diff --git a/.github/labeler.yml b/.github/labeler.yml
index 7f1ac6d2ea32..f97045795fdd 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -162,7 +162,7 @@
       - any-glob-to-any-file:
         - doc/languages-frameworks/gnome.section.md
         - nixos/modules/services/desktops/gnome/**/*
-        - nixos/modules/services/x11/desktop-managers/gnome.nix
+        - nixos/modules/services/desktop-managers/gnome.nix
         - nixos/tests/gnome-xorg.nix
         - nixos/tests/gnome.nix
         - pkgs/desktops/gnome/**/*
diff --git a/.github/workflows/check-cherry-picks.yml b/.github/workflows/check-cherry-picks.yml
index e85fa59bb699..3c6ef1d18920 100644
--- a/.github/workflows/check-cherry-picks.yml
+++ b/.github/workflows/check-cherry-picks.yml
@@ -20,7 +20,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
-          filter: blob:none
+          filter: tree:0
           path: trusted
 
       - name: Check cherry-picks
@@ -28,4 +28,4 @@ jobs:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
-          ./trusted/maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"
+          ./trusted/ci/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"
diff --git a/ci/OWNERS b/ci/OWNERS
index d20533053d17..716dfd2df5b7 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -165,6 +165,13 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 ## common-updater-scripts
 /pkgs/common-updater/scripts/update-source-version    @jtojnar
 
+# Android tools, libraries, and environments
+/pkgs/development/android*                    @NixOS/android
+/pkgs/development/mobile/android*             @NixOS/android
+/pkgs/applications/editors/android-studio*    @NixOS/android
+/doc/languages-frameworks/android*            @NixOS/android
+/pkgs/by-name/an/android*                     @NixOS/android
+
 # Python-related code and docs
 /doc/languages-frameworks/python.section.md   @mweinelt @natsukium
 /maintainers/scripts/update-python-libraries  @mweinelt @natsukium
@@ -470,6 +477,9 @@ pkgs/development/interpreters/erlang/   @NixOS/beam
 pkgs/development/interpreters/elixir/   @NixOS/beam
 pkgs/development/interpreters/lfe/      @NixOS/beam
 
+# Authelia
+pkgs/servers/authelia/ @06kellyjac @dit7ya @nicomem
+
 # OctoDNS
 pkgs/by-name/oc/octodns/ @anthonyroussel
 
diff --git a/maintainers/scripts/check-cherry-picks.sh b/ci/check-cherry-picks.sh
similarity index 54%
rename from maintainers/scripts/check-cherry-picks.sh
rename to ci/check-cherry-picks.sh
index e7ffe2bf4c73..612174925f57 100755
--- a/maintainers/scripts/check-cherry-picks.sh
+++ b/ci/check-cherry-picks.sh
@@ -1,17 +1,25 @@
 #!/usr/bin/env bash
 # Find alleged cherry-picks
 
-set -e
+set -eo pipefail
 
 if [ $# != "2" ] ; then
   echo "usage: check-cherry-picks.sh base_rev head_rev"
   exit 2
 fi
 
-PICKABLE_BRANCHES=${PICKABLE_BRANCHES:-master staging release-??.?? staging-??.??}
+# Make sure we are inside the nixpkgs repo, even when called from outside
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+PICKABLE_BRANCHES="master release-??.?? staging-??.?? haskell-updates python-updates"
 problem=0
 
-while read new_commit_sha ; do
+# Not everyone calls their remote "origin"
+remote="$(git remote -v | grep -i 'NixOS/nixpkgs' | head -n1 | cut -f1 || true)"
+
+commits="$(git rev-list --reverse "$1..$2")"
+
+while read -r new_commit_sha ; do
   if [ -z "$new_commit_sha" ] ; then
     continue  # skip empty lines
   fi
@@ -26,30 +34,47 @@ while read new_commit_sha ; do
   original_commit_sha=$(
     git rev-list --max-count=1 --format=format:%B "$new_commit_sha" \
     | grep -Ei -m1 "cherry.*[0-9a-f]{40}" \
-    | grep -Eoi -m1 '[0-9a-f]{40}'
+    | grep -Eoi -m1 '[0-9a-f]{40}' || true
   )
-  if [ "$?" != "0" ] ; then
-    echo "  ? Couldn't locate original commit hash in message"
-    [ "$GITHUB_ACTIONS" = 'true' ] && echo ::endgroup::
+  if [ -z "$original_commit_sha" ] ; then
+    if [ "$GITHUB_ACTIONS" = 'true' ] ; then
+      echo ::endgroup::
+      echo -n "::error ::"
+    else
+      echo -n "  ✘ "
+    fi
+    echo "Couldn't locate original commit hash in message"
+    echo "Note this should not necessarily be treated as a hard fail, but a reviewer's attention should" \
+      "be drawn to it and github actions have no way of doing that but to raise a 'failure'"
+    problem=1
     continue
   fi
 
   set -f # prevent pathname expansion of patterns
-  for branch_pattern in $PICKABLE_BRANCHES ; do
+  for pattern in $PICKABLE_BRANCHES ; do
     set +f # re-enable pathname expansion
 
+    # Reverse sorting by refname and taking one match only means we can only backport
+    # from unstable and the latest stable. That makes sense, because even right after
+    # branch-off, when we have two supported stable branches, we only ever want to cherry-pick
+    # **to** the older one, but never **from** it.
+    # This makes the job significantly faster in the case when commits can't be found,
+    # because it doesn't need to iterate through 20+ branches, which all need to be fetched.
+    branches="$(git for-each-ref --sort=-refname --format="%(refname)" \
+      "refs/remotes/${remote:-origin}/$pattern" | head -n1)"
+
     while read -r picked_branch ; do
       if git merge-base --is-ancestor "$original_commit_sha" "$picked_branch" ; then
         echo "  ✔ $original_commit_sha present in branch $picked_branch"
 
-        range_diff_common='git range-diff
+        range_diff_common='git --no-pager range-diff
           --no-notes
           --creation-factor=100
           '"$original_commit_sha~..$original_commit_sha"'
           '"$new_commit_sha~..$new_commit_sha"'
         '
 
-        if $range_diff_common --no-color | grep -E '^ {4}[+-]{2}' > /dev/null ; then
+        if $range_diff_common --no-color 2> /dev/null | grep -E '^ {4}[+-]{2}' > /dev/null ; then
           if [ "$GITHUB_ACTIONS" = 'true' ] ; then
             echo ::endgroup::
             echo -n "::warning ::"
@@ -72,11 +97,7 @@ while read new_commit_sha ; do
         # move on to next commit
         continue 3
       fi
-    done <<< "$(
-      git for-each-ref \
-      --format="%(refname)" \
-      "refs/remotes/origin/$branch_pattern"
-    )"
+    done <<< "$branches"
   done
 
   if [ "$GITHUB_ACTIONS" = 'true' ] ; then
@@ -88,10 +109,6 @@ while read new_commit_sha ; do
   echo "$original_commit_sha not found in any pickable branch"
 
   problem=1
-done <<< "$(
-  git rev-list \
-    -E -i --grep="cherry.*[0-9a-f]{40}" --reverse \
-    "$1..$2"
-)"
+done <<< "$commits"
 
 exit $problem
diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 82f69e1c9a44..cbb77bc89bd3 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -73,7 +73,9 @@ let
       # The number of attributes per chunk, see ./README.md for more info.
       chunkSize,
       checkMeta ? true,
-      includeBroken ? true,
+
+      # Don't try to eval packages marked as broken.
+      includeBroken ? false,
       # Whether to just evaluate a single chunk for quick testing
       quickTest ? false,
     }:
diff --git a/doc/build-helpers/fetchers.chapter.md b/doc/build-helpers/fetchers.chapter.md
index 997f97f81bdb..96b85d7b0d4f 100644
--- a/doc/build-helpers/fetchers.chapter.md
+++ b/doc/build-helpers/fetchers.chapter.md
@@ -795,6 +795,10 @@ Additionally, the following optional arguments can be given:
 : Clone the entire repository as opposing to just creating a shallow clone.
   This implies `leaveDotGit`.
 
+*`fetchTags`* (Boolean)
+
+: Whether to fetch all tags from the remote repository. This is useful when the build process needs to run `git describe` or other commands that require tag information to be available. This parameter implies `leaveDotGit`, as tags are stored in the `.git` directory.
+
 *`sparseCheckout`* (List of String)
 
 : Prevent git from fetching unnecessary blobs from server.
diff --git a/doc/languages-frameworks/agda.section.md b/doc/languages-frameworks/agda.section.md
index 6b9e577f8119..d5a1c6ef08a3 100644
--- a/doc/languages-frameworks/agda.section.md
+++ b/doc/languages-frameworks/agda.section.md
@@ -121,6 +121,8 @@ agda.withPackages {
 }
 ```
 
+To install Agda without GHC, use `ghc = null;`.
+
 ## Writing Agda packages {#writing-agda-packages}
 
 To write a nix derivation for an Agda library, first check that the library has a `*.agda-lib` file.
diff --git a/doc/languages-frameworks/cuda.section.md b/doc/languages-frameworks/cuda.section.md
index 091fc57a53a0..535ce02efbc6 100644
--- a/doc/languages-frameworks/cuda.section.md
+++ b/doc/languages-frameworks/cuda.section.md
@@ -115,8 +115,8 @@ All new projects should use the CUDA redistributables available in [`cudaPackage
 
 ### Updating supported compilers and GPUs {#updating-supported-compilers-and-gpus}
 
-1. Update `nvcc-compatibilities.nix` in `pkgs/development/cuda-modules/` to include the newest release of NVCC, as well as any newly supported host compilers.
-2. Update `gpus.nix` in `pkgs/development/cuda-modules/` to include any new GPUs supported by the new release of CUDA.
+1. Update `nvccCompatibilities` in `pkgs/development/cuda-modules/_cuda/data/nvcc.nix` to include the newest release of NVCC, as well as any newly supported host compilers.
+2. Update `cudaCapabilityToInfo` in `pkgs/development/cuda-modules/_cuda/data/cuda.nix` to include any new GPUs supported by the new release of CUDA.
 
 ### Updating the CUDA Toolkit runfile installer {#updating-the-cuda-toolkit}
 
diff --git a/doc/languages-frameworks/neovim.section.md b/doc/languages-frameworks/neovim.section.md
index 71bc52b541dc..b8a7e259a2bb 100644
--- a/doc/languages-frameworks/neovim.section.md
+++ b/doc/languages-frameworks/neovim.section.md
@@ -59,7 +59,7 @@ For instance, `sqlite-lua` needs `g:sqlite_clib_path` to be set to work. Nixpkgs
 - `neovimRcContent`: Extra vimL code sourced by the generated `init.lua`.
 - `wrapperArgs`: Extra arguments forwarded to the `makeWrapper` call.
 - `wrapRc`: Nix, not being able to write in your `$HOME`, loads the
-  generated Neovim configuration via its  `-u` argument, i.e. : `-u /nix/store/...generatedInit.lua`. This has side effects like preventing Neovim from reading your config in `$XDG_CONFIG_HOME` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#_initialization) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse while reusing the logic of the nixpkgs wrapper and access the generated config via `neovim.passthru.initRc`.
+  generated Neovim configuration via the `$VIMINIT` environment variable, i.e. : `export VIMINIT='lua dofile("/nix/store/…-init.lua")'`. This has side effects like preventing Neovim from sourcing your `init.lua` in `$XDG_CONFIG_HOME/nvim` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#startup) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse the generated vimscript init code via `neovim.passthru.initRc`.
 - `plugins`: A list of plugins to add to the wrapper.
 
 ```
diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index ebd6dee23041..8a395089426d 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -28,7 +28,7 @@
   - Applications linked against different Mesa versions than installed on the system should now work correctly going forward (however, applications against older Mesa, e.g. from Nixpkgs releases before 25.05, remain broken)
   - Packages that used to depend on Mesa for libgbm or libdri should use `libgbm` or `dri-pkgconfig-stub` as inputs, respectively
 
-- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.
+- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.
 
 - Emacs has been updated to 30.1.
   This introduces some backwards‐incompatible changes; see the NEWS for details.
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 33a2138756b7..dc12ad11a466 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -37,4 +37,6 @@
 
 ### Additions and Improvements {#sec-nixpkgs-release-25.11-lib-additions-improvements}
 
-- Create the first release note entry in this section!
+- `neovim`: Added support for the `vim.o.exrc` option, the `VIMINIT` environment variable, and sourcing of `sysinit.vim`.
+
+  See the neovim help page [`:help startup`](https://neovim.io/doc/user/starting.html#startup) for more information, as well as [the nixpkgs neovim wrapper documentation](#neovim-custom-configuration).
diff --git a/lib/default.nix b/lib/default.nix
index 63e02882e2c3..6f8530296044 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -309,6 +309,7 @@ let
         stringLength
         substring
         isString
+        replaceString
         replaceStrings
         intersperse
         concatStringsSep
diff --git a/lib/gvariant.nix b/lib/gvariant.nix
index d316a3254a25..e66217db8188 100644
--- a/lib/gvariant.nix
+++ b/lib/gvariant.nix
@@ -18,7 +18,7 @@ let
     concatStrings
     escape
     head
-    replaceStrings
+    replaceString
     ;
 
   mkPrimitive = t: v: {
@@ -451,7 +451,7 @@ rec {
   mkString =
     v:
     let
-      sanitize = s: replaceStrings [ "\n" ] [ "\\n" ] (escape [ "'" "\\" ] s);
+      sanitize = s: replaceString "\n" "\\n" (escape [ "'" "\\" ] s);
     in
     mkPrimitive type.string v
     // {
diff --git a/lib/strings.nix b/lib/strings.nix
index ba8c47b69037..359e1a4cd8db 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -332,6 +332,41 @@ rec {
   */
   concatLines = concatMapStrings (s: s + "\n");
 
+  /**
+    Given string `s`, replace every occurrence of the string `from` with the string `to`.
+
+    # Inputs
+
+    `from`
+    : The string to be replaced
+
+    `to`
+    : The string to replace with
+
+    `s`
+    : The original string where replacements will be made
+
+    # Type
+
+    ```
+    replaceString :: string -> string -> string -> string
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.strings.replaceString` usage example
+
+    ```nix
+    replaceString "world" "Nix" "Hello, world!"
+    => "Hello, Nix!"
+    replaceString "." "_" "v1.2.3"
+    => "v1_2_3"
+    ```
+
+    :::
+  */
+  replaceString = from: to: replaceStrings [ from ] [ to ];
+
   /**
     Repeat a string `n` times,
     and concatenate the parts into a new string.
@@ -1138,7 +1173,7 @@ rec {
       string = toString arg;
     in
     if match "[[:alnum:],._+:@%/-]+" string == null then
-      "'${replaceStrings [ "'" ] [ "'\\''" ] string}'"
+      "'${replaceString "'" "'\\''" string}'"
     else
       string;
 
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 4d4a6d0030a6..6b9da270bf5f 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -14,7 +14,7 @@ let
     optionalAttrs
     optionalString
     removeSuffix
-    replaceStrings
+    replaceString
     toUpper
     ;
 
@@ -522,7 +522,7 @@ let
             #
             # https://github.com/rust-lang/cargo/pull/9169
             # https://github.com/rust-lang/cargo/issues/8285#issuecomment-634202431
-            cargoEnvVarTarget = replaceStrings [ "-" ] [ "_" ] (toUpper final.rust.cargoShortTarget);
+            cargoEnvVarTarget = replaceString "-" "_" (toUpper final.rust.cargoShortTarget);
 
             # True if the target is no_std
             # https://github.com/rust-lang/rust/blob/2e44c17c12cec45b6a682b1e53a04ac5b5fcc9d2/src/bootstrap/config.rs#L415-L421
diff --git a/lib/systems/platforms.nix b/lib/systems/platforms.nix
index 8e3f3621698b..9c9010b9fb46 100644
--- a/lib/systems/platforms.nix
+++ b/lib/systems/platforms.nix
@@ -583,6 +583,14 @@ rec {
       # https://github.com/llvm/llvm-project/pull/132173
       cmodel = "medium";
     };
+    linux-kernel = {
+      name = "loongarch-multiplatform";
+      target = "vmlinuz.efi";
+      autoModules = true;
+      preferBuiltin = true;
+      baseConfig = "defconfig";
+      DTB = true;
+    };
   };
 
   # This function takes a minimally-valid "platform" and returns an
@@ -611,6 +619,9 @@ rec {
     else if platform.isAarch64 then
       if platform.isDarwin then apple-m1 else aarch64-multiplatform
 
+    else if platform.isLoongArch64 then
+      loongarch64-multiplatform
+
     else if platform.isRiscV then
       riscv-multiplatform
 
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 0d8377ec6006..437714a2822e 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -91,6 +91,7 @@ let
     range
     recursiveUpdateUntil
     removePrefix
+    replaceString
     replicate
     runTests
     setFunctionArgs
@@ -497,6 +498,11 @@ runTests {
     expected = "/usr/include:/usr/local/include";
   };
 
+  testReplaceStringString = {
+    expr = strings.replaceString "." "_" "v1.2.3";
+    expected = "v1_2_3";
+  };
+
   testReplicateString = {
     expr = strings.replicate 5 "hello";
     expected = "hellohellohellohellohello";
@@ -1728,6 +1734,11 @@ runTests {
     ];
   };
 
+  testReplaceString = {
+    expr = replaceString "world" "Nix" "Hello, world!";
+    expected = "Hello, Nix!";
+  };
+
   testReplicate = {
     expr = replicate 3 "a";
     expected = [
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index bc4380ec360c..4c3845ff7ac0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6554,7 +6554,7 @@
     name = "DontEatOreo";
     github = "DontEatOreo";
     githubId = 57304299;
-    keys = [ { fingerprint = "33CD 5C0A 673C C54D 661E  5E4C 0DB5 361B EEE5 30AB"; } ];
+    matrix = "@donteatoreo:matrix.org";
   };
   dopplerian = {
     name = "Dopplerian";
@@ -13037,12 +13037,6 @@
     githubId = 843652;
     name = "Kim Burgess";
   };
-  kindrowboat = {
-    email = "hello@kindrobot.ca";
-    github = "kindrowboat";
-    githubId = 777773;
-    name = "Stef Dunlap";
-  };
   kini = {
     email = "keshav.kini@gmail.com";
     github = "kini";
@@ -16604,8 +16598,10 @@
   moraxyc = {
     name = "Moraxyc Xu";
     email = "i@qaq.li";
+    matrix = "@moraxyc:qaq.li";
     github = "Moraxyc";
     githubId = 69713071;
+    keys = [ { fingerprint = "7DD1 A4DF 7DD6 AEEB F07B  1108 8296 4F3A B1D9 DE79"; } ];
   };
   moredread = {
     email = "code@apb.name";
@@ -17609,7 +17605,7 @@
   };
   nicoo = {
     email = "nicoo@debian.org";
-    github = "nbraud";
+    github = "nicoonoclaste";
     githubId = 1155801;
     name = "nicoo";
     keys = [ { fingerprint = "E44E 9EA5 4B8E 256A FB73 49D3 EC9D 3708 72BC 7A8C"; } ];
@@ -22924,6 +22920,11 @@
     matrix = "@c3n21:matrix.org";
     githubId = 37077738;
   };
+  sinjin2300 = {
+    name = "Sinjin";
+    github = "Sinjin2300";
+    githubId = 35543336;
+  };
   sioodmy = {
     name = "Antoni Sokołowski";
     github = "sioodmy";
@@ -23437,6 +23438,13 @@
     githubId = 16364318;
     name = "Jeffrey Harmon";
   };
+  squat = {
+    matrix = "@squat:beeper.com";
+    name = "squat";
+    github = "squat";
+    githubId = 20484159;
+    keys = [ { fingerprint = "F246 425A 7650 6F37 0552  BA8D DEA9 C405 09D9 65F5"; } ];
+  };
   srghma = {
     email = "srghma@gmail.com";
     github = "srghma";
@@ -26717,6 +26725,12 @@
     githubId = 9132420;
     keys = [ { fingerprint = "F943 A0BC 720C 5BEF 73CD E02D B398 93FA 5F65 CAE1"; } ];
   };
+  womeier = {
+    name = "Wolfgang Meier";
+    email = "womeier@posteo.de";
+    github = "womeier";
+    githubId = 55190123;
+  };
   womfoo = {
     email = "kranium@gikos.net";
     github = "womfoo";
diff --git a/nixos/doc/manual/configuration/x-windows.chapter.md b/nixos/doc/manual/configuration/x-windows.chapter.md
index ec07e146de93..5569f9d123ed 100644
--- a/nixos/doc/manual/configuration/x-windows.chapter.md
+++ b/nixos/doc/manual/configuration/x-windows.chapter.md
@@ -29,7 +29,7 @@ Thus you should pick one or more of the following lines:
 {
   services.xserver.desktopManager.plasma5.enable = true;
   services.xserver.desktopManager.xfce.enable = true;
-  services.xserver.desktopManager.gnome.enable = true;
+  services.desktopManager.gnome.enable = true;
   services.xserver.desktopManager.mate.enable = true;
   services.xserver.windowManager.xmonad.enable = true;
   services.xserver.windowManager.twm.enable = true;
@@ -46,7 +46,7 @@ alternative one by picking one of the following lines:
 ```nix
 {
   services.displayManager.sddm.enable = true;
-  services.xserver.displayManager.gdm.enable = true;
+  services.displayManager.gdm.enable = true;
 }
 ```
 
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 883ccb4e7abb..7a3982c95795 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -20,7 +20,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 - GNOME has been updated to version 48.
 
   - `decibels` music player is now installed by default. You can disable it using [](#opt-environment.gnome.excludePackages).
-  - `gnome-shell-extensions` extension collection (which included GNOME Classic extensions, Apps Menu, and User Themes, among others) are no longer installed by default. You can install them again with [](#opt-services.xserver.desktopManager.gnome.sessionPath).
+  - `gnome-shell-extensions` extension collection (which included GNOME Classic extensions, Apps Menu, and User Themes, among others) are no longer installed by default. You can install them again with {option}`services.xserver.desktopManager.gnome.sessionPath`.
   - Option [](#opt-services.gnome.core-developer-tools.enable) now also installs `sysprof` and `d-spy`.
   - Option `services.gnome.core-utilities.enable` has been renamed to [](#opt-services.gnome.core-apps.enable).
   - `cantarell-fonts`, `source-code-pro` and `source-sans` fonts are no longer installed by default. They have been replaced by `adwaita-fonts`.
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index d86c9b80de3a..8ce0ca415f58 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -12,6 +12,11 @@
 
 - [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).
 
+- [FileBrowser](https://filebrowser.org/), a web application for managing and sharing files. Available as [services.filebrowser](#opt-services.filebrowser.enable).
+
+- [LACT](https://github.com/ilya-zlobintsev/LACT), a GPU monitoring and configuration tool, can now be enabled through [services.lact.enable](#opt-services.lact.enable).
+  Note that for LACT to work properly on AMD GPU systems, you need to enable [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable).
+
 - [SuiteNumérique Docs](https://github.com/suitenumerique/docs), a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as [services.lasuite-docs](#opt-services.lasuite-docs.enable).
 
 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
@@ -27,3 +32,6 @@
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 - `services.clamsmtp` is unmaintained and was removed from Nixpkgs.
+
+- `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
+  This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.
diff --git a/nixos/modules/config/swap.nix b/nixos/modules/config/swap.nix
index 20db5f8a40a4..cdc8d673ee12 100644
--- a/nixos/modules/config/swap.nix
+++ b/nixos/modules/config/swap.nix
@@ -277,6 +277,7 @@ in
             # avoid this race condition.
             after = [ "systemd-modules-load.service" ];
             wantedBy = [ "${realDevice'}.swap" ];
+            requiredBy = lib.optionals sw.randomEncryption.enable [ "${realDevice'}.swap" ];
             before = [
               "${realDevice'}.swap"
               "shutdown.target"
diff --git a/nixos/modules/hardware/corectrl.nix b/nixos/modules/hardware/corectrl.nix
index 6e680ddc846e..bbe59d1b5b9d 100644
--- a/nixos/modules/hardware/corectrl.nix
+++ b/nixos/modules/hardware/corectrl.nix
@@ -8,13 +8,23 @@ let
   inherit (lib)
     mkEnableOption
     mkIf
-    mkOption
     mkPackageOption
     ;
 
   cfg = config.programs.corectrl;
 in
 {
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "programs" "corectrl" "gpuOverclock" "enable" ]
+      [ "hardware" "amdgpu" "overdrive" "enable" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "programs" "corectrl" "gpuOverclock" "ppfeaturemask" ]
+      [ "hardware" "amdgpu" "overdrive" "ppfeaturemask" ]
+    )
+  ];
+
   options.programs.corectrl = {
     enable = mkEnableOption ''
       CoreCtrl, a tool to overclock amd graphics cards and processors.
@@ -24,23 +34,6 @@ in
     package = mkPackageOption pkgs "corectrl" {
       extraDescription = "Useful for overriding the configuration options used for the package.";
     };
-
-    gpuOverclock = {
-      enable = mkEnableOption ''
-        GPU overclocking
-      '';
-      ppfeaturemask = mkOption {
-        type = lib.types.str;
-        default = "0xfffd7fff";
-        example = "0xffffffff";
-        description = ''
-          Sets the `amdgpu.ppfeaturemask` kernel option.
-          In particular, it is used here to set the overdrive bit.
-          Default is `0xfffd7fff` as it is less likely to cause flicker issues.
-          Setting it to `0xffffffff` enables all features.
-        '';
-      };
-    };
   };
 
   config = mkIf cfg.enable {
@@ -61,12 +54,6 @@ in
           }
       });
     '';
-
-    # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/amd/include/amd_shared.h#n169
-    # The overdrive bit
-    boot.kernelParams = mkIf cfg.gpuOverclock.enable [
-      "amdgpu.ppfeaturemask=${cfg.gpuOverclock.ppfeaturemask}"
-    ];
   };
 
   meta.maintainers = with lib.maintainers; [
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix
index eda704381db0..1a5e741c4597 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix
@@ -7,7 +7,7 @@
 
   isoImage.edition = lib.mkDefault "gnome";
 
-  services.xserver.desktopManager.gnome = {
+  services.desktopManager.gnome = {
     # Add Firefox and other tools useful for installation to the launcher
     favoriteAppsOverride = ''
       [org.gnome.shell]
@@ -35,7 +35,7 @@
     QT_QPA_PLATFORM = "$([[ $XDG_SESSION_TYPE = \"wayland\" ]] && echo \"wayland\")";
   };
 
-  services.xserver.displayManager.gdm = {
+  services.displayManager.gdm = {
     enable = true;
     # autoSuspend makes the machine automatically suspend after inactivity.
     # It's possible someone could/try to ssh'd into the machine and obviously
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix
index 7b355b191455..afee096d8579 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix
@@ -7,7 +7,7 @@
 
   isoImage.edition = lib.mkDefault "gnome";
 
-  services.xserver.desktopManager.gnome = {
+  services.desktopManager.gnome = {
     # Add Firefox and other tools useful for installation to the launcher
     favoriteAppsOverride = ''
       [org.gnome.shell]
@@ -16,7 +16,7 @@
     enable = true;
   };
 
-  services.xserver.displayManager.gdm = {
+  services.displayManager.gdm = {
     enable = true;
     # autoSuspend makes the machine automatically suspend after inactivity.
     # It's possible someone could/try to ssh'd into the machine and obviously
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index f864dbf613b2..b618a08fc379 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -589,6 +589,7 @@
   ./services/development/zammad.nix
   ./services/display-managers/cosmic-greeter.nix
   ./services/display-managers/default.nix
+  ./services/display-managers/gdm.nix
   ./services/display-managers/greetd.nix
   ./services/display-managers/ly.nix
   ./services/display-managers/sddm.nix
@@ -645,6 +646,7 @@
   ./services/hardware/kanata.nix
   ./services/hardware/keyd.nix
   ./services/hardware/kmonad.nix
+  ./services/hardware/lact.nix
   ./services/hardware/lcd.nix
   ./services/hardware/libinput.nix
   ./services/hardware/lirc.nix
@@ -1535,6 +1537,7 @@
   ./services/web-apps/engelsystem.nix
   ./services/web-apps/ethercalc.nix
   ./services/web-apps/fider.nix
+  ./services/web-apps/filebrowser.nix
   ./services/web-apps/filesender.nix
   ./services/web-apps/firefly-iii-data-importer.nix
   ./services/web-apps/firefly-iii.nix
@@ -1706,7 +1709,6 @@
   ./services/x11/colord.nix
   ./services/x11/desktop-managers/default.nix
   ./services/x11/display-managers/default.nix
-  ./services/x11/display-managers/gdm.nix
   ./services/x11/display-managers/lightdm.nix
   ./services/x11/display-managers/slim.nix
   ./services/x11/display-managers/startx.nix
diff --git a/nixos/modules/programs/gpaste.nix b/nixos/modules/programs/gpaste.nix
index 042bd812cca7..4918edc95bfa 100644
--- a/nixos/modules/programs/gpaste.nix
+++ b/nixos/modules/programs/gpaste.nix
@@ -27,7 +27,7 @@
     services.dbus.packages = [ pkgs.gpaste ];
     systemd.packages = [ pkgs.gpaste ];
     # gnome-control-center crashes in Keyboard Shortcuts pane without the GSettings schemas.
-    services.xserver.desktopManager.gnome.sessionPath = [ pkgs.gpaste ];
+    services.desktopManager.gnome.sessionPath = [ pkgs.gpaste ];
     # gpaste-reloaded applet doesn't work without the typelib
     services.xserver.desktopManager.cinnamon.sessionPath = [ pkgs.gpaste ];
   };
diff --git a/nixos/modules/programs/nautilus-open-any-terminal.nix b/nixos/modules/programs/nautilus-open-any-terminal.nix
index 41f26e03d312..1293f6892375 100644
--- a/nixos/modules/programs/nautilus-open-any-terminal.nix
+++ b/nixos/modules/programs/nautilus-open-any-terminal.nix
@@ -28,7 +28,7 @@ in
       nautilus-open-any-terminal
     ];
 
-    environment.sessionVariables = lib.mkIf (!config.services.xserver.desktopManager.gnome.enable) {
+    environment.sessionVariables = lib.mkIf (!config.services.desktopManager.gnome.enable) {
       NAUTILUS_4_EXTENSION_DIR = "${pkgs.nautilus-python}/lib/nautilus/extensions-4";
     };
 
diff --git a/nixos/modules/programs/vim.nix b/nixos/modules/programs/vim.nix
index c84f966eb3a7..80dc3cdd3959 100644
--- a/nixos/modules/programs/vim.nix
+++ b/nixos/modules/programs/vim.nix
@@ -14,7 +14,7 @@ in
 
     defaultEditor = lib.mkEnableOption "vim as the default editor";
 
-    package = lib.mkPackageOption pkgs "vim" { example = "vim-full"; };
+    package = lib.mkPackageOption pkgs "vim" { example = [ "vim-full" ]; };
   };
 
   # TODO: convert it into assert after 24.11 release
diff --git a/nixos/modules/programs/zoom-us.nix b/nixos/modules/programs/zoom-us.nix
index 22c6e3f8eedd..b5b6c8acf7b6 100644
--- a/nixos/modules/programs/zoom-us.nix
+++ b/nixos/modules/programs/zoom-us.nix
@@ -33,7 +33,7 @@
 
         # Support GNOME desktop environment if it's enabled on the system.
         gnomeXdgDesktopPortalSupport =
-          prev.gnomeXdgDesktopPortalSupport or config.services.xserver.desktopManager.gnome.enable;
+          prev.gnomeXdgDesktopPortalSupport or config.services.desktopManager.gnome.enable;
 
         # Support Hyprland desktop for Wayland if it's enabled on the system.
         hyprlandXdgDesktopPortalSupport =
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index ad4e32e82561..0020ace8da5d 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -249,6 +249,23 @@ let
               to provide Google Authenticator token to log in.
             '';
           };
+          allowNullOTP = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Whether to allow login for accounts that have no OTP set
+              (i.e., accounts with no OTP configured or no existing
+              {file}`~/.google_authenticator`).
+            '';
+          };
+          forwardPass = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              The authentication provides a single field requiring
+              the user's password followed by the one-time password (OTP).
+            '';
+          };
         };
 
         otpwAuth = lib.mkOption {
@@ -1048,6 +1065,8 @@ let
                       modulePath = "${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so";
                       settings = {
                         no_increment_hotp = true;
+                        forward_pass = cfg.googleAuthenticator.forwardPass;
+                        nullok = cfg.googleAuthenticator.allowNullOTP;
                       };
                     }
                     {
diff --git a/nixos/modules/services/cluster/kubernetes/kubelet.nix b/nixos/modules/services/cluster/kubernetes/kubelet.nix
index aa759e20f49f..ca7b524081f6 100644
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@@ -336,7 +336,10 @@ in
           [
             gitMinimal
             openssh
-            util-linux
+            # TODO (#409339): remove this patch. We had to add it to avoid a mass rebuild
+            # for the 25.05 release. Once the staging cycle referenced in the above PR completes,
+            # switch back to plain util-linux.
+            util-linux.withPatches
             iproute2
             ethtool
             thin-provisioning-tools
diff --git a/nixos/modules/services/x11/desktop-managers/gnome.md b/nixos/modules/services/desktop-managers/gnome.md
similarity index 92%
rename from nixos/modules/services/x11/desktop-managers/gnome.md
rename to nixos/modules/services/desktop-managers/gnome.md
index 7f7801305e23..4b45b0872aa7 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome.md
+++ b/nixos/modules/services/desktop-managers/gnome.md
@@ -10,8 +10,8 @@ To enable the GNOME desktop use:
 
 ```nix
 {
-  services.xserver.desktopManager.gnome.enable = true;
-  services.xserver.displayManager.gdm.enable = true;
+  services.desktopManager.gnome.enable = true;
+  services.displayManager.gdm.enable = true;
 }
 ```
 
@@ -76,17 +76,17 @@ GNOME Flashback provides a desktop environment based on the classic GNOME 2 arch
 
 ```nix
 {
-  services.xserver.desktopManager.gnome.flashback.enableMetacity = true;
+  services.desktopManager.gnome.flashback.enableMetacity = true;
 }
 ```
 
-It is also possible to create custom sessions that replace Metacity with a different window manager using [](#opt-services.xserver.desktopManager.gnome.flashback.customSessions).
+It is also possible to create custom sessions that replace Metacity with a different window manager using [](#opt-services.desktopManager.gnome.flashback.customSessions).
 
 The following example uses `xmonad` window manager:
 
 ```nix
 {
-  services.xserver.desktopManager.gnome.flashback.customSessions = [
+  services.desktopManager.gnome.flashback.customSessions = [
     {
       wmName = "xmonad";
       wmLabel = "XMonad";
@@ -143,10 +143,10 @@ Overrides really only change the default values for GSettings keys so if you or
 :::
 
 You can override the default GSettings values using the
-[](#opt-services.xserver.desktopManager.gnome.extraGSettingsOverrides) option.
+[](#opt-services.desktopManager.gnome.extraGSettingsOverrides) option.
 
 Take note that whatever packages you want to override GSettings for, you need to add them to
-[](#opt-services.xserver.desktopManager.gnome.extraGSettingsOverridePackages).
+[](#opt-services.desktopManager.gnome.extraGSettingsOverridePackages).
 
 You can use `dconf-editor` tool to explore which GSettings you can set.
 
@@ -154,7 +154,7 @@ You can use `dconf-editor` tool to explore which GSettings you can set.
 
 ```nix
 {
-  services.xserver.desktopManager.gnome = {
+  services.desktopManager.gnome = {
     extraGSettingsOverrides = ''
       # Change default background
       [org.gnome.desktop.background]
diff --git a/nixos/modules/services/x11/desktop-managers/gnome.nix b/nixos/modules/services/desktop-managers/gnome.nix
similarity index 91%
rename from nixos/modules/services/x11/desktop-managers/gnome.nix
rename to nixos/modules/services/desktop-managers/gnome.nix
index 1f980444e644..aa86bc81f70e 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/nixos/modules/services/desktop-managers/gnome.nix
@@ -15,7 +15,7 @@ let
     literalExpression
     ;
 
-  cfg = config.services.xserver.desktopManager.gnome;
+  cfg = config.services.desktopManager.gnome;
   serviceCfg = config.services.gnome;
 
   # Prioritize nautilus by default when opening directories
@@ -78,13 +78,45 @@ let
 in
 
 {
-
   meta = {
     doc = ./gnome.md;
     maintainers = lib.teams.gnome.members;
   };
 
   imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "desktopManager" "gnome" "enable" ]
+      [ "services" "desktopManager" "gnome" "enable" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "desktopManager" "gnome" "extraGSettingsOverrides" ]
+      [ "services" "desktopManager" "gnome" "extraGSettingsOverrides" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "desktopManager" "gnome" "extraGSettingsOverridePackages" ]
+      [ "services" "desktopManager" "gnome" "extraGSettingsOverridePackages" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "desktopManager" "gnome" "debug" ]
+      [ "services" "desktopManager" "gnome" "debug" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "desktopManager" "gnome" "sessionPath" ]
+      [ "services" "desktopManager" "gnome" "sessionPath" ]
+    )
+    # flashback options
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "desktopManager" "gnome" "flashback" "customSessions" ]
+      [ "services" "desktopManager" "gnome" "flashback" "customSessions" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "desktopManager" "gnome" "flashback" "enableMetacity" ]
+      [ "services" "desktopManager" "gnome" "flashback" "enableMetacity" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "desktopManager" "gnome" "flashback" "panelModulePackages" ]
+      [ "services" "desktopManager" "gnome" "flashback" "panelModulePackages" ]
+    )
     (lib.mkRenamedOptionModule
       [ "services" "gnome" "core-utilities" "enable" ]
       [ "services" "gnome" "core-apps" "enable" ]
@@ -101,7 +133,7 @@ in
       games.enable = mkEnableOption "GNOME games";
     };
 
-    services.xserver.desktopManager.gnome = {
+    services.desktopManager.gnome = {
       enable = mkOption {
         type = types.bool;
         default = false;
@@ -213,8 +245,8 @@ in
       system.nixos-generate-config.desktopConfiguration = [
         ''
           # Enable the GNOME Desktop Environment.
-          services.xserver.displayManager.gdm.enable = true;
-          services.xserver.desktopManager.gnome.enable = true;
+          services.displayManager.gdm.enable = true;
+          services.desktopManager.gnome.enable = true;
         ''
       ];
 
@@ -333,7 +365,7 @@ in
     })
 
     (lib.mkIf serviceCfg.core-shell.enable {
-      services.xserver.desktopManager.gnome.sessionPath = [
+      services.desktopManager.gnome.sessionPath = [
         pkgs.gnome-shell
       ];
 
diff --git a/nixos/modules/services/desktops/telepathy.nix b/nixos/modules/services/desktops/telepathy.nix
index cfab2c3a413f..b60c7e0199c5 100644
--- a/nixos/modules/services/desktops/telepathy.nix
+++ b/nixos/modules/services/desktops/telepathy.nix
@@ -8,7 +8,7 @@
 {
 
   meta = {
-    maintainers = lib.teams.gnome.members;
+    maintainers = [ ];
   };
 
   ###### interface
@@ -37,11 +37,6 @@
     environment.systemPackages = [ pkgs.telepathy-mission-control ];
 
     services.dbus.packages = [ pkgs.telepathy-mission-control ];
-
-    # Enable runtime optional telepathy in gnome-shell
-    services.xserver.desktopManager.gnome.sessionPath = with pkgs; [
-      telepathy-glib
-    ];
   };
 
 }
diff --git a/nixos/modules/services/display-managers/default.nix b/nixos/modules/services/display-managers/default.nix
index 2bcef6106cc0..50afbd9f6ffb 100644
--- a/nixos/modules/services/display-managers/default.nix
+++ b/nixos/modules/services/display-managers/default.nix
@@ -257,7 +257,7 @@ in
         dmConf = config.services.xserver.displayManager;
         noDmUsed =
           !(
-            dmConf.gdm.enable || cfg.sddm.enable || dmConf.xpra.enable || dmConf.lightdm.enable || cfg.ly.enable
+            cfg.gdm.enable || cfg.sddm.enable || dmConf.xpra.enable || dmConf.lightdm.enable || cfg.ly.enable
           );
       in
       lib.mkIf noDmUsed (lib.mkDefault false);
diff --git a/nixos/modules/services/x11/display-managers/gdm.nix b/nixos/modules/services/display-managers/gdm.nix
similarity index 86%
rename from nixos/modules/services/x11/display-managers/gdm.nix
rename to nixos/modules/services/display-managers/gdm.nix
index 5973191d6c7c..960684809711 100644
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/display-managers/gdm.nix
@@ -7,19 +7,20 @@
 
 let
 
-  cfg = config.services.xserver.displayManager;
+  cfg = config.services.displayManager.gdm;
   gdm = pkgs.gdm;
+  xdmcfg = config.services.xserver.displayManager;
   pamLogin = config.security.pam.services.login;
   settingsFormat = pkgs.formats.ini { };
-  configFile = settingsFormat.generate "custom.conf" cfg.gdm.settings;
+  configFile = settingsFormat.generate "custom.conf" cfg.settings;
 
   xSessionWrapper =
-    if (cfg.setupCommands == "") then
+    if (xdmcfg.setupCommands == "") then
       null
     else
       pkgs.writeScript "gdm-x-session-wrapper" ''
         #!${pkgs.bash}/bin/bash
-        ${cfg.setupCommands}
+        ${xdmcfg.setupCommands}
         exec "$@"
       '';
 
@@ -41,7 +42,7 @@ let
 
   defaultSessionName = config.services.displayManager.defaultSession;
 
-  setSessionScript = pkgs.callPackage ./account-service-util.nix { };
+  setSessionScript = pkgs.callPackage ../x11/display-managers/account-service-util.nix { };
 in
 
 {
@@ -72,6 +73,35 @@ in
       "gdm"
       "nvidiaWayland"
     ] "We defer to GDM whether Wayland should be enabled.")
+
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "displayManager" "gdm" "enable" ]
+      [ "services" "displayManager" "gdm" "enable" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "displayManager" "gdm" "debug" ]
+      [ "services" "displayManager" "gdm" "debug" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "displayManager" "gdm" "banner" ]
+      [ "services" "displayManager" "gdm" "banner" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "displayManager" "gdm" "settings" ]
+      [ "services" "displayManager" "gdm" "settings" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "displayManager" "gdm" "wayland" ]
+      [ "services" "displayManager" "gdm" "wayland" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "displayManager" "gdm" "autoSuspend" ]
+      [ "services" "displayManager" "gdm" "autoSuspend" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "xserver" "displayManager" "gdm" "autoLogin" "delay" ]
+      [ "services" "displayManager" "gdm" "autoLogin" "delay" ]
+    )
   ];
 
   meta = {
@@ -82,7 +112,7 @@ in
 
   options = {
 
-    services.xserver.displayManager.gdm = {
+    services.displayManager.gdm = {
 
       enable = lib.mkEnableOption "GDM, the GNOME Display Manager";
 
@@ -145,7 +175,7 @@ in
 
   ###### implementation
 
-  config = lib.mkIf cfg.gdm.enable {
+  config = lib.mkIf cfg.enable {
 
     services.xserver.displayManager.lightdm.enable = false;
 
@@ -170,7 +200,7 @@ in
 
       environment =
         {
-          GDM_X_SERVER_EXTRA_ARGS = toString (lib.filter (arg: arg != "-terminate") cfg.xserverArgs);
+          GDM_X_SERVER_EXTRA_ARGS = toString (lib.filter (arg: arg != "-terminate") xdmcfg.xserverArgs);
           XDG_DATA_DIRS = lib.makeSearchPath "share" [
             gdm # for gnome-login.session
             config.services.displayManager.sessionData.desktops
@@ -274,7 +304,7 @@ in
     systemd.user.services.dbus.wantedBy = [ "default.target" ];
 
     programs.dconf.profiles.gdm.databases =
-      lib.optionals (!cfg.gdm.autoSuspend) [
+      lib.optionals (!cfg.autoSuspend) [
         {
           settings."org/gnome/settings-daemon/plugins/power" = {
             sleep-inactive-ac-type = "nothing";
@@ -284,11 +314,11 @@ in
           };
         }
       ]
-      ++ lib.optionals (cfg.gdm.banner != null) [
+      ++ lib.optionals (cfg.banner != null) [
         {
           settings."org/gnome/login-screen" = {
             banner-message-enable = true;
-            banner-message-text = cfg.gdm.banner;
+            banner-message-text = cfg.banner;
           };
         }
       ]
@@ -297,21 +327,21 @@ in
     # Use AutomaticLogin if delay is zero, because it's immediate.
     # Otherwise with TimedLogin with zero seconds the prompt is still
     # presented and there's a little delay.
-    services.xserver.displayManager.gdm.settings = {
+    services.displayManager.gdm.settings = {
       daemon = lib.mkMerge [
-        { WaylandEnable = cfg.gdm.wayland; }
+        { WaylandEnable = cfg.wayland; }
         # nested if else didn't work
-        (lib.mkIf (config.services.displayManager.autoLogin.enable && cfg.gdm.autoLogin.delay != 0) {
+        (lib.mkIf (config.services.displayManager.autoLogin.enable && cfg.autoLogin.delay != 0) {
           TimedLoginEnable = true;
           TimedLogin = config.services.displayManager.autoLogin.user;
-          TimedLoginDelay = cfg.gdm.autoLogin.delay;
+          TimedLoginDelay = cfg.autoLogin.delay;
         })
-        (lib.mkIf (config.services.displayManager.autoLogin.enable && cfg.gdm.autoLogin.delay == 0) {
+        (lib.mkIf (config.services.displayManager.autoLogin.enable && cfg.autoLogin.delay == 0) {
           AutomaticLoginEnable = true;
           AutomaticLogin = config.services.displayManager.autoLogin.user;
         })
       ];
-      debug = lib.mkIf cfg.gdm.debug {
+      debug = lib.mkIf cfg.debug {
         Enable = true;
       };
     };
diff --git a/nixos/modules/services/hardware/amdgpu.nix b/nixos/modules/services/hardware/amdgpu.nix
index 78f47d858105..4aff9cdd077d 100644
--- a/nixos/modules/services/hardware/amdgpu.nix
+++ b/nixos/modules/services/hardware/amdgpu.nix
@@ -16,21 +16,44 @@ in
       series cards. Note: this removes support for analog video outputs,
       which is only available in the `radeon` driver
     '';
+
     initrd.enable = lib.mkEnableOption ''
       loading `amdgpu` kernelModule in stage 1.
       Can fix lower resolution in boot screen during initramfs phase
     '';
+
+    overdrive = {
+      enable = lib.mkEnableOption ''`amdgpu` overdrive mode for overclocking'';
+
+      ppfeaturemask = lib.mkOption {
+        type = lib.types.str;
+        default = "0xfffd7fff";
+        example = "0xffffffff";
+        description = ''
+          Sets the `amdgpu.ppfeaturemask` kernel option. It can be used to enable the overdrive bit.
+          Default is `0xfffd7fff` as it is less likely to cause flicker issues. Setting it to
+          `0xffffffff` enables all features, but also can be unstable. See
+          [the kernel documentation](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/amd/include/amd_shared.h#n169)
+          for more information.
+        '';
+      };
+    };
+
     opencl.enable = lib.mkEnableOption ''OpenCL support using ROCM runtime library'';
     # cfg.amdvlk option is defined in ./amdvlk.nix module
   };
 
   config = {
-    boot.kernelParams = lib.optionals cfg.legacySupport.enable [
-      "amdgpu.si_support=1"
-      "amdgpu.cik_support=1"
-      "radeon.si_support=0"
-      "radeon.cik_support=0"
-    ];
+    boot.kernelParams =
+      lib.optionals cfg.legacySupport.enable [
+        "amdgpu.si_support=1"
+        "amdgpu.cik_support=1"
+        "radeon.si_support=0"
+        "radeon.cik_support=0"
+      ]
+      ++ lib.optionals cfg.overdrive.enable [
+        "amdgpu.ppfeaturemask=${cfg.overdrive.ppfeaturemask}"
+      ];
 
     boot.initrd.kernelModules = lib.optionals cfg.initrd.enable [ "amdgpu" ];
 
diff --git a/nixos/modules/services/hardware/lact.nix b/nixos/modules/services/hardware/lact.nix
new file mode 100644
index 000000000000..e16712338ab8
--- /dev/null
+++ b/nixos/modules/services/hardware/lact.nix
@@ -0,0 +1,39 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.lact;
+in
+{
+  meta.maintainers = [ lib.maintainers.johnrtitor ];
+
+  options.services.lact = {
+    enable = lib.mkEnableOption null // {
+      description = ''
+        Whether to enable LACT, a tool for monitoring, configuring and overclocking GPUs.
+
+        ::: {.note}
+        If you are on an AMD GPU, it is recommended to enable overdrive mode by using
+        `hardware.amdgpu.overdrive.enable = true;` in your configuration.
+        See [LACT wiki](https://github.com/ilya-zlobintsev/LACT/wiki/Overclocking-(AMD)) for more information.
+        :::
+      '';
+    };
+
+    package = lib.mkPackageOption pkgs "lact" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    systemd.packages = [ cfg.package ];
+
+    systemd.services.lactd = {
+      description = "LACT GPU Control Daemon";
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+}
diff --git a/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix b/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
index bf4e5632271a..13595c320833 100644
--- a/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
@@ -1,9 +1,11 @@
 {
-  deviceNameStrategy,
+  csv-files,
+  device-name-strategy,
+  discovery-mode,
+  mounts,
   glibc,
   jq,
   lib,
-  mounts,
   nvidia-container-toolkit,
   nvidia-driver,
   runtimeShell,
@@ -36,7 +38,14 @@ writeScriptBin "nvidia-cdi-generator" ''
   function cdiGenerate {
     ${lib.getExe' nvidia-container-toolkit "nvidia-ctk"} cdi generate \
       --format json \
-      --device-name-strategy ${deviceNameStrategy} \
+      ${
+        if (builtins.length csv-files) > 0 then
+          lib.concatMapStringsSep "\n" (file: "--csv.file ${file} \\") csv-files
+        else
+          "\\"
+      }
+      --discovery-mode ${discovery-mode} \
+      --device-name-strategy ${device-name-strategy} \
       --ldconfig-path ${lib.getExe' glibc "ldconfig"} \
       --library-search-path ${lib.getLib nvidia-driver}/lib \
       --nvidia-cdi-hook-path ${lib.getExe' nvidia-container-toolkit.tools "nvidia-cdi-hook"}
diff --git a/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix b/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
index af94fbe6a45b..d9596f754c6b 100644
--- a/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
@@ -50,12 +50,39 @@
           '';
         };
 
-        suppressNvidiaDriverAssertion = lib.mkOption {
-          default = false;
-          type = lib.types.bool;
+        device-name-strategy = lib.mkOption {
+          default = "index";
+          type = lib.types.enum [
+            "index"
+            "uuid"
+            "type-index"
+          ];
           description = ''
-            Suppress the assertion for installing Nvidia driver.
-            Useful in WSL where drivers are mounted from Windows, not provided by NixOS.
+            Specify the strategy for generating device names,
+            passed to `nvidia-ctk cdi generate`. This will affect how
+            you reference the device using `nvidia.com/gpu=` in
+            the container runtime.
+          '';
+        };
+
+        discovery-mode = lib.mkOption {
+          default = "auto";
+          type = lib.types.enum [
+            "auto"
+            "csv"
+            "nvml"
+            "wsl"
+          ];
+          description = ''
+            The mode to use when discovering the available entities.
+          '';
+        };
+
+        csv-files = lib.mkOption {
+          default = [ ];
+          type = lib.types.listOf lib.types.path;
+          description = ''
+            The path to the list of CSV files to use when generating the CDI specification in CSV mode.
           '';
         };
 
@@ -74,21 +101,6 @@
           '';
         };
 
-        device-name-strategy = lib.mkOption {
-          default = "index";
-          type = lib.types.enum [
-            "index"
-            "uuid"
-            "type-index"
-          ];
-          description = ''
-            Specify the strategy for generating device names,
-            passed to `nvidia-ctk cdi generate`. This will affect how
-            you reference the device using `nvidia.com/gpu=` in
-            the container runtime.
-          '';
-        };
-
         mount-nvidia-docker-1-directories = lib.mkOption {
           default = true;
           type = lib.types.bool;
@@ -98,6 +110,15 @@
           '';
         };
 
+        suppressNvidiaDriverAssertion = lib.mkOption {
+          default = false;
+          type = lib.types.bool;
+          description = ''
+            Suppress the assertion for installing Nvidia driver.
+            Useful in WSL where drivers are mounted from Windows, not provided by NixOS.
+          '';
+        };
+
         package = lib.mkPackageOption pkgs "nvidia-container-toolkit" { };
       };
 
@@ -112,6 +133,12 @@
           || config.hardware.nvidia-container-toolkit.suppressNvidiaDriverAssertion;
         message = ''`nvidia-container-toolkit` requires nvidia drivers: set `hardware.nvidia.datacenter.enable`, add "nvidia" to `services.xserver.videoDrivers`, or set `hardware.nvidia-container-toolkit.suppressNvidiaDriverAssertion` if the driver is provided by another NixOS module (e.g. from NixOS-WSL)'';
       }
+      {
+        assertion =
+          ((builtins.length config.hardware.nvidia-container-toolkit.csv-files) > 0)
+          -> config.hardware.nvidia-container-toolkit.discovery-mode == "csv";
+        message = ''When CSV files are provided, `config.hardware.nvidia-container-toolkit.discovery-mode` has to be set to `csv`.'';
+      }
     ];
 
     virtualisation.docker = {
@@ -209,10 +236,14 @@
         ExecStart =
           let
             script = pkgs.callPackage ./cdi-generate.nix {
-              inherit (config.hardware.nvidia-container-toolkit) mounts;
+              inherit (config.hardware.nvidia-container-toolkit)
+                csv-files
+                device-name-strategy
+                discovery-mode
+                mounts
+                ;
               nvidia-container-toolkit = config.hardware.nvidia-container-toolkit.package;
               nvidia-driver = config.hardware.nvidia.package;
-              deviceNameStrategy = config.hardware.nvidia-container-toolkit.device-name-strategy;
             };
           in
           lib.getExe script;
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 34c236dcd2a6..4936edc3dd25 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -13,7 +13,7 @@ let
 
   haveAliases = cfg.postmasterAlias != "" || cfg.rootAlias != "" || cfg.extraAliases != "";
   haveCanonical = cfg.canonical != "";
-  haveTransport = cfg.transport != "";
+  haveTransport = cfg.transport != "" || (cfg.enableSlowDomains && cfg.slowDomains != [ ]);
   haveVirtual = cfg.virtual != "";
   haveLocalRecipients = cfg.localRecipients != null;
 
@@ -319,13 +319,20 @@ let
   aliasesFile = pkgs.writeText "postfix-aliases" aliases;
   canonicalFile = pkgs.writeText "postfix-canonical" cfg.canonical;
   virtualFile = pkgs.writeText "postfix-virtual" cfg.virtual;
+  transportFile = pkgs.writeText "postfix-transport" (
+    lib.optionalString (cfg.enableSlowDomains && cfg.slowDomains != [ ]) (
+      lib.concatMapStrings (domain: ''
+        ${domain} slow:
+      '') cfg.slowDomains
+    )
+    + cfg.transport
+  );
   localRecipientMapFile = pkgs.writeText "postfix-local-recipient-map" (
     lib.concatMapStrings (x: x + " ACCEPT\n") cfg.localRecipients
   );
   checkClientAccessFile = pkgs.writeText "postfix-check-client-access" cfg.dnsBlacklistOverrides;
   mainCfFile = pkgs.writeText "postfix-main.cf" mainCf;
   masterCfFile = pkgs.writeText "postfix-master.cf" masterCfContent;
-  transportFile = pkgs.writeText "postfix-transport" cfg.transport;
   headerChecksFile = pkgs.writeText "postfix-header-checks" headerChecks;
 
 in
@@ -550,6 +557,32 @@ in
         '';
       };
 
+      enableSlowDomains = lib.mkEnableOption "slow domains feature for rate limiting specific domains";
+
+      slowDomains = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = [ ];
+        example = [
+          "orange.fr"
+          "gmail.com"
+        ];
+        description = "List of domains to be rate-limited using the slow transport.";
+      };
+
+      slowDomainsConfig = {
+        defaultDestinationRateDelay = lib.mkOption {
+          type = lib.types.str;
+          default = "5s";
+          description = "Default rate delay for destinations.";
+        };
+
+        defaultDestinationConcurrencyLimit = lib.mkOption {
+          type = lib.types.int;
+          default = 3;
+          description = "Concurrency limit for slow destinations.";
+        };
+      };
+
       aliasMapType = lib.mkOption {
         type =
           with lib.types;
@@ -985,7 +1018,10 @@ in
             smtpd_tls_key_file = cfg.sslKey;
 
             smtpd_tls_security_level = lib.mkDefault "may";
-
+          }
+          // lib.optionalAttrs cfg.enableSlowDomains {
+            default_destination_rate_delay = cfg.slowDomainsConfig.defaultDestinationRateDelay;
+            default_destination_concurrency_limit = cfg.slowDomainsConfig.defaultDestinationConcurrencyLimit;
           };
 
         services.postfix.masterConfig =
@@ -1077,6 +1113,14 @@ in
                 lib.concatLists (lib.mapAttrsToList mkKeyVal cfg.submissionOptions);
             };
           }
+          // lib.optionalAttrs cfg.enableSlowDomains {
+            slow = {
+              command = "smtp";
+              type = "unix";
+              private = true;
+              maxproc = 2;
+            };
+          }
           // lib.optionalAttrs cfg.enableSmtp {
             smtp_inet = {
               name = "smtp";
@@ -1128,7 +1172,7 @@ in
       (lib.mkIf haveCanonical {
         services.postfix.mapFiles.canonical = canonicalFile;
       })
-      (lib.mkIf haveTransport {
+      (lib.mkIf (haveTransport || (cfg.enableSlowDomains && cfg.slowDomains != [ ])) {
         services.postfix.mapFiles.transport = transportFile;
       })
       (lib.mkIf haveVirtual {
diff --git a/nixos/modules/services/misc/graphical-desktop.nix b/nixos/modules/services/misc/graphical-desktop.nix
index 7f1e9b39210c..42aa44dde0da 100644
--- a/nixos/modules/services/misc/graphical-desktop.nix
+++ b/nixos/modules/services/misc/graphical-desktop.nix
@@ -45,6 +45,11 @@ in
         nixos-icons # needed for gnome and pantheon about dialog, nixos-manual and maybe more
         xdg-utils
       ];
+      # needed for some display managers to locate desktop manager sessions
+      pathsToLink = [
+        "/share/xsessions"
+        "/share/wayland-sessions"
+      ];
     };
 
     fonts.enableDefaultPackages = lib.mkDefault true;
diff --git a/nixos/modules/services/misc/open-webui.nix b/nixos/modules/services/misc/open-webui.nix
index a31c6b42d696..521aacd39939 100644
--- a/nixos/modules/services/misc/open-webui.nix
+++ b/nixos/modules/services/misc/open-webui.nix
@@ -132,6 +132,21 @@ in
           "@system-service"
           "~@privileged"
         ];
+        SupplementaryGroups = [ "render" ]; # for rocm to access /dev/dri/renderD* devices
+        DeviceAllow = [
+          # CUDA
+          # https://docs.nvidia.com/dgx/pdf/dgx-os-5-user-guide.pdf
+          "char-nvidiactl"
+          "char-nvidia-caps"
+          "char-nvidia-frontend"
+          "char-nvidia-uvm"
+          # ROCm
+          "char-drm"
+          "char-fb"
+          "char-kfd"
+          # WSL (Windows Subsystem for Linux)
+          "/dev/dxg"
+        ];
       };
     };
 
diff --git a/nixos/modules/services/misc/tuxclocker.nix b/nixos/modules/services/misc/tuxclocker.nix
index f316994314be..b5d1eea767db 100644
--- a/nixos/modules/services/misc/tuxclocker.nix
+++ b/nixos/modules/services/misc/tuxclocker.nix
@@ -8,16 +8,18 @@ let
   cfg = config.programs.tuxclocker;
 in
 {
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "programs" "tuxclocker" "enableAMD" ]
+      [ "hardware" "amdgpu" "overdrive" "enable" ]
+    )
+  ];
+
   options.programs.tuxclocker = {
     enable = lib.mkEnableOption ''
       TuxClocker, a hardware control and monitoring program
     '';
 
-    enableAMD = lib.mkEnableOption ''
-      AMD GPU controls.
-      Sets the `amdgpu.ppfeaturemask` kernel parameter to 0xfffd7fff to enable all TuxClocker controls
-    '';
-
     enabledNVIDIADevices = lib.mkOption {
       type = lib.types.listOf lib.types.int;
       default = [ ];
@@ -72,9 +74,5 @@ in
           );
         in
         lib.concatStrings (map configSection cfg.enabledNVIDIADevices);
-
-      # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/amd/include/amd_shared.h#n207
-      # Enable everything modifiable in TuxClocker
-      boot.kernelParams = lib.mkIf cfg.enableAMD [ "amdgpu.ppfeaturemask=0xfffd7fff" ];
     };
 }
diff --git a/nixos/modules/services/security/authelia.nix b/nixos/modules/services/security/authelia.nix
index cd5273bd2163..7b93a7f9f7b3 100644
--- a/nixos/modules/services/security/authelia.nix
+++ b/nixos/modules/services/security/authelia.nix
@@ -476,4 +476,10 @@ in
         map (instance: lib.mkIf instance.enable (mkInstanceUsersConfig instance)) instances
       );
     };
+
+  meta.maintainers = with lib.maintainers; [
+    jk
+    dit7ya
+    nicomem
+  ];
 }
diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index 67b219595458..f900b2816b42 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -185,7 +185,9 @@ let
 
   finalJson =
     if cfg.provision.extraJsonFile != null then
-      "<(${lib.getExe pkgs.jq} -s '.[0] * .[1]' ${provisionStateJson} ${cfg.provision.extraJsonFile})"
+      ''
+        <(${lib.getExe pkgs.yq-go} '. *+ load("${cfg.provision.extraJsonFile}") | (.. | select(type == "!!seq")) |= unique' ${provisionStateJson})
+      ''
     else
       provisionStateJson;
 
@@ -442,10 +444,8 @@ in
         description = ''
           A JSON file for provisioning persons, groups & systems.
           Options set in this file take precedence over values set using the other options.
-          In the case of duplicates, `jq` will remove all but the last one
-          when merging this file with the options.
+          The files get deeply merged, and deduplicated.
           The accepted JSON schema can be found at <https://github.com/oddlama/kanidm-provision#json-schema>.
-          Note: theoretically `jq` cannot merge nested types, but this does not pose an issue as kanidm-provision's JSON scheme does not use nested types.
         '';
         type = types.nullOr types.path;
         default = null;
diff --git a/nixos/modules/services/web-apps/filebrowser.nix b/nixos/modules/services/web-apps/filebrowser.nix
new file mode 100644
index 000000000000..2556f1af9b32
--- /dev/null
+++ b/nixos/modules/services/web-apps/filebrowser.nix
@@ -0,0 +1,137 @@
+{
+  config,
+  pkgs,
+  lib,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.filebrowser;
+  inherit (lib) types;
+  format = pkgs.formats.json { };
+in
+{
+  options = {
+    services.filebrowser = {
+      enable = lib.mkEnableOption "FileBrowser";
+
+      package = lib.mkPackageOption pkgs "filebrowser" { };
+
+      openFirewall = lib.mkEnableOption "opening firewall ports for FileBrowser";
+
+      settings = lib.mkOption {
+        default = { };
+        description = ''
+          Settings for FileBrowser.
+          Refer to <https://filebrowser.org/cli/filebrowser#options> for all supported values.
+        '';
+        type = types.submodule {
+          freeformType = format.type;
+
+          options = {
+            address = lib.mkOption {
+              default = "localhost";
+              description = ''
+                The address to listen on.
+              '';
+              type = types.str;
+            };
+
+            port = lib.mkOption {
+              default = 8080;
+              description = ''
+                The port to listen on.
+              '';
+              type = types.port;
+            };
+
+            root = lib.mkOption {
+              default = "/var/lib/filebrowser/data";
+              description = ''
+                The directory where FileBrowser stores files.
+              '';
+              type = types.path;
+            };
+
+            database = lib.mkOption {
+              default = "/var/lib/filebrowser/database.db";
+              description = ''
+                The path to FileBrowser's Bolt database.
+              '';
+              type = types.path;
+            };
+
+            cache-dir = lib.mkOption {
+              default = "/var/cache/filebrowser";
+              description = ''
+                The directory where FileBrowser stores its cache.
+              '';
+              type = types.path;
+              readOnly = true;
+            };
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd = {
+      services.filebrowser = {
+        after = [ "network.target" ];
+        description = "FileBrowser";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart =
+            let
+              args = [
+                (lib.getExe cfg.package)
+                "--config"
+                (format.generate "config.json" cfg.settings)
+              ];
+            in
+            utils.escapeSystemdExecArgs args;
+
+          StateDirectory = "filebrowser";
+          CacheDirectory = "filebrowser";
+          WorkingDirectory = cfg.settings.root;
+
+          DynamicUser = true;
+
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          MemoryDenyWriteExecute = true;
+          LockPersonality = true;
+          RestrictAddressFamilies = [
+            "AF_UNIX"
+            "AF_INET"
+            "AF_INET6"
+          ];
+          DevicePolicy = "closed";
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+        };
+      };
+
+      tmpfiles.settings.filebrowser =
+        lib.genAttrs
+          [
+            cfg.settings.root
+            (builtins.dirOf cfg.settings.database)
+          ]
+          (_: {
+            d.mode = "0700";
+          });
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.settings.port ];
+  };
+
+  meta.maintainers = [
+    lib.maintainers.lukaswrz
+  ];
+}
diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix
index 867006f8c65f..a97f3037e0f0 100644
--- a/nixos/modules/services/web-apps/keycloak.nix
+++ b/nixos/modules/services/web-apps/keycloak.nix
@@ -631,6 +631,7 @@ in
           psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='keycloak'" | grep -q 1 || psql -tA --file="$create_role"
           psql -tAc "SELECT 1 FROM pg_database WHERE datname = 'keycloak'" | grep -q 1 || psql -tAc 'CREATE DATABASE "keycloak" OWNER "keycloak"'
         '';
+        enableStrictShellChecks = true;
       };
 
       systemd.services.keycloakMySQLInit = mkIf createLocalMySQL {
@@ -662,6 +663,7 @@ in
             echo "GRANT ALL PRIVILEGES ON keycloak.* TO 'keycloak'@'localhost';"
           ) | mysql -N
         '';
+        enableStrictShellChecks = true;
       };
 
       systemd.tmpfiles.settings."10-keycloak" =
@@ -699,7 +701,7 @@ in
               [ ];
           secretPaths = catAttrs "_secret" (collect isSecret cfg.settings);
           mkSecretReplacement = file: ''
-            replace-secret ${hashString "sha256" file} $CREDENTIALS_DIRECTORY/${baseNameOf file} /run/keycloak/conf/keycloak.conf
+            replace-secret ${hashString "sha256" file} "$CREDENTIALS_DIRECTORY/${baseNameOf file}" /run/keycloak/conf/keycloak.conf
           '';
           secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
         in
@@ -760,11 +762,12 @@ in
             ''
             + optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) ''
               mkdir -p /run/keycloak/ssl
-              cp $CREDENTIALS_DIRECTORY/ssl_{cert,key} /run/keycloak/ssl/
+              cp "$CREDENTIALS_DIRECTORY"/ssl_{cert,key} /run/keycloak/ssl/
             ''
             + ''
               kc.sh --verbose start --optimized ${lib.optionalString (cfg.realmFiles != [ ]) "--import-realm"}
             '';
+          enableStrictShellChecks = true;
         };
 
       services.postgresql.enable = mkDefault createLocalPostgreSQL;
diff --git a/nixos/modules/services/web-apps/mediagoblin.nix b/nixos/modules/services/web-apps/mediagoblin.nix
index 9cf7d4dcb2ec..6fa5fac9f5c9 100644
--- a/nixos/modules/services/web-apps/mediagoblin.nix
+++ b/nixos/modules/services/web-apps/mediagoblin.nix
@@ -25,22 +25,32 @@ let
 
   iniFormat = pkgs.formats.ini { };
 
-  # we need to build our own GI_TYPELIB_PATH because celery and paster need this information, too and cannot easily be re-wrapped
-  GI_TYPELIB_PATH =
+  # we need to build our own GI_TYPELIB_PATH and GST_PLUGIN_PATH because celery, paster and gmg need this information and it cannot easily be re-wrapped
+  gst =
     let
       needsGst =
         (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.audio")
         || (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.video");
     in
-    lib.makeSearchPathOutput "out" "lib/girepository-1.0" (
-      with pkgs.gst_all_1;
+    with pkgs.gst_all_1;
+    [
+      pkgs.glib
+      gst-plugins-base
+      gstreamer
+    ]
+    # audio and video share most dependencies, so we can just take audio
+    ++ lib.optionals needsGst cfg.package.optional-dependencies.audio;
+  GI_TYPELIB_PATH = lib.makeSearchPathOutput "out" "lib/girepository-1.0" gst;
+  GST_PLUGIN_PATH = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gst;
+
+  path =
+    lib.optionals (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.stl") [ pkgs.blender ]
+    ++ lib.optionals (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.pdf") (
+      with pkgs;
       [
-        pkgs.glib
-        gst-plugins-base
-        gstreamer
+        poppler-utils
+        unoconv
       ]
-      # audio and video share most dependencies, so we can just take audio
-      ++ lib.optionals needsGst cfg.package.optional-dependencies.audio
     );
 
   finalPackage = cfg.package.python.buildEnv.override {
@@ -189,7 +199,7 @@ in
         if [[ "$USER" != mediagoblin ]]; then
          sudo='exec /run/wrappers/bin/sudo -u mediagoblin'
         fi
-        $sudo sh -c "cd /var/lib/mediagoblin; env GI_TYPELIB_PATH=${GI_TYPELIB_PATH} ${lib.getExe' finalPackage "gmg"} $@"
+        $sudo sh -c "cd /var/lib/mediagoblin; env GI_TYPELIB_PATH=${GI_TYPELIB_PATH} GST_PLUGIN_PATH=${GST_PLUGIN_PATH} PATH=$PATH:${lib.makeBinPath path} ${lib.getExe' finalPackage "gmg"} $*"
       '')
     ];
 
@@ -248,15 +258,7 @@ in
       let
         serviceDefaults = {
           wantedBy = [ "multi-user.target" ];
-          path =
-            lib.optionals (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.stl") [ pkgs.blender ]
-            ++ lib.optionals (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.pdf") (
-              with pkgs;
-              [
-                poppler-utils
-                unoconv
-              ]
-            );
+          inherit path;
           serviceConfig = {
             AmbientCapabilities = "";
             CapabilityBoundingSet = [ "" ];
@@ -325,6 +327,7 @@ in
             Environment = [
               "CELERY_CONFIG_MODULE=mediagoblin.init.celery.from_celery"
               "GI_TYPELIB_PATH=${GI_TYPELIB_PATH}"
+              "GST_PLUGIN_PATH=${GST_PLUGIN_PATH}"
               "MEDIAGOBLIN_CONFIG=/var/lib/mediagoblin/mediagoblin.ini"
               "PASTE_CONFIG=${pasteConfig}"
             ];
@@ -350,6 +353,7 @@ in
             Environment = [
               "CELERY_ALWAYS_EAGER=false"
               "GI_TYPELIB_PATH=${GI_TYPELIB_PATH}"
+              "GST_PLUGIN_PATH=${GST_PLUGIN_PATH}"
             ];
             ExecStart = "${lib.getExe' finalPackage "paster"} serve /var/lib/mediagoblin/paste.ini";
           };
diff --git a/nixos/modules/services/x11/desktop-managers/default.nix b/nixos/modules/services/x11/desktop-managers/default.nix
index 747f838e90ee..9dbb9a42d4fa 100644
--- a/nixos/modules/services/x11/desktop-managers/default.nix
+++ b/nixos/modules/services/x11/desktop-managers/default.nix
@@ -31,7 +31,6 @@ in
     ./lumina.nix
     ./lxqt.nix
     ./enlightenment.nix
-    ./gnome.nix
     ./retroarch.nix
     ./kodi.nix
     ./mate.nix
@@ -43,6 +42,7 @@ in
     ./deepin.nix
     ../../desktop-managers/lomiri.nix
     ../../desktop-managers/cosmic.nix
+    ../../desktop-managers/gnome.nix
   ];
 
   options = {
diff --git a/nixos/modules/services/x11/terminal-server.nix b/nixos/modules/services/x11/terminal-server.nix
index 165cbea6574a..c8fa744d8869 100644
--- a/nixos/modules/services/x11/terminal-server.nix
+++ b/nixos/modules/services/x11/terminal-server.nix
@@ -17,7 +17,7 @@ with lib;
     services.xserver.videoDrivers = [ ];
 
     # Enable GDM.  Any display manager will do as long as it supports XDMCP.
-    services.xserver.displayManager.gdm.enable = true;
+    services.displayManager.gdm.enable = true;
 
     systemd.sockets.terminal-server = {
       description = "Terminal Server Socket";
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 7c0de46a8cd2..206e25355d34 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -761,7 +761,7 @@ in
         dmConf = cfg.displayManager;
         default =
           !(
-            dmConf.gdm.enable
+            config.services.displayManager.gdm.enable
             || config.services.displayManager.sddm.enable
             || dmConf.xpra.enable
             || dmConf.sx.enable
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index 89d967ccc0bf..8ac3df70df97 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -100,6 +100,9 @@ let
           "ReceiveQueues"
           "TransmitQueues"
           "TransmitQueueLength"
+          "RxFlowControl"
+          "TxFlowControl"
+          "AutoNegotiationFlowControl"
         ])
         (assertValueOneOf "MACAddressPolicy" [
           "persistent"
@@ -137,6 +140,9 @@ let
         (assertValueOneOf "GenericSegmentationOffload" boolValues)
         (assertValueOneOf "GenericReceiveOffload" boolValues)
         (assertValueOneOf "LargeReceiveOffload" boolValues)
+        (assertValueOneOf "RxFlowControl" boolValues)
+        (assertValueOneOf "TxFlowControl" boolValues)
+        (assertValueOneOf "AutoNegotiationFlowControl" boolValues)
         (assertInt "RxChannels")
         (assertRange "RxChannels" 1 4294967295)
         (assertInt "TxChannels")
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 95d8b77d2a36..c6a0dbccd8d3 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -125,7 +125,9 @@ let
     name = "initrd-${kernel-name}";
     inherit (config.boot.initrd) compressor compressorArgs prepend;
 
-    contents = lib.filter ({ source, ... }: !lib.elem source cfg.suppressedStorePaths) cfg.storePaths;
+    contents = lib.filter (
+      { source, enable, ... }: (!lib.elem source cfg.suppressedStorePaths) && enable
+    ) cfg.storePaths;
   };
 
 in
@@ -634,7 +636,7 @@ in
         {
           where = "/sysroot/run";
           what = "/run";
-          options = "bind";
+          options = "rbind";
           unitConfig = {
             # See the comment on the mount unit for /run/etc-metadata
             DefaultDependencies = false;
diff --git a/nixos/modules/system/etc/etc-activation.nix b/nixos/modules/system/etc/etc-activation.nix
index 355e9695d8b9..e539500a1ba5 100644
--- a/nixos/modules/system/etc/etc-activation.nix
+++ b/nixos/modules/system/etc/etc-activation.nix
@@ -46,6 +46,10 @@
         "overlay"
       ];
 
+      system.requiredKernelConfig = with config.lib.kernelConfig; [
+        (isEnabled "EROFS_FS")
+      ];
+
       boot.initrd.systemd = {
         mounts = [
           {
diff --git a/nixos/release.nix b/nixos/release.nix
index b7b550fb4721..3bcacf1e471c 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -610,8 +610,8 @@ rec {
       { ... }:
       {
         services.xserver.enable = true;
-        services.xserver.displayManager.gdm.enable = true;
-        services.xserver.desktopManager.gnome.enable = true;
+        services.displayManager.gdm.enable = true;
+        services.desktopManager.gnome.enable = true;
       }
     );
 
diff --git a/nixos/tests/all-terminfo.nix b/nixos/tests/all-terminfo.nix
index 4b547ee47d2c..dad52834cb8b 100644
--- a/nixos/tests/all-terminfo.nix
+++ b/nixos/tests/all-terminfo.nix
@@ -22,7 +22,8 @@
         && lib.isDerivation o.value
         && o.value ? outputs
         && builtins.elem "terminfo" o.value.outputs
-        && !o.value.meta.broken;
+        && !o.value.meta.broken
+        && lib.meta.availableOn pkgs.stdenv.hostPlatform o.value;
       terminfos = lib.filterAttrs infoFilter pkgs;
       excludedTerminfos = lib.filterAttrs (
         _: drv: !(builtins.elem drv.terminfo config.environment.systemPackages)
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index c01da895fbbc..a91b390baa91 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -146,7 +146,7 @@ in
 
   # Testing the test driver
   nixos-test-driver = {
-    extra-python-packages = handleTest ./nixos-test-driver/extra-python-packages.nix { };
+    extra-python-packages = runTest ./nixos-test-driver/extra-python-packages.nix;
     lib-extend = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./nixos-test-driver/lib-extend.nix { };
     node-name = runTest ./nixos-test-driver/node-name.nix;
     busybox = runTest ./nixos-test-driver/busybox.nix;
@@ -213,7 +213,7 @@ in
   atop = import ./atop.nix { inherit pkgs runTest; };
   atticd = runTest ./atticd.nix;
   atuin = runTest ./atuin.nix;
-  ax25 = handleTest ./ax25.nix { };
+  ax25 = runTest ./ax25.nix;
   audiobookshelf = runTest ./audiobookshelf.nix;
   auth-mysql = runTest ./auth-mysql.nix;
   authelia = runTest ./authelia.nix;
@@ -233,7 +233,7 @@ in
   bcachefs = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./bcachefs.nix;
   beanstalkd = runTest ./beanstalkd.nix;
   bees = runTest ./bees.nix;
-  benchexec = handleTest ./benchexec.nix { };
+  benchexec = runTest ./benchexec.nix;
   binary-cache = runTest {
     imports = [ ./binary-cache.nix ];
     _module.args.compression = "zstd";
@@ -250,37 +250,37 @@ in
   bird = handleTest ./bird.nix { };
   birdwatcher = handleTest ./birdwatcher.nix { };
   bitbox-bridge = runTest ./bitbox-bridge.nix;
-  bitcoind = handleTest ./bitcoind.nix { };
-  bittorrent = handleTest ./bittorrent.nix { };
-  blockbook-frontend = handleTest ./blockbook-frontend.nix { };
+  bitcoind = runTest ./bitcoind.nix;
+  bittorrent = runTest ./bittorrent.nix;
+  blockbook-frontend = runTest ./blockbook-frontend.nix;
   blocky = handleTest ./blocky.nix { };
   boot = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./boot.nix { };
   bootspec = handleTestOn [ "x86_64-linux" ] ./bootspec.nix { };
-  boot-stage1 = handleTest ./boot-stage1.nix { };
-  boot-stage2 = handleTest ./boot-stage2.nix { };
-  borgbackup = handleTest ./borgbackup.nix { };
-  borgmatic = handleTest ./borgmatic.nix { };
+  boot-stage1 = runTest ./boot-stage1.nix;
+  boot-stage2 = runTest ./boot-stage2.nix;
+  borgbackup = runTest ./borgbackup.nix;
+  borgmatic = runTest ./borgmatic.nix;
   botamusique = runTest ./botamusique.nix;
   bpf = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./bpf.nix { };
-  bpftune = handleTest ./bpftune.nix { };
-  breitbandmessung = handleTest ./breitbandmessung.nix { };
-  brscan5 = handleTest ./brscan5.nix { };
-  btrbk = handleTest ./btrbk.nix { };
-  btrbk-doas = handleTest ./btrbk-doas.nix { };
-  btrbk-no-timer = handleTest ./btrbk-no-timer.nix { };
-  btrbk-section-order = handleTest ./btrbk-section-order.nix { };
-  budgie = handleTest ./budgie.nix { };
+  bpftune = runTest ./bpftune.nix;
+  breitbandmessung = runTest ./breitbandmessung.nix;
+  brscan5 = runTest ./brscan5.nix;
+  btrbk = runTest ./btrbk.nix;
+  btrbk-doas = runTest ./btrbk-doas.nix;
+  btrbk-no-timer = runTest ./btrbk-no-timer.nix;
+  btrbk-section-order = runTest ./btrbk-section-order.nix;
+  budgie = runTest ./budgie.nix;
   buildbot = runTest ./buildbot.nix;
-  buildkite-agents = handleTest ./buildkite-agents.nix { };
-  c2fmzq = handleTest ./c2fmzq.nix { };
+  buildkite-agents = runTest ./buildkite-agents.nix;
+  c2fmzq = runTest ./c2fmzq.nix;
   caddy = runTest ./caddy.nix;
   cadvisor = handleTestOn [ "x86_64-linux" ] ./cadvisor.nix { };
-  cage = handleTest ./cage.nix { };
-  cagebreak = handleTest ./cagebreak.nix { };
+  cage = runTest ./cage.nix;
+  cagebreak = runTest ./cagebreak.nix;
   calibre-web = runTest ./calibre-web.nix;
   calibre-server = import ./calibre-server.nix { inherit pkgs runTest; };
-  canaille = handleTest ./canaille.nix { };
-  castopod = handleTest ./castopod.nix { };
+  canaille = runTest ./canaille.nix;
+  castopod = runTest ./castopod.nix;
   cassandra_4 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_4; };
   centrifugo = runTest ./centrifugo.nix;
   ceph-multi-node = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-multi-node.nix { };
@@ -296,47 +296,47 @@ in
   certmgr = handleTest ./certmgr.nix { };
   cfssl = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./cfssl.nix { };
   cgit = runTest ./cgit.nix;
-  charliecloud = handleTest ./charliecloud.nix { };
+  charliecloud = runTest ./charliecloud.nix;
   chromadb = runTest ./chromadb.nix;
   chromium = (handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./chromium.nix { }).stable or { };
   chrony = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./chrony.nix { };
   chrony-ptp = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./chrony-ptp.nix { };
-  cinnamon = handleTest ./cinnamon.nix { };
-  cinnamon-wayland = handleTest ./cinnamon-wayland.nix { };
-  cjdns = handleTest ./cjdns.nix { };
+  cinnamon = runTest ./cinnamon.nix;
+  cinnamon-wayland = runTest ./cinnamon-wayland.nix;
+  cjdns = runTest ./cjdns.nix;
   clatd = runTest ./clatd.nix;
-  clickhouse = handleTest ./clickhouse.nix { };
+  clickhouse = runTest ./clickhouse.nix;
   cloud-init = handleTest ./cloud-init.nix { };
   cloud-init-hostname = handleTest ./cloud-init-hostname.nix { };
-  cloudlog = handleTest ./cloudlog.nix { };
+  cloudlog = runTest ./cloudlog.nix;
   cntr = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./cntr.nix { };
-  cockpit = handleTest ./cockpit.nix { };
+  cockpit = runTest ./cockpit.nix;
   cockroachdb = handleTestOn [ "x86_64-linux" ] ./cockroachdb.nix { };
-  code-server = handleTest ./code-server.nix { };
-  coder = handleTest ./coder.nix { };
-  collectd = handleTest ./collectd.nix { };
-  commafeed = handleTest ./commafeed.nix { };
-  connman = handleTest ./connman.nix { };
-  consul = handleTest ./consul.nix { };
-  consul-template = handleTest ./consul-template.nix { };
-  containers-bridge = handleTest ./containers-bridge.nix { };
-  containers-custom-pkgs.nix = handleTest ./containers-custom-pkgs.nix { };
-  containers-ephemeral = handleTest ./containers-ephemeral.nix { };
-  containers-extra_veth = handleTest ./containers-extra_veth.nix { };
-  containers-hosts = handleTest ./containers-hosts.nix { };
-  containers-imperative = handleTest ./containers-imperative.nix { };
-  containers-ip = handleTest ./containers-ip.nix { };
-  containers-macvlans = handleTest ./containers-macvlans.nix { };
-  containers-names = handleTest ./containers-names.nix { };
-  containers-nested = handleTest ./containers-nested.nix { };
-  containers-physical_interfaces = handleTest ./containers-physical_interfaces.nix { };
-  containers-portforward = handleTest ./containers-portforward.nix { };
-  containers-reloadable = handleTest ./containers-reloadable.nix { };
-  containers-require-bind-mounts = handleTest ./containers-require-bind-mounts.nix { };
-  containers-restart_networking = handleTest ./containers-restart_networking.nix { };
-  containers-tmpfs = handleTest ./containers-tmpfs.nix { };
-  containers-unified-hierarchy = handleTest ./containers-unified-hierarchy.nix { };
-  convos = handleTest ./convos.nix { };
+  code-server = runTest ./code-server.nix;
+  coder = runTest ./coder.nix;
+  collectd = runTest ./collectd.nix;
+  commafeed = runTest ./commafeed.nix;
+  connman = runTest ./connman.nix;
+  consul = runTest ./consul.nix;
+  consul-template = runTest ./consul-template.nix;
+  containers-bridge = runTest ./containers-bridge.nix;
+  containers-custom-pkgs.nix = runTest ./containers-custom-pkgs.nix;
+  containers-ephemeral = runTest ./containers-ephemeral.nix;
+  containers-extra_veth = runTest ./containers-extra_veth.nix;
+  containers-hosts = runTest ./containers-hosts.nix;
+  containers-imperative = runTest ./containers-imperative.nix;
+  containers-ip = runTest ./containers-ip.nix;
+  containers-macvlans = runTest ./containers-macvlans.nix;
+  containers-names = runTest ./containers-names.nix;
+  containers-nested = runTest ./containers-nested.nix;
+  containers-physical_interfaces = runTest ./containers-physical_interfaces.nix;
+  containers-portforward = runTest ./containers-portforward.nix;
+  containers-reloadable = runTest ./containers-reloadable.nix;
+  containers-require-bind-mounts = runTest ./containers-require-bind-mounts.nix;
+  containers-restart_networking = runTest ./containers-restart_networking.nix;
+  containers-tmpfs = runTest ./containers-tmpfs.nix;
+  containers-unified-hierarchy = runTest ./containers-unified-hierarchy.nix;
+  convos = runTest ./convos.nix;
   corerad = handleTest ./corerad.nix { };
   cosmic = runTest {
     imports = [ ./cosmic.nix ];
@@ -362,33 +362,33 @@ in
     _module.args.enableAutologin = true;
     _module.args.enableXWayland = false;
   };
-  coturn = handleTest ./coturn.nix { };
-  couchdb = handleTest ./couchdb.nix { };
-  crabfit = handleTest ./crabfit.nix { };
+  coturn = runTest ./coturn.nix;
+  couchdb = runTest ./couchdb.nix;
+  crabfit = runTest ./crabfit.nix;
   cri-o = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./cri-o.nix { };
   cryptpad = runTest ./cryptpad.nix;
   cups-pdf = runTest ./cups-pdf.nix;
-  curl-impersonate = handleTest ./curl-impersonate.nix { };
+  curl-impersonate = runTest ./curl-impersonate.nix;
   custom-ca = handleTest ./custom-ca.nix { };
-  croc = handleTest ./croc.nix { };
+  croc = runTest ./croc.nix;
   cross-seed = runTest ./cross-seed.nix;
   cyrus-imap = runTest ./cyrus-imap.nix;
   darling-dmg = runTest ./darling-dmg.nix;
-  dae = handleTest ./dae.nix { };
+  dae = runTest ./dae.nix;
   davis = runTest ./davis.nix;
-  db-rest = handleTest ./db-rest.nix { };
-  dconf = handleTest ./dconf.nix { };
-  ddns-updater = handleTest ./ddns-updater.nix { };
-  deconz = handleTest ./deconz.nix { };
-  deepin = handleTest ./deepin.nix { };
-  deluge = handleTest ./deluge.nix { };
-  dendrite = handleTest ./matrix/dendrite.nix { };
-  dependency-track = handleTest ./dependency-track.nix { };
-  devpi-server = handleTest ./devpi-server.nix { };
-  dex-oidc = handleTest ./dex-oidc.nix { };
+  db-rest = runTest ./db-rest.nix;
+  dconf = runTest ./dconf.nix;
+  ddns-updater = runTest ./ddns-updater.nix;
+  deconz = runTest ./deconz.nix;
+  deepin = runTest ./deepin.nix;
+  deluge = runTest ./deluge.nix;
+  dendrite = runTest ./matrix/dendrite.nix;
+  dependency-track = runTest ./dependency-track.nix;
+  devpi-server = runTest ./devpi-server.nix;
+  dex-oidc = runTest ./dex-oidc.nix;
   dhparams = handleTest ./dhparams.nix { };
-  disable-installer-tools = handleTest ./disable-installer-tools.nix { };
-  discourse = handleTest ./discourse.nix { };
+  disable-installer-tools = runTest ./disable-installer-tools.nix;
+  discourse = runTest ./discourse.nix;
   dnscrypt-proxy2 = handleTestOn [ "x86_64-linux" ] ./dnscrypt-proxy2.nix { };
   dnsdist = import ./dnsdist.nix { inherit pkgs runTest; };
   doas = runTest ./doas.nix;
@@ -400,36 +400,36 @@ in
   docker-tools-cross = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./docker-tools-cross.nix;
   docker-tools-overlay = runTestOn [ "x86_64-linux" ] ./docker-tools-overlay.nix;
   docling-serve = runTest ./docling-serve.nix;
-  documize = handleTest ./documize.nix { };
+  documize = runTest ./documize.nix;
   documentation = pkgs.callPackage ../modules/misc/documentation/test.nix { inherit nixosLib; };
-  doh-proxy-rust = handleTest ./doh-proxy-rust.nix { };
+  doh-proxy-rust = runTest ./doh-proxy-rust.nix;
   dokuwiki = runTest ./dokuwiki.nix;
   dolibarr = runTest ./dolibarr.nix;
-  domination = handleTest ./domination.nix { };
+  domination = runTest ./domination.nix;
   dovecot = handleTest ./dovecot.nix { };
   drawterm = discoverTests (import ./drawterm.nix);
-  drbd = handleTest ./drbd.nix { };
+  drbd = runTest ./drbd.nix;
   druid = handleTestOn [ "x86_64-linux" ] ./druid { };
-  drbd-driver = handleTest ./drbd-driver.nix { };
-  dublin-traceroute = handleTest ./dublin-traceroute.nix { };
+  drbd-driver = runTest ./drbd-driver.nix;
+  dublin-traceroute = runTest ./dublin-traceroute.nix;
   earlyoom = handleTestOn [ "x86_64-linux" ] ./earlyoom.nix { };
   early-mount-options = handleTest ./early-mount-options.nix { };
   ec2-config = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).boot-ec2-config or { };
   ec2-nixops = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).boot-ec2-nixops or { };
   echoip = runTest ./echoip.nix;
-  ecryptfs = handleTest ./ecryptfs.nix { };
-  fscrypt = handleTest ./fscrypt.nix { };
+  ecryptfs = runTest ./ecryptfs.nix;
+  fscrypt = runTest ./fscrypt.nix;
   fastnetmon-advanced = runTest ./fastnetmon-advanced.nix;
-  eintopf = runTest ./eintopf.nix;
-  ejabberd = handleTest ./xmpp/ejabberd.nix { };
+  lauti = runTest ./lauti.nix;
+  ejabberd = runTest ./xmpp/ejabberd.nix;
   elk = handleTestOn [ "x86_64-linux" ] ./elk.nix { };
   emacs-daemon = runTest ./emacs-daemon.nix;
-  endlessh = handleTest ./endlessh.nix { };
-  endlessh-go = handleTest ./endlessh-go.nix { };
-  engelsystem = handleTest ./engelsystem.nix { };
-  enlightenment = handleTest ./enlightenment.nix { };
-  env = handleTest ./env.nix { };
-  envfs = handleTest ./envfs.nix { };
+  endlessh = runTest ./endlessh.nix;
+  endlessh-go = runTest ./endlessh-go.nix;
+  engelsystem = runTest ./engelsystem.nix;
+  enlightenment = runTest ./enlightenment.nix;
+  env = runTest ./env.nix;
+  envfs = runTest ./envfs.nix;
   envoy = runTest {
     imports = [ ./envoy.nix ];
     _module.args.envoyPackage = pkgs.envoy;
@@ -438,10 +438,10 @@ in
     imports = [ ./envoy.nix ];
     _module.args.envoyPackage = pkgs.envoy-bin;
   };
-  ergo = handleTest ./ergo.nix { };
-  ergochat = handleTest ./ergochat.nix { };
-  eris-server = handleTest ./eris-server.nix { };
-  esphome = handleTest ./esphome.nix { };
+  ergo = runTest ./ergo.nix;
+  ergochat = runTest ./ergochat.nix;
+  eris-server = runTest ./eris-server.nix;
+  esphome = runTest ./esphome.nix;
   etc = pkgs.callPackage ../modules/system/etc/test.nix { inherit evalMinimalConfig; };
   activation = pkgs.callPackage ../modules/system/activation/test.nix { };
   activation-lib = pkgs.callPackage ../modules/system/activation/lib/test.nix { };
@@ -452,20 +452,21 @@ in
   activation-perlless = runTest ./activation/perlless.nix;
   etcd = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./etcd/etcd.nix { };
   etcd-cluster = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./etcd/etcd-cluster.nix { };
-  etebase-server = handleTest ./etebase-server.nix { };
-  etesync-dav = handleTest ./etesync-dav.nix { };
+  etebase-server = runTest ./etebase-server.nix;
+  etesync-dav = runTest ./etesync-dav.nix;
   evcc = runTest ./evcc.nix;
   fail2ban = runTest ./fail2ban.nix;
-  fakeroute = handleTest ./fakeroute.nix { };
+  fakeroute = runTest ./fakeroute.nix;
   fancontrol = runTest ./fancontrol.nix;
-  fanout = handleTest ./fanout.nix { };
+  fanout = runTest ./fanout.nix;
   fcitx5 = handleTest ./fcitx5 { };
   fedimintd = runTest ./fedimintd.nix;
-  fenics = handleTest ./fenics.nix { };
-  ferm = handleTest ./ferm.nix { };
+  fenics = runTest ./fenics.nix;
+  ferm = runTest ./ferm.nix;
   ferretdb = handleTest ./ferretdb.nix { };
   fider = runTest ./fider.nix;
-  filesender = handleTest ./filesender.nix { };
+  filesender = runTest ./filesender.nix;
+  filebrowser = runTest ./filebrowser.nix;
   filesystems-overlayfs = runTest ./filesystems-overlayfs.nix;
   firefly-iii = runTest ./firefly-iii.nix;
   firefly-iii-data-importer = runTest ./firefly-iii-data-importer.nix;
@@ -490,23 +491,23 @@ in
     imports = [ ./firefox.nix ];
     _module.args.firefoxPackage = pkgs.firefox-esr-128;
   };
-  firefoxpwa = handleTest ./firefoxpwa.nix { };
-  firejail = handleTest ./firejail.nix { };
+  firefoxpwa = runTest ./firefoxpwa.nix;
+  firejail = runTest ./firejail.nix;
   firewall = handleTest ./firewall.nix { nftables = false; };
   firewall-nftables = handleTest ./firewall.nix { nftables = true; };
   fish = runTest ./fish.nix;
-  firezone = handleTest ./firezone/firezone.nix { };
+  firezone = runTest ./firezone/firezone.nix;
   flannel = handleTestOn [ "x86_64-linux" ] ./flannel.nix { };
-  flaresolverr = handleTest ./flaresolverr.nix { };
-  flood = handleTest ./flood.nix { };
+  flaresolverr = runTest ./flaresolverr.nix;
+  flood = runTest ./flood.nix;
   floorp = runTest {
     imports = [ ./firefox.nix ];
     _module.args.firefoxPackage = pkgs.floorp;
   };
   fluent-bit = runTest ./fluent-bit.nix;
-  fluentd = handleTest ./fluentd.nix { };
-  fluidd = handleTest ./fluidd.nix { };
-  fontconfig-default-fonts = handleTest ./fontconfig-default-fonts.nix { };
+  fluentd = runTest ./fluentd.nix;
+  fluidd = runTest ./fluidd.nix;
+  fontconfig-default-fonts = runTest ./fontconfig-default-fonts.nix;
   forgejo = import ./forgejo.nix {
     inherit runTest;
     forgejoPackage = pkgs.forgejo;
@@ -516,69 +517,69 @@ in
     forgejoPackage = pkgs.forgejo-lts;
   };
   freenet = runTest ./freenet.nix;
-  freeswitch = handleTest ./freeswitch.nix { };
+  freeswitch = runTest ./freeswitch.nix;
   freetube = discoverTests (import ./freetube.nix);
   freshrss = handleTest ./freshrss { };
   frigate = runTest ./frigate.nix;
   froide-govplan = runTest ./web-apps/froide-govplan.nix;
-  frp = handleTest ./frp.nix { };
-  frr = handleTest ./frr.nix { };
+  frp = runTest ./frp.nix;
+  frr = runTest ./frr.nix;
   fsck = handleTest ./fsck.nix { };
   fsck-systemd-stage-1 = handleTest ./fsck.nix { systemdStage1 = true; };
-  ft2-clone = handleTest ./ft2-clone.nix { };
-  legit = handleTest ./legit.nix { };
-  mimir = handleTest ./mimir.nix { };
-  gancio = handleTest ./gancio.nix { };
+  ft2-clone = runTest ./ft2-clone.nix;
+  legit = runTest ./legit.nix;
+  mimir = runTest ./mimir.nix;
+  gancio = runTest ./gancio.nix;
   garage = handleTest ./garage { };
   gatus = runTest ./gatus.nix;
   gemstash = handleTest ./gemstash.nix { };
   geoclue2 = runTest ./geoclue2.nix;
   geoserver = runTest ./geoserver.nix;
   gerrit = runTest ./gerrit.nix;
-  geth = handleTest ./geth.nix { };
-  ghostunnel = handleTest ./ghostunnel.nix { };
-  gitdaemon = handleTest ./gitdaemon.nix { };
+  geth = runTest ./geth.nix;
+  ghostunnel = runTest ./ghostunnel.nix;
+  gitdaemon = runTest ./gitdaemon.nix;
   gitea = handleTest ./gitea.nix { giteaPackage = pkgs.gitea; };
   github-runner = runTest ./github-runner.nix;
   gitlab = runTest ./gitlab.nix;
-  gitolite = handleTest ./gitolite.nix { };
-  gitolite-fcgiwrap = handleTest ./gitolite-fcgiwrap.nix { };
+  gitolite = runTest ./gitolite.nix;
+  gitolite-fcgiwrap = runTest ./gitolite-fcgiwrap.nix;
   glance = runTest ./glance.nix;
   glances = runTest ./glances.nix;
   glitchtip = runTest ./glitchtip.nix;
-  glusterfs = handleTest ./glusterfs.nix { };
+  glusterfs = runTest ./glusterfs.nix;
   gnome = runTest ./gnome.nix;
-  gnome-extensions = handleTest ./gnome-extensions.nix { };
-  gnome-flashback = handleTest ./gnome-flashback.nix { };
-  gnome-xorg = handleTest ./gnome-xorg.nix { };
-  gns3-server = handleTest ./gns3-server.nix { };
-  gnupg = handleTest ./gnupg.nix { };
-  goatcounter = handleTest ./goatcounter.nix { };
+  gnome-extensions = runTest ./gnome-extensions.nix;
+  gnome-flashback = runTest ./gnome-flashback.nix;
+  gnome-xorg = runTest ./gnome-xorg.nix;
+  gns3-server = runTest ./gns3-server.nix;
+  gnupg = runTest ./gnupg.nix;
+  goatcounter = runTest ./goatcounter.nix;
   go-camo = handleTest ./go-camo.nix { };
   go-neb = runTest ./go-neb.nix;
-  gobgpd = handleTest ./gobgpd.nix { };
-  gocd-agent = handleTest ./gocd-agent.nix { };
-  gocd-server = handleTest ./gocd-server.nix { };
+  gobgpd = runTest ./gobgpd.nix;
+  gocd-agent = runTest ./gocd-agent.nix;
+  gocd-server = runTest ./gocd-server.nix;
   gokapi = runTest ./gokapi.nix;
-  gollum = handleTest ./gollum.nix { };
-  gonic = handleTest ./gonic.nix { };
+  gollum = runTest ./gollum.nix;
+  gonic = runTest ./gonic.nix;
   google-oslogin = handleTest ./google-oslogin { };
-  gopro-tool = handleTest ./gopro-tool.nix { };
-  goss = handleTest ./goss.nix { };
-  gotenberg = handleTest ./gotenberg.nix { };
-  gotify-server = handleTest ./gotify-server.nix { };
+  gopro-tool = runTest ./gopro-tool.nix;
+  goss = runTest ./goss.nix;
+  gotenberg = runTest ./gotenberg.nix;
+  gotify-server = runTest ./gotify-server.nix;
   gotosocial = runTest ./web-apps/gotosocial.nix;
   grafana = handleTest ./grafana { };
-  graphite = handleTest ./graphite.nix { };
+  graphite = runTest ./graphite.nix;
   grav = runTest ./web-apps/grav.nix;
-  graylog = handleTest ./graylog.nix { };
-  greetd-no-shadow = handleTest ./greetd-no-shadow.nix { };
+  graylog = runTest ./graylog.nix;
+  greetd-no-shadow = runTest ./greetd-no-shadow.nix;
   grocy = runTest ./grocy.nix;
   grow-partition = runTest ./grow-partition.nix;
-  grub = handleTest ./grub.nix { };
-  guacamole-server = handleTest ./guacamole-server.nix { };
+  grub = runTest ./grub.nix;
+  guacamole-server = runTest ./guacamole-server.nix;
   guix = handleTest ./guix { };
-  gvisor = handleTest ./gvisor.nix { };
+  gvisor = runTest ./gvisor.nix;
   h2o = import ./web-servers/h2o { inherit recurseIntoAttrs runTest; };
   hadoop = import ./hadoop {
     inherit handleTestOn;
@@ -592,32 +593,38 @@ in
     inherit handleTestOn;
     package = pkgs.hadoop2;
   };
-  haste-server = handleTest ./haste-server.nix { };
+  haste-server = runTest ./haste-server.nix;
   haproxy = runTest ./haproxy.nix;
-  hardened = handleTest ./hardened.nix { };
+  hardened = runTest ./hardened.nix;
   harmonia = runTest ./harmonia.nix;
-  headscale = handleTest ./headscale.nix { };
-  healthchecks = handleTest ./web-apps/healthchecks.nix { };
+  headscale = runTest ./headscale.nix;
+  healthchecks = runTest ./web-apps/healthchecks.nix;
   hbase2 = handleTest ./hbase.nix { package = pkgs.hbase2; };
   hbase_2_5 = handleTest ./hbase.nix { package = pkgs.hbase_2_5; };
   hbase_2_4 = handleTest ./hbase.nix { package = pkgs.hbase_2_4; };
   hbase3 = handleTest ./hbase.nix { package = pkgs.hbase3; };
-  hedgedoc = handleTest ./hedgedoc.nix { };
-  herbstluftwm = handleTest ./herbstluftwm.nix { };
-  homebox = handleTest ./homebox.nix { };
+  hedgedoc = runTest ./hedgedoc.nix;
+  herbstluftwm = runTest ./herbstluftwm.nix;
+  homebox = runTest ./homebox.nix;
   homer = handleTest ./homer { };
   homepage-dashboard = runTest ./homepage-dashboard.nix;
   honk = runTest ./honk.nix;
   installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests { });
-  invidious = handleTest ./invidious.nix { };
-  iosched = handleTest ./iosched.nix { };
-  isolate = handleTest ./isolate.nix { };
-  livebook-service = handleTest ./livebook-service.nix { };
-  pyload = handleTest ./pyload.nix { };
+  invidious = runTest ./invidious.nix;
+  iosched = runTest ./iosched.nix;
+  isolate = runTest ./isolate.nix;
+  livebook-service = runTest ./livebook-service.nix;
+  pyload = runTest ./pyload.nix;
   oci-containers = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./oci-containers.nix { };
-  odoo = handleTest ./odoo.nix { };
-  odoo17 = handleTest ./odoo.nix { package = pkgs.odoo17; };
-  odoo16 = handleTest ./odoo.nix { package = pkgs.odoo16; };
+  odoo = runTest ./odoo.nix;
+  odoo17 = runTest {
+    imports = [ ./odoo.nix ];
+    _module.args.package = pkgs.odoo17;
+  };
+  odoo16 = runTest {
+    imports = [ ./odoo.nix ];
+    _module.args.package = pkgs.odoo16;
+  };
   oncall = runTest ./web-apps/oncall.nix;
   # 9pnet_virtio used to mount /nix partition doesn't support
   # hibernation. This test happens to work on x86_64-linux but
@@ -627,20 +634,20 @@ in
     systemdStage1 = true;
   };
   hitch = handleTest ./hitch { };
-  hledger-web = handleTest ./hledger-web.nix { };
-  hockeypuck = handleTest ./hockeypuck.nix { };
+  hledger-web = runTest ./hledger-web.nix;
+  hockeypuck = runTest ./hockeypuck.nix;
   home-assistant = runTest ./home-assistant.nix;
   hostname = handleTest ./hostname.nix { };
-  hound = handleTest ./hound.nix { };
+  hound = runTest ./hound.nix;
   hub = runTest ./git/hub.nix;
   hydra = runTest ./hydra;
-  i3wm = handleTest ./i3wm.nix { };
+  i3wm = runTest ./i3wm.nix;
   icingaweb2 = runTest ./icingaweb2.nix;
-  ifm = handleTest ./ifm.nix { };
-  iftop = handleTest ./iftop.nix { };
-  immich = handleTest ./web-apps/immich.nix { };
-  immich-public-proxy = handleTest ./web-apps/immich-public-proxy.nix { };
-  incron = handleTest ./incron.nix { };
+  ifm = runTest ./ifm.nix;
+  iftop = runTest ./iftop.nix;
+  immich = runTest ./web-apps/immich.nix;
+  immich-public-proxy = runTest ./web-apps/immich-public-proxy.nix;
+  incron = runTest ./incron.nix;
   incus = pkgs.recurseIntoAttrs (
     handleTest ./incus {
       lts = false;
@@ -648,51 +655,51 @@ in
     }
   );
   incus-lts = pkgs.recurseIntoAttrs (handleTest ./incus { inherit system pkgs; });
-  influxdb = handleTest ./influxdb.nix { };
-  influxdb2 = handleTest ./influxdb2.nix { };
+  influxdb = runTest ./influxdb.nix;
+  influxdb2 = runTest ./influxdb2.nix;
+  initrd-luks-empty-passphrase = runTest ./initrd-luks-empty-passphrase.nix;
   initrd-network-openvpn = handleTestOn [ "x86_64-linux" "i686-linux" ] ./initrd-network-openvpn { };
   initrd-network-ssh = handleTest ./initrd-network-ssh { };
-  initrd-luks-empty-passphrase = handleTest ./initrd-luks-empty-passphrase.nix { };
-  initrdNetwork = handleTest ./initrd-network.nix { };
   initrd-secrets = handleTest ./initrd-secrets.nix { };
   initrd-secrets-changing = handleTest ./initrd-secrets-changing.nix { };
-  input-remapper = handleTest ./input-remapper.nix { };
-  inspircd = handleTest ./inspircd.nix { };
+  initrdNetwork = runTest ./initrd-network.nix;
+  input-remapper = runTest ./input-remapper.nix;
+  inspircd = runTest ./inspircd.nix;
   installer = handleTest ./installer.nix { };
   installer-systemd-stage-1 = handleTest ./installer-systemd-stage-1.nix { };
-  intune = handleTest ./intune.nix { };
+  intune = runTest ./intune.nix;
   invoiceplane = runTest ./invoiceplane.nix;
-  iodine = handleTest ./iodine.nix { };
-  ipv6 = handleTest ./ipv6.nix { };
-  iscsi-multipath-root = handleTest ./iscsi-multipath-root.nix { };
-  iscsi-root = handleTest ./iscsi-root.nix { };
-  isso = handleTest ./isso.nix { };
-  jackett = handleTest ./jackett.nix { };
-  jellyfin = handleTest ./jellyfin.nix { };
-  jenkins = handleTest ./jenkins.nix { };
-  jenkins-cli = handleTest ./jenkins-cli.nix { };
-  jibri = handleTest ./jibri.nix { };
-  jirafeau = handleTest ./jirafeau.nix { };
-  jitsi-meet = handleTest ./jitsi-meet.nix { };
+  iodine = runTest ./iodine.nix;
+  ipv6 = runTest ./ipv6.nix;
+  iscsi-multipath-root = runTest ./iscsi-multipath-root.nix;
+  iscsi-root = runTest ./iscsi-root.nix;
+  isso = runTest ./isso.nix;
+  jackett = runTest ./jackett.nix;
+  jellyfin = runTest ./jellyfin.nix;
+  jenkins = runTest ./jenkins.nix;
+  jenkins-cli = runTest ./jenkins-cli.nix;
+  jibri = runTest ./jibri.nix;
+  jirafeau = runTest ./jirafeau.nix;
+  jitsi-meet = runTest ./jitsi-meet.nix;
   jool = import ./jool.nix { inherit pkgs runTest; };
-  jotta-cli = handleTest ./jotta-cli.nix { };
+  jotta-cli = runTest ./jotta-cli.nix;
   k3s = handleTest ./k3s { };
   kafka = handleTest ./kafka { };
   kanboard = runTest ./web-apps/kanboard.nix;
-  kanidm = handleTest ./kanidm.nix { };
-  kanidm-provisioning = handleTest ./kanidm-provisioning.nix { };
-  karma = handleTest ./karma.nix { };
-  kavita = handleTest ./kavita.nix { };
-  kbd-setfont-decompress = handleTest ./kbd-setfont-decompress.nix { };
-  kbd-update-search-paths-patch = handleTest ./kbd-update-search-paths-patch.nix { };
+  kanidm = runTest ./kanidm.nix;
+  kanidm-provisioning = runTest ./kanidm-provisioning.nix;
+  karma = runTest ./karma.nix;
+  kavita = runTest ./kavita.nix;
+  kbd-setfont-decompress = runTest ./kbd-setfont-decompress.nix;
+  kbd-update-search-paths-patch = runTest ./kbd-update-search-paths-patch.nix;
   kea = runTest ./kea.nix;
-  keepalived = handleTest ./keepalived.nix { };
-  keepassxc = handleTest ./keepassxc.nix { };
+  keepalived = runTest ./keepalived.nix;
+  keepassxc = runTest ./keepassxc.nix;
   kerberos = handleTest ./kerberos/default.nix { };
   kernel-generic = handleTest ./kernel-generic.nix { };
-  kernel-latest-ath-user-regd = handleTest ./kernel-latest-ath-user-regd.nix { };
+  kernel-latest-ath-user-regd = runTest ./kernel-latest-ath-user-regd.nix;
   kernel-rust = handleTest ./kernel-rust.nix { };
-  keter = handleTest ./keter.nix { };
+  keter = runTest ./keter.nix;
   kexec = runTest ./kexec.nix;
   keycloak = discoverTests (import ./keycloak.nix);
   keyd = handleTest ./keyd.nix { };
@@ -701,52 +708,56 @@ in
   kismet = runTest ./kismet.nix;
   kmonad = runTest ./kmonad.nix;
   knot = runTest ./knot.nix;
-  komga = handleTest ./komga.nix { };
+  komga = runTest ./komga.nix;
   krb5 = discoverTests (import ./krb5);
-  ksm = handleTest ./ksm.nix { };
-  kthxbye = handleTest ./kthxbye.nix { };
+  ksm = runTest ./ksm.nix;
+  kthxbye = runTest ./kthxbye.nix;
   kubernetes = handleTestOn [ "x86_64-linux" ] ./kubernetes { };
   kubo = import ./kubo { inherit recurseIntoAttrs runTest; };
-  ladybird = handleTest ./ladybird.nix { };
-  languagetool = handleTest ./languagetool.nix { };
-  lanraragi = handleTest ./lanraragi.nix { };
-  latestKernel.login = handleTest ./login.nix { latestKernel = true; };
+  lact = runTest ./lact.nix;
+  ladybird = runTest ./ladybird.nix;
+  languagetool = runTest ./languagetool.nix;
+  lanraragi = runTest ./lanraragi.nix;
+  latestKernel.login = runTest {
+    imports = [ ./login.nix ];
+    _module.args.latestKernel = true;
+  };
   lasuite-docs = runTest ./web-apps/lasuite-docs.nix;
   lavalink = runTest ./lavalink.nix;
-  leaps = handleTest ./leaps.nix { };
-  lemmy = handleTest ./lemmy.nix { };
-  libinput = handleTest ./libinput.nix { };
+  leaps = runTest ./leaps.nix;
+  lemmy = runTest ./lemmy.nix;
+  libinput = runTest ./libinput.nix;
   librenms = runTest ./librenms.nix;
-  libresprite = handleTest ./libresprite.nix { };
+  libresprite = runTest ./libresprite.nix;
   libreswan = runTest ./libreswan.nix;
   libreswan-nat = runTest ./libreswan-nat.nix;
   librewolf = runTest {
     imports = [ ./firefox.nix ];
     _module.args.firefoxPackage = pkgs.librewolf;
   };
-  libuiohook = handleTest ./libuiohook.nix { };
-  libvirtd = handleTest ./libvirtd.nix { };
-  lidarr = handleTest ./lidarr.nix { };
-  lightdm = handleTest ./lightdm.nix { };
+  libuiohook = runTest ./libuiohook.nix;
+  libvirtd = runTest ./libvirtd.nix;
+  lidarr = runTest ./lidarr.nix;
+  lightdm = runTest ./lightdm.nix;
   lighttpd = runTest ./lighttpd.nix;
   livekit = runTest ./networking/livekit.nix;
-  limesurvey = handleTest ./limesurvey.nix { };
+  limesurvey = runTest ./limesurvey.nix;
   limine = import ./limine { inherit runTest; };
   listmonk = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./listmonk.nix { };
   litellm = runTest ./litellm.nix;
-  litestream = handleTest ./litestream.nix { };
+  litestream = runTest ./litestream.nix;
   lk-jwt-service = runTest ./matrix/lk-jwt-service.nix;
-  lldap = handleTest ./lldap.nix { };
-  localsend = handleTest ./localsend.nix { };
-  locate = handleTest ./locate.nix { };
-  login = handleTest ./login.nix { };
+  lldap = runTest ./lldap.nix;
+  localsend = runTest ./localsend.nix;
+  locate = runTest ./locate.nix;
+  login = runTest ./login.nix;
   logrotate = runTest ./logrotate.nix;
-  loki = handleTest ./loki.nix { };
-  luks = handleTest ./luks.nix { };
+  loki = runTest ./loki.nix;
+  luks = runTest ./luks.nix;
   lvm2 = handleTest ./lvm2 { };
   lxc = handleTest ./lxc { };
   lxd = pkgs.recurseIntoAttrs (handleTest ./lxd { inherit handleTestOn; });
-  lxd-image-server = handleTest ./lxd-image-server.nix { };
+  lxd-image-server = runTest ./lxd-image-server.nix;
   #logstash = handleTest ./logstash.nix {};
   lomiri = discoverTests (import ./lomiri.nix);
   lomiri-calculator-app = runTest ./lomiri-calculator-app.nix;
@@ -760,60 +771,60 @@ in
   lomiri-gallery-app = runTest ./lomiri-gallery-app.nix;
   lomiri-system-settings = runTest ./lomiri-system-settings.nix;
   lorri = handleTest ./lorri/default.nix { };
-  lxqt = handleTest ./lxqt.nix { };
-  ly = handleTest ./ly.nix { };
+  lxqt = runTest ./lxqt.nix;
+  ly = runTest ./ly.nix;
   maddy = discoverTests (import ./maddy { inherit handleTest; });
-  maestral = handleTest ./maestral.nix { };
+  maestral = runTest ./maestral.nix;
   magic-wormhole-mailbox-server = runTest ./magic-wormhole-mailbox-server.nix;
-  magnetico = handleTest ./magnetico.nix { };
+  magnetico = runTest ./magnetico.nix;
   mailcatcher = runTest ./mailcatcher.nix;
   mailhog = runTest ./mailhog.nix;
   mailpit = runTest ./mailpit.nix;
   mailman = runTest ./mailman.nix;
   man = runTest ./man.nix;
   mariadb-galera = handleTest ./mysql/mariadb-galera.nix { };
-  marytts = handleTest ./marytts.nix { };
+  marytts = runTest ./marytts.nix;
   mastodon = pkgs.recurseIntoAttrs (handleTest ./web-apps/mastodon { inherit handleTestOn; });
   pixelfed = discoverTests (import ./web-apps/pixelfed { inherit handleTestOn; });
-  mate = handleTest ./mate.nix { };
-  mate-wayland = handleTest ./mate-wayland.nix { };
-  matter-server = handleTest ./matter-server.nix { };
+  mate = runTest ./mate.nix;
+  mate-wayland = runTest ./mate-wayland.nix;
+  matter-server = runTest ./matter-server.nix;
   matomo = runTest ./matomo.nix;
   matrix-alertmanager = runTest ./matrix/matrix-alertmanager.nix;
   matrix-appservice-irc = runTest ./matrix/appservice-irc.nix;
-  matrix-conduit = handleTest ./matrix/conduit.nix { };
+  matrix-conduit = runTest ./matrix/conduit.nix;
   matrix-continuwuity = runTest ./matrix/continuwuity.nix;
-  matrix-synapse = handleTest ./matrix/synapse.nix { };
-  matrix-synapse-workers = handleTest ./matrix/synapse-workers.nix { };
-  mautrix-meta-postgres = handleTest ./matrix/mautrix-meta-postgres.nix { };
-  mautrix-meta-sqlite = handleTest ./matrix/mautrix-meta-sqlite.nix { };
+  matrix-synapse = runTest ./matrix/synapse.nix;
+  matrix-synapse-workers = runTest ./matrix/synapse-workers.nix;
   mattermost = handleTest ./mattermost { };
-  mealie = handleTest ./mealie.nix { };
-  mediamtx = handleTest ./mediamtx.nix { };
+  mautrix-meta-postgres = runTest ./matrix/mautrix-meta-postgres.nix;
+  mautrix-meta-sqlite = runTest ./matrix/mautrix-meta-sqlite.nix;
+  mealie = runTest ./mealie.nix;
+  mediamtx = runTest ./mediamtx.nix;
   mediatomb = handleTest ./mediatomb.nix { };
   mediawiki = handleTest ./mediawiki.nix { };
-  meilisearch = handleTest ./meilisearch.nix { };
+  meilisearch = runTest ./meilisearch.nix;
   memcached = runTest ./memcached.nix;
-  merecat = handleTest ./merecat.nix { };
-  metabase = handleTest ./metabase.nix { };
-  mihomo = handleTest ./mihomo.nix { };
-  mindustry = handleTest ./mindustry.nix { };
-  minecraft = handleTest ./minecraft.nix { };
-  minecraft-server = handleTest ./minecraft-server.nix { };
-  minidlna = handleTest ./minidlna.nix { };
-  miniflux = handleTest ./miniflux.nix { };
-  minio = handleTest ./minio.nix { };
+  merecat = runTest ./merecat.nix;
+  metabase = runTest ./metabase.nix;
+  mihomo = runTest ./mihomo.nix;
+  mindustry = runTest ./mindustry.nix;
+  minecraft = runTest ./minecraft.nix;
+  minecraft-server = runTest ./minecraft-server.nix;
+  minidlna = runTest ./minidlna.nix;
+  miniflux = runTest ./miniflux.nix;
+  minio = runTest ./minio.nix;
   miracle-wm = runTest ./miracle-wm.nix;
   miriway = runTest ./miriway.nix;
-  misc = handleTest ./misc.nix { };
-  misskey = handleTest ./misskey.nix { };
-  mjolnir = handleTest ./matrix/mjolnir.nix { };
+  misc = runTest ./misc.nix;
+  misskey = runTest ./misskey.nix;
+  mjolnir = runTest ./matrix/mjolnir.nix;
   mobilizon = runTest ./mobilizon.nix;
-  mod_perl = handleTest ./mod_perl.nix { };
-  molly-brown = handleTest ./molly-brown.nix { };
-  mollysocket = handleTest ./mollysocket.nix { };
-  monado = handleTest ./monado.nix { };
-  monetdb = handleTest ./monetdb.nix { };
+  mod_perl = runTest ./mod_perl.nix;
+  molly-brown = runTest ./molly-brown.nix;
+  mollysocket = runTest ./mollysocket.nix;
+  monado = runTest ./monado.nix;
+  monetdb = runTest ./monetdb.nix;
   monica = runTest ./web-apps/monica.nix;
   mongodb = runTest ./mongodb.nix;
   mongodb-ce = runTest (
@@ -824,33 +835,33 @@ in
     }
   );
   moodle = runTest ./moodle.nix;
-  moonraker = handleTest ./moonraker.nix { };
-  mopidy = handleTest ./mopidy.nix { };
+  moonraker = runTest ./moonraker.nix;
+  mopidy = runTest ./mopidy.nix;
   morph-browser = runTest ./morph-browser.nix;
-  morty = handleTest ./morty.nix { };
+  morty = runTest ./morty.nix;
   mosquitto = runTest ./mosquitto.nix;
-  moosefs = handleTest ./moosefs.nix { };
+  moosefs = runTest ./moosefs.nix;
   movim = import ./web-apps/movim { inherit recurseIntoAttrs runTest; };
   mpd = runTest ./mpd.nix;
   mpv = runTest ./mpv.nix;
-  mtp = handleTest ./mtp.nix { };
-  multipass = handleTest ./multipass.nix { };
+  mtp = runTest ./mtp.nix;
+  multipass = runTest ./multipass.nix;
   mumble = runTest ./mumble.nix;
   # Fails on aarch64-linux at the PDF creation step - need to debug this on an
   # aarch64 machine..
   musescore = handleTestOn [ "x86_64-linux" ] ./musescore.nix { };
   music-assistant = runTest ./music-assistant.nix;
-  munin = handleTest ./munin.nix { };
-  mutableUsers = handleTest ./mutable-users.nix { };
+  munin = runTest ./munin.nix;
+  mutableUsers = runTest ./mutable-users.nix;
   mycelium = handleTest ./mycelium { };
-  mympd = handleTest ./mympd.nix { };
+  mympd = runTest ./mympd.nix;
   mysql = handleTest ./mysql/mysql.nix { };
   mysql-autobackup = handleTest ./mysql/mysql-autobackup.nix { };
   mysql-backup = handleTest ./mysql/mysql-backup.nix { };
   mysql-replication = handleTest ./mysql/mysql-replication.nix { };
   n8n = runTest ./n8n.nix;
   nagios = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./nagios.nix { };
-  nar-serve = handleTest ./nar-serve.nix { };
+  nar-serve = runTest ./nar-serve.nix;
   nat.firewall = handleTest ./nat.nix { withFirewall = true; };
   nat.standalone = handleTest ./nat.nix { withFirewall = false; };
   nat.nftables.firewall = handleTest ./nat.nix {
@@ -861,39 +872,39 @@ in
     withFirewall = false;
     nftables = true;
   };
-  nats = handleTest ./nats.nix { };
-  navidrome = handleTest ./navidrome.nix { };
-  nbd = handleTest ./nbd.nix { };
-  ncdns = handleTest ./ncdns.nix { };
+  nats = runTest ./nats.nix;
+  navidrome = runTest ./navidrome.nix;
+  nbd = runTest ./nbd.nix;
+  ncdns = runTest ./ncdns.nix;
   ncps = runTest ./ncps.nix;
   ncps-custom-cache-datapath = runTest {
     imports = [ ./ncps.nix ];
     defaults.services.ncps.cache.dataPath = "/path/to/ncps";
   };
-  ndppd = handleTest ./ndppd.nix { };
-  nix-channel = pkgs.callPackage ../modules/config/nix-channel/test.nix { };
-  nebula = handleTest ./nebula.nix { };
-  netbird = handleTest ./netbird.nix { };
-  nimdow = handleTest ./nimdow.nix { };
+  ndppd = runTest ./ndppd.nix;
+  nebula = runTest ./nebula.nix;
   neo4j = handleTest ./neo4j.nix { };
-  netdata = handleTest ./netdata.nix { };
+  netbird = runTest ./netbird.nix;
+  netdata = runTest ./netdata.nix;
+  nimdow = runTest ./nimdow.nix;
+  nix-channel = pkgs.callPackage ../modules/config/nix-channel/test.nix { };
   networking.scripted = handleTest ./networking/networkd-and-scripted.nix { networkd = false; };
   networking.networkd = handleTest ./networking/networkd-and-scripted.nix { networkd = true; };
   networking.networkmanager = handleTest ./networking/networkmanager.nix { };
   netbox_3_7 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_3_7; };
   netbox_4_1 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_1; };
   netbox_4_2 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_2; };
-  netbox-upgrade = handleTest ./web-apps/netbox-upgrade.nix { };
+  netbox-upgrade = runTest ./web-apps/netbox-upgrade.nix;
   # TODO: put in networking.nix after the test becomes more complete
-  networkingProxy = handleTest ./networking-proxy.nix { };
+  networkingProxy = runTest ./networking-proxy.nix;
   nextcloud = handleTest ./nextcloud { };
   nextflow = runTestOn [ "x86_64-linux" ] ./nextflow.nix;
   nextjs-ollama-llm-ui = runTest ./web-apps/nextjs-ollama-llm-ui.nix;
-  nexus = handleTest ./nexus.nix { };
+  nexus = runTest ./nexus.nix;
   # TODO: Test nfsv3 + Kerberos
   nfs3 = handleTest ./nfs { version = 3; };
   nfs4 = handleTest ./nfs { version = 4; };
-  nghttpx = handleTest ./nghttpx.nix { };
+  nghttpx = runTest ./nghttpx.nix;
   nginx = runTest ./nginx.nix;
   nginx-auth = runTest ./nginx-auth.nix;
   nginx-etag = runTest ./nginx-etag.nix;
@@ -903,7 +914,7 @@ in
   nginx-mime = runTest ./nginx-mime.nix;
   nginx-modsecurity = runTest ./nginx-modsecurity.nix;
   nginx-moreheaders = runTest ./nginx-moreheaders.nix;
-  nginx-njs = handleTest ./nginx-njs.nix { };
+  nginx-njs = runTest ./nginx-njs.nix;
   nginx-proxyprotocol = runTest ./nginx-proxyprotocol/default.nix;
   nginx-pubhtml = runTest ./nginx-pubhtml.nix;
   nginx-redirectcode = runTest ./nginx-redirectcode.nix;
@@ -913,16 +924,16 @@ in
   nginx-unix-socket = runTest ./nginx-unix-socket.nix;
   nginx-variants = import ./nginx-variants.nix { inherit pkgs runTest; };
   nifi = runTestOn [ "x86_64-linux" ] ./web-apps/nifi.nix;
-  nitter = handleTest ./nitter.nix { };
-  nix-config = handleTest ./nix-config.nix { };
+  nitter = runTest ./nitter.nix;
+  nix-config = runTest ./nix-config.nix;
   nix-ld = runTest ./nix-ld.nix;
   nix-misc = handleTest ./nix/misc.nix { };
   nix-upgrade = handleTest ./nix/upgrade.nix { inherit (pkgs) nixVersions; };
   nix-required-mounts = runTest ./nix-required-mounts;
   nix-serve = runTest ./nix-serve.nix;
-  nix-serve-ssh = handleTest ./nix-serve-ssh.nix { };
+  nix-serve-ssh = runTest ./nix-serve-ssh.nix;
   nixops = handleTest ./nixops/default.nix { };
-  nixos-generate-config = handleTest ./nixos-generate-config.nix { };
+  nixos-generate-config = runTest ./nixos-generate-config.nix;
   nixos-rebuild-install-bootloader = handleTestOn [
     "x86_64-linux"
   ] ./nixos-rebuild-install-bootloader.nix { };
@@ -946,97 +957,97 @@ in
     _module.args.withNg = true;
   };
   nixpkgs = pkgs.callPackage ../modules/misc/nixpkgs/test.nix { inherit evalMinimalConfig; };
-  nixseparatedebuginfod = handleTest ./nixseparatedebuginfod.nix { };
+  nixseparatedebuginfod = runTest ./nixseparatedebuginfod.nix;
   node-red = runTest ./node-red.nix;
   nomad = runTest ./nomad.nix;
   non-default-filesystems = handleTest ./non-default-filesystems.nix { };
   non-switchable-system = runTest ./non-switchable-system.nix;
   noto-fonts = runTest ./noto-fonts.nix;
-  noto-fonts-cjk-qt-default-weight = handleTest ./noto-fonts-cjk-qt-default-weight.nix { };
+  noto-fonts-cjk-qt-default-weight = runTest ./noto-fonts-cjk-qt-default-weight.nix;
   novacomd = handleTestOn [ "x86_64-linux" ] ./novacomd.nix { };
-  npmrc = handleTest ./npmrc.nix { };
-  nscd = handleTest ./nscd.nix { };
-  nsd = handleTest ./nsd.nix { };
+  npmrc = runTest ./npmrc.nix;
+  nscd = runTest ./nscd.nix;
+  nsd = runTest ./nsd.nix;
   ntfy-sh = handleTest ./ntfy-sh.nix { };
   ntfy-sh-migration = handleTest ./ntfy-sh-migration.nix { };
-  ntpd = handleTest ./ntpd.nix { };
-  ntpd-rs = handleTest ./ntpd-rs.nix { };
+  ntpd = runTest ./ntpd.nix;
+  ntpd-rs = runTest ./ntpd-rs.nix;
   nvidia-container-toolkit = runTest ./nvidia-container-toolkit.nix;
-  nvmetcfg = handleTest ./nvmetcfg.nix { };
-  nzbget = handleTest ./nzbget.nix { };
-  nzbhydra2 = handleTest ./nzbhydra2.nix { };
-  ocis = handleTest ./ocis.nix { };
+  nvmetcfg = runTest ./nvmetcfg.nix;
+  nzbget = runTest ./nzbget.nix;
+  nzbhydra2 = runTest ./nzbhydra2.nix;
+  ocis = runTest ./ocis.nix;
   oddjobd = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./oddjobd.nix { };
   obs-studio = runTest ./obs-studio.nix;
-  oh-my-zsh = handleTest ./oh-my-zsh.nix { };
+  oh-my-zsh = runTest ./oh-my-zsh.nix;
   olivetin = runTest ./olivetin.nix;
   ollama = runTest ./ollama.nix;
   ollama-cuda = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-cuda.nix;
   ollama-rocm = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-rocm.nix;
-  ombi = handleTest ./ombi.nix { };
-  openarena = handleTest ./openarena.nix { };
+  ombi = runTest ./ombi.nix;
+  openarena = runTest ./openarena.nix;
   openbao = runTest ./openbao.nix;
   opencloud = runTest ./opencloud.nix;
-  openldap = handleTest ./openldap.nix { };
+  openldap = runTest ./openldap.nix;
+  openresty-lua = runTest ./openresty-lua.nix;
   opensearch = discoverTests (import ./opensearch.nix);
-  openresty-lua = handleTest ./openresty-lua.nix { };
   opensmtpd = handleTest ./opensmtpd.nix { };
   opensmtpd-rspamd = handleTest ./opensmtpd-rspamd.nix { };
-  opensnitch = handleTest ./opensnitch.nix { };
-  openssh = handleTest ./openssh.nix { };
-  octoprint = handleTest ./octoprint.nix { };
+  opensnitch = runTest ./opensnitch.nix;
+  openssh = runTest ./openssh.nix;
+  octoprint = runTest ./octoprint.nix;
   openstack-image-metadata =
     (handleTestOn [ "x86_64-linux" ] ./openstack-image.nix { }).metadata or { };
   openstack-image-userdata =
     (handleTestOn [ "x86_64-linux" ] ./openstack-image.nix { }).userdata or { };
-  opentabletdriver = handleTest ./opentabletdriver.nix { };
-  opentelemetry-collector = handleTest ./opentelemetry-collector.nix { };
-  open-web-calendar = handleTest ./web-apps/open-web-calendar.nix { };
+  opentabletdriver = runTest ./opentabletdriver.nix;
+  opentelemetry-collector = runTest ./opentelemetry-collector.nix;
+  open-web-calendar = runTest ./web-apps/open-web-calendar.nix;
   ocsinventory-agent = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./ocsinventory-agent.nix { };
   orthanc = runTest ./orthanc.nix;
-  owncast = handleTest ./owncast.nix { };
-  outline = handleTest ./outline.nix { };
+  owncast = runTest ./owncast.nix;
+  outline = runTest ./outline.nix;
   i18n = runTest ./i18n.nix;
   image-contents = handleTest ./image-contents.nix { };
-  openvscode-server = handleTest ./openvscode-server.nix { };
+  openvscode-server = runTest ./openvscode-server.nix;
   open-webui = runTest ./open-webui.nix;
   openvswitch = runTest ./openvswitch.nix;
-  orangefs = handleTest ./orangefs.nix { };
+  orangefs = runTest ./orangefs.nix;
   os-prober = handleTestOn [ "x86_64-linux" ] ./os-prober.nix { };
   osquery = handleTestOn [ "x86_64-linux" ] ./osquery.nix { };
-  osrm-backend = handleTest ./osrm-backend.nix { };
-  overlayfs = handleTest ./overlayfs.nix { };
-  pacemaker = handleTest ./pacemaker.nix { };
-  packagekit = handleTest ./packagekit.nix { };
-  pam-file-contents = handleTest ./pam/pam-file-contents.nix { };
-  pam-oath-login = handleTest ./pam/pam-oath-login.nix { };
-  pam-u2f = handleTest ./pam/pam-u2f.nix { };
-  pam-ussh = handleTest ./pam/pam-ussh.nix { };
-  pam-zfs-key = handleTest ./pam/zfs-key.nix { };
+  osrm-backend = runTest ./osrm-backend.nix;
+  overlayfs = runTest ./overlayfs.nix;
+  pacemaker = runTest ./pacemaker.nix;
+  packagekit = runTest ./packagekit.nix;
+  pam-file-contents = runTest ./pam/pam-file-contents.nix;
+  pam-oath-login = runTest ./pam/pam-oath-login.nix;
+  pam-u2f = runTest ./pam/pam-u2f.nix;
+  pam-ussh = runTest ./pam/pam-ussh.nix;
+  pam-zfs-key = runTest ./pam/zfs-key.nix;
   paretosecurity = runTest ./paretosecurity.nix;
-  pass-secret-service = handleTest ./pass-secret-service.nix { };
+  pass-secret-service = runTest ./pass-secret-service.nix;
   patroni = handleTestOn [ "x86_64-linux" ] ./patroni.nix { };
-  pantalaimon = handleTest ./matrix/pantalaimon.nix { };
-  pantheon = handleTest ./pantheon.nix { };
-  pantheon-wayland = handleTest ./pantheon-wayland.nix { };
-  paperless = handleTest ./paperless.nix { };
+  pantalaimon = runTest ./matrix/pantalaimon.nix;
+  pantheon = runTest ./pantheon.nix;
+  pantheon-wayland = runTest ./pantheon-wayland.nix;
+  paperless = runTest ./paperless.nix;
   parsedmarc = handleTest ./parsedmarc { };
-  password-option-override-ordering = handleTest ./password-option-override-ordering.nix { };
+  password-option-override-ordering = runTest ./password-option-override-ordering.nix;
   pdns-recursor = runTest ./pdns-recursor.nix;
-  pds = handleTest ./pds.nix { };
-  peerflix = handleTest ./peerflix.nix { };
-  peering-manager = handleTest ./web-apps/peering-manager.nix { };
+  pds = runTest ./pds.nix;
+  peerflix = runTest ./peerflix.nix;
+  peering-manager = runTest ./web-apps/peering-manager.nix;
   peertube = handleTestOn [ "x86_64-linux" ] ./web-apps/peertube.nix { };
-  peroxide = handleTest ./peroxide.nix { };
+  peroxide = runTest ./peroxide.nix;
   pgadmin4 = runTest ./pgadmin4.nix;
   pgbackrest = import ./pgbackrest { inherit runTest; };
-  pgbouncer = handleTest ./pgbouncer.nix { };
+  pgbouncer = runTest ./pgbouncer.nix;
   pghero = runTest ./pghero.nix;
   pgweb = runTest ./pgweb.nix;
-  pgmanage = handleTest ./pgmanage.nix { };
-  phosh = handleTest ./phosh.nix { };
-  photonvision = handleTest ./photonvision.nix { };
-  photoprism = handleTest ./photoprism.nix { };
+  pgmanage = runTest ./pgmanage.nix;
+  phosh = runTest ./phosh.nix;
+  photonvision = runTest ./photonvision.nix;
+  photoprism = runTest ./photoprism.nix;
   php = import ./php/default.nix {
     inherit runTest;
     php = pkgs.php;
@@ -1057,43 +1068,43 @@ in
     inherit runTest;
     php = pkgs.php84;
   };
-  phylactery = handleTest ./web-apps/phylactery.nix { };
-  pict-rs = handleTest ./pict-rs.nix { };
-  pingvin-share = handleTest ./pingvin-share.nix { };
+  phylactery = runTest ./web-apps/phylactery.nix;
+  pict-rs = runTest ./pict-rs.nix;
+  pingvin-share = runTest ./pingvin-share.nix;
   pinnwand = runTest ./pinnwand.nix;
-  plantuml-server = handleTest ./plantuml-server.nix { };
-  plasma-bigscreen = handleTest ./plasma-bigscreen.nix { };
-  plasma5 = handleTest ./plasma5.nix { };
-  plasma6 = handleTest ./plasma6.nix { };
-  plasma5-systemd-start = handleTest ./plasma5-systemd-start.nix { };
-  plausible = handleTest ./plausible.nix { };
-  playwright-python = handleTest ./playwright-python.nix { };
-  please = handleTest ./please.nix { };
+  plantuml-server = runTest ./plantuml-server.nix;
+  plasma-bigscreen = runTest ./plasma-bigscreen.nix;
+  plasma5 = runTest ./plasma5.nix;
+  plasma6 = runTest ./plasma6.nix;
+  plasma5-systemd-start = runTest ./plasma5-systemd-start.nix;
+  plausible = runTest ./plausible.nix;
+  playwright-python = runTest ./playwright-python.nix;
+  please = runTest ./please.nix;
   pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix { };
-  plikd = handleTest ./plikd.nix { };
-  plotinus = handleTest ./plotinus.nix { };
-  pocket-id = handleTest ./pocket-id.nix { };
-  podgrab = handleTest ./podgrab.nix { };
+  plikd = runTest ./plikd.nix;
+  plotinus = runTest ./plotinus.nix;
+  pocket-id = runTest ./pocket-id.nix;
+  podgrab = runTest ./podgrab.nix;
   podman = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./podman/default.nix { };
   podman-tls-ghostunnel = handleTestOn [
     "aarch64-linux"
     "x86_64-linux"
   ] ./podman/tls-ghostunnel.nix { };
-  polaris = handleTest ./polaris.nix { };
+  polaris = runTest ./polaris.nix;
   pomerium = handleTestOn [ "x86_64-linux" ] ./pomerium.nix { };
-  portunus = handleTest ./portunus.nix { };
+  portunus = runTest ./portunus.nix;
   postfix = handleTest ./postfix.nix { };
   postfix-raise-smtpd-tls-security-level =
     handleTest ./postfix-raise-smtpd-tls-security-level.nix
       { };
-  postfixadmin = handleTest ./postfixadmin.nix { };
+  postfixadmin = runTest ./postfixadmin.nix;
   postgres-websockets = runTest ./postgres-websockets.nix;
   postgresql = handleTest ./postgresql { };
   postgrest = runTest ./postgrest.nix;
-  powerdns = handleTest ./powerdns.nix { };
+  powerdns = runTest ./powerdns.nix;
   powerdns-admin = handleTest ./powerdns-admin.nix { };
-  power-profiles-daemon = handleTest ./power-profiles-daemon.nix { };
-  pppd = handleTest ./pppd.nix { };
+  power-profiles-daemon = runTest ./power-profiles-daemon.nix;
+  pppd = runTest ./pppd.nix;
   predictable-interface-names = handleTest ./predictable-interface-names.nix { };
   pretalx = runTest ./web-apps/pretalx.nix;
   prefect = runTest ./prefect.nix;
@@ -1118,19 +1129,19 @@ in
     _module.args.socket = false;
     _module.args.listenTcp = false;
   };
-  private-gpt = handleTest ./private-gpt.nix { };
+  private-gpt = runTest ./private-gpt.nix;
   privatebin = runTest ./privatebin.nix;
-  privoxy = handleTest ./privoxy.nix { };
+  privoxy = runTest ./privoxy.nix;
   prometheus = import ./prometheus { inherit runTest; };
   prometheus-exporters = handleTest ./prometheus-exporters.nix { };
   prosody = handleTest ./xmpp/prosody.nix { };
   prosody-mysql = handleTest ./xmpp/prosody-mysql.nix { };
-  proxy = handleTest ./proxy.nix { };
+  proxy = runTest ./proxy.nix;
   prowlarr = runTest ./prowlarr.nix;
-  pt2-clone = handleTest ./pt2-clone.nix { };
-  pykms = handleTest ./pykms.nix { };
-  public-inbox = handleTest ./public-inbox.nix { };
-  pufferpanel = handleTest ./pufferpanel.nix { };
+  pt2-clone = runTest ./pt2-clone.nix;
+  pykms = runTest ./pykms.nix;
+  public-inbox = runTest ./public-inbox.nix;
+  pufferpanel = runTest ./pufferpanel.nix;
   pulseaudio = discoverTests (import ./pulseaudio.nix);
   qboot = handleTestOn [ "x86_64-linux" "i686-linux" ] ./qboot.nix { };
   qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix { };
@@ -1139,130 +1150,130 @@ in
   qemu-vm-store = runTest ./qemu-vm-store.nix;
   qgis = handleTest ./qgis.nix { package = pkgs.qgis; };
   qgis-ltr = handleTest ./qgis.nix { package = pkgs.qgis-ltr; };
-  qownnotes = handleTest ./qownnotes.nix { };
+  qownnotes = runTest ./qownnotes.nix;
   qtile = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./qtile/default.nix;
-  quake3 = handleTest ./quake3.nix { };
-  quicktun = handleTest ./quicktun.nix { };
-  quickwit = handleTest ./quickwit.nix { };
-  quorum = handleTest ./quorum.nix { };
-  rabbitmq = handleTest ./rabbitmq.nix { };
-  radarr = handleTest ./radarr.nix { };
-  radicale = handleTest ./radicale.nix { };
+  quake3 = runTest ./quake3.nix;
+  quicktun = runTest ./quicktun.nix;
+  quickwit = runTest ./quickwit.nix;
+  quorum = runTest ./quorum.nix;
+  rabbitmq = runTest ./rabbitmq.nix;
+  radarr = runTest ./radarr.nix;
+  radicale = runTest ./radicale.nix;
   radicle = runTest ./radicle.nix;
   ragnarwm = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ragnarwm.nix;
-  rasdaemon = handleTest ./rasdaemon.nix { };
+  rasdaemon = runTest ./rasdaemon.nix;
   rathole = runTest ./rathole.nix;
-  readarr = handleTest ./readarr.nix { };
-  realm = handleTest ./realm.nix { };
+  readarr = runTest ./readarr.nix;
+  realm = runTest ./realm.nix;
   readeck = runTest ./readeck.nix;
   rebuilderd = runTest ./rebuilderd.nix;
   redis = handleTest ./redis.nix { };
-  redlib = handleTest ./redlib.nix { };
+  redlib = runTest ./redlib.nix;
   redmine = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./redmine.nix { };
-  renovate = handleTest ./renovate.nix { };
+  renovate = runTest ./renovate.nix;
   replace-dependencies = handleTest ./replace-dependencies { };
   reposilite = runTest ./reposilite.nix;
-  restartByActivationScript = handleTest ./restart-by-activation-script.nix { };
-  restic-rest-server = handleTest ./restic-rest-server.nix { };
-  restic = handleTest ./restic.nix { };
-  retroarch = handleTest ./retroarch.nix { };
+  restartByActivationScript = runTest ./restart-by-activation-script.nix;
+  restic-rest-server = runTest ./restic-rest-server.nix;
+  restic = runTest ./restic.nix;
+  retroarch = runTest ./retroarch.nix;
   rke2 = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./rke2 { };
   rkvm = handleTest ./rkvm { };
   rmfakecloud = runTest ./rmfakecloud.nix;
-  robustirc-bridge = handleTest ./robustirc-bridge.nix { };
-  roundcube = handleTest ./roundcube.nix { };
+  robustirc-bridge = runTest ./robustirc-bridge.nix;
+  rosenpass = runTest ./rosenpass.nix;
+  roundcube = runTest ./roundcube.nix;
   routinator = handleTest ./routinator.nix { };
-  rosenpass = handleTest ./rosenpass.nix { };
   rshim = handleTest ./rshim.nix { };
   rspamd = handleTest ./rspamd.nix { };
-  rspamd-trainer = handleTest ./rspamd-trainer.nix { };
+  rspamd-trainer = runTest ./rspamd-trainer.nix;
   rss-bridge = handleTest ./web-apps/rss-bridge { };
   rss2email = handleTest ./rss2email.nix { };
-  rstudio-server = handleTest ./rstudio-server.nix { };
-  rsyncd = handleTest ./rsyncd.nix { };
+  rstudio-server = runTest ./rstudio-server.nix;
+  rsyncd = runTest ./rsyncd.nix;
   rsyslogd = handleTest ./rsyslogd.nix { };
   rtkit = runTest ./rtkit.nix;
-  rtorrent = handleTest ./rtorrent.nix { };
+  rtorrent = runTest ./rtorrent.nix;
   rush = runTest ./rush.nix;
-  rustls-libssl = handleTest ./rustls-libssl.nix { };
-  rxe = handleTest ./rxe.nix { };
-  sabnzbd = handleTest ./sabnzbd.nix { };
+  rustls-libssl = runTest ./rustls-libssl.nix;
+  rxe = runTest ./rxe.nix;
+  sabnzbd = runTest ./sabnzbd.nix;
   samba = runTest ./samba.nix;
-  samba-wsdd = handleTest ./samba-wsdd.nix { };
-  sane = handleTest ./sane.nix { };
-  sanoid = handleTest ./sanoid.nix { };
-  saunafs = handleTest ./saunafs.nix { };
+  samba-wsdd = runTest ./samba-wsdd.nix;
+  sane = runTest ./sane.nix;
+  sanoid = runTest ./sanoid.nix;
+  saunafs = runTest ./saunafs.nix;
   scaphandre = handleTest ./scaphandre.nix { };
   schleuder = handleTest ./schleuder.nix { };
   scion-freestanding-deployment = handleTest ./scion/freestanding-deployment { };
   scrutiny = runTest ./scrutiny.nix;
   scx = runTest ./scx/default.nix;
   sddm = handleTest ./sddm.nix { };
-  sdl3 = handleTest ./sdl3.nix { };
-  seafile = handleTest ./seafile.nix { };
+  sdl3 = runTest ./sdl3.nix;
+  seafile = runTest ./seafile.nix;
   searx = runTest ./searx.nix;
-  seatd = handleTest ./seatd.nix { };
+  seatd = runTest ./seatd.nix;
   send = runTest ./send.nix;
-  service-runner = handleTest ./service-runner.nix { };
+  service-runner = runTest ./service-runner.nix;
   servo = runTest ./servo.nix;
   shadps4 = runTest ./shadps4.nix;
   sftpgo = runTest ./sftpgo.nix;
-  sfxr-qt = handleTest ./sfxr-qt.nix { };
-  sgt-puzzles = handleTest ./sgt-puzzles.nix { };
-  shadow = handleTest ./shadow.nix { };
+  sfxr-qt = runTest ./sfxr-qt.nix;
+  sgt-puzzles = runTest ./sgt-puzzles.nix;
+  shadow = runTest ./shadow.nix;
   shadowsocks = handleTest ./shadowsocks { };
-  shattered-pixel-dungeon = handleTest ./shattered-pixel-dungeon.nix { };
-  shiori = handleTest ./shiori.nix { };
+  shattered-pixel-dungeon = runTest ./shattered-pixel-dungeon.nix;
+  shiori = runTest ./shiori.nix;
   signal-desktop = runTest ./signal-desktop.nix;
-  silverbullet = handleTest ./silverbullet.nix { };
-  simple = handleTest ./simple.nix { };
-  sing-box = handleTest ./sing-box.nix { };
-  slimserver = handleTest ./slimserver.nix { };
-  slurm = handleTest ./slurm.nix { };
-  snmpd = handleTest ./snmpd.nix { };
-  smokeping = handleTest ./smokeping.nix { };
+  silverbullet = runTest ./silverbullet.nix;
+  simple = runTest ./simple.nix;
+  sing-box = runTest ./sing-box.nix;
+  slimserver = runTest ./slimserver.nix;
+  slurm = runTest ./slurm.nix;
+  snmpd = runTest ./snmpd.nix;
+  smokeping = runTest ./smokeping.nix;
   snapcast = runTest ./snapcast.nix;
-  snapper = handleTest ./snapper.nix { };
+  snapper = runTest ./snapper.nix;
   snipe-it = runTest ./web-apps/snipe-it.nix;
-  soapui = handleTest ./soapui.nix { };
-  soft-serve = handleTest ./soft-serve.nix { };
-  sogo = handleTest ./sogo.nix { };
-  soju = handleTest ./soju.nix { };
-  solanum = handleTest ./solanum.nix { };
-  sonarr = handleTest ./sonarr.nix { };
-  sonic-server = handleTest ./sonic-server.nix { };
+  soapui = runTest ./soapui.nix;
+  soft-serve = runTest ./soft-serve.nix;
+  sogo = runTest ./sogo.nix;
+  soju = runTest ./soju.nix;
+  solanum = runTest ./solanum.nix;
+  sonarr = runTest ./sonarr.nix;
+  sonic-server = runTest ./sonic-server.nix;
   sourcehut = handleTest ./sourcehut { };
-  spacecookie = handleTest ./spacecookie.nix { };
+  spacecookie = runTest ./spacecookie.nix;
   spark = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./spark { };
   spiped = runTest ./spiped.nix;
-  sqlite3-to-mysql = handleTest ./sqlite3-to-mysql.nix { };
-  squid = handleTest ./squid.nix { };
+  sqlite3-to-mysql = runTest ./sqlite3-to-mysql.nix;
+  squid = runTest ./squid.nix;
   sslh = handleTest ./sslh.nix { };
-  ssh-agent-auth = handleTest ./ssh-agent-auth.nix { };
-  ssh-audit = handleTest ./ssh-audit.nix { };
+  ssh-agent-auth = runTest ./ssh-agent-auth.nix;
+  ssh-audit = runTest ./ssh-audit.nix;
   sssd = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd.nix { };
   sssd-ldap = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-ldap.nix { };
-  stalwart-mail = handleTest ./stalwart-mail.nix { };
+  stalwart-mail = runTest ./stalwart-mail.nix;
   stargazer = runTest ./web-servers/stargazer.nix;
   starship = runTest ./starship.nix;
   stash = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stash.nix { };
   static-web-server = runTest ./web-servers/static-web-server.nix;
   step-ca = handleTestOn [ "x86_64-linux" ] ./step-ca.nix { };
   stratis = handleTest ./stratis { };
-  strongswan-swanctl = handleTest ./strongswan-swanctl.nix { };
+  strongswan-swanctl = runTest ./strongswan-swanctl.nix;
   stub-ld = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stub-ld.nix { };
   stunnel = handleTest ./stunnel.nix { };
-  sudo = handleTest ./sudo.nix { };
+  sudo = runTest ./sudo.nix;
   sudo-rs = runTest ./sudo-rs.nix;
-  sunshine = handleTest ./sunshine.nix { };
-  suricata = handleTest ./suricata.nix { };
+  sunshine = runTest ./sunshine.nix;
+  suricata = runTest ./suricata.nix;
   suwayomi-server = handleTest ./suwayomi-server.nix { };
-  swap-file-btrfs = handleTest ./swap-file-btrfs.nix { };
-  swap-partition = handleTest ./swap-partition.nix { };
-  swap-random-encryption = handleTest ./swap-random-encryption.nix { };
+  swap-file-btrfs = runTest ./swap-file-btrfs.nix;
+  swap-partition = runTest ./swap-partition.nix;
+  swap-random-encryption = runTest ./swap-random-encryption.nix;
   swapspace = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./swapspace.nix { };
-  sway = handleTest ./sway.nix { };
-  swayfx = handleTest ./swayfx.nix { };
+  sway = runTest ./sway.nix;
+  swayfx = runTest ./swayfx.nix;
   switchTest = runTest {
     imports = [ ./switch-test.nix ];
     defaults.system.switch.enableNg = false;
@@ -1271,160 +1282,165 @@ in
     imports = [ ./switch-test.nix ];
     defaults.system.switch.enableNg = true;
   };
-  sx = handleTest ./sx.nix { };
-  sympa = handleTest ./sympa.nix { };
-  syncthing = handleTest ./syncthing.nix { };
-  syncthing-no-settings = handleTest ./syncthing-no-settings.nix { };
-  syncthing-init = handleTest ./syncthing-init.nix { };
-  syncthing-many-devices = handleTest ./syncthing-many-devices.nix { };
+  sx = runTest ./sx.nix;
+  sympa = runTest ./sympa.nix;
+  syncthing = runTest ./syncthing.nix;
+  syncthing-no-settings = runTest ./syncthing-no-settings.nix;
+  syncthing-init = runTest ./syncthing-init.nix;
+  syncthing-many-devices = runTest ./syncthing-many-devices.nix;
   syncthing-folders = runTest ./syncthing-folders.nix;
-  syncthing-relay = handleTest ./syncthing-relay.nix { };
+  syncthing-relay = runTest ./syncthing-relay.nix;
   sysinit-reactivation = runTest ./sysinit-reactivation.nix;
-  systemd = handleTest ./systemd.nix { };
-  systemd-analyze = handleTest ./systemd-analyze.nix { };
+  systemd = runTest ./systemd.nix;
+  systemd-analyze = runTest ./systemd-analyze.nix;
   systemd-binfmt = handleTestOn [ "x86_64-linux" ] ./systemd-binfmt.nix { };
   systemd-boot = handleTest ./systemd-boot.nix { };
-  systemd-bpf = handleTest ./systemd-bpf.nix { };
+  systemd-bpf = runTest ./systemd-bpf.nix;
   systemd-confinement = handleTest ./systemd-confinement { };
-  systemd-coredump = handleTest ./systemd-coredump.nix { };
-  systemd-cryptenroll = handleTest ./systemd-cryptenroll.nix { };
-  systemd-credentials-tpm2 = handleTest ./systemd-credentials-tpm2.nix { };
-  systemd-escaping = handleTest ./systemd-escaping.nix { };
-  systemd-initrd-bridge = handleTest ./systemd-initrd-bridge.nix { };
-  systemd-initrd-btrfs-raid = handleTest ./systemd-initrd-btrfs-raid.nix { };
-  systemd-initrd-luks-fido2 = handleTest ./systemd-initrd-luks-fido2.nix { };
-  systemd-initrd-luks-keyfile = handleTest ./systemd-initrd-luks-keyfile.nix { };
-  systemd-initrd-luks-empty-passphrase = handleTest ./initrd-luks-empty-passphrase.nix {
-    systemdStage1 = true;
+  systemd-coredump = runTest ./systemd-coredump.nix;
+  systemd-cryptenroll = runTest ./systemd-cryptenroll.nix;
+  systemd-credentials-tpm2 = runTest ./systemd-credentials-tpm2.nix;
+  systemd-escaping = runTest ./systemd-escaping.nix;
+  systemd-initrd-bridge = runTest ./systemd-initrd-bridge.nix;
+  systemd-initrd-btrfs-raid = runTest ./systemd-initrd-btrfs-raid.nix;
+  systemd-initrd-credentials = runTest ./systemd-initrd-credentials.nix;
+  systemd-initrd-luks-fido2 = runTest ./systemd-initrd-luks-fido2.nix;
+  systemd-initrd-luks-keyfile = runTest ./systemd-initrd-luks-keyfile.nix;
+  systemd-initrd-luks-empty-passphrase = runTest {
+    imports = [ ./initrd-luks-empty-passphrase.nix ];
+    _module.args.systemdStage1 = true;
   };
-  systemd-initrd-luks-password = handleTest ./systemd-initrd-luks-password.nix { };
-  systemd-initrd-luks-tpm2 = handleTest ./systemd-initrd-luks-tpm2.nix { };
-  systemd-initrd-luks-unl0kr = handleTest ./systemd-initrd-luks-unl0kr.nix { };
-  systemd-initrd-modprobe = handleTest ./systemd-initrd-modprobe.nix { };
-  systemd-initrd-shutdown = handleTest ./systemd-shutdown.nix { systemdStage1 = true; };
-  systemd-initrd-simple = runTest ./systemd-initrd-simple.nix;
-  systemd-initrd-swraid = handleTest ./systemd-initrd-swraid.nix { };
-  systemd-initrd-vconsole = handleTest ./systemd-initrd-vconsole.nix { };
+  systemd-initrd-luks-password = runTest ./systemd-initrd-luks-password.nix;
+  systemd-initrd-luks-tpm2 = runTest ./systemd-initrd-luks-tpm2.nix;
+  systemd-initrd-luks-unl0kr = runTest ./systemd-initrd-luks-unl0kr.nix;
+  systemd-initrd-modprobe = runTest ./systemd-initrd-modprobe.nix;
   systemd-initrd-networkd = handleTest ./systemd-initrd-networkd.nix { };
-  systemd-initrd-networkd-ssh = handleTest ./systemd-initrd-networkd-ssh.nix { };
+  systemd-initrd-networkd-ssh = runTest ./systemd-initrd-networkd-ssh.nix;
   systemd-initrd-networkd-openvpn = handleTestOn [
     "x86_64-linux"
     "i686-linux"
   ] ./initrd-network-openvpn { systemdStage1 = true; };
-  systemd-initrd-vlan = handleTest ./systemd-initrd-vlan.nix { };
-  systemd-journal = handleTest ./systemd-journal.nix { };
-  systemd-journal-gateway = handleTest ./systemd-journal-gateway.nix { };
-  systemd-journal-upload = handleTest ./systemd-journal-upload.nix { };
+  systemd-initrd-shutdown = runTest {
+    imports = [ ./systemd-shutdown.nix ];
+    _module.args.systemdStage1 = true;
+  };
+  systemd-initrd-simple = runTest ./systemd-initrd-simple.nix;
+  systemd-initrd-swraid = runTest ./systemd-initrd-swraid.nix;
+  systemd-initrd-vconsole = runTest ./systemd-initrd-vconsole.nix;
+  systemd-initrd-vlan = runTest ./systemd-initrd-vlan.nix;
+  systemd-journal = runTest ./systemd-journal.nix;
+  systemd-journal-gateway = runTest ./systemd-journal-gateway.nix;
+  systemd-journal-upload = runTest ./systemd-journal-upload.nix;
   systemd-lock-handler = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./systemd-lock-handler.nix;
-  systemd-machinectl = handleTest ./systemd-machinectl.nix { };
-  systemd-networkd = handleTest ./systemd-networkd.nix { };
-  systemd-networkd-bridge = handleTest ./systemd-networkd-bridge.nix { };
-  systemd-networkd-dhcpserver = handleTest ./systemd-networkd-dhcpserver.nix { };
+  systemd-machinectl = runTest ./systemd-machinectl.nix;
+  systemd-networkd = runTest ./systemd-networkd.nix;
+  systemd-networkd-bridge = runTest ./systemd-networkd-bridge.nix;
+  systemd-networkd-dhcpserver = runTest ./systemd-networkd-dhcpserver.nix;
   systemd-networkd-dhcpserver-static-leases =
     handleTest ./systemd-networkd-dhcpserver-static-leases.nix
       { };
   systemd-networkd-ipv6-prefix-delegation =
     handleTest ./systemd-networkd-ipv6-prefix-delegation.nix
       { };
-  systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix { };
-  systemd-no-tainted = handleTest ./systemd-no-tainted.nix { };
-  systemd-nspawn = handleTest ./systemd-nspawn.nix { };
-  systemd-nspawn-configfile = handleTest ./systemd-nspawn-configfile.nix { };
-  systemd-oomd = handleTest ./systemd-oomd.nix { };
-  systemd-portabled = handleTest ./systemd-portabled.nix { };
+  systemd-networkd-vrf = runTest ./systemd-networkd-vrf.nix;
+  systemd-no-tainted = runTest ./systemd-no-tainted.nix;
+  systemd-nspawn = runTest ./systemd-nspawn.nix;
+  systemd-nspawn-configfile = runTest ./systemd-nspawn-configfile.nix;
+  systemd-oomd = runTest ./systemd-oomd.nix;
+  systemd-portabled = runTest ./systemd-portabled.nix;
   systemd-repart = handleTest ./systemd-repart.nix { };
-  systemd-resolved = handleTest ./systemd-resolved.nix { };
+  systemd-resolved = runTest ./systemd-resolved.nix;
   systemd-ssh-proxy = runTest ./systemd-ssh-proxy.nix;
-  systemd-shutdown = handleTest ./systemd-shutdown.nix { };
+  systemd-shutdown = runTest ./systemd-shutdown.nix;
   systemd-sysupdate = runTest ./systemd-sysupdate.nix;
   systemd-sysusers-mutable = runTest ./systemd-sysusers-mutable.nix;
   systemd-sysusers-immutable = runTest ./systemd-sysusers-immutable.nix;
   systemd-sysusers-password-option-override-ordering = runTest ./systemd-sysusers-password-option-override-ordering.nix;
-  systemd-timesyncd = handleTest ./systemd-timesyncd.nix { };
-  systemd-timesyncd-nscd-dnssec = handleTest ./systemd-timesyncd-nscd-dnssec.nix { };
-  systemd-user-linger = handleTest ./systemd-user-linger.nix { };
-  systemd-user-tmpfiles-rules = handleTest ./systemd-user-tmpfiles-rules.nix { };
-  systemd-misc = handleTest ./systemd-misc.nix { };
-  systemd-userdbd = handleTest ./systemd-userdbd.nix { };
-  systemd-homed = handleTest ./systemd-homed.nix { };
+  systemd-timesyncd = runTest ./systemd-timesyncd.nix;
+  systemd-timesyncd-nscd-dnssec = runTest ./systemd-timesyncd-nscd-dnssec.nix;
+  systemd-user-linger = runTest ./systemd-user-linger.nix;
+  systemd-user-tmpfiles-rules = runTest ./systemd-user-tmpfiles-rules.nix;
+  systemd-misc = runTest ./systemd-misc.nix;
+  systemd-userdbd = runTest ./systemd-userdbd.nix;
+  systemd-homed = runTest ./systemd-homed.nix;
   systemtap = handleTest ./systemtap.nix { };
   startx = import ./startx.nix { inherit pkgs runTest; };
   taler = handleTest ./taler { };
-  tandoor-recipes = handleTest ./tandoor-recipes.nix { };
-  tandoor-recipes-script-name = handleTest ./tandoor-recipes-script-name.nix { };
-  tang = handleTest ./tang.nix { };
-  taskserver = handleTest ./taskserver.nix { };
-  taskchampion-sync-server = handleTest ./taskchampion-sync-server.nix { };
-  tayga = handleTest ./tayga.nix { };
-  technitium-dns-server = handleTest ./technitium-dns-server.nix { };
-  teeworlds = handleTest ./teeworlds.nix { };
+  tandoor-recipes = runTest ./tandoor-recipes.nix;
+  tandoor-recipes-script-name = runTest ./tandoor-recipes-script-name.nix;
+  tang = runTest ./tang.nix;
+  taskserver = runTest ./taskserver.nix;
+  taskchampion-sync-server = runTest ./taskchampion-sync-server.nix;
+  tayga = runTest ./tayga.nix;
+  technitium-dns-server = runTest ./technitium-dns-server.nix;
+  teeworlds = runTest ./teeworlds.nix;
   telegraf = runTest ./telegraf.nix;
   teleport = handleTest ./teleport.nix { };
   teleports = runTest ./teleports.nix;
   thelounge = handleTest ./thelounge.nix { };
   terminal-emulators = handleTest ./terminal-emulators.nix { };
   thanos = handleTest ./thanos.nix { };
-  tiddlywiki = handleTest ./tiddlywiki.nix { };
+  tiddlywiki = runTest ./tiddlywiki.nix;
   tigervnc = handleTest ./tigervnc.nix { };
   tika = runTest ./tika.nix;
-  timezone = handleTest ./timezone.nix { };
+  timezone = runTest ./timezone.nix;
   timidity = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./timidity { };
   tinc = handleTest ./tinc { };
-  tinydns = handleTest ./tinydns.nix { };
-  tinyproxy = handleTest ./tinyproxy.nix { };
-  tinywl = handleTest ./tinywl.nix { };
-  tmate-ssh-server = handleTest ./tmate-ssh-server.nix { };
-  tomcat = handleTest ./tomcat.nix { };
-  tor = handleTest ./tor.nix { };
+  tinydns = runTest ./tinydns.nix;
+  tinyproxy = runTest ./tinyproxy.nix;
+  tinywl = runTest ./tinywl.nix;
+  tmate-ssh-server = runTest ./tmate-ssh-server.nix;
+  tomcat = runTest ./tomcat.nix;
+  tor = runTest ./tor.nix;
   tpm-ek = handleTest ./tpm-ek { };
   traefik = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./traefik.nix;
-  trafficserver = handleTest ./trafficserver.nix { };
-  transfer-sh = handleTest ./transfer-sh.nix { };
+  trafficserver = runTest ./trafficserver.nix;
+  transfer-sh = runTest ./transfer-sh.nix;
   transmission_3 = handleTest ./transmission.nix { transmission = pkgs.transmission_3; };
   transmission_4 = handleTest ./transmission.nix { transmission = pkgs.transmission_4; };
   # tracee requires bpf
   tracee = handleTestOn [ "x86_64-linux" ] ./tracee.nix { };
-  trezord = handleTest ./trezord.nix { };
-  trickster = handleTest ./trickster.nix { };
+  trezord = runTest ./trezord.nix;
+  trickster = runTest ./trickster.nix;
   trilium-server = handleTestOn [ "x86_64-linux" ] ./trilium-server.nix { };
-  tsm-client-gui = handleTest ./tsm-client-gui.nix { };
-  ttyd = handleTest ./web-servers/ttyd.nix { };
-  tt-rss = handleTest ./web-apps/tt-rss.nix { };
-  txredisapi = handleTest ./txredisapi.nix { };
-  tuptime = handleTest ./tuptime.nix { };
-  turbovnc-headless-server = handleTest ./turbovnc-headless-server.nix { };
-  turn-rs = handleTest ./turn-rs.nix { };
+  tsm-client-gui = runTest ./tsm-client-gui.nix;
+  ttyd = runTest ./web-servers/ttyd.nix;
+  tt-rss = runTest ./web-apps/tt-rss.nix;
+  txredisapi = runTest ./txredisapi.nix;
+  tuptime = runTest ./tuptime.nix;
+  turbovnc-headless-server = runTest ./turbovnc-headless-server.nix;
+  turn-rs = runTest ./turn-rs.nix;
   tusd = runTest ./tusd/default.nix;
   tuxguitar = runTest ./tuxguitar.nix;
   twingate = runTest ./twingate.nix;
-  typesense = handleTest ./typesense.nix { };
+  typesense = runTest ./typesense.nix;
   tzupdate = runTest ./tzupdate.nix;
-  ucarp = handleTest ./ucarp.nix { };
-  udisks2 = handleTest ./udisks2.nix { };
-  ulogd = handleTest ./ulogd/ulogd.nix { };
-  umurmur = handleTest ./umurmur.nix { };
-  unbound = handleTest ./unbound.nix { };
+  ucarp = runTest ./ucarp.nix;
+  udisks2 = runTest ./udisks2.nix;
+  ulogd = runTest ./ulogd/ulogd.nix;
+  umurmur = runTest ./umurmur.nix;
+  unbound = runTest ./unbound.nix;
   unifi = runTest ./unifi.nix;
   unit-php = runTest ./web-servers/unit-php.nix;
-  unit-perl = handleTest ./web-servers/unit-perl.nix { };
+  unit-perl = runTest ./web-servers/unit-perl.nix;
   upnp.iptables = handleTest ./upnp.nix { useNftables = false; };
   upnp.nftables = handleTest ./upnp.nix { useNftables = true; };
-  uptermd = handleTest ./uptermd.nix { };
-  uptime-kuma = handleTest ./uptime-kuma.nix { };
-  urn-timer = handleTest ./urn-timer.nix { };
-  usbguard = handleTest ./usbguard.nix { };
+  uptermd = runTest ./uptermd.nix;
+  uptime-kuma = runTest ./uptime-kuma.nix;
+  urn-timer = runTest ./urn-timer.nix;
+  usbguard = runTest ./usbguard.nix;
   userborn = runTest ./userborn.nix;
   userborn-mutable-users = runTest ./userborn-mutable-users.nix;
   userborn-immutable-users = runTest ./userborn-immutable-users.nix;
   userborn-mutable-etc = runTest ./userborn-mutable-etc.nix;
   userborn-immutable-etc = runTest ./userborn-immutable-etc.nix;
-  user-activation-scripts = handleTest ./user-activation-scripts.nix { };
+  user-activation-scripts = runTest ./user-activation-scripts.nix;
   user-enable-option = runTest ./user-enable-option.nix;
   user-expiry = runTest ./user-expiry.nix;
-  user-home-mode = handleTest ./user-home-mode.nix { };
-  ustreamer = handleTest ./ustreamer.nix { };
-  uwsgi = handleTest ./uwsgi.nix { };
-  v2ray = handleTest ./v2ray.nix { };
+  user-home-mode = runTest ./user-home-mode.nix;
+  ustreamer = runTest ./ustreamer.nix;
+  uwsgi = runTest ./uwsgi.nix;
+  v2ray = runTest ./v2ray.nix;
   varnish60 = runTest {
     imports = [ ./varnish.nix ];
     _module.args.package = pkgs.varnish60;
@@ -1433,43 +1449,43 @@ in
     imports = [ ./varnish.nix ];
     _module.args.package = pkgs.varnish77;
   };
-  vault = handleTest ./vault.nix { };
-  vault-agent = handleTest ./vault-agent.nix { };
-  vault-dev = handleTest ./vault-dev.nix { };
-  vault-postgresql = handleTest ./vault-postgresql.nix { };
+  vault = runTest ./vault.nix;
+  vault-agent = runTest ./vault-agent.nix;
+  vault-dev = runTest ./vault-dev.nix;
+  vault-postgresql = runTest ./vault-postgresql.nix;
   vaultwarden = discoverTests (import ./vaultwarden.nix);
-  vdirsyncer = handleTest ./vdirsyncer.nix { };
+  vdirsyncer = runTest ./vdirsyncer.nix;
   vector = handleTest ./vector { };
   velocity = runTest ./velocity.nix;
-  vengi-tools = handleTest ./vengi-tools.nix { };
+  vengi-tools = runTest ./vengi-tools.nix;
   victoriametrics = handleTest ./victoriametrics { };
-  vikunja = handleTest ./vikunja.nix { };
+  vikunja = runTest ./vikunja.nix;
   virtualbox = handleTestOn [ "x86_64-linux" ] ./virtualbox.nix { };
   vm-variant = handleTest ./vm-variant.nix { };
   vscode-remote-ssh = handleTestOn [ "x86_64-linux" ] ./vscode-remote-ssh.nix { };
   vscodium = discoverTests (import ./vscodium.nix);
-  vsftpd = handleTest ./vsftpd.nix { };
-  waagent = handleTest ./waagent.nix { };
+  vsftpd = runTest ./vsftpd.nix;
+  waagent = runTest ./waagent.nix;
   wakapi = runTest ./wakapi.nix;
-  warzone2100 = handleTest ./warzone2100.nix { };
-  wasabibackend = handleTest ./wasabibackend.nix { };
+  warzone2100 = runTest ./warzone2100.nix;
+  wasabibackend = runTest ./wasabibackend.nix;
   wastebin = runTest ./wastebin.nix;
-  watchdogd = handleTest ./watchdogd.nix { };
+  watchdogd = runTest ./watchdogd.nix;
   webhook = runTest ./webhook.nix;
-  weblate = handleTest ./web-apps/weblate.nix { };
-  whisparr = handleTest ./whisparr.nix { };
+  weblate = runTest ./web-apps/weblate.nix;
+  whisparr = runTest ./whisparr.nix;
   whoami = runTest ./whoami.nix;
-  whoogle-search = handleTest ./whoogle-search.nix { };
+  whoogle-search = runTest ./whoogle-search.nix;
   wiki-js = runTest ./wiki-js.nix;
   wine = handleTest ./wine.nix { };
   wireguard = handleTest ./wireguard { };
-  wg-access-server = handleTest ./wg-access-server.nix { };
-  without-nix = handleTest ./without-nix.nix { };
-  wmderland = handleTest ./wmderland.nix { };
-  workout-tracker = handleTest ./workout-tracker.nix { };
+  wg-access-server = runTest ./wg-access-server.nix;
+  without-nix = runTest ./without-nix.nix;
+  wmderland = runTest ./wmderland.nix;
+  workout-tracker = runTest ./workout-tracker.nix;
   wpa_supplicant = import ./wpa_supplicant.nix { inherit pkgs runTest; };
   wordpress = runTest ./wordpress.nix;
-  wrappers = handleTest ./wrappers.nix { };
+  wrappers = runTest ./wrappers.nix;
   writefreely = import ./web-apps/writefreely.nix { inherit pkgs runTest; };
   wstunnel = runTest ./wstunnel.nix;
   xandikos = runTest ./xandikos.nix;
diff --git a/nixos/tests/ax25.nix b/nixos/tests/ax25.nix
index f1092d5de101..df4e3de04cb1 100644
--- a/nixos/tests/ax25.nix
+++ b/nixos/tests/ax25.nix
@@ -1,131 +1,128 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
+{ pkgs, lib, ... }:
 
-    baud = 57600;
-    tty = "/dev/ttyACM0";
-    port = "tnc0";
-    socatPort = 1234;
+let
+  baud = 57600;
+  tty = "/dev/ttyACM0";
+  port = "tnc0";
+  socatPort = 1234;
 
-    createAX25Node = nodeId: {
+  createAX25Node = nodeId: {
+    boot.kernelPackages = pkgs.linuxPackages_ham;
+    boot.kernelModules = [ "ax25" ];
 
-      boot.kernelPackages = pkgs.linuxPackages_ham;
-      boot.kernelModules = [ "ax25" ];
+    networking.firewall.allowedTCPPorts = [ socatPort ];
 
-      networking.firewall.allowedTCPPorts = [ socatPort ];
+    environment.systemPackages = with pkgs; [
+      libax25
+      ax25-tools
+      ax25-apps
+      socat
+    ];
 
-      environment.systemPackages = with pkgs; [
-        libax25
-        ax25-tools
-        ax25-apps
-        socat
+    services.ax25.axports."${port}" = {
+      inherit baud tty;
+      enable = true;
+      callsign = "NOCALL-${toString nodeId}";
+      description = "mocked tnc";
+    };
+
+    services.ax25.axlisten = {
+      enable = true;
+    };
+
+    # All mocks radios will connect back to socat-broker on node 1 in order to get
+    # all messages that are "broadcasted over the ether"
+    systemd.services.ax25-mock-hardware = {
+      description = "mock AX.25 TNC and Radio";
+      wantedBy = [ "default.target" ];
+      before = [
+        "ax25-kissattach-${port}.service"
+        "axlisten.service"
       ];
-
-      services.ax25.axports."${port}" = {
-        inherit baud tty;
-        enable = true;
-        callsign = "NOCALL-${toString nodeId}";
-        description = "mocked tnc";
-      };
-
-      services.ax25.axlisten = {
-        enable = true;
-      };
-
-      # All mocks radios will connect back to socat-broker on node 1 in order to get
-      # all messages that are "broadcasted over the ether"
-      systemd.services.ax25-mock-hardware = {
-        description = "mock AX.25 TNC and Radio";
-        wantedBy = [ "default.target" ];
-        before = [
-          "ax25-kissattach-${port}.service"
-          "axlisten.service"
-        ];
-        after = [ "network.target" ];
-        serviceConfig = {
-          Type = "exec";
-          ExecStart = "${pkgs.socat}/bin/socat -d -d tcp:192.168.1.1:${toString socatPort} pty,link=${tty},b${toString baud},raw";
-        };
+      after = [ "network.target" ];
+      serviceConfig = {
+        Type = "exec";
+        ExecStart = "${pkgs.socat}/bin/socat -d -d tcp:192.168.1.1:${toString socatPort} pty,link=${tty},b${toString baud},raw";
       };
     };
-  in
-  {
-    name = "ax25Simple";
-    nodes = {
-      node1 = lib.mkMerge [
-        (createAX25Node 1)
-        # mimicking radios on the same frequency
-        {
-          systemd.services.ax25-mock-ether = {
-            description = "mock radio ether";
-            wantedBy = [ "default.target" ];
-            requires = [ "network.target" ];
-            before = [ "ax25-mock-hardware.service" ];
-            # broken needs access to "ss" or "netstat"
-            path = [ pkgs.iproute2 ];
-            serviceConfig = {
-              Type = "exec";
-              ExecStart = "${pkgs.socat}/bin/socat-broker.sh tcp4-listen:${toString socatPort}";
-            };
-            postStart = "${pkgs.coreutils}/bin/sleep 2";
+  };
+in
+{
+  name = "ax25Simple";
+  nodes = {
+    node1 = lib.mkMerge [
+      (createAX25Node 1)
+      # mimicking radios on the same frequency
+      {
+        systemd.services.ax25-mock-ether = {
+          description = "mock radio ether";
+          wantedBy = [ "default.target" ];
+          requires = [ "network.target" ];
+          before = [ "ax25-mock-hardware.service" ];
+          # broken needs access to "ss" or "netstat"
+          path = [ pkgs.iproute2 ];
+          serviceConfig = {
+            Type = "exec";
+            ExecStart = "${pkgs.socat}/bin/socat-broker.sh tcp4-listen:${toString socatPort}";
           };
-        }
-      ];
-      node2 = createAX25Node 2;
-      node3 = createAX25Node 3;
-    };
-    testScript =
-      { ... }:
-      ''
-        def wait_for_machine(m):
-          m.succeed("lsmod | grep ax25")
-          m.wait_for_unit("ax25-axports.target")
-          m.wait_for_unit("axlisten.service")
-          m.fail("journalctl -o cat -u axlisten.service | grep -i \"no AX.25 port data configured\"")
+          postStart = "${pkgs.coreutils}/bin/sleep 2";
+        };
+      }
+    ];
+    node2 = createAX25Node 2;
+    node3 = createAX25Node 3;
+  };
+  testScript =
+    { ... }:
+    ''
+      def wait_for_machine(m):
+        m.succeed("lsmod | grep ax25")
+        m.wait_for_unit("ax25-axports.target")
+        m.wait_for_unit("axlisten.service")
+        m.fail("journalctl -o cat -u axlisten.service | grep -i \"no AX.25 port data configured\"")
 
-        # start the first node since the socat-broker needs to be running
-        node1.start()
-        node1.wait_for_unit("ax25-mock-ether.service")
-        wait_for_machine(node1)
+      # start the first node since the socat-broker needs to be running
+      node1.start()
+      node1.wait_for_unit("ax25-mock-ether.service")
+      wait_for_machine(node1)
 
-        node2.start()
-        node3.start()
-        wait_for_machine(node2)
-        wait_for_machine(node3)
+      node2.start()
+      node3.start()
+      wait_for_machine(node2)
+      wait_for_machine(node3)
 
-        # Node 1 -> Node 2
-        node1.succeed("echo hello | ax25_call ${port} NOCALL-1 NOCALL-2")
-        node2.sleep(1)
-        node2.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-1 to NOCALL-2 ctl I00\" | grep hello")
+      # Node 1 -> Node 2
+      node1.succeed("echo hello | ax25_call ${port} NOCALL-1 NOCALL-2")
+      node2.sleep(1)
+      node2.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-1 to NOCALL-2 ctl I00\" | grep hello")
 
-        # Node 1 -> Node 3
-        node1.succeed("echo hello | ax25_call ${port} NOCALL-1 NOCALL-3")
-        node3.sleep(1)
-        node3.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-1 to NOCALL-3 ctl I00\" | grep hello")
+      # Node 1 -> Node 3
+      node1.succeed("echo hello | ax25_call ${port} NOCALL-1 NOCALL-3")
+      node3.sleep(1)
+      node3.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-1 to NOCALL-3 ctl I00\" | grep hello")
 
-        # Node 2 -> Node 1
-        # must sleep due to previous ax25_call lingering
-        node2.sleep(5)
-        node2.succeed("echo hello | ax25_call ${port} NOCALL-2 NOCALL-1")
-        node1.sleep(1)
-        node1.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-2 to NOCALL-1 ctl I00\" | grep hello")
+      # Node 2 -> Node 1
+      # must sleep due to previous ax25_call lingering
+      node2.sleep(5)
+      node2.succeed("echo hello | ax25_call ${port} NOCALL-2 NOCALL-1")
+      node1.sleep(1)
+      node1.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-2 to NOCALL-1 ctl I00\" | grep hello")
 
-        # Node 2 -> Node 3
-        node2.succeed("echo hello | ax25_call ${port} NOCALL-2 NOCALL-3")
-        node3.sleep(1)
-        node3.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-2 to NOCALL-3 ctl I00\" | grep hello")
+      # Node 2 -> Node 3
+      node2.succeed("echo hello | ax25_call ${port} NOCALL-2 NOCALL-3")
+      node3.sleep(1)
+      node3.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-2 to NOCALL-3 ctl I00\" | grep hello")
 
-        # Node 3 -> Node 1
-        # must sleep due to previous ax25_call lingering
-        node3.sleep(5)
-        node3.succeed("echo hello | ax25_call ${port} NOCALL-3 NOCALL-1")
-        node1.sleep(1)
-        node1.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-3 to NOCALL-1 ctl I00\" | grep hello")
+      # Node 3 -> Node 1
+      # must sleep due to previous ax25_call lingering
+      node3.sleep(5)
+      node3.succeed("echo hello | ax25_call ${port} NOCALL-3 NOCALL-1")
+      node1.sleep(1)
+      node1.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-3 to NOCALL-1 ctl I00\" | grep hello")
 
-        # Node 3 -> Node 2
-        node3.succeed("echo hello | ax25_call ${port} NOCALL-3 NOCALL-2")
-        node2.sleep(1)
-        node2.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-3 to NOCALL-2 ctl I00\" | grep hello")
-      '';
-  }
-)
+      # Node 3 -> Node 2
+      node3.succeed("echo hello | ax25_call ${port} NOCALL-3 NOCALL-2")
+      node2.sleep(1)
+      node2.succeed("journalctl -o cat -u axlisten.service | grep -A1 \"NOCALL-3 to NOCALL-2 ctl I00\" | grep hello")
+    '';
+}
diff --git a/nixos/tests/benchexec.nix b/nixos/tests/benchexec.nix
index 218bfb5afba4..25e53179bf5a 100644
--- a/nixos/tests/benchexec.nix
+++ b/nixos/tests/benchexec.nix
@@ -1,64 +1,62 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    user = "alice";
-  in
-  {
-    name = "benchexec";
+{ pkgs, lib, ... }:
+let
+  user = "alice";
+in
+{
+  name = "benchexec";
 
-    nodes.benchexec = {
-      imports = [ ./common/user-account.nix ];
+  nodes.benchexec = {
+    imports = [ ./common/user-account.nix ];
 
-      programs.benchexec = {
-        enable = true;
-        users = [ user ];
-      };
-    };
-
-    testScript =
-      { ... }:
-      let
-        runexec = lib.getExe' pkgs.benchexec "runexec";
-        echo = builtins.toString pkgs.benchexec;
-        test = lib.getExe (
-          pkgs.writeShellApplication rec {
-            name = "test";
-            meta.mainProgram = name;
-            text = "echo '${echo}'";
-          }
-        );
-        wd = "/tmp";
-        stdout = "${wd}/runexec.out";
-        stderr = "${wd}/runexec.err";
-      in
-      ''
-        start_all()
-        machine.wait_for_unit("multi-user.target")
-        benchexec.succeed(''''\
-            systemd-run \
-              --property='StandardOutput=file:${stdout}' \
-              --property='StandardError=file:${stderr}' \
-              --unit=runexec --wait --user --machine='${user}@' \
-              --working-directory ${wd} \
-            '${runexec}' \
-              --debug \
-              --read-only-dir / \
-              --hidden-dir /home \
-              '${test}' \
-        '''')
-        benchexec.succeed("grep -s '${echo}' ${wd}/output.log")
-        benchexec.succeed("test \"$(grep -Ec '((start|wall|cpu)time|memory)=' ${stdout})\" = 4")
-        benchexec.succeed("! grep -E '(WARNING|ERROR)' ${stderr}")
-      '';
-
-    interactive.nodes.benchexec.services.kmscon = {
+    programs.benchexec = {
       enable = true;
-      fonts = [
-        {
-          name = "Fira Code";
-          package = pkgs.fira-code;
-        }
-      ];
+      users = [ user ];
     };
-  }
-)
+  };
+
+  testScript =
+    { ... }:
+    let
+      runexec = lib.getExe' pkgs.benchexec "runexec";
+      echo = builtins.toString pkgs.benchexec;
+      test = lib.getExe (
+        pkgs.writeShellApplication rec {
+          name = "test";
+          meta.mainProgram = name;
+          text = "echo '${echo}'";
+        }
+      );
+      wd = "/tmp";
+      stdout = "${wd}/runexec.out";
+      stderr = "${wd}/runexec.err";
+    in
+    ''
+      start_all()
+      machine.wait_for_unit("multi-user.target")
+      benchexec.succeed(''''\
+          systemd-run \
+            --property='StandardOutput=file:${stdout}' \
+            --property='StandardError=file:${stderr}' \
+            --unit=runexec --wait --user --machine='${user}@' \
+            --working-directory ${wd} \
+          '${runexec}' \
+            --debug \
+            --read-only-dir / \
+            --hidden-dir /home \
+            '${test}' \
+      '''')
+      benchexec.succeed("grep -s '${echo}' ${wd}/output.log")
+      benchexec.succeed("test \"$(grep -Ec '((start|wall|cpu)time|memory)=' ${stdout})\" = 4")
+      benchexec.succeed("! grep -E '(WARNING|ERROR)' ${stderr}")
+    '';
+
+  interactive.nodes.benchexec.services.kmscon = {
+    enable = true;
+    fonts = [
+      {
+        name = "Fira Code";
+        package = pkgs.fira-code;
+      }
+    ];
+  };
+}
diff --git a/nixos/tests/bitcoind.nix b/nixos/tests/bitcoind.nix
index d588e055b14a..a4ec0beb51b5 100644
--- a/nixos/tests/bitcoind.nix
+++ b/nixos/tests/bitcoind.nix
@@ -1,57 +1,55 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "bitcoind";
-    meta = with pkgs.lib; {
-      maintainers = with maintainers; [ _1000101 ];
-    };
+{ pkgs, ... }:
+{
+  name = "bitcoind";
+  meta = with pkgs.lib; {
+    maintainers = with maintainers; [ _1000101 ];
+  };
 
-    nodes.machine =
-      { ... }:
-      {
-        services.bitcoind."mainnet" = {
-          enable = true;
-          rpc = {
-            port = 8332;
-            users.rpc.passwordHMAC = "acc2374e5f9ba9e62a5204d3686616cf$53abdba5e67a9005be6a27ca03a93ce09e58854bc2b871523a0d239a72968033";
-            users.rpc2.passwordHMAC = "1495e4a3ad108187576c68f7f9b5ddc5$accce0881c74aa01bb8960ff3bdbd39f607fd33178147679e055a4ac35f53225";
-          };
-        };
-
-        environment.etc."test.blank".text = "";
-        services.bitcoind."testnet" = {
-          enable = true;
-          configFile = "/etc/test.blank";
-          testnet = true;
-          rpc = {
-            port = 18332;
-          };
-          extraCmdlineOptions = [
-            "-rpcuser=rpc"
-            "-rpcpassword=rpc"
-            "-rpcauth=rpc2:1495e4a3ad108187576c68f7f9b5ddc5$accce0881c74aa01bb8960ff3bdbd39f607fd33178147679e055a4ac35f53225"
-          ];
+  nodes.machine =
+    { ... }:
+    {
+      services.bitcoind."mainnet" = {
+        enable = true;
+        rpc = {
+          port = 8332;
+          users.rpc.passwordHMAC = "acc2374e5f9ba9e62a5204d3686616cf$53abdba5e67a9005be6a27ca03a93ce09e58854bc2b871523a0d239a72968033";
+          users.rpc2.passwordHMAC = "1495e4a3ad108187576c68f7f9b5ddc5$accce0881c74aa01bb8960ff3bdbd39f607fd33178147679e055a4ac35f53225";
         };
       };
 
-    testScript = ''
-      start_all()
+      environment.etc."test.blank".text = "";
+      services.bitcoind."testnet" = {
+        enable = true;
+        configFile = "/etc/test.blank";
+        testnet = true;
+        rpc = {
+          port = 18332;
+        };
+        extraCmdlineOptions = [
+          "-rpcuser=rpc"
+          "-rpcpassword=rpc"
+          "-rpcauth=rpc2:1495e4a3ad108187576c68f7f9b5ddc5$accce0881c74aa01bb8960ff3bdbd39f607fd33178147679e055a4ac35f53225"
+        ];
+      };
+    };
 
-      machine.wait_for_unit("bitcoind-mainnet.service")
-      machine.wait_for_unit("bitcoind-testnet.service")
+  testScript = ''
+    start_all()
 
-      machine.wait_until_succeeds(
-          'curl --fail --user rpc:rpc --data-binary \'{"jsonrpc": "1.0", "id":"curltest", "method": "getblockchaininfo", "params": [] }\' -H \'content-type: text/plain;\' localhost:8332 |  grep \'"chain":"main"\' '
-      )
-      machine.wait_until_succeeds(
-          'curl --fail --user rpc2:rpc2 --data-binary \'{"jsonrpc": "1.0", "id":"curltest", "method": "getblockchaininfo", "params": [] }\' -H \'content-type: text/plain;\' localhost:8332 |  grep \'"chain":"main"\' '
-      )
-      machine.wait_until_succeeds(
-          'curl --fail --user rpc:rpc --data-binary \'{"jsonrpc": "1.0", "id":"curltest", "method": "getblockchaininfo", "params": [] }\' -H \'content-type: text/plain;\' localhost:18332 |  grep \'"chain":"test"\' '
-      )
-      machine.wait_until_succeeds(
-          'curl --fail --user rpc2:rpc2 --data-binary \'{"jsonrpc": "1.0", "id":"curltest", "method": "getblockchaininfo", "params": [] }\' -H \'content-type: text/plain;\' localhost:18332 |  grep \'"chain":"test"\' '
-      )
-    '';
-  }
-)
+    machine.wait_for_unit("bitcoind-mainnet.service")
+    machine.wait_for_unit("bitcoind-testnet.service")
+
+    machine.wait_until_succeeds(
+        'curl --fail --user rpc:rpc --data-binary \'{"jsonrpc": "1.0", "id":"curltest", "method": "getblockchaininfo", "params": [] }\' -H \'content-type: text/plain;\' localhost:8332 |  grep \'"chain":"main"\' '
+    )
+    machine.wait_until_succeeds(
+        'curl --fail --user rpc2:rpc2 --data-binary \'{"jsonrpc": "1.0", "id":"curltest", "method": "getblockchaininfo", "params": [] }\' -H \'content-type: text/plain;\' localhost:8332 |  grep \'"chain":"main"\' '
+    )
+    machine.wait_until_succeeds(
+        'curl --fail --user rpc:rpc --data-binary \'{"jsonrpc": "1.0", "id":"curltest", "method": "getblockchaininfo", "params": [] }\' -H \'content-type: text/plain;\' localhost:18332 |  grep \'"chain":"test"\' '
+    )
+    machine.wait_until_succeeds(
+        'curl --fail --user rpc2:rpc2 --data-binary \'{"jsonrpc": "1.0", "id":"curltest", "method": "getblockchaininfo", "params": [] }\' -H \'content-type: text/plain;\' localhost:18332 |  grep \'"chain":"test"\' '
+    )
+  '';
+}
diff --git a/nixos/tests/bittorrent.nix b/nixos/tests/bittorrent.nix
index 83d9168a6fa5..b62eddc4f663 100644
--- a/nixos/tests/bittorrent.nix
+++ b/nixos/tests/bittorrent.nix
@@ -6,199 +6,197 @@
 # which only works if the first client successfully uses the UPnP-IGD
 # protocol to poke a hole in the NAT.
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
+let
 
-    # Some random file to serve.
-    file = pkgs.hello.src;
+  # Some random file to serve.
+  file = pkgs.hello.src;
 
-    internalRouterAddress = "192.168.3.1";
-    internalClient1Address = "192.168.3.2";
-    externalRouterAddress = "80.100.100.1";
-    externalClient2Address = "80.100.100.2";
-    externalTrackerAddress = "80.100.100.3";
+  internalRouterAddress = "192.168.3.1";
+  internalClient1Address = "192.168.3.2";
+  externalRouterAddress = "80.100.100.1";
+  externalClient2Address = "80.100.100.2";
+  externalTrackerAddress = "80.100.100.3";
 
-    download-dir = "/var/lib/transmission/Downloads";
-    transmissionConfig =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.transmission_3 ];
-        services.transmission = {
-          enable = true;
-          settings = {
-            dht-enabled = false;
-            message-level = 2;
-            inherit download-dir;
-          };
+  download-dir = "/var/lib/transmission/Downloads";
+  transmissionConfig =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.transmission_3 ];
+      services.transmission = {
+        enable = true;
+        settings = {
+          dht-enabled = false;
+          message-level = 2;
+          inherit download-dir;
         };
       };
-  in
-
-  {
-    name = "bittorrent";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        domenkozar
-        rob
-        bobvanderlinden
-      ];
     };
+in
 
-    nodes = {
-      tracker =
-        { pkgs, ... }:
-        {
-          imports = [ transmissionConfig ];
+{
+  name = "bittorrent";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      domenkozar
+      rob
+      bobvanderlinden
+    ];
+  };
 
-          virtualisation.vlans = [ 1 ];
-          networking.firewall.enable = false;
-          networking.interfaces.eth1.ipv4.addresses = [
-            {
-              address = externalTrackerAddress;
-              prefixLength = 24;
-            }
-          ];
+  nodes = {
+    tracker =
+      { pkgs, ... }:
+      {
+        imports = [ transmissionConfig ];
 
-          # We need Apache on the tracker to serve the torrents.
-          services.httpd = {
-            enable = true;
-            virtualHosts = {
-              "torrentserver.org" = {
-                adminAddr = "foo@example.org";
-                documentRoot = "/tmp";
-              };
+        virtualisation.vlans = [ 1 ];
+        networking.firewall.enable = false;
+        networking.interfaces.eth1.ipv4.addresses = [
+          {
+            address = externalTrackerAddress;
+            prefixLength = 24;
+          }
+        ];
+
+        # We need Apache on the tracker to serve the torrents.
+        services.httpd = {
+          enable = true;
+          virtualHosts = {
+            "torrentserver.org" = {
+              adminAddr = "foo@example.org";
+              documentRoot = "/tmp";
             };
           };
-          services.opentracker.enable = true;
         };
+        services.opentracker.enable = true;
+      };
 
-      router =
-        { pkgs, nodes, ... }:
-        {
-          virtualisation.vlans = [
-            1
-            2
-          ];
-          networking.nat.enable = true;
-          networking.nat.internalInterfaces = [ "eth2" ];
-          networking.nat.externalInterface = "eth1";
-          networking.firewall.enable = true;
-          networking.firewall.trustedInterfaces = [ "eth2" ];
-          networking.interfaces.eth0.ipv4.addresses = [ ];
-          networking.interfaces.eth1.ipv4.addresses = [
-            {
-              address = externalRouterAddress;
-              prefixLength = 24;
-            }
-          ];
-          networking.interfaces.eth2.ipv4.addresses = [
-            {
-              address = internalRouterAddress;
-              prefixLength = 24;
-            }
-          ];
-          services.miniupnpd = {
-            enable = true;
-            externalInterface = "eth1";
-            internalIPs = [ "eth2" ];
-            appendConfig = ''
-              ext_ip=${externalRouterAddress}
-            '';
-          };
+    router =
+      { pkgs, nodes, ... }:
+      {
+        virtualisation.vlans = [
+          1
+          2
+        ];
+        networking.nat.enable = true;
+        networking.nat.internalInterfaces = [ "eth2" ];
+        networking.nat.externalInterface = "eth1";
+        networking.firewall.enable = true;
+        networking.firewall.trustedInterfaces = [ "eth2" ];
+        networking.interfaces.eth0.ipv4.addresses = [ ];
+        networking.interfaces.eth1.ipv4.addresses = [
+          {
+            address = externalRouterAddress;
+            prefixLength = 24;
+          }
+        ];
+        networking.interfaces.eth2.ipv4.addresses = [
+          {
+            address = internalRouterAddress;
+            prefixLength = 24;
+          }
+        ];
+        services.miniupnpd = {
+          enable = true;
+          externalInterface = "eth1";
+          internalIPs = [ "eth2" ];
+          appendConfig = ''
+            ext_ip=${externalRouterAddress}
+          '';
         };
+      };
 
-      client1 =
-        { pkgs, nodes, ... }:
-        {
-          imports = [ transmissionConfig ];
-          environment.systemPackages = [ pkgs.miniupnpc ];
+    client1 =
+      { pkgs, nodes, ... }:
+      {
+        imports = [ transmissionConfig ];
+        environment.systemPackages = [ pkgs.miniupnpc ];
 
-          virtualisation.vlans = [ 2 ];
-          networking.interfaces.eth0.ipv4.addresses = [ ];
-          networking.interfaces.eth1.ipv4.addresses = [
-            {
-              address = internalClient1Address;
-              prefixLength = 24;
-            }
-          ];
-          networking.defaultGateway = internalRouterAddress;
-          networking.firewall.enable = false;
-        };
+        virtualisation.vlans = [ 2 ];
+        networking.interfaces.eth0.ipv4.addresses = [ ];
+        networking.interfaces.eth1.ipv4.addresses = [
+          {
+            address = internalClient1Address;
+            prefixLength = 24;
+          }
+        ];
+        networking.defaultGateway = internalRouterAddress;
+        networking.firewall.enable = false;
+      };
 
-      client2 =
-        { pkgs, ... }:
-        {
-          imports = [ transmissionConfig ];
+    client2 =
+      { pkgs, ... }:
+      {
+        imports = [ transmissionConfig ];
 
-          virtualisation.vlans = [ 1 ];
-          networking.interfaces.eth0.ipv4.addresses = [ ];
-          networking.interfaces.eth1.ipv4.addresses = [
-            {
-              address = externalClient2Address;
-              prefixLength = 24;
-            }
-          ];
-          networking.firewall.enable = false;
-        };
-    };
+        virtualisation.vlans = [ 1 ];
+        networking.interfaces.eth0.ipv4.addresses = [ ];
+        networking.interfaces.eth1.ipv4.addresses = [
+          {
+            address = externalClient2Address;
+            prefixLength = 24;
+          }
+        ];
+        networking.firewall.enable = false;
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
 
-        # Wait for network and miniupnpd.
-        router.systemctl("start network-online.target")
-        router.wait_for_unit("network-online.target")
-        router.wait_for_unit("miniupnpd")
+      # Wait for network and miniupnpd.
+      router.systemctl("start network-online.target")
+      router.wait_for_unit("network-online.target")
+      router.wait_for_unit("miniupnpd")
 
-        # Create the torrent.
-        tracker.succeed("mkdir ${download-dir}/data")
-        tracker.succeed(
-            "cp ${file} ${download-dir}/data/test.tar.bz2"
-        )
-        tracker.succeed(
-            "transmission-create ${download-dir}/data/test.tar.bz2 --private --tracker http://${externalTrackerAddress}:6969/announce --outfile /tmp/test.torrent"
-        )
-        tracker.succeed("chmod 644 /tmp/test.torrent")
+      # Create the torrent.
+      tracker.succeed("mkdir ${download-dir}/data")
+      tracker.succeed(
+          "cp ${file} ${download-dir}/data/test.tar.bz2"
+      )
+      tracker.succeed(
+          "transmission-create ${download-dir}/data/test.tar.bz2 --private --tracker http://${externalTrackerAddress}:6969/announce --outfile /tmp/test.torrent"
+      )
+      tracker.succeed("chmod 644 /tmp/test.torrent")
 
-        # Start the tracker.  !!! use a less crappy tracker
-        tracker.systemctl("start network-online.target")
-        tracker.wait_for_unit("network-online.target")
-        tracker.wait_for_unit("opentracker.service")
-        tracker.wait_for_open_port(6969)
+      # Start the tracker.  !!! use a less crappy tracker
+      tracker.systemctl("start network-online.target")
+      tracker.wait_for_unit("network-online.target")
+      tracker.wait_for_unit("opentracker.service")
+      tracker.wait_for_open_port(6969)
 
-        # Start the initial seeder.
-        tracker.succeed(
-            "transmission-remote --add /tmp/test.torrent --no-portmap --no-dht --download-dir ${download-dir}/data"
-        )
+      # Start the initial seeder.
+      tracker.succeed(
+          "transmission-remote --add /tmp/test.torrent --no-portmap --no-dht --download-dir ${download-dir}/data"
+      )
 
-        # Now we should be able to download from the client behind the NAT.
-        tracker.wait_for_unit("httpd")
-        client1.systemctl("start network-online.target")
-        client1.wait_for_unit("network-online.target")
-        client1.succeed("transmission-remote --add http://${externalTrackerAddress}/test.torrent >&2 &")
-        client1.wait_for_file("${download-dir}/test.tar.bz2")
-        client1.succeed(
-            "cmp ${download-dir}/test.tar.bz2 ${file}"
-        )
+      # Now we should be able to download from the client behind the NAT.
+      tracker.wait_for_unit("httpd")
+      client1.systemctl("start network-online.target")
+      client1.wait_for_unit("network-online.target")
+      client1.succeed("transmission-remote --add http://${externalTrackerAddress}/test.torrent >&2 &")
+      client1.wait_for_file("${download-dir}/test.tar.bz2")
+      client1.succeed(
+          "cmp ${download-dir}/test.tar.bz2 ${file}"
+      )
 
-        # Bring down the initial seeder.
-        tracker.stop_job("transmission")
+      # Bring down the initial seeder.
+      tracker.stop_job("transmission")
 
-        # Now download from the second client.  This can only succeed if
-        # the first client created a NAT hole in the router.
-        client2.systemctl("start network-online.target")
-        client2.wait_for_unit("network-online.target")
-        client2.succeed(
-            "transmission-remote --add http://${externalTrackerAddress}/test.torrent --no-portmap --no-dht >&2 &"
-        )
-        client2.wait_for_file("${download-dir}/test.tar.bz2")
-        client2.succeed(
-            "cmp ${download-dir}/test.tar.bz2 ${file}"
-        )
-      '';
-  }
-)
+      # Now download from the second client.  This can only succeed if
+      # the first client created a NAT hole in the router.
+      client2.systemctl("start network-online.target")
+      client2.wait_for_unit("network-online.target")
+      client2.succeed(
+          "transmission-remote --add http://${externalTrackerAddress}/test.torrent --no-portmap --no-dht >&2 &"
+      )
+      client2.wait_for_file("${download-dir}/test.tar.bz2")
+      client2.succeed(
+          "cmp ${download-dir}/test.tar.bz2 ${file}"
+      )
+    '';
+}
diff --git a/nixos/tests/blockbook-frontend.nix b/nixos/tests/blockbook-frontend.nix
index 60bc59d8ec8d..bf6d6bb458c4 100644
--- a/nixos/tests/blockbook-frontend.nix
+++ b/nixos/tests/blockbook-frontend.nix
@@ -1,33 +1,31 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "blockbook-frontend";
-    meta = with pkgs.lib; {
-      maintainers = with maintainers; [ _1000101 ];
-    };
+{ pkgs, ... }:
+{
+  name = "blockbook-frontend";
+  meta = with pkgs.lib; {
+    maintainers = with maintainers; [ _1000101 ];
+  };
 
-    nodes.machine =
-      { ... }:
-      {
-        services.blockbook-frontend."test" = {
-          enable = true;
-        };
-        services.bitcoind.mainnet = {
-          enable = true;
-          rpc = {
-            port = 8030;
-            users.rpc.passwordHMAC = "acc2374e5f9ba9e62a5204d3686616cf$53abdba5e67a9005be6a27ca03a93ce09e58854bc2b871523a0d239a72968033";
-          };
+  nodes.machine =
+    { ... }:
+    {
+      services.blockbook-frontend."test" = {
+        enable = true;
+      };
+      services.bitcoind.mainnet = {
+        enable = true;
+        rpc = {
+          port = 8030;
+          users.rpc.passwordHMAC = "acc2374e5f9ba9e62a5204d3686616cf$53abdba5e67a9005be6a27ca03a93ce09e58854bc2b871523a0d239a72968033";
         };
       };
+    };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("blockbook-frontend-test.service")
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("blockbook-frontend-test.service")
 
-      machine.wait_for_open_port(9030)
+    machine.wait_for_open_port(9030)
 
-      machine.succeed("curl -sSfL http://localhost:9030 | grep 'Blockbook'")
-    '';
-  }
-)
+    machine.succeed("curl -sSfL http://localhost:9030 | grep 'Blockbook'")
+  '';
+}
diff --git a/nixos/tests/boot-stage1.nix b/nixos/tests/boot-stage1.nix
index c700b79b27fe..e76af3e1dc6f 100644
--- a/nixos/tests/boot-stage1.nix
+++ b/nixos/tests/boot-stage1.nix
@@ -1,193 +1,191 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "boot-stage1";
+{ pkgs, ... }:
+{
+  name = "boot-stage1";
 
-    nodes.machine =
-      {
-        config,
-        pkgs,
-        lib,
-        ...
-      }:
-      {
-        boot.extraModulePackages =
-          let
-            compileKernelModule =
-              name: source:
-              pkgs.runCommandCC name
-                rec {
-                  inherit source;
-                  kdev = config.boot.kernelPackages.kernel.dev;
-                  kver = config.boot.kernelPackages.kernel.modDirVersion;
-                  ksrc = "${kdev}/lib/modules/${kver}/build";
-                  hardeningDisable = [ "pic" ];
-                  nativeBuildInputs = kdev.moduleBuildDependencies;
-                }
-                ''
-                  echo "obj-m += $name.o" > Makefile
-                  echo "$source" > "$name.c"
-                  make -C "$ksrc" M=$(pwd) modules
-                  install -vD "$name.ko" "$out/lib/modules/$kver/$name.ko"
-                '';
-
-            # This spawns a kthread which just waits until it gets a signal and
-            # terminates if that is the case. We want to make sure that nothing during
-            # the boot process kills any kthread by accident, like what happened in
-            # issue #15226.
-            kcanary = compileKernelModule "kcanary" ''
-              #include <linux/version.h>
-              #include <linux/init.h>
-              #include <linux/module.h>
-              #include <linux/kernel.h>
-              #include <linux/kthread.h>
-              #include <linux/sched.h>
-              #include <linux/signal.h>
-              #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 10, 0)
-              #include <linux/sched/signal.h>
-              #endif
-
-              MODULE_LICENSE("GPL");
-
-              struct task_struct *canaryTask;
-
-              static int kcanary(void *nothing)
-              {
-                allow_signal(SIGINT);
-                allow_signal(SIGTERM);
-                allow_signal(SIGKILL);
-                while (!kthread_should_stop()) {
-                  set_current_state(TASK_INTERRUPTIBLE);
-                  schedule_timeout_interruptible(msecs_to_jiffies(100));
-                  if (signal_pending(current)) break;
-                }
-                return 0;
+  nodes.machine =
+    {
+      config,
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      boot.extraModulePackages =
+        let
+          compileKernelModule =
+            name: source:
+            pkgs.runCommandCC name
+              rec {
+                inherit source;
+                kdev = config.boot.kernelPackages.kernel.dev;
+                kver = config.boot.kernelPackages.kernel.modDirVersion;
+                ksrc = "${kdev}/lib/modules/${kver}/build";
+                hardeningDisable = [ "pic" ];
+                nativeBuildInputs = kdev.moduleBuildDependencies;
               }
-
-              static int kcanaryInit(void)
-              {
-                kthread_run(&kcanary, NULL, "kcanary");
-                return 0;
-              }
-
-              static void kcanaryExit(void)
-              {
-                kthread_stop(canaryTask);
-              }
-
-              module_init(kcanaryInit);
-              module_exit(kcanaryExit);
-            '';
-
-          in
-          lib.singleton kcanary;
-
-        boot.initrd.kernelModules = [ "kcanary" ];
-
-        boot.initrd.extraUtilsCommands =
-          let
-            compile =
-              name: source:
-              pkgs.runCommandCC name { inherit source; } ''
-                mkdir -p "$out/bin"
-                echo "$source" | gcc -Wall -o "$out/bin/$name" -xc -
+              ''
+                echo "obj-m += $name.o" > Makefile
+                echo "$source" > "$name.c"
+                make -C "$ksrc" M=$(pwd) modules
+                install -vD "$name.ko" "$out/lib/modules/$kver/$name.ko"
               '';
 
-            daemonize =
-              name: source:
-              compile name ''
+          # This spawns a kthread which just waits until it gets a signal and
+          # terminates if that is the case. We want to make sure that nothing during
+          # the boot process kills any kthread by accident, like what happened in
+          # issue #15226.
+          kcanary = compileKernelModule "kcanary" ''
+            #include <linux/version.h>
+            #include <linux/init.h>
+            #include <linux/module.h>
+            #include <linux/kernel.h>
+            #include <linux/kthread.h>
+            #include <linux/sched.h>
+            #include <linux/signal.h>
+            #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 10, 0)
+            #include <linux/sched/signal.h>
+            #endif
+
+            MODULE_LICENSE("GPL");
+
+            struct task_struct *canaryTask;
+
+            static int kcanary(void *nothing)
+            {
+              allow_signal(SIGINT);
+              allow_signal(SIGTERM);
+              allow_signal(SIGKILL);
+              while (!kthread_should_stop()) {
+                set_current_state(TASK_INTERRUPTIBLE);
+                schedule_timeout_interruptible(msecs_to_jiffies(100));
+                if (signal_pending(current)) break;
+              }
+              return 0;
+            }
+
+            static int kcanaryInit(void)
+            {
+              kthread_run(&kcanary, NULL, "kcanary");
+              return 0;
+            }
+
+            static void kcanaryExit(void)
+            {
+              kthread_stop(canaryTask);
+            }
+
+            module_init(kcanaryInit);
+            module_exit(kcanaryExit);
+          '';
+
+        in
+        lib.singleton kcanary;
+
+      boot.initrd.kernelModules = [ "kcanary" ];
+
+      boot.initrd.extraUtilsCommands =
+        let
+          compile =
+            name: source:
+            pkgs.runCommandCC name { inherit source; } ''
+              mkdir -p "$out/bin"
+              echo "$source" | gcc -Wall -o "$out/bin/$name" -xc -
+            '';
+
+          daemonize =
+            name: source:
+            compile name ''
+              #include <stdio.h>
+              #include <unistd.h>
+
+              void runSource(void) {
+              ${source}
+              }
+
+              int main(void) {
+                if (fork() > 0) return 0;
+                setsid();
+                runSource();
+                return 1;
+              }
+            '';
+
+          mkCmdlineCanary =
+            {
+              name,
+              cmdline ? "",
+              source ? "",
+            }:
+            (daemonize name ''
+              char *argv[] = {"${cmdline}", NULL};
+              execvp("${name}-child", argv);
+            '')
+            // {
+              child = compile "${name}-child" ''
                 #include <stdio.h>
                 #include <unistd.h>
 
-                void runSource(void) {
-                ${source}
-                }
-
                 int main(void) {
-                  if (fork() > 0) return 0;
-                  setsid();
-                  runSource();
+                  ${source}
+                  while (1) sleep(1);
                   return 1;
                 }
               '';
+            };
 
-            mkCmdlineCanary =
-              {
-                name,
-                cmdline ? "",
-                source ? "",
-              }:
-              (daemonize name ''
-                char *argv[] = {"${cmdline}", NULL};
-                execvp("${name}-child", argv);
-              '')
-              // {
-                child = compile "${name}-child" ''
-                  #include <stdio.h>
-                  #include <unistd.h>
+          copyCanaries = lib.concatMapStrings (canary: ''
+            ${lib.optionalString (canary ? child) ''
+              copy_bin_and_libs "${canary.child}/bin/${canary.child.name}"
+            ''}
+            copy_bin_and_libs "${canary}/bin/${canary.name}"
+          '');
 
-                  int main(void) {
-                    ${source}
-                    while (1) sleep(1);
-                    return 1;
-                  }
-                '';
-              };
+        in
+        copyCanaries [
+          # Simple canary process which just sleeps forever and should be killed by
+          # stage 2.
+          (daemonize "canary1" "while (1) sleep(1);")
 
-            copyCanaries = lib.concatMapStrings (canary: ''
-              ${lib.optionalString (canary ? child) ''
-                copy_bin_and_libs "${canary.child}/bin/${canary.child.name}"
-              ''}
-              copy_bin_and_libs "${canary}/bin/${canary.name}"
-            '');
+          # We want this canary process to try mimicking a kthread using a cmdline
+          # with a zero length so we can make sure that the process is properly
+          # killed in stage 1.
+          (mkCmdlineCanary {
+            name = "canary2";
+            source = ''
+              FILE *f;
+              f = fopen("/run/canary2.pid", "w");
+              fprintf(f, "%d\n", getpid());
+              fclose(f);
+            '';
+          })
 
-          in
-          copyCanaries [
-            # Simple canary process which just sleeps forever and should be killed by
-            # stage 2.
-            (daemonize "canary1" "while (1) sleep(1);")
+          # This canary process mimics a storage daemon, which we do NOT want to be
+          # killed before going into stage 2. For more on root storage daemons, see:
+          # https://www.freedesktop.org/wiki/Software/systemd/RootStorageDaemons/
+          (mkCmdlineCanary {
+            name = "canary3";
+            cmdline = "@canary3";
+          })
+        ];
 
-            # We want this canary process to try mimicking a kthread using a cmdline
-            # with a zero length so we can make sure that the process is properly
-            # killed in stage 1.
-            (mkCmdlineCanary {
-              name = "canary2";
-              source = ''
-                FILE *f;
-                f = fopen("/run/canary2.pid", "w");
-                fprintf(f, "%d\n", getpid());
-                fclose(f);
-              '';
-            })
+      boot.initrd.postMountCommands = ''
+        canary1
+        canary2
+        canary3
+        # Make sure the pidfile of canary 2 is created so that we still can get
+        # its former pid after the killing spree starts next within stage 1.
+        while [ ! -s /run/canary2.pid ]; do sleep 0.1; done
+      '';
+    };
 
-            # This canary process mimics a storage daemon, which we do NOT want to be
-            # killed before going into stage 2. For more on root storage daemons, see:
-            # https://www.freedesktop.org/wiki/Software/systemd/RootStorageDaemons/
-            (mkCmdlineCanary {
-              name = "canary3";
-              cmdline = "@canary3";
-            })
-          ];
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("test -s /run/canary2.pid")
+    machine.fail("pgrep -a canary1")
+    machine.fail("kill -0 $(< /run/canary2.pid)")
+    machine.succeed('pgrep -a -f "^@canary3$"')
+    machine.succeed('pgrep -a -f "^\\[kcanary\\]$"')
+  '';
 
-        boot.initrd.postMountCommands = ''
-          canary1
-          canary2
-          canary3
-          # Make sure the pidfile of canary 2 is created so that we still can get
-          # its former pid after the killing spree starts next within stage 1.
-          while [ ! -s /run/canary2.pid ]; do sleep 0.1; done
-        '';
-      };
-
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("test -s /run/canary2.pid")
-      machine.fail("pgrep -a canary1")
-      machine.fail("kill -0 $(< /run/canary2.pid)")
-      machine.succeed('pgrep -a -f "^@canary3$"')
-      machine.succeed('pgrep -a -f "^\\[kcanary\\]$"')
-    '';
-
-    meta.maintainers = with pkgs.lib.maintainers; [ aszlig ];
-  }
-)
+  meta.maintainers = with pkgs.lib.maintainers; [ aszlig ];
+}
diff --git a/nixos/tests/boot-stage2.nix b/nixos/tests/boot-stage2.nix
index 90f0ac01207c..13d7b66fe67e 100644
--- a/nixos/tests/boot-stage2.nix
+++ b/nixos/tests/boot-stage2.nix
@@ -1,73 +1,71 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "boot-stage2";
+{ pkgs, ... }:
+{
+  name = "boot-stage2";
 
-    nodes.machine =
-      {
-        config,
-        pkgs,
-        lib,
-        ...
-      }:
-      {
-        virtualisation = {
-          emptyDiskImages = [ 256 ];
+  nodes.machine =
+    {
+      config,
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      virtualisation = {
+        emptyDiskImages = [ 256 ];
 
-          # Mount an ext4 as the upper layer of the Nix store.
-          fileSystems = {
-            "/nix/store" = lib.mkForce {
-              device = "/dev/vdb"; # the above disk image
-              fsType = "ext4";
+        # Mount an ext4 as the upper layer of the Nix store.
+        fileSystems = {
+          "/nix/store" = lib.mkForce {
+            device = "/dev/vdb"; # the above disk image
+            fsType = "ext4";
 
-              # data=journal always displays after errors=remount-ro; this is only needed because of the overlay
-              # and #375257 will trigger with `errors=remount-ro` on a non-overlaid store:
-              # see ordering in https://github.com/torvalds/linux/blob/v6.12/fs/ext4/super.c#L2974
-              options = [
-                "defaults"
-                "errors=remount-ro"
-                "data=journal"
-              ];
-            };
+            # data=journal always displays after errors=remount-ro; this is only needed because of the overlay
+            # and #375257 will trigger with `errors=remount-ro` on a non-overlaid store:
+            # see ordering in https://github.com/torvalds/linux/blob/v6.12/fs/ext4/super.c#L2974
+            options = [
+              "defaults"
+              "errors=remount-ro"
+              "data=journal"
+            ];
           };
         };
-
-        boot = {
-          initrd = {
-            # Format the upper Nix store.
-            postDeviceCommands = ''
-              ${pkgs.e2fsprogs}/bin/mkfs.ext4 /dev/vdb
-            '';
-
-            # Overlay the RO store onto it.
-            # Note that bug #375257 can be triggered without an overlay,
-            # using the errors=remount-ro option (or similar) or with an overlay where any of the
-            # paths ends in 'ro'. The offending mountpoint also has to be the last (top) one
-            # if an option ending in 'ro' is the last in the list, so test both cases here.
-            postMountCommands = ''
-              mkdir -p /mnt-root/nix/store/ro /mnt-root/nix/store/rw /mnt-root/nix/store/work
-              mount --bind /mnt-root/nix/.ro-store /mnt-root/nix/store/ro
-              mount -t overlay overlay \
-                -o lowerdir=/mnt-root/nix/store/ro,upperdir=/mnt-root/nix/store/rw,workdir=/mnt-root/nix/store/work \
-                /mnt-root/nix/store
-            '';
-
-            kernelModules = [ "overlay" ];
-          };
-
-          postBootCommands = ''
-            touch /etc/post-boot-ran
-            mount
-          '';
-        };
       };
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("test /etc/post-boot-ran")
-      machine.fail("touch /nix/store/should-not-work");
-    '';
+      boot = {
+        initrd = {
+          # Format the upper Nix store.
+          postDeviceCommands = ''
+            ${pkgs.e2fsprogs}/bin/mkfs.ext4 /dev/vdb
+          '';
 
-    meta.maintainers = with pkgs.lib.maintainers; [ numinit ];
-  }
-)
+          # Overlay the RO store onto it.
+          # Note that bug #375257 can be triggered without an overlay,
+          # using the errors=remount-ro option (or similar) or with an overlay where any of the
+          # paths ends in 'ro'. The offending mountpoint also has to be the last (top) one
+          # if an option ending in 'ro' is the last in the list, so test both cases here.
+          postMountCommands = ''
+            mkdir -p /mnt-root/nix/store/ro /mnt-root/nix/store/rw /mnt-root/nix/store/work
+            mount --bind /mnt-root/nix/.ro-store /mnt-root/nix/store/ro
+            mount -t overlay overlay \
+              -o lowerdir=/mnt-root/nix/store/ro,upperdir=/mnt-root/nix/store/rw,workdir=/mnt-root/nix/store/work \
+              /mnt-root/nix/store
+          '';
+
+          kernelModules = [ "overlay" ];
+        };
+
+        postBootCommands = ''
+          touch /etc/post-boot-ran
+          mount
+        '';
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("test /etc/post-boot-ran")
+    machine.fail("touch /nix/store/should-not-work");
+  '';
+
+  meta.maintainers = with pkgs.lib.maintainers; [ numinit ];
+}
diff --git a/nixos/tests/borgbackup.nix b/nixos/tests/borgbackup.nix
index 2ee324f1de2a..88d67c09f031 100644
--- a/nixos/tests/borgbackup.nix
+++ b/nixos/tests/borgbackup.nix
@@ -1,276 +1,274 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    passphrase = "supersecret";
-    dataDir = "/ran:dom/data";
-    subDir = "not_anything_here";
-    excludedSubDirFile = "not_this_file_either";
-    excludeFile = "not_this_file";
-    keepFile = "important_file";
-    keepFileData = "important_data";
-    localRepo = "/root/back:up";
-    # a repository on a file system which is not mounted automatically
-    localRepoMount = "/noAutoMount";
-    archiveName = "my_archive";
-    remoteRepo = "borg@server:."; # No need to specify path
-    privateKey = pkgs.writeText "id_ed25519" ''
-      -----BEGIN OPENSSH PRIVATE KEY-----
-      b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-      QyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrwAAAJB+cF5HfnBe
-      RwAAAAtzc2gtZWQyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrw
-      AAAEBN75NsJZSpt63faCuaD75Unko0JjlSDxMhYHAPJk2/xXHxQHThDpD9/AMWNqQer3Tg
-      9gXMb2lTZMn0pelo8xyvAAAADXJzY2h1ZXR6QGt1cnQ=
-      -----END OPENSSH PRIVATE KEY-----
-    '';
-    publicKey = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHHxQHThDpD9/AMWNqQer3Tg9gXMb2lTZMn0pelo8xyv root@client
-    '';
-    privateKeyAppendOnly = pkgs.writeText "id_ed25519" ''
-      -----BEGIN OPENSSH PRIVATE KEY-----
-      b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-      QyNTUxOQAAACBacZuz1ELGQdhI7PF6dGFafCDlvh8pSEc4cHjkW0QjLwAAAJC9YTxxvWE8
-      cQAAAAtzc2gtZWQyNTUxOQAAACBacZuz1ELGQdhI7PF6dGFafCDlvh8pSEc4cHjkW0QjLw
-      AAAEAAhV7wTl5dL/lz+PF/d4PnZXuG1Id6L/mFEiGT1tZsuFpxm7PUQsZB2Ejs8Xp0YVp8
-      IOW+HylIRzhweORbRCMvAAAADXJzY2h1ZXR6QGt1cnQ=
-      -----END OPENSSH PRIVATE KEY-----
-    '';
-    publicKeyAppendOnly = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFpxm7PUQsZB2Ejs8Xp0YVp8IOW+HylIRzhweORbRCMv root@client
-    '';
+let
+  passphrase = "supersecret";
+  dataDir = "/ran:dom/data";
+  subDir = "not_anything_here";
+  excludedSubDirFile = "not_this_file_either";
+  excludeFile = "not_this_file";
+  keepFile = "important_file";
+  keepFileData = "important_data";
+  localRepo = "/root/back:up";
+  # a repository on a file system which is not mounted automatically
+  localRepoMount = "/noAutoMount";
+  archiveName = "my_archive";
+  remoteRepo = "borg@server:."; # No need to specify path
+  privateKey = pkgs.writeText "id_ed25519" ''
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+    QyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrwAAAJB+cF5HfnBe
+    RwAAAAtzc2gtZWQyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrw
+    AAAEBN75NsJZSpt63faCuaD75Unko0JjlSDxMhYHAPJk2/xXHxQHThDpD9/AMWNqQer3Tg
+    9gXMb2lTZMn0pelo8xyvAAAADXJzY2h1ZXR6QGt1cnQ=
+    -----END OPENSSH PRIVATE KEY-----
+  '';
+  publicKey = ''
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHHxQHThDpD9/AMWNqQer3Tg9gXMb2lTZMn0pelo8xyv root@client
+  '';
+  privateKeyAppendOnly = pkgs.writeText "id_ed25519" ''
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+    QyNTUxOQAAACBacZuz1ELGQdhI7PF6dGFafCDlvh8pSEc4cHjkW0QjLwAAAJC9YTxxvWE8
+    cQAAAAtzc2gtZWQyNTUxOQAAACBacZuz1ELGQdhI7PF6dGFafCDlvh8pSEc4cHjkW0QjLw
+    AAAEAAhV7wTl5dL/lz+PF/d4PnZXuG1Id6L/mFEiGT1tZsuFpxm7PUQsZB2Ejs8Xp0YVp8
+    IOW+HylIRzhweORbRCMvAAAADXJzY2h1ZXR6QGt1cnQ=
+    -----END OPENSSH PRIVATE KEY-----
+  '';
+  publicKeyAppendOnly = ''
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFpxm7PUQsZB2Ejs8Xp0YVp8IOW+HylIRzhweORbRCMv root@client
+  '';
 
-  in
-  {
-    name = "borgbackup";
-    meta = with pkgs.lib; {
-      maintainers = with maintainers; [ dotlambda ];
-    };
+in
+{
+  name = "borgbackup";
+  meta = with pkgs.lib; {
+    maintainers = with maintainers; [ dotlambda ];
+  };
 
-    nodes = {
-      client =
-        { ... }:
-        {
-          virtualisation.fileSystems.${localRepoMount} = {
-            device = "tmpfs";
-            fsType = "tmpfs";
-            options = [ "noauto" ];
+  nodes = {
+    client =
+      { ... }:
+      {
+        virtualisation.fileSystems.${localRepoMount} = {
+          device = "tmpfs";
+          fsType = "tmpfs";
+          options = [ "noauto" ];
+        };
+
+        services.borgbackup.jobs = {
+
+          local = {
+            paths = dataDir;
+            repo = localRepo;
+            preHook = ''
+              # Don't append a timestamp
+              archiveName="${archiveName}"
+            '';
+            encryption = {
+              mode = "repokey";
+              inherit passphrase;
+            };
+            compression = "auto,zlib,9";
+            prune.keep = {
+              within = "1y";
+              yearly = 5;
+            };
+            exclude = [ "*/${excludeFile}" ];
+            extraCreateArgs = [
+              "--exclude-caches"
+              "--exclude-if-present"
+              ".dont backup"
+            ];
+            postHook = "echo post";
+            startAt = [ ]; # Do not run automatically
           };
 
-          services.borgbackup.jobs = {
+          localMount = {
+            paths = dataDir;
+            repo = localRepoMount;
+            encryption.mode = "none";
+            startAt = [ ];
+          };
 
-            local = {
-              paths = dataDir;
-              repo = localRepo;
-              preHook = ''
-                # Don't append a timestamp
-                archiveName="${archiveName}"
-              '';
-              encryption = {
-                mode = "repokey";
-                inherit passphrase;
-              };
-              compression = "auto,zlib,9";
-              prune.keep = {
-                within = "1y";
-                yearly = 5;
-              };
-              exclude = [ "*/${excludeFile}" ];
-              extraCreateArgs = [
-                "--exclude-caches"
-                "--exclude-if-present"
-                ".dont backup"
-              ];
-              postHook = "echo post";
-              startAt = [ ]; # Do not run automatically
-            };
+          remote = {
+            paths = dataDir;
+            repo = remoteRepo;
+            encryption.mode = "none";
+            startAt = [ ];
+            environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519";
+          };
 
-            localMount = {
-              paths = dataDir;
-              repo = localRepoMount;
-              encryption.mode = "none";
-              startAt = [ ];
-            };
+          remoteAppendOnly = {
+            paths = dataDir;
+            repo = remoteRepo;
+            encryption.mode = "none";
+            startAt = [ ];
+            environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519.appendOnly";
+          };
 
-            remote = {
-              paths = dataDir;
-              repo = remoteRepo;
-              encryption.mode = "none";
-              startAt = [ ];
-              environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519";
-            };
+          commandSuccess = {
+            dumpCommand = pkgs.writeScript "commandSuccess" ''
+              echo -n test
+            '';
+            repo = remoteRepo;
+            encryption.mode = "none";
+            startAt = [ ];
+            environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519";
+          };
 
-            remoteAppendOnly = {
-              paths = dataDir;
-              repo = remoteRepo;
-              encryption.mode = "none";
-              startAt = [ ];
-              environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519.appendOnly";
-            };
+          commandFail = {
+            dumpCommand = "${pkgs.coreutils}/bin/false";
+            repo = remoteRepo;
+            encryption.mode = "none";
+            startAt = [ ];
+            environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519";
+          };
 
-            commandSuccess = {
-              dumpCommand = pkgs.writeScript "commandSuccess" ''
-                echo -n test
-              '';
-              repo = remoteRepo;
-              encryption.mode = "none";
-              startAt = [ ];
-              environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519";
-            };
+          sleepInhibited = {
+            inhibitsSleep = true;
+            # Blocks indefinitely while "backing up" so that we can try to suspend the local system while it's hung
+            dumpCommand = pkgs.writeScript "sleepInhibited" ''
+              cat /dev/zero
+            '';
+            repo = remoteRepo;
+            encryption.mode = "none";
+            startAt = [ ];
+            environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519";
+          };
 
-            commandFail = {
-              dumpCommand = "${pkgs.coreutils}/bin/false";
-              repo = remoteRepo;
-              encryption.mode = "none";
-              startAt = [ ];
-              environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519";
-            };
-
-            sleepInhibited = {
-              inhibitsSleep = true;
-              # Blocks indefinitely while "backing up" so that we can try to suspend the local system while it's hung
-              dumpCommand = pkgs.writeScript "sleepInhibited" ''
-                cat /dev/zero
-              '';
-              repo = remoteRepo;
-              encryption.mode = "none";
-              startAt = [ ];
-              environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519";
-            };
+        };
+      };
 
+    server =
+      { ... }:
+      {
+        services.openssh = {
+          enable = true;
+          settings = {
+            PasswordAuthentication = false;
+            KbdInteractiveAuthentication = false;
           };
         };
 
-      server =
-        { ... }:
-        {
-          services.openssh = {
-            enable = true;
-            settings = {
-              PasswordAuthentication = false;
-              KbdInteractiveAuthentication = false;
-            };
-          };
-
-          services.borgbackup.repos.repo1 = {
-            authorizedKeys = [ publicKey ];
-            path = "/data/borgbackup";
-          };
-
-          # Second repo to make sure the authorizedKeys options are merged correctly
-          services.borgbackup.repos.repo2 = {
-            authorizedKeysAppendOnly = [ publicKeyAppendOnly ];
-            path = "/data/borgbackup";
-            quota = ".5G";
-          };
+        services.borgbackup.repos.repo1 = {
+          authorizedKeys = [ publicKey ];
+          path = "/data/borgbackup";
         };
-    };
 
-    testScript = ''
-      start_all()
+        # Second repo to make sure the authorizedKeys options are merged correctly
+        services.borgbackup.repos.repo2 = {
+          authorizedKeysAppendOnly = [ publicKeyAppendOnly ];
+          path = "/data/borgbackup";
+          quota = ".5G";
+        };
+      };
+  };
 
-      client.fail('test -d "${remoteRepo}"')
+  testScript = ''
+    start_all()
 
-      client.succeed(
-          "cp ${privateKey} /root/id_ed25519"
-      )
-      client.succeed("chmod 0600 /root/id_ed25519")
-      client.succeed(
-          "cp ${privateKeyAppendOnly} /root/id_ed25519.appendOnly"
-      )
-      client.succeed("chmod 0600 /root/id_ed25519.appendOnly")
+    client.fail('test -d "${remoteRepo}"')
 
-      client.succeed("mkdir -p ${dataDir}/${subDir}")
-      client.succeed("touch ${dataDir}/${excludeFile}")
-      client.succeed("touch '${dataDir}/${subDir}/.dont backup'")
-      client.succeed("touch ${dataDir}/${subDir}/${excludedSubDirFile}")
-      client.succeed("echo '${keepFileData}' > ${dataDir}/${keepFile}")
+    client.succeed(
+        "cp ${privateKey} /root/id_ed25519"
+    )
+    client.succeed("chmod 0600 /root/id_ed25519")
+    client.succeed(
+        "cp ${privateKeyAppendOnly} /root/id_ed25519.appendOnly"
+    )
+    client.succeed("chmod 0600 /root/id_ed25519.appendOnly")
 
-      with subtest("local"):
-          borg = "BORG_PASSPHRASE='${passphrase}' borg"
-          client.systemctl("start --wait borgbackup-job-local")
-          client.fail("systemctl is-failed borgbackup-job-local")
-          # Make sure exactly one archive has been created
-          assert int(client.succeed("{} list '${localRepo}' | wc -l".format(borg))) > 0
-          # Make sure excludeFile has been excluded
-          client.fail(
-              "{} list '${localRepo}::${archiveName}' | grep -qF '${excludeFile}'".format(borg)
-          )
-          # Make sure excludedSubDirFile has been excluded
-          client.fail(
-              "{} list '${localRepo}::${archiveName}' | grep -qF '${subDir}/${excludedSubDirFile}".format(borg)
-          )
-          # Make sure keepFile has the correct content
-          client.succeed("{} extract '${localRepo}::${archiveName}'".format(borg))
-          assert "${keepFileData}" in client.succeed("cat ${dataDir}/${keepFile}")
-          # Make sure the same is true when using `borg mount`
-          client.succeed(
-              "mkdir -p /mnt/borg && {} mount '${localRepo}::${archiveName}' /mnt/borg".format(
-                  borg
-              )
-          )
-          assert "${keepFileData}" in client.succeed(
-              "cat /mnt/borg/${dataDir}/${keepFile}"
-          )
+    client.succeed("mkdir -p ${dataDir}/${subDir}")
+    client.succeed("touch ${dataDir}/${excludeFile}")
+    client.succeed("touch '${dataDir}/${subDir}/.dont backup'")
+    client.succeed("touch ${dataDir}/${subDir}/${excludedSubDirFile}")
+    client.succeed("echo '${keepFileData}' > ${dataDir}/${keepFile}")
 
-      with subtest("localMount"):
-          # the file system for the repo should not be already mounted
-          client.fail("mount | grep ${localRepoMount}")
-          # ensure trying to write to the mountpoint before the fs is mounted fails
-          client.succeed("chattr +i ${localRepoMount}")
-          borg = "borg"
-          client.systemctl("start --wait borgbackup-job-localMount")
-          client.fail("systemctl is-failed borgbackup-job-localMount")
-          # Make sure exactly one archive has been created
-          assert int(client.succeed("{} list '${localRepoMount}' | wc -l".format(borg))) > 0
+    with subtest("local"):
+        borg = "BORG_PASSPHRASE='${passphrase}' borg"
+        client.systemctl("start --wait borgbackup-job-local")
+        client.fail("systemctl is-failed borgbackup-job-local")
+        # Make sure exactly one archive has been created
+        assert int(client.succeed("{} list '${localRepo}' | wc -l".format(borg))) > 0
+        # Make sure excludeFile has been excluded
+        client.fail(
+            "{} list '${localRepo}::${archiveName}' | grep -qF '${excludeFile}'".format(borg)
+        )
+        # Make sure excludedSubDirFile has been excluded
+        client.fail(
+            "{} list '${localRepo}::${archiveName}' | grep -qF '${subDir}/${excludedSubDirFile}".format(borg)
+        )
+        # Make sure keepFile has the correct content
+        client.succeed("{} extract '${localRepo}::${archiveName}'".format(borg))
+        assert "${keepFileData}" in client.succeed("cat ${dataDir}/${keepFile}")
+        # Make sure the same is true when using `borg mount`
+        client.succeed(
+            "mkdir -p /mnt/borg && {} mount '${localRepo}::${archiveName}' /mnt/borg".format(
+                borg
+            )
+        )
+        assert "${keepFileData}" in client.succeed(
+            "cat /mnt/borg/${dataDir}/${keepFile}"
+        )
 
-      with subtest("remote"):
-          borg = "BORG_RSH='ssh -oStrictHostKeyChecking=no -i /root/id_ed25519' borg"
-          server.wait_for_unit("sshd.service")
-          client.wait_for_unit("network.target")
-          client.systemctl("start --wait borgbackup-job-remote")
-          client.fail("systemctl is-failed borgbackup-job-remote")
+    with subtest("localMount"):
+        # the file system for the repo should not be already mounted
+        client.fail("mount | grep ${localRepoMount}")
+        # ensure trying to write to the mountpoint before the fs is mounted fails
+        client.succeed("chattr +i ${localRepoMount}")
+        borg = "borg"
+        client.systemctl("start --wait borgbackup-job-localMount")
+        client.fail("systemctl is-failed borgbackup-job-localMount")
+        # Make sure exactly one archive has been created
+        assert int(client.succeed("{} list '${localRepoMount}' | wc -l".format(borg))) > 0
 
-          # Make sure we can't access repos other than the specified one
-          client.fail("{} list borg\@server:wrong".format(borg))
+    with subtest("remote"):
+        borg = "BORG_RSH='ssh -oStrictHostKeyChecking=no -i /root/id_ed25519' borg"
+        server.wait_for_unit("sshd.service")
+        client.wait_for_unit("network.target")
+        client.systemctl("start --wait borgbackup-job-remote")
+        client.fail("systemctl is-failed borgbackup-job-remote")
 
-          # TODO: Make sure that data is actually deleted
+        # Make sure we can't access repos other than the specified one
+        client.fail("{} list borg\@server:wrong".format(borg))
 
-      with subtest("remoteAppendOnly"):
-          borg = (
-              "BORG_RSH='ssh -oStrictHostKeyChecking=no -i /root/id_ed25519.appendOnly' borg"
-          )
-          server.wait_for_unit("sshd.service")
-          client.wait_for_unit("network.target")
-          client.systemctl("start --wait borgbackup-job-remoteAppendOnly")
-          client.fail("systemctl is-failed borgbackup-job-remoteAppendOnly")
+        # TODO: Make sure that data is actually deleted
 
-          # Make sure we can't access repos other than the specified one
-          client.fail("{} list borg\@server:wrong".format(borg))
+    with subtest("remoteAppendOnly"):
+        borg = (
+            "BORG_RSH='ssh -oStrictHostKeyChecking=no -i /root/id_ed25519.appendOnly' borg"
+        )
+        server.wait_for_unit("sshd.service")
+        client.wait_for_unit("network.target")
+        client.systemctl("start --wait borgbackup-job-remoteAppendOnly")
+        client.fail("systemctl is-failed borgbackup-job-remoteAppendOnly")
 
-          # TODO: Make sure that data is not actually deleted
+        # Make sure we can't access repos other than the specified one
+        client.fail("{} list borg\@server:wrong".format(borg))
 
-      with subtest("commandSuccess"):
-          server.wait_for_unit("sshd.service")
-          client.wait_for_unit("network.target")
-          client.systemctl("start --wait borgbackup-job-commandSuccess")
-          client.fail("systemctl is-failed borgbackup-job-commandSuccess")
-          id = client.succeed("borg-job-commandSuccess list | tail -n1 | cut -d' ' -f1").strip()
-          client.succeed(f"borg-job-commandSuccess extract ::{id} stdin")
-          assert "test" == client.succeed("cat stdin")
+        # TODO: Make sure that data is not actually deleted
 
-      with subtest("commandFail"):
-          server.wait_for_unit("sshd.service")
-          client.wait_for_unit("network.target")
-          client.systemctl("start --wait borgbackup-job-commandFail")
-          client.succeed("systemctl is-failed borgbackup-job-commandFail")
+    with subtest("commandSuccess"):
+        server.wait_for_unit("sshd.service")
+        client.wait_for_unit("network.target")
+        client.systemctl("start --wait borgbackup-job-commandSuccess")
+        client.fail("systemctl is-failed borgbackup-job-commandSuccess")
+        id = client.succeed("borg-job-commandSuccess list | tail -n1 | cut -d' ' -f1").strip()
+        client.succeed(f"borg-job-commandSuccess extract ::{id} stdin")
+        assert "test" == client.succeed("cat stdin")
 
-      with subtest("sleepInhibited"):
-          server.wait_for_unit("sshd.service")
-          client.wait_for_unit("network.target")
-          client.fail("systemd-inhibit --list | grep -q borgbackup")
-          client.systemctl("start borgbackup-job-sleepInhibited")
-          client.wait_until_succeeds("systemd-inhibit --list | grep -q borgbackup")
-          client.systemctl("stop borgbackup-job-sleepInhibited")
-    '';
-  }
-)
+    with subtest("commandFail"):
+        server.wait_for_unit("sshd.service")
+        client.wait_for_unit("network.target")
+        client.systemctl("start --wait borgbackup-job-commandFail")
+        client.succeed("systemctl is-failed borgbackup-job-commandFail")
+
+    with subtest("sleepInhibited"):
+        server.wait_for_unit("sshd.service")
+        client.wait_for_unit("network.target")
+        client.fail("systemd-inhibit --list | grep -q borgbackup")
+        client.systemctl("start borgbackup-job-sleepInhibited")
+        client.wait_until_succeeds("systemd-inhibit --list | grep -q borgbackup")
+        client.systemctl("stop borgbackup-job-sleepInhibited")
+  '';
+}
diff --git a/nixos/tests/borgmatic.nix b/nixos/tests/borgmatic.nix
index be2542ed64ca..e89e2b05e4ef 100644
--- a/nixos/tests/borgmatic.nix
+++ b/nixos/tests/borgmatic.nix
@@ -1,28 +1,26 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "borgmatic";
-    nodes.machine =
-      { ... }:
-      {
-        services.borgmatic = {
-          enable = true;
-          settings = {
-            source_directories = [ "/home" ];
-            repositories = [
-              {
-                label = "local";
-                path = "/var/backup";
-              }
-            ];
-            keep_daily = 7;
-          };
+{ pkgs, ... }:
+{
+  name = "borgmatic";
+  nodes.machine =
+    { ... }:
+    {
+      services.borgmatic = {
+        enable = true;
+        settings = {
+          source_directories = [ "/home" ];
+          repositories = [
+            {
+              label = "local";
+              path = "/var/backup";
+            }
+          ];
+          keep_daily = 7;
         };
       };
+    };
 
-    testScript = ''
-      machine.succeed("borgmatic rcreate -e none")
-      machine.succeed("borgmatic")
-    '';
-  }
-)
+  testScript = ''
+    machine.succeed("borgmatic rcreate -e none")
+    machine.succeed("borgmatic")
+  '';
+}
diff --git a/nixos/tests/bpftune.nix b/nixos/tests/bpftune.nix
index 454e27272d5b..f94e3a98e5cf 100644
--- a/nixos/tests/bpftune.nix
+++ b/nixos/tests/bpftune.nix
@@ -1,25 +1,23 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
+{ lib, pkgs, ... }:
+{
 
-    name = "bpftune";
+  name = "bpftune";
 
-    meta = {
-      maintainers = with lib.maintainers; [ nickcao ];
-    };
+  meta = {
+    maintainers = with lib.maintainers; [ nickcao ];
+  };
 
-    nodes = {
-      machine =
-        { pkgs, ... }:
-        {
-          services.bpftune.enable = true;
-        };
-    };
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.bpftune.enable = true;
+      };
+  };
 
-    testScript = ''
-      machine.wait_for_unit("bpftune.service")
-      machine.wait_for_console_text("bpftune works")
-    '';
+  testScript = ''
+    machine.wait_for_unit("bpftune.service")
+    machine.wait_for_console_text("bpftune works")
+  '';
 
-  }
-)
+}
diff --git a/nixos/tests/breitbandmessung.nix b/nixos/tests/breitbandmessung.nix
index 414fd09cfa54..3b5ba5584af6 100644
--- a/nixos/tests/breitbandmessung.nix
+++ b/nixos/tests/breitbandmessung.nix
@@ -1,41 +1,41 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "breitbandmessung";
-    meta.maintainers = with lib.maintainers; [ b4dm4n ];
+{ lib, ... }:
+{
+  name = "breitbandmessung";
+  meta.maintainers = with lib.maintainers; [ b4dm4n ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [
-          ./common/user-account.nix
-          ./common/x11.nix
-        ];
+  node.pkgsReadOnly = false;
 
-        # increase screen size to make the whole program visible
-        virtualisation.resolution = {
-          x = 1280;
-          y = 1024;
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [
+        ./common/user-account.nix
+        ./common/x11.nix
+      ];
 
-        test-support.displayManager.auto.user = "alice";
-
-        environment.systemPackages = with pkgs; [ breitbandmessung ];
-        environment.variables.XAUTHORITY = "/home/alice/.Xauthority";
-
-        # breitbandmessung is unfree
-        nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "breitbandmessung" ];
+      # increase screen size to make the whole program visible
+      virtualisation.resolution = {
+        x = 1280;
+        y = 1024;
       };
 
-    enableOCR = true;
+      test-support.displayManager.auto.user = "alice";
 
-    testScript = ''
-      machine.wait_for_x()
-      machine.execute("su - alice -c breitbandmessung >&2  &")
-      machine.wait_for_window("Breitbandmessung")
-      machine.wait_for_text("Breitbandmessung")
-      machine.wait_for_text("Datenschutz")
-      machine.screenshot("breitbandmessung")
-    '';
-  }
-)
+      environment.systemPackages = with pkgs; [ breitbandmessung ];
+      environment.variables.XAUTHORITY = "/home/alice/.Xauthority";
+
+      # breitbandmessung is unfree
+      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "breitbandmessung" ];
+    };
+
+  enableOCR = true;
+
+  testScript = ''
+    machine.wait_for_x()
+    machine.execute("su - alice -c breitbandmessung >&2  &")
+    machine.wait_for_window("Breitbandmessung")
+    machine.wait_for_text("Breitbandmessung")
+    machine.wait_for_text("Datenschutz")
+    machine.screenshot("breitbandmessung")
+  '';
+}
diff --git a/nixos/tests/brscan5.nix b/nixos/tests/brscan5.nix
index f61228bac41e..9155846c14a8 100644
--- a/nixos/tests/brscan5.nix
+++ b/nixos/tests/brscan5.nix
@@ -1,53 +1,47 @@
 # integration tests for brscan5 sane driver
-#
+{ lib, ... }:
+{
+  name = "brscan5";
+  meta.maintainers = with lib.maintainers; [ mattchrist ];
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "brscan5";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ mattchrist ];
-    };
+  node.pkgsReadOnly = false;
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        nixpkgs.config.allowUnfree = true;
-        hardware.sane = {
-          enable = true;
-          brscan5 = {
-            enable = true;
-            netDevices = {
-              "a" = {
-                model = "ADS-1200";
-                nodename = "BRW0080927AFBCE";
-              };
-              "b" = {
-                model = "ADS-1200";
-                ip = "192.168.1.2";
-              };
-            };
+  nodes.machine = {
+    nixpkgs.config.allowUnfree = true;
+    hardware.sane = {
+      enable = true;
+      brscan5 = {
+        enable = true;
+        netDevices = {
+          "a" = {
+            model = "ADS-1200";
+            nodename = "BRW0080927AFBCE";
+          };
+          "b" = {
+            model = "ADS-1200";
+            ip = "192.168.1.2";
           };
         };
       };
+    };
+  };
 
-    testScript = ''
-      import re
-      # sane loads libsane-brother5.so.1 successfully, and scanimage doesn't die
-      strace = machine.succeed('strace scanimage -L 2>&1').split("\n")
-      regexp = 'openat\(.*libsane-brother5.so.1", O_RDONLY|O_CLOEXEC\) = \d\d*$'
-      assert len([x for x in strace if re.match(regexp,x)]) > 0
+  testScript = ''
+    import re
+    # sane loads libsane-brother5.so.1 successfully, and scanimage doesn't die
+    strace = machine.succeed('strace scanimage -L 2>&1').split("\n")
+    regexp = 'openat\(.*libsane-brother5.so.1", O_RDONLY|O_CLOEXEC\) = \d\d*$'
+    assert len([x for x in strace if re.match(regexp,x)]) > 0
 
-      # module creates a config
-      cfg = machine.succeed('cat /etc/opt/brother/scanner/brscan5/brsanenetdevice.cfg')
-      assert 'DEVICE=a , "ADS-1200" , 0x4f9:0x459 , NODENAME=BRW0080927AFBCE' in cfg
-      assert 'DEVICE=b , "ADS-1200" , 0x4f9:0x459 , IP-ADDRESS=192.168.1.2' in cfg
+    # module creates a config
+    cfg = machine.succeed('cat /etc/opt/brother/scanner/brscan5/brsanenetdevice.cfg')
+    assert 'DEVICE=a , "ADS-1200" , 0x4f9:0x459 , NODENAME=BRW0080927AFBCE' in cfg
+    assert 'DEVICE=b , "ADS-1200" , 0x4f9:0x459 , IP-ADDRESS=192.168.1.2' in cfg
 
-      # scanimage lists the two network scanners
-      scanimage = machine.succeed("scanimage -L")
-      print(scanimage)
-      assert """device `brother5:net1;dev0' is a Brother b ADS-1200""" in scanimage
-      assert """device `brother5:net1;dev1' is a Brother a ADS-1200""" in scanimage
-    '';
-  }
-)
+    # scanimage lists the two network scanners
+    scanimage = machine.succeed("scanimage -L")
+    print(scanimage)
+    assert """device `brother5:net1;dev0' is a Brother b ADS-1200""" in scanimage
+    assert """device `brother5:net1;dev1' is a Brother a ADS-1200""" in scanimage
+  '';
+}
diff --git a/nixos/tests/btrbk-doas.nix b/nixos/tests/btrbk-doas.nix
index aa146ff351bd..326998b16b49 100644
--- a/nixos/tests/btrbk-doas.nix
+++ b/nixos/tests/btrbk-doas.nix
@@ -1,128 +1,126 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    privateKey = ''
-      -----BEGIN OPENSSH PRIVATE KEY-----
-      b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-      QyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrwAAAJB+cF5HfnBe
-      RwAAAAtzc2gtZWQyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrw
-      AAAEBN75NsJZSpt63faCuaD75Unko0JjlSDxMhYHAPJk2/xXHxQHThDpD9/AMWNqQer3Tg
-      9gXMb2lTZMn0pelo8xyvAAAADXJzY2h1ZXR6QGt1cnQ=
-      -----END OPENSSH PRIVATE KEY-----
-    '';
-    publicKey = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHHxQHThDpD9/AMWNqQer3Tg9gXMb2lTZMn0pelo8xyv
-    '';
-  in
-  {
-    name = "btrbk-doas";
-    meta = with pkgs.lib; {
-      maintainers = with maintainers; [
-        symphorien
-        tu-maurice
-      ];
-    };
+let
+  privateKey = ''
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+    QyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrwAAAJB+cF5HfnBe
+    RwAAAAtzc2gtZWQyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrw
+    AAAEBN75NsJZSpt63faCuaD75Unko0JjlSDxMhYHAPJk2/xXHxQHThDpD9/AMWNqQer3Tg
+    9gXMb2lTZMn0pelo8xyvAAAADXJzY2h1ZXR6QGt1cnQ=
+    -----END OPENSSH PRIVATE KEY-----
+  '';
+  publicKey = ''
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHHxQHThDpD9/AMWNqQer3Tg9gXMb2lTZMn0pelo8xyv
+  '';
+in
+{
+  name = "btrbk-doas";
+  meta = with pkgs.lib; {
+    maintainers = with maintainers; [
+      symphorien
+      tu-maurice
+    ];
+  };
 
-    nodes = {
-      archive =
-        { ... }:
-        {
-          security.sudo.enable = false;
-          security.doas.enable = true;
-          environment.systemPackages = with pkgs; [ btrfs-progs ];
-          # note: this makes the privateKey world readable.
-          # don't do it with real ssh keys.
-          environment.etc."btrbk_key".text = privateKey;
-          services.btrbk = {
-            extraPackages = [ pkgs.lz4 ];
-            instances = {
-              remote = {
-                onCalendar = "minutely";
-                settings = {
-                  ssh_identity = "/etc/btrbk_key";
-                  ssh_user = "btrbk";
-                  stream_compress = "lz4";
-                  volume = {
-                    "ssh://main/mnt" = {
-                      target = "/mnt";
-                      snapshot_dir = "btrbk/remote";
-                      subvolume = "to_backup";
-                    };
+  nodes = {
+    archive =
+      { ... }:
+      {
+        security.sudo.enable = false;
+        security.doas.enable = true;
+        environment.systemPackages = with pkgs; [ btrfs-progs ];
+        # note: this makes the privateKey world readable.
+        # don't do it with real ssh keys.
+        environment.etc."btrbk_key".text = privateKey;
+        services.btrbk = {
+          extraPackages = [ pkgs.lz4 ];
+          instances = {
+            remote = {
+              onCalendar = "minutely";
+              settings = {
+                ssh_identity = "/etc/btrbk_key";
+                ssh_user = "btrbk";
+                stream_compress = "lz4";
+                volume = {
+                  "ssh://main/mnt" = {
+                    target = "/mnt";
+                    snapshot_dir = "btrbk/remote";
+                    subvolume = "to_backup";
                   };
                 };
               };
             };
           };
         };
+      };
 
-      main =
-        { ... }:
-        {
-          security.sudo.enable = false;
-          security.doas.enable = true;
-          environment.systemPackages = with pkgs; [ btrfs-progs ];
-          services.openssh = {
-            enable = true;
-            passwordAuthentication = false;
-            kbdInteractiveAuthentication = false;
-          };
-          services.btrbk = {
-            extraPackages = [ pkgs.lz4 ];
-            sshAccess = [
-              {
-                key = publicKey;
-                roles = [
-                  "source"
-                  "send"
-                  "info"
-                  "delete"
-                ];
-              }
-            ];
-            instances = {
-              local = {
-                onCalendar = "minutely";
-                settings = {
-                  volume = {
-                    "/mnt" = {
-                      snapshot_dir = "btrbk/local";
-                      subvolume = "to_backup";
-                    };
+    main =
+      { ... }:
+      {
+        security.sudo.enable = false;
+        security.doas.enable = true;
+        environment.systemPackages = with pkgs; [ btrfs-progs ];
+        services.openssh = {
+          enable = true;
+          passwordAuthentication = false;
+          kbdInteractiveAuthentication = false;
+        };
+        services.btrbk = {
+          extraPackages = [ pkgs.lz4 ];
+          sshAccess = [
+            {
+              key = publicKey;
+              roles = [
+                "source"
+                "send"
+                "info"
+                "delete"
+              ];
+            }
+          ];
+          instances = {
+            local = {
+              onCalendar = "minutely";
+              settings = {
+                volume = {
+                  "/mnt" = {
+                    snapshot_dir = "btrbk/local";
+                    subvolume = "to_backup";
                   };
                 };
               };
             };
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      # create btrfs partition at /mnt
-      for machine in (archive, main):
-        machine.succeed("dd if=/dev/zero of=/data_fs bs=120M count=1")
-        machine.succeed("mkfs.btrfs /data_fs")
-        machine.succeed("mkdir /mnt")
-        machine.succeed("mount /data_fs /mnt")
+    # create btrfs partition at /mnt
+    for machine in (archive, main):
+      machine.succeed("dd if=/dev/zero of=/data_fs bs=120M count=1")
+      machine.succeed("mkfs.btrfs /data_fs")
+      machine.succeed("mkdir /mnt")
+      machine.succeed("mount /data_fs /mnt")
 
-      # what to backup and where
-      main.succeed("btrfs subvolume create /mnt/to_backup")
-      main.succeed("mkdir -p /mnt/btrbk/{local,remote}")
+    # what to backup and where
+    main.succeed("btrfs subvolume create /mnt/to_backup")
+    main.succeed("mkdir -p /mnt/btrbk/{local,remote}")
 
-      # check that local snapshots work
-      with subtest("local"):
-          main.succeed("echo foo > /mnt/to_backup/bar")
-          main.wait_until_succeeds("cat /mnt/btrbk/local/*/bar | grep foo")
-          main.succeed("echo bar > /mnt/to_backup/bar")
-          main.succeed("cat /mnt/btrbk/local/*/bar | grep foo")
+    # check that local snapshots work
+    with subtest("local"):
+        main.succeed("echo foo > /mnt/to_backup/bar")
+        main.wait_until_succeeds("cat /mnt/btrbk/local/*/bar | grep foo")
+        main.succeed("echo bar > /mnt/to_backup/bar")
+        main.succeed("cat /mnt/btrbk/local/*/bar | grep foo")
 
-      # check that btrfs send/receive works and ssh access works
-      with subtest("remote"):
-          archive.wait_until_succeeds("cat /mnt/*/bar | grep bar")
-          main.succeed("echo baz > /mnt/to_backup/bar")
-          archive.succeed("cat /mnt/*/bar | grep bar")
-    '';
-  }
-)
+    # check that btrfs send/receive works and ssh access works
+    with subtest("remote"):
+        archive.wait_until_succeeds("cat /mnt/*/bar | grep bar")
+        main.succeed("echo baz > /mnt/to_backup/bar")
+        archive.succeed("cat /mnt/*/bar | grep bar")
+  '';
+}
diff --git a/nixos/tests/btrbk-no-timer.nix b/nixos/tests/btrbk-no-timer.nix
index c5bcb6edab68..c73dc1907aaa 100644
--- a/nixos/tests/btrbk-no-timer.nix
+++ b/nixos/tests/btrbk-no-timer.nix
@@ -1,41 +1,39 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "btrbk-no-timer";
-    meta.maintainers = with lib.maintainers; [ oxalica ];
+{ lib, pkgs, ... }:
+{
+  name = "btrbk-no-timer";
+  meta.maintainers = with lib.maintainers; [ oxalica ];
 
-    nodes.machine =
-      { ... }:
-      {
-        environment.systemPackages = with pkgs; [ btrfs-progs ];
-        services.btrbk.instances.local = {
-          onCalendar = null;
-          settings.volume."/mnt" = {
-            snapshot_dir = "btrbk/local";
-            subvolume = "to_backup";
-          };
+  nodes.machine =
+    { ... }:
+    {
+      environment.systemPackages = with pkgs; [ btrfs-progs ];
+      services.btrbk.instances.local = {
+        onCalendar = null;
+        settings.volume."/mnt" = {
+          snapshot_dir = "btrbk/local";
+          subvolume = "to_backup";
         };
       };
+    };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      # Create btrfs partition at /mnt
-      machine.succeed("truncate --size=128M /data_fs")
-      machine.succeed("mkfs.btrfs /data_fs")
-      machine.succeed("mkdir /mnt")
-      machine.succeed("mount /data_fs /mnt")
-      machine.succeed("btrfs subvolume create /mnt/to_backup")
-      machine.succeed("mkdir -p /mnt/btrbk/local")
+    # Create btrfs partition at /mnt
+    machine.succeed("truncate --size=128M /data_fs")
+    machine.succeed("mkfs.btrfs /data_fs")
+    machine.succeed("mkdir /mnt")
+    machine.succeed("mount /data_fs /mnt")
+    machine.succeed("btrfs subvolume create /mnt/to_backup")
+    machine.succeed("mkdir -p /mnt/btrbk/local")
 
-      # The service should not have any triggering timer.
-      unit = machine.get_unit_info('btrbk-local.service')
-      assert "TriggeredBy" not in unit
+    # The service should not have any triggering timer.
+    unit = machine.get_unit_info('btrbk-local.service')
+    assert "TriggeredBy" not in unit
 
-      # Manually starting the service should still work.
-      machine.succeed("echo foo > /mnt/to_backup/bar")
-      machine.start_job("btrbk-local.service")
-      machine.wait_until_succeeds("cat /mnt/btrbk/local/*/bar | grep foo")
-    '';
-  }
-)
+    # Manually starting the service should still work.
+    machine.succeed("echo foo > /mnt/to_backup/bar")
+    machine.start_job("btrbk-local.service")
+    machine.wait_until_succeeds("cat /mnt/btrbk/local/*/bar | grep foo")
+  '';
+}
diff --git a/nixos/tests/btrbk-section-order.nix b/nixos/tests/btrbk-section-order.nix
index 03762b3fee6b..226025464835 100644
--- a/nixos/tests/btrbk-section-order.nix
+++ b/nixos/tests/btrbk-section-order.nix
@@ -6,56 +6,54 @@
 # order-sensitive config format.
 #
 # Issue: https://github.com/NixOS/nixpkgs/issues/195660
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "btrbk-section-order";
-    meta.maintainers = with lib.maintainers; [ oxalica ];
+{ lib, pkgs, ... }:
+{
+  name = "btrbk-section-order";
+  meta.maintainers = with lib.maintainers; [ oxalica ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.btrbk.instances.local = {
-          onCalendar = null;
-          settings = {
-            timestamp_format = "long";
-            target."ssh://global-target/".ssh_user = "root";
-            volume."/btrfs" = {
-              snapshot_dir = "/volume-snapshots";
-              target."ssh://volume-target/".ssh_user = "root";
-              subvolume."@subvolume" = {
-                snapshot_dir = "/subvolume-snapshots";
-                target."ssh://subvolume-target/".ssh_user = "root";
-              };
+  nodes.machine =
+    { ... }:
+    {
+      services.btrbk.instances.local = {
+        onCalendar = null;
+        settings = {
+          timestamp_format = "long";
+          target."ssh://global-target/".ssh_user = "root";
+          volume."/btrfs" = {
+            snapshot_dir = "/volume-snapshots";
+            target."ssh://volume-target/".ssh_user = "root";
+            subvolume."@subvolume" = {
+              snapshot_dir = "/subvolume-snapshots";
+              target."ssh://subvolume-target/".ssh_user = "root";
             };
           };
         };
       };
+    };
 
-    testScript = ''
-      import difflib
-      machine.wait_for_unit("basic.target")
-      got = machine.succeed("cat /etc/btrbk/local.conf").strip()
-      expect = """
-      backend btrfs-progs-sudo
-      stream_compress no
-      timestamp_format long
-      target ssh://global-target/
+  testScript = ''
+    import difflib
+    machine.wait_for_unit("basic.target")
+    got = machine.succeed("cat /etc/btrbk/local.conf").strip()
+    expect = """
+    backend btrfs-progs-sudo
+    stream_compress no
+    timestamp_format long
+    target ssh://global-target/
+     ssh_user root
+    volume /btrfs
+     snapshot_dir /volume-snapshots
+     target ssh://volume-target/
+      ssh_user root
+     subvolume @subvolume
+      snapshot_dir /subvolume-snapshots
+      target ssh://subvolume-target/
        ssh_user root
-      volume /btrfs
-       snapshot_dir /volume-snapshots
-       target ssh://volume-target/
-        ssh_user root
-       subvolume @subvolume
-        snapshot_dir /subvolume-snapshots
-        target ssh://subvolume-target/
-         ssh_user root
-      """.strip()
-      print(got)
-      if got != expect:
-        diff = difflib.unified_diff(expect.splitlines(keepends=True), got.splitlines(keepends=True), fromfile="expected", tofile="got")
-        print("".join(diff))
-      assert got == expect
-    '';
-  }
-)
+    """.strip()
+    print(got)
+    if got != expect:
+      diff = difflib.unified_diff(expect.splitlines(keepends=True), got.splitlines(keepends=True), fromfile="expected", tofile="got")
+      print("".join(diff))
+    assert got == expect
+  '';
+}
diff --git a/nixos/tests/btrbk.nix b/nixos/tests/btrbk.nix
index e6b3e1166ff3..10ca8c3ca95e 100644
--- a/nixos/tests/btrbk.nix
+++ b/nixos/tests/btrbk.nix
@@ -1,122 +1,120 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    privateKey = ''
-      -----BEGIN OPENSSH PRIVATE KEY-----
-      b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-      QyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrwAAAJB+cF5HfnBe
-      RwAAAAtzc2gtZWQyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrw
-      AAAEBN75NsJZSpt63faCuaD75Unko0JjlSDxMhYHAPJk2/xXHxQHThDpD9/AMWNqQer3Tg
-      9gXMb2lTZMn0pelo8xyvAAAADXJzY2h1ZXR6QGt1cnQ=
-      -----END OPENSSH PRIVATE KEY-----
-    '';
-    publicKey = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHHxQHThDpD9/AMWNqQer3Tg9gXMb2lTZMn0pelo8xyv
-    '';
-  in
-  {
-    name = "btrbk";
-    meta = with pkgs.lib; {
-      maintainers = with maintainers; [ symphorien ];
-    };
+let
+  privateKey = ''
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+    QyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrwAAAJB+cF5HfnBe
+    RwAAAAtzc2gtZWQyNTUxOQAAACBx8UB04Q6Q/fwDFjakHq904PYFzG9pU2TJ9KXpaPMcrw
+    AAAEBN75NsJZSpt63faCuaD75Unko0JjlSDxMhYHAPJk2/xXHxQHThDpD9/AMWNqQer3Tg
+    9gXMb2lTZMn0pelo8xyvAAAADXJzY2h1ZXR6QGt1cnQ=
+    -----END OPENSSH PRIVATE KEY-----
+  '';
+  publicKey = ''
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHHxQHThDpD9/AMWNqQer3Tg9gXMb2lTZMn0pelo8xyv
+  '';
+in
+{
+  name = "btrbk";
+  meta = with pkgs.lib; {
+    maintainers = with maintainers; [ symphorien ];
+  };
 
-    nodes = {
-      archive =
-        { ... }:
-        {
-          environment.systemPackages = with pkgs; [ btrfs-progs ];
-          # note: this makes the privateKey world readable.
-          # don't do it with real ssh keys.
-          environment.etc."btrbk_key".text = privateKey;
-          services.btrbk = {
-            instances = {
-              remote = {
-                onCalendar = "minutely";
-                settings = {
-                  ssh_identity = "/etc/btrbk_key";
-                  ssh_user = "btrbk";
-                  stream_compress = "lz4";
-                  volume = {
-                    "ssh://main/mnt" = {
-                      target = "/mnt";
-                      snapshot_dir = "btrbk/remote";
-                      subvolume = "to_backup";
-                    };
+  nodes = {
+    archive =
+      { ... }:
+      {
+        environment.systemPackages = with pkgs; [ btrfs-progs ];
+        # note: this makes the privateKey world readable.
+        # don't do it with real ssh keys.
+        environment.etc."btrbk_key".text = privateKey;
+        services.btrbk = {
+          instances = {
+            remote = {
+              onCalendar = "minutely";
+              settings = {
+                ssh_identity = "/etc/btrbk_key";
+                ssh_user = "btrbk";
+                stream_compress = "lz4";
+                volume = {
+                  "ssh://main/mnt" = {
+                    target = "/mnt";
+                    snapshot_dir = "btrbk/remote";
+                    subvolume = "to_backup";
                   };
                 };
               };
             };
           };
         };
+      };
 
-      main =
-        { ... }:
-        {
-          environment.systemPackages = with pkgs; [ btrfs-progs ];
-          services.openssh = {
-            enable = true;
-            settings = {
-              KbdInteractiveAuthentication = false;
-              PasswordAuthentication = false;
-            };
+    main =
+      { ... }:
+      {
+        environment.systemPackages = with pkgs; [ btrfs-progs ];
+        services.openssh = {
+          enable = true;
+          settings = {
+            KbdInteractiveAuthentication = false;
+            PasswordAuthentication = false;
           };
-          services.btrbk = {
-            extraPackages = [ pkgs.lz4 ];
-            sshAccess = [
-              {
-                key = publicKey;
-                roles = [
-                  "source"
-                  "send"
-                  "info"
-                  "delete"
-                ];
-              }
-            ];
-            instances = {
-              local = {
-                onCalendar = "minutely";
-                settings = {
-                  volume = {
-                    "/mnt" = {
-                      snapshot_dir = "btrbk/local";
-                      subvolume = "to_backup";
-                    };
+        };
+        services.btrbk = {
+          extraPackages = [ pkgs.lz4 ];
+          sshAccess = [
+            {
+              key = publicKey;
+              roles = [
+                "source"
+                "send"
+                "info"
+                "delete"
+              ];
+            }
+          ];
+          instances = {
+            local = {
+              onCalendar = "minutely";
+              settings = {
+                volume = {
+                  "/mnt" = {
+                    snapshot_dir = "btrbk/local";
+                    subvolume = "to_backup";
                   };
                 };
               };
             };
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      # create btrfs partition at /mnt
-      for machine in (archive, main):
-        machine.succeed("dd if=/dev/zero of=/data_fs bs=120M count=1")
-        machine.succeed("mkfs.btrfs /data_fs")
-        machine.succeed("mkdir /mnt")
-        machine.succeed("mount /data_fs /mnt")
+    # create btrfs partition at /mnt
+    for machine in (archive, main):
+      machine.succeed("dd if=/dev/zero of=/data_fs bs=120M count=1")
+      machine.succeed("mkfs.btrfs /data_fs")
+      machine.succeed("mkdir /mnt")
+      machine.succeed("mount /data_fs /mnt")
 
-      # what to backup and where
-      main.succeed("btrfs subvolume create /mnt/to_backup")
-      main.succeed("mkdir -p /mnt/btrbk/{local,remote}")
+    # what to backup and where
+    main.succeed("btrfs subvolume create /mnt/to_backup")
+    main.succeed("mkdir -p /mnt/btrbk/{local,remote}")
 
-      # check that local snapshots work
-      with subtest("local"):
-          main.succeed("echo foo > /mnt/to_backup/bar")
-          main.wait_until_succeeds("cat /mnt/btrbk/local/*/bar | grep foo")
-          main.succeed("echo bar > /mnt/to_backup/bar")
-          main.succeed("cat /mnt/btrbk/local/*/bar | grep foo")
+    # check that local snapshots work
+    with subtest("local"):
+        main.succeed("echo foo > /mnt/to_backup/bar")
+        main.wait_until_succeeds("cat /mnt/btrbk/local/*/bar | grep foo")
+        main.succeed("echo bar > /mnt/to_backup/bar")
+        main.succeed("cat /mnt/btrbk/local/*/bar | grep foo")
 
-      # check that btrfs send/receive works and ssh access works
-      with subtest("remote"):
-          archive.wait_until_succeeds("cat /mnt/*/bar | grep bar")
-          main.succeed("echo baz > /mnt/to_backup/bar")
-          archive.succeed("cat /mnt/*/bar | grep bar")
-    '';
-  }
-)
+    # check that btrfs send/receive works and ssh access works
+    with subtest("remote"):
+        archive.wait_until_succeeds("cat /mnt/*/bar | grep bar")
+        main.succeed("echo baz > /mnt/to_backup/bar")
+        archive.succeed("cat /mnt/*/bar | grep bar")
+  '';
+}
diff --git a/nixos/tests/budgie.nix b/nixos/tests/budgie.nix
index 5389a8d9da9d..04e5300ec4fb 100644
--- a/nixos/tests/budgie.nix
+++ b/nixos/tests/budgie.nix
@@ -1,104 +1,102 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "budgie";
+{ pkgs, lib, ... }:
+{
+  name = "budgie";
 
-    meta.maintainers = lib.teams.budgie.members;
+  meta.maintainers = lib.teams.budgie.members;
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [
-          ./common/user-account.nix
-        ];
+  nodes.machine =
+    { ... }:
+    {
+      imports = [
+        ./common/user-account.nix
+      ];
 
-        services.xserver.enable = true;
+      services.xserver.enable = true;
 
-        services.xserver.displayManager = {
-          lightdm.enable = true;
-          autoLogin = {
-            enable = true;
-            user = "alice";
-          };
-        };
-
-        # We don't ship gnome-text-editor in Budgie module, we add this line mainly
-        # to catch eval issues related to this option.
-        environment.budgie.excludePackages = [ pkgs.gnome-text-editor ];
-
-        services.xserver.desktopManager.budgie = {
+      services.xserver.displayManager = {
+        lightdm.enable = true;
+        autoLogin = {
           enable = true;
-          extraPlugins = [
-            pkgs.budgie-analogue-clock-applet
-          ];
+          user = "alice";
         };
       };
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-        env = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus DISPLAY=:0";
-        su = command: "su - ${user.name} -c '${env} ${command}'";
-      in
-      ''
-        with subtest("Wait for login"):
-            # wait_for_x() checks graphical-session.target, which is expected to be
-            # inactive on Budgie before Budgie manages user session with systemd.
-            # https://github.com/BuddiesOfBudgie/budgie-desktop/blob/39e9f0895c978f76/src/session/budgie-desktop.in#L16
-            #
-            # Previously this was unconditionally touched by xsessionWrapper but was
-            # changed in #233981 (we have Budgie:GNOME in XDG_CURRENT_DESKTOP).
-            # machine.wait_for_x()
-            machine.wait_until_succeeds('journalctl -t budgie-session-binary --grep "Entering running state"')
-            machine.wait_for_file("${user.home}/.Xauthority")
-            machine.succeed("xauth merge ${user.home}/.Xauthority")
+      # We don't ship gnome-text-editor in Budgie module, we add this line mainly
+      # to catch eval issues related to this option.
+      environment.budgie.excludePackages = [ pkgs.gnome-text-editor ];
 
-        with subtest("Check that logging in has given the user ownership of devices"):
-            machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+      services.xserver.desktopManager.budgie = {
+        enable = true;
+        extraPlugins = [
+          pkgs.budgie-analogue-clock-applet
+        ];
+      };
+    };
 
-        with subtest("Check if Budgie session components actually start"):
-            for i in ["budgie-daemon", "budgie-panel", "budgie-wm", "budgie-desktop-view", "gsd-media-keys"]:
-                machine.wait_until_succeeds(f"pgrep -f {i}")
-            # We don't check xwininfo for budgie-wm.
-            # See https://github.com/NixOS/nixpkgs/pull/216737#discussion_r1155312754
-            machine.wait_for_window("budgie-daemon")
-            machine.wait_for_window("budgie-panel")
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+      env = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus DISPLAY=:0";
+      su = command: "su - ${user.name} -c '${env} ${command}'";
+    in
+    ''
+      with subtest("Wait for login"):
+          # wait_for_x() checks graphical-session.target, which is expected to be
+          # inactive on Budgie before Budgie manages user session with systemd.
+          # https://github.com/BuddiesOfBudgie/budgie-desktop/blob/39e9f0895c978f76/src/session/budgie-desktop.in#L16
+          #
+          # Previously this was unconditionally touched by xsessionWrapper but was
+          # changed in #233981 (we have Budgie:GNOME in XDG_CURRENT_DESKTOP).
+          # machine.wait_for_x()
+          machine.wait_until_succeeds('journalctl -t budgie-session-binary --grep "Entering running state"')
+          machine.wait_for_file("${user.home}/.Xauthority")
+          machine.succeed("xauth merge ${user.home}/.Xauthority")
 
-        with subtest("Check if various environment variables are set"):
-            cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf /run/current-system/sw/bin/budgie-wm)/environ"
-            machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Budgie:GNOME'")
-            machine.succeed(f"{cmd} | grep 'BUDGIE_PLUGIN_DATADIR' | grep '${pkgs.budgie-desktop-with-plugins.pname}'")
+      with subtest("Check that logging in has given the user ownership of devices"):
+          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
 
-        with subtest("Open run dialog"):
-            machine.send_key("alt-f2")
-            machine.wait_for_window("budgie-run-dialog")
-            machine.sleep(2)
-            machine.screenshot("run_dialog")
-            machine.send_key("esc")
+      with subtest("Check if Budgie session components actually start"):
+          for i in ["budgie-daemon", "budgie-panel", "budgie-wm", "budgie-desktop-view", "gsd-media-keys"]:
+              machine.wait_until_succeeds(f"pgrep -f {i}")
+          # We don't check xwininfo for budgie-wm.
+          # See https://github.com/NixOS/nixpkgs/pull/216737#discussion_r1155312754
+          machine.wait_for_window("budgie-daemon")
+          machine.wait_for_window("budgie-panel")
 
-        with subtest("Open Budgie Control Center"):
-            machine.succeed("${su "budgie-control-center >&2 &"}")
-            machine.wait_for_window("Budgie Control Center")
+      with subtest("Check if various environment variables are set"):
+          cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf /run/current-system/sw/bin/budgie-wm)/environ"
+          machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Budgie:GNOME'")
+          machine.succeed(f"{cmd} | grep 'BUDGIE_PLUGIN_DATADIR' | grep '${pkgs.budgie-desktop-with-plugins.pname}'")
 
-        with subtest("Lock the screen"):
-            machine.succeed("${su "budgie-screensaver-command -l >&2 &"}")
-            machine.wait_until_succeeds("${su "budgie-screensaver-command -q"} | grep 'The screensaver is active'")
-            machine.sleep(2)
-            machine.send_chars("${user.password}", delay=0.5)
-            machine.screenshot("budgie_screensaver")
-            machine.send_chars("\n")
-            machine.wait_until_succeeds("${su "budgie-screensaver-command -q"} | grep 'The screensaver is inactive'")
-            machine.sleep(2)
+      with subtest("Open run dialog"):
+          machine.send_key("alt-f2")
+          machine.wait_for_window("budgie-run-dialog")
+          machine.sleep(2)
+          machine.screenshot("run_dialog")
+          machine.send_key("esc")
 
-        with subtest("Open GNOME terminal"):
-            machine.succeed("${su "gnome-terminal"}")
-            machine.wait_for_window("${user.name}@machine: ~")
+      with subtest("Open Budgie Control Center"):
+          machine.succeed("${su "budgie-control-center >&2 &"}")
+          machine.wait_for_window("Budgie Control Center")
 
-        with subtest("Check if Budgie has ever coredumped"):
-            machine.fail("coredumpctl --json=short | grep budgie")
-            machine.sleep(10)
-            machine.screenshot("screen")
-      '';
-  }
-)
+      with subtest("Lock the screen"):
+          machine.succeed("${su "budgie-screensaver-command -l >&2 &"}")
+          machine.wait_until_succeeds("${su "budgie-screensaver-command -q"} | grep 'The screensaver is active'")
+          machine.sleep(2)
+          machine.send_chars("${user.password}", delay=0.5)
+          machine.screenshot("budgie_screensaver")
+          machine.send_chars("\n")
+          machine.wait_until_succeeds("${su "budgie-screensaver-command -q"} | grep 'The screensaver is inactive'")
+          machine.sleep(2)
+
+      with subtest("Open GNOME terminal"):
+          machine.succeed("${su "gnome-terminal"}")
+          machine.wait_for_window("${user.name}@machine: ~")
+
+      with subtest("Check if Budgie has ever coredumped"):
+          machine.fail("coredumpctl --json=short | grep budgie")
+          machine.sleep(10)
+          machine.screenshot("screen")
+    '';
+}
diff --git a/nixos/tests/buildkite-agents.nix b/nixos/tests/buildkite-agents.nix
index e8934dbaaa5c..e4fe837ea8cc 100644
--- a/nixos/tests/buildkite-agents.nix
+++ b/nixos/tests/buildkite-agents.nix
@@ -1,33 +1,31 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  {
-    name = "buildkite-agent";
-    meta.maintainers = with lib.maintainers; [ flokli ];
+{
+  name = "buildkite-agent";
+  meta.maintainers = with lib.maintainers; [ flokli ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.buildkite-agents = {
-          one = {
-            privateSshKeyPath = (import ./ssh-keys.nix pkgs).snakeOilPrivateKey;
-            tokenPath = (pkgs.writeText "my-token" "5678");
-          };
-          two = {
-            tokenPath = (pkgs.writeText "my-token" "1234");
-          };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.buildkite-agents = {
+        one = {
+          privateSshKeyPath = (import ./ssh-keys.nix pkgs).snakeOilPrivateKey;
+          tokenPath = (pkgs.writeText "my-token" "5678");
+        };
+        two = {
+          tokenPath = (pkgs.writeText "my-token" "1234");
         };
       };
+    };
 
-    testScript = ''
-      start_all()
-      # we can't wait on the unit to start up, as we obviously can't connect to buildkite,
-      # but we can look whether files are set up correctly
+  testScript = ''
+    start_all()
+    # we can't wait on the unit to start up, as we obviously can't connect to buildkite,
+    # but we can look whether files are set up correctly
 
-      machine.wait_for_file("/var/lib/buildkite-agent-one/buildkite-agent.cfg")
-      machine.wait_for_file("/var/lib/buildkite-agent-one/.ssh/id_rsa")
+    machine.wait_for_file("/var/lib/buildkite-agent-one/buildkite-agent.cfg")
+    machine.wait_for_file("/var/lib/buildkite-agent-one/.ssh/id_rsa")
 
-      machine.wait_for_file("/var/lib/buildkite-agent-two/buildkite-agent.cfg")
-    '';
-  }
-)
+    machine.wait_for_file("/var/lib/buildkite-agent-two/buildkite-agent.cfg")
+  '';
+}
diff --git a/nixos/tests/c2fmzq.nix b/nixos/tests/c2fmzq.nix
index 90d816785e1e..26c2a3349ba4 100644
--- a/nixos/tests/c2fmzq.nix
+++ b/nixos/tests/c2fmzq.nix
@@ -1,87 +1,85 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "c2FmZQ";
-    meta.maintainers = with lib.maintainers; [ hmenke ];
+{ pkgs, lib, ... }:
+{
+  name = "c2FmZQ";
+  meta.maintainers = with lib.maintainers; [ hmenke ];
 
-    nodes.machine = {
-      services.c2fmzq-server = {
-        enable = true;
-        port = 8080;
-        passphraseFile = builtins.toFile "pwfile" "hunter2"; # don't do this on real deployments
-        settings = {
-          verbose = 3; # debug
-          # make sure multiple freeform options evaluate
-          allow-new-accounts = true;
-          auto-approve-new-accounts = true;
-          licenses = false;
-        };
-      };
-      environment = {
-        sessionVariables = {
-          C2FMZQ_PASSPHRASE = "lol";
-          C2FMZQ_API_SERVER = "http://localhost:8080";
-        };
-        systemPackages = [
-          pkgs.c2fmzq
-          (pkgs.writeScriptBin "c2FmZQ-client-wrapper" ''
-            #!${pkgs.expect}/bin/expect -f
-            spawn c2FmZQ-client {*}$argv
-            expect {
-              "Enter password:" { send "$env(PASSWORD)\r" }
-              "Type YES to confirm:" { send "YES\r" }
-              timeout { exit 1 }
-              eof { exit 0 }
-            }
-            interact
-          '')
-        ];
+  nodes.machine = {
+    services.c2fmzq-server = {
+      enable = true;
+      port = 8080;
+      passphraseFile = builtins.toFile "pwfile" "hunter2"; # don't do this on real deployments
+      settings = {
+        verbose = 3; # debug
+        # make sure multiple freeform options evaluate
+        allow-new-accounts = true;
+        auto-approve-new-accounts = true;
+        licenses = false;
       };
     };
+    environment = {
+      sessionVariables = {
+        C2FMZQ_PASSPHRASE = "lol";
+        C2FMZQ_API_SERVER = "http://localhost:8080";
+      };
+      systemPackages = [
+        pkgs.c2fmzq
+        (pkgs.writeScriptBin "c2FmZQ-client-wrapper" ''
+          #!${pkgs.expect}/bin/expect -f
+          spawn c2FmZQ-client {*}$argv
+          expect {
+            "Enter password:" { send "$env(PASSWORD)\r" }
+            "Type YES to confirm:" { send "YES\r" }
+            timeout { exit 1 }
+            eof { exit 0 }
+          }
+          interact
+        '')
+      ];
+    };
+  };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        machine.start()
-        machine.wait_for_unit("c2fmzq-server.service")
-        machine.wait_for_open_port(8080)
+  testScript =
+    { nodes, ... }:
+    ''
+      machine.start()
+      machine.wait_for_unit("c2fmzq-server.service")
+      machine.wait_for_open_port(8080)
 
-        with subtest("Create accounts for alice and bob"):
-            machine.succeed("PASSWORD=foobar c2FmZQ-client-wrapper -- -v 3 create-account alice@example.com")
-            machine.succeed("PASSWORD=fizzbuzz c2FmZQ-client-wrapper -- -v 3 create-account bob@example.com")
+      with subtest("Create accounts for alice and bob"):
+          machine.succeed("PASSWORD=foobar c2FmZQ-client-wrapper -- -v 3 create-account alice@example.com")
+          machine.succeed("PASSWORD=fizzbuzz c2FmZQ-client-wrapper -- -v 3 create-account bob@example.com")
 
-        with subtest("Log in as alice"):
-            machine.succeed("PASSWORD=foobar c2FmZQ-client-wrapper -- -v 3 login alice@example.com")
-            msg = machine.succeed("c2FmZQ-client -v 3 status")
-            assert "Logged in as alice@example.com" in msg, f"ERROR: Not logged in as alice:\n{msg}"
+      with subtest("Log in as alice"):
+          machine.succeed("PASSWORD=foobar c2FmZQ-client-wrapper -- -v 3 login alice@example.com")
+          msg = machine.succeed("c2FmZQ-client -v 3 status")
+          assert "Logged in as alice@example.com" in msg, f"ERROR: Not logged in as alice:\n{msg}"
 
-        with subtest("Create a new album, upload a file, and delete the uploaded file"):
-            machine.succeed("c2FmZQ-client -v 3 create-album 'Rarest Memes'")
-            machine.succeed("echo 'pls do not steal' > meme.txt")
-            machine.succeed("c2FmZQ-client -v 3 import meme.txt 'Rarest Memes'")
-            machine.succeed("c2FmZQ-client -v 3 sync")
-            machine.succeed("rm meme.txt")
+      with subtest("Create a new album, upload a file, and delete the uploaded file"):
+          machine.succeed("c2FmZQ-client -v 3 create-album 'Rarest Memes'")
+          machine.succeed("echo 'pls do not steal' > meme.txt")
+          machine.succeed("c2FmZQ-client -v 3 import meme.txt 'Rarest Memes'")
+          machine.succeed("c2FmZQ-client -v 3 sync")
+          machine.succeed("rm meme.txt")
 
-        with subtest("Share the album with bob"):
-            machine.succeed("c2FmZQ-client-wrapper -- -v 3 share 'Rarest Memes' bob@example.com")
+      with subtest("Share the album with bob"):
+          machine.succeed("c2FmZQ-client-wrapper -- -v 3 share 'Rarest Memes' bob@example.com")
 
-        with subtest("Log in as bob"):
-            machine.succeed("PASSWORD=fizzbuzz c2FmZQ-client-wrapper -- -v 3 login bob@example.com")
-            msg = machine.succeed("c2FmZQ-client -v 3 status")
-            assert "Logged in as bob@example.com" in msg, f"ERROR: Not logged in as bob:\n{msg}"
+      with subtest("Log in as bob"):
+          machine.succeed("PASSWORD=fizzbuzz c2FmZQ-client-wrapper -- -v 3 login bob@example.com")
+          msg = machine.succeed("c2FmZQ-client -v 3 status")
+          assert "Logged in as bob@example.com" in msg, f"ERROR: Not logged in as bob:\n{msg}"
 
-        with subtest("Download the shared file"):
-            machine.succeed("c2FmZQ-client -v 3 download 'shared/Rarest Memes/meme.txt'")
-            machine.succeed("c2FmZQ-client -v 3 export 'shared/Rarest Memes/meme.txt' .")
-            msg = machine.succeed("cat meme.txt")
-            assert "pls do not steal\n" == msg, f"File content is not the same:\n{msg}"
+      with subtest("Download the shared file"):
+          machine.succeed("c2FmZQ-client -v 3 download 'shared/Rarest Memes/meme.txt'")
+          machine.succeed("c2FmZQ-client -v 3 export 'shared/Rarest Memes/meme.txt' .")
+          msg = machine.succeed("cat meme.txt")
+          assert "pls do not steal\n" == msg, f"File content is not the same:\n{msg}"
 
-        with subtest("Test that PWA is served"):
-            msg = machine.succeed("curl -sSfL http://localhost:8080")
-            assert "c2FmZQ" in msg, f"Could not find 'c2FmZQ' in the output:\n{msg}"
+      with subtest("Test that PWA is served"):
+          msg = machine.succeed("curl -sSfL http://localhost:8080")
+          assert "c2FmZQ" in msg, f"Could not find 'c2FmZQ' in the output:\n{msg}"
 
-        with subtest("A setting with false value is properly passed"):
-            machine.succeed("systemctl show -p ExecStart --value c2fmzq-server.service | grep -F -- '--licenses=false'");
-      '';
-  }
-)
+      with subtest("A setting with false value is properly passed"):
+          machine.succeed("systemctl show -p ExecStart --value c2fmzq-server.service | grep -F -- '--licenses=false'");
+    '';
+}
diff --git a/nixos/tests/cage.nix b/nixos/tests/cage.nix
index e9c025e51021..585968b5e0e4 100644
--- a/nixos/tests/cage.nix
+++ b/nixos/tests/cage.nix
@@ -1,44 +1,42 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "cage";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ matthewbauer ];
-    };
+{
+  name = "cage";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ matthewbauer ];
+  };
 
-    nodes.machine =
-      { ... }:
+  nodes.machine =
+    { ... }:
 
-      {
-        imports = [ ./common/user-account.nix ];
+    {
+      imports = [ ./common/user-account.nix ];
 
-        fonts.packages = with pkgs; [ dejavu_fonts ];
+      fonts.packages = with pkgs; [ dejavu_fonts ];
 
-        services.cage = {
-          enable = true;
-          user = "alice";
-          program = "${pkgs.xterm}/bin/xterm";
-        };
-
-        # Need to switch to a different GPU driver than the default one (-vga std) so that Cage can launch:
-        virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
+      services.cage = {
+        enable = true;
+        user = "alice";
+        program = "${pkgs.xterm}/bin/xterm";
       };
 
-    enableOCR = true;
+      # Need to switch to a different GPU driver than the default one (-vga std) so that Cage can launch:
+      virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
+    };
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.config.users.users.alice;
-      in
-      ''
-        with subtest("Wait for cage to boot up"):
-            start_all()
-            machine.wait_for_file("/run/user/${toString user.uid}/wayland-0.lock")
-            machine.wait_until_succeeds("pgrep xterm")
-            machine.wait_for_text("alice@machine")
-            machine.screenshot("screen")
-      '';
-  }
-)
+  enableOCR = true;
+
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.config.users.users.alice;
+    in
+    ''
+      with subtest("Wait for cage to boot up"):
+          start_all()
+          machine.wait_for_file("/run/user/${toString user.uid}/wayland-0.lock")
+          machine.wait_until_succeeds("pgrep xterm")
+          machine.wait_for_text("alice@machine")
+          machine.screenshot("screen")
+    '';
+}
diff --git a/nixos/tests/cagebreak.nix b/nixos/tests/cagebreak.nix
index 2c07833b142f..13012281a151 100644
--- a/nixos/tests/cagebreak.nix
+++ b/nixos/tests/cagebreak.nix
@@ -1,72 +1,70 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    cagebreakConfigfile = pkgs.writeText "config" ''
-      workspaces 1
-      escape C-t
-      bind t exec env DISPLAY=:0 ${pkgs.xterm}/bin/xterm -cm -pc
-    '';
-  in
-  {
-    name = "cagebreak";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ berbiche ];
+let
+  cagebreakConfigfile = pkgs.writeText "config" ''
+    workspaces 1
+    escape C-t
+    bind t exec env DISPLAY=:0 ${pkgs.xterm}/bin/xterm -cm -pc
+  '';
+in
+{
+  name = "cagebreak";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ berbiche ];
+  };
+
+  nodes.machine =
+    { config, ... }:
+    {
+      # Automatically login on tty1 as a normal user:
+      imports = [ ./common/user-account.nix ];
+      services.getty.autologinUser = "alice";
+      programs.bash.loginShellInit = ''
+        if [ "$(tty)" = "/dev/tty1" ]; then
+          set -e
+
+          mkdir -p ~/.config/cagebreak
+          cp -f ${cagebreakConfigfile} ~/.config/cagebreak/config
+
+          cagebreak
+        fi
+      '';
+
+      hardware.graphics.enable = true;
+      programs.xwayland.enable = true;
+      security.polkit.enable = true;
+      environment.systemPackages = [
+        pkgs.cagebreak
+        pkgs.wayland-utils
+      ];
+
+      # Need to switch to a different GPU driver than the default one (-vga std) so that Cagebreak can launch:
+      virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
     };
 
-    nodes.machine =
-      { config, ... }:
-      {
-        # Automatically login on tty1 as a normal user:
-        imports = [ ./common/user-account.nix ];
-        services.getty.autologinUser = "alice";
-        programs.bash.loginShellInit = ''
-          if [ "$(tty)" = "/dev/tty1" ]; then
-            set -e
+  enableOCR = true;
 
-            mkdir -p ~/.config/cagebreak
-            cp -f ${cagebreakConfigfile} ~/.config/cagebreak/config
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.config.users.users.alice;
+      XDG_RUNTIME_DIR = "/run/user/${toString user.uid}";
+    in
+    ''
+      start_all()
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_for_file("${XDG_RUNTIME_DIR}/wayland-0")
 
-            cagebreak
-          fi
-        '';
+      with subtest("ensure wayland works with wayinfo from wallutils"):
+          print(machine.succeed("env XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR} wayland-info"))
 
-        hardware.graphics.enable = true;
-        programs.xwayland.enable = true;
-        security.polkit.enable = true;
-        environment.systemPackages = [
-          pkgs.cagebreak
-          pkgs.wayland-utils
-        ];
-
-        # Need to switch to a different GPU driver than the default one (-vga std) so that Cagebreak can launch:
-        virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
-      };
-
-    enableOCR = true;
-
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.config.users.users.alice;
-        XDG_RUNTIME_DIR = "/run/user/${toString user.uid}";
-      in
-      ''
-        start_all()
-        machine.wait_for_unit("multi-user.target")
-        machine.wait_for_file("${XDG_RUNTIME_DIR}/wayland-0")
-
-        with subtest("ensure wayland works with wayinfo from wallutils"):
-            print(machine.succeed("env XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR} wayland-info"))
-
-        # TODO: Fix the XWayland test (log the cagebreak output to debug):
-        # with subtest("ensure xwayland works with xterm"):
-        #     machine.send_key("ctrl-t")
-        #     machine.send_key("t")
-        #     machine.wait_until_succeeds("pgrep xterm")
-        #     machine.wait_for_text("${user.name}@machine")
-        #     machine.screenshot("screen")
-        #     machine.send_key("ctrl-d")
-      '';
-  }
-)
+      # TODO: Fix the XWayland test (log the cagebreak output to debug):
+      # with subtest("ensure xwayland works with xterm"):
+      #     machine.send_key("ctrl-t")
+      #     machine.send_key("t")
+      #     machine.wait_until_succeeds("pgrep xterm")
+      #     machine.wait_for_text("${user.name}@machine")
+      #     machine.screenshot("screen")
+      #     machine.send_key("ctrl-d")
+    '';
+}
diff --git a/nixos/tests/canaille.nix b/nixos/tests/canaille.nix
index 58e81e058de0..fa0d33b0f2e2 100644
--- a/nixos/tests/canaille.nix
+++ b/nixos/tests/canaille.nix
@@ -1,62 +1,60 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    certs = import ./common/acme/server/snakeoil-certs.nix;
-    inherit (certs) domain;
-  in
-  {
-    name = "canaille";
-    meta.maintainers = with pkgs.lib.maintainers; [ erictapen ];
+{ pkgs, ... }:
+let
+  certs = import ./common/acme/server/snakeoil-certs.nix;
+  inherit (certs) domain;
+in
+{
+  name = "canaille";
+  meta.maintainers = with pkgs.lib.maintainers; [ erictapen ];
 
-    nodes.server =
-      { pkgs, lib, ... }:
-      {
-        services.canaille = {
-          enable = true;
-          secretKeyFile = pkgs.writeText "canaille-secret-key" ''
-            this is not a secret key
-          '';
-          settings = {
-            SERVER_NAME = domain;
-          };
+  nodes.server =
+    { pkgs, lib, ... }:
+    {
+      services.canaille = {
+        enable = true;
+        secretKeyFile = pkgs.writeText "canaille-secret-key" ''
+          this is not a secret key
+        '';
+        settings = {
+          SERVER_NAME = domain;
         };
-
-        services.nginx.virtualHosts."${domain}" = {
-          enableACME = lib.mkForce false;
-          sslCertificate = certs."${domain}".cert;
-          sslCertificateKey = certs."${domain}".key;
-        };
-
-        networking.hosts."::1" = [ "${domain}" ];
-        networking.firewall.allowedTCPPorts = [
-          80
-          443
-        ];
-
-        users.users.canaille.shell = pkgs.bashInteractive;
-
-        security.pki.certificateFiles = [ certs.ca.cert ];
       };
 
-    nodes.client =
-      { nodes, ... }:
-      {
-        networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ "${domain}" ];
-        security.pki.certificateFiles = [ certs.ca.cert ];
+      services.nginx.virtualHosts."${domain}" = {
+        enableACME = lib.mkForce false;
+        sslCertificate = certs."${domain}".cert;
+        sslCertificateKey = certs."${domain}".key;
       };
 
-    testScript =
-      { ... }:
-      ''
-        import json
+      networking.hosts."::1" = [ "${domain}" ];
+      networking.firewall.allowedTCPPorts = [
+        80
+        443
+      ];
 
-        start_all()
-        server.wait_for_unit("canaille.socket")
-        server.wait_until_succeeds("curl -f https://${domain}")
-        server.succeed("sudo -iu canaille -- canaille create user --user-name admin --password adminpass --emails admin@${domain}")
-        json_str = server.succeed("sudo -iu canaille -- canaille get user")
-        assert json.loads(json_str)[0]["user_name"] == "admin"
-        server.succeed("sudo -iu canaille -- canaille config check")
-      '';
-  }
-)
+      users.users.canaille.shell = pkgs.bashInteractive;
+
+      security.pki.certificateFiles = [ certs.ca.cert ];
+    };
+
+  nodes.client =
+    { nodes, ... }:
+    {
+      networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ "${domain}" ];
+      security.pki.certificateFiles = [ certs.ca.cert ];
+    };
+
+  testScript =
+    { ... }:
+    ''
+      import json
+
+      start_all()
+      server.wait_for_unit("canaille.socket")
+      server.wait_until_succeeds("curl -f https://${domain}")
+      server.succeed("sudo -iu canaille -- canaille create user --user-name admin --password adminpass --emails admin@${domain}")
+      json_str = server.succeed("sudo -iu canaille -- canaille get user")
+      assert json.loads(json_str)[0]["user_name"] == "admin"
+      server.succeed("sudo -iu canaille -- canaille config check")
+    '';
+}
diff --git a/nixos/tests/castopod.nix b/nixos/tests/castopod.nix
index 3d62cc0711fe..608526c728c6 100644
--- a/nixos/tests/castopod.nix
+++ b/nixos/tests/castopod.nix
@@ -1,250 +1,248 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "castopod";
-    meta = with lib.maintainers; {
-      maintainers = [ alexoundos ];
+{ pkgs, lib, ... }:
+{
+  name = "castopod";
+  meta = with lib.maintainers; {
+    maintainers = [ alexoundos ];
+  };
+
+  nodes.castopod =
+    { nodes, ... }:
+    {
+      # otherwise 500 MiB file upload fails!
+      virtualisation.diskSize = 512 + 3 * 512;
+
+      networking.firewall.allowedTCPPorts = [ 80 ];
+      networking.extraHosts = lib.strings.concatStringsSep "\n" (
+        lib.attrsets.mapAttrsToList (
+          name: _: "127.0.0.1 ${name}"
+        ) nodes.castopod.services.nginx.virtualHosts
+      );
+
+      services.castopod = {
+        enable = true;
+        database.createLocally = true;
+        localDomain = "castopod.example.com";
+        maxUploadSize = "512M";
+      };
     };
 
-    nodes.castopod =
-      { nodes, ... }:
-      {
-        # otherwise 500 MiB file upload fails!
-        virtualisation.diskSize = 512 + 3 * 512;
+  nodes.client =
+    {
+      nodes,
+      pkgs,
+      lib,
+      ...
+    }:
+    let
+      domain = nodes.castopod.services.castopod.localDomain;
 
-        networking.firewall.allowedTCPPorts = [ 80 ];
-        networking.extraHosts = lib.strings.concatStringsSep "\n" (
-          lib.attrsets.mapAttrsToList (
-            name: _: "127.0.0.1 ${name}"
-          ) nodes.castopod.services.nginx.virtualHosts
-        );
+      getIP = node: (builtins.head node.networking.interfaces.eth1.ipv4.addresses).address;
 
-        services.castopod = {
-          enable = true;
-          database.createLocally = true;
-          localDomain = "castopod.example.com";
-          maxUploadSize = "512M";
-        };
-      };
+      targetPodcastSize = 500 * 1024 * 1024;
+      lameMp3Bitrate = 348300;
+      lameMp3FileAdjust = -800;
+      targetPodcastDuration = toString ((targetPodcastSize + lameMp3FileAdjust) / (lameMp3Bitrate / 8));
+      bannerWidth = 3000;
+      banner = pkgs.runCommand "gen-castopod-cover.jpg" { } ''
+        ${pkgs.imagemagick}/bin/magick `
+        `-background green -bordercolor white -gravity northwest xc:black `
+        `-duplicate 99 `
+        `-seed 1 -resize "%[fx:rand()*72+24]" `
+        `-seed 0 -rotate "%[fx:rand()*360]" -border 6x6 -splice 16x36 `
+        `-seed 0 -rotate "%[fx:floor(rand()*4)*90]" -resize "150x50!" `
+        `+append -crop 10x1@ +repage -roll "+%[fx:(t%2)*72]+0" -append `
+        `-resize ${toString bannerWidth} -quality 1 $out
+      '';
 
-    nodes.client =
-      {
-        nodes,
-        pkgs,
-        lib,
-        ...
-      }:
-      let
-        domain = nodes.castopod.services.castopod.localDomain;
+      coverWidth = toString 3000;
+      cover = pkgs.runCommand "gen-castopod-banner.jpg" { } ''
+        ${pkgs.imagemagick}/bin/magick `
+        `-background white -bordercolor white -gravity northwest xc:black `
+        `-duplicate 99 `
+        `-seed 1 -resize "%[fx:rand()*72+24]" `
+        `-seed 0 -rotate "%[fx:rand()*360]" -border 6x6 -splice 36x36 `
+        `-seed 0 -rotate "%[fx:floor(rand()*4)*90]" -resize "144x144!" `
+        `+append -crop 10x1@ +repage -roll "+%[fx:(t%2)*72]+0" -append `
+        `-resize ${coverWidth} -quality 1 $out
+      '';
+    in
+    {
+      networking.extraHosts = lib.strings.concatStringsSep "\n" (
+        lib.attrsets.mapAttrsToList (
+          name: _: "${getIP nodes.castopod} ${name}"
+        ) nodes.castopod.services.nginx.virtualHosts
+      );
 
-        getIP = node: (builtins.head node.networking.interfaces.eth1.ipv4.addresses).address;
+      environment.systemPackages =
+        let
+          username = "admin";
+          email = "admin@${domain}";
+          password = "Abcd1234";
+          podcastTitle = "Some Title";
+          episodeTitle = "Episode Title";
+          browser-test =
+            pkgs.writers.writePython3Bin "browser-test"
+              {
+                libraries = [ pkgs.python3Packages.selenium ];
+                flakeIgnore = [
+                  "E124"
+                  "E501"
+                ];
+              }
+              ''
+                from selenium.webdriver.common.by import By
+                from selenium.webdriver import Firefox
+                from selenium.webdriver.firefox.options import Options
+                from selenium.webdriver.firefox.service import Service
+                from selenium.webdriver.support.ui import WebDriverWait
+                from selenium.webdriver.support import expected_conditions as EC
+                from subprocess import STDOUT
+                import logging
 
-        targetPodcastSize = 500 * 1024 * 1024;
-        lameMp3Bitrate = 348300;
-        lameMp3FileAdjust = -800;
-        targetPodcastDuration = toString ((targetPodcastSize + lameMp3FileAdjust) / (lameMp3Bitrate / 8));
-        bannerWidth = 3000;
-        banner = pkgs.runCommand "gen-castopod-cover.jpg" { } ''
-          ${pkgs.imagemagick}/bin/magick `
-          `-background green -bordercolor white -gravity northwest xc:black `
-          `-duplicate 99 `
-          `-seed 1 -resize "%[fx:rand()*72+24]" `
-          `-seed 0 -rotate "%[fx:rand()*360]" -border 6x6 -splice 16x36 `
-          `-seed 0 -rotate "%[fx:floor(rand()*4)*90]" -resize "150x50!" `
-          `+append -crop 10x1@ +repage -roll "+%[fx:(t%2)*72]+0" -append `
-          `-resize ${toString bannerWidth} -quality 1 $out
-        '';
+                selenium_logger = logging.getLogger("selenium")
+                selenium_logger.setLevel(logging.DEBUG)
+                selenium_logger.addHandler(logging.StreamHandler())
 
-        coverWidth = toString 3000;
-        cover = pkgs.runCommand "gen-castopod-banner.jpg" { } ''
-          ${pkgs.imagemagick}/bin/magick `
-          `-background white -bordercolor white -gravity northwest xc:black `
-          `-duplicate 99 `
-          `-seed 1 -resize "%[fx:rand()*72+24]" `
-          `-seed 0 -rotate "%[fx:rand()*360]" -border 6x6 -splice 36x36 `
-          `-seed 0 -rotate "%[fx:floor(rand()*4)*90]" -resize "144x144!" `
-          `+append -crop 10x1@ +repage -roll "+%[fx:(t%2)*72]+0" -append `
-          `-resize ${coverWidth} -quality 1 $out
-        '';
-      in
-      {
-        networking.extraHosts = lib.strings.concatStringsSep "\n" (
-          lib.attrsets.mapAttrsToList (
-            name: _: "${getIP nodes.castopod} ${name}"
-          ) nodes.castopod.services.nginx.virtualHosts
-        );
+                options = Options()
+                options.add_argument('--headless')
+                service = Service(log_output=STDOUT)
+                driver = Firefox(options=options, service=service)
+                driver = Firefox(options=options)
+                driver.implicitly_wait(30)
+                driver.set_page_load_timeout(60)
 
-        environment.systemPackages =
-          let
-            username = "admin";
-            email = "admin@${domain}";
-            password = "Abcd1234";
-            podcastTitle = "Some Title";
-            episodeTitle = "Episode Title";
-            browser-test =
-              pkgs.writers.writePython3Bin "browser-test"
-                {
-                  libraries = [ pkgs.python3Packages.selenium ];
-                  flakeIgnore = [
-                    "E124"
-                    "E501"
-                  ];
-                }
-                ''
-                  from selenium.webdriver.common.by import By
-                  from selenium.webdriver import Firefox
-                  from selenium.webdriver.firefox.options import Options
-                  from selenium.webdriver.firefox.service import Service
-                  from selenium.webdriver.support.ui import WebDriverWait
-                  from selenium.webdriver.support import expected_conditions as EC
-                  from subprocess import STDOUT
-                  import logging
+                # install ##########################################################
 
-                  selenium_logger = logging.getLogger("selenium")
-                  selenium_logger.setLevel(logging.DEBUG)
-                  selenium_logger.addHandler(logging.StreamHandler())
+                driver.get('http://${domain}/cp-install')
 
-                  options = Options()
-                  options.add_argument('--headless')
-                  service = Service(log_output=STDOUT)
-                  driver = Firefox(options=options, service=service)
-                  driver = Firefox(options=options)
-                  driver.implicitly_wait(30)
-                  driver.set_page_load_timeout(60)
+                wait = WebDriverWait(driver, 20)
 
-                  # install ##########################################################
+                wait.until(EC.title_contains("installer"))
 
-                  driver.get('http://${domain}/cp-install')
+                driver.find_element(By.CSS_SELECTOR, '#username').send_keys(
+                    '${username}'
+                )
+                driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
+                    '${email}'
+                )
+                driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
+                    '${password}'
+                )
+                driver.find_element(By.XPATH,
+                                    "//button[contains(., 'Finish install')]"
+                ).click()
 
-                  wait = WebDriverWait(driver, 20)
+                wait.until(EC.title_contains("Auth"))
 
-                  wait.until(EC.title_contains("installer"))
+                driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
+                    '${email}'
+                )
+                driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
+                    '${password}'
+                )
+                driver.find_element(By.XPATH,
+                                    "//button[contains(., 'Login')]"
+                ).click()
 
-                  driver.find_element(By.CSS_SELECTOR, '#username').send_keys(
-                      '${username}'
-                  )
-                  driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
-                      '${email}'
-                  )
-                  driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
-                      '${password}'
-                  )
-                  driver.find_element(By.XPATH,
-                                      "//button[contains(., 'Finish install')]"
-                  ).click()
+                wait.until(EC.title_contains("Admin dashboard"))
 
-                  wait.until(EC.title_contains("Auth"))
+                # create podcast ###################################################
 
-                  driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
-                      '${email}'
-                  )
-                  driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
-                      '${password}'
-                  )
-                  driver.find_element(By.XPATH,
-                                      "//button[contains(., 'Login')]"
-                  ).click()
+                driver.get('http://${domain}/admin/podcasts/new')
 
-                  wait.until(EC.title_contains("Admin dashboard"))
+                wait.until(EC.title_contains("Create podcast"))
 
-                  # create podcast ###################################################
+                driver.find_element(By.CSS_SELECTOR, '#cover').send_keys(
+                    '${cover}'
+                )
+                driver.find_element(By.CSS_SELECTOR, '#banner').send_keys(
+                    '${banner}'
+                )
+                driver.find_element(By.CSS_SELECTOR, '#title').send_keys(
+                    '${podcastTitle}'
+                )
+                driver.find_element(By.CSS_SELECTOR, '#handle').send_keys(
+                    'some_handle'
+                )
+                driver.find_element(By.CSS_SELECTOR, '#description').send_keys(
+                    'Some description'
+                )
+                driver.find_element(By.CSS_SELECTOR, '#owner_name').send_keys(
+                    'Owner Name'
+                )
+                driver.find_element(By.CSS_SELECTOR, '#owner_email').send_keys(
+                    'owner@email.xyz'
+                )
+                driver.find_element(By.XPATH,
+                                    "//button[contains(., 'Create podcast')]"
+                ).click()
 
-                  driver.get('http://${domain}/admin/podcasts/new')
+                wait.until(EC.title_contains("${podcastTitle}"))
 
-                  wait.until(EC.title_contains("Create podcast"))
+                driver.find_element(By.XPATH,
+                                    "//span[contains(., 'Add an episode')]"
+                ).click()
 
-                  driver.find_element(By.CSS_SELECTOR, '#cover').send_keys(
-                      '${cover}'
-                  )
-                  driver.find_element(By.CSS_SELECTOR, '#banner').send_keys(
-                      '${banner}'
-                  )
-                  driver.find_element(By.CSS_SELECTOR, '#title').send_keys(
-                      '${podcastTitle}'
-                  )
-                  driver.find_element(By.CSS_SELECTOR, '#handle').send_keys(
-                      'some_handle'
-                  )
-                  driver.find_element(By.CSS_SELECTOR, '#description').send_keys(
-                      'Some description'
-                  )
-                  driver.find_element(By.CSS_SELECTOR, '#owner_name').send_keys(
-                      'Owner Name'
-                  )
-                  driver.find_element(By.CSS_SELECTOR, '#owner_email').send_keys(
-                      'owner@email.xyz'
-                  )
-                  driver.find_element(By.XPATH,
-                                      "//button[contains(., 'Create podcast')]"
-                  ).click()
+                wait.until(EC.title_contains("Add an episode"))
 
-                  wait.until(EC.title_contains("${podcastTitle}"))
+                # upload podcast ###################################################
 
-                  driver.find_element(By.XPATH,
-                                      "//span[contains(., 'Add an episode')]"
-                  ).click()
+                driver.find_element(By.CSS_SELECTOR, '#audio_file').send_keys(
+                    '/tmp/podcast.mp3'
+                )
+                driver.find_element(By.CSS_SELECTOR, '#cover').send_keys(
+                    '${cover}'
+                )
+                driver.find_element(By.CSS_SELECTOR, '#description').send_keys(
+                    'Episode description'
+                )
+                driver.find_element(By.CSS_SELECTOR, '#title').send_keys(
+                    '${episodeTitle}'
+                )
+                driver.find_element(By.XPATH,
+                                    "//button[contains(., 'Create episode')]"
+                ).click()
 
-                  wait.until(EC.title_contains("Add an episode"))
+                wait.until(EC.title_contains("${episodeTitle}"))
 
-                  # upload podcast ###################################################
-
-                  driver.find_element(By.CSS_SELECTOR, '#audio_file').send_keys(
-                      '/tmp/podcast.mp3'
-                  )
-                  driver.find_element(By.CSS_SELECTOR, '#cover').send_keys(
-                      '${cover}'
-                  )
-                  driver.find_element(By.CSS_SELECTOR, '#description').send_keys(
-                      'Episode description'
-                  )
-                  driver.find_element(By.CSS_SELECTOR, '#title').send_keys(
-                      '${episodeTitle}'
-                  )
-                  driver.find_element(By.XPATH,
-                                      "//button[contains(., 'Create episode')]"
-                  ).click()
-
-                  wait.until(EC.title_contains("${episodeTitle}"))
-
-                  driver.close()
-                  driver.quit()
-                '';
-          in
-          [
-            pkgs.firefox-unwrapped
-            pkgs.geckodriver
-            browser-test
-            (pkgs.writeShellApplication {
-              name = "build-mp3";
-              runtimeInputs = with pkgs; [
-                sox
-                lame
-              ];
-              text = ''
-                out=/tmp/podcast.mp3
-                sox -n -r 48000 -t wav - synth ${targetPodcastDuration} sine 440 `
-                `| lame --noreplaygain --cbr -q 9 -b 320 - $out
-                FILESIZE="$(stat -c%s $out)"
-                [ "$FILESIZE" -gt 0 ]
-                [ "$FILESIZE" -le "${toString targetPodcastSize}" ]
+                driver.close()
+                driver.quit()
               '';
-            })
-          ];
-      };
+        in
+        [
+          pkgs.firefox-unwrapped
+          pkgs.geckodriver
+          browser-test
+          (pkgs.writeShellApplication {
+            name = "build-mp3";
+            runtimeInputs = with pkgs; [
+              sox
+              lame
+            ];
+            text = ''
+              out=/tmp/podcast.mp3
+              sox -n -r 48000 -t wav - synth ${targetPodcastDuration} sine 440 `
+              `| lame --noreplaygain --cbr -q 9 -b 320 - $out
+              FILESIZE="$(stat -c%s $out)"
+              [ "$FILESIZE" -gt 0 ]
+              [ "$FILESIZE" -le "${toString targetPodcastSize}" ]
+            '';
+          })
+        ];
+    };
 
-    testScript = ''
-      start_all()
-      castopod.wait_for_unit("castopod-setup.service")
-      castopod.wait_for_file("/run/phpfpm/castopod.sock")
-      castopod.wait_for_unit("nginx.service")
-      castopod.wait_for_open_port(80)
-      castopod.wait_until_succeeds("curl -sS -f http://castopod.example.com")
+  testScript = ''
+    start_all()
+    castopod.wait_for_unit("castopod-setup.service")
+    castopod.wait_for_file("/run/phpfpm/castopod.sock")
+    castopod.wait_for_unit("nginx.service")
+    castopod.wait_for_open_port(80)
+    castopod.wait_until_succeeds("curl -sS -f http://castopod.example.com")
 
-      client.succeed("build-mp3")
+    client.succeed("build-mp3")
 
-      with subtest("Create superadmin, log in, create and upload a podcast"):
-          client.succeed(\
-            "PYTHONUNBUFFERED=1 systemd-cat -t browser-test browser-test")
-    '';
-  }
-)
+    with subtest("Create superadmin, log in, create and upload a podcast"):
+        client.succeed(\
+          "PYTHONUNBUFFERED=1 systemd-cat -t browser-test browser-test")
+  '';
+}
diff --git a/nixos/tests/charliecloud.nix b/nixos/tests/charliecloud.nix
index 957ec6ea4374..abdb2d877c19 100644
--- a/nixos/tests/charliecloud.nix
+++ b/nixos/tests/charliecloud.nix
@@ -1,49 +1,47 @@
 # This test checks charliecloud image construction and run
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
+{ pkgs, ... }:
+let
 
-    dockerfile = pkgs.writeText "Dockerfile" ''
-      FROM nix
-      RUN mkdir /home /tmp
-      RUN touch /etc/passwd /etc/group
-      CMD ["true"]
-    '';
+  dockerfile = pkgs.writeText "Dockerfile" ''
+    FROM nix
+    RUN mkdir /home /tmp
+    RUN touch /etc/passwd /etc/group
+    CMD ["true"]
+  '';
 
-  in
-  {
-    name = "charliecloud";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ bzizou ];
-    };
+in
+{
+  name = "charliecloud";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ bzizou ];
+  };
 
-    nodes = {
-      host =
-        { ... }:
-        {
-          environment.systemPackages = [ pkgs.charliecloud ];
-          virtualisation.docker.enable = true;
-          users.users.alice = {
-            isNormalUser = true;
-            extraGroups = [ "docker" ];
-          };
+  nodes = {
+    host =
+      { ... }:
+      {
+        environment.systemPackages = [ pkgs.charliecloud ];
+        virtualisation.docker.enable = true;
+        users.users.alice = {
+          isNormalUser = true;
+          extraGroups = [ "docker" ];
         };
-    };
+      };
+  };
 
-    testScript = ''
-      host.start()
-      host.wait_for_unit("docker.service")
-      host.succeed(
-          'su - alice -c "docker load --input=${pkgs.dockerTools.examples.nix}"'
-      )
-      host.succeed(
-          "cp ${dockerfile} /home/alice/Dockerfile"
-      )
-      host.succeed('su - alice -c "ch-build -t hello ."')
-      host.succeed('su - alice -c "ch-builder2tar hello /var/tmp"')
-      host.succeed('su - alice -c "ch-tar2dir /var/tmp/hello.tar.gz /var/tmp"')
-      host.succeed('su - alice -c "ch-run /var/tmp/hello -- echo Running_From_Container_OK"')
-    '';
-  }
-)
+  testScript = ''
+    host.start()
+    host.wait_for_unit("docker.service")
+    host.succeed(
+        'su - alice -c "docker load --input=${pkgs.dockerTools.examples.nix}"'
+    )
+    host.succeed(
+        "cp ${dockerfile} /home/alice/Dockerfile"
+    )
+    host.succeed('su - alice -c "ch-build -t hello ."')
+    host.succeed('su - alice -c "ch-builder2tar hello /var/tmp"')
+    host.succeed('su - alice -c "ch-tar2dir /var/tmp/hello.tar.gz /var/tmp"')
+    host.succeed('su - alice -c "ch-run /var/tmp/hello -- echo Running_From_Container_OK"')
+  '';
+}
diff --git a/nixos/tests/cinnamon-wayland.nix b/nixos/tests/cinnamon-wayland.nix
index 1b472f863099..a80199956cc2 100644
--- a/nixos/tests/cinnamon-wayland.nix
+++ b/nixos/tests/cinnamon-wayland.nix
@@ -1,84 +1,82 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "cinnamon-wayland";
+{ pkgs, lib, ... }:
+{
+  name = "cinnamon-wayland";
 
-    meta.maintainers = lib.teams.cinnamon.members;
+  meta.maintainers = lib.teams.cinnamon.members;
 
-    nodes.machine =
-      { nodes, ... }:
-      {
-        imports = [ ./common/user-account.nix ];
-        services.xserver.enable = true;
-        services.xserver.desktopManager.cinnamon.enable = true;
-        services.displayManager = {
-          autoLogin.enable = true;
-          autoLogin.user = nodes.machine.users.users.alice.name;
-          defaultSession = "cinnamon-wayland";
-        };
-
-        # For the sessionPath subtest.
-        services.xserver.desktopManager.cinnamon.sessionPath = [ pkgs.gpaste ];
+  nodes.machine =
+    { nodes, ... }:
+    {
+      imports = [ ./common/user-account.nix ];
+      services.xserver.enable = true;
+      services.xserver.desktopManager.cinnamon.enable = true;
+      services.displayManager = {
+        autoLogin.enable = true;
+        autoLogin.user = nodes.machine.users.users.alice.name;
+        defaultSession = "cinnamon-wayland";
       };
 
-    enableOCR = true;
+      # For the sessionPath subtest.
+      services.xserver.desktopManager.cinnamon.sessionPath = [ pkgs.gpaste ];
+    };
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-        env = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus";
-        su = command: "su - ${user.name} -c '${env} ${command}'";
+  enableOCR = true;
 
-        # Call javascript in cinnamon (the shell), returns a tuple (success, output),
-        # where `success` is true if the dbus call was successful and `output` is what
-        # the javascript evaluates to.
-        eval =
-          name: su "gdbus call --session -d org.Cinnamon -o /org/Cinnamon -m org.Cinnamon.Eval ${name}";
-      in
-      ''
-        machine.wait_for_unit("display-manager.service")
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+      env = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus";
+      su = command: "su - ${user.name} -c '${env} ${command}'";
 
-        with subtest("Wait for wayland server"):
-            machine.wait_for_file("/run/user/${toString user.uid}/wayland-0")
+      # Call javascript in cinnamon (the shell), returns a tuple (success, output),
+      # where `success` is true if the dbus call was successful and `output` is what
+      # the javascript evaluates to.
+      eval =
+        name: su "gdbus call --session -d org.Cinnamon -o /org/Cinnamon -m org.Cinnamon.Eval ${name}";
+    in
+    ''
+      machine.wait_for_unit("display-manager.service")
 
-        with subtest("Check that logging in has given the user ownership of devices"):
-            machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+      with subtest("Wait for wayland server"):
+          machine.wait_for_file("/run/user/${toString user.uid}/wayland-0")
 
-        with subtest("Wait for the Cinnamon shell"):
-            # Correct output should be (true, '2')
-            # https://github.com/linuxmint/cinnamon/blob/5.4.0/js/ui/main.js#L183-L187
-            machine.wait_until_succeeds("${eval "Main.runState"} | grep -q 'true,..2'")
+      with subtest("Check that logging in has given the user ownership of devices"):
+          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
 
-        with subtest("Check if Cinnamon components actually start"):
-            for i in ["csd-media-keys", "xapp-sn-watcher", "nemo-desktop"]:
-              machine.wait_until_succeeds(f"pgrep -f {i}")
-            machine.wait_until_succeeds("journalctl -b --grep 'Loaded applet menu@cinnamon.org'")
-            machine.wait_until_succeeds("journalctl -b --grep 'calendar@cinnamon.org: Calendar events supported'")
+      with subtest("Wait for the Cinnamon shell"):
+          # Correct output should be (true, '2')
+          # https://github.com/linuxmint/cinnamon/blob/5.4.0/js/ui/main.js#L183-L187
+          machine.wait_until_succeeds("${eval "Main.runState"} | grep -q 'true,..2'")
 
-        with subtest("Check if sessionPath option actually works"):
-            machine.succeed("${eval "imports.gi.GIRepository.Repository.get_search_path\\(\\)"} | grep gpaste")
+      with subtest("Check if Cinnamon components actually start"):
+          for i in ["csd-media-keys", "xapp-sn-watcher", "nemo-desktop"]:
+            machine.wait_until_succeeds(f"pgrep -f {i}")
+          machine.wait_until_succeeds("journalctl -b --grep 'Loaded applet menu@cinnamon.org'")
+          machine.wait_until_succeeds("journalctl -b --grep 'calendar@cinnamon.org: Calendar events supported'")
 
-        with subtest("Open Cinnamon Settings"):
-            machine.succeed("${su "cinnamon-settings themes >&2 &"}")
-            machine.wait_until_succeeds("${eval "global.display.focus_window.wm_class"} | grep -i 'cinnamon-settings'")
-            machine.wait_for_text('(Style|Appearance|Color)')
-            machine.sleep(2)
-            machine.screenshot("cinnamon_settings")
+      with subtest("Check if sessionPath option actually works"):
+          machine.succeed("${eval "imports.gi.GIRepository.Repository.get_search_path\\(\\)"} | grep gpaste")
 
-        with subtest("Check if screensaver works"):
-            # This is not supported at the moment.
-            # https://trello.com/b/HHs01Pab/cinnamon-wayland
-            machine.execute("${su "cinnamon-screensaver-command -l >&2 &"}")
-            machine.wait_until_succeeds("journalctl -b --grep 'cinnamon-screensaver is disabled in wayland sessions'")
+      with subtest("Open Cinnamon Settings"):
+          machine.succeed("${su "cinnamon-settings themes >&2 &"}")
+          machine.wait_until_succeeds("${eval "global.display.focus_window.wm_class"} | grep -i 'cinnamon-settings'")
+          machine.wait_for_text('(Style|Appearance|Color)')
+          machine.sleep(2)
+          machine.screenshot("cinnamon_settings")
 
-        with subtest("Open GNOME Terminal"):
-            machine.succeed("${su "dbus-launch gnome-terminal"}")
-            machine.wait_until_succeeds("${eval "global.display.focus_window.wm_class"} | grep -i 'gnome-terminal'")
-            machine.sleep(2)
+      with subtest("Check if screensaver works"):
+          # This is not supported at the moment.
+          # https://trello.com/b/HHs01Pab/cinnamon-wayland
+          machine.execute("${su "cinnamon-screensaver-command -l >&2 &"}")
+          machine.wait_until_succeeds("journalctl -b --grep 'cinnamon-screensaver is disabled in wayland sessions'")
 
-        with subtest("Check if Cinnamon has ever coredumped"):
-            machine.fail("coredumpctl --json=short | grep -E 'cinnamon|nemo'")
-      '';
-  }
-)
+      with subtest("Open GNOME Terminal"):
+          machine.succeed("${su "dbus-launch gnome-terminal"}")
+          machine.wait_until_succeeds("${eval "global.display.focus_window.wm_class"} | grep -i 'gnome-terminal'")
+          machine.sleep(2)
+
+      with subtest("Check if Cinnamon has ever coredumped"):
+          machine.fail("coredumpctl --json=short | grep -E 'cinnamon|nemo'")
+    '';
+}
diff --git a/nixos/tests/cinnamon.nix b/nixos/tests/cinnamon.nix
index 34777f8ee7b2..3230d7b07358 100644
--- a/nixos/tests/cinnamon.nix
+++ b/nixos/tests/cinnamon.nix
@@ -1,104 +1,102 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "cinnamon";
+{ pkgs, lib, ... }:
+{
+  name = "cinnamon";
 
-    meta.maintainers = lib.teams.cinnamon.members;
+  meta.maintainers = lib.teams.cinnamon.members;
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ./common/user-account.nix ];
-        services.xserver.enable = true;
-        services.xserver.desktopManager.cinnamon.enable = true;
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ./common/user-account.nix ];
+      services.xserver.enable = true;
+      services.xserver.desktopManager.cinnamon.enable = true;
 
-        # We don't ship gnome-text-editor in Cinnamon module, we add this line mainly
-        # to catch eval issues related to this option.
-        environment.cinnamon.excludePackages = [ pkgs.gnome-text-editor ];
+      # We don't ship gnome-text-editor in Cinnamon module, we add this line mainly
+      # to catch eval issues related to this option.
+      environment.cinnamon.excludePackages = [ pkgs.gnome-text-editor ];
 
-        # For the sessionPath subtest.
-        services.xserver.desktopManager.cinnamon.sessionPath = [ pkgs.gpaste ];
+      # For the sessionPath subtest.
+      services.xserver.desktopManager.cinnamon.sessionPath = [ pkgs.gpaste ];
 
-        # For OCR test.
-        services.xserver.displayManager.lightdm.greeters.slick.extraConfig = ''
-          enable-hidpi = on
-        '';
-      };
-
-    enableOCR = true;
-
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-        env = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus DISPLAY=:0";
-        su = command: "su - ${user.name} -c '${env} ${command}'";
-
-        # Call javascript in cinnamon (the shell), returns a tuple (success, output),
-        # where `success` is true if the dbus call was successful and `output` is what
-        # the javascript evaluates to.
-        eval =
-          name: su "gdbus call --session -d org.Cinnamon -o /org/Cinnamon -m org.Cinnamon.Eval ${name}";
-      in
-      ''
-        machine.wait_for_unit("display-manager.service")
-
-        with subtest("Test if we can see username in slick-greeter"):
-            machine.wait_for_text("${user.description}")
-            machine.screenshot("slick_greeter_lightdm")
-
-        with subtest("Login with slick-greeter"):
-            machine.send_chars("${user.password}\n")
-            machine.wait_for_x()
-            machine.wait_for_file("${user.home}/.Xauthority")
-            machine.succeed("xauth merge ${user.home}/.Xauthority")
-
-        with subtest("Check that logging in has given the user ownership of devices"):
-            machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
-
-        with subtest("Wait for the Cinnamon shell"):
-            # Correct output should be (true, '2')
-            # https://github.com/linuxmint/cinnamon/blob/5.4.0/js/ui/main.js#L183-L187
-            machine.wait_until_succeeds("${eval "Main.runState"} | grep -q 'true,..2'")
-
-        with subtest("Check if Cinnamon components actually start"):
-            for i in ["csd-media-keys", "cinnamon-killer-daemon", "xapp-sn-watcher", "nemo-desktop"]:
-              machine.wait_until_succeeds(f"pgrep -f {i}")
-            machine.wait_until_succeeds("journalctl -b --grep 'Loaded applet menu@cinnamon.org'")
-            machine.wait_until_succeeds("journalctl -b --grep 'calendar@cinnamon.org: Calendar events supported'")
-
-        with subtest("Check if sessionPath option actually works"):
-            machine.succeed("${eval "imports.gi.GIRepository.Repository.get_search_path\\(\\)"} | grep gpaste")
-
-        with subtest("Open Cinnamon Settings"):
-            machine.succeed("${su "cinnamon-settings themes >&2 &"}")
-            machine.wait_until_succeeds("${eval "global.display.focus_window.wm_class"} | grep -i 'cinnamon-settings'")
-            machine.wait_for_text('(Style|Appearance|Color)')
-            machine.sleep(2)
-            machine.screenshot("cinnamon_settings")
-
-        with subtest("Lock the screen"):
-            machine.succeed("${su "cinnamon-screensaver-command -l >&2 &"}")
-            machine.wait_until_succeeds("${su "cinnamon-screensaver-command -q"} | grep 'The screensaver is active'")
-            machine.sleep(2)
-            machine.screenshot("cinnamon_screensaver")
-            machine.send_chars("${user.password}\n", delay=0.2)
-            machine.wait_until_succeeds("${su "cinnamon-screensaver-command -q"} | grep 'The screensaver is inactive'")
-            machine.sleep(2)
-
-        with subtest("Open GNOME Terminal"):
-            machine.succeed("${su "gnome-terminal"}")
-            machine.wait_until_succeeds("${eval "global.display.focus_window.wm_class"} | grep -i 'gnome-terminal'")
-            machine.sleep(2)
-
-        with subtest("Open virtual keyboard"):
-            machine.succeed("${su "dbus-send --print-reply --dest=org.Cinnamon /org/Cinnamon org.Cinnamon.ToggleKeyboard"}")
-            machine.wait_for_text('(Ctrl|Alt)')
-            machine.sleep(2)
-            machine.screenshot("cinnamon_virtual_keyboard")
-
-        with subtest("Check if Cinnamon has ever coredumped"):
-            machine.fail("coredumpctl --json=short | grep -E 'cinnamon|nemo'")
+      # For OCR test.
+      services.xserver.displayManager.lightdm.greeters.slick.extraConfig = ''
+        enable-hidpi = on
       '';
-  }
-)
+    };
+
+  enableOCR = true;
+
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+      env = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus DISPLAY=:0";
+      su = command: "su - ${user.name} -c '${env} ${command}'";
+
+      # Call javascript in cinnamon (the shell), returns a tuple (success, output),
+      # where `success` is true if the dbus call was successful and `output` is what
+      # the javascript evaluates to.
+      eval =
+        name: su "gdbus call --session -d org.Cinnamon -o /org/Cinnamon -m org.Cinnamon.Eval ${name}";
+    in
+    ''
+      machine.wait_for_unit("display-manager.service")
+
+      with subtest("Test if we can see username in slick-greeter"):
+          machine.wait_for_text("${user.description}")
+          machine.screenshot("slick_greeter_lightdm")
+
+      with subtest("Login with slick-greeter"):
+          machine.send_chars("${user.password}\n")
+          machine.wait_for_x()
+          machine.wait_for_file("${user.home}/.Xauthority")
+          machine.succeed("xauth merge ${user.home}/.Xauthority")
+
+      with subtest("Check that logging in has given the user ownership of devices"):
+          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+
+      with subtest("Wait for the Cinnamon shell"):
+          # Correct output should be (true, '2')
+          # https://github.com/linuxmint/cinnamon/blob/5.4.0/js/ui/main.js#L183-L187
+          machine.wait_until_succeeds("${eval "Main.runState"} | grep -q 'true,..2'")
+
+      with subtest("Check if Cinnamon components actually start"):
+          for i in ["csd-media-keys", "cinnamon-killer-daemon", "xapp-sn-watcher", "nemo-desktop"]:
+            machine.wait_until_succeeds(f"pgrep -f {i}")
+          machine.wait_until_succeeds("journalctl -b --grep 'Loaded applet menu@cinnamon.org'")
+          machine.wait_until_succeeds("journalctl -b --grep 'calendar@cinnamon.org: Calendar events supported'")
+
+      with subtest("Check if sessionPath option actually works"):
+          machine.succeed("${eval "imports.gi.GIRepository.Repository.get_search_path\\(\\)"} | grep gpaste")
+
+      with subtest("Open Cinnamon Settings"):
+          machine.succeed("${su "cinnamon-settings themes >&2 &"}")
+          machine.wait_until_succeeds("${eval "global.display.focus_window.wm_class"} | grep -i 'cinnamon-settings'")
+          machine.wait_for_text('(Style|Appearance|Color)')
+          machine.sleep(2)
+          machine.screenshot("cinnamon_settings")
+
+      with subtest("Lock the screen"):
+          machine.succeed("${su "cinnamon-screensaver-command -l >&2 &"}")
+          machine.wait_until_succeeds("${su "cinnamon-screensaver-command -q"} | grep 'The screensaver is active'")
+          machine.sleep(2)
+          machine.screenshot("cinnamon_screensaver")
+          machine.send_chars("${user.password}\n", delay=0.2)
+          machine.wait_until_succeeds("${su "cinnamon-screensaver-command -q"} | grep 'The screensaver is inactive'")
+          machine.sleep(2)
+
+      with subtest("Open GNOME Terminal"):
+          machine.succeed("${su "gnome-terminal"}")
+          machine.wait_until_succeeds("${eval "global.display.focus_window.wm_class"} | grep -i 'gnome-terminal'")
+          machine.sleep(2)
+
+      with subtest("Open virtual keyboard"):
+          machine.succeed("${su "dbus-send --print-reply --dest=org.Cinnamon /org/Cinnamon org.Cinnamon.ToggleKeyboard"}")
+          machine.wait_for_text('(Ctrl|Alt)')
+          machine.sleep(2)
+          machine.screenshot("cinnamon_virtual_keyboard")
+
+      with subtest("Check if Cinnamon has ever coredumped"):
+          machine.fail("coredumpctl --json=short | grep -E 'cinnamon|nemo'")
+    '';
+}
diff --git a/nixos/tests/cjdns.nix b/nixos/tests/cjdns.nix
index 7fdb30a0abe6..52762f853e20 100644
--- a/nixos/tests/cjdns.nix
+++ b/nixos/tests/cjdns.nix
@@ -18,117 +18,115 @@ let
 
 in
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "cjdns";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ehmry ];
-    };
+{ pkgs, ... }:
+{
+  name = "cjdns";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ehmry ];
+  };
 
-    nodes = {
-      # Alice finds peers over over ETHInterface.
-      alice =
-        { ... }:
-        {
-          imports = [ basicConfig ];
+  nodes = {
+    # Alice finds peers over over ETHInterface.
+    alice =
+      { ... }:
+      {
+        imports = [ basicConfig ];
 
-          services.cjdns.ETHInterface.bind = "eth1";
+        services.cjdns.ETHInterface.bind = "eth1";
 
-          services.httpd.enable = true;
-          services.httpd.adminAddr = "foo@example.org";
-          networking.firewall.allowedTCPPorts = [ 80 ];
-        };
+        services.httpd.enable = true;
+        services.httpd.adminAddr = "foo@example.org";
+        networking.firewall.allowedTCPPorts = [ 80 ];
+      };
 
-      # Bob explicitly connects to Carol over UDPInterface.
-      bob =
-        { ... }:
+    # Bob explicitly connects to Carol over UDPInterface.
+    bob =
+      { ... }:
 
-        {
-          imports = [ basicConfig ];
+      {
+        imports = [ basicConfig ];
 
-          networking.interfaces.eth1.ipv4.addresses = [
-            {
-              address = "192.168.0.2";
-              prefixLength = 24;
-            }
-          ];
+        networking.interfaces.eth1.ipv4.addresses = [
+          {
+            address = "192.168.0.2";
+            prefixLength = 24;
+          }
+        ];
 
-          services.cjdns = {
-            UDPInterface = {
-              bind = "0.0.0.0:1024";
-              connectTo."192.168.0.1:1024" = {
-                password = carolPassword;
-                publicKey = carolPubKey;
-              };
+        services.cjdns = {
+          UDPInterface = {
+            bind = "0.0.0.0:1024";
+            connectTo."192.168.0.1:1024" = {
+              password = carolPassword;
+              publicKey = carolPubKey;
             };
           };
         };
+      };
 
-      # Carol listens on ETHInterface and UDPInterface,
-      # but knows neither Alice or Bob.
-      carol =
-        { ... }:
-        {
-          imports = [ basicConfig ];
+    # Carol listens on ETHInterface and UDPInterface,
+    # but knows neither Alice or Bob.
+    carol =
+      { ... }:
+      {
+        imports = [ basicConfig ];
 
-          environment.etc."cjdns.keys".text = ''
-            CJDNS_PRIVATE_KEY=${carolKey}
-            CJDNS_ADMIN_PASSWORD=FOOBAR
-          '';
+        environment.etc."cjdns.keys".text = ''
+          CJDNS_PRIVATE_KEY=${carolKey}
+          CJDNS_ADMIN_PASSWORD=FOOBAR
+        '';
 
-          networking.interfaces.eth1.ipv4.addresses = [
-            {
-              address = "192.168.0.1";
-              prefixLength = 24;
-            }
-          ];
+        networking.interfaces.eth1.ipv4.addresses = [
+          {
+            address = "192.168.0.1";
+            prefixLength = 24;
+          }
+        ];
 
-          services.cjdns = {
-            authorizedPasswords = [ carolPassword ];
-            ETHInterface.bind = "eth1";
-            UDPInterface.bind = "192.168.0.1:1024";
-          };
-          networking.firewall.allowedUDPPorts = [ 1024 ];
+        services.cjdns = {
+          authorizedPasswords = [ carolPassword ];
+          ETHInterface.bind = "eth1";
+          UDPInterface.bind = "192.168.0.1:1024";
         };
+        networking.firewall.allowedUDPPorts = [ 1024 ];
+      };
 
-    };
+  };
 
-    testScript = ''
-      import re
+  testScript = ''
+    import re
 
-      start_all()
+    start_all()
 
-      alice.wait_for_unit("cjdns.service")
-      bob.wait_for_unit("cjdns.service")
-      carol.wait_for_unit("cjdns.service")
+    alice.wait_for_unit("cjdns.service")
+    bob.wait_for_unit("cjdns.service")
+    carol.wait_for_unit("cjdns.service")
 
 
-      def cjdns_ip(machine):
-          res = machine.succeed("ip -o -6 addr show dev tun0")
-          ip = re.split("\s+|/", res)[3]
-          machine.log("has ip {}".format(ip))
-          return ip
+    def cjdns_ip(machine):
+        res = machine.succeed("ip -o -6 addr show dev tun0")
+        ip = re.split("\s+|/", res)[3]
+        machine.log("has ip {}".format(ip))
+        return ip
 
 
-      alice_ip6 = cjdns_ip(alice)
-      bob_ip6 = cjdns_ip(bob)
-      carol_ip6 = cjdns_ip(carol)
+    alice_ip6 = cjdns_ip(alice)
+    bob_ip6 = cjdns_ip(bob)
+    carol_ip6 = cjdns_ip(carol)
 
-      # ping a few times each to let the routing table establish itself
+    # ping a few times each to let the routing table establish itself
 
-      alice.succeed("ping -c 4 {}".format(carol_ip6))
-      bob.succeed("ping -c 4 {}".format(carol_ip6))
+    alice.succeed("ping -c 4 {}".format(carol_ip6))
+    bob.succeed("ping -c 4 {}".format(carol_ip6))
 
-      carol.succeed("ping -c 4 {}".format(alice_ip6))
-      carol.succeed("ping -c 4 {}".format(bob_ip6))
+    carol.succeed("ping -c 4 {}".format(alice_ip6))
+    carol.succeed("ping -c 4 {}".format(bob_ip6))
 
-      alice.succeed("ping -c 4 {}".format(bob_ip6))
-      bob.succeed("ping -c 4 {}".format(alice_ip6))
+    alice.succeed("ping -c 4 {}".format(bob_ip6))
+    bob.succeed("ping -c 4 {}".format(alice_ip6))
 
-      alice.wait_for_unit("httpd.service")
+    alice.wait_for_unit("httpd.service")
 
-      bob.succeed("curl --fail -g http://[{}]".format(alice_ip6))
-    '';
-  }
-)
+    bob.succeed("curl --fail -g http://[{}]".format(alice_ip6))
+  '';
+}
diff --git a/nixos/tests/clickhouse.nix b/nixos/tests/clickhouse.nix
index 80868c04e9e4..165f00a1ec4e 100644
--- a/nixos/tests/clickhouse.nix
+++ b/nixos/tests/clickhouse.nix
@@ -1,35 +1,33 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "clickhouse";
-    meta.maintainers = with pkgs.lib.maintainers; [ ];
+{ pkgs, ... }:
+{
+  name = "clickhouse";
+  meta.maintainers = with pkgs.lib.maintainers; [ ];
 
-    nodes.machine = {
-      services.clickhouse.enable = true;
-      virtualisation.memorySize = 4096;
-    };
+  nodes.machine = {
+    services.clickhouse.enable = true;
+    virtualisation.memorySize = 4096;
+  };
 
-    testScript =
-      let
-        # work around quote/substitution complexity by Nix, Perl, bash and SQL.
-        tableDDL = pkgs.writeText "ddl.sql" "CREATE TABLE `demo` (`value` FixedString(10)) engine = MergeTree PARTITION BY value ORDER BY tuple();";
-        insertQuery = pkgs.writeText "insert.sql" "INSERT INTO `demo` (`value`) VALUES ('foo');";
-        selectQuery = pkgs.writeText "select.sql" "SELECT * from `demo`";
-      in
-      ''
-        machine.start()
-        machine.wait_for_unit("clickhouse.service")
-        machine.wait_for_open_port(9000)
+  testScript =
+    let
+      # work around quote/substitution complexity by Nix, Perl, bash and SQL.
+      tableDDL = pkgs.writeText "ddl.sql" "CREATE TABLE `demo` (`value` FixedString(10)) engine = MergeTree PARTITION BY value ORDER BY tuple();";
+      insertQuery = pkgs.writeText "insert.sql" "INSERT INTO `demo` (`value`) VALUES ('foo');";
+      selectQuery = pkgs.writeText "select.sql" "SELECT * from `demo`";
+    in
+    ''
+      machine.start()
+      machine.wait_for_unit("clickhouse.service")
+      machine.wait_for_open_port(9000)
 
-        machine.succeed(
-            "cat ${tableDDL} | clickhouse-client"
-        )
-        machine.succeed(
-            "cat ${insertQuery} | clickhouse-client"
-        )
-        machine.succeed(
-            "cat ${selectQuery} | clickhouse-client | grep foo"
-        )
-      '';
-  }
-)
+      machine.succeed(
+          "cat ${tableDDL} | clickhouse-client"
+      )
+      machine.succeed(
+          "cat ${insertQuery} | clickhouse-client"
+      )
+      machine.succeed(
+          "cat ${selectQuery} | clickhouse-client | grep foo"
+      )
+    '';
+}
diff --git a/nixos/tests/cloudlog.nix b/nixos/tests/cloudlog.nix
index b49d1929f80c..94be4d241f1b 100644
--- a/nixos/tests/cloudlog.nix
+++ b/nixos/tests/cloudlog.nix
@@ -1,21 +1,19 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "cloudlog";
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ melling ];
+{ pkgs, ... }:
+{
+  name = "cloudlog";
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ melling ];
+  };
+  nodes = {
+    machine = {
+      services.mysql.package = pkgs.mariadb;
+      services.cloudlog.enable = true;
     };
-    nodes = {
-      machine = {
-        services.mysql.package = pkgs.mariadb;
-        services.cloudlog.enable = true;
-      };
-    };
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("phpfpm-cloudlog")
-      machine.wait_for_open_port(80);
-      machine.wait_until_succeeds("curl -s -L --fail http://localhost | grep 'Login - Cloudlog'")
-    '';
-  }
-)
+  };
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("phpfpm-cloudlog")
+    machine.wait_for_open_port(80);
+    machine.wait_until_succeeds("curl -s -L --fail http://localhost | grep 'Login - Cloudlog'")
+  '';
+}
diff --git a/nixos/tests/cockpit.nix b/nixos/tests/cockpit.nix
index 29692f10aad2..b05c4b4dc93d 100644
--- a/nixos/tests/cockpit.nix
+++ b/nixos/tests/cockpit.nix
@@ -1,156 +1,154 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    user = "alice"; # from ./common/user-account.nix
-    password = "foobar"; # from ./common/user-account.nix
-  in
-  {
-    name = "cockpit";
-    meta = {
-      maintainers = with lib.maintainers; [ lucasew ];
-    };
-    nodes = {
-      server =
-        { config, ... }:
-        {
-          imports = [ ./common/user-account.nix ];
-          security.polkit.enable = true;
-          users.users.${user} = {
-            extraGroups = [ "wheel" ];
-          };
-          services.cockpit = {
-            enable = true;
-            port = 7890;
-            openFirewall = true;
-            allowed-origins = [
-              "https://server:${toString config.services.cockpit.port}"
-            ];
-          };
+let
+  user = "alice"; # from ./common/user-account.nix
+  password = "foobar"; # from ./common/user-account.nix
+in
+{
+  name = "cockpit";
+  meta = {
+    maintainers = with lib.maintainers; [ lucasew ];
+  };
+  nodes = {
+    server =
+      { config, ... }:
+      {
+        imports = [ ./common/user-account.nix ];
+        security.polkit.enable = true;
+        users.users.${user} = {
+          extraGroups = [ "wheel" ];
         };
-      client =
-        { config, ... }:
-        {
-          imports = [ ./common/user-account.nix ];
-          environment.systemPackages =
-            let
-              seleniumScript =
-                pkgs.writers.writePython3Bin "selenium-script"
-                  {
-                    libraries = with pkgs.python3Packages; [ selenium ];
-                  }
-                  ''
-                    from selenium import webdriver
-                    from selenium.webdriver.common.by import By
-                    from selenium.webdriver.firefox.options import Options
-                    from selenium.webdriver.support.ui import WebDriverWait
-                    from selenium.webdriver.support import expected_conditions as EC
-                    from time import sleep
-
-
-                    def log(msg):
-                        from sys import stderr
-                        print(f"[*] {msg}", file=stderr)
-
-
-                    log("Initializing")
-
-                    options = Options()
-                    options.add_argument("--headless")
-
-                    service = webdriver.FirefoxService(executable_path="${lib.getExe pkgs.geckodriver}")  # noqa: E501
-                    driver = webdriver.Firefox(options=options, service=service)
-
-                    driver.implicitly_wait(10)
-
-                    log("Opening homepage")
-                    driver.get("https://server:7890")
-
-
-                    def wait_elem(by, query, timeout=10):
-                        wait = WebDriverWait(driver, timeout)
-                        wait.until(EC.presence_of_element_located((by, query)))
-
-
-                    def wait_title_contains(title, timeout=10):
-                        wait = WebDriverWait(driver, timeout)
-                        wait.until(EC.title_contains(title))
-
-
-                    def find_element(by, query):
-                        return driver.find_element(by, query)
-
-
-                    def set_value(elem, value):
-                        script = 'arguments[0].value = arguments[1]'
-                        return driver.execute_script(script, elem, value)
-
-
-                    log("Waiting for the homepage to load")
-
-                    # cockpit sets initial title as hostname
-                    wait_title_contains("server")
-                    wait_elem(By.CSS_SELECTOR, 'input#login-user-input')
-
-                    log("Homepage loaded!")
-
-                    log("Filling out username")
-                    login_input = find_element(By.CSS_SELECTOR, 'input#login-user-input')
-                    set_value(login_input, "${user}")
-
-                    log("Filling out password")
-                    password_input = find_element(By.CSS_SELECTOR, 'input#login-password-input')
-                    set_value(password_input, "${password}")
-
-                    log("Submitting credentials for login")
-                    driver.find_element(By.CSS_SELECTOR, 'button#login-button').click()
-
-                    # driver.implicitly_wait(1)
-                    # driver.get("https://server:7890/system")
-
-                    log("Waiting dashboard to load")
-                    wait_title_contains("${user}@server")
-
-                    log("Waiting for the frontend to initialize")
-                    sleep(1)
-
-                    log("Looking for that banner that tells about limited access")
-                    container_iframe = find_element(By.CSS_SELECTOR, 'iframe.container-frame')
-                    driver.switch_to.frame(container_iframe)
-
-                    assert "Web console is running in limited access mode" in driver.page_source
-
-                    log("Clicking the sudo button")
-                    for button in driver.find_elements(By.TAG_NAME, "button"):
-                        if 'admin' in button.text:
-                            button.click()
-                    driver.switch_to.default_content()
-
-                    log("Checking that /nonexistent is not a thing")
-                    assert '/nonexistent' not in driver.page_source
-                    assert len(driver.find_elements(By.CSS_SELECTOR, '#machine-reconnect')) == 0
-
-                    driver.close()
-                  '';
-            in
-            with pkgs;
-            [
-              firefox-unwrapped
-              geckodriver
-              seleniumScript
-            ];
+        services.cockpit = {
+          enable = true;
+          port = 7890;
+          openFirewall = true;
+          allowed-origins = [
+            "https://server:${toString config.services.cockpit.port}"
+          ];
         };
-    };
+      };
+    client =
+      { config, ... }:
+      {
+        imports = [ ./common/user-account.nix ];
+        environment.systemPackages =
+          let
+            seleniumScript =
+              pkgs.writers.writePython3Bin "selenium-script"
+                {
+                  libraries = with pkgs.python3Packages; [ selenium ];
+                }
+                ''
+                  from selenium import webdriver
+                  from selenium.webdriver.common.by import By
+                  from selenium.webdriver.firefox.options import Options
+                  from selenium.webdriver.support.ui import WebDriverWait
+                  from selenium.webdriver.support import expected_conditions as EC
+                  from time import sleep
 
-    testScript = ''
-      start_all()
 
-      server.wait_for_unit("sockets.target")
-      server.wait_for_open_port(7890)
+                  def log(msg):
+                      from sys import stderr
+                      print(f"[*] {msg}", file=stderr)
 
-      client.succeed("curl -k https://server:7890 -o /dev/stderr")
-      print(client.succeed("whoami"))
-      client.succeed('PYTHONUNBUFFERED=1 selenium-script')
-    '';
-  }
-)
+
+                  log("Initializing")
+
+                  options = Options()
+                  options.add_argument("--headless")
+
+                  service = webdriver.FirefoxService(executable_path="${lib.getExe pkgs.geckodriver}")  # noqa: E501
+                  driver = webdriver.Firefox(options=options, service=service)
+
+                  driver.implicitly_wait(10)
+
+                  log("Opening homepage")
+                  driver.get("https://server:7890")
+
+
+                  def wait_elem(by, query, timeout=10):
+                      wait = WebDriverWait(driver, timeout)
+                      wait.until(EC.presence_of_element_located((by, query)))
+
+
+                  def wait_title_contains(title, timeout=10):
+                      wait = WebDriverWait(driver, timeout)
+                      wait.until(EC.title_contains(title))
+
+
+                  def find_element(by, query):
+                      return driver.find_element(by, query)
+
+
+                  def set_value(elem, value):
+                      script = 'arguments[0].value = arguments[1]'
+                      return driver.execute_script(script, elem, value)
+
+
+                  log("Waiting for the homepage to load")
+
+                  # cockpit sets initial title as hostname
+                  wait_title_contains("server")
+                  wait_elem(By.CSS_SELECTOR, 'input#login-user-input')
+
+                  log("Homepage loaded!")
+
+                  log("Filling out username")
+                  login_input = find_element(By.CSS_SELECTOR, 'input#login-user-input')
+                  set_value(login_input, "${user}")
+
+                  log("Filling out password")
+                  password_input = find_element(By.CSS_SELECTOR, 'input#login-password-input')
+                  set_value(password_input, "${password}")
+
+                  log("Submitting credentials for login")
+                  driver.find_element(By.CSS_SELECTOR, 'button#login-button').click()
+
+                  # driver.implicitly_wait(1)
+                  # driver.get("https://server:7890/system")
+
+                  log("Waiting dashboard to load")
+                  wait_title_contains("${user}@server")
+
+                  log("Waiting for the frontend to initialize")
+                  sleep(1)
+
+                  log("Looking for that banner that tells about limited access")
+                  container_iframe = find_element(By.CSS_SELECTOR, 'iframe.container-frame')
+                  driver.switch_to.frame(container_iframe)
+
+                  assert "Web console is running in limited access mode" in driver.page_source
+
+                  log("Clicking the sudo button")
+                  for button in driver.find_elements(By.TAG_NAME, "button"):
+                      if 'admin' in button.text:
+                          button.click()
+                  driver.switch_to.default_content()
+
+                  log("Checking that /nonexistent is not a thing")
+                  assert '/nonexistent' not in driver.page_source
+                  assert len(driver.find_elements(By.CSS_SELECTOR, '#machine-reconnect')) == 0
+
+                  driver.close()
+                '';
+          in
+          with pkgs;
+          [
+            firefox-unwrapped
+            geckodriver
+            seleniumScript
+          ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("sockets.target")
+    server.wait_for_open_port(7890)
+
+    client.succeed("curl -k https://server:7890 -o /dev/stderr")
+    print(client.succeed("whoami"))
+    client.succeed('PYTHONUNBUFFERED=1 selenium-script')
+  '';
+}
diff --git a/nixos/tests/code-server.nix b/nixos/tests/code-server.nix
index d58a0faee104..e4c9c8397740 100644
--- a/nixos/tests/code-server.nix
+++ b/nixos/tests/code-server.nix
@@ -1,26 +1,24 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "code-server";
+{ pkgs, lib, ... }:
+{
+  name = "code-server";
 
-    nodes = {
-      machine =
-        { pkgs, ... }:
-        {
-          services.code-server = {
-            enable = true;
-            auth = "none";
-          };
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.code-server = {
+          enable = true;
+          auth = "none";
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("code-server.service")
-      machine.wait_for_open_port(4444)
-      machine.succeed("curl -k --fail http://localhost:4444", timeout=10)
-    '';
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("code-server.service")
+    machine.wait_for_open_port(4444)
+    machine.succeed("curl -k --fail http://localhost:4444", timeout=10)
+  '';
 
-    meta.maintainers = [ lib.maintainers.drupol ];
-  }
-)
+  meta.maintainers = [ lib.maintainers.drupol ];
+}
diff --git a/nixos/tests/coder.nix b/nixos/tests/coder.nix
index 8bbba5d900c0..9b0b2c334a0b 100644
--- a/nixos/tests/coder.nix
+++ b/nixos/tests/coder.nix
@@ -1,25 +1,23 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "coder";
-    meta.maintainers = pkgs.coder.meta.maintainers;
+{ pkgs, ... }:
+{
+  name = "coder";
+  meta.maintainers = pkgs.coder.meta.maintainers;
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.coder = {
-          enable = true;
-          accessUrl = "http://localhost:3000";
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.coder = {
+        enable = true;
+        accessUrl = "http://localhost:3000";
       };
+    };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("postgresql.service")
-      machine.wait_for_unit("coder.service")
-      machine.wait_for_open_port(3000)
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("postgresql.service")
+    machine.wait_for_unit("coder.service")
+    machine.wait_for_open_port(3000)
 
-      machine.succeed("curl --fail http://localhost:3000")
-    '';
-  }
-)
+    machine.succeed("curl --fail http://localhost:3000")
+  '';
+}
diff --git a/nixos/tests/collectd.nix b/nixos/tests/collectd.nix
index 31d4689f1efe..7f99bff111e5 100644
--- a/nixos/tests/collectd.nix
+++ b/nixos/tests/collectd.nix
@@ -1,41 +1,39 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "collectd";
-    meta = { };
+{ pkgs, ... }:
+{
+  name = "collectd";
+  meta = { };
 
-    nodes.machine =
-      { pkgs, lib, ... }:
+  nodes.machine =
+    { pkgs, lib, ... }:
 
-      {
-        services.collectd = {
-          enable = true;
-          extraConfig = lib.mkBefore ''
-            Interval 30
+    {
+      services.collectd = {
+        enable = true;
+        extraConfig = lib.mkBefore ''
+          Interval 30
+        '';
+        plugins = {
+          rrdtool = ''
+            DataDir "/var/lib/collectd/rrd"
           '';
-          plugins = {
-            rrdtool = ''
-              DataDir "/var/lib/collectd/rrd"
-            '';
-            load = "";
-          };
+          load = "";
         };
-        environment.systemPackages = [ pkgs.rrdtool ];
       };
+      environment.systemPackages = [ pkgs.rrdtool ];
+    };
 
-    testScript = ''
-      machine.wait_for_unit("collectd.service")
-      hostname = machine.succeed("hostname").strip()
-      file = f"/var/lib/collectd/rrd/{hostname}/load/load.rrd"
-      machine.wait_for_file(file);
-      machine.succeed(f"rrdinfo {file} | logger")
-      # check that this file contains a shortterm metric
-      machine.succeed(f"rrdinfo {file} | grep -F 'ds[shortterm].min = '")
-      # check that interval was set before the plugins
-      machine.succeed(f"rrdinfo {file} | grep -F 'step = 30'")
-      # check that there are frequent updates
-      machine.succeed(f"cp {file} before")
-      machine.wait_until_fails(f"cmp before {file}")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("collectd.service")
+    hostname = machine.succeed("hostname").strip()
+    file = f"/var/lib/collectd/rrd/{hostname}/load/load.rrd"
+    machine.wait_for_file(file);
+    machine.succeed(f"rrdinfo {file} | logger")
+    # check that this file contains a shortterm metric
+    machine.succeed(f"rrdinfo {file} | grep -F 'ds[shortterm].min = '")
+    # check that interval was set before the plugins
+    machine.succeed(f"rrdinfo {file} | grep -F 'step = 30'")
+    # check that there are frequent updates
+    machine.succeed(f"cp {file} before")
+    machine.wait_until_fails(f"cmp before {file}")
+  '';
+}
diff --git a/nixos/tests/commafeed.nix b/nixos/tests/commafeed.nix
index 7b65720818a9..c93619e46635 100644
--- a/nixos/tests/commafeed.nix
+++ b/nixos/tests/commafeed.nix
@@ -1,21 +1,19 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "commafeed";
+{ lib, ... }:
+{
+  name = "commafeed";
 
-    nodes.server = {
-      services.commafeed = {
-        enable = true;
-      };
+  nodes.server = {
+    services.commafeed = {
+      enable = true;
     };
+  };
 
-    testScript = ''
-      server.start()
-      server.wait_for_unit("commafeed.service")
-      server.wait_for_open_port(8082)
-      server.succeed("curl --fail --silent http://localhost:8082")
-    '';
+  testScript = ''
+    server.start()
+    server.wait_for_unit("commafeed.service")
+    server.wait_for_open_port(8082)
+    server.succeed("curl --fail --silent http://localhost:8082")
+  '';
 
-    meta.maintainers = [ lib.maintainers.raroh73 ];
-  }
-)
+  meta.maintainers = [ lib.maintainers.raroh73 ];
+}
diff --git a/nixos/tests/connman.nix b/nixos/tests/connman.nix
index 8ab00de10601..1902e0638b96 100644
--- a/nixos/tests/connman.nix
+++ b/nixos/tests/connman.nix
@@ -1,85 +1,83 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "connman";
-    meta = with lib.maintainers; {
-      maintainers = [ rnhmjoj ];
+{ pkgs, lib, ... }:
+{
+  name = "connman";
+  meta = with lib.maintainers; {
+    maintainers = [ rnhmjoj ];
+  };
+
+  # Router running radvd on VLAN 1
+  nodes.router =
+    { ... }:
+    {
+      imports = [ ../modules/profiles/minimal.nix ];
+
+      virtualisation.vlans = [ 1 ];
+
+      boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true;
+
+      networking = {
+        useDHCP = false;
+        interfaces.eth1.ipv6.addresses = [
+          {
+            address = "fd12::1";
+            prefixLength = 64;
+          }
+        ];
+      };
+
+      services.radvd = {
+        enable = true;
+        config = ''
+          interface eth1 {
+            AdvSendAdvert on;
+            AdvManagedFlag on;
+            AdvOtherConfigFlag on;
+            prefix fd12::/64 {
+              AdvAutonomous off;
+            };
+          };
+        '';
+      };
     };
 
-    # Router running radvd on VLAN 1
-    nodes.router =
-      { ... }:
-      {
-        imports = [ ../modules/profiles/minimal.nix ];
+  # Client running connman, connected to VLAN 1
+  nodes.client =
+    { ... }:
+    {
+      virtualisation.vlans = [ 1 ];
 
-        virtualisation.vlans = [ 1 ];
+      # add a virtual wlan interface
+      boot.kernelModules = [ "mac80211_hwsim" ];
+      boot.extraModprobeConfig = ''
+        options mac80211_hwsim radios=1
+      '';
 
-        boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true;
+      # Note: the overrides are needed because the wifi is
+      # disabled with mkVMOverride in qemu-vm.nix.
+      services.connman.enable = lib.mkOverride 0 true;
+      services.connman.networkInterfaceBlacklist = [ "eth0" ];
+      networking.wireless.enable = lib.mkOverride 0 true;
+      networking.wireless.interfaces = [ "wlan0" ];
+    };
 
-        networking = {
-          useDHCP = false;
-          interfaces.eth1.ipv6.addresses = [
-            {
-              address = "fd12::1";
-              prefixLength = 64;
-            }
-          ];
-        };
+  testScript = ''
+    start_all()
 
-        services.radvd = {
-          enable = true;
-          config = ''
-            interface eth1 {
-              AdvSendAdvert on;
-              AdvManagedFlag on;
-              AdvOtherConfigFlag on;
-              prefix fd12::/64 {
-                AdvAutonomous off;
-              };
-            };
-          '';
-        };
-      };
+    with subtest("Router is ready"):
+        router.wait_for_unit("radvd.service")
 
-    # Client running connman, connected to VLAN 1
-    nodes.client =
-      { ... }:
-      {
-        virtualisation.vlans = [ 1 ];
+    with subtest("Daemons are running"):
+        client.wait_for_unit("wpa_supplicant-wlan0.service")
+        client.wait_for_unit("connman.service")
+        client.wait_until_succeeds("connmanctl state | grep -q ready")
 
-        # add a virtual wlan interface
-        boot.kernelModules = [ "mac80211_hwsim" ];
-        boot.extraModprobeConfig = ''
-          options mac80211_hwsim radios=1
-        '';
+    with subtest("Wired interface is configured"):
+        client.wait_until_succeeds("ip -6 route | grep -q fd12::/64")
+        client.wait_until_succeeds("ping -c 1 fd12::1")
 
-        # Note: the overrides are needed because the wifi is
-        # disabled with mkVMOverride in qemu-vm.nix.
-        services.connman.enable = lib.mkOverride 0 true;
-        services.connman.networkInterfaceBlacklist = [ "eth0" ];
-        networking.wireless.enable = lib.mkOverride 0 true;
-        networking.wireless.interfaces = [ "wlan0" ];
-      };
-
-    testScript = ''
-      start_all()
-
-      with subtest("Router is ready"):
-          router.wait_for_unit("radvd.service")
-
-      with subtest("Daemons are running"):
-          client.wait_for_unit("wpa_supplicant-wlan0.service")
-          client.wait_for_unit("connman.service")
-          client.wait_until_succeeds("connmanctl state | grep -q ready")
-
-      with subtest("Wired interface is configured"):
-          client.wait_until_succeeds("ip -6 route | grep -q fd12::/64")
-          client.wait_until_succeeds("ping -c 1 fd12::1")
-
-      with subtest("Can set up a wireless access point"):
-          client.succeed("connmanctl enable wifi")
-          client.wait_until_succeeds("connmanctl tether wifi on nixos-test reproducibility | grep -q 'Enabled'")
-          client.wait_until_succeeds("iw wlan0 info | grep -q nixos-test")
-    '';
-  }
-)
+    with subtest("Can set up a wireless access point"):
+        client.succeed("connmanctl enable wifi")
+        client.wait_until_succeeds("connmanctl tether wifi on nixos-test reproducibility | grep -q 'Enabled'")
+        client.wait_until_succeeds("iw wlan0 info | grep -q nixos-test")
+  '';
+}
diff --git a/nixos/tests/consul-template.nix b/nixos/tests/consul-template.nix
index 015e09111b3d..6720cd44e629 100644
--- a/nixos/tests/consul-template.nix
+++ b/nixos/tests/consul-template.nix
@@ -1,43 +1,41 @@
-import ./make-test-python.nix (
-  { ... }:
-  {
-    name = "consul-template";
+{ ... }:
+{
+  name = "consul-template";
 
-    nodes.machine =
-      { ... }:
-      {
-        services.consul-template.instances.example.settings = {
-          template = [
-            {
-              contents = ''
-                {{ key "example" }}
-              '';
-              perms = "0600";
-              destination = "/example";
-            }
-          ];
-        };
-
-        services.consul = {
-          enable = true;
-          extraConfig = {
-            server = true;
-            bootstrap_expect = 1;
-            bind_addr = "127.0.0.1";
-          };
-        };
+  nodes.machine =
+    { ... }:
+    {
+      services.consul-template.instances.example.settings = {
+        template = [
+          {
+            contents = ''
+              {{ key "example" }}
+            '';
+            perms = "0600";
+            destination = "/example";
+          }
+        ];
       };
 
-    testScript = ''
-      machine.wait_for_unit("consul.service")
-      machine.wait_for_open_port(8500)
+      services.consul = {
+        enable = true;
+        extraConfig = {
+          server = true;
+          bootstrap_expect = 1;
+          bind_addr = "127.0.0.1";
+        };
+      };
+    };
 
-      machine.wait_for_unit("consul-template-example.service")
+  testScript = ''
+    machine.wait_for_unit("consul.service")
+    machine.wait_for_open_port(8500)
 
-      machine.wait_until_succeeds('consul kv put example example')
+    machine.wait_for_unit("consul-template-example.service")
 
-      machine.wait_for_file("/example")
-      machine.succeed('grep "example" /example')
-    '';
-  }
-)
+    machine.wait_until_succeeds('consul kv put example example')
+
+    machine.wait_for_file("/example")
+    machine.succeed('grep "example" /example')
+  '';
+}
diff --git a/nixos/tests/consul.nix b/nixos/tests/consul.nix
index 253d70f13b59..da72d1d132bd 100644
--- a/nixos/tests/consul.nix
+++ b/nixos/tests/consul.nix
@@ -1,267 +1,267 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ lib, ... }:
 
-  let
-    # Settings for both servers and agents
-    webUi = true;
-    retry_interval = "1s";
-    raft_multiplier = 1;
+let
+  # Settings for both servers and agents
+  webUi = true;
+  retry_interval = "1s";
+  raft_multiplier = 1;
 
-    defaultExtraConfig = {
-      inherit retry_interval;
-      performance = {
-        inherit raft_multiplier;
+  defaultExtraConfig = {
+    inherit retry_interval;
+    performance = {
+      inherit raft_multiplier;
+    };
+  };
+
+  allConsensusServerHosts = [
+    "192.168.1.1"
+    "192.168.1.2"
+    "192.168.1.3"
+  ];
+
+  allConsensusClientHosts = [
+    "192.168.2.1"
+    "192.168.2.2"
+  ];
+
+  firewallSettings = {
+    # See https://www.consul.io/docs/install/ports.html
+    allowedTCPPorts = [
+      8301
+      8302
+      8600
+      8500
+      8300
+    ];
+    allowedUDPPorts = [
+      8301
+      8302
+      8600
+    ];
+  };
+
+  client =
+    index:
+    { pkgs, ... }:
+    let
+      ip = builtins.elemAt allConsensusClientHosts index;
+    in
+    {
+      environment.systemPackages = [ pkgs.consul ];
+
+      networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
+        {
+          address = ip;
+          prefixLength = 16;
+        }
+      ];
+      networking.firewall = firewallSettings;
+
+      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "consul" ];
+
+      services.consul = {
+        enable = true;
+        inherit webUi;
+        extraConfig = defaultExtraConfig // {
+          server = false;
+          retry_join = allConsensusServerHosts;
+          bind_addr = ip;
+        };
       };
     };
 
-    allConsensusServerHosts = [
-      "192.168.1.1"
-      "192.168.1.2"
-      "192.168.1.3"
-    ];
-
-    allConsensusClientHosts = [
-      "192.168.2.1"
-      "192.168.2.2"
-    ];
-
-    firewallSettings = {
-      # See https://www.consul.io/docs/install/ports.html
-      allowedTCPPorts = [
-        8301
-        8302
-        8600
-        8500
-        8300
+  server =
+    index:
+    { pkgs, ... }:
+    let
+      numConsensusServers = builtins.length allConsensusServerHosts;
+      thisConsensusServerHost = builtins.elemAt allConsensusServerHosts index;
+      ip = thisConsensusServerHost; # since we already use IPs to identify servers
+    in
+    {
+      networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
+        {
+          address = ip;
+          prefixLength = 16;
+        }
       ];
-      allowedUDPPorts = [
-        8301
-        8302
-        8600
-      ];
-    };
+      networking.firewall = firewallSettings;
 
-    client =
-      index:
-      { pkgs, ... }:
-      let
-        ip = builtins.elemAt allConsensusClientHosts index;
-      in
-      {
-        environment.systemPackages = [ pkgs.consul ];
+      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "consul" ];
 
-        networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
-          {
-            address = ip;
-            prefixLength = 16;
-          }
-        ];
-        networking.firewall = firewallSettings;
-
-        nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "consul" ];
-
-        services.consul = {
+      services.consul =
+        assert builtins.elem thisConsensusServerHost allConsensusServerHosts;
+        {
           enable = true;
           inherit webUi;
           extraConfig = defaultExtraConfig // {
-            server = false;
-            retry_join = allConsensusServerHosts;
+            server = true;
+            bootstrap_expect = numConsensusServers;
+            # Tell Consul that we never intend to drop below this many servers.
+            # Ensures to not permanently lose consensus after temporary loss.
+            # See https://github.com/hashicorp/consul/issues/8118#issuecomment-645330040
+            autopilot.min_quorum = numConsensusServers;
+            retry_join =
+              # If there's only 1 node in the network, we allow self-join;
+              # otherwise, the node must not try to join itself, and join only the other servers.
+              # See https://github.com/hashicorp/consul/issues/2868
+              if numConsensusServers == 1 then
+                allConsensusServerHosts
+              else
+                builtins.filter (h: h != thisConsensusServerHost) allConsensusServerHosts;
             bind_addr = ip;
           };
         };
-      };
-
-    server =
-      index:
-      { pkgs, ... }:
-      let
-        numConsensusServers = builtins.length allConsensusServerHosts;
-        thisConsensusServerHost = builtins.elemAt allConsensusServerHosts index;
-        ip = thisConsensusServerHost; # since we already use IPs to identify servers
-      in
-      {
-        networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
-          {
-            address = ip;
-            prefixLength = 16;
-          }
-        ];
-        networking.firewall = firewallSettings;
-
-        nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "consul" ];
-
-        services.consul =
-          assert builtins.elem thisConsensusServerHost allConsensusServerHosts;
-          {
-            enable = true;
-            inherit webUi;
-            extraConfig = defaultExtraConfig // {
-              server = true;
-              bootstrap_expect = numConsensusServers;
-              # Tell Consul that we never intend to drop below this many servers.
-              # Ensures to not permanently lose consensus after temporary loss.
-              # See https://github.com/hashicorp/consul/issues/8118#issuecomment-645330040
-              autopilot.min_quorum = numConsensusServers;
-              retry_join =
-                # If there's only 1 node in the network, we allow self-join;
-                # otherwise, the node must not try to join itself, and join only the other servers.
-                # See https://github.com/hashicorp/consul/issues/2868
-                if numConsensusServers == 1 then
-                  allConsensusServerHosts
-                else
-                  builtins.filter (h: h != thisConsensusServerHost) allConsensusServerHosts;
-              bind_addr = ip;
-            };
-          };
-      };
-  in
-  {
-    name = "consul";
-
-    nodes = {
-      server1 = server 0;
-      server2 = server 1;
-      server3 = server 2;
-
-      client1 = client 0;
-      client2 = client 1;
     };
+in
+{
+  name = "consul";
 
-    testScript = ''
-      servers = [server1, server2, server3]
-      machines = [server1, server2, server3, client1, client2]
+  node.pkgsReadOnly = false;
 
-      for m in machines:
-          m.wait_for_unit("consul.service")
+  nodes = {
+    server1 = server 0;
+    server2 = server 1;
+    server3 = server 2;
+
+    client1 = client 0;
+    client2 = client 1;
+  };
+
+  testScript = ''
+    servers = [server1, server2, server3]
+    machines = [server1, server2, server3, client1, client2]
+
+    for m in machines:
+        m.wait_for_unit("consul.service")
 
 
-      def wait_for_healthy_servers():
-          # See https://github.com/hashicorp/consul/issues/8118#issuecomment-645330040
-          # for why the `Voter` column of `list-peers` has that info.
-          # TODO: The `grep true` relies on the fact that currently in
-          #       the output like
-          #           # consul operator raft list-peers
-          #           Node     ID   Address           State     Voter  RaftProtocol
-          #           server3  ...  192.168.1.3:8300  leader    true   3
-          #           server2  ...  192.168.1.2:8300  follower  true   3
-          #           server1  ...  192.168.1.1:8300  follower  false  3
-          #       `Voter`is the only boolean column.
-          #       Change this to the more reliable way to be defined by
-          #       https://github.com/hashicorp/consul/issues/8118
-          #       once that ticket is closed.
-          for m in machines:
-              m.wait_until_succeeds(
-                  "[ $(consul operator raft list-peers | grep true | wc -l) == 3 ]"
-              )
+    def wait_for_healthy_servers():
+        # See https://github.com/hashicorp/consul/issues/8118#issuecomment-645330040
+        # for why the `Voter` column of `list-peers` has that info.
+        # TODO: The `grep true` relies on the fact that currently in
+        #       the output like
+        #           # consul operator raft list-peers
+        #           Node     ID   Address           State     Voter  RaftProtocol
+        #           server3  ...  192.168.1.3:8300  leader    true   3
+        #           server2  ...  192.168.1.2:8300  follower  true   3
+        #           server1  ...  192.168.1.1:8300  follower  false  3
+        #       `Voter`is the only boolean column.
+        #       Change this to the more reliable way to be defined by
+        #       https://github.com/hashicorp/consul/issues/8118
+        #       once that ticket is closed.
+        for m in machines:
+            m.wait_until_succeeds(
+                "[ $(consul operator raft list-peers | grep true | wc -l) == 3 ]"
+            )
 
 
-      def wait_for_all_machines_alive():
-          """
-          Note that Serf-"alive" does not mean "Raft"-healthy;
-          see `wait_for_healthy_servers()` for that instead.
-          """
-          for m in machines:
-              m.wait_until_succeeds("[ $(consul members | grep -o alive | wc -l) == 5 ]")
+    def wait_for_all_machines_alive():
+        """
+        Note that Serf-"alive" does not mean "Raft"-healthy;
+        see `wait_for_healthy_servers()` for that instead.
+        """
+        for m in machines:
+            m.wait_until_succeeds("[ $(consul members | grep -o alive | wc -l) == 5 ]")
 
 
-      wait_for_healthy_servers()
-      # Also wait for clients to be alive.
-      wait_for_all_machines_alive()
+    wait_for_healthy_servers()
+    # Also wait for clients to be alive.
+    wait_for_all_machines_alive()
 
-      client1.succeed("consul kv put testkey 42")
-      client2.succeed("[ $(consul kv get testkey) == 42 ]")
+    client1.succeed("consul kv put testkey 42")
+    client2.succeed("[ $(consul kv get testkey) == 42 ]")
 
 
-      def rolling_restart_test(proper_rolling_procedure=True):
-          """
-          Tests that the cluster can tolearate failures of any single server,
-          following the recommended rolling upgrade procedure from
-          https://www.consul.io/docs/upgrading#standard-upgrades.
+    def rolling_restart_test(proper_rolling_procedure=True):
+        """
+        Tests that the cluster can tolearate failures of any single server,
+        following the recommended rolling upgrade procedure from
+        https://www.consul.io/docs/upgrading#standard-upgrades.
 
-          Optionally, `proper_rolling_procedure=False` can be given
-          to wait only for each server to be back `Healthy`, not `Stable`
-          in the Raft consensus, see Consul setting `ServerStabilizationTime` and
-          https://github.com/hashicorp/consul/issues/8118#issuecomment-645330040.
-          """
+        Optionally, `proper_rolling_procedure=False` can be given
+        to wait only for each server to be back `Healthy`, not `Stable`
+        in the Raft consensus, see Consul setting `ServerStabilizationTime` and
+        https://github.com/hashicorp/consul/issues/8118#issuecomment-645330040.
+        """
 
-          for server in servers:
-              server.block()
-              server.systemctl("stop consul")
+        for server in servers:
+            server.block()
+            server.systemctl("stop consul")
 
-              # Make sure the stopped peer is recognized as being down
-              client1.wait_until_succeeds(
-                f"[ $(consul members | grep {server.name} | grep -o -E 'failed|left' | wc -l) == 1 ]"
-              )
+            # Make sure the stopped peer is recognized as being down
+            client1.wait_until_succeeds(
+              f"[ $(consul members | grep {server.name} | grep -o -E 'failed|left' | wc -l) == 1 ]"
+            )
 
-              # For each client, wait until they have connection again
-              # using `kv get -recurse` before issuing commands.
-              client1.wait_until_succeeds("consul kv get -recurse")
-              client2.wait_until_succeeds("consul kv get -recurse")
+            # For each client, wait until they have connection again
+            # using `kv get -recurse` before issuing commands.
+            client1.wait_until_succeeds("consul kv get -recurse")
+            client2.wait_until_succeeds("consul kv get -recurse")
 
-              # Do some consul actions while one server is down.
-              client1.succeed("consul kv put testkey 43")
-              client2.succeed("[ $(consul kv get testkey) == 43 ]")
-              client2.succeed("consul kv delete testkey")
+            # Do some consul actions while one server is down.
+            client1.succeed("consul kv put testkey 43")
+            client2.succeed("[ $(consul kv get testkey) == 43 ]")
+            client2.succeed("consul kv delete testkey")
 
-              server.unblock()
-              server.systemctl("start consul")
+            server.unblock()
+            server.systemctl("start consul")
 
-              if proper_rolling_procedure:
-                  # Wait for recovery.
-                  wait_for_healthy_servers()
-              else:
-                  # NOT proper rolling upgrade procedure, see above.
-                  wait_for_all_machines_alive()
+            if proper_rolling_procedure:
+                # Wait for recovery.
+                wait_for_healthy_servers()
+            else:
+                # NOT proper rolling upgrade procedure, see above.
+                wait_for_all_machines_alive()
 
-              # Wait for client connections.
-              client1.wait_until_succeeds("consul kv get -recurse")
-              client2.wait_until_succeeds("consul kv get -recurse")
+            # Wait for client connections.
+            client1.wait_until_succeeds("consul kv get -recurse")
+            client2.wait_until_succeeds("consul kv get -recurse")
 
-              # Do some consul actions with server back up.
-              client1.succeed("consul kv put testkey 44")
-              client2.succeed("[ $(consul kv get testkey) == 44 ]")
-              client2.succeed("consul kv delete testkey")
+            # Do some consul actions with server back up.
+            client1.succeed("consul kv put testkey 44")
+            client2.succeed("[ $(consul kv get testkey) == 44 ]")
+            client2.succeed("consul kv delete testkey")
 
 
-      def all_servers_crash_simultaneously_test():
-          """
-          Tests that the cluster will eventually come back after all
-          servers crash simultaneously.
-          """
+    def all_servers_crash_simultaneously_test():
+        """
+        Tests that the cluster will eventually come back after all
+        servers crash simultaneously.
+        """
 
-          for server in servers:
-              server.block()
-              server.systemctl("stop --no-block consul")
+        for server in servers:
+            server.block()
+            server.systemctl("stop --no-block consul")
 
-          for server in servers:
-              # --no-block is async, so ensure it has been stopped by now
-              server.wait_until_fails("systemctl is-active --quiet consul")
-              server.unblock()
-              server.systemctl("start consul")
+        for server in servers:
+            # --no-block is async, so ensure it has been stopped by now
+            server.wait_until_fails("systemctl is-active --quiet consul")
+            server.unblock()
+            server.systemctl("start consul")
 
-          # Wait for recovery.
-          wait_for_healthy_servers()
+        # Wait for recovery.
+        wait_for_healthy_servers()
 
-          # Wait for client connections.
-          client1.wait_until_succeeds("consul kv get -recurse")
-          client2.wait_until_succeeds("consul kv get -recurse")
+        # Wait for client connections.
+        client1.wait_until_succeeds("consul kv get -recurse")
+        client2.wait_until_succeeds("consul kv get -recurse")
 
-          # Do some consul actions with servers back up.
-          client1.succeed("consul kv put testkey 44")
-          client2.succeed("[ $(consul kv get testkey) == 44 ]")
-          client2.succeed("consul kv delete testkey")
+        # Do some consul actions with servers back up.
+        client1.succeed("consul kv put testkey 44")
+        client2.succeed("[ $(consul kv get testkey) == 44 ]")
+        client2.succeed("consul kv delete testkey")
 
 
-      # Run the tests.
+    # Run the tests.
 
-      print("rolling_restart_test()")
-      rolling_restart_test()
+    print("rolling_restart_test()")
+    rolling_restart_test()
 
-      print("all_servers_crash_simultaneously_test()")
-      all_servers_crash_simultaneously_test()
+    print("all_servers_crash_simultaneously_test()")
+    all_servers_crash_simultaneously_test()
 
-      print("rolling_restart_test(proper_rolling_procedure=False)")
-      rolling_restart_test(proper_rolling_procedure=False)
-    '';
-  }
-)
+    print("rolling_restart_test(proper_rolling_procedure=False)")
+    rolling_restart_test(proper_rolling_procedure=False)
+  '';
+}
diff --git a/nixos/tests/containers-bridge.nix b/nixos/tests/containers-bridge.nix
index a8e9f574924f..1f38b1b48e11 100644
--- a/nixos/tests/containers-bridge.nix
+++ b/nixos/tests/containers-bridge.nix
@@ -5,110 +5,108 @@ let
   containerIp6 = "fc00::2/7";
 in
 
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-bridge";
-    meta = {
-      maintainers = with lib.maintainers; [
-        aristid
-        aszlig
-        kampfschlaefer
-      ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "containers-bridge";
+  meta = {
+    maintainers = with lib.maintainers; [
+      aristid
+      aszlig
+      kampfschlaefer
+    ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ../modules/installer/cd-dvd/channel.nix ];
-        virtualisation.writableStore = true;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ../modules/installer/cd-dvd/channel.nix ];
+      virtualisation.writableStore = true;
 
-        networking.bridges = {
-          br0 = {
-            interfaces = [ ];
-          };
+      networking.bridges = {
+        br0 = {
+          interfaces = [ ];
         };
-        networking.interfaces = {
-          br0 = {
-            ipv4.addresses = [
-              {
-                address = hostIp;
-                prefixLength = 24;
-              }
-            ];
-            ipv6.addresses = [
-              {
-                address = hostIp6;
-                prefixLength = 7;
-              }
-            ];
-          };
+      };
+      networking.interfaces = {
+        br0 = {
+          ipv4.addresses = [
+            {
+              address = hostIp;
+              prefixLength = 24;
+            }
+          ];
+          ipv6.addresses = [
+            {
+              address = hostIp6;
+              prefixLength = 7;
+            }
+          ];
         };
-
-        containers.webserver = {
-          autoStart = true;
-          privateNetwork = true;
-          hostBridge = "br0";
-          localAddress = containerIp;
-          localAddress6 = containerIp6;
-          config = {
-            services.httpd.enable = true;
-            services.httpd.adminAddr = "foo@example.org";
-            networking.firewall.allowedTCPPorts = [ 80 ];
-          };
-        };
-
-        containers.web-noip = {
-          autoStart = true;
-          privateNetwork = true;
-          hostBridge = "br0";
-          config = {
-            services.httpd.enable = true;
-            services.httpd.adminAddr = "foo@example.org";
-            networking.firewall.allowedTCPPorts = [ 80 ];
-          };
-        };
-
-        virtualisation.additionalPaths = [ pkgs.stdenv ];
       };
 
-    testScript = ''
-      machine.wait_for_unit("default.target")
-      assert "webserver" in machine.succeed("nixos-container list")
+      containers.webserver = {
+        autoStart = true;
+        privateNetwork = true;
+        hostBridge = "br0";
+        localAddress = containerIp;
+        localAddress6 = containerIp6;
+        config = {
+          services.httpd.enable = true;
+          services.httpd.adminAddr = "foo@example.org";
+          networking.firewall.allowedTCPPorts = [ 80 ];
+        };
+      };
 
-      with subtest("Start the webserver container"):
-          assert "up" in machine.succeed("nixos-container status webserver")
+      containers.web-noip = {
+        autoStart = true;
+        privateNetwork = true;
+        hostBridge = "br0";
+        config = {
+          services.httpd.enable = true;
+          services.httpd.adminAddr = "foo@example.org";
+          networking.firewall.allowedTCPPorts = [ 80 ];
+        };
+      };
 
-      with subtest("Bridges exist inside containers"):
-          machine.succeed(
-              "nixos-container run webserver -- ip link show eth0",
-              "nixos-container run web-noip -- ip link show eth0",
-          )
+      virtualisation.additionalPaths = [ pkgs.stdenv ];
+    };
 
-      ip = "${containerIp}".split("/")[0]
-      machine.succeed(f"ping -n -c 1 {ip}")
-      machine.succeed(f"curl --fail http://{ip}/ > /dev/null")
+  testScript = ''
+    machine.wait_for_unit("default.target")
+    assert "webserver" in machine.succeed("nixos-container list")
 
-      ip6 = "${containerIp6}".split("/")[0]
-      machine.succeed(f"ping -n -c 1 {ip6}")
-      machine.succeed(f"curl --fail http://[{ip6}]/ > /dev/null")
+    with subtest("Start the webserver container"):
+        assert "up" in machine.succeed("nixos-container status webserver")
 
-      with subtest(
-          "nixos-container show-ip works in case of an ipv4 address "
-          + "with subnetmask in CIDR notation."
-      ):
-          result = machine.succeed("nixos-container show-ip webserver").rstrip()
-          assert result == ip
+    with subtest("Bridges exist inside containers"):
+        machine.succeed(
+            "nixos-container run webserver -- ip link show eth0",
+            "nixos-container run web-noip -- ip link show eth0",
+        )
 
-      with subtest("Stop the container"):
-          machine.succeed("nixos-container stop webserver")
-          machine.fail(
-              f"curl --fail --connect-timeout 2 http://{ip}/ > /dev/null",
-              f"curl --fail --connect-timeout 2 http://[{ip6}]/ > /dev/null",
-          )
+    ip = "${containerIp}".split("/")[0]
+    machine.succeed(f"ping -n -c 1 {ip}")
+    machine.succeed(f"curl --fail http://{ip}/ > /dev/null")
 
-      # Destroying a declarative container should fail.
-      machine.fail("nixos-container destroy webserver")
-    '';
-  }
-)
+    ip6 = "${containerIp6}".split("/")[0]
+    machine.succeed(f"ping -n -c 1 {ip6}")
+    machine.succeed(f"curl --fail http://[{ip6}]/ > /dev/null")
+
+    with subtest(
+        "nixos-container show-ip works in case of an ipv4 address "
+        + "with subnetmask in CIDR notation."
+    ):
+        result = machine.succeed("nixos-container show-ip webserver").rstrip()
+        assert result == ip
+
+    with subtest("Stop the container"):
+        machine.succeed("nixos-container stop webserver")
+        machine.fail(
+            f"curl --fail --connect-timeout 2 http://{ip}/ > /dev/null",
+            f"curl --fail --connect-timeout 2 http://[{ip6}]/ > /dev/null",
+        )
+
+    # Destroying a declarative container should fail.
+    machine.fail("nixos-container destroy webserver")
+  '';
+}
diff --git a/nixos/tests/containers-custom-pkgs.nix b/nixos/tests/containers-custom-pkgs.nix
index 74b1ea207b68..b341232fd8cd 100644
--- a/nixos/tests/containers-custom-pkgs.nix
+++ b/nixos/tests/containers-custom-pkgs.nix
@@ -1,48 +1,46 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
+{ pkgs, lib, ... }:
+let
 
-    customPkgs = pkgs.appendOverlays [
-      (self: super: {
-        hello = super.hello.overrideAttrs (old: {
-          name = "custom-hello";
-        });
-      })
-    ];
+  customPkgs = pkgs.appendOverlays [
+    (self: super: {
+      hello = super.hello.overrideAttrs (old: {
+        name = "custom-hello";
+      });
+    })
+  ];
 
-  in
-  {
-    name = "containers-custom-pkgs";
-    meta = {
-      maintainers = with lib.maintainers; [ erikarvstedt ];
+in
+{
+  name = "containers-custom-pkgs";
+  meta = {
+    maintainers = with lib.maintainers; [ erikarvstedt ];
+  };
+
+  nodes.machine =
+    { config, ... }:
+    {
+      assertions =
+        let
+          helloName = (builtins.head config.containers.test.config.system.extraDependencies).name;
+        in
+        [
+          {
+            assertion = helloName == "custom-hello";
+            message = "Unexpected value: ${helloName}";
+          }
+        ];
+
+      containers.test = {
+        autoStart = true;
+        config =
+          { pkgs, config, ... }:
+          {
+            nixpkgs.pkgs = customPkgs;
+            system.extraDependencies = [ pkgs.hello ];
+          };
+      };
     };
 
-    nodes.machine =
-      { config, ... }:
-      {
-        assertions =
-          let
-            helloName = (builtins.head config.containers.test.config.system.extraDependencies).name;
-          in
-          [
-            {
-              assertion = helloName == "custom-hello";
-              message = "Unexpected value: ${helloName}";
-            }
-          ];
-
-        containers.test = {
-          autoStart = true;
-          config =
-            { pkgs, config, ... }:
-            {
-              nixpkgs.pkgs = customPkgs;
-              system.extraDependencies = [ pkgs.hello ];
-            };
-        };
-      };
-
-    # This test only consists of evaluating the test machine
-    testScript = "pass";
-  }
-)
+  # This test only consists of evaluating the test machine
+  testScript = "pass";
+}
diff --git a/nixos/tests/containers-ephemeral.nix b/nixos/tests/containers-ephemeral.nix
index 5204ba67e26b..798962967704 100644
--- a/nixos/tests/containers-ephemeral.nix
+++ b/nixos/tests/containers-ephemeral.nix
@@ -1,59 +1,57 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-ephemeral";
-    meta = {
-      maintainers = with lib.maintainers; [ patryk27 ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "containers-ephemeral";
+  meta = {
+    maintainers = with lib.maintainers; [ patryk27 ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        virtualisation.writableStore = true;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.writableStore = true;
 
-        containers.webserver = {
-          ephemeral = true;
-          privateNetwork = true;
-          hostAddress = "10.231.136.1";
-          localAddress = "10.231.136.2";
-          config = {
-            services.nginx = {
-              enable = true;
-              virtualHosts.localhost = {
-                root = pkgs.runCommand "localhost" { } ''
-                  mkdir "$out"
-                  echo hello world > "$out/index.html"
-                '';
-              };
+      containers.webserver = {
+        ephemeral = true;
+        privateNetwork = true;
+        hostAddress = "10.231.136.1";
+        localAddress = "10.231.136.2";
+        config = {
+          services.nginx = {
+            enable = true;
+            virtualHosts.localhost = {
+              root = pkgs.runCommand "localhost" { } ''
+                mkdir "$out"
+                echo hello world > "$out/index.html"
+              '';
             };
-            networking.firewall.allowedTCPPorts = [ 80 ];
           };
+          networking.firewall.allowedTCPPorts = [ 80 ];
         };
       };
+    };
 
-    testScript = ''
-      assert "webserver" in machine.succeed("nixos-container list")
+  testScript = ''
+    assert "webserver" in machine.succeed("nixos-container list")
 
-      machine.succeed("nixos-container start webserver")
+    machine.succeed("nixos-container start webserver")
 
-      with subtest("Container got its own root folder"):
-          machine.succeed("ls /run/nixos-containers/webserver")
+    with subtest("Container got its own root folder"):
+        machine.succeed("ls /run/nixos-containers/webserver")
 
-      with subtest("Container persistent directory is not created"):
-          machine.fail("ls /var/lib/nixos-containers/webserver")
+    with subtest("Container persistent directory is not created"):
+        machine.fail("ls /var/lib/nixos-containers/webserver")
 
-      # Since "start" returns after the container has reached
-      # multi-user.target, we should now be able to access it.
-      ip = machine.succeed("nixos-container show-ip webserver").rstrip()
-      machine.succeed(f"ping -n -c1 {ip}")
-      machine.succeed(f"curl --fail http://{ip}/ > /dev/null")
+    # Since "start" returns after the container has reached
+    # multi-user.target, we should now be able to access it.
+    ip = machine.succeed("nixos-container show-ip webserver").rstrip()
+    machine.succeed(f"ping -n -c1 {ip}")
+    machine.succeed(f"curl --fail http://{ip}/ > /dev/null")
 
-      with subtest("Stop the container"):
-          machine.succeed("nixos-container stop webserver")
-          machine.fail(f"curl --fail --connect-timeout 2 http://{ip}/ > /dev/null")
+    with subtest("Stop the container"):
+        machine.succeed("nixos-container stop webserver")
+        machine.fail(f"curl --fail --connect-timeout 2 http://{ip}/ > /dev/null")
 
-      with subtest("Container's root folder was removed"):
-          machine.fail("ls /run/nixos-containers/webserver")
-    '';
-  }
-)
+    with subtest("Container's root folder was removed"):
+        machine.fail("ls /run/nixos-containers/webserver")
+  '';
+}
diff --git a/nixos/tests/containers-extra_veth.nix b/nixos/tests/containers-extra_veth.nix
index ed3b8099036b..3a50fa824986 100644
--- a/nixos/tests/containers-extra_veth.nix
+++ b/nixos/tests/containers-extra_veth.nix
@@ -1,115 +1,113 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-extra_veth";
-    meta = {
-      maintainers = with lib.maintainers; [ kampfschlaefer ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "containers-extra_veth";
+  meta = {
+    maintainers = with lib.maintainers; [ kampfschlaefer ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ../modules/installer/cd-dvd/channel.nix ];
-        virtualisation.writableStore = true;
-        virtualisation.vlans = [ ];
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ../modules/installer/cd-dvd/channel.nix ];
+      virtualisation.writableStore = true;
+      virtualisation.vlans = [ ];
 
-        networking.useDHCP = false;
-        networking.bridges = {
-          br0 = {
-            interfaces = [ ];
-          };
-          br1 = {
-            interfaces = [ ];
-          };
+      networking.useDHCP = false;
+      networking.bridges = {
+        br0 = {
+          interfaces = [ ];
         };
-        networking.interfaces = {
-          br0 = {
-            ipv4.addresses = [
-              {
-                address = "192.168.0.1";
-                prefixLength = 24;
-              }
-            ];
-            ipv6.addresses = [
-              {
-                address = "fc00::1";
-                prefixLength = 7;
-              }
-            ];
-          };
-          br1 = {
-            ipv4.addresses = [
-              {
-                address = "192.168.1.1";
-                prefixLength = 24;
-              }
-            ];
-          };
+        br1 = {
+          interfaces = [ ];
         };
-
-        containers.webserver = {
-          autoStart = true;
-          privateNetwork = true;
-          hostBridge = "br0";
-          localAddress = "192.168.0.100/24";
-          localAddress6 = "fc00::2/7";
-          extraVeths = {
-            veth1 = {
-              hostBridge = "br1";
-              localAddress = "192.168.1.100/24";
-            };
-            veth2 = {
-              hostAddress = "192.168.2.1";
-              localAddress = "192.168.2.100";
-            };
-          };
-          config = {
-            networking.firewall.allowedTCPPorts = [ 80 ];
-          };
+      };
+      networking.interfaces = {
+        br0 = {
+          ipv4.addresses = [
+            {
+              address = "192.168.0.1";
+              prefixLength = 24;
+            }
+          ];
+          ipv6.addresses = [
+            {
+              address = "fc00::1";
+              prefixLength = 7;
+            }
+          ];
+        };
+        br1 = {
+          ipv4.addresses = [
+            {
+              address = "192.168.1.1";
+              prefixLength = 24;
+            }
+          ];
         };
-
-        virtualisation.additionalPaths = [ pkgs.stdenv ];
       };
 
-    testScript = ''
-      machine.wait_for_unit("default.target")
-      assert "webserver" in machine.succeed("nixos-container list")
+      containers.webserver = {
+        autoStart = true;
+        privateNetwork = true;
+        hostBridge = "br0";
+        localAddress = "192.168.0.100/24";
+        localAddress6 = "fc00::2/7";
+        extraVeths = {
+          veth1 = {
+            hostBridge = "br1";
+            localAddress = "192.168.1.100/24";
+          };
+          veth2 = {
+            hostAddress = "192.168.2.1";
+            localAddress = "192.168.2.100";
+          };
+        };
+        config = {
+          networking.firewall.allowedTCPPorts = [ 80 ];
+        };
+      };
 
-      with subtest("Status of the webserver container is up"):
-          assert "up" in machine.succeed("nixos-container status webserver")
+      virtualisation.additionalPaths = [ pkgs.stdenv ];
+    };
 
-      with subtest("Ensure that the veths are inside the container"):
-          assert "state UP" in machine.succeed(
-              "nixos-container run webserver -- ip link show veth1"
-          )
-          assert "state UP" in machine.succeed(
-              "nixos-container run webserver -- ip link show veth2"
-          )
+  testScript = ''
+    machine.wait_for_unit("default.target")
+    assert "webserver" in machine.succeed("nixos-container list")
 
-      with subtest("Ensure the presence of the extra veths"):
-          assert "state UP" in machine.succeed("ip link show veth1")
-          assert "state UP" in machine.succeed("ip link show veth2")
+    with subtest("Status of the webserver container is up"):
+        assert "up" in machine.succeed("nixos-container status webserver")
 
-      with subtest("Ensure the veth1 is part of br1 on the host"):
-          assert "master br1" in machine.succeed("ip link show veth1")
+    with subtest("Ensure that the veths are inside the container"):
+        assert "state UP" in machine.succeed(
+            "nixos-container run webserver -- ip link show veth1"
+        )
+        assert "state UP" in machine.succeed(
+            "nixos-container run webserver -- ip link show veth2"
+        )
 
-      with subtest("Ping on main veth"):
-          machine.succeed("ping -n -c 1 192.168.0.100")
-          machine.succeed("ping -n -c 1 fc00::2")
+    with subtest("Ensure the presence of the extra veths"):
+        assert "state UP" in machine.succeed("ip link show veth1")
+        assert "state UP" in machine.succeed("ip link show veth2")
 
-      with subtest("Ping on the first extra veth"):
-          machine.succeed("ping -n -c 1 192.168.1.100 >&2")
+    with subtest("Ensure the veth1 is part of br1 on the host"):
+        assert "master br1" in machine.succeed("ip link show veth1")
 
-      with subtest("Ping on the second extra veth"):
-          machine.succeed("ping -n -c 1 192.168.2.100 >&2")
+    with subtest("Ping on main veth"):
+        machine.succeed("ping -n -c 1 192.168.0.100")
+        machine.succeed("ping -n -c 1 fc00::2")
 
-      with subtest("Container can be stopped"):
-          machine.succeed("nixos-container stop webserver")
-          machine.fail("ping -n -c 1 192.168.1.100 >&2")
-          machine.fail("ping -n -c 1 192.168.2.100 >&2")
+    with subtest("Ping on the first extra veth"):
+        machine.succeed("ping -n -c 1 192.168.1.100 >&2")
 
-      with subtest("Destroying a declarative container should fail"):
-          machine.fail("nixos-container destroy webserver")
-    '';
-  }
-)
+    with subtest("Ping on the second extra veth"):
+        machine.succeed("ping -n -c 1 192.168.2.100 >&2")
+
+    with subtest("Container can be stopped"):
+        machine.succeed("nixos-container stop webserver")
+        machine.fail("ping -n -c 1 192.168.1.100 >&2")
+        machine.fail("ping -n -c 1 192.168.2.100 >&2")
+
+    with subtest("Destroying a declarative container should fail"):
+        machine.fail("nixos-container destroy webserver")
+  '';
+}
diff --git a/nixos/tests/containers-hosts.nix b/nixos/tests/containers-hosts.nix
index 0e5f50f5292c..4e827e7c3983 100644
--- a/nixos/tests/containers-hosts.nix
+++ b/nixos/tests/containers-hosts.nix
@@ -1,55 +1,53 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-hosts";
-    meta = {
-      maintainers = with lib.maintainers; [ montag451 ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "containers-hosts";
+  meta = {
+    maintainers = with lib.maintainers; [ montag451 ];
+  };
 
-    nodes.machine =
-      { lib, ... }:
-      {
-        virtualisation.vlans = [ ];
+  nodes.machine =
+    { lib, ... }:
+    {
+      virtualisation.vlans = [ ];
 
-        networking.bridges.br0.interfaces = [ ];
-        networking.interfaces.br0.ipv4.addresses = [
-          {
-            address = "10.11.0.254";
-            prefixLength = 24;
-          }
-        ];
+      networking.bridges.br0.interfaces = [ ];
+      networking.interfaces.br0.ipv4.addresses = [
+        {
+          address = "10.11.0.254";
+          prefixLength = 24;
+        }
+      ];
 
-        # Force /etc/hosts to be the only source for host name resolution
-        environment.etc."nsswitch.conf".text = lib.mkForce ''
-          hosts: files
-        '';
+      # Force /etc/hosts to be the only source for host name resolution
+      environment.etc."nsswitch.conf".text = lib.mkForce ''
+        hosts: files
+      '';
 
-        containers.simple = {
-          autoStart = true;
-          privateNetwork = true;
-          localAddress = "10.10.0.1";
-          hostAddress = "10.10.0.254";
+      containers.simple = {
+        autoStart = true;
+        privateNetwork = true;
+        localAddress = "10.10.0.1";
+        hostAddress = "10.10.0.254";
 
-          config = { };
-        };
-
-        containers.netmask = {
-          autoStart = true;
-          privateNetwork = true;
-          hostBridge = "br0";
-          localAddress = "10.11.0.1/24";
-
-          config = { };
-        };
+        config = { };
       };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("default.target")
+      containers.netmask = {
+        autoStart = true;
+        privateNetwork = true;
+        hostBridge = "br0";
+        localAddress = "10.11.0.1/24";
 
-      with subtest("Ping the containers using the entries added in /etc/hosts"):
-          for host in "simple.containers", "netmask.containers":
-              machine.succeed(f"ping -n -c 1 {host}")
-    '';
-  }
-)
+        config = { };
+      };
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("default.target")
+
+    with subtest("Ping the containers using the entries added in /etc/hosts"):
+        for host in "simple.containers", "netmask.containers":
+            machine.succeed(f"ping -n -c 1 {host}")
+  '';
+}
diff --git a/nixos/tests/containers-imperative.nix b/nixos/tests/containers-imperative.nix
index f1bd56519c6d..630bcbdf64be 100644
--- a/nixos/tests/containers-imperative.nix
+++ b/nixos/tests/containers-imperative.nix
@@ -1,197 +1,195 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-imperative";
-    meta = {
-      maintainers = with lib.maintainers; [
-        aristid
-        aszlig
-        kampfschlaefer
-      ];
+{ pkgs, lib, ... }:
+{
+  name = "containers-imperative";
+  meta = {
+    maintainers = with lib.maintainers; [
+      aristid
+      aszlig
+      kampfschlaefer
+    ];
+  };
+
+  nodes.machine =
+    {
+      config,
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      imports = [ ../modules/installer/cd-dvd/channel.nix ];
+
+      # XXX: Sandbox setup fails while trying to hardlink files from the host's
+      #      store file system into the prepared chroot directory.
+      nix.settings.sandbox = false;
+      nix.settings.substituters = [ ]; # don't try to access cache.nixos.org
+
+      virtualisation.memorySize = 2048;
+      virtualisation.writableStore = true;
+      # Make sure we always have all the required dependencies for creating a
+      # container available within the VM, because we don't have network access.
+      virtualisation.additionalPaths =
+        let
+          emptyContainer = import ../lib/eval-config.nix {
+            modules = lib.singleton {
+              nixpkgs.hostPlatform = { inherit (pkgs.stdenv.hostPlatform) system; };
+
+              containers.foo.config = { };
+            };
+
+            # The system is inherited from the host above.
+            # Set it to null, to remove the "legacy" entrypoint's non-hermetic default.
+            system = null;
+          };
+        in
+        with pkgs;
+        [
+          stdenv
+          stdenvNoCC
+          emptyContainer.config.containers.foo.path
+          libxslt
+          desktop-file-utils
+          texinfo
+          docbook5
+          libxml2
+          docbook_xsl_ns
+          xorg.lndir
+          documentation-highlighter
+          perlPackages.ConfigIniFiles
+        ];
     };
 
-    nodes.machine =
-      {
-        config,
-        pkgs,
-        lib,
-        ...
-      }:
-      {
-        imports = [ ../modules/installer/cd-dvd/channel.nix ];
-
-        # XXX: Sandbox setup fails while trying to hardlink files from the host's
-        #      store file system into the prepared chroot directory.
-        nix.settings.sandbox = false;
-        nix.settings.substituters = [ ]; # don't try to access cache.nixos.org
-
-        virtualisation.memorySize = 2048;
-        virtualisation.writableStore = true;
-        # Make sure we always have all the required dependencies for creating a
-        # container available within the VM, because we don't have network access.
-        virtualisation.additionalPaths =
-          let
-            emptyContainer = import ../lib/eval-config.nix {
-              modules = lib.singleton {
-                nixpkgs = { inherit (config.nixpkgs) localSystem; };
-
-                containers.foo.config = { };
-              };
-
-              # The system is inherited from the host above.
-              # Set it to null, to remove the "legacy" entrypoint's non-hermetic default.
-              system = null;
-            };
-          in
-          with pkgs;
-          [
-            stdenv
-            stdenvNoCC
-            emptyContainer.config.containers.foo.path
-            libxslt
-            desktop-file-utils
-            texinfo
-            docbook5
-            libxml2
-            docbook_xsl_ns
-            xorg.lndir
-            documentation-highlighter
-            perlPackages.ConfigIniFiles
-          ];
-      };
-
-    testScript =
-      let
-        tmpfilesContainerConfig = pkgs.writeText "container-config-tmpfiles" ''
-          {
-            systemd.tmpfiles.rules = [ "d /foo - - - - -" ];
-            systemd.services.foo = {
-              serviceConfig.Type = "oneshot";
-              script = "ls -al /foo";
-              wantedBy = [ "multi-user.target" ];
-            };
-          }
-        '';
-        brokenCfg = pkgs.writeText "broken.nix" ''
-          {
-            assertions = [
-              { assertion = false;
-                message = "I never evaluate";
-              }
-            ];
-          }
-        '';
-      in
-      ''
-        with subtest("Make sure we have a NixOS tree (required by ‘nixos-container create’)"):
-            machine.succeed("PAGER=cat nix-env -qa -A nixos.hello >&2")
-
-        id1, id2 = None, None
-
-        with subtest("Create some containers imperatively"):
-            id1 = machine.succeed("nixos-container create foo --ensure-unique-name").rstrip()
-            machine.log(f"created container {id1}")
-
-            id2 = machine.succeed("nixos-container create foo --ensure-unique-name").rstrip()
-            machine.log(f"created container {id2}")
-
-            assert id1 != id2
-
-        with subtest(f"Put the root of {id2} into a bind mount"):
-            machine.succeed(
-                f"mv /var/lib/nixos-containers/{id2} /id2-bindmount",
-                f"mount --bind /id2-bindmount /var/lib/nixos-containers/{id1}",
-            )
-
-            ip1 = machine.succeed(f"nixos-container show-ip {id1}").rstrip()
-            ip2 = machine.succeed(f"nixos-container show-ip {id2}").rstrip()
-            assert ip1 != ip2
-
-        with subtest(
-            "Create a directory and a file we can later check if it still exists "
-            + "after destruction of the container"
-        ):
-            machine.succeed("mkdir /nested-bindmount")
-            machine.succeed("echo important data > /nested-bindmount/dummy")
-
-        with subtest(
-            "Create a directory with a dummy file and bind-mount it into both containers."
-        ):
-            for id in id1, id2:
-                important_path = f"/var/lib/nixos-containers/{id}/very/important/data"
-                machine.succeed(
-                    f"mkdir -p {important_path}",
-                    f"mount --bind /nested-bindmount {important_path}",
-                )
-
-        with subtest("Start one of them"):
-            machine.succeed(f"nixos-container start {id1}")
-
-        with subtest("Execute commands via the root shell"):
-            assert "Linux" in machine.succeed(f"nixos-container run {id1} -- uname")
-
-        with subtest("Execute a nix command via the root shell. (regression test for #40355)"):
-            machine.succeed(
-                f"nixos-container run {id1} -- nix-instantiate -E "
-                + '\'derivation { name = "empty"; builder = "false"; system = "false"; }\' '
-            )
-
-        with subtest("Stop and start (regression test for #4989)"):
-            machine.succeed(f"nixos-container stop {id1}")
-            machine.succeed(f"nixos-container start {id1}")
-
-        # clear serial backlog for next tests
-        machine.succeed("logger eat console backlog 3ea46eb2-7f82-4f70-b810-3f00e3dd4c4d")
-        machine.wait_for_console_text(
-            "eat console backlog 3ea46eb2-7f82-4f70-b810-3f00e3dd4c4d"
-        )
-
-        with subtest("Stop a container early"):
-            machine.succeed(f"nixos-container stop {id1}")
-            machine.succeed(f"nixos-container start {id1} >&2 &")
-            machine.wait_for_console_text("Stage 2")
-            machine.succeed(f"nixos-container stop {id1}")
-            machine.wait_for_console_text(f"Container {id1} exited successfully")
-            machine.succeed(f"nixos-container start {id1}")
-
-        with subtest("Stop a container without machined (regression test for #109695)"):
-            machine.systemctl("stop systemd-machined")
-            machine.succeed(f"nixos-container stop {id1}")
-            machine.wait_for_console_text(f"Container {id1} has been shut down")
-            machine.succeed(f"nixos-container start {id1}")
-
-        with subtest("tmpfiles are present"):
-            machine.log("creating container tmpfiles")
-            machine.succeed(
-                "nixos-container create tmpfiles --config-file ${tmpfilesContainerConfig}"
-            )
-            machine.log("created, starting…")
-            machine.succeed("nixos-container start tmpfiles")
-            machine.log("done starting, investigating…")
-            machine.succeed(
-                "echo $(nixos-container run tmpfiles -- systemctl is-active foo.service) | grep -q active;"
-            )
-            machine.succeed("nixos-container destroy tmpfiles")
-
-        with subtest("Execute commands via the root shell"):
-            assert "Linux" in machine.succeed(f"nixos-container run {id1} -- uname")
-
-        with subtest("Destroy the containers"):
-            for id in id1, id2:
-                machine.succeed(f"nixos-container destroy {id}")
-
-        with subtest("Check whether destruction of any container has killed important data"):
-            machine.succeed("grep -qF 'important data' /nested-bindmount/dummy")
-
-        with subtest("Ensure that the container path is gone"):
-            print(machine.succeed("ls -lsa /var/lib/nixos-containers"))
-            machine.succeed(f"test ! -e /var/lib/nixos-containers/{id1}")
-
-        with subtest("Ensure that a failed container creation doesn'leave any state"):
-            machine.fail(
-                "nixos-container create b0rk --config-file ${brokenCfg}"
-            )
-            machine.succeed("test ! -e /var/lib/nixos-containers/b0rk")
+  testScript =
+    let
+      tmpfilesContainerConfig = pkgs.writeText "container-config-tmpfiles" ''
+        {
+          systemd.tmpfiles.rules = [ "d /foo - - - - -" ];
+          systemd.services.foo = {
+            serviceConfig.Type = "oneshot";
+            script = "ls -al /foo";
+            wantedBy = [ "multi-user.target" ];
+          };
+        }
       '';
-  }
-)
+      brokenCfg = pkgs.writeText "broken.nix" ''
+        {
+          assertions = [
+            { assertion = false;
+              message = "I never evaluate";
+            }
+          ];
+        }
+      '';
+    in
+    ''
+      with subtest("Make sure we have a NixOS tree (required by ‘nixos-container create’)"):
+          machine.succeed("PAGER=cat nix-env -qa -A nixos.hello >&2")
+
+      id1, id2 = None, None
+
+      with subtest("Create some containers imperatively"):
+          id1 = machine.succeed("nixos-container create foo --ensure-unique-name").rstrip()
+          machine.log(f"created container {id1}")
+
+          id2 = machine.succeed("nixos-container create foo --ensure-unique-name").rstrip()
+          machine.log(f"created container {id2}")
+
+          assert id1 != id2
+
+      with subtest(f"Put the root of {id2} into a bind mount"):
+          machine.succeed(
+              f"mv /var/lib/nixos-containers/{id2} /id2-bindmount",
+              f"mount --bind /id2-bindmount /var/lib/nixos-containers/{id1}",
+          )
+
+          ip1 = machine.succeed(f"nixos-container show-ip {id1}").rstrip()
+          ip2 = machine.succeed(f"nixos-container show-ip {id2}").rstrip()
+          assert ip1 != ip2
+
+      with subtest(
+          "Create a directory and a file we can later check if it still exists "
+          + "after destruction of the container"
+      ):
+          machine.succeed("mkdir /nested-bindmount")
+          machine.succeed("echo important data > /nested-bindmount/dummy")
+
+      with subtest(
+          "Create a directory with a dummy file and bind-mount it into both containers."
+      ):
+          for id in id1, id2:
+              important_path = f"/var/lib/nixos-containers/{id}/very/important/data"
+              machine.succeed(
+                  f"mkdir -p {important_path}",
+                  f"mount --bind /nested-bindmount {important_path}",
+              )
+
+      with subtest("Start one of them"):
+          machine.succeed(f"nixos-container start {id1}")
+
+      with subtest("Execute commands via the root shell"):
+          assert "Linux" in machine.succeed(f"nixos-container run {id1} -- uname")
+
+      with subtest("Execute a nix command via the root shell. (regression test for #40355)"):
+          machine.succeed(
+              f"nixos-container run {id1} -- nix-instantiate -E "
+              + '\'derivation { name = "empty"; builder = "false"; system = "false"; }\' '
+          )
+
+      with subtest("Stop and start (regression test for #4989)"):
+          machine.succeed(f"nixos-container stop {id1}")
+          machine.succeed(f"nixos-container start {id1}")
+
+      # clear serial backlog for next tests
+      machine.succeed("logger eat console backlog 3ea46eb2-7f82-4f70-b810-3f00e3dd4c4d")
+      machine.wait_for_console_text(
+          "eat console backlog 3ea46eb2-7f82-4f70-b810-3f00e3dd4c4d"
+      )
+
+      with subtest("Stop a container early"):
+          machine.succeed(f"nixos-container stop {id1}")
+          machine.succeed(f"nixos-container start {id1} >&2 &")
+          machine.wait_for_console_text("Stage 2")
+          machine.succeed(f"nixos-container stop {id1}")
+          machine.wait_for_console_text(f"Container {id1} exited successfully")
+          machine.succeed(f"nixos-container start {id1}")
+
+      with subtest("Stop a container without machined (regression test for #109695)"):
+          machine.systemctl("stop systemd-machined")
+          machine.succeed(f"nixos-container stop {id1}")
+          machine.wait_for_console_text(f"Container {id1} has been shut down")
+          machine.succeed(f"nixos-container start {id1}")
+
+      with subtest("tmpfiles are present"):
+          machine.log("creating container tmpfiles")
+          machine.succeed(
+              "nixos-container create tmpfiles --config-file ${tmpfilesContainerConfig}"
+          )
+          machine.log("created, starting…")
+          machine.succeed("nixos-container start tmpfiles")
+          machine.log("done starting, investigating…")
+          machine.succeed(
+              "echo $(nixos-container run tmpfiles -- systemctl is-active foo.service) | grep -q active;"
+          )
+          machine.succeed("nixos-container destroy tmpfiles")
+
+      with subtest("Execute commands via the root shell"):
+          assert "Linux" in machine.succeed(f"nixos-container run {id1} -- uname")
+
+      with subtest("Destroy the containers"):
+          for id in id1, id2:
+              machine.succeed(f"nixos-container destroy {id}")
+
+      with subtest("Check whether destruction of any container has killed important data"):
+          machine.succeed("grep -qF 'important data' /nested-bindmount/dummy")
+
+      with subtest("Ensure that the container path is gone"):
+          print(machine.succeed("ls -lsa /var/lib/nixos-containers"))
+          machine.succeed(f"test ! -e /var/lib/nixos-containers/{id1}")
+
+      with subtest("Ensure that a failed container creation doesn'leave any state"):
+          machine.fail(
+              "nixos-container create b0rk --config-file ${brokenCfg}"
+          )
+          machine.succeed("test ! -e /var/lib/nixos-containers/b0rk")
+    '';
+}
diff --git a/nixos/tests/containers-ip.nix b/nixos/tests/containers-ip.nix
index 979fb365126d..44217970d24e 100644
--- a/nixos/tests/containers-ip.nix
+++ b/nixos/tests/containers-ip.nix
@@ -12,71 +12,69 @@ let
   };
 
 in
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-ipv4-ipv6";
-    meta = {
-      maintainers = with lib.maintainers; [
-        aristid
-        aszlig
-        kampfschlaefer
-      ];
+{ pkgs, lib, ... }:
+{
+  name = "containers-ipv4-ipv6";
+  meta = {
+    maintainers = with lib.maintainers; [
+      aristid
+      aszlig
+      kampfschlaefer
+    ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.writableStore = true;
+
+      containers.webserver4 = webserverFor "10.231.136.1" "10.231.136.2";
+      containers.webserver6 = webserverFor "fc00::2" "fc00::1";
+      virtualisation.additionalPaths = [ pkgs.stdenv ];
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        virtualisation.writableStore = true;
-
-        containers.webserver4 = webserverFor "10.231.136.1" "10.231.136.2";
-        containers.webserver6 = webserverFor "fc00::2" "fc00::1";
-        virtualisation.additionalPaths = [ pkgs.stdenv ];
-      };
-
-    testScript =
-      { nodes, ... }:
-      ''
-        import time
+  testScript =
+    { nodes, ... }:
+    ''
+      import time
 
 
-        def curl_host(ip):
-            # put [] around ipv6 addresses for curl
-            host = ip if ":" not in ip else f"[{ip}]"
-            return f"curl --fail --connect-timeout 2 http://{host}/ > /dev/null"
+      def curl_host(ip):
+          # put [] around ipv6 addresses for curl
+          host = ip if ":" not in ip else f"[{ip}]"
+          return f"curl --fail --connect-timeout 2 http://{host}/ > /dev/null"
 
 
-        def get_ip(container):
-            # need to distinguish because show-ip won't work for ipv6
-            if container == "webserver4":
-                ip = machine.succeed(f"nixos-container show-ip {container}").rstrip()
-                assert ip == "${nodes.machine.config.containers.webserver4.localAddress}"
-                return ip
-            return "${nodes.machine.config.containers.webserver6.localAddress}"
+      def get_ip(container):
+          # need to distinguish because show-ip won't work for ipv6
+          if container == "webserver4":
+              ip = machine.succeed(f"nixos-container show-ip {container}").rstrip()
+              assert ip == "${nodes.machine.config.containers.webserver4.localAddress}"
+              return ip
+          return "${nodes.machine.config.containers.webserver6.localAddress}"
 
 
-        for container in "webserver4", "webserver6":
-            assert container in machine.succeed("nixos-container list")
+      for container in "webserver4", "webserver6":
+          assert container in machine.succeed("nixos-container list")
 
-            with subtest(f"Start container {container}"):
-                machine.succeed(f"nixos-container start {container}")
-                # wait 2s for container to start and network to be up
-                time.sleep(2)
+          with subtest(f"Start container {container}"):
+              machine.succeed(f"nixos-container start {container}")
+              # wait 2s for container to start and network to be up
+              time.sleep(2)
 
-            # Since "start" returns after the container has reached
-            # multi-user.target, we should now be able to access it.
+          # Since "start" returns after the container has reached
+          # multi-user.target, we should now be able to access it.
 
-            ip = get_ip(container)
-            with subtest(f"{container} reacts to pings and HTTP requests"):
-                machine.succeed(f"ping -n -c1 {ip}")
-                machine.succeed(curl_host(ip))
+          ip = get_ip(container)
+          with subtest(f"{container} reacts to pings and HTTP requests"):
+              machine.succeed(f"ping -n -c1 {ip}")
+              machine.succeed(curl_host(ip))
 
-            with subtest(f"Stop container {container}"):
-                machine.succeed(f"nixos-container stop {container}")
-                machine.fail(curl_host(ip))
+          with subtest(f"Stop container {container}"):
+              machine.succeed(f"nixos-container stop {container}")
+              machine.fail(curl_host(ip))
 
-            # Destroying a declarative container should fail.
-            machine.fail(f"nixos-container destroy {container}")
-      '';
-  }
-)
+          # Destroying a declarative container should fail.
+          machine.fail(f"nixos-container destroy {container}")
+    '';
+}
diff --git a/nixos/tests/containers-macvlans.nix b/nixos/tests/containers-macvlans.nix
index 3ebfef9d0bc8..7b9644d0542f 100644
--- a/nixos/tests/containers-macvlans.nix
+++ b/nixos/tests/containers-macvlans.nix
@@ -4,97 +4,95 @@ let
   containerIp2 = "192.168.1.254";
 in
 
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-macvlans";
-    meta = {
-      maintainers = with lib.maintainers; [ montag451 ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "containers-macvlans";
+  meta = {
+    maintainers = with lib.maintainers; [ montag451 ];
+  };
 
-    nodes = {
+  nodes = {
 
-      machine1 =
-        { lib, ... }:
-        {
-          virtualisation.vlans = [ 1 ];
+    machine1 =
+      { lib, ... }:
+      {
+        virtualisation.vlans = [ 1 ];
 
-          # To be able to ping containers from the host, it is necessary
-          # to create a macvlan on the host on the VLAN 1 network.
-          networking.macvlans.mv-eth1-host = {
-            interface = "eth1";
-            mode = "bridge";
-          };
-          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [ ];
-          networking.interfaces.mv-eth1-host = {
-            ipv4.addresses = [
-              {
-                address = "192.168.1.1";
-                prefixLength = 24;
-              }
-            ];
-          };
+        # To be able to ping containers from the host, it is necessary
+        # to create a macvlan on the host on the VLAN 1 network.
+        networking.macvlans.mv-eth1-host = {
+          interface = "eth1";
+          mode = "bridge";
+        };
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [ ];
+        networking.interfaces.mv-eth1-host = {
+          ipv4.addresses = [
+            {
+              address = "192.168.1.1";
+              prefixLength = 24;
+            }
+          ];
+        };
 
-          containers.test1 = {
-            autoStart = true;
-            macvlans = [ "eth1" ];
+        containers.test1 = {
+          autoStart = true;
+          macvlans = [ "eth1" ];
 
-            config = {
-              networking.interfaces.mv-eth1 = {
-                ipv4.addresses = [
-                  {
-                    address = containerIp1;
-                    prefixLength = 24;
-                  }
-                ];
-              };
-            };
-          };
-
-          containers.test2 = {
-            autoStart = true;
-            macvlans = [ "eth1" ];
-
-            config = {
-              networking.interfaces.mv-eth1 = {
-                ipv4.addresses = [
-                  {
-                    address = containerIp2;
-                    prefixLength = 24;
-                  }
-                ];
-              };
+          config = {
+            networking.interfaces.mv-eth1 = {
+              ipv4.addresses = [
+                {
+                  address = containerIp1;
+                  prefixLength = 24;
+                }
+              ];
             };
           };
         };
 
-      machine2 =
-        { ... }:
-        {
-          virtualisation.vlans = [ 1 ];
+        containers.test2 = {
+          autoStart = true;
+          macvlans = [ "eth1" ];
+
+          config = {
+            networking.interfaces.mv-eth1 = {
+              ipv4.addresses = [
+                {
+                  address = containerIp2;
+                  prefixLength = 24;
+                }
+              ];
+            };
+          };
         };
+      };
 
-    };
+    machine2 =
+      { ... }:
+      {
+        virtualisation.vlans = [ 1 ];
+      };
 
-    testScript = ''
-      start_all()
-      machine1.wait_for_unit("default.target")
-      machine2.wait_for_unit("default.target")
+  };
 
-      with subtest(
-          "Ping between containers to check that macvlans are created in bridge mode"
-      ):
-          machine1.succeed("nixos-container run test1 -- ping -n -c 1 ${containerIp2}")
+  testScript = ''
+    start_all()
+    machine1.wait_for_unit("default.target")
+    machine2.wait_for_unit("default.target")
 
-      with subtest("Ping containers from the host (machine1)"):
-          machine1.succeed("ping -n -c 1 ${containerIp1}")
-          machine1.succeed("ping -n -c 1 ${containerIp2}")
+    with subtest(
+        "Ping between containers to check that macvlans are created in bridge mode"
+    ):
+        machine1.succeed("nixos-container run test1 -- ping -n -c 1 ${containerIp2}")
 
-      with subtest(
-          "Ping containers from the second machine to check that containers are reachable from the outside"
-      ):
-          machine2.succeed("ping -n -c 1 ${containerIp1}")
-          machine2.succeed("ping -n -c 1 ${containerIp2}")
-    '';
-  }
-)
+    with subtest("Ping containers from the host (machine1)"):
+        machine1.succeed("ping -n -c 1 ${containerIp1}")
+        machine1.succeed("ping -n -c 1 ${containerIp2}")
+
+    with subtest(
+        "Ping containers from the second machine to check that containers are reachable from the outside"
+    ):
+        machine2.succeed("ping -n -c 1 ${containerIp1}")
+        machine2.succeed("ping -n -c 1 ${containerIp2}")
+  '';
+}
diff --git a/nixos/tests/containers-names.nix b/nixos/tests/containers-names.nix
index 2ed047b62fe2..65f2763c50b3 100644
--- a/nixos/tests/containers-names.nix
+++ b/nixos/tests/containers-names.nix
@@ -1,44 +1,42 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-names";
-    meta = {
-      maintainers = with lib.maintainers; [ patryk27 ];
+{ pkgs, lib, ... }:
+{
+  name = "containers-names";
+  meta = {
+    maintainers = with lib.maintainers; [ patryk27 ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      # We're using the newest kernel, so that we can test containers with long names.
+      # Please see https://github.com/NixOS/nixpkgs/issues/38509 for details.
+      boot.kernelPackages = pkgs.linuxPackages_latest;
+
+      containers =
+        let
+          container = subnet: {
+            autoStart = true;
+            privateNetwork = true;
+            hostAddress = "192.168.${subnet}.1";
+            localAddress = "192.168.${subnet}.2";
+            config = { };
+          };
+
+        in
+        {
+          first = container "1";
+          second = container "2";
+          really-long-name = container "3";
+          really-long-long-name-2 = container "4";
+        };
     };
 
-    nodes.machine =
-      { ... }:
-      {
-        # We're using the newest kernel, so that we can test containers with long names.
-        # Please see https://github.com/NixOS/nixpkgs/issues/38509 for details.
-        boot.kernelPackages = pkgs.linuxPackages_latest;
+  testScript = ''
+    machine.wait_for_unit("default.target")
 
-        containers =
-          let
-            container = subnet: {
-              autoStart = true;
-              privateNetwork = true;
-              hostAddress = "192.168.${subnet}.1";
-              localAddress = "192.168.${subnet}.2";
-              config = { };
-            };
-
-          in
-          {
-            first = container "1";
-            second = container "2";
-            really-long-name = container "3";
-            really-long-long-name-2 = container "4";
-          };
-      };
-
-    testScript = ''
-      machine.wait_for_unit("default.target")
-
-      machine.succeed("ip link show | grep ve-first")
-      machine.succeed("ip link show | grep ve-second")
-      machine.succeed("ip link show | grep ve-really-lFYWO")
-      machine.succeed("ip link show | grep ve-really-l3QgY")
-    '';
-  }
-)
+    machine.succeed("ip link show | grep ve-first")
+    machine.succeed("ip link show | grep ve-second")
+    machine.succeed("ip link show | grep ve-really-lFYWO")
+    machine.succeed("ip link show | grep ve-really-l3QgY")
+  '';
+}
diff --git a/nixos/tests/containers-nested.nix b/nixos/tests/containers-nested.nix
index a274b64c443e..363332dc5853 100644
--- a/nixos/tests/containers-nested.nix
+++ b/nixos/tests/containers-nested.nix
@@ -1,36 +1,34 @@
 # Test for NixOS' container nesting.
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nested";
+{ pkgs, ... }:
+{
+  name = "nested";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ sorki ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ sorki ];
+  };
 
-    nodes.machine =
-      { lib, ... }:
-      let
-        makeNested = subConf: {
-          containers.nested = {
-            autoStart = true;
-            privateNetwork = true;
-            config = subConf;
-          };
+  nodes.machine =
+    { lib, ... }:
+    let
+      makeNested = subConf: {
+        containers.nested = {
+          autoStart = true;
+          privateNetwork = true;
+          config = subConf;
         };
-      in
-      makeNested (makeNested { });
+      };
+    in
+    makeNested (makeNested { });
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("container@nested.service")
-      machine.succeed("systemd-run --pty --machine=nested -- machinectl list | grep nested")
-      print(
-          machine.succeed(
-              "systemd-run --pty --machine=nested -- systemd-run --pty --machine=nested -- systemctl status"
-          )
-      )
-    '';
-  }
-)
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("container@nested.service")
+    machine.succeed("systemd-run --pty --machine=nested -- machinectl list | grep nested")
+    print(
+        machine.succeed(
+            "systemd-run --pty --machine=nested -- systemd-run --pty --machine=nested -- systemctl status"
+        )
+    )
+  '';
+}
diff --git a/nixos/tests/containers-physical_interfaces.nix b/nixos/tests/containers-physical_interfaces.nix
index efe7982c6762..aa96727985c5 100644
--- a/nixos/tests/containers-physical_interfaces.nix
+++ b/nixos/tests/containers-physical_interfaces.nix
@@ -1,153 +1,151 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-physical_interfaces";
-    meta = {
-      maintainers = with lib.maintainers; [ kampfschlaefer ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "containers-physical_interfaces";
+  meta = {
+    maintainers = with lib.maintainers; [ kampfschlaefer ];
+  };
 
-    nodes = {
-      server =
-        { ... }:
-        {
-          virtualisation.vlans = [ 1 ];
+  nodes = {
+    server =
+      { ... }:
+      {
+        virtualisation.vlans = [ 1 ];
 
-          containers.server = {
-            privateNetwork = true;
-            interfaces = [ "eth1" ];
+        containers.server = {
+          privateNetwork = true;
+          interfaces = [ "eth1" ];
 
-            config = {
-              networking.interfaces.eth1.ipv4.addresses = [
-                {
-                  address = "10.10.0.1";
-                  prefixLength = 24;
-                }
-              ];
-              networking.firewall.enable = false;
-            };
+          config = {
+            networking.interfaces.eth1.ipv4.addresses = [
+              {
+                address = "10.10.0.1";
+                prefixLength = 24;
+              }
+            ];
+            networking.firewall.enable = false;
           };
         };
-      bridged =
-        { ... }:
-        {
-          virtualisation.vlans = [ 1 ];
+      };
+    bridged =
+      { ... }:
+      {
+        virtualisation.vlans = [ 1 ];
 
-          containers.bridged = {
-            privateNetwork = true;
-            interfaces = [ "eth1" ];
+        containers.bridged = {
+          privateNetwork = true;
+          interfaces = [ "eth1" ];
 
-            config = {
-              networking.bridges.br0.interfaces = [ "eth1" ];
-              networking.interfaces.br0.ipv4.addresses = [
-                {
-                  address = "10.10.0.2";
-                  prefixLength = 24;
-                }
-              ];
-              networking.firewall.enable = false;
-            };
+          config = {
+            networking.bridges.br0.interfaces = [ "eth1" ];
+            networking.interfaces.br0.ipv4.addresses = [
+              {
+                address = "10.10.0.2";
+                prefixLength = 24;
+              }
+            ];
+            networking.firewall.enable = false;
           };
         };
+      };
 
-      bonded =
-        { ... }:
-        {
-          virtualisation.vlans = [ 1 ];
+    bonded =
+      { ... }:
+      {
+        virtualisation.vlans = [ 1 ];
 
-          containers.bonded = {
-            privateNetwork = true;
-            interfaces = [ "eth1" ];
+        containers.bonded = {
+          privateNetwork = true;
+          interfaces = [ "eth1" ];
 
-            config = {
-              networking.bonds.bond0 = {
-                interfaces = [ "eth1" ];
-                driverOptions.mode = "active-backup";
-              };
-              networking.interfaces.bond0.ipv4.addresses = [
-                {
-                  address = "10.10.0.3";
-                  prefixLength = 24;
-                }
-              ];
-              networking.firewall.enable = false;
+          config = {
+            networking.bonds.bond0 = {
+              interfaces = [ "eth1" ];
+              driverOptions.mode = "active-backup";
             };
+            networking.interfaces.bond0.ipv4.addresses = [
+              {
+                address = "10.10.0.3";
+                prefixLength = 24;
+              }
+            ];
+            networking.firewall.enable = false;
           };
         };
+      };
 
-      bridgedbond =
-        { ... }:
-        {
-          virtualisation.vlans = [ 1 ];
+    bridgedbond =
+      { ... }:
+      {
+        virtualisation.vlans = [ 1 ];
 
-          containers.bridgedbond = {
-            privateNetwork = true;
-            interfaces = [ "eth1" ];
+        containers.bridgedbond = {
+          privateNetwork = true;
+          interfaces = [ "eth1" ];
 
-            config = {
-              networking.bonds.bond0 = {
-                interfaces = [ "eth1" ];
-                driverOptions.mode = "active-backup";
-              };
-              networking.bridges.br0.interfaces = [ "bond0" ];
-              networking.interfaces.br0.ipv4.addresses = [
-                {
-                  address = "10.10.0.4";
-                  prefixLength = 24;
-                }
-              ];
-              networking.firewall.enable = false;
+          config = {
+            networking.bonds.bond0 = {
+              interfaces = [ "eth1" ];
+              driverOptions.mode = "active-backup";
             };
+            networking.bridges.br0.interfaces = [ "bond0" ];
+            networking.interfaces.br0.ipv4.addresses = [
+              {
+                address = "10.10.0.4";
+                prefixLength = 24;
+              }
+            ];
+            networking.firewall.enable = false;
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      with subtest("Prepare server"):
-          server.wait_for_unit("default.target")
-          server.succeed("ip link show dev eth1 >&2")
+    with subtest("Prepare server"):
+        server.wait_for_unit("default.target")
+        server.succeed("ip link show dev eth1 >&2")
 
-      with subtest("Simple physical interface is up"):
-          server.succeed("nixos-container start server")
-          server.wait_for_unit("container@server")
-          server.succeed(
-              "systemctl -M server list-dependencies network-addresses-eth1.service >&2"
-          )
+    with subtest("Simple physical interface is up"):
+        server.succeed("nixos-container start server")
+        server.wait_for_unit("container@server")
+        server.succeed(
+            "systemctl -M server list-dependencies network-addresses-eth1.service >&2"
+        )
 
-          # The other tests will ping this container on its ip. Here we just check
-          # that the device is present in the container.
-          server.succeed("nixos-container run server -- ip a show dev eth1 >&2")
+        # The other tests will ping this container on its ip. Here we just check
+        # that the device is present in the container.
+        server.succeed("nixos-container run server -- ip a show dev eth1 >&2")
 
-      with subtest("Physical device in bridge in container can ping server"):
-          bridged.wait_for_unit("default.target")
-          bridged.succeed("nixos-container start bridged")
-          bridged.wait_for_unit("container@bridged")
-          bridged.succeed(
-              "systemctl -M bridged list-dependencies network-addresses-br0.service >&2",
-              "systemctl -M bridged status -n 30 -l network-addresses-br0.service",
-              "nixos-container run bridged -- ping -w 10 -c 1 -n 10.10.0.1",
-          )
+    with subtest("Physical device in bridge in container can ping server"):
+        bridged.wait_for_unit("default.target")
+        bridged.succeed("nixos-container start bridged")
+        bridged.wait_for_unit("container@bridged")
+        bridged.succeed(
+            "systemctl -M bridged list-dependencies network-addresses-br0.service >&2",
+            "systemctl -M bridged status -n 30 -l network-addresses-br0.service",
+            "nixos-container run bridged -- ping -w 10 -c 1 -n 10.10.0.1",
+        )
 
-      with subtest("Physical device in bond in container can ping server"):
-          bonded.wait_for_unit("default.target")
-          bonded.succeed("nixos-container start bonded")
-          bonded.wait_for_unit("container@bonded")
-          bonded.succeed(
-              "systemctl -M bonded list-dependencies network-addresses-bond0 >&2",
-              "systemctl -M bonded status -n 30 -l network-addresses-bond0 >&2",
-              "nixos-container run bonded -- ping -w 10 -c 1 -n 10.10.0.1",
-          )
+    with subtest("Physical device in bond in container can ping server"):
+        bonded.wait_for_unit("default.target")
+        bonded.succeed("nixos-container start bonded")
+        bonded.wait_for_unit("container@bonded")
+        bonded.succeed(
+            "systemctl -M bonded list-dependencies network-addresses-bond0 >&2",
+            "systemctl -M bonded status -n 30 -l network-addresses-bond0 >&2",
+            "nixos-container run bonded -- ping -w 10 -c 1 -n 10.10.0.1",
+        )
 
-      with subtest("Physical device in bond in bridge in container can ping server"):
-          bridgedbond.wait_for_unit("default.target")
-          bridgedbond.succeed("nixos-container start bridgedbond")
-          bridgedbond.wait_for_unit("container@bridgedbond")
-          bridgedbond.succeed(
-              "systemctl -M bridgedbond list-dependencies network-addresses-br0.service >&2",
-              "systemctl -M bridgedbond status -n 30 -l network-addresses-br0.service",
-              "nixos-container run bridgedbond -- ping -w 10 -c 1 -n 10.10.0.1",
-          )
-    '';
-  }
-)
+    with subtest("Physical device in bond in bridge in container can ping server"):
+        bridgedbond.wait_for_unit("default.target")
+        bridgedbond.succeed("nixos-container start bridgedbond")
+        bridgedbond.wait_for_unit("container@bridgedbond")
+        bridgedbond.succeed(
+            "systemctl -M bridgedbond list-dependencies network-addresses-br0.service >&2",
+            "systemctl -M bridgedbond status -n 30 -l network-addresses-br0.service",
+            "nixos-container run bridgedbond -- ping -w 10 -c 1 -n 10.10.0.1",
+        )
+  '';
+}
diff --git a/nixos/tests/containers-portforward.nix b/nixos/tests/containers-portforward.nix
index be087dba48f0..21b618b4abd5 100644
--- a/nixos/tests/containers-portforward.nix
+++ b/nixos/tests/containers-portforward.nix
@@ -5,69 +5,67 @@ let
   containerPort = 80;
 in
 
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-portforward";
-    meta = {
-      maintainers = with lib.maintainers; [
-        aristid
-        aszlig
-        kampfschlaefer
-        ianwookim
-      ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "containers-portforward";
+  meta = {
+    maintainers = with lib.maintainers; [
+      aristid
+      aszlig
+      kampfschlaefer
+      ianwookim
+    ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ../modules/installer/cd-dvd/channel.nix ];
-        virtualisation.writableStore = true;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ../modules/installer/cd-dvd/channel.nix ];
+      virtualisation.writableStore = true;
 
-        containers.webserver = {
-          privateNetwork = true;
-          hostAddress = hostIp;
-          localAddress = containerIp;
-          forwardPorts = [
-            {
-              protocol = "tcp";
-              hostPort = hostPort;
-              containerPort = containerPort;
-            }
-          ];
-          config = {
-            services.httpd.enable = true;
-            services.httpd.adminAddr = "foo@example.org";
-            networking.firewall.allowedTCPPorts = [ 80 ];
-          };
+      containers.webserver = {
+        privateNetwork = true;
+        hostAddress = hostIp;
+        localAddress = containerIp;
+        forwardPorts = [
+          {
+            protocol = "tcp";
+            hostPort = hostPort;
+            containerPort = containerPort;
+          }
+        ];
+        config = {
+          services.httpd.enable = true;
+          services.httpd.adminAddr = "foo@example.org";
+          networking.firewall.allowedTCPPorts = [ 80 ];
         };
-
-        virtualisation.additionalPaths = [ pkgs.stdenv ];
       };
 
-    testScript = ''
-      container_list = machine.succeed("nixos-container list")
-      assert "webserver" in container_list
+      virtualisation.additionalPaths = [ pkgs.stdenv ];
+    };
 
-      # Start the webserver container.
-      machine.succeed("nixos-container start webserver")
+  testScript = ''
+    container_list = machine.succeed("nixos-container list")
+    assert "webserver" in container_list
 
-      # wait two seconds for the container to start and the network to be up
-      machine.sleep(2)
+    # Start the webserver container.
+    machine.succeed("nixos-container start webserver")
 
-      # Since "start" returns after the container has reached
-      # multi-user.target, we should now be able to access it.
-      # ip = machine.succeed("nixos-container show-ip webserver").strip()
-      machine.succeed("ping -n -c1 ${hostIp}")
-      machine.succeed("curl --fail http://${hostIp}:${toString hostPort}/ > /dev/null")
+    # wait two seconds for the container to start and the network to be up
+    machine.sleep(2)
 
-      # Stop the container.
-      machine.succeed("nixos-container stop webserver")
-      machine.fail("curl --fail --connect-timeout 2 http://${hostIp}:${toString hostPort}/ > /dev/null")
+    # Since "start" returns after the container has reached
+    # multi-user.target, we should now be able to access it.
+    # ip = machine.succeed("nixos-container show-ip webserver").strip()
+    machine.succeed("ping -n -c1 ${hostIp}")
+    machine.succeed("curl --fail http://${hostIp}:${toString hostPort}/ > /dev/null")
 
-      # Destroying a declarative container should fail.
-      machine.fail("nixos-container destroy webserver")
-    '';
+    # Stop the container.
+    machine.succeed("nixos-container stop webserver")
+    machine.fail("curl --fail --connect-timeout 2 http://${hostIp}:${toString hostPort}/ > /dev/null")
 
-  }
-)
+    # Destroying a declarative container should fail.
+    machine.fail("nixos-container destroy webserver")
+  '';
+
+}
diff --git a/nixos/tests/containers-reloadable.nix b/nixos/tests/containers-reloadable.nix
index 74c6003da659..9854db830550 100644
--- a/nixos/tests/containers-reloadable.nix
+++ b/nixos/tests/containers-reloadable.nix
@@ -1,61 +1,59 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-reloadable";
-    meta = {
-      maintainers = with lib.maintainers; [ danbst ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "containers-reloadable";
+  meta = {
+    maintainers = with lib.maintainers; [ danbst ];
+  };
 
-    nodes = {
-      machine =
-        { lib, ... }:
-        {
-          containers.test1 = {
-            autoStart = true;
-            config.environment.etc.check.text = "client_base";
-          };
+  nodes = {
+    machine =
+      { lib, ... }:
+      {
+        containers.test1 = {
+          autoStart = true;
+          config.environment.etc.check.text = "client_base";
+        };
 
-          # prevent make-test-python.nix to change IP
-          networking.interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [ ];
+        # prevent make-test-python.nix to change IP
+        networking.interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [ ];
 
-          specialisation.c1.configuration = {
-            containers.test1.config = {
-              environment.etc.check.text = lib.mkForce "client_c1";
-              services.httpd.enable = true;
-              services.httpd.adminAddr = "nixos@example.com";
-            };
-          };
-
-          specialisation.c2.configuration = {
-            containers.test1.config = {
-              environment.etc.check.text = lib.mkForce "client_c2";
-              services.nginx.enable = true;
-            };
+        specialisation.c1.configuration = {
+          containers.test1.config = {
+            environment.etc.check.text = lib.mkForce "client_c1";
+            services.httpd.enable = true;
+            services.httpd.adminAddr = "nixos@example.com";
           };
         };
-    };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("default.target")
+        specialisation.c2.configuration = {
+          containers.test1.config = {
+            environment.etc.check.text = lib.mkForce "client_c2";
+            services.nginx.enable = true;
+          };
+        };
+      };
+  };
 
-      assert "client_base" in machine.succeed("nixos-container run test1 cat /etc/check")
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("default.target")
 
-      with subtest("httpd is available after activating config1"):
-          machine.succeed(
-              "/run/booted-system/specialisation/c1/bin/switch-to-configuration test >&2",
-              "[[ $(nixos-container run test1 cat /etc/check) == client_c1 ]] >&2",
-              "systemctl status httpd -M test1 >&2",
-          )
+    assert "client_base" in machine.succeed("nixos-container run test1 cat /etc/check")
 
-      with subtest("httpd is not available any longer after switching to config2"):
-          machine.succeed(
-              "/run/booted-system/specialisation/c2/bin/switch-to-configuration test >&2",
-              "[[ $(nixos-container run test1 cat /etc/check) == client_c2 ]] >&2",
-              "systemctl status nginx -M test1 >&2",
-          )
-          machine.fail("systemctl status httpd -M test1 >&2")
-    '';
+    with subtest("httpd is available after activating config1"):
+        machine.succeed(
+            "/run/booted-system/specialisation/c1/bin/switch-to-configuration test >&2",
+            "[[ $(nixos-container run test1 cat /etc/check) == client_c1 ]] >&2",
+            "systemctl status httpd -M test1 >&2",
+        )
 
-  }
-)
+    with subtest("httpd is not available any longer after switching to config2"):
+        machine.succeed(
+            "/run/booted-system/specialisation/c2/bin/switch-to-configuration test >&2",
+            "[[ $(nixos-container run test1 cat /etc/check) == client_c2 ]] >&2",
+            "systemctl status nginx -M test1 >&2",
+        )
+        machine.fail("systemctl status httpd -M test1 >&2")
+  '';
+
+}
diff --git a/nixos/tests/containers-require-bind-mounts.nix b/nixos/tests/containers-require-bind-mounts.nix
index b5a861beacc9..eb65a619c7e9 100644
--- a/nixos/tests/containers-require-bind-mounts.nix
+++ b/nixos/tests/containers-require-bind-mounts.nix
@@ -1,40 +1,38 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "containers-require-bind-mounts";
-    meta.maintainers = with lib.maintainers; [ kira-bruneau ];
+{ lib, ... }:
+{
+  name = "containers-require-bind-mounts";
+  meta.maintainers = with lib.maintainers; [ kira-bruneau ];
 
-    nodes.machine = {
-      containers.require-bind-mounts = {
-        bindMounts = {
-          "/srv/data" = { };
-        };
-        config = { };
-      };
-
-      virtualisation.fileSystems = {
-        "/srv/data" = {
-          fsType = "tmpfs";
-          options = [ "noauto" ];
-        };
+  nodes.machine = {
+    containers.require-bind-mounts = {
+      bindMounts = {
+        "/srv/data" = { };
       };
+      config = { };
     };
 
-    testScript = ''
-      machine.wait_for_unit("default.target")
+    virtualisation.fileSystems = {
+      "/srv/data" = {
+        fsType = "tmpfs";
+        options = [ "noauto" ];
+      };
+    };
+  };
 
-      assert "require-bind-mounts" in machine.succeed("nixos-container list")
+  testScript = ''
+    machine.wait_for_unit("default.target")
+
+    assert "require-bind-mounts" in machine.succeed("nixos-container list")
+    assert "down" in machine.succeed("nixos-container status require-bind-mounts")
+    assert "inactive" in machine.fail("systemctl is-active srv-data.mount")
+
+    with subtest("bind mount host paths must be mounted to run container"):
+      machine.succeed("nixos-container start require-bind-mounts")
+      assert "up" in machine.succeed("nixos-container status require-bind-mounts")
+      assert "active" in machine.succeed("systemctl status srv-data.mount")
+
+      machine.succeed("systemctl stop srv-data.mount")
       assert "down" in machine.succeed("nixos-container status require-bind-mounts")
       assert "inactive" in machine.fail("systemctl is-active srv-data.mount")
-
-      with subtest("bind mount host paths must be mounted to run container"):
-        machine.succeed("nixos-container start require-bind-mounts")
-        assert "up" in machine.succeed("nixos-container status require-bind-mounts")
-        assert "active" in machine.succeed("systemctl status srv-data.mount")
-
-        machine.succeed("systemctl stop srv-data.mount")
-        assert "down" in machine.succeed("nixos-container status require-bind-mounts")
-        assert "inactive" in machine.fail("systemctl is-active srv-data.mount")
-    '';
-  }
-)
+  '';
+}
diff --git a/nixos/tests/containers-restart_networking.nix b/nixos/tests/containers-restart_networking.nix
index d0d77031ea4b..8ce524a3e91c 100644
--- a/nixos/tests/containers-restart_networking.nix
+++ b/nixos/tests/containers-restart_networking.nix
@@ -1,131 +1,129 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-restart_networking";
-    meta = {
-      maintainers = with lib.maintainers; [ kampfschlaefer ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "containers-restart_networking";
+  meta = {
+    maintainers = with lib.maintainers; [ kampfschlaefer ];
+  };
 
-    nodes = {
-      client = {
-        virtualisation.vlans = [ 1 ];
+  nodes = {
+    client = {
+      virtualisation.vlans = [ 1 ];
 
-        networking.firewall.enable = false;
+      networking.firewall.enable = false;
 
-        containers.webserver = {
-          autoStart = true;
-          privateNetwork = true;
-          hostBridge = "br0";
-          config = {
-            networking.firewall.enable = false;
-            networking.interfaces.eth0.ipv4.addresses = [
-              {
-                address = "192.168.1.122";
-                prefixLength = 24;
-              }
-            ];
-          };
+      containers.webserver = {
+        autoStart = true;
+        privateNetwork = true;
+        hostBridge = "br0";
+        config = {
+          networking.firewall.enable = false;
+          networking.interfaces.eth0.ipv4.addresses = [
+            {
+              address = "192.168.1.122";
+              prefixLength = 24;
+            }
+          ];
         };
+      };
 
+      networking.bridges.br0 = {
+        interfaces = [ ];
+        rstp = false;
+      };
+
+      networking.interfaces.br0.ipv4.addresses = [
+        {
+          address = "192.168.1.1";
+          prefixLength = 24;
+        }
+      ];
+
+      networking.interfaces.eth1 = {
+        ipv4.addresses = lib.mkForce [ ];
+        ipv6.addresses = lib.mkForce [ ];
+      };
+
+      specialisation.eth1.configuration = {
+        networking.bridges.br0.interfaces = [ "eth1" ];
+        networking.interfaces = {
+          eth1.ipv4.addresses = lib.mkForce [ ];
+          eth1.ipv6.addresses = lib.mkForce [ ];
+          br0.ipv4.addresses = [
+            {
+              address = "192.168.1.2";
+              prefixLength = 24;
+            }
+          ];
+        };
+      };
+
+      specialisation.eth1-rstp.configuration = {
         networking.bridges.br0 = {
-          interfaces = [ ];
-          rstp = false;
+          interfaces = [ "eth1" ];
+          rstp = lib.mkForce true;
         };
 
-        networking.interfaces.br0.ipv4.addresses = [
-          {
-            address = "192.168.1.1";
-            prefixLength = 24;
-          }
-        ];
-
-        networking.interfaces.eth1 = {
-          ipv4.addresses = lib.mkForce [ ];
-          ipv6.addresses = lib.mkForce [ ];
-        };
-
-        specialisation.eth1.configuration = {
-          networking.bridges.br0.interfaces = [ "eth1" ];
-          networking.interfaces = {
-            eth1.ipv4.addresses = lib.mkForce [ ];
-            eth1.ipv6.addresses = lib.mkForce [ ];
-            br0.ipv4.addresses = [
-              {
-                address = "192.168.1.2";
-                prefixLength = 24;
-              }
-            ];
-          };
-        };
-
-        specialisation.eth1-rstp.configuration = {
-          networking.bridges.br0 = {
-            interfaces = [ "eth1" ];
-            rstp = lib.mkForce true;
-          };
-
-          networking.interfaces = {
-            eth1.ipv4.addresses = lib.mkForce [ ];
-            eth1.ipv6.addresses = lib.mkForce [ ];
-            br0.ipv4.addresses = [
-              {
-                address = "192.168.1.2";
-                prefixLength = 24;
-              }
-            ];
-          };
+        networking.interfaces = {
+          eth1.ipv4.addresses = lib.mkForce [ ];
+          eth1.ipv6.addresses = lib.mkForce [ ];
+          br0.ipv4.addresses = [
+            {
+              address = "192.168.1.2";
+              prefixLength = 24;
+            }
+          ];
         };
       };
     };
+  };
 
-    testScript = ''
-      client.start()
+  testScript = ''
+    client.start()
 
-      client.wait_for_unit("default.target")
+    client.wait_for_unit("default.target")
 
-      with subtest("Initial configuration connectivity check"):
-          client.succeed("ping 192.168.1.122 -c 1 -n >&2")
-          client.succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2")
+    with subtest("Initial configuration connectivity check"):
+        client.succeed("ping 192.168.1.122 -c 1 -n >&2")
+        client.succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2")
 
-          client.fail("ip l show eth1 |grep 'master br0' >&2")
-          client.fail("grep eth1 /run/br0.interfaces >&2")
+        client.fail("ip l show eth1 |grep 'master br0' >&2")
+        client.fail("grep eth1 /run/br0.interfaces >&2")
 
-      with subtest("Bridged configuration without STP preserves connectivity"):
-          client.succeed(
-              "/run/booted-system/specialisation/eth1/bin/switch-to-configuration test >&2"
-          )
+    with subtest("Bridged configuration without STP preserves connectivity"):
+        client.succeed(
+            "/run/booted-system/specialisation/eth1/bin/switch-to-configuration test >&2"
+        )
 
-          client.succeed(
-              "ping 192.168.1.122 -c 1 -n >&2",
-              "nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2",
-              "ip l show eth1 |grep 'master br0' >&2",
-              "grep eth1 /run/br0.interfaces >&2",
-          )
+        client.succeed(
+            "ping 192.168.1.122 -c 1 -n >&2",
+            "nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2",
+            "ip l show eth1 |grep 'master br0' >&2",
+            "grep eth1 /run/br0.interfaces >&2",
+        )
 
-      #  activating rstp needs another service, therefore the bridge will restart and the container will lose its connectivity
-      # with subtest("Bridged configuration with STP"):
-      #     client.succeed("/run/booted-system/specialisation/eth1-rstp/bin/switch-to-configuration test >&2")
-      #     client.execute("ip -4 a >&2")
-      #     client.execute("ip l >&2")
-      #
-      #     client.succeed(
-      #         "ping 192.168.1.122 -c 1 -n >&2",
-      #         "nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2",
-      #         "ip l show eth1 |grep 'master br0' >&2",
-      #         "grep eth1 /run/br0.interfaces >&2",
-      #     )
+    #  activating rstp needs another service, therefore the bridge will restart and the container will lose its connectivity
+    # with subtest("Bridged configuration with STP"):
+    #     client.succeed("/run/booted-system/specialisation/eth1-rstp/bin/switch-to-configuration test >&2")
+    #     client.execute("ip -4 a >&2")
+    #     client.execute("ip l >&2")
+    #
+    #     client.succeed(
+    #         "ping 192.168.1.122 -c 1 -n >&2",
+    #         "nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2",
+    #         "ip l show eth1 |grep 'master br0' >&2",
+    #         "grep eth1 /run/br0.interfaces >&2",
+    #     )
 
-      with subtest("Reverting to initial configuration preserves connectivity"):
-          client.succeed(
-              "/run/booted-system/bin/switch-to-configuration test >&2"
-          )
+    with subtest("Reverting to initial configuration preserves connectivity"):
+        client.succeed(
+            "/run/booted-system/bin/switch-to-configuration test >&2"
+        )
 
-          client.succeed("ping 192.168.1.122 -c 1 -n >&2")
-          client.succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2")
+        client.succeed("ping 192.168.1.122 -c 1 -n >&2")
+        client.succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2")
 
-          client.fail("ip l show eth1 |grep 'master br0' >&2")
-          client.fail("grep eth1 /run/br0.interfaces >&2")
-    '';
+        client.fail("ip l show eth1 |grep 'master br0' >&2")
+        client.fail("grep eth1 /run/br0.interfaces >&2")
+  '';
 
-  }
-)
+}
diff --git a/nixos/tests/containers-tmpfs.nix b/nixos/tests/containers-tmpfs.nix
index 668417df271e..2ac1795cca06 100644
--- a/nixos/tests/containers-tmpfs.nix
+++ b/nixos/tests/containers-tmpfs.nix
@@ -1,93 +1,91 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-tmpfs";
-    meta = {
-      maintainers = with lib.maintainers; [ patryk27 ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "containers-tmpfs";
+  meta = {
+    maintainers = with lib.maintainers; [ patryk27 ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ../modules/installer/cd-dvd/channel.nix ];
-        virtualisation.writableStore = true;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ../modules/installer/cd-dvd/channel.nix ];
+      virtualisation.writableStore = true;
 
-        containers.tmpfs = {
-          autoStart = true;
-          tmpfs = [
-            # Mount var as a tmpfs
-            "/var"
+      containers.tmpfs = {
+        autoStart = true;
+        tmpfs = [
+          # Mount var as a tmpfs
+          "/var"
 
-            # Add a nested mount inside a tmpfs
-            "/var/log"
+          # Add a nested mount inside a tmpfs
+          "/var/log"
 
-            # Add a tmpfs on a path that does not exist
-            "/some/random/path"
-          ];
-          config = { };
-        };
-
-        virtualisation.additionalPaths = [ pkgs.stdenv ];
+          # Add a tmpfs on a path that does not exist
+          "/some/random/path"
+        ];
+        config = { };
       };
 
-    testScript = ''
-      machine.wait_for_unit("default.target")
-      assert "tmpfs" in machine.succeed("nixos-container list")
+      virtualisation.additionalPaths = [ pkgs.stdenv ];
+    };
 
-      with subtest("tmpfs container is up"):
-          assert "up" in machine.succeed("nixos-container status tmpfs")
+  testScript = ''
+    machine.wait_for_unit("default.target")
+    assert "tmpfs" in machine.succeed("nixos-container list")
+
+    with subtest("tmpfs container is up"):
+        assert "up" in machine.succeed("nixos-container status tmpfs")
 
 
-      def tmpfs_cmd(command):
-          return f"nixos-container run tmpfs -- {command} 2>/dev/null"
+    def tmpfs_cmd(command):
+        return f"nixos-container run tmpfs -- {command} 2>/dev/null"
 
 
-      with subtest("/var is mounted as a tmpfs"):
-          machine.succeed(tmpfs_cmd("mountpoint -q /var"))
+    with subtest("/var is mounted as a tmpfs"):
+        machine.succeed(tmpfs_cmd("mountpoint -q /var"))
 
-      with subtest("/var/log is mounted as a tmpfs"):
-          assert "What: tmpfs" in machine.succeed(
-              tmpfs_cmd("systemctl status var-log.mount --no-pager")
-          )
-          machine.succeed(tmpfs_cmd("mountpoint -q /var/log"))
+    with subtest("/var/log is mounted as a tmpfs"):
+        assert "What: tmpfs" in machine.succeed(
+            tmpfs_cmd("systemctl status var-log.mount --no-pager")
+        )
+        machine.succeed(tmpfs_cmd("mountpoint -q /var/log"))
 
-      with subtest("/some/random/path is mounted as a tmpfs"):
-          assert "What: tmpfs" in machine.succeed(
-              tmpfs_cmd("systemctl status some-random-path.mount --no-pager")
-          )
-          machine.succeed(tmpfs_cmd("mountpoint -q /some/random/path"))
+    with subtest("/some/random/path is mounted as a tmpfs"):
+        assert "What: tmpfs" in machine.succeed(
+            tmpfs_cmd("systemctl status some-random-path.mount --no-pager")
+        )
+        machine.succeed(tmpfs_cmd("mountpoint -q /some/random/path"))
 
-      with subtest(
-          "files created in the container in a non-tmpfs directory are visible on the host."
-      ):
-          # This establishes legitimacy for the following tests
-          machine.succeed(
-              tmpfs_cmd("touch /root/test.file"),
-              tmpfs_cmd("ls -l  /root | grep -q test.file"),
-              "test -e /var/lib/nixos-containers/tmpfs/root/test.file",
-          )
+    with subtest(
+        "files created in the container in a non-tmpfs directory are visible on the host."
+    ):
+        # This establishes legitimacy for the following tests
+        machine.succeed(
+            tmpfs_cmd("touch /root/test.file"),
+            tmpfs_cmd("ls -l  /root | grep -q test.file"),
+            "test -e /var/lib/nixos-containers/tmpfs/root/test.file",
+        )
 
-      with subtest(
-          "/some/random/path is writable and that files created there are not "
-          + "in the hosts container dir but in the tmpfs"
-      ):
-          machine.succeed(
-              tmpfs_cmd("touch /some/random/path/test.file"),
-              tmpfs_cmd("test -e /some/random/path/test.file"),
-          )
-          machine.fail("test -e /var/lib/nixos-containers/tmpfs/some/random/path/test.file")
+    with subtest(
+        "/some/random/path is writable and that files created there are not "
+        + "in the hosts container dir but in the tmpfs"
+    ):
+        machine.succeed(
+            tmpfs_cmd("touch /some/random/path/test.file"),
+            tmpfs_cmd("test -e /some/random/path/test.file"),
+        )
+        machine.fail("test -e /var/lib/nixos-containers/tmpfs/some/random/path/test.file")
 
-      with subtest(
-          "files created in the hosts container dir in a path where a tmpfs "
-          + "file system has been mounted are not visible to the container as "
-          + "the do not exist in the tmpfs"
-      ):
-          machine.succeed(
-              "touch /var/lib/nixos-containers/tmpfs/var/test.file",
-              "test -e /var/lib/nixos-containers/tmpfs/var/test.file",
-              "ls -l /var/lib/nixos-containers/tmpfs/var/ | grep -q test.file 2>/dev/null",
-          )
-          machine.fail(tmpfs_cmd("ls -l /var | grep -q test.file"))
-    '';
-  }
-)
+    with subtest(
+        "files created in the hosts container dir in a path where a tmpfs "
+        + "file system has been mounted are not visible to the container as "
+        + "the do not exist in the tmpfs"
+    ):
+        machine.succeed(
+            "touch /var/lib/nixos-containers/tmpfs/var/test.file",
+            "test -e /var/lib/nixos-containers/tmpfs/var/test.file",
+            "ls -l /var/lib/nixos-containers/tmpfs/var/ | grep -q test.file 2>/dev/null",
+        )
+        machine.fail(tmpfs_cmd("ls -l /var | grep -q test.file"))
+  '';
+}
diff --git a/nixos/tests/containers-unified-hierarchy.nix b/nixos/tests/containers-unified-hierarchy.nix
index 5ea89d96dcfe..417f68d0d31d 100644
--- a/nixos/tests/containers-unified-hierarchy.nix
+++ b/nixos/tests/containers-unified-hierarchy.nix
@@ -1,26 +1,24 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "containers-unified-hierarchy";
-    meta = {
-      maintainers = with lib.maintainers; [ farnoy ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "containers-unified-hierarchy";
+  meta = {
+    maintainers = with lib.maintainers; [ farnoy ];
+  };
 
-    nodes.machine =
-      { ... }:
-      {
-        containers = {
-          test-container = {
-            autoStart = true;
-            config = { };
-          };
+  nodes.machine =
+    { ... }:
+    {
+      containers = {
+        test-container = {
+          autoStart = true;
+          config = { };
         };
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("default.target")
+  testScript = ''
+    machine.wait_for_unit("default.target")
 
-      machine.succeed("echo 'stat -fc %T /sys/fs/cgroup/ | grep cgroup2fs' | nixos-container root-login test-container")
-    '';
-  }
-)
+    machine.succeed("echo 'stat -fc %T /sys/fs/cgroup/ | grep cgroup2fs' | nixos-container root-login test-container")
+  '';
+}
diff --git a/nixos/tests/convos.nix b/nixos/tests/convos.nix
index f92ab49a2988..fd0588290950 100644
--- a/nixos/tests/convos.nix
+++ b/nixos/tests/convos.nix
@@ -1,28 +1,26 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  let
-    port = 3333;
-  in
-  {
-    name = "convos";
-    meta.maintainers = with lib.maintainers; [ sgo ];
+let
+  port = 3333;
+in
+{
+  name = "convos";
+  meta.maintainers = with lib.maintainers; [ sgo ];
 
-    nodes = {
-      machine =
-        { pkgs, ... }:
-        {
-          services.convos = {
-            enable = true;
-            listenPort = port;
-          };
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.convos = {
+          enable = true;
+          listenPort = port;
         };
-    };
+      };
+  };
 
-    testScript = ''
-      machine.wait_for_unit("convos")
-      machine.wait_for_open_port(${toString port})
-      machine.succeed("curl -f http://localhost:${toString port}/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("convos")
+    machine.wait_for_open_port(${toString port})
+    machine.succeed("curl -f http://localhost:${toString port}/")
+  '';
+}
diff --git a/nixos/tests/coturn.nix b/nixos/tests/coturn.nix
index e090b45d4af6..8366ceb0045e 100644
--- a/nixos/tests/coturn.nix
+++ b/nixos/tests/coturn.nix
@@ -1,38 +1,36 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "coturn";
-    nodes = {
-      default = {
-        services.coturn.enable = true;
-      };
-      secretsfile = {
-        boot.postBootCommands = ''
-          echo "some-very-secret-string" > /run/coturn-secret
-        '';
-        services.coturn = {
-          enable = true;
-          static-auth-secret-file = "/run/coturn-secret";
-        };
+{ pkgs, ... }:
+{
+  name = "coturn";
+  nodes = {
+    default = {
+      services.coturn.enable = true;
+    };
+    secretsfile = {
+      boot.postBootCommands = ''
+        echo "some-very-secret-string" > /run/coturn-secret
+      '';
+      services.coturn = {
+        enable = true;
+        static-auth-secret-file = "/run/coturn-secret";
       };
     };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      with subtest("by default works without configuration"):
-          default.wait_for_unit("coturn.service")
+    with subtest("by default works without configuration"):
+        default.wait_for_unit("coturn.service")
 
-      with subtest("works with static-auth-secret-file"):
-          secretsfile.wait_for_unit("coturn.service")
-          secretsfile.wait_for_open_port(3478)
-          secretsfile.succeed("grep 'some-very-secret-string' /run/coturn/turnserver.cfg")
-          # Forbidden IP, fails:
-          secretsfile.fail("${pkgs.coturn}/bin/turnutils_uclient -W some-very-secret-string 127.0.0.1 -DgX -e 127.0.0.1 -n 1 -c -y")
-          # allowed-peer-ip, should succeed:
-          secretsfile.succeed("${pkgs.coturn}/bin/turnutils_uclient -W some-very-secret-string 192.168.1.2 -DgX -e 192.168.1.2 -n 1 -c -y")
+    with subtest("works with static-auth-secret-file"):
+        secretsfile.wait_for_unit("coturn.service")
+        secretsfile.wait_for_open_port(3478)
+        secretsfile.succeed("grep 'some-very-secret-string' /run/coturn/turnserver.cfg")
+        # Forbidden IP, fails:
+        secretsfile.fail("${pkgs.coturn}/bin/turnutils_uclient -W some-very-secret-string 127.0.0.1 -DgX -e 127.0.0.1 -n 1 -c -y")
+        # allowed-peer-ip, should succeed:
+        secretsfile.succeed("${pkgs.coturn}/bin/turnutils_uclient -W some-very-secret-string 192.168.1.2 -DgX -e 192.168.1.2 -n 1 -c -y")
 
-      default.log(default.execute("systemd-analyze security coturn.service | grep -v '✓'")[1])
-    '';
-  }
-)
+    default.log(default.execute("systemd-analyze security coturn.service | grep -v '✓'")[1])
+  '';
+}
diff --git a/nixos/tests/couchdb.nix b/nixos/tests/couchdb.nix
index a3945915f98b..d11176bdd311 100644
--- a/nixos/tests/couchdb.nix
+++ b/nixos/tests/couchdb.nix
@@ -14,51 +14,49 @@ let
   testpass = "cowabunga";
   testlogin = "${testuser}:${testpass}@";
 in
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "couchdb";
-    meta.maintainers = [ ];
+{ pkgs, lib, ... }:
+{
+  name = "couchdb";
+  meta.maintainers = [ ];
 
-    nodes = {
-      couchdb3 = makeNode pkgs.couchdb3 testuser testpass;
-    };
+  nodes = {
+    couchdb3 = makeNode pkgs.couchdb3 testuser testpass;
+  };
 
-    testScript =
-      let
-        curlJqCheck =
-          login: action: path: jqexpr: result:
-          pkgs.writeScript "curl-jq-check-${action}-${path}.sh" ''
-            RESULT=$(curl -X ${action} http://${login}127.0.0.1:5984/${path} | jq -r '${jqexpr}')
-            echo $RESULT >&2
-            if [ "$RESULT" != "${result}" ]; then
-              exit 1
-            fi
-          '';
-      in
-      ''
-        start_all()
+  testScript =
+    let
+      curlJqCheck =
+        login: action: path: jqexpr: result:
+        pkgs.writeScript "curl-jq-check-${action}-${path}.sh" ''
+          RESULT=$(curl -X ${action} http://${login}127.0.0.1:5984/${path} | jq -r '${jqexpr}')
+          echo $RESULT >&2
+          if [ "$RESULT" != "${result}" ]; then
+            exit 1
+          fi
+        '';
+    in
+    ''
+      start_all()
 
-        couchdb3.wait_for_unit("couchdb.service")
-        couchdb3.wait_until_succeeds(
-            "${curlJqCheck testlogin "GET" "" ".couchdb" "Welcome"}"
-        )
-        couchdb3.wait_until_succeeds(
-            "${curlJqCheck testlogin "GET" "_all_dbs" ". | length" "0"}"
-        )
-        couchdb3.succeed("${curlJqCheck testlogin "PUT" "foo" ".ok" "true"}")
-        couchdb3.succeed(
-            "${curlJqCheck testlogin "GET" "_all_dbs" ". | length" "1"}"
-        )
-        couchdb3.succeed(
-            "${curlJqCheck testlogin "DELETE" "foo" ".ok" "true"}"
-        )
-        couchdb3.succeed(
-            "${curlJqCheck testlogin "GET" "_all_dbs" ". | length" "0"}"
-        )
-        couchdb3.succeed(
-            "${curlJqCheck testlogin "GET" "_node/couchdb@127.0.0.1" ".couchdb" "Welcome"}"
-        )
-      '';
-  }
-)
+      couchdb3.wait_for_unit("couchdb.service")
+      couchdb3.wait_until_succeeds(
+          "${curlJqCheck testlogin "GET" "" ".couchdb" "Welcome"}"
+      )
+      couchdb3.wait_until_succeeds(
+          "${curlJqCheck testlogin "GET" "_all_dbs" ". | length" "0"}"
+      )
+      couchdb3.succeed("${curlJqCheck testlogin "PUT" "foo" ".ok" "true"}")
+      couchdb3.succeed(
+          "${curlJqCheck testlogin "GET" "_all_dbs" ". | length" "1"}"
+      )
+      couchdb3.succeed(
+          "${curlJqCheck testlogin "DELETE" "foo" ".ok" "true"}"
+      )
+      couchdb3.succeed(
+          "${curlJqCheck testlogin "GET" "_all_dbs" ". | length" "0"}"
+      )
+      couchdb3.succeed(
+          "${curlJqCheck testlogin "GET" "_node/couchdb@127.0.0.1" ".couchdb" "Welcome"}"
+      )
+    '';
+}
diff --git a/nixos/tests/crabfit.nix b/nixos/tests/crabfit.nix
index eb38a0ae0cfc..e22615c5a049 100644
--- a/nixos/tests/crabfit.nix
+++ b/nixos/tests/crabfit.nix
@@ -1,33 +1,31 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  {
-    name = "crabfit";
+{
+  name = "crabfit";
 
-    meta.maintainers = [ ];
+  meta.maintainers = [ ];
 
-    nodes = {
-      machine =
-        { pkgs, ... }:
-        {
-          services.crabfit = {
-            enable = true;
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.crabfit = {
+          enable = true;
 
-            frontend.host = "http://127.0.0.1:3001";
-            api.host = "127.0.0.1:3000";
-          };
+          frontend.host = "http://127.0.0.1:3001";
+          api.host = "127.0.0.1:3000";
         };
-    };
+      };
+  };
 
-    # TODO: Add a reverse proxy and a dns entry for testing
-    testScript = ''
-      machine.wait_for_unit("crabfit-api")
-      machine.wait_for_unit("crabfit-frontend")
+  # TODO: Add a reverse proxy and a dns entry for testing
+  testScript = ''
+    machine.wait_for_unit("crabfit-api")
+    machine.wait_for_unit("crabfit-frontend")
 
-      machine.wait_for_open_port(3000)
-      machine.wait_for_open_port(3001)
+    machine.wait_for_open_port(3000)
+    machine.wait_for_open_port(3001)
 
-      machine.succeed("curl -f http://localhost:3001/")
-    '';
-  }
-)
+    machine.succeed("curl -f http://localhost:3001/")
+  '';
+}
diff --git a/nixos/tests/croc.nix b/nixos/tests/croc.nix
index 4b6d3f4d85a7..296d12c4ebe6 100644
--- a/nixos/tests/croc.nix
+++ b/nixos/tests/croc.nix
@@ -1,59 +1,57 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    client =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.croc ];
-      };
-    pass = "PassRelay";
-  in
-  {
-    name = "croc";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        equirosa
-        SuperSandro2000
-      ];
+{ pkgs, ... }:
+let
+  client =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.croc ];
     };
+  pass = "PassRelay";
+in
+{
+  name = "croc";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      equirosa
+      SuperSandro2000
+    ];
+  };
 
-    nodes = {
-      relay = {
-        services.croc = {
-          enable = true;
-          pass = pass;
-          openFirewall = true;
-        };
+  nodes = {
+    relay = {
+      services.croc = {
+        enable = true;
+        pass = pass;
+        openFirewall = true;
       };
-      sender = client;
-      receiver = client;
     };
+    sender = client;
+    receiver = client;
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      # wait until relay is up
-      relay.wait_for_unit("croc")
-      relay.wait_for_open_port(9009)
-      relay.wait_for_open_port(9010)
-      relay.wait_for_open_port(9011)
-      relay.wait_for_open_port(9012)
-      relay.wait_for_open_port(9013)
+    # wait until relay is up
+    relay.wait_for_unit("croc")
+    relay.wait_for_open_port(9009)
+    relay.wait_for_open_port(9010)
+    relay.wait_for_open_port(9011)
+    relay.wait_for_open_port(9012)
+    relay.wait_for_open_port(9013)
 
-      # generate testfiles and send them
-      sender.wait_for_unit("multi-user.target")
-      sender.execute("echo Hello World > testfile01.txt")
-      sender.execute("echo Hello Earth > testfile02.txt")
-      sender.execute(
-          "env CROC_SECRET=topSecret croc --pass ${pass} --relay relay send testfile01.txt testfile02.txt >&2 &"
-      )
+    # generate testfiles and send them
+    sender.wait_for_unit("multi-user.target")
+    sender.execute("echo Hello World > testfile01.txt")
+    sender.execute("echo Hello Earth > testfile02.txt")
+    sender.execute(
+        "env CROC_SECRET=topSecret croc --pass ${pass} --relay relay send testfile01.txt testfile02.txt >&2 &"
+    )
 
-      # receive the testfiles and check them
-      receiver.succeed(
-          "env CROC_SECRET=topSecret croc --pass ${pass} --yes --relay relay"
-      )
-      assert "Hello World" in receiver.succeed("cat testfile01.txt")
-      assert "Hello Earth" in receiver.succeed("cat testfile02.txt")
-    '';
-  }
-)
+    # receive the testfiles and check them
+    receiver.succeed(
+        "env CROC_SECRET=topSecret croc --pass ${pass} --yes --relay relay"
+    )
+    assert "Hello World" in receiver.succeed("cat testfile01.txt")
+    assert "Hello Earth" in receiver.succeed("cat testfile02.txt")
+  '';
+}
diff --git a/nixos/tests/cryptpad.nix b/nixos/tests/cryptpad.nix
index 9d6af15f5f86..f18649dd4af7 100644
--- a/nixos/tests/cryptpad.nix
+++ b/nixos/tests/cryptpad.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 let
   certs = pkgs.runCommand "cryptpadSelfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
     mkdir -p $out
@@ -12,6 +12,48 @@ let
   test_write_data = pkgs.writeText "cryptpadTestData" ''
     {"command":"WRITE_BLOCK","content":{"publicKey":"O2onvM62pC1io6jQKm8Nc2UyFXcd4kOmOsBIoYtZ2ik=","signature":"aXcM9SMO59lwA7q7HbYB+AnzymmxSyy/KhkG/cXIBVzl8v+kkPWXmFuWhcuKfRF8yt3Zc3ktIsHoFyuyDSAwAA==","ciphertext":"AFwCIfBHKdFzDKjMg4cu66qlJLpP+6Yxogbl3o9neiQou5P8h8yJB8qgnQ=="},"publicKey":"O2onvM62pC1io6jQKm8Nc2UyFXcd4kOmOsBIoYtZ2ik=","nonce":"bitSbJMNSzOsg98nEzN80a231PCkBQeH"}
   '';
+  seleniumScript =
+    pkgs.writers.writePython3Bin "selenium-script"
+      {
+        libraries = with pkgs.python3Packages; [ selenium ];
+      }
+      ''
+        from sys import stderr
+        from time import time
+        from selenium import webdriver
+        from selenium.webdriver.common.by import By
+        from selenium.webdriver.firefox.options import Options
+        from selenium.webdriver.support.ui import WebDriverWait
+        from selenium.webdriver.support import expected_conditions as EC
+
+        options = Options()
+        options.add_argument("--headless")
+        service = webdriver.FirefoxService(executable_path="${lib.getExe pkgs.geckodriver}")  # noqa: E501
+
+        driver = webdriver.Firefox(options=options, service=service)
+        driver.implicitly_wait(10)
+        driver.get("https://cryptpad.localhost")
+
+        WebDriverWait(driver, 10).until(
+          EC.text_to_be_present_in_element(
+            (By.TAG_NAME, "body"), "CryptPad")
+        )
+
+        driver.find_element(By.PARTIAL_LINK_TEXT, "Sheet").click()
+
+        # Title changes once the sheet is rendered, which can take
+        # a lot of time on first run (browser generates keypair etc)
+        start = time()
+        WebDriverWait(driver, 60).until(
+          EC.title_contains('Sheet')
+        )
+        print(f"Sheets done loading in {time() - start}", file=stderr)
+
+        # check screen looks sane...
+        # driver.print_page() and dump pdf somewhere through pdftotext? OCR?
+
+        driver.close()
+      '';
 in
 {
   name = "cryptpad";
@@ -20,6 +62,9 @@ in
   };
 
   nodes.machine = {
+    environment.systemPackages = [
+      pkgs.firefox-unwrapped
+    ];
     services.cryptpad = {
       enable = true;
       configureNginx = true;
@@ -62,6 +107,9 @@ in
     # test some API (e.g. check cryptpad main process)
     machine.succeed("curl --fail -d @${test_write_data} -H 'Content-Type: application/json' https://cryptpad.localhost/api/auth")
 
+    # page loads
+    machine.succeed("${lib.getExe seleniumScript}")
+
     # test telemetry has been disabled
     machine.fail("journalctl -u cryptpad | grep TELEMETRY");
 
diff --git a/nixos/tests/curl-impersonate.nix b/nixos/tests/curl-impersonate.nix
index 28e741a2e19f..866bd78ce163 100644
--- a/nixos/tests/curl-impersonate.nix
+++ b/nixos/tests/curl-impersonate.nix
@@ -24,182 +24,180 @@
       uses upstream for its tests.
 */
 
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    # Update with domains in TestImpersonate.TEST_URLS if needed from:
-    # https://github.com/lwthiker/curl-impersonate/blob/main/tests/test_impersonate.py
-    domains = [
-      "www.wikimedia.org"
-      "www.wikipedia.org"
-      "www.mozilla.org"
-      "www.apache.org"
-      "www.kernel.org"
-      "git-scm.com"
-    ];
+{ pkgs, lib, ... }:
+let
+  # Update with domains in TestImpersonate.TEST_URLS if needed from:
+  # https://github.com/lwthiker/curl-impersonate/blob/main/tests/test_impersonate.py
+  domains = [
+    "www.wikimedia.org"
+    "www.wikipedia.org"
+    "www.mozilla.org"
+    "www.apache.org"
+    "www.kernel.org"
+    "git-scm.com"
+  ];
 
-    tls-certs =
-      let
-        # Configure CA with X.509 v3 extensions that would be trusted by curl
-        ca-cert-conf = pkgs.writeText "curl-impersonate-ca.cnf" ''
-          basicConstraints = critical, CA:TRUE
-          subjectKeyIdentifier = hash
-          authorityKeyIdentifier = keyid:always, issuer:always
-          keyUsage = critical, cRLSign, digitalSignature, keyCertSign
-        '';
-
-        # Configure leaf certificate with X.509 v3 extensions that would be trusted
-        # by curl and set subject-alternative names for test domains
-        tls-cert-conf = pkgs.writeText "curl-impersonate-tls.cnf" ''
-          basicConstraints = critical, CA:FALSE
-          subjectKeyIdentifier = hash
-          authorityKeyIdentifier = keyid:always, issuer:always
-          keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
-          extendedKeyUsage = critical, serverAuth
-          subjectAltName = @alt_names
-
-          [alt_names]
-          ${lib.concatStringsSep "\n" (lib.imap0 (idx: domain: "DNS.${toString idx} = ${domain}") domains)}
-        '';
-      in
-      pkgs.runCommand "curl-impersonate-test-certs"
-        {
-          nativeBuildInputs = [ pkgs.openssl ];
-        }
-        ''
-          # create CA certificate and key
-          openssl req -newkey rsa:4096 -keyout ca-key.pem -out ca-csr.pem -nodes -subj '/CN=curl-impersonate-ca.nixos.test'
-          openssl x509 -req -sha512 -in ca-csr.pem -key ca-key.pem -out ca.pem -extfile ${ca-cert-conf} -days 36500
-          openssl x509 -in ca.pem -text
-
-          # create server certificate and key
-          openssl req -newkey rsa:4096 -keyout key.pem -out csr.pem -nodes -subj '/CN=curl-impersonate.nixos.test'
-          openssl x509 -req -sha512 -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile ${tls-cert-conf} -days 36500
-          openssl x509 -in cert.pem -text
-
-          # output CA cert and server cert and key
-          mkdir -p $out
-          cp key.pem cert.pem ca.pem $out
-        '';
-
-    # Test script
-    curl-impersonate-test =
-      let
-        # Build miniature libcurl client used by test driver
-        minicurl =
-          pkgs.runCommandCC "minicurl"
-            {
-              buildInputs = [ pkgs.curl ];
-            }
-            ''
-              mkdir -p $out/bin
-              $CC -Wall -Werror -o $out/bin/minicurl ${pkgs.curl-impersonate.src}/tests/minicurl.c `curl-config --libs`
-            '';
-      in
-      pkgs.writeShellScript "curl-impersonate-test" ''
-        set -euxo pipefail
-
-        # Test driver requirements
-        export PATH="${
-          with pkgs;
-          lib.makeBinPath [
-            bash
-            coreutils
-            python3Packages.pytest
-            nghttp2
-            tcpdump
-          ]
-        }"
-        export PYTHONPATH="${
-          with pkgs.python3Packages;
-          makePythonPath [
-            pyyaml
-            pytest-asyncio
-            dpkt
-            ts1-signatures
-          ]
-        }"
-
-        # Prepare test root prefix
-        mkdir -p usr/{bin,lib}
-        cp -rs ${pkgs.curl-impersonate}/* ${minicurl}/* usr/
-
-        cp -r ${pkgs.curl-impersonate.src}/tests ./
-
-        # Run tests
-        cd tests
-        pytest . --install-dir ../usr --capture-interface eth1 --exitfirst -k 'not test_http2_headers'
+  tls-certs =
+    let
+      # Configure CA with X.509 v3 extensions that would be trusted by curl
+      ca-cert-conf = pkgs.writeText "curl-impersonate-ca.cnf" ''
+        basicConstraints = critical, CA:TRUE
+        subjectKeyIdentifier = hash
+        authorityKeyIdentifier = keyid:always, issuer:always
+        keyUsage = critical, cRLSign, digitalSignature, keyCertSign
       '';
-  in
-  {
-    name = "curl-impersonate";
 
-    meta = with lib.maintainers; {
-      maintainers = [ ];
-    };
+      # Configure leaf certificate with X.509 v3 extensions that would be trusted
+      # by curl and set subject-alternative names for test domains
+      tls-cert-conf = pkgs.writeText "curl-impersonate-tls.cnf" ''
+        basicConstraints = critical, CA:FALSE
+        subjectKeyIdentifier = hash
+        authorityKeyIdentifier = keyid:always, issuer:always
+        keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
+        extendedKeyUsage = critical, serverAuth
+        subjectAltName = @alt_names
 
-    nodes = {
-      web =
-        {
-          nodes,
-          pkgs,
-          lib,
-          config,
-          ...
-        }:
-        {
-          networking.firewall.allowedTCPPorts = [
-            80
-            443
-          ];
+        [alt_names]
+        ${lib.concatStringsSep "\n" (lib.imap0 (idx: domain: "DNS.${toString idx} = ${domain}") domains)}
+      '';
+    in
+    pkgs.runCommand "curl-impersonate-test-certs"
+      {
+        nativeBuildInputs = [ pkgs.openssl ];
+      }
+      ''
+        # create CA certificate and key
+        openssl req -newkey rsa:4096 -keyout ca-key.pem -out ca-csr.pem -nodes -subj '/CN=curl-impersonate-ca.nixos.test'
+        openssl x509 -req -sha512 -in ca-csr.pem -key ca-key.pem -out ca.pem -extfile ${ca-cert-conf} -days 36500
+        openssl x509 -in ca.pem -text
 
-          services = {
-            nginx = {
-              enable = true;
-              virtualHosts."curl-impersonate.nixos.test" = {
-                default = true;
-                addSSL = true;
-                sslCertificate = "${tls-certs}/cert.pem";
-                sslCertificateKey = "${tls-certs}/key.pem";
-              };
+        # create server certificate and key
+        openssl req -newkey rsa:4096 -keyout key.pem -out csr.pem -nodes -subj '/CN=curl-impersonate.nixos.test'
+        openssl x509 -req -sha512 -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile ${tls-cert-conf} -days 36500
+        openssl x509 -in cert.pem -text
+
+        # output CA cert and server cert and key
+        mkdir -p $out
+        cp key.pem cert.pem ca.pem $out
+      '';
+
+  # Test script
+  curl-impersonate-test =
+    let
+      # Build miniature libcurl client used by test driver
+      minicurl =
+        pkgs.runCommandCC "minicurl"
+          {
+            buildInputs = [ pkgs.curl ];
+          }
+          ''
+            mkdir -p $out/bin
+            $CC -Wall -Werror -o $out/bin/minicurl ${pkgs.curl-impersonate.src}/tests/minicurl.c `curl-config --libs`
+          '';
+    in
+    pkgs.writeShellScript "curl-impersonate-test" ''
+      set -euxo pipefail
+
+      # Test driver requirements
+      export PATH="${
+        with pkgs;
+        lib.makeBinPath [
+          bash
+          coreutils
+          python3Packages.pytest
+          nghttp2
+          tcpdump
+        ]
+      }"
+      export PYTHONPATH="${
+        with pkgs.python3Packages;
+        makePythonPath [
+          pyyaml
+          pytest-asyncio
+          dpkt
+          ts1-signatures
+        ]
+      }"
+
+      # Prepare test root prefix
+      mkdir -p usr/{bin,lib}
+      cp -rs ${pkgs.curl-impersonate}/* ${minicurl}/* usr/
+
+      cp -r ${pkgs.curl-impersonate.src}/tests ./
+
+      # Run tests
+      cd tests
+      pytest . --install-dir ../usr --capture-interface eth1 --exitfirst -k 'not test_http2_headers'
+    '';
+in
+{
+  name = "curl-impersonate";
+
+  meta = with lib.maintainers; {
+    maintainers = [ ];
+  };
+
+  nodes = {
+    web =
+      {
+        nodes,
+        pkgs,
+        lib,
+        config,
+        ...
+      }:
+      {
+        networking.firewall.allowedTCPPorts = [
+          80
+          443
+        ];
+
+        services = {
+          nginx = {
+            enable = true;
+            virtualHosts."curl-impersonate.nixos.test" = {
+              default = true;
+              addSSL = true;
+              sslCertificate = "${tls-certs}/cert.pem";
+              sslCertificateKey = "${tls-certs}/key.pem";
             };
           };
         };
+      };
 
-      curl =
-        {
-          nodes,
-          pkgs,
-          lib,
-          config,
-          ...
-        }:
-        {
-          networking.extraHosts = lib.concatStringsSep "\n" (
-            map (domain: "${nodes.web.networking.primaryIPAddress}  ${domain}") domains
-          );
+    curl =
+      {
+        nodes,
+        pkgs,
+        lib,
+        config,
+        ...
+      }:
+      {
+        networking.extraHosts = lib.concatStringsSep "\n" (
+          map (domain: "${nodes.web.networking.primaryIPAddress}  ${domain}") domains
+        );
 
-          security.pki.certificateFiles = [ "${tls-certs}/ca.pem" ];
-        };
-    };
+        security.pki.certificateFiles = [ "${tls-certs}/ca.pem" ];
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
 
-        with subtest("Wait for network"):
-            web.systemctl("start network-online.target")
-            curl.systemctl("start network-online.target")
-            web.wait_for_unit("network-online.target")
-            curl.wait_for_unit("network-online.target")
+      with subtest("Wait for network"):
+          web.systemctl("start network-online.target")
+          curl.systemctl("start network-online.target")
+          web.wait_for_unit("network-online.target")
+          curl.wait_for_unit("network-online.target")
 
-        with subtest("Wait for web server"):
-            web.wait_for_unit("nginx.service")
-            web.wait_for_open_port(443)
+      with subtest("Wait for web server"):
+          web.wait_for_unit("nginx.service")
+          web.wait_for_open_port(443)
 
-        with subtest("Run curl-impersonate tests"):
-            curl.succeed("${curl-impersonate-test}")
-      '';
-  }
-)
+      with subtest("Run curl-impersonate tests"):
+          curl.succeed("${curl-impersonate-test}")
+    '';
+}
diff --git a/nixos/tests/dae.nix b/nixos/tests/dae.nix
index 127bbcb78813..f3e4edaf8f94 100644
--- a/nixos/tests/dae.nix
+++ b/nixos/tests/dae.nix
@@ -1,38 +1,36 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
+{ lib, pkgs, ... }:
+{
 
-    name = "dae";
+  name = "dae";
 
-    meta = {
-      maintainers = with lib.maintainers; [ oluceps ];
+  meta = {
+    maintainers = with lib.maintainers; [ oluceps ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.curl ];
+      services.nginx = {
+        enable = true;
+        statusPage = true;
+      };
+      services.dae = {
+        enable = true;
+        config = ''
+          global { disable_waiting_network: true }
+          routing{}
+        '';
+      };
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.curl ];
-        services.nginx = {
-          enable = true;
-          statusPage = true;
-        };
-        services.dae = {
-          enable = true;
-          config = ''
-            global { disable_waiting_network: true }
-            routing{}
-          '';
-        };
-      };
+  testScript = ''
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_unit("dae.service")
 
-    testScript = ''
-      machine.wait_for_unit("nginx.service")
-      machine.wait_for_unit("dae.service")
+    machine.wait_for_open_port(80)
 
-      machine.wait_for_open_port(80)
+    machine.succeed("curl --fail --max-time 10 http://localhost")
+  '';
 
-      machine.succeed("curl --fail --max-time 10 http://localhost")
-    '';
-
-  }
-)
+}
diff --git a/nixos/tests/db-rest.nix b/nixos/tests/db-rest.nix
index 18843f330837..9d6cb251a45b 100644
--- a/nixos/tests/db-rest.nix
+++ b/nixos/tests/db-rest.nix
@@ -1,125 +1,123 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "db-rest";
-    meta.maintainers = with pkgs.lib.maintainers; [ marie ];
+{ pkgs, ... }:
+{
+  name = "db-rest";
+  meta.maintainers = with pkgs.lib.maintainers; [ marie ];
 
-    nodes = {
-      database = {
-        networking = {
-          interfaces.eth1 = {
-            ipv4.addresses = [
-              {
-                address = "192.168.2.10";
-                prefixLength = 24;
-              }
-            ];
-          };
-          firewall.allowedTCPPorts = [ 31638 ];
-        };
-
-        services.redis.servers.db-rest = {
-          enable = true;
-          bind = "0.0.0.0";
-          requirePass = "choochoo";
-          port = 31638;
+  nodes = {
+    database = {
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            {
+              address = "192.168.2.10";
+              prefixLength = 24;
+            }
+          ];
         };
+        firewall.allowedTCPPorts = [ 31638 ];
       };
 
-      serverWithTcp =
-        { pkgs, ... }:
-        {
-          environment = {
-            etc = {
-              "db-rest/password-redis-db".text = ''
-                choochoo
-              '';
-            };
-          };
-
-          networking = {
-            interfaces.eth1 = {
-              ipv4.addresses = [
-                {
-                  address = "192.168.2.11";
-                  prefixLength = 24;
-                }
-              ];
-            };
-            firewall.allowedTCPPorts = [ 3000 ];
-          };
-
-          services.db-rest = {
-            enable = true;
-            host = "0.0.0.0";
-            redis = {
-              enable = true;
-              createLocally = false;
-              host = "192.168.2.10";
-              port = 31638;
-              passwordFile = "/etc/db-rest/password-redis-db";
-              useSSL = false;
-            };
-          };
-        };
-
-      serverWithUnixSocket =
-        { pkgs, ... }:
-        {
-          networking = {
-            interfaces.eth1 = {
-              ipv4.addresses = [
-                {
-                  address = "192.168.2.12";
-                  prefixLength = 24;
-                }
-              ];
-            };
-            firewall.allowedTCPPorts = [ 3000 ];
-          };
-
-          services.db-rest = {
-            enable = true;
-            host = "0.0.0.0";
-            redis = {
-              enable = true;
-              createLocally = true;
-            };
-          };
-        };
-
-      client = {
-        environment.systemPackages = [ pkgs.jq ];
-        networking = {
-          interfaces.eth1 = {
-            ipv4.addresses = [
-              {
-                address = "192.168.2.13";
-                prefixLength = 24;
-              }
-            ];
-          };
-        };
+      services.redis.servers.db-rest = {
+        enable = true;
+        bind = "0.0.0.0";
+        requirePass = "choochoo";
+        port = 31638;
       };
     };
 
-    testScript = ''
-      start_all()
+    serverWithTcp =
+      { pkgs, ... }:
+      {
+        environment = {
+          etc = {
+            "db-rest/password-redis-db".text = ''
+              choochoo
+            '';
+          };
+        };
 
-      with subtest("db-rest redis with TCP socket"):
-        database.wait_for_unit("redis-db-rest.service")
-        database.wait_for_open_port(31638)
+        networking = {
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = "192.168.2.11";
+                prefixLength = 24;
+              }
+            ];
+          };
+          firewall.allowedTCPPorts = [ 3000 ];
+        };
 
-        serverWithTcp.wait_for_unit("db-rest.service")
-        serverWithTcp.wait_for_open_port(3000)
+        services.db-rest = {
+          enable = true;
+          host = "0.0.0.0";
+          redis = {
+            enable = true;
+            createLocally = false;
+            host = "192.168.2.10";
+            port = 31638;
+            passwordFile = "/etc/db-rest/password-redis-db";
+            useSSL = false;
+          };
+        };
+      };
 
-        client.succeed("curl --fail --get http://192.168.2.11:3000/stations --data-urlencode 'query=Köln Hbf' | jq -r '.\"8000207\".name' | grep 'Köln Hbf'")
+    serverWithUnixSocket =
+      { pkgs, ... }:
+      {
+        networking = {
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = "192.168.2.12";
+                prefixLength = 24;
+              }
+            ];
+          };
+          firewall.allowedTCPPorts = [ 3000 ];
+        };
 
-      with subtest("db-rest redis with Unix socket"):
-        serverWithUnixSocket.wait_for_unit("db-rest.service")
-        serverWithUnixSocket.wait_for_open_port(3000)
+        services.db-rest = {
+          enable = true;
+          host = "0.0.0.0";
+          redis = {
+            enable = true;
+            createLocally = true;
+          };
+        };
+      };
 
-        client.succeed("curl --fail --get http://192.168.2.12:3000/stations --data-urlencode 'query=Köln Hbf' | jq -r '.\"8000207\".name' | grep 'Köln Hbf'")
-    '';
-  }
-)
+    client = {
+      environment.systemPackages = [ pkgs.jq ];
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            {
+              address = "192.168.2.13";
+              prefixLength = 24;
+            }
+          ];
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    with subtest("db-rest redis with TCP socket"):
+      database.wait_for_unit("redis-db-rest.service")
+      database.wait_for_open_port(31638)
+
+      serverWithTcp.wait_for_unit("db-rest.service")
+      serverWithTcp.wait_for_open_port(3000)
+
+      client.succeed("curl --fail --get http://192.168.2.11:3000/stations --data-urlencode 'query=Köln Hbf' | jq -r '.\"8000207\".name' | grep 'Köln Hbf'")
+
+    with subtest("db-rest redis with Unix socket"):
+      serverWithUnixSocket.wait_for_unit("db-rest.service")
+      serverWithUnixSocket.wait_for_open_port(3000)
+
+      client.succeed("curl --fail --get http://192.168.2.12:3000/stations --data-urlencode 'query=Köln Hbf' | jq -r '.\"8000207\".name' | grep 'Köln Hbf'")
+  '';
+}
diff --git a/nixos/tests/dconf.nix b/nixos/tests/dconf.nix
index 933817917104..195c56702e2b 100644
--- a/nixos/tests/dconf.nix
+++ b/nixos/tests/dconf.nix
@@ -1,44 +1,42 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "dconf";
+{ lib, ... }:
+{
+  name = "dconf";
 
-    meta.maintainers = with lib.maintainers; [
-      linsui
-    ];
+  meta.maintainers = with lib.maintainers; [
+    linsui
+  ];
 
-    nodes.machine =
-      {
-        config,
-        pkgs,
-        lib,
-        ...
-      }:
-      {
-        users.extraUsers.alice = {
-          isNormalUser = true;
-        };
-        programs.dconf = with lib.gvariant; {
-          enable = true;
-          profiles.user.databases = [
-            {
-              settings = {
-                "test/not".locked = mkInt32 1;
-                "test/is".locked = "locked";
-              };
-              locks = [
-                "/test/is/locked"
-              ];
-            }
-          ];
-        };
+  nodes.machine =
+    {
+      config,
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      users.extraUsers.alice = {
+        isNormalUser = true;
       };
+      programs.dconf = with lib.gvariant; {
+        enable = true;
+        profiles.user.databases = [
+          {
+            settings = {
+              "test/not".locked = mkInt32 1;
+              "test/is".locked = "locked";
+            };
+            locks = [
+              "/test/is/locked"
+            ];
+          }
+        ];
+      };
+    };
 
-    testScript = ''
-      machine.succeed("test $(dconf read -d /test/not/locked) == 1")
-      machine.succeed("test $(dconf read -d /test/is/locked) == \"'locked'\"")
-      machine.fail("sudo -u alice dbus-run-session -- dconf write /test/is/locked \"@s 'unlocked'\"")
-      machine.succeed("sudo -u alice dbus-run-session -- dconf write /test/not/locked \"@i 2\"")
-    '';
-  }
-)
+  testScript = ''
+    machine.succeed("test $(dconf read -d /test/not/locked) == 1")
+    machine.succeed("test $(dconf read -d /test/is/locked) == \"'locked'\"")
+    machine.fail("sudo -u alice dbus-run-session -- dconf write /test/is/locked \"@s 'unlocked'\"")
+    machine.succeed("sudo -u alice dbus-run-session -- dconf write /test/not/locked \"@i 2\"")
+  '';
+}
diff --git a/nixos/tests/ddns-updater.nix b/nixos/tests/ddns-updater.nix
index caa763e09bba..95e5953e6a11 100644
--- a/nixos/tests/ddns-updater.nix
+++ b/nixos/tests/ddns-updater.nix
@@ -1,28 +1,26 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    port = 6000;
-  in
-  {
-    name = "ddns-updater";
+{ pkgs, lib, ... }:
+let
+  port = 6000;
+in
+{
+  name = "ddns-updater";
 
-    meta.maintainers = with lib.maintainers; [ delliott ];
+  meta.maintainers = with lib.maintainers; [ delliott ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.ddns-updater = {
-          enable = true;
-          environment = {
-            LISTENING_ADDRESS = ":" + (toString port);
-          };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.ddns-updater = {
+        enable = true;
+        environment = {
+          LISTENING_ADDRESS = ":" + (toString port);
         };
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("ddns-updater.service")
-      machine.wait_for_open_port(${toString port})
-      machine.succeed("curl --fail http://localhost:${toString port}/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("ddns-updater.service")
+    machine.wait_for_open_port(${toString port})
+    machine.succeed("curl --fail http://localhost:${toString port}/")
+  '';
+}
diff --git a/nixos/tests/deconz.nix b/nixos/tests/deconz.nix
index ceeabb6c261a..6272e44ff77c 100644
--- a/nixos/tests/deconz.nix
+++ b/nixos/tests/deconz.nix
@@ -1,37 +1,30 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    httpPort = 800;
-  in
-  {
-    name = "deconz";
+{ lib, ... }:
+let
+  httpPort = 800;
+in
+{
+  name = "deconz";
 
-    meta.maintainers = with lib.maintainers; [
-      bjornfor
-    ];
+  meta.maintainers = with lib.maintainers; [
+    bjornfor
+  ];
 
-    nodes.machine =
-      {
-        config,
-        pkgs,
-        lib,
-        ...
-      }:
-      {
-        nixpkgs.config.allowUnfree = true;
-        services.deconz = {
-          enable = true;
-          inherit httpPort;
-          extraArgs = [
-            "--dbg-err=2"
-            "--dbg-info=2"
-          ];
-        };
-      };
+  node.pkgsReadOnly = false;
 
-    testScript = ''
-      machine.wait_for_unit("deconz.service")
-      machine.succeed("curl -sfL http://localhost:${toString httpPort}")
-    '';
-  }
-)
+  nodes.machine = {
+    nixpkgs.config.allowUnfree = true;
+    services.deconz = {
+      enable = true;
+      inherit httpPort;
+      extraArgs = [
+        "--dbg-err=2"
+        "--dbg-info=2"
+      ];
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("deconz.service")
+    machine.succeed("curl -sfL http://localhost:${toString httpPort}")
+  '';
+}
diff --git a/nixos/tests/deepin.nix b/nixos/tests/deepin.nix
index bf545c08f886..677e58942079 100644
--- a/nixos/tests/deepin.nix
+++ b/nixos/tests/deepin.nix
@@ -1,57 +1,55 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "deepin";
+{ pkgs, lib, ... }:
+{
+  name = "deepin";
 
-    meta.maintainers = lib.teams.deepin.members;
+  meta.maintainers = lib.teams.deepin.members;
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [
-          ./common/user-account.nix
-        ];
+  nodes.machine =
+    { ... }:
+    {
+      imports = [
+        ./common/user-account.nix
+      ];
 
-        virtualisation.memorySize = 2048;
+      virtualisation.memorySize = 2048;
 
-        services.xserver.enable = true;
+      services.xserver.enable = true;
 
-        services.xserver.displayManager = {
-          lightdm.enable = true;
-          autoLogin = {
-            enable = true;
-            user = "alice";
-          };
+      services.xserver.displayManager = {
+        lightdm.enable = true;
+        autoLogin = {
+          enable = true;
+          user = "alice";
         };
-
-        services.xserver.desktopManager.deepin.enable = true;
       };
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-      in
-      ''
-        with subtest("Wait for login"):
-            machine.wait_for_x()
-            machine.wait_for_file("${user.home}/.Xauthority")
-            machine.succeed("xauth merge ${user.home}/.Xauthority")
+      services.xserver.desktopManager.deepin.enable = true;
+    };
 
-        with subtest("Check that logging in has given the user ownership of devices"):
-            machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+    in
+    ''
+      with subtest("Wait for login"):
+          machine.wait_for_x()
+          machine.wait_for_file("${user.home}/.Xauthority")
+          machine.succeed("xauth merge ${user.home}/.Xauthority")
 
-        with subtest("Check if Deepin session components actually start"):
-            machine.wait_until_succeeds("pgrep -f dde-session-daemon")
-            machine.wait_for_window("dde-session-daemon")
-            machine.wait_until_succeeds("pgrep -f dde-desktop")
-            machine.wait_for_window("dde-desktop")
+      with subtest("Check that logging in has given the user ownership of devices"):
+          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
 
-        with subtest("Open deepin-terminal"):
-            machine.succeed("su - ${user.name} -c 'DISPLAY=:0 deepin-terminal >&2 &'")
-            machine.wait_for_window("deepin-terminal")
-            machine.sleep(20)
-            machine.screenshot("screen")
-      '';
-  }
-)
+      with subtest("Check if Deepin session components actually start"):
+          machine.wait_until_succeeds("pgrep -f dde-session-daemon")
+          machine.wait_for_window("dde-session-daemon")
+          machine.wait_until_succeeds("pgrep -f dde-desktop")
+          machine.wait_for_window("dde-desktop")
+
+      with subtest("Open deepin-terminal"):
+          machine.succeed("su - ${user.name} -c 'DISPLAY=:0 deepin-terminal >&2 &'")
+          machine.wait_for_window("deepin-terminal")
+          machine.sleep(20)
+          machine.screenshot("screen")
+    '';
+}
diff --git a/nixos/tests/deluge.nix b/nixos/tests/deluge.nix
index 58763bab5345..b7385608a86c 100644
--- a/nixos/tests/deluge.nix
+++ b/nixos/tests/deluge.nix
@@ -1,69 +1,67 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "deluge";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ flokli ];
-    };
+{ pkgs, ... }:
+{
+  name = "deluge";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ flokli ];
+  };
 
-    nodes = {
-      simple = {
-        services.deluge = {
+  nodes = {
+    simple = {
+      services.deluge = {
+        enable = true;
+        package = pkgs.deluge-2_x;
+        web = {
           enable = true;
-          package = pkgs.deluge-2_x;
-          web = {
-            enable = true;
-            openFirewall = true;
-          };
-        };
-      };
-
-      declarative = {
-        services.deluge = {
-          enable = true;
-          package = pkgs.deluge-2_x;
           openFirewall = true;
-          declarative = true;
-          config = {
-            allow_remote = true;
-            download_location = "/var/lib/deluge/my-download";
-            daemon_port = 58846;
-            listen_ports = [
-              6881
-              6889
-            ];
-          };
-          web = {
-            enable = true;
-            port = 3142;
-          };
-          authFile = pkgs.writeText "deluge-auth" ''
-            localclient:a7bef72a890:10
-            andrew:password:10
-            user3:anotherpass:5
-          '';
         };
       };
-
     };
 
-    testScript = ''
-      start_all()
+    declarative = {
+      services.deluge = {
+        enable = true;
+        package = pkgs.deluge-2_x;
+        openFirewall = true;
+        declarative = true;
+        config = {
+          allow_remote = true;
+          download_location = "/var/lib/deluge/my-download";
+          daemon_port = 58846;
+          listen_ports = [
+            6881
+            6889
+          ];
+        };
+        web = {
+          enable = true;
+          port = 3142;
+        };
+        authFile = pkgs.writeText "deluge-auth" ''
+          localclient:a7bef72a890:10
+          andrew:password:10
+          user3:anotherpass:5
+        '';
+      };
+    };
 
-      simple.wait_for_unit("deluged")
-      simple.wait_for_unit("delugeweb")
-      simple.wait_for_open_port(8112)
-      declarative.wait_for_unit("network.target")
-      declarative.wait_until_succeeds("curl --fail http://simple:8112")
+  };
 
-      declarative.wait_for_unit("deluged")
-      declarative.wait_for_unit("delugeweb")
-      declarative.wait_until_succeeds("curl --fail http://declarative:3142")
+  testScript = ''
+    start_all()
 
-      # deluge-console always exits with 1. https://dev.deluge-torrent.org/ticket/3291
-      declarative.succeed(
-          "(deluge-console 'connect 127.0.0.1:58846 andrew password; help' || true) | grep -q 'rm.*Remove a torrent'"
-      )
-    '';
-  }
-)
+    simple.wait_for_unit("deluged")
+    simple.wait_for_unit("delugeweb")
+    simple.wait_for_open_port(8112)
+    declarative.wait_for_unit("network.target")
+    declarative.wait_until_succeeds("curl --fail http://simple:8112")
+
+    declarative.wait_for_unit("deluged")
+    declarative.wait_for_unit("delugeweb")
+    declarative.wait_until_succeeds("curl --fail http://declarative:3142")
+
+    # deluge-console always exits with 1. https://dev.deluge-torrent.org/ticket/3291
+    declarative.succeed(
+        "(deluge-console 'connect 127.0.0.1:58846 andrew password; help' || true) | grep -q 'rm.*Remove a torrent'"
+    )
+  '';
+}
diff --git a/nixos/tests/dependency-track.nix b/nixos/tests/dependency-track.nix
index baa55e779058..4039339ff8cd 100644
--- a/nixos/tests/dependency-track.nix
+++ b/nixos/tests/dependency-track.nix
@@ -1,71 +1,69 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    dependencyTrackPort = 8081;
-  in
-  {
-    name = "dependency-track";
-    meta = {
-      maintainers = pkgs.lib.teams.cyberus.members;
-    };
+{ pkgs, ... }:
+let
+  dependencyTrackPort = 8081;
+in
+{
+  name = "dependency-track";
+  meta = {
+    maintainers = pkgs.lib.teams.cyberus.members;
+  };
 
-    nodes = {
-      server =
-        { pkgs, ... }:
-        {
-          virtualisation = {
-            cores = 2;
-            diskSize = 4096;
-            memorySize = 1024 * 2;
-          };
-
-          environment.systemPackages = with pkgs; [ curl ];
-          systemd.services.dependency-track = {
-            # source: https://github.com/DependencyTrack/dependency-track/blob/37e0ba59e8057c18a87a7a76e247a8f75677a56c/dev/scripts/data-nist-generate-dummy.sh
-            preStart = ''
-              set -euo pipefail
-
-              NIST_DIR="$HOME/.dependency-track/nist"
-
-              rm -rf "$NIST_DIR"
-              mkdir -p "$NIST_DIR"
-
-              for feed in $(seq "2024" "2002"); do
-                touch "$NIST_DIR/nvdcve-1.1-$feed.json.gz"
-                echo "9999999999999" > "$NIST_DIR/nvdcve-1.1-$feed.json.gz.ts"
-              done
-            '';
-          };
-          services.dependency-track = {
-            enable = true;
-            port = dependencyTrackPort;
-            nginx.domain = "localhost";
-            database.passwordFile = "${pkgs.writeText "dbPassword" ''hunter2'THE'''H''''E''}";
-          };
+  nodes = {
+    server =
+      { pkgs, ... }:
+      {
+        virtualisation = {
+          cores = 2;
+          diskSize = 4096;
+          memorySize = 1024 * 2;
         };
-    };
 
-    testScript =
-      # python
-      ''
-        import json
+        environment.systemPackages = with pkgs; [ curl ];
+        systemd.services.dependency-track = {
+          # source: https://github.com/DependencyTrack/dependency-track/blob/37e0ba59e8057c18a87a7a76e247a8f75677a56c/dev/scripts/data-nist-generate-dummy.sh
+          preStart = ''
+            set -euo pipefail
 
-        start_all()
+            NIST_DIR="$HOME/.dependency-track/nist"
 
-        server.wait_for_unit("dependency-track.service")
-        server.wait_until_succeeds(
-          "journalctl -o cat -u dependency-track.service | grep 'Dependency-Track is ready'"
+            rm -rf "$NIST_DIR"
+            mkdir -p "$NIST_DIR"
+
+            for feed in $(seq "2024" "2002"); do
+              touch "$NIST_DIR/nvdcve-1.1-$feed.json.gz"
+              echo "9999999999999" > "$NIST_DIR/nvdcve-1.1-$feed.json.gz.ts"
+            done
+          '';
+        };
+        services.dependency-track = {
+          enable = true;
+          port = dependencyTrackPort;
+          nginx.domain = "localhost";
+          database.passwordFile = "${pkgs.writeText "dbPassword" ''hunter2'THE'''H''''E''}";
+        };
+      };
+  };
+
+  testScript =
+    # python
+    ''
+      import json
+
+      start_all()
+
+      server.wait_for_unit("dependency-track.service")
+      server.wait_until_succeeds(
+        "journalctl -o cat -u dependency-track.service | grep 'Dependency-Track is ready'"
+      )
+      server.wait_for_open_port(${toString dependencyTrackPort})
+
+      with subtest("version api returns correct version"):
+        version = json.loads(
+          server.succeed("curl http://localhost/api/version")
         )
-        server.wait_for_open_port(${toString dependencyTrackPort})
+        assert version["version"] == "${pkgs.dependency-track.version}"
 
-        with subtest("version api returns correct version"):
-          version = json.loads(
-            server.succeed("curl http://localhost/api/version")
-          )
-          assert version["version"] == "${pkgs.dependency-track.version}"
-
-        with subtest("nginx serves frontend"):
-          server.succeed("curl http://localhost/ | grep \"<title>Dependency-Track</title>\"")
-      '';
-  }
-)
+      with subtest("nginx serves frontend"):
+        server.succeed("curl http://localhost/ | grep \"<title>Dependency-Track</title>\"")
+    '';
+}
diff --git a/nixos/tests/devpi-server.nix b/nixos/tests/devpi-server.nix
index cec019e9d1c4..723499941654 100644
--- a/nixos/tests/devpi-server.nix
+++ b/nixos/tests/devpi-server.nix
@@ -1,43 +1,41 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    server-port = 3141;
-  in
-  {
-    name = "devpi-server";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ cafkafk ];
-    };
+{ pkgs, ... }:
+let
+  server-port = 3141;
+in
+{
+  name = "devpi-server";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ cafkafk ];
+  };
 
-    nodes = {
-      devpi =
-        { ... }:
-        {
-          services.devpi-server = {
-            enable = true;
-            host = "0.0.0.0";
-            port = server-port;
-            openFirewall = true;
-            secretFile = pkgs.writeText "devpi-secret" "v263P+V3YGDYUyfYL/RBURw+tCPMDw94R/iCuBNJrDhaYrZYjpA6XPFVDDH8ViN20j77y2PHoMM/U0opNkVQ2g==";
-          };
+  nodes = {
+    devpi =
+      { ... }:
+      {
+        services.devpi-server = {
+          enable = true;
+          host = "0.0.0.0";
+          port = server-port;
+          openFirewall = true;
+          secretFile = pkgs.writeText "devpi-secret" "v263P+V3YGDYUyfYL/RBURw+tCPMDw94R/iCuBNJrDhaYrZYjpA6XPFVDDH8ViN20j77y2PHoMM/U0opNkVQ2g==";
         };
+      };
 
-      client1 =
-        { ... }:
-        {
-          environment.systemPackages = with pkgs; [
-            devpi-client
-            jq
-          ];
-        };
-    };
+    client1 =
+      { ... }:
+      {
+        environment.systemPackages = with pkgs; [
+          devpi-client
+          jq
+        ];
+      };
+  };
 
-    testScript = ''
-      start_all()
-      devpi.wait_for_unit("devpi-server.service")
-      devpi.wait_for_open_port(${builtins.toString server-port})
+  testScript = ''
+    start_all()
+    devpi.wait_for_unit("devpi-server.service")
+    devpi.wait_for_open_port(${builtins.toString server-port})
 
-      client1.succeed("devpi getjson http://devpi:${builtins.toString server-port}")
-    '';
-  }
-)
+    client1.succeed("devpi getjson http://devpi:${builtins.toString server-port}")
+  '';
+}
diff --git a/nixos/tests/dex-oidc.nix b/nixos/tests/dex-oidc.nix
index 37718fdcdbde..bc764cc1c471 100644
--- a/nixos/tests/dex-oidc.nix
+++ b/nixos/tests/dex-oidc.nix
@@ -1,84 +1,82 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "dex-oidc";
-    meta.maintainers = with lib.maintainers; [ Flakebi ];
+{ lib, ... }:
+{
+  name = "dex-oidc";
+  meta.maintainers = with lib.maintainers; [ Flakebi ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = with pkgs; [ jq ];
-        services.dex = {
-          enable = true;
-          settings = {
-            issuer = "http://127.0.0.1:8080/dex";
-            storage = {
-              type = "postgres";
-              config.host = "/var/run/postgresql";
-            };
-            web.http = "127.0.0.1:8080";
-            oauth2.skipApprovalScreen = true;
-            staticClients = [
-              {
-                id = "oidcclient";
-                name = "Client";
-                redirectURIs = [ "https://example.com/callback" ];
-                secretFile = "/etc/dex/oidcclient";
-              }
-            ];
-            connectors = [
-              {
-                type = "mockPassword";
-                id = "mock";
-                name = "Example";
-                config = {
-                  username = "admin";
-                  password = "password";
-                };
-              }
-            ];
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [ jq ];
+      services.dex = {
+        enable = true;
+        settings = {
+          issuer = "http://127.0.0.1:8080/dex";
+          storage = {
+            type = "postgres";
+            config.host = "/var/run/postgresql";
           };
-        };
-
-        # This should not be set from nix but through other means to not leak the secret.
-        environment.etc."dex/oidcclient" = {
-          mode = "0400";
-          user = "dex";
-          text = "oidcclientsecret";
-        };
-
-        services.postgresql = {
-          enable = true;
-          ensureDatabases = [ "dex" ];
-          ensureUsers = [
+          web.http = "127.0.0.1:8080";
+          oauth2.skipApprovalScreen = true;
+          staticClients = [
             {
-              name = "dex";
-              ensureDBOwnership = true;
+              id = "oidcclient";
+              name = "Client";
+              redirectURIs = [ "https://example.com/callback" ];
+              secretFile = "/etc/dex/oidcclient";
+            }
+          ];
+          connectors = [
+            {
+              type = "mockPassword";
+              id = "mock";
+              name = "Example";
+              config = {
+                username = "admin";
+                password = "password";
+              };
             }
           ];
         };
       };
 
-    testScript = ''
-      with subtest("Web server gets ready"):
-          machine.wait_for_unit("dex.service", timeout=120)
-          # Wait until server accepts connections
-          machine.wait_until_succeeds("curl -fs 'localhost:8080/dex/auth/mock?client_id=oidcclient&response_type=code&redirect_uri=https://example.com/callback&scope=openid'", timeout=120)
+      # This should not be set from nix but through other means to not leak the secret.
+      environment.etc."dex/oidcclient" = {
+        mode = "0400";
+        user = "dex";
+        text = "oidcclientsecret";
+      };
 
-      with subtest("Login"):
-          state = machine.succeed("curl -fs 'localhost:8080/dex/auth/mock?client_id=oidcclient&response_type=code&redirect_uri=https://example.com/callback&scope=openid' | sed -n 's/.*state=\\(.*\\)\">.*/\\1/p'").strip()
-          print(f"Got state {state}")
-          # Login request returns 303 with redirect_url that has code as query parameter:
-          # https://example.com/callback?code=kibsamwdupuy2iwqnlbqei3u6&state=
-          code = machine.succeed(f"curl -fs 'localhost:8080/dex/auth/mock/login?back=&state={state}' -d 'login=admin&password=password' -w '%{{redirect_url}}' | sed -n 's/.*code=\\(.*\\)&.*/\\1/p'")
-          print(f"Got approval code {code}")
-          bearer = machine.succeed(f"curl -fs localhost:8080/dex/token -u oidcclient:oidcclientsecret -d 'grant_type=authorization_code&redirect_uri=https://example.com/callback&code={code}' | jq .access_token -r").strip()
-          print(f"Got access token {bearer}")
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "dex" ];
+        ensureUsers = [
+          {
+            name = "dex";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+    };
 
-      with subtest("Get userinfo"):
-          assert '"sub"' in machine.succeed(
-              f"curl -fs localhost:8080/dex/userinfo --oauth2-bearer {bearer}"
-          )
-    '';
-  }
-)
+  testScript = ''
+    with subtest("Web server gets ready"):
+        machine.wait_for_unit("dex.service", timeout=120)
+        # Wait until server accepts connections
+        machine.wait_until_succeeds("curl -fs 'localhost:8080/dex/auth/mock?client_id=oidcclient&response_type=code&redirect_uri=https://example.com/callback&scope=openid'", timeout=120)
+
+    with subtest("Login"):
+        state = machine.succeed("curl -fs 'localhost:8080/dex/auth/mock?client_id=oidcclient&response_type=code&redirect_uri=https://example.com/callback&scope=openid' | sed -n 's/.*state=\\(.*\\)\">.*/\\1/p'").strip()
+        print(f"Got state {state}")
+        # Login request returns 303 with redirect_url that has code as query parameter:
+        # https://example.com/callback?code=kibsamwdupuy2iwqnlbqei3u6&state=
+        code = machine.succeed(f"curl -fs 'localhost:8080/dex/auth/mock/login?back=&state={state}' -d 'login=admin&password=password' -w '%{{redirect_url}}' | sed -n 's/.*code=\\(.*\\)&.*/\\1/p'")
+        print(f"Got approval code {code}")
+        bearer = machine.succeed(f"curl -fs localhost:8080/dex/token -u oidcclient:oidcclientsecret -d 'grant_type=authorization_code&redirect_uri=https://example.com/callback&code={code}' | jq .access_token -r").strip()
+        print(f"Got access token {bearer}")
+
+    with subtest("Get userinfo"):
+        assert '"sub"' in machine.succeed(
+            f"curl -fs localhost:8080/dex/userinfo --oauth2-bearer {bearer}"
+        )
+  '';
+}
diff --git a/nixos/tests/disable-installer-tools.nix b/nixos/tests/disable-installer-tools.nix
index d794f7d3f86d..ac8fa4cbf46a 100644
--- a/nixos/tests/disable-installer-tools.nix
+++ b/nixos/tests/disable-installer-tools.nix
@@ -1,35 +1,33 @@
-import ./make-test-python.nix (
-  {
-    pkgs,
-    latestKernel ? false,
-    ...
-  }:
+{
+  pkgs,
+  latestKernel ? false,
+  ...
+}:
 
-  {
-    name = "disable-installer-tools";
+{
+  name = "disable-installer-tools";
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
-        system.disableInstallerTools = true;
-        boot.enableContainers = false;
-        environment.defaultPackages = [ ];
-      };
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      system.disableInstallerTools = true;
+      boot.enableContainers = false;
+      environment.defaultPackages = [ ];
+    };
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
 
-      with subtest("nixos installer tools should not be included"):
-          machine.fail("which nixos-rebuild")
-          machine.fail("which nixos-install")
-          machine.fail("which nixos-generate-config")
-          machine.fail("which nixos-enter")
-          machine.fail("which nixos-version")
-          machine.fail("which nixos-build-vms")
+    with subtest("nixos installer tools should not be included"):
+        machine.fail("which nixos-rebuild")
+        machine.fail("which nixos-install")
+        machine.fail("which nixos-generate-config")
+        machine.fail("which nixos-enter")
+        machine.fail("which nixos-version")
+        machine.fail("which nixos-build-vms")
 
-      with subtest("perl should not be included"):
-          machine.fail("which perl")
-    '';
-  }
-)
+    with subtest("perl should not be included"):
+        machine.fail("which perl")
+  '';
+}
diff --git a/nixos/tests/discourse.nix b/nixos/tests/discourse.nix
index 1f8d1b7bdf4c..cff71f17a134 100644
--- a/nixos/tests/discourse.nix
+++ b/nixos/tests/discourse.nix
@@ -3,209 +3,207 @@
 #  2. sending a private message to the admin user through the API
 #  3. replying to that message via email.
 
-import ./make-test-python.nix (
-  {
-    pkgs,
-    lib,
-    package ? pkgs.discourse,
-    ...
-  }:
-  let
-    certs = import ./common/acme/server/snakeoil-certs.nix;
-    clientDomain = "client.fake.domain";
-    discourseDomain = certs.domain;
-    adminPassword = "eYAX85qmMJ5GZIHLaXGDAoszD7HSZp5d";
-    secretKeyBase = "381f4ac6d8f5e49d804dae72aa9c046431d2f34c656a705c41cd52fed9b4f6f76f51549f0b55db3b8b0dded7a00d6a381ebe9a4367d2d44f5e743af6628b4d42";
-    admin = {
-      email = "alice@${clientDomain}";
-      username = "alice";
-      fullName = "Alice Admin";
-      passwordFile = "${pkgs.writeText "admin-pass" adminPassword}";
-    };
-  in
-  {
-    name = "discourse";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ talyz ];
-    };
+{
+  package,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  certs = import ./common/acme/server/snakeoil-certs.nix;
+  clientDomain = "client.fake.domain";
+  discourseDomain = certs.domain;
+  adminPassword = "eYAX85qmMJ5GZIHLaXGDAoszD7HSZp5d";
+  secretKeyBase = "381f4ac6d8f5e49d804dae72aa9c046431d2f34c656a705c41cd52fed9b4f6f76f51549f0b55db3b8b0dded7a00d6a381ebe9a4367d2d44f5e743af6628b4d42";
+  admin = {
+    email = "alice@${clientDomain}";
+    username = "alice";
+    fullName = "Alice Admin";
+    passwordFile = "${pkgs.writeText "admin-pass" adminPassword}";
+  };
+in
+{
+  name = "discourse";
+  meta.maintainers = with lib.maintainers; [ talyz ];
 
-    nodes.discourse =
-      { nodes, ... }:
-      {
-        virtualisation.memorySize = 2048;
-        virtualisation.cores = 4;
-        virtualisation.useNixStoreImage = true;
-        virtualisation.writableStore = false;
+  _module.args.package = lib.mkDefault pkgs.discourse;
 
-        imports = [ common/user-account.nix ];
+  nodes.discourse =
+    { nodes, ... }:
+    {
+      virtualisation.memorySize = 2048;
+      virtualisation.cores = 4;
+      virtualisation.useNixStoreImage = true;
+      virtualisation.writableStore = false;
 
-        security.pki.certificateFiles = [
-          certs.ca.cert
-        ];
+      imports = [ common/user-account.nix ];
 
-        networking.extraHosts = ''
-          127.0.0.1 ${discourseDomain}
-          ${nodes.client.networking.primaryIPAddress} ${clientDomain}
-        '';
+      security.pki.certificateFiles = [
+        certs.ca.cert
+      ];
 
-        services.postfix = {
-          enableSubmission = true;
-          enableSubmissions = true;
-          submissionsOptions = {
-            smtpd_sasl_auth_enable = "yes";
-            smtpd_client_restrictions = "permit";
-          };
-        };
-
-        environment.systemPackages = [ pkgs.jq ];
-
-        services.postgresql.package = pkgs.postgresql_15;
-
-        services.discourse = {
-          enable = true;
-          inherit admin package;
-          hostname = discourseDomain;
-          sslCertificate = "${certs.${discourseDomain}.cert}";
-          sslCertificateKey = "${certs.${discourseDomain}.key}";
-          secretKeyBaseFile = "${pkgs.writeText "secret-key-base" secretKeyBase}";
-          enableACME = false;
-          mail.outgoing.serverAddress = clientDomain;
-          mail.incoming.enable = true;
-          siteSettings = {
-            posting = {
-              min_post_length = 5;
-              min_first_post_length = 5;
-              min_personal_message_post_length = 5;
-            };
-          };
-          unicornTimeout = 900;
-        };
-
-        networking.firewall.allowedTCPPorts = [
-          25
-          465
-        ];
-      };
-
-    nodes.client =
-      { nodes, ... }:
-      {
-        imports = [ common/user-account.nix ];
-
-        security.pki.certificateFiles = [
-          certs.ca.cert
-        ];
-
-        networking.extraHosts = ''
-          127.0.0.1 ${clientDomain}
-          ${nodes.discourse.networking.primaryIPAddress} ${discourseDomain}
-        '';
-
-        services.dovecot2 = {
-          enable = true;
-          protocols = [ "imap" ];
-        };
-
-        services.postfix = {
-          enable = true;
-          origin = clientDomain;
-          relayDomains = [ clientDomain ];
-          config = {
-            compatibility_level = "2";
-            smtpd_banner = "ESMTP server";
-            myhostname = clientDomain;
-            mydestination = clientDomain;
-          };
-        };
-
-        environment.systemPackages =
-          let
-            replyToEmail = pkgs.writeScriptBin "reply-to-email" ''
-              #!${pkgs.python3.interpreter}
-              import imaplib
-              import smtplib
-              import ssl
-              import email.header
-              from email import message_from_bytes
-              from email.message import EmailMessage
-
-              with imaplib.IMAP4('localhost') as imap:
-                  imap.login('alice', 'foobar')
-                  imap.select()
-                  status, data = imap.search(None, 'ALL')
-                  assert status == 'OK'
-
-                  nums = data[0].split()
-                  assert len(nums) == 1
-
-                  status, msg_data = imap.fetch(nums[0], '(RFC822)')
-                  assert status == 'OK'
-
-              msg = email.message_from_bytes(msg_data[0][1])
-              subject = str(email.header.make_header(email.header.decode_header(msg['Subject'])))
-              reply_to = email.header.decode_header(msg['Reply-To'])[0][0]
-              message_id = email.header.decode_header(msg['Message-ID'])[0][0]
-              date = email.header.decode_header(msg['Date'])[0][0]
-
-              ctx = ssl.create_default_context()
-              with smtplib.SMTP_SSL(host='${discourseDomain}', context=ctx) as smtp:
-                  reply = EmailMessage()
-                  reply['Subject'] = 'Re: ' + subject
-                  reply['To'] = reply_to
-                  reply['From'] = 'alice@${clientDomain}'
-                  reply['In-Reply-To'] = message_id
-                  reply['References'] = message_id
-                  reply['Date'] = date
-                  reply.set_content("Test reply.")
-
-                  smtp.send_message(reply)
-                  smtp.quit()
-            '';
-          in
-          [ replyToEmail ];
-
-        networking.firewall.allowedTCPPorts = [ 25 ];
-      };
-
-    testScript =
-      { nodes }:
-      let
-        request = builtins.toJSON {
-          title = "Private message";
-          raw = "This is a test message.";
-          target_recipients = admin.username;
-          archetype = "private_message";
-        };
-      in
-      ''
-        discourse.start()
-        client.start()
-
-        discourse.wait_for_unit("discourse.service")
-        discourse.wait_for_file("/run/discourse/sockets/unicorn.sock")
-        discourse.wait_until_succeeds("curl -sS -f https://${discourseDomain}")
-        discourse.succeed(
-            "curl -sS -f https://${discourseDomain}/session/csrf -c cookie -b cookie -H 'Accept: application/json' | jq -r '\"X-CSRF-Token: \" + .csrf' > csrf_token",
-            "curl -sS -f https://${discourseDomain}/session -c cookie -b cookie -H @csrf_token -H 'Accept: application/json' -d 'login=${nodes.discourse.services.discourse.admin.username}' -d \"password=${adminPassword}\" | jq -e '.user.username == \"${nodes.discourse.services.discourse.admin.username}\"'",
-            "curl -sS -f https://${discourseDomain}/login -v -H 'Accept: application/json' -c cookie -b cookie 2>&1 | grep ${nodes.discourse.services.discourse.admin.username}",
-        )
-
-        client.wait_for_unit("postfix.service")
-        client.wait_for_unit("dovecot2.service")
-
-        discourse.succeed(
-            "sudo -u discourse discourse-rake api_key:create_master[master] >api_key",
-            'curl -sS -f https://${discourseDomain}/posts -X POST -H "Content-Type: application/json" -H "Api-Key: $(<api_key)" -H "Api-Username: system" -d \'${request}\' ',
-        )
-
-        client.wait_until_succeeds("reply-to-email")
-
-        discourse.wait_until_succeeds(
-            'curl -sS -f https://${discourseDomain}/topics/private-messages/system -H "Accept: application/json" -H "Api-Key: $(<api_key)" -H "Api-Username: system" | jq -e \'if .topic_list.topics[0].id != null then .topic_list.topics[0].id else null end\' >topic_id'
-        )
-        discourse.succeed(
-            'curl -sS -f https://${discourseDomain}/t/$(<topic_id) -H "Accept: application/json" -H "Api-Key: $(<api_key)" -H "Api-Username: system" | jq -e \'if .post_stream.posts[1].cooked == "<p>Test reply.</p>" then true else null end\' '
-        )
+      networking.extraHosts = ''
+        127.0.0.1 ${discourseDomain}
+        ${nodes.client.networking.primaryIPAddress} ${clientDomain}
       '';
-  }
-)
+
+      services.postfix = {
+        enableSubmission = true;
+        enableSubmissions = true;
+        submissionsOptions = {
+          smtpd_sasl_auth_enable = "yes";
+          smtpd_client_restrictions = "permit";
+        };
+      };
+
+      environment.systemPackages = [ pkgs.jq ];
+
+      services.postgresql.package = pkgs.postgresql_15;
+
+      services.discourse = {
+        enable = true;
+        inherit admin;
+        hostname = discourseDomain;
+        sslCertificate = "${certs.${discourseDomain}.cert}";
+        sslCertificateKey = "${certs.${discourseDomain}.key}";
+        secretKeyBaseFile = "${pkgs.writeText "secret-key-base" secretKeyBase}";
+        enableACME = false;
+        mail.outgoing.serverAddress = clientDomain;
+        mail.incoming.enable = true;
+        siteSettings = {
+          posting = {
+            min_post_length = 5;
+            min_first_post_length = 5;
+            min_personal_message_post_length = 5;
+          };
+        };
+        unicornTimeout = 900;
+      };
+
+      networking.firewall.allowedTCPPorts = [
+        25
+        465
+      ];
+    };
+
+  nodes.client =
+    { nodes, ... }:
+    {
+      imports = [ common/user-account.nix ];
+
+      security.pki.certificateFiles = [
+        certs.ca.cert
+      ];
+
+      networking.extraHosts = ''
+        127.0.0.1 ${clientDomain}
+        ${nodes.discourse.networking.primaryIPAddress} ${discourseDomain}
+      '';
+
+      services.dovecot2 = {
+        enable = true;
+        protocols = [ "imap" ];
+      };
+
+      services.postfix = {
+        enable = true;
+        origin = clientDomain;
+        relayDomains = [ clientDomain ];
+        config = {
+          compatibility_level = "2";
+          smtpd_banner = "ESMTP server";
+          myhostname = clientDomain;
+          mydestination = clientDomain;
+        };
+      };
+
+      environment.systemPackages =
+        let
+          replyToEmail = pkgs.writeScriptBin "reply-to-email" ''
+            #!${pkgs.python3.interpreter}
+            import imaplib
+            import smtplib
+            import ssl
+            import email.header
+            from email import message_from_bytes
+            from email.message import EmailMessage
+
+            with imaplib.IMAP4('localhost') as imap:
+                imap.login('alice', 'foobar')
+                imap.select()
+                status, data = imap.search(None, 'ALL')
+                assert status == 'OK'
+
+                nums = data[0].split()
+                assert len(nums) == 1
+
+                status, msg_data = imap.fetch(nums[0], '(RFC822)')
+                assert status == 'OK'
+
+            msg = email.message_from_bytes(msg_data[0][1])
+            subject = str(email.header.make_header(email.header.decode_header(msg['Subject'])))
+            reply_to = email.header.decode_header(msg['Reply-To'])[0][0]
+            message_id = email.header.decode_header(msg['Message-ID'])[0][0]
+            date = email.header.decode_header(msg['Date'])[0][0]
+
+            ctx = ssl.create_default_context()
+            with smtplib.SMTP_SSL(host='${discourseDomain}', context=ctx) as smtp:
+                reply = EmailMessage()
+                reply['Subject'] = 'Re: ' + subject
+                reply['To'] = reply_to
+                reply['From'] = 'alice@${clientDomain}'
+                reply['In-Reply-To'] = message_id
+                reply['References'] = message_id
+                reply['Date'] = date
+                reply.set_content("Test reply.")
+
+                smtp.send_message(reply)
+                smtp.quit()
+          '';
+        in
+        [ replyToEmail ];
+
+      networking.firewall.allowedTCPPorts = [ 25 ];
+    };
+
+  testScript =
+    { nodes }:
+    let
+      request = builtins.toJSON {
+        title = "Private message";
+        raw = "This is a test message.";
+        target_recipients = admin.username;
+        archetype = "private_message";
+      };
+    in
+    ''
+      discourse.start()
+      client.start()
+
+      discourse.wait_for_unit("discourse.service")
+      discourse.wait_for_file("/run/discourse/sockets/unicorn.sock")
+      discourse.wait_until_succeeds("curl -sS -f https://${discourseDomain}")
+      discourse.succeed(
+          "curl -sS -f https://${discourseDomain}/session/csrf -c cookie -b cookie -H 'Accept: application/json' | jq -r '\"X-CSRF-Token: \" + .csrf' > csrf_token",
+          "curl -sS -f https://${discourseDomain}/session -c cookie -b cookie -H @csrf_token -H 'Accept: application/json' -d 'login=${nodes.discourse.services.discourse.admin.username}' -d \"password=${adminPassword}\" | jq -e '.user.username == \"${nodes.discourse.services.discourse.admin.username}\"'",
+          "curl -sS -f https://${discourseDomain}/login -v -H 'Accept: application/json' -c cookie -b cookie 2>&1 | grep ${nodes.discourse.services.discourse.admin.username}",
+      )
+
+      client.wait_for_unit("postfix.service")
+      client.wait_for_unit("dovecot2.service")
+
+      discourse.succeed(
+          "sudo -u discourse discourse-rake api_key:create_master[master] >api_key",
+          'curl -sS -f https://${discourseDomain}/posts -X POST -H "Content-Type: application/json" -H "Api-Key: $(<api_key)" -H "Api-Username: system" -d \'${request}\' ',
+      )
+
+      client.wait_until_succeeds("reply-to-email")
+
+      discourse.wait_until_succeeds(
+          'curl -sS -f https://${discourseDomain}/topics/private-messages/system -H "Accept: application/json" -H "Api-Key: $(<api_key)" -H "Api-Username: system" | jq -e \'if .topic_list.topics[0].id != null then .topic_list.topics[0].id else null end\' >topic_id'
+      )
+      discourse.succeed(
+          'curl -sS -f https://${discourseDomain}/t/$(<topic_id) -H "Accept: application/json" -H "Api-Key: $(<api_key)" -H "Api-Username: system" | jq -e \'if .post_stream.posts[1].cooked == "<p>Test reply.</p>" then true else null end\' '
+      )
+    '';
+}
diff --git a/nixos/tests/documize.nix b/nixos/tests/documize.nix
index 1537047ad679..4565033a9349 100644
--- a/nixos/tests/documize.nix
+++ b/nixos/tests/documize.nix
@@ -1,67 +1,65 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "documize";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "documize";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.jq ];
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.jq ];
 
-        services.documize = {
-          enable = true;
-          port = 3000;
-          dbtype = "postgresql";
-          db = "host=localhost port=5432 sslmode=disable user=documize password=documize dbname=documize";
-        };
-
-        systemd.services.documize-server = {
-          after = [ "postgresql.service" ];
-          requires = [ "postgresql.service" ];
-        };
-
-        services.postgresql = {
-          enable = true;
-          initialScript = pkgs.writeText "psql-init" ''
-            CREATE ROLE documize WITH LOGIN PASSWORD 'documize';
-            CREATE DATABASE documize WITH OWNER documize;
-          '';
-        };
+      services.documize = {
+        enable = true;
+        port = 3000;
+        dbtype = "postgresql";
+        db = "host=localhost port=5432 sslmode=disable user=documize password=documize dbname=documize";
       };
 
-    testScript = ''
-      start_all()
+      systemd.services.documize-server = {
+        after = [ "postgresql.service" ];
+        requires = [ "postgresql.service" ];
+      };
 
-      machine.wait_for_unit("documize-server.service")
-      machine.wait_for_open_port(3000)
+      services.postgresql = {
+        enable = true;
+        initialScript = pkgs.writeText "psql-init" ''
+          CREATE ROLE documize WITH LOGIN PASSWORD 'documize';
+          CREATE DATABASE documize WITH OWNER documize;
+        '';
+      };
+    };
 
-      dbhash = machine.succeed(
-          "curl -f localhost:3000 | grep 'property=\"dbhash' | grep -Po 'content=\"\\K[^\"]*'"
-      )
+  testScript = ''
+    start_all()
 
-      dbhash = dbhash.strip()
+    machine.wait_for_unit("documize-server.service")
+    machine.wait_for_open_port(3000)
 
-      machine.succeed(
-          (
-              "curl -X POST"
-              " --data 'dbname=documize'"
-              " --data 'dbhash={}'"
-              " --data 'title=NixOS'"
-              " --data 'message=Docs'"
-              " --data 'firstname=Bob'"
-              " --data 'lastname=Foobar'"
-              " --data 'email=bob.foobar@nixos.org'"
-              " --data 'password=verysafe'"
-              " -f localhost:3000/api/setup"
-          ).format(dbhash)
-      )
+    dbhash = machine.succeed(
+        "curl -f localhost:3000 | grep 'property=\"dbhash' | grep -Po 'content=\"\\K[^\"]*'"
+    )
 
-      machine.succeed(
-          'test "$(curl -f localhost:3000/api/public/meta | jq ".title" | xargs echo)" = "NixOS"'
-      )
-    '';
-  }
-)
+    dbhash = dbhash.strip()
+
+    machine.succeed(
+        (
+            "curl -X POST"
+            " --data 'dbname=documize'"
+            " --data 'dbhash={}'"
+            " --data 'title=NixOS'"
+            " --data 'message=Docs'"
+            " --data 'firstname=Bob'"
+            " --data 'lastname=Foobar'"
+            " --data 'email=bob.foobar@nixos.org'"
+            " --data 'password=verysafe'"
+            " -f localhost:3000/api/setup"
+        ).format(dbhash)
+    )
+
+    machine.succeed(
+        'test "$(curl -f localhost:3000/api/public/meta | jq ".title" | xargs echo)" = "NixOS"'
+    )
+  '';
+}
diff --git a/nixos/tests/doh-proxy-rust.nix b/nixos/tests/doh-proxy-rust.nix
index f9c73edcb778..26e6ea2c3885 100644
--- a/nixos/tests/doh-proxy-rust.nix
+++ b/nixos/tests/doh-proxy-rust.nix
@@ -1,48 +1,46 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "doh-proxy-rust";
-    meta.maintainers = with lib.maintainers; [ stephank ];
+{ lib, pkgs, ... }:
+{
+  name = "doh-proxy-rust";
+  meta.maintainers = with lib.maintainers; [ stephank ];
 
-    nodes = {
-      machine =
-        { pkgs, lib, ... }:
-        {
-          services.bind = {
-            enable = true;
-            extraOptions = "empty-zones-enable no;";
-            zones = lib.singleton {
-              name = ".";
-              master = true;
-              file = pkgs.writeText "root.zone" ''
-                $TTL 3600
-                . IN SOA ns.example.org. admin.example.org. ( 1 3h 1h 1w 1d )
-                . IN NS ns.example.org.
-                ns.example.org. IN A    192.168.0.1
-              '';
-            };
-          };
-          services.doh-proxy-rust = {
-            enable = true;
-            flags = [
-              "--server-address=127.0.0.1:53"
-            ];
+  nodes = {
+    machine =
+      { pkgs, lib, ... }:
+      {
+        services.bind = {
+          enable = true;
+          extraOptions = "empty-zones-enable no;";
+          zones = lib.singleton {
+            name = ".";
+            master = true;
+            file = pkgs.writeText "root.zone" ''
+              $TTL 3600
+              . IN SOA ns.example.org. admin.example.org. ( 1 3h 1h 1w 1d )
+              . IN NS ns.example.org.
+              ns.example.org. IN A    192.168.0.1
+            '';
           };
         };
-    };
+        services.doh-proxy-rust = {
+          enable = true;
+          flags = [
+            "--server-address=127.0.0.1:53"
+          ];
+        };
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        url = "http://localhost:3000/dns-query"
-        query = "AAABAAABAAAAAAAAAm5zB2V4YW1wbGUDb3JnAAABAAE="  # IN A ns.example.org.
-        bin_ip = r"$'\xC0\xA8\x00\x01'"  # 192.168.0.1, as shell binary string
+  testScript =
+    { nodes, ... }:
+    ''
+      url = "http://localhost:3000/dns-query"
+      query = "AAABAAABAAAAAAAAAm5zB2V4YW1wbGUDb3JnAAABAAE="  # IN A ns.example.org.
+      bin_ip = r"$'\xC0\xA8\x00\x01'"  # 192.168.0.1, as shell binary string
 
-        machine.wait_for_unit("bind.service")
-        machine.wait_for_unit("doh-proxy-rust.service")
-        machine.wait_for_open_port(53)
-        machine.wait_for_open_port(3000)
-        machine.succeed(f"curl --fail -H 'Accept: application/dns-message' '{url}?dns={query}' | grep -F {bin_ip}")
-      '';
-  }
-)
+      machine.wait_for_unit("bind.service")
+      machine.wait_for_unit("doh-proxy-rust.service")
+      machine.wait_for_open_port(53)
+      machine.wait_for_open_port(3000)
+      machine.succeed(f"curl --fail -H 'Accept: application/dns-message' '{url}?dns={query}' | grep -F {bin_ip}")
+    '';
+}
diff --git a/nixos/tests/domination.nix b/nixos/tests/domination.nix
index d37a7ba98be9..48f5825afc97 100644
--- a/nixos/tests/domination.nix
+++ b/nixos/tests/domination.nix
@@ -1,33 +1,31 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "domination";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fgaz ];
+{ pkgs, ... }:
+{
+  name = "domination";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      environment.systemPackages = [ pkgs.domination ];
     };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  enableOCR = true;
 
-        services.xserver.enable = true;
-        environment.systemPackages = [ pkgs.domination ];
-      };
-
-    enableOCR = true;
-
-    testScript = ''
-      machine.wait_for_x()
-      # Add a dummy sound card, or an error reporting popup will appear,
-      # covering the main window and preventing OCR
-      machine.execute("modprobe snd-dummy")
-      machine.execute("domination >&2 &")
-      machine.wait_for_window("Menu")
-      machine.wait_for_text(r"(New Game|Start Server|Load Game|Help Manual|Join Game|About|Play Online)")
-      machine.screenshot("screen")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_x()
+    # Add a dummy sound card, or an error reporting popup will appear,
+    # covering the main window and preventing OCR
+    machine.execute("modprobe snd-dummy")
+    machine.execute("domination >&2 &")
+    machine.wait_for_window("Menu")
+    machine.wait_for_text(r"(New Game|Start Server|Load Game|Help Manual|Join Game|About|Play Online)")
+    machine.screenshot("screen")
+  '';
+}
diff --git a/nixos/tests/drbd-driver.nix b/nixos/tests/drbd-driver.nix
index 9ba7c438eabc..9df032bd797c 100644
--- a/nixos/tests/drbd-driver.nix
+++ b/nixos/tests/drbd-driver.nix
@@ -1,24 +1,22 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "drbd-driver";
-    meta.maintainers = with pkgs.lib.maintainers; [ birkb ];
+{ lib, pkgs, ... }:
+{
+  name = "drbd-driver";
+  meta.maintainers = with pkgs.lib.maintainers; [ birkb ];
 
-    nodes = {
-      machine =
-        { config, pkgs, ... }:
-        {
-          boot = {
-            kernelModules = [ "drbd" ];
-            extraModulePackages = with config.boot.kernelPackages; [ drbd ];
-            kernelPackages = pkgs.linuxPackages;
-          };
+  nodes = {
+    machine =
+      { config, pkgs, ... }:
+      {
+        boot = {
+          kernelModules = [ "drbd" ];
+          extraModulePackages = with config.boot.kernelPackages; [ drbd ];
+          kernelPackages = pkgs.linuxPackages;
         };
-    };
+      };
+  };
 
-    testScript = ''
-      machine.start();
-      machine.succeed("modinfo drbd | grep --extended-regexp '^version:\s+${pkgs.linuxPackages.drbd.version}$'")
-    '';
-  }
-)
+  testScript = ''
+    machine.start();
+    machine.succeed("modinfo drbd | grep --extended-regexp '^version:\s+${pkgs.linuxPackages.drbd.version}$'")
+  '';
+}
diff --git a/nixos/tests/drbd.nix b/nixos/tests/drbd.nix
index 9d0a26a3252f..fb88362b10a2 100644
--- a/nixos/tests/drbd.nix
+++ b/nixos/tests/drbd.nix
@@ -1,93 +1,91 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    drbdPort = 7789;
+{ pkgs, lib, ... }:
+let
+  drbdPort = 7789;
 
-    drbdConfig =
-      { nodes, ... }:
-      {
-        virtualisation.emptyDiskImages = [ 1 ];
-        networking.firewall.allowedTCPPorts = [ drbdPort ];
+  drbdConfig =
+    { nodes, ... }:
+    {
+      virtualisation.emptyDiskImages = [ 1 ];
+      networking.firewall.allowedTCPPorts = [ drbdPort ];
 
-        services.drbd = {
-          enable = true;
-          config = ''
-            global {
-              usage-count yes;
+      services.drbd = {
+        enable = true;
+        config = ''
+          global {
+            usage-count yes;
+          }
+
+          common {
+            net {
+              protocol C;
+              ping-int 1;
+            }
+          }
+
+          resource r0 {
+            volume 0 {
+              device    /dev/drbd0;
+              disk      /dev/vdb;
+              meta-disk internal;
             }
 
-            common {
-              net {
-                protocol C;
-                ping-int 1;
-              }
+            on drbd1 {
+              address ${nodes.drbd1.networking.primaryIPAddress}:${toString drbdPort};
             }
 
-            resource r0 {
-              volume 0 {
-                device    /dev/drbd0;
-                disk      /dev/vdb;
-                meta-disk internal;
-              }
-
-              on drbd1 {
-                address ${nodes.drbd1.networking.primaryIPAddress}:${toString drbdPort};
-              }
-
-              on drbd2 {
-                address ${nodes.drbd2.networking.primaryIPAddress}:${toString drbdPort};
-              }
+            on drbd2 {
+              address ${nodes.drbd2.networking.primaryIPAddress}:${toString drbdPort};
             }
-          '';
-        };
+          }
+        '';
       };
-  in
-  {
-    name = "drbd";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        ryantm
-        astro
-        birkb
-      ];
     };
+in
+{
+  name = "drbd";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      ryantm
+      astro
+      birkb
+    ];
+  };
 
-    nodes.drbd1 = drbdConfig;
-    nodes.drbd2 = drbdConfig;
+  nodes.drbd1 = drbdConfig;
+  nodes.drbd2 = drbdConfig;
 
-    testScript =
-      { nodes }:
-      ''
-        drbd1.start()
-        drbd2.start()
+  testScript =
+    { nodes }:
+    ''
+      drbd1.start()
+      drbd2.start()
 
-        drbd1.wait_for_unit("network.target")
-        drbd2.wait_for_unit("network.target")
+      drbd1.wait_for_unit("network.target")
+      drbd2.wait_for_unit("network.target")
 
-        drbd1.succeed(
-            "drbdadm create-md r0",
-            "drbdadm up r0",
-            "drbdadm primary r0 --force",
-        )
+      drbd1.succeed(
+          "drbdadm create-md r0",
+          "drbdadm up r0",
+          "drbdadm primary r0 --force",
+      )
 
-        drbd2.succeed("drbdadm create-md r0", "drbdadm up r0")
+      drbd2.succeed("drbdadm create-md r0", "drbdadm up r0")
 
-        drbd1.succeed(
-            "mkfs.ext4 /dev/drbd0",
-            "mkdir -p /mnt/drbd",
-            "mount /dev/drbd0 /mnt/drbd",
-            "touch /mnt/drbd/hello",
-            "umount /mnt/drbd",
-            "drbdadm secondary r0",
-        )
-        drbd1.sleep(1)
+      drbd1.succeed(
+          "mkfs.ext4 /dev/drbd0",
+          "mkdir -p /mnt/drbd",
+          "mount /dev/drbd0 /mnt/drbd",
+          "touch /mnt/drbd/hello",
+          "umount /mnt/drbd",
+          "drbdadm secondary r0",
+      )
+      drbd1.sleep(1)
 
-        drbd2.succeed(
-            "drbdadm primary r0",
-            "mkdir -p /mnt/drbd",
-            "mount /dev/drbd0 /mnt/drbd",
-            "ls /mnt/drbd/hello",
-        )
-      '';
-  }
-)
+      drbd2.succeed(
+          "drbdadm primary r0",
+          "mkdir -p /mnt/drbd",
+          "mount /dev/drbd0 /mnt/drbd",
+          "ls /mnt/drbd/hello",
+      )
+    '';
+}
diff --git a/nixos/tests/dublin-traceroute.nix b/nixos/tests/dublin-traceroute.nix
index cae8e4f894f3..51532ede15eb 100644
--- a/nixos/tests/dublin-traceroute.nix
+++ b/nixos/tests/dublin-traceroute.nix
@@ -3,75 +3,73 @@
 # client on the inside network, a server on the outside network, and a
 # router connected to both that performs Network Address Translation
 # for the client.
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    routerBase = lib.mkMerge [
-      {
-        virtualisation.vlans = [
-          2
-          1
-        ];
-        networking.nftables.enable = true;
-        networking.nat.internalIPs = [ "192.168.1.0/24" ];
-        networking.nat.externalInterface = "eth1";
-      }
-    ];
-  in
-  {
-    name = "dublin-traceroute";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ baloo ];
+{ pkgs, lib, ... }:
+let
+  routerBase = lib.mkMerge [
+    {
+      virtualisation.vlans = [
+        2
+        1
+      ];
+      networking.nftables.enable = true;
+      networking.nat.internalIPs = [ "192.168.1.0/24" ];
+      networking.nat.externalInterface = "eth1";
+    }
+  ];
+in
+{
+  name = "dublin-traceroute";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ baloo ];
+  };
+
+  nodes.client =
+    { nodes, ... }:
+    {
+      imports = [ ./common/user-account.nix ];
+      virtualisation.vlans = [ 1 ];
+
+      networking.defaultGateway =
+        (builtins.head nodes.router.networking.interfaces.eth2.ipv4.addresses).address;
+      networking.nftables.enable = true;
+
+      programs.dublin-traceroute.enable = true;
     };
 
-    nodes.client =
-      { nodes, ... }:
-      {
-        imports = [ ./common/user-account.nix ];
-        virtualisation.vlans = [ 1 ];
+  nodes.router =
+    { ... }:
+    {
+      virtualisation.vlans = [
+        2
+        1
+      ];
+      networking.nftables.enable = true;
+      networking.nat.internalIPs = [ "192.168.1.0/24" ];
+      networking.nat.externalInterface = "eth1";
+      networking.nat.enable = true;
+    };
 
-        networking.defaultGateway =
-          (builtins.head nodes.router.networking.interfaces.eth2.ipv4.addresses).address;
-        networking.nftables.enable = true;
+  nodes.server =
+    { ... }:
+    {
+      virtualisation.vlans = [ 2 ];
+      networking.firewall.enable = false;
+      services.httpd.enable = true;
+      services.httpd.adminAddr = "foo@example.org";
+      services.vsftpd.enable = true;
+      services.vsftpd.anonymousUser = true;
+    };
 
-        programs.dublin-traceroute.enable = true;
-      };
+  testScript = ''
+    client.start()
+    router.start()
+    server.start()
 
-    nodes.router =
-      { ... }:
-      {
-        virtualisation.vlans = [
-          2
-          1
-        ];
-        networking.nftables.enable = true;
-        networking.nat.internalIPs = [ "192.168.1.0/24" ];
-        networking.nat.externalInterface = "eth1";
-        networking.nat.enable = true;
-      };
+    server.wait_for_unit("network.target")
+    router.wait_for_unit("network.target")
+    client.wait_for_unit("network.target")
 
-    nodes.server =
-      { ... }:
-      {
-        virtualisation.vlans = [ 2 ];
-        networking.firewall.enable = false;
-        services.httpd.enable = true;
-        services.httpd.adminAddr = "foo@example.org";
-        services.vsftpd.enable = true;
-        services.vsftpd.anonymousUser = true;
-      };
-
-    testScript = ''
-      client.start()
-      router.start()
-      server.start()
-
-      server.wait_for_unit("network.target")
-      router.wait_for_unit("network.target")
-      client.wait_for_unit("network.target")
-
-      # Make sure we can trace from an unprivileged user
-      client.succeed("sudo -u alice dublin-traceroute server")
-    '';
-  }
-)
+    # Make sure we can trace from an unprivileged user
+    client.succeed("sudo -u alice dublin-traceroute server")
+  '';
+}
diff --git a/nixos/tests/ecryptfs.nix b/nixos/tests/ecryptfs.nix
index ceeeb1b15da2..e0deaa7e5013 100644
--- a/nixos/tests/ecryptfs.nix
+++ b/nixos/tests/ecryptfs.nix
@@ -1,89 +1,87 @@
-import ./make-test-python.nix (
-  { ... }:
-  {
-    name = "ecryptfs";
+{ ... }:
+{
+  name = "ecryptfs";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ./common/user-account.nix ];
-        boot.kernelModules = [ "ecryptfs" ];
-        security.pam.enableEcryptfs = true;
-        environment.systemPackages = with pkgs; [ keyutils ];
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/user-account.nix ];
+      boot.kernelModules = [ "ecryptfs" ];
+      security.pam.enableEcryptfs = true;
+      environment.systemPackages = with pkgs; [ keyutils ];
+    };
 
-    testScript = ''
-      def login_as_alice():
-          machine.wait_until_tty_matches("1", "login: ")
-          machine.send_chars("alice\n")
-          machine.wait_until_tty_matches("1", "Password: ")
-          machine.send_chars("foobar\n")
-          machine.wait_until_tty_matches("1", "alice\@machine")
+  testScript = ''
+    def login_as_alice():
+        machine.wait_until_tty_matches("1", "login: ")
+        machine.send_chars("alice\n")
+        machine.wait_until_tty_matches("1", "Password: ")
+        machine.send_chars("foobar\n")
+        machine.wait_until_tty_matches("1", "alice\@machine")
 
 
-      def logout():
-          machine.send_chars("logout\n")
-          machine.wait_until_tty_matches("1", "login: ")
+    def logout():
+        machine.send_chars("logout\n")
+        machine.wait_until_tty_matches("1", "login: ")
 
 
-      machine.wait_for_unit("default.target")
+    machine.wait_for_unit("default.target")
 
-      with subtest("Set alice up with a password and a home"):
-          machine.succeed("(echo foobar; echo foobar) | passwd alice")
-          machine.succeed("chown -R alice.users ~alice")
+    with subtest("Set alice up with a password and a home"):
+        machine.succeed("(echo foobar; echo foobar) | passwd alice")
+        machine.succeed("chown -R alice.users ~alice")
 
-      with subtest("Migrate alice's home"):
-          out = machine.succeed("echo foobar | ecryptfs-migrate-home -u alice")
-          machine.log(f"ecryptfs-migrate-home said: {out}")
+    with subtest("Migrate alice's home"):
+        out = machine.succeed("echo foobar | ecryptfs-migrate-home -u alice")
+        machine.log(f"ecryptfs-migrate-home said: {out}")
 
-      with subtest("Log alice in (ecryptfs passwhrase is wrapped during first login)"):
-          login_as_alice()
-          machine.send_chars("logout\n")
-          machine.wait_until_tty_matches("1", "login: ")
+    with subtest("Log alice in (ecryptfs passwhrase is wrapped during first login)"):
+        login_as_alice()
+        machine.send_chars("logout\n")
+        machine.wait_until_tty_matches("1", "login: ")
 
-      # Why do I need to do this??
-      machine.succeed("su alice -c ecryptfs-umount-private || true")
-      machine.sleep(1)
+    # Why do I need to do this??
+    machine.succeed("su alice -c ecryptfs-umount-private || true")
+    machine.sleep(1)
 
-      with subtest("check that encrypted home is not mounted"):
-          machine.fail("mount | grep ecryptfs")
+    with subtest("check that encrypted home is not mounted"):
+        machine.fail("mount | grep ecryptfs")
 
-      with subtest("Show contents of the user keyring"):
-          out = machine.succeed("su - alice -c 'keyctl list \@u'")
-          machine.log(f"keyctl unlink said: {out}")
+    with subtest("Show contents of the user keyring"):
+        out = machine.succeed("su - alice -c 'keyctl list \@u'")
+        machine.log(f"keyctl unlink said: {out}")
 
-      with subtest("Log alice again"):
-          login_as_alice()
+    with subtest("Log alice again"):
+        login_as_alice()
 
-      with subtest("Create some files in encrypted home"):
-          machine.succeed("su alice -c 'touch ~alice/a'")
-          machine.succeed("su alice -c 'echo c > ~alice/b'")
+    with subtest("Create some files in encrypted home"):
+        machine.succeed("su alice -c 'touch ~alice/a'")
+        machine.succeed("su alice -c 'echo c > ~alice/b'")
 
-      with subtest("Logout"):
-          logout()
+    with subtest("Logout"):
+        logout()
 
-      # Why do I need to do this??
-      machine.succeed("su alice -c ecryptfs-umount-private || true")
-      machine.sleep(1)
+    # Why do I need to do this??
+    machine.succeed("su alice -c ecryptfs-umount-private || true")
+    machine.sleep(1)
 
-      with subtest("Check that the filesystem is not accessible"):
-          machine.fail("mount | grep ecryptfs")
-          machine.succeed("su alice -c 'test \! -f ~alice/a'")
-          machine.succeed("su alice -c 'test \! -f ~alice/b'")
+    with subtest("Check that the filesystem is not accessible"):
+        machine.fail("mount | grep ecryptfs")
+        machine.succeed("su alice -c 'test \! -f ~alice/a'")
+        machine.succeed("su alice -c 'test \! -f ~alice/b'")
 
-      with subtest("Log alice once more"):
-          login_as_alice()
+    with subtest("Log alice once more"):
+        login_as_alice()
 
-      with subtest("Check that the files are there"):
-          machine.sleep(1)
-          machine.succeed("su alice -c 'test -f ~alice/a'")
-          machine.succeed("su alice -c 'test -f ~alice/b'")
-          machine.succeed('test "$(cat ~alice/b)" = "c"')
+    with subtest("Check that the files are there"):
+        machine.sleep(1)
+        machine.succeed("su alice -c 'test -f ~alice/a'")
+        machine.succeed("su alice -c 'test -f ~alice/b'")
+        machine.succeed('test "$(cat ~alice/b)" = "c"')
 
-      with subtest("Catch https://github.com/NixOS/nixpkgs/issues/16766"):
-          machine.succeed("su alice -c 'ls -lh ~alice/'")
+    with subtest("Catch https://github.com/NixOS/nixpkgs/issues/16766"):
+        machine.succeed("su alice -c 'ls -lh ~alice/'")
 
-      logout()
-    '';
-  }
-)
+    logout()
+  '';
+}
diff --git a/nixos/tests/endlessh-go.nix b/nixos/tests/endlessh-go.nix
index 0c2402af2568..892d54af6101 100644
--- a/nixos/tests/endlessh-go.nix
+++ b/nixos/tests/endlessh-go.nix
@@ -1,71 +1,69 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "endlessh-go";
-    meta.maintainers = with lib.maintainers; [ azahi ];
+{ lib, pkgs, ... }:
+{
+  name = "endlessh-go";
+  meta.maintainers = with lib.maintainers; [ azahi ];
 
-    nodes = {
-      server =
-        { ... }:
-        {
-          services.endlessh-go = {
-            enable = true;
-            prometheus.enable = true;
-            openFirewall = true;
+  nodes = {
+    server =
+      { ... }:
+      {
+        services.endlessh-go = {
+          enable = true;
+          prometheus.enable = true;
+          openFirewall = true;
+        };
+
+        specialisation = {
+          unprivileged.configuration = {
+            services.endlessh-go = {
+              port = 2222;
+              prometheus.port = 9229;
+            };
           };
 
-          specialisation = {
-            unprivileged.configuration = {
-              services.endlessh-go = {
-                port = 2222;
-                prometheus.port = 9229;
-              };
-            };
-
-            privileged.configuration = {
-              services.endlessh-go = {
-                port = 22;
-                prometheus.port = 92;
-              };
+          privileged.configuration = {
+            services.endlessh-go = {
+              port = 22;
+              prometheus.port = 92;
             };
           };
         };
+      };
 
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = with pkgs; [
-            curl
-            netcat
-          ];
-        };
-    };
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [
+          curl
+          netcat
+        ];
+      };
+  };
 
-    testScript = ''
-      def activate_specialisation(name: str):
-          server.succeed(f"/run/booted-system/specialisation/{name}/bin/switch-to-configuration test >&2")
+  testScript = ''
+    def activate_specialisation(name: str):
+        server.succeed(f"/run/booted-system/specialisation/{name}/bin/switch-to-configuration test >&2")
 
-      start_all()
+    start_all()
 
-      with subtest("Unprivileged"):
-          activate_specialisation("unprivileged")
-          server.wait_for_unit("endlessh-go.service")
-          server.wait_for_open_port(2222)
-          server.wait_for_open_port(9229)
-          server.fail("curl -sSf server:9229/metrics | grep -q endlessh_client_closed_count_total")
-          client.succeed("nc -dvW5 server 2222")
-          server.succeed("curl -sSf server:9229/metrics | grep -q endlessh_client_closed_count_total")
-          client.fail("curl -sSfm 5 server:9229/metrics")
+    with subtest("Unprivileged"):
+        activate_specialisation("unprivileged")
+        server.wait_for_unit("endlessh-go.service")
+        server.wait_for_open_port(2222)
+        server.wait_for_open_port(9229)
+        server.fail("curl -sSf server:9229/metrics | grep -q endlessh_client_closed_count_total")
+        client.succeed("nc -dvW5 server 2222")
+        server.succeed("curl -sSf server:9229/metrics | grep -q endlessh_client_closed_count_total")
+        client.fail("curl -sSfm 5 server:9229/metrics")
 
-      with subtest("Privileged"):
-          activate_specialisation("privileged")
-          server.wait_for_unit("endlessh-go.service")
-          server.wait_for_open_port(22)
-          server.wait_for_open_port(92)
-          server.fail("curl -sSf server:92/metrics | grep -q endlessh_client_closed_count_total")
-          client.succeed("nc -dvW5 server 22")
-          server.succeed("curl -sSf server:92/metrics | grep -q endlessh_client_closed_count_total")
-          client.fail("curl -sSfm 5 server:92/metrics")
-    '';
-  }
-)
+    with subtest("Privileged"):
+        activate_specialisation("privileged")
+        server.wait_for_unit("endlessh-go.service")
+        server.wait_for_open_port(22)
+        server.wait_for_open_port(92)
+        server.fail("curl -sSf server:92/metrics | grep -q endlessh_client_closed_count_total")
+        client.succeed("nc -dvW5 server 22")
+        server.succeed("curl -sSf server:92/metrics | grep -q endlessh_client_closed_count_total")
+        client.fail("curl -sSfm 5 server:92/metrics")
+  '';
+}
diff --git a/nixos/tests/endlessh.nix b/nixos/tests/endlessh.nix
index 696ef1b6013f..95cdbf8586c2 100644
--- a/nixos/tests/endlessh.nix
+++ b/nixos/tests/endlessh.nix
@@ -1,52 +1,50 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "endlessh";
-    meta.maintainers = with lib.maintainers; [ azahi ];
+{ lib, pkgs, ... }:
+{
+  name = "endlessh";
+  meta.maintainers = with lib.maintainers; [ azahi ];
 
-    nodes = {
-      server =
-        { ... }:
-        {
-          services.endlessh = {
-            enable = true;
-            openFirewall = true;
-          };
-
-          specialisation = {
-            unprivileged.configuration.services.endlessh.port = 2222;
-
-            privileged.configuration.services.endlessh.port = 22;
-          };
+  nodes = {
+    server =
+      { ... }:
+      {
+        services.endlessh = {
+          enable = true;
+          openFirewall = true;
         };
 
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = with pkgs; [
-            curl
-            netcat
-          ];
+        specialisation = {
+          unprivileged.configuration.services.endlessh.port = 2222;
+
+          privileged.configuration.services.endlessh.port = 22;
         };
-    };
+      };
 
-    testScript = ''
-      def activate_specialisation(name: str):
-          server.succeed(f"/run/booted-system/specialisation/{name}/bin/switch-to-configuration test >&2")
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [
+          curl
+          netcat
+        ];
+      };
+  };
 
-      start_all()
+  testScript = ''
+    def activate_specialisation(name: str):
+        server.succeed(f"/run/booted-system/specialisation/{name}/bin/switch-to-configuration test >&2")
 
-      with subtest("Unprivileged"):
-          activate_specialisation("unprivileged")
-          server.wait_for_unit("endlessh.service")
-          server.wait_for_open_port(2222)
-          client.succeed("nc -dvW5 server 2222")
+    start_all()
 
-      with subtest("Privileged"):
-          activate_specialisation("privileged")
-          server.wait_for_unit("endlessh.service")
-          server.wait_for_open_port(22)
-          client.succeed("nc -dvW5 server 22")
-    '';
-  }
-)
+    with subtest("Unprivileged"):
+        activate_specialisation("unprivileged")
+        server.wait_for_unit("endlessh.service")
+        server.wait_for_open_port(2222)
+        client.succeed("nc -dvW5 server 2222")
+
+    with subtest("Privileged"):
+        activate_specialisation("privileged")
+        server.wait_for_unit("endlessh.service")
+        server.wait_for_open_port(22)
+        client.succeed("nc -dvW5 server 22")
+  '';
+}
diff --git a/nixos/tests/engelsystem.nix b/nixos/tests/engelsystem.nix
index 69187973ada9..a0eaff6bb1fe 100644
--- a/nixos/tests/engelsystem.nix
+++ b/nixos/tests/engelsystem.nix
@@ -1,45 +1,43 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "engelsystem";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ talyz ];
+{ pkgs, lib, ... }:
+{
+  name = "engelsystem";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ talyz ];
+  };
+
+  nodes.engelsystem =
+    { ... }:
+    {
+      services.engelsystem = {
+        enable = true;
+        domain = "engelsystem";
+        createDatabase = true;
+      };
+      networking.firewall.allowedTCPPorts = [
+        80
+        443
+      ];
+      environment.systemPackages = with pkgs; [
+        xmlstarlet
+        libxml2
+      ];
     };
 
-    nodes.engelsystem =
-      { ... }:
-      {
-        services.engelsystem = {
-          enable = true;
-          domain = "engelsystem";
-          createDatabase = true;
-        };
-        networking.firewall.allowedTCPPorts = [
-          80
-          443
-        ];
-        environment.systemPackages = with pkgs; [
-          xmlstarlet
-          libxml2
-        ];
-      };
-
-    testScript = ''
-      engelsystem.start()
-      engelsystem.wait_for_unit("phpfpm-engelsystem.service")
-      engelsystem.wait_until_succeeds("curl engelsystem/login -sS -f")
-      engelsystem.succeed(
-          "curl engelsystem/login -sS -f -c cookie | xmllint -html -xmlout - >login"
-      )
-      engelsystem.succeed(
-          "xml sel -T -t -m \"html/head/meta[@name='csrf-token']\" -v @content login >token"
-      )
-      engelsystem.succeed(
-          "curl engelsystem/login -sS -f -b cookie -F 'login=admin' -F 'password=asdfasdf' -F '_token=<token' -L | xmllint -html -xmlout - >news"
-      )
-      engelsystem.succeed(
-          "test 'News - Engelsystem' = \"$(xml sel -T -t -c html/head/title news)\""
-      )
-    '';
-  }
-)
+  testScript = ''
+    engelsystem.start()
+    engelsystem.wait_for_unit("phpfpm-engelsystem.service")
+    engelsystem.wait_until_succeeds("curl engelsystem/login -sS -f")
+    engelsystem.succeed(
+        "curl engelsystem/login -sS -f -c cookie | xmllint -html -xmlout - >login"
+    )
+    engelsystem.succeed(
+        "xml sel -T -t -m \"html/head/meta[@name='csrf-token']\" -v @content login >token"
+    )
+    engelsystem.succeed(
+        "curl engelsystem/login -sS -f -b cookie -F 'login=admin' -F 'password=asdfasdf' -F '_token=<token' -L | xmllint -html -xmlout - >news"
+    )
+    engelsystem.succeed(
+        "test 'News - Engelsystem' = \"$(xml sel -T -t -c html/head/title news)\""
+    )
+  '';
+}
diff --git a/nixos/tests/enlightenment.nix b/nixos/tests/enlightenment.nix
index f2fc23685dd6..77e731feddbf 100644
--- a/nixos/tests/enlightenment.nix
+++ b/nixos/tests/enlightenment.nix
@@ -1,104 +1,102 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "enlightenment";
+{ pkgs, ... }:
+{
+  name = "enlightenment";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ romildo ];
-      timeout = 600;
-      # OCR tests are flaky
-      broken = true;
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ romildo ];
+    timeout = 600;
+    # OCR tests are flaky
+    broken = true;
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ./common/user-account.nix ];
+      services.xserver.enable = true;
+      services.xserver.desktopManager.enlightenment.enable = true;
+      services.xserver.displayManager = {
+        lightdm.enable = true;
+        autoLogin = {
+          enable = true;
+          user = "alice";
+        };
+      };
+      environment.systemPackages = [ pkgs.xdotool ];
+      services.acpid.enable = true;
+      services.connman.enable = true;
+      services.connman.package = pkgs.connmanMinimal;
     };
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ./common/user-account.nix ];
-        services.xserver.enable = true;
-        services.xserver.desktopManager.enlightenment.enable = true;
-        services.xserver.displayManager = {
-          lightdm.enable = true;
-          autoLogin = {
-            enable = true;
-            user = "alice";
-          };
-        };
-        environment.systemPackages = [ pkgs.xdotool ];
-        services.acpid.enable = true;
-        services.connman.enable = true;
-        services.connman.package = pkgs.connmanMinimal;
-      };
+  enableOCR = true;
 
-    enableOCR = true;
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.config.users.users.alice;
+    in
+    ''
+      with subtest("Ensure x starts"):
+          machine.wait_for_x()
+          machine.wait_for_file("${user.home}/.Xauthority")
+          machine.succeed("xauth merge ${user.home}/.Xauthority")
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.config.users.users.alice;
-      in
-      ''
-        with subtest("Ensure x starts"):
-            machine.wait_for_x()
-            machine.wait_for_file("${user.home}/.Xauthority")
-            machine.succeed("xauth merge ${user.home}/.Xauthority")
+      with subtest("Check that logging in has given the user ownership of devices"):
+          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
 
-        with subtest("Check that logging in has given the user ownership of devices"):
-            machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+      with subtest("First time wizard"):
+          machine.wait_for_text("Default")  # Language
+          machine.screenshot("wizard1")
+          machine.succeed("xdotool mousemove 512 740 click 1")  # Next
+          machine.screenshot("wizard2")
 
-        with subtest("First time wizard"):
-            machine.wait_for_text("Default")  # Language
-            machine.screenshot("wizard1")
-            machine.succeed("xdotool mousemove 512 740 click 1")  # Next
-            machine.screenshot("wizard2")
+          machine.wait_for_text("English")  # Keyboard (default)
+          machine.screenshot("wizard3")
+          machine.succeed("xdotool mousemove 512 740 click 1")  # Next
 
-            machine.wait_for_text("English")  # Keyboard (default)
-            machine.screenshot("wizard3")
-            machine.succeed("xdotool mousemove 512 740 click 1")  # Next
+          machine.wait_for_text("Standard")  # Profile (default)
+          machine.screenshot("wizard4")
+          machine.succeed("xdotool mousemove 512 740 click 1")  # Next
 
-            machine.wait_for_text("Standard")  # Profile (default)
-            machine.screenshot("wizard4")
-            machine.succeed("xdotool mousemove 512 740 click 1")  # Next
+          machine.wait_for_text("Title")  # Sizing (default)
+          machine.screenshot("wizard5")
+          machine.succeed("xdotool mousemove 512 740 click 1")  # Next
 
-            machine.wait_for_text("Title")  # Sizing (default)
-            machine.screenshot("wizard5")
-            machine.succeed("xdotool mousemove 512 740 click 1")  # Next
+          machine.wait_for_text("clicked")  # Windows Focus
+          machine.succeed("xdotool mousemove 512 370 click 1")  # Click
+          machine.screenshot("wizard6")
+          machine.succeed("xdotool mousemove 512 740 click 1")  # Next
 
-            machine.wait_for_text("clicked")  # Windows Focus
-            machine.succeed("xdotool mousemove 512 370 click 1")  # Click
-            machine.screenshot("wizard6")
-            machine.succeed("xdotool mousemove 512 740 click 1")  # Next
+          machine.wait_for_text("Connman")  # Network Management (default)
+          machine.screenshot("wizard7")
+          machine.succeed("xdotool mousemove 512 740 click 1")  # Next
 
-            machine.wait_for_text("Connman")  # Network Management (default)
-            machine.screenshot("wizard7")
-            machine.succeed("xdotool mousemove 512 740 click 1")  # Next
+          machine.wait_for_text("BlusZ")  # Bluetooth Management (default)
+          machine.screenshot("wizard8")
+          machine.succeed("xdotool mousemove 512 740 click 1")  # Next
 
-            machine.wait_for_text("BlusZ")  # Bluetooth Management (default)
-            machine.screenshot("wizard8")
-            machine.succeed("xdotool mousemove 512 740 click 1")  # Next
+          machine.wait_for_text("OpenGL")  # Compositing (default)
+          machine.screenshot("wizard9")
+          machine.succeed("xdotool mousemove 512 740 click 1")  # Next
 
-            machine.wait_for_text("OpenGL")  # Compositing (default)
-            machine.screenshot("wizard9")
-            machine.succeed("xdotool mousemove 512 740 click 1")  # Next
+          machine.wait_for_text("update")  # Updates
+          machine.succeed("xdotool mousemove 512 495 click 1")  # Disable
+          machine.screenshot("wizard10")
+          machine.succeed("xdotool mousemove 512 740 click 1")  # Next
 
-            machine.wait_for_text("update")  # Updates
-            machine.succeed("xdotool mousemove 512 495 click 1")  # Disable
-            machine.screenshot("wizard10")
-            machine.succeed("xdotool mousemove 512 740 click 1")  # Next
+          machine.wait_for_text("taskbar")  # Taskbar
+          machine.succeed("xdotool mousemove 480 410 click 1")  # Enable
+          machine.screenshot("wizard11")
+          machine.succeed("xdotool mousemove 512 740 click 1")  # Next
 
-            machine.wait_for_text("taskbar")  # Taskbar
-            machine.succeed("xdotool mousemove 480 410 click 1")  # Enable
-            machine.screenshot("wizard11")
-            machine.succeed("xdotool mousemove 512 740 click 1")  # Next
+          machine.wait_for_text("Home")  # The desktop
+          machine.screenshot("wizard12")
 
-            machine.wait_for_text("Home")  # The desktop
-            machine.screenshot("wizard12")
-
-        with subtest("Run Terminology"):
-            machine.succeed("terminology >&2 &")
-            machine.sleep(5)
-            machine.send_chars("ls --color -alF\n")
-            machine.sleep(2)
-            machine.screenshot("terminology")
-      '';
-  }
-)
+      with subtest("Run Terminology"):
+          machine.succeed("terminology >&2 &")
+          machine.sleep(5)
+          machine.send_chars("ls --color -alF\n")
+          machine.sleep(2)
+          machine.screenshot("terminology")
+    '';
+}
diff --git a/nixos/tests/env.nix b/nixos/tests/env.nix
index 5636a423469a..6e94771b1ff1 100644
--- a/nixos/tests/env.nix
+++ b/nixos/tests/env.nix
@@ -1,49 +1,47 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "environment";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ nequissimus ];
-    };
+{ pkgs, ... }:
+{
+  name = "environment";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ nequissimus ];
+  };
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      lib.mkMerge [
-        {
-          boot.kernelPackages = pkgs.linuxPackages;
-          environment.etc.plainFile.text = ''
-            Hello World
-          '';
-          environment.etc."folder/with/file".text = ''
-            Foo Bar!
-          '';
+  nodes.machine =
+    { pkgs, lib, ... }:
+    lib.mkMerge [
+      {
+        boot.kernelPackages = pkgs.linuxPackages;
+        environment.etc.plainFile.text = ''
+          Hello World
+        '';
+        environment.etc."folder/with/file".text = ''
+          Foo Bar!
+        '';
 
-          environment.sessionVariables = {
-            TERMINFO_DIRS = "/run/current-system/sw/share/terminfo";
-            NIXCON = "awesome";
-            SHOULD_NOT_BE_SET = "oops";
-          };
-        }
-        {
-          environment.sessionVariables = {
-            SHOULD_NOT_BE_SET = lib.mkForce null;
-          };
-        }
-      ];
+        environment.sessionVariables = {
+          TERMINFO_DIRS = "/run/current-system/sw/share/terminfo";
+          NIXCON = "awesome";
+          SHOULD_NOT_BE_SET = "oops";
+        };
+      }
+      {
+        environment.sessionVariables = {
+          SHOULD_NOT_BE_SET = lib.mkForce null;
+        };
+      }
+    ];
 
-    testScript = ''
-      machine.succeed('[ -L "/etc/plainFile" ]')
-      assert "Hello World" in machine.succeed('cat "/etc/plainFile"')
-      machine.succeed('[ -d "/etc/folder" ]')
-      machine.succeed('[ -d "/etc/folder/with" ]')
-      machine.succeed('[ -L "/etc/folder/with/file" ]')
-      assert "Hello World" in machine.succeed('cat "/etc/plainFile"')
+  testScript = ''
+    machine.succeed('[ -L "/etc/plainFile" ]')
+    assert "Hello World" in machine.succeed('cat "/etc/plainFile"')
+    machine.succeed('[ -d "/etc/folder" ]')
+    machine.succeed('[ -d "/etc/folder/with" ]')
+    machine.succeed('[ -L "/etc/folder/with/file" ]')
+    assert "Hello World" in machine.succeed('cat "/etc/plainFile"')
 
-      assert "/run/current-system/sw/share/terminfo" in machine.succeed(
-          "echo ''${TERMINFO_DIRS}"
-      )
-      assert "awesome" in machine.succeed("echo ''${NIXCON}")
-      machine.fail("printenv SHOULD_NOT_BE_SET")
-    '';
-  }
-)
+    assert "/run/current-system/sw/share/terminfo" in machine.succeed(
+        "echo ''${TERMINFO_DIRS}"
+    )
+    assert "awesome" in machine.succeed("echo ''${NIXCON}")
+    machine.fail("printenv SHOULD_NOT_BE_SET")
+  '';
+}
diff --git a/nixos/tests/envfs.nix b/nixos/tests/envfs.nix
index b9067467eb2b..6e8ee7e55aea 100644
--- a/nixos/tests/envfs.nix
+++ b/nixos/tests/envfs.nix
@@ -1,42 +1,40 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    pythonShebang = pkgs.writeScript "python-shebang" ''
-      #!/usr/bin/python
-      print("OK")
-    '';
+{ lib, pkgs, ... }:
+let
+  pythonShebang = pkgs.writeScript "python-shebang" ''
+    #!/usr/bin/python
+    print("OK")
+  '';
 
-    bashShebang = pkgs.writeScript "bash-shebang" ''
-      #!/usr/bin/bash
-      echo "OK"
-    '';
-  in
-  {
-    name = "envfs";
-    nodes.machine.services.envfs.enable = true;
+  bashShebang = pkgs.writeScript "bash-shebang" ''
+    #!/usr/bin/bash
+    echo "OK"
+  '';
+in
+{
+  name = "envfs";
+  nodes.machine.services.envfs.enable = true;
 
-    testScript = ''
-      start_all()
-      machine.wait_until_succeeds("mountpoint -q /usr/bin/")
-      machine.succeed(
-          "PATH=${pkgs.coreutils}/bin /usr/bin/cp --version",
-          # check fallback paths
-          "PATH= /usr/bin/sh --version",
-          "PATH= /usr/bin/env --version",
-          "PATH= test -e /usr/bin/sh",
-          "PATH= test -e /usr/bin/env",
-          # also picks up PATH that was set after execve
-          "! /usr/bin/hello",
-          "PATH=${pkgs.hello}/bin /usr/bin/hello",
-      )
+  testScript = ''
+    start_all()
+    machine.wait_until_succeeds("mountpoint -q /usr/bin/")
+    machine.succeed(
+        "PATH=${pkgs.coreutils}/bin /usr/bin/cp --version",
+        # check fallback paths
+        "PATH= /usr/bin/sh --version",
+        "PATH= /usr/bin/env --version",
+        "PATH= test -e /usr/bin/sh",
+        "PATH= test -e /usr/bin/env",
+        # also picks up PATH that was set after execve
+        "! /usr/bin/hello",
+        "PATH=${pkgs.hello}/bin /usr/bin/hello",
+    )
 
-      out = machine.succeed("PATH=${pkgs.python3}/bin ${pythonShebang}")
-      print(out)
-      assert out == "OK\n"
+    out = machine.succeed("PATH=${pkgs.python3}/bin ${pythonShebang}")
+    print(out)
+    assert out == "OK\n"
 
-      out = machine.succeed("PATH=${pkgs.bash}/bin ${bashShebang}")
-      print(out)
-      assert out == "OK\n"
-    '';
-  }
-)
+    out = machine.succeed("PATH=${pkgs.bash}/bin ${bashShebang}")
+    print(out)
+    assert out == "OK\n"
+  '';
+}
diff --git a/nixos/tests/ergo.nix b/nixos/tests/ergo.nix
index fadf44589906..816bec0d3ac4 100644
--- a/nixos/tests/ergo.nix
+++ b/nixos/tests/ergo.nix
@@ -1,23 +1,21 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "ergo";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ mmahut ];
-    };
+{ pkgs, ... }:
+{
+  name = "ergo";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ mmahut ];
+  };
 
-    nodes = {
-      machine =
-        { ... }:
-        {
-          services.ergo.enable = true;
-          services.ergo.api.keyHash = "324dcf027dd4a30a932c441f365a25e86b173defa4b8e58948253471b81b72cf";
-        };
-    };
+  nodes = {
+    machine =
+      { ... }:
+      {
+        services.ergo.enable = true;
+        services.ergo.api.keyHash = "324dcf027dd4a30a932c441f365a25e86b173defa4b8e58948253471b81b72cf";
+      };
+  };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("ergo.service")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("ergo.service")
+  '';
+}
diff --git a/nixos/tests/ergochat.nix b/nixos/tests/ergochat.nix
index 6dd9efbb2ccf..30f262bf5569 100644
--- a/nixos/tests/ergochat.nix
+++ b/nixos/tests/ergochat.nix
@@ -9,100 +9,98 @@ let
   iiDir = "/tmp/irc";
 in
 
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "ergochat";
-    nodes =
-      {
-        "${server}" = {
-          networking.firewall.allowedTCPPorts = [ ircPort ];
-          services.ergochat = {
-            enable = true;
-            settings.server.motd = pkgs.writeText "ergo.motd" ''
-              The default MOTD doesn't contain the word "nixos" in it.
-              This one does.
-            '';
-          };
+{ pkgs, lib, ... }:
+{
+  name = "ergochat";
+  nodes =
+    {
+      "${server}" = {
+        networking.firewall.allowedTCPPorts = [ ircPort ];
+        services.ergochat = {
+          enable = true;
+          settings.server.motd = pkgs.writeText "ergo.motd" ''
+            The default MOTD doesn't contain the word "nixos" in it.
+            This one does.
+          '';
         };
-      }
-      // lib.listToAttrs (
-        builtins.map (
-          client:
-          lib.nameValuePair client {
-            imports = [
-              ./common/user-account.nix
-            ];
+      };
+    }
+    // lib.listToAttrs (
+      builtins.map (
+        client:
+        lib.nameValuePair client {
+          imports = [
+            ./common/user-account.nix
+          ];
 
-            systemd.services.ii = {
-              requires = [ "network.target" ];
-              wantedBy = [ "default.target" ];
+          systemd.services.ii = {
+            requires = [ "network.target" ];
+            wantedBy = [ "default.target" ];
 
-              serviceConfig = {
-                Type = "simple";
-                ExecPreStartPre = "mkdir -p ${iiDir}";
-                ExecStart = ''
-                  ${lib.getBin pkgs.ii}/bin/ii -n ${client} -s ${server} -i ${iiDir}
-                '';
-                User = "alice";
-              };
+            serviceConfig = {
+              Type = "simple";
+              ExecPreStartPre = "mkdir -p ${iiDir}";
+              ExecStart = ''
+                ${lib.getBin pkgs.ii}/bin/ii -n ${client} -s ${server} -i ${iiDir}
+              '';
+              User = "alice";
             };
-          }
-        ) clients
-      );
+          };
+        }
+      ) clients
+    );
 
-    testScript =
-      let
-        msg = client: "Hello, my name is ${client}";
-        clientScript =
-          client:
-          [
-            ''
-              ${client}.wait_for_unit("network.target")
-              ${client}.systemctl("start ii")
-              ${client}.wait_for_unit("ii")
-              ${client}.wait_for_file("${iiDir}/${server}/out")
-            ''
-            # look for the custom text in the MOTD.
-            ''
-              ${client}.wait_until_succeeds("grep 'nixos' ${iiDir}/${server}/out")
-            ''
-            # wait until first PING from server arrives before joining,
-            # so we don't try it too early
-            ''
-              ${client}.wait_until_succeeds("grep 'PING' ${iiDir}/${server}/out")
-            ''
-            # join ${channel}
-            ''
-              ${client}.succeed("echo '/j #${channel}' > ${iiDir}/${server}/in")
-              ${client}.wait_for_file("${iiDir}/${server}/#${channel}/in")
-            ''
-            # send a greeting
-            ''
-              ${client}.succeed(
-                  "echo '${msg client}' > ${iiDir}/${server}/#${channel}/in"
-              )
-            ''
-            # check that all greetings arrived on all clients
-          ]
-          ++ builtins.map (other: ''
+  testScript =
+    let
+      msg = client: "Hello, my name is ${client}";
+      clientScript =
+        client:
+        [
+          ''
+            ${client}.wait_for_unit("network.target")
+            ${client}.systemctl("start ii")
+            ${client}.wait_for_unit("ii")
+            ${client}.wait_for_file("${iiDir}/${server}/out")
+          ''
+          # look for the custom text in the MOTD.
+          ''
+            ${client}.wait_until_succeeds("grep 'nixos' ${iiDir}/${server}/out")
+          ''
+          # wait until first PING from server arrives before joining,
+          # so we don't try it too early
+          ''
+            ${client}.wait_until_succeeds("grep 'PING' ${iiDir}/${server}/out")
+          ''
+          # join ${channel}
+          ''
+            ${client}.succeed("echo '/j #${channel}' > ${iiDir}/${server}/in")
+            ${client}.wait_for_file("${iiDir}/${server}/#${channel}/in")
+          ''
+          # send a greeting
+          ''
             ${client}.succeed(
-                "grep '${msg other}$' ${iiDir}/${server}/#${channel}/out"
+                "echo '${msg client}' > ${iiDir}/${server}/#${channel}/in"
             )
-          '') clients;
+          ''
+          # check that all greetings arrived on all clients
+        ]
+        ++ builtins.map (other: ''
+          ${client}.succeed(
+              "grep '${msg other}$' ${iiDir}/${server}/#${channel}/out"
+          )
+        '') clients;
 
-        # foldl', but requires a non-empty list instead of a start value
-        reduce = f: list: builtins.foldl' f (builtins.head list) (builtins.tail list);
-      in
-      ''
-        start_all()
-        ${server}.systemctl("status ergochat")
-        ${server}.wait_for_open_port(${toString ircPort})
+      # foldl', but requires a non-empty list instead of a start value
+      reduce = f: list: builtins.foldl' f (builtins.head list) (builtins.tail list);
+    in
+    ''
+      start_all()
+      ${server}.systemctl("status ergochat")
+      ${server}.wait_for_open_port(${toString ircPort})
 
-        # run clientScript for all clients so that every list
-        # entry is executed by every client before advancing
-        # to the next one.
-      ''
-      + lib.concatStrings (reduce (lib.zipListsWith (cs: c: cs + c)) (builtins.map clientScript clients));
-  }
-)
+      # run clientScript for all clients so that every list
+      # entry is executed by every client before advancing
+      # to the next one.
+    ''
+    + lib.concatStrings (reduce (lib.zipListsWith (cs: c: cs + c)) (builtins.map clientScript clients));
+}
diff --git a/nixos/tests/eris-server.nix b/nixos/tests/eris-server.nix
index 795be7f5086c..55d02c1a9803 100644
--- a/nixos/tests/eris-server.nix
+++ b/nixos/tests/eris-server.nix
@@ -1,29 +1,27 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "eris-server";
-    meta.maintainers = with lib.maintainers; [ ehmry ];
+{ pkgs, lib, ... }:
+{
+  name = "eris-server";
+  meta.maintainers = with lib.maintainers; [ ehmry ];
 
-    nodes.server = {
-      environment.systemPackages = [
-        pkgs.eris-go
-        pkgs.eriscmd
-      ];
-      services.eris-server = {
-        enable = true;
-        decode = true;
-        listenHttp = "[::1]:80";
-        backends = [ "badger+file:///var/cache/eris.badger?get&put" ];
-        mountpoint = "/eris";
-      };
+  nodes.server = {
+    environment.systemPackages = [
+      pkgs.eris-go
+      pkgs.eriscmd
+    ];
+    services.eris-server = {
+      enable = true;
+      decode = true;
+      listenHttp = "[::1]:80";
+      backends = [ "badger+file:///var/cache/eris.badger?get&put" ];
+      mountpoint = "/eris";
     };
+  };
 
-    testScript = ''
-      start_all()
-      server.wait_for_unit("eris-server.service")
-      server.wait_for_open_port(5683)
-      server.wait_for_open_port(80)
-      server.succeed("eriscmd get http://[::1] $(echo 'Hail ERIS!' | eriscmd put coap+tcp://[::1]:5683)")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    server.wait_for_unit("eris-server.service")
+    server.wait_for_open_port(5683)
+    server.wait_for_open_port(80)
+    server.succeed("eriscmd get http://[::1] $(echo 'Hail ERIS!' | eriscmd put coap+tcp://[::1]:5683)")
+  '';
+}
diff --git a/nixos/tests/esphome.nix b/nixos/tests/esphome.nix
index 4fe0a9303ce8..8a84213f971d 100644
--- a/nixos/tests/esphome.nix
+++ b/nixos/tests/esphome.nix
@@ -1,44 +1,42 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    testPort = 6052;
-    unixSocket = "/run/esphome/esphome.sock";
-  in
-  {
-    name = "esphome";
-    meta.maintainers = with lib.maintainers; [ oddlama ];
+let
+  testPort = 6052;
+  unixSocket = "/run/esphome/esphome.sock";
+in
+{
+  name = "esphome";
+  meta.maintainers = with lib.maintainers; [ oddlama ];
 
-    nodes = {
-      esphomeTcp =
-        { ... }:
-        {
-          services.esphome = {
-            enable = true;
-            port = testPort;
-            address = "0.0.0.0";
-            openFirewall = true;
-          };
+  nodes = {
+    esphomeTcp =
+      { ... }:
+      {
+        services.esphome = {
+          enable = true;
+          port = testPort;
+          address = "0.0.0.0";
+          openFirewall = true;
         };
+      };
 
-      esphomeUnix =
-        { ... }:
-        {
-          services.esphome = {
-            enable = true;
-            enableUnixSocket = true;
-          };
+    esphomeUnix =
+      { ... }:
+      {
+        services.esphome = {
+          enable = true;
+          enableUnixSocket = true;
         };
-    };
+      };
+  };
 
-    testScript = ''
-      esphomeTcp.wait_for_unit("esphome.service")
-      esphomeTcp.wait_for_open_port(${toString testPort})
-      esphomeTcp.succeed("curl --fail http://localhost:${toString testPort}/")
+  testScript = ''
+    esphomeTcp.wait_for_unit("esphome.service")
+    esphomeTcp.wait_for_open_port(${toString testPort})
+    esphomeTcp.succeed("curl --fail http://localhost:${toString testPort}/")
 
-      esphomeUnix.wait_for_unit("esphome.service")
-      esphomeUnix.wait_for_file("${unixSocket}")
-      esphomeUnix.succeed("curl --fail --unix-socket ${unixSocket} http://localhost/")
-    '';
-  }
-)
+    esphomeUnix.wait_for_unit("esphome.service")
+    esphomeUnix.wait_for_file("${unixSocket}")
+    esphomeUnix.succeed("curl --fail --unix-socket ${unixSocket} http://localhost/")
+  '';
+}
diff --git a/nixos/tests/etebase-server.nix b/nixos/tests/etebase-server.nix
index 110338ef8915..4d848b8b0a06 100644
--- a/nixos/tests/etebase-server.nix
+++ b/nixos/tests/etebase-server.nix
@@ -1,52 +1,50 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    dataDir = "/var/lib/foobar";
+let
+  dataDir = "/var/lib/foobar";
 
-  in
-  {
-    name = "etebase-server";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ felschr ];
+in
+{
+  name = "etebase-server";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ felschr ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.etebase-server = {
+        inherit dataDir;
+        enable = true;
+        settings.global.secret_file = toString (pkgs.writeText "secret" "123456");
+      };
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.etebase-server = {
-          inherit dataDir;
-          enable = true;
-          settings.global.secret_file = toString (pkgs.writeText "secret" "123456");
-        };
-      };
+  testScript = ''
+    machine.wait_for_unit("etebase-server.service")
+    machine.wait_for_open_port(8001)
 
-    testScript = ''
-      machine.wait_for_unit("etebase-server.service")
-      machine.wait_for_open_port(8001)
+    with subtest("Database & src-version were created"):
+        machine.wait_for_file("${dataDir}/src-version")
+        assert (
+            "${pkgs.etebase-server}"
+            in machine.succeed("cat ${dataDir}/src-version")
+        )
+        machine.wait_for_file("${dataDir}/db.sqlite3")
+        machine.wait_for_file("${dataDir}/static")
 
-      with subtest("Database & src-version were created"):
-          machine.wait_for_file("${dataDir}/src-version")
-          assert (
-              "${pkgs.etebase-server}"
-              in machine.succeed("cat ${dataDir}/src-version")
-          )
-          machine.wait_for_file("${dataDir}/db.sqlite3")
-          machine.wait_for_file("${dataDir}/static")
+    with subtest("Only allow access from allowed_hosts"):
+        machine.succeed("curl -sSfL http://0.0.0.0:8001/")
+        machine.fail("curl -sSfL http://127.0.0.1:8001/")
+        machine.fail("curl -sSfL http://localhost:8001/")
 
-      with subtest("Only allow access from allowed_hosts"):
-          machine.succeed("curl -sSfL http://0.0.0.0:8001/")
-          machine.fail("curl -sSfL http://127.0.0.1:8001/")
-          machine.fail("curl -sSfL http://localhost:8001/")
+    with subtest("Run tests"):
+        machine.succeed("etebase-server check")
+        machine.succeed("etebase-server test")
 
-      with subtest("Run tests"):
-          machine.succeed("etebase-server check")
-          machine.succeed("etebase-server test")
-
-      with subtest("Create superuser"):
-          machine.succeed(
-              "etebase-server createsuperuser --no-input --username admin --email root@localhost"
-          )
-    '';
-  }
-)
+    with subtest("Create superuser"):
+        machine.succeed(
+            "etebase-server createsuperuser --no-input --username admin --email root@localhost"
+        )
+  '';
+}
diff --git a/nixos/tests/etesync-dav.nix b/nixos/tests/etesync-dav.nix
index c8f86a84e371..feff9030f2a9 100644
--- a/nixos/tests/etesync-dav.nix
+++ b/nixos/tests/etesync-dav.nix
@@ -1,28 +1,26 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
+{ pkgs, ... }:
+{
 
-    name = "etesync-dav";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ _3699n ];
+  name = "etesync-dav";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ _3699n ];
+  };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.curl
+        pkgs.etesync-dav
+      ];
     };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        environment.systemPackages = [
-          pkgs.curl
-          pkgs.etesync-dav
-        ];
-      };
-
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("etesync-dav --version")
-      machine.execute("etesync-dav >&2 &")
-      machine.wait_for_open_port(37358)
-      with subtest("Check that the web interface is accessible"):
-          assert "Add User" in machine.succeed("curl -s http://localhost:37358/.web/add/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("etesync-dav --version")
+    machine.execute("etesync-dav >&2 &")
+    machine.wait_for_open_port(37358)
+    with subtest("Check that the web interface is accessible"):
+        assert "Add User" in machine.succeed("curl -s http://localhost:37358/.web/add/")
+  '';
+}
diff --git a/nixos/tests/fakeroute.nix b/nixos/tests/fakeroute.nix
index 24919d6b242c..3886b976f1c7 100644
--- a/nixos/tests/fakeroute.nix
+++ b/nixos/tests/fakeroute.nix
@@ -1,27 +1,25 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "fakeroute";
-    meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+{ lib, pkgs, ... }:
+{
+  name = "fakeroute";
+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ../modules/profiles/minimal.nix ];
-        services.fakeroute.enable = true;
-        services.fakeroute.route = [
-          "216.102.187.130"
-          "4.0.1.122"
-          "198.116.142.34"
-          "63.199.8.242"
-        ];
-        environment.systemPackages = [ pkgs.traceroute ];
-      };
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ../modules/profiles/minimal.nix ];
+      services.fakeroute.enable = true;
+      services.fakeroute.route = [
+        "216.102.187.130"
+        "4.0.1.122"
+        "198.116.142.34"
+        "63.199.8.242"
+      ];
+      environment.systemPackages = [ pkgs.traceroute ];
+    };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("fakeroute.service")
-      machine.succeed("traceroute 127.0.0.1 | grep -q 216.102.187.130")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("fakeroute.service")
+    machine.succeed("traceroute 127.0.0.1 | grep -q 216.102.187.130")
+  '';
+}
diff --git a/nixos/tests/fanout.nix b/nixos/tests/fanout.nix
index a6ee1b8120b6..797a679b9b0c 100644
--- a/nixos/tests/fanout.nix
+++ b/nixos/tests/fanout.nix
@@ -1,38 +1,23 @@
+{ lib, ... }:
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-}:
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "fanout";
-    meta.maintainers = [ lib.maintainers.therishidesai ];
+  name = "fanout";
+  meta.maintainers = with lib.maintainers; [ therishidesai ];
 
-    nodes =
-      let
-        cfg =
-          { ... }:
-          {
-            services.fanout = {
-              enable = true;
-              fanoutDevices = 2;
-              bufferSize = 8192;
-            };
-          };
-      in
-      {
-        machine = cfg;
-      };
+  nodes.machine = {
+    services.fanout = {
+      enable = true;
+      fanoutDevices = 2;
+      bufferSize = 8192;
+    };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      # mDNS.
-      machine.wait_for_unit("multi-user.target")
+    # mDNS.
+    machine.wait_for_unit("multi-user.target")
 
-      machine.succeed("test -c /dev/fanout0")
-      machine.succeed("test -c /dev/fanout1")
-    '';
-  }
-)
+    machine.succeed("test -c /dev/fanout0")
+    machine.succeed("test -c /dev/fanout1")
+  '';
+}
diff --git a/nixos/tests/fenics.nix b/nixos/tests/fenics.nix
index bf991fed9b0c..ebfff402627f 100644
--- a/nixos/tests/fenics.nix
+++ b/nixos/tests/fenics.nix
@@ -1,53 +1,51 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    fenicsScript = pkgs.writeScript "poisson.py" ''
-      #!/usr/bin/env python
-      from dolfin import *
+let
+  fenicsScript = pkgs.writeScript "poisson.py" ''
+    #!/usr/bin/env python
+    from dolfin import *
 
-      mesh = UnitSquareMesh(4, 4)
-      V = FunctionSpace(mesh, "Lagrange", 1)
+    mesh = UnitSquareMesh(4, 4)
+    V = FunctionSpace(mesh, "Lagrange", 1)
 
-      def boundary(x):
-          return x[0] < DOLFIN_EPS or x[0] > 1.0 - DOLFIN_EPS
+    def boundary(x):
+        return x[0] < DOLFIN_EPS or x[0] > 1.0 - DOLFIN_EPS
 
-      u0 = Constant(0.0)
-      bc = DirichletBC(V, u0, boundary)
+    u0 = Constant(0.0)
+    bc = DirichletBC(V, u0, boundary)
 
-      u = TrialFunction(V)
-      v = TestFunction(V)
-      f = Expression("10*exp(-(pow(x[0] - 0.5, 2) + pow(x[1] - 0.5, 2)) / 0.02)", degree=2)
-      g = Expression("sin(5*x[0])", degree=2)
-      a = inner(grad(u), grad(v))*dx
-      L = f*v*dx + g*v*ds
+    u = TrialFunction(V)
+    v = TestFunction(V)
+    f = Expression("10*exp(-(pow(x[0] - 0.5, 2) + pow(x[1] - 0.5, 2)) / 0.02)", degree=2)
+    g = Expression("sin(5*x[0])", degree=2)
+    a = inner(grad(u), grad(v))*dx
+    L = f*v*dx + g*v*ds
 
-      u = Function(V)
-      solve(a == L, u, bc)
-      print(u)
+    u = Function(V)
+    solve(a == L, u, bc)
+    print(u)
+  '';
+in
+{
+  name = "fenics";
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ ];
+  };
+
+  nodes = {
+    fenicsnode =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [
+          gcc
+          (python3.withPackages (ps: with ps; [ fenics ]))
+        ];
+      };
+  };
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+      fenicsnode.succeed("${fenicsScript}")
     '';
-  in
-  {
-    name = "fenics";
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ ];
-    };
-
-    nodes = {
-      fenicsnode =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = with pkgs; [
-            gcc
-            (python3.withPackages (ps: with ps; [ fenics ]))
-          ];
-        };
-    };
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
-        fenicsnode.succeed("${fenicsScript}")
-      '';
-  }
-)
+}
diff --git a/nixos/tests/ferm.nix b/nixos/tests/ferm.nix
index b0a3a828384b..55781a3b5c05 100644
--- a/nixos/tests/ferm.nix
+++ b/nixos/tests/ferm.nix
@@ -1,98 +1,96 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "ferm";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ mic92 ];
-    };
+{ pkgs, ... }:
+{
+  name = "ferm";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ mic92 ];
+  };
 
-    nodes = {
-      client =
-        { pkgs, ... }:
-        with pkgs.lib;
-        {
-          networking = {
-            dhcpcd.enable = false;
-            interfaces.eth1.ipv6.addresses = mkOverride 0 [
-              {
-                address = "fd00::2";
-                prefixLength = 64;
-              }
-            ];
-            interfaces.eth1.ipv4.addresses = mkOverride 0 [
-              {
-                address = "192.168.1.2";
-                prefixLength = 24;
-              }
-            ];
-          };
+  nodes = {
+    client =
+      { pkgs, ... }:
+      with pkgs.lib;
+      {
+        networking = {
+          dhcpcd.enable = false;
+          interfaces.eth1.ipv6.addresses = mkOverride 0 [
+            {
+              address = "fd00::2";
+              prefixLength = 64;
+            }
+          ];
+          interfaces.eth1.ipv4.addresses = mkOverride 0 [
+            {
+              address = "192.168.1.2";
+              prefixLength = 24;
+            }
+          ];
         };
-      server =
-        { pkgs, ... }:
-        with pkgs.lib;
-        {
-          networking = {
-            dhcpcd.enable = false;
-            useNetworkd = true;
-            useDHCP = false;
-            interfaces.eth1.ipv6.addresses = mkOverride 0 [
-              {
-                address = "fd00::1";
-                prefixLength = 64;
-              }
-            ];
-            interfaces.eth1.ipv4.addresses = mkOverride 0 [
-              {
-                address = "192.168.1.1";
-                prefixLength = 24;
-              }
-            ];
-          };
-
-          services = {
-            ferm.enable = true;
-            ferm.config = ''
-              domain (ip ip6) table filter chain INPUT {
-                interface lo ACCEPT;
-                proto tcp dport 8080 REJECT reject-with tcp-reset;
-              }
-            '';
-            nginx.enable = true;
-            nginx.httpConfig = ''
-              server {
-                listen 80;
-                listen [::]:80;
-                listen 8080;
-                listen [::]:8080;
-
-                location /status { stub_status on; }
-              }
-            '';
-          };
+      };
+    server =
+      { pkgs, ... }:
+      with pkgs.lib;
+      {
+        networking = {
+          dhcpcd.enable = false;
+          useNetworkd = true;
+          useDHCP = false;
+          interfaces.eth1.ipv6.addresses = mkOverride 0 [
+            {
+              address = "fd00::1";
+              prefixLength = 64;
+            }
+          ];
+          interfaces.eth1.ipv4.addresses = mkOverride 0 [
+            {
+              address = "192.168.1.1";
+              prefixLength = 24;
+            }
+          ];
         };
-    };
 
-    testScript = ''
-      start_all()
+        services = {
+          ferm.enable = true;
+          ferm.config = ''
+            domain (ip ip6) table filter chain INPUT {
+              interface lo ACCEPT;
+              proto tcp dport 8080 REJECT reject-with tcp-reset;
+            }
+          '';
+          nginx.enable = true;
+          nginx.httpConfig = ''
+            server {
+              listen 80;
+              listen [::]:80;
+              listen 8080;
+              listen [::]:8080;
 
-      client.systemctl("start network-online.target")
-      server.systemctl("start network-online.target")
-      client.wait_for_unit("network-online.target")
-      server.wait_for_unit("network-online.target")
-      server.wait_for_unit("ferm.service")
-      server.wait_for_unit("nginx.service")
-      server.wait_until_succeeds("ss -ntl | grep -q 80")
+              location /status { stub_status on; }
+            }
+          '';
+        };
+      };
+  };
 
-      with subtest("port 80 is allowed"):
-          client.succeed("curl --fail -g http://192.168.1.1:80/status")
-          client.succeed("curl --fail -g http://[fd00::1]:80/status")
+  testScript = ''
+    start_all()
 
-      with subtest("port 8080 is not allowed"):
-          server.succeed("curl --fail -g http://192.168.1.1:8080/status")
-          server.succeed("curl --fail -g http://[fd00::1]:8080/status")
+    client.systemctl("start network-online.target")
+    server.systemctl("start network-online.target")
+    client.wait_for_unit("network-online.target")
+    server.wait_for_unit("network-online.target")
+    server.wait_for_unit("ferm.service")
+    server.wait_for_unit("nginx.service")
+    server.wait_until_succeeds("ss -ntl | grep -q 80")
 
-          client.fail("curl --fail -g http://192.168.1.1:8080/status")
-          client.fail("curl --fail -g http://[fd00::1]:8080/status")
-    '';
-  }
-)
+    with subtest("port 80 is allowed"):
+        client.succeed("curl --fail -g http://192.168.1.1:80/status")
+        client.succeed("curl --fail -g http://[fd00::1]:80/status")
+
+    with subtest("port 8080 is not allowed"):
+        server.succeed("curl --fail -g http://192.168.1.1:8080/status")
+        server.succeed("curl --fail -g http://[fd00::1]:8080/status")
+
+        client.fail("curl --fail -g http://192.168.1.1:8080/status")
+        client.fail("curl --fail -g http://[fd00::1]:8080/status")
+  '';
+}
diff --git a/nixos/tests/filebrowser.nix b/nixos/tests/filebrowser.nix
new file mode 100644
index 000000000000..52999487c905
--- /dev/null
+++ b/nixos/tests/filebrowser.nix
@@ -0,0 +1,27 @@
+{
+  name = "filebrowser";
+
+  nodes.machine = {
+    services.filebrowser = {
+      enable = true;
+      settings = {
+        address = "localhost";
+        port = 8080;
+        database = "/var/lib/filebrowser/filebrowser.db";
+      };
+    };
+  };
+
+  testScript = ''
+    machine.start()
+
+    machine.wait_for_unit("filebrowser.service")
+    machine.wait_for_open_port(8080)
+
+    machine.succeed("curl --fail http://localhost:8080/")
+
+    machine.succeed("stat /var/lib/filebrowser/filebrowser.db")
+
+    machine.shutdown()
+  '';
+}
diff --git a/nixos/tests/filesender.nix b/nixos/tests/filesender.nix
index 5c4c1a738243..b81b2ab04af3 100644
--- a/nixos/tests/filesender.nix
+++ b/nixos/tests/filesender.nix
@@ -1,148 +1,146 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "filesender";
-    meta = {
-      maintainers = with lib.maintainers; [ nhnn ];
-      broken = pkgs.stdenv.hostPlatform.isAarch64; # selenium.common.exceptions.WebDriverException: Message: Unsupported platform/architecture combination: linux/aarch64
-    };
+{ pkgs, lib, ... }:
+{
+  name = "filesender";
+  meta = {
+    maintainers = with lib.maintainers; [ nhnn ];
+    broken = pkgs.stdenv.hostPlatform.isAarch64; # selenium.common.exceptions.WebDriverException: Message: Unsupported platform/architecture combination: linux/aarch64
+  };
 
-    nodes.filesender =
-      { ... }:
-      let
-        format = pkgs.formats.php { };
-      in
-      {
-        networking.firewall.allowedTCPPorts = [ 80 ];
+  nodes.filesender =
+    { ... }:
+    let
+      format = pkgs.formats.php { };
+    in
+    {
+      networking.firewall.allowedTCPPorts = [ 80 ];
 
-        services.filesender.enable = true;
-        services.filesender.localDomain = "filesender";
-        services.filesender.settings = {
-          auth_sp_saml_authentication_source = "default";
-          auth_sp_saml_uid_attribute = "uid";
-          storage_filesystem_path = "/tmp";
-          site_url = "http://filesender";
-          force_ssl = false;
-          admin = "";
-          admin_email = "admin@localhost";
-          email_reply_to = "noreply@localhost";
+      services.filesender.enable = true;
+      services.filesender.localDomain = "filesender";
+      services.filesender.settings = {
+        auth_sp_saml_authentication_source = "default";
+        auth_sp_saml_uid_attribute = "uid";
+        storage_filesystem_path = "/tmp";
+        site_url = "http://filesender";
+        force_ssl = false;
+        admin = "";
+        admin_email = "admin@localhost";
+        email_reply_to = "noreply@localhost";
+      };
+      services.simplesamlphp.filesender = {
+        settings = {
+          baseurlpath = "http://filesender/saml";
+          "module.enable".exampleauth = true;
         };
-        services.simplesamlphp.filesender = {
-          settings = {
-            baseurlpath = "http://filesender/saml";
-            "module.enable".exampleauth = true;
-          };
-          authSources = {
-            admin = [ "core:AdminPassword" ];
-            default = format.lib.mkMixedArray [ "exampleauth:UserPass" ] {
-              "user:password" = {
-                uid = [ "user" ];
-                cn = [ "user" ];
-                mail = [ "user@nixos.org" ];
-              };
+        authSources = {
+          admin = [ "core:AdminPassword" ];
+          default = format.lib.mkMixedArray [ "exampleauth:UserPass" ] {
+            "user:password" = {
+              uid = [ "user" ];
+              cn = [ "user" ];
+              mail = [ "user@nixos.org" ];
             };
           };
         };
       };
+    };
 
-    nodes.client =
-      {
-        pkgs,
-        nodes,
-        ...
-      }:
-      let
-        filesenderIP = (builtins.head (nodes.filesender.networking.interfaces.eth1.ipv4.addresses)).address;
-      in
-      {
-        networking.hosts.${filesenderIP} = [ "filesender" ];
+  nodes.client =
+    {
+      pkgs,
+      nodes,
+      ...
+    }:
+    let
+      filesenderIP = (builtins.head (nodes.filesender.networking.interfaces.eth1.ipv4.addresses)).address;
+    in
+    {
+      networking.hosts.${filesenderIP} = [ "filesender" ];
 
-        environment.systemPackages =
-          let
-            username = "user";
-            password = "password";
-            browser-test =
-              pkgs.writers.writePython3Bin "browser-test"
-                {
-                  libraries = [ pkgs.python3Packages.selenium ];
-                  flakeIgnore = [
-                    "E124"
-                    "E501"
-                  ];
-                }
-                ''
-                  from selenium.webdriver.common.by import By
-                  from selenium.webdriver import Firefox
-                  from selenium.webdriver.firefox.options import Options
-                  from selenium.webdriver.firefox.firefox_profile import FirefoxProfile
-                  from selenium.webdriver.firefox.service import Service
-                  from selenium.webdriver.support.ui import WebDriverWait
-                  from selenium.webdriver.support import expected_conditions as EC
-                  from subprocess import STDOUT
-                  import string
-                  import random
-                  import logging
-                  import time
-                  selenium_logger = logging.getLogger("selenium")
-                  selenium_logger.setLevel(logging.DEBUG)
-                  selenium_logger.addHandler(logging.StreamHandler())
-                  profile = FirefoxProfile()
-                  profile.set_preference("browser.download.folderList", 2)
-                  profile.set_preference("browser.download.manager.showWhenStarting", False)
-                  profile.set_preference("browser.download.dir", "/tmp/firefox")
-                  profile.set_preference("browser.helperApps.neverAsk.saveToDisk", "text/plain;text/txt")
-                  options = Options()
-                  options.profile = profile
-                  options.add_argument('--headless')
-                  service = Service(log_output=STDOUT)
-                  driver = Firefox(options=options)
-                  driver.set_window_size(1024, 768)
-                  driver.implicitly_wait(30)
-                  driver.get('http://filesender/')
-                  wait = WebDriverWait(driver, 20)
-                  wait.until(EC.title_contains("FileSender"))
-                  driver.find_element(By.ID, "btn_logon").click()
-                  wait.until(EC.title_contains("Enter your username and password"))
-                  driver.find_element(By.ID, 'username').send_keys(
-                      '${username}'
-                  )
-                  driver.find_element(By.ID, 'password').send_keys(
-                      '${password}'
-                  )
-                  driver.find_element(By.ID, "submit_button").click()
-                  wait.until(EC.title_contains("FileSender"))
-                  wait.until(EC.presence_of_element_located((By.ID, "topmenu_logoff")))
-                  test_string = "".join(random.choices(string.ascii_uppercase + string.digits, k=20))
-                  with open("/tmp/test_file.txt", "w") as file:
-                      file.write(test_string)
-                  driver.find_element(By.ID, "files").send_keys("/tmp/test_file.txt")
-                  time.sleep(2)
-                  driver.find_element(By.CSS_SELECTOR, '.start').click()
-                  wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, ".download_link")))
-                  download_link = driver.find_element(By.CSS_SELECTOR, '.download_link > textarea').get_attribute('value').strip()
-                  driver.get(download_link)
-                  wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, ".download")))
-                  driver.find_element(By.CSS_SELECTOR, '.download').click()
-                  wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, ".ui-dialog-buttonset > button:nth-child(2)")))
-                  driver.find_element(By.CSS_SELECTOR, ".ui-dialog-buttonset > button:nth-child(2)").click()
-                  driver.close()
-                  driver.quit()
-                '';
-          in
-          [
-            pkgs.firefox-unwrapped
-            pkgs.geckodriver
-            browser-test
-          ];
-      };
+      environment.systemPackages =
+        let
+          username = "user";
+          password = "password";
+          browser-test =
+            pkgs.writers.writePython3Bin "browser-test"
+              {
+                libraries = [ pkgs.python3Packages.selenium ];
+                flakeIgnore = [
+                  "E124"
+                  "E501"
+                ];
+              }
+              ''
+                from selenium.webdriver.common.by import By
+                from selenium.webdriver import Firefox
+                from selenium.webdriver.firefox.options import Options
+                from selenium.webdriver.firefox.firefox_profile import FirefoxProfile
+                from selenium.webdriver.firefox.service import Service
+                from selenium.webdriver.support.ui import WebDriverWait
+                from selenium.webdriver.support import expected_conditions as EC
+                from subprocess import STDOUT
+                import string
+                import random
+                import logging
+                import time
+                selenium_logger = logging.getLogger("selenium")
+                selenium_logger.setLevel(logging.DEBUG)
+                selenium_logger.addHandler(logging.StreamHandler())
+                profile = FirefoxProfile()
+                profile.set_preference("browser.download.folderList", 2)
+                profile.set_preference("browser.download.manager.showWhenStarting", False)
+                profile.set_preference("browser.download.dir", "/tmp/firefox")
+                profile.set_preference("browser.helperApps.neverAsk.saveToDisk", "text/plain;text/txt")
+                options = Options()
+                options.profile = profile
+                options.add_argument('--headless')
+                service = Service(log_output=STDOUT)
+                driver = Firefox(options=options)
+                driver.set_window_size(1024, 768)
+                driver.implicitly_wait(30)
+                driver.get('http://filesender/')
+                wait = WebDriverWait(driver, 20)
+                wait.until(EC.title_contains("FileSender"))
+                driver.find_element(By.ID, "btn_logon").click()
+                wait.until(EC.title_contains("Enter your username and password"))
+                driver.find_element(By.ID, 'username').send_keys(
+                    '${username}'
+                )
+                driver.find_element(By.ID, 'password').send_keys(
+                    '${password}'
+                )
+                driver.find_element(By.ID, "submit_button").click()
+                wait.until(EC.title_contains("FileSender"))
+                wait.until(EC.presence_of_element_located((By.ID, "topmenu_logoff")))
+                test_string = "".join(random.choices(string.ascii_uppercase + string.digits, k=20))
+                with open("/tmp/test_file.txt", "w") as file:
+                    file.write(test_string)
+                driver.find_element(By.ID, "files").send_keys("/tmp/test_file.txt")
+                time.sleep(2)
+                driver.find_element(By.CSS_SELECTOR, '.start').click()
+                wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, ".download_link")))
+                download_link = driver.find_element(By.CSS_SELECTOR, '.download_link > textarea').get_attribute('value').strip()
+                driver.get(download_link)
+                wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, ".download")))
+                driver.find_element(By.CSS_SELECTOR, '.download').click()
+                wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, ".ui-dialog-buttonset > button:nth-child(2)")))
+                driver.find_element(By.CSS_SELECTOR, ".ui-dialog-buttonset > button:nth-child(2)").click()
+                driver.close()
+                driver.quit()
+              '';
+        in
+        [
+          pkgs.firefox-unwrapped
+          pkgs.geckodriver
+          browser-test
+        ];
+    };
 
-    testScript = ''
-      start_all()
-      filesender.wait_for_file("/run/phpfpm/filesender.sock")
-      filesender.wait_for_open_port(80)
-      if "If you have received an invitation to access this site as a guest" not in client.wait_until_succeeds("curl -sS -f http://filesender"):
-        raise Exception("filesender returned invalid html")
-      client.succeed("browser-test")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    filesender.wait_for_file("/run/phpfpm/filesender.sock")
+    filesender.wait_for_open_port(80)
+    if "If you have received an invitation to access this site as a guest" not in client.wait_until_succeeds("curl -sS -f http://filesender"):
+      raise Exception("filesender returned invalid html")
+    client.succeed("browser-test")
+  '';
+}
diff --git a/nixos/tests/firefoxpwa.nix b/nixos/tests/firefoxpwa.nix
index 546534d1f05e..0e664dfc6e49 100644
--- a/nixos/tests/firefoxpwa.nix
+++ b/nixos/tests/firefoxpwa.nix
@@ -1,41 +1,39 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "firefoxpwa";
-    meta.maintainers = with lib.maintainers; [ camillemndn ];
+{
+  name = "firefoxpwa";
+  meta.maintainers = with lib.maintainers; [ camillemndn ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ./common/x11.nix ];
-        environment.systemPackages = with pkgs; [
-          firefoxpwa
-          jq
-        ];
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/x11.nix ];
+      environment.systemPackages = with pkgs; [
+        firefoxpwa
+        jq
+      ];
 
-        programs.firefox = {
-          enable = true;
-          nativeMessagingHosts.packages = [ pkgs.firefoxpwa ];
-        };
-
-        services.jellyfin.enable = true;
+      programs.firefox = {
+        enable = true;
+        nativeMessagingHosts.packages = [ pkgs.firefoxpwa ];
       };
 
-    enableOCR = true;
+      services.jellyfin.enable = true;
+    };
 
-    testScript = ''
-      machine.start()
+  enableOCR = true;
 
-      with subtest("Install a progressive web app"):
-          machine.wait_for_unit("jellyfin.service")
-          machine.wait_for_open_port(8096)
-          machine.succeed("firefoxpwa site install http://localhost:8096/web/manifest.json >&2")
+  testScript = ''
+    machine.start()
 
-      with subtest("Launch the progressive web app"):
-          machine.succeed("firefoxpwa site launch $(jq -r < ~/.local/share/firefoxpwa/config.json '.sites | keys[0]') >&2")
-          machine.wait_for_window("Jellyfin")
-          machine.wait_for_text("Jellyfin")
-    '';
-  }
-)
+    with subtest("Install a progressive web app"):
+        machine.wait_for_unit("jellyfin.service")
+        machine.wait_for_open_port(8096)
+        machine.succeed("firefoxpwa site install http://localhost:8096/web/manifest.json >&2")
+
+    with subtest("Launch the progressive web app"):
+        machine.succeed("firefoxpwa site launch $(jq -r < ~/.local/share/firefoxpwa/config.json '.sites | keys[0]') >&2")
+        machine.wait_for_window("Jellyfin")
+        machine.wait_for_text("Jellyfin")
+  '';
+}
diff --git a/nixos/tests/firejail.nix b/nixos/tests/firejail.nix
index 24ec4dbe2a7e..6ac163ba0678 100644
--- a/nixos/tests/firejail.nix
+++ b/nixos/tests/firejail.nix
@@ -1,95 +1,93 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "firejail";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ sgo ];
-    };
+{ pkgs, ... }:
+{
+  name = "firejail";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ sgo ];
+  };
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ./common/user-account.nix ];
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ./common/user-account.nix ];
 
-        programs.firejail = {
-          enable = true;
-          wrappedBinaries = {
-            bash-jailed = "${pkgs.bash}/bin/bash";
-            bash-jailed2 = {
-              executable = "${pkgs.bash}/bin/bash";
-              extraArgs = [ "--private=~/firejail-home" ];
-            };
+      programs.firejail = {
+        enable = true;
+        wrappedBinaries = {
+          bash-jailed = "${pkgs.bash}/bin/bash";
+          bash-jailed2 = {
+            executable = "${pkgs.bash}/bin/bash";
+            extraArgs = [ "--private=~/firejail-home" ];
           };
         };
-
-        systemd.services.setupFirejailTest = {
-          wantedBy = [ "multi-user.target" ];
-          before = [ "multi-user.target" ];
-
-          environment = {
-            HOME = "/home/alice";
-          };
-
-          unitConfig = {
-            type = "oneshot";
-            RemainAfterExit = true;
-            user = "alice";
-          };
-
-          script = ''
-            cd $HOME
-
-            mkdir .password-store && echo s3cret > .password-store/secret
-            mkdir my-secrets && echo s3cret > my-secrets/secret
-
-            echo publ1c > public
-
-            mkdir -p .config/firejail
-            echo 'blacklist ''${HOME}/my-secrets' > .config/firejail/globals.local
-          '';
-        };
       };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("multi-user.target")
+      systemd.services.setupFirejailTest = {
+        wantedBy = [ "multi-user.target" ];
+        before = [ "multi-user.target" ];
 
-      # Test path acl with wrapper
-      machine.succeed("sudo -u alice bash-jailed -c 'cat ~/public' | grep -q publ1c")
-      machine.fail(
-          "sudo -u alice bash-jailed -c 'cat ~/.password-store/secret' | grep -q s3cret"
-      )
-      machine.fail("sudo -u alice bash-jailed -c 'cat ~/my-secrets/secret' | grep -q s3cret")
+        environment = {
+          HOME = "/home/alice";
+        };
 
-      # Test extraArgs
-      machine.succeed("sudo -u alice mkdir /home/alice/firejail-home")
-      machine.succeed("sudo -u alice bash-jailed2 -c 'echo test > /home/alice/foo'")
-      machine.fail("sudo -u alice cat /home/alice/foo")
-      machine.succeed("sudo -u alice cat /home/alice/firejail-home/foo | grep test")
+        unitConfig = {
+          type = "oneshot";
+          RemainAfterExit = true;
+          user = "alice";
+        };
 
-      # Test path acl with firejail executable
-      machine.succeed("sudo -u alice firejail -- bash -c 'cat ~/public' | grep -q publ1c")
-      machine.fail(
-          "sudo -u alice firejail -- bash -c 'cat ~/.password-store/secret' | grep -q s3cret"
-      )
-      machine.fail(
-          "sudo -u alice firejail -- bash -c 'cat ~/my-secrets/secret' | grep -q s3cret"
-      )
+        script = ''
+          cd $HOME
 
-      # Disabling profiles
-      machine.succeed(
-          "sudo -u alice bash -c 'firejail --noprofile -- cat ~/.password-store/secret' | grep -q s3cret"
-      )
+          mkdir .password-store && echo s3cret > .password-store/secret
+          mkdir my-secrets && echo s3cret > my-secrets/secret
 
-      # CVE-2020-17367
-      machine.fail(
-          "sudo -u alice firejail --private-tmp id --output=/tmp/vuln1 && cat /tmp/vuln1"
-      )
+          echo publ1c > public
 
-      # CVE-2020-17368
-      machine.fail(
-          "sudo -u alice firejail --private-tmp --output=/tmp/foo 'bash -c $(id>/tmp/vuln2;echo id)' && cat /tmp/vuln2"
-      )
-    '';
-  }
-)
+          mkdir -p .config/firejail
+          echo 'blacklist ''${HOME}/my-secrets' > .config/firejail/globals.local
+        '';
+      };
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+
+    # Test path acl with wrapper
+    machine.succeed("sudo -u alice bash-jailed -c 'cat ~/public' | grep -q publ1c")
+    machine.fail(
+        "sudo -u alice bash-jailed -c 'cat ~/.password-store/secret' | grep -q s3cret"
+    )
+    machine.fail("sudo -u alice bash-jailed -c 'cat ~/my-secrets/secret' | grep -q s3cret")
+
+    # Test extraArgs
+    machine.succeed("sudo -u alice mkdir /home/alice/firejail-home")
+    machine.succeed("sudo -u alice bash-jailed2 -c 'echo test > /home/alice/foo'")
+    machine.fail("sudo -u alice cat /home/alice/foo")
+    machine.succeed("sudo -u alice cat /home/alice/firejail-home/foo | grep test")
+
+    # Test path acl with firejail executable
+    machine.succeed("sudo -u alice firejail -- bash -c 'cat ~/public' | grep -q publ1c")
+    machine.fail(
+        "sudo -u alice firejail -- bash -c 'cat ~/.password-store/secret' | grep -q s3cret"
+    )
+    machine.fail(
+        "sudo -u alice firejail -- bash -c 'cat ~/my-secrets/secret' | grep -q s3cret"
+    )
+
+    # Disabling profiles
+    machine.succeed(
+        "sudo -u alice bash -c 'firejail --noprofile -- cat ~/.password-store/secret' | grep -q s3cret"
+    )
+
+    # CVE-2020-17367
+    machine.fail(
+        "sudo -u alice firejail --private-tmp id --output=/tmp/vuln1 && cat /tmp/vuln1"
+    )
+
+    # CVE-2020-17368
+    machine.fail(
+        "sudo -u alice firejail --private-tmp --output=/tmp/foo 'bash -c $(id>/tmp/vuln2;echo id)' && cat /tmp/vuln2"
+    )
+  '';
+}
diff --git a/nixos/tests/firezone/firezone.nix b/nixos/tests/firezone/firezone.nix
index 10d89778a4c6..82b05b47086c 100644
--- a/nixos/tests/firezone/firezone.nix
+++ b/nixos/tests/firezone/firezone.nix
@@ -1,349 +1,347 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  let
-    certs = import ../common/acme/server/snakeoil-certs.nix;
-    domain = certs.domain;
-  in
-  {
-    name = "firezone";
-    meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
+{ pkgs, ... }:
+let
+  certs = import ../common/acme/server/snakeoil-certs.nix;
+  domain = certs.domain;
+in
+{
+  name = "firezone";
+  meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
 
-    nodes = {
-      server =
-        {
-          config,
-          lib,
-          pkgs,
-          ...
-        }:
-        {
-          security.pki.certificateFiles = [ certs.ca.cert ];
+  nodes = {
+    server =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        security.pki.certificateFiles = [ certs.ca.cert ];
 
-          networking.extraHosts = ''
-            ${config.networking.primaryIPAddress} ${domain}
-            ${config.networking.primaryIPv6Address} ${domain}
-          '';
+        networking.extraHosts = ''
+          ${config.networking.primaryIPAddress} ${domain}
+          ${config.networking.primaryIPv6Address} ${domain}
+        '';
 
-          networking.firewall.allowedTCPPorts = [
-            80
-            443
-          ];
+        networking.firewall.allowedTCPPorts = [
+          80
+          443
+        ];
 
-          services.nginx = {
-            enable = true;
-            virtualHosts.${domain} = {
-              sslCertificate = certs.${domain}.cert;
-              sslCertificateKey = certs.${domain}.key;
-            };
+        services.nginx = {
+          enable = true;
+          virtualHosts.${domain} = {
+            sslCertificate = certs.${domain}.cert;
+            sslCertificateKey = certs.${domain}.key;
+          };
+        };
+
+        services.firezone.server = {
+          enable = true;
+          enableLocalDB = true;
+          nginx.enable = true;
+
+          # Doesn't need to work for this test, but needs to be configured
+          # otherwise the server will not start.
+          smtp = {
+            from = "firezone@example.com";
+            host = "mail.localhost";
+            port = 465;
+            implicitTls = true;
+            username = "firezone@example.com";
+            passwordFile = pkgs.writeText "tmpmailpasswd" "supermailpassword";
           };
 
-          services.firezone.server = {
+          provision = {
             enable = true;
-            enableLocalDB = true;
-            nginx.enable = true;
-
-            # Doesn't need to work for this test, but needs to be configured
-            # otherwise the server will not start.
-            smtp = {
-              from = "firezone@example.com";
-              host = "mail.localhost";
-              port = 465;
-              implicitTls = true;
-              username = "firezone@example.com";
-              passwordFile = pkgs.writeText "tmpmailpasswd" "supermailpassword";
-            };
-
-            provision = {
-              enable = true;
-              accounts.main = {
-                name = "My Account";
-                relayGroups.my-relays.name = "Relays";
-                gatewayGroups.site.name = "Site";
-                actors = {
-                  admin = {
-                    type = "account_admin_user";
-                    name = "Admin";
-                    email = "admin@example.com";
-                  };
-                  client = {
-                    type = "service_account";
-                    name = "A client";
-                    email = "client@example.com";
-                  };
+            accounts.main = {
+              name = "My Account";
+              relayGroups.my-relays.name = "Relays";
+              gatewayGroups.site.name = "Site";
+              actors = {
+                admin = {
+                  type = "account_admin_user";
+                  name = "Admin";
+                  email = "admin@example.com";
                 };
-                resources.res1 = {
-                  type = "dns";
-                  name = "Dns Resource";
-                  address = "resource.example.com";
-                  gatewayGroups = [ "site" ];
-                  filters = [
-                    { protocol = "icmp"; }
-                    {
-                      protocol = "tcp";
-                      ports = [ 80 ];
-                    }
-                  ];
-                };
-                resources.res2 = {
-                  type = "ip";
-                  name = "Ip Resource";
-                  address = "172.20.2.1";
-                  gatewayGroups = [ "site" ];
-                };
-                resources.res3 = {
-                  type = "cidr";
-                  name = "Cidr Resource";
-                  address = "172.20.1.0/24";
-                  gatewayGroups = [ "site" ];
-                };
-                policies.pol1 = {
-                  description = "Allow anyone res1 access";
-                  group = "everyone";
-                  resource = "res1";
-                };
-                policies.pol2 = {
-                  description = "Allow anyone res2 access";
-                  group = "everyone";
-                  resource = "res2";
-                };
-                policies.pol3 = {
-                  description = "Allow anyone res3 access";
-                  group = "everyone";
-                  resource = "res3";
+                client = {
+                  type = "service_account";
+                  name = "A client";
+                  email = "client@example.com";
                 };
               };
+              resources.res1 = {
+                type = "dns";
+                name = "Dns Resource";
+                address = "resource.example.com";
+                gatewayGroups = [ "site" ];
+                filters = [
+                  { protocol = "icmp"; }
+                  {
+                    protocol = "tcp";
+                    ports = [ 80 ];
+                  }
+                ];
+              };
+              resources.res2 = {
+                type = "ip";
+                name = "Ip Resource";
+                address = "172.20.2.1";
+                gatewayGroups = [ "site" ];
+              };
+              resources.res3 = {
+                type = "cidr";
+                name = "Cidr Resource";
+                address = "172.20.1.0/24";
+                gatewayGroups = [ "site" ];
+              };
+              policies.pol1 = {
+                description = "Allow anyone res1 access";
+                group = "everyone";
+                resource = "res1";
+              };
+              policies.pol2 = {
+                description = "Allow anyone res2 access";
+                group = "everyone";
+                resource = "res2";
+              };
+              policies.pol3 = {
+                description = "Allow anyone res3 access";
+                group = "everyone";
+                resource = "res3";
+              };
             };
-
-            api.externalUrl = "https://${domain}/api/";
-            web.externalUrl = "https://${domain}/";
           };
 
-          systemd.services.firezone-server-domain.postStart = lib.mkAfter ''
-            ${lib.getExe config.services.firezone.server.domain.package} rpc 'Code.eval_file("${./create-tokens.exs}")'
-          '';
+          api.externalUrl = "https://${domain}/api/";
+          web.externalUrl = "https://${domain}/";
         };
 
-      relay =
-        {
-          nodes,
-          config,
-          lib,
-          ...
-        }:
-        {
-          security.pki.certificateFiles = [ certs.ca.cert ];
-          networking.extraHosts = ''
-            ${nodes.server.networking.primaryIPAddress} ${domain}
-            ${nodes.server.networking.primaryIPv6Address} ${domain}
-          '';
+        systemd.services.firezone-server-domain.postStart = lib.mkAfter ''
+          ${lib.getExe config.services.firezone.server.domain.package} rpc 'Code.eval_file("${./create-tokens.exs}")'
+        '';
+      };
 
-          services.firezone.relay = {
-            enable = true;
-            logLevel = "debug";
-            name = "test-relay";
-            apiUrl = "wss://${domain}/api/";
-            tokenFile = "/tmp/shared/relay_token.txt";
-            publicIpv4 = config.networking.primaryIPAddress;
-            publicIpv6 = config.networking.primaryIPv6Address;
-            openFirewall = true;
+    relay =
+      {
+        nodes,
+        config,
+        lib,
+        ...
+      }:
+      {
+        security.pki.certificateFiles = [ certs.ca.cert ];
+        networking.extraHosts = ''
+          ${nodes.server.networking.primaryIPAddress} ${domain}
+          ${nodes.server.networking.primaryIPv6Address} ${domain}
+        '';
+
+        services.firezone.relay = {
+          enable = true;
+          logLevel = "debug";
+          name = "test-relay";
+          apiUrl = "wss://${domain}/api/";
+          tokenFile = "/tmp/shared/relay_token.txt";
+          publicIpv4 = config.networking.primaryIPAddress;
+          publicIpv6 = config.networking.primaryIPv6Address;
+          openFirewall = true;
+        };
+
+        # Don't auto-start so we can wait until the token was provisioned
+        systemd.services.firezone-relay.wantedBy = lib.mkForce [ ];
+      };
+
+    # A resource that is only connected to the gateway,
+    # allowing us to confirm the VPN works
+    resource = {
+      virtualisation.vlans = [
+        1
+        2
+      ];
+
+      networking.interfaces.eth1.ipv4.addresses = [
+        {
+          address = "172.20.1.1";
+          prefixLength = 24;
+        }
+      ];
+
+      networking.interfaces.eth2.ipv4.addresses = [
+        {
+          address = "172.20.2.1";
+          prefixLength = 24;
+        }
+      ];
+
+      networking.firewall.allowedTCPPorts = [
+        80
+      ];
+
+      services.nginx = {
+        enable = true;
+        virtualHosts = {
+          "localhost" = {
+            default = true;
+            locations."/".extraConfig = ''
+              return 200 'greetings from the resource';
+              add_header Content-Type text/plain;
+            '';
           };
-
-          # Don't auto-start so we can wait until the token was provisioned
-          systemd.services.firezone-relay.wantedBy = lib.mkForce [ ];
         };
+      };
+    };
 
-      # A resource that is only connected to the gateway,
-      # allowing us to confirm the VPN works
-      resource = {
+    gateway =
+      {
+        nodes,
+        lib,
+        ...
+      }:
+      {
         virtualisation.vlans = [
           1
           2
         ];
 
-        networking.interfaces.eth1.ipv4.addresses = [
-          {
-            address = "172.20.1.1";
-            prefixLength = 24;
-          }
-        ];
-
-        networking.interfaces.eth2.ipv4.addresses = [
-          {
-            address = "172.20.2.1";
-            prefixLength = 24;
-          }
-        ];
-
-        networking.firewall.allowedTCPPorts = [
-          80
-        ];
-
-        services.nginx = {
-          enable = true;
-          virtualHosts = {
-            "localhost" = {
-              default = true;
-              locations."/".extraConfig = ''
-                return 200 'greetings from the resource';
-                add_header Content-Type text/plain;
-              '';
-            };
-          };
-        };
-      };
-
-      gateway =
-        {
-          nodes,
-          lib,
-          ...
-        }:
-        {
-          virtualisation.vlans = [
-            1
-            2
+        networking = {
+          interfaces.eth1.ipv4.addresses = [
+            {
+              address = "172.20.1.2";
+              prefixLength = 24;
+            }
           ];
 
-          networking = {
-            interfaces.eth1.ipv4.addresses = [
-              {
-                address = "172.20.1.2";
-                prefixLength = 24;
-              }
-            ];
+          interfaces.eth2.ipv4.addresses = [
+            {
+              address = "172.20.2.2";
+              prefixLength = 24;
+            }
+          ];
 
-            interfaces.eth2.ipv4.addresses = [
-              {
-                address = "172.20.2.2";
-                prefixLength = 24;
-              }
-            ];
+          firewall.enable = false;
+          nftables.enable = true;
+          nftables.tables."filter".family = "inet";
+          nftables.tables."filter".content = ''
+            chain incoming {
+              type filter hook input priority 0; policy accept;
+            }
 
-            firewall.enable = false;
-            nftables.enable = true;
-            nftables.tables."filter".family = "inet";
-            nftables.tables."filter".content = ''
-              chain incoming {
-                type filter hook input priority 0; policy accept;
-              }
+            chain postrouting {
+              type nat hook postrouting priority srcnat; policy accept;
+              meta protocol ip iifname "tun-firezone" oifname { "eth1", "eth2" } masquerade random
+            }
 
-              chain postrouting {
-                type nat hook postrouting priority srcnat; policy accept;
-                meta protocol ip iifname "tun-firezone" oifname { "eth1", "eth2" } masquerade random
-              }
+            chain forward {
+              type filter hook forward priority 0; policy drop;
+              iifname "tun-firezone" accept
+              oifname "tun-firezone" accept
+            }
 
-              chain forward {
-                type filter hook forward priority 0; policy drop;
-                iifname "tun-firezone" accept
-                oifname "tun-firezone" accept
-              }
-
-              chain output {
-                type filter hook output priority 0; policy accept;
-              }
-            '';
-          };
-
-          boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
-          # boot.kernel.sysctl."net.ipv4.conf.all.src_valid_mark" = "1";
-          boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1";
-          boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1";
-
-          security.pki.certificateFiles = [ certs.ca.cert ];
-          networking.extraHosts = ''
-            ${nodes.server.networking.primaryIPAddress} ${domain}
-            ${nodes.server.networking.primaryIPv6Address} ${domain}
-            172.20.1.1 resource.example.com
+            chain output {
+              type filter hook output priority 0; policy accept;
+            }
           '';
-
-          services.firezone.gateway = {
-            enable = true;
-            logLevel = "debug";
-            name = "test-gateway";
-            apiUrl = "wss://${domain}/api/";
-            tokenFile = "/tmp/shared/gateway_token.txt";
-          };
-
-          # Don't auto-start so we can wait until the token was provisioned
-          systemd.services.firezone-gateway.wantedBy = lib.mkForce [ ];
         };
 
-      client =
-        {
-          nodes,
-          lib,
-          ...
-        }:
-        {
-          security.pki.certificateFiles = [ certs.ca.cert ];
-          networking.useNetworkd = true;
-          networking.extraHosts = ''
-            ${nodes.server.networking.primaryIPAddress} ${domain}
-            ${nodes.server.networking.primaryIPv6Address} ${domain}
-          '';
+        boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
+        # boot.kernel.sysctl."net.ipv4.conf.all.src_valid_mark" = "1";
+        boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1";
+        boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1";
 
-          services.firezone.headless-client = {
-            enable = true;
-            logLevel = "debug";
-            name = "test-client-somebody";
-            apiUrl = "wss://${domain}/api/";
-            tokenFile = "/tmp/shared/client_token.txt";
-          };
+        security.pki.certificateFiles = [ certs.ca.cert ];
+        networking.extraHosts = ''
+          ${nodes.server.networking.primaryIPAddress} ${domain}
+          ${nodes.server.networking.primaryIPv6Address} ${domain}
+          172.20.1.1 resource.example.com
+        '';
 
-          # Don't auto-start so we can wait until the token was provisioned
-          systemd.services.firezone-headless-client.wantedBy = lib.mkForce [ ];
+        services.firezone.gateway = {
+          enable = true;
+          logLevel = "debug";
+          name = "test-gateway";
+          apiUrl = "wss://${domain}/api/";
+          tokenFile = "/tmp/shared/gateway_token.txt";
         };
-    };
 
-    testScript =
-      { ... }:
-      ''
-        start_all()
+        # Don't auto-start so we can wait until the token was provisioned
+        systemd.services.firezone-gateway.wantedBy = lib.mkForce [ ];
+      };
 
-        with subtest("Start server"):
-            server.wait_for_unit("firezone.target")
-            server.wait_until_succeeds("curl -Lsf https://${domain} | grep 'Welcome to Firezone'")
-            server.wait_until_succeeds("curl -Ls https://${domain}/api | grep 'Not Found'")
+    client =
+      {
+        nodes,
+        lib,
+        ...
+      }:
+      {
+        security.pki.certificateFiles = [ certs.ca.cert ];
+        networking.useNetworkd = true;
+        networking.extraHosts = ''
+          ${nodes.server.networking.primaryIPAddress} ${domain}
+          ${nodes.server.networking.primaryIPv6Address} ${domain}
+        '';
 
-            # Wait for tokens and copy them to shared folder
-            server.wait_for_file("/var/lib/private/firezone/relay_token.txt")
-            server.wait_for_file("/var/lib/private/firezone/gateway_token.txt")
-            server.wait_for_file("/var/lib/private/firezone/client_token.txt")
-            server.succeed("cp /var/lib/private/firezone/*_token.txt /tmp/shared")
+        services.firezone.headless-client = {
+          enable = true;
+          logLevel = "debug";
+          name = "test-client-somebody";
+          apiUrl = "wss://${domain}/api/";
+          tokenFile = "/tmp/shared/client_token.txt";
+        };
 
-        with subtest("Connect relay"):
-            relay.succeed("systemctl start firezone-relay")
-            relay.wait_for_unit("firezone-relay.service")
-            relay.wait_until_succeeds("journalctl --since -2m --unit firezone-relay.service --grep 'Connected to portal.*${domain}'", timeout=30)
+        # Don't auto-start so we can wait until the token was provisioned
+        systemd.services.firezone-headless-client.wantedBy = lib.mkForce [ ];
+      };
+  };
 
-        with subtest("Connect gateway"):
-            gateway.succeed("systemctl start firezone-gateway")
-            gateway.wait_for_unit("firezone-gateway.service")
-            gateway.wait_until_succeeds("journalctl --since -2m --unit firezone-gateway.service --grep 'Connected to portal.*${domain}'", timeout=30)
-            relay.wait_until_succeeds("journalctl --since -2m --unit firezone-relay.service --grep 'Created allocation.*IPv4'", timeout=30)
-            relay.wait_until_succeeds("journalctl --since -2m --unit firezone-relay.service --grep 'Created allocation.*IPv6'", timeout=30)
+  testScript =
+    { ... }:
+    ''
+      start_all()
 
-            # Assert both relay ips are known
-            gateway.wait_until_succeeds("journalctl --since -2m --unit firezone-gateway.service --grep 'Updated allocation.*relay_ip4.*Some.*relay_ip6.*Some'", timeout=30)
+      with subtest("Start server"):
+          server.wait_for_unit("firezone.target")
+          server.wait_until_succeeds("curl -Lsf https://${domain} | grep 'Welcome to Firezone'")
+          server.wait_until_succeeds("curl -Ls https://${domain}/api | grep 'Not Found'")
 
-        with subtest("Connect headless-client"):
-            client.succeed("systemctl start firezone-headless-client")
-            client.wait_for_unit("firezone-headless-client.service")
-            client.wait_until_succeeds("journalctl --since -2m --unit firezone-headless-client.service --grep 'Connected to portal.*${domain}'", timeout=30)
-            client.wait_until_succeeds("journalctl --since -2m --unit firezone-headless-client.service --grep 'Tunnel ready'", timeout=30)
+          # Wait for tokens and copy them to shared folder
+          server.wait_for_file("/var/lib/private/firezone/relay_token.txt")
+          server.wait_for_file("/var/lib/private/firezone/gateway_token.txt")
+          server.wait_for_file("/var/lib/private/firezone/client_token.txt")
+          server.succeed("cp /var/lib/private/firezone/*_token.txt /tmp/shared")
 
-        with subtest("Check DNS based access"):
-            # Check that we can access the resource through the VPN via DNS
-            client.wait_until_succeeds("curl -4 -Lsf http://resource.example.com | grep 'greetings from the resource'")
-            client.wait_until_succeeds("curl -6 -Lsf http://resource.example.com | grep 'greetings from the resource'")
+      with subtest("Connect relay"):
+          relay.succeed("systemctl start firezone-relay")
+          relay.wait_for_unit("firezone-relay.service")
+          relay.wait_until_succeeds("journalctl --since -2m --unit firezone-relay.service --grep 'Connected to portal.*${domain}'", timeout=30)
 
-        with subtest("Check CIDR based access"):
-            # Check that we can access the resource through the VPN via CIDR
-            client.wait_until_succeeds("ping -c1 -W1 172.20.1.1")
+      with subtest("Connect gateway"):
+          gateway.succeed("systemctl start firezone-gateway")
+          gateway.wait_for_unit("firezone-gateway.service")
+          gateway.wait_until_succeeds("journalctl --since -2m --unit firezone-gateway.service --grep 'Connected to portal.*${domain}'", timeout=30)
+          relay.wait_until_succeeds("journalctl --since -2m --unit firezone-relay.service --grep 'Created allocation.*IPv4'", timeout=30)
+          relay.wait_until_succeeds("journalctl --since -2m --unit firezone-relay.service --grep 'Created allocation.*IPv6'", timeout=30)
 
-        with subtest("Check IP based access"):
-            # Check that we can access the resource through the VPN via IP
-            client.wait_until_succeeds("ping -c1 -W1 172.20.2.1")
-      '';
-  }
-)
+          # Assert both relay ips are known
+          gateway.wait_until_succeeds("journalctl --since -2m --unit firezone-gateway.service --grep 'Updated allocation.*relay_ip4.*Some.*relay_ip6.*Some'", timeout=30)
+
+      with subtest("Connect headless-client"):
+          client.succeed("systemctl start firezone-headless-client")
+          client.wait_for_unit("firezone-headless-client.service")
+          client.wait_until_succeeds("journalctl --since -2m --unit firezone-headless-client.service --grep 'Connected to portal.*${domain}'", timeout=30)
+          client.wait_until_succeeds("journalctl --since -2m --unit firezone-headless-client.service --grep 'Tunnel ready'", timeout=30)
+
+      with subtest("Check DNS based access"):
+          # Check that we can access the resource through the VPN via DNS
+          client.wait_until_succeeds("curl -4 -Lsf http://resource.example.com | grep 'greetings from the resource'")
+          client.wait_until_succeeds("curl -6 -Lsf http://resource.example.com | grep 'greetings from the resource'")
+
+      with subtest("Check CIDR based access"):
+          # Check that we can access the resource through the VPN via CIDR
+          client.wait_until_succeeds("ping -c1 -W1 172.20.1.1")
+
+      with subtest("Check IP based access"):
+          # Check that we can access the resource through the VPN via IP
+          client.wait_until_succeeds("ping -c1 -W1 172.20.2.1")
+    '';
+}
diff --git a/nixos/tests/flaresolverr.nix b/nixos/tests/flaresolverr.nix
index 0cec7adf6d6b..dc92e03a0a60 100644
--- a/nixos/tests/flaresolverr.nix
+++ b/nixos/tests/flaresolverr.nix
@@ -1,22 +1,20 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "flaresolverr";
-    meta.maintainers = with lib.maintainers; [ paveloom ];
+{ lib, ... }:
+{
+  name = "flaresolverr";
+  meta.maintainers = with lib.maintainers; [ paveloom ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.flaresolverr = {
-          enable = true;
-          port = 8888;
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.flaresolverr = {
+        enable = true;
+        port = 8888;
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("flaresolverr.service")
-      machine.wait_for_open_port(8888)
-      machine.succeed("curl --fail http://localhost:8888/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("flaresolverr.service")
+    machine.wait_for_open_port(8888)
+    machine.succeed("curl --fail http://localhost:8888/")
+  '';
+}
diff --git a/nixos/tests/flood.nix b/nixos/tests/flood.nix
index ca3ef1d919a5..c474f5efeefb 100644
--- a/nixos/tests/flood.nix
+++ b/nixos/tests/flood.nix
@@ -1,32 +1,30 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    port = 3001;
-  in
-  {
-    name = "flood";
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ thiagokokada ];
+{ pkgs, ... }:
+let
+  port = 3001;
+in
+{
+  name = "flood";
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ thiagokokada ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.flood = {
+        inherit port;
+        enable = true;
+        openFirewall = true;
+        extraArgs = [ "--baseuri=/" ];
+      };
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.flood = {
-          inherit port;
-          enable = true;
-          openFirewall = true;
-          extraArgs = [ "--baseuri=/" ];
-        };
-      };
+  testScript = # python
+    ''
+      machine.start()
+      machine.wait_for_unit("flood.service")
+      machine.wait_for_open_port(${toString port})
 
-    testScript = # python
-      ''
-        machine.start()
-        machine.wait_for_unit("flood.service")
-        machine.wait_for_open_port(${toString port})
-
-        machine.succeed("curl --fail http://localhost:${toString port}")
-      '';
-  }
-)
+      machine.succeed("curl --fail http://localhost:${toString port}")
+    '';
+}
diff --git a/nixos/tests/fluentd.nix b/nixos/tests/fluentd.nix
index aa56db49dc53..8f4fb6e37f0e 100644
--- a/nixos/tests/fluentd.nix
+++ b/nixos/tests/fluentd.nix
@@ -1,58 +1,56 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "fluentd";
+{ pkgs, lib, ... }:
+{
+  name = "fluentd";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.fluentd = {
-          enable = true;
-          config = ''
-            <source>
-              @type http
-              port 9880
-            </source>
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.fluentd = {
+        enable = true;
+        config = ''
+          <source>
+            @type http
+            port 9880
+          </source>
 
-            <match **>
-              type copy
-              <store>
-                @type file
-                format json
-                path /tmp/fluentd
-                symlink_path /tmp/current-log
-              </store>
-              <store>
-                @type stdout
-              </store>
-            </match>
-          '';
-        };
+          <match **>
+            type copy
+            <store>
+              @type file
+              format json
+              path /tmp/fluentd
+              symlink_path /tmp/current-log
+            </store>
+            <store>
+              @type stdout
+            </store>
+          </match>
+        '';
       };
+    };
 
-    testScript =
-      let
-        testMessage = "an example log message";
+  testScript =
+    let
+      testMessage = "an example log message";
 
-        payload = pkgs.writeText "test-message.json" (
-          builtins.toJSON {
-            inherit testMessage;
-          }
-        );
-      in
-      ''
-        machine.start()
-        machine.wait_for_unit("fluentd.service")
-        machine.wait_for_open_port(9880)
+      payload = pkgs.writeText "test-message.json" (
+        builtins.toJSON {
+          inherit testMessage;
+        }
+      );
+    in
+    ''
+      machine.start()
+      machine.wait_for_unit("fluentd.service")
+      machine.wait_for_open_port(9880)
 
-        machine.succeed(
-            "curl -fsSL -X POST -H 'Content-type: application/json' -d @${payload} http://localhost:9880/test.tag"
-        )
+      machine.succeed(
+          "curl -fsSL -X POST -H 'Content-type: application/json' -d @${payload} http://localhost:9880/test.tag"
+      )
 
-        # blocking flush
-        machine.succeed("systemctl stop fluentd")
+      # blocking flush
+      machine.succeed("systemctl stop fluentd")
 
-        machine.succeed("grep '${testMessage}' /tmp/current-log")
-      '';
-  }
-)
+      machine.succeed("grep '${testMessage}' /tmp/current-log")
+    '';
+}
diff --git a/nixos/tests/fluidd.nix b/nixos/tests/fluidd.nix
index 94463fc74e49..edfc1e8d9a49 100644
--- a/nixos/tests/fluidd.nix
+++ b/nixos/tests/fluidd.nix
@@ -1,23 +1,21 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "fluidd";
-    meta.maintainers = with lib.maintainers; [ vtuan10 ];
+{
+  name = "fluidd";
+  meta.maintainers = with lib.maintainers; [ vtuan10 ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.fluidd = {
-          enable = true;
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.fluidd = {
+        enable = true;
       };
+    };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("nginx.service")
-      machine.wait_for_open_port(80)
-      machine.succeed("curl -sSfL http://localhost/ | grep 'fluidd'")
-    '';
-  }
-)
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_open_port(80)
+    machine.succeed("curl -sSfL http://localhost/ | grep 'fluidd'")
+  '';
+}
diff --git a/nixos/tests/fontconfig-default-fonts.nix b/nixos/tests/fontconfig-default-fonts.nix
index ce7f33201638..674192e7bba2 100644
--- a/nixos/tests/fontconfig-default-fonts.nix
+++ b/nixos/tests/fontconfig-default-fonts.nix
@@ -1,36 +1,34 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "fontconfig-default-fonts";
+{ lib, ... }:
+{
+  name = "fontconfig-default-fonts";
 
-    meta.maintainers = with lib.maintainers; [
-      jtojnar
-    ];
+  meta.maintainers = with lib.maintainers; [
+    jtojnar
+  ];
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        fonts.enableDefaultPackages = true; # Background fonts
-        fonts.packages = with pkgs; [
-          noto-fonts-color-emoji
-          cantarell-fonts
-          twitter-color-emoji
-          source-code-pro
-          gentium
-        ];
-        fonts.fontconfig.defaultFonts = {
-          serif = [ "Gentium Plus" ];
-          sansSerif = [ "Cantarell" ];
-          monospace = [ "Source Code Pro" ];
-          emoji = [ "Twitter Color Emoji" ];
-        };
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      fonts.enableDefaultPackages = true; # Background fonts
+      fonts.packages = with pkgs; [
+        noto-fonts-color-emoji
+        cantarell-fonts
+        twitter-color-emoji
+        source-code-pro
+        gentium
+      ];
+      fonts.fontconfig.defaultFonts = {
+        serif = [ "Gentium Plus" ];
+        sansSerif = [ "Cantarell" ];
+        monospace = [ "Source Code Pro" ];
+        emoji = [ "Twitter Color Emoji" ];
       };
+    };
 
-    testScript = ''
-      machine.succeed("fc-match serif | grep '\"Gentium Plus\"'")
-      machine.succeed("fc-match sans-serif | grep '\"Cantarell\"'")
-      machine.succeed("fc-match monospace | grep '\"Source Code Pro\"'")
-      machine.succeed("fc-match emoji | grep '\"Twitter Color Emoji\"'")
-    '';
-  }
-)
+  testScript = ''
+    machine.succeed("fc-match serif | grep '\"Gentium Plus\"'")
+    machine.succeed("fc-match sans-serif | grep '\"Cantarell\"'")
+    machine.succeed("fc-match monospace | grep '\"Source Code Pro\"'")
+    machine.succeed("fc-match emoji | grep '\"Twitter Color Emoji\"'")
+  '';
+}
diff --git a/nixos/tests/freeswitch.nix b/nixos/tests/freeswitch.nix
index 91f25244c9a4..8dbb28efe90d 100644
--- a/nixos/tests/freeswitch.nix
+++ b/nixos/tests/freeswitch.nix
@@ -1,34 +1,32 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "freeswitch";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ misuzu ];
-    };
-    nodes = {
-      node0 =
-        { config, lib, ... }:
-        {
-          networking.useDHCP = false;
-          networking.interfaces.eth1 = {
-            ipv4.addresses = [
-              {
-                address = "192.168.0.1";
-                prefixLength = 24;
-              }
-            ];
-          };
-          services.freeswitch = {
-            enable = true;
-            enableReload = true;
-            configTemplate = "${config.services.freeswitch.package}/share/freeswitch/conf/minimal";
-          };
+{ pkgs, ... }:
+{
+  name = "freeswitch";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ misuzu ];
+  };
+  nodes = {
+    node0 =
+      { config, lib, ... }:
+      {
+        networking.useDHCP = false;
+        networking.interfaces.eth1 = {
+          ipv4.addresses = [
+            {
+              address = "192.168.0.1";
+              prefixLength = 24;
+            }
+          ];
         };
-    };
-    testScript = ''
-      node0.wait_for_unit("freeswitch.service")
-      # Wait for SIP port to be open
-      node0.wait_for_open_port(5060)
-    '';
-  }
-)
+        services.freeswitch = {
+          enable = true;
+          enableReload = true;
+          configTemplate = "${config.services.freeswitch.package}/share/freeswitch/conf/minimal";
+        };
+      };
+  };
+  testScript = ''
+    node0.wait_for_unit("freeswitch.service")
+    # Wait for SIP port to be open
+    node0.wait_for_open_port(5060)
+  '';
+}
diff --git a/nixos/tests/frp.nix b/nixos/tests/frp.nix
index 8771ab8ad224..14db56308edc 100644
--- a/nixos/tests/frp.nix
+++ b/nixos/tests/frp.nix
@@ -1,87 +1,85 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "frp";
-    meta.maintainers = with lib.maintainers; [ zaldnoay ];
-    nodes = {
-      frps = {
-        networking = {
-          useNetworkd = true;
-          useDHCP = false;
-          firewall.enable = false;
-        };
-
-        systemd.network.networks."01-eth1" = {
-          name = "eth1";
-          networkConfig.Address = "10.0.0.1/24";
-        };
-
-        services.frp = {
-          enable = true;
-          role = "server";
-          settings = {
-            bindPort = 7000;
-            vhostHTTPPort = 80;
-          };
-        };
+{ pkgs, lib, ... }:
+{
+  name = "frp";
+  meta.maintainers = with lib.maintainers; [ zaldnoay ];
+  nodes = {
+    frps = {
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        firewall.enable = false;
       };
 
-      frpc = {
-        networking = {
-          useNetworkd = true;
-          useDHCP = false;
-        };
+      systemd.network.networks."01-eth1" = {
+        name = "eth1";
+        networkConfig.Address = "10.0.0.1/24";
+      };
 
-        systemd.network.networks."01-eth1" = {
-          name = "eth1";
-          networkConfig.Address = "10.0.0.2/24";
-        };
-
-        services.httpd = {
-          enable = true;
-          adminAddr = "admin@example.com";
-          virtualHosts."test-appication" =
-            let
-              testdir = pkgs.writeTextDir "web/index.php" "<?php phpinfo();";
-            in
-            {
-              documentRoot = "${testdir}/web";
-              locations."/" = {
-                index = "index.php index.html";
-              };
-            };
-          phpPackage = pkgs.php81;
-          enablePHP = true;
-        };
-
-        services.frp = {
-          enable = true;
-          role = "client";
-          settings = {
-            serverAddr = "10.0.0.1";
-            serverPort = 7000;
-            proxies = [
-              {
-                name = "web";
-                type = "http";
-                localPort = 80;
-                customDomains = [ "10.0.0.1" ];
-              }
-            ];
-          };
+      services.frp = {
+        enable = true;
+        role = "server";
+        settings = {
+          bindPort = 7000;
+          vhostHTTPPort = 80;
         };
       };
     };
 
-    testScript = ''
-      start_all()
-      frps.wait_for_unit("frp.service")
-      frps.wait_for_open_port(80)
-      frpc.wait_for_unit("frp.service")
-      response = frpc.succeed("curl -fvvv -s http://127.0.0.1/")
-      assert "PHP Version ${pkgs.php81.version}" in response, "PHP version not detected"
-      response = frpc.succeed("curl -fvvv -s http://10.0.0.1/")
-      assert "PHP Version ${pkgs.php81.version}" in response, "PHP version not detected"
-    '';
-  }
-)
+    frpc = {
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+      };
+
+      systemd.network.networks."01-eth1" = {
+        name = "eth1";
+        networkConfig.Address = "10.0.0.2/24";
+      };
+
+      services.httpd = {
+        enable = true;
+        adminAddr = "admin@example.com";
+        virtualHosts."test-appication" =
+          let
+            testdir = pkgs.writeTextDir "web/index.php" "<?php phpinfo();";
+          in
+          {
+            documentRoot = "${testdir}/web";
+            locations."/" = {
+              index = "index.php index.html";
+            };
+          };
+        phpPackage = pkgs.php81;
+        enablePHP = true;
+      };
+
+      services.frp = {
+        enable = true;
+        role = "client";
+        settings = {
+          serverAddr = "10.0.0.1";
+          serverPort = 7000;
+          proxies = [
+            {
+              name = "web";
+              type = "http";
+              localPort = 80;
+              customDomains = [ "10.0.0.1" ];
+            }
+          ];
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    frps.wait_for_unit("frp.service")
+    frps.wait_for_open_port(80)
+    frpc.wait_for_unit("frp.service")
+    response = frpc.succeed("curl -fvvv -s http://127.0.0.1/")
+    assert "PHP Version ${pkgs.php81.version}" in response, "PHP version not detected"
+    response = frpc.succeed("curl -fvvv -s http://10.0.0.1/")
+    assert "PHP Version ${pkgs.php81.version}" in response, "PHP version not detected"
+  '';
+}
diff --git a/nixos/tests/frr.nix b/nixos/tests/frr.nix
index 21e61bd768aa..cc5e16f8e2c5 100644
--- a/nixos/tests/frr.nix
+++ b/nixos/tests/frr.nix
@@ -5,119 +5,117 @@
 #
 # All interfaces are in OSPF Area 0.
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
+{ pkgs, ... }:
+let
 
-    ifAddr = node: iface: (pkgs.lib.head node.networking.interfaces.${iface}.ipv4.addresses).address;
+  ifAddr = node: iface: (pkgs.lib.head node.networking.interfaces.${iface}.ipv4.addresses).address;
 
-    ospfConf1 = ''
-      interface eth2
-        ip ospf hello-interval 1
-        ip ospf dead-interval 5
-      !
-      router ospf
-        network 192.168.0.0/16 area 0
-    '';
+  ospfConf1 = ''
+    interface eth2
+      ip ospf hello-interval 1
+      ip ospf dead-interval 5
+    !
+    router ospf
+      network 192.168.0.0/16 area 0
+  '';
 
-    ospfConf2 = ''
-      interface eth2
-        ip ospf hello-interval 1
-        ip ospf dead-interval 5
-      !
-      router ospf
-        network 192.168.0.0/16 area 0
-    '';
+  ospfConf2 = ''
+    interface eth2
+      ip ospf hello-interval 1
+      ip ospf dead-interval 5
+    !
+    router ospf
+      network 192.168.0.0/16 area 0
+  '';
 
-  in
-  {
-    name = "frr";
+in
+{
+  name = "frr";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
 
-    nodes = {
+  nodes = {
 
-      client =
-        { nodes, ... }:
-        {
-          virtualisation.vlans = [ 1 ];
-          services.frr = {
-            config = ''
-              ip route 192.168.0.0/16 ${ifAddr nodes.router1 "eth1"}
-            '';
-          };
-        };
-
-      router1 =
-        { ... }:
-        {
-          virtualisation.vlans = [
-            1
-            2
-          ];
-          boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
-          networking.firewall.extraCommands = "iptables -A nixos-fw -i eth2 -p ospfigp -j ACCEPT";
-          services.frr = {
-            ospfd.enable = true;
-            config = ospfConf1;
-          };
-
-          specialisation.ospf.configuration = {
-            services.frr.config = ospfConf2;
-          };
-        };
-
-      router2 =
-        { ... }:
-        {
-          virtualisation.vlans = [
-            3
-            2
-          ];
-          boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
-          networking.firewall.extraCommands = "iptables -A nixos-fw -i eth2 -p ospfigp -j ACCEPT";
-          services.frr = {
-            ospfd.enable = true;
-            config = ospfConf2;
-          };
-        };
-
-      server =
-        { nodes, ... }:
-        {
-          virtualisation.vlans = [ 3 ];
-          services.frr = {
-            config = ''
-              ip route 192.168.0.0/16 ${ifAddr nodes.router2 "eth1"}
-            '';
-          };
-        };
-    };
-
-    testScript =
+    client =
       { nodes, ... }:
-      ''
-        start_all()
+      {
+        virtualisation.vlans = [ 1 ];
+        services.frr = {
+          config = ''
+            ip route 192.168.0.0/16 ${ifAddr nodes.router1 "eth1"}
+          '';
+        };
+      };
 
-        # Wait for the networking to start on all machines
-        for machine in client, router1, router2, server:
-            machine.wait_for_unit("network.target")
+    router1 =
+      { ... }:
+      {
+        virtualisation.vlans = [
+          1
+          2
+        ];
+        boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
+        networking.firewall.extraCommands = "iptables -A nixos-fw -i eth2 -p ospfigp -j ACCEPT";
+        services.frr = {
+          ospfd.enable = true;
+          config = ospfConf1;
+        };
 
-        with subtest("Wait for FRR"):
-            for gw in client, router1, router2, server:
-                gw.wait_for_unit("frr")
+        specialisation.ospf.configuration = {
+          services.frr.config = ospfConf2;
+        };
+      };
 
-        router1.succeed("${nodes.router1.system.build.toplevel}/specialisation/ospf/bin/switch-to-configuration test >&2")
+    router2 =
+      { ... }:
+      {
+        virtualisation.vlans = [
+          3
+          2
+        ];
+        boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
+        networking.firewall.extraCommands = "iptables -A nixos-fw -i eth2 -p ospfigp -j ACCEPT";
+        services.frr = {
+          ospfd.enable = true;
+          config = ospfConf2;
+        };
+      };
 
-        with subtest("Wait for OSPF to form adjacencies"):
-            for gw in router1, router2:
-                gw.wait_until_succeeds("vtysh -c 'show ip ospf neighbor' | grep Full")
-                gw.wait_until_succeeds("vtysh -c 'show ip route' | grep '^O>'")
+    server =
+      { nodes, ... }:
+      {
+        virtualisation.vlans = [ 3 ];
+        services.frr = {
+          config = ''
+            ip route 192.168.0.0/16 ${ifAddr nodes.router2 "eth1"}
+          '';
+        };
+      };
+  };
 
-        with subtest("Test ICMP"):
-            client.wait_until_succeeds("ping -4 -c 3 server >&2")
-      '';
-  }
-)
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+
+      # Wait for the networking to start on all machines
+      for machine in client, router1, router2, server:
+          machine.wait_for_unit("network.target")
+
+      with subtest("Wait for FRR"):
+          for gw in client, router1, router2, server:
+              gw.wait_for_unit("frr")
+
+      router1.succeed("${nodes.router1.system.build.toplevel}/specialisation/ospf/bin/switch-to-configuration test >&2")
+
+      with subtest("Wait for OSPF to form adjacencies"):
+          for gw in router1, router2:
+              gw.wait_until_succeeds("vtysh -c 'show ip ospf neighbor' | grep Full")
+              gw.wait_until_succeeds("vtysh -c 'show ip route' | grep '^O>'")
+
+      with subtest("Test ICMP"):
+          client.wait_until_succeeds("ping -4 -c 3 server >&2")
+    '';
+}
diff --git a/nixos/tests/fscrypt.nix b/nixos/tests/fscrypt.nix
index 5bc611f123c4..4dc839dac447 100644
--- a/nixos/tests/fscrypt.nix
+++ b/nixos/tests/fscrypt.nix
@@ -1,54 +1,52 @@
-import ./make-test-python.nix (
-  { ... }:
-  {
-    name = "fscrypt";
+{ ... }:
+{
+  name = "fscrypt";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ./common/user-account.nix ];
-        security.pam.enableFscrypt = true;
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/user-account.nix ];
+      security.pam.enableFscrypt = true;
+    };
 
-    testScript = ''
-      def login_as_alice():
-          machine.wait_until_tty_matches("1", "login: ")
-          machine.send_chars("alice\n")
-          machine.wait_until_tty_matches("1", "Password: ")
-          machine.send_chars("foobar\n")
-          machine.wait_until_tty_matches("1", "alice\@machine")
+  testScript = ''
+    def login_as_alice():
+        machine.wait_until_tty_matches("1", "login: ")
+        machine.send_chars("alice\n")
+        machine.wait_until_tty_matches("1", "Password: ")
+        machine.send_chars("foobar\n")
+        machine.wait_until_tty_matches("1", "alice\@machine")
 
 
-      def logout():
-          machine.send_chars("logout\n")
-          machine.wait_until_tty_matches("1", "login: ")
+    def logout():
+        machine.send_chars("logout\n")
+        machine.wait_until_tty_matches("1", "login: ")
 
 
-      machine.wait_for_unit("default.target")
+    machine.wait_for_unit("default.target")
 
-      with subtest("Enable fscrypt on filesystem"):
-          machine.succeed("tune2fs -O encrypt /dev/vda")
-          machine.succeed("fscrypt setup --quiet --force --time=1ms")
+    with subtest("Enable fscrypt on filesystem"):
+        machine.succeed("tune2fs -O encrypt /dev/vda")
+        machine.succeed("fscrypt setup --quiet --force --time=1ms")
 
-      with subtest("Set up alice with an fscrypt-enabled home directory"):
-          machine.succeed("(echo foobar; echo foobar) | passwd alice")
-          machine.succeed("chown -R alice.users ~alice")
-          machine.succeed("echo foobar | fscrypt encrypt --skip-unlock --source=pam_passphrase --user=alice /home/alice")
+    with subtest("Set up alice with an fscrypt-enabled home directory"):
+        machine.succeed("(echo foobar; echo foobar) | passwd alice")
+        machine.succeed("chown -R alice.users ~alice")
+        machine.succeed("echo foobar | fscrypt encrypt --skip-unlock --source=pam_passphrase --user=alice /home/alice")
 
-      with subtest("Create file as alice"):
-        login_as_alice()
-        machine.succeed("echo hello > /home/alice/world")
-        logout()
-        # Wait for logout to be processed
-        machine.sleep(1)
+    with subtest("Create file as alice"):
+      login_as_alice()
+      machine.succeed("echo hello > /home/alice/world")
+      logout()
+      # Wait for logout to be processed
+      machine.sleep(1)
 
-      with subtest("File should not be readable without being logged in as alice"):
-        machine.fail("cat /home/alice/world")
+    with subtest("File should not be readable without being logged in as alice"):
+      machine.fail("cat /home/alice/world")
 
-      with subtest("File should be readable again as alice"):
-        login_as_alice()
-        machine.succeed("cat /home/alice/world")
-        logout()
-    '';
-  }
-)
+    with subtest("File should be readable again as alice"):
+      login_as_alice()
+      machine.succeed("cat /home/alice/world")
+      logout()
+  '';
+}
diff --git a/nixos/tests/ft2-clone.nix b/nixos/tests/ft2-clone.nix
index 012432bb3f84..c4f1475ad710 100644
--- a/nixos/tests/ft2-clone.nix
+++ b/nixos/tests/ft2-clone.nix
@@ -1,33 +1,31 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "ft2-clone";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fgaz ];
+{ pkgs, ... }:
+{
+  name = "ft2-clone";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+      environment.systemPackages = [ pkgs.ft2-clone ];
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
-        environment.systemPackages = [ pkgs.ft2-clone ];
-      };
+  enableOCR = true;
 
-    enableOCR = true;
+  testScript = ''
+    machine.wait_for_x()
+    # Add a dummy sound card, or the program won't start
+    machine.execute("modprobe snd-dummy")
 
-    testScript = ''
-      machine.wait_for_x()
-      # Add a dummy sound card, or the program won't start
-      machine.execute("modprobe snd-dummy")
+    machine.execute("ft2-clone >&2 &")
 
-      machine.execute("ft2-clone >&2 &")
-
-      machine.wait_for_window(r"Fasttracker")
-      machine.sleep(5)
-      machine.wait_for_text(r"(Songlen|Repstart|Time|About|Nibbles|Help)")
-      machine.screenshot("screen")
-    '';
-  }
-)
+    machine.wait_for_window(r"Fasttracker")
+    machine.sleep(5)
+    machine.wait_for_text(r"(Songlen|Repstart|Time|About|Nibbles|Help)")
+    machine.screenshot("screen")
+  '';
+}
diff --git a/nixos/tests/gancio.nix b/nixos/tests/gancio.nix
index 8f4696d6f6cc..6cd487008670 100644
--- a/nixos/tests/gancio.nix
+++ b/nixos/tests/gancio.nix
@@ -1,87 +1,85 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    extraHosts = ''
-      192.168.13.12 agenda.example.com
-    '';
-  in
-  {
-    name = "gancio";
-    meta.maintainers = with pkgs.lib.maintainers; [ jbgi ];
+{ pkgs, ... }:
+let
+  extraHosts = ''
+    192.168.13.12 agenda.example.com
+  '';
+in
+{
+  name = "gancio";
+  meta.maintainers = with pkgs.lib.maintainers; [ jbgi ];
 
-    nodes = {
-      server =
-        { pkgs, ... }:
-        {
-          networking = {
-            interfaces.eth1 = {
-              ipv4.addresses = [
-                {
-                  address = "192.168.13.12";
-                  prefixLength = 24;
-                }
-              ];
-            };
-            inherit extraHosts;
-            firewall.allowedTCPPorts = [ 80 ];
+  nodes = {
+    server =
+      { pkgs, ... }:
+      {
+        networking = {
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = "192.168.13.12";
+                prefixLength = 24;
+              }
+            ];
           };
-          environment.systemPackages = [ pkgs.gancio ];
-          services.gancio = {
-            enable = true;
-            settings = {
-              hostname = "agenda.example.com";
-              db.dialect = "postgres";
-            };
-            plugins = [ pkgs.gancioPlugins.telegram-bridge ];
-            userLocale = {
-              en = {
-                register = {
-                  description = "My new registration page description";
-                };
+          inherit extraHosts;
+          firewall.allowedTCPPorts = [ 80 ];
+        };
+        environment.systemPackages = [ pkgs.gancio ];
+        services.gancio = {
+          enable = true;
+          settings = {
+            hostname = "agenda.example.com";
+            db.dialect = "postgres";
+          };
+          plugins = [ pkgs.gancioPlugins.telegram-bridge ];
+          userLocale = {
+            en = {
+              register = {
+                description = "My new registration page description";
               };
             };
-            nginx = {
-              enableACME = false;
-              forceSSL = false;
-            };
+          };
+          nginx = {
+            enableACME = false;
+            forceSSL = false;
           };
         };
+      };
 
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
-          networking = {
-            interfaces.eth1 = {
-              ipv4.addresses = [
-                {
-                  address = "192.168.13.1";
-                  prefixLength = 24;
-                }
-              ];
-            };
-            inherit extraHosts;
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
+        networking = {
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = "192.168.13.1";
+                prefixLength = 24;
+              }
+            ];
           };
+          inherit extraHosts;
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      server.wait_for_unit("postgresql")
-      server.wait_for_unit("gancio")
-      server.wait_for_unit("nginx")
-      server.wait_for_file("/run/gancio/socket")
-      server.wait_for_open_port(80)
+    server.wait_for_unit("postgresql")
+    server.wait_for_unit("gancio")
+    server.wait_for_unit("nginx")
+    server.wait_for_file("/run/gancio/socket")
+    server.wait_for_open_port(80)
 
-      # Check can create user via cli
-      server.succeed("cd /var/lib/gancio && sudo -u gancio gancio users create admin dummy admin")
+    # Check can create user via cli
+    server.succeed("cd /var/lib/gancio && sudo -u gancio gancio users create admin dummy admin")
 
-      # Check event list is returned
-      client.wait_until_succeeds("curl --verbose --fail-with-body http://agenda.example.com/api/events", timeout=30)
+    # Check event list is returned
+    client.wait_until_succeeds("curl --verbose --fail-with-body http://agenda.example.com/api/events", timeout=30)
 
-      server.shutdown()
-      client.shutdown()
-    '';
-  }
-)
+    server.shutdown()
+    client.shutdown()
+  '';
+}
diff --git a/nixos/tests/geth.nix b/nixos/tests/geth.nix
index 7fa7b97ed3bb..49a2c4f11701 100644
--- a/nixos/tests/geth.nix
+++ b/nixos/tests/geth.nix
@@ -1,71 +1,69 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "geth";
-    meta = with pkgs.lib; {
-      maintainers = with maintainers; [ bachp ];
-    };
+{ pkgs, ... }:
+{
+  name = "geth";
+  meta = with pkgs.lib; {
+    maintainers = with maintainers; [ bachp ];
+  };
 
-    nodes.machine =
-      { ... }:
-      {
-        services.geth."mainnet" = {
+  nodes.machine =
+    { ... }:
+    {
+      services.geth."mainnet" = {
+        enable = true;
+        http = {
           enable = true;
-          http = {
-            enable = true;
-          };
-        };
-
-        services.geth."holesky" = {
-          enable = true;
-          port = 30304;
-          network = "holesky";
-          http = {
-            enable = true;
-            port = 18545;
-          };
-          authrpc = {
-            enable = true;
-            port = 18551;
-          };
-        };
-
-        services.geth."sepolia" = {
-          enable = true;
-          port = 30305;
-          network = "sepolia";
-          http = {
-            enable = true;
-            port = 28545;
-          };
-          authrpc = {
-            enable = true;
-            port = 28551;
-          };
         };
       };
 
-    testScript = ''
-      start_all()
+      services.geth."holesky" = {
+        enable = true;
+        port = 30304;
+        network = "holesky";
+        http = {
+          enable = true;
+          port = 18545;
+        };
+        authrpc = {
+          enable = true;
+          port = 18551;
+        };
+      };
 
-      machine.wait_for_unit("geth-mainnet.service")
-      machine.wait_for_unit("geth-holesky.service")
-      machine.wait_for_unit("geth-sepolia.service")
-      machine.wait_for_open_port(8545)
-      machine.wait_for_open_port(18545)
-      machine.wait_for_open_port(28545)
+      services.geth."sepolia" = {
+        enable = true;
+        port = 30305;
+        network = "sepolia";
+        http = {
+          enable = true;
+          port = 28545;
+        };
+        authrpc = {
+          enable = true;
+          port = 28551;
+        };
+      };
+    };
 
-      machine.succeed(
-          'geth attach --exec "eth.blockNumber" http://localhost:8545 | grep \'^0$\' '
-      )
+  testScript = ''
+    start_all()
 
-      machine.succeed(
-          'geth attach --exec "eth.blockNumber" http://localhost:18545 | grep \'^0$\' '
-      )
+    machine.wait_for_unit("geth-mainnet.service")
+    machine.wait_for_unit("geth-holesky.service")
+    machine.wait_for_unit("geth-sepolia.service")
+    machine.wait_for_open_port(8545)
+    machine.wait_for_open_port(18545)
+    machine.wait_for_open_port(28545)
 
-      machine.succeed(
-          'geth attach --exec "eth.blockNumber" http://localhost:28545 | grep \'^0$\' '
-      )
-    '';
-  }
-)
+    machine.succeed(
+        'geth attach --exec "eth.blockNumber" http://localhost:8545 | grep \'^0$\' '
+    )
+
+    machine.succeed(
+        'geth attach --exec "eth.blockNumber" http://localhost:18545 | grep \'^0$\' '
+    )
+
+    machine.succeed(
+        'geth attach --exec "eth.blockNumber" http://localhost:28545 | grep \'^0$\' '
+    )
+  '';
+}
diff --git a/nixos/tests/ghostunnel.nix b/nixos/tests/ghostunnel.nix
index bd16a802e60d..417f1a64765b 100644
--- a/nixos/tests/ghostunnel.nix
+++ b/nixos/tests/ghostunnel.nix
@@ -1,116 +1,114 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "ghostunnel";
-    nodes = {
-      backend =
-        { pkgs, ... }:
-        {
-          services.nginx.enable = true;
-          services.nginx.virtualHosts."backend".root = pkgs.runCommand "webroot" { } ''
-            mkdir $out
-            echo hi >$out/hi.txt
-          '';
-          networking.firewall.allowedTCPPorts = [ 80 ];
+{ pkgs, ... }:
+{
+  name = "ghostunnel";
+  nodes = {
+    backend =
+      { pkgs, ... }:
+      {
+        services.nginx.enable = true;
+        services.nginx.virtualHosts."backend".root = pkgs.runCommand "webroot" { } ''
+          mkdir $out
+          echo hi >$out/hi.txt
+        '';
+        networking.firewall.allowedTCPPorts = [ 80 ];
+      };
+    service =
+      { ... }:
+      {
+        services.ghostunnel.enable = true;
+        services.ghostunnel.servers."plain-old" = {
+          listen = "0.0.0.0:443";
+          cert = "/root/service-cert.pem";
+          key = "/root/service-key.pem";
+          disableAuthentication = true;
+          target = "backend:80";
+          unsafeTarget = true;
         };
-      service =
-        { ... }:
-        {
-          services.ghostunnel.enable = true;
-          services.ghostunnel.servers."plain-old" = {
-            listen = "0.0.0.0:443";
-            cert = "/root/service-cert.pem";
-            key = "/root/service-key.pem";
-            disableAuthentication = true;
-            target = "backend:80";
-            unsafeTarget = true;
-          };
-          services.ghostunnel.servers."client-cert" = {
-            listen = "0.0.0.0:1443";
-            cert = "/root/service-cert.pem";
-            key = "/root/service-key.pem";
-            cacert = "/root/ca.pem";
-            target = "backend:80";
-            allowCN = [ "client" ];
-            unsafeTarget = true;
-          };
-          networking.firewall.allowedTCPPorts = [
-            443
-            1443
-          ];
+        services.ghostunnel.servers."client-cert" = {
+          listen = "0.0.0.0:1443";
+          cert = "/root/service-cert.pem";
+          key = "/root/service-key.pem";
+          cacert = "/root/ca.pem";
+          target = "backend:80";
+          allowCN = [ "client" ];
+          unsafeTarget = true;
         };
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [
-            pkgs.curl
-          ];
-        };
-    };
+        networking.firewall.allowedTCPPorts = [
+          443
+          1443
+        ];
+      };
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.curl
+        ];
+      };
+  };
 
-    testScript = ''
+  testScript = ''
 
-      # prepare certificates
+    # prepare certificates
 
-      def cmd(command):
-        print(f"+{command}")
-        r = os.system(command)
-        if r != 0:
-          raise Exception(f"Command {command} failed with exit code {r}")
+    def cmd(command):
+      print(f"+{command}")
+      r = os.system(command)
+      if r != 0:
+        raise Exception(f"Command {command} failed with exit code {r}")
 
-      # Create CA
-      cmd("${pkgs.openssl}/bin/openssl genrsa -out ca-key.pem 4096")
-      cmd("${pkgs.openssl}/bin/openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -subj '/C=NL/ST=Zuid-Holland/L=The Hague/O=Stevige Balken en Planken B.V./OU=OpSec/CN=Certificate Authority' -out ca.pem")
+    # Create CA
+    cmd("${pkgs.openssl}/bin/openssl genrsa -out ca-key.pem 4096")
+    cmd("${pkgs.openssl}/bin/openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -subj '/C=NL/ST=Zuid-Holland/L=The Hague/O=Stevige Balken en Planken B.V./OU=OpSec/CN=Certificate Authority' -out ca.pem")
 
-      # Create service
-      cmd("${pkgs.openssl}/bin/openssl genrsa -out service-key.pem 4096")
-      cmd("${pkgs.openssl}/bin/openssl req -subj '/CN=service' -sha256 -new -key service-key.pem -out service.csr")
-      cmd("echo subjectAltName = DNS:service,IP:127.0.0.1 >> extfile.cnf")
-      cmd("echo extendedKeyUsage = serverAuth >> extfile.cnf")
-      cmd("${pkgs.openssl}/bin/openssl x509 -req -days 365 -sha256 -in service.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out service-cert.pem -extfile extfile.cnf")
+    # Create service
+    cmd("${pkgs.openssl}/bin/openssl genrsa -out service-key.pem 4096")
+    cmd("${pkgs.openssl}/bin/openssl req -subj '/CN=service' -sha256 -new -key service-key.pem -out service.csr")
+    cmd("echo subjectAltName = DNS:service,IP:127.0.0.1 >> extfile.cnf")
+    cmd("echo extendedKeyUsage = serverAuth >> extfile.cnf")
+    cmd("${pkgs.openssl}/bin/openssl x509 -req -days 365 -sha256 -in service.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out service-cert.pem -extfile extfile.cnf")
 
-      # Create client
-      cmd("${pkgs.openssl}/bin/openssl genrsa -out client-key.pem 4096")
-      cmd("${pkgs.openssl}/bin/openssl req -subj '/CN=client' -new -key client-key.pem -out client.csr")
-      cmd("echo extendedKeyUsage = clientAuth > extfile-client.cnf")
-      cmd("${pkgs.openssl}/bin/openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -extfile extfile-client.cnf")
+    # Create client
+    cmd("${pkgs.openssl}/bin/openssl genrsa -out client-key.pem 4096")
+    cmd("${pkgs.openssl}/bin/openssl req -subj '/CN=client' -new -key client-key.pem -out client.csr")
+    cmd("echo extendedKeyUsage = clientAuth > extfile-client.cnf")
+    cmd("${pkgs.openssl}/bin/openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -extfile extfile-client.cnf")
 
-      cmd("ls -al")
+    cmd("ls -al")
 
-      start_all()
+    start_all()
 
-      # Configuration
-      service.copy_from_host("ca.pem", "/root/ca.pem")
-      service.copy_from_host("service-cert.pem", "/root/service-cert.pem")
-      service.copy_from_host("service-key.pem", "/root/service-key.pem")
-      client.copy_from_host("ca.pem", "/root/ca.pem")
-      client.copy_from_host("service-cert.pem", "/root/service-cert.pem")
-      client.copy_from_host("client-cert.pem", "/root/client-cert.pem")
-      client.copy_from_host("client-key.pem", "/root/client-key.pem")
+    # Configuration
+    service.copy_from_host("ca.pem", "/root/ca.pem")
+    service.copy_from_host("service-cert.pem", "/root/service-cert.pem")
+    service.copy_from_host("service-key.pem", "/root/service-key.pem")
+    client.copy_from_host("ca.pem", "/root/ca.pem")
+    client.copy_from_host("service-cert.pem", "/root/service-cert.pem")
+    client.copy_from_host("client-cert.pem", "/root/client-cert.pem")
+    client.copy_from_host("client-key.pem", "/root/client-key.pem")
 
-      backend.wait_for_unit("nginx.service")
-      service.wait_for_unit("multi-user.target")
-      service.wait_for_unit("multi-user.target")
-      client.wait_for_unit("multi-user.target")
+    backend.wait_for_unit("nginx.service")
+    service.wait_for_unit("multi-user.target")
+    service.wait_for_unit("multi-user.target")
+    client.wait_for_unit("multi-user.target")
 
-      # Check assumptions before the real test
-      client.succeed("bash -c 'diff <(curl -v --no-progress-meter http://backend/hi.txt) <(echo hi)'")
+    # Check assumptions before the real test
+    client.succeed("bash -c 'diff <(curl -v --no-progress-meter http://backend/hi.txt) <(echo hi)'")
 
-      # Plain old simple TLS can connect, ignoring cert
-      client.succeed("bash -c 'diff <(curl -v --no-progress-meter --insecure https://service/hi.txt) <(echo hi)'")
+    # Plain old simple TLS can connect, ignoring cert
+    client.succeed("bash -c 'diff <(curl -v --no-progress-meter --insecure https://service/hi.txt) <(echo hi)'")
 
-      # Plain old simple TLS provides correct signature with its cert
-      client.succeed("bash -c 'diff <(curl -v --no-progress-meter --cacert /root/ca.pem https://service/hi.txt) <(echo hi)'")
+    # Plain old simple TLS provides correct signature with its cert
+    client.succeed("bash -c 'diff <(curl -v --no-progress-meter --cacert /root/ca.pem https://service/hi.txt) <(echo hi)'")
 
-      # Client can authenticate with certificate
-      client.succeed("bash -c 'diff <(curl -v --no-progress-meter --cert /root/client-cert.pem --key /root/client-key.pem --cacert /root/ca.pem https://service:1443/hi.txt) <(echo hi)'")
+    # Client can authenticate with certificate
+    client.succeed("bash -c 'diff <(curl -v --no-progress-meter --cert /root/client-cert.pem --key /root/client-key.pem --cacert /root/ca.pem https://service:1443/hi.txt) <(echo hi)'")
 
-      # Client must authenticate with certificate
-      client.fail("bash -c 'diff <(curl -v --no-progress-meter --cacert /root/ca.pem https://service:1443/hi.txt) <(echo hi)'")
-    '';
+    # Client must authenticate with certificate
+    client.fail("bash -c 'diff <(curl -v --no-progress-meter --cacert /root/ca.pem https://service:1443/hi.txt) <(echo hi)'")
+  '';
 
-    meta.maintainers = with pkgs.lib.maintainers; [
-      roberth
-    ];
-  }
-)
+  meta.maintainers = with pkgs.lib.maintainers; [
+    roberth
+  ];
+}
diff --git a/nixos/tests/gitdaemon.nix b/nixos/tests/gitdaemon.nix
index 41a29168bda4..35278a319827 100644
--- a/nixos/tests/gitdaemon.nix
+++ b/nixos/tests/gitdaemon.nix
@@ -1,83 +1,81 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    hashes = pkgs.writeText "hashes" ''
-      b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c  /project/bar
-    '';
-  in
-  {
-    name = "gitdaemon";
+let
+  hashes = pkgs.writeText "hashes" ''
+    b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c  /project/bar
+  '';
+in
+{
+  name = "gitdaemon";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ tilpner ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ tilpner ];
+  };
 
-    nodes = {
-      server =
-        { config, ... }:
-        {
-          networking.firewall.allowedTCPPorts = [ config.services.gitDaemon.port ];
+  nodes = {
+    server =
+      { config, ... }:
+      {
+        networking.firewall.allowedTCPPorts = [ config.services.gitDaemon.port ];
 
-          environment.systemPackages = [ pkgs.git ];
+        environment.systemPackages = [ pkgs.git ];
 
-          systemd.tmpfiles.rules = [
-            # type path mode user group age arg
-            " d    /git 0755 git  git   -   -"
-          ];
+        systemd.tmpfiles.rules = [
+          # type path mode user group age arg
+          " d    /git 0755 git  git   -   -"
+        ];
 
-          services.gitDaemon = {
-            enable = true;
-            basePath = "/git";
-          };
+        services.gitDaemon = {
+          enable = true;
+          basePath = "/git";
         };
+      };
 
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.git ];
-        };
-    };
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.git ];
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      with subtest("create project.git"):
-          server.succeed(
-              "git init --bare /git/project.git",
-              "touch /git/project.git/git-daemon-export-ok",
-          )
+    with subtest("create project.git"):
+        server.succeed(
+            "git init --bare /git/project.git",
+            "touch /git/project.git/git-daemon-export-ok",
+        )
 
-      with subtest("add file to project.git"):
-          server.succeed(
-              "git clone /git/project.git /project",
-              "echo foo > /project/bar",
-              "git config --global user.email 'you@example.com'",
-              "git config --global user.name 'Your Name'",
-              "git -C /project add bar",
-              "git -C /project commit -m 'quux'",
-              "git -C /project push",
-              "rm -r /project",
-          )
+    with subtest("add file to project.git"):
+        server.succeed(
+            "git clone /git/project.git /project",
+            "echo foo > /project/bar",
+            "git config --global user.email 'you@example.com'",
+            "git config --global user.name 'Your Name'",
+            "git -C /project add bar",
+            "git -C /project commit -m 'quux'",
+            "git -C /project push",
+            "rm -r /project",
+        )
 
-      # Change user/group to default daemon user/group from module
-      # to avoid "fatal: detected dubious ownership in repository at '/git/project.git'"
-      server.succeed("chown git:git -R /git/project.git")
+    # Change user/group to default daemon user/group from module
+    # to avoid "fatal: detected dubious ownership in repository at '/git/project.git'"
+    server.succeed("chown git:git -R /git/project.git")
 
-      with subtest("git daemon starts"):
-          server.wait_for_unit("git-daemon.service")
+    with subtest("git daemon starts"):
+        server.wait_for_unit("git-daemon.service")
 
 
-      server.systemctl("start network-online.target")
-      client.systemctl("start network-online.target")
-      server.wait_for_unit("network-online.target")
-      client.wait_for_unit("network-online.target")
+    server.systemctl("start network-online.target")
+    client.systemctl("start network-online.target")
+    server.wait_for_unit("network-online.target")
+    client.wait_for_unit("network-online.target")
 
-      with subtest("client can clone project.git"):
-          client.succeed(
-              "git clone git://server/project.git /project",
-              "sha256sum -c ${hashes}",
-          )
-    '';
-  }
-)
+    with subtest("client can clone project.git"):
+        client.succeed(
+            "git clone git://server/project.git /project",
+            "sha256sum -c ${hashes}",
+        )
+  '';
+}
diff --git a/nixos/tests/gitolite-fcgiwrap.nix b/nixos/tests/gitolite-fcgiwrap.nix
index 9560c5c34913..fff676ee1f59 100644
--- a/nixos/tests/gitolite-fcgiwrap.nix
+++ b/nixos/tests/gitolite-fcgiwrap.nix
@@ -1,98 +1,96 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    user = "gitolite-admin";
-    password = "some_password";
+let
+  user = "gitolite-admin";
+  password = "some_password";
 
-    # not used but needed to setup gitolite
-    adminPublicKey = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7urFhAA90BTpGuEHeWWTY3W/g9PBxXNxfWhfbrm4Le root@client
-    '';
-  in
-  {
-    name = "gitolite-fcgiwrap";
+  # not used but needed to setup gitolite
+  adminPublicKey = ''
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7urFhAA90BTpGuEHeWWTY3W/g9PBxXNxfWhfbrm4Le root@client
+  '';
+in
+{
+  name = "gitolite-fcgiwrap";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ bbigras ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ bbigras ];
+  };
 
-    nodes = {
+  nodes = {
 
-      server =
-        { config, ... }:
-        {
-          networking.firewall.allowedTCPPorts = [ 80 ];
+    server =
+      { config, ... }:
+      {
+        networking.firewall.allowedTCPPorts = [ 80 ];
 
-          services.fcgiwrap.instances.gitolite = {
-            process.user = "gitolite";
-            process.group = "gitolite";
-            socket = { inherit (config.services.nginx) user group; };
-          };
+        services.fcgiwrap.instances.gitolite = {
+          process.user = "gitolite";
+          process.group = "gitolite";
+          socket = { inherit (config.services.nginx) user group; };
+        };
 
-          services.gitolite = {
-            enable = true;
-            adminPubkey = adminPublicKey;
-          };
+        services.gitolite = {
+          enable = true;
+          adminPubkey = adminPublicKey;
+        };
 
-          services.nginx = {
-            enable = true;
-            recommendedProxySettings = true;
-            virtualHosts."server".locations."/git".extraConfig = ''
-              # turn off gzip as git objects are already well compressed
-              gzip off;
+        services.nginx = {
+          enable = true;
+          recommendedProxySettings = true;
+          virtualHosts."server".locations."/git".extraConfig = ''
+            # turn off gzip as git objects are already well compressed
+            gzip off;
 
-              # use file based basic authentication
-              auth_basic "Git Repository Authentication";
-              auth_basic_user_file /etc/gitolite/htpasswd;
+            # use file based basic authentication
+            auth_basic "Git Repository Authentication";
+            auth_basic_user_file /etc/gitolite/htpasswd;
 
-              # common FastCGI parameters are required
-              include ${config.services.nginx.package}/conf/fastcgi_params;
+            # common FastCGI parameters are required
+            include ${config.services.nginx.package}/conf/fastcgi_params;
 
-              # strip the CGI program prefix
-              fastcgi_split_path_info ^(/git)(.*)$;
-              fastcgi_param PATH_INFO $fastcgi_path_info;
+            # strip the CGI program prefix
+            fastcgi_split_path_info ^(/git)(.*)$;
+            fastcgi_param PATH_INFO $fastcgi_path_info;
 
-              # pass authenticated user login(mandatory) to Gitolite
-              fastcgi_param REMOTE_USER $remote_user;
+            # pass authenticated user login(mandatory) to Gitolite
+            fastcgi_param REMOTE_USER $remote_user;
 
-              # pass git repository root directory and hosting user directory
-              # these env variables can be set in a wrapper script
-              fastcgi_param GIT_HTTP_EXPORT_ALL "";
-              fastcgi_param GIT_PROJECT_ROOT /var/lib/gitolite/repositories;
-              fastcgi_param GITOLITE_HTTP_HOME /var/lib/gitolite;
-              fastcgi_param SCRIPT_FILENAME ${pkgs.gitolite}/bin/gitolite-shell;
+            # pass git repository root directory and hosting user directory
+            # these env variables can be set in a wrapper script
+            fastcgi_param GIT_HTTP_EXPORT_ALL "";
+            fastcgi_param GIT_PROJECT_ROOT /var/lib/gitolite/repositories;
+            fastcgi_param GITOLITE_HTTP_HOME /var/lib/gitolite;
+            fastcgi_param SCRIPT_FILENAME ${pkgs.gitolite}/bin/gitolite-shell;
 
-              # use Unix domain socket or inet socket
-              fastcgi_pass unix:${config.services.fcgiwrap.instances.gitolite.socket.address};
-            '';
-          };
-
-          # WARNING: DON'T DO THIS IN PRODUCTION!
-          # This puts unhashed secrets directly into the Nix store for ease of testing.
-          environment.etc."gitolite/htpasswd".source = pkgs.runCommand "htpasswd" { } ''
-            ${pkgs.apacheHttpd}/bin/htpasswd -bc "$out" ${user} ${password}
+            # use Unix domain socket or inet socket
+            fastcgi_pass unix:${config.services.fcgiwrap.instances.gitolite.socket.address};
           '';
         };
 
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.git ];
-        };
-    };
+        # WARNING: DON'T DO THIS IN PRODUCTION!
+        # This puts unhashed secrets directly into the Nix store for ease of testing.
+        environment.etc."gitolite/htpasswd".source = pkgs.runCommand "htpasswd" { } ''
+          ${pkgs.apacheHttpd}/bin/htpasswd -bc "$out" ${user} ${password}
+        '';
+      };
 
-    testScript = ''
-      start_all()
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.git ];
+      };
+  };
 
-      server.wait_for_unit("gitolite-init.service")
-      server.wait_for_unit("nginx.service")
-      server.wait_for_file("/run/fcgiwrap-gitolite.sock")
+  testScript = ''
+    start_all()
 
-      client.wait_for_unit("multi-user.target")
-      client.succeed(
-          "git clone http://${user}:${password}@server/git/gitolite-admin.git"
-      )
-    '';
-  }
-)
+    server.wait_for_unit("gitolite-init.service")
+    server.wait_for_unit("nginx.service")
+    server.wait_for_file("/run/fcgiwrap-gitolite.sock")
+
+    client.wait_for_unit("multi-user.target")
+    client.succeed(
+        "git clone http://${user}:${password}@server/git/gitolite-admin.git"
+    )
+  '';
+}
diff --git a/nixos/tests/gitolite.nix b/nixos/tests/gitolite.nix
index af2aa327c016..3b4c4634e270 100644
--- a/nixos/tests/gitolite.nix
+++ b/nixos/tests/gitolite.nix
@@ -1,144 +1,142 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    adminPrivateKey = pkgs.writeText "id_ed25519" ''
-      -----BEGIN OPENSSH PRIVATE KEY-----
-      b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-      QyNTUxOQAAACDu7qxYQAPdAU6RrhB3llk2N1v4PTwcVzcX1oX265uC3gAAAJBJiYxDSYmM
-      QwAAAAtzc2gtZWQyNTUxOQAAACDu7qxYQAPdAU6RrhB3llk2N1v4PTwcVzcX1oX265uC3g
-      AAAEDE1W6vMwSEUcF1r7Hyypm/+sCOoDmKZgPxi3WOa1mD2u7urFhAA90BTpGuEHeWWTY3
-      W/g9PBxXNxfWhfbrm4LeAAAACGJmb0BtaW5pAQIDBAU=
-      -----END OPENSSH PRIVATE KEY-----
-    '';
+let
+  adminPrivateKey = pkgs.writeText "id_ed25519" ''
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+    QyNTUxOQAAACDu7qxYQAPdAU6RrhB3llk2N1v4PTwcVzcX1oX265uC3gAAAJBJiYxDSYmM
+    QwAAAAtzc2gtZWQyNTUxOQAAACDu7qxYQAPdAU6RrhB3llk2N1v4PTwcVzcX1oX265uC3g
+    AAAEDE1W6vMwSEUcF1r7Hyypm/+sCOoDmKZgPxi3WOa1mD2u7urFhAA90BTpGuEHeWWTY3
+    W/g9PBxXNxfWhfbrm4LeAAAACGJmb0BtaW5pAQIDBAU=
+    -----END OPENSSH PRIVATE KEY-----
+  '';
 
-    adminPublicKey = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7urFhAA90BTpGuEHeWWTY3W/g9PBxXNxfWhfbrm4Le root@client
-    '';
+  adminPublicKey = ''
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7urFhAA90BTpGuEHeWWTY3W/g9PBxXNxfWhfbrm4Le root@client
+  '';
 
-    alicePrivateKey = pkgs.writeText "id_ed25519" ''
-      -----BEGIN OPENSSH PRIVATE KEY-----
-      b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-      QyNTUxOQAAACBbeWvHh/AWGWI6EIc1xlSihyXtacNQ9KeztlW/VUy8wQAAAJAwVQ5VMFUO
-      VQAAAAtzc2gtZWQyNTUxOQAAACBbeWvHh/AWGWI6EIc1xlSihyXtacNQ9KeztlW/VUy8wQ
-      AAAEB7lbfkkdkJoE+4TKHPdPQWBKLSx+J54Eg8DaTr+3KoSlt5a8eH8BYZYjoQhzXGVKKH
-      Je1pw1D0p7O2Vb9VTLzBAAAACGJmb0BtaW5pAQIDBAU=
-      -----END OPENSSH PRIVATE KEY-----
-    '';
+  alicePrivateKey = pkgs.writeText "id_ed25519" ''
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+    QyNTUxOQAAACBbeWvHh/AWGWI6EIc1xlSihyXtacNQ9KeztlW/VUy8wQAAAJAwVQ5VMFUO
+    VQAAAAtzc2gtZWQyNTUxOQAAACBbeWvHh/AWGWI6EIc1xlSihyXtacNQ9KeztlW/VUy8wQ
+    AAAEB7lbfkkdkJoE+4TKHPdPQWBKLSx+J54Eg8DaTr+3KoSlt5a8eH8BYZYjoQhzXGVKKH
+    Je1pw1D0p7O2Vb9VTLzBAAAACGJmb0BtaW5pAQIDBAU=
+    -----END OPENSSH PRIVATE KEY-----
+  '';
 
-    alicePublicKey = pkgs.writeText "id_ed25519.pub" ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFt5a8eH8BYZYjoQhzXGVKKHJe1pw1D0p7O2Vb9VTLzB alice@client
-    '';
+  alicePublicKey = pkgs.writeText "id_ed25519.pub" ''
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFt5a8eH8BYZYjoQhzXGVKKHJe1pw1D0p7O2Vb9VTLzB alice@client
+  '';
 
-    bobPrivateKey = pkgs.writeText "id_ed25519" ''
-      -----BEGIN OPENSSH PRIVATE KEY-----
-      b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-      QyNTUxOQAAACCWTaJ1D9Xjxy6759FvQ9oXTes1lmWBciXPkEeqTikBMAAAAJDQBmNV0AZj
-      VQAAAAtzc2gtZWQyNTUxOQAAACCWTaJ1D9Xjxy6759FvQ9oXTes1lmWBciXPkEeqTikBMA
-      AAAEDM1IYYFUwk/IVxauha9kuR6bbRtT3gZ6ZA0GLb9txb/pZNonUP1ePHLrvn0W9D2hdN
-      6zWWZYFyJc+QR6pOKQEwAAAACGJmb0BtaW5pAQIDBAU=
-      -----END OPENSSH PRIVATE KEY-----
-    '';
+  bobPrivateKey = pkgs.writeText "id_ed25519" ''
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+    QyNTUxOQAAACCWTaJ1D9Xjxy6759FvQ9oXTes1lmWBciXPkEeqTikBMAAAAJDQBmNV0AZj
+    VQAAAAtzc2gtZWQyNTUxOQAAACCWTaJ1D9Xjxy6759FvQ9oXTes1lmWBciXPkEeqTikBMA
+    AAAEDM1IYYFUwk/IVxauha9kuR6bbRtT3gZ6ZA0GLb9txb/pZNonUP1ePHLrvn0W9D2hdN
+    6zWWZYFyJc+QR6pOKQEwAAAACGJmb0BtaW5pAQIDBAU=
+    -----END OPENSSH PRIVATE KEY-----
+  '';
 
-    bobPublicKey = pkgs.writeText "id_ed25519.pub" ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZNonUP1ePHLrvn0W9D2hdN6zWWZYFyJc+QR6pOKQEw bob@client
-    '';
+  bobPublicKey = pkgs.writeText "id_ed25519.pub" ''
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZNonUP1ePHLrvn0W9D2hdN6zWWZYFyJc+QR6pOKQEw bob@client
+  '';
 
-    gitoliteAdminConfSnippet = pkgs.writeText "gitolite-admin-conf-snippet" ''
-      repo alice-project
-          RW+     =   alice
-    '';
-  in
-  {
-    name = "gitolite";
+  gitoliteAdminConfSnippet = pkgs.writeText "gitolite-admin-conf-snippet" ''
+    repo alice-project
+        RW+     =   alice
+  '';
+in
+{
+  name = "gitolite";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ bjornfor ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ bjornfor ];
+  };
 
-    nodes = {
+  nodes = {
 
-      server =
-        { ... }:
-        {
-          services.gitolite = {
-            enable = true;
-            adminPubkey = adminPublicKey;
-          };
-          services.openssh.enable = true;
+    server =
+      { ... }:
+      {
+        services.gitolite = {
+          enable = true;
+          adminPubkey = adminPublicKey;
         };
+        services.openssh.enable = true;
+      };
 
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.git ];
-          programs.ssh.extraConfig = ''
-            Host *
-              UserKnownHostsFile /dev/null
-              StrictHostKeyChecking no
-              # there's nobody around that can input password
-              PreferredAuthentications publickey
-          '';
-          users.users.alice = {
-            isNormalUser = true;
-          };
-          users.users.bob = {
-            isNormalUser = true;
-          };
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.git ];
+        programs.ssh.extraConfig = ''
+          Host *
+            UserKnownHostsFile /dev/null
+            StrictHostKeyChecking no
+            # there's nobody around that can input password
+            PreferredAuthentications publickey
+        '';
+        users.users.alice = {
+          isNormalUser = true;
         };
+        users.users.bob = {
+          isNormalUser = true;
+        };
+      };
 
-    };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      with subtest("can setup ssh keys on system"):
-          client.succeed(
-              "mkdir -p ~root/.ssh",
-              "cp ${adminPrivateKey} ~root/.ssh/id_ed25519",
-              "chmod 600 ~root/.ssh/id_ed25519",
-          )
-          client.succeed(
-              "sudo -u alice mkdir -p ~alice/.ssh",
-              "sudo -u alice cp ${alicePrivateKey} ~alice/.ssh/id_ed25519",
-              "sudo -u alice chmod 600 ~alice/.ssh/id_ed25519",
-          )
-          client.succeed(
-              "sudo -u bob mkdir -p ~bob/.ssh",
-              "sudo -u bob cp ${bobPrivateKey} ~bob/.ssh/id_ed25519",
-              "sudo -u bob chmod 600 ~bob/.ssh/id_ed25519",
-          )
+    with subtest("can setup ssh keys on system"):
+        client.succeed(
+            "mkdir -p ~root/.ssh",
+            "cp ${adminPrivateKey} ~root/.ssh/id_ed25519",
+            "chmod 600 ~root/.ssh/id_ed25519",
+        )
+        client.succeed(
+            "sudo -u alice mkdir -p ~alice/.ssh",
+            "sudo -u alice cp ${alicePrivateKey} ~alice/.ssh/id_ed25519",
+            "sudo -u alice chmod 600 ~alice/.ssh/id_ed25519",
+        )
+        client.succeed(
+            "sudo -u bob mkdir -p ~bob/.ssh",
+            "sudo -u bob cp ${bobPrivateKey} ~bob/.ssh/id_ed25519",
+            "sudo -u bob chmod 600 ~bob/.ssh/id_ed25519",
+        )
 
-      with subtest("gitolite server starts"):
-          server.wait_for_unit("gitolite-init.service")
-          server.wait_for_unit("sshd.service")
-          client.succeed("ssh -n gitolite@server info")
+    with subtest("gitolite server starts"):
+        server.wait_for_unit("gitolite-init.service")
+        server.wait_for_unit("sshd.service")
+        client.succeed("ssh -n gitolite@server info")
 
-      with subtest("admin can clone and configure gitolite-admin.git"):
-          client.succeed(
-              "git clone gitolite@server:gitolite-admin.git",
-              "git config --global user.name 'System Administrator'",
-              "git config --global user.email root\@domain.example",
-              "cp ${alicePublicKey} gitolite-admin/keydir/alice.pub",
-              "cp ${bobPublicKey} gitolite-admin/keydir/bob.pub",
-              "(cd gitolite-admin && git add . && git commit -m 'Add keys for alice, bob' && git push)",
-              "cat ${gitoliteAdminConfSnippet} >> gitolite-admin/conf/gitolite.conf",
-              "(cd gitolite-admin && git add . && git commit -m 'Add repo for alice' && git push)",
-          )
+    with subtest("admin can clone and configure gitolite-admin.git"):
+        client.succeed(
+            "git clone gitolite@server:gitolite-admin.git",
+            "git config --global user.name 'System Administrator'",
+            "git config --global user.email root\@domain.example",
+            "cp ${alicePublicKey} gitolite-admin/keydir/alice.pub",
+            "cp ${bobPublicKey} gitolite-admin/keydir/bob.pub",
+            "(cd gitolite-admin && git add . && git commit -m 'Add keys for alice, bob' && git push)",
+            "cat ${gitoliteAdminConfSnippet} >> gitolite-admin/conf/gitolite.conf",
+            "(cd gitolite-admin && git add . && git commit -m 'Add repo for alice' && git push)",
+        )
 
-      with subtest("non-admins cannot clone gitolite-admin.git"):
-          client.fail("sudo -i -u alice git clone gitolite@server:gitolite-admin.git")
-          client.fail("sudo -i -u bob git clone gitolite@server:gitolite-admin.git")
+    with subtest("non-admins cannot clone gitolite-admin.git"):
+        client.fail("sudo -i -u alice git clone gitolite@server:gitolite-admin.git")
+        client.fail("sudo -i -u bob git clone gitolite@server:gitolite-admin.git")
 
-      with subtest("non-admins can clone testing.git"):
-          client.succeed("sudo -i -u alice git clone gitolite@server:testing.git")
-          client.succeed("sudo -i -u bob git clone gitolite@server:testing.git")
+    with subtest("non-admins can clone testing.git"):
+        client.succeed("sudo -i -u alice git clone gitolite@server:testing.git")
+        client.succeed("sudo -i -u bob git clone gitolite@server:testing.git")
 
-      with subtest("alice can clone alice-project.git"):
-          client.succeed("sudo -i -u alice git clone gitolite@server:alice-project.git")
+    with subtest("alice can clone alice-project.git"):
+        client.succeed("sudo -i -u alice git clone gitolite@server:alice-project.git")
 
-      with subtest("bob cannot clone alice-project.git"):
-          client.fail("sudo -i -u bob git clone gitolite@server:alice-project.git")
-    '';
-  }
-)
+    with subtest("bob cannot clone alice-project.git"):
+        client.fail("sudo -i -u bob git clone gitolite@server:alice-project.git")
+  '';
+}
diff --git a/nixos/tests/glusterfs.nix b/nixos/tests/glusterfs.nix
index 8beed8e4a91f..e8b0a442aedc 100644
--- a/nixos/tests/glusterfs.nix
+++ b/nixos/tests/glusterfs.nix
@@ -1,75 +1,73 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    client =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.glusterfs ];
-        virtualisation.fileSystems = {
-          "/gluster" = {
-            device = "server1:/gv0";
-            fsType = "glusterfs";
-          };
+let
+  client =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.glusterfs ];
+      virtualisation.fileSystems = {
+        "/gluster" = {
+          device = "server1:/gv0";
+          fsType = "glusterfs";
         };
       };
-
-    server =
-      { pkgs, ... }:
-      {
-        networking.firewall.enable = false;
-        services.glusterfs.enable = true;
-
-        # create a mount point for the volume
-        boot.initrd.postDeviceCommands = ''
-          ${pkgs.e2fsprogs}/bin/mkfs.ext4 -L data /dev/vdb
-        '';
-
-        virtualisation.emptyDiskImages = [ 1024 ];
-
-        virtualisation.fileSystems = {
-          "/data" = {
-            device = "/dev/disk/by-label/data";
-            fsType = "ext4";
-          };
-        };
-      };
-  in
-  {
-    name = "glusterfs";
-
-    nodes = {
-      server1 = server;
-      server2 = server;
-      client1 = client;
-      client2 = client;
     };
 
-    testScript = ''
-      server1.wait_for_unit("glusterd.service")
-      server2.wait_for_unit("glusterd.service")
+  server =
+    { pkgs, ... }:
+    {
+      networking.firewall.enable = false;
+      services.glusterfs.enable = true;
 
-      server1.wait_until_succeeds("gluster peer status")
-      server2.wait_until_succeeds("gluster peer status")
+      # create a mount point for the volume
+      boot.initrd.postDeviceCommands = ''
+        ${pkgs.e2fsprogs}/bin/mkfs.ext4 -L data /dev/vdb
+      '';
 
-      # establish initial contact
-      server1.succeed("gluster peer probe server2")
-      server1.succeed("gluster peer probe server1")
+      virtualisation.emptyDiskImages = [ 1024 ];
 
-      server1.succeed("gluster peer status | grep Connected")
+      virtualisation.fileSystems = {
+        "/data" = {
+          device = "/dev/disk/by-label/data";
+          fsType = "ext4";
+        };
+      };
+    };
+in
+{
+  name = "glusterfs";
 
-      # create volumes
-      server1.succeed("mkdir -p /data/vg0")
-      server2.succeed("mkdir -p /data/vg0")
-      server1.succeed("gluster volume create gv0 server1:/data/vg0 server2:/data/vg0")
-      server1.succeed("gluster volume start gv0")
+  nodes = {
+    server1 = server;
+    server2 = server;
+    client1 = client;
+    client2 = client;
+  };
 
-      # test clients
-      client1.wait_for_unit("gluster.mount")
-      client2.wait_for_unit("gluster.mount")
+  testScript = ''
+    server1.wait_for_unit("glusterd.service")
+    server2.wait_for_unit("glusterd.service")
 
-      client1.succeed("echo test > /gluster/file1")
-      client2.succeed("grep test /gluster/file1")
-    '';
-  }
-)
+    server1.wait_until_succeeds("gluster peer status")
+    server2.wait_until_succeeds("gluster peer status")
+
+    # establish initial contact
+    server1.succeed("gluster peer probe server2")
+    server1.succeed("gluster peer probe server1")
+
+    server1.succeed("gluster peer status | grep Connected")
+
+    # create volumes
+    server1.succeed("mkdir -p /data/vg0")
+    server2.succeed("mkdir -p /data/vg0")
+    server1.succeed("gluster volume create gv0 server1:/data/vg0 server2:/data/vg0")
+    server1.succeed("gluster volume start gv0")
+
+    # test clients
+    client1.wait_for_unit("gluster.mount")
+    client2.wait_for_unit("gluster.mount")
+
+    client1.succeed("echo test > /gluster/file1")
+    client2.succeed("grep test /gluster/file1")
+  '';
+}
diff --git a/nixos/tests/gnome-extensions.nix b/nixos/tests/gnome-extensions.nix
index d6381a899f3b..bde20a8c95aa 100644
--- a/nixos/tests/gnome-extensions.nix
+++ b/nixos/tests/gnome-extensions.nix
@@ -1,162 +1,160 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "gnome-extensions";
-    meta.maintainers = [ ];
+{ pkgs, lib, ... }:
+{
+  name = "gnome-extensions";
+  meta.maintainers = [ ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ./common/user-account.nix ];
+  node.pkgsReadOnly = false;
 
-        # Install all extensions
-        environment.systemPackages = lib.filter (e: e ? extensionUuid) (
-          lib.attrValues pkgs.gnomeExtensions
-        );
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/user-account.nix ];
 
-        # Some extensions are broken, but that's kind of the point of a testing VM
-        nixpkgs.config.allowBroken = true;
-        # There are some aliases which throw exceptions; ignore them.
-        # Also prevent duplicate extensions under different names.
-        nixpkgs.config.allowAliases = false;
+      # Install all extensions
+      environment.systemPackages = lib.filter (e: e ? extensionUuid) (
+        lib.attrValues pkgs.gnomeExtensions
+      );
 
-        # Configure GDM
-        services.xserver.enable = true;
-        services.xserver.displayManager = {
-          gdm = {
-            enable = true;
-            debug = true;
-            wayland = true;
-          };
-          autoLogin = {
-            enable = true;
-            user = "alice";
-          };
-        };
-
-        # Configure Gnome
-        services.xserver.desktopManager.gnome.enable = true;
-        services.xserver.desktopManager.gnome.debug = true;
-
-        systemd.user.services = {
-          "org.gnome.Shell@wayland" = {
-            serviceConfig = {
-              ExecStart = [
-                # Clear the list before overriding it.
-                ""
-                # Eval API is now internal so Shell needs to run in unsafe mode.
-                # TODO: improve test driver so that it supports openqa-like manipulation
-                # that would allow us to drop this mess.
-                "${pkgs.gnome-shell}/bin/gnome-shell --unsafe-mode"
-              ];
-            };
-          };
-        };
+      # Some extensions are broken, but that's kind of the point of a testing VM
+      nixpkgs.config.allowBroken = true;
+      # There are some aliases which throw exceptions; ignore them.
+      # Also prevent duplicate extensions under different names.
+      nixpkgs.config.allowAliases = false;
 
+      # Configure GDM
+      services.xserver.enable = true;
+      services.xserver.displayManager.gdm = {
+        enable = true;
+        debug = true;
+        wayland = true;
+      };
+      services.displayManager.autoLogin = {
+        enable = true;
+        user = "alice";
       };
 
-    testScript =
-      { nodes, ... }:
-      let
-        # Keep line widths somewhat manageable
-        user = nodes.machine.users.users.alice;
-        uid = toString user.uid;
-        bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus";
-        # Run a command in the appropriate user environment
-        run = command: "su - ${user.name} -c '${bus} ${command}'";
+      # Configure Gnome
+      services.desktopManager.gnome.enable = true;
+      services.desktopManager.gnome.debug = true;
 
-        # Call javascript in gnome shell, returns a tuple (success, output), where
-        # `success` is true if the dbus call was successful and output is what the
-        # javascript evaluates to.
-        eval =
-          command:
-          run "gdbus call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval ${command}";
+      systemd.user.services = {
+        "org.gnome.Shell@wayland" = {
+          serviceConfig = {
+            ExecStart = [
+              # Clear the list before overriding it.
+              ""
+              # Eval API is now internal so Shell needs to run in unsafe mode.
+              # TODO: improve test driver so that it supports openqa-like manipulation
+              # that would allow us to drop this mess.
+              "${pkgs.gnome-shell}/bin/gnome-shell --unsafe-mode"
+            ];
+          };
+        };
+      };
 
-        # False when startup is done
-        startingUp = eval "Main.layoutManager._startingUp";
+    };
 
-        # Extensions to keep always enabled together
-        # Those are extensions that are usually always on for many users, and that we expect to work
-        # well together with most others without conflicts
-        alwaysOnExtensions = map (name: pkgs.gnomeExtensions.${name}.extensionUuid) [
-          "applications-menu"
-          "user-themes"
-        ];
+  testScript =
+    { nodes, ... }:
+    let
+      # Keep line widths somewhat manageable
+      user = nodes.machine.users.users.alice;
+      uid = toString user.uid;
+      bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus";
+      # Run a command in the appropriate user environment
+      run = command: "su - ${user.name} -c '${bus} ${command}'";
 
-        # Extensions to enable and disable individually
-        # Extensions like dash-to-dock and dash-to-panel cannot be enabled at the same time.
-        testExtensions = map (name: pkgs.gnomeExtensions.${name}.extensionUuid) [
-          "appindicator"
-          "dash-to-dock"
-          "dash-to-panel"
-          "ddterm"
-          "gsconnect"
-          "system-monitor-next"
-          "desktop-icons-ng-ding"
-          "workspace-indicator"
-          "vitals"
-        ];
-      in
-      ''
-        with subtest("Login to GNOME with GDM"):
-            # wait for gdm to start
-            machine.wait_for_unit("display-manager.service")
-            # wait for the wayland server
-            machine.wait_for_file("/run/user/${uid}/wayland-0")
-            # wait for alice to be logged in
-            machine.wait_for_unit("default.target", "${user.name}")
-            # check that logging in has given the user ownership of devices
-            assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
+      # Call javascript in gnome shell, returns a tuple (success, output), where
+      # `success` is true if the dbus call was successful and output is what the
+      # javascript evaluates to.
+      eval =
+        command:
+        run "gdbus call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval ${command}";
 
-        with subtest("Wait for GNOME Shell"):
-            # correct output should be (true, 'false')
-            machine.wait_until_succeeds(
-                "${startingUp} | grep -q 'true,..false'"
-            )
+      # False when startup is done
+      startingUp = eval "Main.layoutManager._startingUp";
 
-            # Close the Activities view so that Shell can correctly track the focused window.
-            machine.send_key("esc")
-            # # Disable extension version validation (only use for manual testing)
-            # machine.succeed(
-            #   "${run "gsettings set org.gnome.shell disable-extension-version-validation true"}"
-            # )
+      # Extensions to keep always enabled together
+      # Those are extensions that are usually always on for many users, and that we expect to work
+      # well together with most others without conflicts
+      alwaysOnExtensions = map (name: pkgs.gnomeExtensions.${name}.extensionUuid) [
+        "applications-menu"
+        "user-themes"
+      ];
 
-        def getState(extension):
-            return machine.succeed(
-                f"${run "gnome-extensions info {extension}"} | grep '^  State: .*$'"
-            )
+      # Extensions to enable and disable individually
+      # Extensions like dash-to-dock and dash-to-panel cannot be enabled at the same time.
+      testExtensions = map (name: pkgs.gnomeExtensions.${name}.extensionUuid) [
+        "appindicator"
+        "dash-to-dock"
+        "dash-to-panel"
+        "ddterm"
+        "gsconnect"
+        "system-monitor-next"
+        "desktop-icons-ng-ding"
+        "workspace-indicator"
+        "vitals"
+      ];
+    in
+    ''
+      with subtest("Login to GNOME with GDM"):
+          # wait for gdm to start
+          machine.wait_for_unit("display-manager.service")
+          # wait for the wayland server
+          machine.wait_for_file("/run/user/${uid}/wayland-0")
+          # wait for alice to be logged in
+          machine.wait_for_unit("default.target", "${user.name}")
+          # check that logging in has given the user ownership of devices
+          assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
 
-        # Assert that some extension is in a specific state
-        def checkState(target, extension):
-            state = getState(extension)
-            assert target in state, f"{state} instead of {target}"
+      with subtest("Wait for GNOME Shell"):
+          # correct output should be (true, 'false')
+          machine.wait_until_succeeds(
+              "${startingUp} | grep -q 'true,..false'"
+          )
 
-        def checkExtension(extension, disable):
-            with subtest(f"Enable extension '{extension}'"):
-                # Check that the extension is properly initialized; skip out of date ones
-                state = machine.succeed(
-                    f"${run "gnome-extensions info {extension}"} | grep '^  State: .*$'"
-                )
-                if "OUT OF DATE" in state:
-                    machine.log(f"Extension {extension} will be skipped because out of date")
-                    return
+          # Close the Activities view so that Shell can correctly track the focused window.
+          machine.send_key("esc")
+          # # Disable extension version validation (only use for manual testing)
+          # machine.succeed(
+          #   "${run "gsettings set org.gnome.shell disable-extension-version-validation true"}"
+          # )
 
-                assert "INITIALIZED" in state, f"{state} instead of INITIALIZED"
+      def getState(extension):
+          return machine.succeed(
+              f"${run "gnome-extensions info {extension}"} | grep '^  State: .*$'"
+          )
 
-                # Enable and optionally disable
+      # Assert that some extension is in a specific state
+      def checkState(target, extension):
+          state = getState(extension)
+          assert target in state, f"{state} instead of {target}"
 
-                machine.succeed(f"${run "gnome-extensions enable {extension}"}")
-                wait_time = 5
-                while getState(extension) == "ACTIVATING" and (wait_time := wait_time - 1) > 0:
-                    machine.log(f"Extension {extension} is still activating, waiting {wait_time} more seconds")
-                    machine.sleep(1)
-                checkState("ACTIVE", extension)
+      def checkExtension(extension, disable):
+          with subtest(f"Enable extension '{extension}'"):
+              # Check that the extension is properly initialized; skip out of date ones
+              state = machine.succeed(
+                  f"${run "gnome-extensions info {extension}"} | grep '^  State: .*$'"
+              )
+              if "OUT OF DATE" in state:
+                  machine.log(f"Extension {extension} will be skipped because out of date")
+                  return
 
-                if disable:
-                    machine.succeed(f"${run "gnome-extensions disable {extension}"}")
-                    checkState("INACTIVE", extension)
-      ''
-      + lib.concatLines (map (e: ''checkExtension("${e}", False)'') alwaysOnExtensions)
-      + lib.concatLines (map (e: ''checkExtension("${e}", True)'') testExtensions);
-  }
-)
+              assert "INITIALIZED" in state, f"{state} instead of INITIALIZED"
+
+              # Enable and optionally disable
+
+              machine.succeed(f"${run "gnome-extensions enable {extension}"}")
+              wait_time = 5
+              while getState(extension) == "ACTIVATING" and (wait_time := wait_time - 1) > 0:
+                  machine.log(f"Extension {extension} is still activating, waiting {wait_time} more seconds")
+                  machine.sleep(1)
+              checkState("ACTIVE", extension)
+
+              if disable:
+                  machine.succeed(f"${run "gnome-extensions disable {extension}"}")
+                  checkState("INACTIVE", extension)
+    ''
+    + lib.concatLines (map (e: ''checkExtension("${e}", False)'') alwaysOnExtensions)
+    + lib.concatLines (map (e: ''checkExtension("${e}", True)'') testExtensions);
+}
diff --git a/nixos/tests/gnome-flashback.nix b/nixos/tests/gnome-flashback.nix
index b96245b4461e..6df6e621995e 100644
--- a/nixos/tests/gnome-flashback.nix
+++ b/nixos/tests/gnome-flashback.nix
@@ -1,61 +1,59 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "gnome-flashback";
-    meta.maintainers = lib.teams.gnome.members ++ [ lib.maintainers.chpatrick ];
+{ pkgs, lib, ... }:
+{
+  name = "gnome-flashback";
+  meta.maintainers = lib.teams.gnome.members ++ [ lib.maintainers.chpatrick ];
 
-    nodes.machine =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-      in
+  nodes.machine =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+    in
 
-      {
-        imports = [ ./common/user-account.nix ];
+    {
+      imports = [ ./common/user-account.nix ];
 
-        services.xserver.enable = true;
+      services.xserver.enable = true;
 
-        services.xserver.displayManager = {
-          gdm.enable = true;
-          gdm.debug = true;
-        };
-
-        services.displayManager.autoLogin = {
-          enable = true;
-          user = user.name;
-        };
-
-        services.xserver.desktopManager.gnome.enable = true;
-        services.xserver.desktopManager.gnome.debug = true;
-        services.xserver.desktopManager.gnome.flashback.enableMetacity = true;
-        services.displayManager.defaultSession = "gnome-flashback-metacity";
+      services.displayManager.gdm = {
+        enable = true;
+        debug = true;
       };
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-        uid = toString user.uid;
-        xauthority = "/run/user/${uid}/gdm/Xauthority";
-      in
-      ''
-        with subtest("Login to GNOME Flashback with GDM"):
-            machine.wait_for_x()
-            machine.wait_until_succeeds('journalctl -t gnome-session-binary --grep "Entering running state"')
-            # Wait for alice to be logged in"
-            machine.wait_for_unit("default.target", "${user.name}")
-            machine.wait_for_file("${xauthority}")
-            machine.succeed("xauth merge ${xauthority}")
-            # Check that logging in has given the user ownership of devices
-            assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
+      services.displayManager.autoLogin = {
+        enable = true;
+        user = user.name;
+      };
 
-        with subtest("Wait for Metacity"):
-            machine.wait_until_succeeds("pgrep metacity")
+      services.desktopManager.gnome.enable = true;
+      services.desktopManager.gnome.debug = true;
+      services.desktopManager.gnome.flashback.enableMetacity = true;
+      services.displayManager.defaultSession = "gnome-flashback-metacity";
+    };
 
-        with subtest("Regression test for #233920"):
-            machine.wait_until_succeeds("pgrep -fa gnome-flashback-media-keys")
-            machine.sleep(20)
-            machine.screenshot("screen")
-      '';
-  }
-)
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+      uid = toString user.uid;
+      xauthority = "/run/user/${uid}/gdm/Xauthority";
+    in
+    ''
+      with subtest("Login to GNOME Flashback with GDM"):
+          machine.wait_for_x()
+          machine.wait_until_succeeds('journalctl -t gnome-session-binary --grep "Entering running state"')
+          # Wait for alice to be logged in"
+          machine.wait_for_unit("default.target", "${user.name}")
+          machine.wait_for_file("${xauthority}")
+          machine.succeed("xauth merge ${xauthority}")
+          # Check that logging in has given the user ownership of devices
+          assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
+
+      with subtest("Wait for Metacity"):
+          machine.wait_until_succeeds("pgrep metacity")
+
+      with subtest("Regression test for #233920"):
+          machine.wait_until_succeeds("pgrep -fa gnome-flashback-media-keys")
+          machine.sleep(20)
+          machine.screenshot("screen")
+    '';
+}
diff --git a/nixos/tests/gnome-xorg.nix b/nixos/tests/gnome-xorg.nix
index b605781ce40f..82d3bf3e08ce 100644
--- a/nixos/tests/gnome-xorg.nix
+++ b/nixos/tests/gnome-xorg.nix
@@ -1,111 +1,109 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "gnome-xorg";
-    meta = {
-      maintainers = lib.teams.gnome.members;
-    };
+{ pkgs, lib, ... }:
+{
+  name = "gnome-xorg";
+  meta = {
+    maintainers = lib.teams.gnome.members;
+  };
 
-    nodes.machine =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-      in
+  nodes.machine =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+    in
 
-      {
-        imports = [ ./common/user-account.nix ];
+    {
+      imports = [ ./common/user-account.nix ];
 
-        services.xserver.enable = true;
-
-        services.xserver.displayManager = {
-          gdm.enable = true;
-          gdm.debug = true;
-        };
-
-        services.displayManager.autoLogin = {
-          enable = true;
-          user = user.name;
-        };
-
-        services.xserver.desktopManager.gnome.enable = true;
-        services.xserver.desktopManager.gnome.debug = true;
-        services.displayManager.defaultSession = "gnome-xorg";
-
-        systemd.user.services = {
-          "org.gnome.Shell@x11" = {
-            serviceConfig = {
-              ExecStart = [
-                # Clear the list before overriding it.
-                ""
-                # Eval API is now internal so Shell needs to run in unsafe mode.
-                # TODO: improve test driver so that it supports openqa-like manipulation
-                # that would allow us to drop this mess.
-                "${pkgs.gnome-shell}/bin/gnome-shell --unsafe-mode"
-              ];
-            };
-          };
-        };
+      services.xserver.enable = true;
 
+      services.displayManager.gdm = {
+        enable = true;
+        debug = true;
       };
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-        uid = toString user.uid;
-        bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus";
-        xauthority = "/run/user/${uid}/gdm/Xauthority";
-        display = "DISPLAY=:0.0";
-        env = "${bus} XAUTHORITY=${xauthority} ${display}";
-        # Run a command in the appropriate user environment
-        run = command: "su - ${user.name} -c '${bus} ${command}'";
+      services.displayManager.autoLogin = {
+        enable = true;
+        user = user.name;
+      };
 
-        # Call javascript in gnome shell, returns a tuple (success, output), where
-        # `success` is true if the dbus call was successful and output is what the
-        # javascript evaluates to.
-        eval =
-          command:
-          run "gdbus call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval ${command}";
+      services.desktopManager.gnome.enable = true;
+      services.desktopManager.gnome.debug = true;
+      services.displayManager.defaultSession = "gnome-xorg";
 
-        # False when startup is done
-        startingUp = eval "Main.layoutManager._startingUp";
+      systemd.user.services = {
+        "org.gnome.Shell@x11" = {
+          serviceConfig = {
+            ExecStart = [
+              # Clear the list before overriding it.
+              ""
+              # Eval API is now internal so Shell needs to run in unsafe mode.
+              # TODO: improve test driver so that it supports openqa-like manipulation
+              # that would allow us to drop this mess.
+              "${pkgs.gnome-shell}/bin/gnome-shell --unsafe-mode"
+            ];
+          };
+        };
+      };
 
-        # Start Console
-        launchConsole = run "gapplication launch org.gnome.Console";
+    };
 
-        # Hopefully Console's wm class
-        wmClass = eval "global.display.focus_window.wm_class";
-      in
-      ''
-        with subtest("Login to GNOME Xorg with GDM"):
-            machine.wait_for_x()
-            # Wait for alice to be logged in"
-            machine.wait_for_unit("default.target", "${user.name}")
-            machine.wait_for_file("${xauthority}")
-            machine.succeed("xauth merge ${xauthority}")
-            # Check that logging in has given the user ownership of devices
-            assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+      uid = toString user.uid;
+      bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus";
+      xauthority = "/run/user/${uid}/gdm/Xauthority";
+      display = "DISPLAY=:0.0";
+      env = "${bus} XAUTHORITY=${xauthority} ${display}";
+      # Run a command in the appropriate user environment
+      run = command: "su - ${user.name} -c '${bus} ${command}'";
 
-        with subtest("Wait for GNOME Shell"):
-            # correct output should be (true, 'false')
-            machine.wait_until_succeeds(
-                "${startingUp} | grep -q 'true,..false'"
-            )
+      # Call javascript in gnome shell, returns a tuple (success, output), where
+      # `success` is true if the dbus call was successful and output is what the
+      # javascript evaluates to.
+      eval =
+        command:
+        run "gdbus call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval ${command}";
 
-        with subtest("Open Console"):
-            # Close the Activities view so that Shell can correctly track the focused window.
-            machine.send_key("esc")
+      # False when startup is done
+      startingUp = eval "Main.layoutManager._startingUp";
 
-            machine.succeed(
-                "${launchConsole}"
-            )
-            # correct output should be (true, '"kgx"')
-            # For some reason, this deviates from Wayland.
-            machine.wait_until_succeeds(
-                "${wmClass} | grep -q  'true,...kgx'"
-            )
-            machine.sleep(20)
-            machine.screenshot("screen")
-      '';
-  }
-)
+      # Start Console
+      launchConsole = run "gapplication launch org.gnome.Console";
+
+      # Hopefully Console's wm class
+      wmClass = eval "global.display.focus_window.wm_class";
+    in
+    ''
+      with subtest("Login to GNOME Xorg with GDM"):
+          machine.wait_for_x()
+          # Wait for alice to be logged in"
+          machine.wait_for_unit("default.target", "${user.name}")
+          machine.wait_for_file("${xauthority}")
+          machine.succeed("xauth merge ${xauthority}")
+          # Check that logging in has given the user ownership of devices
+          assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
+
+      with subtest("Wait for GNOME Shell"):
+          # correct output should be (true, 'false')
+          machine.wait_until_succeeds(
+              "${startingUp} | grep -q 'true,..false'"
+          )
+
+      with subtest("Open Console"):
+          # Close the Activities view so that Shell can correctly track the focused window.
+          machine.send_key("esc")
+
+          machine.succeed(
+              "${launchConsole}"
+          )
+          # correct output should be (true, '"kgx"')
+          # For some reason, this deviates from Wayland.
+          machine.wait_until_succeeds(
+              "${wmClass} | grep -q  'true,...kgx'"
+          )
+          machine.sleep(20)
+          machine.screenshot("screen")
+    '';
+}
diff --git a/nixos/tests/gnome.nix b/nixos/tests/gnome.nix
index 17fdcf550ca3..4d1b4c71ecd2 100644
--- a/nixos/tests/gnome.nix
+++ b/nixos/tests/gnome.nix
@@ -11,9 +11,9 @@
 
       services.xserver.enable = true;
 
-      services.xserver.displayManager = {
-        gdm.enable = true;
-        gdm.debug = true;
+      services.displayManager.gdm = {
+        enable = true;
+        debug = true;
       };
 
       services.displayManager.autoLogin = {
@@ -21,8 +21,8 @@
         user = "alice";
       };
 
-      services.xserver.desktopManager.gnome.enable = true;
-      services.xserver.desktopManager.gnome.debug = true;
+      services.desktopManager.gnome.enable = true;
+      services.desktopManager.gnome.debug = true;
 
       systemd.user.services = {
         "org.gnome.Shell@wayland" = {
diff --git a/nixos/tests/gns3-server.nix b/nixos/tests/gns3-server.nix
index 309b83053b8d..19aa1e984ed7 100644
--- a/nixos/tests/gns3-server.nix
+++ b/nixos/tests/gns3-server.nix
@@ -1,62 +1,60 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "gns3-server";
-    meta.maintainers = [ lib.maintainers.anthonyroussel ];
+{ pkgs, lib, ... }:
+{
+  name = "gns3-server";
+  meta.maintainers = [ lib.maintainers.anthonyroussel ];
 
-    nodes.machine =
-      { ... }:
-      let
-        tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
-          openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 365 \
-            -subj '/CN=localhost'
-          install -D -t $out key.pem cert.pem
-        '';
-      in
-      {
-        services.gns3-server = {
+  nodes.machine =
+    { ... }:
+    let
+      tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+        openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 365 \
+          -subj '/CN=localhost'
+        install -D -t $out key.pem cert.pem
+      '';
+    in
+    {
+      services.gns3-server = {
+        enable = true;
+        auth = {
           enable = true;
-          auth = {
-            enable = true;
-            user = "user";
-            passwordFile = pkgs.writeText "gns3-auth-password-file" "password";
-          };
-          ssl = {
-            enable = true;
-            certFile = "${tls-cert}/cert.pem";
-            keyFile = "${tls-cert}/key.pem";
-          };
-          dynamips.enable = true;
-          ubridge.enable = true;
-          vpcs.enable = true;
+          user = "user";
+          passwordFile = pkgs.writeText "gns3-auth-password-file" "password";
         };
-
-        security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
+        ssl = {
+          enable = true;
+          certFile = "${tls-cert}/cert.pem";
+          keyFile = "${tls-cert}/key.pem";
+        };
+        dynamips.enable = true;
+        ubridge.enable = true;
+        vpcs.enable = true;
       };
 
-    testScript =
-      let
-        createProject = pkgs.writeText "createProject.json" (
-          builtins.toJSON {
-            name = "test_project";
-          }
-        );
-      in
-      ''
-        start_all()
+      security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
+    };
 
-        machine.wait_for_unit("gns3-server.service")
-        machine.wait_for_open_port(3080)
+  testScript =
+    let
+      createProject = pkgs.writeText "createProject.json" (
+        builtins.toJSON {
+          name = "test_project";
+        }
+      );
+    in
+    ''
+      start_all()
 
-        with subtest("server is listening"):
-          machine.succeed("curl -sSfL -u user:password https://localhost:3080/v2/version")
+      machine.wait_for_unit("gns3-server.service")
+      machine.wait_for_open_port(3080)
 
-        with subtest("create dummy project"):
-          machine.succeed("curl -sSfL -u user:password https://localhost:3080/v2/projects -d @${createProject}")
+      with subtest("server is listening"):
+        machine.succeed("curl -sSfL -u user:password https://localhost:3080/v2/version")
 
-        with subtest("logging works"):
-          log_path = "/var/log/gns3/server.log"
-          machine.wait_for_file(log_path)
-      '';
-  }
-)
+      with subtest("create dummy project"):
+        machine.succeed("curl -sSfL -u user:password https://localhost:3080/v2/projects -d @${createProject}")
+
+      with subtest("logging works"):
+        log_path = "/var/log/gns3/server.log"
+        machine.wait_for_file(log_path)
+    '';
+}
diff --git a/nixos/tests/gnupg.nix b/nixos/tests/gnupg.nix
index 897c94aba507..1c720b2d6b84 100644
--- a/nixos/tests/gnupg.nix
+++ b/nixos/tests/gnupg.nix
@@ -1,127 +1,125 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  {
-    name = "gnupg";
-    meta = with lib.maintainers; {
-      maintainers = [ rnhmjoj ];
+{
+  name = "gnupg";
+  meta = with lib.maintainers; {
+    maintainers = [ rnhmjoj ];
+  };
+
+  # server for testing SSH
+  nodes.server =
+    { ... }:
+    {
+      imports = [ ../modules/profiles/minimal.nix ];
+
+      users.users.alice.isNormalUser = true;
+      services.openssh.enable = true;
     };
 
-    # server for testing SSH
-    nodes.server =
-      { ... }:
-      {
-        imports = [ ../modules/profiles/minimal.nix ];
+  # machine for testing GnuPG
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ../modules/profiles/minimal.nix ];
 
-        users.users.alice.isNormalUser = true;
-        services.openssh.enable = true;
-      };
+      users.users.alice.isNormalUser = true;
+      services.getty.autologinUser = "alice";
 
-    # machine for testing GnuPG
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ../modules/profiles/minimal.nix ];
+      environment.shellInit = ''
+        # preset a key passphrase in gpg-agent
+        preset_key() {
+          # find all keys
+          case "$1" in
+            ssh) grips=$(awk '/^[0-9A-F]/{print $1}' "''${GNUPGHOME:-$HOME/.gnupg}/sshcontrol") ;;
+            pgp) grips=$(gpg --with-keygrip --list-secret-keys | awk '/Keygrip/{print $3}') ;;
+          esac
 
-        users.users.alice.isNormalUser = true;
-        services.getty.autologinUser = "alice";
+          # try to preset the passphrase for each key found
+          for grip in $grips; do
+            "$(gpgconf --list-dirs libexecdir)/gpg-preset-passphrase" -c -P "$2" "$grip"
+          done
+        }
+      '';
 
-        environment.shellInit = ''
-          # preset a key passphrase in gpg-agent
-          preset_key() {
-            # find all keys
-            case "$1" in
-              ssh) grips=$(awk '/^[0-9A-F]/{print $1}' "''${GNUPGHOME:-$HOME/.gnupg}/sshcontrol") ;;
-              pgp) grips=$(gpg --with-keygrip --list-secret-keys | awk '/Keygrip/{print $3}') ;;
-            esac
+      programs.gnupg.agent.enable = true;
+      programs.gnupg.agent.enableSSHSupport = true;
+    };
 
-            # try to preset the passphrase for each key found
-            for grip in $grips; do
-              "$(gpgconf --list-dirs libexecdir)/gpg-preset-passphrase" -c -P "$2" "$grip"
-            done
-          }
-        '';
-
-        programs.gnupg.agent.enable = true;
-        programs.gnupg.agent.enableSSHSupport = true;
-      };
-
-    testScript = ''
-      import shlex
+  testScript = ''
+    import shlex
 
 
-      def as_alice(command: str) -> str:
-          """
-          Wraps a command to run it as Alice in a login shell
-          """
-          quoted = shlex.quote(command)
-          return "su --login alice --command " + quoted
+    def as_alice(command: str) -> str:
+        """
+        Wraps a command to run it as Alice in a login shell
+        """
+        quoted = shlex.quote(command)
+        return "su --login alice --command " + quoted
 
 
-      start_all()
+    start_all()
 
-      with subtest("Wait for the autologin"):
-          machine.wait_until_tty_matches("1", "alice@machine")
+    with subtest("Wait for the autologin"):
+        machine.wait_until_tty_matches("1", "alice@machine")
 
-      with subtest("Can generate a PGP key"):
-          # Note: this needs a tty because of pinentry
-          machine.send_chars("gpg --gen-key\n")
-          machine.wait_until_tty_matches("1", "Real name:")
-          machine.send_chars("Alice\n")
-          machine.wait_until_tty_matches("1", "Email address:")
-          machine.send_chars("alice@machine\n")
-          machine.wait_until_tty_matches("1", "Change")
-          machine.send_chars("O\n")
-          machine.wait_until_tty_matches("1", "Please enter")
-          machine.send_chars("pgp_p4ssphrase")
-          machine.send_key("tab")
-          machine.send_chars("pgp_p4ssphrase")
-          machine.wait_until_tty_matches("1", "Passphrases match")
-          machine.send_chars("\n")
-          machine.wait_until_tty_matches("1", "public and secret key created")
+    with subtest("Can generate a PGP key"):
+        # Note: this needs a tty because of pinentry
+        machine.send_chars("gpg --gen-key\n")
+        machine.wait_until_tty_matches("1", "Real name:")
+        machine.send_chars("Alice\n")
+        machine.wait_until_tty_matches("1", "Email address:")
+        machine.send_chars("alice@machine\n")
+        machine.wait_until_tty_matches("1", "Change")
+        machine.send_chars("O\n")
+        machine.wait_until_tty_matches("1", "Please enter")
+        machine.send_chars("pgp_p4ssphrase")
+        machine.send_key("tab")
+        machine.send_chars("pgp_p4ssphrase")
+        machine.wait_until_tty_matches("1", "Passphrases match")
+        machine.send_chars("\n")
+        machine.wait_until_tty_matches("1", "public and secret key created")
 
-      with subtest("Confirm the key is in the keyring"):
-          machine.wait_until_succeeds(as_alice("gpg --list-secret-keys | grep -q alice@machine"))
+    with subtest("Confirm the key is in the keyring"):
+        machine.wait_until_succeeds(as_alice("gpg --list-secret-keys | grep -q alice@machine"))
 
-      with subtest("Can generate and add an SSH key"):
-          machine.succeed(as_alice("ssh-keygen -t ed25519 -f alice -N ssh_p4ssphrase"))
+    with subtest("Can generate and add an SSH key"):
+        machine.succeed(as_alice("ssh-keygen -t ed25519 -f alice -N ssh_p4ssphrase"))
 
-          # Note: apparently this must be run before using the OpenSSH agent
-          # socket for the first time in a tty. It's not needed for `ssh`
-          # because there's a hook that calls it automatically (only in NixOS).
-          machine.send_chars("gpg-connect-agent updatestartuptty /bye\n")
+        # Note: apparently this must be run before using the OpenSSH agent
+        # socket for the first time in a tty. It's not needed for `ssh`
+        # because there's a hook that calls it automatically (only in NixOS).
+        machine.send_chars("gpg-connect-agent updatestartuptty /bye\n")
 
-          # Note: again, this needs a tty because of pinentry
-          machine.send_chars("ssh-add alice\n")
-          machine.wait_until_tty_matches("1", "Enter passphrase")
-          machine.send_chars("ssh_p4ssphrase\n")
-          machine.wait_until_tty_matches("1", "Please enter")
-          machine.send_chars("ssh_agent_p4ssphrase")
-          machine.send_key("tab")
-          machine.send_chars("ssh_agent_p4ssphrase")
-          machine.wait_until_tty_matches("1", "Passphrases match")
-          machine.send_chars("\n")
+        # Note: again, this needs a tty because of pinentry
+        machine.send_chars("ssh-add alice\n")
+        machine.wait_until_tty_matches("1", "Enter passphrase")
+        machine.send_chars("ssh_p4ssphrase\n")
+        machine.wait_until_tty_matches("1", "Please enter")
+        machine.send_chars("ssh_agent_p4ssphrase")
+        machine.send_key("tab")
+        machine.send_chars("ssh_agent_p4ssphrase")
+        machine.wait_until_tty_matches("1", "Passphrases match")
+        machine.send_chars("\n")
 
-      with subtest("Confirm the SSH key has been registered"):
-          machine.wait_until_succeeds(as_alice("ssh-add -l | grep -q alice@machine"))
+    with subtest("Confirm the SSH key has been registered"):
+        machine.wait_until_succeeds(as_alice("ssh-add -l | grep -q alice@machine"))
 
-      with subtest("Can preset the key passphrases in the agent"):
-          machine.succeed(as_alice("echo allow-preset-passphrase > .gnupg/gpg-agent.conf"))
-          machine.succeed(as_alice("pkill gpg-agent"))
-          machine.succeed(as_alice("preset_key pgp pgp_p4ssphrase"))
-          machine.succeed(as_alice("preset_key ssh ssh_agent_p4ssphrase"))
+    with subtest("Can preset the key passphrases in the agent"):
+        machine.succeed(as_alice("echo allow-preset-passphrase > .gnupg/gpg-agent.conf"))
+        machine.succeed(as_alice("pkill gpg-agent"))
+        machine.succeed(as_alice("preset_key pgp pgp_p4ssphrase"))
+        machine.succeed(as_alice("preset_key ssh ssh_agent_p4ssphrase"))
 
-      with subtest("Can encrypt and decrypt a message"):
-          machine.succeed(as_alice("echo Hello | gpg -e -r alice | gpg -d | grep -q Hello"))
+    with subtest("Can encrypt and decrypt a message"):
+        machine.succeed(as_alice("echo Hello | gpg -e -r alice | gpg -d | grep -q Hello"))
 
-      with subtest("Can log into the server"):
-          # Install Alice's public key
-          public_key = machine.succeed(as_alice("cat alice.pub"))
-          server.succeed("mkdir /etc/ssh/authorized_keys.d")
-          server.succeed(f"printf '{public_key}' > /etc/ssh/authorized_keys.d/alice")
+    with subtest("Can log into the server"):
+        # Install Alice's public key
+        public_key = machine.succeed(as_alice("cat alice.pub"))
+        server.succeed("mkdir /etc/ssh/authorized_keys.d")
+        server.succeed(f"printf '{public_key}' > /etc/ssh/authorized_keys.d/alice")
 
-          server.wait_for_open_port(22)
-          machine.succeed(as_alice("ssh -i alice -o StrictHostKeyChecking=no server exit"))
-    '';
-  }
-)
+        server.wait_for_open_port(22)
+        machine.succeed(as_alice("ssh -i alice -o StrictHostKeyChecking=no server exit"))
+  '';
+}
diff --git a/nixos/tests/goatcounter.nix b/nixos/tests/goatcounter.nix
index ee3b373383e2..b3dfe6f267f7 100644
--- a/nixos/tests/goatcounter.nix
+++ b/nixos/tests/goatcounter.nix
@@ -1,32 +1,30 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  {
-    name = "goatcounter";
+{
+  name = "goatcounter";
 
-    meta.maintainers = with lib.maintainers; [ bhankas ];
+  meta.maintainers = with lib.maintainers; [ bhankas ];
 
-    nodes.machine =
-      { config, ... }:
-      {
-        virtualisation.memorySize = 2048;
+  nodes.machine =
+    { config, ... }:
+    {
+      virtualisation.memorySize = 2048;
 
-        services.goatcounter = {
-          enable = true;
-          proxy = true;
-        };
+      services.goatcounter = {
+        enable = true;
+        proxy = true;
       };
+    };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("goatcounter.service")
-      # wait for goatcounter to fully come up
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("goatcounter.service")
+    # wait for goatcounter to fully come up
 
-      with subtest("goatcounter service starts"):
-          machine.wait_until_succeeds(
-              "curl -sSfL http://localhost:8081/ > /dev/null",
-              timeout=30
-          )
-    '';
-  }
-)
+    with subtest("goatcounter service starts"):
+        machine.wait_until_succeeds(
+            "curl -sSfL http://localhost:8081/ > /dev/null",
+            timeout=30
+        )
+  '';
+}
diff --git a/nixos/tests/gobgpd.nix b/nixos/tests/gobgpd.nix
index 029b486b7cc6..8491e1893403 100644
--- a/nixos/tests/gobgpd.nix
+++ b/nixos/tests/gobgpd.nix
@@ -1,87 +1,85 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    ifAddr =
-      node: iface: (pkgs.lib.head node.config.networking.interfaces.${iface}.ipv4.addresses).address;
-  in
-  {
-    name = "gobgpd";
+{ pkgs, ... }:
+let
+  ifAddr =
+    node: iface: (pkgs.lib.head node.config.networking.interfaces.${iface}.ipv4.addresses).address;
+in
+{
+  name = "gobgpd";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ higebu ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ higebu ];
+  };
 
-    nodes = {
-      node1 =
-        { nodes, ... }:
-        {
-          environment.systemPackages = [ pkgs.gobgp ];
-          networking.firewall.allowedTCPPorts = [ 179 ];
-          services.gobgpd = {
-            enable = true;
-            settings = {
-              global = {
-                config = {
-                  as = 64512;
-                  router-id = "192.168.255.1";
-                };
-              };
-              neighbors = [
-                {
-                  config = {
-                    neighbor-address = ifAddr nodes.node2 "eth1";
-                    peer-as = 64513;
-                  };
-                }
-              ];
-            };
-          };
-        };
-      node2 =
-        { nodes, ... }:
-        {
-          environment.systemPackages = [ pkgs.gobgp ];
-          networking.firewall.allowedTCPPorts = [ 179 ];
-          services.gobgpd = {
-            enable = true;
-            settings = {
-              global = {
-                config = {
-                  as = 64513;
-                  router-id = "192.168.255.2";
-                };
-              };
-              neighbors = [
-                {
-                  config = {
-                    neighbor-address = ifAddr nodes.node1 "eth1";
-                    peer-as = 64512;
-                  };
-                }
-              ];
-            };
-          };
-        };
-    };
-
-    testScript =
+  nodes = {
+    node1 =
       { nodes, ... }:
-      let
-        addr1 = ifAddr nodes.node1 "eth1";
-        addr2 = ifAddr nodes.node2 "eth1";
-      in
-      ''
-        start_all()
+      {
+        environment.systemPackages = [ pkgs.gobgp ];
+        networking.firewall.allowedTCPPorts = [ 179 ];
+        services.gobgpd = {
+          enable = true;
+          settings = {
+            global = {
+              config = {
+                as = 64512;
+                router-id = "192.168.255.1";
+              };
+            };
+            neighbors = [
+              {
+                config = {
+                  neighbor-address = ifAddr nodes.node2 "eth1";
+                  peer-as = 64513;
+                };
+              }
+            ];
+          };
+        };
+      };
+    node2 =
+      { nodes, ... }:
+      {
+        environment.systemPackages = [ pkgs.gobgp ];
+        networking.firewall.allowedTCPPorts = [ 179 ];
+        services.gobgpd = {
+          enable = true;
+          settings = {
+            global = {
+              config = {
+                as = 64513;
+                router-id = "192.168.255.2";
+              };
+            };
+            neighbors = [
+              {
+                config = {
+                  neighbor-address = ifAddr nodes.node1 "eth1";
+                  peer-as = 64512;
+                };
+              }
+            ];
+          };
+        };
+      };
+  };
 
-        for node in node1, node2:
-            with subtest("should start gobgpd node"):
-                node.wait_for_unit("gobgpd.service")
-            with subtest("should open port 179"):
-                node.wait_for_open_port(179)
+  testScript =
+    { nodes, ... }:
+    let
+      addr1 = ifAddr nodes.node1 "eth1";
+      addr2 = ifAddr nodes.node2 "eth1";
+    in
+    ''
+      start_all()
 
-        with subtest("should show neighbors by gobgp cli and BGP state should be ESTABLISHED"):
-            node1.wait_until_succeeds("gobgp neighbor ${addr2} | grep -q ESTABLISHED")
-            node2.wait_until_succeeds("gobgp neighbor ${addr1} | grep -q ESTABLISHED")
-      '';
-  }
-)
+      for node in node1, node2:
+          with subtest("should start gobgpd node"):
+              node.wait_for_unit("gobgpd.service")
+          with subtest("should open port 179"):
+              node.wait_for_open_port(179)
+
+      with subtest("should show neighbors by gobgp cli and BGP state should be ESTABLISHED"):
+          node1.wait_until_succeeds("gobgp neighbor ${addr2} | grep -q ESTABLISHED")
+          node2.wait_until_succeeds("gobgp neighbor ${addr1} | grep -q ESTABLISHED")
+    '';
+}
diff --git a/nixos/tests/gocd-agent.nix b/nixos/tests/gocd-agent.nix
index d717299d55c7..674bc2374fd1 100644
--- a/nixos/tests/gocd-agent.nix
+++ b/nixos/tests/gocd-agent.nix
@@ -9,46 +9,44 @@ let
   header = "Accept: application/vnd.go.cd.v2+json";
 in
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "gocd-agent";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        grahamc
-        swarren83
-      ];
+{ pkgs, ... }:
+{
+  name = "gocd-agent";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      grahamc
+      swarren83
+    ];
 
-      # gocd agent needs to register with the autoregister key created on first server startup,
-      # but NixOS module doesn't seem to allow to pass during runtime currently
-      broken = true;
-    };
+    # gocd agent needs to register with the autoregister key created on first server startup,
+    # but NixOS module doesn't seem to allow to pass during runtime currently
+    broken = true;
+  };
 
-    nodes = {
-      agent =
-        { ... }:
-        {
-          virtualisation.memorySize = 2046;
-          services.gocd-agent = {
-            enable = true;
-          };
-          services.gocd-server = {
-            enable = true;
-          };
+  nodes = {
+    agent =
+      { ... }:
+      {
+        virtualisation.memorySize = 2046;
+        services.gocd-agent = {
+          enable = true;
         };
-    };
+        services.gocd-server = {
+          enable = true;
+        };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      agent.wait_for_unit("gocd-server")
-      agent.wait_for_open_port(8153)
-      agent.wait_for_unit("gocd-agent")
-      agent.wait_until_succeeds(
-          "curl ${serverUrl} -H '${header}' | ${pkgs.jq}/bin/jq -e ._embedded.agents[0].uuid"
-      )
-      agent.succeed(
-          "curl ${serverUrl} -H '${header}' | ${pkgs.jq}/bin/jq -e ._embedded.agents[0].agent_state | grep Idle"
-      )
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    agent.wait_for_unit("gocd-server")
+    agent.wait_for_open_port(8153)
+    agent.wait_for_unit("gocd-agent")
+    agent.wait_until_succeeds(
+        "curl ${serverUrl} -H '${header}' | ${pkgs.jq}/bin/jq -e ._embedded.agents[0].uuid"
+    )
+    agent.succeed(
+        "curl ${serverUrl} -H '${header}' | ${pkgs.jq}/bin/jq -e ._embedded.agents[0].agent_state | grep Idle"
+    )
+  '';
+}
diff --git a/nixos/tests/gocd-server.nix b/nixos/tests/gocd-server.nix
index 95b126c55a52..cffd9f50aedd 100644
--- a/nixos/tests/gocd-server.nix
+++ b/nixos/tests/gocd-server.nix
@@ -2,29 +2,27 @@
 #   1. GoCD server starts
 #   2. GoCD server responds
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "gocd-server";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ swarren83 ];
-    };
+{
+  name = "gocd-server";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ swarren83 ];
+  };
 
-    nodes = {
-      server =
-        { ... }:
-        {
-          virtualisation.memorySize = 2046;
-          services.gocd-server.enable = true;
-        };
-    };
+  nodes = {
+    server =
+      { ... }:
+      {
+        virtualisation.memorySize = 2046;
+        services.gocd-server.enable = true;
+      };
+  };
 
-    testScript = ''
-      server.start()
-      server.wait_for_unit("gocd-server")
-      server.wait_for_open_port(8153)
-      server.wait_until_succeeds("curl -s -f localhost:8153/go")
-    '';
-  }
-)
+  testScript = ''
+    server.start()
+    server.wait_for_unit("gocd-server")
+    server.wait_for_open_port(8153)
+    server.wait_until_succeeds("curl -s -f localhost:8153/go")
+  '';
+}
diff --git a/nixos/tests/gollum.nix b/nixos/tests/gollum.nix
index ab937bc990bb..bf42ccc35e30 100644
--- a/nixos/tests/gollum.nix
+++ b/nixos/tests/gollum.nix
@@ -1,21 +1,19 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "gollum";
+{ pkgs, ... }:
+{
+  name = "gollum";
 
-    nodes = {
-      webserver =
-        { pkgs, lib, ... }:
-        {
-          services.gollum.enable = true;
-        };
-    };
+  nodes = {
+    webserver =
+      { pkgs, lib, ... }:
+      {
+        services.gollum.enable = true;
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        webserver.wait_for_unit("gollum")
-        webserver.wait_for_open_port(${toString nodes.webserver.services.gollum.port})
-      '';
-  }
-)
+  testScript =
+    { nodes, ... }:
+    ''
+      webserver.wait_for_unit("gollum")
+      webserver.wait_for_open_port(${toString nodes.webserver.services.gollum.port})
+    '';
+}
diff --git a/nixos/tests/gonic.nix b/nixos/tests/gonic.nix
index 47d432d6354a..836e7167035f 100644
--- a/nixos/tests/gonic.nix
+++ b/nixos/tests/gonic.nix
@@ -1,31 +1,29 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "gonic";
+{ pkgs, ... }:
+{
+  name = "gonic";
 
-    nodes.machine =
-      { ... }:
-      {
-        systemd.tmpfiles.settings = {
-          "10-gonic" = {
-            "/tmp/music"."d" = { };
-            "/tmp/podcast"."d" = { };
-            "/tmp/playlists"."d" = { };
-          };
-        };
-        services.gonic = {
-          enable = true;
-          settings = {
-            music-path = [ "/tmp/music" ];
-            podcast-path = "/tmp/podcast";
-            playlists-path = "/tmp/playlists";
-          };
+  nodes.machine =
+    { ... }:
+    {
+      systemd.tmpfiles.settings = {
+        "10-gonic" = {
+          "/tmp/music"."d" = { };
+          "/tmp/podcast"."d" = { };
+          "/tmp/playlists"."d" = { };
         };
       };
+      services.gonic = {
+        enable = true;
+        settings = {
+          music-path = [ "/tmp/music" ];
+          podcast-path = "/tmp/podcast";
+          playlists-path = "/tmp/playlists";
+        };
+      };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("gonic")
-      machine.wait_for_open_port(4747)
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("gonic")
+    machine.wait_for_open_port(4747)
+  '';
+}
diff --git a/nixos/tests/gopro-tool.nix b/nixos/tests/gopro-tool.nix
index 1f183e4c30d5..e52a6106ee41 100644
--- a/nixos/tests/gopro-tool.nix
+++ b/nixos/tests/gopro-tool.nix
@@ -1,41 +1,39 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  let
-    testScript = ''
-      start_all()
+let
+  testScript = ''
+    start_all()
 
-      machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("multi-user.target")
 
-      # Check that gopro-tool is installed
-      machine.succeed("which gopro-tool")
+    # Check that gopro-tool is installed
+    machine.succeed("which gopro-tool")
 
-      # Check that the v4l2loopback module is available
-      machine.succeed("lsmod | grep v4l2loopback || echo 'Module not found'")
+    # Check that the v4l2loopback module is available
+    machine.succeed("lsmod | grep v4l2loopback || echo 'Module not found'")
 
-      # Check that VLC is installed
-      machine.succeed("which vlc")
-    '';
-  in
-  {
-    name = "gopro-tool";
-    meta.maintainers = with lib.maintainers; [ ZMon3y ];
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        # Ensure dependencies are installed
-        environment.systemPackages = with pkgs; [
-          gopro-tool
-          vlc
-        ];
+    # Check that VLC is installed
+    machine.succeed("which vlc")
+  '';
+in
+{
+  name = "gopro-tool";
+  meta.maintainers = with lib.maintainers; [ ZMon3y ];
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      # Ensure dependencies are installed
+      environment.systemPackages = with pkgs; [
+        gopro-tool
+        vlc
+      ];
 
-        # Load kernel module for testing
-        boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
+      # Load kernel module for testing
+      boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
 
-        # Enable module loading
-        boot.kernelModules = [ "v4l2loopback" ];
-      };
+      # Enable module loading
+      boot.kernelModules = [ "v4l2loopback" ];
+    };
 
-    testScript = testScript;
-  }
-)
+  testScript = testScript;
+}
diff --git a/nixos/tests/goss.nix b/nixos/tests/goss.nix
index 1bf9feda8ba3..a9d49b4ff53c 100644
--- a/nixos/tests/goss.nix
+++ b/nixos/tests/goss.nix
@@ -1,52 +1,50 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "goss";
-    meta.maintainers = [ lib.maintainers.anthonyroussel ];
+{ pkgs, lib, ... }:
+{
+  name = "goss";
+  meta.maintainers = [ lib.maintainers.anthonyroussel ];
 
-    nodes.machine = {
-      environment.systemPackages = [ pkgs.jq ];
+  nodes.machine = {
+    environment.systemPackages = [ pkgs.jq ];
 
-      services.goss = {
-        enable = true;
+    services.goss = {
+      enable = true;
 
-        environment = {
-          GOSS_FMT = "json";
+      environment = {
+        GOSS_FMT = "json";
+      };
+
+      settings = {
+        addr."tcp://localhost:8080" = {
+          reachable = true;
+          local-address = "127.0.0.1";
         };
-
-        settings = {
-          addr."tcp://localhost:8080" = {
-            reachable = true;
-            local-address = "127.0.0.1";
-          };
-          command."check-goss-version" = {
-            exec = "${lib.getExe pkgs.goss} --version";
-            exit-status = 0;
-          };
-          dns.localhost.resolvable = true;
-          file."/nix" = {
-            filetype = "directory";
-            exists = true;
-          };
-          group.root.exists = true;
-          kernel-param."kernel.ostype".value = "Linux";
-          user.root.exists = true;
+        command."check-goss-version" = {
+          exec = "${lib.getExe pkgs.goss} --version";
+          exit-status = 0;
         };
+        dns.localhost.resolvable = true;
+        file."/nix" = {
+          filetype = "directory";
+          exists = true;
+        };
+        group.root.exists = true;
+        kernel-param."kernel.ostype".value = "Linux";
+        user.root.exists = true;
       };
     };
+  };
 
-    testScript = ''
-      import json
+  testScript = ''
+    import json
 
-      machine.wait_for_unit("goss.service")
-      machine.wait_for_open_port(8080)
+    machine.wait_for_unit("goss.service")
+    machine.wait_for_open_port(8080)
 
-      with subtest("returns health status"):
-        result = json.loads(machine.succeed("curl -sS http://localhost:8080/healthz"))
+    with subtest("returns health status"):
+      result = json.loads(machine.succeed("curl -sS http://localhost:8080/healthz"))
 
-        assert len(result["results"]) == 8, f".results should be an array of 10 items, was {result['results']!r}"
-        assert result["summary"]["failed-count"] == 0, f".summary.failed-count should be zero, was {result['summary']['failed-count']}"
-        assert result["summary"]["test-count"] == 8, f".summary.test-count should be 10, was {result['summary']['test-count']}"
-    '';
-  }
-)
+      assert len(result["results"]) == 8, f".results should be an array of 10 items, was {result['results']!r}"
+      assert result["summary"]["failed-count"] == 0, f".summary.failed-count should be zero, was {result['summary']['failed-count']}"
+      assert result["summary"]["test-count"] == 8, f".summary.test-count should be 10, was {result['summary']['test-count']}"
+  '';
+}
diff --git a/nixos/tests/gotenberg.nix b/nixos/tests/gotenberg.nix
index aa39b2d349d7..c640657ea872 100644
--- a/nixos/tests/gotenberg.nix
+++ b/nixos/tests/gotenberg.nix
@@ -1,26 +1,24 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "gotenberg";
-    meta.maintainers = with lib.maintainers; [ pyrox0 ];
+{
+  name = "gotenberg";
+  meta.maintainers = with lib.maintainers; [ pyrox0 ];
 
-    nodes.machine = {
-      services.gotenberg = {
-        enable = true;
-      };
+  nodes.machine = {
+    services.gotenberg = {
+      enable = true;
     };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine.wait_for_unit("gotenberg.service")
+    machine.wait_for_unit("gotenberg.service")
 
-      # Gotenberg startup
-      machine.wait_for_open_port(3000)
+    # Gotenberg startup
+    machine.wait_for_open_port(3000)
 
-      # Ensure healthcheck endpoint succeeds
-      machine.succeed("curl http://localhost:3000/health")
-    '';
-  }
-)
+    # Ensure healthcheck endpoint succeeds
+    machine.succeed("curl http://localhost:3000/health")
+  '';
+}
diff --git a/nixos/tests/gotify-server.nix b/nixos/tests/gotify-server.nix
index 55f5fe6468f5..560022be89e8 100644
--- a/nixos/tests/gotify-server.nix
+++ b/nixos/tests/gotify-server.nix
@@ -1,57 +1,55 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "gotify-server";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "gotify-server";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.jq ];
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.jq ];
 
-        services.gotify = {
-          enable = true;
-          environment = {
-            GOTIFY_SERVER_PORT = 3000;
-          };
+      services.gotify = {
+        enable = true;
+        environment = {
+          GOTIFY_SERVER_PORT = 3000;
         };
       };
+    };
 
-    testScript = ''
-      machine.start()
+  testScript = ''
+    machine.start()
 
-      machine.wait_for_unit("gotify-server.service")
-      machine.wait_for_open_port(3000)
+    machine.wait_for_unit("gotify-server.service")
+    machine.wait_for_open_port(3000)
 
-      token = machine.succeed(
-          "curl --fail -sS -X POST localhost:3000/application -F name=nixos "
-          + '-H "Authorization: Basic $(echo -ne "admin:admin" | base64 --wrap 0)" '
-          + "| jq .token | xargs echo -n"
-      )
+    token = machine.succeed(
+        "curl --fail -sS -X POST localhost:3000/application -F name=nixos "
+        + '-H "Authorization: Basic $(echo -ne "admin:admin" | base64 --wrap 0)" '
+        + "| jq .token | xargs echo -n"
+    )
 
-      usertoken = machine.succeed(
-          "curl --fail -sS -X POST localhost:3000/client -F name=nixos "
-          + '-H "Authorization: Basic $(echo -ne "admin:admin" | base64 --wrap 0)" '
-          + "| jq .token | xargs echo -n"
-      )
+    usertoken = machine.succeed(
+        "curl --fail -sS -X POST localhost:3000/client -F name=nixos "
+        + '-H "Authorization: Basic $(echo -ne "admin:admin" | base64 --wrap 0)" '
+        + "| jq .token | xargs echo -n"
+    )
 
-      machine.succeed(
-          f"curl --fail -sS -X POST 'localhost:3000/message?token={token}' -H 'Accept: application/json' "
-          + "-F title=Gotify -F message=Works"
-      )
+    machine.succeed(
+        f"curl --fail -sS -X POST 'localhost:3000/message?token={token}' -H 'Accept: application/json' "
+        + "-F title=Gotify -F message=Works"
+    )
 
-      title = machine.succeed(
-          f"curl --fail -sS 'localhost:3000/message?since=0&token={usertoken}' | jq '.messages|.[0]|.title' | xargs echo -n"
-      )
+    title = machine.succeed(
+        f"curl --fail -sS 'localhost:3000/message?since=0&token={usertoken}' | jq '.messages|.[0]|.title' | xargs echo -n"
+    )
 
-      assert title == "Gotify"
+    assert title == "Gotify"
 
-      # Ensure that the UI responds with a successful code and that the
-      # response is not empty
-      result = machine.succeed("curl -fsS localhost:3000")
-      assert result, "HTTP response from localhost:3000 must not be empty!"
-    '';
-  }
-)
+    # Ensure that the UI responds with a successful code and that the
+    # response is not empty
+    result = machine.succeed("curl -fsS localhost:3000")
+    assert result, "HTTP response from localhost:3000 must not be empty!"
+  '';
+}
diff --git a/nixos/tests/graphite.nix b/nixos/tests/graphite.nix
index 1791cb38fc62..fd5888f0c973 100644
--- a/nixos/tests/graphite.nix
+++ b/nixos/tests/graphite.nix
@@ -1,39 +1,37 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "graphite";
-    nodes = {
-      one =
-        { ... }:
-        {
-          time.timeZone = "UTC";
-          services.graphite = {
-            web = {
-              enable = true;
-              extraConfig = ''
-                SECRET_KEY = "abcd";
-              '';
-            };
-            carbon.enableCache = true;
-            seyren.enable = false; # Implicitly requires openssl-1.0.2u which is marked insecure
+{ pkgs, ... }:
+{
+  name = "graphite";
+  nodes = {
+    one =
+      { ... }:
+      {
+        time.timeZone = "UTC";
+        services.graphite = {
+          web = {
+            enable = true;
+            extraConfig = ''
+              SECRET_KEY = "abcd";
+            '';
           };
+          carbon.enableCache = true;
+          seyren.enable = false; # Implicitly requires openssl-1.0.2u which is marked insecure
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      one.wait_for_unit("default.target")
-      one.wait_for_unit("graphiteWeb.service")
-      one.wait_for_unit("carbonCache.service")
-      # The services above are of type "simple". systemd considers them active immediately
-      # even if they're still in preStart (which takes quite long for graphiteWeb).
-      # Wait for ports to open so we're sure the services are up and listening.
-      one.wait_for_open_port(8080)
-      one.wait_for_open_port(2003)
-      one.succeed('echo "foo 1 `date +%s`" | nc -N localhost 2003')
-      one.wait_until_succeeds(
-          "curl 'http://localhost:8080/metrics/find/?query=foo&format=treejson' --silent | grep foo >&2"
-      )
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    one.wait_for_unit("default.target")
+    one.wait_for_unit("graphiteWeb.service")
+    one.wait_for_unit("carbonCache.service")
+    # The services above are of type "simple". systemd considers them active immediately
+    # even if they're still in preStart (which takes quite long for graphiteWeb).
+    # Wait for ports to open so we're sure the services are up and listening.
+    one.wait_for_open_port(8080)
+    one.wait_for_open_port(2003)
+    one.succeed('echo "foo 1 `date +%s`" | nc -N localhost 2003')
+    one.wait_until_succeeds(
+        "curl 'http://localhost:8080/metrics/find/?query=foo&format=treejson' --silent | grep foo >&2"
+    )
+  '';
+}
diff --git a/nixos/tests/graylog.nix b/nixos/tests/graylog.nix
index 7766ad9a6a05..32c419378713 100644
--- a/nixos/tests/graylog.nix
+++ b/nixos/tests/graylog.nix
@@ -1,140 +1,138 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "graylog";
-    meta.maintainers = [ ];
+{ pkgs, lib, ... }:
+{
+  name = "graylog";
+  meta.maintainers = [ ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        virtualisation.memorySize = 4096;
-        virtualisation.diskSize = 1024 * 6;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.memorySize = 4096;
+      virtualisation.diskSize = 1024 * 6;
 
-        services.mongodb.enable = true;
-        services.elasticsearch.enable = true;
-        services.elasticsearch.extraConf = ''
-          network.publish_host: 127.0.0.1
-          network.bind_host: 127.0.0.1
-        '';
+      services.mongodb.enable = true;
+      services.elasticsearch.enable = true;
+      services.elasticsearch.extraConf = ''
+        network.publish_host: 127.0.0.1
+        network.bind_host: 127.0.0.1
+      '';
 
-        services.graylog = {
-          enable = true;
-          passwordSecret = "YGhZ59wXMrYOojx5xdgEpBpDw2N6FbhM4lTtaJ1KPxxmKrUvSlDbtWArwAWMQ5LKx1ojHEVrQrBMVRdXbRyZLqffoUzHfssc";
-          elasticsearchHosts = [ "http://localhost:9200" ];
+      services.graylog = {
+        enable = true;
+        passwordSecret = "YGhZ59wXMrYOojx5xdgEpBpDw2N6FbhM4lTtaJ1KPxxmKrUvSlDbtWArwAWMQ5LKx1ojHEVrQrBMVRdXbRyZLqffoUzHfssc";
+        elasticsearchHosts = [ "http://localhost:9200" ];
 
-          # `echo -n "nixos" | shasum -a 256`
-          rootPasswordSha2 = "6ed332bcfa615381511d4d5ba44a293bb476f368f7e9e304f0dff50230d1a85b";
-        };
-
-        environment.systemPackages = [ pkgs.jq ];
-
-        systemd.services.graylog.path = [ pkgs.netcat ];
-        systemd.services.graylog.preStart = ''
-          until nc -z localhost 9200; do
-            sleep 2
-          done
-        '';
+        # `echo -n "nixos" | shasum -a 256`
+        rootPasswordSha2 = "6ed332bcfa615381511d4d5ba44a293bb476f368f7e9e304f0dff50230d1a85b";
       };
 
-    testScript =
-      let
-        payloads.login = pkgs.writeText "login.json" (
-          builtins.toJSON {
-            host = "127.0.0.1:9000";
-            username = "admin";
-            password = "nixos";
-          }
-        );
+      environment.systemPackages = [ pkgs.jq ];
 
-        payloads.input = pkgs.writeText "input.json" (
-          builtins.toJSON {
-            title = "Demo";
-            global = false;
-            type = "org.graylog2.inputs.gelf.udp.GELFUDPInput";
-            node = "@node@";
-            configuration = {
-              bind_address = "0.0.0.0";
-              decompress_size_limit = 8388608;
-              number_worker_threads = 1;
-              override_source = null;
-              port = 12201;
-              recv_buffer_size = 262144;
-            };
-          }
-        );
-
-        payloads.gelf_message = pkgs.writeText "gelf.json" (
-          builtins.toJSON {
-            host = "example.org";
-            short_message = "A short message";
-            full_message = "A long message";
-            version = "1.1";
-            level = 5;
-            facility = "Test";
-          }
-        );
-      in
-      ''
-        machine.start()
-        machine.wait_for_unit("graylog.service")
-
-        machine.wait_until_succeeds(
-          "journalctl -o cat -u graylog.service | grep 'Started REST API at <127.0.0.1:9000>'"
-        )
-
-        machine.wait_for_open_port(9000)
-        machine.succeed("curl -sSfL http://127.0.0.1:9000/")
-
-        machine.wait_until_succeeds(
-          "journalctl -o cat -u graylog.service | grep 'Graylog server up and running'"
-        )
-
-        session = machine.succeed(
-            "curl -X POST "
-            + "-sSfL http://127.0.0.1:9000/api/system/sessions "
-            + "-d $(cat ${payloads.login}) "
-            + "-H 'Content-Type: application/json' "
-            + "-H 'Accept: application/json' "
-            + "-H 'x-requested-by: cli' "
-            + "| jq .session_id | xargs echo"
-        ).rstrip()
-
-        machine.succeed(
-            "curl -X POST "
-            + f"-sSfL http://127.0.0.1:9000/api/system/inputs -u {session}:session "
-            + '-d $(cat ${payloads.input} | sed -e "s,@node@,$(cat /var/lib/graylog/server/node-id),") '
-            + "-H 'Accept: application/json' "
-            + "-H 'Content-Type: application/json' "
-            + "-H 'x-requested-by: cli' "
-        )
-
-        machine.wait_until_succeeds(
-          "journalctl -o cat -u graylog.service | grep -E 'Input \[GELF UDP/Demo/[[:alnum:]]{24}\] is now RUNNING'"
-        )
-
-        machine.wait_until_succeeds(
-            "test \"$(curl -sSfL 'http://127.0.0.1:9000/api/cluster/inputstates' "
-            + f"-u {session}:session "
-            + "-H 'Accept: application/json' "
-            + "-H 'Content-Type: application/json' "
-            + "-H 'x-requested-by: cli'"
-            + "| jq 'to_entries[]|.value|.[0]|.state' | xargs echo"
-            + ')" = "RUNNING"'
-        )
-
-        machine.succeed(
-            "echo -n $(cat ${payloads.gelf_message}) | nc -w10 -u 127.0.0.1 12201"
-        )
-
-        machine.succeed(
-            'test "$(curl -X GET '
-            + "-sSfL 'http://127.0.0.1:9000/api/search/universal/relative?query=*' "
-            + f"-u {session}:session "
-            + "-H 'Accept: application/json' "
-            + "-H 'Content-Type: application/json' "
-            + "-H 'x-requested-by: cli'"
-            + ' | jq \'.total_results\' | xargs echo)" = "1"'
-        )
+      systemd.services.graylog.path = [ pkgs.netcat ];
+      systemd.services.graylog.preStart = ''
+        until nc -z localhost 9200; do
+          sleep 2
+        done
       '';
-  }
-)
+    };
+
+  testScript =
+    let
+      payloads.login = pkgs.writeText "login.json" (
+        builtins.toJSON {
+          host = "127.0.0.1:9000";
+          username = "admin";
+          password = "nixos";
+        }
+      );
+
+      payloads.input = pkgs.writeText "input.json" (
+        builtins.toJSON {
+          title = "Demo";
+          global = false;
+          type = "org.graylog2.inputs.gelf.udp.GELFUDPInput";
+          node = "@node@";
+          configuration = {
+            bind_address = "0.0.0.0";
+            decompress_size_limit = 8388608;
+            number_worker_threads = 1;
+            override_source = null;
+            port = 12201;
+            recv_buffer_size = 262144;
+          };
+        }
+      );
+
+      payloads.gelf_message = pkgs.writeText "gelf.json" (
+        builtins.toJSON {
+          host = "example.org";
+          short_message = "A short message";
+          full_message = "A long message";
+          version = "1.1";
+          level = 5;
+          facility = "Test";
+        }
+      );
+    in
+    ''
+      machine.start()
+      machine.wait_for_unit("graylog.service")
+
+      machine.wait_until_succeeds(
+        "journalctl -o cat -u graylog.service | grep 'Started REST API at <127.0.0.1:9000>'"
+      )
+
+      machine.wait_for_open_port(9000)
+      machine.succeed("curl -sSfL http://127.0.0.1:9000/")
+
+      machine.wait_until_succeeds(
+        "journalctl -o cat -u graylog.service | grep 'Graylog server up and running'"
+      )
+
+      session = machine.succeed(
+          "curl -X POST "
+          + "-sSfL http://127.0.0.1:9000/api/system/sessions "
+          + "-d $(cat ${payloads.login}) "
+          + "-H 'Content-Type: application/json' "
+          + "-H 'Accept: application/json' "
+          + "-H 'x-requested-by: cli' "
+          + "| jq .session_id | xargs echo"
+      ).rstrip()
+
+      machine.succeed(
+          "curl -X POST "
+          + f"-sSfL http://127.0.0.1:9000/api/system/inputs -u {session}:session "
+          + '-d $(cat ${payloads.input} | sed -e "s,@node@,$(cat /var/lib/graylog/server/node-id),") '
+          + "-H 'Accept: application/json' "
+          + "-H 'Content-Type: application/json' "
+          + "-H 'x-requested-by: cli' "
+      )
+
+      machine.wait_until_succeeds(
+        "journalctl -o cat -u graylog.service | grep -E 'Input \[GELF UDP/Demo/[[:alnum:]]{24}\] is now RUNNING'"
+      )
+
+      machine.wait_until_succeeds(
+          "test \"$(curl -sSfL 'http://127.0.0.1:9000/api/cluster/inputstates' "
+          + f"-u {session}:session "
+          + "-H 'Accept: application/json' "
+          + "-H 'Content-Type: application/json' "
+          + "-H 'x-requested-by: cli'"
+          + "| jq 'to_entries[]|.value|.[0]|.state' | xargs echo"
+          + ')" = "RUNNING"'
+      )
+
+      machine.succeed(
+          "echo -n $(cat ${payloads.gelf_message}) | nc -w10 -u 127.0.0.1 12201"
+      )
+
+      machine.succeed(
+          'test "$(curl -X GET '
+          + "-sSfL 'http://127.0.0.1:9000/api/search/universal/relative?query=*' "
+          + f"-u {session}:session "
+          + "-H 'Accept: application/json' "
+          + "-H 'Content-Type: application/json' "
+          + "-H 'x-requested-by: cli'"
+          + ' | jq \'.total_results\' | xargs echo)" = "1"'
+      )
+    '';
+}
diff --git a/nixos/tests/greetd-no-shadow.nix b/nixos/tests/greetd-no-shadow.nix
index 0bbf4faa3d9c..c4cb028ff6eb 100644
--- a/nixos/tests/greetd-no-shadow.nix
+++ b/nixos/tests/greetd-no-shadow.nix
@@ -1,56 +1,54 @@
-import ./make-test-python.nix (
-  {
-    pkgs,
-    latestKernel ? false,
-    ...
-  }:
-  {
-    name = "greetd-no-shadow";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
-    };
+{
+  pkgs,
+  latestKernel ? false,
+  ...
+}:
+{
+  name = "greetd-no-shadow";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
 
-        users.users.alice = {
-          isNormalUser = true;
-          group = "alice";
-          password = "foobar";
-        };
-        users.groups.alice = { };
+      users.users.alice = {
+        isNormalUser = true;
+        group = "alice";
+        password = "foobar";
+      };
+      users.groups.alice = { };
 
-        # This means login(1) breaks, so we must use greetd/agreety instead.
-        security.shadow.enable = false;
+      # This means login(1) breaks, so we must use greetd/agreety instead.
+      security.shadow.enable = false;
 
-        services.greetd = {
-          enable = true;
-          settings = {
-            default_session = {
-              command = "${pkgs.greetd.greetd}/bin/agreety --cmd bash";
-            };
+      services.greetd = {
+        enable = true;
+        settings = {
+          default_session = {
+            command = "${pkgs.greetd.greetd}/bin/agreety --cmd bash";
           };
         };
       };
+    };
 
-    testScript = ''
-      machine.start()
+  testScript = ''
+    machine.start()
 
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_until_succeeds("pgrep -f 'agretty.*tty1'")
-      machine.screenshot("postboot")
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("pgrep -f 'agretty.*tty1'")
+    machine.screenshot("postboot")
 
-      with subtest("Log in as alice on a virtual console"):
-          machine.wait_until_tty_matches("1", "login: ")
-          machine.send_chars("alice\n")
-          machine.wait_until_tty_matches("1", "login: alice")
-          machine.wait_until_succeeds("pgrep login")
-          machine.wait_until_tty_matches("1", "Password: ")
-          machine.send_chars("foobar\n")
-          machine.wait_until_succeeds("pgrep -u alice bash")
-          machine.send_chars("touch done\n")
-          machine.wait_for_file("/home/alice/done")
-    '';
-  }
-)
+    with subtest("Log in as alice on a virtual console"):
+        machine.wait_until_tty_matches("1", "login: ")
+        machine.send_chars("alice\n")
+        machine.wait_until_tty_matches("1", "login: alice")
+        machine.wait_until_succeeds("pgrep login")
+        machine.wait_until_tty_matches("1", "Password: ")
+        machine.send_chars("foobar\n")
+        machine.wait_until_succeeds("pgrep -u alice bash")
+        machine.send_chars("touch done\n")
+        machine.wait_for_file("/home/alice/done")
+  '';
+}
diff --git a/nixos/tests/grub.nix b/nixos/tests/grub.nix
index c7232a9e6940..4221eec73049 100644
--- a/nixos/tests/grub.nix
+++ b/nixos/tests/grub.nix
@@ -1,65 +1,63 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "grub";
+{ lib, ... }:
+{
+  name = "grub";
 
-    meta = with lib.maintainers; {
-      maintainers = [ rnhmjoj ];
+  meta = with lib.maintainers; {
+    maintainers = [ rnhmjoj ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      virtualisation.useBootLoader = true;
+
+      boot.loader.timeout = null;
+      boot.loader.grub = {
+        enable = true;
+        users.alice.password = "supersecret";
+
+        # OCR is not accurate enough
+        extraConfig = "serial; terminal_output serial";
+      };
     };
 
-    nodes.machine =
-      { ... }:
-      {
-        virtualisation.useBootLoader = true;
-
-        boot.loader.timeout = null;
-        boot.loader.grub = {
-          enable = true;
-          users.alice.password = "supersecret";
-
-          # OCR is not accurate enough
-          extraConfig = "serial; terminal_output serial";
-        };
-      };
-
-    testScript = ''
-      def grub_login_as(user, password):
-          """
-          Enters user and password to log into GRUB
-          """
-          machine.wait_for_console_text("Enter username:")
-          machine.send_chars(user + "\n")
-          machine.wait_for_console_text("Enter password:")
-          machine.send_chars(password + "\n")
+  testScript = ''
+    def grub_login_as(user, password):
+        """
+        Enters user and password to log into GRUB
+        """
+        machine.wait_for_console_text("Enter username:")
+        machine.send_chars(user + "\n")
+        machine.wait_for_console_text("Enter password:")
+        machine.send_chars(password + "\n")
 
 
-      def grub_select_all_configurations():
-          """
-          Selects "All configurations" from the GRUB menu
-          to trigger a login request.
-          """
-          machine.send_monitor_command("sendkey down")
-          machine.send_monitor_command("sendkey ret")
+    def grub_select_all_configurations():
+        """
+        Selects "All configurations" from the GRUB menu
+        to trigger a login request.
+        """
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey ret")
 
 
-      machine.start()
+    machine.start()
 
-      # wait for grub screen
-      machine.wait_for_console_text("GNU GRUB")
+    # wait for grub screen
+    machine.wait_for_console_text("GNU GRUB")
 
-      grub_select_all_configurations()
-      with subtest("Invalid credentials are rejected"):
-          grub_login_as("wronguser", "wrongsecret")
-          machine.wait_for_console_text("error: access denied.")
+    grub_select_all_configurations()
+    with subtest("Invalid credentials are rejected"):
+        grub_login_as("wronguser", "wrongsecret")
+        machine.wait_for_console_text("error: access denied.")
 
-      grub_select_all_configurations()
-      with subtest("Valid credentials are accepted"):
-          grub_login_as("alice", "supersecret")
-          machine.send_chars("\n")  # press enter to boot
-          machine.wait_for_console_text("Linux version")
+    grub_select_all_configurations()
+    with subtest("Valid credentials are accepted"):
+        grub_login_as("alice", "supersecret")
+        machine.send_chars("\n")  # press enter to boot
+        machine.wait_for_console_text("Linux version")
 
-      with subtest("Machine boots correctly"):
-          machine.wait_for_unit("multi-user.target")
-    '';
-  }
-)
+    with subtest("Machine boots correctly"):
+        machine.wait_for_unit("multi-user.target")
+  '';
+}
diff --git a/nixos/tests/guacamole-server.nix b/nixos/tests/guacamole-server.nix
index 41830778d836..280742f5ad0b 100644
--- a/nixos/tests/guacamole-server.nix
+++ b/nixos/tests/guacamole-server.nix
@@ -1,25 +1,23 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "guacamole-server";
+{ pkgs, lib, ... }:
+{
+  name = "guacamole-server";
 
-    nodes = {
-      machine =
-        { pkgs, ... }:
-        {
-          services.guacamole-server = {
-            enable = true;
-            host = "0.0.0.0";
-          };
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.guacamole-server = {
+          enable = true;
+          host = "0.0.0.0";
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("guacamole-server.service")
-      machine.wait_for_open_port(4822)
-    '';
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("guacamole-server.service")
+    machine.wait_for_open_port(4822)
+  '';
 
-    meta.maintainers = [ lib.maintainers.drupol ];
-  }
-)
+  meta.maintainers = [ lib.maintainers.drupol ];
+}
diff --git a/nixos/tests/gvisor.nix b/nixos/tests/gvisor.nix
index 905abaeedc62..73b013754e81 100644
--- a/nixos/tests/gvisor.nix
+++ b/nixos/tests/gvisor.nix
@@ -1,48 +1,46 @@
 # This test runs a container through gvisor and checks if simple container starts
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "gvisor";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
-    };
+{ pkgs, ... }:
+{
+  name = "gvisor";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
 
-    nodes = {
-      gvisor =
-        { pkgs, ... }:
-        {
-          virtualisation.docker = {
-            enable = true;
-            extraOptions = "--add-runtime runsc=${pkgs.gvisor}/bin/runsc";
-          };
-
-          networking = {
-            dhcpcd.enable = false;
-            defaultGateway = "192.168.1.1";
-            interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
-              {
-                address = "192.168.1.2";
-                prefixLength = 24;
-              }
-            ];
-          };
+  nodes = {
+    gvisor =
+      { pkgs, ... }:
+      {
+        virtualisation.docker = {
+          enable = true;
+          extraOptions = "--add-runtime runsc=${pkgs.gvisor}/bin/runsc";
         };
-    };
 
-    testScript = ''
-      start_all()
+        networking = {
+          dhcpcd.enable = false;
+          defaultGateway = "192.168.1.1";
+          interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
+            {
+              address = "192.168.1.2";
+              prefixLength = 24;
+            }
+          ];
+        };
+      };
+  };
 
-      gvisor.wait_for_unit("network.target")
-      gvisor.wait_for_unit("sockets.target")
+  testScript = ''
+    start_all()
 
-      # Test the Docker runtime
-      gvisor.succeed("tar cv --files-from /dev/null | docker import - scratchimg")
-      gvisor.succeed(
-          "docker run -d --name=sleeping --runtime=runsc -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
-      )
-      gvisor.succeed("docker ps | grep sleeping")
-      gvisor.succeed("docker stop sleeping")
-    '';
-  }
-)
+    gvisor.wait_for_unit("network.target")
+    gvisor.wait_for_unit("sockets.target")
+
+    # Test the Docker runtime
+    gvisor.succeed("tar cv --files-from /dev/null | docker import - scratchimg")
+    gvisor.succeed(
+        "docker run -d --name=sleeping --runtime=runsc -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+    )
+    gvisor.succeed("docker ps | grep sleeping")
+    gvisor.succeed("docker stop sleeping")
+  '';
+}
diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix
index 7e1301b8099a..5a11b0a90567 100644
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@@ -1,113 +1,111 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "hardened";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ joachifm ];
+{ pkgs, ... }:
+{
+  name = "hardened";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ joachifm ];
+  };
+
+  nodes.machine =
+    {
+      lib,
+      pkgs,
+      config,
+      ...
+    }:
+    {
+      users.users.alice = {
+        isNormalUser = true;
+        extraGroups = [ "proc" ];
+      };
+      users.users.sybil = {
+        isNormalUser = true;
+        group = "wheel";
+      };
+      imports = [ ../modules/profiles/hardened.nix ];
+      environment.memoryAllocator.provider = "graphene-hardened";
+      nix.settings.sandbox = false;
+      virtualisation.emptyDiskImages = [ 4096 ];
+      boot.initrd.postDeviceCommands = ''
+        ${pkgs.dosfstools}/bin/mkfs.vfat -n EFISYS /dev/vdb
+      '';
+      virtualisation.fileSystems = {
+        "/efi" = {
+          device = "/dev/disk/by-label/EFISYS";
+          fsType = "vfat";
+          options = [ "noauto" ];
+        };
+      };
+      boot.extraModulePackages = pkgs.lib.optional (pkgs.lib.versionOlder config.boot.kernelPackages.kernel.version "5.6") config.boot.kernelPackages.wireguard;
+      boot.kernelModules = [ "wireguard" ];
     };
 
-    nodes.machine =
-      {
-        lib,
-        pkgs,
-        config,
-        ...
-      }:
-      {
-        users.users.alice = {
-          isNormalUser = true;
-          extraGroups = [ "proc" ];
-        };
-        users.users.sybil = {
-          isNormalUser = true;
-          group = "wheel";
-        };
-        imports = [ ../modules/profiles/hardened.nix ];
-        environment.memoryAllocator.provider = "graphene-hardened";
-        nix.settings.sandbox = false;
-        virtualisation.emptyDiskImages = [ 4096 ];
-        boot.initrd.postDeviceCommands = ''
-          ${pkgs.dosfstools}/bin/mkfs.vfat -n EFISYS /dev/vdb
-        '';
-        virtualisation.fileSystems = {
-          "/efi" = {
-            device = "/dev/disk/by-label/EFISYS";
-            fsType = "vfat";
-            options = [ "noauto" ];
-          };
-        };
-        boot.extraModulePackages = pkgs.lib.optional (pkgs.lib.versionOlder config.boot.kernelPackages.kernel.version "5.6") config.boot.kernelPackages.wireguard;
-        boot.kernelModules = [ "wireguard" ];
-      };
-
-    testScript =
-      let
-        hardened-malloc-tests = pkgs.graphene-hardened-malloc.ld-preload-tests;
-      in
-      ''
-        machine.wait_for_unit("multi-user.target")
+  testScript =
+    let
+      hardened-malloc-tests = pkgs.graphene-hardened-malloc.ld-preload-tests;
+    in
+    ''
+      machine.wait_for_unit("multi-user.target")
 
 
-        with subtest("AppArmor profiles are loaded"):
-            machine.succeed("systemctl status apparmor.service")
+      with subtest("AppArmor profiles are loaded"):
+          machine.succeed("systemctl status apparmor.service")
 
 
-        # AppArmor securityfs
-        with subtest("AppArmor securityfs is mounted"):
-            machine.succeed("mountpoint -q /sys/kernel/security")
-            machine.succeed("cat /sys/kernel/security/apparmor/profiles")
+      # AppArmor securityfs
+      with subtest("AppArmor securityfs is mounted"):
+          machine.succeed("mountpoint -q /sys/kernel/security")
+          machine.succeed("cat /sys/kernel/security/apparmor/profiles")
 
 
-        # Test loading out-of-tree modules
-        with subtest("Out-of-tree modules can be loaded"):
-            machine.succeed("grep -Fq wireguard /proc/modules")
+      # Test loading out-of-tree modules
+      with subtest("Out-of-tree modules can be loaded"):
+          machine.succeed("grep -Fq wireguard /proc/modules")
 
 
-        # Test kernel module hardening
-        with subtest("No more kernel modules can be loaded"):
-            # note: this better a be module we normally wouldn't load ...
-            machine.wait_for_unit("disable-kernel-module-loading.service")
-            machine.fail("modprobe dccp")
+      # Test kernel module hardening
+      with subtest("No more kernel modules can be loaded"):
+          # note: this better a be module we normally wouldn't load ...
+          machine.wait_for_unit("disable-kernel-module-loading.service")
+          machine.fail("modprobe dccp")
 
 
-        # Test userns
-        with subtest("User namespaces are restricted"):
-            machine.succeed("unshare --user true")
-            machine.fail("su -l alice -c 'unshare --user true'")
+      # Test userns
+      with subtest("User namespaces are restricted"):
+          machine.succeed("unshare --user true")
+          machine.fail("su -l alice -c 'unshare --user true'")
 
 
-        # Test dmesg restriction
-        with subtest("Regular users cannot access dmesg"):
-            machine.fail("su -l alice -c dmesg")
+      # Test dmesg restriction
+      with subtest("Regular users cannot access dmesg"):
+          machine.fail("su -l alice -c dmesg")
 
 
-        # Test access to kcore
-        with subtest("Kcore is inaccessible as root"):
-            machine.fail("cat /proc/kcore")
+      # Test access to kcore
+      with subtest("Kcore is inaccessible as root"):
+          machine.fail("cat /proc/kcore")
 
 
-        # Test deferred mount
-        with subtest("Deferred mounts work"):
-            machine.fail("mountpoint -q /efi")  # was deferred
-            machine.execute("mkdir -p /efi")
-            machine.succeed("mount /dev/disk/by-label/EFISYS /efi")
-            machine.succeed("mountpoint -q /efi")  # now mounted
+      # Test deferred mount
+      with subtest("Deferred mounts work"):
+          machine.fail("mountpoint -q /efi")  # was deferred
+          machine.execute("mkdir -p /efi")
+          machine.succeed("mount /dev/disk/by-label/EFISYS /efi")
+          machine.succeed("mountpoint -q /efi")  # now mounted
 
 
-        # Test Nix dæmon usage
-        with subtest("nix-daemon cannot be used by all users"):
-            machine.fail("su -l nobody -s /bin/sh -c 'nix --extra-experimental-features nix-command ping-store'")
-            machine.succeed("su -l alice -c 'nix --extra-experimental-features nix-command ping-store'")
+      # Test Nix dæmon usage
+      with subtest("nix-daemon cannot be used by all users"):
+          machine.fail("su -l nobody -s /bin/sh -c 'nix --extra-experimental-features nix-command ping-store'")
+          machine.succeed("su -l alice -c 'nix --extra-experimental-features nix-command ping-store'")
 
 
-        # Test kernel image protection
-        with subtest("The kernel image is protected"):
-            machine.fail("systemctl hibernate")
-            machine.fail("systemctl kexec")
+      # Test kernel image protection
+      with subtest("The kernel image is protected"):
+          machine.fail("systemctl hibernate")
+          machine.fail("systemctl kexec")
 
 
-        with subtest("The hardened memory allocator works"):
-            machine.succeed("${hardened-malloc-tests}/bin/run-tests")
-      '';
-  }
-)
+      with subtest("The hardened memory allocator works"):
+          machine.succeed("${hardened-malloc-tests}/bin/run-tests")
+    '';
+}
diff --git a/nixos/tests/haste-server.nix b/nixos/tests/haste-server.nix
index 9c076155f2fc..758e5f9dcae8 100644
--- a/nixos/tests/haste-server.nix
+++ b/nixos/tests/haste-server.nix
@@ -1,27 +1,25 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "haste-server";
-    meta.maintainers = with lib.maintainers; [ mkg20001 ];
+{ pkgs, lib, ... }:
+{
+  name = "haste-server";
+  meta.maintainers = with lib.maintainers; [ mkg20001 ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = with pkgs; [
-          curl
-          jq
-        ];
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        curl
+        jq
+      ];
 
-        services.haste-server = {
-          enable = true;
-        };
+      services.haste-server = {
+        enable = true;
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("haste-server")
-      machine.wait_until_succeeds("curl -s localhost:7777")
-      machine.succeed('curl -s -X POST http://localhost:7777/documents -d "Hello World!" > bla')
-      machine.succeed('curl http://localhost:7777/raw/$(cat bla | jq -r .key) | grep "Hello World"')
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("haste-server")
+    machine.wait_until_succeeds("curl -s localhost:7777")
+    machine.succeed('curl -s -X POST http://localhost:7777/documents -d "Hello World!" > bla')
+    machine.succeed('curl http://localhost:7777/raw/$(cat bla | jq -r .key) | grep "Hello World"')
+  '';
+}
diff --git a/nixos/tests/headscale.nix b/nixos/tests/headscale.nix
index 3ba331b7c3d4..c4e69cd1ffd5 100644
--- a/nixos/tests/headscale.nix
+++ b/nixos/tests/headscale.nix
@@ -1,93 +1,91 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
-      openssl req \
-        -x509 -newkey rsa:4096 -sha256 -days 365 \
-        -nodes -out cert.pem -keyout key.pem \
-        -subj '/CN=headscale' -addext "subjectAltName=DNS:headscale"
+{ pkgs, lib, ... }:
+let
+  tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+    openssl req \
+      -x509 -newkey rsa:4096 -sha256 -days 365 \
+      -nodes -out cert.pem -keyout key.pem \
+      -subj '/CN=headscale' -addext "subjectAltName=DNS:headscale"
 
-      mkdir -p $out
-      cp key.pem cert.pem $out
-    '';
-  in
-  {
-    name = "headscale";
-    meta.maintainers = with lib.maintainers; [
-      kradalby
-      misterio77
-    ];
+    mkdir -p $out
+    cp key.pem cert.pem $out
+  '';
+in
+{
+  name = "headscale";
+  meta.maintainers = with lib.maintainers; [
+    kradalby
+    misterio77
+  ];
 
-    nodes =
-      let
-        headscalePort = 8080;
-        stunPort = 3478;
-        peer = {
-          services.tailscale.enable = true;
-          security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
-        };
-      in
-      {
-        peer1 = peer;
-        peer2 = peer;
-
-        headscale = {
-          services = {
-            headscale = {
-              enable = true;
-              port = headscalePort;
-              settings = {
-                server_url = "https://headscale";
-                ip_prefixes = [ "100.64.0.0/10" ];
-                derp.server = {
-                  enabled = true;
-                  region_id = 999;
-                  stun_listen_addr = "0.0.0.0:${toString stunPort}";
-                };
-                dns.base_domain = "tailnet";
-              };
-            };
-            nginx = {
-              enable = true;
-              virtualHosts.headscale = {
-                addSSL = true;
-                sslCertificate = "${tls-cert}/cert.pem";
-                sslCertificateKey = "${tls-cert}/key.pem";
-                locations."/" = {
-                  proxyPass = "http://127.0.0.1:${toString headscalePort}";
-                  proxyWebsockets = true;
-                };
-              };
-            };
-          };
-          networking.firewall = {
-            allowedTCPPorts = [
-              80
-              443
-            ];
-            allowedUDPPorts = [ stunPort ];
-          };
-          environment.systemPackages = [ pkgs.headscale ];
-        };
+  nodes =
+    let
+      headscalePort = 8080;
+      stunPort = 3478;
+      peer = {
+        services.tailscale.enable = true;
+        security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
       };
+    in
+    {
+      peer1 = peer;
+      peer2 = peer;
 
-    testScript = ''
-      start_all()
-      headscale.wait_for_unit("headscale")
-      headscale.wait_for_open_port(443)
+      headscale = {
+        services = {
+          headscale = {
+            enable = true;
+            port = headscalePort;
+            settings = {
+              server_url = "https://headscale";
+              ip_prefixes = [ "100.64.0.0/10" ];
+              derp.server = {
+                enabled = true;
+                region_id = 999;
+                stun_listen_addr = "0.0.0.0:${toString stunPort}";
+              };
+              dns.base_domain = "tailnet";
+            };
+          };
+          nginx = {
+            enable = true;
+            virtualHosts.headscale = {
+              addSSL = true;
+              sslCertificate = "${tls-cert}/cert.pem";
+              sslCertificateKey = "${tls-cert}/key.pem";
+              locations."/" = {
+                proxyPass = "http://127.0.0.1:${toString headscalePort}";
+                proxyWebsockets = true;
+              };
+            };
+          };
+        };
+        networking.firewall = {
+          allowedTCPPorts = [
+            80
+            443
+          ];
+          allowedUDPPorts = [ stunPort ];
+        };
+        environment.systemPackages = [ pkgs.headscale ];
+      };
+    };
 
-      # Create headscale user and preauth-key
-      headscale.succeed("headscale users create test")
-      authkey = headscale.succeed("headscale preauthkeys -u test create --reusable")
+  testScript = ''
+    start_all()
+    headscale.wait_for_unit("headscale")
+    headscale.wait_for_open_port(443)
 
-      # Connect peers
-      up_cmd = f"tailscale up --login-server 'https://headscale' --auth-key {authkey}"
-      peer1.execute(up_cmd)
-      peer2.execute(up_cmd)
+    # Create headscale user and preauth-key
+    headscale.succeed("headscale users create test")
+    authkey = headscale.succeed("headscale preauthkeys -u test create --reusable")
 
-      # Check that they are reachable from the tailnet
-      peer1.wait_until_succeeds("tailscale ping peer2")
-      peer2.wait_until_succeeds("tailscale ping peer1.tailnet")
-    '';
-  }
-)
+    # Connect peers
+    up_cmd = f"tailscale up --login-server 'https://headscale' --auth-key {authkey}"
+    peer1.execute(up_cmd)
+    peer2.execute(up_cmd)
+
+    # Check that they are reachable from the tailnet
+    peer1.wait_until_succeeds("tailscale ping peer2")
+    peer2.wait_until_succeeds("tailscale ping peer1.tailnet")
+  '';
+}
diff --git a/nixos/tests/hedgedoc.nix b/nixos/tests/hedgedoc.nix
index aa1be7421d5e..aaf83a30bfc5 100644
--- a/nixos/tests/hedgedoc.nix
+++ b/nixos/tests/hedgedoc.nix
@@ -1,104 +1,102 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "hedgedoc";
+{ pkgs, lib, ... }:
+{
+  name = "hedgedoc";
 
-    meta = with lib.maintainers; {
-      maintainers = [ willibutz ];
-    };
+  meta = with lib.maintainers; {
+    maintainers = [ willibutz ];
+  };
 
-    nodes = {
-      hedgedocSqlite =
-        { ... }:
-        {
-          services.hedgedoc.enable = true;
-        };
+  nodes = {
+    hedgedocSqlite =
+      { ... }:
+      {
+        services.hedgedoc.enable = true;
+      };
 
-      hedgedocPostgresWithTCPSocket =
-        { ... }:
-        {
-          systemd.services.hedgedoc.after = [ "postgresql.service" ];
-          services = {
-            hedgedoc = {
-              enable = true;
-              settings.db = {
-                dialect = "postgres";
-                user = "hedgedoc";
-                password = "$DB_PASSWORD";
-                host = "localhost";
-                port = 5432;
-                database = "hedgedocdb";
-              };
-
-              /*
-                Do not use pkgs.writeText for secrets as
-                they will end up in the world-readable Nix store.
-              */
-              environmentFile = pkgs.writeText "hedgedoc-env" ''
-                DB_PASSWORD=snakeoilpassword
-              '';
-            };
-            postgresql = {
-              enable = true;
-              initialScript = pkgs.writeText "pg-init-script.sql" ''
-                CREATE ROLE hedgedoc LOGIN PASSWORD 'snakeoilpassword';
-                CREATE DATABASE hedgedocdb OWNER hedgedoc;
-              '';
+    hedgedocPostgresWithTCPSocket =
+      { ... }:
+      {
+        systemd.services.hedgedoc.after = [ "postgresql.service" ];
+        services = {
+          hedgedoc = {
+            enable = true;
+            settings.db = {
+              dialect = "postgres";
+              user = "hedgedoc";
+              password = "$DB_PASSWORD";
+              host = "localhost";
+              port = 5432;
+              database = "hedgedocdb";
             };
+
+            /*
+              Do not use pkgs.writeText for secrets as
+              they will end up in the world-readable Nix store.
+            */
+            environmentFile = pkgs.writeText "hedgedoc-env" ''
+              DB_PASSWORD=snakeoilpassword
+            '';
+          };
+          postgresql = {
+            enable = true;
+            initialScript = pkgs.writeText "pg-init-script.sql" ''
+              CREATE ROLE hedgedoc LOGIN PASSWORD 'snakeoilpassword';
+              CREATE DATABASE hedgedocdb OWNER hedgedoc;
+            '';
           };
         };
+      };
 
-      hedgedocPostgresWithUNIXSocket =
-        { ... }:
-        {
-          systemd.services.hedgedoc.after = [ "postgresql.service" ];
-          services = {
-            hedgedoc = {
-              enable = true;
-              settings.db = {
-                dialect = "postgres";
-                user = "hedgedoc";
-                password = "$DB_PASSWORD";
-                host = "/run/postgresql";
-                database = "hedgedocdb";
-              };
+    hedgedocPostgresWithUNIXSocket =
+      { ... }:
+      {
+        systemd.services.hedgedoc.after = [ "postgresql.service" ];
+        services = {
+          hedgedoc = {
+            enable = true;
+            settings.db = {
+              dialect = "postgres";
+              user = "hedgedoc";
+              password = "$DB_PASSWORD";
+              host = "/run/postgresql";
+              database = "hedgedocdb";
+            };
 
-              environmentFile = pkgs.writeText "hedgedoc-env" ''
-                DB_PASSWORD=snakeoilpassword
-              '';
-            };
-            postgresql = {
-              enable = true;
-              initialScript = pkgs.writeText "pg-init-script.sql" ''
-                CREATE ROLE hedgedoc LOGIN PASSWORD 'snakeoilpassword';
-                CREATE DATABASE hedgedocdb OWNER hedgedoc;
-              '';
-            };
+            environmentFile = pkgs.writeText "hedgedoc-env" ''
+              DB_PASSWORD=snakeoilpassword
+            '';
+          };
+          postgresql = {
+            enable = true;
+            initialScript = pkgs.writeText "pg-init-script.sql" ''
+              CREATE ROLE hedgedoc LOGIN PASSWORD 'snakeoilpassword';
+              CREATE DATABASE hedgedocdb OWNER hedgedoc;
+            '';
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      with subtest("HedgeDoc sqlite"):
-          hedgedocSqlite.wait_for_unit("hedgedoc.service")
-          hedgedocSqlite.wait_for_open_port(3000)
-          hedgedocSqlite.wait_until_succeeds("curl -sSf http://localhost:3000/new")
+    with subtest("HedgeDoc sqlite"):
+        hedgedocSqlite.wait_for_unit("hedgedoc.service")
+        hedgedocSqlite.wait_for_open_port(3000)
+        hedgedocSqlite.wait_until_succeeds("curl -sSf http://localhost:3000/new")
 
-      with subtest("HedgeDoc postgres with TCP socket"):
-          hedgedocPostgresWithTCPSocket.wait_for_unit("postgresql.service")
-          hedgedocPostgresWithTCPSocket.wait_for_unit("hedgedoc.service")
-          hedgedocPostgresWithTCPSocket.wait_for_open_port(5432)
-          hedgedocPostgresWithTCPSocket.wait_for_open_port(3000)
-          hedgedocPostgresWithTCPSocket.wait_until_succeeds("curl -sSf http://localhost:3000/new")
+    with subtest("HedgeDoc postgres with TCP socket"):
+        hedgedocPostgresWithTCPSocket.wait_for_unit("postgresql.service")
+        hedgedocPostgresWithTCPSocket.wait_for_unit("hedgedoc.service")
+        hedgedocPostgresWithTCPSocket.wait_for_open_port(5432)
+        hedgedocPostgresWithTCPSocket.wait_for_open_port(3000)
+        hedgedocPostgresWithTCPSocket.wait_until_succeeds("curl -sSf http://localhost:3000/new")
 
-      with subtest("HedgeDoc postgres with UNIX socket"):
-          hedgedocPostgresWithUNIXSocket.wait_for_unit("postgresql.service")
-          hedgedocPostgresWithUNIXSocket.wait_for_unit("hedgedoc.service")
-          hedgedocPostgresWithUNIXSocket.wait_for_open_port(5432)
-          hedgedocPostgresWithUNIXSocket.wait_for_open_port(3000)
-          hedgedocPostgresWithUNIXSocket.wait_until_succeeds("curl -sSf http://localhost:3000/new")
-    '';
-  }
-)
+    with subtest("HedgeDoc postgres with UNIX socket"):
+        hedgedocPostgresWithUNIXSocket.wait_for_unit("postgresql.service")
+        hedgedocPostgresWithUNIXSocket.wait_for_unit("hedgedoc.service")
+        hedgedocPostgresWithUNIXSocket.wait_for_open_port(5432)
+        hedgedocPostgresWithUNIXSocket.wait_for_open_port(3000)
+        hedgedocPostgresWithUNIXSocket.wait_until_succeeds("curl -sSf http://localhost:3000/new")
+  '';
+}
diff --git a/nixos/tests/herbstluftwm.nix b/nixos/tests/herbstluftwm.nix
index 84e6985803c3..5f6678e41fff 100644
--- a/nixos/tests/herbstluftwm.nix
+++ b/nixos/tests/herbstluftwm.nix
@@ -1,45 +1,43 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "herbstluftwm";
+{ lib, ... }:
+{
+  name = "herbstluftwm";
 
-    meta = {
-      maintainers = with lib.maintainers; [ thibautmarty ];
+  meta = {
+    maintainers = with lib.maintainers; [ thibautmarty ];
+  };
+
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+        ./common/user-account.nix
+      ];
+      test-support.displayManager.auto.user = "alice";
+      services.displayManager.defaultSession = lib.mkForce "none+herbstluftwm";
+      services.xserver.windowManager.herbstluftwm.enable = true;
+      environment.systemPackages = [ pkgs.dzen2 ]; # needed for upstream provided panel
     };
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-          ./common/user-account.nix
-        ];
-        test-support.displayManager.auto.user = "alice";
-        services.displayManager.defaultSession = lib.mkForce "none+herbstluftwm";
-        services.xserver.windowManager.herbstluftwm.enable = true;
-        environment.systemPackages = [ pkgs.dzen2 ]; # needed for upstream provided panel
-      };
+  testScript = ''
+    with subtest("ensure x starts"):
+        machine.wait_for_x()
+        machine.wait_for_file("/home/alice/.Xauthority")
+        machine.succeed("xauth merge ~alice/.Xauthority")
 
-    testScript = ''
-      with subtest("ensure x starts"):
-          machine.wait_for_x()
-          machine.wait_for_file("/home/alice/.Xauthority")
-          machine.succeed("xauth merge ~alice/.Xauthority")
+    with subtest("ensure client is available"):
+        machine.succeed("herbstclient --version")
 
-      with subtest("ensure client is available"):
-          machine.succeed("herbstclient --version")
+    with subtest("ensure keybindings are set"):
+        machine.wait_until_succeeds("herbstclient list_keybinds | grep xterm")
 
-      with subtest("ensure keybindings are set"):
-          machine.wait_until_succeeds("herbstclient list_keybinds | grep xterm")
+    with subtest("ensure panel starts"):
+        machine.wait_for_window("dzen title")
 
-      with subtest("ensure panel starts"):
-          machine.wait_for_window("dzen title")
-
-      with subtest("ensure we can open a new terminal"):
-          machine.send_key("alt-ret")
-          machine.wait_for_window(r"alice.*?machine")
-          machine.sleep(2)
-          machine.screenshot("terminal")
-    '';
-  }
-)
+    with subtest("ensure we can open a new terminal"):
+        machine.send_key("alt-ret")
+        machine.wait_for_window(r"alice.*?machine")
+        machine.sleep(2)
+        machine.screenshot("terminal")
+  '';
+}
diff --git a/nixos/tests/hledger-web.nix b/nixos/tests/hledger-web.nix
index fcb3c7f656aa..705288dc4e71 100644
--- a/nixos/tests/hledger-web.nix
+++ b/nixos/tests/hledger-web.nix
@@ -1,56 +1,54 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    journal = pkgs.writeText "test.journal" ''
-      2010/01/10 Loan
-          assets:cash                 500$
-          income:loan                -500$
-      2010/01/10 NixOS Foundation donation
-          expenses:donation           250$
-          assets:cash                -250$
-    '';
-  in
-  rec {
-    name = "hledger-web";
-    meta.maintainers = with lib.maintainers; [ marijanp ];
+{ pkgs, lib, ... }:
+let
+  journal = pkgs.writeText "test.journal" ''
+    2010/01/10 Loan
+        assets:cash                 500$
+        income:loan                -500$
+    2010/01/10 NixOS Foundation donation
+        expenses:donation           250$
+        assets:cash                -250$
+  '';
+in
+rec {
+  name = "hledger-web";
+  meta.maintainers = with lib.maintainers; [ marijanp ];
 
-    nodes = rec {
-      server =
-        { config, pkgs, ... }:
-        {
-          services.hledger-web = {
-            host = "127.0.0.1";
-            port = 5000;
-            enable = true;
-            allow = "edit";
-          };
-          networking.firewall.allowedTCPPorts = [ config.services.hledger-web.port ];
-          systemd.services.hledger-web.preStart = ''
-            ln -s ${journal} /var/lib/hledger-web/.hledger.journal
-          '';
+  nodes = rec {
+    server =
+      { config, pkgs, ... }:
+      {
+        services.hledger-web = {
+          host = "127.0.0.1";
+          port = 5000;
+          enable = true;
+          allow = "edit";
         };
-      apiserver =
-        { ... }:
-        {
-          imports = [ server ];
-          services.hledger-web.serveApi = true;
-        };
-    };
+        networking.firewall.allowedTCPPorts = [ config.services.hledger-web.port ];
+        systemd.services.hledger-web.preStart = ''
+          ln -s ${journal} /var/lib/hledger-web/.hledger.journal
+        '';
+      };
+    apiserver =
+      { ... }:
+      {
+        imports = [ server ];
+        services.hledger-web.serveApi = true;
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      server.wait_for_unit("hledger-web.service")
-      server.wait_for_open_port(5000)
-      with subtest("Check if web UI is accessible"):
-          page = server.succeed("curl -L http://127.0.0.1:5000")
-          assert ".hledger.journal" in page
+    server.wait_for_unit("hledger-web.service")
+    server.wait_for_open_port(5000)
+    with subtest("Check if web UI is accessible"):
+        page = server.succeed("curl -L http://127.0.0.1:5000")
+        assert ".hledger.journal" in page
 
-      apiserver.wait_for_unit("hledger-web.service")
-      apiserver.wait_for_open_port(5000)
-      with subtest("Check if the JSON API is served"):
-          transactions = apiserver.succeed("curl -L http://127.0.0.1:5000/transactions")
-          assert "NixOS Foundation donation" in transactions
-    '';
-  }
-)
+    apiserver.wait_for_unit("hledger-web.service")
+    apiserver.wait_for_open_port(5000)
+    with subtest("Check if the JSON API is served"):
+        transactions = apiserver.succeed("curl -L http://127.0.0.1:5000/transactions")
+        assert "NixOS Foundation donation" in transactions
+  '';
+}
diff --git a/nixos/tests/hockeypuck.nix b/nixos/tests/hockeypuck.nix
index bc24ceb4b70f..d1b5037fbe26 100644
--- a/nixos/tests/hockeypuck.nix
+++ b/nixos/tests/hockeypuck.nix
@@ -1,72 +1,70 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    gpgKeyring = (
-      pkgs.runCommand "gpg-keyring" { buildInputs = [ pkgs.gnupg ]; } ''
-        mkdir -p $out
-        export GNUPGHOME=$out
-        cat > foo <<EOF
-          %echo Generating a basic OpenPGP key
-          %no-protection
-          Key-Type: DSA
-          Key-Length: 1024
-          Subkey-Type: ELG-E
-          Subkey-Length: 1024
-          Name-Real: Foo Example
-          Name-Email: foo@example.org
-          Expire-Date: 0
-          # Do a commit here, so that we can later print "done"
-          %commit
-          %echo done
-        EOF
-        gpg --batch --generate-key foo
-        rm $out/S.gpg-agent $out/S.gpg-agent.*
-      ''
-    );
-  in
-  {
-    name = "hockeypuck";
-    meta.maintainers = with lib.maintainers; [ etu ];
+{ lib, pkgs, ... }:
+let
+  gpgKeyring = (
+    pkgs.runCommand "gpg-keyring" { buildInputs = [ pkgs.gnupg ]; } ''
+      mkdir -p $out
+      export GNUPGHOME=$out
+      cat > foo <<EOF
+        %echo Generating a basic OpenPGP key
+        %no-protection
+        Key-Type: DSA
+        Key-Length: 1024
+        Subkey-Type: ELG-E
+        Subkey-Length: 1024
+        Name-Real: Foo Example
+        Name-Email: foo@example.org
+        Expire-Date: 0
+        # Do a commit here, so that we can later print "done"
+        %commit
+        %echo done
+      EOF
+      gpg --batch --generate-key foo
+      rm $out/S.gpg-agent $out/S.gpg-agent.*
+    ''
+  );
+in
+{
+  name = "hockeypuck";
+  meta.maintainers = with lib.maintainers; [ etu ];
 
-    nodes.machine =
-      { ... }:
-      {
-        # Used for test
-        environment.systemPackages = [ pkgs.gnupg ];
+  nodes.machine =
+    { ... }:
+    {
+      # Used for test
+      environment.systemPackages = [ pkgs.gnupg ];
 
-        services.hockeypuck.enable = true;
+      services.hockeypuck.enable = true;
 
-        services.postgresql = {
-          enable = true;
-          ensureDatabases = [ "hockeypuck" ];
-          ensureUsers = [
-            {
-              name = "hockeypuck";
-              ensureDBOwnership = true;
-            }
-          ];
-        };
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "hockeypuck" ];
+        ensureUsers = [
+          {
+            name = "hockeypuck";
+            ensureDBOwnership = true;
+          }
+        ];
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("hockeypuck.service")
-      machine.wait_for_open_port(11371)
+  testScript = ''
+    machine.wait_for_unit("hockeypuck.service")
+    machine.wait_for_open_port(11371)
 
-      response = machine.succeed("curl -vvv -s http://127.0.0.1:11371/")
+    response = machine.succeed("curl -vvv -s http://127.0.0.1:11371/")
 
-      assert "<title>OpenPGP Keyserver</title>" in response, "HTML title not found"
+    assert "<title>OpenPGP Keyserver</title>" in response, "HTML title not found"
 
-      # Copy the keyring
-      machine.succeed("cp -R ${gpgKeyring} /tmp/GNUPGHOME")
+    # Copy the keyring
+    machine.succeed("cp -R ${gpgKeyring} /tmp/GNUPGHOME")
 
-      # Extract our GPG key id
-      keyId = machine.succeed("GNUPGHOME=/tmp/GNUPGHOME gpg --list-keys | grep dsa1024 --after-context=1 | grep -v dsa1024").strip()
+    # Extract our GPG key id
+    keyId = machine.succeed("GNUPGHOME=/tmp/GNUPGHOME gpg --list-keys | grep dsa1024 --after-context=1 | grep -v dsa1024").strip()
 
-      # Send the key to our local keyserver
-      machine.succeed("GNUPGHOME=/tmp/GNUPGHOME gpg --keyserver hkp://127.0.0.1:11371 --send-keys " + keyId)
+    # Send the key to our local keyserver
+    machine.succeed("GNUPGHOME=/tmp/GNUPGHOME gpg --keyserver hkp://127.0.0.1:11371 --send-keys " + keyId)
 
-      # Receive the key from our local keyserver to a separate directory
-      machine.succeed("GNUPGHOME=$(mktemp -d) gpg --keyserver hkp://127.0.0.1:11371 --recv-keys " + keyId)
-    '';
-  }
-)
+    # Receive the key from our local keyserver to a separate directory
+    machine.succeed("GNUPGHOME=$(mktemp -d) gpg --keyserver hkp://127.0.0.1:11371 --recv-keys " + keyId)
+  '';
+}
diff --git a/nixos/tests/homebox.nix b/nixos/tests/homebox.nix
index aadcd4269774..160d09f116bb 100644
--- a/nixos/tests/homebox.nix
+++ b/nixos/tests/homebox.nix
@@ -1,43 +1,41 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    port = "7745";
-  in
-  {
-    name = "homebox";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ patrickdag ];
-    };
-    nodes =
-      let
-        self = {
-          simple = {
-            services.homebox = {
-              enable = true;
-              settings.HBOX_WEB_PORT = port;
-            };
-          };
-
-          postgres = {
-            imports = [ self.simple ];
-            services.homebox.database.createLocally = true;
+{ pkgs, ... }:
+let
+  port = "7745";
+in
+{
+  name = "homebox";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ patrickdag ];
+  };
+  nodes =
+    let
+      self = {
+        simple = {
+          services.homebox = {
+            enable = true;
+            settings.HBOX_WEB_PORT = port;
           };
         };
-      in
-      self;
-    testScript = ''
-      def test_homebox(node):
-        node.wait_for_unit("homebox.service")
-        node.wait_for_open_port(${port})
 
-        node.succeed("curl --fail -X GET 'http://localhost:${port}/'")
-        out = node.succeed("curl --fail 'http://localhost:${port}/api/v1/status'")
-        assert '"health":true' in out
+        postgres = {
+          imports = [ self.simple ];
+          services.homebox.database.createLocally = true;
+        };
+      };
+    in
+    self;
+  testScript = ''
+    def test_homebox(node):
+      node.wait_for_unit("homebox.service")
+      node.wait_for_open_port(${port})
 
-      test_homebox(simple)
-      simple.send_monitor_command("quit")
-      simple.wait_for_shutdown()
-      test_homebox(postgres)
-    '';
-  }
-)
+      node.succeed("curl --fail -X GET 'http://localhost:${port}/'")
+      out = node.succeed("curl --fail 'http://localhost:${port}/api/v1/status'")
+      assert '"health":true' in out
+
+    test_homebox(simple)
+    simple.send_monitor_command("quit")
+    simple.wait_for_shutdown()
+    test_homebox(postgres)
+  '';
+}
diff --git a/nixos/tests/hound.nix b/nixos/tests/hound.nix
index b73ba27bed29..59574b6ce937 100644
--- a/nixos/tests/hound.nix
+++ b/nixos/tests/hound.nix
@@ -1,62 +1,60 @@
 # Test whether `houndd` indexes nixpkgs
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "hound";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ grahamc ];
-    };
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.hound = {
-          enable = true;
-          settings = {
-            "max-concurrent-indexers" = 1;
-            "dbpath" = "/var/lib/hound/data";
-            "repos" = {
-              "nix" = {
-                "url" = "file:///var/lib/hound/my-git";
-              };
+{ pkgs, ... }:
+{
+  name = "hound";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ grahamc ];
+  };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.hound = {
+        enable = true;
+        settings = {
+          "max-concurrent-indexers" = 1;
+          "dbpath" = "/var/lib/hound/data";
+          "repos" = {
+            "nix" = {
+              "url" = "file:///var/lib/hound/my-git";
             };
           };
         };
-
-        systemd.services.houndseed = {
-          description = "seed hound with a git repo";
-          requiredBy = [ "hound.service" ];
-          before = [ "hound.service" ];
-
-          serviceConfig = {
-            User = "hound";
-            Group = "hound";
-            WorkingDirectory = "/var/lib/hound";
-          };
-          path = [ pkgs.git ];
-          script = ''
-            git config --global user.email "you@example.com"
-            git config --global user.name "Your Name"
-            git init my-git --bare
-            git init my-git-clone
-            cd my-git-clone
-            echo 'hi nix!' > hello
-            git add hello
-            git commit -m "hello there :)"
-            git remote add origin /var/lib/hound/my-git
-            git push origin master
-          '';
-        };
       };
 
-    testScript = ''
-      start_all()
+      systemd.services.houndseed = {
+        description = "seed hound with a git repo";
+        requiredBy = [ "hound.service" ];
+        before = [ "hound.service" ];
 
-      machine.wait_for_unit("network.target")
-      machine.wait_for_unit("hound.service")
-      machine.wait_for_open_port(6080)
-      machine.wait_until_succeeds(
-          "curl -f http://127.0.0.1:6080/api/v1/search\?stats\=fosho\&repos\=\*\&rng=%3A20\&q\=hi\&files\=\&i=nope | grep 'Filename' | grep 'hello'"
-      )
-    '';
-  }
-)
+        serviceConfig = {
+          User = "hound";
+          Group = "hound";
+          WorkingDirectory = "/var/lib/hound";
+        };
+        path = [ pkgs.git ];
+        script = ''
+          git config --global user.email "you@example.com"
+          git config --global user.name "Your Name"
+          git init my-git --bare
+          git init my-git-clone
+          cd my-git-clone
+          echo 'hi nix!' > hello
+          git add hello
+          git commit -m "hello there :)"
+          git remote add origin /var/lib/hound/my-git
+          git push origin master
+        '';
+      };
+    };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("network.target")
+    machine.wait_for_unit("hound.service")
+    machine.wait_for_open_port(6080)
+    machine.wait_until_succeeds(
+        "curl -f http://127.0.0.1:6080/api/v1/search\?stats\=fosho\&repos\=\*\&rng=%3A20\&q\=hi\&files\=\&i=nope | grep 'Filename' | grep 'hello'"
+    )
+  '';
+}
diff --git a/nixos/tests/i3wm.nix b/nixos/tests/i3wm.nix
index 9dfde33aff8a..eb897573deb5 100644
--- a/nixos/tests/i3wm.nix
+++ b/nixos/tests/i3wm.nix
@@ -1,56 +1,54 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "i3wm";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ aszlig ];
+{ pkgs, ... }:
+{
+  name = "i3wm";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ aszlig ];
+  };
+
+  nodes.machine =
+    { lib, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+        ./common/user-account.nix
+      ];
+      test-support.displayManager.auto.user = "alice";
+      services.displayManager.defaultSession = lib.mkForce "none+i3";
+      services.xserver.windowManager.i3.enable = true;
     };
 
-    nodes.machine =
-      { lib, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-          ./common/user-account.nix
-        ];
-        test-support.displayManager.auto.user = "alice";
-        services.displayManager.defaultSession = lib.mkForce "none+i3";
-        services.xserver.windowManager.i3.enable = true;
-      };
+  testScript =
+    { ... }:
+    ''
+      with subtest("ensure x starts"):
+          machine.wait_for_x()
+          machine.wait_for_file("/home/alice/.Xauthority")
+          machine.succeed("xauth merge ~alice/.Xauthority")
 
-    testScript =
-      { ... }:
-      ''
-        with subtest("ensure x starts"):
-            machine.wait_for_x()
-            machine.wait_for_file("/home/alice/.Xauthority")
-            machine.succeed("xauth merge ~alice/.Xauthority")
+      with subtest("ensure we get first configuration window"):
+          machine.wait_for_window(r".*?first configuration.*?")
+          machine.sleep(2)
+          machine.screenshot("started")
 
-        with subtest("ensure we get first configuration window"):
-            machine.wait_for_window(r".*?first configuration.*?")
-            machine.sleep(2)
-            machine.screenshot("started")
+      with subtest("ensure we generate and save a config"):
+          # press return to indicate we want to gen a new config
+          machine.send_key("\n")
+          machine.sleep(2)
+          machine.screenshot("preconfig")
+          # press alt then return to indicate we want to use alt as our Mod key
+          machine.send_key("alt")
+          machine.send_key("\n")
+          machine.sleep(2)
+          # make sure the config file is created before we continue
+          machine.wait_for_file("/home/alice/.config/i3/config")
+          machine.screenshot("postconfig")
+          machine.sleep(2)
 
-        with subtest("ensure we generate and save a config"):
-            # press return to indicate we want to gen a new config
-            machine.send_key("\n")
-            machine.sleep(2)
-            machine.screenshot("preconfig")
-            # press alt then return to indicate we want to use alt as our Mod key
-            machine.send_key("alt")
-            machine.send_key("\n")
-            machine.sleep(2)
-            # make sure the config file is created before we continue
-            machine.wait_for_file("/home/alice/.config/i3/config")
-            machine.screenshot("postconfig")
-            machine.sleep(2)
-
-        with subtest("ensure we can open a new terminal"):
-            machine.send_key("alt-ret")
-            machine.sleep(2)
-            machine.wait_for_window(r"alice.*?machine")
-            machine.sleep(2)
-            machine.screenshot("terminal")
-      '';
-  }
-)
+      with subtest("ensure we can open a new terminal"):
+          machine.send_key("alt-ret")
+          machine.sleep(2)
+          machine.wait_for_window(r"alice.*?machine")
+          machine.sleep(2)
+          machine.screenshot("terminal")
+    '';
+}
diff --git a/nixos/tests/ifm.nix b/nixos/tests/ifm.nix
index a1bc8e23a897..228f0a06c121 100644
--- a/nixos/tests/ifm.nix
+++ b/nixos/tests/ifm.nix
@@ -1,38 +1,36 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "ifm";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ litchipi ];
-    };
+{
+  name = "ifm";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ litchipi ];
+  };
 
-    nodes = {
-      server = rec {
-        services.ifm = {
-          enable = true;
-          port = 9001;
-          dataDir = "/data";
-        };
-
-        system.activationScripts.ifm-setup-dir = ''
-          mkdir -p ${services.ifm.dataDir}
-          chmod u+w,g+w,o+w ${services.ifm.dataDir}
-        '';
+  nodes = {
+    server = rec {
+      services.ifm = {
+        enable = true;
+        port = 9001;
+        dataDir = "/data";
       };
+
+      system.activationScripts.ifm-setup-dir = ''
+        mkdir -p ${services.ifm.dataDir}
+        chmod u+w,g+w,o+w ${services.ifm.dataDir}
+      '';
     };
+  };
 
-    testScript = ''
-      start_all()
-      server.wait_for_unit("ifm.service")
-      server.wait_for_open_port(9001)
-      server.succeed("curl --fail http://localhost:9001")
+  testScript = ''
+    start_all()
+    server.wait_for_unit("ifm.service")
+    server.wait_for_open_port(9001)
+    server.succeed("curl --fail http://localhost:9001")
 
-      server.succeed("echo \"testfile\" > testfile && shasum testfile >> checksums")
-      server.succeed("curl --fail http://localhost:9001 -X POST -F \"api=upload\" -F \"dir=\" -F \"file=@testfile\" | grep \"OK\"");
-      server.succeed("rm testfile")
-      server.succeed("curl --fail http://localhost:9001 -X POST -F \"api=download\" -F \"filename=testfile\" -F \"dir=\" --output testfile");
-      server.succeed("shasum testfile >> checksums && shasum --check checksums")
-    '';
-  }
-)
+    server.succeed("echo \"testfile\" > testfile && shasum testfile >> checksums")
+    server.succeed("curl --fail http://localhost:9001 -X POST -F \"api=upload\" -F \"dir=\" -F \"file=@testfile\" | grep \"OK\"");
+    server.succeed("rm testfile")
+    server.succeed("curl --fail http://localhost:9001 -X POST -F \"api=download\" -F \"filename=testfile\" -F \"dir=\" --output testfile");
+    server.succeed("shasum testfile >> checksums && shasum --check checksums")
+  '';
+}
diff --git a/nixos/tests/iftop.nix b/nixos/tests/iftop.nix
index 3b4fedbbb940..8afa314293ac 100644
--- a/nixos/tests/iftop.nix
+++ b/nixos/tests/iftop.nix
@@ -1,33 +1,31 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  {
-    name = "iftop";
-    meta.maintainers = with lib.maintainers; [ ma27 ];
+{
+  name = "iftop";
+  meta.maintainers = with lib.maintainers; [ ma27 ];
 
-    nodes = {
-      withIftop = {
-        imports = [ ./common/user-account.nix ];
-        programs.iftop.enable = true;
-      };
-      withoutIftop = {
-        imports = [ ./common/user-account.nix ];
-        environment.systemPackages = [ pkgs.iftop ];
-      };
+  nodes = {
+    withIftop = {
+      imports = [ ./common/user-account.nix ];
+      programs.iftop.enable = true;
     };
+    withoutIftop = {
+      imports = [ ./common/user-account.nix ];
+      environment.systemPackages = [ pkgs.iftop ];
+    };
+  };
 
-    testScript = ''
-      with subtest("machine with iftop enabled"):
-          withIftop.wait_for_unit("default.target")
-          # limit to eth1 (eth0 is the test driver's control interface)
-          # and don't try name lookups
-          withIftop.succeed("su -l alice -c 'iftop -t -s 1 -n -i eth1'")
+  testScript = ''
+    with subtest("machine with iftop enabled"):
+        withIftop.wait_for_unit("default.target")
+        # limit to eth1 (eth0 is the test driver's control interface)
+        # and don't try name lookups
+        withIftop.succeed("su -l alice -c 'iftop -t -s 1 -n -i eth1'")
 
-      with subtest("machine without iftop"):
-          withoutIftop.wait_for_unit("default.target")
-          # check that iftop is there but user alice lacks capabilitie
-          withoutIftop.succeed("iftop -t -s 1 -n -i eth1")
-          withoutIftop.fail("su -l alice -c 'iftop -t -s 1 -n -i eth1'")
-    '';
-  }
-)
+    with subtest("machine without iftop"):
+        withoutIftop.wait_for_unit("default.target")
+        # check that iftop is there but user alice lacks capabilitie
+        withoutIftop.succeed("iftop -t -s 1 -n -i eth1")
+        withoutIftop.fail("su -l alice -c 'iftop -t -s 1 -n -i eth1'")
+  '';
+}
diff --git a/nixos/tests/incron.nix b/nixos/tests/incron.nix
index adbea25b9bde..dc368eb768af 100644
--- a/nixos/tests/incron.nix
+++ b/nixos/tests/incron.nix
@@ -1,55 +1,53 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  {
-    name = "incron";
-    meta.maintainers = [ lib.maintainers.aanderse ];
+{
+  name = "incron";
+  meta.maintainers = [ lib.maintainers.aanderse ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.incron.enable = true;
-        services.incron.extraPackages = [ pkgs.coreutils ];
-        services.incron.systab = ''
-          /test IN_CREATE,IN_MODIFY,IN_CLOSE_WRITE,IN_MOVED_FROM,IN_MOVED_TO echo "$@/$# $%" >> /root/incron.log
-        '';
+  nodes.machine =
+    { ... }:
+    {
+      services.incron.enable = true;
+      services.incron.extraPackages = [ pkgs.coreutils ];
+      services.incron.systab = ''
+        /test IN_CREATE,IN_MODIFY,IN_CLOSE_WRITE,IN_MOVED_FROM,IN_MOVED_TO echo "$@/$# $%" >> /root/incron.log
+      '';
 
-        # ensure the directory to be monitored exists before incron is started
-        systemd.tmpfiles.settings.incron-test = {
-          "/test".d = { };
-        };
+      # ensure the directory to be monitored exists before incron is started
+      systemd.tmpfiles.settings.incron-test = {
+        "/test".d = { };
       };
+    };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_for_unit("incron.service")
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("incron.service")
 
-      machine.succeed("test -d /test")
-      # create some activity for incron to monitor
-      machine.succeed("touch /test/file")
-      machine.succeed("echo foo >> /test/file")
-      machine.succeed("mv /test/file /root")
-      machine.succeed("mv /root/file /test")
+    machine.succeed("test -d /test")
+    # create some activity for incron to monitor
+    machine.succeed("touch /test/file")
+    machine.succeed("echo foo >> /test/file")
+    machine.succeed("mv /test/file /root")
+    machine.succeed("mv /root/file /test")
 
-      machine.sleep(1)
+    machine.sleep(1)
 
-      # touch /test/file
-      machine.succeed("grep '/test/file IN_CREATE' /root/incron.log")
+    # touch /test/file
+    machine.succeed("grep '/test/file IN_CREATE' /root/incron.log")
 
-      # echo foo >> /test/file
-      machine.succeed("grep '/test/file IN_MODIFY' /root/incron.log")
-      machine.succeed("grep '/test/file IN_CLOSE_WRITE' /root/incron.log")
+    # echo foo >> /test/file
+    machine.succeed("grep '/test/file IN_MODIFY' /root/incron.log")
+    machine.succeed("grep '/test/file IN_CLOSE_WRITE' /root/incron.log")
 
-      # mv /test/file /root
-      machine.succeed("grep '/test/file IN_MOVED_FROM' /root/incron.log")
+    # mv /test/file /root
+    machine.succeed("grep '/test/file IN_MOVED_FROM' /root/incron.log")
 
-      # mv /root/file /test
-      machine.succeed("grep '/test/file IN_MOVED_TO' /root/incron.log")
+    # mv /root/file /test
+    machine.succeed("grep '/test/file IN_MOVED_TO' /root/incron.log")
 
-      # ensure something unexpected is not present
-      machine.fail("grep 'IN_OPEN' /root/incron.log")
-    '';
-  }
-)
+    # ensure something unexpected is not present
+    machine.fail("grep 'IN_OPEN' /root/incron.log")
+  '';
+}
diff --git a/nixos/tests/influxdb.nix b/nixos/tests/influxdb.nix
index 87b1192c3062..f8ec355469f7 100644
--- a/nixos/tests/influxdb.nix
+++ b/nixos/tests/influxdb.nix
@@ -1,45 +1,43 @@
 # This test runs influxdb and checks if influxdb is up and running
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "influxdb";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ offline ];
-    };
+{ pkgs, ... }:
+{
+  name = "influxdb";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ offline ];
+  };
 
-    nodes = {
-      one =
-        { ... }:
-        {
-          services.influxdb.enable = true;
-          environment.systemPackages = [ pkgs.httpie ];
-        };
-    };
+  nodes = {
+    one =
+      { ... }:
+      {
+        services.influxdb.enable = true;
+        environment.systemPackages = [ pkgs.httpie ];
+      };
+  };
 
-    testScript = ''
-      import shlex
+  testScript = ''
+    import shlex
 
-      start_all()
+    start_all()
 
-      one.wait_for_unit("influxdb.service")
+    one.wait_for_unit("influxdb.service")
 
-      # create database
-      one.succeed(
-          "curl -XPOST http://localhost:8086/query --data-urlencode 'q=CREATE DATABASE test'"
-      )
+    # create database
+    one.succeed(
+        "curl -XPOST http://localhost:8086/query --data-urlencode 'q=CREATE DATABASE test'"
+    )
 
-      # write some points and run simple query
-      out = one.succeed(
-          "curl -XPOST 'http://localhost:8086/write?db=test' --data-binary 'cpu_load_short,host=server01,region=us-west value=0.64 1434055562000000000'"
-      )
+    # write some points and run simple query
+    out = one.succeed(
+        "curl -XPOST 'http://localhost:8086/write?db=test' --data-binary 'cpu_load_short,host=server01,region=us-west value=0.64 1434055562000000000'"
+    )
 
-      qv = "SELECT value FROM cpu_load_short WHERE region='us-west'"
-      cmd = f'curl -GET "http://localhost:8086/query?db=test" --data-urlencode {shlex.quote("q="+ qv)}'
-      out = one.succeed(cmd)
+    qv = "SELECT value FROM cpu_load_short WHERE region='us-west'"
+    cmd = f'curl -GET "http://localhost:8086/query?db=test" --data-urlencode {shlex.quote("q="+ qv)}'
+    out = one.succeed(cmd)
 
-      assert "2015-06-11T20:46:02Z" in out
-      assert "0.64" in out
-    '';
-  }
-)
+    assert "2015-06-11T20:46:02Z" in out
+    assert "0.64" in out
+  '';
+}
diff --git a/nixos/tests/influxdb2.nix b/nixos/tests/influxdb2.nix
index 3646960c1569..f054039fa9a3 100644
--- a/nixos/tests/influxdb2.nix
+++ b/nixos/tests/influxdb2.nix
@@ -1,241 +1,239 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "influxdb2";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ offline ];
-    };
+{ pkgs, ... }:
+{
+  name = "influxdb2";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ offline ];
+  };
 
-    nodes.machine =
-      { lib, ... }:
-      {
-        environment.systemPackages = [ pkgs.influxdb2-cli ];
-        # Make sure that the service is restarted immediately if tokens need to be rewritten
-        # without relying on any Restart=on-failure behavior
-        systemd.services.influxdb2.serviceConfig.RestartSec = 6000;
-        services.influxdb2.enable = true;
-        services.influxdb2.provision = {
-          enable = true;
-          initialSetup = {
-            organization = "default";
-            bucket = "default";
-            passwordFile = pkgs.writeText "admin-pw" "ExAmPl3PA55W0rD";
-            tokenFile = pkgs.writeText "admin-token" "verysecureadmintoken";
-          };
-          organizations.someorg = {
-            buckets.somebucket = { };
-            auths.sometoken = {
-              description = "some auth token";
-              readBuckets = [ "somebucket" ];
-              writeBuckets = [ "somebucket" ];
-            };
-          };
-          users.someuser.passwordFile = pkgs.writeText "tmp-pw" "abcgoiuhaoga";
+  nodes.machine =
+    { lib, ... }:
+    {
+      environment.systemPackages = [ pkgs.influxdb2-cli ];
+      # Make sure that the service is restarted immediately if tokens need to be rewritten
+      # without relying on any Restart=on-failure behavior
+      systemd.services.influxdb2.serviceConfig.RestartSec = 6000;
+      services.influxdb2.enable = true;
+      services.influxdb2.provision = {
+        enable = true;
+        initialSetup = {
+          organization = "default";
+          bucket = "default";
+          passwordFile = pkgs.writeText "admin-pw" "ExAmPl3PA55W0rD";
+          tokenFile = pkgs.writeText "admin-token" "verysecureadmintoken";
         };
-
-        specialisation.withModifications.configuration =
-          { ... }:
-          {
-            services.influxdb2.provision = {
-              organizations.someorg.buckets.somebucket.present = false;
-              organizations.someorg.auths.sometoken.present = false;
-              users.someuser.present = false;
-
-              organizations.myorg = {
-                description = "Myorg description";
-                buckets.mybucket = {
-                  description = "Mybucket description";
-                };
-                auths.mytoken = {
-                  operator = true;
-                  description = "operator token";
-                  tokenFile = pkgs.writeText "tmp-tok" "someusertoken";
-                };
-              };
-              users.myuser.passwordFile = pkgs.writeText "tmp-pw" "abcgoiuhaoga";
-            };
-          };
-
-        specialisation.withParentDelete.configuration =
-          { ... }:
-          {
-            services.influxdb2.provision = {
-              organizations.someorg.present = false;
-              # Deleting the parent implies:
-              #organizations.someorg.buckets.somebucket.present = false;
-              #organizations.someorg.auths.sometoken.present = false;
-            };
-          };
-
-        specialisation.withNewTokens.configuration =
-          { ... }:
-          {
-            services.influxdb2.provision = {
-              organizations.default = {
-                auths.operator = {
-                  operator = true;
-                  description = "new optoken";
-                  tokenFile = pkgs.writeText "tmp-tok" "newoptoken";
-                };
-                auths.allaccess = {
-                  operator = true;
-                  description = "new allaccess";
-                  tokenFile = pkgs.writeText "tmp-tok" "newallaccess";
-                };
-                auths.specifics = {
-                  description = "new specifics";
-                  readPermissions = [
-                    "users"
-                    "tasks"
-                  ];
-                  writePermissions = [ "tasks" ];
-                  tokenFile = pkgs.writeText "tmp-tok" "newspecificstoken";
-                };
-              };
-            };
+        organizations.someorg = {
+          buckets.somebucket = { };
+          auths.sometoken = {
+            description = "some auth token";
+            readBuckets = [ "somebucket" ];
+            writeBuckets = [ "somebucket" ];
           };
+        };
+        users.someuser.passwordFile = pkgs.writeText "tmp-pw" "abcgoiuhaoga";
       };
 
-    testScript =
-      { nodes, ... }:
-      let
-        specialisations = "${nodes.machine.system.build.toplevel}/specialisation";
-        tokenArg = "--token verysecureadmintoken";
-      in
-      ''
-        def assert_contains(haystack, needle):
-            if needle not in haystack:
-                print("The haystack that will cause the following exception is:")
-                print("---")
-                print(haystack)
-                print("---")
-                raise Exception(f"Expected string '{needle}' was not found")
+      specialisation.withModifications.configuration =
+        { ... }:
+        {
+          services.influxdb2.provision = {
+            organizations.someorg.buckets.somebucket.present = false;
+            organizations.someorg.auths.sometoken.present = false;
+            users.someuser.present = false;
 
-        def assert_lacks(haystack, needle):
-            if needle in haystack:
-                print("The haystack that will cause the following exception is:")
-                print("---")
-                print(haystack, end="")
-                print("---")
-                raise Exception(f"Unexpected string '{needle}' was found")
+            organizations.myorg = {
+              description = "Myorg description";
+              buckets.mybucket = {
+                description = "Mybucket description";
+              };
+              auths.mytoken = {
+                operator = true;
+                description = "operator token";
+                tokenFile = pkgs.writeText "tmp-tok" "someusertoken";
+              };
+            };
+            users.myuser.passwordFile = pkgs.writeText "tmp-pw" "abcgoiuhaoga";
+          };
+        };
 
+      specialisation.withParentDelete.configuration =
+        { ... }:
+        {
+          services.influxdb2.provision = {
+            organizations.someorg.present = false;
+            # Deleting the parent implies:
+            #organizations.someorg.buckets.somebucket.present = false;
+            #organizations.someorg.auths.sometoken.present = false;
+          };
+        };
+
+      specialisation.withNewTokens.configuration =
+        { ... }:
+        {
+          services.influxdb2.provision = {
+            organizations.default = {
+              auths.operator = {
+                operator = true;
+                description = "new optoken";
+                tokenFile = pkgs.writeText "tmp-tok" "newoptoken";
+              };
+              auths.allaccess = {
+                operator = true;
+                description = "new allaccess";
+                tokenFile = pkgs.writeText "tmp-tok" "newallaccess";
+              };
+              auths.specifics = {
+                description = "new specifics";
+                readPermissions = [
+                  "users"
+                  "tasks"
+                ];
+                writePermissions = [ "tasks" ];
+                tokenFile = pkgs.writeText "tmp-tok" "newspecificstoken";
+              };
+            };
+          };
+        };
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      specialisations = "${nodes.machine.system.build.toplevel}/specialisation";
+      tokenArg = "--token verysecureadmintoken";
+    in
+    ''
+      def assert_contains(haystack, needle):
+          if needle not in haystack:
+              print("The haystack that will cause the following exception is:")
+              print("---")
+              print(haystack)
+              print("---")
+              raise Exception(f"Expected string '{needle}' was not found")
+
+      def assert_lacks(haystack, needle):
+          if needle in haystack:
+              print("The haystack that will cause the following exception is:")
+              print("---")
+              print(haystack, end="")
+              print("---")
+              raise Exception(f"Unexpected string '{needle}' was found")
+
+      machine.wait_for_unit("influxdb2.service")
+
+      machine.fail("curl --fail -X POST 'http://localhost:8086/api/v2/signin' -u admin:wrongpassword")
+      machine.succeed("curl --fail -X POST 'http://localhost:8086/api/v2/signin' -u admin:ExAmPl3PA55W0rD")
+
+      out = machine.succeed("influx org list ${tokenArg}")
+      assert_contains(out, "default")
+      assert_lacks(out, "myorg")
+      assert_contains(out, "someorg")
+
+      out = machine.succeed("influx bucket list ${tokenArg} --org default")
+      assert_contains(out, "default")
+
+      machine.fail("influx bucket list ${tokenArg} --org myorg")
+
+      out = machine.succeed("influx bucket list ${tokenArg} --org someorg")
+      assert_contains(out, "somebucket")
+
+      out = machine.succeed("influx user list ${tokenArg}")
+      assert_contains(out, "admin")
+      assert_lacks(out, "myuser")
+      assert_contains(out, "someuser")
+
+      out = machine.succeed("influx auth list ${tokenArg}")
+      assert_lacks(out, "operator token")
+      assert_contains(out, "some auth token")
+
+      with subtest("withModifications"):
+        machine.succeed('${specialisations}/withModifications/bin/switch-to-configuration test')
         machine.wait_for_unit("influxdb2.service")
 
-        machine.fail("curl --fail -X POST 'http://localhost:8086/api/v2/signin' -u admin:wrongpassword")
-        machine.succeed("curl --fail -X POST 'http://localhost:8086/api/v2/signin' -u admin:ExAmPl3PA55W0rD")
-
         out = machine.succeed("influx org list ${tokenArg}")
         assert_contains(out, "default")
-        assert_lacks(out, "myorg")
+        assert_contains(out, "myorg")
+        assert_contains(out, "someorg")
+
+        out = machine.succeed("influx bucket list ${tokenArg} --org myorg")
+        assert_contains(out, "mybucket")
+
+        out = machine.succeed("influx bucket list ${tokenArg} --org someorg")
+        assert_lacks(out, "somebucket")
+
+        out = machine.succeed("influx user list ${tokenArg}")
+        assert_contains(out, "admin")
+        assert_contains(out, "myuser")
+        assert_lacks(out, "someuser")
+
+        out = machine.succeed("influx auth list ${tokenArg}")
+        assert_contains(out, "operator token")
+        assert_lacks(out, "some auth token")
+
+        # Make sure the user token is also usable
+        machine.succeed("influx auth list --token someusertoken")
+
+      with subtest("keepsUnrelated"):
+        machine.succeed('${nodes.machine.system.build.toplevel}/bin/switch-to-configuration test')
+        machine.wait_for_unit("influxdb2.service")
+
+        out = machine.succeed("influx org list ${tokenArg}")
+        assert_contains(out, "default")
+        assert_contains(out, "myorg")
         assert_contains(out, "someorg")
 
         out = machine.succeed("influx bucket list ${tokenArg} --org default")
         assert_contains(out, "default")
 
-        machine.fail("influx bucket list ${tokenArg} --org myorg")
+        out = machine.succeed("influx bucket list ${tokenArg} --org myorg")
+        assert_contains(out, "mybucket")
 
         out = machine.succeed("influx bucket list ${tokenArg} --org someorg")
         assert_contains(out, "somebucket")
 
         out = machine.succeed("influx user list ${tokenArg}")
         assert_contains(out, "admin")
-        assert_lacks(out, "myuser")
+        assert_contains(out, "myuser")
         assert_contains(out, "someuser")
 
         out = machine.succeed("influx auth list ${tokenArg}")
-        assert_lacks(out, "operator token")
+        assert_contains(out, "operator token")
         assert_contains(out, "some auth token")
 
-        with subtest("withModifications"):
-          machine.succeed('${specialisations}/withModifications/bin/switch-to-configuration test')
-          machine.wait_for_unit("influxdb2.service")
+      with subtest("withParentDelete"):
+        machine.succeed('${specialisations}/withParentDelete/bin/switch-to-configuration test')
+        machine.wait_for_unit("influxdb2.service")
 
-          out = machine.succeed("influx org list ${tokenArg}")
-          assert_contains(out, "default")
-          assert_contains(out, "myorg")
-          assert_contains(out, "someorg")
+        out = machine.succeed("influx org list ${tokenArg}")
+        assert_contains(out, "default")
+        assert_contains(out, "myorg")
+        assert_lacks(out, "someorg")
 
-          out = machine.succeed("influx bucket list ${tokenArg} --org myorg")
-          assert_contains(out, "mybucket")
+        out = machine.succeed("influx bucket list ${tokenArg} --org default")
+        assert_contains(out, "default")
 
-          out = machine.succeed("influx bucket list ${tokenArg} --org someorg")
-          assert_lacks(out, "somebucket")
+        out = machine.succeed("influx bucket list ${tokenArg} --org myorg")
+        assert_contains(out, "mybucket")
 
-          out = machine.succeed("influx user list ${tokenArg}")
-          assert_contains(out, "admin")
-          assert_contains(out, "myuser")
-          assert_lacks(out, "someuser")
+        machine.fail("influx bucket list ${tokenArg} --org someorg")
 
-          out = machine.succeed("influx auth list ${tokenArg}")
-          assert_contains(out, "operator token")
-          assert_lacks(out, "some auth token")
+        out = machine.succeed("influx user list ${tokenArg}")
+        assert_contains(out, "admin")
+        assert_contains(out, "myuser")
+        assert_contains(out, "someuser")
 
-          # Make sure the user token is also usable
-          machine.succeed("influx auth list --token someusertoken")
+        out = machine.succeed("influx auth list ${tokenArg}")
+        assert_contains(out, "operator token")
+        assert_lacks(out, "some auth token")
 
-        with subtest("keepsUnrelated"):
-          machine.succeed('${nodes.machine.system.build.toplevel}/bin/switch-to-configuration test')
-          machine.wait_for_unit("influxdb2.service")
+      with subtest("withNewTokens"):
+        machine.succeed('${specialisations}/withNewTokens/bin/switch-to-configuration test')
+        machine.wait_for_unit("influxdb2.service")
 
-          out = machine.succeed("influx org list ${tokenArg}")
-          assert_contains(out, "default")
-          assert_contains(out, "myorg")
-          assert_contains(out, "someorg")
-
-          out = machine.succeed("influx bucket list ${tokenArg} --org default")
-          assert_contains(out, "default")
-
-          out = machine.succeed("influx bucket list ${tokenArg} --org myorg")
-          assert_contains(out, "mybucket")
-
-          out = machine.succeed("influx bucket list ${tokenArg} --org someorg")
-          assert_contains(out, "somebucket")
-
-          out = machine.succeed("influx user list ${tokenArg}")
-          assert_contains(out, "admin")
-          assert_contains(out, "myuser")
-          assert_contains(out, "someuser")
-
-          out = machine.succeed("influx auth list ${tokenArg}")
-          assert_contains(out, "operator token")
-          assert_contains(out, "some auth token")
-
-        with subtest("withParentDelete"):
-          machine.succeed('${specialisations}/withParentDelete/bin/switch-to-configuration test')
-          machine.wait_for_unit("influxdb2.service")
-
-          out = machine.succeed("influx org list ${tokenArg}")
-          assert_contains(out, "default")
-          assert_contains(out, "myorg")
-          assert_lacks(out, "someorg")
-
-          out = machine.succeed("influx bucket list ${tokenArg} --org default")
-          assert_contains(out, "default")
-
-          out = machine.succeed("influx bucket list ${tokenArg} --org myorg")
-          assert_contains(out, "mybucket")
-
-          machine.fail("influx bucket list ${tokenArg} --org someorg")
-
-          out = machine.succeed("influx user list ${tokenArg}")
-          assert_contains(out, "admin")
-          assert_contains(out, "myuser")
-          assert_contains(out, "someuser")
-
-          out = machine.succeed("influx auth list ${tokenArg}")
-          assert_contains(out, "operator token")
-          assert_lacks(out, "some auth token")
-
-        with subtest("withNewTokens"):
-          machine.succeed('${specialisations}/withNewTokens/bin/switch-to-configuration test')
-          machine.wait_for_unit("influxdb2.service")
-
-          out = machine.succeed("influx auth list ${tokenArg}")
-          assert_contains(out, "operator token")
-          assert_contains(out, "some auth token")
-          assert_contains(out, "new optoken")
-          assert_contains(out, "new allaccess")
-          assert_contains(out, "new specifics")
-      '';
-  }
-)
+        out = machine.succeed("influx auth list ${tokenArg}")
+        assert_contains(out, "operator token")
+        assert_contains(out, "some auth token")
+        assert_contains(out, "new optoken")
+        assert_contains(out, "new allaccess")
+        assert_contains(out, "new specifics")
+    '';
+}
diff --git a/nixos/tests/initrd-luks-empty-passphrase.nix b/nixos/tests/initrd-luks-empty-passphrase.nix
index 2b981e009f79..47215c4bc998 100644
--- a/nixos/tests/initrd-luks-empty-passphrase.nix
+++ b/nixos/tests/initrd-luks-empty-passphrase.nix
@@ -1,113 +1,110 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-  systemdStage1 ? false,
+  systemdStage1,
+  lib,
+  pkgs,
+  ...
 }:
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
+let
+  keyfile = pkgs.writeText "luks-keyfile" ''
+    MIGHAoGBAJ4rGTSo/ldyjQypd0kuS7k2OSsmQYzMH6TNj3nQ/vIUjDn7fqa3slt2
+    gV6EK3TmTbGc4tzC1v4SWx2m+2Bjdtn4Fs4wiBwn1lbRdC6i5ZYCqasTWIntWn+6
+    FllUkMD5oqjOR/YcboxG8Z3B5sJuvTP9llsF+gnuveWih9dpbBr7AgEC
+  '';
+in
+{
+  name = "initrd-luks-empty-passphrase";
 
-    keyfile = pkgs.writeText "luks-keyfile" ''
-      MIGHAoGBAJ4rGTSo/ldyjQypd0kuS7k2OSsmQYzMH6TNj3nQ/vIUjDn7fqa3slt2
-      gV6EK3TmTbGc4tzC1v4SWx2m+2Bjdtn4Fs4wiBwn1lbRdC6i5ZYCqasTWIntWn+6
-      FllUkMD5oqjOR/YcboxG8Z3B5sJuvTP9llsF+gnuveWih9dpbBr7AgEC
-    '';
+  _module.args.systemdStage1 = lib.mkDefault false;
 
-  in
-  {
-    name = "initrd-luks-empty-passphrase";
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = lib.optionals (!systemdStage1) [ ./common/auto-format-root-device.nix ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = lib.optionals (!systemdStage1) [ ./common/auto-format-root-device.nix ];
-
-        virtualisation = {
-          emptyDiskImages = [ 512 ];
-          useBootLoader = true;
-          useEFIBoot = true;
-          # This requires to have access
-          # to a host Nix store as
-          # the new root device is /dev/vdb
-          # an empty 512MiB drive, containing no Nix store.
-          mountHostNixStore = true;
-          fileSystems."/".autoFormat = lib.mkIf systemdStage1 true;
-        };
-
-        boot.loader.systemd-boot.enable = true;
-        boot.initrd.systemd = lib.mkIf systemdStage1 {
-          enable = true;
-          emergencyAccess = true;
-        };
-        environment.systemPackages = with pkgs; [ cryptsetup ];
-
-        specialisation.boot-luks-wrong-keyfile.configuration = {
-          boot.initrd.luks.devices = lib.mkVMOverride {
-            cryptroot = {
-              device = "/dev/vdb";
-              keyFile = "/etc/cryptroot.key";
-              tryEmptyPassphrase = true;
-              fallbackToPassword = !systemdStage1;
-            };
-          };
-          virtualisation.rootDevice = "/dev/mapper/cryptroot";
-          boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
-        };
-
-        specialisation.boot-luks-missing-keyfile.configuration = {
-          boot.initrd.luks.devices = lib.mkVMOverride {
-            cryptroot = {
-              device = "/dev/vdb";
-              keyFile = "/etc/cryptroot.key";
-              tryEmptyPassphrase = true;
-              fallbackToPassword = !systemdStage1;
-            };
-          };
-          virtualisation.rootDevice = "/dev/mapper/cryptroot";
-        };
+      virtualisation = {
+        emptyDiskImages = [ 512 ];
+        useBootLoader = true;
+        useEFIBoot = true;
+        # This requires to have access
+        # to a host Nix store as
+        # the new root device is /dev/vdb
+        # an empty 512MiB drive, containing no Nix store.
+        mountHostNixStore = true;
+        fileSystems."/".autoFormat = lib.mkIf systemdStage1 true;
       };
 
-    testScript = ''
-      # Encrypt key with empty key so boot should try keyfile and then fallback to empty passphrase
+      boot.loader.systemd-boot.enable = true;
+      boot.initrd.systemd = lib.mkIf systemdStage1 {
+        enable = true;
+        emergencyAccess = true;
+      };
+      environment.systemPackages = with pkgs; [ cryptsetup ];
+
+      specialisation.boot-luks-wrong-keyfile.configuration = {
+        boot.initrd.luks.devices = lib.mkVMOverride {
+          cryptroot = {
+            device = "/dev/vdb";
+            keyFile = "/etc/cryptroot.key";
+            tryEmptyPassphrase = true;
+            fallbackToPassword = !systemdStage1;
+          };
+        };
+        virtualisation.rootDevice = "/dev/mapper/cryptroot";
+        boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
+      };
+
+      specialisation.boot-luks-missing-keyfile.configuration = {
+        boot.initrd.luks.devices = lib.mkVMOverride {
+          cryptroot = {
+            device = "/dev/vdb";
+            keyFile = "/etc/cryptroot.key";
+            tryEmptyPassphrase = true;
+            fallbackToPassword = !systemdStage1;
+          };
+        };
+        virtualisation.rootDevice = "/dev/mapper/cryptroot";
+      };
+    };
+
+  testScript = ''
+    # Encrypt key with empty key so boot should try keyfile and then fallback to empty passphrase
 
 
-      def grub_select_boot_luks_wrong_key_file():
-          """
-          Selects "boot-luks" from the GRUB menu
-          to trigger a login request.
-          """
-          machine.send_monitor_command("sendkey down")
-          machine.send_monitor_command("sendkey down")
-          machine.send_monitor_command("sendkey ret")
+    def grub_select_boot_luks_wrong_key_file():
+        """
+        Selects "boot-luks" from the GRUB menu
+        to trigger a login request.
+        """
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey ret")
 
-      def grub_select_boot_luks_missing_key_file():
-          """
-          Selects "boot-luks" from the GRUB menu
-          to trigger a login request.
-          """
-          machine.send_monitor_command("sendkey down")
-          machine.send_monitor_command("sendkey ret")
+    def grub_select_boot_luks_missing_key_file():
+        """
+        Selects "boot-luks" from the GRUB menu
+        to trigger a login request.
+        """
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey ret")
 
-      # Create encrypted volume
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("echo "" | cryptsetup luksFormat /dev/vdb --batch-mode")
-      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-wrong-keyfile.conf")
-      machine.succeed("sync")
-      machine.crash()
+    # Create encrypted volume
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("echo "" | cryptsetup luksFormat /dev/vdb --batch-mode")
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-wrong-keyfile.conf")
+    machine.succeed("sync")
+    machine.crash()
 
-      # Check if rootfs is on /dev/mapper/cryptroot
-      machine.wait_for_unit("multi-user.target")
-      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+    # Check if rootfs is on /dev/mapper/cryptroot
+    machine.wait_for_unit("multi-user.target")
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
 
-      # Choose boot-luks-missing-keyfile specialisation
-      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-missing-keyfile.conf")
-      machine.succeed("sync")
-      machine.crash()
+    # Choose boot-luks-missing-keyfile specialisation
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-missing-keyfile.conf")
+    machine.succeed("sync")
+    machine.crash()
 
-      # Check if rootfs is on /dev/mapper/cryptroot
-      machine.wait_for_unit("multi-user.target")
-      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-    '';
-  }
-)
+    # Check if rootfs is on /dev/mapper/cryptroot
+    machine.wait_for_unit("multi-user.target")
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+  '';
+}
diff --git a/nixos/tests/initrd-network.nix b/nixos/tests/initrd-network.nix
index 7e86f7f87075..b84588f1d250 100644
--- a/nixos/tests/initrd-network.nix
+++ b/nixos/tests/initrd-network.nix
@@ -1,35 +1,33 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "initrd-network";
+{ pkgs, lib, ... }:
+{
+  name = "initrd-network";
 
-    meta.maintainers = [ ];
+  meta.maintainers = [ ];
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ../modules/profiles/minimal.nix ];
-        boot.initrd.network.enable = true;
-        boot.initrd.network.postCommands = ''
-          ip addr show
-          ip route show
-          ip addr | grep 10.0.2.15 || exit 1
-          ping -c1 10.0.2.2 || exit 1
-        '';
-        # Check if cleanup was done correctly
-        boot.initrd.postMountCommands = lib.mkAfter ''
-          ip addr show
-          ip route show
-          ip addr | grep 10.0.2.15 && exit 1
-          ping -c1 10.0.2.2 && exit 1
-        '';
-      };
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ../modules/profiles/minimal.nix ];
+      boot.initrd.network.enable = true;
+      boot.initrd.network.postCommands = ''
+        ip addr show
+        ip route show
+        ip addr | grep 10.0.2.15 || exit 1
+        ping -c1 10.0.2.2 || exit 1
+      '';
+      # Check if cleanup was done correctly
+      boot.initrd.postMountCommands = lib.mkAfter ''
+        ip addr show
+        ip route show
+        ip addr | grep 10.0.2.15 && exit 1
+        ping -c1 10.0.2.2 && exit 1
+      '';
+    };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("ip addr show >&2")
-      machine.succeed("ip route show >&2")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("ip addr show >&2")
+    machine.succeed("ip route show >&2")
+  '';
+}
diff --git a/nixos/tests/input-remapper.nix b/nixos/tests/input-remapper.nix
index 4937274aa692..eb444d8683a6 100644
--- a/nixos/tests/input-remapper.nix
+++ b/nixos/tests/input-remapper.nix
@@ -1,65 +1,63 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "input-remapper";
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ LunNova ];
+{
+  name = "input-remapper";
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ LunNova ];
+  };
+
+  nodes.machine =
+    { config, ... }:
+    let
+      user = config.users.users.sybil;
+    in
+    {
+      imports = [
+        ./common/user-account.nix
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      services.input-remapper.enable = true;
+      users.users.sybil = {
+        isNormalUser = true;
+        group = "wheel";
+      };
+      test-support.displayManager.auto.user = user.name;
+      # workaround for pkexec not working in the test environment
+      # Error creating textual authentication agent:
+      #   Error opening current controlling terminal for the process (`/dev/tty'):
+      #   No such device or address
+      # passwordless pkexec with polkit module also doesn't work
+      # to allow the program to run, we replace pkexec with sudo
+      # and turn on passwordless sudo
+      # this is not correct in general but good enough for this test
+      security.sudo = {
+        enable = true;
+        wheelNeedsPassword = false;
+      };
+      security.wrappers.pkexec = pkgs.lib.mkForce {
+        setuid = true;
+        owner = "root";
+        group = "root";
+        source = "${pkgs.sudo}/bin/sudo";
+      };
     };
 
-    nodes.machine =
-      { config, ... }:
-      let
-        user = config.users.users.sybil;
-      in
-      {
-        imports = [
-          ./common/user-account.nix
-          ./common/x11.nix
-        ];
+  enableOCR = true;
 
-        services.xserver.enable = true;
-        services.input-remapper.enable = true;
-        users.users.sybil = {
-          isNormalUser = true;
-          group = "wheel";
-        };
-        test-support.displayManager.auto.user = user.name;
-        # workaround for pkexec not working in the test environment
-        # Error creating textual authentication agent:
-        #   Error opening current controlling terminal for the process (`/dev/tty'):
-        #   No such device or address
-        # passwordless pkexec with polkit module also doesn't work
-        # to allow the program to run, we replace pkexec with sudo
-        # and turn on passwordless sudo
-        # this is not correct in general but good enough for this test
-        security.sudo = {
-          enable = true;
-          wheelNeedsPassword = false;
-        };
-        security.wrappers.pkexec = pkgs.lib.mkForce {
-          setuid = true;
-          owner = "root";
-          group = "root";
-          source = "${pkgs.sudo}/bin/sudo";
-        };
-      };
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+      machine.wait_for_x()
 
-    enableOCR = true;
+      machine.succeed("systemctl status input-remapper.service")
+      machine.execute("su - sybil -c input-remapper-gtk >&2 &")
 
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
-        machine.wait_for_x()
-
-        machine.succeed("systemctl status input-remapper.service")
-        machine.execute("su - sybil -c input-remapper-gtk >&2 &")
-
-        machine.wait_for_text("Input Remapper")
-        machine.wait_for_text("Device")
-        machine.wait_for_text("Presets")
-        machine.wait_for_text("Editor")
-      '';
-  }
-)
+      machine.wait_for_text("Input Remapper")
+      machine.wait_for_text("Device")
+      machine.wait_for_text("Presets")
+      machine.wait_for_text("Editor")
+    '';
+}
diff --git a/nixos/tests/inspircd.nix b/nixos/tests/inspircd.nix
index b3dc09dd7521..b163622dd5b5 100644
--- a/nixos/tests/inspircd.nix
+++ b/nixos/tests/inspircd.nix
@@ -9,96 +9,94 @@ let
   iiDir = "/tmp/irc";
 in
 
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "inspircd";
-    nodes =
-      {
-        "${server}" = {
-          networking.firewall.allowedTCPPorts = [ ircPort ];
-          services.inspircd = {
-            enable = true;
-            package = pkgs.inspircdMinimal;
-            config = ''
-              <bind address="" port="${toString ircPort}" type="clients">
-              <connect name="main" allow="*" pingfreq="15">
-            '';
-          };
+{ pkgs, lib, ... }:
+{
+  name = "inspircd";
+  nodes =
+    {
+      "${server}" = {
+        networking.firewall.allowedTCPPorts = [ ircPort ];
+        services.inspircd = {
+          enable = true;
+          package = pkgs.inspircdMinimal;
+          config = ''
+            <bind address="" port="${toString ircPort}" type="clients">
+            <connect name="main" allow="*" pingfreq="15">
+          '';
         };
-      }
-      // lib.listToAttrs (
-        builtins.map (
-          client:
-          lib.nameValuePair client {
-            imports = [
-              ./common/user-account.nix
-            ];
+      };
+    }
+    // lib.listToAttrs (
+      builtins.map (
+        client:
+        lib.nameValuePair client {
+          imports = [
+            ./common/user-account.nix
+          ];
 
-            systemd.services.ii = {
-              requires = [ "network.target" ];
-              wantedBy = [ "default.target" ];
+          systemd.services.ii = {
+            requires = [ "network.target" ];
+            wantedBy = [ "default.target" ];
 
-              serviceConfig = {
-                Type = "simple";
-                ExecPreStartPre = "mkdir -p ${iiDir}";
-                ExecStart = ''
-                  ${lib.getBin pkgs.ii}/bin/ii -n ${client} -s ${server} -i ${iiDir}
-                '';
-                User = "alice";
-              };
+            serviceConfig = {
+              Type = "simple";
+              ExecPreStartPre = "mkdir -p ${iiDir}";
+              ExecStart = ''
+                ${lib.getBin pkgs.ii}/bin/ii -n ${client} -s ${server} -i ${iiDir}
+              '';
+              User = "alice";
             };
-          }
-        ) clients
-      );
+          };
+        }
+      ) clients
+    );
 
-    testScript =
-      let
-        msg = client: "Hello, my name is ${client}";
-        clientScript =
-          client:
-          [
-            ''
-              ${client}.wait_for_unit("network.target")
-              ${client}.systemctl("start ii")
-              ${client}.wait_for_unit("ii")
-              ${client}.wait_for_file("${iiDir}/${server}/out")
-            ''
-            # wait until first PING from server arrives before joining,
-            # so we don't try it too early
-            ''
-              ${client}.wait_until_succeeds("grep 'PING' ${iiDir}/${server}/out")
-            ''
-            # join ${channel}
-            ''
-              ${client}.succeed("echo '/j #${channel}' > ${iiDir}/${server}/in")
-              ${client}.wait_for_file("${iiDir}/${server}/#${channel}/in")
-            ''
-            # send a greeting
-            ''
-              ${client}.succeed(
-                  "echo '${msg client}' > ${iiDir}/${server}/#${channel}/in"
-              )
-            ''
-            # check that all greetings arrived on all clients
-          ]
-          ++ builtins.map (other: ''
+  testScript =
+    let
+      msg = client: "Hello, my name is ${client}";
+      clientScript =
+        client:
+        [
+          ''
+            ${client}.wait_for_unit("network.target")
+            ${client}.systemctl("start ii")
+            ${client}.wait_for_unit("ii")
+            ${client}.wait_for_file("${iiDir}/${server}/out")
+          ''
+          # wait until first PING from server arrives before joining,
+          # so we don't try it too early
+          ''
+            ${client}.wait_until_succeeds("grep 'PING' ${iiDir}/${server}/out")
+          ''
+          # join ${channel}
+          ''
+            ${client}.succeed("echo '/j #${channel}' > ${iiDir}/${server}/in")
+            ${client}.wait_for_file("${iiDir}/${server}/#${channel}/in")
+          ''
+          # send a greeting
+          ''
             ${client}.succeed(
-                "grep '${msg other}$' ${iiDir}/${server}/#${channel}/out"
+                "echo '${msg client}' > ${iiDir}/${server}/#${channel}/in"
             )
-          '') clients;
+          ''
+          # check that all greetings arrived on all clients
+        ]
+        ++ builtins.map (other: ''
+          ${client}.succeed(
+              "grep '${msg other}$' ${iiDir}/${server}/#${channel}/out"
+          )
+        '') clients;
 
-        # foldl', but requires a non-empty list instead of a start value
-        reduce = f: list: builtins.foldl' f (builtins.head list) (builtins.tail list);
-      in
-      ''
-        start_all()
-        ${server}.wait_for_open_port(${toString ircPort})
+      # foldl', but requires a non-empty list instead of a start value
+      reduce = f: list: builtins.foldl' f (builtins.head list) (builtins.tail list);
+    in
+    ''
+      start_all()
+      ${server}.wait_for_open_port(${toString ircPort})
 
-        # run clientScript for all clients so that every list
-        # entry is executed by every client before advancing
-        # to the next one.
-      ''
-      + lib.concatStrings (reduce (lib.zipListsWith (cs: c: cs + c)) (builtins.map clientScript clients));
-  }
-)
+      # run clientScript for all clients so that every list
+      # entry is executed by every client before advancing
+      # to the next one.
+    ''
+    + lib.concatStrings (reduce (lib.zipListsWith (cs: c: cs + c)) (builtins.map clientScript clients));
+}
diff --git a/nixos/tests/intune.nix b/nixos/tests/intune.nix
index eeb55f053f8a..1d36f107f9e6 100644
--- a/nixos/tests/intune.nix
+++ b/nixos/tests/intune.nix
@@ -1,66 +1,64 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "intune";
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ rhysmdnz ];
+{ pkgs, ... }:
+{
+  name = "intune";
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ rhysmdnz ];
+  };
+  enableOCR = true;
+
+  nodes.machine =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+    in
+    {
+      services.intune.enable = true;
+      services.gnome.gnome-keyring.enable = true;
+      imports = [
+        ./common/user-account.nix
+        ./common/x11.nix
+      ];
+      test-support.displayManager.auto.user = user.name;
+      environment = {
+        variables.DBUS_SESSION_BUS_ADDRESS = "unix:path=/run/user/${builtins.toString user.uid}/bus";
+      };
+    };
+  nodes.pam =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+    in
+    {
+      services.intune.enable = true;
+      imports = [ ./common/user-account.nix ];
     };
-    enableOCR = true;
 
-    nodes.machine =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-      in
-      {
-        services.intune.enable = true;
-        services.gnome.gnome-keyring.enable = true;
-        imports = [
-          ./common/user-account.nix
-          ./common/x11.nix
-        ];
-        test-support.displayManager.auto.user = user.name;
-        environment = {
-          variables.DBUS_SESSION_BUS_ADDRESS = "unix:path=/run/user/${builtins.toString user.uid}/bus";
-        };
-      };
-    nodes.pam =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-      in
-      {
-        services.intune.enable = true;
-        imports = [ ./common/user-account.nix ];
-      };
+  testScript = ''
+    start_all()
 
-    testScript = ''
-      start_all()
+    # Check System Daemons successfully start
+    machine.succeed("systemctl start microsoft-identity-device-broker.service")
+    machine.succeed("systemctl start intune-daemon.service")
 
-      # Check System Daemons successfully start
-      machine.succeed("systemctl start microsoft-identity-device-broker.service")
-      machine.succeed("systemctl start intune-daemon.service")
+    # Check User Daemons and intune-portal execurtable works
+    # Going any further than starting it would require internet access and a microsoft account
+    machine.wait_for_x()
+    # TODO: This needs an unlocked user keychain before it will work
+    #machine.succeed("su - alice -c 'systemctl start --user microsoft-identity-broker.service'")
+    machine.succeed("su - alice -c 'systemctl start --user intune-agent.service'")
+    machine.succeed("su - alice -c intune-portal >&2 &")
+    machine.wait_for_text("Intune Agent")
 
-      # Check User Daemons and intune-portal execurtable works
-      # Going any further than starting it would require internet access and a microsoft account
-      machine.wait_for_x()
-      # TODO: This needs an unlocked user keychain before it will work
-      #machine.succeed("su - alice -c 'systemctl start --user microsoft-identity-broker.service'")
-      machine.succeed("su - alice -c 'systemctl start --user intune-agent.service'")
-      machine.succeed("su - alice -c intune-portal >&2 &")
-      machine.wait_for_text("Intune Agent")
+    # Check logging in creates password file
+    def login_as_alice():
+        pam.wait_until_tty_matches("1", "login: ")
+        pam.send_chars("alice\n")
+        pam.wait_until_tty_matches("1", "Password: ")
+        pam.send_chars("foobar\n")
+        pam.wait_until_tty_matches("1", "alice\@pam")
 
-      # Check logging in creates password file
-      def login_as_alice():
-          pam.wait_until_tty_matches("1", "login: ")
-          pam.send_chars("alice\n")
-          pam.wait_until_tty_matches("1", "Password: ")
-          pam.send_chars("foobar\n")
-          pam.wait_until_tty_matches("1", "alice\@pam")
-
-      pam.wait_for_unit("multi-user.target")
-      login_as_alice()
-      pam.wait_for_file("/run/intune/1000/pwquality")
-    '';
-  }
-)
+    pam.wait_for_unit("multi-user.target")
+    login_as_alice()
+    pam.wait_for_file("/run/intune/1000/pwquality")
+  '';
+}
diff --git a/nixos/tests/invidious.nix b/nixos/tests/invidious.nix
index d4817cac4ebf..24efe642784a 100644
--- a/nixos/tests/invidious.nix
+++ b/nixos/tests/invidious.nix
@@ -1,154 +1,152 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "invidious";
+{ pkgs, ... }:
+{
+  name = "invidious";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ sbruder ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ sbruder ];
+  };
 
-    nodes = {
-      postgres-tcp =
-        { config, pkgs, ... }:
-        {
-          services.postgresql = {
-            enable = true;
-            initialScript = pkgs.writeText "init-postgres-with-password" ''
-              CREATE USER invidious WITH PASSWORD 'correct horse battery staple';
-              CREATE DATABASE invidious WITH OWNER invidious;
-            '';
-            enableTCPIP = true;
-            authentication = ''
-              host invidious invidious samenet scram-sha-256
-            '';
-          };
-          networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
+  nodes = {
+    postgres-tcp =
+      { config, pkgs, ... }:
+      {
+        services.postgresql = {
+          enable = true;
+          initialScript = pkgs.writeText "init-postgres-with-password" ''
+            CREATE USER invidious WITH PASSWORD 'correct horse battery staple';
+            CREATE DATABASE invidious WITH OWNER invidious;
+          '';
+          enableTCPIP = true;
+          authentication = ''
+            host invidious invidious samenet scram-sha-256
+          '';
+        };
+        networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
+      };
+    machine =
+      { lib, pkgs, ... }:
+      {
+        services.invidious = {
+          enable = true;
         };
-      machine =
-        { lib, pkgs, ... }:
-        {
-          services.invidious = {
-            enable = true;
-          };
 
-          specialisation = {
-            nginx.configuration = {
-              services.invidious = {
-                nginx.enable = true;
-                domain = "invidious.example.com";
-              };
-              services.nginx.virtualHosts."invidious.example.com" = {
-                forceSSL = false;
-                enableACME = false;
-              };
-              networking.hosts."127.0.0.1" = [ "invidious.example.com" ];
+        specialisation = {
+          nginx.configuration = {
+            services.invidious = {
+              nginx.enable = true;
+              domain = "invidious.example.com";
             };
-            nginx-sig-helper.configuration = {
-              services.invidious = {
-                nginx.enable = true;
-                domain = "invidious.example.com";
-                sig-helper.enable = true;
-                settings.log_level = "Trace";
-              };
-              services.nginx.virtualHosts."invidious.example.com" = {
-                forceSSL = false;
-                enableACME = false;
-              };
-              networking.hosts."127.0.0.1" = [ "invidious.example.com" ];
+            services.nginx.virtualHosts."invidious.example.com" = {
+              forceSSL = false;
+              enableACME = false;
             };
-            nginx-scale.configuration = {
-              services.invidious = {
-                nginx.enable = true;
-                domain = "invidious.example.com";
-                serviceScale = 3;
-              };
-              services.nginx.virtualHosts."invidious.example.com" = {
-                forceSSL = false;
-                enableACME = false;
-              };
-              networking.hosts."127.0.0.1" = [ "invidious.example.com" ];
+            networking.hosts."127.0.0.1" = [ "invidious.example.com" ];
+          };
+          nginx-sig-helper.configuration = {
+            services.invidious = {
+              nginx.enable = true;
+              domain = "invidious.example.com";
+              sig-helper.enable = true;
+              settings.log_level = "Trace";
             };
-            nginx-scale-ytproxy.configuration = {
-              services.invidious = {
-                nginx.enable = true;
-                http3-ytproxy.enable = true;
-                domain = "invidious.example.com";
-                serviceScale = 3;
-              };
-              services.nginx.virtualHosts."invidious.example.com" = {
-                forceSSL = false;
-                enableACME = false;
-              };
-              networking.hosts."127.0.0.1" = [ "invidious.example.com" ];
+            services.nginx.virtualHosts."invidious.example.com" = {
+              forceSSL = false;
+              enableACME = false;
             };
-            postgres-tcp.configuration = {
-              services.invidious = {
-                database = {
-                  createLocally = false;
-                  host = "postgres-tcp";
-                  passwordFile = toString (pkgs.writeText "database-password" "correct horse battery staple");
-                };
+            networking.hosts."127.0.0.1" = [ "invidious.example.com" ];
+          };
+          nginx-scale.configuration = {
+            services.invidious = {
+              nginx.enable = true;
+              domain = "invidious.example.com";
+              serviceScale = 3;
+            };
+            services.nginx.virtualHosts."invidious.example.com" = {
+              forceSSL = false;
+              enableACME = false;
+            };
+            networking.hosts."127.0.0.1" = [ "invidious.example.com" ];
+          };
+          nginx-scale-ytproxy.configuration = {
+            services.invidious = {
+              nginx.enable = true;
+              http3-ytproxy.enable = true;
+              domain = "invidious.example.com";
+              serviceScale = 3;
+            };
+            services.nginx.virtualHosts."invidious.example.com" = {
+              forceSSL = false;
+              enableACME = false;
+            };
+            networking.hosts."127.0.0.1" = [ "invidious.example.com" ];
+          };
+          postgres-tcp.configuration = {
+            services.invidious = {
+              database = {
+                createLocally = false;
+                host = "postgres-tcp";
+                passwordFile = toString (pkgs.writeText "database-password" "correct horse battery staple");
               };
             };
           };
         };
-    };
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        def curl_assert_status_code(url, code, form=None):
-            assert int(machine.succeed(f"curl -s -o /dev/null -w %{{http_code}} {'-F ' + form + ' ' if form else '''}{url}")) == code
+  testScript =
+    { nodes, ... }:
+    ''
+      def curl_assert_status_code(url, code, form=None):
+          assert int(machine.succeed(f"curl -s -o /dev/null -w %{{http_code}} {'-F ' + form + ' ' if form else '''}{url}")) == code
 
 
-        def activate_specialisation(name: str):
-            machine.succeed(f"${nodes.machine.system.build.toplevel}/specialisation/{name}/bin/switch-to-configuration test >&2")
+      def activate_specialisation(name: str):
+          machine.succeed(f"${nodes.machine.system.build.toplevel}/specialisation/{name}/bin/switch-to-configuration test >&2")
 
 
-        url = "http://localhost:${toString nodes.machine.services.invidious.port}"
-        port = ${toString nodes.machine.services.invidious.port}
+      url = "http://localhost:${toString nodes.machine.services.invidious.port}"
+      port = ${toString nodes.machine.services.invidious.port}
 
-        # start postgres vm now
-        postgres_tcp.start()
+      # start postgres vm now
+      postgres_tcp.start()
 
-        machine.wait_for_open_port(port)
-        curl_assert_status_code(f"{url}/search", 200)
+      machine.wait_for_open_port(port)
+      curl_assert_status_code(f"{url}/search", 200)
 
-        activate_specialisation("nginx")
-        machine.wait_for_open_port(80)
-        curl_assert_status_code("http://invidious.example.com/search", 200)
+      activate_specialisation("nginx")
+      machine.wait_for_open_port(80)
+      curl_assert_status_code("http://invidious.example.com/search", 200)
 
-        activate_specialisation("nginx-scale")
-        machine.wait_for_open_port(80)
-        # this depends on nginx round-robin behaviour for the upstream servers
-        curl_assert_status_code("http://invidious.example.com/search", 200)
-        curl_assert_status_code("http://invidious.example.com/search", 200)
-        curl_assert_status_code("http://invidious.example.com/search", 200)
-        machine.succeed("journalctl -eu invidious.service | grep -o '200 GET /search'")
-        machine.succeed("journalctl -eu invidious-1.service | grep -o '200 GET /search'")
-        machine.succeed("journalctl -eu invidious-2.service | grep -o '200 GET /search'")
+      activate_specialisation("nginx-scale")
+      machine.wait_for_open_port(80)
+      # this depends on nginx round-robin behaviour for the upstream servers
+      curl_assert_status_code("http://invidious.example.com/search", 200)
+      curl_assert_status_code("http://invidious.example.com/search", 200)
+      curl_assert_status_code("http://invidious.example.com/search", 200)
+      machine.succeed("journalctl -eu invidious.service | grep -o '200 GET /search'")
+      machine.succeed("journalctl -eu invidious-1.service | grep -o '200 GET /search'")
+      machine.succeed("journalctl -eu invidious-2.service | grep -o '200 GET /search'")
 
-        activate_specialisation("nginx-scale-ytproxy")
-        machine.wait_for_unit("http3-ytproxy.service")
-        machine.wait_for_open_port(80)
-        machine.wait_until_succeeds("ls /run/http3-ytproxy/socket/http-proxy.sock")
-        curl_assert_status_code("http://invidious.example.com/search", 200)
-        # this should error out as no internet connectivity is available in the test
-        curl_assert_status_code("http://invidious.example.com/vi/dQw4w9WgXcQ/mqdefault.jpg", 502)
-        machine.succeed("journalctl -eu http3-ytproxy.service | grep -o 'dQw4w9WgXcQ'")
+      activate_specialisation("nginx-scale-ytproxy")
+      machine.wait_for_unit("http3-ytproxy.service")
+      machine.wait_for_open_port(80)
+      machine.wait_until_succeeds("ls /run/http3-ytproxy/socket/http-proxy.sock")
+      curl_assert_status_code("http://invidious.example.com/search", 200)
+      # this should error out as no internet connectivity is available in the test
+      curl_assert_status_code("http://invidious.example.com/vi/dQw4w9WgXcQ/mqdefault.jpg", 502)
+      machine.succeed("journalctl -eu http3-ytproxy.service | grep -o 'dQw4w9WgXcQ'")
 
-        activate_specialisation("nginx-sig-helper")
-        machine.wait_for_unit("invidious-sig-helper.service")
-        # we can't really test the sig helper that well without internet connection...
-        # invidious does connect to the sig helper though and crashes when the sig helper is not available
-        machine.wait_for_open_port(80)
-        curl_assert_status_code("http://invidious.example.com/search", 200)
-        machine.succeed("journalctl -eu invidious.service | grep -o \"SigHelper: Using helper at 'tcp://127.0.0.1:2999'\"")
+      activate_specialisation("nginx-sig-helper")
+      machine.wait_for_unit("invidious-sig-helper.service")
+      # we can't really test the sig helper that well without internet connection...
+      # invidious does connect to the sig helper though and crashes when the sig helper is not available
+      machine.wait_for_open_port(80)
+      curl_assert_status_code("http://invidious.example.com/search", 200)
+      machine.succeed("journalctl -eu invidious.service | grep -o \"SigHelper: Using helper at 'tcp://127.0.0.1:2999'\"")
 
-        postgres_tcp.wait_for_unit("postgresql.service")
-        activate_specialisation("postgres-tcp")
-        machine.wait_for_open_port(port)
-        curl_assert_status_code(f"{url}/search", 200)
-      '';
-  }
-)
+      postgres_tcp.wait_for_unit("postgresql.service")
+      activate_specialisation("postgres-tcp")
+      machine.wait_for_open_port(port)
+      curl_assert_status_code(f"{url}/search", 200)
+    '';
+}
diff --git a/nixos/tests/iodine.nix b/nixos/tests/iodine.nix
index 573f6d7aebeb..04ed8dcfaa53 100644
--- a/nixos/tests/iodine.nix
+++ b/nixos/tests/iodine.nix
@@ -1,66 +1,64 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    domain = "whatever.example.com";
-    password = "false;foo;exit;withspecialcharacters";
-  in
-  {
-    name = "iodine";
-    nodes = {
-      server =
-        { ... }:
+{ pkgs, ... }:
+let
+  domain = "whatever.example.com";
+  password = "false;foo;exit;withspecialcharacters";
+in
+{
+  name = "iodine";
+  nodes = {
+    server =
+      { ... }:
 
-        {
-          networking.firewall = {
-            allowedUDPPorts = [ 53 ];
-            trustedInterfaces = [ "dns0" ];
-          };
-          boot.kernel.sysctl = {
-            "net.ipv4.ip_forward" = 1;
-            "net.ipv6.ip_forward" = 1;
-          };
-
-          services.iodine.server = {
-            enable = true;
-            ip = "10.53.53.1/24";
-            passwordFile = "${builtins.toFile "password" password}";
-            inherit domain;
-          };
-
-          # test resource: accessible only via tunnel
-          services.openssh = {
-            enable = true;
-            openFirewall = false;
-          };
+      {
+        networking.firewall = {
+          allowedUDPPorts = [ 53 ];
+          trustedInterfaces = [ "dns0" ];
+        };
+        boot.kernel.sysctl = {
+          "net.ipv4.ip_forward" = 1;
+          "net.ipv6.ip_forward" = 1;
         };
 
-      client =
-        { ... }:
-        {
-          services.iodine.clients.testClient = {
-            # test that ProtectHome is "read-only"
-            passwordFile = "/root/pw";
-            relay = "server";
-            server = domain;
-          };
-          systemd.tmpfiles.rules = [
-            "f /root/pw 0666 root root - ${password}"
-          ];
-          environment.systemPackages = [
-            pkgs.nagiosPluginsOfficial
-          ];
+        services.iodine.server = {
+          enable = true;
+          ip = "10.53.53.1/24";
+          passwordFile = "${builtins.toFile "password" password}";
+          inherit domain;
         };
 
-    };
+        # test resource: accessible only via tunnel
+        services.openssh = {
+          enable = true;
+          openFirewall = false;
+        };
+      };
 
-    testScript = ''
-      start_all()
+    client =
+      { ... }:
+      {
+        services.iodine.clients.testClient = {
+          # test that ProtectHome is "read-only"
+          passwordFile = "/root/pw";
+          relay = "server";
+          server = domain;
+        };
+        systemd.tmpfiles.rules = [
+          "f /root/pw 0666 root root - ${password}"
+        ];
+        environment.systemPackages = [
+          pkgs.nagiosPluginsOfficial
+        ];
+      };
 
-      server.wait_for_unit("sshd")
-      server.wait_for_unit("iodined")
-      client.wait_for_unit("iodine-testClient")
+  };
 
-      client.succeed("check_ssh -H 10.53.53.1")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("sshd")
+    server.wait_for_unit("iodined")
+    client.wait_for_unit("iodine-testClient")
+
+    client.succeed("check_ssh -H 10.53.53.1")
+  '';
+}
diff --git a/nixos/tests/iosched.nix b/nixos/tests/iosched.nix
index 92870e3ae603..c113f23f1d6d 100644
--- a/nixos/tests/iosched.nix
+++ b/nixos/tests/iosched.nix
@@ -1,71 +1,69 @@
-import ./make-test-python.nix (
-  {
-    pkgs,
-    ...
-  }:
-  let
-    qemu-img = pkgs.lib.getExe' pkgs.vmTools.qemu "qemu-img";
-    empty = pkgs.runCommand "empty.qcow2" { } ''
-      ${qemu-img} create -f qcow2 "$out" 32M
-    '';
-  in
-  {
-    name = "iosched";
-    meta.maintainers = with pkgs.lib.maintainers; [ mvs ];
+{
+  pkgs,
+  ...
+}:
+let
+  qemu-img = pkgs.lib.getExe' pkgs.vmTools.qemu "qemu-img";
+  empty = pkgs.runCommand "empty.qcow2" { } ''
+    ${qemu-img} create -f qcow2 "$out" 32M
+  '';
+in
+{
+  name = "iosched";
+  meta.maintainers = with pkgs.lib.maintainers; [ mvs ];
 
-    nodes.machine = {
-      virtualisation.qemu.options = [
-        "-drive"
-        "id=sda,if=none,format=qcow2,readonly=on,file=${empty}"
-        "-drive"
-        "id=sdb,if=none,format=qcow2,readonly=on,file=${empty}"
-        "-drive"
-        "id=nvme0n1,if=none,format=qcow2,readonly=on,file=${empty}"
-        "-drive"
-        "id=mmcblk0,if=none,format=qcow2,file=./mmcblk0.qcow2"
-        "-device"
-        "virtio-scsi-pci,id=scsi0"
-        "-device"
-        "sdhci-pci"
-        "-device"
-        "scsi-hd,rotation_rate=1,bus=scsi0.0,drive=sda"
-        "-device"
-        "scsi-hd,rotation_rate=7200,bus=scsi0.0,drive=sdb"
-        "-device"
-        "sd-card,drive=mmcblk0"
-        "-device"
-        "nvme,serial=deadbeef,drive=nvme0n1"
-      ];
+  nodes.machine = {
+    virtualisation.qemu.options = [
+      "-drive"
+      "id=sda,if=none,format=qcow2,readonly=on,file=${empty}"
+      "-drive"
+      "id=sdb,if=none,format=qcow2,readonly=on,file=${empty}"
+      "-drive"
+      "id=nvme0n1,if=none,format=qcow2,readonly=on,file=${empty}"
+      "-drive"
+      "id=mmcblk0,if=none,format=qcow2,file=./mmcblk0.qcow2"
+      "-device"
+      "virtio-scsi-pci,id=scsi0"
+      "-device"
+      "sdhci-pci"
+      "-device"
+      "scsi-hd,rotation_rate=1,bus=scsi0.0,drive=sda"
+      "-device"
+      "scsi-hd,rotation_rate=7200,bus=scsi0.0,drive=sdb"
+      "-device"
+      "sd-card,drive=mmcblk0"
+      "-device"
+      "nvme,serial=deadbeef,drive=nvme0n1"
+    ];
 
-      hardware.block = {
-        defaultScheduler = "none";
-        defaultSchedulerRotational = "mq-deadline";
-        scheduler = {
-          "nvme[0-9]*" = "kyber";
-          "mmcblk[0-9]*" = "bfq";
-        };
+    hardware.block = {
+      defaultScheduler = "none";
+      defaultSchedulerRotational = "mq-deadline";
+      scheduler = {
+        "nvme[0-9]*" = "kyber";
+        "mmcblk[0-9]*" = "bfq";
       };
     };
+  };
 
-    testScript = ''
-      import subprocess
+  testScript = ''
+    import subprocess
 
-      def check_scheduler(dev, scheduler):
-        machine.succeed("grep -F -q '[{}]' /sys/block/{}/queue/scheduler".format(scheduler, dev))
+    def check_scheduler(dev, scheduler):
+      machine.succeed("grep -F -q '[{}]' /sys/block/{}/queue/scheduler".format(scheduler, dev))
 
-      subprocess.check_call([
-        "${qemu-img}", "create", "-f", "qcow2", "vm-state-machine/mmcblk0.qcow2", "32M"
-      ])
+    subprocess.check_call([
+      "${qemu-img}", "create", "-f", "qcow2", "vm-state-machine/mmcblk0.qcow2", "32M"
+    ])
 
-      machine.start()
-      machine.succeed("udevadm verify --no-style")
-      check_scheduler("sda", "none")
-      check_scheduler("sdb", "mq-deadline")
-      check_scheduler("nvme0n1", "kyber")
-      check_scheduler("mmcblk0", "bfq")
+    machine.start()
+    machine.succeed("udevadm verify --no-style")
+    check_scheduler("sda", "none")
+    check_scheduler("sdb", "mq-deadline")
+    check_scheduler("nvme0n1", "kyber")
+    check_scheduler("mmcblk0", "bfq")
 
-      machine.succeed("tmp=\"$(mktemp)\"; losetup /dev/loop0 \"$tmp\"")
-      check_scheduler("loop0", "none")
-    '';
-  }
-)
+    machine.succeed("tmp=\"$(mktemp)\"; losetup /dev/loop0 \"$tmp\"")
+    check_scheduler("loop0", "none")
+  '';
+}
diff --git a/nixos/tests/ipv6.nix b/nixos/tests/ipv6.nix
index cc0bf895c5e3..ca25c0b4497f 100644
--- a/nixos/tests/ipv6.nix
+++ b/nixos/tests/ipv6.nix
@@ -1,133 +1,131 @@
 # Test of IPv6 functionality in NixOS, including whether router
 # solicication/advertisement using radvd works.
 
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "ipv6";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
+{ pkgs, lib, ... }:
+{
+  name = "ipv6";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
+
+  nodes = {
+    # We use lib.mkForce here to remove the interface configuration
+    # provided by makeTest, so that the interfaces are all configured
+    # implicitly.
+
+    # This client should use privacy extensions fully, having a
+    # completely-default network configuration.
+    client_defaults.networking.interfaces = lib.mkForce { };
+
+    # Both of these clients should obtain temporary addresses, but
+    # not use them as the default source IP. We thus run the same
+    # checks against them — but the configuration resulting in this
+    # behaviour is different.
+
+    # Here, by using an altered default value for the global setting...
+    client_global_setting = {
+      networking.interfaces = lib.mkForce { };
+      networking.tempAddresses = "enabled";
+    };
+    # and here, by setting this on the interface explicitly.
+    client_interface_setting = {
+      networking.tempAddresses = "disabled";
+      networking.interfaces = lib.mkForce {
+        eth1.tempAddress = "enabled";
+      };
     };
 
-    nodes = {
-      # We use lib.mkForce here to remove the interface configuration
-      # provided by makeTest, so that the interfaces are all configured
-      # implicitly.
-
-      # This client should use privacy extensions fully, having a
-      # completely-default network configuration.
-      client_defaults.networking.interfaces = lib.mkForce { };
-
-      # Both of these clients should obtain temporary addresses, but
-      # not use them as the default source IP. We thus run the same
-      # checks against them — but the configuration resulting in this
-      # behaviour is different.
-
-      # Here, by using an altered default value for the global setting...
-      client_global_setting = {
-        networking.interfaces = lib.mkForce { };
-        networking.tempAddresses = "enabled";
-      };
-      # and here, by setting this on the interface explicitly.
-      client_interface_setting = {
-        networking.tempAddresses = "disabled";
-        networking.interfaces = lib.mkForce {
-          eth1.tempAddress = "enabled";
-        };
-      };
-
-      server = {
-        services.httpd.enable = true;
-        services.httpd.adminAddr = "foo@example.org";
-        networking.firewall.allowedTCPPorts = [ 80 ];
-        # disable testing driver's default IPv6 address.
-        networking.interfaces.eth1.ipv6.addresses = lib.mkForce [ ];
-      };
-
-      router =
-        { ... }:
-        {
-          services.radvd.enable = true;
-          services.radvd.config = ''
-            interface eth1 {
-              AdvSendAdvert on;
-              # ULA prefix (RFC 4193).
-              prefix fd60:cc69:b537:1::/64 { };
-            };
-          '';
-        };
+    server = {
+      services.httpd.enable = true;
+      services.httpd.adminAddr = "foo@example.org";
+      networking.firewall.allowedTCPPorts = [ 80 ];
+      # disable testing driver's default IPv6 address.
+      networking.interfaces.eth1.ipv6.addresses = lib.mkForce [ ];
     };
 
-    testScript = ''
-      import re
+    router =
+      { ... }:
+      {
+        services.radvd.enable = true;
+        services.radvd.config = ''
+          interface eth1 {
+            AdvSendAdvert on;
+            # ULA prefix (RFC 4193).
+            prefix fd60:cc69:b537:1::/64 { };
+          };
+        '';
+      };
+  };
 
-      # Start the router first so that it respond to router solicitations.
-      router.wait_for_unit("radvd")
+  testScript = ''
+    import re
 
-      clients = [client_defaults, client_global_setting, client_interface_setting]
+    # Start the router first so that it respond to router solicitations.
+    router.wait_for_unit("radvd")
 
-      start_all()
+    clients = [client_defaults, client_global_setting, client_interface_setting]
 
-      for client in clients:
-          client.wait_for_unit("network.target")
-      server.wait_for_unit("network.target")
-      server.wait_for_unit("httpd.service")
+    start_all()
 
-      # Wait until the given interface has a non-tentative address of
-      # the desired scope (i.e. has completed Duplicate Address
-      # Detection).
-      def wait_for_address(machine, iface, scope, temporary=False):
-          temporary_flag = "temporary" if temporary else "-temporary"
-          cmd = f"ip -o -6 addr show dev {iface} scope {scope} -tentative {temporary_flag}"
+    for client in clients:
+        client.wait_for_unit("network.target")
+    server.wait_for_unit("network.target")
+    server.wait_for_unit("httpd.service")
 
-          machine.wait_until_succeeds(f"[ `{cmd} | wc -l` -eq 1 ]")
-          output = machine.succeed(cmd)
-          ip = re.search(r"inet6 ([0-9a-f:]{2,})/", output).group(1)
+    # Wait until the given interface has a non-tentative address of
+    # the desired scope (i.e. has completed Duplicate Address
+    # Detection).
+    def wait_for_address(machine, iface, scope, temporary=False):
+        temporary_flag = "temporary" if temporary else "-temporary"
+        cmd = f"ip -o -6 addr show dev {iface} scope {scope} -tentative {temporary_flag}"
 
-          if temporary:
-              scope = scope + " temporary"
-          machine.log(f"{scope} address on {iface} is {ip}")
-          return ip
+        machine.wait_until_succeeds(f"[ `{cmd} | wc -l` -eq 1 ]")
+        output = machine.succeed(cmd)
+        ip = re.search(r"inet6 ([0-9a-f:]{2,})/", output).group(1)
+
+        if temporary:
+            scope = scope + " temporary"
+        machine.log(f"{scope} address on {iface} is {ip}")
+        return ip
 
 
-      with subtest("Loopback address can be pinged"):
-          client_defaults.succeed("ping -c 1 ::1 >&2")
-          client_defaults.fail("ping -c 1 2001:db8:: >&2")
+    with subtest("Loopback address can be pinged"):
+        client_defaults.succeed("ping -c 1 ::1 >&2")
+        client_defaults.fail("ping -c 1 2001:db8:: >&2")
 
-      with subtest("Local link addresses can be obtained and pinged"):
-          for client in clients:
-              client_ip = wait_for_address(client, "eth1", "link")
-              server_ip = wait_for_address(server, "eth1", "link")
-              client.succeed(f"ping -c 1 {client_ip}%eth1 >&2")
-              client.succeed(f"ping -c 1 {server_ip}%eth1 >&2")
+    with subtest("Local link addresses can be obtained and pinged"):
+        for client in clients:
+            client_ip = wait_for_address(client, "eth1", "link")
+            server_ip = wait_for_address(server, "eth1", "link")
+            client.succeed(f"ping -c 1 {client_ip}%eth1 >&2")
+            client.succeed(f"ping -c 1 {server_ip}%eth1 >&2")
 
-      with subtest("Global addresses can be obtained, pinged, and reached via http"):
-          for client in clients:
-              client_ip = wait_for_address(client, "eth1", "global")
-              server_ip = wait_for_address(server, "eth1", "global")
-              client.succeed(f"ping -c 1 {client_ip} >&2")
-              client.succeed(f"ping -c 1 {server_ip} >&2")
-              client.succeed(f"curl --fail -g http://[{server_ip}]")
-              client.fail(f"curl --fail -g http://[{client_ip}]")
+    with subtest("Global addresses can be obtained, pinged, and reached via http"):
+        for client in clients:
+            client_ip = wait_for_address(client, "eth1", "global")
+            server_ip = wait_for_address(server, "eth1", "global")
+            client.succeed(f"ping -c 1 {client_ip} >&2")
+            client.succeed(f"ping -c 1 {server_ip} >&2")
+            client.succeed(f"curl --fail -g http://[{server_ip}]")
+            client.fail(f"curl --fail -g http://[{client_ip}]")
 
-      with subtest(
-          "Privacy extensions: Global temporary address is used as default source address"
-      ):
-          ip = wait_for_address(client_defaults, "eth1", "global", temporary=True)
-          # Default route should have "src <temporary address>" in it
-          client_defaults.succeed(f"ip route get 2001:db8:: | grep 'src {ip}'")
+    with subtest(
+        "Privacy extensions: Global temporary address is used as default source address"
+    ):
+        ip = wait_for_address(client_defaults, "eth1", "global", temporary=True)
+        # Default route should have "src <temporary address>" in it
+        client_defaults.succeed(f"ip route get 2001:db8:: | grep 'src {ip}'")
 
-      for client, setting_desc in (
-          (client_global_setting, "global"),
-          (client_interface_setting, "interface"),
-      ):
-          with subtest(f'Privacy extensions: "enabled" through {setting_desc} setting)'):
-              # We should be obtaining both a temporary address and an EUI-64 address...
-              ip = wait_for_address(client, "eth1", "global")
-              assert "ff:fe" in ip
-              ip_temp = wait_for_address(client, "eth1", "global", temporary=True)
-              # But using the EUI-64 one.
-              client.succeed(f"ip route get 2001:db8:: | grep 'src {ip}'")
-    '';
-  }
-)
+    for client, setting_desc in (
+        (client_global_setting, "global"),
+        (client_interface_setting, "interface"),
+    ):
+        with subtest(f'Privacy extensions: "enabled" through {setting_desc} setting)'):
+            # We should be obtaining both a temporary address and an EUI-64 address...
+            ip = wait_for_address(client, "eth1", "global")
+            assert "ff:fe" in ip
+            ip_temp = wait_for_address(client, "eth1", "global", temporary=True)
+            # But using the EUI-64 one.
+            client.succeed(f"ip route get 2001:db8:: | grep 'src {ip}'")
+  '';
+}
diff --git a/nixos/tests/iscsi-multipath-root.nix b/nixos/tests/iscsi-multipath-root.nix
index 56f9e1ae7cc1..45b1baf40c61 100644
--- a/nixos/tests/iscsi-multipath-root.nix
+++ b/nixos/tests/iscsi-multipath-root.nix
@@ -1,298 +1,296 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    initiatorName = "iqn.2020-08.org.linux-iscsi.initiatorhost:example";
-    targetName = "iqn.2003-01.org.linux-iscsi.target.x8664:sn.acf8fd9c23af";
-  in
-  {
-    name = "iscsi";
-    meta = {
-      maintainers = pkgs.lib.teams.deshaw.members;
-    };
+{ pkgs, lib, ... }:
+let
+  initiatorName = "iqn.2020-08.org.linux-iscsi.initiatorhost:example";
+  targetName = "iqn.2003-01.org.linux-iscsi.target.x8664:sn.acf8fd9c23af";
+in
+{
+  name = "iscsi";
+  meta = {
+    maintainers = pkgs.lib.teams.deshaw.members;
+  };
 
-    nodes = {
-      target =
-        {
-          config,
-          pkgs,
-          lib,
-          ...
-        }:
-        {
-          virtualisation.vlans = [
-            1
-            2
-          ];
-          services.target = {
-            enable = true;
-            config = {
-              fabric_modules = [ ];
-              storage_objects = [
-                {
-                  dev = "/dev/vdb";
-                  name = "test";
-                  plugin = "block";
-                  write_back = true;
-                  wwn = "92b17c3f-6b40-4168-b082-ceeb7b495522";
-                }
-              ];
-              targets = [
-                {
-                  fabric = "iscsi";
-                  tpgs = [
-                    {
-                      enable = true;
-                      attributes = {
-                        authentication = 0;
-                        generate_node_acls = 1;
-                      };
-                      luns = [
-                        {
-                          alias = "94dfe06967";
-                          alua_tg_pt_gp_name = "default_tg_pt_gp";
-                          index = 0;
-                          storage_object = "/backstores/block/test";
-                        }
-                      ];
-                      node_acls = [
-                        {
-                          mapped_luns = [
-                            {
-                              alias = "d42f5bdf8a";
-                              index = 0;
-                              tpg_lun = 0;
-                              write_protect = false;
-                            }
-                          ];
-                          node_wwn = initiatorName;
-                        }
-                      ];
-                      portals = [
-                        {
-                          ip_address = "0.0.0.0";
-                          iser = false;
-                          offload = false;
-                          port = 3260;
-                        }
-                      ];
-                      tag = 1;
-                    }
-                  ];
-                  wwn = targetName;
-                }
-              ];
-            };
-          };
-
-          networking.firewall.allowedTCPPorts = [ 3260 ];
-          networking.firewall.allowedUDPPorts = [ 3260 ];
-
-          virtualisation.memorySize = 2048;
-          virtualisation.emptyDiskImages = [ 2048 ];
-        };
-
-      initiatorAuto =
-        {
-          nodes,
-          config,
-          pkgs,
-          ...
-        }:
-        {
-          virtualisation.vlans = [
-            1
-            2
-          ];
-
-          services.multipath = {
-            enable = true;
-            defaults = ''
-              find_multipaths yes
-              user_friendly_names yes
-            '';
-            pathGroups = [
+  nodes = {
+    target =
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
+      {
+        virtualisation.vlans = [
+          1
+          2
+        ];
+        services.target = {
+          enable = true;
+          config = {
+            fabric_modules = [ ];
+            storage_objects = [
               {
-                alias = 123456;
-                wwid = "3600140592b17c3f6b404168b082ceeb7";
+                dev = "/dev/vdb";
+                name = "test";
+                plugin = "block";
+                write_back = true;
+                wwn = "92b17c3f-6b40-4168-b082-ceeb7b495522";
+              }
+            ];
+            targets = [
+              {
+                fabric = "iscsi";
+                tpgs = [
+                  {
+                    enable = true;
+                    attributes = {
+                      authentication = 0;
+                      generate_node_acls = 1;
+                    };
+                    luns = [
+                      {
+                        alias = "94dfe06967";
+                        alua_tg_pt_gp_name = "default_tg_pt_gp";
+                        index = 0;
+                        storage_object = "/backstores/block/test";
+                      }
+                    ];
+                    node_acls = [
+                      {
+                        mapped_luns = [
+                          {
+                            alias = "d42f5bdf8a";
+                            index = 0;
+                            tpg_lun = 0;
+                            write_protect = false;
+                          }
+                        ];
+                        node_wwn = initiatorName;
+                      }
+                    ];
+                    portals = [
+                      {
+                        ip_address = "0.0.0.0";
+                        iser = false;
+                        offload = false;
+                        port = 3260;
+                      }
+                    ];
+                    tag = 1;
+                  }
+                ];
+                wwn = targetName;
               }
             ];
           };
+        };
 
-          services.openiscsi = {
-            enable = true;
-            enableAutoLoginOut = true;
-            discoverPortal = "target";
-            name = initiatorName;
-          };
+        networking.firewall.allowedTCPPorts = [ 3260 ];
+        networking.firewall.allowedUDPPorts = [ 3260 ];
 
-          environment.systemPackages = with pkgs; [
-            xfsprogs
+        virtualisation.memorySize = 2048;
+        virtualisation.emptyDiskImages = [ 2048 ];
+      };
+
+    initiatorAuto =
+      {
+        nodes,
+        config,
+        pkgs,
+        ...
+      }:
+      {
+        virtualisation.vlans = [
+          1
+          2
+        ];
+
+        services.multipath = {
+          enable = true;
+          defaults = ''
+            find_multipaths yes
+            user_friendly_names yes
+          '';
+          pathGroups = [
+            {
+              alias = 123456;
+              wwid = "3600140592b17c3f6b404168b082ceeb7";
+            }
           ];
+        };
 
-          environment.etc."initiator-root-disk-closure".source =
-            nodes.initiatorRootDisk.config.system.build.toplevel;
+        services.openiscsi = {
+          enable = true;
+          enableAutoLoginOut = true;
+          discoverPortal = "target";
+          name = initiatorName;
+        };
 
-          nix.settings = {
-            substituters = lib.mkForce [ ];
-            hashed-mirrors = null;
-            connect-timeout = 1;
+        environment.systemPackages = with pkgs; [
+          xfsprogs
+        ];
+
+        environment.etc."initiator-root-disk-closure".source =
+          nodes.initiatorRootDisk.config.system.build.toplevel;
+
+        nix.settings = {
+          substituters = lib.mkForce [ ];
+          hashed-mirrors = null;
+          connect-timeout = 1;
+        };
+      };
+
+    initiatorRootDisk =
+      {
+        config,
+        pkgs,
+        modulesPath,
+        lib,
+        ...
+      }:
+      {
+        boot.initrd.network.enable = true;
+        boot.loader.grub.enable = false;
+
+        boot.kernelParams = lib.mkOverride 5 ([
+          "boot.shell_on_fail"
+          "console=tty1"
+          "ip=192.168.1.1:::255.255.255.0::ens9:none"
+          "ip=192.168.2.1:::255.255.255.0::ens10:none"
+        ]);
+
+        # defaults to true, puts some code in the initrd that tries to mount an overlayfs on /nix/store
+        virtualisation.writableStore = false;
+        virtualisation.vlans = [
+          1
+          2
+        ];
+
+        services.multipath = {
+          enable = true;
+          defaults = ''
+            find_multipaths yes
+            user_friendly_names yes
+          '';
+          pathGroups = [
+            {
+              alias = 123456;
+              wwid = "3600140592b17c3f6b404168b082ceeb7";
+            }
+          ];
+        };
+
+        fileSystems = lib.mkOverride 5 {
+          "/" = {
+            fsType = "xfs";
+            device = "/dev/mapper/123456";
+            options = [ "_netdev" ];
           };
         };
 
-      initiatorRootDisk =
-        {
-          config,
-          pkgs,
-          modulesPath,
-          lib,
-          ...
-        }:
-        {
-          boot.initrd.network.enable = true;
-          boot.loader.grub.enable = false;
+        boot.initrd.extraFiles."etc/multipath/wwids".source =
+          pkgs.writeText "wwids" "/3600140592b17c3f6b404168b082ceeb7/";
 
-          boot.kernelParams = lib.mkOverride 5 ([
-            "boot.shell_on_fail"
-            "console=tty1"
-            "ip=192.168.1.1:::255.255.255.0::ens9:none"
-            "ip=192.168.2.1:::255.255.255.0::ens10:none"
-          ]);
-
-          # defaults to true, puts some code in the initrd that tries to mount an overlayfs on /nix/store
-          virtualisation.writableStore = false;
-          virtualisation.vlans = [
-            1
-            2
-          ];
-
-          services.multipath = {
-            enable = true;
-            defaults = ''
-              find_multipaths yes
-              user_friendly_names yes
-            '';
-            pathGroups = [
-              {
-                alias = 123456;
-                wwid = "3600140592b17c3f6b404168b082ceeb7";
-              }
-            ];
-          };
-
-          fileSystems = lib.mkOverride 5 {
-            "/" = {
-              fsType = "xfs";
-              device = "/dev/mapper/123456";
-              options = [ "_netdev" ];
-            };
-          };
-
-          boot.initrd.extraFiles."etc/multipath/wwids".source =
-            pkgs.writeText "wwids" "/3600140592b17c3f6b404168b082ceeb7/";
-
-          boot.iscsi-initiator = {
-            discoverPortal = "target";
-            name = initiatorName;
-            target = targetName;
-            extraIscsiCommands = ''
-              iscsiadm -m discovery -o update -t sendtargets -p 192.168.2.3 --login
-            '';
-          };
+        boot.iscsi-initiator = {
+          discoverPortal = "target";
+          name = initiatorName;
+          target = targetName;
+          extraIscsiCommands = ''
+            iscsiadm -m discovery -o update -t sendtargets -p 192.168.2.3 --login
+          '';
         };
+      };
 
-    };
+  };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        target.start()
-        target.wait_for_unit("iscsi-target.service")
+  testScript =
+    { nodes, ... }:
+    ''
+      target.start()
+      target.wait_for_unit("iscsi-target.service")
 
-        initiatorAuto.start()
+      initiatorAuto.start()
 
-        initiatorAuto.wait_for_unit("iscsid.service")
-        initiatorAuto.wait_for_unit("iscsi.service")
-        initiatorAuto.get_unit_info("iscsi")
+      initiatorAuto.wait_for_unit("iscsid.service")
+      initiatorAuto.wait_for_unit("iscsi.service")
+      initiatorAuto.get_unit_info("iscsi")
 
-        # Expecting this to fail since we should already know about 192.168.1.3
-        initiatorAuto.fail("iscsiadm -m discovery -o update -t sendtargets -p 192.168.1.3 --login")
-        # Expecting this to succeed since we don't yet know about 192.168.2.3
-        initiatorAuto.succeed("iscsiadm -m discovery -o update -t sendtargets -p 192.168.2.3 --login")
+      # Expecting this to fail since we should already know about 192.168.1.3
+      initiatorAuto.fail("iscsiadm -m discovery -o update -t sendtargets -p 192.168.1.3 --login")
+      # Expecting this to succeed since we don't yet know about 192.168.2.3
+      initiatorAuto.succeed("iscsiadm -m discovery -o update -t sendtargets -p 192.168.2.3 --login")
 
-        # /dev/sda is provided by iscsi on target
-        initiatorAuto.succeed("set -x; while ! test -e /dev/sda; do sleep 1; done")
+      # /dev/sda is provided by iscsi on target
+      initiatorAuto.succeed("set -x; while ! test -e /dev/sda; do sleep 1; done")
 
-        initiatorAuto.succeed("mkfs.xfs /dev/sda")
-        initiatorAuto.succeed("mkdir /mnt")
+      initiatorAuto.succeed("mkfs.xfs /dev/sda")
+      initiatorAuto.succeed("mkdir /mnt")
 
-        # Start by verifying /dev/sda and /dev/sdb are both the same disk
-        initiatorAuto.succeed("mount /dev/sda /mnt")
-        initiatorAuto.succeed("touch /mnt/hi")
-        initiatorAuto.succeed("umount /mnt")
+      # Start by verifying /dev/sda and /dev/sdb are both the same disk
+      initiatorAuto.succeed("mount /dev/sda /mnt")
+      initiatorAuto.succeed("touch /mnt/hi")
+      initiatorAuto.succeed("umount /mnt")
 
-        initiatorAuto.succeed("mount /dev/sdb /mnt")
-        initiatorAuto.succeed("test -e /mnt/hi")
-        initiatorAuto.succeed("umount /mnt")
+      initiatorAuto.succeed("mount /dev/sdb /mnt")
+      initiatorAuto.succeed("test -e /mnt/hi")
+      initiatorAuto.succeed("umount /mnt")
 
-        initiatorAuto.succeed("systemctl restart multipathd")
-        initiatorAuto.succeed("systemd-cat multipath -ll")
+      initiatorAuto.succeed("systemctl restart multipathd")
+      initiatorAuto.succeed("systemd-cat multipath -ll")
 
-        # Install our RootDisk machine to 123456, the alias to the device that multipath is now managing
-        initiatorAuto.succeed("mount /dev/mapper/123456 /mnt")
-        initiatorAuto.succeed("mkdir -p /mnt/etc/{multipath,iscsi}")
-        initiatorAuto.succeed("cp -r /etc/multipath/wwids /mnt/etc/multipath/wwids")
-        initiatorAuto.succeed("cp -r /etc/iscsi/{nodes,send_targets} /mnt/etc/iscsi")
-        initiatorAuto.succeed(
-          "nixos-install --no-bootloader --no-root-passwd --system /etc/initiator-root-disk-closure"
-        )
-        initiatorAuto.succeed("umount /mnt")
-        initiatorAuto.shutdown()
+      # Install our RootDisk machine to 123456, the alias to the device that multipath is now managing
+      initiatorAuto.succeed("mount /dev/mapper/123456 /mnt")
+      initiatorAuto.succeed("mkdir -p /mnt/etc/{multipath,iscsi}")
+      initiatorAuto.succeed("cp -r /etc/multipath/wwids /mnt/etc/multipath/wwids")
+      initiatorAuto.succeed("cp -r /etc/iscsi/{nodes,send_targets} /mnt/etc/iscsi")
+      initiatorAuto.succeed(
+        "nixos-install --no-bootloader --no-root-passwd --system /etc/initiator-root-disk-closure"
+      )
+      initiatorAuto.succeed("umount /mnt")
+      initiatorAuto.shutdown()
 
-        initiatorRootDisk.start()
-        initiatorRootDisk.wait_for_unit("multi-user.target")
-        initiatorRootDisk.wait_for_unit("iscsid")
+      initiatorRootDisk.start()
+      initiatorRootDisk.wait_for_unit("multi-user.target")
+      initiatorRootDisk.wait_for_unit("iscsid")
 
-        # Log in over both nodes
-        initiatorRootDisk.fail("iscsiadm -m discovery -o update -t sendtargets -p 192.168.1.3 --login")
-        initiatorRootDisk.fail("iscsiadm -m discovery -o update -t sendtargets -p 192.168.2.3 --login")
-        initiatorRootDisk.succeed("systemctl restart multipathd")
-        initiatorRootDisk.succeed("systemd-cat multipath -ll")
+      # Log in over both nodes
+      initiatorRootDisk.fail("iscsiadm -m discovery -o update -t sendtargets -p 192.168.1.3 --login")
+      initiatorRootDisk.fail("iscsiadm -m discovery -o update -t sendtargets -p 192.168.2.3 --login")
+      initiatorRootDisk.succeed("systemctl restart multipathd")
+      initiatorRootDisk.succeed("systemd-cat multipath -ll")
 
-        # Verify we can write and sync the root disk
-        initiatorRootDisk.succeed("mkdir /scratch")
-        initiatorRootDisk.succeed("touch /scratch/both-up")
-        initiatorRootDisk.succeed("sync /scratch")
+      # Verify we can write and sync the root disk
+      initiatorRootDisk.succeed("mkdir /scratch")
+      initiatorRootDisk.succeed("touch /scratch/both-up")
+      initiatorRootDisk.succeed("sync /scratch")
 
-        # Verify we can write to the root with ens9 (sda, 192.168.1.3) down
-        initiatorRootDisk.succeed("ip link set ens9 down")
-        initiatorRootDisk.succeed("touch /scratch/ens9-down")
-        initiatorRootDisk.succeed("sync /scratch")
-        initiatorRootDisk.succeed("ip link set ens9 up")
+      # Verify we can write to the root with ens9 (sda, 192.168.1.3) down
+      initiatorRootDisk.succeed("ip link set ens9 down")
+      initiatorRootDisk.succeed("touch /scratch/ens9-down")
+      initiatorRootDisk.succeed("sync /scratch")
+      initiatorRootDisk.succeed("ip link set ens9 up")
 
-        # todo: better way to wait until multipath notices the link is back
-        initiatorRootDisk.succeed("sleep 5")
-        initiatorRootDisk.succeed("touch /scratch/both-down")
-        initiatorRootDisk.succeed("sync /scratch")
+      # todo: better way to wait until multipath notices the link is back
+      initiatorRootDisk.succeed("sleep 5")
+      initiatorRootDisk.succeed("touch /scratch/both-down")
+      initiatorRootDisk.succeed("sync /scratch")
 
-        # Verify we can write to the root with ens10 (sdb, 192.168.2.3) down
-        initiatorRootDisk.succeed("ip link set ens10 down")
-        initiatorRootDisk.succeed("touch /scratch/ens10-down")
-        initiatorRootDisk.succeed("sync /scratch")
-        initiatorRootDisk.succeed("ip link set ens10 up")
-        initiatorRootDisk.succeed("touch /scratch/ens10-down")
-        initiatorRootDisk.succeed("sync /scratch")
+      # Verify we can write to the root with ens10 (sdb, 192.168.2.3) down
+      initiatorRootDisk.succeed("ip link set ens10 down")
+      initiatorRootDisk.succeed("touch /scratch/ens10-down")
+      initiatorRootDisk.succeed("sync /scratch")
+      initiatorRootDisk.succeed("ip link set ens10 up")
+      initiatorRootDisk.succeed("touch /scratch/ens10-down")
+      initiatorRootDisk.succeed("sync /scratch")
 
-        initiatorRootDisk.succeed("ip link set ens9 up")
-        initiatorRootDisk.succeed("ip link set ens10 up")
-        initiatorRootDisk.shutdown()
+      initiatorRootDisk.succeed("ip link set ens9 up")
+      initiatorRootDisk.succeed("ip link set ens10 up")
+      initiatorRootDisk.shutdown()
 
-        # Verify we can boot with the target's eth1 down, forcing
-        # it to multipath via the second link
-        target.succeed("ip link set eth1 down")
-        initiatorRootDisk.start()
-        initiatorRootDisk.wait_for_unit("multi-user.target")
-        initiatorRootDisk.wait_for_unit("iscsid")
-        initiatorRootDisk.succeed("test -e /scratch/both-up")
-      '';
-  }
-)
+      # Verify we can boot with the target's eth1 down, forcing
+      # it to multipath via the second link
+      target.succeed("ip link set eth1 down")
+      initiatorRootDisk.start()
+      initiatorRootDisk.wait_for_unit("multi-user.target")
+      initiatorRootDisk.wait_for_unit("iscsid")
+      initiatorRootDisk.succeed("test -e /scratch/both-up")
+    '';
+}
diff --git a/nixos/tests/iscsi-root.nix b/nixos/tests/iscsi-root.nix
index ab0ab9f89e9b..9d0b0765b311 100644
--- a/nixos/tests/iscsi-root.nix
+++ b/nixos/tests/iscsi-root.nix
@@ -1,182 +1,180 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    initiatorName = "iqn.2020-08.org.linux-iscsi.initiatorhost:example";
-    targetName = "iqn.2003-01.org.linux-iscsi.target.x8664:sn.acf8fd9c23af";
-  in
-  {
-    name = "iscsi";
-    meta = {
-      maintainers = lib.teams.deshaw.members ++ lib.teams.helsinki-systems.members;
-    };
+{ pkgs, lib, ... }:
+let
+  initiatorName = "iqn.2020-08.org.linux-iscsi.initiatorhost:example";
+  targetName = "iqn.2003-01.org.linux-iscsi.target.x8664:sn.acf8fd9c23af";
+in
+{
+  name = "iscsi";
+  meta = {
+    maintainers = lib.teams.deshaw.members ++ lib.teams.helsinki-systems.members;
+  };
 
-    nodes = {
-      target =
-        {
-          config,
-          pkgs,
-          lib,
-          ...
-        }:
-        {
-          services.target = {
-            enable = true;
-            config = {
-              fabric_modules = [ ];
-              storage_objects = [
-                {
-                  dev = "/dev/vdb";
-                  name = "test";
-                  plugin = "block";
-                  write_back = true;
-                  wwn = "92b17c3f-6b40-4168-b082-ceeb7b495522";
-                }
-              ];
-              targets = [
-                {
-                  fabric = "iscsi";
-                  tpgs = [
-                    {
-                      enable = true;
-                      attributes = {
-                        authentication = 0;
-                        generate_node_acls = 1;
-                      };
-                      luns = [
-                        {
-                          alias = "94dfe06967";
-                          alua_tg_pt_gp_name = "default_tg_pt_gp";
-                          index = 0;
-                          storage_object = "/backstores/block/test";
-                        }
-                      ];
-                      node_acls = [
-                        {
-                          mapped_luns = [
-                            {
-                              alias = "d42f5bdf8a";
-                              index = 0;
-                              tpg_lun = 0;
-                              write_protect = false;
-                            }
-                          ];
-                          node_wwn = initiatorName;
-                        }
-                      ];
-                      portals = [
-                        {
-                          ip_address = "[::]";
-                          iser = false;
-                          offload = false;
-                          port = 3260;
-                        }
-                      ];
-                      tag = 1;
-                    }
-                  ];
-                  wwn = targetName;
-                }
-              ];
-            };
-          };
-
-          networking.firewall.allowedTCPPorts = [ 3260 ];
-          networking.firewall.allowedUDPPorts = [ 3260 ];
-
-          virtualisation.memorySize = 2048;
-          virtualisation.emptyDiskImages = [ 2048 ];
-        };
-
-      initiatorAuto =
-        {
-          nodes,
-          config,
-          pkgs,
-          ...
-        }:
-        {
-          services.openiscsi = {
-            enable = true;
-            enableAutoLoginOut = true;
-            discoverPortal = "target";
-            name = initiatorName;
-          };
-
-          environment.systemPackages = with pkgs; [
-            xfsprogs
-          ];
-
-          system.extraDependencies = [ nodes.initiatorRootDisk.system.build.toplevel ];
-
-          nix.settings = {
-            substituters = lib.mkForce [ ];
-            hashed-mirrors = null;
-            connect-timeout = 1;
+  nodes = {
+    target =
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
+      {
+        services.target = {
+          enable = true;
+          config = {
+            fabric_modules = [ ];
+            storage_objects = [
+              {
+                dev = "/dev/vdb";
+                name = "test";
+                plugin = "block";
+                write_back = true;
+                wwn = "92b17c3f-6b40-4168-b082-ceeb7b495522";
+              }
+            ];
+            targets = [
+              {
+                fabric = "iscsi";
+                tpgs = [
+                  {
+                    enable = true;
+                    attributes = {
+                      authentication = 0;
+                      generate_node_acls = 1;
+                    };
+                    luns = [
+                      {
+                        alias = "94dfe06967";
+                        alua_tg_pt_gp_name = "default_tg_pt_gp";
+                        index = 0;
+                        storage_object = "/backstores/block/test";
+                      }
+                    ];
+                    node_acls = [
+                      {
+                        mapped_luns = [
+                          {
+                            alias = "d42f5bdf8a";
+                            index = 0;
+                            tpg_lun = 0;
+                            write_protect = false;
+                          }
+                        ];
+                        node_wwn = initiatorName;
+                      }
+                    ];
+                    portals = [
+                      {
+                        ip_address = "[::]";
+                        iser = false;
+                        offload = false;
+                        port = 3260;
+                      }
+                    ];
+                    tag = 1;
+                  }
+                ];
+                wwn = targetName;
+              }
+            ];
           };
         };
 
-      initiatorRootDisk =
-        {
-          config,
-          pkgs,
-          modulesPath,
-          lib,
-          ...
-        }:
-        {
-          boot.loader.grub.enable = false;
-          boot.kernelParams = lib.mkOverride 5 ([
-            "boot.shell_on_fail"
-            "console=tty1"
-            "ip=${config.networking.primaryIPAddress}:::255.255.255.0::eth1:none"
-          ]);
+        networking.firewall.allowedTCPPorts = [ 3260 ];
+        networking.firewall.allowedUDPPorts = [ 3260 ];
 
-          # defaults to true, puts some code in the initrd that tries to mount an overlayfs on /nix/store
-          virtualisation.writableStore = false;
+        virtualisation.memorySize = 2048;
+        virtualisation.emptyDiskImages = [ 2048 ];
+      };
 
-          fileSystems = lib.mkOverride 5 {
-            "/" = {
-              fsType = "xfs";
-              device = "/dev/sda";
-              options = [ "_netdev" ];
-            };
-          };
+    initiatorAuto =
+      {
+        nodes,
+        config,
+        pkgs,
+        ...
+      }:
+      {
+        services.openiscsi = {
+          enable = true;
+          enableAutoLoginOut = true;
+          discoverPortal = "target";
+          name = initiatorName;
+        };
 
-          boot.iscsi-initiator = {
-            discoverPortal = "target";
-            name = initiatorName;
-            target = targetName;
+        environment.systemPackages = with pkgs; [
+          xfsprogs
+        ];
+
+        system.extraDependencies = [ nodes.initiatorRootDisk.system.build.toplevel ];
+
+        nix.settings = {
+          substituters = lib.mkForce [ ];
+          hashed-mirrors = null;
+          connect-timeout = 1;
+        };
+      };
+
+    initiatorRootDisk =
+      {
+        config,
+        pkgs,
+        modulesPath,
+        lib,
+        ...
+      }:
+      {
+        boot.loader.grub.enable = false;
+        boot.kernelParams = lib.mkOverride 5 ([
+          "boot.shell_on_fail"
+          "console=tty1"
+          "ip=${config.networking.primaryIPAddress}:::255.255.255.0::eth1:none"
+        ]);
+
+        # defaults to true, puts some code in the initrd that tries to mount an overlayfs on /nix/store
+        virtualisation.writableStore = false;
+
+        fileSystems = lib.mkOverride 5 {
+          "/" = {
+            fsType = "xfs";
+            device = "/dev/sda";
+            options = [ "_netdev" ];
           };
         };
-    };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        target.start()
-        target.wait_for_unit("iscsi-target.service")
+        boot.iscsi-initiator = {
+          discoverPortal = "target";
+          name = initiatorName;
+          target = targetName;
+        };
+      };
+  };
 
-        initiatorAuto.start()
+  testScript =
+    { nodes, ... }:
+    ''
+      target.start()
+      target.wait_for_unit("iscsi-target.service")
 
-        initiatorAuto.wait_for_unit("iscsid.service")
-        initiatorAuto.wait_for_unit("iscsi.service")
-        initiatorAuto.get_unit_info("iscsi")
+      initiatorAuto.start()
 
-        initiatorAuto.succeed("set -x; while ! test -e /dev/sda; do sleep 1; done")
+      initiatorAuto.wait_for_unit("iscsid.service")
+      initiatorAuto.wait_for_unit("iscsi.service")
+      initiatorAuto.get_unit_info("iscsi")
 
-        initiatorAuto.succeed("mkfs.xfs /dev/sda")
-        initiatorAuto.succeed("mkdir /mnt && mount /dev/sda /mnt")
-        initiatorAuto.succeed(
-            "nixos-install --no-bootloader --no-root-passwd --system ${nodes.initiatorRootDisk.config.system.build.toplevel}"
-        )
-        initiatorAuto.succeed("umount /mnt && rmdir /mnt")
-        initiatorAuto.shutdown()
+      initiatorAuto.succeed("set -x; while ! test -e /dev/sda; do sleep 1; done")
 
-        initiatorRootDisk.start()
-        initiatorRootDisk.wait_for_unit("multi-user.target")
-        initiatorRootDisk.wait_for_unit("iscsid")
-        initiatorRootDisk.succeed("touch test")
-        initiatorRootDisk.shutdown()
-      '';
-  }
-)
+      initiatorAuto.succeed("mkfs.xfs /dev/sda")
+      initiatorAuto.succeed("mkdir /mnt && mount /dev/sda /mnt")
+      initiatorAuto.succeed(
+          "nixos-install --no-bootloader --no-root-passwd --system ${nodes.initiatorRootDisk.config.system.build.toplevel}"
+      )
+      initiatorAuto.succeed("umount /mnt && rmdir /mnt")
+      initiatorAuto.shutdown()
+
+      initiatorRootDisk.start()
+      initiatorRootDisk.wait_for_unit("multi-user.target")
+      initiatorRootDisk.wait_for_unit("iscsid")
+      initiatorRootDisk.succeed("touch test")
+      initiatorRootDisk.shutdown()
+    '';
+}
diff --git a/nixos/tests/isolate.nix b/nixos/tests/isolate.nix
index c6f83240ad08..fe9ea18a2c6c 100644
--- a/nixos/tests/isolate.nix
+++ b/nixos/tests/isolate.nix
@@ -1,40 +1,38 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "isolate";
-    meta.maintainers = with lib.maintainers; [ virchau13 ];
+{ lib, ... }:
+{
+  name = "isolate";
+  meta.maintainers = with lib.maintainers; [ virchau13 ];
 
-    nodes.machine =
-      { ... }:
-      {
-        security.isolate = {
-          enable = true;
-        };
+  nodes.machine =
+    { ... }:
+    {
+      security.isolate = {
+        enable = true;
       };
+    };
 
-    testScript = ''
-      bash_path = machine.succeed('realpath $(which bash)').strip()
-      sleep_path = machine.succeed('realpath $(which sleep)').strip()
-      def sleep_test(walltime, sleeptime):
-          return f'isolate --no-default-dirs --wall-time {walltime} ' + \
-              f'--dir=/box={box_path} --dir=/nix=/nix --run -- ' + \
-              f"{bash_path} -c 'exec -a sleep {sleep_path} {sleeptime}'"
+  testScript = ''
+    bash_path = machine.succeed('realpath $(which bash)').strip()
+    sleep_path = machine.succeed('realpath $(which sleep)').strip()
+    def sleep_test(walltime, sleeptime):
+        return f'isolate --no-default-dirs --wall-time {walltime} ' + \
+            f'--dir=/box={box_path} --dir=/nix=/nix --run -- ' + \
+            f"{bash_path} -c 'exec -a sleep {sleep_path} {sleeptime}'"
 
-      def sleep_test_cg(walltime, sleeptime):
-          return f'isolate --cg --no-default-dirs --wall-time {walltime} ' + \
-              f'--dir=/box={box_path} --dir=/nix=/nix --processes=2 --run -- ' + \
-              f"{bash_path} -c '( exec -a sleep {sleep_path} {sleeptime} )'"
+    def sleep_test_cg(walltime, sleeptime):
+        return f'isolate --cg --no-default-dirs --wall-time {walltime} ' + \
+            f'--dir=/box={box_path} --dir=/nix=/nix --processes=2 --run -- ' + \
+            f"{bash_path} -c '( exec -a sleep {sleep_path} {sleeptime} )'"
 
-      with subtest("without cgroups"):
-          box_path = machine.succeed('isolate --init').strip()
-          machine.succeed(sleep_test(1, 0.5))
-          machine.fail(sleep_test(0.5, 1))
-          machine.succeed('isolate --cleanup')
-      with subtest("with cgroups"):
-          box_path = machine.succeed('isolate --cg --init').strip()
-          machine.succeed(sleep_test_cg(1, 0.5))
-          machine.fail(sleep_test_cg(0.5, 1))
-          machine.succeed('isolate --cg --cleanup')
-    '';
-  }
-)
+    with subtest("without cgroups"):
+        box_path = machine.succeed('isolate --init').strip()
+        machine.succeed(sleep_test(1, 0.5))
+        machine.fail(sleep_test(0.5, 1))
+        machine.succeed('isolate --cleanup')
+    with subtest("with cgroups"):
+        box_path = machine.succeed('isolate --cg --init').strip()
+        machine.succeed(sleep_test_cg(1, 0.5))
+        machine.fail(sleep_test_cg(0.5, 1))
+        machine.succeed('isolate --cg --cleanup')
+  '';
+}
diff --git a/nixos/tests/isso.nix b/nixos/tests/isso.nix
index f3af293bf75b..a5ed88044b26 100644
--- a/nixos/tests/isso.nix
+++ b/nixos/tests/isso.nix
@@ -1,36 +1,34 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "isso";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
-    };
+{ pkgs, ... }:
+{
+  name = "isso";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        services.isso = {
-          enable = true;
-          settings = {
-            general = {
-              dbpath = "/var/lib/isso/comments.db";
-              host = "http://localhost";
-            };
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      services.isso = {
+        enable = true;
+        settings = {
+          general = {
+            dbpath = "/var/lib/isso/comments.db";
+            host = "http://localhost";
           };
         };
       };
+    };
 
-    testScript =
-      let
-        port = 8080;
-      in
-      ''
-        machine.wait_for_unit("isso.service")
+  testScript =
+    let
+      port = 8080;
+    in
+    ''
+      machine.wait_for_unit("isso.service")
 
-        machine.wait_for_open_port(${toString port})
+      machine.wait_for_open_port(${toString port})
 
-        machine.succeed("curl --fail http://localhost:${toString port}/?uri")
-        machine.succeed("curl --fail http://localhost:${toString port}/js/embed.min.js")
-      '';
-  }
-)
+      machine.succeed("curl --fail http://localhost:${toString port}/?uri")
+      machine.succeed("curl --fail http://localhost:${toString port}/js/embed.min.js")
+    '';
+}
diff --git a/nixos/tests/jackett.nix b/nixos/tests/jackett.nix
index 11931c7c96bd..9ce8209f49dd 100644
--- a/nixos/tests/jackett.nix
+++ b/nixos/tests/jackett.nix
@@ -1,25 +1,23 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  let
-    jackettPort = 9117;
-  in
-  {
-    name = "jackett";
-    meta.maintainers = with lib.maintainers; [ etu ];
+let
+  jackettPort = 9117;
+in
+{
+  name = "jackett";
+  meta.maintainers = with lib.maintainers; [ etu ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.jackett.enable = true;
-        services.jackett.port = jackettPort;
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.jackett.enable = true;
+      services.jackett.port = jackettPort;
+    };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("jackett.service")
-      machine.wait_for_open_port(${toString jackettPort})
-      machine.succeed("curl --fail http://localhost:${toString jackettPort}/")
-    '';
-  }
-)
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("jackett.service")
+    machine.wait_for_open_port(${toString jackettPort})
+    machine.succeed("curl --fail http://localhost:${toString jackettPort}/")
+  '';
+}
diff --git a/nixos/tests/jellyfin.nix b/nixos/tests/jellyfin.nix
index 2b879ff83751..6b4a962e029f 100644
--- a/nixos/tests/jellyfin.nix
+++ b/nixos/tests/jellyfin.nix
@@ -1,159 +1,157 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  {
-    name = "jellyfin";
-    meta.maintainers = with lib.maintainers; [ minijackson ];
+{
+  name = "jellyfin";
+  meta.maintainers = with lib.maintainers; [ minijackson ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.jellyfin.enable = true;
-        environment.systemPackages = with pkgs; [ ffmpeg ];
+  nodes.machine =
+    { ... }:
+    {
+      services.jellyfin.enable = true;
+      environment.systemPackages = with pkgs; [ ffmpeg ];
+    };
+
+  # Documentation of the Jellyfin API: https://api.jellyfin.org/
+  # Beware, this link can be resource intensive
+  testScript =
+    let
+      payloads = {
+        auth = pkgs.writeText "auth.json" (
+          builtins.toJSON {
+            Username = "jellyfin";
+          }
+        );
+        empty = pkgs.writeText "empty.json" (builtins.toJSON { });
       };
+    in
+    ''
+      import json
+      from urllib.parse import urlencode
 
-    # Documentation of the Jellyfin API: https://api.jellyfin.org/
-    # Beware, this link can be resource intensive
-    testScript =
-      let
-        payloads = {
-          auth = pkgs.writeText "auth.json" (
-            builtins.toJSON {
-              Username = "jellyfin";
-            }
-          );
-          empty = pkgs.writeText "empty.json" (builtins.toJSON { });
-        };
-      in
-      ''
-        import json
-        from urllib.parse import urlencode
+      machine.wait_for_unit("jellyfin.service")
+      machine.wait_for_open_port(8096)
+      machine.succeed("curl --fail http://localhost:8096/")
 
-        machine.wait_for_unit("jellyfin.service")
-        machine.wait_for_open_port(8096)
-        machine.succeed("curl --fail http://localhost:8096/")
+      machine.wait_until_succeeds("curl --fail http://localhost:8096/health | grep Healthy")
 
-        machine.wait_until_succeeds("curl --fail http://localhost:8096/health | grep Healthy")
-
-        auth_header = 'MediaBrowser Client="NixOS Integration Tests", DeviceId="1337", Device="Apple II", Version="20.09"'
+      auth_header = 'MediaBrowser Client="NixOS Integration Tests", DeviceId="1337", Device="Apple II", Version="20.09"'
 
 
-        def api_get(path):
-            return f"curl --fail 'http://localhost:8096{path}' -H 'X-Emby-Authorization:{auth_header}'"
+      def api_get(path):
+          return f"curl --fail 'http://localhost:8096{path}' -H 'X-Emby-Authorization:{auth_header}'"
 
 
-        def api_post(path, json_file=None):
-            if json_file:
-                return f"curl --fail -X post 'http://localhost:8096{path}' -d '@{json_file}' -H Content-Type:application/json -H 'X-Emby-Authorization:{auth_header}'"
-            else:
-                return f"curl --fail -X post 'http://localhost:8096{path}' -H 'X-Emby-Authorization:{auth_header}'"
+      def api_post(path, json_file=None):
+          if json_file:
+              return f"curl --fail -X post 'http://localhost:8096{path}' -d '@{json_file}' -H Content-Type:application/json -H 'X-Emby-Authorization:{auth_header}'"
+          else:
+              return f"curl --fail -X post 'http://localhost:8096{path}' -H 'X-Emby-Authorization:{auth_header}'"
 
 
-        with machine.nested("Wizard completes"):
-            machine.wait_until_succeeds(api_get("/Startup/Configuration"))
-            machine.succeed(api_get("/Startup/FirstUser"))
-            machine.succeed(api_post("/Startup/Complete"))
+      with machine.nested("Wizard completes"):
+          machine.wait_until_succeeds(api_get("/Startup/Configuration"))
+          machine.succeed(api_get("/Startup/FirstUser"))
+          machine.succeed(api_post("/Startup/Complete"))
 
-        with machine.nested("Can login"):
-            auth_result_str = machine.succeed(
-                api_post(
-                    "/Users/AuthenticateByName",
-                    "${payloads.auth}",
-                )
-            )
-            auth_result = json.loads(auth_result_str)
-            auth_token = auth_result["AccessToken"]
-            auth_header += f", Token={auth_token}"
+      with machine.nested("Can login"):
+          auth_result_str = machine.succeed(
+              api_post(
+                  "/Users/AuthenticateByName",
+                  "${payloads.auth}",
+              )
+          )
+          auth_result = json.loads(auth_result_str)
+          auth_token = auth_result["AccessToken"]
+          auth_header += f", Token={auth_token}"
 
-            sessions_result_str = machine.succeed(api_get("/Sessions"))
-            sessions_result = json.loads(sessions_result_str)
+          sessions_result_str = machine.succeed(api_get("/Sessions"))
+          sessions_result = json.loads(sessions_result_str)
 
-            this_session = [
-                session for session in sessions_result if session["DeviceId"] == "1337"
-            ]
-            if len(this_session) != 1:
-                raise Exception("Session not created")
+          this_session = [
+              session for session in sessions_result if session["DeviceId"] == "1337"
+          ]
+          if len(this_session) != 1:
+              raise Exception("Session not created")
 
-            me_str = machine.succeed(api_get("/Users/Me"))
-            me = json.loads(me_str)["Id"]
+          me_str = machine.succeed(api_get("/Users/Me"))
+          me = json.loads(me_str)["Id"]
 
-        with machine.nested("Can add library"):
-            tempdir = machine.succeed("mktemp -d -p /var/lib/jellyfin").strip()
-            machine.succeed(f"chmod 755 '{tempdir}'")
+      with machine.nested("Can add library"):
+          tempdir = machine.succeed("mktemp -d -p /var/lib/jellyfin").strip()
+          machine.succeed(f"chmod 755 '{tempdir}'")
 
-            # Generate a dummy video that we can test later
-            videofile = f"{tempdir}/Big Buck Bunny (2008) [1080p].mkv"
-            machine.succeed(f"ffmpeg -f lavfi -i testsrc2=duration=5 '{videofile}'")
+          # Generate a dummy video that we can test later
+          videofile = f"{tempdir}/Big Buck Bunny (2008) [1080p].mkv"
+          machine.succeed(f"ffmpeg -f lavfi -i testsrc2=duration=5 '{videofile}'")
 
-            add_folder_query = urlencode(
-                {
-                    "name": "My Library",
-                    "collectionType": "Movies",
-                    "paths": tempdir,
-                    "refreshLibrary": "true",
-                }
-            )
+          add_folder_query = urlencode(
+              {
+                  "name": "My Library",
+                  "collectionType": "Movies",
+                  "paths": tempdir,
+                  "refreshLibrary": "true",
+              }
+          )
 
-            machine.succeed(
-                api_post(
-                    f"/Library/VirtualFolders?{add_folder_query}",
-                    "${payloads.empty}",
-                )
-            )
+          machine.succeed(
+              api_post(
+                  f"/Library/VirtualFolders?{add_folder_query}",
+                  "${payloads.empty}",
+              )
+          )
 
 
-        def is_refreshed(_):
-            folders_str = machine.succeed(api_get("/Library/VirtualFolders"))
-            folders = json.loads(folders_str)
-            print(folders)
-            return all(folder["RefreshStatus"] == "Idle" for folder in folders)
+      def is_refreshed(_):
+          folders_str = machine.succeed(api_get("/Library/VirtualFolders"))
+          folders = json.loads(folders_str)
+          print(folders)
+          return all(folder["RefreshStatus"] == "Idle" for folder in folders)
 
 
-        retry(is_refreshed)
+      retry(is_refreshed)
 
-        with machine.nested("Can identify videos"):
-            items = []
+      with machine.nested("Can identify videos"):
+          items = []
 
-            # For some reason, having the folder refreshed doesn't mean the
-            # movie was scanned
-            def has_movie(_):
-                global items
+          # For some reason, having the folder refreshed doesn't mean the
+          # movie was scanned
+          def has_movie(_):
+              global items
 
-                items_str = machine.succeed(
-                    api_get(f"/Users/{me}/Items?IncludeItemTypes=Movie&Recursive=true")
-                )
-                items = json.loads(items_str)["Items"]
+              items_str = machine.succeed(
+                  api_get(f"/Users/{me}/Items?IncludeItemTypes=Movie&Recursive=true")
+              )
+              items = json.loads(items_str)["Items"]
 
-                return len(items) == 1
+              return len(items) == 1
 
-            retry(has_movie)
+          retry(has_movie)
 
-            video = items[0]["Id"]
+          video = items[0]["Id"]
 
-            item_info_str = machine.succeed(api_get(f"/Users/{me}/Items/{video}"))
-            item_info = json.loads(item_info_str)
+          item_info_str = machine.succeed(api_get(f"/Users/{me}/Items/{video}"))
+          item_info = json.loads(item_info_str)
 
-            if item_info["Name"] != "Big Buck Bunny":
-                raise Exception("Jellyfin failed to properly identify file")
+          if item_info["Name"] != "Big Buck Bunny":
+              raise Exception("Jellyfin failed to properly identify file")
 
-        with machine.nested("Can read videos"):
-            media_source_id = item_info["MediaSources"][0]["Id"]
+      with machine.nested("Can read videos"):
+          media_source_id = item_info["MediaSources"][0]["Id"]
 
-            machine.succeed(
-                "ffmpeg"
-                + f" -headers 'X-Emby-Authorization:{auth_header}'"
-                + f" -i http://localhost:8096/Videos/{video}/master.m3u8?mediaSourceId={media_source_id}"
-                + " /tmp/test.mkv"
-            )
+          machine.succeed(
+              "ffmpeg"
+              + f" -headers 'X-Emby-Authorization:{auth_header}'"
+              + f" -i http://localhost:8096/Videos/{video}/master.m3u8?mediaSourceId={media_source_id}"
+              + " /tmp/test.mkv"
+          )
 
-            duration = machine.succeed(
-                "ffprobe /tmp/test.mkv"
-                + " -show_entries format=duration"
-                + " -of compact=print_section=0:nokey=1"
-            )
+          duration = machine.succeed(
+              "ffprobe /tmp/test.mkv"
+              + " -show_entries format=duration"
+              + " -of compact=print_section=0:nokey=1"
+          )
 
-            if duration.strip() != "5.000000":
-                raise Exception("Downloaded video has wrong duration")
-      '';
-  }
-)
+          if duration.strip() != "5.000000":
+              raise Exception("Downloaded video has wrong duration")
+    '';
+}
diff --git a/nixos/tests/jenkins-cli.nix b/nixos/tests/jenkins-cli.nix
index fdd2767cf041..69167ffa3a6f 100644
--- a/nixos/tests/jenkins-cli.nix
+++ b/nixos/tests/jenkins-cli.nix
@@ -1,33 +1,31 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  rec {
-    name = "jenkins-cli";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ pamplemousse ];
-    };
+{ pkgs, ... }:
+rec {
+  name = "jenkins-cli";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ pamplemousse ];
+  };
 
-    nodes = {
-      machine =
-        { ... }:
-        {
-          services.jenkins = {
-            enable = true;
-            withCLI = true;
-          };
+  nodes = {
+    machine =
+      { ... }:
+      {
+        services.jenkins = {
+          enable = true;
+          withCLI = true;
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine.wait_for_unit("jenkins")
+    machine.wait_for_unit("jenkins")
 
-      assert "JENKINS_URL" in machine.succeed("env")
-      assert "http://0.0.0.0:8080" in machine.succeed("echo $JENKINS_URL")
+    assert "JENKINS_URL" in machine.succeed("env")
+    assert "http://0.0.0.0:8080" in machine.succeed("echo $JENKINS_URL")
 
-      machine.succeed(
-          "jenkins-cli -auth admin:$(cat /var/lib/jenkins/secrets/initialAdminPassword)"
-      )
-    '';
-  }
-)
+    machine.succeed(
+        "jenkins-cli -auth admin:$(cat /var/lib/jenkins/secrets/initialAdminPassword)"
+    )
+  '';
+}
diff --git a/nixos/tests/jenkins.nix b/nixos/tests/jenkins.nix
index cd82214fb3ac..7a8e4ea4d0b4 100644
--- a/nixos/tests/jenkins.nix
+++ b/nixos/tests/jenkins.nix
@@ -4,140 +4,138 @@
 #   3. jenkins service not started on slave node
 #   4. declarative jobs can be added and removed
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "jenkins";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        bjornfor
-        domenkozar
-      ];
-    };
+{ pkgs, ... }:
+{
+  name = "jenkins";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      bjornfor
+      domenkozar
+    ];
+  };
 
-    nodes = {
+  nodes = {
 
-      master =
-        { ... }:
-        {
-          services.jenkins = {
+    master =
+      { ... }:
+      {
+        services.jenkins = {
+          enable = true;
+          jobBuilder = {
             enable = true;
-            jobBuilder = {
-              enable = true;
-              nixJobs = [
-                {
-                  job = {
-                    name = "job-1";
-                    builders = [
-                      {
-                        shell = ''
-                          echo "Running job-1"
-                        '';
-                      }
-                    ];
-                  };
-                }
+            nixJobs = [
+              {
+                job = {
+                  name = "job-1";
+                  builders = [
+                    {
+                      shell = ''
+                        echo "Running job-1"
+                      '';
+                    }
+                  ];
+                };
+              }
 
-                {
-                  job = {
-                    name = "folder-1";
-                    project-type = "folder";
-                  };
-                }
+              {
+                job = {
+                  name = "folder-1";
+                  project-type = "folder";
+                };
+              }
 
-                {
-                  job = {
-                    name = "folder-1/job-2";
-                    builders = [
-                      {
-                        shell = ''
-                          echo "Running job-2"
-                        '';
-                      }
-                    ];
-                  };
-                }
-              ];
-            };
+              {
+                job = {
+                  name = "folder-1/job-2";
+                  builders = [
+                    {
+                      shell = ''
+                        echo "Running job-2"
+                      '';
+                    }
+                  ];
+                };
+              }
+            ];
           };
-
-          specialisation.noJenkinsJobs.configuration = {
-            services.jenkins.jobBuilder.nixJobs = pkgs.lib.mkForce [ ];
-          };
-
-          # should have no effect
-          services.jenkinsSlave.enable = true;
-
-          users.users.jenkins.extraGroups = [ "users" ];
-
-          systemd.services.jenkins.serviceConfig.TimeoutStartSec = "6min";
-
-          # Increase disk space to prevent this issue:
-          #
-          # WARNING h.n.DiskSpaceMonitorDescriptor#markNodeOfflineOrOnline: Making Built-In Node offline temporarily due to the lack of disk space
-          virtualisation.diskSize = 2 * 1024;
         };
 
-      slave =
-        { ... }:
-        {
-          services.jenkinsSlave.enable = true;
-
-          users.users.jenkins.extraGroups = [ "users" ];
+        specialisation.noJenkinsJobs.configuration = {
+          services.jenkins.jobBuilder.nixJobs = pkgs.lib.mkForce [ ];
         };
 
-    };
+        # should have no effect
+        services.jenkinsSlave.enable = true;
 
-    testScript =
-      { nodes, ... }:
-      let
-        configWithoutJobs = "${nodes.master.system.build.toplevel}/specialisation/noJenkinsJobs";
-        jenkinsPort = nodes.master.services.jenkins.port;
-        jenkinsUrl = "http://localhost:${toString jenkinsPort}";
-      in
-      ''
-        start_all()
+        users.users.jenkins.extraGroups = [ "users" ];
 
-        master.wait_for_unit("default.target")
+        systemd.services.jenkins.serviceConfig.TimeoutStartSec = "6min";
 
-        assert "Authentication required" in master.succeed("curl http://localhost:8080")
+        # Increase disk space to prevent this issue:
+        #
+        # WARNING h.n.DiskSpaceMonitorDescriptor#markNodeOfflineOrOnline: Making Built-In Node offline temporarily due to the lack of disk space
+        virtualisation.diskSize = 2 * 1024;
+      };
 
-        for host in master, slave:
-            groups = host.succeed("sudo -u jenkins groups")
-            assert "jenkins" in groups
-            assert "users" in groups
+    slave =
+      { ... }:
+      {
+        services.jenkinsSlave.enable = true;
 
-        slave.fail("systemctl is-enabled jenkins.service")
+        users.users.jenkins.extraGroups = [ "users" ];
+      };
 
-        slave.succeed("java -fullversion")
+  };
 
-        with subtest("jobs are declarative"):
-            # Check that jobs are created on disk.
-            master.wait_until_succeeds("test -f /var/lib/jenkins/jobs/job-1/config.xml")
-            master.wait_until_succeeds("test -f /var/lib/jenkins/jobs/folder-1/config.xml")
-            master.wait_until_succeeds("test -f /var/lib/jenkins/jobs/folder-1/jobs/job-2/config.xml")
+  testScript =
+    { nodes, ... }:
+    let
+      configWithoutJobs = "${nodes.master.system.build.toplevel}/specialisation/noJenkinsJobs";
+      jenkinsPort = nodes.master.services.jenkins.port;
+      jenkinsUrl = "http://localhost:${toString jenkinsPort}";
+    in
+    ''
+      start_all()
 
-            # Verify that jenkins also sees the jobs.
-            out = master.succeed("${pkgs.jenkins}/bin/jenkins-cli -s ${jenkinsUrl} -auth admin:$(cat /var/lib/jenkins/secrets/initialAdminPassword) list-jobs")
-            jobs = [x.strip() for x in out.splitlines()]
-            # Seeing jobs inside folders requires the Folders plugin
-            # (https://plugins.jenkins.io/cloudbees-folder/), which we don't have
-            # in this vanilla jenkins install, so limit ourself to non-folder jobs.
-            assert jobs == ['job-1'], f"jobs != ['job-1']: {jobs}"
+      master.wait_for_unit("default.target")
 
-            master.succeed(
-                "${configWithoutJobs}/bin/switch-to-configuration test >&2"
-            )
+      assert "Authentication required" in master.succeed("curl http://localhost:8080")
 
-            # Check that jobs are removed from disk.
-            master.wait_until_fails("test -f /var/lib/jenkins/jobs/job-1/config.xml")
-            master.wait_until_fails("test -f /var/lib/jenkins/jobs/folder-1/config.xml")
-            master.wait_until_fails("test -f /var/lib/jenkins/jobs/folder-1/jobs/job-2/config.xml")
+      for host in master, slave:
+          groups = host.succeed("sudo -u jenkins groups")
+          assert "jenkins" in groups
+          assert "users" in groups
 
-            # Verify that jenkins also sees the jobs as removed.
-            out = master.succeed("${pkgs.jenkins}/bin/jenkins-cli -s ${jenkinsUrl} -auth admin:$(cat /var/lib/jenkins/secrets/initialAdminPassword) list-jobs")
-            jobs = [x.strip() for x in out.splitlines()]
-            assert jobs == [], f"jobs != []: {jobs}"
-      '';
-  }
-)
+      slave.fail("systemctl is-enabled jenkins.service")
+
+      slave.succeed("java -fullversion")
+
+      with subtest("jobs are declarative"):
+          # Check that jobs are created on disk.
+          master.wait_until_succeeds("test -f /var/lib/jenkins/jobs/job-1/config.xml")
+          master.wait_until_succeeds("test -f /var/lib/jenkins/jobs/folder-1/config.xml")
+          master.wait_until_succeeds("test -f /var/lib/jenkins/jobs/folder-1/jobs/job-2/config.xml")
+
+          # Verify that jenkins also sees the jobs.
+          out = master.succeed("${pkgs.jenkins}/bin/jenkins-cli -s ${jenkinsUrl} -auth admin:$(cat /var/lib/jenkins/secrets/initialAdminPassword) list-jobs")
+          jobs = [x.strip() for x in out.splitlines()]
+          # Seeing jobs inside folders requires the Folders plugin
+          # (https://plugins.jenkins.io/cloudbees-folder/), which we don't have
+          # in this vanilla jenkins install, so limit ourself to non-folder jobs.
+          assert jobs == ['job-1'], f"jobs != ['job-1']: {jobs}"
+
+          master.succeed(
+              "${configWithoutJobs}/bin/switch-to-configuration test >&2"
+          )
+
+          # Check that jobs are removed from disk.
+          master.wait_until_fails("test -f /var/lib/jenkins/jobs/job-1/config.xml")
+          master.wait_until_fails("test -f /var/lib/jenkins/jobs/folder-1/config.xml")
+          master.wait_until_fails("test -f /var/lib/jenkins/jobs/folder-1/jobs/job-2/config.xml")
+
+          # Verify that jenkins also sees the jobs as removed.
+          out = master.succeed("${pkgs.jenkins}/bin/jenkins-cli -s ${jenkinsUrl} -auth admin:$(cat /var/lib/jenkins/secrets/initialAdminPassword) list-jobs")
+          jobs = [x.strip() for x in out.splitlines()]
+          assert jobs == [], f"jobs != []: {jobs}"
+    '';
+}
diff --git a/nixos/tests/jibri.nix b/nixos/tests/jibri.nix
index d42e82bf1f47..2bfc41ed188d 100644
--- a/nixos/tests/jibri.nix
+++ b/nixos/tests/jibri.nix
@@ -1,74 +1,72 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "jibri";
-    meta = with pkgs.lib; {
-      maintainers = teams.jitsi.members;
-    };
+{ pkgs, ... }:
+{
+  name = "jibri";
+  meta = with pkgs.lib; {
+    maintainers = teams.jitsi.members;
+  };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        virtualisation.memorySize = 5120;
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      virtualisation.memorySize = 5120;
 
-        services.jitsi-meet = {
-          enable = true;
-          hostName = "machine";
-          jibri.enable = true;
-        };
-        services.jibri.ignoreCert = true;
-        services.jitsi-videobridge.openFirewall = true;
+      services.jitsi-meet = {
+        enable = true;
+        hostName = "machine";
+        jibri.enable = true;
+      };
+      services.jibri.ignoreCert = true;
+      services.jitsi-videobridge.openFirewall = true;
 
-        networking.firewall.allowedTCPPorts = [
-          80
-          443
-        ];
+      networking.firewall.allowedTCPPorts = [
+        80
+        443
+      ];
 
-        services.nginx.virtualHosts.machine = {
-          enableACME = true;
-          forceSSL = true;
-        };
-
-        security.acme.defaults.email = "me@example.org";
-        security.acme.acceptTerms = true;
-        security.acme.defaults.server = "https://example.com"; # self-signed only
+      services.nginx.virtualHosts.machine = {
+        enableACME = true;
+        forceSSL = true;
       };
 
-    testScript = ''
-      machine.wait_for_unit("jitsi-videobridge2.service")
-      machine.wait_for_unit("jicofo.service")
-      machine.wait_for_unit("nginx.service")
-      machine.wait_for_unit("prosody.service")
-      machine.wait_for_unit("jibri.service")
+      security.acme.defaults.email = "me@example.org";
+      security.acme.acceptTerms = true;
+      security.acme.defaults.server = "https://example.com"; # self-signed only
+    };
 
-      machine.wait_until_succeeds(
-          "journalctl -b -u prosody -o cat | grep -q 'Authenticated as focus@auth.machine'", timeout=31
-      )
-      machine.wait_until_succeeds(
-          "journalctl -b -u prosody -o cat | grep -q 'Authenticated as jvb@auth.machine'", timeout=32
-      )
-      machine.wait_until_succeeds(
-          "journalctl -b -u prosody -o cat | grep -q 'Authenticated as jibri@auth.machine'", timeout=33
-      )
-      machine.wait_until_succeeds(
-          "cat /var/log/jitsi/jibri/log.0.txt | grep -q 'Joined MUC: jibribrewery@internal.auth.machine'", timeout=34
-      )
+  testScript = ''
+    machine.wait_for_unit("jitsi-videobridge2.service")
+    machine.wait_for_unit("jicofo.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_unit("prosody.service")
+    machine.wait_for_unit("jibri.service")
 
-      assert '"busyStatus":"IDLE","health":{"healthStatus":"HEALTHY"' in machine.succeed(
-          "curl -X GET http://machine:2222/jibri/api/v1.0/health"
-      )
-      machine.succeed(
-          """curl -H "Content-Type: application/json" -X POST http://localhost:2222/jibri/api/v1.0/startService -d '{"sessionId": "RecordTest","callParams":{"callUrlInfo":{"baseUrl": "https://machine","callName": "TestCall"}},"callLoginParams":{"domain": "recorder.machine", "username": "recorder", "password": "'"$(cat /var/lib/jitsi-meet/jibri-recorder-secret)"'" },"sinkType": "file"}'"""
-      )
-      machine.wait_until_succeeds(
-          "cat /var/log/jitsi/jibri/log.0.txt | grep -q 'File recording service transitioning from state Starting up to Running'", timeout=35
-      )
-      machine.succeed(
-          """sleep 15 && curl -H "Content-Type: application/json" -X POST http://localhost:2222/jibri/api/v1.0/stopService -d '{"sessionId": "RecordTest","callParams":{"callUrlInfo":{"baseUrl": "https://machine","callName": "TestCall"}},"callLoginParams":{"domain": "recorder.machine", "username": "recorder", "password": "'"$(cat /var/lib/jitsi-meet/jibri-recorder-secret)"'" },"sinkType": "file"}'"""
-      )
-      machine.wait_until_succeeds(
-          "cat /var/log/jitsi/jibri/log.0.txt | grep -q 'Finalize script finished with exit value 0'", timeout=36
-      )
-    '';
-  }
-)
+    machine.wait_until_succeeds(
+        "journalctl -b -u prosody -o cat | grep -q 'Authenticated as focus@auth.machine'", timeout=31
+    )
+    machine.wait_until_succeeds(
+        "journalctl -b -u prosody -o cat | grep -q 'Authenticated as jvb@auth.machine'", timeout=32
+    )
+    machine.wait_until_succeeds(
+        "journalctl -b -u prosody -o cat | grep -q 'Authenticated as jibri@auth.machine'", timeout=33
+    )
+    machine.wait_until_succeeds(
+        "cat /var/log/jitsi/jibri/log.0.txt | grep -q 'Joined MUC: jibribrewery@internal.auth.machine'", timeout=34
+    )
+
+    assert '"busyStatus":"IDLE","health":{"healthStatus":"HEALTHY"' in machine.succeed(
+        "curl -X GET http://machine:2222/jibri/api/v1.0/health"
+    )
+    machine.succeed(
+        """curl -H "Content-Type: application/json" -X POST http://localhost:2222/jibri/api/v1.0/startService -d '{"sessionId": "RecordTest","callParams":{"callUrlInfo":{"baseUrl": "https://machine","callName": "TestCall"}},"callLoginParams":{"domain": "recorder.machine", "username": "recorder", "password": "'"$(cat /var/lib/jitsi-meet/jibri-recorder-secret)"'" },"sinkType": "file"}'"""
+    )
+    machine.wait_until_succeeds(
+        "cat /var/log/jitsi/jibri/log.0.txt | grep -q 'File recording service transitioning from state Starting up to Running'", timeout=35
+    )
+    machine.succeed(
+        """sleep 15 && curl -H "Content-Type: application/json" -X POST http://localhost:2222/jibri/api/v1.0/stopService -d '{"sessionId": "RecordTest","callParams":{"callUrlInfo":{"baseUrl": "https://machine","callName": "TestCall"}},"callLoginParams":{"domain": "recorder.machine", "username": "recorder", "password": "'"$(cat /var/lib/jitsi-meet/jibri-recorder-secret)"'" },"sinkType": "file"}'"""
+    )
+    machine.wait_until_succeeds(
+        "cat /var/log/jitsi/jibri/log.0.txt | grep -q 'Finalize script finished with exit value 0'", timeout=36
+    )
+  '';
+}
diff --git a/nixos/tests/jirafeau.nix b/nixos/tests/jirafeau.nix
index 6cace65ed6f3..ebbd637a13ec 100644
--- a/nixos/tests/jirafeau.nix
+++ b/nixos/tests/jirafeau.nix
@@ -1,24 +1,22 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "jirafeau";
-    meta.maintainers = [ ];
+{
+  name = "jirafeau";
+  meta.maintainers = [ ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.jirafeau = {
-          enable = true;
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.jirafeau = {
+        enable = true;
       };
+    };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("phpfpm-jirafeau.service")
-      machine.wait_for_unit("nginx.service")
-      machine.wait_for_open_port(80)
-      machine.succeed("curl -sSfL http://localhost/ | grep 'Jirafeau'")
-    '';
-  }
-)
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("phpfpm-jirafeau.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_open_port(80)
+    machine.succeed("curl -sSfL http://localhost/ | grep 'Jirafeau'")
+  '';
+}
diff --git a/nixos/tests/jitsi-meet.nix b/nixos/tests/jitsi-meet.nix
index a9934700ecf3..2181ed863a88 100644
--- a/nixos/tests/jitsi-meet.nix
+++ b/nixos/tests/jitsi-meet.nix
@@ -1,80 +1,78 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "jitsi-meet";
-    meta = with pkgs.lib; {
-      maintainers = teams.jitsi.members;
-    };
+{ pkgs, ... }:
+{
+  name = "jitsi-meet";
+  meta = with pkgs.lib; {
+    maintainers = teams.jitsi.members;
+  };
 
-    nodes = {
-      client =
-        { nodes, pkgs, ... }:
-        {
+  nodes = {
+    client =
+      { nodes, pkgs, ... }:
+      {
+      };
+    server =
+      { config, pkgs, ... }:
+      {
+        services.jitsi-meet = {
+          enable = true;
+          hostName = "server";
         };
-      server =
-        { config, pkgs, ... }:
-        {
-          services.jitsi-meet = {
-            enable = true;
-            hostName = "server";
-          };
-          services.jitsi-videobridge.openFirewall = true;
+        services.jitsi-videobridge.openFirewall = true;
 
-          networking.firewall.allowedTCPPorts = [
-            80
-            443
-          ];
+        networking.firewall.allowedTCPPorts = [
+          80
+          443
+        ];
 
-          services.nginx.virtualHosts.server = {
-            enableACME = true;
-            forceSSL = true;
-          };
+        services.nginx.virtualHosts.server = {
+          enableACME = true;
+          forceSSL = true;
+        };
 
-          security.acme.acceptTerms = true;
-          security.acme.defaults.email = "me@example.org";
-          security.acme.defaults.server = "https://example.com"; # self-signed only
+        security.acme.acceptTerms = true;
+        security.acme.defaults.email = "me@example.org";
+        security.acme.defaults.server = "https://example.com"; # self-signed only
 
-          specialisation.caddy = {
-            inheritParentConfig = true;
-            configuration = {
-              services.jitsi-meet = {
-                caddy.enable = true;
-                nginx.enable = false;
-              };
-              services.caddy.virtualHosts.${config.services.jitsi-meet.hostName}.extraConfig = ''
-                tls internal
-              '';
+        specialisation.caddy = {
+          inheritParentConfig = true;
+          configuration = {
+            services.jitsi-meet = {
+              caddy.enable = true;
+              nginx.enable = false;
             };
+            services.caddy.virtualHosts.${config.services.jitsi-meet.hostName}.extraConfig = ''
+              tls internal
+            '';
           };
         };
-    };
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        server.wait_for_unit("jitsi-videobridge2.service")
-        server.wait_for_unit("jicofo.service")
-        server.wait_for_unit("nginx.service")
-        server.wait_for_unit("prosody.service")
+  testScript =
+    { nodes, ... }:
+    ''
+      server.wait_for_unit("jitsi-videobridge2.service")
+      server.wait_for_unit("jicofo.service")
+      server.wait_for_unit("nginx.service")
+      server.wait_for_unit("prosody.service")
 
-        server.wait_until_succeeds(
-            "journalctl -b -u prosody -o cat | grep -q 'Authenticated as focus@auth.server'"
-        )
-        server.wait_until_succeeds(
-            "journalctl -b -u prosody -o cat | grep -q 'Authenticated as jvb@auth.server'"
-        )
+      server.wait_until_succeeds(
+          "journalctl -b -u prosody -o cat | grep -q 'Authenticated as focus@auth.server'"
+      )
+      server.wait_until_succeeds(
+          "journalctl -b -u prosody -o cat | grep -q 'Authenticated as jvb@auth.server'"
+      )
 
-        client.wait_for_unit("network.target")
+      client.wait_for_unit("network.target")
 
-        def client_curl():
-            assert "<title>Jitsi Meet</title>" in client.succeed("curl -sSfkL http://server/")
+      def client_curl():
+          assert "<title>Jitsi Meet</title>" in client.succeed("curl -sSfkL http://server/")
 
-        client_curl()
+      client_curl()
 
-        with subtest("Testing backup service"):
-            server.succeed("${nodes.server.system.build.toplevel}/specialisation/caddy/bin/switch-to-configuration test")
-            server.wait_for_unit("caddy.service")
-            client_curl()
-      '';
-  }
-)
+      with subtest("Testing backup service"):
+          server.succeed("${nodes.server.system.build.toplevel}/specialisation/caddy/bin/switch-to-configuration test")
+          server.wait_for_unit("caddy.service")
+          client_curl()
+    '';
+}
diff --git a/nixos/tests/jotta-cli.nix b/nixos/tests/jotta-cli.nix
index 27f576f93a53..caf3ebeaad78 100644
--- a/nixos/tests/jotta-cli.nix
+++ b/nixos/tests/jotta-cli.nix
@@ -1,33 +1,31 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
+{ pkgs, ... }:
+{
 
-    name = "jotta-cli";
-    meta.maintainers = with pkgs.lib.maintainers; [ evenbrenden ];
+  name = "jotta-cli";
+  meta.maintainers = with pkgs.lib.maintainers; [ evenbrenden ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.jotta-cli.enable = true;
-        imports = [ ./common/user-account.nix ];
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.jotta-cli.enable = true;
+      imports = [ ./common/user-account.nix ];
+    };
 
-    testScript =
-      { nodes, ... }:
-      let
-        uid = toString nodes.machine.users.users.alice.uid;
-      in
-      ''
-        machine.start()
+  testScript =
+    { nodes, ... }:
+    let
+      uid = toString nodes.machine.users.users.alice.uid;
+    in
+    ''
+      machine.start()
 
-        machine.succeed("loginctl enable-linger alice")
-        machine.wait_for_unit("user@${uid}.service")
+      machine.succeed("loginctl enable-linger alice")
+      machine.wait_for_unit("user@${uid}.service")
 
-        machine.wait_for_unit("jottad.service", "alice")
-        machine.wait_for_open_unix_socket("/run/user/${uid}/jottad/jottad.socket")
+      machine.wait_for_unit("jottad.service", "alice")
+      machine.wait_for_open_unix_socket("/run/user/${uid}/jottad/jottad.socket")
 
-        # "jotta-cli version" should fail if jotta-cli cannot connect to jottad
-        machine.succeed('XDG_RUNTIME_DIR=/run/user/${uid} su alice -c "jotta-cli version"')
-      '';
-  }
-)
+      # "jotta-cli version" should fail if jotta-cli cannot connect to jottad
+      machine.succeed('XDG_RUNTIME_DIR=/run/user/${uid} su alice -c "jotta-cli version"')
+    '';
+}
diff --git a/nixos/tests/kanidm-provisioning.nix b/nixos/tests/kanidm-provisioning.nix
index 8f0ca0ec0859..f38e0770388d 100644
--- a/nixos/tests/kanidm-provisioning.nix
+++ b/nixos/tests/kanidm-provisioning.nix
@@ -1,522 +1,562 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    certs = import ./common/acme/server/snakeoil-certs.nix;
-    serverDomain = certs.domain;
+{ pkgs, ... }:
+let
+  certs = import ./common/acme/server/snakeoil-certs.nix;
+  serverDomain = certs.domain;
 
-    # copy certs to store to work around mount namespacing
-    certsPath = pkgs.runCommandNoCC "snakeoil-certs" { } ''
-      mkdir $out
-      cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
-      cp ${certs."${serverDomain}".key} $out/snakeoil.key
-    '';
+  # copy certs to store to work around mount namespacing
+  certsPath = pkgs.runCommandNoCC "snakeoil-certs" { } ''
+    mkdir $out
+    cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
+    cp ${certs."${serverDomain}".key} $out/snakeoil.key
+  '';
 
-    provisionAdminPassword = "very-strong-password-for-admin";
-    provisionIdmAdminPassword = "very-strong-password-for-idm-admin";
-    provisionIdmAdminPassword2 = "very-strong-alternative-password-for-idm-admin";
-  in
-  {
-    name = "kanidm-provisioning";
-    meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
+  provisionAdminPassword = "very-strong-password-for-admin";
+  provisionIdmAdminPassword = "very-strong-password-for-idm-admin";
+  provisionIdmAdminPassword2 = "very-strong-alternative-password-for-idm-admin";
+in
+{
+  name = "kanidm-provisioning";
+  meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
 
-    nodes.provision =
-      { pkgs, lib, ... }:
-      {
-        services.kanidm = {
-          package = pkgs.kanidmWithSecretProvisioning_1_6;
-          enableServer = true;
-          serverSettings = {
-            origin = "https://${serverDomain}";
-            domain = serverDomain;
-            bindaddress = "[::]:443";
-            ldapbindaddress = "[::1]:636";
-            tls_chain = "${certsPath}/snakeoil.crt";
-            tls_key = "${certsPath}/snakeoil.key";
-          };
-          # So we can check whether provisioning did what we wanted
-          enableClient = true;
-          clientSettings = {
-            uri = "https://${serverDomain}";
-            verify_ca = true;
-            verify_hostnames = true;
+  nodes.provision =
+    { pkgs, lib, ... }:
+    {
+      services.kanidm = {
+        package = pkgs.kanidmWithSecretProvisioning_1_6;
+        enableServer = true;
+        serverSettings = {
+          origin = "https://${serverDomain}";
+          domain = serverDomain;
+          bindaddress = "[::]:443";
+          ldapbindaddress = "[::1]:636";
+          tls_chain = "${certsPath}/snakeoil.crt";
+          tls_key = "${certsPath}/snakeoil.key";
+        };
+        # So we can check whether provisioning did what we wanted
+        enableClient = true;
+        clientSettings = {
+          uri = "https://${serverDomain}";
+          verify_ca = true;
+          verify_hostnames = true;
+        };
+      };
+
+      specialisation.credentialProvision.configuration =
+        { ... }:
+        {
+          services.kanidm.provision = lib.mkForce {
+            enable = true;
+            adminPasswordFile = pkgs.writeText "admin-pw" provisionAdminPassword;
+            idmAdminPasswordFile = pkgs.writeText "idm-admin-pw" provisionIdmAdminPassword;
           };
         };
 
-        specialisation.credentialProvision.configuration =
-          { ... }:
-          {
-            services.kanidm.provision = lib.mkForce {
-              enable = true;
-              adminPasswordFile = pkgs.writeText "admin-pw" provisionAdminPassword;
-              idmAdminPasswordFile = pkgs.writeText "idm-admin-pw" provisionIdmAdminPassword;
-            };
+      specialisation.changedCredential.configuration =
+        { ... }:
+        {
+          services.kanidm.provision = lib.mkForce {
+            enable = true;
+            idmAdminPasswordFile = pkgs.writeText "idm-admin-pw" provisionIdmAdminPassword2;
           };
+        };
 
-        specialisation.changedCredential.configuration =
-          { ... }:
-          {
-            services.kanidm.provision = lib.mkForce {
-              enable = true;
-              idmAdminPasswordFile = pkgs.writeText "idm-admin-pw" provisionIdmAdminPassword2;
+      specialisation.addEntities.configuration =
+        { ... }:
+        {
+          services.kanidm.provision = lib.mkForce {
+            enable = true;
+            # Test whether credential recovery works without specific idmAdmin password
+            #idmAdminPasswordFile =
+
+            groups.supergroup1 = {
+              members = [ "testgroup1" ];
             };
-          };
 
-        specialisation.addEntities.configuration =
-          { ... }:
-          {
-            services.kanidm.provision = lib.mkForce {
-              enable = true;
-              # Test whether credential recovery works without specific idmAdmin password
-              #idmAdminPasswordFile =
+            groups.testgroup1 = { };
 
-              groups.supergroup1 = {
-                members = [ "testgroup1" ];
-              };
+            persons.testuser1 = {
+              displayName = "Test User";
+              legalName = "Jane Doe";
+              mailAddresses = [ "jane.doe@example.com" ];
+              groups = [
+                "testgroup1"
+                "service1-access"
+              ];
+            };
 
-              groups.testgroup1 = { };
+            persons.testuser2 = {
+              displayName = "Powerful Test User";
+              legalName = "Ryouiki Tenkai";
+              groups = [ "service1-admin" ];
+            };
 
-              persons.testuser1 = {
-                displayName = "Test User";
-                legalName = "Jane Doe";
-                mailAddresses = [ "jane.doe@example.com" ];
-                groups = [
-                  "testgroup1"
-                  "service1-access"
-                ];
-              };
-
-              persons.testuser2 = {
-                displayName = "Powerful Test User";
-                legalName = "Ryouiki Tenkai";
-                groups = [ "service1-admin" ];
-              };
-
-              groups.service1-access = { };
-              groups.service1-admin = { };
-              systems.oauth2.service1 = {
-                displayName = "Service One";
-                originUrl = "https://one.example.com/";
-                originLanding = "https://one.example.com/landing";
-                basicSecretFile = pkgs.writeText "bs-service1" "very-strong-secret-for-service1";
-                scopeMaps.service1-access = [
-                  "openid"
-                  "email"
-                  "profile"
-                ];
-                supplementaryScopeMaps.service1-admin = [ "admin" ];
-                claimMaps.groups = {
-                  valuesByGroup.service1-admin = [ "admin" ];
-                };
-              };
-
-              systems.oauth2.service2 = {
-                displayName = "Service Two";
-                originUrl = "https://two.example.com/";
-                originLanding = "https://landing2.example.com/";
-                # Test not setting secret
-                # basicSecretFile =
-                allowInsecureClientDisablePkce = true;
-                preferShortUsername = true;
+            groups.service1-access = { };
+            groups.service1-admin = { };
+            systems.oauth2.service1 = {
+              displayName = "Service One";
+              originUrl = "https://one.example.com/";
+              originLanding = "https://one.example.com/landing";
+              basicSecretFile = pkgs.writeText "bs-service1" "very-strong-secret-for-service1";
+              scopeMaps.service1-access = [
+                "openid"
+                "email"
+                "profile"
+              ];
+              supplementaryScopeMaps.service1-admin = [ "admin" ];
+              claimMaps.groups = {
+                valuesByGroup.service1-admin = [ "admin" ];
               };
             };
-          };
 
-        specialisation.changeAttributes.configuration =
-          { ... }:
-          {
-            services.kanidm.provision = lib.mkForce {
-              enable = true;
-              # Changing admin credentials at any time should not be a problem:
-              idmAdminPasswordFile = pkgs.writeText "idm-admin-pw" provisionIdmAdminPassword;
-
-              groups.supergroup1 = {
-                #members = ["testgroup1"];
-              };
-
-              groups.testgroup1 = { };
-
-              persons.testuser1 = {
-                displayName = "Test User (changed)";
-                legalName = "Jane Doe (changed)";
-                mailAddresses = [
-                  "jane.doe@example.com"
-                  "second.doe@example.com"
-                ];
-                groups = [
-                  #"testgroup1"
-                  "service1-access"
-                ];
-              };
-
-              persons.testuser2 = {
-                displayName = "Powerful Test User (changed)";
-                legalName = "Ryouiki Tenkai (changed)";
-                groups = [ "service1-admin" ];
-              };
-
-              groups.service1-access = { };
-              groups.service1-admin = { };
-              systems.oauth2.service1 = {
-                displayName = "Service One (changed)";
-                # multiple origin urls
-                originUrl = [
-                  "https://changed-one.example.com/"
-                  "https://changed-one.example.org/"
-                ];
-                originLanding = "https://changed-one.example.com/landing-changed";
-                basicSecretFile = pkgs.writeText "bs-service1" "changed-very-strong-secret-for-service1";
-                scopeMaps.service1-access = [
-                  "openid"
-                  "email"
-                  #"profile"
-                ];
-                supplementaryScopeMaps.service1-admin = [ "adminchanged" ];
-                claimMaps.groups = {
-                  valuesByGroup.service1-admin = [ "adminchanged" ];
-                };
-              };
-
-              systems.oauth2.service2 = {
-                displayName = "Service Two (changed)";
-                originUrl = "https://changed-two.example.com/";
-                originLanding = "https://changed-landing2.example.com/";
-                # Test not setting secret
-                # basicSecretFile =
-                allowInsecureClientDisablePkce = false;
-                preferShortUsername = false;
-              };
+            systems.oauth2.service2 = {
+              displayName = "Service Two";
+              originUrl = "https://two.example.com/";
+              originLanding = "https://landing2.example.com/";
+              # Test not setting secret
+              # basicSecretFile =
+              allowInsecureClientDisablePkce = true;
+              preferShortUsername = true;
             };
           };
+        };
 
-        specialisation.removeAttributes.configuration =
-          { ... }:
-          {
-            services.kanidm.provision = lib.mkForce {
-              enable = true;
-              idmAdminPasswordFile = pkgs.writeText "idm-admin-pw" provisionIdmAdminPassword;
+      specialisation.changeAttributes.configuration =
+        { ... }:
+        {
+          services.kanidm.provision = lib.mkForce {
+            enable = true;
+            # Changing admin credentials at any time should not be a problem:
+            idmAdminPasswordFile = pkgs.writeText "idm-admin-pw" provisionIdmAdminPassword;
 
-              groups.supergroup1 = { };
+            groups.supergroup1 = {
+              #members = ["testgroup1"];
+            };
 
-              persons.testuser1 = {
-                displayName = "Test User (changed)";
-              };
+            groups.testgroup1 = { };
 
-              persons.testuser2 = {
-                displayName = "Powerful Test User (changed)";
-                groups = [ "service1-admin" ];
-              };
+            persons.testuser1 = {
+              displayName = "Test User (changed)";
+              legalName = "Jane Doe (changed)";
+              mailAddresses = [
+                "jane.doe@example.com"
+                "second.doe@example.com"
+              ];
+              groups = [
+                #"testgroup1"
+                "service1-access"
+              ];
+            };
 
-              groups.service1-access = { };
-              groups.service1-admin = { };
-              systems.oauth2.service1 = {
-                displayName = "Service One (changed)";
-                originUrl = "https://changed-one.example.com/";
-                originLanding = "https://changed-one.example.com/landing-changed";
-                basicSecretFile = pkgs.writeText "bs-service1" "changed-very-strong-secret-for-service1";
-                # Removing maps requires setting them to the empty list
-                scopeMaps.service1-access = [ ];
-                supplementaryScopeMaps.service1-admin = [ ];
-              };
+            persons.testuser2 = {
+              displayName = "Powerful Test User (changed)";
+              legalName = "Ryouiki Tenkai (changed)";
+              groups = [ "service1-admin" ];
+            };
 
-              systems.oauth2.service2 = {
-                displayName = "Service Two (changed)";
-                originUrl = "https://changed-two.example.com/";
-                originLanding = "https://changed-landing2.example.com/";
+            groups.service1-access = { };
+            groups.service1-admin = { };
+            systems.oauth2.service1 = {
+              displayName = "Service One (changed)";
+              # multiple origin urls
+              originUrl = [
+                "https://changed-one.example.com/"
+                "https://changed-one.example.org/"
+              ];
+              originLanding = "https://changed-one.example.com/landing-changed";
+              basicSecretFile = pkgs.writeText "bs-service1" "changed-very-strong-secret-for-service1";
+              scopeMaps.service1-access = [
+                "openid"
+                "email"
+                #"profile"
+              ];
+              supplementaryScopeMaps.service1-admin = [ "adminchanged" ];
+              claimMaps.groups = {
+                valuesByGroup.service1-admin = [ "adminchanged" ];
               };
             };
-          };
 
-        specialisation.removeEntities.configuration =
-          { ... }:
-          {
-            services.kanidm.provision = lib.mkForce {
-              enable = true;
-              idmAdminPasswordFile = pkgs.writeText "idm-admin-pw" provisionIdmAdminPassword;
+            systems.oauth2.service2 = {
+              displayName = "Service Two (changed)";
+              originUrl = "https://changed-two.example.com/";
+              originLanding = "https://changed-landing2.example.com/";
+              # Test not setting secret
+              # basicSecretFile =
+              allowInsecureClientDisablePkce = false;
+              preferShortUsername = false;
             };
           };
+        };
 
-        security.pki.certificateFiles = [ certs.ca.cert ];
+      specialisation.removeAttributes.configuration =
+        { ... }:
+        {
+          services.kanidm.provision = lib.mkForce {
+            enable = true;
+            idmAdminPasswordFile = pkgs.writeText "idm-admin-pw" provisionIdmAdminPassword;
 
-        networking.hosts."::1" = [ serverDomain ];
-        networking.firewall.allowedTCPPorts = [ 443 ];
+            groups.supergroup1 = { };
 
-        users.users.kanidm.shell = pkgs.bashInteractive;
+            persons.testuser1 = {
+              displayName = "Test User (changed)";
+            };
 
-        environment.systemPackages = with pkgs; [
-          kanidm
-          openldap
-          ripgrep
-          jq
-        ];
-      };
+            persons.testuser2 = {
+              displayName = "Powerful Test User (changed)";
+              groups = [ "service1-admin" ];
+            };
 
-    testScript =
-      { nodes, ... }:
-      let
-        # We need access to the config file in the test script.
-        filteredConfig = pkgs.lib.converge (pkgs.lib.filterAttrsRecursive (
-          _: v: v != null
-        )) nodes.provision.services.kanidm.serverSettings;
-        serverConfigFile = (pkgs.formats.toml { }).generate "server.toml" filteredConfig;
+            groups.service1-access = { };
+            groups.service1-admin = { };
+            systems.oauth2.service1 = {
+              displayName = "Service One (changed)";
+              originUrl = "https://changed-one.example.com/";
+              originLanding = "https://changed-one.example.com/landing-changed";
+              basicSecretFile = pkgs.writeText "bs-service1" "changed-very-strong-secret-for-service1";
+              # Removing maps requires setting them to the empty list
+              scopeMaps.service1-access = [ ];
+              supplementaryScopeMaps.service1-admin = [ ];
+            };
 
-        specialisations = "${nodes.provision.system.build.toplevel}/specialisation";
-      in
-      ''
-        import re
+            systems.oauth2.service2 = {
+              displayName = "Service Two (changed)";
+              originUrl = "https://changed-two.example.com/";
+              originLanding = "https://changed-landing2.example.com/";
+            };
+          };
+        };
 
-        def assert_contains(haystack, needle):
-            if needle not in haystack:
-                print("The haystack that will cause the following exception is:")
-                print("---")
-                print(haystack)
-                print("---")
-                raise Exception(f"Expected string '{needle}' was not found")
+      specialisation.removeEntities.configuration =
+        { ... }:
+        {
+          services.kanidm.provision = lib.mkForce {
+            enable = true;
+            idmAdminPasswordFile = pkgs.writeText "idm-admin-pw" provisionIdmAdminPassword;
+          };
+        };
 
-        def assert_matches(haystack, expr):
-            if not re.search(expr, haystack):
-                print("The haystack that will cause the following exception is:")
-                print("---")
-                print(haystack)
-                print("---")
-                raise Exception(f"Expected regex '{expr}' did not match")
+      specialisation.extraJsonFile.configuration =
+        { ... }:
+        {
+          services.kanidm.provision = lib.mkForce {
+            enable = true;
+            idmAdminPasswordFile = pkgs.writeText "idm-admin-pw" provisionIdmAdminPassword;
 
-        def assert_lacks(haystack, needle):
-            if needle in haystack:
-                print("The haystack that will cause the following exception is:")
-                print("---")
-                print(haystack, end="")
-                print("---")
-                raise Exception(f"Unexpected string '{needle}' was found")
+            extraJsonFile = pkgs.writeText "extra-json.json" (
+              builtins.toJSON {
+                persons.testuser2.displayName = "Test User 2";
+                groups.testgroup1.members = [ "testuser2" ];
+              }
+            );
 
-        provision.start()
+            groups.testgroup1 = { };
 
-        def provision_login(pw):
-            provision.wait_for_unit("kanidm.service")
-            provision.wait_until_succeeds("curl -Lsf https://${serverDomain} | grep Kanidm")
-            if pw is None:
-                pw = provision.succeed("su - kanidm -c 'kanidmd recover-account -c ${serverConfigFile} idm_admin 2>&1 | rg -o \'[A-Za-z0-9]{48}\' '").strip().removeprefix("'").removesuffix("'")
-            out = provision.succeed(f"KANIDM_PASSWORD={pw} kanidm login -D idm_admin")
-            assert_contains(out, "Login Success for idm_admin")
+            persons.testuser1 = {
+              displayName = "Test User 1";
+              groups = [ "testgroup1" ];
+            };
+          };
+        };
 
-        with subtest("Test Provisioning - setup"):
-            provision_login(None)
-            provision.succeed("kanidm logout -D idm_admin")
+      security.pki.certificateFiles = [ certs.ca.cert ];
 
-        with subtest("Test Provisioning - credentialProvision"):
-            provision.succeed('${specialisations}/credentialProvision/bin/switch-to-configuration test')
-            provision_login("${provisionIdmAdminPassword}")
+      networking.hosts."::1" = [ serverDomain ];
+      networking.firewall.allowedTCPPorts = [ 443 ];
 
-            # Make sure neither password is logged
-            provision.fail("journalctl --since -10m --unit kanidm.service --grep '${provisionAdminPassword}'")
-            provision.fail("journalctl --since -10m --unit kanidm.service --grep '${provisionIdmAdminPassword}'")
+      users.users.kanidm.shell = pkgs.bashInteractive;
 
-            # Test provisioned admin pw
-            out = provision.succeed("KANIDM_PASSWORD=${provisionAdminPassword} kanidm login -D admin")
-            assert_contains(out, "Login Success for admin")
-            provision.succeed("kanidm logout -D admin")
-            provision.succeed("kanidm logout -D idm_admin")
+      environment.systemPackages = with pkgs; [
+        kanidm
+        openldap
+        ripgrep
+        jq
+      ];
+    };
 
-        with subtest("Test Provisioning - changedCredential"):
-            provision.succeed('${specialisations}/changedCredential/bin/switch-to-configuration test')
-            provision_login("${provisionIdmAdminPassword2}")
-            provision.succeed("kanidm logout -D idm_admin")
+  testScript =
+    { nodes, ... }:
+    let
+      # We need access to the config file in the test script.
+      filteredConfig = pkgs.lib.converge (pkgs.lib.filterAttrsRecursive (
+        _: v: v != null
+      )) nodes.provision.services.kanidm.serverSettings;
+      serverConfigFile = (pkgs.formats.toml { }).generate "server.toml" filteredConfig;
 
-        with subtest("Test Provisioning - addEntities"):
-            provision.succeed('${specialisations}/addEntities/bin/switch-to-configuration test')
-            # Unspecified idm admin password
-            provision_login(None)
+      specialisations = "${nodes.provision.system.build.toplevel}/specialisation";
+    in
+    ''
+      import re
 
-            out = provision.succeed("kanidm group get testgroup1")
-            assert_contains(out, "name: testgroup1")
+      def assert_contains(haystack, needle):
+          if needle not in haystack:
+              print("The haystack that will cause the following exception is:")
+              print("---")
+              print(haystack)
+              print("---")
+              raise Exception(f"Expected string '{needle}' was not found")
 
-            out = provision.succeed("kanidm group get supergroup1")
-            assert_contains(out, "name: supergroup1")
-            assert_contains(out, "member: testgroup1")
+      def assert_matches(haystack, expr):
+          if not re.search(expr, haystack):
+              print("The haystack that will cause the following exception is:")
+              print("---")
+              print(haystack)
+              print("---")
+              raise Exception(f"Expected regex '{expr}' did not match")
 
-            out = provision.succeed("kanidm person get testuser1")
-            assert_contains(out, "name: testuser1")
-            assert_contains(out, "displayname: Test User")
-            assert_contains(out, "legalname: Jane Doe")
-            assert_contains(out, "mail: jane.doe@example.com")
-            assert_contains(out, "memberof: testgroup1")
-            assert_contains(out, "memberof: service1-access")
+      def assert_lacks(haystack, needle):
+          if needle in haystack:
+              print("The haystack that will cause the following exception is:")
+              print("---")
+              print(haystack, end="")
+              print("---")
+              raise Exception(f"Unexpected string '{needle}' was found")
 
-            out = provision.succeed("kanidm person get testuser2")
-            assert_contains(out, "name: testuser2")
-            assert_contains(out, "displayname: Powerful Test User")
-            assert_contains(out, "legalname: Ryouiki Tenkai")
-            assert_contains(out, "memberof: service1-admin")
-            assert_lacks(out, "mail:")
+      provision.start()
 
-            out = provision.succeed("kanidm group get service1-access")
-            assert_contains(out, "name: service1-access")
+      def provision_login(pw):
+          provision.wait_for_unit("kanidm.service")
+          provision.wait_until_succeeds("curl -Lsf https://${serverDomain} | grep Kanidm")
+          if pw is None:
+              pw = provision.succeed("su - kanidm -c 'kanidmd recover-account -c ${serverConfigFile} idm_admin 2>&1 | rg -o \'[A-Za-z0-9]{48}\' '").strip().removeprefix("'").removesuffix("'")
+          out = provision.succeed(f"KANIDM_PASSWORD={pw} kanidm login -D idm_admin")
+          assert_contains(out, "Login Success for idm_admin")
 
-            out = provision.succeed("kanidm group get service1-admin")
-            assert_contains(out, "name: service1-admin")
+      with subtest("Test Provisioning - setup"):
+          provision_login(None)
+          provision.succeed("kanidm logout -D idm_admin")
 
-            out = provision.succeed("kanidm system oauth2 get service1")
-            assert_contains(out, "name: service1")
-            assert_contains(out, "displayname: Service One")
-            assert_contains(out, "oauth2_rs_origin: https://one.example.com/")
-            assert_contains(out, "oauth2_rs_origin_landing: https://one.example.com/landing")
-            assert_matches(out, 'oauth2_rs_scope_map: service1-access.*{"email", "openid", "profile"}')
-            assert_matches(out, 'oauth2_rs_sup_scope_map: service1-admin.*{"admin"}')
-            assert_matches(out, 'oauth2_rs_claim_map: groups:.*"admin"')
+      with subtest("Test Provisioning - credentialProvision"):
+          provision.succeed('${specialisations}/credentialProvision/bin/switch-to-configuration test')
+          provision_login("${provisionIdmAdminPassword}")
 
-            out = provision.succeed("kanidm system oauth2 show-basic-secret service1")
-            assert_contains(out, "very-strong-secret-for-service1")
+          # Make sure neither password is logged
+          provision.fail("journalctl --since -10m --unit kanidm.service --grep '${provisionAdminPassword}'")
+          provision.fail("journalctl --since -10m --unit kanidm.service --grep '${provisionIdmAdminPassword}'")
 
-            out = provision.succeed("kanidm system oauth2 get service2")
-            assert_contains(out, "name: service2")
-            assert_contains(out, "displayname: Service Two")
-            assert_contains(out, "oauth2_rs_origin: https://two.example.com/")
-            assert_contains(out, "oauth2_rs_origin_landing: https://landing2.example.com/")
-            assert_contains(out, "oauth2_allow_insecure_client_disable_pkce: true")
-            assert_contains(out, "oauth2_prefer_short_username: true")
+          # Test provisioned admin pw
+          out = provision.succeed("KANIDM_PASSWORD=${provisionAdminPassword} kanidm login -D admin")
+          assert_contains(out, "Login Success for admin")
+          provision.succeed("kanidm logout -D admin")
+          provision.succeed("kanidm logout -D idm_admin")
 
-            provision.succeed("kanidm logout -D idm_admin")
+      with subtest("Test Provisioning - changedCredential"):
+          provision.succeed('${specialisations}/changedCredential/bin/switch-to-configuration test')
+          provision_login("${provisionIdmAdminPassword2}")
+          provision.succeed("kanidm logout -D idm_admin")
 
-        with subtest("Test Provisioning - changeAttributes"):
-            provision.succeed('${specialisations}/changeAttributes/bin/switch-to-configuration test')
-            provision_login("${provisionIdmAdminPassword}")
+      with subtest("Test Provisioning - addEntities"):
+          provision.succeed('${specialisations}/addEntities/bin/switch-to-configuration test')
+          # Unspecified idm admin password
+          provision_login(None)
 
-            out = provision.succeed("kanidm group get testgroup1")
-            assert_contains(out, "name: testgroup1")
+          out = provision.succeed("kanidm group get testgroup1")
+          assert_contains(out, "name: testgroup1")
 
-            out = provision.succeed("kanidm group get supergroup1")
-            assert_contains(out, "name: supergroup1")
-            assert_lacks(out, "member: testgroup1")
+          out = provision.succeed("kanidm group get supergroup1")
+          assert_contains(out, "name: supergroup1")
+          assert_contains(out, "member: testgroup1")
 
-            out = provision.succeed("kanidm person get testuser1")
-            assert_contains(out, "name: testuser1")
-            assert_contains(out, "displayname: Test User (changed)")
-            assert_contains(out, "legalname: Jane Doe (changed)")
-            assert_contains(out, "mail: jane.doe@example.com")
-            assert_contains(out, "mail: second.doe@example.com")
-            assert_lacks(out, "memberof: testgroup1")
-            assert_contains(out, "memberof: service1-access")
+          out = provision.succeed("kanidm person get testuser1")
+          assert_contains(out, "name: testuser1")
+          assert_contains(out, "displayname: Test User")
+          assert_contains(out, "legalname: Jane Doe")
+          assert_contains(out, "mail: jane.doe@example.com")
+          assert_contains(out, "memberof: testgroup1")
+          assert_contains(out, "memberof: service1-access")
 
-            out = provision.succeed("kanidm person get testuser2")
-            assert_contains(out, "name: testuser2")
-            assert_contains(out, "displayname: Powerful Test User (changed)")
-            assert_contains(out, "legalname: Ryouiki Tenkai (changed)")
-            assert_contains(out, "memberof: service1-admin")
-            assert_lacks(out, "mail:")
+          out = provision.succeed("kanidm person get testuser2")
+          assert_contains(out, "name: testuser2")
+          assert_contains(out, "displayname: Powerful Test User")
+          assert_contains(out, "legalname: Ryouiki Tenkai")
+          assert_contains(out, "memberof: service1-admin")
+          assert_lacks(out, "mail:")
 
-            out = provision.succeed("kanidm group get service1-access")
-            assert_contains(out, "name: service1-access")
+          out = provision.succeed("kanidm group get service1-access")
+          assert_contains(out, "name: service1-access")
 
-            out = provision.succeed("kanidm group get service1-admin")
-            assert_contains(out, "name: service1-admin")
+          out = provision.succeed("kanidm group get service1-admin")
+          assert_contains(out, "name: service1-admin")
 
-            out = provision.succeed("kanidm system oauth2 get service1")
-            assert_contains(out, "name: service1")
-            assert_contains(out, "displayname: Service One (changed)")
-            assert_contains(out, "oauth2_rs_origin: https://changed-one.example.com/")
-            assert_contains(out, "oauth2_rs_origin: https://changed-one.example.org/")
-            assert_contains(out, "oauth2_rs_origin_landing: https://changed-one.example.com/landing")
-            assert_matches(out, 'oauth2_rs_scope_map: service1-access.*{"email", "openid"}')
-            assert_matches(out, 'oauth2_rs_sup_scope_map: service1-admin.*{"adminchanged"}')
-            assert_matches(out, 'oauth2_rs_claim_map: groups:.*"adminchanged"')
+          out = provision.succeed("kanidm system oauth2 get service1")
+          assert_contains(out, "name: service1")
+          assert_contains(out, "displayname: Service One")
+          assert_contains(out, "oauth2_rs_origin: https://one.example.com/")
+          assert_contains(out, "oauth2_rs_origin_landing: https://one.example.com/landing")
+          assert_matches(out, 'oauth2_rs_scope_map: service1-access.*{"email", "openid", "profile"}')
+          assert_matches(out, 'oauth2_rs_sup_scope_map: service1-admin.*{"admin"}')
+          assert_matches(out, 'oauth2_rs_claim_map: groups:.*"admin"')
 
-            out = provision.succeed("kanidm system oauth2 show-basic-secret service1")
-            assert_contains(out, "changed-very-strong-secret-for-service1")
+          out = provision.succeed("kanidm system oauth2 show-basic-secret service1")
+          assert_contains(out, "very-strong-secret-for-service1")
 
-            out = provision.succeed("kanidm system oauth2 get service2")
-            assert_contains(out, "name: service2")
-            assert_contains(out, "displayname: Service Two (changed)")
-            assert_contains(out, "oauth2_rs_origin: https://changed-two.example.com/")
-            assert_contains(out, "oauth2_rs_origin_landing: https://changed-landing2.example.com/")
-            assert_lacks(out, "oauth2_allow_insecure_client_disable_pkce: true")
-            assert_lacks(out, "oauth2_prefer_short_username: true")
+          out = provision.succeed("kanidm system oauth2 get service2")
+          assert_contains(out, "name: service2")
+          assert_contains(out, "displayname: Service Two")
+          assert_contains(out, "oauth2_rs_origin: https://two.example.com/")
+          assert_contains(out, "oauth2_rs_origin_landing: https://landing2.example.com/")
+          assert_contains(out, "oauth2_allow_insecure_client_disable_pkce: true")
+          assert_contains(out, "oauth2_prefer_short_username: true")
 
-            provision.succeed("kanidm logout -D idm_admin")
+          provision.succeed("kanidm logout -D idm_admin")
 
-        with subtest("Test Provisioning - removeAttributes"):
-            provision.succeed('${specialisations}/removeAttributes/bin/switch-to-configuration test')
-            provision_login("${provisionIdmAdminPassword}")
+      with subtest("Test Provisioning - changeAttributes"):
+          provision.succeed('${specialisations}/changeAttributes/bin/switch-to-configuration test')
+          provision_login("${provisionIdmAdminPassword}")
 
-            out = provision.succeed("kanidm group get testgroup1")
-            assert_lacks(out, "name: testgroup1")
+          out = provision.succeed("kanidm group get testgroup1")
+          assert_contains(out, "name: testgroup1")
 
-            out = provision.succeed("kanidm group get supergroup1")
-            assert_contains(out, "name: supergroup1")
-            assert_lacks(out, "member: testgroup1")
+          out = provision.succeed("kanidm group get supergroup1")
+          assert_contains(out, "name: supergroup1")
+          assert_lacks(out, "member: testgroup1")
 
-            out = provision.succeed("kanidm person get testuser1")
-            assert_contains(out, "name: testuser1")
-            assert_contains(out, "displayname: Test User (changed)")
-            assert_lacks(out, "legalname: Jane Doe (changed)")
-            assert_lacks(out, "mail: jane.doe@example.com")
-            assert_lacks(out, "mail: second.doe@example.com")
-            assert_lacks(out, "memberof: testgroup1")
-            assert_lacks(out, "memberof: service1-access")
+          out = provision.succeed("kanidm person get testuser1")
+          assert_contains(out, "name: testuser1")
+          assert_contains(out, "displayname: Test User (changed)")
+          assert_contains(out, "legalname: Jane Doe (changed)")
+          assert_contains(out, "mail: jane.doe@example.com")
+          assert_contains(out, "mail: second.doe@example.com")
+          assert_lacks(out, "memberof: testgroup1")
+          assert_contains(out, "memberof: service1-access")
 
-            out = provision.succeed("kanidm person get testuser2")
-            assert_contains(out, "name: testuser2")
-            assert_contains(out, "displayname: Powerful Test User (changed)")
-            assert_lacks(out, "legalname: Ryouiki Tenkai (changed)")
-            assert_contains(out, "memberof: service1-admin")
-            assert_lacks(out, "mail:")
+          out = provision.succeed("kanidm person get testuser2")
+          assert_contains(out, "name: testuser2")
+          assert_contains(out, "displayname: Powerful Test User (changed)")
+          assert_contains(out, "legalname: Ryouiki Tenkai (changed)")
+          assert_contains(out, "memberof: service1-admin")
+          assert_lacks(out, "mail:")
 
-            out = provision.succeed("kanidm group get service1-access")
-            assert_contains(out, "name: service1-access")
+          out = provision.succeed("kanidm group get service1-access")
+          assert_contains(out, "name: service1-access")
 
-            out = provision.succeed("kanidm group get service1-admin")
-            assert_contains(out, "name: service1-admin")
+          out = provision.succeed("kanidm group get service1-admin")
+          assert_contains(out, "name: service1-admin")
 
-            out = provision.succeed("kanidm system oauth2 get service1")
-            assert_contains(out, "name: service1")
-            assert_contains(out, "displayname: Service One (changed)")
-            assert_contains(out, "oauth2_rs_origin: https://changed-one.example.com/")
-            assert_lacks(out, "oauth2_rs_origin: https://changed-one.example.org/")
-            assert_contains(out, "oauth2_rs_origin_landing: https://changed-one.example.com/landing")
-            assert_lacks(out, "oauth2_rs_scope_map")
-            assert_lacks(out, "oauth2_rs_sup_scope_map")
-            assert_lacks(out, "oauth2_rs_claim_map")
+          out = provision.succeed("kanidm system oauth2 get service1")
+          assert_contains(out, "name: service1")
+          assert_contains(out, "displayname: Service One (changed)")
+          assert_contains(out, "oauth2_rs_origin: https://changed-one.example.com/")
+          assert_contains(out, "oauth2_rs_origin: https://changed-one.example.org/")
+          assert_contains(out, "oauth2_rs_origin_landing: https://changed-one.example.com/landing")
+          assert_matches(out, 'oauth2_rs_scope_map: service1-access.*{"email", "openid"}')
+          assert_matches(out, 'oauth2_rs_sup_scope_map: service1-admin.*{"adminchanged"}')
+          assert_matches(out, 'oauth2_rs_claim_map: groups:.*"adminchanged"')
 
-            out = provision.succeed("kanidm system oauth2 show-basic-secret service1")
-            assert_contains(out, "changed-very-strong-secret-for-service1")
+          out = provision.succeed("kanidm system oauth2 show-basic-secret service1")
+          assert_contains(out, "changed-very-strong-secret-for-service1")
 
-            out = provision.succeed("kanidm system oauth2 get service2")
-            assert_contains(out, "name: service2")
-            assert_contains(out, "displayname: Service Two (changed)")
-            assert_contains(out, "oauth2_rs_origin: https://changed-two.example.com/")
-            assert_contains(out, "oauth2_rs_origin_landing: https://changed-landing2.example.com/")
-            assert_lacks(out, "oauth2_allow_insecure_client_disable_pkce: true")
-            assert_lacks(out, "oauth2_prefer_short_username: true")
+          out = provision.succeed("kanidm system oauth2 get service2")
+          assert_contains(out, "name: service2")
+          assert_contains(out, "displayname: Service Two (changed)")
+          assert_contains(out, "oauth2_rs_origin: https://changed-two.example.com/")
+          assert_contains(out, "oauth2_rs_origin_landing: https://changed-landing2.example.com/")
+          assert_lacks(out, "oauth2_allow_insecure_client_disable_pkce: true")
+          assert_lacks(out, "oauth2_prefer_short_username: true")
 
-            provision.succeed("kanidm logout -D idm_admin")
+          provision.succeed("kanidm logout -D idm_admin")
 
-        with subtest("Test Provisioning - removeEntities"):
-            provision.succeed('${specialisations}/removeEntities/bin/switch-to-configuration test')
-            provision_login("${provisionIdmAdminPassword}")
+      with subtest("Test Provisioning - removeAttributes"):
+          provision.succeed('${specialisations}/removeAttributes/bin/switch-to-configuration test')
+          provision_login("${provisionIdmAdminPassword}")
 
-            out = provision.succeed("kanidm group get testgroup1")
-            assert_lacks(out, "name: testgroup1")
+          out = provision.succeed("kanidm group get testgroup1")
+          assert_lacks(out, "name: testgroup1")
 
-            out = provision.succeed("kanidm group get supergroup1")
-            assert_lacks(out, "name: supergroup1")
+          out = provision.succeed("kanidm group get supergroup1")
+          assert_contains(out, "name: supergroup1")
+          assert_lacks(out, "member: testgroup1")
 
-            out = provision.succeed("kanidm person get testuser1")
-            assert_lacks(out, "name: testuser1")
+          out = provision.succeed("kanidm person get testuser1")
+          assert_contains(out, "name: testuser1")
+          assert_contains(out, "displayname: Test User (changed)")
+          assert_lacks(out, "legalname: Jane Doe (changed)")
+          assert_lacks(out, "mail: jane.doe@example.com")
+          assert_lacks(out, "mail: second.doe@example.com")
+          assert_lacks(out, "memberof: testgroup1")
+          assert_lacks(out, "memberof: service1-access")
 
-            out = provision.succeed("kanidm person get testuser2")
-            assert_lacks(out, "name: testuser2")
+          out = provision.succeed("kanidm person get testuser2")
+          assert_contains(out, "name: testuser2")
+          assert_contains(out, "displayname: Powerful Test User (changed)")
+          assert_lacks(out, "legalname: Ryouiki Tenkai (changed)")
+          assert_contains(out, "memberof: service1-admin")
+          assert_lacks(out, "mail:")
 
-            out = provision.succeed("kanidm group get service1-access")
-            assert_lacks(out, "name: service1-access")
+          out = provision.succeed("kanidm group get service1-access")
+          assert_contains(out, "name: service1-access")
 
-            out = provision.succeed("kanidm group get service1-admin")
-            assert_lacks(out, "name: service1-admin")
+          out = provision.succeed("kanidm group get service1-admin")
+          assert_contains(out, "name: service1-admin")
 
-            out = provision.succeed("kanidm system oauth2 get service1")
-            assert_lacks(out, "name: service1")
+          out = provision.succeed("kanidm system oauth2 get service1")
+          assert_contains(out, "name: service1")
+          assert_contains(out, "displayname: Service One (changed)")
+          assert_contains(out, "oauth2_rs_origin: https://changed-one.example.com/")
+          assert_lacks(out, "oauth2_rs_origin: https://changed-one.example.org/")
+          assert_contains(out, "oauth2_rs_origin_landing: https://changed-one.example.com/landing")
+          assert_lacks(out, "oauth2_rs_scope_map")
+          assert_lacks(out, "oauth2_rs_sup_scope_map")
+          assert_lacks(out, "oauth2_rs_claim_map")
 
-            out = provision.succeed("kanidm system oauth2 get service2")
-            assert_lacks(out, "name: service2")
+          out = provision.succeed("kanidm system oauth2 show-basic-secret service1")
+          assert_contains(out, "changed-very-strong-secret-for-service1")
 
-            provision.succeed("kanidm logout -D idm_admin")
-      '';
-  }
-)
+          out = provision.succeed("kanidm system oauth2 get service2")
+          assert_contains(out, "name: service2")
+          assert_contains(out, "displayname: Service Two (changed)")
+          assert_contains(out, "oauth2_rs_origin: https://changed-two.example.com/")
+          assert_contains(out, "oauth2_rs_origin_landing: https://changed-landing2.example.com/")
+          assert_lacks(out, "oauth2_allow_insecure_client_disable_pkce: true")
+          assert_lacks(out, "oauth2_prefer_short_username: true")
+
+          provision.succeed("kanidm logout -D idm_admin")
+
+      with subtest("Test Provisioning - removeEntities"):
+          provision.succeed('${specialisations}/removeEntities/bin/switch-to-configuration test')
+          provision_login("${provisionIdmAdminPassword}")
+
+          out = provision.succeed("kanidm group get testgroup1")
+          assert_lacks(out, "name: testgroup1")
+
+          out = provision.succeed("kanidm group get supergroup1")
+          assert_lacks(out, "name: supergroup1")
+
+          out = provision.succeed("kanidm person get testuser1")
+          assert_lacks(out, "name: testuser1")
+
+          out = provision.succeed("kanidm person get testuser2")
+          assert_lacks(out, "name: testuser2")
+
+          out = provision.succeed("kanidm group get service1-access")
+          assert_lacks(out, "name: service1-access")
+
+          out = provision.succeed("kanidm group get service1-admin")
+          assert_lacks(out, "name: service1-admin")
+
+          out = provision.succeed("kanidm system oauth2 get service1")
+          assert_lacks(out, "name: service1")
+
+          out = provision.succeed("kanidm system oauth2 get service2")
+          assert_lacks(out, "name: service2")
+
+          provision.succeed("kanidm logout -D idm_admin")
+
+      with subtest("Test Provisioning - extraJsonFile"):
+          provision.succeed('${specialisations}/extraJsonFile/bin/switch-to-configuration test')
+          provision_login("${provisionIdmAdminPassword}")
+
+          out = provision.succeed("kanidm group get testgroup1")
+          assert_contains(out, "name: testgroup1")
+
+          out = provision.succeed("kanidm person get testuser1")
+          assert_contains(out, "name: testuser1")
+
+          out = provision.succeed("kanidm person get testuser2")
+          assert_contains(out, "name: testuser2")
+
+          out = provision.succeed("kanidm group get testgroup1")
+          assert_contains(out, "member: testuser1")
+          assert_contains(out, "member: testuser2")
+
+          provision.succeed("kanidm logout -D idm_admin")
+    '';
+}
diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix
index 69dac0de6865..f2f4981da276 100644
--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@@ -1,154 +1,152 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    certs = import ./common/acme/server/snakeoil-certs.nix;
-    serverDomain = certs.domain;
+{ pkgs, ... }:
+let
+  certs = import ./common/acme/server/snakeoil-certs.nix;
+  serverDomain = certs.domain;
 
-    testCredentials = {
-      password = "Password1_cZPEwpCWvrReripJmAZdmVIZd8HHoHcl";
+  testCredentials = {
+    password = "Password1_cZPEwpCWvrReripJmAZdmVIZd8HHoHcl";
+  };
+
+  # copy certs to store to work around mount namespacing
+  certsPath = pkgs.runCommandNoCC "snakeoil-certs" { } ''
+    mkdir $out
+    cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
+    cp ${certs."${serverDomain}".key} $out/snakeoil.key
+  '';
+in
+{
+  name = "kanidm";
+  meta.maintainers = with pkgs.lib.maintainers; [
+    Flakebi
+    oddlama
+  ];
+
+  nodes.server =
+    { pkgs, ... }:
+    {
+      services.kanidm = {
+        package = pkgs.kanidm_1_6;
+        enableServer = true;
+        serverSettings = {
+          origin = "https://${serverDomain}";
+          domain = serverDomain;
+          bindaddress = "[::]:443";
+          ldapbindaddress = "[::1]:636";
+          tls_chain = "${certsPath}/snakeoil.crt";
+          tls_key = "${certsPath}/snakeoil.key";
+        };
+      };
+
+      security.pki.certificateFiles = [ certs.ca.cert ];
+
+      networking.hosts."::1" = [ serverDomain ];
+      networking.firewall.allowedTCPPorts = [ 443 ];
+
+      users.users.kanidm.shell = pkgs.bashInteractive;
+
+      environment.systemPackages = with pkgs; [
+        kanidm
+        openldap
+        ripgrep
+      ];
     };
 
-    # copy certs to store to work around mount namespacing
-    certsPath = pkgs.runCommandNoCC "snakeoil-certs" { } ''
-      mkdir $out
-      cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
-      cp ${certs."${serverDomain}".key} $out/snakeoil.key
+  nodes.client =
+    { nodes, ... }:
+    {
+      services.kanidm = {
+        package = pkgs.kanidm_1_6;
+        enableClient = true;
+        clientSettings = {
+          uri = "https://${serverDomain}";
+          verify_ca = true;
+          verify_hostnames = true;
+        };
+        enablePam = true;
+        unixSettings = {
+          pam_allowed_login_groups = [ "shell" ];
+        };
+      };
+
+      networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ serverDomain ];
+
+      security.pki.certificateFiles = [ certs.ca.cert ];
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      ldapBaseDN = builtins.concatStringsSep "," (
+        map (s: "dc=" + s) (pkgs.lib.splitString "." serverDomain)
+      );
+
+      # We need access to the config file in the test script.
+      filteredConfig = pkgs.lib.converge (pkgs.lib.filterAttrsRecursive (
+        _: v: v != null
+      )) nodes.server.services.kanidm.serverSettings;
+      serverConfigFile = (pkgs.formats.toml { }).generate "server.toml" filteredConfig;
+    in
+    ''
+      server.start()
+      client.start()
+      server.wait_for_unit("kanidm.service")
+      client.systemctl("start network-online.target")
+      client.wait_for_unit("network-online.target")
+
+      with subtest("Test HTTP interface"):
+          server.wait_until_succeeds("curl -Lsf https://${serverDomain} | grep Kanidm")
+
+      with subtest("Test LDAP interface"):
+          server.succeed("ldapsearch -H ldaps://${serverDomain}:636 -b '${ldapBaseDN}' -x '(name=test)'")
+
+      with subtest("Recover idm_admin account"):
+          idm_admin_password = server.succeed("su - kanidm -c 'kanidmd recover-account -c ${serverConfigFile} idm_admin 2>&1 | rg -o \'[A-Za-z0-9]{48}\' '").strip().removeprefix("'").removesuffix("'")
+
+      with subtest("Test CLI login"):
+          client.wait_until_tty_matches("1", "login: ")
+          client.send_chars("root\n")
+          client.send_chars("kanidm login -D idm_admin\n")
+          client.wait_until_tty_matches("1", "Enter password: ")
+          client.send_chars(f"{idm_admin_password}\n")
+          client.wait_until_tty_matches("1", "Login Success for idm_admin")
+
+      with subtest("Test unixd connection"):
+          client.wait_for_unit("kanidm-unixd.service")
+          client.wait_for_file("/run/kanidm-unixd/sock")
+          client.wait_until_succeeds("kanidm-unix status | grep online")
+
+      with subtest("Test user creation"):
+          client.wait_for_unit("getty@tty1.service")
+          client.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+          client.succeed("kanidm person create testuser TestUser")
+          client.succeed("kanidm person posix set --shell \"$SHELL\" testuser")
+          client.send_chars("kanidm person posix set-password testuser\n")
+          client.wait_until_tty_matches("1", "Enter new")
+          client.send_chars("${testCredentials.password}\n")
+          client.wait_until_tty_matches("1", "Reenter")
+          client.send_chars("${testCredentials.password}\n")
+          output = client.succeed("getent passwd testuser")
+          assert "TestUser" in output
+          client.succeed("kanidm group create shell")
+          client.succeed("kanidm group posix set shell")
+          client.succeed("kanidm group add-members shell testuser")
+
+      with subtest("Test user login"):
+          client.send_key("alt-f2")
+          client.wait_until_succeeds("[ $(fgconsole) = 2 ]")
+          client.wait_for_unit("getty@tty2.service")
+          client.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
+          client.wait_until_tty_matches("2", "login: ")
+          client.send_chars("testuser\n")
+          client.wait_until_tty_matches("2", "login: testuser")
+          client.wait_until_succeeds("pgrep login")
+          client.wait_until_tty_matches("2", "Password: ")
+          client.send_chars("${testCredentials.password}\n")
+          client.wait_until_succeeds("systemctl is-active user@$(id -u testuser).service")
+          client.send_chars("touch done\n")
+          client.wait_for_file("/home/testuser@${serverDomain}/done")
+
+      server.shutdown()
+      client.shutdown()
     '';
-  in
-  {
-    name = "kanidm";
-    meta.maintainers = with pkgs.lib.maintainers; [
-      Flakebi
-      oddlama
-    ];
-
-    nodes.server =
-      { pkgs, ... }:
-      {
-        services.kanidm = {
-          package = pkgs.kanidm_1_6;
-          enableServer = true;
-          serverSettings = {
-            origin = "https://${serverDomain}";
-            domain = serverDomain;
-            bindaddress = "[::]:443";
-            ldapbindaddress = "[::1]:636";
-            tls_chain = "${certsPath}/snakeoil.crt";
-            tls_key = "${certsPath}/snakeoil.key";
-          };
-        };
-
-        security.pki.certificateFiles = [ certs.ca.cert ];
-
-        networking.hosts."::1" = [ serverDomain ];
-        networking.firewall.allowedTCPPorts = [ 443 ];
-
-        users.users.kanidm.shell = pkgs.bashInteractive;
-
-        environment.systemPackages = with pkgs; [
-          kanidm
-          openldap
-          ripgrep
-        ];
-      };
-
-    nodes.client =
-      { nodes, ... }:
-      {
-        services.kanidm = {
-          package = pkgs.kanidm_1_6;
-          enableClient = true;
-          clientSettings = {
-            uri = "https://${serverDomain}";
-            verify_ca = true;
-            verify_hostnames = true;
-          };
-          enablePam = true;
-          unixSettings = {
-            pam_allowed_login_groups = [ "shell" ];
-          };
-        };
-
-        networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ serverDomain ];
-
-        security.pki.certificateFiles = [ certs.ca.cert ];
-      };
-
-    testScript =
-      { nodes, ... }:
-      let
-        ldapBaseDN = builtins.concatStringsSep "," (
-          map (s: "dc=" + s) (pkgs.lib.splitString "." serverDomain)
-        );
-
-        # We need access to the config file in the test script.
-        filteredConfig = pkgs.lib.converge (pkgs.lib.filterAttrsRecursive (
-          _: v: v != null
-        )) nodes.server.services.kanidm.serverSettings;
-        serverConfigFile = (pkgs.formats.toml { }).generate "server.toml" filteredConfig;
-      in
-      ''
-        server.start()
-        client.start()
-        server.wait_for_unit("kanidm.service")
-        client.systemctl("start network-online.target")
-        client.wait_for_unit("network-online.target")
-
-        with subtest("Test HTTP interface"):
-            server.wait_until_succeeds("curl -Lsf https://${serverDomain} | grep Kanidm")
-
-        with subtest("Test LDAP interface"):
-            server.succeed("ldapsearch -H ldaps://${serverDomain}:636 -b '${ldapBaseDN}' -x '(name=test)'")
-
-        with subtest("Recover idm_admin account"):
-            idm_admin_password = server.succeed("su - kanidm -c 'kanidmd recover-account -c ${serverConfigFile} idm_admin 2>&1 | rg -o \'[A-Za-z0-9]{48}\' '").strip().removeprefix("'").removesuffix("'")
-
-        with subtest("Test CLI login"):
-            client.wait_until_tty_matches("1", "login: ")
-            client.send_chars("root\n")
-            client.send_chars("kanidm login -D idm_admin\n")
-            client.wait_until_tty_matches("1", "Enter password: ")
-            client.send_chars(f"{idm_admin_password}\n")
-            client.wait_until_tty_matches("1", "Login Success for idm_admin")
-
-        with subtest("Test unixd connection"):
-            client.wait_for_unit("kanidm-unixd.service")
-            client.wait_for_file("/run/kanidm-unixd/sock")
-            client.wait_until_succeeds("kanidm-unix status | grep online")
-
-        with subtest("Test user creation"):
-            client.wait_for_unit("getty@tty1.service")
-            client.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
-            client.succeed("kanidm person create testuser TestUser")
-            client.succeed("kanidm person posix set --shell \"$SHELL\" testuser")
-            client.send_chars("kanidm person posix set-password testuser\n")
-            client.wait_until_tty_matches("1", "Enter new")
-            client.send_chars("${testCredentials.password}\n")
-            client.wait_until_tty_matches("1", "Reenter")
-            client.send_chars("${testCredentials.password}\n")
-            output = client.succeed("getent passwd testuser")
-            assert "TestUser" in output
-            client.succeed("kanidm group create shell")
-            client.succeed("kanidm group posix set shell")
-            client.succeed("kanidm group add-members shell testuser")
-
-        with subtest("Test user login"):
-            client.send_key("alt-f2")
-            client.wait_until_succeeds("[ $(fgconsole) = 2 ]")
-            client.wait_for_unit("getty@tty2.service")
-            client.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
-            client.wait_until_tty_matches("2", "login: ")
-            client.send_chars("testuser\n")
-            client.wait_until_tty_matches("2", "login: testuser")
-            client.wait_until_succeeds("pgrep login")
-            client.wait_until_tty_matches("2", "Password: ")
-            client.send_chars("${testCredentials.password}\n")
-            client.wait_until_succeeds("systemctl is-active user@$(id -u testuser).service")
-            client.send_chars("touch done\n")
-            client.wait_for_file("/home/testuser@${serverDomain}/done")
-
-        server.shutdown()
-        client.shutdown()
-      '';
-  }
-)
+}
diff --git a/nixos/tests/karma.nix b/nixos/tests/karma.nix
index 2e80aa97fbb5..7d21d99bc505 100644
--- a/nixos/tests/karma.nix
+++ b/nixos/tests/karma.nix
@@ -1,89 +1,87 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "karma";
-    nodes = {
-      server =
-        { ... }:
-        {
-          services.prometheus.alertmanager = {
-            enable = true;
-            logLevel = "debug";
-            port = 9093;
-            openFirewall = true;
-            configuration = {
-              global = {
-                resolve_timeout = "1m";
-              };
-              route = {
-                # Root route node
-                receiver = "test";
-                group_by = [ "..." ];
-                continue = false;
-                group_wait = "1s";
-                group_interval = "15s";
-                repeat_interval = "24h";
-              };
-              receivers = [
+{ lib, pkgs, ... }:
+{
+  name = "karma";
+  nodes = {
+    server =
+      { ... }:
+      {
+        services.prometheus.alertmanager = {
+          enable = true;
+          logLevel = "debug";
+          port = 9093;
+          openFirewall = true;
+          configuration = {
+            global = {
+              resolve_timeout = "1m";
+            };
+            route = {
+              # Root route node
+              receiver = "test";
+              group_by = [ "..." ];
+              continue = false;
+              group_wait = "1s";
+              group_interval = "15s";
+              repeat_interval = "24h";
+            };
+            receivers = [
+              {
+                name = "test";
+                webhook_configs = [
+                  {
+                    url = "http://localhost:1234";
+                    send_resolved = true;
+                    max_alerts = 0;
+                  }
+                ];
+              }
+            ];
+          };
+        };
+        services.karma = {
+          enable = true;
+          openFirewall = true;
+          settings = {
+            listen = {
+              address = "0.0.0.0";
+              port = 8081;
+            };
+            alertmanager = {
+              servers = [
                 {
-                  name = "test";
-                  webhook_configs = [
-                    {
-                      url = "http://localhost:1234";
-                      send_resolved = true;
-                      max_alerts = 0;
-                    }
-                  ];
+                  name = "alertmanager";
+                  uri = "https://127.0.0.1:9093";
                 }
               ];
             };
-          };
-          services.karma = {
-            enable = true;
-            openFirewall = true;
-            settings = {
-              listen = {
-                address = "0.0.0.0";
-                port = 8081;
-              };
-              alertmanager = {
-                servers = [
-                  {
-                    name = "alertmanager";
-                    uri = "https://127.0.0.1:9093";
-                  }
-                ];
-              };
-              karma.name = "test-dashboard";
-              log.config = true;
-              log.requests = true;
-              log.timestamp = true;
-            };
+            karma.name = "test-dashboard";
+            log.config = true;
+            log.requests = true;
+            log.timestamp = true;
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      with subtest("Wait for server to come up"):
+    with subtest("Wait for server to come up"):
 
-        server.wait_for_unit("alertmanager.service")
-        server.wait_for_unit("karma.service")
+      server.wait_for_unit("alertmanager.service")
+      server.wait_for_unit("karma.service")
 
-        server.sleep(5) # wait for both services to settle
+      server.sleep(5) # wait for both services to settle
 
-        server.wait_for_open_port(9093)
-        server.wait_for_open_port(8081)
+      server.wait_for_open_port(9093)
+      server.wait_for_open_port(8081)
 
-      with subtest("Test alertmanager readiness"):
-        server.succeed("curl -s http://127.0.0.1:9093/-/ready")
+    with subtest("Test alertmanager readiness"):
+      server.succeed("curl -s http://127.0.0.1:9093/-/ready")
 
-        # Karma only starts serving the dashboard once it has established connectivity to all alertmanagers in its config
-        # Therefore, this will fail if karma isn't able to reach alertmanager
-        server.succeed("curl -s http://127.0.0.1:8081")
+      # Karma only starts serving the dashboard once it has established connectivity to all alertmanagers in its config
+      # Therefore, this will fail if karma isn't able to reach alertmanager
+      server.succeed("curl -s http://127.0.0.1:8081")
 
-      server.shutdown()
-    '';
-  }
-)
+    server.shutdown()
+  '';
+}
diff --git a/nixos/tests/kavita.nix b/nixos/tests/kavita.nix
index f9f51ebb80f8..6749c98f4d83 100644
--- a/nixos/tests/kavita.nix
+++ b/nixos/tests/kavita.nix
@@ -1,47 +1,45 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "kavita";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ misterio77 ];
-    };
+{ pkgs, ... }:
+{
+  name = "kavita";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ misterio77 ];
+  };
 
-    nodes = {
-      kavita =
-        { config, pkgs, ... }:
-        {
-          services.kavita = {
-            enable = true;
-            tokenKeyFile = builtins.toFile "kavita.key" "d26ba694b455271a8872415830fb7b5c58f8da98f9ef7f58b2ca4c34bd406512";
-          };
+  nodes = {
+    kavita =
+      { config, pkgs, ... }:
+      {
+        services.kavita = {
+          enable = true;
+          tokenKeyFile = builtins.toFile "kavita.key" "d26ba694b455271a8872415830fb7b5c58f8da98f9ef7f58b2ca4c34bd406512";
         };
-    };
+      };
+  };
 
-    testScript =
-      let
-        regUrl = "http://kavita:5000/api/Account/register";
-        loginUrl = "http://kavita:5000/api/Account/login";
-        localeUrl = "http://kavita:5000/api/locale";
-      in
-      ''
-        import json
+  testScript =
+    let
+      regUrl = "http://kavita:5000/api/Account/register";
+      loginUrl = "http://kavita:5000/api/Account/login";
+      localeUrl = "http://kavita:5000/api/locale";
+    in
+    ''
+      import json
 
-        kavita.start
-        kavita.wait_for_unit("kavita.service")
+      kavita.start
+      kavita.wait_for_unit("kavita.service")
 
-        # Check that static assets are working
-        kavita.wait_until_succeeds("curl http://kavita:5000/site.webmanifest | grep Kavita")
+      # Check that static assets are working
+      kavita.wait_until_succeeds("curl http://kavita:5000/site.webmanifest | grep Kavita")
 
-        # Check that registration is working
-        kavita.succeed("""curl -fX POST ${regUrl} --json '{"username": "foo", "password": "correcthorsebatterystaple"}'""")
-        # But only for the first one
-        kavita.fail("""curl -fX POST ${regUrl} --json '{"username": "foo", "password": "correcthorsebatterystaple"}'""")
+      # Check that registration is working
+      kavita.succeed("""curl -fX POST ${regUrl} --json '{"username": "foo", "password": "correcthorsebatterystaple"}'""")
+      # But only for the first one
+      kavita.fail("""curl -fX POST ${regUrl} --json '{"username": "foo", "password": "correcthorsebatterystaple"}'""")
 
-        # Log in and retrieve token
-        session = json.loads(kavita.succeed("""curl -fX POST ${loginUrl} --json '{"username": "foo", "password": "correcthorsebatterystaple"}'"""))
-        # Check list of locales
-        locales = json.loads(kavita.succeed(f"curl -fX GET ${localeUrl} -H 'Authorization: Bearer {session['token']}'"))
-        assert len(locales) > 0, "expected a list of locales"
-      '';
-  }
-)
+      # Log in and retrieve token
+      session = json.loads(kavita.succeed("""curl -fX POST ${loginUrl} --json '{"username": "foo", "password": "correcthorsebatterystaple"}'"""))
+      # Check list of locales
+      locales = json.loads(kavita.succeed(f"curl -fX GET ${localeUrl} -H 'Authorization: Bearer {session['token']}'"))
+      assert len(locales) > 0, "expected a list of locales"
+    '';
+}
diff --git a/nixos/tests/kbd-setfont-decompress.nix b/nixos/tests/kbd-setfont-decompress.nix
index 07ecf2c8979d..a6ad57d46fd2 100644
--- a/nixos/tests/kbd-setfont-decompress.nix
+++ b/nixos/tests/kbd-setfont-decompress.nix
@@ -1,23 +1,21 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "kbd-setfont-decompress";
+{ lib, pkgs, ... }:
+{
+  name = "kbd-setfont-decompress";
 
-    meta.maintainers = with lib.maintainers; [ oxalica ];
+  meta.maintainers = with lib.maintainers; [ oxalica ];
 
-    nodes.machine = { ... }: { };
+  nodes.machine = { ... }: { };
 
-    testScript = ''
-      machine.succeed("gzip -cd ${pkgs.terminus_font}/share/consolefonts/ter-v16b.psf.gz >font.psf")
-      machine.succeed("gzip <font.psf >font.psf.gz")
-      machine.succeed("bzip2 <font.psf >font.psf.bz2")
-      machine.succeed("xz <font.psf >font.psf.xz")
-      machine.succeed("zstd <font.psf >font.psf.zst")
-      # setfont returns 0 even on error.
-      assert machine.succeed("PATH= ${pkgs.kbd}/bin/setfont font.psf.gz  2>&1") == ""
-      assert machine.succeed("PATH= ${pkgs.kbd}/bin/setfont font.psf.bz2 2>&1") == ""
-      assert machine.succeed("PATH= ${pkgs.kbd}/bin/setfont font.psf.xz  2>&1") == ""
-      assert machine.succeed("PATH= ${pkgs.kbd}/bin/setfont font.psf.zst 2>&1") == ""
-    '';
-  }
-)
+  testScript = ''
+    machine.succeed("gzip -cd ${pkgs.terminus_font}/share/consolefonts/ter-v16b.psf.gz >font.psf")
+    machine.succeed("gzip <font.psf >font.psf.gz")
+    machine.succeed("bzip2 <font.psf >font.psf.bz2")
+    machine.succeed("xz <font.psf >font.psf.xz")
+    machine.succeed("zstd <font.psf >font.psf.zst")
+    # setfont returns 0 even on error.
+    assert machine.succeed("PATH= ${pkgs.kbd}/bin/setfont font.psf.gz  2>&1") == ""
+    assert machine.succeed("PATH= ${pkgs.kbd}/bin/setfont font.psf.bz2 2>&1") == ""
+    assert machine.succeed("PATH= ${pkgs.kbd}/bin/setfont font.psf.xz  2>&1") == ""
+    assert machine.succeed("PATH= ${pkgs.kbd}/bin/setfont font.psf.zst 2>&1") == ""
+  '';
+}
diff --git a/nixos/tests/kbd-update-search-paths-patch.nix b/nixos/tests/kbd-update-search-paths-patch.nix
index da2cf99b44a6..7c1c36174f8a 100644
--- a/nixos/tests/kbd-update-search-paths-patch.nix
+++ b/nixos/tests/kbd-update-search-paths-patch.nix
@@ -1,24 +1,22 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "kbd-update-search-paths-patch";
+{ pkgs, ... }:
+{
+  name = "kbd-update-search-paths-patch";
 
-    nodes.machine =
-      { pkgs, options, ... }:
-      {
-        console = {
-          packages = options.console.packages.default ++ [ pkgs.terminus_font ];
-        };
+  nodes.machine =
+    { pkgs, options, ... }:
+    {
+      console = {
+        packages = options.console.packages.default ++ [ pkgs.terminus_font ];
       };
+    };
 
-    testScript = ''
-      command = "${pkgs.kbd}/bin/setfont ter-112n 2>&1"
-      (status, out) = machine.execute(command)
-      import re
-      pattern = re.compile(r".*Unable to find file:.*")
-      match = pattern.match(out)
-      if match:
-          raise Exception("command `{}` failed".format(command))
-    '';
-  }
-)
+  testScript = ''
+    command = "${pkgs.kbd}/bin/setfont ter-112n 2>&1"
+    (status, out) = machine.execute(command)
+    import re
+    pattern = re.compile(r".*Unable to find file:.*")
+    match = pattern.match(out)
+    if match:
+        raise Exception("command `{}` failed".format(command))
+  '';
+}
diff --git a/nixos/tests/keepalived.nix b/nixos/tests/keepalived.nix
index ba75dde8c5dc..d5ffa6e9838d 100644
--- a/nixos/tests/keepalived.nix
+++ b/nixos/tests/keepalived.nix
@@ -1,50 +1,48 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "keepalived";
-    meta.maintainers = [ lib.maintainers.raitobezarius ];
+{ pkgs, lib, ... }:
+{
+  name = "keepalived";
+  meta.maintainers = [ lib.maintainers.raitobezarius ];
 
-    nodes = {
-      node1 =
-        { pkgs, ... }:
-        {
-          services.keepalived.enable = true;
-          services.keepalived.openFirewall = true;
-          services.keepalived.vrrpInstances.test = {
-            interface = "eth1";
-            state = "MASTER";
-            priority = 50;
-            virtualIps = [ { addr = "192.168.1.200"; } ];
-            virtualRouterId = 1;
-          };
-          environment.systemPackages = [ pkgs.tcpdump ];
+  nodes = {
+    node1 =
+      { pkgs, ... }:
+      {
+        services.keepalived.enable = true;
+        services.keepalived.openFirewall = true;
+        services.keepalived.vrrpInstances.test = {
+          interface = "eth1";
+          state = "MASTER";
+          priority = 50;
+          virtualIps = [ { addr = "192.168.1.200"; } ];
+          virtualRouterId = 1;
         };
-      node2 =
-        { pkgs, ... }:
-        {
-          services.keepalived.enable = true;
-          services.keepalived.openFirewall = true;
-          services.keepalived.vrrpInstances.test = {
-            interface = "eth1";
-            state = "MASTER";
-            priority = 100;
-            virtualIps = [ { addr = "192.168.1.200"; } ];
-            virtualRouterId = 1;
-          };
-          environment.systemPackages = [ pkgs.tcpdump ];
+        environment.systemPackages = [ pkgs.tcpdump ];
+      };
+    node2 =
+      { pkgs, ... }:
+      {
+        services.keepalived.enable = true;
+        services.keepalived.openFirewall = true;
+        services.keepalived.vrrpInstances.test = {
+          interface = "eth1";
+          state = "MASTER";
+          priority = 100;
+          virtualIps = [ { addr = "192.168.1.200"; } ];
+          virtualRouterId = 1;
         };
-    };
+        environment.systemPackages = [ pkgs.tcpdump ];
+      };
+  };
 
-    testScript = ''
-      # wait for boot time delay to pass
-      for node in [node1, node2]:
-          node.wait_until_succeeds(
-              "systemctl show -p LastTriggerUSecMonotonic keepalived-boot-delay.timer | grep -vq 'LastTriggerUSecMonotonic=0'"
-          )
-          node.wait_for_unit("keepalived")
-      node2.wait_until_succeeds("ip addr show dev eth1 | grep -q 192.168.1.200")
-      node1.fail("ip addr show dev eth1 | grep -q 192.168.1.200")
-      node1.succeed("ping -c1 192.168.1.200")
-    '';
-  }
-)
+  testScript = ''
+    # wait for boot time delay to pass
+    for node in [node1, node2]:
+        node.wait_until_succeeds(
+            "systemctl show -p LastTriggerUSecMonotonic keepalived-boot-delay.timer | grep -vq 'LastTriggerUSecMonotonic=0'"
+        )
+        node.wait_for_unit("keepalived")
+    node2.wait_until_succeeds("ip addr show dev eth1 | grep -q 192.168.1.200")
+    node1.fail("ip addr show dev eth1 | grep -q 192.168.1.200")
+    node1.succeed("ping -c1 192.168.1.200")
+  '';
+}
diff --git a/nixos/tests/keepassxc.nix b/nixos/tests/keepassxc.nix
index c2d68e29b798..1cdbdb445c3d 100644
--- a/nixos/tests/keepassxc.nix
+++ b/nixos/tests/keepassxc.nix
@@ -1,94 +1,92 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "keepassxc";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ turion ];
-      timeout = 1800;
-    };
+{
+  name = "keepassxc";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ turion ];
+    timeout = 1800;
+  };
 
-    nodes.machine =
-      { ... }:
+  nodes.machine =
+    { ... }:
 
-      {
-        imports = [
-          ./common/user-account.nix
-          ./common/x11.nix
-        ];
+    {
+      imports = [
+        ./common/user-account.nix
+        ./common/x11.nix
+      ];
 
-        services.xserver.enable = true;
+      services.xserver.enable = true;
 
-        # for better OCR
-        environment.etc."icewm/prefoverride".text = ''
-          ColorActiveTitleBar = "rgb:FF/FF/FF"
-        '';
+      # for better OCR
+      environment.etc."icewm/prefoverride".text = ''
+        ColorActiveTitleBar = "rgb:FF/FF/FF"
+      '';
 
-        # Regression test for https://github.com/NixOS/nixpkgs/issues/163482
-        qt = {
-          enable = true;
-          platformTheme = "gnome";
-          style = "adwaita-dark";
-        };
-
-        test-support.displayManager.auto.user = "alice";
-        environment.systemPackages = with pkgs; [
-          keepassxc
-          xdotool
-        ];
+      # Regression test for https://github.com/NixOS/nixpkgs/issues/163482
+      qt = {
+        enable = true;
+        platformTheme = "gnome";
+        style = "adwaita-dark";
       };
 
-    enableOCR = true;
+      test-support.displayManager.auto.user = "alice";
+      environment.systemPackages = with pkgs; [
+        keepassxc
+        xdotool
+      ];
+    };
 
-    testScript =
-      { nodes, ... }:
-      let
-        aliceDo = cmd: ''machine.succeed("su - alice -c '${cmd}' >&2 &");'';
-      in
-      ''
-        with subtest("Ensure X starts"):
-            start_all()
-            machine.wait_for_x()
+  enableOCR = true;
 
-        with subtest("Can create database and entry with CLI"):
-            ${aliceDo "keepassxc-cli db-create --set-key-file foo.keyfile foo.kdbx"}
-            ${aliceDo "keepassxc-cli add --no-password -k foo.keyfile foo.kdbx bar"}
+  testScript =
+    { nodes, ... }:
+    let
+      aliceDo = cmd: ''machine.succeed("su - alice -c '${cmd}' >&2 &");'';
+    in
+    ''
+      with subtest("Ensure X starts"):
+          start_all()
+          machine.wait_for_x()
 
-        with subtest("Ensure KeePassXC starts"):
-            # start KeePassXC window
-            ${aliceDo "keepassxc >&2 &"}
+      with subtest("Can create database and entry with CLI"):
+          ${aliceDo "keepassxc-cli db-create --set-key-file foo.keyfile foo.kdbx"}
+          ${aliceDo "keepassxc-cli add --no-password -k foo.keyfile foo.kdbx bar"}
 
-            machine.wait_for_text("KeePassXC ${pkgs.keepassxc.version}")
-            machine.screenshot("KeePassXC")
+      with subtest("Ensure KeePassXC starts"):
+          # start KeePassXC window
+          ${aliceDo "keepassxc >&2 &"}
 
-        with subtest("Can open existing database"):
-            machine.send_key("ctrl-o")
-            machine.sleep(5)
-            # Regression #163482: keepassxc did not crash
-            machine.succeed("ps -e | grep keepassxc")
-            machine.wait_for_text("Open database")
-            machine.send_key("ret")
+          machine.wait_for_text("KeePassXC ${pkgs.keepassxc.version}")
+          machine.screenshot("KeePassXC")
 
-            # Wait for the enter password screen to appear.
-            machine.wait_for_text("/home/alice/foo.kdbx")
+      with subtest("Can open existing database"):
+          machine.send_key("ctrl-o")
+          machine.sleep(5)
+          # Regression #163482: keepassxc did not crash
+          machine.succeed("ps -e | grep keepassxc")
+          machine.wait_for_text("Open database")
+          machine.send_key("ret")
 
-            # Click on "I have key file" button to open keyfile dialog
-            machine.send_key("tab")
-            machine.send_key("tab")
-            machine.send_key("tab")
-            machine.send_key("ret")
+          # Wait for the enter password screen to appear.
+          machine.wait_for_text("/home/alice/foo.kdbx")
 
-            # Select keyfile
-            machine.wait_for_text("Select key file")
-            machine.send_chars("/home/alice/foo.keyfile")
-            machine.send_key("ret")
+          # Click on "I have key file" button to open keyfile dialog
+          machine.send_key("tab")
+          machine.send_key("tab")
+          machine.send_key("tab")
+          machine.send_key("ret")
 
-            # Open database
-            machine.wait_for_text("foo.kdbx \\[Locked] - KeePassXC")
-            machine.send_key("ret")
+          # Select keyfile
+          machine.wait_for_text("Select key file")
+          machine.send_chars("/home/alice/foo.keyfile")
+          machine.send_key("ret")
 
-            # Database is unlocked (doesn't have "[Locked]" in the title anymore)
-            machine.wait_for_text("foo.kdbx - KeePassXC")
-      '';
-  }
-)
+          # Open database
+          machine.wait_for_text("foo.kdbx \\[Locked] - KeePassXC")
+          machine.send_key("ret")
+
+          # Database is unlocked (doesn't have "[Locked]" in the title anymore)
+          machine.wait_for_text("foo.kdbx - KeePassXC")
+    '';
+}
diff --git a/nixos/tests/kernel-latest-ath-user-regd.nix b/nixos/tests/kernel-latest-ath-user-regd.nix
index ede82d7d340a..f60b42ac6741 100644
--- a/nixos/tests/kernel-latest-ath-user-regd.nix
+++ b/nixos/tests/kernel-latest-ath-user-regd.nix
@@ -1,20 +1,18 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "kernel-latest-ath-user-regd";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ veehaitch ];
+{ pkgs, ... }:
+{
+  name = "kernel-latest-ath-user-regd";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ veehaitch ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      boot.kernelPackages = pkgs.linuxPackages_latest;
+      networking.wireless.athUserRegulatoryDomain = true;
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        boot.kernelPackages = pkgs.linuxPackages_latest;
-        networking.wireless.athUserRegulatoryDomain = true;
-      };
-
-    testScript = ''
-      assert "CONFIG_ATH_USER_REGD=y" in machine.succeed("zcat /proc/config.gz")
-    '';
-  }
-)
+  testScript = ''
+    assert "CONFIG_ATH_USER_REGD=y" in machine.succeed("zcat /proc/config.gz")
+  '';
+}
diff --git a/nixos/tests/keter.nix b/nixos/tests/keter.nix
index d42b30d869d9..129ed25803cc 100644
--- a/nixos/tests/keter.nix
+++ b/nixos/tests/keter.nix
@@ -1,47 +1,45 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    port = 81;
-  in
-  {
-    name = "keter";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ jappie ];
-    };
+{ pkgs, ... }:
+let
+  port = 81;
+in
+{
+  name = "keter";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jappie ];
+  };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        services.keter = {
-          enable = true;
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      services.keter = {
+        enable = true;
 
-          globalKeterConfig = {
-            cli-port = 123; # just adding this to test the freeform
-            listeners = [
-              {
-                host = "*4";
-                inherit port;
-              }
-            ];
-          };
-          bundle = {
-            appName = "test-bundle";
-            domain = "localhost";
-            executable = pkgs.writeShellScript "run" ''
-              ${pkgs.python3}/bin/python -m http.server $PORT
-            '';
-          };
+        globalKeterConfig = {
+          cli-port = 123; # just adding this to test the freeform
+          listeners = [
+            {
+              host = "*4";
+              inherit port;
+            }
+          ];
+        };
+        bundle = {
+          appName = "test-bundle";
+          domain = "localhost";
+          executable = pkgs.writeShellScript "run" ''
+            ${pkgs.python3}/bin/python -m http.server $PORT
+          '';
         };
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("keter.service")
+  testScript = ''
+    machine.wait_for_unit("keter.service")
 
-      machine.wait_for_open_port(${toString port})
-      machine.wait_for_console_text("Activating app test-bundle with hosts: localhost")
+    machine.wait_for_open_port(${toString port})
+    machine.wait_for_console_text("Activating app test-bundle with hosts: localhost")
 
 
-      machine.succeed("curl --fail http://localhost:${toString port}/")
-    '';
-  }
-)
+    machine.succeed("curl --fail http://localhost:${toString port}/")
+  '';
+}
diff --git a/nixos/tests/komga.nix b/nixos/tests/komga.nix
index 22c63d8cac6b..8d3ef130a5cd 100644
--- a/nixos/tests/komga.nix
+++ b/nixos/tests/komga.nix
@@ -1,23 +1,21 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "komga";
-    meta.maintainers = with lib.maintainers; [ govanify ];
+{
+  name = "komga";
+  meta.maintainers = with lib.maintainers; [ govanify ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.komga = {
-          enable = true;
-          settings.server.port = 1234;
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.komga = {
+        enable = true;
+        settings.server.port = 1234;
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("komga.service")
-      machine.wait_for_open_port(1234)
-      machine.succeed("curl --fail http://localhost:1234/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("komga.service")
+    machine.wait_for_open_port(1234)
+    machine.succeed("curl --fail http://localhost:1234/")
+  '';
+}
diff --git a/nixos/tests/ksm.nix b/nixos/tests/ksm.nix
index 73ef3bdc8eb0..2268843268ff 100644
--- a/nixos/tests/ksm.nix
+++ b/nixos/tests/ksm.nix
@@ -1,25 +1,23 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "ksm";
-    meta = with lib.maintainers; {
-      maintainers = [ rnhmjoj ];
+{
+  name = "ksm";
+  meta = with lib.maintainers; {
+    maintainers = [ rnhmjoj ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ../modules/profiles/minimal.nix ];
+
+      hardware.ksm.enable = true;
+      hardware.ksm.sleep = 300;
     };
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ../modules/profiles/minimal.nix ];
-
-        hardware.ksm.enable = true;
-        hardware.ksm.sleep = 300;
-      };
-
-    testScript = ''
-      machine.start()
-      machine.wait_until_succeeds("test $(</sys/kernel/mm/ksm/run) -eq 1")
-      machine.wait_until_succeeds("test $(</sys/kernel/mm/ksm/sleep_millisecs) -eq 300")
-    '';
-  }
-)
+  testScript = ''
+    machine.start()
+    machine.wait_until_succeeds("test $(</sys/kernel/mm/ksm/run) -eq 1")
+    machine.wait_until_succeeds("test $(</sys/kernel/mm/ksm/sleep_millisecs) -eq 300")
+  '';
+}
diff --git a/nixos/tests/kthxbye.nix b/nixos/tests/kthxbye.nix
index ea2d77a5fc65..57f3f4b7e5c6 100644
--- a/nixos/tests/kthxbye.nix
+++ b/nixos/tests/kthxbye.nix
@@ -1,114 +1,112 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "kthxbye";
+{ lib, pkgs, ... }:
+{
+  name = "kthxbye";
 
-    meta = with lib.maintainers; {
-      maintainers = [ nukaduka ];
-    };
+  meta = with lib.maintainers; {
+    maintainers = [ nukaduka ];
+  };
 
-    nodes.server =
-      { ... }:
-      {
-        environment.systemPackages = with pkgs; [ prometheus-alertmanager ];
-        services.prometheus = {
-          enable = true;
+  nodes.server =
+    { ... }:
+    {
+      environment.systemPackages = with pkgs; [ prometheus-alertmanager ];
+      services.prometheus = {
+        enable = true;
 
-          globalConfig = {
+        globalConfig = {
+          scrape_interval = "5s";
+          scrape_timeout = "5s";
+          evaluation_interval = "5s";
+        };
+
+        scrapeConfigs = [
+          {
+            job_name = "prometheus";
             scrape_interval = "5s";
-            scrape_timeout = "5s";
-            evaluation_interval = "5s";
-          };
-
-          scrapeConfigs = [
-            {
-              job_name = "prometheus";
-              scrape_interval = "5s";
-              static_configs = [
-                {
-                  targets = [ "localhost:9090" ];
-                }
-              ];
-            }
-          ];
-
-          rules = [
-            ''
-              groups:
-                - name: test
-                  rules:
-                    - alert: node_up
-                      expr: up != 0
-                      for: 5s
-                      labels:
-                        severity: bottom of the barrel
-                      annotations:
-                        summary: node is fine
-            ''
-          ];
-
-          alertmanagers = [
-            {
-              static_configs = [
-                {
-                  targets = [
-                    "localhost:9093"
-                  ];
-                }
-              ];
-            }
-          ];
-
-          alertmanager = {
-            enable = true;
-            openFirewall = true;
-            configuration.route = {
-              receiver = "test";
-              group_wait = "5s";
-              group_interval = "5s";
-              group_by = [ "..." ];
-            };
-            configuration.receivers = [
+            static_configs = [
               {
-                name = "test";
-                webhook_configs = [
-                  {
-                    url = "http://localhost:1234";
-                  }
+                targets = [ "localhost:9090" ];
+              }
+            ];
+          }
+        ];
+
+        rules = [
+          ''
+            groups:
+              - name: test
+                rules:
+                  - alert: node_up
+                    expr: up != 0
+                    for: 5s
+                    labels:
+                      severity: bottom of the barrel
+                    annotations:
+                      summary: node is fine
+          ''
+        ];
+
+        alertmanagers = [
+          {
+            static_configs = [
+              {
+                targets = [
+                  "localhost:9093"
                 ];
               }
             ];
-          };
-        };
+          }
+        ];
 
-        services.kthxbye = {
+        alertmanager = {
           enable = true;
           openFirewall = true;
-          extendIfExpiringIn = "30s";
-          logJSON = true;
-          maxDuration = "15m";
-          interval = "5s";
+          configuration.route = {
+            receiver = "test";
+            group_wait = "5s";
+            group_interval = "5s";
+            group_by = [ "..." ];
+          };
+          configuration.receivers = [
+            {
+              name = "test";
+              webhook_configs = [
+                {
+                  url = "http://localhost:1234";
+                }
+              ];
+            }
+          ];
         };
       };
 
-    testScript = ''
-      with subtest("start the server"):
-        start_all()
-        server.wait_for_unit("prometheus.service")
-        server.wait_for_unit("alertmanager.service")
-        server.wait_for_unit("kthxbye.service")
+      services.kthxbye = {
+        enable = true;
+        openFirewall = true;
+        extendIfExpiringIn = "30s";
+        logJSON = true;
+        maxDuration = "15m";
+        interval = "5s";
+      };
+    };
 
-        server.sleep(2) # wait for units to settle
-        server.systemctl("restart kthxbye.service") # make sure kthxbye comes up after alertmanager
-        server.sleep(2)
+  testScript = ''
+    with subtest("start the server"):
+      start_all()
+      server.wait_for_unit("prometheus.service")
+      server.wait_for_unit("alertmanager.service")
+      server.wait_for_unit("kthxbye.service")
 
-      with subtest("set up test silence which expires in 20s"):
-        server.succeed('amtool --alertmanager.url "http://localhost:9093" silence add alertname="node_up" -a "nixosTest" -d "20s" -c "ACK! this server is fine!!"')
+      server.sleep(2) # wait for units to settle
+      server.systemctl("restart kthxbye.service") # make sure kthxbye comes up after alertmanager
+      server.sleep(2)
 
-      with subtest("wait for 21 seconds and check if the silence is still active"):
-        server.sleep(21)
-        server.systemctl("status kthxbye.service")
-        server.succeed("amtool --alertmanager.url 'http://localhost:9093' silence | grep 'ACK'")
-    '';
-  }
-)
+    with subtest("set up test silence which expires in 20s"):
+      server.succeed('amtool --alertmanager.url "http://localhost:9093" silence add alertname="node_up" -a "nixosTest" -d "20s" -c "ACK! this server is fine!!"')
+
+    with subtest("wait for 21 seconds and check if the silence is still active"):
+      server.sleep(21)
+      server.systemctl("status kthxbye.service")
+      server.succeed("amtool --alertmanager.url 'http://localhost:9093' silence | grep 'ACK'")
+  '';
+}
diff --git a/nixos/tests/lact.nix b/nixos/tests/lact.nix
new file mode 100644
index 000000000000..ebfda66ad11e
--- /dev/null
+++ b/nixos/tests/lact.nix
@@ -0,0 +1,18 @@
+{ pkgs, ... }:
+{
+  name = "lact";
+  meta = {
+    inherit (pkgs.lact.meta) maintainers;
+  };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      services.lact.enable = true;
+    };
+
+  testScript = ''
+    machine.wait_for_unit("lactd.service")
+    machine.wait_for_file("/run/lactd.sock")
+  '';
+}
diff --git a/nixos/tests/ladybird.nix b/nixos/tests/ladybird.nix
index c9532b4f12b8..9b7a9e51d61c 100644
--- a/nixos/tests/ladybird.nix
+++ b/nixos/tests/ladybird.nix
@@ -1,32 +1,30 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "ladybird";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fgaz ];
+{ pkgs, ... }:
+{
+  name = "ladybird";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      programs.ladybird.enable = true;
     };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  enableOCR = true;
 
-        services.xserver.enable = true;
-        programs.ladybird.enable = true;
-      };
-
-    enableOCR = true;
-
-    testScript = ''
-      machine.wait_for_x()
-      machine.succeed("echo '<!DOCTYPE html><html><body><h1>Hello world</h1></body></html>' > page.html")
-      machine.execute("Ladybird file://$(pwd)/page.html >&2 &")
-      machine.wait_for_window("Ladybird")
-      machine.sleep(5)
-      machine.wait_for_text("Hello world")
-      machine.screenshot("screen")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_x()
+    machine.succeed("echo '<!DOCTYPE html><html><body><h1>Hello world</h1></body></html>' > page.html")
+    machine.execute("Ladybird file://$(pwd)/page.html >&2 &")
+    machine.wait_for_window("Ladybird")
+    machine.sleep(5)
+    machine.wait_for_text("Hello world")
+    machine.screenshot("screen")
+  '';
+}
diff --git a/nixos/tests/languagetool.nix b/nixos/tests/languagetool.nix
index 35ab59b5d861..bbd6f3bf97c3 100644
--- a/nixos/tests/languagetool.nix
+++ b/nixos/tests/languagetool.nix
@@ -1,26 +1,24 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    port = 8082;
-  in
-  {
-    name = "languagetool";
-    meta = with lib.maintainers; {
-      maintainers = [ fbeffa ];
+{ pkgs, lib, ... }:
+let
+  port = 8082;
+in
+{
+  name = "languagetool";
+  meta = with lib.maintainers; {
+    maintainers = [ fbeffa ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      services.languagetool.enable = true;
+      services.languagetool.port = port;
     };
 
-    nodes.machine =
-      { ... }:
-      {
-        services.languagetool.enable = true;
-        services.languagetool.port = port;
-      };
-
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("languagetool.service")
-      machine.wait_for_open_port(${toString port})
-      machine.wait_until_succeeds('curl -d "language=en-US" -d "text=a simple test" http://localhost:${toString port}/v2/check')
-    '';
-  }
-)
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("languagetool.service")
+    machine.wait_for_open_port(${toString port})
+    machine.wait_until_succeeds('curl -d "language=en-US" -d "text=a simple test" http://localhost:${toString port}/v2/check')
+  '';
+}
diff --git a/nixos/tests/lanraragi.nix b/nixos/tests/lanraragi.nix
index 21a065845c64..ccc95a5e0483 100644
--- a/nixos/tests/lanraragi.nix
+++ b/nixos/tests/lanraragi.nix
@@ -1,44 +1,42 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "lanraragi";
-    meta.maintainers = with lib.maintainers; [ tomasajt ];
+{ pkgs, lib, ... }:
+{
+  name = "lanraragi";
+  meta.maintainers = with lib.maintainers; [ tomasajt ];
 
-    nodes = {
-      machine1 =
-        { pkgs, ... }:
-        {
-          services.lanraragi.enable = true;
-        };
-      machine2 =
-        { pkgs, ... }:
-        {
-          services.lanraragi = {
-            enable = true;
-            passwordFile = pkgs.writeText "lrr-test-pass" ''
-              Ultra-secure-p@ssword-"with-spec1al\chars
+  nodes = {
+    machine1 =
+      { pkgs, ... }:
+      {
+        services.lanraragi.enable = true;
+      };
+    machine2 =
+      { pkgs, ... }:
+      {
+        services.lanraragi = {
+          enable = true;
+          passwordFile = pkgs.writeText "lrr-test-pass" ''
+            Ultra-secure-p@ssword-"with-spec1al\chars
+          '';
+          port = 4000;
+          redis = {
+            port = 4001;
+            passwordFile = pkgs.writeText "redis-lrr-test-pass" ''
+              123-redis-PASS
             '';
-            port = 4000;
-            redis = {
-              port = 4001;
-              passwordFile = pkgs.writeText "redis-lrr-test-pass" ''
-                123-redis-PASS
-              '';
-            };
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine1.wait_for_unit("lanraragi.service")
-      machine1.wait_until_succeeds("curl -f localhost:3000")
-      machine1.succeed("[ $(curl -o /dev/null -X post 'http://localhost:3000/login' --data-raw 'password=kamimamita' -w '%{http_code}') -eq 302 ]")
+    machine1.wait_for_unit("lanraragi.service")
+    machine1.wait_until_succeeds("curl -f localhost:3000")
+    machine1.succeed("[ $(curl -o /dev/null -X post 'http://localhost:3000/login' --data-raw 'password=kamimamita' -w '%{http_code}') -eq 302 ]")
 
-      machine2.wait_for_unit("lanraragi.service")
-      machine2.wait_until_succeeds("curl -f localhost:4000")
-      machine2.succeed("[ $(curl -o /dev/null -X post 'http://localhost:4000/login' --data-raw 'password=Ultra-secure-p@ssword-\"with-spec1al\\chars' -w '%{http_code}') -eq 302 ]")
-    '';
-  }
-)
+    machine2.wait_for_unit("lanraragi.service")
+    machine2.wait_until_succeeds("curl -f localhost:4000")
+    machine2.succeed("[ $(curl -o /dev/null -X post 'http://localhost:4000/login' --data-raw 'password=Ultra-secure-p@ssword-\"with-spec1al\\chars' -w '%{http_code}') -eq 302 ]")
+  '';
+}
diff --git a/nixos/tests/eintopf.nix b/nixos/tests/lauti.nix
similarity index 100%
rename from nixos/tests/eintopf.nix
rename to nixos/tests/lauti.nix
diff --git a/nixos/tests/leaps.nix b/nixos/tests/leaps.nix
index 92847d83eaeb..dd26ca181a5a 100644
--- a/nixos/tests/leaps.nix
+++ b/nixos/tests/leaps.nix
@@ -1,32 +1,30 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "leaps";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ qknight ];
-    };
+{
+  name = "leaps";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ qknight ];
+  };
 
-    nodes = {
-      client = { };
+  nodes = {
+    client = { };
 
-      server = {
-        services.leaps = {
-          enable = true;
-          port = 6666;
-          path = "/leaps/";
-        };
-        networking.firewall.enable = false;
+    server = {
+      services.leaps = {
+        enable = true;
+        port = 6666;
+        path = "/leaps/";
       };
+      networking.firewall.enable = false;
     };
+  };
 
-    testScript = ''
-      start_all()
-      server.wait_for_open_port(6666)
-      client.wait_for_unit("network.target")
-      assert "leaps" in client.succeed(
-          "${pkgs.curl}/bin/curl -f http://server:6666/leaps/"
-      )
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    server.wait_for_open_port(6666)
+    client.wait_for_unit("network.target")
+    assert "leaps" in client.succeed(
+        "${pkgs.curl}/bin/curl -f http://server:6666/leaps/"
+    )
+  '';
+}
diff --git a/nixos/tests/legit.nix b/nixos/tests/legit.nix
index 405c69a52fad..d107e74fedd9 100644
--- a/nixos/tests/legit.nix
+++ b/nixos/tests/legit.nix
@@ -1,59 +1,57 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    port = 5000;
-    scanPath = "/var/lib/legit";
-  in
-  {
-    name = "legit-web";
-    meta.maintainers = [ lib.maintainers.ratsclub ];
+{ lib, pkgs, ... }:
+let
+  port = 5000;
+  scanPath = "/var/lib/legit";
+in
+{
+  name = "legit-web";
+  meta.maintainers = [ lib.maintainers.ratsclub ];
 
-    nodes = {
-      server =
-        { config, pkgs, ... }:
-        {
-          services.legit = {
-            enable = true;
-            settings = {
-              server.port = 5000;
-              repo = { inherit scanPath; };
-            };
+  nodes = {
+    server =
+      { config, pkgs, ... }:
+      {
+        services.legit = {
+          enable = true;
+          settings = {
+            server.port = 5000;
+            repo = { inherit scanPath; };
           };
-
-          environment.systemPackages = [ pkgs.git ];
         };
-    };
 
-    testScript =
-      { nodes, ... }:
-      let
-        strPort = builtins.toString port;
-      in
-      ''
-        start_all()
+        environment.systemPackages = [ pkgs.git ];
+      };
+  };
 
-        server.wait_for_unit("network.target")
-        server.wait_for_unit("legit.service")
+  testScript =
+    { nodes, ... }:
+    let
+      strPort = builtins.toString port;
+    in
+    ''
+      start_all()
 
-        server.wait_until_succeeds(
-            "curl -f http://localhost:${strPort}"
-        )
+      server.wait_for_unit("network.target")
+      server.wait_for_unit("legit.service")
 
-        server.succeed("${pkgs.writeShellScript "setup-legit-test-repo" ''
-          set -e
-          git init --bare -b master ${scanPath}/some-repo
-          git init -b master reference
-          cd reference
-          git remote add origin ${scanPath}/some-repo
-          date > date.txt
-          git add date.txt
-          git -c user.name=test -c user.email=test@localhost commit -m 'add date'
-          git push -u origin master
-        ''}")
+      server.wait_until_succeeds(
+          "curl -f http://localhost:${strPort}"
+      )
 
-        server.wait_until_succeeds(
-            "curl -f http://localhost:${strPort}/some-repo"
-        )
-      '';
-  }
-)
+      server.succeed("${pkgs.writeShellScript "setup-legit-test-repo" ''
+        set -e
+        git init --bare -b master ${scanPath}/some-repo
+        git init -b master reference
+        cd reference
+        git remote add origin ${scanPath}/some-repo
+        date > date.txt
+        git add date.txt
+        git -c user.name=test -c user.email=test@localhost commit -m 'add date'
+        git push -u origin master
+      ''}")
+
+      server.wait_until_succeeds(
+          "curl -f http://localhost:${strPort}/some-repo"
+      )
+    '';
+}
diff --git a/nixos/tests/lemmy.nix b/nixos/tests/lemmy.nix
index 5dc8cf107316..31eef526f29c 100644
--- a/nixos/tests/lemmy.nix
+++ b/nixos/tests/lemmy.nix
@@ -1,104 +1,102 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    uiPort = 1234;
-    backendPort = 5678;
-    lemmyNodeName = "server";
-  in
-  {
-    name = "lemmy";
-    meta = with lib.maintainers; {
-      maintainers = [ mightyiam ];
-    };
+{ pkgs, lib, ... }:
+let
+  uiPort = 1234;
+  backendPort = 5678;
+  lemmyNodeName = "server";
+in
+{
+  name = "lemmy";
+  meta = with lib.maintainers; {
+    maintainers = [ mightyiam ];
+  };
 
-    nodes = {
-      client = { };
+  nodes = {
+    client = { };
 
-      "${lemmyNodeName}" = {
-        services.lemmy = {
-          enable = true;
-          ui.port = uiPort;
-          database.createLocally = true;
-          settings = {
-            hostname = "http://${lemmyNodeName}";
-            port = backendPort;
-            # Without setup, the /feeds/* and /nodeinfo/* API endpoints won't return 200
-            setup = {
-              admin_username = "mightyiam";
-              site_name = "Lemmy FTW";
-              admin_email = "mightyiam@example.com";
-            };
+    "${lemmyNodeName}" = {
+      services.lemmy = {
+        enable = true;
+        ui.port = uiPort;
+        database.createLocally = true;
+        settings = {
+          hostname = "http://${lemmyNodeName}";
+          port = backendPort;
+          # Without setup, the /feeds/* and /nodeinfo/* API endpoints won't return 200
+          setup = {
+            admin_username = "mightyiam";
+            site_name = "Lemmy FTW";
+            admin_email = "mightyiam@example.com";
           };
-          adminPasswordFile = /etc/lemmy-admin-password.txt;
-          caddy.enable = true;
         };
-
-        environment.etc."lemmy-admin-password.txt".text = "ThisIsWhatIUseEverywhereTryIt";
-
-        networking.firewall.allowedTCPPorts = [ 80 ];
-
-        # pict-rs seems to need more than 1025114112 bytes
-        virtualisation.memorySize = 2000;
+        adminPasswordFile = /etc/lemmy-admin-password.txt;
+        caddy.enable = true;
       };
+
+      environment.etc."lemmy-admin-password.txt".text = "ThisIsWhatIUseEverywhereTryIt";
+
+      networking.firewall.allowedTCPPorts = [ 80 ];
+
+      # pict-rs seems to need more than 1025114112 bytes
+      virtualisation.memorySize = 2000;
     };
+  };
 
-    testScript = ''
-      server = ${lemmyNodeName}
+  testScript = ''
+    server = ${lemmyNodeName}
 
-      with subtest("the merged config is secure"):
-          server.wait_for_unit("lemmy.service")
-          config_permissions = server.succeed("stat --format %A /run/lemmy/config.hjson").rstrip()
-          assert config_permissions == "-rw-------", f"merged config permissions {config_permissions} are insecure"
-          directory_permissions = server.succeed("stat --format %A /run/lemmy").rstrip()
-          assert directory_permissions[5] == directory_permissions[8] == "-", "merged config can be replaced"
+    with subtest("the merged config is secure"):
+        server.wait_for_unit("lemmy.service")
+        config_permissions = server.succeed("stat --format %A /run/lemmy/config.hjson").rstrip()
+        assert config_permissions == "-rw-------", f"merged config permissions {config_permissions} are insecure"
+        directory_permissions = server.succeed("stat --format %A /run/lemmy").rstrip()
+        assert directory_permissions[5] == directory_permissions[8] == "-", "merged config can be replaced"
 
-      with subtest("the backend starts and responds"):
-          server.wait_for_open_port(${toString backendPort})
-          # wait until succeeds, it just needs few seconds for migrations, but lets give it 50s max
-          server.wait_until_succeeds("curl --fail localhost:${toString backendPort}/api/v3/site", 50)
+    with subtest("the backend starts and responds"):
+        server.wait_for_open_port(${toString backendPort})
+        # wait until succeeds, it just needs few seconds for migrations, but lets give it 50s max
+        server.wait_until_succeeds("curl --fail localhost:${toString backendPort}/api/v3/site", 50)
 
-      with subtest("the UI starts and responds"):
-          server.wait_for_unit("lemmy-ui.service")
-          server.wait_for_open_port(${toString uiPort})
-          server.succeed("curl --fail localhost:${toString uiPort}")
+    with subtest("the UI starts and responds"):
+        server.wait_for_unit("lemmy-ui.service")
+        server.wait_for_open_port(${toString uiPort})
+        server.succeed("curl --fail localhost:${toString uiPort}")
 
-      with subtest("Lemmy-UI responds through the caddy reverse proxy"):
-          server.systemctl("start network-online.target")
-          server.wait_for_unit("network-online.target")
-          server.wait_for_unit("caddy.service")
-          server.wait_for_open_port(80)
-          body = server.execute("curl --fail --location ${lemmyNodeName}")[1]
-          assert "Lemmy" in body, f"String Lemmy not found in response for ${lemmyNodeName}: \n{body}"
+    with subtest("Lemmy-UI responds through the caddy reverse proxy"):
+        server.systemctl("start network-online.target")
+        server.wait_for_unit("network-online.target")
+        server.wait_for_unit("caddy.service")
+        server.wait_for_open_port(80)
+        body = server.execute("curl --fail --location ${lemmyNodeName}")[1]
+        assert "Lemmy" in body, f"String Lemmy not found in response for ${lemmyNodeName}: \n{body}"
 
-      with subtest("the server is exposed externally"):
-          client.systemctl("start network-online.target")
-          client.wait_for_unit("network-online.target")
-          client.succeed("curl -v --fail ${lemmyNodeName}")
+    with subtest("the server is exposed externally"):
+        client.systemctl("start network-online.target")
+        client.wait_for_unit("network-online.target")
+        client.succeed("curl -v --fail ${lemmyNodeName}")
 
-      with subtest("caddy correctly routes backend requests"):
-          # Make sure we are not hitting frontend
-          server.execute("systemctl stop lemmy-ui.service")
+    with subtest("caddy correctly routes backend requests"):
+        # Make sure we are not hitting frontend
+        server.execute("systemctl stop lemmy-ui.service")
 
-          def assert_http_code(url, expected_http_code, extra_curl_args=""):
-              _, http_code = server.execute(f'curl --location --silent -o /dev/null {extra_curl_args} --fail --write-out "%{{http_code}}" {url}')
-              assert http_code == str(expected_http_code), f"expected http code {expected_http_code}, got {http_code}"
+        def assert_http_code(url, expected_http_code, extra_curl_args=""):
+            _, http_code = server.execute(f'curl --location --silent -o /dev/null {extra_curl_args} --fail --write-out "%{{http_code}}" {url}')
+            assert http_code == str(expected_http_code), f"expected http code {expected_http_code}, got {http_code}"
 
-          # Caddy responds with HTTP code 502 if it cannot handle the requested path
-          assert_http_code("${lemmyNodeName}/obviously-wrong-path/", 502)
+        # Caddy responds with HTTP code 502 if it cannot handle the requested path
+        assert_http_code("${lemmyNodeName}/obviously-wrong-path/", 502)
 
-          assert_http_code("${lemmyNodeName}/static/js/client.js", 200)
-          assert_http_code("${lemmyNodeName}/api/v3/site", 200)
+        assert_http_code("${lemmyNodeName}/static/js/client.js", 200)
+        assert_http_code("${lemmyNodeName}/api/v3/site", 200)
 
-          # A 404 confirms that the request goes to the backend
-          # No path can return 200 until after we upload an image to pict-rs
-          assert_http_code("${lemmyNodeName}/pictrs/", 404)
+        # A 404 confirms that the request goes to the backend
+        # No path can return 200 until after we upload an image to pict-rs
+        assert_http_code("${lemmyNodeName}/pictrs/", 404)
 
-          assert_http_code("${lemmyNodeName}/feeds/all.xml", 200)
-          assert_http_code("${lemmyNodeName}/nodeinfo/2.0.json", 200)
+        assert_http_code("${lemmyNodeName}/feeds/all.xml", 200)
+        assert_http_code("${lemmyNodeName}/nodeinfo/2.0.json", 200)
 
-          assert_http_code("${lemmyNodeName}/some-other-made-up-path/", 404, "-X POST")
-          assert_http_code("${lemmyNodeName}/some-other-path", 404, "-H 'Accept: application/activity+json'")
-          assert_http_code("${lemmyNodeName}/some-other-path", 404, "-H 'Accept: application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"'")
-    '';
-  }
-)
+        assert_http_code("${lemmyNodeName}/some-other-made-up-path/", 404, "-X POST")
+        assert_http_code("${lemmyNodeName}/some-other-path", 404, "-H 'Accept: application/activity+json'")
+        assert_http_code("${lemmyNodeName}/some-other-path", 404, "-H 'Accept: application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"'")
+  '';
+}
diff --git a/nixos/tests/libinput.nix b/nixos/tests/libinput.nix
index 32858c80da85..47084fca53d2 100644
--- a/nixos/tests/libinput.nix
+++ b/nixos/tests/libinput.nix
@@ -1,41 +1,39 @@
-import ./make-test-python.nix (
-  { ... }:
+{ ... }:
 
-  {
-    name = "libinput";
+{
+  name = "libinput";
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [
-          ./common/x11.nix
-          ./common/user-account.nix
-        ];
+  nodes.machine =
+    { ... }:
+    {
+      imports = [
+        ./common/x11.nix
+        ./common/user-account.nix
+      ];
 
-        test-support.displayManager.auto.user = "alice";
+      test-support.displayManager.auto.user = "alice";
 
-        services.libinput = {
-          enable = true;
-          mouse = {
-            naturalScrolling = true;
-            leftHanded = true;
-            middleEmulation = false;
-            horizontalScrolling = false;
-          };
+      services.libinput = {
+        enable = true;
+        mouse = {
+          naturalScrolling = true;
+          leftHanded = true;
+          middleEmulation = false;
+          horizontalScrolling = false;
         };
       };
+    };
 
-    testScript = ''
-      def expect_xserver_option(option, value):
-          machine.succeed(f"""cat /var/log/X.0.log | grep -F 'Option "{option}" "{value}"'""")
+  testScript = ''
+    def expect_xserver_option(option, value):
+        machine.succeed(f"""cat /var/log/X.0.log | grep -F 'Option "{option}" "{value}"'""")
 
-      machine.start()
-      machine.wait_for_x()
-      machine.succeed("""cat /var/log/X.0.log | grep -F "Using input driver 'libinput'" """)
-      expect_xserver_option("NaturalScrolling", "on")
-      expect_xserver_option("LeftHanded", "on")
-      expect_xserver_option("MiddleEmulation", "off")
-      expect_xserver_option("HorizontalScrolling", "off")
-    '';
-  }
-)
+    machine.start()
+    machine.wait_for_x()
+    machine.succeed("""cat /var/log/X.0.log | grep -F "Using input driver 'libinput'" """)
+    expect_xserver_option("NaturalScrolling", "on")
+    expect_xserver_option("LeftHanded", "on")
+    expect_xserver_option("MiddleEmulation", "off")
+    expect_xserver_option("HorizontalScrolling", "off")
+  '';
+}
diff --git a/nixos/tests/libresprite.nix b/nixos/tests/libresprite.nix
index d03911788750..76417b80ee2e 100644
--- a/nixos/tests/libresprite.nix
+++ b/nixos/tests/libresprite.nix
@@ -1,34 +1,32 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "libresprite";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fgaz ];
+{ pkgs, ... }:
+{
+  name = "libresprite";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      environment.systemPackages = [
+        pkgs.imagemagick
+        pkgs.libresprite
+      ];
     };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  enableOCR = true;
 
-        services.xserver.enable = true;
-        environment.systemPackages = [
-          pkgs.imagemagick
-          pkgs.libresprite
-        ];
-      };
-
-    enableOCR = true;
-
-    testScript = ''
-      machine.wait_for_x()
-      machine.succeed("convert -font DejaVu-Sans +antialias label:'IT WORKS' image.png")
-      machine.execute("libresprite image.png >&2 &")
-      machine.wait_for_window("LibreSprite ${pkgs.libresprite.version}-dev")
-      machine.wait_for_text("IT WORKS")
-      machine.screenshot("screen")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_x()
+    machine.succeed("convert -font DejaVu-Sans +antialias label:'IT WORKS' image.png")
+    machine.execute("libresprite image.png >&2 &")
+    machine.wait_for_window("LibreSprite ${pkgs.libresprite.version}-dev")
+    machine.wait_for_text("IT WORKS")
+    machine.screenshot("screen")
+  '';
+}
diff --git a/nixos/tests/libuiohook.nix b/nixos/tests/libuiohook.nix
index bd0cdcc7696a..34a200bd0349 100644
--- a/nixos/tests/libuiohook.nix
+++ b/nixos/tests/libuiohook.nix
@@ -1,35 +1,33 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "libuiohook";
-    meta = with lib.maintainers; {
-      maintainers = [ anoa ];
+{ pkgs, lib, ... }:
+{
+  name = "libuiohook";
+  meta = with lib.maintainers; {
+    maintainers = [ anoa ];
+  };
+
+  nodes.client =
+    { nodes, ... }:
+    let
+      user = nodes.client.config.users.users.alice;
+    in
+    {
+      imports = [
+        ./common/user-account.nix
+        ./common/x11.nix
+      ];
+
+      environment.systemPackages = [ pkgs.libuiohook.test ];
+
+      test-support.displayManager.auto.user = user.name;
     };
 
-    nodes.client =
-      { nodes, ... }:
-      let
-        user = nodes.client.config.users.users.alice;
-      in
-      {
-        imports = [
-          ./common/user-account.nix
-          ./common/x11.nix
-        ];
-
-        environment.systemPackages = [ pkgs.libuiohook.test ];
-
-        test-support.displayManager.auto.user = user.name;
-      };
-
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.client.config.users.users.alice;
-      in
-      ''
-        client.wait_for_x()
-        client.succeed("su - alice -c ${pkgs.libuiohook.test}/share/uiohook_tests >&2 &")
-      '';
-  }
-)
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.client.config.users.users.alice;
+    in
+    ''
+      client.wait_for_x()
+      client.succeed("su - alice -c ${pkgs.libuiohook.test}/share/uiohook_tests >&2 &")
+    '';
+}
diff --git a/nixos/tests/libvirtd.nix b/nixos/tests/libvirtd.nix
index 3f996cdcde4a..d7df4c560177 100644
--- a/nixos/tests/libvirtd.nix
+++ b/nixos/tests/libvirtd.nix
@@ -1,78 +1,76 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "libvirtd";
-    meta.maintainers = with pkgs.lib.maintainers; [ fpletz ];
+{ pkgs, ... }:
+{
+  name = "libvirtd";
+  meta.maintainers = with pkgs.lib.maintainers; [ fpletz ];
 
-    nodes = {
-      virthost =
-        { pkgs, ... }:
-        {
-          virtualisation = {
-            cores = 2;
-            memorySize = 2048;
+  nodes = {
+    virthost =
+      { pkgs, ... }:
+      {
+        virtualisation = {
+          cores = 2;
+          memorySize = 2048;
 
-            libvirtd.enable = true;
-            libvirtd.hooks.qemu.is_working = "${pkgs.writeShellScript "testHook.sh" ''
-              touch /tmp/qemu_hook_is_working
-            ''}";
-            libvirtd.nss.enable = true;
-          };
-          boot.supportedFilesystems = [ "zfs" ];
-          networking.hostId = "deadbeef"; # needed for zfs
-          security.polkit.enable = true;
-          environment.systemPackages = with pkgs; [ virt-manager ];
-
-          # This adds `resolve` to the `hosts` line of /etc/nsswitch.conf; NSS modules placed after it
-          # will not be consulted. Therefore this tests that the libvirtd NSS modules will be
-          # be placed early enough for name resolution to work.
-          services.resolved.enable = true;
+          libvirtd.enable = true;
+          libvirtd.hooks.qemu.is_working = "${pkgs.writeShellScript "testHook.sh" ''
+            touch /tmp/qemu_hook_is_working
+          ''}";
+          libvirtd.nss.enable = true;
         };
-    };
+        boot.supportedFilesystems = [ "zfs" ];
+        networking.hostId = "deadbeef"; # needed for zfs
+        security.polkit.enable = true;
+        environment.systemPackages = with pkgs; [ virt-manager ];
 
-    testScript =
-      let
-        nixosInstallISO = (import ../release.nix { }).iso_minimal.${pkgs.stdenv.hostPlatform.system};
-        virshShutdownCmd = if pkgs.stdenv.hostPlatform.isx86_64 then "shutdown" else "destroy";
-      in
-      ''
-        start_all()
+        # This adds `resolve` to the `hosts` line of /etc/nsswitch.conf; NSS modules placed after it
+        # will not be consulted. Therefore this tests that the libvirtd NSS modules will be
+        # be placed early enough for name resolution to work.
+        services.resolved.enable = true;
+      };
+  };
 
+  testScript =
+    let
+      nixosInstallISO = (import ../release.nix { }).iso_minimal.${pkgs.stdenv.hostPlatform.system};
+      virshShutdownCmd = if pkgs.stdenv.hostPlatform.isx86_64 then "shutdown" else "destroy";
+    in
+    ''
+      start_all()
+
+      virthost.wait_for_unit("multi-user.target")
+
+      with subtest("enable default network"):
+        virthost.succeed("virsh net-start default")
+        virthost.succeed("virsh net-autostart default")
+        virthost.succeed("virsh net-info default")
+
+      with subtest("check if partition disk pools works with parted"):
+        virthost.succeed("fallocate -l100m /tmp/foo; losetup /dev/loop0 /tmp/foo; echo 'label: dos' | sfdisk /dev/loop0")
+        virthost.succeed("virsh pool-create-as foo disk --source-dev /dev/loop0 --target /dev")
+        virthost.succeed("virsh vol-create-as foo loop0p1 25MB")
+        virthost.succeed("virsh vol-create-as foo loop0p2 50MB")
+
+      with subtest("check if virsh zfs pools work"):
+        virthost.succeed("fallocate -l100m /tmp/zfs; losetup /dev/loop1 /tmp/zfs;")
+        virthost.succeed("zpool create zfs_loop /dev/loop1")
+        virthost.succeed("virsh pool-define-as --name zfs_storagepool --source-name zfs_loop --type zfs")
+        virthost.succeed("virsh pool-start zfs_storagepool")
+        virthost.succeed("virsh vol-create-as zfs_storagepool disk1 25MB")
+
+      with subtest("check if nixos install iso boots, network and autostart works"):
+        virthost.succeed(
+          "virt-install -n nixos --osinfo nixos-unstable --memory 1024 --graphics none --disk `find ${nixosInstallISO}/iso -type f | head -n1`,readonly=on --import --noautoconsole --autostart"
+        )
+        virthost.succeed("virsh domstate nixos | grep running")
+        virthost.wait_until_succeeds("ping -c 1 nixos")
+        virthost.succeed("virsh ${virshShutdownCmd} nixos")
+        virthost.wait_until_succeeds("virsh domstate nixos | grep 'shut off'")
+        virthost.shutdown()
         virthost.wait_for_unit("multi-user.target")
+        virthost.wait_until_succeeds("ping -c 1 nixos")
 
-        with subtest("enable default network"):
-          virthost.succeed("virsh net-start default")
-          virthost.succeed("virsh net-autostart default")
-          virthost.succeed("virsh net-info default")
-
-        with subtest("check if partition disk pools works with parted"):
-          virthost.succeed("fallocate -l100m /tmp/foo; losetup /dev/loop0 /tmp/foo; echo 'label: dos' | sfdisk /dev/loop0")
-          virthost.succeed("virsh pool-create-as foo disk --source-dev /dev/loop0 --target /dev")
-          virthost.succeed("virsh vol-create-as foo loop0p1 25MB")
-          virthost.succeed("virsh vol-create-as foo loop0p2 50MB")
-
-        with subtest("check if virsh zfs pools work"):
-          virthost.succeed("fallocate -l100m /tmp/zfs; losetup /dev/loop1 /tmp/zfs;")
-          virthost.succeed("zpool create zfs_loop /dev/loop1")
-          virthost.succeed("virsh pool-define-as --name zfs_storagepool --source-name zfs_loop --type zfs")
-          virthost.succeed("virsh pool-start zfs_storagepool")
-          virthost.succeed("virsh vol-create-as zfs_storagepool disk1 25MB")
-
-        with subtest("check if nixos install iso boots, network and autostart works"):
-          virthost.succeed(
-            "virt-install -n nixos --osinfo nixos-unstable --memory 1024 --graphics none --disk `find ${nixosInstallISO}/iso -type f | head -n1`,readonly=on --import --noautoconsole --autostart"
-          )
-          virthost.succeed("virsh domstate nixos | grep running")
-          virthost.wait_until_succeeds("ping -c 1 nixos")
-          virthost.succeed("virsh ${virshShutdownCmd} nixos")
-          virthost.wait_until_succeeds("virsh domstate nixos | grep 'shut off'")
-          virthost.shutdown()
-          virthost.wait_for_unit("multi-user.target")
-          virthost.wait_until_succeeds("ping -c 1 nixos")
-
-        with subtest("test if hooks are linked and run"):
-          virthost.succeed("ls /var/lib/libvirt/hooks/qemu.d/is_working")
-          virthost.succeed("ls /tmp/qemu_hook_is_working")
-      '';
-  }
-)
+      with subtest("test if hooks are linked and run"):
+        virthost.succeed("ls /var/lib/libvirt/hooks/qemu.d/is_working")
+        virthost.succeed("ls /tmp/qemu_hook_is_working")
+    '';
+}
diff --git a/nixos/tests/lidarr.nix b/nixos/tests/lidarr.nix
index 411d4a782390..8f32ce14673f 100644
--- a/nixos/tests/lidarr.nix
+++ b/nixos/tests/lidarr.nix
@@ -1,22 +1,20 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "lidarr";
-    meta.maintainers = with lib.maintainers; [ etu ];
+{
+  name = "lidarr";
+  meta.maintainers = with lib.maintainers; [ etu ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.lidarr.enable = true;
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.lidarr.enable = true;
+    };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine.wait_for_unit("lidarr.service")
-      machine.wait_for_open_port(8686)
-      machine.succeed("curl --fail http://localhost:8686/")
-    '';
-  }
-)
+    machine.wait_for_unit("lidarr.service")
+    machine.wait_for_open_port(8686)
+    machine.succeed("curl --fail http://localhost:8686/")
+  '';
+}
diff --git a/nixos/tests/lightdm.nix b/nixos/tests/lightdm.nix
index 8490f0a6ffaa..3d51924af8de 100644
--- a/nixos/tests/lightdm.nix
+++ b/nixos/tests/lightdm.nix
@@ -1,36 +1,34 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "lightdm";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ aszlig ];
+{ pkgs, ... }:
+{
+  name = "lightdm";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ aszlig ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ./common/user-account.nix ];
+      services.xserver.enable = true;
+      services.xserver.displayManager.lightdm.enable = true;
+      services.displayManager.defaultSession = "none+icewm";
+      services.xserver.windowManager.icewm.enable = true;
     };
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ./common/user-account.nix ];
-        services.xserver.enable = true;
-        services.xserver.displayManager.lightdm.enable = true;
-        services.displayManager.defaultSession = "none+icewm";
-        services.xserver.windowManager.icewm.enable = true;
-      };
+  enableOCR = true;
 
-    enableOCR = true;
-
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.config.users.users.alice;
-      in
-      ''
-        start_all()
-        machine.wait_for_text("${user.description}")
-        machine.screenshot("lightdm")
-        machine.send_chars("${user.password}\n")
-        machine.wait_for_file("${user.home}/.Xauthority")
-        machine.succeed("xauth merge ${user.home}/.Xauthority")
-        machine.wait_for_window("^IceWM ")
-      '';
-  }
-)
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.config.users.users.alice;
+    in
+    ''
+      start_all()
+      machine.wait_for_text("${user.description}")
+      machine.screenshot("lightdm")
+      machine.send_chars("${user.password}\n")
+      machine.wait_for_file("${user.home}/.Xauthority")
+      machine.succeed("xauth merge ${user.home}/.Xauthority")
+      machine.wait_for_window("^IceWM ")
+    '';
+}
diff --git a/nixos/tests/limesurvey.nix b/nixos/tests/limesurvey.nix
index af6092b40193..9f90b4d16820 100644
--- a/nixos/tests/limesurvey.nix
+++ b/nixos/tests/limesurvey.nix
@@ -1,33 +1,31 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "limesurvey";
-    meta.maintainers = [ lib.maintainers.aanderse ];
+{ lib, pkgs, ... }:
+{
+  name = "limesurvey";
+  meta.maintainers = [ lib.maintainers.aanderse ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.limesurvey = {
-          enable = true;
-          virtualHost = {
-            hostName = "example.local";
-            adminAddr = "root@example.local";
-          };
-          encryptionKeyFile = pkgs.writeText "key" (lib.strings.replicate 32 "0");
-          encryptionNonceFile = pkgs.writeText "nonce" (lib.strings.replicate 24 "0");
+  nodes.machine =
+    { ... }:
+    {
+      services.limesurvey = {
+        enable = true;
+        virtualHost = {
+          hostName = "example.local";
+          adminAddr = "root@example.local";
         };
-
-        # limesurvey won't work without a dot in the hostname
-        networking.hosts."127.0.0.1" = [ "example.local" ];
+        encryptionKeyFile = pkgs.writeText "key" (lib.strings.replicate 32 "0");
+        encryptionNonceFile = pkgs.writeText "nonce" (lib.strings.replicate 24 "0");
       };
 
-    testScript = ''
-      start_all()
+      # limesurvey won't work without a dot in the hostname
+      networking.hosts."127.0.0.1" = [ "example.local" ];
+    };
 
-      machine.wait_for_unit("phpfpm-limesurvey.service")
-      assert "The following surveys are available" in machine.succeed(
-          "curl -f http://example.local/"
-      )
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("phpfpm-limesurvey.service")
+    assert "The following surveys are available" in machine.succeed(
+        "curl -f http://example.local/"
+    )
+  '';
+}
diff --git a/nixos/tests/litestream.nix b/nixos/tests/litestream.nix
index 24fe804f3a9e..1ecf08cf5014 100644
--- a/nixos/tests/litestream.nix
+++ b/nixos/tests/litestream.nix
@@ -1,114 +1,112 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "litestream";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ jwygoda ];
-    };
+{ pkgs, ... }:
+{
+  name = "litestream";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jwygoda ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.litestream = {
-          enable = true;
-          settings = {
-            dbs = [
-              {
-                path = "/var/lib/grafana/data/grafana.db";
-                replicas = [
-                  {
-                    url = "sftp://foo:bar@127.0.0.1:22/home/foo/grafana";
-                  }
-                ];
-              }
-            ];
-          };
-        };
-        systemd.services.grafana.serviceConfig.ExecStartPost =
-          "+"
-          + pkgs.writeShellScript "grant-grafana-permissions" ''
-            timeout=10
-
-            while [ ! -f /var/lib/grafana/data/grafana.db ];
-            do
-              if [ "$timeout" == 0 ]; then
-                echo "ERROR: Timeout while waiting for /var/lib/grafana/data/grafana.db."
-                exit 1
-              fi
-
-              sleep 1
-
-              ((timeout--))
-            done
-
-            find /var/lib/grafana -type d -exec chmod -v 775 {} \;
-            find /var/lib/grafana -type f -exec chmod -v 660 {} \;
-          '';
-        services.openssh = {
-          enable = true;
-          allowSFTP = true;
-          listenAddresses = [
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.litestream = {
+        enable = true;
+        settings = {
+          dbs = [
             {
-              addr = "127.0.0.1";
-              port = 22;
+              path = "/var/lib/grafana/data/grafana.db";
+              replicas = [
+                {
+                  url = "sftp://foo:bar@127.0.0.1:22/home/foo/grafana";
+                }
+              ];
             }
           ];
         };
-        services.grafana = {
-          enable = true;
-          settings = {
-            security = {
-              admin_user = "admin";
-              admin_password = "admin";
-            };
+      };
+      systemd.services.grafana.serviceConfig.ExecStartPost =
+        "+"
+        + pkgs.writeShellScript "grant-grafana-permissions" ''
+          timeout=10
 
-            server = {
-              http_addr = "localhost";
-              http_port = 3000;
-            };
+          while [ ! -f /var/lib/grafana/data/grafana.db ];
+          do
+            if [ "$timeout" == 0 ]; then
+              echo "ERROR: Timeout while waiting for /var/lib/grafana/data/grafana.db."
+              exit 1
+            fi
 
-            database = {
-              type = "sqlite3";
-              path = "/var/lib/grafana/data/grafana.db";
-              wal = true;
-            };
+            sleep 1
+
+            ((timeout--))
+          done
+
+          find /var/lib/grafana -type d -exec chmod -v 775 {} \;
+          find /var/lib/grafana -type f -exec chmod -v 660 {} \;
+        '';
+      services.openssh = {
+        enable = true;
+        allowSFTP = true;
+        listenAddresses = [
+          {
+            addr = "127.0.0.1";
+            port = 22;
+          }
+        ];
+      };
+      services.grafana = {
+        enable = true;
+        settings = {
+          security = {
+            admin_user = "admin";
+            admin_password = "admin";
+          };
+
+          server = {
+            http_addr = "localhost";
+            http_port = 3000;
+          };
+
+          database = {
+            type = "sqlite3";
+            path = "/var/lib/grafana/data/grafana.db";
+            wal = true;
           };
         };
-        users.users.foo = {
-          isNormalUser = true;
-          password = "bar";
-        };
-        users.users.litestream.extraGroups = [ "grafana" ];
       };
+      users.users.foo = {
+        isNormalUser = true;
+        password = "bar";
+      };
+      users.users.litestream.extraGroups = [ "grafana" ];
+    };
 
-    testScript = ''
-      start_all()
-      machine.wait_until_succeeds("test -d /home/foo/grafana")
-      machine.wait_for_open_port(3000)
-      machine.succeed("""
-          curl -sSfN -X PUT -H "Content-Type: application/json" -d '{
-            "oldPassword": "admin",
-            "newPassword": "newpass",
-            "confirmNew": "newpass"
-          }' http://admin:admin@127.0.0.1:3000/api/user/password
-      """)
-      # https://litestream.io/guides/systemd/#simulating-a-disaster
-      machine.systemctl("stop litestream.service")
-      machine.succeed(
-          "rm -f /var/lib/grafana/data/grafana.db "
-          "/var/lib/grafana/data/grafana.db-shm "
-          "/var/lib/grafana/data/grafana.db-wal"
-      )
-      machine.succeed(
-          "litestream restore /var/lib/grafana/data/grafana.db "
-          "&& chown grafana:grafana /var/lib/grafana/data/grafana.db "
-          "&& chmod 660 /var/lib/grafana/data/grafana.db"
-      )
-      machine.systemctl("restart grafana.service")
-      machine.wait_for_open_port(3000)
-      machine.succeed(
-          "curl -sSfN -u admin:newpass http://127.0.0.1:3000/api/org/users | grep admin\@localhost"
-      )
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_until_succeeds("test -d /home/foo/grafana")
+    machine.wait_for_open_port(3000)
+    machine.succeed("""
+        curl -sSfN -X PUT -H "Content-Type: application/json" -d '{
+          "oldPassword": "admin",
+          "newPassword": "newpass",
+          "confirmNew": "newpass"
+        }' http://admin:admin@127.0.0.1:3000/api/user/password
+    """)
+    # https://litestream.io/guides/systemd/#simulating-a-disaster
+    machine.systemctl("stop litestream.service")
+    machine.succeed(
+        "rm -f /var/lib/grafana/data/grafana.db "
+        "/var/lib/grafana/data/grafana.db-shm "
+        "/var/lib/grafana/data/grafana.db-wal"
+    )
+    machine.succeed(
+        "litestream restore /var/lib/grafana/data/grafana.db "
+        "&& chown grafana:grafana /var/lib/grafana/data/grafana.db "
+        "&& chmod 660 /var/lib/grafana/data/grafana.db"
+    )
+    machine.systemctl("restart grafana.service")
+    machine.wait_for_open_port(3000)
+    machine.succeed(
+        "curl -sSfN -u admin:newpass http://127.0.0.1:3000/api/org/users | grep admin\@localhost"
+    )
+  '';
+}
diff --git a/nixos/tests/livebook-service.nix b/nixos/tests/livebook-service.nix
index 140b056c48d4..b84fd894692c 100644
--- a/nixos/tests/livebook-service.nix
+++ b/nixos/tests/livebook-service.nix
@@ -1,48 +1,46 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "livebook-service";
+{ lib, pkgs, ... }:
+{
+  name = "livebook-service";
 
-    nodes = {
-      machine =
-        { config, pkgs, ... }:
-        {
-          imports = [
-            ./common/user-account.nix
-          ];
-
-          services.livebook = {
-            enableUserService = true;
-            environment = {
-              LIVEBOOK_PORT = 20123;
-            };
-            environmentFile = pkgs.writeText "livebook.env" ''
-              LIVEBOOK_PASSWORD = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-            '';
-          };
-        };
-    };
-
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-        sudo = lib.concatStringsSep " " [
-          "XDG_RUNTIME_DIR=/run/user/${toString user.uid}"
-          "sudo"
-          "--preserve-env=XDG_RUNTIME_DIR"
-          "-u"
-          "alice"
+  nodes = {
+    machine =
+      { config, pkgs, ... }:
+      {
+        imports = [
+          ./common/user-account.nix
         ];
-      in
-      ''
-        machine.wait_for_unit("multi-user.target")
 
-        machine.succeed("loginctl enable-linger alice")
-        machine.wait_until_succeeds("${sudo} systemctl --user is-active livebook.service")
-        machine.wait_for_open_port(20123, timeout=10)
+        services.livebook = {
+          enableUserService = true;
+          environment = {
+            LIVEBOOK_PORT = 20123;
+          };
+          environmentFile = pkgs.writeText "livebook.env" ''
+            LIVEBOOK_PASSWORD = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+          '';
+        };
+      };
+  };
 
-        machine.succeed("curl -L localhost:20123 | grep 'Type password'")
-      '';
-  }
-)
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+      sudo = lib.concatStringsSep " " [
+        "XDG_RUNTIME_DIR=/run/user/${toString user.uid}"
+        "sudo"
+        "--preserve-env=XDG_RUNTIME_DIR"
+        "-u"
+        "alice"
+      ];
+    in
+    ''
+      machine.wait_for_unit("multi-user.target")
+
+      machine.succeed("loginctl enable-linger alice")
+      machine.wait_until_succeeds("${sudo} systemctl --user is-active livebook.service")
+      machine.wait_for_open_port(20123, timeout=10)
+
+      machine.succeed("curl -L localhost:20123 | grep 'Type password'")
+    '';
+}
diff --git a/nixos/tests/lldap.nix b/nixos/tests/lldap.nix
index 610bda27b1cc..c2e48525a5f3 100644
--- a/nixos/tests/lldap.nix
+++ b/nixos/tests/lldap.nix
@@ -1,31 +1,29 @@
-import ./make-test-python.nix (
-  { ... }:
-  {
-    name = "lldap";
+{ ... }:
+{
+  name = "lldap";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.lldap = {
-          enable = true;
-          settings = {
-            verbose = true;
-            ldap_base_dn = "dc=example,dc=com";
-          };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.lldap = {
+        enable = true;
+        settings = {
+          verbose = true;
+          ldap_base_dn = "dc=example,dc=com";
         };
-        environment.systemPackages = [ pkgs.openldap ];
       };
+      environment.systemPackages = [ pkgs.openldap ];
+    };
 
-    testScript = ''
-      machine.wait_for_unit("lldap.service")
-      machine.wait_for_open_port(3890)
-      machine.wait_for_open_port(17170)
+  testScript = ''
+    machine.wait_for_unit("lldap.service")
+    machine.wait_for_open_port(3890)
+    machine.wait_for_open_port(17170)
 
-      machine.succeed("curl --location --fail http://localhost:17170/")
+    machine.succeed("curl --location --fail http://localhost:17170/")
 
-      print(
-        machine.succeed('ldapsearch -H ldap://localhost:3890 -D uid=admin,ou=people,dc=example,dc=com -b "ou=people,dc=example,dc=com" -w password')
-      )
-    '';
-  }
-)
+    print(
+      machine.succeed('ldapsearch -H ldap://localhost:3890 -D uid=admin,ou=people,dc=example,dc=com -b "ou=people,dc=example,dc=com" -w password')
+    )
+  '';
+}
diff --git a/nixos/tests/localsend.nix b/nixos/tests/localsend.nix
index 551b6dd73ce8..047a3d1598c9 100644
--- a/nixos/tests/localsend.nix
+++ b/nixos/tests/localsend.nix
@@ -1,22 +1,20 @@
-import ./make-test-python.nix (
-  { ... }:
-  {
-    name = "localsend";
+{ ... }:
+{
+  name = "localsend";
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ./common/x11.nix ];
-        programs.localsend.enable = true;
-      };
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ./common/x11.nix ];
+      programs.localsend.enable = true;
+    };
 
-    testScript = ''
-      machine.wait_for_x()
-      machine.succeed("localsend_app >&2 &")
-      machine.wait_for_open_port(53317)
-      machine.wait_for_window("LocalSend", 10)
-      machine.succeed("netstat --listening --program --tcp | grep -P 'tcp.*53317.*localsend'")
-      machine.succeed("netstat --listening --program --udp | grep -P 'udp.*53317.*localsend'")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_x()
+    machine.succeed("localsend_app >&2 &")
+    machine.wait_for_open_port(53317)
+    machine.wait_for_window("LocalSend", 10)
+    machine.succeed("netstat --listening --program --tcp | grep -P 'tcp.*53317.*localsend'")
+    machine.succeed("netstat --listening --program --udp | grep -P 'udp.*53317.*localsend'")
+  '';
+}
diff --git a/nixos/tests/locate.nix b/nixos/tests/locate.nix
index ce66d7fd3afc..559868128560 100644
--- a/nixos/tests/locate.nix
+++ b/nixos/tests/locate.nix
@@ -1,66 +1,64 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
-  in
-  {
-    name = "locate";
-    meta.maintainers = with pkgs.lib.maintainers; [ chkno ];
+{ lib, pkgs, ... }:
+let
+  inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+in
+{
+  name = "locate";
+  meta.maintainers = with pkgs.lib.maintainers; [ chkno ];
 
-    nodes = rec {
-      a = {
-        environment.systemPackages = with pkgs; [ sshfs ];
-        virtualisation.fileSystems = {
-          "/ssh" = {
-            device = "alice@b:/";
-            fsType = "fuse.sshfs";
-            options = [
-              "allow_other"
-              "IdentityFile=/privkey"
-              "noauto"
-              "StrictHostKeyChecking=no"
-              "UserKnownHostsFile=/dev/null"
-            ];
-          };
-        };
-        services.locate = {
-          enable = true;
-          interval = "*:*:0/5";
+  nodes = rec {
+    a = {
+      environment.systemPackages = with pkgs; [ sshfs ];
+      virtualisation.fileSystems = {
+        "/ssh" = {
+          device = "alice@b:/";
+          fsType = "fuse.sshfs";
+          options = [
+            "allow_other"
+            "IdentityFile=/privkey"
+            "noauto"
+            "StrictHostKeyChecking=no"
+            "UserKnownHostsFile=/dev/null"
+          ];
         };
       };
-      b = {
-        services.openssh.enable = true;
-        users.users.alice = {
-          isNormalUser = true;
-          openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
-        };
+      services.locate = {
+        enable = true;
+        interval = "*:*:0/5";
       };
     };
+    b = {
+      services.openssh.enable = true;
+      users.users.alice = {
+        isNormalUser = true;
+        openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+      };
+    };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      # Set up sshfs mount
-      a.succeed(
-          "(umask 077; cat ${snakeOilPrivateKey} > /privkey)"
-      )
-      b.succeed("touch /file-on-b-machine")
-      b.wait_for_open_port(22)
-      a.succeed("mkdir /ssh")
-      a.succeed("mount /ssh")
+    # Set up sshfs mount
+    a.succeed(
+        "(umask 077; cat ${snakeOilPrivateKey} > /privkey)"
+    )
+    b.succeed("touch /file-on-b-machine")
+    b.wait_for_open_port(22)
+    a.succeed("mkdir /ssh")
+    a.succeed("mount /ssh")
 
-      # Core locatedb functionality
-      a.succeed("touch /file-on-a-machine-1")
-      a.wait_for_file("/var/cache/locatedb")
-      a.wait_until_succeeds("locate file-on-a-machine-1")
+    # Core locatedb functionality
+    a.succeed("touch /file-on-a-machine-1")
+    a.wait_for_file("/var/cache/locatedb")
+    a.wait_until_succeeds("locate file-on-a-machine-1")
 
-      # Wait for a second update to make sure we're using a locatedb from a run
-      # that began after the sshfs mount
-      a.succeed("touch /file-on-a-machine-2")
-      a.wait_until_succeeds("locate file-on-a-machine-2")
+    # Wait for a second update to make sure we're using a locatedb from a run
+    # that began after the sshfs mount
+    a.succeed("touch /file-on-a-machine-2")
+    a.wait_until_succeeds("locate file-on-a-machine-2")
 
-      # We shouldn't be able to see files on the other machine
-      a.fail("locate file-on-b-machine")
-    '';
-  }
-)
+    # We shouldn't be able to see files on the other machine
+    a.fail("locate file-on-b-machine")
+  '';
+}
diff --git a/nixos/tests/login.nix b/nixos/tests/login.nix
index acfb270193ab..5703528f69de 100644
--- a/nixos/tests/login.nix
+++ b/nixos/tests/login.nix
@@ -1,74 +1,74 @@
-import ./make-test-python.nix (
-  {
-    pkgs,
-    latestKernel ? false,
-    ...
-  }:
+{
+  lib,
+  pkgs,
+  latestKernel,
+  ...
+}:
 
-  {
-    name = "login";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
+{
+  _module.args.latestKernel = lib.mkDefault false;
+  name = "login";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
+
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      boot.kernelPackages = lib.mkIf latestKernel pkgs.linuxPackages_latest;
     };
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
-        boot.kernelPackages = lib.mkIf latestKernel pkgs.linuxPackages_latest;
-      };
+  testScript = ''
+    machine.start(allow_reboot = True)
 
-    testScript = ''
-      machine.start(allow_reboot = True)
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+    machine.screenshot("postboot")
 
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
-      machine.screenshot("postboot")
+    with subtest("create user"):
+        machine.succeed("useradd -m alice")
+        machine.succeed("(echo foobar; echo foobar) | passwd alice")
 
-      with subtest("create user"):
-          machine.succeed("useradd -m alice")
-          machine.succeed("(echo foobar; echo foobar) | passwd alice")
+    with subtest("Check whether switching VTs works"):
+        machine.fail("pgrep -f 'agetty.*tty2'")
+        machine.send_key("alt-f2")
+        machine.wait_until_succeeds("[ $(fgconsole) = 2 ]")
+        machine.wait_for_unit("getty@tty2.service")
+        machine.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
 
-      with subtest("Check whether switching VTs works"):
-          machine.fail("pgrep -f 'agetty.*tty2'")
-          machine.send_key("alt-f2")
-          machine.wait_until_succeeds("[ $(fgconsole) = 2 ]")
-          machine.wait_for_unit("getty@tty2.service")
-          machine.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
+    with subtest("Log in as alice on a virtual console"):
+        machine.wait_until_tty_matches("2", "login: ")
+        machine.send_chars("alice\n")
+        machine.wait_until_tty_matches("2", "login: alice")
+        machine.wait_until_succeeds("pgrep login")
+        machine.wait_until_tty_matches("2", "Password: ")
+        machine.send_chars("foobar\n")
+        machine.wait_until_succeeds("pgrep -u alice bash")
+        machine.send_chars("touch done\n")
+        machine.wait_for_file("/home/alice/done")
 
-      with subtest("Log in as alice on a virtual console"):
-          machine.wait_until_tty_matches("2", "login: ")
-          machine.send_chars("alice\n")
-          machine.wait_until_tty_matches("2", "login: alice")
-          machine.wait_until_succeeds("pgrep login")
-          machine.wait_until_tty_matches("2", "Password: ")
-          machine.send_chars("foobar\n")
-          machine.wait_until_succeeds("pgrep -u alice bash")
-          machine.send_chars("touch done\n")
-          machine.wait_for_file("/home/alice/done")
+    with subtest("Systemd gives and removes device ownership as needed"):
+        machine.succeed("getfacl /dev/snd/timer | grep -q alice")
+        machine.send_key("alt-f1")
+        machine.wait_until_succeeds("[ $(fgconsole) = 1 ]")
+        machine.fail("getfacl /dev/snd/timer | grep -q alice")
+        machine.succeed("chvt 2")
+        machine.wait_until_succeeds("getfacl /dev/snd/timer | grep -q alice")
 
-      with subtest("Systemd gives and removes device ownership as needed"):
-          machine.succeed("getfacl /dev/snd/timer | grep -q alice")
-          machine.send_key("alt-f1")
-          machine.wait_until_succeeds("[ $(fgconsole) = 1 ]")
-          machine.fail("getfacl /dev/snd/timer | grep -q alice")
-          machine.succeed("chvt 2")
-          machine.wait_until_succeeds("getfacl /dev/snd/timer | grep -q alice")
+    with subtest("Virtual console logout"):
+        machine.send_chars("exit\n")
+        machine.wait_until_fails("pgrep -u alice bash")
+        machine.screenshot("getty")
 
-      with subtest("Virtual console logout"):
-          machine.send_chars("exit\n")
-          machine.wait_until_fails("pgrep -u alice bash")
-          machine.screenshot("getty")
+    with subtest("Check whether ctrl-alt-delete works"):
+        boot_id1 = machine.succeed("cat /proc/sys/kernel/random/boot_id").strip()
+        assert boot_id1 != ""
 
-      with subtest("Check whether ctrl-alt-delete works"):
-          boot_id1 = machine.succeed("cat /proc/sys/kernel/random/boot_id").strip()
-          assert boot_id1 != ""
+        machine.reboot()
 
-          machine.reboot()
+        boot_id2 = machine.succeed("cat /proc/sys/kernel/random/boot_id").strip()
+        assert boot_id2 != ""
 
-          boot_id2 = machine.succeed("cat /proc/sys/kernel/random/boot_id").strip()
-          assert boot_id2 != ""
-
-          assert boot_id1 != boot_id2
-    '';
-  }
-)
+        assert boot_id1 != boot_id2
+  '';
+}
diff --git a/nixos/tests/loki.nix b/nixos/tests/loki.nix
index 8f5e23c3ac08..9c08c4312c97 100644
--- a/nixos/tests/loki.nix
+++ b/nixos/tests/loki.nix
@@ -1,65 +1,63 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  {
-    name = "loki";
+{
+  name = "loki";
 
-    meta = with lib.maintainers; {
-      maintainers = [ willibutz ];
-    };
+  meta = with lib.maintainers; {
+    maintainers = [ willibutz ];
+  };
 
-    nodes.machine =
-      { ... }:
-      {
-        services.loki = {
-          enable = true;
+  nodes.machine =
+    { ... }:
+    {
+      services.loki = {
+        enable = true;
 
-          # FIXME(globin) revert to original file when upstream fix released
-          # configFile = "${pkgs.grafana-loki.src}/cmd/loki/loki-local-config.yaml";
-          configFile = pkgs.runCommandNoCC "patched-loki-cfg.yml" { } ''
-            sed '/metric_aggregation/!b;n;/enable/d' "${pkgs.grafana-loki.src}/cmd/loki/loki-local-config.yaml" > $out
-          '';
-        };
-        services.promtail = {
-          enable = true;
-          configuration = {
-            server = {
-              http_listen_port = 9080;
-              grpc_listen_port = 0;
-            };
-            clients = [ { url = "http://localhost:3100/loki/api/v1/push"; } ];
-            scrape_configs = [
-              {
-                job_name = "system";
-                static_configs = [
-                  {
-                    targets = [ "localhost" ];
-                    labels = {
-                      job = "varlogs";
-                      __path__ = "/var/log/*log";
-                    };
-                  }
-                ];
-              }
-            ];
+        # FIXME(globin) revert to original file when upstream fix released
+        # configFile = "${pkgs.grafana-loki.src}/cmd/loki/loki-local-config.yaml";
+        configFile = pkgs.runCommandNoCC "patched-loki-cfg.yml" { } ''
+          sed '/metric_aggregation/!b;n;/enable/d' "${pkgs.grafana-loki.src}/cmd/loki/loki-local-config.yaml" > $out
+        '';
+      };
+      services.promtail = {
+        enable = true;
+        configuration = {
+          server = {
+            http_listen_port = 9080;
+            grpc_listen_port = 0;
           };
+          clients = [ { url = "http://localhost:3100/loki/api/v1/push"; } ];
+          scrape_configs = [
+            {
+              job_name = "system";
+              static_configs = [
+                {
+                  targets = [ "localhost" ];
+                  labels = {
+                    job = "varlogs";
+                    __path__ = "/var/log/*log";
+                  };
+                }
+              ];
+            }
+          ];
         };
       };
+    };
 
-    testScript = ''
-      machine.start
-      machine.wait_for_unit("loki.service")
-      machine.wait_for_unit("promtail.service")
-      machine.wait_for_open_port(3100)
-      machine.wait_for_open_port(9080)
-      machine.succeed("echo 'Loki Ingestion Test' > /var/log/testlog")
-      # should not have access to journal unless specified
-      machine.fail(
-          "systemctl show --property=SupplementaryGroups promtail | grep -q systemd-journal"
-      )
-      machine.wait_until_succeeds(
-          "${pkgs.grafana-loki}/bin/logcli --addr='http://localhost:3100' query --no-labels '{job=\"varlogs\",filename=\"/var/log/testlog\"}' | grep -q 'Loki Ingestion Test'"
-      )
-    '';
-  }
-)
+  testScript = ''
+    machine.start
+    machine.wait_for_unit("loki.service")
+    machine.wait_for_unit("promtail.service")
+    machine.wait_for_open_port(3100)
+    machine.wait_for_open_port(9080)
+    machine.succeed("echo 'Loki Ingestion Test' > /var/log/testlog")
+    # should not have access to journal unless specified
+    machine.fail(
+        "systemctl show --property=SupplementaryGroups promtail | grep -q systemd-journal"
+    )
+    machine.wait_until_succeeds(
+        "${pkgs.grafana-loki}/bin/logcli --addr='http://localhost:3100' query --no-labels '{job=\"varlogs\",filename=\"/var/log/testlog\"}' | grep -q 'Loki Ingestion Test'"
+    )
+  '';
+}
diff --git a/nixos/tests/lomiri-music-app.nix b/nixos/tests/lomiri-music-app.nix
index 87722db239d7..9efff85fee20 100644
--- a/nixos/tests/lomiri-music-app.nix
+++ b/nixos/tests/lomiri-music-app.nix
@@ -1,7 +1,8 @@
 { lib, ... }:
 let
   ocrContent = "Music Test";
-  musicFile = "test.mp3";
+  musicFileName = "Example";
+  musicFile = "${musicFileName}.mp3";
 
   ocrPauseColor = "#FF00FF";
   ocrStartColor = "#00FFFF";
@@ -136,6 +137,7 @@ in
 
     with subtest("lomiri music launches"):
         machine.succeed("lomiri-music-app >&2 &")
+        machine.wait_for_console_text("Queue is empty")
         machine.sleep(10)
         machine.send_key("alt-f10")
         machine.sleep(2)
@@ -144,11 +146,14 @@ in
 
     with subtest("lomiri music plays music"):
         machine.succeed("xdotool mousemove 30 720 click 1") # Skip intro
+        machine.sleep(2)
         machine.wait_for_text("Albums")
         machine.succeed("xdotool mousemove 25 45 click 1") # Open categories
+        machine.sleep(2)
         machine.wait_for_text("Tracks")
         machine.succeed("xdotool mousemove 25 240 click 1") # Switch to Tracks category
-        machine.wait_for_text("test") # the test file
+        machine.sleep(2)
+        machine.wait_for_text("${musicFileName}") # the test file
         machine.screenshot("lomiri-music_listing")
 
         # Ensure pause colours isn't present already
@@ -185,6 +190,7 @@ in
 
     with subtest("lomiri music localisation works"):
         machine.succeed("env LANG=de_DE.UTF-8 lomiri-music-app .mp4 >&2 &")
+        machine.wait_for_console_text("Restoring library queue")
         machine.sleep(10)
         machine.send_key("alt-f10")
         machine.sleep(2)
diff --git a/nixos/tests/luks.nix b/nixos/tests/luks.nix
index 15489343b707..685643c4c9dc 100644
--- a/nixos/tests/luks.nix
+++ b/nixos/tests/luks.nix
@@ -1,81 +1,79 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "luks";
+{ lib, pkgs, ... }:
+{
+  name = "luks";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ./common/auto-format-root-device.nix ];
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/auto-format-root-device.nix ];
 
-        # Use systemd-boot
-        virtualisation = {
-          emptyDiskImages = [
-            512
-            512
-          ];
-          useBootLoader = true;
-          useEFIBoot = true;
-          # To boot off the encrypted disk, we need to have a init script which comes from the Nix store
-          mountHostNixStore = true;
-        };
-        boot.loader.systemd-boot.enable = true;
-
-        boot.kernelParams = lib.mkOverride 5 [ "console=tty1" ];
-
-        environment.systemPackages = with pkgs; [ cryptsetup ];
-
-        specialisation = rec {
-          boot-luks.configuration = {
-            boot.initrd.luks.devices = lib.mkVMOverride {
-              # We have two disks and only type one password - key reuse is in place
-              cryptroot.device = "/dev/vdb";
-              cryptroot2.device = "/dev/vdc";
-            };
-            virtualisation.rootDevice = "/dev/mapper/cryptroot";
-          };
-          boot-luks-custom-keymap.configuration = lib.mkMerge [
-            boot-luks.configuration
-            {
-              console.keyMap = "neo";
-            }
-          ];
-        };
+      # Use systemd-boot
+      virtualisation = {
+        emptyDiskImages = [
+          512
+          512
+        ];
+        useBootLoader = true;
+        useEFIBoot = true;
+        # To boot off the encrypted disk, we need to have a init script which comes from the Nix store
+        mountHostNixStore = true;
       };
+      boot.loader.systemd-boot.enable = true;
 
-    enableOCR = true;
+      boot.kernelParams = lib.mkOverride 5 [ "console=tty1" ];
 
-    testScript = ''
-      # Create encrypted volume
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
+      environment.systemPackages = with pkgs; [ cryptsetup ];
 
-      # Boot from the encrypted disk
-      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-      machine.succeed("sync")
-      machine.crash()
+      specialisation = rec {
+        boot-luks.configuration = {
+          boot.initrd.luks.devices = lib.mkVMOverride {
+            # We have two disks and only type one password - key reuse is in place
+            cryptroot.device = "/dev/vdb";
+            cryptroot2.device = "/dev/vdc";
+          };
+          virtualisation.rootDevice = "/dev/mapper/cryptroot";
+        };
+        boot-luks-custom-keymap.configuration = lib.mkMerge [
+          boot-luks.configuration
+          {
+            console.keyMap = "neo";
+          }
+        ];
+      };
+    };
 
-      # Boot and decrypt the disk
-      machine.start()
-      machine.wait_for_text("Passphrase for")
-      machine.send_chars("supersecret\n")
-      machine.wait_for_unit("multi-user.target")
+  enableOCR = true;
 
-      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+  testScript = ''
+    # Create encrypted volume
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
 
-      # Boot from the encrypted disk with custom keymap
-      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-custom-keymap.conf")
-      machine.succeed("sync")
-      machine.crash()
+    # Boot from the encrypted disk
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
+    machine.succeed("sync")
+    machine.crash()
 
-      # Boot and decrypt the disk
-      machine.start()
-      machine.wait_for_text("Passphrase for")
-      machine.send_chars("havfkhfrkfl\n")
-      machine.wait_for_unit("multi-user.target")
+    # Boot and decrypt the disk
+    machine.start()
+    machine.wait_for_text("Passphrase for")
+    machine.send_chars("supersecret\n")
+    machine.wait_for_unit("multi-user.target")
 
-      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-    '';
-  }
-)
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+
+    # Boot from the encrypted disk with custom keymap
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-custom-keymap.conf")
+    machine.succeed("sync")
+    machine.crash()
+
+    # Boot and decrypt the disk
+    machine.start()
+    machine.wait_for_text("Passphrase for")
+    machine.send_chars("havfkhfrkfl\n")
+    machine.wait_for_unit("multi-user.target")
+
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+  '';
+}
diff --git a/nixos/tests/lxd-image-server.nix b/nixos/tests/lxd-image-server.nix
index 4b0b1259f404..498f17ef56a2 100644
--- a/nixos/tests/lxd-image-server.nix
+++ b/nixos/tests/lxd-image-server.nix
@@ -1,102 +1,100 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    lxd-image = import ../release.nix {
-      configuration = {
-        # Building documentation makes the test unnecessarily take a longer time:
-        documentation.enable = lib.mkForce false;
-      };
+let
+  lxd-image = import ../release.nix {
+    configuration = {
+      # Building documentation makes the test unnecessarily take a longer time:
+      documentation.enable = lib.mkForce false;
     };
+  };
 
-    lxd-image-metadata = lxd-image.lxdContainerMeta.${pkgs.stdenv.hostPlatform.system};
-    lxd-image-rootfs = lxd-image.lxdContainerImage.${pkgs.stdenv.hostPlatform.system};
+  lxd-image-metadata = lxd-image.lxdContainerMeta.${pkgs.stdenv.hostPlatform.system};
+  lxd-image-rootfs = lxd-image.lxdContainerImage.${pkgs.stdenv.hostPlatform.system};
 
-  in
-  {
-    name = "lxd-image-server";
+in
+{
+  name = "lxd-image-server";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        mkg20001
-        patryk27
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      mkg20001
+      patryk27
+    ];
+  };
+
+  nodes.machine =
+    { lib, ... }:
+    {
+      virtualisation = {
+        cores = 2;
+
+        memorySize = 2048;
+        diskSize = 4096;
+
+        lxc.lxcfs.enable = true;
+        lxd.enable = true;
+      };
+
+      security.pki.certificates = [
+        (builtins.readFile ./common/acme/server/ca.cert.pem)
       ];
-    };
 
-    nodes.machine =
-      { lib, ... }:
-      {
-        virtualisation = {
-          cores = 2;
+      services.nginx = {
+        enable = true;
+      };
 
-          memorySize = 2048;
-          diskSize = 4096;
-
-          lxc.lxcfs.enable = true;
-          lxd.enable = true;
-        };
-
-        security.pki.certificates = [
-          (builtins.readFile ./common/acme/server/ca.cert.pem)
-        ];
-
-        services.nginx = {
+      services.lxd-image-server = {
+        enable = true;
+        nginx = {
           enable = true;
-        };
-
-        services.lxd-image-server = {
-          enable = true;
-          nginx = {
-            enable = true;
-            domain = "acme.test";
-          };
-        };
-
-        services.nginx.virtualHosts."acme.test" = {
-          enableACME = false;
-          sslCertificate = ./common/acme/server/acme.test.cert.pem;
-          sslCertificateKey = ./common/acme/server/acme.test.key.pem;
-        };
-
-        networking.hosts = {
-          "::1" = [ "acme.test" ];
+          domain = "acme.test";
         };
       };
 
-    testScript = ''
-      machine.wait_for_unit("sockets.target")
-      machine.wait_for_unit("lxd.service")
-      machine.wait_for_file("/var/lib/lxd/unix.socket")
+      services.nginx.virtualHosts."acme.test" = {
+        enableACME = false;
+        sslCertificate = ./common/acme/server/acme.test.cert.pem;
+        sslCertificateKey = ./common/acme/server/acme.test.key.pem;
+      };
 
-      # Wait for lxd to settle
-      machine.succeed("lxd waitready")
+      networking.hosts = {
+        "::1" = [ "acme.test" ];
+      };
+    };
 
-      # lxd expects the pool's directory to already exist
-      machine.succeed("mkdir /var/lxd-pool")
+  testScript = ''
+    machine.wait_for_unit("sockets.target")
+    machine.wait_for_unit("lxd.service")
+    machine.wait_for_file("/var/lib/lxd/unix.socket")
 
-      machine.succeed(
-          "lxd init --minimal"
-      )
+    # Wait for lxd to settle
+    machine.succeed("lxd waitready")
 
-      machine.succeed(
-          "lxc image import ${lxd-image-metadata}/*/*.tar.xz ${lxd-image-rootfs}/*/*.tar.xz --alias nixos"
-      )
+    # lxd expects the pool's directory to already exist
+    machine.succeed("mkdir /var/lxd-pool")
 
-      loc = "/var/www/simplestreams/images/iats/nixos/amd64/default/v1"
+    machine.succeed(
+        "lxd init --minimal"
+    )
 
-      with subtest("push image to server"):
-          machine.succeed("lxc launch nixos test")
-          machine.sleep(5)
-          machine.succeed("lxc stop -f test")
-          machine.succeed("lxc publish --public test --alias=testimg")
-          machine.succeed("lxc image export testimg")
-          machine.succeed("ls >&2")
-          machine.succeed("mkdir -p " + loc)
-          machine.succeed("mv *.tar.gz " + loc)
+    machine.succeed(
+        "lxc image import ${lxd-image-metadata}/*/*.tar.xz ${lxd-image-rootfs}/*/*.tar.xz --alias nixos"
+    )
 
-      with subtest("pull image from server"):
-          machine.succeed("lxc remote add img https://acme.test --protocol=simplestreams")
-          machine.succeed("lxc image list img: >&2")
-    '';
-  }
-)
+    loc = "/var/www/simplestreams/images/iats/nixos/amd64/default/v1"
+
+    with subtest("push image to server"):
+        machine.succeed("lxc launch nixos test")
+        machine.sleep(5)
+        machine.succeed("lxc stop -f test")
+        machine.succeed("lxc publish --public test --alias=testimg")
+        machine.succeed("lxc image export testimg")
+        machine.succeed("ls >&2")
+        machine.succeed("mkdir -p " + loc)
+        machine.succeed("mv *.tar.gz " + loc)
+
+    with subtest("pull image from server"):
+        machine.succeed("lxc remote add img https://acme.test --protocol=simplestreams")
+        machine.succeed("lxc image list img: >&2")
+  '';
+}
diff --git a/nixos/tests/lxqt.nix b/nixos/tests/lxqt.nix
index f2d5bb513ce8..a685a21536bb 100644
--- a/nixos/tests/lxqt.nix
+++ b/nixos/tests/lxqt.nix
@@ -1,80 +1,78 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  {
-    name = "lxqt";
+{
+  name = "lxqt";
 
-    meta.maintainers = lib.teams.lxqt.members ++ [ lib.maintainers.bobby285271 ];
+  meta.maintainers = lib.teams.lxqt.members ++ [ lib.maintainers.bobby285271 ];
 
-    nodes.machine =
-      { ... }:
+  nodes.machine =
+    { ... }:
 
-      {
-        imports = [ ./common/user-account.nix ];
+    {
+      imports = [ ./common/user-account.nix ];
 
-        services.xserver.enable = true;
-        services.xserver.desktopManager.lxqt.enable = true;
+      services.xserver.enable = true;
+      services.xserver.desktopManager.lxqt.enable = true;
 
-        services.displayManager = {
-          sddm.enable = true;
-          defaultSession = "lxqt";
-          autoLogin = {
-            enable = true;
-            user = "alice";
-          };
+      services.displayManager = {
+        sddm.enable = true;
+        defaultSession = "lxqt";
+        autoLogin = {
+          enable = true;
+          user = "alice";
         };
       };
+    };
 
-    enableOCR = true;
+  enableOCR = true;
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-      in
-      ''
-        machine.wait_for_unit("display-manager.service")
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+    in
+    ''
+      machine.wait_for_unit("display-manager.service")
 
-        with subtest("Wait for login"):
-            machine.wait_for_x()
-            machine.wait_for_file("/tmp/xauth_*")
-            machine.succeed("xauth merge /tmp/xauth_*")
-            machine.succeed("su - ${user.name} -c 'xauth merge /tmp/xauth_*'")
+      with subtest("Wait for login"):
+          machine.wait_for_x()
+          machine.wait_for_file("/tmp/xauth_*")
+          machine.succeed("xauth merge /tmp/xauth_*")
+          machine.succeed("su - ${user.name} -c 'xauth merge /tmp/xauth_*'")
 
-        with subtest("Check that logging in has given the user ownership of devices"):
-            machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+      with subtest("Check that logging in has given the user ownership of devices"):
+          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
 
-        with subtest("Check if LXQt components actually start"):
-            for i in ["openbox", "lxqt-session", "pcmanfm-qt", "lxqt-panel", "lxqt-runner"]:
-                machine.wait_until_succeeds(f"pgrep {i}")
-            machine.wait_for_window("pcmanfm-desktop0")
-            machine.wait_for_window("lxqt-panel")
-            machine.wait_for_text("(Computer|Network|Trash)")
+      with subtest("Check if LXQt components actually start"):
+          for i in ["openbox", "lxqt-session", "pcmanfm-qt", "lxqt-panel", "lxqt-runner"]:
+              machine.wait_until_succeeds(f"pgrep {i}")
+          machine.wait_for_window("pcmanfm-desktop0")
+          machine.wait_for_window("lxqt-panel")
+          machine.wait_for_text("(Computer|Network|Trash)")
 
-        with subtest("Open QTerminal"):
-            machine.succeed("su - ${user.name} -c 'DISPLAY=:0 qterminal >&2 &'")
-            machine.wait_until_succeeds("pgrep qterminal")
-            machine.wait_for_window("${user.name}@machine: ~")
+      with subtest("Open QTerminal"):
+          machine.succeed("su - ${user.name} -c 'DISPLAY=:0 qterminal >&2 &'")
+          machine.wait_until_succeeds("pgrep qterminal")
+          machine.wait_for_window("${user.name}@machine: ~")
 
-        with subtest("Open PCManFM-Qt"):
-            machine.succeed("mkdir -p /tmp/test/test")
-            machine.succeed("su - ${user.name} -c 'DISPLAY=:0 QT_SCALE_FACTOR=2 pcmanfm-qt /tmp/test >&2 &'")
-            machine.wait_for_window("test")
-            machine.wait_for_text("(test|Bookmarks|Reload)")
+      with subtest("Open PCManFM-Qt"):
+          machine.succeed("mkdir -p /tmp/test/test")
+          machine.succeed("su - ${user.name} -c 'DISPLAY=:0 QT_SCALE_FACTOR=2 pcmanfm-qt /tmp/test >&2 &'")
+          machine.wait_for_window("test")
+          machine.wait_for_text("(test|Bookmarks|Reload)")
 
-        with subtest("Check if various environment variables are set"):
-            cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf /run/current-system/sw/bin/lxqt-panel)/environ"
-            machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP=LXQt'")
-            machine.succeed(f"{cmd} | grep 'QT_PLATFORM_PLUGIN=lxqt'")
-            # From login shell.
-            machine.succeed(f"{cmd} | grep '__NIXOS_SET_ENVIRONMENT_DONE=1'")
-            # See the nixos/lxqt module.
-            machine.succeed(f"{cmd} | grep 'XDG_CONFIG_DIRS' | grep '${nodes.machine.system.path}'")
+      with subtest("Check if various environment variables are set"):
+          cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf /run/current-system/sw/bin/lxqt-panel)/environ"
+          machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP=LXQt'")
+          machine.succeed(f"{cmd} | grep 'QT_PLATFORM_PLUGIN=lxqt'")
+          # From login shell.
+          machine.succeed(f"{cmd} | grep '__NIXOS_SET_ENVIRONMENT_DONE=1'")
+          # See the nixos/lxqt module.
+          machine.succeed(f"{cmd} | grep 'XDG_CONFIG_DIRS' | grep '${nodes.machine.system.path}'")
 
-        with subtest("Check if any coredumps are found"):
-            machine.succeed("(coredumpctl --json=short 2>&1 || true) | grep 'No coredumps found'")
-            machine.sleep(10)
-            machine.screenshot("screen")
-      '';
-  }
-)
+      with subtest("Check if any coredumps are found"):
+          machine.succeed("(coredumpctl --json=short 2>&1 || true) | grep 'No coredumps found'")
+          machine.sleep(10)
+          machine.screenshot("screen")
+    '';
+}
diff --git a/nixos/tests/ly.nix b/nixos/tests/ly.nix
index 04c6ed9c7774..4791bf8056f2 100644
--- a/nixos/tests/ly.nix
+++ b/nixos/tests/ly.nix
@@ -1,44 +1,42 @@
-import ./make-test-python.nix (
-  { ... }:
+{ ... }:
 
-  {
-    name = "ly";
+{
+  name = "ly";
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ./common/user-account.nix ];
-        services.displayManager.ly = {
-          enable = true;
-          settings = {
-            load = false;
-            save = false;
-          };
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ./common/user-account.nix ];
+      services.displayManager.ly = {
+        enable = true;
+        settings = {
+          load = false;
+          save = false;
         };
-        services.xserver.enable = true;
-        services.displayManager.defaultSession = "none+icewm";
-        services.xserver.windowManager.icewm.enable = true;
       };
+      services.xserver.enable = true;
+      services.displayManager.defaultSession = "none+icewm";
+      services.xserver.windowManager.icewm.enable = true;
+    };
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-      in
-      ''
-        start_all()
-        machine.wait_until_tty_matches("2", "password:")
-        machine.send_key("ctrl-alt-f2")
-        machine.sleep(1)
-        machine.screenshot("ly")
-        machine.send_chars("alice")
-        machine.send_key("tab")
-        machine.send_chars("${user.password}")
-        machine.send_key("ret")
-        machine.wait_for_file("/run/user/${toString user.uid}/lyxauth")
-        machine.succeed("xauth merge /run/user/${toString user.uid}/lyxauth")
-        machine.wait_for_window("^IceWM ")
-        machine.screenshot("icewm")
-      '';
-  }
-)
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+    in
+    ''
+      start_all()
+      machine.wait_until_tty_matches("2", "password:")
+      machine.send_key("ctrl-alt-f2")
+      machine.sleep(1)
+      machine.screenshot("ly")
+      machine.send_chars("alice")
+      machine.send_key("tab")
+      machine.send_chars("${user.password}")
+      machine.send_key("ret")
+      machine.wait_for_file("/run/user/${toString user.uid}/lyxauth")
+      machine.succeed("xauth merge /run/user/${toString user.uid}/lyxauth")
+      machine.wait_for_window("^IceWM ")
+      machine.screenshot("icewm")
+    '';
+}
diff --git a/nixos/tests/maestral.nix b/nixos/tests/maestral.nix
index aa510897d0d7..9b42b2d59e28 100644
--- a/nixos/tests/maestral.nix
+++ b/nixos/tests/maestral.nix
@@ -1,83 +1,81 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "maestral";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ peterhoeg ];
+{ pkgs, ... }:
+{
+  name = "maestral";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ peterhoeg ];
+  };
+
+  nodes =
+    let
+      common =
+        attrs:
+        pkgs.lib.recursiveUpdate {
+          imports = [ ./common/user-account.nix ];
+          systemd.user.services.maestral = {
+            description = "Maestral Dropbox Client";
+            serviceConfig.Type = "exec";
+          };
+        } attrs;
+
+    in
+    {
+      cli =
+        { ... }:
+        common {
+          systemd.user.services.maestral = {
+            wantedBy = [ "default.target" ];
+            serviceConfig.ExecStart = "${pkgs.maestral}/bin/maestral start --foreground";
+          };
+        };
+
+      gui =
+        { ... }:
+        common {
+          services.xserver = {
+            enable = true;
+            desktopManager.plasma5.enable = true;
+            desktopManager.plasma5.runUsingSystemd = true;
+          };
+
+          services.displayManager = {
+            sddm.enable = true;
+            defaultSession = "plasma";
+            autoLogin = {
+              enable = true;
+              user = "alice";
+            };
+          };
+
+          systemd.user.services = {
+            maestral = {
+              wantedBy = [ "graphical-session.target" ];
+              serviceConfig.ExecStart = "${pkgs.maestral-gui}/bin/maestral_qt";
+            };
+            # PowerDevil doesn't like our VM
+            plasma-powerdevil.enable = false;
+          };
+        };
     };
 
-    nodes =
-      let
-        common =
-          attrs:
-          pkgs.lib.recursiveUpdate {
-            imports = [ ./common/user-account.nix ];
-            systemd.user.services.maestral = {
-              description = "Maestral Dropbox Client";
-              serviceConfig.Type = "exec";
-            };
-          } attrs;
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.cli.users.users.alice;
+    in
+    ''
+      start_all()
 
-      in
-      {
-        cli =
-          { ... }:
-          common {
-            systemd.user.services.maestral = {
-              wantedBy = [ "default.target" ];
-              serviceConfig.ExecStart = "${pkgs.maestral}/bin/maestral start --foreground";
-            };
-          };
+      with subtest("CLI"):
+        # we need SOME way to give the user an active login session
+        cli.execute("loginctl enable-linger ${user.name}")
+        cli.systemctl("start user@${toString user.uid}")
+        cli.wait_for_unit("maestral.service", "${user.name}")
 
-        gui =
-          { ... }:
-          common {
-            services.xserver = {
-              enable = true;
-              desktopManager.plasma5.enable = true;
-              desktopManager.plasma5.runUsingSystemd = true;
-            };
-
-            services.displayManager = {
-              sddm.enable = true;
-              defaultSession = "plasma";
-              autoLogin = {
-                enable = true;
-                user = "alice";
-              };
-            };
-
-            systemd.user.services = {
-              maestral = {
-                wantedBy = [ "graphical-session.target" ];
-                serviceConfig.ExecStart = "${pkgs.maestral-gui}/bin/maestral_qt";
-              };
-              # PowerDevil doesn't like our VM
-              plasma-powerdevil.enable = false;
-            };
-          };
-      };
-
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.cli.users.users.alice;
-      in
-      ''
-        start_all()
-
-        with subtest("CLI"):
-          # we need SOME way to give the user an active login session
-          cli.execute("loginctl enable-linger ${user.name}")
-          cli.systemctl("start user@${toString user.uid}")
-          cli.wait_for_unit("maestral.service", "${user.name}")
-
-        with subtest("GUI"):
-          gui.wait_for_x()
-          gui.wait_for_file("/tmp/xauth_*")
-          gui.succeed("xauth merge /tmp/xauth_*")
-          gui.wait_for_window("^Desktop ")
-          gui.wait_for_unit("maestral.service", "${user.name}")
-      '';
-  }
-)
+      with subtest("GUI"):
+        gui.wait_for_x()
+        gui.wait_for_file("/tmp/xauth_*")
+        gui.succeed("xauth merge /tmp/xauth_*")
+        gui.wait_for_window("^Desktop ")
+        gui.wait_for_unit("maestral.service", "${user.name}")
+    '';
+}
diff --git a/nixos/tests/magnetico.nix b/nixos/tests/magnetico.nix
index 279d19d87778..294762fe146b 100644
--- a/nixos/tests/magnetico.nix
+++ b/nixos/tests/magnetico.nix
@@ -1,44 +1,42 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    port = 8081;
-  in
-  {
-    name = "magnetico";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ rnhmjoj ];
+let
+  port = 8081;
+in
+{
+  name = "magnetico";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ rnhmjoj ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ../modules/profiles/minimal.nix ];
+
+      networking.firewall.allowedTCPPorts = [ 9000 ];
+
+      services.magnetico = {
+        enable = true;
+        crawler.port = 9000;
+        web.port = port;
+        web.credentials.user = "$2y$12$P88ZF6soFthiiAeXnz64aOWDsY3Dw7Yw8fZ6GtiqFNjknD70zDmNe";
+      };
     };
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ../modules/profiles/minimal.nix ];
-
-        networking.firewall.allowedTCPPorts = [ 9000 ];
-
-        services.magnetico = {
-          enable = true;
-          crawler.port = 9000;
-          web.port = port;
-          web.credentials.user = "$2y$12$P88ZF6soFthiiAeXnz64aOWDsY3Dw7Yw8fZ6GtiqFNjknD70zDmNe";
-        };
-      };
-
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("magneticod")
-      machine.wait_for_unit("magneticow")
-      machine.wait_for_open_port(${toString port})
-      machine.succeed(
-          "${pkgs.curl}/bin/curl --fail "
-          + "-u user:password http://localhost:${toString port}"
-      )
-      machine.fail(
-          "${pkgs.curl}/bin/curl --fail "
-          + "-u user:wrongpwd http://localhost:${toString port}"
-      )
-      machine.shutdown()
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("magneticod")
+    machine.wait_for_unit("magneticow")
+    machine.wait_for_open_port(${toString port})
+    machine.succeed(
+        "${pkgs.curl}/bin/curl --fail "
+        + "-u user:password http://localhost:${toString port}"
+    )
+    machine.fail(
+        "${pkgs.curl}/bin/curl --fail "
+        + "-u user:wrongpwd http://localhost:${toString port}"
+    )
+    machine.shutdown()
+  '';
+}
diff --git a/nixos/tests/marytts.nix b/nixos/tests/marytts.nix
index 4c80cf5cc4e1..101f20662ea5 100644
--- a/nixos/tests/marytts.nix
+++ b/nixos/tests/marytts.nix
@@ -1,87 +1,85 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  let
-    port = 59126;
-  in
-  {
-    name = "marytts";
-    meta.maintainers = with lib.maintainers; [ pluiedev ];
+{ lib, ... }:
+let
+  port = 59126;
+in
+{
+  name = "marytts";
+  meta.maintainers = with lib.maintainers; [ pluiedev ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        networking.firewall.enable = false;
-        networking.useDHCP = false;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      networking.firewall.enable = false;
+      networking.useDHCP = false;
 
-        services.marytts = {
-          enable = true;
-          inherit port;
+      services.marytts = {
+        enable = true;
+        inherit port;
 
-          voices = [
-            (pkgs.fetchzip {
-              url = "https://github.com/marytts/voice-bits1-hsmm/releases/download/v5.2/voice-bits1-hsmm-5.2.zip";
-              hash = "sha256-1nK+qZxjumMev7z5lgKr660NCKH5FDwvZ9sw/YYYeaA=";
-            })
-          ];
+        voices = [
+          (pkgs.fetchzip {
+            url = "https://github.com/marytts/voice-bits1-hsmm/releases/download/v5.2/voice-bits1-hsmm-5.2.zip";
+            hash = "sha256-1nK+qZxjumMev7z5lgKr660NCKH5FDwvZ9sw/YYYeaA=";
+          })
+        ];
 
-          userDictionaries = [
-            (pkgs.writeTextFile {
-              name = "userdict-en_US.txt";
-              destination = "/userdict-en_US.txt";
-              text = ''
-                amogus | @ - ' m @U - g @ s
-                Nixpkgs | n I k s - ' p { - k @ - dZ @ s
-              '';
-            })
-          ];
-        };
+        userDictionaries = [
+          (pkgs.writeTextFile {
+            name = "userdict-en_US.txt";
+            destination = "/userdict-en_US.txt";
+            text = ''
+              amogus | @ - ' m @U - g @ s
+              Nixpkgs | n I k s - ' p { - k @ - dZ @ s
+            '';
+          })
+        ];
       };
+    };
 
-    testScript = ''
-      from xml.etree import ElementTree
-      from urllib.parse import urlencode
+  testScript = ''
+    from xml.etree import ElementTree
+    from urllib.parse import urlencode
 
-      machine.wait_for_unit("marytts.service")
+    machine.wait_for_unit("marytts.service")
 
-      with subtest("Checking health of MaryTTS server"):
-        machine.wait_for_open_port(${toString port})
-        assert 'Mary TTS server' in machine.succeed("curl 'localhost:${toString port}/version'")
+    with subtest("Checking health of MaryTTS server"):
+      machine.wait_for_open_port(${toString port})
+      assert 'Mary TTS server' in machine.succeed("curl 'localhost:${toString port}/version'")
 
-      with subtest("Generating example MaryXML"):
-        query = urlencode({
-          'datatype': 'RAWMARYXML',
-          'locale': 'en_US',
-        })
-        xml = machine.succeed(f"curl 'localhost:${toString port}/exampletext?{query}'")
-        root = ElementTree.fromstring(xml)
-        text = " ".join(root.itertext()).strip()
-        assert text == "Welcome to the world of speech synthesis!"
+    with subtest("Generating example MaryXML"):
+      query = urlencode({
+        'datatype': 'RAWMARYXML',
+        'locale': 'en_US',
+      })
+      xml = machine.succeed(f"curl 'localhost:${toString port}/exampletext?{query}'")
+      root = ElementTree.fromstring(xml)
+      text = " ".join(root.itertext()).strip()
+      assert text == "Welcome to the world of speech synthesis!"
 
-      with subtest("Detecting custom voice"):
-        assert "bits1-hsmm" in machine.succeed("curl 'localhost:${toString port}/voices'")
+    with subtest("Detecting custom voice"):
+      assert "bits1-hsmm" in machine.succeed("curl 'localhost:${toString port}/voices'")
 
-      with subtest("Finding user dictionary"):
-        query = urlencode({
-          'INPUT_TEXT': 'amogus',
-          'INPUT_TYPE': 'TEXT',
-          'OUTPUT_TYPE': 'PHONEMES',
-          'LOCALE': 'en_US',
-        })
-        phonemes = machine.succeed(f"curl 'localhost:${toString port}/process?{query}'")
-        phonemes_tree = ElementTree.fromstring(phonemes)
-        print([i.get('ph') for i in phonemes_tree.iter('{http://mary.dfki.de/2002/MaryXML}t')])
-        assert ["@ - ' m @U - g @ s"] == [i.get('ph') for i in phonemes_tree.iter('{http://mary.dfki.de/2002/MaryXML}t')]
+    with subtest("Finding user dictionary"):
+      query = urlencode({
+        'INPUT_TEXT': 'amogus',
+        'INPUT_TYPE': 'TEXT',
+        'OUTPUT_TYPE': 'PHONEMES',
+        'LOCALE': 'en_US',
+      })
+      phonemes = machine.succeed(f"curl 'localhost:${toString port}/process?{query}'")
+      phonemes_tree = ElementTree.fromstring(phonemes)
+      print([i.get('ph') for i in phonemes_tree.iter('{http://mary.dfki.de/2002/MaryXML}t')])
+      assert ["@ - ' m @U - g @ s"] == [i.get('ph') for i in phonemes_tree.iter('{http://mary.dfki.de/2002/MaryXML}t')]
 
-      with subtest("Synthesizing"):
-        query = urlencode({
-          'INPUT_TEXT': 'Nixpkgs is a collection of over 100,000 software packages that can be installed with the Nix package manager.',
-          'INPUT_TYPE': 'TEXT',
-          'OUTPUT_TYPE': 'AUDIO',
-          'AUDIO': 'WAVE_FILE',
-          'LOCALE': 'en_US',
-        })
-        machine.succeed(f"curl 'localhost:${toString port}/process?{query}' -o ./audio.wav")
-        machine.copy_from_vm("./audio.wav")
-    '';
-  }
-)
+    with subtest("Synthesizing"):
+      query = urlencode({
+        'INPUT_TEXT': 'Nixpkgs is a collection of over 100,000 software packages that can be installed with the Nix package manager.',
+        'INPUT_TYPE': 'TEXT',
+        'OUTPUT_TYPE': 'AUDIO',
+        'AUDIO': 'WAVE_FILE',
+        'LOCALE': 'en_US',
+      })
+      machine.succeed(f"curl 'localhost:${toString port}/process?{query}' -o ./audio.wav")
+      machine.copy_from_vm("./audio.wav")
+  '';
+}
diff --git a/nixos/tests/mate-wayland.nix b/nixos/tests/mate-wayland.nix
index bf0989b2cf1d..42b88439357a 100644
--- a/nixos/tests/mate-wayland.nix
+++ b/nixos/tests/mate-wayland.nix
@@ -1,67 +1,65 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "mate-wayland";
+{ pkgs, lib, ... }:
+{
+  name = "mate-wayland";
 
-    meta.maintainers = lib.teams.mate.members;
+  meta.maintainers = lib.teams.mate.members;
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [
-          ./common/user-account.nix
-        ];
+  nodes.machine =
+    { ... }:
+    {
+      imports = [
+        ./common/user-account.nix
+      ];
 
-        services.xserver.enable = true;
-        services.displayManager = {
-          sddm.enable = true; # https://github.com/canonical/lightdm/issues/63
-          sddm.wayland.enable = true;
-          defaultSession = "MATE";
-          autoLogin = {
-            enable = true;
-            user = "alice";
-          };
+      services.xserver.enable = true;
+      services.displayManager = {
+        sddm.enable = true; # https://github.com/canonical/lightdm/issues/63
+        sddm.wayland.enable = true;
+        defaultSession = "MATE";
+        autoLogin = {
+          enable = true;
+          user = "alice";
         };
-        services.xserver.desktopManager.mate.enableWaylandSession = true;
-
-        # Need to switch to a different GPU driver than the default one (-vga std) so that wayfire can launch:
-        virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
       };
+      services.xserver.desktopManager.mate.enableWaylandSession = true;
 
-    enableOCR = true;
+      # Need to switch to a different GPU driver than the default one (-vga std) so that wayfire can launch:
+      virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
+    };
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-      in
-      ''
-        machine.wait_for_unit("display-manager.service")
+  enableOCR = true;
 
-        with subtest("Wait for Wayland server"):
-            machine.wait_for_file("/run/user/${toString user.uid}/wayland-1")
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+    in
+    ''
+      machine.wait_for_unit("display-manager.service")
 
-        with subtest("Check if MATE session components actually start"):
-            for i in ["wayfire", "mate-panel", "mate-wayland.sh"]:
-                machine.wait_until_succeeds(f"pgrep {i}")
-            machine.wait_until_succeeds("pgrep -f mate-wayland-components.sh")
-            # It is expected that WorkspaceSwitcherApplet doesn't work in Wayland
-            machine.wait_for_text('(panel|Factory|Workspace|Switcher|Applet|configuration)')
+      with subtest("Wait for Wayland server"):
+          machine.wait_for_file("/run/user/${toString user.uid}/wayland-1")
 
-        with subtest("Check if various environment variables are set"):
-            cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf mate-panel)/environ"
-            machine.succeed(f"{cmd} | grep 'XDG_SESSION_TYPE' | grep 'wayland'")
-            machine.succeed(f"{cmd} | grep 'XDG_SESSION_DESKTOP' | grep 'MATE'")
-            machine.succeed(f"{cmd} | grep 'MATE_PANEL_APPLETS_DIR' | grep '${pkgs.mate.mate-panel-with-applets.pname}'")
+      with subtest("Check if MATE session components actually start"):
+          for i in ["wayfire", "mate-panel", "mate-wayland.sh"]:
+              machine.wait_until_succeeds(f"pgrep {i}")
+          machine.wait_until_succeeds("pgrep -f mate-wayland-components.sh")
+          # It is expected that WorkspaceSwitcherApplet doesn't work in Wayland
+          machine.wait_for_text('(panel|Factory|Workspace|Switcher|Applet|configuration)')
 
-        with subtest("Check if Wayfire config is properly configured"):
-            for i in ["button_style = mate", "firedecor", "mate-wayland-components.sh"]:
-                machine.wait_until_succeeds(f"cat /home/${user.name}/.config/mate/wayfire.ini | grep '{i}'")
+      with subtest("Check if various environment variables are set"):
+          cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf mate-panel)/environ"
+          machine.succeed(f"{cmd} | grep 'XDG_SESSION_TYPE' | grep 'wayland'")
+          machine.succeed(f"{cmd} | grep 'XDG_SESSION_DESKTOP' | grep 'MATE'")
+          machine.succeed(f"{cmd} | grep 'MATE_PANEL_APPLETS_DIR' | grep '${pkgs.mate.mate-panel-with-applets.pname}'")
 
-        with subtest("Check if Wayfire has ever coredumped"):
-            machine.fail("coredumpctl --json=short | grep wayfire")
-            machine.sleep(10)
-            machine.screenshot("screen")
-      '';
-  }
-)
+      with subtest("Check if Wayfire config is properly configured"):
+          for i in ["button_style = mate", "firedecor", "mate-wayland-components.sh"]:
+              machine.wait_until_succeeds(f"cat /home/${user.name}/.config/mate/wayfire.ini | grep '{i}'")
+
+      with subtest("Check if Wayfire has ever coredumped"):
+          machine.fail("coredumpctl --json=short | grep wayfire")
+          machine.sleep(10)
+          machine.screenshot("screen")
+    '';
+}
diff --git a/nixos/tests/mate.nix b/nixos/tests/mate.nix
index d0847be5ffa9..6112044837db 100644
--- a/nixos/tests/mate.nix
+++ b/nixos/tests/mate.nix
@@ -1,92 +1,90 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "mate";
+{ pkgs, lib, ... }:
+{
+  name = "mate";
 
-    meta = {
-      maintainers = lib.teams.mate.members;
-    };
+  meta = {
+    maintainers = lib.teams.mate.members;
+  };
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [
-          ./common/user-account.nix
-        ];
+  nodes.machine =
+    { ... }:
+    {
+      imports = [
+        ./common/user-account.nix
+      ];
 
-        services.xserver.enable = true;
+      services.xserver.enable = true;
 
-        services.xserver.displayManager = {
-          lightdm.enable = true;
-          autoLogin = {
-            enable = true;
-            user = "alice";
-          };
+      services.xserver.displayManager = {
+        lightdm.enable = true;
+        autoLogin = {
+          enable = true;
+          user = "alice";
         };
-
-        services.xserver.desktopManager.mate.enable = true;
       };
 
-    enableOCR = true;
+      services.xserver.desktopManager.mate.enable = true;
+    };
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-        env = "DISPLAY=:0.0 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus";
-      in
-      ''
-        with subtest("Wait for login"):
-            machine.wait_for_x()
-            machine.wait_for_file("${user.home}/.Xauthority")
-            machine.succeed("xauth merge ${user.home}/.Xauthority")
+  enableOCR = true;
 
-        with subtest("Check that logging in has given the user ownership of devices"):
-            machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+      env = "DISPLAY=:0.0 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus";
+    in
+    ''
+      with subtest("Wait for login"):
+          machine.wait_for_x()
+          machine.wait_for_file("${user.home}/.Xauthority")
+          machine.succeed("xauth merge ${user.home}/.Xauthority")
 
-        with subtest("Check if MATE session components actually start"):
-            machine.wait_until_succeeds("pgrep marco")
-            machine.wait_for_window("marco")
-            machine.wait_until_succeeds("pgrep mate-panel")
-            machine.wait_for_window("Top Panel")
-            machine.wait_for_window("Bottom Panel")
-            machine.wait_until_succeeds("pgrep caja")
-            machine.wait_for_window("Caja")
-            machine.wait_for_text('(Applications|Places|System)')
-            machine.wait_for_text('(Computer|Home|Trash)')
+      with subtest("Check that logging in has given the user ownership of devices"):
+          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
 
-        with subtest("Check if various environment variables are set"):
-            machine.succeed("xargs --null --max-args=1 echo < /proc/$(pgrep -xf marco)/environ | grep 'XDG_CURRENT_DESKTOP' | grep 'MATE'")
-            # From mate-panel-with-applets packaging
-            machine.succeed("xargs --null --max-args=1 echo < /proc/$(pgrep -xf mate-panel)/environ | grep 'MATE_PANEL_APPLETS_DIR' | grep '${pkgs.mate.mate-panel-with-applets.pname}'")
+      with subtest("Check if MATE session components actually start"):
+          machine.wait_until_succeeds("pgrep marco")
+          machine.wait_for_window("marco")
+          machine.wait_until_succeeds("pgrep mate-panel")
+          machine.wait_for_window("Top Panel")
+          machine.wait_for_window("Bottom Panel")
+          machine.wait_until_succeeds("pgrep caja")
+          machine.wait_for_window("Caja")
+          machine.wait_for_text('(Applications|Places|System)')
+          machine.wait_for_text('(Computer|Home|Trash)')
 
-        with subtest("Check if applets are built with in-process support"):
-            # This is needed for Wayland support
-            machine.fail("pgrep -fa clock-applet")
+      with subtest("Check if various environment variables are set"):
+          machine.succeed("xargs --null --max-args=1 echo < /proc/$(pgrep -xf marco)/environ | grep 'XDG_CURRENT_DESKTOP' | grep 'MATE'")
+          # From mate-panel-with-applets packaging
+          machine.succeed("xargs --null --max-args=1 echo < /proc/$(pgrep -xf mate-panel)/environ | grep 'MATE_PANEL_APPLETS_DIR' | grep '${pkgs.mate.mate-panel-with-applets.pname}'")
 
-        with subtest("Lock the screen"):
-            machine.wait_until_succeeds("su - ${user.name} -c '${env} mate-screensaver-command -q' | grep 'The screensaver is inactive'")
-            machine.succeed("su - ${user.name} -c '${env} mate-screensaver-command -l >&2 &'")
-            machine.wait_until_succeeds("su - ${user.name} -c '${env} mate-screensaver-command -q' | grep 'The screensaver is active'")
-            machine.sleep(2)
-            machine.send_chars("${user.password}", delay=0.2)
-            machine.wait_for_text("${user.description}")
-            machine.screenshot("screensaver")
-            machine.send_chars("\n")
-            machine.wait_until_succeeds("su - ${user.name} -c '${env} mate-screensaver-command -q' | grep 'The screensaver is inactive'")
+      with subtest("Check if applets are built with in-process support"):
+          # This is needed for Wayland support
+          machine.fail("pgrep -fa clock-applet")
 
-        with subtest("Open MATE control center"):
-            machine.succeed("su - ${user.name} -c '${env} mate-control-center >&2 &'")
-            machine.wait_for_window("Control Center")
-            machine.wait_for_text('(Groups|Administration|Hardware)')
+      with subtest("Lock the screen"):
+          machine.wait_until_succeeds("su - ${user.name} -c '${env} mate-screensaver-command -q' | grep 'The screensaver is inactive'")
+          machine.succeed("su - ${user.name} -c '${env} mate-screensaver-command -l >&2 &'")
+          machine.wait_until_succeeds("su - ${user.name} -c '${env} mate-screensaver-command -q' | grep 'The screensaver is active'")
+          machine.sleep(2)
+          machine.send_chars("${user.password}", delay=0.2)
+          machine.wait_for_text("${user.description}")
+          machine.screenshot("screensaver")
+          machine.send_chars("\n")
+          machine.wait_until_succeeds("su - ${user.name} -c '${env} mate-screensaver-command -q' | grep 'The screensaver is inactive'")
 
-        with subtest("Open MATE terminal"):
-            machine.succeed("su - ${user.name} -c '${env} mate-terminal >&2 &'")
-            machine.wait_for_window("Terminal")
+      with subtest("Open MATE control center"):
+          machine.succeed("su - ${user.name} -c '${env} mate-control-center >&2 &'")
+          machine.wait_for_window("Control Center")
+          machine.wait_for_text('(Groups|Administration|Hardware)')
 
-        with subtest("Check if MATE has ever coredumped"):
-            machine.fail("coredumpctl --json=short | grep -E 'mate|marco|caja'")
-            machine.screenshot("screen")
-      '';
-  }
-)
+      with subtest("Open MATE terminal"):
+          machine.succeed("su - ${user.name} -c '${env} mate-terminal >&2 &'")
+          machine.wait_for_window("Terminal")
+
+      with subtest("Check if MATE has ever coredumped"):
+          machine.fail("coredumpctl --json=short | grep -E 'mate|marco|caja'")
+          machine.screenshot("screen")
+    '';
+}
diff --git a/nixos/tests/matrix/conduit.nix b/nixos/tests/matrix/conduit.nix
index b38549b23ab4..874e7672812b 100644
--- a/nixos/tests/matrix/conduit.nix
+++ b/nixos/tests/matrix/conduit.nix
@@ -1,98 +1,96 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  let
-    name = "conduit";
-  in
-  {
-    name = "matrix-conduit";
+{ pkgs, ... }:
+let
+  name = "conduit";
+in
+{
+  name = "matrix-conduit";
 
-    nodes = {
-      conduit = args: {
-        services.matrix-conduit = {
-          enable = true;
-          settings.global.server_name = name;
-          settings.global.allow_registration = true;
-          extraEnvironment.RUST_BACKTRACE = "yes";
-        };
-        services.nginx = {
-          enable = true;
-          virtualHosts.${name} = {
-            enableACME = false;
-            forceSSL = false;
-            enableSSL = false;
+  nodes = {
+    conduit = args: {
+      services.matrix-conduit = {
+        enable = true;
+        settings.global.server_name = name;
+        settings.global.allow_registration = true;
+        extraEnvironment.RUST_BACKTRACE = "yes";
+      };
+      services.nginx = {
+        enable = true;
+        virtualHosts.${name} = {
+          enableACME = false;
+          forceSSL = false;
+          enableSSL = false;
 
-            locations."/_matrix" = {
-              proxyPass = "http://[::1]:6167";
-            };
+          locations."/_matrix" = {
+            proxyPass = "http://[::1]:6167";
           };
         };
-        networking.firewall.allowedTCPPorts = [ 80 ];
       };
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [
-            (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
-              import asyncio
-
-              from nio import AsyncClient
-
-
-              async def main() -> None:
-                  # Connect to conduit
-                  client = AsyncClient("http://conduit:80", "alice")
-
-                  # Register as user alice
-                  response = await client.register("alice", "my-secret-password")
-
-                  # Log in as user alice
-                  response = await client.login("my-secret-password")
-
-                  # Create a new room
-                  response = await client.room_create(federate=False)
-                  room_id = response.room_id
-
-                  # Join the room
-                  response = await client.join(room_id)
-
-                  # Send a message to the room
-                  response = await client.room_send(
-                      room_id=room_id,
-                      message_type="m.room.message",
-                      content={
-                          "msgtype": "m.text",
-                          "body": "Hello conduit!"
-                      }
-                  )
-
-                  # Sync responses
-                  response = await client.sync(timeout=30000)
-
-                  # Check the message was received by conduit
-                  last_message = response.rooms.join[room_id].timeline.events[-1].body
-                  assert last_message == "Hello conduit!"
-
-                  # Leave the room
-                  response = await client.room_leave(room_id)
-
-                  # Close the client
-                  await client.close()
-
-              asyncio.get_event_loop().run_until_complete(main())
-            '')
-          ];
-        };
+      networking.firewall.allowedTCPPorts = [ 80 ];
     };
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
+            import asyncio
 
-    testScript = ''
-      start_all()
+            from nio import AsyncClient
 
-      with subtest("start conduit"):
-            conduit.wait_for_unit("conduit.service")
-            conduit.wait_for_open_port(80)
 
-      with subtest("ensure messages can be exchanged"):
-            client.succeed("do_test")
-    '';
-  }
-)
+            async def main() -> None:
+                # Connect to conduit
+                client = AsyncClient("http://conduit:80", "alice")
+
+                # Register as user alice
+                response = await client.register("alice", "my-secret-password")
+
+                # Log in as user alice
+                response = await client.login("my-secret-password")
+
+                # Create a new room
+                response = await client.room_create(federate=False)
+                room_id = response.room_id
+
+                # Join the room
+                response = await client.join(room_id)
+
+                # Send a message to the room
+                response = await client.room_send(
+                    room_id=room_id,
+                    message_type="m.room.message",
+                    content={
+                        "msgtype": "m.text",
+                        "body": "Hello conduit!"
+                    }
+                )
+
+                # Sync responses
+                response = await client.sync(timeout=30000)
+
+                # Check the message was received by conduit
+                last_message = response.rooms.join[room_id].timeline.events[-1].body
+                assert last_message == "Hello conduit!"
+
+                # Leave the room
+                response = await client.room_leave(room_id)
+
+                # Close the client
+                await client.close()
+
+            asyncio.get_event_loop().run_until_complete(main())
+          '')
+        ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    with subtest("start conduit"):
+          conduit.wait_for_unit("conduit.service")
+          conduit.wait_for_open_port(80)
+
+    with subtest("ensure messages can be exchanged"):
+          client.succeed("do_test")
+  '';
+}
diff --git a/nixos/tests/matrix/dendrite.nix b/nixos/tests/matrix/dendrite.nix
index 9796423a5bb7..4477f522a37b 100644
--- a/nixos/tests/matrix/dendrite.nix
+++ b/nixos/tests/matrix/dendrite.nix
@@ -1,102 +1,100 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  let
-    homeserverUrl = "http://homeserver:8008";
+{ pkgs, ... }:
+let
+  homeserverUrl = "http://homeserver:8008";
 
-    private_key = pkgs.runCommand "matrix_key.pem" {
-      buildInputs = [ pkgs.dendrite ];
-    } "generate-keys --private-key $out";
-  in
-  {
-    name = "dendrite";
-    meta = with pkgs.lib; {
-      maintainers = teams.matrix.members;
-    };
+  private_key = pkgs.runCommand "matrix_key.pem" {
+    buildInputs = [ pkgs.dendrite ];
+  } "generate-keys --private-key $out";
+in
+{
+  name = "dendrite";
+  meta = with pkgs.lib; {
+    maintainers = teams.matrix.members;
+  };
 
-    nodes = {
-      homeserver =
-        { pkgs, ... }:
-        {
-          services.dendrite = {
-            enable = true;
-            loadCredential = [ "test_private_key:${private_key}" ];
-            openRegistration = true;
-            settings = {
-              global.server_name = "test-dendrite-server.com";
-              global.private_key = "$CREDENTIALS_DIRECTORY/test_private_key";
-              client_api.registration_disabled = false;
-            };
+  nodes = {
+    homeserver =
+      { pkgs, ... }:
+      {
+        services.dendrite = {
+          enable = true;
+          loadCredential = [ "test_private_key:${private_key}" ];
+          openRegistration = true;
+          settings = {
+            global.server_name = "test-dendrite-server.com";
+            global.private_key = "$CREDENTIALS_DIRECTORY/test_private_key";
+            client_api.registration_disabled = false;
           };
-
-          networking.firewall.allowedTCPPorts = [ 8008 ];
         };
 
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [
-            (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
-              import asyncio
+        networking.firewall.allowedTCPPorts = [ 8008 ];
+      };
 
-              from nio import AsyncClient
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
+            import asyncio
+
+            from nio import AsyncClient
 
 
-              async def main() -> None:
-                  # Connect to dendrite
-                  client = AsyncClient("http://homeserver:8008", "alice")
+            async def main() -> None:
+                # Connect to dendrite
+                client = AsyncClient("http://homeserver:8008", "alice")
 
-                  # Register as user alice
-                  response = await client.register("alice", "my-secret-password")
+                # Register as user alice
+                response = await client.register("alice", "my-secret-password")
 
-                  # Log in as user alice
-                  response = await client.login("my-secret-password")
+                # Log in as user alice
+                response = await client.login("my-secret-password")
 
-                  # Create a new room
-                  response = await client.room_create(federate=False)
-                  room_id = response.room_id
+                # Create a new room
+                response = await client.room_create(federate=False)
+                room_id = response.room_id
 
-                  # Join the room
-                  response = await client.join(room_id)
+                # Join the room
+                response = await client.join(room_id)
 
-                  # Send a message to the room
-                  response = await client.room_send(
-                      room_id=room_id,
-                      message_type="m.room.message",
-                      content={
-                          "msgtype": "m.text",
-                          "body": "Hello world!"
-                      }
-                  )
+                # Send a message to the room
+                response = await client.room_send(
+                    room_id=room_id,
+                    message_type="m.room.message",
+                    content={
+                        "msgtype": "m.text",
+                        "body": "Hello world!"
+                    }
+                )
 
-                  # Sync responses
-                  response = await client.sync(timeout=30000)
+                # Sync responses
+                response = await client.sync(timeout=30000)
 
-                  # Check the message was received by dendrite
-                  last_message = response.rooms.join[room_id].timeline.events[-1].body
-                  assert last_message == "Hello world!"
+                # Check the message was received by dendrite
+                last_message = response.rooms.join[room_id].timeline.events[-1].body
+                assert last_message == "Hello world!"
 
-                  # Leave the room
-                  response = await client.room_leave(room_id)
+                # Leave the room
+                response = await client.room_leave(room_id)
 
-                  # Close the client
-                  await client.close()
+                # Close the client
+                await client.close()
 
-              asyncio.get_event_loop().run_until_complete(main())
-            '')
-          ];
-        };
-    };
+            asyncio.get_event_loop().run_until_complete(main())
+          '')
+        ];
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      with subtest("start the homeserver"):
-          homeserver.wait_for_unit("dendrite.service")
-          homeserver.wait_for_open_port(8008)
+    with subtest("start the homeserver"):
+        homeserver.wait_for_unit("dendrite.service")
+        homeserver.wait_for_open_port(8008)
 
-      with subtest("ensure messages can be exchanged"):
-          client.succeed("do_test")
-    '';
+    with subtest("ensure messages can be exchanged"):
+        client.succeed("do_test")
+  '';
 
-  }
-)
+}
diff --git a/nixos/tests/matrix/mautrix-meta-postgres.nix b/nixos/tests/matrix/mautrix-meta-postgres.nix
index 99ed56477df3..72f12aa8db6a 100644
--- a/nixos/tests/matrix/mautrix-meta-postgres.nix
+++ b/nixos/tests/matrix/mautrix-meta-postgres.nix
@@ -1,236 +1,234 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  let
-    homeserverDomain = "server";
-    homeserverUrl = "http://server:8008";
-    userName = "alice";
-    botUserName = "instagrambot";
+{ pkgs, ... }:
+let
+  homeserverDomain = "server";
+  homeserverUrl = "http://server:8008";
+  userName = "alice";
+  botUserName = "instagrambot";
 
-    asToken = "this-is-my-totally-randomly-generated-as-token";
-    hsToken = "this-is-my-totally-randomly-generated-hs-token";
-  in
-  {
-    name = "mautrix-meta-postgres";
-    meta.maintainers = pkgs.mautrix-meta.meta.maintainers;
+  asToken = "this-is-my-totally-randomly-generated-as-token";
+  hsToken = "this-is-my-totally-randomly-generated-hs-token";
+in
+{
+  name = "mautrix-meta-postgres";
+  meta.maintainers = pkgs.mautrix-meta.meta.maintainers;
 
-    nodes = {
-      server =
-        { config, pkgs, ... }:
-        {
-          services.postgresql = {
-            enable = true;
+  nodes = {
+    server =
+      { config, pkgs, ... }:
+      {
+        services.postgresql = {
+          enable = true;
 
-            ensureUsers = [
-              {
-                name = "mautrix-meta-instagram";
-                ensureDBOwnership = true;
-              }
-            ];
+          ensureUsers = [
+            {
+              name = "mautrix-meta-instagram";
+              ensureDBOwnership = true;
+            }
+          ];
 
-            ensureDatabases = [
-              "mautrix-meta-instagram"
-            ];
-          };
-
-          systemd.services.mautrix-meta-instagram = {
-            wants = [ "postgres.service" ];
-            after = [ "postgres.service" ];
-          };
-
-          services.matrix-synapse = {
-            enable = true;
-            settings = {
-              database.name = "sqlite3";
-
-              enable_registration = true;
-
-              # don't use this in production, always use some form of verification
-              enable_registration_without_verification = true;
-
-              listeners = [
-                {
-                  # The default but tls=false
-                  bind_addresses = [
-                    "0.0.0.0"
-                  ];
-                  port = 8008;
-                  resources = [
-                    {
-                      "compress" = true;
-                      "names" = [ "client" ];
-                    }
-                    {
-                      "compress" = false;
-                      "names" = [ "federation" ];
-                    }
-                  ];
-                  tls = false;
-                  type = "http";
-                }
-              ];
-            };
-          };
-
-          services.mautrix-meta.instances.instagram = {
-            enable = true;
-
-            environmentFile = pkgs.writeText ''my-secrets'' ''
-              AS_TOKEN=${asToken}
-              HS_TOKEN=${hsToken}
-            '';
-
-            settings = {
-              homeserver = {
-                address = homeserverUrl;
-                domain = homeserverDomain;
-              };
-
-              appservice = {
-                port = 8009;
-
-                as_token = "$AS_TOKEN";
-                hs_token = "$HS_TOKEN";
-
-                database = {
-                  type = "postgres";
-                  uri = "postgres:///mautrix-meta-instagram?host=/var/run/postgresql";
-                };
-
-                bot.username = botUserName;
-              };
-
-              bridge.permissions."@${userName}:server" = "user";
-            };
-          };
-
-          networking.firewall.allowedTCPPorts = [
-            8008
-            8009
+          ensureDatabases = [
+            "mautrix-meta-instagram"
           ];
         };
 
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [
-            (pkgs.writers.writePython3Bin "do_test"
+        systemd.services.mautrix-meta-instagram = {
+          wants = [ "postgres.service" ];
+          after = [ "postgres.service" ];
+        };
+
+        services.matrix-synapse = {
+          enable = true;
+          settings = {
+            database.name = "sqlite3";
+
+            enable_registration = true;
+
+            # don't use this in production, always use some form of verification
+            enable_registration_without_verification = true;
+
+            listeners = [
               {
-                libraries = [ pkgs.python3Packages.matrix-nio ];
-                flakeIgnore = [
-                  # We don't live in the dark ages anymore.
-                  # Languages like Python that are whitespace heavy will overrun
-                  # 79 characters..
-                  "E501"
+                # The default but tls=false
+                bind_addresses = [
+                  "0.0.0.0"
                 ];
+                port = 8008;
+                resources = [
+                  {
+                    "compress" = true;
+                    "names" = [ "client" ];
+                  }
+                  {
+                    "compress" = false;
+                    "names" = [ "federation" ];
+                  }
+                ];
+                tls = false;
+                type = "http";
               }
-              ''
-                import sys
-                import functools
-                import asyncio
-
-                from nio import AsyncClient, RoomMessageNotice, RoomCreateResponse, RoomInviteResponse
-
-
-                async def message_callback(matrix: AsyncClient, msg: str, _r, e):
-                    print("Received matrix text message: ", e)
-                    assert msg in e.body
-                    exit(0)  # Success!
-
-
-                async def run(homeserver: str):
-                    matrix = AsyncClient(homeserver)
-                    response = await matrix.register("${userName}", "foobar")
-                    print("Matrix register response: ", response)
-
-                    # Open a DM with the bridge bot
-                    response = await matrix.room_create()
-                    print("Matrix create room response:", response)
-                    assert isinstance(response, RoomCreateResponse)
-                    room_id = response.room_id
-
-                    response = await matrix.room_invite(room_id, "@${botUserName}:${homeserverDomain}")
-                    assert isinstance(response, RoomInviteResponse)
-
-                    callback = functools.partial(
-                        message_callback, matrix, "Hello, I'm an Instagram bridge bot."
-                    )
-                    matrix.add_event_callback(callback, RoomMessageNotice)
-
-                    print("Waiting for matrix message...")
-                    await matrix.sync_forever(timeout=30000)
-
-
-                if __name__ == "__main__":
-                    asyncio.run(run(sys.argv[1]))
-              ''
-            )
-          ];
+            ];
+          };
         };
-    };
 
-    testScript = ''
-      def extract_token(data):
-          stdout = data[1]
-          stdout = stdout.strip()
-          line = stdout.split('\n')[-1]
-          return line.split(':')[-1].strip("\" '\n")
+        services.mautrix-meta.instances.instagram = {
+          enable = true;
 
-      def get_token_from(token, file):
-          data = server.execute(f"cat {file} | grep {token}")
-          return extract_token(data)
+          environmentFile = pkgs.writeText ''my-secrets'' ''
+            AS_TOKEN=${asToken}
+            HS_TOKEN=${hsToken}
+          '';
 
-      def get_as_token_from(file):
-          return get_token_from("as_token", file)
+          settings = {
+            homeserver = {
+              address = homeserverUrl;
+              domain = homeserverDomain;
+            };
 
-      def get_hs_token_from(file):
-          return get_token_from("hs_token", file)
+            appservice = {
+              port = 8009;
 
-      config_yaml = "/var/lib/mautrix-meta-instagram/config.yaml"
-      registration_yaml = "/var/lib/mautrix-meta-instagram/meta-registration.yaml"
+              as_token = "$AS_TOKEN";
+              hs_token = "$HS_TOKEN";
 
-      expected_as_token = "${asToken}"
-      expected_hs_token = "${hsToken}"
+              database = {
+                type = "postgres";
+                uri = "postgres:///mautrix-meta-instagram?host=/var/run/postgresql";
+              };
 
-      start_all()
+              bot.username = botUserName;
+            };
 
-      with subtest("start the server"):
-          # bridge
-          server.wait_for_unit("mautrix-meta-instagram.service")
+            bridge.permissions."@${userName}:server" = "user";
+          };
+        };
 
-          # homeserver
-          server.wait_for_unit("matrix-synapse.service")
+        networking.firewall.allowedTCPPorts = [
+          8008
+          8009
+        ];
+      };
 
-          server.wait_for_open_port(8008)
-          # Bridge only opens the port after it contacts the homeserver
-          server.wait_for_open_port(8009)
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          (pkgs.writers.writePython3Bin "do_test"
+            {
+              libraries = [ pkgs.python3Packages.matrix-nio ];
+              flakeIgnore = [
+                # We don't live in the dark ages anymore.
+                # Languages like Python that are whitespace heavy will overrun
+                # 79 characters..
+                "E501"
+              ];
+            }
+            ''
+              import sys
+              import functools
+              import asyncio
 
-      with subtest("ensure messages can be exchanged"):
-          client.succeed("do_test ${homeserverUrl} >&2")
+              from nio import AsyncClient, RoomMessageNotice, RoomCreateResponse, RoomInviteResponse
 
-      with subtest("ensure as_token, hs_token match from environment file"):
-          as_token = get_as_token_from(config_yaml)
-          hs_token = get_hs_token_from(config_yaml)
-          as_token_registration = get_as_token_from(registration_yaml)
-          hs_token_registration = get_hs_token_from(registration_yaml)
 
-          assert as_token == expected_as_token, f"as_token in config should match the one specified (is: {as_token}, expected: {expected_as_token})"
-          assert hs_token == expected_hs_token, f"hs_token in config should match the one specified (is: {hs_token}, expected: {expected_hs_token})"
-          assert as_token_registration == expected_as_token, f"as_token in registration should match the one specified (is: {as_token_registration}, expected: {expected_as_token})"
-          assert hs_token_registration == expected_hs_token, f"hs_token in registration should match the one specified (is: {hs_token_registration}, expected: {expected_hs_token})"
+              async def message_callback(matrix: AsyncClient, msg: str, _r, e):
+                  print("Received matrix text message: ", e)
+                  assert msg in e.body
+                  exit(0)  # Success!
 
-      with subtest("ensure as_token and hs_token stays same after restart"):
-          server.systemctl("restart mautrix-meta-instagram")
-          server.wait_for_open_port(8009)
 
-          as_token = get_as_token_from(config_yaml)
-          hs_token = get_hs_token_from(config_yaml)
-          as_token_registration = get_as_token_from(registration_yaml)
-          hs_token_registration = get_hs_token_from(registration_yaml)
+              async def run(homeserver: str):
+                  matrix = AsyncClient(homeserver)
+                  response = await matrix.register("${userName}", "foobar")
+                  print("Matrix register response: ", response)
 
-          assert as_token == expected_as_token, f"as_token in config should match the one specified (is: {as_token}, expected: {expected_as_token})"
-          assert hs_token == expected_hs_token, f"hs_token in config should match the one specified (is: {hs_token}, expected: {expected_hs_token})"
-          assert as_token_registration == expected_as_token, f"as_token in registration should match the one specified (is: {as_token_registration}, expected: {expected_as_token})"
-          assert hs_token_registration == expected_hs_token, f"hs_token in registration should match the one specified (is: {hs_token_registration}, expected: {expected_hs_token})"
-    '';
-  }
-)
+                  # Open a DM with the bridge bot
+                  response = await matrix.room_create()
+                  print("Matrix create room response:", response)
+                  assert isinstance(response, RoomCreateResponse)
+                  room_id = response.room_id
+
+                  response = await matrix.room_invite(room_id, "@${botUserName}:${homeserverDomain}")
+                  assert isinstance(response, RoomInviteResponse)
+
+                  callback = functools.partial(
+                      message_callback, matrix, "Hello, I'm an Instagram bridge bot."
+                  )
+                  matrix.add_event_callback(callback, RoomMessageNotice)
+
+                  print("Waiting for matrix message...")
+                  await matrix.sync_forever(timeout=30000)
+
+
+              if __name__ == "__main__":
+                  asyncio.run(run(sys.argv[1]))
+            ''
+          )
+        ];
+      };
+  };
+
+  testScript = ''
+    def extract_token(data):
+        stdout = data[1]
+        stdout = stdout.strip()
+        line = stdout.split('\n')[-1]
+        return line.split(':')[-1].strip("\" '\n")
+
+    def get_token_from(token, file):
+        data = server.execute(f"cat {file} | grep {token}")
+        return extract_token(data)
+
+    def get_as_token_from(file):
+        return get_token_from("as_token", file)
+
+    def get_hs_token_from(file):
+        return get_token_from("hs_token", file)
+
+    config_yaml = "/var/lib/mautrix-meta-instagram/config.yaml"
+    registration_yaml = "/var/lib/mautrix-meta-instagram/meta-registration.yaml"
+
+    expected_as_token = "${asToken}"
+    expected_hs_token = "${hsToken}"
+
+    start_all()
+
+    with subtest("start the server"):
+        # bridge
+        server.wait_for_unit("mautrix-meta-instagram.service")
+
+        # homeserver
+        server.wait_for_unit("matrix-synapse.service")
+
+        server.wait_for_open_port(8008)
+        # Bridge only opens the port after it contacts the homeserver
+        server.wait_for_open_port(8009)
+
+    with subtest("ensure messages can be exchanged"):
+        client.succeed("do_test ${homeserverUrl} >&2")
+
+    with subtest("ensure as_token, hs_token match from environment file"):
+        as_token = get_as_token_from(config_yaml)
+        hs_token = get_hs_token_from(config_yaml)
+        as_token_registration = get_as_token_from(registration_yaml)
+        hs_token_registration = get_hs_token_from(registration_yaml)
+
+        assert as_token == expected_as_token, f"as_token in config should match the one specified (is: {as_token}, expected: {expected_as_token})"
+        assert hs_token == expected_hs_token, f"hs_token in config should match the one specified (is: {hs_token}, expected: {expected_hs_token})"
+        assert as_token_registration == expected_as_token, f"as_token in registration should match the one specified (is: {as_token_registration}, expected: {expected_as_token})"
+        assert hs_token_registration == expected_hs_token, f"hs_token in registration should match the one specified (is: {hs_token_registration}, expected: {expected_hs_token})"
+
+    with subtest("ensure as_token and hs_token stays same after restart"):
+        server.systemctl("restart mautrix-meta-instagram")
+        server.wait_for_open_port(8009)
+
+        as_token = get_as_token_from(config_yaml)
+        hs_token = get_hs_token_from(config_yaml)
+        as_token_registration = get_as_token_from(registration_yaml)
+        hs_token_registration = get_hs_token_from(registration_yaml)
+
+        assert as_token == expected_as_token, f"as_token in config should match the one specified (is: {as_token}, expected: {expected_as_token})"
+        assert hs_token == expected_hs_token, f"hs_token in config should match the one specified (is: {hs_token}, expected: {expected_hs_token})"
+        assert as_token_registration == expected_as_token, f"as_token in registration should match the one specified (is: {as_token_registration}, expected: {expected_as_token})"
+        assert hs_token_registration == expected_hs_token, f"hs_token in registration should match the one specified (is: {hs_token_registration}, expected: {expected_hs_token})"
+  '';
+}
diff --git a/nixos/tests/matrix/mautrix-meta-sqlite.nix b/nixos/tests/matrix/mautrix-meta-sqlite.nix
index ddd38e8f0b00..d4692dec718e 100644
--- a/nixos/tests/matrix/mautrix-meta-sqlite.nix
+++ b/nixos/tests/matrix/mautrix-meta-sqlite.nix
@@ -1,260 +1,258 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  let
-    homeserverDomain = "server";
-    homeserverUrl = "http://server:8008";
-    username = "alice";
-    instagramBotUsername = "instagrambot";
-    facebookBotUsername = "facebookbot";
-  in
-  {
-    name = "mautrix-meta-sqlite";
-    meta.maintainers = pkgs.mautrix-meta.meta.maintainers;
+{ pkgs, ... }:
+let
+  homeserverDomain = "server";
+  homeserverUrl = "http://server:8008";
+  username = "alice";
+  instagramBotUsername = "instagrambot";
+  facebookBotUsername = "facebookbot";
+in
+{
+  name = "mautrix-meta-sqlite";
+  meta.maintainers = pkgs.mautrix-meta.meta.maintainers;
 
-    nodes = {
-      server =
-        { config, pkgs, ... }:
-        {
-          services.matrix-synapse = {
-            enable = true;
-            settings = {
-              database.name = "sqlite3";
+  nodes = {
+    server =
+      { config, pkgs, ... }:
+      {
+        services.matrix-synapse = {
+          enable = true;
+          settings = {
+            database.name = "sqlite3";
 
-              enable_registration = true;
+            enable_registration = true;
 
-              # don't use this in production, always use some form of verification
-              enable_registration_without_verification = true;
+            # don't use this in production, always use some form of verification
+            enable_registration_without_verification = true;
 
-              listeners = [
-                {
-                  # The default but tls=false
-                  bind_addresses = [
-                    "0.0.0.0"
-                  ];
-                  port = 8008;
-                  resources = [
-                    {
-                      "compress" = true;
-                      "names" = [ "client" ];
-                    }
-                    {
-                      "compress" = false;
-                      "names" = [ "federation" ];
-                    }
-                  ];
-                  tls = false;
-                  type = "http";
-                }
+            listeners = [
+              {
+                # The default but tls=false
+                bind_addresses = [
+                  "0.0.0.0"
+                ];
+                port = 8008;
+                resources = [
+                  {
+                    "compress" = true;
+                    "names" = [ "client" ];
+                  }
+                  {
+                    "compress" = false;
+                    "names" = [ "federation" ];
+                  }
+                ];
+                tls = false;
+                type = "http";
+              }
+            ];
+          };
+        };
+
+        services.mautrix-meta.instances.facebook = {
+          enable = true;
+
+          settings = {
+            homeserver = {
+              address = homeserverUrl;
+              domain = homeserverDomain;
+            };
+
+            appservice = {
+              port = 8009;
+
+              bot.username = facebookBotUsername;
+            };
+
+            bridge.permissions."@${username}:server" = "user";
+          };
+        };
+
+        services.mautrix-meta.instances.instagram = {
+          enable = true;
+
+          settings = {
+            homeserver = {
+              address = homeserverUrl;
+              domain = homeserverDomain;
+            };
+
+            appservice = {
+              port = 8010;
+
+              bot.username = instagramBotUsername;
+            };
+
+            bridge.permissions."@${username}:server" = "user";
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [ 8008 ];
+      };
+
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          (pkgs.writers.writePython3Bin "register_user"
+            {
+              libraries = [ pkgs.python3Packages.matrix-nio ];
+              flakeIgnore = [
+                # We don't live in the dark ages anymore.
+                # Languages like Python that are whitespace heavy will overrun
+                # 79 characters..
+                "E501"
               ];
-            };
-          };
+            }
+            ''
+              import sys
+              import asyncio
 
-          services.mautrix-meta.instances.facebook = {
-            enable = true;
-
-            settings = {
-              homeserver = {
-                address = homeserverUrl;
-                domain = homeserverDomain;
-              };
-
-              appservice = {
-                port = 8009;
-
-                bot.username = facebookBotUsername;
-              };
-
-              bridge.permissions."@${username}:server" = "user";
-            };
-          };
-
-          services.mautrix-meta.instances.instagram = {
-            enable = true;
-
-            settings = {
-              homeserver = {
-                address = homeserverUrl;
-                domain = homeserverDomain;
-              };
-
-              appservice = {
-                port = 8010;
-
-                bot.username = instagramBotUsername;
-              };
-
-              bridge.permissions."@${username}:server" = "user";
-            };
-          };
-
-          networking.firewall.allowedTCPPorts = [ 8008 ];
-        };
-
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [
-            (pkgs.writers.writePython3Bin "register_user"
-              {
-                libraries = [ pkgs.python3Packages.matrix-nio ];
-                flakeIgnore = [
-                  # We don't live in the dark ages anymore.
-                  # Languages like Python that are whitespace heavy will overrun
-                  # 79 characters..
-                  "E501"
-                ];
-              }
-              ''
-                import sys
-                import asyncio
-
-                from nio import AsyncClient
+              from nio import AsyncClient
 
 
-                async def run(username: str, homeserver: str):
-                    matrix = AsyncClient(homeserver)
+              async def run(username: str, homeserver: str):
+                  matrix = AsyncClient(homeserver)
 
-                    response = await matrix.register(username, "foobar")
-                    print("Matrix register response: ", response)
+                  response = await matrix.register(username, "foobar")
+                  print("Matrix register response: ", response)
 
 
-                if __name__ == "__main__":
-                    asyncio.run(run(sys.argv[1], sys.argv[2]))
-              ''
-            )
-            (pkgs.writers.writePython3Bin "do_test"
-              {
-                libraries = [ pkgs.python3Packages.matrix-nio ];
-                flakeIgnore = [
-                  # We don't live in the dark ages anymore.
-                  # Languages like Python that are whitespace heavy will overrun
-                  # 79 characters..
-                  "E501"
-                ];
-              }
-              ''
-                import sys
-                import functools
-                import asyncio
+              if __name__ == "__main__":
+                  asyncio.run(run(sys.argv[1], sys.argv[2]))
+            ''
+          )
+          (pkgs.writers.writePython3Bin "do_test"
+            {
+              libraries = [ pkgs.python3Packages.matrix-nio ];
+              flakeIgnore = [
+                # We don't live in the dark ages anymore.
+                # Languages like Python that are whitespace heavy will overrun
+                # 79 characters..
+                "E501"
+              ];
+            }
+            ''
+              import sys
+              import functools
+              import asyncio
 
-                from nio import AsyncClient, RoomMessageNotice, RoomCreateResponse, RoomInviteResponse
+              from nio import AsyncClient, RoomMessageNotice, RoomCreateResponse, RoomInviteResponse
 
 
-                async def message_callback(matrix: AsyncClient, msg: str, _r, e):
-                    print("Received matrix text message: ", e)
-                    assert msg in e.body
-                    exit(0)  # Success!
+              async def message_callback(matrix: AsyncClient, msg: str, _r, e):
+                  print("Received matrix text message: ", e)
+                  assert msg in e.body
+                  exit(0)  # Success!
 
 
-                async def run(username: str, bot_username: str, homeserver: str):
-                    matrix = AsyncClient(homeserver, f"@{username}:${homeserverDomain}")
+              async def run(username: str, bot_username: str, homeserver: str):
+                  matrix = AsyncClient(homeserver, f"@{username}:${homeserverDomain}")
 
-                    response = await matrix.login("foobar")
-                    print("Matrix login response: ", response)
+                  response = await matrix.login("foobar")
+                  print("Matrix login response: ", response)
 
-                    # Open a DM with the bridge bot
-                    response = await matrix.room_create()
-                    print("Matrix create room response:", response)
-                    assert isinstance(response, RoomCreateResponse)
-                    room_id = response.room_id
+                  # Open a DM with the bridge bot
+                  response = await matrix.room_create()
+                  print("Matrix create room response:", response)
+                  assert isinstance(response, RoomCreateResponse)
+                  room_id = response.room_id
 
-                    response = await matrix.room_invite(room_id, f"@{bot_username}:${homeserverDomain}")
-                    assert isinstance(response, RoomInviteResponse)
+                  response = await matrix.room_invite(room_id, f"@{bot_username}:${homeserverDomain}")
+                  assert isinstance(response, RoomInviteResponse)
 
-                    callback = functools.partial(
-                        message_callback, matrix, "Hello, I'm an Instagram bridge bot."
-                    )
-                    matrix.add_event_callback(callback, RoomMessageNotice)
+                  callback = functools.partial(
+                      message_callback, matrix, "Hello, I'm an Instagram bridge bot."
+                  )
+                  matrix.add_event_callback(callback, RoomMessageNotice)
 
-                    print("Waiting for matrix message...")
-                    await matrix.sync_forever(timeout=30000)
+                  print("Waiting for matrix message...")
+                  await matrix.sync_forever(timeout=30000)
 
 
-                if __name__ == "__main__":
-                    asyncio.run(run(sys.argv[1], sys.argv[2], sys.argv[3]))
-              ''
-            )
-          ];
-        };
-    };
+              if __name__ == "__main__":
+                  asyncio.run(run(sys.argv[1], sys.argv[2], sys.argv[3]))
+            ''
+          )
+        ];
+      };
+  };
 
-    testScript = ''
-      def extract_token(data):
-          stdout = data[1]
-          stdout = stdout.strip()
-          line = stdout.split('\n')[-1]
-          return line.split(':')[-1].strip("\" '\n")
+  testScript = ''
+    def extract_token(data):
+        stdout = data[1]
+        stdout = stdout.strip()
+        line = stdout.split('\n')[-1]
+        return line.split(':')[-1].strip("\" '\n")
 
-      def get_token_from(token, file):
-          data = server.execute(f"cat {file} | grep {token}")
-          return extract_token(data)
+    def get_token_from(token, file):
+        data = server.execute(f"cat {file} | grep {token}")
+        return extract_token(data)
 
-      def get_as_token_from(file):
-          return get_token_from("as_token", file)
+    def get_as_token_from(file):
+        return get_token_from("as_token", file)
 
-      def get_hs_token_from(file):
-          return get_token_from("hs_token", file)
+    def get_hs_token_from(file):
+        return get_token_from("hs_token", file)
 
-      config_yaml = "/var/lib/mautrix-meta-facebook/config.yaml"
-      registration_yaml = "/var/lib/mautrix-meta-facebook/meta-registration.yaml"
+    config_yaml = "/var/lib/mautrix-meta-facebook/config.yaml"
+    registration_yaml = "/var/lib/mautrix-meta-facebook/meta-registration.yaml"
 
-      start_all()
+    start_all()
 
-      with subtest("wait for bridges and homeserver"):
-          # bridge
-          server.wait_for_unit("mautrix-meta-facebook.service")
-          server.wait_for_unit("mautrix-meta-instagram.service")
+    with subtest("wait for bridges and homeserver"):
+        # bridge
+        server.wait_for_unit("mautrix-meta-facebook.service")
+        server.wait_for_unit("mautrix-meta-instagram.service")
 
-          # homeserver
-          server.wait_for_unit("matrix-synapse.service")
+        # homeserver
+        server.wait_for_unit("matrix-synapse.service")
 
-          server.wait_for_open_port(8008)
-          # Bridges only open the port after they contact the homeserver
-          server.wait_for_open_port(8009)
-          server.wait_for_open_port(8010)
+        server.wait_for_open_port(8008)
+        # Bridges only open the port after they contact the homeserver
+        server.wait_for_open_port(8009)
+        server.wait_for_open_port(8010)
 
-      with subtest("register user"):
-          client.succeed("register_user ${username} ${homeserverUrl} >&2")
+    with subtest("register user"):
+        client.succeed("register_user ${username} ${homeserverUrl} >&2")
 
-      with subtest("ensure messages can be exchanged"):
-          client.succeed("do_test ${username} ${facebookBotUsername} ${homeserverUrl} >&2")
-          client.succeed("do_test ${username} ${instagramBotUsername} ${homeserverUrl} >&2")
+    with subtest("ensure messages can be exchanged"):
+        client.succeed("do_test ${username} ${facebookBotUsername} ${homeserverUrl} >&2")
+        client.succeed("do_test ${username} ${instagramBotUsername} ${homeserverUrl} >&2")
 
-      with subtest("ensure as_token and hs_token stays same after restart"):
-          generated_as_token_facebook = get_as_token_from(config_yaml)
-          generated_hs_token_facebook = get_hs_token_from(config_yaml)
+    with subtest("ensure as_token and hs_token stays same after restart"):
+        generated_as_token_facebook = get_as_token_from(config_yaml)
+        generated_hs_token_facebook = get_hs_token_from(config_yaml)
 
-          generated_as_token_facebook_registration = get_as_token_from(registration_yaml)
-          generated_hs_token_facebook_registration = get_hs_token_from(registration_yaml)
+        generated_as_token_facebook_registration = get_as_token_from(registration_yaml)
+        generated_hs_token_facebook_registration = get_hs_token_from(registration_yaml)
 
-          # Indirectly checks the as token is not set to something like empty string or "null"
-          assert len(generated_as_token_facebook) > 20, f"as_token ({generated_as_token_facebook}) is too short, something went wrong"
-          assert len(generated_hs_token_facebook) > 20, f"hs_token ({generated_hs_token_facebook}) is too short, something went wrong"
+        # Indirectly checks the as token is not set to something like empty string or "null"
+        assert len(generated_as_token_facebook) > 20, f"as_token ({generated_as_token_facebook}) is too short, something went wrong"
+        assert len(generated_hs_token_facebook) > 20, f"hs_token ({generated_hs_token_facebook}) is too short, something went wrong"
 
-          assert generated_as_token_facebook == generated_as_token_facebook_registration, f"as_token should be the same in registration ({generated_as_token_facebook_registration}) and configuration ({generated_as_token_facebook}) files"
-          assert generated_hs_token_facebook == generated_hs_token_facebook_registration, f"hs_token should be the same in registration ({generated_hs_token_facebook_registration}) and configuration ({generated_hs_token_facebook}) files"
+        assert generated_as_token_facebook == generated_as_token_facebook_registration, f"as_token should be the same in registration ({generated_as_token_facebook_registration}) and configuration ({generated_as_token_facebook}) files"
+        assert generated_hs_token_facebook == generated_hs_token_facebook_registration, f"hs_token should be the same in registration ({generated_hs_token_facebook_registration}) and configuration ({generated_hs_token_facebook}) files"
 
-          server.systemctl("restart mautrix-meta-facebook")
-          server.systemctl("restart mautrix-meta-instagram")
+        server.systemctl("restart mautrix-meta-facebook")
+        server.systemctl("restart mautrix-meta-instagram")
 
-          server.wait_for_open_port(8009)
-          server.wait_for_open_port(8010)
+        server.wait_for_open_port(8009)
+        server.wait_for_open_port(8010)
 
-          new_as_token_facebook = get_as_token_from(config_yaml)
-          new_hs_token_facebook = get_hs_token_from(config_yaml)
+        new_as_token_facebook = get_as_token_from(config_yaml)
+        new_hs_token_facebook = get_hs_token_from(config_yaml)
 
-          assert generated_as_token_facebook == new_as_token_facebook, f"as_token should stay the same after restart inside the configuration file (is: {new_as_token_facebook}, was: {generated_as_token_facebook})"
-          assert generated_hs_token_facebook == new_hs_token_facebook, f"hs_token should stay the same after restart inside the configuration file (is: {new_hs_token_facebook}, was: {generated_hs_token_facebook})"
+        assert generated_as_token_facebook == new_as_token_facebook, f"as_token should stay the same after restart inside the configuration file (is: {new_as_token_facebook}, was: {generated_as_token_facebook})"
+        assert generated_hs_token_facebook == new_hs_token_facebook, f"hs_token should stay the same after restart inside the configuration file (is: {new_hs_token_facebook}, was: {generated_hs_token_facebook})"
 
-          new_as_token_facebook = get_as_token_from(registration_yaml)
-          new_hs_token_facebook = get_hs_token_from(registration_yaml)
+        new_as_token_facebook = get_as_token_from(registration_yaml)
+        new_hs_token_facebook = get_hs_token_from(registration_yaml)
 
-          assert generated_as_token_facebook == new_as_token_facebook, f"as_token should stay the same after restart inside the registration file (is: {new_as_token_facebook}, was: {generated_as_token_facebook})"
-          assert generated_hs_token_facebook == new_hs_token_facebook, f"hs_token should stay the same after restart inside the registration file (is: {new_hs_token_facebook}, was: {generated_hs_token_facebook})"
+        assert generated_as_token_facebook == new_as_token_facebook, f"as_token should stay the same after restart inside the registration file (is: {new_as_token_facebook}, was: {generated_as_token_facebook})"
+        assert generated_hs_token_facebook == new_hs_token_facebook, f"hs_token should stay the same after restart inside the registration file (is: {new_hs_token_facebook}, was: {generated_hs_token_facebook})"
 
-      with subtest("ensure messages can be exchanged after restart"):
-          client.succeed("do_test ${username} ${instagramBotUsername} ${homeserverUrl} >&2")
-          client.succeed("do_test ${username} ${facebookBotUsername} ${homeserverUrl} >&2")
-    '';
-  }
-)
+    with subtest("ensure messages can be exchanged after restart"):
+        client.succeed("do_test ${username} ${instagramBotUsername} ${homeserverUrl} >&2")
+        client.succeed("do_test ${username} ${facebookBotUsername} ${homeserverUrl} >&2")
+  '';
+}
diff --git a/nixos/tests/matrix/mjolnir.nix b/nixos/tests/matrix/mjolnir.nix
index a4a4426758d3..bc74902c7f20 100644
--- a/nixos/tests/matrix/mjolnir.nix
+++ b/nixos/tests/matrix/mjolnir.nix
@@ -1,187 +1,185 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  let
-    # Set up SSL certs for Synapse to be happy.
-    runWithOpenSSL =
-      file: cmd:
-      pkgs.runCommand file {
-        buildInputs = [ pkgs.openssl ];
-      } cmd;
+{ pkgs, ... }:
+let
+  # Set up SSL certs for Synapse to be happy.
+  runWithOpenSSL =
+    file: cmd:
+    pkgs.runCommand file {
+      buildInputs = [ pkgs.openssl ];
+    } cmd;
 
-    ca_key = runWithOpenSSL "ca-key.pem" "openssl genrsa -out $out 2048";
-    ca_pem = runWithOpenSSL "ca.pem" ''
-      openssl req \
-        -x509 -new -nodes -key ${ca_key} \
-        -days 10000 -out $out -subj "/CN=snakeoil-ca"
-    '';
-    key = runWithOpenSSL "matrix_key.pem" "openssl genrsa -out $out 2048";
-    csr = runWithOpenSSL "matrix.csr" ''
-      openssl req \
-         -new -key ${key} \
-         -out $out -subj "/CN=localhost" \
-    '';
-    cert = runWithOpenSSL "matrix_cert.pem" ''
-      openssl x509 \
-        -req -in ${csr} \
-        -CA ${ca_pem} -CAkey ${ca_key} \
-        -CAcreateserial -out $out \
-        -days 365
-    '';
-  in
-  {
-    name = "mjolnir";
-    meta = {
-      inherit (pkgs.mjolnir.meta) maintainers;
-    };
+  ca_key = runWithOpenSSL "ca-key.pem" "openssl genrsa -out $out 2048";
+  ca_pem = runWithOpenSSL "ca.pem" ''
+    openssl req \
+      -x509 -new -nodes -key ${ca_key} \
+      -days 10000 -out $out -subj "/CN=snakeoil-ca"
+  '';
+  key = runWithOpenSSL "matrix_key.pem" "openssl genrsa -out $out 2048";
+  csr = runWithOpenSSL "matrix.csr" ''
+    openssl req \
+       -new -key ${key} \
+       -out $out -subj "/CN=localhost" \
+  '';
+  cert = runWithOpenSSL "matrix_cert.pem" ''
+    openssl x509 \
+      -req -in ${csr} \
+      -CA ${ca_pem} -CAkey ${ca_key} \
+      -CAcreateserial -out $out \
+      -days 365
+  '';
+in
+{
+  name = "mjolnir";
+  meta = {
+    inherit (pkgs.mjolnir.meta) maintainers;
+  };
 
-    nodes = {
-      homeserver =
-        { pkgs, ... }:
-        {
-          services.matrix-synapse = {
-            enable = true;
-            settings = {
-              database.name = "sqlite3";
-              tls_certificate_path = "${cert}";
-              tls_private_key_path = "${key}";
-              enable_registration = true;
-              enable_registration_without_verification = true;
-              registration_shared_secret = "supersecret-registration";
+  nodes = {
+    homeserver =
+      { pkgs, ... }:
+      {
+        services.matrix-synapse = {
+          enable = true;
+          settings = {
+            database.name = "sqlite3";
+            tls_certificate_path = "${cert}";
+            tls_private_key_path = "${key}";
+            enable_registration = true;
+            enable_registration_without_verification = true;
+            registration_shared_secret = "supersecret-registration";
 
-              listeners = [
-                {
-                  # The default but tls=false
-                  bind_addresses = [
-                    "0.0.0.0"
-                  ];
-                  port = 8448;
-                  resources = [
-                    {
-                      compress = true;
-                      names = [ "client" ];
-                    }
-                    {
-                      compress = false;
-                      names = [ "federation" ];
-                    }
-                  ];
-                  tls = false;
-                  type = "http";
-                  x_forwarded = false;
-                }
-              ];
-            };
-          };
-
-          networking.firewall.allowedTCPPorts = [ 8448 ];
-
-          environment.systemPackages = [
-            (pkgs.writeShellScriptBin "register_mjolnir_user" ''
-              exec ${pkgs.matrix-synapse}/bin/register_new_matrix_user \
-                -u mjolnir \
-                -p mjolnir-password \
-                --admin \
-                --shared-secret supersecret-registration \
-                http://localhost:8448
-            '')
-            (pkgs.writeShellScriptBin "register_moderator_user" ''
-              exec ${pkgs.matrix-synapse}/bin/register_new_matrix_user \
-                -u moderator \
-                -p moderator-password \
-                --no-admin \
-                --shared-secret supersecret-registration \
-                http://localhost:8448
-            '')
-          ];
-        };
-
-      mjolnir =
-        { pkgs, ... }:
-        {
-          services.mjolnir = {
-            enable = true;
-            homeserverUrl = "http://homeserver:8448";
-            pantalaimon = {
-              enable = true;
-              username = "mjolnir";
-              passwordFile = pkgs.writeText "password.txt" "mjolnir-password";
-              # otherwise mjolnir tries to connect to ::1, which is not listened by pantalaimon
-              options.listenAddress = "127.0.0.1";
-            };
-            managementRoom = "#moderators:homeserver";
-          };
-        };
-
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [
-            (pkgs.writers.writePython3Bin "create_management_room_and_invite_mjolnir"
+            listeners = [
               {
-                libraries = with pkgs.python3Packages; [
-                  (matrix-nio.override { withOlm = true; })
+                # The default but tls=false
+                bind_addresses = [
+                  "0.0.0.0"
                 ];
+                port = 8448;
+                resources = [
+                  {
+                    compress = true;
+                    names = [ "client" ];
+                  }
+                  {
+                    compress = false;
+                    names = [ "federation" ];
+                  }
+                ];
+                tls = false;
+                type = "http";
+                x_forwarded = false;
               }
-              ''
-                import asyncio
-
-                from nio import (
-                    AsyncClient,
-                    EnableEncryptionBuilder
-                )
-
-
-                async def main() -> None:
-                    client = AsyncClient("http://homeserver:8448", "moderator")
-
-                    await client.login("moderator-password")
-
-                    room = await client.room_create(
-                        name="Moderators",
-                        alias="moderators",
-                        initial_state=[EnableEncryptionBuilder().as_dict()],
-                    )
-
-                    await client.join(room.room_id)
-                    await client.room_invite(room.room_id, "@mjolnir:homeserver")
-
-                asyncio.run(main())
-              ''
-            )
-          ];
+            ];
+          };
         };
-    };
 
-    testScript = ''
-      with subtest("start homeserver"):
-        homeserver.start()
+        networking.firewall.allowedTCPPorts = [ 8448 ];
 
-        homeserver.wait_for_unit("matrix-synapse.service")
-        homeserver.wait_until_succeeds("curl --fail -L http://localhost:8448/")
+        environment.systemPackages = [
+          (pkgs.writeShellScriptBin "register_mjolnir_user" ''
+            exec ${pkgs.matrix-synapse}/bin/register_new_matrix_user \
+              -u mjolnir \
+              -p mjolnir-password \
+              --admin \
+              --shared-secret supersecret-registration \
+              http://localhost:8448
+          '')
+          (pkgs.writeShellScriptBin "register_moderator_user" ''
+            exec ${pkgs.matrix-synapse}/bin/register_new_matrix_user \
+              -u moderator \
+              -p moderator-password \
+              --no-admin \
+              --shared-secret supersecret-registration \
+              http://localhost:8448
+          '')
+        ];
+      };
 
-      with subtest("register users"):
-        # register mjolnir user
-        homeserver.succeed("register_mjolnir_user")
-        # register moderator user
-        homeserver.succeed("register_moderator_user")
+    mjolnir =
+      { pkgs, ... }:
+      {
+        services.mjolnir = {
+          enable = true;
+          homeserverUrl = "http://homeserver:8448";
+          pantalaimon = {
+            enable = true;
+            username = "mjolnir";
+            passwordFile = pkgs.writeText "password.txt" "mjolnir-password";
+            # otherwise mjolnir tries to connect to ::1, which is not listened by pantalaimon
+            options.listenAddress = "127.0.0.1";
+          };
+          managementRoom = "#moderators:homeserver";
+        };
+      };
 
-      with subtest("start mjolnir"):
-        mjolnir.start()
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          (pkgs.writers.writePython3Bin "create_management_room_and_invite_mjolnir"
+            {
+              libraries = with pkgs.python3Packages; [
+                (matrix-nio.override { withOlm = true; })
+              ];
+            }
+            ''
+              import asyncio
 
-        # wait for pantalaimon to be ready
-        mjolnir.wait_for_unit("pantalaimon-mjolnir.service")
-        mjolnir.wait_for_unit("mjolnir.service")
+              from nio import (
+                  AsyncClient,
+                  EnableEncryptionBuilder
+              )
 
-        mjolnir.wait_until_succeeds("curl --fail -L http://localhost:8009/")
 
-      with subtest("ensure mjolnir can be invited to the management room"):
-        client.start()
+              async def main() -> None:
+                  client = AsyncClient("http://homeserver:8448", "moderator")
 
-        client.wait_until_succeeds("curl --fail -L http://homeserver:8448/")
+                  await client.login("moderator-password")
 
-        client.succeed("create_management_room_and_invite_mjolnir")
+                  room = await client.room_create(
+                      name="Moderators",
+                      alias="moderators",
+                      initial_state=[EnableEncryptionBuilder().as_dict()],
+                  )
 
-        mjolnir.wait_for_console_text("Startup complete. Now monitoring rooms")
-    '';
-  }
-)
+                  await client.join(room.room_id)
+                  await client.room_invite(room.room_id, "@mjolnir:homeserver")
+
+              asyncio.run(main())
+            ''
+          )
+        ];
+      };
+  };
+
+  testScript = ''
+    with subtest("start homeserver"):
+      homeserver.start()
+
+      homeserver.wait_for_unit("matrix-synapse.service")
+      homeserver.wait_until_succeeds("curl --fail -L http://localhost:8448/")
+
+    with subtest("register users"):
+      # register mjolnir user
+      homeserver.succeed("register_mjolnir_user")
+      # register moderator user
+      homeserver.succeed("register_moderator_user")
+
+    with subtest("start mjolnir"):
+      mjolnir.start()
+
+      # wait for pantalaimon to be ready
+      mjolnir.wait_for_unit("pantalaimon-mjolnir.service")
+      mjolnir.wait_for_unit("mjolnir.service")
+
+      mjolnir.wait_until_succeeds("curl --fail -L http://localhost:8009/")
+
+    with subtest("ensure mjolnir can be invited to the management room"):
+      client.start()
+
+      client.wait_until_succeeds("curl --fail -L http://homeserver:8448/")
+
+      client.succeed("create_management_room_and_invite_mjolnir")
+
+      mjolnir.wait_for_console_text("Startup complete. Now monitoring rooms")
+  '';
+}
diff --git a/nixos/tests/matrix/pantalaimon.nix b/nixos/tests/matrix/pantalaimon.nix
index 6ff4cf8cda06..eb2123ee3ca6 100644
--- a/nixos/tests/matrix/pantalaimon.nix
+++ b/nixos/tests/matrix/pantalaimon.nix
@@ -1,95 +1,93 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  let
-    pantalaimonInstanceName = "testing";
+{ pkgs, ... }:
+let
+  pantalaimonInstanceName = "testing";
 
-    # Set up SSL certs for Synapse to be happy.
-    runWithOpenSSL =
-      file: cmd:
-      pkgs.runCommand file {
-        buildInputs = [ pkgs.openssl ];
-      } cmd;
+  # Set up SSL certs for Synapse to be happy.
+  runWithOpenSSL =
+    file: cmd:
+    pkgs.runCommand file {
+      buildInputs = [ pkgs.openssl ];
+    } cmd;
 
-    ca_key = runWithOpenSSL "ca-key.pem" "openssl genrsa -out $out 2048";
-    ca_pem = runWithOpenSSL "ca.pem" ''
-      openssl req \
-        -x509 -new -nodes -key ${ca_key} \
-        -days 10000 -out $out -subj "/CN=snakeoil-ca"
-    '';
-    key = runWithOpenSSL "matrix_key.pem" "openssl genrsa -out $out 2048";
-    csr = runWithOpenSSL "matrix.csr" ''
-      openssl req \
-         -new -key ${key} \
-         -out $out -subj "/CN=localhost" \
-    '';
-    cert = runWithOpenSSL "matrix_cert.pem" ''
-      openssl x509 \
-        -req -in ${csr} \
-        -CA ${ca_pem} -CAkey ${ca_key} \
-        -CAcreateserial -out $out \
-        -days 365
-    '';
-  in
-  {
-    name = "pantalaimon";
-    meta = with pkgs.lib; {
-      maintainers = teams.matrix.members;
-    };
+  ca_key = runWithOpenSSL "ca-key.pem" "openssl genrsa -out $out 2048";
+  ca_pem = runWithOpenSSL "ca.pem" ''
+    openssl req \
+      -x509 -new -nodes -key ${ca_key} \
+      -days 10000 -out $out -subj "/CN=snakeoil-ca"
+  '';
+  key = runWithOpenSSL "matrix_key.pem" "openssl genrsa -out $out 2048";
+  csr = runWithOpenSSL "matrix.csr" ''
+    openssl req \
+       -new -key ${key} \
+       -out $out -subj "/CN=localhost" \
+  '';
+  cert = runWithOpenSSL "matrix_cert.pem" ''
+    openssl x509 \
+      -req -in ${csr} \
+      -CA ${ca_pem} -CAkey ${ca_key} \
+      -CAcreateserial -out $out \
+      -days 365
+  '';
+in
+{
+  name = "pantalaimon";
+  meta = with pkgs.lib; {
+    maintainers = teams.matrix.members;
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.pantalaimon-headless.instances.${pantalaimonInstanceName} = {
-          homeserver = "https://localhost:8448";
-          listenAddress = "0.0.0.0";
-          listenPort = 8888;
-          logLevel = "debug";
-          ssl = false;
-        };
-
-        services.matrix-synapse = {
-          enable = true;
-          settings = {
-            listeners = [
-              {
-                port = 8448;
-                bind_addresses = [
-                  "127.0.0.1"
-                  "::1"
-                ];
-                type = "http";
-                tls = true;
-                x_forwarded = false;
-                resources = [
-                  {
-                    names = [
-                      "client"
-                    ];
-                    compress = true;
-                  }
-                  {
-                    names = [
-                      "federation"
-                    ];
-                    compress = false;
-                  }
-                ];
-              }
-            ];
-            database.name = "sqlite3";
-            tls_certificate_path = "${cert}";
-            tls_private_key_path = "${key}";
-          };
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.pantalaimon-headless.instances.${pantalaimonInstanceName} = {
+        homeserver = "https://localhost:8448";
+        listenAddress = "0.0.0.0";
+        listenPort = 8888;
+        logLevel = "debug";
+        ssl = false;
       };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("pantalaimon-${pantalaimonInstanceName}.service")
-      machine.wait_for_unit("matrix-synapse.service")
-      machine.wait_until_succeeds(
-          "curl --fail -L http://localhost:8888/"
-      )
-    '';
-  }
-)
+      services.matrix-synapse = {
+        enable = true;
+        settings = {
+          listeners = [
+            {
+              port = 8448;
+              bind_addresses = [
+                "127.0.0.1"
+                "::1"
+              ];
+              type = "http";
+              tls = true;
+              x_forwarded = false;
+              resources = [
+                {
+                  names = [
+                    "client"
+                  ];
+                  compress = true;
+                }
+                {
+                  names = [
+                    "federation"
+                  ];
+                  compress = false;
+                }
+              ];
+            }
+          ];
+          database.name = "sqlite3";
+          tls_certificate_path = "${cert}";
+          tls_private_key_path = "${key}";
+        };
+      };
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("pantalaimon-${pantalaimonInstanceName}.service")
+    machine.wait_for_unit("matrix-synapse.service")
+    machine.wait_until_succeeds(
+        "curl --fail -L http://localhost:8888/"
+    )
+  '';
+}
diff --git a/nixos/tests/matrix/synapse-workers.nix b/nixos/tests/matrix/synapse-workers.nix
index f75a0528769a..949658caac47 100644
--- a/nixos/tests/matrix/synapse-workers.nix
+++ b/nixos/tests/matrix/synapse-workers.nix
@@ -1,55 +1,53 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "matrix-synapse-workers";
-    meta = {
-      inherit (pkgs.matrix-synapse.meta) maintainers;
-    };
+{ pkgs, ... }:
+{
+  name = "matrix-synapse-workers";
+  meta = {
+    inherit (pkgs.matrix-synapse.meta) maintainers;
+  };
 
-    nodes = {
-      homeserver =
-        {
-          pkgs,
-          nodes,
-          ...
-        }:
-        {
-          services.postgresql = {
-            enable = true;
-            initialScript = pkgs.writeText "synapse-init.sql" ''
-              CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
-              CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
-              TEMPLATE template0
-              LC_COLLATE = "C"
-              LC_CTYPE = "C";
-            '';
+  nodes = {
+    homeserver =
+      {
+        pkgs,
+        nodes,
+        ...
+      }:
+      {
+        services.postgresql = {
+          enable = true;
+          initialScript = pkgs.writeText "synapse-init.sql" ''
+            CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
+            CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
+            TEMPLATE template0
+            LC_COLLATE = "C"
+            LC_CTYPE = "C";
+          '';
+        };
+
+        services.matrix-synapse = {
+          enable = true;
+          settings = {
+            database = {
+              name = "psycopg2";
+              args.password = "synapse";
+            };
+            enable_registration = true;
+            enable_registration_without_verification = true;
+
+            federation_sender_instances = [ "federation_sender" ];
           };
-
-          services.matrix-synapse = {
-            enable = true;
-            settings = {
-              database = {
-                name = "psycopg2";
-                args.password = "synapse";
-              };
-              enable_registration = true;
-              enable_registration_without_verification = true;
-
-              federation_sender_instances = [ "federation_sender" ];
-            };
-            configureRedisLocally = true;
-            workers = {
-              "federation_sender" = { };
-            };
+          configureRedisLocally = true;
+          workers = {
+            "federation_sender" = { };
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      homeserver.wait_for_unit("matrix-synapse.service");
-      homeserver.wait_for_unit("matrix-synapse-worker-federation_sender.service");
-    '';
-  }
-)
+    homeserver.wait_for_unit("matrix-synapse.service");
+    homeserver.wait_for_unit("matrix-synapse-worker-federation_sender.service");
+  '';
+}
diff --git a/nixos/tests/matrix/synapse.nix b/nixos/tests/matrix/synapse.nix
index c16182a46cd2..323fa25ccb6c 100644
--- a/nixos/tests/matrix/synapse.nix
+++ b/nixos/tests/matrix/synapse.nix
@@ -1,248 +1,246 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  let
+{ pkgs, ... }:
+let
 
-    ca_key = mailerCerts.ca.key;
-    ca_pem = mailerCerts.ca.cert;
+  ca_key = mailerCerts.ca.key;
+  ca_pem = mailerCerts.ca.cert;
 
-    bundle =
-      pkgs.runCommand "bundle"
-        {
-          nativeBuildInputs = [ pkgs.minica ];
-        }
-        ''
-          minica -ca-cert ${ca_pem} -ca-key ${ca_key} \
-            -domains localhost
-          install -Dm444 -t $out localhost/{key,cert}.pem
-        '';
-
-    mailerCerts = import ../common/acme/server/snakeoil-certs.nix;
-    mailerDomain = mailerCerts.domain;
-    registrationSharedSecret = "unsecure123";
-    testUser = "alice";
-    testPassword = "alicealice";
-    testEmail = "alice@example.com";
-
-    listeners = [
+  bundle =
+    pkgs.runCommand "bundle"
       {
-        port = 8448;
-        bind_addresses = [
-          "127.0.0.1"
-          "::1"
-        ];
-        type = "http";
-        tls = true;
-        x_forwarded = false;
-        resources = [
-          {
-            names = [
-              "client"
-            ];
-            compress = true;
-          }
-          {
-            names = [
-              "federation"
-            ];
-            compress = false;
-          }
-        ];
+        nativeBuildInputs = [ pkgs.minica ];
       }
-    ];
+      ''
+        minica -ca-cert ${ca_pem} -ca-key ${ca_key} \
+          -domains localhost
+        install -Dm444 -t $out localhost/{key,cert}.pem
+      '';
 
-  in
-  {
+  mailerCerts = import ../common/acme/server/snakeoil-certs.nix;
+  mailerDomain = mailerCerts.domain;
+  registrationSharedSecret = "unsecure123";
+  testUser = "alice";
+  testPassword = "alicealice";
+  testEmail = "alice@example.com";
 
-    name = "matrix-synapse";
-    meta = {
-      inherit (pkgs.matrix-synapse.meta) maintainers;
-    };
-
-    nodes = {
-      # Since 0.33.0, matrix-synapse doesn't allow underscores in server names
-      serverpostgres =
+  listeners = [
+    {
+      port = 8448;
+      bind_addresses = [
+        "127.0.0.1"
+        "::1"
+      ];
+      type = "http";
+      tls = true;
+      x_forwarded = false;
+      resources = [
         {
-          pkgs,
-          nodes,
-          config,
-          ...
-        }:
-        let
-          mailserverIP = nodes.mailserver.config.networking.primaryIPAddress;
-        in
-        {
-          services.matrix-synapse = {
-            enable = true;
-            settings = {
-              inherit listeners;
-              database = {
-                name = "psycopg2";
-                args.password = "synapse";
-              };
-              redis = {
-                enabled = true;
-                host = "localhost";
-                port = config.services.redis.servers.matrix-synapse.port;
-              };
-              tls_certificate_path = "${bundle}/cert.pem";
-              tls_private_key_path = "${bundle}/key.pem";
-              registration_shared_secret = registrationSharedSecret;
-              public_baseurl = "https://example.com";
-              email = {
-                smtp_host = mailerDomain;
-                smtp_port = 25;
-                require_transport_security = true;
-                notif_from = "matrix <matrix@${mailerDomain}>";
-                app_name = "Matrix";
-              };
-            };
-          };
-          services.postgresql = {
-            enable = true;
-
-            # The database name and user are configured by the following options:
-            #   - services.matrix-synapse.database_name
-            #   - services.matrix-synapse.database_user
-            #
-            # The values used here represent the default values of the module.
-            initialScript = pkgs.writeText "synapse-init.sql" ''
-              CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
-              CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
-                TEMPLATE template0
-                LC_COLLATE = "C"
-                LC_CTYPE = "C";
-            '';
-          };
-
-          services.redis.servers.matrix-synapse = {
-            enable = true;
-            port = 6380;
-          };
-
-          networking.extraHosts = ''
-            ${mailserverIP} ${mailerDomain}
-          '';
-
-          security.pki.certificateFiles = [
-            mailerCerts.ca.cert
-            ca_pem
+          names = [
+            "client"
           ];
-
-          environment.systemPackages =
-            let
-              sendTestMailStarttls = pkgs.writeScriptBin "send-testmail-starttls" ''
-                #!${pkgs.python3.interpreter}
-                import smtplib
-                import ssl
-
-                ctx = ssl.create_default_context()
-
-                with smtplib.SMTP('${mailerDomain}') as smtp:
-                  smtp.ehlo()
-                  smtp.starttls(context=ctx)
-                  smtp.ehlo()
-                  smtp.sendmail('matrix@${mailerDomain}', '${testEmail}', 'Subject: Test STARTTLS\n\nTest data.')
-                  smtp.quit()
-              '';
-
-              obtainTokenAndRegisterEmail =
-                let
-                  # adding the email through the API is quite complicated as it involves more than one step and some
-                  # client-side calculation
-                  insertEmailForAlice = pkgs.writeText "alice-email.sql" ''
-                    INSERT INTO user_threepids (user_id, medium, address, validated_at, added_at) VALUES ('${testUser}@serverpostgres', 'email', '${testEmail}', '1629149927271', '1629149927270');
-                  '';
-                in
-                pkgs.writeScriptBin "obtain-token-and-register-email" ''
-                  #!${pkgs.runtimeShell}
-                  set -o errexit
-                  set -o pipefail
-                  set -o nounset
-                  su postgres -c "psql -d matrix-synapse -f ${insertEmailForAlice}"
-                  curl --fail -XPOST 'https://localhost:8448/_matrix/client/r0/account/password/email/requestToken' -d '{"email":"${testEmail}","client_secret":"foobar","send_attempt":1}' -v
-                '';
-            in
-            [
-              sendTestMailStarttls
-              pkgs.matrix-synapse
-              obtainTokenAndRegisterEmail
-            ];
-        };
-
-      # test mail delivery
-      mailserver =
-        args:
-        let
-        in
+          compress = true;
+        }
         {
-          security.pki.certificateFiles = [
-            mailerCerts.ca.cert
+          names = [
+            "federation"
           ];
+          compress = false;
+        }
+      ];
+    }
+  ];
 
-          networking.firewall.enable = false;
+in
+{
 
-          services.postfix = {
-            enable = true;
-            hostname = "${mailerDomain}";
-            # open relay for subnet
-            networksStyle = "subnet";
-            enableSubmission = true;
-            tlsTrustedAuthorities = "${mailerCerts.ca.cert}";
-            sslCert = "${mailerCerts.${mailerDomain}.cert}";
-            sslKey = "${mailerCerts.${mailerDomain}.key}";
+  name = "matrix-synapse";
+  meta = {
+    inherit (pkgs.matrix-synapse.meta) maintainers;
+  };
 
-            # blackhole transport
-            transport = "example.com discard:silently";
-
-            config = {
-              debug_peer_level = "10";
-              smtpd_relay_restrictions = [
-                "permit_mynetworks"
-                "reject_unauth_destination"
-              ];
-
-              # disable obsolete protocols, something old versions of twisted are still using
-              smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-              smtp_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-              smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-              smtp_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-            };
-          };
-        };
-
-      serversqlite = args: {
+  nodes = {
+    # Since 0.33.0, matrix-synapse doesn't allow underscores in server names
+    serverpostgres =
+      {
+        pkgs,
+        nodes,
+        config,
+        ...
+      }:
+      let
+        mailserverIP = nodes.mailserver.config.networking.primaryIPAddress;
+      in
+      {
         services.matrix-synapse = {
           enable = true;
           settings = {
             inherit listeners;
-            database.name = "sqlite3";
+            database = {
+              name = "psycopg2";
+              args.password = "synapse";
+            };
+            redis = {
+              enabled = true;
+              host = "localhost";
+              port = config.services.redis.servers.matrix-synapse.port;
+            };
             tls_certificate_path = "${bundle}/cert.pem";
             tls_private_key_path = "${bundle}/key.pem";
+            registration_shared_secret = registrationSharedSecret;
+            public_baseurl = "https://example.com";
+            email = {
+              smtp_host = mailerDomain;
+              smtp_port = 25;
+              require_transport_security = true;
+              notif_from = "matrix <matrix@${mailerDomain}>";
+              app_name = "Matrix";
+            };
+          };
+        };
+        services.postgresql = {
+          enable = true;
+
+          # The database name and user are configured by the following options:
+          #   - services.matrix-synapse.database_name
+          #   - services.matrix-synapse.database_user
+          #
+          # The values used here represent the default values of the module.
+          initialScript = pkgs.writeText "synapse-init.sql" ''
+            CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
+            CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
+              TEMPLATE template0
+              LC_COLLATE = "C"
+              LC_CTYPE = "C";
+          '';
+        };
+
+        services.redis.servers.matrix-synapse = {
+          enable = true;
+          port = 6380;
+        };
+
+        networking.extraHosts = ''
+          ${mailserverIP} ${mailerDomain}
+        '';
+
+        security.pki.certificateFiles = [
+          mailerCerts.ca.cert
+          ca_pem
+        ];
+
+        environment.systemPackages =
+          let
+            sendTestMailStarttls = pkgs.writeScriptBin "send-testmail-starttls" ''
+              #!${pkgs.python3.interpreter}
+              import smtplib
+              import ssl
+
+              ctx = ssl.create_default_context()
+
+              with smtplib.SMTP('${mailerDomain}') as smtp:
+                smtp.ehlo()
+                smtp.starttls(context=ctx)
+                smtp.ehlo()
+                smtp.sendmail('matrix@${mailerDomain}', '${testEmail}', 'Subject: Test STARTTLS\n\nTest data.')
+                smtp.quit()
+            '';
+
+            obtainTokenAndRegisterEmail =
+              let
+                # adding the email through the API is quite complicated as it involves more than one step and some
+                # client-side calculation
+                insertEmailForAlice = pkgs.writeText "alice-email.sql" ''
+                  INSERT INTO user_threepids (user_id, medium, address, validated_at, added_at) VALUES ('${testUser}@serverpostgres', 'email', '${testEmail}', '1629149927271', '1629149927270');
+                '';
+              in
+              pkgs.writeScriptBin "obtain-token-and-register-email" ''
+                #!${pkgs.runtimeShell}
+                set -o errexit
+                set -o pipefail
+                set -o nounset
+                su postgres -c "psql -d matrix-synapse -f ${insertEmailForAlice}"
+                curl --fail -XPOST 'https://localhost:8448/_matrix/client/r0/account/password/email/requestToken' -d '{"email":"${testEmail}","client_secret":"foobar","send_attempt":1}' -v
+              '';
+          in
+          [
+            sendTestMailStarttls
+            pkgs.matrix-synapse
+            obtainTokenAndRegisterEmail
+          ];
+      };
+
+    # test mail delivery
+    mailserver =
+      args:
+      let
+      in
+      {
+        security.pki.certificateFiles = [
+          mailerCerts.ca.cert
+        ];
+
+        networking.firewall.enable = false;
+
+        services.postfix = {
+          enable = true;
+          hostname = "${mailerDomain}";
+          # open relay for subnet
+          networksStyle = "subnet";
+          enableSubmission = true;
+          tlsTrustedAuthorities = "${mailerCerts.ca.cert}";
+          sslCert = "${mailerCerts.${mailerDomain}.cert}";
+          sslKey = "${mailerCerts.${mailerDomain}.key}";
+
+          # blackhole transport
+          transport = "example.com discard:silently";
+
+          config = {
+            debug_peer_level = "10";
+            smtpd_relay_restrictions = [
+              "permit_mynetworks"
+              "reject_unauth_destination"
+            ];
+
+            # disable obsolete protocols, something old versions of twisted are still using
+            smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
+            smtp_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
+            smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
+            smtp_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
           };
         };
       };
+
+    serversqlite = args: {
+      services.matrix-synapse = {
+        enable = true;
+        settings = {
+          inherit listeners;
+          database.name = "sqlite3";
+          tls_certificate_path = "${bundle}/cert.pem";
+          tls_private_key_path = "${bundle}/key.pem";
+        };
+      };
     };
+  };
 
-    testScript = ''
-      start_all()
-      mailserver.wait_for_unit("postfix.service")
-      serverpostgres.succeed("send-testmail-starttls")
-      serverpostgres.wait_for_unit("matrix-synapse.service")
-      serverpostgres.wait_until_succeeds(
-          "curl --fail -L --cacert ${ca_pem} https://localhost:8448/"
-      )
-      serverpostgres.wait_until_succeeds(
-          "journalctl -u matrix-synapse.service | grep -q 'Connected to redis'"
-      )
-      serverpostgres.require_unit_state("postgresql.service")
-      serverpostgres.succeed("REQUESTS_CA_BUNDLE=${ca_pem} register_new_matrix_user -u ${testUser} -p ${testPassword} -a -k ${registrationSharedSecret} https://localhost:8448/")
-      serverpostgres.succeed("obtain-token-and-register-email")
-      serversqlite.wait_for_unit("matrix-synapse.service")
-      serversqlite.wait_until_succeeds(
-          "curl --fail -L --cacert ${ca_pem} https://localhost:8448/"
-      )
-      serversqlite.succeed("[ -e /var/lib/matrix-synapse/homeserver.db ]")
-    '';
+  testScript = ''
+    start_all()
+    mailserver.wait_for_unit("postfix.service")
+    serverpostgres.succeed("send-testmail-starttls")
+    serverpostgres.wait_for_unit("matrix-synapse.service")
+    serverpostgres.wait_until_succeeds(
+        "curl --fail -L --cacert ${ca_pem} https://localhost:8448/"
+    )
+    serverpostgres.wait_until_succeeds(
+        "journalctl -u matrix-synapse.service | grep -q 'Connected to redis'"
+    )
+    serverpostgres.require_unit_state("postgresql.service")
+    serverpostgres.succeed("REQUESTS_CA_BUNDLE=${ca_pem} register_new_matrix_user -u ${testUser} -p ${testPassword} -a -k ${registrationSharedSecret} https://localhost:8448/")
+    serverpostgres.succeed("obtain-token-and-register-email")
+    serversqlite.wait_for_unit("matrix-synapse.service")
+    serversqlite.wait_until_succeeds(
+        "curl --fail -L --cacert ${ca_pem} https://localhost:8448/"
+    )
+    serversqlite.succeed("[ -e /var/lib/matrix-synapse/homeserver.db ]")
+  '';
 
-  }
-)
+}
diff --git a/nixos/tests/matter-server.nix b/nixos/tests/matter-server.nix
index e302a8e91427..167cee21e07b 100644
--- a/nixos/tests/matter-server.nix
+++ b/nixos/tests/matter-server.nix
@@ -1,52 +1,50 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    chipVersion = pkgs.python311Packages.home-assistant-chip-core.version;
-  in
+let
+  chipVersion = pkgs.python311Packages.home-assistant-chip-core.version;
+in
 
-  {
-    name = "matter-server";
-    meta.maintainers = with lib.maintainers; [ leonm1 ];
-    meta.timeout = 120; # Timeout after two minutes
+{
+  name = "matter-server";
+  meta.maintainers = with lib.maintainers; [ leonm1 ];
+  meta.timeout = 120; # Timeout after two minutes
 
-    nodes = {
-      machine =
-        { config, ... }:
-        {
-          services.matter-server = {
-            enable = true;
-            port = 1234;
-          };
+  nodes = {
+    machine =
+      { config, ... }:
+      {
+        services.matter-server = {
+          enable = true;
+          port = 1234;
         };
-    };
+      };
+  };
 
-    testScript = # python
-      ''
-        @polling_condition
-        def matter_server_running():
-          machine.succeed("systemctl status matter-server")
+  testScript = # python
+    ''
+      @polling_condition
+      def matter_server_running():
+        machine.succeed("systemctl status matter-server")
 
-        start_all()
+      start_all()
 
-        machine.wait_for_unit("matter-server.service", timeout=20)
-        machine.wait_for_open_port(1234, timeout=20)
+      machine.wait_for_unit("matter-server.service", timeout=20)
+      machine.wait_for_open_port(1234, timeout=20)
 
-        with matter_server_running: # type: ignore[union-attr]
-          with subtest("Check websocket server initialized"):
-              output = machine.succeed("echo \"\" | ${pkgs.websocat}/bin/websocat ws://localhost:1234/ws")
-              machine.log(output)
+      with matter_server_running: # type: ignore[union-attr]
+        with subtest("Check websocket server initialized"):
+            output = machine.succeed("echo \"\" | ${pkgs.websocat}/bin/websocat ws://localhost:1234/ws")
+            machine.log(output)
 
-          assert '"fabric_id": 1' in output, (
-            "fabric_id not propagated to server"
-          )
+        assert '"fabric_id": 1' in output, (
+          "fabric_id not propagated to server"
+        )
 
-          with subtest("Check storage directory is created"):
-              machine.succeed("ls /var/lib/matter-server/chip.json")
+        with subtest("Check storage directory is created"):
+            machine.succeed("ls /var/lib/matter-server/chip.json")
 
-          with subtest("Check systemd hardening"):
-              _, output = machine.execute("systemd-analyze security matter-server.service | grep -v '✓'")
-              machine.log(output)
-      '';
-  }
-)
+        with subtest("Check systemd hardening"):
+            _, output = machine.execute("systemd-analyze security matter-server.service | grep -v '✓'")
+            machine.log(output)
+    '';
+}
diff --git a/nixos/tests/mealie.nix b/nixos/tests/mealie.nix
index e296d5180ecd..97dd4d048f48 100644
--- a/nixos/tests/mealie.nix
+++ b/nixos/tests/mealie.nix
@@ -1,44 +1,42 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "mealie";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        litchipi
-        anoa
-      ];
+{
+  name = "mealie";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      litchipi
+      anoa
+    ];
+  };
+
+  nodes =
+    let
+      sqlite = {
+        services.mealie = {
+          enable = true;
+          port = 9001;
+        };
+      };
+      postgres = {
+        imports = [ sqlite ];
+        services.mealie.database.createLocally = true;
+      };
+    in
+    {
+      inherit sqlite postgres;
     };
 
-    nodes =
-      let
-        sqlite = {
-          services.mealie = {
-            enable = true;
-            port = 9001;
-          };
-        };
-        postgres = {
-          imports = [ sqlite ];
-          services.mealie.database.createLocally = true;
-        };
-      in
-      {
-        inherit sqlite postgres;
-      };
+  testScript = ''
+    start_all()
 
-    testScript = ''
-      start_all()
+    def test_mealie(node):
+      node.wait_for_unit("mealie.service")
+      node.wait_for_open_port(9001)
+      node.succeed("curl --fail http://localhost:9001")
 
-      def test_mealie(node):
-        node.wait_for_unit("mealie.service")
-        node.wait_for_open_port(9001)
-        node.succeed("curl --fail http://localhost:9001")
-
-      test_mealie(sqlite)
-      sqlite.send_monitor_command("quit")
-      sqlite.wait_for_shutdown()
-      test_mealie(postgres)
-    '';
-  }
-)
+    test_mealie(sqlite)
+    sqlite.send_monitor_command("quit")
+    sqlite.wait_for_shutdown()
+    test_mealie(postgres)
+  '';
+}
diff --git a/nixos/tests/mediamtx.nix b/nixos/tests/mediamtx.nix
index f40c4a8cb583..a815efccfdfa 100644
--- a/nixos/tests/mediamtx.nix
+++ b/nixos/tests/mediamtx.nix
@@ -1,60 +1,62 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  {
-    name = "mediamtx";
-    meta.maintainers = with lib.maintainers; [ fpletz ];
+let
+  rtmpUrl = "rtmp://localhost:1935/test";
+in
+{
+  name = "mediamtx";
+  meta.maintainers = with lib.maintainers; [ fpletz ];
 
-    nodes = {
-      machine = {
-        services.mediamtx = {
-          enable = true;
-          settings = {
-            metrics = true;
-            paths.all.source = "publisher";
-          };
+  nodes = {
+    machine = {
+      services.mediamtx = {
+        enable = true;
+        settings = {
+          metrics = true;
+          paths.all.source = "publisher";
         };
+      };
 
-        systemd.services.rtmp-publish = {
-          description = "Publish an RTMP stream to mediamtx";
-          after = [ "mediamtx.service" ];
-          bindsTo = [ "mediamtx.service" ];
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig = {
-            DynamicUser = true;
-            Restart = "on-failure";
-            RestartSec = "1s";
-            TimeoutStartSec = "10s";
-            ExecStart = "${lib.getBin pkgs.ffmpeg-headless}/bin/ffmpeg -re -f lavfi -i smptebars=size=800x600:rate=10 -c libx264 -f flv rtmp://localhost:1935/test";
-          };
+      systemd.services.rtmp-publish = {
+        description = "Publish an RTMP stream to mediamtx";
+        after = [ "mediamtx.service" ];
+        bindsTo = [ "mediamtx.service" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          DynamicUser = true;
+          Restart = "on-failure";
+          RestartSec = "1s";
+          TimeoutStartSec = "30s";
+          ExecStart = "${lib.getBin pkgs.ffmpeg-headless}/bin/ffmpeg -re -f lavfi -i smptebars=size=800x600:rate=10 -c libx264 -f flv ${rtmpUrl}";
         };
+      };
 
-        systemd.services.rtmp-receive = {
-          description = "Receive an RTMP stream from mediamtx";
-          after = [ "rtmp-publish.service" ];
-          bindsTo = [ "rtmp-publish.service" ];
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig = {
-            DynamicUser = true;
-            Restart = "on-failure";
-            RestartSec = "1s";
-            TimeoutStartSec = "10s";
-            ExecStart = "${lib.getBin pkgs.ffmpeg-headless}/bin/ffmpeg -y -re -i rtmp://localhost:1935/test -f flv /dev/null";
-          };
+      systemd.services.rtmp-receive = {
+        description = "Receive an RTMP stream from mediamtx";
+        after = [ "rtmp-publish.service" ];
+        bindsTo = [ "rtmp-publish.service" ];
+        wantedBy = [ "multi-user.target" ];
+        unitConfig.StartLimitIntervalSec = 0;
+        serviceConfig = {
+          DynamicUser = true;
+          Restart = "on-failure";
+          RestartSec = "1s";
+          TimeoutStartSec = "30s";
+          ExecStart = "${lib.getBin pkgs.ffmpeg-headless}/bin/ffmpeg -y -re -i ${rtmpUrl} -f flv /dev/null";
         };
       };
     };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine.wait_for_unit("mediamtx.service")
-      machine.wait_for_unit("rtmp-publish.service")
-      machine.sleep(10)
-      machine.wait_for_unit("rtmp-receive.service")
-      machine.wait_for_open_port(9998)
-      machine.succeed("curl http://localhost:9998/metrics | grep '^rtmp_conns.*state=\"publish\".*1$'")
-      machine.succeed("curl http://localhost:9998/metrics | grep '^rtmp_conns.*state=\"read\".*1$'")
-    '';
-  }
-)
+    machine.wait_for_unit("mediamtx.service")
+
+    machine.wait_for_unit("rtmp-publish.service")
+    machine.wait_until_succeeds("curl http://localhost:9998/metrics | grep '^rtmp_conns.*state=\"publish\".*1$'")
+
+    machine.wait_for_unit("rtmp-receive.service")
+    machine.wait_until_succeeds("curl http://localhost:9998/metrics | grep '^rtmp_conns.*state=\"read\".*1$'")
+  '';
+}
diff --git a/nixos/tests/meilisearch.nix b/nixos/tests/meilisearch.nix
index a73abbba3a48..ae88b8e07157 100644
--- a/nixos/tests/meilisearch.nix
+++ b/nixos/tests/meilisearch.nix
@@ -1,69 +1,67 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    listenAddress = "127.0.0.1";
-    listenPort = 7700;
-    apiUrl = "http://${listenAddress}:${toString listenPort}";
-    uid = "movies";
-    indexJSON = pkgs.writeText "index.json" (builtins.toJSON { inherit uid; });
-    moviesJSON = pkgs.fetchurl {
-      url = "https://github.com/meilisearch/meilisearch/raw/v0.23.1/datasets/movies/movies.json";
-      sha256 = "1r3srld63dpmg9yrmysm6xl175661j5cspi93mk5q2wf8xwn50c5";
-    };
-  in
-  {
-    name = "meilisearch";
-    meta.maintainers = with lib.maintainers; [ Br1ght0ne ];
+{ pkgs, lib, ... }:
+let
+  listenAddress = "127.0.0.1";
+  listenPort = 7700;
+  apiUrl = "http://${listenAddress}:${toString listenPort}";
+  uid = "movies";
+  indexJSON = pkgs.writeText "index.json" (builtins.toJSON { inherit uid; });
+  moviesJSON = pkgs.fetchurl {
+    url = "https://github.com/meilisearch/meilisearch/raw/v0.23.1/datasets/movies/movies.json";
+    sha256 = "1r3srld63dpmg9yrmysm6xl175661j5cspi93mk5q2wf8xwn50c5";
+  };
+in
+{
+  name = "meilisearch";
+  meta.maintainers = with lib.maintainers; [ Br1ght0ne ];
 
-    nodes.machine =
-      { ... }:
-      {
-        environment.systemPackages = with pkgs; [
-          curl
-          jq
-        ];
-        services.meilisearch = {
-          enable = true;
-          inherit listenAddress listenPort;
-        };
+  nodes.machine =
+    { ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        curl
+        jq
+      ];
+      services.meilisearch = {
+        enable = true;
+        inherit listenAddress listenPort;
       };
+    };
 
-    testScript = ''
-      import json
+  testScript = ''
+    import json
 
-      start_all()
+    start_all()
 
-      machine.wait_for_unit("meilisearch")
-      machine.wait_for_open_port(7700)
+    machine.wait_for_unit("meilisearch")
+    machine.wait_for_open_port(7700)
 
-      with subtest("check version"):
-          version = json.loads(machine.succeed("curl ${apiUrl}/version"))
-          assert version["pkgVersion"] == "${pkgs.meilisearch.version}"
+    with subtest("check version"):
+        version = json.loads(machine.succeed("curl ${apiUrl}/version"))
+        assert version["pkgVersion"] == "${pkgs.meilisearch.version}"
 
-      with subtest("create index"):
-          machine.succeed(
-              "curl -X POST -H 'Content-Type: application/json' ${apiUrl}/indexes --data @${indexJSON}"
-          )
-          indexes = json.loads(machine.succeed("curl ${apiUrl}/indexes"))
-          assert indexes["total"] == 1, "index wasn't created"
+    with subtest("create index"):
+        machine.succeed(
+            "curl -X POST -H 'Content-Type: application/json' ${apiUrl}/indexes --data @${indexJSON}"
+        )
+        indexes = json.loads(machine.succeed("curl ${apiUrl}/indexes"))
+        assert indexes["total"] == 1, "index wasn't created"
 
-      with subtest("add documents"):
-          response = json.loads(
-              machine.succeed(
-                  "curl -X POST -H 'Content-Type: application/json' ${apiUrl}/indexes/${uid}/documents --data-binary @${moviesJSON}"
-              )
-          )
-          task_uid = response["taskUid"]
-          machine.wait_until_succeeds(
-              f"curl ${apiUrl}/tasks/{task_uid} | jq -e '.status == \"succeeded\"'"
-          )
+    with subtest("add documents"):
+        response = json.loads(
+            machine.succeed(
+                "curl -X POST -H 'Content-Type: application/json' ${apiUrl}/indexes/${uid}/documents --data-binary @${moviesJSON}"
+            )
+        )
+        task_uid = response["taskUid"]
+        machine.wait_until_succeeds(
+            f"curl ${apiUrl}/tasks/{task_uid} | jq -e '.status == \"succeeded\"'"
+        )
 
-      with subtest("search"):
-          response = json.loads(
-              machine.succeed("curl ${apiUrl}/indexes/movies/search?q=hero")
-          )
-          print(response)
-          assert len(response["hits"]) >= 1, "no results found"
-    '';
-  }
-)
+    with subtest("search"):
+        response = json.loads(
+            machine.succeed("curl ${apiUrl}/indexes/movies/search?q=hero")
+        )
+        print(response)
+        assert len(response["hits"]) >= 1, "no results found"
+  '';
+}
diff --git a/nixos/tests/merecat.nix b/nixos/tests/merecat.nix
index 072d8dd933de..db790dff41e8 100644
--- a/nixos/tests/merecat.nix
+++ b/nixos/tests/merecat.nix
@@ -1,35 +1,33 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "merecat";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fgaz ];
-    };
+{ pkgs, ... }:
+{
+  name = "merecat";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        services.merecat = {
-          enable = true;
-          settings = {
-            hostname = "localhost";
-            virtual-host = true;
-            directory = toString (
-              pkgs.runCommand "merecat-webdir" { } ''
-                mkdir -p $out/foo.localhost $out/bar.localhost
-                echo '<h1>Hello foo</h1>' > $out/foo.localhost/index.html
-                echo '<h1>Hello bar</h1>' > $out/bar.localhost/index.html
-              ''
-            );
-          };
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      services.merecat = {
+        enable = true;
+        settings = {
+          hostname = "localhost";
+          virtual-host = true;
+          directory = toString (
+            pkgs.runCommand "merecat-webdir" { } ''
+              mkdir -p $out/foo.localhost $out/bar.localhost
+              echo '<h1>Hello foo</h1>' > $out/foo.localhost/index.html
+              echo '<h1>Hello bar</h1>' > $out/bar.localhost/index.html
+            ''
+          );
         };
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("merecat")
-      machine.wait_for_open_port(80)
-      machine.succeed("curl --fail foo.localhost | grep 'Hello foo'")
-      machine.succeed("curl --fail bar.localhost | grep 'Hello bar'")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("merecat")
+    machine.wait_for_open_port(80)
+    machine.succeed("curl --fail foo.localhost | grep 'Hello foo'")
+    machine.succeed("curl --fail bar.localhost | grep 'Hello bar'")
+  '';
+}
diff --git a/nixos/tests/metabase.nix b/nixos/tests/metabase.nix
index f86c51b108fc..bf606d5d32cf 100644
--- a/nixos/tests/metabase.nix
+++ b/nixos/tests/metabase.nix
@@ -1,24 +1,22 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "metabase";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ mmahut ];
-    };
+{ pkgs, ... }:
+{
+  name = "metabase";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ mmahut ];
+  };
 
-    nodes = {
-      machine =
-        { ... }:
-        {
-          services.metabase.enable = true;
-        };
-    };
+  nodes = {
+    machine =
+      { ... }:
+      {
+        services.metabase.enable = true;
+      };
+  };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("metabase.service")
-      machine.wait_for_open_port(3000)
-      machine.wait_until_succeeds("curl -fL http://localhost:3000/setup | grep Metabase")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("metabase.service")
+    machine.wait_for_open_port(3000)
+    machine.wait_until_succeeds("curl -fL http://localhost:3000/setup | grep Metabase")
+  '';
+}
diff --git a/nixos/tests/mihomo.nix b/nixos/tests/mihomo.nix
index 4e16750a63b5..aa6bde4810fd 100644
--- a/nixos/tests/mihomo.nix
+++ b/nixos/tests/mihomo.nix
@@ -1,49 +1,47 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "mihomo";
-    meta.maintainers = with pkgs.lib.maintainers; [ Guanran928 ];
+{ pkgs, ... }:
+{
+  name = "mihomo";
+  meta.maintainers = with pkgs.lib.maintainers; [ Guanran928 ];
 
-    nodes.machine = {
-      environment.systemPackages = [ pkgs.curl ];
+  nodes.machine = {
+    environment.systemPackages = [ pkgs.curl ];
 
-      services.nginx = {
-        enable = true;
-        statusPage = true;
-      };
-
-      services.mihomo = {
-        enable = true;
-        configFile = pkgs.writeTextFile {
-          name = "config.yaml";
-          text = ''
-            mixed-port: 7890
-            external-controller: 127.0.0.1:9090
-            authentication:
-            - "user:supersecret"
-          '';
-        };
-      };
+    services.nginx = {
+      enable = true;
+      statusPage = true;
     };
 
-    testScript = ''
-      # Wait until it starts
-      machine.wait_for_unit("nginx.service")
-      machine.wait_for_unit("mihomo.service")
-      machine.wait_for_open_port(80)
-      machine.wait_for_open_port(7890)
-      machine.wait_for_open_port(9090)
+    services.mihomo = {
+      enable = true;
+      configFile = pkgs.writeTextFile {
+        name = "config.yaml";
+        text = ''
+          mixed-port: 7890
+          external-controller: 127.0.0.1:9090
+          authentication:
+          - "user:supersecret"
+        '';
+      };
+    };
+  };
 
-      # Proxy
-      machine.succeed("curl --fail --max-time 10 --proxy http://user:supersecret@localhost:7890 http://localhost")
-      machine.succeed("curl --fail --max-time 10 --proxy socks5://user:supersecret@localhost:7890 http://localhost")
-      machine.fail("curl --fail --max-time 10 --proxy http://user:supervillain@localhost:7890 http://localhost")
-      machine.fail("curl --fail --max-time 10 --proxy socks5://user:supervillain@localhost:7890 http://localhost")
+  testScript = ''
+    # Wait until it starts
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_unit("mihomo.service")
+    machine.wait_for_open_port(80)
+    machine.wait_for_open_port(7890)
+    machine.wait_for_open_port(9090)
 
-      # Web UI
-      result = machine.succeed("curl --fail http://localhost:9090")
-      target = '{"hello":"mihomo"}\n'
-      assert result == target, f"{result!r} != {target!r}"
-    '';
-  }
-)
+    # Proxy
+    machine.succeed("curl --fail --max-time 10 --proxy http://user:supersecret@localhost:7890 http://localhost")
+    machine.succeed("curl --fail --max-time 10 --proxy socks5://user:supersecret@localhost:7890 http://localhost")
+    machine.fail("curl --fail --max-time 10 --proxy http://user:supervillain@localhost:7890 http://localhost")
+    machine.fail("curl --fail --max-time 10 --proxy socks5://user:supervillain@localhost:7890 http://localhost")
+
+    # Web UI
+    result = machine.succeed("curl --fail http://localhost:9090")
+    target = '{"hello":"mihomo"}\n'
+    assert result == target, f"{result!r} != {target!r}"
+  '';
+}
diff --git a/nixos/tests/mimir.nix b/nixos/tests/mimir.nix
index 981990b93a1d..9922487751df 100644
--- a/nixos/tests/mimir.nix
+++ b/nixos/tests/mimir.nix
@@ -1,55 +1,53 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "mimir";
-    nodes = {
-      server =
-        { ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
-          services.mimir.enable = true;
-          services.mimir.configuration = {
-            ingester.ring.replication_factor = 1;
+{ pkgs, ... }:
+{
+  name = "mimir";
+  nodes = {
+    server =
+      { ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
+        services.mimir.enable = true;
+        services.mimir.configuration = {
+          ingester.ring.replication_factor = 1;
+        };
+
+        services.telegraf.enable = true;
+        services.telegraf.extraConfig = {
+          agent.interval = "1s";
+          agent.flush_interval = "1s";
+          inputs.exec = {
+            commands = [
+              "${pkgs.coreutils}/bin/echo 'foo i=42i'"
+            ];
+            data_format = "influx";
           };
+          outputs = {
+            http = {
+              # test remote write
+              url = "http://localhost:8080/api/v1/push";
 
-          services.telegraf.enable = true;
-          services.telegraf.extraConfig = {
-            agent.interval = "1s";
-            agent.flush_interval = "1s";
-            inputs.exec = {
-              commands = [
-                "${pkgs.coreutils}/bin/echo 'foo i=42i'"
-              ];
-              data_format = "influx";
-            };
-            outputs = {
-              http = {
-                # test remote write
-                url = "http://localhost:8080/api/v1/push";
+              # Data format to output.
+              data_format = "prometheusremotewrite";
 
-                # Data format to output.
-                data_format = "prometheusremotewrite";
-
-                headers = {
-                  Content-Type = "application/x-protobuf";
-                  Content-Encoding = "snappy";
-                  X-Scope-OrgID = "nixos";
-                  X-Prometheus-Remote-Write-Version = "0.1.0";
-                };
+              headers = {
+                Content-Type = "application/x-protobuf";
+                Content-Encoding = "snappy";
+                X-Scope-OrgID = "nixos";
+                X-Prometheus-Remote-Write-Version = "0.1.0";
               };
             };
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      server.wait_for_unit("mimir.service")
-      server.wait_for_unit("telegraf.service")
-      server.wait_for_open_port(8080)
-      server.wait_until_succeeds(
-          "curl -H 'X-Scope-OrgID: nixos' http://127.0.0.1:8080/prometheus/api/v1/label/host/values | jq -r '.data[0]' | grep server"
-      )
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    server.wait_for_unit("mimir.service")
+    server.wait_for_unit("telegraf.service")
+    server.wait_for_open_port(8080)
+    server.wait_until_succeeds(
+        "curl -H 'X-Scope-OrgID: nixos' http://127.0.0.1:8080/prometheus/api/v1/label/host/values | jq -r '.data[0]' | grep server"
+    )
+  '';
+}
diff --git a/nixos/tests/mindustry.nix b/nixos/tests/mindustry.nix
index 3ec5fb32a0d3..d140520b1d19 100644
--- a/nixos/tests/mindustry.nix
+++ b/nixos/tests/mindustry.nix
@@ -1,32 +1,30 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "mindustry";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fgaz ];
+{ pkgs, ... }:
+{
+  name = "mindustry";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      environment.systemPackages = [ pkgs.mindustry ];
     };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  enableOCR = true;
 
-        services.xserver.enable = true;
-        environment.systemPackages = [ pkgs.mindustry ];
-      };
-
-    enableOCR = true;
-
-    testScript = ''
-      machine.wait_for_x()
-      machine.execute("mindustry >&2 &")
-      machine.wait_for_window("Mindustry")
-      # Loading can take a while. Avoid wasting cycles on OCR during that time
-      machine.sleep(60)
-      machine.wait_for_text(r"(Play|Database|Editor|Mods|Settings|Quit)")
-      machine.screenshot("screen")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_x()
+    machine.execute("mindustry >&2 &")
+    machine.wait_for_window("Mindustry")
+    # Loading can take a while. Avoid wasting cycles on OCR during that time
+    machine.sleep(60)
+    machine.wait_for_text(r"(Play|Database|Editor|Mods|Settings|Quit)")
+    machine.screenshot("screen")
+  '';
+}
diff --git a/nixos/tests/minecraft-server.nix b/nixos/tests/minecraft-server.nix
index f8edf0aefb7a..32d4619cd5cd 100644
--- a/nixos/tests/minecraft-server.nix
+++ b/nixos/tests/minecraft-server.nix
@@ -3,46 +3,44 @@ let
   rcon-pass = "foobar";
   rcon-port = 43000;
 in
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "minecraft-server";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ nequissimus ];
-    };
+{ lib, pkgs, ... }:
+{
+  name = "minecraft-server";
+  meta.maintainers = with lib.maintainers; [ nequissimus ];
 
-    nodes.server =
-      { ... }:
-      {
-        environment.systemPackages = [ pkgs.mcrcon ];
+  node.pkgsReadOnly = false;
 
-        nixpkgs.config.allowUnfree = true;
+  nodes.server =
+    { ... }:
+    {
+      environment.systemPackages = [ pkgs.mcrcon ];
 
-        services.minecraft-server = {
-          declarative = true;
-          enable = true;
-          eula = true;
-          serverProperties = {
-            enable-rcon = true;
-            level-seed = seed;
-            level-type = "flat";
-            generate-structures = false;
-            online-mode = false;
-            "rcon.password" = rcon-pass;
-            "rcon.port" = rcon-port;
-          };
+      nixpkgs.config.allowUnfree = true;
+
+      services.minecraft-server = {
+        declarative = true;
+        enable = true;
+        eula = true;
+        serverProperties = {
+          enable-rcon = true;
+          level-seed = seed;
+          level-type = "flat";
+          generate-structures = false;
+          online-mode = false;
+          "rcon.password" = rcon-pass;
+          "rcon.port" = rcon-port;
         };
-
-        virtualisation.memorySize = 2047;
       };
 
-    testScript = ''
-      server.wait_for_unit("minecraft-server")
-      server.wait_for_open_port(${toString rcon-port})
-      assert "${seed}" in server.succeed(
-          "mcrcon -H localhost -P ${toString rcon-port} -p '${rcon-pass}' -c 'seed'"
-      )
-      server.succeed("systemctl stop minecraft-server")
-    '';
-  }
-)
+      virtualisation.memorySize = 2047;
+    };
+
+  testScript = ''
+    server.wait_for_unit("minecraft-server")
+    server.wait_for_open_port(${toString rcon-port})
+    assert "${seed}" in server.succeed(
+        "mcrcon -H localhost -P ${toString rcon-port} -p '${rcon-pass}' -c 'seed'"
+    )
+    server.succeed("systemctl stop minecraft-server")
+  '';
+}
diff --git a/nixos/tests/minecraft.nix b/nixos/tests/minecraft.nix
index 5f75669900a2..db577a573b23 100644
--- a/nixos/tests/minecraft.nix
+++ b/nixos/tests/minecraft.nix
@@ -1,42 +1,40 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "minecraft";
-    meta = with lib.maintainers; {
-      maintainers = [ nequissimus ];
+{ pkgs, lib, ... }:
+{
+  name = "minecraft";
+  meta = with lib.maintainers; {
+    maintainers = [ nequissimus ];
+  };
+
+  nodes.client =
+    { nodes, ... }:
+    let
+      user = nodes.client.config.users.users.alice;
+    in
+    {
+      imports = [
+        ./common/user-account.nix
+        ./common/x11.nix
+      ];
+
+      environment.systemPackages = [ pkgs.minecraft ];
+
+      nixpkgs.config.allowUnfree = true;
+
+      test-support.displayManager.auto.user = user.name;
     };
 
-    nodes.client =
-      { nodes, ... }:
-      let
-        user = nodes.client.config.users.users.alice;
-      in
-      {
-        imports = [
-          ./common/user-account.nix
-          ./common/x11.nix
-        ];
+  enableOCR = true;
 
-        environment.systemPackages = [ pkgs.minecraft ];
-
-        nixpkgs.config.allowUnfree = true;
-
-        test-support.displayManager.auto.user = user.name;
-      };
-
-    enableOCR = true;
-
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.client.config.users.users.alice;
-      in
-      ''
-        client.wait_for_x()
-        client.execute("su - alice -c minecraft-launcher >&2 &")
-        client.wait_for_text("Create a new Microsoft account")
-        client.sleep(10)
-        client.screenshot("launcher")
-      '';
-  }
-)
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.client.config.users.users.alice;
+    in
+    ''
+      client.wait_for_x()
+      client.execute("su - alice -c minecraft-launcher >&2 &")
+      client.wait_for_text("Create a new Microsoft account")
+      client.sleep(10)
+      client.screenshot("launcher")
+    '';
+}
diff --git a/nixos/tests/minidlna.nix b/nixos/tests/minidlna.nix
index a1add4ba4836..5e32190a9623 100644
--- a/nixos/tests/minidlna.nix
+++ b/nixos/tests/minidlna.nix
@@ -1,42 +1,40 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "minidlna";
+{ pkgs, ... }:
+{
+  name = "minidlna";
 
-    nodes = {
-      server =
-        { ... }:
-        {
-          imports = [ ../modules/profiles/minimal.nix ];
-          services.minidlna.enable = true;
-          services.minidlna.openFirewall = true;
-          services.minidlna.settings = {
-            log_level = "error";
-            media_dir = [
-              "PV,/tmp/stuff"
-            ];
-            friendly_name = "rpi3";
-            root_container = "B";
-            notify_interval = 60;
-            album_art_names = [
-              "Cover.jpg/cover.jpg/AlbumArtSmall.jpg/albumartsmall.jpg"
-              "AlbumArt.jpg/albumart.jpg/Album.jpg/album.jpg"
-              "Folder.jpg/folder.jpg/Thumb.jpg/thumb.jpg"
-            ];
-          };
+  nodes = {
+    server =
+      { ... }:
+      {
+        imports = [ ../modules/profiles/minimal.nix ];
+        services.minidlna.enable = true;
+        services.minidlna.openFirewall = true;
+        services.minidlna.settings = {
+          log_level = "error";
+          media_dir = [
+            "PV,/tmp/stuff"
+          ];
+          friendly_name = "rpi3";
+          root_container = "B";
+          notify_interval = 60;
+          album_art_names = [
+            "Cover.jpg/cover.jpg/AlbumArtSmall.jpg/albumartsmall.jpg"
+            "AlbumArt.jpg/albumart.jpg/Album.jpg/album.jpg"
+            "Folder.jpg/folder.jpg/Thumb.jpg/thumb.jpg"
+          ];
         };
-      client = { ... }: { };
-    };
+      };
+    client = { ... }: { };
+  };
 
-    testScript = ''
-      start_all()
-      server.succeed("mkdir -p /tmp/stuff && chown minidlna: /tmp/stuff")
-      server.wait_for_unit("minidlna")
-      server.wait_for_open_port(8200)
-      # requests must be made *by IP* to avoid triggering minidlna's
-      # DNS-rebinding protection
-      server.succeed("curl --fail http://$(getent ahostsv4 localhost | head -n1 | cut -f 1 -d ' '):8200/")
-      client.succeed("curl --fail http://$(getent ahostsv4 server | head -n1 | cut -f 1 -d ' '):8200/")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    server.succeed("mkdir -p /tmp/stuff && chown minidlna: /tmp/stuff")
+    server.wait_for_unit("minidlna")
+    server.wait_for_open_port(8200)
+    # requests must be made *by IP* to avoid triggering minidlna's
+    # DNS-rebinding protection
+    server.succeed("curl --fail http://$(getent ahostsv4 localhost | head -n1 | cut -f 1 -d ' '):8200/")
+    client.succeed("curl --fail http://$(getent ahostsv4 server | head -n1 | cut -f 1 -d ' '):8200/")
+  '';
+}
diff --git a/nixos/tests/miniflux.nix b/nixos/tests/miniflux.nix
index f349a7a2c45c..e13214a148a8 100644
--- a/nixos/tests/miniflux.nix
+++ b/nixos/tests/miniflux.nix
@@ -1,132 +1,130 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    port = 3142;
-    username = "alice";
-    password = "correcthorsebatterystaple";
-    defaultPort = 8080;
-    defaultUsername = "admin";
-    defaultPassword = "password";
-    adminCredentialsFile = pkgs.writeText "admin-credentials" ''
-      ADMIN_USERNAME=${defaultUsername}
-      ADMIN_PASSWORD=${defaultPassword}
-    '';
-    customAdminCredentialsFile = pkgs.writeText "admin-credentials" ''
-      ADMIN_USERNAME=${username}
-      ADMIN_PASSWORD=${password}
-    '';
-    postgresPassword = "correcthorsebatterystaple";
-    postgresPasswordFile = pkgs.writeText "pgpass" ''
-      *:*:*:*:${postgresPassword}
-    '';
+let
+  port = 3142;
+  username = "alice";
+  password = "correcthorsebatterystaple";
+  defaultPort = 8080;
+  defaultUsername = "admin";
+  defaultPassword = "password";
+  adminCredentialsFile = pkgs.writeText "admin-credentials" ''
+    ADMIN_USERNAME=${defaultUsername}
+    ADMIN_PASSWORD=${defaultPassword}
+  '';
+  customAdminCredentialsFile = pkgs.writeText "admin-credentials" ''
+    ADMIN_USERNAME=${username}
+    ADMIN_PASSWORD=${password}
+  '';
+  postgresPassword = "correcthorsebatterystaple";
+  postgresPasswordFile = pkgs.writeText "pgpass" ''
+    *:*:*:*:${postgresPassword}
+  '';
 
-  in
-  {
-    name = "miniflux";
-    meta.maintainers = [ ];
+in
+{
+  name = "miniflux";
+  meta.maintainers = [ ];
 
-    nodes = {
-      default =
-        { ... }:
-        {
-          security.apparmor.enable = true;
-          services.miniflux = {
-            enable = true;
-            inherit adminCredentialsFile;
-          };
+  nodes = {
+    default =
+      { ... }:
+      {
+        security.apparmor.enable = true;
+        services.miniflux = {
+          enable = true;
+          inherit adminCredentialsFile;
         };
+      };
 
-      withoutSudo =
-        { ... }:
-        {
-          security.apparmor.enable = true;
-          services.miniflux = {
-            enable = true;
-            inherit adminCredentialsFile;
-          };
-          security.sudo.enable = false;
+    withoutSudo =
+      { ... }:
+      {
+        security.apparmor.enable = true;
+        services.miniflux = {
+          enable = true;
+          inherit adminCredentialsFile;
         };
+        security.sudo.enable = false;
+      };
 
-      customized =
-        { ... }:
-        {
-          security.apparmor.enable = true;
-          services.miniflux = {
-            enable = true;
-            config = {
-              CLEANUP_FREQUENCY = "48";
-              LISTEN_ADDR = "localhost:${toString port}";
-            };
-            adminCredentialsFile = customAdminCredentialsFile;
+    customized =
+      { ... }:
+      {
+        security.apparmor.enable = true;
+        services.miniflux = {
+          enable = true;
+          config = {
+            CLEANUP_FREQUENCY = "48";
+            LISTEN_ADDR = "localhost:${toString port}";
           };
+          adminCredentialsFile = customAdminCredentialsFile;
         };
+      };
 
-      postgresTcp =
-        {
-          config,
-          pkgs,
-          lib,
-          ...
-        }:
-        {
-          services.postgresql = {
-            enable = true;
-            initialScript = pkgs.writeText "init-postgres" ''
-              CREATE USER miniflux WITH PASSWORD '${postgresPassword}';
-              CREATE DATABASE miniflux WITH OWNER miniflux;
-            '';
-            enableTCPIP = true;
-            authentication = ''
-              host sameuser miniflux samenet scram-sha-256
-            '';
-          };
-          systemd.services.postgresql.postStart = lib.mkAfter ''
-            $PSQL -tAd miniflux -c 'CREATE EXTENSION hstore;'
+    postgresTcp =
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
+      {
+        services.postgresql = {
+          enable = true;
+          initialScript = pkgs.writeText "init-postgres" ''
+            CREATE USER miniflux WITH PASSWORD '${postgresPassword}';
+            CREATE DATABASE miniflux WITH OWNER miniflux;
           '';
-          networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
-        };
-      externalDb =
-        { ... }:
-        {
-          security.apparmor.enable = true;
-          services.miniflux = {
-            enable = true;
-            createDatabaseLocally = false;
-            inherit adminCredentialsFile;
-            config = {
-              DATABASE_URL = "user=miniflux host=postgresTcp dbname=miniflux sslmode=disable";
-              PGPASSFILE = "/run/miniflux/pgpass";
-            };
-          };
-          systemd.services.miniflux.preStart = ''
-            cp ${postgresPasswordFile} /run/miniflux/pgpass
-            chmod 600 /run/miniflux/pgpass
+          enableTCPIP = true;
+          authentication = ''
+            host sameuser miniflux samenet scram-sha-256
           '';
         };
-    };
-    testScript = ''
-      def runTest(machine, port, user):
-        machine.wait_for_unit("miniflux.service")
-        machine.wait_for_open_port(port)
-        machine.succeed(f"curl --fail 'http://localhost:{port}/healthcheck' | grep OK")
-        machine.succeed(
-            f"curl 'http://localhost:{port}/v1/me' -u '{user}' -H Content-Type:application/json | grep '\"is_admin\":true'"
-        )
-        machine.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""')
+        systemd.services.postgresql.postStart = lib.mkAfter ''
+          $PSQL -tAd miniflux -c 'CREATE EXTENSION hstore;'
+        '';
+        networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
+      };
+    externalDb =
+      { ... }:
+      {
+        security.apparmor.enable = true;
+        services.miniflux = {
+          enable = true;
+          createDatabaseLocally = false;
+          inherit adminCredentialsFile;
+          config = {
+            DATABASE_URL = "user=miniflux host=postgresTcp dbname=miniflux sslmode=disable";
+            PGPASSFILE = "/run/miniflux/pgpass";
+          };
+        };
+        systemd.services.miniflux.preStart = ''
+          cp ${postgresPasswordFile} /run/miniflux/pgpass
+          chmod 600 /run/miniflux/pgpass
+        '';
+      };
+  };
+  testScript = ''
+    def runTest(machine, port, user):
+      machine.wait_for_unit("miniflux.service")
+      machine.wait_for_open_port(port)
+      machine.succeed(f"curl --fail 'http://localhost:{port}/healthcheck' | grep OK")
+      machine.succeed(
+          f"curl 'http://localhost:{port}/v1/me' -u '{user}' -H Content-Type:application/json | grep '\"is_admin\":true'"
+      )
+      machine.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""')
 
-      default.start()
-      withoutSudo.start()
-      customized.start()
-      postgresTcp.start()
+    default.start()
+    withoutSudo.start()
+    customized.start()
+    postgresTcp.start()
 
-      runTest(default, ${toString defaultPort}, "${defaultUsername}:${defaultPassword}")
-      runTest(withoutSudo, ${toString defaultPort}, "${defaultUsername}:${defaultPassword}")
-      runTest(customized, ${toString port}, "${username}:${password}")
+    runTest(default, ${toString defaultPort}, "${defaultUsername}:${defaultPassword}")
+    runTest(withoutSudo, ${toString defaultPort}, "${defaultUsername}:${defaultPassword}")
+    runTest(customized, ${toString port}, "${username}:${password}")
 
-      postgresTcp.wait_for_unit("postgresql.service")
-      externalDb.start()
-      runTest(externalDb, ${toString defaultPort}, "${defaultUsername}:${defaultPassword}")
-    '';
-  }
-)
+    postgresTcp.wait_for_unit("postgresql.service")
+    externalDb.start()
+    runTest(externalDb, ${toString defaultPort}, "${defaultUsername}:${defaultPassword}")
+  '';
+}
diff --git a/nixos/tests/minio.nix b/nixos/tests/minio.nix
index d4d34ea660f0..dfe7f169def1 100644
--- a/nixos/tests/minio.nix
+++ b/nixos/tests/minio.nix
@@ -1,116 +1,114 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
-      openssl req \
-        -x509 -newkey rsa:4096 -sha256 -days 365 \
-        -nodes -out cert.pem -keyout key.pem \
-        -subj '/CN=minio' -addext "subjectAltName=DNS:localhost"
+{ pkgs, ... }:
+let
+  tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+    openssl req \
+      -x509 -newkey rsa:4096 -sha256 -days 365 \
+      -nodes -out cert.pem -keyout key.pem \
+      -subj '/CN=minio' -addext "subjectAltName=DNS:localhost"
 
-      mkdir -p $out
-      cp key.pem cert.pem $out
-    '';
+    mkdir -p $out
+    cp key.pem cert.pem $out
+  '';
 
-    accessKey = "BKIKJAA5BMMU2RHO6IBB";
-    secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
-    minioPythonScript = pkgs.writeScript "minio-test.py" ''
-      #! ${pkgs.python3.withPackages (ps: [ ps.minio ])}/bin/python
-      import io
-      import os
-      import sys
-      from minio import Minio
+  accessKey = "BKIKJAA5BMMU2RHO6IBB";
+  secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
+  minioPythonScript = pkgs.writeScript "minio-test.py" ''
+    #! ${pkgs.python3.withPackages (ps: [ ps.minio ])}/bin/python
+    import io
+    import os
+    import sys
+    from minio import Minio
 
-      if len(sys.argv) > 1 and sys.argv[1] == 'tls':
-        tls = True
-      else:
-        tls = False
+    if len(sys.argv) > 1 and sys.argv[1] == 'tls':
+      tls = True
+    else:
+      tls = False
 
-      minioClient = Minio('localhost:9000',
-                    access_key='${accessKey}',
-                    secret_key='${secretKey}',
-                    secure=tls,
-                    cert_check=False)
-      sio = io.BytesIO()
-      sio.write(b'Test from Python')
-      sio.seek(0, os.SEEK_END)
-      sio_len = sio.tell()
-      sio.seek(0)
-      minioClient.put_object('test-bucket', 'test.txt', sio, sio_len, content_type='text/plain')
-    '';
-    rootCredentialsFile = "/etc/nixos/minio-root-credentials";
-    credsPartial = pkgs.writeText "minio-credentials-partial" ''
-      MINIO_ROOT_USER=${accessKey}
-    '';
-    credsFull = pkgs.writeText "minio-credentials-full" ''
-      MINIO_ROOT_USER=${accessKey}
-      MINIO_ROOT_PASSWORD=${secretKey}
-    '';
-  in
-  {
-    name = "minio";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ bachp ];
-    };
+    minioClient = Minio('localhost:9000',
+                  access_key='${accessKey}',
+                  secret_key='${secretKey}',
+                  secure=tls,
+                  cert_check=False)
+    sio = io.BytesIO()
+    sio.write(b'Test from Python')
+    sio.seek(0, os.SEEK_END)
+    sio_len = sio.tell()
+    sio.seek(0)
+    minioClient.put_object('test-bucket', 'test.txt', sio, sio_len, content_type='text/plain')
+  '';
+  rootCredentialsFile = "/etc/nixos/minio-root-credentials";
+  credsPartial = pkgs.writeText "minio-credentials-partial" ''
+    MINIO_ROOT_USER=${accessKey}
+  '';
+  credsFull = pkgs.writeText "minio-credentials-full" ''
+    MINIO_ROOT_USER=${accessKey}
+    MINIO_ROOT_PASSWORD=${secretKey}
+  '';
+in
+{
+  name = "minio";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ bachp ];
+  };
 
-    nodes = {
-      machine =
-        { pkgs, ... }:
-        {
-          services.minio = {
-            enable = true;
-            inherit rootCredentialsFile;
-          };
-          environment.systemPackages = [ pkgs.minio-client ];
-
-          # Minio requires at least 1GiB of free disk space to run.
-          virtualisation.diskSize = 4 * 1024;
-
-          # Minio pre allocates 2GiB or memory, reserve some more
-          virtualisation.memorySize = 4096;
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.minio = {
+          enable = true;
+          inherit rootCredentialsFile;
         };
-    };
+        environment.systemPackages = [ pkgs.minio-client ];
 
-    testScript = ''
+        # Minio requires at least 1GiB of free disk space to run.
+        virtualisation.diskSize = 4 * 1024;
 
-      start_all()
-      # simulate manually editing root credentials file
-      machine.wait_for_unit("multi-user.target")
-      machine.copy_from_host("${credsFull}", "${rootCredentialsFile}")
+        # Minio pre allocates 2GiB or memory, reserve some more
+        virtualisation.memorySize = 4096;
+      };
+  };
 
-      # Test non-TLS server
-      machine.wait_for_unit("minio.service")
-      machine.wait_for_open_port(9000)
+  testScript = ''
 
-      # Create a test bucket on the server
-      machine.succeed(
-          "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
-      )
-      machine.succeed("mc mb minio/test-bucket")
-      machine.succeed("${minioPythonScript}")
-      assert "test-bucket" in machine.succeed("mc ls minio")
-      assert "Test from Python" in machine.succeed("mc cat minio/test-bucket/test.txt")
-      machine.succeed("mc rb --force minio/test-bucket")
-      machine.systemctl("stop minio.service")
+    start_all()
+    # simulate manually editing root credentials file
+    machine.wait_for_unit("multi-user.target")
+    machine.copy_from_host("${credsFull}", "${rootCredentialsFile}")
 
-      # Test TLS server
-      machine.copy_from_host("${tls-cert}/cert.pem", "/var/lib/minio/certs/public.crt")
-      machine.copy_from_host("${tls-cert}/key.pem", "/var/lib/minio/certs/private.key")
+    # Test non-TLS server
+    machine.wait_for_unit("minio.service")
+    machine.wait_for_open_port(9000)
 
-      machine.systemctl("start minio.service")
-      machine.wait_for_unit("minio.service")
-      machine.wait_for_open_port(9000)
+    # Create a test bucket on the server
+    machine.succeed(
+        "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
+    )
+    machine.succeed("mc mb minio/test-bucket")
+    machine.succeed("${minioPythonScript}")
+    assert "test-bucket" in machine.succeed("mc ls minio")
+    assert "Test from Python" in machine.succeed("mc cat minio/test-bucket/test.txt")
+    machine.succeed("mc rb --force minio/test-bucket")
+    machine.systemctl("stop minio.service")
 
-      # Create a test bucket on the server
-      machine.succeed(
-          "mc config host add minio https://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
-      )
-      machine.succeed("mc --insecure mb minio/test-bucket")
-      machine.succeed("${minioPythonScript} tls")
-      assert "test-bucket" in machine.succeed("mc --insecure ls minio")
-      assert "Test from Python" in machine.succeed("mc --insecure cat minio/test-bucket/test.txt")
-      machine.succeed("mc --insecure rb --force minio/test-bucket")
+    # Test TLS server
+    machine.copy_from_host("${tls-cert}/cert.pem", "/var/lib/minio/certs/public.crt")
+    machine.copy_from_host("${tls-cert}/key.pem", "/var/lib/minio/certs/private.key")
 
-      machine.shutdown()
-    '';
-  }
-)
+    machine.systemctl("start minio.service")
+    machine.wait_for_unit("minio.service")
+    machine.wait_for_open_port(9000)
+
+    # Create a test bucket on the server
+    machine.succeed(
+        "mc config host add minio https://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
+    )
+    machine.succeed("mc --insecure mb minio/test-bucket")
+    machine.succeed("${minioPythonScript} tls")
+    assert "test-bucket" in machine.succeed("mc --insecure ls minio")
+    assert "Test from Python" in machine.succeed("mc --insecure cat minio/test-bucket/test.txt")
+    machine.succeed("mc --insecure rb --force minio/test-bucket")
+
+    machine.shutdown()
+  '';
+}
diff --git a/nixos/tests/misc.nix b/nixos/tests/misc.nix
index 55d719aeafbb..50efcbd28999 100644
--- a/nixos/tests/misc.nix
+++ b/nixos/tests/misc.nix
@@ -1,170 +1,168 @@
 # Miscellaneous small tests that don't warrant their own VM run.
 
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    foo = pkgs.writeText "foo" "Hello World";
-  in
-  {
-    name = "misc";
-    meta.maintainers = with lib.maintainers; [ eelco ];
+{ lib, pkgs, ... }:
+let
+  foo = pkgs.writeText "foo" "Hello World";
+in
+{
+  name = "misc";
+  meta.maintainers = with lib.maintainers; [ eelco ];
 
-    nodes.machine =
-      { lib, ... }:
-      {
-        swapDevices = lib.mkOverride 0 [
-          {
-            device = "/root/swapfile";
-            size = 128;
-          }
-        ];
-        environment.variables.EDITOR = lib.mkOverride 0 "emacs";
-        systemd.tmpfiles.rules = [ "d /tmp 1777 root root 10d" ];
-        systemd.tmpfiles.settings."10-test"."/tmp/somefile".d = { };
-        virtualisation.fileSystems = {
-          "/tmp2" = {
-            fsType = "tmpfs";
-            options = [
-              "mode=1777"
-              "noauto"
-            ];
-          };
-          # Tests https://discourse.nixos.org/t/how-to-make-a-derivations-executables-have-the-s-permission/8555
-          "/user-mount/point" = {
-            device = "/user-mount/source";
-            fsType = "none";
-            options = [
-              "bind"
-              "rw"
-              "user"
-              "noauto"
-            ];
-          };
-          "/user-mount/denied-point" = {
-            device = "/user-mount/denied-source";
-            fsType = "none";
-            options = [
-              "bind"
-              "rw"
-              "noauto"
-            ];
-          };
+  nodes.machine =
+    { lib, ... }:
+    {
+      swapDevices = lib.mkOverride 0 [
+        {
+          device = "/root/swapfile";
+          size = 128;
+        }
+      ];
+      environment.variables.EDITOR = lib.mkOverride 0 "emacs";
+      systemd.tmpfiles.rules = [ "d /tmp 1777 root root 10d" ];
+      systemd.tmpfiles.settings."10-test"."/tmp/somefile".d = { };
+      virtualisation.fileSystems = {
+        "/tmp2" = {
+          fsType = "tmpfs";
+          options = [
+            "mode=1777"
+            "noauto"
+          ];
         };
-        systemd.automounts = lib.singleton {
-          wantedBy = [ "multi-user.target" ];
-          where = "/tmp2";
+        # Tests https://discourse.nixos.org/t/how-to-make-a-derivations-executables-have-the-s-permission/8555
+        "/user-mount/point" = {
+          device = "/user-mount/source";
+          fsType = "none";
+          options = [
+            "bind"
+            "rw"
+            "user"
+            "noauto"
+          ];
         };
-        users.users.sybil = {
-          isNormalUser = true;
-          group = "wheel";
+        "/user-mount/denied-point" = {
+          device = "/user-mount/denied-source";
+          fsType = "none";
+          options = [
+            "bind"
+            "rw"
+            "noauto"
+          ];
         };
-        users.users.alice = {
-          isNormalUser = true;
-        };
-        security.sudo = {
-          enable = true;
-          wheelNeedsPassword = false;
-        };
-        boot.kernel.sysctl."vm.swappiness" = 1;
-        boot.kernelParams = [ "vsyscall=emulate" ];
-        system.extraDependencies = [ foo ];
       };
+      systemd.automounts = lib.singleton {
+        wantedBy = [ "multi-user.target" ];
+        where = "/tmp2";
+      };
+      users.users.sybil = {
+        isNormalUser = true;
+        group = "wheel";
+      };
+      users.users.alice = {
+        isNormalUser = true;
+      };
+      security.sudo = {
+        enable = true;
+        wheelNeedsPassword = false;
+      };
+      boot.kernel.sysctl."vm.swappiness" = 1;
+      boot.kernelParams = [ "vsyscall=emulate" ];
+      system.extraDependencies = [ foo ];
+    };
 
-    testScript = ''
-      with subtest("nixos-version"):
-          machine.succeed("[ `nixos-version | wc -w` = 2 ]")
+  testScript = ''
+    with subtest("nixos-version"):
+        machine.succeed("[ `nixos-version | wc -w` = 2 ]")
 
-      with subtest("nixos-rebuild"):
-          assert "NixOS module" in machine.succeed("nixos-rebuild --help")
+    with subtest("nixos-rebuild"):
+        assert "NixOS module" in machine.succeed("nixos-rebuild --help")
 
-      with subtest("Sanity check for uid/gid assignment"):
-          assert "4" == machine.succeed("id -u messagebus").strip()
-          assert "4" == machine.succeed("id -g messagebus").strip()
-          assert "users:x:100:" == machine.succeed("getent group users").strip()
+    with subtest("Sanity check for uid/gid assignment"):
+        assert "4" == machine.succeed("id -u messagebus").strip()
+        assert "4" == machine.succeed("id -g messagebus").strip()
+        assert "users:x:100:" == machine.succeed("getent group users").strip()
 
-      with subtest("Regression test for GMP aborts on QEMU."):
-          machine.succeed("expr 1 + 2")
+    with subtest("Regression test for GMP aborts on QEMU."):
+        machine.succeed("expr 1 + 2")
 
-      with subtest("the swap file got created"):
-          machine.wait_for_unit("root-swapfile.swap")
-          machine.succeed("ls -l /root/swapfile | grep 134217728")
+    with subtest("the swap file got created"):
+        machine.wait_for_unit("root-swapfile.swap")
+        machine.succeed("ls -l /root/swapfile | grep 134217728")
 
-      with subtest("whether kernel.poweroff_cmd is set"):
-          machine.succeed('[ -x "$(cat /proc/sys/kernel/poweroff_cmd)" ]')
+    with subtest("whether kernel.poweroff_cmd is set"):
+        machine.succeed('[ -x "$(cat /proc/sys/kernel/poweroff_cmd)" ]')
 
-      with subtest("whether the io cgroupv2 controller is properly enabled"):
-          machine.succeed("grep -q '\\bio\\b' /sys/fs/cgroup/cgroup.controllers")
+    with subtest("whether the io cgroupv2 controller is properly enabled"):
+        machine.succeed("grep -q '\\bio\\b' /sys/fs/cgroup/cgroup.controllers")
 
-      with subtest("whether we have a reboot record in wtmp"):
-          machine.shutdown
-          machine.wait_for_unit("multi-user.target")
-          machine.succeed("last | grep reboot >&2")
+    with subtest("whether we have a reboot record in wtmp"):
+        machine.shutdown
+        machine.wait_for_unit("multi-user.target")
+        machine.succeed("last | grep reboot >&2")
 
-      with subtest("whether we can override environment variables"):
-          machine.succeed('[ "$EDITOR" = emacs ]')
+    with subtest("whether we can override environment variables"):
+        machine.succeed('[ "$EDITOR" = emacs ]')
 
-      with subtest("whether hostname (and by extension nss_myhostname) works"):
-          assert "machine" == machine.succeed("hostname").strip()
-          assert "machine" == machine.succeed("hostname -s").strip()
+    with subtest("whether hostname (and by extension nss_myhostname) works"):
+        assert "machine" == machine.succeed("hostname").strip()
+        assert "machine" == machine.succeed("hostname -s").strip()
 
-      with subtest("whether systemd-udevd automatically loads modules for our hardware"):
-          machine.succeed("systemctl start systemd-udev-settle.service")
-          machine.wait_for_unit("systemd-udev-settle.service")
-          assert "mousedev" in machine.succeed("lsmod")
+    with subtest("whether systemd-udevd automatically loads modules for our hardware"):
+        machine.succeed("systemctl start systemd-udev-settle.service")
+        machine.wait_for_unit("systemd-udev-settle.service")
+        assert "mousedev" in machine.succeed("lsmod")
 
-      with subtest("whether systemd-tmpfiles-clean works"):
-          machine.succeed(
-              "touch /tmp/foo", "systemctl start systemd-tmpfiles-clean", "[ -e /tmp/foo ]"
-          )
-          # move into the future
-          machine.succeed(
-              'date -s "@$(($(date +%s) + 1000000))"',
-              "systemctl start systemd-tmpfiles-clean",
-          )
-          machine.fail("[ -e /tmp/foo ]")
+    with subtest("whether systemd-tmpfiles-clean works"):
+        machine.succeed(
+            "touch /tmp/foo", "systemctl start systemd-tmpfiles-clean", "[ -e /tmp/foo ]"
+        )
+        # move into the future
+        machine.succeed(
+            'date -s "@$(($(date +%s) + 1000000))"',
+            "systemctl start systemd-tmpfiles-clean",
+        )
+        machine.fail("[ -e /tmp/foo ]")
 
-      with subtest("whether systemd-tmpfiles settings works"):
-          machine.succeed("[ -e /tmp/somefile ]")
+    with subtest("whether systemd-tmpfiles settings works"):
+        machine.succeed("[ -e /tmp/somefile ]")
 
-      with subtest("/etc/mtab"):
-          assert "/proc/mounts" == machine.succeed("readlink --no-newline /etc/mtab")
+    with subtest("/etc/mtab"):
+        assert "/proc/mounts" == machine.succeed("readlink --no-newline /etc/mtab")
 
-      with subtest("whether automounting works"):
-          machine.fail("grep '/tmp2 tmpfs' /proc/mounts")
-          machine.succeed("touch /tmp2/x")
-          machine.succeed("grep '/tmp2 tmpfs' /proc/mounts")
+    with subtest("whether automounting works"):
+        machine.fail("grep '/tmp2 tmpfs' /proc/mounts")
+        machine.succeed("touch /tmp2/x")
+        machine.succeed("grep '/tmp2 tmpfs' /proc/mounts")
 
-      with subtest(
-          "Whether mounting by a user is possible with the `user` option in fstab (#95444)"
-      ):
-          machine.succeed("mkdir -p /user-mount/source")
-          machine.succeed("touch /user-mount/source/file")
-          machine.succeed("chmod -R a+Xr /user-mount/source")
-          machine.succeed("mkdir /user-mount/point")
-          machine.succeed("chown alice:users /user-mount/point")
-          machine.succeed("su - alice -c 'mount /user-mount/point'")
-          machine.succeed("su - alice -c 'ls /user-mount/point/file'")
-      with subtest(
-          "Whether mounting by a user is denied without the `user` option in  fstab"
-      ):
-          machine.succeed("mkdir -p /user-mount/denied-source")
-          machine.succeed("touch /user-mount/denied-source/file")
-          machine.succeed("chmod -R a+Xr /user-mount/denied-source")
-          machine.succeed("mkdir /user-mount/denied-point")
-          machine.succeed("chown alice:users /user-mount/denied-point")
-          machine.fail("su - alice -c 'mount /user-mount/denied-point'")
+    with subtest(
+        "Whether mounting by a user is possible with the `user` option in fstab (#95444)"
+    ):
+        machine.succeed("mkdir -p /user-mount/source")
+        machine.succeed("touch /user-mount/source/file")
+        machine.succeed("chmod -R a+Xr /user-mount/source")
+        machine.succeed("mkdir /user-mount/point")
+        machine.succeed("chown alice:users /user-mount/point")
+        machine.succeed("su - alice -c 'mount /user-mount/point'")
+        machine.succeed("su - alice -c 'ls /user-mount/point/file'")
+    with subtest(
+        "Whether mounting by a user is denied without the `user` option in  fstab"
+    ):
+        machine.succeed("mkdir -p /user-mount/denied-source")
+        machine.succeed("touch /user-mount/denied-source/file")
+        machine.succeed("chmod -R a+Xr /user-mount/denied-source")
+        machine.succeed("mkdir /user-mount/denied-point")
+        machine.succeed("chown alice:users /user-mount/denied-point")
+        machine.fail("su - alice -c 'mount /user-mount/denied-point'")
 
-      with subtest("shell-vars"):
-          machine.succeed('[ -n "$NIX_PATH" ]')
+    with subtest("shell-vars"):
+        machine.succeed('[ -n "$NIX_PATH" ]')
 
-      with subtest("Test sysctl"):
-          machine.wait_for_unit("systemd-sysctl.service")
-          assert "1" == machine.succeed("sysctl -ne vm.swappiness").strip()
-          machine.execute("sysctl vm.swappiness=60")
-          assert "60" == machine.succeed("sysctl -ne vm.swappiness").strip()
+    with subtest("Test sysctl"):
+        machine.wait_for_unit("systemd-sysctl.service")
+        assert "1" == machine.succeed("sysctl -ne vm.swappiness").strip()
+        machine.execute("sysctl vm.swappiness=60")
+        assert "60" == machine.succeed("sysctl -ne vm.swappiness").strip()
 
-      with subtest("Test boot parameters"):
-          assert "vsyscall=emulate" in machine.succeed("cat /proc/cmdline")
-    '';
-  }
-)
+    with subtest("Test boot parameters"):
+        assert "vsyscall=emulate" in machine.succeed("cat /proc/cmdline")
+  '';
+}
diff --git a/nixos/tests/misskey.nix b/nixos/tests/misskey.nix
index 1a450c518aae..9afa7aa0cee4 100644
--- a/nixos/tests/misskey.nix
+++ b/nixos/tests/misskey.nix
@@ -1,29 +1,27 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  let
-    port = 61812;
-  in
-  {
-    name = "misskey";
+{ lib, ... }:
+let
+  port = 61812;
+in
+{
+  name = "misskey";
 
-    meta.maintainers = [ lib.maintainers.feathecutie ];
+  meta.maintainers = [ lib.maintainers.feathecutie ];
 
-    nodes.machine = {
-      services.misskey = {
-        enable = true;
-        settings = {
-          url = "http://misskey.local";
-          inherit port;
-        };
-        database.createLocally = true;
-        redis.createLocally = true;
+  nodes.machine = {
+    services.misskey = {
+      enable = true;
+      settings = {
+        url = "http://misskey.local";
+        inherit port;
       };
+      database.createLocally = true;
+      redis.createLocally = true;
     };
+  };
 
-    testScript = ''
-      machine.wait_for_unit("misskey.service")
-      machine.wait_for_open_port(${toString port})
-      machine.succeed("curl --fail http://localhost:${toString port}/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("misskey.service")
+    machine.wait_for_open_port(${toString port})
+    machine.succeed("curl --fail http://localhost:${toString port}/")
+  '';
+}
diff --git a/nixos/tests/mod_perl.nix b/nixos/tests/mod_perl.nix
index 677f2bcbc969..6bcca2b914f4 100644
--- a/nixos/tests/mod_perl.nix
+++ b/nixos/tests/mod_perl.nix
@@ -1,65 +1,63 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "mod_perl";
+{ pkgs, lib, ... }:
+{
+  name = "mod_perl";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ sgo ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ sgo ];
+  };
 
-    nodes.machine =
-      {
-        config,
-        lib,
-        pkgs,
-        ...
-      }:
-      {
-        services.httpd = {
-          enable = true;
-          adminAddr = "admin@localhost";
-          virtualHosts."modperl" =
-            let
-              inc = pkgs.writeTextDir "ModPerlTest.pm" ''
-                package ModPerlTest;
-                use strict;
-                use Apache2::RequestRec ();
-                use Apache2::RequestIO ();
-                use Apache2::Const -compile => qw(OK);
-                sub handler {
-                  my $r = shift;
-                  $r->content_type('text/plain');
-                  print "Hello mod_perl!\n";
-                  return Apache2::Const::OK;
-                }
-                1;
-              '';
-              startup = pkgs.writeScript "startup.pl" ''
-                use lib "${inc}",
-                  split ":","${with pkgs.perl.pkgs; makeFullPerlPath ([ mod_perl2 ])}";
-                1;
-              '';
-            in
-            {
+  nodes.machine =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      services.httpd = {
+        enable = true;
+        adminAddr = "admin@localhost";
+        virtualHosts."modperl" =
+          let
+            inc = pkgs.writeTextDir "ModPerlTest.pm" ''
+              package ModPerlTest;
+              use strict;
+              use Apache2::RequestRec ();
+              use Apache2::RequestIO ();
+              use Apache2::Const -compile => qw(OK);
+              sub handler {
+                my $r = shift;
+                $r->content_type('text/plain');
+                print "Hello mod_perl!\n";
+                return Apache2::Const::OK;
+              }
+              1;
+            '';
+            startup = pkgs.writeScript "startup.pl" ''
+              use lib "${inc}",
+                split ":","${with pkgs.perl.pkgs; makeFullPerlPath ([ mod_perl2 ])}";
+              1;
+            '';
+          in
+          {
+            extraConfig = ''
+              PerlRequire ${startup}
+            '';
+            locations."/modperl" = {
               extraConfig = ''
-                PerlRequire ${startup}
+                SetHandler perl-script
+                PerlResponseHandler ModPerlTest
               '';
-              locations."/modperl" = {
-                extraConfig = ''
-                  SetHandler perl-script
-                  PerlResponseHandler ModPerlTest
-                '';
-              };
             };
-          enablePerl = true;
-        };
+          };
+        enablePerl = true;
       };
-    testScript =
-      { ... }:
-      ''
-        machine.wait_for_unit("httpd.service")
-        response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/modperl")
-        assert "Hello mod_perl!" in response, "/modperl handler did not respond"
-      '';
-  }
-)
+    };
+  testScript =
+    { ... }:
+    ''
+      machine.wait_for_unit("httpd.service")
+      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/modperl")
+      assert "Hello mod_perl!" in response, "/modperl handler did not respond"
+    '';
+}
diff --git a/nixos/tests/molly-brown.nix b/nixos/tests/molly-brown.nix
index 72e42c4a5be8..56d969ae79bf 100644
--- a/nixos/tests/molly-brown.nix
+++ b/nixos/tests/molly-brown.nix
@@ -1,79 +1,77 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    testString = "NixOS Gemini test successful";
-  in
-  {
+let
+  testString = "NixOS Gemini test successful";
+in
+{
 
-    name = "molly-brown";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ehmry ];
-    };
+  name = "molly-brown";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ehmry ];
+  };
 
-    nodes = {
+  nodes = {
 
-      geminiServer =
-        { config, pkgs, ... }:
-        let
-          inherit (config.networking) hostName;
-          cfg = config.services.molly-brown;
-        in
-        {
+    geminiServer =
+      { config, pkgs, ... }:
+      let
+        inherit (config.networking) hostName;
+        cfg = config.services.molly-brown;
+      in
+      {
 
-          environment.systemPackages = [
-            (pkgs.writeScriptBin "test-gemini" ''
-              #!${pkgs.python3}/bin/python
+        environment.systemPackages = [
+          (pkgs.writeScriptBin "test-gemini" ''
+            #!${pkgs.python3}/bin/python
 
-              import socket
-              import ssl
-              import tempfile
-              import textwrap
-              import urllib.parse
+            import socket
+            import ssl
+            import tempfile
+            import textwrap
+            import urllib.parse
 
-              url = "gemini://geminiServer/init.gmi"
-              parsed_url = urllib.parse.urlparse(url)
+            url = "gemini://geminiServer/init.gmi"
+            parsed_url = urllib.parse.urlparse(url)
 
-              s = socket.create_connection((parsed_url.netloc, 1965))
-              context = ssl.SSLContext()
-              context.check_hostname = False
-              context.verify_mode = ssl.CERT_NONE
-              s = context.wrap_socket(s, server_hostname=parsed_url.netloc)
-              s.sendall((url + "\r\n").encode("UTF-8"))
-              fp = s.makefile("rb")
-              print(fp.readline().strip())
-              print(fp.readline().strip())
-              print(fp.readline().strip())
-            '')
-          ];
+            s = socket.create_connection((parsed_url.netloc, 1965))
+            context = ssl.SSLContext()
+            context.check_hostname = False
+            context.verify_mode = ssl.CERT_NONE
+            s = context.wrap_socket(s, server_hostname=parsed_url.netloc)
+            s.sendall((url + "\r\n").encode("UTF-8"))
+            fp = s.makefile("rb")
+            print(fp.readline().strip())
+            print(fp.readline().strip())
+            print(fp.readline().strip())
+          '')
+        ];
 
-          networking.firewall.allowedTCPPorts = [ cfg.settings.Port ];
+        networking.firewall.allowedTCPPorts = [ cfg.settings.Port ];
 
-          services.molly-brown = {
-            enable = true;
-            docBase = "/tmp/docs";
-            certPath = "/tmp/cert.pem";
-            keyPath = "/tmp/key.pem";
-          };
-
-          systemd.services.molly-brown.preStart = ''
-            ${pkgs.openssl}/bin/openssl genrsa -out "/tmp/key.pem"
-            ${pkgs.openssl}/bin/openssl req -new \
-              -subj "/CN=${config.networking.hostName}" \
-              -key "/tmp/key.pem" -out /tmp/request.pem
-            ${pkgs.openssl}/bin/openssl x509 -req -days 3650 \
-              -in /tmp/request.pem -signkey "/tmp/key.pem" -out "/tmp/cert.pem"
-
-            mkdir -p "${cfg.settings.DocBase}"
-            echo "${testString}" > "${cfg.settings.DocBase}/test.gmi"
-          '';
+        services.molly-brown = {
+          enable = true;
+          docBase = "/tmp/docs";
+          certPath = "/tmp/cert.pem";
+          keyPath = "/tmp/key.pem";
         };
-    };
-    testScript = ''
-      geminiServer.wait_for_unit("molly-brown")
-      geminiServer.wait_for_open_port(1965)
-      geminiServer.succeed("test-gemini")
-    '';
 
-  }
-)
+        systemd.services.molly-brown.preStart = ''
+          ${pkgs.openssl}/bin/openssl genrsa -out "/tmp/key.pem"
+          ${pkgs.openssl}/bin/openssl req -new \
+            -subj "/CN=${config.networking.hostName}" \
+            -key "/tmp/key.pem" -out /tmp/request.pem
+          ${pkgs.openssl}/bin/openssl x509 -req -days 3650 \
+            -in /tmp/request.pem -signkey "/tmp/key.pem" -out "/tmp/cert.pem"
+
+          mkdir -p "${cfg.settings.DocBase}"
+          echo "${testString}" > "${cfg.settings.DocBase}/test.gmi"
+        '';
+      };
+  };
+  testScript = ''
+    geminiServer.wait_for_unit("molly-brown")
+    geminiServer.wait_for_open_port(1965)
+    geminiServer.succeed("test-gemini")
+  '';
+
+}
diff --git a/nixos/tests/mollysocket.nix b/nixos/tests/mollysocket.nix
index ccfc20fdda6b..b4acbb1095cb 100644
--- a/nixos/tests/mollysocket.nix
+++ b/nixos/tests/mollysocket.nix
@@ -1,30 +1,28 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    port = 1234;
-  in
-  {
-    name = "mollysocket";
-    meta.maintainers = with lib.maintainers; [ dotlambda ];
+let
+  port = 1234;
+in
+{
+  name = "mollysocket";
+  meta.maintainers = with lib.maintainers; [ dotlambda ];
 
-    nodes.mollysocket =
-      { ... }:
-      {
-        services.mollysocket = {
-          enable = true;
-          settings = {
-            inherit port;
-          };
+  nodes.mollysocket =
+    { ... }:
+    {
+      services.mollysocket = {
+        enable = true;
+        settings = {
+          inherit port;
         };
       };
+    };
 
-    testScript = ''
-      mollysocket.wait_for_unit("mollysocket.service")
-      mollysocket.wait_for_open_port(${toString port})
+  testScript = ''
+    mollysocket.wait_for_unit("mollysocket.service")
+    mollysocket.wait_for_open_port(${toString port})
 
-      out = mollysocket.succeed("curl --fail http://127.0.0.1:${toString port}")
-      assert "Version ${pkgs.mollysocket.version}" in out
-    '';
-  }
-)
+    out = mollysocket.succeed("curl --fail http://127.0.0.1:${toString port}")
+    assert "Version ${pkgs.mollysocket.version}" in out
+  '';
+}
diff --git a/nixos/tests/monado.nix b/nixos/tests/monado.nix
index 9b7e636d1f66..609b0fa647e5 100644
--- a/nixos/tests/monado.nix
+++ b/nixos/tests/monado.nix
@@ -1,51 +1,49 @@
-import ./make-test-python.nix (
-  { ... }:
-  {
-    name = "monado";
+{ ... }:
+{
+  name = "monado";
 
-    nodes.machine =
-      { pkgs, ... }:
+  nodes.machine =
+    { pkgs, ... }:
 
-      {
-        hardware.graphics.enable = true;
-        users.users.alice = {
-          isNormalUser = true;
-          uid = 1000;
-        };
-
-        services.monado = {
-          enable = true;
-          defaultRuntime = true;
-
-          forceDefaultRuntime = true;
-        };
-        # Stop Monado from probing for any hardware
-        systemd.user.services.monado.environment.SIMULATED_ENABLE = "1";
-
-        environment.systemPackages = with pkgs; [ openxr-loader ];
+    {
+      hardware.graphics.enable = true;
+      users.users.alice = {
+        isNormalUser = true;
+        uid = 1000;
       };
 
-    testScript =
-      { nodes, ... }:
-      let
-        userId = toString nodes.machine.users.users.alice.uid;
-        runtimePath = "/run/user/${userId}";
-      in
-      ''
-        # for defaultRuntime
-        machine.succeed("stat /etc/xdg/openxr/1/active_runtime.json")
+      services.monado = {
+        enable = true;
+        defaultRuntime = true;
 
-        machine.succeed("loginctl enable-linger alice")
-        machine.wait_for_unit("user@${userId}.service")
+        forceDefaultRuntime = true;
+      };
+      # Stop Monado from probing for any hardware
+      systemd.user.services.monado.environment.SIMULATED_ENABLE = "1";
 
-        machine.wait_for_unit("monado.socket", "alice")
-        machine.systemctl("start monado.service", "alice")
-        machine.wait_for_unit("monado.service", "alice")
+      environment.systemPackages = with pkgs; [ openxr-loader ];
+    };
 
-        # for forceDefaultRuntime
-        machine.succeed("stat /home/alice/.config/openxr/1/active_runtime.json")
+  testScript =
+    { nodes, ... }:
+    let
+      userId = toString nodes.machine.users.users.alice.uid;
+      runtimePath = "/run/user/${userId}";
+    in
+    ''
+      # for defaultRuntime
+      machine.succeed("stat /etc/xdg/openxr/1/active_runtime.json")
 
-        machine.succeed("su -- alice -c env XDG_RUNTIME_DIR=${runtimePath} openxr_runtime_list")
-      '';
-  }
-)
+      machine.succeed("loginctl enable-linger alice")
+      machine.wait_for_unit("user@${userId}.service")
+
+      machine.wait_for_unit("monado.socket", "alice")
+      machine.systemctl("start monado.service", "alice")
+      machine.wait_for_unit("monado.service", "alice")
+
+      # for forceDefaultRuntime
+      machine.succeed("stat /home/alice/.config/openxr/1/active_runtime.json")
+
+      machine.succeed("su -- alice -c env XDG_RUNTIME_DIR=${runtimePath} openxr_runtime_list")
+    '';
+}
diff --git a/nixos/tests/monetdb.nix b/nixos/tests/monetdb.nix
index 53c732338554..0ea2d2843635 100644
--- a/nixos/tests/monetdb.nix
+++ b/nixos/tests/monetdb.nix
@@ -1,81 +1,79 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    creds = pkgs.writeText ".monetdb" ''
-      user=monetdb
-      password=monetdb
-    '';
-    createUser = pkgs.writeText "createUser.sql" ''
-      CREATE USER "voc" WITH PASSWORD 'voc' NAME 'VOC Explorer' SCHEMA "sys";
-      CREATE SCHEMA "voc" AUTHORIZATION "voc";
-      ALTER USER "voc" SET SCHEMA "voc";
-    '';
-    credsVoc = pkgs.writeText ".monetdb" ''
-      user=voc
-      password=voc
-    '';
-    transaction = pkgs.writeText "transaction" ''
-      START TRANSACTION;
-      CREATE TABLE test (id int, data varchar(30));
-      ROLLBACK;
-    '';
-    vocData = pkgs.fetchzip {
-      url = "https://dev.monetdb.org/Assets/VOC/voc_dump.zip";
-      hash = "sha256-sQ5acTsSAiXQfOgt2PhN7X7Z9TZGZtLrPPxgQT2pCGQ=";
-    };
-    onboardPeople = pkgs.writeText "onboardPeople" ''
-      CREATE VIEW onboard_people AS
-      SELECT * FROM (
-      SELECT 'craftsmen' AS type, craftsmen.* FROM craftsmen
-      UNION ALL
-      SELECT 'impotenten' AS type, impotenten.* FROM impotenten
-      UNION ALL
-      SELECT 'passengers' AS type, passengers.* FROM passengers
-      UNION ALL
-      SELECT 'seafarers' AS type, seafarers.* FROM seafarers
-      UNION ALL
-      SELECT 'soldiers' AS type, soldiers.* FROM soldiers
-      UNION ALL
-      SELECT 'total' AS type, total.* FROM total
-      ) AS onboard_people_table;
-      SELECT type, COUNT(*) AS total
-      FROM onboard_people GROUP BY type ORDER BY type;
-    '';
-    onboardExpected = pkgs.lib.strings.replaceStrings [ "\n" ] [ "\\n" ] ''
-      +------------+-------+
-      | type       | total |
-      +============+=======+
-      | craftsmen  |  2349 |
-      | impotenten |   938 |
-      | passengers |  2813 |
-      | seafarers  |  4468 |
-      | soldiers   |  4177 |
-      | total      |  2467 |
-      +------------+-------+
-    '';
-  in
-  {
-    name = "monetdb";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ StillerHarpo ];
-    };
-    nodes.machine.services.monetdb.enable = true;
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("monetdb")
-      machine.succeed("monetdbd create mydbfarm")
-      machine.succeed("monetdbd start mydbfarm")
-      machine.succeed("monetdb create voc")
-      machine.succeed("monetdb release voc")
-      machine.succeed("cp ${creds} ./.monetdb")
-      assert "hello world" in machine.succeed("mclient -d voc -s \"SELECT 'hello world'\"")
-      machine.succeed("mclient -d voc ${createUser}")
-      machine.succeed("cp ${credsVoc} ./.monetdb")
-      machine.succeed("mclient -d voc ${transaction}")
-      machine.succeed("mclient -d voc ${vocData}/voc_dump.sql")
-      assert "8131" in machine.succeed("mclient -d voc -s \"SELECT count(*) FROM voyages\"")
-      assert "${onboardExpected}" in machine.succeed("mclient -d voc ${onboardPeople}")
+{ pkgs, ... }:
+let
+  creds = pkgs.writeText ".monetdb" ''
+    user=monetdb
+    password=monetdb
+  '';
+  createUser = pkgs.writeText "createUser.sql" ''
+    CREATE USER "voc" WITH PASSWORD 'voc' NAME 'VOC Explorer' SCHEMA "sys";
+    CREATE SCHEMA "voc" AUTHORIZATION "voc";
+    ALTER USER "voc" SET SCHEMA "voc";
+  '';
+  credsVoc = pkgs.writeText ".monetdb" ''
+    user=voc
+    password=voc
+  '';
+  transaction = pkgs.writeText "transaction" ''
+    START TRANSACTION;
+    CREATE TABLE test (id int, data varchar(30));
+    ROLLBACK;
+  '';
+  vocData = pkgs.fetchzip {
+    url = "https://dev.monetdb.org/Assets/VOC/voc_dump.zip";
+    hash = "sha256-sQ5acTsSAiXQfOgt2PhN7X7Z9TZGZtLrPPxgQT2pCGQ=";
+  };
+  onboardPeople = pkgs.writeText "onboardPeople" ''
+    CREATE VIEW onboard_people AS
+    SELECT * FROM (
+    SELECT 'craftsmen' AS type, craftsmen.* FROM craftsmen
+    UNION ALL
+    SELECT 'impotenten' AS type, impotenten.* FROM impotenten
+    UNION ALL
+    SELECT 'passengers' AS type, passengers.* FROM passengers
+    UNION ALL
+    SELECT 'seafarers' AS type, seafarers.* FROM seafarers
+    UNION ALL
+    SELECT 'soldiers' AS type, soldiers.* FROM soldiers
+    UNION ALL
+    SELECT 'total' AS type, total.* FROM total
+    ) AS onboard_people_table;
+    SELECT type, COUNT(*) AS total
+    FROM onboard_people GROUP BY type ORDER BY type;
+  '';
+  onboardExpected = pkgs.lib.strings.replaceStrings [ "\n" ] [ "\\n" ] ''
+    +------------+-------+
+    | type       | total |
+    +============+=======+
+    | craftsmen  |  2349 |
+    | impotenten |   938 |
+    | passengers |  2813 |
+    | seafarers  |  4468 |
+    | soldiers   |  4177 |
+    | total      |  2467 |
+    +------------+-------+
+  '';
+in
+{
+  name = "monetdb";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ StillerHarpo ];
+  };
+  nodes.machine.services.monetdb.enable = true;
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("monetdb")
+    machine.succeed("monetdbd create mydbfarm")
+    machine.succeed("monetdbd start mydbfarm")
+    machine.succeed("monetdb create voc")
+    machine.succeed("monetdb release voc")
+    machine.succeed("cp ${creds} ./.monetdb")
+    assert "hello world" in machine.succeed("mclient -d voc -s \"SELECT 'hello world'\"")
+    machine.succeed("mclient -d voc ${createUser}")
+    machine.succeed("cp ${credsVoc} ./.monetdb")
+    machine.succeed("mclient -d voc ${transaction}")
+    machine.succeed("mclient -d voc ${vocData}/voc_dump.sql")
+    assert "8131" in machine.succeed("mclient -d voc -s \"SELECT count(*) FROM voyages\"")
+    assert "${onboardExpected}" in machine.succeed("mclient -d voc ${onboardPeople}")
 
-    '';
-  }
-)
+  '';
+}
diff --git a/nixos/tests/moonraker.nix b/nixos/tests/moonraker.nix
index 7eb43b68d1ee..fdefb64c852b 100644
--- a/nixos/tests/moonraker.nix
+++ b/nixos/tests/moonraker.nix
@@ -1,53 +1,51 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "moonraker";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ zhaofengli ];
-    };
+{ pkgs, ... }:
+{
+  name = "moonraker";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ zhaofengli ];
+  };
 
-    nodes = {
-      printer =
-        { config, pkgs, ... }:
-        {
-          security.polkit.enable = true;
+  nodes = {
+    printer =
+      { config, pkgs, ... }:
+      {
+        security.polkit.enable = true;
 
-          services.moonraker = {
-            enable = true;
-            allowSystemControl = true;
+        services.moonraker = {
+          enable = true;
+          allowSystemControl = true;
 
-            settings = {
-              authorization = {
-                trusted_clients = [
-                  "127.0.0.0/8"
-                  "::1/128"
-                ];
-              };
+          settings = {
+            authorization = {
+              trusted_clients = [
+                "127.0.0.0/8"
+                "::1/128"
+              ];
             };
           };
-
-          services.klipper = {
-            enable = true;
-
-            user = "moonraker";
-            group = "moonraker";
-
-            # No mcu configured so won't even enter `ready` state
-            settings = { };
-          };
         };
-    };
 
-    testScript = ''
-      printer.start()
+        services.klipper = {
+          enable = true;
 
-      printer.wait_for_unit("klipper.service")
-      printer.wait_for_unit("moonraker.service")
-      printer.wait_until_succeeds("curl http://localhost:7125/printer/info | grep -v 'Not Found' >&2", timeout=30)
+          user = "moonraker";
+          group = "moonraker";
 
-      with subtest("Check that we can perform system-level operations"):
-          printer.succeed("curl -X POST http://localhost:7125/machine/services/stop?service=klipper | grep ok >&2")
-          printer.wait_until_succeeds("systemctl --no-pager show klipper.service | grep ActiveState=inactive", timeout=10)
-    '';
-  }
-)
+          # No mcu configured so won't even enter `ready` state
+          settings = { };
+        };
+      };
+  };
+
+  testScript = ''
+    printer.start()
+
+    printer.wait_for_unit("klipper.service")
+    printer.wait_for_unit("moonraker.service")
+    printer.wait_until_succeeds("curl http://localhost:7125/printer/info | grep -v 'Not Found' >&2", timeout=30)
+
+    with subtest("Check that we can perform system-level operations"):
+        printer.succeed("curl -X POST http://localhost:7125/machine/services/stop?service=klipper | grep ok >&2")
+        printer.wait_until_succeeds("systemctl --no-pager show klipper.service | grep ActiveState=inactive", timeout=10)
+  '';
+}
diff --git a/nixos/tests/moosefs.nix b/nixos/tests/moosefs.nix
index 633e872f0d30..3166d34bf14a 100644
--- a/nixos/tests/moosefs.nix
+++ b/nixos/tests/moosefs.nix
@@ -1,99 +1,97 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    master =
-      { pkgs, ... }:
-      {
-        # data base is stored in memory
-        # server crashes with default memory size
-        virtualisation.memorySize = 1024;
+let
+  master =
+    { pkgs, ... }:
+    {
+      # data base is stored in memory
+      # server crashes with default memory size
+      virtualisation.memorySize = 1024;
 
-        services.moosefs.master = {
-          enable = true;
-          openFirewall = true;
-          autoInit = true;
-          exports = [
-            "* / rw,alldirs,admin,maproot=0:0"
-            "* . rw"
-          ];
-        };
+      services.moosefs.master = {
+        enable = true;
+        openFirewall = true;
+        autoInit = true;
+        exports = [
+          "* / rw,alldirs,admin,maproot=0:0"
+          "* . rw"
+        ];
       };
-
-    chunkserver =
-      { pkgs, ... }:
-      {
-        virtualisation.emptyDiskImages = [ 4096 ];
-        boot.initrd.postDeviceCommands = ''
-          ${pkgs.e2fsprogs}/bin/mkfs.ext4 -L data /dev/vdb
-        '';
-
-        fileSystems = pkgs.lib.mkVMOverride {
-          "/data" = {
-            device = "/dev/disk/by-label/data";
-            fsType = "ext4";
-          };
-        };
-
-        services.moosefs = {
-          masterHost = "master";
-          chunkserver = {
-            openFirewall = true;
-            enable = true;
-            hdds = [ "~/data" ];
-          };
-        };
-      };
-
-    metalogger =
-      { pkgs, ... }:
-      {
-        services.moosefs = {
-          masterHost = "master";
-          metalogger.enable = true;
-        };
-      };
-
-    client =
-      { pkgs, ... }:
-      {
-        services.moosefs.client.enable = true;
-      };
-
-  in
-  {
-    name = "moosefs";
-
-    nodes = {
-      inherit master;
-      inherit metalogger;
-      chunkserver1 = chunkserver;
-      chunkserver2 = chunkserver;
-      client1 = client;
-      client2 = client;
     };
 
-    testScript = ''
-      # prepare master server
-      master.start()
-      master.wait_for_unit("multi-user.target")
-      master.wait_for_unit("mfs-master.service")
+  chunkserver =
+    { pkgs, ... }:
+    {
+      virtualisation.emptyDiskImages = [ 4096 ];
+      boot.initrd.postDeviceCommands = ''
+        ${pkgs.e2fsprogs}/bin/mkfs.ext4 -L data /dev/vdb
+      '';
 
-      metalogger.wait_for_unit("mfs-metalogger.service")
+      fileSystems = pkgs.lib.mkVMOverride {
+        "/data" = {
+          device = "/dev/disk/by-label/data";
+          fsType = "ext4";
+        };
+      };
 
-      for chunkserver in [chunkserver1, chunkserver2]:
-          chunkserver.wait_for_unit("multi-user.target")
-          chunkserver.succeed("chown moosefs:moosefs /data")
-          chunkserver.succeed("systemctl restart mfs-chunkserver")
-          chunkserver.wait_for_unit("mfs-chunkserver.service")
+      services.moosefs = {
+        masterHost = "master";
+        chunkserver = {
+          openFirewall = true;
+          enable = true;
+          hdds = [ "~/data" ];
+        };
+      };
+    };
 
-      for client in [client1, client2]:
-          client.wait_for_unit("multi-user.target")
-          client.succeed("mkdir /moosefs")
-          client.succeed("mount -t moosefs master:/ /moosefs")
+  metalogger =
+    { pkgs, ... }:
+    {
+      services.moosefs = {
+        masterHost = "master";
+        metalogger.enable = true;
+      };
+    };
 
-      client1.succeed("echo test > /moosefs/file")
-      client2.succeed("grep test /moosefs/file")
-    '';
-  }
-)
+  client =
+    { pkgs, ... }:
+    {
+      services.moosefs.client.enable = true;
+    };
+
+in
+{
+  name = "moosefs";
+
+  nodes = {
+    inherit master;
+    inherit metalogger;
+    chunkserver1 = chunkserver;
+    chunkserver2 = chunkserver;
+    client1 = client;
+    client2 = client;
+  };
+
+  testScript = ''
+    # prepare master server
+    master.start()
+    master.wait_for_unit("multi-user.target")
+    master.wait_for_unit("mfs-master.service")
+
+    metalogger.wait_for_unit("mfs-metalogger.service")
+
+    for chunkserver in [chunkserver1, chunkserver2]:
+        chunkserver.wait_for_unit("multi-user.target")
+        chunkserver.succeed("chown moosefs:moosefs /data")
+        chunkserver.succeed("systemctl restart mfs-chunkserver")
+        chunkserver.wait_for_unit("mfs-chunkserver.service")
+
+    for client in [client1, client2]:
+        client.wait_for_unit("multi-user.target")
+        client.succeed("mkdir /moosefs")
+        client.succeed("mount -t moosefs master:/ /moosefs")
+
+    client1.succeed("echo test > /moosefs/file")
+    client2.succeed("grep test /moosefs/file")
+  '';
+}
diff --git a/nixos/tests/mopidy.nix b/nixos/tests/mopidy.nix
index e8447af8c75a..305a12f5aa2e 100644
--- a/nixos/tests/mopidy.nix
+++ b/nixos/tests/mopidy.nix
@@ -1,17 +1,15 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "mopidy";
+{ pkgs, ... }:
+{
+  name = "mopidy";
 
-    nodes.machine =
-      { ... }:
-      {
-        services.mopidy.enable = true;
-      };
+  nodes.machine =
+    { ... }:
+    {
+      services.mopidy.enable = true;
+    };
 
-    testScript = ''
-      machine.wait_for_unit("mopidy")
-      machine.wait_for_open_port(6680)
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("mopidy")
+    machine.wait_for_open_port(6680)
+  '';
+}
diff --git a/nixos/tests/morty.nix b/nixos/tests/morty.nix
index 4ec44e31d487..b8e490fbbcb5 100644
--- a/nixos/tests/morty.nix
+++ b/nixos/tests/morty.nix
@@ -1,33 +1,31 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "morty";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ leenaars ];
-    };
+{
+  name = "morty";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ leenaars ];
+  };
 
-    nodes = {
-      mortyProxyWithKey =
+  nodes = {
+    mortyProxyWithKey =
 
-        { ... }:
-        {
-          services.morty = {
-            enable = true;
-            key = "78a9cd0cfee20c672f78427efb2a2a96036027f0";
-            port = 3001;
-          };
-        };
-
-    };
-
-    testScript =
       { ... }:
-      ''
-        mortyProxyWithKey.wait_for_unit("default.target")
-        mortyProxyWithKey.wait_for_open_port(3001)
-        mortyProxyWithKey.succeed("curl -fL 127.0.0.1:3001 | grep MortyProxy")
-      '';
+      {
+        services.morty = {
+          enable = true;
+          key = "78a9cd0cfee20c672f78427efb2a2a96036027f0";
+          port = 3001;
+        };
+      };
 
-  }
-)
+  };
+
+  testScript =
+    { ... }:
+    ''
+      mortyProxyWithKey.wait_for_unit("default.target")
+      mortyProxyWithKey.wait_for_open_port(3001)
+      mortyProxyWithKey.succeed("curl -fL 127.0.0.1:3001 | grep MortyProxy")
+    '';
+
+}
diff --git a/nixos/tests/mtp.nix b/nixos/tests/mtp.nix
index b4efef0318aa..6eab7ad995a6 100644
--- a/nixos/tests/mtp.nix
+++ b/nixos/tests/mtp.nix
@@ -1,121 +1,119 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "mtp";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        matthewcroughan
-        nixinator
-      ];
-    };
+{ pkgs, ... }:
+{
+  name = "mtp";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      matthewcroughan
+      nixinator
+    ];
+  };
 
-    nodes = {
-      client =
-        { config, pkgs, ... }:
-        {
-          # DBUS runs only once a user session is created, which means a user has to
-          # login. Here, we log in as root. Once logged in, the gvfs-daemon service runs
-          # as UID 0 in User-0.service
-          services.getty.autologinUser = "root";
+  nodes = {
+    client =
+      { config, pkgs, ... }:
+      {
+        # DBUS runs only once a user session is created, which means a user has to
+        # login. Here, we log in as root. Once logged in, the gvfs-daemon service runs
+        # as UID 0 in User-0.service
+        services.getty.autologinUser = "root";
 
-          # XDG_RUNTIME_DIR is needed for running systemd-user services such as
-          # gvfs-daemon as root.
-          environment.variables.XDG_RUNTIME_DIR = "/run/user/0";
+        # XDG_RUNTIME_DIR is needed for running systemd-user services such as
+        # gvfs-daemon as root.
+        environment.variables.XDG_RUNTIME_DIR = "/run/user/0";
 
-          environment.systemPackages = with pkgs; [
-            usbutils
-            glib
-            jmtpfs
-            tree
-          ];
-          services.gvfs.enable = true;
+        environment.systemPackages = with pkgs; [
+          usbutils
+          glib
+          jmtpfs
+          tree
+        ];
+        services.gvfs.enable = true;
 
-          # Creates a usb-mtp device inside the VM, which is mapped to the host's
-          # /tmp folder, it is able to write files to this location, but only has
-          # permissions to read its own creations.
-          virtualisation.qemu.options = [
-            "-usb"
-            "-device usb-mtp,rootdir=/tmp,readonly=false"
-          ];
-        };
-    };
+        # Creates a usb-mtp device inside the VM, which is mapped to the host's
+        # /tmp folder, it is able to write files to this location, but only has
+        # permissions to read its own creations.
+        virtualisation.qemu.options = [
+          "-usb"
+          "-device usb-mtp,rootdir=/tmp,readonly=false"
+        ];
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      let
-        # Creates a list of QEMU MTP devices matching USB ID (46f4:0004). This
-        # value can be sourced in a shell script. This is so we can loop over the
-        # devices we find, as this test may want to use more than one MTP device
-        # in future.
-        mtpDevices = pkgs.writeScript "mtpDevices.sh" ''
-          export mtpDevices=$(lsusb -d 46f4:0004 | awk {'print $2","$4'} | sed 's/[:-]/ /g')
-        '';
-        # Qemu is only capable of creating an MTP device with Picture Transfer
-        # Protocol. This means that gvfs must use gphoto2:// rather than mtp://
-        # when mounting.
-        # https://github.com/qemu/qemu/blob/970bc16f60937bcfd334f14c614bd4407c247961/hw/usb/dev-mtp.c#L278
-        gvfs = rec {
-          mountAllMtpDevices = pkgs.writeScript "mountAllMtpDevices.sh" ''
-            set -e
-            source ${mtpDevices}
-            for i in $mtpDevices
-            do
-              gio mount "gphoto2://[usb:$i]/"
-            done
-          '';
-          unmountAllMtpDevices = pkgs.writeScript "unmountAllMtpDevices.sh" ''
-            set -e
-            source ${mtpDevices}
-            for i in $mtpDevices
-            do
-              gio mount -u "gphoto2://[usb:$i]/"
-            done
-          '';
-          # gvfsTest:
-          # 1. Creates a 10M test file
-          # 2. Copies it to the device using GIO tools
-          # 3. Checks for corruption with `diff`
-          # 4. Removes the file, then unmounts the disks.
-          gvfsTest = pkgs.writeScript "gvfsTest.sh" ''
-            set -e
-            source ${mtpDevices}
-            ${mountAllMtpDevices}
-            dd if=/dev/urandom of=testFile10M bs=1M count=10
-            for i in $mtpDevices
-            do
-              gio copy ./testFile10M gphoto2://[usb:$i]/
-              ls -lah /run/user/0/gvfs/*/testFile10M
-              gio remove gphoto2://[usb:$i]/testFile10M
-            done
-            ${unmountAllMtpDevices}
-          '';
-        };
-        jmtpfs = {
-          # jmtpfsTest:
-          # 1. Mounts the device on a dir named `phone` using jmtpfs
-          # 2. Puts the current Nixpkgs libmtp version into a file
-          # 3. Checks for corruption with `diff`
-          # 4. Prints the directory tree
-          jmtpfsTest = pkgs.writeScript "jmtpfsTest.sh" ''
-            set -e
-            mkdir phone
-            jmtpfs phone
-            echo "${pkgs.libmtp.version}" > phone/tmp/testFile
-            echo "${pkgs.libmtp.version}" > testFile
-            diff phone/tmp/testFile testFile
-            tree phone
-          '';
-        };
-      in
-      # Using >&2 allows the results of the scripts to be printed to the terminal
-      # when building this test with Nix. Scripts would otherwise complete
-      # silently.
-      ''
-        start_all()
-        client.wait_for_unit("multi-user.target")
-        client.wait_for_unit("dbus.service")
-        client.succeed("${gvfs.gvfsTest} >&2")
-        client.succeed("${jmtpfs.jmtpfsTest} >&2")
+  testScript =
+    { nodes, ... }:
+    let
+      # Creates a list of QEMU MTP devices matching USB ID (46f4:0004). This
+      # value can be sourced in a shell script. This is so we can loop over the
+      # devices we find, as this test may want to use more than one MTP device
+      # in future.
+      mtpDevices = pkgs.writeScript "mtpDevices.sh" ''
+        export mtpDevices=$(lsusb -d 46f4:0004 | awk {'print $2","$4'} | sed 's/[:-]/ /g')
       '';
-  }
-)
+      # Qemu is only capable of creating an MTP device with Picture Transfer
+      # Protocol. This means that gvfs must use gphoto2:// rather than mtp://
+      # when mounting.
+      # https://github.com/qemu/qemu/blob/970bc16f60937bcfd334f14c614bd4407c247961/hw/usb/dev-mtp.c#L278
+      gvfs = rec {
+        mountAllMtpDevices = pkgs.writeScript "mountAllMtpDevices.sh" ''
+          set -e
+          source ${mtpDevices}
+          for i in $mtpDevices
+          do
+            gio mount "gphoto2://[usb:$i]/"
+          done
+        '';
+        unmountAllMtpDevices = pkgs.writeScript "unmountAllMtpDevices.sh" ''
+          set -e
+          source ${mtpDevices}
+          for i in $mtpDevices
+          do
+            gio mount -u "gphoto2://[usb:$i]/"
+          done
+        '';
+        # gvfsTest:
+        # 1. Creates a 10M test file
+        # 2. Copies it to the device using GIO tools
+        # 3. Checks for corruption with `diff`
+        # 4. Removes the file, then unmounts the disks.
+        gvfsTest = pkgs.writeScript "gvfsTest.sh" ''
+          set -e
+          source ${mtpDevices}
+          ${mountAllMtpDevices}
+          dd if=/dev/urandom of=testFile10M bs=1M count=10
+          for i in $mtpDevices
+          do
+            gio copy ./testFile10M gphoto2://[usb:$i]/
+            ls -lah /run/user/0/gvfs/*/testFile10M
+            gio remove gphoto2://[usb:$i]/testFile10M
+          done
+          ${unmountAllMtpDevices}
+        '';
+      };
+      jmtpfs = {
+        # jmtpfsTest:
+        # 1. Mounts the device on a dir named `phone` using jmtpfs
+        # 2. Puts the current Nixpkgs libmtp version into a file
+        # 3. Checks for corruption with `diff`
+        # 4. Prints the directory tree
+        jmtpfsTest = pkgs.writeScript "jmtpfsTest.sh" ''
+          set -e
+          mkdir phone
+          jmtpfs phone
+          echo "${pkgs.libmtp.version}" > phone/tmp/testFile
+          echo "${pkgs.libmtp.version}" > testFile
+          diff phone/tmp/testFile testFile
+          tree phone
+        '';
+      };
+    in
+    # Using >&2 allows the results of the scripts to be printed to the terminal
+    # when building this test with Nix. Scripts would otherwise complete
+    # silently.
+    ''
+      start_all()
+      client.wait_for_unit("multi-user.target")
+      client.wait_for_unit("dbus.service")
+      client.succeed("${gvfs.gvfsTest} >&2")
+      client.succeed("${jmtpfs.jmtpfsTest} >&2")
+    '';
+}
diff --git a/nixos/tests/multipass.nix b/nixos/tests/multipass.nix
index da63a7a41fbb..33919cde81ed 100644
--- a/nixos/tests/multipass.nix
+++ b/nixos/tests/multipass.nix
@@ -1,41 +1,39 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    multipass-image = import ../release.nix {
-      configuration = {
-        # Building documentation makes the test unnecessarily take a longer time:
-        documentation.enable = lib.mkForce false;
+let
+  multipass-image = import ../release.nix {
+    configuration = {
+      # Building documentation makes the test unnecessarily take a longer time:
+      documentation.enable = lib.mkForce false;
+    };
+  };
+
+in
+{
+  name = "multipass";
+
+  meta.maintainers = [ lib.maintainers.jnsgruk ];
+
+  nodes.machine =
+    { lib, ... }:
+    {
+      virtualisation = {
+        cores = 1;
+        memorySize = 1024;
+        diskSize = 4096;
+
+        multipass.enable = true;
       };
     };
 
-  in
-  {
-    name = "multipass";
+  testScript = ''
+    machine.wait_for_unit("sockets.target")
+    machine.wait_for_unit("multipass.service")
+    machine.wait_for_file("/var/lib/multipass/data/multipassd/network/multipass_subnet")
 
-    meta.maintainers = [ lib.maintainers.jnsgruk ];
+    # Wait for Multipass to settle
+    machine.sleep(1)
 
-    nodes.machine =
-      { lib, ... }:
-      {
-        virtualisation = {
-          cores = 1;
-          memorySize = 1024;
-          diskSize = 4096;
-
-          multipass.enable = true;
-        };
-      };
-
-    testScript = ''
-      machine.wait_for_unit("sockets.target")
-      machine.wait_for_unit("multipass.service")
-      machine.wait_for_file("/var/lib/multipass/data/multipassd/network/multipass_subnet")
-
-      # Wait for Multipass to settle
-      machine.sleep(1)
-
-      machine.succeed("multipass list")
-    '';
-  }
-)
+    machine.succeed("multipass list")
+  '';
+}
diff --git a/nixos/tests/munin.nix b/nixos/tests/munin.nix
index b28562bbaa2e..fad3f2b52fae 100644
--- a/nixos/tests/munin.nix
+++ b/nixos/tests/munin.nix
@@ -1,49 +1,47 @@
 # This test runs basic munin setup with node and cron job running on the same
 # machine.
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "munin";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ domenkozar ];
-    };
+{ pkgs, ... }:
+{
+  name = "munin";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ domenkozar ];
+  };
 
-    nodes = {
-      one =
-        { config, ... }:
-        {
-          services = {
-            munin-node = {
-              enable = true;
-              # disable a failing plugin to prevent irrelevant error message, see #23049
-              disabledPlugins = [ "apc_nis" ];
-            };
-            munin-cron = {
-              enable = true;
-              hosts = ''
-                [${config.networking.hostName}]
-                address localhost
-              '';
-            };
+  nodes = {
+    one =
+      { config, ... }:
+      {
+        services = {
+          munin-node = {
+            enable = true;
+            # disable a failing plugin to prevent irrelevant error message, see #23049
+            disabledPlugins = [ "apc_nis" ];
+          };
+          munin-cron = {
+            enable = true;
+            hosts = ''
+              [${config.networking.hostName}]
+              address localhost
+            '';
           };
-
-          # increase the systemd timer interval so it fires more often
-          systemd.timers.munin-cron.timerConfig.OnCalendar = pkgs.lib.mkForce "*:*:0/10";
         };
-    };
 
-    testScript = ''
-      start_all()
+        # increase the systemd timer interval so it fires more often
+        systemd.timers.munin-cron.timerConfig.OnCalendar = pkgs.lib.mkForce "*:*:0/10";
+      };
+  };
 
-      with subtest("ensure munin-node starts and listens on 4949"):
-          one.wait_for_unit("munin-node.service")
-          one.wait_for_open_port(4949)
+  testScript = ''
+    start_all()
 
-      with subtest("ensure munin-cron output is correct"):
-          one.wait_for_file("/var/lib/munin/one/one-uptime-uptime-g.rrd")
-          one.wait_for_file("/var/www/munin/one/index.html")
-          one.wait_for_file("/var/www/munin/one/one/diskstat_iops_vda-day.png", timeout=60)
-    '';
-  }
-)
+    with subtest("ensure munin-node starts and listens on 4949"):
+        one.wait_for_unit("munin-node.service")
+        one.wait_for_open_port(4949)
+
+    with subtest("ensure munin-cron output is correct"):
+        one.wait_for_file("/var/lib/munin/one/one-uptime-uptime-g.rrd")
+        one.wait_for_file("/var/www/munin/one/index.html")
+        one.wait_for_file("/var/www/munin/one/one/diskstat_iops_vda-day.png", timeout=60)
+  '';
+}
diff --git a/nixos/tests/mutable-users.nix b/nixos/tests/mutable-users.nix
index e4e35f2d7220..3b262ff0821f 100644
--- a/nixos/tests/mutable-users.nix
+++ b/nixos/tests/mutable-users.nix
@@ -1,76 +1,74 @@
 # Mutable users tests.
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "mutable-users";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ gleber ];
-    };
+{ pkgs, ... }:
+{
+  name = "mutable-users";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ gleber ];
+  };
 
-    nodes = {
-      machine = {
-        specialisation.immutable.configuration = {
-          users.mutableUsers = false;
-        };
+  nodes = {
+    machine = {
+      specialisation.immutable.configuration = {
+        users.mutableUsers = false;
+      };
 
-        specialisation.mutable.configuration = {
-          users.mutableUsers = true;
-          users.users.dry-test.isNormalUser = true;
-        };
+      specialisation.mutable.configuration = {
+        users.mutableUsers = true;
+        users.users.dry-test.isNormalUser = true;
       };
     };
+  };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("default.target")
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("default.target")
 
-      # Machine starts in immutable mode. Add a user and test if reactivating
-      # configuration removes the user.
-      with subtest("Machine in immutable mode"):
-          assert "foobar" not in machine.succeed("cat /etc/passwd")
-          machine.succeed("sudo useradd foobar")
-          assert "foobar" in machine.succeed("cat /etc/passwd")
-          machine.succeed(
-              "/run/booted-system/specialisation/immutable/bin/switch-to-configuration test"
-          )
-          assert "foobar" not in machine.succeed("cat /etc/passwd")
+    # Machine starts in immutable mode. Add a user and test if reactivating
+    # configuration removes the user.
+    with subtest("Machine in immutable mode"):
+        assert "foobar" not in machine.succeed("cat /etc/passwd")
+        machine.succeed("sudo useradd foobar")
+        assert "foobar" in machine.succeed("cat /etc/passwd")
+        machine.succeed(
+            "/run/booted-system/specialisation/immutable/bin/switch-to-configuration test"
+        )
+        assert "foobar" not in machine.succeed("cat /etc/passwd")
 
-      # In immutable mode passwd is not wrapped, while in mutable mode it is
-      # wrapped.
-      with subtest("Password is wrapped in mutable mode"):
-          assert "/run/current-system/" in machine.succeed("which passwd")
-          machine.succeed(
-              "/run/booted-system/specialisation/mutable/bin/switch-to-configuration test"
-          )
-          assert "/run/wrappers/" in machine.succeed("which passwd")
+    # In immutable mode passwd is not wrapped, while in mutable mode it is
+    # wrapped.
+    with subtest("Password is wrapped in mutable mode"):
+        assert "/run/current-system/" in machine.succeed("which passwd")
+        machine.succeed(
+            "/run/booted-system/specialisation/mutable/bin/switch-to-configuration test"
+        )
+        assert "/run/wrappers/" in machine.succeed("which passwd")
 
-      with subtest("dry-activation does not change files"):
-          machine.succeed('test -e /home/dry-test')  # home was created
-          machine.succeed('rm -rf /home/dry-test')
+    with subtest("dry-activation does not change files"):
+        machine.succeed('test -e /home/dry-test')  # home was created
+        machine.succeed('rm -rf /home/dry-test')
 
-          files_to_check = ['/etc/group',
-                            '/etc/passwd',
-                            '/etc/shadow',
-                            '/etc/subuid',
-                            '/etc/subgid',
-                            '/var/lib/nixos/uid-map',
-                            '/var/lib/nixos/gid-map',
-                            '/var/lib/nixos/declarative-groups',
-                            '/var/lib/nixos/declarative-users'
-                           ]
-          expected_hashes = {}
-          expected_stats = {}
-          for file in files_to_check:
-              expected_hashes[file] = machine.succeed(f"sha256sum {file}")
-              expected_stats[file] = machine.succeed(f"stat {file}")
+        files_to_check = ['/etc/group',
+                          '/etc/passwd',
+                          '/etc/shadow',
+                          '/etc/subuid',
+                          '/etc/subgid',
+                          '/var/lib/nixos/uid-map',
+                          '/var/lib/nixos/gid-map',
+                          '/var/lib/nixos/declarative-groups',
+                          '/var/lib/nixos/declarative-users'
+                         ]
+        expected_hashes = {}
+        expected_stats = {}
+        for file in files_to_check:
+            expected_hashes[file] = machine.succeed(f"sha256sum {file}")
+            expected_stats[file] = machine.succeed(f"stat {file}")
 
-          machine.succeed("/run/booted-system/specialisation/mutable/bin/switch-to-configuration dry-activate")
+        machine.succeed("/run/booted-system/specialisation/mutable/bin/switch-to-configuration dry-activate")
 
-          machine.fail('test -e /home/dry-test')  # home was not recreated
-          for file in files_to_check:
-              assert machine.succeed(f"sha256sum {file}") == expected_hashes[file]
-              assert machine.succeed(f"stat {file}") == expected_stats[file]
-    '';
-  }
-)
+        machine.fail('test -e /home/dry-test')  # home was not recreated
+        for file in files_to_check:
+            assert machine.succeed(f"sha256sum {file}") == expected_hashes[file]
+            assert machine.succeed(f"stat {file}") == expected_stats[file]
+  '';
+}
diff --git a/nixos/tests/mympd.nix b/nixos/tests/mympd.nix
index 20c5603da69d..8d599dd3ad39 100644
--- a/nixos/tests/mympd.nix
+++ b/nixos/tests/mympd.nix
@@ -1,30 +1,28 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "mympd";
+{ pkgs, lib, ... }:
+{
+  name = "mympd";
 
-    nodes.mympd = {
-      services.mympd = {
-        enable = true;
-        settings = {
-          http_port = 8081;
-        };
+  nodes.mympd = {
+    services.mympd = {
+      enable = true;
+      settings = {
+        http_port = 8081;
       };
-
-      services.mpd.enable = true;
     };
 
-    testScript = ''
-      start_all();
-      machine.wait_for_unit("mympd.service");
+    services.mpd.enable = true;
+  };
 
-      # Ensure that mympd can connect to mpd
-      machine.wait_until_succeeds(
-        "journalctl -eu mympd -o cat | grep 'Connected to MPD'"
-      )
+  testScript = ''
+    start_all();
+    machine.wait_for_unit("mympd.service");
 
-      # Ensure that the web server is working
-      machine.succeed("curl http://localhost:8081 --compressed | grep -o myMPD")
-    '';
-  }
-)
+    # Ensure that mympd can connect to mpd
+    machine.wait_until_succeeds(
+      "journalctl -eu mympd -o cat | grep 'Connected to MPD'"
+    )
+
+    # Ensure that the web server is working
+    machine.succeed("curl http://localhost:8081 --compressed | grep -o myMPD")
+  '';
+}
diff --git a/nixos/tests/nar-serve.nix b/nixos/tests/nar-serve.nix
index fde57eb4f670..d05d3f136251 100644
--- a/nixos/tests/nar-serve.nix
+++ b/nixos/tests/nar-serve.nix
@@ -1,51 +1,49 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "nar-serve";
-    meta.maintainers = [ lib.maintainers.rizary ];
-    nodes = {
-      server =
-        { pkgs, ... }:
-        {
-          services.nginx = {
-            enable = true;
-            virtualHosts.default.root = "/var/www";
-          };
-          services.nar-serve = {
-            enable = true;
-            # Connect to the localhost nginx instead of the default
-            # https://cache.nixos.org
-            cacheURL = "http://localhost/";
-          };
-          environment.systemPackages = [
-            pkgs.hello
-            pkgs.curl
-          ];
-
-          networking.firewall.allowedTCPPorts = [ 8383 ];
-
-          # virtualisation.diskSize = 2 * 1024;
+{ pkgs, lib, ... }:
+{
+  name = "nar-serve";
+  meta.maintainers = [ lib.maintainers.rizary ];
+  nodes = {
+    server =
+      { pkgs, ... }:
+      {
+        services.nginx = {
+          enable = true;
+          virtualHosts.default.root = "/var/www";
         };
-    };
-    testScript = ''
-      import os
+        services.nar-serve = {
+          enable = true;
+          # Connect to the localhost nginx instead of the default
+          # https://cache.nixos.org
+          cacheURL = "http://localhost/";
+        };
+        environment.systemPackages = [
+          pkgs.hello
+          pkgs.curl
+        ];
 
-      start_all()
+        networking.firewall.allowedTCPPorts = [ 8383 ];
 
-      # Create a fake cache with Nginx service the static files
-      server.succeed(
-          "nix --experimental-features nix-command copy --to file:///var/www ${pkgs.hello}"
-      )
-      server.wait_for_unit("nginx.service")
-      server.wait_for_open_port(80)
+        # virtualisation.diskSize = 2 * 1024;
+      };
+  };
+  testScript = ''
+    import os
 
-      # Check that nar-serve can return the content of the derivation
-      drvName = os.path.basename("${pkgs.hello}")
-      drvHash = drvName.split("-")[0]
-      server.wait_for_unit("nar-serve.service")
-      server.succeed(
-          "curl -o hello -f http://localhost:8383/nix/store/{}/bin/hello".format(drvHash)
-      )
-    '';
-  }
-)
+    start_all()
+
+    # Create a fake cache with Nginx service the static files
+    server.succeed(
+        "nix --experimental-features nix-command copy --to file:///var/www ${pkgs.hello}"
+    )
+    server.wait_for_unit("nginx.service")
+    server.wait_for_open_port(80)
+
+    # Check that nar-serve can return the content of the derivation
+    drvName = os.path.basename("${pkgs.hello}")
+    drvHash = drvName.split("-")[0]
+    server.wait_for_unit("nar-serve.service")
+    server.succeed(
+        "curl -o hello -f http://localhost:8383/nix/store/{}/bin/hello".format(drvHash)
+    )
+  '';
+}
diff --git a/nixos/tests/nats.nix b/nixos/tests/nats.nix
index b62b9201101a..2ed97ee86b09 100644
--- a/nixos/tests/nats.nix
+++ b/nixos/tests/nats.nix
@@ -6,75 +6,73 @@ let
   topic = "foo.bar";
 
 in
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "nats";
-    meta = with pkgs.lib; {
-      maintainers = with maintainers; [ c0deaddict ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "nats";
+  meta = with pkgs.lib; {
+    maintainers = with maintainers; [ c0deaddict ];
+  };
 
-    nodes =
-      let
-        client =
-          { pkgs, ... }:
-          {
-            environment.systemPackages = with pkgs; [ natscli ];
-          };
-      in
-      {
-        server =
-          { pkgs, ... }:
-          {
-            networking.firewall.allowedTCPPorts = [ port ];
-            services.nats = {
-              inherit port;
-              enable = true;
-              settings = {
-                authorization = {
-                  users = [
-                    {
-                      user = username;
-                      inherit password;
-                    }
-                  ];
-                };
+  nodes =
+    let
+      client =
+        { pkgs, ... }:
+        {
+          environment.systemPackages = with pkgs; [ natscli ];
+        };
+    in
+    {
+      server =
+        { pkgs, ... }:
+        {
+          networking.firewall.allowedTCPPorts = [ port ];
+          services.nats = {
+            inherit port;
+            enable = true;
+            settings = {
+              authorization = {
+                users = [
+                  {
+                    user = username;
+                    inherit password;
+                  }
+                ];
               };
             };
           };
+        };
 
-        client1 = client;
-        client2 = client;
-      };
+      client1 = client;
+      client2 = client;
+    };
 
-    testScript =
-      let
-        file = "/tmp/msg";
-      in
-      ''
-        def nats_cmd(*args):
-            return (
-                "nats "
-                "--server=nats://server:${toString port} "
-                "--user=${username} "
-                "--password=${password} "
-                "{}"
-            ).format(" ".join(args))
+  testScript =
+    let
+      file = "/tmp/msg";
+    in
+    ''
+      def nats_cmd(*args):
+          return (
+              "nats "
+              "--server=nats://server:${toString port} "
+              "--user=${username} "
+              "--password=${password} "
+              "{}"
+          ).format(" ".join(args))
 
-        def parallel(*fns):
-            from threading import Thread
-            threads = [ Thread(target=fn) for fn in fns ]
-            for t in threads: t.start()
-            for t in threads: t.join()
+      def parallel(*fns):
+          from threading import Thread
+          threads = [ Thread(target=fn) for fn in fns ]
+          for t in threads: t.start()
+          for t in threads: t.join()
 
-        start_all()
-        server.wait_for_unit("nats.service")
+      start_all()
+      server.wait_for_unit("nats.service")
 
-        with subtest("pub sub"):
-            parallel(
-                lambda: client1.succeed(nats_cmd("sub", "--count", "1", "${topic}")),
-                lambda: client2.succeed("sleep 2 && {}".format(nats_cmd("pub", "${topic}", "hello"))),
-            )
-      '';
-  }
-)
+      with subtest("pub sub"):
+          parallel(
+              lambda: client1.succeed(nats_cmd("sub", "--count", "1", "${topic}")),
+              lambda: client2.succeed("sleep 2 && {}".format(nats_cmd("pub", "${topic}", "hello"))),
+          )
+    '';
+}
diff --git a/nixos/tests/navidrome.nix b/nixos/tests/navidrome.nix
index b6afad8e56c7..e57cec0d2830 100644
--- a/nixos/tests/navidrome.nix
+++ b/nixos/tests/navidrome.nix
@@ -1,17 +1,15 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "navidrome";
+{ pkgs, ... }:
+{
+  name = "navidrome";
 
-    nodes.machine =
-      { ... }:
-      {
-        services.navidrome.enable = true;
-      };
+  nodes.machine =
+    { ... }:
+    {
+      services.navidrome.enable = true;
+    };
 
-    testScript = ''
-      machine.wait_for_unit("navidrome")
-      machine.wait_for_open_port(4533)
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("navidrome")
+    machine.wait_for_open_port(4533)
+  '';
+}
diff --git a/nixos/tests/nbd.nix b/nixos/tests/nbd.nix
index 7905a4a6127e..088e35c2df6a 100644
--- a/nixos/tests/nbd.nix
+++ b/nixos/tests/nbd.nix
@@ -1,116 +1,114 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    listenPort = 30123;
-    testString = "It works!";
-    mkCreateSmallFileService =
-      {
-        path,
-        loop ? false,
-      }:
-      {
-        script = ''
-          ${pkgs.coreutils}/bin/dd if=/dev/zero of=${path} bs=1K count=100
-          ${pkgs.lib.optionalString loop "${pkgs.util-linux}/bin/losetup --find ${path}"}
-        '';
-        serviceConfig = {
-          Type = "oneshot";
-        };
-        wantedBy = [ "multi-user.target" ];
-        before = [ "nbd-server.service" ];
+{ pkgs, ... }:
+let
+  listenPort = 30123;
+  testString = "It works!";
+  mkCreateSmallFileService =
+    {
+      path,
+      loop ? false,
+    }:
+    {
+      script = ''
+        ${pkgs.coreutils}/bin/dd if=/dev/zero of=${path} bs=1K count=100
+        ${pkgs.lib.optionalString loop "${pkgs.util-linux}/bin/losetup --find ${path}"}
+      '';
+      serviceConfig = {
+        Type = "oneshot";
       };
-  in
-  {
-    name = "nbd";
-
-    nodes = {
-      server =
-        { config, pkgs, ... }:
-        {
-          # Create some small files of zeros to use as the ndb disks
-          ## `vault-pub.disk` is accessible from any IP
-          systemd.services.create-pub-file = mkCreateSmallFileService { path = "/vault-pub.disk"; };
-          ## `vault-priv.disk` is accessible only from localhost.
-          ## It's also a loopback device to test exporting /dev/...
-          systemd.services.create-priv-file = mkCreateSmallFileService {
-            path = "/vault-priv.disk";
-            loop = true;
-          };
-          ## `aaa.disk` is just here because "[aaa]" sorts before
-          ## "[generic]" lexicographically, and nbd-server breaks if
-          ## "[generic]" isn't the first section.
-          systemd.services.create-aaa-file = mkCreateSmallFileService { path = "/aaa.disk"; };
-
-          # Needed only for nbd-client used in the tests.
-          environment.systemPackages = [ pkgs.nbd ];
-
-          # Open the nbd port in the firewall
-          networking.firewall.allowedTCPPorts = [ listenPort ];
-
-          # Run the nbd server and expose the small file created above
-          services.nbd.server = {
-            enable = true;
-            exports = {
-              aaa = {
-                path = "/aaa.disk";
-              };
-              vault-pub = {
-                path = "/vault-pub.disk";
-              };
-              vault-priv = {
-                path = "/dev/loop0";
-                allowAddresses = [
-                  "127.0.0.1"
-                  "::1"
-                ];
-              };
-            };
-            listenAddress = "0.0.0.0";
-            listenPort = listenPort;
-          };
-        };
-
-      client =
-        { config, pkgs, ... }:
-        {
-          programs.nbd.enable = true;
-        };
+      wantedBy = [ "multi-user.target" ];
+      before = [ "nbd-server.service" ];
     };
+in
+{
+  name = "nbd";
 
-    testScript = ''
-      testString = "${testString}"
+  nodes = {
+    server =
+      { config, pkgs, ... }:
+      {
+        # Create some small files of zeros to use as the ndb disks
+        ## `vault-pub.disk` is accessible from any IP
+        systemd.services.create-pub-file = mkCreateSmallFileService { path = "/vault-pub.disk"; };
+        ## `vault-priv.disk` is accessible only from localhost.
+        ## It's also a loopback device to test exporting /dev/...
+        systemd.services.create-priv-file = mkCreateSmallFileService {
+          path = "/vault-priv.disk";
+          loop = true;
+        };
+        ## `aaa.disk` is just here because "[aaa]" sorts before
+        ## "[generic]" lexicographically, and nbd-server breaks if
+        ## "[generic]" isn't the first section.
+        systemd.services.create-aaa-file = mkCreateSmallFileService { path = "/aaa.disk"; };
 
-      start_all()
-      server.wait_for_open_port(${toString listenPort})
+        # Needed only for nbd-client used in the tests.
+        environment.systemPackages = [ pkgs.nbd ];
 
-      # Client: Connect to the server, write a small string to the nbd disk, and cleanly disconnect
-      client.succeed("nbd-client server ${toString listenPort} /dev/nbd0 -name vault-pub -persist")
-      client.succeed(f"echo '{testString}' | dd of=/dev/nbd0 conv=notrunc")
-      client.succeed("nbd-client -d /dev/nbd0")
+        # Open the nbd port in the firewall
+        networking.firewall.allowedTCPPorts = [ listenPort ];
 
-      # Server: Check that the string written by the client is indeed in the file
-      foundString = server.succeed(f"dd status=none if=/vault-pub.disk count={len(testString)}")[:len(testString)]
-      if foundString != testString:
-         raise Exception(f"Read the wrong string from nbd disk. Expected: '{testString}'. Found: '{foundString}'")
+        # Run the nbd server and expose the small file created above
+        services.nbd.server = {
+          enable = true;
+          exports = {
+            aaa = {
+              path = "/aaa.disk";
+            };
+            vault-pub = {
+              path = "/vault-pub.disk";
+            };
+            vault-priv = {
+              path = "/dev/loop0";
+              allowAddresses = [
+                "127.0.0.1"
+                "::1"
+              ];
+            };
+          };
+          listenAddress = "0.0.0.0";
+          listenPort = listenPort;
+        };
+      };
 
-      # Client: Fail to connect to the private disk
-      client.fail("nbd-client server ${toString listenPort} /dev/nbd0 -name vault-priv -persist")
+    client =
+      { config, pkgs, ... }:
+      {
+        programs.nbd.enable = true;
+      };
+  };
 
-      # Server: Successfully connect to the private disk
-      server.succeed("nbd-client localhost ${toString listenPort} /dev/nbd0 -name vault-priv -persist")
-      server.succeed(f"echo '{testString}' | dd of=/dev/nbd0 conv=notrunc")
-      foundString = server.succeed(f"dd status=none if=/dev/loop0 count={len(testString)}")[:len(testString)]
-      if foundString != testString:
-         raise Exception(f"Read the wrong string from nbd disk. Expected: '{testString}'. Found: '{foundString}'")
-      server.succeed("nbd-client -d /dev/nbd0")
+  testScript = ''
+    testString = "${testString}"
 
-      # Server: Successfully connect to the aaa disk
-      server.succeed("nbd-client localhost ${toString listenPort} /dev/nbd0 -name aaa -persist")
-      server.succeed(f"echo '{testString}' | dd of=/dev/nbd0 conv=notrunc")
-      foundString = server.succeed(f"dd status=none if=/aaa.disk count={len(testString)}")[:len(testString)]
-      if foundString != testString:
-         raise Exception(f"Read the wrong string from nbd disk. Expected: '{testString}'. Found: '{foundString}'")
-      server.succeed("nbd-client -d /dev/nbd0")
-    '';
-  }
-)
+    start_all()
+    server.wait_for_open_port(${toString listenPort})
+
+    # Client: Connect to the server, write a small string to the nbd disk, and cleanly disconnect
+    client.succeed("nbd-client server ${toString listenPort} /dev/nbd0 -name vault-pub -persist")
+    client.succeed(f"echo '{testString}' | dd of=/dev/nbd0 conv=notrunc")
+    client.succeed("nbd-client -d /dev/nbd0")
+
+    # Server: Check that the string written by the client is indeed in the file
+    foundString = server.succeed(f"dd status=none if=/vault-pub.disk count={len(testString)}")[:len(testString)]
+    if foundString != testString:
+       raise Exception(f"Read the wrong string from nbd disk. Expected: '{testString}'. Found: '{foundString}'")
+
+    # Client: Fail to connect to the private disk
+    client.fail("nbd-client server ${toString listenPort} /dev/nbd0 -name vault-priv -persist")
+
+    # Server: Successfully connect to the private disk
+    server.succeed("nbd-client localhost ${toString listenPort} /dev/nbd0 -name vault-priv -persist")
+    server.succeed(f"echo '{testString}' | dd of=/dev/nbd0 conv=notrunc")
+    foundString = server.succeed(f"dd status=none if=/dev/loop0 count={len(testString)}")[:len(testString)]
+    if foundString != testString:
+       raise Exception(f"Read the wrong string from nbd disk. Expected: '{testString}'. Found: '{foundString}'")
+    server.succeed("nbd-client -d /dev/nbd0")
+
+    # Server: Successfully connect to the aaa disk
+    server.succeed("nbd-client localhost ${toString listenPort} /dev/nbd0 -name aaa -persist")
+    server.succeed(f"echo '{testString}' | dd of=/dev/nbd0 conv=notrunc")
+    foundString = server.succeed(f"dd status=none if=/aaa.disk count={len(testString)}")[:len(testString)]
+    if foundString != testString:
+       raise Exception(f"Read the wrong string from nbd disk. Expected: '{testString}'. Found: '{foundString}'")
+    server.succeed("nbd-client -d /dev/nbd0")
+  '';
+}
diff --git a/nixos/tests/ncdns.nix b/nixos/tests/ncdns.nix
index 48f17ed16b85..97f509250475 100644
--- a/nixos/tests/ncdns.nix
+++ b/nixos/tests/ncdns.nix
@@ -1,97 +1,95 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    fakeReply = pkgs.writeText "namecoin-reply.json" ''
-      { "error": null,
-        "id": 1,
-        "result": {
-          "address": "T31q8ucJ4dI1xzhxQ5QispfECld5c7Xw",
-          "expired": false,
-          "expires_in": 2248,
-          "height": 438155,
-          "name": "d/test",
-          "txid": "db61c0b2540ba0c1a2c8cc92af703a37002e7566ecea4dbf8727c7191421edfb",
-          "value": "{\"ip\": \"1.2.3.4\", \"email\": \"root@test.bit\",\"info\": \"Fake record\"}",
-          "vout": 0
-        }
+{ lib, pkgs, ... }:
+let
+  fakeReply = pkgs.writeText "namecoin-reply.json" ''
+    { "error": null,
+      "id": 1,
+      "result": {
+        "address": "T31q8ucJ4dI1xzhxQ5QispfECld5c7Xw",
+        "expired": false,
+        "expires_in": 2248,
+        "height": 438155,
+        "name": "d/test",
+        "txid": "db61c0b2540ba0c1a2c8cc92af703a37002e7566ecea4dbf8727c7191421edfb",
+        "value": "{\"ip\": \"1.2.3.4\", \"email\": \"root@test.bit\",\"info\": \"Fake record\"}",
+        "vout": 0
       }
-    '';
+    }
+  '';
 
-    # Disabled because DNSSEC does not currently validate,
-    # see https://github.com/namecoin/ncdns/issues/127
-    dnssec = false;
+  # Disabled because DNSSEC does not currently validate,
+  # see https://github.com/namecoin/ncdns/issues/127
+  dnssec = false;
 
-  in
+in
 
-  {
-    name = "ncdns";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ rnhmjoj ];
-    };
+{
+  name = "ncdns";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ rnhmjoj ];
+  };
 
-    nodes.server =
-      { ... }:
-      {
-        networking.nameservers = [ "::1" ];
+  nodes.server =
+    { ... }:
+    {
+      networking.nameservers = [ "::1" ];
 
-        services.namecoind.rpc = {
-          address = "::1";
-          user = "namecoin";
-          password = "secret";
-          port = 8332;
-        };
-
-        # Fake namecoin RPC server because we can't
-        # run a full node in a test.
-        systemd.services.namecoind = {
-          wantedBy = [ "multi-user.target" ];
-          script = ''
-            while true; do
-              echo -e "HTTP/1.1 200 OK\n\n $(<${fakeReply})\n" \
-                | ${pkgs.netcat}/bin/nc -N -l ::1 8332
-            done
-          '';
-        };
-
-        services.ncdns = {
-          enable = true;
-          dnssec.enable = dnssec;
-          identity.hostname = "example.com";
-          identity.hostmaster = "root@example.com";
-          identity.address = "1.0.0.1";
-        };
-
-        services.pdns-recursor.enable = true;
-        services.pdns-recursor.resolveNamecoin = true;
-
-        environment.systemPackages = [ pkgs.dnsutils ];
+      services.namecoind.rpc = {
+        address = "::1";
+        user = "namecoin";
+        password = "secret";
+        port = 8332;
       };
 
-    testScript =
-      (lib.optionalString dnssec ''
-        with subtest("DNSSEC keys have been generated"):
-            server.wait_for_unit("ncdns")
-            server.wait_for_file("/var/lib/ncdns/bit.key")
-            server.wait_for_file("/var/lib/ncdns/bit-zone.key")
+      # Fake namecoin RPC server because we can't
+      # run a full node in a test.
+      systemd.services.namecoind = {
+        wantedBy = [ "multi-user.target" ];
+        script = ''
+          while true; do
+            echo -e "HTTP/1.1 200 OK\n\n $(<${fakeReply})\n" \
+              | ${pkgs.netcat}/bin/nc -N -l ::1 8332
+          done
+        '';
+      };
 
-        with subtest("DNSKEY bit record is present"):
-            server.wait_for_unit("pdns-recursor")
-            server.wait_for_open_port(53)
-            server.succeed("host -t DNSKEY bit")
-      '')
-      + ''
-        with subtest("can resolve a .bit name"):
-            server.wait_for_unit("namecoind")
-            server.wait_for_unit("ncdns")
-            server.wait_for_open_port(8332)
-            assert "1.2.3.4" in server.succeed("dig @localhost -p 5333 test.bit")
+      services.ncdns = {
+        enable = true;
+        dnssec.enable = dnssec;
+        identity.hostname = "example.com";
+        identity.hostmaster = "root@example.com";
+        identity.address = "1.0.0.1";
+      };
 
-        with subtest("SOA record has identity information"):
-            assert "example.com" in server.succeed("dig SOA @localhost -p 5333 bit")
+      services.pdns-recursor.enable = true;
+      services.pdns-recursor.resolveNamecoin = true;
 
-        with subtest("bit. zone forwarding works"):
-            server.wait_for_unit("pdns-recursor")
-            assert "1.2.3.4" in server.succeed("host test.bit")
-      '';
-  }
-)
+      environment.systemPackages = [ pkgs.dnsutils ];
+    };
+
+  testScript =
+    (lib.optionalString dnssec ''
+      with subtest("DNSSEC keys have been generated"):
+          server.wait_for_unit("ncdns")
+          server.wait_for_file("/var/lib/ncdns/bit.key")
+          server.wait_for_file("/var/lib/ncdns/bit-zone.key")
+
+      with subtest("DNSKEY bit record is present"):
+          server.wait_for_unit("pdns-recursor")
+          server.wait_for_open_port(53)
+          server.succeed("host -t DNSKEY bit")
+    '')
+    + ''
+      with subtest("can resolve a .bit name"):
+          server.wait_for_unit("namecoind")
+          server.wait_for_unit("ncdns")
+          server.wait_for_open_port(8332)
+          assert "1.2.3.4" in server.succeed("dig @localhost -p 5333 test.bit")
+
+      with subtest("SOA record has identity information"):
+          assert "example.com" in server.succeed("dig SOA @localhost -p 5333 bit")
+
+      with subtest("bit. zone forwarding works"):
+          server.wait_for_unit("pdns-recursor")
+          assert "1.2.3.4" in server.succeed("host test.bit")
+    '';
+}
diff --git a/nixos/tests/ndppd.nix b/nixos/tests/ndppd.nix
index 23f1826cc3f7..465e86bfa77d 100644
--- a/nixos/tests/ndppd.nix
+++ b/nixos/tests/ndppd.nix
@@ -1,74 +1,72 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "ndppd";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fpletz ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "ndppd";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fpletz ];
+  };
 
-    nodes = {
-      upstream =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.tcpdump ];
-          networking.useDHCP = false;
-          networking.interfaces = {
-            eth1 = {
-              ipv6.addresses = [
-                {
-                  address = "fd23::1";
-                  prefixLength = 112;
-                }
-              ];
-              ipv6.routes = [
-                {
-                  address = "fd42::";
-                  prefixLength = 112;
-                }
-              ];
-            };
+  nodes = {
+    upstream =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.tcpdump ];
+        networking.useDHCP = false;
+        networking.interfaces = {
+          eth1 = {
+            ipv6.addresses = [
+              {
+                address = "fd23::1";
+                prefixLength = 112;
+              }
+            ];
+            ipv6.routes = [
+              {
+                address = "fd42::";
+                prefixLength = 112;
+              }
+            ];
           };
         };
-      server =
-        { pkgs, ... }:
-        {
-          boot.kernel.sysctl = {
-            "net.ipv6.conf.all.forwarding" = "1";
-            "net.ipv6.conf.default.forwarding" = "1";
-          };
-          environment.systemPackages = [ pkgs.tcpdump ];
-          networking.useDHCP = false;
-          networking.interfaces = {
-            eth1 = {
-              ipv6.addresses = [
-                {
-                  address = "fd23::2";
-                  prefixLength = 112;
-                }
-              ];
-            };
-          };
-          services.ndppd = {
-            enable = true;
-            proxies.eth1.rules."fd42::/112" = { };
-          };
-          containers.client = {
-            autoStart = true;
-            privateNetwork = true;
-            hostAddress = "192.168.255.1";
-            localAddress = "192.168.255.2";
-            hostAddress6 = "fd42::1";
-            localAddress6 = "fd42::2";
-            config = { };
+      };
+    server =
+      { pkgs, ... }:
+      {
+        boot.kernel.sysctl = {
+          "net.ipv6.conf.all.forwarding" = "1";
+          "net.ipv6.conf.default.forwarding" = "1";
+        };
+        environment.systemPackages = [ pkgs.tcpdump ];
+        networking.useDHCP = false;
+        networking.interfaces = {
+          eth1 = {
+            ipv6.addresses = [
+              {
+                address = "fd23::2";
+                prefixLength = 112;
+              }
+            ];
           };
         };
-    };
+        services.ndppd = {
+          enable = true;
+          proxies.eth1.rules."fd42::/112" = { };
+        };
+        containers.client = {
+          autoStart = true;
+          privateNetwork = true;
+          hostAddress = "192.168.255.1";
+          localAddress = "192.168.255.2";
+          hostAddress6 = "fd42::1";
+          localAddress6 = "fd42::2";
+          config = { };
+        };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      server.wait_for_unit("multi-user.target")
-      upstream.wait_for_unit("multi-user.target")
-      upstream.wait_until_succeeds("ping -c5 fd42::2")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    server.wait_for_unit("multi-user.target")
+    upstream.wait_for_unit("multi-user.target")
+    upstream.wait_until_succeeds("ping -c5 fd42::2")
+  '';
+}
diff --git a/nixos/tests/nebula.nix b/nixos/tests/nebula.nix
index 68a48d4c86a2..68f60f8388fd 100644
--- a/nixos/tests/nebula.nix
+++ b/nixos/tests/nebula.nix
@@ -1,426 +1,424 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
+{ pkgs, lib, ... }:
+let
 
-    # We'll need to be able to trade cert files between nodes via scp.
-    inherit (import ./ssh-keys.nix pkgs)
-      snakeOilPrivateKey
-      snakeOilPublicKey
-      ;
+  # We'll need to be able to trade cert files between nodes via scp.
+  inherit (import ./ssh-keys.nix pkgs)
+    snakeOilPrivateKey
+    snakeOilPublicKey
+    ;
 
-    makeNebulaNode =
-      { config, ... }:
-      name: extraConfig:
-      lib.mkMerge [
-        {
-          # Expose nebula for doing cert signing.
-          environment.systemPackages = [
-            pkgs.dig
-            pkgs.nebula
-          ];
-          users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
-          services.openssh.enable = true;
-          networking.firewall.enable = true; # Implicitly true, but let's make sure.
-          networking.interfaces.eth1.useDHCP = false;
+  makeNebulaNode =
+    { config, ... }:
+    name: extraConfig:
+    lib.mkMerge [
+      {
+        # Expose nebula for doing cert signing.
+        environment.systemPackages = [
+          pkgs.dig
+          pkgs.nebula
+        ];
+        users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+        services.openssh.enable = true;
+        networking.firewall.enable = true; # Implicitly true, but let's make sure.
+        networking.interfaces.eth1.useDHCP = false;
 
-          services.nebula.networks.smoke = {
-            # Note that these paths won't exist when the machine is first booted.
-            ca = "/etc/nebula/ca.crt";
-            cert = "/etc/nebula/${name}.crt";
-            key = "/etc/nebula/${name}.key";
-            listen = {
-              host = "0.0.0.0";
-              port =
-                if
-                  (
-                    config.services.nebula.networks.smoke.isLighthouse || config.services.nebula.networks.smoke.isRelay
-                  )
-                then
-                  4242
-                else
-                  0;
-            };
+        services.nebula.networks.smoke = {
+          # Note that these paths won't exist when the machine is first booted.
+          ca = "/etc/nebula/ca.crt";
+          cert = "/etc/nebula/${name}.crt";
+          key = "/etc/nebula/${name}.key";
+          listen = {
+            host = "0.0.0.0";
+            port =
+              if
+                (
+                  config.services.nebula.networks.smoke.isLighthouse || config.services.nebula.networks.smoke.isRelay
+                )
+              then
+                4242
+              else
+                0;
           };
-        }
-        extraConfig
-      ];
+        };
+      }
+      extraConfig
+    ];
 
-  in
-  {
-    name = "nebula";
+in
+{
+  name = "nebula";
 
-    nodes = {
+  nodes = {
 
-      lighthouse =
-        { ... }@args:
-        makeNebulaNode args "lighthouse" {
-          networking.firewall.allowedUDPPorts = [ 53 ];
-          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-            {
-              address = "192.168.1.1";
-              prefixLength = 24;
-            }
-          ];
+    lighthouse =
+      { ... }@args:
+      makeNebulaNode args "lighthouse" {
+        networking.firewall.allowedUDPPorts = [ 53 ];
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          {
+            address = "192.168.1.1";
+            prefixLength = 24;
+          }
+        ];
 
-          services.nebula.networks.smoke = {
-            isLighthouse = true;
-            isRelay = true;
-            firewall = {
-              outbound = [
-                {
-                  port = "any";
-                  proto = "any";
-                  host = "any";
-                }
-              ];
-              inbound = [
-                {
-                  port = "any";
-                  proto = "any";
-                  host = "any";
-                }
-              ];
-            };
-            lighthouse = {
-              dns = {
-                enable = true;
-                host = "10.0.100.1"; # bind to lighthouse interface
-                port = 53; # answer on standard DNS port
-              };
+        services.nebula.networks.smoke = {
+          isLighthouse = true;
+          isRelay = true;
+          firewall = {
+            outbound = [
+              {
+                port = "any";
+                proto = "any";
+                host = "any";
+              }
+            ];
+            inbound = [
+              {
+                port = "any";
+                proto = "any";
+                host = "any";
+              }
+            ];
+          };
+          lighthouse = {
+            dns = {
+              enable = true;
+              host = "10.0.100.1"; # bind to lighthouse interface
+              port = 53; # answer on standard DNS port
             };
           };
         };
+      };
 
-      allowAny =
-        { ... }@args:
-        makeNebulaNode args "allowAny" {
-          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-            {
-              address = "192.168.1.2";
-              prefixLength = 24;
-            }
-          ];
+    allowAny =
+      { ... }@args:
+      makeNebulaNode args "allowAny" {
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          {
+            address = "192.168.1.2";
+            prefixLength = 24;
+          }
+        ];
 
-          services.nebula.networks.smoke = {
-            staticHostMap = {
-              "10.0.100.1" = [ "192.168.1.1:4242" ];
-            };
-            isLighthouse = false;
-            lighthouses = [ "10.0.100.1" ];
-            relays = [ "10.0.100.1" ];
-            firewall = {
-              outbound = [
-                {
-                  port = "any";
-                  proto = "any";
-                  host = "any";
-                }
-              ];
-              inbound = [
-                {
-                  port = "any";
-                  proto = "any";
-                  host = "any";
-                }
-              ];
-            };
+        services.nebula.networks.smoke = {
+          staticHostMap = {
+            "10.0.100.1" = [ "192.168.1.1:4242" ];
+          };
+          isLighthouse = false;
+          lighthouses = [ "10.0.100.1" ];
+          relays = [ "10.0.100.1" ];
+          firewall = {
+            outbound = [
+              {
+                port = "any";
+                proto = "any";
+                host = "any";
+              }
+            ];
+            inbound = [
+              {
+                port = "any";
+                proto = "any";
+                host = "any";
+              }
+            ];
           };
         };
+      };
 
-      allowFromLighthouse =
-        { ... }@args:
-        makeNebulaNode args "allowFromLighthouse" {
-          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-            {
-              address = "192.168.1.3";
-              prefixLength = 24;
-            }
-          ];
+    allowFromLighthouse =
+      { ... }@args:
+      makeNebulaNode args "allowFromLighthouse" {
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          {
+            address = "192.168.1.3";
+            prefixLength = 24;
+          }
+        ];
 
-          services.nebula.networks.smoke = {
-            staticHostMap = {
-              "10.0.100.1" = [ "192.168.1.1:4242" ];
-            };
-            isLighthouse = false;
-            lighthouses = [ "10.0.100.1" ];
-            relays = [ "10.0.100.1" ];
-            firewall = {
-              outbound = [
-                {
-                  port = "any";
-                  proto = "any";
-                  host = "any";
-                }
-              ];
-              inbound = [
-                {
-                  port = "any";
-                  proto = "any";
-                  host = "lighthouse";
-                }
-              ];
-            };
+        services.nebula.networks.smoke = {
+          staticHostMap = {
+            "10.0.100.1" = [ "192.168.1.1:4242" ];
+          };
+          isLighthouse = false;
+          lighthouses = [ "10.0.100.1" ];
+          relays = [ "10.0.100.1" ];
+          firewall = {
+            outbound = [
+              {
+                port = "any";
+                proto = "any";
+                host = "any";
+              }
+            ];
+            inbound = [
+              {
+                port = "any";
+                proto = "any";
+                host = "lighthouse";
+              }
+            ];
           };
         };
+      };
 
-      allowToLighthouse =
-        { ... }@args:
-        makeNebulaNode args "allowToLighthouse" {
-          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-            {
-              address = "192.168.1.4";
-              prefixLength = 24;
-            }
-          ];
+    allowToLighthouse =
+      { ... }@args:
+      makeNebulaNode args "allowToLighthouse" {
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          {
+            address = "192.168.1.4";
+            prefixLength = 24;
+          }
+        ];
 
-          services.nebula.networks.smoke = {
-            enable = true;
-            staticHostMap = {
-              "10.0.100.1" = [ "192.168.1.1:4242" ];
-            };
-            isLighthouse = false;
-            lighthouses = [ "10.0.100.1" ];
-            relays = [ "10.0.100.1" ];
-            firewall = {
-              outbound = [
-                {
-                  port = "any";
-                  proto = "any";
-                  host = "lighthouse";
-                }
-              ];
-              inbound = [
-                {
-                  port = "any";
-                  proto = "any";
-                  host = "any";
-                }
-              ];
-            };
+        services.nebula.networks.smoke = {
+          enable = true;
+          staticHostMap = {
+            "10.0.100.1" = [ "192.168.1.1:4242" ];
+          };
+          isLighthouse = false;
+          lighthouses = [ "10.0.100.1" ];
+          relays = [ "10.0.100.1" ];
+          firewall = {
+            outbound = [
+              {
+                port = "any";
+                proto = "any";
+                host = "lighthouse";
+              }
+            ];
+            inbound = [
+              {
+                port = "any";
+                proto = "any";
+                host = "any";
+              }
+            ];
           };
         };
+      };
 
-      disabled =
-        { ... }@args:
-        makeNebulaNode args "disabled" {
-          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-            {
-              address = "192.168.1.5";
-              prefixLength = 24;
-            }
-          ];
+    disabled =
+      { ... }@args:
+      makeNebulaNode args "disabled" {
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          {
+            address = "192.168.1.5";
+            prefixLength = 24;
+          }
+        ];
 
-          services.nebula.networks.smoke = {
-            enable = false;
-            staticHostMap = {
-              "10.0.100.1" = [ "192.168.1.1:4242" ];
-            };
-            isLighthouse = false;
-            lighthouses = [ "10.0.100.1" ];
-            relays = [ "10.0.100.1" ];
-            firewall = {
-              outbound = [
-                {
-                  port = "any";
-                  proto = "any";
-                  host = "lighthouse";
-                }
-              ];
-              inbound = [
-                {
-                  port = "any";
-                  proto = "any";
-                  host = "any";
-                }
-              ];
-            };
+        services.nebula.networks.smoke = {
+          enable = false;
+          staticHostMap = {
+            "10.0.100.1" = [ "192.168.1.1:4242" ];
+          };
+          isLighthouse = false;
+          lighthouses = [ "10.0.100.1" ];
+          relays = [ "10.0.100.1" ];
+          firewall = {
+            outbound = [
+              {
+                port = "any";
+                proto = "any";
+                host = "lighthouse";
+              }
+            ];
+            inbound = [
+              {
+                port = "any";
+                proto = "any";
+                host = "any";
+              }
+            ];
           };
         };
+      };
 
-    };
+  };
 
-    testScript =
-      let
+  testScript =
+    let
 
-        setUpPrivateKey = name: ''
-          ${name}.start()
-          ${name}.succeed(
-              "mkdir -p /root/.ssh",
-              "chmod 700 /root/.ssh",
-              "cat '${snakeOilPrivateKey}' > /root/.ssh/id_snakeoil",
-              "chmod 600 /root/.ssh/id_snakeoil",
-              "mkdir -p /root"
-          )
-        '';
-
-        # From what I can tell, StrictHostKeyChecking=no is necessary for ssh to work between machines.
-        sshOpts = "-oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null -oIdentityFile=/root/.ssh/id_snakeoil";
-
-        restartAndCheckNebula = name: ip: ''
-          ${name}.systemctl("restart nebula@smoke.service")
-          ${name}.succeed("ping -c5 ${ip}")
-        '';
-
-        # Create a keypair on the client node, then use the public key to sign a cert on the lighthouse.
-        signKeysFor = name: ip: ''
-          lighthouse.wait_for_unit("sshd.service")
-          ${name}.wait_for_unit("sshd.service")
-          ${name}.succeed(
-              "mkdir -p /etc/nebula",
-              "nebula-cert keygen -out-key /etc/nebula/${name}.key -out-pub /etc/nebula/${name}.pub",
-              "scp ${sshOpts} /etc/nebula/${name}.pub root@192.168.1.1:/root/${name}.pub",
-          )
-          lighthouse.succeed(
-              'nebula-cert sign -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "${name}" -groups "${name}" -ip "${ip}" -in-pub /root/${name}.pub -out-crt /root/${name}.crt'
-          )
-          ${name}.succeed(
-              "scp ${sshOpts} root@192.168.1.1:/root/${name}.crt /etc/nebula/${name}.crt",
-              "scp ${sshOpts} root@192.168.1.1:/etc/nebula/ca.crt /etc/nebula/ca.crt",
-              '(id nebula-smoke >/dev/null && chown -R nebula-smoke:nebula-smoke /etc/nebula) || true'
-          )
-        '';
-
-        getPublicIp = node: ''
-          ${node}.succeed("ip --brief addr show eth1 | awk '{print $3}' | tail -n1 | cut -d/ -f1").strip()
-        '';
-
-        # Never do this for anything security critical! (Thankfully it's just a test.)
-        # Restart Nebula right after the mutual block and/or restore so the state is fresh.
-        blockTrafficBetween = nodeA: nodeB: ''
-          node_a = ${getPublicIp nodeA}
-          node_b = ${getPublicIp nodeB}
-          ${nodeA}.succeed("iptables -I INPUT -s " + node_b + " -j DROP")
-          ${nodeB}.succeed("iptables -I INPUT -s " + node_a + " -j DROP")
-          ${nodeA}.systemctl("restart nebula@smoke.service")
-          ${nodeB}.systemctl("restart nebula@smoke.service")
-        '';
-        allowTrafficBetween = nodeA: nodeB: ''
-          node_a = ${getPublicIp nodeA}
-          node_b = ${getPublicIp nodeB}
-          ${nodeA}.succeed("iptables -D INPUT -s " + node_b + " -j DROP")
-          ${nodeB}.succeed("iptables -D INPUT -s " + node_a + " -j DROP")
-          ${nodeA}.systemctl("restart nebula@smoke.service")
-          ${nodeB}.systemctl("restart nebula@smoke.service")
-        '';
-      in
-      ''
-        # Create the certificate and sign the lighthouse's keys.
-        ${setUpPrivateKey "lighthouse"}
-        lighthouse.succeed(
-            "mkdir -p /etc/nebula",
-            'nebula-cert ca -name "Smoke Test" -out-crt /etc/nebula/ca.crt -out-key /etc/nebula/ca.key',
-            'nebula-cert sign -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "lighthouse" -groups "lighthouse" -ip "10.0.100.1/24" -out-crt /etc/nebula/lighthouse.crt -out-key /etc/nebula/lighthouse.key',
-            'chown -R nebula-smoke:nebula-smoke /etc/nebula'
+      setUpPrivateKey = name: ''
+        ${name}.start()
+        ${name}.succeed(
+            "mkdir -p /root/.ssh",
+            "chmod 700 /root/.ssh",
+            "cat '${snakeOilPrivateKey}' > /root/.ssh/id_snakeoil",
+            "chmod 600 /root/.ssh/id_snakeoil",
+            "mkdir -p /root"
         )
-
-        # Reboot the lighthouse and verify that the nebula service comes up on boot.
-        # Since rebooting takes a while, we'll just restart the service on the other nodes.
-        lighthouse.shutdown()
-        lighthouse.start()
-        lighthouse.wait_for_unit("nebula@smoke.service")
-        lighthouse.succeed("ping -c5 10.0.100.1")
-
-        # Create keys for allowAny's nebula service and test that it comes up.
-        ${setUpPrivateKey "allowAny"}
-        ${signKeysFor "allowAny" "10.0.100.2/24"}
-        ${restartAndCheckNebula "allowAny" "10.0.100.2"}
-
-        # Create keys for allowFromLighthouse's nebula service and test that it comes up.
-        ${setUpPrivateKey "allowFromLighthouse"}
-        ${signKeysFor "allowFromLighthouse" "10.0.100.3/24"}
-        ${restartAndCheckNebula "allowFromLighthouse" "10.0.100.3"}
-
-        # Create keys for allowToLighthouse's nebula service and test that it comes up.
-        ${setUpPrivateKey "allowToLighthouse"}
-        ${signKeysFor "allowToLighthouse" "10.0.100.4/24"}
-        ${restartAndCheckNebula "allowToLighthouse" "10.0.100.4"}
-
-        # Create keys for disabled's nebula service and test that it does not come up.
-        ${setUpPrivateKey "disabled"}
-        ${signKeysFor "disabled" "10.0.100.5/24"}
-        disabled.fail("systemctl status nebula@smoke.service")
-        disabled.fail("ping -c5 10.0.100.5")
-
-        # The lighthouse can ping allowAny and allowFromLighthouse but not disabled
-        lighthouse.succeed("ping -c3 10.0.100.2")
-        lighthouse.succeed("ping -c3 10.0.100.3")
-        lighthouse.fail("ping -c3 10.0.100.5")
-
-        # allowAny can ping the lighthouse, but not allowFromLighthouse because of its inbound firewall
-        allowAny.succeed("ping -c3 10.0.100.1")
-        allowAny.fail("ping -c3 10.0.100.3")
-        # allowAny can also resolve DNS on lighthouse
-        allowAny.succeed("dig @10.0.100.1 allowToLighthouse | grep -E 'allowToLighthouse\.\s+[0-9]+\s+IN\s+A\s+10\.0\.100\.4'")
-
-        # allowFromLighthouse can ping the lighthouse and allowAny
-        allowFromLighthouse.succeed("ping -c3 10.0.100.1")
-        allowFromLighthouse.succeed("ping -c3 10.0.100.2")
-
-        # block allowFromLighthouse <-> allowAny, and allowFromLighthouse -> allowAny should still work.
-        ${blockTrafficBetween "allowFromLighthouse" "allowAny"}
-        allowFromLighthouse.succeed("ping -c10 10.0.100.2")
-        ${allowTrafficBetween "allowFromLighthouse" "allowAny"}
-        allowFromLighthouse.succeed("ping -c10 10.0.100.2")
-
-        # allowToLighthouse can ping the lighthouse but not allowAny or allowFromLighthouse
-        allowToLighthouse.succeed("ping -c3 10.0.100.1")
-        allowToLighthouse.fail("ping -c3 10.0.100.2")
-        allowToLighthouse.fail("ping -c3 10.0.100.3")
-
-        # allowAny can ping allowFromLighthouse now that allowFromLighthouse pinged it first
-        allowAny.succeed("ping -c3 10.0.100.3")
-
-        # block allowAny <-> allowFromLighthouse, and allowAny -> allowFromLighthouse should still work.
-        ${blockTrafficBetween "allowAny" "allowFromLighthouse"}
-        allowFromLighthouse.succeed("ping -c10 10.0.100.2")
-        allowAny.succeed("ping -c10 10.0.100.3")
-        ${allowTrafficBetween "allowAny" "allowFromLighthouse"}
-        allowFromLighthouse.succeed("ping -c10 10.0.100.2")
-        allowAny.succeed("ping -c10 10.0.100.3")
-
-        # allowToLighthouse can ping allowAny if allowAny pings it first
-        allowAny.succeed("ping -c3 10.0.100.4")
-        allowToLighthouse.succeed("ping -c3 10.0.100.2")
-
-        # block allowToLighthouse <-> allowAny, and allowAny <-> allowToLighthouse should still work.
-        ${blockTrafficBetween "allowAny" "allowToLighthouse"}
-        allowAny.succeed("ping -c10 10.0.100.4")
-        allowToLighthouse.succeed("ping -c10 10.0.100.2")
-        ${allowTrafficBetween "allowAny" "allowToLighthouse"}
-        allowAny.succeed("ping -c10 10.0.100.4")
-        allowToLighthouse.succeed("ping -c10 10.0.100.2")
-
-        # block lighthouse <-> allowFromLighthouse and allowAny <-> allowFromLighthouse; allowFromLighthouse won't get to allowAny
-        ${blockTrafficBetween "allowFromLighthouse" "lighthouse"}
-        ${blockTrafficBetween "allowFromLighthouse" "allowAny"}
-        allowFromLighthouse.fail("ping -c3 10.0.100.2")
-        ${allowTrafficBetween "allowFromLighthouse" "lighthouse"}
-        ${allowTrafficBetween "allowFromLighthouse" "allowAny"}
-        allowFromLighthouse.succeed("ping -c3 10.0.100.2")
-
-        # block lighthouse <-> allowAny, allowAny <-> allowFromLighthouse, and allowAny <-> allowToLighthouse; it won't get to allowFromLighthouse or allowToLighthouse
-        ${blockTrafficBetween "allowAny" "lighthouse"}
-        ${blockTrafficBetween "allowAny" "allowFromLighthouse"}
-        ${blockTrafficBetween "allowAny" "allowToLighthouse"}
-        allowFromLighthouse.fail("ping -c3 10.0.100.2")
-        allowAny.fail("ping -c3 10.0.100.3")
-        allowAny.fail("ping -c3 10.0.100.4")
-        ${allowTrafficBetween "allowAny" "lighthouse"}
-        ${allowTrafficBetween "allowAny" "allowFromLighthouse"}
-        ${allowTrafficBetween "allowAny" "allowToLighthouse"}
-        allowFromLighthouse.succeed("ping -c3 10.0.100.2")
-        allowAny.succeed("ping -c3 10.0.100.3")
-        allowAny.succeed("ping -c3 10.0.100.4")
-
-        # block lighthouse <-> allowToLighthouse and allowToLighthouse <-> allowAny; it won't get to allowAny
-        ${blockTrafficBetween "allowToLighthouse" "lighthouse"}
-        ${blockTrafficBetween "allowToLighthouse" "allowAny"}
-        allowAny.fail("ping -c3 10.0.100.4")
-        allowToLighthouse.fail("ping -c3 10.0.100.2")
-        ${allowTrafficBetween "allowToLighthouse" "lighthouse"}
-        ${allowTrafficBetween "allowToLighthouse" "allowAny"}
-        allowAny.succeed("ping -c3 10.0.100.4")
-        allowToLighthouse.succeed("ping -c3 10.0.100.2")
       '';
-  }
-)
+
+      # From what I can tell, StrictHostKeyChecking=no is necessary for ssh to work between machines.
+      sshOpts = "-oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null -oIdentityFile=/root/.ssh/id_snakeoil";
+
+      restartAndCheckNebula = name: ip: ''
+        ${name}.systemctl("restart nebula@smoke.service")
+        ${name}.succeed("ping -c5 ${ip}")
+      '';
+
+      # Create a keypair on the client node, then use the public key to sign a cert on the lighthouse.
+      signKeysFor = name: ip: ''
+        lighthouse.wait_for_unit("sshd.service")
+        ${name}.wait_for_unit("sshd.service")
+        ${name}.succeed(
+            "mkdir -p /etc/nebula",
+            "nebula-cert keygen -out-key /etc/nebula/${name}.key -out-pub /etc/nebula/${name}.pub",
+            "scp ${sshOpts} /etc/nebula/${name}.pub root@192.168.1.1:/root/${name}.pub",
+        )
+        lighthouse.succeed(
+            'nebula-cert sign -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "${name}" -groups "${name}" -ip "${ip}" -in-pub /root/${name}.pub -out-crt /root/${name}.crt'
+        )
+        ${name}.succeed(
+            "scp ${sshOpts} root@192.168.1.1:/root/${name}.crt /etc/nebula/${name}.crt",
+            "scp ${sshOpts} root@192.168.1.1:/etc/nebula/ca.crt /etc/nebula/ca.crt",
+            '(id nebula-smoke >/dev/null && chown -R nebula-smoke:nebula-smoke /etc/nebula) || true'
+        )
+      '';
+
+      getPublicIp = node: ''
+        ${node}.succeed("ip --brief addr show eth1 | awk '{print $3}' | tail -n1 | cut -d/ -f1").strip()
+      '';
+
+      # Never do this for anything security critical! (Thankfully it's just a test.)
+      # Restart Nebula right after the mutual block and/or restore so the state is fresh.
+      blockTrafficBetween = nodeA: nodeB: ''
+        node_a = ${getPublicIp nodeA}
+        node_b = ${getPublicIp nodeB}
+        ${nodeA}.succeed("iptables -I INPUT -s " + node_b + " -j DROP")
+        ${nodeB}.succeed("iptables -I INPUT -s " + node_a + " -j DROP")
+        ${nodeA}.systemctl("restart nebula@smoke.service")
+        ${nodeB}.systemctl("restart nebula@smoke.service")
+      '';
+      allowTrafficBetween = nodeA: nodeB: ''
+        node_a = ${getPublicIp nodeA}
+        node_b = ${getPublicIp nodeB}
+        ${nodeA}.succeed("iptables -D INPUT -s " + node_b + " -j DROP")
+        ${nodeB}.succeed("iptables -D INPUT -s " + node_a + " -j DROP")
+        ${nodeA}.systemctl("restart nebula@smoke.service")
+        ${nodeB}.systemctl("restart nebula@smoke.service")
+      '';
+    in
+    ''
+      # Create the certificate and sign the lighthouse's keys.
+      ${setUpPrivateKey "lighthouse"}
+      lighthouse.succeed(
+          "mkdir -p /etc/nebula",
+          'nebula-cert ca -name "Smoke Test" -out-crt /etc/nebula/ca.crt -out-key /etc/nebula/ca.key',
+          'nebula-cert sign -ca-crt /etc/nebula/ca.crt -ca-key /etc/nebula/ca.key -name "lighthouse" -groups "lighthouse" -ip "10.0.100.1/24" -out-crt /etc/nebula/lighthouse.crt -out-key /etc/nebula/lighthouse.key',
+          'chown -R nebula-smoke:nebula-smoke /etc/nebula'
+      )
+
+      # Reboot the lighthouse and verify that the nebula service comes up on boot.
+      # Since rebooting takes a while, we'll just restart the service on the other nodes.
+      lighthouse.shutdown()
+      lighthouse.start()
+      lighthouse.wait_for_unit("nebula@smoke.service")
+      lighthouse.succeed("ping -c5 10.0.100.1")
+
+      # Create keys for allowAny's nebula service and test that it comes up.
+      ${setUpPrivateKey "allowAny"}
+      ${signKeysFor "allowAny" "10.0.100.2/24"}
+      ${restartAndCheckNebula "allowAny" "10.0.100.2"}
+
+      # Create keys for allowFromLighthouse's nebula service and test that it comes up.
+      ${setUpPrivateKey "allowFromLighthouse"}
+      ${signKeysFor "allowFromLighthouse" "10.0.100.3/24"}
+      ${restartAndCheckNebula "allowFromLighthouse" "10.0.100.3"}
+
+      # Create keys for allowToLighthouse's nebula service and test that it comes up.
+      ${setUpPrivateKey "allowToLighthouse"}
+      ${signKeysFor "allowToLighthouse" "10.0.100.4/24"}
+      ${restartAndCheckNebula "allowToLighthouse" "10.0.100.4"}
+
+      # Create keys for disabled's nebula service and test that it does not come up.
+      ${setUpPrivateKey "disabled"}
+      ${signKeysFor "disabled" "10.0.100.5/24"}
+      disabled.fail("systemctl status nebula@smoke.service")
+      disabled.fail("ping -c5 10.0.100.5")
+
+      # The lighthouse can ping allowAny and allowFromLighthouse but not disabled
+      lighthouse.succeed("ping -c3 10.0.100.2")
+      lighthouse.succeed("ping -c3 10.0.100.3")
+      lighthouse.fail("ping -c3 10.0.100.5")
+
+      # allowAny can ping the lighthouse, but not allowFromLighthouse because of its inbound firewall
+      allowAny.succeed("ping -c3 10.0.100.1")
+      allowAny.fail("ping -c3 10.0.100.3")
+      # allowAny can also resolve DNS on lighthouse
+      allowAny.succeed("dig @10.0.100.1 allowToLighthouse | grep -E 'allowToLighthouse\.\s+[0-9]+\s+IN\s+A\s+10\.0\.100\.4'")
+
+      # allowFromLighthouse can ping the lighthouse and allowAny
+      allowFromLighthouse.succeed("ping -c3 10.0.100.1")
+      allowFromLighthouse.succeed("ping -c3 10.0.100.2")
+
+      # block allowFromLighthouse <-> allowAny, and allowFromLighthouse -> allowAny should still work.
+      ${blockTrafficBetween "allowFromLighthouse" "allowAny"}
+      allowFromLighthouse.succeed("ping -c10 10.0.100.2")
+      ${allowTrafficBetween "allowFromLighthouse" "allowAny"}
+      allowFromLighthouse.succeed("ping -c10 10.0.100.2")
+
+      # allowToLighthouse can ping the lighthouse but not allowAny or allowFromLighthouse
+      allowToLighthouse.succeed("ping -c3 10.0.100.1")
+      allowToLighthouse.fail("ping -c3 10.0.100.2")
+      allowToLighthouse.fail("ping -c3 10.0.100.3")
+
+      # allowAny can ping allowFromLighthouse now that allowFromLighthouse pinged it first
+      allowAny.succeed("ping -c3 10.0.100.3")
+
+      # block allowAny <-> allowFromLighthouse, and allowAny -> allowFromLighthouse should still work.
+      ${blockTrafficBetween "allowAny" "allowFromLighthouse"}
+      allowFromLighthouse.succeed("ping -c10 10.0.100.2")
+      allowAny.succeed("ping -c10 10.0.100.3")
+      ${allowTrafficBetween "allowAny" "allowFromLighthouse"}
+      allowFromLighthouse.succeed("ping -c10 10.0.100.2")
+      allowAny.succeed("ping -c10 10.0.100.3")
+
+      # allowToLighthouse can ping allowAny if allowAny pings it first
+      allowAny.succeed("ping -c3 10.0.100.4")
+      allowToLighthouse.succeed("ping -c3 10.0.100.2")
+
+      # block allowToLighthouse <-> allowAny, and allowAny <-> allowToLighthouse should still work.
+      ${blockTrafficBetween "allowAny" "allowToLighthouse"}
+      allowAny.succeed("ping -c10 10.0.100.4")
+      allowToLighthouse.succeed("ping -c10 10.0.100.2")
+      ${allowTrafficBetween "allowAny" "allowToLighthouse"}
+      allowAny.succeed("ping -c10 10.0.100.4")
+      allowToLighthouse.succeed("ping -c10 10.0.100.2")
+
+      # block lighthouse <-> allowFromLighthouse and allowAny <-> allowFromLighthouse; allowFromLighthouse won't get to allowAny
+      ${blockTrafficBetween "allowFromLighthouse" "lighthouse"}
+      ${blockTrafficBetween "allowFromLighthouse" "allowAny"}
+      allowFromLighthouse.fail("ping -c3 10.0.100.2")
+      ${allowTrafficBetween "allowFromLighthouse" "lighthouse"}
+      ${allowTrafficBetween "allowFromLighthouse" "allowAny"}
+      allowFromLighthouse.succeed("ping -c3 10.0.100.2")
+
+      # block lighthouse <-> allowAny, allowAny <-> allowFromLighthouse, and allowAny <-> allowToLighthouse; it won't get to allowFromLighthouse or allowToLighthouse
+      ${blockTrafficBetween "allowAny" "lighthouse"}
+      ${blockTrafficBetween "allowAny" "allowFromLighthouse"}
+      ${blockTrafficBetween "allowAny" "allowToLighthouse"}
+      allowFromLighthouse.fail("ping -c3 10.0.100.2")
+      allowAny.fail("ping -c3 10.0.100.3")
+      allowAny.fail("ping -c3 10.0.100.4")
+      ${allowTrafficBetween "allowAny" "lighthouse"}
+      ${allowTrafficBetween "allowAny" "allowFromLighthouse"}
+      ${allowTrafficBetween "allowAny" "allowToLighthouse"}
+      allowFromLighthouse.succeed("ping -c3 10.0.100.2")
+      allowAny.succeed("ping -c3 10.0.100.3")
+      allowAny.succeed("ping -c3 10.0.100.4")
+
+      # block lighthouse <-> allowToLighthouse and allowToLighthouse <-> allowAny; it won't get to allowAny
+      ${blockTrafficBetween "allowToLighthouse" "lighthouse"}
+      ${blockTrafficBetween "allowToLighthouse" "allowAny"}
+      allowAny.fail("ping -c3 10.0.100.4")
+      allowToLighthouse.fail("ping -c3 10.0.100.2")
+      ${allowTrafficBetween "allowToLighthouse" "lighthouse"}
+      ${allowTrafficBetween "allowToLighthouse" "allowAny"}
+      allowAny.succeed("ping -c3 10.0.100.4")
+      allowToLighthouse.succeed("ping -c3 10.0.100.2")
+    '';
+}
diff --git a/nixos/tests/netbird.nix b/nixos/tests/netbird.nix
index f684a3104265..581c6eeeab2e 100644
--- a/nixos/tests/netbird.nix
+++ b/nixos/tests/netbird.nix
@@ -1,59 +1,57 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "netbird";
+{ pkgs, lib, ... }:
+{
+  name = "netbird";
 
-    meta.maintainers = with pkgs.lib.maintainers; [
-      nazarewk
-    ];
+  meta.maintainers = with pkgs.lib.maintainers; [
+    nazarewk
+  ];
 
-    nodes = {
-      clients =
-        { ... }:
-        {
-          services.netbird.enable = true;
-          services.netbird.clients.custom.port = 51819;
-        };
-    };
+  nodes = {
+    clients =
+      { ... }:
+      {
+        services.netbird.enable = true;
+        services.netbird.clients.custom.port = 51819;
+      };
+  };
 
-    # TODO: confirm the whole solution is working end-to-end when netbird server is implemented
-    testScript = ''
-      start_all()
-      def did_start(node, name):
-        node.wait_for_unit(f"{name}.service")
-        node.wait_for_file(f"/var/run/{name}/sock")
-        output = node.succeed(f"{name} status")
+  # TODO: confirm the whole solution is working end-to-end when netbird server is implemented
+  testScript = ''
+    start_all()
+    def did_start(node, name):
+      node.wait_for_unit(f"{name}.service")
+      node.wait_for_file(f"/var/run/{name}/sock")
+      output = node.succeed(f"{name} status")
 
-        # not sure why, but it can print either of:
-        #  - Daemon status: NeedsLogin
-        #  - Management: Disconnected
-        expected = [
-          "Disconnected",
-          "NeedsLogin",
-        ]
-        assert any(msg in output for msg in expected)
+      # not sure why, but it can print either of:
+      #  - Daemon status: NeedsLogin
+      #  - Management: Disconnected
+      expected = [
+        "Disconnected",
+        "NeedsLogin",
+      ]
+      assert any(msg in output for msg in expected)
 
-      did_start(clients, "netbird")
-      did_start(clients, "netbird-custom")
-    '';
+    did_start(clients, "netbird")
+    did_start(clients, "netbird-custom")
+  '';
 
-    /*
-      `netbird status` used to print `Daemon status: NeedsLogin`
-          https://github.com/netbirdio/netbird/blob/23a14737974e3849fa86408d136cc46db8a885d0/client/cmd/status.go#L154-L164
-      as the first line, but now it is just:
+  /*
+    `netbird status` used to print `Daemon status: NeedsLogin`
+        https://github.com/netbirdio/netbird/blob/23a14737974e3849fa86408d136cc46db8a885d0/client/cmd/status.go#L154-L164
+    as the first line, but now it is just:
 
-          Daemon version: 0.26.3
-          CLI version: 0.26.3
-          Management: Disconnected
-          Signal: Disconnected
-          Relays: 0/0 Available
-          Nameservers: 0/0 Available
-          FQDN:
-          NetBird IP: N/A
-          Interface type: N/A
-          Quantum resistance: false
-          Routes: -
-          Peers count: 0/0 Connected
-    */
-  }
-)
+        Daemon version: 0.26.3
+        CLI version: 0.26.3
+        Management: Disconnected
+        Signal: Disconnected
+        Relays: 0/0 Available
+        Nameservers: 0/0 Available
+        FQDN:
+        NetBird IP: N/A
+        Interface type: N/A
+        Quantum resistance: false
+        Routes: -
+        Peers count: 0/0 Connected
+  */
+}
diff --git a/nixos/tests/netdata.nix b/nixos/tests/netdata.nix
index 77c34e70e7d0..2a85c11f0542 100644
--- a/nixos/tests/netdata.nix
+++ b/nixos/tests/netdata.nix
@@ -1,57 +1,55 @@
 # This test runs netdata and checks for data via apps.plugin
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "netdata";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        cransom
-        raitobezarius
-      ];
-    };
+{ pkgs, ... }:
+{
+  name = "netdata";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      cransom
+      raitobezarius
+    ];
+  };
 
-    nodes = {
-      netdata =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = with pkgs; [
-            curl
-            jq
-            netdata
-          ];
-          services.netdata = {
-            enable = true;
-            package = pkgs.netdataCloud;
-            python.recommendedPythonPackages = true;
+  nodes = {
+    netdata =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [
+          curl
+          jq
+          netdata
+        ];
+        services.netdata = {
+          enable = true;
+          package = pkgs.netdataCloud;
+          python.recommendedPythonPackages = true;
 
-            configDir."apps_groups.conf" = pkgs.writeText "apps_groups.conf" ''
-              netdata_test: netdata
-            '';
-          };
+          configDir."apps_groups.conf" = pkgs.writeText "apps_groups.conf" ''
+            netdata_test: netdata
+          '';
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      netdata.wait_for_unit("netdata.service")
+    netdata.wait_for_unit("netdata.service")
 
-      # wait for the service to listen before sending a request
-      netdata.wait_for_open_port(19999)
+    # wait for the service to listen before sending a request
+    netdata.wait_for_open_port(19999)
 
-      # check if the netdata main page loads.
-      netdata.succeed("curl --fail http://127.0.0.1:19999")
-      netdata.succeed("sleep 4")
+    # check if the netdata main page loads.
+    netdata.succeed("curl --fail http://127.0.0.1:19999")
+    netdata.succeed("sleep 4")
 
-      # check if netdata api shows correct os
-      url = "http://127.0.0.1:19999/api/v3/info"
-      filter = '.agents[0].application.os.os | . == "NixOS"'
-      cmd = f"curl -s {url} | jq -e '{filter}'"
-      netdata.wait_until_succeeds(cmd)
+    # check if netdata api shows correct os
+    url = "http://127.0.0.1:19999/api/v3/info"
+    filter = '.agents[0].application.os.os | . == "NixOS"'
+    cmd = f"curl -s {url} | jq -e '{filter}'"
+    netdata.wait_until_succeeds(cmd)
 
-      # check if the control socket is available
-      netdata.succeed("sudo netdatacli ping")
-    '';
-  }
-)
+    # check if the control socket is available
+    netdata.succeed("sudo netdatacli ping")
+  '';
+}
diff --git a/nixos/tests/networking-proxy.nix b/nixos/tests/networking-proxy.nix
index 4592bffec9e3..c20dd297328f 100644
--- a/nixos/tests/networking-proxy.nix
+++ b/nixos/tests/networking-proxy.nix
@@ -11,130 +11,128 @@ let
 
   };
 in
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "networking-proxy";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
-    };
+{ pkgs, ... }:
+{
+  name = "networking-proxy";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
 
-    nodes = {
-      # no proxy
-      machine =
-        { ... }:
+  nodes = {
+    # no proxy
+    machine =
+      { ... }:
 
-        default-config;
+      default-config;
 
-      # proxy default
-      machine2 =
-        { ... }:
+    # proxy default
+    machine2 =
+      { ... }:
 
-        default-config
-        // {
-          networking.proxy.default = "http://user:pass@host:port";
+      default-config
+      // {
+        networking.proxy.default = "http://user:pass@host:port";
+      };
+
+    # specific proxy options
+    machine3 =
+      { ... }:
+
+      default-config
+      // {
+        networking.proxy = {
+          # useless because overridden by the next options
+          default = "http://user:pass@host:port";
+          # advanced proxy setup
+          httpProxy = "123-http://user:pass@http-host:port";
+          httpsProxy = "456-http://user:pass@https-host:port";
+          rsyncProxy = "789-http://user:pass@rsync-host:port";
+          ftpProxy = "101112-http://user:pass@ftp-host:port";
+          noProxy = "131415-127.0.0.1,localhost,.localdomain";
         };
+      };
 
-      # specific proxy options
-      machine3 =
-        { ... }:
+    # mix default + proxy options
+    machine4 =
+      { ... }:
 
-        default-config
-        // {
-          networking.proxy = {
-            # useless because overridden by the next options
-            default = "http://user:pass@host:port";
-            # advanced proxy setup
-            httpProxy = "123-http://user:pass@http-host:port";
-            httpsProxy = "456-http://user:pass@https-host:port";
-            rsyncProxy = "789-http://user:pass@rsync-host:port";
-            ftpProxy = "101112-http://user:pass@ftp-host:port";
-            noProxy = "131415-127.0.0.1,localhost,.localdomain";
-          };
+      default-config
+      // {
+        networking.proxy = {
+          # open for all *_proxy env var
+          default = "000-http://user:pass@default-host:port";
+          # except for those 2
+          rsyncProxy = "123-http://user:pass@http-host:port";
+          noProxy = "131415-127.0.0.1,localhost,.localdomain";
         };
+      };
+  };
 
-      # mix default + proxy options
-      machine4 =
-        { ... }:
-
-        default-config
-        // {
-          networking.proxy = {
-            # open for all *_proxy env var
-            default = "000-http://user:pass@default-host:port";
-            # except for those 2
-            rsyncProxy = "123-http://user:pass@http-host:port";
-            noProxy = "131415-127.0.0.1,localhost,.localdomain";
-          };
-        };
-    };
-
-    testScript = ''
-      from typing import Dict, Optional
+  testScript = ''
+    from typing import Dict, Optional
 
 
-      def get_machine_env(machine: Machine, user: Optional[str] = None) -> Dict[str, str]:
-          """
-          Gets the environment from a given machine, and returns it as a
-          dictionary in the form:
-              {"lowercase_var_name": "value"}
+    def get_machine_env(machine: Machine, user: Optional[str] = None) -> Dict[str, str]:
+        """
+        Gets the environment from a given machine, and returns it as a
+        dictionary in the form:
+            {"lowercase_var_name": "value"}
 
-          Duplicate environment variables with the same name
-          (e.g. "foo" and "FOO") are handled in an undefined manner.
-          """
-          if user is not None:
-              env = machine.succeed("su - {} -c 'env -0'".format(user))
-          else:
-              env = machine.succeed("env -0")
-          ret = {}
-          for line in env.split("\0"):
-              if "=" not in line:
-                  continue
+        Duplicate environment variables with the same name
+        (e.g. "foo" and "FOO") are handled in an undefined manner.
+        """
+        if user is not None:
+            env = machine.succeed("su - {} -c 'env -0'".format(user))
+        else:
+            env = machine.succeed("env -0")
+        ret = {}
+        for line in env.split("\0"):
+            if "=" not in line:
+                continue
 
-              key, val = line.split("=", 1)
-              ret[key.lower()] = val
-          return ret
+            key, val = line.split("=", 1)
+            ret[key.lower()] = val
+        return ret
 
 
-      start_all()
+    start_all()
 
-      with subtest("no proxy"):
-          assert "proxy" not in machine.succeed("env").lower()
-          assert "proxy" not in machine.succeed("su - alice -c env").lower()
+    with subtest("no proxy"):
+        assert "proxy" not in machine.succeed("env").lower()
+        assert "proxy" not in machine.succeed("su - alice -c env").lower()
 
-      with subtest("default proxy"):
-          assert "proxy" in machine2.succeed("env").lower()
-          assert "proxy" in machine2.succeed("su - alice -c env").lower()
+    with subtest("default proxy"):
+        assert "proxy" in machine2.succeed("env").lower()
+        assert "proxy" in machine2.succeed("su - alice -c env").lower()
 
-      with subtest("explicitly-set proxy"):
-          env = get_machine_env(machine3)
-          assert "123" in env["http_proxy"]
-          assert "456" in env["https_proxy"]
-          assert "789" in env["rsync_proxy"]
-          assert "101112" in env["ftp_proxy"]
-          assert "131415" in env["no_proxy"]
+    with subtest("explicitly-set proxy"):
+        env = get_machine_env(machine3)
+        assert "123" in env["http_proxy"]
+        assert "456" in env["https_proxy"]
+        assert "789" in env["rsync_proxy"]
+        assert "101112" in env["ftp_proxy"]
+        assert "131415" in env["no_proxy"]
 
-          env = get_machine_env(machine3, "alice")
-          assert "123" in env["http_proxy"]
-          assert "456" in env["https_proxy"]
-          assert "789" in env["rsync_proxy"]
-          assert "101112" in env["ftp_proxy"]
-          assert "131415" in env["no_proxy"]
+        env = get_machine_env(machine3, "alice")
+        assert "123" in env["http_proxy"]
+        assert "456" in env["https_proxy"]
+        assert "789" in env["rsync_proxy"]
+        assert "101112" in env["ftp_proxy"]
+        assert "131415" in env["no_proxy"]
 
-      with subtest("default proxy + some other specifics"):
-          env = get_machine_env(machine4)
-          assert "000" in env["http_proxy"]
-          assert "000" in env["https_proxy"]
-          assert "123" in env["rsync_proxy"]
-          assert "000" in env["ftp_proxy"]
-          assert "131415" in env["no_proxy"]
+    with subtest("default proxy + some other specifics"):
+        env = get_machine_env(machine4)
+        assert "000" in env["http_proxy"]
+        assert "000" in env["https_proxy"]
+        assert "123" in env["rsync_proxy"]
+        assert "000" in env["ftp_proxy"]
+        assert "131415" in env["no_proxy"]
 
-          env = get_machine_env(machine4, "alice")
-          assert "000" in env["http_proxy"]
-          assert "000" in env["https_proxy"]
-          assert "123" in env["rsync_proxy"]
-          assert "000" in env["ftp_proxy"]
-          assert "131415" in env["no_proxy"]
-    '';
-  }
-)
+        env = get_machine_env(machine4, "alice")
+        assert "000" in env["http_proxy"]
+        assert "000" in env["https_proxy"]
+        assert "123" in env["rsync_proxy"]
+        assert "000" in env["ftp_proxy"]
+        assert "131415" in env["no_proxy"]
+  '';
+}
diff --git a/nixos/tests/nexus.nix b/nixos/tests/nexus.nix
index 9c3e65daf317..d8cad38500ed 100644
--- a/nixos/tests/nexus.nix
+++ b/nixos/tests/nexus.nix
@@ -3,34 +3,32 @@
 #   2. nexus service can startup on server (creating database and all other initial stuff)
 #   3. the web application is reachable via HTTP
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nexus";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ironpinguin ];
-    };
+{ pkgs, ... }:
+{
+  name = "nexus";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ironpinguin ];
+  };
 
-    nodes = {
+  nodes = {
 
-      server =
-        { ... }:
-        {
-          virtualisation.memorySize = 2047; # qemu-system-i386 has a 2047M limit
-          virtualisation.diskSize = 8192;
+    server =
+      { ... }:
+      {
+        virtualisation.memorySize = 2047; # qemu-system-i386 has a 2047M limit
+        virtualisation.diskSize = 8192;
 
-          services.nexus.enable = true;
-        };
+        services.nexus.enable = true;
+      };
 
-    };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      server.wait_for_unit("nexus")
-      server.wait_for_open_port(8081)
+    server.wait_for_unit("nexus")
+    server.wait_for_open_port(8081)
 
-      server.succeed("curl -f 127.0.0.1:8081")
-    '';
-  }
-)
+    server.succeed("curl -f 127.0.0.1:8081")
+  '';
+}
diff --git a/nixos/tests/nghttpx.nix b/nixos/tests/nghttpx.nix
index 15acb81b12c1..a9f5cf112e2d 100644
--- a/nixos/tests/nghttpx.nix
+++ b/nixos/tests/nghttpx.nix
@@ -1,66 +1,64 @@
 let
   nginxRoot = "/run/nginx";
 in
-import ./make-test-python.nix (
-  { ... }:
-  {
-    name = "nghttpx";
-    nodes = {
-      webserver = {
-        networking.firewall.allowedTCPPorts = [ 80 ];
-        systemd.services.nginx = {
-          preStart = ''
-            mkdir -p ${nginxRoot}
-            echo "Hello world!" > ${nginxRoot}/hello-world.txt
-          '';
-        };
-
-        services.nginx = {
-          enable = true;
-          virtualHosts.server = {
-            locations."/".root = nginxRoot;
-          };
-        };
+{ ... }:
+{
+  name = "nghttpx";
+  nodes = {
+    webserver = {
+      networking.firewall.allowedTCPPorts = [ 80 ];
+      systemd.services.nginx = {
+        preStart = ''
+          mkdir -p ${nginxRoot}
+          echo "Hello world!" > ${nginxRoot}/hello-world.txt
+        '';
       };
 
-      proxy = {
-        networking.firewall.allowedTCPPorts = [ 80 ];
-        services.nghttpx = {
-          enable = true;
-          frontends = [
-            {
-              server = {
-                host = "*";
-                port = 80;
-              };
-
-              params = {
-                tls = "no-tls";
-              };
-            }
-          ];
-          backends = [
-            {
-              server = {
-                host = "webserver";
-                port = 80;
-              };
-              patterns = [ "/" ];
-              params.proto = "http/1.1";
-            }
-          ];
+      services.nginx = {
+        enable = true;
+        virtualHosts.server = {
+          locations."/".root = nginxRoot;
         };
       };
-
-      client = { };
     };
 
-    testScript = ''
-      start_all()
+    proxy = {
+      networking.firewall.allowedTCPPorts = [ 80 ];
+      services.nghttpx = {
+        enable = true;
+        frontends = [
+          {
+            server = {
+              host = "*";
+              port = 80;
+            };
 
-      webserver.wait_for_open_port(80)
-      proxy.wait_for_open_port(80)
-      client.wait_until_succeeds("curl -s --fail http://proxy/hello-world.txt")
-    '';
-  }
-)
+            params = {
+              tls = "no-tls";
+            };
+          }
+        ];
+        backends = [
+          {
+            server = {
+              host = "webserver";
+              port = 80;
+            };
+            patterns = [ "/" ];
+            params.proto = "http/1.1";
+          }
+        ];
+      };
+    };
+
+    client = { };
+  };
+
+  testScript = ''
+    start_all()
+
+    webserver.wait_for_open_port(80)
+    proxy.wait_for_open_port(80)
+    client.wait_until_succeeds("curl -s --fail http://proxy/hello-world.txt")
+  '';
+}
diff --git a/nixos/tests/nginx-njs.nix b/nixos/tests/nginx-njs.nix
index 7e9e911ee02f..a64bbad08e10 100644
--- a/nixos/tests/nginx-njs.nix
+++ b/nixos/tests/nginx-njs.nix
@@ -1,37 +1,35 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "nginx-njs";
+{ pkgs, lib, ... }:
+{
+  name = "nginx-njs";
 
-    nodes.machine =
-      {
-        config,
-        lib,
-        pkgs,
-        ...
-      }:
-      {
-        services.nginx = {
-          enable = true;
-          additionalModules = [ pkgs.nginxModules.njs ];
-          commonHttpConfig = ''
-            js_import http from ${builtins.toFile "http.js" ''
-              function hello(r) {
-                  r.return(200, "Hello world!");
-              }
-              export default {hello};
-            ''};
-          '';
-          virtualHosts."localhost".locations."/".extraConfig = ''
-            js_content http.hello;
-          '';
-        };
+  nodes.machine =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      services.nginx = {
+        enable = true;
+        additionalModules = [ pkgs.nginxModules.njs ];
+        commonHttpConfig = ''
+          js_import http from ${builtins.toFile "http.js" ''
+            function hello(r) {
+                r.return(200, "Hello world!");
+            }
+            export default {hello};
+          ''};
+        '';
+        virtualHosts."localhost".locations."/".extraConfig = ''
+          js_content http.hello;
+        '';
       };
-    testScript = ''
-      machine.wait_for_unit("nginx")
+    };
+  testScript = ''
+    machine.wait_for_unit("nginx")
 
-      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1/")
-      assert "Hello world!" == response, f"Expected 'Hello world!', got '{response}'"
-    '';
-  }
-)
+    response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1/")
+    assert "Hello world!" == response, f"Expected 'Hello world!', got '{response}'"
+  '';
+}
diff --git a/nixos/tests/nimdow.nix b/nixos/tests/nimdow.nix
index d71fcf35acd8..7d1d815bcd13 100644
--- a/nixos/tests/nimdow.nix
+++ b/nixos/tests/nimdow.nix
@@ -1,35 +1,33 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nimdow";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ marcusramberg ];
+{ pkgs, ... }:
+{
+  name = "nimdow";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ marcusramberg ];
+  };
+
+  nodes.machine =
+    { lib, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+        ./common/user-account.nix
+      ];
+      test-support.displayManager.auto.user = "alice";
+      services.displayManager.defaultSession = lib.mkForce "none+nimdow";
+      services.xserver.windowManager.nimdow.enable = true;
     };
 
-    nodes.machine =
-      { lib, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-          ./common/user-account.nix
-        ];
-        test-support.displayManager.auto.user = "alice";
-        services.displayManager.defaultSession = lib.mkForce "none+nimdow";
-        services.xserver.windowManager.nimdow.enable = true;
-      };
+  testScript =
+    { ... }:
+    ''
+      with subtest("ensure x starts"):
+          machine.wait_for_x()
+          machine.wait_for_file("/home/alice/.Xauthority")
+          machine.succeed("xauth merge ~alice/.Xauthority")
 
-    testScript =
-      { ... }:
-      ''
-        with subtest("ensure x starts"):
-            machine.wait_for_x()
-            machine.wait_for_file("/home/alice/.Xauthority")
-            machine.succeed("xauth merge ~alice/.Xauthority")
-
-        with subtest("ensure we can open a new terminal"):
-            machine.send_key("meta_l-ret")
-            machine.wait_for_window(r"alice.*?machine")
-            machine.screenshot("terminal")
-      '';
-  }
-)
+      with subtest("ensure we can open a new terminal"):
+          machine.send_key("meta_l-ret")
+          machine.wait_for_window(r"alice.*?machine")
+          machine.screenshot("terminal")
+    '';
+}
diff --git a/nixos/tests/nitter.nix b/nixos/tests/nitter.nix
index 3b063c9f19ae..4678652927e5 100644
--- a/nixos/tests/nitter.nix
+++ b/nixos/tests/nitter.nix
@@ -1,35 +1,33 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    # In a real deployment this should naturally not common from the nix store
-    # and be seeded via agenix or as a non-nix managed file.
-    #
-    # These credentials are from the nitter wiki and are expired. We must provide
-    # credentials in the correct format, otherwise nitter fails to start. They
-    # must not be valid, as unauthorized errors are handled gracefully.
-    sessionsFile = pkgs.writeText "sessions.jsonl" ''
-      {"oauth_token":"1719213587296620928-BsXY2RIJEw7fjxoNwbBemgjJhueK0m","oauth_token_secret":"N0WB0xhL4ng6WTN44aZO82SUJjz7ssI3hHez2CUhTiYqy"}
-    '';
-  in
-  {
-    name = "nitter";
-    meta.maintainers = with pkgs.lib.maintainers; [ erdnaxe ];
+let
+  # In a real deployment this should naturally not common from the nix store
+  # and be seeded via agenix or as a non-nix managed file.
+  #
+  # These credentials are from the nitter wiki and are expired. We must provide
+  # credentials in the correct format, otherwise nitter fails to start. They
+  # must not be valid, as unauthorized errors are handled gracefully.
+  sessionsFile = pkgs.writeText "sessions.jsonl" ''
+    {"oauth_token":"1719213587296620928-BsXY2RIJEw7fjxoNwbBemgjJhueK0m","oauth_token_secret":"N0WB0xhL4ng6WTN44aZO82SUJjz7ssI3hHez2CUhTiYqy"}
+  '';
+in
+{
+  name = "nitter";
+  meta.maintainers = with pkgs.lib.maintainers; [ erdnaxe ];
 
-    nodes.machine = {
-      services.nitter = {
-        enable = true;
-        # Test CAP_NET_BIND_SERVICE
-        server.port = 80;
-        # Provide dummy guest accounts
-        inherit sessionsFile;
-      };
+  nodes.machine = {
+    services.nitter = {
+      enable = true;
+      # Test CAP_NET_BIND_SERVICE
+      server.port = 80;
+      # Provide dummy guest accounts
+      inherit sessionsFile;
     };
+  };
 
-    testScript = ''
-      machine.wait_for_unit("nitter.service")
-      machine.wait_for_open_port(80)
-      machine.succeed("curl --fail http://localhost:80/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("nitter.service")
+    machine.wait_for_open_port(80)
+    machine.succeed("curl --fail http://localhost:80/")
+  '';
+}
diff --git a/nixos/tests/nix-config.nix b/nixos/tests/nix-config.nix
index 18fa3ae347aa..b39baf3f6b50 100644
--- a/nixos/tests/nix-config.nix
+++ b/nixos/tests/nix-config.nix
@@ -1,22 +1,20 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nix-config";
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        nix.settings = {
-          nix-path = [ "nonextra=/etc/value.nix" ];
-          extra-nix-path = [ "extra=/etc/value.nix" ];
-        };
-        environment.etc."value.nix".text = "42";
+{ pkgs, ... }:
+{
+  name = "nix-config";
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      nix.settings = {
+        nix-path = [ "nonextra=/etc/value.nix" ];
+        extra-nix-path = [ "extra=/etc/value.nix" ];
       };
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("nix-daemon.socket")
-      # regression test for the workaround for https://github.com/NixOS/nix/issues/9487
-      print(machine.succeed("nix-instantiate --find-file extra"))
-      print(machine.succeed("nix-instantiate --find-file nonextra"))
-    '';
-  }
-)
+      environment.etc."value.nix".text = "42";
+    };
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("nix-daemon.socket")
+    # regression test for the workaround for https://github.com/NixOS/nix/issues/9487
+    print(machine.succeed("nix-instantiate --find-file extra"))
+    print(machine.succeed("nix-instantiate --find-file nonextra"))
+  '';
+}
diff --git a/nixos/tests/nix-serve-ssh.nix b/nixos/tests/nix-serve-ssh.nix
index 554ea5a69f20..e5b3adc37b3a 100644
--- a/nixos/tests/nix-serve-ssh.nix
+++ b/nixos/tests/nix-serve-ssh.nix
@@ -1,50 +1,48 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    inherit (import ./ssh-keys.nix pkgs)
-      snakeOilPrivateKey
-      snakeOilPublicKey
-      ;
-    ssh-config = builtins.toFile "ssh.conf" ''
-      UserKnownHostsFile=/dev/null
-      StrictHostKeyChecking=no
-    '';
-  in
-  {
-    name = "nix-ssh-serve";
-    meta.maintainers = [ lib.maintainers.shlevy ];
-    nodes = {
-      server.nix.sshServe = {
-        enable = true;
-        keys = [ snakeOilPublicKey ];
-        protocol = "ssh-ng";
-      };
-      server.nix.package = pkgs.nix;
-      client.nix.package = pkgs.nix;
+{ pkgs, lib, ... }:
+let
+  inherit (import ./ssh-keys.nix pkgs)
+    snakeOilPrivateKey
+    snakeOilPublicKey
+    ;
+  ssh-config = builtins.toFile "ssh.conf" ''
+    UserKnownHostsFile=/dev/null
+    StrictHostKeyChecking=no
+  '';
+in
+{
+  name = "nix-ssh-serve";
+  meta.maintainers = [ lib.maintainers.shlevy ];
+  nodes = {
+    server.nix.sshServe = {
+      enable = true;
+      keys = [ snakeOilPublicKey ];
+      protocol = "ssh-ng";
     };
-    testScript = ''
-      start_all()
+    server.nix.package = pkgs.nix;
+    client.nix.package = pkgs.nix;
+  };
+  testScript = ''
+    start_all()
 
-      client.succeed("mkdir -m 700 /root/.ssh")
-      client.succeed(
-          "cat ${ssh-config} > /root/.ssh/config"
-      )
-      client.succeed(
-          "cat ${snakeOilPrivateKey} > /root/.ssh/id_ecdsa"
-      )
-      client.succeed("chmod 600 /root/.ssh/id_ecdsa")
+    client.succeed("mkdir -m 700 /root/.ssh")
+    client.succeed(
+        "cat ${ssh-config} > /root/.ssh/config"
+    )
+    client.succeed(
+        "cat ${snakeOilPrivateKey} > /root/.ssh/id_ecdsa"
+    )
+    client.succeed("chmod 600 /root/.ssh/id_ecdsa")
 
-      client.succeed("nix-store --add /etc/machine-id > mach-id-path")
+    client.succeed("nix-store --add /etc/machine-id > mach-id-path")
 
-      server.wait_for_unit("sshd")
+    server.wait_for_unit("sshd")
 
-      client.fail("diff /root/other-store$(cat mach-id-path) /etc/machine-id")
-      # Currently due to shared store this is a noop :(
-      client.succeed("nix copy --experimental-features 'nix-command' --to ssh-ng://nix-ssh@server $(cat mach-id-path)")
-      client.succeed(
-          "nix-store --realise $(cat mach-id-path) --store /root/other-store --substituters ssh-ng://nix-ssh@server"
-      )
-      client.succeed("diff /root/other-store$(cat mach-id-path) /etc/machine-id")
-    '';
-  }
-)
+    client.fail("diff /root/other-store$(cat mach-id-path) /etc/machine-id")
+    # Currently due to shared store this is a noop :(
+    client.succeed("nix copy --experimental-features 'nix-command' --to ssh-ng://nix-ssh@server $(cat mach-id-path)")
+    client.succeed(
+        "nix-store --realise $(cat mach-id-path) --store /root/other-store --substituters ssh-ng://nix-ssh@server"
+    )
+    client.succeed("diff /root/other-store$(cat mach-id-path) /etc/machine-id")
+  '';
+}
diff --git a/nixos/tests/nixos-generate-config.nix b/nixos/tests/nixos-generate-config.nix
index d9b2f502365e..c887403bbda3 100644
--- a/nixos/tests/nixos-generate-config.nix
+++ b/nixos/tests/nixos-generate-config.nix
@@ -1,52 +1,50 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "nixos-generate-config";
-    meta.maintainers = with lib.maintainers; [ basvandijk ];
-    nodes.machine = {
-      system.nixos-generate-config.configuration = ''
-        # OVERRIDDEN
-        { config, pkgs, ... }: {
-          imports = [ ./hardware-configuration.nix ];
-        $bootLoaderConfig
-        $desktopConfiguration
-        }
-      '';
-
-      system.nixos-generate-config.desktopConfiguration = [
-        ''
-          # DESKTOP
-          services.xserver.displayManager.gdm.enable = true;
-          services.xserver.desktopManager.gnome.enable = true;
-        ''
-      ];
-    };
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("nixos-generate-config")
-
-      machine.succeed("nix-instantiate --parse /etc/nixos/configuration.nix /etc/nixos/hardware-configuration.nix")
-
-      # Test if the configuration really is overridden
-      machine.succeed("grep 'OVERRIDDEN' /etc/nixos/configuration.nix")
-
-      # Test if desktop configuration really is overridden
-      machine.succeed("grep 'DESKTOP' /etc/nixos/configuration.nix")
-
-      # Test of if the Perl variable $bootLoaderConfig is spliced correctly:
-      machine.succeed(
-          "grep 'boot\\.loader\\.grub\\.enable = true;' /etc/nixos/configuration.nix"
-      )
-
-      # Test if the Perl variable $desktopConfiguration is spliced correctly
-      machine.succeed(
-          "grep 'services\\.xserver\\.desktopManager\\.gnome\\.enable = true;' /etc/nixos/configuration.nix"
-      )
-
-      machine.succeed("rm -rf /etc/nixos")
-      machine.succeed("nixos-generate-config --flake")
-      machine.succeed("nix-instantiate --parse /etc/nixos/flake.nix /etc/nixos/configuration.nix /etc/nixos/hardware-configuration.nix")
+{ lib, ... }:
+{
+  name = "nixos-generate-config";
+  meta.maintainers = with lib.maintainers; [ basvandijk ];
+  nodes.machine = {
+    system.nixos-generate-config.configuration = ''
+      # OVERRIDDEN
+      { config, pkgs, ... }: {
+        imports = [ ./hardware-configuration.nix ];
+      $bootLoaderConfig
+      $desktopConfiguration
+      }
     '';
-  }
-)
+
+    system.nixos-generate-config.desktopConfiguration = [
+      ''
+        # DESKTOP
+        services.displayManager.gdm.enable = true;
+        services.desktopManager.gnome.enable = true;
+      ''
+    ];
+  };
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("nixos-generate-config")
+
+    machine.succeed("nix-instantiate --parse /etc/nixos/configuration.nix /etc/nixos/hardware-configuration.nix")
+
+    # Test if the configuration really is overridden
+    machine.succeed("grep 'OVERRIDDEN' /etc/nixos/configuration.nix")
+
+    # Test if desktop configuration really is overridden
+    machine.succeed("grep 'DESKTOP' /etc/nixos/configuration.nix")
+
+    # Test of if the Perl variable $bootLoaderConfig is spliced correctly:
+    machine.succeed(
+        "grep 'boot\\.loader\\.grub\\.enable = true;' /etc/nixos/configuration.nix"
+    )
+
+    # Test if the Perl variable $desktopConfiguration is spliced correctly
+    machine.succeed(
+        "grep 'services\\.desktopManager\\.gnome\\.enable = true;' /etc/nixos/configuration.nix"
+    )
+
+    machine.succeed("rm -rf /etc/nixos")
+    machine.succeed("nixos-generate-config --flake")
+    machine.succeed("nix-instantiate --parse /etc/nixos/flake.nix /etc/nixos/configuration.nix /etc/nixos/hardware-configuration.nix")
+  '';
+}
diff --git a/nixos/tests/nixos-test-driver/extra-python-packages.nix b/nixos/tests/nixos-test-driver/extra-python-packages.nix
index 6c187e605591..700299c6a118 100644
--- a/nixos/tests/nixos-test-driver/extra-python-packages.nix
+++ b/nixos/tests/nixos-test-driver/extra-python-packages.nix
@@ -1,15 +1,13 @@
-import ../make-test-python.nix (
-  { ... }:
-  {
-    name = "extra-python-packages";
+{ ... }:
+{
+  name = "extra-python-packages";
 
-    extraPythonPackages = p: [ p.numpy ];
+  extraPythonPackages = p: [ p.numpy ];
 
-    nodes = { };
+  nodes = { };
 
-    testScript = ''
-      import numpy as np
-      assert str(np.zeros(4) == "array([0., 0., 0., 0.])")
-    '';
-  }
-)
+  testScript = ''
+    import numpy as np
+    assert str(np.zeros(4) == "array([0., 0., 0., 0.])")
+  '';
+}
diff --git a/nixos/tests/nixseparatedebuginfod.nix b/nixos/tests/nixseparatedebuginfod.nix
index bb9f8c9f43be..39fd6356340d 100644
--- a/nixos/tests/nixseparatedebuginfod.nix
+++ b/nixos/tests/nixseparatedebuginfod.nix
@@ -1,84 +1,82 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    secret-key = "key-name:/COlMSRbehSh6YSruJWjL+R0JXQUKuPEn96fIb+pLokEJUjcK/2Gv8Ai96D7JGay5gDeUTx5wdpPgNvum9YtwA==";
-    public-key = "key-name:BCVI3Cv9hr/AIveg+yRmsuYA3lE8ecHaT4Db7pvWLcA=";
-  in
-  {
-    name = "nixseparatedebuginfod";
-    # A binary cache with debug info and source for nix
-    nodes.cache =
-      { pkgs, ... }:
-      {
-        services.nix-serve = {
-          enable = true;
-          secretKeyFile = builtins.toFile "secret-key" secret-key;
-          openFirewall = true;
-        };
-        system.extraDependencies = [
-          pkgs.nix.debug
-          pkgs.nix.src
-          pkgs.sl
-        ];
+{ pkgs, lib, ... }:
+let
+  secret-key = "key-name:/COlMSRbehSh6YSruJWjL+R0JXQUKuPEn96fIb+pLokEJUjcK/2Gv8Ai96D7JGay5gDeUTx5wdpPgNvum9YtwA==";
+  public-key = "key-name:BCVI3Cv9hr/AIveg+yRmsuYA3lE8ecHaT4Db7pvWLcA=";
+in
+{
+  name = "nixseparatedebuginfod";
+  # A binary cache with debug info and source for nix
+  nodes.cache =
+    { pkgs, ... }:
+    {
+      services.nix-serve = {
+        enable = true;
+        secretKeyFile = builtins.toFile "secret-key" secret-key;
+        openFirewall = true;
       };
-    # the machine where we need the debuginfo
-    nodes.machine = {
-      imports = [
-        ../modules/installer/cd-dvd/channel.nix
-      ];
-      services.nixseparatedebuginfod.enable = true;
-      nix.settings = {
-        substituters = lib.mkForce [ "http://cache:5000" ];
-        trusted-public-keys = [ public-key ];
-      };
-      environment.systemPackages = [
-        pkgs.valgrind
-        pkgs.gdb
-        (pkgs.writeShellScriptBin "wait_for_indexation" ''
-          set -x
-          while debuginfod-find debuginfo /run/current-system/sw/bin/nix |& grep 'File too large'; do
-            sleep 1;
-          done
-        '')
+      system.extraDependencies = [
+        pkgs.nix.debug
+        pkgs.nix.src
+        pkgs.sl
       ];
     };
-    testScript = ''
-      start_all()
-      cache.wait_for_unit("nix-serve.service")
-      cache.wait_for_open_port(5000)
-      machine.wait_for_unit("nixseparatedebuginfod.service")
-      machine.wait_for_open_port(1949)
+  # the machine where we need the debuginfo
+  nodes.machine = {
+    imports = [
+      ../modules/installer/cd-dvd/channel.nix
+    ];
+    services.nixseparatedebuginfod.enable = true;
+    nix.settings = {
+      substituters = lib.mkForce [ "http://cache:5000" ];
+      trusted-public-keys = [ public-key ];
+    };
+    environment.systemPackages = [
+      pkgs.valgrind
+      pkgs.gdb
+      (pkgs.writeShellScriptBin "wait_for_indexation" ''
+        set -x
+        while debuginfod-find debuginfo /run/current-system/sw/bin/nix |& grep 'File too large'; do
+          sleep 1;
+        done
+      '')
+    ];
+  };
+  testScript = ''
+    start_all()
+    cache.wait_for_unit("nix-serve.service")
+    cache.wait_for_open_port(5000)
+    machine.wait_for_unit("nixseparatedebuginfod.service")
+    machine.wait_for_open_port(1949)
 
-      with subtest("show the config to debug the test"):
-        machine.succeed("nix --extra-experimental-features nix-command show-config |& logger")
-        machine.succeed("cat /etc/nix/nix.conf |& logger")
-      with subtest("check that the binary cache works"):
-        machine.succeed("nix-store -r ${pkgs.sl}")
+    with subtest("show the config to debug the test"):
+      machine.succeed("nix --extra-experimental-features nix-command show-config |& logger")
+      machine.succeed("cat /etc/nix/nix.conf |& logger")
+    with subtest("check that the binary cache works"):
+      machine.succeed("nix-store -r ${pkgs.sl}")
 
-      # nixseparatedebuginfod needs .drv to associate executable -> source
-      # on regular systems this would be provided by nixos-rebuild
-      machine.succeed("nix-instantiate '<nixpkgs>' -A nix")
+    # nixseparatedebuginfod needs .drv to associate executable -> source
+    # on regular systems this would be provided by nixos-rebuild
+    machine.succeed("nix-instantiate '<nixpkgs>' -A nix")
 
-      machine.succeed("timeout 600 wait_for_indexation")
+    machine.succeed("timeout 600 wait_for_indexation")
 
-      # test debuginfod-find
-      machine.succeed("debuginfod-find debuginfo /run/current-system/sw/bin/nix")
+    # test debuginfod-find
+    machine.succeed("debuginfod-find debuginfo /run/current-system/sw/bin/nix")
 
-      # test that gdb can fetch source
-      out = machine.succeed("gdb /run/current-system/sw/bin/nix --batch -x ${builtins.toFile "commands" ''
-        start
-        l
-      ''}")
-      print(out)
-      assert 'int main(' in out
+    # test that gdb can fetch source
+    out = machine.succeed("gdb /run/current-system/sw/bin/nix --batch -x ${builtins.toFile "commands" ''
+      start
+      l
+    ''}")
+    print(out)
+    assert 'int main(' in out
 
-      # test that valgrind can display location information
-      # this relies on the fact that valgrind complains about nix
-      # libgc helps in this regard, and we also ask valgrind to show leak kinds
-      # which are usually false positives.
-      out = machine.succeed("valgrind --leak-check=full --show-leak-kinds=all nix-env --version 2>&1")
-      print(out)
-      assert 'main.cc' in out
-    '';
-  }
-)
+    # test that valgrind can display location information
+    # this relies on the fact that valgrind complains about nix
+    # libgc helps in this regard, and we also ask valgrind to show leak kinds
+    # which are usually false positives.
+    out = machine.succeed("valgrind --leak-check=full --show-leak-kinds=all nix-env --version 2>&1")
+    print(out)
+    assert 'main.cc' in out
+  '';
+}
diff --git a/nixos/tests/noto-fonts-cjk-qt-default-weight.nix b/nixos/tests/noto-fonts-cjk-qt-default-weight.nix
index 44d9cf8083c1..636dfa3cfb72 100644
--- a/nixos/tests/noto-fonts-cjk-qt-default-weight.nix
+++ b/nixos/tests/noto-fonts-cjk-qt-default-weight.nix
@@ -1,37 +1,35 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "noto-fonts-cjk-qt";
-    meta.maintainers = with lib.maintainers; [ oxalica ];
+{ pkgs, lib, ... }:
+{
+  name = "noto-fonts-cjk-qt";
+  meta.maintainers = with lib.maintainers; [ oxalica ];
 
-    nodes.machine = {
-      imports = [ ./common/x11.nix ];
-      fonts = {
-        enableDefaultPackages = false;
-        fonts = [ pkgs.noto-fonts-cjk-sans ];
-      };
+  nodes.machine = {
+    imports = [ ./common/x11.nix ];
+    fonts = {
+      enableDefaultPackages = false;
+      fonts = [ pkgs.noto-fonts-cjk-sans ];
     };
+  };
 
-    testScript =
-      let
-        script =
-          pkgs.writers.writePython3 "qt-default-weight"
-            {
-              libraries = [ pkgs.python3Packages.pyqt6 ];
-            }
-            ''
-              from PyQt6.QtWidgets import QApplication
-              from PyQt6.QtGui import QFont, QRawFont
+  testScript =
+    let
+      script =
+        pkgs.writers.writePython3 "qt-default-weight"
+          {
+            libraries = [ pkgs.python3Packages.pyqt6 ];
+          }
+          ''
+            from PyQt6.QtWidgets import QApplication
+            from PyQt6.QtGui import QFont, QRawFont
 
-              app = QApplication([])
-              f = QRawFont.fromFont(QFont("Noto Sans CJK SC", 20))
+            app = QApplication([])
+            f = QRawFont.fromFont(QFont("Noto Sans CJK SC", 20))
 
-              assert f.styleName() == "Regular", f.styleName()
-            '';
-      in
-      ''
-        machine.wait_for_x()
-        machine.succeed("${script}")
-      '';
-  }
-)
+            assert f.styleName() == "Regular", f.styleName()
+          '';
+    in
+    ''
+      machine.wait_for_x()
+      machine.succeed("${script}")
+    '';
+}
diff --git a/nixos/tests/npmrc.nix b/nixos/tests/npmrc.nix
index 0377124433f9..d4209d0f85cd 100644
--- a/nixos/tests/npmrc.nix
+++ b/nixos/tests/npmrc.nix
@@ -1,24 +1,22 @@
-import ./make-test-python.nix (
-  { ... }:
-  let
-    machineName = "machine";
-    settingName = "prefix";
-    settingValue = "/some/path";
-  in
-  {
-    name = "npmrc";
+{ ... }:
+let
+  machineName = "machine";
+  settingName = "prefix";
+  settingValue = "/some/path";
+in
+{
+  name = "npmrc";
 
-    nodes."${machineName}".programs.npm = {
-      enable = true;
-      npmrc = ''
-        ${settingName} = ${settingValue}
-      '';
-    };
-
-    testScript = ''
-      ${machineName}.start()
-
-      assert ${machineName}.succeed("npm config get ${settingName}") == "${settingValue}\n"
+  nodes."${machineName}".programs.npm = {
+    enable = true;
+    npmrc = ''
+      ${settingName} = ${settingValue}
     '';
-  }
-)
+  };
+
+  testScript = ''
+    ${machineName}.start()
+
+    assert ${machineName}.succeed("npm config get ${settingName}") == "${settingValue}\n"
+  '';
+}
diff --git a/nixos/tests/nscd.nix b/nixos/tests/nscd.nix
index 75e478725d49..475660e91090 100644
--- a/nixos/tests/nscd.nix
+++ b/nixos/tests/nscd.nix
@@ -1,151 +1,149 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    # build a getent that itself doesn't see anything in /etc/hosts and
-    # /etc/nsswitch.conf, by using libredirect to steer its own requests to
-    # /dev/null.
-    # This means is /has/ to go via nscd to actually resolve any of the
-    # additionally configured hosts.
-    getent' = pkgs.writeScript "getent-without-etc-hosts" ''
-      export NIX_REDIRECTS=/etc/hosts=/dev/null:/etc/nsswitch.conf=/dev/null
-      export LD_PRELOAD=${pkgs.libredirect}/lib/libredirect.so
-      exec getent $@
-    '';
-  in
-  {
-    name = "nscd";
+{ pkgs, ... }:
+let
+  # build a getent that itself doesn't see anything in /etc/hosts and
+  # /etc/nsswitch.conf, by using libredirect to steer its own requests to
+  # /dev/null.
+  # This means is /has/ to go via nscd to actually resolve any of the
+  # additionally configured hosts.
+  getent' = pkgs.writeScript "getent-without-etc-hosts" ''
+    export NIX_REDIRECTS=/etc/hosts=/dev/null:/etc/nsswitch.conf=/dev/null
+    export LD_PRELOAD=${pkgs.libredirect}/lib/libredirect.so
+    exec getent $@
+  '';
+in
+{
+  name = "nscd";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ common/user-account.nix ];
-        networking.extraHosts = ''
-          2001:db8::1 somehost.test
-          192.0.2.1 somehost.test
-        '';
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ common/user-account.nix ];
+      networking.extraHosts = ''
+        2001:db8::1 somehost.test
+        192.0.2.1 somehost.test
+      '';
 
-        systemd.services.sockdump = {
-          wantedBy = [ "multi-user.target" ];
-          path = [
-            # necessary for bcc to unpack kernel headers and invoke modprobe
-            pkgs.gnutar
-            pkgs.xz.bin
-            pkgs.kmod
-          ];
-          environment.PYTHONUNBUFFERED = "1";
+      systemd.services.sockdump = {
+        wantedBy = [ "multi-user.target" ];
+        path = [
+          # necessary for bcc to unpack kernel headers and invoke modprobe
+          pkgs.gnutar
+          pkgs.xz.bin
+          pkgs.kmod
+        ];
+        environment.PYTHONUNBUFFERED = "1";
 
-          serviceConfig = {
-            ExecStart = "${pkgs.sockdump}/bin/sockdump /var/run/nscd/socket";
-            Restart = "on-failure";
-            RestartSec = "1";
-            Type = "simple";
-          };
-        };
-
-        specialisation = {
-          withGlibcNscd.configuration =
-            { ... }:
-            {
-              services.nscd.enableNsncd = false;
-            };
-          withUnscd.configuration =
-            { ... }:
-            {
-              services.nscd.enableNsncd = false;
-              services.nscd.package = pkgs.unscd;
-            };
+        serviceConfig = {
+          ExecStart = "${pkgs.sockdump}/bin/sockdump /var/run/nscd/socket";
+          Restart = "on-failure";
+          RestartSec = "1";
+          Type = "simple";
         };
       };
 
-    testScript =
-      { nodes, ... }:
-      let
-        specialisations = "${nodes.machine.system.build.toplevel}/specialisation";
-      in
-      ''
-        # Regression test for https://github.com/NixOS/nixpkgs/issues/50273
-        def test_dynamic_user():
-            with subtest("DynamicUser actually allocates a user"):
-                assert "iamatest" in machine.succeed(
-                    "systemd-run --pty --property=Type=oneshot --property=DynamicUser=yes --property=User=iamatest whoami"
-                )
+      specialisation = {
+        withGlibcNscd.configuration =
+          { ... }:
+          {
+            services.nscd.enableNsncd = false;
+          };
+        withUnscd.configuration =
+          { ... }:
+          {
+            services.nscd.enableNsncd = false;
+            services.nscd.package = pkgs.unscd;
+          };
+      };
+    };
 
-        # Test resolution of somehost.test with getent', to make sure we go via
-        # nscd protocol
-        def test_host_lookups():
-            with subtest("host lookups via nscd protocol"):
-                # ahosts
-                output = machine.succeed("${getent'} ahosts somehost.test")
-                assert "192.0.2.1" in output
-                assert "2001:db8::1" in output
+  testScript =
+    { nodes, ... }:
+    let
+      specialisations = "${nodes.machine.system.build.toplevel}/specialisation";
+    in
+    ''
+      # Regression test for https://github.com/NixOS/nixpkgs/issues/50273
+      def test_dynamic_user():
+          with subtest("DynamicUser actually allocates a user"):
+              assert "iamatest" in machine.succeed(
+                  "systemd-run --pty --property=Type=oneshot --property=DynamicUser=yes --property=User=iamatest whoami"
+              )
 
-                # ahostsv4
-                output = machine.succeed("${getent'} ahostsv4 somehost.test")
-                assert "192.0.2.1" in output
-                assert "2001:db8::1" not in output
+      # Test resolution of somehost.test with getent', to make sure we go via
+      # nscd protocol
+      def test_host_lookups():
+          with subtest("host lookups via nscd protocol"):
+              # ahosts
+              output = machine.succeed("${getent'} ahosts somehost.test")
+              assert "192.0.2.1" in output
+              assert "2001:db8::1" in output
 
-                # ahostsv6
-                output = machine.succeed("${getent'} ahostsv6 somehost.test")
-                assert "192.0.2.1" not in output
-                assert "2001:db8::1" in output
+              # ahostsv4
+              output = machine.succeed("${getent'} ahostsv4 somehost.test")
+              assert "192.0.2.1" in output
+              assert "2001:db8::1" not in output
 
-                # reverse lookups (hosts)
-                assert "somehost.test" in machine.succeed("${getent'} hosts 2001:db8::1")
-                assert "somehost.test" in machine.succeed("${getent'} hosts 192.0.2.1")
+              # ahostsv6
+              output = machine.succeed("${getent'} ahostsv6 somehost.test")
+              assert "192.0.2.1" not in output
+              assert "2001:db8::1" in output
+
+              # reverse lookups (hosts)
+              assert "somehost.test" in machine.succeed("${getent'} hosts 2001:db8::1")
+              assert "somehost.test" in machine.succeed("${getent'} hosts 192.0.2.1")
 
 
-        # Test host resolution via nss modules works
-        # We rely on nss-myhostname in this case, which resolves *.localhost and
-        # _gateway.
-        # We don't need to use getent' here, as non-glibc nss modules can only be
-        # discovered via nscd.
-        def test_nss_myhostname():
-            with subtest("nss-myhostname provides hostnames (ahosts)"):
-                # ahosts
-                output = machine.succeed("getent ahosts foobar.localhost")
-                assert "::1" in output
-                assert "127.0.0.1" in output
+      # Test host resolution via nss modules works
+      # We rely on nss-myhostname in this case, which resolves *.localhost and
+      # _gateway.
+      # We don't need to use getent' here, as non-glibc nss modules can only be
+      # discovered via nscd.
+      def test_nss_myhostname():
+          with subtest("nss-myhostname provides hostnames (ahosts)"):
+              # ahosts
+              output = machine.succeed("getent ahosts foobar.localhost")
+              assert "::1" in output
+              assert "127.0.0.1" in output
 
-                # ahostsv4
-                output = machine.succeed("getent ahostsv4 foobar.localhost")
-                assert "::1" not in output
-                assert "127.0.0.1" in output
+              # ahostsv4
+              output = machine.succeed("getent ahostsv4 foobar.localhost")
+              assert "::1" not in output
+              assert "127.0.0.1" in output
 
-                # ahostsv6
-                output = machine.succeed("getent ahostsv6 foobar.localhost")
-                assert "::1" in output
-                assert "127.0.0.1" not in output
+              # ahostsv6
+              output = machine.succeed("getent ahostsv6 foobar.localhost")
+              assert "::1" in output
+              assert "127.0.0.1" not in output
 
-        start_all()
-        machine.wait_for_unit("default.target")
+      start_all()
+      machine.wait_for_unit("default.target")
 
-        # give sockdump some time to finish attaching.
-        machine.sleep(5)
+      # give sockdump some time to finish attaching.
+      machine.sleep(5)
 
-        # Test all tests with glibc-nscd.
-        test_dynamic_user()
-        test_host_lookups()
-        test_nss_myhostname()
+      # Test all tests with glibc-nscd.
+      test_dynamic_user()
+      test_host_lookups()
+      test_nss_myhostname()
 
-        with subtest("glibc-nscd"):
-            machine.succeed('${specialisations}/withGlibcNscd/bin/switch-to-configuration test')
-            machine.wait_for_unit("default.target")
+      with subtest("glibc-nscd"):
+          machine.succeed('${specialisations}/withGlibcNscd/bin/switch-to-configuration test')
+          machine.wait_for_unit("default.target")
 
-            test_dynamic_user()
-            test_host_lookups()
-            test_nss_myhostname()
+          test_dynamic_user()
+          test_host_lookups()
+          test_nss_myhostname()
 
-        with subtest("unscd"):
-            machine.succeed('${specialisations}/withUnscd/bin/switch-to-configuration test')
-            machine.wait_for_unit("default.target")
+      with subtest("unscd"):
+          machine.succeed('${specialisations}/withUnscd/bin/switch-to-configuration test')
+          machine.wait_for_unit("default.target")
 
-            # known to fail, unscd doesn't load external NSS modules
-            # test_dynamic_user()
+          # known to fail, unscd doesn't load external NSS modules
+          # test_dynamic_user()
 
-            test_host_lookups()
+          test_host_lookups()
 
-            # known to fail, unscd doesn't load external NSS modules
-            # test_nss_myhostname()
-      '';
-  }
-)
+          # known to fail, unscd doesn't load external NSS modules
+          # test_nss_myhostname()
+    '';
+}
diff --git a/nixos/tests/nsd.nix b/nixos/tests/nsd.nix
index b77e28d80504..747d691a87d6 100644
--- a/nixos/tests/nsd.nix
+++ b/nixos/tests/nsd.nix
@@ -8,129 +8,127 @@ let
       environment.systemPackages = [ pkgs.bind ];
     };
 in
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nsd";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ aszlig ];
-    };
+{ pkgs, ... }:
+{
+  name = "nsd";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ aszlig ];
+  };
 
-    nodes = {
-      clientv4 =
-        { lib, nodes, ... }:
-        {
-          imports = [ common ];
-          networking.nameservers = lib.mkForce [
-            (lib.head nodes.server.config.networking.interfaces.eth1.ipv4.addresses).address
-          ];
-          networking.interfaces.eth1.ipv4.addresses = [
-            {
-              address = "192.168.0.2";
-              prefixLength = 24;
-            }
-          ];
-        };
+  nodes = {
+    clientv4 =
+      { lib, nodes, ... }:
+      {
+        imports = [ common ];
+        networking.nameservers = lib.mkForce [
+          (lib.head nodes.server.config.networking.interfaces.eth1.ipv4.addresses).address
+        ];
+        networking.interfaces.eth1.ipv4.addresses = [
+          {
+            address = "192.168.0.2";
+            prefixLength = 24;
+          }
+        ];
+      };
 
-      clientv6 =
-        { lib, nodes, ... }:
-        {
-          imports = [ common ];
-          networking.nameservers = lib.mkForce [
-            (lib.head nodes.server.config.networking.interfaces.eth1.ipv6.addresses).address
-          ];
-          networking.interfaces.eth1.ipv4.addresses = [
-            {
-              address = "dead:beef::2";
-              prefixLength = 24;
-            }
-          ];
-        };
+    clientv6 =
+      { lib, nodes, ... }:
+      {
+        imports = [ common ];
+        networking.nameservers = lib.mkForce [
+          (lib.head nodes.server.config.networking.interfaces.eth1.ipv6.addresses).address
+        ];
+        networking.interfaces.eth1.ipv4.addresses = [
+          {
+            address = "dead:beef::2";
+            prefixLength = 24;
+          }
+        ];
+      };
 
-      server =
-        { lib, ... }:
-        {
-          imports = [ common ];
-          networking.interfaces.eth1.ipv4.addresses = [
-            {
-              address = "192.168.0.1";
-              prefixLength = 24;
-            }
-          ];
-          networking.interfaces.eth1.ipv6.addresses = [
-            {
-              address = "dead:beef::1";
-              prefixLength = 64;
-            }
-          ];
-          services.nsd.enable = true;
-          services.nsd.rootServer = true;
-          services.nsd.interfaces = lib.mkForce [ ];
-          services.nsd.keys."tsig.example.com." = {
-            algorithm = "hmac-sha256";
-            keyFile = pkgs.writeTextFile {
-              name = "tsig.example.com.";
-              text = "aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc=";
-            };
+    server =
+      { lib, ... }:
+      {
+        imports = [ common ];
+        networking.interfaces.eth1.ipv4.addresses = [
+          {
+            address = "192.168.0.1";
+            prefixLength = 24;
+          }
+        ];
+        networking.interfaces.eth1.ipv6.addresses = [
+          {
+            address = "dead:beef::1";
+            prefixLength = 64;
+          }
+        ];
+        services.nsd.enable = true;
+        services.nsd.rootServer = true;
+        services.nsd.interfaces = lib.mkForce [ ];
+        services.nsd.keys."tsig.example.com." = {
+          algorithm = "hmac-sha256";
+          keyFile = pkgs.writeTextFile {
+            name = "tsig.example.com.";
+            text = "aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc=";
           };
-          services.nsd.zones."example.com.".data = ''
-            @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
-            ipv4 A 1.2.3.4
-            ipv6 AAAA abcd::eeff
-            deleg NS ns.example.com
-            ns A 192.168.0.1
-            ns AAAA dead:beef::1
-          '';
-          services.nsd.zones."example.com.".provideXFR = [ "0.0.0.0 tsig.example.com." ];
-          services.nsd.zones."deleg.example.com.".data = ''
-            @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
-            @ A 9.8.7.6
-            @ AAAA fedc::bbaa
-          '';
-          services.nsd.zones.".".data = ''
-            @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
-            root A 1.8.7.4
-            root AAAA acbd::4
-          '';
         };
-    };
+        services.nsd.zones."example.com.".data = ''
+          @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
+          ipv4 A 1.2.3.4
+          ipv6 AAAA abcd::eeff
+          deleg NS ns.example.com
+          ns A 192.168.0.1
+          ns AAAA dead:beef::1
+        '';
+        services.nsd.zones."example.com.".provideXFR = [ "0.0.0.0 tsig.example.com." ];
+        services.nsd.zones."deleg.example.com.".data = ''
+          @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
+          @ A 9.8.7.6
+          @ AAAA fedc::bbaa
+        '';
+        services.nsd.zones.".".data = ''
+          @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
+          root A 1.8.7.4
+          root AAAA acbd::4
+        '';
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      clientv4.wait_for_unit("network.target")
-      clientv6.wait_for_unit("network.target")
-      server.wait_for_unit("nsd.service")
+    clientv4.wait_for_unit("network.target")
+    clientv6.wait_for_unit("network.target")
+    server.wait_for_unit("nsd.service")
 
-      with subtest("server tsig.example.com."):
-          expected_tsig = "  secret: \"aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc=\"\n"
-          tsig=server.succeed("cat /var/lib/nsd/private/tsig.example.com.")
-          assert expected_tsig == tsig, f"Expected /var/lib/nsd/private/tsig.example.com. to contain '{expected_tsig}', but found '{tsig}'"
+    with subtest("server tsig.example.com."):
+        expected_tsig = "  secret: \"aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc=\"\n"
+        tsig=server.succeed("cat /var/lib/nsd/private/tsig.example.com.")
+        assert expected_tsig == tsig, f"Expected /var/lib/nsd/private/tsig.example.com. to contain '{expected_tsig}', but found '{tsig}'"
 
-      def assert_host(type, rr, query, expected):
-          self = clientv4 if type == 4 else clientv6
-          out = self.succeed(f"host -{type} -t {rr} {query}").rstrip()
-          self.log(f"output: {out}")
-          import re
-          assert re.search(
-              expected, out
-          ), f"DNS IPv{type} query on {query} gave '{out}' instead of '{expected}'"
+    def assert_host(type, rr, query, expected):
+        self = clientv4 if type == 4 else clientv6
+        out = self.succeed(f"host -{type} -t {rr} {query}").rstrip()
+        self.log(f"output: {out}")
+        import re
+        assert re.search(
+            expected, out
+        ), f"DNS IPv{type} query on {query} gave '{out}' instead of '{expected}'"
 
 
-      for ipv in 4, 6:
-          with subtest(f"IPv{ipv}"):
-              assert_host(ipv, "a", "example.com", "has no [^ ]+ record")
-              assert_host(ipv, "aaaa", "example.com", "has no [^ ]+ record")
+    for ipv in 4, 6:
+        with subtest(f"IPv{ipv}"):
+            assert_host(ipv, "a", "example.com", "has no [^ ]+ record")
+            assert_host(ipv, "aaaa", "example.com", "has no [^ ]+ record")
 
-              assert_host(ipv, "soa", "example.com", "SOA.*?noc\.example\.com")
-              assert_host(ipv, "a", "ipv4.example.com", "address 1.2.3.4$")
-              assert_host(ipv, "aaaa", "ipv6.example.com", "address abcd::eeff$")
+            assert_host(ipv, "soa", "example.com", "SOA.*?noc\.example\.com")
+            assert_host(ipv, "a", "ipv4.example.com", "address 1.2.3.4$")
+            assert_host(ipv, "aaaa", "ipv6.example.com", "address abcd::eeff$")
 
-              assert_host(ipv, "a", "deleg.example.com", "address 9.8.7.6$")
-              assert_host(ipv, "aaaa", "deleg.example.com", "address fedc::bbaa$")
+            assert_host(ipv, "a", "deleg.example.com", "address 9.8.7.6$")
+            assert_host(ipv, "aaaa", "deleg.example.com", "address fedc::bbaa$")
 
-              assert_host(ipv, "a", "root", "address 1.8.7.4$")
-              assert_host(ipv, "aaaa", "root", "address acbd::4$")
-    '';
-  }
-)
+            assert_host(ipv, "a", "root", "address 1.8.7.4$")
+            assert_host(ipv, "aaaa", "root", "address acbd::4$")
+  '';
+}
diff --git a/nixos/tests/ntpd-rs.nix b/nixos/tests/ntpd-rs.nix
index 9459a9f4ac51..050d0a20f57d 100644
--- a/nixos/tests/ntpd-rs.nix
+++ b/nixos/tests/ntpd-rs.nix
@@ -1,77 +1,75 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "ntpd-rs";
+{ lib, ... }:
+{
+  name = "ntpd-rs";
 
-    meta = {
-      maintainers = with lib.maintainers; [ fpletz ];
-    };
+  meta = {
+    maintainers = with lib.maintainers; [ fpletz ];
+  };
 
-    nodes = {
-      client = {
-        services.ntpd-rs = {
-          enable = true;
-          metrics.enable = false;
-          useNetworkingTimeServers = false;
-          settings = {
-            source = [
-              {
-                mode = "server";
-                address = "server";
-              }
-            ];
-            synchronization = {
-              minimum-agreeing-sources = 1;
-            };
-          };
-        };
-      };
-      server = {
-        networking.firewall = {
-          allowedTCPPorts = [
-            9975
+  nodes = {
+    client = {
+      services.ntpd-rs = {
+        enable = true;
+        metrics.enable = false;
+        useNetworkingTimeServers = false;
+        settings = {
+          source = [
+            {
+              mode = "server";
+              address = "server";
+            }
           ];
-          allowedUDPPorts = [
-            123
-          ];
-        };
-
-        services.ntpd-rs = {
-          enable = true;
-          metrics.enable = true;
-          settings = {
-            observability = {
-              metrics-exporter-listen = "[::]:9975";
-            };
-            server = [
-              { listen = "[::]:123"; }
-            ];
+          synchronization = {
+            minimum-agreeing-sources = 1;
           };
         };
       };
     };
+    server = {
+      networking.firewall = {
+        allowedTCPPorts = [
+          9975
+        ];
+        allowedUDPPorts = [
+          123
+        ];
+      };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
+      services.ntpd-rs = {
+        enable = true;
+        metrics.enable = true;
+        settings = {
+          observability = {
+            metrics-exporter-listen = "[::]:9975";
+          };
+          server = [
+            { listen = "[::]:123"; }
+          ];
+        };
+      };
+    };
+  };
 
-        for machine in (server, client):
-          machine.wait_for_unit('multi-user.target')
-          machine.succeed('systemctl is-active ntpd-rs.service')
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
 
-        client.fail('systemctl is-active ntpd-rs-metrics.service')
-        server.succeed('systemctl is-active ntpd-rs-metrics.service')
+      for machine in (server, client):
+        machine.wait_for_unit('multi-user.target')
+        machine.succeed('systemctl is-active ntpd-rs.service')
 
-        server.wait_for_open_port(9975)
-        client.succeed('curl http://server:9975/metrics | grep ntp_uptime_seconds')
-        server.fail('curl --fail --connect-timeout 2 http://client:9975/metrics | grep ntp_uptime_seconds')
+      client.fail('systemctl is-active ntpd-rs-metrics.service')
+      server.succeed('systemctl is-active ntpd-rs-metrics.service')
 
-        client.succeed("ntp-ctl status | grep server:123")
-        server.succeed("ntp-ctl status | grep '\[::\]:123'")
+      server.wait_for_open_port(9975)
+      client.succeed('curl http://server:9975/metrics | grep ntp_uptime_seconds')
+      server.fail('curl --fail --connect-timeout 2 http://client:9975/metrics | grep ntp_uptime_seconds')
 
-        client.succeed("grep '^mode = \"server\"' $(systemctl status ntpd-rs | grep -oE '/nix/store[^ ]*ntpd-rs.toml')")
-        server.succeed("grep '^mode = \"pool\"' $(systemctl status ntpd-rs | grep -oE '/nix/store[^ ]*ntpd-rs.toml')")
-      '';
-  }
-)
+      client.succeed("ntp-ctl status | grep server:123")
+      server.succeed("ntp-ctl status | grep '\[::\]:123'")
+
+      client.succeed("grep '^mode = \"server\"' $(systemctl status ntpd-rs | grep -oE '/nix/store[^ ]*ntpd-rs.toml')")
+      server.succeed("grep '^mode = \"pool\"' $(systemctl status ntpd-rs | grep -oE '/nix/store[^ ]*ntpd-rs.toml')")
+    '';
+}
diff --git a/nixos/tests/ntpd.nix b/nixos/tests/ntpd.nix
index 67a5a95e6fe5..e961cb7614a7 100644
--- a/nixos/tests/ntpd.nix
+++ b/nixos/tests/ntpd.nix
@@ -1,27 +1,25 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "ntpd";
+{ lib, ... }:
+{
+  name = "ntpd";
 
-    meta = {
-      maintainers = with lib.maintainers; [ pyrox0 ];
+  meta = {
+    maintainers = with lib.maintainers; [ pyrox0 ];
+  };
+
+  nodes.machine = {
+    services.ntp = {
+      enable = true;
     };
+  };
 
-    nodes.machine = {
-      services.ntp = {
-        enable = true;
-      };
-    };
+  testScript = ''
+    start_all()
 
-    testScript = ''
-      start_all()
-
-      machine.wait_for_unit('ntpd.service')
-      machine.wait_for_console_text('Listen normally on 10 eth*')
-      machine.succeed('systemctl is-active ntpd.service')
-      machine.succeed('ntpq -p')
-      # ntp user must be able to create drift files
-      machine.succeed('su -s /bin/sh -c "touch /var/lib/ntp/ntp.drift" ntp')
-    '';
-  }
-)
+    machine.wait_for_unit('ntpd.service')
+    machine.wait_for_console_text('Listen normally on 10 eth*')
+    machine.succeed('systemctl is-active ntpd.service')
+    machine.succeed('ntpq -p')
+    # ntp user must be able to create drift files
+    machine.succeed('su -s /bin/sh -c "touch /var/lib/ntp/ntp.drift" ntp')
+  '';
+}
diff --git a/nixos/tests/nvmetcfg.nix b/nixos/tests/nvmetcfg.nix
index 6f937251bb35..4720ac754378 100644
--- a/nixos/tests/nvmetcfg.nix
+++ b/nixos/tests/nvmetcfg.nix
@@ -1,54 +1,52 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "nvmetcfg";
+{ lib, ... }:
+{
+  name = "nvmetcfg";
 
-    meta = {
-      maintainers = with lib.maintainers; [ nickcao ];
-    };
+  meta = {
+    maintainers = with lib.maintainers; [ nickcao ];
+  };
 
-    nodes = {
-      server =
-        { pkgs, ... }:
-        {
-          boot.kernelModules = [ "nvmet" ];
-          environment.systemPackages = [ pkgs.nvmetcfg ];
-          networking.firewall.allowedTCPPorts = [ 4420 ];
-          virtualisation.emptyDiskImages = [ 512 ];
-        };
-      client =
-        { pkgs, ... }:
-        {
-          boot.kernelModules = [ "nvme-fabrics" ];
-          environment.systemPackages = [ pkgs.nvme-cli ];
-        };
-    };
+  nodes = {
+    server =
+      { pkgs, ... }:
+      {
+        boot.kernelModules = [ "nvmet" ];
+        environment.systemPackages = [ pkgs.nvmetcfg ];
+        networking.firewall.allowedTCPPorts = [ 4420 ];
+        virtualisation.emptyDiskImages = [ 512 ];
+      };
+    client =
+      { pkgs, ... }:
+      {
+        boot.kernelModules = [ "nvme-fabrics" ];
+        environment.systemPackages = [ pkgs.nvme-cli ];
+      };
+  };
 
-    testScript =
-      let
-        subsystem = "nqn.2014-08.org.nixos:server";
-      in
-      ''
-        import json
+  testScript =
+    let
+      subsystem = "nqn.2014-08.org.nixos:server";
+    in
+    ''
+      import json
 
-        with subtest("Create subsystem and namespace"):
-          server.succeed("nvmet subsystem add ${subsystem}")
-          server.succeed("nvmet namespace add ${subsystem} 1 /dev/vdb")
+      with subtest("Create subsystem and namespace"):
+        server.succeed("nvmet subsystem add ${subsystem}")
+        server.succeed("nvmet namespace add ${subsystem} 1 /dev/vdb")
 
-        with subtest("Bind subsystem to port"):
-          server.wait_for_unit("network-online.target")
-          server.succeed("nvmet port add 1 tcp [::]:4420")
-          server.succeed("nvmet port add-subsystem 1 ${subsystem}")
+      with subtest("Bind subsystem to port"):
+        server.wait_for_unit("network-online.target")
+        server.succeed("nvmet port add 1 tcp [::]:4420")
+        server.succeed("nvmet port add-subsystem 1 ${subsystem}")
 
-        with subtest("Discover and connect to available subsystems"):
-          client.wait_for_unit("network-online.target")
-          assert "subnqn:  ${subsystem}" in client.succeed("nvme discover --transport=tcp --traddr=server --trsvcid=4420")
-          client.succeed("nvme connect-all --transport=tcp --traddr=server --trsvcid=4420")
+      with subtest("Discover and connect to available subsystems"):
+        client.wait_for_unit("network-online.target")
+        assert "subnqn:  ${subsystem}" in client.succeed("nvme discover --transport=tcp --traddr=server --trsvcid=4420")
+        client.succeed("nvme connect-all --transport=tcp --traddr=server --trsvcid=4420")
 
-        with subtest("Write to the connected subsystem"):
-          devices = json.loads(client.succeed("lsblk --nvme --paths --json"))["blockdevices"]
-          assert len(devices) == 1
-          client.succeed(f"dd if=/dev/zero of={devices[0]['name']} bs=1M count=64")
-      '';
-  }
-)
+      with subtest("Write to the connected subsystem"):
+        devices = json.loads(client.succeed("lsblk --nvme --paths --json"))["blockdevices"]
+        assert len(devices) == 1
+        client.succeed(f"dd if=/dev/zero of={devices[0]['name']} bs=1M count=64")
+    '';
+}
diff --git a/nixos/tests/nzbget.nix b/nixos/tests/nzbget.nix
index 0fd80c6d554a..3b5ee0ce0c43 100644
--- a/nixos/tests/nzbget.nix
+++ b/nixos/tests/nzbget.nix
@@ -1,56 +1,54 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nzbget";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        aanderse
-        flokli
-      ];
-    };
+{ pkgs, ... }:
+{
+  name = "nzbget";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      aanderse
+      flokli
+    ];
+  };
 
-    nodes = {
-      server =
-        { ... }:
-        {
-          services.nzbget.enable = true;
+  nodes = {
+    server =
+      { ... }:
+      {
+        services.nzbget.enable = true;
 
-          # provide some test settings
-          services.nzbget.settings = {
-            "MainDir" = "/var/lib/nzbget";
-            "DirectRename" = true;
-            "DiskSpace" = 0;
-            "Server1.Name" = "this is a test";
-          };
-
-          # hack, don't add (unfree) unrar to nzbget's path,
-          # so we can run this test in CI
-          systemd.services.nzbget.path = pkgs.lib.mkForce [ pkgs.p7zip ];
+        # provide some test settings
+        services.nzbget.settings = {
+          "MainDir" = "/var/lib/nzbget";
+          "DirectRename" = true;
+          "DiskSpace" = 0;
+          "Server1.Name" = "this is a test";
         };
-    };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
+        # hack, don't add (unfree) unrar to nzbget's path,
+        # so we can run this test in CI
+        systemd.services.nzbget.path = pkgs.lib.mkForce [ pkgs.p7zip ];
+      };
+  };
 
-        server.wait_for_unit("nzbget.service")
-        server.wait_for_unit("network.target")
-        server.wait_for_open_port(6789)
-        assert "This file is part of nzbget" in server.succeed(
-            "curl -f -s -u nzbget:tegbzn6789 http://127.0.0.1:6789"
-        )
-        server.succeed(
-            "${pkgs.nzbget}/bin/nzbget -n -o Control_iP=127.0.0.1 -o Control_port=6789 -o Control_password=tegbzn6789 -V"
-        )
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
 
-        config = server.succeed("${nodes.server.systemd.services.nzbget.serviceConfig.ExecStart} --printconfig")
+      server.wait_for_unit("nzbget.service")
+      server.wait_for_unit("network.target")
+      server.wait_for_open_port(6789)
+      assert "This file is part of nzbget" in server.succeed(
+          "curl -f -s -u nzbget:tegbzn6789 http://127.0.0.1:6789"
+      )
+      server.succeed(
+          "${pkgs.nzbget}/bin/nzbget -n -o Control_iP=127.0.0.1 -o Control_port=6789 -o Control_password=tegbzn6789 -V"
+      )
 
-        # confirm the test settings are applied
-        assert 'MainDir = "/var/lib/nzbget"' in config
-        assert 'DirectRename = "yes"' in config
-        assert 'DiskSpace = "0"' in config
-        assert 'Server1.Name = "this is a test"' in config
-      '';
-  }
-)
+      config = server.succeed("${nodes.server.systemd.services.nzbget.serviceConfig.ExecStart} --printconfig")
+
+      # confirm the test settings are applied
+      assert 'MainDir = "/var/lib/nzbget"' in config
+      assert 'DirectRename = "yes"' in config
+      assert 'DiskSpace = "0"' in config
+      assert 'Server1.Name = "this is a test"' in config
+    '';
+}
diff --git a/nixos/tests/nzbhydra2.nix b/nixos/tests/nzbhydra2.nix
index 9f6f2e98423a..b446d8236977 100644
--- a/nixos/tests/nzbhydra2.nix
+++ b/nixos/tests/nzbhydra2.nix
@@ -1,20 +1,18 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "nzbhydra2";
-    meta.maintainers = with lib.maintainers; [ matteopacini ];
+{ lib, ... }:
+{
+  name = "nzbhydra2";
+  meta.maintainers = with lib.maintainers; [ matteopacini ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.nzbhydra2.enable = true;
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.nzbhydra2.enable = true;
+    };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("nzbhydra2.service")
-      machine.wait_for_open_port(5076)
-      machine.succeed("curl --fail http://localhost:5076/")
-    '';
-  }
-)
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("nzbhydra2.service")
+    machine.wait_for_open_port(5076)
+    machine.succeed("curl --fail http://localhost:5076/")
+  '';
+}
diff --git a/nixos/tests/ocis.nix b/nixos/tests/ocis.nix
index a529b4385663..275a13799035 100644
--- a/nixos/tests/ocis.nix
+++ b/nixos/tests/ocis.nix
@@ -1,217 +1,215 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  let
-    # this is a demo user created by IDM_CREATE_DEMO_USERS=true
-    demoUser = "einstein";
-    demoPassword = "relativity";
+let
+  # this is a demo user created by IDM_CREATE_DEMO_USERS=true
+  demoUser = "einstein";
+  demoPassword = "relativity";
 
-    adminUser = "admin";
-    adminPassword = "hunter2";
-    testRunner =
-      pkgs.writers.writePython3Bin "test-runner"
-        {
-          libraries = [ pkgs.python3Packages.selenium ];
-          flakeIgnore = [ "E501" ];
-        }
-        ''
-          import sys
-          from selenium.webdriver.common.by import By
-          from selenium.webdriver import Firefox
-          from selenium.webdriver.firefox.options import Options
-          from selenium.webdriver.support.ui import WebDriverWait
-          from selenium.webdriver.support import expected_conditions as EC
+  adminUser = "admin";
+  adminPassword = "hunter2";
+  testRunner =
+    pkgs.writers.writePython3Bin "test-runner"
+      {
+        libraries = [ pkgs.python3Packages.selenium ];
+        flakeIgnore = [ "E501" ];
+      }
+      ''
+        import sys
+        from selenium.webdriver.common.by import By
+        from selenium.webdriver import Firefox
+        from selenium.webdriver.firefox.options import Options
+        from selenium.webdriver.support.ui import WebDriverWait
+        from selenium.webdriver.support import expected_conditions as EC
 
-          options = Options()
-          options.add_argument('--headless')
-          driver = Firefox(options=options)
+        options = Options()
+        options.add_argument('--headless')
+        driver = Firefox(options=options)
 
-          user = sys.argv[1]
-          password = sys.argv[2]
-          driver.implicitly_wait(20)
-          driver.get('https://localhost:9200/login')
-          wait = WebDriverWait(driver, 10)
-          wait.until(EC.title_contains("Sign in"))
-          driver.find_element(By.XPATH, '//*[@id="oc-login-username"]').send_keys(user)
-          driver.find_element(By.XPATH, '//*[@id="oc-login-password"]').send_keys(password)
-          driver.find_element(By.XPATH, '//*[@id="root"]//button').click()
-          wait.until(EC.title_contains("Personal"))
-        '';
+        user = sys.argv[1]
+        password = sys.argv[2]
+        driver.implicitly_wait(20)
+        driver.get('https://localhost:9200/login')
+        wait = WebDriverWait(driver, 10)
+        wait.until(EC.title_contains("Sign in"))
+        driver.find_element(By.XPATH, '//*[@id="oc-login-username"]').send_keys(user)
+        driver.find_element(By.XPATH, '//*[@id="oc-login-password"]').send_keys(password)
+        driver.find_element(By.XPATH, '//*[@id="root"]//button').click()
+        wait.until(EC.title_contains("Personal"))
+      '';
 
-    # This was generated with `ocis init --config-path testconfig/ --admin-password "hunter2" --insecure true`.
-    testConfig = ''
-      token_manager:
-        jwt_secret: kaKYgfso*d9GA-yTM.&BTOUEuMz%Ai0H
-      machine_auth_api_key: sGWRG1JZ&qe&pe@N1HKK4#qH*B&@xLnO
-      system_user_api_key: h+m4aHPUtOtUJFKrc5B2=04C=7fDZaT-
-      transfer_secret: 4-R6AfUjQn0P&+h2+$skf0lJqmre$j=x
-      system_user_id: db180e0a-b38a-4edf-a4cd-a3d358248537
-      admin_user_id: ea623f50-742d-4fd0-95bb-c61767b070d4
-      graph:
-        application:
-          id: 11971eab-d560-4b95-a2d4-50726676bbd0
-        events:
-          tls_insecure: true
-        spaces:
-          insecure: true
-        identity:
-          ldap:
-            bind_password: ^F&Vn7@mYGYGuxr$#qm^gGy@FVq=.w=y
-        service_account:
-          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
-          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
-      idp:
+  # This was generated with `ocis init --config-path testconfig/ --admin-password "hunter2" --insecure true`.
+  testConfig = ''
+    token_manager:
+      jwt_secret: kaKYgfso*d9GA-yTM.&BTOUEuMz%Ai0H
+    machine_auth_api_key: sGWRG1JZ&qe&pe@N1HKK4#qH*B&@xLnO
+    system_user_api_key: h+m4aHPUtOtUJFKrc5B2=04C=7fDZaT-
+    transfer_secret: 4-R6AfUjQn0P&+h2+$skf0lJqmre$j=x
+    system_user_id: db180e0a-b38a-4edf-a4cd-a3d358248537
+    admin_user_id: ea623f50-742d-4fd0-95bb-c61767b070d4
+    graph:
+      application:
+        id: 11971eab-d560-4b95-a2d4-50726676bbd0
+      events:
+        tls_insecure: true
+      spaces:
+        insecure: true
+      identity:
         ldap:
-          bind_password: bv53IjS28x.nxth*%aRbE70%4TGNXbLU
-      idm:
-        service_user_passwords:
-          admin_password: hunter2
-          idm_password: ^F&Vn7@mYGYGuxr$#qm^gGy@FVq=.w=y
-          reva_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
-          idp_password: bv53IjS28x.nxth*%aRbE70%4TGNXbLU
-      proxy:
+          bind_password: ^F&Vn7@mYGYGuxr$#qm^gGy@FVq=.w=y
+      service_account:
+        service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+        service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+    idp:
+      ldap:
+        bind_password: bv53IjS28x.nxth*%aRbE70%4TGNXbLU
+    idm:
+      service_user_passwords:
+        admin_password: hunter2
+        idm_password: ^F&Vn7@mYGYGuxr$#qm^gGy@FVq=.w=y
+        reva_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
+        idp_password: bv53IjS28x.nxth*%aRbE70%4TGNXbLU
+    proxy:
+      oidc:
+        insecure: true
+      insecure_backends: true
+      service_account:
+        service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+        service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+    frontend:
+      app_handler:
+        insecure: true
+      archiver:
+        insecure: true
+      service_account:
+        service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+        service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+    auth_basic:
+      auth_providers:
+        ldap:
+          bind_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
+    auth_bearer:
+      auth_providers:
         oidc:
           insecure: true
-        insecure_backends: true
-        service_account:
-          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
-          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
-      frontend:
-        app_handler:
-          insecure: true
-        archiver:
-          insecure: true
-        service_account:
-          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
-          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
-      auth_basic:
-        auth_providers:
-          ldap:
-            bind_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
-      auth_bearer:
-        auth_providers:
-          oidc:
-            insecure: true
-      users:
-        drivers:
-          ldap:
-            bind_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
-      groups:
-        drivers:
-          ldap:
-            bind_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
-      ocdav:
-        insecure: true
-      ocm:
-        service_account:
-          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
-          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
-      thumbnails:
-        thumbnail:
-          transfer_secret: 2%11!zAu*AYE&=d*8dfoZs8jK&5ZMm*%
-          webdav_allow_insecure: true
-          cs3_allow_insecure: true
-      search:
-        events:
-          tls_insecure: true
-        service_account:
-          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
-          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
-      audit:
-        events:
-          tls_insecure: true
-      settings:
-        service_account_ids:
-        - df39a290-3f3e-4e39-b67b-8b810ca2abac
-      sharing:
-        events:
-          tls_insecure: true
-      storage_users:
-        events:
-          tls_insecure: true
-        mount_id: ef72cb8b-809c-4592-bfd2-1df603295205
-        service_account:
-          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
-          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+    users:
+      drivers:
+        ldap:
+          bind_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
+    groups:
+      drivers:
+        ldap:
+          bind_password: z-%@fWipLliR8lD#fl.0teC#9QbhJ^eb
+    ocdav:
+      insecure: true
+    ocm:
+      service_account:
+        service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+        service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+    thumbnails:
+      thumbnail:
+        transfer_secret: 2%11!zAu*AYE&=d*8dfoZs8jK&5ZMm*%
+        webdav_allow_insecure: true
+        cs3_allow_insecure: true
+    search:
+      events:
+        tls_insecure: true
+      service_account:
+        service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+        service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+    audit:
+      events:
+        tls_insecure: true
+    settings:
+      service_account_ids:
+      - df39a290-3f3e-4e39-b67b-8b810ca2abac
+    sharing:
+      events:
+        tls_insecure: true
+    storage_users:
+      events:
+        tls_insecure: true
+      mount_id: ef72cb8b-809c-4592-bfd2-1df603295205
+      service_account:
+        service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+        service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+    notifications:
       notifications:
-        notifications:
-          events:
-            tls_insecure: true
-        service_account:
-          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
-          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+        events:
+          tls_insecure: true
+      service_account:
+        service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+        service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+    nats:
       nats:
-        nats:
-          tls_skip_verify_client_cert: true
-      gateway:
-        storage_registry:
-          storage_users_mount_id: ef72cb8b-809c-4592-bfd2-1df603295205
-      userlog:
-        service_account:
-          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
-          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
-      auth_service:
-        service_account:
-          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
-          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
-      clientlog:
-        service_account:
-          service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
-          service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE'';
-  in
+        tls_skip_verify_client_cert: true
+    gateway:
+      storage_registry:
+        storage_users_mount_id: ef72cb8b-809c-4592-bfd2-1df603295205
+    userlog:
+      service_account:
+        service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+        service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+    auth_service:
+      service_account:
+        service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+        service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE
+    clientlog:
+      service_account:
+        service_account_id: df39a290-3f3e-4e39-b67b-8b810ca2abac
+        service_account_secret: .demKypQ$=pGl+yRar!#YaFjLYCr4YwE'';
+in
 
-  {
-    name = "ocis";
+{
+  name = "ocis";
 
-    meta.maintainers = with lib.maintainers; [
-      bhankas
-      ramblurr
-    ];
+  meta.maintainers = with lib.maintainers; [
+    bhankas
+    ramblurr
+  ];
 
-    nodes.machine =
-      { config, ... }:
-      {
-        virtualisation.memorySize = 2048;
-        environment.systemPackages = [
-          pkgs.firefox-unwrapped
-          pkgs.geckodriver
-          testRunner
-        ];
+  nodes.machine =
+    { config, ... }:
+    {
+      virtualisation.memorySize = 2048;
+      environment.systemPackages = [
+        pkgs.firefox-unwrapped
+        pkgs.geckodriver
+        testRunner
+      ];
 
-        # if you do this in production, dont put secrets in this file because it will be written to the world readable nix store
-        environment.etc."ocis/ocis.env".text = ''
-          ADMIN_PASSWORD=${adminPassword}
-          IDM_CREATE_DEMO_USERS=true
-        '';
+      # if you do this in production, dont put secrets in this file because it will be written to the world readable nix store
+      environment.etc."ocis/ocis.env".text = ''
+        ADMIN_PASSWORD=${adminPassword}
+        IDM_CREATE_DEMO_USERS=true
+      '';
 
-        # if you do this in production, dont put secrets in this file because it will be written to the world readable nix store
-        environment.etc."ocis/config/ocis.yaml".text = testConfig;
+      # if you do this in production, dont put secrets in this file because it will be written to the world readable nix store
+      environment.etc."ocis/config/ocis.yaml".text = testConfig;
 
-        services.ocis = {
-          enable = true;
-          configDir = "/etc/ocis/config";
-          environment = {
-            OCIS_INSECURE = "true";
-          };
-          environmentFile = "/etc/ocis/ocis.env";
+      services.ocis = {
+        enable = true;
+        configDir = "/etc/ocis/config";
+        environment = {
+          OCIS_INSECURE = "true";
         };
+        environmentFile = "/etc/ocis/ocis.env";
       };
+    };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("ocis.service")
-      machine.wait_for_open_port(9200)
-      # wait for ocis to fully come up
-      machine.sleep(5)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("ocis.service")
+    machine.wait_for_open_port(9200)
+    # wait for ocis to fully come up
+    machine.sleep(5)
 
-      with subtest("ocis bin works"):
-          machine.succeed("${lib.getExe pkgs.ocis_5-bin} version")
+    with subtest("ocis bin works"):
+        machine.succeed("${lib.getExe pkgs.ocis_5-bin} version")
 
-      with subtest("use the web interface to log in with a demo user"):
-          machine.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner ${demoUser} ${demoPassword}")
+    with subtest("use the web interface to log in with a demo user"):
+        machine.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner ${demoUser} ${demoPassword}")
 
-      with subtest("use the web interface to log in with the provisioned admin user"):
-          machine.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner ${adminUser} ${adminPassword}")
-    '';
-  }
-)
+    with subtest("use the web interface to log in with the provisioned admin user"):
+        machine.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner ${adminUser} ${adminPassword}")
+  '';
+}
diff --git a/nixos/tests/octoprint.nix b/nixos/tests/octoprint.nix
index 9473797d5047..805b7c764b61 100644
--- a/nixos/tests/octoprint.nix
+++ b/nixos/tests/octoprint.nix
@@ -1,69 +1,67 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    apikey = "testapikey";
-  in
-  {
-    name = "octoprint";
-    meta.maintainers = with lib.maintainers; [ gador ];
+let
+  apikey = "testapikey";
+in
+{
+  name = "octoprint";
+  meta.maintainers = with lib.maintainers; [ gador ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = with pkgs; [ jq ];
-        services.octoprint = {
-          enable = true;
-          extraConfig = {
-            server = {
-              firstRun = false;
-            };
-            api = {
-              enabled = true;
-              key = apikey;
-            };
-            plugins = {
-              # these need internet access and pollute the output with connection failed errors
-              _disabled = [
-                "softwareupdate"
-                "announcements"
-                "pluginmanager"
-              ];
-            };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [ jq ];
+      services.octoprint = {
+        enable = true;
+        extraConfig = {
+          server = {
+            firstRun = false;
+          };
+          api = {
+            enabled = true;
+            key = apikey;
+          };
+          plugins = {
+            # these need internet access and pollute the output with connection failed errors
+            _disabled = [
+              "softwareupdate"
+              "announcements"
+              "pluginmanager"
+            ];
           };
         };
       };
+    };
 
-    testScript = ''
-      import json
+  testScript = ''
+    import json
 
-      @polling_condition
-      def octoprint_running():
-          machine.succeed("pgrep octoprint")
+    @polling_condition
+    def octoprint_running():
+        machine.succeed("pgrep octoprint")
 
-      with subtest("Wait for octoprint service to start"):
-          machine.wait_for_unit("octoprint.service")
-          machine.wait_until_succeeds("pgrep octoprint")
+    with subtest("Wait for octoprint service to start"):
+        machine.wait_for_unit("octoprint.service")
+        machine.wait_until_succeeds("pgrep octoprint")
 
-      with subtest("Wait for final boot"):
-          # this appears whe octoprint is almost finished starting
-          machine.wait_for_file("/var/lib/octoprint/uploads")
+    with subtest("Wait for final boot"):
+        # this appears whe octoprint is almost finished starting
+        machine.wait_for_file("/var/lib/octoprint/uploads")
 
-      # octoprint takes some time to start. This makes sure we'll retry just in case it takes longer
-      # retry-all-errors in necessary, since octoprint will report a 404 error when not yet ready
-      curl_cmd = "curl --retry-all-errors --connect-timeout 5 --max-time 10 --retry 5 --retry-delay 0 \
-                  --retry-max-time 40 -X GET --header 'X-API-Key: ${apikey}' "
+    # octoprint takes some time to start. This makes sure we'll retry just in case it takes longer
+    # retry-all-errors in necessary, since octoprint will report a 404 error when not yet ready
+    curl_cmd = "curl --retry-all-errors --connect-timeout 5 --max-time 10 --retry 5 --retry-delay 0 \
+                --retry-max-time 40 -X GET --header 'X-API-Key: ${apikey}' "
 
-      # used to fail early, in case octoprint first starts and then crashes
-      with octoprint_running: # type: ignore[union-attr]
-          with subtest("Check for web interface"):
-              machine.wait_until_succeeds("curl -s localhost:5000")
+    # used to fail early, in case octoprint first starts and then crashes
+    with octoprint_running: # type: ignore[union-attr]
+        with subtest("Check for web interface"):
+            machine.wait_until_succeeds("curl -s localhost:5000")
 
-          with subtest("Check API"):
-              version = json.loads(machine.succeed(curl_cmd + "localhost:5000/api/version"))
-              server = json.loads(machine.succeed(curl_cmd + "localhost:5000/api/server"))
-              assert version["server"] == str("${pkgs.octoprint.version}")
-              assert server["safemode"] == None
-    '';
-  }
-)
+        with subtest("Check API"):
+            version = json.loads(machine.succeed(curl_cmd + "localhost:5000/api/version"))
+            server = json.loads(machine.succeed(curl_cmd + "localhost:5000/api/server"))
+            assert version["server"] == str("${pkgs.octoprint.version}")
+            assert server["safemode"] == None
+  '';
+}
diff --git a/nixos/tests/odoo.nix b/nixos/tests/odoo.nix
index 54120b234364..a36a7a5b9801 100644
--- a/nixos/tests/odoo.nix
+++ b/nixos/tests/odoo.nix
@@ -1,39 +1,33 @@
-import ./make-test-python.nix (
-  {
-    pkgs,
-    lib,
-    package ? pkgs.odoo,
-    ...
-  }:
-  {
-    name = "odoo";
-    meta.maintainers = with lib.maintainers; [ mkg20001 ];
+{
+  package,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  name = "odoo";
+  meta.maintainers = with lib.maintainers; [ mkg20001 ];
 
-    nodes = {
-      server =
-        { ... }:
-        {
-          services.nginx = {
-            enable = true;
-            recommendedProxySettings = true;
-          };
+  _module.args.package = lib.mkDefault pkgs.odoo;
 
-          services.odoo = {
-            enable = true;
-            package = package;
-            autoInit = true;
-            autoInitExtraFlags = [ "--without-demo=all" ];
-            domain = "localhost";
-          };
-        };
+  nodes.server = {
+    services.nginx = {
+      enable = true;
+      recommendedProxySettings = true;
     };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        server.wait_for_unit("odoo.service")
-        server.wait_until_succeeds("curl -s http://localhost:8069/web/database/selector | grep '<title>Odoo</title>'")
-        server.succeed("curl -s http://localhost/web/database/selector | grep '<title>Odoo</title>'")
-      '';
-  }
-)
+    services.odoo = {
+      enable = true;
+      package = package;
+      autoInit = true;
+      autoInitExtraFlags = [ "--without-demo=all" ];
+      domain = "localhost";
+    };
+  };
+
+  testScript = ''
+    server.wait_for_unit("odoo.service")
+    server.wait_until_succeeds("curl -s http://localhost:8069/web/database/selector | grep '<title>Odoo</title>'")
+    server.succeed("curl -s http://localhost/web/database/selector | grep '<title>Odoo</title>'")
+  '';
+}
diff --git a/nixos/tests/oh-my-zsh.nix b/nixos/tests/oh-my-zsh.nix
index 25c4e8ebfe97..026e8628c11c 100644
--- a/nixos/tests/oh-my-zsh.nix
+++ b/nixos/tests/oh-my-zsh.nix
@@ -1,22 +1,20 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "oh-my-zsh";
+{ pkgs, ... }:
+{
+  name = "oh-my-zsh";
 
-    nodes.machine =
-      { pkgs, ... }:
+  nodes.machine =
+    { pkgs, ... }:
 
-      {
-        programs.zsh = {
-          enable = true;
-          ohMyZsh.enable = true;
-        };
+    {
+      programs.zsh = {
+        enable = true;
+        ohMyZsh.enable = true;
       };
+    };
 
-    testScript = ''
-      start_all()
-      machine.succeed("touch ~/.zshrc")
-      machine.succeed("zsh -c 'source /etc/zshrc && echo $ZSH | grep oh-my-zsh-${pkgs.oh-my-zsh.version}'")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.succeed("touch ~/.zshrc")
+    machine.succeed("zsh -c 'source /etc/zshrc && echo $ZSH | grep oh-my-zsh-${pkgs.oh-my-zsh.version}'")
+  '';
+}
diff --git a/nixos/tests/ombi.nix b/nixos/tests/ombi.nix
index eeeaba5e2d0e..6d77aa3c5b70 100644
--- a/nixos/tests/ombi.nix
+++ b/nixos/tests/ombi.nix
@@ -1,20 +1,18 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "ombi";
-    meta.maintainers = with lib.maintainers; [ woky ];
+{
+  name = "ombi";
+  meta.maintainers = with lib.maintainers; [ woky ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.ombi.enable = true;
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.ombi.enable = true;
+    };
 
-    testScript = ''
-      machine.wait_for_unit("ombi.service")
-      machine.wait_for_open_port(5000)
-      machine.succeed("curl --fail http://localhost:5000/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("ombi.service")
+    machine.wait_for_open_port(5000)
+    machine.succeed("curl --fail http://localhost:5000/")
+  '';
+}
diff --git a/nixos/tests/openarena.nix b/nixos/tests/openarena.nix
index 6ac38729d3f1..2d514bac4c73 100644
--- a/nixos/tests/openarena.nix
+++ b/nixos/tests/openarena.nix
@@ -1,79 +1,77 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    client =
-      { pkgs, ... }:
+let
+  client =
+    { pkgs, ... }:
 
-      {
-        imports = [ ./common/x11.nix ];
-        hardware.graphics.enable = true;
-        environment.systemPackages = [ pkgs.openarena ];
-      };
-
-  in
-  {
-    name = "openarena";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fpletz ];
+    {
+      imports = [ ./common/x11.nix ];
+      hardware.graphics.enable = true;
+      environment.systemPackages = [ pkgs.openarena ];
     };
 
-    nodes = {
-      server = {
-        services.openarena = {
-          enable = true;
-          extraFlags = [
-            "+set g_gametype 0"
-            "+map oa_dm7"
-            "+addbot Angelyss"
-            "+addbot Arachna"
-          ];
-          openPorts = true;
-        };
-      };
+in
+{
+  name = "openarena";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fpletz ];
+  };
 
-      client1 = client;
-      client2 = client;
+  nodes = {
+    server = {
+      services.openarena = {
+        enable = true;
+        extraFlags = [
+          "+set g_gametype 0"
+          "+map oa_dm7"
+          "+addbot Angelyss"
+          "+addbot Arachna"
+        ];
+        openPorts = true;
+      };
     };
 
-    testScript = ''
-      start_all()
+    client1 = client;
+    client2 = client;
+  };
 
-      server.wait_for_unit("openarena")
-      server.wait_until_succeeds("ss --numeric --udp --listening | grep -q 27960")
+  testScript = ''
+    start_all()
 
-      client1.wait_for_x()
-      client2.wait_for_x()
+    server.wait_for_unit("openarena")
+    server.wait_until_succeeds("ss --numeric --udp --listening | grep -q 27960")
 
-      client1.execute("openarena +set r_fullscreen 0 +set name Foo +connect server >&2 &")
-      client2.execute("openarena +set r_fullscreen 0 +set name Bar +connect server >&2 &")
+    client1.wait_for_x()
+    client2.wait_for_x()
 
-      server.wait_until_succeeds(
-          "journalctl -u openarena -e | grep -q 'Foo.*entered the game'"
-      )
-      server.wait_until_succeeds(
-          "journalctl -u openarena -e | grep -q 'Bar.*entered the game'"
-      )
+    client1.execute("openarena +set r_fullscreen 0 +set name Foo +connect server >&2 &")
+    client2.execute("openarena +set r_fullscreen 0 +set name Bar +connect server >&2 &")
 
-      server.sleep(10)  # wait for a while to get a nice screenshot
+    server.wait_until_succeeds(
+        "journalctl -u openarena -e | grep -q 'Foo.*entered the game'"
+    )
+    server.wait_until_succeeds(
+        "journalctl -u openarena -e | grep -q 'Bar.*entered the game'"
+    )
 
-      client1.screenshot("screen_client1_1")
-      client2.screenshot("screen_client2_1")
+    server.sleep(10)  # wait for a while to get a nice screenshot
 
-      client1.block()
+    client1.screenshot("screen_client1_1")
+    client2.screenshot("screen_client2_1")
 
-      server.sleep(10)
+    client1.block()
 
-      client1.screenshot("screen_client1_2")
-      client2.screenshot("screen_client2_2")
+    server.sleep(10)
 
-      client1.unblock()
+    client1.screenshot("screen_client1_2")
+    client2.screenshot("screen_client2_2")
 
-      server.sleep(10)
+    client1.unblock()
 
-      client1.screenshot("screen_client1_3")
-      client2.screenshot("screen_client2_3")
-    '';
+    server.sleep(10)
 
-  }
-)
+    client1.screenshot("screen_client1_3")
+    client2.screenshot("screen_client2_3")
+  '';
+
+}
diff --git a/nixos/tests/openldap.nix b/nixos/tests/openldap.nix
index f66aaec78048..b1b196d9c5ec 100644
--- a/nixos/tests/openldap.nix
+++ b/nixos/tests/openldap.nix
@@ -1,177 +1,178 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    dbContents = ''
-      dn: dc=example
-      objectClass: domain
-      dc: example
+{ pkgs, ... }:
+let
+  dbContents = ''
+    dn: dc=example
+    objectClass: domain
+    dc: example
 
-      dn: ou=users,dc=example
-      objectClass: organizationalUnit
-      ou: users
-    '';
+    dn: ou=users,dc=example
+    objectClass: organizationalUnit
+    ou: users
+  '';
 
-    ldifConfig = ''
-      dn: cn=config
-      cn: config
-      objectClass: olcGlobal
-      olcLogLevel: stats
+  ldifConfig = ''
+    dn: cn=config
+    cn: config
+    objectClass: olcGlobal
+    olcLogLevel: stats
 
-      dn: cn=schema,cn=config
-      cn: schema
-      objectClass: olcSchemaConfig
+    dn: cn=schema,cn=config
+    cn: schema
+    objectClass: olcSchemaConfig
 
-      include: file://${pkgs.openldap}/etc/schema/core.ldif
-      include: file://${pkgs.openldap}/etc/schema/cosine.ldif
-      include: file://${pkgs.openldap}/etc/schema/inetorgperson.ldif
+    include: file://${pkgs.openldap}/etc/schema/core.ldif
+    include: file://${pkgs.openldap}/etc/schema/cosine.ldif
+    include: file://${pkgs.openldap}/etc/schema/inetorgperson.ldif
 
-      dn: olcDatabase={0}config,cn=config
-      olcDatabase: {0}config
-      objectClass: olcDatabaseConfig
-      olcRootDN: cn=root,cn=config
-      olcRootPW: configpassword
+    dn: olcDatabase={0}config,cn=config
+    olcDatabase: {0}config
+    objectClass: olcDatabaseConfig
+    olcRootDN: cn=root,cn=config
+    olcRootPW: configpassword
 
-      dn: olcDatabase={1}mdb,cn=config
-      objectClass: olcDatabaseConfig
-      objectClass: olcMdbConfig
-      olcDatabase: {1}mdb
-      olcDbDirectory: /var/db/openldap
-      olcDbIndex: objectClass eq
-      olcSuffix: dc=example
-      olcRootDN: cn=root,dc=example
-      olcRootPW: notapassword
-    '';
+    dn: olcDatabase={1}mdb,cn=config
+    objectClass: olcDatabaseConfig
+    objectClass: olcMdbConfig
+    olcDatabase: {1}mdb
+    olcDbDirectory: /var/db/openldap
+    olcDbIndex: objectClass eq
+    olcSuffix: dc=example
+    olcRootDN: cn=root,dc=example
+    olcRootPW: notapassword
+  '';
 
-    ldapClientConfig = {
-      enable = true;
-      loginPam = false;
-      nsswitch = false;
-      server = "ldap://";
-      base = "dc=example";
-    };
+  ldapClientConfig = {
+    enable = true;
+    loginPam = false;
+    nsswitch = false;
+    server = "ldap://";
+    base = "dc=example";
+  };
 
-  in
-  {
-    name = "openldap";
+in
+{
+  name = "openldap";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.etc."openldap/root_password".text = "notapassword";
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      environment.etc."openldap/root_password".text = "notapassword";
 
-        users.ldap = ldapClientConfig;
+      users.ldap = ldapClientConfig;
 
-        services.openldap = {
-          enable = true;
-          urlList = [
-            "ldapi:///"
-            "ldap://"
-          ];
-          settings = {
-            children = {
-              "cn=schema".includes = [
-                "${pkgs.openldap}/etc/schema/core.ldif"
-                "${pkgs.openldap}/etc/schema/cosine.ldif"
-                "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
-                "${pkgs.openldap}/etc/schema/nis.ldif"
-              ];
-              "olcDatabase={0}config" = {
-                attrs = {
-                  objectClass = [ "olcDatabaseConfig" ];
-                  olcDatabase = "{0}config";
-                  olcRootDN = "cn=root,cn=config";
-                  olcRootPW = "configpassword";
-                };
+      services.openldap = {
+        enable = true;
+        urlList = [
+          "ldapi:///"
+          "ldap://"
+        ];
+        settings = {
+          children = {
+            "cn=schema".includes = [
+              "${pkgs.openldap}/etc/schema/core.ldif"
+              "${pkgs.openldap}/etc/schema/cosine.ldif"
+              "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
+              "${pkgs.openldap}/etc/schema/nis.ldif"
+            ];
+            "olcDatabase={0}config" = {
+              attrs = {
+                objectClass = [ "olcDatabaseConfig" ];
+                olcDatabase = "{0}config";
+                olcRootDN = "cn=root,cn=config";
+                olcRootPW = "configpassword";
               };
-              "olcDatabase={1}mdb" = {
-                # This tests string, base64 and path values, as well as lists of string values
-                attrs = {
-                  objectClass = [
-                    "olcDatabaseConfig"
-                    "olcMdbConfig"
-                  ];
-                  olcDatabase = "{1}mdb";
-                  olcDbDirectory = "/var/lib/openldap/db";
-                  olcSuffix = "dc=example";
-                  olcRootDN = {
-                    # cn=root,dc=example
-                    base64 = "Y249cm9vdCxkYz1leGFtcGxl";
-                  };
-                  olcRootPW = {
-                    path = "/etc/openldap/root_password";
-                  };
+            };
+            "olcDatabase={1}mdb" = {
+              # This tests string, base64 and path values, as well as lists of string values
+              attrs = {
+                objectClass = [
+                  "olcDatabaseConfig"
+                  "olcMdbConfig"
+                ];
+                olcDatabase = "{1}mdb";
+                olcDbDirectory = "/var/lib/openldap/db";
+                olcSuffix = "dc=example";
+                olcRootDN = {
+                  # cn=root,dc=example
+                  base64 = "Y249cm9vdCxkYz1leGFtcGxl";
+                };
+                olcRootPW = {
+                  path = "/etc/openldap/root_password";
                 };
               };
             };
           };
         };
-
-        specialisation = {
-          declarativeContents.configuration =
-            { ... }:
-            {
-              services.openldap.declarativeContents."dc=example" = dbContents;
-            };
-          mutableConfig.configuration =
-            { ... }:
-            {
-              services.openldap = {
-                declarativeContents."dc=example" = dbContents;
-                mutableConfig = true;
-              };
-            };
-          manualConfigDir = {
-            inheritParentConfig = false;
-            configuration =
-              { ... }:
-              {
-                users.ldap = ldapClientConfig;
-                services.openldap = {
-                  enable = true;
-                  configDir = "/var/db/slapd.d";
-                };
-              };
-          };
-        };
       };
-    testScript =
-      { nodes, ... }:
-      let
-        specializations = "${nodes.machine.system.build.toplevel}/specialisation";
-        changeRootPw = ''
-          dn: olcDatabase={1}mdb,cn=config
-          changetype: modify
-          replace: olcRootPW
-          olcRootPW: foobar
-        '';
-      in
-      ''
-        # Test startup with empty DB
-        machine.wait_for_unit("openldap.service")
 
-        with subtest("declarative contents"):
-          machine.succeed('${specializations}/declarativeContents/bin/switch-to-configuration test')
-          machine.wait_for_unit("openldap.service")
-          machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
-          machine.fail('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
+      specialisation = {
+        declarativeContents.configuration =
+          { ... }:
+          {
+            services.openldap.declarativeContents."dc=example" = dbContents;
+          };
+        mutableConfig.configuration =
+          { ... }:
+          {
+            services.openldap = {
+              declarativeContents."dc=example" = dbContents;
+              mutableConfig = true;
+            };
+          };
+        manualConfigDir = {
+          inheritParentConfig = false;
+          configuration =
+            { ... }:
+            {
+              nixpkgs.hostPlatform = config.nixpkgs.hostPlatform;
 
-        with subtest("mutable config"):
-          machine.succeed('${specializations}/mutableConfig/bin/switch-to-configuration test')
-          machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
-          machine.succeed('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
-          machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w foobar')
+              users.ldap = ldapClientConfig;
+              services.openldap = {
+                enable = true;
+                configDir = "/var/db/slapd.d";
+              };
+            };
+        };
+      };
+    };
 
-        with subtest("manual config dir"):
-          machine.succeed(
-            'mkdir /var/db/slapd.d /var/db/openldap',
-            'slapadd -F /var/db/slapd.d -n0 -l ${pkgs.writeText "config.ldif" ldifConfig}',
-            'slapadd -F /var/db/slapd.d -n1 -l ${pkgs.writeText "contents.ldif" dbContents}',
-            'chown -R openldap:openldap /var/db/slapd.d /var/db/openldap',
-            '${specializations}/manualConfigDir/bin/switch-to-configuration test',
-          )
-          machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
-          machine.succeed('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
-          machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w foobar')
+  testScript =
+    { nodes, ... }:
+    let
+      specializations = "${nodes.machine.system.build.toplevel}/specialisation";
+      changeRootPw = ''
+        dn: olcDatabase={1}mdb,cn=config
+        changetype: modify
+        replace: olcRootPW
+        olcRootPW: foobar
       '';
-  }
-)
+    in
+    ''
+      # Test startup with empty DB
+      machine.wait_for_unit("openldap.service")
+
+      with subtest("declarative contents"):
+        machine.succeed('${specializations}/declarativeContents/bin/switch-to-configuration test')
+        machine.wait_for_unit("openldap.service")
+        machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
+        machine.fail('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
+
+      with subtest("mutable config"):
+        machine.succeed('${specializations}/mutableConfig/bin/switch-to-configuration test')
+        machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
+        machine.succeed('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
+        machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w foobar')
+
+      with subtest("manual config dir"):
+        machine.succeed(
+          'mkdir /var/db/slapd.d /var/db/openldap',
+          'slapadd -F /var/db/slapd.d -n0 -l ${pkgs.writeText "config.ldif" ldifConfig}',
+          'slapadd -F /var/db/slapd.d -n1 -l ${pkgs.writeText "contents.ldif" dbContents}',
+          'chown -R openldap:openldap /var/db/slapd.d /var/db/openldap',
+          '${specializations}/manualConfigDir/bin/switch-to-configuration test',
+        )
+        machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
+        machine.succeed('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
+        machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w foobar')
+    '';
+}
diff --git a/nixos/tests/openresty-lua.nix b/nixos/tests/openresty-lua.nix
index 7141ef181039..8af2a0720eda 100644
--- a/nixos/tests/openresty-lua.nix
+++ b/nixos/tests/openresty-lua.nix
@@ -1,105 +1,103 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    luaLibs = [
-      pkgs.lua.pkgs.markdown
-    ];
+{ pkgs, lib, ... }:
+let
+  luaLibs = [
+    pkgs.lua.pkgs.markdown
+  ];
 
-    getLuaPath = lib: "${lib}/share/lua/${pkgs.lua.luaversion}/?.lua";
-    luaPath = lib.concatStringsSep ";" (map getLuaPath luaLibs);
-  in
-  {
-    name = "openresty-lua";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ bbigras ];
-    };
+  getLuaPath = lib: "${lib}/share/lua/${pkgs.lua.luaversion}/?.lua";
+  luaPath = lib.concatStringsSep ";" (map getLuaPath luaLibs);
+in
+{
+  name = "openresty-lua";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ bbigras ];
+  };
 
-    nodes = {
-      webserver =
-        { pkgs, lib, ... }:
-        {
-          networking = {
-            extraHosts = ''
-              127.0.0.1 default.test
-              127.0.0.1 sandbox.test
-            '';
-          };
-          services.nginx = {
-            enable = true;
-            package = pkgs.openresty;
+  nodes = {
+    webserver =
+      { pkgs, lib, ... }:
+      {
+        networking = {
+          extraHosts = ''
+            127.0.0.1 default.test
+            127.0.0.1 sandbox.test
+          '';
+        };
+        services.nginx = {
+          enable = true;
+          package = pkgs.openresty;
 
-            commonHttpConfig = ''
-              lua_package_path '${luaPath};;';
-            '';
+          commonHttpConfig = ''
+            lua_package_path '${luaPath};;';
+          '';
 
-            virtualHosts."default.test" = {
-              default = true;
-              locations."/" = {
-                extraConfig = ''
-                  default_type text/html;
-                  access_by_lua '
-                    local markdown = require "markdown"
-                    markdown("source")
-                  ';
-                '';
-              };
+          virtualHosts."default.test" = {
+            default = true;
+            locations."/" = {
+              extraConfig = ''
+                default_type text/html;
+                access_by_lua '
+                  local markdown = require "markdown"
+                  markdown("source")
+                ';
+              '';
             };
+          };
 
-            virtualHosts."sandbox.test" = {
-              locations."/test1-write" = {
-                extraConfig = ''
-                  content_by_lua_block {
-                    local create = os.execute('${pkgs.coreutils}/bin/mkdir /tmp/test1-read')
-                    local create = os.execute('${pkgs.coreutils}/bin/touch /tmp/test1-read/foo.txt')
-                    local echo = os.execute('${pkgs.coreutils}/bin/echo worked > /tmp/test1-read/foo.txt')
-                  }
-                '';
-              };
-              locations."/test1-read" = {
-                root = "/tmp";
-              };
-              locations."/test2-write" = {
-                extraConfig = ''
-                  content_by_lua_block {
-                    local create = os.execute('${pkgs.coreutils}/bin/mkdir /var/web/test2-read')
-                    local create = os.execute('${pkgs.coreutils}/bin/touch /var/web/test2-read/bar.txt')
-                    local echo = os.execute('${pkgs.coreutils}/bin/echo error-worked > /var/web/test2-read/bar.txt')
-                  }
-                '';
-              };
-              locations."/test2-read" = {
-                root = "/var/web";
-              };
+          virtualHosts."sandbox.test" = {
+            locations."/test1-write" = {
+              extraConfig = ''
+                content_by_lua_block {
+                  local create = os.execute('${pkgs.coreutils}/bin/mkdir /tmp/test1-read')
+                  local create = os.execute('${pkgs.coreutils}/bin/touch /tmp/test1-read/foo.txt')
+                  local echo = os.execute('${pkgs.coreutils}/bin/echo worked > /tmp/test1-read/foo.txt')
+                }
+              '';
+            };
+            locations."/test1-read" = {
+              root = "/tmp";
+            };
+            locations."/test2-write" = {
+              extraConfig = ''
+                content_by_lua_block {
+                  local create = os.execute('${pkgs.coreutils}/bin/mkdir /var/web/test2-read')
+                  local create = os.execute('${pkgs.coreutils}/bin/touch /var/web/test2-read/bar.txt')
+                  local echo = os.execute('${pkgs.coreutils}/bin/echo error-worked > /var/web/test2-read/bar.txt')
+                }
+              '';
+            };
+            locations."/test2-read" = {
+              root = "/var/web";
             };
           };
         };
-    };
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        url = "http://localhost"
+  testScript =
+    { nodes, ... }:
+    ''
+      url = "http://localhost"
 
-        webserver.wait_for_unit("nginx")
-        webserver.wait_for_open_port(80)
+      webserver.wait_for_unit("nginx")
+      webserver.wait_for_open_port(80)
 
-        http_code = webserver.succeed(
-          f"curl -w '%{{http_code}}' --head --fail {url}"
-        )
-        assert http_code.split("\n")[-1] == "200"
+      http_code = webserver.succeed(
+        f"curl -w '%{{http_code}}' --head --fail {url}"
+      )
+      assert http_code.split("\n")[-1] == "200"
 
-        # This test checks the creation and reading of a file in sandbox mode.
-        # Checking write in temporary folder
-        webserver.succeed("$(curl -vvv http://sandbox.test/test1-write)")
-        webserver.succeed('test "$(curl -fvvv http://sandbox.test/test1-read/foo.txt)" = worked')
-        # Checking write in protected folder. In sandbox mode for the nginx service, the folder /var/web is mounted
-        # in read-only mode.
-        webserver.succeed("mkdir -p /var/web")
-        webserver.succeed("chown nginx:nginx /var/web")
-        webserver.succeed("$(curl -vvv http://sandbox.test/test2-write)")
-        assert "404 Not Found" in machine.succeed(
-            "curl -vvv -s http://sandbox.test/test2-read/bar.txt"
-        )
-      '';
-  }
-)
+      # This test checks the creation and reading of a file in sandbox mode.
+      # Checking write in temporary folder
+      webserver.succeed("$(curl -vvv http://sandbox.test/test1-write)")
+      webserver.succeed('test "$(curl -fvvv http://sandbox.test/test1-read/foo.txt)" = worked')
+      # Checking write in protected folder. In sandbox mode for the nginx service, the folder /var/web is mounted
+      # in read-only mode.
+      webserver.succeed("mkdir -p /var/web")
+      webserver.succeed("chown nginx:nginx /var/web")
+      webserver.succeed("$(curl -vvv http://sandbox.test/test2-write)")
+      assert "404 Not Found" in machine.succeed(
+          "curl -vvv -s http://sandbox.test/test2-read/bar.txt"
+      )
+    '';
+}
diff --git a/nixos/tests/opensnitch.nix b/nixos/tests/opensnitch.nix
index dbb536e9a769..3f279037df2e 100644
--- a/nixos/tests/opensnitch.nix
+++ b/nixos/tests/opensnitch.nix
@@ -1,85 +1,83 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    monitorMethods = [
-      "ebpf"
-      "proc"
-      "ftrace"
-      "audit"
-    ];
-  in
-  {
-    name = "opensnitch";
+{ pkgs, lib, ... }:
+let
+  monitorMethods = [
+    "ebpf"
+    "proc"
+    "ftrace"
+    "audit"
+  ];
+in
+{
+  name = "opensnitch";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ onny ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ onny ];
+  };
 
-    nodes =
-      {
-        server = {
-          networking.firewall.allowedTCPPorts = [ 80 ];
-          services.caddy = {
-            enable = true;
-            virtualHosts."localhost".extraConfig = ''
-              respond "Hello, world!"
-            '';
-          };
+  nodes =
+    {
+      server = {
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        services.caddy = {
+          enable = true;
+          virtualHosts."localhost".extraConfig = ''
+            respond "Hello, world!"
+          '';
         };
-      }
-      // (lib.listToAttrs (
-        map (
-          m:
-          lib.nameValuePair "client_blocked_${m}" {
-            services.opensnitch = {
-              enable = true;
-              settings.DefaultAction = "deny";
-              settings.ProcMonitorMethod = m;
-            };
-          }
-        ) monitorMethods
-      ))
-      // (lib.listToAttrs (
-        map (
-          m:
-          lib.nameValuePair "client_allowed_${m}" {
-            services.opensnitch = {
-              enable = true;
-              settings.DefaultAction = "deny";
-              settings.ProcMonitorMethod = m;
-              rules = {
-                curl = {
-                  name = "curl";
-                  enabled = true;
-                  action = "allow";
-                  duration = "always";
-                  operator = {
-                    type = "simple";
-                    sensitive = false;
-                    operand = "process.path";
-                    data = "${pkgs.curl}/bin/curl";
-                  };
+      };
+    }
+    // (lib.listToAttrs (
+      map (
+        m:
+        lib.nameValuePair "client_blocked_${m}" {
+          services.opensnitch = {
+            enable = true;
+            settings.DefaultAction = "deny";
+            settings.ProcMonitorMethod = m;
+          };
+        }
+      ) monitorMethods
+    ))
+    // (lib.listToAttrs (
+      map (
+        m:
+        lib.nameValuePair "client_allowed_${m}" {
+          services.opensnitch = {
+            enable = true;
+            settings.DefaultAction = "deny";
+            settings.ProcMonitorMethod = m;
+            rules = {
+              curl = {
+                name = "curl";
+                enabled = true;
+                action = "allow";
+                duration = "always";
+                operator = {
+                  type = "simple";
+                  sensitive = false;
+                  operand = "process.path";
+                  data = "${pkgs.curl}/bin/curl";
                 };
               };
             };
-          }
-        ) monitorMethods
-      ));
+          };
+        }
+      ) monitorMethods
+    ));
 
-    testScript =
-      ''
-        start_all()
-        server.wait_for_unit("caddy.service")
-        server.wait_for_open_port(80)
-      ''
-      + lib.concatLines (
-        map (m: ''
-          client_blocked_${m}.wait_for_unit("opensnitchd.service")
-          client_blocked_${m}.fail("curl http://server")
+  testScript =
+    ''
+      start_all()
+      server.wait_for_unit("caddy.service")
+      server.wait_for_open_port(80)
+    ''
+    + lib.concatLines (
+      map (m: ''
+        client_blocked_${m}.wait_for_unit("opensnitchd.service")
+        client_blocked_${m}.fail("curl http://server")
 
-          client_allowed_${m}.wait_for_unit("opensnitchd.service")
-          client_allowed_${m}.succeed("curl http://server")
-        '') monitorMethods
-      );
-  }
-)
+        client_allowed_${m}.wait_for_unit("opensnitchd.service")
+        client_allowed_${m}.succeed("curl http://server")
+      '') monitorMethods
+    );
+}
diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix
index d7ddf478d91a..5f2b3e7969d1 100644
--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -1,359 +1,357 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    inherit (import ./ssh-keys.nix pkgs)
-      snakeOilPrivateKey
-      snakeOilPublicKey
-      snakeOilEd25519PrivateKey
-      snakeOilEd25519PublicKey
-      ;
-  in
-  {
-    name = "openssh";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ aszlig ];
-    };
+let
+  inherit (import ./ssh-keys.nix pkgs)
+    snakeOilPrivateKey
+    snakeOilPublicKey
+    snakeOilEd25519PrivateKey
+    snakeOilEd25519PublicKey
+    ;
+in
+{
+  name = "openssh";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ aszlig ];
+  };
 
-    nodes = {
+  nodes = {
 
-      server =
-        { ... }:
+    server =
+      { ... }:
 
-        {
-          services.openssh.enable = true;
-          security.pam.services.sshd.limits = [
-            {
-              domain = "*";
-              item = "memlock";
-              type = "-";
-              value = 1024;
-            }
-          ];
-          users.users.root.openssh.authorizedKeys.keys = [
-            snakeOilPublicKey
-          ];
-        };
-
-      server-allowed-users =
-        { ... }:
-
-        {
-          services.openssh = {
-            enable = true;
-            settings.AllowUsers = [
-              "alice"
-              "bob"
-            ];
-          };
-          users.groups = {
-            alice = { };
-            bob = { };
-            carol = { };
-          };
-          users.users = {
-            alice = {
-              isNormalUser = true;
-              group = "alice";
-              openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
-            };
-            bob = {
-              isNormalUser = true;
-              group = "bob";
-              openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
-            };
-            carol = {
-              isNormalUser = true;
-              group = "carol";
-              openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
-            };
-          };
-        };
-
-      server-lazy =
-        { ... }:
-
-        {
-          services.openssh = {
-            enable = true;
-            startWhenNeeded = true;
-          };
-          security.pam.services.sshd.limits = [
-            {
-              domain = "*";
-              item = "memlock";
-              type = "-";
-              value = 1024;
-            }
-          ];
-          users.users.root.openssh.authorizedKeys.keys = [
-            snakeOilPublicKey
-          ];
-        };
-
-      server-lazy-socket = {
-        virtualisation.vlans = [
-          1
-          2
+      {
+        services.openssh.enable = true;
+        security.pam.services.sshd.limits = [
+          {
+            domain = "*";
+            item = "memlock";
+            type = "-";
+            value = 1024;
+          }
         ];
+        users.users.root.openssh.authorizedKeys.keys = [
+          snakeOilPublicKey
+        ];
+      };
+
+    server-allowed-users =
+      { ... }:
+
+      {
+        services.openssh = {
+          enable = true;
+          settings.AllowUsers = [
+            "alice"
+            "bob"
+          ];
+        };
+        users.groups = {
+          alice = { };
+          bob = { };
+          carol = { };
+        };
+        users.users = {
+          alice = {
+            isNormalUser = true;
+            group = "alice";
+            openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+          };
+          bob = {
+            isNormalUser = true;
+            group = "bob";
+            openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+          };
+          carol = {
+            isNormalUser = true;
+            group = "carol";
+            openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+          };
+        };
+      };
+
+    server-lazy =
+      { ... }:
+
+      {
         services.openssh = {
           enable = true;
           startWhenNeeded = true;
-          ports = [ 2222 ];
-          listenAddresses = [ { addr = "0.0.0.0"; } ];
+        };
+        security.pam.services.sshd.limits = [
+          {
+            domain = "*";
+            item = "memlock";
+            type = "-";
+            value = 1024;
+          }
+        ];
+        users.users.root.openssh.authorizedKeys.keys = [
+          snakeOilPublicKey
+        ];
+      };
+
+    server-lazy-socket = {
+      virtualisation.vlans = [
+        1
+        2
+      ];
+      services.openssh = {
+        enable = true;
+        startWhenNeeded = true;
+        ports = [ 2222 ];
+        listenAddresses = [ { addr = "0.0.0.0"; } ];
+      };
+      users.users.root.openssh.authorizedKeys.keys = [
+        snakeOilPublicKey
+      ];
+    };
+
+    server-localhost-only =
+      { ... }:
+
+      {
+        services.openssh = {
+          enable = true;
+          listenAddresses = [
+            {
+              addr = "127.0.0.1";
+              port = 22;
+            }
+          ];
+        };
+      };
+
+    server-localhost-only-lazy =
+      { ... }:
+
+      {
+        services.openssh = {
+          enable = true;
+          startWhenNeeded = true;
+          listenAddresses = [
+            {
+              addr = "127.0.0.1";
+              port = 22;
+            }
+          ];
+        };
+      };
+
+    server-match-rule =
+      { ... }:
+
+      {
+        services.openssh = {
+          enable = true;
+          listenAddresses = [
+            {
+              addr = "127.0.0.1";
+              port = 22;
+            }
+            {
+              addr = "[::]";
+              port = 22;
+            }
+          ];
+          extraConfig = ''
+            # Combined test for two (predictable) Match criterias
+            Match LocalAddress 127.0.0.1 LocalPort 22
+              PermitRootLogin yes
+
+            # Separate tests for Match criterias
+            Match User root
+              PermitRootLogin yes
+            Match Group root
+              PermitRootLogin yes
+            Match Host nohost.example
+              PermitRootLogin yes
+            Match LocalAddress 127.0.0.1
+              PermitRootLogin yes
+            Match LocalPort 22
+              PermitRootLogin yes
+            Match RDomain nohost.example
+              PermitRootLogin yes
+            Match Address 127.0.0.1
+              PermitRootLogin yes
+          '';
+        };
+      };
+
+    server-no-openssl =
+      { ... }:
+      {
+        services.openssh = {
+          enable = true;
+          package = pkgs.opensshPackages.openssh.override {
+            linkOpenssl = false;
+          };
+          hostKeys = [
+            {
+              type = "ed25519";
+              path = "/etc/ssh/ssh_host_ed25519_key";
+            }
+          ];
+          settings = {
+            # Since this test is against an OpenSSH-without-OpenSSL,
+            # we have to override NixOS's defaults ciphers (which require OpenSSL)
+            # and instead set these to null, which will mean OpenSSH uses its defaults.
+            # Expectedly, OpenSSH's defaults don't require OpenSSL when it's compiled
+            # without OpenSSL.
+            Ciphers = null;
+            KexAlgorithms = null;
+            Macs = null;
+          };
+        };
+        users.users.root.openssh.authorizedKeys.keys = [
+          snakeOilEd25519PublicKey
+        ];
+      };
+
+    server-no-pam =
+      { pkgs, ... }:
+      {
+        services.openssh = {
+          enable = true;
+          package = pkgs.opensshPackages.openssh.override {
+            withPAM = false;
+          };
+          settings = {
+            UsePAM = false;
+          };
         };
         users.users.root.openssh.authorizedKeys.keys = [
           snakeOilPublicKey
         ];
       };
 
-      server-localhost-only =
-        { ... }:
+    client =
+      { ... }:
+      {
+        virtualisation.vlans = [
+          1
+          2
+        ];
+      };
 
-        {
-          services.openssh = {
-            enable = true;
-            listenAddresses = [
-              {
-                addr = "127.0.0.1";
-                port = 22;
-              }
-            ];
-          };
-        };
+  };
 
-      server-localhost-only-lazy =
-        { ... }:
+  testScript = ''
+    start_all()
 
-        {
-          services.openssh = {
-            enable = true;
-            startWhenNeeded = true;
-            listenAddresses = [
-              {
-                addr = "127.0.0.1";
-                port = 22;
-              }
-            ];
-          };
-        };
+    server.wait_for_unit("sshd", timeout=30)
+    server_allowed_users.wait_for_unit("sshd", timeout=30)
+    server_localhost_only.wait_for_unit("sshd", timeout=30)
+    server_match_rule.wait_for_unit("sshd", timeout=30)
+    server_no_openssl.wait_for_unit("sshd", timeout=30)
+    server_no_pam.wait_for_unit("sshd", timeout=30)
 
-      server-match-rule =
-        { ... }:
+    server_lazy.wait_for_unit("sshd.socket", timeout=30)
+    server_localhost_only_lazy.wait_for_unit("sshd.socket", timeout=30)
+    server_lazy_socket.wait_for_unit("sshd.socket", timeout=30)
 
-        {
-          services.openssh = {
-            enable = true;
-            listenAddresses = [
-              {
-                addr = "127.0.0.1";
-                port = 22;
-              }
-              {
-                addr = "[::]";
-                port = 22;
-              }
-            ];
-            extraConfig = ''
-              # Combined test for two (predictable) Match criterias
-              Match LocalAddress 127.0.0.1 LocalPort 22
-                PermitRootLogin yes
+    with subtest("manual-authkey"):
+        client.succeed(
+            '${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/id_ed25519 -N ""'
+        )
+        public_key = client.succeed(
+            "${pkgs.openssh}/bin/ssh-keygen -y -f /root/.ssh/id_ed25519"
+        )
+        public_key = public_key.strip()
+        client.succeed("chmod 600 /root/.ssh/id_ed25519")
 
-              # Separate tests for Match criterias
-              Match User root
-                PermitRootLogin yes
-              Match Group root
-                PermitRootLogin yes
-              Match Host nohost.example
-                PermitRootLogin yes
-              Match LocalAddress 127.0.0.1
-                PermitRootLogin yes
-              Match LocalPort 22
-                PermitRootLogin yes
-              Match RDomain nohost.example
-                PermitRootLogin yes
-              Match Address 127.0.0.1
-                PermitRootLogin yes
-            '';
-          };
-        };
+        server.succeed("echo '{}' > /root/.ssh/authorized_keys".format(public_key))
+        server_lazy.succeed("echo '{}' > /root/.ssh/authorized_keys".format(public_key))
 
-      server-no-openssl =
-        { ... }:
-        {
-          services.openssh = {
-            enable = true;
-            package = pkgs.opensshPackages.openssh.override {
-              linkOpenssl = false;
-            };
-            hostKeys = [
-              {
-                type = "ed25519";
-                path = "/etc/ssh/ssh_host_ed25519_key";
-              }
-            ];
-            settings = {
-              # Since this test is against an OpenSSH-without-OpenSSL,
-              # we have to override NixOS's defaults ciphers (which require OpenSSL)
-              # and instead set these to null, which will mean OpenSSH uses its defaults.
-              # Expectedly, OpenSSH's defaults don't require OpenSSL when it's compiled
-              # without OpenSSL.
-              Ciphers = null;
-              KexAlgorithms = null;
-              Macs = null;
-            };
-          };
-          users.users.root.openssh.authorizedKeys.keys = [
-            snakeOilEd25519PublicKey
-          ];
-        };
+        client.wait_for_unit("network.target")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2",
+            timeout=30
+        )
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024",
+            timeout=30
+        )
 
-      server-no-pam =
-        { pkgs, ... }:
-        {
-          services.openssh = {
-            enable = true;
-            package = pkgs.opensshPackages.openssh.override {
-              withPAM = false;
-            };
-            settings = {
-              UsePAM = false;
-            };
-          };
-          users.users.root.openssh.authorizedKeys.keys = [
-            snakeOilPublicKey
-          ];
-        };
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server-lazy 'echo hello world' >&2",
+            timeout=30
+        )
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server-lazy 'ulimit -l' | grep 1024",
+            timeout=30
+        )
 
-      client =
-        { ... }:
-        {
-          virtualisation.vlans = [
-            1
-            2
-          ];
-        };
+    with subtest("socket activation on a non-standard port"):
+        client.succeed(
+            "cat ${snakeOilPrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        # The final segment in this IP is allocated according to the alphabetical order of machines in this test.
+        client.succeed(
+            "ssh -p 2222 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.2.5 true",
+            timeout=30
+        )
 
-    };
+    with subtest("configured-authkey"):
+        client.succeed(
+            "cat ${snakeOilPrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server true",
+            timeout=30
+        )
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-lazy true",
+            timeout=30
+        )
 
-    testScript = ''
-      start_all()
+    with subtest("localhost-only"):
+        server_localhost_only.succeed("ss -nlt | grep '127.0.0.1:22'")
+        server_localhost_only_lazy.succeed("ss -nlt | grep '127.0.0.1:22'")
 
-      server.wait_for_unit("sshd", timeout=30)
-      server_allowed_users.wait_for_unit("sshd", timeout=30)
-      server_localhost_only.wait_for_unit("sshd", timeout=30)
-      server_match_rule.wait_for_unit("sshd", timeout=30)
-      server_no_openssl.wait_for_unit("sshd", timeout=30)
-      server_no_pam.wait_for_unit("sshd", timeout=30)
+    with subtest("match-rules"):
+        server_match_rule.succeed("ss -nlt | grep '127.0.0.1:22'")
 
-      server_lazy.wait_for_unit("sshd.socket", timeout=30)
-      server_localhost_only_lazy.wait_for_unit("sshd.socket", timeout=30)
-      server_lazy_socket.wait_for_unit("sshd.socket", timeout=30)
+    with subtest("allowed-users"):
+        client.succeed(
+            "cat ${snakeOilPrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil alice@server-allowed-users true",
+            timeout=30
+        )
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil bob@server-allowed-users true",
+            timeout=30
+        )
+        client.fail(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil carol@server-allowed-users true",
+            timeout=30
+        )
 
-      with subtest("manual-authkey"):
-          client.succeed(
-              '${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/id_ed25519 -N ""'
-          )
-          public_key = client.succeed(
-              "${pkgs.openssh}/bin/ssh-keygen -y -f /root/.ssh/id_ed25519"
-          )
-          public_key = public_key.strip()
-          client.succeed("chmod 600 /root/.ssh/id_ed25519")
+    with subtest("no-openssl"):
+        client.succeed(
+            "cat ${snakeOilEd25519PrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-no-openssl true",
+            timeout=30
+        )
 
-          server.succeed("echo '{}' > /root/.ssh/authorized_keys".format(public_key))
-          server_lazy.succeed("echo '{}' > /root/.ssh/authorized_keys".format(public_key))
+    with subtest("no-pam"):
+        client.succeed(
+            "cat ${snakeOilPrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-no-pam true",
+            timeout=30
+        )
 
-          client.wait_for_unit("network.target")
-          client.succeed(
-              "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2",
-              timeout=30
-          )
-          client.succeed(
-              "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024",
-              timeout=30
-          )
-
-          client.succeed(
-              "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server-lazy 'echo hello world' >&2",
-              timeout=30
-          )
-          client.succeed(
-              "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server-lazy 'ulimit -l' | grep 1024",
-              timeout=30
-          )
-
-      with subtest("socket activation on a non-standard port"):
-          client.succeed(
-              "cat ${snakeOilPrivateKey} > privkey.snakeoil"
-          )
-          client.succeed("chmod 600 privkey.snakeoil")
-          # The final segment in this IP is allocated according to the alphabetical order of machines in this test.
-          client.succeed(
-              "ssh -p 2222 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.2.5 true",
-              timeout=30
-          )
-
-      with subtest("configured-authkey"):
-          client.succeed(
-              "cat ${snakeOilPrivateKey} > privkey.snakeoil"
-          )
-          client.succeed("chmod 600 privkey.snakeoil")
-          client.succeed(
-              "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server true",
-              timeout=30
-          )
-          client.succeed(
-              "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-lazy true",
-              timeout=30
-          )
-
-      with subtest("localhost-only"):
-          server_localhost_only.succeed("ss -nlt | grep '127.0.0.1:22'")
-          server_localhost_only_lazy.succeed("ss -nlt | grep '127.0.0.1:22'")
-
-      with subtest("match-rules"):
-          server_match_rule.succeed("ss -nlt | grep '127.0.0.1:22'")
-
-      with subtest("allowed-users"):
-          client.succeed(
-              "cat ${snakeOilPrivateKey} > privkey.snakeoil"
-          )
-          client.succeed("chmod 600 privkey.snakeoil")
-          client.succeed(
-              "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil alice@server-allowed-users true",
-              timeout=30
-          )
-          client.succeed(
-              "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil bob@server-allowed-users true",
-              timeout=30
-          )
-          client.fail(
-              "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil carol@server-allowed-users true",
-              timeout=30
-          )
-
-      with subtest("no-openssl"):
-          client.succeed(
-              "cat ${snakeOilEd25519PrivateKey} > privkey.snakeoil"
-          )
-          client.succeed("chmod 600 privkey.snakeoil")
-          client.succeed(
-              "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-no-openssl true",
-              timeout=30
-          )
-
-      with subtest("no-pam"):
-          client.succeed(
-              "cat ${snakeOilPrivateKey} > privkey.snakeoil"
-          )
-          client.succeed("chmod 600 privkey.snakeoil")
-          client.succeed(
-              "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-no-pam true",
-              timeout=30
-          )
-
-      # None of the per-connection units should have failed.
-      server_lazy.fail("systemctl is-failed 'sshd@*.service'")
-    '';
-  }
-)
+    # None of the per-connection units should have failed.
+    server_lazy.fail("systemctl is-failed 'sshd@*.service'")
+  '';
+}
diff --git a/nixos/tests/opentabletdriver.nix b/nixos/tests/opentabletdriver.nix
index b7bdb16bf005..e97e3a5fe123 100644
--- a/nixos/tests/opentabletdriver.nix
+++ b/nixos/tests/opentabletdriver.nix
@@ -1,36 +1,34 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    testUser = "alice";
-  in
-  {
-    name = "opentabletdriver";
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ thiagokokada ];
+{ pkgs, ... }:
+let
+  testUser = "alice";
+in
+{
+  name = "opentabletdriver";
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ thiagokokada ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [
+        ./common/user-account.nix
+        ./common/x11.nix
+      ];
+      test-support.displayManager.auto.user = testUser;
+      hardware.opentabletdriver.enable = true;
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [
-          ./common/user-account.nix
-          ./common/x11.nix
-        ];
-        test-support.displayManager.auto.user = testUser;
-        hardware.opentabletdriver.enable = true;
-      };
+  testScript = ''
+    machine.start()
+    machine.wait_for_x()
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_x()
+    machine.wait_for_unit('graphical.target')
+    machine.wait_for_unit("opentabletdriver.service", "${testUser}")
 
-      machine.wait_for_unit('graphical.target')
-      machine.wait_for_unit("opentabletdriver.service", "${testUser}")
-
-      machine.succeed("cat /etc/udev/rules.d/70-opentabletdriver.rules")
-      # Will fail if service is not running
-      # Needs to run as the same user that started the service
-      machine.succeed("su - ${testUser} -c 'otd detect'")
-    '';
-  }
-)
+    machine.succeed("cat /etc/udev/rules.d/70-opentabletdriver.rules")
+    # Will fail if service is not running
+    # Needs to run as the same user that started the service
+    machine.succeed("su - ${testUser} -c 'otd detect'")
+  '';
+}
diff --git a/nixos/tests/opentelemetry-collector.nix b/nixos/tests/opentelemetry-collector.nix
index 1d8d4ea815c4..df319e5c7df9 100644
--- a/nixos/tests/opentelemetry-collector.nix
+++ b/nixos/tests/opentelemetry-collector.nix
@@ -1,87 +1,85 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    port = 4318;
-  in
-  {
-    name = "opentelemetry-collector";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ tylerjl ];
-    };
+{ pkgs, ... }:
+let
+  port = 4318;
+in
+{
+  name = "opentelemetry-collector";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ tylerjl ];
+  };
 
-    nodes.machine =
-      { ... }:
-      {
-        networking.firewall.allowedTCPPorts = [ port ];
-        services.opentelemetry-collector = {
-          enable = true;
-          settings = {
-            exporters.logging.verbosity = "detailed";
-            receivers.otlp.protocols = {
-              http.endpoint = "0.0.0.0:${toString port}";
-            };
-            service = {
-              pipelines.logs = {
-                receivers = [ "otlp" ];
-                exporters = [ "logging" ];
-              };
+  nodes.machine =
+    { ... }:
+    {
+      networking.firewall.allowedTCPPorts = [ port ];
+      services.opentelemetry-collector = {
+        enable = true;
+        settings = {
+          exporters.logging.verbosity = "detailed";
+          receivers.otlp.protocols = {
+            http.endpoint = "0.0.0.0:${toString port}";
+          };
+          service = {
+            pipelines.logs = {
+              receivers = [ "otlp" ];
+              exporters = [ "logging" ];
             };
           };
         };
-        virtualisation.forwardPorts = [
-          {
-            host.port = port;
-            guest.port = port;
-          }
-        ];
       };
-
-    extraPythonPackages = p: [
-      p.requests
-      p.types-requests
-    ];
-
-    # Send a log event through the OTLP pipeline and check for its
-    # presence in the collector logs.
-    testScript = # python
-      ''
-        import requests
-        import time
-
-        from uuid import uuid4
-
-        flag = str(uuid4())
-
-        machine.wait_for_unit("opentelemetry-collector.service")
-        machine.wait_for_open_port(${toString port})
-
-        event = {
-            "resourceLogs": [
-                {
-                    "resource": {"attributes": []},
-                    "scopeLogs": [
-                        {
-                            "logRecords": [
-                                {
-                                    "timeUnixNano": str(time.time_ns()),
-                                    "severityNumber": 9,
-                                    "severityText": "Info",
-                                    "name": "logTest",
-                                    "body": {
-                                        "stringValue": flag
-                                    },
-                                    "attributes": []
-                                },
-                            ]
-                        }
-                    ]
-                }
-            ]
+      virtualisation.forwardPorts = [
+        {
+          host.port = port;
+          guest.port = port;
         }
+      ];
+    };
 
-        response = requests.post("http://localhost:${toString port}/v1/logs", json=event)
-        assert response.status_code == 200
-        assert flag in machine.execute("journalctl -u opentelemetry-collector")[-1]
-      '';
-  }
-)
+  extraPythonPackages = p: [
+    p.requests
+    p.types-requests
+  ];
+
+  # Send a log event through the OTLP pipeline and check for its
+  # presence in the collector logs.
+  testScript = # python
+    ''
+      import requests
+      import time
+
+      from uuid import uuid4
+
+      flag = str(uuid4())
+
+      machine.wait_for_unit("opentelemetry-collector.service")
+      machine.wait_for_open_port(${toString port})
+
+      event = {
+          "resourceLogs": [
+              {
+                  "resource": {"attributes": []},
+                  "scopeLogs": [
+                      {
+                          "logRecords": [
+                              {
+                                  "timeUnixNano": str(time.time_ns()),
+                                  "severityNumber": 9,
+                                  "severityText": "Info",
+                                  "name": "logTest",
+                                  "body": {
+                                      "stringValue": flag
+                                  },
+                                  "attributes": []
+                              },
+                          ]
+                      }
+                  ]
+              }
+          ]
+      }
+
+      response = requests.post("http://localhost:${toString port}/v1/logs", json=event)
+      assert response.status_code == 200
+      assert flag in machine.execute("journalctl -u opentelemetry-collector")[-1]
+    '';
+}
diff --git a/nixos/tests/openvscode-server.nix b/nixos/tests/openvscode-server.nix
index eaef459530ba..89d3817b2cf3 100644
--- a/nixos/tests/openvscode-server.nix
+++ b/nixos/tests/openvscode-server.nix
@@ -1,26 +1,24 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "openvscode-server";
+{ pkgs, lib, ... }:
+{
+  name = "openvscode-server";
 
-    nodes = {
-      machine =
-        { pkgs, ... }:
-        {
-          services.openvscode-server = {
-            enable = true;
-            withoutConnectionToken = true;
-          };
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.openvscode-server = {
+          enable = true;
+          withoutConnectionToken = true;
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("openvscode-server.service")
-      machine.wait_for_open_port(3000)
-      machine.succeed("curl -k --fail http://localhost:3000", timeout=10)
-    '';
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("openvscode-server.service")
+    machine.wait_for_open_port(3000)
+    machine.succeed("curl -k --fail http://localhost:3000", timeout=10)
+  '';
 
-    meta.maintainers = [ lib.maintainers.drupol ];
-  }
-)
+  meta.maintainers = [ lib.maintainers.drupol ];
+}
diff --git a/nixos/tests/orangefs.nix b/nixos/tests/orangefs.nix
index d388826dbf62..fe9335f74981 100644
--- a/nixos/tests/orangefs.nix
+++ b/nixos/tests/orangefs.nix
@@ -1,91 +1,89 @@
-import ./make-test-python.nix (
-  { ... }:
+{ ... }:
 
-  let
-    server =
-      { pkgs, ... }:
-      {
-        networking.firewall.allowedTCPPorts = [ 3334 ];
-        boot.initrd.postDeviceCommands = ''
-          ${pkgs.e2fsprogs}/bin/mkfs.ext4 -L data /dev/vdb
-        '';
+let
+  server =
+    { pkgs, ... }:
+    {
+      networking.firewall.allowedTCPPorts = [ 3334 ];
+      boot.initrd.postDeviceCommands = ''
+        ${pkgs.e2fsprogs}/bin/mkfs.ext4 -L data /dev/vdb
+      '';
 
-        virtualisation.emptyDiskImages = [ 4096 ];
+      virtualisation.emptyDiskImages = [ 4096 ];
 
-        virtualisation.fileSystems = {
-          "/data" = {
-            device = "/dev/disk/by-label/data";
-            fsType = "ext4";
-          };
-        };
-
-        services.orangefs.server = {
-          enable = true;
-          dataStorageSpace = "/data/storage";
-          metadataStorageSpace = "/data/meta";
-          servers = {
-            server1 = "tcp://server1:3334";
-            server2 = "tcp://server2:3334";
-          };
+      virtualisation.fileSystems = {
+        "/data" = {
+          device = "/dev/disk/by-label/data";
+          fsType = "ext4";
         };
       };
 
-    client =
-      { lib, ... }:
-      {
-        networking.firewall.enable = true;
-
-        services.orangefs.client = {
-          enable = true;
-          fileSystems = [
-            {
-              target = "tcp://server1:3334/orangefs";
-              mountPoint = "/orangefs";
-            }
-          ];
+      services.orangefs.server = {
+        enable = true;
+        dataStorageSpace = "/data/storage";
+        metadataStorageSpace = "/data/meta";
+        servers = {
+          server1 = "tcp://server1:3334";
+          server2 = "tcp://server2:3334";
         };
       };
-
-  in
-  {
-    name = "orangefs";
-
-    nodes = {
-      server1 = server;
-      server2 = server;
-
-      client1 = client;
-      client2 = client;
     };
 
-    testScript = ''
-      # format storage
-      for server in server1, server2:
-          server.start()
-          server.wait_for_unit("multi-user.target")
-          server.succeed("mkdir -p /data/storage /data/meta")
-          server.succeed("chown orangefs:orangefs /data/storage /data/meta")
-          server.succeed("chmod 0770 /data/storage /data/meta")
-          server.succeed(
-              "sudo -g orangefs -u orangefs pvfs2-server -f /etc/orangefs/server.conf"
-          )
+  client =
+    { lib, ... }:
+    {
+      networking.firewall.enable = true;
 
-      # start services after storage is formatted on all machines
-      for server in server1, server2:
-          server.succeed("systemctl start orangefs-server.service")
+      services.orangefs.client = {
+        enable = true;
+        fileSystems = [
+          {
+            target = "tcp://server1:3334/orangefs";
+            mountPoint = "/orangefs";
+          }
+        ];
+      };
+    };
 
-      with subtest("clients can reach and mount the FS"):
-          for client in client1, client2:
-              client.start()
-              client.wait_for_unit("orangefs-client.service")
-              # Both servers need to be reachable
-              client.succeed("pvfs2-check-server -h server1 -f orangefs -n tcp -p 3334")
-              client.succeed("pvfs2-check-server -h server2 -f orangefs -n tcp -p 3334")
-              client.wait_for_unit("orangefs.mount")
+in
+{
+  name = "orangefs";
 
-      with subtest("R/W test between clients"):
-          client1.succeed("echo test > /orangefs/file1")
-          client2.succeed("grep test /orangefs/file1")
-    '';
-  }
-)
+  nodes = {
+    server1 = server;
+    server2 = server;
+
+    client1 = client;
+    client2 = client;
+  };
+
+  testScript = ''
+    # format storage
+    for server in server1, server2:
+        server.start()
+        server.wait_for_unit("multi-user.target")
+        server.succeed("mkdir -p /data/storage /data/meta")
+        server.succeed("chown orangefs:orangefs /data/storage /data/meta")
+        server.succeed("chmod 0770 /data/storage /data/meta")
+        server.succeed(
+            "sudo -g orangefs -u orangefs pvfs2-server -f /etc/orangefs/server.conf"
+        )
+
+    # start services after storage is formatted on all machines
+    for server in server1, server2:
+        server.succeed("systemctl start orangefs-server.service")
+
+    with subtest("clients can reach and mount the FS"):
+        for client in client1, client2:
+            client.start()
+            client.wait_for_unit("orangefs-client.service")
+            # Both servers need to be reachable
+            client.succeed("pvfs2-check-server -h server1 -f orangefs -n tcp -p 3334")
+            client.succeed("pvfs2-check-server -h server2 -f orangefs -n tcp -p 3334")
+            client.wait_for_unit("orangefs.mount")
+
+    with subtest("R/W test between clients"):
+        client1.succeed("echo test > /orangefs/file1")
+        client2.succeed("grep test /orangefs/file1")
+  '';
+}
diff --git a/nixos/tests/osrm-backend.nix b/nixos/tests/osrm-backend.nix
index 304450430888..ad9485d6a944 100644
--- a/nixos/tests/osrm-backend.nix
+++ b/nixos/tests/osrm-backend.nix
@@ -1,66 +1,64 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    port = 5000;
-  in
-  {
-    name = "osrm-backend";
-    meta.maintainers = [ lib.maintainers.erictapen ];
+{ pkgs, lib, ... }:
+let
+  port = 5000;
+in
+{
+  name = "osrm-backend";
+  meta.maintainers = [ lib.maintainers.erictapen ];
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
 
-        services.osrm = {
-          enable = true;
-          inherit port;
-          dataFile =
-            let
-              filename = "monaco";
-              osrm-data = pkgs.stdenv.mkDerivation {
-                name = "osrm-data";
+      services.osrm = {
+        enable = true;
+        inherit port;
+        dataFile =
+          let
+            filename = "monaco";
+            osrm-data = pkgs.stdenv.mkDerivation {
+              name = "osrm-data";
 
-                buildInputs = [ pkgs.osrm-backend ];
+              buildInputs = [ pkgs.osrm-backend ];
 
-                # This is a pbf file of monaco, downloaded at 2019-01-04 from
-                # http://download.geofabrik.de/europe/monaco-latest.osm.pbf
-                # as apparently no provider of OSM files guarantees immutability,
-                # this is hosted as a gist on GitHub.
-                src = pkgs.fetchgit {
-                  url = "https://gist.github.com/erictapen/01e39f73a6c856eac53ba809a94cdb83";
-                  rev = "9b1ff0f24deb40e5cf7df51f843dbe860637b8ce";
-                  sha256 = "1scqhmrfnpwsy5i2a9jpggqnvfgj4hv9p4qyvc79321pzkbv59nx";
-                };
-
-                buildCommand = ''
-                  cp $src/${filename}.osm.pbf .
-                  ${pkgs.osrm-backend}/bin/osrm-extract -p ${pkgs.osrm-backend}/share/osrm/profiles/car.lua ${filename}.osm.pbf
-                  ${pkgs.osrm-backend}/bin/osrm-partition ${filename}.osrm
-                  ${pkgs.osrm-backend}/bin/osrm-customize ${filename}.osrm
-                  mkdir -p $out
-                  cp ${filename}* $out/
-                '';
+              # This is a pbf file of monaco, downloaded at 2019-01-04 from
+              # http://download.geofabrik.de/europe/monaco-latest.osm.pbf
+              # as apparently no provider of OSM files guarantees immutability,
+              # this is hosted as a gist on GitHub.
+              src = pkgs.fetchgit {
+                url = "https://gist.github.com/erictapen/01e39f73a6c856eac53ba809a94cdb83";
+                rev = "9b1ff0f24deb40e5cf7df51f843dbe860637b8ce";
+                sha256 = "1scqhmrfnpwsy5i2a9jpggqnvfgj4hv9p4qyvc79321pzkbv59nx";
               };
-            in
-            "${osrm-data}/${filename}.osrm";
-        };
 
-        environment.systemPackages = [ pkgs.jq ];
+              buildCommand = ''
+                cp $src/${filename}.osm.pbf .
+                ${pkgs.osrm-backend}/bin/osrm-extract -p ${pkgs.osrm-backend}/share/osrm/profiles/car.lua ${filename}.osm.pbf
+                ${pkgs.osrm-backend}/bin/osrm-partition ${filename}.osrm
+                ${pkgs.osrm-backend}/bin/osrm-customize ${filename}.osrm
+                mkdir -p $out
+                cp ${filename}* $out/
+              '';
+            };
+          in
+          "${osrm-data}/${filename}.osrm";
       };
 
-    testScript =
-      let
-        query = "http://localhost:${toString port}/route/v1/driving/7.41720,43.73304;7.42463,43.73886?steps=true";
-      in
-      ''
-        machine.wait_for_unit("osrm.service")
-        machine.wait_for_open_port(${toString port})
-        assert "Boulevard Rainier III" in machine.succeed(
-            "curl --fail --silent '${query}' | jq .waypoints[0].name"
-        )
-        assert "Avenue de la Costa" in machine.succeed(
-            "curl --fail --silent '${query}' | jq .waypoints[1].name"
-        )
-      '';
-  }
-)
+      environment.systemPackages = [ pkgs.jq ];
+    };
+
+  testScript =
+    let
+      query = "http://localhost:${toString port}/route/v1/driving/7.41720,43.73304;7.42463,43.73886?steps=true";
+    in
+    ''
+      machine.wait_for_unit("osrm.service")
+      machine.wait_for_open_port(${toString port})
+      assert "Boulevard Rainier III" in machine.succeed(
+          "curl --fail --silent '${query}' | jq .waypoints[0].name"
+      )
+      assert "Avenue de la Costa" in machine.succeed(
+          "curl --fail --silent '${query}' | jq .waypoints[1].name"
+      )
+    '';
+}
diff --git a/nixos/tests/outline.nix b/nixos/tests/outline.nix
index 52f46f533878..e2691c205056 100644
--- a/nixos/tests/outline.nix
+++ b/nixos/tests/outline.nix
@@ -1,57 +1,55 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    accessKey = "BKIKJAA5BMMU2RHO6IBB";
-    secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
-    secretKeyFile = pkgs.writeText "outline-secret-key" ''
-      ${secretKey}
-    '';
-    rootCredentialsFile = pkgs.writeText "minio-credentials-full" ''
-      MINIO_ROOT_USER=${accessKey}
-      MINIO_ROOT_PASSWORD=${secretKey}
-    '';
-  in
-  {
-    name = "outline";
+{ pkgs, lib, ... }:
+let
+  accessKey = "BKIKJAA5BMMU2RHO6IBB";
+  secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
+  secretKeyFile = pkgs.writeText "outline-secret-key" ''
+    ${secretKey}
+  '';
+  rootCredentialsFile = pkgs.writeText "minio-credentials-full" ''
+    MINIO_ROOT_USER=${accessKey}
+    MINIO_ROOT_PASSWORD=${secretKey}
+  '';
+in
+{
+  name = "outline";
 
-    meta.maintainers = lib.teams.cyberus.members;
+  meta.maintainers = lib.teams.cyberus.members;
 
-    nodes = {
-      outline =
-        { pkgs, config, ... }:
-        {
-          nixpkgs.config.allowUnfree = true;
-          environment.systemPackages = [ pkgs.minio-client ];
-          services.outline = {
-            enable = true;
-            forceHttps = false;
-            storage = {
-              inherit accessKey secretKeyFile;
-              uploadBucketUrl = "http://localhost:9000";
-              uploadBucketName = "outline";
-              region = config.services.minio.region;
-            };
-          };
-          services.minio = {
-            enable = true;
-            inherit rootCredentialsFile;
-          };
+  node.pkgsReadOnly = false;
+
+  nodes.outline =
+    { pkgs, config, ... }:
+    {
+      nixpkgs.config.allowUnfree = true;
+      environment.systemPackages = [ pkgs.minio-client ];
+      services.outline = {
+        enable = true;
+        forceHttps = false;
+        storage = {
+          inherit accessKey secretKeyFile;
+          uploadBucketUrl = "http://localhost:9000";
+          uploadBucketName = "outline";
+          region = config.services.minio.region;
         };
+      };
+      services.minio = {
+        enable = true;
+        inherit rootCredentialsFile;
+      };
     };
 
-    testScript = ''
-      machine.wait_for_unit("minio.service")
-      machine.wait_for_open_port(9000)
+  testScript = ''
+    machine.wait_for_unit("minio.service")
+    machine.wait_for_open_port(9000)
 
-      # Create a test bucket on the server
-      machine.succeed(
-          "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
-      )
-      machine.succeed("mc mb minio/outline")
+    # Create a test bucket on the server
+    machine.succeed(
+        "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
+    )
+    machine.succeed("mc mb minio/outline")
 
-      outline.wait_for_unit("outline.service")
-      outline.wait_for_open_port(3000)
-      outline.succeed("curl --fail http://localhost:3000/")
-    '';
-  }
-)
+    outline.wait_for_unit("outline.service")
+    outline.wait_for_open_port(3000)
+    outline.succeed("curl --fail http://localhost:3000/")
+  '';
+}
diff --git a/nixos/tests/overlayfs.nix b/nixos/tests/overlayfs.nix
index cd4843229943..93300ed8e812 100644
--- a/nixos/tests/overlayfs.nix
+++ b/nixos/tests/overlayfs.nix
@@ -1,52 +1,50 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "overlayfs";
-    meta.maintainers = with pkgs.lib.maintainers; [ bachp ];
+{ pkgs, ... }:
+{
+  name = "overlayfs";
+  meta.maintainers = with pkgs.lib.maintainers; [ bachp ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        virtualisation.emptyDiskImages = [ 512 ];
-        networking.hostId = "deadbeef";
-        environment.systemPackages = with pkgs; [ parted ];
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.emptyDiskImages = [ 512 ];
+      networking.hostId = "deadbeef";
+      environment.systemPackages = with pkgs; [ parted ];
+    };
 
-    testScript = ''
-      machine.succeed("ls /dev")
+  testScript = ''
+    machine.succeed("ls /dev")
 
-      machine.succeed("mkdir -p /tmp/mnt")
+    machine.succeed("mkdir -p /tmp/mnt")
 
-      # Test ext4 + overlayfs
-      machine.succeed(
-        'mkfs.ext4 -F -L overlay-ext4 /dev/vdb',
-        'mount -t ext4 /dev/vdb /tmp/mnt',
-        'mkdir -p /tmp/mnt/upper /tmp/mnt/lower /tmp/mnt/work /tmp/mnt/merged',
-        # Setup some existing files
-        'echo Replace > /tmp/mnt/lower/replace.txt',
-        'echo Append > /tmp/mnt/lower/append.txt',
-        'echo Overwrite > /tmp/mnt/lower/overwrite.txt',
-        'mount -t overlay overlay -o lowerdir=/tmp/mnt/lower,upperdir=/tmp/mnt/upper,workdir=/tmp/mnt/work /tmp/mnt/merged',
-        # Test new
-        'echo New > /tmp/mnt/merged/new.txt',
-        '[[ "$(cat /tmp/mnt/merged/new.txt)" == New ]]',
-        # Test replace
-        '[[ "$(cat /tmp/mnt/merged/replace.txt)" == Replace ]]',
-        'echo Replaced > /tmp/mnt/merged/replace-tmp.txt',
-        'mv /tmp/mnt/merged/replace-tmp.txt /tmp/mnt/merged/replace.txt',
-        '[[ "$(cat /tmp/mnt/merged/replace.txt)" == Replaced ]]',
-        # Overwrite
-        '[[ "$(cat /tmp/mnt/merged/overwrite.txt)" == Overwrite ]]',
-        'echo Overwritten > /tmp/mnt/merged/overwrite.txt',
-        '[[ "$(cat /tmp/mnt/merged/overwrite.txt)" == Overwritten ]]',
-        # Test append
-        '[[ "$(cat /tmp/mnt/merged/append.txt)" == Append ]]',
-        'echo ed >> /tmp/mnt/merged/append.txt',
-        '[[ "$(cat /tmp/mnt/merged/append.txt)" == "Append\ned" ]]',
-        'umount /tmp/mnt/merged',
-        'umount /tmp/mnt',
-        'udevadm settle',
-      )
-    '';
-  }
-)
+    # Test ext4 + overlayfs
+    machine.succeed(
+      'mkfs.ext4 -F -L overlay-ext4 /dev/vdb',
+      'mount -t ext4 /dev/vdb /tmp/mnt',
+      'mkdir -p /tmp/mnt/upper /tmp/mnt/lower /tmp/mnt/work /tmp/mnt/merged',
+      # Setup some existing files
+      'echo Replace > /tmp/mnt/lower/replace.txt',
+      'echo Append > /tmp/mnt/lower/append.txt',
+      'echo Overwrite > /tmp/mnt/lower/overwrite.txt',
+      'mount -t overlay overlay -o lowerdir=/tmp/mnt/lower,upperdir=/tmp/mnt/upper,workdir=/tmp/mnt/work /tmp/mnt/merged',
+      # Test new
+      'echo New > /tmp/mnt/merged/new.txt',
+      '[[ "$(cat /tmp/mnt/merged/new.txt)" == New ]]',
+      # Test replace
+      '[[ "$(cat /tmp/mnt/merged/replace.txt)" == Replace ]]',
+      'echo Replaced > /tmp/mnt/merged/replace-tmp.txt',
+      'mv /tmp/mnt/merged/replace-tmp.txt /tmp/mnt/merged/replace.txt',
+      '[[ "$(cat /tmp/mnt/merged/replace.txt)" == Replaced ]]',
+      # Overwrite
+      '[[ "$(cat /tmp/mnt/merged/overwrite.txt)" == Overwrite ]]',
+      'echo Overwritten > /tmp/mnt/merged/overwrite.txt',
+      '[[ "$(cat /tmp/mnt/merged/overwrite.txt)" == Overwritten ]]',
+      # Test append
+      '[[ "$(cat /tmp/mnt/merged/append.txt)" == Append ]]',
+      'echo ed >> /tmp/mnt/merged/append.txt',
+      '[[ "$(cat /tmp/mnt/merged/append.txt)" == "Append\ned" ]]',
+      'umount /tmp/mnt/merged',
+      'umount /tmp/mnt',
+      'udevadm settle',
+    )
+  '';
+}
diff --git a/nixos/tests/owncast.nix b/nixos/tests/owncast.nix
index a081cd5b544d..14fa2a737a71 100644
--- a/nixos/tests/owncast.nix
+++ b/nixos/tests/owncast.nix
@@ -1,75 +1,73 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "owncast";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ MayNiklas ];
-    };
+{ pkgs, ... }:
+{
+  name = "owncast";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ MayNiklas ];
+  };
 
-    nodes = {
-      client =
-        { pkgs, ... }:
-        with pkgs.lib;
-        {
-          networking = {
-            dhcpcd.enable = false;
-            interfaces.eth1.ipv6.addresses = mkOverride 0 [
-              {
-                address = "fd00::2";
-                prefixLength = 64;
-              }
-            ];
-            interfaces.eth1.ipv4.addresses = mkOverride 0 [
-              {
-                address = "192.168.1.2";
-                prefixLength = 24;
-              }
-            ];
-          };
+  nodes = {
+    client =
+      { pkgs, ... }:
+      with pkgs.lib;
+      {
+        networking = {
+          dhcpcd.enable = false;
+          interfaces.eth1.ipv6.addresses = mkOverride 0 [
+            {
+              address = "fd00::2";
+              prefixLength = 64;
+            }
+          ];
+          interfaces.eth1.ipv4.addresses = mkOverride 0 [
+            {
+              address = "192.168.1.2";
+              prefixLength = 24;
+            }
+          ];
         };
-      server =
-        { pkgs, ... }:
-        with pkgs.lib;
-        {
-          networking = {
-            dhcpcd.enable = false;
-            useNetworkd = true;
-            useDHCP = false;
-            interfaces.eth1.ipv6.addresses = mkOverride 0 [
-              {
-                address = "fd00::1";
-                prefixLength = 64;
-              }
-            ];
-            interfaces.eth1.ipv4.addresses = mkOverride 0 [
-              {
-                address = "192.168.1.1";
-                prefixLength = 24;
-              }
-            ];
+      };
+    server =
+      { pkgs, ... }:
+      with pkgs.lib;
+      {
+        networking = {
+          dhcpcd.enable = false;
+          useNetworkd = true;
+          useDHCP = false;
+          interfaces.eth1.ipv6.addresses = mkOverride 0 [
+            {
+              address = "fd00::1";
+              prefixLength = 64;
+            }
+          ];
+          interfaces.eth1.ipv4.addresses = mkOverride 0 [
+            {
+              address = "192.168.1.1";
+              prefixLength = 24;
+            }
+          ];
 
-            firewall.allowedTCPPorts = [ 8080 ];
-          };
-
-          services.owncast = {
-            enable = true;
-            listen = "0.0.0.0";
-          };
+          firewall.allowedTCPPorts = [ 8080 ];
         };
-    };
 
-    testScript = ''
-      start_all()
+        services.owncast = {
+          enable = true;
+          listen = "0.0.0.0";
+        };
+      };
+  };
 
-      client.systemctl("start network-online.target")
-      server.systemctl("start network-online.target")
-      client.wait_for_unit("network-online.target")
-      server.wait_for_unit("network-online.target")
-      server.wait_for_unit("owncast.service")
-      server.wait_until_succeeds("ss -ntl | grep -q 8080")
+  testScript = ''
+    start_all()
 
-      client.succeed("curl http://192.168.1.1:8080/api/status")
-      client.succeed("curl http://[fd00::1]:8080/api/status")
-    '';
-  }
-)
+    client.systemctl("start network-online.target")
+    server.systemctl("start network-online.target")
+    client.wait_for_unit("network-online.target")
+    server.wait_for_unit("network-online.target")
+    server.wait_for_unit("owncast.service")
+    server.wait_until_succeeds("ss -ntl | grep -q 8080")
+
+    client.succeed("curl http://192.168.1.1:8080/api/status")
+    client.succeed("curl http://[fd00::1]:8080/api/status")
+  '';
+}
diff --git a/nixos/tests/pacemaker.nix b/nixos/tests/pacemaker.nix
index 6b711ad94552..826c4be7df14 100644
--- a/nixos/tests/pacemaker.nix
+++ b/nixos/tests/pacemaker.nix
@@ -1,118 +1,116 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  rec {
-    name = "pacemaker";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ astro ];
+{ pkgs, lib, ... }:
+rec {
+  name = "pacemaker";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ astro ];
+  };
+
+  nodes =
+    let
+      node = i: {
+        networking.interfaces.eth1.ipv4.addresses = [
+          {
+            address = "192.168.0.${toString i}";
+            prefixLength = 24;
+          }
+        ];
+
+        services.corosync = {
+          enable = true;
+          clusterName = "zentralwerk-network";
+          nodelist = lib.imap (i: name: {
+            nodeid = i;
+            inherit name;
+            ring_addrs = [
+              (builtins.head nodes.${name}.networking.interfaces.eth1.ipv4.addresses).address
+            ];
+          }) (builtins.attrNames nodes);
+        };
+        environment.etc."corosync/authkey" = {
+          source =
+            builtins.toFile "authkey"
+              # minimum length: 128 bytes
+              "testtesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttest";
+          mode = "0400";
+        };
+
+        services.pacemaker.enable = true;
+
+        # used for pacemaker resource
+        systemd.services.ha-cat = {
+          description = "Highly available netcat";
+          serviceConfig.ExecStart = "${pkgs.netcat}/bin/nc -l discard";
+        };
+      };
+    in
+    {
+      node1 = node 1;
+      node2 = node 2;
+      node3 = node 3;
     };
 
-    nodes =
-      let
-        node = i: {
-          networking.interfaces.eth1.ipv4.addresses = [
-            {
-              address = "192.168.0.${toString i}";
-              prefixLength = 24;
-            }
-          ];
-
-          services.corosync = {
-            enable = true;
-            clusterName = "zentralwerk-network";
-            nodelist = lib.imap (i: name: {
-              nodeid = i;
-              inherit name;
-              ring_addrs = [
-                (builtins.head nodes.${name}.networking.interfaces.eth1.ipv4.addresses).address
-              ];
-            }) (builtins.attrNames nodes);
-          };
-          environment.etc."corosync/authkey" = {
-            source =
-              builtins.toFile "authkey"
-                # minimum length: 128 bytes
-                "testtesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttest";
-            mode = "0400";
-          };
-
-          services.pacemaker.enable = true;
-
-          # used for pacemaker resource
-          systemd.services.ha-cat = {
-            description = "Highly available netcat";
-            serviceConfig.ExecStart = "${pkgs.netcat}/bin/nc -l discard";
-          };
-        };
-      in
-      {
-        node1 = node 1;
-        node2 = node 2;
-        node3 = node 3;
-      };
-
-    # sets up pacemaker with resources configuration, then crashes a
-    # node and waits for service restart on another node
-    testScript =
-      let
-        resources = builtins.toFile "cib-resources.xml" ''
-          <resources>
-            <primitive id="cat" class="systemd" type="ha-cat">
-              <operations>
-                <op id="stop-cat" name="start" interval="0" timeout="1s"/>
-                <op id="start-cat" name="start" interval="0" timeout="1s"/>
-                <op id="monitor-cat" name="monitor" interval="1s" timeout="1s"/>
-              </operations>
-            </primitive>
-          </resources>
-        '';
-      in
-      ''
-        import re
-        import time
-
-        start_all()
-
-        ${lib.concatMapStrings (node: ''
-          ${node}.wait_until_succeeds("corosync-quorumtool")
-          ${node}.wait_for_unit("pacemaker.service")
-        '') (builtins.attrNames nodes)}
-
-        # No STONITH device
-        node1.succeed("crm_attribute -t crm_config -n stonith-enabled -v false")
-        # Configure the cat resource
-        node1.succeed("cibadmin --replace --scope resources --xml-file ${resources}")
-
-        # wait until the service is started
-        while True:
-          output = node1.succeed("crm_resource -r cat --locate")
-          match = re.search("is running on: (.+)", output)
-          if match:
-            for machine in machines:
-              if machine.name == match.group(1):
-                current_node = machine
-            break
-          time.sleep(1)
-
-        current_node.log("Service running here!")
-        current_node.crash()
-
-        # pick another node that's still up
-        for machine in machines:
-          if machine.booted:
-            check_node = machine
-        # find where the service has been started next
-        while True:
-          output = check_node.succeed("crm_resource -r cat --locate")
-          match = re.search("is running on: (.+)", output)
-          # output will remain the old current_node until the crash is detected by pacemaker
-          if match and match.group(1) != current_node.name:
-            for machine in machines:
-              if machine.name == match.group(1):
-                next_node = machine
-            break
-          time.sleep(1)
-
-        next_node.log("Service migrated here!")
+  # sets up pacemaker with resources configuration, then crashes a
+  # node and waits for service restart on another node
+  testScript =
+    let
+      resources = builtins.toFile "cib-resources.xml" ''
+        <resources>
+          <primitive id="cat" class="systemd" type="ha-cat">
+            <operations>
+              <op id="stop-cat" name="start" interval="0" timeout="1s"/>
+              <op id="start-cat" name="start" interval="0" timeout="1s"/>
+              <op id="monitor-cat" name="monitor" interval="1s" timeout="1s"/>
+            </operations>
+          </primitive>
+        </resources>
       '';
-  }
-)
+    in
+    ''
+      import re
+      import time
+
+      start_all()
+
+      ${lib.concatMapStrings (node: ''
+        ${node}.wait_until_succeeds("corosync-quorumtool")
+        ${node}.wait_for_unit("pacemaker.service")
+      '') (builtins.attrNames nodes)}
+
+      # No STONITH device
+      node1.succeed("crm_attribute -t crm_config -n stonith-enabled -v false")
+      # Configure the cat resource
+      node1.succeed("cibadmin --replace --scope resources --xml-file ${resources}")
+
+      # wait until the service is started
+      while True:
+        output = node1.succeed("crm_resource -r cat --locate")
+        match = re.search("is running on: (.+)", output)
+        if match:
+          for machine in machines:
+            if machine.name == match.group(1):
+              current_node = machine
+          break
+        time.sleep(1)
+
+      current_node.log("Service running here!")
+      current_node.crash()
+
+      # pick another node that's still up
+      for machine in machines:
+        if machine.booted:
+          check_node = machine
+      # find where the service has been started next
+      while True:
+        output = check_node.succeed("crm_resource -r cat --locate")
+        match = re.search("is running on: (.+)", output)
+        # output will remain the old current_node until the crash is detected by pacemaker
+        if match and match.group(1) != current_node.name:
+          for machine in machines:
+            if machine.name == match.group(1):
+              next_node = machine
+          break
+        time.sleep(1)
+
+      next_node.log("Service migrated here!")
+    '';
+}
diff --git a/nixos/tests/packagekit.nix b/nixos/tests/packagekit.nix
index 1dc248217b11..edeaabc5463f 100644
--- a/nixos/tests/packagekit.nix
+++ b/nixos/tests/packagekit.nix
@@ -1,30 +1,28 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "packagekit";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ peterhoeg ];
+{ pkgs, ... }:
+{
+  name = "packagekit";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ peterhoeg ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      environment.systemPackages = with pkgs; [ dbus ];
+      services.packagekit = {
+        enable = true;
+      };
     };
 
-    nodes.machine =
-      { ... }:
-      {
-        environment.systemPackages = with pkgs; [ dbus ];
-        services.packagekit = {
-          enable = true;
-        };
-      };
+  testScript = ''
+    start_all()
 
-    testScript = ''
-      start_all()
+    # send a dbus message to activate the service
+    machine.succeed(
+        "dbus-send --system --type=method_call --print-reply --dest=org.freedesktop.PackageKit /org/freedesktop/PackageKit org.freedesktop.DBus.Introspectable.Introspect"
+    )
 
-      # send a dbus message to activate the service
-      machine.succeed(
-          "dbus-send --system --type=method_call --print-reply --dest=org.freedesktop.PackageKit /org/freedesktop/PackageKit org.freedesktop.DBus.Introspectable.Introspect"
-      )
-
-      # so now it should be running
-      machine.wait_for_unit("packagekit.service")
-    '';
-  }
-)
+    # so now it should be running
+    machine.wait_for_unit("packagekit.service")
+  '';
+}
diff --git a/nixos/tests/pam/pam-file-contents.nix b/nixos/tests/pam/pam-file-contents.nix
index 50551d8fd340..c0342ebaaf7b 100644
--- a/nixos/tests/pam/pam-file-contents.nix
+++ b/nixos/tests/pam/pam-file-contents.nix
@@ -1,32 +1,30 @@
 let
   name = "pam";
 in
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "pam-file-contents";
+{ pkgs, ... }:
+{
+  name = "pam-file-contents";
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ../../modules/profiles/minimal.nix ];
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ../../modules/profiles/minimal.nix ];
 
-        security.krb5.enable = true;
+      security.krb5.enable = true;
 
+      users = {
+        mutableUsers = false;
         users = {
-          mutableUsers = false;
-          users = {
-            user = {
-              isNormalUser = true;
-            };
+          user = {
+            isNormalUser = true;
           };
         };
       };
+    };
 
-    testScript =
-      builtins.replaceStrings
-        [ "@@pam@@" "@@pam_ccreds@@" "@@pam_krb5@@" ]
-        [ pkgs.pam.outPath pkgs.pam_ccreds.outPath pkgs.pam_krb5.outPath ]
-        (builtins.readFile ./test_chfn.py);
-  }
-)
+  testScript =
+    builtins.replaceStrings
+      [ "@@pam@@" "@@pam_ccreds@@" "@@pam_krb5@@" ]
+      [ pkgs.pam.outPath pkgs.pam_ccreds.outPath pkgs.pam_krb5.outPath ]
+      (builtins.readFile ./test_chfn.py);
+}
diff --git a/nixos/tests/pam/pam-oath-login.nix b/nixos/tests/pam/pam-oath-login.nix
index 25602b72d35c..f22d5607db4f 100644
--- a/nixos/tests/pam/pam-oath-login.nix
+++ b/nixos/tests/pam/pam-oath-login.nix
@@ -1,109 +1,107 @@
-import ../make-test-python.nix (
-  { ... }:
+{ ... }:
 
-  let
-    oathSnakeoilSecret = "cdd4083ef8ff1fa9178c6d46bfb1a3";
+let
+  oathSnakeoilSecret = "cdd4083ef8ff1fa9178c6d46bfb1a3";
 
-    # With HOTP mode the password is calculated based on a counter of
-    # how many passwords have been made. In this env, we'll always be on
-    # the 0th counter, so the password is static.
-    #
-    # Generated in nix-shell -p oath-toolkit
-    # via: oathtool -v -d6 -w10 cdd4083ef8ff1fa9178c6d46bfb1a3
-    # and picking a the first 4:
-    oathSnakeOilPassword1 = "143349";
-    oathSnakeOilPassword2 = "801753";
+  # With HOTP mode the password is calculated based on a counter of
+  # how many passwords have been made. In this env, we'll always be on
+  # the 0th counter, so the password is static.
+  #
+  # Generated in nix-shell -p oath-toolkit
+  # via: oathtool -v -d6 -w10 cdd4083ef8ff1fa9178c6d46bfb1a3
+  # and picking a the first 4:
+  oathSnakeOilPassword1 = "143349";
+  oathSnakeOilPassword2 = "801753";
 
-    alicePassword = "foobar";
-    # Generated via: mkpasswd -m sha-512 and passing in "foobar"
-    hashedAlicePassword = "$6$MsMrE1q.1HrCgTS$Vq2e/uILzYjSN836TobAyN9xh9oi7EmCmucnZID25qgPoibkw8qTCugiAPnn4eCGvn1A.7oEBFJaaGUaJsQQY.";
+  alicePassword = "foobar";
+  # Generated via: mkpasswd -m sha-512 and passing in "foobar"
+  hashedAlicePassword = "$6$MsMrE1q.1HrCgTS$Vq2e/uILzYjSN836TobAyN9xh9oi7EmCmucnZID25qgPoibkw8qTCugiAPnn4eCGvn1A.7oEBFJaaGUaJsQQY.";
 
-  in
-  {
-    name = "pam-oath-login";
+in
+{
+  name = "pam-oath-login";
 
-    nodes.machine =
-      { ... }:
-      {
-        security.pam.oath = {
-          enable = true;
-        };
-
-        users.users.alice = {
-          isNormalUser = true;
-          name = "alice";
-          uid = 1000;
-          hashedPassword = hashedAlicePassword;
-          extraGroups = [ "wheel" ];
-          createHome = true;
-          home = "/home/alice";
-        };
-
-        systemd.services.setupOathSnakeoilFile = {
-          wantedBy = [ "default.target" ];
-          before = [ "default.target" ];
-          unitConfig = {
-            type = "oneshot";
-            RemainAfterExit = true;
-          };
-          script = ''
-            touch /etc/users.oath
-            chmod 600 /etc/users.oath
-            chown root /etc/users.oath
-            echo "HOTP/E/6 alice - ${oathSnakeoilSecret}" > /etc/users.oath
-          '';
-        };
+  nodes.machine =
+    { ... }:
+    {
+      security.pam.oath = {
+        enable = true;
       };
 
-    testScript = ''
-      def switch_to_tty(tty_number):
-          machine.fail(f"pgrep -f 'agetty.*tty{tty_number}'")
-          machine.send_key(f"alt-f{tty_number}")
-          machine.wait_until_succeeds(f"[ $(fgconsole) = {tty_number} ]")
-          machine.wait_for_unit(f"getty@tty{tty_number}.service")
-          machine.wait_until_succeeds(f"pgrep -f 'agetty.*tty{tty_number}'")
+      users.users.alice = {
+        isNormalUser = true;
+        name = "alice";
+        uid = 1000;
+        hashedPassword = hashedAlicePassword;
+        extraGroups = [ "wheel" ];
+        createHome = true;
+        home = "/home/alice";
+      };
+
+      systemd.services.setupOathSnakeoilFile = {
+        wantedBy = [ "default.target" ];
+        before = [ "default.target" ];
+        unitConfig = {
+          type = "oneshot";
+          RemainAfterExit = true;
+        };
+        script = ''
+          touch /etc/users.oath
+          chmod 600 /etc/users.oath
+          chown root /etc/users.oath
+          echo "HOTP/E/6 alice - ${oathSnakeoilSecret}" > /etc/users.oath
+        '';
+      };
+    };
+
+  testScript = ''
+    def switch_to_tty(tty_number):
+        machine.fail(f"pgrep -f 'agetty.*tty{tty_number}'")
+        machine.send_key(f"alt-f{tty_number}")
+        machine.wait_until_succeeds(f"[ $(fgconsole) = {tty_number} ]")
+        machine.wait_for_unit(f"getty@tty{tty_number}.service")
+        machine.wait_until_succeeds(f"pgrep -f 'agetty.*tty{tty_number}'")
 
 
-      def enter_user_alice(tty_number):
-          machine.wait_until_tty_matches(tty_number, "login: ")
-          machine.send_chars("alice\n")
-          machine.wait_until_tty_matches(tty_number, "login: alice")
-          machine.wait_until_succeeds("pgrep login")
-          machine.wait_until_tty_matches(tty_number, "One-time password")
+    def enter_user_alice(tty_number):
+        machine.wait_until_tty_matches(tty_number, "login: ")
+        machine.send_chars("alice\n")
+        machine.wait_until_tty_matches(tty_number, "login: alice")
+        machine.wait_until_succeeds("pgrep login")
+        machine.wait_until_tty_matches(tty_number, "One-time password")
 
 
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
-      machine.screenshot("postboot")
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+    machine.screenshot("postboot")
 
-      with subtest("Invalid password"):
-          switch_to_tty("2")
-          enter_user_alice("2")
+    with subtest("Invalid password"):
+        switch_to_tty("2")
+        enter_user_alice("2")
 
-          machine.send_chars("${oathSnakeOilPassword1}\n")
-          machine.wait_until_tty_matches("2", "Password: ")
-          machine.send_chars("blorg\n")
-          machine.wait_until_tty_matches("2", "Login incorrect")
+        machine.send_chars("${oathSnakeOilPassword1}\n")
+        machine.wait_until_tty_matches("2", "Password: ")
+        machine.send_chars("blorg\n")
+        machine.wait_until_tty_matches("2", "Login incorrect")
 
-      with subtest("Invalid oath token"):
-          switch_to_tty("3")
-          enter_user_alice("3")
+    with subtest("Invalid oath token"):
+        switch_to_tty("3")
+        enter_user_alice("3")
 
-          machine.send_chars("000000\n")
-          machine.wait_until_tty_matches("3", "Login incorrect")
-          machine.wait_until_tty_matches("3", "login:")
+        machine.send_chars("000000\n")
+        machine.wait_until_tty_matches("3", "Login incorrect")
+        machine.wait_until_tty_matches("3", "login:")
 
-      with subtest("Happy path: Both passwords are mandatory to get us in"):
-          switch_to_tty("4")
-          enter_user_alice("4")
+    with subtest("Happy path: Both passwords are mandatory to get us in"):
+        switch_to_tty("4")
+        enter_user_alice("4")
 
-          machine.send_chars("${oathSnakeOilPassword2}\n")
-          machine.wait_until_tty_matches("4", "Password: ")
-          machine.send_chars("${alicePassword}\n")
+        machine.send_chars("${oathSnakeOilPassword2}\n")
+        machine.wait_until_tty_matches("4", "Password: ")
+        machine.send_chars("${alicePassword}\n")
 
-          machine.wait_until_succeeds("pgrep -u alice bash")
-          machine.send_chars("touch  done4\n")
-          machine.wait_for_file("/home/alice/done4")
-    '';
-  }
-)
+        machine.wait_until_succeeds("pgrep -u alice bash")
+        machine.send_chars("touch  done4\n")
+        machine.wait_for_file("/home/alice/done4")
+  '';
+}
diff --git a/nixos/tests/pam/pam-u2f.nix b/nixos/tests/pam/pam-u2f.nix
index c889cb9ee2fa..17b9e19e4cc5 100644
--- a/nixos/tests/pam/pam-u2f.nix
+++ b/nixos/tests/pam/pam-u2f.nix
@@ -1,31 +1,29 @@
-import ../make-test-python.nix (
-  { ... }:
+{ ... }:
 
-  {
-    name = "pam-u2f";
+{
+  name = "pam-u2f";
 
-    nodes.machine =
-      { ... }:
-      {
-        security.pam.u2f = {
-          enable = true;
-          control = "required";
-          settings = {
-            cue = true;
-            debug = true;
-            interactive = true;
-            origin = "nixos-test";
-            # Freeform option
-            userpresence = 1;
-          };
+  nodes.machine =
+    { ... }:
+    {
+      security.pam.u2f = {
+        enable = true;
+        control = "required";
+        settings = {
+          cue = true;
+          debug = true;
+          interactive = true;
+          origin = "nixos-test";
+          # Freeform option
+          userpresence = 1;
         };
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed(
-          'egrep "auth required .*/lib/security/pam_u2f.so.*cue.*debug.*interactive.*origin=nixos-test.*userpresence=1" /etc/pam.d/ -R'
-      )
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed(
+        'egrep "auth required .*/lib/security/pam_u2f.so.*cue.*debug.*interactive.*origin=nixos-test.*userpresence=1" /etc/pam.d/ -R'
+    )
+  '';
+}
diff --git a/nixos/tests/pam/pam-ussh.nix b/nixos/tests/pam/pam-ussh.nix
index c5eefd12aa3b..bdbbfe16b0fa 100644
--- a/nixos/tests/pam/pam-ussh.nix
+++ b/nixos/tests/pam/pam-ussh.nix
@@ -1,83 +1,81 @@
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    testOnlySSHCredentials =
-      pkgs.runCommand "pam-ussh-test-ca"
-        {
-          nativeBuildInputs = [ pkgs.openssh ];
-        }
-        ''
-          mkdir $out
-          ssh-keygen -t ed25519 -N "" -f $out/ca
-
-          ssh-keygen -t ed25519 -N "" -f $out/alice
-          ssh-keygen -s $out/ca -I "alice user key" -n "alice,root" -V 19700101:forever $out/alice.pub
-
-          ssh-keygen -t ed25519 -N "" -f $out/bob
-          ssh-keygen -s $out/ca -I "bob user key" -n "bob" -V 19700101:forever $out/bob.pub
-        '';
-    makeTestScript =
-      user:
-      pkgs.writeShellScript "pam-ussh-${user}-test-script" ''
-        set -euo pipefail
-
-        eval $(${pkgs.openssh}/bin/ssh-agent)
-
-        mkdir -p $HOME/.ssh
-        chmod 700 $HOME/.ssh
-        cp ${testOnlySSHCredentials}/${user}{,.pub,-cert.pub} $HOME/.ssh
-        chmod 600 $HOME/.ssh/${user}
-        chmod 644 $HOME/.ssh/${user}{,-cert}.pub
-
-        set -x
-
-        ${pkgs.openssh}/bin/ssh-add $HOME/.ssh/${user}
-        ${pkgs.openssh}/bin/ssh-add -l &>2
-
-        exec sudo id -u -n
-      '';
-  in
-  {
-    name = "pam-ussh";
-    meta.maintainers = with lib.maintainers; [ lukegb ];
-
-    machine =
-      { ... }:
+let
+  testOnlySSHCredentials =
+    pkgs.runCommand "pam-ussh-test-ca"
       {
-        users.users.alice = {
-          isNormalUser = true;
-          extraGroups = [ "wheel" ];
-        };
-        users.users.bob = {
-          isNormalUser = true;
-          extraGroups = [ "wheel" ];
-        };
+        nativeBuildInputs = [ pkgs.openssh ];
+      }
+      ''
+        mkdir $out
+        ssh-keygen -t ed25519 -N "" -f $out/ca
 
-        security.pam.ussh = {
-          enable = true;
-          authorizedPrincipals = "root";
-          caFile = "${testOnlySSHCredentials}/ca.pub";
-        };
+        ssh-keygen -t ed25519 -N "" -f $out/alice
+        ssh-keygen -s $out/ca -I "alice user key" -n "alice,root" -V 19700101:forever $out/alice.pub
 
-        security.sudo = {
-          enable = true;
-          extraConfig = ''
-            Defaults lecture="never"
-          '';
-        };
+        ssh-keygen -t ed25519 -N "" -f $out/bob
+        ssh-keygen -s $out/ca -I "bob user key" -n "bob" -V 19700101:forever $out/bob.pub
+      '';
+  makeTestScript =
+    user:
+    pkgs.writeShellScript "pam-ussh-${user}-test-script" ''
+      set -euo pipefail
+
+      eval $(${pkgs.openssh}/bin/ssh-agent)
+
+      mkdir -p $HOME/.ssh
+      chmod 700 $HOME/.ssh
+      cp ${testOnlySSHCredentials}/${user}{,.pub,-cert.pub} $HOME/.ssh
+      chmod 600 $HOME/.ssh/${user}
+      chmod 644 $HOME/.ssh/${user}{,-cert}.pub
+
+      set -x
+
+      ${pkgs.openssh}/bin/ssh-add $HOME/.ssh/${user}
+      ${pkgs.openssh}/bin/ssh-add -l &>2
+
+      exec sudo id -u -n
+    '';
+in
+{
+  name = "pam-ussh";
+  meta.maintainers = with lib.maintainers; [ lukegb ];
+
+  machine =
+    { ... }:
+    {
+      users.users.alice = {
+        isNormalUser = true;
+        extraGroups = [ "wheel" ];
+      };
+      users.users.bob = {
+        isNormalUser = true;
+        extraGroups = [ "wheel" ];
       };
 
-    testScript = ''
-      with subtest("alice should be allowed to escalate to root"):
-        machine.succeed(
-            'su -c "${makeTestScript "alice"}" -l alice | grep root'
-        )
+      security.pam.ussh = {
+        enable = true;
+        authorizedPrincipals = "root";
+        caFile = "${testOnlySSHCredentials}/ca.pub";
+      };
 
-      with subtest("bob should not be allowed to escalate to root"):
-        machine.fail(
-            'su -c "${makeTestScript "bob"}" -l bob | grep root'
-        )
-    '';
-  }
-)
+      security.sudo = {
+        enable = true;
+        extraConfig = ''
+          Defaults lecture="never"
+        '';
+      };
+    };
+
+  testScript = ''
+    with subtest("alice should be allowed to escalate to root"):
+      machine.succeed(
+          'su -c "${makeTestScript "alice"}" -l alice | grep root'
+      )
+
+    with subtest("bob should not be allowed to escalate to root"):
+      machine.fail(
+          'su -c "${makeTestScript "bob"}" -l bob | grep root'
+      )
+  '';
+}
diff --git a/nixos/tests/pam/zfs-key.nix b/nixos/tests/pam/zfs-key.nix
index 2a494eaa5702..9251a3a9173c 100644
--- a/nixos/tests/pam/zfs-key.nix
+++ b/nixos/tests/pam/zfs-key.nix
@@ -1,86 +1,84 @@
-import ../make-test-python.nix (
-  { ... }:
+{ ... }:
 
-  let
-    userPassword = "password";
-    mismatchPass = "mismatch";
-  in
-  {
-    name = "pam-zfs-key";
+let
+  userPassword = "password";
+  mismatchPass = "mismatch";
+in
+{
+  name = "pam-zfs-key";
 
-    nodes.machine =
-      { ... }:
-      {
-        boot.supportedFilesystems = [ "zfs" ];
+  nodes.machine =
+    { ... }:
+    {
+      boot.supportedFilesystems = [ "zfs" ];
 
-        networking.hostId = "12345678";
+      networking.hostId = "12345678";
 
-        security.pam.zfs.enable = true;
+      security.pam.zfs.enable = true;
 
-        users.users = {
-          alice = {
-            isNormalUser = true;
-            password = userPassword;
-          };
-          bob = {
-            isNormalUser = true;
-            password = userPassword;
-          };
+      users.users = {
+        alice = {
+          isNormalUser = true;
+          password = userPassword;
+        };
+        bob = {
+          isNormalUser = true;
+          password = userPassword;
         };
       };
+    };
 
-    testScript =
-      { nodes, ... }:
-      let
-        homes = nodes.machine.security.pam.zfs.homes;
-        pool = builtins.head (builtins.split "/" homes);
-      in
-      ''
-        machine.wait_for_unit("multi-user.target")
-        machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+  testScript =
+    { nodes, ... }:
+    let
+      homes = nodes.machine.security.pam.zfs.homes;
+      pool = builtins.head (builtins.split "/" homes);
+    in
+    ''
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
 
-        with subtest("Create encrypted ZFS datasets"):
-          machine.succeed("truncate -s 64M /testpool.img")
-          machine.succeed("zpool create -O canmount=off '${pool}' /testpool.img")
-          machine.succeed("zfs create -o canmount=off -p '${homes}'")
-          machine.succeed("echo ${userPassword} | zfs create -o canmount=noauto -o encryption=on -o keyformat=passphrase '${homes}/alice'")
-          machine.succeed("zfs unload-key '${homes}/alice'")
-          machine.succeed("echo ${mismatchPass} | zfs create -o canmount=noauto -o encryption=on -o keyformat=passphrase '${homes}/bob'")
-          machine.succeed("zfs unload-key '${homes}/bob'")
+      with subtest("Create encrypted ZFS datasets"):
+        machine.succeed("truncate -s 64M /testpool.img")
+        machine.succeed("zpool create -O canmount=off '${pool}' /testpool.img")
+        machine.succeed("zfs create -o canmount=off -p '${homes}'")
+        machine.succeed("echo ${userPassword} | zfs create -o canmount=noauto -o encryption=on -o keyformat=passphrase '${homes}/alice'")
+        machine.succeed("zfs unload-key '${homes}/alice'")
+        machine.succeed("echo ${mismatchPass} | zfs create -o canmount=noauto -o encryption=on -o keyformat=passphrase '${homes}/bob'")
+        machine.succeed("zfs unload-key '${homes}/bob'")
 
-        with subtest("Switch to tty2"):
-          machine.fail("pgrep -f 'agetty.*tty2'")
-          machine.send_key("alt-f2")
-          machine.wait_until_succeeds("[ $(fgconsole) = 2 ]")
-          machine.wait_for_unit("getty@tty2.service")
-          machine.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
+      with subtest("Switch to tty2"):
+        machine.fail("pgrep -f 'agetty.*tty2'")
+        machine.send_key("alt-f2")
+        machine.wait_until_succeeds("[ $(fgconsole) = 2 ]")
+        machine.wait_for_unit("getty@tty2.service")
+        machine.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
 
-        with subtest("Log in as user with home locked by login password"):
-          machine.wait_until_tty_matches("2", "login: ")
-          machine.send_chars("alice\n")
-          machine.wait_until_tty_matches("2", "login: alice")
-          machine.wait_until_succeeds("pgrep login")
-          machine.wait_until_tty_matches("2", "Password: ")
-          machine.send_chars("${userPassword}\n")
-          machine.wait_until_succeeds("pgrep -u alice bash")
-          machine.succeed("mount | grep ${homes}/alice")
+      with subtest("Log in as user with home locked by login password"):
+        machine.wait_until_tty_matches("2", "login: ")
+        machine.send_chars("alice\n")
+        machine.wait_until_tty_matches("2", "login: alice")
+        machine.wait_until_succeeds("pgrep login")
+        machine.wait_until_tty_matches("2", "Password: ")
+        machine.send_chars("${userPassword}\n")
+        machine.wait_until_succeeds("pgrep -u alice bash")
+        machine.succeed("mount | grep ${homes}/alice")
 
-        with subtest("Switch to tty3"):
-          machine.fail("pgrep -f 'agetty.*tty3'")
-          machine.send_key("alt-f3")
-          machine.wait_until_succeeds("[ $(fgconsole) = 3 ]")
-          machine.wait_for_unit("getty@tty3.service")
-          machine.wait_until_succeeds("pgrep -f 'agetty.*tty3'")
+      with subtest("Switch to tty3"):
+        machine.fail("pgrep -f 'agetty.*tty3'")
+        machine.send_key("alt-f3")
+        machine.wait_until_succeeds("[ $(fgconsole) = 3 ]")
+        machine.wait_for_unit("getty@tty3.service")
+        machine.wait_until_succeeds("pgrep -f 'agetty.*tty3'")
 
-        with subtest("Log in as user with home locked by password different from login"):
-          machine.wait_until_tty_matches("3", "login: ")
-          machine.send_chars("bob\n")
-          machine.wait_until_tty_matches("3", "login: bob")
-          machine.wait_until_succeeds("pgrep login")
-          machine.wait_until_tty_matches("3", "Password: ")
-          machine.send_chars("${userPassword}\n")
-          machine.wait_until_succeeds("pgrep -u bob bash")
-          machine.fail("mount | grep ${homes}/bob")
-      '';
-  }
-)
+      with subtest("Log in as user with home locked by password different from login"):
+        machine.wait_until_tty_matches("3", "login: ")
+        machine.send_chars("bob\n")
+        machine.wait_until_tty_matches("3", "login: bob")
+        machine.wait_until_succeeds("pgrep login")
+        machine.wait_until_tty_matches("3", "Password: ")
+        machine.send_chars("${userPassword}\n")
+        machine.wait_until_succeeds("pgrep -u bob bash")
+        machine.fail("mount | grep ${homes}/bob")
+    '';
+}
diff --git a/nixos/tests/pantheon-wayland.nix b/nixos/tests/pantheon-wayland.nix
index 74bc57eae78c..6bda9e508ef2 100644
--- a/nixos/tests/pantheon-wayland.nix
+++ b/nixos/tests/pantheon-wayland.nix
@@ -1,104 +1,102 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  {
-    name = "pantheon-wayland";
+{
+  name = "pantheon-wayland";
 
-    meta.maintainers = lib.teams.pantheon.members;
+  meta.maintainers = lib.teams.pantheon.members;
 
-    nodes.machine =
-      { nodes, ... }:
+  nodes.machine =
+    { nodes, ... }:
 
-      let
-        videosAutostart = pkgs.writeTextFile {
-          name = "autostart-elementary-videos";
-          destination = "/etc/xdg/autostart/io.elementary.videos.desktop";
-          text = ''
-            [Desktop Entry]
-            Version=1.0
-            Name=Videos
-            Type=Application
-            Terminal=false
-            Exec=io.elementary.videos %U
-          '';
-        };
-      in
-      {
-        imports = [ ./common/user-account.nix ];
+    let
+      videosAutostart = pkgs.writeTextFile {
+        name = "autostart-elementary-videos";
+        destination = "/etc/xdg/autostart/io.elementary.videos.desktop";
+        text = ''
+          [Desktop Entry]
+          Version=1.0
+          Name=Videos
+          Type=Application
+          Terminal=false
+          Exec=io.elementary.videos %U
+        '';
+      };
+    in
+    {
+      imports = [ ./common/user-account.nix ];
 
-        # Workaround ".gala-wrapped invoked oom-killer"
-        virtualisation.memorySize = 2047;
+      # Workaround ".gala-wrapped invoked oom-killer"
+      virtualisation.memorySize = 2047;
 
-        services.xserver.enable = true;
-        services.xserver.desktopManager.pantheon.enable = true;
-        services.displayManager = {
-          autoLogin.enable = true;
-          autoLogin.user = nodes.machine.users.users.alice.name;
-          defaultSession = "pantheon-wayland";
-        };
-
-        # We ship pantheon.appcenter by default when this is enabled.
-        services.flatpak.enable = true;
-
-        # For basic OCR tests.
-        environment.systemPackages = [ videosAutostart ];
-
-        # We don't ship gnome-text-editor in Pantheon module, we add this line mainly
-        # to catch eval issues related to this option.
-        environment.pantheon.excludePackages = [ pkgs.gnome-text-editor ];
+      services.xserver.enable = true;
+      services.xserver.desktopManager.pantheon.enable = true;
+      services.displayManager = {
+        autoLogin.enable = true;
+        autoLogin.user = nodes.machine.users.users.alice.name;
+        defaultSession = "pantheon-wayland";
       };
 
-    enableOCR = true;
+      # We ship pantheon.appcenter by default when this is enabled.
+      services.flatpak.enable = true;
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-      in
-      ''
-        machine.wait_for_unit("display-manager.service")
+      # For basic OCR tests.
+      environment.systemPackages = [ videosAutostart ];
 
-        with subtest("Wait for wayland server"):
-            machine.wait_for_file("/run/user/${toString user.uid}/wayland-0")
+      # We don't ship gnome-text-editor in Pantheon module, we add this line mainly
+      # to catch eval issues related to this option.
+      environment.pantheon.excludePackages = [ pkgs.gnome-text-editor ];
+    };
 
-        with subtest("Check that logging in has given the user ownership of devices"):
-            machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+  enableOCR = true;
 
-        with subtest("Check if Pantheon components actually start"):
-            # We specifically check gsd-xsettings here since it is manually pulled up by gala.
-            # https://github.com/elementary/gala/pull/2140
-            for i in ["gala", "io.elementary.wingpanel", "io.elementary.dock", "gsd-media-keys", "gsd-xsettings", "io.elementary.desktop.agent-polkit"]:
-                machine.wait_until_succeeds(f"pgrep -f {i}")
-            machine.wait_until_succeeds("pgrep -xf ${pkgs.pantheon.elementary-files}/libexec/io.elementary.files.xdg-desktop-portal")
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+    in
+    ''
+      machine.wait_for_unit("display-manager.service")
 
-        with subtest("Check if various environment variables are set"):
-            cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf ${pkgs.pantheon.gala}/bin/gala)/environ"
-            machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Pantheon'")
-            machine.succeed(f"{cmd} | grep 'XDG_SESSION_TYPE' | grep 'wayland'")
-            # Hopefully from the sessionPath option.
-            machine.succeed(f"{cmd} | grep 'XDG_DATA_DIRS' | grep 'gsettings-schemas/pantheon-agent-geoclue2'")
-            # Hopefully from login shell.
-            machine.succeed(f"{cmd} | grep '__NIXOS_SET_ENVIRONMENT_DONE' | grep '1'")
+      with subtest("Wait for wayland server"):
+          machine.wait_for_file("/run/user/${toString user.uid}/wayland-0")
 
-        with subtest("Wait for elementary videos autostart"):
-            machine.wait_until_succeeds("pgrep -f io.elementary.videos")
-            machine.wait_for_text("No Videos Open")
-            machine.screenshot("videos")
+      with subtest("Check that logging in has given the user ownership of devices"):
+          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
 
-        with subtest("Trigger multitasking view"):
-            cmd = "dbus-send --session --dest=org.pantheon.gala --print-reply /org/pantheon/gala org.pantheon.gala.PerformAction int32:1"
-            env = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus"
-            machine.succeed(f"su - ${user.name} -c '{env} {cmd}'")
-            machine.sleep(5)
-            machine.screenshot("multitasking")
-            machine.succeed(f"su - ${user.name} -c '{env} {cmd}'")
+      with subtest("Check if Pantheon components actually start"):
+          # We specifically check gsd-xsettings here since it is manually pulled up by gala.
+          # https://github.com/elementary/gala/pull/2140
+          for i in ["gala", "io.elementary.wingpanel", "io.elementary.dock", "gsd-media-keys", "gsd-xsettings", "io.elementary.desktop.agent-polkit"]:
+              machine.wait_until_succeeds(f"pgrep -f {i}")
+          machine.wait_until_succeeds("pgrep -xf ${pkgs.pantheon.elementary-files}/libexec/io.elementary.files.xdg-desktop-portal")
 
-        with subtest("Check if gala has ever coredumped"):
-            machine.fail("coredumpctl --json=short | grep gala")
-            # So we can see the dock.
-            machine.execute("pkill -f -9 io.elementary.videos")
-            machine.sleep(10)
-            machine.screenshot("screen")
-      '';
-  }
-)
+      with subtest("Check if various environment variables are set"):
+          cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf ${pkgs.pantheon.gala}/bin/gala)/environ"
+          machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Pantheon'")
+          machine.succeed(f"{cmd} | grep 'XDG_SESSION_TYPE' | grep 'wayland'")
+          # Hopefully from the sessionPath option.
+          machine.succeed(f"{cmd} | grep 'XDG_DATA_DIRS' | grep 'gsettings-schemas/pantheon-agent-geoclue2'")
+          # Hopefully from login shell.
+          machine.succeed(f"{cmd} | grep '__NIXOS_SET_ENVIRONMENT_DONE' | grep '1'")
+
+      with subtest("Wait for elementary videos autostart"):
+          machine.wait_until_succeeds("pgrep -f io.elementary.videos")
+          machine.wait_for_text("No Videos Open")
+          machine.screenshot("videos")
+
+      with subtest("Trigger multitasking view"):
+          cmd = "dbus-send --session --dest=org.pantheon.gala --print-reply /org/pantheon/gala org.pantheon.gala.PerformAction int32:1"
+          env = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus"
+          machine.succeed(f"su - ${user.name} -c '{env} {cmd}'")
+          machine.sleep(5)
+          machine.screenshot("multitasking")
+          machine.succeed(f"su - ${user.name} -c '{env} {cmd}'")
+
+      with subtest("Check if gala has ever coredumped"):
+          machine.fail("coredumpctl --json=short | grep gala")
+          # So we can see the dock.
+          machine.execute("pkill -f -9 io.elementary.videos")
+          machine.sleep(10)
+          machine.screenshot("screen")
+    '';
+}
diff --git a/nixos/tests/pantheon.nix b/nixos/tests/pantheon.nix
index 6392d193a34c..b8cb0512c542 100644
--- a/nixos/tests/pantheon.nix
+++ b/nixos/tests/pantheon.nix
@@ -1,116 +1,114 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  {
-    name = "pantheon";
+{
+  name = "pantheon";
 
-    meta.maintainers = lib.teams.pantheon.members;
+  meta.maintainers = lib.teams.pantheon.members;
 
-    nodes.machine =
-      { ... }:
+  nodes.machine =
+    { ... }:
 
-      {
-        imports = [ ./common/user-account.nix ];
+    {
+      imports = [ ./common/user-account.nix ];
 
-        # Workaround ".gala-wrapped invoked oom-killer"
-        virtualisation.memorySize = 2047;
+      # Workaround ".gala-wrapped invoked oom-killer"
+      virtualisation.memorySize = 2047;
 
-        services.xserver.enable = true;
-        services.xserver.desktopManager.pantheon.enable = true;
+      services.xserver.enable = true;
+      services.xserver.desktopManager.pantheon.enable = true;
 
-        # We ship pantheon.appcenter by default when this is enabled.
-        services.flatpak.enable = true;
+      # We ship pantheon.appcenter by default when this is enabled.
+      services.flatpak.enable = true;
 
-        # We don't ship gnome-text-editor in Pantheon module, we add this line mainly
-        # to catch eval issues related to this option.
-        environment.pantheon.excludePackages = [ pkgs.gnome-text-editor ];
+      # We don't ship gnome-text-editor in Pantheon module, we add this line mainly
+      # to catch eval issues related to this option.
+      environment.pantheon.excludePackages = [ pkgs.gnome-text-editor ];
 
-        environment.systemPackages = [ pkgs.xdotool ];
-      };
+      environment.systemPackages = [ pkgs.xdotool ];
+    };
 
-    enableOCR = true;
+  enableOCR = true;
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-        bob = nodes.machine.users.users.bob;
-      in
-      ''
-        machine.wait_for_unit("display-manager.service")
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+      bob = nodes.machine.users.users.bob;
+    in
+    ''
+      machine.wait_for_unit("display-manager.service")
 
-        with subtest("Test we can see usernames in elementary-greeter"):
-            machine.wait_for_text("${user.description}")
-            machine.wait_until_succeeds("pgrep -f io.elementary.greeter-compositor")
-            # OCR was struggling with this one.
-            # machine.wait_for_text("${bob.description}")
-            # Ensure the password box is focused by clicking it.
-            # Workaround for https://github.com/NixOS/nixpkgs/issues/211366.
-            machine.succeed("XAUTHORITY=/var/lib/lightdm/.Xauthority DISPLAY=:0 xdotool mousemove 512 505 click 1")
-            machine.sleep(2)
-            machine.screenshot("elementary_greeter_lightdm")
+      with subtest("Test we can see usernames in elementary-greeter"):
+          machine.wait_for_text("${user.description}")
+          machine.wait_until_succeeds("pgrep -f io.elementary.greeter-compositor")
+          # OCR was struggling with this one.
+          # machine.wait_for_text("${bob.description}")
+          # Ensure the password box is focused by clicking it.
+          # Workaround for https://github.com/NixOS/nixpkgs/issues/211366.
+          machine.succeed("XAUTHORITY=/var/lib/lightdm/.Xauthority DISPLAY=:0 xdotool mousemove 512 505 click 1")
+          machine.sleep(2)
+          machine.screenshot("elementary_greeter_lightdm")
 
-        with subtest("Login with elementary-greeter"):
-            machine.send_chars("${user.password}\n")
-            machine.wait_for_x()
-            machine.wait_for_file("${user.home}/.Xauthority")
-            machine.succeed("xauth merge ${user.home}/.Xauthority")
-            machine.wait_until_succeeds('journalctl -t gnome-session-binary --grep "Entering running state"')
+      with subtest("Login with elementary-greeter"):
+          machine.send_chars("${user.password}\n")
+          machine.wait_for_x()
+          machine.wait_for_file("${user.home}/.Xauthority")
+          machine.succeed("xauth merge ${user.home}/.Xauthority")
+          machine.wait_until_succeeds('journalctl -t gnome-session-binary --grep "Entering running state"')
 
-        with subtest("Check that logging in has given the user ownership of devices"):
-            machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+      with subtest("Check that logging in has given the user ownership of devices"):
+          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
 
-        with subtest("Check if Pantheon components actually start"):
-            for i in ["gala", "io.elementary.wingpanel", "io.elementary.dock", "gsd-media-keys", "io.elementary.desktop.agent-polkit"]:
-                machine.wait_until_succeeds(f"pgrep -f {i}")
-            for i in ["gala", "io.elementary.wingpanel", "io.elementary.dock"]:
-                machine.wait_for_window(i)
-            machine.wait_until_succeeds("pgrep -xf ${pkgs.pantheon.elementary-files}/libexec/io.elementary.files.xdg-desktop-portal")
+      with subtest("Check if Pantheon components actually start"):
+          for i in ["gala", "io.elementary.wingpanel", "io.elementary.dock", "gsd-media-keys", "io.elementary.desktop.agent-polkit"]:
+              machine.wait_until_succeeds(f"pgrep -f {i}")
+          for i in ["gala", "io.elementary.wingpanel", "io.elementary.dock"]:
+              machine.wait_for_window(i)
+          machine.wait_until_succeeds("pgrep -xf ${pkgs.pantheon.elementary-files}/libexec/io.elementary.files.xdg-desktop-portal")
 
-        with subtest("Check if various environment variables are set"):
-            cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf ${pkgs.pantheon.gala}/bin/gala)/environ"
-            machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Pantheon'")
-            # Hopefully from the sessionPath option.
-            machine.succeed(f"{cmd} | grep 'XDG_DATA_DIRS' | grep 'gsettings-schemas/pantheon-agent-geoclue2'")
-            # Hopefully from login shell.
-            machine.succeed(f"{cmd} | grep '__NIXOS_SET_ENVIRONMENT_DONE' | grep '1'")
+      with subtest("Check if various environment variables are set"):
+          cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf ${pkgs.pantheon.gala}/bin/gala)/environ"
+          machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Pantheon'")
+          # Hopefully from the sessionPath option.
+          machine.succeed(f"{cmd} | grep 'XDG_DATA_DIRS' | grep 'gsettings-schemas/pantheon-agent-geoclue2'")
+          # Hopefully from login shell.
+          machine.succeed(f"{cmd} | grep '__NIXOS_SET_ENVIRONMENT_DONE' | grep '1'")
 
-        with subtest("Open elementary videos"):
-            machine.execute("su - ${user.name} -c 'DISPLAY=:0 io.elementary.videos >&2 &'")
-            machine.sleep(2)
-            machine.wait_for_window("io.elementary.videos")
-            machine.wait_for_text("No Videos Open")
+      with subtest("Open elementary videos"):
+          machine.execute("su - ${user.name} -c 'DISPLAY=:0 io.elementary.videos >&2 &'")
+          machine.sleep(2)
+          machine.wait_for_window("io.elementary.videos")
+          machine.wait_for_text("No Videos Open")
 
-        with subtest("Open elementary calendar"):
-            machine.wait_until_succeeds("pgrep -f evolution-calendar-factory")
-            machine.execute("su - ${user.name} -c 'DISPLAY=:0 io.elementary.calendar >&2 &'")
-            machine.sleep(2)
-            machine.wait_for_window("io.elementary.calendar")
+      with subtest("Open elementary calendar"):
+          machine.wait_until_succeeds("pgrep -f evolution-calendar-factory")
+          machine.execute("su - ${user.name} -c 'DISPLAY=:0 io.elementary.calendar >&2 &'")
+          machine.sleep(2)
+          machine.wait_for_window("io.elementary.calendar")
 
-        with subtest("Open system settings"):
-            machine.execute("su - ${user.name} -c 'DISPLAY=:0 io.elementary.settings >&2 &'")
-            # Wait for all plugins to be loaded before we check if the window is still there.
-            machine.sleep(5)
-            machine.wait_for_window("io.elementary.settings")
+      with subtest("Open system settings"):
+          machine.execute("su - ${user.name} -c 'DISPLAY=:0 io.elementary.settings >&2 &'")
+          # Wait for all plugins to be loaded before we check if the window is still there.
+          machine.sleep(5)
+          machine.wait_for_window("io.elementary.settings")
 
-        with subtest("Open elementary terminal"):
-            machine.execute("su - ${user.name} -c 'DISPLAY=:0 io.elementary.terminal >&2 &'")
-            machine.wait_for_window("io.elementary.terminal")
+      with subtest("Open elementary terminal"):
+          machine.execute("su - ${user.name} -c 'DISPLAY=:0 io.elementary.terminal >&2 &'")
+          machine.wait_for_window("io.elementary.terminal")
 
-        with subtest("Trigger multitasking view"):
-            cmd = "dbus-send --session --dest=org.pantheon.gala --print-reply /org/pantheon/gala org.pantheon.gala.PerformAction int32:1"
-            env = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus DISPLAY=:0"
-            machine.succeed(f"su - ${user.name} -c '{env} {cmd}'")
-            machine.sleep(5)
-            machine.screenshot("multitasking")
-            machine.succeed(f"su - ${user.name} -c '{env} {cmd}'")
+      with subtest("Trigger multitasking view"):
+          cmd = "dbus-send --session --dest=org.pantheon.gala --print-reply /org/pantheon/gala org.pantheon.gala.PerformAction int32:1"
+          env = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${toString user.uid}/bus DISPLAY=:0"
+          machine.succeed(f"su - ${user.name} -c '{env} {cmd}'")
+          machine.sleep(5)
+          machine.screenshot("multitasking")
+          machine.succeed(f"su - ${user.name} -c '{env} {cmd}'")
 
-        with subtest("Check if gala has ever coredumped"):
-            machine.fail("coredumpctl --json=short | grep gala")
-            # So you can see the dock in the below screenshot.
-            machine.succeed("su - ${user.name} -c 'DISPLAY=:0 xdotool mousemove 450 1000 >&2 &'")
-            machine.sleep(10)
-            machine.screenshot("screen")
-      '';
-  }
-)
+      with subtest("Check if gala has ever coredumped"):
+          machine.fail("coredumpctl --json=short | grep gala")
+          # So you can see the dock in the below screenshot.
+          machine.succeed("su - ${user.name} -c 'DISPLAY=:0 xdotool mousemove 450 1000 >&2 &'")
+          machine.sleep(10)
+          machine.screenshot("screen")
+    '';
+}
diff --git a/nixos/tests/paperless.nix b/nixos/tests/paperless.nix
index 28ec877f2435..d35d909e690f 100644
--- a/nixos/tests/paperless.nix
+++ b/nixos/tests/paperless.nix
@@ -1,127 +1,125 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "paperless";
-    meta.maintainers = with lib.maintainers; [
-      leona
-      SuperSandro2000
-      erikarvstedt
-    ];
+{ lib, ... }:
+{
+  name = "paperless";
+  meta.maintainers = with lib.maintainers; [
+    leona
+    SuperSandro2000
+    erikarvstedt
+  ];
 
-    nodes =
-      let
-        self = {
-          simple =
-            { pkgs, ... }:
-            {
-              environment.systemPackages = with pkgs; [
-                imagemagick
-                jq
-              ];
-              services.paperless = {
+  nodes =
+    let
+      self = {
+        simple =
+          { pkgs, ... }:
+          {
+            environment.systemPackages = with pkgs; [
+              imagemagick
+              jq
+            ];
+            services.paperless = {
+              enable = true;
+              passwordFile = builtins.toFile "password" "admin";
+
+              exporter = {
                 enable = true;
-                passwordFile = builtins.toFile "password" "admin";
 
-                exporter = {
-                  enable = true;
-
-                  settings = {
-                    "no-color" = lib.mkForce false; # override a default option
-                    "no-thumbnail" = true; # add a new option
-                  };
+                settings = {
+                  "no-color" = lib.mkForce false; # override a default option
+                  "no-thumbnail" = true; # add a new option
                 };
               };
             };
-          postgres =
-            { config, pkgs, ... }:
-            {
-              imports = [ self.simple ];
-              services.paperless.database.createLocally = true;
-              services.paperless.settings = {
-                PAPERLESS_OCR_LANGUAGE = "deu";
-              };
+          };
+        postgres =
+          { config, pkgs, ... }:
+          {
+            imports = [ self.simple ];
+            services.paperless.database.createLocally = true;
+            services.paperless.settings = {
+              PAPERLESS_OCR_LANGUAGE = "deu";
             };
-        };
-      in
-      self;
+          };
+      };
+    in
+    self;
 
-    testScript = ''
-      import json
+  testScript = ''
+    import json
 
-      def test_paperless(node):
-        node.wait_for_unit("paperless-consumer.service")
+    def test_paperless(node):
+      node.wait_for_unit("paperless-consumer.service")
 
-        with subtest("Add a document via the file system"):
-          node.succeed(
-            "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black "
-            "-annotate +5+20 'hello world 16-10-2005' /var/lib/paperless/consume/doc.png"
-          )
+      with subtest("Add a document via the file system"):
+        node.succeed(
+          "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black "
+          "-annotate +5+20 'hello world 16-10-2005' /var/lib/paperless/consume/doc.png"
+        )
 
-        with subtest("Web interface gets ready"):
+      with subtest("Web interface gets ready"):
+        node.wait_for_unit("paperless-web.service")
+        # Wait until server accepts connections
+        node.wait_until_succeeds("curl -fs localhost:28981")
+
+      # Required for consuming documents via the web interface
+      with subtest("Task-queue gets ready"):
+        node.wait_for_unit("paperless-task-queue.service")
+
+      with subtest("Add a png document via the web interface"):
+        node.succeed(
+          "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black "
+          "-annotate +5+20 'hello web 16-10-2005' /tmp/webdoc.png"
+        )
+        node.wait_until_succeeds("curl -u admin:admin -F document=@/tmp/webdoc.png -fs localhost:28981/api/documents/post_document/")
+
+      with subtest("Add a txt document via the web interface"):
+        node.succeed(
+          "echo 'hello web 16-10-2005' > /tmp/webdoc.txt"
+        )
+        node.wait_until_succeeds("curl -u admin:admin -F document=@/tmp/webdoc.txt -fs localhost:28981/api/documents/post_document/")
+
+      with subtest("Documents are consumed"):
+        node.wait_until_succeeds(
+          "(($(curl -u admin:admin -fs localhost:28981/api/documents/ | jq .count) == 3))"
+        )
+        docs = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/"))['results']
+        assert "2005-10-16" in docs[0]['created']
+        assert "2005-10-16" in docs[1]['created']
+        assert "2005-10-16" in docs[2]['created']
+
+      # Detects gunicorn issues, see PR #190888
+      with subtest("Document metadata can be accessed"):
+        metadata = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/1/metadata/"))
+        assert "original_checksum" in metadata
+
+        metadata = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/2/metadata/"))
+        assert "original_checksum" in metadata
+
+        metadata = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/3/metadata/"))
+        assert "original_checksum" in metadata
+
+      with subtest("Exporter"):
+          node.succeed("systemctl start --wait paperless-exporter")
           node.wait_for_unit("paperless-web.service")
-          # Wait until server accepts connections
-          node.wait_until_succeeds("curl -fs localhost:28981")
-
-        # Required for consuming documents via the web interface
-        with subtest("Task-queue gets ready"):
+          node.wait_for_unit("paperless-consumer.service")
+          node.wait_for_unit("paperless-scheduler.service")
           node.wait_for_unit("paperless-task-queue.service")
 
-        with subtest("Add a png document via the web interface"):
-          node.succeed(
-            "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black "
-            "-annotate +5+20 'hello web 16-10-2005' /tmp/webdoc.png"
-          )
-          node.wait_until_succeeds("curl -u admin:admin -F document=@/tmp/webdoc.png -fs localhost:28981/api/documents/post_document/")
+          node.succeed("ls -lah /var/lib/paperless/export/manifest.json")
 
-        with subtest("Add a txt document via the web interface"):
-          node.succeed(
-            "echo 'hello web 16-10-2005' > /tmp/webdoc.txt"
-          )
-          node.wait_until_succeeds("curl -u admin:admin -F document=@/tmp/webdoc.txt -fs localhost:28981/api/documents/post_document/")
+          timers = node.succeed("systemctl list-timers paperless-exporter")
+          print(timers)
+          assert "paperless-exporter.timer paperless-exporter.service" in timers, "missing timer"
+          assert "1 timers listed." in timers, "incorrect number of timers"
 
-        with subtest("Documents are consumed"):
-          node.wait_until_succeeds(
-            "(($(curl -u admin:admin -fs localhost:28981/api/documents/ | jq .count) == 3))"
-          )
-          docs = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/"))['results']
-          assert "2005-10-16" in docs[0]['created']
-          assert "2005-10-16" in docs[1]['created']
-          assert "2005-10-16" in docs[2]['created']
+          # Double check that our attrset option override works as expected
+          cmdline = node.succeed("grep 'paperless-manage' $(systemctl cat paperless-exporter | grep ExecStart | cut -f 2 -d=)")
+          print(f"Exporter command line {cmdline!r}")
+          assert cmdline.strip() == "paperless-manage document_exporter /var/lib/paperless/export --compare-checksums --delete --no-progress-bar --no-thumbnail", "Unexpected exporter command line"
 
-        # Detects gunicorn issues, see PR #190888
-        with subtest("Document metadata can be accessed"):
-          metadata = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/1/metadata/"))
-          assert "original_checksum" in metadata
-
-          metadata = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/2/metadata/"))
-          assert "original_checksum" in metadata
-
-          metadata = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/3/metadata/"))
-          assert "original_checksum" in metadata
-
-        with subtest("Exporter"):
-            node.succeed("systemctl start --wait paperless-exporter")
-            node.wait_for_unit("paperless-web.service")
-            node.wait_for_unit("paperless-consumer.service")
-            node.wait_for_unit("paperless-scheduler.service")
-            node.wait_for_unit("paperless-task-queue.service")
-
-            node.succeed("ls -lah /var/lib/paperless/export/manifest.json")
-
-            timers = node.succeed("systemctl list-timers paperless-exporter")
-            print(timers)
-            assert "paperless-exporter.timer paperless-exporter.service" in timers, "missing timer"
-            assert "1 timers listed." in timers, "incorrect number of timers"
-
-            # Double check that our attrset option override works as expected
-            cmdline = node.succeed("grep 'paperless-manage' $(systemctl cat paperless-exporter | grep ExecStart | cut -f 2 -d=)")
-            print(f"Exporter command line {cmdline!r}")
-            assert cmdline.strip() == "paperless-manage document_exporter /var/lib/paperless/export --compare-checksums --delete --no-progress-bar --no-thumbnail", "Unexpected exporter command line"
-
-      test_paperless(simple)
-      simple.send_monitor_command("quit")
-      simple.wait_for_shutdown()
-      test_paperless(postgres)
-    '';
-  }
-)
+    test_paperless(simple)
+    simple.send_monitor_command("quit")
+    simple.wait_for_shutdown()
+    test_paperless(postgres)
+  '';
+}
diff --git a/nixos/tests/pass-secret-service.nix b/nixos/tests/pass-secret-service.nix
index 9e85dd30610b..de07cfd47a49 100644
--- a/nixos/tests/pass-secret-service.nix
+++ b/nixos/tests/pass-secret-service.nix
@@ -1,75 +1,73 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "pass-secret-service";
-    meta.maintainers = [ lib.maintainers.aidalgol ];
+{ pkgs, lib, ... }:
+{
+  name = "pass-secret-service";
+  meta.maintainers = [ lib.maintainers.aidalgol ];
 
-    nodes.machine =
-      { nodes, pkgs, ... }:
-      {
-        imports = [ ./common/user-account.nix ];
+  nodes.machine =
+    { nodes, pkgs, ... }:
+    {
+      imports = [ ./common/user-account.nix ];
 
-        services.passSecretService.enable = true;
+      services.passSecretService.enable = true;
 
-        environment.systemPackages = [
-          # Create a script that tries to make a request to the D-Bus secrets API.
-          (pkgs.writers.writePython3Bin "secrets-dbus-init"
-            {
-              libraries = [ pkgs.python3Packages.secretstorage ];
-            }
-            ''
-              import secretstorage
-              print("Initializing dbus connection...")
-              connection = secretstorage.dbus_init()
-              print("Requesting default collection...")
-              collection = secretstorage.get_default_collection(connection)
-              print("Done!  dbus-org.freedesktop.secrets should now be active.")
-            ''
-          )
-          pkgs.pass
-        ];
+      environment.systemPackages = [
+        # Create a script that tries to make a request to the D-Bus secrets API.
+        (pkgs.writers.writePython3Bin "secrets-dbus-init"
+          {
+            libraries = [ pkgs.python3Packages.secretstorage ];
+          }
+          ''
+            import secretstorage
+            print("Initializing dbus connection...")
+            connection = secretstorage.dbus_init()
+            print("Requesting default collection...")
+            collection = secretstorage.get_default_collection(connection)
+            print("Done!  dbus-org.freedesktop.secrets should now be active.")
+          ''
+        )
+        pkgs.pass
+      ];
 
-        programs.gnupg = {
-          agent.enable = true;
-          dirmngr.enable = true;
-        };
+      programs.gnupg = {
+        agent.enable = true;
+        dirmngr.enable = true;
       };
+    };
 
-    # Some of the commands are run via a virtual console because they need to be
-    # run under a real login session, with D-Bus running in the environment.
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.config.users.users.alice;
-        gpg-uid = "alice@example.net";
-        gpg-pw = "foobar9000";
-        ready-file = "/tmp/secrets-dbus-init.done";
-      in
-      ''
-        # Initialise the pass(1) storage.
-        machine.succeed("""
-          sudo -u alice gpg --pinentry-mode loopback --batch --passphrase ${gpg-pw} \
-          --quick-gen-key ${gpg-uid} \
-        """)
-        machine.succeed("sudo -u alice pass init ${gpg-uid}")
+  # Some of the commands are run via a virtual console because they need to be
+  # run under a real login session, with D-Bus running in the environment.
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.config.users.users.alice;
+      gpg-uid = "alice@example.net";
+      gpg-pw = "foobar9000";
+      ready-file = "/tmp/secrets-dbus-init.done";
+    in
+    ''
+      # Initialise the pass(1) storage.
+      machine.succeed("""
+        sudo -u alice gpg --pinentry-mode loopback --batch --passphrase ${gpg-pw} \
+        --quick-gen-key ${gpg-uid} \
+      """)
+      machine.succeed("sudo -u alice pass init ${gpg-uid}")
 
-        with subtest("Service is not running on login"):
-            machine.wait_until_tty_matches("1", "login: ")
-            machine.send_chars("alice\n")
-            machine.wait_until_tty_matches("1", "login: alice")
-            machine.wait_until_succeeds("pgrep login")
-            machine.wait_until_tty_matches("1", "Password: ")
-            machine.send_chars("${user.password}\n")
-            machine.wait_until_succeeds("pgrep -u alice bash")
+      with subtest("Service is not running on login"):
+          machine.wait_until_tty_matches("1", "login: ")
+          machine.send_chars("alice\n")
+          machine.wait_until_tty_matches("1", "login: alice")
+          machine.wait_until_succeeds("pgrep login")
+          machine.wait_until_tty_matches("1", "Password: ")
+          machine.send_chars("${user.password}\n")
+          machine.wait_until_succeeds("pgrep -u alice bash")
 
-            _, output = machine.systemctl("status dbus-org.freedesktop.secrets --no-pager", "alice")
-            assert "Active: inactive (dead)" in output
+          _, output = machine.systemctl("status dbus-org.freedesktop.secrets --no-pager", "alice")
+          assert "Active: inactive (dead)" in output
 
-        with subtest("Service starts after a client tries to talk to the D-Bus API"):
-            machine.send_chars("secrets-dbus-init; touch ${ready-file}\n")
-            machine.wait_for_file("${ready-file}")
-            _, output = machine.systemctl("status dbus-org.freedesktop.secrets --no-pager", "alice")
-            assert "Active: active (running)" in output
-      '';
-  }
-)
+      with subtest("Service starts after a client tries to talk to the D-Bus API"):
+          machine.send_chars("secrets-dbus-init; touch ${ready-file}\n")
+          machine.wait_for_file("${ready-file}")
+          _, output = machine.systemctl("status dbus-org.freedesktop.secrets --no-pager", "alice")
+          assert "Active: active (running)" in output
+    '';
+}
diff --git a/nixos/tests/password-option-override-ordering.nix b/nixos/tests/password-option-override-ordering.nix
index 5b06ab0bdbff..c2e4b1768108 100644
--- a/nixos/tests/password-option-override-ordering.nix
+++ b/nixos/tests/password-option-override-ordering.nix
@@ -6,166 +6,164 @@ let
   hashed_sha512crypt = "$6$ymzs8WINZ5wGwQcV$VC2S0cQiX8NVukOLymysTPn4v1zJoJp3NGyhnqyv/dAf4NWZsBWYveQcj6gEJr4ZUjRBRjM0Pj1L8TCQ8hUUp0"; # meow
 in
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "password-option-override-ordering";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fidgetingbits ];
-    };
+{ pkgs, ... }:
+{
+  name = "password-option-override-ordering";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fidgetingbits ];
+  };
 
-    nodes =
-      let
-        # The following users are expected to have the same behavior between immutable and mutable systems
-        # NOTE: Below given A -> B it implies B overrides A . Each entry below builds off the next
-        users = {
-          # mutable true/false: initialHashedPassword -> hashedPassword
-          fran = {
-            isNormalUser = true;
-            initialHashedPassword = hashed_yeshash;
-            hashedPassword = hashed_sha512crypt;
-          };
-
-          # mutable false: initialHashedPassword -> hashedPassword -> initialPassword
-          # mutable true: initialHashedPassword -> initialPassword -> hashedPassword
-          greg = {
-            isNormalUser = true;
-            hashedPassword = hashed_sha512crypt;
-            initialPassword = password1;
-          };
-
-          # mutable false: initialHashedPassword -> hashedPassword -> initialPassword -> password
-          # mutable true: initialHashedPassword -> initialPassword -> hashedPassword -> password
-          egon = {
-            isNormalUser = true;
-            initialPassword = password2;
-            password = password1;
-          };
-
-          # mutable true/false: hashedPassword -> password
-          # NOTE: minor duplication of test above, but to verify no initialXXX use is consistent
-          alice = {
-            isNormalUser = true;
-            hashedPassword = hashed_sha512crypt;
-            password = password1;
-          };
-
-          # mutable false: initialHashedPassword -> hashedPassword -> initialPassword -> password -> hashedPasswordFile
-          # mutable true: initialHashedPassword -> initialPassword -> hashedPassword -> password -> hashedPasswordFile
-          bob = {
-            isNormalUser = true;
-            hashedPassword = hashed_sha512crypt;
-            password = password1;
-            hashedPasswordFile = (pkgs.writeText "hashed_bcrypt" hashed_bcrypt).outPath; # Expect override of everything above
-          };
-
-          # Show hashedPassword -> password -> hashedPasswordFile -> initialPassword is false
-          # to explicitly show the following lib.trace warning in users-groups.nix (which was
-          # the wording prior to PR 310484) is in fact wrong:
-          # ```
-          # The user 'root' has multiple of the options
-          # `hashedPassword`, `password`, `hashedPasswordFile`, `initialPassword`
-          # & `initialHashedPassword` set to a non-null value.
-          # The options silently discard others by the order of precedence
-          # given above which can lead to surprising results. To resolve this warning,
-          # set at most one of the options above to a non-`null` value.
-          # ```
-          cat = {
-            isNormalUser = true;
-            hashedPassword = hashed_sha512crypt;
-            password = password1;
-            hashedPasswordFile = (pkgs.writeText "hashed_bcrypt" hashed_bcrypt).outPath;
-            initialPassword = password2; # lib.trace message implies this overrides everything above
-          };
-
-          # Show hashedPassword -> password -> hashedPasswordFile -> initialHashedPassword is false
-          # to also explicitly show the lib.trace explained above (see cat user) is wrong
-          dan = {
-            isNormalUser = true;
-            hashedPassword = hashed_sha512crypt;
-            initialPassword = password2;
-            password = password1;
-            hashedPasswordFile = (pkgs.writeText "hashed_bcrypt" hashed_bcrypt).outPath;
-            initialHashedPassword = hashed_yeshash; # lib.trace message implies this overrides everything above
-          };
+  nodes =
+    let
+      # The following users are expected to have the same behavior between immutable and mutable systems
+      # NOTE: Below given A -> B it implies B overrides A . Each entry below builds off the next
+      users = {
+        # mutable true/false: initialHashedPassword -> hashedPassword
+        fran = {
+          isNormalUser = true;
+          initialHashedPassword = hashed_yeshash;
+          hashedPassword = hashed_sha512crypt;
         };
 
-        mkTestMachine = mutable: {
-          environment.systemPackages = [ pkgs.shadow ];
-          users = {
-            mutableUsers = mutable;
-            inherit users;
-          };
+        # mutable false: initialHashedPassword -> hashedPassword -> initialPassword
+        # mutable true: initialHashedPassword -> initialPassword -> hashedPassword
+        greg = {
+          isNormalUser = true;
+          hashedPassword = hashed_sha512crypt;
+          initialPassword = password1;
+        };
+
+        # mutable false: initialHashedPassword -> hashedPassword -> initialPassword -> password
+        # mutable true: initialHashedPassword -> initialPassword -> hashedPassword -> password
+        egon = {
+          isNormalUser = true;
+          initialPassword = password2;
+          password = password1;
+        };
+
+        # mutable true/false: hashedPassword -> password
+        # NOTE: minor duplication of test above, but to verify no initialXXX use is consistent
+        alice = {
+          isNormalUser = true;
+          hashedPassword = hashed_sha512crypt;
+          password = password1;
+        };
+
+        # mutable false: initialHashedPassword -> hashedPassword -> initialPassword -> password -> hashedPasswordFile
+        # mutable true: initialHashedPassword -> initialPassword -> hashedPassword -> password -> hashedPasswordFile
+        bob = {
+          isNormalUser = true;
+          hashedPassword = hashed_sha512crypt;
+          password = password1;
+          hashedPasswordFile = (pkgs.writeText "hashed_bcrypt" hashed_bcrypt).outPath; # Expect override of everything above
+        };
+
+        # Show hashedPassword -> password -> hashedPasswordFile -> initialPassword is false
+        # to explicitly show the following lib.trace warning in users-groups.nix (which was
+        # the wording prior to PR 310484) is in fact wrong:
+        # ```
+        # The user 'root' has multiple of the options
+        # `hashedPassword`, `password`, `hashedPasswordFile`, `initialPassword`
+        # & `initialHashedPassword` set to a non-null value.
+        # The options silently discard others by the order of precedence
+        # given above which can lead to surprising results. To resolve this warning,
+        # set at most one of the options above to a non-`null` value.
+        # ```
+        cat = {
+          isNormalUser = true;
+          hashedPassword = hashed_sha512crypt;
+          password = password1;
+          hashedPasswordFile = (pkgs.writeText "hashed_bcrypt" hashed_bcrypt).outPath;
+          initialPassword = password2; # lib.trace message implies this overrides everything above
+        };
+
+        # Show hashedPassword -> password -> hashedPasswordFile -> initialHashedPassword is false
+        # to also explicitly show the lib.trace explained above (see cat user) is wrong
+        dan = {
+          isNormalUser = true;
+          hashedPassword = hashed_sha512crypt;
+          initialPassword = password2;
+          password = password1;
+          hashedPasswordFile = (pkgs.writeText "hashed_bcrypt" hashed_bcrypt).outPath;
+          initialHashedPassword = hashed_yeshash; # lib.trace message implies this overrides everything above
         };
-      in
-      {
-        immutable = mkTestMachine false;
-        mutable = mkTestMachine true;
       };
 
-    testScript = ''
-      import crypt
+      mkTestMachine = mutable: {
+        environment.systemPackages = [ pkgs.shadow ];
+        users = {
+          mutableUsers = mutable;
+          inherit users;
+        };
+      };
+    in
+    {
+      immutable = mkTestMachine false;
+      mutable = mkTestMachine true;
+    };
 
-      def assert_password_match(machine, username, password):
-        shadow_entry = machine.succeed(f"getent shadow {username}")
-        print(shadow_entry)
-        hash = shadow_entry.split(":")[1]
-        seed = "$".join(hash.split("$")[:-1])
-        assert crypt.crypt(password, seed) == hash, f"{username} user password does not match"
+  testScript = ''
+    import crypt
 
-      with subtest("alice user has correct password"):
-        for machine in machines:
-          assert_password_match(machine, "alice", "${password1}")
-          assert "${hashed_sha512crypt}" not in machine.succeed("getent shadow alice"), f"{machine}: alice user password is not correct"
-
-      with subtest("bob user has correct password"):
-        for machine in machines:
-          print(machine.succeed("getent shadow bob"))
-          assert "${hashed_bcrypt}" in machine.succeed("getent shadow bob"), f"{machine}: bob user password is not correct"
-
-      with subtest("cat user has correct password"):
-        for machine in machines:
-          print(machine.succeed("getent shadow cat"))
-          assert "${hashed_bcrypt}" in machine.succeed("getent shadow cat"), f"{machine}: cat user password is not correct"
-
-      with subtest("dan user has correct password"):
-        for machine in machines:
-          print(machine.succeed("getent shadow dan"))
-          assert "${hashed_bcrypt}" in machine.succeed("getent shadow dan"), f"{machine}: dan user password is not correct"
-
-      with subtest("greg user has correct password"):
-        print(mutable.succeed("getent shadow greg"))
-        assert "${hashed_sha512crypt}" in mutable.succeed("getent shadow greg"), "greg user password is not correct"
-
-        assert_password_match(immutable, "greg", "${password1}")
-        assert "${hashed_sha512crypt}" not in immutable.succeed("getent shadow greg"), "greg user password is not correct"
+    def assert_password_match(machine, username, password):
+      shadow_entry = machine.succeed(f"getent shadow {username}")
+      print(shadow_entry)
+      hash = shadow_entry.split(":")[1]
+      seed = "$".join(hash.split("$")[:-1])
+      assert crypt.crypt(password, seed) == hash, f"{username} user password does not match"
 
+    with subtest("alice user has correct password"):
       for machine in machines:
-        machine.wait_for_unit("multi-user.target")
-        machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+        assert_password_match(machine, "alice", "${password1}")
+        assert "${hashed_sha512crypt}" not in machine.succeed("getent shadow alice"), f"{machine}: alice user password is not correct"
 
-      def check_login(machine: Machine, tty_number: str, username: str, password: str):
-        machine.send_key(f"alt-f{tty_number}")
-        machine.wait_until_succeeds(f"[ $(fgconsole) = {tty_number} ]")
-        machine.wait_for_unit(f"getty@tty{tty_number}.service")
-        machine.wait_until_succeeds(f"pgrep -f 'agetty.*tty{tty_number}'")
-        machine.wait_until_tty_matches(tty_number, "login: ")
-        machine.send_chars(f"{username}\n")
-        machine.wait_until_tty_matches(tty_number, f"login: {username}")
-        machine.wait_until_succeeds("pgrep login")
-        machine.wait_until_tty_matches(tty_number, "Password: ")
-        machine.send_chars(f"{password}\n")
-        machine.send_chars(f"whoami > /tmp/{tty_number}\n")
-        machine.wait_for_file(f"/tmp/{tty_number}")
-        assert username in machine.succeed(f"cat /tmp/{tty_number}"), f"{machine}: {username} password is not correct"
+    with subtest("bob user has correct password"):
+      for machine in machines:
+        print(machine.succeed("getent shadow bob"))
+        assert "${hashed_bcrypt}" in machine.succeed("getent shadow bob"), f"{machine}: bob user password is not correct"
 
-      with subtest("Test initialPassword override"):
-        for machine in machines:
-          check_login(machine, "2", "egon", "${password1}")
+    with subtest("cat user has correct password"):
+      for machine in machines:
+        print(machine.succeed("getent shadow cat"))
+        assert "${hashed_bcrypt}" in machine.succeed("getent shadow cat"), f"{machine}: cat user password is not correct"
 
-      with subtest("Test initialHashedPassword override"):
-        for machine in machines:
-          check_login(machine, "3", "fran", "meow")
-    '';
-  }
-)
+    with subtest("dan user has correct password"):
+      for machine in machines:
+        print(machine.succeed("getent shadow dan"))
+        assert "${hashed_bcrypt}" in machine.succeed("getent shadow dan"), f"{machine}: dan user password is not correct"
+
+    with subtest("greg user has correct password"):
+      print(mutable.succeed("getent shadow greg"))
+      assert "${hashed_sha512crypt}" in mutable.succeed("getent shadow greg"), "greg user password is not correct"
+
+      assert_password_match(immutable, "greg", "${password1}")
+      assert "${hashed_sha512crypt}" not in immutable.succeed("getent shadow greg"), "greg user password is not correct"
+
+    for machine in machines:
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+
+    def check_login(machine: Machine, tty_number: str, username: str, password: str):
+      machine.send_key(f"alt-f{tty_number}")
+      machine.wait_until_succeeds(f"[ $(fgconsole) = {tty_number} ]")
+      machine.wait_for_unit(f"getty@tty{tty_number}.service")
+      machine.wait_until_succeeds(f"pgrep -f 'agetty.*tty{tty_number}'")
+      machine.wait_until_tty_matches(tty_number, "login: ")
+      machine.send_chars(f"{username}\n")
+      machine.wait_until_tty_matches(tty_number, f"login: {username}")
+      machine.wait_until_succeeds("pgrep login")
+      machine.wait_until_tty_matches(tty_number, "Password: ")
+      machine.send_chars(f"{password}\n")
+      machine.send_chars(f"whoami > /tmp/{tty_number}\n")
+      machine.wait_for_file(f"/tmp/{tty_number}")
+      assert username in machine.succeed(f"cat /tmp/{tty_number}"), f"{machine}: {username} password is not correct"
+
+    with subtest("Test initialPassword override"):
+      for machine in machines:
+        check_login(machine, "2", "egon", "${password1}")
+
+    with subtest("Test initialHashedPassword override"):
+      for machine in machines:
+        check_login(machine, "3", "fran", "meow")
+  '';
+}
diff --git a/nixos/tests/pds.nix b/nixos/tests/pds.nix
index 4c4ab2a64326..a07a2c1fcf72 100644
--- a/nixos/tests/pds.nix
+++ b/nixos/tests/pds.nix
@@ -1,29 +1,27 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "PDS";
+{ lib, ... }:
+{
+  name = "PDS";
 
-    nodes.machine = {
-      services.pds = {
-        enable = true;
-        settings = {
-          PDS_PORT = 3000;
-          PDS_HOSTNAME = "example.com";
+  nodes.machine = {
+    services.pds = {
+      enable = true;
+      settings = {
+        PDS_PORT = 3000;
+        PDS_HOSTNAME = "example.com";
 
-          # Snake oil testing credentials
-          PDS_JWT_SECRET = "7b93fee53be046bf59c27a32a0fb2069";
-          PDS_ADMIN_PASSWORD = "3a4077bc0d5f04eca945ef0509f7e809";
-          PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX = "ae4f5028d04c833ba630f29debd5ff80b7700e43e9f4bf70f729a88cd6a6ce35";
-        };
+        # Snake oil testing credentials
+        PDS_JWT_SECRET = "7b93fee53be046bf59c27a32a0fb2069";
+        PDS_ADMIN_PASSWORD = "3a4077bc0d5f04eca945ef0509f7e809";
+        PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX = "ae4f5028d04c833ba630f29debd5ff80b7700e43e9f4bf70f729a88cd6a6ce35";
       };
     };
+  };
 
-    testScript = ''
-      machine.wait_for_unit("pds.service")
-      machine.wait_for_open_port(3000)
-      machine.succeed("curl --fail http://localhost:3000")
-    '';
+  testScript = ''
+    machine.wait_for_unit("pds.service")
+    machine.wait_for_open_port(3000)
+    machine.succeed("curl --fail http://localhost:3000")
+  '';
 
-    meta.maintainers = with lib.maintainers; [ t4ccer ];
-  }
-)
+  meta.maintainers = with lib.maintainers; [ t4ccer ];
+}
diff --git a/nixos/tests/peerflix.nix b/nixos/tests/peerflix.nix
index b53f1b114abe..92a03157f568 100644
--- a/nixos/tests/peerflix.nix
+++ b/nixos/tests/peerflix.nix
@@ -1,26 +1,24 @@
 # This test runs peerflix and checks if peerflix starts
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "peerflix";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ offline ];
-    };
+{ pkgs, ... }:
+{
+  name = "peerflix";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ offline ];
+  };
 
-    nodes = {
-      peerflix =
-        { ... }:
-        {
-          services.peerflix.enable = true;
-        };
-    };
+  nodes = {
+    peerflix =
+      { ... }:
+      {
+        services.peerflix.enable = true;
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      peerflix.wait_for_unit("peerflix.service")
-      peerflix.wait_until_succeeds("curl -f localhost:9000")
-    '';
-  }
-)
+    peerflix.wait_for_unit("peerflix.service")
+    peerflix.wait_until_succeeds("curl -f localhost:9000")
+  '';
+}
diff --git a/nixos/tests/peroxide.nix b/nixos/tests/peroxide.nix
index 3508942d2970..d5902a64ba2d 100644
--- a/nixos/tests/peroxide.nix
+++ b/nixos/tests/peroxide.nix
@@ -1,20 +1,18 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "peroxide";
-    meta.maintainers = with lib.maintainers; [ aidalgol ];
+{ pkgs, lib, ... }:
+{
+  name = "peroxide";
+  meta.maintainers = with lib.maintainers; [ aidalgol ];
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        networking.hostName = "nixos";
-        services.peroxide.enable = true;
-      };
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      networking.hostName = "nixos";
+      services.peroxide.enable = true;
+    };
 
-    testScript = ''
-      machine.wait_for_unit("peroxide.service")
-      machine.wait_for_open_port(1143) # IMAP
-      machine.wait_for_open_port(1025) # SMTP
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("peroxide.service")
+    machine.wait_for_open_port(1143) # IMAP
+    machine.wait_for_open_port(1025) # SMTP
+  '';
+}
diff --git a/nixos/tests/pgbouncer.nix b/nixos/tests/pgbouncer.nix
index 7951ad0fb084..ffe2c3c137bf 100644
--- a/nixos/tests/pgbouncer.nix
+++ b/nixos/tests/pgbouncer.nix
@@ -1,62 +1,60 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "pgbouncer";
+{ lib, pkgs, ... }:
+{
+  name = "pgbouncer";
 
-    meta = with lib.maintainers; {
-      maintainers = [ _1000101 ];
-    };
+  meta = with lib.maintainers; {
+    maintainers = [ _1000101 ];
+  };
 
-    nodes = {
-      one =
-        { pkgs, ... }:
-        {
-          systemd.services.postgresql = {
-            postStart = ''
-              ${pkgs.postgresql}/bin/psql -U postgres -c "ALTER ROLE testuser WITH LOGIN PASSWORD 'testpass'";
-              ${pkgs.postgresql}/bin/psql -U postgres -c "ALTER DATABASE testdb OWNER TO testuser;";
+  nodes = {
+    one =
+      { pkgs, ... }:
+      {
+        systemd.services.postgresql = {
+          postStart = ''
+            ${pkgs.postgresql}/bin/psql -U postgres -c "ALTER ROLE testuser WITH LOGIN PASSWORD 'testpass'";
+            ${pkgs.postgresql}/bin/psql -U postgres -c "ALTER DATABASE testdb OWNER TO testuser;";
+          '';
+        };
+
+        services = {
+          postgresql = {
+            enable = true;
+            ensureDatabases = [ "testdb" ];
+            ensureUsers = [ { name = "testuser"; } ];
+            authentication = ''
+              local testdb testuser scram-sha-256
             '';
           };
 
-          services = {
-            postgresql = {
-              enable = true;
-              ensureDatabases = [ "testdb" ];
-              ensureUsers = [ { name = "testuser"; } ];
-              authentication = ''
-                local testdb testuser scram-sha-256
-              '';
-            };
-
-            pgbouncer = {
-              enable = true;
-              openFirewall = true;
-              settings = {
-                pgbouncer = {
-                  listen_addr = "localhost";
-                  auth_type = "scram-sha-256";
-                  auth_file = builtins.toFile "pgbouncer-users.txt" ''
-                    "testuser" "testpass"
-                  '';
-                };
-                databases = {
-                  test = "host=/run/postgresql port=5432 auth_user=testuser dbname=testdb";
-                };
+          pgbouncer = {
+            enable = true;
+            openFirewall = true;
+            settings = {
+              pgbouncer = {
+                listen_addr = "localhost";
+                auth_type = "scram-sha-256";
+                auth_file = builtins.toFile "pgbouncer-users.txt" ''
+                  "testuser" "testpass"
+                '';
+              };
+              databases = {
+                test = "host=/run/postgresql port=5432 auth_user=testuser dbname=testdb";
               };
             };
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      one.wait_for_unit("default.target")
-      one.require_unit_state("pgbouncer.service", "active")
+  testScript = ''
+    start_all()
+    one.wait_for_unit("default.target")
+    one.require_unit_state("pgbouncer.service", "active")
 
-      # Test if we can make a query through PgBouncer
-      one.wait_until_succeeds(
-          "psql 'postgres://testuser:testpass@localhost:6432/test' -c 'SELECT 1;'"
-      )
-    '';
-  }
-)
+    # Test if we can make a query through PgBouncer
+    one.wait_until_succeeds(
+        "psql 'postgres://testuser:testpass@localhost:6432/test' -c 'SELECT 1;'"
+    )
+  '';
+}
diff --git a/nixos/tests/pgmanage.nix b/nixos/tests/pgmanage.nix
index a28a3ce44766..157f46faec9f 100644
--- a/nixos/tests/pgmanage.nix
+++ b/nixos/tests/pgmanage.nix
@@ -1,46 +1,44 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    role = "test";
-    password = "secret";
-    conn = "local";
-  in
-  {
-    name = "pgmanage";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ basvandijk ];
-    };
-    nodes = {
-      one =
-        { config, pkgs, ... }:
-        {
-          services = {
-            postgresql = {
-              enable = true;
-              initialScript = pkgs.writeText "pg-init-script" ''
-                CREATE ROLE ${role} SUPERUSER LOGIN PASSWORD '${password}';
-              '';
-            };
-            pgmanage = {
-              enable = true;
-              connections = {
-                ${conn} =
-                  "hostaddr=127.0.0.1 port=${toString config.services.postgresql.settings.port} dbname=postgres";
-              };
+{ pkgs, ... }:
+let
+  role = "test";
+  password = "secret";
+  conn = "local";
+in
+{
+  name = "pgmanage";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ basvandijk ];
+  };
+  nodes = {
+    one =
+      { config, pkgs, ... }:
+      {
+        services = {
+          postgresql = {
+            enable = true;
+            initialScript = pkgs.writeText "pg-init-script" ''
+              CREATE ROLE ${role} SUPERUSER LOGIN PASSWORD '${password}';
+            '';
+          };
+          pgmanage = {
+            enable = true;
+            connections = {
+              ${conn} =
+                "hostaddr=127.0.0.1 port=${toString config.services.postgresql.settings.port} dbname=postgres";
             };
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      one.wait_for_unit("default.target")
-      one.require_unit_state("pgmanage.service", "active")
+  testScript = ''
+    start_all()
+    one.wait_for_unit("default.target")
+    one.require_unit_state("pgmanage.service", "active")
 
-      # Test if we can log in.
-      one.wait_until_succeeds(
-          "curl 'http://localhost:8080/pgmanage/auth' --data 'action=login&connname=${conn}&username=${role}&password=${password}' --fail"
-      )
-    '';
-  }
-)
+    # Test if we can log in.
+    one.wait_until_succeeds(
+        "curl 'http://localhost:8080/pgmanage/auth' --data 'action=login&connname=${conn}&username=${role}&password=${password}' --fail"
+    )
+  '';
+}
diff --git a/nixos/tests/phosh.nix b/nixos/tests/phosh.nix
index 9a93f64b0ac4..a276e1f57653 100644
--- a/nixos/tests/phosh.nix
+++ b/nixos/tests/phosh.nix
@@ -1,88 +1,86 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    pin = "1234";
-  in
-  {
-    name = "phosh";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ zhaofengli ];
-    };
+{ pkgs, ... }:
+let
+  pin = "1234";
+in
+{
+  name = "phosh";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ zhaofengli ];
+  };
 
-    nodes = {
-      phone =
-        { config, pkgs, ... }:
-        {
-          users.users.nixos = {
-            isNormalUser = true;
-            password = pin;
-          };
-
-          services.xserver.desktopManager.phosh = {
-            enable = true;
-            user = "nixos";
-            group = "users";
-
-            phocConfig = {
-              outputs.Virtual-1 = {
-                scale = 2;
-              };
-            };
-          };
-
-          environment.systemPackages = [
-            pkgs.phosh-mobile-settings
-          ];
-
-          systemd.services.phosh = {
-            environment = {
-              # Accelerated graphics fail on phoc 0.20 (wlroots 0.15)
-              "WLR_RENDERER" = "pixman";
-            };
-          };
-
-          virtualisation.resolution = {
-            x = 720;
-            y = 1440;
-          };
-          virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci,xres=720,yres=1440" ];
+  nodes = {
+    phone =
+      { config, pkgs, ... }:
+      {
+        users.users.nixos = {
+          isNormalUser = true;
+          password = pin;
         };
-    };
 
-    enableOCR = true;
+        services.xserver.desktopManager.phosh = {
+          enable = true;
+          user = "nixos";
+          group = "users";
 
-    testScript = ''
-      import time
+          phocConfig = {
+            outputs.Virtual-1 = {
+              scale = 2;
+            };
+          };
+        };
 
-      start_all()
-      phone.wait_for_unit("phosh.service")
+        environment.systemPackages = [
+          pkgs.phosh-mobile-settings
+        ];
 
-      with subtest("Check that we can see the lock screen info page"):
-          # Saturday, January 1
-          phone.succeed("timedatectl set-time '2022-01-01 07:00'")
+        systemd.services.phosh = {
+          environment = {
+            # Accelerated graphics fail on phoc 0.20 (wlroots 0.15)
+            "WLR_RENDERER" = "pixman";
+          };
+        };
 
-          phone.wait_for_text("Saturday")
-          phone.screenshot("01lockinfo")
+        virtualisation.resolution = {
+          x = 720;
+          y = 1440;
+        };
+        virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci,xres=720,yres=1440" ];
+      };
+  };
 
-      with subtest("Check that we can unlock the screen"):
-          phone.send_chars("${pin}", delay=0.2)
-          time.sleep(1)
-          phone.screenshot("02unlock")
+  enableOCR = true;
 
-          phone.send_chars("\n")
+  testScript = ''
+    import time
 
-          phone.wait_for_text("All Apps")
-          phone.screenshot("03launcher")
+    start_all()
+    phone.wait_for_unit("phosh.service")
 
-      with subtest("Check the on-screen keyboard shows"):
-          phone.send_chars("mobile setting", delay=0.2)
-          phone.wait_for_text("123") # A button on the OSK
-          phone.screenshot("04osk")
+    with subtest("Check that we can see the lock screen info page"):
+        # Saturday, January 1
+        phone.succeed("timedatectl set-time '2022-01-01 07:00'")
 
-      with subtest("Check mobile-phosh-settings starts"):
-         phone.send_chars("\n")
-         phone.wait_for_text("Tweak advanced mobile settings");
-         phone.screenshot("05settings")
-    '';
-  }
-)
+        phone.wait_for_text("Saturday")
+        phone.screenshot("01lockinfo")
+
+    with subtest("Check that we can unlock the screen"):
+        phone.send_chars("${pin}", delay=0.2)
+        time.sleep(1)
+        phone.screenshot("02unlock")
+
+        phone.send_chars("\n")
+
+        phone.wait_for_text("All Apps")
+        phone.screenshot("03launcher")
+
+    with subtest("Check the on-screen keyboard shows"):
+        phone.send_chars("mobile setting", delay=0.2)
+        phone.wait_for_text("123") # A button on the OSK
+        phone.screenshot("04osk")
+
+    with subtest("Check mobile-phosh-settings starts"):
+       phone.send_chars("\n")
+       phone.wait_for_text("Tweak advanced mobile settings");
+       phone.screenshot("05settings")
+  '';
+}
diff --git a/nixos/tests/photonvision.nix b/nixos/tests/photonvision.nix
index 6893e77d1554..6ad5ec8915ea 100644
--- a/nixos/tests/photonvision.nix
+++ b/nixos/tests/photonvision.nix
@@ -1,24 +1,22 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "photonvision";
+{ pkgs, lib, ... }:
+{
+  name = "photonvision";
 
-    nodes = {
-      machine =
-        { pkgs, ... }:
-        {
-          services.photonvision = {
-            enable = true;
-          };
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.photonvision = {
+          enable = true;
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("photonvision.service")
-      machine.wait_for_open_port(5800)
-    '';
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("photonvision.service")
+    machine.wait_for_open_port(5800)
+  '';
 
-    meta.maintainers = with lib.maintainers; [ max-niederman ];
-  }
-)
+  meta.maintainers = with lib.maintainers; [ max-niederman ];
+}
diff --git a/nixos/tests/photoprism.nix b/nixos/tests/photoprism.nix
index b8c86c9ac20a..e4cdfeb43331 100644
--- a/nixos/tests/photoprism.nix
+++ b/nixos/tests/photoprism.nix
@@ -1,28 +1,26 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "photoprism";
-    meta.maintainers = with lib.maintainers; [ stunkymonkey ];
+{ lib, pkgs, ... }:
+{
+  name = "photoprism";
+  meta.maintainers = with lib.maintainers; [ stunkymonkey ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.photoprism = {
-          enable = true;
-          port = 8080;
-          originalsPath = "/media/photos/";
-          passwordFile = pkgs.writeText "password" "secret";
-        };
-        environment.extraInit = ''
-          mkdir -p /media/photos
-        '';
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.photoprism = {
+        enable = true;
+        port = 8080;
+        originalsPath = "/media/photos/";
+        passwordFile = pkgs.writeText "password" "secret";
       };
+      environment.extraInit = ''
+        mkdir -p /media/photos
+      '';
+    };
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_for_open_port(8080)
-      response = machine.succeed("curl -vvv -s -H 'Host: photoprism' http://127.0.0.1:8080/library/login")
-      assert '<title>PhotoPrism</title>' in response, "Login page didn't load successfully"
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_open_port(8080)
+    response = machine.succeed("curl -vvv -s -H 'Host: photoprism' http://127.0.0.1:8080/library/login")
+    assert '<title>PhotoPrism</title>' in response, "Login page didn't load successfully"
+  '';
+}
diff --git a/nixos/tests/pict-rs.nix b/nixos/tests/pict-rs.nix
index 12109c74138d..7bd2c601f8a6 100644
--- a/nixos/tests/pict-rs.nix
+++ b/nixos/tests/pict-rs.nix
@@ -1,24 +1,22 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "pict-rs";
-    meta.maintainers = with lib.maintainers; [ happysalada ];
+{ pkgs, lib, ... }:
+{
+  name = "pict-rs";
+  meta.maintainers = with lib.maintainers; [ happysalada ];
 
-    nodes.machine =
-      { ... }:
-      {
-        environment.systemPackages = with pkgs; [
-          curl
-          jq
-        ];
-        services.pict-rs.enable = true;
-      };
+  nodes.machine =
+    { ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        curl
+        jq
+      ];
+      services.pict-rs.enable = true;
+    };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine.wait_for_unit("pict-rs")
-      machine.wait_for_open_port(8080)
-    '';
-  }
-)
+    machine.wait_for_unit("pict-rs")
+    machine.wait_for_open_port(8080)
+  '';
+}
diff --git a/nixos/tests/pingvin-share.nix b/nixos/tests/pingvin-share.nix
index 5b1ec55add20..5cb5dcd2a3fc 100644
--- a/nixos/tests/pingvin-share.nix
+++ b/nixos/tests/pingvin-share.nix
@@ -1,26 +1,24 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "pingvin-share";
-    meta.maintainers = with lib.maintainers; [ ratcornu ];
+{ lib, ... }:
+{
+  name = "pingvin-share";
+  meta.maintainers = with lib.maintainers; [ ratcornu ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.pingvin-share = {
-          enable = true;
+  nodes.machine =
+    { ... }:
+    {
+      services.pingvin-share = {
+        enable = true;
 
-          backend.port = 9010;
-          frontend.port = 9011;
-        };
+        backend.port = 9010;
+        frontend.port = 9011;
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("pingvin-share-frontend.service")
-      machine.wait_for_open_port(9010)
-      machine.wait_for_open_port(9011)
-      machine.succeed("curl --fail http://127.0.0.1:9010/api/configs")
-      machine.succeed("curl --fail http://127.0.0.1:9011/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("pingvin-share-frontend.service")
+    machine.wait_for_open_port(9010)
+    machine.wait_for_open_port(9011)
+    machine.succeed("curl --fail http://127.0.0.1:9010/api/configs")
+    machine.succeed("curl --fail http://127.0.0.1:9011/")
+  '';
+}
diff --git a/nixos/tests/plantuml-server.nix b/nixos/tests/plantuml-server.nix
index b0885ea2630d..e46461bc55ac 100644
--- a/nixos/tests/plantuml-server.nix
+++ b/nixos/tests/plantuml-server.nix
@@ -1,25 +1,23 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "plantuml-server";
-    meta.maintainers = with lib.maintainers; [ anthonyroussel ];
+{ pkgs, lib, ... }:
+{
+  name = "plantuml-server";
+  meta.maintainers = with lib.maintainers; [ anthonyroussel ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.curl ];
-        services.plantuml-server.enable = true;
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.curl ];
+      services.plantuml-server.enable = true;
+    };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine.wait_for_unit("plantuml-server.service")
-      machine.wait_for_open_port(8080)
+    machine.wait_for_unit("plantuml-server.service")
+    machine.wait_for_open_port(8080)
 
-      with subtest("Generate chart"):
-        chart_id = machine.succeed("curl -sSf http://localhost:8080/plantuml/coder -d 'Alice -> Bob'")
-        machine.succeed("curl -sSf http://localhost:8080/plantuml/txt/{}".format(chart_id))
-    '';
-  }
-)
+    with subtest("Generate chart"):
+      chart_id = machine.succeed("curl -sSf http://localhost:8080/plantuml/coder -d 'Alice -> Bob'")
+      machine.succeed("curl -sSf http://localhost:8080/plantuml/txt/{}".format(chart_id))
+  '';
+}
diff --git a/nixos/tests/plasma-bigscreen.nix b/nixos/tests/plasma-bigscreen.nix
index 4a14564364ac..b429117b3a44 100644
--- a/nixos/tests/plasma-bigscreen.nix
+++ b/nixos/tests/plasma-bigscreen.nix
@@ -1,43 +1,41 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "plasma-bigscreen";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        ttuegel
-        k900
-      ];
-    };
+{
+  name = "plasma-bigscreen";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      ttuegel
+      k900
+    ];
+  };
 
-    nodes.machine =
-      { ... }:
+  nodes.machine =
+    { ... }:
 
-      {
-        imports = [ ./common/user-account.nix ];
-        services.xserver.enable = true;
-        services.displayManager.sddm.enable = true;
-        services.displayManager.defaultSession = "plasma-bigscreen-x11";
-        services.xserver.desktopManager.plasma5.bigscreen.enable = true;
-        services.displayManager.autoLogin = {
-          enable = true;
-          user = "alice";
-        };
-
-        users.users.alice.extraGroups = [ "uinput" ];
+    {
+      imports = [ ./common/user-account.nix ];
+      services.xserver.enable = true;
+      services.displayManager.sddm.enable = true;
+      services.displayManager.defaultSession = "plasma-bigscreen-x11";
+      services.xserver.desktopManager.plasma5.bigscreen.enable = true;
+      services.displayManager.autoLogin = {
+        enable = true;
+        user = "alice";
       };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        with subtest("Wait for login"):
-            start_all()
-            machine.wait_for_file("/tmp/xauth_*")
-            machine.succeed("xauth merge /tmp/xauth_*")
+      users.users.alice.extraGroups = [ "uinput" ];
+    };
 
-        with subtest("Check plasmashell started"):
-            machine.wait_until_succeeds("pgrep plasmashell")
-            machine.wait_for_window("Plasma Big Screen")
-      '';
-  }
-)
+  testScript =
+    { nodes, ... }:
+    ''
+      with subtest("Wait for login"):
+          start_all()
+          machine.wait_for_file("/tmp/xauth_*")
+          machine.succeed("xauth merge /tmp/xauth_*")
+
+      with subtest("Check plasmashell started"):
+          machine.wait_until_succeeds("pgrep plasmashell")
+          machine.wait_for_window("Plasma Big Screen")
+    '';
+}
diff --git a/nixos/tests/plasma5-systemd-start.nix b/nixos/tests/plasma5-systemd-start.nix
index 9f21c21714b0..6a62f356f839 100644
--- a/nixos/tests/plasma5-systemd-start.nix
+++ b/nixos/tests/plasma5-systemd-start.nix
@@ -1,48 +1,46 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "plasma5-systemd-start";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ oxalica ];
-    };
+{
+  name = "plasma5-systemd-start";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ oxalica ];
+  };
 
-    nodes.machine =
-      { ... }:
+  nodes.machine =
+    { ... }:
 
-      {
-        imports = [ ./common/user-account.nix ];
-        services.xserver = {
-          enable = true;
-          desktopManager.plasma5.enable = true;
-          desktopManager.plasma5.runUsingSystemd = true;
-        };
-
-        services.displayManager = {
-          sddm.enable = true;
-          defaultSession = "plasma";
-          autoLogin = {
-            enable = true;
-            user = "alice";
-          };
-        };
+    {
+      imports = [ ./common/user-account.nix ];
+      services.xserver = {
+        enable = true;
+        desktopManager.plasma5.enable = true;
+        desktopManager.plasma5.runUsingSystemd = true;
       };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        with subtest("Wait for login"):
-            start_all()
-            machine.wait_for_file("/tmp/xauth_*")
-            machine.succeed("xauth merge /tmp/xauth_*")
+      services.displayManager = {
+        sddm.enable = true;
+        defaultSession = "plasma";
+        autoLogin = {
+          enable = true;
+          user = "alice";
+        };
+      };
+    };
 
-        with subtest("Check plasmashell started"):
-            machine.wait_until_succeeds("pgrep plasmashell")
-            machine.wait_for_window("^Desktop ")
+  testScript =
+    { nodes, ... }:
+    ''
+      with subtest("Wait for login"):
+          start_all()
+          machine.wait_for_file("/tmp/xauth_*")
+          machine.succeed("xauth merge /tmp/xauth_*")
 
-        status, result = machine.systemctl('--no-pager show plasma-plasmashell.service', user='alice')
-        assert status == 0, 'Service not found'
-        assert 'ActiveState=active' in result.split('\n'), 'Systemd service not active'
-      '';
-  }
-)
+      with subtest("Check plasmashell started"):
+          machine.wait_until_succeeds("pgrep plasmashell")
+          machine.wait_for_window("^Desktop ")
+
+      status, result = machine.systemctl('--no-pager show plasma-plasmashell.service', user='alice')
+      assert status == 0, 'Service not found'
+      assert 'ActiveState=active' in result.split('\n'), 'Systemd service not active'
+    '';
+}
diff --git a/nixos/tests/plasma5.nix b/nixos/tests/plasma5.nix
index d333df24eb8d..7fe677feae92 100644
--- a/nixos/tests/plasma5.nix
+++ b/nixos/tests/plasma5.nix
@@ -1,72 +1,70 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "plasma5";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ttuegel ];
+{
+  name = "plasma5";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ttuegel ];
+  };
+
+  nodes.machine =
+    { ... }:
+
+    {
+      imports = [ ./common/user-account.nix ];
+      services.xserver.enable = true;
+      services.displayManager.sddm.enable = true;
+      services.displayManager.defaultSession = "plasma";
+      services.xserver.desktopManager.plasma5.enable = true;
+      environment.plasma5.excludePackages = [ pkgs.plasma5Packages.elisa ];
+      services.displayManager.autoLogin = {
+        enable = true;
+        user = "alice";
+      };
     };
 
-    nodes.machine =
-      { ... }:
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+      xdo = "${pkgs.xdotool}/bin/xdotool";
+    in
+    ''
+      with subtest("Wait for login"):
+          start_all()
+          machine.wait_for_file("/tmp/xauth_*")
+          machine.succeed("xauth merge /tmp/xauth_*")
 
-      {
-        imports = [ ./common/user-account.nix ];
-        services.xserver.enable = true;
-        services.displayManager.sddm.enable = true;
-        services.displayManager.defaultSession = "plasma";
-        services.xserver.desktopManager.plasma5.enable = true;
-        environment.plasma5.excludePackages = [ pkgs.plasma5Packages.elisa ];
-        services.displayManager.autoLogin = {
-          enable = true;
-          user = "alice";
-        };
-      };
+      with subtest("Check plasmashell started"):
+          machine.wait_until_succeeds("pgrep plasmashell")
+          machine.wait_for_window("^Desktop ")
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-        xdo = "${pkgs.xdotool}/bin/xdotool";
-      in
-      ''
-        with subtest("Wait for login"):
-            start_all()
-            machine.wait_for_file("/tmp/xauth_*")
-            machine.succeed("xauth merge /tmp/xauth_*")
+      with subtest("Check that KDED is running"):
+          machine.succeed("pgrep kded5")
 
-        with subtest("Check plasmashell started"):
-            machine.wait_until_succeeds("pgrep plasmashell")
-            machine.wait_for_window("^Desktop ")
+      with subtest("Check that logging in has given the user ownership of devices"):
+          machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
 
-        with subtest("Check that KDED is running"):
-            machine.succeed("pgrep kded5")
+      with subtest("Ensure Elisa is not installed"):
+          machine.fail("which elisa")
 
-        with subtest("Check that logging in has given the user ownership of devices"):
-            machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+      machine.succeed("su - ${user.name} -c 'xauth merge /tmp/xauth_*'")
 
-        with subtest("Ensure Elisa is not installed"):
-            machine.fail("which elisa")
+      with subtest("Run Dolphin"):
+          machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 dolphin >&2 &'")
+          machine.wait_for_window(" Dolphin")
 
-        machine.succeed("su - ${user.name} -c 'xauth merge /tmp/xauth_*'")
+      with subtest("Run Konsole"):
+          machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 konsole >&2 &'")
+          machine.wait_for_window("Konsole")
 
-        with subtest("Run Dolphin"):
-            machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 dolphin >&2 &'")
-            machine.wait_for_window(" Dolphin")
+      with subtest("Run systemsettings"):
+          machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 systemsettings5 >&2 &'")
+          machine.wait_for_window("Settings")
 
-        with subtest("Run Konsole"):
-            machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 konsole >&2 &'")
-            machine.wait_for_window("Konsole")
-
-        with subtest("Run systemsettings"):
-            machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 systemsettings5 >&2 &'")
-            machine.wait_for_window("Settings")
-
-        with subtest("Wait to get a screenshot"):
-            machine.execute(
-                "${xdo} key Alt+F1 sleep 10"
-            )
-            machine.screenshot("screen")
-      '';
-  }
-)
+      with subtest("Wait to get a screenshot"):
+          machine.execute(
+              "${xdo} key Alt+F1 sleep 10"
+          )
+          machine.screenshot("screen")
+    '';
+}
diff --git a/nixos/tests/plasma6.nix b/nixos/tests/plasma6.nix
index afdb965d5d89..b10d829102ad 100644
--- a/nixos/tests/plasma6.nix
+++ b/nixos/tests/plasma6.nix
@@ -1,70 +1,68 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "plasma6";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ k900 ];
+{
+  name = "plasma6";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ k900 ];
+  };
+
+  nodes.machine =
+    { ... }:
+
+    {
+      imports = [ ./common/user-account.nix ];
+      services.xserver.enable = true;
+      services.displayManager.sddm.enable = true;
+      # FIXME: this should be testing Wayland
+      services.displayManager.defaultSession = "plasmax11";
+      services.desktopManager.plasma6.enable = true;
+      environment.plasma6.excludePackages = [ pkgs.kdePackages.elisa ];
+      services.displayManager.autoLogin = {
+        enable = true;
+        user = "alice";
+      };
     };
 
-    nodes.machine =
-      { ... }:
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+      xdo = "${pkgs.xdotool}/bin/xdotool";
+    in
+    ''
+      with subtest("Wait for login"):
+          start_all()
+          machine.wait_for_file("/tmp/xauth_*")
+          machine.succeed("xauth merge /tmp/xauth_*")
 
-      {
-        imports = [ ./common/user-account.nix ];
-        services.xserver.enable = true;
-        services.displayManager.sddm.enable = true;
-        # FIXME: this should be testing Wayland
-        services.displayManager.defaultSession = "plasmax11";
-        services.desktopManager.plasma6.enable = true;
-        environment.plasma6.excludePackages = [ pkgs.kdePackages.elisa ];
-        services.displayManager.autoLogin = {
-          enable = true;
-          user = "alice";
-        };
-      };
+      with subtest("Check plasmashell started"):
+          machine.wait_until_succeeds("pgrep plasmashell")
+          machine.wait_for_window("^Desktop ")
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-        xdo = "${pkgs.xdotool}/bin/xdotool";
-      in
-      ''
-        with subtest("Wait for login"):
-            start_all()
-            machine.wait_for_file("/tmp/xauth_*")
-            machine.succeed("xauth merge /tmp/xauth_*")
+      with subtest("Check that KDED is running"):
+          machine.succeed("pgrep kded6")
 
-        with subtest("Check plasmashell started"):
-            machine.wait_until_succeeds("pgrep plasmashell")
-            machine.wait_for_window("^Desktop ")
+      with subtest("Ensure Elisa is not installed"):
+          machine.fail("which elisa")
 
-        with subtest("Check that KDED is running"):
-            machine.succeed("pgrep kded6")
+      machine.succeed("su - ${user.name} -c 'xauth merge /tmp/xauth_*'")
 
-        with subtest("Ensure Elisa is not installed"):
-            machine.fail("which elisa")
+      with subtest("Run Dolphin"):
+          machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 dolphin >&2 &'")
+          machine.wait_for_window(" Dolphin")
 
-        machine.succeed("su - ${user.name} -c 'xauth merge /tmp/xauth_*'")
+      with subtest("Run Konsole"):
+          machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 konsole >&2 &'")
+          machine.wait_for_window("Konsole")
 
-        with subtest("Run Dolphin"):
-            machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 dolphin >&2 &'")
-            machine.wait_for_window(" Dolphin")
+      with subtest("Run systemsettings"):
+          machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 systemsettings >&2 &'")
+          machine.wait_for_window("Settings")
 
-        with subtest("Run Konsole"):
-            machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 konsole >&2 &'")
-            machine.wait_for_window("Konsole")
-
-        with subtest("Run systemsettings"):
-            machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 systemsettings >&2 &'")
-            machine.wait_for_window("Settings")
-
-        with subtest("Wait to get a screenshot"):
-            machine.execute(
-                "${xdo} key Alt+F1 sleep 10"
-            )
-            machine.screenshot("screen")
-      '';
-  }
-)
+      with subtest("Wait to get a screenshot"):
+          machine.execute(
+              "${xdo} key Alt+F1 sleep 10"
+          )
+          machine.screenshot("screen")
+    '';
+}
diff --git a/nixos/tests/plausible.nix b/nixos/tests/plausible.nix
index 2076667797db..5253b521c99e 100644
--- a/nixos/tests/plausible.nix
+++ b/nixos/tests/plausible.nix
@@ -1,36 +1,34 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "plausible";
-    meta = {
-      maintainers = lib.teams.cyberus.members;
-    };
+{ lib, ... }:
+{
+  name = "plausible";
+  meta = {
+    maintainers = lib.teams.cyberus.members;
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        virtualisation.memorySize = 4096;
-        services.plausible = {
-          enable = true;
-          server = {
-            baseUrl = "http://localhost:8000";
-            secretKeybaseFile = "${pkgs.writeText "dont-try-this-at-home" "nannannannannannannannannannannannannannannannannannannan_batman!"}";
-          };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.memorySize = 4096;
+      services.plausible = {
+        enable = true;
+        server = {
+          baseUrl = "http://localhost:8000";
+          secretKeybaseFile = "${pkgs.writeText "dont-try-this-at-home" "nannannannannannannannannannannannannannannannannannannan_batman!"}";
         };
       };
+    };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("plausible.service")
-      machine.wait_for_open_port(8000)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("plausible.service")
+    machine.wait_for_open_port(8000)
 
-      # Ensure that the software does not make not make the machine
-      # listen on any public interfaces by default.
-      machine.fail("ss -tlpn 'src = 0.0.0.0 or src = [::]' | grep LISTEN")
+    # Ensure that the software does not make not make the machine
+    # listen on any public interfaces by default.
+    machine.fail("ss -tlpn 'src = 0.0.0.0 or src = [::]' | grep LISTEN")
 
-      machine.succeed("curl -f localhost:8000 >&2")
+    machine.succeed("curl -f localhost:8000 >&2")
 
-      machine.succeed("curl -f localhost:8000/js/script.js >&2")
-    '';
-  }
-)
+    machine.succeed("curl -f localhost:8000/js/script.js >&2")
+  '';
+}
diff --git a/nixos/tests/playwright-python.nix b/nixos/tests/playwright-python.nix
index e479f3a91517..7911dac1b428 100644
--- a/nixos/tests/playwright-python.nix
+++ b/nixos/tests/playwright-python.nix
@@ -1,61 +1,59 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "playwright-python";
+{ pkgs, ... }:
+{
+  name = "playwright-python";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ phaer ];
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ phaer ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.variables = {
+        NIX_MANUAL_DOCROOT = "file://${pkgs.nix.doc}/share/doc/nix/manual/index.html";
+        PLAYWRIGHT_BROWSERS_PATH = pkgs.playwright-driver.browsers;
+      };
+      environment.systemPackages = [
+        (pkgs.writers.writePython3Bin "test_playwright"
+          {
+            libraries = [ pkgs.python3Packages.playwright ];
+          }
+          ''
+            import sys
+            import re
+            from playwright.sync_api import sync_playwright
+            from playwright.sync_api import expect
+
+            browsers = {
+              "chromium": {'args': ["--headless", "--disable-gpu"], 'channel': 'chromium'},
+              "firefox": {},
+              "webkit": {}
+            }
+            needle = re.compile("Nix.*Reference Manual")
+            if len(sys.argv) != 3 or sys.argv[1] not in browsers.keys():
+                print(f"usage: {sys.argv[0]} [{'|'.join(browsers.keys())}] <url>")
+                sys.exit(1)
+            browser_name = sys.argv[1]
+            url = sys.argv[2]
+            browser_kwargs = browsers.get(browser_name)
+            args = ' '.join(browser_kwargs.get('args', []))
+            print(f"Running test on {browser_name} {args}")
+            with sync_playwright() as p:
+                browser = getattr(p, browser_name).launch(**browser_kwargs)
+                context = browser.new_context()
+                page = context.new_page()
+                page.goto(url)
+                expect(page.get_by_text(needle)).to_be_visible()
+          ''
+        )
+      ];
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.variables = {
-          NIX_MANUAL_DOCROOT = "file://${pkgs.nix.doc}/share/doc/nix/manual/index.html";
-          PLAYWRIGHT_BROWSERS_PATH = pkgs.playwright-driver.browsers;
-        };
-        environment.systemPackages = [
-          (pkgs.writers.writePython3Bin "test_playwright"
-            {
-              libraries = [ pkgs.python3Packages.playwright ];
-            }
-            ''
-              import sys
-              import re
-              from playwright.sync_api import sync_playwright
-              from playwright.sync_api import expect
+  testScript = ''
+    # FIXME: Webkit segfaults
+    for browser in ["firefox", "chromium"]:
+        with subtest(f"Render Nix Manual in {browser}"):
+            machine.succeed(f"test_playwright {browser} $NIX_MANUAL_DOCROOT")
+  '';
 
-              browsers = {
-                "chromium": {'args': ["--headless", "--disable-gpu"], 'channel': 'chromium'},
-                "firefox": {},
-                "webkit": {}
-              }
-              needle = re.compile("Nix.*Reference Manual")
-              if len(sys.argv) != 3 or sys.argv[1] not in browsers.keys():
-                  print(f"usage: {sys.argv[0]} [{'|'.join(browsers.keys())}] <url>")
-                  sys.exit(1)
-              browser_name = sys.argv[1]
-              url = sys.argv[2]
-              browser_kwargs = browsers.get(browser_name)
-              args = ' '.join(browser_kwargs.get('args', []))
-              print(f"Running test on {browser_name} {args}")
-              with sync_playwright() as p:
-                  browser = getattr(p, browser_name).launch(**browser_kwargs)
-                  context = browser.new_context()
-                  page = context.new_page()
-                  page.goto(url)
-                  expect(page.get_by_text(needle)).to_be_visible()
-            ''
-          )
-        ];
-      };
-
-    testScript = ''
-      # FIXME: Webkit segfaults
-      for browser in ["firefox", "chromium"]:
-          with subtest(f"Render Nix Manual in {browser}"):
-              machine.succeed(f"test_playwright {browser} $NIX_MANUAL_DOCROOT")
-    '';
-
-  }
-)
+}
diff --git a/nixos/tests/please.nix b/nixos/tests/please.nix
index 6b461bff4938..7671266ac7e4 100644
--- a/nixos/tests/please.nix
+++ b/nixos/tests/please.nix
@@ -1,68 +1,66 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "please";
-    meta.maintainers = [ ];
+{ lib, ... }:
+{
+  name = "please";
+  meta.maintainers = [ ];
 
-    nodes.machine =
-      { ... }:
-      {
-        users.users = lib.mkMerge [
-          (lib.listToAttrs (
-            map (n: lib.nameValuePair n { isNormalUser = true; }) (lib.genList (x: "user${toString x}") 6)
-          ))
-          {
-            user0.extraGroups = [ "wheel" ];
-          }
-        ];
+  nodes.machine =
+    { ... }:
+    {
+      users.users = lib.mkMerge [
+        (lib.listToAttrs (
+          map (n: lib.nameValuePair n { isNormalUser = true; }) (lib.genList (x: "user${toString x}") 6)
+        ))
+        {
+          user0.extraGroups = [ "wheel" ];
+        }
+      ];
 
-        security.please = {
-          enable = true;
-          wheelNeedsPassword = false;
-          settings = {
-            user2_run_true_as_root = {
-              name = "user2";
-              target = "root";
-              rule = "/run/current-system/sw/bin/true";
-              require_pass = false;
-            };
-            user4_edit_etc_hosts_as_root = {
-              name = "user4";
-              type = "edit";
-              target = "root";
-              rule = "/etc/hosts";
-              editmode = 644;
-              require_pass = false;
-            };
+      security.please = {
+        enable = true;
+        wheelNeedsPassword = false;
+        settings = {
+          user2_run_true_as_root = {
+            name = "user2";
+            target = "root";
+            rule = "/run/current-system/sw/bin/true";
+            require_pass = false;
+          };
+          user4_edit_etc_hosts_as_root = {
+            name = "user4";
+            type = "edit";
+            target = "root";
+            rule = "/etc/hosts";
+            editmode = 644;
+            require_pass = false;
           };
         };
       };
+    };
 
-    testScript = ''
-      with subtest("root: can run anything by default"):
-          machine.succeed('please true')
-      with subtest("root: can edit anything by default"):
-          machine.succeed('EDITOR=cat pleaseedit /etc/hosts')
+  testScript = ''
+    with subtest("root: can run anything by default"):
+        machine.succeed('please true')
+    with subtest("root: can edit anything by default"):
+        machine.succeed('EDITOR=cat pleaseedit /etc/hosts')
 
-      with subtest("user0: can run as root because it's in the wheel group"):
-          machine.succeed('su - user0 -c "please -u root true"')
-      with subtest("user1: cannot run as root because it's not in the wheel group"):
-          machine.fail('su - user1 -c "please -u root true"')
+    with subtest("user0: can run as root because it's in the wheel group"):
+        machine.succeed('su - user0 -c "please -u root true"')
+    with subtest("user1: cannot run as root because it's not in the wheel group"):
+        machine.fail('su - user1 -c "please -u root true"')
 
-      with subtest("user0: can edit as root"):
-          machine.succeed('su - user0 -c "EDITOR=cat pleaseedit /etc/hosts"')
-      with subtest("user1: cannot edit as root"):
-          machine.fail('su - user1 -c "EDITOR=cat pleaseedit /etc/hosts"')
+    with subtest("user0: can edit as root"):
+        machine.succeed('su - user0 -c "EDITOR=cat pleaseedit /etc/hosts"')
+    with subtest("user1: cannot edit as root"):
+        machine.fail('su - user1 -c "EDITOR=cat pleaseedit /etc/hosts"')
 
-      with subtest("user2: can run 'true' as root"):
-          machine.succeed('su - user2 -c "please -u root true"')
-      with subtest("user3: cannot run 'true' as root"):
-          machine.fail('su - user3 -c "please -u root true"')
+    with subtest("user2: can run 'true' as root"):
+        machine.succeed('su - user2 -c "please -u root true"')
+    with subtest("user3: cannot run 'true' as root"):
+        machine.fail('su - user3 -c "please -u root true"')
 
-      with subtest("user4: can edit /etc/hosts"):
-          machine.succeed('su - user4 -c "EDITOR=cat pleaseedit /etc/hosts"')
-      with subtest("user5: cannot edit /etc/hosts"):
-          machine.fail('su - user5 -c "EDITOR=cat pleaseedit /etc/hosts"')
-    '';
-  }
-)
+    with subtest("user4: can edit /etc/hosts"):
+        machine.succeed('su - user4 -c "EDITOR=cat pleaseedit /etc/hosts"')
+    with subtest("user5: cannot edit /etc/hosts"):
+        machine.fail('su - user5 -c "EDITOR=cat pleaseedit /etc/hosts"')
+  '';
+}
diff --git a/nixos/tests/plikd.nix b/nixos/tests/plikd.nix
index 05a1c6017d2d..b22c26302081 100644
--- a/nixos/tests/plikd.nix
+++ b/nixos/tests/plikd.nix
@@ -1,33 +1,31 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "plikd";
-    meta = with lib.maintainers; {
-      maintainers = [ freezeboy ];
+{ lib, ... }:
+{
+  name = "plikd";
+  meta = with lib.maintainers; {
+    maintainers = [ freezeboy ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    let
+    in
+    {
+      services.plikd.enable = true;
+      environment.systemPackages = [ pkgs.plik ];
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      let
-      in
-      {
-        services.plikd.enable = true;
-        environment.systemPackages = [ pkgs.plik ];
-      };
+  testScript = ''
+    # Service basic test
+    machine.wait_for_unit("plikd")
 
-    testScript = ''
-      # Service basic test
-      machine.wait_for_unit("plikd")
+    # Network test
+    machine.wait_for_open_port(8080)
+    machine.succeed("curl --fail -v http://localhost:8080")
 
-      # Network test
-      machine.wait_for_open_port(8080)
-      machine.succeed("curl --fail -v http://localhost:8080")
+    # Application test
+    machine.execute("echo test > /tmp/data.txt")
+    machine.succeed("plik --server http://localhost:8080 /tmp/data.txt | grep curl")
 
-      # Application test
-      machine.execute("echo test > /tmp/data.txt")
-      machine.succeed("plik --server http://localhost:8080 /tmp/data.txt | grep curl")
-
-      machine.succeed("diff data.txt /tmp/data.txt")
-    '';
-  }
-)
+    machine.succeed("diff data.txt /tmp/data.txt")
+  '';
+}
diff --git a/nixos/tests/plotinus.nix b/nixos/tests/plotinus.nix
index 97041012756a..f1ea049ff449 100644
--- a/nixos/tests/plotinus.nix
+++ b/nixos/tests/plotinus.nix
@@ -1,36 +1,34 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "plotinus";
-    meta = {
-      maintainers = pkgs.plotinus.meta.maintainers;
-      timeout = 600;
+{ pkgs, ... }:
+{
+  name = "plotinus";
+  meta = {
+    maintainers = pkgs.plotinus.meta.maintainers;
+    timeout = 600;
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+
+    {
+      imports = [ ./common/x11.nix ];
+      programs.plotinus.enable = true;
+      environment.systemPackages = [
+        pkgs.gnome-pomodoro
+        pkgs.xdotool
+      ];
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-
-      {
-        imports = [ ./common/x11.nix ];
-        programs.plotinus.enable = true;
-        environment.systemPackages = [
-          pkgs.gnome-pomodoro
-          pkgs.xdotool
-        ];
-      };
-
-    testScript = ''
-      machine.wait_for_x()
-      machine.succeed("gnome-pomodoro >&2 &")
-      machine.wait_for_window("Pomodoro", timeout=120)
-      machine.succeed(
-          "xdotool search --sync --onlyvisible --class gnome-pomodoro "
-          + "windowfocus --sync key --clearmodifiers --delay 1 'ctrl+shift+p'"
-      )
-      machine.sleep(5)  # wait for the popup
-      machine.screenshot("popup")
-      machine.succeed("xdotool key --delay 100 p r e f e r e n c e s Return")
-      machine.wait_for_window("Preferences", timeout=120)
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_x()
+    machine.succeed("gnome-pomodoro >&2 &")
+    machine.wait_for_window("Pomodoro", timeout=120)
+    machine.succeed(
+        "xdotool search --sync --onlyvisible --class gnome-pomodoro "
+        + "windowfocus --sync key --clearmodifiers --delay 1 'ctrl+shift+p'"
+    )
+    machine.sleep(5)  # wait for the popup
+    machine.screenshot("popup")
+    machine.succeed("xdotool key --delay 100 p r e f e r e n c e s Return")
+    machine.wait_for_window("Preferences", timeout=120)
+  '';
+}
diff --git a/nixos/tests/pocket-id.nix b/nixos/tests/pocket-id.nix
index 753fa251473f..830ba3e8c760 100644
--- a/nixos/tests/pocket-id.nix
+++ b/nixos/tests/pocket-id.nix
@@ -1,47 +1,45 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "pocket-id";
-    meta.maintainers = with lib.maintainers; [
-      gepbird
-      ymstnt
-    ];
+{
+  name = "pocket-id";
+  meta.maintainers = with lib.maintainers; [
+    gepbird
+    ymstnt
+  ];
 
-    nodes = {
-      machine =
-        { ... }:
-        {
-          services.pocket-id = {
-            enable = true;
-            settings = {
-              PORT = 10001;
-              INTERNAL_BACKEND_URL = "http://localhost:10002";
-              BACKEND_PORT = 10002;
-            };
+  nodes = {
+    machine =
+      { ... }:
+      {
+        services.pocket-id = {
+          enable = true;
+          settings = {
+            PORT = 10001;
+            INTERNAL_BACKEND_URL = "http://localhost:10002";
+            BACKEND_PORT = 10002;
           };
         };
-    };
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      let
-        inherit (nodes.machine.services.pocket-id) settings;
-        inherit (builtins) toString;
-      in
-      ''
-        machine.wait_for_unit("pocket-id-backend.service")
-        machine.wait_for_open_port(${toString settings.BACKEND_PORT})
-        machine.wait_for_unit("pocket-id-frontend.service")
-        machine.wait_for_open_port(${toString settings.PORT})
+  testScript =
+    { nodes, ... }:
+    let
+      inherit (nodes.machine.services.pocket-id) settings;
+      inherit (builtins) toString;
+    in
+    ''
+      machine.wait_for_unit("pocket-id-backend.service")
+      machine.wait_for_open_port(${toString settings.BACKEND_PORT})
+      machine.wait_for_unit("pocket-id-frontend.service")
+      machine.wait_for_open_port(${toString settings.PORT})
 
-        backend_status = machine.succeed("curl -L -o /tmp/backend-output -w '%{http_code}' http://localhost:${toString settings.BACKEND_PORT}/api/users/me")
-        assert backend_status == "401"
-        machine.succeed("grep 'You are not signed in' /tmp/backend-output")
+      backend_status = machine.succeed("curl -L -o /tmp/backend-output -w '%{http_code}' http://localhost:${toString settings.BACKEND_PORT}/api/users/me")
+      assert backend_status == "401"
+      machine.succeed("grep 'You are not signed in' /tmp/backend-output")
 
-        frontend_status = machine.succeed("curl -L -o /tmp/frontend-output -w '%{http_code}' http://localhost:${toString settings.PORT}")
-        assert frontend_status == "200"
-        machine.succeed("grep 'Sign in to Pocket ID' /tmp/frontend-output")
-      '';
-  }
-)
+      frontend_status = machine.succeed("curl -L -o /tmp/frontend-output -w '%{http_code}' http://localhost:${toString settings.PORT}")
+      assert frontend_status == "200"
+      machine.succeed("grep 'Sign in to Pocket ID' /tmp/frontend-output")
+    '';
+}
diff --git a/nixos/tests/podgrab.nix b/nixos/tests/podgrab.nix
index 05c2fd726016..cefe5d373d99 100644
--- a/nixos/tests/podgrab.nix
+++ b/nixos/tests/podgrab.nix
@@ -2,40 +2,38 @@ let
   defaultPort = 8080;
   customPort = 4242;
 in
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "podgrab";
+{ pkgs, ... }:
+{
+  name = "podgrab";
 
-    nodes = {
-      default =
-        { ... }:
-        {
-          services.podgrab.enable = true;
+  nodes = {
+    default =
+      { ... }:
+      {
+        services.podgrab.enable = true;
+      };
+
+    customized =
+      { ... }:
+      {
+        services.podgrab = {
+          enable = true;
+          port = customPort;
         };
+      };
+  };
 
-      customized =
-        { ... }:
-        {
-          services.podgrab = {
-            enable = true;
-            port = customPort;
-          };
-        };
-    };
+  testScript = ''
+    start_all()
 
-    testScript = ''
-      start_all()
+    default.wait_for_unit("podgrab")
+    default.wait_for_open_port(${toString defaultPort})
+    default.succeed("curl --fail http://localhost:${toString defaultPort}")
 
-      default.wait_for_unit("podgrab")
-      default.wait_for_open_port(${toString defaultPort})
-      default.succeed("curl --fail http://localhost:${toString defaultPort}")
+    customized.wait_for_unit("podgrab")
+    customized.wait_for_open_port(${toString customPort})
+    customized.succeed("curl --fail http://localhost:${toString customPort}")
+  '';
 
-      customized.wait_for_unit("podgrab")
-      customized.wait_for_open_port(${toString customPort})
-      customized.succeed("curl --fail http://localhost:${toString customPort}")
-    '';
-
-    meta.maintainers = with pkgs.lib.maintainers; [ ambroisie ];
-  }
-)
+  meta.maintainers = with pkgs.lib.maintainers; [ ambroisie ];
+}
diff --git a/nixos/tests/polaris.nix b/nixos/tests/polaris.nix
index 3a530996d63a..59e4b37337bf 100644
--- a/nixos/tests/polaris.nix
+++ b/nixos/tests/polaris.nix
@@ -1,32 +1,30 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "polaris";
-    meta.maintainers = with lib.maintainers; [ pbsds ];
+{
+  name = "polaris";
+  meta.maintainers = with lib.maintainers; [ pbsds ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.jq ];
-        services.polaris = {
-          enable = true;
-          port = 5050;
-          settings.users = [
-            {
-              name = "test_user";
-              password = "very_secret_password";
-              admin = true;
-            }
-          ];
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.jq ];
+      services.polaris = {
+        enable = true;
+        port = 5050;
+        settings.users = [
+          {
+            name = "test_user";
+            password = "very_secret_password";
+            admin = true;
+          }
+        ];
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("polaris.service")
-      machine.wait_for_open_port(5050)
-      machine.succeed("curl http://localhost:5050/api/version")
-      machine.succeed("curl -X GET http://localhost:5050/api/initial_setup -H  'accept: application/json' | jq -e '.has_any_users == true'")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("polaris.service")
+    machine.wait_for_open_port(5050)
+    machine.succeed("curl http://localhost:5050/api/version")
+    machine.succeed("curl -X GET http://localhost:5050/api/initial_setup -H  'accept: application/json' | jq -e '.has_any_users == true'")
+  '';
+}
diff --git a/nixos/tests/portunus.nix b/nixos/tests/portunus.nix
index 5bfe990943b5..5562c7f5ac8a 100644
--- a/nixos/tests/portunus.nix
+++ b/nixos/tests/portunus.nix
@@ -1,20 +1,18 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "portunus";
-    meta.maintainers = with lib.maintainers; [ SuperSandro2000 ];
+{
+  name = "portunus";
+  meta.maintainers = with lib.maintainers; [ SuperSandro2000 ];
 
-    nodes.machine = _: {
-      services.portunus = {
-        enable = true;
-        ldap.suffix = "dc=example,dc=org";
-      };
+  nodes.machine = _: {
+    services.portunus = {
+      enable = true;
+      ldap.suffix = "dc=example,dc=org";
     };
+  };
 
-    testScript = ''
-      machine.wait_for_unit("portunus.service")
-      machine.succeed("curl --fail -vvv http://localhost:8080/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("portunus.service")
+    machine.succeed("curl --fail -vvv http://localhost:8080/")
+  '';
+}
diff --git a/nixos/tests/postfixadmin.nix b/nixos/tests/postfixadmin.nix
index 9162de429482..2994efcfca47 100644
--- a/nixos/tests/postfixadmin.nix
+++ b/nixos/tests/postfixadmin.nix
@@ -1,36 +1,34 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "postfixadmin";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ globin ];
-    };
+{ pkgs, ... }:
+{
+  name = "postfixadmin";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ globin ];
+  };
 
-    nodes = {
-      postfixadmin =
-        { config, pkgs, ... }:
-        {
-          services.postfixadmin = {
-            enable = true;
-            hostName = "postfixadmin";
-            setupPasswordFile = pkgs.writeText "insecure-test-setup-pw-file" "$2y$10$r0p63YCjd9rb9nHrV9UtVuFgGTmPDLKu.0UIJoQTkWCZZze2iuB1m";
-          };
-          services.nginx.virtualHosts.postfixadmin = {
-            forceSSL = false;
-            enableACME = false;
-          };
+  nodes = {
+    postfixadmin =
+      { config, pkgs, ... }:
+      {
+        services.postfixadmin = {
+          enable = true;
+          hostName = "postfixadmin";
+          setupPasswordFile = pkgs.writeText "insecure-test-setup-pw-file" "$2y$10$r0p63YCjd9rb9nHrV9UtVuFgGTmPDLKu.0UIJoQTkWCZZze2iuB1m";
         };
-    };
+        services.nginx.virtualHosts.postfixadmin = {
+          forceSSL = false;
+          enableACME = false;
+        };
+      };
+  };
 
-    testScript = ''
-      postfixadmin.start
-      postfixadmin.wait_for_unit("postgresql.service")
-      postfixadmin.wait_for_unit("phpfpm-postfixadmin.service")
-      postfixadmin.wait_for_unit("nginx.service")
-      postfixadmin.succeed(
-          "curl -sSfL http://postfixadmin/setup.php -X POST -F 'setup_password=not production'"
-      )
-      postfixadmin.succeed("curl -sSfL http://postfixadmin/ | grep 'Mail admins login here'")
-    '';
-  }
-)
+  testScript = ''
+    postfixadmin.start
+    postfixadmin.wait_for_unit("postgresql.service")
+    postfixadmin.wait_for_unit("phpfpm-postfixadmin.service")
+    postfixadmin.wait_for_unit("nginx.service")
+    postfixadmin.succeed(
+        "curl -sSfL http://postfixadmin/setup.php -X POST -F 'setup_password=not production'"
+    )
+    postfixadmin.succeed("curl -sSfL http://postfixadmin/ | grep 'Mail admins login here'")
+  '';
+}
diff --git a/nixos/tests/power-profiles-daemon.nix b/nixos/tests/power-profiles-daemon.nix
index a1f10afda9e6..75a45c437f63 100644
--- a/nixos/tests/power-profiles-daemon.nix
+++ b/nixos/tests/power-profiles-daemon.nix
@@ -1,64 +1,62 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "power-profiles-daemon";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ mvnetbiz ];
+{
+  name = "power-profiles-daemon";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ mvnetbiz ];
+  };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      security.polkit.enable = true;
+      services.power-profiles-daemon.enable = true;
+      environment.systemPackages = [
+        pkgs.glib
+        pkgs.power-profiles-daemon
+      ];
     };
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        security.polkit.enable = true;
-        services.power-profiles-daemon.enable = true;
-        environment.systemPackages = [
-          pkgs.glib
-          pkgs.power-profiles-daemon
-        ];
-      };
 
-    testScript = ''
-      def get_profile():
-          return machine.succeed(
-              """gdbus call --system --dest org.freedesktop.UPower.PowerProfiles --object-path /org/freedesktop/UPower/PowerProfiles \
-      --method org.freedesktop.DBus.Properties.Get 'org.freedesktop.UPower.PowerProfiles' 'ActiveProfile'
-      """
-          )
+  testScript = ''
+    def get_profile():
+        return machine.succeed(
+            """gdbus call --system --dest org.freedesktop.UPower.PowerProfiles --object-path /org/freedesktop/UPower/PowerProfiles \
+    --method org.freedesktop.DBus.Properties.Get 'org.freedesktop.UPower.PowerProfiles' 'ActiveProfile'
+    """
+        )
 
 
-      def set_profile(profile):
-          return machine.succeed(
-              """gdbus call --system --dest org.freedesktop.UPower.PowerProfiles --object-path /org/freedesktop/UPower/PowerProfiles \
-      --method org.freedesktop.DBus.Properties.Set 'org.freedesktop.UPower.PowerProfiles' 'ActiveProfile' "<'{profile}'>"
-      """.format(
-                  profile=profile
-              )
-          )
+    def set_profile(profile):
+        return machine.succeed(
+            """gdbus call --system --dest org.freedesktop.UPower.PowerProfiles --object-path /org/freedesktop/UPower/PowerProfiles \
+    --method org.freedesktop.DBus.Properties.Set 'org.freedesktop.UPower.PowerProfiles' 'ActiveProfile' "<'{profile}'>"
+    """.format(
+                profile=profile
+            )
+        )
 
 
-      machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("multi-user.target")
 
-      set_profile("power-saver")
-      profile = get_profile()
-      if not "power-saver" in profile:
-          raise Exception("Unable to set power-saver profile")
+    set_profile("power-saver")
+    profile = get_profile()
+    if not "power-saver" in profile:
+        raise Exception("Unable to set power-saver profile")
 
 
-      set_profile("balanced")
-      profile = get_profile()
-      if not "balanced" in profile:
-          raise Exception("Unable to set balanced profile")
+    set_profile("balanced")
+    profile = get_profile()
+    if not "balanced" in profile:
+        raise Exception("Unable to set balanced profile")
 
-      # test powerprofilectl CLI
-      machine.succeed("powerprofilesctl set power-saver")
-      profile = get_profile()
-      if not "power-saver" in profile:
-          raise Exception("Unable to set power-saver profile with powerprofilectl")
+    # test powerprofilectl CLI
+    machine.succeed("powerprofilesctl set power-saver")
+    profile = get_profile()
+    if not "power-saver" in profile:
+        raise Exception("Unable to set power-saver profile with powerprofilectl")
 
-      machine.succeed("powerprofilesctl set balanced")
-      profile = get_profile()
-      if not "balanced" in profile:
-          raise Exception("Unable to set balanced profile with powerprofilectl")
-    '';
-  }
-)
+    machine.succeed("powerprofilesctl set balanced")
+    profile = get_profile()
+    if not "balanced" in profile:
+        raise Exception("Unable to set balanced profile with powerprofilectl")
+  '';
+}
diff --git a/nixos/tests/powerdns.nix b/nixos/tests/powerdns.nix
index 9ca6e597b6be..2813fa89bee5 100644
--- a/nixos/tests/powerdns.nix
+++ b/nixos/tests/powerdns.nix
@@ -2,71 +2,69 @@
 # generic MySQL backend (gmysql) to connect to a
 # MariaDB server using UNIX sockets authentication.
 
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "powerdns";
+{ pkgs, lib, ... }:
+{
+  name = "powerdns";
 
-    nodes.server =
-      { ... }:
-      {
-        services.powerdns.enable = true;
-        services.powerdns.extraConfig = ''
-          launch=gmysql
-          gmysql-user=pdns
-          zone-cache-refresh-interval=0
-        '';
+  nodes.server =
+    { ... }:
+    {
+      services.powerdns.enable = true;
+      services.powerdns.extraConfig = ''
+        launch=gmysql
+        gmysql-user=pdns
+        zone-cache-refresh-interval=0
+      '';
 
-        services.mysql = {
-          enable = true;
-          package = pkgs.mariadb;
-          ensureDatabases = [ "powerdns" ];
-          ensureUsers = lib.singleton {
-            name = "pdns";
-            ensurePermissions = {
-              "powerdns.*" = "ALL PRIVILEGES";
-            };
+      services.mysql = {
+        enable = true;
+        package = pkgs.mariadb;
+        ensureDatabases = [ "powerdns" ];
+        ensureUsers = lib.singleton {
+          name = "pdns";
+          ensurePermissions = {
+            "powerdns.*" = "ALL PRIVILEGES";
           };
         };
-
-        environment.systemPackages = with pkgs; [
-          dnsutils
-          powerdns
-          mariadb
-        ];
       };
 
-    testScript = ''
-      with subtest("PowerDNS database exists"):
-          server.wait_for_unit("mysql")
-          server.succeed("echo 'SHOW DATABASES;' | sudo -u pdns mysql -u pdns >&2")
+      environment.systemPackages = with pkgs; [
+        dnsutils
+        powerdns
+        mariadb
+      ];
+    };
 
-      with subtest("Loading the MySQL schema works"):
-          server.succeed(
-              "sudo -u pdns mysql -u pdns -D powerdns <"
-              "${pkgs.powerdns}/share/doc/pdns/schema.mysql.sql"
-          )
+  testScript = ''
+    with subtest("PowerDNS database exists"):
+        server.wait_for_unit("mysql")
+        server.succeed("echo 'SHOW DATABASES;' | sudo -u pdns mysql -u pdns >&2")
 
-      with subtest("PowerDNS server starts"):
-          server.wait_for_unit("pdns")
-          server.succeed("dig version.bind txt chaos @127.0.0.1 >&2")
+    with subtest("Loading the MySQL schema works"):
+        server.succeed(
+            "sudo -u pdns mysql -u pdns -D powerdns <"
+            "${pkgs.powerdns}/share/doc/pdns/schema.mysql.sql"
+        )
 
-      with subtest("Adding an example zone works"):
-          # Extract configuration file needed by pdnsutil
-          pdnsutil = "sudo -u pdns pdnsutil "
-          server.succeed(f"{pdnsutil} create-zone example.com ns1.example.com")
-          server.succeed(f"{pdnsutil} add-record  example.com ns1 A 192.168.1.2")
+    with subtest("PowerDNS server starts"):
+        server.wait_for_unit("pdns")
+        server.succeed("dig version.bind txt chaos @127.0.0.1 >&2")
 
-      with subtest("Querying the example zone works"):
-          reply = server.succeed("dig +noall +answer ns1.example.com @127.0.0.1")
-          assert (
-              "192.168.1.2" in reply
-          ), f""""
-          The reply does not contain the expected IP address:
-            Expected:
-              ns1.example.com.        3600    IN      A       192.168.1.2
-            Reply:
-              {reply}"""
-    '';
-  }
-)
+    with subtest("Adding an example zone works"):
+        # Extract configuration file needed by pdnsutil
+        pdnsutil = "sudo -u pdns pdnsutil "
+        server.succeed(f"{pdnsutil} create-zone example.com ns1.example.com")
+        server.succeed(f"{pdnsutil} add-record  example.com ns1 A 192.168.1.2")
+
+    with subtest("Querying the example zone works"):
+        reply = server.succeed("dig +noall +answer ns1.example.com @127.0.0.1")
+        assert (
+            "192.168.1.2" in reply
+        ), f""""
+        The reply does not contain the expected IP address:
+          Expected:
+            ns1.example.com.        3600    IN      A       192.168.1.2
+          Reply:
+            {reply}"""
+  '';
+}
diff --git a/nixos/tests/pppd.nix b/nixos/tests/pppd.nix
index ad4927e9e67b..20cc03bfc7e7 100644
--- a/nixos/tests/pppd.nix
+++ b/nixos/tests/pppd.nix
@@ -1,75 +1,73 @@
-import ./make-test-python.nix (
-  let
-    chap-secrets = {
-      text = ''"flynn" * "reindeerflotilla" *'';
-      mode = "0640";
-    };
-  in
-  { pkgs, ... }:
-  {
-    name = "pppd";
+let
+  chap-secrets = {
+    text = ''"flynn" * "reindeerflotilla" *'';
+    mode = "0640";
+  };
+in
+{ pkgs, ... }:
+{
+  name = "pppd";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ stv0g ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ stv0g ];
+  };
 
-    nodes = {
-      server =
-        { config, pkgs, ... }:
-        {
-          config = {
-            # Run a PPPoE access concentrator server. It will spawn an
-            # appropriate PPP server process when a PPPoE client sets up a
-            # PPPoE session.
-            systemd.services.pppoe-server = {
-              restartTriggers = [
-                config.environment.etc."ppp/pppoe-server-options".source
-                config.environment.etc."ppp/chap-secrets".source
-              ];
-              after = [ "network.target" ];
-              serviceConfig = {
-                ExecStart = "${pkgs.rpPPPoE}/sbin/pppoe-server -F -O /etc/ppp/pppoe-server-options -q ${pkgs.ppp}/sbin/pppd -I eth1 -L 192.0.2.1 -R 192.0.2.2";
-              };
-              wantedBy = [ "multi-user.target" ];
-            };
-            environment.etc = {
-              "ppp/pppoe-server-options".text = ''
-                lcp-echo-interval 10
-                lcp-echo-failure 2
-                plugin pppoe.so
-                require-chap
-                nobsdcomp
-                noccp
-                novj
-              '';
-              "ppp/chap-secrets" = chap-secrets;
+  nodes = {
+    server =
+      { config, pkgs, ... }:
+      {
+        config = {
+          # Run a PPPoE access concentrator server. It will spawn an
+          # appropriate PPP server process when a PPPoE client sets up a
+          # PPPoE session.
+          systemd.services.pppoe-server = {
+            restartTriggers = [
+              config.environment.etc."ppp/pppoe-server-options".source
+              config.environment.etc."ppp/chap-secrets".source
+            ];
+            after = [ "network.target" ];
+            serviceConfig = {
+              ExecStart = "${pkgs.rpPPPoE}/sbin/pppoe-server -F -O /etc/ppp/pppoe-server-options -q ${pkgs.ppp}/sbin/pppd -I eth1 -L 192.0.2.1 -R 192.0.2.2";
             };
+            wantedBy = [ "multi-user.target" ];
+          };
+          environment.etc = {
+            "ppp/pppoe-server-options".text = ''
+              lcp-echo-interval 10
+              lcp-echo-failure 2
+              plugin pppoe.so
+              require-chap
+              nobsdcomp
+              noccp
+              novj
+            '';
+            "ppp/chap-secrets" = chap-secrets;
           };
         };
-      client =
-        { config, pkgs, ... }:
-        {
-          services.pppd = {
-            enable = true;
-            peers.test = {
-              config = ''
-                plugin pppoe.so eth1
-                name "flynn"
-                noipdefault
-                persist
-                noauth
-                debug
-              '';
-            };
+      };
+    client =
+      { config, pkgs, ... }:
+      {
+        services.pppd = {
+          enable = true;
+          peers.test = {
+            config = ''
+              plugin pppoe.so eth1
+              name "flynn"
+              noipdefault
+              persist
+              noauth
+              debug
+            '';
           };
-          environment.etc."ppp/chap-secrets" = chap-secrets;
         };
-    };
+        environment.etc."ppp/chap-secrets" = chap-secrets;
+      };
+  };
 
-    testScript = ''
-      start_all()
-      client.wait_until_succeeds("ping -c1 -W1 192.0.2.1")
-      server.wait_until_succeeds("ping -c1 -W1 192.0.2.2")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    client.wait_until_succeeds("ping -c1 -W1 192.0.2.1")
+    server.wait_until_succeeds("ping -c1 -W1 192.0.2.2")
+  '';
+}
diff --git a/nixos/tests/private-gpt.nix b/nixos/tests/private-gpt.nix
index f6bfda38aabf..f5c005165ab1 100644
--- a/nixos/tests/private-gpt.nix
+++ b/nixos/tests/private-gpt.nix
@@ -1,31 +1,29 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    mainPort = "8001";
-  in
-  {
-    name = "private-gpt";
-    meta = with lib.maintainers; {
-      maintainers = [ ];
-    };
+{ pkgs, lib, ... }:
+let
+  mainPort = "8001";
+in
+{
+  name = "private-gpt";
+  meta = with lib.maintainers; {
+    maintainers = [ ];
+  };
 
-    nodes = {
-      machine =
-        { ... }:
-        {
-          services.private-gpt = {
-            enable = true;
-          };
+  nodes = {
+    machine =
+      { ... }:
+      {
+        services.private-gpt = {
+          enable = true;
         };
-    };
+      };
+  };
 
-    testScript = ''
-      machine.start()
+  testScript = ''
+    machine.start()
 
-      machine.wait_for_unit("private-gpt.service")
-      machine.wait_for_open_port(${mainPort})
+    machine.wait_for_unit("private-gpt.service")
+    machine.wait_for_open_port(${mainPort})
 
-      machine.succeed("curl http://127.0.0.1:${mainPort}")
-    '';
-  }
-)
+    machine.succeed("curl http://127.0.0.1:${mainPort}")
+  '';
+}
diff --git a/nixos/tests/privoxy.nix b/nixos/tests/privoxy.nix
index 0c0cb6ab2e31..acbd1f81e878 100644
--- a/nixos/tests/privoxy.nix
+++ b/nixos/tests/privoxy.nix
@@ -1,155 +1,153 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  let
-    # Note: For some reason Privoxy can't issue valid
-    # certificates if the CA is generated using gnutls :(
-    certs = pkgs.runCommand "example-certs" { buildInputs = [ pkgs.openssl ]; } ''
-      mkdir $out
+let
+  # Note: For some reason Privoxy can't issue valid
+  # certificates if the CA is generated using gnutls :(
+  certs = pkgs.runCommand "example-certs" { buildInputs = [ pkgs.openssl ]; } ''
+    mkdir $out
 
-      # generate CA keypair
-      openssl req -new -nodes -x509 \
-        -extensions v3_ca -keyout $out/ca.key \
-        -out $out/ca.crt -days 365 \
-        -subj "/O=Privoxy CA/CN=Privoxy CA"
+    # generate CA keypair
+    openssl req -new -nodes -x509 \
+      -extensions v3_ca -keyout $out/ca.key \
+      -out $out/ca.crt -days 365 \
+      -subj "/O=Privoxy CA/CN=Privoxy CA"
 
-      # generate server key/signing request
-      openssl genrsa -out $out/server.key 3072
-      openssl req -new -key $out/server.key \
-        -out server.csr -sha256 \
-        -subj "/O=An unhappy server./CN=example.com"
+    # generate server key/signing request
+    openssl genrsa -out $out/server.key 3072
+    openssl req -new -key $out/server.key \
+      -out server.csr -sha256 \
+      -subj "/O=An unhappy server./CN=example.com"
 
-      # sign the request/generate the certificate
-      openssl x509 -req -in server.csr -CA $out/ca.crt \
-      -CAkey $out/ca.key -CAcreateserial -out $out/server.crt \
-      -days 500 -sha256
-    '';
-  in
+    # sign the request/generate the certificate
+    openssl x509 -req -in server.csr -CA $out/ca.crt \
+    -CAkey $out/ca.key -CAcreateserial -out $out/server.crt \
+    -days 500 -sha256
+  '';
+in
 
-  {
-    name = "privoxy";
-    meta = with lib.maintainers; {
-      maintainers = [ rnhmjoj ];
+{
+  name = "privoxy";
+  meta = with lib.maintainers; {
+    maintainers = [ rnhmjoj ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      services.nginx.enable = true;
+      services.nginx.virtualHosts."example.com" = {
+        addSSL = true;
+        sslCertificate = "${certs}/server.crt";
+        sslCertificateKey = "${certs}/server.key";
+        locations."/".root = pkgs.writeTextFile {
+          name = "bad-day";
+          destination = "/how-are-you/index.html";
+          text = "I've had a bad day!\n";
+        };
+        locations."/ads".extraConfig = ''
+          return 200 "Hot Nixpkgs PRs in your area. Click here!\n";
+        '';
+      };
+
+      services.privoxy = {
+        enable = true;
+        inspectHttps = true;
+        settings = {
+          ca-cert-file = "${certs}/ca.crt";
+          ca-key-file = "${certs}/ca.key";
+          debug = 65536;
+        };
+        userActions = ''
+          {+filter{positive}}
+          example.com
+
+          {+block{Fake ads}}
+          example.com/ads
+        '';
+        userFilters = ''
+          FILTER: positive This is a filter example.
+          s/bad/great/ig
+        '';
+      };
+
+      security.pki.certificateFiles = [ "${certs}/ca.crt" ];
+
+      networking.hosts."::1" = [ "example.com" ];
+      networking.proxy.httpProxy = "http://localhost:8118";
+      networking.proxy.httpsProxy = "http://localhost:8118";
     };
 
-    nodes.machine =
-      { ... }:
-      {
-        services.nginx.enable = true;
-        services.nginx.virtualHosts."example.com" = {
-          addSSL = true;
-          sslCertificate = "${certs}/server.crt";
-          sslCertificateKey = "${certs}/server.key";
-          locations."/".root = pkgs.writeTextFile {
-            name = "bad-day";
-            destination = "/how-are-you/index.html";
-            text = "I've had a bad day!\n";
-          };
-          locations."/ads".extraConfig = ''
-            return 200 "Hot Nixpkgs PRs in your area. Click here!\n";
-          '';
-        };
-
-        services.privoxy = {
-          enable = true;
-          inspectHttps = true;
-          settings = {
-            ca-cert-file = "${certs}/ca.crt";
-            ca-key-file = "${certs}/ca.key";
-            debug = 65536;
-          };
-          userActions = ''
-            {+filter{positive}}
-            example.com
-
-            {+block{Fake ads}}
-            example.com/ads
-          '';
-          userFilters = ''
-            FILTER: positive This is a filter example.
-            s/bad/great/ig
-          '';
-        };
-
-        security.pki.certificateFiles = [ "${certs}/ca.crt" ];
-
-        networking.hosts."::1" = [ "example.com" ];
-        networking.proxy.httpProxy = "http://localhost:8118";
-        networking.proxy.httpsProxy = "http://localhost:8118";
+  nodes.machine_socks4 =
+    { ... }:
+    {
+      services.privoxy = {
+        enable = true;
+        settings.forward-socks4 = "/ 127.0.0.1:9050 .";
       };
-
-    nodes.machine_socks4 =
-      { ... }:
-      {
-        services.privoxy = {
-          enable = true;
-          settings.forward-socks4 = "/ 127.0.0.1:9050 .";
-        };
+    };
+  nodes.machine_socks4a =
+    { ... }:
+    {
+      services.privoxy = {
+        enable = true;
+        settings.forward-socks4a = "/ 127.0.0.1:9050 .";
       };
-    nodes.machine_socks4a =
-      { ... }:
-      {
-        services.privoxy = {
-          enable = true;
-          settings.forward-socks4a = "/ 127.0.0.1:9050 .";
-        };
+    };
+  nodes.machine_socks5 =
+    { ... }:
+    {
+      services.privoxy = {
+        enable = true;
+        settings.forward-socks5 = "/ 127.0.0.1:9050 .";
       };
-    nodes.machine_socks5 =
-      { ... }:
-      {
-        services.privoxy = {
-          enable = true;
-          settings.forward-socks5 = "/ 127.0.0.1:9050 .";
-        };
-      };
-    nodes.machine_socks5t =
-      { ... }:
-      {
-        services.privoxy = {
-          enable = true;
-          settings.forward-socks5t = "/ 127.0.0.1:9050 .";
-        };
+    };
+  nodes.machine_socks5t =
+    { ... }:
+    {
+      services.privoxy = {
+        enable = true;
+        settings.forward-socks5t = "/ 127.0.0.1:9050 .";
       };
+    };
 
-    testScript = ''
-      with subtest("Privoxy is running"):
-          machine.wait_for_unit("privoxy")
-          machine.wait_for_open_port(8118)
-          machine.succeed("curl -f http://config.privoxy.org")
+  testScript = ''
+    with subtest("Privoxy is running"):
+        machine.wait_for_unit("privoxy")
+        machine.wait_for_open_port(8118)
+        machine.succeed("curl -f http://config.privoxy.org")
 
-      with subtest("Privoxy can filter http requests"):
-          machine.wait_for_open_port(80)
-          assert "great day" in machine.succeed(
-              "curl -sfL http://example.com/how-are-you? | tee /dev/stderr"
-          )
+    with subtest("Privoxy can filter http requests"):
+        machine.wait_for_open_port(80)
+        assert "great day" in machine.succeed(
+            "curl -sfL http://example.com/how-are-you? | tee /dev/stderr"
+        )
 
-      with subtest("Privoxy can filter https requests"):
-          machine.wait_for_open_port(443)
-          assert "great day" in machine.succeed(
-              "curl -sfL https://example.com/how-are-you? | tee /dev/stderr"
-          )
+    with subtest("Privoxy can filter https requests"):
+        machine.wait_for_open_port(443)
+        assert "great day" in machine.succeed(
+            "curl -sfL https://example.com/how-are-you? | tee /dev/stderr"
+        )
 
-      with subtest("Blocks are working"):
-          machine.wait_for_open_port(443)
-          machine.fail("curl -f https://example.com/ads 1>&2")
-          machine.succeed("curl -f https://example.com/PRIVOXY-FORCE/ads 1>&2")
+    with subtest("Blocks are working"):
+        machine.wait_for_open_port(443)
+        machine.fail("curl -f https://example.com/ads 1>&2")
+        machine.succeed("curl -f https://example.com/PRIVOXY-FORCE/ads 1>&2")
 
-      with subtest("Temporary certificates are cleaned"):
-          # Count current certificates
-          machine.succeed("test $(ls /run/privoxy/certs | wc -l) -gt 0")
-          # Forward in time 12 days, trigger the timer..
-          machine.succeed("date -s \"$(date --date '12 days')\"")
-          machine.systemctl("start systemd-tmpfiles-clean")
-          # ...and count again
-          machine.succeed("test $(ls /run/privoxy/certs | wc -l) -eq 0")
+    with subtest("Temporary certificates are cleaned"):
+        # Count current certificates
+        machine.succeed("test $(ls /run/privoxy/certs | wc -l) -gt 0")
+        # Forward in time 12 days, trigger the timer..
+        machine.succeed("date -s \"$(date --date '12 days')\"")
+        machine.systemctl("start systemd-tmpfiles-clean")
+        # ...and count again
+        machine.succeed("test $(ls /run/privoxy/certs | wc -l) -eq 0")
 
-      with subtest("Privoxy supports socks upstream proxies"):
-          for m in [machine_socks4, machine_socks4a, machine_socks5, machine_socks5t]:
-              m.wait_for_unit("privoxy")
-              m.wait_for_open_port(8118)
-              # We expect a 503 error because the dummy upstream proxy is not reachable.
-              # In issue #265654, instead privoxy segfaulted causing curl to exit with "Empty reply from server".
-              m.succeed("http_proxy=http://localhost:8118 curl -v http://does-not-exist/ 2>&1 | grep 'HTTP/1.1 503'")
-    '';
-  }
-)
+    with subtest("Privoxy supports socks upstream proxies"):
+        for m in [machine_socks4, machine_socks4a, machine_socks5, machine_socks5t]:
+            m.wait_for_unit("privoxy")
+            m.wait_for_open_port(8118)
+            # We expect a 503 error because the dummy upstream proxy is not reachable.
+            # In issue #265654, instead privoxy segfaulted causing curl to exit with "Empty reply from server".
+            m.succeed("http_proxy=http://localhost:8118 curl -v http://does-not-exist/ 2>&1 | grep 'HTTP/1.1 503'")
+  '';
+}
diff --git a/nixos/tests/proxy.nix b/nixos/tests/proxy.nix
index beba1d843592..2526ce954c5b 100644
--- a/nixos/tests/proxy.nix
+++ b/nixos/tests/proxy.nix
@@ -1,100 +1,98 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    backend =
-      { pkgs, ... }:
+let
+  backend =
+    { pkgs, ... }:
+    {
+      services.httpd = {
+        enable = true;
+        adminAddr = "foo@example.org";
+        virtualHosts.localhost.documentRoot = "${pkgs.valgrind.doc}/share/doc/valgrind/html";
+      };
+      networking.firewall.allowedTCPPorts = [ 80 ];
+    };
+in
+{
+  name = "proxy";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
+
+  nodes = {
+    proxy =
+      { nodes, ... }:
       {
         services.httpd = {
           enable = true;
-          adminAddr = "foo@example.org";
-          virtualHosts.localhost.documentRoot = "${pkgs.valgrind.doc}/share/doc/valgrind/html";
+          adminAddr = "bar@example.org";
+          extraModules = [
+            "proxy_balancer"
+            "lbmethod_byrequests"
+          ];
+          extraConfig = ''
+            ExtendedStatus on
+          '';
+          virtualHosts.localhost = {
+            extraConfig = ''
+              <Location /server-status>
+                Require all granted
+                SetHandler server-status
+              </Location>
+
+              <Proxy balancer://cluster>
+                Require all granted
+                BalancerMember http://${nodes.backend1.config.networking.hostName} retry=0
+                BalancerMember http://${nodes.backend2.config.networking.hostName} retry=0
+              </Proxy>
+
+              ProxyStatus       full
+              ProxyPass         /server-status !
+              ProxyPass         /       balancer://cluster/
+              ProxyPassReverse  /       balancer://cluster/
+
+              # For testing; don't want to wait forever for dead backend servers.
+              ProxyTimeout      5
+            '';
+          };
         };
         networking.firewall.allowedTCPPorts = [ 80 ];
       };
-  in
-  {
-    name = "proxy";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
-    };
 
-    nodes = {
-      proxy =
-        { nodes, ... }:
-        {
-          services.httpd = {
-            enable = true;
-            adminAddr = "bar@example.org";
-            extraModules = [
-              "proxy_balancer"
-              "lbmethod_byrequests"
-            ];
-            extraConfig = ''
-              ExtendedStatus on
-            '';
-            virtualHosts.localhost = {
-              extraConfig = ''
-                <Location /server-status>
-                  Require all granted
-                  SetHandler server-status
-                </Location>
+    backend1 = backend;
+    backend2 = backend;
 
-                <Proxy balancer://cluster>
-                  Require all granted
-                  BalancerMember http://${nodes.backend1.config.networking.hostName} retry=0
-                  BalancerMember http://${nodes.backend2.config.networking.hostName} retry=0
-                </Proxy>
+    client = { ... }: { };
+  };
 
-                ProxyStatus       full
-                ProxyPass         /server-status !
-                ProxyPass         /       balancer://cluster/
-                ProxyPassReverse  /       balancer://cluster/
+  testScript = ''
+    start_all()
 
-                # For testing; don't want to wait forever for dead backend servers.
-                ProxyTimeout      5
-              '';
-            };
-          };
-          networking.firewall.allowedTCPPorts = [ 80 ];
-        };
+    proxy.wait_for_unit("httpd")
+    backend1.wait_for_unit("httpd")
+    backend2.wait_for_unit("httpd")
+    client.wait_for_unit("network.target")
 
-      backend1 = backend;
-      backend2 = backend;
+    # With the back-ends up, the proxy should work.
+    client.succeed("curl --fail http://proxy/")
 
-      client = { ... }: { };
-    };
+    client.succeed("curl --fail http://proxy/server-status")
 
-    testScript = ''
-      start_all()
+    # Block the first back-end.
+    backend1.block()
 
-      proxy.wait_for_unit("httpd")
-      backend1.wait_for_unit("httpd")
-      backend2.wait_for_unit("httpd")
-      client.wait_for_unit("network.target")
+    # The proxy should still work.
+    client.succeed("curl --fail http://proxy/")
+    client.succeed("curl --fail http://proxy/")
 
-      # With the back-ends up, the proxy should work.
-      client.succeed("curl --fail http://proxy/")
+    # Block the second back-end.
+    backend2.block()
 
-      client.succeed("curl --fail http://proxy/server-status")
+    # Now the proxy should fail as well.
+    client.fail("curl --fail http://proxy/")
 
-      # Block the first back-end.
-      backend1.block()
-
-      # The proxy should still work.
-      client.succeed("curl --fail http://proxy/")
-      client.succeed("curl --fail http://proxy/")
-
-      # Block the second back-end.
-      backend2.block()
-
-      # Now the proxy should fail as well.
-      client.fail("curl --fail http://proxy/")
-
-      # But if the second back-end comes back, the proxy should start
-      # working again.
-      backend2.unblock()
-      client.succeed("curl --fail http://proxy/")
-    '';
-  }
-)
+    # But if the second back-end comes back, the proxy should start
+    # working again.
+    backend2.unblock()
+    client.succeed("curl --fail http://proxy/")
+  '';
+}
diff --git a/nixos/tests/pt2-clone.nix b/nixos/tests/pt2-clone.nix
index 98df2e8cbac3..160431175f8d 100644
--- a/nixos/tests/pt2-clone.nix
+++ b/nixos/tests/pt2-clone.nix
@@ -1,37 +1,35 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "pt2-clone";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fgaz ];
+{ pkgs, ... }:
+{
+  name = "pt2-clone";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      environment.systemPackages = [ pkgs.pt2-clone ];
     };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  enableOCR = true;
 
-        services.xserver.enable = true;
-        environment.systemPackages = [ pkgs.pt2-clone ];
-      };
+  testScript = ''
+    machine.wait_for_x()
+    # Add a dummy sound card, or the program won't start
+    machine.execute("modprobe snd-dummy")
 
-    enableOCR = true;
+    machine.execute("pt2-clone >&2 &")
 
-    testScript = ''
-      machine.wait_for_x()
-      # Add a dummy sound card, or the program won't start
-      machine.execute("modprobe snd-dummy")
-
-      machine.execute("pt2-clone >&2 &")
-
-      machine.wait_for_window(r"ProTracker")
-      machine.sleep(5)
-      # One of the few words that actually get recognized
-      if "LENGTH" not in machine.get_screen_text():
-          raise Exception("Program did not start successfully")
-      machine.screenshot("screen")
-    '';
-  }
-)
+    machine.wait_for_window(r"ProTracker")
+    machine.sleep(5)
+    # One of the few words that actually get recognized
+    if "LENGTH" not in machine.get_screen_text():
+        raise Exception("Program did not start successfully")
+    machine.screenshot("screen")
+  '';
+}
diff --git a/nixos/tests/public-inbox.nix b/nixos/tests/public-inbox.nix
index 698dbf2eb799..23163f0bc982 100644
--- a/nixos/tests/public-inbox.nix
+++ b/nixos/tests/public-inbox.nix
@@ -1,244 +1,242 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    orga = "example";
-    domain = "${orga}.localdomain";
+{ pkgs, lib, ... }:
+let
+  orga = "example";
+  domain = "${orga}.localdomain";
 
-    tls-cert = pkgs.runCommand "selfSignedCert" { buildInputs = [ pkgs.openssl ]; } ''
-      openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 36500 \
-        -subj '/CN=machine.${domain}'
-      install -D -t $out key.pem cert.pem
-    '';
+  tls-cert = pkgs.runCommand "selfSignedCert" { buildInputs = [ pkgs.openssl ]; } ''
+    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 36500 \
+      -subj '/CN=machine.${domain}'
+    install -D -t $out key.pem cert.pem
+  '';
 
-    gitRepositories = [
-      "repo1"
-      "repo2"
-    ];
-  in
-  {
-    name = "public-inbox";
+  gitRepositories = [
+    "repo1"
+    "repo2"
+  ];
+in
+{
+  name = "public-inbox";
 
-    meta.maintainers = with pkgs.lib.maintainers; [ julm ];
+  meta.maintainers = with pkgs.lib.maintainers; [ julm ];
 
-    nodes.machine =
-      {
-        config,
-        pkgs,
-        nodes,
-        ...
-      }:
-      let
-        inherit (config.services) public-inbox;
-      in
-      {
-        virtualisation.diskSize = 1 * 1024;
-        virtualisation.memorySize = 1 * 1024;
-        networking.domain = domain;
+  nodes.machine =
+    {
+      config,
+      pkgs,
+      nodes,
+      ...
+    }:
+    let
+      inherit (config.services) public-inbox;
+    in
+    {
+      virtualisation.diskSize = 1 * 1024;
+      virtualisation.memorySize = 1 * 1024;
+      networking.domain = domain;
 
-        security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
-        # If using security.acme:
-        #security.acme.certs."${domain}".postRun = ''
-        #  systemctl try-restart public-inbox-nntpd public-inbox-imapd
-        #'';
+      security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
+      # If using security.acme:
+      #security.acme.certs."${domain}".postRun = ''
+      #  systemctl try-restart public-inbox-nntpd public-inbox-imapd
+      #'';
 
-        services.public-inbox = {
+      services.public-inbox = {
+        enable = true;
+        postfix.enable = true;
+        openFirewall = true;
+        settings.publicinbox = {
+          css = [ "href=https://machine.${domain}/style/light.css" ];
+          nntpserver = [ "nntps://machine.${domain}" ];
+          wwwlisting = "match=domain";
+        };
+        mda = {
           enable = true;
-          postfix.enable = true;
-          openFirewall = true;
-          settings.publicinbox = {
-            css = [ "href=https://machine.${domain}/style/light.css" ];
-            nntpserver = [ "nntps://machine.${domain}" ];
-            wwwlisting = "match=domain";
-          };
-          mda = {
-            enable = true;
-            args = [ "--no-precheck" ]; # Allow Bcc:
-          };
-          http = {
-            enable = true;
-            port = "/run/public-inbox-http.sock";
-            #port = 8080;
-            args = [ "-W0" ];
-            mounts = [
-              "https://machine.${domain}/inbox"
-            ];
-          };
-          nntp = {
-            enable = true;
-            #port = 563;
-            args = [ "-W0" ];
-            cert = "${tls-cert}/cert.pem";
-            key = "${tls-cert}/key.pem";
-          };
-          imap = {
-            enable = true;
-            #port = 993;
-            args = [ "-W0" ];
-            cert = "${tls-cert}/cert.pem";
-            key = "${tls-cert}/key.pem";
-          };
-          inboxes =
-            lib.recursiveUpdate
-              (lib.genAttrs gitRepositories (repo: {
-                address = [
-                  # Routed to the "public-inbox:" transport in services.postfix.transport
-                  "${repo}@${domain}"
+          args = [ "--no-precheck" ]; # Allow Bcc:
+        };
+        http = {
+          enable = true;
+          port = "/run/public-inbox-http.sock";
+          #port = 8080;
+          args = [ "-W0" ];
+          mounts = [
+            "https://machine.${domain}/inbox"
+          ];
+        };
+        nntp = {
+          enable = true;
+          #port = 563;
+          args = [ "-W0" ];
+          cert = "${tls-cert}/cert.pem";
+          key = "${tls-cert}/key.pem";
+        };
+        imap = {
+          enable = true;
+          #port = 993;
+          args = [ "-W0" ];
+          cert = "${tls-cert}/cert.pem";
+          key = "${tls-cert}/key.pem";
+        };
+        inboxes =
+          lib.recursiveUpdate
+            (lib.genAttrs gitRepositories (repo: {
+              address = [
+                # Routed to the "public-inbox:" transport in services.postfix.transport
+                "${repo}@${domain}"
+              ];
+              description = ''
+                ${repo}@${domain} :
+                discussions about ${repo}.
+              '';
+              url = "https://machine.${domain}/inbox/${repo}";
+              newsgroup = "inbox.comp.${orga}.${repo}";
+              coderepo = [ repo ];
+            }))
+            {
+              repo2 = {
+                hide = [
+                  "imap" # FIXME: doesn't work for IMAP as of public-inbox 1.6.1
+                  "manifest"
+                  "www"
                 ];
-                description = ''
-                  ${repo}@${domain} :
-                  discussions about ${repo}.
-                '';
-                url = "https://machine.${domain}/inbox/${repo}";
-                newsgroup = "inbox.comp.${orga}.${repo}";
-                coderepo = [ repo ];
-              }))
-              {
-                repo2 = {
-                  hide = [
-                    "imap" # FIXME: doesn't work for IMAP as of public-inbox 1.6.1
-                    "manifest"
-                    "www"
-                  ];
-                };
               };
-          settings.coderepo = lib.listToAttrs (
-            map (
-              repositoryName:
-              lib.nameValuePair repositoryName {
-                dir = "/var/lib/public-inbox/repositories/${repositoryName}.git";
-                cgitUrl = "https://git.${domain}/${repositoryName}.git";
-              }
-            ) gitRepositories
-          );
-        };
-
-        # Use nginx as a reverse proxy for public-inbox-httpd
-        services.nginx = {
-          enable = true;
-          recommendedGzipSettings = true;
-          recommendedOptimisation = true;
-          recommendedTlsSettings = true;
-          recommendedProxySettings = true;
-          virtualHosts."machine.${domain}" = {
-            forceSSL = true;
-            sslCertificate = "${tls-cert}/cert.pem";
-            sslCertificateKey = "${tls-cert}/key.pem";
-            locations."/".return = "302 /inbox";
-            locations."= /inbox".return = "302 /inbox/";
-            locations."/inbox".proxyPass = "http://unix:${public-inbox.http.port}:/inbox";
-            # If using TCP instead of a Unix socket:
-            #locations."/inbox".proxyPass = "http://127.0.0.1:${toString public-inbox.http.port}/inbox";
-            # Referred to by settings.publicinbox.css
-            # See http://public-inbox.org/meta/_/text/color/
-            locations."= /style/light.css".alias = pkgs.writeText "light.css" ''
-              * { background:#fff; color:#000 }
-
-              a { color:#00f; text-decoration:none }
-              a:visited { color:#808 }
-
-              *.q { color:#008 }
-
-              *.add { color:#060 }
-              *.del {color:#900 }
-              *.head { color:#000 }
-              *.hunk { color:#960 }
-
-              .hl.num { color:#f30 } /* number */
-              .hl.esc { color:#f0f } /* escape character */
-              .hl.str { color:#f30 } /* string */
-              .hl.ppc { color:#c3c } /* preprocessor */
-              .hl.pps { color:#f30 } /* preprocessor string */
-              .hl.slc { color:#099 } /* single-line comment */
-              .hl.com { color:#099 } /* multi-line comment */
-              /* .hl.opt { color:#ccc } */ /* operator */
-              /* .hl.ipl { color:#ccc } */ /* interpolation */
-
-              /* keyword groups kw[a-z] */
-              .hl.kwa { color:#f90 }
-              .hl.kwb { color:#060 }
-              .hl.kwc { color:#f90 }
-              /* .hl.kwd { color:#ccc } */
-            '';
-          };
-        };
-
-        services.postfix = {
-          enable = true;
-          setSendmail = true;
-          #sslCert = "${tls-cert}/cert.pem";
-          #sslKey = "${tls-cert}/key.pem";
-          recipientDelimiter = "+";
-        };
-
-        environment.systemPackages = [
-          pkgs.gitMinimal
-          pkgs.mailutils
-          pkgs.openssl
-        ];
-
+            };
+        settings.coderepo = lib.listToAttrs (
+          map (
+            repositoryName:
+            lib.nameValuePair repositoryName {
+              dir = "/var/lib/public-inbox/repositories/${repositoryName}.git";
+              cgitUrl = "https://git.${domain}/${repositoryName}.git";
+            }
+          ) gitRepositories
+        );
       };
 
-    testScript = ''
-      start_all()
+      # Use nginx as a reverse proxy for public-inbox-httpd
+      services.nginx = {
+        enable = true;
+        recommendedGzipSettings = true;
+        recommendedOptimisation = true;
+        recommendedTlsSettings = true;
+        recommendedProxySettings = true;
+        virtualHosts."machine.${domain}" = {
+          forceSSL = true;
+          sslCertificate = "${tls-cert}/cert.pem";
+          sslCertificateKey = "${tls-cert}/key.pem";
+          locations."/".return = "302 /inbox";
+          locations."= /inbox".return = "302 /inbox/";
+          locations."/inbox".proxyPass = "http://unix:${public-inbox.http.port}:/inbox";
+          # If using TCP instead of a Unix socket:
+          #locations."/inbox".proxyPass = "http://127.0.0.1:${toString public-inbox.http.port}/inbox";
+          # Referred to by settings.publicinbox.css
+          # See http://public-inbox.org/meta/_/text/color/
+          locations."= /style/light.css".alias = pkgs.writeText "light.css" ''
+            * { background:#fff; color:#000 }
 
-      # The threshold and/or hardening may have to be changed with new features/checks
-      with subtest("systemd hardening thresholds"):
-        print(machine.succeed("systemd-analyze security public-inbox-httpd.service --threshold=5 --no-pager"))
-        print(machine.succeed("systemd-analyze security public-inbox-imapd.service --threshold=5 --no-pager"))
-        print(machine.succeed("systemd-analyze security public-inbox-nntpd.service --threshold=4 --no-pager"))
+            a { color:#00f; text-decoration:none }
+            a:visited { color:#808 }
 
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_for_unit("public-inbox-init.service")
+            *.q { color:#008 }
 
-      machine.succeed(
-        ${lib.concatMapStrings (repositoryName: ''
-          "sudo -u public-inbox git init --bare -b main /var/lib/public-inbox/repositories/${repositoryName}.git",
-        '') gitRepositories}
-      )
+            *.add { color:#060 }
+            *.del {color:#900 }
+            *.head { color:#000 }
+            *.hunk { color:#960 }
 
-      # List inboxes through public-inbox-httpd
-      machine.wait_for_unit("public-inbox-httpd.socket")
-      machine.wait_for_unit("nginx.service")
-      machine.succeed("curl -L https://machine.${domain} | grep repo1@${domain}")
-      # The repo2 inbox is hidden
-      machine.fail("curl -L https://machine.${domain} | grep repo2@${domain}")
+            .hl.num { color:#f30 } /* number */
+            .hl.esc { color:#f0f } /* escape character */
+            .hl.str { color:#f30 } /* string */
+            .hl.ppc { color:#c3c } /* preprocessor */
+            .hl.pps { color:#f30 } /* preprocessor string */
+            .hl.slc { color:#099 } /* single-line comment */
+            .hl.com { color:#099 } /* multi-line comment */
+            /* .hl.opt { color:#ccc } */ /* operator */
+            /* .hl.ipl { color:#ccc } */ /* interpolation */
 
-      # Send a mail and read it through public-inbox-httpd
-      # Must work too when using a recipientDelimiter.
-      machine.wait_for_unit("postfix.service")
-      machine.succeed("mail -t <${pkgs.writeText "mail" ''
-        Subject: Testing mail
-        From: root@localhost
-        To: repo1+extension@${domain}
-        Message-ID: <repo1@root-1>
-        Content-Type: text/plain; charset=utf-8
-        Content-Disposition: inline
+            /* keyword groups kw[a-z] */
+            .hl.kwa { color:#f90 }
+            .hl.kwb { color:#060 }
+            .hl.kwc { color:#f90 }
+            /* .hl.kwd { color:#ccc } */
+          '';
+        };
+      };
 
-        This is a testing mail.
-      ''}")
-      machine.sleep(10)
-      machine.succeed("curl -L 'https://machine.${domain}/inbox/repo1/repo1@root-1/T/#u' | grep 'This is a testing mail.'")
+      services.postfix = {
+        enable = true;
+        setSendmail = true;
+        #sslCert = "${tls-cert}/cert.pem";
+        #sslKey = "${tls-cert}/key.pem";
+        recipientDelimiter = "+";
+      };
 
-      # Read a mail through public-inbox-imapd
-      machine.wait_for_unit("public-inbox-imapd.socket")
-      machine.succeed("openssl s_client -ign_eof -crlf -connect machine.${domain}:993 <${pkgs.writeText "imap-commands" ''
-        tag login anonymous@${domain} anonymous
-        tag SELECT INBOX.comp.${orga}.repo1.0
-        tag FETCH 1 (BODY[HEADER])
-        tag LOGOUT
-      ''} | grep '^Message-ID: <repo1@root-1>'")
+      environment.systemPackages = [
+        pkgs.gitMinimal
+        pkgs.mailutils
+        pkgs.openssl
+      ];
 
-      # TODO: Read a mail through public-inbox-nntpd
-      #machine.wait_for_unit("public-inbox-nntpd.socket")
+    };
 
-      # Delete a mail.
-      # Note that the use of an extension not listed in the addresses
-      # require to use --all
-      machine.succeed("curl -L https://machine.${domain}/inbox/repo1/repo1@root-1/raw | sudo -u public-inbox public-inbox-learn rm --all")
-      machine.fail("curl -L https://machine.${domain}/inbox/repo1/repo1@root-1/T/#u | grep 'This is a testing mail.'")
+  testScript = ''
+    start_all()
 
-      # Compact the database
-      machine.succeed("sudo -u public-inbox public-inbox-compact --all")
-    '';
-  }
-)
+    # The threshold and/or hardening may have to be changed with new features/checks
+    with subtest("systemd hardening thresholds"):
+      print(machine.succeed("systemd-analyze security public-inbox-httpd.service --threshold=5 --no-pager"))
+      print(machine.succeed("systemd-analyze security public-inbox-imapd.service --threshold=5 --no-pager"))
+      print(machine.succeed("systemd-analyze security public-inbox-nntpd.service --threshold=4 --no-pager"))
+
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("public-inbox-init.service")
+
+    machine.succeed(
+      ${lib.concatMapStrings (repositoryName: ''
+        "sudo -u public-inbox git init --bare -b main /var/lib/public-inbox/repositories/${repositoryName}.git",
+      '') gitRepositories}
+    )
+
+    # List inboxes through public-inbox-httpd
+    machine.wait_for_unit("public-inbox-httpd.socket")
+    machine.wait_for_unit("nginx.service")
+    machine.succeed("curl -L https://machine.${domain} | grep repo1@${domain}")
+    # The repo2 inbox is hidden
+    machine.fail("curl -L https://machine.${domain} | grep repo2@${domain}")
+
+    # Send a mail and read it through public-inbox-httpd
+    # Must work too when using a recipientDelimiter.
+    machine.wait_for_unit("postfix.service")
+    machine.succeed("mail -t <${pkgs.writeText "mail" ''
+      Subject: Testing mail
+      From: root@localhost
+      To: repo1+extension@${domain}
+      Message-ID: <repo1@root-1>
+      Content-Type: text/plain; charset=utf-8
+      Content-Disposition: inline
+
+      This is a testing mail.
+    ''}")
+    machine.sleep(10)
+    machine.succeed("curl -L 'https://machine.${domain}/inbox/repo1/repo1@root-1/T/#u' | grep 'This is a testing mail.'")
+
+    # Read a mail through public-inbox-imapd
+    machine.wait_for_unit("public-inbox-imapd.socket")
+    machine.succeed("openssl s_client -ign_eof -crlf -connect machine.${domain}:993 <${pkgs.writeText "imap-commands" ''
+      tag login anonymous@${domain} anonymous
+      tag SELECT INBOX.comp.${orga}.repo1.0
+      tag FETCH 1 (BODY[HEADER])
+      tag LOGOUT
+    ''} | grep '^Message-ID: <repo1@root-1>'")
+
+    # TODO: Read a mail through public-inbox-nntpd
+    #machine.wait_for_unit("public-inbox-nntpd.socket")
+
+    # Delete a mail.
+    # Note that the use of an extension not listed in the addresses
+    # require to use --all
+    machine.succeed("curl -L https://machine.${domain}/inbox/repo1/repo1@root-1/raw | sudo -u public-inbox public-inbox-learn rm --all")
+    machine.fail("curl -L https://machine.${domain}/inbox/repo1/repo1@root-1/T/#u | grep 'This is a testing mail.'")
+
+    # Compact the database
+    machine.succeed("sudo -u public-inbox public-inbox-compact --all")
+  '';
+}
diff --git a/nixos/tests/pufferpanel.nix b/nixos/tests/pufferpanel.nix
index e0613b43b7de..0b695a57d266 100644
--- a/nixos/tests/pufferpanel.nix
+++ b/nixos/tests/pufferpanel.nix
@@ -1,79 +1,77 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "pufferpanel";
-    meta.maintainers = [ lib.maintainers.tie ];
+{ lib, ... }:
+{
+  name = "pufferpanel";
+  meta.maintainers = [ lib.maintainers.tie ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.pufferpanel ];
-        services.pufferpanel = {
-          enable = true;
-          extraPackages = [ pkgs.netcat ];
-          environment = {
-            PUFFER_PANEL_REGISTRATIONENABLED = "false";
-            PUFFER_PANEL_SETTINGS_COMPANYNAME = "NixOS";
-          };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.pufferpanel ];
+      services.pufferpanel = {
+        enable = true;
+        extraPackages = [ pkgs.netcat ];
+        environment = {
+          PUFFER_PANEL_REGISTRATIONENABLED = "false";
+          PUFFER_PANEL_SETTINGS_COMPANYNAME = "NixOS";
         };
       };
+    };
 
-    testScript = ''
-      import shlex
-      import json
+  testScript = ''
+    import shlex
+    import json
 
-      curl = "curl --fail-with-body --silent"
-      baseURL = "http://localhost:8080"
-      adminName = "admin"
-      adminEmail = "admin@nixos.org"
-      adminPass = "admin"
-      adminCreds = json.dumps({
-        "email": adminEmail,
-        "password": adminPass,
-      })
-      stopCode = 9 # SIGKILL
-      serverPort = 1337
-      serverDefinition = json.dumps({
-        "name": "netcat",
-        "node": 0,
-        "users": [
-          adminName,
-        ],
-        "type": "netcat",
-        "run": {
-          "stopCode": stopCode,
-          "command": f"nc -l {serverPort}",
-        },
-        "environment": {
-          "type": "standard",
-        },
-      })
+    curl = "curl --fail-with-body --silent"
+    baseURL = "http://localhost:8080"
+    adminName = "admin"
+    adminEmail = "admin@nixos.org"
+    adminPass = "admin"
+    adminCreds = json.dumps({
+      "email": adminEmail,
+      "password": adminPass,
+    })
+    stopCode = 9 # SIGKILL
+    serverPort = 1337
+    serverDefinition = json.dumps({
+      "name": "netcat",
+      "node": 0,
+      "users": [
+        adminName,
+      ],
+      "type": "netcat",
+      "run": {
+        "stopCode": stopCode,
+        "command": f"nc -l {serverPort}",
+      },
+      "environment": {
+        "type": "standard",
+      },
+    })
 
-      start_all()
+    start_all()
 
-      machine.wait_for_unit("pufferpanel.service")
-      machine.wait_for_open_port(5657) # SFTP
-      machine.wait_for_open_port(8080) # HTTP
+    machine.wait_for_unit("pufferpanel.service")
+    machine.wait_for_open_port(5657) # SFTP
+    machine.wait_for_open_port(8080) # HTTP
 
-      # Note that PufferPanel does not initialize database unless necessary.
-      # /api/config endpoint creates database file and triggers migrations.
-      # On success, we run a command to create administrator user that we use to
-      # interact with HTTP API.
-      resp = json.loads(machine.succeed(f"{curl} {baseURL}/api/config"))
-      assert resp["branding"]["name"] == "NixOS", "Invalid company name in configuration"
-      assert resp["registrationEnabled"] == False, "Expected registration to be disabled"
+    # Note that PufferPanel does not initialize database unless necessary.
+    # /api/config endpoint creates database file and triggers migrations.
+    # On success, we run a command to create administrator user that we use to
+    # interact with HTTP API.
+    resp = json.loads(machine.succeed(f"{curl} {baseURL}/api/config"))
+    assert resp["branding"]["name"] == "NixOS", "Invalid company name in configuration"
+    assert resp["registrationEnabled"] == False, "Expected registration to be disabled"
 
-      machine.succeed(f"pufferpanel --workDir /var/lib/pufferpanel user add --admin --name {adminName} --email {adminEmail} --password {adminPass}")
+    machine.succeed(f"pufferpanel --workDir /var/lib/pufferpanel user add --admin --name {adminName} --email {adminEmail} --password {adminPass}")
 
-      resp = json.loads(machine.succeed(f"{curl} -d '{adminCreds}' {baseURL}/auth/login"))
-      assert "servers.admin" in resp["scopes"], "User is not administrator"
-      token = resp["session"]
-      authHeader = shlex.quote(f"Authorization: Bearer {token}")
+    resp = json.loads(machine.succeed(f"{curl} -d '{adminCreds}' {baseURL}/auth/login"))
+    assert "servers.admin" in resp["scopes"], "User is not administrator"
+    token = resp["session"]
+    authHeader = shlex.quote(f"Authorization: Bearer {token}")
 
-      resp = json.loads(machine.succeed(f"{curl} -H {authHeader} -H 'Content-Type: application/json' -d '{serverDefinition}' {baseURL}/api/servers"))
-      serverID = resp["id"]
-      machine.succeed(f"{curl} -X POST -H {authHeader} {baseURL}/proxy/daemon/server/{serverID}/start")
-      machine.wait_for_open_port(serverPort)
-    '';
-  }
-)
+    resp = json.loads(machine.succeed(f"{curl} -H {authHeader} -H 'Content-Type: application/json' -d '{serverDefinition}' {baseURL}/api/servers"))
+    serverID = resp["id"]
+    machine.succeed(f"{curl} -X POST -H {authHeader} {baseURL}/proxy/daemon/server/{serverID}/start")
+    machine.wait_for_open_port(serverPort)
+  '';
+}
diff --git a/nixos/tests/pykms.nix b/nixos/tests/pykms.nix
index e7df338a9fc2..035b9f314e67 100644
--- a/nixos/tests/pykms.nix
+++ b/nixos/tests/pykms.nix
@@ -1,23 +1,21 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "pykms-test";
-    meta.maintainers = with pkgs.lib.maintainers; [ zopieux ];
+{ pkgs, ... }:
+{
+  name = "pykms-test";
+  meta.maintainers = with pkgs.lib.maintainers; [ zopieux ];
 
-    nodes.machine =
-      {
-        config,
-        lib,
-        pkgs,
-        ...
-      }:
-      {
-        services.pykms.enable = true;
-      };
+  nodes.machine =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      services.pykms.enable = true;
+    };
 
-    testScript = ''
-      machine.wait_for_unit("pykms.service")
-      machine.succeed("${pkgs.pykms}/bin/client")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("pykms.service")
+    machine.succeed("${pkgs.pykms}/bin/client")
+  '';
+}
diff --git a/nixos/tests/pyload.nix b/nixos/tests/pyload.nix
index 9f87faec2b2c..317f1c43a53d 100644
--- a/nixos/tests/pyload.nix
+++ b/nixos/tests/pyload.nix
@@ -1,38 +1,36 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "pyload";
-    meta.maintainers = with lib.maintainers; [ ambroisie ];
+{ lib, ... }:
+{
+  name = "pyload";
+  meta.maintainers = with lib.maintainers; [ ambroisie ];
 
-    nodes = {
-      machine =
-        { ... }:
-        {
-          services.pyload = {
-            enable = true;
+  nodes = {
+    machine =
+      { ... }:
+      {
+        services.pyload = {
+          enable = true;
 
-            listenAddress = "0.0.0.0";
-            port = 9876;
-          };
-
-          networking.firewall.allowedTCPPorts = [ 9876 ];
+          listenAddress = "0.0.0.0";
+          port = 9876;
         };
 
-      client = { };
-    };
+        networking.firewall.allowedTCPPorts = [ 9876 ];
+      };
 
-    testScript = ''
-      start_all()
+    client = { };
+  };
 
-      machine.wait_for_unit("pyload.service")
+  testScript = ''
+    start_all()
 
-      with subtest("Web interface accessible locally"):
-          machine.wait_until_succeeds("curl -fs localhost:9876")
+    machine.wait_for_unit("pyload.service")
 
-      client.wait_for_unit("network.target")
+    with subtest("Web interface accessible locally"):
+        machine.wait_until_succeeds("curl -fs localhost:9876")
 
-      with subtest("Web interface accessible from a different machine"):
-          client.wait_until_succeeds("curl -fs machine:9876")
-    '';
-  }
-)
+    client.wait_for_unit("network.target")
+
+    with subtest("Web interface accessible from a different machine"):
+        client.wait_until_succeeds("curl -fs machine:9876")
+  '';
+}
diff --git a/nixos/tests/qownnotes.nix b/nixos/tests/qownnotes.nix
index 710492f59bf5..3c5de65e5cfc 100644
--- a/nixos/tests/qownnotes.nix
+++ b/nixos/tests/qownnotes.nix
@@ -1,88 +1,86 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  {
-    name = "qownnotes";
-    meta.maintainers = [ lib.maintainers.pbek ];
+{
+  name = "qownnotes";
+  meta.maintainers = [ lib.maintainers.pbek ];
 
-    nodes.machine =
-      { ... }:
+  nodes.machine =
+    { ... }:
 
-      {
-        imports = [
-          ./common/user-account.nix
-          ./common/x11.nix
-        ];
+    {
+      imports = [
+        ./common/user-account.nix
+        ./common/x11.nix
+      ];
 
-        test-support.displayManager.auto.user = "alice";
-        environment.systemPackages = [
-          pkgs.qownnotes
-          pkgs.xdotool
-        ];
-      };
+      test-support.displayManager.auto.user = "alice";
+      environment.systemPackages = [
+        pkgs.qownnotes
+        pkgs.xdotool
+      ];
+    };
 
-    enableOCR = true;
+  enableOCR = true;
 
-    # https://nixos.org/manual/nixos/stable/#ssec-machine-objects
-    testScript =
-      { nodes, ... }:
-      let
-        aliceDo = cmd: ''machine.succeed("su - alice -c '${cmd}' >&2 &");'';
-      in
-      ''
-        with subtest("Ensure X starts"):
-            start_all()
-            machine.wait_for_x()
+  # https://nixos.org/manual/nixos/stable/#ssec-machine-objects
+  testScript =
+    { nodes, ... }:
+    let
+      aliceDo = cmd: ''machine.succeed("su - alice -c '${cmd}' >&2 &");'';
+    in
+    ''
+      with subtest("Ensure X starts"):
+          start_all()
+          machine.wait_for_x()
 
-        with subtest("Check QOwnNotes version on CLI"):
-            ${aliceDo "qownnotes --version"}
+      with subtest("Check QOwnNotes version on CLI"):
+          ${aliceDo "qownnotes --version"}
 
-            machine.wait_for_console_text("QOwnNotes ${pkgs.qownnotes.version}")
+          machine.wait_for_console_text("QOwnNotes ${pkgs.qownnotes.version}")
 
-        with subtest("Ensure QOwnNotes starts"):
-            # start QOwnNotes window
-            ${aliceDo "qownnotes"}
+      with subtest("Ensure QOwnNotes starts"):
+          # start QOwnNotes window
+          ${aliceDo "qownnotes"}
 
-            machine.wait_for_text("Welcome to QOwnNotes")
-            machine.screenshot("QOwnNotes-Welcome")
+          machine.wait_for_text("Welcome to QOwnNotes")
+          machine.screenshot("QOwnNotes-Welcome")
 
-        with subtest("Finish first-run wizard"):
-            # The wizard should show up now
-            machine.wait_for_text("Note folder")
-            machine.send_key("ret")
-            machine.wait_for_console_text("Note path '/home/alice/Notes' was now created.")
-            machine.wait_for_text("Panel layout")
-            machine.send_key("ret")
-            machine.wait_for_text("Nextcloud")
-            machine.send_key("ret")
-            machine.wait_for_text("App metric")
-            machine.send_key("ret")
+      with subtest("Finish first-run wizard"):
+          # The wizard should show up now
+          machine.wait_for_text("Note folder")
+          machine.send_key("ret")
+          machine.wait_for_console_text("Note path '/home/alice/Notes' was now created.")
+          machine.wait_for_text("Panel layout")
+          machine.send_key("ret")
+          machine.wait_for_text("Nextcloud")
+          machine.send_key("ret")
+          machine.wait_for_text("App metric")
+          machine.send_key("ret")
 
-            # Doesn't work for non-root
-            #machine.wait_for_window("QOwnNotes - ${pkgs.qownnotes.version}")
+          # Doesn't work for non-root
+          #machine.wait_for_window("QOwnNotes - ${pkgs.qownnotes.version}")
 
-            # OCR doesn't seem to be able any more to handle the main window
-            #machine.wait_for_text("QOwnNotes - ${pkgs.qownnotes.version}")
+          # OCR doesn't seem to be able any more to handle the main window
+          #machine.wait_for_text("QOwnNotes - ${pkgs.qownnotes.version}")
 
-            # The main window should now show up
-            machine.wait_for_open_port(22222)
-            machine.wait_for_console_text("QOwnNotes server listening on port 22222")
+          # The main window should now show up
+          machine.wait_for_open_port(22222)
+          machine.wait_for_console_text("QOwnNotes server listening on port 22222")
 
-            machine.screenshot("QOwnNotes-DemoNote")
+          machine.screenshot("QOwnNotes-DemoNote")
 
-        with subtest("Create a new note"):
-            machine.send_key("ctrl-n")
-            machine.sleep(1)
-            machine.send_chars("This is a NixOS test!\n")
-            machine.wait_until_succeeds("find /home/alice/Notes -type f | grep -qi 'Note 2'")
+      with subtest("Create a new note"):
+          machine.send_key("ctrl-n")
+          machine.sleep(1)
+          machine.send_chars("This is a NixOS test!\n")
+          machine.wait_until_succeeds("find /home/alice/Notes -type f | grep -qi 'Note 2'")
 
-            # OCR doesn't seem to be able any more to handle the main window
-            #machine.wait_for_text("This is a NixOS test!")
+          # OCR doesn't seem to be able any more to handle the main window
+          #machine.wait_for_text("This is a NixOS test!")
 
-            # Doesn't work for non-root
-            #machine.wait_for_window("- QOwnNotes - ${pkgs.qownnotes.version}")
+          # Doesn't work for non-root
+          #machine.wait_for_window("- QOwnNotes - ${pkgs.qownnotes.version}")
 
-            machine.screenshot("QOwnNotes-NewNote")
-      '';
-  }
-)
+          machine.screenshot("QOwnNotes-NewNote")
+    '';
+}
diff --git a/nixos/tests/quake3.nix b/nixos/tests/quake3.nix
index cade2991de61..67867796be56 100644
--- a/nixos/tests/quake3.nix
+++ b/nixos/tests/quake3.nix
@@ -1,102 +1,93 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ lib, ... }:
+let
+  # Build Quake with coverage instrumentation.
+  overrides = pkgs: {
+    quake3game = pkgs.quake3game.override (args: {
+      stdenv = pkgs.stdenvAdapters.addCoverageInstrumentation args.stdenv;
+    });
+  };
 
-  let
+  # Only allow the demo data to be used (only if it's unfreeRedistributable).
+  unfreePredicate =
+    pkg:
+    let
+      allowPackageNames = [
+        "quake3-demodata"
+        "quake3-pointrelease"
+      ];
+      allowLicenses = [ lib.licenses.unfreeRedistributable ];
+    in
+    lib.elem pkg.pname allowPackageNames && lib.elem (pkg.meta.license or null) allowLicenses;
 
-    # Build Quake with coverage instrumentation.
-    overrides = pkgs: {
-      quake3game = pkgs.quake3game.override (args: {
-        stdenv = pkgs.stdenvAdapters.addCoverageInstrumentation args.stdenv;
-      });
+  client =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/x11.nix ];
+      hardware.graphics.enable = true;
+      environment.systemPackages = [ pkgs.quake3demo ];
+      nixpkgs.config.packageOverrides = overrides;
+      nixpkgs.config.allowUnfreePredicate = unfreePredicate;
     };
+in
+{
+  name = "quake3";
+  meta.maintainers = with lib.maintainers; [ domenkozar ];
 
-    # Only allow the demo data to be used (only if it's unfreeRedistributable).
-    unfreePredicate =
-      pkg:
-      let
-        allowPackageNames = [
-          "quake3-demodata"
-          "quake3-pointrelease"
-        ];
-        allowLicenses = [ lib.licenses.unfreeRedistributable ];
-      in
-      lib.elem pkg.pname allowPackageNames && lib.elem (pkg.meta.license or null) allowLicenses;
+  node.pkgsReadOnly = false;
 
-    client =
+  # TODO: lcov doesn't work atm
+  #makeCoverageReport = true;
+
+  nodes = {
+    server =
       { pkgs, ... }:
-
       {
-        imports = [ ./common/x11.nix ];
-        hardware.graphics.enable = true;
-        environment.systemPackages = [ pkgs.quake3demo ];
+        systemd.services.quake3-server = {
+          wantedBy = [ "multi-user.target" ];
+          script =
+            "${pkgs.quake3demo}/bin/quake3-server +set g_gametype 0 "
+            + "+map q3dm7 +addbot grunt +addbot daemia 2> /tmp/log";
+        };
         nixpkgs.config.packageOverrides = overrides;
         nixpkgs.config.allowUnfreePredicate = unfreePredicate;
+        networking.firewall.allowedUDPPorts = [ 27960 ];
       };
 
-  in
+    client1 = client;
+    client2 = client;
+  };
 
-  rec {
-    name = "quake3";
-    meta = with lib.maintainers; {
-      maintainers = [ domenkozar ];
-    };
+  testScript = ''
+    start_all()
 
-    # TODO: lcov doesn't work atm
-    #makeCoverageReport = true;
+    server.wait_for_unit("quake3-server")
+    client1.wait_for_x()
+    client2.wait_for_x()
 
-    nodes = {
-      server =
-        { pkgs, ... }:
+    client1.execute("quake3 +set r_fullscreen 0 +set name Foo +connect server >&2 &", check_return = False)
+    client2.execute("quake3 +set r_fullscreen 0 +set name Bar +connect server >&2 &", check_return = False)
 
-        {
-          systemd.services.quake3-server = {
-            wantedBy = [ "multi-user.target" ];
-            script =
-              "${pkgs.quake3demo}/bin/quake3-server +set g_gametype 0 "
-              + "+map q3dm7 +addbot grunt +addbot daemia 2> /tmp/log";
-          };
-          nixpkgs.config.packageOverrides = overrides;
-          nixpkgs.config.allowUnfreePredicate = unfreePredicate;
-          networking.firewall.allowedUDPPorts = [ 27960 ];
-        };
+    server.wait_until_succeeds("grep -q 'Foo.*entered the game' /tmp/log")
+    server.wait_until_succeeds("grep -q 'Bar.*entered the game' /tmp/log")
 
-      client1 = client;
-      client2 = client;
-    };
+    server.sleep(10)  # wait for a while to get a nice screenshot
 
-    testScript = ''
-      start_all()
+    client1.block()
 
-      server.wait_for_unit("quake3-server")
-      client1.wait_for_x()
-      client2.wait_for_x()
+    server.sleep(20)
 
-      client1.execute("quake3 +set r_fullscreen 0 +set name Foo +connect server >&2 &", check_return = False)
-      client2.execute("quake3 +set r_fullscreen 0 +set name Bar +connect server >&2 &", check_return = False)
+    client1.screenshot("screen1")
+    client2.screenshot("screen2")
 
-      server.wait_until_succeeds("grep -q 'Foo.*entered the game' /tmp/log")
-      server.wait_until_succeeds("grep -q 'Bar.*entered the game' /tmp/log")
+    client1.unblock()
 
-      server.sleep(10)  # wait for a while to get a nice screenshot
+    server.sleep(10)
 
-      client1.block()
+    client1.screenshot("screen3")
+    client2.screenshot("screen4")
 
-      server.sleep(20)
-
-      client1.screenshot("screen1")
-      client2.screenshot("screen2")
-
-      client1.unblock()
-
-      server.sleep(10)
-
-      client1.screenshot("screen3")
-      client2.screenshot("screen4")
-
-      client1.shutdown()
-      client2.shutdown()
-      server.stop_job("quake3-server")
-    '';
-
-  }
-)
+    client1.shutdown()
+    client2.shutdown()
+    server.stop_job("quake3-server")
+  '';
+}
diff --git a/nixos/tests/quicktun.nix b/nixos/tests/quicktun.nix
index 62b441f3fd78..22bd0dbdf52a 100644
--- a/nixos/tests/quicktun.nix
+++ b/nixos/tests/quicktun.nix
@@ -1,22 +1,20 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "quicktun";
-    meta.maintainers = with lib.maintainers; [ h7x4 ];
+{ pkgs, lib, ... }:
+{
+  name = "quicktun";
+  meta.maintainers = with lib.maintainers; [ h7x4 ];
 
-    nodes = {
-      machine =
-        { ... }:
-        {
-          services.quicktun."test-tunnel" = {
-            protocol = "raw";
-          };
+  nodes = {
+    machine =
+      { ... }:
+      {
+        services.quicktun."test-tunnel" = {
+          protocol = "raw";
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("quicktun-test-tunnel.service")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("quicktun-test-tunnel.service")
+  '';
+}
diff --git a/nixos/tests/quickwit.nix b/nixos/tests/quickwit.nix
index 0dddd547fd06..f080285ca345 100644
--- a/nixos/tests/quickwit.nix
+++ b/nixos/tests/quickwit.nix
@@ -1,106 +1,104 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  let
-    # Define an example Quickwit index schema,
-    # and some `exampleDocs` below, to test if ingesting
-    # and querying works as expected.
-    index_yaml = ''
-      version: 0.7
-      index_id: example_server_logs
-      doc_mapping:
-        mode: dynamic
-        field_mappings:
-          - name: datetime
-            type: datetime
-            fast: true
-            input_formats:
-              - iso8601
-            output_format: iso8601
-            fast_precision: seconds
-            fast: true
-          - name: git
-            type: text
-            tokenizer: raw
-          - name: hostname
-            type: text
-            tokenizer: raw
-          - name: level
-            type: text
-            tokenizer: raw
-          - name: message
-            type: text
-          - name: location
-            type: text
-          - name: source
-            type: text
-        timestamp_field: datetime
+let
+  # Define an example Quickwit index schema,
+  # and some `exampleDocs` below, to test if ingesting
+  # and querying works as expected.
+  index_yaml = ''
+    version: 0.7
+    index_id: example_server_logs
+    doc_mapping:
+      mode: dynamic
+      field_mappings:
+        - name: datetime
+          type: datetime
+          fast: true
+          input_formats:
+            - iso8601
+          output_format: iso8601
+          fast_precision: seconds
+          fast: true
+        - name: git
+          type: text
+          tokenizer: raw
+        - name: hostname
+          type: text
+          tokenizer: raw
+        - name: level
+          type: text
+          tokenizer: raw
+        - name: message
+          type: text
+        - name: location
+          type: text
+        - name: source
+          type: text
+      timestamp_field: datetime
 
-      search_settings:
-        default_search_fields: [message]
+    search_settings:
+      default_search_fields: [message]
 
-      indexing_settings:
-        commit_timeout_secs: 10
-    '';
+    indexing_settings:
+      commit_timeout_secs: 10
+  '';
 
-    exampleDocs = ''
-      {"datetime":"2024-05-03T02:36:41.017674444Z","git":"e6e1f087ce12065e44ed3b87b50784e6f9bcc2f9","hostname":"machine-1","level":"Info","message":"Processing request done","location":"path/to/server.c:6442:32","source":""}
-      {"datetime":"2024-05-04T02:36:41.017674444Z","git":"e6e1f087ce12065e44ed3b87b50784e6f9bcc2f9","hostname":"machine-1","level":"Info","message":"Got exception processing request: HTTP 404","location":"path/to/server.c:6444:32","source":""}
-      {"datetime":"2024-05-05T02:36:41.017674444Z","git":"e6e1f087ce12065e44ed3b87b50784e6f9bcc2f9","hostname":"machine-1","level":"Info","message":"Got exception processing request: HTTP 404","location":"path/to/server.c:6444:32","source":""}
-      {"datetime":"2024-05-06T02:36:41.017674444Z","git":"e6e1f087ce12065e44ed3b87b50784e6f9bcc2f9","hostname":"machine-2","level":"Info","message":"Got exception processing request: HTTP 404","location":"path/to/server.c:6444:32","source":""}
-    '';
-  in
-  {
-    name = "quickwit";
-    meta.maintainers = [ pkgs.lib.maintainers.happysalada ];
+  exampleDocs = ''
+    {"datetime":"2024-05-03T02:36:41.017674444Z","git":"e6e1f087ce12065e44ed3b87b50784e6f9bcc2f9","hostname":"machine-1","level":"Info","message":"Processing request done","location":"path/to/server.c:6442:32","source":""}
+    {"datetime":"2024-05-04T02:36:41.017674444Z","git":"e6e1f087ce12065e44ed3b87b50784e6f9bcc2f9","hostname":"machine-1","level":"Info","message":"Got exception processing request: HTTP 404","location":"path/to/server.c:6444:32","source":""}
+    {"datetime":"2024-05-05T02:36:41.017674444Z","git":"e6e1f087ce12065e44ed3b87b50784e6f9bcc2f9","hostname":"machine-1","level":"Info","message":"Got exception processing request: HTTP 404","location":"path/to/server.c:6444:32","source":""}
+    {"datetime":"2024-05-06T02:36:41.017674444Z","git":"e6e1f087ce12065e44ed3b87b50784e6f9bcc2f9","hostname":"machine-2","level":"Info","message":"Got exception processing request: HTTP 404","location":"path/to/server.c:6444:32","source":""}
+  '';
+in
+{
+  name = "quickwit";
+  meta.maintainers = [ pkgs.lib.maintainers.happysalada ];
 
-    nodes = {
-      quickwit =
-        { config, pkgs, ... }:
-        {
-          services.quickwit.enable = true;
-        };
-    };
+  nodes = {
+    quickwit =
+      { config, pkgs, ... }:
+      {
+        services.quickwit.enable = true;
+      };
+  };
 
-    testScript = ''
-      quickwit.wait_for_unit("quickwit")
-      quickwit.wait_for_open_port(7280)
-      quickwit.wait_for_open_port(7281)
+  testScript = ''
+    quickwit.wait_for_unit("quickwit")
+    quickwit.wait_for_open_port(7280)
+    quickwit.wait_for_open_port(7281)
 
-      quickwit.wait_until_succeeds(
-        "journalctl -o cat -u quickwit.service | grep 'version: ${pkgs.quickwit.version}'"
-      )
+    quickwit.wait_until_succeeds(
+      "journalctl -o cat -u quickwit.service | grep 'version: ${pkgs.quickwit.version}'"
+    )
 
-      quickwit.wait_until_succeeds(
-        "journalctl -o cat -u quickwit.service | grep 'transitioned to ready state'"
-      )
+    quickwit.wait_until_succeeds(
+      "journalctl -o cat -u quickwit.service | grep 'transitioned to ready state'"
+    )
 
-      with subtest("verify UI installed"):
-        machine.succeed("curl -sSf http://127.0.0.1:7280/ui/")
+    with subtest("verify UI installed"):
+      machine.succeed("curl -sSf http://127.0.0.1:7280/ui/")
 
-      with subtest("injest and query data"):
-        import json
+    with subtest("injest and query data"):
+      import json
 
-        # Test CLI ingestion
-        print(machine.succeed('${pkgs.quickwit}/bin/quickwit index create --index-config ${pkgs.writeText "index.yaml" index_yaml}'))
-        # Important to use `--wait`, otherwise the queries below race with index processing.
-        print(machine.succeed('${pkgs.quickwit}/bin/quickwit index ingest --index example_server_logs --input-path ${pkgs.writeText "exampleDocs.json" exampleDocs} --wait'))
+      # Test CLI ingestion
+      print(machine.succeed('${pkgs.quickwit}/bin/quickwit index create --index-config ${pkgs.writeText "index.yaml" index_yaml}'))
+      # Important to use `--wait`, otherwise the queries below race with index processing.
+      print(machine.succeed('${pkgs.quickwit}/bin/quickwit index ingest --index example_server_logs --input-path ${pkgs.writeText "exampleDocs.json" exampleDocs} --wait'))
 
-        # Test CLI query
-        cli_query_output = machine.succeed('${pkgs.quickwit}/bin/quickwit index search --index example_server_logs --query "exception"')
-        print(cli_query_output)
+      # Test CLI query
+      cli_query_output = machine.succeed('${pkgs.quickwit}/bin/quickwit index search --index example_server_logs --query "exception"')
+      print(cli_query_output)
 
-        # Assert query result is as expected.
-        num_hits = len(json.loads(cli_query_output)["hits"])
-        assert num_hits == 3, f"cli_query_output contains unexpected number of results: {num_hits}"
+      # Assert query result is as expected.
+      num_hits = len(json.loads(cli_query_output)["hits"])
+      assert num_hits == 3, f"cli_query_output contains unexpected number of results: {num_hits}"
 
-        # Test API query
-        api_query_output = machine.succeed('curl --fail http://127.0.0.1:7280/api/v1/example_server_logs/search?query=exception')
-        print(api_query_output)
+      # Test API query
+      api_query_output = machine.succeed('curl --fail http://127.0.0.1:7280/api/v1/example_server_logs/search?query=exception')
+      print(api_query_output)
 
-      quickwit.log(quickwit.succeed(
-        "systemd-analyze security quickwit.service | grep -v '✓'"
-      ))
-    '';
-  }
-)
+    quickwit.log(quickwit.succeed(
+      "systemd-analyze security quickwit.service | grep -v '✓'"
+    ))
+  '';
+}
diff --git a/nixos/tests/quorum.nix b/nixos/tests/quorum.nix
index 1a38ad434658..0e67f3564070 100644
--- a/nixos/tests/quorum.nix
+++ b/nixos/tests/quorum.nix
@@ -1,105 +1,103 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    keystore = {
-      address = "9377bc3936de934c497e22917b81aa8774ac3bb0";
-      crypto = {
-        cipher = "aes-128-ctr";
-        ciphertext = "ad8341d8ef225650403fd366c955f41095e438dd966a3c84b3d406818c1e366c";
-        cipherparams = {
-          iv = "2a09f7a72fd6dff7c43150ff437e6ac2";
-        };
-        kdf = "scrypt";
-        kdfparams = {
-          dklen = 32;
-          n = 262144;
-          p = 1;
-          r = 8;
-          salt = "d1a153845bb80cd6274c87c5bac8ac09fdfac5ff131a6f41b5ed319667f12027";
-        };
-        mac = "a9621ad88fa1d042acca6fc2fcd711f7e05bfbadea3f30f379235570c8e270d3";
+{ pkgs, ... }:
+let
+  keystore = {
+    address = "9377bc3936de934c497e22917b81aa8774ac3bb0";
+    crypto = {
+      cipher = "aes-128-ctr";
+      ciphertext = "ad8341d8ef225650403fd366c955f41095e438dd966a3c84b3d406818c1e366c";
+      cipherparams = {
+        iv = "2a09f7a72fd6dff7c43150ff437e6ac2";
       };
-      id = "89e847a3-1527-42f6-a321-77de0a14ce02";
-      version = 3;
-    };
-    keystore-file = pkgs.writeText "keystore-file" (builtins.toJSON keystore);
-  in
-  {
-    name = "quorum";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ mmahut ];
+      kdf = "scrypt";
+      kdfparams = {
+        dklen = 32;
+        n = 262144;
+        p = 1;
+        r = 8;
+        salt = "d1a153845bb80cd6274c87c5bac8ac09fdfac5ff131a6f41b5ed319667f12027";
+      };
+      mac = "a9621ad88fa1d042acca6fc2fcd711f7e05bfbadea3f30f379235570c8e270d3";
     };
+    id = "89e847a3-1527-42f6-a321-77de0a14ce02";
+    version = 3;
+  };
+  keystore-file = pkgs.writeText "keystore-file" (builtins.toJSON keystore);
+in
+{
+  name = "quorum";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ mmahut ];
+  };
 
-    nodes = {
-      machine =
-        { ... }:
-        {
-          services.quorum = {
-            enable = true;
-            permissioned = false;
-            staticNodes = [
-              "enode://dd333ec28f0a8910c92eb4d336461eea1c20803eed9cf2c056557f986e720f8e693605bba2f4e8f289b1162e5ac7c80c914c7178130711e393ca76abc1d92f57@0.0.0.0:30303?discport=0"
-            ];
-            genesis = {
-              alloc = {
-                "189d23d201b03ae1cf9113672df29a5d672aefa3" = {
-                  balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
-                };
-                "44b07d2c28b8ed8f02b45bd84ac7d9051b3349e6" = {
-                  balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
-                };
-                "4c1ccd426833b9782729a212c857f2f03b7b4c0d" = {
-                  balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
-                };
-                "7ae555d0f6faad7930434abdaac2274fd86ab516" = {
-                  balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
-                };
-                c1056df7c02b6f1a353052eaf0533cc7cb743b52 = {
-                  balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
-                };
+  nodes = {
+    machine =
+      { ... }:
+      {
+        services.quorum = {
+          enable = true;
+          permissioned = false;
+          staticNodes = [
+            "enode://dd333ec28f0a8910c92eb4d336461eea1c20803eed9cf2c056557f986e720f8e693605bba2f4e8f289b1162e5ac7c80c914c7178130711e393ca76abc1d92f57@0.0.0.0:30303?discport=0"
+          ];
+          genesis = {
+            alloc = {
+              "189d23d201b03ae1cf9113672df29a5d672aefa3" = {
+                balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
               };
-              coinbase = "0x0000000000000000000000000000000000000000";
-              config = {
-                byzantiumBlock = 1;
-                chainId = 10;
-                eip150Block = 1;
-                eip150Hash = "0x0000000000000000000000000000000000000000000000000000000000000000";
-                eip155Block = 1;
-                eip158Block = 1;
-                homesteadBlock = 1;
-                isQuorum = true;
-                istanbul = {
-                  epoch = 30000;
-                  policy = 0;
-                };
+              "44b07d2c28b8ed8f02b45bd84ac7d9051b3349e6" = {
+                balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
+              };
+              "4c1ccd426833b9782729a212c857f2f03b7b4c0d" = {
+                balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
+              };
+              "7ae555d0f6faad7930434abdaac2274fd86ab516" = {
+                balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
+              };
+              c1056df7c02b6f1a353052eaf0533cc7cb743b52 = {
+                balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
               };
-              difficulty = "0x1";
-              extraData = "0x0000000000000000000000000000000000000000000000000000000000000000f8aff869944c1ccd426833b9782729a212c857f2f03b7b4c0d94189d23d201b03ae1cf9113672df29a5d672aefa39444b07d2c28b8ed8f02b45bd84ac7d9051b3349e694c1056df7c02b6f1a353052eaf0533cc7cb743b52947ae555d0f6faad7930434abdaac2274fd86ab516b8410000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0";
-              gasLimit = "0xe0000000";
-              gasUsed = "0x0";
-              mixHash = "0x63746963616c2062797a616e74696e65206661756c7420746f6c6572616e6365";
-              nonce = "0x0";
-              number = "0x0";
-              parentHash = "0x0000000000000000000000000000000000000000000000000000000000000000";
-              timestamp = "0x5cffc201";
             };
+            coinbase = "0x0000000000000000000000000000000000000000";
+            config = {
+              byzantiumBlock = 1;
+              chainId = 10;
+              eip150Block = 1;
+              eip150Hash = "0x0000000000000000000000000000000000000000000000000000000000000000";
+              eip155Block = 1;
+              eip158Block = 1;
+              homesteadBlock = 1;
+              isQuorum = true;
+              istanbul = {
+                epoch = 30000;
+                policy = 0;
+              };
+            };
+            difficulty = "0x1";
+            extraData = "0x0000000000000000000000000000000000000000000000000000000000000000f8aff869944c1ccd426833b9782729a212c857f2f03b7b4c0d94189d23d201b03ae1cf9113672df29a5d672aefa39444b07d2c28b8ed8f02b45bd84ac7d9051b3349e694c1056df7c02b6f1a353052eaf0533cc7cb743b52947ae555d0f6faad7930434abdaac2274fd86ab516b8410000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0";
+            gasLimit = "0xe0000000";
+            gasUsed = "0x0";
+            mixHash = "0x63746963616c2062797a616e74696e65206661756c7420746f6c6572616e6365";
+            nonce = "0x0";
+            number = "0x0";
+            parentHash = "0x0000000000000000000000000000000000000000000000000000000000000000";
+            timestamp = "0x5cffc201";
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      machine.succeed("mkdir -p /var/lib/quorum/keystore")
-      machine.succeed(
-          'cp ${keystore-file} /var/lib/quorum/keystore/UTC--2020-03-23T11-08-34.144812212Z--${keystore.address}'
-      )
-      machine.succeed(
-          "echo fe2725c4e8f7617764b845e8d939a65c664e7956eb47ed7d934573f16488efc1 > /var/lib/quorum/nodekey"
-      )
-      machine.succeed("systemctl restart quorum")
-      machine.wait_for_unit("quorum.service")
-      machine.sleep(15)
-      machine.succeed('geth attach /var/lib/quorum/geth.ipc --exec "eth.accounts" | grep ${keystore.address}')
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.succeed("mkdir -p /var/lib/quorum/keystore")
+    machine.succeed(
+        'cp ${keystore-file} /var/lib/quorum/keystore/UTC--2020-03-23T11-08-34.144812212Z--${keystore.address}'
+    )
+    machine.succeed(
+        "echo fe2725c4e8f7617764b845e8d939a65c664e7956eb47ed7d934573f16488efc1 > /var/lib/quorum/nodekey"
+    )
+    machine.succeed("systemctl restart quorum")
+    machine.wait_for_unit("quorum.service")
+    machine.sleep(15)
+    machine.succeed('geth attach /var/lib/quorum/geth.ipc --exec "eth.accounts" | grep ${keystore.address}')
+  '';
+}
diff --git a/nixos/tests/rabbitmq.nix b/nixos/tests/rabbitmq.nix
index cb6dba27a64c..94c7bdf49ba5 100644
--- a/nixos/tests/rabbitmq.nix
+++ b/nixos/tests/rabbitmq.nix
@@ -1,63 +1,61 @@
 # This test runs rabbitmq and checks if rabbitmq is up and running.
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    # in real life, you would keep this out of your repo and deploy it to a safe
-    # location using safe means.
-    configKeyPath = pkgs.writeText "fake-config-key" "hOjWzSEn2Z7cHzKOcf6i183O2NdjurSuoMDIIv01";
-  in
-  {
-    name = "rabbitmq";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ offline ];
+{ pkgs, ... }:
+let
+  # in real life, you would keep this out of your repo and deploy it to a safe
+  # location using safe means.
+  configKeyPath = pkgs.writeText "fake-config-key" "hOjWzSEn2Z7cHzKOcf6i183O2NdjurSuoMDIIv01";
+in
+{
+  name = "rabbitmq";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ offline ];
+  };
+
+  nodes.machine = {
+    services.rabbitmq = {
+      enable = true;
+      managementPlugin.enable = true;
+
+      # To encrypt:
+      # rabbitmqctl --quiet encode --cipher blowfish_cfb64 --hash sha256 \
+      #   --iterations 10000 '<<"dJT8isYu6t0Xb6u56rPglSj1vK51SlNVlXfwsRxw">>' \
+      #   "hOjWzSEn2Z7cHzKOcf6i183O2NdjurSuoMDIIv01" ;
+      config = ''
+        [ { rabbit
+          , [ {default_user, <<"alice">>}
+            , { default_pass
+              , {encrypted,<<"oKKxyTze9PYmsEfl6FG1MxIUhxY7WPQL7HBoMPRC/1ZOdOZbtr9+DxjWW3e1D5SL48n3D9QOsGD0cOgYG7Qdvb7Txrepw8w=">>}
+              }
+            , {config_entry_decoder
+              , [ {passphrase, {file, <<"${configKeyPath}">>}}
+                , {cipher, blowfish_cfb64}
+                , {hash, sha256}
+                , {iterations, 10000}
+                ]
+              }
+            % , {rabbitmq_management, [{path_prefix, "/_queues"}]}
+            ]
+          }
+        ].
+      '';
     };
+    # Ensure there is sufficient extra disk space for rabbitmq to be happy
+    virtualisation.diskSize = 1024;
+  };
 
-    nodes.machine = {
-      services.rabbitmq = {
-        enable = true;
-        managementPlugin.enable = true;
+  testScript = ''
+    machine.start()
 
-        # To encrypt:
-        # rabbitmqctl --quiet encode --cipher blowfish_cfb64 --hash sha256 \
-        #   --iterations 10000 '<<"dJT8isYu6t0Xb6u56rPglSj1vK51SlNVlXfwsRxw">>' \
-        #   "hOjWzSEn2Z7cHzKOcf6i183O2NdjurSuoMDIIv01" ;
-        config = ''
-          [ { rabbit
-            , [ {default_user, <<"alice">>}
-              , { default_pass
-                , {encrypted,<<"oKKxyTze9PYmsEfl6FG1MxIUhxY7WPQL7HBoMPRC/1ZOdOZbtr9+DxjWW3e1D5SL48n3D9QOsGD0cOgYG7Qdvb7Txrepw8w=">>}
-                }
-              , {config_entry_decoder
-                , [ {passphrase, {file, <<"${configKeyPath}">>}}
-                  , {cipher, blowfish_cfb64}
-                  , {hash, sha256}
-                  , {iterations, 10000}
-                  ]
-                }
-              % , {rabbitmq_management, [{path_prefix, "/_queues"}]}
-              ]
-            }
-          ].
-        '';
-      };
-      # Ensure there is sufficient extra disk space for rabbitmq to be happy
-      virtualisation.diskSize = 1024;
-    };
+    machine.wait_for_unit("rabbitmq.service")
+    machine.wait_until_succeeds(
+        'su -s ${pkgs.runtimeShell} rabbitmq -c "rabbitmqctl status"'
+    )
+    machine.wait_for_open_port(15672)
 
-    testScript = ''
-      machine.start()
-
-      machine.wait_for_unit("rabbitmq.service")
-      machine.wait_until_succeeds(
-          'su -s ${pkgs.runtimeShell} rabbitmq -c "rabbitmqctl status"'
-      )
-      machine.wait_for_open_port(15672)
-
-      # The password is the plaintext that was encrypted with rabbitmqctl encode above.
-      machine.wait_until_succeeds(
-          'echo Hello World | ${pkgs.lib.getExe pkgs.amqpcat} --producer --uri=amqp://alice:dJT8isYu6t0Xb6u56rPglSj1vK51SlNVlXfwsRxw@localhost --queue test'
-      )
-    '';
-  }
-)
+    # The password is the plaintext that was encrypted with rabbitmqctl encode above.
+    machine.wait_until_succeeds(
+        'echo Hello World | ${pkgs.lib.getExe pkgs.amqpcat} --producer --uri=amqp://alice:dJT8isYu6t0Xb6u56rPglSj1vK51SlNVlXfwsRxw@localhost --queue test'
+    )
+  '';
+}
diff --git a/nixos/tests/radarr.nix b/nixos/tests/radarr.nix
index ac093beeb790..00949dcc7695 100644
--- a/nixos/tests/radarr.nix
+++ b/nixos/tests/radarr.nix
@@ -1,20 +1,18 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "radarr";
-    meta.maintainers = with lib.maintainers; [ etu ];
+{
+  name = "radarr";
+  meta.maintainers = with lib.maintainers; [ etu ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.radarr.enable = true;
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.radarr.enable = true;
+    };
 
-    testScript = ''
-      machine.wait_for_unit("radarr.service")
-      machine.wait_for_open_port(7878)
-      machine.succeed("curl --fail http://localhost:7878/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("radarr.service")
+    machine.wait_for_open_port(7878)
+    machine.succeed("curl --fail http://localhost:7878/")
+  '';
+}
diff --git a/nixos/tests/radicale.nix b/nixos/tests/radicale.nix
index 96c17a657b3a..210be285c988 100644
--- a/nixos/tests/radicale.nix
+++ b/nixos/tests/radicale.nix
@@ -1,100 +1,98 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  let
-    user = "someuser";
-    password = "some_password";
-    port = "5232";
-    filesystem_folder = "/data/radicale";
+let
+  user = "someuser";
+  password = "some_password";
+  port = "5232";
+  filesystem_folder = "/data/radicale";
 
-    cli = "${lib.getExe pkgs.calendar-cli} --caldav-user ${user} --caldav-pass ${password}";
-  in
-  {
-    name = "radicale3";
-    meta.maintainers = with lib.maintainers; [ dotlambda ];
+  cli = "${lib.getExe pkgs.calendar-cli} --caldav-user ${user} --caldav-pass ${password}";
+in
+{
+  name = "radicale3";
+  meta.maintainers = with lib.maintainers; [ dotlambda ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.radicale = {
-          enable = true;
-          settings = {
-            auth = {
-              type = "htpasswd";
-              htpasswd_filename = "/etc/radicale/users";
-              htpasswd_encryption = "bcrypt";
-            };
-            storage = {
-              inherit filesystem_folder;
-              hook = "git add -A && (git diff --cached --quiet || git commit -m 'Changes by '%(user)s)";
-            };
-            logging.level = "info";
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.radicale = {
+        enable = true;
+        settings = {
+          auth = {
+            type = "htpasswd";
+            htpasswd_filename = "/etc/radicale/users";
+            htpasswd_encryption = "bcrypt";
           };
-          rights = {
-            principal = {
-              user = ".+";
-              collection = "{user}";
-              permissions = "RW";
-            };
-            calendars = {
-              user = ".+";
-              collection = "{user}/[^/]+";
-              permissions = "rw";
-            };
+          storage = {
+            inherit filesystem_folder;
+            hook = "git add -A && (git diff --cached --quiet || git commit -m 'Changes by '%(user)s)";
+          };
+          logging.level = "info";
+        };
+        rights = {
+          principal = {
+            user = ".+";
+            collection = "{user}";
+            permissions = "RW";
+          };
+          calendars = {
+            user = ".+";
+            collection = "{user}/[^/]+";
+            permissions = "rw";
           };
         };
-        systemd.services.radicale.path = [ pkgs.git ];
-        environment.systemPackages = [ pkgs.git ];
-        systemd.tmpfiles.rules = [ "d ${filesystem_folder} 0750 radicale radicale -" ];
-        # WARNING: DON'T DO THIS IN PRODUCTION!
-        # This puts unhashed secrets directly into the Nix store for ease of testing.
-        environment.etc."radicale/users".source = pkgs.runCommand "htpasswd" { } ''
-          ${pkgs.apacheHttpd}/bin/htpasswd -bcB "$out" ${user} ${password}
-        '';
       };
-    testScript = ''
-      machine.wait_for_unit("radicale.service")
-      machine.wait_for_open_port(${port})
+      systemd.services.radicale.path = [ pkgs.git ];
+      environment.systemPackages = [ pkgs.git ];
+      systemd.tmpfiles.rules = [ "d ${filesystem_folder} 0750 radicale radicale -" ];
+      # WARNING: DON'T DO THIS IN PRODUCTION!
+      # This puts unhashed secrets directly into the Nix store for ease of testing.
+      environment.etc."radicale/users".source = pkgs.runCommand "htpasswd" { } ''
+        ${pkgs.apacheHttpd}/bin/htpasswd -bcB "$out" ${user} ${password}
+      '';
+    };
+  testScript = ''
+    machine.wait_for_unit("radicale.service")
+    machine.wait_for_open_port(${port})
 
-      machine.succeed("sudo -u radicale git -C ${filesystem_folder} init")
-      machine.succeed(
-          "sudo -u radicale git -C ${filesystem_folder} config --local user.email radicale@example.com"
-      )
-      machine.succeed(
-          "sudo -u radicale git -C ${filesystem_folder} config --local user.name radicale"
-      )
+    machine.succeed("sudo -u radicale git -C ${filesystem_folder} init")
+    machine.succeed(
+        "sudo -u radicale git -C ${filesystem_folder} config --local user.email radicale@example.com"
+    )
+    machine.succeed(
+        "sudo -u radicale git -C ${filesystem_folder} config --local user.name radicale"
+    )
 
-      with subtest("Test calendar and event creation"):
-          machine.succeed(
-              "${cli} --caldav-url http://localhost:${port}/${user} calendar create cal"
-          )
-          machine.succeed("test -d ${filesystem_folder}/collection-root/${user}/cal")
-          machine.succeed('test -z "$(ls ${filesystem_folder}/collection-root/${user}/cal)"')
-          machine.succeed(
-              "${cli} --caldav-url http://localhost:${port}/${user}/cal calendar add 2021-04-23 testevent"
-          )
-          machine.succeed('test -n "$(ls ${filesystem_folder}/collection-root/${user}/cal)"')
-          (status, stdout) = machine.execute(
-              "sudo -u radicale git -C ${filesystem_folder} log --format=oneline | wc -l"
-          )
-          assert status == 0, "git log failed"
-          assert stdout == "3\n", "there should be exactly 3 commits"
+    with subtest("Test calendar and event creation"):
+        machine.succeed(
+            "${cli} --caldav-url http://localhost:${port}/${user} calendar create cal"
+        )
+        machine.succeed("test -d ${filesystem_folder}/collection-root/${user}/cal")
+        machine.succeed('test -z "$(ls ${filesystem_folder}/collection-root/${user}/cal)"')
+        machine.succeed(
+            "${cli} --caldav-url http://localhost:${port}/${user}/cal calendar add 2021-04-23 testevent"
+        )
+        machine.succeed('test -n "$(ls ${filesystem_folder}/collection-root/${user}/cal)"')
+        (status, stdout) = machine.execute(
+            "sudo -u radicale git -C ${filesystem_folder} log --format=oneline | wc -l"
+        )
+        assert status == 0, "git log failed"
+        assert stdout == "3\n", "there should be exactly 3 commits"
 
-      with subtest("Test rights file"):
-          machine.fail(
-              "${cli} --caldav-url http://localhost:${port}/${user} calendar create sub/cal"
-          )
-          machine.fail(
-              "${cli} --caldav-url http://localhost:${port}/otheruser calendar create cal"
-          )
+    with subtest("Test rights file"):
+        machine.fail(
+            "${cli} --caldav-url http://localhost:${port}/${user} calendar create sub/cal"
+        )
+        machine.fail(
+            "${cli} --caldav-url http://localhost:${port}/otheruser calendar create cal"
+        )
 
-      with subtest("Test web interface"):
-          machine.succeed("curl --fail http://${user}:${password}@localhost:${port}/.web/")
+    with subtest("Test web interface"):
+        machine.succeed("curl --fail http://${user}:${password}@localhost:${port}/.web/")
 
-      with subtest("Test security"):
-          output = machine.succeed("systemd-analyze security radicale.service")
-          machine.log(output)
-          assert output[-9:-1] == "SAFE :-}"
-    '';
-  }
-)
+    with subtest("Test security"):
+        output = machine.succeed("systemd-analyze security radicale.service")
+        machine.log(output)
+        assert output[-9:-1] == "SAFE :-}"
+  '';
+}
diff --git a/nixos/tests/rasdaemon.nix b/nixos/tests/rasdaemon.nix
index c7b147a1ca52..cc7b3fc3c670 100644
--- a/nixos/tests/rasdaemon.nix
+++ b/nixos/tests/rasdaemon.nix
@@ -1,38 +1,36 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "rasdaemon";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ evils ];
+{ pkgs, ... }:
+{
+  name = "rasdaemon";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ evils ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ../modules/profiles/minimal.nix ];
+      hardware.rasdaemon = {
+        enable = true;
+        # should be enabled by default, just making sure
+        record = true;
+        # nonsense label
+        labels = ''
+          vendor: none
+            product: none
+            model: none
+              DIMM_0: 0.0.0;
+        '';
+      };
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ../modules/profiles/minimal.nix ];
-        hardware.rasdaemon = {
-          enable = true;
-          # should be enabled by default, just making sure
-          record = true;
-          # nonsense label
-          labels = ''
-            vendor: none
-              product: none
-              model: none
-                DIMM_0: 0.0.0;
-          '';
-        };
-      };
-
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("multi-user.target")
-      # confirm rasdaemon is running and has a valid database
-      # some disk errors detected in qemu for some reason ¯\_(ツ)_/¯
-      machine.wait_until_succeeds("ras-mc-ctl --errors | tee /dev/stderr | grep -q 'No .* errors.'")
-      # confirm the supplied labels text made it into the system
-      machine.succeed("grep -q 'vendor: none' /etc/ras/dimm_labels.d/labels >&2")
-      machine.shutdown()
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    # confirm rasdaemon is running and has a valid database
+    # some disk errors detected in qemu for some reason ¯\_(ツ)_/¯
+    machine.wait_until_succeeds("ras-mc-ctl --errors | tee /dev/stderr | grep -q 'No .* errors.'")
+    # confirm the supplied labels text made it into the system
+    machine.succeed("grep -q 'vendor: none' /etc/ras/dimm_labels.d/labels >&2")
+    machine.shutdown()
+  '';
+}
diff --git a/nixos/tests/readarr.nix b/nixos/tests/readarr.nix
index d6d5fdd586b5..6a0e25742632 100644
--- a/nixos/tests/readarr.nix
+++ b/nixos/tests/readarr.nix
@@ -1,19 +1,17 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "readarr";
-    meta.maintainers = with lib.maintainers; [ jocelynthode ];
+{ lib, ... }:
+{
+  name = "readarr";
+  meta.maintainers = with lib.maintainers; [ jocelynthode ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.readarr.enable = true;
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.readarr.enable = true;
+    };
 
-    testScript = ''
-      machine.wait_for_unit("readarr.service")
-      machine.wait_for_open_port(8787)
-      machine.succeed("curl --fail http://localhost:8787/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("readarr.service")
+    machine.wait_for_open_port(8787)
+    machine.succeed("curl --fail http://localhost:8787/")
+  '';
+}
diff --git a/nixos/tests/realm.nix b/nixos/tests/realm.nix
index 826dab61dbf2..353e595fbd3d 100644
--- a/nixos/tests/realm.nix
+++ b/nixos/tests/realm.nix
@@ -1,44 +1,42 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "realm";
+{ lib, pkgs, ... }:
+{
+  name = "realm";
 
-    meta = {
-      maintainers = with lib.maintainers; [ ocfox ];
-    };
+  meta = {
+    maintainers = with lib.maintainers; [ ocfox ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.nginx = {
-          enable = true;
-          statusPage = true;
-        };
-        # realm need DNS resolv server to run or use config.dns.nameserver
-        services.resolved.enable = true;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.nginx = {
+        enable = true;
+        statusPage = true;
+      };
+      # realm need DNS resolv server to run or use config.dns.nameserver
+      services.resolved.enable = true;
 
-        services.realm = {
-          enable = true;
-          config = {
-            endpoints = [
-              {
-                listen = "0.0.0.0:1000";
-                remote = "127.0.0.1:80";
-              }
-            ];
-          };
+      services.realm = {
+        enable = true;
+        config = {
+          endpoints = [
+            {
+              listen = "0.0.0.0:1000";
+              remote = "127.0.0.1:80";
+            }
+          ];
         };
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("nginx.service")
-      machine.wait_for_unit("realm.service")
+  testScript = ''
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_unit("realm.service")
 
-      machine.wait_for_open_port(80)
-      machine.wait_for_open_port(1000)
+    machine.wait_for_open_port(80)
+    machine.wait_for_open_port(1000)
 
-      machine.succeed("curl --fail http://localhost:1000/")
-    '';
+    machine.succeed("curl --fail http://localhost:1000/")
+  '';
 
-  }
-)
+}
diff --git a/nixos/tests/redlib.nix b/nixos/tests/redlib.nix
index 55bfd6be4720..e03df475fe3d 100644
--- a/nixos/tests/redlib.nix
+++ b/nixos/tests/redlib.nix
@@ -1,31 +1,29 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "redlib";
-    meta.maintainers = with lib.maintainers; [
-      bpeetz
-      Guanran928
-    ];
+{ lib, pkgs, ... }:
+{
+  name = "redlib";
+  meta.maintainers = with lib.maintainers; [
+    bpeetz
+    Guanran928
+  ];
 
-    nodes.machine = {
-      services.redlib = {
-        package = pkgs.redlib;
-        enable = true;
-        # Test CAP_NET_BIND_SERVICE
-        port = 80;
+  nodes.machine = {
+    services.redlib = {
+      package = pkgs.redlib;
+      enable = true;
+      # Test CAP_NET_BIND_SERVICE
+      port = 80;
 
-        settings = {
-          REDLIB_DEFAULT_USE_HLS = true;
-        };
+      settings = {
+        REDLIB_DEFAULT_USE_HLS = true;
       };
     };
+  };
 
-    testScript = ''
-      machine.wait_for_unit("redlib.service")
-      machine.wait_for_open_port(80)
-      # Query a page that does not require Internet access
-      machine.succeed("curl --fail http://localhost:80/settings")
-      machine.succeed("curl --fail http://localhost:80/info | grep '<tr><td>Use HLS</td><td>on</td></tr>'")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("redlib.service")
+    machine.wait_for_open_port(80)
+    # Query a page that does not require Internet access
+    machine.succeed("curl --fail http://localhost:80/settings")
+    machine.succeed("curl --fail http://localhost:80/info | grep '<tr><td>Use HLS</td><td>on</td></tr>'")
+  '';
+}
diff --git a/nixos/tests/renovate.nix b/nixos/tests/renovate.nix
index 52bcc867173c..d6adb3f76801 100644
--- a/nixos/tests/renovate.nix
+++ b/nixos/tests/renovate.nix
@@ -1,74 +1,72 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "renovate";
-    meta.maintainers = with pkgs.lib.maintainers; [
-      marie
-      natsukium
-    ];
+{ pkgs, ... }:
+{
+  name = "renovate";
+  meta.maintainers = with pkgs.lib.maintainers; [
+    marie
+    natsukium
+  ];
 
-    nodes.machine =
-      { config, ... }:
-      {
-        services.renovate = {
-          enable = true;
-          settings = {
-            platform = "gitea";
-            endpoint = "http://localhost:3000";
-            autodiscover = true;
-            gitAuthor = "Renovate <renovate@example.com>";
-          };
-          credentials = {
-            RENOVATE_TOKEN = "/etc/renovate-token";
-          };
+  nodes.machine =
+    { config, ... }:
+    {
+      services.renovate = {
+        enable = true;
+        settings = {
+          platform = "gitea";
+          endpoint = "http://localhost:3000";
+          autodiscover = true;
+          gitAuthor = "Renovate <renovate@example.com>";
         };
-        environment.systemPackages = [
-          config.services.forgejo.package
-          pkgs.tea
-          pkgs.git
-        ];
-        services.forgejo = {
-          enable = true;
-          settings.server.HTTP_PORT = 3000;
+        credentials = {
+          RENOVATE_TOKEN = "/etc/renovate-token";
         };
-        # Uncomment the next line to lint service scripts (Note: breaks VM startup; see #373166)
-        #systemd.enableStrictShellChecks = true;
       };
+      environment.systemPackages = [
+        config.services.forgejo.package
+        pkgs.tea
+        pkgs.git
+      ];
+      services.forgejo = {
+        enable = true;
+        settings.server.HTTP_PORT = 3000;
+      };
+      # Uncomment the next line to lint service scripts (Note: breaks VM startup; see #373166)
+      #systemd.enableStrictShellChecks = true;
+    };
 
-    testScript = ''
-      def gitea(command):
-        return machine.succeed(f"cd /var/lib/forgejo && sudo --user=forgejo GITEA_WORK_DIR=/var/lib/forgejo GITEA_CUSTOM=/var/lib/forgejo/custom gitea {command}")
+  testScript = ''
+    def gitea(command):
+      return machine.succeed(f"cd /var/lib/forgejo && sudo --user=forgejo GITEA_WORK_DIR=/var/lib/forgejo GITEA_CUSTOM=/var/lib/forgejo/custom gitea {command}")
 
-      machine.wait_for_unit("forgejo.service")
-      machine.wait_for_open_port(3000)
+    machine.wait_for_unit("forgejo.service")
+    machine.wait_for_open_port(3000)
 
-      machine.systemctl("stop forgejo.service")
+    machine.systemctl("stop forgejo.service")
 
-      gitea("admin user create --username meow --email meow@example.com --password meow")
+    gitea("admin user create --username meow --email meow@example.com --password meow")
 
-      machine.systemctl("start forgejo.service")
-      machine.wait_for_unit("forgejo.service")
-      machine.wait_for_open_port(3000)
+    machine.systemctl("start forgejo.service")
+    machine.wait_for_unit("forgejo.service")
+    machine.wait_for_open_port(3000)
 
-      accessToken = gitea("admin user generate-access-token --raw --username meow --scopes all | tr -d '\n'")
+    accessToken = gitea("admin user generate-access-token --raw --username meow --scopes all | tr -d '\n'")
 
-      machine.succeed(f"tea login add --name default --user meow --token '{accessToken}' --password meow --url http://localhost:3000")
-      machine.succeed("tea repo create --name kitty --init")
-      machine.succeed("git config --global user.name Meow")
-      machine.succeed("git config --global user.email meow@example.com")
-      machine.succeed(f"git clone http://meow:{accessToken}@localhost:3000/meow/kitty.git /tmp/kitty")
-      machine.succeed("echo '{ \"name\": \"meow\", \"version\": \"0.1.0\" }' > /tmp/kitty/package.json")
-      machine.succeed("git -C /tmp/kitty add /tmp/kitty/package.json")
-      machine.succeed("git -C /tmp/kitty commit -m 'add package.json'")
-      machine.succeed("git -C /tmp/kitty push origin")
+    machine.succeed(f"tea login add --name default --user meow --token '{accessToken}' --password meow --url http://localhost:3000")
+    machine.succeed("tea repo create --name kitty --init")
+    machine.succeed("git config --global user.name Meow")
+    machine.succeed("git config --global user.email meow@example.com")
+    machine.succeed(f"git clone http://meow:{accessToken}@localhost:3000/meow/kitty.git /tmp/kitty")
+    machine.succeed("echo '{ \"name\": \"meow\", \"version\": \"0.1.0\" }' > /tmp/kitty/package.json")
+    machine.succeed("git -C /tmp/kitty add /tmp/kitty/package.json")
+    machine.succeed("git -C /tmp/kitty commit -m 'add package.json'")
+    machine.succeed("git -C /tmp/kitty push origin")
 
-      machine.succeed(f"echo '{accessToken}' > /etc/renovate-token")
-      machine.systemctl("start --wait renovate.service")
+    machine.succeed(f"echo '{accessToken}' > /etc/renovate-token")
+    machine.systemctl("start --wait renovate.service")
 
-      machine.succeed("tea pulls list --repo meow/kitty | grep 'Configure Renovate'")
-      machine.succeed("tea pulls merge --repo meow/kitty 1")
+    machine.succeed("tea pulls list --repo meow/kitty | grep 'Configure Renovate'")
+    machine.succeed("tea pulls merge --repo meow/kitty 1")
 
-      machine.systemctl("start --wait renovate.service")
-    '';
-  }
-)
+    machine.systemctl("start --wait renovate.service")
+  '';
+}
diff --git a/nixos/tests/restart-by-activation-script.nix b/nixos/tests/restart-by-activation-script.nix
index cf89aa341ada..6d26d9843aff 100644
--- a/nixos/tests/restart-by-activation-script.nix
+++ b/nixos/tests/restart-by-activation-script.nix
@@ -1,81 +1,79 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "restart-by-activation-script";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ das_j ];
-    };
+{ pkgs, ... }:
+{
+  name = "restart-by-activation-script";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ das_j ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ../modules/profiles/minimal.nix ];
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ../modules/profiles/minimal.nix ];
 
-        system.switch.enable = true;
+      system.switch.enable = true;
 
-        systemd.services.restart-me = {
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-            ExecStart = "${pkgs.coreutils}/bin/true";
-          };
-        };
-
-        systemd.services.reload-me = {
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig = rec {
-            Type = "oneshot";
-            RemainAfterExit = true;
-            ExecStart = "${pkgs.coreutils}/bin/true";
-            ExecReload = ExecStart;
-          };
-        };
-
-        system.activationScripts.test = {
-          supportsDryActivation = true;
-          text = ''
-            if [ -e /test-the-activation-script ]; then
-              if [ "$NIXOS_ACTION" != dry-activate ]; then
-                touch /activation-was-run
-                echo restart-me.service > /run/nixos/activation-restart-list
-                echo reload-me.service > /run/nixos/activation-reload-list
-              else
-                echo restart-me.service > /run/nixos/dry-activation-restart-list
-                echo reload-me.service > /run/nixos/dry-activation-reload-list
-              fi
-            fi
-          '';
+      systemd.services.restart-me = {
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = "${pkgs.coreutils}/bin/true";
         };
       };
 
-    testScript = # python
-      ''
-        machine.wait_for_unit("multi-user.target")
+      systemd.services.reload-me = {
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = rec {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = "${pkgs.coreutils}/bin/true";
+          ExecReload = ExecStart;
+        };
+      };
 
-        with subtest("nothing happens when the activation script does nothing"):
-            out = machine.succeed("/run/current-system/bin/switch-to-configuration dry-activate 2>&1")
-            assert 'restart' not in out
-            assert 'reload' not in out
-            out = machine.succeed("/run/current-system/bin/switch-to-configuration test")
-            assert 'restart' not in out
-            assert 'reload' not in out
+      system.activationScripts.test = {
+        supportsDryActivation = true;
+        text = ''
+          if [ -e /test-the-activation-script ]; then
+            if [ "$NIXOS_ACTION" != dry-activate ]; then
+              touch /activation-was-run
+              echo restart-me.service > /run/nixos/activation-restart-list
+              echo reload-me.service > /run/nixos/activation-reload-list
+            else
+              echo restart-me.service > /run/nixos/dry-activation-restart-list
+              echo reload-me.service > /run/nixos/dry-activation-reload-list
+            fi
+          fi
+        '';
+      };
+    };
 
-        machine.succeed("touch /test-the-activation-script")
+  testScript = # python
+    ''
+      machine.wait_for_unit("multi-user.target")
 
-        with subtest("dry activation"):
-            out = machine.succeed("/run/current-system/bin/switch-to-configuration dry-activate 2>&1")
-            assert 'would restart the following units: restart-me.service' in out
-            assert 'would reload the following units: reload-me.service' in out
-            machine.fail("test -f /run/nixos/dry-activation-restart-list")
-            machine.fail("test -f /run/nixos/dry-activation-reload-list")
+      with subtest("nothing happens when the activation script does nothing"):
+          out = machine.succeed("/run/current-system/bin/switch-to-configuration dry-activate 2>&1")
+          assert 'restart' not in out
+          assert 'reload' not in out
+          out = machine.succeed("/run/current-system/bin/switch-to-configuration test")
+          assert 'restart' not in out
+          assert 'reload' not in out
 
-        with subtest("real activation"):
-            out = machine.succeed("/run/current-system/bin/switch-to-configuration test 2>&1")
-            assert 'restarting the following units: restart-me.service' in out
-            assert 'reloading the following units: reload-me.service' in out
-            machine.fail("test -f /run/nixos/activation-restart-list")
-            machine.fail("test -f /run/nixos/activation-reload-list")
-      '';
-  }
-)
+      machine.succeed("touch /test-the-activation-script")
+
+      with subtest("dry activation"):
+          out = machine.succeed("/run/current-system/bin/switch-to-configuration dry-activate 2>&1")
+          assert 'would restart the following units: restart-me.service' in out
+          assert 'would reload the following units: reload-me.service' in out
+          machine.fail("test -f /run/nixos/dry-activation-restart-list")
+          machine.fail("test -f /run/nixos/dry-activation-reload-list")
+
+      with subtest("real activation"):
+          out = machine.succeed("/run/current-system/bin/switch-to-configuration test 2>&1")
+          assert 'restarting the following units: restart-me.service' in out
+          assert 'reloading the following units: reload-me.service' in out
+          machine.fail("test -f /run/nixos/activation-restart-list")
+          machine.fail("test -f /run/nixos/activation-reload-list")
+    '';
+}
diff --git a/nixos/tests/restic-rest-server.nix b/nixos/tests/restic-rest-server.nix
index ecca1bf83af3..9e6753d91b2a 100644
--- a/nixos/tests/restic-rest-server.nix
+++ b/nixos/tests/restic-rest-server.nix
@@ -1,129 +1,127 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    remoteRepository = "rest:http://restic_rest_server:8001/";
+let
+  remoteRepository = "rest:http://restic_rest_server:8001/";
 
-    backupPrepareCommand = ''
-      touch /root/backupPrepareCommand
-      test ! -e /root/backupCleanupCommand
+  backupPrepareCommand = ''
+    touch /root/backupPrepareCommand
+    test ! -e /root/backupCleanupCommand
+  '';
+
+  backupCleanupCommand = ''
+    rm /root/backupPrepareCommand
+    touch /root/backupCleanupCommand
+  '';
+
+  testDir = pkgs.stdenvNoCC.mkDerivation {
+    name = "test-files-to-backup";
+    unpackPhase = "true";
+    installPhase = ''
+      mkdir $out
+      echo some_file > $out/some_file
+      echo some_other_file > $out/some_other_file
+      mkdir $out/a_dir
+      echo a_file > $out/a_dir/a_file
     '';
+  };
 
-    backupCleanupCommand = ''
-      rm /root/backupPrepareCommand
-      touch /root/backupCleanupCommand
-    '';
+  passwordFile = "${pkgs.writeText "password" "correcthorsebatterystaple"}";
+  paths = [ "/opt" ];
+  exclude = [ "/opt/excluded_file_*" ];
+  pruneOpts = [
+    "--keep-daily 2"
+    "--keep-weekly 1"
+    "--keep-monthly 1"
+    "--keep-yearly 99"
+  ];
+in
+{
+  name = "restic-rest-server";
 
-    testDir = pkgs.stdenvNoCC.mkDerivation {
-      name = "test-files-to-backup";
-      unpackPhase = "true";
-      installPhase = ''
-        mkdir $out
-        echo some_file > $out/some_file
-        echo some_other_file > $out/some_other_file
-        mkdir $out/a_dir
-        echo a_file > $out/a_dir/a_file
-      '';
-    };
-
-    passwordFile = "${pkgs.writeText "password" "correcthorsebatterystaple"}";
-    paths = [ "/opt" ];
-    exclude = [ "/opt/excluded_file_*" ];
-    pruneOpts = [
-      "--keep-daily 2"
-      "--keep-weekly 1"
-      "--keep-monthly 1"
-      "--keep-yearly 99"
-    ];
-  in
-  {
-    name = "restic-rest-server";
-
-    nodes = {
-      restic_rest_server = {
-        services.restic.server = {
-          enable = true;
-          extraFlags = [ "--no-auth" ];
-          listenAddress = "8001";
-        };
-        networking.firewall.allowedTCPPorts = [ 8001 ];
+  nodes = {
+    restic_rest_server = {
+      services.restic.server = {
+        enable = true;
+        extraFlags = [ "--no-auth" ];
+        listenAddress = "8001";
       };
-      server = {
-        services.restic.backups = {
-          remotebackup = {
-            inherit
-              passwordFile
-              paths
-              exclude
-              pruneOpts
-              backupPrepareCommand
-              backupCleanupCommand
-              ;
-            repository = remoteRepository;
-            initialize = true;
-            timerConfig = null; # has no effect here, just checking that it doesn't break the service
-          };
-          remoteprune = {
-            inherit passwordFile;
-            repository = remoteRepository;
-            pruneOpts = [ "--keep-last 1" ];
-          };
+      networking.firewall.allowedTCPPorts = [ 8001 ];
+    };
+    server = {
+      services.restic.backups = {
+        remotebackup = {
+          inherit
+            passwordFile
+            paths
+            exclude
+            pruneOpts
+            backupPrepareCommand
+            backupCleanupCommand
+            ;
+          repository = remoteRepository;
+          initialize = true;
+          timerConfig = null; # has no effect here, just checking that it doesn't break the service
+        };
+        remoteprune = {
+          inherit passwordFile;
+          repository = remoteRepository;
+          pruneOpts = [ "--keep-last 1" ];
         };
       };
     };
+  };
 
-    testScript = ''
-      restic_rest_server.start()
-      server.start()
-      restic_rest_server.wait_for_unit("restic-rest-server.socket")
-      restic_rest_server.wait_for_open_port(8001)
-      server.wait_for_unit("dbus.socket")
-      server.fail(
-          "restic-remotebackup snapshots",
-      )
-      server.succeed(
-          # set up
-          "cp -rT ${testDir} /opt",
-          "touch /opt/excluded_file_1 /opt/excluded_file_2",
+  testScript = ''
+    restic_rest_server.start()
+    server.start()
+    restic_rest_server.wait_for_unit("restic-rest-server.socket")
+    restic_rest_server.wait_for_open_port(8001)
+    server.wait_for_unit("dbus.socket")
+    server.fail(
+        "restic-remotebackup snapshots",
+    )
+    server.succeed(
+        # set up
+        "cp -rT ${testDir} /opt",
+        "touch /opt/excluded_file_1 /opt/excluded_file_2",
 
-          # test that remotebackup runs custom commands and produces a snapshot
-          "timedatectl set-time '2016-12-13 13:45'",
-          "systemctl start restic-backups-remotebackup.service",
-          "rm /root/backupCleanupCommand",
-          'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+        # test that remotebackup runs custom commands and produces a snapshot
+        "timedatectl set-time '2016-12-13 13:45'",
+        "systemctl start restic-backups-remotebackup.service",
+        "rm /root/backupCleanupCommand",
+        'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
 
-          # test that restoring that snapshot produces the same directory
-          "mkdir /tmp/restore-1",
-          "restic-remotebackup restore latest -t /tmp/restore-1",
-          "diff -ru ${testDir} /tmp/restore-1/opt",
+        # test that restoring that snapshot produces the same directory
+        "mkdir /tmp/restore-1",
+        "restic-remotebackup restore latest -t /tmp/restore-1",
+        "diff -ru ${testDir} /tmp/restore-1/opt",
 
-          # test that we can create four snapshots in remotebackup and rclonebackup
-          "timedatectl set-time '2017-12-13 13:45'",
-          "systemctl start restic-backups-remotebackup.service",
-          "rm /root/backupCleanupCommand",
+        # test that we can create four snapshots in remotebackup and rclonebackup
+        "timedatectl set-time '2017-12-13 13:45'",
+        "systemctl start restic-backups-remotebackup.service",
+        "rm /root/backupCleanupCommand",
 
-          "timedatectl set-time '2018-12-13 13:45'",
-          "systemctl start restic-backups-remotebackup.service",
-          "rm /root/backupCleanupCommand",
+        "timedatectl set-time '2018-12-13 13:45'",
+        "systemctl start restic-backups-remotebackup.service",
+        "rm /root/backupCleanupCommand",
 
-          "timedatectl set-time '2018-12-14 13:45'",
-          "systemctl start restic-backups-remotebackup.service",
-          "rm /root/backupCleanupCommand",
+        "timedatectl set-time '2018-12-14 13:45'",
+        "systemctl start restic-backups-remotebackup.service",
+        "rm /root/backupCleanupCommand",
 
-          "timedatectl set-time '2018-12-15 13:45'",
-          "systemctl start restic-backups-remotebackup.service",
-          "rm /root/backupCleanupCommand",
+        "timedatectl set-time '2018-12-15 13:45'",
+        "systemctl start restic-backups-remotebackup.service",
+        "rm /root/backupCleanupCommand",
 
-          "timedatectl set-time '2018-12-16 13:45'",
-          "systemctl start restic-backups-remotebackup.service",
-          "rm /root/backupCleanupCommand",
+        "timedatectl set-time '2018-12-16 13:45'",
+        "systemctl start restic-backups-remotebackup.service",
+        "rm /root/backupCleanupCommand",
 
-          'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 4"',
+        'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 4"',
 
-          # test that remoteprune brings us back to 1 snapshot in remotebackup
-          "systemctl start restic-backups-remoteprune.service",
-          'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
-      )
-    '';
-  }
-)
+        # test that remoteprune brings us back to 1 snapshot in remotebackup
+        "systemctl start restic-backups-remoteprune.service",
+        'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+    )
+  '';
+}
diff --git a/nixos/tests/restic.nix b/nixos/tests/restic.nix
index 54d2a88c4545..44e405fe4852 100644
--- a/nixos/tests/restic.nix
+++ b/nixos/tests/restic.nix
@@ -1,249 +1,247 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    remoteRepository = "/root/restic-backup";
-    remoteFromFileRepository = "/root/restic-backup-from-file";
-    remoteInhibitTestRepository = "/root/restic-backup-inhibit-test";
-    remoteNoInitRepository = "/root/restic-backup-no-init";
-    rcloneRepository = "rclone:local:/root/restic-rclone-backup";
+let
+  remoteRepository = "/root/restic-backup";
+  remoteFromFileRepository = "/root/restic-backup-from-file";
+  remoteInhibitTestRepository = "/root/restic-backup-inhibit-test";
+  remoteNoInitRepository = "/root/restic-backup-no-init";
+  rcloneRepository = "rclone:local:/root/restic-rclone-backup";
 
-    backupPrepareCommand = ''
-      touch /root/backupPrepareCommand
-      test ! -e /root/backupCleanupCommand
+  backupPrepareCommand = ''
+    touch /root/backupPrepareCommand
+    test ! -e /root/backupCleanupCommand
+  '';
+
+  backupCleanupCommand = ''
+    rm /root/backupPrepareCommand
+    touch /root/backupCleanupCommand
+  '';
+
+  testDir = pkgs.stdenvNoCC.mkDerivation {
+    name = "test-files-to-backup";
+    unpackPhase = "true";
+    installPhase = ''
+      mkdir $out
+      echo some_file > $out/some_file
+      echo some_other_file > $out/some_other_file
+      mkdir $out/a_dir
+      echo a_file > $out/a_dir/a_file
+      echo a_file_2 > $out/a_dir/a_file_2
     '';
+  };
 
-    backupCleanupCommand = ''
-      rm /root/backupPrepareCommand
-      touch /root/backupCleanupCommand
-    '';
+  passwordFile = "${pkgs.writeText "password" "correcthorsebatterystaple"}";
+  paths = [ "/opt" ];
+  exclude = [ "/opt/excluded_file_*" ];
+  pruneOpts = [
+    "--keep-daily 2"
+    "--keep-weekly 1"
+    "--keep-monthly 1"
+    "--keep-yearly 99"
+  ];
+in
+{
+  name = "restic";
 
-    testDir = pkgs.stdenvNoCC.mkDerivation {
-      name = "test-files-to-backup";
-      unpackPhase = "true";
-      installPhase = ''
-        mkdir $out
-        echo some_file > $out/some_file
-        echo some_other_file > $out/some_other_file
-        mkdir $out/a_dir
-        echo a_file > $out/a_dir/a_file
-        echo a_file_2 > $out/a_dir/a_file_2
-      '';
-    };
-
-    passwordFile = "${pkgs.writeText "password" "correcthorsebatterystaple"}";
-    paths = [ "/opt" ];
-    exclude = [ "/opt/excluded_file_*" ];
-    pruneOpts = [
-      "--keep-daily 2"
-      "--keep-weekly 1"
-      "--keep-monthly 1"
-      "--keep-yearly 99"
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      bbigras
+      i077
     ];
-  in
-  {
-    name = "restic";
+  };
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        bbigras
-        i077
-      ];
-    };
-
-    nodes = {
-      server =
-        { pkgs, ... }:
-        {
-          services.restic.backups = {
-            remotebackup = {
-              inherit
-                passwordFile
-                paths
-                exclude
-                pruneOpts
-                backupPrepareCommand
-                backupCleanupCommand
-                ;
-              repository = remoteRepository;
-              initialize = true;
-              timerConfig = null; # has no effect here, just checking that it doesn't break the service
-            };
-            remote-from-file-backup = {
-              inherit passwordFile exclude pruneOpts;
-              initialize = true;
-              repositoryFile = pkgs.writeText "repositoryFile" remoteFromFileRepository;
-              paths = [
-                "/opt/a_dir/a_file"
-                "/opt/a_dir/a_file_2"
-              ];
-              dynamicFilesFrom = ''
-                find /opt -mindepth 1 -maxdepth 1 ! -name a_dir # all files in /opt except for a_dir
-              '';
-            };
-            inhibit-test = {
-              inherit
-                passwordFile
-                paths
-                exclude
-                pruneOpts
-                ;
-              repository = remoteInhibitTestRepository;
-              initialize = true;
-              inhibitsSleep = true;
-            };
-            remote-noinit-backup = {
-              inherit
-                passwordFile
-                exclude
-                pruneOpts
-                paths
-                ;
-              initialize = false;
-              repository = remoteNoInitRepository;
-            };
-            rclonebackup = {
-              inherit
-                passwordFile
-                paths
-                exclude
-                pruneOpts
-                ;
-              initialize = true;
-              repository = rcloneRepository;
-              rcloneConfig = {
-                type = "local";
-                one_file_system = true;
-              };
-
-              # This gets overridden by rcloneConfig.type
-              rcloneConfigFile = pkgs.writeText "rclone.conf" ''
-                [local]
-                type=ftp
-              '';
-            };
-            remoteprune = {
-              inherit passwordFile;
-              repository = remoteRepository;
-              pruneOpts = [ "--keep-last 1" ];
-            };
-            custompackage = {
-              inherit passwordFile paths;
-              repository = "some-fake-repository";
-              package = pkgs.writeShellScriptBin "restic" ''
-                echo "$@" >> /root/fake-restic.log;
-              '';
-
-              pruneOpts = [ "--keep-last 1" ];
-              checkOpts = [ "--some-check-option" ];
-            };
+  nodes = {
+    server =
+      { pkgs, ... }:
+      {
+        services.restic.backups = {
+          remotebackup = {
+            inherit
+              passwordFile
+              paths
+              exclude
+              pruneOpts
+              backupPrepareCommand
+              backupCleanupCommand
+              ;
+            repository = remoteRepository;
+            initialize = true;
+            timerConfig = null; # has no effect here, just checking that it doesn't break the service
           };
+          remote-from-file-backup = {
+            inherit passwordFile exclude pruneOpts;
+            initialize = true;
+            repositoryFile = pkgs.writeText "repositoryFile" remoteFromFileRepository;
+            paths = [
+              "/opt/a_dir/a_file"
+              "/opt/a_dir/a_file_2"
+            ];
+            dynamicFilesFrom = ''
+              find /opt -mindepth 1 -maxdepth 1 ! -name a_dir # all files in /opt except for a_dir
+            '';
+          };
+          inhibit-test = {
+            inherit
+              passwordFile
+              paths
+              exclude
+              pruneOpts
+              ;
+            repository = remoteInhibitTestRepository;
+            initialize = true;
+            inhibitsSleep = true;
+          };
+          remote-noinit-backup = {
+            inherit
+              passwordFile
+              exclude
+              pruneOpts
+              paths
+              ;
+            initialize = false;
+            repository = remoteNoInitRepository;
+          };
+          rclonebackup = {
+            inherit
+              passwordFile
+              paths
+              exclude
+              pruneOpts
+              ;
+            initialize = true;
+            repository = rcloneRepository;
+            rcloneConfig = {
+              type = "local";
+              one_file_system = true;
+            };
 
-          environment.sessionVariables.RCLONE_CONFIG_LOCAL_TYPE = "local";
+            # This gets overridden by rcloneConfig.type
+            rcloneConfigFile = pkgs.writeText "rclone.conf" ''
+              [local]
+              type=ftp
+            '';
+          };
+          remoteprune = {
+            inherit passwordFile;
+            repository = remoteRepository;
+            pruneOpts = [ "--keep-last 1" ];
+          };
+          custompackage = {
+            inherit passwordFile paths;
+            repository = "some-fake-repository";
+            package = pkgs.writeShellScriptBin "restic" ''
+              echo "$@" >> /root/fake-restic.log;
+            '';
+
+            pruneOpts = [ "--keep-last 1" ];
+            checkOpts = [ "--some-check-option" ];
+          };
         };
-    };
 
-    testScript = ''
-      server.start()
-      server.wait_for_unit("dbus.socket")
-      server.fail(
-          "restic-remotebackup snapshots",
-          'restic-remote-from-file-backup snapshots"',
-          "restic-rclonebackup snapshots",
-          "grep 'backup.* /opt' /root/fake-restic.log",
-      )
-      server.succeed(
-          # set up
-          "cp -rT ${testDir} /opt",
-          "touch /opt/excluded_file_1 /opt/excluded_file_2",
-          "mkdir -p /root/restic-rclone-backup",
-      )
+        environment.sessionVariables.RCLONE_CONFIG_LOCAL_TYPE = "local";
+      };
+  };
 
-      server.fail(
-          # test that noinit backup in fact does not initialize the repository
-          # and thus fails without a pre-initialized repository
-          "systemctl start restic-backups-remote-noinit-backup.service",
-      )
+  testScript = ''
+    server.start()
+    server.wait_for_unit("dbus.socket")
+    server.fail(
+        "restic-remotebackup snapshots",
+        'restic-remote-from-file-backup snapshots"',
+        "restic-rclonebackup snapshots",
+        "grep 'backup.* /opt' /root/fake-restic.log",
+    )
+    server.succeed(
+        # set up
+        "cp -rT ${testDir} /opt",
+        "touch /opt/excluded_file_1 /opt/excluded_file_2",
+        "mkdir -p /root/restic-rclone-backup",
+    )
 
-      server.succeed(
-          # test that remotebackup runs custom commands and produces a snapshot
-          "timedatectl set-time '2016-12-13 13:45'",
-          "systemctl start restic-backups-remotebackup.service",
-          "rm /root/backupCleanupCommand",
-          'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+    server.fail(
+        # test that noinit backup in fact does not initialize the repository
+        # and thus fails without a pre-initialized repository
+        "systemctl start restic-backups-remote-noinit-backup.service",
+    )
 
-          # test that restoring that snapshot produces the same directory
-          "mkdir /tmp/restore-1",
-          "restic-remotebackup restore latest -t /tmp/restore-1",
-          "diff -ru ${testDir} /tmp/restore-1/opt",
+    server.succeed(
+        # test that remotebackup runs custom commands and produces a snapshot
+        "timedatectl set-time '2016-12-13 13:45'",
+        "systemctl start restic-backups-remotebackup.service",
+        "rm /root/backupCleanupCommand",
+        'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
 
-          # test that remote-from-file-backup produces a snapshot
-          "systemctl start restic-backups-remote-from-file-backup.service",
-          'restic-remote-from-file-backup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
-          "mkdir /tmp/restore-2",
-          "restic-remote-from-file-backup restore latest -t /tmp/restore-2",
-          "diff -ru ${testDir} /tmp/restore-2/opt",
+        # test that restoring that snapshot produces the same directory
+        "mkdir /tmp/restore-1",
+        "restic-remotebackup restore latest -t /tmp/restore-1",
+        "diff -ru ${testDir} /tmp/restore-1/opt",
 
-          # test that remote-noinit-backup produces a snapshot once initialized
-          "restic-remote-noinit-backup init",
-          "systemctl start restic-backups-remote-noinit-backup.service",
-          'restic-remote-noinit-backup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+        # test that remote-from-file-backup produces a snapshot
+        "systemctl start restic-backups-remote-from-file-backup.service",
+        'restic-remote-from-file-backup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+        "mkdir /tmp/restore-2",
+        "restic-remote-from-file-backup restore latest -t /tmp/restore-2",
+        "diff -ru ${testDir} /tmp/restore-2/opt",
 
-          # test that restoring that snapshot produces the same directory
-          "mkdir /tmp/restore-3",
-          "${pkgs.restic}/bin/restic -r ${remoteRepository} -p ${passwordFile} restore latest -t /tmp/restore-3",
-          "diff -ru ${testDir} /tmp/restore-3/opt",
+        # test that remote-noinit-backup produces a snapshot once initialized
+        "restic-remote-noinit-backup init",
+        "systemctl start restic-backups-remote-noinit-backup.service",
+        'restic-remote-noinit-backup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
 
-          # test that rclonebackup produces a snapshot
-          "systemctl start restic-backups-rclonebackup.service",
-          'restic-rclonebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+        # test that restoring that snapshot produces the same directory
+        "mkdir /tmp/restore-3",
+        "${pkgs.restic}/bin/restic -r ${remoteRepository} -p ${passwordFile} restore latest -t /tmp/restore-3",
+        "diff -ru ${testDir} /tmp/restore-3/opt",
 
-          # test that custompackage runs both `restic backup` and `restic check` with reasonable commandlines
-          "systemctl start restic-backups-custompackage.service",
-          "grep 'backup' /root/fake-restic.log",
-          "grep 'check.* --some-check-option' /root/fake-restic.log",
+        # test that rclonebackup produces a snapshot
+        "systemctl start restic-backups-rclonebackup.service",
+        'restic-rclonebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
 
-          # test that we can create four snapshots in remotebackup and rclonebackup
-          "timedatectl set-time '2017-12-13 13:45'",
-          "systemctl start restic-backups-remotebackup.service",
-          "rm /root/backupCleanupCommand",
-          "systemctl start restic-backups-rclonebackup.service",
+        # test that custompackage runs both `restic backup` and `restic check` with reasonable commandlines
+        "systemctl start restic-backups-custompackage.service",
+        "grep 'backup' /root/fake-restic.log",
+        "grep 'check.* --some-check-option' /root/fake-restic.log",
 
-          "timedatectl set-time '2018-12-13 13:45'",
-          "systemctl start restic-backups-remotebackup.service",
-          "rm /root/backupCleanupCommand",
-          "systemctl start restic-backups-rclonebackup.service",
+        # test that we can create four snapshots in remotebackup and rclonebackup
+        "timedatectl set-time '2017-12-13 13:45'",
+        "systemctl start restic-backups-remotebackup.service",
+        "rm /root/backupCleanupCommand",
+        "systemctl start restic-backups-rclonebackup.service",
 
-          "timedatectl set-time '2018-12-14 13:45'",
-          "systemctl start restic-backups-remotebackup.service",
-          "rm /root/backupCleanupCommand",
-          "systemctl start restic-backups-rclonebackup.service",
+        "timedatectl set-time '2018-12-13 13:45'",
+        "systemctl start restic-backups-remotebackup.service",
+        "rm /root/backupCleanupCommand",
+        "systemctl start restic-backups-rclonebackup.service",
 
-          "timedatectl set-time '2018-12-15 13:45'",
-          "systemctl start restic-backups-remotebackup.service",
-          "rm /root/backupCleanupCommand",
-          "systemctl start restic-backups-rclonebackup.service",
+        "timedatectl set-time '2018-12-14 13:45'",
+        "systemctl start restic-backups-remotebackup.service",
+        "rm /root/backupCleanupCommand",
+        "systemctl start restic-backups-rclonebackup.service",
 
-          "timedatectl set-time '2018-12-16 13:45'",
-          "systemctl start restic-backups-remotebackup.service",
-          "rm /root/backupCleanupCommand",
-          "systemctl start restic-backups-rclonebackup.service",
+        "timedatectl set-time '2018-12-15 13:45'",
+        "systemctl start restic-backups-remotebackup.service",
+        "rm /root/backupCleanupCommand",
+        "systemctl start restic-backups-rclonebackup.service",
 
-          'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 4"',
-          'restic-rclonebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 4"',
+        "timedatectl set-time '2018-12-16 13:45'",
+        "systemctl start restic-backups-remotebackup.service",
+        "rm /root/backupCleanupCommand",
+        "systemctl start restic-backups-rclonebackup.service",
 
-          # test that remoteprune brings us back to 1 snapshot in remotebackup
-          "systemctl start restic-backups-remoteprune.service",
-          'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+        'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 4"',
+        'restic-rclonebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 4"',
 
-      )
+        # test that remoteprune brings us back to 1 snapshot in remotebackup
+        "systemctl start restic-backups-remoteprune.service",
+        'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
 
-      # test that the inhibit option is working
-      server.systemctl("start --no-block restic-backups-inhibit-test.service")
-      server.wait_until_succeeds(
-          "systemd-inhibit --no-legend --no-pager | grep -q restic",
-          5
-      )
-    '';
-  }
-)
+    )
+
+    # test that the inhibit option is working
+    server.systemctl("start --no-block restic-backups-inhibit-test.service")
+    server.wait_until_succeeds(
+        "systemd-inhibit --no-legend --no-pager | grep -q restic",
+        5
+    )
+  '';
+}
diff --git a/nixos/tests/retroarch.nix b/nixos/tests/retroarch.nix
index ac03cbffefea..9f700ed290ef 100644
--- a/nixos/tests/retroarch.nix
+++ b/nixos/tests/retroarch.nix
@@ -1,56 +1,54 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "retroarch";
-    meta = with pkgs.lib; {
-      maintainers = teams.libretro.members ++ [ maintainers.j0hax ];
-    };
+{
+  name = "retroarch";
+  meta = with pkgs.lib; {
+    maintainers = teams.libretro.members ++ [ maintainers.j0hax ];
+  };
 
-    nodes.machine =
-      { ... }:
+  nodes.machine =
+    { ... }:
 
-      {
-        imports = [ ./common/user-account.nix ];
-        services.xserver.enable = true;
-        services.xserver.desktopManager.retroarch = {
+    {
+      imports = [ ./common/user-account.nix ];
+      services.xserver.enable = true;
+      services.xserver.desktopManager.retroarch = {
+        enable = true;
+        package = pkgs.retroarch-bare;
+      };
+      services.xserver.displayManager = {
+        sddm.enable = true;
+        defaultSession = "RetroArch";
+        autoLogin = {
           enable = true;
-          package = pkgs.retroarch-bare;
-        };
-        services.xserver.displayManager = {
-          sddm.enable = true;
-          defaultSession = "RetroArch";
-          autoLogin = {
-            enable = true;
-            user = "alice";
-          };
+          user = "alice";
         };
       };
+    };
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.config.users.users.alice;
-        xdo = "${pkgs.xdotool}/bin/xdotool";
-      in
-      ''
-        with subtest("Wait for login"):
-            start_all()
-            machine.wait_for_file("/tmp/xauth_*")
-            machine.succeed("xauth merge /tmp/xauth_*")
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.config.users.users.alice;
+      xdo = "${pkgs.xdotool}/bin/xdotool";
+    in
+    ''
+      with subtest("Wait for login"):
+          start_all()
+          machine.wait_for_file("/tmp/xauth_*")
+          machine.succeed("xauth merge /tmp/xauth_*")
 
-        with subtest("Check RetroArch started"):
-            machine.wait_until_succeeds("pgrep retroarch")
-            machine.wait_for_window("^RetroArch")
+      with subtest("Check RetroArch started"):
+          machine.wait_until_succeeds("pgrep retroarch")
+          machine.wait_for_window("^RetroArch")
 
-        with subtest("Check configuration created"):
-            machine.wait_for_file("${user.home}/.config/retroarch/retroarch.cfg")
+      with subtest("Check configuration created"):
+          machine.wait_for_file("${user.home}/.config/retroarch/retroarch.cfg")
 
-        with subtest("Wait to get a screenshot"):
-            machine.execute(
-                "${xdo} key Alt+F1 sleep 10"
-            )
-            machine.screenshot("screen")
-      '';
-  }
-)
+      with subtest("Wait to get a screenshot"):
+          machine.execute(
+              "${xdo} key Alt+F1 sleep 10"
+          )
+          machine.screenshot("screen")
+    '';
+}
diff --git a/nixos/tests/robustirc-bridge.nix b/nixos/tests/robustirc-bridge.nix
index 31b4240f9836..2f6f48df757c 100644
--- a/nixos/tests/robustirc-bridge.nix
+++ b/nixos/tests/robustirc-bridge.nix
@@ -1,30 +1,28 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "robustirc-bridge";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ hax404 ];
-    };
+{
+  name = "robustirc-bridge";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ hax404 ];
+  };
 
-    nodes = {
-      bridge = {
-        services.robustirc-bridge = {
-          enable = true;
-          extraFlags = [
-            "-listen localhost:6667"
-            "-network example.com"
-          ];
-        };
+  nodes = {
+    bridge = {
+      services.robustirc-bridge = {
+        enable = true;
+        extraFlags = [
+          "-listen localhost:6667"
+          "-network example.com"
+        ];
       };
     };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      bridge.wait_for_unit("robustirc-bridge.service")
-      bridge.wait_for_open_port(1080)
-      bridge.wait_for_open_port(6667)
-    '';
-  }
-)
+    bridge.wait_for_unit("robustirc-bridge.service")
+    bridge.wait_for_open_port(1080)
+    bridge.wait_for_open_port(6667)
+  '';
+}
diff --git a/nixos/tests/rosenpass.nix b/nixos/tests/rosenpass.nix
index cb0937b58971..9af5ef608bfc 100644
--- a/nixos/tests/rosenpass.nix
+++ b/nixos/tests/rosenpass.nix
@@ -1,223 +1,221 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    deviceName = "rp0";
+{ pkgs, ... }:
+let
+  deviceName = "rp0";
 
-    server = {
-      ip = "fe80::1";
-      wg = {
-        public = "mQufmDFeQQuU/fIaB2hHgluhjjm1ypK4hJr1cW3WqAw=";
-        secret = "4N5Y1dldqrpsbaEiY8O0XBUGUFf8vkvtBtm8AoOX7Eo=";
-        listen = 10000;
-      };
+  server = {
+    ip = "fe80::1";
+    wg = {
+      public = "mQufmDFeQQuU/fIaB2hHgluhjjm1ypK4hJr1cW3WqAw=";
+      secret = "4N5Y1dldqrpsbaEiY8O0XBUGUFf8vkvtBtm8AoOX7Eo=";
+      listen = 10000;
     };
-    client = {
-      ip = "fe80::2";
-      wg = {
-        public = "Mb3GOlT7oS+F3JntVKiaD7SpHxLxNdtEmWz/9FMnRFU=";
-        secret = "uC5dfGMv7Oxf5UDfdPkj6rZiRZT2dRWp5x8IQxrNcUE=";
-      };
+  };
+  client = {
+    ip = "fe80::2";
+    wg = {
+      public = "Mb3GOlT7oS+F3JntVKiaD7SpHxLxNdtEmWz/9FMnRFU=";
+      secret = "uC5dfGMv7Oxf5UDfdPkj6rZiRZT2dRWp5x8IQxrNcUE=";
     };
-  in
-  {
-    name = "rosenpass";
+  };
+in
+{
+  name = "rosenpass";
 
-    nodes =
-      let
-        shared =
-          peer:
-          { config, modulesPath, ... }:
-          {
-            imports = [ "${modulesPath}/services/networking/rosenpass.nix" ];
+  nodes =
+    let
+      shared =
+        peer:
+        { config, modulesPath, ... }:
+        {
+          imports = [ "${modulesPath}/services/networking/rosenpass.nix" ];
 
-            boot.kernelModules = [ "wireguard" ];
+          boot.kernelModules = [ "wireguard" ];
 
-            services.rosenpass = {
-              enable = true;
-              defaultDevice = deviceName;
-              settings = {
-                verbosity = "Verbose";
-                public_key = "/etc/rosenpass/pqpk";
-                secret_key = "/etc/rosenpass/pqsk";
-              };
-            };
-
-            networking.firewall.allowedUDPPorts = [ 9999 ];
-
-            systemd.network = {
-              enable = true;
-              networks."rosenpass" = {
-                matchConfig.Name = deviceName;
-                networkConfig.IPv4Forwarding = true;
-                networkConfig.IPv6Forwarding = true;
-                address = [ "${peer.ip}/64" ];
-              };
-
-              netdevs."10-rp0" = {
-                netdevConfig = {
-                  Kind = "wireguard";
-                  Name = deviceName;
-                };
-                wireguardConfig.PrivateKeyFile = "/etc/wireguard/wgsk";
-              };
-            };
-
-            environment.etc."wireguard/wgsk" = {
-              text = peer.wg.secret;
-              user = "systemd-network";
-              group = "systemd-network";
+          services.rosenpass = {
+            enable = true;
+            defaultDevice = deviceName;
+            settings = {
+              verbosity = "Verbose";
+              public_key = "/etc/rosenpass/pqpk";
+              secret_key = "/etc/rosenpass/pqsk";
             };
           };
-      in
-      {
-        server = {
-          imports = [ (shared server) ];
 
-          networking.firewall.allowedUDPPorts = [ server.wg.listen ];
+          networking.firewall.allowedUDPPorts = [ 9999 ];
 
-          systemd.network.netdevs."10-${deviceName}" = {
-            wireguardConfig.ListenPort = server.wg.listen;
-            wireguardPeers = [
-              {
-                AllowedIPs = [ "::/0" ];
-                PublicKey = client.wg.public;
-              }
-            ];
+          systemd.network = {
+            enable = true;
+            networks."rosenpass" = {
+              matchConfig.Name = deviceName;
+              networkConfig.IPv4Forwarding = true;
+              networkConfig.IPv6Forwarding = true;
+              address = [ "${peer.ip}/64" ];
+            };
+
+            netdevs."10-rp0" = {
+              netdevConfig = {
+                Kind = "wireguard";
+                Name = deviceName;
+              };
+              wireguardConfig.PrivateKeyFile = "/etc/wireguard/wgsk";
+            };
           };
 
-          services.rosenpass.settings = {
-            listen = [ "0.0.0.0:9999" ];
-            peers = [
-              {
-                public_key = "/etc/rosenpass/peers/client/pqpk";
-                peer = client.wg.public;
-              }
-            ];
+          environment.etc."wireguard/wgsk" = {
+            text = peer.wg.secret;
+            user = "systemd-network";
+            group = "systemd-network";
           };
         };
-        client = {
-          imports = [ (shared client) ];
+    in
+    {
+      server = {
+        imports = [ (shared server) ];
 
-          systemd.network.netdevs."10-${deviceName}".wireguardPeers = [
+        networking.firewall.allowedUDPPorts = [ server.wg.listen ];
+
+        systemd.network.netdevs."10-${deviceName}" = {
+          wireguardConfig.ListenPort = server.wg.listen;
+          wireguardPeers = [
             {
               AllowedIPs = [ "::/0" ];
-              PublicKey = server.wg.public;
-              Endpoint = "server:${builtins.toString server.wg.listen}";
+              PublicKey = client.wg.public;
             }
           ];
+        };
 
-          services.rosenpass.settings.peers = [
+        services.rosenpass.settings = {
+          listen = [ "0.0.0.0:9999" ];
+          peers = [
             {
-              public_key = "/etc/rosenpass/peers/server/pqpk";
-              endpoint = "server:9999";
-              peer = server.wg.public;
+              public_key = "/etc/rosenpass/peers/client/pqpk";
+              peer = client.wg.public;
             }
           ];
         };
       };
+      client = {
+        imports = [ (shared client) ];
 
-    testScript =
-      { ... }:
-      ''
-        from os import system
+        systemd.network.netdevs."10-${deviceName}".wireguardPeers = [
+          {
+            AllowedIPs = [ "::/0" ];
+            PublicKey = server.wg.public;
+            Endpoint = "server:${builtins.toString server.wg.listen}";
+          }
+        ];
 
-        # Full path to rosenpass in the store, to avoid fiddling with `$PATH`.
-        rosenpass = "${pkgs.rosenpass}/bin/rosenpass"
-
-        # Path in `/etc` where keys will be placed.
-        etc = "/etc/rosenpass"
-
-        start_all()
-
-        for machine in [server, client]:
-            machine.wait_for_unit("multi-user.target")
-
-        # Gently stop Rosenpass to avoid crashes during key generation/distribution.
-        for machine in [server, client]:
-            machine.execute("systemctl stop rosenpass.service")
-
-        for (name, machine, remote) in [("server", server, client), ("client", client, server)]:
-            pk, sk = f"{name}.pqpk", f"{name}.pqsk"
-            system(f"{rosenpass} gen-keys --force --secret-key {sk} --public-key {pk}")
-            machine.copy_from_host(sk, f"{etc}/pqsk")
-            machine.copy_from_host(pk, f"{etc}/pqpk")
-            remote.copy_from_host(pk, f"{etc}/peers/{name}/pqpk")
-
-        for machine in [server, client]:
-            machine.execute("systemctl start rosenpass.service")
-
-        for machine in [server, client]:
-            machine.wait_for_unit("rosenpass.service")
-
-        with subtest("ping"):
-            client.succeed("ping -c 2 -i 0.5 ${server.ip}%${deviceName}")
-
-        with subtest("preshared-keys"):
-            # Rosenpass works by setting the WireGuard preshared key at regular intervals.
-            # Thus, if it is not active, then no key will be set, and the output of `wg show` will contain "none".
-            # Otherwise, if it is active, then the key will be set and "none" will not be found in the output of `wg show`.
-            for machine in [server, client]:
-                machine.wait_until_succeeds("wg show all preshared-keys | grep --invert-match none", timeout=5)
-      '';
-
-    # NOTE: Below configuration is for "interactive" (=developing/debugging) only.
-    interactive.nodes =
-      let
-        inherit (import ./ssh-keys.nix pkgs) snakeOilPublicKey snakeOilPrivateKey;
-
-        sshAndKeyGeneration = {
-          services.openssh.enable = true;
-          users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
-          environment.systemPackages = [
-            (pkgs.writeShellApplication {
-              name = "gen-keys";
-              runtimeInputs = [ pkgs.rosenpass ];
-              text = ''
-                HOST="$(hostname)"
-                if [ "$HOST" == "server" ]
-                then
-                  PEER="client"
-                else
-                  PEER="server"
-                fi
-
-                # Generate keypair.
-                mkdir -vp /etc/rosenpass/peers/$PEER
-                rosenpass gen-keys --force --secret-key /etc/rosenpass/pqsk --public-key /etc/rosenpass/pqpk
-
-                # Set up SSH key.
-                mkdir -p /root/.ssh
-                cp ${snakeOilPrivateKey} /root/.ssh/id_ecdsa
-                chmod 0400 /root/.ssh/id_ecdsa
-
-                # Copy public key to other peer.
-                # shellcheck disable=SC2029
-                ssh -o StrictHostKeyChecking=no $PEER "mkdir -pv /etc/rosenpass/peers/$HOST"
-                scp /etc/rosenpass/pqpk "$PEER:/etc/rosenpass/peers/$HOST/pqpk"
-              '';
-            })
-          ];
-        };
-
-        # Use kmscon <https://www.freedesktop.org/wiki/Software/kmscon/>
-        # to provide a slightly nicer console, and while we're at it,
-        # also use a nice font.
-        # With kmscon, we can for example zoom in/out using [Ctrl] + [+]
-        # and [Ctrl] + [-]
-        niceConsoleAndAutologin.services.kmscon = {
-          enable = true;
-          autologinUser = "root";
-          fonts = [
-            {
-              name = "Fira Code";
-              package = pkgs.fira-code;
-            }
-          ];
-        };
-      in
-      {
-        server = sshAndKeyGeneration // niceConsoleAndAutologin;
-        client = sshAndKeyGeneration // niceConsoleAndAutologin;
+        services.rosenpass.settings.peers = [
+          {
+            public_key = "/etc/rosenpass/peers/server/pqpk";
+            endpoint = "server:9999";
+            peer = server.wg.public;
+          }
+        ];
       };
-  }
-)
+    };
+
+  testScript =
+    { ... }:
+    ''
+      from os import system
+
+      # Full path to rosenpass in the store, to avoid fiddling with `$PATH`.
+      rosenpass = "${pkgs.rosenpass}/bin/rosenpass"
+
+      # Path in `/etc` where keys will be placed.
+      etc = "/etc/rosenpass"
+
+      start_all()
+
+      for machine in [server, client]:
+          machine.wait_for_unit("multi-user.target")
+
+      # Gently stop Rosenpass to avoid crashes during key generation/distribution.
+      for machine in [server, client]:
+          machine.execute("systemctl stop rosenpass.service")
+
+      for (name, machine, remote) in [("server", server, client), ("client", client, server)]:
+          pk, sk = f"{name}.pqpk", f"{name}.pqsk"
+          system(f"{rosenpass} gen-keys --force --secret-key {sk} --public-key {pk}")
+          machine.copy_from_host(sk, f"{etc}/pqsk")
+          machine.copy_from_host(pk, f"{etc}/pqpk")
+          remote.copy_from_host(pk, f"{etc}/peers/{name}/pqpk")
+
+      for machine in [server, client]:
+          machine.execute("systemctl start rosenpass.service")
+
+      for machine in [server, client]:
+          machine.wait_for_unit("rosenpass.service")
+
+      with subtest("ping"):
+          client.succeed("ping -c 2 -i 0.5 ${server.ip}%${deviceName}")
+
+      with subtest("preshared-keys"):
+          # Rosenpass works by setting the WireGuard preshared key at regular intervals.
+          # Thus, if it is not active, then no key will be set, and the output of `wg show` will contain "none".
+          # Otherwise, if it is active, then the key will be set and "none" will not be found in the output of `wg show`.
+          for machine in [server, client]:
+              machine.wait_until_succeeds("wg show all preshared-keys | grep --invert-match none", timeout=5)
+    '';
+
+  # NOTE: Below configuration is for "interactive" (=developing/debugging) only.
+  interactive.nodes =
+    let
+      inherit (import ./ssh-keys.nix pkgs) snakeOilPublicKey snakeOilPrivateKey;
+
+      sshAndKeyGeneration = {
+        services.openssh.enable = true;
+        users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+        environment.systemPackages = [
+          (pkgs.writeShellApplication {
+            name = "gen-keys";
+            runtimeInputs = [ pkgs.rosenpass ];
+            text = ''
+              HOST="$(hostname)"
+              if [ "$HOST" == "server" ]
+              then
+                PEER="client"
+              else
+                PEER="server"
+              fi
+
+              # Generate keypair.
+              mkdir -vp /etc/rosenpass/peers/$PEER
+              rosenpass gen-keys --force --secret-key /etc/rosenpass/pqsk --public-key /etc/rosenpass/pqpk
+
+              # Set up SSH key.
+              mkdir -p /root/.ssh
+              cp ${snakeOilPrivateKey} /root/.ssh/id_ecdsa
+              chmod 0400 /root/.ssh/id_ecdsa
+
+              # Copy public key to other peer.
+              # shellcheck disable=SC2029
+              ssh -o StrictHostKeyChecking=no $PEER "mkdir -pv /etc/rosenpass/peers/$HOST"
+              scp /etc/rosenpass/pqpk "$PEER:/etc/rosenpass/peers/$HOST/pqpk"
+            '';
+          })
+        ];
+      };
+
+      # Use kmscon <https://www.freedesktop.org/wiki/Software/kmscon/>
+      # to provide a slightly nicer console, and while we're at it,
+      # also use a nice font.
+      # With kmscon, we can for example zoom in/out using [Ctrl] + [+]
+      # and [Ctrl] + [-]
+      niceConsoleAndAutologin.services.kmscon = {
+        enable = true;
+        autologinUser = "root";
+        fonts = [
+          {
+            name = "Fira Code";
+            package = pkgs.fira-code;
+          }
+        ];
+      };
+    in
+    {
+      server = sshAndKeyGeneration // niceConsoleAndAutologin;
+      client = sshAndKeyGeneration // niceConsoleAndAutologin;
+    };
+}
diff --git a/nixos/tests/roundcube.nix b/nixos/tests/roundcube.nix
index 1f82e9c7a902..c631c97d6827 100644
--- a/nixos/tests/roundcube.nix
+++ b/nixos/tests/roundcube.nix
@@ -1,40 +1,38 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "roundcube";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ globin ];
-    };
+{ pkgs, ... }:
+{
+  name = "roundcube";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ globin ];
+  };
 
-    nodes = {
-      roundcube =
-        { config, pkgs, ... }:
-        {
-          services.roundcube = {
-            enable = true;
-            hostName = "roundcube";
-            database.password = "not production";
-            package = pkgs.roundcube.withPlugins (plugins: [ plugins.persistent_login ]);
-            plugins = [ "persistent_login" ];
-            dicts = with pkgs.aspellDicts; [
-              en
-              fr
-              de
-            ];
-          };
-          services.nginx.virtualHosts.roundcube = {
-            forceSSL = false;
-            enableACME = false;
-          };
+  nodes = {
+    roundcube =
+      { config, pkgs, ... }:
+      {
+        services.roundcube = {
+          enable = true;
+          hostName = "roundcube";
+          database.password = "not production";
+          package = pkgs.roundcube.withPlugins (plugins: [ plugins.persistent_login ]);
+          plugins = [ "persistent_login" ];
+          dicts = with pkgs.aspellDicts; [
+            en
+            fr
+            de
+          ];
         };
-    };
+        services.nginx.virtualHosts.roundcube = {
+          forceSSL = false;
+          enableACME = false;
+        };
+      };
+  };
 
-    testScript = ''
-      roundcube.start
-      roundcube.wait_for_unit("postgresql.service")
-      roundcube.wait_for_unit("phpfpm-roundcube.service")
-      roundcube.wait_for_unit("nginx.service")
-      roundcube.succeed("curl -sSfL http://roundcube/ | grep 'Keep me logged in'")
-    '';
-  }
-)
+  testScript = ''
+    roundcube.start
+    roundcube.wait_for_unit("postgresql.service")
+    roundcube.wait_for_unit("phpfpm-roundcube.service")
+    roundcube.wait_for_unit("nginx.service")
+    roundcube.succeed("curl -sSfL http://roundcube/ | grep 'Keep me logged in'")
+  '';
+}
diff --git a/nixos/tests/rspamd-trainer.nix b/nixos/tests/rspamd-trainer.nix
index fdb05bb8b00d..2f58ab73dd4f 100644
--- a/nixos/tests/rspamd-trainer.nix
+++ b/nixos/tests/rspamd-trainer.nix
@@ -1,168 +1,166 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    certs = import ./common/acme/server/snakeoil-certs.nix;
-    domain = certs.domain;
-  in
-  {
-    name = "rspamd-trainer";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ onny ];
-    };
+{ pkgs, ... }:
+let
+  certs = import ./common/acme/server/snakeoil-certs.nix;
+  domain = certs.domain;
+in
+{
+  name = "rspamd-trainer";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ onny ];
+  };
 
-    nodes = {
-      machine =
-        { options, config, ... }:
-        {
+  nodes = {
+    machine =
+      { options, config, ... }:
+      {
 
-          security.pki.certificateFiles = [
-            certs.ca.cert
+        security.pki.certificateFiles = [
+          certs.ca.cert
+        ];
+
+        networking.extraHosts = ''
+          127.0.0.1 ${domain}
+        '';
+
+        services.rspamd-trainer = {
+          enable = true;
+          settings = {
+            HOST = domain;
+            USERNAME = "spam@${domain}";
+            INBOXPREFIX = "INBOX/";
+          };
+          secrets = [
+            # Do not use this in production. This will make passwords
+            # world-readable in the Nix store
+            "${pkgs.writeText "secrets" ''
+              PASSWORD = test123
+            ''}"
           ];
-
-          networking.extraHosts = ''
-            127.0.0.1 ${domain}
-          '';
-
-          services.rspamd-trainer = {
-            enable = true;
-            settings = {
-              HOST = domain;
-              USERNAME = "spam@${domain}";
-              INBOXPREFIX = "INBOX/";
-            };
-            secrets = [
-              # Do not use this in production. This will make passwords
-              # world-readable in the Nix store
-              "${pkgs.writeText "secrets" ''
-                PASSWORD = test123
-              ''}"
-            ];
-          };
-
-          services.maddy = {
-            enable = true;
-            hostname = domain;
-            primaryDomain = domain;
-            ensureAccounts = [ "spam@${domain}" ];
-            ensureCredentials = {
-              # Do not use this in production. This will make passwords world-readable
-              # in the Nix store
-              "spam@${domain}".passwordFile = "${pkgs.writeText "postmaster" "test123"}";
-            };
-            tls = {
-              loader = "file";
-              certificates = [
-                {
-                  certPath = "${certs.${domain}.cert}";
-                  keyPath = "${certs.${domain}.key}";
-                }
-              ];
-            };
-            config =
-              builtins.replaceStrings
-                [
-                  "imap tcp://0.0.0.0:143"
-                  "submission tcp://0.0.0.0:587"
-                ]
-                [
-                  "imap tls://0.0.0.0:993 tcp://0.0.0.0:143"
-                  "submission tls://0.0.0.0:465 tcp://0.0.0.0:587"
-                ]
-                options.services.maddy.config.default;
-          };
-
-          services.rspamd = {
-            enable = true;
-            locals = {
-              "redis.conf".text = ''
-                servers = "${config.services.redis.servers.rspamd.unixSocket}";
-              '';
-              "classifier-bayes.conf".text = ''
-                backend = "redis";
-                autolearn = true;
-              '';
-            };
-          };
-
-          services.redis.servers.rspamd = {
-            enable = true;
-            port = 0;
-            unixSocket = "/run/redis-rspamd/redis.sock";
-            user = config.services.rspamd.user;
-          };
-
-          environment.systemPackages = [
-            (pkgs.writers.writePython3Bin "send-testmail" { } ''
-              import smtplib
-              import ssl
-              from email.mime.text import MIMEText
-              context = ssl.create_default_context()
-              msg = MIMEText("Hello World")
-              msg['Subject'] = 'Test'
-              msg['From'] = "spam@${domain}"
-              msg['To'] = "spam@${domain}"
-              with smtplib.SMTP_SSL(host='${domain}', port=465, context=context) as smtp:
-                  smtp.login('spam@${domain}', 'test123')
-                  smtp.sendmail(
-                    'spam@${domain}', 'spam@${domain}', msg.as_string()
-                  )
-            '')
-            (pkgs.writers.writePython3Bin "create-mail-dirs" { } ''
-              import imaplib
-              with imaplib.IMAP4_SSL('${domain}') as imap:
-                  imap.login('spam@${domain}', 'test123')
-                  imap.create("\"INBOX/report_spam\"")
-                  imap.create("\"INBOX/report_ham\"")
-                  imap.create("\"INBOX/report_spam_reply\"")
-                  imap.select("INBOX")
-                  imap.copy("1", "\"INBOX/report_ham\"")
-                  imap.logout()
-            '')
-            (pkgs.writers.writePython3Bin "test-imap" { } ''
-              import imaplib
-              with imaplib.IMAP4_SSL('${domain}') as imap:
-                  imap.login('spam@${domain}', 'test123')
-                  imap.select("INBOX/learned_ham")
-                  status, refs = imap.search(None, 'ALL')
-                  assert status == 'OK'
-                  assert len(refs) == 1
-                  status, msg = imap.fetch(refs[0], 'BODY[TEXT]')
-                  assert status == 'OK'
-                  assert msg[0][1].strip() == b"Hello World"
-                  imap.logout()
-            '')
-          ];
-
         };
 
-    };
+        services.maddy = {
+          enable = true;
+          hostname = domain;
+          primaryDomain = domain;
+          ensureAccounts = [ "spam@${domain}" ];
+          ensureCredentials = {
+            # Do not use this in production. This will make passwords world-readable
+            # in the Nix store
+            "spam@${domain}".passwordFile = "${pkgs.writeText "postmaster" "test123"}";
+          };
+          tls = {
+            loader = "file";
+            certificates = [
+              {
+                certPath = "${certs.${domain}.cert}";
+                keyPath = "${certs.${domain}.key}";
+              }
+            ];
+          };
+          config =
+            builtins.replaceStrings
+              [
+                "imap tcp://0.0.0.0:143"
+                "submission tcp://0.0.0.0:587"
+              ]
+              [
+                "imap tls://0.0.0.0:993 tcp://0.0.0.0:143"
+                "submission tls://0.0.0.0:465 tcp://0.0.0.0:587"
+              ]
+              options.services.maddy.config.default;
+        };
 
-    testScript =
-      { nodes }:
-      ''
-        start_all()
-        machine.wait_for_unit("maddy.service")
-        machine.wait_for_open_port(143)
-        machine.wait_for_open_port(993)
-        machine.wait_for_open_port(587)
-        machine.wait_for_open_port(465)
+        services.rspamd = {
+          enable = true;
+          locals = {
+            "redis.conf".text = ''
+              servers = "${config.services.redis.servers.rspamd.unixSocket}";
+            '';
+            "classifier-bayes.conf".text = ''
+              backend = "redis";
+              autolearn = true;
+            '';
+          };
+        };
 
-        # Send test mail to spam@domain
-        machine.succeed("send-testmail")
+        services.redis.servers.rspamd = {
+          enable = true;
+          port = 0;
+          unixSocket = "/run/redis-rspamd/redis.sock";
+          user = config.services.rspamd.user;
+        };
 
-        # Create mail directories required for rspamd-trainer and copy mail from
-        # INBOX into INBOX/report_ham
-        machine.succeed("create-mail-dirs")
+        environment.systemPackages = [
+          (pkgs.writers.writePython3Bin "send-testmail" { } ''
+            import smtplib
+            import ssl
+            from email.mime.text import MIMEText
+            context = ssl.create_default_context()
+            msg = MIMEText("Hello World")
+            msg['Subject'] = 'Test'
+            msg['From'] = "spam@${domain}"
+            msg['To'] = "spam@${domain}"
+            with smtplib.SMTP_SSL(host='${domain}', port=465, context=context) as smtp:
+                smtp.login('spam@${domain}', 'test123')
+                smtp.sendmail(
+                  'spam@${domain}', 'spam@${domain}', msg.as_string()
+                )
+          '')
+          (pkgs.writers.writePython3Bin "create-mail-dirs" { } ''
+            import imaplib
+            with imaplib.IMAP4_SSL('${domain}') as imap:
+                imap.login('spam@${domain}', 'test123')
+                imap.create("\"INBOX/report_spam\"")
+                imap.create("\"INBOX/report_ham\"")
+                imap.create("\"INBOX/report_spam_reply\"")
+                imap.select("INBOX")
+                imap.copy("1", "\"INBOX/report_ham\"")
+                imap.logout()
+          '')
+          (pkgs.writers.writePython3Bin "test-imap" { } ''
+            import imaplib
+            with imaplib.IMAP4_SSL('${domain}') as imap:
+                imap.login('spam@${domain}', 'test123')
+                imap.select("INBOX/learned_ham")
+                status, refs = imap.search(None, 'ALL')
+                assert status == 'OK'
+                assert len(refs) == 1
+                status, msg = imap.fetch(refs[0], 'BODY[TEXT]')
+                assert status == 'OK'
+                assert msg[0][1].strip() == b"Hello World"
+                imap.logout()
+          '')
+        ];
 
-        # Start rspamd-trainer. It should read mail from INBOX/report_ham
-        machine.wait_for_unit("rspamd.service")
-        machine.wait_for_unit("redis-rspamd.service")
-        machine.wait_for_file("/run/rspamd/rspamd.sock")
-        machine.succeed("systemctl start rspamd-trainer.service")
+      };
 
-        # Check if mail got processed by rspamd-trainer successfully and check for
-        # it in INBOX/learned_ham
-        machine.succeed("test-imap")
-      '';
-  }
-)
+  };
+
+  testScript =
+    { nodes }:
+    ''
+      start_all()
+      machine.wait_for_unit("maddy.service")
+      machine.wait_for_open_port(143)
+      machine.wait_for_open_port(993)
+      machine.wait_for_open_port(587)
+      machine.wait_for_open_port(465)
+
+      # Send test mail to spam@domain
+      machine.succeed("send-testmail")
+
+      # Create mail directories required for rspamd-trainer and copy mail from
+      # INBOX into INBOX/report_ham
+      machine.succeed("create-mail-dirs")
+
+      # Start rspamd-trainer. It should read mail from INBOX/report_ham
+      machine.wait_for_unit("rspamd.service")
+      machine.wait_for_unit("redis-rspamd.service")
+      machine.wait_for_file("/run/rspamd/rspamd.sock")
+      machine.succeed("systemctl start rspamd-trainer.service")
+
+      # Check if mail got processed by rspamd-trainer successfully and check for
+      # it in INBOX/learned_ham
+      machine.succeed("test-imap")
+    '';
+}
diff --git a/nixos/tests/rstudio-server.nix b/nixos/tests/rstudio-server.nix
index 03a173fe32f2..e561bd309d40 100644
--- a/nixos/tests/rstudio-server.nix
+++ b/nixos/tests/rstudio-server.nix
@@ -1,43 +1,41 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "rstudio-server-test";
-    meta.maintainers = with pkgs.lib.maintainers; [
-      jbedo
-      cfhammill
-    ];
+{ pkgs, ... }:
+{
+  name = "rstudio-server-test";
+  meta.maintainers = with pkgs.lib.maintainers; [
+    jbedo
+    cfhammill
+  ];
 
-    nodes.machine =
-      {
-        config,
-        lib,
-        pkgs,
-        ...
-      }:
-      {
-        services.rstudio-server.enable = true;
+  nodes.machine =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      services.rstudio-server.enable = true;
+    };
+
+  nodes.customPackageMachine =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      services.rstudio-server = {
+        enable = true;
+        package = pkgs.rstudioServerWrapper.override { packages = [ pkgs.rPackages.ggplot2 ]; };
       };
+    };
 
-    nodes.customPackageMachine =
-      {
-        config,
-        lib,
-        pkgs,
-        ...
-      }:
-      {
-        services.rstudio-server = {
-          enable = true;
-          package = pkgs.rstudioServerWrapper.override { packages = [ pkgs.rPackages.ggplot2 ]; };
-        };
-      };
+  testScript = ''
+    machine.wait_for_unit("rstudio-server.service")
+    machine.succeed("curl -f -vvv -s http://127.0.0.1:8787")
 
-    testScript = ''
-      machine.wait_for_unit("rstudio-server.service")
-      machine.succeed("curl -f -vvv -s http://127.0.0.1:8787")
-
-      customPackageMachine.wait_for_unit("rstudio-server.service")
-      customPackageMachine.succeed("curl -f -vvv -s http://127.0.0.1:8787")
-    '';
-  }
-)
+    customPackageMachine.wait_for_unit("rstudio-server.service")
+    customPackageMachine.succeed("curl -f -vvv -s http://127.0.0.1:8787")
+  '';
+}
diff --git a/nixos/tests/rsyncd.nix b/nixos/tests/rsyncd.nix
index 9935c0e6c6bf..3ccf22c2132b 100644
--- a/nixos/tests/rsyncd.nix
+++ b/nixos/tests/rsyncd.nix
@@ -1,45 +1,43 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "rsyncd";
-    meta.maintainers = with pkgs.lib.maintainers; [ ehmry ];
+{ pkgs, ... }:
+{
+  name = "rsyncd";
+  meta.maintainers = with pkgs.lib.maintainers; [ ehmry ];
 
-    nodes =
-      let
-        mkNode =
-          socketActivated:
-          { config, ... }:
-          {
-            networking.firewall.allowedTCPPorts = [ config.services.rsyncd.port ];
-            services.rsyncd = {
-              enable = true;
-              inherit socketActivated;
-              settings = {
-                globalSection = {
-                  "reverse lookup" = false;
-                  "forward lookup" = false;
-                };
-                sections = {
-                  tmp = {
-                    path = "/nix/store";
-                    comment = "test module";
-                  };
+  nodes =
+    let
+      mkNode =
+        socketActivated:
+        { config, ... }:
+        {
+          networking.firewall.allowedTCPPorts = [ config.services.rsyncd.port ];
+          services.rsyncd = {
+            enable = true;
+            inherit socketActivated;
+            settings = {
+              globalSection = {
+                "reverse lookup" = false;
+                "forward lookup" = false;
+              };
+              sections = {
+                tmp = {
+                  path = "/nix/store";
+                  comment = "test module";
                 };
               };
             };
           };
-      in
-      {
-        a = mkNode false;
-        b = mkNode true;
-      };
+        };
+    in
+    {
+      a = mkNode false;
+      b = mkNode true;
+    };
 
-    testScript = ''
-      start_all()
-      a.wait_for_unit("rsync")
-      b.wait_for_unit("sockets.target")
-      b.succeed("rsync a::")
-      a.succeed("rsync b::")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    a.wait_for_unit("rsync")
+    b.wait_for_unit("sockets.target")
+    b.succeed("rsync a::")
+    a.succeed("rsync b::")
+  '';
+}
diff --git a/nixos/tests/rtorrent.nix b/nixos/tests/rtorrent.nix
index ca680380374a..b34f1cb5cec6 100644
--- a/nixos/tests/rtorrent.nix
+++ b/nixos/tests/rtorrent.nix
@@ -1,30 +1,28 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    port = 50001;
-  in
-  {
-    name = "rtorrent";
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ thiagokokada ];
+{ pkgs, ... }:
+let
+  port = 50001;
+in
+{
+  name = "rtorrent";
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ thiagokokada ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.rtorrent = {
+        inherit port;
+        enable = true;
+      };
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.rtorrent = {
-          inherit port;
-          enable = true;
-        };
-      };
+  testScript = # python
+    ''
+      machine.start()
+      machine.wait_for_unit("rtorrent.service")
+      machine.wait_for_open_port(${toString port})
 
-    testScript = # python
-      ''
-        machine.start()
-        machine.wait_for_unit("rtorrent.service")
-        machine.wait_for_open_port(${toString port})
-
-        machine.succeed("nc -z localhost ${toString port}")
-      '';
-  }
-)
+      machine.succeed("nc -z localhost ${toString port}")
+    '';
+}
diff --git a/nixos/tests/rustls-libssl.nix b/nixos/tests/rustls-libssl.nix
index 079fa52435bc..165edb76a5d4 100644
--- a/nixos/tests/rustls-libssl.nix
+++ b/nixos/tests/rustls-libssl.nix
@@ -1,92 +1,90 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    caCert = builtins.readFile ./common/acme/server/ca.cert.pem;
-    certPath = ./common/acme/server/acme.test.cert.pem;
-    keyPath = ./common/acme/server/acme.test.key.pem;
-    hosts = ''
-      192.168.2.101 acme.test
-    '';
-  in
-  {
-    name = "rustls-libssl";
-    meta.maintainers = with pkgs.lib.maintainers; [
-      stephank
-      cpu
-    ];
+{ pkgs, lib, ... }:
+let
+  caCert = builtins.readFile ./common/acme/server/ca.cert.pem;
+  certPath = ./common/acme/server/acme.test.cert.pem;
+  keyPath = ./common/acme/server/acme.test.key.pem;
+  hosts = ''
+    192.168.2.101 acme.test
+  '';
+in
+{
+  name = "rustls-libssl";
+  meta.maintainers = with pkgs.lib.maintainers; [
+    stephank
+    cpu
+  ];
 
-    nodes = {
-      server =
-        { lib, pkgs, ... }:
-        {
-          networking = {
-            interfaces.eth1 = {
-              ipv4.addresses = [
-                {
-                  address = "192.168.2.101";
-                  prefixLength = 24;
-                }
-              ];
-            };
-            extraHosts = hosts;
-            firewall.allowedTCPPorts = [ 443 ];
-          };
-
-          security.pki.certificates = [ caCert ];
-
-          services.nginx = {
-            enable = true;
-            package = pkgs.nginxMainline.override {
-              openssl = pkgs.rustls-libssl;
-              modules = [ ]; # slightly reduces the size of the build
-            };
-
-            # Hardcoded sole input accepted by rustls-libssl.
-            sslCiphers = "HIGH:!aNULL:!MD5";
-
-            virtualHosts."acme.test" = {
-              onlySSL = true;
-              sslCertificate = certPath;
-              sslCertificateKey = keyPath;
-              http2 = true;
-              reuseport = true;
-              root = lib.mkForce (
-                pkgs.runCommandLocal "testdir" { } ''
-                  mkdir "$out"
-                  cat > "$out/index.html" <<EOF
-                  <html><body>Hello World!</body></html>
-                  EOF
-                ''
-              );
-            };
+  nodes = {
+    server =
+      { lib, pkgs, ... }:
+      {
+        networking = {
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = "192.168.2.101";
+                prefixLength = 24;
+              }
+            ];
           };
+          extraHosts = hosts;
+          firewall.allowedTCPPorts = [ 443 ];
         };
 
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.curlHTTP3 ];
-          networking = {
-            interfaces.eth1 = {
-              ipv4.addresses = [
-                {
-                  address = "192.168.2.201";
-                  prefixLength = 24;
-                }
-              ];
-            };
-            extraHosts = hosts;
+        security.pki.certificates = [ caCert ];
+
+        services.nginx = {
+          enable = true;
+          package = pkgs.nginxMainline.override {
+            openssl = pkgs.rustls-libssl;
+            modules = [ ]; # slightly reduces the size of the build
           };
 
-          security.pki.certificates = [ caCert ];
-        };
-    };
+          # Hardcoded sole input accepted by rustls-libssl.
+          sslCiphers = "HIGH:!aNULL:!MD5";
 
-    testScript = ''
-      start_all()
-      server.wait_for_open_port(443)
-      client.succeed("curl --verbose --http1.1 https://acme.test | grep 'Hello World!'")
-      client.succeed("curl --verbose --http2-prior-knowledge https://acme.test | grep 'Hello World!'")
-    '';
-  }
-)
+          virtualHosts."acme.test" = {
+            onlySSL = true;
+            sslCertificate = certPath;
+            sslCertificateKey = keyPath;
+            http2 = true;
+            reuseport = true;
+            root = lib.mkForce (
+              pkgs.runCommandLocal "testdir" { } ''
+                mkdir "$out"
+                cat > "$out/index.html" <<EOF
+                <html><body>Hello World!</body></html>
+                EOF
+              ''
+            );
+          };
+        };
+      };
+
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.curlHTTP3 ];
+        networking = {
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = "192.168.2.201";
+                prefixLength = 24;
+              }
+            ];
+          };
+          extraHosts = hosts;
+        };
+
+        security.pki.certificates = [ caCert ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+    server.wait_for_open_port(443)
+    client.succeed("curl --verbose --http1.1 https://acme.test | grep 'Hello World!'")
+    client.succeed("curl --verbose --http2-prior-knowledge https://acme.test | grep 'Hello World!'")
+  '';
+}
diff --git a/nixos/tests/rxe.nix b/nixos/tests/rxe.nix
index f05b5a7dd374..8b2626857d84 100644
--- a/nixos/tests/rxe.nix
+++ b/nixos/tests/rxe.nix
@@ -1,53 +1,51 @@
-import ./make-test-python.nix (
-  { ... }:
+{ ... }:
 
-  let
-    node =
-      { pkgs, ... }:
-      {
-        networking = {
-          firewall = {
-            allowedUDPPorts = [ 4791 ]; # open RoCE port
-            allowedTCPPorts = [ 4800 ]; # port for test utils
-          };
-          rxe = {
-            enable = true;
-            interfaces = [ "eth1" ];
-          };
+let
+  node =
+    { pkgs, ... }:
+    {
+      networking = {
+        firewall = {
+          allowedUDPPorts = [ 4791 ]; # open RoCE port
+          allowedTCPPorts = [ 4800 ]; # port for test utils
+        };
+        rxe = {
+          enable = true;
+          interfaces = [ "eth1" ];
         };
-
-        environment.systemPackages = with pkgs; [
-          rdma-core
-          screen
-        ];
       };
 
-  in
-  {
-    name = "rxe";
-
-    nodes = {
-      server = node;
-      client = node;
+      environment.systemPackages = with pkgs; [
+        rdma-core
+        screen
+      ];
     };
 
-    testScript = ''
-      # Test if rxe interface comes up
-      server.wait_for_unit("default.target")
-      server.succeed("systemctl status rxe.service")
-      server.succeed("ibv_devices | grep rxe_eth1")
+in
+{
+  name = "rxe";
 
-      client.wait_for_unit("default.target")
+  nodes = {
+    server = node;
+    client = node;
+  };
 
-      # ping pong tests
-      for proto in "rc", "uc", "ud", "srq":
-          server.succeed(
-              "screen -dmS {0}_pingpong ibv_{0}_pingpong -p 4800 -s 1024 -g0".format(proto)
-          )
-          client.succeed("sleep 2; ibv_{}_pingpong -p 4800 -s 1024 -g0 server".format(proto))
+  testScript = ''
+    # Test if rxe interface comes up
+    server.wait_for_unit("default.target")
+    server.succeed("systemctl status rxe.service")
+    server.succeed("ibv_devices | grep rxe_eth1")
 
-      server.succeed("screen -dmS rping rping -s -a server -C 10")
-      client.succeed("sleep 2; rping -c -a server -C 10")
-    '';
-  }
-)
+    client.wait_for_unit("default.target")
+
+    # ping pong tests
+    for proto in "rc", "uc", "ud", "srq":
+        server.succeed(
+            "screen -dmS {0}_pingpong ibv_{0}_pingpong -p 4800 -s 1024 -g0".format(proto)
+        )
+        client.succeed("sleep 2; ibv_{}_pingpong -p 4800 -s 1024 -g0 server".format(proto))
+
+    server.succeed("screen -dmS rping rping -s -a server -C 10")
+    client.succeed("sleep 2; rping -c -a server -C 10")
+  '';
+}
diff --git a/nixos/tests/sabnzbd.nix b/nixos/tests/sabnzbd.nix
index 5aa466267a5d..92d574d717b2 100644
--- a/nixos/tests/sabnzbd.nix
+++ b/nixos/tests/sabnzbd.nix
@@ -1,30 +1,28 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "sabnzbd";
-    meta = with pkgs.lib; {
-      maintainers = with maintainers; [ jojosch ];
-    };
+{ lib, ... }:
+{
+  name = "sabnzbd";
+  meta.maintainers = with lib.maintainers; [ jojosch ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.sabnzbd = {
-          enable = true;
-        };
+  node.pkgsReadOnly = false;
 
-        # unrar is unfree
-        nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "unrar" ];
+  nodes.machine =
+    { lib, ... }:
+    {
+      services.sabnzbd = {
+        enable = true;
       };
 
-    testScript = ''
-      machine.wait_for_unit("sabnzbd.service")
-      machine.wait_until_succeeds(
-          "curl --fail -L http://localhost:8080/"
-      )
-      _, out = machine.execute("grep SABCTools /var/lib/sabnzbd/logs/sabnzbd.log")
-      machine.log(out)
-      machine.fail("grep 'SABCTools disabled: no correct version found!' /var/lib/sabnzbd/logs/sabnzbd.log")
-    '';
-  }
-)
+      # unrar is unfree
+      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "unrar" ];
+    };
+
+  testScript = ''
+    machine.wait_for_unit("sabnzbd.service")
+    machine.wait_until_succeeds(
+        "curl --fail -L http://localhost:8080/"
+    )
+    _, out = machine.execute("grep SABCTools /var/lib/sabnzbd/logs/sabnzbd.log")
+    machine.log(out)
+    machine.fail("grep 'SABCTools disabled: no correct version found!' /var/lib/sabnzbd/logs/sabnzbd.log")
+  '';
+}
diff --git a/nixos/tests/samba-wsdd.nix b/nixos/tests/samba-wsdd.nix
index 2efc3058ee96..07ad7d68f664 100644
--- a/nixos/tests/samba-wsdd.nix
+++ b/nixos/tests/samba-wsdd.nix
@@ -1,48 +1,46 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "samba-wsdd";
-    meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
+{
+  name = "samba-wsdd";
+  meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
 
-    nodes = {
-      client_wsdd =
-        { pkgs, ... }:
-        {
-          services.samba-wsdd = {
-            enable = true;
-            openFirewall = true;
-            interface = "eth1";
-            workgroup = "WORKGROUP";
-            hostname = "CLIENT-WSDD";
-            discovery = true;
-            extraOptions = [ "--no-host" ];
-          };
+  nodes = {
+    client_wsdd =
+      { pkgs, ... }:
+      {
+        services.samba-wsdd = {
+          enable = true;
+          openFirewall = true;
+          interface = "eth1";
+          workgroup = "WORKGROUP";
+          hostname = "CLIENT-WSDD";
+          discovery = true;
+          extraOptions = [ "--no-host" ];
         };
+      };
 
-      server_wsdd =
-        { ... }:
-        {
-          services.samba-wsdd = {
-            enable = true;
-            openFirewall = true;
-            interface = "eth1";
-            workgroup = "WORKGROUP";
-            hostname = "SERVER-WSDD";
-          };
+    server_wsdd =
+      { ... }:
+      {
+        services.samba-wsdd = {
+          enable = true;
+          openFirewall = true;
+          interface = "eth1";
+          workgroup = "WORKGROUP";
+          hostname = "SERVER-WSDD";
         };
-    };
+      };
+  };
 
-    testScript = ''
-      client_wsdd.start()
-      client_wsdd.wait_for_unit("samba-wsdd")
+  testScript = ''
+    client_wsdd.start()
+    client_wsdd.wait_for_unit("samba-wsdd")
 
-      server_wsdd.start()
-      server_wsdd.wait_for_unit("samba-wsdd")
+    server_wsdd.start()
+    server_wsdd.wait_for_unit("samba-wsdd")
 
-      client_wsdd.wait_until_succeeds(
-          "echo list | ${pkgs.libressl.nc}/bin/nc -N -U /run/wsdd/wsdd.sock | grep -i SERVER-WSDD"
-      )
-    '';
-  }
-)
+    client_wsdd.wait_until_succeeds(
+        "echo list | ${pkgs.libressl.nc}/bin/nc -N -U /run/wsdd/wsdd.sock | grep -i SERVER-WSDD"
+    )
+  '';
+}
diff --git a/nixos/tests/sane.nix b/nixos/tests/sane.nix
index 117831e5c7ab..6b112898de0c 100644
--- a/nixos/tests/sane.nix
+++ b/nixos/tests/sane.nix
@@ -1,94 +1,92 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  /*
-    SANE NixOS test
-    ===============
-    SANE is intrisically tied to hardware, so testing it is not straightforward.
-    However:
-    - a fake webcam can be created with v4l2loopback
-    - sane has a backend (v4l) to use a webcam as a scanner
-    This test creates a webcam /dev/video0, streams a still image with some text
-    through this webcam, uses SANE to scan from the webcam, and uses OCR to check
-    that the expected text was scanned.
-  */
-  let
-    text = "66263666188646651519653683416";
-    fontsConf = pkgs.makeFontsConf {
-      fontDirectories = [
-        pkgs.dejavu_fonts.minimal
-      ];
-    };
-    # an image with black on white text spelling "${text}"
-    # for some reason, the test fails if it's jpg instead of png
-    # the font is quite large to make OCR easier
-    image =
-      pkgs.runCommand "image.png"
-        {
-          # only imagemagickBig can render text
-          nativeBuildInputs = [ pkgs.imagemagickBig ];
-          FONTCONFIG_FILE = fontsConf;
-        }
-        ''
-          magick -pointsize 100 label:${text} $out
-        '';
-  in
-  {
-    name = "sane";
-    nodes.machine =
-      { pkgs, config, ... }:
+{ pkgs, ... }:
+/*
+  SANE NixOS test
+  ===============
+  SANE is intrisically tied to hardware, so testing it is not straightforward.
+  However:
+  - a fake webcam can be created with v4l2loopback
+  - sane has a backend (v4l) to use a webcam as a scanner
+  This test creates a webcam /dev/video0, streams a still image with some text
+  through this webcam, uses SANE to scan from the webcam, and uses OCR to check
+  that the expected text was scanned.
+*/
+let
+  text = "66263666188646651519653683416";
+  fontsConf = pkgs.makeFontsConf {
+    fontDirectories = [
+      pkgs.dejavu_fonts.minimal
+    ];
+  };
+  # an image with black on white text spelling "${text}"
+  # for some reason, the test fails if it's jpg instead of png
+  # the font is quite large to make OCR easier
+  image =
+    pkgs.runCommand "image.png"
       {
-        boot = {
-          # create /dev/video0 as a fake webcam whose content is filled by ffmpeg
-          extraModprobeConfig = ''
-            options v4l2loopback devices=1 max_buffers=2 exclusive_caps=1 card_label=VirtualCam
-          '';
-          kernelModules = [ "v4l2loopback" ];
-          extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
-        };
-        systemd.services.fake-webcam = {
-          wantedBy = [ "multi-user.target" ];
-          description = "fill /dev/video0 with ${image}";
-          /*
-            HACK: /dev/video0 is a v4l2 only device, it misses one single v4l1
-            ioctl, VIDIOCSPICT. But sane only supports v4l1, so it will log that this
-            ioctl failed, and assume that the pixel format is Y8 (gray). So we tell
-            ffmpeg to produce this pixel format.
-          */
-          serviceConfig.ExecStart = [
-            "${pkgs.ffmpeg}/bin/ffmpeg -framerate 30 -re -stream_loop -1 -i ${image} -f v4l2 -pix_fmt gray /dev/video0"
-          ];
-        };
-        hardware.sane.enable = true;
-        system.extraDependencies = [ image ];
-        environment.systemPackages = [
-          pkgs.fswebcam
-          pkgs.tesseract
-          pkgs.v4l-utils
-        ];
-        environment.variables.SANE_DEBUG_V4L = "128";
+        # only imagemagickBig can render text
+        nativeBuildInputs = [ pkgs.imagemagickBig ];
+        FONTCONFIG_FILE = fontsConf;
+      }
+      ''
+        magick -pointsize 100 label:${text} $out
+      '';
+in
+{
+  name = "sane";
+  nodes.machine =
+    { pkgs, config, ... }:
+    {
+      boot = {
+        # create /dev/video0 as a fake webcam whose content is filled by ffmpeg
+        extraModprobeConfig = ''
+          options v4l2loopback devices=1 max_buffers=2 exclusive_caps=1 card_label=VirtualCam
+        '';
+        kernelModules = [ "v4l2loopback" ];
+        extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
       };
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("fake-webcam.service")
+      systemd.services.fake-webcam = {
+        wantedBy = [ "multi-user.target" ];
+        description = "fill /dev/video0 with ${image}";
+        /*
+          HACK: /dev/video0 is a v4l2 only device, it misses one single v4l1
+          ioctl, VIDIOCSPICT. But sane only supports v4l1, so it will log that this
+          ioctl failed, and assume that the pixel format is Y8 (gray). So we tell
+          ffmpeg to produce this pixel format.
+        */
+        serviceConfig.ExecStart = [
+          "${pkgs.ffmpeg}/bin/ffmpeg -framerate 30 -re -stream_loop -1 -i ${image} -f v4l2 -pix_fmt gray /dev/video0"
+        ];
+      };
+      hardware.sane.enable = true;
+      system.extraDependencies = [ image ];
+      environment.systemPackages = [
+        pkgs.fswebcam
+        pkgs.tesseract
+        pkgs.v4l-utils
+      ];
+      environment.variables.SANE_DEBUG_V4L = "128";
+    };
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("fake-webcam.service")
 
-      # the device only appears when ffmpeg starts producing frames
-      machine.wait_until_succeeds("scanimage -L | grep /dev/video0")
+    # the device only appears when ffmpeg starts producing frames
+    machine.wait_until_succeeds("scanimage -L | grep /dev/video0")
 
-      machine.succeed("scanimage -L >&2")
+    machine.succeed("scanimage -L >&2")
 
-      with subtest("debugging: /dev/video0 works"):
-        machine.succeed("v4l2-ctl --all >&2")
-        machine.succeed("fswebcam --no-banner /tmp/webcam.jpg")
-        machine.copy_from_vm("/tmp/webcam.jpg", "webcam")
+    with subtest("debugging: /dev/video0 works"):
+      machine.succeed("v4l2-ctl --all >&2")
+      machine.succeed("fswebcam --no-banner /tmp/webcam.jpg")
+      machine.copy_from_vm("/tmp/webcam.jpg", "webcam")
 
-      # scan with the webcam
-      machine.succeed("scanimage -o /tmp/scan.png >&2")
-      machine.copy_from_vm("/tmp/scan.png", "scan")
+    # scan with the webcam
+    machine.succeed("scanimage -o /tmp/scan.png >&2")
+    machine.copy_from_vm("/tmp/scan.png", "scan")
 
-      # the image should contain "${text}"
-      output = machine.succeed("tesseract /tmp/scan.png -")
-      print(output)
-      assert "${text}" in output, f"expected text ${text} was not found, OCR found {output!r}"
-    '';
-  }
-)
+    # the image should contain "${text}"
+    output = machine.succeed("tesseract /tmp/scan.png -")
+    print(output)
+    assert "${text}" in output, f"expected text ${text} was not found, OCR found {output!r}"
+  '';
+}
diff --git a/nixos/tests/sanoid.nix b/nixos/tests/sanoid.nix
index 227a95e9471d..e42fd54dfd82 100644
--- a/nixos/tests/sanoid.nix
+++ b/nixos/tests/sanoid.nix
@@ -1,148 +1,146 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    inherit (import ./ssh-keys.nix pkgs)
-      snakeOilPrivateKey
-      snakeOilPublicKey
-      ;
+{ pkgs, ... }:
+let
+  inherit (import ./ssh-keys.nix pkgs)
+    snakeOilPrivateKey
+    snakeOilPublicKey
+    ;
 
-    commonConfig =
-      { pkgs, ... }:
+  commonConfig =
+    { pkgs, ... }:
+    {
+      virtualisation.emptyDiskImages = [ 2048 ];
+      boot.supportedFilesystems = [ "zfs" ];
+      environment.systemPackages = [ pkgs.parted ];
+    };
+in
+{
+  name = "sanoid";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ lopsided98 ];
+  };
+
+  nodes = {
+    source =
+      { ... }:
       {
-        virtualisation.emptyDiskImages = [ 2048 ];
-        boot.supportedFilesystems = [ "zfs" ];
-        environment.systemPackages = [ pkgs.parted ];
+        imports = [ commonConfig ];
+        networking.hostId = "daa82e91";
+
+        programs.ssh.extraConfig = ''
+          UserKnownHostsFile=/dev/null
+          StrictHostKeyChecking=no
+        '';
+
+        services.sanoid = {
+          enable = true;
+          templates.test = {
+            hourly = 12;
+            daily = 1;
+            monthly = 1;
+            yearly = 1;
+
+            autosnap = true;
+          };
+          datasets."pool/sanoid".use_template = [ "test" ];
+          datasets."pool/compat".useTemplate = [ "test" ];
+          extraArgs = [ "--verbose" ];
+        };
+
+        services.syncoid = {
+          enable = true;
+          sshKey = "/var/lib/syncoid/id_ecdsa";
+          commands = {
+            # Sync snapshot taken by sanoid
+            "pool/sanoid" = {
+              target = "root@target:pool/sanoid";
+              extraArgs = [
+                "--no-sync-snap"
+                "--create-bookmark"
+              ];
+            };
+            # Take snapshot and sync
+            "pool/syncoid".target = "root@target:pool/syncoid";
+
+            # Test pool without parent (regression test for https://github.com/NixOS/nixpkgs/pull/180111)
+            "pool".target = "root@target:pool/full-pool";
+
+            # Test backward compatible options (regression test for https://github.com/NixOS/nixpkgs/issues/181561)
+            "pool/compat" = {
+              target = "root@target:pool/compat";
+              extraArgs = [ "--no-sync-snap" ];
+            };
+          };
+        };
       };
-  in
-  {
-    name = "sanoid";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ lopsided98 ];
-    };
+    target =
+      { ... }:
+      {
+        imports = [ commonConfig ];
+        networking.hostId = "dcf39d36";
 
-    nodes = {
-      source =
-        { ... }:
-        {
-          imports = [ commonConfig ];
-          networking.hostId = "daa82e91";
+        services.openssh.enable = true;
+        users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+      };
+  };
 
-          programs.ssh.extraConfig = ''
-            UserKnownHostsFile=/dev/null
-            StrictHostKeyChecking=no
-          '';
+  testScript = ''
+    source.succeed(
+        "mkdir /mnt",
+        "parted --script /dev/vdb -- mklabel msdos mkpart primary 1024M -1s",
+        "udevadm settle",
+        "zpool create pool -R /mnt /dev/vdb1",
+        "zfs create pool/sanoid",
+        "zfs create pool/compat",
+        "zfs create pool/syncoid",
+        "udevadm settle",
+    )
+    target.succeed(
+        "mkdir /mnt",
+        "parted --script /dev/vdb -- mklabel msdos mkpart primary 1024M -1s",
+        "udevadm settle",
+        "zpool create pool -R /mnt /dev/vdb1",
+        "udevadm settle",
+    )
 
-          services.sanoid = {
-            enable = true;
-            templates.test = {
-              hourly = 12;
-              daily = 1;
-              monthly = 1;
-              yearly = 1;
+    source.succeed(
+        "mkdir -m 700 -p /var/lib/syncoid",
+        "cat '${snakeOilPrivateKey}' > /var/lib/syncoid/id_ecdsa",
+        "chmod 600 /var/lib/syncoid/id_ecdsa",
+        "chown -R syncoid:syncoid /var/lib/syncoid/",
+    )
 
-              autosnap = true;
-            };
-            datasets."pool/sanoid".use_template = [ "test" ];
-            datasets."pool/compat".useTemplate = [ "test" ];
-            extraArgs = [ "--verbose" ];
-          };
+    assert len(source.succeed("zfs allow pool")) == 0, "Pool shouldn't have delegated permissions set before snapshotting"
+    assert len(source.succeed("zfs allow pool/sanoid")) == 0, "Sanoid dataset shouldn't have delegated permissions set before snapshotting"
+    assert len(source.succeed("zfs allow pool/syncoid")) == 0, "Syncoid dataset shouldn't have delegated permissions set before snapshotting"
 
-          services.syncoid = {
-            enable = true;
-            sshKey = "/var/lib/syncoid/id_ecdsa";
-            commands = {
-              # Sync snapshot taken by sanoid
-              "pool/sanoid" = {
-                target = "root@target:pool/sanoid";
-                extraArgs = [
-                  "--no-sync-snap"
-                  "--create-bookmark"
-                ];
-              };
-              # Take snapshot and sync
-              "pool/syncoid".target = "root@target:pool/syncoid";
+    # Take snapshot with sanoid
+    source.succeed("touch /mnt/pool/sanoid/test.txt")
+    source.succeed("touch /mnt/pool/compat/test.txt")
+    source.systemctl("start --wait sanoid.service")
 
-              # Test pool without parent (regression test for https://github.com/NixOS/nixpkgs/pull/180111)
-              "pool".target = "root@target:pool/full-pool";
+    assert len(source.succeed("zfs allow pool")) == 0, "Pool shouldn't have delegated permissions set after snapshotting"
+    assert len(source.succeed("zfs allow pool/sanoid")) == 0, "Sanoid dataset shouldn't have delegated permissions set after snapshotting"
+    assert len(source.succeed("zfs allow pool/syncoid")) == 0, "Syncoid dataset shouldn't have delegated permissions set after snapshotting"
 
-              # Test backward compatible options (regression test for https://github.com/NixOS/nixpkgs/issues/181561)
-              "pool/compat" = {
-                target = "root@target:pool/compat";
-                extraArgs = [ "--no-sync-snap" ];
-              };
-            };
-          };
-        };
-      target =
-        { ... }:
-        {
-          imports = [ commonConfig ];
-          networking.hostId = "dcf39d36";
+    # Sync snapshots
+    target.wait_for_open_port(22)
+    source.succeed("touch /mnt/pool/syncoid/test.txt")
+    source.systemctl("start --wait syncoid-pool-sanoid.service")
+    target.succeed("cat /mnt/pool/sanoid/test.txt")
+    source.systemctl("start --wait syncoid-pool-syncoid.service")
+    source.systemctl("start --wait syncoid-pool-syncoid.service")
+    target.succeed("cat /mnt/pool/syncoid/test.txt")
 
-          services.openssh.enable = true;
-          users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
-        };
-    };
+    assert(len(source.succeed("zfs list -H -t snapshot pool/syncoid").splitlines()) == 1), "Syncoid should only retain one sync snapshot"
 
-    testScript = ''
-      source.succeed(
-          "mkdir /mnt",
-          "parted --script /dev/vdb -- mklabel msdos mkpart primary 1024M -1s",
-          "udevadm settle",
-          "zpool create pool -R /mnt /dev/vdb1",
-          "zfs create pool/sanoid",
-          "zfs create pool/compat",
-          "zfs create pool/syncoid",
-          "udevadm settle",
-      )
-      target.succeed(
-          "mkdir /mnt",
-          "parted --script /dev/vdb -- mklabel msdos mkpart primary 1024M -1s",
-          "udevadm settle",
-          "zpool create pool -R /mnt /dev/vdb1",
-          "udevadm settle",
-      )
+    source.systemctl("start --wait syncoid-pool.service")
+    target.succeed("[[ -d /mnt/pool/full-pool/syncoid ]]")
 
-      source.succeed(
-          "mkdir -m 700 -p /var/lib/syncoid",
-          "cat '${snakeOilPrivateKey}' > /var/lib/syncoid/id_ecdsa",
-          "chmod 600 /var/lib/syncoid/id_ecdsa",
-          "chown -R syncoid:syncoid /var/lib/syncoid/",
-      )
+    source.systemctl("start --wait syncoid-pool-compat.service")
+    target.succeed("cat /mnt/pool/compat/test.txt")
 
-      assert len(source.succeed("zfs allow pool")) == 0, "Pool shouldn't have delegated permissions set before snapshotting"
-      assert len(source.succeed("zfs allow pool/sanoid")) == 0, "Sanoid dataset shouldn't have delegated permissions set before snapshotting"
-      assert len(source.succeed("zfs allow pool/syncoid")) == 0, "Syncoid dataset shouldn't have delegated permissions set before snapshotting"
-
-      # Take snapshot with sanoid
-      source.succeed("touch /mnt/pool/sanoid/test.txt")
-      source.succeed("touch /mnt/pool/compat/test.txt")
-      source.systemctl("start --wait sanoid.service")
-
-      assert len(source.succeed("zfs allow pool")) == 0, "Pool shouldn't have delegated permissions set after snapshotting"
-      assert len(source.succeed("zfs allow pool/sanoid")) == 0, "Sanoid dataset shouldn't have delegated permissions set after snapshotting"
-      assert len(source.succeed("zfs allow pool/syncoid")) == 0, "Syncoid dataset shouldn't have delegated permissions set after snapshotting"
-
-      # Sync snapshots
-      target.wait_for_open_port(22)
-      source.succeed("touch /mnt/pool/syncoid/test.txt")
-      source.systemctl("start --wait syncoid-pool-sanoid.service")
-      target.succeed("cat /mnt/pool/sanoid/test.txt")
-      source.systemctl("start --wait syncoid-pool-syncoid.service")
-      source.systemctl("start --wait syncoid-pool-syncoid.service")
-      target.succeed("cat /mnt/pool/syncoid/test.txt")
-
-      assert(len(source.succeed("zfs list -H -t snapshot pool/syncoid").splitlines()) == 1), "Syncoid should only retain one sync snapshot"
-
-      source.systemctl("start --wait syncoid-pool.service")
-      target.succeed("[[ -d /mnt/pool/full-pool/syncoid ]]")
-
-      source.systemctl("start --wait syncoid-pool-compat.service")
-      target.succeed("cat /mnt/pool/compat/test.txt")
-
-      assert len(source.succeed("zfs allow pool")) == 0, "Pool shouldn't have delegated permissions set after syncing snapshots"
-      assert len(source.succeed("zfs allow pool/sanoid")) == 0, "Sanoid dataset shouldn't have delegated permissions set after syncing snapshots"
-      assert len(source.succeed("zfs allow pool/syncoid")) == 0, "Syncoid dataset shouldn't have delegated permissions set after syncing snapshots"
-    '';
-  }
-)
+    assert len(source.succeed("zfs allow pool")) == 0, "Pool shouldn't have delegated permissions set after syncing snapshots"
+    assert len(source.succeed("zfs allow pool/sanoid")) == 0, "Sanoid dataset shouldn't have delegated permissions set after syncing snapshots"
+    assert len(source.succeed("zfs allow pool/syncoid")) == 0, "Syncoid dataset shouldn't have delegated permissions set after syncing snapshots"
+  '';
+}
diff --git a/nixos/tests/saunafs.nix b/nixos/tests/saunafs.nix
index 49d986175716..cc0c9e941372 100644
--- a/nixos/tests/saunafs.nix
+++ b/nixos/tests/saunafs.nix
@@ -1,122 +1,120 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    master =
-      { pkgs, ... }:
-      {
-        # data base is stored in memory
-        # server may crash with default memory size
-        virtualisation.memorySize = 1024;
+let
+  master =
+    { pkgs, ... }:
+    {
+      # data base is stored in memory
+      # server may crash with default memory size
+      virtualisation.memorySize = 1024;
 
-        services.saunafs.master = {
-          enable = true;
-          openFirewall = true;
-          exports = [
-            "* / rw,alldirs,maproot=0:0"
-          ];
-        };
-      };
-
-    chunkserver =
-      { pkgs, ... }:
-      {
-        virtualisation.emptyDiskImages = [ 4096 ];
-        boot.initrd.postDeviceCommands = ''
-          ${pkgs.e2fsprogs}/bin/mkfs.ext4 -L data /dev/vdb
-        '';
-
-        fileSystems = pkgs.lib.mkVMOverride {
-          "/data" = {
-            device = "/dev/disk/by-label/data";
-            fsType = "ext4";
-          };
-        };
-
-        services.saunafs = {
-          masterHost = "master";
-          chunkserver = {
-            openFirewall = true;
-            enable = true;
-            hdds = [ "/data" ];
-
-            # The test image is too small and gets set to "full"
-            settings.HDD_LEAVE_SPACE_DEFAULT = "100M";
-          };
-        };
-      };
-
-    metalogger =
-      { pkgs, ... }:
-      {
-        services.saunafs = {
-          masterHost = "master";
-          metalogger.enable = true;
-        };
-      };
-
-    client =
-      { pkgs, lib, ... }:
-      {
-        services.saunafs.client.enable = true;
-        # systemd.tmpfiles.rules = [ "d /sfs 755 root root -" ];
-        systemd.network.enable = true;
-
-        # Use networkd to have properly functioning
-        # network-online.target
-        networking = {
-          useDHCP = false;
-          useNetworkd = true;
-        };
-
-        systemd.mounts = [
-          {
-            requires = [ "network-online.target" ];
-            after = [ "network-online.target" ];
-            wantedBy = [ "remote-fs.target" ];
-            type = "saunafs";
-            what = "master:/";
-            where = "/sfs";
-          }
+      services.saunafs.master = {
+        enable = true;
+        openFirewall = true;
+        exports = [
+          "* / rw,alldirs,maproot=0:0"
         ];
       };
-
-  in
-  {
-    name = "saunafs";
-
-    meta.maintainers = [ lib.maintainers.markuskowa ];
-
-    nodes = {
-      inherit master metalogger;
-      chunkserver1 = chunkserver;
-      chunkserver2 = chunkserver;
-      client1 = client;
-      client2 = client;
     };
 
-    testScript = ''
-      # prepare master server
-      master.start()
-      master.wait_for_unit("multi-user.target")
-      master.succeed("sfsmaster-init")
-      master.succeed("systemctl restart sfs-master")
-      master.wait_for_unit("sfs-master.service")
+  chunkserver =
+    { pkgs, ... }:
+    {
+      virtualisation.emptyDiskImages = [ 4096 ];
+      boot.initrd.postDeviceCommands = ''
+        ${pkgs.e2fsprogs}/bin/mkfs.ext4 -L data /dev/vdb
+      '';
 
-      metalogger.wait_for_unit("sfs-metalogger.service")
+      fileSystems = pkgs.lib.mkVMOverride {
+        "/data" = {
+          device = "/dev/disk/by-label/data";
+          fsType = "ext4";
+        };
+      };
 
-      # Setup chunkservers
-      for chunkserver in [chunkserver1, chunkserver2]:
-          chunkserver.wait_for_unit("multi-user.target")
-          chunkserver.succeed("chown saunafs:saunafs /data")
-          chunkserver.succeed("systemctl restart sfs-chunkserver")
-          chunkserver.wait_for_unit("sfs-chunkserver.service")
+      services.saunafs = {
+        masterHost = "master";
+        chunkserver = {
+          openFirewall = true;
+          enable = true;
+          hdds = [ "/data" ];
 
-      for client in [client1, client2]:
-          client.wait_for_unit("multi-user.target")
+          # The test image is too small and gets set to "full"
+          settings.HDD_LEAVE_SPACE_DEFAULT = "100M";
+        };
+      };
+    };
 
-      client1.succeed("echo test > /sfs/file")
-      client2.succeed("grep test /sfs/file")
-    '';
-  }
-)
+  metalogger =
+    { pkgs, ... }:
+    {
+      services.saunafs = {
+        masterHost = "master";
+        metalogger.enable = true;
+      };
+    };
+
+  client =
+    { pkgs, lib, ... }:
+    {
+      services.saunafs.client.enable = true;
+      # systemd.tmpfiles.rules = [ "d /sfs 755 root root -" ];
+      systemd.network.enable = true;
+
+      # Use networkd to have properly functioning
+      # network-online.target
+      networking = {
+        useDHCP = false;
+        useNetworkd = true;
+      };
+
+      systemd.mounts = [
+        {
+          requires = [ "network-online.target" ];
+          after = [ "network-online.target" ];
+          wantedBy = [ "remote-fs.target" ];
+          type = "saunafs";
+          what = "master:/";
+          where = "/sfs";
+        }
+      ];
+    };
+
+in
+{
+  name = "saunafs";
+
+  meta.maintainers = [ lib.maintainers.markuskowa ];
+
+  nodes = {
+    inherit master metalogger;
+    chunkserver1 = chunkserver;
+    chunkserver2 = chunkserver;
+    client1 = client;
+    client2 = client;
+  };
+
+  testScript = ''
+    # prepare master server
+    master.start()
+    master.wait_for_unit("multi-user.target")
+    master.succeed("sfsmaster-init")
+    master.succeed("systemctl restart sfs-master")
+    master.wait_for_unit("sfs-master.service")
+
+    metalogger.wait_for_unit("sfs-metalogger.service")
+
+    # Setup chunkservers
+    for chunkserver in [chunkserver1, chunkserver2]:
+        chunkserver.wait_for_unit("multi-user.target")
+        chunkserver.succeed("chown saunafs:saunafs /data")
+        chunkserver.succeed("systemctl restart sfs-chunkserver")
+        chunkserver.wait_for_unit("sfs-chunkserver.service")
+
+    for client in [client1, client2]:
+        client.wait_for_unit("multi-user.target")
+
+    client1.succeed("echo test > /sfs/file")
+    client2.succeed("grep test /sfs/file")
+  '';
+}
diff --git a/nixos/tests/sdl3.nix b/nixos/tests/sdl3.nix
index d07f342fe8b2..33c913321632 100644
--- a/nixos/tests/sdl3.nix
+++ b/nixos/tests/sdl3.nix
@@ -1,28 +1,26 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "sdl3";
-    meta.maintainers = pkgs.sdl3.meta.maintainers;
+{ pkgs, ... }:
+{
+  name = "sdl3";
+  meta.maintainers = pkgs.sdl3.meta.maintainers;
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ./common/x11.nix ];
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/x11.nix ];
 
-        environment.systemPackages = [ pkgs.sdl3.passthru.debug-text-example ];
-      };
+      environment.systemPackages = [ pkgs.sdl3.passthru.debug-text-example ];
+    };
 
-    enableOCR = true;
+  enableOCR = true;
 
-    testScript = ''
-      machine.wait_for_x()
+  testScript = ''
+    machine.wait_for_x()
 
-      machine.execute("debug-text >&2 &")
+    machine.execute("debug-text >&2 &")
 
-      machine.wait_for_window("examples/renderer/debug-text")
-      machine.wait_for_text("Hello world")
+    machine.wait_for_window("examples/renderer/debug-text")
+    machine.wait_for_text("Hello world")
 
-      machine.screenshot("screen")
-    '';
-  }
-)
+    machine.screenshot("screen")
+  '';
+}
diff --git a/nixos/tests/seafile.nix b/nixos/tests/seafile.nix
index 54aa582149d5..85ff857535fe 100644
--- a/nixos/tests/seafile.nix
+++ b/nixos/tests/seafile.nix
@@ -1,131 +1,129 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    client =
-      { config, pkgs, ... }:
-      {
-        environment.systemPackages = [
-          pkgs.seafile-shared
-          pkgs.curl
-        ];
-      };
-  in
-  {
-    name = "seafile";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        kampfschlaefer
-        schmittlauch
+{ pkgs, ... }:
+let
+  client =
+    { config, pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.seafile-shared
+        pkgs.curl
       ];
     };
+in
+{
+  name = "seafile";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      kampfschlaefer
+      schmittlauch
+    ];
+  };
 
-    nodes = {
-      server =
-        { config, pkgs, ... }:
-        {
-          services.seafile = {
-            enable = true;
-            ccnetSettings.General.SERVICE_URL = "http://server";
-            seafileSettings.fileserver.host = "unix:/run/seafile/server.sock";
-            adminEmail = "admin@example.com";
-            initialAdminPassword = "seafile_password";
-          };
-          services.nginx = {
-            enable = true;
-            virtualHosts."server" = {
-              locations."/".proxyPass = "http://unix:/run/seahub/gunicorn.sock";
-              locations."/seafhttp" = {
-                proxyPass = "http://unix:/run/seafile/server.sock";
-                extraConfig = ''
-                  rewrite ^/seafhttp(.*)$ $1 break;
-                  client_max_body_size 0;
-                  proxy_connect_timeout  36000s;
-                  proxy_read_timeout  36000s;
-                  proxy_send_timeout  36000s;
-                  send_timeout  36000s;
-                  proxy_http_version 1.1;
-                '';
-              };
+  nodes = {
+    server =
+      { config, pkgs, ... }:
+      {
+        services.seafile = {
+          enable = true;
+          ccnetSettings.General.SERVICE_URL = "http://server";
+          seafileSettings.fileserver.host = "unix:/run/seafile/server.sock";
+          adminEmail = "admin@example.com";
+          initialAdminPassword = "seafile_password";
+        };
+        services.nginx = {
+          enable = true;
+          virtualHosts."server" = {
+            locations."/".proxyPass = "http://unix:/run/seahub/gunicorn.sock";
+            locations."/seafhttp" = {
+              proxyPass = "http://unix:/run/seafile/server.sock";
+              extraConfig = ''
+                rewrite ^/seafhttp(.*)$ $1 break;
+                client_max_body_size 0;
+                proxy_connect_timeout  36000s;
+                proxy_read_timeout  36000s;
+                proxy_send_timeout  36000s;
+                send_timeout  36000s;
+                proxy_http_version 1.1;
+              '';
             };
           };
-          networking.firewall = {
-            allowedTCPPorts = [ 80 ];
-          };
         };
-      client1 = client pkgs;
-      client2 = client pkgs;
-    };
+        networking.firewall = {
+          allowedTCPPorts = [ 80 ];
+        };
+      };
+    client1 = client pkgs;
+    client2 = client pkgs;
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      with subtest("start seaf-server"):
-          server.wait_for_unit("seaf-server.service")
-          server.wait_for_file("/run/seafile/seafile.sock")
+    with subtest("start seaf-server"):
+        server.wait_for_unit("seaf-server.service")
+        server.wait_for_file("/run/seafile/seafile.sock")
 
-      with subtest("start seahub"):
-          server.wait_for_unit("seahub.service")
-          server.wait_for_unit("nginx.service")
-          server.wait_for_file("/run/seahub/gunicorn.sock")
+    with subtest("start seahub"):
+        server.wait_for_unit("seahub.service")
+        server.wait_for_unit("nginx.service")
+        server.wait_for_file("/run/seahub/gunicorn.sock")
 
-      with subtest("client1 fetch seahub page"):
-          client1.succeed("curl -L http://server | grep 'Log In' >&2")
+    with subtest("client1 fetch seahub page"):
+        client1.succeed("curl -L http://server | grep 'Log In' >&2")
 
-      with subtest("client1 connect"):
-          client1.wait_for_unit("default.target")
-          client1.succeed("seaf-cli init -d . >&2")
-          client1.succeed("seaf-cli start >&2")
-          client1.succeed(
-              "seaf-cli list-remote -s http://server -u admin\@example.com -p seafile_password >&2"
-          )
+    with subtest("client1 connect"):
+        client1.wait_for_unit("default.target")
+        client1.succeed("seaf-cli init -d . >&2")
+        client1.succeed("seaf-cli start >&2")
+        client1.succeed(
+            "seaf-cli list-remote -s http://server -u admin\@example.com -p seafile_password >&2"
+        )
 
-          libid = client1.succeed(
-              'seaf-cli create -s http://server -n test01 -u admin\@example.com -p seafile_password -t "first test library"'
-          ).strip()
+        libid = client1.succeed(
+            'seaf-cli create -s http://server -n test01 -u admin\@example.com -p seafile_password -t "first test library"'
+        ).strip()
 
-          client1.succeed(
-              "seaf-cli list-remote -s http://server -u admin\@example.com -p seafile_password |grep test01"
-          )
-          client1.fail(
-              "seaf-cli list-remote -s http://server -u admin\@example.com -p seafile_password |grep test02"
-          )
+        client1.succeed(
+            "seaf-cli list-remote -s http://server -u admin\@example.com -p seafile_password |grep test01"
+        )
+        client1.fail(
+            "seaf-cli list-remote -s http://server -u admin\@example.com -p seafile_password |grep test02"
+        )
 
-          client1.succeed(
-              f"seaf-cli download -l {libid} -s http://server -u admin\@example.com -p seafile_password -d . >&2"
-          )
+        client1.succeed(
+            f"seaf-cli download -l {libid} -s http://server -u admin\@example.com -p seafile_password -d . >&2"
+        )
 
-          client1.wait_until_succeeds("seaf-cli status |grep synchronized >&2")
+        client1.wait_until_succeeds("seaf-cli status |grep synchronized >&2")
 
-          client1.succeed("ls -la >&2")
-          client1.succeed("ls -la test01 >&2")
+        client1.succeed("ls -la >&2")
+        client1.succeed("ls -la test01 >&2")
 
-          client1.execute("echo bla > test01/first_file")
+        client1.execute("echo bla > test01/first_file")
 
-          client1.wait_until_succeeds("seaf-cli status |grep synchronized >&2")
+        client1.wait_until_succeeds("seaf-cli status |grep synchronized >&2")
 
-      with subtest("client2 sync"):
-          client2.wait_for_unit("default.target")
+    with subtest("client2 sync"):
+        client2.wait_for_unit("default.target")
 
-          client2.succeed("seaf-cli init -d . >&2")
-          client2.succeed("seaf-cli start >&2")
+        client2.succeed("seaf-cli init -d . >&2")
+        client2.succeed("seaf-cli start >&2")
 
-          client2.succeed(
-              "seaf-cli list-remote -s http://server -u admin\@example.com -p seafile_password >&2"
-          )
+        client2.succeed(
+            "seaf-cli list-remote -s http://server -u admin\@example.com -p seafile_password >&2"
+        )
 
-          libid = client2.succeed(
-              "seaf-cli list-remote -s http://server -u admin\@example.com -p seafile_password |grep test01 |cut -d' ' -f 2"
-          ).strip()
+        libid = client2.succeed(
+            "seaf-cli list-remote -s http://server -u admin\@example.com -p seafile_password |grep test01 |cut -d' ' -f 2"
+        ).strip()
 
-          client2.succeed(
-              f"seaf-cli download -l {libid} -s http://server -u admin\@example.com -p seafile_password -d . >&2"
-          )
+        client2.succeed(
+            f"seaf-cli download -l {libid} -s http://server -u admin\@example.com -p seafile_password -d . >&2"
+        )
 
-          client2.wait_until_succeeds("seaf-cli status |grep synchronized >&2")
+        client2.wait_until_succeeds("seaf-cli status |grep synchronized >&2")
 
-          client2.succeed("ls -la test01 >&2")
+        client2.succeed("ls -la test01 >&2")
 
-          client2.succeed('[ `cat test01/first_file` = "bla" ]')
-    '';
-  }
-)
+        client2.succeed('[ `cat test01/first_file` = "bla" ]')
+  '';
+}
diff --git a/nixos/tests/seatd.nix b/nixos/tests/seatd.nix
index 8ba79ca49584..117c1ea4be50 100644
--- a/nixos/tests/seatd.nix
+++ b/nixos/tests/seatd.nix
@@ -1,58 +1,56 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    seatd-test = pkgs.writeShellApplication {
-      name = "seatd-client-pid";
-      text = ''
-        journalctl -u seatd --no-pager -b | while read -r line; do
-            case "$line" in
-            *"New client connected"*)
-                line="''${line##*pid: }"
-                pid="''${line%%,*}"
-                ;;
-            *"Opened client"*)
-                echo "$pid"
-                exit
-            esac
-        done;
-      '';
-    };
-  in
-  {
-    name = "seatd";
-    meta.maintainers = with lib.maintainers; [ sinanmohd ];
-
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ./common/user-account.nix ];
-        services.getty.autologinUser = "alice";
-        users.users.alice.extraGroups = [
-          "seat"
-          "wheel"
-        ];
-
-        fonts.enableDefaultPackages = true;
-        environment.systemPackages = with pkgs; [
-          dwl
-          foot
-          seatd-test
-        ];
-
-        programs.bash.loginShellInit = ''
-          [ "$(tty)" = "/dev/tty1" ] &&
-              dwl -s 'foot touch /tmp/foot_started'
-        '';
-
-        hardware.graphics.enable = true;
-        virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
-        services.seatd.enable = true;
-      };
-
-    testScript = ''
-      machine.wait_for_file("/tmp/foot_started")
-      machine.succeed("test $(seatd-client-pid) = $(pgrep dwl)")
+let
+  seatd-test = pkgs.writeShellApplication {
+    name = "seatd-client-pid";
+    text = ''
+      journalctl -u seatd --no-pager -b | while read -r line; do
+          case "$line" in
+          *"New client connected"*)
+              line="''${line##*pid: }"
+              pid="''${line%%,*}"
+              ;;
+          *"Opened client"*)
+              echo "$pid"
+              exit
+          esac
+      done;
     '';
-  }
-)
+  };
+in
+{
+  name = "seatd";
+  meta.maintainers = with lib.maintainers; [ sinanmohd ];
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ./common/user-account.nix ];
+      services.getty.autologinUser = "alice";
+      users.users.alice.extraGroups = [
+        "seat"
+        "wheel"
+      ];
+
+      fonts.enableDefaultPackages = true;
+      environment.systemPackages = with pkgs; [
+        dwl
+        foot
+        seatd-test
+      ];
+
+      programs.bash.loginShellInit = ''
+        [ "$(tty)" = "/dev/tty1" ] &&
+            dwl -s 'foot touch /tmp/foot_started'
+      '';
+
+      hardware.graphics.enable = true;
+      virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
+      services.seatd.enable = true;
+    };
+
+  testScript = ''
+    machine.wait_for_file("/tmp/foot_started")
+    machine.succeed("test $(seatd-client-pid) = $(pgrep dwl)")
+  '';
+}
diff --git a/nixos/tests/service-runner.nix b/nixos/tests/service-runner.nix
index 42d87c384234..e7a552b9e536 100644
--- a/nixos/tests/service-runner.nix
+++ b/nixos/tests/service-runner.nix
@@ -1,43 +1,41 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "service-runner";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ roberth ];
-    };
+{ pkgs, ... }:
+{
+  name = "service-runner";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ roberth ];
+  };
 
-    nodes = {
-      machine =
-        { pkgs, lib, ... }:
-        {
-          services.nginx.enable = true;
-          services.nginx.virtualHosts.machine.root = pkgs.runCommand "webroot" { } ''
-            mkdir $out
-            echo 'yay' >$out/index.html
-          '';
-          systemd.services.nginx.enable = false;
-        };
+  nodes = {
+    machine =
+      { pkgs, lib, ... }:
+      {
+        services.nginx.enable = true;
+        services.nginx.virtualHosts.machine.root = pkgs.runCommand "webroot" { } ''
+          mkdir $out
+          echo 'yay' >$out/index.html
+        '';
+        systemd.services.nginx.enable = false;
+      };
 
-    };
+  };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        url = "http://localhost/index.html"
+  testScript =
+    { nodes, ... }:
+    ''
+      url = "http://localhost/index.html"
 
-        with subtest("check systemd.services.nginx.runner"):
-            machine.fail(f"curl {url}")
-            machine.succeed(
-                """
-                mkdir -p /run/nginx /var/log/nginx /var/cache/nginx
-                ${nodes.machine.config.systemd.services.nginx.runner} >&2 &
-                echo $!>my-nginx.pid
-                """
-            )
-            machine.wait_for_open_port(80)
-            machine.succeed(f"curl -f {url}")
-            machine.succeed("kill -INT $(cat my-nginx.pid)")
-            machine.wait_for_closed_port(80)
-      '';
-  }
-)
+      with subtest("check systemd.services.nginx.runner"):
+          machine.fail(f"curl {url}")
+          machine.succeed(
+              """
+              mkdir -p /run/nginx /var/log/nginx /var/cache/nginx
+              ${nodes.machine.config.systemd.services.nginx.runner} >&2 &
+              echo $!>my-nginx.pid
+              """
+          )
+          machine.wait_for_open_port(80)
+          machine.succeed(f"curl -f {url}")
+          machine.succeed("kill -INT $(cat my-nginx.pid)")
+          machine.wait_for_closed_port(80)
+    '';
+}
diff --git a/nixos/tests/sfxr-qt.nix b/nixos/tests/sfxr-qt.nix
index d3696a576041..f62eeacafbd5 100644
--- a/nixos/tests/sfxr-qt.nix
+++ b/nixos/tests/sfxr-qt.nix
@@ -1,35 +1,33 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "sfxr-qt";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fgaz ];
+{ pkgs, ... }:
+{
+  name = "sfxr-qt";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
+
+  machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      environment.systemPackages = [ pkgs.sfxr-qt ];
     };
 
-    machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  enableOCR = true;
 
-        services.xserver.enable = true;
-        environment.systemPackages = [ pkgs.sfxr-qt ];
-      };
+  testScript = ''
+    machine.wait_for_x()
+    # Add a dummy sound card, or the program won't start
+    machine.execute("modprobe snd-dummy")
 
-    enableOCR = true;
+    machine.execute("sfxr-qt >&2 &")
 
-    testScript = ''
-      machine.wait_for_x()
-      # Add a dummy sound card, or the program won't start
-      machine.execute("modprobe snd-dummy")
-
-      machine.execute("sfxr-qt >&2 &")
-
-      machine.wait_for_window(r"sfxr")
-      machine.sleep(10)
-      machine.wait_for_text("requency")
-      machine.screenshot("screen")
-    '';
-  }
-)
+    machine.wait_for_window(r"sfxr")
+    machine.sleep(10)
+    machine.wait_for_text("requency")
+    machine.screenshot("screen")
+  '';
+}
diff --git a/nixos/tests/sgt-puzzles.nix b/nixos/tests/sgt-puzzles.nix
index e5a92690854b..6096b0ae78d6 100644
--- a/nixos/tests/sgt-puzzles.nix
+++ b/nixos/tests/sgt-puzzles.nix
@@ -1,38 +1,36 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "sgt-puzzles";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ tomfitzhenry ];
+{ pkgs, ... }:
+{
+  name = "sgt-puzzles";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ tomfitzhenry ];
+  };
+
+  nodes.machine =
+    { ... }:
+
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      environment.systemPackages = with pkgs; [
+        sgt-puzzles
+      ];
     };
 
-    nodes.machine =
-      { ... }:
+  enableOCR = true;
 
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+      machine.wait_for_x()
 
-        services.xserver.enable = true;
-        environment.systemPackages = with pkgs; [
-          sgt-puzzles
-        ];
-      };
+      machine.execute("mines >&2 &")
 
-    enableOCR = true;
-
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
-        machine.wait_for_x()
-
-        machine.execute("mines >&2 &")
-
-        machine.wait_for_window("Mines")
-        machine.wait_for_text("Marked")
-        machine.screenshot("mines")
-      '';
-  }
-)
+      machine.wait_for_window("Mines")
+      machine.wait_for_text("Marked")
+      machine.screenshot("mines")
+    '';
+}
diff --git a/nixos/tests/shadow.nix b/nixos/tests/shadow.nix
index dba18f127639..585abc599a97 100644
--- a/nixos/tests/shadow.nix
+++ b/nixos/tests/shadow.nix
@@ -7,174 +7,172 @@ let
   hashed_yeshash = "$y$j9T$d8Z4EAf8P1SvM/aDFbxMS0$VnTXMp/Hnc7QdCBEaLTq5ZFOAFo2/PM0/xEAFuOE88."; # fnord
   hashed_sha512crypt = "$6$ymzs8WINZ5wGwQcV$VC2S0cQiX8NVukOLymysTPn4v1zJoJp3NGyhnqyv/dAf4NWZsBWYveQcj6gEJr4ZUjRBRjM0Pj1L8TCQ8hUUp0"; # meow
 in
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "shadow";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ nequissimus ];
-    };
+{ pkgs, ... }:
+{
+  name = "shadow";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ nequissimus ];
+  };
 
-    nodes.shadow =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.shadow ];
+  nodes.shadow =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.shadow ];
 
-        users = {
-          mutableUsers = true;
-          users.emma = {
-            isNormalUser = true;
-            password = password1;
-            shell = pkgs.bash;
-          };
-          users.layla = {
-            isNormalUser = true;
-            password = password2;
-            shell = pkgs.shadow;
-          };
-          users.ash = {
-            isNormalUser = true;
-            password = password4;
-            shell = pkgs.bash;
-          };
-          users.berta = {
-            isNormalUser = true;
-            hashedPasswordFile = (pkgs.writeText "hashed_bcrypt" hashed_bcrypt).outPath;
-            shell = pkgs.bash;
-          };
-          users.yesim = {
-            isNormalUser = true;
-            hashedPassword = hashed_yeshash;
-            shell = pkgs.bash;
-          };
-          users.leo = {
-            isNormalUser = true;
-            initialHashedPassword = "!";
-            hashedPassword = hashed_sha512crypt; # should take precedence over initialHashedPassword
-            shell = pkgs.bash;
-          };
+      users = {
+        mutableUsers = true;
+        users.emma = {
+          isNormalUser = true;
+          password = password1;
+          shell = pkgs.bash;
+        };
+        users.layla = {
+          isNormalUser = true;
+          password = password2;
+          shell = pkgs.shadow;
+        };
+        users.ash = {
+          isNormalUser = true;
+          password = password4;
+          shell = pkgs.bash;
+        };
+        users.berta = {
+          isNormalUser = true;
+          hashedPasswordFile = (pkgs.writeText "hashed_bcrypt" hashed_bcrypt).outPath;
+          shell = pkgs.bash;
+        };
+        users.yesim = {
+          isNormalUser = true;
+          hashedPassword = hashed_yeshash;
+          shell = pkgs.bash;
+        };
+        users.leo = {
+          isNormalUser = true;
+          initialHashedPassword = "!";
+          hashedPassword = hashed_sha512crypt; # should take precedence over initialHashedPassword
+          shell = pkgs.bash;
         };
       };
+    };
 
-    testScript = ''
-      shadow.wait_for_unit("multi-user.target")
-      shadow.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+  testScript = ''
+    shadow.wait_for_unit("multi-user.target")
+    shadow.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
 
-      with subtest("Normal login"):
-          shadow.send_key("alt-f2")
-          shadow.wait_until_succeeds("[ $(fgconsole) = 2 ]")
-          shadow.wait_for_unit("getty@tty2.service")
-          shadow.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
-          shadow.wait_until_tty_matches("2", "login: ")
-          shadow.send_chars("emma\n")
-          shadow.wait_until_tty_matches("2", "login: emma")
-          shadow.wait_until_succeeds("pgrep login")
-          shadow.sleep(2)
-          shadow.send_chars("${password1}\n")
-          shadow.send_chars("whoami > /tmp/1\n")
-          shadow.wait_for_file("/tmp/1")
-          assert "emma" in shadow.succeed("cat /tmp/1")
+    with subtest("Normal login"):
+        shadow.send_key("alt-f2")
+        shadow.wait_until_succeeds("[ $(fgconsole) = 2 ]")
+        shadow.wait_for_unit("getty@tty2.service")
+        shadow.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
+        shadow.wait_until_tty_matches("2", "login: ")
+        shadow.send_chars("emma\n")
+        shadow.wait_until_tty_matches("2", "login: emma")
+        shadow.wait_until_succeeds("pgrep login")
+        shadow.sleep(2)
+        shadow.send_chars("${password1}\n")
+        shadow.send_chars("whoami > /tmp/1\n")
+        shadow.wait_for_file("/tmp/1")
+        assert "emma" in shadow.succeed("cat /tmp/1")
 
-      with subtest("Switch user"):
-          shadow.send_chars("su - ash\n")
-          shadow.sleep(2)
-          shadow.send_chars("${password4}\n")
-          shadow.sleep(2)
-          shadow.send_chars("whoami > /tmp/3\n")
-          shadow.wait_for_file("/tmp/3")
-          assert "ash" in shadow.succeed("cat /tmp/3")
+    with subtest("Switch user"):
+        shadow.send_chars("su - ash\n")
+        shadow.sleep(2)
+        shadow.send_chars("${password4}\n")
+        shadow.sleep(2)
+        shadow.send_chars("whoami > /tmp/3\n")
+        shadow.wait_for_file("/tmp/3")
+        assert "ash" in shadow.succeed("cat /tmp/3")
 
-      with subtest("Change password"):
-          shadow.send_key("alt-f3")
-          shadow.wait_until_succeeds("[ $(fgconsole) = 3 ]")
-          shadow.wait_for_unit("getty@tty3.service")
-          shadow.wait_until_succeeds("pgrep -f 'agetty.*tty3'")
-          shadow.wait_until_tty_matches("3", "login: ")
-          shadow.send_chars("emma\n")
-          shadow.wait_until_tty_matches("3", "login: emma")
-          shadow.wait_until_succeeds("pgrep login")
-          shadow.sleep(2)
-          shadow.send_chars("${password1}\n")
-          shadow.send_chars("passwd\n")
-          shadow.sleep(2)
-          shadow.send_chars("${password1}\n")
-          shadow.sleep(2)
-          shadow.send_chars("${password3}\n")
-          shadow.sleep(2)
-          shadow.send_chars("${password3}\n")
-          shadow.sleep(2)
-          shadow.send_key("alt-f4")
-          shadow.wait_until_succeeds("[ $(fgconsole) = 4 ]")
-          shadow.wait_for_unit("getty@tty4.service")
-          shadow.wait_until_succeeds("pgrep -f 'agetty.*tty4'")
-          shadow.wait_until_tty_matches("4", "login: ")
-          shadow.send_chars("emma\n")
-          shadow.wait_until_tty_matches("4", "login: emma")
-          shadow.wait_until_succeeds("pgrep login")
-          shadow.sleep(2)
-          shadow.send_chars("${password1}\n")
-          shadow.wait_until_tty_matches("4", "Login incorrect")
-          shadow.wait_until_tty_matches("4", "login:")
-          shadow.send_chars("emma\n")
-          shadow.wait_until_tty_matches("4", "login: emma")
-          shadow.wait_until_succeeds("pgrep login")
-          shadow.sleep(2)
-          shadow.send_chars("${password3}\n")
-          shadow.send_chars("whoami > /tmp/2\n")
-          shadow.wait_for_file("/tmp/2")
-          assert "emma" in shadow.succeed("cat /tmp/2")
+    with subtest("Change password"):
+        shadow.send_key("alt-f3")
+        shadow.wait_until_succeeds("[ $(fgconsole) = 3 ]")
+        shadow.wait_for_unit("getty@tty3.service")
+        shadow.wait_until_succeeds("pgrep -f 'agetty.*tty3'")
+        shadow.wait_until_tty_matches("3", "login: ")
+        shadow.send_chars("emma\n")
+        shadow.wait_until_tty_matches("3", "login: emma")
+        shadow.wait_until_succeeds("pgrep login")
+        shadow.sleep(2)
+        shadow.send_chars("${password1}\n")
+        shadow.send_chars("passwd\n")
+        shadow.sleep(2)
+        shadow.send_chars("${password1}\n")
+        shadow.sleep(2)
+        shadow.send_chars("${password3}\n")
+        shadow.sleep(2)
+        shadow.send_chars("${password3}\n")
+        shadow.sleep(2)
+        shadow.send_key("alt-f4")
+        shadow.wait_until_succeeds("[ $(fgconsole) = 4 ]")
+        shadow.wait_for_unit("getty@tty4.service")
+        shadow.wait_until_succeeds("pgrep -f 'agetty.*tty4'")
+        shadow.wait_until_tty_matches("4", "login: ")
+        shadow.send_chars("emma\n")
+        shadow.wait_until_tty_matches("4", "login: emma")
+        shadow.wait_until_succeeds("pgrep login")
+        shadow.sleep(2)
+        shadow.send_chars("${password1}\n")
+        shadow.wait_until_tty_matches("4", "Login incorrect")
+        shadow.wait_until_tty_matches("4", "login:")
+        shadow.send_chars("emma\n")
+        shadow.wait_until_tty_matches("4", "login: emma")
+        shadow.wait_until_succeeds("pgrep login")
+        shadow.sleep(2)
+        shadow.send_chars("${password3}\n")
+        shadow.send_chars("whoami > /tmp/2\n")
+        shadow.wait_for_file("/tmp/2")
+        assert "emma" in shadow.succeed("cat /tmp/2")
 
-      with subtest("Groups"):
-          assert "foobar" not in shadow.succeed("groups emma")
-          shadow.succeed("groupadd foobar")
-          shadow.succeed("usermod -a -G foobar emma")
-          assert "foobar" in shadow.succeed("groups emma")
+    with subtest("Groups"):
+        assert "foobar" not in shadow.succeed("groups emma")
+        shadow.succeed("groupadd foobar")
+        shadow.succeed("usermod -a -G foobar emma")
+        assert "foobar" in shadow.succeed("groups emma")
 
-      with subtest("nologin shell"):
-          shadow.send_key("alt-f5")
-          shadow.wait_until_succeeds("[ $(fgconsole) = 5 ]")
-          shadow.wait_for_unit("getty@tty5.service")
-          shadow.wait_until_succeeds("pgrep -f 'agetty.*tty5'")
-          shadow.wait_until_tty_matches("5", "login: ")
-          shadow.send_chars("layla\n")
-          shadow.wait_until_tty_matches("5", "login: layla")
-          shadow.wait_until_succeeds("pgrep login")
-          shadow.send_chars("${password2}\n")
-          shadow.wait_until_tty_matches("5", "login:")
+    with subtest("nologin shell"):
+        shadow.send_key("alt-f5")
+        shadow.wait_until_succeeds("[ $(fgconsole) = 5 ]")
+        shadow.wait_for_unit("getty@tty5.service")
+        shadow.wait_until_succeeds("pgrep -f 'agetty.*tty5'")
+        shadow.wait_until_tty_matches("5", "login: ")
+        shadow.send_chars("layla\n")
+        shadow.wait_until_tty_matches("5", "login: layla")
+        shadow.wait_until_succeeds("pgrep login")
+        shadow.send_chars("${password2}\n")
+        shadow.wait_until_tty_matches("5", "login:")
 
-      with subtest("check alternate password hashes"):
-          shadow.send_key("alt-f6")
-          shadow.wait_until_succeeds("[ $(fgconsole) = 6 ]")
-          for u in ["berta", "yesim"]:
-              shadow.wait_for_unit("getty@tty6.service")
-              shadow.wait_until_succeeds("pgrep -f 'agetty.*tty6'")
-              shadow.wait_until_tty_matches("6", "login: ")
-              shadow.send_chars(f"{u}\n")
-              shadow.wait_until_tty_matches("6", f"login: {u}")
-              shadow.wait_until_succeeds("pgrep login")
-              shadow.sleep(2)
-              shadow.send_chars("fnord\n")
-              shadow.send_chars(f"whoami > /tmp/{u}\n")
-              shadow.wait_for_file(f"/tmp/{u}")
-              print(shadow.succeed(f"cat /tmp/{u}"))
-              assert u in shadow.succeed(f"cat /tmp/{u}")
-              shadow.send_chars("logout\n")
+    with subtest("check alternate password hashes"):
+        shadow.send_key("alt-f6")
+        shadow.wait_until_succeeds("[ $(fgconsole) = 6 ]")
+        for u in ["berta", "yesim"]:
+            shadow.wait_for_unit("getty@tty6.service")
+            shadow.wait_until_succeeds("pgrep -f 'agetty.*tty6'")
+            shadow.wait_until_tty_matches("6", "login: ")
+            shadow.send_chars(f"{u}\n")
+            shadow.wait_until_tty_matches("6", f"login: {u}")
+            shadow.wait_until_succeeds("pgrep login")
+            shadow.sleep(2)
+            shadow.send_chars("fnord\n")
+            shadow.send_chars(f"whoami > /tmp/{u}\n")
+            shadow.wait_for_file(f"/tmp/{u}")
+            print(shadow.succeed(f"cat /tmp/{u}"))
+            assert u in shadow.succeed(f"cat /tmp/{u}")
+            shadow.send_chars("logout\n")
 
-      with subtest("Ensure hashedPassword does not get overridden by initialHashedPassword"):
-          shadow.send_key("alt-f6")
-          shadow.wait_until_succeeds("[ $(fgconsole) = 6 ]")
-          shadow.wait_for_unit("getty@tty6.service")
-          shadow.wait_until_succeeds("pgrep -f 'agetty.*tty6'")
-          shadow.wait_until_tty_matches("6", "login: ")
-          shadow.send_chars("leo\n")
-          shadow.wait_until_tty_matches("6", "login: leo")
-          shadow.wait_until_succeeds("pgrep login")
-          shadow.sleep(2)
-          shadow.send_chars("meow\n")
-          shadow.send_chars("whoami > /tmp/leo\n")
-          shadow.wait_for_file("/tmp/leo")
-          assert "leo" in shadow.succeed("cat /tmp/leo")
-          shadow.send_chars("logout\n")
-    '';
-  }
-)
+    with subtest("Ensure hashedPassword does not get overridden by initialHashedPassword"):
+        shadow.send_key("alt-f6")
+        shadow.wait_until_succeeds("[ $(fgconsole) = 6 ]")
+        shadow.wait_for_unit("getty@tty6.service")
+        shadow.wait_until_succeeds("pgrep -f 'agetty.*tty6'")
+        shadow.wait_until_tty_matches("6", "login: ")
+        shadow.send_chars("leo\n")
+        shadow.wait_until_tty_matches("6", "login: leo")
+        shadow.wait_until_succeeds("pgrep login")
+        shadow.sleep(2)
+        shadow.send_chars("meow\n")
+        shadow.send_chars("whoami > /tmp/leo\n")
+        shadow.wait_for_file("/tmp/leo")
+        assert "leo" in shadow.succeed("cat /tmp/leo")
+        shadow.send_chars("logout\n")
+  '';
+}
diff --git a/nixos/tests/shattered-pixel-dungeon.nix b/nixos/tests/shattered-pixel-dungeon.nix
index dadd9991e29e..1f2aeeea1438 100644
--- a/nixos/tests/shattered-pixel-dungeon.nix
+++ b/nixos/tests/shattered-pixel-dungeon.nix
@@ -1,30 +1,28 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "shattered-pixel-dungeon";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fgaz ];
+{ pkgs, ... }:
+{
+  name = "shattered-pixel-dungeon";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      environment.systemPackages = [ pkgs.shattered-pixel-dungeon ];
     };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  enableOCR = true;
 
-        services.xserver.enable = true;
-        environment.systemPackages = [ pkgs.shattered-pixel-dungeon ];
-      };
-
-    enableOCR = true;
-
-    testScript = ''
-      machine.wait_for_x()
-      machine.execute("shattered-pixel-dungeon >&2 &")
-      machine.wait_for_window(r"Shattered Pixel Dungeon")
-      machine.wait_for_text("Enter")
-      machine.screenshot("screen")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_x()
+    machine.execute("shattered-pixel-dungeon >&2 &")
+    machine.wait_for_window(r"Shattered Pixel Dungeon")
+    machine.wait_for_text("Enter")
+    machine.screenshot("screen")
+  '';
+}
diff --git a/nixos/tests/shiori.nix b/nixos/tests/shiori.nix
index f25807e900f9..161228747ceb 100644
--- a/nixos/tests/shiori.nix
+++ b/nixos/tests/shiori.nix
@@ -1,90 +1,88 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  {
-    name = "shiori";
-    meta.maintainers = with lib.maintainers; [ minijackson ];
+{
+  name = "shiori";
+  meta.maintainers = with lib.maintainers; [ minijackson ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.shiori.enable = true;
+  nodes.machine =
+    { ... }:
+    {
+      services.shiori.enable = true;
+    };
+
+  testScript =
+    let
+      authJSON = pkgs.writeText "auth.json" (
+        builtins.toJSON {
+          username = "shiori";
+          password = "gopher";
+          owner = true;
+        }
+      );
+
+      insertBookmark = {
+        url = "http://example.org";
+        title = "Example Bookmark";
       };
 
-    testScript =
-      let
-        authJSON = pkgs.writeText "auth.json" (
-          builtins.toJSON {
-            username = "shiori";
-            password = "gopher";
-            owner = true;
-          }
-        );
+      insertBookmarkJSON = pkgs.writeText "insertBookmark.json" (builtins.toJSON insertBookmark);
+    in
+    ''
+      #import json
 
-        insertBookmark = {
-          url = "http://example.org";
-          title = "Example Bookmark";
-        };
+      machine.wait_for_unit("shiori.service")
+      machine.wait_for_open_port(8080)
+      machine.succeed("curl --fail http://localhost:8080/")
+      machine.succeed("curl --fail --location http://localhost:8080/ | grep -i shiori")
 
-        insertBookmarkJSON = pkgs.writeText "insertBookmark.json" (builtins.toJSON insertBookmark);
-      in
-      ''
-        #import json
+      # The test code below no longer works because the API authentication has changed.
 
-        machine.wait_for_unit("shiori.service")
-        machine.wait_for_open_port(8080)
-        machine.succeed("curl --fail http://localhost:8080/")
-        machine.succeed("curl --fail --location http://localhost:8080/ | grep -i shiori")
+      #with subtest("login"):
+      #    auth_json = machine.succeed(
+      #        "curl --fail --location http://localhost:8080/api/login "
+      #        "-X POST -H 'Content-Type:application/json' -d @${authJSON}"
+      #    )
+      #    auth_ret = json.loads(auth_json)
+      #    session_id = auth_ret["session"]
 
-        # The test code below no longer works because the API authentication has changed.
+      #with subtest("bookmarks"):
+      #    with subtest("first use no bookmarks"):
+      #        bookmarks_json = machine.succeed(
+      #            (
+      #                "curl --fail --location http://localhost:8080/api/bookmarks "
+      #                "-H 'X-Session-Id:{}'"
+      #            ).format(session_id)
+      #        )
 
-        #with subtest("login"):
-        #    auth_json = machine.succeed(
-        #        "curl --fail --location http://localhost:8080/api/login "
-        #        "-X POST -H 'Content-Type:application/json' -d @${authJSON}"
-        #    )
-        #    auth_ret = json.loads(auth_json)
-        #    session_id = auth_ret["session"]
+      #        if json.loads(bookmarks_json)["bookmarks"] != []:
+      #            raise Exception("Shiori have a bookmark on first use")
 
-        #with subtest("bookmarks"):
-        #    with subtest("first use no bookmarks"):
-        #        bookmarks_json = machine.succeed(
-        #            (
-        #                "curl --fail --location http://localhost:8080/api/bookmarks "
-        #                "-H 'X-Session-Id:{}'"
-        #            ).format(session_id)
-        #        )
+      #    with subtest("insert bookmark"):
+      #        machine.succeed(
+      #            (
+      #                "curl --fail --location http://localhost:8080/api/bookmarks "
+      #                "-X POST -H 'X-Session-Id:{}' "
+      #                "-H 'Content-Type:application/json' -d @${insertBookmarkJSON}"
+      #            ).format(session_id)
+      #        )
 
-        #        if json.loads(bookmarks_json)["bookmarks"] != []:
-        #            raise Exception("Shiori have a bookmark on first use")
+      #    with subtest("get inserted bookmark"):
+      #        bookmarks_json = machine.succeed(
+      #            (
+      #                "curl --fail --location http://localhost:8080/api/bookmarks "
+      #                "-H 'X-Session-Id:{}'"
+      #            ).format(session_id)
+      #        )
 
-        #    with subtest("insert bookmark"):
-        #        machine.succeed(
-        #            (
-        #                "curl --fail --location http://localhost:8080/api/bookmarks "
-        #                "-X POST -H 'X-Session-Id:{}' "
-        #                "-H 'Content-Type:application/json' -d @${insertBookmarkJSON}"
-        #            ).format(session_id)
-        #        )
+      #        bookmarks = json.loads(bookmarks_json)["bookmarks"]
+      #        if len(bookmarks) != 1:
+      #            raise Exception("Shiori didn't save the bookmark")
 
-        #    with subtest("get inserted bookmark"):
-        #        bookmarks_json = machine.succeed(
-        #            (
-        #                "curl --fail --location http://localhost:8080/api/bookmarks "
-        #                "-H 'X-Session-Id:{}'"
-        #            ).format(session_id)
-        #        )
-
-        #        bookmarks = json.loads(bookmarks_json)["bookmarks"]
-        #        if len(bookmarks) != 1:
-        #            raise Exception("Shiori didn't save the bookmark")
-
-        #        bookmark = bookmarks[0]
-        #        if (
-        #            bookmark["url"] != "${insertBookmark.url}"
-        #            or bookmark["title"] != "${insertBookmark.title}"
-        #        ):
-        #            raise Exception("Inserted bookmark doesn't have same URL or title")
-      '';
-  }
-)
+      #        bookmark = bookmarks[0]
+      #        if (
+      #            bookmark["url"] != "${insertBookmark.url}"
+      #            or bookmark["title"] != "${insertBookmark.title}"
+      #        ):
+      #            raise Exception("Inserted bookmark doesn't have same URL or title")
+    '';
+}
diff --git a/nixos/tests/silverbullet.nix b/nixos/tests/silverbullet.nix
index a14e59cccf48..af2c6d5ec2a7 100644
--- a/nixos/tests/silverbullet.nix
+++ b/nixos/tests/silverbullet.nix
@@ -1,59 +1,57 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "silverbullet";
-    meta.maintainers = with lib.maintainers; [ aorith ];
+{ lib, ... }:
+{
+  name = "silverbullet";
+  meta.maintainers = with lib.maintainers; [ aorith ];
 
-    nodes.simple =
-      { ... }:
-      {
-        services.silverbullet.enable = true;
+  nodes.simple =
+    { ... }:
+    {
+      services.silverbullet.enable = true;
+    };
+
+  nodes.configured =
+    { pkgs, ... }:
+    {
+      users.users.test.isNormalUser = true;
+      users.groups.test = { };
+
+      services.silverbullet = {
+        enable = true;
+        package = pkgs.silverbullet;
+        listenPort = 3001;
+        listenAddress = "localhost";
+        spaceDir = "/home/test/silverbullet";
+        user = "test";
+        group = "test";
+        envFile = pkgs.writeText "silverbullet.env" ''
+          SB_USER=user:password
+          SB_AUTH_TOKEN=test
+        '';
+        extraArgs = [
+          "--reindex"
+          "--db /home/test/silverbullet/custom.db"
+        ];
       };
+    };
 
-    nodes.configured =
-      { pkgs, ... }:
-      {
-        users.users.test.isNormalUser = true;
-        users.groups.test = { };
+  testScript =
+    { nodes, ... }:
+    ''
+      PORT = ${builtins.toString nodes.simple.services.silverbullet.listenPort}
+      ADDRESS = "${nodes.simple.services.silverbullet.listenAddress}"
+      SPACEDIR = "${nodes.simple.services.silverbullet.spaceDir}"
+      simple.wait_for_unit("silverbullet.service")
+      simple.wait_for_open_port(PORT)
+      simple.succeed(f"curl --max-time 5 -s -v -o /dev/null --fail http://{ADDRESS}:{PORT}/")
+      simple.succeed(f"test -d '{SPACEDIR}'")
 
-        services.silverbullet = {
-          enable = true;
-          package = pkgs.silverbullet;
-          listenPort = 3001;
-          listenAddress = "localhost";
-          spaceDir = "/home/test/silverbullet";
-          user = "test";
-          group = "test";
-          envFile = pkgs.writeText "silverbullet.env" ''
-            SB_USER=user:password
-            SB_AUTH_TOKEN=test
-          '';
-          extraArgs = [
-            "--reindex"
-            "--db /home/test/silverbullet/custom.db"
-          ];
-        };
-      };
-
-    testScript =
-      { nodes, ... }:
-      ''
-        PORT = ${builtins.toString nodes.simple.services.silverbullet.listenPort}
-        ADDRESS = "${nodes.simple.services.silverbullet.listenAddress}"
-        SPACEDIR = "${nodes.simple.services.silverbullet.spaceDir}"
-        simple.wait_for_unit("silverbullet.service")
-        simple.wait_for_open_port(PORT)
-        simple.succeed(f"curl --max-time 5 -s -v -o /dev/null --fail http://{ADDRESS}:{PORT}/")
-        simple.succeed(f"test -d '{SPACEDIR}'")
-
-        PORT = ${builtins.toString nodes.configured.services.silverbullet.listenPort}
-        ADDRESS = "${nodes.configured.services.silverbullet.listenAddress}"
-        SPACEDIR = "${nodes.configured.services.silverbullet.spaceDir}"
-        configured.wait_for_unit("silverbullet.service")
-        configured.wait_for_open_port(PORT)
-        assert int(configured.succeed(f"curl --max-time 5 -s -o /dev/null -w '%{{http_code}}' -XPUT -d 'test' --fail http://{ADDRESS}:{PORT}/test.md -H'Authorization: Bearer test'")) == 200
-        assert int(configured.fail(f"curl --max-time 5 -s -o /dev/null -w '%{{http_code}}' -XPUT -d 'test' --fail http://{ADDRESS}:{PORT}/test.md -H'Authorization: Bearer wrong'")) == 401
-        configured.succeed(f"test -d '{SPACEDIR}'")
-      '';
-  }
-)
+      PORT = ${builtins.toString nodes.configured.services.silverbullet.listenPort}
+      ADDRESS = "${nodes.configured.services.silverbullet.listenAddress}"
+      SPACEDIR = "${nodes.configured.services.silverbullet.spaceDir}"
+      configured.wait_for_unit("silverbullet.service")
+      configured.wait_for_open_port(PORT)
+      assert int(configured.succeed(f"curl --max-time 5 -s -o /dev/null -w '%{{http_code}}' -XPUT -d 'test' --fail http://{ADDRESS}:{PORT}/test.md -H'Authorization: Bearer test'")) == 200
+      assert int(configured.fail(f"curl --max-time 5 -s -o /dev/null -w '%{{http_code}}' -XPUT -d 'test' --fail http://{ADDRESS}:{PORT}/test.md -H'Authorization: Bearer wrong'")) == 401
+      configured.succeed(f"test -d '{SPACEDIR}'")
+    '';
+}
diff --git a/nixos/tests/simple.nix b/nixos/tests/simple.nix
index ab9cf1d9768f..3695f3ff9038 100644
--- a/nixos/tests/simple.nix
+++ b/nixos/tests/simple.nix
@@ -1,21 +1,19 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "simple";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
+{ pkgs, ... }:
+{
+  name = "simple";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ../modules/profiles/minimal.nix ];
     };
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ../modules/profiles/minimal.nix ];
-      };
-
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("multi-user.target")
-      machine.shutdown()
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.shutdown()
+  '';
+}
diff --git a/nixos/tests/sing-box.nix b/nixos/tests/sing-box.nix
index a8a287586af2..6d105253f29c 100644
--- a/nixos/tests/sing-box.nix
+++ b/nixos/tests/sing-box.nix
@@ -1,548 +1,546 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    wg-keys = import ./wireguard/snakeoil-keys.nix;
+{ lib, pkgs, ... }:
+let
+  wg-keys = import ./wireguard/snakeoil-keys.nix;
 
-    target_host = "acme.test";
-    server_host = "sing-box.test";
+  target_host = "acme.test";
+  server_host = "sing-box.test";
 
-    hosts = {
-      "${target_host}" = "1.1.1.1";
-      "${server_host}" = "1.1.1.2";
-    };
-    hostsEntries = lib.mapAttrs' (k: v: {
-      name = v;
-      value = lib.singleton k;
-    }) hosts;
+  hosts = {
+    "${target_host}" = "1.1.1.1";
+    "${server_host}" = "1.1.1.2";
+  };
+  hostsEntries = lib.mapAttrs' (k: v: {
+    name = v;
+    value = lib.singleton k;
+  }) hosts;
 
-    vmessPort = 1080;
-    vmessUUID = "bf000d23-0752-40b4-affe-68f7707a9661";
-    vmessInbound = {
-      type = "vmess";
-      tag = "inbound:vmess";
-      listen = "0.0.0.0";
-      listen_port = vmessPort;
-      users = [
-        {
-          name = "sekai";
-          uuid = vmessUUID;
-          alterId = 0;
-        }
-      ];
-    };
-    vmessOutbound = {
-      type = "vmess";
-      tag = "outbound:vmess";
-      server = server_host;
-      server_port = vmessPort;
-      uuid = vmessUUID;
-      security = "auto";
-      alter_id = 0;
-    };
+  vmessPort = 1080;
+  vmessUUID = "bf000d23-0752-40b4-affe-68f7707a9661";
+  vmessInbound = {
+    type = "vmess";
+    tag = "inbound:vmess";
+    listen = "0.0.0.0";
+    listen_port = vmessPort;
+    users = [
+      {
+        name = "sekai";
+        uuid = vmessUUID;
+        alterId = 0;
+      }
+    ];
+  };
+  vmessOutbound = {
+    type = "vmess";
+    tag = "outbound:vmess";
+    server = server_host;
+    server_port = vmessPort;
+    uuid = vmessUUID;
+    security = "auto";
+    alter_id = 0;
+  };
 
-    tunInbound = {
-      type = "tun";
-      tag = "inbound:tun";
-      interface_name = "tun0";
-      address = [
-        "172.16.0.1/30"
-        "fd00::1/126"
-      ];
-      auto_route = true;
-      iproute2_table_index = 2024;
-      iproute2_rule_index = 9001;
-      route_address = [
-        "${hosts."${target_host}"}/32"
-      ];
-      route_exclude_address = [
-        "${hosts."${server_host}"}/32"
-      ];
-      strict_route = false;
-      sniff = true;
-      sniff_override_destination = false;
-    };
+  tunInbound = {
+    type = "tun";
+    tag = "inbound:tun";
+    interface_name = "tun0";
+    address = [
+      "172.16.0.1/30"
+      "fd00::1/126"
+    ];
+    auto_route = true;
+    iproute2_table_index = 2024;
+    iproute2_rule_index = 9001;
+    route_address = [
+      "${hosts."${target_host}"}/32"
+    ];
+    route_exclude_address = [
+      "${hosts."${server_host}"}/32"
+    ];
+    strict_route = false;
+    sniff = true;
+    sniff_override_destination = false;
+  };
 
-    tproxyPort = 1081;
-    tproxyPost = pkgs.writeShellApplication {
-      name = "exe";
-      runtimeInputs = with pkgs; [
-        iproute2
-        iptables
-      ];
-      text = ''
-        ip route add local default dev lo table 100
-        ip rule add fwmark 1 table 100
+  tproxyPort = 1081;
+  tproxyPost = pkgs.writeShellApplication {
+    name = "exe";
+    runtimeInputs = with pkgs; [
+      iproute2
+      iptables
+    ];
+    text = ''
+      ip route add local default dev lo table 100
+      ip rule add fwmark 1 table 100
 
-        iptables -t mangle -N SING_BOX
-        iptables -t mangle -A SING_BOX -d 100.64.0.0/10 -j RETURN
-        iptables -t mangle -A SING_BOX -d 127.0.0.0/8 -j RETURN
-        iptables -t mangle -A SING_BOX -d 169.254.0.0/16 -j RETURN
-        iptables -t mangle -A SING_BOX -d 172.16.0.0/12 -j RETURN
-        iptables -t mangle -A SING_BOX -d 192.0.0.0/24 -j RETURN
-        iptables -t mangle -A SING_BOX -d 224.0.0.0/4 -j RETURN
-        iptables -t mangle -A SING_BOX -d 240.0.0.0/4 -j RETURN
-        iptables -t mangle -A SING_BOX -d 255.255.255.255/32 -j RETURN
+      iptables -t mangle -N SING_BOX
+      iptables -t mangle -A SING_BOX -d 100.64.0.0/10 -j RETURN
+      iptables -t mangle -A SING_BOX -d 127.0.0.0/8 -j RETURN
+      iptables -t mangle -A SING_BOX -d 169.254.0.0/16 -j RETURN
+      iptables -t mangle -A SING_BOX -d 172.16.0.0/12 -j RETURN
+      iptables -t mangle -A SING_BOX -d 192.0.0.0/24 -j RETURN
+      iptables -t mangle -A SING_BOX -d 224.0.0.0/4 -j RETURN
+      iptables -t mangle -A SING_BOX -d 240.0.0.0/4 -j RETURN
+      iptables -t mangle -A SING_BOX -d 255.255.255.255/32 -j RETURN
 
-        iptables -t mangle -A SING_BOX -d ${hosts."${server_host}"}/32 -p tcp -j RETURN
-        iptables -t mangle -A SING_BOX -d ${hosts."${server_host}"}/32 -p udp -j RETURN
+      iptables -t mangle -A SING_BOX -d ${hosts."${server_host}"}/32 -p tcp -j RETURN
+      iptables -t mangle -A SING_BOX -d ${hosts."${server_host}"}/32 -p udp -j RETURN
 
-        iptables -t mangle -A SING_BOX -d ${hosts."${target_host}"}/32 -p tcp -j TPROXY --on-port ${toString tproxyPort} --tproxy-mark 1
-        iptables -t mangle -A SING_BOX -d ${hosts."${target_host}"}/32 -p udp -j TPROXY --on-port ${toString tproxyPort} --tproxy-mark 1
-        iptables -t mangle -A PREROUTING -j SING_BOX
+      iptables -t mangle -A SING_BOX -d ${hosts."${target_host}"}/32 -p tcp -j TPROXY --on-port ${toString tproxyPort} --tproxy-mark 1
+      iptables -t mangle -A SING_BOX -d ${hosts."${target_host}"}/32 -p udp -j TPROXY --on-port ${toString tproxyPort} --tproxy-mark 1
+      iptables -t mangle -A PREROUTING -j SING_BOX
 
-        iptables -t mangle -N SING_BOX_SELF
-        iptables -t mangle -A SING_BOX_SELF -d 100.64.0.0/10 -j RETURN
-        iptables -t mangle -A SING_BOX_SELF -d 127.0.0.0/8 -j RETURN
-        iptables -t mangle -A SING_BOX_SELF -d 169.254.0.0/16 -j RETURN
-        iptables -t mangle -A SING_BOX_SELF -d 172.16.0.0/12 -j RETURN
-        iptables -t mangle -A SING_BOX_SELF -d 192.0.0.0/24 -j RETURN
-        iptables -t mangle -A SING_BOX_SELF -d 224.0.0.0/4 -j RETURN
-        iptables -t mangle -A SING_BOX_SELF -d 240.0.0.0/4 -j RETURN
-        iptables -t mangle -A SING_BOX_SELF -d 255.255.255.255/32 -j RETURN
-        iptables -t mangle -A SING_BOX_SELF  -j RETURN -m mark --mark 1234
+      iptables -t mangle -N SING_BOX_SELF
+      iptables -t mangle -A SING_BOX_SELF -d 100.64.0.0/10 -j RETURN
+      iptables -t mangle -A SING_BOX_SELF -d 127.0.0.0/8 -j RETURN
+      iptables -t mangle -A SING_BOX_SELF -d 169.254.0.0/16 -j RETURN
+      iptables -t mangle -A SING_BOX_SELF -d 172.16.0.0/12 -j RETURN
+      iptables -t mangle -A SING_BOX_SELF -d 192.0.0.0/24 -j RETURN
+      iptables -t mangle -A SING_BOX_SELF -d 224.0.0.0/4 -j RETURN
+      iptables -t mangle -A SING_BOX_SELF -d 240.0.0.0/4 -j RETURN
+      iptables -t mangle -A SING_BOX_SELF -d 255.255.255.255/32 -j RETURN
+      iptables -t mangle -A SING_BOX_SELF  -j RETURN -m mark --mark 1234
 
-        iptables -t mangle -A SING_BOX_SELF -d ${hosts."${server_host}"}/32 -p tcp -j RETURN
-        iptables -t mangle -A SING_BOX_SELF -d ${hosts."${server_host}"}/32 -p udp -j RETURN
-        iptables -t mangle -A SING_BOX_SELF -p tcp -j MARK --set-mark 1
-        iptables -t mangle -A SING_BOX_SELF -p udp -j MARK --set-mark 1
-        iptables -t mangle -A OUTPUT -j SING_BOX_SELF
-      '';
-    };
-  in
-  {
+      iptables -t mangle -A SING_BOX_SELF -d ${hosts."${server_host}"}/32 -p tcp -j RETURN
+      iptables -t mangle -A SING_BOX_SELF -d ${hosts."${server_host}"}/32 -p udp -j RETURN
+      iptables -t mangle -A SING_BOX_SELF -p tcp -j MARK --set-mark 1
+      iptables -t mangle -A SING_BOX_SELF -p udp -j MARK --set-mark 1
+      iptables -t mangle -A OUTPUT -j SING_BOX_SELF
+    '';
+  };
+in
+{
 
-    name = "sing-box";
+  name = "sing-box";
 
-    meta = {
-      maintainers = with lib.maintainers; [ nickcao ];
-    };
+  meta = {
+    maintainers = with lib.maintainers; [ nickcao ];
+  };
 
-    nodes = {
-      target =
-        { pkgs, ... }:
-        {
-          networking = {
-            firewall.enable = false;
-            hosts = hostsEntries;
-            useDHCP = false;
-            interfaces.eth1 = {
-              ipv4.addresses = [
-                {
-                  address = hosts."${target_host}";
-                  prefixLength = 24;
-                }
-              ];
-            };
-          };
-
-          services.dnsmasq.enable = true;
-
-          services.nginx = {
-            enable = true;
-            package = pkgs.nginxQuic;
-
-            virtualHosts."${target_host}" = {
-              onlySSL = true;
-              sslCertificate = ./common/acme/server/acme.test.cert.pem;
-              sslCertificateKey = ./common/acme/server/acme.test.key.pem;
-              http2 = true;
-              http3 = true;
-              http3_hq = false;
-              quic = true;
-              reuseport = true;
-              locations."/" = {
-                extraConfig = ''
-                  default_type text/plain;
-                  return 200 "$server_protocol $remote_addr";
-                  allow ${hosts."${server_host}"}/32;
-                  deny all;
-                '';
-              };
-            };
-          };
-        };
-
-      server =
-        { pkgs, ... }:
-        {
-          boot.kernel.sysctl = {
-            "net.ipv4.conf.all.forwarding" = 1;
-          };
-
-          networking = {
-            firewall.enable = false;
-            hosts = hostsEntries;
-            useDHCP = false;
-            interfaces.eth1 = {
-              ipv4.addresses = [
-                {
-                  address = hosts."${server_host}";
-                  prefixLength = 24;
-                }
-              ];
-            };
-          };
-
-          systemd.network.wait-online.ignoredInterfaces = [ "wg0" ];
-
-          networking.wg-quick.interfaces.wg0 = {
-            address = [
-              "10.23.42.1/24"
+  nodes = {
+    target =
+      { pkgs, ... }:
+      {
+        networking = {
+          firewall.enable = false;
+          hosts = hostsEntries;
+          useDHCP = false;
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = hosts."${target_host}";
+                prefixLength = 24;
+              }
             ];
-            listenPort = 2408;
-            mtu = 1500;
+          };
+        };
 
-            inherit (wg-keys.peer0) privateKey;
+        services.dnsmasq.enable = true;
 
-            peers = lib.singleton {
-              allowedIPs = [
-                "10.23.42.2/32"
-              ];
+        services.nginx = {
+          enable = true;
+          package = pkgs.nginxQuic;
 
-              inherit (wg-keys.peer1) publicKey;
+          virtualHosts."${target_host}" = {
+            onlySSL = true;
+            sslCertificate = ./common/acme/server/acme.test.cert.pem;
+            sslCertificateKey = ./common/acme/server/acme.test.key.pem;
+            http2 = true;
+            http3 = true;
+            http3_hq = false;
+            quic = true;
+            reuseport = true;
+            locations."/" = {
+              extraConfig = ''
+                default_type text/plain;
+                return 200 "$server_protocol $remote_addr";
+                allow ${hosts."${server_host}"}/32;
+                deny all;
+              '';
             };
+          };
+        };
+      };
 
-            postUp = ''
-              ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
-              ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.23.42.0/24 -o eth1 -j MASQUERADE
-            '';
+    server =
+      { pkgs, ... }:
+      {
+        boot.kernel.sysctl = {
+          "net.ipv4.conf.all.forwarding" = 1;
+        };
+
+        networking = {
+          firewall.enable = false;
+          hosts = hostsEntries;
+          useDHCP = false;
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = hosts."${server_host}";
+                prefixLength = 24;
+              }
+            ];
+          };
+        };
+
+        systemd.network.wait-online.ignoredInterfaces = [ "wg0" ];
+
+        networking.wg-quick.interfaces.wg0 = {
+          address = [
+            "10.23.42.1/24"
+          ];
+          listenPort = 2408;
+          mtu = 1500;
+
+          inherit (wg-keys.peer0) privateKey;
+
+          peers = lib.singleton {
+            allowedIPs = [
+              "10.23.42.2/32"
+            ];
+
+            inherit (wg-keys.peer1) publicKey;
           };
 
-          services.sing-box = {
-            enable = true;
-            settings = {
-              inbounds = [
-                vmessInbound
-              ];
-              outbounds = [
+          postUp = ''
+            ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
+            ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.23.42.0/24 -o eth1 -j MASQUERADE
+          '';
+        };
+
+        services.sing-box = {
+          enable = true;
+          settings = {
+            inbounds = [
+              vmessInbound
+            ];
+            outbounds = [
+              {
+                type = "direct";
+                tag = "outbound:direct";
+              }
+            ];
+          };
+        };
+      };
+
+    tun =
+      { pkgs, ... }:
+      {
+        networking = {
+          firewall.enable = false;
+          hosts = hostsEntries;
+          useDHCP = false;
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = "1.1.1.3";
+                prefixLength = 24;
+              }
+            ];
+          };
+        };
+
+        security.pki.certificates = [
+          (builtins.readFile ./common/acme/server/ca.cert.pem)
+        ];
+
+        environment.systemPackages = [
+          pkgs.curlHTTP3
+          pkgs.iproute2
+        ];
+
+        services.sing-box = {
+          enable = true;
+          settings = {
+            inbounds = [
+              tunInbound
+            ];
+            outbounds = [
+              {
+                type = "block";
+                tag = "outbound:block";
+              }
+              {
+                type = "direct";
+                tag = "outbound:direct";
+              }
+              vmessOutbound
+            ];
+            route = {
+              final = "outbound:block";
+              rules = [
                 {
-                  type = "direct";
-                  tag = "outbound:direct";
+                  inbound = [
+                    "inbound:tun"
+                  ];
+                  outbound = "outbound:vmess";
                 }
               ];
             };
           };
         };
+      };
 
-      tun =
-        { pkgs, ... }:
-        {
-          networking = {
-            firewall.enable = false;
-            hosts = hostsEntries;
-            useDHCP = false;
-            interfaces.eth1 = {
-              ipv4.addresses = [
+    wireguard =
+      { pkgs, ... }:
+      {
+        networking = {
+          firewall.enable = false;
+          hosts = hostsEntries;
+          useDHCP = false;
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = "1.1.1.4";
+                prefixLength = 24;
+              }
+            ];
+          };
+        };
+
+        security.pki.certificates = [
+          (builtins.readFile ./common/acme/server/ca.cert.pem)
+        ];
+
+        environment.systemPackages = [
+          pkgs.curlHTTP3
+          pkgs.iproute2
+        ];
+
+        services.sing-box = {
+          enable = true;
+          settings = {
+            outbounds = [
+              {
+                type = "block";
+                tag = "outbound:block";
+              }
+              {
+                type = "direct";
+                tag = "outbound:direct";
+              }
+              {
+                detour = "outbound:direct";
+                type = "wireguard";
+                tag = "outbound:wireguard";
+                interface_name = "wg0";
+                local_address = [ "10.23.42.2/32" ];
+                mtu = 1280;
+                private_key = wg-keys.peer1.privateKey;
+                peer_public_key = wg-keys.peer0.publicKey;
+                server = server_host;
+                server_port = 2408;
+                system_interface = true;
+              }
+            ];
+            route = {
+              final = "outbound:block";
+            };
+          };
+        };
+      };
+
+    tproxy =
+      { pkgs, ... }:
+      {
+        networking = {
+          firewall.enable = false;
+          hosts = hostsEntries;
+          useDHCP = false;
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = "1.1.1.5";
+                prefixLength = 24;
+              }
+            ];
+          };
+        };
+
+        security.pki.certificates = [
+          (builtins.readFile ./common/acme/server/ca.cert.pem)
+        ];
+
+        environment.systemPackages = [ pkgs.curlHTTP3 ];
+
+        systemd.services.sing-box.serviceConfig.ExecStartPost = [
+          "+${tproxyPost}/bin/exe"
+        ];
+
+        services.sing-box = {
+          enable = true;
+          settings = {
+            inbounds = [
+              {
+                tag = "inbound:tproxy";
+                type = "tproxy";
+                listen = "0.0.0.0";
+                listen_port = tproxyPort;
+                udp_fragment = true;
+                sniff = true;
+                sniff_override_destination = false;
+              }
+            ];
+            outbounds = [
+              {
+                type = "block";
+                tag = "outbound:block";
+              }
+              {
+                type = "direct";
+                tag = "outbound:direct";
+              }
+              vmessOutbound
+            ];
+            route = {
+              final = "outbound:block";
+              rules = [
                 {
-                  address = "1.1.1.3";
-                  prefixLength = 24;
+                  inbound = [
+                    "inbound:tproxy"
+                  ];
+                  outbound = "outbound:vmess";
                 }
               ];
             };
           };
+        };
+      };
 
-          security.pki.certificates = [
-            (builtins.readFile ./common/acme/server/ca.cert.pem)
-          ];
+    fakeip =
+      { pkgs, ... }:
+      {
+        networking = {
+          firewall.enable = false;
+          hosts = hostsEntries;
+          useDHCP = false;
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = "1.1.1.6";
+                prefixLength = 24;
+              }
+            ];
+          };
+        };
 
-          environment.systemPackages = [
-            pkgs.curlHTTP3
-            pkgs.iproute2
-          ];
+        environment.systemPackages = [ pkgs.dnsutils ];
 
-          services.sing-box = {
-            enable = true;
-            settings = {
-              inbounds = [
-                tunInbound
-              ];
-              outbounds = [
-                {
-                  type = "block";
-                  tag = "outbound:block";
-                }
-                {
-                  type = "direct";
-                  tag = "outbound:direct";
-                }
-                vmessOutbound
-              ];
-              route = {
-                final = "outbound:block";
-                rules = [
-                  {
-                    inbound = [
-                      "inbound:tun"
-                    ];
-                    outbound = "outbound:vmess";
-                  }
-                ];
+        services.sing-box = {
+          enable = true;
+          settings = {
+            dns = {
+              final = "dns:default";
+              independent_cache = true;
+              fakeip = {
+                enabled = true;
+                "inet4_range" = "198.18.0.0/16";
               };
-            };
-          };
-        };
-
-      wireguard =
-        { pkgs, ... }:
-        {
-          networking = {
-            firewall.enable = false;
-            hosts = hostsEntries;
-            useDHCP = false;
-            interfaces.eth1 = {
-              ipv4.addresses = [
-                {
-                  address = "1.1.1.4";
-                  prefixLength = 24;
-                }
-              ];
-            };
-          };
-
-          security.pki.certificates = [
-            (builtins.readFile ./common/acme/server/ca.cert.pem)
-          ];
-
-          environment.systemPackages = [
-            pkgs.curlHTTP3
-            pkgs.iproute2
-          ];
-
-          services.sing-box = {
-            enable = true;
-            settings = {
-              outbounds = [
-                {
-                  type = "block";
-                  tag = "outbound:block";
-                }
-                {
-                  type = "direct";
-                  tag = "outbound:direct";
-                }
+              servers = [
                 {
                   detour = "outbound:direct";
-                  type = "wireguard";
-                  tag = "outbound:wireguard";
-                  interface_name = "wg0";
-                  local_address = [ "10.23.42.2/32" ];
-                  mtu = 1280;
-                  private_key = wg-keys.peer1.privateKey;
-                  peer_public_key = wg-keys.peer0.publicKey;
-                  server = server_host;
-                  server_port = 2408;
-                  system_interface = true;
+                  tag = "dns:default";
+                  address = hosts."${target_host}";
+                }
+                {
+                  tag = "dns:fakeip";
+                  address = "fakeip";
                 }
               ];
-              route = {
-                final = "outbound:block";
-              };
-            };
-          };
-        };
-
-      tproxy =
-        { pkgs, ... }:
-        {
-          networking = {
-            firewall.enable = false;
-            hosts = hostsEntries;
-            useDHCP = false;
-            interfaces.eth1 = {
-              ipv4.addresses = [
+              rules = [
                 {
-                  address = "1.1.1.5";
-                  prefixLength = 24;
+                  outbound = [ "any" ];
+                  server = "dns:default";
+                }
+                {
+                  query_type = [
+                    "A"
+                    "AAAA"
+                  ];
+                  server = "dns:fakeip";
+
                 }
               ];
             };
-          };
-
-          security.pki.certificates = [
-            (builtins.readFile ./common/acme/server/ca.cert.pem)
-          ];
-
-          environment.systemPackages = [ pkgs.curlHTTP3 ];
-
-          systemd.services.sing-box.serviceConfig.ExecStartPost = [
-            "+${tproxyPost}/bin/exe"
-          ];
-
-          services.sing-box = {
-            enable = true;
-            settings = {
-              inbounds = [
+            inbounds = [
+              tunInbound
+            ];
+            outbounds = [
+              {
+                type = "block";
+                tag = "outbound:block";
+              }
+              {
+                type = "direct";
+                tag = "outbound:direct";
+              }
+              {
+                type = "dns";
+                tag = "outbound:dns";
+              }
+            ];
+            route = {
+              final = "outbound:direct";
+              rules = [
                 {
-                  tag = "inbound:tproxy";
-                  type = "tproxy";
-                  listen = "0.0.0.0";
-                  listen_port = tproxyPort;
-                  udp_fragment = true;
-                  sniff = true;
-                  sniff_override_destination = false;
+                  protocol = "dns";
+                  outbound = "outbound:dns";
                 }
               ];
-              outbounds = [
-                {
-                  type = "block";
-                  tag = "outbound:block";
-                }
-                {
-                  type = "direct";
-                  tag = "outbound:direct";
-                }
-                vmessOutbound
-              ];
-              route = {
-                final = "outbound:block";
-                rules = [
-                  {
-                    inbound = [
-                      "inbound:tproxy"
-                    ];
-                    outbound = "outbound:vmess";
-                  }
-                ];
-              };
-            };
-          };
-        };
-
-      fakeip =
-        { pkgs, ... }:
-        {
-          networking = {
-            firewall.enable = false;
-            hosts = hostsEntries;
-            useDHCP = false;
-            interfaces.eth1 = {
-              ipv4.addresses = [
-                {
-                  address = "1.1.1.6";
-                  prefixLength = 24;
-                }
-              ];
-            };
-          };
-
-          environment.systemPackages = [ pkgs.dnsutils ];
-
-          services.sing-box = {
-            enable = true;
-            settings = {
-              dns = {
-                final = "dns:default";
-                independent_cache = true;
-                fakeip = {
-                  enabled = true;
-                  "inet4_range" = "198.18.0.0/16";
-                };
-                servers = [
-                  {
-                    detour = "outbound:direct";
-                    tag = "dns:default";
-                    address = hosts."${target_host}";
-                  }
-                  {
-                    tag = "dns:fakeip";
-                    address = "fakeip";
-                  }
-                ];
-                rules = [
-                  {
-                    outbound = [ "any" ];
-                    server = "dns:default";
-                  }
-                  {
-                    query_type = [
-                      "A"
-                      "AAAA"
-                    ];
-                    server = "dns:fakeip";
-
-                  }
-                ];
-              };
-              inbounds = [
-                tunInbound
-              ];
-              outbounds = [
-                {
-                  type = "block";
-                  tag = "outbound:block";
-                }
-                {
-                  type = "direct";
-                  tag = "outbound:direct";
-                }
-                {
-                  type = "dns";
-                  tag = "outbound:dns";
-                }
-              ];
-              route = {
-                final = "outbound:direct";
-                rules = [
-                  {
-                    protocol = "dns";
-                    outbound = "outbound:dns";
-                  }
-                ];
-              };
             };
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      target.wait_for_unit("nginx.service")
-      target.wait_for_open_port(443)
-      target.wait_for_unit("dnsmasq.service")
-      target.wait_for_open_port(53)
+  testScript = ''
+    target.wait_for_unit("nginx.service")
+    target.wait_for_open_port(443)
+    target.wait_for_unit("dnsmasq.service")
+    target.wait_for_open_port(53)
 
-      server.wait_for_unit("sing-box.service")
-      server.wait_for_open_port(1080)
-      server.wait_for_unit("wg-quick-wg0.service")
-      server.wait_for_file("/sys/class/net/wg0")
+    server.wait_for_unit("sing-box.service")
+    server.wait_for_open_port(1080)
+    server.wait_for_unit("wg-quick-wg0.service")
+    server.wait_for_file("/sys/class/net/wg0")
 
-      def test_curl(machine, extra_args=""):
-        assert (
-          machine.succeed(f"curl --fail --max-time 10 --http2 https://${target_host} {extra_args}")
-          == "HTTP/2.0 ${hosts.${server_host}}"
-        )
-        assert (
-          machine.succeed(f"curl --fail --max-time 10 --http3-only https://${target_host} {extra_args}")
-          == "HTTP/3.0 ${hosts.${server_host}}"
-        )
+    def test_curl(machine, extra_args=""):
+      assert (
+        machine.succeed(f"curl --fail --max-time 10 --http2 https://${target_host} {extra_args}")
+        == "HTTP/2.0 ${hosts.${server_host}}"
+      )
+      assert (
+        machine.succeed(f"curl --fail --max-time 10 --http3-only https://${target_host} {extra_args}")
+        == "HTTP/3.0 ${hosts.${server_host}}"
+      )
 
-      with subtest("tun"):
-        tun.wait_for_unit("sing-box.service")
-        tun.wait_for_unit("sys-devices-virtual-net-${tunInbound.interface_name}.device")
-        tun.wait_until_succeeds("ip route get ${hosts."${target_host}"} | grep 'dev ${tunInbound.interface_name}'")
-        tun.succeed("ip addr show ${tunInbound.interface_name}")
-        tun.succeed("ip route show table ${toString tunInbound.iproute2_table_index} | grep ${tunInbound.interface_name}")
-        assert (
-          tun.succeed("ip rule list table ${toString tunInbound.iproute2_table_index} | sort | head -1 | awk -F: '{print $1}' | tr -d '\n'")
-          == "${toString tunInbound.iproute2_rule_index}"
-        )
-        test_curl(tun)
+    with subtest("tun"):
+      tun.wait_for_unit("sing-box.service")
+      tun.wait_for_unit("sys-devices-virtual-net-${tunInbound.interface_name}.device")
+      tun.wait_until_succeeds("ip route get ${hosts."${target_host}"} | grep 'dev ${tunInbound.interface_name}'")
+      tun.succeed("ip addr show ${tunInbound.interface_name}")
+      tun.succeed("ip route show table ${toString tunInbound.iproute2_table_index} | grep ${tunInbound.interface_name}")
+      assert (
+        tun.succeed("ip rule list table ${toString tunInbound.iproute2_table_index} | sort | head -1 | awk -F: '{print $1}' | tr -d '\n'")
+        == "${toString tunInbound.iproute2_rule_index}"
+      )
+      test_curl(tun)
 
-      with subtest("wireguard"):
-        wireguard.wait_for_unit("sing-box.service")
-        wireguard.wait_for_unit("sys-devices-virtual-net-wg0.device")
-        wireguard.succeed("ip addr show wg0")
-        test_curl(wireguard, "--interface wg0")
+    with subtest("wireguard"):
+      wireguard.wait_for_unit("sing-box.service")
+      wireguard.wait_for_unit("sys-devices-virtual-net-wg0.device")
+      wireguard.succeed("ip addr show wg0")
+      test_curl(wireguard, "--interface wg0")
 
-      with subtest("tproxy"):
-        tproxy.wait_for_unit("sing-box.service")
-        test_curl(tproxy)
+    with subtest("tproxy"):
+      tproxy.wait_for_unit("sing-box.service")
+      test_curl(tproxy)
 
-      with subtest("fakeip"):
-        fakeip.wait_for_unit("sing-box.service")
-        fakeip.wait_for_unit("sys-devices-virtual-net-${tunInbound.interface_name}.device")
-        fakeip.wait_until_succeeds("ip route get ${hosts."${target_host}"} | grep 'dev ${tunInbound.interface_name}'")
-        fakeip.succeed("dig +short A ${target_host} @${target_host} | grep '^198.18.'")
-    '';
+    with subtest("fakeip"):
+      fakeip.wait_for_unit("sing-box.service")
+      fakeip.wait_for_unit("sys-devices-virtual-net-${tunInbound.interface_name}.device")
+      fakeip.wait_until_succeeds("ip route get ${hosts."${target_host}"} | grep 'dev ${tunInbound.interface_name}'")
+      fakeip.succeed("dig +short A ${target_host} @${target_host} | grep '^198.18.'")
+  '';
 
-  }
-)
+}
diff --git a/nixos/tests/slimserver.nix b/nixos/tests/slimserver.nix
index b9821a7b1c33..2c18d0183319 100644
--- a/nixos/tests/slimserver.nix
+++ b/nixos/tests/slimserver.nix
@@ -1,49 +1,47 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "slimserver";
-    meta.maintainers = with pkgs.lib.maintainers; [ adamcstephens ];
+{ pkgs, ... }:
+{
+  name = "slimserver";
+  meta.maintainers = with pkgs.lib.maintainers; [ adamcstephens ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.slimserver.enable = true;
-        services.squeezelite = {
-          enable = true;
-          extraArguments = "-s 127.0.0.1 -d slimproto=info";
-        };
-        boot.kernelModules = [ "snd-dummy" ];
+  nodes.machine =
+    { ... }:
+    {
+      services.slimserver.enable = true;
+      services.squeezelite = {
+        enable = true;
+        extraArguments = "-s 127.0.0.1 -d slimproto=info";
       };
+      boot.kernelModules = [ "snd-dummy" ];
+    };
 
-    testScript = # python
-      ''
-        import json
-        rpc_get_player = {
-            "id": 1,
-            "method": "slim.request",
-            "params":[0,["player", "id", "0", "?"]]
-        }
+  testScript = # python
+    ''
+      import json
+      rpc_get_player = {
+          "id": 1,
+          "method": "slim.request",
+          "params":[0,["player", "id", "0", "?"]]
+      }
 
-        with subtest("slimserver is started"):
-            machine.wait_for_unit("slimserver.service")
-            # give slimserver a moment to report errors
-            machine.sleep(2)
-            machine.wait_until_succeeds("journalctl -u slimserver.service | grep 'Starting Lyrion Music'", timeout=120)
-            machine.wait_for_open_port(9000)
+      with subtest("slimserver is started"):
+          machine.wait_for_unit("slimserver.service")
+          # give slimserver a moment to report errors
+          machine.sleep(2)
+          machine.wait_until_succeeds("journalctl -u slimserver.service | grep 'Starting Lyrion Music'", timeout=120)
+          machine.wait_for_open_port(9000)
 
-        with subtest('slimserver module errors are not reported'):
-            machine.fail("journalctl -u slimserver.service | grep 'throw_exception'")
-            machine.fail("journalctl -u slimserver.service | grep 'not installed'")
-            machine.fail("journalctl -u slimserver.service | grep 'not found'")
-            machine.fail("journalctl -u slimserver.service | grep 'The following CPAN modules were found but cannot work with Logitech Media Server'")
-            machine.fail("journalctl -u slimserver.service | grep 'please use the buildme.sh'")
+      with subtest('slimserver module errors are not reported'):
+          machine.fail("journalctl -u slimserver.service | grep 'throw_exception'")
+          machine.fail("journalctl -u slimserver.service | grep 'not installed'")
+          machine.fail("journalctl -u slimserver.service | grep 'not found'")
+          machine.fail("journalctl -u slimserver.service | grep 'The following CPAN modules were found but cannot work with Logitech Media Server'")
+          machine.fail("journalctl -u slimserver.service | grep 'please use the buildme.sh'")
 
-        with subtest("squeezelite player successfully connects to slimserver"):
-            machine.wait_for_unit("squeezelite.service")
-            machine.wait_until_succeeds("journalctl -u squeezelite.service | grep -E 'slimproto:[0-9]+ connected'", timeout=120)
-            player_mac = machine.wait_until_succeeds("journalctl -eu squeezelite.service | grep -E 'sendHELO:[0-9]+ mac:'", timeout=120).strip().split(" ")[-1]
-            player_id = machine.succeed(f"curl http://localhost:9000/jsonrpc.js -g -X POST -d '{json.dumps(rpc_get_player)}'")
-            assert player_mac == json.loads(player_id)["result"]["_id"], "squeezelite player not found"
-      '';
-  }
-)
+      with subtest("squeezelite player successfully connects to slimserver"):
+          machine.wait_for_unit("squeezelite.service")
+          machine.wait_until_succeeds("journalctl -u squeezelite.service | grep -E 'slimproto:[0-9]+ connected'", timeout=120)
+          player_mac = machine.wait_until_succeeds("journalctl -eu squeezelite.service | grep -E 'sendHELO:[0-9]+ mac:'", timeout=120).strip().split(" ")[-1]
+          player_id = machine.succeed(f"curl http://localhost:9000/jsonrpc.js -g -X POST -d '{json.dumps(rpc_get_player)}'")
+          assert player_mac == json.loads(player_id)["result"]["_id"], "squeezelite player not found"
+    '';
+}
diff --git a/nixos/tests/slurm.nix b/nixos/tests/slurm.nix
index 02fe38c6ecfe..cac0a671ca8b 100644
--- a/nixos/tests/slurm.nix
+++ b/nixos/tests/slurm.nix
@@ -1,177 +1,175 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    slurmconfig = {
-      services.slurm = {
-        controlMachine = "control";
-        nodeName = [ "node[1-3] CPUs=1 State=UNKNOWN" ];
-        partitionName = [ "debug Nodes=node[1-3] Default=YES MaxTime=INFINITE State=UP" ];
-        extraConfig = ''
-          AccountingStorageHost=dbd
-          AccountingStorageType=accounting_storage/slurmdbd
-        '';
-      };
-      environment.systemPackages = [ mpitest ];
-      networking.firewall.enable = false;
-      systemd.tmpfiles.rules = [
-        "f /etc/munge/munge.key 0400 munge munge - mungeverryweakkeybuteasytointegratoinatest"
-      ];
+{ lib, pkgs, ... }:
+let
+  slurmconfig = {
+    services.slurm = {
+      controlMachine = "control";
+      nodeName = [ "node[1-3] CPUs=1 State=UNKNOWN" ];
+      partitionName = [ "debug Nodes=node[1-3] Default=YES MaxTime=INFINITE State=UP" ];
+      extraConfig = ''
+        AccountingStorageHost=dbd
+        AccountingStorageType=accounting_storage/slurmdbd
+      '';
+    };
+    environment.systemPackages = [ mpitest ];
+    networking.firewall.enable = false;
+    systemd.tmpfiles.rules = [
+      "f /etc/munge/munge.key 0400 munge munge - mungeverryweakkeybuteasytointegratoinatest"
+    ];
+  };
+
+  mpitest =
+    let
+      mpitestC = pkgs.writeText "mpitest.c" ''
+        #include <stdio.h>
+        #include <stdlib.h>
+        #include <mpi.h>
+
+        int
+        main (int argc, char *argv[])
+        {
+          int rank, size, length;
+          char name[512];
+
+          MPI_Init (&argc, &argv);
+          MPI_Comm_rank (MPI_COMM_WORLD, &rank);
+          MPI_Comm_size (MPI_COMM_WORLD, &size);
+          MPI_Get_processor_name (name, &length);
+
+          if ( rank == 0 ) printf("size=%d\n", size);
+
+          printf ("%s: hello world from process %d of %d\n", name, rank, size);
+
+          MPI_Finalize ();
+
+          return EXIT_SUCCESS;
+        }
+      '';
+    in
+    pkgs.runCommand "mpitest" { } ''
+      mkdir -p $out/bin
+      ${lib.getDev pkgs.mpi}/bin/mpicc ${mpitestC} -o $out/bin/mpitest
+    '';
+in
+{
+  name = "slurm";
+
+  meta.maintainers = [ lib.maintainers.markuskowa ];
+
+  nodes =
+    let
+      computeNode =
+        { ... }:
+        {
+          imports = [ slurmconfig ];
+          # TODO slurmd port and slurmctld port should be configurations and
+          # automatically allowed by the  firewall.
+          services.slurm = {
+            client.enable = true;
+          };
+        };
+    in
+    {
+
+      control =
+        { ... }:
+        {
+          imports = [ slurmconfig ];
+          services.slurm = {
+            server.enable = true;
+          };
+        };
+
+      submit =
+        { ... }:
+        {
+          imports = [ slurmconfig ];
+          services.slurm = {
+            enableStools = true;
+          };
+        };
+
+      dbd =
+        { pkgs, ... }:
+        let
+          passFile = pkgs.writeText "dbdpassword" "password123";
+        in
+        {
+          networking.firewall.enable = false;
+          systemd.tmpfiles.rules = [
+            "f /etc/munge/munge.key 0400 munge munge - mungeverryweakkeybuteasytointegratoinatest"
+          ];
+          services.slurm.dbdserver = {
+            enable = true;
+            storagePassFile = "${passFile}";
+          };
+          services.mysql = {
+            enable = true;
+            package = pkgs.mariadb;
+            initialScript = pkgs.writeText "mysql-init.sql" ''
+              CREATE USER 'slurm'@'localhost' IDENTIFIED BY 'password123';
+              GRANT ALL PRIVILEGES ON slurm_acct_db.* TO 'slurm'@'localhost';
+            '';
+            ensureDatabases = [ "slurm_acct_db" ];
+            ensureUsers = [
+              {
+                ensurePermissions = {
+                  "slurm_acct_db.*" = "ALL PRIVILEGES";
+                };
+                name = "slurm";
+              }
+            ];
+            settings.mysqld = {
+              # recommendations from: https://slurm.schedmd.com/accounting.html#mysql-configuration
+              innodb_buffer_pool_size = "1024M";
+              innodb_log_file_size = "64M";
+              innodb_lock_wait_timeout = 900;
+            };
+          };
+        };
+
+      node1 = computeNode;
+      node2 = computeNode;
+      node3 = computeNode;
     };
 
-    mpitest =
-      let
-        mpitestC = pkgs.writeText "mpitest.c" ''
-          #include <stdio.h>
-          #include <stdlib.h>
-          #include <mpi.h>
+  testScript = ''
+    start_all()
 
-          int
-          main (int argc, char *argv[])
-          {
-            int rank, size, length;
-            char name[512];
+    # Make sure DBD is up after DB initialzation
+    with subtest("can_start_slurmdbd"):
+        dbd.succeed("systemctl restart slurmdbd")
+        dbd.wait_for_unit("slurmdbd.service")
+        dbd.wait_for_open_port(6819)
 
-            MPI_Init (&argc, &argv);
-            MPI_Comm_rank (MPI_COMM_WORLD, &rank);
-            MPI_Comm_size (MPI_COMM_WORLD, &size);
-            MPI_Get_processor_name (name, &length);
+    # there needs to be an entry for the current
+    # cluster in the database before slurmctld is restarted
+    with subtest("add_account"):
+        control.succeed("sacctmgr -i add cluster default")
+        # check for cluster entry
+        control.succeed("sacctmgr list cluster | awk '{ print $1 }' | grep default")
 
-            if ( rank == 0 ) printf("size=%d\n", size);
+    with subtest("can_start_slurmctld"):
+        control.succeed("systemctl restart slurmctld")
+        control.wait_for_unit("slurmctld.service")
 
-            printf ("%s: hello world from process %d of %d\n", name, rank, size);
+    with subtest("can_start_slurmd"):
+        for node in [node1, node2, node3]:
+            node.succeed("systemctl restart slurmd.service")
+            node.wait_for_unit("slurmd")
 
-            MPI_Finalize ();
+    # Test that the cluster works and can distribute jobs;
 
-            return EXIT_SUCCESS;
-          }
-        '';
-      in
-      pkgs.runCommand "mpitest" { } ''
-        mkdir -p $out/bin
-        ${lib.getDev pkgs.mpi}/bin/mpicc ${mpitestC} -o $out/bin/mpitest
-      '';
-  in
-  {
-    name = "slurm";
+    with subtest("run_distributed_command"):
+        # Run `hostname` on 3 nodes of the partition (so on all the 3 nodes).
+        # The output must contain the 3 different names
+        submit.succeed("srun -N 3 hostname | sort | uniq | wc -l | xargs test 3 -eq")
 
-    meta.maintainers = [ lib.maintainers.markuskowa ];
+        with subtest("check_slurm_dbd"):
+            # find the srun job from above in the database
+            control.succeed("sleep 5")
+            control.succeed("sacct | grep hostname")
 
-    nodes =
-      let
-        computeNode =
-          { ... }:
-          {
-            imports = [ slurmconfig ];
-            # TODO slurmd port and slurmctld port should be configurations and
-            # automatically allowed by the  firewall.
-            services.slurm = {
-              client.enable = true;
-            };
-          };
-      in
-      {
-
-        control =
-          { ... }:
-          {
-            imports = [ slurmconfig ];
-            services.slurm = {
-              server.enable = true;
-            };
-          };
-
-        submit =
-          { ... }:
-          {
-            imports = [ slurmconfig ];
-            services.slurm = {
-              enableStools = true;
-            };
-          };
-
-        dbd =
-          { pkgs, ... }:
-          let
-            passFile = pkgs.writeText "dbdpassword" "password123";
-          in
-          {
-            networking.firewall.enable = false;
-            systemd.tmpfiles.rules = [
-              "f /etc/munge/munge.key 0400 munge munge - mungeverryweakkeybuteasytointegratoinatest"
-            ];
-            services.slurm.dbdserver = {
-              enable = true;
-              storagePassFile = "${passFile}";
-            };
-            services.mysql = {
-              enable = true;
-              package = pkgs.mariadb;
-              initialScript = pkgs.writeText "mysql-init.sql" ''
-                CREATE USER 'slurm'@'localhost' IDENTIFIED BY 'password123';
-                GRANT ALL PRIVILEGES ON slurm_acct_db.* TO 'slurm'@'localhost';
-              '';
-              ensureDatabases = [ "slurm_acct_db" ];
-              ensureUsers = [
-                {
-                  ensurePermissions = {
-                    "slurm_acct_db.*" = "ALL PRIVILEGES";
-                  };
-                  name = "slurm";
-                }
-              ];
-              settings.mysqld = {
-                # recommendations from: https://slurm.schedmd.com/accounting.html#mysql-configuration
-                innodb_buffer_pool_size = "1024M";
-                innodb_log_file_size = "64M";
-                innodb_lock_wait_timeout = 900;
-              };
-            };
-          };
-
-        node1 = computeNode;
-        node2 = computeNode;
-        node3 = computeNode;
-      };
-
-    testScript = ''
-      start_all()
-
-      # Make sure DBD is up after DB initialzation
-      with subtest("can_start_slurmdbd"):
-          dbd.succeed("systemctl restart slurmdbd")
-          dbd.wait_for_unit("slurmdbd.service")
-          dbd.wait_for_open_port(6819)
-
-      # there needs to be an entry for the current
-      # cluster in the database before slurmctld is restarted
-      with subtest("add_account"):
-          control.succeed("sacctmgr -i add cluster default")
-          # check for cluster entry
-          control.succeed("sacctmgr list cluster | awk '{ print $1 }' | grep default")
-
-      with subtest("can_start_slurmctld"):
-          control.succeed("systemctl restart slurmctld")
-          control.wait_for_unit("slurmctld.service")
-
-      with subtest("can_start_slurmd"):
-          for node in [node1, node2, node3]:
-              node.succeed("systemctl restart slurmd.service")
-              node.wait_for_unit("slurmd")
-
-      # Test that the cluster works and can distribute jobs;
-
-      with subtest("run_distributed_command"):
-          # Run `hostname` on 3 nodes of the partition (so on all the 3 nodes).
-          # The output must contain the 3 different names
-          submit.succeed("srun -N 3 hostname | sort | uniq | wc -l | xargs test 3 -eq")
-
-          with subtest("check_slurm_dbd"):
-              # find the srun job from above in the database
-              control.succeed("sleep 5")
-              control.succeed("sacct | grep hostname")
-
-      with subtest("run_PMIx_mpitest"):
-          submit.succeed("srun -N 3 --mpi=pmix mpitest | grep size=3")
-    '';
-  }
-)
+    with subtest("run_PMIx_mpitest"):
+        submit.succeed("srun -N 3 --mpi=pmix mpitest | grep size=3")
+  '';
+}
diff --git a/nixos/tests/smokeping.nix b/nixos/tests/smokeping.nix
index 9aa25ee49d6d..ec359176fa6b 100644
--- a/nixos/tests/smokeping.nix
+++ b/nixos/tests/smokeping.nix
@@ -1,45 +1,43 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "smokeping";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ cransom ];
-    };
+{ pkgs, ... }:
+{
+  name = "smokeping";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ cransom ];
+  };
 
-    nodes = {
-      sm =
-        { ... }:
-        {
-          networking.domain = "example.com"; # FQDN: sm.example.com
-          services.smokeping = {
-            enable = true;
-            mailHost = "127.0.0.2";
-            probeConfig = ''
-              + FPing
-              binary = /run/wrappers/bin/fping
-              offset = 0%
-            '';
-          };
+  nodes = {
+    sm =
+      { ... }:
+      {
+        networking.domain = "example.com"; # FQDN: sm.example.com
+        services.smokeping = {
+          enable = true;
+          mailHost = "127.0.0.2";
+          probeConfig = ''
+            + FPing
+            binary = /run/wrappers/bin/fping
+            offset = 0%
+          '';
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      sm.wait_for_unit("smokeping")
-      sm.wait_for_unit("nginx")
-      sm.wait_for_file("/var/lib/smokeping/data/Local/LocalMachine.rrd")
-      sm.succeed("curl -s -f localhost/smokeping.fcgi?target=Local")
-      # Check that there's a helpful page without explicit path as well.
-      sm.succeed("curl -s -f localhost")
-      sm.succeed("ls /var/lib/smokeping/cache/Local/LocalMachine_mini.png")
-      sm.succeed("ls /var/lib/smokeping/cache/index.html")
+  testScript = ''
+    start_all()
+    sm.wait_for_unit("smokeping")
+    sm.wait_for_unit("nginx")
+    sm.wait_for_file("/var/lib/smokeping/data/Local/LocalMachine.rrd")
+    sm.succeed("curl -s -f localhost/smokeping.fcgi?target=Local")
+    # Check that there's a helpful page without explicit path as well.
+    sm.succeed("curl -s -f localhost")
+    sm.succeed("ls /var/lib/smokeping/cache/Local/LocalMachine_mini.png")
+    sm.succeed("ls /var/lib/smokeping/cache/index.html")
 
-      # stop and start the service like nixos-rebuild would do
-      # see https://github.com/NixOS/nixpkgs/issues/265953)
-      sm.succeed("systemctl stop smokeping")
-      sm.succeed("systemctl start smokeping")
-      # ensure all services restarted properly
-      sm.succeed("systemctl --failed | grep -q '0 loaded units listed'")
-    '';
-  }
-)
+    # stop and start the service like nixos-rebuild would do
+    # see https://github.com/NixOS/nixpkgs/issues/265953)
+    sm.succeed("systemctl stop smokeping")
+    sm.succeed("systemctl start smokeping")
+    # ensure all services restarted properly
+    sm.succeed("systemctl --failed | grep -q '0 loaded units listed'")
+  '';
+}
diff --git a/nixos/tests/snapper.nix b/nixos/tests/snapper.nix
index 683d2f58ea3c..4a03b85cc71d 100644
--- a/nixos/tests/snapper.nix
+++ b/nixos/tests/snapper.nix
@@ -1,45 +1,43 @@
-import ./make-test-python.nix (
-  { ... }:
-  {
-    name = "snapper";
+{ ... }:
+{
+  name = "snapper";
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
-        boot.initrd.postDeviceCommands = ''
-          ${pkgs.btrfs-progs}/bin/mkfs.btrfs -f -L aux /dev/vdb
-        '';
-
-        virtualisation.emptyDiskImages = [ 4096 ];
-
-        virtualisation.fileSystems = {
-          "/home" = {
-            device = "/dev/disk/by-label/aux";
-            fsType = "btrfs";
-          };
-        };
-        services.snapper.configs.home.SUBVOLUME = "/home";
-        services.snapper.filters = "/nix";
-      };
-
-    testScript =
-      { nodes, ... }:
-      let
-        inherit (nodes.machine.services.snapper) snapshotRootOnBoot;
-      in
-      ''
-        machine.succeed("btrfs subvolume create /home/.snapshots")
-        machine.succeed("snapper -c home list")
-        machine.succeed("snapper -c home create --description empty")
-        machine.succeed("echo test > /home/file")
-        machine.succeed("snapper -c home create --description file")
-        machine.succeed("snapper -c home status 1..2")
-        machine.succeed("snapper -c home undochange 1..2")
-        machine.fail("ls /home/file")
-        machine.succeed("snapper -c home delete 2")
-        machine.succeed("systemctl --wait start snapper-timeline.service")
-        machine.succeed("systemctl --wait start snapper-cleanup.service")
-        machine.${if snapshotRootOnBoot then "succeed" else "fail"}("systemctl cat snapper-boot.service")
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      boot.initrd.postDeviceCommands = ''
+        ${pkgs.btrfs-progs}/bin/mkfs.btrfs -f -L aux /dev/vdb
       '';
-  }
-)
+
+      virtualisation.emptyDiskImages = [ 4096 ];
+
+      virtualisation.fileSystems = {
+        "/home" = {
+          device = "/dev/disk/by-label/aux";
+          fsType = "btrfs";
+        };
+      };
+      services.snapper.configs.home.SUBVOLUME = "/home";
+      services.snapper.filters = "/nix";
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      inherit (nodes.machine.services.snapper) snapshotRootOnBoot;
+    in
+    ''
+      machine.succeed("btrfs subvolume create /home/.snapshots")
+      machine.succeed("snapper -c home list")
+      machine.succeed("snapper -c home create --description empty")
+      machine.succeed("echo test > /home/file")
+      machine.succeed("snapper -c home create --description file")
+      machine.succeed("snapper -c home status 1..2")
+      machine.succeed("snapper -c home undochange 1..2")
+      machine.fail("ls /home/file")
+      machine.succeed("snapper -c home delete 2")
+      machine.succeed("systemctl --wait start snapper-timeline.service")
+      machine.succeed("systemctl --wait start snapper-cleanup.service")
+      machine.${if snapshotRootOnBoot then "succeed" else "fail"}("systemctl cat snapper-boot.service")
+    '';
+}
diff --git a/nixos/tests/snmpd.nix b/nixos/tests/snmpd.nix
index 24d414e03d4d..619c08426df9 100644
--- a/nixos/tests/snmpd.nix
+++ b/nixos/tests/snmpd.nix
@@ -1,26 +1,24 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "snmpd";
+{ pkgs, lib, ... }:
+{
+  name = "snmpd";
 
-    nodes.snmpd = {
-      environment.systemPackages = with pkgs; [
-        net-snmp
-      ];
+  nodes.snmpd = {
+    environment.systemPackages = with pkgs; [
+      net-snmp
+    ];
 
-      services.snmpd = {
-        enable = true;
-        configText = ''
-          rocommunity public
-        '';
-      };
+    services.snmpd = {
+      enable = true;
+      configText = ''
+        rocommunity public
+      '';
     };
+  };
 
-    testScript = ''
-      start_all();
-      machine.wait_for_unit("snmpd.service")
-      machine.succeed("snmpwalk -v 2c -c public localhost | grep SNMPv2-MIB::sysName.0");
-    '';
+  testScript = ''
+    start_all();
+    machine.wait_for_unit("snmpd.service")
+    machine.succeed("snmpwalk -v 2c -c public localhost | grep SNMPv2-MIB::sysName.0");
+  '';
 
-  }
-)
+}
diff --git a/nixos/tests/soapui.nix b/nixos/tests/soapui.nix
index 834369f9dcc7..9906678e560f 100644
--- a/nixos/tests/soapui.nix
+++ b/nixos/tests/soapui.nix
@@ -1,29 +1,27 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "soapui";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
+{ pkgs, ... }:
+{
+  name = "soapui";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+
+      environment.systemPackages = [ pkgs.soapui ];
     };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
-
-        services.xserver.enable = true;
-
-        environment.systemPackages = [ pkgs.soapui ];
-      };
-
-    testScript = ''
-      machine.wait_for_x()
-      machine.succeed("soapui >&2 &")
-      machine.wait_for_window(r"SoapUI \d+\.\d+\.\d+")
-      machine.sleep(1)
-      machine.screenshot("soapui")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_x()
+    machine.succeed("soapui >&2 &")
+    machine.wait_for_window(r"SoapUI \d+\.\d+\.\d+")
+    machine.sleep(1)
+    machine.screenshot("soapui")
+  '';
+}
diff --git a/nixos/tests/soft-serve.nix b/nixos/tests/soft-serve.nix
index 1fa365c93ef1..a9bed17a1976 100644
--- a/nixos/tests/soft-serve.nix
+++ b/nixos/tests/soft-serve.nix
@@ -1,110 +1,108 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
-    sshPort = 8231;
-    httpPort = 8232;
-    statsPort = 8233;
-    gitPort = 8418;
-  in
-  {
-    name = "soft-serve";
-    meta.maintainers = with lib.maintainers; [ dadada ];
-    nodes = {
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = with pkgs; [
-            curl
-            git
-            openssh
-          ];
-          environment.etc.sshKey = {
-            source = snakeOilPrivateKey;
-            mode = "0600";
+{ pkgs, lib, ... }:
+let
+  inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+  sshPort = 8231;
+  httpPort = 8232;
+  statsPort = 8233;
+  gitPort = 8418;
+in
+{
+  name = "soft-serve";
+  meta.maintainers = with lib.maintainers; [ dadada ];
+  nodes = {
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [
+          curl
+          git
+          openssh
+        ];
+        environment.etc.sshKey = {
+          source = snakeOilPrivateKey;
+          mode = "0600";
+        };
+      };
+
+    server =
+      { config, ... }:
+      {
+        services.soft-serve = {
+          enable = true;
+          settings = {
+            name = "TestServer";
+            ssh.listen_addr = ":${toString sshPort}";
+            git.listen_addr = ":${toString gitPort}";
+            http.listen_addr = ":${toString httpPort}";
+            stats.listen_addr = ":${toString statsPort}";
+            initial_admin_keys = [ snakeOilPublicKey ];
           };
         };
+        networking.firewall.allowedTCPPorts = [
+          sshPort
+          httpPort
+          statsPort
+        ];
+      };
+  };
 
-      server =
-        { config, ... }:
-        {
-          services.soft-serve = {
-            enable = true;
-            settings = {
-              name = "TestServer";
-              ssh.listen_addr = ":${toString sshPort}";
-              git.listen_addr = ":${toString gitPort}";
-              http.listen_addr = ":${toString httpPort}";
-              stats.listen_addr = ":${toString statsPort}";
-              initial_admin_keys = [ snakeOilPublicKey ];
-            };
-          };
-          networking.firewall.allowedTCPPorts = [
-            sshPort
-            httpPort
-            statsPort
-          ];
-        };
-    };
+  testScript =
+    { ... }:
+    ''
+      SSH_PORT = ${toString sshPort}
+      HTTP_PORT = ${toString httpPort}
+      STATS_PORT = ${toString statsPort}
+      KEY = "${snakeOilPublicKey}"
+      SSH_KEY = "/etc/sshKey"
+      SSH_COMMAND = f"ssh -p {SSH_PORT} -i {SSH_KEY} -o StrictHostKeyChecking=no"
+      TEST_DIR = "/tmp/test"
+      GIT = f"git -C {TEST_DIR}"
 
-    testScript =
-      { ... }:
-      ''
-        SSH_PORT = ${toString sshPort}
-        HTTP_PORT = ${toString httpPort}
-        STATS_PORT = ${toString statsPort}
-        KEY = "${snakeOilPublicKey}"
-        SSH_KEY = "/etc/sshKey"
-        SSH_COMMAND = f"ssh -p {SSH_PORT} -i {SSH_KEY} -o StrictHostKeyChecking=no"
-        TEST_DIR = "/tmp/test"
-        GIT = f"git -C {TEST_DIR}"
+      for machine in client, server:
+          machine.wait_for_unit("network.target")
 
-        for machine in client, server:
-            machine.wait_for_unit("network.target")
+      server.wait_for_unit("soft-serve.service")
+      server.wait_for_open_port(SSH_PORT)
 
-        server.wait_for_unit("soft-serve.service")
-        server.wait_for_open_port(SSH_PORT)
+      with subtest("Get info"):
+          status, test = client.execute(f"{SSH_COMMAND} server info")
+          if status != 0:
+              raise Exception("Failed to get SSH info")
+          key = " ".join(KEY.split(" ")[0:2])
+          if not key in test:
+              raise Exception("Admin key must be configured correctly")
 
-        with subtest("Get info"):
-            status, test = client.execute(f"{SSH_COMMAND} server info")
-            if status != 0:
-                raise Exception("Failed to get SSH info")
-            key = " ".join(KEY.split(" ")[0:2])
-            if not key in test:
-                raise Exception("Admin key must be configured correctly")
+      with subtest("Create user"):
+          client.succeed(f"{SSH_COMMAND} server user create beatrice")
+          client.succeed(f"{SSH_COMMAND} server user info beatrice")
 
-        with subtest("Create user"):
-            client.succeed(f"{SSH_COMMAND} server user create beatrice")
-            client.succeed(f"{SSH_COMMAND} server user info beatrice")
+      with subtest("Create repo"):
+          client.succeed(f"git init {TEST_DIR}")
+          client.succeed(f"{GIT} config --global user.email you@example.com")
+          client.succeed(f"touch {TEST_DIR}/foo")
+          client.succeed(f"{GIT} add foo")
+          client.succeed(f"{GIT} commit --allow-empty -m test")
+          client.succeed(f"{GIT} remote add origin git@server:test")
+          client.succeed(f"GIT_SSH_COMMAND='{SSH_COMMAND}' {GIT} push -u origin master")
+          client.execute("rm -r /tmp/test")
 
-        with subtest("Create repo"):
-            client.succeed(f"git init {TEST_DIR}")
-            client.succeed(f"{GIT} config --global user.email you@example.com")
-            client.succeed(f"touch {TEST_DIR}/foo")
-            client.succeed(f"{GIT} add foo")
-            client.succeed(f"{GIT} commit --allow-empty -m test")
-            client.succeed(f"{GIT} remote add origin git@server:test")
-            client.succeed(f"GIT_SSH_COMMAND='{SSH_COMMAND}' {GIT} push -u origin master")
-            client.execute("rm -r /tmp/test")
+      server.wait_for_open_port(HTTP_PORT)
 
-        server.wait_for_open_port(HTTP_PORT)
+      with subtest("Clone over HTTP"):
+          client.succeed(f"curl --connect-timeout 10 http://server:{HTTP_PORT}/")
+          client.succeed(f"git clone http://server:{HTTP_PORT}/test /tmp/test")
+          client.execute("rm -r /tmp/test")
 
-        with subtest("Clone over HTTP"):
-            client.succeed(f"curl --connect-timeout 10 http://server:{HTTP_PORT}/")
-            client.succeed(f"git clone http://server:{HTTP_PORT}/test /tmp/test")
-            client.execute("rm -r /tmp/test")
+      with subtest("Clone over SSH"):
+          client.succeed(f"GIT_SSH_COMMAND='{SSH_COMMAND}' git clone git@server:test /tmp/test")
+          client.execute("rm -r /tmp/test")
 
-        with subtest("Clone over SSH"):
-            client.succeed(f"GIT_SSH_COMMAND='{SSH_COMMAND}' git clone git@server:test /tmp/test")
-            client.execute("rm -r /tmp/test")
-
-        with subtest("Get stats over HTTP"):
-            server.wait_for_open_port(STATS_PORT)
-            status, test = client.execute(f"curl --connect-timeout 10 http://server:{STATS_PORT}/metrics")
-            if status != 0:
-                raise Exception("Failed to get metrics from status port")
-            if not "go_gc_duration_seconds_count" in test:
-                raise Exception("Metrics did not contain key 'go_gc_duration_seconds_count'")
-      '';
-  }
-)
+      with subtest("Get stats over HTTP"):
+          server.wait_for_open_port(STATS_PORT)
+          status, test = client.execute(f"curl --connect-timeout 10 http://server:{STATS_PORT}/metrics")
+          if status != 0:
+              raise Exception("Failed to get metrics from status port")
+          if not "go_gc_duration_seconds_count" in test:
+              raise Exception("Metrics did not contain key 'go_gc_duration_seconds_count'")
+    '';
+}
diff --git a/nixos/tests/sogo.nix b/nixos/tests/sogo.nix
index a3ad3bd5b7ac..38e13a506b69 100644
--- a/nixos/tests/sogo.nix
+++ b/nixos/tests/sogo.nix
@@ -1,65 +1,63 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "sogo";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
-    };
+{ pkgs, ... }:
+{
+  name = "sogo";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
 
-    nodes = {
-      sogo =
-        { config, pkgs, ... }:
-        {
-          services.nginx.enable = true;
+  nodes = {
+    sogo =
+      { config, pkgs, ... }:
+      {
+        services.nginx.enable = true;
 
-          services.mysql = {
-            enable = true;
-            package = pkgs.mariadb;
-            ensureDatabases = [ "sogo" ];
-            ensureUsers = [
-              {
-                name = "sogo";
-                ensurePermissions = {
-                  "sogo.*" = "ALL PRIVILEGES";
-                };
-              }
-            ];
-          };
-
-          services.sogo = {
-            enable = true;
-            timezone = "Europe/Berlin";
-            extraConfig = ''
-              WOWorkersCount = 1;
-
-              SOGoUserSources = (
-                {
-                  type = sql;
-                  userPasswordAlgorithm = md5;
-                  viewURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_users";
-                  canAuthenticate = YES;
-                  id = users;
-                }
-              );
-
-              SOGoProfileURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_user_profile";
-              OCSFolderInfoURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_folder_info";
-              OCSSessionsFolderURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_sessions_folder";
-              OCSEMailAlarmsFolderURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_alarms_folder";
-              OCSStoreURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_store";
-              OCSAclURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_acl";
-              OCSCacheFolderURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_cache_folder";
-            '';
-          };
+        services.mysql = {
+          enable = true;
+          package = pkgs.mariadb;
+          ensureDatabases = [ "sogo" ];
+          ensureUsers = [
+            {
+              name = "sogo";
+              ensurePermissions = {
+                "sogo.*" = "ALL PRIVILEGES";
+              };
+            }
+          ];
         };
-    };
 
-    testScript = ''
-      start_all()
-      sogo.wait_for_unit("multi-user.target")
-      sogo.wait_for_open_port(20000)
-      sogo.wait_for_open_port(80)
-      sogo.succeed("curl -sSfL http://sogo/SOGo")
-    '';
-  }
-)
+        services.sogo = {
+          enable = true;
+          timezone = "Europe/Berlin";
+          extraConfig = ''
+            WOWorkersCount = 1;
+
+            SOGoUserSources = (
+              {
+                type = sql;
+                userPasswordAlgorithm = md5;
+                viewURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_users";
+                canAuthenticate = YES;
+                id = users;
+              }
+            );
+
+            SOGoProfileURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_user_profile";
+            OCSFolderInfoURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_folder_info";
+            OCSSessionsFolderURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_sessions_folder";
+            OCSEMailAlarmsFolderURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_alarms_folder";
+            OCSStoreURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_store";
+            OCSAclURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_acl";
+            OCSCacheFolderURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_cache_folder";
+          '';
+        };
+      };
+  };
+
+  testScript = ''
+    start_all()
+    sogo.wait_for_unit("multi-user.target")
+    sogo.wait_for_open_port(20000)
+    sogo.wait_for_open_port(80)
+    sogo.succeed("curl -sSfL http://sogo/SOGo")
+  '';
+}
diff --git a/nixos/tests/soju.nix b/nixos/tests/soju.nix
index 71f457b14204..53acae2a57c7 100644
--- a/nixos/tests/soju.nix
+++ b/nixos/tests/soju.nix
@@ -1,35 +1,33 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    certs = import ./common/acme/server/snakeoil-certs.nix;
-    domain = certs.domain;
+{ pkgs, lib, ... }:
+let
+  certs = import ./common/acme/server/snakeoil-certs.nix;
+  domain = certs.domain;
 
-    user = "testuser";
-    pass = "hunter2";
-  in
-  {
-    name = "soju";
-    meta.maintainers = [ ];
+  user = "testuser";
+  pass = "hunter2";
+in
+{
+  name = "soju";
+  meta.maintainers = [ ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.soju = {
-          enable = true;
-          adminSocket.enable = true;
-          hostName = domain;
-          tlsCertificate = certs.${domain}.cert;
-          tlsCertificateKey = certs.${domain}.key;
-        };
+  nodes.machine =
+    { ... }:
+    {
+      services.soju = {
+        enable = true;
+        adminSocket.enable = true;
+        hostName = domain;
+        tlsCertificate = certs.${domain}.cert;
+        tlsCertificateKey = certs.${domain}.key;
       };
+    };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine.wait_for_unit("soju")
-      machine.wait_for_file("/run/soju/admin")
+    machine.wait_for_unit("soju")
+    machine.wait_for_file("/run/soju/admin")
 
-      machine.succeed("sojuctl user create -username ${user} -password ${pass}")
-    '';
-  }
-)
+    machine.succeed("sojuctl user create -username ${user} -password ${pass}")
+  '';
+}
diff --git a/nixos/tests/solanum.nix b/nixos/tests/solanum.nix
index be3f4bfd45ae..a2c3013125e8 100644
--- a/nixos/tests/solanum.nix
+++ b/nixos/tests/solanum.nix
@@ -9,100 +9,98 @@ let
   iiDir = "/tmp/irc";
 in
 
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "solanum";
-    nodes =
-      {
-        "${server}" = {
-          networking.firewall.allowedTCPPorts = [ ircPort ];
-          services.solanum = {
-            enable = true;
-            motd = ''
-              The default MOTD doesn't contain the word "nixos" in it.
-              This one does.
-            '';
-          };
+{ pkgs, lib, ... }:
+{
+  name = "solanum";
+  nodes =
+    {
+      "${server}" = {
+        networking.firewall.allowedTCPPorts = [ ircPort ];
+        services.solanum = {
+          enable = true;
+          motd = ''
+            The default MOTD doesn't contain the word "nixos" in it.
+            This one does.
+          '';
         };
-      }
-      // lib.listToAttrs (
-        builtins.map (
-          client:
-          lib.nameValuePair client {
-            imports = [
-              ./common/user-account.nix
-            ];
+      };
+    }
+    // lib.listToAttrs (
+      builtins.map (
+        client:
+        lib.nameValuePair client {
+          imports = [
+            ./common/user-account.nix
+          ];
 
-            systemd.services.ii = {
-              requires = [ "network.target" ];
-              wantedBy = [ "default.target" ];
+          systemd.services.ii = {
+            requires = [ "network.target" ];
+            wantedBy = [ "default.target" ];
 
-              serviceConfig = {
-                Type = "simple";
-                ExecPreStartPre = "mkdir -p ${iiDir}";
-                ExecStart = ''
-                  ${lib.getBin pkgs.ii}/bin/ii -n ${client} -s ${server} -i ${iiDir}
-                '';
-                User = "alice";
-              };
+            serviceConfig = {
+              Type = "simple";
+              ExecPreStartPre = "mkdir -p ${iiDir}";
+              ExecStart = ''
+                ${lib.getBin pkgs.ii}/bin/ii -n ${client} -s ${server} -i ${iiDir}
+              '';
+              User = "alice";
             };
-          }
-        ) clients
-      );
+          };
+        }
+      ) clients
+    );
 
-    testScript =
-      let
-        msg = client: "Hello, my name is ${client}";
-        clientScript =
-          client:
-          [
-            ''
-              ${client}.wait_for_unit("network.target")
-              ${client}.systemctl("start ii")
-              ${client}.wait_for_unit("ii")
-              ${client}.wait_for_file("${iiDir}/${server}/out")
-            ''
-            # look for the custom text in the MOTD.
-            ''
-              ${client}.wait_until_succeeds("grep 'nixos' ${iiDir}/${server}/out")
-            ''
-            # wait until first PING from server arrives before joining,
-            # so we don't try it too early
-            ''
-              ${client}.wait_until_succeeds("grep 'PING' ${iiDir}/${server}/out")
-            ''
-            # join ${channel}
-            ''
-              ${client}.succeed("echo '/j #${channel}' > ${iiDir}/${server}/in")
-              ${client}.wait_for_file("${iiDir}/${server}/#${channel}/in")
-            ''
-            # send a greeting
-            ''
-              ${client}.succeed(
-                  "echo '${msg client}' > ${iiDir}/${server}/#${channel}/in"
-              )
-            ''
-            # check that all greetings arrived on all clients
-          ]
-          ++ builtins.map (other: ''
+  testScript =
+    let
+      msg = client: "Hello, my name is ${client}";
+      clientScript =
+        client:
+        [
+          ''
+            ${client}.wait_for_unit("network.target")
+            ${client}.systemctl("start ii")
+            ${client}.wait_for_unit("ii")
+            ${client}.wait_for_file("${iiDir}/${server}/out")
+          ''
+          # look for the custom text in the MOTD.
+          ''
+            ${client}.wait_until_succeeds("grep 'nixos' ${iiDir}/${server}/out")
+          ''
+          # wait until first PING from server arrives before joining,
+          # so we don't try it too early
+          ''
+            ${client}.wait_until_succeeds("grep 'PING' ${iiDir}/${server}/out")
+          ''
+          # join ${channel}
+          ''
+            ${client}.succeed("echo '/j #${channel}' > ${iiDir}/${server}/in")
+            ${client}.wait_for_file("${iiDir}/${server}/#${channel}/in")
+          ''
+          # send a greeting
+          ''
             ${client}.succeed(
-                "grep '${msg other}$' ${iiDir}/${server}/#${channel}/out"
+                "echo '${msg client}' > ${iiDir}/${server}/#${channel}/in"
             )
-          '') clients;
+          ''
+          # check that all greetings arrived on all clients
+        ]
+        ++ builtins.map (other: ''
+          ${client}.succeed(
+              "grep '${msg other}$' ${iiDir}/${server}/#${channel}/out"
+          )
+        '') clients;
 
-        # foldl', but requires a non-empty list instead of a start value
-        reduce = f: list: builtins.foldl' f (builtins.head list) (builtins.tail list);
-      in
-      ''
-        start_all()
-        ${server}.systemctl("status solanum")
-        ${server}.wait_for_open_port(${toString ircPort})
+      # foldl', but requires a non-empty list instead of a start value
+      reduce = f: list: builtins.foldl' f (builtins.head list) (builtins.tail list);
+    in
+    ''
+      start_all()
+      ${server}.systemctl("status solanum")
+      ${server}.wait_for_open_port(${toString ircPort})
 
-        # run clientScript for all clients so that every list
-        # entry is executed by every client before advancing
-        # to the next one.
-      ''
-      + lib.concatStrings (reduce (lib.zipListsWith (cs: c: cs + c)) (builtins.map clientScript clients));
-  }
-)
+      # run clientScript for all clients so that every list
+      # entry is executed by every client before advancing
+      # to the next one.
+    ''
+    + lib.concatStrings (reduce (lib.zipListsWith (cs: c: cs + c)) (builtins.map clientScript clients));
+}
diff --git a/nixos/tests/sonarr.nix b/nixos/tests/sonarr.nix
index e9d6bdf62594..44dcaf3c893a 100644
--- a/nixos/tests/sonarr.nix
+++ b/nixos/tests/sonarr.nix
@@ -1,20 +1,18 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "sonarr";
-    meta.maintainers = with lib.maintainers; [ etu ];
+{
+  name = "sonarr";
+  meta.maintainers = with lib.maintainers; [ etu ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.sonarr.enable = true;
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.sonarr.enable = true;
+    };
 
-    testScript = ''
-      machine.wait_for_unit("sonarr.service")
-      machine.wait_for_open_port(8989)
-      machine.succeed("curl --fail http://localhost:8989/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("sonarr.service")
+    machine.wait_for_open_port(8989)
+    machine.succeed("curl --fail http://localhost:8989/")
+  '';
+}
diff --git a/nixos/tests/sonic-server.nix b/nixos/tests/sonic-server.nix
index bef0316d66f0..40f9802ec391 100644
--- a/nixos/tests/sonic-server.nix
+++ b/nixos/tests/sonic-server.nix
@@ -1,27 +1,25 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "sonic-server";
+{ pkgs, lib, ... }:
+{
+  name = "sonic-server";
 
-    meta = {
-      maintainers = with lib.maintainers; [ anthonyroussel ];
+  meta = {
+    maintainers = with lib.maintainers; [ anthonyroussel ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.sonic-server.enable = true;
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.sonic-server.enable = true;
-      };
+  testScript = ''
+    machine.start()
 
-    testScript = ''
-      machine.start()
+    machine.wait_for_unit("sonic-server.service")
+    machine.wait_for_open_port(1491)
 
-      machine.wait_for_unit("sonic-server.service")
-      machine.wait_for_open_port(1491)
-
-      with subtest("Check control mode"):
-        result = machine.succeed('(echo START control; sleep 1; echo PING; echo QUIT) | nc localhost 1491').splitlines()
-        assert result[2] == "PONG", f"expected 'PONG', got '{result[2]}'"
-    '';
-  }
-)
+    with subtest("Check control mode"):
+      result = machine.succeed('(echo START control; sleep 1; echo PING; echo QUIT) | nc localhost 1491').splitlines()
+      assert result[2] == "PONG", f"expected 'PONG', got '{result[2]}'"
+  '';
+}
diff --git a/nixos/tests/spacecookie.nix b/nixos/tests/spacecookie.nix
index 696cdee902c4..79d348e33ff3 100644
--- a/nixos/tests/spacecookie.nix
+++ b/nixos/tests/spacecookie.nix
@@ -5,55 +5,53 @@ let
   fileContent = "Hello Gopher!\n";
   fileName = "file.txt";
 in
-import ./make-test-python.nix (
-  { ... }:
-  {
-    name = "spacecookie";
-    nodes = {
-      ${gopherHost} = {
-        systemd.services.spacecookie = {
-          preStart = ''
-            mkdir -p ${gopherRoot}/directory
-            printf "%s" "${fileContent}" > ${gopherRoot}/${fileName}
-          '';
-        };
-
-        services.spacecookie = {
-          enable = true;
-          openFirewall = true;
-          settings = {
-            root = gopherRoot;
-            hostname = gopherHost;
-          };
-        };
+{ ... }:
+{
+  name = "spacecookie";
+  nodes = {
+    ${gopherHost} = {
+      systemd.services.spacecookie = {
+        preStart = ''
+          mkdir -p ${gopherRoot}/directory
+          printf "%s" "${fileContent}" > ${gopherRoot}/${fileName}
+        '';
       };
 
-      ${gopherClient} = { };
+      services.spacecookie = {
+        enable = true;
+        openFirewall = true;
+        settings = {
+          root = gopherRoot;
+          hostname = gopherHost;
+        };
+      };
     };
 
-    testScript = ''
-      start_all()
+    ${gopherClient} = { };
+  };
 
-      # with daemon type notify, the unit being started
-      # should also mean the port is open
-      ${gopherHost}.wait_for_unit("spacecookie.service")
-      ${gopherClient}.wait_for_unit("network.target")
+  testScript = ''
+    start_all()
 
-      fileResponse = ${gopherClient}.succeed("curl -f -s gopher://${gopherHost}/0/${fileName}")
+    # with daemon type notify, the unit being started
+    # should also mean the port is open
+    ${gopherHost}.wait_for_unit("spacecookie.service")
+    ${gopherClient}.wait_for_unit("network.target")
 
-      # the file response should return our created file exactly
-      if not (fileResponse == "${builtins.replaceStrings [ "\n" ] [ "\\n" ] fileContent}"):
-          raise Exception("Unexpected file response")
+    fileResponse = ${gopherClient}.succeed("curl -f -s gopher://${gopherHost}/0/${fileName}")
 
-      # sanity check on the directory listing: we serve a directory and a file
-      # via gopher, so the directory listing should have exactly two entries,
-      # one with gopher file type 0 (file) and one with file type 1 (directory).
-      dirResponse = ${gopherClient}.succeed("curl -f -s gopher://${gopherHost}")
-      dirEntries = [l[0] for l in dirResponse.split("\n") if len(l) > 0]
-      dirEntries.sort()
+    # the file response should return our created file exactly
+    if not (fileResponse == "${builtins.replaceStrings [ "\n" ] [ "\\n" ] fileContent}"):
+        raise Exception("Unexpected file response")
 
-      if not (["0", "1"] == dirEntries):
-          raise Exception("Unexpected directory response")
-    '';
-  }
-)
+    # sanity check on the directory listing: we serve a directory and a file
+    # via gopher, so the directory listing should have exactly two entries,
+    # one with gopher file type 0 (file) and one with file type 1 (directory).
+    dirResponse = ${gopherClient}.succeed("curl -f -s gopher://${gopherHost}")
+    dirEntries = [l[0] for l in dirResponse.split("\n") if len(l) > 0]
+    dirEntries.sort()
+
+    if not (["0", "1"] == dirEntries):
+        raise Exception("Unexpected directory response")
+  '';
+}
diff --git a/nixos/tests/sqlite3-to-mysql.nix b/nixos/tests/sqlite3-to-mysql.nix
index 25ffa13ba4f5..4c1a40f74148 100644
--- a/nixos/tests/sqlite3-to-mysql.nix
+++ b/nixos/tests/sqlite3-to-mysql.nix
@@ -1,70 +1,68 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  /*
-    This test suite replaces the typical pytestCheckHook function in
-    sqlite3-to-mysql due to the need of a running mysql instance.
-  */
+/*
+  This test suite replaces the typical pytestCheckHook function in
+  sqlite3-to-mysql due to the need of a running mysql instance.
+*/
 
-  {
-    name = "sqlite3-to-mysql";
-    meta.maintainers = with lib.maintainers; [ gador ];
+{
+  name = "sqlite3-to-mysql";
+  meta.maintainers = with lib.maintainers; [ gador ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = with pkgs; [
-          sqlite3-to-mysql
-          # create one coherent python environment
-          (python3.withPackages (
-            ps:
-            sqlite3-to-mysql.propagatedBuildInputs
-            ++ [
-              python3Packages.pytest
-              python3Packages.pytest-mock
-              python3Packages.pytest-timeout
-              python3Packages.factory-boy
-              python3Packages.docker # only needed so import does not fail
-              sqlite3-to-mysql
-            ]
-          ))
-        ];
-        services.mysql = {
-          package = pkgs.mariadb;
-          enable = true;
-          # from https://github.com/techouse/sqlite3-to-mysql/blob/master/tests/conftest.py
-          # and https://github.com/techouse/sqlite3-to-mysql/blob/master/.github/workflows/test.yml
-          initialScript = pkgs.writeText "mysql-init.sql" ''
-            create database test_db DEFAULT CHARACTER SET utf8mb4;
-            create user tester identified by 'testpass';
-            grant all on test_db.* to tester;
-            create user tester@localhost identified by 'testpass';
-            grant all on test_db.* to tester@localhost;
-          '';
-          settings = {
-            mysqld = {
-              character-set-server = "utf8mb4";
-              collation-server = "utf8mb4_unicode_ci";
-              log_warnings = 1;
-            };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        sqlite3-to-mysql
+        # create one coherent python environment
+        (python3.withPackages (
+          ps:
+          sqlite3-to-mysql.propagatedBuildInputs
+          ++ [
+            python3Packages.pytest
+            python3Packages.pytest-mock
+            python3Packages.pytest-timeout
+            python3Packages.factory-boy
+            python3Packages.docker # only needed so import does not fail
+            sqlite3-to-mysql
+          ]
+        ))
+      ];
+      services.mysql = {
+        package = pkgs.mariadb;
+        enable = true;
+        # from https://github.com/techouse/sqlite3-to-mysql/blob/master/tests/conftest.py
+        # and https://github.com/techouse/sqlite3-to-mysql/blob/master/.github/workflows/test.yml
+        initialScript = pkgs.writeText "mysql-init.sql" ''
+          create database test_db DEFAULT CHARACTER SET utf8mb4;
+          create user tester identified by 'testpass';
+          grant all on test_db.* to tester;
+          create user tester@localhost identified by 'testpass';
+          grant all on test_db.* to tester@localhost;
+        '';
+        settings = {
+          mysqld = {
+            character-set-server = "utf8mb4";
+            collation-server = "utf8mb4_unicode_ci";
+            log_warnings = 1;
           };
         };
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("mysql")
+  testScript = ''
+    machine.wait_for_unit("mysql")
 
-      machine.succeed(
-           "sqlite3mysql --version | grep ${pkgs.sqlite3-to-mysql.version}"
-      )
+    machine.succeed(
+         "sqlite3mysql --version | grep ${pkgs.sqlite3-to-mysql.version}"
+    )
 
-      # invalid_database_name: assert '1045 (28000): Access denied' in "1044 (42000): Access denied [...]
-      # invalid_database_user: does not return non-zero exit for some reason
-      # test_version: has problems importing sqlite3_to_mysql and determining the version
-      machine.succeed(
-           "cd ${pkgs.sqlite3-to-mysql.src} \
-            && pytest -v --no-docker -k \"not test_invalid_database_name and not test_invalid_database_user and not test_version\""
-      )
-    '';
-  }
-)
+    # invalid_database_name: assert '1045 (28000): Access denied' in "1044 (42000): Access denied [...]
+    # invalid_database_user: does not return non-zero exit for some reason
+    # test_version: has problems importing sqlite3_to_mysql and determining the version
+    machine.succeed(
+         "cd ${pkgs.sqlite3-to-mysql.src} \
+          && pytest -v --no-docker -k \"not test_invalid_database_name and not test_invalid_database_user and not test_version\""
+    )
+  '';
+}
diff --git a/nixos/tests/squid.nix b/nixos/tests/squid.nix
index 6518158b0e49..77552b237f34 100644
--- a/nixos/tests/squid.nix
+++ b/nixos/tests/squid.nix
@@ -2,187 +2,185 @@
 # - "external" -- i.e. the internet, where the proxy and server communicate
 # - "internal" -- i.e. an office LAN, where the client and proxy communicat
 
-import ./make-test-python.nix (
-  {
-    pkgs,
-    lib,
-    ...
-  }:
-  # VLANS:
-  # 1 -- simulates the internal network
-  # 2 -- simulates the external network
-  let
-    commonConfig = {
-      # Disable eth0 autoconfiguration
-      networking.useDHCP = false;
+{
+  pkgs,
+  lib,
+  ...
+}:
+# VLANS:
+# 1 -- simulates the internal network
+# 2 -- simulates the external network
+let
+  commonConfig = {
+    # Disable eth0 autoconfiguration
+    networking.useDHCP = false;
 
-      environment.systemPackages = [
-        (pkgs.writeScriptBin "check-connection" ''
-          #!/usr/bin/env bash
+    environment.systemPackages = [
+      (pkgs.writeScriptBin "check-connection" ''
+        #!/usr/bin/env bash
 
-          set -e
+        set -e
 
-          if [[ "$2" == "" || "$1" == "--help" || "$1" == "-h" ]];
-          then
-              echo "check-connection <target-address> <[expect-success|expect-failure]>"
-              exit 1
-          fi
+        if [[ "$2" == "" || "$1" == "--help" || "$1" == "-h" ]];
+        then
+            echo "check-connection <target-address> <[expect-success|expect-failure]>"
+            exit 1
+        fi
 
-          ADDRESS="$1"
+        ADDRESS="$1"
 
-          function test_icmp() { timeout 3 ping -c 1 "$ADDRESS"; }
+        function test_icmp() { timeout 3 ping -c 1 "$ADDRESS"; }
 
-          if [[ "$2" == "expect-success" ]];
-          then
-              test_icmp
-          else
-              ! test_icmp
-          fi
-        '')
+        if [[ "$2" == "expect-success" ]];
+        then
+            test_icmp
+        else
+            ! test_icmp
+        fi
+      '')
+    ];
+  };
+in
+{
+  name = "squid";
+  meta.maintainers = with lib.maintainers; [ cobalt ];
+
+  node.pkgsReadOnly = false;
+
+  nodes = {
+    client =
+      { ... }:
+      lib.mkMerge [
+        commonConfig
+        {
+          virtualisation.vlans = [ 1 ];
+          networking.firewall.enable = true;
+
+          # NOTE: the client doesn't need a HTTP server, this is here to allow a validation of the proxy acl
+          networking.firewall.allowedTCPPorts = [ 80 ];
+
+          services.nginx = {
+            enable = true;
+
+            virtualHosts."server" = {
+              root = "/etc";
+              locations."/".index = "hostname";
+              listen = [
+                {
+                  addr = "0.0.0.0";
+                  port = 80;
+                }
+              ];
+            };
+          };
+        }
       ];
-    };
-  in
-  {
-    name = "squid";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ cobalt ];
-    };
 
-    nodes = {
-      client =
-        { ... }:
-        lib.mkMerge [
-          commonConfig
-          {
-            virtualisation.vlans = [ 1 ];
-            networking.firewall.enable = true;
-
-            # NOTE: the client doesn't need a HTTP server, this is here to allow a validation of the proxy acl
-            networking.firewall.allowedTCPPorts = [ 80 ];
-
-            services.nginx = {
-              enable = true;
-
-              virtualHosts."server" = {
-                root = "/etc";
-                locations."/".index = "hostname";
-                listen = [
-                  {
-                    addr = "0.0.0.0";
-                    port = 80;
-                  }
-                ];
-              };
-            };
-          }
-        ];
-
-      proxy =
-        { config, nodes, ... }:
-        let
-          clientIp = (pkgs.lib.head nodes.client.networking.interfaces.eth1.ipv4.addresses).address;
-          serverIp = (pkgs.lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address;
-        in
-        lib.mkMerge [
-          commonConfig
-          {
-            nixpkgs.config.permittedInsecurePackages = [ "squid-7.0.1" ];
-
-            virtualisation.vlans = [
-              1
-              2
-            ];
-            networking.firewall.enable = true;
-            networking.firewall.allowedTCPPorts = [ config.services.squid.proxyPort ];
-
-            services.squid = {
-              enable = true;
-
-              extraConfig = ''
-                acl client src ${clientIp}
-                acl server dst ${serverIp}
-                http_access allow client server
-                http_access deny all
-              '';
-            };
-          }
-        ];
-
-      server =
-        { ... }:
-        lib.mkMerge [
-          commonConfig
-          {
-            virtualisation.vlans = [ 2 ];
-            networking.firewall.enable = true;
-            networking.firewall.allowedTCPPorts = [ 80 ];
-
-            services.nginx = {
-              enable = true;
-
-              virtualHosts."server" = {
-                root = "/etc";
-                locations."/".index = "hostname";
-                listen = [
-                  {
-                    addr = "0.0.0.0";
-                    port = 80;
-                  }
-                ];
-              };
-            };
-          }
-        ];
-    };
-
-    testScript =
-      { nodes, ... }:
+    proxy =
+      { config, nodes, ... }:
       let
         clientIp = (pkgs.lib.head nodes.client.networking.interfaces.eth1.ipv4.addresses).address;
         serverIp = (pkgs.lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address;
-        proxyExternalIp = (pkgs.lib.head nodes.proxy.networking.interfaces.eth2.ipv4.addresses).address;
-        proxyInternalIp = (pkgs.lib.head nodes.proxy.networking.interfaces.eth1.ipv4.addresses).address;
       in
-      ''
-        client.start()
-        proxy.start()
-        server.start()
+      lib.mkMerge [
+        commonConfig
+        {
+          nixpkgs.config.permittedInsecurePackages = [ "squid-7.0.1" ];
 
-        proxy.wait_for_unit("network.target")
-        proxy.wait_for_unit("squid.service")
-        client.wait_for_unit("network.target")
-        server.wait_for_unit("network.target")
-        server.wait_for_unit("nginx.service")
+          virtualisation.vlans = [
+            1
+            2
+          ];
+          networking.firewall.enable = true;
+          networking.firewall.allowedTCPPorts = [ config.services.squid.proxyPort ];
 
-        # Topology checks.
-        with subtest("proxy connectivity"):
-            ## The proxy should have direct access to the server and client
-            proxy.succeed("check-connection ${serverIp} expect-success")
-            proxy.succeed("check-connection ${clientIp} expect-success")
+          services.squid = {
+            enable = true;
 
-        with subtest("server connectivity"):
-            ## The server should have direct access to the proxy
-            server.succeed("check-connection ${proxyExternalIp} expect-success")
-            ## ... and not have access to the client
-            server.succeed("check-connection ${clientIp} expect-failure")
+            extraConfig = ''
+              acl client src ${clientIp}
+              acl server dst ${serverIp}
+              http_access allow client server
+              http_access deny all
+            '';
+          };
+        }
+      ];
 
-        with subtest("client connectivity"):
-            # The client should be also able to connect to the proxy
-            client.succeed("check-connection ${proxyInternalIp} expect-success")
-            # but not the client to the server
-            client.succeed("check-connection ${serverIp} expect-failure")
+    server =
+      { ... }:
+      lib.mkMerge [
+        commonConfig
+        {
+          virtualisation.vlans = [ 2 ];
+          networking.firewall.enable = true;
+          networking.firewall.allowedTCPPorts = [ 80 ];
 
-        with subtest("HTTP"):
-            # the client cannot reach the server directly over HTTP
-            client.fail('[[ `timeout 3 curl --fail-with-body http://${serverIp}` ]]')
-            # ... but can with the proxy
-            client.succeed('[[ `timeout 3 curl --fail-with-body --proxy http://${proxyInternalIp}:3128 http://${serverIp}` == "server" ]]')
-            # and cannot from the server (with a 4xx error code) and ...
-            server.fail('[[ `timeout 3 curl --fail-with-body --proxy http://${proxyExternalIp}:3128 http://${clientIp}` == "client" ]]')
-            # .. not the client hostname
-            server.fail('[[ `timeout 3 curl --proxy http://${proxyExternalIp}:3128 http://${clientIp}` == "client" ]]')
-            # with an explicit deny message (no --fail because we want to parse the returned message)
-            server.succeed('[[ `timeout 3 curl --proxy http://${proxyExternalIp}:3128 http://${clientIp}` == *"ERR_ACCESS_DENIED"* ]]')
-      '';
-  }
-)
+          services.nginx = {
+            enable = true;
+
+            virtualHosts."server" = {
+              root = "/etc";
+              locations."/".index = "hostname";
+              listen = [
+                {
+                  addr = "0.0.0.0";
+                  port = 80;
+                }
+              ];
+            };
+          };
+        }
+      ];
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      clientIp = (pkgs.lib.head nodes.client.networking.interfaces.eth1.ipv4.addresses).address;
+      serverIp = (pkgs.lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address;
+      proxyExternalIp = (pkgs.lib.head nodes.proxy.networking.interfaces.eth2.ipv4.addresses).address;
+      proxyInternalIp = (pkgs.lib.head nodes.proxy.networking.interfaces.eth1.ipv4.addresses).address;
+    in
+    ''
+      client.start()
+      proxy.start()
+      server.start()
+
+      proxy.wait_for_unit("network.target")
+      proxy.wait_for_unit("squid.service")
+      client.wait_for_unit("network.target")
+      server.wait_for_unit("network.target")
+      server.wait_for_unit("nginx.service")
+
+      # Topology checks.
+      with subtest("proxy connectivity"):
+          ## The proxy should have direct access to the server and client
+          proxy.succeed("check-connection ${serverIp} expect-success")
+          proxy.succeed("check-connection ${clientIp} expect-success")
+
+      with subtest("server connectivity"):
+          ## The server should have direct access to the proxy
+          server.succeed("check-connection ${proxyExternalIp} expect-success")
+          ## ... and not have access to the client
+          server.succeed("check-connection ${clientIp} expect-failure")
+
+      with subtest("client connectivity"):
+          # The client should be also able to connect to the proxy
+          client.succeed("check-connection ${proxyInternalIp} expect-success")
+          # but not the client to the server
+          client.succeed("check-connection ${serverIp} expect-failure")
+
+      with subtest("HTTP"):
+          # the client cannot reach the server directly over HTTP
+          client.fail('[[ `timeout 3 curl --fail-with-body http://${serverIp}` ]]')
+          # ... but can with the proxy
+          client.succeed('[[ `timeout 3 curl --fail-with-body --proxy http://${proxyInternalIp}:3128 http://${serverIp}` == "server" ]]')
+          # and cannot from the server (with a 4xx error code) and ...
+          server.fail('[[ `timeout 3 curl --fail-with-body --proxy http://${proxyExternalIp}:3128 http://${clientIp}` == "client" ]]')
+          # .. not the client hostname
+          server.fail('[[ `timeout 3 curl --proxy http://${proxyExternalIp}:3128 http://${clientIp}` == "client" ]]')
+          # with an explicit deny message (no --fail because we want to parse the returned message)
+          server.succeed('[[ `timeout 3 curl --proxy http://${proxyExternalIp}:3128 http://${clientIp}` == *"ERR_ACCESS_DENIED"* ]]')
+    '';
+}
diff --git a/nixos/tests/ssh-agent-auth.nix b/nixos/tests/ssh-agent-auth.nix
index 4bfe453586f9..58ef908fd518 100644
--- a/nixos/tests/ssh-agent-auth.nix
+++ b/nixos/tests/ssh-agent-auth.nix
@@ -1,65 +1,63 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
-  in
-  {
-    name = "ssh-agent-auth";
-    meta.maintainers = with lib.maintainers; [ nicoo ];
+{ lib, pkgs, ... }:
+let
+  inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+in
+{
+  name = "ssh-agent-auth";
+  meta.maintainers = with lib.maintainers; [ nicoo ];
 
-    nodes =
-      let
-        nodeConfig =
-          n:
-          { ... }:
-          {
-            users.users = {
-              admin = {
-                isNormalUser = true;
-                extraGroups = [ "wheel" ];
-                openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
-              };
-              foo.isNormalUser = true;
+  nodes =
+    let
+      nodeConfig =
+        n:
+        { ... }:
+        {
+          users.users = {
+            admin = {
+              isNormalUser = true;
+              extraGroups = [ "wheel" ];
+              openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
             };
-
-            security.pam.sshAgentAuth = {
-              # Must be specified, as nixpkgs CI expects everything to eval without warning
-              authorizedKeysFiles = [ "/etc/ssh/authorized_keys.d/%u" ];
-              enable = true;
-            };
-            security.${lib.replaceStrings [ "_" ] [ "-" ] n} = {
-              enable = true;
-              wheelNeedsPassword = true; # We are checking `pam_ssh_agent_auth(8)` works for a sudoer
-            };
-
-            # Necessary for pam_ssh_agent_auth  >_>'
-            services.openssh.enable = true;
+            foo.isNormalUser = true;
           };
-      in
-      lib.genAttrs [ "sudo" "sudo_rs" ] nodeConfig;
 
-    testScript =
-      let
-        privateKeyPath = "/home/admin/.ssh/id_ecdsa";
-        userScript = pkgs.writeShellScript "test-script" ''
-          set -e
-          ssh-add -q ${privateKeyPath}
+          security.pam.sshAgentAuth = {
+            # Must be specified, as nixpkgs CI expects everything to eval without warning
+            authorizedKeysFiles = [ "/etc/ssh/authorized_keys.d/%u" ];
+            enable = true;
+          };
+          security.${lib.replaceStrings [ "_" ] [ "-" ] n} = {
+            enable = true;
+            wheelNeedsPassword = true; # We are checking `pam_ssh_agent_auth(8)` works for a sudoer
+          };
 
-          # faketty needed to ensure `sudo` doesn't write to the controlling PTY,
-          #  which would break the test-driver's line-oriented protocol.
-          ${lib.getExe pkgs.faketty} sudo -u foo -- id -un
-        '';
-      in
-      ''
-        for vm in (sudo, sudo_rs):
-          sudo_impl = vm.name.replace("_", "-")
-          with subtest(f"wheel user can auth with ssh-agent for {sudo_impl}"):
-              vm.copy_from_host("${snakeOilPrivateKey}", "${privateKeyPath}")
-              vm.succeed("chmod -R 0700 /home/admin")
-              vm.succeed("chown -R admin:users /home/admin")
+          # Necessary for pam_ssh_agent_auth  >_>'
+          services.openssh.enable = true;
+        };
+    in
+    lib.genAttrs [ "sudo" "sudo_rs" ] nodeConfig;
 
-              # Run `userScript` in an environment with an SSH-agent available
-              assert vm.succeed("sudo -u admin -- ssh-agent ${userScript} 2>&1").strip() == "foo"
+  testScript =
+    let
+      privateKeyPath = "/home/admin/.ssh/id_ecdsa";
+      userScript = pkgs.writeShellScript "test-script" ''
+        set -e
+        ssh-add -q ${privateKeyPath}
+
+        # faketty needed to ensure `sudo` doesn't write to the controlling PTY,
+        #  which would break the test-driver's line-oriented protocol.
+        ${lib.getExe pkgs.faketty} sudo -u foo -- id -un
       '';
-  }
-)
+    in
+    ''
+      for vm in (sudo, sudo_rs):
+        sudo_impl = vm.name.replace("_", "-")
+        with subtest(f"wheel user can auth with ssh-agent for {sudo_impl}"):
+            vm.copy_from_host("${snakeOilPrivateKey}", "${privateKeyPath}")
+            vm.succeed("chmod -R 0700 /home/admin")
+            vm.succeed("chown -R admin:users /home/admin")
+
+            # Run `userScript` in an environment with an SSH-agent available
+            assert vm.succeed("sudo -u admin -- ssh-agent ${userScript} 2>&1").strip() == "foo"
+    '';
+}
diff --git a/nixos/tests/ssh-audit.nix b/nixos/tests/ssh-audit.nix
index 3e0c33c6850f..88232a9010d3 100644
--- a/nixos/tests/ssh-audit.nix
+++ b/nixos/tests/ssh-audit.nix
@@ -1,106 +1,104 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    sshKeys = import (pkgs.path + "/nixos/tests/ssh-keys.nix") pkgs;
-    sshUsername = "any-user";
-    serverName = "server";
-    clientName = "client";
-    sshAuditPort = 2222;
-  in
-  {
-    name = "ssh";
+{ pkgs, ... }:
+let
+  sshKeys = import (pkgs.path + "/nixos/tests/ssh-keys.nix") pkgs;
+  sshUsername = "any-user";
+  serverName = "server";
+  clientName = "client";
+  sshAuditPort = 2222;
+in
+{
+  name = "ssh";
 
-    nodes = {
-      "${serverName}" = {
-        networking.firewall.allowedTCPPorts = [
-          sshAuditPort
+  nodes = {
+    "${serverName}" = {
+      networking.firewall.allowedTCPPorts = [
+        sshAuditPort
+      ];
+      services.openssh.enable = true;
+      users.users."${sshUsername}" = {
+        isNormalUser = true;
+        openssh.authorizedKeys.keys = [
+          sshKeys.snakeOilPublicKey
         ];
-        services.openssh.enable = true;
-        users.users."${sshUsername}" = {
-          isNormalUser = true;
-          openssh.authorizedKeys.keys = [
-            sshKeys.snakeOilPublicKey
-          ];
-        };
-      };
-      "${clientName}" = {
-        programs.ssh = {
-          ciphers = [
-            "aes128-ctr"
-            "aes128-gcm@openssh.com"
-            "aes192-ctr"
-            "aes256-ctr"
-            "aes256-gcm@openssh.com"
-            "chacha20-poly1305@openssh.com"
-          ];
-          extraConfig = ''
-            IdentitiesOnly yes
-          '';
-          hostKeyAlgorithms = [
-            "rsa-sha2-256"
-            "rsa-sha2-256-cert-v01@openssh.com"
-            "rsa-sha2-512"
-            "rsa-sha2-512-cert-v01@openssh.com"
-            "sk-ssh-ed25519-cert-v01@openssh.com"
-            "sk-ssh-ed25519@openssh.com"
-            "ssh-ed25519"
-            "ssh-ed25519-cert-v01@openssh.com"
-          ];
-          kexAlgorithms = [
-            "curve25519-sha256"
-            "curve25519-sha256@libssh.org"
-            "diffie-hellman-group-exchange-sha256"
-            "diffie-hellman-group16-sha512"
-            "diffie-hellman-group18-sha512"
-            "sntrup761x25519-sha512@openssh.com"
-          ];
-          macs = [
-            "hmac-sha2-256-etm@openssh.com"
-            "hmac-sha2-512-etm@openssh.com"
-            "umac-128-etm@openssh.com"
-          ];
-        };
       };
     };
+    "${clientName}" = {
+      programs.ssh = {
+        ciphers = [
+          "aes128-ctr"
+          "aes128-gcm@openssh.com"
+          "aes192-ctr"
+          "aes256-ctr"
+          "aes256-gcm@openssh.com"
+          "chacha20-poly1305@openssh.com"
+        ];
+        extraConfig = ''
+          IdentitiesOnly yes
+        '';
+        hostKeyAlgorithms = [
+          "rsa-sha2-256"
+          "rsa-sha2-256-cert-v01@openssh.com"
+          "rsa-sha2-512"
+          "rsa-sha2-512-cert-v01@openssh.com"
+          "sk-ssh-ed25519-cert-v01@openssh.com"
+          "sk-ssh-ed25519@openssh.com"
+          "ssh-ed25519"
+          "ssh-ed25519-cert-v01@openssh.com"
+        ];
+        kexAlgorithms = [
+          "curve25519-sha256"
+          "curve25519-sha256@libssh.org"
+          "diffie-hellman-group-exchange-sha256"
+          "diffie-hellman-group16-sha512"
+          "diffie-hellman-group18-sha512"
+          "sntrup761x25519-sha512@openssh.com"
+        ];
+        macs = [
+          "hmac-sha2-256-etm@openssh.com"
+          "hmac-sha2-512-etm@openssh.com"
+          "umac-128-etm@openssh.com"
+        ];
+      };
+    };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      ${serverName}.wait_for_open_port(22)
+    ${serverName}.wait_for_open_port(22)
 
-      # Should pass SSH server audit
-      ${serverName}.succeed("${pkgs.ssh-audit}/bin/ssh-audit 127.0.0.1")
+    # Should pass SSH server audit
+    ${serverName}.succeed("${pkgs.ssh-audit}/bin/ssh-audit 127.0.0.1")
 
-      # Wait for client to be able to connect to the server
-      ${clientName}.systemctl("start network-online.target")
-      ${clientName}.wait_for_unit("network-online.target")
+    # Wait for client to be able to connect to the server
+    ${clientName}.systemctl("start network-online.target")
+    ${clientName}.wait_for_unit("network-online.target")
 
-      # Set up trusted private key
-      ${clientName}.succeed("cat ${sshKeys.snakeOilPrivateKey} > privkey.snakeoil")
-      ${clientName}.succeed("chmod 600 privkey.snakeoil")
+    # Set up trusted private key
+    ${clientName}.succeed("cat ${sshKeys.snakeOilPrivateKey} > privkey.snakeoil")
+    ${clientName}.succeed("chmod 600 privkey.snakeoil")
 
-      # Fail fast and disable interactivity
-      ssh_options = "-o BatchMode=yes -o ConnectTimeout=1 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
+    # Fail fast and disable interactivity
+    ssh_options = "-o BatchMode=yes -o ConnectTimeout=1 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
 
-      # Should deny root user
-      ${clientName}.fail(f"ssh {ssh_options} root@${serverName} true")
+    # Should deny root user
+    ${clientName}.fail(f"ssh {ssh_options} root@${serverName} true")
 
-      # Should deny non-root user password login
-      ${clientName}.fail(f"ssh {ssh_options} -o PasswordAuthentication=yes ${sshUsername}@${serverName} true")
+    # Should deny non-root user password login
+    ${clientName}.fail(f"ssh {ssh_options} -o PasswordAuthentication=yes ${sshUsername}@${serverName} true")
 
-      # Should allow non-root user certificate login
-      ${clientName}.succeed(f"ssh {ssh_options} -i privkey.snakeoil ${sshUsername}@${serverName} true")
+    # Should allow non-root user certificate login
+    ${clientName}.succeed(f"ssh {ssh_options} -i privkey.snakeoil ${sshUsername}@${serverName} true")
 
-      # Should pass SSH client audit
-      service_name = "ssh-audit.service"
-      ${serverName}.succeed(f"systemd-run --unit={service_name} ${pkgs.ssh-audit}/bin/ssh-audit --client-audit --port=${toString sshAuditPort}")
-      ${clientName}.sleep(5) # We can't use wait_for_open_port because ssh-audit exits as soon as anything talks to it
-      ${clientName}.execute(
-          f"ssh {ssh_options} -i privkey.snakeoil -p ${toString sshAuditPort} ${sshUsername}@${serverName} true",
-          check_return=False,
-          timeout=10
-      )
-      ${serverName}.succeed(f"exit $(systemctl show --property=ExecMainStatus --value {service_name})")
-    '';
-  }
-)
+    # Should pass SSH client audit
+    service_name = "ssh-audit.service"
+    ${serverName}.succeed(f"systemd-run --unit={service_name} ${pkgs.ssh-audit}/bin/ssh-audit --client-audit --port=${toString sshAuditPort}")
+    ${clientName}.sleep(5) # We can't use wait_for_open_port because ssh-audit exits as soon as anything talks to it
+    ${clientName}.execute(
+        f"ssh {ssh_options} -i privkey.snakeoil -p ${toString sshAuditPort} ${sshUsername}@${serverName} true",
+        check_return=False,
+        timeout=10
+    )
+    ${serverName}.succeed(f"exit $(systemctl show --property=ExecMainStatus --value {service_name})")
+  '';
+}
diff --git a/nixos/tests/stalwart-mail.nix b/nixos/tests/stalwart-mail.nix
index 38b47cb88f90..cfc0d3bb1c5b 100644
--- a/nixos/tests/stalwart-mail.nix
+++ b/nixos/tests/stalwart-mail.nix
@@ -7,125 +7,123 @@ let
   domain = certs.domain;
 
 in
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "stalwart-mail";
+{ lib, ... }:
+{
+  name = "stalwart-mail";
 
-    nodes.main =
-      { pkgs, ... }:
-      {
-        security.pki.certificateFiles = [ certs.ca.cert ];
+  nodes.main =
+    { pkgs, ... }:
+    {
+      security.pki.certificateFiles = [ certs.ca.cert ];
 
-        services.stalwart-mail = {
-          enable = true;
-          settings = {
-            server.hostname = domain;
+      services.stalwart-mail = {
+        enable = true;
+        settings = {
+          server.hostname = domain;
 
-            certificate."snakeoil" = {
-              cert = "%{file:${certs.${domain}.cert}}%";
-              private-key = "%{file:${certs.${domain}.key}}%";
+          certificate."snakeoil" = {
+            cert = "%{file:${certs.${domain}.cert}}%";
+            private-key = "%{file:${certs.${domain}.key}}%";
+          };
+
+          server.tls = {
+            certificate = "snakeoil";
+            enable = true;
+            implicit = false;
+          };
+
+          server.listener = {
+            "smtp-submission" = {
+              bind = [ "[::]:587" ];
+              protocol = "smtp";
             };
 
-            server.tls = {
-              certificate = "snakeoil";
-              enable = true;
-              implicit = false;
-            };
-
-            server.listener = {
-              "smtp-submission" = {
-                bind = [ "[::]:587" ];
-                protocol = "smtp";
-              };
-
-              "imap" = {
-                bind = [ "[::]:143" ];
-                protocol = "imap";
-              };
-            };
-
-            session.auth.mechanisms = "[plain]";
-            session.auth.directory = "'in-memory'";
-            storage.directory = "in-memory";
-
-            session.rcpt.directory = "'in-memory'";
-            queue.outbound.next-hop = "'local'";
-
-            directory."in-memory" = {
-              type = "memory";
-              principals = [
-                {
-                  class = "individual";
-                  name = "alice";
-                  secret = "foobar";
-                  email = [ "alice@${domain}" ];
-                }
-                {
-                  class = "individual";
-                  name = "bob";
-                  secret = "foobar";
-                  email = [ "bob@${domain}" ];
-                }
-              ];
+            "imap" = {
+              bind = [ "[::]:143" ];
+              protocol = "imap";
             };
           };
+
+          session.auth.mechanisms = "[plain]";
+          session.auth.directory = "'in-memory'";
+          storage.directory = "in-memory";
+
+          session.rcpt.directory = "'in-memory'";
+          queue.outbound.next-hop = "'local'";
+
+          directory."in-memory" = {
+            type = "memory";
+            principals = [
+              {
+                class = "individual";
+                name = "alice";
+                secret = "foobar";
+                email = [ "alice@${domain}" ];
+              }
+              {
+                class = "individual";
+                name = "bob";
+                secret = "foobar";
+                email = [ "bob@${domain}" ];
+              }
+            ];
+          };
         };
-
-        environment.systemPackages = [
-          (pkgs.writers.writePython3Bin "test-smtp-submission" { } ''
-            from smtplib import SMTP
-
-            with SMTP('localhost', 587) as smtp:
-                smtp.starttls()
-                smtp.login('alice', 'foobar')
-                smtp.sendmail(
-                    'alice@${domain}',
-                    'bob@${domain}',
-                    """
-                        From: alice@${domain}
-                        To: bob@${domain}
-                        Subject: Some test message
-
-                        This is a test message.
-                    """.strip()
-                )
-          '')
-
-          (pkgs.writers.writePython3Bin "test-imap-read" { } ''
-            from imaplib import IMAP4
-
-            with IMAP4('localhost') as imap:
-                imap.starttls()
-                status, [caps] = imap.login('bob', 'foobar')
-                assert status == 'OK'
-                imap.select()
-                status, [ref] = imap.search(None, 'ALL')
-                assert status == 'OK'
-                [msgId] = ref.split()
-                status, msg = imap.fetch(msgId, 'BODY[TEXT]')
-                assert status == 'OK'
-                assert msg[0][1].strip() == b'This is a test message.'
-          '')
-        ];
       };
 
-    testScript = # python
-      ''
-        main.wait_for_unit("stalwart-mail.service")
-        main.wait_for_open_port(587)
-        main.wait_for_open_port(143)
+      environment.systemPackages = [
+        (pkgs.writers.writePython3Bin "test-smtp-submission" { } ''
+          from smtplib import SMTP
 
-        main.succeed("test-smtp-submission")
-        main.succeed("test-imap-read")
-      '';
+          with SMTP('localhost', 587) as smtp:
+              smtp.starttls()
+              smtp.login('alice', 'foobar')
+              smtp.sendmail(
+                  'alice@${domain}',
+                  'bob@${domain}',
+                  """
+                      From: alice@${domain}
+                      To: bob@${domain}
+                      Subject: Some test message
 
-    meta = {
-      maintainers = with lib.maintainers; [
-        happysalada
-        euxane
-        onny
+                      This is a test message.
+                  """.strip()
+              )
+        '')
+
+        (pkgs.writers.writePython3Bin "test-imap-read" { } ''
+          from imaplib import IMAP4
+
+          with IMAP4('localhost') as imap:
+              imap.starttls()
+              status, [caps] = imap.login('bob', 'foobar')
+              assert status == 'OK'
+              imap.select()
+              status, [ref] = imap.search(None, 'ALL')
+              assert status == 'OK'
+              [msgId] = ref.split()
+              status, msg = imap.fetch(msgId, 'BODY[TEXT]')
+              assert status == 'OK'
+              assert msg[0][1].strip() == b'This is a test message.'
+        '')
       ];
     };
-  }
-)
+
+  testScript = # python
+    ''
+      main.wait_for_unit("stalwart-mail.service")
+      main.wait_for_open_port(587)
+      main.wait_for_open_port(143)
+
+      main.succeed("test-smtp-submission")
+      main.succeed("test-imap-read")
+    '';
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      happysalada
+      euxane
+      onny
+    ];
+  };
+}
diff --git a/nixos/tests/stratis/encryption.nix b/nixos/tests/stratis/encryption.nix
index 719d8dd25841..583c881ecaac 100644
--- a/nixos/tests/stratis/encryption.nix
+++ b/nixos/tests/stratis/encryption.nix
@@ -30,7 +30,7 @@ import ../make-test-python.nix (
         machine.succeed("stratis pool rebind keyring  testpool testkey2")
         # test restarting encrypted pool
         machine.succeed("stratis pool stop  --name testpool")
-        machine.succeed("stratis pool start --name testpool --unlock-method keyring")
+        machine.succeed("stratis pool start --name testpool --unlock-method any")
       '';
   }
 )
diff --git a/nixos/tests/strongswan-swanctl.nix b/nixos/tests/strongswan-swanctl.nix
index a36757bf9eaa..e5ef5f1d5ccf 100644
--- a/nixos/tests/strongswan-swanctl.nix
+++ b/nixos/tests/strongswan-swanctl.nix
@@ -16,150 +16,148 @@
 # See the NixOS manual for how to run this test:
 # https://nixos.org/nixos/manual/index.html#sec-running-nixos-tests-interactively
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    allowESP = "iptables --insert INPUT --protocol ESP --jump ACCEPT";
+let
+  allowESP = "iptables --insert INPUT --protocol ESP --jump ACCEPT";
 
-    # Shared VPN settings:
-    vlan0 = "192.168.0.0/24";
-    carolIp = "192.168.1.2";
-    moonIp = "192.168.1.3";
-    version = 2;
-    secret = "0sFpZAZqEN6Ti9sqt4ZP5EWcqx";
-    esp_proposals = [ "aes128gcm128-x25519" ];
-    proposals = [ "aes128-sha256-x25519" ];
-  in
-  {
-    name = "strongswan-swanctl";
-    meta.maintainers = with pkgs.lib.maintainers; [ basvandijk ];
-    nodes = {
+  # Shared VPN settings:
+  vlan0 = "192.168.0.0/24";
+  carolIp = "192.168.1.2";
+  moonIp = "192.168.1.3";
+  version = 2;
+  secret = "0sFpZAZqEN6Ti9sqt4ZP5EWcqx";
+  esp_proposals = [ "aes128gcm128-x25519" ];
+  proposals = [ "aes128-sha256-x25519" ];
+in
+{
+  name = "strongswan-swanctl";
+  meta.maintainers = with pkgs.lib.maintainers; [ basvandijk ];
+  nodes = {
 
-      alice =
-        { ... }:
-        {
-          virtualisation.vlans = [ 0 ];
-          networking = {
-            dhcpcd.enable = false;
-            defaultGateway = "192.168.0.3";
-          };
+    alice =
+      { ... }:
+      {
+        virtualisation.vlans = [ 0 ];
+        networking = {
+          dhcpcd.enable = false;
+          defaultGateway = "192.168.0.3";
         };
+      };
 
-      moon =
-        { config, ... }:
-        let
-          strongswan = config.services.strongswan-swanctl.package;
-        in
-        {
-          virtualisation.vlans = [
-            0
-            1
-          ];
-          networking = {
-            dhcpcd.enable = false;
-            firewall = {
-              allowedUDPPorts = [
-                4500
-                500
-              ];
-              extraCommands = allowESP;
-            };
-            nat = {
-              enable = true;
-              internalIPs = [ vlan0 ];
-              internalInterfaces = [ "eth1" ];
-              externalIP = moonIp;
-              externalInterface = "eth2";
-            };
+    moon =
+      { config, ... }:
+      let
+        strongswan = config.services.strongswan-swanctl.package;
+      in
+      {
+        virtualisation.vlans = [
+          0
+          1
+        ];
+        networking = {
+          dhcpcd.enable = false;
+          firewall = {
+            allowedUDPPorts = [
+              4500
+              500
+            ];
+            extraCommands = allowESP;
           };
-          environment.systemPackages = [ strongswan ];
-          services.strongswan-swanctl = {
+          nat = {
             enable = true;
-            swanctl = {
-              connections = {
-                rw = {
-                  local_addrs = [ moonIp ];
-                  local.main = {
-                    auth = "psk";
-                  };
-                  remote.main = {
-                    auth = "psk";
-                  };
-                  children = {
-                    net = {
-                      local_ts = [ vlan0 ];
-                      updown = "${strongswan}/libexec/ipsec/_updown iptables";
-                      inherit esp_proposals;
-                    };
-                  };
-                  inherit version;
-                  inherit proposals;
+            internalIPs = [ vlan0 ];
+            internalInterfaces = [ "eth1" ];
+            externalIP = moonIp;
+            externalInterface = "eth2";
+          };
+        };
+        environment.systemPackages = [ strongswan ];
+        services.strongswan-swanctl = {
+          enable = true;
+          swanctl = {
+            connections = {
+              rw = {
+                local_addrs = [ moonIp ];
+                local.main = {
+                  auth = "psk";
                 };
+                remote.main = {
+                  auth = "psk";
+                };
+                children = {
+                  net = {
+                    local_ts = [ vlan0 ];
+                    updown = "${strongswan}/libexec/ipsec/_updown iptables";
+                    inherit esp_proposals;
+                  };
+                };
+                inherit version;
+                inherit proposals;
               };
-              secrets = {
-                ike.carol = {
-                  id.main = carolIp;
-                  inherit secret;
-                };
+            };
+            secrets = {
+              ike.carol = {
+                id.main = carolIp;
+                inherit secret;
               };
             };
           };
         };
+      };
 
-      carol =
-        { config, ... }:
-        let
-          strongswan = config.services.strongswan-swanctl.package;
-        in
-        {
-          virtualisation.vlans = [ 1 ];
-          networking = {
-            dhcpcd.enable = false;
-            firewall.extraCommands = allowESP;
-          };
-          environment.systemPackages = [ strongswan ];
-          services.strongswan-swanctl = {
-            enable = true;
-            swanctl = {
-              connections = {
-                home = {
-                  local_addrs = [ carolIp ];
-                  remote_addrs = [ moonIp ];
-                  local.main = {
-                    auth = "psk";
-                    id = carolIp;
-                  };
-                  remote.main = {
-                    auth = "psk";
-                    id = moonIp;
-                  };
-                  children = {
-                    home = {
-                      remote_ts = [ vlan0 ];
-                      start_action = "trap";
-                      updown = "${strongswan}/libexec/ipsec/_updown iptables";
-                      inherit esp_proposals;
-                    };
-                  };
-                  inherit version;
-                  inherit proposals;
+    carol =
+      { config, ... }:
+      let
+        strongswan = config.services.strongswan-swanctl.package;
+      in
+      {
+        virtualisation.vlans = [ 1 ];
+        networking = {
+          dhcpcd.enable = false;
+          firewall.extraCommands = allowESP;
+        };
+        environment.systemPackages = [ strongswan ];
+        services.strongswan-swanctl = {
+          enable = true;
+          swanctl = {
+            connections = {
+              home = {
+                local_addrs = [ carolIp ];
+                remote_addrs = [ moonIp ];
+                local.main = {
+                  auth = "psk";
+                  id = carolIp;
                 };
+                remote.main = {
+                  auth = "psk";
+                  id = moonIp;
+                };
+                children = {
+                  home = {
+                    remote_ts = [ vlan0 ];
+                    start_action = "trap";
+                    updown = "${strongswan}/libexec/ipsec/_updown iptables";
+                    inherit esp_proposals;
+                  };
+                };
+                inherit version;
+                inherit proposals;
               };
-              secrets = {
-                ike.moon = {
-                  id.main = moonIp;
-                  inherit secret;
-                };
+            };
+            secrets = {
+              ike.moon = {
+                id.main = moonIp;
+                inherit secret;
               };
             };
           };
         };
+      };
 
-    };
-    testScript = ''
-      start_all()
-      carol.wait_until_succeeds("ping -c 1 alice")
-    '';
-  }
-)
+  };
+  testScript = ''
+    start_all()
+    carol.wait_until_succeeds("ping -c 1 alice")
+  '';
+}
diff --git a/nixos/tests/sudo.nix b/nixos/tests/sudo.nix
index 77accf8e82fb..13246be95289 100644
--- a/nixos/tests/sudo.nix
+++ b/nixos/tests/sudo.nix
@@ -3,181 +3,179 @@
 let
   password = "helloworld";
 in
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "sudo";
-    meta.maintainers = pkgs.sudo.meta.maintainers;
+{ lib, pkgs, ... }:
+{
+  name = "sudo";
+  meta.maintainers = pkgs.sudo.meta.maintainers;
 
-    nodes.machine =
-      { lib, ... }:
-      {
-        users.groups = {
-          foobar = { };
-          barfoo = { };
-          baz = {
-            gid = 1337;
-          };
+  nodes.machine =
+    { lib, ... }:
+    {
+      users.groups = {
+        foobar = { };
+        barfoo = { };
+        baz = {
+          gid = 1337;
         };
-        users.users = {
-          test0 = {
-            isNormalUser = true;
-            extraGroups = [ "wheel" ];
-          };
-          test1 = {
-            isNormalUser = true;
-            password = password;
-          };
-          test2 = {
-            isNormalUser = true;
-            extraGroups = [ "foobar" ];
-            password = password;
-          };
-          test3 = {
-            isNormalUser = true;
-            extraGroups = [ "barfoo" ];
-          };
-          test4 = {
-            isNormalUser = true;
-            extraGroups = [ "baz" ];
-          };
-          test5 = {
-            isNormalUser = true;
-          };
+      };
+      users.users = {
+        test0 = {
+          isNormalUser = true;
+          extraGroups = [ "wheel" ];
         };
-
-        security.sudo = {
-          # Explicitly _not_ defining 'enable = true;' here, to check that sudo is enabled by default
-
-          wheelNeedsPassword = false;
-
-          extraConfig = ''
-            Defaults lecture="never"
-          '';
-
-          extraRules = [
-            # SUDOERS SYNTAX CHECK (Test whether the module produces a valid output;
-            # errors being detected by the visudo checks.
-
-            # These should not create any entries
-            {
-              users = [ "notest1" ];
-              commands = [ ];
-            }
-            {
-              commands = [
-                {
-                  command = "ALL";
-                  options = [ ];
-                }
-              ];
-            }
-
-            # Test defining commands with the options syntax, though not setting any options
-            {
-              users = [ "notest2" ];
-              commands = [
-                {
-                  command = "ALL";
-                  options = [ ];
-                }
-              ];
-            }
-
-            # CONFIGURATION FOR TEST CASES
-            {
-              users = [ "test1" ];
-              groups = [ "foobar" ];
-              commands = [ "ALL" ];
-            }
-            {
-              groups = [
-                "barfoo"
-                1337
-              ];
-              commands = [
-                {
-                  command = "ALL";
-                  options = [
-                    "NOPASSWD"
-                    "NOSETENV"
-                  ];
-                }
-              ];
-            }
-            {
-              users = [ "test5" ];
-              commands = [
-                {
-                  command = "ALL";
-                  options = [
-                    "NOPASSWD"
-                    "SETENV"
-                  ];
-                }
-              ];
-              runAs = "test1:barfoo";
-            }
-          ];
+        test1 = {
+          isNormalUser = true;
+          password = password;
+        };
+        test2 = {
+          isNormalUser = true;
+          extraGroups = [ "foobar" ];
+          password = password;
+        };
+        test3 = {
+          isNormalUser = true;
+          extraGroups = [ "barfoo" ];
+        };
+        test4 = {
+          isNormalUser = true;
+          extraGroups = [ "baz" ];
+        };
+        test5 = {
+          isNormalUser = true;
         };
       };
 
-    nodes.strict =
-      { ... }:
-      {
-        users.users = {
-          admin = {
-            isNormalUser = true;
-            extraGroups = [ "wheel" ];
-          };
-          noadmin = {
-            isNormalUser = true;
-          };
-        };
+      security.sudo = {
+        # Explicitly _not_ defining 'enable = true;' here, to check that sudo is enabled by default
 
-        security.sudo = {
-          enable = true;
-          wheelNeedsPassword = false;
-          execWheelOnly = true;
+        wheelNeedsPassword = false;
+
+        extraConfig = ''
+          Defaults lecture="never"
+        '';
+
+        extraRules = [
+          # SUDOERS SYNTAX CHECK (Test whether the module produces a valid output;
+          # errors being detected by the visudo checks.
+
+          # These should not create any entries
+          {
+            users = [ "notest1" ];
+            commands = [ ];
+          }
+          {
+            commands = [
+              {
+                command = "ALL";
+                options = [ ];
+              }
+            ];
+          }
+
+          # Test defining commands with the options syntax, though not setting any options
+          {
+            users = [ "notest2" ];
+            commands = [
+              {
+                command = "ALL";
+                options = [ ];
+              }
+            ];
+          }
+
+          # CONFIGURATION FOR TEST CASES
+          {
+            users = [ "test1" ];
+            groups = [ "foobar" ];
+            commands = [ "ALL" ];
+          }
+          {
+            groups = [
+              "barfoo"
+              1337
+            ];
+            commands = [
+              {
+                command = "ALL";
+                options = [
+                  "NOPASSWD"
+                  "NOSETENV"
+                ];
+              }
+            ];
+          }
+          {
+            users = [ "test5" ];
+            commands = [
+              {
+                command = "ALL";
+                options = [
+                  "NOPASSWD"
+                  "SETENV"
+                ];
+              }
+            ];
+            runAs = "test1:barfoo";
+          }
+        ];
+      };
+    };
+
+  nodes.strict =
+    { ... }:
+    {
+      users.users = {
+        admin = {
+          isNormalUser = true;
+          extraGroups = [ "wheel" ];
+        };
+        noadmin = {
+          isNormalUser = true;
         };
       };
 
-    testScript = ''
-      with subtest("users in wheel group should have passwordless sudo"):
-          machine.succeed('su - test0 -c "sudo -u root true"')
+      security.sudo = {
+        enable = true;
+        wheelNeedsPassword = false;
+        execWheelOnly = true;
+      };
+    };
 
-      with subtest("test1 user should have sudo with password"):
-          machine.succeed('su - test1 -c "echo ${password} | sudo -S -u root true"')
+  testScript = ''
+    with subtest("users in wheel group should have passwordless sudo"):
+        machine.succeed('su - test0 -c "sudo -u root true"')
 
-      with subtest("test1 user should not be able to use sudo without password"):
-          machine.fail('su - test1 -c "sudo -n -u root true"')
+    with subtest("test1 user should have sudo with password"):
+        machine.succeed('su - test1 -c "echo ${password} | sudo -S -u root true"')
 
-      with subtest("users in group 'foobar' should be able to use sudo with password"):
-          machine.succeed('su - test2 -c "echo ${password} | sudo -S -u root true"')
+    with subtest("test1 user should not be able to use sudo without password"):
+        machine.fail('su - test1 -c "sudo -n -u root true"')
 
-      with subtest("users in group 'barfoo' should be able to use sudo without password"):
-          machine.succeed("sudo -u test3 sudo -n -u root true")
+    with subtest("users in group 'foobar' should be able to use sudo with password"):
+        machine.succeed('su - test2 -c "echo ${password} | sudo -S -u root true"')
 
-      with subtest("users in group 'baz' (GID 1337)"):
-          machine.succeed("sudo -u test4 sudo -n -u root echo true")
+    with subtest("users in group 'barfoo' should be able to use sudo without password"):
+        machine.succeed("sudo -u test3 sudo -n -u root true")
 
-      with subtest("test5 user should be able to run commands under test1"):
-          machine.succeed("sudo -u test5 sudo -n -u test1 true")
+    with subtest("users in group 'baz' (GID 1337)"):
+        machine.succeed("sudo -u test4 sudo -n -u root echo true")
 
-      with subtest("test5 user should not be able to run commands under root"):
-          machine.fail("sudo -u test5 sudo -n -u root true")
+    with subtest("test5 user should be able to run commands under test1"):
+        machine.succeed("sudo -u test5 sudo -n -u test1 true")
 
-      with subtest("test5 user should be able to keep their environment"):
-          machine.succeed("sudo -u test5 sudo -n -E -u test1 true")
+    with subtest("test5 user should not be able to run commands under root"):
+        machine.fail("sudo -u test5 sudo -n -u root true")
 
-      with subtest("users in group 'barfoo' should not be able to keep their environment"):
-          machine.fail("sudo -u test3 sudo -n -E -u root true")
+    with subtest("test5 user should be able to keep their environment"):
+        machine.succeed("sudo -u test5 sudo -n -E -u test1 true")
 
-      with subtest("users in wheel should be able to run sudo despite execWheelOnly"):
-          strict.succeed('su - admin -c "sudo -u root true"')
+    with subtest("users in group 'barfoo' should not be able to keep their environment"):
+        machine.fail("sudo -u test3 sudo -n -E -u root true")
 
-      with subtest("non-wheel users should be unable to run sudo thanks to execWheelOnly"):
-          strict.fail('su - noadmin -c "sudo --help"')
-    '';
-  }
-)
+    with subtest("users in wheel should be able to run sudo despite execWheelOnly"):
+        strict.succeed('su - admin -c "sudo -u root true"')
+
+    with subtest("non-wheel users should be unable to run sudo thanks to execWheelOnly"):
+        strict.fail('su - noadmin -c "sudo --help"')
+  '';
+}
diff --git a/nixos/tests/sunshine.nix b/nixos/tests/sunshine.nix
index d492a85f90d7..176b7aa9f307 100644
--- a/nixos/tests/sunshine.nix
+++ b/nixos/tests/sunshine.nix
@@ -1,81 +1,79 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "sunshine";
-    meta = {
-      # test is flaky on aarch64
-      broken = pkgs.stdenv.hostPlatform.isAarch64;
-      maintainers = [ lib.maintainers.devusb ];
-      timeout = 600;
+{ pkgs, lib, ... }:
+{
+  name = "sunshine";
+  meta = {
+    # test is flaky on aarch64
+    broken = pkgs.stdenv.hostPlatform.isAarch64;
+    maintainers = [ lib.maintainers.devusb ];
+    timeout = 600;
+  };
+
+  nodes.sunshine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.sunshine = {
+        enable = true;
+        openFirewall = true;
+        settings = {
+          capture = "x11";
+          encoder = "software";
+          output_name = 0;
+        };
+      };
+
+      environment.systemPackages = with pkgs; [
+        gxmessage
+      ];
+
     };
 
-    nodes.sunshine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  nodes.moonlight =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
 
-        services.sunshine = {
-          enable = true;
-          openFirewall = true;
-          settings = {
-            capture = "x11";
-            encoder = "software";
-            output_name = 0;
-          };
-        };
+      environment.systemPackages = with pkgs; [
+        moonlight-qt
+      ];
 
-        environment.systemPackages = with pkgs; [
-          gxmessage
-        ];
+    };
 
-      };
+  enableOCR = true;
 
-    nodes.moonlight =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  testScript = ''
+    # start the tests, wait for sunshine to be up
+    start_all()
+    sunshine.wait_for_open_port(48010,"localhost")
 
-        environment.systemPackages = with pkgs; [
-          moonlight-qt
-        ];
+    # set the admin username/password, restart sunshine
+    sunshine.execute("sunshine --creds sunshine sunshine")
+    sunshine.systemctl("restart sunshine","root")
+    sunshine.wait_for_open_port(48010,"localhost")
 
-      };
+    # initiate pairing from moonlight
+    moonlight.execute("moonlight pair sunshine --pin 1234 >&2 & disown")
+    moonlight.wait_for_console_text("Executing request.*pair")
 
-    enableOCR = true;
+    # respond to pairing request from sunshine
+    sunshine.succeed("curl --fail --insecure -u sunshine:sunshine -d '{\"pin\":\"1234\",\"name\":\"1234\"}' https://localhost:47990/api/pin")
 
-    testScript = ''
-      # start the tests, wait for sunshine to be up
-      start_all()
-      sunshine.wait_for_open_port(48010,"localhost")
+    # wait until pairing is complete
+    moonlight.wait_for_console_text("Executing request.*phrase=pairchallenge")
 
-      # set the admin username/password, restart sunshine
-      sunshine.execute("sunshine --creds sunshine sunshine")
-      sunshine.systemctl("restart sunshine","root")
-      sunshine.wait_for_open_port(48010,"localhost")
+    # hide icewm panel
+    sunshine.send_key("ctrl-alt-h")
+    # put words on the sunshine screen for moonlight to see
+    sunshine.execute("gxmessage ' ABC' -center -font 'consolas 100' -fg '#FFFFFF' -bg '#000000' -borderless -geometry '2000x2000' -buttons \"\" >&2 & disown")
 
-      # initiate pairing from moonlight
-      moonlight.execute("moonlight pair sunshine --pin 1234 >&2 & disown")
-      moonlight.wait_for_console_text("Executing request.*pair")
-
-      # respond to pairing request from sunshine
-      sunshine.succeed("curl --fail --insecure -u sunshine:sunshine -d '{\"pin\":\"1234\",\"name\":\"1234\"}' https://localhost:47990/api/pin")
-
-      # wait until pairing is complete
-      moonlight.wait_for_console_text("Executing request.*phrase=pairchallenge")
-
-      # hide icewm panel
-      sunshine.send_key("ctrl-alt-h")
-      # put words on the sunshine screen for moonlight to see
-      sunshine.execute("gxmessage ' ABC' -center -font 'consolas 100' -fg '#FFFFFF' -bg '#000000' -borderless -geometry '2000x2000' -buttons \"\" >&2 & disown")
-
-      # connect to sunshine from moonlight and look for the words
-      moonlight.execute("moonlight --video-decoder software stream sunshine 'Desktop' >&2 & disown")
-      moonlight.wait_for_console_text("Dropping window event during flush")
-      moonlight.wait_for_text("ABC")
-    '';
-  }
-)
+    # connect to sunshine from moonlight and look for the words
+    moonlight.execute("moonlight --video-decoder software stream sunshine 'Desktop' >&2 & disown")
+    moonlight.wait_for_console_text("Dropping window event during flush")
+    moonlight.wait_for_text("ABC")
+  '';
+}
diff --git a/nixos/tests/suricata.nix b/nixos/tests/suricata.nix
index 9634f4af25a0..c79d0799551b 100644
--- a/nixos/tests/suricata.nix
+++ b/nixos/tests/suricata.nix
@@ -1,81 +1,79 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "suricata";
-    meta.maintainers = with lib.maintainers; [ felbinger ];
+{ lib, pkgs, ... }:
+{
+  name = "suricata";
+  meta.maintainers = with lib.maintainers; [ felbinger ];
 
-    nodes = {
-      ids = {
-        networking.interfaces.eth1 = {
-          useDHCP = false;
-          ipv4.addresses = [
-            {
-              address = "192.168.1.2";
-              prefixLength = 24;
-            }
-          ];
-        };
-
-        # disable suricata-update because this requires an Internet connection
-        systemd.services.suricata-update.enable = false;
-
-        # install suricata package to make suricatasc program available
-        environment.systemPackages = with pkgs; [ suricata ];
-
-        services.suricata = {
-          enable = true;
-          settings = {
-            vars.address-groups.HOME_NET = "192.168.1.0/24";
-            unix-command.enabled = true;
-            outputs = [ { fast.enabled = true; } ];
-            af-packet = [ { interface = "eth1"; } ];
-            classification-file = "${pkgs.suricata}/etc/suricata/classification.config";
-          };
-        };
-
-        # create suricata.rules with the rule to detect the output of the id command
-        systemd.tmpfiles.rules = [
-          ''f /var/lib/suricata/rules/suricata.rules 644 suricata suricata 0 alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2019_07_26;)''
+  nodes = {
+    ids = {
+      networking.interfaces.eth1 = {
+        useDHCP = false;
+        ipv4.addresses = [
+          {
+            address = "192.168.1.2";
+            prefixLength = 24;
+          }
         ];
       };
-      helper = {
-        imports = [ ../modules/profiles/minimal.nix ];
 
-        networking.interfaces.eth1 = {
-          useDHCP = false;
-          ipv4.addresses = [
-            {
-              address = "192.168.1.1";
-              prefixLength = 24;
-            }
-          ];
-        };
+      # disable suricata-update because this requires an Internet connection
+      systemd.services.suricata-update.enable = false;
 
-        services.nginx = {
-          enable = true;
-          virtualHosts."localhost".locations = {
-            "/id/".return = "200 'uid=0(root) gid=0(root) groups=0(root)'";
-          };
+      # install suricata package to make suricatasc program available
+      environment.systemPackages = with pkgs; [ suricata ];
+
+      services.suricata = {
+        enable = true;
+        settings = {
+          vars.address-groups.HOME_NET = "192.168.1.0/24";
+          unix-command.enabled = true;
+          outputs = [ { fast.enabled = true; } ];
+          af-packet = [ { interface = "eth1"; } ];
+          classification-file = "${pkgs.suricata}/etc/suricata/classification.config";
         };
-        networking.firewall.allowedTCPPorts = [ 80 ];
       };
+
+      # create suricata.rules with the rule to detect the output of the id command
+      systemd.tmpfiles.rules = [
+        ''f /var/lib/suricata/rules/suricata.rules 644 suricata suricata 0 alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2019_07_26;)''
+      ];
     };
+    helper = {
+      imports = [ ../modules/profiles/minimal.nix ];
 
-    testScript = ''
-      start_all()
+      networking.interfaces.eth1 = {
+        useDHCP = false;
+        ipv4.addresses = [
+          {
+            address = "192.168.1.1";
+            prefixLength = 24;
+          }
+        ];
+      };
 
-      # check that configuration has been applied correctly with suricatasc
-      with subtest("suricata configuration test"):
-          ids.wait_for_unit("suricata.service")
-          assert '1' in ids.succeed("suricatasc -c 'iface-list' | ${pkgs.jq}/bin/jq .message.count")
+      services.nginx = {
+        enable = true;
+        virtualHosts."localhost".locations = {
+          "/id/".return = "200 'uid=0(root) gid=0(root) groups=0(root)'";
+        };
+      };
+      networking.firewall.allowedTCPPorts = [ 80 ];
+    };
+  };
 
-      # test detection of events based on a static ruleset (output of id command)
-      with subtest("suricata rule test"):
-          helper.wait_for_unit("nginx.service")
-          ids.wait_for_unit("suricata.service")
+  testScript = ''
+    start_all()
 
-          ids.succeed("curl http://192.168.1.1/id/")
-          assert "id check returned root [**] [Classification: Potentially Bad Traffic]" in ids.succeed("tail -n 1 /var/log/suricata/fast.log"), "Suricata didn't detect the output of id comment"
-    '';
-  }
-)
+    # check that configuration has been applied correctly with suricatasc
+    with subtest("suricata configuration test"):
+        ids.wait_for_unit("suricata.service")
+        assert '1' in ids.succeed("suricatasc -c 'iface-list' | ${pkgs.jq}/bin/jq .message.count")
+
+    # test detection of events based on a static ruleset (output of id command)
+    with subtest("suricata rule test"):
+        helper.wait_for_unit("nginx.service")
+        ids.wait_for_unit("suricata.service")
+
+        ids.succeed("curl http://192.168.1.1/id/")
+        assert "id check returned root [**] [Classification: Potentially Bad Traffic]" in ids.succeed("tail -n 1 /var/log/suricata/fast.log"), "Suricata didn't detect the output of id comment"
+  '';
+}
diff --git a/nixos/tests/swap-file-btrfs.nix b/nixos/tests/swap-file-btrfs.nix
index eaea9ad00125..d074a781ce0a 100644
--- a/nixos/tests/swap-file-btrfs.nix
+++ b/nixos/tests/swap-file-btrfs.nix
@@ -1,52 +1,50 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "swap-file-btrfs";
+{ lib, ... }:
+{
+  name = "swap-file-btrfs";
 
-    meta.maintainers = with lib.maintainers; [ oxalica ];
+  meta.maintainers = with lib.maintainers; [ oxalica ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        virtualisation.useDefaultFilesystems = false;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.useDefaultFilesystems = false;
 
-        virtualisation.rootDevice = "/dev/vda";
+      virtualisation.rootDevice = "/dev/vda";
 
-        boot.initrd.postDeviceCommands = ''
-          ${pkgs.btrfs-progs}/bin/mkfs.btrfs --label root /dev/vda
-        '';
+      boot.initrd.postDeviceCommands = ''
+        ${pkgs.btrfs-progs}/bin/mkfs.btrfs --label root /dev/vda
+      '';
 
-        virtualisation.fileSystems = {
-          "/" = {
-            device = "/dev/disk/by-label/root";
-            fsType = "btrfs";
-          };
+      virtualisation.fileSystems = {
+        "/" = {
+          device = "/dev/disk/by-label/root";
+          fsType = "btrfs";
         };
-
-        swapDevices = [
-          {
-            device = "/var/swapfile";
-            size = 1; # 1MiB.
-          }
-        ];
       };
 
-    testScript = ''
-      machine.wait_for_unit('var-swapfile.swap')
-      # Ensure the swap file creation script ran to completion without failing when creating the swap file
-      machine.fail("systemctl is-failed --quiet mkswap-var-swapfile.service")
-      machine.succeed("stat --file-system --format=%T /var/swapfile | grep btrfs")
-      # First run. Auto creation.
-      machine.succeed("swapon --show | grep /var/swapfile")
+      swapDevices = [
+        {
+          device = "/var/swapfile";
+          size = 1; # 1MiB.
+        }
+      ];
+    };
 
-      machine.shutdown()
-      machine.start()
+  testScript = ''
+    machine.wait_for_unit('var-swapfile.swap')
+    # Ensure the swap file creation script ran to completion without failing when creating the swap file
+    machine.fail("systemctl is-failed --quiet mkswap-var-swapfile.service")
+    machine.succeed("stat --file-system --format=%T /var/swapfile | grep btrfs")
+    # First run. Auto creation.
+    machine.succeed("swapon --show | grep /var/swapfile")
 
-      # Second run. Use it as-is.
-      machine.wait_for_unit('var-swapfile.swap')
-      # Ensure the swap file creation script ran to completion without failing when the swap file already exists
-      machine.fail("systemctl is-failed --quiet mkswap-var-swapfile.service")
-      machine.succeed("swapon --show | grep /var/swapfile")
-    '';
-  }
-)
+    machine.shutdown()
+    machine.start()
+
+    # Second run. Use it as-is.
+    machine.wait_for_unit('var-swapfile.swap')
+    # Ensure the swap file creation script ran to completion without failing when the swap file already exists
+    machine.fail("systemctl is-failed --quiet mkswap-var-swapfile.service")
+    machine.succeed("swapon --show | grep /var/swapfile")
+  '';
+}
diff --git a/nixos/tests/swap-partition.nix b/nixos/tests/swap-partition.nix
index db04bbf559b5..d6310be61202 100644
--- a/nixos/tests/swap-partition.nix
+++ b/nixos/tests/swap-partition.nix
@@ -1,55 +1,53 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "swap-partition";
+{ lib, pkgs, ... }:
+{
+  name = "swap-partition";
 
-    nodes.machine =
-      {
-        config,
-        pkgs,
-        lib,
-        ...
-      }:
-      {
-        virtualisation.useDefaultFilesystems = false;
+  nodes.machine =
+    {
+      config,
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      virtualisation.useDefaultFilesystems = false;
 
-        virtualisation.rootDevice = "/dev/vda1";
+      virtualisation.rootDevice = "/dev/vda1";
 
-        boot.initrd.postDeviceCommands = ''
-          if ! test -b /dev/vda1; then
-            ${pkgs.parted}/bin/parted --script /dev/vda -- mklabel msdos
-            ${pkgs.parted}/bin/parted --script /dev/vda -- mkpart primary 1MiB -250MiB
-            ${pkgs.parted}/bin/parted --script /dev/vda -- mkpart primary -250MiB 100%
-            sync
-          fi
+      boot.initrd.postDeviceCommands = ''
+        if ! test -b /dev/vda1; then
+          ${pkgs.parted}/bin/parted --script /dev/vda -- mklabel msdos
+          ${pkgs.parted}/bin/parted --script /dev/vda -- mkpart primary 1MiB -250MiB
+          ${pkgs.parted}/bin/parted --script /dev/vda -- mkpart primary -250MiB 100%
+          sync
+        fi
 
-          FSTYPE=$(blkid -o value -s TYPE /dev/vda1 || true)
-          if test -z "$FSTYPE"; then
-            ${pkgs.e2fsprogs}/bin/mke2fs -t ext4 -L root /dev/vda1
-            ${pkgs.util-linux}/bin/mkswap --label swap /dev/vda2
-          fi
-        '';
+        FSTYPE=$(blkid -o value -s TYPE /dev/vda1 || true)
+        if test -z "$FSTYPE"; then
+          ${pkgs.e2fsprogs}/bin/mke2fs -t ext4 -L root /dev/vda1
+          ${pkgs.util-linux}/bin/mkswap --label swap /dev/vda2
+        fi
+      '';
 
-        virtualisation.fileSystems = {
-          "/" = {
-            device = "/dev/disk/by-label/root";
-            fsType = "ext4";
-          };
+      virtualisation.fileSystems = {
+        "/" = {
+          device = "/dev/disk/by-label/root";
+          fsType = "ext4";
         };
-
-        swapDevices = [
-          {
-            device = "/dev/disk/by-label/swap";
-          }
-        ];
       };
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
+      swapDevices = [
+        {
+          device = "/dev/disk/by-label/swap";
+        }
+      ];
+    };
 
-      with subtest("Swap is active"):
-        # Doesn't matter if the numbers reported by `free` are slightly off due to unit conversions.
-        machine.succeed("free -h | grep -E 'Swap:\s+2[45][0-9]Mi'")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("Swap is active"):
+      # Doesn't matter if the numbers reported by `free` are slightly off due to unit conversions.
+      machine.succeed("free -h | grep -E 'Swap:\s+2[45][0-9]Mi'")
+  '';
+}
diff --git a/nixos/tests/swap-random-encryption.nix b/nixos/tests/swap-random-encryption.nix
index c48452412534..0b88c21654ca 100644
--- a/nixos/tests/swap-random-encryption.nix
+++ b/nixos/tests/swap-random-encryption.nix
@@ -1,87 +1,85 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "swap-random-encryption";
+{ lib, pkgs, ... }:
+{
+  name = "swap-random-encryption";
 
-    nodes.machine =
-      {
-        config,
-        pkgs,
-        lib,
-        ...
-      }:
-      {
-        environment.systemPackages = [ pkgs.cryptsetup ];
+  nodes.machine =
+    {
+      config,
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      environment.systemPackages = [ pkgs.cryptsetup ];
 
-        virtualisation.useDefaultFilesystems = false;
+      virtualisation.useDefaultFilesystems = false;
 
-        virtualisation.rootDevice = "/dev/vda1";
+      virtualisation.rootDevice = "/dev/vda1";
 
-        boot.initrd.postDeviceCommands = ''
-          if ! test -b /dev/vda1; then
-            ${pkgs.parted}/bin/parted --script /dev/vda -- mklabel msdos
-            ${pkgs.parted}/bin/parted --script /dev/vda -- mkpart primary 1MiB -250MiB
-            ${pkgs.parted}/bin/parted --script /dev/vda -- mkpart primary -250MiB 100%
-            sync
-          fi
+      boot.initrd.postDeviceCommands = ''
+        if ! test -b /dev/vda1; then
+          ${pkgs.parted}/bin/parted --script /dev/vda -- mklabel msdos
+          ${pkgs.parted}/bin/parted --script /dev/vda -- mkpart primary 1MiB -250MiB
+          ${pkgs.parted}/bin/parted --script /dev/vda -- mkpart primary -250MiB 100%
+          sync
+        fi
 
-          FSTYPE=$(blkid -o value -s TYPE /dev/vda1 || true)
-          if test -z "$FSTYPE"; then
-            ${pkgs.e2fsprogs}/bin/mke2fs -t ext4 -L root /dev/vda1
-          fi
-        '';
+        FSTYPE=$(blkid -o value -s TYPE /dev/vda1 || true)
+        if test -z "$FSTYPE"; then
+          ${pkgs.e2fsprogs}/bin/mke2fs -t ext4 -L root /dev/vda1
+        fi
+      '';
 
-        virtualisation.fileSystems = {
-          "/" = {
-            device = "/dev/disk/by-label/root";
-            fsType = "ext4";
-          };
+      virtualisation.fileSystems = {
+        "/" = {
+          device = "/dev/disk/by-label/root";
+          fsType = "ext4";
         };
-
-        swapDevices = [
-          {
-            device = "/dev/vda2";
-
-            randomEncryption = {
-              enable = true;
-              cipher = "aes-xts-plain64";
-              keySize = 512;
-              sectorSize = 4096;
-            };
-          }
-        ];
       };
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
+      swapDevices = [
+        {
+          device = "/dev/vda2";
 
-      with subtest("Swap is active"):
-        # Doesn't matter if the numbers reported by `free` are slightly off due to unit conversions.
-        machine.succeed("free -h | grep -E 'Swap:\s+2[45][0-9]Mi'")
+          randomEncryption = {
+            enable = true;
+            cipher = "aes-xts-plain64";
+            keySize = 512;
+            sectorSize = 4096;
+          };
+        }
+      ];
+    };
 
-      with subtest("Swap device has 4k sector size"):
-        import json
-        result = json.loads(machine.succeed("lsblk -Jo PHY-SEC,LOG-SEC /dev/mapper/dev-vda2"))
-        block_devices = result["blockdevices"]
-        if len(block_devices) != 1:
-          raise Exception ("lsblk output did not report exactly one block device")
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
 
-        swapDevice = block_devices[0];
-        if not (swapDevice["phy-sec"] == 4096 and swapDevice["log-sec"] == 4096):
-          raise Exception ("swap device does not have the sector size specified in the configuration")
+    with subtest("Swap is active"):
+      # Doesn't matter if the numbers reported by `free` are slightly off due to unit conversions.
+      machine.succeed("free -h | grep -E 'Swap:\s+2[45][0-9]Mi'")
 
-      with subtest("Swap encrypt has assigned cipher and keysize"):
-        import re
+    with subtest("Swap device has 4k sector size"):
+      import json
+      result = json.loads(machine.succeed("lsblk -Jo PHY-SEC,LOG-SEC /dev/mapper/dev-vda2"))
+      block_devices = result["blockdevices"]
+      if len(block_devices) != 1:
+        raise Exception ("lsblk output did not report exactly one block device")
 
-        results = machine.succeed("cryptsetup status dev-vda2").splitlines()
+      swapDevice = block_devices[0];
+      if not (swapDevice["phy-sec"] == 4096 and swapDevice["log-sec"] == 4096):
+        raise Exception ("swap device does not have the sector size specified in the configuration")
 
-        cipher_pattern = re.compile(r"\s*cipher:\s+aes-xts-plain64\s*")
-        if not any(cipher_pattern.fullmatch(line) for line in results):
-          raise Exception ("swap device encryption does not use the cipher specified in the configuration")
+    with subtest("Swap encrypt has assigned cipher and keysize"):
+      import re
 
-        key_size_pattern = re.compile(r"\s*keysize:\s+512\s+bits\s*")
-        if not any(key_size_pattern.fullmatch(line) for line in results):
-          raise Exception ("swap device encryption does not use the key size specified in the configuration")
-    '';
-  }
-)
+      results = machine.succeed("cryptsetup status dev-vda2").splitlines()
+
+      cipher_pattern = re.compile(r"\s*cipher:\s+aes-xts-plain64\s*")
+      if not any(cipher_pattern.fullmatch(line) for line in results):
+        raise Exception ("swap device encryption does not use the cipher specified in the configuration")
+
+      key_size_pattern = re.compile(r"\s*keysize:\s+512\s+bits\s*")
+      if not any(key_size_pattern.fullmatch(line) for line in results):
+        raise Exception ("swap device encryption does not use the key size specified in the configuration")
+  '';
+}
diff --git a/nixos/tests/sway.nix b/nixos/tests/sway.nix
index 75035c5b9f65..a79e692d24cb 100644
--- a/nixos/tests/sway.nix
+++ b/nixos/tests/sway.nix
@@ -1,207 +1,205 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "sway";
-    meta = {
-      maintainers = with lib.maintainers; [
-        primeos
-        synthetica
-      ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "sway";
+  meta = {
+    maintainers = with lib.maintainers; [
+      primeos
+      synthetica
+    ];
+  };
 
-    # testScriptWithTypes:49: error: Cannot call function of unknown type
-    #           (machine.succeed if succeed else machine.execute)(
-    #           ^
-    # Found 1 error in 1 file (checked 1 source file)
-    skipTypeCheck = true;
+  # testScriptWithTypes:49: error: Cannot call function of unknown type
+  #           (machine.succeed if succeed else machine.execute)(
+  #           ^
+  # Found 1 error in 1 file (checked 1 source file)
+  skipTypeCheck = true;
 
-    nodes.machine =
-      { config, ... }:
-      {
-        # Automatically login on tty1 as a normal user:
-        imports = [ ./common/user-account.nix ];
-        services.getty.autologinUser = "alice";
+  nodes.machine =
+    { config, ... }:
+    {
+      # Automatically login on tty1 as a normal user:
+      imports = [ ./common/user-account.nix ];
+      services.getty.autologinUser = "alice";
 
-        environment = {
-          # For glinfo and wayland-info:
-          systemPackages = with pkgs; [
-            mesa-demos
-            wayland-utils
-            alacritty
-          ];
-          # Use a fixed SWAYSOCK path (for swaymsg):
-          variables = {
-            "SWAYSOCK" = "/tmp/sway-ipc.sock";
-            # TODO: Investigate if we can get hardware acceleration to work (via
-            # virtio-gpu and Virgil). We currently have to use the Pixman software
-            # renderer since the GLES2 renderer doesn't work inside the VM (even
-            # with WLR_RENDERER_ALLOW_SOFTWARE):
-            # "WLR_RENDERER_ALLOW_SOFTWARE" = "1";
-            "WLR_RENDERER" = "pixman";
-          };
-          # For convenience:
-          shellAliases = {
-            test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
-            test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
-          };
-
-          # To help with OCR:
-          etc."xdg/foot/foot.ini".text = lib.generators.toINI { } {
-            main = {
-              font = "inconsolata:size=14";
-            };
-            colors = rec {
-              foreground = "000000";
-              background = "ffffff";
-              regular2 = foreground;
-            };
-          };
-
-          etc."gpg-agent.conf".text = ''
-            pinentry-timeout 86400
-          '';
+      environment = {
+        # For glinfo and wayland-info:
+        systemPackages = with pkgs; [
+          mesa-demos
+          wayland-utils
+          alacritty
+        ];
+        # Use a fixed SWAYSOCK path (for swaymsg):
+        variables = {
+          "SWAYSOCK" = "/tmp/sway-ipc.sock";
+          # TODO: Investigate if we can get hardware acceleration to work (via
+          # virtio-gpu and Virgil). We currently have to use the Pixman software
+          # renderer since the GLES2 renderer doesn't work inside the VM (even
+          # with WLR_RENDERER_ALLOW_SOFTWARE):
+          # "WLR_RENDERER_ALLOW_SOFTWARE" = "1";
+          "WLR_RENDERER" = "pixman";
+        };
+        # For convenience:
+        shellAliases = {
+          test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
+          test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
         };
 
-        fonts.packages = [ pkgs.inconsolata ];
+        # To help with OCR:
+        etc."xdg/foot/foot.ini".text = lib.generators.toINI { } {
+          main = {
+            font = "inconsolata:size=14";
+          };
+          colors = rec {
+            foreground = "000000";
+            background = "ffffff";
+            regular2 = foreground;
+          };
+        };
 
-        # Automatically configure and start Sway when logging in on tty1:
-        programs.bash.loginShellInit = ''
-          if [ "$(tty)" = "/dev/tty1" ]; then
-            set -e
-
-            mkdir -p ~/.config/sway
-            sed s/Mod4/Mod1/ /etc/sway/config > ~/.config/sway/config
-
-            sway --validate
-            sway && touch /tmp/sway-exit-ok
-          fi
+        etc."gpg-agent.conf".text = ''
+          pinentry-timeout 86400
         '';
-
-        programs.sway.enable = true;
-
-        # To test pinentry via gpg-agent:
-        programs.gnupg.agent.enable = true;
-
-        # Need to switch to a different GPU driver than the default one (-vga std) so that Sway can launch:
-        virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
       };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        import shlex
-        import json
+      fonts.packages = [ pkgs.inconsolata ];
 
-        q = shlex.quote
-        NODE_GROUPS = ["nodes", "floating_nodes"]
+      # Automatically configure and start Sway when logging in on tty1:
+      programs.bash.loginShellInit = ''
+        if [ "$(tty)" = "/dev/tty1" ]; then
+          set -e
 
+          mkdir -p ~/.config/sway
+          sed s/Mod4/Mod1/ /etc/sway/config > ~/.config/sway/config
 
-        def swaymsg(command: str = "", succeed=True, type="command"):
-            assert command != "" or type != "command", "Must specify command or type"
-            shell = q(f"swaymsg -t {q(type)} -- {q(command)}")
-            with machine.nested(
-                f"sending swaymsg {shell!r}" + " (allowed to fail)" * (not succeed)
-            ):
-                ret = (machine.succeed if succeed else machine.execute)(
-                    f"su - alice -c {shell}"
-                )
-
-            # execute also returns a status code, but disregard.
-            if not succeed:
-                _, ret = ret
-
-            if not succeed and not ret:
-                return None
-
-            parsed = json.loads(ret)
-            return parsed
-
-
-        def walk(tree):
-            yield tree
-            for group in NODE_GROUPS:
-                for node in tree.get(group, []):
-                    yield from walk(node)
-
-
-        def wait_for_window(pattern):
-            def func(last_chance):
-                nodes = (node["name"] for node in walk(swaymsg(type="get_tree")))
-
-                if last_chance:
-                    nodes = list(nodes)
-                    machine.log(f"Last call! Current list of windows: {nodes}")
-
-                return any(pattern in name for name in nodes)
-
-            retry(func)
-
-        start_all()
-        machine.wait_for_unit("multi-user.target")
-
-        # To check the version:
-        print(machine.succeed("sway --version"))
-
-        # Wait for Sway to complete startup:
-        machine.wait_for_file("/run/user/1000/wayland-1")
-        machine.wait_for_file("/tmp/sway-ipc.sock")
-
-        # Test XWayland (foot does not support X):
-        swaymsg("exec WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY= alacritty")
-        wait_for_window("alice@machine")
-        machine.send_chars("test-x11\n")
-        machine.wait_for_file("/tmp/test-x11-exit-ok")
-        print(machine.succeed("cat /tmp/test-x11.out"))
-        machine.copy_from_vm("/tmp/test-x11.out")
-        machine.screenshot("alacritty_glinfo")
-        machine.succeed("pkill alacritty")
-
-        # Start a terminal (foot) on workspace 3:
-        machine.send_key("alt-3")
-        machine.sleep(3)
-        machine.send_key("alt-ret")
-        wait_for_window("alice@machine")
-        machine.send_chars("test-wayland\n")
-        machine.wait_for_file("/tmp/test-wayland-exit-ok")
-        print(machine.succeed("cat /tmp/test-wayland.out"))
-        machine.copy_from_vm("/tmp/test-wayland.out")
-        machine.screenshot("foot_wayland_info")
-        machine.send_key("alt-shift-q")
-        machine.wait_until_fails("pgrep foot")
-
-        # Test gpg-agent starting pinentry-gnome3 via D-Bus (tests if
-        # $WAYLAND_DISPLAY is correctly imported into the D-Bus user env):
-        swaymsg("exec mkdir -p ~/.gnupg")
-        swaymsg("exec cp /etc/gpg-agent.conf ~/.gnupg")
-
-        swaymsg("exec DISPLAY=INVALID gpg --no-tty --yes --quick-generate-key test", succeed=False)
-        machine.wait_until_succeeds("pgrep --exact gpg")
-        wait_for_window("gpg")
-        machine.succeed("pgrep --exact gpg")
-        machine.screenshot("gpg_pinentry")
-        machine.send_key("alt-shift-q")
-        machine.wait_until_fails("pgrep --exact gpg")
-
-        # Test swaynag:
-        def get_height():
-            return [node['rect']['height'] for node in walk(swaymsg(type="get_tree")) if node['focused']][0]
-
-        before = get_height()
-        machine.send_key("alt-shift-e")
-        retry(lambda _: get_height() < before)
-        machine.screenshot("sway_exit")
-
-        swaymsg("exec swaylock")
-        machine.wait_until_succeeds("pgrep -xf swaylock")
-        machine.sleep(3)
-        machine.send_chars("${nodes.machine.config.users.users.alice.password}")
-        machine.send_key("ret")
-        machine.wait_until_fails("pgrep -xf swaylock")
-
-        # Exit Sway and verify process exit status 0:
-        swaymsg("exit", succeed=False)
-        machine.wait_until_fails("pgrep -xf sway")
-        machine.wait_for_file("/tmp/sway-exit-ok")
+          sway --validate
+          sway && touch /tmp/sway-exit-ok
+        fi
       '';
-  }
-)
+
+      programs.sway.enable = true;
+
+      # To test pinentry via gpg-agent:
+      programs.gnupg.agent.enable = true;
+
+      # Need to switch to a different GPU driver than the default one (-vga std) so that Sway can launch:
+      virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      import shlex
+      import json
+
+      q = shlex.quote
+      NODE_GROUPS = ["nodes", "floating_nodes"]
+
+
+      def swaymsg(command: str = "", succeed=True, type="command"):
+          assert command != "" or type != "command", "Must specify command or type"
+          shell = q(f"swaymsg -t {q(type)} -- {q(command)}")
+          with machine.nested(
+              f"sending swaymsg {shell!r}" + " (allowed to fail)" * (not succeed)
+          ):
+              ret = (machine.succeed if succeed else machine.execute)(
+                  f"su - alice -c {shell}"
+              )
+
+          # execute also returns a status code, but disregard.
+          if not succeed:
+              _, ret = ret
+
+          if not succeed and not ret:
+              return None
+
+          parsed = json.loads(ret)
+          return parsed
+
+
+      def walk(tree):
+          yield tree
+          for group in NODE_GROUPS:
+              for node in tree.get(group, []):
+                  yield from walk(node)
+
+
+      def wait_for_window(pattern):
+          def func(last_chance):
+              nodes = (node["name"] for node in walk(swaymsg(type="get_tree")))
+
+              if last_chance:
+                  nodes = list(nodes)
+                  machine.log(f"Last call! Current list of windows: {nodes}")
+
+              return any(pattern in name for name in nodes)
+
+          retry(func)
+
+      start_all()
+      machine.wait_for_unit("multi-user.target")
+
+      # To check the version:
+      print(machine.succeed("sway --version"))
+
+      # Wait for Sway to complete startup:
+      machine.wait_for_file("/run/user/1000/wayland-1")
+      machine.wait_for_file("/tmp/sway-ipc.sock")
+
+      # Test XWayland (foot does not support X):
+      swaymsg("exec WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY= alacritty")
+      wait_for_window("alice@machine")
+      machine.send_chars("test-x11\n")
+      machine.wait_for_file("/tmp/test-x11-exit-ok")
+      print(machine.succeed("cat /tmp/test-x11.out"))
+      machine.copy_from_vm("/tmp/test-x11.out")
+      machine.screenshot("alacritty_glinfo")
+      machine.succeed("pkill alacritty")
+
+      # Start a terminal (foot) on workspace 3:
+      machine.send_key("alt-3")
+      machine.sleep(3)
+      machine.send_key("alt-ret")
+      wait_for_window("alice@machine")
+      machine.send_chars("test-wayland\n")
+      machine.wait_for_file("/tmp/test-wayland-exit-ok")
+      print(machine.succeed("cat /tmp/test-wayland.out"))
+      machine.copy_from_vm("/tmp/test-wayland.out")
+      machine.screenshot("foot_wayland_info")
+      machine.send_key("alt-shift-q")
+      machine.wait_until_fails("pgrep foot")
+
+      # Test gpg-agent starting pinentry-gnome3 via D-Bus (tests if
+      # $WAYLAND_DISPLAY is correctly imported into the D-Bus user env):
+      swaymsg("exec mkdir -p ~/.gnupg")
+      swaymsg("exec cp /etc/gpg-agent.conf ~/.gnupg")
+
+      swaymsg("exec DISPLAY=INVALID gpg --no-tty --yes --quick-generate-key test", succeed=False)
+      machine.wait_until_succeeds("pgrep --exact gpg")
+      wait_for_window("gpg")
+      machine.succeed("pgrep --exact gpg")
+      machine.screenshot("gpg_pinentry")
+      machine.send_key("alt-shift-q")
+      machine.wait_until_fails("pgrep --exact gpg")
+
+      # Test swaynag:
+      def get_height():
+          return [node['rect']['height'] for node in walk(swaymsg(type="get_tree")) if node['focused']][0]
+
+      before = get_height()
+      machine.send_key("alt-shift-e")
+      retry(lambda _: get_height() < before)
+      machine.screenshot("sway_exit")
+
+      swaymsg("exec swaylock")
+      machine.wait_until_succeeds("pgrep -xf swaylock")
+      machine.sleep(3)
+      machine.send_chars("${nodes.machine.config.users.users.alice.password}")
+      machine.send_key("ret")
+      machine.wait_until_fails("pgrep -xf swaylock")
+
+      # Exit Sway and verify process exit status 0:
+      swaymsg("exit", succeed=False)
+      machine.wait_until_fails("pgrep -xf sway")
+      machine.wait_for_file("/tmp/sway-exit-ok")
+    '';
+}
diff --git a/nixos/tests/swayfx.nix b/nixos/tests/swayfx.nix
index 7fa5c602f520..1f9b19f335f9 100644
--- a/nixos/tests/swayfx.nix
+++ b/nixos/tests/swayfx.nix
@@ -1,205 +1,203 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "swayfx";
-    meta = {
-      maintainers = with lib.maintainers; [ ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "swayfx";
+  meta = {
+    maintainers = with lib.maintainers; [ ];
+  };
 
-    # testScriptWithTypes:49: error: Cannot call function of unknown type
-    #           (machine.succeed if succeed else machine.execute)(
-    #           ^
-    # Found 1 error in 1 file (checked 1 source file)
-    skipTypeCheck = true;
+  # testScriptWithTypes:49: error: Cannot call function of unknown type
+  #           (machine.succeed if succeed else machine.execute)(
+  #           ^
+  # Found 1 error in 1 file (checked 1 source file)
+  skipTypeCheck = true;
 
-    nodes.machine = {
-      # Automatically login on tty1 as a normal user:
-      imports = [ ./common/user-account.nix ];
-      services.getty.autologinUser = "alice";
+  nodes.machine = {
+    # Automatically login on tty1 as a normal user:
+    imports = [ ./common/user-account.nix ];
+    services.getty.autologinUser = "alice";
 
-      environment = {
-        # For glinfo and wayland-info:
-        systemPackages = with pkgs; [
-          mesa-demos
-          wayland-utils
-          alacritty
-        ];
-        # Use a fixed SWAYSOCK path (for swaymsg):
-        variables = {
-          "SWAYSOCK" = "/tmp/sway-ipc.sock";
-          # TODO: Investigate if we can get hardware acceleration to work (via
-          # virtio-gpu and Virgil). We currently have to use the Pixman software
-          # renderer since the GLES2 renderer doesn't work inside the VM (even
-          # with WLR_RENDERER_ALLOW_SOFTWARE):
-          # "WLR_RENDERER_ALLOW_SOFTWARE" = "1";
-          "WLR_RENDERER" = "pixman";
-        };
-        # For convenience:
-        shellAliases = {
-          test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
-          test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
-        };
-
-        # To help with OCR:
-        etc."xdg/foot/foot.ini".text = lib.generators.toINI { } {
-          main = {
-            font = "inconsolata:size=14";
-          };
-          colors = rec {
-            foreground = "000000";
-            background = "ffffff";
-            regular2 = foreground;
-          };
-        };
-
-        etc."gpg-agent.conf".text = ''
-          pinentry-timeout 86400
-        '';
+    environment = {
+      # For glinfo and wayland-info:
+      systemPackages = with pkgs; [
+        mesa-demos
+        wayland-utils
+        alacritty
+      ];
+      # Use a fixed SWAYSOCK path (for swaymsg):
+      variables = {
+        "SWAYSOCK" = "/tmp/sway-ipc.sock";
+        # TODO: Investigate if we can get hardware acceleration to work (via
+        # virtio-gpu and Virgil). We currently have to use the Pixman software
+        # renderer since the GLES2 renderer doesn't work inside the VM (even
+        # with WLR_RENDERER_ALLOW_SOFTWARE):
+        # "WLR_RENDERER_ALLOW_SOFTWARE" = "1";
+        "WLR_RENDERER" = "pixman";
+      };
+      # For convenience:
+      shellAliases = {
+        test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
+        test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
       };
 
-      fonts.packages = [ pkgs.inconsolata ];
-
-      # Automatically configure and start Sway when logging in on tty1:
-      programs.bash.loginShellInit = ''
-        if [ "$(tty)" = "/dev/tty1" ]; then
-          set -e
-
-          mkdir -p ~/.config/sway
-          sed s/Mod4/Mod1/ /etc/sway/config > ~/.config/sway/config
-
-          sway --validate
-          sway && touch /tmp/sway-exit-ok
-        fi
-      '';
-
-      programs.sway = {
-        enable = true;
-        package = pkgs.swayfx.override { isNixOS = true; };
+      # To help with OCR:
+      etc."xdg/foot/foot.ini".text = lib.generators.toINI { } {
+        main = {
+          font = "inconsolata:size=14";
+        };
+        colors = rec {
+          foreground = "000000";
+          background = "ffffff";
+          regular2 = foreground;
+        };
       };
 
-      # To test pinentry via gpg-agent:
-      programs.gnupg.agent.enable = true;
-
-      # Need to switch to a different GPU driver than the default one (-vga std) so that Sway can launch:
-      virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
+      etc."gpg-agent.conf".text = ''
+        pinentry-timeout 86400
+      '';
     };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        import shlex
-        import json
+    fonts.packages = [ pkgs.inconsolata ];
 
-        q = shlex.quote
-        NODE_GROUPS = ["nodes", "floating_nodes"]
+    # Automatically configure and start Sway when logging in on tty1:
+    programs.bash.loginShellInit = ''
+      if [ "$(tty)" = "/dev/tty1" ]; then
+        set -e
+
+        mkdir -p ~/.config/sway
+        sed s/Mod4/Mod1/ /etc/sway/config > ~/.config/sway/config
+
+        sway --validate
+        sway && touch /tmp/sway-exit-ok
+      fi
+    '';
+
+    programs.sway = {
+      enable = true;
+      package = pkgs.swayfx.override { isNixOS = true; };
+    };
+
+    # To test pinentry via gpg-agent:
+    programs.gnupg.agent.enable = true;
+
+    # Need to switch to a different GPU driver than the default one (-vga std) so that Sway can launch:
+    virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      import shlex
+      import json
+
+      q = shlex.quote
+      NODE_GROUPS = ["nodes", "floating_nodes"]
 
 
-        def swaymsg(command: str = "", succeed=True, type="command"):
-            assert command != "" or type != "command", "Must specify command or type"
-            shell = q(f"swaymsg -t {q(type)} -- {q(command)}")
-            with machine.nested(
-                f"sending swaymsg {shell!r}" + " (allowed to fail)" * (not succeed)
-            ):
-                ret = (machine.succeed if succeed else machine.execute)(
-                    f"su - alice -c {shell}"
-                )
+      def swaymsg(command: str = "", succeed=True, type="command"):
+          assert command != "" or type != "command", "Must specify command or type"
+          shell = q(f"swaymsg -t {q(type)} -- {q(command)}")
+          with machine.nested(
+              f"sending swaymsg {shell!r}" + " (allowed to fail)" * (not succeed)
+          ):
+              ret = (machine.succeed if succeed else machine.execute)(
+                  f"su - alice -c {shell}"
+              )
 
-            # execute also returns a status code, but disregard.
-            if not succeed:
-                _, ret = ret
+          # execute also returns a status code, but disregard.
+          if not succeed:
+              _, ret = ret
 
-            if not succeed and not ret:
-                return None
+          if not succeed and not ret:
+              return None
 
-            parsed = json.loads(ret)
-            return parsed
+          parsed = json.loads(ret)
+          return parsed
 
 
-        def walk(tree):
-            yield tree
-            for group in NODE_GROUPS:
-                for node in tree.get(group, []):
-                    yield from walk(node)
+      def walk(tree):
+          yield tree
+          for group in NODE_GROUPS:
+              for node in tree.get(group, []):
+                  yield from walk(node)
 
 
-        def wait_for_window(pattern):
-            def func(last_chance):
-                nodes = (node["name"] for node in walk(swaymsg(type="get_tree")))
+      def wait_for_window(pattern):
+          def func(last_chance):
+              nodes = (node["name"] for node in walk(swaymsg(type="get_tree")))
 
-                if last_chance:
-                    nodes = list(nodes)
-                    machine.log(f"Last call! Current list of windows: {nodes}")
+              if last_chance:
+                  nodes = list(nodes)
+                  machine.log(f"Last call! Current list of windows: {nodes}")
 
-                return any(pattern in name for name in nodes)
+              return any(pattern in name for name in nodes)
 
-            retry(func)
+          retry(func)
 
-        start_all()
-        machine.wait_for_unit("multi-user.target")
+      start_all()
+      machine.wait_for_unit("multi-user.target")
 
-        # To check the version:
-        print(machine.succeed("sway --version"))
+      # To check the version:
+      print(machine.succeed("sway --version"))
 
-        # Wait for Sway to complete startup:
-        machine.wait_for_file("/run/user/1000/wayland-1")
-        machine.wait_for_file("/tmp/sway-ipc.sock")
+      # Wait for Sway to complete startup:
+      machine.wait_for_file("/run/user/1000/wayland-1")
+      machine.wait_for_file("/tmp/sway-ipc.sock")
 
-        # Test XWayland (foot does not support X):
-        swaymsg("exec WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY= alacritty")
-        wait_for_window("alice@machine")
-        machine.send_chars("test-x11\n")
-        machine.wait_for_file("/tmp/test-x11-exit-ok")
-        print(machine.succeed("cat /tmp/test-x11.out"))
-        machine.copy_from_vm("/tmp/test-x11.out")
-        machine.screenshot("alacritty_glinfo")
-        machine.succeed("pkill alacritty")
+      # Test XWayland (foot does not support X):
+      swaymsg("exec WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY= alacritty")
+      wait_for_window("alice@machine")
+      machine.send_chars("test-x11\n")
+      machine.wait_for_file("/tmp/test-x11-exit-ok")
+      print(machine.succeed("cat /tmp/test-x11.out"))
+      machine.copy_from_vm("/tmp/test-x11.out")
+      machine.screenshot("alacritty_glinfo")
+      machine.succeed("pkill alacritty")
 
-        # Start a terminal (foot) on workspace 3:
-        machine.send_key("alt-3")
-        machine.sleep(3)
-        machine.send_key("alt-ret")
-        wait_for_window("alice@machine")
-        machine.send_chars("test-wayland\n")
-        machine.wait_for_file("/tmp/test-wayland-exit-ok")
-        print(machine.succeed("cat /tmp/test-wayland.out"))
-        machine.copy_from_vm("/tmp/test-wayland.out")
-        machine.screenshot("foot_wayland_info")
-        machine.send_key("alt-shift-q")
-        machine.wait_until_fails("pgrep foot")
+      # Start a terminal (foot) on workspace 3:
+      machine.send_key("alt-3")
+      machine.sleep(3)
+      machine.send_key("alt-ret")
+      wait_for_window("alice@machine")
+      machine.send_chars("test-wayland\n")
+      machine.wait_for_file("/tmp/test-wayland-exit-ok")
+      print(machine.succeed("cat /tmp/test-wayland.out"))
+      machine.copy_from_vm("/tmp/test-wayland.out")
+      machine.screenshot("foot_wayland_info")
+      machine.send_key("alt-shift-q")
+      machine.wait_until_fails("pgrep foot")
 
-        # Test gpg-agent starting pinentry-gnome3 via D-Bus (tests if
-        # $WAYLAND_DISPLAY is correctly imported into the D-Bus user env):
-        swaymsg("exec mkdir -p ~/.gnupg")
-        swaymsg("exec cp /etc/gpg-agent.conf ~/.gnupg")
+      # Test gpg-agent starting pinentry-gnome3 via D-Bus (tests if
+      # $WAYLAND_DISPLAY is correctly imported into the D-Bus user env):
+      swaymsg("exec mkdir -p ~/.gnupg")
+      swaymsg("exec cp /etc/gpg-agent.conf ~/.gnupg")
 
-        swaymsg("exec DISPLAY=INVALID gpg --no-tty --yes --quick-generate-key test", succeed=False)
-        machine.wait_until_succeeds("pgrep --exact gpg")
-        wait_for_window("gpg")
-        machine.succeed("pgrep --exact gpg")
-        machine.screenshot("gpg_pinentry")
-        machine.send_key("alt-shift-q")
-        machine.wait_until_fails("pgrep --exact gpg")
+      swaymsg("exec DISPLAY=INVALID gpg --no-tty --yes --quick-generate-key test", succeed=False)
+      machine.wait_until_succeeds("pgrep --exact gpg")
+      wait_for_window("gpg")
+      machine.succeed("pgrep --exact gpg")
+      machine.screenshot("gpg_pinentry")
+      machine.send_key("alt-shift-q")
+      machine.wait_until_fails("pgrep --exact gpg")
 
-        # Test swaynag:
-        def get_height():
-            return [node['rect']['height'] for node in walk(swaymsg(type="get_tree")) if node['focused']][0]
+      # Test swaynag:
+      def get_height():
+          return [node['rect']['height'] for node in walk(swaymsg(type="get_tree")) if node['focused']][0]
 
-        before = get_height()
-        machine.send_key("alt-shift-e")
-        retry(lambda _: get_height() < before)
-        machine.screenshot("sway_exit")
+      before = get_height()
+      machine.send_key("alt-shift-e")
+      retry(lambda _: get_height() < before)
+      machine.screenshot("sway_exit")
 
-        swaymsg("exec swaylock")
-        machine.wait_until_succeeds("pgrep -xf swaylock")
-        machine.sleep(3)
-        machine.send_chars("${nodes.machine.users.users.alice.password}")
-        machine.send_key("ret")
-        machine.wait_until_fails("pgrep -xf swaylock")
+      swaymsg("exec swaylock")
+      machine.wait_until_succeeds("pgrep -xf swaylock")
+      machine.sleep(3)
+      machine.send_chars("${nodes.machine.users.users.alice.password}")
+      machine.send_key("ret")
+      machine.wait_until_fails("pgrep -xf swaylock")
 
-        # Exit Sway and verify process exit status 0:
-        swaymsg("exit", succeed=False)
-        machine.wait_until_fails("pgrep -xf sway")
-        machine.wait_for_file("/tmp/sway-exit-ok")
-      '';
-  }
-)
+      # Exit Sway and verify process exit status 0:
+      swaymsg("exit", succeed=False)
+      machine.wait_until_fails("pgrep -xf sway")
+      machine.wait_for_file("/tmp/sway-exit-ok")
+    '';
+}
diff --git a/nixos/tests/sx.nix b/nixos/tests/sx.nix
index 1cdc4858cf00..8fc41621a7c4 100644
--- a/nixos/tests/sx.nix
+++ b/nixos/tests/sx.nix
@@ -1,63 +1,61 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "sx";
-    meta.maintainers = with lib.maintainers; [
-      figsoda
-      thiagokokada
-    ];
+{ pkgs, lib, ... }:
+{
+  name = "sx";
+  meta.maintainers = with lib.maintainers; [
+    figsoda
+    thiagokokada
+  ];
 
-    nodes.machine =
-      { ... }:
-      {
-        imports = [ ./common/user-account.nix ];
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ./common/user-account.nix ];
 
-        environment.systemPackages = with pkgs; [ icewm ];
+      environment.systemPackages = with pkgs; [ icewm ];
 
-        services.getty.autologinUser = "alice";
+      services.getty.autologinUser = "alice";
 
-        services.xserver = {
-          enable = true;
-          displayManager.sx.enable = true;
-        };
-
-        # Create sxrc file on login and start sx
-        programs.bash.loginShellInit =
-          # bash
-          ''
-            mkdir -p "$HOME/.config/sx"
-            echo 'exec icewm' > "$HOME/.config/sx/sxrc"
-            chmod +x "$HOME/.config/sx/sxrc"
-
-            sx
-          '';
+      services.xserver = {
+        enable = true;
+        displayManager.sx.enable = true;
       };
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.users.users.alice;
-      in
-      # python
-      ''
-        start_all()
+      # Create sxrc file on login and start sx
+      programs.bash.loginShellInit =
+        # bash
+        ''
+          mkdir -p "$HOME/.config/sx"
+          echo 'exec icewm' > "$HOME/.config/sx/sxrc"
+          chmod +x "$HOME/.config/sx/sxrc"
 
-        machine.wait_for_unit("multi-user.target")
+          sx
+        '';
+    };
 
-        xauthority = "${user.home}/.local/share/sx/xauthority"
-        machine.wait_for_file(xauthority)
-        machine.succeed(f"xauth merge {xauthority}")
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+    in
+    # python
+    ''
+      start_all()
 
-        def icewm_is_visible(_last_try: bool) -> bool:
-            # sx will set DISPLAY as the TTY number we started, in this case
-            # TTY1:
-            # https://github.com/Earnestly/sx/blob/master/sx#L41.
-            # We can't use `machine.wait_for_window` here since we are running
-            # X as alice and not root.
-            return "IceWM" in machine.succeed("DISPLAY=:1 xwininfo -root -tree")
+      machine.wait_for_unit("multi-user.target")
 
-        # Adding a retry logic to increase reliability
-        retry(icewm_is_visible)
-      '';
-  }
-)
+      xauthority = "${user.home}/.local/share/sx/xauthority"
+      machine.wait_for_file(xauthority)
+      machine.succeed(f"xauth merge {xauthority}")
+
+      def icewm_is_visible(_last_try: bool) -> bool:
+          # sx will set DISPLAY as the TTY number we started, in this case
+          # TTY1:
+          # https://github.com/Earnestly/sx/blob/master/sx#L41.
+          # We can't use `machine.wait_for_window` here since we are running
+          # X as alice and not root.
+          return "IceWM" in machine.succeed("DISPLAY=:1 xwininfo -root -tree")
+
+      # Adding a retry logic to increase reliability
+      retry(icewm_is_visible)
+    '';
+}
diff --git a/nixos/tests/sympa.nix b/nixos/tests/sympa.nix
index 57284b75643e..de7e469f74d1 100644
--- a/nixos/tests/sympa.nix
+++ b/nixos/tests/sympa.nix
@@ -1,38 +1,36 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "sympa";
-    meta.maintainers = with lib.maintainers; [ ];
+{ pkgs, lib, ... }:
+{
+  name = "sympa";
+  meta.maintainers = with lib.maintainers; [ ];
 
-    nodes.machine =
-      { ... }:
-      {
+  nodes.machine =
+    { ... }:
+    {
 
-        services.sympa = {
-          enable = true;
-          domains = {
-            "lists.example.org" = {
-              webHost = "localhost";
-            };
-          };
-          listMasters = [ "bob@example.org" ];
-          web.enable = true;
-          web.https = false;
-          database = {
-            type = "PostgreSQL";
-            createLocally = true;
+      services.sympa = {
+        enable = true;
+        domains = {
+          "lists.example.org" = {
+            webHost = "localhost";
           };
         };
+        listMasters = [ "bob@example.org" ];
+        web.enable = true;
+        web.https = false;
+        database = {
+          type = "PostgreSQL";
+          createLocally = true;
+        };
       };
+    };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine.wait_for_unit("sympa.service")
-      machine.wait_for_unit("wwsympa.service")
-      assert "Mailing lists service" in machine.succeed(
-          "curl --fail --insecure -L http://localhost/"
-      )
-    '';
-  }
-)
+    machine.wait_for_unit("sympa.service")
+    machine.wait_for_unit("wwsympa.service")
+    assert "Mailing lists service" in machine.succeed(
+        "curl --fail --insecure -L http://localhost/"
+    )
+  '';
+}
diff --git a/nixos/tests/syncthing-init.nix b/nixos/tests/syncthing-init.nix
index a4401805dcb2..8424b052f6fc 100644
--- a/nixos/tests/syncthing-init.nix
+++ b/nixos/tests/syncthing-init.nix
@@ -1,35 +1,33 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
+{ lib, pkgs, ... }:
+let
 
-    testId = "7CFNTQM-IMTJBHJ-3UWRDIU-ZGQJFR6-VCXZ3NB-XUH3KZO-N52ITXR-LAIYUAU";
+  testId = "7CFNTQM-IMTJBHJ-3UWRDIU-ZGQJFR6-VCXZ3NB-XUH3KZO-N52ITXR-LAIYUAU";
 
-  in
-  {
-    name = "syncthing-init";
-    meta.maintainers = with pkgs.lib.maintainers; [ lassulus ];
+in
+{
+  name = "syncthing-init";
+  meta.maintainers = with pkgs.lib.maintainers; [ lassulus ];
 
-    nodes.machine = {
-      services.syncthing = {
-        enable = true;
-        settings.devices.testDevice = {
-          id = testId;
-        };
-        settings.folders.testFolder = {
-          path = "/tmp/test";
-          devices = [ "testDevice" ];
-        };
-        settings.gui.user = "guiUser";
+  nodes.machine = {
+    services.syncthing = {
+      enable = true;
+      settings.devices.testDevice = {
+        id = testId;
       };
+      settings.folders.testFolder = {
+        path = "/tmp/test";
+        devices = [ "testDevice" ];
+      };
+      settings.gui.user = "guiUser";
     };
+  };
 
-    testScript = ''
-      machine.wait_for_unit("syncthing-init.service")
-      config = machine.succeed("cat /var/lib/syncthing/.config/syncthing/config.xml")
+  testScript = ''
+    machine.wait_for_unit("syncthing-init.service")
+    config = machine.succeed("cat /var/lib/syncthing/.config/syncthing/config.xml")
 
-      assert "testFolder" in config
-      assert "${testId}" in config
-      assert "guiUser" in config
-    '';
-  }
-)
+    assert "testFolder" in config
+    assert "${testId}" in config
+    assert "guiUser" in config
+  '';
+}
diff --git a/nixos/tests/syncthing-many-devices.nix b/nixos/tests/syncthing-many-devices.nix
index b60569578071..a00026faf299 100644
--- a/nixos/tests/syncthing-many-devices.nix
+++ b/nixos/tests/syncthing-many-devices.nix
@@ -1,225 +1,223 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  # This nixosTest is supposed to check the following:
-  #
-  # - Whether syncthing's API handles multiple requests for many devices, see
-  #   https://github.com/NixOS/nixpkgs/issues/260262
-  #
-  # - Whether syncthing-init.service generated bash script removes devices and
-  #   folders that are not present in the user's configuration, which is partly
-  #   injected into the script. See also:
-  #   https://github.com/NixOS/nixpkgs/issues/259256
-  #
+# This nixosTest is supposed to check the following:
+#
+# - Whether syncthing's API handles multiple requests for many devices, see
+#   https://github.com/NixOS/nixpkgs/issues/260262
+#
+# - Whether syncthing-init.service generated bash script removes devices and
+#   folders that are not present in the user's configuration, which is partly
+#   injected into the script. See also:
+#   https://github.com/NixOS/nixpkgs/issues/259256
+#
 
-  let
-    # Just a long path not to copy paste
-    configPath = "/var/lib/syncthing/.config/syncthing/config.xml";
+let
+  # Just a long path not to copy paste
+  configPath = "/var/lib/syncthing/.config/syncthing/config.xml";
 
-    # We will iterate this and more attribute sets defined here, later in the
-    # testScript. Start with this, and distinguish these settings from other
-    # settings, as we check these differently with xmllint, due to the ID.
-    settingsWithId = {
-      devices = {
-        # All of the device IDs used here were generated by the following command:
-        #
-        #    (${pkgs.syncthing}/bin/syncthing generate --home /tmp/foo\
-        #       | grep ID: | sed 's/.*ID: *//') && rm -rf /tmp/foo
-        #
-        # See also discussion at:
-        # https://forum.syncthing.net/t/how-to-generate-dummy-device-ids/20927/8
-        test_device1.id = "IVTZ5XF-EF3GKFT-GS4AZLG-IT6H2ZP-6WK75SF-AFXQXJJ-BNRZ4N6-XPDKVAU";
-        test_device2.id = "5C35H56-Z2GFF4F-F3IVD4B-GJYVWIE-SMDBJZN-GI66KWP-52JIQGN-4AVLYAM";
-        test_device3.id = "XKLSKHE-BZOHV7B-WQZACEF-GTH36NP-6JSBB6L-RXS3M7C-EEVWO2L-C5B4OAJ";
-        test_device4.id = "APN5Q7J-35GZETO-5KCLF35-ZA7KBWK-HGWPBNG-FERF24R-UTLGMEX-4VJ6PQX";
-        test_device5.id = "D4YXQEE-5MK6LIK-BRU5QWM-ZRXJCK2-N3RQBJE-23JKTQQ-LYGDPHF-RFPZIQX";
-        test_device6.id = "TKMCH64-T44VSLI-6FN2YLF-URBZOBR-ATO4DYX-GEDRIII-CSMRQAI-UAQMDQG";
-        test_device7.id = "472EEBG-Q4PZCD4-4CX6PGF-XS3FSQ2-UFXBZVB-PGNXWLX-7FKBLER-NJ3EMAR";
-        test_device8.id = "HW6KUMK-WTBG24L-2HZQXLO-TGJSG2M-2JG3FHX-5OGYRUJ-T6L5NN7-L364QAZ";
-        test_device9.id = "YAE24AP-7LSVY4T-J74ZSEM-A2IK6RB-FGA35TP-AG4CSLU-ED4UYYY-2J2TDQU";
-        test_device10.id = "277XFSB-OFMQOBI-3XGNGUE-Y7FWRV3-QQDADIY-QIIPQ26-EOGTYKW-JP2EXAI";
-        test_device11.id = "2WWXVTN-Q3QWAAY-XFORMRM-2FDI5XZ-OGN33BD-XOLL42R-DHLT2ML-QYXDQAU";
-      };
-      # Generates a few folders with IDs and paths as written...
-      folders = lib.pipe 6 [
-        (builtins.genList (x: {
-          name = "/var/lib/syncthing/test_folder${builtins.toString x}";
-          value = {
-            id = "DontDeleteMe${builtins.toString x}";
-          };
-        }))
-        builtins.listToAttrs
-      ];
+  # We will iterate this and more attribute sets defined here, later in the
+  # testScript. Start with this, and distinguish these settings from other
+  # settings, as we check these differently with xmllint, due to the ID.
+  settingsWithId = {
+    devices = {
+      # All of the device IDs used here were generated by the following command:
+      #
+      #    (${pkgs.syncthing}/bin/syncthing generate --home /tmp/foo\
+      #       | grep ID: | sed 's/.*ID: *//') && rm -rf /tmp/foo
+      #
+      # See also discussion at:
+      # https://forum.syncthing.net/t/how-to-generate-dummy-device-ids/20927/8
+      test_device1.id = "IVTZ5XF-EF3GKFT-GS4AZLG-IT6H2ZP-6WK75SF-AFXQXJJ-BNRZ4N6-XPDKVAU";
+      test_device2.id = "5C35H56-Z2GFF4F-F3IVD4B-GJYVWIE-SMDBJZN-GI66KWP-52JIQGN-4AVLYAM";
+      test_device3.id = "XKLSKHE-BZOHV7B-WQZACEF-GTH36NP-6JSBB6L-RXS3M7C-EEVWO2L-C5B4OAJ";
+      test_device4.id = "APN5Q7J-35GZETO-5KCLF35-ZA7KBWK-HGWPBNG-FERF24R-UTLGMEX-4VJ6PQX";
+      test_device5.id = "D4YXQEE-5MK6LIK-BRU5QWM-ZRXJCK2-N3RQBJE-23JKTQQ-LYGDPHF-RFPZIQX";
+      test_device6.id = "TKMCH64-T44VSLI-6FN2YLF-URBZOBR-ATO4DYX-GEDRIII-CSMRQAI-UAQMDQG";
+      test_device7.id = "472EEBG-Q4PZCD4-4CX6PGF-XS3FSQ2-UFXBZVB-PGNXWLX-7FKBLER-NJ3EMAR";
+      test_device8.id = "HW6KUMK-WTBG24L-2HZQXLO-TGJSG2M-2JG3FHX-5OGYRUJ-T6L5NN7-L364QAZ";
+      test_device9.id = "YAE24AP-7LSVY4T-J74ZSEM-A2IK6RB-FGA35TP-AG4CSLU-ED4UYYY-2J2TDQU";
+      test_device10.id = "277XFSB-OFMQOBI-3XGNGUE-Y7FWRV3-QQDADIY-QIIPQ26-EOGTYKW-JP2EXAI";
+      test_device11.id = "2WWXVTN-Q3QWAAY-XFORMRM-2FDI5XZ-OGN33BD-XOLL42R-DHLT2ML-QYXDQAU";
     };
-    # Non default options that we check later if were applied
-    settingsWithoutId = {
-      options = {
-        autoUpgradeIntervalH = 0;
-        urAccepted = -1;
-      };
-      gui = {
-        theme = "dark";
-      };
+    # Generates a few folders with IDs and paths as written...
+    folders = lib.pipe 6 [
+      (builtins.genList (x: {
+        name = "/var/lib/syncthing/test_folder${builtins.toString x}";
+        value = {
+          id = "DontDeleteMe${builtins.toString x}";
+        };
+      }))
+      builtins.listToAttrs
+    ];
+  };
+  # Non default options that we check later if were applied
+  settingsWithoutId = {
+    options = {
+      autoUpgradeIntervalH = 0;
+      urAccepted = -1;
     };
-    # Used later when checking whether settings were set in config.xml:
-    checkSettingWithId =
-      {
-        t, # t for type
-        id,
-        not ? false,
-      }:
-      ''
-        print("Searching for a ${t} with id ${id}")
-        configVal_${t} = machine.succeed(
-            "${pkgs.libxml2}/bin/xmllint "
-            "--xpath 'string(//${t}[@id=\"${id}\"]/@id)' ${configPath}"
-        )
-        print("${t}.id = {}".format(configVal_${t}))
-        assert "${id}" ${if not then "not" else ""} in configVal_${t}
-      '';
-    # Same as checkSettingWithId, but for 'options' and 'gui'
-    checkSettingWithoutId =
-      {
-        t, # t for type
-        n, # n for name
-        v, # v for value
-        not ? false,
-      }:
-      ''
-        print("checking whether setting ${t}.${n} is set to ${v}")
-        configVal_${t}_${n} = machine.succeed(
-            "${pkgs.libxml2}/bin/xmllint "
-            "--xpath 'string(/configuration/${t}/${n})' ${configPath}"
-        )
-        print("${t}.${n} = {}".format(configVal_${t}_${n}))
-        assert "${v}" ${if not then "not" else ""} in configVal_${t}_${n}
-      '';
-    # Removes duplication a bit to define this function for the IDs to delete -
-    # we check whether they were added after our script ran, and before the
-    # systemd unit's bash script ran, and afterwards - whether the systemd unit
-    # worked.
-    checkSettingsToDelete =
-      {
-        not,
-      }:
-      lib.pipe IDsToDelete [
-        (lib.mapAttrsToList (
-          t: id:
-          checkSettingWithId {
-            inherit t id;
-            inherit not;
-          }
-        ))
-        lib.concatStrings
-      ];
-    # These IDs are added to syncthing using the API, similarly to how the
-    # generated systemd unit's bash script does it. Only we add it and expect the
-    # systemd unit bash script to remove them when executed.
-    IDsToDelete = {
-      # Also created using the syncthing generate command above
-      device = "LZ2CTHT-3W2M7BC-CMKDFZL-DLUQJFS-WJR73PA-NZGODWG-DZBHCHI-OXTQXAK";
-      # Intentionally this is a substring of the IDs of the 'test_folder's, as
-      # explained in: https://github.com/NixOS/nixpkgs/issues/259256
-      folder = "DeleteMe";
+    gui = {
+      theme = "dark";
     };
-    addDeviceToDeleteScript = pkgs.writers.writeBash "syncthing-add-device-to-delete.sh" ''
-      set -euo pipefail
-
-      export RUNTIME_DIRECTORY=/tmp
-
-      curl() {
-          # get the api key by parsing the config.xml
-          while
-              ! ${pkgs.libxml2}/bin/xmllint \
-                  --xpath 'string(configuration/gui/apikey)' \
-                  ${configPath} \
-                  >"$RUNTIME_DIRECTORY/api_key"
-          do sleep 1; done
-
-          (printf "X-API-Key: "; cat "$RUNTIME_DIRECTORY/api_key") >"$RUNTIME_DIRECTORY/headers"
-
-          ${pkgs.curl}/bin/curl -sSLk -H "@$RUNTIME_DIRECTORY/headers" \
-              --retry 1000 --retry-delay 1 --retry-all-errors \
-              "$@"
-      }
-      curl -d ${lib.escapeShellArg (builtins.toJSON { deviceID = IDsToDelete.device; })} \
-          -X POST 127.0.0.1:8384/rest/config/devices
-      curl -d ${lib.escapeShellArg (builtins.toJSON { id = IDsToDelete.folder; })} \
-          -X POST 127.0.0.1:8384/rest/config/folders
+  };
+  # Used later when checking whether settings were set in config.xml:
+  checkSettingWithId =
+    {
+      t, # t for type
+      id,
+      not ? false,
+    }:
+    ''
+      print("Searching for a ${t} with id ${id}")
+      configVal_${t} = machine.succeed(
+          "${pkgs.libxml2}/bin/xmllint "
+          "--xpath 'string(//${t}[@id=\"${id}\"]/@id)' ${configPath}"
+      )
+      print("${t}.id = {}".format(configVal_${t}))
+      assert "${id}" ${if not then "not" else ""} in configVal_${t}
     '';
-  in
-  {
-    name = "syncthing-many-devices";
-    meta.maintainers = with lib.maintainers; [ doronbehar ];
+  # Same as checkSettingWithId, but for 'options' and 'gui'
+  checkSettingWithoutId =
+    {
+      t, # t for type
+      n, # n for name
+      v, # v for value
+      not ? false,
+    }:
+    ''
+      print("checking whether setting ${t}.${n} is set to ${v}")
+      configVal_${t}_${n} = machine.succeed(
+          "${pkgs.libxml2}/bin/xmllint "
+          "--xpath 'string(/configuration/${t}/${n})' ${configPath}"
+      )
+      print("${t}.${n} = {}".format(configVal_${t}_${n}))
+      assert "${v}" ${if not then "not" else ""} in configVal_${t}_${n}
+    '';
+  # Removes duplication a bit to define this function for the IDs to delete -
+  # we check whether they were added after our script ran, and before the
+  # systemd unit's bash script ran, and afterwards - whether the systemd unit
+  # worked.
+  checkSettingsToDelete =
+    {
+      not,
+    }:
+    lib.pipe IDsToDelete [
+      (lib.mapAttrsToList (
+        t: id:
+        checkSettingWithId {
+          inherit t id;
+          inherit not;
+        }
+      ))
+      lib.concatStrings
+    ];
+  # These IDs are added to syncthing using the API, similarly to how the
+  # generated systemd unit's bash script does it. Only we add it and expect the
+  # systemd unit bash script to remove them when executed.
+  IDsToDelete = {
+    # Also created using the syncthing generate command above
+    device = "LZ2CTHT-3W2M7BC-CMKDFZL-DLUQJFS-WJR73PA-NZGODWG-DZBHCHI-OXTQXAK";
+    # Intentionally this is a substring of the IDs of the 'test_folder's, as
+    # explained in: https://github.com/NixOS/nixpkgs/issues/259256
+    folder = "DeleteMe";
+  };
+  addDeviceToDeleteScript = pkgs.writers.writeBash "syncthing-add-device-to-delete.sh" ''
+    set -euo pipefail
 
-    nodes.machine = {
-      services.syncthing = {
-        enable = true;
-        overrideDevices = true;
-        overrideFolders = true;
-        settings = settingsWithoutId // settingsWithId;
-      };
+    export RUNTIME_DIRECTORY=/tmp
+
+    curl() {
+        # get the api key by parsing the config.xml
+        while
+            ! ${pkgs.libxml2}/bin/xmllint \
+                --xpath 'string(configuration/gui/apikey)' \
+                ${configPath} \
+                >"$RUNTIME_DIRECTORY/api_key"
+        do sleep 1; done
+
+        (printf "X-API-Key: "; cat "$RUNTIME_DIRECTORY/api_key") >"$RUNTIME_DIRECTORY/headers"
+
+        ${pkgs.curl}/bin/curl -sSLk -H "@$RUNTIME_DIRECTORY/headers" \
+            --retry 1000 --retry-delay 1 --retry-all-errors \
+            "$@"
+    }
+    curl -d ${lib.escapeShellArg (builtins.toJSON { deviceID = IDsToDelete.device; })} \
+        -X POST 127.0.0.1:8384/rest/config/devices
+    curl -d ${lib.escapeShellArg (builtins.toJSON { id = IDsToDelete.folder; })} \
+        -X POST 127.0.0.1:8384/rest/config/folders
+  '';
+in
+{
+  name = "syncthing-many-devices";
+  meta.maintainers = with lib.maintainers; [ doronbehar ];
+
+  nodes.machine = {
+    services.syncthing = {
+      enable = true;
+      overrideDevices = true;
+      overrideFolders = true;
+      settings = settingsWithoutId // settingsWithId;
     };
-    testScript =
-      ''
-        machine.wait_for_unit("syncthing-init.service")
-      ''
-      + (lib.pipe settingsWithId [
-        # Check that folders and devices were added properly and that all IDs exist
-        (lib.mapAttrsRecursive (
-          path: id:
-          checkSettingWithId {
-            # plural -> solitary
-            t = (lib.removeSuffix "s" (builtins.elemAt path 0));
-            inherit id;
-          }
-        ))
-        # Get all the values we applied the above function upon
-        (lib.collect builtins.isString)
-        lib.concatStrings
-      ])
-      + (lib.pipe settingsWithoutId [
-        # Check that all other syncthing.settings were added properly with correct
-        # values
-        (lib.mapAttrsRecursive (
-          path: value:
-          checkSettingWithoutId {
-            t = (builtins.elemAt path 0);
-            n = (builtins.elemAt path 1);
-            v = (builtins.toString value);
-          }
-        ))
-        # Get all the values we applied the above function upon
-        (lib.collect builtins.isString)
-        lib.concatStrings
-      ])
-      + ''
-        # Run the script on the machine
-        machine.succeed("${addDeviceToDeleteScript}")
-      ''
-      + (checkSettingsToDelete {
-        not = false;
-      })
-      + ''
-        # Useful for debugging later
-        machine.copy_from_vm("${configPath}", "before")
+  };
+  testScript =
+    ''
+      machine.wait_for_unit("syncthing-init.service")
+    ''
+    + (lib.pipe settingsWithId [
+      # Check that folders and devices were added properly and that all IDs exist
+      (lib.mapAttrsRecursive (
+        path: id:
+        checkSettingWithId {
+          # plural -> solitary
+          t = (lib.removeSuffix "s" (builtins.elemAt path 0));
+          inherit id;
+        }
+      ))
+      # Get all the values we applied the above function upon
+      (lib.collect builtins.isString)
+      lib.concatStrings
+    ])
+    + (lib.pipe settingsWithoutId [
+      # Check that all other syncthing.settings were added properly with correct
+      # values
+      (lib.mapAttrsRecursive (
+        path: value:
+        checkSettingWithoutId {
+          t = (builtins.elemAt path 0);
+          n = (builtins.elemAt path 1);
+          v = (builtins.toString value);
+        }
+      ))
+      # Get all the values we applied the above function upon
+      (lib.collect builtins.isString)
+      lib.concatStrings
+    ])
+    + ''
+      # Run the script on the machine
+      machine.succeed("${addDeviceToDeleteScript}")
+    ''
+    + (checkSettingsToDelete {
+      not = false;
+    })
+    + ''
+      # Useful for debugging later
+      machine.copy_from_vm("${configPath}", "before")
 
-        machine.systemctl("restart syncthing-init.service")
-        machine.wait_for_unit("syncthing-init.service")
-      ''
-      + (checkSettingsToDelete {
-        not = true;
-      })
-      + ''
-        # Useful for debugging later
-        machine.copy_from_vm("${configPath}", "after")
+      machine.systemctl("restart syncthing-init.service")
+      machine.wait_for_unit("syncthing-init.service")
+    ''
+    + (checkSettingsToDelete {
+      not = true;
+    })
+    + ''
+      # Useful for debugging later
+      machine.copy_from_vm("${configPath}", "after")
 
-        # Copy the systemd unit's bash script, to inspect it for debugging.
-        mergeScript = machine.succeed(
-            "systemctl cat syncthing-init.service | "
-            "${pkgs.initool}/bin/initool g - Service ExecStart --value-only"
-        ).strip() # strip from new lines
-        machine.copy_from_vm(mergeScript, "")
-      '';
-  }
-)
+      # Copy the systemd unit's bash script, to inspect it for debugging.
+      mergeScript = machine.succeed(
+          "systemctl cat syncthing-init.service | "
+          "${pkgs.initool}/bin/initool g - Service ExecStart --value-only"
+      ).strip() # strip from new lines
+      machine.copy_from_vm(mergeScript, "")
+    '';
+}
diff --git a/nixos/tests/syncthing-no-settings.nix b/nixos/tests/syncthing-no-settings.nix
index 904f3eb37356..ee79d389e92a 100644
--- a/nixos/tests/syncthing-no-settings.nix
+++ b/nixos/tests/syncthing-no-settings.nix
@@ -1,26 +1,24 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "syncthing";
-    meta.maintainers = with pkgs.lib.maintainers; [ chkno ];
+{ lib, pkgs, ... }:
+{
+  name = "syncthing";
+  meta.maintainers = with pkgs.lib.maintainers; [ chkno ];
 
-    nodes = {
-      a = {
-        environment.systemPackages = with pkgs; [
-          curl
-          libxml2
-          syncthing
-        ];
-        services.syncthing = {
-          enable = true;
-        };
+  nodes = {
+    a = {
+      environment.systemPackages = with pkgs; [
+        curl
+        libxml2
+        syncthing
+      ];
+      services.syncthing = {
+        enable = true;
       };
     };
-    # Test that indeed a syncthing-init.service systemd service is not created.
-    #
-    testScript = # python
-      ''
-        a.succeed("systemctl list-unit-files | awk '$1 == \"syncthing-init.service\" {exit 1;}'")
-      '';
-  }
-)
+  };
+  # Test that indeed a syncthing-init.service systemd service is not created.
+  #
+  testScript = # python
+    ''
+      a.succeed("systemctl list-unit-files | awk '$1 == \"syncthing-init.service\" {exit 1;}'")
+    '';
+}
diff --git a/nixos/tests/syncthing-relay.nix b/nixos/tests/syncthing-relay.nix
index 9b44155415d2..29793363414e 100644
--- a/nixos/tests/syncthing-relay.nix
+++ b/nixos/tests/syncthing-relay.nix
@@ -1,29 +1,27 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "syncthing-relay";
-    meta.maintainers = with pkgs.lib.maintainers; [ ];
+{ lib, pkgs, ... }:
+{
+  name = "syncthing-relay";
+  meta.maintainers = with pkgs.lib.maintainers; [ ];
 
-    nodes.machine = {
-      environment.systemPackages = [ pkgs.jq ];
-      services.syncthing.relay = {
-        enable = true;
-        providedBy = "nixos-test";
-        pools = [ ]; # Don't connect to any pool while testing.
-        port = 12345;
-        statusPort = 12346;
-      };
+  nodes.machine = {
+    environment.systemPackages = [ pkgs.jq ];
+    services.syncthing.relay = {
+      enable = true;
+      providedBy = "nixos-test";
+      pools = [ ]; # Don't connect to any pool while testing.
+      port = 12345;
+      statusPort = 12346;
     };
+  };
 
-    testScript = ''
-      machine.wait_for_unit("syncthing-relay.service")
-      machine.wait_for_open_port(12345)
-      machine.wait_for_open_port(12346)
+  testScript = ''
+    machine.wait_for_unit("syncthing-relay.service")
+    machine.wait_for_open_port(12345)
+    machine.wait_for_open_port(12346)
 
-      out = machine.succeed(
-          "curl -sSf http://localhost:12346/status | jq -r '.options.\"provided-by\"'"
-      )
-      assert "nixos-test" in out
-    '';
-  }
-)
+    out = machine.succeed(
+        "curl -sSf http://localhost:12346/status | jq -r '.options.\"provided-by\"'"
+    )
+    assert "nixos-test" in out
+  '';
+}
diff --git a/nixos/tests/syncthing.nix b/nixos/tests/syncthing.nix
index f3e2614a0b83..6ba21fb89fc2 100644
--- a/nixos/tests/syncthing.nix
+++ b/nixos/tests/syncthing.nix
@@ -1,72 +1,70 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "syncthing";
-    meta.maintainers = with pkgs.lib.maintainers; [ chkno ];
+{ lib, pkgs, ... }:
+{
+  name = "syncthing";
+  meta.maintainers = with pkgs.lib.maintainers; [ chkno ];
 
-    nodes = rec {
-      a = {
-        environment.systemPackages = with pkgs; [
-          curl
-          libxml2
-          syncthing
-        ];
-        services.syncthing = {
-          enable = true;
-          openDefaultPorts = true;
-        };
+  nodes = rec {
+    a = {
+      environment.systemPackages = with pkgs; [
+        curl
+        libxml2
+        syncthing
+      ];
+      services.syncthing = {
+        enable = true;
+        openDefaultPorts = true;
       };
-      b = a;
     };
+    b = a;
+  };
 
-    testScript = ''
-      import json
-      import shlex
+  testScript = ''
+    import json
+    import shlex
 
-      confdir = "/var/lib/syncthing/.config/syncthing"
+    confdir = "/var/lib/syncthing/.config/syncthing"
 
 
-      def addPeer(host, name, deviceID):
-          APIKey = host.succeed(
-              "xmllint --xpath 'string(configuration/gui/apikey)' %s/config.xml" % confdir
-          ).strip()
-          oldConf = host.succeed(
-              "curl -Ssf -H 'X-API-Key: %s' 127.0.0.1:8384/rest/config" % APIKey
-          )
-          conf = json.loads(oldConf)
-          conf["devices"].append({"deviceID": deviceID, "id": name})
-          conf["folders"].append(
-              {
-                  "devices": [{"deviceID": deviceID}],
-                  "id": "foo",
-                  "path": "/var/lib/syncthing/foo",
-                  "rescanIntervalS": 1,
-              }
-          )
-          newConf = json.dumps(conf)
-          host.succeed(
-              "curl -Ssf -H 'X-API-Key: %s' 127.0.0.1:8384/rest/config -X PUT -d %s"
-              % (APIKey, shlex.quote(newConf))
-          )
+    def addPeer(host, name, deviceID):
+        APIKey = host.succeed(
+            "xmllint --xpath 'string(configuration/gui/apikey)' %s/config.xml" % confdir
+        ).strip()
+        oldConf = host.succeed(
+            "curl -Ssf -H 'X-API-Key: %s' 127.0.0.1:8384/rest/config" % APIKey
+        )
+        conf = json.loads(oldConf)
+        conf["devices"].append({"deviceID": deviceID, "id": name})
+        conf["folders"].append(
+            {
+                "devices": [{"deviceID": deviceID}],
+                "id": "foo",
+                "path": "/var/lib/syncthing/foo",
+                "rescanIntervalS": 1,
+            }
+        )
+        newConf = json.dumps(conf)
+        host.succeed(
+            "curl -Ssf -H 'X-API-Key: %s' 127.0.0.1:8384/rest/config -X PUT -d %s"
+            % (APIKey, shlex.quote(newConf))
+        )
 
 
-      start_all()
-      a.wait_for_unit("syncthing.service")
-      b.wait_for_unit("syncthing.service")
-      a.wait_for_open_port(22000)
-      b.wait_for_open_port(22000)
+    start_all()
+    a.wait_for_unit("syncthing.service")
+    b.wait_for_unit("syncthing.service")
+    a.wait_for_open_port(22000)
+    b.wait_for_open_port(22000)
 
-      aDeviceID = a.succeed("syncthing -home=%s -device-id" % confdir).strip()
-      bDeviceID = b.succeed("syncthing -home=%s -device-id" % confdir).strip()
-      addPeer(a, "b", bDeviceID)
-      addPeer(b, "a", aDeviceID)
+    aDeviceID = a.succeed("syncthing -home=%s -device-id" % confdir).strip()
+    bDeviceID = b.succeed("syncthing -home=%s -device-id" % confdir).strip()
+    addPeer(a, "b", bDeviceID)
+    addPeer(b, "a", aDeviceID)
 
-      a.wait_for_file("/var/lib/syncthing/foo")
-      b.wait_for_file("/var/lib/syncthing/foo")
-      a.succeed("echo a2b > /var/lib/syncthing/foo/a2b")
-      b.succeed("echo b2a > /var/lib/syncthing/foo/b2a")
-      a.wait_for_file("/var/lib/syncthing/foo/b2a")
-      b.wait_for_file("/var/lib/syncthing/foo/a2b")
-    '';
-  }
-)
+    a.wait_for_file("/var/lib/syncthing/foo")
+    b.wait_for_file("/var/lib/syncthing/foo")
+    a.succeed("echo a2b > /var/lib/syncthing/foo/a2b")
+    b.succeed("echo b2a > /var/lib/syncthing/foo/b2a")
+    a.wait_for_file("/var/lib/syncthing/foo/b2a")
+    b.wait_for_file("/var/lib/syncthing/foo/a2b")
+  '';
+}
diff --git a/nixos/tests/systemd-analyze.nix b/nixos/tests/systemd-analyze.nix
index 3b1365c0b4cf..1751f132c8fc 100644
--- a/nixos/tests/systemd-analyze.nix
+++ b/nixos/tests/systemd-analyze.nix
@@ -1,52 +1,50 @@
-import ./make-test-python.nix (
-  {
-    pkgs,
-    latestKernel ? false,
-    ...
-  }:
+{
+  latestKernel,
+  lib,
+  ...
+}:
 
-  {
-    name = "systemd-analyze";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ raskin ];
+{
+  name = "systemd-analyze";
+  meta.maintainers = with lib.maintainers; [ raskin ];
+
+  _module.args.latestKernel = lib.mkDefault false;
+
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      boot.kernelPackages = lib.mkIf latestKernel pkgs.linuxPackages_latest;
     };
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
-        boot.kernelPackages = lib.mkIf latestKernel pkgs.linuxPackages_latest;
-      };
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-
-      # We create a special output directory to copy it as a whole
-      with subtest("Prepare output dir"):
-          machine.succeed("mkdir systemd-analyze")
+    # We create a special output directory to copy it as a whole
+    with subtest("Prepare output dir"):
+        machine.succeed("mkdir systemd-analyze")
 
 
-      # Save the output into a file with given name inside the common
-      # output directory
-      def run_systemd_analyze(args, name):
-          tgt_dir = "systemd-analyze"
-          machine.succeed(
-              "systemd-analyze {} > {}/{} 2> {}/{}.err".format(
-                  " ".join(args), tgt_dir, name, tgt_dir, name
-              )
-          )
+    # Save the output into a file with given name inside the common
+    # output directory
+    def run_systemd_analyze(args, name):
+        tgt_dir = "systemd-analyze"
+        machine.succeed(
+            "systemd-analyze {} > {}/{} 2> {}/{}.err".format(
+                " ".join(args), tgt_dir, name, tgt_dir, name
+            )
+        )
 
 
-      with subtest("Print statistics"):
-          run_systemd_analyze(["blame"], "blame.txt")
-          run_systemd_analyze(["critical-chain"], "critical-chain.txt")
-          run_systemd_analyze(["dot"], "dependencies.dot")
-          run_systemd_analyze(["plot"], "systemd-analyze.svg")
+    with subtest("Print statistics"):
+        run_systemd_analyze(["blame"], "blame.txt")
+        run_systemd_analyze(["critical-chain"], "critical-chain.txt")
+        run_systemd_analyze(["dot"], "dependencies.dot")
+        run_systemd_analyze(["plot"], "systemd-analyze.svg")
 
-      # We copy the main graph into the $out (toplevel), and we also copy
-      # the entire output directory with additional data
-      with subtest("Copying the resulting data into $out"):
-          machine.copy_from_vm("systemd-analyze/", "")
-          machine.copy_from_vm("systemd-analyze/systemd-analyze.svg", "")
-    '';
-  }
-)
+    # We copy the main graph into the $out (toplevel), and we also copy
+    # the entire output directory with additional data
+    with subtest("Copying the resulting data into $out"):
+        machine.copy_from_vm("systemd-analyze/", "")
+        machine.copy_from_vm("systemd-analyze/systemd-analyze.svg", "")
+  '';
+}
diff --git a/nixos/tests/systemd-bpf.nix b/nixos/tests/systemd-bpf.nix
index bc51d08497de..6af553130385 100644
--- a/nixos/tests/systemd-bpf.nix
+++ b/nixos/tests/systemd-bpf.nix
@@ -1,53 +1,51 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "systemd-bpf";
-    meta = with lib.maintainers; {
-      maintainers = [ veehaitch ];
-    };
-    nodes = {
-      node1 = {
-        virtualisation.vlans = [ 1 ];
-        networking = {
-          useNetworkd = true;
-          useDHCP = false;
-          firewall.enable = false;
-          interfaces.eth1.ipv4.addresses = [
-            {
-              address = "192.168.1.1";
-              prefixLength = 24;
-            }
-          ];
-        };
-      };
-
-      node2 = {
-        virtualisation.vlans = [ 1 ];
-        networking = {
-          useNetworkd = true;
-          useDHCP = false;
-          firewall.enable = false;
-          interfaces.eth1.ipv4.addresses = [
-            {
-              address = "192.168.1.2";
-              prefixLength = 24;
-            }
-          ];
-        };
+{ lib, ... }:
+{
+  name = "systemd-bpf";
+  meta = with lib.maintainers; {
+    maintainers = [ veehaitch ];
+  };
+  nodes = {
+    node1 = {
+      virtualisation.vlans = [ 1 ];
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        firewall.enable = false;
+        interfaces.eth1.ipv4.addresses = [
+          {
+            address = "192.168.1.1";
+            prefixLength = 24;
+          }
+        ];
       };
     };
 
-    testScript = ''
-      start_all()
-      node1.systemctl("start systemd-networkd-wait-online.service")
-      node1.wait_for_unit("systemd-networkd-wait-online.service")
-      node2.systemctl("start systemd-networkd-wait-online.service")
-      node2.wait_for_unit("systemd-networkd-wait-online.service")
+    node2 = {
+      virtualisation.vlans = [ 1 ];
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        firewall.enable = false;
+        interfaces.eth1.ipv4.addresses = [
+          {
+            address = "192.168.1.2";
+            prefixLength = 24;
+          }
+        ];
+      };
+    };
+  };
 
-      with subtest("test RestrictNetworkInterfaces= works"):
-        node1.succeed("ping -c 5 192.168.1.2")
-        node1.succeed("systemd-run -t -p RestrictNetworkInterfaces='eth1' ping -c 5 192.168.1.2")
-        node1.fail("systemd-run -t -p RestrictNetworkInterfaces='lo' ping -c 5 192.168.1.2")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    node1.systemctl("start systemd-networkd-wait-online.service")
+    node1.wait_for_unit("systemd-networkd-wait-online.service")
+    node2.systemctl("start systemd-networkd-wait-online.service")
+    node2.wait_for_unit("systemd-networkd-wait-online.service")
+
+    with subtest("test RestrictNetworkInterfaces= works"):
+      node1.succeed("ping -c 5 192.168.1.2")
+      node1.succeed("systemd-run -t -p RestrictNetworkInterfaces='eth1' ping -c 5 192.168.1.2")
+      node1.fail("systemd-run -t -p RestrictNetworkInterfaces='lo' ping -c 5 192.168.1.2")
+  '';
+}
diff --git a/nixos/tests/systemd-coredump.nix b/nixos/tests/systemd-coredump.nix
index 06888682e138..54f00dbbbc02 100644
--- a/nixos/tests/systemd-coredump.nix
+++ b/nixos/tests/systemd-coredump.nix
@@ -1,48 +1,46 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
+let
 
-    crasher = pkgs.writeCBin "crasher" "int main;";
+  crasher = pkgs.writeCBin "crasher" "int main;";
 
-    commonConfig = {
-      systemd.services.crasher.serviceConfig = {
-        ExecStart = "${crasher}/bin/crasher";
-        StateDirectory = "crasher";
-        WorkingDirectory = "%S/crasher";
-        Restart = "no";
+  commonConfig = {
+    systemd.services.crasher.serviceConfig = {
+      ExecStart = "${crasher}/bin/crasher";
+      StateDirectory = "crasher";
+      WorkingDirectory = "%S/crasher";
+      Restart = "no";
+    };
+  };
+
+in
+
+{
+  name = "systemd-coredump";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ squalus ];
+  };
+
+  nodes.machine1 = { pkgs, lib, ... }: commonConfig;
+  nodes.machine2 =
+    { pkgs, lib, ... }:
+    lib.recursiveUpdate commonConfig {
+      systemd.coredump.enable = false;
+      systemd.package = pkgs.systemd.override {
+        withCoredump = false;
       };
     };
 
-  in
+  testScript = ''
+    with subtest("systemd-coredump enabled"):
+      machine1.wait_for_unit("multi-user.target")
+      machine1.wait_for_unit("systemd-coredump.socket")
+      machine1.systemctl("start crasher");
+      machine1.wait_until_succeeds("coredumpctl list | grep crasher", timeout=10)
+      machine1.fail("stat /var/lib/crasher/core")
 
-  {
-    name = "systemd-coredump";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ squalus ];
-    };
-
-    nodes.machine1 = { pkgs, lib, ... }: commonConfig;
-    nodes.machine2 =
-      { pkgs, lib, ... }:
-      lib.recursiveUpdate commonConfig {
-        systemd.coredump.enable = false;
-        systemd.package = pkgs.systemd.override {
-          withCoredump = false;
-        };
-      };
-
-    testScript = ''
-      with subtest("systemd-coredump enabled"):
-        machine1.wait_for_unit("multi-user.target")
-        machine1.wait_for_unit("systemd-coredump.socket")
-        machine1.systemctl("start crasher");
-        machine1.wait_until_succeeds("coredumpctl list | grep crasher", timeout=10)
-        machine1.fail("stat /var/lib/crasher/core")
-
-      with subtest("systemd-coredump disabled"):
-        machine2.systemctl("start crasher");
-        machine2.wait_until_succeeds("stat /var/lib/crasher/core", timeout=10)
-    '';
-  }
-)
+    with subtest("systemd-coredump disabled"):
+      machine2.systemctl("start crasher");
+      machine2.wait_until_succeeds("stat /var/lib/crasher/core", timeout=10)
+  '';
+}
diff --git a/nixos/tests/systemd-credentials-tpm2.nix b/nixos/tests/systemd-credentials-tpm2.nix
index 085d05d4b926..b01e3a0850d9 100644
--- a/nixos/tests/systemd-credentials-tpm2.nix
+++ b/nixos/tests/systemd-credentials-tpm2.nix
@@ -1,73 +1,71 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "systemd-credentials-tpm2";
+{ lib, pkgs, ... }:
+{
+  name = "systemd-credentials-tpm2";
 
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ tmarkus ];
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ tmarkus ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.tpm.enable = true;
+      environment.systemPackages = with pkgs; [ diffutils ];
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        virtualisation.tpm.enable = true;
-        environment.systemPackages = with pkgs; [ diffutils ];
-      };
+  testScript = ''
+    CRED_NAME = "testkey"
+    CRED_RAW_FILE = f"/root/{CRED_NAME}"
+    CRED_FILE = f"/root/{CRED_NAME}.cred"
 
-    testScript = ''
-      CRED_NAME = "testkey"
-      CRED_RAW_FILE = f"/root/{CRED_NAME}"
-      CRED_FILE = f"/root/{CRED_NAME}.cred"
+    def systemd_run(machine, cmd):
+        machine.log(f"Executing command (via systemd-run): \"{cmd}\"")
 
-      def systemd_run(machine, cmd):
-          machine.log(f"Executing command (via systemd-run): \"{cmd}\"")
+        (status, out) = machine.execute( " ".join([
+            "systemd-run",
+            "--service-type=exec",
+            "--quiet",
+            "--wait",
+            "-E PATH=\"$PATH\"",
+            "-p StandardOutput=journal",
+            "-p StandardError=journal",
+            f"-p LoadCredentialEncrypted={CRED_NAME}:{CRED_FILE}",
+            f"$SHELL -c '{cmd}'"
+            ]) )
 
-          (status, out) = machine.execute( " ".join([
-              "systemd-run",
-              "--service-type=exec",
-              "--quiet",
-              "--wait",
-              "-E PATH=\"$PATH\"",
-              "-p StandardOutput=journal",
-              "-p StandardError=journal",
-              f"-p LoadCredentialEncrypted={CRED_NAME}:{CRED_FILE}",
-              f"$SHELL -c '{cmd}'"
-              ]) )
+        if status != 0:
+            raise Exception(f"systemd_run failed (status {status})")
 
-          if status != 0:
-              raise Exception(f"systemd_run failed (status {status})")
+        machine.log("systemd-run finished successfully")
 
-          machine.log("systemd-run finished successfully")
+    machine.wait_for_unit("multi-user.target")
 
-      machine.wait_for_unit("multi-user.target")
+    with subtest("Check whether TPM device exists"):
+        machine.succeed("test -e /dev/tpm0")
+        machine.succeed("test -e /dev/tpmrm0")
 
-      with subtest("Check whether TPM device exists"):
-          machine.succeed("test -e /dev/tpm0")
-          machine.succeed("test -e /dev/tpmrm0")
+    with subtest("Check whether systemd-creds detects TPM2 correctly"):
+        cmd = "systemd-creds has-tpm2"
+        machine.log(f"Running \"{cmd}\"")
+        (status, _) = machine.execute(cmd)
 
-      with subtest("Check whether systemd-creds detects TPM2 correctly"):
-          cmd = "systemd-creds has-tpm2"
-          machine.log(f"Running \"{cmd}\"")
-          (status, _) = machine.execute(cmd)
+        # Check exit code equals 0 or 1 (1 means firmware support is missing, which is OK here)
+        if status != 0 and status != 1:
+            raise Exception("systemd-creds failed to detect TPM2")
 
-          # Check exit code equals 0 or 1 (1 means firmware support is missing, which is OK here)
-          if status != 0 and status != 1:
-              raise Exception("systemd-creds failed to detect TPM2")
+    with subtest("Encrypt credential using systemd-creds"):
+        machine.succeed(f"dd if=/dev/urandom of={CRED_RAW_FILE} bs=1k count=16")
+        machine.succeed(f"systemd-creds --with-key=host+tpm2 encrypt --name=testkey {CRED_RAW_FILE} {CRED_FILE}")
 
-      with subtest("Encrypt credential using systemd-creds"):
-          machine.succeed(f"dd if=/dev/urandom of={CRED_RAW_FILE} bs=1k count=16")
-          machine.succeed(f"systemd-creds --with-key=host+tpm2 encrypt --name=testkey {CRED_RAW_FILE} {CRED_FILE}")
+    with subtest("Write provided credential and check for equality"):
+        CRED_OUT_FILE = f"/root/{CRED_NAME}.out"
+        systemd_run(machine, f"systemd-creds cat testkey > {CRED_OUT_FILE}")
+        machine.succeed(f"cmp --silent -- {CRED_RAW_FILE} {CRED_OUT_FILE}")
 
-      with subtest("Write provided credential and check for equality"):
-          CRED_OUT_FILE = f"/root/{CRED_NAME}.out"
-          systemd_run(machine, f"systemd-creds cat testkey > {CRED_OUT_FILE}")
-          machine.succeed(f"cmp --silent -- {CRED_RAW_FILE} {CRED_OUT_FILE}")
+    with subtest("Check whether systemd service can see credential in systemd-creds list"):
+        systemd_run(machine, f"systemd-creds list | grep {CRED_NAME}")
 
-      with subtest("Check whether systemd service can see credential in systemd-creds list"):
-          systemd_run(machine, f"systemd-creds list | grep {CRED_NAME}")
-
-      with subtest("Check whether systemd service can access credential in $CREDENTIALS_DIRECTORY"):
-          systemd_run(machine, f"cmp --silent -- $CREDENTIALS_DIRECTORY/{CRED_NAME} {CRED_RAW_FILE}")
-    '';
-  }
-)
+    with subtest("Check whether systemd service can access credential in $CREDENTIALS_DIRECTORY"):
+        systemd_run(machine, f"cmp --silent -- $CREDENTIALS_DIRECTORY/{CRED_NAME} {CRED_RAW_FILE}")
+  '';
+}
diff --git a/nixos/tests/systemd-cryptenroll.nix b/nixos/tests/systemd-cryptenroll.nix
index c8773888c086..d42a7db68432 100644
--- a/nixos/tests/systemd-cryptenroll.nix
+++ b/nixos/tests/systemd-cryptenroll.nix
@@ -1,45 +1,43 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "systemd-cryptenroll";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ymatsiuk ];
+{ pkgs, ... }:
+{
+  name = "systemd-cryptenroll";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ymatsiuk ];
+  };
+
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      environment.systemPackages = [ pkgs.cryptsetup ];
+      virtualisation = {
+        emptyDiskImages = [ 512 ];
+        tpm.enable = true;
+      };
     };
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
-        environment.systemPackages = [ pkgs.cryptsetup ];
-        virtualisation = {
-          emptyDiskImages = [ 512 ];
-          tpm.enable = true;
-        };
-      };
+  testScript = ''
+    machine.start()
 
-    testScript = ''
-      machine.start()
+    # Verify the TPM device is available and accessible by systemd-cryptenroll
+    machine.succeed("test -e /dev/tpm0")
+    machine.succeed("test -e /dev/tpmrm0")
+    machine.succeed("systemd-cryptenroll --tpm2-device=list")
 
-      # Verify the TPM device is available and accessible by systemd-cryptenroll
-      machine.succeed("test -e /dev/tpm0")
-      machine.succeed("test -e /dev/tpmrm0")
-      machine.succeed("systemd-cryptenroll --tpm2-device=list")
+    # Create LUKS partition
+    machine.succeed("echo -n lukspass | cryptsetup luksFormat -q /dev/vdb -")
+    # Enroll new LUKS key and bind it to Secure Boot state
+    # For more details on PASSWORD variable, check the following issue:
+    # https://github.com/systemd/systemd/issues/20955
+    machine.succeed("PASSWORD=lukspass systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/vdb")
+    # Add LUKS partition to /etc/crypttab to test auto unlock
+    machine.succeed("echo 'luks /dev/vdb - tpm2-device=auto' >> /etc/crypttab")
 
-      # Create LUKS partition
-      machine.succeed("echo -n lukspass | cryptsetup luksFormat -q /dev/vdb -")
-      # Enroll new LUKS key and bind it to Secure Boot state
-      # For more details on PASSWORD variable, check the following issue:
-      # https://github.com/systemd/systemd/issues/20955
-      machine.succeed("PASSWORD=lukspass systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/vdb")
-      # Add LUKS partition to /etc/crypttab to test auto unlock
-      machine.succeed("echo 'luks /dev/vdb - tpm2-device=auto' >> /etc/crypttab")
+    machine.shutdown()
+    machine.start()
 
-      machine.shutdown()
-      machine.start()
-
-      # Test LUKS partition automatic unlock on boot
-      machine.wait_for_unit("systemd-cryptsetup@luks.service")
-      # Wipe TPM2 slot
-      machine.succeed("systemd-cryptenroll --wipe-slot=tpm2 /dev/vdb")
-    '';
-  }
-)
+    # Test LUKS partition automatic unlock on boot
+    machine.wait_for_unit("systemd-cryptsetup@luks.service")
+    # Wipe TPM2 slot
+    machine.succeed("systemd-cryptenroll --wipe-slot=tpm2 /dev/vdb")
+  '';
+}
diff --git a/nixos/tests/systemd-escaping.nix b/nixos/tests/systemd-escaping.nix
index 1eeb7dbe6090..7f80e2988bd1 100644
--- a/nixos/tests/systemd-escaping.nix
+++ b/nixos/tests/systemd-escaping.nix
@@ -1,63 +1,61 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    echoAll = pkgs.writeScript "echo-all" ''
-      #! ${pkgs.runtimeShell}
-      for s in "$@"; do
-        printf '%s\n' "$s"
-      done
-    '';
-    # deliberately using a local empty file instead of pkgs.emptyFile to have
-    # a non-store path in the test
-    args = [
-      "a%Nything"
-      "lang=\${LANG}"
-      ";"
-      "/bin/sh -c date"
-      ./empty-file
-      4.2
-      23
-    ];
-  in
-  {
-    name = "systemd-escaping";
+let
+  echoAll = pkgs.writeScript "echo-all" ''
+    #! ${pkgs.runtimeShell}
+    for s in "$@"; do
+      printf '%s\n' "$s"
+    done
+  '';
+  # deliberately using a local empty file instead of pkgs.emptyFile to have
+  # a non-store path in the test
+  args = [
+    "a%Nything"
+    "lang=\${LANG}"
+    ";"
+    "/bin/sh -c date"
+    ./empty-file
+    4.2
+    23
+  ];
+in
+{
+  name = "systemd-escaping";
 
-    nodes.machine =
-      {
-        pkgs,
-        lib,
-        utils,
-        ...
-      }:
-      {
-        systemd.services.echo =
-          assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ [ ] ])).success;
-          assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ { } ])).success;
-          assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ null ])).success;
-          assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ false ])).success;
-          assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ (_: _) ])).success;
-          {
-            description = "Echo to the journal";
-            serviceConfig.Type = "oneshot";
-            serviceConfig.ExecStart = ''
-              ${echoAll} ${utils.escapeSystemdExecArgs args}
-            '';
-          };
-      };
+  nodes.machine =
+    {
+      pkgs,
+      lib,
+      utils,
+      ...
+    }:
+    {
+      systemd.services.echo =
+        assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ [ ] ])).success;
+        assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ { } ])).success;
+        assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ null ])).success;
+        assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ false ])).success;
+        assert !(builtins.tryEval (utils.escapeSystemdExecArgs [ (_: _) ])).success;
+        {
+          description = "Echo to the journal";
+          serviceConfig.Type = "oneshot";
+          serviceConfig.ExecStart = ''
+            ${echoAll} ${utils.escapeSystemdExecArgs args}
+          '';
+        };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("systemctl start echo.service")
-      # skip the first 'Starting <service> ...' line
-      logs = machine.succeed("journalctl -u echo.service -o cat").splitlines()[1:]
-      assert "a%Nything" == logs[0]
-      assert "lang=''${LANG}" == logs[1]
-      assert ";" == logs[2]
-      assert "/bin/sh -c date" == logs[3]
-      assert "/nix/store/ij3gw72f4n5z4dz6nnzl1731p9kmjbwr-empty-file" == logs[4]
-      assert "4.2" in logs[5] # toString produces extra fractional digits!
-      assert "23" == logs[6]
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("systemctl start echo.service")
+    # skip the first 'Starting <service> ...' line
+    logs = machine.succeed("journalctl -u echo.service -o cat").splitlines()[1:]
+    assert "a%Nything" == logs[0]
+    assert "lang=''${LANG}" == logs[1]
+    assert ";" == logs[2]
+    assert "/bin/sh -c date" == logs[3]
+    assert "/nix/store/ij3gw72f4n5z4dz6nnzl1731p9kmjbwr-empty-file" == logs[4]
+    assert "4.2" in logs[5] # toString produces extra fractional digits!
+    assert "23" == logs[6]
+  '';
+}
diff --git a/nixos/tests/systemd-homed.nix b/nixos/tests/systemd-homed.nix
index b31f66cdd1c8..766fd4f2cc19 100644
--- a/nixos/tests/systemd-homed.nix
+++ b/nixos/tests/systemd-homed.nix
@@ -1,103 +1,101 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    password = "foobarfoo";
-    newPass = "barfoobar";
-  in
-  {
-    name = "systemd-homed";
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        services.homed.enable = true;
+{ pkgs, lib, ... }:
+let
+  password = "foobarfoo";
+  newPass = "barfoobar";
+in
+{
+  name = "systemd-homed";
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      services.homed.enable = true;
 
-        users.users.test-normal-user = {
-          extraGroups = [ "wheel" ];
-          isNormalUser = true;
-          initialPassword = password;
-        };
+      users.users.test-normal-user = {
+        extraGroups = [ "wheel" ];
+        isNormalUser = true;
+        initialPassword = password;
       };
-    testScript = ''
-      def switchTTY(number):
-        machine.send_key(f"alt-f{number}")
-        machine.wait_until_succeeds(f"[ $(fgconsole) = {number} ]")
-        machine.wait_for_unit(f"getty@tty{number}.service")
-        machine.wait_until_succeeds(f"pgrep -f 'agetty.*tty{number}'")
+    };
+  testScript = ''
+    def switchTTY(number):
+      machine.send_key(f"alt-f{number}")
+      machine.wait_until_succeeds(f"[ $(fgconsole) = {number} ]")
+      machine.wait_for_unit(f"getty@tty{number}.service")
+      machine.wait_until_succeeds(f"pgrep -f 'agetty.*tty{number}'")
 
-      machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("multi-user.target")
 
-      # Smoke test to make sure the pam changes didn't break regular users.
-      machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
-      with subtest("login as regular user"):
-        switchTTY(2)
-        machine.wait_until_tty_matches("2", "login: ")
-        machine.send_chars("test-normal-user\n")
-        machine.wait_until_tty_matches("2", "login: test-normal-user")
-        machine.wait_until_tty_matches("2", "Password: ")
-        machine.send_chars("${password}\n")
-        machine.wait_until_succeeds("pgrep -u test-normal-user bash")
-        machine.send_chars("whoami > /tmp/1\n")
-        machine.wait_for_file("/tmp/1")
-        assert "test-normal-user" in machine.succeed("cat /tmp/1")
+    # Smoke test to make sure the pam changes didn't break regular users.
+    machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+    with subtest("login as regular user"):
+      switchTTY(2)
+      machine.wait_until_tty_matches("2", "login: ")
+      machine.send_chars("test-normal-user\n")
+      machine.wait_until_tty_matches("2", "login: test-normal-user")
+      machine.wait_until_tty_matches("2", "Password: ")
+      machine.send_chars("${password}\n")
+      machine.wait_until_succeeds("pgrep -u test-normal-user bash")
+      machine.send_chars("whoami > /tmp/1\n")
+      machine.wait_for_file("/tmp/1")
+      assert "test-normal-user" in machine.succeed("cat /tmp/1")
 
-      with subtest("create homed encrypted user"):
-        # TODO: Figure out how to pass password manually.
-        #
-        # This environment variable is used for homed internal testing
-        # and is not documented.
-        machine.succeed("NEWPASSWORD=${password} homectl create --shell=/run/current-system/sw/bin/bash --storage=luks -G wheel test-homed-user")
+    with subtest("create homed encrypted user"):
+      # TODO: Figure out how to pass password manually.
+      #
+      # This environment variable is used for homed internal testing
+      # and is not documented.
+      machine.succeed("NEWPASSWORD=${password} homectl create --shell=/run/current-system/sw/bin/bash --storage=luks -G wheel test-homed-user")
 
-      with subtest("login as homed user"):
-        switchTTY(3)
-        machine.wait_until_tty_matches("3", "login: ")
+    with subtest("login as homed user"):
+      switchTTY(3)
+      machine.wait_until_tty_matches("3", "login: ")
+      machine.send_chars("test-homed-user\n")
+      machine.wait_until_tty_matches("3", "login: test-homed-user")
+      machine.wait_until_tty_matches("3", "Password: ")
+      machine.send_chars("${password}\n")
+      machine.wait_until_succeeds("pgrep -t tty3 -u test-homed-user bash")
+      machine.send_chars("whoami > /tmp/2\n")
+      machine.wait_for_file("/tmp/2")
+      assert "test-homed-user" in machine.succeed("cat /tmp/2")
+
+    with subtest("change homed user password"):
+      switchTTY(4)
+      machine.wait_until_tty_matches("4", "login: ")
+      machine.send_chars("test-homed-user\n")
+      machine.wait_until_tty_matches("4", "login: test-homed-user")
+      machine.wait_until_tty_matches("4", "Password: ")
+      machine.send_chars("${password}\n")
+      machine.wait_until_succeeds("pgrep -t tty4 -u test-homed-user bash")
+      machine.send_chars("passwd\n")
+      # homed does it in a weird order, it asks for new passes, then it asks
+      # for the old one.
+      machine.sleep(2)
+      machine.send_chars("${newPass}\n")
+      machine.sleep(2)
+      machine.send_chars("${newPass}\n")
+      machine.sleep(4)
+      machine.send_chars("${password}\n")
+      machine.wait_until_fails("pgrep -t tty4 passwd")
+
+      @polling_condition
+      def not_logged_in_tty5():
+        machine.fail("pgrep -t tty5 bash")
+
+      switchTTY(5)
+      with not_logged_in_tty5: # type: ignore[union-attr]
+        machine.wait_until_tty_matches("5", "login: ")
         machine.send_chars("test-homed-user\n")
-        machine.wait_until_tty_matches("3", "login: test-homed-user")
-        machine.wait_until_tty_matches("3", "Password: ")
+        machine.wait_until_tty_matches("5", "login: test-homed-user")
+        machine.wait_until_tty_matches("5", "Password: ")
         machine.send_chars("${password}\n")
-        machine.wait_until_succeeds("pgrep -t tty3 -u test-homed-user bash")
-        machine.send_chars("whoami > /tmp/2\n")
-        machine.wait_for_file("/tmp/2")
-        assert "test-homed-user" in machine.succeed("cat /tmp/2")
+        machine.wait_until_tty_matches("5", "Password incorrect or not sufficient for authentication of user test-homed-user.")
+        machine.wait_until_tty_matches("5", "Sorry, try again: ")
+      machine.send_chars("${newPass}\n")
+      machine.send_chars("whoami > /tmp/4\n")
+      machine.wait_for_file("/tmp/4")
+      assert "test-homed-user" in machine.succeed("cat /tmp/4")
 
-      with subtest("change homed user password"):
-        switchTTY(4)
-        machine.wait_until_tty_matches("4", "login: ")
-        machine.send_chars("test-homed-user\n")
-        machine.wait_until_tty_matches("4", "login: test-homed-user")
-        machine.wait_until_tty_matches("4", "Password: ")
-        machine.send_chars("${password}\n")
-        machine.wait_until_succeeds("pgrep -t tty4 -u test-homed-user bash")
-        machine.send_chars("passwd\n")
-        # homed does it in a weird order, it asks for new passes, then it asks
-        # for the old one.
-        machine.sleep(2)
-        machine.send_chars("${newPass}\n")
-        machine.sleep(2)
-        machine.send_chars("${newPass}\n")
-        machine.sleep(4)
-        machine.send_chars("${password}\n")
-        machine.wait_until_fails("pgrep -t tty4 passwd")
-
-        @polling_condition
-        def not_logged_in_tty5():
-          machine.fail("pgrep -t tty5 bash")
-
-        switchTTY(5)
-        with not_logged_in_tty5: # type: ignore[union-attr]
-          machine.wait_until_tty_matches("5", "login: ")
-          machine.send_chars("test-homed-user\n")
-          machine.wait_until_tty_matches("5", "login: test-homed-user")
-          machine.wait_until_tty_matches("5", "Password: ")
-          machine.send_chars("${password}\n")
-          machine.wait_until_tty_matches("5", "Password incorrect or not sufficient for authentication of user test-homed-user.")
-          machine.wait_until_tty_matches("5", "Sorry, try again: ")
-        machine.send_chars("${newPass}\n")
-        machine.send_chars("whoami > /tmp/4\n")
-        machine.wait_for_file("/tmp/4")
-        assert "test-homed-user" in machine.succeed("cat /tmp/4")
-
-      with subtest("homed user should be in wheel according to NSS"):
-        machine.succeed("userdbctl group wheel -s io.systemd.NameServiceSwitch | grep test-homed-user")
-    '';
-  }
-)
+    with subtest("homed user should be in wheel according to NSS"):
+      machine.succeed("userdbctl group wheel -s io.systemd.NameServiceSwitch | grep test-homed-user")
+  '';
+}
diff --git a/nixos/tests/systemd-initrd-bridge.nix b/nixos/tests/systemd-initrd-bridge.nix
index 7ca3a6a93a00..f0c7d5f98f7a 100644
--- a/nixos/tests/systemd-initrd-bridge.nix
+++ b/nixos/tests/systemd-initrd-bridge.nix
@@ -1,80 +1,78 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "systemd-initrd-bridge";
-    meta.maintainers = [ lib.maintainers.majiir ];
+{ lib, ... }:
+{
+  name = "systemd-initrd-bridge";
+  meta.maintainers = [ lib.maintainers.majiir ];
 
-    # Tests bridge interface configuration in systemd-initrd.
-    #
-    # The 'a' and 'b' nodes are connected to a 'bridge' node through different
-    # links. The 'bridge' node configures a bridge across them. It waits forever
-    # in initrd (stage 1) with networking enabled. 'a' and 'b' ping 'bridge' to
-    # test connectivity with the bridge interface. Then, 'a' pings 'b' to test
-    # the bridge itself.
+  # Tests bridge interface configuration in systemd-initrd.
+  #
+  # The 'a' and 'b' nodes are connected to a 'bridge' node through different
+  # links. The 'bridge' node configures a bridge across them. It waits forever
+  # in initrd (stage 1) with networking enabled. 'a' and 'b' ping 'bridge' to
+  # test connectivity with the bridge interface. Then, 'a' pings 'b' to test
+  # the bridge itself.
 
-    nodes = {
-      bridge =
-        { config, lib, ... }:
-        {
-          boot.initrd.systemd.enable = true;
-          boot.initrd.network.enable = true;
-          boot.initrd.systemd.services.boot-blocker = {
-            before = [ "initrd.target" ];
-            wantedBy = [ "initrd.target" ];
-            script = "sleep infinity";
-            serviceConfig.Type = "oneshot";
-          };
-
-          networking.primaryIPAddress = "192.168.1.${toString config.virtualisation.test.nodeNumber}";
-
-          virtualisation.vlans = [
-            1
-            2
-          ];
-          networking.bridges.br0.interfaces = [
-            "eth1"
-            "eth2"
-          ];
-
-          networking.interfaces = {
-            eth1.ipv4.addresses = lib.mkForce [ ];
-            eth2.ipv4.addresses = lib.mkForce [ ];
-            br0.ipv4.addresses = [
-              {
-                address = config.networking.primaryIPAddress;
-                prefixLength = 24;
-              }
-            ];
-          };
+  nodes = {
+    bridge =
+      { config, lib, ... }:
+      {
+        boot.initrd.systemd.enable = true;
+        boot.initrd.network.enable = true;
+        boot.initrd.systemd.services.boot-blocker = {
+          before = [ "initrd.target" ];
+          wantedBy = [ "initrd.target" ];
+          script = "sleep infinity";
+          serviceConfig.Type = "oneshot";
         };
 
-      a = {
-        virtualisation.vlans = [ 1 ];
-      };
+        networking.primaryIPAddress = "192.168.1.${toString config.virtualisation.test.nodeNumber}";
 
-      b =
-        { config, ... }:
-        {
-          virtualisation.vlans = [ 2 ];
-          networking.primaryIPAddress = lib.mkForce "192.168.1.${toString config.virtualisation.test.nodeNumber}";
-          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+        virtualisation.vlans = [
+          1
+          2
+        ];
+        networking.bridges.br0.interfaces = [
+          "eth1"
+          "eth2"
+        ];
+
+        networking.interfaces = {
+          eth1.ipv4.addresses = lib.mkForce [ ];
+          eth2.ipv4.addresses = lib.mkForce [ ];
+          br0.ipv4.addresses = [
             {
               address = config.networking.primaryIPAddress;
               prefixLength = 24;
             }
           ];
         };
+      };
+
+    a = {
+      virtualisation.vlans = [ 1 ];
     };
 
-    testScript = ''
-      start_all()
-      a.wait_for_unit("network.target")
-      b.wait_for_unit("network.target")
+    b =
+      { config, ... }:
+      {
+        virtualisation.vlans = [ 2 ];
+        networking.primaryIPAddress = lib.mkForce "192.168.1.${toString config.virtualisation.test.nodeNumber}";
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          {
+            address = config.networking.primaryIPAddress;
+            prefixLength = 24;
+          }
+        ];
+      };
+  };
 
-      a.succeed("ping -n -w 10 -c 1 bridge >&2")
-      b.succeed("ping -n -w 10 -c 1 bridge >&2")
+  testScript = ''
+    start_all()
+    a.wait_for_unit("network.target")
+    b.wait_for_unit("network.target")
 
-      a.succeed("ping -n -w 10 -c 1 b >&2")
-    '';
-  }
-)
+    a.succeed("ping -n -w 10 -c 1 bridge >&2")
+    b.succeed("ping -n -w 10 -c 1 bridge >&2")
+
+    a.succeed("ping -n -w 10 -c 1 b >&2")
+  '';
+}
diff --git a/nixos/tests/systemd-initrd-btrfs-raid.nix b/nixos/tests/systemd-initrd-btrfs-raid.nix
index 75f9879628fa..1aa21fc326cd 100644
--- a/nixos/tests/systemd-initrd-btrfs-raid.nix
+++ b/nixos/tests/systemd-initrd-btrfs-raid.nix
@@ -1,55 +1,53 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "systemd-initrd-btrfs-raid";
+{ lib, pkgs, ... }:
+{
+  name = "systemd-initrd-btrfs-raid";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        # Use systemd-boot
-        virtualisation = {
-          emptyDiskImages = [
-            512
-            512
-          ];
-          useBootLoader = true;
-          # Booting off the BTRFS RAID requires an available init script from the Nix store
-          mountHostNixStore = true;
-          useEFIBoot = true;
-        };
-        boot.loader.systemd-boot.enable = true;
-        boot.loader.efi.canTouchEfiVariables = true;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      # Use systemd-boot
+      virtualisation = {
+        emptyDiskImages = [
+          512
+          512
+        ];
+        useBootLoader = true;
+        # Booting off the BTRFS RAID requires an available init script from the Nix store
+        mountHostNixStore = true;
+        useEFIBoot = true;
+      };
+      boot.loader.systemd-boot.enable = true;
+      boot.loader.efi.canTouchEfiVariables = true;
 
-        environment.systemPackages = with pkgs; [ btrfs-progs ];
-        boot.initrd.systemd = {
-          enable = true;
-          emergencyAccess = true;
-        };
-
-        specialisation.boot-btrfs-raid.configuration = {
-          fileSystems = lib.mkVMOverride {
-            "/".fsType = lib.mkForce "btrfs";
-          };
-          virtualisation.rootDevice = "/dev/vdb";
-        };
+      environment.systemPackages = with pkgs; [ btrfs-progs ];
+      boot.initrd.systemd = {
+        enable = true;
+        emergencyAccess = true;
       };
 
-    testScript = ''
-      # Create RAID
-      machine.succeed("mkfs.btrfs -d raid0 /dev/vdb /dev/vdc")
-      machine.succeed("mkdir -p /mnt && mount /dev/vdb /mnt && echo hello > /mnt/test && umount /mnt")
+      specialisation.boot-btrfs-raid.configuration = {
+        fileSystems = lib.mkVMOverride {
+          "/".fsType = lib.mkForce "btrfs";
+        };
+        virtualisation.rootDevice = "/dev/vdb";
+      };
+    };
 
-      # Boot from the RAID
-      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-btrfs-raid.conf")
-      machine.succeed("sync")
-      machine.crash()
-      machine.wait_for_unit("multi-user.target")
+  testScript = ''
+    # Create RAID
+    machine.succeed("mkfs.btrfs -d raid0 /dev/vdb /dev/vdc")
+    machine.succeed("mkdir -p /mnt && mount /dev/vdb /mnt && echo hello > /mnt/test && umount /mnt")
 
-      # Ensure we have successfully booted from the RAID
-      assert "(initrd)" in machine.succeed("systemd-analyze")  # booted with systemd in stage 1
-      assert "/dev/vdb on / type btrfs" in machine.succeed("mount")
-      assert "hello" in machine.succeed("cat /test")
-      assert "Total devices 2" in machine.succeed("btrfs filesystem show")
-    '';
-  }
-)
+    # Boot from the RAID
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-btrfs-raid.conf")
+    machine.succeed("sync")
+    machine.crash()
+    machine.wait_for_unit("multi-user.target")
+
+    # Ensure we have successfully booted from the RAID
+    assert "(initrd)" in machine.succeed("systemd-analyze")  # booted with systemd in stage 1
+    assert "/dev/vdb on / type btrfs" in machine.succeed("mount")
+    assert "hello" in machine.succeed("cat /test")
+    assert "Total devices 2" in machine.succeed("btrfs filesystem show")
+  '';
+}
diff --git a/nixos/tests/systemd-initrd-credentials.nix b/nixos/tests/systemd-initrd-credentials.nix
new file mode 100644
index 000000000000..50893d2cec78
--- /dev/null
+++ b/nixos/tests/systemd-initrd-credentials.nix
@@ -0,0 +1,32 @@
+{ lib, pkgs, ... }:
+{
+  name = "systemd-initrd-credentials";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation = {
+        qemu.options = [
+          "-smbios type=11,value=io.systemd.credential:cred-smbios=secret-smbios"
+        ];
+      };
+
+      boot.initrd.availableKernelModules = [ "dmi_sysfs" ];
+
+      boot.kernelParams = [ "systemd.set_credential=cred-cmdline:secret-cmdline" ];
+
+      boot.initrd.systemd = {
+        enable = true;
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    # Check credential passed via kernel command line
+    assert "secret-cmdline" in machine.succeed("systemd-creds --system cat cred-cmdline")
+
+    # Check credential passed via SMBIOS
+    assert "secret-smbios" in machine.succeed("systemd-creds --system cat cred-smbios")
+  '';
+}
diff --git a/nixos/tests/systemd-initrd-luks-fido2.nix b/nixos/tests/systemd-initrd-luks-fido2.nix
index e681525c99f8..e822c811cec5 100644
--- a/nixos/tests/systemd-initrd-luks-fido2.nix
+++ b/nixos/tests/systemd-initrd-luks-fido2.nix
@@ -1,55 +1,53 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "systemd-initrd-luks-fido2";
+{ lib, pkgs, ... }:
+{
+  name = "systemd-initrd-luks-fido2";
 
-    nodes.machine =
-      { pkgs, config, ... }:
-      {
-        # Use systemd-boot
-        virtualisation = {
-          emptyDiskImages = [ 512 ];
-          useBootLoader = true;
-          # Booting off the encrypted disk requires having a Nix store available for the init script
-          mountHostNixStore = true;
-          useEFIBoot = true;
-          qemu.options = [
-            "-device pci-ohci,id=usb-bus"
-            "-device canokey,bus=usb-bus.0,file=/tmp/canokey-file"
-          ];
-        };
-        boot.loader.systemd-boot.enable = true;
-
-        boot.initrd.systemd.enable = true;
-
-        environment.systemPackages = with pkgs; [ cryptsetup ];
-
-        specialisation.boot-luks.configuration = {
-          boot.initrd.luks.devices = lib.mkVMOverride {
-            cryptroot = {
-              device = "/dev/vdb";
-              crypttabExtraOpts = [ "fido2-device=auto" ];
-            };
-          };
-          virtualisation.rootDevice = "/dev/mapper/cryptroot";
-          virtualisation.fileSystems."/".autoFormat = true;
-        };
+  nodes.machine =
+    { pkgs, config, ... }:
+    {
+      # Use systemd-boot
+      virtualisation = {
+        emptyDiskImages = [ 512 ];
+        useBootLoader = true;
+        # Booting off the encrypted disk requires having a Nix store available for the init script
+        mountHostNixStore = true;
+        useEFIBoot = true;
+        qemu.options = [
+          "-device pci-ohci,id=usb-bus"
+          "-device canokey,bus=usb-bus.0,file=/tmp/canokey-file"
+        ];
       };
+      boot.loader.systemd-boot.enable = true;
 
-    testScript = ''
-      # Create encrypted volume
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-      machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --fido2-device=auto /dev/vdb |& systemd-cat")
+      boot.initrd.systemd.enable = true;
 
-      # Boot from the encrypted disk
-      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-      machine.succeed("sync")
-      machine.crash()
+      environment.systemPackages = with pkgs; [ cryptsetup ];
 
-      # Boot and decrypt the disk
-      machine.wait_for_unit("multi-user.target")
-      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-    '';
-  }
-)
+      specialisation.boot-luks.configuration = {
+        boot.initrd.luks.devices = lib.mkVMOverride {
+          cryptroot = {
+            device = "/dev/vdb";
+            crypttabExtraOpts = [ "fido2-device=auto" ];
+          };
+        };
+        virtualisation.rootDevice = "/dev/mapper/cryptroot";
+        virtualisation.fileSystems."/".autoFormat = true;
+      };
+    };
+
+  testScript = ''
+    # Create encrypted volume
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+    machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --fido2-device=auto /dev/vdb |& systemd-cat")
+
+    # Boot from the encrypted disk
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
+    machine.succeed("sync")
+    machine.crash()
+
+    # Boot and decrypt the disk
+    machine.wait_for_unit("multi-user.target")
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+  '';
+}
diff --git a/nixos/tests/systemd-initrd-luks-keyfile.nix b/nixos/tests/systemd-initrd-luks-keyfile.nix
index 22794c0dcd85..3723307946dd 100644
--- a/nixos/tests/systemd-initrd-luks-keyfile.nix
+++ b/nixos/tests/systemd-initrd-luks-keyfile.nix
@@ -1,62 +1,60 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
+{ lib, pkgs, ... }:
+let
 
-    keyfile = pkgs.writeText "luks-keyfile" ''
-      MIGHAoGBAJ4rGTSo/ldyjQypd0kuS7k2OSsmQYzMH6TNj3nQ/vIUjDn7fqa3slt2
-      gV6EK3TmTbGc4tzC1v4SWx2m+2Bjdtn4Fs4wiBwn1lbRdC6i5ZYCqasTWIntWn+6
-      FllUkMD5oqjOR/YcboxG8Z3B5sJuvTP9llsF+gnuveWih9dpbBr7AgEC
-    '';
+  keyfile = pkgs.writeText "luks-keyfile" ''
+    MIGHAoGBAJ4rGTSo/ldyjQypd0kuS7k2OSsmQYzMH6TNj3nQ/vIUjDn7fqa3slt2
+    gV6EK3TmTbGc4tzC1v4SWx2m+2Bjdtn4Fs4wiBwn1lbRdC6i5ZYCqasTWIntWn+6
+    FllUkMD5oqjOR/YcboxG8Z3B5sJuvTP9llsF+gnuveWih9dpbBr7AgEC
+  '';
 
-  in
-  {
-    name = "systemd-initrd-luks-keyfile";
+in
+{
+  name = "systemd-initrd-luks-keyfile";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        # Use systemd-boot
-        virtualisation = {
-          emptyDiskImages = [ 512 ];
-          useBootLoader = true;
-          # Necessary to boot off the encrypted disk because it requires a init script coming from the Nix store
-          mountHostNixStore = true;
-          useEFIBoot = true;
-        };
-        boot.loader.systemd-boot.enable = true;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      # Use systemd-boot
+      virtualisation = {
+        emptyDiskImages = [ 512 ];
+        useBootLoader = true;
+        # Necessary to boot off the encrypted disk because it requires a init script coming from the Nix store
+        mountHostNixStore = true;
+        useEFIBoot = true;
+      };
+      boot.loader.systemd-boot.enable = true;
 
-        environment.systemPackages = with pkgs; [ cryptsetup ];
-        boot.initrd.systemd = {
-          enable = true;
-          emergencyAccess = true;
-        };
-
-        specialisation.boot-luks.configuration = {
-          boot.initrd.luks.devices = lib.mkVMOverride {
-            cryptroot = {
-              device = "/dev/vdb";
-              keyFile = "/etc/cryptroot.key";
-            };
-          };
-          virtualisation.rootDevice = "/dev/mapper/cryptroot";
-          virtualisation.fileSystems."/".autoFormat = true;
-          boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
-        };
+      environment.systemPackages = with pkgs; [ cryptsetup ];
+      boot.initrd.systemd = {
+        enable = true;
+        emergencyAccess = true;
       };
 
-    testScript = ''
-      # Create encrypted volume
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("cryptsetup luksFormat -q --iter-time=1 -d ${keyfile} /dev/vdb")
+      specialisation.boot-luks.configuration = {
+        boot.initrd.luks.devices = lib.mkVMOverride {
+          cryptroot = {
+            device = "/dev/vdb";
+            keyFile = "/etc/cryptroot.key";
+          };
+        };
+        virtualisation.rootDevice = "/dev/mapper/cryptroot";
+        virtualisation.fileSystems."/".autoFormat = true;
+        boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
+      };
+    };
 
-      # Boot from the encrypted disk
-      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-      machine.succeed("sync")
-      machine.crash()
+  testScript = ''
+    # Create encrypted volume
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("cryptsetup luksFormat -q --iter-time=1 -d ${keyfile} /dev/vdb")
 
-      # Boot and decrypt the disk
-      machine.wait_for_unit("multi-user.target")
-      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-    '';
-  }
-)
+    # Boot from the encrypted disk
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
+    machine.succeed("sync")
+    machine.crash()
+
+    # Boot and decrypt the disk
+    machine.wait_for_unit("multi-user.target")
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+  '';
+}
diff --git a/nixos/tests/systemd-initrd-luks-password.nix b/nixos/tests/systemd-initrd-luks-password.nix
index 941926f98192..0f7c2f51a034 100644
--- a/nixos/tests/systemd-initrd-luks-password.nix
+++ b/nixos/tests/systemd-initrd-luks-password.nix
@@ -1,64 +1,62 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "systemd-initrd-luks-password";
+{ lib, pkgs, ... }:
+{
+  name = "systemd-initrd-luks-password";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        # Use systemd-boot
-        virtualisation = {
-          emptyDiskImages = [
-            512
-            512
-          ];
-          useBootLoader = true;
-          # Booting off the encrypted disk requires an available init script
-          mountHostNixStore = true;
-          useEFIBoot = true;
-        };
-        boot.loader.systemd-boot.enable = true;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      # Use systemd-boot
+      virtualisation = {
+        emptyDiskImages = [
+          512
+          512
+        ];
+        useBootLoader = true;
+        # Booting off the encrypted disk requires an available init script
+        mountHostNixStore = true;
+        useEFIBoot = true;
+      };
+      boot.loader.systemd-boot.enable = true;
 
-        environment.systemPackages = with pkgs; [ cryptsetup ];
-        boot.initrd.systemd = {
-          enable = true;
-          emergencyAccess = true;
-        };
-
-        specialisation.boot-luks.configuration = {
-          boot.initrd.luks.devices = lib.mkVMOverride {
-            # We have two disks and only type one password - key reuse is in place
-            cryptroot.device = "/dev/vdb";
-            cryptroot2.device = "/dev/vdc";
-          };
-          virtualisation.rootDevice = "/dev/mapper/cryptroot";
-          virtualisation.fileSystems."/".autoFormat = true;
-          # test mounting device unlocked in initrd after switching root
-          virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2";
-        };
+      environment.systemPackages = with pkgs; [ cryptsetup ];
+      boot.initrd.systemd = {
+        enable = true;
+        emergencyAccess = true;
       };
 
-    testScript = ''
-      # Create encrypted volume
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
-      machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
-      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
+      specialisation.boot-luks.configuration = {
+        boot.initrd.luks.devices = lib.mkVMOverride {
+          # We have two disks and only type one password - key reuse is in place
+          cryptroot.device = "/dev/vdb";
+          cryptroot2.device = "/dev/vdc";
+        };
+        virtualisation.rootDevice = "/dev/mapper/cryptroot";
+        virtualisation.fileSystems."/".autoFormat = true;
+        # test mounting device unlocked in initrd after switching root
+        virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2";
+      };
+    };
 
-      # Boot from the encrypted disk
-      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-      machine.succeed("sync")
-      machine.crash()
+  testScript = ''
+    # Create encrypted volume
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
+    machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
 
-      # Boot and decrypt the disk
-      machine.start()
-      machine.wait_for_console_text("Please enter passphrase for disk cryptroot")
-      machine.send_console("supersecret\n")
-      machine.wait_for_unit("multi-user.target")
+    # Boot from the encrypted disk
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
+    machine.succeed("sync")
+    machine.crash()
 
-      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
-      assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
-    '';
-  }
-)
+    # Boot and decrypt the disk
+    machine.start()
+    machine.wait_for_console_text("Please enter passphrase for disk cryptroot")
+    machine.send_console("supersecret\n")
+    machine.wait_for_unit("multi-user.target")
+
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
+    assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
+  '';
+}
diff --git a/nixos/tests/systemd-initrd-luks-tpm2.nix b/nixos/tests/systemd-initrd-luks-tpm2.nix
index a6c52435ee03..20e203b0e86b 100644
--- a/nixos/tests/systemd-initrd-luks-tpm2.nix
+++ b/nixos/tests/systemd-initrd-luks-tpm2.nix
@@ -1,55 +1,53 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "systemd-initrd-luks-tpm2";
+{ lib, pkgs, ... }:
+{
+  name = "systemd-initrd-luks-tpm2";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        # Use systemd-boot
-        virtualisation = {
-          emptyDiskImages = [ 512 ];
-          useBootLoader = true;
-          # Booting off the TPM2-encrypted device requires an available init script
-          mountHostNixStore = true;
-          useEFIBoot = true;
-          tpm.enable = true;
-        };
-        boot.loader.systemd-boot.enable = true;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      # Use systemd-boot
+      virtualisation = {
+        emptyDiskImages = [ 512 ];
+        useBootLoader = true;
+        # Booting off the TPM2-encrypted device requires an available init script
+        mountHostNixStore = true;
+        useEFIBoot = true;
+        tpm.enable = true;
+      };
+      boot.loader.systemd-boot.enable = true;
 
-        boot.initrd.availableKernelModules = [ "tpm_tis" ];
+      boot.initrd.availableKernelModules = [ "tpm_tis" ];
 
-        environment.systemPackages = with pkgs; [ cryptsetup ];
-        boot.initrd.systemd = {
-          enable = true;
-        };
-
-        specialisation.boot-luks.configuration = {
-          boot.initrd.luks.devices = lib.mkVMOverride {
-            cryptroot = {
-              device = "/dev/vdb";
-              crypttabExtraOpts = [ "tpm2-device=auto" ];
-            };
-          };
-          virtualisation.rootDevice = "/dev/mapper/cryptroot";
-          virtualisation.fileSystems."/".autoFormat = true;
-        };
+      environment.systemPackages = with pkgs; [ cryptsetup ];
+      boot.initrd.systemd = {
+        enable = true;
       };
 
-    testScript = ''
-      # Create encrypted volume
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-      machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --tpm2-pcrs= --tpm2-device=auto /dev/vdb |& systemd-cat")
+      specialisation.boot-luks.configuration = {
+        boot.initrd.luks.devices = lib.mkVMOverride {
+          cryptroot = {
+            device = "/dev/vdb";
+            crypttabExtraOpts = [ "tpm2-device=auto" ];
+          };
+        };
+        virtualisation.rootDevice = "/dev/mapper/cryptroot";
+        virtualisation.fileSystems."/".autoFormat = true;
+      };
+    };
 
-      # Boot from the encrypted disk
-      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-      machine.succeed("sync")
-      machine.crash()
+  testScript = ''
+    # Create encrypted volume
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+    machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --tpm2-pcrs= --tpm2-device=auto /dev/vdb |& systemd-cat")
 
-      # Boot and decrypt the disk
-      machine.wait_for_unit("multi-user.target")
-      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-    '';
-  }
-)
+    # Boot from the encrypted disk
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
+    machine.succeed("sync")
+    machine.crash()
+
+    # Boot and decrypt the disk
+    machine.wait_for_unit("multi-user.target")
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+  '';
+}
diff --git a/nixos/tests/systemd-initrd-luks-unl0kr.nix b/nixos/tests/systemd-initrd-luks-unl0kr.nix
index 5a9af4949cc9..875e1beb7187 100644
--- a/nixos/tests/systemd-initrd-luks-unl0kr.nix
+++ b/nixos/tests/systemd-initrd-luks-unl0kr.nix
@@ -1,109 +1,107 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    passphrase = "secret";
+{ lib, pkgs, ... }:
+let
+  passphrase = "secret";
 
-    debugPackages = with pkgs; [
-      coreutils-prefixed
-      toybox
+  debugPackages = with pkgs; [
+    coreutils-prefixed
+    toybox
 
-      micro
-      nano
-    ];
-  in
-  {
-    name = "systemd-initrd-luks-unl0kr";
-    meta = {
-      maintainers = [ ];
-    };
+    micro
+    nano
+  ];
+in
+{
+  name = "systemd-initrd-luks-unl0kr";
+  meta = {
+    maintainers = [ ];
+  };
 
-    # TODO: Fix OCR: #302965
-    # enableOCR = true;
+  # TODO: Fix OCR: #302965
+  # enableOCR = true;
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        virtualisation = {
-          emptyDiskImages = [
-            512
-            512
-          ];
-          useBootLoader = true;
-          mountHostNixStore = true;
-          useEFIBoot = true;
-          qemu.options = [
-            "-vga virtio"
-          ];
-        };
-        boot.loader.systemd-boot.enable = true;
-
-        boot.kernelParams = [
-          "rd.systemd.debug_shell"
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation = {
+        emptyDiskImages = [
+          512
+          512
         ];
+        useBootLoader = true;
+        mountHostNixStore = true;
+        useEFIBoot = true;
+        qemu.options = [
+          "-vga virtio"
+        ];
+      };
+      boot.loader.systemd-boot.enable = true;
 
-        environment.systemPackages =
-          with pkgs;
-          [
-            cryptsetup
-          ]
-          ++ debugPackages;
-        boot.initrd = {
-          systemd = {
-            enable = true;
-            emergencyAccess = true;
+      boot.kernelParams = [
+        "rd.systemd.debug_shell"
+      ];
 
-            storePaths = debugPackages;
-          };
-          unl0kr = {
-            enable = true;
+      environment.systemPackages =
+        with pkgs;
+        [
+          cryptsetup
+        ]
+        ++ debugPackages;
+      boot.initrd = {
+        systemd = {
+          enable = true;
+          emergencyAccess = true;
 
-            settings = {
-              general.backend = "drm";
-              # TODO: Fix OCR. See above.
-              # theme.default = "adwaita-dark"; # Improves contrast quite a bit, helpful for OCR.
-            };
-          };
+          storePaths = debugPackages;
         };
+        unl0kr = {
+          enable = true;
 
-        specialisation.boot-luks.configuration = {
-          testing.initrdBackdoor = true;
-          boot.initrd.luks.devices = lib.mkVMOverride {
-            # We have two disks and only type one password - key reuse is in place
-            cryptroot.device = "/dev/vdb";
-            cryptroot2.device = "/dev/vdc";
+          settings = {
+            general.backend = "drm";
+            # TODO: Fix OCR. See above.
+            # theme.default = "adwaita-dark"; # Improves contrast quite a bit, helpful for OCR.
           };
-          virtualisation.rootDevice = "/dev/mapper/cryptroot";
-          virtualisation.fileSystems."/".autoFormat = true;
-          # test mounting device unlocked in initrd after switching root
-          virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2";
         };
       };
 
-    testScript = ''
-      # Create encrypted volume
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-      machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
-      machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
-      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
+      specialisation.boot-luks.configuration = {
+        testing.initrdBackdoor = true;
+        boot.initrd.luks.devices = lib.mkVMOverride {
+          # We have two disks and only type one password - key reuse is in place
+          cryptroot.device = "/dev/vdb";
+          cryptroot2.device = "/dev/vdc";
+        };
+        virtualisation.rootDevice = "/dev/mapper/cryptroot";
+        virtualisation.fileSystems."/".autoFormat = true;
+        # test mounting device unlocked in initrd after switching root
+        virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2";
+      };
+    };
 
-      # Boot from the encrypted disk
-      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-      machine.succeed("sync")
-      machine.crash()
+  testScript = ''
+    # Create encrypted volume
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+    machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
+    machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
 
-      # Boot and decrypt the disk. This part of the test is SLOW.
-      machine.start()
-      machine.wait_for_unit("unl0kr-agent.service")
-      machine.screenshot("prompt")
-      machine.send_chars("${passphrase}")
-      machine.screenshot("pw")
-      machine.send_chars("\n")
-      machine.switch_root()
-      machine.wait_for_unit("multi-user.target")
+    # Boot from the encrypted disk
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
+    machine.succeed("sync")
+    machine.crash()
 
-      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
-      assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
-    '';
-  }
-)
+    # Boot and decrypt the disk. This part of the test is SLOW.
+    machine.start()
+    machine.wait_for_unit("unl0kr-agent.service")
+    machine.screenshot("prompt")
+    machine.send_chars("${passphrase}")
+    machine.screenshot("pw")
+    machine.send_chars("\n")
+    machine.switch_root()
+    machine.wait_for_unit("multi-user.target")
+
+    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
+    assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
+  '';
+}
diff --git a/nixos/tests/systemd-initrd-modprobe.nix b/nixos/tests/systemd-initrd-modprobe.nix
index e5aee51ade7f..88237f5ab801 100644
--- a/nixos/tests/systemd-initrd-modprobe.nix
+++ b/nixos/tests/systemd-initrd-modprobe.nix
@@ -1,29 +1,27 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "systemd-initrd-modprobe";
+{ lib, pkgs, ... }:
+{
+  name = "systemd-initrd-modprobe";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        testing.initrdBackdoor = true;
-        boot.initrd.systemd.enable = true;
-        boot.initrd.kernelModules = [ "tcp_hybla" ]; # Load module in initrd.
-        boot.extraModprobeConfig = ''
-          options tcp_hybla rtt0=42
-        '';
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      testing.initrdBackdoor = true;
+      boot.initrd.systemd.enable = true;
+      boot.initrd.kernelModules = [ "tcp_hybla" ]; # Load module in initrd.
+      boot.extraModprobeConfig = ''
+        options tcp_hybla rtt0=42
+      '';
+    };
 
-    testScript = ''
-      machine.wait_for_unit("initrd.target")
-      rtt = machine.succeed("cat /sys/module/tcp_hybla/parameters/rtt0")
-      assert int(rtt) == 42, "Parameter should be respected for initrd kernel modules"
+  testScript = ''
+    machine.wait_for_unit("initrd.target")
+    rtt = machine.succeed("cat /sys/module/tcp_hybla/parameters/rtt0")
+    assert int(rtt) == 42, "Parameter should be respected for initrd kernel modules"
 
-      # Make sure it sticks in stage 2
-      machine.switch_root()
-      machine.wait_for_unit("multi-user.target")
-      rtt = machine.succeed("cat /sys/module/tcp_hybla/parameters/rtt0")
-      assert int(rtt) == 42, "Parameter should be respected for initrd kernel modules"
-    '';
-  }
-)
+    # Make sure it sticks in stage 2
+    machine.switch_root()
+    machine.wait_for_unit("multi-user.target")
+    rtt = machine.succeed("cat /sys/module/tcp_hybla/parameters/rtt0")
+    assert int(rtt) == 42, "Parameter should be respected for initrd kernel modules"
+  '';
+}
diff --git a/nixos/tests/systemd-initrd-networkd-ssh.nix b/nixos/tests/systemd-initrd-networkd-ssh.nix
index 9805689be4aa..bf59c925875c 100644
--- a/nixos/tests/systemd-initrd-networkd-ssh.nix
+++ b/nixos/tests/systemd-initrd-networkd-ssh.nix
@@ -1,64 +1,62 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "systemd-initrd-network-ssh";
-    meta.maintainers = [ lib.maintainers.elvishjerricco ];
+{ lib, ... }:
+{
+  name = "systemd-initrd-network-ssh";
+  meta.maintainers = [ lib.maintainers.elvishjerricco ];
 
-    nodes = {
-      server =
-        { config, pkgs, ... }:
-        {
-          testing.initrdBackdoor = true;
-          boot.initrd.systemd.enable = true;
-          boot.initrd.systemd.contents."/etc/msg".text = "foo";
-          boot.initrd.network = {
+  nodes = {
+    server =
+      { config, pkgs, ... }:
+      {
+        testing.initrdBackdoor = true;
+        boot.initrd.systemd.enable = true;
+        boot.initrd.systemd.contents."/etc/msg".text = "foo";
+        boot.initrd.network = {
+          enable = true;
+          ssh = {
             enable = true;
-            ssh = {
-              enable = true;
-              authorizedKeys = [ (lib.readFile ./initrd-network-ssh/id_ed25519.pub) ];
-              port = 22;
-              hostKeys = [ ./initrd-network-ssh/ssh_host_ed25519_key ];
-            };
+            authorizedKeys = [ (lib.readFile ./initrd-network-ssh/id_ed25519.pub) ];
+            port = 22;
+            hostKeys = [ ./initrd-network-ssh/ssh_host_ed25519_key ];
           };
         };
+      };
 
-      client =
-        { config, ... }:
-        {
-          environment.etc = {
-            knownHosts = {
-              text = lib.concatStrings [
-                "server,"
-                "${toString (lib.head (lib.splitString " " (toString (lib.elemAt (lib.splitString "\n" config.networking.extraHosts) 2))))} "
-                "${lib.readFile ./initrd-network-ssh/ssh_host_ed25519_key.pub}"
-              ];
-            };
-            sshKey = {
-              source = ./initrd-network-ssh/id_ed25519;
-              mode = "0600";
-            };
+    client =
+      { config, ... }:
+      {
+        environment.etc = {
+          knownHosts = {
+            text = lib.concatStrings [
+              "server,"
+              "${toString (lib.head (lib.splitString " " (toString (lib.elemAt (lib.splitString "\n" config.networking.extraHosts) 2))))} "
+              "${lib.readFile ./initrd-network-ssh/ssh_host_ed25519_key.pub}"
+            ];
+          };
+          sshKey = {
+            source = ./initrd-network-ssh/id_ed25519;
+            mode = "0600";
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      def ssh_is_up(_) -> bool:
-          status, _ = client.execute("nc -z server 22")
-          return status == 0
+    def ssh_is_up(_) -> bool:
+        status, _ = client.execute("nc -z server 22")
+        return status == 0
 
-      client.wait_for_unit("network.target")
-      with client.nested("waiting for SSH server to come up"):
-          retry(ssh_is_up)
+    client.wait_for_unit("network.target")
+    with client.nested("waiting for SSH server to come up"):
+        retry(ssh_is_up)
 
-      msg = client.succeed(
-          "ssh -i /etc/sshKey -o UserKnownHostsFile=/etc/knownHosts server 'cat /etc/msg'"
-      )
-      assert "foo" in msg
+    msg = client.succeed(
+        "ssh -i /etc/sshKey -o UserKnownHostsFile=/etc/knownHosts server 'cat /etc/msg'"
+    )
+    assert "foo" in msg
 
-      server.switch_root()
-      server.wait_for_unit("multi-user.target")
-    '';
-  }
-)
+    server.switch_root()
+    server.wait_for_unit("multi-user.target")
+  '';
+}
diff --git a/nixos/tests/systemd-initrd-swraid.nix b/nixos/tests/systemd-initrd-swraid.nix
index 106839ef4b95..933b2ad41056 100644
--- a/nixos/tests/systemd-initrd-swraid.nix
+++ b/nixos/tests/systemd-initrd-swraid.nix
@@ -1,77 +1,75 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "systemd-initrd-swraid";
+{ lib, pkgs, ... }:
+{
+  name = "systemd-initrd-swraid";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        # Use systemd-boot
-        virtualisation = {
-          emptyDiskImages = [
-            512
-            512
-          ];
-          useBootLoader = true;
-          # Booting off the RAID requires an available init script
-          mountHostNixStore = true;
-          useEFIBoot = true;
-        };
-        boot.loader.systemd-boot.enable = true;
-        boot.loader.efi.canTouchEfiVariables = true;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      # Use systemd-boot
+      virtualisation = {
+        emptyDiskImages = [
+          512
+          512
+        ];
+        useBootLoader = true;
+        # Booting off the RAID requires an available init script
+        mountHostNixStore = true;
+        useEFIBoot = true;
+      };
+      boot.loader.systemd-boot.enable = true;
+      boot.loader.efi.canTouchEfiVariables = true;
 
-        environment.systemPackages = with pkgs; [
-          mdadm
-          e2fsprogs
-        ]; # for mdadm and mkfs.ext4
-        boot.swraid = {
-          enable = true;
-          mdadmConf = ''
-            ARRAY /dev/md0 devices=/dev/vdb,/dev/vdc
-          '';
-        };
-        environment.etc."mdadm.conf".text = ''
-          MAILADDR test@example.com
+      environment.systemPackages = with pkgs; [
+        mdadm
+        e2fsprogs
+      ]; # for mdadm and mkfs.ext4
+      boot.swraid = {
+        enable = true;
+        mdadmConf = ''
+          ARRAY /dev/md0 devices=/dev/vdb,/dev/vdc
         '';
-        boot.initrd = {
-          systemd = {
-            enable = true;
-            emergencyAccess = true;
-          };
-          kernelModules = [ "raid0" ];
+      };
+      environment.etc."mdadm.conf".text = ''
+        MAILADDR test@example.com
+      '';
+      boot.initrd = {
+        systemd = {
+          enable = true;
+          emergencyAccess = true;
         };
-
-        specialisation.boot-swraid.configuration.virtualisation.rootDevice = "/dev/disk/by-label/testraid";
-        # This protects against a regression. We do not have to switch to it.
-        # It's sufficient to trigger its evaluation.
-        specialisation.build-old-initrd.configuration.boot.initrd.systemd.enable = lib.mkForce false;
+        kernelModules = [ "raid0" ];
       };
 
-    testScript = ''
-      # Create RAID
-      machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid1 /dev/vdb /dev/vdc --metadata=0.90")
-      machine.succeed("mkfs.ext4 -L testraid /dev/md0")
-      machine.succeed("mkdir -p /mnt && mount /dev/md0 /mnt && echo hello > /mnt/test && umount /mnt")
+      specialisation.boot-swraid.configuration.virtualisation.rootDevice = "/dev/disk/by-label/testraid";
+      # This protects against a regression. We do not have to switch to it.
+      # It's sufficient to trigger its evaluation.
+      specialisation.build-old-initrd.configuration.boot.initrd.systemd.enable = lib.mkForce false;
+    };
 
-      # Boot from the RAID
-      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-swraid.conf")
-      machine.succeed("sync")
-      machine.crash()
-      machine.wait_for_unit("multi-user.target")
+  testScript = ''
+    # Create RAID
+    machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid1 /dev/vdb /dev/vdc --metadata=0.90")
+    machine.succeed("mkfs.ext4 -L testraid /dev/md0")
+    machine.succeed("mkdir -p /mnt && mount /dev/md0 /mnt && echo hello > /mnt/test && umount /mnt")
 
-      # Ensure we have successfully booted from the RAID
-      assert "(initrd)" in machine.succeed("systemd-analyze")  # booted with systemd in stage 1
-      assert "/dev/md0 on / type ext4" in machine.succeed("mount")
-      assert "hello" in machine.succeed("cat /test")
-      assert "md0" in machine.succeed("cat /proc/mdstat")
+    # Boot from the RAID
+    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-swraid.conf")
+    machine.succeed("sync")
+    machine.crash()
+    machine.wait_for_unit("multi-user.target")
 
-      expected_config = """MAILADDR test@example.com
+    # Ensure we have successfully booted from the RAID
+    assert "(initrd)" in machine.succeed("systemd-analyze")  # booted with systemd in stage 1
+    assert "/dev/md0 on / type ext4" in machine.succeed("mount")
+    assert "hello" in machine.succeed("cat /test")
+    assert "md0" in machine.succeed("cat /proc/mdstat")
 
-      ARRAY /dev/md0 devices=/dev/vdb,/dev/vdc
-      """
-      got_config = machine.execute("cat /etc/mdadm.conf")[1]
-      assert expected_config == got_config, repr((expected_config, got_config))
-      machine.wait_for_unit("mdmonitor.service")
-    '';
-  }
-)
+    expected_config = """MAILADDR test@example.com
+
+    ARRAY /dev/md0 devices=/dev/vdb,/dev/vdc
+    """
+    got_config = machine.execute("cat /etc/mdadm.conf")[1]
+    assert expected_config == got_config, repr((expected_config, got_config))
+    machine.wait_for_unit("mdmonitor.service")
+  '';
+}
diff --git a/nixos/tests/systemd-initrd-vconsole.nix b/nixos/tests/systemd-initrd-vconsole.nix
index 4fc9b5f3738c..556679cdbb15 100644
--- a/nixos/tests/systemd-initrd-vconsole.nix
+++ b/nixos/tests/systemd-initrd-vconsole.nix
@@ -1,52 +1,50 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "systemd-initrd-vconsole";
+{ lib, pkgs, ... }:
+{
+  name = "systemd-initrd-vconsole";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        boot.kernelParams = lib.mkAfter [
-          "rd.systemd.unit=rescue.target"
-          "loglevel=3"
-          "udev.log_level=3"
-          "systemd.log_level=warning"
-        ];
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      boot.kernelParams = lib.mkAfter [
+        "rd.systemd.unit=rescue.target"
+        "loglevel=3"
+        "udev.log_level=3"
+        "systemd.log_level=warning"
+      ];
 
-        boot.initrd.systemd = {
-          enable = true;
-          emergencyAccess = true;
-        };
-
-        console = {
-          earlySetup = true;
-          keyMap = "colemak";
-        };
+      boot.initrd.systemd = {
+        enable = true;
+        emergencyAccess = true;
       };
 
-    testScript = ''
-      # Boot into rescue shell in initrd
-      machine.start()
-      machine.wait_for_console_text("Press Enter for maintenance")
-      machine.send_console("\n")
+      console = {
+        earlySetup = true;
+        keyMap = "colemak";
+      };
+    };
 
-      # Wait for shell to become ready
-      for _ in range(300):
-        machine.send_console("printf '%s to receive commands:\\n' Ready\n")
-        try:
-          machine.wait_for_console_text("Ready to receive commands:", timeout=1)
-          break
-        except Exception:
-          continue
-      else:
-        raise RuntimeError("Rescue shell never became ready")
+  testScript = ''
+    # Boot into rescue shell in initrd
+    machine.start()
+    machine.wait_for_console_text("Press Enter for maintenance")
+    machine.send_console("\n")
 
-      # Check keymap
-      machine.send_console("(printf '%s to receive text:\\n' Ready && read text && echo \"$text\") </dev/tty1\n")
-      machine.wait_for_console_text("Ready to receive text:")
-      for key in "asdfjkl;\n":
-        machine.send_key(key)
-      machine.wait_for_console_text("arstneio")
-    '';
-  }
-)
+    # Wait for shell to become ready
+    for _ in range(300):
+      machine.send_console("printf '%s to receive commands:\\n' Ready\n")
+      try:
+        machine.wait_for_console_text("Ready to receive commands:", timeout=1)
+        break
+      except Exception:
+        continue
+    else:
+      raise RuntimeError("Rescue shell never became ready")
+
+    # Check keymap
+    machine.send_console("(printf '%s to receive text:\\n' Ready && read text && echo \"$text\") </dev/tty1\n")
+    machine.wait_for_console_text("Ready to receive text:")
+    for key in "asdfjkl;\n":
+      machine.send_key(key)
+    machine.wait_for_console_text("arstneio")
+  '';
+}
diff --git a/nixos/tests/systemd-initrd-vlan.nix b/nixos/tests/systemd-initrd-vlan.nix
index 36d8154cdc5f..dd1b9ec8b6bf 100644
--- a/nixos/tests/systemd-initrd-vlan.nix
+++ b/nixos/tests/systemd-initrd-vlan.nix
@@ -1,66 +1,64 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "systemd-initrd-vlan";
-    meta.maintainers = [ lib.maintainers.majiir ];
+{ lib, ... }:
+{
+  name = "systemd-initrd-vlan";
+  meta.maintainers = [ lib.maintainers.majiir ];
 
-    # Tests VLAN interface configuration in systemd-initrd.
-    #
-    # Two nodes are configured for a tagged VLAN. (Note that they also still have
-    # their ordinary eth0 and eth1 interfaces, which are not VLAN-tagged.)
-    #
-    # The 'server' node waits forever in initrd (stage 1) with networking
-    # enabled. The 'client' node pings it to test network connectivity.
+  # Tests VLAN interface configuration in systemd-initrd.
+  #
+  # Two nodes are configured for a tagged VLAN. (Note that they also still have
+  # their ordinary eth0 and eth1 interfaces, which are not VLAN-tagged.)
+  #
+  # The 'server' node waits forever in initrd (stage 1) with networking
+  # enabled. The 'client' node pings it to test network connectivity.
 
-    nodes =
-      let
-        network = id: {
-          networking = {
-            vlans."eth1.10" = {
-              id = 10;
-              interface = "eth1";
-            };
-            interfaces."eth1.10" = {
-              ipv4.addresses = [
-                {
-                  address = "192.168.10.${id}";
-                  prefixLength = 24;
-                }
-              ];
-            };
+  nodes =
+    let
+      network = id: {
+        networking = {
+          vlans."eth1.10" = {
+            id = 10;
+            interface = "eth1";
+          };
+          interfaces."eth1.10" = {
+            ipv4.addresses = [
+              {
+                address = "192.168.10.${id}";
+                prefixLength = 24;
+              }
+            ];
           };
         };
-      in
-      {
-        # Node that will use initrd networking.
-        server = network "1" // {
-          boot.initrd.systemd.enable = true;
-          boot.initrd.network.enable = true;
-          boot.initrd.systemd.services.boot-blocker = {
-            before = [ "initrd.target" ];
-            wantedBy = [ "initrd.target" ];
-            script = "sleep infinity";
-            serviceConfig.Type = "oneshot";
-          };
+      };
+    in
+    {
+      # Node that will use initrd networking.
+      server = network "1" // {
+        boot.initrd.systemd.enable = true;
+        boot.initrd.network.enable = true;
+        boot.initrd.systemd.services.boot-blocker = {
+          before = [ "initrd.target" ];
+          wantedBy = [ "initrd.target" ];
+          script = "sleep infinity";
+          serviceConfig.Type = "oneshot";
         };
-
-        # Node that will ping the server.
-        client = network "2";
       };
 
-    testScript = ''
-      start_all()
-      client.wait_for_unit("network.target")
+      # Node that will ping the server.
+      client = network "2";
+    };
 
-      # Wait for the regular (untagged) interface to be up.
-      def server_is_up(_) -> bool:
-          status, _ = client.execute("ping -n -c 1 server >&2")
-          return status == 0
-      with client.nested("waiting for server to come up"):
-          retry(server_is_up)
+  testScript = ''
+    start_all()
+    client.wait_for_unit("network.target")
 
-      # Try to ping the (tagged) VLAN interface.
-      client.succeed("ping -n -w 10 -c 1 192.168.10.1 >&2")
-    '';
-  }
-)
+    # Wait for the regular (untagged) interface to be up.
+    def server_is_up(_) -> bool:
+        status, _ = client.execute("ping -n -c 1 server >&2")
+        return status == 0
+    with client.nested("waiting for server to come up"):
+        retry(server_is_up)
+
+    # Try to ping the (tagged) VLAN interface.
+    client.succeed("ping -n -w 10 -c 1 192.168.10.1 >&2")
+  '';
+}
diff --git a/nixos/tests/systemd-journal-gateway.nix b/nixos/tests/systemd-journal-gateway.nix
index 6ae009f5362c..e77501127ca2 100644
--- a/nixos/tests/systemd-journal-gateway.nix
+++ b/nixos/tests/systemd-journal-gateway.nix
@@ -1,95 +1,93 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "systemd-journal-gateway";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        minijackson
-        raitobezarius
-      ];
+{ lib, pkgs, ... }:
+{
+  name = "systemd-journal-gateway";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      minijackson
+      raitobezarius
+    ];
+  };
+
+  # Named client for coherence with the systemd-journal-upload test, and for
+  # certificate validation
+  nodes.client = {
+    services.journald.gateway = {
+      enable = true;
+      cert = "/run/secrets/client/cert.pem";
+      key = "/run/secrets/client/key.pem";
+      trust = "/run/secrets/ca.cert.pem";
     };
+  };
 
-    # Named client for coherence with the systemd-journal-upload test, and for
-    # certificate validation
-    nodes.client = {
-      services.journald.gateway = {
-        enable = true;
-        cert = "/run/secrets/client/cert.pem";
-        key = "/run/secrets/client/key.pem";
-        trust = "/run/secrets/ca.cert.pem";
-      };
-    };
+  testScript = ''
+    import json
+    import subprocess
+    import tempfile
 
-    testScript = ''
-      import json
-      import subprocess
-      import tempfile
+    tmpdir_o = tempfile.TemporaryDirectory()
+    tmpdir = tmpdir_o.name
 
-      tmpdir_o = tempfile.TemporaryDirectory()
-      tmpdir = tmpdir_o.name
-
-      def generate_pems(domain: str):
-        subprocess.run(
-          [
-            "${pkgs.minica}/bin/minica",
-            "--ca-key=ca.key.pem",
-            "--ca-cert=ca.cert.pem",
-            f"--domains={domain}",
-          ],
-          cwd=str(tmpdir),
-        )
-
-      with subtest("Creating keys and certificates"):
-        generate_pems("server")
-        generate_pems("client")
-
-      client.wait_for_unit("multi-user.target")
-
-      def copy_pem(file: str):
-        machine.copy_from_host(source=f"{tmpdir}/{file}", target=f"/run/secrets/{file}")
-        machine.succeed(f"chmod 600 /run/secrets/{file} && chown systemd-journal-gateway /run/secrets/{file}")
-
-      with subtest("Copying keys and certificates"):
-        machine.succeed("mkdir -p /run/secrets/{client,server}")
-        copy_pem("server/cert.pem")
-        copy_pem("server/key.pem")
-        copy_pem("client/cert.pem")
-        copy_pem("client/key.pem")
-        copy_pem("ca.cert.pem")
-
-      client.wait_for_unit("multi-user.target")
-
-      curl = '${pkgs.curl}/bin/curl'
-      accept_json = '--header "Accept: application/json"'
-      cacert = '--cacert /run/secrets/ca.cert.pem'
-      cert = '--cert /run/secrets/server/cert.pem'
-      key = '--key /run/secrets/server/key.pem'
-      base_url = 'https://client:19531'
-
-      curl_cli = f"{curl} {accept_json} {cacert} {cert} {key} --fail"
-
-      machine_info = client.succeed(f"{curl_cli} {base_url}/machine")
-      assert json.loads(machine_info)["hostname"] == "client", "wrong machine name"
-
-      # The HTTP request should have started the gateway service, triggered by
-      # the .socket unit
-      client.wait_for_unit("systemd-journal-gatewayd.service")
-
-      identifier = "nixos-test"
-      message = "Hello from NixOS test infrastructure"
-
-      client.succeed(f"systemd-cat --identifier={identifier} <<< '{message}'")
-
-      # max-time is a workaround against a bug in systemd-journal-gatewayd where
-      # if TLS is enabled, the connection is never closed. Since it will timeout,
-      # we ignore the return code.
-      entries = client.succeed(
-          f"{curl_cli} --max-time 5 {base_url}/entries?SYSLOG_IDENTIFIER={identifier} || true"
+    def generate_pems(domain: str):
+      subprocess.run(
+        [
+          "${pkgs.minica}/bin/minica",
+          "--ca-key=ca.key.pem",
+          "--ca-cert=ca.cert.pem",
+          f"--domains={domain}",
+        ],
+        cwd=str(tmpdir),
       )
 
-      # Number of entries should be only 1
-      added_entry = json.loads(entries)
-      assert added_entry["SYSLOG_IDENTIFIER"] == identifier and added_entry["MESSAGE"] == message, "journal entry does not correspond"
-    '';
-  }
-)
+    with subtest("Creating keys and certificates"):
+      generate_pems("server")
+      generate_pems("client")
+
+    client.wait_for_unit("multi-user.target")
+
+    def copy_pem(file: str):
+      machine.copy_from_host(source=f"{tmpdir}/{file}", target=f"/run/secrets/{file}")
+      machine.succeed(f"chmod 600 /run/secrets/{file} && chown systemd-journal-gateway /run/secrets/{file}")
+
+    with subtest("Copying keys and certificates"):
+      machine.succeed("mkdir -p /run/secrets/{client,server}")
+      copy_pem("server/cert.pem")
+      copy_pem("server/key.pem")
+      copy_pem("client/cert.pem")
+      copy_pem("client/key.pem")
+      copy_pem("ca.cert.pem")
+
+    client.wait_for_unit("multi-user.target")
+
+    curl = '${pkgs.curl}/bin/curl'
+    accept_json = '--header "Accept: application/json"'
+    cacert = '--cacert /run/secrets/ca.cert.pem'
+    cert = '--cert /run/secrets/server/cert.pem'
+    key = '--key /run/secrets/server/key.pem'
+    base_url = 'https://client:19531'
+
+    curl_cli = f"{curl} {accept_json} {cacert} {cert} {key} --fail"
+
+    machine_info = client.succeed(f"{curl_cli} {base_url}/machine")
+    assert json.loads(machine_info)["hostname"] == "client", "wrong machine name"
+
+    # The HTTP request should have started the gateway service, triggered by
+    # the .socket unit
+    client.wait_for_unit("systemd-journal-gatewayd.service")
+
+    identifier = "nixos-test"
+    message = "Hello from NixOS test infrastructure"
+
+    client.succeed(f"systemd-cat --identifier={identifier} <<< '{message}'")
+
+    # max-time is a workaround against a bug in systemd-journal-gatewayd where
+    # if TLS is enabled, the connection is never closed. Since it will timeout,
+    # we ignore the return code.
+    entries = client.succeed(
+        f"{curl_cli} --max-time 5 {base_url}/entries?SYSLOG_IDENTIFIER={identifier} || true"
+    )
+
+    # Number of entries should be only 1
+    added_entry = json.loads(entries)
+    assert added_entry["SYSLOG_IDENTIFIER"] == identifier and added_entry["MESSAGE"] == message, "journal entry does not correspond"
+  '';
+}
diff --git a/nixos/tests/systemd-journal-upload.nix b/nixos/tests/systemd-journal-upload.nix
index 923dd48b32ac..00dbba82b88b 100644
--- a/nixos/tests/systemd-journal-upload.nix
+++ b/nixos/tests/systemd-journal-upload.nix
@@ -1,110 +1,108 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "systemd-journal-upload";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        minijackson
-        raitobezarius
-      ];
+{ pkgs, ... }:
+{
+  name = "systemd-journal-upload";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      minijackson
+      raitobezarius
+    ];
+  };
+
+  nodes.server =
+    { nodes, ... }:
+    {
+      services.journald.remote = {
+        enable = true;
+        listen = "http";
+        settings.Remote = {
+          ServerCertificateFile = "/run/secrets/sever.cert.pem";
+          ServerKeyFile = "/run/secrets/sever.key.pem";
+          TrustedCertificateFile = "/run/secrets/ca.cert.pem";
+          Seal = true;
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [ nodes.server.services.journald.remote.port ];
     };
 
-    nodes.server =
-      { nodes, ... }:
-      {
-        services.journald.remote = {
-          enable = true;
-          listen = "http";
-          settings.Remote = {
-            ServerCertificateFile = "/run/secrets/sever.cert.pem";
-            ServerKeyFile = "/run/secrets/sever.key.pem";
-            TrustedCertificateFile = "/run/secrets/ca.cert.pem";
-            Seal = true;
-          };
-        };
-
-        networking.firewall.allowedTCPPorts = [ nodes.server.services.journald.remote.port ];
-      };
-
-    nodes.client =
-      { lib, nodes, ... }:
-      {
-        services.journald.upload = {
-          enable = true;
-          settings.Upload = {
-            URL = "http://server:${toString nodes.server.services.journald.remote.port}";
-            ServerCertificateFile = "/run/secrets/client.cert.pem";
-            ServerKeyFile = "/run/secrets/client.key.pem";
-            TrustedCertificateFile = "/run/secrets/ca.cert.pem";
-          };
-        };
-
-        # Wait for the PEMs to arrive
-        systemd.services.systemd-journal-upload.wantedBy = lib.mkForce [ ];
-        systemd.paths.systemd-journal-upload = {
-          wantedBy = [ "default.target" ];
-          # This file must be copied last
-          pathConfig.PathExists = [ "/run/secrets/ca.cert.pem" ];
+  nodes.client =
+    { lib, nodes, ... }:
+    {
+      services.journald.upload = {
+        enable = true;
+        settings.Upload = {
+          URL = "http://server:${toString nodes.server.services.journald.remote.port}";
+          ServerCertificateFile = "/run/secrets/client.cert.pem";
+          ServerKeyFile = "/run/secrets/client.key.pem";
+          TrustedCertificateFile = "/run/secrets/ca.cert.pem";
         };
       };
 
-    testScript = ''
-      import subprocess
-      import tempfile
+      # Wait for the PEMs to arrive
+      systemd.services.systemd-journal-upload.wantedBy = lib.mkForce [ ];
+      systemd.paths.systemd-journal-upload = {
+        wantedBy = [ "default.target" ];
+        # This file must be copied last
+        pathConfig.PathExists = [ "/run/secrets/ca.cert.pem" ];
+      };
+    };
 
-      tmpdir_o = tempfile.TemporaryDirectory()
-      tmpdir = tmpdir_o.name
+  testScript = ''
+    import subprocess
+    import tempfile
 
-      def generate_pems(domain: str):
-        subprocess.run(
-          [
-            "${pkgs.minica}/bin/minica",
-            "--ca-key=ca.key.pem",
-            "--ca-cert=ca.cert.pem",
-            f"--domains={domain}",
-          ],
-          cwd=str(tmpdir),
-        )
+    tmpdir_o = tempfile.TemporaryDirectory()
+    tmpdir = tmpdir_o.name
 
-      with subtest("Creating keys and certificates"):
-        generate_pems("server")
-        generate_pems("client")
-
-      server.wait_for_unit("multi-user.target")
-      client.wait_for_unit("multi-user.target")
-
-      def copy_pems(machine: Machine, domain: str):
-        machine.succeed("mkdir /run/secrets")
-        machine.copy_from_host(
-          source=f"{tmpdir}/{domain}/cert.pem",
-          target=f"/run/secrets/{domain}.cert.pem",
-        )
-        machine.copy_from_host(
-          source=f"{tmpdir}/{domain}/key.pem",
-          target=f"/run/secrets/{domain}.key.pem",
-        )
-        # Should be last
-        machine.copy_from_host(
-          source=f"{tmpdir}/ca.cert.pem",
-          target="/run/secrets/ca.cert.pem",
-        )
-
-      with subtest("Copying keys and certificates"):
-        copy_pems(server, "server")
-        copy_pems(client, "client")
-
-      client.wait_for_unit("systemd-journal-upload.service")
-      # The journal upload should have started the remote service, triggered by
-      # the .socket unit
-      server.wait_for_unit("systemd-journal-remote.service")
-
-      identifier = "nixos-test"
-      message = "Hello from NixOS test infrastructure"
-
-      client.succeed(f"systemd-cat --identifier={identifier} <<< '{message}'")
-      server.wait_until_succeeds(
-        f"journalctl --file /var/log/journal/remote/remote-*.journal --identifier={identifier} | grep -F '{message}'"
+    def generate_pems(domain: str):
+      subprocess.run(
+        [
+          "${pkgs.minica}/bin/minica",
+          "--ca-key=ca.key.pem",
+          "--ca-cert=ca.cert.pem",
+          f"--domains={domain}",
+        ],
+        cwd=str(tmpdir),
       )
-    '';
-  }
-)
+
+    with subtest("Creating keys and certificates"):
+      generate_pems("server")
+      generate_pems("client")
+
+    server.wait_for_unit("multi-user.target")
+    client.wait_for_unit("multi-user.target")
+
+    def copy_pems(machine: Machine, domain: str):
+      machine.succeed("mkdir /run/secrets")
+      machine.copy_from_host(
+        source=f"{tmpdir}/{domain}/cert.pem",
+        target=f"/run/secrets/{domain}.cert.pem",
+      )
+      machine.copy_from_host(
+        source=f"{tmpdir}/{domain}/key.pem",
+        target=f"/run/secrets/{domain}.key.pem",
+      )
+      # Should be last
+      machine.copy_from_host(
+        source=f"{tmpdir}/ca.cert.pem",
+        target="/run/secrets/ca.cert.pem",
+      )
+
+    with subtest("Copying keys and certificates"):
+      copy_pems(server, "server")
+      copy_pems(client, "client")
+
+    client.wait_for_unit("systemd-journal-upload.service")
+    # The journal upload should have started the remote service, triggered by
+    # the .socket unit
+    server.wait_for_unit("systemd-journal-remote.service")
+
+    identifier = "nixos-test"
+    message = "Hello from NixOS test infrastructure"
+
+    client.succeed(f"systemd-cat --identifier={identifier} <<< '{message}'")
+    server.wait_until_succeeds(
+      f"journalctl --file /var/log/journal/remote/remote-*.journal --identifier={identifier} | grep -F '{message}'"
+    )
+  '';
+}
diff --git a/nixos/tests/systemd-journal.nix b/nixos/tests/systemd-journal.nix
index c39fc50e5006..8589df339253 100644
--- a/nixos/tests/systemd-journal.nix
+++ b/nixos/tests/systemd-journal.nix
@@ -1,77 +1,75 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "systemd-journal";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ lewo ];
+{
+  name = "systemd-journal";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ lewo ];
+  };
+
+  nodes.machine = {
+    environment.systemPackages = [ pkgs.audit ];
+  };
+  nodes.auditd = {
+    security.auditd.enable = true;
+    security.audit.enable = true;
+    environment.systemPackages = [ pkgs.audit ];
+    boot.kernel.sysctl."kernel.printk_ratelimit" = 0;
+    boot.kernelParams = [ "audit_backlog_limit=8192" ];
+  };
+  nodes.journaldAudit = {
+    services.journald.audit = true;
+    security.audit.enable = true;
+    environment.systemPackages = [ pkgs.audit ];
+    boot.kernel.sysctl."kernel.printk_ratelimit" = 0;
+    boot.kernelParams = [ "audit_backlog_limit=8192" ];
+  };
+  nodes.containerCheck = {
+    containers.c1 = {
+      autoStart = true;
+      config = { };
     };
+  };
 
-    nodes.machine = {
-      environment.systemPackages = [ pkgs.audit ];
-    };
-    nodes.auditd = {
-      security.auditd.enable = true;
-      security.audit.enable = true;
-      environment.systemPackages = [ pkgs.audit ];
-      boot.kernel.sysctl."kernel.printk_ratelimit" = 0;
-      boot.kernelParams = [ "audit_backlog_limit=8192" ];
-    };
-    nodes.journaldAudit = {
-      services.journald.audit = true;
-      security.audit.enable = true;
-      environment.systemPackages = [ pkgs.audit ];
-      boot.kernel.sysctl."kernel.printk_ratelimit" = 0;
-      boot.kernelParams = [ "audit_backlog_limit=8192" ];
-    };
-    nodes.containerCheck = {
-      containers.c1 = {
-        autoStart = true;
-        config = { };
-      };
-    };
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("journalctl --grep=systemd")
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("journalctl --grep=systemd")
+    with subtest("no audit messages"):
+      machine.fail("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
+      machine.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
 
-      with subtest("no audit messages"):
-        machine.fail("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
-        machine.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
+    with subtest("auditd enabled"):
+      auditd.wait_for_unit("multi-user.target")
 
-      with subtest("auditd enabled"):
-        auditd.wait_for_unit("multi-user.target")
-
-        # logs should end up in the journald
-        auditd.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
-        # logs should end up in the auditd audit log
-        auditd.succeed("grep 'unit=systemd-journald' /var/log/audit/audit.log")
-        # logs should not end up in kmesg
-        machine.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
+      # logs should end up in the journald
+      auditd.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
+      # logs should end up in the auditd audit log
+      auditd.succeed("grep 'unit=systemd-journald' /var/log/audit/audit.log")
+      # logs should not end up in kmesg
+      machine.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
 
 
-      with subtest("journald audit"):
-        journaldAudit.wait_for_unit("multi-user.target")
+    with subtest("journald audit"):
+      journaldAudit.wait_for_unit("multi-user.target")
 
-        # logs should end up in the journald
-        journaldAudit.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
-        # logs should NOT end up in audit log
-        journaldAudit.fail("grep 'unit=systemd-journald' /var/log/audit/audit.log")
-        # FIXME: If systemd fixes #15324 this test will start failing.
-        # You can fix this text by removing the below line.
-        # logs ideally should NOT end up in kmesg, but they do due to
-        # https://github.com/systemd/systemd/issues/15324
-        journaldAudit.succeed("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
+      # logs should end up in the journald
+      journaldAudit.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
+      # logs should NOT end up in audit log
+      journaldAudit.fail("grep 'unit=systemd-journald' /var/log/audit/audit.log")
+      # FIXME: If systemd fixes #15324 this test will start failing.
+      # You can fix this text by removing the below line.
+      # logs ideally should NOT end up in kmesg, but they do due to
+      # https://github.com/systemd/systemd/issues/15324
+      journaldAudit.succeed("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
 
 
-      with subtest("container systemd-journald-audit not running"):
-        containerCheck.wait_for_unit("multi-user.target");
-        containerCheck.wait_until_succeeds("systemctl -M c1 is-active default.target");
+    with subtest("container systemd-journald-audit not running"):
+      containerCheck.wait_for_unit("multi-user.target");
+      containerCheck.wait_until_succeeds("systemctl -M c1 is-active default.target");
 
-        # systemd-journald-audit.socket should exist but not run due to the upstream unit's `Condition*` settings
-        (status, output) = containerCheck.execute("systemctl -M c1 is-active systemd-journald-audit.socket")
-        containerCheck.log(output)
-        assert status == 3 and output == "inactive\n", f"systemd-journald-audit.socket should exist in a container but remain inactive, was {output}"
-    '';
-  }
-)
+      # systemd-journald-audit.socket should exist but not run due to the upstream unit's `Condition*` settings
+      (status, output) = containerCheck.execute("systemctl -M c1 is-active systemd-journald-audit.socket")
+      containerCheck.log(output)
+      assert status == 3 and output == "inactive\n", f"systemd-journald-audit.socket should exist in a container but remain inactive, was {output}"
+  '';
+}
diff --git a/nixos/tests/systemd-machinectl.nix b/nixos/tests/systemd-machinectl.nix
index 2e35d160f533..03ffc25b9113 100644
--- a/nixos/tests/systemd-machinectl.nix
+++ b/nixos/tests/systemd-machinectl.nix
@@ -1,213 +1,211 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
+{ pkgs, ... }:
+let
 
-    container =
-      { config, ... }:
-      {
-        # We re-use the NixOS container option ...
-        boot.isContainer = true;
-        # ... and revert unwanted defaults
-        networking.useHostResolvConf = false;
+  container =
+    { config, ... }:
+    {
+      # We re-use the NixOS container option ...
+      boot.isContainer = true;
+      # ... and revert unwanted defaults
+      networking.useHostResolvConf = false;
 
-        # use networkd to obtain systemd network setup
-        networking.useNetworkd = true;
-        networking.useDHCP = false;
+      # use networkd to obtain systemd network setup
+      networking.useNetworkd = true;
+      networking.useDHCP = false;
 
-        # systemd-nspawn expects /sbin/init
-        boot.loader.initScript.enable = true;
+      # systemd-nspawn expects /sbin/init
+      boot.loader.initScript.enable = true;
 
-        imports = [ ../modules/profiles/minimal.nix ];
+      imports = [ ../modules/profiles/minimal.nix ];
 
-        system.stateVersion = config.system.nixos.release;
+      system.stateVersion = config.system.nixos.release;
 
-        nixpkgs.pkgs = pkgs;
-      };
-
-    containerSystem =
-      (import ../lib/eval-config.nix {
-        system = null;
-        modules = [ container ];
-      }).config.system.build.toplevel;
-
-    containerName = "container";
-    containerRoot = "/var/lib/machines/${containerName}";
-
-    containerTarball = pkgs.callPackage ../lib/make-system-tarball.nix {
-      storeContents = [
-        {
-          object = containerSystem;
-          symlink = "/nix/var/nix/profiles/system";
-        }
-      ];
-
-      contents = [
-        {
-          source = containerSystem + "/etc/os-release";
-          target = "/etc/os-release";
-        }
-        {
-          source = containerSystem + "/init";
-          target = "/sbin/init";
-        }
-      ];
+      nixpkgs.pkgs = pkgs;
     };
-  in
-  {
-    name = "systemd-machinectl";
 
-    nodes.machine =
-      { lib, ... }:
+  containerSystem =
+    (import ../lib/eval-config.nix {
+      system = null;
+      modules = [ container ];
+    }).config.system.build.toplevel;
+
+  containerName = "container";
+  containerRoot = "/var/lib/machines/${containerName}";
+
+  containerTarball = pkgs.callPackage ../lib/make-system-tarball.nix {
+    storeContents = [
       {
-        # use networkd to obtain systemd network setup
-        networking.useNetworkd = true;
-        networking.useDHCP = false;
+        object = containerSystem;
+        symlink = "/nix/var/nix/profiles/system";
+      }
+    ];
 
-        # do not try to access cache.nixos.org
-        nix.settings.substituters = lib.mkForce [ ];
+    contents = [
+      {
+        source = containerSystem + "/etc/os-release";
+        target = "/etc/os-release";
+      }
+      {
+        source = containerSystem + "/init";
+        target = "/sbin/init";
+      }
+    ];
+  };
+in
+{
+  name = "systemd-machinectl";
 
-        # auto-start container
-        systemd.targets.machines.wants = [ "systemd-nspawn@${containerName}.service" ];
+  nodes.machine =
+    { lib, ... }:
+    {
+      # use networkd to obtain systemd network setup
+      networking.useNetworkd = true;
+      networking.useDHCP = false;
 
-        virtualisation.additionalPaths = [
-          containerSystem
-          containerTarball
-        ];
+      # do not try to access cache.nixos.org
+      nix.settings.substituters = lib.mkForce [ ];
 
-        systemd.tmpfiles.rules = [
-          "d /var/lib/machines/shared-decl 0755 root root - -"
-        ];
-        systemd.nspawn.shared-decl = {
-          execConfig = {
-            Boot = false;
-            Parameters = "${containerSystem}/init";
-          };
-          filesConfig = {
-            BindReadOnly = "/nix/store";
-          };
+      # auto-start container
+      systemd.targets.machines.wants = [ "systemd-nspawn@${containerName}.service" ];
+
+      virtualisation.additionalPaths = [
+        containerSystem
+        containerTarball
+      ];
+
+      systemd.tmpfiles.rules = [
+        "d /var/lib/machines/shared-decl 0755 root root - -"
+      ];
+      systemd.nspawn.shared-decl = {
+        execConfig = {
+          Boot = false;
+          Parameters = "${containerSystem}/init";
         };
-
-        systemd.nspawn.${containerName} = {
-          filesConfig = {
-            # workaround to fix kernel namespaces; needed for Nix sandbox
-            # https://github.com/systemd/systemd/issues/27994#issuecomment-1704005670
-            Bind = "/proc:/run/proc";
-          };
+        filesConfig = {
+          BindReadOnly = "/nix/store";
         };
-
-        systemd.services."systemd-nspawn@${containerName}" = {
-          serviceConfig.Environment = [
-            # Disable tmpfs for /tmp
-            "SYSTEMD_NSPAWN_TMPFS_TMP=0"
-
-            # force unified cgroup delegation, which would be the default
-            # if systemd could check the capabilities of the installed systemd.
-            # see also: https://github.com/NixOS/nixpkgs/pull/198526
-            "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY=1"
-          ];
-          overrideStrategy = "asDropin";
-        };
-
-        # open DHCP for container
-        networking.firewall.extraCommands = ''
-          ${pkgs.iptables}/bin/iptables -A nixos-fw -i ve-+ -p udp -m udp --dport 67 -j nixos-fw-accept
-        '';
       };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("default.target");
+      systemd.nspawn.${containerName} = {
+        filesConfig = {
+          # workaround to fix kernel namespaces; needed for Nix sandbox
+          # https://github.com/systemd/systemd/issues/27994#issuecomment-1704005670
+          Bind = "/proc:/run/proc";
+        };
+      };
 
-      # Test machinectl start stop of shared-decl
-      machine.succeed("machinectl start shared-decl");
-      machine.wait_until_succeeds("systemctl -M shared-decl is-active default.target");
-      machine.succeed("machinectl stop shared-decl");
+      systemd.services."systemd-nspawn@${containerName}" = {
+        serviceConfig.Environment = [
+          # Disable tmpfs for /tmp
+          "SYSTEMD_NSPAWN_TMPFS_TMP=0"
 
-      # create containers root
-      machine.succeed("mkdir -p ${containerRoot}");
+          # force unified cgroup delegation, which would be the default
+          # if systemd could check the capabilities of the installed systemd.
+          # see also: https://github.com/NixOS/nixpkgs/pull/198526
+          "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY=1"
+        ];
+        overrideStrategy = "asDropin";
+      };
 
-      # start container with shared nix store by using same arguments as for systemd-nspawn@.service
-      machine.succeed("systemd-run systemd-nspawn --machine=${containerName} --network-veth -U --bind-ro=/nix/store ${containerSystem}/init")
-      machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
+      # open DHCP for container
+      networking.firewall.extraCommands = ''
+        ${pkgs.iptables}/bin/iptables -A nixos-fw -i ve-+ -p udp -m udp --dport 67 -j nixos-fw-accept
+      '';
+    };
 
-      # Test machinectl stop
-      machine.succeed("machinectl stop ${containerName}");
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("default.target");
 
-      # Install container
-      # Workaround for nixos-install
-      machine.succeed("chmod o+rx /var/lib/machines");
-      machine.succeed("nixos-install --root ${containerRoot} --system ${containerSystem} --no-channel-copy --no-root-passwd");
+    # Test machinectl start stop of shared-decl
+    machine.succeed("machinectl start shared-decl");
+    machine.wait_until_succeeds("systemctl -M shared-decl is-active default.target");
+    machine.succeed("machinectl stop shared-decl");
 
-      # Allow systemd-nspawn to apply user namespace on immutable files
-      machine.succeed("chattr -i ${containerRoot}/var/empty");
+    # create containers root
+    machine.succeed("mkdir -p ${containerRoot}");
 
-      # Test machinectl start
-      machine.succeed("machinectl start ${containerName}");
-      machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
+    # start container with shared nix store by using same arguments as for systemd-nspawn@.service
+    machine.succeed("systemd-run systemd-nspawn --machine=${containerName} --network-veth -U --bind-ro=/nix/store ${containerSystem}/init")
+    machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
 
-      # Test systemd-nspawn configured unified cgroup delegation
-      # see also:
-      # https://github.com/systemd/systemd/blob/main/docs/CGROUP_DELEGATION.md#three-different-tree-setups-
-      machine.succeed('systemd-run --pty --wait -M ${containerName} /run/current-system/sw/bin/stat --format="%T" --file-system /sys/fs/cgroup > fstype')
-      machine.succeed('test $(tr -d "\\r" < fstype) = cgroup2fs')
+    # Test machinectl stop
+    machine.succeed("machinectl stop ${containerName}");
 
-      # Test if systemd-nspawn provides a working environment for nix to build derivations
-      # https://nixos.org/guides/nix-pills/07-working-derivation
-      machine.succeed('systemd-run --pty --wait -M ${containerName} /run/current-system/sw/bin/nix-instantiate --expr \'derivation { name = "myname"; builder = "/bin/sh"; args = [ "-c" "echo foo > $out" ]; system = "${pkgs.system}"; }\' --add-root /tmp/drv')
-      machine.succeed('systemd-run --pty --wait -M ${containerName} /run/current-system/sw/bin/nix-store --option substitute false --realize /tmp/drv')
+    # Install container
+    # Workaround for nixos-install
+    machine.succeed("chmod o+rx /var/lib/machines");
+    machine.succeed("nixos-install --root ${containerRoot} --system ${containerSystem} --no-channel-copy --no-root-passwd");
 
-      # Test nss_mymachines without nscd
-      machine.succeed('LD_LIBRARY_PATH="/run/current-system/sw/lib" getent -s hosts:mymachines hosts ${containerName}');
+    # Allow systemd-nspawn to apply user namespace on immutable files
+    machine.succeed("chattr -i ${containerRoot}/var/empty");
 
-      # Test nss_mymachines via nscd
-      machine.succeed("getent hosts ${containerName}");
+    # Test machinectl start
+    machine.succeed("machinectl start ${containerName}");
+    machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
 
-      # Test systemd-nspawn network configuration to container
-      machine.succeed("networkctl --json=short status ve-${containerName} | ${pkgs.jq}/bin/jq -e '.OperationalState == \"routable\"'");
+    # Test systemd-nspawn configured unified cgroup delegation
+    # see also:
+    # https://github.com/systemd/systemd/blob/main/docs/CGROUP_DELEGATION.md#three-different-tree-setups-
+    machine.succeed('systemd-run --pty --wait -M ${containerName} /run/current-system/sw/bin/stat --format="%T" --file-system /sys/fs/cgroup > fstype')
+    machine.succeed('test $(tr -d "\\r" < fstype) = cgroup2fs')
 
-      # Test systemd-nspawn network configuration to host
-      machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/networkctl --json=short status host0 | ${pkgs.jq}/bin/jq -r '.OperationalState == \"routable\"'");
+    # Test if systemd-nspawn provides a working environment for nix to build derivations
+    # https://nixos.org/guides/nix-pills/07-working-derivation
+    machine.succeed('systemd-run --pty --wait -M ${containerName} /run/current-system/sw/bin/nix-instantiate --expr \'derivation { name = "myname"; builder = "/bin/sh"; args = [ "-c" "echo foo > $out" ]; system = "${pkgs.system}"; }\' --add-root /tmp/drv')
+    machine.succeed('systemd-run --pty --wait -M ${containerName} /run/current-system/sw/bin/nix-store --option substitute false --realize /tmp/drv')
 
-      # Test systemd-nspawn network configuration
-      machine.succeed("ping -n -c 1 ${containerName}");
+    # Test nss_mymachines without nscd
+    machine.succeed('LD_LIBRARY_PATH="/run/current-system/sw/lib" getent -s hosts:mymachines hosts ${containerName}');
 
-      # Test systemd-nspawn uses a user namespace
-      machine.succeed("test $(machinectl status ${containerName} | grep 'UID Shift: ' | wc -l) = 1")
+    # Test nss_mymachines via nscd
+    machine.succeed("getent hosts ${containerName}");
 
-      # Test systemd-nspawn reboot
-      machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/reboot");
-      machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
+    # Test systemd-nspawn network configuration to container
+    machine.succeed("networkctl --json=short status ve-${containerName} | ${pkgs.jq}/bin/jq -e '.OperationalState == \"routable\"'");
 
-      # Test machinectl reboot
-      machine.succeed("machinectl reboot ${containerName}");
-      machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
+    # Test systemd-nspawn network configuration to host
+    machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/networkctl --json=short status host0 | ${pkgs.jq}/bin/jq -r '.OperationalState == \"routable\"'");
 
-      # Restart machine
-      machine.shutdown()
-      machine.start()
-      machine.wait_for_unit("default.target");
+    # Test systemd-nspawn network configuration
+    machine.succeed("ping -n -c 1 ${containerName}");
 
-      # Test auto-start
-      machine.succeed("machinectl show ${containerName}")
+    # Test systemd-nspawn uses a user namespace
+    machine.succeed("test $(machinectl status ${containerName} | grep 'UID Shift: ' | wc -l) = 1")
 
-      # Test machinectl stop
-      machine.succeed("machinectl stop ${containerName}");
-      machine.wait_until_succeeds("test $(systemctl is-active systemd-nspawn@${containerName}) = inactive");
+    # Test systemd-nspawn reboot
+    machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/reboot");
+    machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
 
-      # Test tmpfs for /tmp
-      machine.fail("mountpoint /tmp");
+    # Test machinectl reboot
+    machine.succeed("machinectl reboot ${containerName}");
+    machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
 
-      # Show to to delete the container
-      machine.succeed("chattr -i ${containerRoot}/var/empty");
-      machine.succeed("rm -rf ${containerRoot}");
+    # Restart machine
+    machine.shutdown()
+    machine.start()
+    machine.wait_for_unit("default.target");
 
-      # Test import tarball, start, stop and remove
-      machine.succeed("machinectl import-tar ${containerTarball}/tarball/*.tar* ${containerName}");
-      machine.succeed("machinectl start ${containerName}");
-      machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
-      machine.succeed("machinectl stop ${containerName}");
-      machine.wait_until_succeeds("test $(systemctl is-active systemd-nspawn@${containerName}) = inactive");
-      machine.succeed("machinectl remove ${containerName}");
-    '';
-  }
-)
+    # Test auto-start
+    machine.succeed("machinectl show ${containerName}")
+
+    # Test machinectl stop
+    machine.succeed("machinectl stop ${containerName}");
+    machine.wait_until_succeeds("test $(systemctl is-active systemd-nspawn@${containerName}) = inactive");
+
+    # Test tmpfs for /tmp
+    machine.fail("mountpoint /tmp");
+
+    # Show to to delete the container
+    machine.succeed("chattr -i ${containerRoot}/var/empty");
+    machine.succeed("rm -rf ${containerRoot}");
+
+    # Test import tarball, start, stop and remove
+    machine.succeed("machinectl import-tar ${containerTarball}/tarball/*.tar* ${containerName}");
+    machine.succeed("machinectl start ${containerName}");
+    machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
+    machine.succeed("machinectl stop ${containerName}");
+    machine.wait_until_succeeds("test $(systemctl is-active systemd-nspawn@${containerName}) = inactive");
+    machine.succeed("machinectl remove ${containerName}");
+  '';
+}
diff --git a/nixos/tests/systemd-misc.nix b/nixos/tests/systemd-misc.nix
index 632f3f59d47b..2623f78add63 100644
--- a/nixos/tests/systemd-misc.nix
+++ b/nixos/tests/systemd-misc.nix
@@ -1,66 +1,64 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    exampleScript = pkgs.writeTextFile {
-      name = "example.sh";
-      text = ''
-        #! ${pkgs.runtimeShell} -e
+let
+  exampleScript = pkgs.writeTextFile {
+    name = "example.sh";
+    text = ''
+      #! ${pkgs.runtimeShell} -e
 
-        while true; do
-            echo "Example script running" >&2
-            ${pkgs.coreutils}/bin/sleep 1
-        done
-      '';
-      executable = true;
-    };
+      while true; do
+          echo "Example script running" >&2
+          ${pkgs.coreutils}/bin/sleep 1
+      done
+    '';
+    executable = true;
+  };
 
-    unitFile = pkgs.writeTextFile {
-      name = "example.service";
-      text = ''
-        [Unit]
-        Description=Example systemd service unit file
+  unitFile = pkgs.writeTextFile {
+    name = "example.service";
+    text = ''
+      [Unit]
+      Description=Example systemd service unit file
 
-        [Service]
-        ExecStart=${exampleScript}
+      [Service]
+      ExecStart=${exampleScript}
 
-        [Install]
-        WantedBy=multi-user.target
-      '';
-    };
-  in
-  {
-    name = "systemd-misc";
+      [Install]
+      WantedBy=multi-user.target
+    '';
+  };
+in
+{
+  name = "systemd-misc";
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
-        boot.extraSystemdUnitPaths = [ "/etc/systemd-rw/system" ];
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      boot.extraSystemdUnitPaths = [ "/etc/systemd-rw/system" ];
 
-        users.users.limited = {
-          isNormalUser = true;
-          uid = 1000;
-        };
-
-        systemd.units."user-1000.slice.d/limits.conf" = {
-          text = ''
-            [Slice]
-            TasksAccounting=yes
-            TasksMax=100
-          '';
-        };
+      users.users.limited = {
+        isNormalUser = true;
+        uid = 1000;
       };
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("mkdir -p /etc/systemd-rw/system")
-      machine.succeed(
-          "cp ${unitFile} /etc/systemd-rw/system/example.service"
-      )
-      machine.succeed("systemctl start example.service")
-      machine.succeed("systemctl status example.service | grep 'Active: active'")
+      systemd.units."user-1000.slice.d/limits.conf" = {
+        text = ''
+          [Slice]
+          TasksAccounting=yes
+          TasksMax=100
+        '';
+      };
+    };
 
-      machine.succeed("systemctl show --property TasksMax --value user-1000.slice | grep 100")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("mkdir -p /etc/systemd-rw/system")
+    machine.succeed(
+        "cp ${unitFile} /etc/systemd-rw/system/example.service"
+    )
+    machine.succeed("systemctl start example.service")
+    machine.succeed("systemctl status example.service | grep 'Active: active'")
+
+    machine.succeed("systemctl show --property TasksMax --value user-1000.slice | grep 100")
+  '';
+}
diff --git a/nixos/tests/systemd-networkd-bridge.nix b/nixos/tests/systemd-networkd-bridge.nix
index ec0547ce5cc4..80f2670209c7 100644
--- a/nixos/tests/systemd-networkd-bridge.nix
+++ b/nixos/tests/systemd-networkd-bridge.nix
@@ -89,57 +89,55 @@ let
       };
     };
 in
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "networkd";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ picnoir ];
+{ pkgs, ... }:
+{
+  name = "networkd";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ picnoir ];
+  };
+  nodes = {
+    node1 = generateNodeConf {
+      octet = 1;
+      vlan = 1;
     };
-    nodes = {
-      node1 = generateNodeConf {
-        octet = 1;
-        vlan = 1;
-      };
-      node2 = generateNodeConf {
-        octet = 2;
-        vlan = 3;
-      };
-      node3 = generateNodeConf {
-        octet = 3;
-        vlan = 6;
-      };
-      sw1 = generateSwitchConf [
-        1
-        2
-        4
-      ];
-      sw2 = generateSwitchConf [
-        2
-        3
-        5
-      ];
-      sw3 = generateSwitchConf [
-        4
-        5
-        6
-      ];
+    node2 = generateNodeConf {
+      octet = 2;
+      vlan = 3;
     };
-    testScript = ''
-      network_nodes = [node1, node2, node3]
-      network_switches = [sw1, sw2, sw3]
-      start_all()
+    node3 = generateNodeConf {
+      octet = 3;
+      vlan = 6;
+    };
+    sw1 = generateSwitchConf [
+      1
+      2
+      4
+    ];
+    sw2 = generateSwitchConf [
+      2
+      3
+      5
+    ];
+    sw3 = generateSwitchConf [
+      4
+      5
+      6
+    ];
+  };
+  testScript = ''
+    network_nodes = [node1, node2, node3]
+    network_switches = [sw1, sw2, sw3]
+    start_all()
 
-      for n in network_nodes + network_switches:
-          n.systemctl("start systemd-networkd-wait-online.service")
-          n.wait_for_unit("systemd-networkd-wait-online.service")
+    for n in network_nodes + network_switches:
+        n.systemctl("start systemd-networkd-wait-online.service")
+        n.wait_for_unit("systemd-networkd-wait-online.service")
 
-      node1.succeed("ping 10.0.0.2 -w 10 -c 1")
-      node1.succeed("ping 10.0.0.3 -w 10 -c 1")
-      node2.succeed("ping 10.0.0.1 -w 10 -c 1")
-      node2.succeed("ping 10.0.0.3 -w 10 -c 1")
-      node3.succeed("ping 10.0.0.1 -w 10 -c 1")
-      node3.succeed("ping 10.0.0.2 -w 10 -c 1")
-    '';
-  }
-)
+    node1.succeed("ping 10.0.0.2 -w 10 -c 1")
+    node1.succeed("ping 10.0.0.3 -w 10 -c 1")
+    node2.succeed("ping 10.0.0.1 -w 10 -c 1")
+    node2.succeed("ping 10.0.0.3 -w 10 -c 1")
+    node3.succeed("ping 10.0.0.1 -w 10 -c 1")
+    node3.succeed("ping 10.0.0.2 -w 10 -c 1")
+  '';
+}
diff --git a/nixos/tests/systemd-networkd-dhcpserver.nix b/nixos/tests/systemd-networkd-dhcpserver.nix
index 59cc2cfd5245..ae3ec181654b 100644
--- a/nixos/tests/systemd-networkd-dhcpserver.nix
+++ b/nixos/tests/systemd-networkd-dhcpserver.nix
@@ -7,121 +7,119 @@
 # br0 ----untagged---v
 #                    +---PVID 1+VLAN 2---[bridge]---PVID 2---eth1
 # vlan2 ---VLAN 2----^
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "systemd-networkd-dhcpserver";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
-    };
-    nodes = {
-      router =
-        { config, pkgs, ... }:
-        {
-          virtualisation.vlans = [ 1 ];
-          systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
-          networking = {
-            useNetworkd = true;
-            useDHCP = false;
-            firewall.enable = false;
-          };
-          systemd.network = {
-            netdevs = {
-              br0 = {
-                enable = true;
-                netdevConfig = {
-                  Name = "br0";
-                  Kind = "bridge";
-                };
-                extraConfig = ''
-                  [Bridge]
-                  VLANFiltering=yes
-                  DefaultPVID=none
-                '';
-              };
-              vlan2 = {
-                enable = true;
-                netdevConfig = {
-                  Name = "vlan2";
-                  Kind = "vlan";
-                };
-                vlanConfig.Id = 2;
+{ pkgs, ... }:
+{
+  name = "systemd-networkd-dhcpserver";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
+  nodes = {
+    router =
+      { config, pkgs, ... }:
+      {
+        virtualisation.vlans = [ 1 ];
+        systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+          firewall.enable = false;
+        };
+        systemd.network = {
+          netdevs = {
+            br0 = {
+              enable = true;
+              netdevConfig = {
+                Name = "br0";
+                Kind = "bridge";
               };
+              extraConfig = ''
+                [Bridge]
+                VLANFiltering=yes
+                DefaultPVID=none
+              '';
             };
-            networks = {
-              # systemd-networkd will load the first network unit file
-              # that matches, ordered lexiographically by filename.
-              # /etc/systemd/network/{40-eth1,99-main}.network already
-              # exists. This network unit must be loaded for the test,
-              # however, hence why this network is named such.
-              "01-eth1" = {
-                name = "eth1";
-                networkConfig.Bridge = "br0";
-                bridgeVLANs = [
-                  {
-                    PVID = 2;
-                    EgressUntagged = 2;
-                  }
-                ];
+            vlan2 = {
+              enable = true;
+              netdevConfig = {
+                Name = "vlan2";
+                Kind = "vlan";
               };
-              "02-br0" = {
-                name = "br0";
-                networkConfig = {
-                  DHCPServer = true;
-                  Address = "10.0.0.1/24";
-                  VLAN = [ "vlan2" ];
-                };
-                dhcpServerConfig = {
-                  PoolOffset = 100;
-                  PoolSize = 1;
-                };
-                bridgeVLANs = [
-                  {
-                    PVID = 1;
-                    EgressUntagged = 1;
-                  }
-                  { VLAN = 2; }
-                ];
+              vlanConfig.Id = 2;
+            };
+          };
+          networks = {
+            # systemd-networkd will load the first network unit file
+            # that matches, ordered lexiographically by filename.
+            # /etc/systemd/network/{40-eth1,99-main}.network already
+            # exists. This network unit must be loaded for the test,
+            # however, hence why this network is named such.
+            "01-eth1" = {
+              name = "eth1";
+              networkConfig.Bridge = "br0";
+              bridgeVLANs = [
+                {
+                  PVID = 2;
+                  EgressUntagged = 2;
+                }
+              ];
+            };
+            "02-br0" = {
+              name = "br0";
+              networkConfig = {
+                DHCPServer = true;
+                Address = "10.0.0.1/24";
+                VLAN = [ "vlan2" ];
               };
-              "02-vlan2" = {
-                name = "vlan2";
-                networkConfig = {
-                  DHCPServer = true;
-                  Address = "10.0.2.1/24";
-                };
-                dhcpServerConfig = {
-                  PoolOffset = 100;
-                  PoolSize = 1;
-                };
+              dhcpServerConfig = {
+                PoolOffset = 100;
+                PoolSize = 1;
+              };
+              bridgeVLANs = [
+                {
+                  PVID = 1;
+                  EgressUntagged = 1;
+                }
+                { VLAN = 2; }
+              ];
+            };
+            "02-vlan2" = {
+              name = "vlan2";
+              networkConfig = {
+                DHCPServer = true;
+                Address = "10.0.2.1/24";
+              };
+              dhcpServerConfig = {
+                PoolOffset = 100;
+                PoolSize = 1;
               };
             };
           };
         };
+      };
 
-      client =
-        { config, pkgs, ... }:
-        {
-          virtualisation.vlans = [ 1 ];
-          systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
-          networking = {
-            useNetworkd = true;
-            useDHCP = false;
-            firewall.enable = false;
-            interfaces.eth1.useDHCP = true;
-          };
+    client =
+      { config, pkgs, ... }:
+      {
+        virtualisation.vlans = [ 1 ];
+        systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+          firewall.enable = false;
+          interfaces.eth1.useDHCP = true;
         };
-    };
-    testScript =
-      { ... }:
-      ''
-        start_all()
+      };
+  };
+  testScript =
+    { ... }:
+    ''
+      start_all()
 
-        router.systemctl("start network-online.target")
-        client.systemctl("start network-online.target")
-        router.wait_for_unit("systemd-networkd-wait-online.service")
-        client.wait_for_unit("systemd-networkd-wait-online.service")
-        client.wait_until_succeeds("ping -c 5 10.0.2.1")
-        router.wait_until_succeeds("ping -c 5 10.0.2.100")
-      '';
-  }
-)
+      router.systemctl("start network-online.target")
+      client.systemctl("start network-online.target")
+      router.wait_for_unit("systemd-networkd-wait-online.service")
+      client.wait_for_unit("systemd-networkd-wait-online.service")
+      client.wait_until_succeeds("ping -c 5 10.0.2.1")
+      router.wait_until_succeeds("ping -c 5 10.0.2.100")
+    '';
+}
diff --git a/nixos/tests/systemd-networkd-vrf.nix b/nixos/tests/systemd-networkd-vrf.nix
index 357431fc297a..05225e457c1b 100644
--- a/nixos/tests/systemd-networkd-vrf.nix
+++ b/nixos/tests/systemd-networkd-vrf.nix
@@ -1,202 +1,200 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+{ pkgs, lib, ... }:
+let
+  inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
 
-    mkNode = vlan: id: {
-      virtualisation.vlans = [ vlan ];
-      networking = {
-        useDHCP = false;
-        useNetworkd = true;
-      };
+  mkNode = vlan: id: {
+    virtualisation.vlans = [ vlan ];
+    networking = {
+      useDHCP = false;
+      useNetworkd = true;
+    };
 
-      systemd.network = {
-        enable = true;
+    systemd.network = {
+      enable = true;
 
-        networks."10-eth${toString vlan}" = {
-          matchConfig.Name = "eth${toString vlan}";
-          linkConfig.RequiredForOnline = "no";
-          networkConfig = {
-            Address = "192.168.${toString vlan}.${toString id}/24";
-            IPv4Forwarding = "yes";
-            IPv6Forwarding = "yes";
-          };
+      networks."10-eth${toString vlan}" = {
+        matchConfig.Name = "eth${toString vlan}";
+        linkConfig.RequiredForOnline = "no";
+        networkConfig = {
+          Address = "192.168.${toString vlan}.${toString id}/24";
+          IPv4Forwarding = "yes";
+          IPv6Forwarding = "yes";
         };
       };
     };
-  in
-  {
-    name = "systemd-networkd-vrf";
-    meta.maintainers = with lib.maintainers; [ ma27 ];
+  };
+in
+{
+  name = "systemd-networkd-vrf";
+  meta.maintainers = with lib.maintainers; [ ma27 ];
 
-    nodes = {
-      client =
-        { pkgs, ... }:
-        {
-          virtualisation.vlans = [
-            1
-            2
-          ];
+  nodes = {
+    client =
+      { pkgs, ... }:
+      {
+        virtualisation.vlans = [
+          1
+          2
+        ];
 
-          networking = {
-            useDHCP = false;
-            useNetworkd = true;
-            firewall.checkReversePath = "loose";
+        networking = {
+          useDHCP = false;
+          useNetworkd = true;
+          firewall.checkReversePath = "loose";
+        };
+
+        systemd.network = {
+          enable = true;
+
+          netdevs."10-vrf1" = {
+            netdevConfig = {
+              Kind = "vrf";
+              Name = "vrf1";
+              MTUBytes = "1300";
+            };
+            vrfConfig.Table = 23;
+          };
+          netdevs."10-vrf2" = {
+            netdevConfig = {
+              Kind = "vrf";
+              Name = "vrf2";
+              MTUBytes = "1300";
+            };
+            vrfConfig.Table = 42;
           };
 
-          systemd.network = {
-            enable = true;
+          networks."10-vrf1" = {
+            matchConfig.Name = "vrf1";
+            networkConfig.IPv4Forwarding = "yes";
+            networkConfig.IPv6Forwarding = "yes";
+            routes = [
+              {
+                Destination = "192.168.1.2";
+                Metric = 100;
+              }
+            ];
+          };
+          networks."10-vrf2" = {
+            matchConfig.Name = "vrf2";
+            networkConfig.IPv4Forwarding = "yes";
+            networkConfig.IPv6Forwarding = "yes";
+            routes = [
+              {
+                Destination = "192.168.2.3";
+                Metric = 100;
+              }
+            ];
+          };
 
-            netdevs."10-vrf1" = {
-              netdevConfig = {
-                Kind = "vrf";
-                Name = "vrf1";
-                MTUBytes = "1300";
-              };
-              vrfConfig.Table = 23;
+          networks."10-eth1" = {
+            matchConfig.Name = "eth1";
+            linkConfig.RequiredForOnline = "no";
+            networkConfig = {
+              VRF = "vrf1";
+              Address = "192.168.1.1/24";
+              IPv4Forwarding = "yes";
+              IPv6Forwarding = "yes";
             };
-            netdevs."10-vrf2" = {
-              netdevConfig = {
-                Kind = "vrf";
-                Name = "vrf2";
-                MTUBytes = "1300";
-              };
-              vrfConfig.Table = 42;
-            };
-
-            networks."10-vrf1" = {
-              matchConfig.Name = "vrf1";
-              networkConfig.IPv4Forwarding = "yes";
-              networkConfig.IPv6Forwarding = "yes";
-              routes = [
-                {
-                  Destination = "192.168.1.2";
-                  Metric = 100;
-                }
-              ];
-            };
-            networks."10-vrf2" = {
-              matchConfig.Name = "vrf2";
-              networkConfig.IPv4Forwarding = "yes";
-              networkConfig.IPv6Forwarding = "yes";
-              routes = [
-                {
-                  Destination = "192.168.2.3";
-                  Metric = 100;
-                }
-              ];
-            };
-
-            networks."10-eth1" = {
-              matchConfig.Name = "eth1";
-              linkConfig.RequiredForOnline = "no";
-              networkConfig = {
-                VRF = "vrf1";
-                Address = "192.168.1.1/24";
-                IPv4Forwarding = "yes";
-                IPv6Forwarding = "yes";
-              };
-            };
-            networks."10-eth2" = {
-              matchConfig.Name = "eth2";
-              linkConfig.RequiredForOnline = "no";
-              networkConfig = {
-                VRF = "vrf2";
-                Address = "192.168.2.1/24";
-                IPv4Forwarding = "yes";
-                IPv6Forwarding = "yes";
-              };
+          };
+          networks."10-eth2" = {
+            matchConfig.Name = "eth2";
+            linkConfig.RequiredForOnline = "no";
+            networkConfig = {
+              VRF = "vrf2";
+              Address = "192.168.2.1/24";
+              IPv4Forwarding = "yes";
+              IPv6Forwarding = "yes";
             };
           };
         };
+      };
 
-      node1 = lib.mkMerge [
-        (mkNode 1 2)
-        {
-          services.openssh.enable = true;
-          users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
-        }
-      ];
+    node1 = lib.mkMerge [
+      (mkNode 1 2)
+      {
+        services.openssh.enable = true;
+        users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+      }
+    ];
 
-      node2 = mkNode 2 3;
-      node3 = mkNode 2 4;
-    };
+    node2 = mkNode 2 3;
+    node3 = mkNode 2 4;
+  };
 
-    testScript = ''
-      import json
+  testScript = ''
+    import json
 
-      def compare(raw_json, to_compare):
-          data = json.loads(raw_json)
-          assert len(raw_json) >= len(to_compare)
-          for i, row in enumerate(to_compare):
-              actual = data[i]
-              assert len(row.keys()) > 0
-              for key, value in row.items():
-                  assert value == actual[key], f"""
-                    In entry {i}, value {key}: got: {actual[key]}, expected {value}
-                  """
+    def compare(raw_json, to_compare):
+        data = json.loads(raw_json)
+        assert len(raw_json) >= len(to_compare)
+        for i, row in enumerate(to_compare):
+            actual = data[i]
+            assert len(row.keys()) > 0
+            for key, value in row.items():
+                assert value == actual[key], f"""
+                  In entry {i}, value {key}: got: {actual[key]}, expected {value}
+                """
 
 
-      start_all()
+    start_all()
 
-      client.wait_for_unit("network.target")
-      node1.wait_for_unit("network.target")
-      node2.wait_for_unit("network.target")
-      node3.wait_for_unit("network.target")
+    client.wait_for_unit("network.target")
+    node1.wait_for_unit("network.target")
+    node2.wait_for_unit("network.target")
+    node3.wait_for_unit("network.target")
 
-      # Check that networkd properly configures the main routing table
-      # and the routing tables for the VRF.
-      with subtest("check vrf routing tables"):
-          compare(
-              client.succeed("ip --json -4 route list"),
-              [
-                  {"dst": "192.168.1.2", "dev": "vrf1", "metric": 100},
-                  {"dst": "192.168.2.3", "dev": "vrf2", "metric": 100}
-              ]
-          )
-          compare(
-              client.succeed("ip --json -4 route list table 23"),
-              [
-                  {"dst": "192.168.1.0/24", "dev": "eth1", "prefsrc": "192.168.1.1"},
-                  {"type": "local", "dst": "192.168.1.1", "dev": "eth1", "prefsrc": "192.168.1.1"},
-                  {"type": "broadcast", "dev": "eth1", "prefsrc": "192.168.1.1", "dst": "192.168.1.255"}
-              ]
-          )
-          compare(
-              client.succeed("ip --json -4 route list table 42"),
-              [
-                  {"dst": "192.168.2.0/24", "dev": "eth2", "prefsrc": "192.168.2.1"},
-                  {"type": "local", "dst": "192.168.2.1", "dev": "eth2", "prefsrc": "192.168.2.1"},
-                  {"type": "broadcast", "dev": "eth2", "prefsrc": "192.168.2.1", "dst": "192.168.2.255"}
-              ]
-          )
+    # Check that networkd properly configures the main routing table
+    # and the routing tables for the VRF.
+    with subtest("check vrf routing tables"):
+        compare(
+            client.succeed("ip --json -4 route list"),
+            [
+                {"dst": "192.168.1.2", "dev": "vrf1", "metric": 100},
+                {"dst": "192.168.2.3", "dev": "vrf2", "metric": 100}
+            ]
+        )
+        compare(
+            client.succeed("ip --json -4 route list table 23"),
+            [
+                {"dst": "192.168.1.0/24", "dev": "eth1", "prefsrc": "192.168.1.1"},
+                {"type": "local", "dst": "192.168.1.1", "dev": "eth1", "prefsrc": "192.168.1.1"},
+                {"type": "broadcast", "dev": "eth1", "prefsrc": "192.168.1.1", "dst": "192.168.1.255"}
+            ]
+        )
+        compare(
+            client.succeed("ip --json -4 route list table 42"),
+            [
+                {"dst": "192.168.2.0/24", "dev": "eth2", "prefsrc": "192.168.2.1"},
+                {"type": "local", "dst": "192.168.2.1", "dev": "eth2", "prefsrc": "192.168.2.1"},
+                {"type": "broadcast", "dev": "eth2", "prefsrc": "192.168.2.1", "dst": "192.168.2.255"}
+            ]
+        )
 
-      # Ensure that other nodes are reachable via ICMP through the VRF.
-      with subtest("icmp through vrf works"):
-          client.succeed("ping -c5 192.168.1.2")
-          client.succeed("ping -c5 192.168.2.3")
+    # Ensure that other nodes are reachable via ICMP through the VRF.
+    with subtest("icmp through vrf works"):
+        client.succeed("ping -c5 192.168.1.2")
+        client.succeed("ping -c5 192.168.2.3")
 
-      # Test whether TCP through a VRF IP is possible.
-      with subtest("tcp traffic through vrf works"):
-          node1.wait_for_open_port(22)
-          client.succeed(
-              "cat ${snakeOilPrivateKey} > privkey.snakeoil"
-          )
-          client.succeed("chmod 600 privkey.snakeoil")
-          client.succeed(
-              "ulimit -l 2048; ip vrf exec vrf1 ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.1.2 true"
-          )
+    # Test whether TCP through a VRF IP is possible.
+    with subtest("tcp traffic through vrf works"):
+        node1.wait_for_open_port(22)
+        client.succeed(
+            "cat ${snakeOilPrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ulimit -l 2048; ip vrf exec vrf1 ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.1.2 true"
+        )
 
-      # Only configured routes through the VRF from the main routing table should
-      # work. Additional IPs are only reachable when binding to the vrf interface.
-      with subtest("only routes from main routing table work by default"):
-          client.fail("ping -c5 192.168.2.4")
-          client.succeed("ping -I vrf2 -c5 192.168.2.4")
+    # Only configured routes through the VRF from the main routing table should
+    # work. Additional IPs are only reachable when binding to the vrf interface.
+    with subtest("only routes from main routing table work by default"):
+        client.fail("ping -c5 192.168.2.4")
+        client.succeed("ping -I vrf2 -c5 192.168.2.4")
 
-      client.shutdown()
-      node1.shutdown()
-      node2.shutdown()
-      node3.shutdown()
-    '';
-  }
-)
+    client.shutdown()
+    node1.shutdown()
+    node2.shutdown()
+    node3.shutdown()
+  '';
+}
diff --git a/nixos/tests/systemd-networkd.nix b/nixos/tests/systemd-networkd.nix
index 7bde032871d5..940192b1ad7f 100644
--- a/nixos/tests/systemd-networkd.nix
+++ b/nixos/tests/systemd-networkd.nix
@@ -125,83 +125,81 @@ let
       };
     };
 in
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "networkd";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ picnoir ];
-    };
-    nodes = {
-      node1 =
-        { pkgs, ... }@attrs:
-        let
-          localConf = {
-            privk = "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
-            pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
-            systemdCreds = false;
-            nodeId = "1";
-            peerId = "2";
-          };
-        in
-        generateNodeConf (attrs // localConf);
+{ pkgs, ... }:
+{
+  name = "networkd";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ picnoir ];
+  };
+  nodes = {
+    node1 =
+      { pkgs, ... }@attrs:
+      let
+        localConf = {
+          privk = "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
+          pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
+          systemdCreds = false;
+          nodeId = "1";
+          peerId = "2";
+        };
+      in
+      generateNodeConf (attrs // localConf);
 
-      node2 =
-        { pkgs, ... }@attrs:
-        let
-          localConf = {
-            privk = "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
-            pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
-            systemdCreds = true;
-            nodeId = "2";
-            peerId = "1";
-          };
-        in
-        generateNodeConf (attrs // localConf);
-    };
-    testScript = ''
-      start_all()
-      node1.systemctl("start systemd-networkd-wait-online@eth1.service")
-      node1.systemctl("start systemd-networkd-wait-online.service")
-      node1.wait_for_unit("systemd-networkd-wait-online@eth1.service")
-      node1.wait_for_unit("systemd-networkd-wait-online.service")
-      node2.systemctl("start systemd-networkd-wait-online@eth1.service")
-      node2.systemctl("start systemd-networkd-wait-online.service")
-      node2.wait_for_unit("systemd-networkd-wait-online@eth1.service")
-      node2.wait_for_unit("systemd-networkd-wait-online.service")
+    node2 =
+      { pkgs, ... }@attrs:
+      let
+        localConf = {
+          privk = "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
+          pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
+          systemdCreds = true;
+          nodeId = "2";
+          peerId = "1";
+        };
+      in
+      generateNodeConf (attrs // localConf);
+  };
+  testScript = ''
+    start_all()
+    node1.systemctl("start systemd-networkd-wait-online@eth1.service")
+    node1.systemctl("start systemd-networkd-wait-online.service")
+    node1.wait_for_unit("systemd-networkd-wait-online@eth1.service")
+    node1.wait_for_unit("systemd-networkd-wait-online.service")
+    node2.systemctl("start systemd-networkd-wait-online@eth1.service")
+    node2.systemctl("start systemd-networkd-wait-online.service")
+    node2.wait_for_unit("systemd-networkd-wait-online@eth1.service")
+    node2.wait_for_unit("systemd-networkd-wait-online.service")
 
-      # ================================
-      # Networkd Config
-      # ================================
-      node1.succeed("grep RouteTable=custom:23 /etc/systemd/networkd.conf")
-      node1.succeed("sudo ip route show table custom | grep '10.0.0.0/24 via 10.0.0.1 dev wg0 proto static'")
+    # ================================
+    # Networkd Config
+    # ================================
+    node1.succeed("grep RouteTable=custom:23 /etc/systemd/networkd.conf")
+    node1.succeed("sudo ip route show table custom | grep '10.0.0.0/24 via 10.0.0.1 dev wg0 proto static'")
 
-      # ================================
-      # Wireguard
-      # ================================
-      node1.succeed("ping -c 5 10.0.0.2")
-      node2.succeed("ping -c 5 10.0.0.1")
-      # Is the fwmark set?
-      node2.succeed("wg | grep -q 42")
+    # ================================
+    # Wireguard
+    # ================================
+    node1.succeed("ping -c 5 10.0.0.2")
+    node2.succeed("ping -c 5 10.0.0.1")
+    # Is the fwmark set?
+    node2.succeed("wg | grep -q 42")
 
-      # ================================
-      # Routing Policies
-      # ================================
-      # Testing all the routingPolicyRuleConfig members:
-      # Table + IncomingInterface
-      node1.succeed("sudo ip rule | grep 'from all iif eth1 lookup 10'")
-      # OutgoingInterface
-      node1.succeed("sudo ip rule | grep 'from all oif eth1 lookup 20'")
-      # From + To + SourcePort + DestinationPort
-      node1.succeed(
-          "sudo ip rule | grep 'from 192.168.1.1 to 192.168.1.2 sport 666 dport 667 lookup 30'"
-      )
-      # IPProtocol + InvertRule
-      node1.succeed("sudo ip rule | grep 'not from all ipproto tcp lookup 40'")
-      # FirewallMark without a mask
-      node1.succeed("sudo ip rule | grep 'from all fwmark 0x4 lookup 60'")
-      # FirewallMark with a mask
-      node1.succeed("sudo ip rule | grep 'from all fwmark 0x10/0x1f lookup 70'")
-    '';
-  }
-)
+    # ================================
+    # Routing Policies
+    # ================================
+    # Testing all the routingPolicyRuleConfig members:
+    # Table + IncomingInterface
+    node1.succeed("sudo ip rule | grep 'from all iif eth1 lookup 10'")
+    # OutgoingInterface
+    node1.succeed("sudo ip rule | grep 'from all oif eth1 lookup 20'")
+    # From + To + SourcePort + DestinationPort
+    node1.succeed(
+        "sudo ip rule | grep 'from 192.168.1.1 to 192.168.1.2 sport 666 dport 667 lookup 30'"
+    )
+    # IPProtocol + InvertRule
+    node1.succeed("sudo ip rule | grep 'not from all ipproto tcp lookup 40'")
+    # FirewallMark without a mask
+    node1.succeed("sudo ip rule | grep 'from all fwmark 0x4 lookup 60'")
+    # FirewallMark with a mask
+    node1.succeed("sudo ip rule | grep 'from all fwmark 0x10/0x1f lookup 70'")
+  '';
+}
diff --git a/nixos/tests/systemd-no-tainted.nix b/nixos/tests/systemd-no-tainted.nix
index 12b68868415c..8b3059345181 100644
--- a/nixos/tests/systemd-no-tainted.nix
+++ b/nixos/tests/systemd-no-tainted.nix
@@ -1,17 +1,15 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "systemd-no-tainted";
+{ pkgs, ... }:
+{
+  name = "systemd-no-tainted";
 
-    nodes.machine = { };
+  nodes.machine = { };
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-      with subtest("systemctl should not report tainted with unmerged-usr"):
-          output = machine.succeed("systemctl status")
-          print(output)
-          assert "Tainted" not in output
-          assert "unmerged-usr" not in output
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    with subtest("systemctl should not report tainted with unmerged-usr"):
+        output = machine.succeed("systemctl status")
+        print(output)
+        assert "Tainted" not in output
+        assert "unmerged-usr" not in output
+  '';
+}
diff --git a/nixos/tests/systemd-nspawn-configfile.nix b/nixos/tests/systemd-nspawn-configfile.nix
index 8dd0260d2aee..d8b9e714a858 100644
--- a/nixos/tests/systemd-nspawn-configfile.nix
+++ b/nixos/tests/systemd-nspawn-configfile.nix
@@ -1,133 +1,131 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  let
-    execOptions = [
-      "Boot"
-      "ProcessTwo"
-      "Parameters"
-      "Environment"
-      "User"
-      "WorkingDirectory"
-      "PivotRoot"
-      "Capability"
-      "DropCapability"
-      "NoNewPrivileges"
-      "KillSignal"
-      "Personality"
-      "MachineID"
-      "PrivateUsers"
-      "NotifyReady"
-      "SystemCallFilter"
-      "LimitCPU"
-      "LimitFSIZE"
-      "LimitDATA"
-      "LimitSTACK"
-      "LimitCORE"
-      "LimitRSS"
-      "LimitNOFILE"
-      "LimitAS"
-      "LimitNPROC"
-      "LimitMEMLOCK"
-      "LimitLOCKS"
-      "LimitSIGPENDING"
-      "LimitMSGQUEUE"
-      "LimitNICE"
-      "LimitRTPRIO"
-      "LimitRTTIME"
-      "OOMScoreAdjust"
-      "CPUAffinity"
-      "Hostname"
-      "ResolvConf"
-      "Timezone"
-      "LinkJournal"
-      "Ephemeral"
-      "AmbientCapability"
-    ];
+{ lib, ... }:
+let
+  execOptions = [
+    "Boot"
+    "ProcessTwo"
+    "Parameters"
+    "Environment"
+    "User"
+    "WorkingDirectory"
+    "PivotRoot"
+    "Capability"
+    "DropCapability"
+    "NoNewPrivileges"
+    "KillSignal"
+    "Personality"
+    "MachineID"
+    "PrivateUsers"
+    "NotifyReady"
+    "SystemCallFilter"
+    "LimitCPU"
+    "LimitFSIZE"
+    "LimitDATA"
+    "LimitSTACK"
+    "LimitCORE"
+    "LimitRSS"
+    "LimitNOFILE"
+    "LimitAS"
+    "LimitNPROC"
+    "LimitMEMLOCK"
+    "LimitLOCKS"
+    "LimitSIGPENDING"
+    "LimitMSGQUEUE"
+    "LimitNICE"
+    "LimitRTPRIO"
+    "LimitRTTIME"
+    "OOMScoreAdjust"
+    "CPUAffinity"
+    "Hostname"
+    "ResolvConf"
+    "Timezone"
+    "LinkJournal"
+    "Ephemeral"
+    "AmbientCapability"
+  ];
 
-    filesOptions = [
-      "ReadOnly"
-      "Volatile"
-      "Bind"
-      "BindReadOnly"
-      "TemporaryFileSystem"
-      "Overlay"
-      "OverlayReadOnly"
-      "PrivateUsersChown"
-      "BindUser"
-      "Inaccessible"
-      "PrivateUsersOwnership"
-    ];
+  filesOptions = [
+    "ReadOnly"
+    "Volatile"
+    "Bind"
+    "BindReadOnly"
+    "TemporaryFileSystem"
+    "Overlay"
+    "OverlayReadOnly"
+    "PrivateUsersChown"
+    "BindUser"
+    "Inaccessible"
+    "PrivateUsersOwnership"
+  ];
 
-    networkOptions = [
-      "Private"
-      "VirtualEthernet"
-      "VirtualEthernetExtra"
-      "Interface"
-      "MACVLAN"
-      "IPVLAN"
-      "Bridge"
-      "Zone"
-      "Port"
-    ];
+  networkOptions = [
+    "Private"
+    "VirtualEthernet"
+    "VirtualEthernetExtra"
+    "Interface"
+    "MACVLAN"
+    "IPVLAN"
+    "Bridge"
+    "Zone"
+    "Port"
+  ];
 
-    optionsToConfig = opts: builtins.listToAttrs (map (n: lib.nameValuePair n "testdata") opts);
+  optionsToConfig = opts: builtins.listToAttrs (map (n: lib.nameValuePair n "testdata") opts);
 
-    grepForOptions = opts: ''
-      node.succeed(
-          "for o in ${builtins.concatStringsSep " " opts} ; do grep --quiet $o ${configFile} || exit 1 ; done"
-        )'';
+  grepForOptions = opts: ''
+    node.succeed(
+        "for o in ${builtins.concatStringsSep " " opts} ; do grep --quiet $o ${configFile} || exit 1 ; done"
+      )'';
 
-    unitName = "options-test";
-    configFile = "/etc/systemd/nspawn/${unitName}.nspawn";
+  unitName = "options-test";
+  configFile = "/etc/systemd/nspawn/${unitName}.nspawn";
 
-  in
-  {
-    name = "systemd-nspawn-configfile";
+in
+{
+  name = "systemd-nspawn-configfile";
 
-    nodes = {
-      node =
-        { pkgs, ... }:
-        {
-          systemd.nspawn."${unitName}" = {
-            enable = true;
+  nodes = {
+    node =
+      { pkgs, ... }:
+      {
+        systemd.nspawn."${unitName}" = {
+          enable = true;
 
-            execConfig = optionsToConfig execOptions // {
-              Boot = true;
-              ProcessTwo = true;
-              NotifyReady = true;
-            };
+          execConfig = optionsToConfig execOptions // {
+            Boot = true;
+            ProcessTwo = true;
+            NotifyReady = true;
+          };
 
-            filesConfig = optionsToConfig filesOptions // {
-              ReadOnly = true;
-              Volatile = "state";
-              PrivateUsersChown = true;
-              PrivateUsersOwnership = "auto";
-            };
+          filesConfig = optionsToConfig filesOptions // {
+            ReadOnly = true;
+            Volatile = "state";
+            PrivateUsersChown = true;
+            PrivateUsersOwnership = "auto";
+          };
 
-            networkConfig = optionsToConfig networkOptions // {
-              Private = true;
-              VirtualEthernet = true;
-            };
+          networkConfig = optionsToConfig networkOptions // {
+            Private = true;
+            VirtualEthernet = true;
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      node.wait_for_file("${configFile}")
+    node.wait_for_file("${configFile}")
 
-      with subtest("Test for presence of all specified options in config file"):
-        ${grepForOptions execOptions}
-        ${grepForOptions filesOptions}
-        ${grepForOptions networkOptions}
+    with subtest("Test for presence of all specified options in config file"):
+      ${grepForOptions execOptions}
+      ${grepForOptions filesOptions}
+      ${grepForOptions networkOptions}
 
-      with subtest("Test for absence of misspelled option 'MachineId' (instead of 'MachineID')"):
-        node.fail("grep --quiet MachineId ${configFile}")
-    '';
+    with subtest("Test for absence of misspelled option 'MachineId' (instead of 'MachineID')"):
+      node.fail("grep --quiet MachineId ${configFile}")
+  '';
 
-    meta.maintainers = [
-      lib.maintainers.zi3m5f
-    ];
-  }
-)
+  meta.maintainers = [
+    lib.maintainers.zi3m5f
+  ];
+}
diff --git a/nixos/tests/systemd-nspawn.nix b/nixos/tests/systemd-nspawn.nix
index feda47bf34ef..d54f3d8b5b31 100644
--- a/nixos/tests/systemd-nspawn.nix
+++ b/nixos/tests/systemd-nspawn.nix
@@ -1,68 +1,66 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    gpgKeyring = import ./common/gpg-keyring.nix { inherit pkgs; };
+{ pkgs, lib, ... }:
+let
+  gpgKeyring = import ./common/gpg-keyring.nix { inherit pkgs; };
 
-    nspawnImages = (
-      pkgs.runCommand "localhost"
-        {
-          buildInputs = [
-            pkgs.coreutils
-            pkgs.gnupg
-          ];
-        }
-        ''
-          mkdir -p $out
-          cd $out
+  nspawnImages = (
+    pkgs.runCommand "localhost"
+      {
+        buildInputs = [
+          pkgs.coreutils
+          pkgs.gnupg
+        ];
+      }
+      ''
+        mkdir -p $out
+        cd $out
 
-          # produce a testimage.raw
-          dd if=/dev/urandom of=$out/testimage.raw bs=$((1024*1024+7)) count=5
+        # produce a testimage.raw
+        dd if=/dev/urandom of=$out/testimage.raw bs=$((1024*1024+7)) count=5
 
-          # produce a testimage2.tar.xz, containing the hello store path
-          tar cvJpf testimage2.tar.xz ${pkgs.hello}
+        # produce a testimage2.tar.xz, containing the hello store path
+        tar cvJpf testimage2.tar.xz ${pkgs.hello}
 
-          # produce signature(s)
-          sha256sum testimage* > SHA256SUMS
-          export GNUPGHOME="$(mktemp -d)"
-          cp -R ${gpgKeyring}/* $GNUPGHOME
-          gpg --batch --sign --detach-sign --output SHA256SUMS.gpg SHA256SUMS
-        ''
-    );
-  in
-  {
-    name = "systemd-nspawn";
+        # produce signature(s)
+        sha256sum testimage* > SHA256SUMS
+        export GNUPGHOME="$(mktemp -d)"
+        cp -R ${gpgKeyring}/* $GNUPGHOME
+        gpg --batch --sign --detach-sign --output SHA256SUMS.gpg SHA256SUMS
+      ''
+  );
+in
+{
+  name = "systemd-nspawn";
 
-    nodes = {
-      server =
-        { pkgs, ... }:
-        {
-          networking.firewall.allowedTCPPorts = [ 80 ];
-          services.nginx = {
-            enable = true;
-            virtualHosts."server".root = nspawnImages;
-          };
+  nodes = {
+    server =
+      { pkgs, ... }:
+      {
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        services.nginx = {
+          enable = true;
+          virtualHosts."server".root = nspawnImages;
         };
-      client =
-        { pkgs, ... }:
-        {
-          environment.etc."systemd/import-pubring.gpg".source = "${gpgKeyring}/pubkey.gpg";
-        };
-    };
+      };
+    client =
+      { pkgs, ... }:
+      {
+        environment.etc."systemd/import-pubring.gpg".source = "${gpgKeyring}/pubkey.gpg";
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      server.wait_for_unit("nginx.service")
-      client.systemctl("start network-online.target")
-      client.wait_for_unit("network-online.target")
-      client.succeed("machinectl pull-raw --verify=signature http://server/testimage.raw")
-      client.succeed(
-          "cmp /var/lib/machines/testimage.raw ${nspawnImages}/testimage.raw"
-      )
-      client.succeed("machinectl pull-tar --verify=signature http://server/testimage2.tar.xz")
-      client.succeed(
-          "cmp /var/lib/machines/testimage2/${pkgs.hello}/bin/hello ${pkgs.hello}/bin/hello"
-      )
-    '';
-  }
-)
+    server.wait_for_unit("nginx.service")
+    client.systemctl("start network-online.target")
+    client.wait_for_unit("network-online.target")
+    client.succeed("machinectl pull-raw --verify=signature http://server/testimage.raw")
+    client.succeed(
+        "cmp /var/lib/machines/testimage.raw ${nspawnImages}/testimage.raw"
+    )
+    client.succeed("machinectl pull-tar --verify=signature http://server/testimage2.tar.xz")
+    client.succeed(
+        "cmp /var/lib/machines/testimage2/${pkgs.hello}/bin/hello ${pkgs.hello}/bin/hello"
+    )
+  '';
+}
diff --git a/nixos/tests/systemd-oomd.nix b/nixos/tests/systemd-oomd.nix
index 5c95c6705c71..265fabaf3a30 100644
--- a/nixos/tests/systemd-oomd.nix
+++ b/nixos/tests/systemd-oomd.nix
@@ -1,58 +1,56 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "systemd-oomd";
+{
+  name = "systemd-oomd";
 
-    # This test is a simplified version of systemd's testsuite-55.
-    # https://github.com/systemd/systemd/blob/v251/test/units/testsuite-55.sh
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        # Limit VM resource usage.
-        virtualisation.memorySize = 1024;
-        systemd.oomd.extraConfig.DefaultMemoryPressureDurationSec = "1s";
+  # This test is a simplified version of systemd's testsuite-55.
+  # https://github.com/systemd/systemd/blob/v251/test/units/testsuite-55.sh
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      # Limit VM resource usage.
+      virtualisation.memorySize = 1024;
+      systemd.oomd.extraConfig.DefaultMemoryPressureDurationSec = "1s";
 
-        systemd.slices.workload = {
-          description = "Test slice for memory pressure kills";
-          sliceConfig = {
-            MemoryAccounting = true;
-            ManagedOOMMemoryPressure = "kill";
-            ManagedOOMMemoryPressureLimit = "10%";
-          };
-        };
-
-        systemd.services.testbloat = {
-          description = "Create a lot of memory pressure";
-          serviceConfig = {
-            Slice = "workload.slice";
-            MemoryHigh = "5M";
-            ExecStart = "${pkgs.coreutils}/bin/tail /dev/zero";
-          };
-        };
-
-        systemd.services.testchill = {
-          description = "No memory pressure";
-          serviceConfig = {
-            Slice = "workload.slice";
-            MemoryHigh = "3M";
-            ExecStart = "${pkgs.coreutils}/bin/sleep infinity";
-          };
+      systemd.slices.workload = {
+        description = "Test slice for memory pressure kills";
+        sliceConfig = {
+          MemoryAccounting = true;
+          ManagedOOMMemoryPressure = "kill";
+          ManagedOOMMemoryPressureLimit = "10%";
         };
       };
 
-    testScript = ''
-      # Start the system.
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("oomctl")
+      systemd.services.testbloat = {
+        description = "Create a lot of memory pressure";
+        serviceConfig = {
+          Slice = "workload.slice";
+          MemoryHigh = "5M";
+          ExecStart = "${pkgs.coreutils}/bin/tail /dev/zero";
+        };
+      };
 
-      machine.succeed("systemctl start testchill.service")
-      with subtest("OOMd should kill the bad service"):
-          machine.fail("systemctl start --wait testbloat.service")
-          assert machine.get_unit_info("testbloat.service")["Result"] == "oom-kill"
+      systemd.services.testchill = {
+        description = "No memory pressure";
+        serviceConfig = {
+          Slice = "workload.slice";
+          MemoryHigh = "3M";
+          ExecStart = "${pkgs.coreutils}/bin/sleep infinity";
+        };
+      };
+    };
 
-      with subtest("Service without memory pressure should be untouched"):
-          machine.require_unit_state("testchill.service", "active")
-    '';
-  }
-)
+  testScript = ''
+    # Start the system.
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("oomctl")
+
+    machine.succeed("systemctl start testchill.service")
+    with subtest("OOMd should kill the bad service"):
+        machine.fail("systemctl start --wait testbloat.service")
+        assert machine.get_unit_info("testbloat.service")["Result"] == "oom-kill"
+
+    with subtest("Service without memory pressure should be untouched"):
+        machine.require_unit_state("testchill.service", "active")
+  '';
+}
diff --git a/nixos/tests/systemd-portabled.nix b/nixos/tests/systemd-portabled.nix
index caece9089d22..cde16bcf3652 100644
--- a/nixos/tests/systemd-portabled.nix
+++ b/nixos/tests/systemd-portabled.nix
@@ -1,58 +1,56 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    demo-program = pkgs.writeShellScriptBin "demo" ''
-      while ${pkgs.coreutils}/bin/sleep 3; do
-          echo Hello World > /dev/null
-      done
-    '';
-    demo-service = pkgs.writeText "demo.service" ''
-      [Unit]
-      Description=demo service
-      Requires=demo.socket
-      After=demo.socket
+{ pkgs, lib, ... }:
+let
+  demo-program = pkgs.writeShellScriptBin "demo" ''
+    while ${pkgs.coreutils}/bin/sleep 3; do
+        echo Hello World > /dev/null
+    done
+  '';
+  demo-service = pkgs.writeText "demo.service" ''
+    [Unit]
+    Description=demo service
+    Requires=demo.socket
+    After=demo.socket
 
-      [Service]
-      Type=simple
-      ExecStart=${demo-program}/bin/demo
-      Restart=always
+    [Service]
+    Type=simple
+    ExecStart=${demo-program}/bin/demo
+    Restart=always
 
-      [Install]
-      WantedBy=multi-user.target
-      Also=demo.socket
-    '';
-    demo-socket = pkgs.writeText "demo.socket" ''
-      [Unit]
-      Description=demo socket
+    [Install]
+    WantedBy=multi-user.target
+    Also=demo.socket
+  '';
+  demo-socket = pkgs.writeText "demo.socket" ''
+    [Unit]
+    Description=demo socket
 
-      [Socket]
-      ListenStream=/run/demo.sock
-      SocketMode=0666
+    [Socket]
+    ListenStream=/run/demo.sock
+    SocketMode=0666
 
-      [Install]
-      WantedBy=sockets.target
-    '';
-    demo-portable = pkgs.portableService {
-      pname = "demo";
-      version = "1.0";
-      description = ''A demo "Portable Service" for a shell program built with nix'';
-      units = [
-        demo-service
-        demo-socket
-      ];
-    };
-  in
-  {
+    [Install]
+    WantedBy=sockets.target
+  '';
+  demo-portable = pkgs.portableService {
+    pname = "demo";
+    version = "1.0";
+    description = ''A demo "Portable Service" for a shell program built with nix'';
+    units = [
+      demo-service
+      demo-socket
+    ];
+  };
+in
+{
 
-    name = "systemd-portabled";
-    nodes.machine = { };
-    testScript = ''
-      machine.succeed("portablectl")
-      machine.wait_for_unit("systemd-portabled.service")
-      machine.succeed("portablectl attach --now --runtime ${demo-portable}/demo_1.0.raw")
-      machine.wait_for_unit("demo.service")
-      machine.succeed("portablectl detach --now --runtime demo_1.0")
-      machine.fail("systemctl status demo.service")
-    '';
-  }
-)
+  name = "systemd-portabled";
+  nodes.machine = { };
+  testScript = ''
+    machine.succeed("portablectl")
+    machine.wait_for_unit("systemd-portabled.service")
+    machine.succeed("portablectl attach --now --runtime ${demo-portable}/demo_1.0.raw")
+    machine.wait_for_unit("demo.service")
+    machine.succeed("portablectl detach --now --runtime demo_1.0")
+    machine.fail("systemctl status demo.service")
+  '';
+}
diff --git a/nixos/tests/systemd-resolved.nix b/nixos/tests/systemd-resolved.nix
index 6256b7f2e675..25b926c75fdc 100644
--- a/nixos/tests/systemd-resolved.nix
+++ b/nixos/tests/systemd-resolved.nix
@@ -1,93 +1,91 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "systemd-resolved";
-    meta.maintainers = [ lib.maintainers.elvishjerricco ];
+{ pkgs, lib, ... }:
+{
+  name = "systemd-resolved";
+  meta.maintainers = [ lib.maintainers.elvishjerricco ];
 
-    nodes.server =
-      { lib, config, ... }:
-      let
-        exampleZone = pkgs.writeTextDir "example.com.zone" ''
-          @ SOA ns.example.com. noc.example.com. 2019031301 86400 7200 3600000 172800
-          @       A       ${(lib.head config.networking.interfaces.eth1.ipv4.addresses).address}
-          @       AAAA    ${(lib.head config.networking.interfaces.eth1.ipv6.addresses).address}
-        '';
-      in
-      {
-        networking.firewall.enable = false;
-        networking.useDHCP = false;
-
-        networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
-          {
-            address = "fd00::1";
-            prefixLength = 64;
-          }
-        ];
-
-        services.knot = {
-          enable = true;
-          settings = {
-            server.listen = [
-              "0.0.0.0@53"
-              "::@53"
-            ];
-            template.default.storage = exampleZone;
-            zone."example.com".file = "example.com.zone";
-          };
-        };
-      };
-
-    nodes.client =
-      { nodes, ... }:
-      let
-        inherit (lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses) address;
-      in
-      {
-        networking.nameservers = [ address ];
-        networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
-          {
-            address = "fd00::2";
-            prefixLength = 64;
-          }
-        ];
-        services.resolved.enable = true;
-        services.resolved.fallbackDns = [ ];
-        networking.useNetworkd = true;
-        networking.useDHCP = false;
-        systemd.network.networks."40-eth0".enable = false;
-
-        testing.initrdBackdoor = true;
-        boot.initrd = {
-          systemd.enable = true;
-          systemd.initrdBin = [ pkgs.iputils ];
-          network.enable = true;
-          services.resolved.enable = true;
-        };
-      };
-
-    testScript =
-      { nodes, ... }:
-      let
-        address4 = (lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address;
-        address6 = (lib.head nodes.server.networking.interfaces.eth1.ipv6.addresses).address;
-      in
-      ''
-        start_all()
-        server.wait_for_unit("multi-user.target")
-
-        def test_client():
-            query = client.succeed("resolvectl query example.com")
-            assert "${address4}" in query
-            assert "${address6}" in query
-            client.succeed("ping -4 -c 1 example.com")
-            client.succeed("ping -6 -c 1 example.com")
-
-        client.wait_for_unit("initrd.target")
-        test_client()
-        client.switch_root()
-
-        client.wait_for_unit("multi-user.target")
-        test_client()
+  nodes.server =
+    { lib, config, ... }:
+    let
+      exampleZone = pkgs.writeTextDir "example.com.zone" ''
+        @ SOA ns.example.com. noc.example.com. 2019031301 86400 7200 3600000 172800
+        @       A       ${(lib.head config.networking.interfaces.eth1.ipv4.addresses).address}
+        @       AAAA    ${(lib.head config.networking.interfaces.eth1.ipv6.addresses).address}
       '';
-  }
-)
+    in
+    {
+      networking.firewall.enable = false;
+      networking.useDHCP = false;
+
+      networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
+        {
+          address = "fd00::1";
+          prefixLength = 64;
+        }
+      ];
+
+      services.knot = {
+        enable = true;
+        settings = {
+          server.listen = [
+            "0.0.0.0@53"
+            "::@53"
+          ];
+          template.default.storage = exampleZone;
+          zone."example.com".file = "example.com.zone";
+        };
+      };
+    };
+
+  nodes.client =
+    { nodes, ... }:
+    let
+      inherit (lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses) address;
+    in
+    {
+      networking.nameservers = [ address ];
+      networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
+        {
+          address = "fd00::2";
+          prefixLength = 64;
+        }
+      ];
+      services.resolved.enable = true;
+      services.resolved.fallbackDns = [ ];
+      networking.useNetworkd = true;
+      networking.useDHCP = false;
+      systemd.network.networks."40-eth0".enable = false;
+
+      testing.initrdBackdoor = true;
+      boot.initrd = {
+        systemd.enable = true;
+        systemd.initrdBin = [ pkgs.iputils ];
+        network.enable = true;
+        services.resolved.enable = true;
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      address4 = (lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address;
+      address6 = (lib.head nodes.server.networking.interfaces.eth1.ipv6.addresses).address;
+    in
+    ''
+      start_all()
+      server.wait_for_unit("multi-user.target")
+
+      def test_client():
+          query = client.succeed("resolvectl query example.com")
+          assert "${address4}" in query
+          assert "${address6}" in query
+          client.succeed("ping -4 -c 1 example.com")
+          client.succeed("ping -6 -c 1 example.com")
+
+      client.wait_for_unit("initrd.target")
+      test_client()
+      client.switch_root()
+
+      client.wait_for_unit("multi-user.target")
+      test_client()
+    '';
+}
diff --git a/nixos/tests/systemd-shutdown.nix b/nixos/tests/systemd-shutdown.nix
index fa0105cb90cf..f4685605bb61 100644
--- a/nixos/tests/systemd-shutdown.nix
+++ b/nixos/tests/systemd-shutdown.nix
@@ -1,44 +1,43 @@
-import ./make-test-python.nix (
-  {
-    pkgs,
-    systemdStage1 ? false,
-    ...
-  }:
-  let
-    msg = "Shutting down NixOS";
-  in
-  {
-    name = "systemd-shutdown";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ das_j ];
-    };
+{
+  systemdStage1,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  msg = "Shutting down NixOS";
+in
+{
+  name = "systemd-shutdown";
+  meta.maintainers = with lib.maintainers; [ das_j ];
 
-    nodes.machine = {
-      imports = [ ../modules/profiles/minimal.nix ];
-      systemd.shutdownRamfs.contents."/etc/systemd/system-shutdown/shutdown-message".source =
-        pkgs.writeShellScript "shutdown-message" ''
-          echo "${msg}" > /dev/kmsg
-        '';
-      boot.initrd.systemd.enable = systemdStage1;
-    };
+  _module.args.systemdStage1 = lib.mkDefault false;
 
-    testScript = ''
-      # Check that 'generate-shutdown-ramfs.service' is started
-      # automatically and that 'systemd-shutdown' runs our script.
-      machine.wait_for_unit("multi-user.target")
-      # .shutdown() would wait for the machine to power off
-      machine.succeed("systemctl poweroff")
-      # Message printed by systemd-shutdown
-      machine.wait_for_console_text("Unmounting '/oldroot'")
-      machine.wait_for_console_text("${msg}")
-      # Don't try to sync filesystems
-      machine.wait_for_shutdown()
+  nodes.machine = {
+    imports = [ ../modules/profiles/minimal.nix ];
+    systemd.shutdownRamfs.contents."/etc/systemd/system-shutdown/shutdown-message".source =
+      pkgs.writeShellScript "shutdown-message" ''
+        echo "${msg}" > /dev/kmsg
+      '';
+    boot.initrd.systemd.enable = systemdStage1;
+  };
 
-      # In a separate boot, start 'generate-shutdown-ramfs.service'
-      # manually in order to check the permissions on '/run/initramfs'.
-      machine.systemctl("start generate-shutdown-ramfs.service")
-      stat = machine.succeed("stat --printf=%a:%u:%g /run/initramfs")
-      assert stat == "700:0:0", f"Improper permissions on /run/initramfs: {stat}"
-    '';
-  }
-)
+  testScript = ''
+    # Check that 'generate-shutdown-ramfs.service' is started
+    # automatically and that 'systemd-shutdown' runs our script.
+    machine.wait_for_unit("multi-user.target")
+    # .shutdown() would wait for the machine to power off
+    machine.succeed("systemctl poweroff")
+    # Message printed by systemd-shutdown
+    machine.wait_for_console_text("Unmounting '/oldroot'")
+    machine.wait_for_console_text("${msg}")
+    # Don't try to sync filesystems
+    machine.wait_for_shutdown()
+
+    # In a separate boot, start 'generate-shutdown-ramfs.service'
+    # manually in order to check the permissions on '/run/initramfs'.
+    machine.systemctl("start generate-shutdown-ramfs.service")
+    stat = machine.succeed("stat --printf=%a:%u:%g /run/initramfs")
+    assert stat == "700:0:0", f"Improper permissions on /run/initramfs: {stat}"
+  '';
+}
diff --git a/nixos/tests/systemd-timesyncd-nscd-dnssec.nix b/nixos/tests/systemd-timesyncd-nscd-dnssec.nix
index fc3002dbf51a..df30751b507e 100644
--- a/nixos/tests/systemd-timesyncd-nscd-dnssec.nix
+++ b/nixos/tests/systemd-timesyncd-nscd-dnssec.nix
@@ -13,57 +13,55 @@
 #   server running. For this test to succeed, we only need to ensure that systemd-timesyncd
 #   resolves the IP address of the fake.ntp host.
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    ntpHostname = "fake.ntp";
-    ntpIP = "192.0.2.1";
-  in
-  {
-    name = "systemd-timesyncd";
-    nodes.machine =
-      {
-        pkgs,
-        lib,
-        config,
-        ...
-      }:
-      let
-        eth1IP = (lib.head config.networking.interfaces.eth1.ipv4.addresses).address;
-      in
-      {
-        # Setup a local DNS server for the NTP domain on the eth1 IP address
-        services.tinydns = {
-          enable = true;
-          ip = eth1IP;
-          data = ''
-            .ntp:${eth1IP}
-            +.${ntpHostname}:${ntpIP}
-          '';
-        };
-
-        # Enable systemd-resolved with DNSSEC and use the local DNS as a name server
-        services.resolved.enable = true;
-        services.resolved.dnssec = "true";
-        networking.nameservers = [ eth1IP ];
-
-        # Configure systemd-timesyncd to use our NTP hostname
-        services.timesyncd.enable = lib.mkForce true;
-        services.timesyncd.servers = [ ntpHostname ];
-        services.timesyncd.extraConfig = ''
-          FallbackNTP=${ntpHostname}
+let
+  ntpHostname = "fake.ntp";
+  ntpIP = "192.0.2.1";
+in
+{
+  name = "systemd-timesyncd";
+  nodes.machine =
+    {
+      pkgs,
+      lib,
+      config,
+      ...
+    }:
+    let
+      eth1IP = (lib.head config.networking.interfaces.eth1.ipv4.addresses).address;
+    in
+    {
+      # Setup a local DNS server for the NTP domain on the eth1 IP address
+      services.tinydns = {
+        enable = true;
+        ip = eth1IP;
+        data = ''
+          .ntp:${eth1IP}
+          +.${ntpHostname}:${ntpIP}
         '';
-
-        # The debug output is necessary to determine whether systemd-timesyncd successfully resolves our NTP hostname or not
-        systemd.services.systemd-timesyncd.environment.SYSTEMD_LOG_LEVEL = "debug";
       };
 
-    testScript = ''
-      machine.wait_for_unit("tinydns.service")
-      machine.wait_for_unit("systemd-timesyncd.service")
-      machine.fail("resolvectl query ${ntpHostname}")
-      machine.wait_until_succeeds("journalctl -u systemd-timesyncd.service --grep='Resolved address ${ntpIP}:123 for ${ntpHostname}'")
-    '';
-  }
-)
+      # Enable systemd-resolved with DNSSEC and use the local DNS as a name server
+      services.resolved.enable = true;
+      services.resolved.dnssec = "true";
+      networking.nameservers = [ eth1IP ];
+
+      # Configure systemd-timesyncd to use our NTP hostname
+      services.timesyncd.enable = lib.mkForce true;
+      services.timesyncd.servers = [ ntpHostname ];
+      services.timesyncd.extraConfig = ''
+        FallbackNTP=${ntpHostname}
+      '';
+
+      # The debug output is necessary to determine whether systemd-timesyncd successfully resolves our NTP hostname or not
+      systemd.services.systemd-timesyncd.environment.SYSTEMD_LOG_LEVEL = "debug";
+    };
+
+  testScript = ''
+    machine.wait_for_unit("tinydns.service")
+    machine.wait_for_unit("systemd-timesyncd.service")
+    machine.fail("resolvectl query ${ntpHostname}")
+    machine.wait_until_succeeds("journalctl -u systemd-timesyncd.service --grep='Resolved address ${ntpIP}:123 for ${ntpHostname}'")
+  '';
+}
diff --git a/nixos/tests/systemd-timesyncd.nix b/nixos/tests/systemd-timesyncd.nix
index b1f618d947cd..83a3d820c50b 100644
--- a/nixos/tests/systemd-timesyncd.nix
+++ b/nixos/tests/systemd-timesyncd.nix
@@ -1,72 +1,70 @@
 # Regression test for systemd-timesync having moved the state directory without
 # upstream providing a migration path. https://github.com/systemd/systemd/issues/12131
 
-import ./make-test-python.nix (
-  let
-    common =
+let
+  common =
+    { lib, ... }:
+    {
+      # override the `false` value from the qemu-vm base profile
+      services.timesyncd.enable = lib.mkForce true;
+    };
+  mkVM = conf: {
+    imports = [
+      conf
+      common
+    ];
+  };
+in
+{
+  name = "systemd-timesyncd";
+  nodes = {
+    current = mkVM { };
+    pre1909 = mkVM (
       { lib, ... }:
       {
-        # override the `false` value from the qemu-vm base profile
-        services.timesyncd.enable = lib.mkForce true;
-      };
-    mkVM = conf: {
-      imports = [
-        conf
-        common
-      ];
-    };
-  in
-  {
-    name = "systemd-timesyncd";
-    nodes = {
-      current = mkVM { };
-      pre1909 = mkVM (
-        { lib, ... }:
-        {
-          # create the path that should be migrated by our activation script when
-          # upgrading to a newer nixos version
-          system.stateVersion = "19.03";
-          systemd.services.old-timesync-state-dir = {
-            requiredBy = [ "sysinit.target" ];
-            before = [ "systemd-timesyncd.service" ];
-            after = [ "local-fs.target" ];
-            unitConfig.DefaultDependencies = false;
-            serviceConfig.Type = "oneshot";
-            script = ''
-              rm -rf /var/lib/systemd/timesync
-              mkdir -p /var/lib/systemd /var/lib/private/systemd/timesync
-              ln -s /var/lib/private/systemd/timesync /var/lib/systemd/timesync
-              chown systemd-timesync: /var/lib/private/systemd/timesync
-            '';
-          };
-        }
-      );
-    };
+        # create the path that should be migrated by our activation script when
+        # upgrading to a newer nixos version
+        system.stateVersion = "19.03";
+        systemd.services.old-timesync-state-dir = {
+          requiredBy = [ "sysinit.target" ];
+          before = [ "systemd-timesyncd.service" ];
+          after = [ "local-fs.target" ];
+          unitConfig.DefaultDependencies = false;
+          serviceConfig.Type = "oneshot";
+          script = ''
+            rm -rf /var/lib/systemd/timesync
+            mkdir -p /var/lib/systemd /var/lib/private/systemd/timesync
+            ln -s /var/lib/private/systemd/timesync /var/lib/systemd/timesync
+            chown systemd-timesync: /var/lib/private/systemd/timesync
+          '';
+        };
+      }
+    );
+  };
 
-    testScript = ''
-      start_all()
-      current.succeed("systemctl status systemd-timesyncd.service")
-      # on a new install with a recent systemd there should not be any
-      # leftovers from the dynamic user mess
-      current.succeed("test -e /var/lib/systemd/timesync")
-      current.succeed("test ! -L /var/lib/systemd/timesync")
+  testScript = ''
+    start_all()
+    current.succeed("systemctl status systemd-timesyncd.service")
+    # on a new install with a recent systemd there should not be any
+    # leftovers from the dynamic user mess
+    current.succeed("test -e /var/lib/systemd/timesync")
+    current.succeed("test ! -L /var/lib/systemd/timesync")
 
-      # timesyncd should be running on the upgrading system since we fixed the
-      # file bits in the activation script
-      pre1909.succeed("systemctl status systemd-timesyncd.service")
+    # timesyncd should be running on the upgrading system since we fixed the
+    # file bits in the activation script
+    pre1909.succeed("systemctl status systemd-timesyncd.service")
 
-      # the path should be gone after the migration
-      pre1909.succeed("test ! -e /var/lib/private/systemd/timesync")
+    # the path should be gone after the migration
+    pre1909.succeed("test ! -e /var/lib/private/systemd/timesync")
 
-      # and the new path should no longer be a symlink
-      pre1909.succeed("test -e /var/lib/systemd/timesync")
-      pre1909.succeed("test ! -L /var/lib/systemd/timesync")
+    # and the new path should no longer be a symlink
+    pre1909.succeed("test -e /var/lib/systemd/timesync")
+    pre1909.succeed("test ! -L /var/lib/systemd/timesync")
 
-      # after a restart things should still work and not fail in the activation
-      # scripts and cause the boot to fail..
-      pre1909.shutdown()
-      pre1909.start()
-      pre1909.succeed("systemctl status systemd-timesyncd.service")
-    '';
-  }
-)
+    # after a restart things should still work and not fail in the activation
+    # scripts and cause the boot to fail..
+    pre1909.shutdown()
+    pre1909.start()
+    pre1909.succeed("systemctl status systemd-timesyncd.service")
+  '';
+}
diff --git a/nixos/tests/systemd-user-linger.nix b/nixos/tests/systemd-user-linger.nix
index 2c3d71668979..32094c74fa56 100644
--- a/nixos/tests/systemd-user-linger.nix
+++ b/nixos/tests/systemd-user-linger.nix
@@ -1,39 +1,37 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "systemd-user-linger";
+{ lib, ... }:
+{
+  name = "systemd-user-linger";
 
-    nodes.machine =
-      { ... }:
-      {
-        users.users = {
-          alice = {
-            isNormalUser = true;
-            linger = true;
-            uid = 1000;
-          };
+  nodes.machine =
+    { ... }:
+    {
+      users.users = {
+        alice = {
+          isNormalUser = true;
+          linger = true;
+          uid = 1000;
+        };
 
-          bob = {
-            isNormalUser = true;
-            linger = false;
-            uid = 10001;
-          };
+        bob = {
+          isNormalUser = true;
+          linger = false;
+          uid = 10001;
         };
       };
+    };
 
-    testScript =
-      { ... }:
-      ''
-        machine.wait_for_file("/var/lib/systemd/linger/alice")
-        machine.succeed("systemctl status user-1000.slice")
+  testScript =
+    { ... }:
+    ''
+      machine.wait_for_file("/var/lib/systemd/linger/alice")
+      machine.succeed("systemctl status user-1000.slice")
 
-        machine.fail("test -e /var/lib/systemd/linger/bob")
-        machine.fail("systemctl status user-1001.slice")
+      machine.fail("test -e /var/lib/systemd/linger/bob")
+      machine.fail("systemctl status user-1001.slice")
 
-        with subtest("missing users have linger purged"):
-            machine.succeed("touch /var/lib/systemd/linger/missing")
-            machine.systemctl("restart linger-users")
-            machine.succeed("test ! -e /var/lib/systemd/linger/missing")
-      '';
-  }
-)
+      with subtest("missing users have linger purged"):
+          machine.succeed("touch /var/lib/systemd/linger/missing")
+          machine.systemctl("restart linger-users")
+          machine.succeed("test ! -e /var/lib/systemd/linger/missing")
+    '';
+}
diff --git a/nixos/tests/systemd-user-tmpfiles-rules.nix b/nixos/tests/systemd-user-tmpfiles-rules.nix
index 6e11e9d4e5f6..c74a52c4f169 100644
--- a/nixos/tests/systemd-user-tmpfiles-rules.nix
+++ b/nixos/tests/systemd-user-tmpfiles-rules.nix
@@ -1,42 +1,40 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "systemd-user-tmpfiles-rules";
+{ lib, ... }:
+{
+  name = "systemd-user-tmpfiles-rules";
 
-    meta = with lib.maintainers; {
-      maintainers = [ schnusch ];
-    };
+  meta = with lib.maintainers; {
+    maintainers = [ schnusch ];
+  };
 
-    nodes.machine =
-      { ... }:
-      {
-        users.users = {
-          alice.isNormalUser = true;
-          bob.isNormalUser = true;
-        };
-
-        systemd.user.tmpfiles = {
-          rules = [
-            "d %h/user_tmpfiles_created"
-          ];
-          users.alice.rules = [
-            "d %h/only_alice"
-          ];
-        };
+  nodes.machine =
+    { ... }:
+    {
+      users.users = {
+        alice.isNormalUser = true;
+        bob.isNormalUser = true;
       };
 
-    testScript =
-      { ... }:
-      ''
-        machine.succeed("loginctl enable-linger alice bob")
+      systemd.user.tmpfiles = {
+        rules = [
+          "d %h/user_tmpfiles_created"
+        ];
+        users.alice.rules = [
+          "d %h/only_alice"
+        ];
+      };
+    };
 
-        machine.wait_until_succeeds("systemctl --user --machine=alice@ is-active systemd-tmpfiles-setup.service")
-        machine.succeed("[ -d ~alice/user_tmpfiles_created ]")
-        machine.succeed("[ -d ~alice/only_alice ]")
+  testScript =
+    { ... }:
+    ''
+      machine.succeed("loginctl enable-linger alice bob")
 
-        machine.wait_until_succeeds("systemctl --user --machine=bob@ is-active systemd-tmpfiles-setup.service")
-        machine.succeed("[ -d ~bob/user_tmpfiles_created ]")
-        machine.succeed("[ ! -e ~bob/only_alice ]")
-      '';
-  }
-)
+      machine.wait_until_succeeds("systemctl --user --machine=alice@ is-active systemd-tmpfiles-setup.service")
+      machine.succeed("[ -d ~alice/user_tmpfiles_created ]")
+      machine.succeed("[ -d ~alice/only_alice ]")
+
+      machine.wait_until_succeeds("systemctl --user --machine=bob@ is-active systemd-tmpfiles-setup.service")
+      machine.succeed("[ -d ~bob/user_tmpfiles_created ]")
+      machine.succeed("[ ! -e ~bob/only_alice ]")
+    '';
+}
diff --git a/nixos/tests/systemd-userdbd.nix b/nixos/tests/systemd-userdbd.nix
index 75fe469ed963..4a505432e321 100644
--- a/nixos/tests/systemd-userdbd.nix
+++ b/nixos/tests/systemd-userdbd.nix
@@ -1,37 +1,35 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "systemd-userdbd";
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        services.userdbd.enable = true;
+{ pkgs, lib, ... }:
+{
+  name = "systemd-userdbd";
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      services.userdbd.enable = true;
 
-        users.users.test-user-nss = {
-          isNormalUser = true;
-        };
-
-        environment.etc."userdb/test-user-dropin.user".text = builtins.toJSON {
-          userName = "test-user-dropin";
-        };
-
-        environment.systemPackages = with pkgs; [ libvarlink ];
+      users.users.test-user-nss = {
+        isNormalUser = true;
       };
-    testScript = ''
-      import json
-      from shlex import quote
 
-      def getUserRecord(name):
-        Interface = "unix:/run/systemd/userdb/io.systemd.Multiplexer/io.systemd.UserDatabase"
-        payload = json.dumps({
-          "service": "io.systemd.Multiplexer",
-          "userName": name
-        })
-        return json.loads(machine.succeed(f"varlink call {Interface}.GetUserRecord {quote(payload)}"))
+      environment.etc."userdb/test-user-dropin.user".text = builtins.toJSON {
+        userName = "test-user-dropin";
+      };
 
-      machine.wait_for_unit("systemd-userdbd.socket")
-      getUserRecord("test-user-nss")
-      getUserRecord("test-user-dropin")
-    '';
-  }
-)
+      environment.systemPackages = with pkgs; [ libvarlink ];
+    };
+  testScript = ''
+    import json
+    from shlex import quote
+
+    def getUserRecord(name):
+      Interface = "unix:/run/systemd/userdb/io.systemd.Multiplexer/io.systemd.UserDatabase"
+      payload = json.dumps({
+        "service": "io.systemd.Multiplexer",
+        "userName": name
+      })
+      return json.loads(machine.succeed(f"varlink call {Interface}.GetUserRecord {quote(payload)}"))
+
+    machine.wait_for_unit("systemd-userdbd.socket")
+    getUserRecord("test-user-nss")
+    getUserRecord("test-user-dropin")
+  '';
+}
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index 9e01aedca406..f2ea77f2ed48 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -1,252 +1,250 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "systemd";
+{ pkgs, ... }:
+{
+  name = "systemd";
 
-    nodes.machine =
-      { config, lib, ... }:
-      {
-        imports = [
-          common/user-account.nix
-          common/x11.nix
-        ];
+  nodes.machine =
+    { config, lib, ... }:
+    {
+      imports = [
+        common/user-account.nix
+        common/x11.nix
+      ];
 
-        virtualisation.emptyDiskImages = [
-          512
-          512
-        ];
+      virtualisation.emptyDiskImages = [
+        512
+        512
+      ];
 
-        environment.systemPackages = [ pkgs.cryptsetup ];
+      environment.systemPackages = [ pkgs.cryptsetup ];
 
-        virtualisation.fileSystems = {
-          "/test-x-initrd-mount" = {
-            device = "/dev/vdb";
-            fsType = "ext2";
-            autoFormat = true;
-            noCheck = true;
-            options = [ "x-initrd.mount" ];
-          };
+      virtualisation.fileSystems = {
+        "/test-x-initrd-mount" = {
+          device = "/dev/vdb";
+          fsType = "ext2";
+          autoFormat = true;
+          noCheck = true;
+          options = [ "x-initrd.mount" ];
         };
+      };
 
-        systemd.extraConfig = "DefaultEnvironment=\"XXX_SYSTEM=foo\"";
-        systemd.user.extraConfig = "DefaultEnvironment=\"XXX_USER=bar\"";
-        services.journald.extraConfig = "Storage=volatile";
-        test-support.displayManager.auto.user = "alice";
+      systemd.extraConfig = "DefaultEnvironment=\"XXX_SYSTEM=foo\"";
+      systemd.user.extraConfig = "DefaultEnvironment=\"XXX_USER=bar\"";
+      services.journald.extraConfig = "Storage=volatile";
+      test-support.displayManager.auto.user = "alice";
 
-        systemd.shutdown.test = pkgs.writeScript "test.shutdown" ''
-          #!${pkgs.runtimeShell}
-          PATH=${
-            lib.makeBinPath (
-              with pkgs;
-              [
-                util-linux
-                coreutils
-              ]
-            )
-          }
-          mount -t 9p shared -o trans=virtio,version=9p2000.L /tmp/shared
-          touch /tmp/shared/shutdown-test
-          umount /tmp/shared
-        '';
+      systemd.shutdown.test = pkgs.writeScript "test.shutdown" ''
+        #!${pkgs.runtimeShell}
+        PATH=${
+          lib.makeBinPath (
+            with pkgs;
+            [
+              util-linux
+              coreutils
+            ]
+          )
+        }
+        mount -t 9p shared -o trans=virtio,version=9p2000.L /tmp/shared
+        touch /tmp/shared/shutdown-test
+        umount /tmp/shared
+      '';
 
-        systemd.services.oncalendar-test = {
-          description = "calendar test";
-          # Japan does not have DST which makes the test a little bit simpler
-          startAt = "Wed 10:00 Asia/Tokyo";
-          script = "true";
-        };
+      systemd.services.oncalendar-test = {
+        description = "calendar test";
+        # Japan does not have DST which makes the test a little bit simpler
+        startAt = "Wed 10:00 Asia/Tokyo";
+        script = "true";
+      };
 
-        systemd.services.testDependency1 = {
-          description = "Test Dependency 1";
-          wantedBy = [ config.systemd.services."testservice1".name ];
-          serviceConfig.Type = "oneshot";
-          script = ''
-            true
-          '';
-        };
-
-        systemd.services.testservice1 = {
-          description = "Test Service 1";
-          wantedBy = [ config.systemd.targets.multi-user.name ];
-          serviceConfig.Type = "oneshot";
-          script = ''
-            if [ "$XXX_SYSTEM" = foo ]; then
-              touch /system_conf_read
-            fi
-          '';
-        };
-
-        systemd.user.services.testservice2 = {
-          description = "Test Service 2";
-          wantedBy = [ "default.target" ];
-          serviceConfig.Type = "oneshot";
-          script = ''
-            if [ "$XXX_USER" = bar ]; then
-              touch "$HOME/user_conf_read"
-            fi
-          '';
-        };
-
-        systemd.watchdog = {
-          device = "/dev/watchdog";
-          runtimeTime = "30s";
-          rebootTime = "10min";
-          kexecTime = "5min";
-        };
-
-        environment.etc."systemd/system-preset/10-testservice.preset".text = ''
-          disable ${config.systemd.services.testservice1.name}
+      systemd.services.testDependency1 = {
+        description = "Test Dependency 1";
+        wantedBy = [ config.systemd.services."testservice1".name ];
+        serviceConfig.Type = "oneshot";
+        script = ''
+          true
         '';
       };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        import re
-        import subprocess
+      systemd.services.testservice1 = {
+        description = "Test Service 1";
+        wantedBy = [ config.systemd.targets.multi-user.name ];
+        serviceConfig.Type = "oneshot";
+        script = ''
+          if [ "$XXX_SYSTEM" = foo ]; then
+            touch /system_conf_read
+          fi
+        '';
+      };
 
-        machine.start(allow_reboot=True)
+      systemd.user.services.testservice2 = {
+        description = "Test Service 2";
+        wantedBy = [ "default.target" ];
+        serviceConfig.Type = "oneshot";
+        script = ''
+          if [ "$XXX_USER" = bar ]; then
+            touch "$HOME/user_conf_read"
+          fi
+        '';
+      };
 
-        # Will not succeed unless ConditionFirstBoot=yes
-        machine.wait_for_unit("first-boot-complete.target")
+      systemd.watchdog = {
+        device = "/dev/watchdog";
+        runtimeTime = "30s";
+        rebootTime = "10min";
+        kexecTime = "5min";
+      };
 
-        # Make sure, a subsequent boot isn't a ConditionFirstBoot=yes.
-        machine.reboot()
-        machine.wait_for_x()
-        state = machine.get_unit_info("first-boot-complete.target")['ActiveState']
-        assert state == 'inactive', "Detected first boot despite first-boot-completed.target was already reached on a previous boot."
-
-        # wait for user services
-        machine.wait_for_unit("default.target", "alice")
-
-        with subtest("systemctl edit suggests --runtime"):
-            # --runtime is suggested when using `systemctl edit`
-            ret, out = machine.execute("systemctl edit testservice1.service 2>&1")
-            assert ret == 1
-            assert out.rstrip("\n") == "The unit-directory '/etc/systemd/system' is read-only on NixOS, so it's not possible to edit system-units directly. Use 'systemctl edit --runtime' instead."
-            # editing w/o `--runtime` is possible for user-services, however
-            # it's not possible because we're not in a tty when grepping
-            # (i.e. hacky way to ensure that the error from above doesn't appear here).
-            _, out = machine.execute("systemctl --user edit testservice2.service 2>&1")
-            assert out.rstrip("\n") == "Cannot edit units interactively if not on a tty."
-
-        # Regression test for https://github.com/NixOS/nixpkgs/issues/105049
-        with subtest("systemd reads timezone database in /etc/zoneinfo"):
-            timer = machine.succeed("TZ=UTC systemctl show --property=TimersCalendar oncalendar-test.timer")
-            assert re.search("next_elapse=Wed ....-..-.. 01:00:00 UTC", timer), f"got {timer.strip()}"
-
-        # Regression test for https://github.com/NixOS/nixpkgs/issues/35415
-        with subtest("configuration files are recognized by systemd"):
-            machine.succeed("test -e /system_conf_read")
-            machine.succeed("test -e /home/alice/user_conf_read")
-            machine.succeed("test -z $(ls -1 /var/log/journal)")
-
-        with subtest("regression test for https://bugs.freedesktop.org/show_bug.cgi?id=77507"):
-            retcode, output = machine.execute("systemctl status testservice1.service")
-            assert retcode in [0, 3]  # https://bugs.freedesktop.org/show_bug.cgi?id=77507
-
-        # Regression test for https://github.com/NixOS/nixpkgs/issues/35268
-        with subtest("file system with x-initrd.mount is not unmounted"):
-            machine.succeed("mountpoint -q /test-x-initrd-mount")
-            machine.shutdown()
-
-            subprocess.check_call(
-                [
-                    "qemu-img",
-                    "convert",
-                    "-O",
-                    "raw",
-                    "vm-state-machine/empty0.qcow2",
-                    "x-initrd-mount.raw",
-                ]
-            )
-            extinfo = subprocess.check_output(
-                [
-                    "${pkgs.e2fsprogs}/bin/dumpe2fs",
-                    "x-initrd-mount.raw",
-                ]
-            ).decode("utf-8")
-            assert (
-                re.search(r"^Filesystem state: *clean$", extinfo, re.MULTILINE) is not None
-            ), ("File system was not cleanly unmounted: " + extinfo)
-
-        # Regression test for https://github.com/NixOS/nixpkgs/pull/91232
-        with subtest("setting transient hostnames works"):
-            machine.succeed("hostnamectl set-hostname --transient machine-transient")
-            machine.fail("hostnamectl set-hostname machine-all")
-
-        with subtest("systemd-shutdown works"):
-            machine.shutdown()
-            machine.wait_for_unit("multi-user.target")
-            machine.succeed("test -e /tmp/shared/shutdown-test")
-
-        # Test settings from /etc/sysctl.d/50-default.conf are applied
-        with subtest("systemd sysctl settings are applied"):
-            machine.wait_for_unit("multi-user.target")
-            assert "fq_codel" in machine.succeed("sysctl net.core.default_qdisc")
-
-        # Test systemd is configured to manage a watchdog
-        with subtest("systemd manages hardware watchdog"):
-            machine.wait_for_unit("multi-user.target")
-
-            # It seems that the device's path doesn't appear in 'systemctl show' so
-            # check it separately.
-            assert "WatchdogDevice=/dev/watchdog" in machine.succeed(
-                "cat /etc/systemd/system.conf"
-            )
-
-            output = machine.succeed("systemctl show | grep Watchdog")
-            # assert "RuntimeWatchdogUSec=30s" in output
-            # for some reason RuntimeWatchdogUSec, doesn't seem to be updated in here.
-            assert "RebootWatchdogUSec=10min" in output
-            assert "KExecWatchdogUSec=5min" in output
-
-        # Test systemd cryptsetup support
-        with subtest("systemd successfully reads /etc/crypttab and unlocks volumes"):
-            # create a luks volume and put a filesystem on it
-            machine.succeed(
-                "echo -n supersecret | cryptsetup luksFormat -q /dev/vdc -",
-                "echo -n supersecret | cryptsetup luksOpen --key-file - /dev/vdc foo",
-                "mkfs.ext3 /dev/mapper/foo",
-            )
-
-            # create a keyfile and /etc/crypttab
-            machine.succeed("echo -n supersecret > /var/lib/luks-keyfile")
-            machine.succeed("chmod 600 /var/lib/luks-keyfile")
-            machine.succeed("echo 'luks1 /dev/vdc /var/lib/luks-keyfile luks' > /etc/crypttab")
-
-            # after a reboot, systemd should unlock the volume and we should be able to mount it
-            machine.shutdown()
-            machine.succeed("systemctl status systemd-cryptsetup@luks1.service")
-            machine.succeed("mkdir -p /tmp/luks1")
-            machine.succeed("mount /dev/mapper/luks1 /tmp/luks1")
-
-        # Do some IP traffic
-        output_ping = machine.succeed(
-            "systemd-run --wait -- ping -c 1 127.0.0.1 2>&1"
-        )
-
-        with subtest("systemd reports accounting data on system.slice"):
-            output = machine.succeed("systemctl status system.slice")
-            assert "CPU:" in output
-            assert "Memory:" in output
-
-            assert "IP:" in output
-            assert "0B in, 0B out" not in output
-
-            assert "IO:" in output
-            assert "0B read, 0B written" not in output
-
-        with subtest("systemd per-unit accounting works"):
-            assert "IP traffic received: 84B sent: 84B" in output_ping
-
-        with subtest("systemd environment is properly set"):
-            machine.systemctl("daemon-reexec")  # Rewrites /proc/1/environ
-            machine.succeed("grep -q TZDIR=/etc/zoneinfo /proc/1/environ")
-
-        with subtest("systemd presets are ignored"):
-            machine.succeed("systemctl preset ${nodes.machine.systemd.services.testservice1.name}")
-            machine.succeed("test -e /etc/systemd/system/${nodes.machine.systemd.services.testservice1.name}")
+      environment.etc."systemd/system-preset/10-testservice.preset".text = ''
+        disable ${config.systemd.services.testservice1.name}
       '';
-  }
-)
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      import re
+      import subprocess
+
+      machine.start(allow_reboot=True)
+
+      # Will not succeed unless ConditionFirstBoot=yes
+      machine.wait_for_unit("first-boot-complete.target")
+
+      # Make sure, a subsequent boot isn't a ConditionFirstBoot=yes.
+      machine.reboot()
+      machine.wait_for_x()
+      state = machine.get_unit_info("first-boot-complete.target")['ActiveState']
+      assert state == 'inactive', "Detected first boot despite first-boot-completed.target was already reached on a previous boot."
+
+      # wait for user services
+      machine.wait_for_unit("default.target", "alice")
+
+      with subtest("systemctl edit suggests --runtime"):
+          # --runtime is suggested when using `systemctl edit`
+          ret, out = machine.execute("systemctl edit testservice1.service 2>&1")
+          assert ret == 1
+          assert out.rstrip("\n") == "The unit-directory '/etc/systemd/system' is read-only on NixOS, so it's not possible to edit system-units directly. Use 'systemctl edit --runtime' instead."
+          # editing w/o `--runtime` is possible for user-services, however
+          # it's not possible because we're not in a tty when grepping
+          # (i.e. hacky way to ensure that the error from above doesn't appear here).
+          _, out = machine.execute("systemctl --user edit testservice2.service 2>&1")
+          assert out.rstrip("\n") == "Cannot edit units interactively if not on a tty."
+
+      # Regression test for https://github.com/NixOS/nixpkgs/issues/105049
+      with subtest("systemd reads timezone database in /etc/zoneinfo"):
+          timer = machine.succeed("TZ=UTC systemctl show --property=TimersCalendar oncalendar-test.timer")
+          assert re.search("next_elapse=Wed ....-..-.. 01:00:00 UTC", timer), f"got {timer.strip()}"
+
+      # Regression test for https://github.com/NixOS/nixpkgs/issues/35415
+      with subtest("configuration files are recognized by systemd"):
+          machine.succeed("test -e /system_conf_read")
+          machine.succeed("test -e /home/alice/user_conf_read")
+          machine.succeed("test -z $(ls -1 /var/log/journal)")
+
+      with subtest("regression test for https://bugs.freedesktop.org/show_bug.cgi?id=77507"):
+          retcode, output = machine.execute("systemctl status testservice1.service")
+          assert retcode in [0, 3]  # https://bugs.freedesktop.org/show_bug.cgi?id=77507
+
+      # Regression test for https://github.com/NixOS/nixpkgs/issues/35268
+      with subtest("file system with x-initrd.mount is not unmounted"):
+          machine.succeed("mountpoint -q /test-x-initrd-mount")
+          machine.shutdown()
+
+          subprocess.check_call(
+              [
+                  "qemu-img",
+                  "convert",
+                  "-O",
+                  "raw",
+                  "vm-state-machine/empty0.qcow2",
+                  "x-initrd-mount.raw",
+              ]
+          )
+          extinfo = subprocess.check_output(
+              [
+                  "${pkgs.e2fsprogs}/bin/dumpe2fs",
+                  "x-initrd-mount.raw",
+              ]
+          ).decode("utf-8")
+          assert (
+              re.search(r"^Filesystem state: *clean$", extinfo, re.MULTILINE) is not None
+          ), ("File system was not cleanly unmounted: " + extinfo)
+
+      # Regression test for https://github.com/NixOS/nixpkgs/pull/91232
+      with subtest("setting transient hostnames works"):
+          machine.succeed("hostnamectl set-hostname --transient machine-transient")
+          machine.fail("hostnamectl set-hostname machine-all")
+
+      with subtest("systemd-shutdown works"):
+          machine.shutdown()
+          machine.wait_for_unit("multi-user.target")
+          machine.succeed("test -e /tmp/shared/shutdown-test")
+
+      # Test settings from /etc/sysctl.d/50-default.conf are applied
+      with subtest("systemd sysctl settings are applied"):
+          machine.wait_for_unit("multi-user.target")
+          assert "fq_codel" in machine.succeed("sysctl net.core.default_qdisc")
+
+      # Test systemd is configured to manage a watchdog
+      with subtest("systemd manages hardware watchdog"):
+          machine.wait_for_unit("multi-user.target")
+
+          # It seems that the device's path doesn't appear in 'systemctl show' so
+          # check it separately.
+          assert "WatchdogDevice=/dev/watchdog" in machine.succeed(
+              "cat /etc/systemd/system.conf"
+          )
+
+          output = machine.succeed("systemctl show | grep Watchdog")
+          # assert "RuntimeWatchdogUSec=30s" in output
+          # for some reason RuntimeWatchdogUSec, doesn't seem to be updated in here.
+          assert "RebootWatchdogUSec=10min" in output
+          assert "KExecWatchdogUSec=5min" in output
+
+      # Test systemd cryptsetup support
+      with subtest("systemd successfully reads /etc/crypttab and unlocks volumes"):
+          # create a luks volume and put a filesystem on it
+          machine.succeed(
+              "echo -n supersecret | cryptsetup luksFormat -q /dev/vdc -",
+              "echo -n supersecret | cryptsetup luksOpen --key-file - /dev/vdc foo",
+              "mkfs.ext3 /dev/mapper/foo",
+          )
+
+          # create a keyfile and /etc/crypttab
+          machine.succeed("echo -n supersecret > /var/lib/luks-keyfile")
+          machine.succeed("chmod 600 /var/lib/luks-keyfile")
+          machine.succeed("echo 'luks1 /dev/vdc /var/lib/luks-keyfile luks' > /etc/crypttab")
+
+          # after a reboot, systemd should unlock the volume and we should be able to mount it
+          machine.shutdown()
+          machine.succeed("systemctl status systemd-cryptsetup@luks1.service")
+          machine.succeed("mkdir -p /tmp/luks1")
+          machine.succeed("mount /dev/mapper/luks1 /tmp/luks1")
+
+      # Do some IP traffic
+      output_ping = machine.succeed(
+          "systemd-run --wait -- ping -c 1 127.0.0.1 2>&1"
+      )
+
+      with subtest("systemd reports accounting data on system.slice"):
+          output = machine.succeed("systemctl status system.slice")
+          assert "CPU:" in output
+          assert "Memory:" in output
+
+          assert "IP:" in output
+          assert "0B in, 0B out" not in output
+
+          assert "IO:" in output
+          assert "0B read, 0B written" not in output
+
+      with subtest("systemd per-unit accounting works"):
+          assert "IP traffic received: 84B sent: 84B" in output_ping
+
+      with subtest("systemd environment is properly set"):
+          machine.systemctl("daemon-reexec")  # Rewrites /proc/1/environ
+          machine.succeed("grep -q TZDIR=/etc/zoneinfo /proc/1/environ")
+
+      with subtest("systemd presets are ignored"):
+          machine.succeed("systemctl preset ${nodes.machine.systemd.services.testservice1.name}")
+          machine.succeed("test -e /etc/systemd/system/${nodes.machine.systemd.services.testservice1.name}")
+    '';
+}
diff --git a/nixos/tests/tandoor-recipes-script-name.nix b/nixos/tests/tandoor-recipes-script-name.nix
index 6216d67b8084..b2a73771dddd 100644
--- a/nixos/tests/tandoor-recipes-script-name.nix
+++ b/nixos/tests/tandoor-recipes-script-name.nix
@@ -1,95 +1,93 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "tandoor-recipes-script-name";
+{ pkgs, lib, ... }:
+{
+  name = "tandoor-recipes-script-name";
 
-    nodes.machine =
-      { pkgs, nodes, ... }:
-      {
-        services.tandoor-recipes = {
-          enable = true;
-          extraConfig = {
-            SCRIPT_NAME = "/any/path";
-            STATIC_URL = "${nodes.machine.services.tandoor-recipes.extraConfig.SCRIPT_NAME}/static/";
-          };
+  nodes.machine =
+    { pkgs, nodes, ... }:
+    {
+      services.tandoor-recipes = {
+        enable = true;
+        extraConfig = {
+          SCRIPT_NAME = "/any/path";
+          STATIC_URL = "${nodes.machine.services.tandoor-recipes.extraConfig.SCRIPT_NAME}/static/";
         };
       };
+    };
 
-    testScript =
-      { nodes, ... }:
-      let
-        inherit (nodes.machine.services.tandoor-recipes) address port;
-        inherit (nodes.machine.services.tandoor-recipes.extraConfig) SCRIPT_NAME;
-      in
-      ''
-        from html.parser import HTMLParser
+  testScript =
+    { nodes, ... }:
+    let
+      inherit (nodes.machine.services.tandoor-recipes) address port;
+      inherit (nodes.machine.services.tandoor-recipes.extraConfig) SCRIPT_NAME;
+    in
+    ''
+      from html.parser import HTMLParser
 
-        origin_url = "http://${address}:${toString port}"
-        base_url = f"{origin_url}${SCRIPT_NAME}"
-        login_path = "/admin/login/"
-        login_url = f"{base_url}{login_path}"
+      origin_url = "http://${address}:${toString port}"
+      base_url = f"{origin_url}${SCRIPT_NAME}"
+      login_path = "/admin/login/"
+      login_url = f"{base_url}{login_path}"
 
-        cookie_jar_path = "/tmp/cookies.txt"
-        curl = f"curl --cookie {cookie_jar_path} --cookie-jar {cookie_jar_path} --fail --header 'Origin: {origin_url}' --show-error --silent"
+      cookie_jar_path = "/tmp/cookies.txt"
+      curl = f"curl --cookie {cookie_jar_path} --cookie-jar {cookie_jar_path} --fail --header 'Origin: {origin_url}' --show-error --silent"
 
-        print("Wait for the service to respond")
-        machine.wait_for_unit("tandoor-recipes.service")
-        machine.wait_until_succeeds(f"{curl} {login_url}")
+      print("Wait for the service to respond")
+      machine.wait_for_unit("tandoor-recipes.service")
+      machine.wait_until_succeeds(f"{curl} {login_url}")
 
-        username = "username"
-        password = "password"
+      username = "username"
+      password = "password"
 
-        print("Create admin user")
-        machine.succeed(
-            f"DJANGO_SUPERUSER_PASSWORD='{password}' /var/lib/tandoor-recipes/tandoor-recipes-manage createsuperuser --no-input --username='{username}' --email=nobody@example.com"
-        )
+      print("Create admin user")
+      machine.succeed(
+          f"DJANGO_SUPERUSER_PASSWORD='{password}' /var/lib/tandoor-recipes/tandoor-recipes-manage createsuperuser --no-input --username='{username}' --email=nobody@example.com"
+      )
 
-        print("Get CSRF token for later requests")
-        csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut --fields=7").rstrip()
+      print("Get CSRF token for later requests")
+      csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut --fields=7").rstrip()
 
-        print("Log in as admin user")
-        machine.succeed(
-            f"{curl} --data 'csrfmiddlewaretoken={csrf_token}' --data 'username={username}' --data 'password={password}' {login_url}"
-        )
+      print("Log in as admin user")
+      machine.succeed(
+          f"{curl} --data 'csrfmiddlewaretoken={csrf_token}' --data 'username={username}' --data 'password={password}' {login_url}"
+      )
 
-        print("Get the contents of the logged in main page")
-        logged_in_page = machine.succeed(f"{curl} --location {base_url}")
+      print("Get the contents of the logged in main page")
+      logged_in_page = machine.succeed(f"{curl} --location {base_url}")
 
-        class UrlParser(HTMLParser):
-            def __init__(self):
-                super().__init__()
+      class UrlParser(HTMLParser):
+          def __init__(self):
+              super().__init__()
 
-                self.urls: list[str] = []
+              self.urls: list[str] = []
 
-            def handle_starttag(self, tag: str, attrs: list[tuple[str, str | None]]) -> None:
-                if tag == "form":
-                    for name, value in attrs:
-                        if name == "action" and value is not None:
-                            assert not value.endswith(login_path)
-                            break
+          def handle_starttag(self, tag: str, attrs: list[tuple[str, str | None]]) -> None:
+              if tag == "form":
+                  for name, value in attrs:
+                      if name == "action" and value is not None:
+                          assert not value.endswith(login_path)
+                          break
 
-                if tag != "a":
-                    return
+              if tag != "a":
+                  return
 
-                for name, value in attrs:
-                    if name == "href" and value is not None:
-                        if value.startswith(base_url):
-                            self.urls.append(value)
-                        elif value.startswith("/"):
-                            self.urls.append(f"{origin_url}{value}")
-                        else:
-                            print(f"Ignoring non-path URL: {value}")
+              for name, value in attrs:
+                  if name == "href" and value is not None:
+                      if value.startswith(base_url):
+                          self.urls.append(value)
+                      elif value.startswith("/"):
+                          self.urls.append(f"{origin_url}{value}")
+                      else:
+                          print(f"Ignoring non-path URL: {value}")
 
-                        break
+                      break
 
-        parser = UrlParser()
-        parser.feed(logged_in_page)
+      parser = UrlParser()
+      parser.feed(logged_in_page)
 
-        for url in parser.urls:
-            with subtest(f"Verify that {url} can be reached"):
-                machine.succeed(f"{curl} {url}")
-      '';
+      for url in parser.urls:
+          with subtest(f"Verify that {url} can be reached"):
+              machine.succeed(f"{curl} {url}")
+    '';
 
-    meta.maintainers = with lib.maintainers; [ l0b0 ];
-  }
-)
+  meta.maintainers = with lib.maintainers; [ l0b0 ];
+}
diff --git a/nixos/tests/tandoor-recipes.nix b/nixos/tests/tandoor-recipes.nix
index 536746e092b9..0b2211af22fa 100644
--- a/nixos/tests/tandoor-recipes.nix
+++ b/nixos/tests/tandoor-recipes.nix
@@ -1,46 +1,44 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "tandoor-recipes";
-    meta.maintainers = with lib.maintainers; [ ];
+{ lib, ... }:
+{
+  name = "tandoor-recipes";
+  meta.maintainers = with lib.maintainers; [ ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.tandoor-recipes = {
-          enable = true;
-          extraConfig = {
-            DB_ENGINE = "django.db.backends.postgresql";
-            POSTGRES_HOST = "/run/postgresql";
-            POSTGRES_USER = "tandoor_recipes";
-            POSTGRES_DB = "tandoor_recipes";
-          };
-        };
-
-        services.postgresql = {
-          enable = true;
-          ensureDatabases = [ "tandoor_recipes" ];
-          ensureUsers = [
-            {
-              name = "tandoor_recipes";
-              ensureDBOwnership = true;
-            }
-          ];
-        };
-
-        systemd.services = {
-          tandoor-recipes = {
-            after = [ "postgresql.service" ];
-          };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.tandoor-recipes = {
+        enable = true;
+        extraConfig = {
+          DB_ENGINE = "django.db.backends.postgresql";
+          POSTGRES_HOST = "/run/postgresql";
+          POSTGRES_USER = "tandoor_recipes";
+          POSTGRES_DB = "tandoor_recipes";
         };
       };
 
-    testScript = ''
-      machine.wait_for_unit("tandoor-recipes.service")
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "tandoor_recipes" ];
+        ensureUsers = [
+          {
+            name = "tandoor_recipes";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
 
-      with subtest("Web interface gets ready"):
-          # Wait until server accepts connections
-          machine.wait_until_succeeds("curl -fs localhost:8080")
-    '';
-  }
-)
+      systemd.services = {
+        tandoor-recipes = {
+          after = [ "postgresql.service" ];
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("tandoor-recipes.service")
+
+    with subtest("Web interface gets ready"):
+        # Wait until server accepts connections
+        machine.wait_until_succeeds("curl -fs localhost:8080")
+  '';
+}
diff --git a/nixos/tests/tang.nix b/nixos/tests/tang.nix
index 58d351061791..0241b62dd3c7 100644
--- a/nixos/tests/tang.nix
+++ b/nixos/tests/tang.nix
@@ -1,93 +1,91 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "tang";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ jfroche ];
-    };
+{ pkgs, ... }:
+{
+  name = "tang";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jfroche ];
+  };
 
-    nodes.server =
-      {
-        config,
-        pkgs,
-        modulesPath,
-        ...
-      }:
-      {
-        imports = [
-          "${modulesPath}/../tests/common/auto-format-root-device.nix"
-        ];
-        virtualisation = {
-          emptyDiskImages = [ 512 ];
-          useBootLoader = true;
-          useEFIBoot = true;
-          # This requires to have access
-          # to a host Nix store as
-          # the new root device is /dev/vdb
-          # an empty 512MiB drive, containing no Nix store.
-          mountHostNixStore = true;
-        };
-
-        boot.loader.systemd-boot.enable = true;
-
-        networking.interfaces.eth1.ipv4.addresses = [
-          {
-            address = "192.168.0.1";
-            prefixLength = 24;
-          }
-        ];
-
-        environment.systemPackages = with pkgs; [
-          clevis
-          tang
-          cryptsetup
-        ];
-        services.tang = {
-          enable = true;
-          ipAddressAllow = [ "127.0.0.1/32" ];
-        };
+  nodes.server =
+    {
+      config,
+      pkgs,
+      modulesPath,
+      ...
+    }:
+    {
+      imports = [
+        "${modulesPath}/../tests/common/auto-format-root-device.nix"
+      ];
+      virtualisation = {
+        emptyDiskImages = [ 512 ];
+        useBootLoader = true;
+        useEFIBoot = true;
+        # This requires to have access
+        # to a host Nix store as
+        # the new root device is /dev/vdb
+        # an empty 512MiB drive, containing no Nix store.
+        mountHostNixStore = true;
       };
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("sockets.target")
 
-      with subtest("Check keys are generated"):
-        machine.wait_until_succeeds("curl -v http://127.0.0.1:7654/adv")
-        key = machine.wait_until_succeeds("tang-show-keys 7654")
+      boot.loader.systemd-boot.enable = true;
 
-      with subtest("Check systemd access list"):
-        machine.succeed("ping -c 3 192.168.0.1")
-        machine.fail("curl -v --connect-timeout 3 http://192.168.0.1:7654/adv")
+      networking.interfaces.eth1.ipv4.addresses = [
+        {
+          address = "192.168.0.1";
+          prefixLength = 24;
+        }
+      ];
 
-      with subtest("Check basic encrypt and decrypt message"):
-        machine.wait_until_succeeds(f"""echo 'Hello World' | clevis encrypt tang '{{ "url": "http://127.0.0.1:7654", "thp":"{key}"}}' > /tmp/encrypted""")
-        decrypted = machine.wait_until_succeeds("clevis decrypt < /tmp/encrypted")
-        assert decrypted.strip() == "Hello World"
-        machine.wait_until_succeeds("tang-show-keys 7654")
+      environment.systemPackages = with pkgs; [
+        clevis
+        tang
+        cryptsetup
+      ];
+      services.tang = {
+        enable = true;
+        ipAddressAllow = [ "127.0.0.1/32" ];
+      };
+    };
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("sockets.target")
 
-      with subtest("Check encrypt and decrypt disk"):
-        machine.succeed("cryptsetup luksFormat --force-password --batch-mode /dev/vdb <<<'password'")
-        machine.succeed(f"""clevis luks bind -s1 -y -f -d /dev/vdb tang '{{ "url": "http://127.0.0.1:7654", "thp":"{key}" }}' <<< 'password' """)
-        clevis_luks = machine.succeed("clevis luks list -d /dev/vdb")
-        assert clevis_luks.strip() == """1: tang '{"url":"http://127.0.0.1:7654"}'"""
-        machine.succeed("clevis luks unlock -d /dev/vdb")
-        machine.succeed("find /dev/mapper -name 'luks*' -exec cryptsetup close {} +")
-        machine.succeed("clevis luks unlock -d /dev/vdb")
-        machine.succeed("find /dev/mapper -name 'luks*' -exec cryptsetup close {} +")
-        # without tang available, unlock should fail
-        machine.succeed("systemctl stop tangd.socket")
-        machine.fail("clevis luks unlock -d /dev/vdb")
-        machine.succeed("systemctl start tangd.socket")
+    with subtest("Check keys are generated"):
+      machine.wait_until_succeeds("curl -v http://127.0.0.1:7654/adv")
+      key = machine.wait_until_succeeds("tang-show-keys 7654")
 
-      with subtest("Rotate server keys"):
-        machine.succeed("${pkgs.tang}/libexec/tangd-rotate-keys -d /var/lib/tang")
-        machine.succeed("clevis luks unlock -d /dev/vdb")
-        machine.succeed("find /dev/mapper -name 'luks*' -exec cryptsetup close {} +")
+    with subtest("Check systemd access list"):
+      machine.succeed("ping -c 3 192.168.0.1")
+      machine.fail("curl -v --connect-timeout 3 http://192.168.0.1:7654/adv")
 
-      with subtest("Test systemd service security"):
-          output = machine.succeed("systemd-analyze security tangd@.service")
-          machine.log(output)
-          assert output[-9:-1] == "SAFE :-}"
-    '';
-  }
-)
+    with subtest("Check basic encrypt and decrypt message"):
+      machine.wait_until_succeeds(f"""echo 'Hello World' | clevis encrypt tang '{{ "url": "http://127.0.0.1:7654", "thp":"{key}"}}' > /tmp/encrypted""")
+      decrypted = machine.wait_until_succeeds("clevis decrypt < /tmp/encrypted")
+      assert decrypted.strip() == "Hello World"
+      machine.wait_until_succeeds("tang-show-keys 7654")
+
+    with subtest("Check encrypt and decrypt disk"):
+      machine.succeed("cryptsetup luksFormat --force-password --batch-mode /dev/vdb <<<'password'")
+      machine.succeed(f"""clevis luks bind -s1 -y -f -d /dev/vdb tang '{{ "url": "http://127.0.0.1:7654", "thp":"{key}" }}' <<< 'password' """)
+      clevis_luks = machine.succeed("clevis luks list -d /dev/vdb")
+      assert clevis_luks.strip() == """1: tang '{"url":"http://127.0.0.1:7654"}'"""
+      machine.succeed("clevis luks unlock -d /dev/vdb")
+      machine.succeed("find /dev/mapper -name 'luks*' -exec cryptsetup close {} +")
+      machine.succeed("clevis luks unlock -d /dev/vdb")
+      machine.succeed("find /dev/mapper -name 'luks*' -exec cryptsetup close {} +")
+      # without tang available, unlock should fail
+      machine.succeed("systemctl stop tangd.socket")
+      machine.fail("clevis luks unlock -d /dev/vdb")
+      machine.succeed("systemctl start tangd.socket")
+
+    with subtest("Rotate server keys"):
+      machine.succeed("${pkgs.tang}/libexec/tangd-rotate-keys -d /var/lib/tang")
+      machine.succeed("clevis luks unlock -d /dev/vdb")
+      machine.succeed("find /dev/mapper -name 'luks*' -exec cryptsetup close {} +")
+
+    with subtest("Test systemd service security"):
+        output = machine.succeed("systemd-analyze security tangd@.service")
+        machine.log(output)
+        assert output[-9:-1] == "SAFE :-}"
+  '';
+}
diff --git a/nixos/tests/taskchampion-sync-server.nix b/nixos/tests/taskchampion-sync-server.nix
index 659a900fd2c2..474c0bd8834e 100644
--- a/nixos/tests/taskchampion-sync-server.nix
+++ b/nixos/tests/taskchampion-sync-server.nix
@@ -1,49 +1,47 @@
-import ./make-test-python.nix (
-  { ... }:
-  {
-    name = "taskchampion-sync-server";
+{ ... }:
+{
+  name = "taskchampion-sync-server";
 
-    nodes = {
-      server = {
-        services.taskchampion-sync-server.enable = true;
-        services.taskchampion-sync-server.host = "0.0.0.0";
-        services.taskchampion-sync-server.openFirewall = true;
-      };
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.taskwarrior3 ];
-        };
+  nodes = {
+    server = {
+      services.taskchampion-sync-server.enable = true;
+      services.taskchampion-sync-server.host = "0.0.0.0";
+      services.taskchampion-sync-server.openFirewall = true;
     };
-    testScript =
-      { nodes, ... }:
-      let
-        cfg = nodes.server.services.taskchampion-sync-server;
-        port = builtins.toString cfg.port;
-        # Generated with uuidgen
-        uuid = "bf01376e-04a4-435a-9263-608567531af3";
-        password = "nixos-test";
-      in
-      ''
-        # Explicitly start the VMs so that we don't accidentally start newServer
-        server.start()
-        client.start()
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.taskwarrior3 ];
+      };
+  };
+  testScript =
+    { nodes, ... }:
+    let
+      cfg = nodes.server.services.taskchampion-sync-server;
+      port = builtins.toString cfg.port;
+      # Generated with uuidgen
+      uuid = "bf01376e-04a4-435a-9263-608567531af3";
+      password = "nixos-test";
+    in
+    ''
+      # Explicitly start the VMs so that we don't accidentally start newServer
+      server.start()
+      client.start()
 
-        server.wait_for_unit("taskchampion-sync-server.service")
-        server.wait_for_open_port(${port})
+      server.wait_for_unit("taskchampion-sync-server.service")
+      server.wait_for_open_port(${port})
 
-        # See man task-sync(5)
-        client.succeed("mkdir ~/.task")
-        client.succeed("touch ~/.taskrc")
-        client.succeed("echo sync.server.origin=http://server:${port} >> ~/.taskrc")
-        client.succeed("echo sync.server.client_id=${uuid} >> ~/.taskrc")
-        client.succeed("echo sync.encryption_secret=${password} >> ~/.taskrc")
-        client.succeed("task add hello world")
-        client.succeed("task sync")
+      # See man task-sync(5)
+      client.succeed("mkdir ~/.task")
+      client.succeed("touch ~/.taskrc")
+      client.succeed("echo sync.server.origin=http://server:${port} >> ~/.taskrc")
+      client.succeed("echo sync.server.client_id=${uuid} >> ~/.taskrc")
+      client.succeed("echo sync.encryption_secret=${password} >> ~/.taskrc")
+      client.succeed("task add hello world")
+      client.succeed("task sync")
 
-        # Useful for debugging
-        client.copy_from_vm("/root/.task", "client")
-        server.copy_from_vm("${cfg.dataDir}", "server")
-      '';
-  }
-)
+      # Useful for debugging
+      client.copy_from_vm("/root/.task", "client")
+      server.copy_from_vm("${cfg.dataDir}", "server")
+    '';
+}
diff --git a/nixos/tests/taskserver.nix b/nixos/tests/taskserver.nix
index 31dfea00435c..b1e2113f2f09 100644
--- a/nixos/tests/taskserver.nix
+++ b/nixos/tests/taskserver.nix
@@ -1,299 +1,297 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    snakeOil =
-      pkgs.runCommand "snakeoil-certs"
-        {
-          outputs = [
-            "out"
-            "cacert"
-            "cert"
-            "key"
-            "crl"
-          ];
-          buildInputs = [ pkgs.gnutls.bin ];
-          caTemplate = pkgs.writeText "snakeoil-ca.template" ''
-            cn = server
-            expiration_days = -1
-            cert_signing_key
-            ca
-          '';
-          certTemplate = pkgs.writeText "snakeoil-cert.template" ''
-            cn = server
-            expiration_days = -1
-            tls_www_server
-            encryption_key
-            signing_key
-          '';
-          crlTemplate = pkgs.writeText "snakeoil-crl.template" ''
-            expiration_days = -1
-          '';
-          userCertTemplate = pkgs.writeText "snakeoil-user-cert.template" ''
-            organization = snakeoil
-            cn = server
-            expiration_days = -1
-            tls_www_client
-            encryption_key
-            signing_key
-          '';
-        }
-        ''
-          certtool -p --bits 4096 --outfile ca.key
-          certtool -s --template "$caTemplate" --load-privkey ca.key \
-                      --outfile "$cacert"
-          certtool -p --bits 4096 --outfile "$key"
-          certtool -c --template "$certTemplate" \
-                      --load-ca-privkey ca.key \
-                      --load-ca-certificate "$cacert" \
-                      --load-privkey "$key" \
-                      --outfile "$cert"
-          certtool --generate-crl --template "$crlTemplate" \
-                                  --load-ca-privkey ca.key \
-                                  --load-ca-certificate "$cacert" \
-                                  --outfile "$crl"
-
-          mkdir "$out"
-
-          # Stripping key information before the actual PEM-encoded values is solely
-          # to make test output a bit less verbose when copying the client key to the
-          # actual client.
-          certtool -p --bits 4096 | sed -n \
-            -e '/^----* *BEGIN/,/^----* *END/p' > "$out/alice.key"
-
-          certtool -c --template "$userCertTemplate" \
-                      --load-privkey "$out/alice.key" \
-                      --load-ca-privkey ca.key \
-                      --load-ca-certificate "$cacert" \
-                      --outfile "$out/alice.cert"
+{ pkgs, ... }:
+let
+  snakeOil =
+    pkgs.runCommand "snakeoil-certs"
+      {
+        outputs = [
+          "out"
+          "cacert"
+          "cert"
+          "key"
+          "crl"
+        ];
+        buildInputs = [ pkgs.gnutls.bin ];
+        caTemplate = pkgs.writeText "snakeoil-ca.template" ''
+          cn = server
+          expiration_days = -1
+          cert_signing_key
+          ca
         '';
+        certTemplate = pkgs.writeText "snakeoil-cert.template" ''
+          cn = server
+          expiration_days = -1
+          tls_www_server
+          encryption_key
+          signing_key
+        '';
+        crlTemplate = pkgs.writeText "snakeoil-crl.template" ''
+          expiration_days = -1
+        '';
+        userCertTemplate = pkgs.writeText "snakeoil-user-cert.template" ''
+          organization = snakeoil
+          cn = server
+          expiration_days = -1
+          tls_www_client
+          encryption_key
+          signing_key
+        '';
+      }
+      ''
+        certtool -p --bits 4096 --outfile ca.key
+        certtool -s --template "$caTemplate" --load-privkey ca.key \
+                    --outfile "$cacert"
+        certtool -p --bits 4096 --outfile "$key"
+        certtool -c --template "$certTemplate" \
+                    --load-ca-privkey ca.key \
+                    --load-ca-certificate "$cacert" \
+                    --load-privkey "$key" \
+                    --outfile "$cert"
+        certtool --generate-crl --template "$crlTemplate" \
+                                --load-ca-privkey ca.key \
+                                --load-ca-certificate "$cacert" \
+                                --outfile "$crl"
 
-  in
-  {
-    name = "taskserver";
+        mkdir "$out"
 
-    nodes = rec {
-      server = {
-        services.taskserver.enable = true;
-        services.taskserver.listenHost = "::";
-        services.taskserver.openFirewall = true;
-        services.taskserver.fqdn = "server";
-        services.taskserver.organisations = {
-          testOrganisation.users = [
-            "alice"
-            "foo"
-          ];
-          anotherOrganisation.users = [ "bob" ];
-        };
+        # Stripping key information before the actual PEM-encoded values is solely
+        # to make test output a bit less verbose when copying the client key to the
+        # actual client.
+        certtool -p --bits 4096 | sed -n \
+          -e '/^----* *BEGIN/,/^----* *END/p' > "$out/alice.key"
 
-        specialisation.manual_config.configuration = {
-          services.taskserver.pki.manual = {
-            ca.cert = snakeOil.cacert;
-            server.cert = snakeOil.cert;
-            server.key = snakeOil.key;
-            server.crl = snakeOil.crl;
-          };
-        };
+        certtool -c --template "$userCertTemplate" \
+                    --load-privkey "$out/alice.key" \
+                    --load-ca-privkey ca.key \
+                    --load-ca-certificate "$cacert" \
+                    --outfile "$out/alice.cert"
+      '';
+
+in
+{
+  name = "taskserver";
+
+  nodes = rec {
+    server = {
+      services.taskserver.enable = true;
+      services.taskserver.listenHost = "::";
+      services.taskserver.openFirewall = true;
+      services.taskserver.fqdn = "server";
+      services.taskserver.organisations = {
+        testOrganisation.users = [
+          "alice"
+          "foo"
+        ];
+        anotherOrganisation.users = [ "bob" ];
       };
 
-      client1 =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [
-            pkgs.taskwarrior2
-            pkgs.gnutls
-          ];
-          users.users.alice.isNormalUser = true;
-          users.users.bob.isNormalUser = true;
-          users.users.foo.isNormalUser = true;
-          users.users.bar.isNormalUser = true;
+      specialisation.manual_config.configuration = {
+        services.taskserver.pki.manual = {
+          ca.cert = snakeOil.cacert;
+          server.cert = snakeOil.cert;
+          server.key = snakeOil.key;
+          server.crl = snakeOil.crl;
         };
-
-      client2 = client1;
+      };
     };
 
-    testScript =
-      { nodes, ... }:
-      let
-        cfg = nodes.server.services.taskserver;
-        portStr = toString cfg.listenPort;
-        specialisations = "${nodes.server.system.build.toplevel}/specialisation";
-        newServerSystem = "${specialisations}/manual_config";
-        switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";
-      in
-      ''
-        from shlex import quote
+    client1 =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.taskwarrior2
+          pkgs.gnutls
+        ];
+        users.users.alice.isNormalUser = true;
+        users.users.bob.isNormalUser = true;
+        users.users.foo.isNormalUser = true;
+        users.users.bar.isNormalUser = true;
+      };
+
+    client2 = client1;
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      cfg = nodes.server.services.taskserver;
+      portStr = toString cfg.listenPort;
+      specialisations = "${nodes.server.system.build.toplevel}/specialisation";
+      newServerSystem = "${specialisations}/manual_config";
+      switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";
+    in
+    ''
+      from shlex import quote
 
 
-        def su(user, cmd):
-            return f"su - {user} -c {quote(cmd)}"
+      def su(user, cmd):
+          return f"su - {user} -c {quote(cmd)}"
 
 
-        def no_extra_init(client, org, user):
-            pass
+      def no_extra_init(client, org, user):
+          pass
 
 
-        def setup_clients_for(org, user, extra_init=no_extra_init):
-            for client in [client1, client2]:
-                with client.nested(f"initialize client for user {user}"):
-                    client.succeed(
-                        su(user, f"rm -rf /home/{user}/.task"),
-                        su(user, "task rc.confirmation=no config confirmation no"),
-                    )
+      def setup_clients_for(org, user, extra_init=no_extra_init):
+          for client in [client1, client2]:
+              with client.nested(f"initialize client for user {user}"):
+                  client.succeed(
+                      su(user, f"rm -rf /home/{user}/.task"),
+                      su(user, "task rc.confirmation=no config confirmation no"),
+                  )
 
-                    exportinfo = server.succeed(f"nixos-taskserver user export {org} {user}")
+                  exportinfo = server.succeed(f"nixos-taskserver user export {org} {user}")
 
-                    with client.nested("importing taskwarrior configuration"):
-                        client.succeed(su(user, f"eval {quote(exportinfo)} >&2"))
+                  with client.nested("importing taskwarrior configuration"):
+                      client.succeed(su(user, f"eval {quote(exportinfo)} >&2"))
 
-                    extra_init(client, org, user)
+                  extra_init(client, org, user)
 
-                    client.succeed(su(user, "task config taskd.server server:${portStr} >&2"))
+                  client.succeed(su(user, "task config taskd.server server:${portStr} >&2"))
 
-                    client.succeed(su(user, "task sync init >&2"))
+                  client.succeed(su(user, "task sync init >&2"))
 
 
-        def restart_server():
-            server.systemctl("restart taskserver.service")
-            server.wait_for_open_port(${portStr})
+      def restart_server():
+          server.systemctl("restart taskserver.service")
+          server.wait_for_open_port(${portStr})
 
 
-        def re_add_imperative_user():
-            with server.nested("(re-)add imperative user bar"):
-                server.execute("nixos-taskserver org remove imperativeOrg")
-                server.succeed(
-                    "nixos-taskserver org add imperativeOrg",
-                    "nixos-taskserver user add imperativeOrg bar",
-                )
-                setup_clients_for("imperativeOrg", "bar")
+      def re_add_imperative_user():
+          with server.nested("(re-)add imperative user bar"):
+              server.execute("nixos-taskserver org remove imperativeOrg")
+              server.succeed(
+                  "nixos-taskserver org add imperativeOrg",
+                  "nixos-taskserver user add imperativeOrg bar",
+              )
+              setup_clients_for("imperativeOrg", "bar")
 
 
-        def test_sync(user):
-            with subtest(f"sync for user {user}"):
-                client1.succeed(su(user, "task add foo >&2"))
-                client1.succeed(su(user, "task sync >&2"))
-                client2.fail(su(user, "task list >&2"))
-                client2.succeed(su(user, "task sync >&2"))
-                client2.succeed(su(user, "task list >&2"))
+      def test_sync(user):
+          with subtest(f"sync for user {user}"):
+              client1.succeed(su(user, "task add foo >&2"))
+              client1.succeed(su(user, "task sync >&2"))
+              client2.fail(su(user, "task list >&2"))
+              client2.succeed(su(user, "task sync >&2"))
+              client2.succeed(su(user, "task list >&2"))
 
 
-        def check_client_cert(user):
-            # debug level 3 is a workaround for gnutls issue https://gitlab.com/gnutls/gnutls/-/issues/1040
-            cmd = (
-                f"gnutls-cli -d 3"
-                f" --x509cafile=/home/{user}/.task/keys/ca.cert"
-                f" --x509keyfile=/home/{user}/.task/keys/private.key"
-                f" --x509certfile=/home/{user}/.task/keys/public.cert"
-                f" --port=${portStr} server < /dev/null"
-            )
-            return su(user, cmd)
+      def check_client_cert(user):
+          # debug level 3 is a workaround for gnutls issue https://gitlab.com/gnutls/gnutls/-/issues/1040
+          cmd = (
+              f"gnutls-cli -d 3"
+              f" --x509cafile=/home/{user}/.task/keys/ca.cert"
+              f" --x509keyfile=/home/{user}/.task/keys/private.key"
+              f" --x509certfile=/home/{user}/.task/keys/public.cert"
+              f" --port=${portStr} server < /dev/null"
+          )
+          return su(user, cmd)
 
 
-        # Explicitly start the VMs so that we don't accidentally start newServer
-        server.start()
-        client1.start()
-        client2.start()
+      # Explicitly start the VMs so that we don't accidentally start newServer
+      server.start()
+      client1.start()
+      client2.start()
 
-        server.wait_for_unit("taskserver.service")
+      server.wait_for_unit("taskserver.service")
 
-        server.succeed(
-            "nixos-taskserver user list testOrganisation | grep -qxF alice",
-            "nixos-taskserver user list testOrganisation | grep -qxF foo",
-            "nixos-taskserver user list anotherOrganisation | grep -qxF bob",
-        )
+      server.succeed(
+          "nixos-taskserver user list testOrganisation | grep -qxF alice",
+          "nixos-taskserver user list testOrganisation | grep -qxF foo",
+          "nixos-taskserver user list anotherOrganisation | grep -qxF bob",
+      )
 
-        server.wait_for_open_port(${portStr})
+      server.wait_for_open_port(${portStr})
 
-        client1.wait_for_unit("multi-user.target")
-        client2.wait_for_unit("multi-user.target")
+      client1.wait_for_unit("multi-user.target")
+      client2.wait_for_unit("multi-user.target")
 
-        setup_clients_for("testOrganisation", "alice")
-        setup_clients_for("testOrganisation", "foo")
-        setup_clients_for("anotherOrganisation", "bob")
+      setup_clients_for("testOrganisation", "alice")
+      setup_clients_for("testOrganisation", "foo")
+      setup_clients_for("anotherOrganisation", "bob")
 
-        for user in ["alice", "bob", "foo"]:
-            test_sync(user)
+      for user in ["alice", "bob", "foo"]:
+          test_sync(user)
 
-        server.fail("nixos-taskserver user add imperativeOrg bar")
-        re_add_imperative_user()
+      server.fail("nixos-taskserver user add imperativeOrg bar")
+      re_add_imperative_user()
 
-        test_sync("bar")
+      test_sync("bar")
 
-        with subtest("checking certificate revocation of user bar"):
-            client1.succeed(check_client_cert("bar"))
+      with subtest("checking certificate revocation of user bar"):
+          client1.succeed(check_client_cert("bar"))
 
-            server.succeed("nixos-taskserver user remove imperativeOrg bar")
-            restart_server()
+          server.succeed("nixos-taskserver user remove imperativeOrg bar")
+          restart_server()
 
-            client1.fail(check_client_cert("bar"))
+          client1.fail(check_client_cert("bar"))
 
-            client1.succeed(su("bar", "task add destroy everything >&2"))
-            client1.fail(su("bar", "task sync >&2"))
+          client1.succeed(su("bar", "task add destroy everything >&2"))
+          client1.fail(su("bar", "task sync >&2"))
 
-        re_add_imperative_user()
+      re_add_imperative_user()
 
-        with subtest("checking certificate revocation of org imperativeOrg"):
-            client1.succeed(check_client_cert("bar"))
+      with subtest("checking certificate revocation of org imperativeOrg"):
+          client1.succeed(check_client_cert("bar"))
 
-            server.succeed("nixos-taskserver org remove imperativeOrg")
-            restart_server()
+          server.succeed("nixos-taskserver org remove imperativeOrg")
+          restart_server()
 
-            client1.fail(check_client_cert("bar"))
+          client1.fail(check_client_cert("bar"))
 
-            client1.succeed(su("bar", "task add destroy even more >&2"))
-            client1.fail(su("bar", "task sync >&2"))
+          client1.succeed(su("bar", "task add destroy even more >&2"))
+          client1.fail(su("bar", "task sync >&2"))
 
-        re_add_imperative_user()
+      re_add_imperative_user()
 
-        with subtest("check whether declarative config overrides user bar"):
-            restart_server()
-            test_sync("bar")
+      with subtest("check whether declarative config overrides user bar"):
+          restart_server()
+          test_sync("bar")
 
 
-        def init_manual_config(client, org, user):
-            cfgpath = f"/home/{user}/.task"
+      def init_manual_config(client, org, user):
+          cfgpath = f"/home/{user}/.task"
 
-            client.copy_from_host(
-                "${snakeOil.cacert}",
-                f"{cfgpath}/ca.cert",
-            )
-            for file in ["alice.key", "alice.cert"]:
-                client.copy_from_host(
-                    f"${snakeOil}/{file}",
-                    f"{cfgpath}/{file}",
-                )
+          client.copy_from_host(
+              "${snakeOil.cacert}",
+              f"{cfgpath}/ca.cert",
+          )
+          for file in ["alice.key", "alice.cert"]:
+              client.copy_from_host(
+                  f"${snakeOil}/{file}",
+                  f"{cfgpath}/{file}",
+              )
 
-            for file in [f"{user}.key", f"{user}.cert"]:
-                client.copy_from_host(
-                    f"${snakeOil}/{file}",
-                    f"{cfgpath}/{file}",
-                )
+          for file in [f"{user}.key", f"{user}.cert"]:
+              client.copy_from_host(
+                  f"${snakeOil}/{file}",
+                  f"{cfgpath}/{file}",
+              )
 
-            client.succeed(
-                su("alice", f"task config taskd.ca {cfgpath}/ca.cert"),
-                su("alice", f"task config taskd.key {cfgpath}/{user}.key"),
-                su(user, f"task config taskd.certificate {cfgpath}/{user}.cert"),
-            )
+          client.succeed(
+              su("alice", f"task config taskd.ca {cfgpath}/ca.cert"),
+              su("alice", f"task config taskd.key {cfgpath}/{user}.key"),
+              su(user, f"task config taskd.certificate {cfgpath}/{user}.cert"),
+          )
 
 
-        with subtest("check manual configuration"):
-            # Remove the keys from automatic CA creation, to make sure the new
-            # generation doesn't use keys from before.
-            server.succeed("rm -rf ${cfg.dataDir}/keys/* >&2")
+      with subtest("check manual configuration"):
+          # Remove the keys from automatic CA creation, to make sure the new
+          # generation doesn't use keys from before.
+          server.succeed("rm -rf ${cfg.dataDir}/keys/* >&2")
 
-            server.succeed(
-                "${switchToNewServer} >&2"
-            )
-            server.wait_for_unit("taskserver.service")
-            server.wait_for_open_port(${portStr})
+          server.succeed(
+              "${switchToNewServer} >&2"
+          )
+          server.wait_for_unit("taskserver.service")
+          server.wait_for_open_port(${portStr})
 
-            server.succeed(
-                "nixos-taskserver org add manualOrg",
-                "nixos-taskserver user add manualOrg alice",
-            )
+          server.succeed(
+              "nixos-taskserver org add manualOrg",
+              "nixos-taskserver user add manualOrg alice",
+          )
 
-            setup_clients_for("manualOrg", "alice", init_manual_config)
+          setup_clients_for("manualOrg", "alice", init_manual_config)
 
-            test_sync("alice")
-      '';
-  }
-)
+          test_sync("alice")
+    '';
+}
diff --git a/nixos/tests/tayga.nix b/nixos/tests/tayga.nix
index bd60b51449b8..32512224bb58 100644
--- a/nixos/tests/tayga.nix
+++ b/nixos/tests/tayga.nix
@@ -22,257 +22,255 @@
 #        |         Route:   192.0.2.0/24 via 100.64.0.1
 #        +------
 
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  {
-    name = "tayga";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ hax404 ];
+{
+  name = "tayga";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ hax404 ];
+  };
+
+  nodes = {
+    # The server is configured with static IPv4 addresses. RFC 6052 Section 3.1
+    # disallows the mapping of non-global IPv4 addresses like RFC 1918 into the
+    # Well-Known Prefix 64:ff9b::/96. TAYGA also does not allow the mapping of
+    # documentation space (RFC 5737). To circumvent this, 100.64.0.2/24 from
+    # RFC 6589 (Carrier Grade NAT) is used here.
+    # To reach the IPv4 address pool of the NAT64 gateway, there is a static
+    # route configured. In normal cases, where the router would also source NAT
+    # the pool addresses to one IPv4 addresses, this would not be needed.
+    server = {
+      virtualisation.vlans = [
+        2 # towards router
+      ];
+      networking = {
+        useDHCP = false;
+        interfaces.eth1 = lib.mkForce { };
+      };
+      systemd.network = {
+        enable = true;
+        networks."vlan1" = {
+          matchConfig.Name = "eth1";
+          address = [
+            "100.64.0.2/24"
+          ];
+          routes = [
+            {
+              Destination = "192.0.2.0/24";
+              Gateway = "100.64.0.1";
+            }
+          ];
+        };
+      };
+      programs.mtr.enable = true;
     };
 
-    nodes = {
-      # The server is configured with static IPv4 addresses. RFC 6052 Section 3.1
-      # disallows the mapping of non-global IPv4 addresses like RFC 1918 into the
-      # Well-Known Prefix 64:ff9b::/96. TAYGA also does not allow the mapping of
-      # documentation space (RFC 5737). To circumvent this, 100.64.0.2/24 from
-      # RFC 6589 (Carrier Grade NAT) is used here.
-      # To reach the IPv4 address pool of the NAT64 gateway, there is a static
-      # route configured. In normal cases, where the router would also source NAT
-      # the pool addresses to one IPv4 addresses, this would not be needed.
-      server = {
-        virtualisation.vlans = [
-          2 # towards router
-        ];
-        networking = {
-          useDHCP = false;
-          interfaces.eth1 = lib.mkForce { };
-        };
-        systemd.network = {
-          enable = true;
-          networks."vlan1" = {
-            matchConfig.Name = "eth1";
-            address = [
-              "100.64.0.2/24"
-            ];
-            routes = [
+    # The router is configured with static IPv4 addresses towards the server
+    # and IPv6 addresses towards the client. For NAT64, the Well-Known prefix
+    # 64:ff9b::/96 is used. NAT64 is done with TAYGA which provides the
+    # tun-interface nat64 and does the translation over it. The IPv6 packets
+    # are sent to this interfaces and received as IPv4 packets and vice versa.
+    # As TAYGA only translates IPv6 addresses to dedicated IPv4 addresses, it
+    # needs a pool of IPv4 addresses which must be at least as big as the
+    # expected amount of clients. In this test, the packets from the pool are
+    # directly routed towards the client. In normal cases, there would be a
+    # second source NAT44 to map all clients behind one IPv4 address.
+    router_systemd = {
+      boot.kernel.sysctl = {
+        "net.ipv4.ip_forward" = 1;
+        "net.ipv6.conf.all.forwarding" = 1;
+      };
+
+      virtualisation.vlans = [
+        2 # towards server
+        3 # towards client
+      ];
+
+      networking = {
+        useDHCP = false;
+        useNetworkd = true;
+        firewall.enable = false;
+        interfaces.eth1 = lib.mkForce {
+          ipv4 = {
+            addresses = [
               {
-                Destination = "192.0.2.0/24";
-                Gateway = "100.64.0.1";
+                address = "100.64.0.1";
+                prefixLength = 24;
               }
             ];
           };
         };
-        programs.mtr.enable = true;
-      };
-
-      # The router is configured with static IPv4 addresses towards the server
-      # and IPv6 addresses towards the client. For NAT64, the Well-Known prefix
-      # 64:ff9b::/96 is used. NAT64 is done with TAYGA which provides the
-      # tun-interface nat64 and does the translation over it. The IPv6 packets
-      # are sent to this interfaces and received as IPv4 packets and vice versa.
-      # As TAYGA only translates IPv6 addresses to dedicated IPv4 addresses, it
-      # needs a pool of IPv4 addresses which must be at least as big as the
-      # expected amount of clients. In this test, the packets from the pool are
-      # directly routed towards the client. In normal cases, there would be a
-      # second source NAT44 to map all clients behind one IPv4 address.
-      router_systemd = {
-        boot.kernel.sysctl = {
-          "net.ipv4.ip_forward" = 1;
-          "net.ipv6.conf.all.forwarding" = 1;
-        };
-
-        virtualisation.vlans = [
-          2 # towards server
-          3 # towards client
-        ];
-
-        networking = {
-          useDHCP = false;
-          useNetworkd = true;
-          firewall.enable = false;
-          interfaces.eth1 = lib.mkForce {
-            ipv4 = {
-              addresses = [
-                {
-                  address = "100.64.0.1";
-                  prefixLength = 24;
-                }
-              ];
-            };
-          };
-          interfaces.eth2 = lib.mkForce {
-            ipv6 = {
-              addresses = [
-                {
-                  address = "2001:db8::1";
-                  prefixLength = 64;
-                }
-              ];
-            };
-          };
-        };
-
-        services.tayga = {
-          enable = true;
-          ipv4 = {
-            address = "192.0.2.0";
-            router = {
-              address = "192.0.2.1";
-            };
-            pool = {
-              address = "192.0.2.0";
-              prefixLength = 24;
-            };
-          };
+        interfaces.eth2 = lib.mkForce {
           ipv6 = {
-            address = "2001:db8::1";
-            router = {
-              address = "64:ff9b::1";
-            };
-            pool = {
-              address = "64:ff9b::";
-              prefixLength = 96;
-            };
-          };
-          mappings = {
-            "192.0.2.42" = "2001:db8::2";
-          };
-        };
-      };
-
-      router_nixos = {
-        boot.kernel.sysctl = {
-          "net.ipv4.ip_forward" = 1;
-          "net.ipv6.conf.all.forwarding" = 1;
-        };
-
-        virtualisation.vlans = [
-          2 # towards server
-          3 # towards client
-        ];
-
-        networking = {
-          useDHCP = false;
-          firewall.enable = false;
-          interfaces.eth1 = lib.mkForce {
-            ipv4 = {
-              addresses = [
-                {
-                  address = "100.64.0.1";
-                  prefixLength = 24;
-                }
-              ];
-            };
-          };
-          interfaces.eth2 = lib.mkForce {
-            ipv6 = {
-              addresses = [
-                {
-                  address = "2001:db8::1";
-                  prefixLength = 64;
-                }
-              ];
-            };
-          };
-        };
-
-        services.tayga = {
-          enable = true;
-          ipv4 = {
-            address = "192.0.2.0";
-            router = {
-              address = "192.0.2.1";
-            };
-            pool = {
-              address = "192.0.2.0";
-              prefixLength = 24;
-            };
-          };
-          ipv6 = {
-            address = "2001:db8::1";
-            router = {
-              address = "64:ff9b::1";
-            };
-            pool = {
-              address = "64:ff9b::";
-              prefixLength = 96;
-            };
-          };
-          mappings = {
-            "192.0.2.42" = "2001:db8::2";
-          };
-        };
-      };
-
-      # The client is configured with static IPv6 addresses. It has also a static
-      # route for the NAT64 IP space where the IPv4 addresses are mapped in. In
-      # normal cases, there would be only a default route.
-      client = {
-        virtualisation.vlans = [
-          3 # towards router
-        ];
-
-        networking = {
-          useDHCP = false;
-          interfaces.eth1 = lib.mkForce { };
-        };
-
-        systemd.network = {
-          enable = true;
-          networks."vlan1" = {
-            matchConfig.Name = "eth1";
-            address = [
-              "2001:db8::2/64"
-            ];
-            routes = [
+            addresses = [
               {
-                Destination = "64:ff9b::/96";
-                Gateway = "2001:db8::1";
+                address = "2001:db8::1";
+                prefixLength = 64;
               }
             ];
           };
         };
-        programs.mtr.enable = true;
+      };
+
+      services.tayga = {
+        enable = true;
+        ipv4 = {
+          address = "192.0.2.0";
+          router = {
+            address = "192.0.2.1";
+          };
+          pool = {
+            address = "192.0.2.0";
+            prefixLength = 24;
+          };
+        };
+        ipv6 = {
+          address = "2001:db8::1";
+          router = {
+            address = "64:ff9b::1";
+          };
+          pool = {
+            address = "64:ff9b::";
+            prefixLength = 96;
+          };
+        };
+        mappings = {
+          "192.0.2.42" = "2001:db8::2";
+        };
       };
     };
 
-    testScript = ''
-      # start client and server
-      for machine in client, server:
-        machine.systemctl("start network-online.target")
-        machine.wait_for_unit("network-online.target")
-        machine.log(machine.execute("ip addr")[1])
-        machine.log(machine.execute("ip route")[1])
-        machine.log(machine.execute("ip -6 route")[1])
+    router_nixos = {
+      boot.kernel.sysctl = {
+        "net.ipv4.ip_forward" = 1;
+        "net.ipv6.conf.all.forwarding" = 1;
+      };
 
-      # test systemd-networkd and nixos-scripts based router
-      for router in router_systemd, router_nixos:
-        router.start()
-        router.systemctl("start network-online.target")
-        router.wait_for_unit("network-online.target")
+      virtualisation.vlans = [
+        2 # towards server
+        3 # towards client
+      ];
+
+      networking = {
+        useDHCP = false;
+        firewall.enable = false;
+        interfaces.eth1 = lib.mkForce {
+          ipv4 = {
+            addresses = [
+              {
+                address = "100.64.0.1";
+                prefixLength = 24;
+              }
+            ];
+          };
+        };
+        interfaces.eth2 = lib.mkForce {
+          ipv6 = {
+            addresses = [
+              {
+                address = "2001:db8::1";
+                prefixLength = 64;
+              }
+            ];
+          };
+        };
+      };
+
+      services.tayga = {
+        enable = true;
+        ipv4 = {
+          address = "192.0.2.0";
+          router = {
+            address = "192.0.2.1";
+          };
+          pool = {
+            address = "192.0.2.0";
+            prefixLength = 24;
+          };
+        };
+        ipv6 = {
+          address = "2001:db8::1";
+          router = {
+            address = "64:ff9b::1";
+          };
+          pool = {
+            address = "64:ff9b::";
+            prefixLength = 96;
+          };
+        };
+        mappings = {
+          "192.0.2.42" = "2001:db8::2";
+        };
+      };
+    };
+
+    # The client is configured with static IPv6 addresses. It has also a static
+    # route for the NAT64 IP space where the IPv4 addresses are mapped in. In
+    # normal cases, there would be only a default route.
+    client = {
+      virtualisation.vlans = [
+        3 # towards router
+      ];
+
+      networking = {
+        useDHCP = false;
+        interfaces.eth1 = lib.mkForce { };
+      };
+
+      systemd.network = {
+        enable = true;
+        networks."vlan1" = {
+          matchConfig.Name = "eth1";
+          address = [
+            "2001:db8::2/64"
+          ];
+          routes = [
+            {
+              Destination = "64:ff9b::/96";
+              Gateway = "2001:db8::1";
+            }
+          ];
+        };
+      };
+      programs.mtr.enable = true;
+    };
+  };
+
+  testScript = ''
+    # start client and server
+    for machine in client, server:
+      machine.systemctl("start network-online.target")
+      machine.wait_for_unit("network-online.target")
+      machine.log(machine.execute("ip addr")[1])
+      machine.log(machine.execute("ip route")[1])
+      machine.log(machine.execute("ip -6 route")[1])
+
+    # test systemd-networkd and nixos-scripts based router
+    for router in router_systemd, router_nixos:
+      router.start()
+      router.systemctl("start network-online.target")
+      router.wait_for_unit("network-online.target")
+      router.wait_for_unit("tayga.service")
+      router.log(machine.execute("ip addr")[1])
+      router.log(machine.execute("ip route")[1])
+      router.log(machine.execute("ip -6 route")[1])
+
+      with subtest("Wait for tayga"):
         router.wait_for_unit("tayga.service")
-        router.log(machine.execute("ip addr")[1])
-        router.log(machine.execute("ip route")[1])
-        router.log(machine.execute("ip -6 route")[1])
 
-        with subtest("Wait for tayga"):
-          router.wait_for_unit("tayga.service")
+      with subtest("Test ICMP server -> client"):
+        server.wait_until_succeeds("ping -c 3 192.0.2.42 >&2")
 
-        with subtest("Test ICMP server -> client"):
-          server.wait_until_succeeds("ping -c 3 192.0.2.42 >&2")
+      with subtest("Test ICMP and show a traceroute server -> client"):
+        server.wait_until_succeeds("mtr --show-ips --report-wide 192.0.2.42 >&2")
 
-        with subtest("Test ICMP and show a traceroute server -> client"):
-          server.wait_until_succeeds("mtr --show-ips --report-wide 192.0.2.42 >&2")
+      with subtest("Test ICMP client -> server"):
+        client.wait_until_succeeds("ping -c 3 64:ff9b::100.64.0.2 >&2")
 
-        with subtest("Test ICMP client -> server"):
-          client.wait_until_succeeds("ping -c 3 64:ff9b::100.64.0.2 >&2")
+      with subtest("Test ICMP and show a traceroute client -> server"):
+        client.wait_until_succeeds("mtr --show-ips --report-wide 64:ff9b::100.64.0.2 >&2")
 
-        with subtest("Test ICMP and show a traceroute client -> server"):
-          client.wait_until_succeeds("mtr --show-ips --report-wide 64:ff9b::100.64.0.2 >&2")
-
-        router.log(router.execute("systemd-analyze security tayga.service")[1])
-        router.shutdown()
-    '';
-  }
-)
+      router.log(router.execute("systemd-analyze security tayga.service")[1])
+      router.shutdown()
+  '';
+}
diff --git a/nixos/tests/technitium-dns-server.nix b/nixos/tests/technitium-dns-server.nix
index dbe8fac5d354..7ac06371ead9 100644
--- a/nixos/tests/technitium-dns-server.nix
+++ b/nixos/tests/technitium-dns-server.nix
@@ -1,31 +1,29 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "technitium-dns-server";
+{ pkgs, lib, ... }:
+{
+  name = "technitium-dns-server";
 
-    nodes = {
-      machine =
-        { pkgs, ... }:
-        {
-          services.technitium-dns-server = {
-            enable = true;
-            openFirewall = true;
-          };
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.technitium-dns-server = {
+          enable = true;
+          openFirewall = true;
         };
-    };
+      };
+  };
 
-    testScript = ''
-      import json
+  testScript = ''
+    import json
 
-      start_all()
-      machine.wait_for_unit("technitium-dns-server.service")
-      machine.wait_for_open_port(53)
-      curl_cmd = 'curl --fail-with-body -X GET "http://localhost:5380/api/user/login?user=admin&pass=admin"'
-      output = json.loads(machine.wait_until_succeeds(curl_cmd, timeout=10))
-      print(output)
-      assert "ok" == output['status'], "status not ok"
-    '';
+    start_all()
+    machine.wait_for_unit("technitium-dns-server.service")
+    machine.wait_for_open_port(53)
+    curl_cmd = 'curl --fail-with-body -X GET "http://localhost:5380/api/user/login?user=admin&pass=admin"'
+    output = json.loads(machine.wait_until_succeeds(curl_cmd, timeout=10))
+    print(output)
+    assert "ok" == output['status'], "status not ok"
+  '';
 
-    meta.maintainers = with lib.maintainers; [ fabianrig ];
-  }
-)
+  meta.maintainers = with lib.maintainers; [ fabianrig ];
+}
diff --git a/nixos/tests/teeworlds.nix b/nixos/tests/teeworlds.nix
index 7c94f66a2b20..9b0c39d12235 100644
--- a/nixos/tests/teeworlds.nix
+++ b/nixos/tests/teeworlds.nix
@@ -1,58 +1,56 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    client =
-      { pkgs, ... }:
+let
+  client =
+    { pkgs, ... }:
 
-      {
-        imports = [ ./common/x11.nix ];
-        environment.systemPackages = [ pkgs.teeworlds ];
-      };
-
-  in
-  {
-    name = "teeworlds";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ hax404 ];
+    {
+      imports = [ ./common/x11.nix ];
+      environment.systemPackages = [ pkgs.teeworlds ];
     };
 
-    nodes = {
-      server = {
-        services.teeworlds = {
-          enable = true;
-          openPorts = true;
-        };
-      };
+in
+{
+  name = "teeworlds";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ hax404 ];
+  };
 
-      client1 = client;
-      client2 = client;
+  nodes = {
+    server = {
+      services.teeworlds = {
+        enable = true;
+        openPorts = true;
+      };
     };
 
-    testScript = ''
-      start_all()
+    client1 = client;
+    client2 = client;
+  };
 
-      server.wait_for_unit("teeworlds.service")
-      server.wait_until_succeeds("ss --numeric --udp --listening | grep -q 8303")
+  testScript = ''
+    start_all()
 
-      client1.wait_for_x()
-      client2.wait_for_x()
+    server.wait_for_unit("teeworlds.service")
+    server.wait_until_succeeds("ss --numeric --udp --listening | grep -q 8303")
 
-      client1.execute("teeworlds 'player_name Alice;connect server' >&2 &")
-      server.wait_until_succeeds(
-          'journalctl -u teeworlds -e | grep --extended-regexp -q "team_join player=\'[0-9]:Alice"'
-      )
+    client1.wait_for_x()
+    client2.wait_for_x()
 
-      client2.execute("teeworlds 'player_name Bob;connect server' >&2 &")
-      server.wait_until_succeeds(
-          'journalctl -u teeworlds -e | grep --extended-regexp -q "team_join player=\'[0-9]:Bob"'
-      )
+    client1.execute("teeworlds 'player_name Alice;connect server' >&2 &")
+    server.wait_until_succeeds(
+        'journalctl -u teeworlds -e | grep --extended-regexp -q "team_join player=\'[0-9]:Alice"'
+    )
 
-      server.sleep(10)  # wait for a while to get a nice screenshot
+    client2.execute("teeworlds 'player_name Bob;connect server' >&2 &")
+    server.wait_until_succeeds(
+        'journalctl -u teeworlds -e | grep --extended-regexp -q "team_join player=\'[0-9]:Bob"'
+    )
 
-      client1.screenshot("screen_client1")
-      client2.screenshot("screen_client2")
-    '';
+    server.sleep(10)  # wait for a while to get a nice screenshot
 
-  }
-)
+    client1.screenshot("screen_client1")
+    client2.screenshot("screen_client2")
+  '';
+
+}
diff --git a/nixos/tests/tiddlywiki.nix b/nixos/tests/tiddlywiki.nix
index b52bc385f7f3..3473c8a8e910 100644
--- a/nixos/tests/tiddlywiki.nix
+++ b/nixos/tests/tiddlywiki.nix
@@ -1,71 +1,69 @@
-import ./make-test-python.nix (
-  { ... }:
-  {
-    name = "tiddlywiki";
-    nodes = {
-      default = {
-        services.tiddlywiki.enable = true;
-      };
-      configured = {
-        boot.postBootCommands = ''
-          echo "username,password
-          somelogin,somesecret" > /var/lib/wikiusers.csv
-        '';
-        services.tiddlywiki = {
-          enable = true;
-          listenOptions = {
-            port = 3000;
-            credentials = "../wikiusers.csv";
-            readers = "(authenticated)";
-          };
+{ ... }:
+{
+  name = "tiddlywiki";
+  nodes = {
+    default = {
+      services.tiddlywiki.enable = true;
+    };
+    configured = {
+      boot.postBootCommands = ''
+        echo "username,password
+        somelogin,somesecret" > /var/lib/wikiusers.csv
+      '';
+      services.tiddlywiki = {
+        enable = true;
+        listenOptions = {
+          port = 3000;
+          credentials = "../wikiusers.csv";
+          readers = "(authenticated)";
         };
       };
     };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      with subtest("by default works without configuration"):
-          default.wait_for_unit("tiddlywiki.service")
+    with subtest("by default works without configuration"):
+        default.wait_for_unit("tiddlywiki.service")
 
-      with subtest("by default available on port 8080 without auth"):
-          default.wait_for_unit("tiddlywiki.service")
-          default.wait_for_open_port(8080)
-          # we output to /dev/null here to avoid a python UTF-8 decode error
-          # but the check will still fail if the service doesn't respond
-          default.succeed("curl --fail -o /dev/null 127.0.0.1:8080")
+    with subtest("by default available on port 8080 without auth"):
+        default.wait_for_unit("tiddlywiki.service")
+        default.wait_for_open_port(8080)
+        # we output to /dev/null here to avoid a python UTF-8 decode error
+        # but the check will still fail if the service doesn't respond
+        default.succeed("curl --fail -o /dev/null 127.0.0.1:8080")
 
-      with subtest("by default creates empty wiki"):
-          default.succeed("test -f /var/lib/tiddlywiki/tiddlywiki.info")
+    with subtest("by default creates empty wiki"):
+        default.succeed("test -f /var/lib/tiddlywiki/tiddlywiki.info")
 
-      with subtest("configured on port 3000 with basic auth"):
-          configured.wait_for_unit("tiddlywiki.service")
-          configured.wait_for_open_port(3000)
-          configured.fail("curl --fail -o /dev/null 127.0.0.1:3000")
-          configured.succeed(
-              "curl --fail -o /dev/null 127.0.0.1:3000 --user somelogin:somesecret"
-          )
+    with subtest("configured on port 3000 with basic auth"):
+        configured.wait_for_unit("tiddlywiki.service")
+        configured.wait_for_open_port(3000)
+        configured.fail("curl --fail -o /dev/null 127.0.0.1:3000")
+        configured.succeed(
+            "curl --fail -o /dev/null 127.0.0.1:3000 --user somelogin:somesecret"
+        )
 
-      with subtest("restart preserves changes"):
-          # given running wiki
-          default.wait_for_unit("tiddlywiki.service")
-          # with some changes
-          default.succeed(
-              'curl --fail --request PUT --header \'X-Requested-With:TiddlyWiki\' \
-              --data \'{ "title": "title", "text": "content" }\' \
-              --url 127.0.0.1:8080/recipes/default/tiddlers/somepage '
-          )
-          default.succeed("sleep 2")
+    with subtest("restart preserves changes"):
+        # given running wiki
+        default.wait_for_unit("tiddlywiki.service")
+        # with some changes
+        default.succeed(
+            'curl --fail --request PUT --header \'X-Requested-With:TiddlyWiki\' \
+            --data \'{ "title": "title", "text": "content" }\' \
+            --url 127.0.0.1:8080/recipes/default/tiddlers/somepage '
+        )
+        default.succeed("sleep 2")
 
-          # when wiki is cycled
-          default.systemctl("restart tiddlywiki.service")
-          default.wait_for_unit("tiddlywiki.service")
-          default.wait_for_open_port(8080)
+        # when wiki is cycled
+        default.systemctl("restart tiddlywiki.service")
+        default.wait_for_unit("tiddlywiki.service")
+        default.wait_for_open_port(8080)
 
-          # the change is preserved
-          default.succeed(
-              "curl --fail -o /dev/null 127.0.0.1:8080/recipes/default/tiddlers/somepage"
-          )
-    '';
-  }
-)
+        # the change is preserved
+        default.succeed(
+            "curl --fail -o /dev/null 127.0.0.1:8080/recipes/default/tiddlers/somepage"
+        )
+  '';
+}
diff --git a/nixos/tests/timezone.nix b/nixos/tests/timezone.nix
index 86de47204ae8..3a16c9de4887 100644
--- a/nixos/tests/timezone.nix
+++ b/nixos/tests/timezone.nix
@@ -1,59 +1,57 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "timezone";
-    meta.maintainers = with pkgs.lib.maintainers; [ ];
+{ pkgs, ... }:
+{
+  name = "timezone";
+  meta.maintainers = with pkgs.lib.maintainers; [ ];
 
-    nodes = {
-      node_eutz =
-        { pkgs, ... }:
-        {
-          time.timeZone = "Europe/Amsterdam";
-        };
+  nodes = {
+    node_eutz =
+      { pkgs, ... }:
+      {
+        time.timeZone = "Europe/Amsterdam";
+      };
 
-      node_nulltz =
-        { pkgs, ... }:
-        {
-          time.timeZone = null;
-        };
-    };
+    node_nulltz =
+      { pkgs, ... }:
+      {
+        time.timeZone = null;
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        node_eutz.wait_for_unit("dbus.socket")
+  testScript =
+    { nodes, ... }:
+    ''
+      node_eutz.wait_for_unit("dbus.socket")
 
-        with subtest("static - Ensure timezone change gives the correct result"):
-            node_eutz.fail("timedatectl set-timezone Asia/Tokyo")
-            date_result = node_eutz.succeed('date -d @0 "+%Y-%m-%d %H:%M:%S"')
-            assert date_result == "1970-01-01 01:00:00\n", "Timezone seems to be wrong"
+      with subtest("static - Ensure timezone change gives the correct result"):
+          node_eutz.fail("timedatectl set-timezone Asia/Tokyo")
+          date_result = node_eutz.succeed('date -d @0 "+%Y-%m-%d %H:%M:%S"')
+          assert date_result == "1970-01-01 01:00:00\n", "Timezone seems to be wrong"
 
-        node_nulltz.wait_for_unit("dbus.socket")
+      node_nulltz.wait_for_unit("dbus.socket")
 
-        with subtest("imperative - Ensure timezone defaults to UTC"):
-            date_result = node_nulltz.succeed('date -d @0 "+%Y-%m-%d %H:%M:%S"')
-            print(date_result)
-            assert (
-                date_result == "1970-01-01 00:00:00\n"
-            ), "Timezone seems to be wrong (not UTC)"
+      with subtest("imperative - Ensure timezone defaults to UTC"):
+          date_result = node_nulltz.succeed('date -d @0 "+%Y-%m-%d %H:%M:%S"')
+          print(date_result)
+          assert (
+              date_result == "1970-01-01 00:00:00\n"
+          ), "Timezone seems to be wrong (not UTC)"
 
-        with subtest("imperative - Ensure timezone adjustment produces expected result"):
-            node_nulltz.succeed("timedatectl set-timezone Asia/Tokyo")
+      with subtest("imperative - Ensure timezone adjustment produces expected result"):
+          node_nulltz.succeed("timedatectl set-timezone Asia/Tokyo")
 
-            # Adjustment should be taken into account
-            date_result = node_nulltz.succeed('date -d @0 "+%Y-%m-%d %H:%M:%S"')
-            print(date_result)
-            assert date_result == "1970-01-01 09:00:00\n", "Timezone was not adjusted"
+          # Adjustment should be taken into account
+          date_result = node_nulltz.succeed('date -d @0 "+%Y-%m-%d %H:%M:%S"')
+          print(date_result)
+          assert date_result == "1970-01-01 09:00:00\n", "Timezone was not adjusted"
 
-        with subtest("imperative - Ensure timezone adjustment persists across reboot"):
-            # Adjustment should persist across a reboot
-            node_nulltz.shutdown()
-            node_nulltz.wait_for_unit("dbus.socket")
-            date_result = node_nulltz.succeed('date -d @0 "+%Y-%m-%d %H:%M:%S"')
-            print(date_result)
-            assert (
-                date_result == "1970-01-01 09:00:00\n"
-            ), "Timezone adjustment was not persisted"
-      '';
-  }
-)
+      with subtest("imperative - Ensure timezone adjustment persists across reboot"):
+          # Adjustment should persist across a reboot
+          node_nulltz.shutdown()
+          node_nulltz.wait_for_unit("dbus.socket")
+          date_result = node_nulltz.succeed('date -d @0 "+%Y-%m-%d %H:%M:%S"')
+          print(date_result)
+          assert (
+              date_result == "1970-01-01 09:00:00\n"
+          ), "Timezone adjustment was not persisted"
+    '';
+}
diff --git a/nixos/tests/tinydns.nix b/nixos/tests/tinydns.nix
index 74f5a9413752..fc07983f529a 100644
--- a/nixos/tests/tinydns.nix
+++ b/nixos/tests/tinydns.nix
@@ -1,46 +1,44 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "tinydns";
-    meta = {
-      maintainers = with lib.maintainers; [ basvandijk ];
-    };
-    nodes = {
-      nameserver =
-        { config, lib, ... }:
-        let
-          ip = (lib.head config.networking.interfaces.eth1.ipv4.addresses).address;
-        in
-        {
-          networking.nameservers = [ ip ];
-          services.tinydns = {
-            enable = true;
-            inherit ip;
-            data = ''
-              .foo.bar:${ip}
-              +.bla.foo.bar:1.2.3.4:300
-            '';
-          };
+{ lib, ... }:
+{
+  name = "tinydns";
+  meta = {
+    maintainers = with lib.maintainers; [ basvandijk ];
+  };
+  nodes = {
+    nameserver =
+      { config, lib, ... }:
+      let
+        ip = (lib.head config.networking.interfaces.eth1.ipv4.addresses).address;
+      in
+      {
+        networking.nameservers = [ ip ];
+        services.tinydns = {
+          enable = true;
+          inherit ip;
+          data = ''
+            .foo.bar:${ip}
+            +.bla.foo.bar:1.2.3.4:300
+          '';
         };
-    };
-    testScript = ''
-      nameserver.start()
-      nameserver.wait_for_unit("tinydns.service")
+      };
+  };
+  testScript = ''
+    nameserver.start()
+    nameserver.wait_for_unit("tinydns.service")
 
-      # We query tinydns a few times to trigger the bug:
-      #
-      #   nameserver # [    6.105872] mmap: tinydns (842): VmData 331776 exceed data ulimit 300000. Update limits or use boot option ignore_rlimit_data.
-      #
-      # which was reported in https://github.com/NixOS/nixpkgs/issues/119066.
-      # Without the patch <nixpkgs/pkgs/tools/networking/djbdns/softlimit.patch>
-      # it fails on the 10th iteration.
-      nameserver.succeed(
-          """
-            for i in {1..100}; do
-              host bla.foo.bar 192.168.1.1 | grep '1\.2\.3\.4'
-            done
-          """
-      )
-    '';
-  }
-)
+    # We query tinydns a few times to trigger the bug:
+    #
+    #   nameserver # [    6.105872] mmap: tinydns (842): VmData 331776 exceed data ulimit 300000. Update limits or use boot option ignore_rlimit_data.
+    #
+    # which was reported in https://github.com/NixOS/nixpkgs/issues/119066.
+    # Without the patch <nixpkgs/pkgs/tools/networking/djbdns/softlimit.patch>
+    # it fails on the 10th iteration.
+    nameserver.succeed(
+        """
+          for i in {1..100}; do
+            host bla.foo.bar 192.168.1.1 | grep '1\.2\.3\.4'
+          done
+        """
+    )
+  '';
+}
diff --git a/nixos/tests/tinyproxy.nix b/nixos/tests/tinyproxy.nix
index 4184f68fd181..c1bcd0428503 100644
--- a/nixos/tests/tinyproxy.nix
+++ b/nixos/tests/tinyproxy.nix
@@ -1,25 +1,23 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "tinyproxy";
+{ pkgs, ... }:
+{
+  name = "tinyproxy";
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        services.tinyproxy = {
-          enable = true;
-          settings = {
-            Listen = "127.0.0.1";
-            Port = 8080;
-          };
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      services.tinyproxy = {
+        enable = true;
+        settings = {
+          Listen = "127.0.0.1";
+          Port = 8080;
         };
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("tinyproxy.service")
-      machine.wait_for_open_port(8080)
+  testScript = ''
+    machine.wait_for_unit("tinyproxy.service")
+    machine.wait_for_open_port(8080)
 
-      machine.succeed('curl -s http://localhost:8080 |grep -i tinyproxy')
-    '';
-  }
-)
+    machine.succeed('curl -s http://localhost:8080 |grep -i tinyproxy')
+  '';
+}
diff --git a/nixos/tests/tinywl.nix b/nixos/tests/tinywl.nix
index 85788d74ec89..aa0df6b6b1df 100644
--- a/nixos/tests/tinywl.nix
+++ b/nixos/tests/tinywl.nix
@@ -1,69 +1,67 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  {
-    name = "tinywl";
-    meta = {
-      maintainers = with lib.maintainers; [ primeos ];
-    };
+{
+  name = "tinywl";
+  meta = {
+    maintainers = with lib.maintainers; [ primeos ];
+  };
 
-    nodes.machine =
-      { config, ... }:
-      {
-        # Automatically login on tty1 as a normal user:
-        imports = [ ./common/user-account.nix ];
-        services.getty.autologinUser = "alice";
-        security.polkit.enable = true;
+  nodes.machine =
+    { config, ... }:
+    {
+      # Automatically login on tty1 as a normal user:
+      imports = [ ./common/user-account.nix ];
+      services.getty.autologinUser = "alice";
+      security.polkit.enable = true;
 
-        environment = {
-          systemPackages = with pkgs; [
-            tinywl
-            foot
-            wayland-utils
-          ];
-        };
-
-        hardware.graphics.enable = true;
-
-        # Automatically start TinyWL when logging in on tty1:
-        programs.bash.loginShellInit = ''
-          if [ "$(tty)" = "/dev/tty1" ]; then
-            set -e
-            test ! -e /tmp/tinywl.log # Only start tinywl once
-            readonly TEST_CMD="wayland-info |& tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok; read"
-            readonly FOOT_CMD="foot sh -c '$TEST_CMD'"
-            tinywl -s "$FOOT_CMD" |& tee /tmp/tinywl.log
-            touch /tmp/tinywl-exit-ok
-          fi
-        '';
-
-        # Switch to a different GPU driver (default: -vga std), otherwise TinyWL segfaults:
-        virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
+      environment = {
+        systemPackages = with pkgs; [
+          tinywl
+          foot
+          wayland-utils
+        ];
       };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
-        machine.wait_for_unit("multi-user.target")
+      hardware.graphics.enable = true;
 
-        # Wait for complete startup:
-        machine.wait_until_succeeds("pgrep tinywl")
-        machine.wait_for_file("/run/user/1000/wayland-0")
-        machine.wait_until_succeeds("pgrep foot")
-        machine.wait_for_file("/tmp/test-wayland-exit-ok")
-
-        # Make a screenshot and save the result:
-        machine.screenshot("tinywl_foot")
-        print(machine.succeed("cat /tmp/test-wayland.out"))
-        machine.copy_from_vm("/tmp/test-wayland.out")
-
-        # Terminate cleanly:
-        machine.send_key("alt-esc")
-        machine.wait_until_fails("pgrep foot")
-        machine.wait_until_fails("pgrep tinywl")
-        machine.wait_for_file("/tmp/tinywl-exit-ok")
-        machine.copy_from_vm("/tmp/tinywl.log")
+      # Automatically start TinyWL when logging in on tty1:
+      programs.bash.loginShellInit = ''
+        if [ "$(tty)" = "/dev/tty1" ]; then
+          set -e
+          test ! -e /tmp/tinywl.log # Only start tinywl once
+          readonly TEST_CMD="wayland-info |& tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok; read"
+          readonly FOOT_CMD="foot sh -c '$TEST_CMD'"
+          tinywl -s "$FOOT_CMD" |& tee /tmp/tinywl.log
+          touch /tmp/tinywl-exit-ok
+        fi
       '';
-  }
-)
+
+      # Switch to a different GPU driver (default: -vga std), otherwise TinyWL segfaults:
+      virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+      machine.wait_for_unit("multi-user.target")
+
+      # Wait for complete startup:
+      machine.wait_until_succeeds("pgrep tinywl")
+      machine.wait_for_file("/run/user/1000/wayland-0")
+      machine.wait_until_succeeds("pgrep foot")
+      machine.wait_for_file("/tmp/test-wayland-exit-ok")
+
+      # Make a screenshot and save the result:
+      machine.screenshot("tinywl_foot")
+      print(machine.succeed("cat /tmp/test-wayland.out"))
+      machine.copy_from_vm("/tmp/test-wayland.out")
+
+      # Terminate cleanly:
+      machine.send_key("alt-esc")
+      machine.wait_until_fails("pgrep foot")
+      machine.wait_until_fails("pgrep tinywl")
+      machine.wait_for_file("/tmp/tinywl-exit-ok")
+      machine.copy_from_vm("/tmp/tinywl.log")
+    '';
+}
diff --git a/nixos/tests/tmate-ssh-server.nix b/nixos/tests/tmate-ssh-server.nix
index 0d529d6e6812..daf0321c6971 100644
--- a/nixos/tests/tmate-ssh-server.nix
+++ b/nixos/tests/tmate-ssh-server.nix
@@ -1,85 +1,83 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    inherit (import ./ssh-keys.nix pkgs)
-      snakeOilPrivateKey
-      snakeOilPublicKey
-      ;
+{ pkgs, lib, ... }:
+let
+  inherit (import ./ssh-keys.nix pkgs)
+    snakeOilPrivateKey
+    snakeOilPublicKey
+    ;
 
-    setUpPrivateKey = name: ''
-      ${name}.succeed(
-          "mkdir -p /root/.ssh",
-          "chmod 700 /root/.ssh",
-          "cat '${snakeOilPrivateKey}' > /root/.ssh/id_snakeoil",
-          "chmod 600 /root/.ssh/id_snakeoil",
-      )
-      ${name}.wait_for_file("/root/.ssh/id_snakeoil")
-    '';
+  setUpPrivateKey = name: ''
+    ${name}.succeed(
+        "mkdir -p /root/.ssh",
+        "chmod 700 /root/.ssh",
+        "cat '${snakeOilPrivateKey}' > /root/.ssh/id_snakeoil",
+        "chmod 600 /root/.ssh/id_snakeoil",
+    )
+    ${name}.wait_for_file("/root/.ssh/id_snakeoil")
+  '';
 
-    sshOpts = "-oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null -oIdentityFile=/root/.ssh/id_snakeoil";
+  sshOpts = "-oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null -oIdentityFile=/root/.ssh/id_snakeoil";
 
-  in
-  {
-    name = "tmate-ssh-server";
-    nodes = {
-      server =
-        { ... }:
-        {
-          services.tmate-ssh-server = {
-            enable = true;
-            port = 2223;
-            openFirewall = true;
-          };
+in
+{
+  name = "tmate-ssh-server";
+  nodes = {
+    server =
+      { ... }:
+      {
+        services.tmate-ssh-server = {
+          enable = true;
+          port = 2223;
+          openFirewall = true;
         };
-      client =
-        { ... }:
-        {
-          environment.systemPackages = [ pkgs.tmate ];
-          services.openssh.enable = true;
-          users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
-        };
-      client2 =
-        { ... }:
-        {
-          environment.systemPackages = [ pkgs.openssh ];
-        };
-    };
-    testScript = ''
-      start_all()
+      };
+    client =
+      { ... }:
+      {
+        environment.systemPackages = [ pkgs.tmate ];
+        services.openssh.enable = true;
+        users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+      };
+    client2 =
+      { ... }:
+      {
+        environment.systemPackages = [ pkgs.openssh ];
+      };
+  };
+  testScript = ''
+    start_all()
 
-      server.wait_for_unit("tmate-ssh-server.service")
-      server.wait_for_open_port(2223)
-      server.wait_for_file("/etc/tmate-ssh-server-keys/ssh_host_ed25519_key.pub")
-      server.wait_for_file("/etc/tmate-ssh-server-keys/ssh_host_rsa_key.pub")
-      server.succeed("tmate-client-config > /tmp/tmate.conf")
-      server.wait_for_file("/tmp/tmate.conf")
+    server.wait_for_unit("tmate-ssh-server.service")
+    server.wait_for_open_port(2223)
+    server.wait_for_file("/etc/tmate-ssh-server-keys/ssh_host_ed25519_key.pub")
+    server.wait_for_file("/etc/tmate-ssh-server-keys/ssh_host_rsa_key.pub")
+    server.succeed("tmate-client-config > /tmp/tmate.conf")
+    server.wait_for_file("/tmp/tmate.conf")
 
-      ${setUpPrivateKey "server"}
-      client.wait_for_unit("sshd.service")
-      client.wait_for_open_port(22)
-      server.succeed("scp ${sshOpts} /tmp/tmate.conf client:/tmp/tmate.conf")
+    ${setUpPrivateKey "server"}
+    client.wait_for_unit("sshd.service")
+    client.wait_for_open_port(22)
+    server.succeed("scp ${sshOpts} /tmp/tmate.conf client:/tmp/tmate.conf")
 
-      client.wait_for_file("/tmp/tmate.conf")
-      client.wait_until_tty_matches("1", "login:")
-      client.send_chars("root\n")
-      client.sleep(2)
-      client.send_chars("tmate -f /tmp/tmate.conf\n")
-      client.sleep(2)
-      client.send_chars("q")
-      client.sleep(2)
-      client.send_chars("tmate display -p '#{tmate_ssh}' > /tmp/ssh_command\n")
-      client.wait_for_file("/tmp/ssh_command")
-      ssh_cmd = client.succeed("cat /tmp/ssh_command")
+    client.wait_for_file("/tmp/tmate.conf")
+    client.wait_until_tty_matches("1", "login:")
+    client.send_chars("root\n")
+    client.sleep(2)
+    client.send_chars("tmate -f /tmp/tmate.conf\n")
+    client.sleep(2)
+    client.send_chars("q")
+    client.sleep(2)
+    client.send_chars("tmate display -p '#{tmate_ssh}' > /tmp/ssh_command\n")
+    client.wait_for_file("/tmp/ssh_command")
+    ssh_cmd = client.succeed("cat /tmp/ssh_command")
 
-      client2.succeed("mkdir -p ~/.ssh; ssh-keyscan -4 -p 2223 server > ~/.ssh/known_hosts")
-      client2.wait_until_tty_matches("1", "login:")
-      client2.send_chars("root\n")
-      client2.sleep(2)
-      client2.send_chars(ssh_cmd.strip() + "\n")
-      client2.sleep(2)
-      client2.send_chars("touch /tmp/client_2\n")
+    client2.succeed("mkdir -p ~/.ssh; ssh-keyscan -4 -p 2223 server > ~/.ssh/known_hosts")
+    client2.wait_until_tty_matches("1", "login:")
+    client2.send_chars("root\n")
+    client2.sleep(2)
+    client2.send_chars(ssh_cmd.strip() + "\n")
+    client2.sleep(2)
+    client2.send_chars("touch /tmp/client_2\n")
 
-      client.wait_for_file("/tmp/client_2")
-    '';
-  }
-)
+    client.wait_for_file("/tmp/client_2")
+  '';
+}
diff --git a/nixos/tests/tomcat.nix b/nixos/tests/tomcat.nix
index 6d8b9f496454..a025f54b8035 100644
--- a/nixos/tests/tomcat.nix
+++ b/nixos/tests/tomcat.nix
@@ -1,33 +1,31 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "tomcat";
-    meta.maintainers = [ lib.maintainers.anthonyroussel ];
+{ lib, pkgs, ... }:
+{
+  name = "tomcat";
+  meta.maintainers = [ lib.maintainers.anthonyroussel ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.tomcat = {
-          enable = true;
-          port = 8001;
-          axis2.enable = true;
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.tomcat = {
+        enable = true;
+        port = 8001;
+        axis2.enable = true;
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("tomcat.service")
-      machine.wait_for_open_port(8001)
-      machine.wait_for_file("/var/tomcat/webapps/examples");
+  testScript = ''
+    machine.wait_for_unit("tomcat.service")
+    machine.wait_for_open_port(8001)
+    machine.wait_for_file("/var/tomcat/webapps/examples");
 
-      machine.succeed(
-          "curl -sS --fail http://localhost:8001/examples/servlets/servlet/HelloWorldExample | grep 'Hello World!'"
-      )
-      machine.succeed(
-          "curl -sS --fail http://localhost:8001/examples/jsp/jsp2/simpletag/hello.jsp | grep 'Hello, world!'"
-      )
-      machine.succeed(
-          "curl -sS --fail http://localhost:8001/axis2/axis2-web/HappyAxis.jsp | grep 'Found Axis2'"
-      )
-    '';
-  }
-)
+    machine.succeed(
+        "curl -sS --fail http://localhost:8001/examples/servlets/servlet/HelloWorldExample | grep 'Hello World!'"
+    )
+    machine.succeed(
+        "curl -sS --fail http://localhost:8001/examples/jsp/jsp2/simpletag/hello.jsp | grep 'Hello, world!'"
+    )
+    machine.succeed(
+        "curl -sS --fail http://localhost:8001/axis2/axis2-web/HappyAxis.jsp | grep 'Found Axis2'"
+    )
+  '';
+}
diff --git a/nixos/tests/tor.nix b/nixos/tests/tor.nix
index 6eff3c7e260a..ce35a38c7e0b 100644
--- a/nixos/tests/tor.nix
+++ b/nixos/tests/tor.nix
@@ -1,32 +1,30 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "tor";
-    meta.maintainers = with lib.maintainers; [ joachifm ];
+{ lib, ... }:
+{
+  name = "tor";
+  meta.maintainers = with lib.maintainers; [ joachifm ];
 
-    nodes.client =
-      { pkgs, ... }:
-      {
-        boot.kernelParams = [
-          "audit=0"
-          "apparmor=0"
-          "quiet"
-        ];
-        networking.firewall.enable = false;
-        networking.useDHCP = false;
+  nodes.client =
+    { pkgs, ... }:
+    {
+      boot.kernelParams = [
+        "audit=0"
+        "apparmor=0"
+        "quiet"
+      ];
+      networking.firewall.enable = false;
+      networking.useDHCP = false;
 
-        environment.systemPackages = [ pkgs.netcat ];
-        services.tor.enable = true;
-        services.tor.client.enable = true;
-        services.tor.settings.ControlPort = 9051;
-      };
+      environment.systemPackages = [ pkgs.netcat ];
+      services.tor.enable = true;
+      services.tor.client.enable = true;
+      services.tor.settings.ControlPort = 9051;
+    };
 
-    testScript = ''
-      client.wait_for_unit("tor.service")
-      client.wait_for_open_port(9051)
-      assert "514 Authentication required." in client.succeed(
-          "echo GETINFO version | nc 127.0.0.1 9051"
-      )
-    '';
-  }
-)
+  testScript = ''
+    client.wait_for_unit("tor.service")
+    client.wait_for_open_port(9051)
+    assert "514 Authentication required." in client.succeed(
+        "echo GETINFO version | nc 127.0.0.1 9051"
+    )
+  '';
+}
diff --git a/nixos/tests/trafficserver.nix b/nixos/tests/trafficserver.nix
index 9a64534e4357..e8a6fdb1f8fb 100644
--- a/nixos/tests/trafficserver.nix
+++ b/nixos/tests/trafficserver.nix
@@ -19,188 +19,186 @@
 #   - bin/traffic_logcat
 #   - bin/traffic_logstats
 #   - bin/tspush
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "trafficserver";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ midchildan ];
-    };
+{ pkgs, ... }:
+{
+  name = "trafficserver";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ midchildan ];
+  };
 
-    nodes = {
-      ats =
-        {
-          pkgs,
-          lib,
-          config,
-          ...
-        }:
-        let
-          user = config.users.users.trafficserver.name;
-          group = config.users.groups.trafficserver.name;
-          healthchecks = pkgs.writeText "healthchecks.conf" ''
-            /status /tmp/ats.status text/plain 200 500
-          '';
-        in
-        {
-          services.trafficserver.enable = true;
-
-          services.trafficserver.records = {
-            proxy.config.http.server_ports = "80 80:ipv6";
-            proxy.config.hostdb.host_file.path = "/etc/hosts";
-            proxy.config.log.max_space_mb_headroom = 0;
-            proxy.config.http.push_method_enabled = 1;
-
-            # check that cache storage is usable before accepting traffic
-            proxy.config.http.wait_for_cache = 2;
-          };
-
-          services.trafficserver.plugins = [
-            {
-              path = "healthchecks.so";
-              arg = toString healthchecks;
-            }
-            { path = "xdebug.so"; }
-          ];
-
-          services.trafficserver.remap = ''
-            map http://httpbin.test http://httpbin
-            map http://pristine-host-hdr.test http://httpbin \
-              @plugin=conf_remap.so \
-              @pparam=proxy.config.url_remap.pristine_host_hdr=1
-            map http://ats/tspush http://httpbin/cache \
-              @plugin=conf_remap.so \
-              @pparam=proxy.config.http.cache.required_headers=0
-          '';
-
-          services.trafficserver.storage = ''
-            /dev/vdb volume=1
-          '';
-
-          networking.firewall.allowedTCPPorts = [ 80 ];
-          virtualisation.emptyDiskImages = [ 256 ];
-          services.udev.extraRules = ''
-            KERNEL=="vdb", OWNER="${user}", GROUP="${group}"
-          '';
-        };
-
-      httpbin =
-        { pkgs, lib, ... }:
-        let
-          python = pkgs.python3.withPackages (
-            ps: with ps; [
-              httpbin
-              gunicorn
-              gevent
-            ]
-          );
-        in
-        {
-          systemd.services.httpbin = {
-            enable = true;
-            after = [ "network.target" ];
-            wantedBy = [ "multi-user.target" ];
-            serviceConfig = {
-              ExecStart = "${python}/bin/gunicorn -b 0.0.0.0:80 httpbin:app -k gevent";
-            };
-          };
-
-          networking.firewall.allowedTCPPorts = [ 80 ];
-        };
-
-      client =
-        { pkgs, lib, ... }:
-        {
-          environment.systemPackages = with pkgs; [ curl ];
-        };
-    };
-
-    testScript =
-      { nodes, ... }:
+  nodes = {
+    ats =
+      {
+        pkgs,
+        lib,
+        config,
+        ...
+      }:
       let
-        sampleFile = pkgs.writeText "sample.txt" ''
-          It's the season of White Album.
+        user = config.users.users.trafficserver.name;
+        group = config.users.groups.trafficserver.name;
+        healthchecks = pkgs.writeText "healthchecks.conf" ''
+          /status /tmp/ats.status text/plain 200 500
         '';
       in
-      ''
-        import json
-        import re
+      {
+        services.trafficserver.enable = true;
 
-        ats.wait_for_unit("trafficserver")
-        ats.wait_for_open_port(80)
-        httpbin.wait_for_unit("httpbin")
-        httpbin.wait_for_open_port(80)
-        client.systemctl("start network-online.target")
-        client.wait_for_unit("network-online.target")
+        services.trafficserver.records = {
+          proxy.config.http.server_ports = "80 80:ipv6";
+          proxy.config.hostdb.host_file.path = "/etc/hosts";
+          proxy.config.log.max_space_mb_headroom = 0;
+          proxy.config.http.push_method_enabled = 1;
 
-        with subtest("Traffic Server is running"):
-            out = ats.succeed("traffic_ctl server status")
-            assert out.strip() == "Proxy -- on"
+          # check that cache storage is usable before accepting traffic
+          proxy.config.http.wait_for_cache = 2;
+        };
 
-        with subtest("traffic_crashlog is running"):
-            ats.succeed("pgrep -f traffic_crashlog")
+        services.trafficserver.plugins = [
+          {
+            path = "healthchecks.so";
+            arg = toString healthchecks;
+          }
+          { path = "xdebug.so"; }
+        ];
 
-        with subtest("basic remapping works"):
-            out = client.succeed("curl -vv -H 'Host: httpbin.test' http://ats/headers")
-            assert json.loads(out)["headers"]["Host"] == "httpbin"
+        services.trafficserver.remap = ''
+          map http://httpbin.test http://httpbin
+          map http://pristine-host-hdr.test http://httpbin \
+            @plugin=conf_remap.so \
+            @pparam=proxy.config.url_remap.pristine_host_hdr=1
+          map http://ats/tspush http://httpbin/cache \
+            @plugin=conf_remap.so \
+            @pparam=proxy.config.http.cache.required_headers=0
+        '';
 
-        with subtest("conf_remap plugin works"):
-            out = client.succeed(
-                "curl -vv -H 'Host: pristine-host-hdr.test' http://ats/headers"
-            )
-            assert json.loads(out)["headers"]["Host"] == "pristine-host-hdr.test"
+        services.trafficserver.storage = ''
+          /dev/vdb volume=1
+        '';
 
-        with subtest("caching works"):
-            out = client.succeed(
-                "curl -vv -D - -H 'Host: httpbin.test' -H 'X-Debug: X-Cache' http://ats/cache/60 -o /dev/null"
-            )
-            assert "X-Cache: miss" in out
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        virtualisation.emptyDiskImages = [ 256 ];
+        services.udev.extraRules = ''
+          KERNEL=="vdb", OWNER="${user}", GROUP="${group}"
+        '';
+      };
 
-            out = client.succeed(
-                "curl -vv -D - -H 'Host: httpbin.test' -H 'X-Debug: X-Cache' http://ats/cache/60 -o /dev/null"
-            )
-            assert "X-Cache: hit-fresh" in out
+    httpbin =
+      { pkgs, lib, ... }:
+      let
+        python = pkgs.python3.withPackages (
+          ps: with ps; [
+            httpbin
+            gunicorn
+            gevent
+          ]
+        );
+      in
+      {
+        systemd.services.httpbin = {
+          enable = true;
+          after = [ "network.target" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            ExecStart = "${python}/bin/gunicorn -b 0.0.0.0:80 httpbin:app -k gevent";
+          };
+        };
 
-        with subtest("pushing to cache works"):
-            url = "http://ats/tspush"
+        networking.firewall.allowedTCPPorts = [ 80 ];
+      };
 
-            ats.succeed(f"echo {url} > /tmp/urls.txt")
-            out = ats.succeed(
-                f"tspush -f '${sampleFile}' -u {url}"
-            )
-            assert "HTTP/1.0 201 Created" in out, "cache push failed"
+    client =
+      { pkgs, lib, ... }:
+      {
+        environment.systemPackages = with pkgs; [ curl ];
+      };
+  };
 
-            out = ats.succeed(
-                "traffic_cache_tool --spans /etc/trafficserver/storage.config find --input /tmp/urls.txt"
-            )
-            assert "Span: /dev/vdb" in out, "cache not stored on disk"
-
-            out = client.succeed(f"curl {url}").strip()
-            expected = (
-                open("${sampleFile}").read().strip()
-            )
-            assert out == expected, "cache content mismatch"
-
-        with subtest("healthcheck plugin works"):
-            out = client.succeed("curl -vv http://ats/status -o /dev/null -w '%{http_code}'")
-            assert out.strip() == "500"
-
-            ats.succeed("touch /tmp/ats.status")
-
-            out = client.succeed("curl -vv http://ats/status -o /dev/null -w '%{http_code}'")
-            assert out.strip() == "200"
-
-        with subtest("logging works"):
-            access_log_path = "/var/log/trafficserver/squid.blog"
-            ats.wait_for_file(access_log_path)
-
-            out = ats.succeed(f"traffic_logcat {access_log_path}").split("\n")[0]
-            expected = "^\S+ \S+ \S+ TCP_MISS/200 \S+ GET http://httpbin/headers - DIRECT/httpbin application/json$"
-            assert re.fullmatch(expected, out) is not None, "no matching logs"
-
-            out = json.loads(ats.succeed(f"traffic_logstats -jf {access_log_path}"))
-            assert isinstance(out, dict)
-            assert out["total"]["error.total"]["req"] == "0", "unexpected log stat"
+  testScript =
+    { nodes, ... }:
+    let
+      sampleFile = pkgs.writeText "sample.txt" ''
+        It's the season of White Album.
       '';
-  }
-)
+    in
+    ''
+      import json
+      import re
+
+      ats.wait_for_unit("trafficserver")
+      ats.wait_for_open_port(80)
+      httpbin.wait_for_unit("httpbin")
+      httpbin.wait_for_open_port(80)
+      client.systemctl("start network-online.target")
+      client.wait_for_unit("network-online.target")
+
+      with subtest("Traffic Server is running"):
+          out = ats.succeed("traffic_ctl server status")
+          assert out.strip() == "Proxy -- on"
+
+      with subtest("traffic_crashlog is running"):
+          ats.succeed("pgrep -f traffic_crashlog")
+
+      with subtest("basic remapping works"):
+          out = client.succeed("curl -vv -H 'Host: httpbin.test' http://ats/headers")
+          assert json.loads(out)["headers"]["Host"] == "httpbin"
+
+      with subtest("conf_remap plugin works"):
+          out = client.succeed(
+              "curl -vv -H 'Host: pristine-host-hdr.test' http://ats/headers"
+          )
+          assert json.loads(out)["headers"]["Host"] == "pristine-host-hdr.test"
+
+      with subtest("caching works"):
+          out = client.succeed(
+              "curl -vv -D - -H 'Host: httpbin.test' -H 'X-Debug: X-Cache' http://ats/cache/60 -o /dev/null"
+          )
+          assert "X-Cache: miss" in out
+
+          out = client.succeed(
+              "curl -vv -D - -H 'Host: httpbin.test' -H 'X-Debug: X-Cache' http://ats/cache/60 -o /dev/null"
+          )
+          assert "X-Cache: hit-fresh" in out
+
+      with subtest("pushing to cache works"):
+          url = "http://ats/tspush"
+
+          ats.succeed(f"echo {url} > /tmp/urls.txt")
+          out = ats.succeed(
+              f"tspush -f '${sampleFile}' -u {url}"
+          )
+          assert "HTTP/1.0 201 Created" in out, "cache push failed"
+
+          out = ats.succeed(
+              "traffic_cache_tool --spans /etc/trafficserver/storage.config find --input /tmp/urls.txt"
+          )
+          assert "Span: /dev/vdb" in out, "cache not stored on disk"
+
+          out = client.succeed(f"curl {url}").strip()
+          expected = (
+              open("${sampleFile}").read().strip()
+          )
+          assert out == expected, "cache content mismatch"
+
+      with subtest("healthcheck plugin works"):
+          out = client.succeed("curl -vv http://ats/status -o /dev/null -w '%{http_code}'")
+          assert out.strip() == "500"
+
+          ats.succeed("touch /tmp/ats.status")
+
+          out = client.succeed("curl -vv http://ats/status -o /dev/null -w '%{http_code}'")
+          assert out.strip() == "200"
+
+      with subtest("logging works"):
+          access_log_path = "/var/log/trafficserver/squid.blog"
+          ats.wait_for_file(access_log_path)
+
+          out = ats.succeed(f"traffic_logcat {access_log_path}").split("\n")[0]
+          expected = "^\S+ \S+ \S+ TCP_MISS/200 \S+ GET http://httpbin/headers - DIRECT/httpbin application/json$"
+          assert re.fullmatch(expected, out) is not None, "no matching logs"
+
+          out = json.loads(ats.succeed(f"traffic_logstats -jf {access_log_path}"))
+          assert isinstance(out, dict)
+          assert out["total"]["error.total"]["req"] == "0", "unexpected log stat"
+    '';
+}
diff --git a/nixos/tests/transfer-sh.nix b/nixos/tests/transfer-sh.nix
index 32750b1fdc25..dc628db33f1e 100644
--- a/nixos/tests/transfer-sh.nix
+++ b/nixos/tests/transfer-sh.nix
@@ -1,25 +1,23 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "transfer-sh";
+{ pkgs, lib, ... }:
+{
+  name = "transfer-sh";
 
-    meta = {
-      maintainers = with lib.maintainers; [ ocfox ];
+  meta = {
+    maintainers = with lib.maintainers; [ ocfox ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.transfer-sh = {
+        enable = true;
+        settings.LISTENER = ":1234";
+      };
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.transfer-sh = {
-          enable = true;
-          settings.LISTENER = ":1234";
-        };
-      };
-
-    testScript = ''
-      machine.wait_for_unit("transfer-sh.service")
-      machine.wait_for_open_port(1234)
-      machine.succeed("curl --fail http://localhost:1234/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("transfer-sh.service")
+    machine.wait_for_open_port(1234)
+    machine.succeed("curl --fail http://localhost:1234/")
+  '';
+}
diff --git a/nixos/tests/trezord.nix b/nixos/tests/trezord.nix
index d8b85d99f09c..4955ecb9c714 100644
--- a/nixos/tests/trezord.nix
+++ b/nixos/tests/trezord.nix
@@ -1,27 +1,25 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "trezord";
-    meta = with pkgs.lib; {
-      maintainers = with maintainers; [
-        mmahut
-        _1000101
-      ];
-    };
-    nodes = {
-      machine =
-        { ... }:
-        {
-          services.trezord.enable = true;
-          services.trezord.emulator.enable = true;
-        };
-    };
+{ pkgs, ... }:
+{
+  name = "trezord";
+  meta = with pkgs.lib; {
+    maintainers = with maintainers; [
+      mmahut
+      _1000101
+    ];
+  };
+  nodes = {
+    machine =
+      { ... }:
+      {
+        services.trezord.enable = true;
+        services.trezord.emulator.enable = true;
+      };
+  };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("trezord.service")
-      machine.wait_for_open_port(21325)
-      machine.wait_until_succeeds("curl -fL http://localhost:21325/status/ | grep Version")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("trezord.service")
+    machine.wait_for_open_port(21325)
+    machine.wait_until_succeeds("curl -fL http://localhost:21325/status/ | grep Version")
+  '';
+}
diff --git a/nixos/tests/trickster.nix b/nixos/tests/trickster.nix
index 97ee1855496e..e987341bc7de 100644
--- a/nixos/tests/trickster.nix
+++ b/nixos/tests/trickster.nix
@@ -1,44 +1,42 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "trickster";
-    meta = with pkgs.lib; {
-      maintainers = with maintainers; [ _1000101 ];
-    };
+{ pkgs, ... }:
+{
+  name = "trickster";
+  meta = with pkgs.lib; {
+    maintainers = with maintainers; [ _1000101 ];
+  };
 
-    nodes = {
-      prometheus =
-        { ... }:
-        {
-          services.prometheus.enable = true;
-          networking.firewall.allowedTCPPorts = [ 9090 ];
-        };
-      trickster =
-        { ... }:
-        {
-          services.trickster.enable = true;
-        };
-    };
+  nodes = {
+    prometheus =
+      { ... }:
+      {
+        services.prometheus.enable = true;
+        networking.firewall.allowedTCPPorts = [ 9090 ];
+      };
+    trickster =
+      { ... }:
+      {
+        services.trickster.enable = true;
+      };
+  };
 
-    testScript = ''
-      start_all()
-      prometheus.wait_for_unit("prometheus.service")
-      prometheus.wait_for_open_port(9090)
-      prometheus.wait_until_succeeds(
-          "curl -fL http://localhost:9090/metrics | grep 'promhttp_metric_handler_requests_total{code=\"500\"} 0'"
-      )
-      trickster.wait_for_unit("trickster.service")
-      trickster.wait_for_open_port(8082)
-      trickster.wait_for_open_port(9090)
-      trickster.wait_until_succeeds(
-          "curl -fL http://localhost:8082/metrics | grep 'promhttp_metric_handler_requests_total{code=\"500\"} 0'"
-      )
-      trickster.wait_until_succeeds(
-          "curl -fL http://prometheus:9090/metrics | grep 'promhttp_metric_handler_requests_total{code=\"500\"} 0'"
-      )
-      trickster.wait_until_succeeds(
-          "curl -fL http://localhost:9090/metrics | grep 'promhttp_metric_handler_requests_total{code=\"500\"} 0'"
-      )
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    prometheus.wait_for_unit("prometheus.service")
+    prometheus.wait_for_open_port(9090)
+    prometheus.wait_until_succeeds(
+        "curl -fL http://localhost:9090/metrics | grep 'promhttp_metric_handler_requests_total{code=\"500\"} 0'"
+    )
+    trickster.wait_for_unit("trickster.service")
+    trickster.wait_for_open_port(8082)
+    trickster.wait_for_open_port(9090)
+    trickster.wait_until_succeeds(
+        "curl -fL http://localhost:8082/metrics | grep 'promhttp_metric_handler_requests_total{code=\"500\"} 0'"
+    )
+    trickster.wait_until_succeeds(
+        "curl -fL http://prometheus:9090/metrics | grep 'promhttp_metric_handler_requests_total{code=\"500\"} 0'"
+    )
+    trickster.wait_until_succeeds(
+        "curl -fL http://localhost:9090/metrics | grep 'promhttp_metric_handler_requests_total{code=\"500\"} 0'"
+    )
+  '';
+}
diff --git a/nixos/tests/tsm-client-gui.nix b/nixos/tests/tsm-client-gui.nix
index edae66f67028..7e3dbb6f116a 100644
--- a/nixos/tests/tsm-client-gui.nix
+++ b/nixos/tests/tsm-client-gui.nix
@@ -5,58 +5,56 @@
 # to show its main application window
 # and verifies some configuration information.
 
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "tsm-client";
+{ lib, pkgs, ... }:
+{
+  name = "tsm-client";
 
-    enableOCR = true;
+  enableOCR = true;
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ./common/x11.nix ];
-        programs.tsmClient = {
-          enable = true;
-          package = pkgs.tsm-client-withGui;
-          defaultServername = "testserver";
-          servers.testserver = {
-            # 192.0.0.8 is a "dummy address" according to RFC 7600
-            tcpserveraddress = "192.0.0.8";
-            nodename = "SOME-NODE";
-            passworddir = "/tmp";
-          };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/x11.nix ];
+      programs.tsmClient = {
+        enable = true;
+        package = pkgs.tsm-client-withGui;
+        defaultServername = "testserver";
+        servers.testserver = {
+          # 192.0.0.8 is a "dummy address" according to RFC 7600
+          tcpserveraddress = "192.0.0.8";
+          nodename = "SOME-NODE";
+          passworddir = "/tmp";
         };
       };
+    };
 
-    testScript = ''
-      machine.succeed("which dsmj")  # fail early if this is missing
-      machine.wait_for_x()
-      machine.execute("DSM_LOG=/tmp dsmj -optfile=/dev/null >&2 &")
+  testScript = ''
+    machine.succeed("which dsmj")  # fail early if this is missing
+    machine.wait_for_x()
+    machine.execute("DSM_LOG=/tmp dsmj -optfile=/dev/null >&2 &")
 
-      # does it report the "TCP/IP connection failure" error code?
-      machine.wait_for_window("IBM Storage Protect")
-      machine.wait_for_text("ANS2610S")
-      machine.send_key("esc")
+    # does it report the "TCP/IP connection failure" error code?
+    machine.wait_for_window("IBM Storage Protect")
+    machine.wait_for_text("ANS2610S")
+    machine.send_key("esc")
 
-      # it asks to continue to restore a local backupset now;
-      # "yes" (return) leads to the main application window
-      machine.wait_for_text("backupset")
-      machine.send_key("ret")
+    # it asks to continue to restore a local backupset now;
+    # "yes" (return) leads to the main application window
+    machine.wait_for_text("backupset")
+    machine.send_key("ret")
 
-      # main window: navigate to "Connection Information"
-      machine.wait_for_text("Welcome")
-      machine.send_key("alt-f")  # "File" menu
-      machine.send_key("c")  # "Connection Information"
+    # main window: navigate to "Connection Information"
+    machine.wait_for_text("Welcome")
+    machine.send_key("alt-f")  # "File" menu
+    machine.send_key("c")  # "Connection Information"
 
-      # "Connection Information" dialog box
-      machine.wait_for_window("Connection Information")
-      machine.wait_for_text("SOME-NODE")
-      machine.wait_for_text("${pkgs.tsm-client.passthru.unwrapped.version}")
+    # "Connection Information" dialog box
+    machine.wait_for_window("Connection Information")
+    machine.wait_for_text("SOME-NODE")
+    machine.wait_for_text("${pkgs.tsm-client.passthru.unwrapped.version}")
 
-      machine.shutdown()
-    '';
+    machine.shutdown()
+  '';
 
-    meta.maintainers = [ lib.maintainers.yarny ];
-  }
-)
+  meta.maintainers = [ lib.maintainers.yarny ];
+}
diff --git a/nixos/tests/tuptime.nix b/nixos/tests/tuptime.nix
index a879781c55c0..b5bde1280e89 100644
--- a/nixos/tests/tuptime.nix
+++ b/nixos/tests/tuptime.nix
@@ -1,32 +1,30 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "tuptime";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ evils ];
+{ pkgs, ... }:
+{
+  name = "tuptime";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ evils ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ../modules/profiles/minimal.nix ];
+      services.tuptime.enable = true;
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [ ../modules/profiles/minimal.nix ];
-        services.tuptime.enable = true;
-      };
+  testScript = ''
+    # see if it starts
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("tuptime | grep 'System startups:[[:blank:]]*1'")
+    machine.succeed("tuptime | grep 'System uptime:[[:blank:]]*100.0%'")
+    machine.shutdown()
 
-    testScript = ''
-      # see if it starts
-      start_all()
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("tuptime | grep 'System startups:[[:blank:]]*1'")
-      machine.succeed("tuptime | grep 'System uptime:[[:blank:]]*100.0%'")
-      machine.shutdown()
-
-      # restart machine and see if it correctly reports the reboot
-      machine.start()
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("tuptime | grep 'System startups:[[:blank:]]*2'")
-      machine.succeed("tuptime | grep 'System shutdowns:[[:blank:]]*1 ok'")
-      machine.shutdown()
-    '';
-  }
-)
+    # restart machine and see if it correctly reports the reboot
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("tuptime | grep 'System startups:[[:blank:]]*2'")
+    machine.succeed("tuptime | grep 'System shutdowns:[[:blank:]]*1 ok'")
+    machine.shutdown()
+  '';
+}
diff --git a/nixos/tests/turbovnc-headless-server.nix b/nixos/tests/turbovnc-headless-server.nix
index 6b3ade7179ff..2c670fc60ee7 100644
--- a/nixos/tests/turbovnc-headless-server.nix
+++ b/nixos/tests/turbovnc-headless-server.nix
@@ -1,157 +1,155 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "turbovnc-headless-server";
-    meta = {
-      maintainers = with lib.maintainers; [ nh2 ];
-    };
+{ pkgs, lib, ... }:
+{
+  name = "turbovnc-headless-server";
+  meta = {
+    maintainers = with lib.maintainers; [ nh2 ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
+  nodes.machine =
+    { pkgs, ... }:
+    {
 
-        environment.systemPackages = with pkgs; [
-          mesa-demos
-          procps # for `pkill`, `pidof` in the test
-          scrot # for screenshotting Xorg
-          turbovnc
+      environment.systemPackages = with pkgs; [
+        mesa-demos
+        procps # for `pkill`, `pidof` in the test
+        scrot # for screenshotting Xorg
+        turbovnc
+      ];
+
+      programs.turbovnc.ensureHeadlessSoftwareOpenGL = true;
+
+      networking.firewall = {
+        # Reject instead of drop, for failures instead of hangs.
+        rejectPackets = true;
+        allowedTCPPorts = [
+          5900 # VNC :0, for seeing what's going on in the server
         ];
-
-        programs.turbovnc.ensureHeadlessSoftwareOpenGL = true;
-
-        networking.firewall = {
-          # Reject instead of drop, for failures instead of hangs.
-          rejectPackets = true;
-          allowedTCPPorts = [
-            5900 # VNC :0, for seeing what's going on in the server
-          ];
-        };
-
-        # So that we can ssh into the VM, see e.g.
-        # https://nixos.org/manual/nixos/stable/#sec-nixos-test-port-forwarding
-        services.openssh.enable = true;
-        users.mutableUsers = false;
-        # `test-instrumentation.nix` already sets an empty root password.
-        # The following have to all be set to allow an empty SSH login password.
-        services.openssh.settings.PermitRootLogin = "yes";
-        services.openssh.settings.PermitEmptyPasswords = "yes";
-        security.pam.services.sshd.allowNullPassword = true; # the default `UsePam yes` makes this necessary
       };
 
-    testScript = ''
-      def wait_until_terminated_or_succeeds(
-          termination_check_shell_command,
-          success_check_shell_command,
-          get_detail_message_fn,
-          retries=60,
-          retry_sleep=0.5,
-      ):
-          def check_success():
-              command_exit_code, _output = machine.execute(success_check_shell_command)
-              return command_exit_code == 0
+      # So that we can ssh into the VM, see e.g.
+      # https://nixos.org/manual/nixos/stable/#sec-nixos-test-port-forwarding
+      services.openssh.enable = true;
+      users.mutableUsers = false;
+      # `test-instrumentation.nix` already sets an empty root password.
+      # The following have to all be set to allow an empty SSH login password.
+      services.openssh.settings.PermitRootLogin = "yes";
+      services.openssh.settings.PermitEmptyPasswords = "yes";
+      security.pam.services.sshd.allowNullPassword = true; # the default `UsePam yes` makes this necessary
+    };
 
-          for _ in range(retries):
-              exit_check_exit_code, _output = machine.execute(termination_check_shell_command)
-              is_terminated = exit_check_exit_code != 0
-              if is_terminated:
-                  if check_success():
-                      return
-                  else:
-                      details = get_detail_message_fn()
-                      raise Exception(
-                          f"termination check ({termination_check_shell_command}) triggered without command succeeding ({success_check_shell_command}); details: {details}"
-                      )
-              else:
-                  if check_success():
-                      return
-              import time
-              time.sleep(retry_sleep)
+  testScript = ''
+    def wait_until_terminated_or_succeeds(
+        termination_check_shell_command,
+        success_check_shell_command,
+        get_detail_message_fn,
+        retries=60,
+        retry_sleep=0.5,
+    ):
+        def check_success():
+            command_exit_code, _output = machine.execute(success_check_shell_command)
+            return command_exit_code == 0
 
-          if not check_success():
-              details = get_detail_message_fn()
-              raise Exception(
-                  f"action timed out ({success_check_shell_command}); details: {details}"
-              )
+        for _ in range(retries):
+            exit_check_exit_code, _output = machine.execute(termination_check_shell_command)
+            is_terminated = exit_check_exit_code != 0
+            if is_terminated:
+                if check_success():
+                    return
+                else:
+                    details = get_detail_message_fn()
+                    raise Exception(
+                        f"termination check ({termination_check_shell_command}) triggered without command succeeding ({success_check_shell_command}); details: {details}"
+                    )
+            else:
+                if check_success():
+                    return
+            import time
+            time.sleep(retry_sleep)
+
+        if not check_success():
+            details = get_detail_message_fn()
+            raise Exception(
+                f"action timed out ({success_check_shell_command}); details: {details}"
+            )
 
 
-      # Below we use the pattern:
-      #     (cmd | tee stdout.log) 3>&1 1>&2 2>&3 | tee stderr.log
-      # to capture both stderr and stdout while also teeing them, see:
-      # https://unix.stackexchange.com/questions/6430/how-to-redirect-stderr-and-stdout-to-different-files-and-also-display-in-termina/6431#6431
+    # Below we use the pattern:
+    #     (cmd | tee stdout.log) 3>&1 1>&2 2>&3 | tee stderr.log
+    # to capture both stderr and stdout while also teeing them, see:
+    # https://unix.stackexchange.com/questions/6430/how-to-redirect-stderr-and-stdout-to-different-files-and-also-display-in-termina/6431#6431
 
 
-      # Starts headless VNC server, backgrounding it.
-      def start_xvnc():
-          xvnc_command = " ".join(
-              [
-                  "Xvnc",
-                  ":0",
-                  "-iglx",
-                  "-auth /root/.Xauthority",
-                  "-geometry 1240x900",
-                  "-depth 24",
-                  "-rfbwait 5000",
-                  "-deferupdate 1",
-                  "-verbose",
-                  "-securitytypes none",
-                  # We don't enforce localhost listening such that we
-                  # can connect from outside the VM using
-                  #     env QEMU_NET_OPTS=hostfwd=tcp::5900-:5900 $(nix-build nixos/tests/turbovnc-headless-server.nix -A driver)/bin/nixos-test-driver
-                  # for testing purposes, and so that we can in the future
-                  # add another test case that connects the TurboVNC client.
-                  # "-localhost",
-              ]
-          )
-          machine.execute(
-              # Note trailing & for backgrounding.
-              f"({xvnc_command} | tee /tmp/Xvnc.stdout) 3>&1 1>&2 2>&3 | tee /tmp/Xvnc.stderr >&2 &",
-          )
+    # Starts headless VNC server, backgrounding it.
+    def start_xvnc():
+        xvnc_command = " ".join(
+            [
+                "Xvnc",
+                ":0",
+                "-iglx",
+                "-auth /root/.Xauthority",
+                "-geometry 1240x900",
+                "-depth 24",
+                "-rfbwait 5000",
+                "-deferupdate 1",
+                "-verbose",
+                "-securitytypes none",
+                # We don't enforce localhost listening such that we
+                # can connect from outside the VM using
+                #     env QEMU_NET_OPTS=hostfwd=tcp::5900-:5900 $(nix-build nixos/tests/turbovnc-headless-server.nix -A driver)/bin/nixos-test-driver
+                # for testing purposes, and so that we can in the future
+                # add another test case that connects the TurboVNC client.
+                # "-localhost",
+            ]
+        )
+        machine.execute(
+            # Note trailing & for backgrounding.
+            f"({xvnc_command} | tee /tmp/Xvnc.stdout) 3>&1 1>&2 2>&3 | tee /tmp/Xvnc.stderr >&2 &",
+        )
 
 
-      # Waits until the server log message that tells us that GLX is ready
-      # (requires `-verbose` above), avoiding screenshoting racing below.
-      def wait_until_xvnc_glx_ready():
-          machine.wait_until_succeeds("test -f /tmp/Xvnc.stderr")
-          wait_until_terminated_or_succeeds(
-              termination_check_shell_command="pidof Xvnc",
-              success_check_shell_command="grep 'GLX: Initialized DRISWRAST' /tmp/Xvnc.stderr",
-              get_detail_message_fn=lambda: "Contents of /tmp/Xvnc.stderr:\n"
-              + machine.succeed("cat /tmp/Xvnc.stderr"),
-          )
+    # Waits until the server log message that tells us that GLX is ready
+    # (requires `-verbose` above), avoiding screenshoting racing below.
+    def wait_until_xvnc_glx_ready():
+        machine.wait_until_succeeds("test -f /tmp/Xvnc.stderr")
+        wait_until_terminated_or_succeeds(
+            termination_check_shell_command="pidof Xvnc",
+            success_check_shell_command="grep 'GLX: Initialized DRISWRAST' /tmp/Xvnc.stderr",
+            get_detail_message_fn=lambda: "Contents of /tmp/Xvnc.stderr:\n"
+            + machine.succeed("cat /tmp/Xvnc.stderr"),
+        )
 
 
-      # Starts glxgears, backgrounding it. Waits until it prints the `GL_RENDERER`.
-      # Does not quit glxgears.
-      def test_glxgears_prints_renderer():
-          machine.execute(
-              # Note trailing & for backgrounding.
-              "(env DISPLAY=:0 glxgears -info | tee /tmp/glxgears.stdout) 3>&1 1>&2 2>&3 | tee /tmp/glxgears.stderr >&2 &"
-          )
-          machine.wait_until_succeeds("test -f /tmp/glxgears.stderr")
-          wait_until_terminated_or_succeeds(
-              termination_check_shell_command="pidof glxgears",
-              success_check_shell_command="grep 'GL_RENDERER' /tmp/glxgears.stdout",
-              get_detail_message_fn=lambda: "Contents of /tmp/glxgears.stderr:\n"
-              + machine.succeed("cat /tmp/glxgears.stderr"),
-          )
+    # Starts glxgears, backgrounding it. Waits until it prints the `GL_RENDERER`.
+    # Does not quit glxgears.
+    def test_glxgears_prints_renderer():
+        machine.execute(
+            # Note trailing & for backgrounding.
+            "(env DISPLAY=:0 glxgears -info | tee /tmp/glxgears.stdout) 3>&1 1>&2 2>&3 | tee /tmp/glxgears.stderr >&2 &"
+        )
+        machine.wait_until_succeeds("test -f /tmp/glxgears.stderr")
+        wait_until_terminated_or_succeeds(
+            termination_check_shell_command="pidof glxgears",
+            success_check_shell_command="grep 'GL_RENDERER' /tmp/glxgears.stdout",
+            get_detail_message_fn=lambda: "Contents of /tmp/glxgears.stderr:\n"
+            + machine.succeed("cat /tmp/glxgears.stderr"),
+        )
 
 
-      with subtest("Start Xvnc"):
-          start_xvnc()
-          wait_until_xvnc_glx_ready()
+    with subtest("Start Xvnc"):
+        start_xvnc()
+        wait_until_xvnc_glx_ready()
 
-      with subtest("Run 3D application (glxgears)"):
-          test_glxgears_prints_renderer()
+    with subtest("Run 3D application (glxgears)"):
+        test_glxgears_prints_renderer()
 
-          # Take screenshot; should display the glxgears.
-          machine.succeed("scrot --display :0 /tmp/glxgears.png")
+        # Take screenshot; should display the glxgears.
+        machine.succeed("scrot --display :0 /tmp/glxgears.png")
 
-      # Copy files down.
-      machine.copy_from_vm("/tmp/glxgears.png")
-      machine.copy_from_vm("/tmp/glxgears.stdout")
-      machine.copy_from_vm("/tmp/Xvnc.stdout")
-      machine.copy_from_vm("/tmp/Xvnc.stderr")
-    '';
+    # Copy files down.
+    machine.copy_from_vm("/tmp/glxgears.png")
+    machine.copy_from_vm("/tmp/glxgears.stdout")
+    machine.copy_from_vm("/tmp/Xvnc.stdout")
+    machine.copy_from_vm("/tmp/Xvnc.stderr")
+  '';
 
-  }
-)
+}
diff --git a/nixos/tests/turn-rs.nix b/nixos/tests/turn-rs.nix
index 750a141c224a..4404a50f52d9 100644
--- a/nixos/tests/turn-rs.nix
+++ b/nixos/tests/turn-rs.nix
@@ -1,65 +1,63 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "turn-rs";
+{ pkgs, ... }:
+{
+  name = "turn-rs";
 
-    nodes = {
-      server = {
-        virtualisation.vlans = [ 1 ];
+  nodes = {
+    server = {
+      virtualisation.vlans = [ 1 ];
 
-        networking = {
-          useNetworkd = true;
-          useDHCP = false;
-          firewall.enable = false;
-        };
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        firewall.enable = false;
+      };
 
-        systemd.network.networks."01-eth1" = {
-          name = "eth1";
-          networkConfig.Address = "10.0.0.1/24";
-        };
+      systemd.network.networks."01-eth1" = {
+        name = "eth1";
+        networkConfig.Address = "10.0.0.1/24";
+      };
 
-        services.turn-rs = {
-          enable = true;
-          secretFile = pkgs.writeText "secret" ''
-            USER_1_CREDS="foobar"
-          '';
-          settings = {
-            turn = {
-              realm = "localhost";
-              interfaces = [
-                {
-                  transport = "udp";
-                  bind = "127.0.0.1:3478";
-                  external = "127.0.0.1:3478";
-                }
-                {
-                  transport = "tcp";
-                  bind = "127.0.0.1:3478";
-                  external = "127.0.0.1:3478";
-                }
-              ];
-            };
-
-            auth.static_credentials.user1 = "$USER_1_CREDS";
+      services.turn-rs = {
+        enable = true;
+        secretFile = pkgs.writeText "secret" ''
+          USER_1_CREDS="foobar"
+        '';
+        settings = {
+          turn = {
+            realm = "localhost";
+            interfaces = [
+              {
+                transport = "udp";
+                bind = "127.0.0.1:3478";
+                external = "127.0.0.1:3478";
+              }
+              {
+                transport = "tcp";
+                bind = "127.0.0.1:3478";
+                external = "127.0.0.1:3478";
+              }
+            ];
           };
+
+          auth.static_credentials.user1 = "$USER_1_CREDS";
         };
       };
     };
+  };
 
-    testScript = # python
-      ''
-        import json
+  testScript = # python
+    ''
+      import json
 
-        start_all()
-        server.wait_for_unit('turn-rs.service')
-        server.wait_for_open_port(3000, "127.0.0.1")
+      start_all()
+      server.wait_for_unit('turn-rs.service')
+      server.wait_for_open_port(3000, "127.0.0.1")
 
-        info = server.succeed('curl http://localhost:3000/info')
-        jsonInfo = json.loads(info)
-        assert len(jsonInfo['interfaces']) == 2, f'Interfaces doesn\'t contain two entries:\n{json.dumps(jsonInfo, indent=2)}'
+      info = server.succeed('curl http://localhost:3000/info')
+      jsonInfo = json.loads(info)
+      assert len(jsonInfo['interfaces']) == 2, f'Interfaces doesn\'t contain two entries:\n{json.dumps(jsonInfo, indent=2)}'
 
-        config = server.succeed('cat /run/turn-rs/config.toml')
-        assert 'foobar' in config, f'Secrets are not properly injected:\n{config}'
-      '';
-  }
-)
+      config = server.succeed('cat /run/turn-rs/config.toml')
+      assert 'foobar' in config, f'Secrets are not properly injected:\n{config}'
+    '';
+}
diff --git a/nixos/tests/txredisapi.nix b/nixos/tests/txredisapi.nix
index ecfb79ea13d7..171d3efee78f 100644
--- a/nixos/tests/txredisapi.nix
+++ b/nixos/tests/txredisapi.nix
@@ -1,40 +1,38 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "txredisapi";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ dandellion ];
-    };
+{ pkgs, ... }:
+{
+  name = "txredisapi";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ dandellion ];
+  };
 
-    nodes = {
-      machine =
-        { pkgs, ... }:
+  nodes = {
+    machine =
+      { pkgs, ... }:
 
-        {
-          services.redis.servers."".enable = true;
+      {
+        services.redis.servers."".enable = true;
 
-          environment.systemPackages = with pkgs; [
-            (python3.withPackages (ps: [
-              ps.twisted
-              ps.txredisapi
-              ps.mock
-            ]))
-          ];
-        };
-    };
+        environment.systemPackages = with pkgs; [
+          (python3.withPackages (ps: [
+            ps.twisted
+            ps.txredisapi
+            ps.mock
+          ]))
+        ];
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      let
-        inherit (nodes.machine.config.services) redis;
-      in
-      ''
-        start_all()
-        machine.wait_for_unit("redis")
-        machine.wait_for_file("${redis.servers."".unixSocket}")
-        machine.succeed("ln -s ${redis.servers."".unixSocket} /tmp/redis.sock")
+  testScript =
+    { nodes, ... }:
+    let
+      inherit (nodes.machine.config.services) redis;
+    in
+    ''
+      start_all()
+      machine.wait_for_unit("redis")
+      machine.wait_for_file("${redis.servers."".unixSocket}")
+      machine.succeed("ln -s ${redis.servers."".unixSocket} /tmp/redis.sock")
 
-        tests = machine.succeed("PYTHONPATH=\"${pkgs.python3Packages.txredisapi.src}\" python -m twisted.trial ${pkgs.python3Packages.txredisapi.src}/tests")
-      '';
-  }
-)
+      tests = machine.succeed("PYTHONPATH=\"${pkgs.python3Packages.txredisapi.src}\" python -m twisted.trial ${pkgs.python3Packages.txredisapi.src}/tests")
+    '';
+}
diff --git a/nixos/tests/typesense.nix b/nixos/tests/typesense.nix
index dbd9e4e38a9f..2d97150bcec5 100644
--- a/nixos/tests/typesense.nix
+++ b/nixos/tests/typesense.nix
@@ -1,30 +1,28 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    testPort = 8108;
-  in
-  {
-    name = "typesense";
-    meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
+{ pkgs, ... }:
+let
+  testPort = 8108;
+in
+{
+  name = "typesense";
+  meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.typesense = {
-          enable = true;
-          apiKeyFile = pkgs.writeText "typesense-api-key" "dummy";
-          settings.server = {
-            api-port = testPort;
-            api-address = "0.0.0.0";
-          };
+  nodes.machine =
+    { ... }:
+    {
+      services.typesense = {
+        enable = true;
+        apiKeyFile = pkgs.writeText "typesense-api-key" "dummy";
+        settings.server = {
+          api-port = testPort;
+          api-address = "0.0.0.0";
         };
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("typesense.service")
-      machine.wait_for_open_port(${toString testPort})
-      # After waiting for the port, typesense still hasn't initialized the database, so wait until we can connect successfully
-      assert machine.wait_until_succeeds("curl --fail http://localhost:${toString testPort}/health") == '{"ok":true}'
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("typesense.service")
+    machine.wait_for_open_port(${toString testPort})
+    # After waiting for the port, typesense still hasn't initialized the database, so wait until we can connect successfully
+    assert machine.wait_until_succeeds("curl --fail http://localhost:${toString testPort}/health") == '{"ok":true}'
+  '';
+}
diff --git a/nixos/tests/ucarp.nix b/nixos/tests/ucarp.nix
index ec24d49e95a9..385412d60120 100644
--- a/nixos/tests/ucarp.nix
+++ b/nixos/tests/ucarp.nix
@@ -1,80 +1,78 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    addrShared = "192.168.0.1";
-    addrHostA = "192.168.0.10";
-    addrHostB = "192.168.0.11";
+let
+  addrShared = "192.168.0.1";
+  addrHostA = "192.168.0.10";
+  addrHostB = "192.168.0.11";
 
-    mkUcarpHost =
-      addr:
-      {
-        config,
-        pkgs,
-        lib,
-        ...
-      }:
-      {
-        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-          {
-            address = addr;
-            prefixLength = 24;
-          }
-        ];
+  mkUcarpHost =
+    addr:
+    {
+      config,
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+        {
+          address = addr;
+          prefixLength = 24;
+        }
+      ];
 
-        networking.ucarp = {
-          enable = true;
-          interface = "eth1";
-          srcIp = addr;
-          vhId = 1;
-          passwordFile = "${pkgs.writeText "ucarp-pass" "secure"}";
-          addr = addrShared;
-          upscript = pkgs.writeScript "upscript" ''
-            #!/bin/sh
-            ${pkgs.iproute2}/bin/ip addr add "$2"/24 dev "$1"
-          '';
-          downscript = pkgs.writeScript "downscript" ''
-            #!/bin/sh
-            ${pkgs.iproute2}/bin/ip addr del "$2"/24 dev "$1"
-          '';
-        };
+      networking.ucarp = {
+        enable = true;
+        interface = "eth1";
+        srcIp = addr;
+        vhId = 1;
+        passwordFile = "${pkgs.writeText "ucarp-pass" "secure"}";
+        addr = addrShared;
+        upscript = pkgs.writeScript "upscript" ''
+          #!/bin/sh
+          ${pkgs.iproute2}/bin/ip addr add "$2"/24 dev "$1"
+        '';
+        downscript = pkgs.writeScript "downscript" ''
+          #!/bin/sh
+          ${pkgs.iproute2}/bin/ip addr del "$2"/24 dev "$1"
+        '';
       };
-  in
-  {
-    name = "ucarp";
-    meta.maintainers = with lib.maintainers; [ oxzi ];
-
-    nodes = {
-      hostA = mkUcarpHost addrHostA;
-      hostB = mkUcarpHost addrHostB;
     };
+in
+{
+  name = "ucarp";
+  meta.maintainers = with lib.maintainers; [ oxzi ];
 
-    testScript = ''
-      def is_master(host):
-        ipOutput = host.succeed("ip addr show dev eth1")
-        return "inet ${addrShared}/24" in ipOutput
+  nodes = {
+    hostA = mkUcarpHost addrHostA;
+    hostB = mkUcarpHost addrHostB;
+  };
+
+  testScript = ''
+    def is_master(host):
+      ipOutput = host.succeed("ip addr show dev eth1")
+      return "inet ${addrShared}/24" in ipOutput
 
 
-      start_all()
+    start_all()
 
-      # First, let both hosts start and let a master node be selected
-      for host, peer in [(hostA, "${addrHostB}"), (hostB, "${addrHostA}")]:
-        host.wait_for_unit("ucarp.service")
-        host.succeed(f"ping -c 1 {peer}")
+    # First, let both hosts start and let a master node be selected
+    for host, peer in [(hostA, "${addrHostB}"), (hostB, "${addrHostA}")]:
+      host.wait_for_unit("ucarp.service")
+      host.succeed(f"ping -c 1 {peer}")
 
-      hostA.sleep(5)
+    hostA.sleep(5)
 
-      hostA_master, hostB_master = is_master(hostA), is_master(hostB)
-      assert hostA_master != hostB_master, "only one master node is allowed"
+    hostA_master, hostB_master = is_master(hostA), is_master(hostB)
+    assert hostA_master != hostB_master, "only one master node is allowed"
 
-      master_host = hostA if hostA_master else hostB
-      backup_host = hostB if hostA_master else hostA
+    master_host = hostA if hostA_master else hostB
+    backup_host = hostB if hostA_master else hostA
 
-      # Let's crash the master host and let the backup take over
-      master_host.crash()
+    # Let's crash the master host and let the backup take over
+    master_host.crash()
 
-      backup_host.sleep(5)
-      assert is_master(backup_host), "backup did not take over"
-    '';
-  }
-)
+    backup_host.sleep(5)
+    assert is_master(backup_host), "backup did not take over"
+  '';
+}
diff --git a/nixos/tests/udisks2.nix b/nixos/tests/udisks2.nix
index 3800a53ef196..591ad0741e28 100644
--- a/nixos/tests/udisks2.nix
+++ b/nixos/tests/udisks2.nix
@@ -1,74 +1,72 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
+let
 
-    # FIXME: 404s
-    stick = pkgs.fetchurl {
-      url = "https://nixos.org/~eelco/nix/udisks-test.img.xz";
-      sha256 = "0was1xgjkjad91nipzclaz5biv3m4b2nk029ga6nk7iklwi19l8b";
+  # FIXME: 404s
+  stick = pkgs.fetchurl {
+    url = "https://nixos.org/~eelco/nix/udisks-test.img.xz";
+    sha256 = "0was1xgjkjad91nipzclaz5biv3m4b2nk029ga6nk7iklwi19l8b";
+  };
+
+in
+
+{
+  name = "udisks2";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      services.udisks2.enable = true;
+      imports = [ ./common/user-account.nix ];
+
+      security.polkit.extraConfig = ''
+        polkit.addRule(function(action, subject) {
+          if (subject.user == "alice") return "yes";
+        });
+      '';
     };
 
-  in
+  testScript = ''
+    import lzma
 
-  {
-    name = "udisks2";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
-    };
+    machine.systemctl("start udisks2")
+    machine.wait_for_unit("udisks2.service")
 
-    nodes.machine =
-      { ... }:
-      {
-        services.udisks2.enable = true;
-        imports = [ ./common/user-account.nix ];
+    with lzma.open(
+        "${stick}"
+    ) as data, open(machine.state_dir / "usbstick.img", "wb") as stick:
+        stick.write(data.read())
 
-        security.polkit.extraConfig = ''
-          polkit.addRule(function(action, subject) {
-            if (subject.user == "alice") return "yes";
-          });
-        '';
-      };
+    machine.succeed("udisksctl info -b /dev/vda >&2")
+    machine.fail("udisksctl info -b /dev/sda1")
 
-    testScript = ''
-      import lzma
+    # Attach a USB stick and wait for it to show up.
+    machine.send_monitor_command(
+        f"drive_add 0 id=stick,if=none,file={stick.name},format=raw"
+    )
+    machine.send_monitor_command("device_add usb-storage,id=stick,drive=stick")
+    machine.wait_until_succeeds("udisksctl info -b /dev/sda1")
+    machine.succeed("udisksctl info -b /dev/sda1 | grep 'IdLabel:.*USBSTICK'")
 
-      machine.systemctl("start udisks2")
-      machine.wait_for_unit("udisks2.service")
+    # Mount the stick as a non-root user and do some stuff with it.
+    machine.succeed("su - alice -c 'udisksctl info -b /dev/sda1'")
+    machine.succeed("su - alice -c 'udisksctl mount -b /dev/sda1'")
+    machine.succeed(
+        "su - alice -c 'cat /run/media/alice/USBSTICK/test.txt' | grep -q 'Hello World'"
+    )
+    machine.succeed("su - alice -c 'echo foo > /run/media/alice/USBSTICK/bar.txt'")
 
-      with lzma.open(
-          "${stick}"
-      ) as data, open(machine.state_dir / "usbstick.img", "wb") as stick:
-          stick.write(data.read())
+    # Unmounting the stick should make the mountpoint disappear.
+    machine.succeed("su - alice -c 'udisksctl unmount -b /dev/sda1'")
+    machine.fail("[ -d /run/media/alice/USBSTICK ]")
 
-      machine.succeed("udisksctl info -b /dev/vda >&2")
-      machine.fail("udisksctl info -b /dev/sda1")
+    # Remove the USB stick.
+    machine.send_monitor_command("device_del stick")
+    machine.wait_until_fails("udisksctl info -b /dev/sda1")
+    machine.fail("[ -e /dev/sda ]")
+  '';
 
-      # Attach a USB stick and wait for it to show up.
-      machine.send_monitor_command(
-          f"drive_add 0 id=stick,if=none,file={stick.name},format=raw"
-      )
-      machine.send_monitor_command("device_add usb-storage,id=stick,drive=stick")
-      machine.wait_until_succeeds("udisksctl info -b /dev/sda1")
-      machine.succeed("udisksctl info -b /dev/sda1 | grep 'IdLabel:.*USBSTICK'")
-
-      # Mount the stick as a non-root user and do some stuff with it.
-      machine.succeed("su - alice -c 'udisksctl info -b /dev/sda1'")
-      machine.succeed("su - alice -c 'udisksctl mount -b /dev/sda1'")
-      machine.succeed(
-          "su - alice -c 'cat /run/media/alice/USBSTICK/test.txt' | grep -q 'Hello World'"
-      )
-      machine.succeed("su - alice -c 'echo foo > /run/media/alice/USBSTICK/bar.txt'")
-
-      # Unmounting the stick should make the mountpoint disappear.
-      machine.succeed("su - alice -c 'udisksctl unmount -b /dev/sda1'")
-      machine.fail("[ -d /run/media/alice/USBSTICK ]")
-
-      # Remove the USB stick.
-      machine.send_monitor_command("device_del stick")
-      machine.wait_until_fails("udisksctl info -b /dev/sda1")
-      machine.fail("[ -e /dev/sda ]")
-    '';
-
-  }
-)
+}
diff --git a/nixos/tests/ulogd/ulogd.nix b/nixos/tests/ulogd/ulogd.nix
index 9146ec44561d..2130a334fea1 100644
--- a/nixos/tests/ulogd/ulogd.nix
+++ b/nixos/tests/ulogd/ulogd.nix
@@ -1,61 +1,59 @@
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "ulogd";
+{ pkgs, lib, ... }:
+{
+  name = "ulogd";
 
-    meta.maintainers = with lib.maintainers; [ p-h ];
-
-    nodes.machine =
-      { ... }:
-      {
-        networking.firewall.enable = false;
-        networking.nftables.enable = true;
-        networking.nftables.ruleset = ''
-          table inet filter {
-            chain input {
-              type filter hook input priority 0;
-              icmp type { echo-request, echo-reply } log group 2 accept
-            }
-
-            chain output {
-              type filter hook output priority 0; policy accept;
-              icmp type { echo-request, echo-reply } log group 2 accept
-            }
-
-            chain forward {
-              type filter hook forward priority 0; policy drop;
-            }
+  meta.maintainers = with lib.maintainers; [ p-h ];
 
+  nodes.machine =
+    { ... }:
+    {
+      networking.firewall.enable = false;
+      networking.nftables.enable = true;
+      networking.nftables.ruleset = ''
+        table inet filter {
+          chain input {
+            type filter hook input priority 0;
+            icmp type { echo-request, echo-reply } log group 2 accept
           }
-        '';
-        services.ulogd = {
-          enable = true;
-          settings = {
-            global = {
-              logfile = "/var/log/ulogd.log";
-              stack = [
-                "log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu1:LOGEMU"
-                "log1:NFLOG,base1:BASE,pcap1:PCAP"
-              ];
-            };
 
-            log1.group = 2;
+          chain output {
+            type filter hook output priority 0; policy accept;
+            icmp type { echo-request, echo-reply } log group 2 accept
+          }
 
-            pcap1 = {
-              sync = 1;
-              file = "/var/log/ulogd.pcap";
-            };
+          chain forward {
+            type filter hook forward priority 0; policy drop;
+          }
 
-            emu1 = {
-              sync = 1;
-              file = "/var/log/ulogd_pkts.log";
-            };
+        }
+      '';
+      services.ulogd = {
+        enable = true;
+        settings = {
+          global = {
+            logfile = "/var/log/ulogd.log";
+            stack = [
+              "log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu1:LOGEMU"
+              "log1:NFLOG,base1:BASE,pcap1:PCAP"
+            ];
+          };
+
+          log1.group = 2;
+
+          pcap1 = {
+            sync = 1;
+            file = "/var/log/ulogd.pcap";
+          };
+
+          emu1 = {
+            sync = 1;
+            file = "/var/log/ulogd_pkts.log";
           };
         };
-
-        environment.systemPackages = with pkgs; [ tcpdump ];
       };
 
-    testScript = lib.readFile ./ulogd.py;
-  }
-)
+      environment.systemPackages = with pkgs; [ tcpdump ];
+    };
+
+  testScript = lib.readFile ./ulogd.py;
+}
diff --git a/nixos/tests/umurmur.nix b/nixos/tests/umurmur.nix
index 0fcdeb1847ff..d5d167b70cf2 100644
--- a/nixos/tests/umurmur.nix
+++ b/nixos/tests/umurmur.nix
@@ -1,99 +1,97 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    client =
-      { pkgs, ... }:
-      {
-        imports = [ ./common/x11.nix ];
-        environment.systemPackages = [ pkgs.mumble ];
-      };
-    port = 56457;
-  in
-  {
-    name = "mumble";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ _3JlOy-PYCCKUi ];
+let
+  client =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/x11.nix ];
+      environment.systemPackages = [ pkgs.mumble ];
     };
+  port = 56457;
+in
+{
+  name = "mumble";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ _3JlOy-PYCCKUi ];
+  };
 
-    nodes = {
-      server =
-        { ... }:
-        {
-          services.umurmur = {
-            enable = true;
-            openFirewall = true;
-            settings = {
-              password = "testpassword";
-              channels = [
-                {
-                  name = "root";
-                  parent = "";
-                  description = "Root channel. No entry.";
-                  noenter = true;
-                }
-                {
-                  name = "lobby";
-                  parent = "root";
-                  description = "Lobby channel";
-                }
-              ];
-              default_channel = "lobby";
-              bindport = port;
-            };
+  nodes = {
+    server =
+      { ... }:
+      {
+        services.umurmur = {
+          enable = true;
+          openFirewall = true;
+          settings = {
+            password = "testpassword";
+            channels = [
+              {
+                name = "root";
+                parent = "";
+                description = "Root channel. No entry.";
+                noenter = true;
+              }
+              {
+                name = "lobby";
+                parent = "root";
+                description = "Lobby channel";
+              }
+            ];
+            default_channel = "lobby";
+            bindport = port;
           };
         };
+      };
 
-      client1 = client;
-      client2 = client;
-    };
+    client1 = client;
+    client2 = client;
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      server.wait_for_unit("umurmur.service")
-      client1.wait_for_x()
-      client2.wait_for_x()
+    server.wait_for_unit("umurmur.service")
+    client1.wait_for_x()
+    client2.wait_for_x()
 
-      client1.execute("mumble mumble://client1:testpassword\@server:${toString port}/lobby >&2 &")
-      client2.execute("mumble mumble://client2:testpassword\@server:${toString port}/lobby >&2 &")
+    client1.execute("mumble mumble://client1:testpassword\@server:${toString port}/lobby >&2 &")
+    client2.execute("mumble mumble://client2:testpassword\@server:${toString port}/lobby >&2 &")
 
-      # cancel client audio configuration
-      client1.wait_for_window(r"Audio Tuning Wizard")
-      client2.wait_for_window(r"Audio Tuning Wizard")
-      server.sleep(5)  # wait because mumble is slow to register event handlers
-      client1.send_key("esc")
-      client2.send_key("esc")
+    # cancel client audio configuration
+    client1.wait_for_window(r"Audio Tuning Wizard")
+    client2.wait_for_window(r"Audio Tuning Wizard")
+    server.sleep(5)  # wait because mumble is slow to register event handlers
+    client1.send_key("esc")
+    client2.send_key("esc")
 
-      # cancel client cert configuration
-      client1.wait_for_window(r"Certificate Management")
-      client2.wait_for_window(r"Certificate Management")
-      server.sleep(5)  # wait because mumble is slow to register event handlers
-      client1.send_key("esc")
-      client2.send_key("esc")
+    # cancel client cert configuration
+    client1.wait_for_window(r"Certificate Management")
+    client2.wait_for_window(r"Certificate Management")
+    server.sleep(5)  # wait because mumble is slow to register event handlers
+    client1.send_key("esc")
+    client2.send_key("esc")
 
-      # accept server certificate
-      client1.wait_for_window(r"^Mumble$")
-      client2.wait_for_window(r"^Mumble$")
-      server.sleep(5)  # wait because mumble is slow to register event handlers
-      client1.send_chars("y")
-      client2.send_chars("y")
-      server.sleep(5)  # wait because mumble is slow to register event handlers
+    # accept server certificate
+    client1.wait_for_window(r"^Mumble$")
+    client2.wait_for_window(r"^Mumble$")
+    server.sleep(5)  # wait because mumble is slow to register event handlers
+    client1.send_chars("y")
+    client2.send_chars("y")
+    server.sleep(5)  # wait because mumble is slow to register event handlers
 
-      # sometimes the wrong of the 2 windows is focused, we switch focus and try pressing "y" again
-      client1.send_key("alt-tab")
-      client2.send_key("alt-tab")
-      server.sleep(5)  # wait because mumble is slow to register event handlers
-      client1.send_chars("y")
-      client2.send_chars("y")
+    # sometimes the wrong of the 2 windows is focused, we switch focus and try pressing "y" again
+    client1.send_key("alt-tab")
+    client2.send_key("alt-tab")
+    server.sleep(5)  # wait because mumble is slow to register event handlers
+    client1.send_chars("y")
+    client2.send_chars("y")
 
-      # Find clients in logs
-      server.wait_until_succeeds(
-          "journalctl -eu umurmur -o cat | grep -q 'User client1 authenticated'"
-      )
-      server.wait_until_succeeds(
-          "journalctl -eu umurmur -o cat | grep -q 'User client2 authenticated'"
-      )
-    '';
-  }
-)
+    # Find clients in logs
+    server.wait_until_succeeds(
+        "journalctl -eu umurmur -o cat | grep -q 'User client1 authenticated'"
+    )
+    server.wait_until_succeeds(
+        "journalctl -eu umurmur -o cat | grep -q 'User client2 authenticated'"
+    )
+  '';
+}
diff --git a/nixos/tests/unbound.nix b/nixos/tests/unbound.nix
index 0aa3a6a0c16f..1e656fc5fcf2 100644
--- a/nixos/tests/unbound.nix
+++ b/nixos/tests/unbound.nix
@@ -16,379 +16,377 @@
   access to that socket. Also, when there is no socket configured, users
   shouldn't be able to access the control socket at all. Not even root.
 */
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    # common client configuration that we can just use for the multitude of
-    # clients we are constructing
-    common =
-      { lib, pkgs, ... }:
+{ pkgs, lib, ... }:
+let
+  # common client configuration that we can just use for the multitude of
+  # clients we are constructing
+  common =
+    { lib, pkgs, ... }:
+    {
+      config = {
+        environment.systemPackages = [ pkgs.knot-dns ];
+
+        # disable the root anchor update as we do not have internet access during
+        # the test execution
+        services.unbound.enableRootTrustAnchor = false;
+
+        # we want to test the full-variant of the package to also get DoH support
+        services.unbound.package = pkgs.unbound-full;
+      };
+    };
+
+  cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=dns.example.local'
+    mkdir -p $out
+    cp key.pem cert.pem $out
+  '';
+in
+{
+  name = "unbound";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ andir ];
+  };
+
+  nodes = {
+
+    # The server that actually serves our zones, this tests unbounds authoriative mode
+    authoritative =
       {
-        config = {
-          environment.systemPackages = [ pkgs.knot-dns ];
+        lib,
+        pkgs,
+        config,
+        ...
+      }:
+      {
+        imports = [ common ];
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          {
+            address = "192.168.0.1";
+            prefixLength = 24;
+          }
+        ];
+        networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
+          {
+            address = "fd21::1";
+            prefixLength = 64;
+          }
+        ];
+        networking.firewall.allowedTCPPorts = [ 53 ];
+        networking.firewall.allowedUDPPorts = [ 53 ];
 
-          # disable the root anchor update as we do not have internet access during
-          # the test execution
-          services.unbound.enableRootTrustAnchor = false;
-
-          # we want to test the full-variant of the package to also get DoH support
-          services.unbound.package = pkgs.unbound-full;
+        services.unbound = {
+          enable = true;
+          settings = {
+            server = {
+              interface = [
+                "192.168.0.1"
+                "fd21::1"
+                "::1"
+                "127.0.0.1"
+              ];
+              access-control = [
+                "192.168.0.0/24 allow"
+                "fd21::/64 allow"
+                "::1 allow"
+                "127.0.0.0/8 allow"
+              ];
+              local-data = [
+                ''"example.local. IN A 1.2.3.4"''
+                ''"example.local. IN AAAA abcd::eeff"''
+              ];
+            };
+          };
         };
       };
 
-    cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
-      openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=dns.example.local'
-      mkdir -p $out
-      cp key.pem cert.pem $out
+    # The resolver that knows that forwards (only) to the authoritative server
+    # and listens on UDP/53, TCP/53 & TCP/853.
+    resolver =
+      { lib, nodes, ... }:
+      {
+        imports = [ common ];
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          {
+            address = "192.168.0.2";
+            prefixLength = 24;
+          }
+        ];
+        networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
+          {
+            address = "fd21::2";
+            prefixLength = 64;
+          }
+        ];
+        networking.firewall.allowedTCPPorts = [
+          53 # regular DNS
+          853 # DNS over TLS
+          443 # DNS over HTTPS
+        ];
+        networking.firewall.allowedUDPPorts = [ 53 ];
+
+        services.unbound = {
+          enable = true;
+          settings = {
+            server = {
+              interface = [
+                "::1"
+                "127.0.0.1"
+                "192.168.0.2"
+                "fd21::2"
+                "192.168.0.2@853"
+                "fd21::2@853"
+                "::1@853"
+                "127.0.0.1@853"
+                "192.168.0.2@443"
+                "fd21::2@443"
+                "::1@443"
+                "127.0.0.1@443"
+              ];
+              access-control = [
+                "192.168.0.0/24 allow"
+                "fd21::/64 allow"
+                "::1 allow"
+                "127.0.0.0/8 allow"
+              ];
+              tls-service-pem = "${cert}/cert.pem";
+              tls-service-key = "${cert}/key.pem";
+            };
+            forward-zone = [
+              {
+                name = ".";
+                forward-addr = [
+                  (lib.head nodes.authoritative.networking.interfaces.eth1.ipv6.addresses).address
+                  (lib.head nodes.authoritative.networking.interfaces.eth1.ipv4.addresses).address
+                ];
+              }
+            ];
+          };
+        };
+      };
+
+    # machine that runs a local unbound that will be reconfigured during test execution
+    local_resolver =
+      {
+        lib,
+        nodes,
+        config,
+        ...
+      }:
+      {
+        imports = [ common ];
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          {
+            address = "192.168.0.3";
+            prefixLength = 24;
+          }
+        ];
+        networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
+          {
+            address = "fd21::3";
+            prefixLength = 64;
+          }
+        ];
+        networking.firewall.allowedTCPPorts = [
+          53 # regular DNS
+        ];
+        networking.firewall.allowedUDPPorts = [ 53 ];
+
+        services.unbound = {
+          enable = true;
+          settings = {
+            server = {
+              interface = [
+                "::1"
+                "127.0.0.1"
+              ];
+              access-control = [
+                "::1 allow"
+                "127.0.0.0/8 allow"
+              ];
+            };
+            include = "/etc/unbound/extra*.conf";
+          };
+          localControlSocketPath = "/run/unbound/unbound.ctl";
+        };
+
+        users.users = {
+          # user that is permitted to access the unix socket
+          someuser = {
+            isSystemUser = true;
+            group = "someuser";
+            extraGroups = [
+              config.users.users.unbound.group
+            ];
+          };
+
+          # user that is not permitted to access the unix socket
+          unauthorizeduser = {
+            isSystemUser = true;
+            group = "unauthorizeduser";
+          };
+
+        };
+        users.groups = {
+          someuser = { };
+          unauthorizeduser = { };
+        };
+
+        # Used for testing configuration reloading
+        environment.etc = {
+          "unbound-extra1.conf".text = ''
+            forward-zone:
+            name: "example.local."
+            forward-addr: ${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address}
+            forward-addr: ${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}
+          '';
+          "unbound-extra2.conf".text = ''
+            auth-zone:
+              name: something.local.
+              zonefile: ${pkgs.writeText "zone" ''
+                something.local. IN A 3.4.5.6
+              ''}
+          '';
+        };
+      };
+
+    # plain node that only has network access and doesn't run any part of the
+    # resolver software locally
+    client =
+      { lib, nodes, ... }:
+      {
+        imports = [ common ];
+        networking.nameservers = [
+          (lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address
+          (lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address
+        ];
+        networking.interfaces.eth1.ipv4.addresses = [
+          {
+            address = "192.168.0.10";
+            prefixLength = 24;
+          }
+        ];
+        networking.interfaces.eth1.ipv6.addresses = [
+          {
+            address = "fd21::10";
+            prefixLength = 64;
+          }
+        ];
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      import typing
+
+      zone = "example.local."
+      records = [("AAAA", "abcd::eeff"), ("A", "1.2.3.4")]
+
+
+      def query(
+          machine,
+          host: str,
+          query_type: str,
+          query: str,
+          expected: typing.Optional[str] = None,
+          args: typing.Optional[typing.List[str]] = None,
+      ):
+          """
+          Execute a single query and compare the result with expectation
+          """
+          text_args = ""
+          if args:
+              text_args = " ".join(args)
+
+          out = machine.succeed(
+              f"kdig {text_args} {query} {query_type} @{host} +short"
+          ).strip()
+          machine.log(f"{host} replied with {out}")
+          if expected:
+              assert expected == out, f"Expected `{expected}` but got `{out}`"
+
+
+      def test(machine, remotes, /, doh=False, zone=zone, records=records, args=[]):
+          """
+          Run queries for the given remotes on the given machine.
+          """
+          for query_type, expected in records:
+              for remote in remotes:
+                  query(machine, remote, query_type, zone, expected, args)
+                  query(machine, remote, query_type, zone, expected, ["+tcp"] + args)
+                  if doh:
+                      query(
+                          machine,
+                          remote,
+                          query_type,
+                          zone,
+                          expected,
+                          ["+tcp", "+tls"] + args,
+                      )
+                      query(
+                          machine,
+                          remote,
+                          query_type,
+                          zone,
+                          expected,
+                          ["+https"] + args,
+                      )
+
+
+      client.start()
+      authoritative.wait_for_unit("unbound.service")
+
+      # verify that we can resolve locally
+      with subtest("test the authoritative servers local responses"):
+          test(authoritative, ["::1", "127.0.0.1"])
+
+      resolver.wait_for_unit("unbound.service")
+
+      with subtest("root is unable to use unbounc-control when the socket is not configured"):
+          resolver.succeed("which unbound-control")  # the binary must exist
+          resolver.fail("unbound-control list_forwards")  # the invocation must fail
+
+      # verify that the resolver is able to resolve on all the local protocols
+      with subtest("test that the resolver resolves on all protocols and transports"):
+          test(resolver, ["::1", "127.0.0.1"], doh=True)
+
+      resolver.wait_for_unit("multi-user.target")
+
+      with subtest("client should be able to query the resolver"):
+          test(client, ["${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address}", "${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}"], doh=True)
+
+      # discard the client we do not need anymore
+      client.shutdown()
+
+      local_resolver.wait_for_unit("multi-user.target")
+
+      # link a new config file to /etc/unbound/extra.conf
+      local_resolver.succeed("ln -s /etc/unbound-extra1.conf /etc/unbound/extra1.conf")
+
+      # reload the server & ensure the forwarding works
+      with subtest("test that the local resolver resolves on all protocols and transports"):
+          local_resolver.succeed("systemctl reload unbound")
+          print(local_resolver.succeed("journalctl -u unbound -n 1000"))
+          test(local_resolver, ["::1", "127.0.0.1"], args=["+timeout=60"])
+
+      with subtest("test that we can use the unbound control socket"):
+          out = local_resolver.succeed(
+              "sudo -u someuser -- unbound-control list_forwards"
+          ).strip()
+
+          # Thank you black! Can't really break this line into a readable version.
+          expected = "example.local. IN forward ${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address} ${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}"
+          assert out == expected, f"Expected `{expected}` but got `{out}` instead."
+          local_resolver.fail("sudo -u unauthorizeduser -- unbound-control list_forwards")
+
+
+      # link a new config file to /etc/unbound/extra.conf
+      local_resolver.succeed("ln -sf /etc/unbound-extra2.conf /etc/unbound/extra2.conf")
+
+      # reload the server & ensure the new local zone works
+      with subtest("test that we can query the new local zone"):
+          local_resolver.succeed("unbound-control reload")
+          r = [("A", "3.4.5.6")]
+          test(local_resolver, ["::1", "127.0.0.1"], zone="something.local.", records=r)
     '';
-  in
-  {
-    name = "unbound";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ andir ];
-    };
-
-    nodes = {
-
-      # The server that actually serves our zones, this tests unbounds authoriative mode
-      authoritative =
-        {
-          lib,
-          pkgs,
-          config,
-          ...
-        }:
-        {
-          imports = [ common ];
-          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-            {
-              address = "192.168.0.1";
-              prefixLength = 24;
-            }
-          ];
-          networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
-            {
-              address = "fd21::1";
-              prefixLength = 64;
-            }
-          ];
-          networking.firewall.allowedTCPPorts = [ 53 ];
-          networking.firewall.allowedUDPPorts = [ 53 ];
-
-          services.unbound = {
-            enable = true;
-            settings = {
-              server = {
-                interface = [
-                  "192.168.0.1"
-                  "fd21::1"
-                  "::1"
-                  "127.0.0.1"
-                ];
-                access-control = [
-                  "192.168.0.0/24 allow"
-                  "fd21::/64 allow"
-                  "::1 allow"
-                  "127.0.0.0/8 allow"
-                ];
-                local-data = [
-                  ''"example.local. IN A 1.2.3.4"''
-                  ''"example.local. IN AAAA abcd::eeff"''
-                ];
-              };
-            };
-          };
-        };
-
-      # The resolver that knows that forwards (only) to the authoritative server
-      # and listens on UDP/53, TCP/53 & TCP/853.
-      resolver =
-        { lib, nodes, ... }:
-        {
-          imports = [ common ];
-          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-            {
-              address = "192.168.0.2";
-              prefixLength = 24;
-            }
-          ];
-          networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
-            {
-              address = "fd21::2";
-              prefixLength = 64;
-            }
-          ];
-          networking.firewall.allowedTCPPorts = [
-            53 # regular DNS
-            853 # DNS over TLS
-            443 # DNS over HTTPS
-          ];
-          networking.firewall.allowedUDPPorts = [ 53 ];
-
-          services.unbound = {
-            enable = true;
-            settings = {
-              server = {
-                interface = [
-                  "::1"
-                  "127.0.0.1"
-                  "192.168.0.2"
-                  "fd21::2"
-                  "192.168.0.2@853"
-                  "fd21::2@853"
-                  "::1@853"
-                  "127.0.0.1@853"
-                  "192.168.0.2@443"
-                  "fd21::2@443"
-                  "::1@443"
-                  "127.0.0.1@443"
-                ];
-                access-control = [
-                  "192.168.0.0/24 allow"
-                  "fd21::/64 allow"
-                  "::1 allow"
-                  "127.0.0.0/8 allow"
-                ];
-                tls-service-pem = "${cert}/cert.pem";
-                tls-service-key = "${cert}/key.pem";
-              };
-              forward-zone = [
-                {
-                  name = ".";
-                  forward-addr = [
-                    (lib.head nodes.authoritative.networking.interfaces.eth1.ipv6.addresses).address
-                    (lib.head nodes.authoritative.networking.interfaces.eth1.ipv4.addresses).address
-                  ];
-                }
-              ];
-            };
-          };
-        };
-
-      # machine that runs a local unbound that will be reconfigured during test execution
-      local_resolver =
-        {
-          lib,
-          nodes,
-          config,
-          ...
-        }:
-        {
-          imports = [ common ];
-          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-            {
-              address = "192.168.0.3";
-              prefixLength = 24;
-            }
-          ];
-          networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
-            {
-              address = "fd21::3";
-              prefixLength = 64;
-            }
-          ];
-          networking.firewall.allowedTCPPorts = [
-            53 # regular DNS
-          ];
-          networking.firewall.allowedUDPPorts = [ 53 ];
-
-          services.unbound = {
-            enable = true;
-            settings = {
-              server = {
-                interface = [
-                  "::1"
-                  "127.0.0.1"
-                ];
-                access-control = [
-                  "::1 allow"
-                  "127.0.0.0/8 allow"
-                ];
-              };
-              include = "/etc/unbound/extra*.conf";
-            };
-            localControlSocketPath = "/run/unbound/unbound.ctl";
-          };
-
-          users.users = {
-            # user that is permitted to access the unix socket
-            someuser = {
-              isSystemUser = true;
-              group = "someuser";
-              extraGroups = [
-                config.users.users.unbound.group
-              ];
-            };
-
-            # user that is not permitted to access the unix socket
-            unauthorizeduser = {
-              isSystemUser = true;
-              group = "unauthorizeduser";
-            };
-
-          };
-          users.groups = {
-            someuser = { };
-            unauthorizeduser = { };
-          };
-
-          # Used for testing configuration reloading
-          environment.etc = {
-            "unbound-extra1.conf".text = ''
-              forward-zone:
-              name: "example.local."
-              forward-addr: ${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address}
-              forward-addr: ${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}
-            '';
-            "unbound-extra2.conf".text = ''
-              auth-zone:
-                name: something.local.
-                zonefile: ${pkgs.writeText "zone" ''
-                  something.local. IN A 3.4.5.6
-                ''}
-            '';
-          };
-        };
-
-      # plain node that only has network access and doesn't run any part of the
-      # resolver software locally
-      client =
-        { lib, nodes, ... }:
-        {
-          imports = [ common ];
-          networking.nameservers = [
-            (lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address
-            (lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address
-          ];
-          networking.interfaces.eth1.ipv4.addresses = [
-            {
-              address = "192.168.0.10";
-              prefixLength = 24;
-            }
-          ];
-          networking.interfaces.eth1.ipv6.addresses = [
-            {
-              address = "fd21::10";
-              prefixLength = 64;
-            }
-          ];
-        };
-    };
-
-    testScript =
-      { nodes, ... }:
-      ''
-        import typing
-
-        zone = "example.local."
-        records = [("AAAA", "abcd::eeff"), ("A", "1.2.3.4")]
-
-
-        def query(
-            machine,
-            host: str,
-            query_type: str,
-            query: str,
-            expected: typing.Optional[str] = None,
-            args: typing.Optional[typing.List[str]] = None,
-        ):
-            """
-            Execute a single query and compare the result with expectation
-            """
-            text_args = ""
-            if args:
-                text_args = " ".join(args)
-
-            out = machine.succeed(
-                f"kdig {text_args} {query} {query_type} @{host} +short"
-            ).strip()
-            machine.log(f"{host} replied with {out}")
-            if expected:
-                assert expected == out, f"Expected `{expected}` but got `{out}`"
-
-
-        def test(machine, remotes, /, doh=False, zone=zone, records=records, args=[]):
-            """
-            Run queries for the given remotes on the given machine.
-            """
-            for query_type, expected in records:
-                for remote in remotes:
-                    query(machine, remote, query_type, zone, expected, args)
-                    query(machine, remote, query_type, zone, expected, ["+tcp"] + args)
-                    if doh:
-                        query(
-                            machine,
-                            remote,
-                            query_type,
-                            zone,
-                            expected,
-                            ["+tcp", "+tls"] + args,
-                        )
-                        query(
-                            machine,
-                            remote,
-                            query_type,
-                            zone,
-                            expected,
-                            ["+https"] + args,
-                        )
-
-
-        client.start()
-        authoritative.wait_for_unit("unbound.service")
-
-        # verify that we can resolve locally
-        with subtest("test the authoritative servers local responses"):
-            test(authoritative, ["::1", "127.0.0.1"])
-
-        resolver.wait_for_unit("unbound.service")
-
-        with subtest("root is unable to use unbounc-control when the socket is not configured"):
-            resolver.succeed("which unbound-control")  # the binary must exist
-            resolver.fail("unbound-control list_forwards")  # the invocation must fail
-
-        # verify that the resolver is able to resolve on all the local protocols
-        with subtest("test that the resolver resolves on all protocols and transports"):
-            test(resolver, ["::1", "127.0.0.1"], doh=True)
-
-        resolver.wait_for_unit("multi-user.target")
-
-        with subtest("client should be able to query the resolver"):
-            test(client, ["${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address}", "${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}"], doh=True)
-
-        # discard the client we do not need anymore
-        client.shutdown()
-
-        local_resolver.wait_for_unit("multi-user.target")
-
-        # link a new config file to /etc/unbound/extra.conf
-        local_resolver.succeed("ln -s /etc/unbound-extra1.conf /etc/unbound/extra1.conf")
-
-        # reload the server & ensure the forwarding works
-        with subtest("test that the local resolver resolves on all protocols and transports"):
-            local_resolver.succeed("systemctl reload unbound")
-            print(local_resolver.succeed("journalctl -u unbound -n 1000"))
-            test(local_resolver, ["::1", "127.0.0.1"], args=["+timeout=60"])
-
-        with subtest("test that we can use the unbound control socket"):
-            out = local_resolver.succeed(
-                "sudo -u someuser -- unbound-control list_forwards"
-            ).strip()
-
-            # Thank you black! Can't really break this line into a readable version.
-            expected = "example.local. IN forward ${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address} ${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}"
-            assert out == expected, f"Expected `{expected}` but got `{out}` instead."
-            local_resolver.fail("sudo -u unauthorizeduser -- unbound-control list_forwards")
-
-
-        # link a new config file to /etc/unbound/extra.conf
-        local_resolver.succeed("ln -sf /etc/unbound-extra2.conf /etc/unbound/extra2.conf")
-
-        # reload the server & ensure the new local zone works
-        with subtest("test that we can query the new local zone"):
-            local_resolver.succeed("unbound-control reload")
-            r = [("A", "3.4.5.6")]
-            test(local_resolver, ["::1", "127.0.0.1"], zone="something.local.", records=r)
-      '';
-  }
-)
+}
diff --git a/nixos/tests/uptermd.nix b/nixos/tests/uptermd.nix
index a7f18fa3cba7..c5020d5ef683 100644
--- a/nixos/tests/uptermd.nix
+++ b/nixos/tests/uptermd.nix
@@ -1,71 +1,69 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    client =
-      { pkgs, ... }:
+let
+  client =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.upterm ];
+    };
+in
+{
+  name = "uptermd";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fleaz ];
+  };
+
+  nodes = {
+    server =
+      { config, ... }:
       {
-        environment.systemPackages = [ pkgs.upterm ];
-      };
-  in
-  {
-    name = "uptermd";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fleaz ];
-    };
-
-    nodes = {
-      server =
-        { config, ... }:
-        {
-          services.uptermd = {
-            enable = true;
-            openFirewall = true;
-            port = 1337;
-          };
+        services.uptermd = {
+          enable = true;
+          openFirewall = true;
+          port = 1337;
         };
-      client1 = client;
-      client2 = client;
-    };
+      };
+    client1 = client;
+    client2 = client;
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      server.wait_for_unit("uptermd.service")
-      server.systemctl("start network-online.target")
-      server.wait_for_unit("network-online.target")
+    server.wait_for_unit("uptermd.service")
+    server.systemctl("start network-online.target")
+    server.wait_for_unit("network-online.target")
 
-      # wait for upterm port to be reachable
-      client1.wait_until_succeeds("nc -z -v server 1337")
+    # wait for upterm port to be reachable
+    client1.wait_until_succeeds("nc -z -v server 1337")
 
-      # Add SSH hostkeys from the server to both clients
-      # uptermd needs an '@cert-authority entry so we need to modify the known_hosts file
-      client1.execute("mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
-      client1.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
-      client2.execute("mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
-      client2.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
+    # Add SSH hostkeys from the server to both clients
+    # uptermd needs an '@cert-authority entry so we need to modify the known_hosts file
+    client1.execute("mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
+    client1.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
+    client2.execute("mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
+    client2.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
 
-      client1.wait_for_unit("multi-user.target")
-      client1.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
-      client1.wait_until_tty_matches("1", "login: ")
-      client1.send_chars("root\n")
-      client1.wait_until_succeeds("pgrep -u root bash")
+    client1.wait_for_unit("multi-user.target")
+    client1.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+    client1.wait_until_tty_matches("1", "login: ")
+    client1.send_chars("root\n")
+    client1.wait_until_succeeds("pgrep -u root bash")
 
-      client1.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
-      client1.send_chars("TERM=xterm upterm host --server ssh://server:1337 --force-command hostname -- bash > /tmp/session-details\n")
-      client1.wait_for_file("/tmp/session-details")
-      client1.send_key("q")
+    client1.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
+    client1.send_chars("TERM=xterm upterm host --server ssh://server:1337 --force-command hostname -- bash > /tmp/session-details\n")
+    client1.wait_for_file("/tmp/session-details")
+    client1.send_key("q")
 
-      # uptermd can't connect if we don't have a keypair
-      client2.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
+    # uptermd can't connect if we don't have a keypair
+    client2.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
 
-      # Grep the ssh connect command from the output of 'upterm host'
-      ssh_command = client1.succeed("grep 'SSH Session' /tmp/session-details | cut -d':' -f2-").strip()
+    # Grep the ssh connect command from the output of 'upterm host'
+    ssh_command = client1.succeed("grep 'SSH Session' /tmp/session-details | cut -d':' -f2-").strip()
 
-      # Connect with client2. Because we used '--force-command hostname' we should get "client1" as the output
-      output = client2.succeed(ssh_command)
+    # Connect with client2. Because we used '--force-command hostname' we should get "client1" as the output
+    output = client2.succeed(ssh_command)
 
-      assert output.strip() == "client1"
-    '';
-  }
-)
+    assert output.strip() == "client1"
+  '';
+}
diff --git a/nixos/tests/uptime-kuma.nix b/nixos/tests/uptime-kuma.nix
index e79546246f62..1d40b4766a8c 100644
--- a/nixos/tests/uptime-kuma.nix
+++ b/nixos/tests/uptime-kuma.nix
@@ -1,21 +1,19 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "uptime-kuma";
-    meta.maintainers = with lib.maintainers; [ julienmalka ];
+{
+  name = "uptime-kuma";
+  meta.maintainers = with lib.maintainers; [ julienmalka ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.uptime-kuma.enable = true;
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.uptime-kuma.enable = true;
+    };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("uptime-kuma.service")
-      machine.wait_for_open_port(3001)
-      machine.succeed("curl --fail http://localhost:3001/")
-    '';
-  }
-)
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("uptime-kuma.service")
+    machine.wait_for_open_port(3001)
+    machine.succeed("curl --fail http://localhost:3001/")
+  '';
+}
diff --git a/nixos/tests/urn-timer.nix b/nixos/tests/urn-timer.nix
index 157e26b30b5e..5748cf096f3e 100644
--- a/nixos/tests/urn-timer.nix
+++ b/nixos/tests/urn-timer.nix
@@ -1,30 +1,28 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "urn-timer";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fgaz ];
+{ pkgs, ... }:
+{
+  name = "urn-timer";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      environment.systemPackages = [ pkgs.urn-timer ];
     };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  enableOCR = true;
 
-        services.xserver.enable = true;
-        environment.systemPackages = [ pkgs.urn-timer ];
-      };
-
-    enableOCR = true;
-
-    testScript = ''
-      machine.wait_for_x()
-      machine.execute("urn-gtk ${pkgs.urn-timer.src}/splits_examples/sotn.json >&2 &")
-      machine.wait_for_window("urn")
-      machine.wait_for_text(r"(Mist|Bat|Reverse|Dracula)")
-      machine.screenshot("screen")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_x()
+    machine.execute("urn-gtk ${pkgs.urn-timer.src}/splits_examples/sotn.json >&2 &")
+    machine.wait_for_window("urn")
+    machine.wait_for_text(r"(Mist|Bat|Reverse|Dracula)")
+    machine.screenshot("screen")
+  '';
+}
diff --git a/nixos/tests/usbguard.nix b/nixos/tests/usbguard.nix
index 210b8b2adac5..959d062b8366 100644
--- a/nixos/tests/usbguard.nix
+++ b/nixos/tests/usbguard.nix
@@ -1,68 +1,66 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "usbguard";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ tnias ];
+{ pkgs, ... }:
+{
+  name = "usbguard";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ tnias ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      services.usbguard = {
+        enable = true;
+        IPCAllowedUsers = [
+          "alice"
+          "root"
+        ];
+
+        # As virtual USB devices get attached to the "QEMU USB Hub" we need to
+        # allow Hubs. Otherwise we would have to explicitly allow them too.
+        rules = ''
+          allow with-interface equals { 09:00:00 }
+        '';
+      };
+      imports = [ ./common/user-account.nix ];
     };
 
-    nodes.machine =
-      { ... }:
-      {
-        services.usbguard = {
-          enable = true;
-          IPCAllowedUsers = [
-            "alice"
-            "root"
-          ];
+  testScript = ''
+    # create a blank disk image for our fake USB stick
+    with open(machine.state_dir / "usbstick.img", "wb") as stick:
+        stick.write(b"\x00" * (1024 * 1024))
 
-          # As virtual USB devices get attached to the "QEMU USB Hub" we need to
-          # allow Hubs. Otherwise we would have to explicitly allow them too.
-          rules = ''
-            allow with-interface equals { 09:00:00 }
-          '';
-        };
-        imports = [ ./common/user-account.nix ];
-      };
+    # wait for machine to have started and the usbguard service to be up
+    machine.wait_for_unit("usbguard.service")
 
-    testScript = ''
-      # create a blank disk image for our fake USB stick
-      with open(machine.state_dir / "usbstick.img", "wb") as stick:
-          stick.write(b"\x00" * (1024 * 1024))
+    with subtest("IPC access control"):
+        # User "alice" is allowed to access the IPC interface
+        machine.succeed("su alice -c 'usbguard list-devices'")
 
-      # wait for machine to have started and the usbguard service to be up
-      machine.wait_for_unit("usbguard.service")
+        # User "bob" is not allowed to access the IPC interface
+        machine.fail("su bob -c 'usbguard list-devices'")
 
-      with subtest("IPC access control"):
-          # User "alice" is allowed to access the IPC interface
-          machine.succeed("su alice -c 'usbguard list-devices'")
+    with subtest("check basic functionality"):
+        # at this point we expect that no USB HDD is connected
+        machine.fail("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'")
 
-          # User "bob" is not allowed to access the IPC interface
-          machine.fail("su bob -c 'usbguard list-devices'")
+        # insert usb device
+        machine.send_monitor_command(
+            f"drive_add 0 id=stick,if=none,file={stick.name},format=raw"
+        )
+        machine.send_monitor_command("device_add usb-storage,id=stick,drive=stick")
 
-      with subtest("check basic functionality"):
-          # at this point we expect that no USB HDD is connected
-          machine.fail("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'")
+        # the attached USB HDD should show up after a short while
+        machine.wait_until_succeeds("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'")
 
-          # insert usb device
-          machine.send_monitor_command(
-              f"drive_add 0 id=stick,if=none,file={stick.name},format=raw"
-          )
-          machine.send_monitor_command("device_add usb-storage,id=stick,drive=stick")
+        # at this point there should be a **blocked** USB HDD
+        machine.succeed("usbguard list-devices | grep -E 'block.*QEMU USB HARDDRIVE'")
+        machine.fail("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'")
 
-          # the attached USB HDD should show up after a short while
-          machine.wait_until_succeeds("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'")
+        # allow storage devices
+        machine.succeed("usbguard allow-device 'with-interface { 08:*:* }'")
 
-          # at this point there should be a **blocked** USB HDD
-          machine.succeed("usbguard list-devices | grep -E 'block.*QEMU USB HARDDRIVE'")
-          machine.fail("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'")
-
-          # allow storage devices
-          machine.succeed("usbguard allow-device 'with-interface { 08:*:* }'")
-
-          # at this point there should be an **allowed** USB HDD
-          machine.succeed("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'")
-          machine.fail("usbguard list-devices | grep -E ' block .*QEMU USB HARDDRIVE'")
-    '';
-  }
-)
+        # at this point there should be an **allowed** USB HDD
+        machine.succeed("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'")
+        machine.fail("usbguard list-devices | grep -E ' block .*QEMU USB HARDDRIVE'")
+  '';
+}
diff --git a/nixos/tests/user-activation-scripts.nix b/nixos/tests/user-activation-scripts.nix
index 58d1b97a09d6..e8ea2d05c465 100644
--- a/nixos/tests/user-activation-scripts.nix
+++ b/nixos/tests/user-activation-scripts.nix
@@ -1,42 +1,40 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "user-activation-scripts";
-    meta = with lib.maintainers; {
-      maintainers = [ chkno ];
+{ lib, ... }:
+{
+  name = "user-activation-scripts";
+  meta = with lib.maintainers; {
+    maintainers = [ chkno ];
+  };
+
+  nodes.machine = {
+    system.switch.enable = true;
+    system.userActivationScripts.foo = "mktemp ~/user-activation-ran.XXXXXX";
+    users.users.alice = {
+      initialPassword = "pass1";
+      isNormalUser = true;
     };
+    systemd.user.tmpfiles.users.alice.rules = [ "r %h/file-to-remove" ];
+  };
 
-    nodes.machine = {
-      system.switch.enable = true;
-      system.userActivationScripts.foo = "mktemp ~/user-activation-ran.XXXXXX";
-      users.users.alice = {
-        initialPassword = "pass1";
-        isNormalUser = true;
-      };
-      systemd.user.tmpfiles.users.alice.rules = [ "r %h/file-to-remove" ];
-    };
-
-    testScript = ''
-      def verify_user_activation_run_count(n):
-          machine.succeed(
-              '[[ "$(find /home/alice/ -name user-activation-ran.\\* | wc -l)" == %s ]]' % n
-          )
+  testScript = ''
+    def verify_user_activation_run_count(n):
+        machine.succeed(
+            '[[ "$(find /home/alice/ -name user-activation-ran.\\* | wc -l)" == %s ]]' % n
+        )
 
 
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_for_unit("getty@tty1.service")
-      machine.wait_until_tty_matches("1", "login: ")
-      machine.send_chars("alice\n")
-      machine.wait_until_tty_matches("1", "Password: ")
-      machine.send_chars("pass1\n")
-      machine.send_chars("touch login-ok\n")
-      machine.wait_for_file("/home/alice/login-ok")
-      verify_user_activation_run_count(1)
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("getty@tty1.service")
+    machine.wait_until_tty_matches("1", "login: ")
+    machine.send_chars("alice\n")
+    machine.wait_until_tty_matches("1", "Password: ")
+    machine.send_chars("pass1\n")
+    machine.send_chars("touch login-ok\n")
+    machine.wait_for_file("/home/alice/login-ok")
+    verify_user_activation_run_count(1)
 
-      machine.succeed("touch /home/alice/file-to-remove")
-      machine.succeed("/run/current-system/bin/switch-to-configuration test")
-      verify_user_activation_run_count(2)
-      machine.succeed("[[ ! -f /home/alice/file-to-remove ]] || false")
-    '';
-  }
-)
+    machine.succeed("touch /home/alice/file-to-remove")
+    machine.succeed("/run/current-system/bin/switch-to-configuration test")
+    verify_user_activation_run_count(2)
+    machine.succeed("[[ ! -f /home/alice/file-to-remove ]] || false")
+  '';
+}
diff --git a/nixos/tests/user-home-mode.nix b/nixos/tests/user-home-mode.nix
index f5bcbcbcef8a..dca1e67ef943 100644
--- a/nixos/tests/user-home-mode.nix
+++ b/nixos/tests/user-home-mode.nix
@@ -1,40 +1,38 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "user-home-mode";
-    meta = with lib.maintainers; {
-      maintainers = [ fbeffa ];
-    };
+{ lib, ... }:
+{
+  name = "user-home-mode";
+  meta = with lib.maintainers; {
+    maintainers = [ fbeffa ];
+  };
 
-    nodes.machine = {
-      users.users.alice = {
-        initialPassword = "pass1";
-        isNormalUser = true;
-      };
-      users.users.bob = {
-        initialPassword = "pass2";
-        isNormalUser = true;
-        homeMode = "750";
-      };
-      users.users.carol = {
-        initialPassword = "pass3";
-        isNormalUser = true;
-        createHome = true;
-        home = "/users/carol";
-      };
+  nodes.machine = {
+    users.users.alice = {
+      initialPassword = "pass1";
+      isNormalUser = true;
     };
+    users.users.bob = {
+      initialPassword = "pass2";
+      isNormalUser = true;
+      homeMode = "750";
+    };
+    users.users.carol = {
+      initialPassword = "pass3";
+      isNormalUser = true;
+      createHome = true;
+      home = "/users/carol";
+    };
+  };
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_for_unit("getty@tty1.service")
-      machine.wait_until_tty_matches("1", "login: ")
-      machine.send_chars("alice\n")
-      machine.wait_until_tty_matches("1", "Password: ")
-      machine.send_chars("pass1\n")
-      machine.succeed('[ "$(stat -c %a /home/alice)" == "700" ]')
-      machine.succeed('[ "$(stat -c %a /home/bob)" == "750" ]')
-      machine.succeed('[ "$(stat -c %a /users)" == "755" ]')
-      machine.succeed('[ "$(stat -c %a /users/carol)" == "700" ]')
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("getty@tty1.service")
+    machine.wait_until_tty_matches("1", "login: ")
+    machine.send_chars("alice\n")
+    machine.wait_until_tty_matches("1", "Password: ")
+    machine.send_chars("pass1\n")
+    machine.succeed('[ "$(stat -c %a /home/alice)" == "700" ]')
+    machine.succeed('[ "$(stat -c %a /home/bob)" == "750" ]')
+    machine.succeed('[ "$(stat -c %a /users)" == "755" ]')
+    machine.succeed('[ "$(stat -c %a /users/carol)" == "700" ]')
+  '';
+}
diff --git a/nixos/tests/ustreamer.nix b/nixos/tests/ustreamer.nix
index a47dc42c0c66..a9cf7150915e 100644
--- a/nixos/tests/ustreamer.nix
+++ b/nixos/tests/ustreamer.nix
@@ -1,74 +1,72 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "ustreamer-vmtest";
-    nodes = {
-      client =
-        { ... }:
-        {
-          environment.systemPackages = [ pkgs.curl ];
+{ pkgs, ... }:
+{
+  name = "ustreamer-vmtest";
+  nodes = {
+    client =
+      { ... }:
+      {
+        environment.systemPackages = [ pkgs.curl ];
+      };
+    camera =
+      { config, ... }:
+      let
+        configFile = pkgs.writeText "akvcam-configFile" ''
+          [Cameras]
+          cameras/size = 2
+
+          cameras/1/type = output
+          cameras/1/mode = mmap, userptr, rw
+          cameras/1/description = Virtual Camera (output device)
+          cameras/1/formats = 2
+          cameras/1/videonr = 7
+
+          cameras/2/type = capture
+          cameras/2/mode = mmap, rw
+          cameras/2/description = Virtual Camera
+          cameras/2/formats = 1, 2
+          cameras/2/videonr = 9
+
+          [Connections]
+          connections/size = 1
+          connections/1/connection = 1:2
+
+          [Formats]
+          formats/size = 2
+
+          formats/1/format = YUY2
+          formats/1/width = 640
+          formats/1/height = 480
+          formats/1/fps = 30
+
+          formats/2/format = RGB24, YUY2
+          formats/2/width = 640
+          formats/2/height = 480
+          formats/2/fps = 20/1, 15/2
+        '';
+      in
+      {
+        services.ustreamer = {
+          enable = true;
+          device = "/dev/video9";
+          extraArgs = [ "--device-timeout=8" ];
         };
-      camera =
-        { config, ... }:
-        let
-          configFile = pkgs.writeText "akvcam-configFile" ''
-            [Cameras]
-            cameras/size = 2
+        networking.firewall.allowedTCPPorts = [ 8080 ];
 
-            cameras/1/type = output
-            cameras/1/mode = mmap, userptr, rw
-            cameras/1/description = Virtual Camera (output device)
-            cameras/1/formats = 2
-            cameras/1/videonr = 7
+        boot.extraModulePackages = [ config.boot.kernelPackages.akvcam ];
+        boot.kernelModules = [ "akvcam" ];
+        boot.extraModprobeConfig = ''
+          options akvcam config_file=${configFile}
+        '';
+      };
+  };
 
-            cameras/2/type = capture
-            cameras/2/mode = mmap, rw
-            cameras/2/description = Virtual Camera
-            cameras/2/formats = 1, 2
-            cameras/2/videonr = 9
+  testScript = ''
+    start_all()
 
-            [Connections]
-            connections/size = 1
-            connections/1/connection = 1:2
+    camera.wait_for_unit("ustreamer.service")
+    camera.wait_for_open_port(8080)
 
-            [Formats]
-            formats/size = 2
-
-            formats/1/format = YUY2
-            formats/1/width = 640
-            formats/1/height = 480
-            formats/1/fps = 30
-
-            formats/2/format = RGB24, YUY2
-            formats/2/width = 640
-            formats/2/height = 480
-            formats/2/fps = 20/1, 15/2
-          '';
-        in
-        {
-          services.ustreamer = {
-            enable = true;
-            device = "/dev/video9";
-            extraArgs = [ "--device-timeout=8" ];
-          };
-          networking.firewall.allowedTCPPorts = [ 8080 ];
-
-          boot.extraModulePackages = [ config.boot.kernelPackages.akvcam ];
-          boot.kernelModules = [ "akvcam" ];
-          boot.extraModprobeConfig = ''
-            options akvcam config_file=${configFile}
-          '';
-        };
-    };
-
-    testScript = ''
-      start_all()
-
-      camera.wait_for_unit("ustreamer.service")
-      camera.wait_for_open_port(8080)
-
-      client.wait_for_unit("multi-user.target")
-      client.succeed("curl http://camera:8080")
-    '';
-  }
-)
+    client.wait_for_unit("multi-user.target")
+    client.succeed("curl http://camera:8080")
+  '';
+}
diff --git a/nixos/tests/uwsgi.nix b/nixos/tests/uwsgi.nix
index ea8e73b0b638..52b9d6361077 100644
--- a/nixos/tests/uwsgi.nix
+++ b/nixos/tests/uwsgi.nix
@@ -1,87 +1,85 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "uwsgi";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ lnl7 ];
-    };
+{ pkgs, ... }:
+{
+  name = "uwsgi";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ lnl7 ];
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        users.users.hello = {
-          isSystemUser = true;
-          group = "hello";
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      users.users.hello = {
+        isSystemUser = true;
+        group = "hello";
+      };
+      users.groups.hello = { };
+
+      services.uwsgi = {
+        enable = true;
+        plugins = [
+          "python3"
+          "php"
+        ];
+        capabilities = [ "CAP_NET_BIND_SERVICE" ];
+        instance.type = "emperor";
+
+        instance.vassals.hello = {
+          type = "normal";
+          immediate-uid = "hello";
+          immediate-gid = "hello";
+          module = "wsgi:application";
+          http = ":80";
+          cap = "net_bind_service";
+          pythonPackages = self: [ self.flask ];
+          chdir = pkgs.writeTextDir "wsgi.py" ''
+            from flask import Flask
+            import subprocess
+            application = Flask(__name__)
+
+            @application.route("/")
+            def hello():
+                return "Hello, World!"
+
+            @application.route("/whoami")
+            def whoami():
+                whoami = "${pkgs.coreutils}/bin/whoami"
+                proc = subprocess.run(whoami, capture_output=True)
+                return proc.stdout.decode().strip()
+          '';
         };
-        users.groups.hello = { };
 
-        services.uwsgi = {
-          enable = true;
-          plugins = [
-            "python3"
-            "php"
-          ];
-          capabilities = [ "CAP_NET_BIND_SERVICE" ];
-          instance.type = "emperor";
-
-          instance.vassals.hello = {
-            type = "normal";
-            immediate-uid = "hello";
-            immediate-gid = "hello";
-            module = "wsgi:application";
-            http = ":80";
-            cap = "net_bind_service";
-            pythonPackages = self: [ self.flask ];
-            chdir = pkgs.writeTextDir "wsgi.py" ''
-              from flask import Flask
-              import subprocess
-              application = Flask(__name__)
-
-              @application.route("/")
-              def hello():
-                  return "Hello, World!"
-
-              @application.route("/whoami")
-              def whoami():
-                  whoami = "${pkgs.coreutils}/bin/whoami"
-                  proc = subprocess.run(whoami, capture_output=True)
-                  return proc.stdout.decode().strip()
-            '';
-          };
-
-          instance.vassals.php = {
-            type = "normal";
-            master = true;
-            workers = 2;
-            http-socket = ":8000";
-            http-socket-modifier1 = 14;
-            php-index = "index.php";
-            php-docroot = pkgs.writeTextDir "index.php" ''
-              <?php echo "Hello World\n"; ?>
-            '';
-          };
+        instance.vassals.php = {
+          type = "normal";
+          master = true;
+          workers = 2;
+          http-socket = ":8000";
+          http-socket-modifier1 = 14;
+          php-index = "index.php";
+          php-docroot = pkgs.writeTextDir "index.php" ''
+            <?php echo "Hello World\n"; ?>
+          '';
         };
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_for_unit("uwsgi.service")
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("uwsgi.service")
 
-      with subtest("uWSGI has started"):
-          machine.wait_for_unit("uwsgi.service")
+    with subtest("uWSGI has started"):
+        machine.wait_for_unit("uwsgi.service")
 
-      with subtest("Vassal can bind on port <1024"):
-          machine.wait_for_open_port(80)
-          hello = machine.succeed("curl -f http://machine").strip()
-          assert "Hello, World!" in hello, f"Excepted 'Hello, World!', got '{hello}'"
+    with subtest("Vassal can bind on port <1024"):
+        machine.wait_for_open_port(80)
+        hello = machine.succeed("curl -f http://machine").strip()
+        assert "Hello, World!" in hello, f"Excepted 'Hello, World!', got '{hello}'"
 
-      with subtest("Vassal is running as dedicated user"):
-          username = machine.succeed("curl -f http://machine/whoami").strip()
-          assert username == "hello", f"Excepted 'hello', got '{username}'"
+    with subtest("Vassal is running as dedicated user"):
+        username = machine.succeed("curl -f http://machine/whoami").strip()
+        assert username == "hello", f"Excepted 'hello', got '{username}'"
 
-      with subtest("PHP plugin is working"):
-          machine.wait_for_open_port(8000)
-          assert "Hello World" in machine.succeed("curl -fv http://machine:8000")
-    '';
-  }
-)
+    with subtest("PHP plugin is working"):
+        machine.wait_for_open_port(8000)
+        assert "Hello World" in machine.succeed("curl -fv http://machine:8000")
+  '';
+}
diff --git a/nixos/tests/v2ray.nix b/nixos/tests/v2ray.nix
index c20720d057d0..29b7c8635444 100644
--- a/nixos/tests/v2ray.nix
+++ b/nixos/tests/v2ray.nix
@@ -1,99 +1,97 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
+{ lib, pkgs, ... }:
+let
 
-    v2rayUser = {
-      # A random UUID.
-      id = "a6a46834-2150-45f8-8364-0f6f6ab32384";
-      alterId = 0; # Non-zero support will be disabled in the future.
-    };
+  v2rayUser = {
+    # A random UUID.
+    id = "a6a46834-2150-45f8-8364-0f6f6ab32384";
+    alterId = 0; # Non-zero support will be disabled in the future.
+  };
 
-    # 1080 [http proxy] -> 1081 [vmess] -> direct
-    v2rayConfig = {
-      inbounds = [
-        {
-          tag = "http_in";
-          port = 1080;
-          listen = "127.0.0.1";
-          protocol = "http";
-        }
-        {
-          tag = "vmess_in";
-          port = 1081;
-          listen = "127.0.0.1";
-          protocol = "vmess";
-          settings.clients = [ v2rayUser ];
-        }
-      ];
-      outbounds = [
-        {
-          tag = "vmess_out";
-          protocol = "vmess";
-          settings.vnext = [
-            {
-              address = "127.0.0.1";
-              port = 1081;
-              users = [ v2rayUser ];
-            }
-          ];
-        }
-        {
-          tag = "direct";
-          protocol = "freedom";
-        }
-      ];
-      routing.rules = [
-        {
-          type = "field";
-          inboundTag = "http_in";
-          outboundTag = "vmess_out";
-        }
-        {
-          type = "field";
-          inboundTag = "vmess_in";
-          outboundTag = "direct";
-        }
-
-        # Assert assets "geoip" and "geosite" are accessible.
-        {
-          type = "field";
-          ip = [ "geoip:private" ];
-          domain = [ "geosite:category-ads" ];
-          outboundTag = "direct";
-        }
-      ];
-    };
-
-  in
-  {
-    name = "v2ray";
-    meta = with lib.maintainers; {
-      maintainers = [ servalcatty ];
-    };
-    nodes.machine =
-      { pkgs, ... }:
+  # 1080 [http proxy] -> 1081 [vmess] -> direct
+  v2rayConfig = {
+    inbounds = [
       {
-        environment.systemPackages = [ pkgs.curl ];
-        services.v2ray = {
-          enable = true;
-          config = v2rayConfig;
-        };
-        services.httpd = {
-          enable = true;
-          adminAddr = "foo@example.org";
-        };
+        tag = "http_in";
+        port = 1080;
+        listen = "127.0.0.1";
+        protocol = "http";
+      }
+      {
+        tag = "vmess_in";
+        port = 1081;
+        listen = "127.0.0.1";
+        protocol = "vmess";
+        settings.clients = [ v2rayUser ];
+      }
+    ];
+    outbounds = [
+      {
+        tag = "vmess_out";
+        protocol = "vmess";
+        settings.vnext = [
+          {
+            address = "127.0.0.1";
+            port = 1081;
+            users = [ v2rayUser ];
+          }
+        ];
+      }
+      {
+        tag = "direct";
+        protocol = "freedom";
+      }
+    ];
+    routing.rules = [
+      {
+        type = "field";
+        inboundTag = "http_in";
+        outboundTag = "vmess_out";
+      }
+      {
+        type = "field";
+        inboundTag = "vmess_in";
+        outboundTag = "direct";
+      }
+
+      # Assert assets "geoip" and "geosite" are accessible.
+      {
+        type = "field";
+        ip = [ "geoip:private" ];
+        domain = [ "geosite:category-ads" ];
+        outboundTag = "direct";
+      }
+    ];
+  };
+
+in
+{
+  name = "v2ray";
+  meta = with lib.maintainers; {
+    maintainers = [ servalcatty ];
+  };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.curl ];
+      services.v2ray = {
+        enable = true;
+        config = v2rayConfig;
       };
+      services.httpd = {
+        enable = true;
+        adminAddr = "foo@example.org";
+      };
+    };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine.wait_for_unit("httpd.service")
-      machine.wait_for_unit("v2ray.service")
-      machine.wait_for_open_port(80)
-      machine.wait_for_open_port(1080)
-      machine.succeed(
-          "curl --fail --max-time 10 --proxy http://localhost:1080 http://localhost"
-      )
-    '';
-  }
-)
+    machine.wait_for_unit("httpd.service")
+    machine.wait_for_unit("v2ray.service")
+    machine.wait_for_open_port(80)
+    machine.wait_for_open_port(1080)
+    machine.succeed(
+        "curl --fail --max-time 10 --proxy http://localhost:1080 http://localhost"
+    )
+  '';
+}
diff --git a/nixos/tests/vault-agent.nix b/nixos/tests/vault-agent.nix
index dfebc6b21828..4c9f98a3df7e 100644
--- a/nixos/tests/vault-agent.nix
+++ b/nixos/tests/vault-agent.nix
@@ -1,63 +1,61 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "vault-agent";
+{ pkgs, ... }:
+{
+  name = "vault-agent";
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        services.vault-agent.instances.example.settings = {
-          vault.address = config.environment.variables.VAULT_ADDR;
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      services.vault-agent.instances.example.settings = {
+        vault.address = config.environment.variables.VAULT_ADDR;
 
-          auto_auth = [
-            {
-              method = [
-                {
-                  type = "token_file";
-                  config.token_file_path = pkgs.writeText "vault-token" config.environment.variables.VAULT_TOKEN;
-                }
-              ];
-            }
-          ];
+        auto_auth = [
+          {
+            method = [
+              {
+                type = "token_file";
+                config.token_file_path = pkgs.writeText "vault-token" config.environment.variables.VAULT_TOKEN;
+              }
+            ];
+          }
+        ];
 
-          template = [
-            {
-              contents = ''
-                {{- with secret "secret/example" }}
-                {{ .Data.data.key }}"
-                {{- end }}
-              '';
-              perms = "0600";
-              destination = "/example";
-            }
-          ];
-        };
-
-        services.vault = {
-          enable = true;
-          dev = true;
-          devRootTokenID = config.environment.variables.VAULT_TOKEN;
-        };
-
-        environment = {
-          systemPackages = [ pkgs.vault ];
-          variables = {
-            VAULT_ADDR = "http://localhost:8200";
-            VAULT_TOKEN = "root";
-          };
-        };
+        template = [
+          {
+            contents = ''
+              {{- with secret "secret/example" }}
+              {{ .Data.data.key }}"
+              {{- end }}
+            '';
+            perms = "0600";
+            destination = "/example";
+          }
+        ];
       };
 
-    testScript = ''
-      machine.wait_for_unit("vault.service")
-      machine.wait_for_open_port(8200)
+      services.vault = {
+        enable = true;
+        dev = true;
+        devRootTokenID = config.environment.variables.VAULT_TOKEN;
+      };
 
-      machine.wait_until_succeeds('vault kv put secret/example key=example')
+      environment = {
+        systemPackages = [ pkgs.vault ];
+        variables = {
+          VAULT_ADDR = "http://localhost:8200";
+          VAULT_TOKEN = "root";
+        };
+      };
+    };
 
-      machine.wait_for_unit("vault-agent-example.service")
+  testScript = ''
+    machine.wait_for_unit("vault.service")
+    machine.wait_for_open_port(8200)
 
-      machine.wait_for_file("/example")
-      machine.succeed('grep "example" /example')
-    '';
-  }
-)
+    machine.wait_until_succeeds('vault kv put secret/example key=example')
+
+    machine.wait_for_unit("vault-agent-example.service")
+
+    machine.wait_for_file("/example")
+    machine.succeed('grep "example" /example')
+  '';
+}
diff --git a/nixos/tests/vault-dev.nix b/nixos/tests/vault-dev.nix
index b66b72ac74a9..a70a35b6d736 100644
--- a/nixos/tests/vault-dev.nix
+++ b/nixos/tests/vault-dev.nix
@@ -1,42 +1,40 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "vault-dev";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        lnl7
-        mic92
-      ];
-    };
-    nodes.machine =
-      { pkgs, config, ... }:
-      {
-        environment.systemPackages = [ pkgs.vault ];
-        environment.variables.VAULT_ADDR = "http://127.0.0.1:8200";
-        environment.variables.VAULT_TOKEN = "phony-secret";
+{ pkgs, ... }:
+{
+  name = "vault-dev";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      lnl7
+      mic92
+    ];
+  };
+  nodes.machine =
+    { pkgs, config, ... }:
+    {
+      environment.systemPackages = [ pkgs.vault ];
+      environment.variables.VAULT_ADDR = "http://127.0.0.1:8200";
+      environment.variables.VAULT_TOKEN = "phony-secret";
 
-        services.vault = {
-          enable = true;
-          dev = true;
-          devRootTokenID = config.environment.variables.VAULT_TOKEN;
-        };
+      services.vault = {
+        enable = true;
+        dev = true;
+        devRootTokenID = config.environment.variables.VAULT_TOKEN;
       };
+    };
 
-    testScript = ''
-      import json
-      start_all()
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_for_unit("vault.service")
-      machine.wait_for_open_port(8200)
-      out = machine.succeed("vault status -format=json")
-      print(out)
-      status = json.loads(out)
-      assert status.get("initialized") == True
-      machine.succeed("vault kv put secret/foo bar=baz")
-      out = machine.succeed("vault kv get -format=json secret/foo")
-      print(out)
-      status = json.loads(out)
-      assert status.get("data", {}).get("data", {}).get("bar") == "baz"
-    '';
-  }
-)
+  testScript = ''
+    import json
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("vault.service")
+    machine.wait_for_open_port(8200)
+    out = machine.succeed("vault status -format=json")
+    print(out)
+    status = json.loads(out)
+    assert status.get("initialized") == True
+    machine.succeed("vault kv put secret/foo bar=baz")
+    out = machine.succeed("vault kv get -format=json secret/foo")
+    print(out)
+    status = json.loads(out)
+    assert status.get("data", {}).get("data", {}).get("bar") == "baz"
+  '';
+}
diff --git a/nixos/tests/vault-postgresql.nix b/nixos/tests/vault-postgresql.nix
index 33d45306a36c..b0ccb6ae0456 100644
--- a/nixos/tests/vault-postgresql.nix
+++ b/nixos/tests/vault-postgresql.nix
@@ -6,71 +6,69 @@
      always covered, availability isn't)
    - the postgres integration works
 */
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "vault-postgresql";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        lnl7
-        roberth
-      ];
-    };
-    nodes.machine =
-      { lib, pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.vault ];
-        environment.variables.VAULT_ADDR = "http://127.0.0.1:8200";
-        services.vault.enable = true;
-        services.vault.extraSettingsPaths = [ "/run/vault.hcl" ];
+{ pkgs, ... }:
+{
+  name = "vault-postgresql";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      lnl7
+      roberth
+    ];
+  };
+  nodes.machine =
+    { lib, pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.vault ];
+      environment.variables.VAULT_ADDR = "http://127.0.0.1:8200";
+      services.vault.enable = true;
+      services.vault.extraSettingsPaths = [ "/run/vault.hcl" ];
 
-        systemd.services.vault = {
-          after = [
-            "postgresql.service"
-          ];
-          # Try for about 10 minutes rather than the default of 5 attempts.
-          serviceConfig.RestartSec = 1;
-          serviceConfig.StartLimitBurst = 600;
-        };
-        # systemd.services.vault.unitConfig.RequiresMountsFor = "/run/keys/";
-
-        services.postgresql.enable = true;
-        services.postgresql.initialScript = pkgs.writeText "init.psql" ''
-          CREATE USER vaultuser WITH ENCRYPTED PASSWORD 'thisisthepass';
-          GRANT CONNECT ON DATABASE postgres TO vaultuser;
-
-          -- https://www.vaultproject.io/docs/configuration/storage/postgresql
-          CREATE TABLE vault_kv_store (
-            parent_path TEXT COLLATE "C" NOT NULL,
-            path        TEXT COLLATE "C",
-            key         TEXT COLLATE "C",
-            value       BYTEA,
-            CONSTRAINT pkey PRIMARY KEY (path, key)
-          );
-          CREATE INDEX parent_path_idx ON vault_kv_store (parent_path);
-
-          GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO vaultuser;
-        '';
+      systemd.services.vault = {
+        after = [
+          "postgresql.service"
+        ];
+        # Try for about 10 minutes rather than the default of 5 attempts.
+        serviceConfig.RestartSec = 1;
+        serviceConfig.StartLimitBurst = 600;
       };
+      # systemd.services.vault.unitConfig.RequiresMountsFor = "/run/keys/";
 
-    testScript = ''
-      secretConfig = """
-          storage "postgresql" {
-            connection_url = "postgres://vaultuser:thisisthepass@localhost/postgres?sslmode=disable"
-          }
-          """
+      services.postgresql.enable = true;
+      services.postgresql.initialScript = pkgs.writeText "init.psql" ''
+        CREATE USER vaultuser WITH ENCRYPTED PASSWORD 'thisisthepass';
+        GRANT CONNECT ON DATABASE postgres TO vaultuser;
 
-      start_all()
+        -- https://www.vaultproject.io/docs/configuration/storage/postgresql
+        CREATE TABLE vault_kv_store (
+          parent_path TEXT COLLATE "C" NOT NULL,
+          path        TEXT COLLATE "C",
+          key         TEXT COLLATE "C",
+          value       BYTEA,
+          CONSTRAINT pkey PRIMARY KEY (path, key)
+        );
+        CREATE INDEX parent_path_idx ON vault_kv_store (parent_path);
 
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("cat >/root/vault.hcl <<EOF\n%s\nEOF\n" % secretConfig)
-      machine.succeed(
-          "install --owner vault --mode 0400 /root/vault.hcl /run/vault.hcl; rm /root/vault.hcl"
-      )
-      machine.wait_for_unit("vault.service")
-      machine.wait_for_open_port(8200)
-      machine.succeed("vault operator init")
-      machine.succeed("vault status || test $? -eq 2")
-    '';
-  }
-)
+        GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO vaultuser;
+      '';
+    };
+
+  testScript = ''
+    secretConfig = """
+        storage "postgresql" {
+          connection_url = "postgres://vaultuser:thisisthepass@localhost/postgres?sslmode=disable"
+        }
+        """
+
+    start_all()
+
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("cat >/root/vault.hcl <<EOF\n%s\nEOF\n" % secretConfig)
+    machine.succeed(
+        "install --owner vault --mode 0400 /root/vault.hcl /run/vault.hcl; rm /root/vault.hcl"
+    )
+    machine.wait_for_unit("vault.service")
+    machine.wait_for_open_port(8200)
+    machine.succeed("vault operator init")
+    machine.succeed("vault status || test $? -eq 2")
+  '';
+}
diff --git a/nixos/tests/vault.nix b/nixos/tests/vault.nix
index a17e4fdfba08..5b60fb9cfa8a 100644
--- a/nixos/tests/vault.nix
+++ b/nixos/tests/vault.nix
@@ -1,28 +1,26 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "vault";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ lnl7 ];
+{ pkgs, ... }:
+{
+  name = "vault";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ lnl7 ];
+  };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.vault ];
+      environment.variables.VAULT_ADDR = "http://127.0.0.1:8200";
+      services.vault.enable = true;
     };
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [ pkgs.vault ];
-        environment.variables.VAULT_ADDR = "http://127.0.0.1:8200";
-        services.vault.enable = true;
-      };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_for_unit("vault.service")
-      machine.wait_for_open_port(8200)
-      machine.succeed("vault operator init")
-      # vault now returns exit code 2 for sealed vaults
-      machine.fail("vault status")
-      machine.succeed("vault status || test $? -eq 2")
-    '';
-  }
-)
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("vault.service")
+    machine.wait_for_open_port(8200)
+    machine.succeed("vault operator init")
+    # vault now returns exit code 2 for sealed vaults
+    machine.fail("vault status")
+    machine.succeed("vault status || test $? -eq 2")
+  '';
+}
diff --git a/nixos/tests/vdirsyncer.nix b/nixos/tests/vdirsyncer.nix
index 1267967dac97..5f4b5e3b4845 100644
--- a/nixos/tests/vdirsyncer.nix
+++ b/nixos/tests/vdirsyncer.nix
@@ -1,300 +1,298 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
+let
 
-    radicale_calendars = {
-      type = "caldav";
-      url = "http://localhost:5232/";
-      # Radicale needs username/password.
-      username = "alice";
-      password = "password";
-    };
+  radicale_calendars = {
+    type = "caldav";
+    url = "http://localhost:5232/";
+    # Radicale needs username/password.
+    username = "alice";
+    password = "password";
+  };
 
-    radicale_contacts = {
-      type = "carddav";
-      url = "http://localhost:5232/";
-      # Radicale needs username/password.
-      username = "alice";
-      password = "password";
-    };
+  radicale_contacts = {
+    type = "carddav";
+    url = "http://localhost:5232/";
+    # Radicale needs username/password.
+    username = "alice";
+    password = "password";
+  };
 
-    xandikos_calendars = {
-      type = "caldav";
-      url = "http://localhost:8080/user/calendars";
-      # Xandikos warns
-      # > No current-user-principal returned, re-using URL http://localhost:8080/user/calendars/
-      # but we do not need username/password.
-    };
+  xandikos_calendars = {
+    type = "caldav";
+    url = "http://localhost:8080/user/calendars";
+    # Xandikos warns
+    # > No current-user-principal returned, re-using URL http://localhost:8080/user/calendars/
+    # but we do not need username/password.
+  };
 
-    xandikos_contacts = {
-      type = "carddav";
-      url = "http://localhost:8080/user/contacts";
-    };
+  xandikos_contacts = {
+    type = "carddav";
+    url = "http://localhost:8080/user/contacts";
+  };
 
-    local_calendars = {
-      type = "filesystem";
-      path = "~/calendars";
-      fileext = ".ics";
-    };
+  local_calendars = {
+    type = "filesystem";
+    path = "~/calendars";
+    fileext = ".ics";
+  };
 
-    local_contacts = {
-      type = "filesystem";
-      path = "~/contacts";
-      fileext = ".vcf";
-    };
+  local_contacts = {
+    type = "filesystem";
+    path = "~/contacts";
+    fileext = ".vcf";
+  };
 
-    mkPairs = a: b: {
-      calendars = {
-        a = "${a}_calendars";
-        b = "${b}_calendars";
-        collections = [
-          "from a"
-          "from b"
-        ];
-      };
-      contacts = {
-        a = "${a}_contacts";
-        b = "${b}_contacts";
-        collections = [
-          "from a"
-          "from b"
-        ];
-      };
-    };
-
-    mkRadicaleProps =
-      tag:
-      pkgs.writeText "Radicale.props" (
-        builtins.toJSON {
-          inherit tag;
-        }
-      );
-
-    writeLines =
-      name: eol: lines:
-      pkgs.writeText name (lib.concatMapStrings (l: "${l}${eol}") lines);
-
-    prodid = "-//NixOS test//EN";
-    dtstamp = "20231129T194743Z";
-
-    writeICS =
-      {
-        uid,
-        summary,
-        dtstart,
-        dtend,
-      }:
-      writeLines "${uid}.ics" "\r\n" [
-        "BEGIN:VCALENDAR"
-        "VERSION:2.0"
-        "PRODID:${prodid}"
-        "BEGIN:VEVENT"
-        "UID:${uid}"
-        "SUMMARY:${summary}"
-        "DTSTART:${dtstart}"
-        "DTEND:${dtend}"
-        "DTSTAMP:${dtstamp}"
-        "END:VEVENT"
-        "END:VCALENDAR"
+  mkPairs = a: b: {
+    calendars = {
+      a = "${a}_calendars";
+      b = "${b}_calendars";
+      collections = [
+        "from a"
+        "from b"
       ];
-
-    foo_ics = writeICS {
-      uid = "foo";
-      summary = "Epochalypse";
-      dtstart = "19700101T000000Z";
-      dtend = "20380119T031407Z";
     };
-
-    bar_ics = writeICS {
-      uid = "bar";
-      summary = "One Billion Seconds";
-      dtstart = "19700101T000000Z";
-      dtend = "20010909T014640Z";
-    };
-
-    writeVCF =
-      {
-        uid,
-        name,
-        displayName,
-        email,
-      }:
-      writeLines "${uid}.vcf" "\r\n" [
-        # One of the tools enforces this order of fields.
-        "BEGIN:VCARD"
-        "VERSION:4.0"
-        "UID:${uid}"
-        "EMAIL;TYPE=INTERNET:${email}"
-        "FN:${displayName}"
-        "N:${name}"
-        "END:VCARD"
+    contacts = {
+      a = "${a}_contacts";
+      b = "${b}_contacts";
+      collections = [
+        "from a"
+        "from b"
       ];
-
-    foo_vcf = writeVCF {
-      uid = "foo";
-      name = "Doe;John;;;";
-      displayName = "John Doe";
-      email = "john.doe@example.org";
     };
+  };
 
-    bar_vcf = writeVCF {
-      uid = "bar";
-      name = "Doe;Jane;;;";
-      displayName = "Jane Doe";
-      email = "jane.doe@example.org";
-    };
+  mkRadicaleProps =
+    tag:
+    pkgs.writeText "Radicale.props" (
+      builtins.toJSON {
+        inherit tag;
+      }
+    );
 
-  in
-  {
-    name = "vdirsyncer";
+  writeLines =
+    name: eol: lines:
+    pkgs.writeText name (lib.concatMapStrings (l: "${l}${eol}") lines);
 
-    meta.maintainers = with lib.maintainers; [ schnusch ];
+  prodid = "-//NixOS test//EN";
+  dtstamp = "20231129T194743Z";
 
-    nodes = {
-      machine = {
-        services.radicale = {
-          enable = true;
-          settings.auth.type = "none";
-        };
+  writeICS =
+    {
+      uid,
+      summary,
+      dtstart,
+      dtend,
+    }:
+    writeLines "${uid}.ics" "\r\n" [
+      "BEGIN:VCALENDAR"
+      "VERSION:2.0"
+      "PRODID:${prodid}"
+      "BEGIN:VEVENT"
+      "UID:${uid}"
+      "SUMMARY:${summary}"
+      "DTSTART:${dtstart}"
+      "DTEND:${dtend}"
+      "DTSTAMP:${dtstamp}"
+      "END:VEVENT"
+      "END:VCALENDAR"
+    ];
 
-        services.xandikos = {
-          enable = true;
-          extraOptions = [ "--autocreate" ];
-        };
+  foo_ics = writeICS {
+    uid = "foo";
+    summary = "Epochalypse";
+    dtstart = "19700101T000000Z";
+    dtend = "20380119T031407Z";
+  };
 
-        services.vdirsyncer = {
-          enable = true;
-          jobs = {
+  bar_ics = writeICS {
+    uid = "bar";
+    summary = "One Billion Seconds";
+    dtstart = "19700101T000000Z";
+    dtend = "20010909T014640Z";
+  };
 
-            alice = {
-              user = "alice";
-              group = "users";
-              config = {
-                statusPath = "/home/alice/.vdirsyncer";
-                storages = {
-                  inherit
-                    local_calendars
-                    local_contacts
-                    radicale_calendars
-                    radicale_contacts
-                    ;
-                };
-                pairs = mkPairs "local" "radicale";
+  writeVCF =
+    {
+      uid,
+      name,
+      displayName,
+      email,
+    }:
+    writeLines "${uid}.vcf" "\r\n" [
+      # One of the tools enforces this order of fields.
+      "BEGIN:VCARD"
+      "VERSION:4.0"
+      "UID:${uid}"
+      "EMAIL;TYPE=INTERNET:${email}"
+      "FN:${displayName}"
+      "N:${name}"
+      "END:VCARD"
+    ];
+
+  foo_vcf = writeVCF {
+    uid = "foo";
+    name = "Doe;John;;;";
+    displayName = "John Doe";
+    email = "john.doe@example.org";
+  };
+
+  bar_vcf = writeVCF {
+    uid = "bar";
+    name = "Doe;Jane;;;";
+    displayName = "Jane Doe";
+    email = "jane.doe@example.org";
+  };
+
+in
+{
+  name = "vdirsyncer";
+
+  meta.maintainers = with lib.maintainers; [ schnusch ];
+
+  nodes = {
+    machine = {
+      services.radicale = {
+        enable = true;
+        settings.auth.type = "none";
+      };
+
+      services.xandikos = {
+        enable = true;
+        extraOptions = [ "--autocreate" ];
+      };
+
+      services.vdirsyncer = {
+        enable = true;
+        jobs = {
+
+          alice = {
+            user = "alice";
+            group = "users";
+            config = {
+              statusPath = "/home/alice/.vdirsyncer";
+              storages = {
+                inherit
+                  local_calendars
+                  local_contacts
+                  radicale_calendars
+                  radicale_contacts
+                  ;
               };
-              forceDiscover = true;
+              pairs = mkPairs "local" "radicale";
             };
+            forceDiscover = true;
+          };
 
-            bob = {
-              user = "bob";
-              group = "users";
-              config = {
-                statusPath = "/home/bob/.vdirsyncer";
-                storages = {
-                  inherit
-                    local_calendars
-                    local_contacts
-                    xandikos_calendars
-                    xandikos_contacts
-                    ;
-                };
-                pairs = mkPairs "local" "xandikos";
+          bob = {
+            user = "bob";
+            group = "users";
+            config = {
+              statusPath = "/home/bob/.vdirsyncer";
+              storages = {
+                inherit
+                  local_calendars
+                  local_contacts
+                  xandikos_calendars
+                  xandikos_contacts
+                  ;
               };
-              forceDiscover = true;
+              pairs = mkPairs "local" "xandikos";
             };
+            forceDiscover = true;
+          };
 
-            remote = {
-              config = {
-                storages = {
-                  inherit
-                    radicale_calendars
-                    radicale_contacts
-                    xandikos_calendars
-                    xandikos_contacts
-                    ;
-                };
-                pairs = mkPairs "radicale" "xandikos";
+          remote = {
+            config = {
+              storages = {
+                inherit
+                  radicale_calendars
+                  radicale_contacts
+                  xandikos_calendars
+                  xandikos_contacts
+                  ;
               };
-              forceDiscover = true;
+              pairs = mkPairs "radicale" "xandikos";
             };
-
+            forceDiscover = true;
           };
-        };
 
-        users.users = {
-          alice.isNormalUser = true;
-          bob.isNormalUser = true;
         };
       };
+
+      users.users = {
+        alice.isNormalUser = true;
+        bob.isNormalUser = true;
+      };
     };
+  };
 
-    testScript = ''
-      def run_unit(name):
-          machine.systemctl(f"start {name}")
-          # The service is Type=oneshot without RemainAfterExit=yes. Once it
-          # is finished it is no longer active and wait_for_unit will fail.
-          # When that happens we check if it actually failed.
-          try:
-              machine.wait_for_unit(name)
-          except:
-              machine.fail(f"systemctl is-failed {name}")
+  testScript = ''
+    def run_unit(name):
+        machine.systemctl(f"start {name}")
+        # The service is Type=oneshot without RemainAfterExit=yes. Once it
+        # is finished it is no longer active and wait_for_unit will fail.
+        # When that happens we check if it actually failed.
+        try:
+            machine.wait_for_unit(name)
+        except:
+            machine.fail(f"systemctl is-failed {name}")
 
-      start_all()
+    start_all()
 
-      machine.wait_for_open_port(5232)
-      machine.wait_for_open_port(8080)
-      machine.wait_for_unit("multi-user.target")
+    machine.wait_for_open_port(5232)
+    machine.wait_for_open_port(8080)
+    machine.wait_for_unit("multi-user.target")
 
-      with subtest("alice -> radicale"):
-          # vdirsyncer cannot create create collections on Radicale,
-          # see https://vdirsyncer.pimutils.org/en/stable/tutorials/radicale.html
-          machine.succeed("runuser -u radicale -- install -Dm 644 ${mkRadicaleProps "VCALENDAR"} /var/lib/radicale/collections/collection-root/alice/foocal/.Radicale.props")
-          machine.succeed("runuser -u radicale -- install -Dm 644 ${mkRadicaleProps "VADDRESSBOOK"} /var/lib/radicale/collections/collection-root/alice/foocard/.Radicale.props")
+    with subtest("alice -> radicale"):
+        # vdirsyncer cannot create create collections on Radicale,
+        # see https://vdirsyncer.pimutils.org/en/stable/tutorials/radicale.html
+        machine.succeed("runuser -u radicale -- install -Dm 644 ${mkRadicaleProps "VCALENDAR"} /var/lib/radicale/collections/collection-root/alice/foocal/.Radicale.props")
+        machine.succeed("runuser -u radicale -- install -Dm 644 ${mkRadicaleProps "VADDRESSBOOK"} /var/lib/radicale/collections/collection-root/alice/foocard/.Radicale.props")
 
-          machine.succeed("runuser -u alice -- install -Dm 644 ${foo_ics} /home/alice/calendars/foocal/foo.ics")
-          machine.succeed("runuser -u alice -- install -Dm 644 ${foo_vcf} /home/alice/contacts/foocard/foo.vcf")
-          run_unit("vdirsyncer@alice.service")
+        machine.succeed("runuser -u alice -- install -Dm 644 ${foo_ics} /home/alice/calendars/foocal/foo.ics")
+        machine.succeed("runuser -u alice -- install -Dm 644 ${foo_vcf} /home/alice/contacts/foocard/foo.vcf")
+        run_unit("vdirsyncer@alice.service")
 
-          # test statusPath
-          machine.succeed("test -d /home/alice/.vdirsyncer")
-          machine.fail("test -e /var/lib/private/vdirsyncer/alice")
+        # test statusPath
+        machine.succeed("test -d /home/alice/.vdirsyncer")
+        machine.fail("test -e /var/lib/private/vdirsyncer/alice")
 
-      with subtest("bob -> xandikos"):
-          # I suspect Radicale shares the namespace for calendars and
-          # contacts, but Xandikos separates them. We just use `barcal` and
-          # `barcard` with Xandikos as well to avoid conflicts.
-          machine.succeed("runuser -u bob -- install -Dm 644 ${bar_ics} /home/bob/calendars/barcal/bar.ics")
-          machine.succeed("runuser -u bob -- install -Dm 644 ${bar_vcf} /home/bob/contacts/barcard/bar.vcf")
-          run_unit("vdirsyncer@bob.service")
+    with subtest("bob -> xandikos"):
+        # I suspect Radicale shares the namespace for calendars and
+        # contacts, but Xandikos separates them. We just use `barcal` and
+        # `barcard` with Xandikos as well to avoid conflicts.
+        machine.succeed("runuser -u bob -- install -Dm 644 ${bar_ics} /home/bob/calendars/barcal/bar.ics")
+        machine.succeed("runuser -u bob -- install -Dm 644 ${bar_vcf} /home/bob/contacts/barcard/bar.vcf")
+        run_unit("vdirsyncer@bob.service")
 
-          # test statusPath
-          machine.succeed("test -d /home/bob/.vdirsyncer")
-          machine.fail("test -e /var/lib/private/vdirsyncer/bob")
+        # test statusPath
+        machine.succeed("test -d /home/bob/.vdirsyncer")
+        machine.fail("test -e /var/lib/private/vdirsyncer/bob")
 
-      with subtest("radicale <-> xandikos"):
-          # vdirsyncer cannot create create collections on Radicale,
-          # see https://vdirsyncer.pimutils.org/en/stable/tutorials/radicale.html
-          machine.succeed("runuser -u radicale -- install -Dm 644 ${mkRadicaleProps "VCALENDAR"} /var/lib/radicale/collections/collection-root/alice/barcal/.Radicale.props")
-          machine.succeed("runuser -u radicale -- install -Dm 644 ${mkRadicaleProps "VADDRESSBOOK"} /var/lib/radicale/collections/collection-root/alice/barcard/.Radicale.props")
+    with subtest("radicale <-> xandikos"):
+        # vdirsyncer cannot create create collections on Radicale,
+        # see https://vdirsyncer.pimutils.org/en/stable/tutorials/radicale.html
+        machine.succeed("runuser -u radicale -- install -Dm 644 ${mkRadicaleProps "VCALENDAR"} /var/lib/radicale/collections/collection-root/alice/barcal/.Radicale.props")
+        machine.succeed("runuser -u radicale -- install -Dm 644 ${mkRadicaleProps "VADDRESSBOOK"} /var/lib/radicale/collections/collection-root/alice/barcard/.Radicale.props")
 
-          run_unit("vdirsyncer@remote.service")
+        run_unit("vdirsyncer@remote.service")
 
-          # test statusPath
-          machine.succeed("test -d /var/lib/private/vdirsyncer/remote")
+        # test statusPath
+        machine.succeed("test -d /var/lib/private/vdirsyncer/remote")
 
-      with subtest("radicale -> alice"):
-          run_unit("vdirsyncer@alice.service")
+    with subtest("radicale -> alice"):
+        run_unit("vdirsyncer@alice.service")
 
-      with subtest("xandikos -> bob"):
-          run_unit("vdirsyncer@bob.service")
+    with subtest("xandikos -> bob"):
+        run_unit("vdirsyncer@bob.service")
 
-      with subtest("compare synced files"):
-          # iCalendar files get reordered
-          machine.succeed("diff -u --strip-trailing-cr <(sort /home/alice/calendars/foocal/foo.ics) <(sort /home/bob/calendars/foocal/foo.ics) >&2")
-          machine.succeed("diff -u --strip-trailing-cr <(sort /home/bob/calendars/barcal/bar.ics) <(sort /home/alice/calendars/barcal/bar.ics) >&2")
+    with subtest("compare synced files"):
+        # iCalendar files get reordered
+        machine.succeed("diff -u --strip-trailing-cr <(sort /home/alice/calendars/foocal/foo.ics) <(sort /home/bob/calendars/foocal/foo.ics) >&2")
+        machine.succeed("diff -u --strip-trailing-cr <(sort /home/bob/calendars/barcal/bar.ics) <(sort /home/alice/calendars/barcal/bar.ics) >&2")
 
-          machine.succeed("diff -u --strip-trailing-cr /home/alice/contacts/foocard/foo.vcf /home/bob/contacts/foocard/foo.vcf >&2")
-          machine.succeed("diff -u --strip-trailing-cr /home/bob/contacts/barcard/bar.vcf /home/alice/contacts/barcard/bar.vcf >&2")
-    '';
-  }
-)
+        machine.succeed("diff -u --strip-trailing-cr /home/alice/contacts/foocard/foo.vcf /home/bob/contacts/foocard/foo.vcf >&2")
+        machine.succeed("diff -u --strip-trailing-cr /home/bob/contacts/barcard/bar.vcf /home/alice/contacts/barcard/bar.vcf >&2")
+  '';
+}
diff --git a/nixos/tests/vengi-tools.nix b/nixos/tests/vengi-tools.nix
index fcf42c09a7a8..3260d5a62a28 100644
--- a/nixos/tests/vengi-tools.nix
+++ b/nixos/tests/vengi-tools.nix
@@ -1,31 +1,29 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "vengi-tools";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fgaz ];
+{ pkgs, ... }:
+{
+  name = "vengi-tools";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      environment.systemPackages = [ pkgs.vengi-tools ];
     };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  enableOCR = true;
 
-        services.xserver.enable = true;
-        environment.systemPackages = [ pkgs.vengi-tools ];
-      };
-
-    enableOCR = true;
-
-    testScript = ''
-      machine.wait_for_x()
-      machine.execute("vengi-voxedit >&2 &")
-      machine.wait_for_window("voxedit")
-      # Let the window load fully
-      machine.sleep(15)
-      machine.screenshot("screen")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_x()
+    machine.execute("vengi-voxedit >&2 &")
+    machine.wait_for_window("voxedit")
+    # Let the window load fully
+    machine.sleep(15)
+    machine.screenshot("screen")
+  '';
+}
diff --git a/nixos/tests/vikunja.nix b/nixos/tests/vikunja.nix
index f1108dc69330..7da5e2f23b30 100644
--- a/nixos/tests/vikunja.nix
+++ b/nixos/tests/vikunja.nix
@@ -1,81 +1,79 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "vikunja";
+{ pkgs, lib, ... }:
+{
+  name = "vikunja";
 
-    meta.maintainers = with lib.maintainers; [ leona ];
+  meta.maintainers = with lib.maintainers; [ leona ];
 
-    nodes = {
-      vikunjaSqlite =
-        { ... }:
-        {
-          services.vikunja = {
-            enable = true;
-            database = {
-              type = "sqlite";
-            };
-            frontendScheme = "http";
-            frontendHostname = "localhost";
+  nodes = {
+    vikunjaSqlite =
+      { ... }:
+      {
+        services.vikunja = {
+          enable = true;
+          database = {
+            type = "sqlite";
           };
-          services.nginx = {
-            enable = true;
-            virtualHosts."http://localhost" = {
-              locations."/".proxyPass = "http://localhost:3456";
-            };
+          frontendScheme = "http";
+          frontendHostname = "localhost";
+        };
+        services.nginx = {
+          enable = true;
+          virtualHosts."http://localhost" = {
+            locations."/".proxyPass = "http://localhost:3456";
           };
         };
-      vikunjaPostgresql =
-        { pkgs, ... }:
-        {
-          services.vikunja = {
-            enable = true;
-            database = {
-              type = "postgres";
-              user = "vikunja";
-              database = "vikunja";
-              host = "/run/postgresql";
-            };
-            frontendScheme = "http";
-            frontendHostname = "localhost";
-            port = 9090;
+      };
+    vikunjaPostgresql =
+      { pkgs, ... }:
+      {
+        services.vikunja = {
+          enable = true;
+          database = {
+            type = "postgres";
+            user = "vikunja";
+            database = "vikunja";
+            host = "/run/postgresql";
           };
-          services.postgresql = {
-            enable = true;
-            ensureDatabases = [ "vikunja" ];
-            ensureUsers = [
-              {
-                name = "vikunja";
-                ensureDBOwnership = true;
-              }
-            ];
-          };
-          services.nginx = {
-            enable = true;
-            virtualHosts."http://localhost" = {
-              locations."/".proxyPass = "http://localhost:9090";
-            };
+          frontendScheme = "http";
+          frontendHostname = "localhost";
+          port = 9090;
+        };
+        services.postgresql = {
+          enable = true;
+          ensureDatabases = [ "vikunja" ];
+          ensureUsers = [
+            {
+              name = "vikunja";
+              ensureDBOwnership = true;
+            }
+          ];
+        };
+        services.nginx = {
+          enable = true;
+          virtualHosts."http://localhost" = {
+            locations."/".proxyPass = "http://localhost:9090";
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      vikunjaSqlite.wait_for_unit("vikunja.service")
-      vikunjaSqlite.wait_for_open_port(3456)
-      vikunjaSqlite.succeed("curl --fail http://localhost:3456/api/v1/info")
+  testScript = ''
+    vikunjaSqlite.wait_for_unit("vikunja.service")
+    vikunjaSqlite.wait_for_open_port(3456)
+    vikunjaSqlite.succeed("curl --fail http://localhost:3456/api/v1/info")
 
-      vikunjaSqlite.wait_for_unit("nginx.service")
-      vikunjaSqlite.wait_for_open_port(80)
-      vikunjaSqlite.succeed("curl --fail http://localhost/api/v1/info")
-      vikunjaSqlite.succeed("curl --fail http://localhost")
+    vikunjaSqlite.wait_for_unit("nginx.service")
+    vikunjaSqlite.wait_for_open_port(80)
+    vikunjaSqlite.succeed("curl --fail http://localhost/api/v1/info")
+    vikunjaSqlite.succeed("curl --fail http://localhost")
 
-      vikunjaPostgresql.wait_for_unit("vikunja.service")
-      vikunjaPostgresql.wait_for_open_port(9090)
-      vikunjaPostgresql.succeed("curl --fail http://localhost:9090/api/v1/info")
+    vikunjaPostgresql.wait_for_unit("vikunja.service")
+    vikunjaPostgresql.wait_for_open_port(9090)
+    vikunjaPostgresql.succeed("curl --fail http://localhost:9090/api/v1/info")
 
-      vikunjaPostgresql.wait_for_unit("nginx.service")
-      vikunjaPostgresql.wait_for_open_port(80)
-      vikunjaPostgresql.succeed("curl --fail http://localhost/api/v1/info")
-      vikunjaPostgresql.succeed("curl --fail http://localhost")
-    '';
-  }
-)
+    vikunjaPostgresql.wait_for_unit("nginx.service")
+    vikunjaPostgresql.wait_for_open_port(80)
+    vikunjaPostgresql.succeed("curl --fail http://localhost/api/v1/info")
+    vikunjaPostgresql.succeed("curl --fail http://localhost")
+  '';
+}
diff --git a/nixos/tests/vsftpd.nix b/nixos/tests/vsftpd.nix
index 816014a10b54..f3bd182a3748 100644
--- a/nixos/tests/vsftpd.nix
+++ b/nixos/tests/vsftpd.nix
@@ -1,45 +1,43 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "vsftpd";
+{ pkgs, ... }:
+{
+  name = "vsftpd";
 
-    nodes = {
-      server = {
-        services.vsftpd = {
-          enable = true;
-          userlistDeny = false;
-          localUsers = true;
-          userlist = [ "ftp-test-user" ];
-          writeEnable = true;
-          localRoot = "/tmp";
-        };
-        networking.firewall.enable = false;
-
-        users = {
-          users.ftp-test-user = {
-            isSystemUser = true;
-            password = "ftp-test-password";
-            group = "ftp-test-group";
-          };
-          groups.ftp-test-group = { };
-        };
+  nodes = {
+    server = {
+      services.vsftpd = {
+        enable = true;
+        userlistDeny = false;
+        localUsers = true;
+        userlist = [ "ftp-test-user" ];
+        writeEnable = true;
+        localRoot = "/tmp";
       };
+      networking.firewall.enable = false;
 
-      client = { };
+      users = {
+        users.ftp-test-user = {
+          isSystemUser = true;
+          password = "ftp-test-password";
+          group = "ftp-test-group";
+        };
+        groups.ftp-test-group = { };
+      };
     };
 
-    testScript = ''
-      client.start()
-      server.wait_for_unit("vsftpd")
-      server.wait_for_open_port(21)
+    client = { };
+  };
 
-      client.succeed("curl -u ftp-test-user:ftp-test-password ftp://server")
-      client.succeed('echo "this is a test" > /tmp/test.file.up')
-      client.succeed("curl -v -T /tmp/test.file.up -u ftp-test-user:ftp-test-password ftp://server")
-      client.succeed("curl -u ftp-test-user:ftp-test-password ftp://server/test.file.up > /tmp/test.file.down")
-      client.succeed("diff /tmp/test.file.up /tmp/test.file.down")
-      assert client.succeed("cat /tmp/test.file.up") == server.succeed("cat /tmp/test.file.up")
-      assert client.succeed("cat /tmp/test.file.down") == server.succeed("cat /tmp/test.file.up")
-    '';
-  }
-)
+  testScript = ''
+    client.start()
+    server.wait_for_unit("vsftpd")
+    server.wait_for_open_port(21)
+
+    client.succeed("curl -u ftp-test-user:ftp-test-password ftp://server")
+    client.succeed('echo "this is a test" > /tmp/test.file.up')
+    client.succeed("curl -v -T /tmp/test.file.up -u ftp-test-user:ftp-test-password ftp://server")
+    client.succeed("curl -u ftp-test-user:ftp-test-password ftp://server/test.file.up > /tmp/test.file.down")
+    client.succeed("diff /tmp/test.file.up /tmp/test.file.down")
+    assert client.succeed("cat /tmp/test.file.up") == server.succeed("cat /tmp/test.file.up")
+    assert client.succeed("cat /tmp/test.file.down") == server.succeed("cat /tmp/test.file.up")
+  '';
+}
diff --git a/nixos/tests/waagent.nix b/nixos/tests/waagent.nix
index 54fa645e8304..f12f393f2597 100644
--- a/nixos/tests/waagent.nix
+++ b/nixos/tests/waagent.nix
@@ -1,72 +1,70 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    confPath = "/etc/waagent.conf";
-  in
-  {
-    name = "waagent";
+{ lib, pkgs, ... }:
+let
+  confPath = "/etc/waagent.conf";
+in
+{
+  name = "waagent";
 
-    meta = {
-      maintainers = with lib.maintainers; [ codgician ];
-    };
+  meta = {
+    maintainers = with lib.maintainers; [ codgician ];
+  };
 
-    nodes.machine = {
-      services.waagent = {
-        enable = true;
-        settings = {
-          Provisioning = {
-            Enable = false;
-            Agent = "waagent";
-            DeleteRootPassword = false;
-            RegenerateSshHostKeyPair = false;
-            SshHostKeyPairType = "ed25519";
-            MonitorHostName = false;
-          };
-          ResourceDisk = {
-            Format = false;
-            MountOptions = [
-              "compress=lzo"
-              "mode=0600"
-            ];
-          };
-          OS.RootDeviceScsiTimeout = 300;
-          HttpProxy = {
-            Host = null;
-            Port = null;
-          };
-          CGroups = {
-            EnforceLimits = false;
-            Excluded = [ ];
-          };
+  nodes.machine = {
+    services.waagent = {
+      enable = true;
+      settings = {
+        Provisioning = {
+          Enable = false;
+          Agent = "waagent";
+          DeleteRootPassword = false;
+          RegenerateSshHostKeyPair = false;
+          SshHostKeyPairType = "ed25519";
+          MonitorHostName = false;
+        };
+        ResourceDisk = {
+          Format = false;
+          MountOptions = [
+            "compress=lzo"
+            "mode=0600"
+          ];
+        };
+        OS.RootDeviceScsiTimeout = 300;
+        HttpProxy = {
+          Host = null;
+          Port = null;
+        };
+        CGroups = {
+          EnforceLimits = false;
+          Excluded = [ ];
         };
       };
     };
+  };
 
-    testScript = ''
-      # Defined values should be reflected in waagent.conf
-      machine.succeed("grep -q '^Provisioning.Enable=n$' '${confPath}'")
-      machine.succeed("grep -q '^Provisioning.Agent=waagent$' '${confPath}'")
-      machine.succeed("grep -q '^Provisioning.DeleteRootPassword=n$' '${confPath}'")
-      machine.succeed("grep -q '^Provisioning.RegenerateSshHostKeyPair=n$' '${confPath}'")
-      machine.succeed("grep -q '^Provisioning.SshHostKeyPairType=ed25519$' '${confPath}'")
-      machine.succeed("grep -q '^Provisioning.MonitorHostName=n$' '${confPath}'")
-      machine.succeed("grep -q '^ResourceDisk.Format=n$' '${confPath}'")
-      machine.succeed("grep -q '^ResourceDisk.MountOptions=compress=lzo,mode=0600$' '${confPath}'")
-      machine.succeed("grep -q '^OS.RootDeviceScsiTimeout=300$' '${confPath}'")
+  testScript = ''
+    # Defined values should be reflected in waagent.conf
+    machine.succeed("grep -q '^Provisioning.Enable=n$' '${confPath}'")
+    machine.succeed("grep -q '^Provisioning.Agent=waagent$' '${confPath}'")
+    machine.succeed("grep -q '^Provisioning.DeleteRootPassword=n$' '${confPath}'")
+    machine.succeed("grep -q '^Provisioning.RegenerateSshHostKeyPair=n$' '${confPath}'")
+    machine.succeed("grep -q '^Provisioning.SshHostKeyPairType=ed25519$' '${confPath}'")
+    machine.succeed("grep -q '^Provisioning.MonitorHostName=n$' '${confPath}'")
+    machine.succeed("grep -q '^ResourceDisk.Format=n$' '${confPath}'")
+    machine.succeed("grep -q '^ResourceDisk.MountOptions=compress=lzo,mode=0600$' '${confPath}'")
+    machine.succeed("grep -q '^OS.RootDeviceScsiTimeout=300$' '${confPath}'")
 
-      # Undocumented options should also be supported
-      machine.succeed("grep -q '^CGroups.EnforceLimits=n$' '${confPath}'")
+    # Undocumented options should also be supported
+    machine.succeed("grep -q '^CGroups.EnforceLimits=n$' '${confPath}'")
 
-      # Null values should be skipped and not exist in waagent.conf
-      machine.fail("grep -q '^HttpProxy.Host=' '${confPath}'")
-      machine.fail("grep -q '^HttpProxy.Port=' '${confPath}'")
+    # Null values should be skipped and not exist in waagent.conf
+    machine.fail("grep -q '^HttpProxy.Host=' '${confPath}'")
+    machine.fail("grep -q '^HttpProxy.Port=' '${confPath}'")
 
-      # Empty lists should be skipped and not exist in waagent.conf
-      machine.fail("grep -q '^CGroups.Excluded=' '${confPath}'")
+    # Empty lists should be skipped and not exist in waagent.conf
+    machine.fail("grep -q '^CGroups.Excluded=' '${confPath}'")
 
-      # Test service start
-      # Skip testing actual functionality due to lacking Azure infrasturcture
-      machine.wait_for_unit("waagent.service")
-    '';
-  }
-)
+    # Test service start
+    # Skip testing actual functionality due to lacking Azure infrasturcture
+    machine.wait_for_unit("waagent.service")
+  '';
+}
diff --git a/nixos/tests/warzone2100.nix b/nixos/tests/warzone2100.nix
index 4e9572a12c73..c7ce531e8dda 100644
--- a/nixos/tests/warzone2100.nix
+++ b/nixos/tests/warzone2100.nix
@@ -1,30 +1,28 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "warzone2100";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ fgaz ];
+{ pkgs, ... }:
+{
+  name = "warzone2100";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fgaz ];
+  };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+      environment.systemPackages = [ pkgs.warzone2100 ];
     };
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  enableOCR = true;
 
-        services.xserver.enable = true;
-        environment.systemPackages = [ pkgs.warzone2100 ];
-      };
-
-    enableOCR = true;
-
-    testScript = ''
-      machine.wait_for_x()
-      machine.execute("warzone2100 >&2 &")
-      machine.wait_for_window("Warzone 2100")
-      machine.wait_for_text(r"(Single Player|Multi Player|Tutorial|Options|Quit Game)")
-      machine.screenshot("screen")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_x()
+    machine.execute("warzone2100 >&2 &")
+    machine.wait_for_window("Warzone 2100")
+    machine.wait_for_text(r"(Single Player|Multi Player|Tutorial|Options|Quit Game)")
+    machine.screenshot("screen")
+  '';
+}
diff --git a/nixos/tests/wasabibackend.nix b/nixos/tests/wasabibackend.nix
index 05f9ecd47bd6..f237a8d62075 100644
--- a/nixos/tests/wasabibackend.nix
+++ b/nixos/tests/wasabibackend.nix
@@ -1,43 +1,41 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "wasabibackend";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ mmahut ];
-    };
+{ pkgs, ... }:
+{
+  name = "wasabibackend";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ mmahut ];
+  };
 
-    nodes = {
-      machine =
-        { ... }:
-        {
-          services.wasabibackend = {
-            enable = true;
-            network = "testnet";
-            rpc = {
-              user = "alice";
-              port = 18332;
-            };
-          };
-          services.bitcoind."testnet" = {
-            enable = true;
-            testnet = true;
-            rpc.users = {
-              alice.passwordHMAC = "e7096bc21da60b29ecdbfcdb2c3acc62$f948e61cb587c399358ed99c6ed245a41460b4bf75125d8330c9f6fcc13d7ae7";
-            };
+  nodes = {
+    machine =
+      { ... }:
+      {
+        services.wasabibackend = {
+          enable = true;
+          network = "testnet";
+          rpc = {
+            user = "alice";
+            port = 18332;
           };
         };
-    };
+        services.bitcoind."testnet" = {
+          enable = true;
+          testnet = true;
+          rpc.users = {
+            alice.passwordHMAC = "e7096bc21da60b29ecdbfcdb2c3acc62$f948e61cb587c399358ed99c6ed245a41460b4bf75125d8330c9f6fcc13d7ae7";
+          };
+        };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("wasabibackend.service")
-      machine.wait_until_succeeds(
-          "grep 'Wasabi Backend started' /var/lib/wasabibackend/.walletwasabi/backend/Logs.txt"
-      )
-      machine.sleep(5)
-      machine.succeed(
-          "grep 'Config is successfully initialized' /var/lib/wasabibackend/.walletwasabi/backend/Logs.txt"
-      )
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("wasabibackend.service")
+    machine.wait_until_succeeds(
+        "grep 'Wasabi Backend started' /var/lib/wasabibackend/.walletwasabi/backend/Logs.txt"
+    )
+    machine.sleep(5)
+    machine.succeed(
+        "grep 'Config is successfully initialized' /var/lib/wasabibackend/.walletwasabi/backend/Logs.txt"
+    )
+  '';
+}
diff --git a/nixos/tests/watchdogd.nix b/nixos/tests/watchdogd.nix
index 711cdee65f8e..5519ca6fb695 100644
--- a/nixos/tests/watchdogd.nix
+++ b/nixos/tests/watchdogd.nix
@@ -1,27 +1,25 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "watchdogd";
-    meta.maintainers = with lib.maintainers; [ vifino ];
+{ lib, ... }:
+{
+  name = "watchdogd";
+  meta.maintainers = with lib.maintainers; [ vifino ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        virtualisation.qemu.options = [
-          "-device i6300esb" # virtual watchdog timer
-        ];
-        boot.kernelModules = [ "i6300esb" ];
-        services.watchdogd.enable = true;
-        services.watchdogd.settings = {
-          supervisor.enabled = true;
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.qemu.options = [
+        "-device i6300esb" # virtual watchdog timer
+      ];
+      boot.kernelModules = [ "i6300esb" ];
+      services.watchdogd.enable = true;
+      services.watchdogd.settings = {
+        supervisor.enabled = true;
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("watchdogd.service")
+  testScript = ''
+    machine.wait_for_unit("watchdogd.service")
 
-      assert "i6300ESB" in machine.succeed("watchdogctl status")
-      machine.succeed("watchdogctl test")
-    '';
-  }
-)
+    assert "i6300ESB" in machine.succeed("watchdogctl status")
+    machine.succeed("watchdogctl test")
+  '';
+}
diff --git a/nixos/tests/web-apps/healthchecks.nix b/nixos/tests/web-apps/healthchecks.nix
index 1c6755ec922c..6915a37975cb 100644
--- a/nixos/tests/web-apps/healthchecks.nix
+++ b/nixos/tests/web-apps/healthchecks.nix
@@ -1,46 +1,44 @@
-import ../make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "healthchecks";
+{ lib, pkgs, ... }:
+{
+  name = "healthchecks";
 
-    meta = with lib.maintainers; {
-      maintainers = [ phaer ];
-    };
+  meta = with lib.maintainers; {
+    maintainers = [ phaer ];
+  };
 
-    nodes.machine =
-      { ... }:
-      {
-        services.healthchecks = {
-          enable = true;
-          settings = {
-            SITE_NAME = "MyUniqueInstance";
-            COMPRESS_ENABLED = "True";
-            SECRET_KEY_FILE = pkgs.writeText "secret" "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
-          };
+  nodes.machine =
+    { ... }:
+    {
+      services.healthchecks = {
+        enable = true;
+        settings = {
+          SITE_NAME = "MyUniqueInstance";
+          COMPRESS_ENABLED = "True";
+          SECRET_KEY_FILE = pkgs.writeText "secret" "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
         };
       };
+    };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("healthchecks.target")
-      machine.wait_until_succeeds("journalctl --since -1m --unit healthchecks --grep Listening")
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("healthchecks.target")
+    machine.wait_until_succeeds("journalctl --since -1m --unit healthchecks --grep Listening")
 
-      with subtest("Home screen loads"):
-          machine.succeed(
-              "curl -sSfL http://localhost:8000 | grep '<title>Log In'"
-          )
+    with subtest("Home screen loads"):
+        machine.succeed(
+            "curl -sSfL http://localhost:8000 | grep '<title>Log In'"
+        )
 
-      with subtest("Setting SITE_NAME via freeform option works"):
-          machine.succeed(
-              "curl -sSfL http://localhost:8000 | grep 'MyUniqueInstance</title>'"
-          )
+    with subtest("Setting SITE_NAME via freeform option works"):
+        machine.succeed(
+            "curl -sSfL http://localhost:8000 | grep 'MyUniqueInstance</title>'"
+        )
 
-      with subtest("Manage script works"):
-          # "shell" sucommand should succeed, needs python in PATH.
-          assert "foo\n" == machine.succeed("echo 'print(\"foo\")' | sudo -u healthchecks healthchecks-manage shell")
+    with subtest("Manage script works"):
+        # "shell" sucommand should succeed, needs python in PATH.
+        assert "foo\n" == machine.succeed("echo 'print(\"foo\")' | sudo -u healthchecks healthchecks-manage shell")
 
-          # Shouldn't fail if not called by healthchecks user
-          assert "foo\n" == machine.succeed("echo 'print(\"foo\")' | healthchecks-manage shell")
-    '';
-  }
-)
+        # Shouldn't fail if not called by healthchecks user
+        assert "foo\n" == machine.succeed("echo 'print(\"foo\")' | healthchecks-manage shell")
+  '';
+}
diff --git a/nixos/tests/web-apps/immich-public-proxy.nix b/nixos/tests/web-apps/immich-public-proxy.nix
index 5f2034b29442..f711e56abb48 100644
--- a/nixos/tests/web-apps/immich-public-proxy.nix
+++ b/nixos/tests/web-apps/immich-public-proxy.nix
@@ -1,105 +1,103 @@
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "immich-public-proxy";
+{ pkgs, lib, ... }:
+{
+  name = "immich-public-proxy";
 
-    nodes.machine =
-      { pkgs, ... }@args:
-      {
-        environment.systemPackages = [
-          pkgs.imagemagick
-          pkgs.immich-cli
-        ];
-        services.immich = {
-          enable = true;
-          port = 2283;
-          # disable a lot of features that aren't needed for this test
-          machine-learning.enable = false;
-          settings = {
-            backup.database.enabled = false;
-            machineLearning.enabled = false;
-            map.enabled = false;
-            reverseGeocoding.enabled = false;
-            metadata.faces.import = false;
-            newVersionCheck.enabled = false;
-            notifications.smtp.enabled = false;
-          };
-        };
-        services.immich-public-proxy = {
-          enable = true;
-          immichUrl = "http://localhost:2283";
-          port = 8002;
-          settings.ipp.responseHeaders."X-NixOS" = "Rules";
+  nodes.machine =
+    { pkgs, ... }@args:
+    {
+      environment.systemPackages = [
+        pkgs.imagemagick
+        pkgs.immich-cli
+      ];
+      services.immich = {
+        enable = true;
+        port = 2283;
+        # disable a lot of features that aren't needed for this test
+        machine-learning.enable = false;
+        settings = {
+          backup.database.enabled = false;
+          machineLearning.enabled = false;
+          map.enabled = false;
+          reverseGeocoding.enabled = false;
+          metadata.faces.import = false;
+          newVersionCheck.enabled = false;
+          notifications.smtp.enabled = false;
         };
       };
+      services.immich-public-proxy = {
+        enable = true;
+        immichUrl = "http://localhost:2283";
+        port = 8002;
+        settings.ipp.responseHeaders."X-NixOS" = "Rules";
+      };
+    };
 
-    testScript = ''
-      import json
+  testScript = ''
+    import json
 
-      machine.wait_for_unit("immich-server.service")
-      machine.wait_for_unit("immich-public-proxy.service")
-      machine.wait_for_open_port(2283)
-      machine.wait_for_open_port(8002)
+    machine.wait_for_unit("immich-server.service")
+    machine.wait_for_unit("immich-public-proxy.service")
+    machine.wait_for_open_port(2283)
+    machine.wait_for_open_port(8002)
 
-      # The proxy should be up
-      machine.succeed("curl -sf http://localhost:8002")
+    # The proxy should be up
+    machine.succeed("curl -sf http://localhost:8002")
 
-      # Verify the static assets are served
-      machine.succeed("curl -sf http://localhost:8002/robots.txt")
-      machine.succeed("curl -sf http://localhost:8002/share/static/style.css")
+    # Verify the static assets are served
+    machine.succeed("curl -sf http://localhost:8002/robots.txt")
+    machine.succeed("curl -sf http://localhost:8002/share/static/style.css")
 
-      # Check that the response header in the settings is sent
-      res = machine.succeed("""
-        curl -sD - http://localhost:8002 -o /dev/null
-      """)
-      assert "x-nixos: rules" in res.lower(), res
+    # Check that the response header in the settings is sent
+    res = machine.succeed("""
+      curl -sD - http://localhost:8002 -o /dev/null
+    """)
+    assert "x-nixos: rules" in res.lower(), res
 
-      # Log in to Immich and create an access key
-      machine.succeed("""
-        curl -sf --json '{ "email": "test@example.com", "name": "Admin", "password": "admin" }' http://localhost:2283/api/auth/admin-sign-up
-      """)
-      res = machine.succeed("""
-        curl -sf --json '{ "email": "test@example.com", "password": "admin" }' http://localhost:2283/api/auth/login
-      """)
-      token = json.loads(res)['accessToken']
-      res = machine.succeed("""
-        curl -sf -H 'Cookie: immich_access_token=%s' --json '{ "name": "API Key", "permissions": ["all"] }' http://localhost:2283/api/api-keys
-      """ % token)
-      key = json.loads(res)['secret']
-      machine.succeed(f"immich login http://localhost:2283/api {key}")
-      res = machine.succeed("immich server-info")
-      print(res)
+    # Log in to Immich and create an access key
+    machine.succeed("""
+      curl -sf --json '{ "email": "test@example.com", "name": "Admin", "password": "admin" }' http://localhost:2283/api/auth/admin-sign-up
+    """)
+    res = machine.succeed("""
+      curl -sf --json '{ "email": "test@example.com", "password": "admin" }' http://localhost:2283/api/auth/login
+    """)
+    token = json.loads(res)['accessToken']
+    res = machine.succeed("""
+      curl -sf -H 'Cookie: immich_access_token=%s' --json '{ "name": "API Key", "permissions": ["all"] }' http://localhost:2283/api/api-keys
+    """ % token)
+    key = json.loads(res)['secret']
+    machine.succeed(f"immich login http://localhost:2283/api {key}")
+    res = machine.succeed("immich server-info")
+    print(res)
 
-      # Upload some blank images to a new album
-      # If there's only one image, the proxy serves the image directly
-      machine.succeed("magick -size 800x600 canvas:white /tmp/white.png")
-      machine.succeed("immich upload -A '✨ Reproducible Moments ✨' /tmp/white.png")
-      machine.succeed("magick -size 800x600 canvas:black /tmp/black.png")
-      machine.succeed("immich upload -A '✨ Reproducible Moments ✨' /tmp/black.png")
-      res = machine.succeed("immich server-info")
-      print(res)
+    # Upload some blank images to a new album
+    # If there's only one image, the proxy serves the image directly
+    machine.succeed("magick -size 800x600 canvas:white /tmp/white.png")
+    machine.succeed("immich upload -A '✨ Reproducible Moments ✨' /tmp/white.png")
+    machine.succeed("magick -size 800x600 canvas:black /tmp/black.png")
+    machine.succeed("immich upload -A '✨ Reproducible Moments ✨' /tmp/black.png")
+    res = machine.succeed("immich server-info")
+    print(res)
 
-      # Get the new album id
-      res = machine.succeed("""
-        curl -sf -H 'Cookie: immich_access_token=%s' http://localhost:2283/api/albums
-      """ % token)
-      album_id = json.loads(res)[0]['id']
+    # Get the new album id
+    res = machine.succeed("""
+      curl -sf -H 'Cookie: immich_access_token=%s' http://localhost:2283/api/albums
+    """ % token)
+    album_id = json.loads(res)[0]['id']
 
-      # Create a shared link
-      res = machine.succeed("""
-        curl -sf -H 'Cookie: immich_access_token=%s' --json '{ "albumId": "%s", "type": "ALBUM" }' http://localhost:2283/api/shared-links
-      """ % (token, album_id))
-      share_key = json.loads(res)['key']
+    # Create a shared link
+    res = machine.succeed("""
+      curl -sf -H 'Cookie: immich_access_token=%s' --json '{ "albumId": "%s", "type": "ALBUM" }' http://localhost:2283/api/shared-links
+    """ % (token, album_id))
+    share_key = json.loads(res)['key']
 
-      # Access the share
-      machine.succeed("""
-        curl -sf http://localhost:2283/share/%s
-      """ % share_key)
+    # Access the share
+    machine.succeed("""
+      curl -sf http://localhost:2283/share/%s
+    """ % share_key)
 
-      # Access the share through the proxy
-      machine.succeed("""
-        curl -sf http://localhost:8002/share/%s
-      """ % share_key)
-    '';
-  }
-)
+    # Access the share through the proxy
+    machine.succeed("""
+      curl -sf http://localhost:8002/share/%s
+    """ % share_key)
+  '';
+}
diff --git a/nixos/tests/web-apps/immich.nix b/nixos/tests/web-apps/immich.nix
index 089037ad837c..550a1630bda8 100644
--- a/nixos/tests/web-apps/immich.nix
+++ b/nixos/tests/web-apps/immich.nix
@@ -1,60 +1,58 @@
-import ../make-test-python.nix (
-  { ... }:
-  {
-    name = "immich-nixos";
+{ ... }:
+{
+  name = "immich-nixos";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        # These tests need a little more juice
-        virtualisation = {
-          cores = 2;
-          memorySize = 2048;
-          diskSize = 4096;
-        };
-
-        environment.systemPackages = with pkgs; [ immich-cli ];
-
-        services.immich = {
-          enable = true;
-          environment.IMMICH_LOG_LEVEL = "verbose";
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      # These tests need a little more juice
+      virtualisation = {
+        cores = 2;
+        memorySize = 2048;
+        diskSize = 4096;
       };
 
-    testScript = ''
-      import json
+      environment.systemPackages = with pkgs; [ immich-cli ];
 
-      machine.wait_for_unit("immich-server.service")
+      services.immich = {
+        enable = true;
+        environment.IMMICH_LOG_LEVEL = "verbose";
+      };
+    };
 
-      machine.wait_for_open_port(2283) # Server
-      machine.wait_for_open_port(3003) # Machine learning
-      machine.succeed("curl --fail http://localhost:2283/")
+  testScript = ''
+    import json
 
-      machine.succeed("""
-        curl -f --json '{ "email": "test@example.com", "name": "Admin", "password": "admin" }' http://localhost:2283/api/auth/admin-sign-up
-      """)
-      res = machine.succeed("""
-        curl -f --json '{ "email": "test@example.com", "password": "admin" }' http://localhost:2283/api/auth/login
-      """)
-      token = json.loads(res)['accessToken']
+    machine.wait_for_unit("immich-server.service")
 
-      res = machine.succeed("""
-        curl -f -H 'Cookie: immich_access_token=%s' --json '{ "name": "API Key", "permissions": ["all"] }' http://localhost:2283/api/api-keys
-      """ % token)
-      key = json.loads(res)['secret']
+    machine.wait_for_open_port(2283) # Server
+    machine.wait_for_open_port(3003) # Machine learning
+    machine.succeed("curl --fail http://localhost:2283/")
 
-      machine.succeed(f"immich login http://localhost:2283/api {key}")
-      res = machine.succeed("immich server-info")
-      print(res)
+    machine.succeed("""
+      curl -f --json '{ "email": "test@example.com", "name": "Admin", "password": "admin" }' http://localhost:2283/api/auth/admin-sign-up
+    """)
+    res = machine.succeed("""
+      curl -f --json '{ "email": "test@example.com", "password": "admin" }' http://localhost:2283/api/auth/login
+    """)
+    token = json.loads(res)['accessToken']
 
-      machine.succeed("""
-        curl -f -X PUT -H 'Cookie: immich_access_token=%s' --json '{ "command": "start" }' http://localhost:2283/api/jobs/backupDatabase
-      """ % token)
-      res = machine.succeed("""
-        curl -f -H 'Cookie: immich_access_token=%s' http://localhost:2283/api/jobs
-      """ % token)
-      assert sum(json.loads(res)["backupDatabase"]["jobCounts"].values()) >= 1
-      machine.wait_until_succeeds("ls /var/lib/immich/backups/*.sql.gz")
-    '';
-  }
-)
+    res = machine.succeed("""
+      curl -f -H 'Cookie: immich_access_token=%s' --json '{ "name": "API Key", "permissions": ["all"] }' http://localhost:2283/api/api-keys
+    """ % token)
+    key = json.loads(res)['secret']
+
+    machine.succeed(f"immich login http://localhost:2283/api {key}")
+    res = machine.succeed("immich server-info")
+    print(res)
+
+    machine.succeed("""
+      curl -f -X PUT -H 'Cookie: immich_access_token=%s' --json '{ "command": "start" }' http://localhost:2283/api/jobs/backupDatabase
+    """ % token)
+    res = machine.succeed("""
+      curl -f -H 'Cookie: immich_access_token=%s' http://localhost:2283/api/jobs
+    """ % token)
+    assert sum(json.loads(res)["backupDatabase"]["jobCounts"].values()) >= 1
+    machine.wait_until_succeeds("ls /var/lib/immich/backups/*.sql.gz")
+  '';
+}
diff --git a/nixos/tests/web-apps/netbox-upgrade.nix b/nixos/tests/web-apps/netbox-upgrade.nix
index 417df2a32af0..1a8c9599206d 100644
--- a/nixos/tests/web-apps/netbox-upgrade.nix
+++ b/nixos/tests/web-apps/netbox-upgrade.nix
@@ -1,104 +1,105 @@
-import ../make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    oldNetbox = "netbox_4_1";
-    newNetbox = "netbox_4_2";
+{ lib, pkgs, ... }:
+let
+  oldNetbox = "netbox_4_1";
+  newNetbox = "netbox_4_2";
 
-    apiVersion =
-      version:
-      lib.pipe version [
-        (lib.splitString ".")
-        (lib.take 2)
-        (lib.concatStringsSep ".")
-      ];
-    oldApiVersion = apiVersion pkgs."${oldNetbox}".version;
-    newApiVersion = apiVersion pkgs."${newNetbox}".version;
-  in
-  {
-    name = "netbox-upgrade";
+  apiVersion =
+    version:
+    lib.pipe version [
+      (lib.splitString ".")
+      (lib.take 2)
+      (lib.concatStringsSep ".")
+    ];
+  oldApiVersion = apiVersion pkgs.${oldNetbox}.version;
+  newApiVersion = apiVersion pkgs.${newNetbox}.version;
+in
+{
+  name = "netbox-upgrade";
 
-    meta = with lib.maintainers; {
-      maintainers = [
-        minijackson
-        raitobezarius
-      ];
-    };
+  meta.maintainers = with lib.maintainers; [
+    minijackson
+    raitobezarius
+  ];
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        virtualisation.memorySize = 2048;
-        services.netbox = {
-          enable = true;
-          # Pick the NetBox package from this config's "pkgs" argument,
-          # so that `nixpkgs.config.permittedInsecurePackages` works
-          package = pkgs."${oldNetbox}";
-          secretKeyFile = pkgs.writeText "secret" ''
-            abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-          '';
-        };
+  node.pkgsReadOnly = false;
 
-        services.nginx = {
-          enable = true;
-
-          recommendedProxySettings = true;
-
-          virtualHosts.netbox = {
-            default = true;
-            locations."/".proxyPass = "http://localhost:${toString config.services.netbox.port}";
-            locations."/static/".alias = "/var/lib/netbox/static/";
-          };
-        };
-
-        users.users.nginx.extraGroups = [ "netbox" ];
-
-        networking.firewall.allowedTCPPorts = [ 80 ];
-
-        nixpkgs.config.permittedInsecurePackages = [ pkgs."${oldNetbox}".name ];
-
-        specialisation.upgrade.configuration.services.netbox.package = lib.mkForce pkgs."${newNetbox}";
+  nodes.machine =
+    let
+      pkgs' = pkgs;
+    in
+    { config, pkgs, ... }:
+    {
+      virtualisation.memorySize = 2048;
+      services.netbox = {
+        enable = true;
+        # Pick the NetBox package from this config's "pkgs" argument,
+        # so that `nixpkgs.config.permittedInsecurePackages` works
+        package = pkgs.${oldNetbox};
+        secretKeyFile = pkgs.writeText "secret" ''
+          abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
+        '';
       };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
-        machine.wait_for_unit("netbox.target")
-        machine.wait_for_unit("nginx.service")
-        machine.wait_until_succeeds("journalctl --since -1m --unit netbox --grep Listening")
+      services.nginx = {
+        enable = true;
 
-        def api_version(headers):
-            header = [header for header in headers.splitlines() if header.startswith("API-Version:")][0]
-            return header.split()[1]
+        recommendedProxySettings = true;
 
-        def check_api_version(version):
-            # Returns 403 with NetBox >= 4.0,
-            # but we still get the API version in the headers
-            headers = machine.succeed(
-              "curl -sSL http://localhost/api/ --head -H 'Content-Type: application/json'"
-            )
-            assert api_version(headers) == version
+        virtualHosts.netbox = {
+          default = true;
+          locations."/".proxyPass = "http://localhost:${toString config.services.netbox.port}";
+          locations."/static/".alias = "/var/lib/netbox/static/";
+        };
+      };
 
-        with subtest("NetBox version is the old one"):
-            check_api_version("${oldApiVersion}")
+      users.users.nginx.extraGroups = [ "netbox" ];
 
-        # Somehow, even though netbox-housekeeping.service has After=netbox.service,
-        # netbox-housekeeping.service and netbox.service still get started at the
-        # same time, making netbox-housekeeping fail (can't really do some house
-        # keeping job if the database is not correctly formed).
-        #
-        # So we don't check that the upgrade went well, we just check that
-        # netbox.service is active, and that netbox-housekeeping can be run
-        # successfully afterwards.
-        #
-        # This is not good UX, but the system should be working nonetheless.
-        machine.execute("${nodes.machine.system.build.toplevel}/specialisation/upgrade/bin/switch-to-configuration test >&2")
+      networking.firewall.allowedTCPPorts = [ 80 ];
 
-        machine.wait_for_unit("netbox.service")
-        machine.succeed("systemctl start netbox-housekeeping.service")
+      nixpkgs.config.permittedInsecurePackages = [ pkgs'.${oldNetbox}.name ];
 
-        with subtest("NetBox version is the new one"):
-            check_api_version("${newApiVersion}")
-      '';
-  }
-)
+      specialisation.upgrade.configuration.services.netbox.package = lib.mkForce pkgs.${newNetbox};
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+      machine.wait_for_unit("netbox.target")
+      machine.wait_for_unit("nginx.service")
+      machine.wait_until_succeeds("journalctl --since -1m --unit netbox --grep Listening")
+
+      def api_version(headers):
+          header = [header for header in headers.splitlines() if header.startswith("API-Version:")][0]
+          return header.split()[1]
+
+      def check_api_version(version):
+          # Returns 403 with NetBox >= 4.0,
+          # but we still get the API version in the headers
+          headers = machine.succeed(
+            "curl -sSL http://localhost/api/ --head -H 'Content-Type: application/json'"
+          )
+          assert api_version(headers) == version
+
+      with subtest("NetBox version is the old one"):
+          check_api_version("${oldApiVersion}")
+
+      # Somehow, even though netbox-housekeeping.service has After=netbox.service,
+      # netbox-housekeeping.service and netbox.service still get started at the
+      # same time, making netbox-housekeeping fail (can't really do some house
+      # keeping job if the database is not correctly formed).
+      #
+      # So we don't check that the upgrade went well, we just check that
+      # netbox.service is active, and that netbox-housekeeping can be run
+      # successfully afterwards.
+      #
+      # This is not good UX, but the system should be working nonetheless.
+      machine.execute("${nodes.machine.system.build.toplevel}/specialisation/upgrade/bin/switch-to-configuration test >&2")
+
+      machine.wait_for_unit("netbox.service")
+      machine.succeed("systemctl start netbox-housekeeping.service")
+
+      with subtest("NetBox version is the new one"):
+          check_api_version("${newApiVersion}")
+    '';
+}
diff --git a/nixos/tests/web-apps/open-web-calendar.nix b/nixos/tests/web-apps/open-web-calendar.nix
index b5cd59c56abd..9778031dabc0 100644
--- a/nixos/tests/web-apps/open-web-calendar.nix
+++ b/nixos/tests/web-apps/open-web-calendar.nix
@@ -1,51 +1,49 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    certs = import ../common/acme/server/snakeoil-certs.nix;
+let
+  certs = import ../common/acme/server/snakeoil-certs.nix;
 
-    serverDomain = certs.domain;
-  in
-  {
-    name = "open-web-calendar";
-    meta.maintainers = with pkgs.lib.maintainers; [ erictapen ];
+  serverDomain = certs.domain;
+in
+{
+  name = "open-web-calendar";
+  meta.maintainers = with pkgs.lib.maintainers; [ erictapen ];
 
-    nodes.server =
-      { pkgs, lib, ... }:
-      {
-        services.open-web-calendar = {
-          enable = true;
-          domain = serverDomain;
-          calendarSettings.title = "My custom title";
-        };
-
-        services.nginx.virtualHosts."${serverDomain}" = {
-          enableACME = lib.mkForce false;
-          sslCertificate = certs."${serverDomain}".cert;
-          sslCertificateKey = certs."${serverDomain}".key;
-        };
-
-        security.pki.certificateFiles = [ certs.ca.cert ];
-
-        networking.hosts."::1" = [ "${serverDomain}" ];
-        networking.firewall.allowedTCPPorts = [
-          80
-          443
-        ];
+  nodes.server =
+    { pkgs, lib, ... }:
+    {
+      services.open-web-calendar = {
+        enable = true;
+        domain = serverDomain;
+        calendarSettings.title = "My custom title";
       };
 
-    nodes.client =
-      { pkgs, nodes, ... }:
-      {
-        networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ "${serverDomain}" ];
-
-        security.pki.certificateFiles = [ certs.ca.cert ];
+      services.nginx.virtualHosts."${serverDomain}" = {
+        enableACME = lib.mkForce false;
+        sslCertificate = certs."${serverDomain}".cert;
+        sslCertificateKey = certs."${serverDomain}".key;
       };
 
-    testScript = ''
-      start_all()
-      server.wait_for_unit("open-web-calendar.socket")
-      server.wait_until_succeeds("curl -f https://${serverDomain}/ | grep 'My custom title'")
-    '';
-  }
-)
+      security.pki.certificateFiles = [ certs.ca.cert ];
+
+      networking.hosts."::1" = [ "${serverDomain}" ];
+      networking.firewall.allowedTCPPorts = [
+        80
+        443
+      ];
+    };
+
+  nodes.client =
+    { pkgs, nodes, ... }:
+    {
+      networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ "${serverDomain}" ];
+
+      security.pki.certificateFiles = [ certs.ca.cert ];
+    };
+
+  testScript = ''
+    start_all()
+    server.wait_for_unit("open-web-calendar.socket")
+    server.wait_until_succeeds("curl -f https://${serverDomain}/ | grep 'My custom title'")
+  '';
+}
diff --git a/nixos/tests/web-apps/peering-manager.nix b/nixos/tests/web-apps/peering-manager.nix
index 6a04d5f4e5e6..8f4e1d731ae8 100644
--- a/nixos/tests/web-apps/peering-manager.nix
+++ b/nixos/tests/web-apps/peering-manager.nix
@@ -1,47 +1,45 @@
-import ../make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "peering-manager";
+{ lib, pkgs, ... }:
+{
+  name = "peering-manager";
 
-    meta = with lib.maintainers; {
-      maintainers = [ yuka ];
+  meta = with lib.maintainers; {
+    maintainers = [ yuka ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      services.peering-manager = {
+        enable = true;
+        secretKeyFile = pkgs.writeText "secret" ''
+          abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
+        '';
+      };
     };
 
-    nodes.machine =
-      { ... }:
-      {
-        services.peering-manager = {
-          enable = true;
-          secretKeyFile = pkgs.writeText "secret" ''
-            abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
-          '';
-        };
-      };
+  testScript =
+    { nodes }:
+    ''
+      machine.start()
+      machine.wait_for_unit("peering-manager.target")
+      machine.wait_until_succeeds("journalctl --since -1m --unit peering-manager --grep Listening")
 
-    testScript =
-      { nodes }:
-      ''
-        machine.start()
-        machine.wait_for_unit("peering-manager.target")
-        machine.wait_until_succeeds("journalctl --since -1m --unit peering-manager --grep Listening")
-
-        print(machine.succeed(
-            "curl -sSfL http://[::1]:8001"
-        ))
-        with subtest("Home screen loads"):
-            machine.succeed(
-                "curl -sSfL http://[::1]:8001 | grep '<title>Home - Peering Manager</title>'"
-            )
-        with subtest("checks succeed"):
-            machine.succeed(
-                "systemctl stop peering-manager peering-manager-rq"
-            )
-            machine.succeed(
-                "sudo -u postgres psql -c 'ALTER USER \"peering-manager\" WITH SUPERUSER;'"
-            )
-            machine.succeed(
-                "cd ${nodes.machine.system.build.peeringManagerPkg}/opt/peering-manager ; peering-manager-manage test --no-input"
-            )
-      '';
-  }
-)
+      print(machine.succeed(
+          "curl -sSfL http://[::1]:8001"
+      ))
+      with subtest("Home screen loads"):
+          machine.succeed(
+              "curl -sSfL http://[::1]:8001 | grep '<title>Home - Peering Manager</title>'"
+          )
+      with subtest("checks succeed"):
+          machine.succeed(
+              "systemctl stop peering-manager peering-manager-rq"
+          )
+          machine.succeed(
+              "sudo -u postgres psql -c 'ALTER USER \"peering-manager\" WITH SUPERUSER;'"
+          )
+          machine.succeed(
+              "cd ${nodes.machine.system.build.peeringManagerPkg}/opt/peering-manager ; peering-manager-manage test --no-input"
+          )
+    '';
+}
diff --git a/nixos/tests/web-apps/phylactery.nix b/nixos/tests/web-apps/phylactery.nix
index 492d50d3d2d1..1643231ff8f0 100644
--- a/nixos/tests/web-apps/phylactery.nix
+++ b/nixos/tests/web-apps/phylactery.nix
@@ -1,25 +1,23 @@
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "phylactery";
+{ pkgs, lib, ... }:
+{
+  name = "phylactery";
 
-    nodes.machine =
-      { ... }:
-      {
-        services.phylactery = rec {
-          enable = true;
-          port = 8080;
-          library = "/tmp";
-        };
+  nodes.machine =
+    { ... }:
+    {
+      services.phylactery = rec {
+        enable = true;
+        port = 8080;
+        library = "/tmp";
       };
+    };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit('phylactery')
-      machine.wait_for_open_port(8080)
-      machine.wait_until_succeeds('curl localhost:8080')
-    '';
+  testScript = ''
+    start_all()
+    machine.wait_for_unit('phylactery')
+    machine.wait_for_open_port(8080)
+    machine.wait_until_succeeds('curl localhost:8080')
+  '';
 
-    meta.maintainers = with lib.maintainers; [ McSinyx ];
-  }
-)
+  meta.maintainers = with lib.maintainers; [ McSinyx ];
+}
diff --git a/nixos/tests/web-apps/tt-rss.nix b/nixos/tests/web-apps/tt-rss.nix
index 1dc2daf535d7..933a6419923c 100644
--- a/nixos/tests/web-apps/tt-rss.nix
+++ b/nixos/tests/web-apps/tt-rss.nix
@@ -1,47 +1,45 @@
-import ../make-test-python.nix (
-  { ... }:
-  {
-    name = "tt-rss-nixos";
+{ ... }:
+{
+  name = "tt-rss-nixos";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.tt-rss = {
-          enable = true;
-          virtualHost = "localhost";
-          selfUrlPath = "http://localhost/";
-          pluginPackages = with pkgs; [
-            tt-rss-plugin-auth-ldap
-            tt-rss-plugin-feediron
-          ];
-          plugins = [
-            "auth_internal"
-            "feediron"
-            "note"
-          ];
-          singleUserMode = true;
-          themePackages = with pkgs; [ tt-rss-theme-feedly ];
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.tt-rss = {
+        enable = true;
+        virtualHost = "localhost";
+        selfUrlPath = "http://localhost/";
+        pluginPackages = with pkgs; [
+          tt-rss-plugin-auth-ldap
+          tt-rss-plugin-feediron
+        ];
+        plugins = [
+          "auth_internal"
+          "feediron"
+          "note"
+        ];
+        singleUserMode = true;
+        themePackages = with pkgs; [ tt-rss-theme-feedly ];
       };
+    };
 
-    testScript = ''
-      import json
-      import re
-      machine.wait_for_unit("tt-rss.service")
+  testScript = ''
+    import json
+    import re
+    machine.wait_for_unit("tt-rss.service")
 
-      matches = re.search('__csrf_token = "([^"]*)"', machine.succeed("curl -sSfL --cookie cjar --cookie-jar cjar -sSfL http://localhost/"))
-      if matches is None:
-        assert False, "CSRF token not found"
-      csrf_token = matches.group(1)
+    matches = re.search('__csrf_token = "([^"]*)"', machine.succeed("curl -sSfL --cookie cjar --cookie-jar cjar -sSfL http://localhost/"))
+    if matches is None:
+      assert False, "CSRF token not found"
+    csrf_token = matches.group(1)
 
-      # Ensure themes are loaded. No API found for these, so it's a crude check.
-      preference_page = machine.succeed("curl -sSfL --cookie cjar --cookie-jar cjar http://localhost/backend.php?op=Pref_Prefs")
-      assert "feedly" in preference_page
+    # Ensure themes are loaded. No API found for these, so it's a crude check.
+    preference_page = machine.succeed("curl -sSfL --cookie cjar --cookie-jar cjar http://localhost/backend.php?op=Pref_Prefs")
+    assert "feedly" in preference_page
 
-      plugins = json.loads(machine.succeed(f"curl -sSfL --cookie cjar --cookie-jar cjar 'http://localhost/backend.php' -X POST --data-raw 'op=Pref_Prefs&method=getPluginsList&csrf_token={csrf_token}'"))["plugins"]
-      expected_plugins = ["auth_internal", "auth_ldap", "feediron", "note"];
-      found_plugins = [p["name"] for p in plugins if p["name"] in expected_plugins]
-      assert len(found_plugins) == len(expected_plugins), f"Expected plugins {expected_plugins}, found {found_plugins}"
-    '';
-  }
-)
+    plugins = json.loads(machine.succeed(f"curl -sSfL --cookie cjar --cookie-jar cjar 'http://localhost/backend.php' -X POST --data-raw 'op=Pref_Prefs&method=getPluginsList&csrf_token={csrf_token}'"))["plugins"]
+    expected_plugins = ["auth_internal", "auth_ldap", "feediron", "note"];
+    found_plugins = [p["name"] for p in plugins if p["name"] in expected_plugins]
+    assert len(found_plugins) == len(expected_plugins), f"Expected plugins {expected_plugins}, found {found_plugins}"
+  '';
+}
diff --git a/nixos/tests/web-apps/weblate.nix b/nixos/tests/web-apps/weblate.nix
index b294dd01cfe5..27df88621973 100644
--- a/nixos/tests/web-apps/weblate.nix
+++ b/nixos/tests/web-apps/weblate.nix
@@ -1,105 +1,103 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    certs = import ../common/acme/server/snakeoil-certs.nix;
+let
+  certs = import ../common/acme/server/snakeoil-certs.nix;
 
-    serverDomain = certs.domain;
+  serverDomain = certs.domain;
 
-    admin = {
-      username = "admin";
-      password = "snakeoilpass";
-    };
-    # An API token that we manually insert into the db as a valid one.
-    apiToken = "OVJh65sXaAfQMZ4NTcIGbFZIyBZbEZqWTi7azdDf";
-  in
-  {
-    name = "weblate";
-    meta.maintainers = with pkgs.lib.maintainers; [ erictapen ];
+  admin = {
+    username = "admin";
+    password = "snakeoilpass";
+  };
+  # An API token that we manually insert into the db as a valid one.
+  apiToken = "OVJh65sXaAfQMZ4NTcIGbFZIyBZbEZqWTi7azdDf";
+in
+{
+  name = "weblate";
+  meta.maintainers = with pkgs.lib.maintainers; [ erictapen ];
 
-    nodes.server =
-      { pkgs, lib, ... }:
-      {
-        virtualisation.memorySize = 2048;
+  nodes.server =
+    { pkgs, lib, ... }:
+    {
+      virtualisation.memorySize = 2048;
 
-        services.weblate = {
-          enable = true;
-          localDomain = "${serverDomain}";
-          djangoSecretKeyFile = pkgs.writeText "weblate-django-secret" "thisissnakeoilsecretwithmorethan50characterscorrecthorsebatterystaple";
-          extraConfig = ''
-            # Weblate tries to fetch Avatars from the network
-            ENABLE_AVATARS = False
-          '';
-        };
-
-        services.nginx.virtualHosts."${serverDomain}" = {
-          enableACME = lib.mkForce false;
-          sslCertificate = certs."${serverDomain}".cert;
-          sslCertificateKey = certs."${serverDomain}".key;
-        };
-
-        security.pki.certificateFiles = [ certs.ca.cert ];
-
-        networking.hosts."::1" = [ "${serverDomain}" ];
-        networking.firewall.allowedTCPPorts = [
-          80
-          443
-        ];
-
-        users.users.weblate.shell = pkgs.bashInteractive;
-      };
-
-    nodes.client =
-      { pkgs, nodes, ... }:
-      {
-        environment.systemPackages = [ pkgs.wlc ];
-
-        environment.etc."xdg/weblate".text = ''
-          [weblate]
-          url = https://${serverDomain}/api/
-          key = ${apiToken}
+      services.weblate = {
+        enable = true;
+        localDomain = "${serverDomain}";
+        djangoSecretKeyFile = pkgs.writeText "weblate-django-secret" "thisissnakeoilsecretwithmorethan50characterscorrecthorsebatterystaple";
+        extraConfig = ''
+          # Weblate tries to fetch Avatars from the network
+          ENABLE_AVATARS = False
         '';
-
-        networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ "${serverDomain}" ];
-
-        security.pki.certificateFiles = [ certs.ca.cert ];
       };
 
-    testScript = ''
-      import json
+      services.nginx.virtualHosts."${serverDomain}" = {
+        enableACME = lib.mkForce false;
+        sslCertificate = certs."${serverDomain}".cert;
+        sslCertificateKey = certs."${serverDomain}".key;
+      };
 
-      start_all()
-      server.wait_for_unit("weblate.socket")
-      server.wait_until_succeeds("curl -f https://${serverDomain}/")
-      server.succeed("sudo -iu weblate -- weblate createadmin --username ${admin.username} --password ${admin.password} --email weblate@example.org")
+      security.pki.certificateFiles = [ certs.ca.cert ];
 
-      # It's easier to replace the generated API token with a predefined one than
-      # to extract it at runtime.
-      server.succeed("sudo -iu weblate -- psql -d weblate -c \"UPDATE authtoken_token SET key = '${apiToken}' WHERE user_id = (SELECT id FROM weblate_auth_user WHERE username = 'admin');\"")
+      networking.hosts."::1" = [ "${serverDomain}" ];
+      networking.firewall.allowedTCPPorts = [
+        80
+        443
+      ];
 
-      client.wait_for_unit("multi-user.target")
+      users.users.weblate.shell = pkgs.bashInteractive;
+    };
 
-      # Test the official Weblate client wlc.
-      client.wait_until_succeeds("REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt wlc --debug list-projects")
+  nodes.client =
+    { pkgs, nodes, ... }:
+    {
+      environment.systemPackages = [ pkgs.wlc ];
 
-      def call_wl_api(arg):
-          (rv, result) = client.execute("curl -H \"Content-Type: application/json\" -H \"Authorization: Token ${apiToken}\" https://${serverDomain}/api/{}".format(arg))
-          assert rv == 0
-          print(result)
+      environment.etc."xdg/weblate".text = ''
+        [weblate]
+        url = https://${serverDomain}/api/
+        key = ${apiToken}
+      '';
 
-      call_wl_api("users/ --data '{}'".format(
-        json.dumps(
-          {"username": "test1",
-            "full_name": "test1",
-            "email": "test1@example.org"
-          })))
+      networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ "${serverDomain}" ];
 
-      # TODO: Check sending and receiving email.
-      # server.wait_for_unit("postfix.service")
+      security.pki.certificateFiles = [ certs.ca.cert ];
+    };
 
-      server.succeed("sudo -iu weblate -- weblate check")
-      # TODO: The goal is for this to succeed, but there are still some checks failing.
-      # server.succeed("sudo -iu weblate -- weblate check --deploy")
-    '';
-  }
-)
+  testScript = ''
+    import json
+
+    start_all()
+    server.wait_for_unit("weblate.socket")
+    server.wait_until_succeeds("curl -f https://${serverDomain}/")
+    server.succeed("sudo -iu weblate -- weblate createadmin --username ${admin.username} --password ${admin.password} --email weblate@example.org")
+
+    # It's easier to replace the generated API token with a predefined one than
+    # to extract it at runtime.
+    server.succeed("sudo -iu weblate -- psql -d weblate -c \"UPDATE authtoken_token SET key = '${apiToken}' WHERE user_id = (SELECT id FROM weblate_auth_user WHERE username = 'admin');\"")
+
+    client.wait_for_unit("multi-user.target")
+
+    # Test the official Weblate client wlc.
+    client.wait_until_succeeds("REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt wlc --debug list-projects")
+
+    def call_wl_api(arg):
+        (rv, result) = client.execute("curl -H \"Content-Type: application/json\" -H \"Authorization: Token ${apiToken}\" https://${serverDomain}/api/{}".format(arg))
+        assert rv == 0
+        print(result)
+
+    call_wl_api("users/ --data '{}'".format(
+      json.dumps(
+        {"username": "test1",
+          "full_name": "test1",
+          "email": "test1@example.org"
+        })))
+
+    # TODO: Check sending and receiving email.
+    # server.wait_for_unit("postfix.service")
+
+    server.succeed("sudo -iu weblate -- weblate check")
+    # TODO: The goal is for this to succeed, but there are still some checks failing.
+    # server.succeed("sudo -iu weblate -- weblate check --deploy")
+  '';
+}
diff --git a/nixos/tests/web-servers/ttyd.nix b/nixos/tests/web-servers/ttyd.nix
index 8735269afcff..948224e6fcb8 100644
--- a/nixos/tests/web-servers/ttyd.nix
+++ b/nixos/tests/web-servers/ttyd.nix
@@ -1,36 +1,34 @@
-import ../make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "ttyd";
-    meta.maintainers = with lib.maintainers; [ stunkymonkey ];
+{ lib, pkgs, ... }:
+{
+  name = "ttyd";
+  meta.maintainers = with lib.maintainers; [ stunkymonkey ];
 
-    nodes.readonly =
-      { pkgs, ... }:
-      {
-        services.ttyd = {
-          enable = true;
-          entrypoint = [ (lib.getExe pkgs.htop) ];
-          writeable = false;
-        };
+  nodes.readonly =
+    { pkgs, ... }:
+    {
+      services.ttyd = {
+        enable = true;
+        entrypoint = [ (lib.getExe pkgs.htop) ];
+        writeable = false;
       };
+    };
 
-    nodes.writeable =
-      { pkgs, ... }:
-      {
-        services.ttyd = {
-          enable = true;
-          username = "foo";
-          passwordFile = pkgs.writeText "password" "bar";
-          writeable = true;
-        };
+  nodes.writeable =
+    { pkgs, ... }:
+    {
+      services.ttyd = {
+        enable = true;
+        username = "foo";
+        passwordFile = pkgs.writeText "password" "bar";
+        writeable = true;
       };
+    };
 
-    testScript = ''
-      for machine in [readonly, writeable]:
-        machine.wait_for_unit("ttyd.service")
-        machine.wait_for_open_port(7681)
-        response = machine.succeed("curl -vvv -u foo:bar -s -H 'Host: ttyd' http://127.0.0.1:7681/")
-        assert '<title>ttyd - Terminal</title>' in response, "Page didn't load successfully"
-    '';
-  }
-)
+  testScript = ''
+    for machine in [readonly, writeable]:
+      machine.wait_for_unit("ttyd.service")
+      machine.wait_for_open_port(7681)
+      response = machine.succeed("curl -vvv -u foo:bar -s -H 'Host: ttyd' http://127.0.0.1:7681/")
+      assert '<title>ttyd - Terminal</title>' in response, "Page didn't load successfully"
+  '';
+}
diff --git a/nixos/tests/web-servers/unit-perl.nix b/nixos/tests/web-servers/unit-perl.nix
index e632221747cf..157e989c8bd1 100644
--- a/nixos/tests/web-servers/unit-perl.nix
+++ b/nixos/tests/web-servers/unit-perl.nix
@@ -1,46 +1,44 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  let
-    testdir = pkgs.writeTextDir "www/app.psgi" ''
-      my $app = sub {
-          return [
-              "200",
-              [ "Content-Type" => "text/plain" ],
-              [ "Hello, Perl on Unit!" ],
-          ];
-      };
-    '';
+{ pkgs, ... }:
+let
+  testdir = pkgs.writeTextDir "www/app.psgi" ''
+    my $app = sub {
+        return [
+            "200",
+            [ "Content-Type" => "text/plain" ],
+            [ "Hello, Perl on Unit!" ],
+        ];
+    };
+  '';
 
-  in
-  {
-    name = "unit-perl-test";
-    meta.maintainers = with pkgs.lib.maintainers; [ sgo ];
+in
+{
+  name = "unit-perl-test";
+  meta.maintainers = with pkgs.lib.maintainers; [ sgo ];
 
-    nodes.machine =
-      {
-        config,
-        lib,
-        pkgs,
-        ...
-      }:
-      {
-        services.unit = {
-          enable = true;
-          config = pkgs.lib.strings.toJSON {
-            listeners."*:8080".application = "perl";
-            applications.perl = {
-              type = "perl";
-              script = "${testdir}/www/app.psgi";
-            };
+  nodes.machine =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      services.unit = {
+        enable = true;
+        config = pkgs.lib.strings.toJSON {
+          listeners."*:8080".application = "perl";
+          applications.perl = {
+            type = "perl";
+            script = "${testdir}/www/app.psgi";
           };
         };
       };
-    testScript = ''
-      machine.wait_for_unit("unit.service")
-      machine.wait_for_open_port(8080)
+    };
+  testScript = ''
+    machine.wait_for_unit("unit.service")
+    machine.wait_for_open_port(8080)
 
-      response = machine.succeed("curl -f -vvv -s http://127.0.0.1:8080/")
-      assert "Hello, Perl on Unit!" in response, "Hello world"
-    '';
-  }
-)
+    response = machine.succeed("curl -f -vvv -s http://127.0.0.1:8080/")
+    assert "Hello, Perl on Unit!" in response, "Hello world"
+  '';
+}
diff --git a/nixos/tests/wg-access-server.nix b/nixos/tests/wg-access-server.nix
index 63ec2a3ddbb5..cfd2c748ec1b 100644
--- a/nixos/tests/wg-access-server.nix
+++ b/nixos/tests/wg-access-server.nix
@@ -1,36 +1,34 @@
-import ./make-test-python.nix (
-  {
-    pkgs,
-    lib,
-    kernelPackages ? null,
-    ...
-  }:
-  {
-    name = "wg-access-server";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ xanderio ];
-    };
+{
+  pkgs,
+  lib,
+  kernelPackages ? null,
+  ...
+}:
+{
+  name = "wg-access-server";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ xanderio ];
+  };
 
-    nodes = {
-      server = {
-        services.wg-access-server = {
-          enable = true;
-          settings = {
-            adminUsername = "admin";
-          };
-          secretsFile = (
-            pkgs.writers.writeYAML "secrets.yaml" {
-              adminPassword = "hunter2";
-            }
-          );
+  nodes = {
+    server = {
+      services.wg-access-server = {
+        enable = true;
+        settings = {
+          adminUsername = "admin";
         };
+        secretsFile = (
+          pkgs.writers.writeYAML "secrets.yaml" {
+            adminPassword = "hunter2";
+          }
+        );
       };
     };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      server.wait_for_unit("wg-access-server.service")
-    '';
-  }
-)
+    server.wait_for_unit("wg-access-server.service")
+  '';
+}
diff --git a/nixos/tests/whisparr.nix b/nixos/tests/whisparr.nix
index 3d528a21c6e2..ee34aca18ce5 100644
--- a/nixos/tests/whisparr.nix
+++ b/nixos/tests/whisparr.nix
@@ -1,19 +1,17 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "whisparr";
-    meta.maintainers = [ lib.maintainers.paveloom ];
+{ lib, ... }:
+{
+  name = "whisparr";
+  meta.maintainers = [ lib.maintainers.paveloom ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.whisparr.enable = true;
-      };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.whisparr.enable = true;
+    };
 
-    testScript = ''
-      machine.wait_for_unit("whisparr.service")
-      machine.wait_for_open_port(6969)
-      machine.succeed("curl --fail http://localhost:6969/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("whisparr.service")
+    machine.wait_for_open_port(6969)
+    machine.succeed("curl --fail http://localhost:6969/")
+  '';
+}
diff --git a/nixos/tests/whoogle-search.nix b/nixos/tests/whoogle-search.nix
index 0f25609601ee..c85ad02bcb2f 100644
--- a/nixos/tests/whoogle-search.nix
+++ b/nixos/tests/whoogle-search.nix
@@ -1,24 +1,22 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "whoogle-search";
-    meta.maintainers = with lib.maintainers; [ malte-v ];
+{ pkgs, lib, ... }:
+{
+  name = "whoogle-search";
+  meta.maintainers = with lib.maintainers; [ malte-v ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.whoogle-search = {
-          enable = true;
-          port = 5000;
-          listenAddress = "127.0.0.1";
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.whoogle-search = {
+        enable = true;
+        port = 5000;
+        listenAddress = "127.0.0.1";
       };
+    };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("whoogle-search.service")
-      machine.wait_for_open_port(5000)
-      machine.wait_until_succeeds("curl --fail --show-error --silent --location localhost:5000/")
-    '';
-  }
-)
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("whoogle-search.service")
+    machine.wait_for_open_port(5000)
+    machine.wait_until_succeeds("curl --fail --show-error --silent --location localhost:5000/")
+  '';
+}
diff --git a/nixos/tests/without-nix.nix b/nixos/tests/without-nix.nix
index 2469a80e99b3..9bea24e691a4 100644
--- a/nixos/tests/without-nix.nix
+++ b/nixos/tests/without-nix.nix
@@ -1,37 +1,33 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "without-nix";
-    meta = with lib.maintainers; {
-      maintainers = [ ericson2314 ];
-    };
+{ lib, ... }:
+{
+  name = "without-nix";
+  meta.maintainers = with lib.maintainers; [ ericson2314 ];
 
-    nodes.machine =
-      { ... }:
-      {
-        nix.enable = false;
-        nixpkgs.overlays = [
-          (self: super: {
-            nix = throw "don't want to use pkgs.nix";
-            nixVersions = lib.mapAttrs (k: throw "don't want to use pkgs.nixVersions.${k}") super.nixVersions;
-            # aliases, some deprecated
-            nix_2_3 = throw "don't want to use pkgs.nix_2_3";
-            nix_2_4 = throw "don't want to use pkgs.nix_2_4";
-            nix_2_5 = throw "don't want to use pkgs.nix_2_5";
-            nix_2_6 = throw "don't want to use pkgs.nix_2_6";
-            nixFlakes = throw "don't want to use pkgs.nixFlakes";
-            nixStable = throw "don't want to use pkgs.nixStable";
-            nixUnstable = throw "don't want to use pkgs.nixUnstable";
-            nixStatic = throw "don't want to use pkgs.nixStatic";
-          })
-        ];
-      };
+  node.pkgsReadOnly = false;
 
-    testScript = ''
-      start_all()
+  nodes.machine = {
+    nix.enable = false;
+    nixpkgs.overlays = [
+      (self: super: {
+        nix = throw "don't want to use pkgs.nix";
+        nixVersions = lib.mapAttrs (k: throw "don't want to use pkgs.nixVersions.${k}") super.nixVersions;
+        # aliases, some deprecated
+        nix_2_3 = throw "don't want to use pkgs.nix_2_3";
+        nix_2_4 = throw "don't want to use pkgs.nix_2_4";
+        nix_2_5 = throw "don't want to use pkgs.nix_2_5";
+        nix_2_6 = throw "don't want to use pkgs.nix_2_6";
+        nixFlakes = throw "don't want to use pkgs.nixFlakes";
+        nixStable = throw "don't want to use pkgs.nixStable";
+        nixUnstable = throw "don't want to use pkgs.nixUnstable";
+        nixStatic = throw "don't want to use pkgs.nixStatic";
+      })
+    ];
+  };
 
-      machine.succeed("which which")
-      machine.fail("which nix")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+
+    machine.succeed("which which")
+    machine.fail("which nix")
+  '';
+}
diff --git a/nixos/tests/wmderland.nix b/nixos/tests/wmderland.nix
index 44622f340ca9..4ce99b889521 100644
--- a/nixos/tests/wmderland.nix
+++ b/nixos/tests/wmderland.nix
@@ -1,66 +1,64 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "wmderland";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ takagiy ];
+{ pkgs, ... }:
+{
+  name = "wmderland";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ takagiy ];
+  };
+
+  nodes.machine =
+    { lib, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+        ./common/user-account.nix
+      ];
+      test-support.displayManager.auto.user = "alice";
+      services.displayManager.defaultSession = lib.mkForce "none+wmderland";
+      services.xserver.windowManager.wmderland.enable = true;
+
+      systemd.services.setupWmderlandConfig = {
+        wantedBy = [ "multi-user.target" ];
+        before = [ "multi-user.target" ];
+        environment = {
+          HOME = "/home/alice";
+        };
+        unitConfig = {
+          type = "oneshot";
+          RemainAfterExit = true;
+          user = "alice";
+        };
+        script =
+          let
+            config = pkgs.writeText "config" ''
+              set $Mod = Mod1
+              bindsym $Mod+Return exec ${pkgs.xterm}/bin/xterm -cm -pc
+            '';
+          in
+          ''
+            mkdir -p $HOME/.config/wmderland
+            cp ${config} $HOME/.config/wmderland/config
+          '';
+      };
     };
 
-    nodes.machine =
-      { lib, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-          ./common/user-account.nix
-        ];
-        test-support.displayManager.auto.user = "alice";
-        services.displayManager.defaultSession = lib.mkForce "none+wmderland";
-        services.xserver.windowManager.wmderland.enable = true;
+  testScript =
+    { ... }:
+    ''
+      with subtest("ensure x starts"):
+          machine.wait_for_x()
+          machine.wait_for_file("/home/alice/.Xauthority")
+          machine.succeed("xauth merge ~alice/.Xauthority")
 
-        systemd.services.setupWmderlandConfig = {
-          wantedBy = [ "multi-user.target" ];
-          before = [ "multi-user.target" ];
-          environment = {
-            HOME = "/home/alice";
-          };
-          unitConfig = {
-            type = "oneshot";
-            RemainAfterExit = true;
-            user = "alice";
-          };
-          script =
-            let
-              config = pkgs.writeText "config" ''
-                set $Mod = Mod1
-                bindsym $Mod+Return exec ${pkgs.xterm}/bin/xterm -cm -pc
-              '';
-            in
-            ''
-              mkdir -p $HOME/.config/wmderland
-              cp ${config} $HOME/.config/wmderland/config
-            '';
-        };
-      };
+      with subtest("ensure we can open a new terminal"):
+          machine.send_key("alt-ret")
+          machine.wait_until_succeeds("pgrep xterm")
+          machine.wait_for_window(r"alice.*?machine")
+          machine.screenshot("terminal")
 
-    testScript =
-      { ... }:
-      ''
-        with subtest("ensure x starts"):
-            machine.wait_for_x()
-            machine.wait_for_file("/home/alice/.Xauthority")
-            machine.succeed("xauth merge ~alice/.Xauthority")
-
-        with subtest("ensure we can open a new terminal"):
-            machine.send_key("alt-ret")
-            machine.wait_until_succeeds("pgrep xterm")
-            machine.wait_for_window(r"alice.*?machine")
-            machine.screenshot("terminal")
-
-        with subtest("ensure we can communicate through ipc with wmderlandc"):
-            # Kills the previously open xterm
-            machine.succeed("pgrep xterm")
-            machine.execute("DISPLAY=:0 wmderlandc kill")
-            machine.fail("pgrep xterm")
-      '';
-  }
-)
+      with subtest("ensure we can communicate through ipc with wmderlandc"):
+          # Kills the previously open xterm
+          machine.succeed("pgrep xterm")
+          machine.execute("DISPLAY=:0 wmderlandc kill")
+          machine.fail("pgrep xterm")
+    '';
+}
diff --git a/nixos/tests/workout-tracker.nix b/nixos/tests/workout-tracker.nix
index 1ad509edf2d4..b937e3e6e09e 100644
--- a/nixos/tests/workout-tracker.nix
+++ b/nixos/tests/workout-tracker.nix
@@ -1,29 +1,27 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
-  {
-    name = "workout-tracker";
+{
+  name = "workout-tracker";
 
-    meta.maintainers = with lib.maintainers; [ bhankas ];
+  meta.maintainers = with lib.maintainers; [ bhankas ];
 
-    nodes.machine =
-      { config, ... }:
-      {
-        virtualisation.memorySize = 2048;
+  nodes.machine =
+    { config, ... }:
+    {
+      virtualisation.memorySize = 2048;
 
-        services.workout-tracker.enable = true;
-      };
+      services.workout-tracker.enable = true;
+    };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("workout-tracker.service")
-      # wait for workout-tracker to fully come up
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("workout-tracker.service")
+    # wait for workout-tracker to fully come up
 
-      with subtest("workout-tracker service starts"):
-          machine.wait_until_succeeds(
-              "curl -sSfL http://localhost:8080/ > /dev/null",
-              timeout=30
-          )
-    '';
-  }
-)
+    with subtest("workout-tracker service starts"):
+        machine.wait_until_succeeds(
+            "curl -sSfL http://localhost:8080/ > /dev/null",
+            timeout=30
+        )
+  '';
+}
diff --git a/nixos/tests/wrappers.nix b/nixos/tests/wrappers.nix
index 4766051805c7..e27e02bc4d10 100644
--- a/nixos/tests/wrappers.nix
+++ b/nixos/tests/wrappers.nix
@@ -1,128 +1,126 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    userUid = 1000;
-    usersGid = 100;
-    busybox =
-      pkgs:
-      pkgs.busybox.override {
-        # Without this, the busybox binary drops euid to ruid for most applets, including id.
-        # See https://bugs.busybox.net/show_bug.cgi?id=15101
-        extraConfig = "CONFIG_FEATURE_SUID n";
-      };
-  in
-  {
-    name = "wrappers";
+{ pkgs, ... }:
+let
+  userUid = 1000;
+  usersGid = 100;
+  busybox =
+    pkgs:
+    pkgs.busybox.override {
+      # Without this, the busybox binary drops euid to ruid for most applets, including id.
+      # See https://bugs.busybox.net/show_bug.cgi?id=15101
+      extraConfig = "CONFIG_FEATURE_SUID n";
+    };
+in
+{
+  name = "wrappers";
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        ids.gids.users = usersGid;
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      ids.gids.users = usersGid;
 
-        users.users = {
-          regular = {
-            uid = userUid;
-            isNormalUser = true;
-          };
-        };
-
-        security.apparmor.enable = true;
-
-        security.wrappers = {
-          disabled = {
-            enable = false;
-            owner = "root";
-            group = "root";
-            setuid = true;
-            source = "${busybox pkgs}/bin/busybox";
-            program = "disabled_busybox";
-          };
-          suidRoot = {
-            owner = "root";
-            group = "root";
-            setuid = true;
-            source = "${busybox pkgs}/bin/busybox";
-            program = "suid_root_busybox";
-          };
-          sgidRoot = {
-            owner = "root";
-            group = "root";
-            setgid = true;
-            source = "${busybox pkgs}/bin/busybox";
-            program = "sgid_root_busybox";
-          };
-          withChown = {
-            owner = "root";
-            group = "root";
-            source = "${pkgs.libcap}/bin/capsh";
-            program = "capsh_with_chown";
-            capabilities = "cap_chown+ep";
-          };
+      users.users = {
+        regular = {
+          uid = userUid;
+          isNormalUser = true;
         };
       };
 
-    testScript = ''
-      def cmd_as_regular(cmd):
-        return "su -l regular -c '{0}'".format(cmd)
+      security.apparmor.enable = true;
 
-      def test_as_regular(cmd, expected):
-        out = machine.succeed(cmd_as_regular(cmd)).strip()
-        assert out == expected, "Expected {0} to output {1}, but got {2}".format(cmd, expected, out)
+      security.wrappers = {
+        disabled = {
+          enable = false;
+          owner = "root";
+          group = "root";
+          setuid = true;
+          source = "${busybox pkgs}/bin/busybox";
+          program = "disabled_busybox";
+        };
+        suidRoot = {
+          owner = "root";
+          group = "root";
+          setuid = true;
+          source = "${busybox pkgs}/bin/busybox";
+          program = "suid_root_busybox";
+        };
+        sgidRoot = {
+          owner = "root";
+          group = "root";
+          setgid = true;
+          source = "${busybox pkgs}/bin/busybox";
+          program = "sgid_root_busybox";
+        };
+        withChown = {
+          owner = "root";
+          group = "root";
+          source = "${pkgs.libcap}/bin/capsh";
+          program = "capsh_with_chown";
+          capabilities = "cap_chown+ep";
+        };
+      };
+    };
 
-      def test_as_regular_in_userns_mapped_as_root(cmd, expected):
-        out = machine.succeed(f"su -l regular -c '${pkgs.util-linux}/bin/unshare -rm {cmd}'").strip()
-        assert out == expected, "Expected {0} to output {1}, but got {2}".format(cmd, expected, out)
+  testScript = ''
+    def cmd_as_regular(cmd):
+      return "su -l regular -c '{0}'".format(cmd)
 
-      test_as_regular('${busybox pkgs}/bin/busybox id -u', '${toString userUid}')
-      test_as_regular('${busybox pkgs}/bin/busybox id -ru', '${toString userUid}')
-      test_as_regular('${busybox pkgs}/bin/busybox id -g', '${toString usersGid}')
-      test_as_regular('${busybox pkgs}/bin/busybox id -rg', '${toString usersGid}')
+    def test_as_regular(cmd, expected):
+      out = machine.succeed(cmd_as_regular(cmd)).strip()
+      assert out == expected, "Expected {0} to output {1}, but got {2}".format(cmd, expected, out)
 
-      test_as_regular('/run/wrappers/bin/suid_root_busybox id -u', '0')
-      test_as_regular('/run/wrappers/bin/suid_root_busybox id -ru', '${toString userUid}')
-      test_as_regular('/run/wrappers/bin/suid_root_busybox id -g', '${toString usersGid}')
-      test_as_regular('/run/wrappers/bin/suid_root_busybox id -rg', '${toString usersGid}')
+    def test_as_regular_in_userns_mapped_as_root(cmd, expected):
+      out = machine.succeed(f"su -l regular -c '${pkgs.util-linux}/bin/unshare -rm {cmd}'").strip()
+      assert out == expected, "Expected {0} to output {1}, but got {2}".format(cmd, expected, out)
 
-      test_as_regular('/run/wrappers/bin/sgid_root_busybox id -u', '${toString userUid}')
-      test_as_regular('/run/wrappers/bin/sgid_root_busybox id -ru', '${toString userUid}')
-      test_as_regular('/run/wrappers/bin/sgid_root_busybox id -g', '0')
-      test_as_regular('/run/wrappers/bin/sgid_root_busybox id -rg', '${toString usersGid}')
+    test_as_regular('${busybox pkgs}/bin/busybox id -u', '${toString userUid}')
+    test_as_regular('${busybox pkgs}/bin/busybox id -ru', '${toString userUid}')
+    test_as_regular('${busybox pkgs}/bin/busybox id -g', '${toString usersGid}')
+    test_as_regular('${busybox pkgs}/bin/busybox id -rg', '${toString usersGid}')
 
-      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/suid_root_busybox id -u', '0')
-      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/suid_root_busybox id -ru', '0')
-      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/suid_root_busybox id -g', '0')
-      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/suid_root_busybox id -rg', '0')
+    test_as_regular('/run/wrappers/bin/suid_root_busybox id -u', '0')
+    test_as_regular('/run/wrappers/bin/suid_root_busybox id -ru', '${toString userUid}')
+    test_as_regular('/run/wrappers/bin/suid_root_busybox id -g', '${toString usersGid}')
+    test_as_regular('/run/wrappers/bin/suid_root_busybox id -rg', '${toString usersGid}')
 
-      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -u', '0')
-      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -ru', '0')
-      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -g', '0')
-      test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -rg', '0')
+    test_as_regular('/run/wrappers/bin/sgid_root_busybox id -u', '${toString userUid}')
+    test_as_regular('/run/wrappers/bin/sgid_root_busybox id -ru', '${toString userUid}')
+    test_as_regular('/run/wrappers/bin/sgid_root_busybox id -g', '0')
+    test_as_regular('/run/wrappers/bin/sgid_root_busybox id -rg', '${toString usersGid}')
 
-      # Test that in nonewprivs environment the wrappers simply exec their target.
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -u', '${toString userUid}')
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -ru', '${toString userUid}')
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -g', '${toString usersGid}')
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -rg', '${toString usersGid}')
+    test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/suid_root_busybox id -u', '0')
+    test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/suid_root_busybox id -ru', '0')
+    test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/suid_root_busybox id -g', '0')
+    test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/suid_root_busybox id -rg', '0')
 
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -u', '${toString userUid}')
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -ru', '${toString userUid}')
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -g', '${toString usersGid}')
-      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -rg', '${toString usersGid}')
+    test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -u', '0')
+    test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -ru', '0')
+    test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -g', '0')
+    test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -rg', '0')
 
-      # We are only testing the permitted set, because it's easiest to look at with capsh.
-      machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_CHOWN'))
-      machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_SYS_ADMIN'))
-      machine.succeed(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_CHOWN'))
-      machine.fail(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_SYS_ADMIN'))
+    # Test that in nonewprivs environment the wrappers simply exec their target.
+    test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -u', '${toString userUid}')
+    test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -ru', '${toString userUid}')
+    test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -g', '${toString usersGid}')
+    test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -rg', '${toString usersGid}')
 
-      # Test that the only user of apparmor policy includes generated by
-      # wrappers works. Ideally this'd be located in a test for the module that
-      # actually makes the apparmor policy for ping, but there's no convenient
-      # test for that one.
-      machine.succeed("ping -c 1 127.0.0.1")
+    test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -u', '${toString userUid}')
+    test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -ru', '${toString userUid}')
+    test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -g', '${toString usersGid}')
+    test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -rg', '${toString usersGid}')
 
-      # Test that the disabled wrapper is not present.
-      machine.fail("test -e /run/wrappers/bin/disabled_busybox")
-    '';
-  }
-)
+    # We are only testing the permitted set, because it's easiest to look at with capsh.
+    machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_CHOWN'))
+    machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_SYS_ADMIN'))
+    machine.succeed(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_CHOWN'))
+    machine.fail(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_SYS_ADMIN'))
+
+    # Test that the only user of apparmor policy includes generated by
+    # wrappers works. Ideally this'd be located in a test for the module that
+    # actually makes the apparmor policy for ping, but there's no convenient
+    # test for that one.
+    machine.succeed("ping -c 1 127.0.0.1")
+
+    # Test that the disabled wrapper is not present.
+    machine.fail("test -e /run/wrappers/bin/disabled_busybox")
+  '';
+}
diff --git a/nixos/tests/xmpp/ejabberd.nix b/nixos/tests/xmpp/ejabberd.nix
index a9dcdab80518..2172ae54bc91 100644
--- a/nixos/tests/xmpp/ejabberd.nix
+++ b/nixos/tests/xmpp/ejabberd.nix
@@ -7,315 +7,313 @@ let
       cp key.pem cert.pem $out
     '';
 in
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "ejabberd";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ];
-    };
-    nodes = {
-      client =
-        { nodes, pkgs, ... }:
-        {
-          security.pki.certificateFiles = [ "${cert pkgs}/cert.pem" ];
-          networking.extraHosts = ''
-            ${nodes.server.networking.primaryIPAddress} example.com
-          '';
+{ pkgs, ... }:
+{
+  name = "ejabberd";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ];
+  };
+  nodes = {
+    client =
+      { nodes, pkgs, ... }:
+      {
+        security.pki.certificateFiles = [ "${cert pkgs}/cert.pem" ];
+        networking.extraHosts = ''
+          ${nodes.server.networking.primaryIPAddress} example.com
+        '';
 
-          environment.systemPackages = [
-            (pkgs.callPackage ./xmpp-sendmessage.nix {
-              connectTo = nodes.server.networking.primaryIPAddress;
-            })
-          ];
+        environment.systemPackages = [
+          (pkgs.callPackage ./xmpp-sendmessage.nix {
+            connectTo = nodes.server.networking.primaryIPAddress;
+          })
+        ];
+      };
+    server =
+      { config, pkgs, ... }:
+      {
+        security.pki.certificateFiles = [ "${cert pkgs}/cert.pem" ];
+        networking.extraHosts = ''
+          ${config.networking.primaryIPAddress} example.com
+          ${config.networking.primaryIPAddress} matrix.example.com
+        '';
+
+        services.ejabberd = {
+          enable = true;
+          configFile = "/etc/ejabberd.yml";
         };
-      server =
-        { config, pkgs, ... }:
-        {
-          security.pki.certificateFiles = [ "${cert pkgs}/cert.pem" ];
-          networking.extraHosts = ''
-            ${config.networking.primaryIPAddress} example.com
-            ${config.networking.primaryIPAddress} matrix.example.com
-          '';
 
-          services.ejabberd = {
-            enable = true;
-            configFile = "/etc/ejabberd.yml";
-          };
+        systemd.services.ejabberd.serviceConfig.TimeoutStartSec = "15min";
+        environment.etc."ejabberd.yml" = {
+          user = "ejabberd";
+          mode = "0600";
+          text = ''
+            loglevel: 3
 
-          systemd.services.ejabberd.serviceConfig.TimeoutStartSec = "15min";
-          environment.etc."ejabberd.yml" = {
-            user = "ejabberd";
-            mode = "0600";
-            text = ''
-              loglevel: 3
+            hosts:
+              - "example.com"
 
-              hosts:
-                - "example.com"
+            listen:
+              -
+                port: 5222
+                module: ejabberd_c2s
+                zlib: false
+                max_stanza_size: 65536
+                shaper: c2s_shaper
+                access: c2s
+                starttls: true
+              -
+                port: 5269
+                ip: "::"
+                module: ejabberd_s2s_in
+              -
+                port: 8448
+                module: ejabberd_http
+                tls: true
+                request_handlers:
+                  "/_matrix": mod_matrix_gw
+              -
+                port: 5347
+                ip: "127.0.0.1"
+                module: ejabberd_service
+                access: local
+                shaper: fast
+              -
+                port: 5444
+                module: ejabberd_http
+                request_handlers:
+                  "/upload": mod_http_upload
 
-              listen:
-                -
-                  port: 5222
-                  module: ejabberd_c2s
-                  zlib: false
-                  max_stanza_size: 65536
-                  shaper: c2s_shaper
-                  access: c2s
-                  starttls: true
-                -
-                  port: 5269
-                  ip: "::"
-                  module: ejabberd_s2s_in
-                -
-                  port: 8448
-                  module: ejabberd_http
-                  tls: true
-                  request_handlers:
-                    "/_matrix": mod_matrix_gw
-                -
-                  port: 5347
-                  ip: "127.0.0.1"
-                  module: ejabberd_service
-                  access: local
-                  shaper: fast
-                -
-                  port: 5444
-                  module: ejabberd_http
-                  request_handlers:
-                    "/upload": mod_http_upload
+            certfiles:
+              - ${cert pkgs}/key.pem
+              - ${cert pkgs}/cert.pem
 
-              certfiles:
-                - ${cert pkgs}/key.pem
-                - ${cert pkgs}/cert.pem
+            ## Disabling digest-md5 SASL authentication. digest-md5 requires plain-text
+            ## password storage (see auth_password_format option).
+            disable_sasl_mechanisms: "digest-md5"
 
-              ## Disabling digest-md5 SASL authentication. digest-md5 requires plain-text
-              ## password storage (see auth_password_format option).
-              disable_sasl_mechanisms: "digest-md5"
+            ## Outgoing S2S options
+            ## Preferred address families (which to try first) and connect timeout
+            ## in seconds.
+            outgoing_s2s_families:
+               - ipv4
+               - ipv6
 
-              ## Outgoing S2S options
-              ## Preferred address families (which to try first) and connect timeout
-              ## in seconds.
-              outgoing_s2s_families:
-                 - ipv4
-                 - ipv6
+            ## auth_method: Method used to authenticate the users.
+            ## The default method is the internal.
+            ## If you want to use a different method,
+            ## comment this line and enable the correct ones.
+            auth_method: internal
 
-              ## auth_method: Method used to authenticate the users.
-              ## The default method is the internal.
-              ## If you want to use a different method,
-              ## comment this line and enable the correct ones.
-              auth_method: internal
+            ## Store the plain passwords or hashed for SCRAM:
+            ## auth_password_format: plain
+            auth_password_format: scram
 
-              ## Store the plain passwords or hashed for SCRAM:
-              ## auth_password_format: plain
-              auth_password_format: scram
+            ###'  TRAFFIC SHAPERS
+            shaper:
+              # in B/s
+              normal: 1000000
+              fast: 50000000
 
-              ###'  TRAFFIC SHAPERS
-              shaper:
-                # in B/s
-                normal: 1000000
-                fast: 50000000
+            ## This option specifies the maximum number of elements in the queue
+            ## of the FSM. Refer to the documentation for details.
+            max_fsm_queue: 1000
 
-              ## This option specifies the maximum number of elements in the queue
-              ## of the FSM. Refer to the documentation for details.
-              max_fsm_queue: 1000
+            ###'   ACCESS CONTROL LISTS
+            acl:
+              ## The 'admin' ACL grants administrative privileges to XMPP accounts.
+              ## You can put here as many accounts as you want.
+              admin:
+                 user:
+                   - "root": "example.com"
 
-              ###'   ACCESS CONTROL LISTS
-              acl:
-                ## The 'admin' ACL grants administrative privileges to XMPP accounts.
-                ## You can put here as many accounts as you want.
-                admin:
-                   user:
-                     - "root": "example.com"
+              ## Local users: don't modify this.
+              local:
+                user_regexp: ""
 
-                ## Local users: don't modify this.
-                local:
-                  user_regexp: ""
+              ## Loopback network
+              loopback:
+                ip:
+                  - "127.0.0.0/8"
+                  - "::1/128"
+                  - "::FFFF:127.0.0.1/128"
 
-                ## Loopback network
-                loopback:
-                  ip:
-                    - "127.0.0.0/8"
-                    - "::1/128"
-                    - "::FFFF:127.0.0.1/128"
+            ###'  SHAPER RULES
+            shaper_rules:
+              ## Maximum number of simultaneous sessions allowed for a single user:
+              max_user_sessions: 10
+              ## Maximum number of offline messages that users can have:
+              max_user_offline_messages:
+                - 5000: admin
+                - 1024
+              ## For C2S connections, all users except admins use the "normal" shaper
+              c2s_shaper:
+                - none: admin
+                - normal
+              ## All S2S connections use the "fast" shaper
+              s2s_shaper: fast
 
-              ###'  SHAPER RULES
-              shaper_rules:
-                ## Maximum number of simultaneous sessions allowed for a single user:
-                max_user_sessions: 10
-                ## Maximum number of offline messages that users can have:
-                max_user_offline_messages:
-                  - 5000: admin
-                  - 1024
-                ## For C2S connections, all users except admins use the "normal" shaper
-                c2s_shaper:
-                  - none: admin
-                  - normal
-                ## All S2S connections use the "fast" shaper
-                s2s_shaper: fast
+            ###'  ACCESS RULES
+            access_rules:
+              ## This rule allows access only for local users:
+              local:
+                - allow: local
+              ## Only non-blocked users can use c2s connections:
+              c2s:
+                - deny: blocked
+                - allow
+              ## Only admins can send announcement messages:
+              announce:
+                - allow: admin
+              ## Only admins can use the configuration interface:
+              configure:
+                - allow: admin
+              ## Only accounts of the local ejabberd server can create rooms:
+              muc_create:
+                - allow: local
+              ## Only accounts on the local ejabberd server can create Pubsub nodes:
+              pubsub_createnode:
+                - allow: local
+              ## In-band registration allows registration of any possible username.
+              ## To disable in-band registration, replace 'allow' with 'deny'.
+              register:
+                - allow
+              ## Only allow to register from localhost
+              trusted_network:
+                - allow: loopback
 
-              ###'  ACCESS RULES
-              access_rules:
-                ## This rule allows access only for local users:
-                local:
-                  - allow: local
-                ## Only non-blocked users can use c2s connections:
-                c2s:
-                  - deny: blocked
+            ## ===============
+            ## API PERMISSIONS
+            ## ===============
+            ##
+            ## This section allows you to define who and using what method
+            ## can execute commands offered by ejabberd.
+            ##
+            ## By default "console commands" section allow executing all commands
+            ## issued using ejabberdctl command, and "admin access" section allows
+            ## users in admin acl that connect from 127.0.0.1 to  execute all
+            ## commands except start and stop with any available access method
+            ## (ejabberdctl, http-api, xmlrpc depending what is enabled on server).
+            ##
+            ## If you remove "console commands" there will be one added by
+            ## default allowing executing all commands, but if you just change
+            ## permissions in it, version from config file will be used instead
+            ## of default one.
+            ##
+            api_permissions:
+              "console commands":
+                from:
+                  - ejabberd_ctl
+                who: all
+                what: "*"
+
+            language: "en"
+
+            ###'  MODULES
+            ## Modules enabled in all ejabberd virtual hosts.
+            modules:
+              mod_adhoc: {}
+              mod_announce: # recommends mod_adhoc
+                access: announce
+              mod_blocking: {} # requires mod_privacy
+              mod_caps: {}
+              mod_carboncopy: {}
+              mod_client_state: {}
+              mod_configure: {} # requires mod_adhoc
+              ## mod_delegation: {} # for xep0356
+              mod_disco: {}
+              #mod_irc:
+              #  host: "irc.@HOST@"
+              #  default_encoding: "utf-8"
+              ## mod_bosh: {}
+              ## mod_http_fileserver:
+              ##   docroot: "/var/www"
+              ##   accesslog: "/var/log/ejabberd/access.log"
+              mod_http_upload:
+                thumbnail: false # otherwise needs the identify command from ImageMagick installed
+                put_url: "http://@HOST@:5444/upload"
+              ##   # docroot: "@HOME@/upload"
+              #mod_http_upload_quota:
+              #  max_days: 14
+              mod_last: {}
+              ## XEP-0313: Message Archive Management
+              ## You might want to setup a SQL backend for MAM because the mnesia database is
+              ## limited to 2GB which might be exceeded on large servers
+              mod_mam: {}
+              mod_muc:
+                host: "muc.@HOST@"
+                access:
                   - allow
-                ## Only admins can send announcement messages:
-                announce:
+                access_admin:
                   - allow: admin
-                ## Only admins can use the configuration interface:
-                configure:
-                  - allow: admin
-                ## Only accounts of the local ejabberd server can create rooms:
-                muc_create:
-                  - allow: local
-                ## Only accounts on the local ejabberd server can create Pubsub nodes:
-                pubsub_createnode:
-                  - allow: local
-                ## In-band registration allows registration of any possible username.
-                ## To disable in-band registration, replace 'allow' with 'deny'.
-                register:
-                  - allow
-                ## Only allow to register from localhost
-                trusted_network:
-                  - allow: loopback
-
-              ## ===============
-              ## API PERMISSIONS
-              ## ===============
-              ##
-              ## This section allows you to define who and using what method
-              ## can execute commands offered by ejabberd.
-              ##
-              ## By default "console commands" section allow executing all commands
-              ## issued using ejabberdctl command, and "admin access" section allows
-              ## users in admin acl that connect from 127.0.0.1 to  execute all
-              ## commands except start and stop with any available access method
-              ## (ejabberdctl, http-api, xmlrpc depending what is enabled on server).
-              ##
-              ## If you remove "console commands" there will be one added by
-              ## default allowing executing all commands, but if you just change
-              ## permissions in it, version from config file will be used instead
-              ## of default one.
-              ##
-              api_permissions:
-                "console commands":
-                  from:
-                    - ejabberd_ctl
-                  who: all
-                  what: "*"
-
-              language: "en"
-
-              ###'  MODULES
-              ## Modules enabled in all ejabberd virtual hosts.
-              modules:
-                mod_adhoc: {}
-                mod_announce: # recommends mod_adhoc
-                  access: announce
-                mod_blocking: {} # requires mod_privacy
-                mod_caps: {}
-                mod_carboncopy: {}
-                mod_client_state: {}
-                mod_configure: {} # requires mod_adhoc
-                ## mod_delegation: {} # for xep0356
-                mod_disco: {}
-                #mod_irc:
-                #  host: "irc.@HOST@"
-                #  default_encoding: "utf-8"
-                ## mod_bosh: {}
-                ## mod_http_fileserver:
-                ##   docroot: "/var/www"
-                ##   accesslog: "/var/log/ejabberd/access.log"
-                mod_http_upload:
-                  thumbnail: false # otherwise needs the identify command from ImageMagick installed
-                  put_url: "http://@HOST@:5444/upload"
-                ##   # docroot: "@HOME@/upload"
-                #mod_http_upload_quota:
-                #  max_days: 14
-                mod_last: {}
-                ## XEP-0313: Message Archive Management
-                ## You might want to setup a SQL backend for MAM because the mnesia database is
-                ## limited to 2GB which might be exceeded on large servers
-                mod_mam: {}
-                mod_muc:
-                  host: "muc.@HOST@"
-                  access:
-                    - allow
-                  access_admin:
-                    - allow: admin
-                  access_create: muc_create
-                  access_persistent: muc_create
-                mod_muc_admin: {}
-                mod_muc_log: {}
-                mod_offline:
-                  access_max_user_messages: max_user_offline_messages
-                mod_ping: {}
-                ## mod_pres_counter:
-                ##   count: 5
-                ##   interval: 60
-                mod_privacy: {}
-                mod_private: {}
-                mod_roster:
-                    versioning: true
-                mod_shared_roster: {}
-                mod_stats: {}
-                mod_time: {}
-                mod_vcard:
-                  search: false
-                mod_vcard_xupdate: {}
-                ## Convert all avatars posted by Android clients from WebP to JPEG
-                mod_avatar: {}
-                #  convert:
-                #    webp: jpeg
-                mod_version: {}
-                mod_stream_mgmt: {}
-                ##   The module for S2S dialback (XEP-0220). Please note that you cannot
-                ##   rely solely on dialback if you want to federate with other servers,
-                ##   because a lot of servers have dialback disabled and instead rely on
-                ##   PKIX authentication. Make sure you have proper certificates installed
-                ##   and check your accessibility at https://check.messaging.one/
-                mod_s2s_dialback: {}
-                mod_pubsub:
-                  plugins:
-                    - "pep"
-                mod_push: {}
-                mod_matrix_gw:
-                  key_name: key1
-                  key: MATRIX_SECRET
-            '';
-          };
-
-          systemd.services.ejabberd.serviceConfig.EnvironmentFile = pkgs.writeText "ejabberd.env" ''
-            EJABBERD_MACRO_MATRIX_SECRET=SU4mu/j8b8A1i1EdyxIcKlFlrp+eSRBIlZwGyHP7Mfo=
+                access_create: muc_create
+                access_persistent: muc_create
+              mod_muc_admin: {}
+              mod_muc_log: {}
+              mod_offline:
+                access_max_user_messages: max_user_offline_messages
+              mod_ping: {}
+              ## mod_pres_counter:
+              ##   count: 5
+              ##   interval: 60
+              mod_privacy: {}
+              mod_private: {}
+              mod_roster:
+                  versioning: true
+              mod_shared_roster: {}
+              mod_stats: {}
+              mod_time: {}
+              mod_vcard:
+                search: false
+              mod_vcard_xupdate: {}
+              ## Convert all avatars posted by Android clients from WebP to JPEG
+              mod_avatar: {}
+              #  convert:
+              #    webp: jpeg
+              mod_version: {}
+              mod_stream_mgmt: {}
+              ##   The module for S2S dialback (XEP-0220). Please note that you cannot
+              ##   rely solely on dialback if you want to federate with other servers,
+              ##   because a lot of servers have dialback disabled and instead rely on
+              ##   PKIX authentication. Make sure you have proper certificates installed
+              ##   and check your accessibility at https://check.messaging.one/
+              mod_s2s_dialback: {}
+              mod_pubsub:
+                plugins:
+                  - "pep"
+              mod_push: {}
+              mod_matrix_gw:
+                key_name: key1
+                key: MATRIX_SECRET
           '';
-          networking.firewall.enable = false;
         };
-    };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        ejabberd_prefix = "su ejabberd -s $(which ejabberdctl) "
+        systemd.services.ejabberd.serviceConfig.EnvironmentFile = pkgs.writeText "ejabberd.env" ''
+          EJABBERD_MACRO_MATRIX_SECRET=SU4mu/j8b8A1i1EdyxIcKlFlrp+eSRBIlZwGyHP7Mfo=
+        '';
+        networking.firewall.enable = false;
+      };
+  };
 
-        server.wait_for_unit("ejabberd.service")
+  testScript =
+    { nodes, ... }:
+    ''
+      ejabberd_prefix = "su ejabberd -s $(which ejabberdctl) "
 
-        assert "status: started" in server.succeed(ejabberd_prefix + "status")
+      server.wait_for_unit("ejabberd.service")
 
-        server.succeed("curl https://matrix.example.com:8448/_matrix/key/v2/server")
+      assert "status: started" in server.succeed(ejabberd_prefix + "status")
 
-        server.succeed(
-            ejabberd_prefix + "register azurediamond example.com hunter2",
-            ejabberd_prefix + "register cthon98 example.com nothunter2",
-        )
-        server.fail(ejabberd_prefix + "register asdf wrong.domain")
-        client.succeed("send-message")
-        server.succeed(
-            ejabberd_prefix + "unregister cthon98 example.com",
-            ejabberd_prefix + "unregister azurediamond example.com",
-        )
-      '';
-  }
-)
+      server.succeed("curl https://matrix.example.com:8448/_matrix/key/v2/server")
+
+      server.succeed(
+          ejabberd_prefix + "register azurediamond example.com hunter2",
+          ejabberd_prefix + "register cthon98 example.com nothunter2",
+      )
+      server.fail(ejabberd_prefix + "register asdf wrong.domain")
+      client.succeed("send-message")
+      server.succeed(
+          ejabberd_prefix + "unregister cthon98 example.com",
+          ejabberd_prefix + "unregister azurediamond example.com",
+      )
+    '';
+}
diff --git a/pkgs/applications/editors/android-studio/common.nix b/pkgs/applications/editors/android-studio/common.nix
index 00c4934e6c47..8c837cfdd851 100644
--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@@ -33,6 +33,7 @@
   libdrm,
   libpng,
   libuuid,
+  libsecret,
   libX11,
   libxcb,
   libxkbcommon,
@@ -130,6 +131,7 @@ let
             git
             ps
             usbutils
+            libsecret
           ]
         }" \
         --prefix LD_LIBRARY_PATH : "${
@@ -142,6 +144,7 @@ let
             libXi
             libXrender
             libXtst
+            libsecret
 
             # No crash, but attempted to load at startup
             e2fsprogs
@@ -344,7 +347,6 @@ let
             ."${channel}";
           mainProgram = pname;
           sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
-          position = "pkgs/applications/editors/android-studio/common.nix:303";
         };
       }
       ''
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 244af2428263..5f15e827ef02 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -16,16 +16,16 @@ let
       inherit tiling_wm;
     };
   stableVersion = {
-    version = "2024.3.2.14"; # "Android Studio Meerkat Feature Drop | 2024.3.2"
-    sha256Hash = "sha256-LHtPAJe4Zo2FcYwO0j51vt8QUNPQ2Dwf2UT7H72DyKU=";
+    version = "2024.3.2.15"; # "Android Studio Meerkat Feature Drop | 2024.3.2 Patch 1"
+    sha256Hash = "sha256-L8s8l1/Q4AJEGvdzTLLu9sRZlkNyRDMQvK8moZXOeIE=";
   };
   betaVersion = {
     version = "2024.3.2.13"; # "Android Studio Meerkat Feature Drop | 2024.3.2 RC 4"
     sha256Hash = "sha256-tPRTDFyKGPR1DKuJRBcwjWjNxylS/8Zv/Nd6vBmcujg=";
   };
   latestVersion = {
-    version = "2025.1.1.10"; # "Android Studio Narwhal | 2025.1.1 Canary 10"
-    sha256Hash = "sha256-GKLOlDkA4hSbKeI3Oob3Pmfxq0ji+q2yTK/z2jPV8FU=";
+    version = "2025.1.2.2"; # "Android Studio Narwhal Feature Drop | 2025.1.2 Canary 2"
+    sha256Hash = "sha256-zQ3PK9Fq8iYocSRFsYXNrnJ34QJGUkQoLtSNhFA2Ido=";
   };
 in
 {
diff --git a/pkgs/applications/editors/leo-editor/default.nix b/pkgs/applications/editors/leo-editor/default.nix
index 2672900910ad..d5c9148304a9 100644
--- a/pkgs/applications/editors/leo-editor/default.nix
+++ b/pkgs/applications/editors/leo-editor/default.nix
@@ -10,13 +10,13 @@
 
 mkDerivation rec {
   pname = "leo-editor";
-  version = "6.8.3";
+  version = "6.8.4";
 
   src = fetchFromGitHub {
     owner = "leo-editor";
     repo = "leo-editor";
     rev = version;
-    sha256 = "sha256-nK6JMR4XrxZxvLOAsYjuyHQo/sob+OLSk/8U3zZ/Iyo=";
+    sha256 = "sha256-CSugdfkAMy6VFdNdSGR+iCrK/XhwseoiMQ4mfgu4F/E=";
   };
 
   dontBuild = true;
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index 1ba4130cf7b9..97c7409404b6 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -48,7 +48,7 @@ let
       viAlias ? false,
 
       # additional argument not generated by makeNeovimConfig
-      # it will append "-u <customRc>" to the wrapped arguments
+      # it sets the VIMINIT environment variable to "lua dofile('${customRc}')"
       # set to false if you want to control where to save the generated config
       # (e.g., in ~/.config/init.vim or project/.nvimrc)
       wrapRc ? true,
@@ -193,8 +193,9 @@ let
             "${placeholder "out"}/rplugin.vim"
           ]
           ++ lib.optionals finalAttrs.wrapRc [
-            "--add-flags"
-            "-u ${writeText "init.lua" rcContent}"
+            "--set-default"
+            "VIMINIT"
+            "lua dofile('${writeText "init.lua" rcContent}')"
           ]
           ++ finalAttrs.generatedWrapperArgs;
 
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index ef7513b15f35..836b7de7dfc2 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -5282,6 +5282,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  gh-nvim = buildVimPlugin {
+    pname = "gh.nvim";
+    version = "0-unstable-2025-01-21";
+    src = fetchFromGitHub {
+      owner = "ldelossa";
+      repo = "gh.nvim";
+      rev = "6f367b2ab8f9d4a0a23df2b703a3f91137618387";
+      hash = "sha256-XI4FVjajin0NM+OaEN+O5vmalPpOB2RII+aOERSzjJA=";
+    };
+    meta.description = "Fully featured GitHub integration for performing code reviews in Neovim";
+    meta.homepage = "https://github.com/ldelossa/gh.nvim";
+  };
+
   git-blame-nvim = buildVimPlugin {
     pname = "git-blame.nvim";
     version = "2025-04-12";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 8a3339845d59..3a1ea038d4d8 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1278,6 +1278,10 @@ in
     configurePhase = "cd plugins/nvim";
   };
 
+  gh-nvim = super.gh-nvim.overrideAttrs {
+    dependencies = [ self.litee-nvim ];
+  };
+
   gitlinker-nvim = super.gitlinker-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 432b80653cf7..b64aa114eb05 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -403,6 +403,7 @@ https://github.com/David-Kunz/gen.nvim/,HEAD,
 https://github.com/jsfaint/gen_tags.vim/,,
 https://github.com/gentoo/gentoo-syntax/,,
 https://github.com/ndmitchell/ghcid/,,
+https://github.com/ldelossa/gh.nvim/,,
 https://github.com/eagletmt/ghcmod-vim/,,
 https://github.com/f-person/git-blame.nvim/,,
 https://github.com/akinsho/git-conflict.nvim/,HEAD,
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 9448bc408906..9d8ad86b2c16 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -89,8 +89,8 @@ let
         mktplcRef = {
           publisher = "42Crunch";
           name = "vscode-openapi";
-          version = "4.33.2";
-          hash = "sha256-agCxi2UhJitdQmHIf6rK7WexkfljUQdqK5rLqzV4J6o=";
+          version = "4.34.0";
+          hash = "sha256-iGVXWKa7xX4WrUeta8ofsXWHQSlxpv8289R9iFdPaII=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/42Crunch.vscode-openapi/changelog";
@@ -411,8 +411,8 @@ let
         mktplcRef = {
           name = "vscode-neovim";
           publisher = "asvetliakov";
-          version = "1.18.21";
-          hash = "sha256-I5jrp8sGn+M8bJo93jNrx+s4sB0p3sGN4lLLROstkKA=";
+          version = "1.18.22";
+          hash = "sha256-nSRZGRhqRO52dx3QfSJZR5uVNVaxw0mcH/JBFyrUGKA=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/asvetliakov.vscode-neovim/changelog";
@@ -1181,8 +1181,8 @@ let
         mktplcRef = {
           name = "vscode-database-client2";
           publisher = "cweijan";
-          version = "8.3.2";
-          hash = "sha256-cBFc8F8FwP7rSWyRTZqi19MihwHE6xNpb4I4O+4zhWs=";
+          version = "8.3.4";
+          hash = "sha256-rZ/xYe5Ng532XhLCzCtVmcYTDekAaMu3vLnvTagFupE=";
         };
         meta = {
           description = "Database Client For Visual Studio Code";
@@ -2129,8 +2129,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.13.1";
-          hash = "sha256-v+gnZPemEMtyBNxwQf0OOp1QSy1+uWDNH9tBu4HwGDg=";
+          version = "6.17.0";
+          hash = "sha256-4/wGrHFB7yn7WTJq9igOU6XTOQZ1PGZ6kdMBP/IlZqw=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -2975,8 +2975,8 @@ let
         mktplcRef = {
           name = "vscord";
           publisher = "leonardssh";
-          version = "5.2.13";
-          hash = "sha256-Jgm3ekXFLhylX7RM6tdfi+lRLrcl4UQGmRHbr27M59M=";
+          version = "5.3.2";
+          hash = "sha256-kj1D0X6Wj088nwgFlWZkPG+zaHsqb0MapycPIfRWEIk=";
         };
         meta = {
           description = "Highly customizable Discord Rich Presence extension for Visual Studio Code";
@@ -4669,8 +4669,8 @@ let
         mktplcRef = {
           name = "svelte-vscode";
           publisher = "svelte";
-          version = "109.8.0";
-          hash = "sha256-T0pNjjeKKX/T1Oc+zvOHu74H4r4F9Ogk5gDV7z0+D9I=";
+          version = "109.8.1";
+          hash = "sha256-ILZ7YA7LngwpU3U+qsgHPd+oxyqLNGRiKUCFC/OMBAo=";
         };
         meta = {
           changelog = "https://github.com/sveltejs/language-tools/releases";
diff --git a/pkgs/applications/editors/vscode/extensions/ms-pyright.pyright/default.nix b/pkgs/applications/editors/vscode/extensions/ms-pyright.pyright/default.nix
index f2fd32afd155..f1f5d566837e 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-pyright.pyright/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-pyright.pyright/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-pyright";
     name = "pyright";
-    version = "1.1.400";
-    hash = "sha256-Twpsxtr6fUSDgCfMYFJF3asgaKLB/axIvOZRItuFyig=";
+    version = "1.1.401";
+    hash = "sha256-EkuF7GqGH30KSZzJVBJhLso6HkOi2fyzsO+fS8KQvaE=";
   };
 
   meta = {
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
index 0af9a827656f..79664f233539 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix
@@ -15,8 +15,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "python";
     publisher = "ms-python";
-    version = "2025.6.0";
-    hash = "sha256-DtnBFLSQj9y7UiHRhOILuua6c2eeJcFiyMNlIjTor9g=";
+    version = "2025.6.1";
+    hash = "sha256-aCutbmWI68IRqAwztQ9USo996zWL29UO2eAC75b3/IY=";
   };
 
   buildInputs = [ icu ];
diff --git a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
index 530ff6d9706f..0ad4f9cab313 100644
--- a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "RooVeterinaryInc";
     name = "roo-cline";
-    version = "3.17.1";
-    hash = "sha256-gfzn0KulOHUKcG3LNF7+g7VwkDHR4BYsmq730Uuv2ZU=";
+    version = "3.18.3";
+    hash = "sha256-kg4kXO7UwDQPXb6CAysaez2v8FPRMbX+f41vE68V0QA=";
   };
 
   passthru.updateScript = vscode-extension-update-script { };
diff --git a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
index 1ed6ad4f5301..09a90db17d1c 100644
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.16.1";
-    hash = "sha256-o8sU4daSeaq6x24mGcBW84Z0SwLu76hZWA9ihlYlT1w=";
+    version = "3.17.7";
+    hash = "sha256-Sn3yyt1xMYYvUQKrY0YliCKS46g5VfvFZPgeSoc1c8E=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
index 7dc31a0a0e86..ec7e3909c091 100644
--- a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
+++ b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "pcsx-rearmed";
-  version = "0-unstable-2025-04-13";
+  version = "0-unstable-2025-05-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "pcsx_rearmed";
-    rev = "febf2246848efb8937ab24c562bba20107bb46f0";
-    hash = "sha256-1mnPYr5A6KmZXXbvkE9XkZiCjx/y0Y9/Ed34LQHDbvE=";
+    rev = "6365a756c02d25c76bf90c78e42316b46f876c49";
+    hash = "sha256-7bL+3+AfbN9FBhMaF8FzZhGZ0OgKGCT+M/5KVYd9Tt0=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/emulators/libretro/cores/stella.nix b/pkgs/applications/emulators/libretro/cores/stella.nix
index 485f488307a5..96e5b6afdad9 100644
--- a/pkgs/applications/emulators/libretro/cores/stella.nix
+++ b/pkgs/applications/emulators/libretro/cores/stella.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "stella";
-  version = "0-unstable-2025-05-17";
+  version = "0-unstable-2025-05-21";
 
   src = fetchFromGitHub {
     owner = "stella-emu";
     repo = "stella";
-    rev = "8421af89314bbdcf118d4b3884a9f566e4b1020e";
-    hash = "sha256-uffcz8TXb0vEivOEcnL288YT8rspSOGcNdXtGijXX1g=";
+    rev = "3d3f223a17fe065c7dee1ff440f0309eb8583009";
+    hash = "sha256-RR6/zRqFUctWc+Rrbm+4Twk6GZwpPgYHgFP65sL6UN8=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/misc/keystore-explorer/default.nix b/pkgs/applications/misc/keystore-explorer/default.nix
index aa37f5cfe689..7aa4aa62910f 100644
--- a/pkgs/applications/misc/keystore-explorer/default.nix
+++ b/pkgs/applications/misc/keystore-explorer/default.nix
@@ -9,13 +9,13 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "5.5.3";
+  version = "5.6.0";
   pname = "keystore-explorer";
   src = fetchzip {
     url = "https://github.com/kaikramer/keystore-explorer/releases/download/v${version}/kse-${
       lib.replaceStrings [ "." ] [ "" ] version
     }.zip";
-    sha256 = "sha256-oShVfmien4HMpAfSa9rPr18wLu7RN8ZWEZEUtiBHyBs=";
+    sha256 = "sha256-+ZgALJaZodLmAtdCIE1SG6D0lzlETg4mMPXheXmGhPc=";
   };
 
   # glib is necessary so file dialogs don't hang.
diff --git a/pkgs/applications/misc/maliit-keyboard/default.nix b/pkgs/applications/misc/maliit-keyboard/default.nix
index dd7d60049c46..d3522e47e16a 100644
--- a/pkgs/applications/misc/maliit-keyboard/default.nix
+++ b/pkgs/applications/misc/maliit-keyboard/default.nix
@@ -8,7 +8,6 @@
   libchewing,
   libpinyin,
   maliit-framework,
-  pcre,
   presage,
   qtfeedback,
   qtmultimedia,
@@ -42,7 +41,6 @@ mkDerivation rec {
     libchewing
     libpinyin
     maliit-framework
-    pcre
     presage
     qtfeedback
     qtmultimedia
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index fe3e5e28cef3..031ac6d70db7 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -565,6 +565,32 @@ let
         # preventing compilations of chromium with versions below their intended version, not about running the very
         # exact version or even running a newer version.
         ./patches/chromium-136-nodejs-assert-minimal-version-instead-of-exact-match.patch
+      ]
+      ++ lib.optionals (chromiumVersionAtLeast "137") [
+        (fetchpatch {
+          # Partial revert of upstream clang+llvm bump revert to fix the following error when building with LLVM < 21:
+          #  clang++: error: unknown argument: '-fextend-variable-liveness=none'
+          # https://chromium-review.googlesource.com/c/chromium/src/+/6514242
+          name = "chromium-137-llvm-19.patch";
+          url = "https://chromium.googlesource.com/chromium/src/+/ddf8f8a465be2779bd826db57f1299ccd2f3aa25^!?format=TEXT";
+          includes = [ "build/config/compiler/BUILD.gn" ];
+          revert = true;
+          decode = "base64 -d";
+          hash = "sha256-wAR8E4WKMvdkW8DzdKpyNpp4dynIsYAbnJ2MqE8V2o8=";
+        })
+      ]
+      ++ lib.optionals (chromiumVersionAtLeast "137") [
+        (fetchpatch {
+          # Backport "Fix build with system libpng" that fixes a typo in core/fxcodec/png/png_decoder.cpp that causes
+          # the build to fail at the final linking step.
+          # https://pdfium-review.googlesource.com/c/pdfium/+/132130
+          name = "pdfium-Fix-build-with-system-libpng.patch";
+          url = "https://pdfium.googlesource.com/pdfium.git/+/83f11d630aa1cb6d5ceb292364412f7b0585a201^!?format=TEXT";
+          extraPrefix = "third_party/pdfium/";
+          stripLen = 1;
+          decode = "base64 -d";
+          hash = "sha256-lDX0OLdxxTNLtViqEt0luJQ/H0mlvQfV0zbY1Ubqyq0=";
+        })
       ];
 
     postPatch =
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 64a68d26f105..f499bdc271af 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,27 +1,27 @@
 {
   "chromium": {
-    "version": "136.0.7103.113",
+    "version": "137.0.7151.55",
     "chromedriver": {
-      "version": "136.0.7103.114",
-      "hash_darwin": "sha256-RAWarx2vOh23XKvhNwAkCgG9swGxX1dw8LaqIQBPJFo=",
-      "hash_darwin_aarch64": "sha256-TZcO5RiRW0dN0+jBArclBkIvYSSirhmPgJXswfTufgk="
+      "version": "137.0.7151.56",
+      "hash_darwin": "sha256-z4GTPrONaXARP0d8vInJdFxR052PuuI6IJy1PEv2RNg=",
+      "hash_darwin_aarch64": "sha256-wlSDfCiBTdLWwabpHwOiM8Y3asn7ueHGSMh2AANaE+A="
     },
     "deps": {
       "depot_tools": {
-        "rev": "f40ddcd8d51626fb7be3ab3c418b3f3be801623f",
-        "hash": "sha256-O9vVbrCqHD4w39Q8ZAxl1RwzJxbH/thjqacMtCnOPdg="
+        "rev": "1fcc527019d786502b02f71b8b764ee674a40953",
+        "hash": "sha256-7HJyJARZPes5MmKgXd3TV1uRjk0bH/pkPm+F4scg+Tc="
       },
       "gn": {
-        "rev": "6e8e0d6d4a151ab2ed9b4a35366e630c55888444",
-        "hash": "sha256-vDKMt23RMDI+KX6CmjfeOhRv2haf/mDOuHpWKnlODcg="
+        "rev": "85cc21e94af590a267c1c7a47020d9b420f8a033",
+        "hash": "sha256-+nKP2hBUKIqdNfDz1vGggXSdCuttOt0GwyGUQ3Z1ZHI="
       },
-      "npmHash": "sha256-QRjk9X4rJW3ofizK33R4T1qym1riqcnpBhDF+FfNZLo="
+      "npmHash": "sha256-I6MsfAhrLRmgiRJ13LSejfy2N63C3Oug5tOOXA622j4="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "76fa3c1782406c63308c70b54f228fd39c7aaa71",
-        "hash": "sha256-U6WsxmGf4eFKVBBgppoHIfMlrT34a1oymZETzEhzkQA=",
+        "rev": "254bc711794d7ad269495f3d419a209935b78cad",
+        "hash": "sha256-dB81lgjgVK0qXWgAddB7G4L7rsJpZp+0VsjDKvGugEs=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -31,28 +31,28 @@
       },
       "src/third_party/compiler-rt/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "bc2b30185219a2defe3c8a3b45f95a11386a7f6f",
-        "hash": "sha256-bfDMglQaiExTFwaVBroia+6G+9AHEVy5cQGocaEVOgA="
+        "rev": "d0e4db9fcea15a392aaada986cbe33658afc0454",
+        "hash": "sha256-P/uDeqalafY1S7AqZkL1Pz7Jc+iWrkfiACxEtgTRqdU="
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "449310fe2e37834a7e62972d2a690cade2ef596b",
-        "hash": "sha256-Ypi5fmWdoNA1IZDoKITlkNRITmho8HzVlgjlmtx0Y84="
+        "rev": "9d0cba76be7399399d3a499ff3a52c264db3b104",
+        "hash": "sha256-wpMma142NBqyrSbaReQr5yOYhvQIZ06j6S2EUnXmZ2I="
       },
       "src/third_party/libc++abi/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
-        "rev": "94c5d7a8edc09f0680aee57548c0b5d400c2840d",
-        "hash": "sha256-wMMfj3E2AQJxovoSEIuT2uTyrcGBurS1HrHZOmP36+g="
+        "rev": "f2a7f2987f9dcdf8b04c2d8cd4dcb186641a7c3e",
+        "hash": "sha256-X9cAbyd8ZPSwqOGhPYwIZ6b9E3tVwAuAYZKMgbZQxgk="
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "e2e6f2a67e9420e770b014ce9bba476fa2ab9874",
-        "hash": "sha256-LdRaxPo2i7uMeFxpR7R4o3V+1ycBcygT/D+gklsD0tA="
+        "rev": "81e2cb40a70de2b6978e6d8658891ded9a77f7e3",
+        "hash": "sha256-XdFKn+cGOxA0fHkVMG9UAhCmpML44ocoyHB7XnumX7o="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "97989c1bfa112c81f6499487fedc661dcf6d3b2e",
-        "hash": "sha256-9Ieaxe0PFIIP4RttODd8pTw/zVjQZGZtaYSybwnzTz0="
+        "rev": "cc59264cf9b2ecab0cfc8b51f6f1878372416d36",
+        "hash": "sha256-wQMUL5uAaR8sA1V0FHTZv3jVVaF3NxiHfNnlMq3YImY="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -71,18 +71,18 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "929dd3e6d02aac1f46653d03b2a644e2873a3bbb",
-        "hash": "sha256-lY4P2f90/9JwCpxuBFjim7KygczM8zMDQVUaEYaQjnA="
+        "rev": "e157e12d99cfc729a970b474344673c44e2d2c9c",
+        "hash": "sha256-fowwJbXOR4OIN4+1bJEWv9VP/TLHb9+H1Vt3apVLwkk="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
-        "rev": "5a1675c86821a48f8983842d07f774df28dfb43c",
-        "hash": "sha256-FgeuOsxToA4qx3H76czCPeO/WVtprRkllDMPancw3Ik="
+        "rev": "852a81f0ae3ab350041d2e44d207a42fb0436ae1",
+        "hash": "sha256-3JBBcBg2ep/7LnvMHBWnqAFG+etETArFXZr4Klv30T4="
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "5077431b183c43f10890b865fc9f02a4dcf1dd85",
-        "hash": "sha256-CLvZTBvtTdOpC8eWUTWkb0ITJ5EViPmc6d5O8cTaKY8="
+        "rev": "faec206356fe384c522f34982ae2e92f2f111242",
+        "hash": "sha256-8SuRhYAD3RWMiqD/a8usrRnYKd6prAK5jdwJVXRI+Q0="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -96,8 +96,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "fa40b7c586fd2da9fd7e5c4d893ecb1334553b9e",
-        "hash": "sha256-bIpN9lehrKpJYBKLeo8Szz0/aVe7NU2Eo2NIO5dAZ9w="
+        "rev": "df9c59dcacff7d186d00e3263a1aa68f8059137c",
+        "hash": "sha256-ybi/DwOQ10I+MK9buKpdNcUlFAI9RA3NfyoB3Udpfyo="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -111,8 +111,8 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "b6bb4bab7b4a36bc95566e00cb8f01051089afc3",
-        "hash": "sha256-L2ewIW6C+PTftbbXf+nlWcFD0y4naBNg7FLXMMxiWac="
+        "rev": "dd7e71367795e2dc4d46effda5378f22e9000d16",
+        "hash": "sha256-EZoSoDLFWRR2xkHOKNaNVQvubFp8in0p7/CHN8CFaVI="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
@@ -131,8 +131,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "1cffe7ec763900d104e4df62bc96d93f572157cb",
-        "hash": "sha256-VK+5saAJlZOluMAYKTKwNcnZALsCYkzgVfQHylt3584="
+        "rev": "fbe707f88ccabca01031e47bf165bd9d499878dd",
+        "hash": "sha256-8tmDR3l7eHWUfVRU90Kg76N/moU6Lb5b3FySJOckl8U="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -141,8 +141,8 @@
       },
       "src/third_party/dawn/third_party/dxc": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "206b77577d15fc5798eb7ad52290388539b7146d",
-        "hash": "sha256-WXgiOlqtczrUkXp46Q/GTaYk0LDqebQSFbyWpD299Xw="
+        "rev": "8209d53f0ef0257e5b8c78d22057086403946cca",
+        "hash": "sha256-2yM8Fct7Ru8ZSFr+Qm1Bv52K2/geAwmOpWc/X7yxLQY="
       },
       "src/third_party/dawn/third_party/dxheaders": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -161,8 +161,8 @@
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "5fbd82847521cb2d584773facd56c2eb6a4df180",
-        "hash": "sha256-WTVOc2EVB/DJ4aDeB8XIF/ff6LSeEUMt2Xkvj5Hu4aU="
+        "rev": "3df76734dc695c4d1c51276b5d9eb63078362972",
+        "hash": "sha256-4jCsCt2rcUpUk2xeL3tZx/jTnuJ+COG+xsDtR+sK1oQ="
       },
       "src/third_party/highway/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
@@ -176,13 +176,13 @@
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "a9993612faac4866bc33ca8ff37bfd0659af1c48",
-        "hash": "sha256-fUPl9E2b7RfanH0pZNArIkJ4lnnmCtyk7sCaTArCB70="
+        "rev": "918cf66ed841930fe1554ae8d78974b95e989596",
+        "hash": "sha256-gzcXse/emv9JBMiInUV5KTeyMQ0igUdFpzUJR4vCUu4="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
-        "rev": "657a441e5c1a818d4c10b7bafd431454e6614901",
-        "hash": "sha256-9MePkv10fwyJ0VDWRtvRcbLMAcJzZlziGTPzXJYjVJE="
+        "rev": "232a723f5096ab02d53d87931efa485fa77d3b03",
+        "hash": "sha256-0ynZuxIqBIpNkfD3Y9XdPFQr7HeQcsUO3lhnqvH+k8c="
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
@@ -191,8 +191,8 @@
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "5bda0fdab9d93ec9963e2cd858c7b49ad7fec7d4",
-        "hash": "sha256-xwR9gGE8uU8qFr7GgS3/1JiuTmj1tvcM5CoCfPMdW2M="
+        "rev": "000f47cfa393d7f9557025a252862e2a61a60d44",
+        "hash": "sha256-FIJZE1Qu1MLZA4qxB68k1NjhgSbFTjf57YF85JicVZw="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -216,8 +216,8 @@
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "b73ae6ce38d5dd0b7fe46dbe0a4b5f4bab91c7ea",
-        "hash": "sha256-JNLaK105qDk9DxTqCFyXFfYn46dF+nZIaF5urSVRa0U="
+        "rev": "39ea79a3c132f4e678695c579ea9353d2bd29968",
+        "hash": "sha256-uochXC0AtOw8N/ycyVJdiRw4pibCW2ENrFMT3jtxDSg="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -226,29 +226,34 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "62ab80355a8194e051bd1d93a5c09093c7645a32",
-        "hash": "sha256-pZi6GRu7OGL7jbN4FM2qDsLCsT6cM+RM0a7XtFZVSVE="
+        "rev": "68114875ad35b573034a2ab1f5cdf3dbb0e59468",
+        "hash": "sha256-cGpteAnjGcxJUcrdLRFfQN7ruTEdNvNCbOH6EC+a39s="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "ce46be2573328fa7b0fd1d23c04b63389f298122",
-        "hash": "sha256-Q0kdJdEmh+wbO5oeTp98OHKh9luz8u6PDztGToldZjk="
+        "rev": "d91cc488cd651b00009e5d6c70f222362598bec9",
+        "hash": "sha256-o/sw1P+mZOSb6XIVFivC02hTPu++x+xJy2SRP2I9yGE="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "f40ddcd8d51626fb7be3ab3c418b3f3be801623f",
-        "hash": "sha256-O9vVbrCqHD4w39Q8ZAxl1RwzJxbH/thjqacMtCnOPdg="
+        "rev": "1fcc527019d786502b02f71b8b764ee674a40953",
+        "hash": "sha256-7HJyJARZPes5MmKgXd3TV1uRjk0bH/pkPm+F4scg+Tc="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "4a53cbe7a1270c91ec60903ee792de658453becb",
-        "hash": "sha256-hEksLeJli/1TNNrDcUjv19cpyIJph6kfriNfe7FWO0U="
+        "rev": "a54ed1df191a9e2aff2e9ef453ee6fdc959dd125",
+        "hash": "sha256-E6sx2ioDZRWJljbS17ztRwz+gsDhIHiluvkUx1rRZcw="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
         "rev": "199de96b345ada7c6e7e6ba3d2fa7a6911b8767d",
         "hash": "sha256-yuEBD2XQlV3FGI/i7lTmJbCqzeBiuG1Qow8wvsppGJw="
       },
+      "src/third_party/dragonbox/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/jk-jeon/dragonbox.git",
+        "rev": "6c7c925b571d54486b9ffae8d9d18a822801cbda",
+        "hash": "sha256-AOniXMPgwKpkJqivRd+GazEnhdw53FzhxKqG+GdU+cc="
+      },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
         "rev": "464c1d097891a1462ab28bf8bb763c1683883892",
@@ -266,8 +271,8 @@
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "fbce2a76c00cd2e5aeffe3c2e71d44c284ec52d6",
-        "hash": "sha256-bGa0BCvzNxEKu9VZEwJ1NLt+b2KKWUxshpKSN2FHNEM="
+        "rev": "01f23648c6b84de6c0f717fa4e1816f53b9ee72e",
+        "hash": "sha256-hNzQZQxaa2Wtl7GWWF852cFmmXy4pc15Pp0d59TTfnI="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -296,8 +301,8 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "82090e67c24259c343c83fd9cefe6ff0be7a7eca",
-        "hash": "sha256-LhSIX7X0+dmLADYGNclg73kIrXmjTMM++tJ92MKzanA="
+        "rev": "2d1abd3bbb4d2396ed63b3e5accd66724cf62307",
+        "hash": "sha256-MAVHzILj9f+/HfVjZXyJkSQM3WBwzg7IDpAwiYHfA88="
       },
       "src/third_party/freetype-testing/src": {
         "url": "https://chromium.googlesource.com/external/github.com/freetype/freetype2-testing.git",
@@ -311,18 +316,18 @@
       },
       "src/third_party/harfbuzz-ng/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "8efd2d85c78fbba6ca09a3e454f77525f3b296ce",
-        "hash": "sha256-/WNGrvyvJ+FGqoIoHapaux1iu63zjID0yR30HYPpxaw="
+        "rev": "9f83bbbe64654b45ba5bb06927ff36c2e7588495",
+        "hash": "sha256-lNnCtgIegUy4DLhYaGZXcEaFw83KWAHoKpz69AEsWp4="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
-        "rev": "c542d619a8959415beda5a76fe89ffa2f83df886",
-        "hash": "sha256-sMqSHYs3lvuHXEov1K9xWRd8tUPG00QBJl6an0zrxwA="
+        "rev": "da9cb551ada1e55309b0ac89b9fbff2d29dbfe1e",
+        "hash": "sha256-MqJXwtUGL/IakwOO63JX4gx0gTocgQT3hbhw6OcYUbc="
       },
       "src/third_party/ink_stroke_modeler/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink-stroke-modeler.git",
-        "rev": "f61f28792a00c9bdcb3489fec81d8fd0ca1cbaba",
-        "hash": "sha256-XMLW/m+Qx+RVgo1DeYggBLjUYg/M+2eHwgjVWrA/Erw="
+        "rev": "03db1ed37b8b10b47d62ed0fa142d198a3861689",
+        "hash": "sha256-jnIljheEBq96e6zZO87bhVJbA1vIjiRzm1Hh6YMBdnU="
       },
       "src/third_party/instrumented_libs": {
         "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git",
@@ -346,8 +351,8 @@
       },
       "src/third_party/googletest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git",
-        "rev": "52204f78f94d7512df1f0f3bea1d47437a2c3a58",
-        "hash": "sha256-8keF4E6ag/rikv5ROaWUB7oganjViupEAdxW1NJVgmE="
+        "rev": "cd430b47a54841ec45d64d2377d7cabaf0eba610",
+        "hash": "sha256-QT9PQ9bF+eCPfRLkcHpH4jc0UZfGPc98fHf8QDV5bZg="
       },
       "src/third_party/hunspell_dictionaries": {
         "url": "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries.git",
@@ -356,8 +361,8 @@
       },
       "src/third_party/icu": {
         "url": "https://chromium.googlesource.com/chromium/deps/icu.git",
-        "rev": "c9fb4b3a6fb54aa8c20a03bbcaa0a4a985ffd34b",
-        "hash": "sha256-Omv4sp9z44eINXtaE0+1TzIU1q2hWviANA79fmkF78U="
+        "rev": "4c8cc4b365a505ce35be1e0bd488476c5f79805d",
+        "hash": "sha256-eGI/6wk6IOUPvX7pRTm4VJk1CqkkxalTu84L36i/D6k="
       },
       "src/third_party/jsoncpp/source": {
         "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git",
@@ -376,8 +381,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "c31f0c0e6df5725c6b03124b579c9cf815fd10f4",
-        "hash": "sha256-Dz7DqucOxr5HzLNOdGNOG4iMw66bkOj64qOvqeADTic="
+        "rev": "b10387fdbbca18192f85eaa5323a59f44bf9c468",
+        "hash": "sha256-L2QG0pUmGjGdtdlivxYfxSqO9YaVHpIT6lvJwBMTxMw="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -391,8 +396,8 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "9680f2b1781fb33b9eeb52409b75c679c8a954be",
-        "hash": "sha256-nfnt5JXyKR9JR3BflpGEkwzDo0lYa/oeCDm2bKH/j1g="
+        "rev": "719f60edc51b6141a2434bf1b5110c2fb075b246",
+        "hash": "sha256-W62uXVbQiq6Ef3bar2NsCXJoz5KKUK8Y/9n2vK7Vf3Q="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
@@ -401,13 +406,8 @@
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
-        "rev": "8acf9249344ea9ff9806d0d7f46e07640fddf550",
-        "hash": "sha256-qIIyCHay3vkE14GVCq77psm1OyuEYs4guAaQDlEwiMg="
-      },
-      "src/third_party/beto-core/src": {
-        "url": "https://beto-core.googlesource.com/beto-core.git",
-        "rev": "89563fec14c756482afa08b016eeba9087c8d1e3",
-        "hash": "sha256-QPFGjtu/I0r4+dTQ2eSlWIEYwJ43B3yW0q4QtVFTVGY="
+        "rev": "e71de0e0c312caf8d2fa22f132619c6a68496444",
+        "hash": "sha256-dzJtRhoPA1FWeu0xjd7kJ1Q2nT5gIkKpIgQmywsRlPY="
       },
       "src/third_party/securemessage/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/securemessage.git",
@@ -416,8 +416,8 @@
       },
       "src/third_party/jetstream/main": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
-        "rev": "0260caf74b5c115507ee0adb6d9cdf6aefb0965f",
-        "hash": "sha256-DbRup4tOAYv27plzB2JKi2DBX2FVMDtFR7AzuovXUDU="
+        "rev": "0976ddeae0863ef5fb3f9ad09906224b0989f9ad",
+        "hash": "sha256-NyXGd7SwsECGBJ2qodGYB3os+UBgIOg/I8mnrsZJuTg="
       },
       "src/third_party/jetstream/v2.2": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
@@ -426,8 +426,8 @@
       },
       "src/third_party/speedometer/main": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
-        "rev": "c760d160caa05792d3ed7650e85861c9f9462506",
-        "hash": "sha256-/nAK2uLjpPem37XCHHx3LGZEpvL/7w4Uw5bVpQ4C6ms="
+        "rev": "dd661c033abdde11022779f40375c52632a9f43a",
+        "hash": "sha256-1/G06WCO5ssBS3+T6E3rnGdIf0r205wVxfJX7lgivR4="
       },
       "src/third_party/speedometer/v3.1": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
@@ -466,8 +466,8 @@
       },
       "src/third_party/expat/src": {
         "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git",
-        "rev": "624da0f593bb8d7e146b9f42b06d8e6c80d032a3",
-        "hash": "sha256-Iwu9+i/0vsPyu6pOWFxjNNblVxMl6bTPW5eWyaju4Mg="
+        "rev": "69d6c054c1bd5258c2a13405a7f5628c72c177c2",
+        "hash": "sha256-qe8O7otL6YcDDBx2DS/+c5mWIS8Rf8RQXVtLFMIAeyk="
       },
       "src/third_party/libipp/libipp": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git",
@@ -511,8 +511,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "027bbee30a0103b99d86327b48d29567fed11688",
-        "hash": "sha256-+4I6B1aTa+txhey6LMeflU0pe39V6TJ+lNIJPh6yFGM="
+        "rev": "40ec928b3fadcf8edd836445bb5842a11aeb7a2d",
+        "hash": "sha256-aUHvIv78KTiyN/cOYNuhW4UCOD55s8l8VLu4oP0Pk1s="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -526,8 +526,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "ccdf870348764e4b77fa3b56accb2a896a901bad",
-        "hash": "sha256-8sH11psWPXLMy3Q0tAizCZ/woUWvTCCUf44jcr2C4Xs="
+        "rev": "9f9b5cf660dcfa0d3fdee41cf4ffbe4bb6e95114",
+        "hash": "sha256-OYmsMPz7nJwkVSpsDW7SbqrCU5raC1k3Mh/UkonCujM="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -546,8 +546,8 @@
       },
       "src/third_party/nasm": {
         "url": "https://chromium.googlesource.com/chromium/deps/nasm.git",
-        "rev": "767a169c8811b090df222a458b25dfa137fc637e",
-        "hash": "sha256-yg4qwhS68B/sWfcJeXUqPC69ppE8FaIyRc+IkUQXSnU="
+        "rev": "9f916e90e6fc34ec302573f6ce147e43e33d68ca",
+        "hash": "sha256-neYrS4kQ76ihUh22Q3uPR67Ld8+yerA922YSZU1KxJs="
       },
       "src/third_party/neon_2_sse/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git",
@@ -561,8 +561,8 @@
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "db9e1ea566813606ca055868be13f6ff4a760ab8",
-        "hash": "sha256-K/frmCf3JMvPVZc6ZKPFAQrq4Pz4io3XBvADS0O5u78="
+        "rev": "40fe10467c27b6536e5d3241e5881b6e9f243216",
+        "hash": "sha256-fKXCuGzNVcN8l/2VNR5c9lwUjmSDb7MuEAVF5h8VXQU="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@@ -576,13 +576,13 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "ca83e69429af8f0bfa34b22dc54f538b9eebf5c5",
-        "hash": "sha256-6gsur+fx546YJn/PUOOthuj+XrSIruVUeAYl4nRI6xM="
+        "rev": "c82c611f105c0df064cc8c76363578caf9eafb75",
+        "hash": "sha256-kcrWcvbbGgQTfGypJ2EaLunYtSipJJRAin2jHunZoCU="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "054635b91453895720951f7329619d003a98b3e4",
-        "hash": "sha256-2jKRhHLitR0m2a4/asvVvTqAOhUlyLsBBSjpQAer4GA="
+        "rev": "f35ae1939989c58c29df43f9c2d8610f5b932715",
+        "hash": "sha256-SyYTZnNar6F6/k6PGrkRan3l9hAikEVRciDQQaR7Jvs="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -591,8 +591,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "4e1831c02c74334a35ead03362f3342b6cea2a86",
-        "hash": "sha256-mB1QaAuY8vfv8FasPyio1AF75iYH+dM8t1GIr0Ty/+g="
+        "rev": "290ee6fff0c36614702d6b297c148e3fa08e056a",
+        "hash": "sha256-jRHF7vZPmh70jNFVukfWzVnA2dBLSDSnMWVyZ9e08n4="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -621,13 +621,13 @@
       },
       "src/third_party/search_engines_data/resources": {
         "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "07834ba1e5ebfb333d0b73556b7c4d62a53cb455",
-        "hash": "sha256-DTz351NpoygQLESm/z+fzFc/KGJyQelLnWpzNMmNT9o="
+        "rev": "be408bdc2c1501ef25206145a49dcebb98db34b5",
+        "hash": "sha256-XlAE782PsEysPVIBM/Q8VdE9XnvoYUVaeMmUUoYFgvM="
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "bcce46ca33b67cc302dd53927a63013b8f53bf73",
-        "hash": "sha256-ei95CJRfNPrsYt8XcDi7Pnl5dGiJu3qs7R4rAcZ24Uc="
+        "rev": "0dfd95a49aed617f242c8b06dd5b255d1cb07776",
+        "hash": "sha256-HBqkqEoyQo3KuRCwP5NW9kuY9maaBYSpjA1lcBdFjxk="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -646,8 +646,8 @@
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "4982425ff1bdcb2ce52a360edde58a379119bfde",
-        "hash": "sha256-QTGU9Dgc6rgMeFZvhZyYeYj5W+ClJO8Yfa4+K7TmEec="
+        "rev": "7905fa19e456df5aa8e2233a7ec5832c9c6c287b",
+        "hash": "sha256-Wi8mttxM1fuLqrL2q6qPnpmyAfmDqJGA8Wub+yexFLA="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -656,18 +656,18 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "c8ed430d092acd485f00e7a9d7a888a0857d0430",
-        "hash": "sha256-S5zkpQZdhRdnZRUrUfi5FCrF2XFe3y/adAWwfh1OQYE="
+        "rev": "42d6877b1aa1cf324eb03ccf9b13511400341deb",
+        "hash": "sha256-KummGT7CUoGd3lCGXvtSFcFD1FhSlJXDcEi1WKUza70="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "1648e664337ca19a4f8679cbb9547a5b4b926995",
-        "hash": "sha256-CI0X6zbRV/snGcQZOUKQFn8Zo6D6Out6nN027HGZaa8="
+        "rev": "96793fb0ff6fb5d4328cc6f71d84f5cb2d835daf",
+        "hash": "sha256-rAtsw8JV8EwrNzjK5p7JbWQa6fHfpByvZcP71hHC8uM="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "e57f993cff981c8c3ffd38967e030f04d13781a9",
-        "hash": "sha256-nr7pGPNPMbmL/XnL27M4m5in8qnCDcpNtVsxBAc7zms="
+        "rev": "fc9889c889561c5882e83819dcaffef5ed45529b",
+        "hash": "sha256-HwFP4KJuA+BMQVvBWV0BCRj9U5I3CLEU+5bBtde2f6w="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -676,38 +676,38 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "8c88e0c4c94a21de825efccba5f99a862b049825",
-        "hash": "sha256-s0Pe7kg5syKhK8qEZH8b7UCDa87Xk32Lh95cQbpLdAc="
+        "rev": "bab63ff679c41eb75fc67dac76e1dc44426101e1",
+        "hash": "sha256-hi4vCwdCnwuYodUYq75niCZt2t9lERQH6529/R+7nH8="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "2e83ad7e6f2cc51f7eaff3ffeb10e34351b3c157",
-        "hash": "sha256-u4WDbWywua71yWB1cVIt1IDZRe4NnT5bUq3yHLKBgPo="
+        "rev": "8e9165a3d162967a424dcf2ff645a98b50381cce",
+        "hash": "sha256-GsoaeO3FMzMtMStg1Wp0KUHU3Xxmmr7t3lDyu0ervNk="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "78c359741d855213e8685278eb81bb62599f8e56",
-        "hash": "sha256-VqKQeJd81feSgYnYLqb2sYirCmnHN9Rr19/4cPZ2TzE="
+        "rev": "e2e53a724677f6eba8ff0ce1ccb64ee321785cbd",
+        "hash": "sha256-lIuJ50zi9UIMrP/FePI8jHFhJ5LsKhthDY4gIHeZNpo="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "723d6b4aa35853315c6e021ec86388b3a2559fae",
-        "hash": "sha256-tDW5ed6gsDKlCKf4gT8MNi1yaafocUTohL1upGKB+Cc="
+        "rev": "fb78607414e154c7a5c01b23177ba719c8a44909",
+        "hash": "sha256-CeIjyW90Ri0MvhyFfYgss5Rjh5fHKhQf7CgBEcB/nPk="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "289efccc7560f2b970e2b4e0f50349da87669311",
-        "hash": "sha256-Cw7LWBPRbDVlfmeMM4CYEC9xbfqT1wV7yuUcpGMLahs="
+        "rev": "0b8196724e4ad28cc7459b82a9b75f252c08cb3e",
+        "hash": "sha256-oL4lyUH26eO6eJy7EQmuXdt4oy3eQ65fribfMSOZV+8="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "0d5b49b80f17bca25e7f9321ad4e671a56f70887",
-        "hash": "sha256-NdvjtdCrNVKY23B4YDL33KB+/9HsSWTVolZJOto8+pc="
+        "rev": "4e246c56ec5afb5ad66b9b04374d39ac04675c8e",
+        "hash": "sha256-MmC4UVa9P/0h7r8IBp1LhP9EztwyZv/ASWKKj8Gk1T8="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "73d7d74bc979c8a16c823c4eae4ee881153e000a",
-        "hash": "sha256-2GII+RBRzPZTTib82srUEFDG+CbtPTZ6lX3oDJBC2gU="
+        "rev": "cea6ec1cdd37494c1f0fc5619c6c356ac33372fb",
+        "hash": "sha256-iXQZ6Qpe0li+QeThxMUCn45OufZ8W/qJcejpMb4/gWc="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -716,8 +716,8 @@
       },
       "src/third_party/wasm_tts_engine/src": {
         "url": "https://chromium.googlesource.com/chromium/wasm-tts-engine",
-        "rev": "53d2aba6f0cf7db57e17edfc3ff6471871b0c125",
-        "hash": "sha256-t5eeehwspRLaowEMPLa8/lV5AHamXQBfH/un0DHLVAM="
+        "rev": "352880bb49e2410707543c252ef6b94a21b0f47f",
+        "hash": "sha256-TFkniS4XvP0RlPnI1lv4RxxSY44RUuwCMKmmybENEBw="
       },
       "src/third_party/wayland/src": {
         "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git",
@@ -751,8 +751,8 @@
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "92f4eb4dae0f5439f2cdc7ce467d66b10e165f42",
-        "hash": "sha256-vXyp0+6eyKOzzQbkRa8f8dO+B9cyUCY2hCZEFc7+7lU="
+        "rev": "168536ad91bff176bbe31ae692d97f8bfe9fb86d",
+        "hash": "sha256-HB16HM4Gj+2F26tyN393VmHbGxvKOZ+M949059odN/4="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
@@ -761,8 +761,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "2c8f5be6924d507ee74191b1aeadcec07f747f21",
-        "hash": "sha256-cNONf88oSbsdYuSdPiLxgTI973qOP6fb1OKb2WMQMMg="
+        "rev": "cec4daea7ed5da94fc38d790bd12694c86865447",
+        "hash": "sha256-mxRckkiBIpQp2Qxj6fcer3jDftp3wlg+aO4BoUHhyiY="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -771,8 +771,8 @@
       },
       "src/third_party/weston/src": {
         "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/weston.git",
-        "rev": "ccf29cb237c3ed09c5f370f35239c93d07abfdd7",
-        "hash": "sha256-y2srFaPUOoB2umzpo4+hFfhNlqXM2AoMGOpUy/ZSacg="
+        "rev": "4eb10b123b483327214d8da5da67e8bbeeaed8fe",
+        "hash": "sha256-VNHUAtfTB24SIf2kl+MMXF3rG5cJOPM93WU/sVSIQ1A="
       },
       "src/third_party/xdg-utils": {
         "url": "https://chromium.googlesource.com/chromium/deps/xdg-utils.git",
@@ -781,43 +781,43 @@
       },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "d6fc3be20b0d3e3742157fa26c5359babaa8bc8b",
-        "hash": "sha256-p5DjGNH9IR0KPWSFmbsdt2PU+kHgWRAnBw7J9sLV/S8="
+        "rev": "474d7e58d4b8f4bd1a98ee74bc57858769f7d925",
+        "hash": "sha256-UO+nOh7R+3xTSxF2u8dIrv7qn/QmhnDr2J5Ciumj93M="
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "ef2bf5781112a4cd6b62ac1817f7842bbdc7ea8f",
-        "hash": "sha256-hDDNrUXGxG/o1oZnypAnuLyIeM16Hy6x1KacGu9Hhmw="
+        "rev": "d654fca78690fa15cceb8058ac47454d914a0e63",
+        "hash": "sha256-Ginvak0y1CjURT3mQZzdLn3MW9vXxC7T0KLsM6SHDV0="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "5297e56d91816747d539abca52b578e5832135f0",
-        "hash": "sha256-Fi4pl6xSXkHF4XaQNfNzULVjQZSzDfaHFIyIxH103go="
+        "rev": "44fdd9108308773dd3f4fa040de5f4f75edf671f",
+        "hash": "sha256-BkLOmb97p2NcAIuQiDjIoVAe49h9iv79rC5G8wyD1as="
       }
     }
   },
   "ungoogled-chromium": {
-    "version": "136.0.7103.113",
+    "version": "137.0.7151.55",
     "deps": {
       "depot_tools": {
-        "rev": "f40ddcd8d51626fb7be3ab3c418b3f3be801623f",
-        "hash": "sha256-O9vVbrCqHD4w39Q8ZAxl1RwzJxbH/thjqacMtCnOPdg="
+        "rev": "1fcc527019d786502b02f71b8b764ee674a40953",
+        "hash": "sha256-7HJyJARZPes5MmKgXd3TV1uRjk0bH/pkPm+F4scg+Tc="
       },
       "gn": {
-        "rev": "6e8e0d6d4a151ab2ed9b4a35366e630c55888444",
-        "hash": "sha256-vDKMt23RMDI+KX6CmjfeOhRv2haf/mDOuHpWKnlODcg="
+        "rev": "85cc21e94af590a267c1c7a47020d9b420f8a033",
+        "hash": "sha256-+nKP2hBUKIqdNfDz1vGggXSdCuttOt0GwyGUQ3Z1ZHI="
       },
       "ungoogled-patches": {
-        "rev": "136.0.7103.113-1",
-        "hash": "sha256-+xQvBkwza1QLwWgijoMnih2k2v0I7cBiAjxOeqMf6A0="
+        "rev": "137.0.7151.55-1",
+        "hash": "sha256-m8un3k5gz8nqQIvulvV2yhY/TQZ7wcp1zwQmtqjbCEw="
       },
-      "npmHash": "sha256-QRjk9X4rJW3ofizK33R4T1qym1riqcnpBhDF+FfNZLo="
+      "npmHash": "sha256-I6MsfAhrLRmgiRJ13LSejfy2N63C3Oug5tOOXA622j4="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "76fa3c1782406c63308c70b54f228fd39c7aaa71",
-        "hash": "sha256-U6WsxmGf4eFKVBBgppoHIfMlrT34a1oymZETzEhzkQA=",
+        "rev": "254bc711794d7ad269495f3d419a209935b78cad",
+        "hash": "sha256-dB81lgjgVK0qXWgAddB7G4L7rsJpZp+0VsjDKvGugEs=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -827,28 +827,28 @@
       },
       "src/third_party/compiler-rt/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "bc2b30185219a2defe3c8a3b45f95a11386a7f6f",
-        "hash": "sha256-bfDMglQaiExTFwaVBroia+6G+9AHEVy5cQGocaEVOgA="
+        "rev": "d0e4db9fcea15a392aaada986cbe33658afc0454",
+        "hash": "sha256-P/uDeqalafY1S7AqZkL1Pz7Jc+iWrkfiACxEtgTRqdU="
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "449310fe2e37834a7e62972d2a690cade2ef596b",
-        "hash": "sha256-Ypi5fmWdoNA1IZDoKITlkNRITmho8HzVlgjlmtx0Y84="
+        "rev": "9d0cba76be7399399d3a499ff3a52c264db3b104",
+        "hash": "sha256-wpMma142NBqyrSbaReQr5yOYhvQIZ06j6S2EUnXmZ2I="
       },
       "src/third_party/libc++abi/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
-        "rev": "94c5d7a8edc09f0680aee57548c0b5d400c2840d",
-        "hash": "sha256-wMMfj3E2AQJxovoSEIuT2uTyrcGBurS1HrHZOmP36+g="
+        "rev": "f2a7f2987f9dcdf8b04c2d8cd4dcb186641a7c3e",
+        "hash": "sha256-X9cAbyd8ZPSwqOGhPYwIZ6b9E3tVwAuAYZKMgbZQxgk="
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "e2e6f2a67e9420e770b014ce9bba476fa2ab9874",
-        "hash": "sha256-LdRaxPo2i7uMeFxpR7R4o3V+1ycBcygT/D+gklsD0tA="
+        "rev": "81e2cb40a70de2b6978e6d8658891ded9a77f7e3",
+        "hash": "sha256-XdFKn+cGOxA0fHkVMG9UAhCmpML44ocoyHB7XnumX7o="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "97989c1bfa112c81f6499487fedc661dcf6d3b2e",
-        "hash": "sha256-9Ieaxe0PFIIP4RttODd8pTw/zVjQZGZtaYSybwnzTz0="
+        "rev": "cc59264cf9b2ecab0cfc8b51f6f1878372416d36",
+        "hash": "sha256-wQMUL5uAaR8sA1V0FHTZv3jVVaF3NxiHfNnlMq3YImY="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -867,18 +867,18 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "929dd3e6d02aac1f46653d03b2a644e2873a3bbb",
-        "hash": "sha256-lY4P2f90/9JwCpxuBFjim7KygczM8zMDQVUaEYaQjnA="
+        "rev": "e157e12d99cfc729a970b474344673c44e2d2c9c",
+        "hash": "sha256-fowwJbXOR4OIN4+1bJEWv9VP/TLHb9+H1Vt3apVLwkk="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
-        "rev": "5a1675c86821a48f8983842d07f774df28dfb43c",
-        "hash": "sha256-FgeuOsxToA4qx3H76czCPeO/WVtprRkllDMPancw3Ik="
+        "rev": "852a81f0ae3ab350041d2e44d207a42fb0436ae1",
+        "hash": "sha256-3JBBcBg2ep/7LnvMHBWnqAFG+etETArFXZr4Klv30T4="
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "5077431b183c43f10890b865fc9f02a4dcf1dd85",
-        "hash": "sha256-CLvZTBvtTdOpC8eWUTWkb0ITJ5EViPmc6d5O8cTaKY8="
+        "rev": "faec206356fe384c522f34982ae2e92f2f111242",
+        "hash": "sha256-8SuRhYAD3RWMiqD/a8usrRnYKd6prAK5jdwJVXRI+Q0="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -892,8 +892,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "fa40b7c586fd2da9fd7e5c4d893ecb1334553b9e",
-        "hash": "sha256-bIpN9lehrKpJYBKLeo8Szz0/aVe7NU2Eo2NIO5dAZ9w="
+        "rev": "df9c59dcacff7d186d00e3263a1aa68f8059137c",
+        "hash": "sha256-ybi/DwOQ10I+MK9buKpdNcUlFAI9RA3NfyoB3Udpfyo="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -907,8 +907,8 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "b6bb4bab7b4a36bc95566e00cb8f01051089afc3",
-        "hash": "sha256-L2ewIW6C+PTftbbXf+nlWcFD0y4naBNg7FLXMMxiWac="
+        "rev": "dd7e71367795e2dc4d46effda5378f22e9000d16",
+        "hash": "sha256-EZoSoDLFWRR2xkHOKNaNVQvubFp8in0p7/CHN8CFaVI="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
@@ -927,8 +927,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "1cffe7ec763900d104e4df62bc96d93f572157cb",
-        "hash": "sha256-VK+5saAJlZOluMAYKTKwNcnZALsCYkzgVfQHylt3584="
+        "rev": "fbe707f88ccabca01031e47bf165bd9d499878dd",
+        "hash": "sha256-8tmDR3l7eHWUfVRU90Kg76N/moU6Lb5b3FySJOckl8U="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -937,8 +937,8 @@
       },
       "src/third_party/dawn/third_party/dxc": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "206b77577d15fc5798eb7ad52290388539b7146d",
-        "hash": "sha256-WXgiOlqtczrUkXp46Q/GTaYk0LDqebQSFbyWpD299Xw="
+        "rev": "8209d53f0ef0257e5b8c78d22057086403946cca",
+        "hash": "sha256-2yM8Fct7Ru8ZSFr+Qm1Bv52K2/geAwmOpWc/X7yxLQY="
       },
       "src/third_party/dawn/third_party/dxheaders": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -957,8 +957,8 @@
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "5fbd82847521cb2d584773facd56c2eb6a4df180",
-        "hash": "sha256-WTVOc2EVB/DJ4aDeB8XIF/ff6LSeEUMt2Xkvj5Hu4aU="
+        "rev": "3df76734dc695c4d1c51276b5d9eb63078362972",
+        "hash": "sha256-4jCsCt2rcUpUk2xeL3tZx/jTnuJ+COG+xsDtR+sK1oQ="
       },
       "src/third_party/highway/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
@@ -972,13 +972,13 @@
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "a9993612faac4866bc33ca8ff37bfd0659af1c48",
-        "hash": "sha256-fUPl9E2b7RfanH0pZNArIkJ4lnnmCtyk7sCaTArCB70="
+        "rev": "918cf66ed841930fe1554ae8d78974b95e989596",
+        "hash": "sha256-gzcXse/emv9JBMiInUV5KTeyMQ0igUdFpzUJR4vCUu4="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
-        "rev": "657a441e5c1a818d4c10b7bafd431454e6614901",
-        "hash": "sha256-9MePkv10fwyJ0VDWRtvRcbLMAcJzZlziGTPzXJYjVJE="
+        "rev": "232a723f5096ab02d53d87931efa485fa77d3b03",
+        "hash": "sha256-0ynZuxIqBIpNkfD3Y9XdPFQr7HeQcsUO3lhnqvH+k8c="
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
@@ -987,8 +987,8 @@
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "5bda0fdab9d93ec9963e2cd858c7b49ad7fec7d4",
-        "hash": "sha256-xwR9gGE8uU8qFr7GgS3/1JiuTmj1tvcM5CoCfPMdW2M="
+        "rev": "000f47cfa393d7f9557025a252862e2a61a60d44",
+        "hash": "sha256-FIJZE1Qu1MLZA4qxB68k1NjhgSbFTjf57YF85JicVZw="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -1012,8 +1012,8 @@
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "b73ae6ce38d5dd0b7fe46dbe0a4b5f4bab91c7ea",
-        "hash": "sha256-JNLaK105qDk9DxTqCFyXFfYn46dF+nZIaF5urSVRa0U="
+        "rev": "39ea79a3c132f4e678695c579ea9353d2bd29968",
+        "hash": "sha256-uochXC0AtOw8N/ycyVJdiRw4pibCW2ENrFMT3jtxDSg="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -1022,29 +1022,34 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "62ab80355a8194e051bd1d93a5c09093c7645a32",
-        "hash": "sha256-pZi6GRu7OGL7jbN4FM2qDsLCsT6cM+RM0a7XtFZVSVE="
+        "rev": "68114875ad35b573034a2ab1f5cdf3dbb0e59468",
+        "hash": "sha256-cGpteAnjGcxJUcrdLRFfQN7ruTEdNvNCbOH6EC+a39s="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "ce46be2573328fa7b0fd1d23c04b63389f298122",
-        "hash": "sha256-Q0kdJdEmh+wbO5oeTp98OHKh9luz8u6PDztGToldZjk="
+        "rev": "d91cc488cd651b00009e5d6c70f222362598bec9",
+        "hash": "sha256-o/sw1P+mZOSb6XIVFivC02hTPu++x+xJy2SRP2I9yGE="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "f40ddcd8d51626fb7be3ab3c418b3f3be801623f",
-        "hash": "sha256-O9vVbrCqHD4w39Q8ZAxl1RwzJxbH/thjqacMtCnOPdg="
+        "rev": "1fcc527019d786502b02f71b8b764ee674a40953",
+        "hash": "sha256-7HJyJARZPes5MmKgXd3TV1uRjk0bH/pkPm+F4scg+Tc="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "4a53cbe7a1270c91ec60903ee792de658453becb",
-        "hash": "sha256-hEksLeJli/1TNNrDcUjv19cpyIJph6kfriNfe7FWO0U="
+        "rev": "a54ed1df191a9e2aff2e9ef453ee6fdc959dd125",
+        "hash": "sha256-E6sx2ioDZRWJljbS17ztRwz+gsDhIHiluvkUx1rRZcw="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
         "rev": "199de96b345ada7c6e7e6ba3d2fa7a6911b8767d",
         "hash": "sha256-yuEBD2XQlV3FGI/i7lTmJbCqzeBiuG1Qow8wvsppGJw="
       },
+      "src/third_party/dragonbox/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/jk-jeon/dragonbox.git",
+        "rev": "6c7c925b571d54486b9ffae8d9d18a822801cbda",
+        "hash": "sha256-AOniXMPgwKpkJqivRd+GazEnhdw53FzhxKqG+GdU+cc="
+      },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
         "rev": "464c1d097891a1462ab28bf8bb763c1683883892",
@@ -1062,8 +1067,8 @@
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "fbce2a76c00cd2e5aeffe3c2e71d44c284ec52d6",
-        "hash": "sha256-bGa0BCvzNxEKu9VZEwJ1NLt+b2KKWUxshpKSN2FHNEM="
+        "rev": "01f23648c6b84de6c0f717fa4e1816f53b9ee72e",
+        "hash": "sha256-hNzQZQxaa2Wtl7GWWF852cFmmXy4pc15Pp0d59TTfnI="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -1092,8 +1097,8 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "82090e67c24259c343c83fd9cefe6ff0be7a7eca",
-        "hash": "sha256-LhSIX7X0+dmLADYGNclg73kIrXmjTMM++tJ92MKzanA="
+        "rev": "2d1abd3bbb4d2396ed63b3e5accd66724cf62307",
+        "hash": "sha256-MAVHzILj9f+/HfVjZXyJkSQM3WBwzg7IDpAwiYHfA88="
       },
       "src/third_party/freetype-testing/src": {
         "url": "https://chromium.googlesource.com/external/github.com/freetype/freetype2-testing.git",
@@ -1107,18 +1112,18 @@
       },
       "src/third_party/harfbuzz-ng/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "8efd2d85c78fbba6ca09a3e454f77525f3b296ce",
-        "hash": "sha256-/WNGrvyvJ+FGqoIoHapaux1iu63zjID0yR30HYPpxaw="
+        "rev": "9f83bbbe64654b45ba5bb06927ff36c2e7588495",
+        "hash": "sha256-lNnCtgIegUy4DLhYaGZXcEaFw83KWAHoKpz69AEsWp4="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
-        "rev": "c542d619a8959415beda5a76fe89ffa2f83df886",
-        "hash": "sha256-sMqSHYs3lvuHXEov1K9xWRd8tUPG00QBJl6an0zrxwA="
+        "rev": "da9cb551ada1e55309b0ac89b9fbff2d29dbfe1e",
+        "hash": "sha256-MqJXwtUGL/IakwOO63JX4gx0gTocgQT3hbhw6OcYUbc="
       },
       "src/third_party/ink_stroke_modeler/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink-stroke-modeler.git",
-        "rev": "f61f28792a00c9bdcb3489fec81d8fd0ca1cbaba",
-        "hash": "sha256-XMLW/m+Qx+RVgo1DeYggBLjUYg/M+2eHwgjVWrA/Erw="
+        "rev": "03db1ed37b8b10b47d62ed0fa142d198a3861689",
+        "hash": "sha256-jnIljheEBq96e6zZO87bhVJbA1vIjiRzm1Hh6YMBdnU="
       },
       "src/third_party/instrumented_libs": {
         "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git",
@@ -1142,8 +1147,8 @@
       },
       "src/third_party/googletest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git",
-        "rev": "52204f78f94d7512df1f0f3bea1d47437a2c3a58",
-        "hash": "sha256-8keF4E6ag/rikv5ROaWUB7oganjViupEAdxW1NJVgmE="
+        "rev": "cd430b47a54841ec45d64d2377d7cabaf0eba610",
+        "hash": "sha256-QT9PQ9bF+eCPfRLkcHpH4jc0UZfGPc98fHf8QDV5bZg="
       },
       "src/third_party/hunspell_dictionaries": {
         "url": "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries.git",
@@ -1152,8 +1157,8 @@
       },
       "src/third_party/icu": {
         "url": "https://chromium.googlesource.com/chromium/deps/icu.git",
-        "rev": "c9fb4b3a6fb54aa8c20a03bbcaa0a4a985ffd34b",
-        "hash": "sha256-Omv4sp9z44eINXtaE0+1TzIU1q2hWviANA79fmkF78U="
+        "rev": "4c8cc4b365a505ce35be1e0bd488476c5f79805d",
+        "hash": "sha256-eGI/6wk6IOUPvX7pRTm4VJk1CqkkxalTu84L36i/D6k="
       },
       "src/third_party/jsoncpp/source": {
         "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git",
@@ -1172,8 +1177,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "c31f0c0e6df5725c6b03124b579c9cf815fd10f4",
-        "hash": "sha256-Dz7DqucOxr5HzLNOdGNOG4iMw66bkOj64qOvqeADTic="
+        "rev": "b10387fdbbca18192f85eaa5323a59f44bf9c468",
+        "hash": "sha256-L2QG0pUmGjGdtdlivxYfxSqO9YaVHpIT6lvJwBMTxMw="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -1187,8 +1192,8 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "9680f2b1781fb33b9eeb52409b75c679c8a954be",
-        "hash": "sha256-nfnt5JXyKR9JR3BflpGEkwzDo0lYa/oeCDm2bKH/j1g="
+        "rev": "719f60edc51b6141a2434bf1b5110c2fb075b246",
+        "hash": "sha256-W62uXVbQiq6Ef3bar2NsCXJoz5KKUK8Y/9n2vK7Vf3Q="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
@@ -1197,13 +1202,8 @@
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
-        "rev": "8acf9249344ea9ff9806d0d7f46e07640fddf550",
-        "hash": "sha256-qIIyCHay3vkE14GVCq77psm1OyuEYs4guAaQDlEwiMg="
-      },
-      "src/third_party/beto-core/src": {
-        "url": "https://beto-core.googlesource.com/beto-core.git",
-        "rev": "89563fec14c756482afa08b016eeba9087c8d1e3",
-        "hash": "sha256-QPFGjtu/I0r4+dTQ2eSlWIEYwJ43B3yW0q4QtVFTVGY="
+        "rev": "e71de0e0c312caf8d2fa22f132619c6a68496444",
+        "hash": "sha256-dzJtRhoPA1FWeu0xjd7kJ1Q2nT5gIkKpIgQmywsRlPY="
       },
       "src/third_party/securemessage/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/securemessage.git",
@@ -1212,8 +1212,8 @@
       },
       "src/third_party/jetstream/main": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
-        "rev": "0260caf74b5c115507ee0adb6d9cdf6aefb0965f",
-        "hash": "sha256-DbRup4tOAYv27plzB2JKi2DBX2FVMDtFR7AzuovXUDU="
+        "rev": "0976ddeae0863ef5fb3f9ad09906224b0989f9ad",
+        "hash": "sha256-NyXGd7SwsECGBJ2qodGYB3os+UBgIOg/I8mnrsZJuTg="
       },
       "src/third_party/jetstream/v2.2": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
@@ -1222,8 +1222,8 @@
       },
       "src/third_party/speedometer/main": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
-        "rev": "c760d160caa05792d3ed7650e85861c9f9462506",
-        "hash": "sha256-/nAK2uLjpPem37XCHHx3LGZEpvL/7w4Uw5bVpQ4C6ms="
+        "rev": "dd661c033abdde11022779f40375c52632a9f43a",
+        "hash": "sha256-1/G06WCO5ssBS3+T6E3rnGdIf0r205wVxfJX7lgivR4="
       },
       "src/third_party/speedometer/v3.1": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git",
@@ -1262,8 +1262,8 @@
       },
       "src/third_party/expat/src": {
         "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git",
-        "rev": "624da0f593bb8d7e146b9f42b06d8e6c80d032a3",
-        "hash": "sha256-Iwu9+i/0vsPyu6pOWFxjNNblVxMl6bTPW5eWyaju4Mg="
+        "rev": "69d6c054c1bd5258c2a13405a7f5628c72c177c2",
+        "hash": "sha256-qe8O7otL6YcDDBx2DS/+c5mWIS8Rf8RQXVtLFMIAeyk="
       },
       "src/third_party/libipp/libipp": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git",
@@ -1307,8 +1307,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "027bbee30a0103b99d86327b48d29567fed11688",
-        "hash": "sha256-+4I6B1aTa+txhey6LMeflU0pe39V6TJ+lNIJPh6yFGM="
+        "rev": "40ec928b3fadcf8edd836445bb5842a11aeb7a2d",
+        "hash": "sha256-aUHvIv78KTiyN/cOYNuhW4UCOD55s8l8VLu4oP0Pk1s="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -1322,8 +1322,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "ccdf870348764e4b77fa3b56accb2a896a901bad",
-        "hash": "sha256-8sH11psWPXLMy3Q0tAizCZ/woUWvTCCUf44jcr2C4Xs="
+        "rev": "9f9b5cf660dcfa0d3fdee41cf4ffbe4bb6e95114",
+        "hash": "sha256-OYmsMPz7nJwkVSpsDW7SbqrCU5raC1k3Mh/UkonCujM="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -1342,8 +1342,8 @@
       },
       "src/third_party/nasm": {
         "url": "https://chromium.googlesource.com/chromium/deps/nasm.git",
-        "rev": "767a169c8811b090df222a458b25dfa137fc637e",
-        "hash": "sha256-yg4qwhS68B/sWfcJeXUqPC69ppE8FaIyRc+IkUQXSnU="
+        "rev": "9f916e90e6fc34ec302573f6ce147e43e33d68ca",
+        "hash": "sha256-neYrS4kQ76ihUh22Q3uPR67Ld8+yerA922YSZU1KxJs="
       },
       "src/third_party/neon_2_sse/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git",
@@ -1357,8 +1357,8 @@
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "db9e1ea566813606ca055868be13f6ff4a760ab8",
-        "hash": "sha256-K/frmCf3JMvPVZc6ZKPFAQrq4Pz4io3XBvADS0O5u78="
+        "rev": "40fe10467c27b6536e5d3241e5881b6e9f243216",
+        "hash": "sha256-fKXCuGzNVcN8l/2VNR5c9lwUjmSDb7MuEAVF5h8VXQU="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@@ -1372,13 +1372,13 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "ca83e69429af8f0bfa34b22dc54f538b9eebf5c5",
-        "hash": "sha256-6gsur+fx546YJn/PUOOthuj+XrSIruVUeAYl4nRI6xM="
+        "rev": "c82c611f105c0df064cc8c76363578caf9eafb75",
+        "hash": "sha256-kcrWcvbbGgQTfGypJ2EaLunYtSipJJRAin2jHunZoCU="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "054635b91453895720951f7329619d003a98b3e4",
-        "hash": "sha256-2jKRhHLitR0m2a4/asvVvTqAOhUlyLsBBSjpQAer4GA="
+        "rev": "f35ae1939989c58c29df43f9c2d8610f5b932715",
+        "hash": "sha256-SyYTZnNar6F6/k6PGrkRan3l9hAikEVRciDQQaR7Jvs="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -1387,8 +1387,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "4e1831c02c74334a35ead03362f3342b6cea2a86",
-        "hash": "sha256-mB1QaAuY8vfv8FasPyio1AF75iYH+dM8t1GIr0Ty/+g="
+        "rev": "290ee6fff0c36614702d6b297c148e3fa08e056a",
+        "hash": "sha256-jRHF7vZPmh70jNFVukfWzVnA2dBLSDSnMWVyZ9e08n4="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -1417,13 +1417,13 @@
       },
       "src/third_party/search_engines_data/resources": {
         "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "07834ba1e5ebfb333d0b73556b7c4d62a53cb455",
-        "hash": "sha256-DTz351NpoygQLESm/z+fzFc/KGJyQelLnWpzNMmNT9o="
+        "rev": "be408bdc2c1501ef25206145a49dcebb98db34b5",
+        "hash": "sha256-XlAE782PsEysPVIBM/Q8VdE9XnvoYUVaeMmUUoYFgvM="
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "bcce46ca33b67cc302dd53927a63013b8f53bf73",
-        "hash": "sha256-ei95CJRfNPrsYt8XcDi7Pnl5dGiJu3qs7R4rAcZ24Uc="
+        "rev": "0dfd95a49aed617f242c8b06dd5b255d1cb07776",
+        "hash": "sha256-HBqkqEoyQo3KuRCwP5NW9kuY9maaBYSpjA1lcBdFjxk="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1442,8 +1442,8 @@
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "4982425ff1bdcb2ce52a360edde58a379119bfde",
-        "hash": "sha256-QTGU9Dgc6rgMeFZvhZyYeYj5W+ClJO8Yfa4+K7TmEec="
+        "rev": "7905fa19e456df5aa8e2233a7ec5832c9c6c287b",
+        "hash": "sha256-Wi8mttxM1fuLqrL2q6qPnpmyAfmDqJGA8Wub+yexFLA="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -1452,18 +1452,18 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "c8ed430d092acd485f00e7a9d7a888a0857d0430",
-        "hash": "sha256-S5zkpQZdhRdnZRUrUfi5FCrF2XFe3y/adAWwfh1OQYE="
+        "rev": "42d6877b1aa1cf324eb03ccf9b13511400341deb",
+        "hash": "sha256-KummGT7CUoGd3lCGXvtSFcFD1FhSlJXDcEi1WKUza70="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "1648e664337ca19a4f8679cbb9547a5b4b926995",
-        "hash": "sha256-CI0X6zbRV/snGcQZOUKQFn8Zo6D6Out6nN027HGZaa8="
+        "rev": "96793fb0ff6fb5d4328cc6f71d84f5cb2d835daf",
+        "hash": "sha256-rAtsw8JV8EwrNzjK5p7JbWQa6fHfpByvZcP71hHC8uM="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "e57f993cff981c8c3ffd38967e030f04d13781a9",
-        "hash": "sha256-nr7pGPNPMbmL/XnL27M4m5in8qnCDcpNtVsxBAc7zms="
+        "rev": "fc9889c889561c5882e83819dcaffef5ed45529b",
+        "hash": "sha256-HwFP4KJuA+BMQVvBWV0BCRj9U5I3CLEU+5bBtde2f6w="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -1472,38 +1472,38 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "8c88e0c4c94a21de825efccba5f99a862b049825",
-        "hash": "sha256-s0Pe7kg5syKhK8qEZH8b7UCDa87Xk32Lh95cQbpLdAc="
+        "rev": "bab63ff679c41eb75fc67dac76e1dc44426101e1",
+        "hash": "sha256-hi4vCwdCnwuYodUYq75niCZt2t9lERQH6529/R+7nH8="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "2e83ad7e6f2cc51f7eaff3ffeb10e34351b3c157",
-        "hash": "sha256-u4WDbWywua71yWB1cVIt1IDZRe4NnT5bUq3yHLKBgPo="
+        "rev": "8e9165a3d162967a424dcf2ff645a98b50381cce",
+        "hash": "sha256-GsoaeO3FMzMtMStg1Wp0KUHU3Xxmmr7t3lDyu0ervNk="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "78c359741d855213e8685278eb81bb62599f8e56",
-        "hash": "sha256-VqKQeJd81feSgYnYLqb2sYirCmnHN9Rr19/4cPZ2TzE="
+        "rev": "e2e53a724677f6eba8ff0ce1ccb64ee321785cbd",
+        "hash": "sha256-lIuJ50zi9UIMrP/FePI8jHFhJ5LsKhthDY4gIHeZNpo="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "723d6b4aa35853315c6e021ec86388b3a2559fae",
-        "hash": "sha256-tDW5ed6gsDKlCKf4gT8MNi1yaafocUTohL1upGKB+Cc="
+        "rev": "fb78607414e154c7a5c01b23177ba719c8a44909",
+        "hash": "sha256-CeIjyW90Ri0MvhyFfYgss5Rjh5fHKhQf7CgBEcB/nPk="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "289efccc7560f2b970e2b4e0f50349da87669311",
-        "hash": "sha256-Cw7LWBPRbDVlfmeMM4CYEC9xbfqT1wV7yuUcpGMLahs="
+        "rev": "0b8196724e4ad28cc7459b82a9b75f252c08cb3e",
+        "hash": "sha256-oL4lyUH26eO6eJy7EQmuXdt4oy3eQ65fribfMSOZV+8="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "0d5b49b80f17bca25e7f9321ad4e671a56f70887",
-        "hash": "sha256-NdvjtdCrNVKY23B4YDL33KB+/9HsSWTVolZJOto8+pc="
+        "rev": "4e246c56ec5afb5ad66b9b04374d39ac04675c8e",
+        "hash": "sha256-MmC4UVa9P/0h7r8IBp1LhP9EztwyZv/ASWKKj8Gk1T8="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "73d7d74bc979c8a16c823c4eae4ee881153e000a",
-        "hash": "sha256-2GII+RBRzPZTTib82srUEFDG+CbtPTZ6lX3oDJBC2gU="
+        "rev": "cea6ec1cdd37494c1f0fc5619c6c356ac33372fb",
+        "hash": "sha256-iXQZ6Qpe0li+QeThxMUCn45OufZ8W/qJcejpMb4/gWc="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -1512,8 +1512,8 @@
       },
       "src/third_party/wasm_tts_engine/src": {
         "url": "https://chromium.googlesource.com/chromium/wasm-tts-engine",
-        "rev": "53d2aba6f0cf7db57e17edfc3ff6471871b0c125",
-        "hash": "sha256-t5eeehwspRLaowEMPLa8/lV5AHamXQBfH/un0DHLVAM="
+        "rev": "352880bb49e2410707543c252ef6b94a21b0f47f",
+        "hash": "sha256-TFkniS4XvP0RlPnI1lv4RxxSY44RUuwCMKmmybENEBw="
       },
       "src/third_party/wayland/src": {
         "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git",
@@ -1547,8 +1547,8 @@
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "92f4eb4dae0f5439f2cdc7ce467d66b10e165f42",
-        "hash": "sha256-vXyp0+6eyKOzzQbkRa8f8dO+B9cyUCY2hCZEFc7+7lU="
+        "rev": "168536ad91bff176bbe31ae692d97f8bfe9fb86d",
+        "hash": "sha256-HB16HM4Gj+2F26tyN393VmHbGxvKOZ+M949059odN/4="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
@@ -1557,8 +1557,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "2c8f5be6924d507ee74191b1aeadcec07f747f21",
-        "hash": "sha256-cNONf88oSbsdYuSdPiLxgTI973qOP6fb1OKb2WMQMMg="
+        "rev": "cec4daea7ed5da94fc38d790bd12694c86865447",
+        "hash": "sha256-mxRckkiBIpQp2Qxj6fcer3jDftp3wlg+aO4BoUHhyiY="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1567,8 +1567,8 @@
       },
       "src/third_party/weston/src": {
         "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/weston.git",
-        "rev": "ccf29cb237c3ed09c5f370f35239c93d07abfdd7",
-        "hash": "sha256-y2srFaPUOoB2umzpo4+hFfhNlqXM2AoMGOpUy/ZSacg="
+        "rev": "4eb10b123b483327214d8da5da67e8bbeeaed8fe",
+        "hash": "sha256-VNHUAtfTB24SIf2kl+MMXF3rG5cJOPM93WU/sVSIQ1A="
       },
       "src/third_party/xdg-utils": {
         "url": "https://chromium.googlesource.com/chromium/deps/xdg-utils.git",
@@ -1577,18 +1577,18 @@
       },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "d6fc3be20b0d3e3742157fa26c5359babaa8bc8b",
-        "hash": "sha256-p5DjGNH9IR0KPWSFmbsdt2PU+kHgWRAnBw7J9sLV/S8="
+        "rev": "474d7e58d4b8f4bd1a98ee74bc57858769f7d925",
+        "hash": "sha256-UO+nOh7R+3xTSxF2u8dIrv7qn/QmhnDr2J5Ciumj93M="
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "ef2bf5781112a4cd6b62ac1817f7842bbdc7ea8f",
-        "hash": "sha256-hDDNrUXGxG/o1oZnypAnuLyIeM16Hy6x1KacGu9Hhmw="
+        "rev": "d654fca78690fa15cceb8058ac47454d914a0e63",
+        "hash": "sha256-Ginvak0y1CjURT3mQZzdLn3MW9vXxC7T0KLsM6SHDV0="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "5297e56d91816747d539abca52b578e5832135f0",
-        "hash": "sha256-Fi4pl6xSXkHF4XaQNfNzULVjQZSzDfaHFIyIxH103go="
+        "rev": "44fdd9108308773dd3f4fa040de5f4f75edf671f",
+        "hash": "sha256-BkLOmb97p2NcAIuQiDjIoVAe49h9iv79rC5G8wyD1as="
       }
     }
   }
diff --git a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
index f3608e09d4a9..6ea22626836b 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
@@ -1,2477 +1,2477 @@
 {
-  version = "139.0b4";
+  version = "140.0b2";
   sources = [
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ach/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ach/firefox-140.0b2.tar.xz";
       locale = "ach";
       arch = "linux-x86_64";
-      sha256 = "709fe8a024c4531f515eb01a6b267a56029a03166ac5d6de413019fe0a8ba45e";
+      sha256 = "9772122fe9b864f2247c7fdb6e5d11813b25af4e86120959581ef8d1e4d43522";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/af/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/af/firefox-140.0b2.tar.xz";
       locale = "af";
       arch = "linux-x86_64";
-      sha256 = "a62c1d62f6e2dfce5225df31b215f1227c7eabb220dc12043c8a5ad4c8f417f5";
+      sha256 = "dd758bbab164e46f9484b1a271b94d95dff15788998e137ba4ea6a4adc325625";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/an/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/an/firefox-140.0b2.tar.xz";
       locale = "an";
       arch = "linux-x86_64";
-      sha256 = "63cc13f04ea6f0c77a6855cfad11f4f6f35bdaa3d5fc06edcf030a8ffcad7a6e";
+      sha256 = "e10bf7cb75a4b9c395aa2c0adf1f5406daaab1ed2148a6c8cad034376e79380c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ar/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ar/firefox-140.0b2.tar.xz";
       locale = "ar";
       arch = "linux-x86_64";
-      sha256 = "0298c9c247c673847b8154d19b35b7379345409dfb9a5d80f2a6239e972e7cdc";
+      sha256 = "09d6db922f63c3a0b9fa080050820f9a83c517c6faa0848bd104a669336789b1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ast/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ast/firefox-140.0b2.tar.xz";
       locale = "ast";
       arch = "linux-x86_64";
-      sha256 = "f48ab573fdad0eeb69b4c70a99e8cf7af87783f6698c591d01739ed3ea870723";
+      sha256 = "5e2bed35394f61519b2cc67e341e14002e692edbf7c52b5a5aca329403ff36ec";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/az/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/az/firefox-140.0b2.tar.xz";
       locale = "az";
       arch = "linux-x86_64";
-      sha256 = "add78dfa402bf925f4834c4e0b698b5dbe01d99e1838de9c03272f819404b8d8";
+      sha256 = "7f56c3afe0cb2a899411496e5f989b44834bafb0febda20bed7495ec5dfcd8d7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/be/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/be/firefox-140.0b2.tar.xz";
       locale = "be";
       arch = "linux-x86_64";
-      sha256 = "0500f7ce071b2867a712f32a830ae65a98cfd7b4beb28ea9623361affca11e62";
+      sha256 = "202cde7a9402777c80ce654b264007d13baf7e573ecb6ada8ac21a58ff80c6c0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/bg/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/bg/firefox-140.0b2.tar.xz";
       locale = "bg";
       arch = "linux-x86_64";
-      sha256 = "a32e773d73f2a10cf17292c65f21e0e3fc1516dd4093111ddbe54d4fd553a26b";
+      sha256 = "58d17e006afc3a024d843ad196b09a5ed19b29ab40318be8d0682b4a21e73117";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/bn/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/bn/firefox-140.0b2.tar.xz";
       locale = "bn";
       arch = "linux-x86_64";
-      sha256 = "dc1386c1677b429980463325db93c9a96c1a4178bd2604adf3e943ae6a5890a1";
+      sha256 = "8f21073aaa86facd7e5828857f3581e67949be14a359c1a99967e02ebc888a03";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/br/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/br/firefox-140.0b2.tar.xz";
       locale = "br";
       arch = "linux-x86_64";
-      sha256 = "26ec0871ac96b3ce28d7953d4ead1df0d2826b5c2650fe1db2af238753edfc9c";
+      sha256 = "ee8f892efd0dd4a9bb2d45609f54c7ca06e1e803c7a1abbed7bc3a80ac03cd3e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/bs/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/bs/firefox-140.0b2.tar.xz";
       locale = "bs";
       arch = "linux-x86_64";
-      sha256 = "6a2ab79e63632932b673e7d22a98767b7e923094ead8ecd48511444b46be6dcc";
+      sha256 = "11308e30b1a7bb4c26779048b5cf6c36ed6f1092c6aebb19c5413379b000c245";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ca-valencia/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ca-valencia/firefox-140.0b2.tar.xz";
       locale = "ca-valencia";
       arch = "linux-x86_64";
-      sha256 = "fb19289c0f3d03d5f66467ad740d753f43e6fc2601f87d130209ec0c836fe718";
+      sha256 = "e99bb572c923e86dab8ca768dd7016553a166bff9479ed568e0c0cf823058b8e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ca/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ca/firefox-140.0b2.tar.xz";
       locale = "ca";
       arch = "linux-x86_64";
-      sha256 = "6380ca078dfec8f821f537a685b2b5f7b4ff9e328ef0a5acbf6257069c0b27e5";
+      sha256 = "b0cce2c03c5a3b5741cfa158f8cf294c51b881ba101695e00c91b1bd14f897e6";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/cak/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/cak/firefox-140.0b2.tar.xz";
       locale = "cak";
       arch = "linux-x86_64";
-      sha256 = "4947e4d6c8433efa7379115eb0523f75ec3c00bcdfa8179f97ae97ef662bd8a4";
+      sha256 = "bc26e0bd9336906decce9e79bc4501335d1144bfe4acad0e34d604982a99e799";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/cs/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/cs/firefox-140.0b2.tar.xz";
       locale = "cs";
       arch = "linux-x86_64";
-      sha256 = "49b157447c444099afa5177aa7179d98f71171fee8a89f0ce14c65fd9af58214";
+      sha256 = "d94e4fdd4aa4c2cc57c8dd5cc3f28c9287d916ac98d803048f9c254b7036b32c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/cy/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/cy/firefox-140.0b2.tar.xz";
       locale = "cy";
       arch = "linux-x86_64";
-      sha256 = "f440960100c6685444e6507a4e0f072871b410784967e2f00c04ef9427609a78";
+      sha256 = "f6e8adfabb271dc3275af1c0123a050a9acea8cb20d69da53c06b1f8b93abcb5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/da/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/da/firefox-140.0b2.tar.xz";
       locale = "da";
       arch = "linux-x86_64";
-      sha256 = "ea2cefb990e4bd8f283c45a14bbf7a5ca420b69542692d2bb86093c885a1f627";
+      sha256 = "a0c7e0fd4daa6f83ea721bddcb67b0dcaebfa971964d5eb8b30421c6ccf9afb2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/de/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/de/firefox-140.0b2.tar.xz";
       locale = "de";
       arch = "linux-x86_64";
-      sha256 = "5bacffc6c87f049f865c2a6ad00e5d26a4b4ba879092902165db0a345daaf77e";
+      sha256 = "a41061a13e540377854c68bac1e0ead0e43fb6eb398cedd1c7d072fbd1aa7d2c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/dsb/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/dsb/firefox-140.0b2.tar.xz";
       locale = "dsb";
       arch = "linux-x86_64";
-      sha256 = "f93de9c31f9d63d41fbe7635103500a81144888518bc8c2f698e39d4b0357028";
+      sha256 = "a4ee38be8dc35f327c7e10178f5d589234ece7fa82799748e51c10b9b2a03e57";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/el/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/el/firefox-140.0b2.tar.xz";
       locale = "el";
       arch = "linux-x86_64";
-      sha256 = "201f51c2f4f30618d8e9f614cf27b3e07e899f852504becdf46f6a15220309c7";
+      sha256 = "76c892f181579b8d86468789df62e2f61b87be550235884419966dcdf5f159b0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/en-CA/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/en-CA/firefox-140.0b2.tar.xz";
       locale = "en-CA";
       arch = "linux-x86_64";
-      sha256 = "ef5403be996abf97e9c58c5ebcd0c74fe9a14122119c33266e30428a60c4c944";
+      sha256 = "57cf1cb329540eb612f2b2392ade585b4505a89ad32dc4bbc6adb199ec179b31";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/en-GB/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/en-GB/firefox-140.0b2.tar.xz";
       locale = "en-GB";
       arch = "linux-x86_64";
-      sha256 = "64b2ce817ac1cfb314a9f22456716f9e1e5d7893bf46fd6b55d203c718df6c9a";
+      sha256 = "62b77a005adc751657d1c40c8f744c7d1c0ab341a6bd3ee0e7864f69ed2759f4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/en-US/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/en-US/firefox-140.0b2.tar.xz";
       locale = "en-US";
       arch = "linux-x86_64";
-      sha256 = "21bfb99fe445e64ad8fb86822fd6d77c9c0d387530b787f3c3fc99b97723d664";
+      sha256 = "828cac8a8d7e83fd82c13c979fce4a77262be2d8bf6639612664ca1f10c96ec1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/eo/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/eo/firefox-140.0b2.tar.xz";
       locale = "eo";
       arch = "linux-x86_64";
-      sha256 = "531b94cf1b0a20de877bbe1cc9e3ab3ae9b7dd8729586a70a43f04576909c99e";
+      sha256 = "91f3b063d16c364419ec2ccdd152c05b19a0bb38eededdd2461d79952a760753";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/es-AR/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/es-AR/firefox-140.0b2.tar.xz";
       locale = "es-AR";
       arch = "linux-x86_64";
-      sha256 = "f80d18dca3009011d97bb89726d9b09c548e239383412615c4a341537e157165";
+      sha256 = "b2edc4c81a5910901a6e2e9b90b2fc3c625f67e74f746cbc3ca4a32dc9115611";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/es-CL/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/es-CL/firefox-140.0b2.tar.xz";
       locale = "es-CL";
       arch = "linux-x86_64";
-      sha256 = "f2144b0b492eff30dbd95ab92ef9523d3d7d48dbad2efc52e8401a4e4f85d561";
+      sha256 = "f35abf87c2ac7afe6f75861bf99595a06f7216de0003f91cde3c719f3a2b0124";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/es-ES/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/es-ES/firefox-140.0b2.tar.xz";
       locale = "es-ES";
       arch = "linux-x86_64";
-      sha256 = "895b92176b7dc1a492574bb625e6264548377adabd1655c6ba07eb24a786c1a6";
+      sha256 = "575e9368ff7bbac6c168441d1095472bd29eeaf8dbb271bf7c1ef14d0e0c69ed";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/es-MX/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/es-MX/firefox-140.0b2.tar.xz";
       locale = "es-MX";
       arch = "linux-x86_64";
-      sha256 = "b770be36d7b93925baf0c85fcccecb73f1c1b8845615e7631f3d83e8fafe10ce";
+      sha256 = "5ce0c62e79621a15c533768282344b523b96c478d463de58754e3808bccf4d0b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/et/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/et/firefox-140.0b2.tar.xz";
       locale = "et";
       arch = "linux-x86_64";
-      sha256 = "e88a52d747dc3d6c5a449c5449fb2b412441f41da64c496da22f5880ba5c4752";
+      sha256 = "b8493cd786ec0beb918cd7bbe5009d039ec6e5b8fa2f8cdd80309a3325947015";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/eu/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/eu/firefox-140.0b2.tar.xz";
       locale = "eu";
       arch = "linux-x86_64";
-      sha256 = "4d7d7fe2f695c79418a746c875cfd9357cb290ad8b6d253774a3ab92fe235210";
+      sha256 = "5573776ed1d9b4dda2d0bd566b2b4c8a83906193005f2db7f953d1eb57079335";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/fa/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/fa/firefox-140.0b2.tar.xz";
       locale = "fa";
       arch = "linux-x86_64";
-      sha256 = "8cb53568f15e61491f0b3c03a1e71599cac3ce278f145f638830b9d22b789ff4";
+      sha256 = "59a775986c659bf12ef00f2f13de480b69279d1881358827244eae0ba6631976";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ff/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ff/firefox-140.0b2.tar.xz";
       locale = "ff";
       arch = "linux-x86_64";
-      sha256 = "2f229d6811bbc2bde175dc9b6fea0b1fdf4221f9f8042cf50d67513074a45a5e";
+      sha256 = "2e5bec3ebf2b31d9a3eac67f03f9fadf249956df08529fccfb1fe6d305c99e31";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/fi/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/fi/firefox-140.0b2.tar.xz";
       locale = "fi";
       arch = "linux-x86_64";
-      sha256 = "316ac34c897feb1b98f677436d4dbac7b4a5c5fc29cf07bb55341736b156ae0a";
+      sha256 = "f31288ef2e48ac0cb3fdff3395346927fd866878d22bcc9be6a70fb1c86cb441";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/fr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/fr/firefox-140.0b2.tar.xz";
       locale = "fr";
       arch = "linux-x86_64";
-      sha256 = "2b1e4ab91f25e9b95fb894231709d086d9645eb76a64e0db194dd386e8f362ac";
+      sha256 = "4d011e05781ad8cf93d704e7455e28a0325c07d0b3bd12ade2f315b918e9fe65";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/fur/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/fur/firefox-140.0b2.tar.xz";
       locale = "fur";
       arch = "linux-x86_64";
-      sha256 = "1a2c3b4e20c5cbbd6531c53516bcd97478cd86f6bc8b2761fd7074cc9e0429d0";
+      sha256 = "042c4f0d7fa4a638db9dec99fd30d7af490fd11097b4adfa9f7d474bccabb4a1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/fy-NL/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/fy-NL/firefox-140.0b2.tar.xz";
       locale = "fy-NL";
       arch = "linux-x86_64";
-      sha256 = "ca55a18278f39416d4982834357d8ee4e9dbb47e129feb3d45b4912f411dcfc6";
+      sha256 = "7c44584b9bc19d943191385cc8c56420f77fba6e4f9712a229797b3cf6588639";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ga-IE/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ga-IE/firefox-140.0b2.tar.xz";
       locale = "ga-IE";
       arch = "linux-x86_64";
-      sha256 = "34594aded12da96b71053623e9bdc09367d8d28281f6ea31be81dc1eab4d76f1";
+      sha256 = "33ee655e264ed6b96a3aa75e7f1d7cd6c188fa55eb6c07c633cd7a388d04ce03";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/gd/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/gd/firefox-140.0b2.tar.xz";
       locale = "gd";
       arch = "linux-x86_64";
-      sha256 = "a6dffbb23c3b61f25a913933d700ace50954ae6e879a9d7d4b73c1a864954523";
+      sha256 = "24a8becd37c3836af08e14e010914563ab4a205380b8a7ebeb856afe552f6c17";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/gl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/gl/firefox-140.0b2.tar.xz";
       locale = "gl";
       arch = "linux-x86_64";
-      sha256 = "a629a7d61624ade963df689fbee4add6f3eca0f603bd8fcc75563480642e7e97";
+      sha256 = "a0be7754c2e9b50429b62decb89123da0818530ffdecfae333b2c94342d23975";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/gn/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/gn/firefox-140.0b2.tar.xz";
       locale = "gn";
       arch = "linux-x86_64";
-      sha256 = "fb827103cafe3179b1b17f8fdc21e2008a5ff24f4502b923c7426ae91fc26c91";
+      sha256 = "ad5844d9720a0847aa8ccd06fe2fb948cbebc2b1adfe0fc871d18b0461ad4591";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/gu-IN/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/gu-IN/firefox-140.0b2.tar.xz";
       locale = "gu-IN";
       arch = "linux-x86_64";
-      sha256 = "e9f4437d6f8959aa9270e6cc8eb7070165a8418f4ed28c2a31e1b955948c7837";
+      sha256 = "7a32e73b96af77fbcb4a14fb6098d270a73484054ea9d8a47319247f2ba2db0d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/he/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/he/firefox-140.0b2.tar.xz";
       locale = "he";
       arch = "linux-x86_64";
-      sha256 = "5eedd55e647c494461a013912eaac5b1d40b20acef64a0810e74fdd72083e5df";
+      sha256 = "50a1e0ea0c17140525584a1cbb7de67801af5be12765d4d610cd70dea4ad1bfc";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/hi-IN/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/hi-IN/firefox-140.0b2.tar.xz";
       locale = "hi-IN";
       arch = "linux-x86_64";
-      sha256 = "3a1e543d88f0103776397decc1ae9fa2b5a96b68fddadea56c60e1d76b1120d5";
+      sha256 = "9871be936ad26228905a9bbabc94f8b027b066af8b4a27c0895fbb927dfea723";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/hr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/hr/firefox-140.0b2.tar.xz";
       locale = "hr";
       arch = "linux-x86_64";
-      sha256 = "4dbfbb04729a97c82b4eb123d1a6623867b6ece4f26777ed12c81a9bc5f4b88e";
+      sha256 = "f950a486143e3658168f7caed53f546679d5af41994398ccd3578222c4f6c513";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/hsb/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/hsb/firefox-140.0b2.tar.xz";
       locale = "hsb";
       arch = "linux-x86_64";
-      sha256 = "1cca8fe6f46c797b8e03923d9b4a317cab0e011c34a44feabcaea6767a4054b8";
+      sha256 = "1885e8881aa7bc06a993fd350c0368f85101d007583eb3b9145e9fc777ba2012";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/hu/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/hu/firefox-140.0b2.tar.xz";
       locale = "hu";
       arch = "linux-x86_64";
-      sha256 = "ddbb8a9b6fd89f496c47398f09cb2a56ecf51299138cdf1dff659d027f1f8055";
+      sha256 = "3efa843d3a3c1b8ca7454959ea2838ff436cb5820725b98599a99f57db4f21fe";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/hy-AM/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/hy-AM/firefox-140.0b2.tar.xz";
       locale = "hy-AM";
       arch = "linux-x86_64";
-      sha256 = "e819ccd80cfe1446cd60398e788931d12060766fbd23539932efc6e16a0a59a0";
+      sha256 = "4566fba506a4ee45d1152a5ebb716ec264e1cccfa84b011cb6bbccc1d58e5ffc";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ia/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ia/firefox-140.0b2.tar.xz";
       locale = "ia";
       arch = "linux-x86_64";
-      sha256 = "bb5dc9c1a4cb919a2f6207fe171fe0e2c9345d038cf7a7d969fc72f6c0d9aa94";
+      sha256 = "e599c11c636a7912a5d64df4c4f642c6b23b8ac8917602319c7d1aadf2c6e15a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/id/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/id/firefox-140.0b2.tar.xz";
       locale = "id";
       arch = "linux-x86_64";
-      sha256 = "04f8e8f738dad42e6c0daca2ada66ea01f7d994c2ef4f2ec329070f740a2bd0d";
+      sha256 = "788e2874ea4d845a742eb4f5ef9e02c79ad3ce156a09e1b7db19e83ed661b650";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/is/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/is/firefox-140.0b2.tar.xz";
       locale = "is";
       arch = "linux-x86_64";
-      sha256 = "140e3f7a50a57f415913465372b3c0cb026f648d587eab2e2406361430c1d81e";
+      sha256 = "280b95ffa32b43aa893b0df87fdda0adb14826b8a2b195c8a8a6f21174894412";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/it/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/it/firefox-140.0b2.tar.xz";
       locale = "it";
       arch = "linux-x86_64";
-      sha256 = "81eaf1ea39d5792ce31388a3936cc9597f7873eddbb6ab34ed78acf688598272";
+      sha256 = "5bf7718acb53c53244cb9979ed72c132b14b66b53caf51d554b01e601dfc116d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ja/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ja/firefox-140.0b2.tar.xz";
       locale = "ja";
       arch = "linux-x86_64";
-      sha256 = "5eb2dad48c1fdd9b869c89009f83433c7c43ecfbb85c6489a46bde89e935b534";
+      sha256 = "67cffcb3c101d24c384056b9ed5285f78a5a00421753524a8a4936d2ac3727c9";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ka/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ka/firefox-140.0b2.tar.xz";
       locale = "ka";
       arch = "linux-x86_64";
-      sha256 = "16cd1d3352195a758bb256d9f201d50934c016f772c4ae01133f7ff25f86f2fd";
+      sha256 = "e868d7da325cb38a4a6360aaeec5d34d2e7aa545da2682226b319b4f3aca2d53";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/kab/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/kab/firefox-140.0b2.tar.xz";
       locale = "kab";
       arch = "linux-x86_64";
-      sha256 = "e9390977f31c11d995d3748329da38c45300aa43ac5639c11cc90db9cd5b8d4f";
+      sha256 = "0de027c78af9346e30d4d64595ea81d5c522bb3a44e33e380b45e0d9fcfd0f28";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/kk/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/kk/firefox-140.0b2.tar.xz";
       locale = "kk";
       arch = "linux-x86_64";
-      sha256 = "7d13ee5bf4718468f8ea20a5fc6aceff58ac0be84fa7659932e85dbbaeed867d";
+      sha256 = "411e311bac40c12392aca73a5a4315fc015ba413526d20a19c620f74a66a8200";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/km/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/km/firefox-140.0b2.tar.xz";
       locale = "km";
       arch = "linux-x86_64";
-      sha256 = "999eff92897c3cb7597abef1e2c86eb962204dfa4ebd0d86842b3f2cbc7fe957";
+      sha256 = "6575b0b44caa29ba2d2ce4f69ccd0ac09c2d89b86eb9a541632a0e155e8108f2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/kn/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/kn/firefox-140.0b2.tar.xz";
       locale = "kn";
       arch = "linux-x86_64";
-      sha256 = "a2d45d1ffe1a46c8178f460ac30c394a7f4177ecc8cdb4c130bf3e5c49bc2ad7";
+      sha256 = "a1757ad5a847e430271d2cc99a3ef45ea409d0f8df52d8df38012e618ddb90fe";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ko/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ko/firefox-140.0b2.tar.xz";
       locale = "ko";
       arch = "linux-x86_64";
-      sha256 = "f847db77a08952229d6ef998c7157f0c75850f06cc96953ad66fd3a024ad1713";
+      sha256 = "6aa52561db8818725fe013bc7940b81c07e38c2678ef427675d0fc58c6741da6";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/lij/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/lij/firefox-140.0b2.tar.xz";
       locale = "lij";
       arch = "linux-x86_64";
-      sha256 = "5e82c700fc49d454496199107a8fcb752847cd46981754a8413af64777ba9d5f";
+      sha256 = "c07084a6bc9324dd71dc442fe24934bf29873b6e7e5158ae68eb4323507a5b0a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/lt/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/lt/firefox-140.0b2.tar.xz";
       locale = "lt";
       arch = "linux-x86_64";
-      sha256 = "5d60fd80069d73d12e285b65da1e3af0eca6824c27cb80e946c856f5c3028879";
+      sha256 = "5b088e25ded761cd501be0f5617349a2126c9eec6839e3ec6bcdc0b19ec9db02";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/lv/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/lv/firefox-140.0b2.tar.xz";
       locale = "lv";
       arch = "linux-x86_64";
-      sha256 = "28e9eba64a0662004171f87e2ccf23308d259bc78b2184ffdfec398ef08f89f6";
+      sha256 = "2bfe6a0bb5522305f577608ca6759013be5a947fd3e5e253191dc25376d2ab12";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/mk/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/mk/firefox-140.0b2.tar.xz";
       locale = "mk";
       arch = "linux-x86_64";
-      sha256 = "83df7f0457e3ecc36c1a6376ec595f3df04543ba36d80d896cd7d68fdf6d9de5";
+      sha256 = "441e386a2c4c0f3602907f48438b390a19e1f6a00831f8160b3212724d7da07d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/mr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/mr/firefox-140.0b2.tar.xz";
       locale = "mr";
       arch = "linux-x86_64";
-      sha256 = "879ae358c38367b634154936a9e8d093813ac8e410f8f533f7c32227845d3bb4";
+      sha256 = "c9f51bf2d9ebf2e76c80d2911f15f1ebb0272011c39059ea9a4e1c1bf83bf190";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ms/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ms/firefox-140.0b2.tar.xz";
       locale = "ms";
       arch = "linux-x86_64";
-      sha256 = "ec20aeaf31cd2f4b16b94ab16c62a0ebde70b738b86c739dd4deca7b50feb95b";
+      sha256 = "261acca048d14496d15c2ebd56fa069346b194c652f0f6f2cd9afbe8ffad02f0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/my/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/my/firefox-140.0b2.tar.xz";
       locale = "my";
       arch = "linux-x86_64";
-      sha256 = "90468dd5c6db813612f69f2b646be26db909dcaa92e66b3c3250823baea81de6";
+      sha256 = "58ba0821d03e4f362bc506b420427c02ca69ae43eb5bf241caa481ee791f1c13";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/nb-NO/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/nb-NO/firefox-140.0b2.tar.xz";
       locale = "nb-NO";
       arch = "linux-x86_64";
-      sha256 = "904f3f3760506b6feb246397caab176e6dd884e982dcb07274605bc067113d95";
+      sha256 = "5792c3f26540c20ba966fe7d587a1874452eb4346d72c24ede6a8bdaeaf704cb";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ne-NP/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ne-NP/firefox-140.0b2.tar.xz";
       locale = "ne-NP";
       arch = "linux-x86_64";
-      sha256 = "0181214f14fd5e88381952ad07df7a37efa293e8fbe903db0029e773ff1e50f9";
+      sha256 = "2f0656c6a7ae21a07a506b4293afcd85f6d3376961a71d5b45af698d67496d17";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/nl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/nl/firefox-140.0b2.tar.xz";
       locale = "nl";
       arch = "linux-x86_64";
-      sha256 = "cd1f662dcc64190d00c84b0c02d67558626246470c5cdac78fdee1408ec88cac";
+      sha256 = "e135d0459ba83b78cbd606e2fb033f8fc945ff628959103ef65747123bee7cae";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/nn-NO/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/nn-NO/firefox-140.0b2.tar.xz";
       locale = "nn-NO";
       arch = "linux-x86_64";
-      sha256 = "c20d2ea023e5eb1a60863cadd085db28f616dfa79c79652dc1f38c2efd2e4f49";
+      sha256 = "24ae203327f886d34d71d1820292fea86cbd39bb68400a317e1185c291739eb8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/oc/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/oc/firefox-140.0b2.tar.xz";
       locale = "oc";
       arch = "linux-x86_64";
-      sha256 = "6f387a7892a61b623ec1696adec24f5836dce98a4157c59cc47a987f11e8dfec";
+      sha256 = "fe061945a5fab1a73a03f424e02db5e90f490b3dbab11af978bf2bca27abd44c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/pa-IN/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/pa-IN/firefox-140.0b2.tar.xz";
       locale = "pa-IN";
       arch = "linux-x86_64";
-      sha256 = "1973852bbe05fc0207834a6271858a8b6585254635854cc2302b45d0a10f8b07";
+      sha256 = "16e22303ce33d37a5462fe1f9cc09959a7f8efe77133d3d87b6a6b3d5fedf0d6";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/pl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/pl/firefox-140.0b2.tar.xz";
       locale = "pl";
       arch = "linux-x86_64";
-      sha256 = "9919cc6421b35798c2df90729d2d25e200e24d1450003ce30794124fb88ac21d";
+      sha256 = "9e1d841a5e5457f62f20cee241e538b1336edffe42a893fcbcf616a5989044e0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/pt-BR/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/pt-BR/firefox-140.0b2.tar.xz";
       locale = "pt-BR";
       arch = "linux-x86_64";
-      sha256 = "0ca06936133a86645d2975acb69fd01d3b80fdfcbc1ab003561ecd9fc85d4467";
+      sha256 = "e7da00d2172e5ce485957061bf3b8869f7437de3e3324dc9251f095e48ae26cf";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/pt-PT/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/pt-PT/firefox-140.0b2.tar.xz";
       locale = "pt-PT";
       arch = "linux-x86_64";
-      sha256 = "48dfb1081c2bee39a5bb2729d4aa83860d29435c818bef4b80c53e02efafb807";
+      sha256 = "b44a97bb059b2c4d11fd4786be517b22db28eb61bec88dab6335fdc5820cfbfc";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/rm/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/rm/firefox-140.0b2.tar.xz";
       locale = "rm";
       arch = "linux-x86_64";
-      sha256 = "4cb0f6115a83a9e30d5800f2d7c4709431c3617fba9fa43073bfd169c7a61266";
+      sha256 = "eecf8793a52e4f64391b3f424530b2ba9fe3474ad24ef16e3388272bb0cd1839";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ro/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ro/firefox-140.0b2.tar.xz";
       locale = "ro";
       arch = "linux-x86_64";
-      sha256 = "cf18a73a2170ab3fc5934adab6ef6142779f8f3c1fd949b1a1051bf2ea9795b8";
+      sha256 = "b1d69873414e221ffbe2b5c7175487c5dcd97ae2b7da17011d14f0e6e1342e1c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ru/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ru/firefox-140.0b2.tar.xz";
       locale = "ru";
       arch = "linux-x86_64";
-      sha256 = "85ea9ba70d407d009aced7ab3d1b8552b0cf1a44cb0df5d3cae35bbefec3bc8a";
+      sha256 = "823e6ec4c9a1326cc08ef9afaa50f33e892517fb94b8cf135c5df2ad0b39af49";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/sat/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/sat/firefox-140.0b2.tar.xz";
       locale = "sat";
       arch = "linux-x86_64";
-      sha256 = "693a3a17e376381dba4439a35eb8b7cf03ea59dbd6c8030b4da15466475f23b1";
+      sha256 = "2c24a66abdbe63b8537c1d1eb457e1078f4768fa4e1c628ec91c801fa4e29863";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/sc/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/sc/firefox-140.0b2.tar.xz";
       locale = "sc";
       arch = "linux-x86_64";
-      sha256 = "0d031bb02cef10ec8ee44376f384df868c20a6ae96138011adcfe577a132d788";
+      sha256 = "3f49ee23328467021066957d5c46150a2b2ed2216774d4593a2bedc8c3a116f6";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/sco/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/sco/firefox-140.0b2.tar.xz";
       locale = "sco";
       arch = "linux-x86_64";
-      sha256 = "e38e1b62fdbf65b5893c448a8df763da3e04436ad75db1531023a800bb2fd186";
+      sha256 = "1d1ec36ea66705cd0b0d986d7f7ceca5a0b56dd98fd51cc640b3aba03454ab72";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/si/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/si/firefox-140.0b2.tar.xz";
       locale = "si";
       arch = "linux-x86_64";
-      sha256 = "efaac36b3c3a6da5958563d682936413851f76134eff15652cab0260038affca";
+      sha256 = "1d2609c2d3b7ef1badb501a65644d3dcd0e376a9a95fccbc751c9420aa9144ec";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/sk/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/sk/firefox-140.0b2.tar.xz";
       locale = "sk";
       arch = "linux-x86_64";
-      sha256 = "e60387517f08d43b27179b08a0f9f8280d9e5e1d72ebd200f1794d37ecbb7b42";
+      sha256 = "adf327cae6a85ef120eb027a8e5477654db02f829bf673db4bdcc8c05dee86d6";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/skr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/skr/firefox-140.0b2.tar.xz";
       locale = "skr";
       arch = "linux-x86_64";
-      sha256 = "834d207793100f06741459b12203ebf73750abeaffb43524564562bbb7160779";
+      sha256 = "70f8da6b2e7ef52d707a80011ae8998342fa64def483ba4717f6c7e0ea1b7ac2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/sl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/sl/firefox-140.0b2.tar.xz";
       locale = "sl";
       arch = "linux-x86_64";
-      sha256 = "9f0f2d2d7b22a2c2eb7ba28974d41d6db63fea0e66491753eea7e009ee7dd23f";
+      sha256 = "bdd9383a3d0f8f736371956852a51583e68c0227612610b3831c6601b4cbd319";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/son/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/son/firefox-140.0b2.tar.xz";
       locale = "son";
       arch = "linux-x86_64";
-      sha256 = "bb57306e0b721a99b3d916ead2ca6c813315d010f51076dd6d415d53dc1e1847";
+      sha256 = "24d2724df88cedccbceeebd89e5c8087e54049bf11f291a707adacb16f4fefff";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/sq/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/sq/firefox-140.0b2.tar.xz";
       locale = "sq";
       arch = "linux-x86_64";
-      sha256 = "64e95983086221f6f01d19fe37282ebce21f93516a43905dc29d3006d59b7847";
+      sha256 = "7211cb03bc81a7eb781fd4d35c6826c70df13a29fdb4486d423c718047a76859";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/sr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/sr/firefox-140.0b2.tar.xz";
       locale = "sr";
       arch = "linux-x86_64";
-      sha256 = "456423a6a6c0c49b643d25bb3d32866c177a7856110c3cc94494f44296a836b2";
+      sha256 = "177e7e9786e45883f84939ce5eff32dfccdc08adc5c034e22437203637a9d89e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/sv-SE/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/sv-SE/firefox-140.0b2.tar.xz";
       locale = "sv-SE";
       arch = "linux-x86_64";
-      sha256 = "960c1aade2e27b872e648f61944ea5421cfe4f7f09205dac2693cf5d6f3840af";
+      sha256 = "700f554cdf816dc5aa91b6cfbaf8bf204264538ea9b9ae3d6ef10d256450a29c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/szl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/szl/firefox-140.0b2.tar.xz";
       locale = "szl";
       arch = "linux-x86_64";
-      sha256 = "2966c66c503b0fbdd8cf0fb141549cac9a8f34af9eb107b65aa7ed9409a629e5";
+      sha256 = "48db54afbcc1e6840e52b0a023dd6ee1956a44ee6a96930b52d10e1640155eed";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ta/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ta/firefox-140.0b2.tar.xz";
       locale = "ta";
       arch = "linux-x86_64";
-      sha256 = "afa115d8acfa334d69f8baf6159ffbb02165dcde6593b0b9132086bebd274714";
+      sha256 = "17074b69f77f2db0bd507e334d7b74cf290854d9fe696763223487c130629ca9";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/te/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/te/firefox-140.0b2.tar.xz";
       locale = "te";
       arch = "linux-x86_64";
-      sha256 = "215cf233c79f4d33e0de76e4dd11f270a908b8f1fa55c6744200e86b6c862f9c";
+      sha256 = "85f1f5bb9ab7517b0ab0700bbb94048776454cec7677216005989c0c4eec6047";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/tg/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/tg/firefox-140.0b2.tar.xz";
       locale = "tg";
       arch = "linux-x86_64";
-      sha256 = "e88ab65a2a477f5ad36ec77e334c2bbe9fc39e60fdd44b5ac705ff60f01dd8b9";
+      sha256 = "417933976c3a4b3d9e001adb8817b97830c22d2500d2bd20fb3d260d4efb58f2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/th/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/th/firefox-140.0b2.tar.xz";
       locale = "th";
       arch = "linux-x86_64";
-      sha256 = "ba4f17f2fc2d86486dda6acaea1acfabcf4157f23c2aa39a858c35c78be3b20b";
+      sha256 = "3ebb8a62335d1ff46df072f88244c94e7af3476efc892f2116526829f854d0e7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/tl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/tl/firefox-140.0b2.tar.xz";
       locale = "tl";
       arch = "linux-x86_64";
-      sha256 = "e123514d141c959e8f29b2dfc1c8152cb9c978267aca5cfa647ca79fcfd67563";
+      sha256 = "9751edb8943cf113a14be6bf5e1f9b06368d8ad316ab3e58b0924a62fea31749";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/tr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/tr/firefox-140.0b2.tar.xz";
       locale = "tr";
       arch = "linux-x86_64";
-      sha256 = "73988d7cc818bfbed084a626727d1bbbbb378daf849fbaa8b23f3f5a76315f63";
+      sha256 = "428675ed3f2bb5691329628bca3a1684c4154faffaf0a99d8ac7bea1e5af2f4f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/trs/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/trs/firefox-140.0b2.tar.xz";
       locale = "trs";
       arch = "linux-x86_64";
-      sha256 = "2b9022ed251f2e72bc0a7f7c319e7169eaddeec9cba230ceb9789ccd6c2a4c20";
+      sha256 = "5d41e893d50d9e39325ce571341594f247b429c7316415c7df1be2d7e67524c2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/uk/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/uk/firefox-140.0b2.tar.xz";
       locale = "uk";
       arch = "linux-x86_64";
-      sha256 = "f721779da0e1c681ae7ef66e789a81a3655ed7be116357c518d4eb0401937fe1";
+      sha256 = "38e28de077f6c2e70ffd42cb08d9ebdbb33873f42ec28e3f1380675818b232c6";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/ur/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/ur/firefox-140.0b2.tar.xz";
       locale = "ur";
       arch = "linux-x86_64";
-      sha256 = "080b7d053124ec03e821b5db14544de1a76e0b8d1aad4cbf6a5bfe7a721debba";
+      sha256 = "1f4be2e844e19a070bd976411abf5b84b8e71b68b098ef6724c0115e3347a4e2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/uz/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/uz/firefox-140.0b2.tar.xz";
       locale = "uz";
       arch = "linux-x86_64";
-      sha256 = "7fb7b3fd94aabaa611c53c6d8b75e0908c5bb93b0bdaa73a3e6e030a204d0bbc";
+      sha256 = "3b14162e19e28f35bc616fae251180a7fdf1698a7a9ebd0f43e04215fdb6dd54";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/vi/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/vi/firefox-140.0b2.tar.xz";
       locale = "vi";
       arch = "linux-x86_64";
-      sha256 = "27d15b1434b9aae896a3915eb647c1078a1663b1dfd6ce4c05d8e77bc21232f5";
+      sha256 = "34aaece124bf3a1af61dd0f6a0b7a7b924f332b04a2cb86c2e9375bb40e6e32b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/xh/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/xh/firefox-140.0b2.tar.xz";
       locale = "xh";
       arch = "linux-x86_64";
-      sha256 = "642d2ce475f6b2662ae13a54775fb4e5a01a1d25a5cec6e95bc341e8505c4856";
+      sha256 = "1055d5e93a507660405c64d8a122617467d26894b7786e998a0226442bf2e106";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/zh-CN/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/zh-CN/firefox-140.0b2.tar.xz";
       locale = "zh-CN";
       arch = "linux-x86_64";
-      sha256 = "1c07356d7c142aed0c17df737aa7b3e0ad38d9d4897d7df7bfd0a79a367d8ca1";
+      sha256 = "3725c141425b3977fd3120f3a6eacfbd5e2fb413a3723834e30ac3a41e5c124c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-x86_64/zh-TW/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-x86_64/zh-TW/firefox-140.0b2.tar.xz";
       locale = "zh-TW";
       arch = "linux-x86_64";
-      sha256 = "d20921bd3d75051a61de3890349bf65280a539824403074f51d14332cb33b3df";
+      sha256 = "7ff7baece1723aa893bed76b18117ea1ec633371018443553b7eb1af90617859";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ach/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ach/firefox-140.0b2.tar.xz";
       locale = "ach";
       arch = "linux-i686";
-      sha256 = "87a70f57297d5b0c01492da28bc80d74f290682f37b19a43fc6126efd85c6079";
+      sha256 = "b884ba50b81fe756b20f463131757dd701480fcd16133185a4fc983ca17d7c6d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/af/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/af/firefox-140.0b2.tar.xz";
       locale = "af";
       arch = "linux-i686";
-      sha256 = "c14ea82b75e114e01bad4b6e0b405c9611330105659b88bf8455857e181b4913";
+      sha256 = "60654b1bfb5c2922bb55ec75cc4c5c286e415741c0fb9b648bd53b3b2abb93d1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/an/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/an/firefox-140.0b2.tar.xz";
       locale = "an";
       arch = "linux-i686";
-      sha256 = "233822a13e7ddc7eb437a6fa48b95f57c4c1d7da7a6ca54e84015b6d6cc16f8f";
+      sha256 = "ef3be35e1124bedb22f1ec478e7f55e0436c416e5a049a7ec3d97be2b87012ab";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ar/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ar/firefox-140.0b2.tar.xz";
       locale = "ar";
       arch = "linux-i686";
-      sha256 = "c0cd5c0d31333a5a6ba6af3de586df838adbf7da09b2d85f8310757b3c9c8253";
+      sha256 = "67f4cda86a7e272fb194b6daaee4abe1040540014a02db93fa98e01f86748b4a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ast/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ast/firefox-140.0b2.tar.xz";
       locale = "ast";
       arch = "linux-i686";
-      sha256 = "e38ac58bff96c8396df39b1fe090abd67bdf9b3e410f504f25e0d24482a2d1ed";
+      sha256 = "052afbe7da0e5f8772097e25db3019a4bf8092c3369f8617052e876b162e7d4f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/az/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/az/firefox-140.0b2.tar.xz";
       locale = "az";
       arch = "linux-i686";
-      sha256 = "2c7a74321548b4d3c3c07e2c0f1127c4f54c55d1af0dabfc6704fa7eaa02b102";
+      sha256 = "394b4a7cb760e060b75031ecaa462dbb72622565583eb0ad7d3228fa1ab8b522";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/be/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/be/firefox-140.0b2.tar.xz";
       locale = "be";
       arch = "linux-i686";
-      sha256 = "624589d8c29240678a85b5b0978b4de1c43ea7850960bab85f7c7f7a172cb4f4";
+      sha256 = "c353fdd48caf79fa4ad02148bf80d480d7ecac400368d6e865be11f479ef794a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/bg/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/bg/firefox-140.0b2.tar.xz";
       locale = "bg";
       arch = "linux-i686";
-      sha256 = "84b144c5d7ae2cbc95dbb4fa262b6e0653000c645c9a604022aca70ead9282d8";
+      sha256 = "12e6f03a85147c992445ad753af7ba04c265570c103a489bca7fd9e724fc9f22";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/bn/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/bn/firefox-140.0b2.tar.xz";
       locale = "bn";
       arch = "linux-i686";
-      sha256 = "b7273dc41403f54eff659a67c8a4b70f2a4df61f62a1dd4c562b0bc75c08f909";
+      sha256 = "fe2c94b27a658388764fe5147ff989d2915f013c3efe26a60210022ab749e877";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/br/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/br/firefox-140.0b2.tar.xz";
       locale = "br";
       arch = "linux-i686";
-      sha256 = "0815292d40fb6ebe791d7de8d699ccc0d5096c0999fd498fe30ceb55aeb7292d";
+      sha256 = "aad228d7e751e6829e9fc48a4de4c71bfd1dbbe6cf698f0c51065baab521991e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/bs/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/bs/firefox-140.0b2.tar.xz";
       locale = "bs";
       arch = "linux-i686";
-      sha256 = "24de75d8e893acefc305717a2f8ba2decdb722e2505385d6cddb04ad43d7fe5b";
+      sha256 = "8931cc82c8f5a22053fe21dbb2947d5b1478348f8dd7e9ee4f727771166006af";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ca-valencia/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ca-valencia/firefox-140.0b2.tar.xz";
       locale = "ca-valencia";
       arch = "linux-i686";
-      sha256 = "2ba91787e8af61cb24de5c122a5ff57c6081e9680f7594d02e2b363f28e16a4b";
+      sha256 = "04a5f2a9344e369adfc40c57b719446da83ab80eea582efae5dc56ff0abb50de";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ca/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ca/firefox-140.0b2.tar.xz";
       locale = "ca";
       arch = "linux-i686";
-      sha256 = "da9e7f0f9a0730b2a9c4bc467da5f5c2349f98e22f683db02b5651df4a202251";
+      sha256 = "36e14338dc3686949fc391946599b523b83c8bc9638c42ee7fa424ea4f0731f1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/cak/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/cak/firefox-140.0b2.tar.xz";
       locale = "cak";
       arch = "linux-i686";
-      sha256 = "8e77e88d9fc94f819d450ca6c7a78c618d881a97aabae5b997f7a6d69290e29f";
+      sha256 = "511fe4e4dbb53e2df4a76aa7ce83c67405f0f177d275125570b00e909c3dd327";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/cs/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/cs/firefox-140.0b2.tar.xz";
       locale = "cs";
       arch = "linux-i686";
-      sha256 = "a79b45aaf0e6e8f412e21e746265c1d43e7de9046a050b670ba3667b1462c620";
+      sha256 = "56f018158aa318c1ed5d4355b7fdc2de9ab98e45a2e7a86ba330a4b7f4b5c884";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/cy/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/cy/firefox-140.0b2.tar.xz";
       locale = "cy";
       arch = "linux-i686";
-      sha256 = "2a436e2d6a9eba59a8bcb448cb61c5730772e204665416c4c2e04564c19ac23a";
+      sha256 = "7f4a3c45b989379066dc94eb10c609c94efb62706a0ce6238c9f652b18e11972";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/da/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/da/firefox-140.0b2.tar.xz";
       locale = "da";
       arch = "linux-i686";
-      sha256 = "c055660cefb5fe09c71ea087de51efbd4d0b8c2a349f78f2ec5d4349116ad694";
+      sha256 = "d4cbf628409e36837cfdeb25c4815bb48d469d9c21019a87960e904ef2f2bf03";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/de/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/de/firefox-140.0b2.tar.xz";
       locale = "de";
       arch = "linux-i686";
-      sha256 = "e3d546c3a20067ea5c710e6af065bcd11e6ab49a803f730873affa229a1badc8";
+      sha256 = "3cffaf86b35b6c4fc8dafac8817c958247241e617562baab0c099159f4d8445a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/dsb/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/dsb/firefox-140.0b2.tar.xz";
       locale = "dsb";
       arch = "linux-i686";
-      sha256 = "50b1be16d8856605e37078f0cb87bce59f621a76c354a8d64d2f9a68e626405a";
+      sha256 = "ae5ef7bfad006e61943aab84c6b4af62beb4e2caa2b802e5bc7cd1d8cf4ca29d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/el/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/el/firefox-140.0b2.tar.xz";
       locale = "el";
       arch = "linux-i686";
-      sha256 = "7f85663812934905be421c0bc3bb0ebcf22c5a497db7fbcf91a21b8174bdad0b";
+      sha256 = "efdbf60eeb1f6e04aebef7ef6c35d049d4719211d90203c514984dc0f506d2c2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/en-CA/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/en-CA/firefox-140.0b2.tar.xz";
       locale = "en-CA";
       arch = "linux-i686";
-      sha256 = "e5304a3d0557d7ec259e41e989ae191c14e7aa72203eea1ea2c180ba8aec1913";
+      sha256 = "72469319463c7a378e7de8de9cd28f9a64d13ba027aea08caf6cda9db297ad9c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/en-GB/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/en-GB/firefox-140.0b2.tar.xz";
       locale = "en-GB";
       arch = "linux-i686";
-      sha256 = "393f92153a7935bc161badc7d81b23803f1d6cf9ce69651097cbc383056a30d7";
+      sha256 = "593c9812fd7296bae1388d96d8b4aaf75a2f3bfcb6c1a4cb740cb28d5e34f3d4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/en-US/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/en-US/firefox-140.0b2.tar.xz";
       locale = "en-US";
       arch = "linux-i686";
-      sha256 = "8d61639f9b02659fa3486e2f17af815e028e87c373a1770c69e968af3c7c0b74";
+      sha256 = "eff54312f1bfa5f4be53d200cbaea6dd85f41c5cfea83611f9a6977ecc7228f7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/eo/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/eo/firefox-140.0b2.tar.xz";
       locale = "eo";
       arch = "linux-i686";
-      sha256 = "dcd9df03ad825bd50f3b162ebd5bc6561d09688972d7c80af15b10d1801a3fd3";
+      sha256 = "985b855971a03440ad95a69cb0042fb103b146900a7957ac61277b46dde691e4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/es-AR/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/es-AR/firefox-140.0b2.tar.xz";
       locale = "es-AR";
       arch = "linux-i686";
-      sha256 = "cbe7dff319e0cf3d67126565366bf6063536188fb5b2c830e24b2b439d5410a2";
+      sha256 = "a37df3746470d646d2c97775d1e90cec189ae3e487f508fbd84523de7f6e35b3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/es-CL/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/es-CL/firefox-140.0b2.tar.xz";
       locale = "es-CL";
       arch = "linux-i686";
-      sha256 = "225c027d37ea0d6da7f9de2c784ee13db182bc76ea0398ae7dd3ec90b3146b7c";
+      sha256 = "371f39656c30e7c677bf1b57696ef135191bb1b755f152b2df77638cba27afe7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/es-ES/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/es-ES/firefox-140.0b2.tar.xz";
       locale = "es-ES";
       arch = "linux-i686";
-      sha256 = "2b349436c1ce8d99138875f11af5d5210210eaeb39f0dbdea381dafb8c5d4404";
+      sha256 = "7446b7f231a58db5feeda635bffc148ca699a3a3e792737077c177d4b7794318";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/es-MX/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/es-MX/firefox-140.0b2.tar.xz";
       locale = "es-MX";
       arch = "linux-i686";
-      sha256 = "016fada5c527dd9c4c95b6549e2cbb7b3616ec6256c9e30c527f995af1029ebb";
+      sha256 = "b0ffd426095764a5b67cf7757f29aca249205379d2e5505f48a442e599796436";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/et/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/et/firefox-140.0b2.tar.xz";
       locale = "et";
       arch = "linux-i686";
-      sha256 = "57eecae03d4cb2c2e86f2909e82a8e42113f86b7f30eb8711b3a6262e1157b4e";
+      sha256 = "9d67e8f49fedffb0054f6e211f6e43eb63767a0ce9733827f5ebdbb5d501305c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/eu/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/eu/firefox-140.0b2.tar.xz";
       locale = "eu";
       arch = "linux-i686";
-      sha256 = "af2405d4e1db8662e7cc6f212694ab80f607c854ddc707d5322d4a0565227f04";
+      sha256 = "f7902502f184288a7a3d3c22918711e9c7b615aac7e6ee233cefd0bdfcec7cdd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/fa/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/fa/firefox-140.0b2.tar.xz";
       locale = "fa";
       arch = "linux-i686";
-      sha256 = "1170f8ca54cc2eac1a2bdd9a63eee87b29a627d30cd2f06e91e519ac2be2b05c";
+      sha256 = "7929c783bf090082fc51cee3e45398396ade4909237e9ba951c7d07ccdaa0126";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ff/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ff/firefox-140.0b2.tar.xz";
       locale = "ff";
       arch = "linux-i686";
-      sha256 = "bdc3e84a777bba9e664f29cc3e109af18dc40253b0f9b4fba57765b604d4320f";
+      sha256 = "64260c4ba89431f4537838ac0a4ad15aca7f2e771e8f7150f42cd7790be32e39";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/fi/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/fi/firefox-140.0b2.tar.xz";
       locale = "fi";
       arch = "linux-i686";
-      sha256 = "db78665b7ea38f0f5f054949d3045239f6971b827e781bf740650596e7d91580";
+      sha256 = "388366eeed2c2487cbfea71ec8469c317b9b4315fe775e4aa629daf1ca6bee6a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/fr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/fr/firefox-140.0b2.tar.xz";
       locale = "fr";
       arch = "linux-i686";
-      sha256 = "9a41a156bf9c002d3f438c2895e3154ac483a67ebe6f80e0eee2b01b7fd7244e";
+      sha256 = "b5cd62e23ee855775e0529f849936dc0ff949605372e217b9cdb4dbcab135a3d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/fur/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/fur/firefox-140.0b2.tar.xz";
       locale = "fur";
       arch = "linux-i686";
-      sha256 = "56220f6634ea0e7e69a29f07736120b46f2c1911e82df13a842e4101ab0e7cf0";
+      sha256 = "4fe3aee24eec68a7b88c40e23f035848030525b74cf3e17acc81bc84d5c0e086";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/fy-NL/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/fy-NL/firefox-140.0b2.tar.xz";
       locale = "fy-NL";
       arch = "linux-i686";
-      sha256 = "9334756030f7495ee55780665ba0f8587331364ef4221393106194b9ab938362";
+      sha256 = "2efb11fc2c9ac5591828fa237c4f3549ac6a708cc8ddbccb5517f6408c362eb1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ga-IE/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ga-IE/firefox-140.0b2.tar.xz";
       locale = "ga-IE";
       arch = "linux-i686";
-      sha256 = "96a68363e3a6593f3657da4d5add4af443b2db60d30efdcf23485244472e59eb";
+      sha256 = "64e96b326e33d74c2fed43d45c1900d3c90593c9ef8da0ecf15c1b5a509a5f1a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/gd/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/gd/firefox-140.0b2.tar.xz";
       locale = "gd";
       arch = "linux-i686";
-      sha256 = "2a21ee5ca1acca96a81cbd1c0f6f0ce8c3a52ed88ba787d98d6059bbc097e22f";
+      sha256 = "947d98a1333460ef5d722becc2d28599425e4f877c522f2f11bc320edebb8a77";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/gl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/gl/firefox-140.0b2.tar.xz";
       locale = "gl";
       arch = "linux-i686";
-      sha256 = "bd8a9e005ba534d5ab7436f78b02cc84f380bd36a4044a797085f529b23466eb";
+      sha256 = "8f3b052afdbe5371a4d2c87100f005aa1878a06ffae8cbf75dd95cc6003a7d97";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/gn/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/gn/firefox-140.0b2.tar.xz";
       locale = "gn";
       arch = "linux-i686";
-      sha256 = "3d6aa78558ec05bfcab9872160c7ee06eda338aacdf78974022dab4fd047adaf";
+      sha256 = "c9fff849e03704d1324680eb856d01b051e8395e7dea9ee80ceba2ecb1c2c83a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/gu-IN/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/gu-IN/firefox-140.0b2.tar.xz";
       locale = "gu-IN";
       arch = "linux-i686";
-      sha256 = "37a683ae33978ad481ef68f40b3c83f27a85b13aa1b55b905905c2d3ed1ceafb";
+      sha256 = "d1ba1fd9a19556f8d1128d3b6025cd862210d8635f35221ae96a894414c1acbb";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/he/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/he/firefox-140.0b2.tar.xz";
       locale = "he";
       arch = "linux-i686";
-      sha256 = "1916e775b875911d87365bfdbbf549ae728ab674814ac222edb955853a224273";
+      sha256 = "5624f4bc7a3b700e602af22443d40da302fcb604240258c5ff1864a32040421e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/hi-IN/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/hi-IN/firefox-140.0b2.tar.xz";
       locale = "hi-IN";
       arch = "linux-i686";
-      sha256 = "72a3b2387777f16e2b5f8232522d4080a276bf60b853a564f5e70c37d9fd2e3b";
+      sha256 = "d67706f3213f12d475250f0c1ee4d7e618b03bba9130803bf7cea24d5d46e770";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/hr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/hr/firefox-140.0b2.tar.xz";
       locale = "hr";
       arch = "linux-i686";
-      sha256 = "4186afabb2595f717bda2555348fc082ea7167e6c83f03755d925ff2c084a31d";
+      sha256 = "55b89834e35ef17fb1d619a7ac949f0e662531892ea2c0d17fa5f6131e4575d1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/hsb/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/hsb/firefox-140.0b2.tar.xz";
       locale = "hsb";
       arch = "linux-i686";
-      sha256 = "6b12f273ce7cb98e913ebe1785e2271813c351fe85203a8e96558bee3d8b802b";
+      sha256 = "1c112a4996b5c32971ba5d784379ece5bab5f9ff10d3568884f76dc2e985e47f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/hu/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/hu/firefox-140.0b2.tar.xz";
       locale = "hu";
       arch = "linux-i686";
-      sha256 = "f689294ca4226c898df2ebcbfcd60c4b9fb8bf529bc51df60b36896a77b3fb95";
+      sha256 = "748830a3236b3165c25cf4ceb91e99d1c082c0df507e76e49825fa7b8437320e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/hy-AM/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/hy-AM/firefox-140.0b2.tar.xz";
       locale = "hy-AM";
       arch = "linux-i686";
-      sha256 = "c1483077c18d4527053c7d979f9d8abc10710580295056f6fc14ce0034dd0711";
+      sha256 = "f836c11a40efc7cf1aecaa7719713f282d8d983c1df5d747669fde975f9173ea";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ia/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ia/firefox-140.0b2.tar.xz";
       locale = "ia";
       arch = "linux-i686";
-      sha256 = "11829a72579c847b78622bedf1aa6e5af500bf2eebc04bd10cbf8c7ea7790b3f";
+      sha256 = "9b814a6c15a9418f4e412cc265798d630fa2a935fa714db4db17b2916f3dc73f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/id/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/id/firefox-140.0b2.tar.xz";
       locale = "id";
       arch = "linux-i686";
-      sha256 = "2217188bd592ca5c4cc8e2749ea31015861287c59fc14780335e42275b559cae";
+      sha256 = "d47fa1a73c96f23fa169fb0ca4dcf977e4bfe264be21620a61e91776381d09d8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/is/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/is/firefox-140.0b2.tar.xz";
       locale = "is";
       arch = "linux-i686";
-      sha256 = "1ffab05f776dc59104a34baa0164d6de764dc8882f4c7ab2748b59c492823c4d";
+      sha256 = "2c431df3eac6468a456d568e5659d422abf7b529e7405c522b63ab5151011825";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/it/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/it/firefox-140.0b2.tar.xz";
       locale = "it";
       arch = "linux-i686";
-      sha256 = "3e9965d635107eaf2607463508d0da22906bcac4db645dd43708ad885c037ddb";
+      sha256 = "67d030c97665b64ea8ce7c61e9f2f42b1e2f917debbb072887552bd2640aa031";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ja/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ja/firefox-140.0b2.tar.xz";
       locale = "ja";
       arch = "linux-i686";
-      sha256 = "1a971c6f7e1558b6a47ca204a398c5b1b9be44700726b8daf0c0298271b5562c";
+      sha256 = "28a3bdbe49900a2b290a986800665bd610aaba582ed852c7d7c16b36efff4f90";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ka/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ka/firefox-140.0b2.tar.xz";
       locale = "ka";
       arch = "linux-i686";
-      sha256 = "4b7c001d19b96b0254fc3d5760feb2f473014e5ba1602d320fe179d8c8e8e1f5";
+      sha256 = "55871733f141fce7cb20244efa9cce6811e79c45f5f77177de5e9ac48bfd2c1b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/kab/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/kab/firefox-140.0b2.tar.xz";
       locale = "kab";
       arch = "linux-i686";
-      sha256 = "4022280fc975d0fdccfe02ec6ee4159936a9de99ca2eed8d6c496f290a5a6d0a";
+      sha256 = "859ca377458e20fab592010257ab7d10552a8bb60d93d3936519c1b6cb6a82d6";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/kk/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/kk/firefox-140.0b2.tar.xz";
       locale = "kk";
       arch = "linux-i686";
-      sha256 = "06612dc7f831654df0ca60cf3c2ab4fd1e72b4cba16ec496f02528c0fd4fbfd8";
+      sha256 = "1759ea36efa1ccdb77734b0886c00c797356435994fed5747dc644ba0a18a477";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/km/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/km/firefox-140.0b2.tar.xz";
       locale = "km";
       arch = "linux-i686";
-      sha256 = "91ed4c4b6b6f294b8d47b013393bfa48402a63c6f4d2f986947d51729c624f12";
+      sha256 = "f0f9886f6324a6fcce0e76c48457ade4a891f3c38e1a91997b5f97c34ed66e5d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/kn/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/kn/firefox-140.0b2.tar.xz";
       locale = "kn";
       arch = "linux-i686";
-      sha256 = "a4a2e2c5759805640ae3080c563fd0e5ca127e8b5067351928b6dfd10e45a761";
+      sha256 = "7d79b905a38e09d9551e423760ec2ca4e92fa1ef07c676da822567d9e157b400";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ko/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ko/firefox-140.0b2.tar.xz";
       locale = "ko";
       arch = "linux-i686";
-      sha256 = "2e09752b2c02315d79185c86e546f66d314a5c158720e1163132c54934c06ebe";
+      sha256 = "030fc4bde9e14dd0f67c8007827f52dac7a623112b250e39c67ec4621818f2e5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/lij/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/lij/firefox-140.0b2.tar.xz";
       locale = "lij";
       arch = "linux-i686";
-      sha256 = "ebf2dd79fc7c373feaf517f3030bddec4fb22879452cc3abd6192d5868333fc2";
+      sha256 = "2042102cf667d81d62870df30e00cfb6015c7032f6367d2eee65bbc646aaa13f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/lt/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/lt/firefox-140.0b2.tar.xz";
       locale = "lt";
       arch = "linux-i686";
-      sha256 = "71aa1ff3f47b4be838e06bdb791bfa70b638c09dbddae37128c90ff4b4974998";
+      sha256 = "53e504395c32ae53b926505cf3fba5f3dcbae8995eec8657be085200e79bff6c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/lv/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/lv/firefox-140.0b2.tar.xz";
       locale = "lv";
       arch = "linux-i686";
-      sha256 = "90b01be8cb7b2ebddbb2966a45f6ca29a86feb1285db233012ef85f301ca4fed";
+      sha256 = "0924feafc5ffefa07bf2d805ebb3396b8ab565f92714ad438a2077f395dfe3b9";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/mk/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/mk/firefox-140.0b2.tar.xz";
       locale = "mk";
       arch = "linux-i686";
-      sha256 = "f6fa830344486666e46113e5515e1f24a0c32943db3c6bb7f02e5ad3db6de2d9";
+      sha256 = "44c9fff89d42c44ab2eeeed8ac54e9ece3d52ca3f3c05a7cc800f5ae458861b2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/mr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/mr/firefox-140.0b2.tar.xz";
       locale = "mr";
       arch = "linux-i686";
-      sha256 = "2c58107d0ab0cd7c5fa0a4030e047c892808c9d6de05123cd0337ce36e54360d";
+      sha256 = "1740dd34a0d1a0f4b529535473714b016bda43c2838879b5991e43c8ff11eef4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ms/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ms/firefox-140.0b2.tar.xz";
       locale = "ms";
       arch = "linux-i686";
-      sha256 = "8afefb023e6bd415c29f075e484bd0783f5f05f10616d4f191cff8839ce372ba";
+      sha256 = "669c371e0103d0da8df990f002e1f67632de4fe01f4c4fa18c620445176de1ae";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/my/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/my/firefox-140.0b2.tar.xz";
       locale = "my";
       arch = "linux-i686";
-      sha256 = "a713b3d904d5590488141f331d89560b0fe3c163287861b6c709133521aeda99";
+      sha256 = "2a312674d939b1cbffdb708a36d8159c1c7d7ae18fb839952db0a99909e11692";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/nb-NO/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/nb-NO/firefox-140.0b2.tar.xz";
       locale = "nb-NO";
       arch = "linux-i686";
-      sha256 = "40e037728d2697304965ff04db4e8d8206335a7e52866954241766182d9f150e";
+      sha256 = "a8df416206c09635d76ef4b76f194c2044bf7527b187787e46cd445361270c87";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ne-NP/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ne-NP/firefox-140.0b2.tar.xz";
       locale = "ne-NP";
       arch = "linux-i686";
-      sha256 = "32e752b56699102d5d0e65a5fbb2644b7d95059f12c737944a56c9807fcb5d4b";
+      sha256 = "9551f9f3a19efd9827cf8302bdd4ccffd9c84c5bcd34a874bff741a8e2f8b312";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/nl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/nl/firefox-140.0b2.tar.xz";
       locale = "nl";
       arch = "linux-i686";
-      sha256 = "086f26eb82543f2f536b3546782d9531b2367c090244bb3dd7d7b3766f5e3bdb";
+      sha256 = "9766566147c5d4b1c2150258dbbb719d1f9dd971bbb8c81c0b2a1feeeb867046";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/nn-NO/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/nn-NO/firefox-140.0b2.tar.xz";
       locale = "nn-NO";
       arch = "linux-i686";
-      sha256 = "8f7faf5cf79fece9aa05dead8931cc51829399c1e77d865fc7a2e90586ffa68d";
+      sha256 = "413bfb495237e4f7bbcfed9a2a6511c0c9e0ddd84c08c7ebe939675039969b7c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/oc/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/oc/firefox-140.0b2.tar.xz";
       locale = "oc";
       arch = "linux-i686";
-      sha256 = "7a6743d63d6ebd2c8019e5e4431d0251eb1764e5cb4c2bcd2da43489c304e0a0";
+      sha256 = "a51718ea3fcee92b96445f592ad90c51e011dad048c00e547566929968101f2f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/pa-IN/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/pa-IN/firefox-140.0b2.tar.xz";
       locale = "pa-IN";
       arch = "linux-i686";
-      sha256 = "25c72f3a21ca5c1e09b4d6c97fe8ccda39c107ee4ac23c447cd7097d0fdd8eef";
+      sha256 = "98bdcd33a7053afe0a770818337d7cbc358c387f263a6a587065adeab091d5ca";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/pl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/pl/firefox-140.0b2.tar.xz";
       locale = "pl";
       arch = "linux-i686";
-      sha256 = "f1adf8d5eedd479cc763fefd80306a4f400a0b8838b356d223aab85f305c0b51";
+      sha256 = "80d06c0c7d211136e715bc0d708b261da09f17e4182d302ae2c673265251452c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/pt-BR/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/pt-BR/firefox-140.0b2.tar.xz";
       locale = "pt-BR";
       arch = "linux-i686";
-      sha256 = "ca70a854d9930a008fba706f839840408dfd37b7805b1fc686786c7804906c1b";
+      sha256 = "857d512372876071be9741ab69ead9641221578e66b46c08be0bd4b9ceb67ee5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/pt-PT/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/pt-PT/firefox-140.0b2.tar.xz";
       locale = "pt-PT";
       arch = "linux-i686";
-      sha256 = "b81b41f9aca42e313941fe69c2a884118144640f5faa53fb16b21e0d19ffc640";
+      sha256 = "b8b555872fcd6f6dfdaa08f084ca65fbf33d58bcd8419973f2efe25b3d03e5e4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/rm/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/rm/firefox-140.0b2.tar.xz";
       locale = "rm";
       arch = "linux-i686";
-      sha256 = "68b07bd5a6f6adf58851980157e1a04f6a0a069d4418fbf74108eb7101e39905";
+      sha256 = "ca253108c8246320aa47376f5e6dd0663d76c7c05fcb8d156f3d4e236b1329e9";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ro/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ro/firefox-140.0b2.tar.xz";
       locale = "ro";
       arch = "linux-i686";
-      sha256 = "34962c09e2f96ff552733d3e70363989122e58657d85488d215b12aba6a478de";
+      sha256 = "8006f4534e48d7dd26725dd3cd7cae56aff960181f9f7a8e63648c90c3afafac";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ru/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ru/firefox-140.0b2.tar.xz";
       locale = "ru";
       arch = "linux-i686";
-      sha256 = "631f44ac7908c217df544986041576f22afa37ada0b550ceb4f143b68f6f044d";
+      sha256 = "c57b4c19aae50965bd88d0fdece6b999f02885987d2fe52ce251e2cedb175c2e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/sat/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/sat/firefox-140.0b2.tar.xz";
       locale = "sat";
       arch = "linux-i686";
-      sha256 = "f55ed94a407e02de8f519e0db3731c778ae27f53dba62a4d27dea12ee5c69d67";
+      sha256 = "a15d19aafd33c8a95b2fd7e9f35086043e08151255b7eab880918422a2c6c727";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/sc/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/sc/firefox-140.0b2.tar.xz";
       locale = "sc";
       arch = "linux-i686";
-      sha256 = "ecdeba036f6d3c69377b282fc11b16137ddcc97c55d49f12a6497b3ddd857758";
+      sha256 = "9843fc42dec2c3af953736915c4ba815b170276442f679c448ce094bd844d152";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/sco/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/sco/firefox-140.0b2.tar.xz";
       locale = "sco";
       arch = "linux-i686";
-      sha256 = "a9c5742f64b9018906b5fabd9373e5fe8805a447a001acbc3106818f081ff09b";
+      sha256 = "b6991a246b2328c04ddd385ac16438f4e73da1ed9ad2485e3ac322b26e3c3a68";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/si/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/si/firefox-140.0b2.tar.xz";
       locale = "si";
       arch = "linux-i686";
-      sha256 = "3621682261e1243d64012ae5ef4508458ef088a20c097f22d0d3889b2c0fad00";
+      sha256 = "2f93452a96fed41bfbaf5467f33372ebb6b9f6c0ba5ba40cd1f349b8c983e71e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/sk/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/sk/firefox-140.0b2.tar.xz";
       locale = "sk";
       arch = "linux-i686";
-      sha256 = "15ee029ae13f93060ceb44bc032e90062fbeb4e7f1cddd4acbdd8c03187441b2";
+      sha256 = "47e6d512ce895898505b8ca6b7105ddcb6017a1f3b0878dd904244c2826140a7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/skr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/skr/firefox-140.0b2.tar.xz";
       locale = "skr";
       arch = "linux-i686";
-      sha256 = "c61dbb39288239c7620c87d799fd745f02f1e2e4320ce8f44f92aeff38e35204";
+      sha256 = "871e23a7c187230462ebb61550c9083b2d898c5f76160e95913a0fad8f60742e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/sl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/sl/firefox-140.0b2.tar.xz";
       locale = "sl";
       arch = "linux-i686";
-      sha256 = "701b3105c92bf18dc0baa508008c6a9208ba69a67babe16f7404dc50e5b5c822";
+      sha256 = "57db29bc5fd0f98b231338bb256e07953fb54867cf483de08b7b530526f8defb";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/son/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/son/firefox-140.0b2.tar.xz";
       locale = "son";
       arch = "linux-i686";
-      sha256 = "a7b5fb0c9cf055db86b411d5b4d8fe7b154dd79da1e0d23f050bb890e111584a";
+      sha256 = "72873188351e9dd5ba46fb229eff1306713944a45dfb6c96ca24bb5ab4ad61f2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/sq/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/sq/firefox-140.0b2.tar.xz";
       locale = "sq";
       arch = "linux-i686";
-      sha256 = "e88c917629b50cc933daed3134bf61bb9a7021db66d5840c00e179afd22af58b";
+      sha256 = "5acec6030e5705819159886d9a719fefc5aafad0d69b58d3cbcdcda1311264fa";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/sr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/sr/firefox-140.0b2.tar.xz";
       locale = "sr";
       arch = "linux-i686";
-      sha256 = "c06aa97b94fee81c474784e005ea0b87fb108dbc023697caa036e0c8b394e825";
+      sha256 = "74ac1e41660b8127c701b30e616131ba46e87b47665095c0836fb70bc9525d10";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/sv-SE/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/sv-SE/firefox-140.0b2.tar.xz";
       locale = "sv-SE";
       arch = "linux-i686";
-      sha256 = "972103e2717945e1c7f53e6606bbc6b8939f9030a4bcb2d4fc718e230669eaff";
+      sha256 = "62676a28d5791d0bdb0ab45996313442d9ebe8e36a401f1750e3522f2148bbb8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/szl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/szl/firefox-140.0b2.tar.xz";
       locale = "szl";
       arch = "linux-i686";
-      sha256 = "04adc5b6186a5af52d0e49dfb798bfd7da80553cd284763b5affc471dd1e8328";
+      sha256 = "89c2be0bfcddaa8c44bfca3ab3c91f9c257b1ecebcbeacea203673f4a4e0edb8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ta/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ta/firefox-140.0b2.tar.xz";
       locale = "ta";
       arch = "linux-i686";
-      sha256 = "44934dc8cc75f9e0d96812ad7f60de98b1fc7f2008926afa61a3ac81d3c43977";
+      sha256 = "6df705686cc62e94fff63e1eea2c962e6ac8e45c797755809f4ef7657e97f489";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/te/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/te/firefox-140.0b2.tar.xz";
       locale = "te";
       arch = "linux-i686";
-      sha256 = "a65484fff230858c4f0ce1c8554928e469fe06c5c0eb941217ba770a15cf3762";
+      sha256 = "011478d18c5a07bee2dc417a618be95ed94b10f9e97c315c2114405219f4f633";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/tg/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/tg/firefox-140.0b2.tar.xz";
       locale = "tg";
       arch = "linux-i686";
-      sha256 = "78ea45f86204077dafa932bc892159ae11bf1bf8f32a86b9bb79742944115250";
+      sha256 = "bf71f9da12c8060543ebe48ebfdcc6e2e16a8b86b930a138a7a35996d6308974";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/th/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/th/firefox-140.0b2.tar.xz";
       locale = "th";
       arch = "linux-i686";
-      sha256 = "937d5f0858d4701a739557a54df30dc20ed3dfa0c92d9c08909b64c57ee34dc9";
+      sha256 = "f8c6c9c5a8d51df500f463cab3951addd59a11eda3bc92228d9c42a56c3883a5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/tl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/tl/firefox-140.0b2.tar.xz";
       locale = "tl";
       arch = "linux-i686";
-      sha256 = "977abd61324f94d41a030ed8affb6d7c99a9f44cd89df35ae5e075ff746e3b45";
+      sha256 = "45c02ae216dfbff769daf7236a31d4efd7aaca3b419ed037d3250b2a5c03658d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/tr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/tr/firefox-140.0b2.tar.xz";
       locale = "tr";
       arch = "linux-i686";
-      sha256 = "a9de20042a68a2afa8726b31da47e950a5fb1578a9f1c3855fe04700dd3461a5";
+      sha256 = "ff6ab57920b494349951ba85e1e604f135a6b706a89d26a93ec5945ebba7932d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/trs/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/trs/firefox-140.0b2.tar.xz";
       locale = "trs";
       arch = "linux-i686";
-      sha256 = "7de7776812f6188e1b88aad5293f1472975356c989bb6dd61b53d634c1595d9e";
+      sha256 = "e3999c0c31fa0c1210cbf52ae4a936ee08d1cee6a53e9f6a2b294167317bed99";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/uk/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/uk/firefox-140.0b2.tar.xz";
       locale = "uk";
       arch = "linux-i686";
-      sha256 = "ccc2e770e91aed87bf1690dd82e52107ef49efe2062cb08ac4a4e372b097770b";
+      sha256 = "85af79aed55ab6b5f5f700540bd0a6d382195cbf0f7749e21a9705fc9cc2fc66";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/ur/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/ur/firefox-140.0b2.tar.xz";
       locale = "ur";
       arch = "linux-i686";
-      sha256 = "1e61bbf085a439b6a51add991499e582a58f50453c2018d15548f0ce50f95191";
+      sha256 = "8efb1afcb3555911be2816f62db5d2d2115f416804064f4a7ea016d368605bce";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/uz/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/uz/firefox-140.0b2.tar.xz";
       locale = "uz";
       arch = "linux-i686";
-      sha256 = "7b4120e694d31a901d7e9224ca42034db85f27f9062463f1fbe7aa8dd7afcfd6";
+      sha256 = "bbc614544c7b2272e812ea8ebd058adef37bc905bfb989e28259c270d837eda7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/vi/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/vi/firefox-140.0b2.tar.xz";
       locale = "vi";
       arch = "linux-i686";
-      sha256 = "9798b0741ff2e5eb5eadf5234d54fc5c2e473ef3d093079b7b6ac23518e06404";
+      sha256 = "f6d77d1d12ebcd17795be230395f42f8499ae4fd2c954d96a2fea50102141bcd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/xh/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/xh/firefox-140.0b2.tar.xz";
       locale = "xh";
       arch = "linux-i686";
-      sha256 = "17e717b6a62c34d7f0e74b9c6b4af4e04e0bb9e6e0624b5691f1762c8ac734ab";
+      sha256 = "06427fbd032094695659c8aac0b7d48b8ac49207750c72a20bd96516a086e3e9";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/zh-CN/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/zh-CN/firefox-140.0b2.tar.xz";
       locale = "zh-CN";
       arch = "linux-i686";
-      sha256 = "a32bd1b70bfb1c5fdcf33d0c4413fc1f3d4c7c1b355e06c1e7fa571657078682";
+      sha256 = "afb4e3d700f9c67efe6ca59e1baf98dcbe014f9abcae6aa3326a94f47540556c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-i686/zh-TW/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-i686/zh-TW/firefox-140.0b2.tar.xz";
       locale = "zh-TW";
       arch = "linux-i686";
-      sha256 = "0ee631ecf8b7de2ffcb9a77aba4e4dd20cb62f2a1aab53650c1c12b39c5b48a2";
+      sha256 = "1eb8189e613d855bdb4da3d929fa59ae00c87c7ce4caf26e242b77dfe4ef9e46";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ach/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ach/firefox-140.0b2.tar.xz";
       locale = "ach";
       arch = "linux-aarch64";
-      sha256 = "d754b7c77338934ad9c988af0ca76c20b9d0eeb9f63beb9423d48902cf39579c";
+      sha256 = "7cd042bf81247ca4bf869772140a28da2cac0f38336c1b21774753ef0935c252";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/af/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/af/firefox-140.0b2.tar.xz";
       locale = "af";
       arch = "linux-aarch64";
-      sha256 = "9e3893fe70cff031562b1f9b6d1a8651a591d050a02733126d00d24c8d676bf2";
+      sha256 = "0b46b672ec0ba920946e8a19b66c4c15618457fa0d70f80283e9339efe919b88";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/an/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/an/firefox-140.0b2.tar.xz";
       locale = "an";
       arch = "linux-aarch64";
-      sha256 = "01055cd10e6bb1e963a7b7366233faf8d2951318576a02a9f1e81aa7a1c4c50b";
+      sha256 = "cc4e3757e933755b79c35946f87b88a4dd0e9fd68ad8391e2f0a1ec758707c35";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ar/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ar/firefox-140.0b2.tar.xz";
       locale = "ar";
       arch = "linux-aarch64";
-      sha256 = "d1cd5710aee5418d9c903f195d96f2fff01bee31875877e737399c9f4479e056";
+      sha256 = "7ca7a1330d97c5c2d242dcb9b0681768cceabbe931796d78d1db4e434c555cc9";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ast/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ast/firefox-140.0b2.tar.xz";
       locale = "ast";
       arch = "linux-aarch64";
-      sha256 = "55834b6c054928aa733035366c5b45ad19503f03730001d70a41ba6510d5bd72";
+      sha256 = "67976e71bcd80adbfd9e5910708ebba978a1ec02db046b209bee54c0e9fe4e7d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/az/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/az/firefox-140.0b2.tar.xz";
       locale = "az";
       arch = "linux-aarch64";
-      sha256 = "41c91dba441d06e022af5e90d2d8e77e2051e09e1cb4cec1a5fcb4bbc93dc97d";
+      sha256 = "f99cdbb0b61406a82b6d31e87a5ad60cc11b654ba20199eef7e6ff6a0211e0b2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/be/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/be/firefox-140.0b2.tar.xz";
       locale = "be";
       arch = "linux-aarch64";
-      sha256 = "be5610c2f38693dd6a1f8c4949bb8df06e201f4e769b986df4b3e404d9a0e494";
+      sha256 = "baa9da20ff4f0cd15f67ca190982a26ab45635a83d6fb2a60a0c537cdf3f0d9e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/bg/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/bg/firefox-140.0b2.tar.xz";
       locale = "bg";
       arch = "linux-aarch64";
-      sha256 = "8bd908287a0c2871839dfc027e0e6279218addfdf0de06a62b4018097375e2cd";
+      sha256 = "493851b1cdeba502582e3f311858296883637763c6b3875c4e2c8fe1832726d0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/bn/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/bn/firefox-140.0b2.tar.xz";
       locale = "bn";
       arch = "linux-aarch64";
-      sha256 = "f74f9db667a9774b4c3eae709facd5a33b432cbf18fb72365c57ce0ce9e8c1da";
+      sha256 = "7ecad658638c5b4357e06043c33ede20870f50055f3840fa76e0829341e8ed2e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/br/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/br/firefox-140.0b2.tar.xz";
       locale = "br";
       arch = "linux-aarch64";
-      sha256 = "a00ab0024862e999d7d739722f441b2b63368ba227346fee3e9bc80c31807771";
+      sha256 = "90cb3c30c226a64ee8e04c89ba4511741b788a08c29305e4bd37f15c568c0790";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/bs/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/bs/firefox-140.0b2.tar.xz";
       locale = "bs";
       arch = "linux-aarch64";
-      sha256 = "39b8da8c52d4fa01498d9684e0f80d2431ac029e72ca39ef431533333b4318a0";
+      sha256 = "359bce9cb8555fcfd5e3782755345c74a023fd5196629993b9c7ddb4c159d29c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ca-valencia/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ca-valencia/firefox-140.0b2.tar.xz";
       locale = "ca-valencia";
       arch = "linux-aarch64";
-      sha256 = "de6ec7c3bfffbfb4f0783ab91c708449f0f90dc21d412220044715e56f209469";
+      sha256 = "d0c0a903e7f49cdd4e7abbc010362ef7f9f94f0ddaede5c073b7d5ed492c8b4b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ca/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ca/firefox-140.0b2.tar.xz";
       locale = "ca";
       arch = "linux-aarch64";
-      sha256 = "43a84887bc56e8e775a1fc77238a9a5b311a3922b342c0b8937a10864a58e1df";
+      sha256 = "065d8a4d120a5f6bcdc2aaf598e96950b87439b3f091c6ab45ba42c42d9dc493";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/cak/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/cak/firefox-140.0b2.tar.xz";
       locale = "cak";
       arch = "linux-aarch64";
-      sha256 = "b781db306b99c87420a371d5504505613258001326341e12d53cad1c6d22eef9";
+      sha256 = "f1e95e51e3c73a2c28632e3f23d53d3aaf1211d9db640b8c110eaed94a97ff8b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/cs/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/cs/firefox-140.0b2.tar.xz";
       locale = "cs";
       arch = "linux-aarch64";
-      sha256 = "a0e7e2d60296d59eb438d67e9e6f7e7397cec1ced5b8eda1210e244fa10a0205";
+      sha256 = "1cabba2333c315ec8a8ffa64609ffdaf3664428b6f109dfbb3f9bcefe6a08326";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/cy/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/cy/firefox-140.0b2.tar.xz";
       locale = "cy";
       arch = "linux-aarch64";
-      sha256 = "c985bf38fcb61a264e3e7cefe00ba90bdb935009546533bf018d4bd173b88c60";
+      sha256 = "aeaea449bd1427315022606358eda4907a611248ee48cf94b8936c68067f93cd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/da/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/da/firefox-140.0b2.tar.xz";
       locale = "da";
       arch = "linux-aarch64";
-      sha256 = "31b86f8656a3c5a92439457714d2215481e175718dad2e71a0bd12cb9d8d53ab";
+      sha256 = "baccce03f5a023e9c4db5c786416108d1e9a3b34f8e224c11b0c50089b5044b1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/de/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/de/firefox-140.0b2.tar.xz";
       locale = "de";
       arch = "linux-aarch64";
-      sha256 = "2931c7cdfbb9113176130df3551731c1313c06168257a1e1a393a4d8c71fc648";
+      sha256 = "cc7f6ce82a0c27854cc0b2c1aded7f589c29e73741746fa3a9dcad685ddd8b62";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/dsb/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/dsb/firefox-140.0b2.tar.xz";
       locale = "dsb";
       arch = "linux-aarch64";
-      sha256 = "e4970af22566a2c423138dfc68a7d58b58e7d3284e88f4c7f3e9d00940739cf5";
+      sha256 = "0a3aba29ef00869e8a543e5196188c42ca87331df9b283d61238ba1a8a724f3a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/el/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/el/firefox-140.0b2.tar.xz";
       locale = "el";
       arch = "linux-aarch64";
-      sha256 = "b12bf7bbb352c7b34d9bfb11478a0ae7717325f4807c2baef04aa4f250400a90";
+      sha256 = "d87b9a60fa65911acfe8535ccb1c8d4e6cbfad290d9979692cc7899ce0ac6b38";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/en-CA/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/en-CA/firefox-140.0b2.tar.xz";
       locale = "en-CA";
       arch = "linux-aarch64";
-      sha256 = "09e94e0803a321b313a740036171cb59e049a826e737a4151713f072c797953d";
+      sha256 = "026ad7b1f2b3b746c85a31860910ae1487e0871d406b63ffbdb87e374c517bb4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/en-GB/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/en-GB/firefox-140.0b2.tar.xz";
       locale = "en-GB";
       arch = "linux-aarch64";
-      sha256 = "cf6922dd5832202593dab94022f82e91af46685f8c16cdf92ee6fd2665ac225c";
+      sha256 = "f26d62c55973c679153ad8b2378c00a28b068748db76c38c61c9aee03aa7bf96";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/en-US/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/en-US/firefox-140.0b2.tar.xz";
       locale = "en-US";
       arch = "linux-aarch64";
-      sha256 = "4edba8a869dfe9c906649b5e7989748490665e99599b44c653c2fbe896f268e5";
+      sha256 = "fb8905d9af83f43bb09b453a0fbd85e23adc70eefa07efcf015395a534140450";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/eo/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/eo/firefox-140.0b2.tar.xz";
       locale = "eo";
       arch = "linux-aarch64";
-      sha256 = "8ce7a3c2d44ec47d0c76a896005cc485a5e325f5991a50833e244cf69b8a7645";
+      sha256 = "347cbb9195e8012d39d18cfd8ada8302a5f5746674bcff21c68926d93edcbc35";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/es-AR/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/es-AR/firefox-140.0b2.tar.xz";
       locale = "es-AR";
       arch = "linux-aarch64";
-      sha256 = "d1c49d9227b3d9e27e73f9788171c718c73829c077040520b05dc9b9a02cc839";
+      sha256 = "c3e04df1298513e487072a6bb5eda83e3921f3217408cb0f86f33c6a52bcc7e7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/es-CL/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/es-CL/firefox-140.0b2.tar.xz";
       locale = "es-CL";
       arch = "linux-aarch64";
-      sha256 = "79c5b47dc1962faec8ef4db9860698a160b2e724145dbc3520a3b179073d2aaf";
+      sha256 = "040bc8601a976587a173a5d82b4b3ed7474dc6d274e1be504fd516eacb951174";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/es-ES/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/es-ES/firefox-140.0b2.tar.xz";
       locale = "es-ES";
       arch = "linux-aarch64";
-      sha256 = "c3ea8d8ca383dc7271537b5fb888ea0c155c94b0f1a7988a69359d4930b1624c";
+      sha256 = "ed4197fe2d0279979e879eda7f51a5f3bc19b161ba0e6a031f6cea2cb22b5229";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/es-MX/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/es-MX/firefox-140.0b2.tar.xz";
       locale = "es-MX";
       arch = "linux-aarch64";
-      sha256 = "fe673d9624ff97fafb5e41d4bbcb0142d24051201fcdd58ddf8863b0a169010c";
+      sha256 = "290ae698fca93612144db3d7821b38a9a7708ba1bd9aacda09f9efee8e5a2fcd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/et/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/et/firefox-140.0b2.tar.xz";
       locale = "et";
       arch = "linux-aarch64";
-      sha256 = "721727d911c456833e9207f35b5fa574561789eb9d5aef2cf70c07a41996604f";
+      sha256 = "7b174a91b10efbd8d5628ea29d95a4dc7dbc986ae64dc5c7709df3f7a9aeb113";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/eu/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/eu/firefox-140.0b2.tar.xz";
       locale = "eu";
       arch = "linux-aarch64";
-      sha256 = "c1d51c11fe6eb6b74a1170e93ceb910aa01b227ff67181a436abd9a272f4006a";
+      sha256 = "36ee14d1be91e8aa663439cd08f71ec6bde8e4b13f5aaf4a17f95df4080b4e00";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/fa/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/fa/firefox-140.0b2.tar.xz";
       locale = "fa";
       arch = "linux-aarch64";
-      sha256 = "d48577e912bc8d9302164ce233c02bb0d1a802bbf6923d2f6e3e40466753e7ef";
+      sha256 = "1b538780607b5fcc3a153c4198a0ea086b245c4c6f246561179d5aec98e6032d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ff/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ff/firefox-140.0b2.tar.xz";
       locale = "ff";
       arch = "linux-aarch64";
-      sha256 = "6397792fe1f9b6cf9e074f6dbdc620d2bb9e5a81cd9203a6b9e19d8ebe4af951";
+      sha256 = "64362226245b8694ef956f4bd3d285c45aa5f7a31830c043fe23b96071e09280";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/fi/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/fi/firefox-140.0b2.tar.xz";
       locale = "fi";
       arch = "linux-aarch64";
-      sha256 = "8f5c2ca086de1cda97c4383b0032cbe134a4af7231def94e19abdcf794d3a858";
+      sha256 = "1f810aa9a14a0f47c48d2a485397d8164c71f9a833cea682949d582ac30c4091";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/fr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/fr/firefox-140.0b2.tar.xz";
       locale = "fr";
       arch = "linux-aarch64";
-      sha256 = "cea552b5a870c9a0842dfc56bde4d91927fbc40cef6a1f0e36d0399b65ceac7a";
+      sha256 = "2861e18226f50259f0ec8426e419c93b268c2e9113c0cae1a3d4923dd906c139";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/fur/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/fur/firefox-140.0b2.tar.xz";
       locale = "fur";
       arch = "linux-aarch64";
-      sha256 = "baa9819189ba1ff16efeeb80052f6d0afc2306a09757630e978c4a92a74147d6";
+      sha256 = "42e8d9e6582267a374246cd83cb51a71dfb24b5c54d5b8230dcab93d47e89ecc";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/fy-NL/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/fy-NL/firefox-140.0b2.tar.xz";
       locale = "fy-NL";
       arch = "linux-aarch64";
-      sha256 = "c1b1b141ced5a635383e2e0066f36c56b852e0e44842e86b684d6ceb8209aa4a";
+      sha256 = "5ed467f0a335d41d82007f39b078c60e244faa7f7614e3386991f7e687fc10dd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ga-IE/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ga-IE/firefox-140.0b2.tar.xz";
       locale = "ga-IE";
       arch = "linux-aarch64";
-      sha256 = "6a9348174c586c70f55d77ac9076c203287590eed6254b3d1eeed9cc8424b076";
+      sha256 = "edb53eec33ed84ead0b00d90930c9e0d93cf7f95835f003884190a6379d61664";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/gd/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/gd/firefox-140.0b2.tar.xz";
       locale = "gd";
       arch = "linux-aarch64";
-      sha256 = "c6f367eced3add25b7a51b8eb1d55b42d7cd5c674cc934c33fa9de86d6ef5c81";
+      sha256 = "dabd8721dbe812bfe349d89011317bffeb2eb8578dfd580e97fb962c6b234ccf";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/gl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/gl/firefox-140.0b2.tar.xz";
       locale = "gl";
       arch = "linux-aarch64";
-      sha256 = "30fcda0e983a655e8f0a87f40bf1f7e877569808b4b0e6710e58d446ec3913fe";
+      sha256 = "4c2cedbd7c26cbdc2869a5186ae3e766c27f059a5be4b745f91cb3b7d334c1de";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/gn/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/gn/firefox-140.0b2.tar.xz";
       locale = "gn";
       arch = "linux-aarch64";
-      sha256 = "9c458bf9d63fec82a51b92391bc7d7b3030cce9e6228f14d5d5cde80c577349b";
+      sha256 = "557eb831214ae85f8954b609fc6c381c7334a6c8fe98c98f0b5ab5d6e3afd9d4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/gu-IN/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/gu-IN/firefox-140.0b2.tar.xz";
       locale = "gu-IN";
       arch = "linux-aarch64";
-      sha256 = "92e5e135ac587dd6b7bea7a4df4803eaabf509a55b98ec2a127af3293a10c048";
+      sha256 = "937e4455d075a52b5dc546840a7be025ab14266d36c287dbbfa415f9db5edb38";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/he/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/he/firefox-140.0b2.tar.xz";
       locale = "he";
       arch = "linux-aarch64";
-      sha256 = "ec64a5e068e2223c95ac1c90531ef9d857fa72f03a5b4b200242029b661344e3";
+      sha256 = "2a660ac10700d2d0c8e223a7e7ccc641923e53001a9ed8f523126766919e3694";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/hi-IN/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/hi-IN/firefox-140.0b2.tar.xz";
       locale = "hi-IN";
       arch = "linux-aarch64";
-      sha256 = "434c8bfea7979d256f40f3f3766c1230b8a403678893ad988b54c19188ca82be";
+      sha256 = "d2714b679ca967305693eb28655127e381ad7a4adf7e8dfc09c4ebb92385ac61";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/hr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/hr/firefox-140.0b2.tar.xz";
       locale = "hr";
       arch = "linux-aarch64";
-      sha256 = "59d09b703c2ed3dc3e289310503e505507b345b1c5b2133da6ce59df9f952b06";
+      sha256 = "8c42af036a26589817096562c089d62c035726be61137b04de137e72fbe0f784";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/hsb/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/hsb/firefox-140.0b2.tar.xz";
       locale = "hsb";
       arch = "linux-aarch64";
-      sha256 = "55ac7f1a2a6b00118aae7d3acab31a563cf05a23e4f35389795cdd7afd613b6c";
+      sha256 = "8233a55b9d57fa591fb5b6ced9163c9e1ad3ac0efc16106f7900e0938b9bc505";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/hu/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/hu/firefox-140.0b2.tar.xz";
       locale = "hu";
       arch = "linux-aarch64";
-      sha256 = "75265bbd21c0c783c373f2ff57dfaebedb3baa8e8f635adb764d00ae340df15b";
+      sha256 = "e36fcfe99e3885cf8eaff441d917f8b714314688484ed31bc82061eba6cb78a5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/hy-AM/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/hy-AM/firefox-140.0b2.tar.xz";
       locale = "hy-AM";
       arch = "linux-aarch64";
-      sha256 = "825bb3ab555455af7204fc3081d4e881bfaad7272b97c7a52d574711ac6fce43";
+      sha256 = "caa0557f2ba798d0d0d0b2e1d2b084079baf1203bade06c580062983fa53fde4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ia/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ia/firefox-140.0b2.tar.xz";
       locale = "ia";
       arch = "linux-aarch64";
-      sha256 = "07b43f7d3dbf12f9d8a9a4b2d393b0cc9fe3ce0d333431b9d8c694abf2948607";
+      sha256 = "66c4626de30fca547e690fbae7ef8d665f138548ed29b973630c1e5fea8cba1a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/id/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/id/firefox-140.0b2.tar.xz";
       locale = "id";
       arch = "linux-aarch64";
-      sha256 = "bf34449bee65bd3bf8ca7568683c111e19af99323970f6070bac75ae5d8df14e";
+      sha256 = "afeb6eb9c996a7f6bfe93c2e0606f29af90b9d46d9a35633ffd6218b76dd367b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/is/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/is/firefox-140.0b2.tar.xz";
       locale = "is";
       arch = "linux-aarch64";
-      sha256 = "4b825583d13bf6f4b75cba352d1bf0eba3ab97c92f62da2c16aae79174f6f185";
+      sha256 = "ddf3e0190f6ded182ed3d9cc80cb3456d2251f5a3a5af42a4eee4d6144cb04d5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/it/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/it/firefox-140.0b2.tar.xz";
       locale = "it";
       arch = "linux-aarch64";
-      sha256 = "2dff0bac0c85f40cb21103c48e0489573cd12a21078b8edc5af5cfd6c1c5be9f";
+      sha256 = "cd16a0d3b70e4e746f2d5a19ce448b4c8f3761e1b4879c6fb50902e5779f73b7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ja/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ja/firefox-140.0b2.tar.xz";
       locale = "ja";
       arch = "linux-aarch64";
-      sha256 = "7012be903c3b748178a4bdd87849251f01bc341bb1d418e43c15adb8a5236697";
+      sha256 = "2761071a3916fdaf81608d12fc7356450c4abc27fe2315d7ae1768b048751a85";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ka/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ka/firefox-140.0b2.tar.xz";
       locale = "ka";
       arch = "linux-aarch64";
-      sha256 = "bb7b562895a31c2985e5b57dcd697ea65e0627c3ca92a7a1031de12d88f2d112";
+      sha256 = "2fa470435b4e3ecd4389639b135f840f2869ba1f997e495d5b7ca3b3b472a14e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/kab/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/kab/firefox-140.0b2.tar.xz";
       locale = "kab";
       arch = "linux-aarch64";
-      sha256 = "534d152fd21b7206fa1d781167d2d39114224e694cd6e0ce0df0c51f632be8d9";
+      sha256 = "23a15e2d7667bb0cad5069a555ce7eb5ebd647d01dcd5b5008df5dd3a25c41f4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/kk/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/kk/firefox-140.0b2.tar.xz";
       locale = "kk";
       arch = "linux-aarch64";
-      sha256 = "c914ef270be6d93b244e77eae73f0b8dc81ccae98d1e5648c9f36df3534b5b83";
+      sha256 = "c9ab7d7695204eab0aaf2d395484df8331dcdd5a2d3cf7bcc2ea544e5877443f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/km/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/km/firefox-140.0b2.tar.xz";
       locale = "km";
       arch = "linux-aarch64";
-      sha256 = "4c4b716afcad883b4c3d4ef98f256fd3a7383c6f6f9daf004ed57dc66c9cc1d3";
+      sha256 = "6740c9921ea366cae10b37b3c5de4076f1f1710b4169030c68be12b5070c633b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/kn/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/kn/firefox-140.0b2.tar.xz";
       locale = "kn";
       arch = "linux-aarch64";
-      sha256 = "bf36d322be0eb143d16b3266f468218e4db77edf5752d92d0527737d5699bead";
+      sha256 = "938558327b5c687bdebc00007467cc911084ed13d347b3dca50bd4064a1ed0a3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ko/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ko/firefox-140.0b2.tar.xz";
       locale = "ko";
       arch = "linux-aarch64";
-      sha256 = "d306fe18f0afb856b5eca468cadf0661a0f296900aa213693f9dfce7ce01e693";
+      sha256 = "d610e561841fa970c6be608a25f030e7bebc0812b674c65e1f32e0f3a722f494";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/lij/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/lij/firefox-140.0b2.tar.xz";
       locale = "lij";
       arch = "linux-aarch64";
-      sha256 = "4134c5b66369b7e7baaf9ed18e686aec1f6fba8dabfcea557c8801e271099604";
+      sha256 = "3f8a986918ca0504c5f7e16996d62e52a59ae812aa10b521c93f71e5495a26f1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/lt/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/lt/firefox-140.0b2.tar.xz";
       locale = "lt";
       arch = "linux-aarch64";
-      sha256 = "d02e63dc5244755d70d7c6adf8809e809ad5624b5b2cf7db5d549fe873c8e030";
+      sha256 = "41c516c24cbdb6c3953cd378272039c8cbd92c4dfcd45e807224dee8ead1edad";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/lv/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/lv/firefox-140.0b2.tar.xz";
       locale = "lv";
       arch = "linux-aarch64";
-      sha256 = "49906a5a4bf59e755de8002436a431adf3a26ae70865a5c14cf2b1148d67be46";
+      sha256 = "fee89b89b07fdb6de208967bdfdf0cd09ff47ef4b382b5ff6dad823e2038f3bc";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/mk/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/mk/firefox-140.0b2.tar.xz";
       locale = "mk";
       arch = "linux-aarch64";
-      sha256 = "d0baccadc36ae94f9038e2c22b0a90d2084c512b71471af4e8f744548c92a79d";
+      sha256 = "fc713d3a275cb918aac2960e5d02ed55c1e53a588cd1d7b3072ce4ef1d322010";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/mr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/mr/firefox-140.0b2.tar.xz";
       locale = "mr";
       arch = "linux-aarch64";
-      sha256 = "f8015e7594ec2b02914884f5be2d50f2cf0236bbe496fec731592ac81eeeb9a9";
+      sha256 = "9770d1c413bb780ba5734397fc44a4a750759fafbf092baa2dff9b0ca03f3778";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ms/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ms/firefox-140.0b2.tar.xz";
       locale = "ms";
       arch = "linux-aarch64";
-      sha256 = "fd820b03aebcfda8057f630f881c49d443f14661a6bf55ddd4b9a26b4cdb9308";
+      sha256 = "c0b6fcb678b449c2a7341fee0602591178dc3f783ad914f5e2e1fde3b3889dd3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/my/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/my/firefox-140.0b2.tar.xz";
       locale = "my";
       arch = "linux-aarch64";
-      sha256 = "f2286cf08af4be1daf434cfe972049f40ed68b1d59a0073c0f022c9f02dee1ca";
+      sha256 = "af5a3b599a09708b6981cb3079e3b1512ab3f271c09f506c953b39936e6e0952";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/nb-NO/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/nb-NO/firefox-140.0b2.tar.xz";
       locale = "nb-NO";
       arch = "linux-aarch64";
-      sha256 = "668569c1fccef37f1398b1ecd9e9974081e6c055edd0577bc464fde69e5e7ada";
+      sha256 = "0c6dd74781697f69a8cfd7b657e8971d2272f0c2c7c37efb5476a3c6d226e8d4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ne-NP/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ne-NP/firefox-140.0b2.tar.xz";
       locale = "ne-NP";
       arch = "linux-aarch64";
-      sha256 = "6ce7d8b5d852ca4abd94fd8505e52a2482b5b1ba207d48fd02dce6f585ef0fd6";
+      sha256 = "22c46f8ecc726cb41d302149b6ee4816d8e5f4afc3322ce6a38621f0edfcfc55";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/nl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/nl/firefox-140.0b2.tar.xz";
       locale = "nl";
       arch = "linux-aarch64";
-      sha256 = "b57bac3e8a06c66f93f7c98a77accfe6a21661d6bdfc148cb2d8f3ce83bdbb80";
+      sha256 = "c19785a813e1d190ff83eae04d02c6647e5423d9e3dbfa5bbdbc124aa20c0b01";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/nn-NO/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/nn-NO/firefox-140.0b2.tar.xz";
       locale = "nn-NO";
       arch = "linux-aarch64";
-      sha256 = "01ee287813e78d073926bbeaab9cafae2a11e9239f8da1db3c45b5d6168a5f8b";
+      sha256 = "1f5e90790da565b4e661726b11fa2d07a006c25d6ba41557e20cd8fc53972e7f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/oc/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/oc/firefox-140.0b2.tar.xz";
       locale = "oc";
       arch = "linux-aarch64";
-      sha256 = "7af2c95d9d6c9241fb98dc21a4c542f6e038098eca89a72aad53d03d834cf8d7";
+      sha256 = "8280752b38cf4e19ea5400ffe96c370888df59999be3ba73a6ff358df55eb973";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/pa-IN/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/pa-IN/firefox-140.0b2.tar.xz";
       locale = "pa-IN";
       arch = "linux-aarch64";
-      sha256 = "c109cbbfc292aa3ad04656c79ee5fcd0b839032fc156499dadb60aed37d93c13";
+      sha256 = "8496cd59b2f13317622e23e3840a086f70217566bade2b749288d884f6d08326";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/pl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/pl/firefox-140.0b2.tar.xz";
       locale = "pl";
       arch = "linux-aarch64";
-      sha256 = "ad2ee57783e372d968b9a76b4b0c5f4cf039e53f6ab8ab5169d556bc9733b04e";
+      sha256 = "466931bbf9058183abe611c927a2bf147e254c84f159a9c1c528bae40d8b62e1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/pt-BR/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/pt-BR/firefox-140.0b2.tar.xz";
       locale = "pt-BR";
       arch = "linux-aarch64";
-      sha256 = "c4b649b39622a0cdd8afaffdf531681659ae6c092221786df71ada4f8e5dc81f";
+      sha256 = "3c9cdc685156255ad8cdc5e557a3c58de63c3d3c1293c92ea816b2abcca69863";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/pt-PT/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/pt-PT/firefox-140.0b2.tar.xz";
       locale = "pt-PT";
       arch = "linux-aarch64";
-      sha256 = "d84337d337c87390e8ac98f43d8b1199d3b8bf640d55ddd2eda86f3c6c2f9084";
+      sha256 = "b89c7c4d38f667b70ea74e66cb052525e692829a001b0415387f806021ceaf54";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/rm/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/rm/firefox-140.0b2.tar.xz";
       locale = "rm";
       arch = "linux-aarch64";
-      sha256 = "a8d422e2ebeb5c76a27e3df7dc8ca4052be628022d3d7df38255aae4b14089d7";
+      sha256 = "47595af5bf7ad9e8ccd76abe627037bad388bb733b625cd9200414fbe385bad1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ro/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ro/firefox-140.0b2.tar.xz";
       locale = "ro";
       arch = "linux-aarch64";
-      sha256 = "4b222f477c9291a0ed28dd51f57588914e26efd69c0a249cd2f4a3251ef2b3cf";
+      sha256 = "48cc3b4168318447044806f63dd4ab2d84aff91ed3315846df63ad9dfdf7e0a5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ru/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ru/firefox-140.0b2.tar.xz";
       locale = "ru";
       arch = "linux-aarch64";
-      sha256 = "caa6d2698ce1e5508f5fad2bf90563b10a8f9961042c089f2f1a5e4d61822246";
+      sha256 = "2413517aa76e06fcfb7122c949ba8acca175201ae338b8425eb28a5ffc2ad253";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/sat/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/sat/firefox-140.0b2.tar.xz";
       locale = "sat";
       arch = "linux-aarch64";
-      sha256 = "3f17440f5a67e6ac0f7f0a67eea72a4beae7c20627ba97c786f4740563adb4ff";
+      sha256 = "802f635513658ff4c9f146b7988763bf363e9676c7c3c8edaad7d15e99baf22f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/sc/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/sc/firefox-140.0b2.tar.xz";
       locale = "sc";
       arch = "linux-aarch64";
-      sha256 = "3eb57781a60c295918d7f065edc1429bcd2685f01398c3176fbfd097bf88e059";
+      sha256 = "4b88d2609d1fd79ca3ec2c0e5f6f8313953a79ff321df92a66aadc0150001635";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/sco/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/sco/firefox-140.0b2.tar.xz";
       locale = "sco";
       arch = "linux-aarch64";
-      sha256 = "a6c32b5c1d63728429ada5211857a49c056ce93b23d428f26a8d00efbb143e91";
+      sha256 = "b89f86a38a1595d8b4052b74e1f9beb741c859f4015c7dbf9b894a08eca6fdc1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/si/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/si/firefox-140.0b2.tar.xz";
       locale = "si";
       arch = "linux-aarch64";
-      sha256 = "dc50c48c50cd0fa013b0754dfcecd15015392d23e0247f33b3ad15cd7aa309a6";
+      sha256 = "cf5854ec14f712d1a12502edd0026288078d81273ee260244c8d09bc45b1f704";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/sk/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/sk/firefox-140.0b2.tar.xz";
       locale = "sk";
       arch = "linux-aarch64";
-      sha256 = "35906da5afd4bf8a52ddbd2ddeeb9ce01b40d5e93968e4e1f66541d0dcfb1b88";
+      sha256 = "54f6863f9dd7ca0b48ddd5b1b46b4b3b929fd01349bc5e2933f314388972757a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/skr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/skr/firefox-140.0b2.tar.xz";
       locale = "skr";
       arch = "linux-aarch64";
-      sha256 = "0af03523f3a0987e32c36d182d51c318f62efba1f614d2864e571837ca8eab13";
+      sha256 = "a051e36dbcec29dde148453fd95881c7073cd8ede0ef92e3c1e2263fcb5e1c94";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/sl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/sl/firefox-140.0b2.tar.xz";
       locale = "sl";
       arch = "linux-aarch64";
-      sha256 = "d7b9c75397dddb544fc4287e43f255929f04ba3e5cbd9c8c737f1f47d4d8353f";
+      sha256 = "e18c4b176463416e35438b155748b69714a965f54e87e8cc578c483a2454d30e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/son/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/son/firefox-140.0b2.tar.xz";
       locale = "son";
       arch = "linux-aarch64";
-      sha256 = "7ab390ad40c8c7db2029a5ff103e523f2dce8691926e4f3f140c911a862937c3";
+      sha256 = "46461fa15f488234915e4a6f39fc0e241c1256c6ade93d584e686552fae53d49";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/sq/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/sq/firefox-140.0b2.tar.xz";
       locale = "sq";
       arch = "linux-aarch64";
-      sha256 = "3fa9746d65d15ebed2d0bef82e16c26c25fe40671ea71651c3ea55f23769a5d1";
+      sha256 = "b6bb2006bff76cd6fa875e18e0717a357ddfbd09a419126f41ac1f614bf56adc";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/sr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/sr/firefox-140.0b2.tar.xz";
       locale = "sr";
       arch = "linux-aarch64";
-      sha256 = "954194b63497a3c490f819188c7353139af87a0c6ab2a0b87ce5db1a942d8b68";
+      sha256 = "f24fb9fdd5ec517efd56a5c539916a756c6ecb1686e0ec1b1437bc30b78b9168";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/sv-SE/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/sv-SE/firefox-140.0b2.tar.xz";
       locale = "sv-SE";
       arch = "linux-aarch64";
-      sha256 = "ef30b8f7ba31857b871c4e41d139eee7ac6bfc759a461c0addec73b1e1559695";
+      sha256 = "5d25e7d100840d8259a7c9043e14d2e50daef0fe14ef766aec19ca6fe30e8db5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/szl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/szl/firefox-140.0b2.tar.xz";
       locale = "szl";
       arch = "linux-aarch64";
-      sha256 = "ba038643ce7af49c6e16e6eece4a56b4bbe85a9a14639d534b9cf64884046154";
+      sha256 = "0ebdd8c0dc4f1d1f6567a9319688c7b71aff30a6999d4d57bb6ca3e50fb66031";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ta/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ta/firefox-140.0b2.tar.xz";
       locale = "ta";
       arch = "linux-aarch64";
-      sha256 = "b12d92276744680c57aeabdbd714bf5d3f2ea09030858d6d38d4aae80099989c";
+      sha256 = "e89ad50eb57568f223fc96751b6b426741826a41f1895fde4e0b1d3e3e48a0ef";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/te/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/te/firefox-140.0b2.tar.xz";
       locale = "te";
       arch = "linux-aarch64";
-      sha256 = "eb5b186241b7fde86cc0f57fbe3712ef1d3831700d741c1955fd89efe84aed96";
+      sha256 = "e2e94525844616c4f9f3c51ae82a7c6b1cb4ca39272f76fc77c0c21bd1ef2278";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/tg/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/tg/firefox-140.0b2.tar.xz";
       locale = "tg";
       arch = "linux-aarch64";
-      sha256 = "b3f5feef512525cc09d11935cc1fb0b7086756158bd6cc6dffcd22cf3ec9497f";
+      sha256 = "bf8d5f5ea4c8ecc6e6764560966affcc969acacb0a6015153b2c46688b165574";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/th/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/th/firefox-140.0b2.tar.xz";
       locale = "th";
       arch = "linux-aarch64";
-      sha256 = "2d187742b7e8a60f0a427b60f41f1d684d19360e562d2fc9d0f968cce4581b21";
+      sha256 = "23046863b1c3405f5ecd184a0ba82207f46c4489e1672e43110c47f5d6a522bc";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/tl/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/tl/firefox-140.0b2.tar.xz";
       locale = "tl";
       arch = "linux-aarch64";
-      sha256 = "44c490eccdae6a1c0fd08d7c3b589de398498f4ff705292ff6f72366f27dd768";
+      sha256 = "0955e3bbc514eccf2774d3e70ec94d890be12b50c555787937ab38b2b30e1eb2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/tr/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/tr/firefox-140.0b2.tar.xz";
       locale = "tr";
       arch = "linux-aarch64";
-      sha256 = "b784b58007959048c3067a041950813ec8be9ae30a73dc24bd0b5f1b3d702460";
+      sha256 = "a99c19d94963709c38ab298199263643f9e5f55459648d4ce9a98ec46f087db9";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/trs/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/trs/firefox-140.0b2.tar.xz";
       locale = "trs";
       arch = "linux-aarch64";
-      sha256 = "611991646e94273c6b142f2af670755fe18878f2a5c61a2e9f13a0fea99ce775";
+      sha256 = "e4f033ccdf9ff353d4de0a5fd5aaf239f95c7340a90873a35ca51ad1730f6e5c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/uk/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/uk/firefox-140.0b2.tar.xz";
       locale = "uk";
       arch = "linux-aarch64";
-      sha256 = "90c25ceb18b53030e881e0f44b7d3e23c5b6c9cd380babfdcad957783d0e0c4e";
+      sha256 = "d16f97ed40b919d179a530d344a16520cf957141d3cbb68987ccffcb7a69fa62";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/ur/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/ur/firefox-140.0b2.tar.xz";
       locale = "ur";
       arch = "linux-aarch64";
-      sha256 = "9be466dcebfd73ff9b5a4b0982a9421034654310ccf077fb812d652b67d6d284";
+      sha256 = "0eee3a71fdbedcdadf3ffe9025c3436a0e551e7596a0b2f386175d196d3dc73a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/uz/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/uz/firefox-140.0b2.tar.xz";
       locale = "uz";
       arch = "linux-aarch64";
-      sha256 = "9d58ea902acb5ad35b19cd87f5423b21fb7772512156198d2fd05f84c08a778f";
+      sha256 = "b7e3707e6c76bdf87c83ca237895c651b9137b83814e8975569512c2c5c9cb10";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/vi/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/vi/firefox-140.0b2.tar.xz";
       locale = "vi";
       arch = "linux-aarch64";
-      sha256 = "2cfc4c3f5d129a3041096dde196f3e887498a886dac1ab6845fb54b7eeae16d2";
+      sha256 = "2ddbdf7c755241c1400656f65a181e6c117b08743d52127943882f3f0172c405";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/xh/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/xh/firefox-140.0b2.tar.xz";
       locale = "xh";
       arch = "linux-aarch64";
-      sha256 = "4eab0c87e4bd3f54d1e77b83a8c82b084c23beb0d0882d542e04bb19e798c98a";
+      sha256 = "b4fadd9165a04b491c81273273e894a81667de20e06479d166cf36942edd6ccc";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/zh-CN/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/zh-CN/firefox-140.0b2.tar.xz";
       locale = "zh-CN";
       arch = "linux-aarch64";
-      sha256 = "e6094469887c77d367ca255d0b461d47f9a352b12602042caaf668846b5f295a";
+      sha256 = "0e6b7ff8960f0cbbc1b34a3a44bb7d8bef6a832d40f6d9bd85e8d8a54f03b9f6";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/linux-aarch64/zh-TW/firefox-139.0b4.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/linux-aarch64/zh-TW/firefox-140.0b2.tar.xz";
       locale = "zh-TW";
       arch = "linux-aarch64";
-      sha256 = "4b5490a70185a206ad337404876cf943bd49681065d87e302a2856d2543b0329";
+      sha256 = "fbc5b78a7b6e022d8e6784c741d29d0adb6bad2afed4c5b3ff878b26f6dcdd00";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ach/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ach/Firefox%20140.0b2.dmg";
       locale = "ach";
       arch = "mac";
-      sha256 = "4a42735641e22b977ec4ac31451ac8e0a17faf7e409a33f0d35a33efe5e033c0";
+      sha256 = "1c2d490bbe1ec81a70cc42fd9474f980771b64f8c8142d73001d18a5e74a2f45";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/af/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/af/Firefox%20140.0b2.dmg";
       locale = "af";
       arch = "mac";
-      sha256 = "15754862b1b05ac166ae8f157655477aaf008fb7dff4ecb8847bda815dfb74fd";
+      sha256 = "d841a2fb6679761f95697ed1252c765220ca226774881153ab709f8da13339cf";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/an/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/an/Firefox%20140.0b2.dmg";
       locale = "an";
       arch = "mac";
-      sha256 = "ae9f4fb8eeb5d868a89c2f602d036ce71c199489d704bfbb430ceea99d21ceb9";
+      sha256 = "3ebec1ccb2d8a5050ad2920c53016c02f50dbaeb4249fbc65f72aa50463799ee";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ar/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ar/Firefox%20140.0b2.dmg";
       locale = "ar";
       arch = "mac";
-      sha256 = "b5fa0c0e348e1aa81719979ed2348b36efb77e212e4806bb70131400ef3a3b1c";
+      sha256 = "2d40019da859a502af6d3e48112509cdc4fca031901c299dd7f0734bb6ca5de0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ast/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ast/Firefox%20140.0b2.dmg";
       locale = "ast";
       arch = "mac";
-      sha256 = "97c54f7224b0baf23d2f0c775de23aa3187f7f41de4e2d406634642967fbf797";
+      sha256 = "0f69deb4c3b87c4696d34852d9e7bd956b728d3802403929ec3ba733d174635f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/az/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/az/Firefox%20140.0b2.dmg";
       locale = "az";
       arch = "mac";
-      sha256 = "0166eb8d67ec5cef8efb3c0625e8a4d3b0dd23e1a697ad1b3193e3acf3515b82";
+      sha256 = "de80d2c96e6106aff495e91dda2dc66c98b49082627fc9b73e6cb541418e01bf";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/be/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/be/Firefox%20140.0b2.dmg";
       locale = "be";
       arch = "mac";
-      sha256 = "995a25f2eb716ece9467a62673e1ad5938b3eca2bee1b8fc0392ecbf08d79c78";
+      sha256 = "6d1561f7858485628a4d75340d7f24e6d912703594b4c9d7bca49fd5c0b9a792";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/bg/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/bg/Firefox%20140.0b2.dmg";
       locale = "bg";
       arch = "mac";
-      sha256 = "58eebc470431b310c5012ee22e21051295742cb4cdcc991bfacec025f20f16a8";
+      sha256 = "59e34ca3ced32f81b26e1a03aa9872c8a9a6247c7c660b146f787f29f53ee4a7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/bn/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/bn/Firefox%20140.0b2.dmg";
       locale = "bn";
       arch = "mac";
-      sha256 = "8c019e1b39c963a6c776bec5065440190afea8661a86e098d73a4139ede3438f";
+      sha256 = "3f14512645552b8fd4added4ac10995449e7e01dbfc5fb2dba8923d95298b54d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/br/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/br/Firefox%20140.0b2.dmg";
       locale = "br";
       arch = "mac";
-      sha256 = "c263c604507b44d9eceff1c6a4d88a5d03f6b72a437235902440811b5594fc4c";
+      sha256 = "7793a491f9fa9a417408685ca1d8dcf2b9a2bb1048f4ee95e4aaec3dfa6b2168";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/bs/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/bs/Firefox%20140.0b2.dmg";
       locale = "bs";
       arch = "mac";
-      sha256 = "709e3edf72a4927c929eb978611553f1c9c51f4d2b65ad8316ae08e7db5727da";
+      sha256 = "8e1e58ae603650f447244b20da467a987bc5663f7805eaa87c108aea0dfe8629";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ca-valencia/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ca-valencia/Firefox%20140.0b2.dmg";
       locale = "ca-valencia";
       arch = "mac";
-      sha256 = "fd21e0c49e8c89479e43a5e8e6eadcc565550ccedae11b48e534875c79858c40";
+      sha256 = "0fcc15e68a06f56e3aa8f52833652570d2e2c80386b4d468f119d9b2f5d63cc6";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ca/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ca/Firefox%20140.0b2.dmg";
       locale = "ca";
       arch = "mac";
-      sha256 = "49945e34d0031cd6d734904449c0cc45bb43a064674ae30d249a69202aa2ffc7";
+      sha256 = "a4cd0c1f124a8997182dbdccaee61f03d688e10c2c9f4f46076ef62c88bc2ebc";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/cak/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/cak/Firefox%20140.0b2.dmg";
       locale = "cak";
       arch = "mac";
-      sha256 = "9716963c81d5bf84ccc5046a1cc61a3bc4e593f116b390e761f2dba1edf7d1f9";
+      sha256 = "ba76bb6afbbb6f72538d1a0b50d5f95cd2a14421a321ae013984ee880017031b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/cs/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/cs/Firefox%20140.0b2.dmg";
       locale = "cs";
       arch = "mac";
-      sha256 = "239a8caba9b1a23b7c98ab9f507d8718594f353dd27c079efeb8b42bd77ae7ea";
+      sha256 = "005862a68ec16e926e9e888a73fa27314da31519e38ce0fd6656ad924b6c296c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/cy/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/cy/Firefox%20140.0b2.dmg";
       locale = "cy";
       arch = "mac";
-      sha256 = "cecc8f11be8ccaa4b3d98120e86c347510b56a04c9812ba8e98852f331bfe6c5";
+      sha256 = "d71f2f3f678b5289023089482107772a448848db26e75908e8cde58087aaf1d1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/da/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/da/Firefox%20140.0b2.dmg";
       locale = "da";
       arch = "mac";
-      sha256 = "6edf58c11f2d4ab1ea575bc5b5fc32cf9cdafff197e17aa47450fc940a22ae15";
+      sha256 = "a2ca0b54a7324acc16e9d2ee6831e3bf25cabf36e1f4ec69c4034795c1519185";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/de/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/de/Firefox%20140.0b2.dmg";
       locale = "de";
       arch = "mac";
-      sha256 = "0e0d6110bb40aca8498523b49e48da8fc4e7ae198191aeab5b7f0e9e9baa11f2";
+      sha256 = "24cbff457b1bdba5c44a473f7d65e247727df35a28ece5ab2b685a92f24cb4db";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/dsb/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/dsb/Firefox%20140.0b2.dmg";
       locale = "dsb";
       arch = "mac";
-      sha256 = "8713f01cea21be9d90e917809b963aacd05d8ca5fb8d311e46c06e693a40ded7";
+      sha256 = "0af7cec5144e91bd7c42b3ac6e1bf1b73724853e0c0a67b4d1800aa5a7ef9218";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/el/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/el/Firefox%20140.0b2.dmg";
       locale = "el";
       arch = "mac";
-      sha256 = "75eb0726b6cbf7e2b5172a282b79069d1580cacfa0f9a1654853195d9976d84f";
+      sha256 = "4fe53f17a96dcaa91ae4e630222a8311c4b63c8d627ba7fecafab3cb66ae8bc8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/en-CA/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/en-CA/Firefox%20140.0b2.dmg";
       locale = "en-CA";
       arch = "mac";
-      sha256 = "1cf3f9e0bdd4941243f11a55c3fb4a24dac024a942ad2b89d568b784f174fb1b";
+      sha256 = "5671afd041943c805d0115bb235636c656966b79b37b8ff622318b08dc66f23d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/en-GB/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/en-GB/Firefox%20140.0b2.dmg";
       locale = "en-GB";
       arch = "mac";
-      sha256 = "b29064c4277036ebca99ea3cbbebf7ef887247e97e34778180c3381da673aae2";
+      sha256 = "27899bd86fe738877c78e9c95dfed10f84f1d99865caf1c8e377a285f7539742";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/en-US/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/en-US/Firefox%20140.0b2.dmg";
       locale = "en-US";
       arch = "mac";
-      sha256 = "c61d0fe161c6cb778a3e564f4cffa70cc7fb6bb5770586fa66c7db8ab9c31cf1";
+      sha256 = "e60b906321e4e8f6479d87e02314fdf804e3b461028f8d70552d88911a693a0e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/eo/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/eo/Firefox%20140.0b2.dmg";
       locale = "eo";
       arch = "mac";
-      sha256 = "fdf543162489d4165d8b39e01bad6d28addcad942d90c32aa2068e74558def80";
+      sha256 = "e5513b3584e0e07ab2efbbc3b1acb531cd19fe88decc460fdef0b8bab1ba45ec";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/es-AR/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/es-AR/Firefox%20140.0b2.dmg";
       locale = "es-AR";
       arch = "mac";
-      sha256 = "13641a204ea5fbce36d1c9661fc149081e90fcd03a2840300a288861bacd5925";
+      sha256 = "e70de7f34a08c75c8ca81e041033fda21f8af581f30705ccd1708666a69ed993";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/es-CL/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/es-CL/Firefox%20140.0b2.dmg";
       locale = "es-CL";
       arch = "mac";
-      sha256 = "1fb4f9f7f01c78188b038a1116b4e19607388947067dbcad3bde3daa115e5f68";
+      sha256 = "f93f379e3953b56cf32f1e7d71df9fd6d0e898a41cb10c1af8fb0c83fd953c64";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/es-ES/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/es-ES/Firefox%20140.0b2.dmg";
       locale = "es-ES";
       arch = "mac";
-      sha256 = "13cc2d4179bc10b58253e8a88cabb8228f9fd14fb1e237f002c7220c29c790af";
+      sha256 = "d7275c44b957fe378e949d0c47f8eba8792b5cbc0bacfaa98a4f26795c0f4bef";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/es-MX/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/es-MX/Firefox%20140.0b2.dmg";
       locale = "es-MX";
       arch = "mac";
-      sha256 = "a78061c9a63720610f1a11990199299a66e6c3f805821df80fc994bcab01d2e1";
+      sha256 = "529a01a430b6fd03e8de52f7fad75243d53fd042d39dba676b285156f7279a89";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/et/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/et/Firefox%20140.0b2.dmg";
       locale = "et";
       arch = "mac";
-      sha256 = "3623ae5b628d82224b39e5506e5f1b604355e932d7a2e320795baeb72e892323";
+      sha256 = "c4e67c20198d278dc784212f765c638f25137d3654ccb3cdb49564c599a0d074";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/eu/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/eu/Firefox%20140.0b2.dmg";
       locale = "eu";
       arch = "mac";
-      sha256 = "ef038ab87151a9ec36b311ab73fab8d5444f8ac9317c94b8ade608a7387f83bb";
+      sha256 = "5a2cdbf4aef80735073adf761ca7ebeafee4ec68868c1b19580dc0a3d73d3d4c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/fa/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/fa/Firefox%20140.0b2.dmg";
       locale = "fa";
       arch = "mac";
-      sha256 = "84034c107634a08322974c899956ef02ec725970603d9f73d15833c508089984";
+      sha256 = "57e1d9990fbc724eca8b9bc3f2bd8b2b63c30d99788859d4cdf6c94104dc0713";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ff/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ff/Firefox%20140.0b2.dmg";
       locale = "ff";
       arch = "mac";
-      sha256 = "2874b586b9cc2f55fe12a1dda4de3f45f702966359f62276b6009c113193e87d";
+      sha256 = "2b5bcf6057d17ef408cdcb198198d67a9f27a0bea5f3bc682a167d958b2bbf54";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/fi/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/fi/Firefox%20140.0b2.dmg";
       locale = "fi";
       arch = "mac";
-      sha256 = "dba286212463e1fcd3052dcaa8a66fa2d5a938052c74b655d634e700522041e3";
+      sha256 = "392ce242ddef92bf02dff3f7ce26f7dfc5358a259a3679ebc2333294650e91cb";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/fr/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/fr/Firefox%20140.0b2.dmg";
       locale = "fr";
       arch = "mac";
-      sha256 = "d4ca7c3969f32f2af2f2ca4824d4439228a8e17386c9cf9fe849caba4c271280";
+      sha256 = "c07d5671bef18729205554a881e2055c2d4af04c1109210ba8ea5b5e33c0c553";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/fur/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/fur/Firefox%20140.0b2.dmg";
       locale = "fur";
       arch = "mac";
-      sha256 = "4accfe0a3721b1ac5ffac33b586e778fe888210b92c4375c80aed95e3daa34db";
+      sha256 = "baeb0ab73c5b288c67fb87a57f9b3866071051e7e04e68c9f554b30640aa988f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/fy-NL/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/fy-NL/Firefox%20140.0b2.dmg";
       locale = "fy-NL";
       arch = "mac";
-      sha256 = "db6751ce87b9e801a1bb72a0f04c7f909fd6aab5c4cb5591b522e798355f9eba";
+      sha256 = "57d0713b6c1eca3460bbeb1f9cc6a769db2bb01036054a5538cca93c6fbb5225";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ga-IE/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ga-IE/Firefox%20140.0b2.dmg";
       locale = "ga-IE";
       arch = "mac";
-      sha256 = "257dc1d4b56b5e633bdba46ec71469b746f175ebab0463ca3792257e7c6efdf0";
+      sha256 = "82fd3bf162cf641549c2a98fe88393d3caa1a41ebdd9fef15e3aff278b24cf5f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/gd/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/gd/Firefox%20140.0b2.dmg";
       locale = "gd";
       arch = "mac";
-      sha256 = "e2f8d9c9c0a494239472b760687d1bdcaf018a9a3a87882541936ab3c628f974";
+      sha256 = "b15a9124f3c4a138adaf497109467d242b7eb706f7ba904c53e9073fa5b40068";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/gl/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/gl/Firefox%20140.0b2.dmg";
       locale = "gl";
       arch = "mac";
-      sha256 = "f735a8db8e58deb85c1b2455db1924f3375df450890bd1e0a94990e5744bc831";
+      sha256 = "be63b8dabc4673022dd0c69577d202efea303ef3d9204bebbe86b09c80913602";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/gn/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/gn/Firefox%20140.0b2.dmg";
       locale = "gn";
       arch = "mac";
-      sha256 = "4c859dcd1819e5c53a3adff48d958a8d301a37e72ed0de63abd71889aff02c0d";
+      sha256 = "0fd5f6cf33ea00c65c1e37c2b5b27e6e28b1e804f873ed2a81862639697fb6da";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/gu-IN/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/gu-IN/Firefox%20140.0b2.dmg";
       locale = "gu-IN";
       arch = "mac";
-      sha256 = "ba0941058959c7cfc06cbe6cab3245499850369f7f31d8428cc1cdb88f1ff673";
+      sha256 = "a72071f5897b9de30fe23ab448751d88b0943a1ce12bbac525fc25e0d06ca824";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/he/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/he/Firefox%20140.0b2.dmg";
       locale = "he";
       arch = "mac";
-      sha256 = "75e398253677225953a07d1e9e144adc4086968899554b7d57031cc8f5b1b638";
+      sha256 = "8f5873c677ffa3bf8f3c03c1cdd56c9d532f5576b1d45e3eaddc4ca63a4c84d7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/hi-IN/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/hi-IN/Firefox%20140.0b2.dmg";
       locale = "hi-IN";
       arch = "mac";
-      sha256 = "66872abb8f5eeacdbe8bd6f5c96c9566e72ebfa57b897dc64c46df2ab0fdfc84";
+      sha256 = "ef2a4cb4a0822afd273713265b2bd12199cd5754876205435a996af6bd08e7db";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/hr/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/hr/Firefox%20140.0b2.dmg";
       locale = "hr";
       arch = "mac";
-      sha256 = "d8d8e4aea4c86635ee536fa929e12eece775e2abab09956244776a9de308b4bc";
+      sha256 = "19f7a517502a8cf46cb802fd428688b2f9733a4b29c6bd69ffb42ead7078c823";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/hsb/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/hsb/Firefox%20140.0b2.dmg";
       locale = "hsb";
       arch = "mac";
-      sha256 = "d5c31f2a62960141813d8f0d9120fd9af14a114e418b2f71c4b61760abb0addd";
+      sha256 = "43b7bed183606c1ea212fde9cd996ec7b0c227e2e827ca7f0ac11a11a46c1f46";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/hu/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/hu/Firefox%20140.0b2.dmg";
       locale = "hu";
       arch = "mac";
-      sha256 = "aec856b42ff661f07626fe6e7c49fbc09eb09b7e3732e5a4ffd7e2152ba18fdc";
+      sha256 = "97998fce9f91f25ae8354c274cd0a8e29145935163e1b0d723818d939bfe0434";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/hy-AM/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/hy-AM/Firefox%20140.0b2.dmg";
       locale = "hy-AM";
       arch = "mac";
-      sha256 = "3757bad209cde3d24c008756be1e1ba03bc86a6567c5f919221b75ca113c70c5";
+      sha256 = "26fdba87a2584afba336c3e388abf0bcaf75352694415954644b3300a482fd88";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ia/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ia/Firefox%20140.0b2.dmg";
       locale = "ia";
       arch = "mac";
-      sha256 = "669117617c58b1048772c519dd9796e25636703d6f1ce29ca4b41a25c9734140";
+      sha256 = "a714bf43aa173d5d4ef29ee5e406f09fe137ab1d9a311299604dbd6a63653238";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/id/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/id/Firefox%20140.0b2.dmg";
       locale = "id";
       arch = "mac";
-      sha256 = "4e7a95a805b4a870201728c6fe267a69751b8d7135210133718b48771b1efd81";
+      sha256 = "883a1081b0a0bb03fbf5ab735520b241f9f6d46f05ff7492750223ba1388bfde";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/is/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/is/Firefox%20140.0b2.dmg";
       locale = "is";
       arch = "mac";
-      sha256 = "1ab46c1a5858000683c0004dc3fdb59d2b2ded4e78b24b1d9ec0daf2945db6e3";
+      sha256 = "411ac5c44cca622d542e568ead74f6192c4dfe717ac16863554b1d6da11755c5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/it/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/it/Firefox%20140.0b2.dmg";
       locale = "it";
       arch = "mac";
-      sha256 = "e7cc58da37fa5dc49d32b85c226e25214546dab7798458f18db31c3a28420691";
+      sha256 = "fb088f8cdcaf8ea9aced69ca2892fb776dcf48b746f0abef6975e99854c55a79";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ja-JP-mac/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ja-JP-mac/Firefox%20140.0b2.dmg";
       locale = "ja-JP-mac";
       arch = "mac";
-      sha256 = "26ee160188fcb0d59bb88e0ae10856b556a01a16254f59b122490714ac3a8cef";
+      sha256 = "9258d8f492c8c64695af53960fcdbeee60a6bb82a37d71abc77abe1002f98f09";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ka/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ka/Firefox%20140.0b2.dmg";
       locale = "ka";
       arch = "mac";
-      sha256 = "4ceb3e350415425f05ce77abdc582d4f5a8934dae7a987cfa9ab909543f25d1a";
+      sha256 = "0f486c5bbcc0af6a9bdb4e1b706c303501284848d3fcfd4000c1bfca71bc0300";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/kab/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/kab/Firefox%20140.0b2.dmg";
       locale = "kab";
       arch = "mac";
-      sha256 = "eb2cd412c94a67415664290b14a08f5bb870b3f25e7fa404dfd68272e33df4fd";
+      sha256 = "ccbda4ad3d59661a897a1b47ac77e0c48144802575f6740aec95d788227e1028";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/kk/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/kk/Firefox%20140.0b2.dmg";
       locale = "kk";
       arch = "mac";
-      sha256 = "c2bbf15bd5013388c090b9ba7631ccd6ca803c262b2e3f8ac8f07a8ff22d0bcf";
+      sha256 = "e55c667813ee5b15f79c5d623cb33eebd1eec5ac4d57f2a8bb9c3466794b746d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/km/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/km/Firefox%20140.0b2.dmg";
       locale = "km";
       arch = "mac";
-      sha256 = "b75cfef561797c1b19f696234e6c5792f0835de469b71dc0736c47087ea43b02";
+      sha256 = "5774f04b93c6863b27514a2eae504bcfc1ef8ccfc068a953e4d3e270dedf7b93";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/kn/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/kn/Firefox%20140.0b2.dmg";
       locale = "kn";
       arch = "mac";
-      sha256 = "383e8dca3ee948a086e4a9bfb16149c443ecb5aab957564ec33e7f32b98f3c61";
+      sha256 = "7c376799a36ce1cd8f89798ebdd777f7886a99693c5f98729684252d340ba2d4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ko/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ko/Firefox%20140.0b2.dmg";
       locale = "ko";
       arch = "mac";
-      sha256 = "e4fd810f240a24a9fa9d7d9a3e3d52d3eb8bcd59704da3777998c4288d8d5634";
+      sha256 = "5f3d2829512178f393b9a665ebeea9cf4f18e9afa042839b7f53e2b620c5db8e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/lij/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/lij/Firefox%20140.0b2.dmg";
       locale = "lij";
       arch = "mac";
-      sha256 = "d803bf21f5b2fbd058319b68b86ee3a1ceefa9473fc0ed85cf549065c4040a13";
+      sha256 = "30ec59741eb1324d18f995d1b94fe5928421002bfc0d8876cfff257148eda97e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/lt/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/lt/Firefox%20140.0b2.dmg";
       locale = "lt";
       arch = "mac";
-      sha256 = "3e8a7440f91d017060f4045a2bf99eeaafbffeb114de3a3afde30b71dee77f54";
+      sha256 = "0fe2982d361f6beffd4d61f55fd81843943a9fb4daeb1c2df872191cb1bc6a17";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/lv/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/lv/Firefox%20140.0b2.dmg";
       locale = "lv";
       arch = "mac";
-      sha256 = "cc82e24338955ea73fc488cd2bd4408783e1006d8a4644036de09c2731cc1fa2";
+      sha256 = "7914c9bcf07701a2978c0ff417e14a23078ae2cd6ec6315b4be8979ab09e9823";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/mk/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/mk/Firefox%20140.0b2.dmg";
       locale = "mk";
       arch = "mac";
-      sha256 = "d12e758204660abeae700ad10b79effb2627486cda0a6123bed191e3d6ff9282";
+      sha256 = "244798bc32bd4429eb230b4aa7d7a6192c5456cb95faee5bf66f09ad8013517b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/mr/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/mr/Firefox%20140.0b2.dmg";
       locale = "mr";
       arch = "mac";
-      sha256 = "8ad6085ae950d89ba4754dd9ea3f9154ecf12252ee47636fd6834ba8dc7ff71f";
+      sha256 = "67a2d6ce2ac921d47d01ef7cee9543014eeb4f2db0394ba3b459114b5e65c23d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ms/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ms/Firefox%20140.0b2.dmg";
       locale = "ms";
       arch = "mac";
-      sha256 = "c7f082195da9a650df72066d7f4e9004adb59fca30deaed4ecfd2e70514c02fd";
+      sha256 = "d74083626dfccd8d628ef0326ff7f2865cad8c0c32aada246d4cbd9edd6cdefa";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/my/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/my/Firefox%20140.0b2.dmg";
       locale = "my";
       arch = "mac";
-      sha256 = "639b38b8c6b9e42ae89fbaea360ddfed3be74e9eb3a55456a251d9d22ede241d";
+      sha256 = "61a501809b50a3006a362eeb76f3c4d49bad778cee9fe35b6dd072c53e7be210";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/nb-NO/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/nb-NO/Firefox%20140.0b2.dmg";
       locale = "nb-NO";
       arch = "mac";
-      sha256 = "87a676d880411221b19763c9263024507d41e0c89f6fd818f8efe8563952bd09";
+      sha256 = "7b1fbd6ed0aaa7865997be627bc7c89622f872c2c5c7725393620404bb6660c5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ne-NP/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ne-NP/Firefox%20140.0b2.dmg";
       locale = "ne-NP";
       arch = "mac";
-      sha256 = "b8018da6989bdb66b02dc386b608ee439718b5ba2f377dc3302710ce7854aa8d";
+      sha256 = "e16d0769328870f6b964ffc209b6c0b2cdfa015a83ef1b7744cedbaf91f7ed29";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/nl/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/nl/Firefox%20140.0b2.dmg";
       locale = "nl";
       arch = "mac";
-      sha256 = "9037c896ea9aedd7275c8922f4a61d5ad9e4b41ecf43f808e9e996c7d702ed33";
+      sha256 = "92bade0cb93b3aa2bafee685b671f4284144f554a3910fe6c3d125a58fd1c830";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/nn-NO/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/nn-NO/Firefox%20140.0b2.dmg";
       locale = "nn-NO";
       arch = "mac";
-      sha256 = "06368696dcedd347d62ceb7a1bf3ce6f0d92eab035310aa704b0a09a495448c9";
+      sha256 = "0ee61fda7d45de9c3a85a88514aef5fa2d7ef9c33e839657257da3804c33e488";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/oc/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/oc/Firefox%20140.0b2.dmg";
       locale = "oc";
       arch = "mac";
-      sha256 = "9865f0cf11e8baf3b6930617597ba807b1e06d95abc9a8a68525119a0d591e48";
+      sha256 = "9b549cec47785c84ed77694f21efa1c8a39eecb76bddfa191e43e54ebd798adf";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/pa-IN/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/pa-IN/Firefox%20140.0b2.dmg";
       locale = "pa-IN";
       arch = "mac";
-      sha256 = "1bd442dfd70d0da87a4904f25a955323fa15d1551d529e710876c2c4e7cf257a";
+      sha256 = "271b013e5388416b2d0956b72d68191cd51857d0ab92595a2ff2f7a0aad95462";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/pl/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/pl/Firefox%20140.0b2.dmg";
       locale = "pl";
       arch = "mac";
-      sha256 = "e261443f9dd5160e941378c9c8f0aaef9159ae21172babecd0154b7481081210";
+      sha256 = "04554a10737ed4c2862a3b9e20c82de6e22b6053a55e4ef34b62bc977a8e1ef3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/pt-BR/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/pt-BR/Firefox%20140.0b2.dmg";
       locale = "pt-BR";
       arch = "mac";
-      sha256 = "4140fca76b890df5b79a7accc26bba64f43b31b3818bf5567930451666cfca43";
+      sha256 = "cf56901b76d04c7ed54827e07d11ef8556cabaf7fc9657b83fbc3d86b051a104";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/pt-PT/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/pt-PT/Firefox%20140.0b2.dmg";
       locale = "pt-PT";
       arch = "mac";
-      sha256 = "8d492cdcc1af5e98bf89039474b1af4e7e4f784e82ad2645351500a2dc22bf23";
+      sha256 = "07d160fbc743da7aff2f3501c4861abb300d509549ad46d8230a298f62e57b99";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/rm/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/rm/Firefox%20140.0b2.dmg";
       locale = "rm";
       arch = "mac";
-      sha256 = "c65018162dfec1f1f1a03be127fb27bbd25a604a4e5d2df53f5bbbd13f02e64c";
+      sha256 = "2bf8142a9034bd15ea15e625788d7dd2aeeb378df54b1e64330a99d6d8fb84e0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ro/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ro/Firefox%20140.0b2.dmg";
       locale = "ro";
       arch = "mac";
-      sha256 = "396b5d2061bb0df1fa5af0b1b77e92c230e043a853cc0df7bad529c74eec6c1f";
+      sha256 = "c739d147056f2fe970b53977e58139580c6200d414d5a07c656bd33386f8d1f9";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ru/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ru/Firefox%20140.0b2.dmg";
       locale = "ru";
       arch = "mac";
-      sha256 = "c90e4d1bf9440ab473eeeb6ebbf57051b30d13f5586abe7adb61487f43b15423";
+      sha256 = "a52b9100ed56fdeb1d3fcb96741e379d96062a89d27a52dc3e1b56ee9d295941";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/sat/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/sat/Firefox%20140.0b2.dmg";
       locale = "sat";
       arch = "mac";
-      sha256 = "4a02f90828c7bcd302ed8e2689dad6b9186ae230210c0a56b2a8fcfc3001880f";
+      sha256 = "593a800e5993a1d64b25de417e21b86604bf00a5a46b3bdabeda86ab04876a31";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/sc/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/sc/Firefox%20140.0b2.dmg";
       locale = "sc";
       arch = "mac";
-      sha256 = "1ce3f7cb4770771ab928006ccd0c2d855a5c69179efec9e62e8dafbdcffd54f5";
+      sha256 = "195f0e203e720b40024ccfe65e98b9c3fe485e5f27ab10aeb7f01145f129be2c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/sco/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/sco/Firefox%20140.0b2.dmg";
       locale = "sco";
       arch = "mac";
-      sha256 = "5ac1424837f62ff290017a880b9b816bc7ab79e7a4401a2e8dbab8e3b05478c0";
+      sha256 = "dfceefc189afb27e80659e38446433b9cf92fb81c92b783ff9ae1533a0ca950c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/si/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/si/Firefox%20140.0b2.dmg";
       locale = "si";
       arch = "mac";
-      sha256 = "6f0f1b88034a03b3f1c31db951f23555b2e758338b92eb7e9486b38376b0540a";
+      sha256 = "70c88ca3c07759e59add1e057020f7bc18a9b2dd582178727bd6c0c9a74ff407";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/sk/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/sk/Firefox%20140.0b2.dmg";
       locale = "sk";
       arch = "mac";
-      sha256 = "44d0e95057c74f1e6728ed14aeeb4846f789d5c7770a327a6530c21837bd230d";
+      sha256 = "ce352af03817432c6f8da15ffa2c57ecd2fde59729140ac0f7cd59439d677185";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/skr/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/skr/Firefox%20140.0b2.dmg";
       locale = "skr";
       arch = "mac";
-      sha256 = "e18e95beecb16f455ff78e9eab622e6df7e80b0461c6beec5e2b68534802653e";
+      sha256 = "6205c5cc529b43747cbbb3931e828dd273cac01c1cb4413c8dccf8a3f37b075e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/sl/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/sl/Firefox%20140.0b2.dmg";
       locale = "sl";
       arch = "mac";
-      sha256 = "065a5250d0145b713685c045280cca1bf7a2559e10d1c812fc4e1a6108b0b114";
+      sha256 = "74cb297c6f9fc2fef69bfa7f8a0f7c846e6980ef980b40b8479ca843caf20fc2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/son/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/son/Firefox%20140.0b2.dmg";
       locale = "son";
       arch = "mac";
-      sha256 = "e7d1090386a485211cb358bb757a0fa54d0953eac79347eea36dce4808d443a8";
+      sha256 = "d0972c1cf8c89153daaa8fecea950802dc3c15d93e53eb0549f33e31178dc51f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/sq/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/sq/Firefox%20140.0b2.dmg";
       locale = "sq";
       arch = "mac";
-      sha256 = "cb5a4f74226b68fafe633f6e39af27948ffe9bfa3c866cb9f935018f0ab01fb4";
+      sha256 = "cf89a59786a888726616aae73c8b1a3ba783e64fbcfda3b383d66ec72a6b1d8d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/sr/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/sr/Firefox%20140.0b2.dmg";
       locale = "sr";
       arch = "mac";
-      sha256 = "676d0da9ee7951a46270b9f47bd33ac5135b4a439a93f61eb260c8f0af2c0d49";
+      sha256 = "91ebceddc8280c6c7fb35306abdc551ca4671944f7caceb493a5dab8f200a563";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/sv-SE/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/sv-SE/Firefox%20140.0b2.dmg";
       locale = "sv-SE";
       arch = "mac";
-      sha256 = "c4f9814dab5efee3a4a67cc9f8bd703d015b51f4e59947dac56636f0a9325048";
+      sha256 = "864e8427329b950ad42ead7d0044c51a5bc5595f1f94038093b0fbc6eaeee2f3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/szl/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/szl/Firefox%20140.0b2.dmg";
       locale = "szl";
       arch = "mac";
-      sha256 = "1d92ef8edb7bb67be228771019f2f1fc9ae72ba3f005998f9f2db60287fc81e2";
+      sha256 = "92dae8cb9b2f3388a070672cbe74e2f2399cd416374f78ac7201ac6389bf5865";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ta/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ta/Firefox%20140.0b2.dmg";
       locale = "ta";
       arch = "mac";
-      sha256 = "f210471b4963521bce9aa29b4526e786cfd615a7dc3c57f6f16c92327ebaed86";
+      sha256 = "3998a4b1d8eedce4789b33fbdfe887bb6c434ef668d45d8cc12445351de18ad9";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/te/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/te/Firefox%20140.0b2.dmg";
       locale = "te";
       arch = "mac";
-      sha256 = "0c22ca5d3109cd8ff222906afe4ac7023aad6e983e1c00cb21159e018a2ae52f";
+      sha256 = "b47d181b75916c505795aa612cfd44708f4fdf99e2c47d95ad8b01fd92eff35a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/tg/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/tg/Firefox%20140.0b2.dmg";
       locale = "tg";
       arch = "mac";
-      sha256 = "1d9f2a44adec91d4120228640d6cf73290ca40333109b28f8c6f832e4cbd382b";
+      sha256 = "a149324442209694df3a229d00ccb2f67c7589a601dccf4a263f7e9ab5b80425";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/th/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/th/Firefox%20140.0b2.dmg";
       locale = "th";
       arch = "mac";
-      sha256 = "315c2049ab3f0905cc8e3420cddf90e00e7e0a54b65b60625c1eab2f2e560ef4";
+      sha256 = "5391f60c1322ad8ae87436317ac6b95c1c1d3d5f112d5b3d23e82af45118caf8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/tl/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/tl/Firefox%20140.0b2.dmg";
       locale = "tl";
       arch = "mac";
-      sha256 = "b8ce0475f332fc463ab40763ef250ae4711591f81f60065a3d66fa39a1c06dfb";
+      sha256 = "c2a5ee86077abe59ae4acf0ce3d1d4ba2c86511fac1ec44a21bde5c1a714509e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/tr/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/tr/Firefox%20140.0b2.dmg";
       locale = "tr";
       arch = "mac";
-      sha256 = "ba882caba5bec222b61c307d661caf1d2a3bbc8e58de21c6ecec9a0e48a10c64";
+      sha256 = "799ec56efb3bd5fa7e5f76f9cf7683711c79f342fbf02fd69037d8141887f682";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/trs/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/trs/Firefox%20140.0b2.dmg";
       locale = "trs";
       arch = "mac";
-      sha256 = "fae309ad38fd0972148effa759d979a43c3233c424fcef036921371a5f5c4355";
+      sha256 = "9f6123302bcf9b18344260e3dfab6839087ea41a42daf9c2fed7df04e3362ff4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/uk/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/uk/Firefox%20140.0b2.dmg";
       locale = "uk";
       arch = "mac";
-      sha256 = "54d8631cc02b44f286cc3716034fa854da91486ac78dae035a1206f1ac00685f";
+      sha256 = "f2e58fb4bae53bd8dc03cd5c29e9d5676dced99a2376322a0ba013eaa5154bb4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/ur/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/ur/Firefox%20140.0b2.dmg";
       locale = "ur";
       arch = "mac";
-      sha256 = "e401903f76ef26a3b968a605776428c8b55b54503587644706c2e991f4684932";
+      sha256 = "a4db73f4a8b98557ceb77f1f491e48bd783f0f4f5941d5234309d618a0221a7d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/uz/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/uz/Firefox%20140.0b2.dmg";
       locale = "uz";
       arch = "mac";
-      sha256 = "f12af8f8cd8d56742dd2a780842b88649d0914aae5151edd7071643bfd96337d";
+      sha256 = "0446e4a59da6f5e3fb242c2a9e3adb781832c2729f64167a12351638f3d00d8a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/vi/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/vi/Firefox%20140.0b2.dmg";
       locale = "vi";
       arch = "mac";
-      sha256 = "5981392db9d826d35e2a23a0da72664883c57a2e30273912a35cc80dd5e8dba1";
+      sha256 = "e6f47ff4cc809313f928fb365ccd716f7c8de8a5e914e7afdc774c7f3fbd03f4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/xh/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/xh/Firefox%20140.0b2.dmg";
       locale = "xh";
       arch = "mac";
-      sha256 = "4d86249d3b3cef3b87f2974199bdc49b5f4116b76595a8c33fc261b7ca6945a8";
+      sha256 = "c4ee8e4849fa4334757c2068f9eb94341bba22b7298c767f7fffa8cde8341c6b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/zh-CN/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/zh-CN/Firefox%20140.0b2.dmg";
       locale = "zh-CN";
       arch = "mac";
-      sha256 = "1c1b40f50bc92af90419cf2851e707b815dca48ffd43a550a866c3c09e212f36";
+      sha256 = "f22948993a7882ef1e244bcda91b0cd9ef4c814d17f4f54af2b9911e44f0899f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/139.0b4/mac/zh-TW/Firefox%20139.0b4.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/140.0b2/mac/zh-TW/Firefox%20140.0b2.dmg";
       locale = "zh-TW";
       arch = "mac";
-      sha256 = "7b41474db868d1ddf74bbf96486ea51ca8f187075bff0dabed74ef47db3114a5";
+      sha256 = "c95699dca04392bf80ecd477514e74804614765d53029a9be80e9ea6b821a90c";
     }
   ];
 }
diff --git a/pkgs/applications/networking/browsers/firefox-bin/developer-edition_sources.nix b/pkgs/applications/networking/browsers/firefox-bin/developer-edition_sources.nix
index 40ef23e60fdf..e751c29b4659 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/developer-edition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/developer-edition_sources.nix
@@ -1,2477 +1,2477 @@
 {
-  version = "139.0b3";
+  version = "140.0b2";
   sources = [
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ach/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ach/firefox-140.0b2.tar.xz";
       locale = "ach";
       arch = "linux-x86_64";
-      sha256 = "fd57bc7e6844cedf2c85e685246c42d929d3156a77e1d0ded40b8bca1099d5a7";
+      sha256 = "6304038c471eb73b1c8581f0d0812ba328de0f8d7db7f2b17f587e194754d2a0";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/af/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/af/firefox-140.0b2.tar.xz";
       locale = "af";
       arch = "linux-x86_64";
-      sha256 = "5fdb91b4dee48d1ca0a4191b6d4be2ea44bc2b1513efa50434b763f1fcd9d69e";
+      sha256 = "8cd9c38cce4f6672d7c1017e1309f65481af918314a4ceb43c6acd20ac1bba2e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/an/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/an/firefox-140.0b2.tar.xz";
       locale = "an";
       arch = "linux-x86_64";
-      sha256 = "ddb7dea1828c4906c5a6126f1d325d4eafade0a247d0f22fcc9c4e212bb79010";
+      sha256 = "2380b688d5f54edb3b0a5ec3fa7adc5f6f01513551a3d02bfed1a0ada05ddc05";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ar/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ar/firefox-140.0b2.tar.xz";
       locale = "ar";
       arch = "linux-x86_64";
-      sha256 = "cf581f622fb37c71e2886fd122bdc826600ab04cb8a2a5725905d29ea087157a";
+      sha256 = "fde74a9a25843aa6141c796958f9cef020b3265a9578aa63a268365cc1be8e69";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ast/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ast/firefox-140.0b2.tar.xz";
       locale = "ast";
       arch = "linux-x86_64";
-      sha256 = "436e4ab12e59de6b5cb5cba78d3e68db43e0408460ba46b25b81e03effd71eb0";
+      sha256 = "3112d67a4d293f672694661266791521d16e3cde918eedf65f3157e9a2b9f008";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/az/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/az/firefox-140.0b2.tar.xz";
       locale = "az";
       arch = "linux-x86_64";
-      sha256 = "1d62aa36c32b2dc2f4af25ba12679436bcf79e50c2b73db1624e4fd7bf46933b";
+      sha256 = "1904894b09994f8f9ffccc32a295237ffb94779787ff04e2f427416d0912f319";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/be/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/be/firefox-140.0b2.tar.xz";
       locale = "be";
       arch = "linux-x86_64";
-      sha256 = "f054bea6716d06ef8aecbbf147d3c81cb61f514e82ad57f515204aa176abc33d";
+      sha256 = "9393160070ed056e5d1568e90f68ebdd13323e894b79fd05afea64f207231131";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/bg/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/bg/firefox-140.0b2.tar.xz";
       locale = "bg";
       arch = "linux-x86_64";
-      sha256 = "ffb4c108609792de752947becc51c2e2975e90ea0fe46d44601c186f804eab49";
+      sha256 = "c521605cfd30f37dffb5b1063d18f40c35d843782480befa7b4e3a91c9960b80";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/bn/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/bn/firefox-140.0b2.tar.xz";
       locale = "bn";
       arch = "linux-x86_64";
-      sha256 = "877a26a16590cde1bcd678b0d419bec76f09cf4be230d0fc93fddf751c08b13e";
+      sha256 = "3d31bd1fbd7d9cac8ce4c4a9f1ed2595d17319dbe640aa8d07b96fce80abba28";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/br/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/br/firefox-140.0b2.tar.xz";
       locale = "br";
       arch = "linux-x86_64";
-      sha256 = "55bd564631ecc2614080ce653ad5312ec5d7de98df948b1bbe8dd9e613cc77a5";
+      sha256 = "39c1e6cfca4001c63698e066753269d29328fd3188f9fd2ee8c89a35b72da079";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/bs/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/bs/firefox-140.0b2.tar.xz";
       locale = "bs";
       arch = "linux-x86_64";
-      sha256 = "f33fbced526a89acab9fc34a860e4811cb83842a583f6d7871d11152ff1fee4c";
+      sha256 = "406e850b89cf20211936221b208bc164a8a73b02fc5d6a9bf791cdf7a7e9c439";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ca-valencia/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ca-valencia/firefox-140.0b2.tar.xz";
       locale = "ca-valencia";
       arch = "linux-x86_64";
-      sha256 = "d9c250c770914d018f596cb15ff87c0d009ef0121a040f09c1c2e8c95e415570";
+      sha256 = "0093fcdc460bc29b826f66da5711bba2b70fe584c41c830e2555f71f33111baf";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ca/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ca/firefox-140.0b2.tar.xz";
       locale = "ca";
       arch = "linux-x86_64";
-      sha256 = "1a675352282c3fb2966287a0e763defc6f259ea396ee17c9ba4d71e79ce263ad";
+      sha256 = "9ed9e2eeb261926aa79faa89122887e7ad0a07b2dd764f05ef140e709a413779";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/cak/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/cak/firefox-140.0b2.tar.xz";
       locale = "cak";
       arch = "linux-x86_64";
-      sha256 = "3a672f2a6b1132d0cc37c9fac289c7029588d585e887a05943e01d2df0059562";
+      sha256 = "1b4b3619ef9114b3713a64aa5afec1f33861dc6335bcce5449b86676f4b6a0ee";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/cs/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/cs/firefox-140.0b2.tar.xz";
       locale = "cs";
       arch = "linux-x86_64";
-      sha256 = "f83bde54b11b0cb95c49a953d74f5d9dba8351e775ddb53238debeee26ab558b";
+      sha256 = "89ada949f223c2579be305656a3dcbdead12465bde6d6ee2a464bb3c92455e77";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/cy/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/cy/firefox-140.0b2.tar.xz";
       locale = "cy";
       arch = "linux-x86_64";
-      sha256 = "6876cb45e012664a3ddeeb8d833a28d97af191b3653a850393ba24c850c1c327";
+      sha256 = "4c18ce881a44473dd2e4e5ad1b7732bfafbac5519d92e036ee59f61319d2de4e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/da/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/da/firefox-140.0b2.tar.xz";
       locale = "da";
       arch = "linux-x86_64";
-      sha256 = "438f790a0a0c8648c9d265a4e3d487d87ffd6b41beb91bddc8b60e538e2a7d40";
+      sha256 = "d00cecaa47c94d895a6b94e155e8e24fa43abdd83d9f96aacdc34a1c70b2d6eb";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/de/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/de/firefox-140.0b2.tar.xz";
       locale = "de";
       arch = "linux-x86_64";
-      sha256 = "70d4882852da68a7e431de93377cb7b7a1f68b906c2b3332f6b65ec705f5256b";
+      sha256 = "6039041822411f42a6757c4f53f85f1036c2094b8e8a8d8ec6a26f3c1abe521e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/dsb/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/dsb/firefox-140.0b2.tar.xz";
       locale = "dsb";
       arch = "linux-x86_64";
-      sha256 = "7e845675e5a334b6080505f62790e6dda22aca0f07af1e1599faa9b2478ac3f0";
+      sha256 = "9845539a1db4a76ce1f31047471815f2a2ca4adef51d2b56c6fe487f7b9eafb5";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/el/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/el/firefox-140.0b2.tar.xz";
       locale = "el";
       arch = "linux-x86_64";
-      sha256 = "07675440e77b87a0b64a83b28e59be294fc559f7fe4d5d6506cd34fe4dfa69f7";
+      sha256 = "b468c6b5ca6163aeb94ec45ef16fb856cc02a75fc55d939d2aab6181a777d8f8";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/en-CA/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/en-CA/firefox-140.0b2.tar.xz";
       locale = "en-CA";
       arch = "linux-x86_64";
-      sha256 = "988e4e463a5e3684df5633e11e5e37dace06626bb20e04b1b69e9ef089d962cc";
+      sha256 = "ebadf4008439945b4909f0b4bc68515e89837ea871fe09c76dfd78e194469797";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/en-GB/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/en-GB/firefox-140.0b2.tar.xz";
       locale = "en-GB";
       arch = "linux-x86_64";
-      sha256 = "b1c268a2c350a065e37cf259c81b6e535c0597c15e046fbac6dbcc064625bcdf";
+      sha256 = "f73ac36adeae16e5b0a383dd65ccde3946072de55094b52259cf96b5ee78d732";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/en-US/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/en-US/firefox-140.0b2.tar.xz";
       locale = "en-US";
       arch = "linux-x86_64";
-      sha256 = "7a5f6f3816f25442272606ed5e45a9db22c507f0ceaec5858e55d02e4dc10d54";
+      sha256 = "ab17cf4f447bc681649903aca837c950f62e7fee004eaaa9fc2c894f6d001891";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/eo/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/eo/firefox-140.0b2.tar.xz";
       locale = "eo";
       arch = "linux-x86_64";
-      sha256 = "b36ab4a47cb20b07b1c1ac77c3cd24fb850feb40261d398bc0b1f16d7e1f0e1f";
+      sha256 = "6f61eb153692e3de7bf83da4670c44d524aee1761aec5c8e54c9fef3ac843d72";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/es-AR/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/es-AR/firefox-140.0b2.tar.xz";
       locale = "es-AR";
       arch = "linux-x86_64";
-      sha256 = "cd03f278e58beb350683174d9614b78e41f2f0ec1552d50882dc1c405bc37ee6";
+      sha256 = "1ad06fdea8283a58544922066eedb16801d07ad7ed72cc6fc817a33f36741e69";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/es-CL/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/es-CL/firefox-140.0b2.tar.xz";
       locale = "es-CL";
       arch = "linux-x86_64";
-      sha256 = "1ff43a0e99f0f540944209470ae660756cd41a1b9e5fa267a78cdfa1b6ddb287";
+      sha256 = "79963ea997d12e82e245364556fd7c4deceacdaeb1e0c7e4376c7e10df6d5eca";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/es-ES/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/es-ES/firefox-140.0b2.tar.xz";
       locale = "es-ES";
       arch = "linux-x86_64";
-      sha256 = "9a8abef988292db0d3e2b7d728770d6e8b397f90493acba75b2910ff348114dc";
+      sha256 = "cc966099a59e66bfddfae99a9a5874490ed5716fd5af99b9db03e3f13125dd80";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/es-MX/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/es-MX/firefox-140.0b2.tar.xz";
       locale = "es-MX";
       arch = "linux-x86_64";
-      sha256 = "f76653c3b4a3d7244eef6adb61ea79903f42133deb4ec5c93715cbe06dbaa1e9";
+      sha256 = "ad8b1bf472d0a377fea8e0f5b532a144b397d1447ae85c7c14f871d9029cab19";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/et/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/et/firefox-140.0b2.tar.xz";
       locale = "et";
       arch = "linux-x86_64";
-      sha256 = "3f725c9a2c84f3eb329d321ddd4b3a3ea6a21cf64fb3f18dd0fb681af378b007";
+      sha256 = "296e93456cc6e9027d187ca7b59923acd330066b36829f8140ca16d4ec423d20";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/eu/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/eu/firefox-140.0b2.tar.xz";
       locale = "eu";
       arch = "linux-x86_64";
-      sha256 = "bec67bfbfae8f1a0969c1bd083d200db25e9d7efadea0192955e2ca5be3a506d";
+      sha256 = "9269d0e584c4d004d6cb2c6f3d3859329947fada0413141b77cab3e4270e594d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/fa/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/fa/firefox-140.0b2.tar.xz";
       locale = "fa";
       arch = "linux-x86_64";
-      sha256 = "c37543777fc3c90368768c730398c1782400f94e05b26601cb6068f0b947284f";
+      sha256 = "02a5f409e51ec0010f551afde246a7b405a642fbdc9c85e8e021c7bbacc298b0";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ff/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ff/firefox-140.0b2.tar.xz";
       locale = "ff";
       arch = "linux-x86_64";
-      sha256 = "cd4af2a894a4a6f523aced106bad12f91ec41ae9409d0a5b32a1ee99f09c184a";
+      sha256 = "89a1e5d4e8d81ed4c3e2b0db3cb82acfe85f00c7875a993d9ef97a895a2c1e8e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/fi/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/fi/firefox-140.0b2.tar.xz";
       locale = "fi";
       arch = "linux-x86_64";
-      sha256 = "7e9e1692e2d870375e17d8f91be4808118409088160bc61df8d2ea99fc4879b6";
+      sha256 = "feb7014dad2848a0e70bf2cb6f59fd7cbe4526566e9517ca636c7f81af1fd227";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/fr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/fr/firefox-140.0b2.tar.xz";
       locale = "fr";
       arch = "linux-x86_64";
-      sha256 = "2d1eb3ef8903cf00994a8b0b249cc806f0085b8ac4de11da66cc0611ec9ca62c";
+      sha256 = "d8c21f84f555a7ed705d7a21098151195a18a1ceeb8838a6204aa8b346e3b77e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/fur/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/fur/firefox-140.0b2.tar.xz";
       locale = "fur";
       arch = "linux-x86_64";
-      sha256 = "1b6a9f6592e3b2d35553c39b8bd59a1d0e7975c16d6e742fb748fc5071e61c8d";
+      sha256 = "df6870ff18a549566f89c864349f6e1b1be1e996af61a23f6ba8c8ebdc43ea99";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/fy-NL/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/fy-NL/firefox-140.0b2.tar.xz";
       locale = "fy-NL";
       arch = "linux-x86_64";
-      sha256 = "9bea116bfd10e2687fd903fa533642f9380901196a4068a8d19d05176aa9b8df";
+      sha256 = "800b0a1ca94fdb9bf745c163053816152a62bfc374682fcb46920c281de24c7b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ga-IE/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ga-IE/firefox-140.0b2.tar.xz";
       locale = "ga-IE";
       arch = "linux-x86_64";
-      sha256 = "fcc39ffaccfddff75c5b9dff184a7f67df03c24598910dd4d89380e29fc9fbdd";
+      sha256 = "60d3d9b322ed276db8495119171dbc822dac0720fa67d6e0e2417d5f7d903303";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/gd/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/gd/firefox-140.0b2.tar.xz";
       locale = "gd";
       arch = "linux-x86_64";
-      sha256 = "3bfc75d90fd3c4cc7a271350e7b4474ac5dab71f742aee22bd994c775906fab9";
+      sha256 = "fdc316f98f0b7c6c58e11a85df0596763276f506b224a79c17314bbcedd76b18";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/gl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/gl/firefox-140.0b2.tar.xz";
       locale = "gl";
       arch = "linux-x86_64";
-      sha256 = "9a1008adc5c74857777bf8379bfcfd5592c987c36b9495534ae6c5cbd1be740d";
+      sha256 = "3f541084a75bfd470f9684ff0e9c64566ae1ae70ec6cab992f641d1ea711f56f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/gn/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/gn/firefox-140.0b2.tar.xz";
       locale = "gn";
       arch = "linux-x86_64";
-      sha256 = "46aa366e2df1df9365ff81214b637ab563689d53714f78c4950bca7e78334678";
+      sha256 = "403181843d5b8b0a511fb1c8526ac04938750ea19ce5bea725c6f6e67aab4cd9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/gu-IN/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/gu-IN/firefox-140.0b2.tar.xz";
       locale = "gu-IN";
       arch = "linux-x86_64";
-      sha256 = "c6a34a993efa290921958cc79bf4a59a9fe66548a7684710a8eaf07f1e62d9ec";
+      sha256 = "a0a75e18c30ba231bbb8696d47f203f35800bfa945b010e4b67102e9ea995a57";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/he/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/he/firefox-140.0b2.tar.xz";
       locale = "he";
       arch = "linux-x86_64";
-      sha256 = "86462bfc1e78034b69e106d1c3a728ccdd1f18ded37563fd9d7ee37d2b98fedb";
+      sha256 = "da0a1845ead82dbec393b3951ddfb050ea7b1eddf07d1dd52c6ea3941629373c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/hi-IN/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/hi-IN/firefox-140.0b2.tar.xz";
       locale = "hi-IN";
       arch = "linux-x86_64";
-      sha256 = "36235be9dc59e2c093a43ad0d7ec6ae8341f8afa9fc939c6d29590acbd384e72";
+      sha256 = "9cfca47a6e5c5ce56679575657cc52da56a04cbdfeba9fdde7eed2f7dca21e01";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/hr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/hr/firefox-140.0b2.tar.xz";
       locale = "hr";
       arch = "linux-x86_64";
-      sha256 = "20eafa0b16a86da30b39dcda17e232d69b0df3e02f1301d7c52e192768ed52f6";
+      sha256 = "e2412f9401f913fb3f78c68c242ed2bc7727e4798145f6d78e7ea7bb1e2330b4";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/hsb/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/hsb/firefox-140.0b2.tar.xz";
       locale = "hsb";
       arch = "linux-x86_64";
-      sha256 = "e99331dc0ecd3f9be2dfa63dfabb71c2b3d8d84b62fbdbe67faaa6e106cfe2b6";
+      sha256 = "eef6641537eb1902fb5c80f85c028012151a864a011d87dfabdfff4860adcdea";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/hu/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/hu/firefox-140.0b2.tar.xz";
       locale = "hu";
       arch = "linux-x86_64";
-      sha256 = "1d14b5d69e230ef6ec21f2376b07230b64981e66f79c968c47ff109b34fe421a";
+      sha256 = "338ce874b6b6e7c18c805488eddbaae60cc0070dede2768e1fe8bd807efa858c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/hy-AM/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/hy-AM/firefox-140.0b2.tar.xz";
       locale = "hy-AM";
       arch = "linux-x86_64";
-      sha256 = "cf226323063c8d2786031a888b9001b18f282708e858247f9180a1bea3451282";
+      sha256 = "fce3954dab579911bc3f3f2daa4139b6567ec48ba209119fa7a890835abb25b8";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ia/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ia/firefox-140.0b2.tar.xz";
       locale = "ia";
       arch = "linux-x86_64";
-      sha256 = "b4d61eab8372f1cc20f28c1a3e8c1f72b21d584c0dd45266a715ac116e4e0c04";
+      sha256 = "cd252dfb69f3c202f6a10a1f94a3958474b281c5648c86fe1fd7058f1cc0daf4";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/id/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/id/firefox-140.0b2.tar.xz";
       locale = "id";
       arch = "linux-x86_64";
-      sha256 = "7086deb11a567fb9e15a2b301fe4234aff8ba5125cd6a9371700f10e6e89a06f";
+      sha256 = "c4110ddcbb1ffe4ef89423626887c8f2f093c26e449f109eeec04e23c8f86f82";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/is/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/is/firefox-140.0b2.tar.xz";
       locale = "is";
       arch = "linux-x86_64";
-      sha256 = "f37387831ad3722a61a9bdf082e15cdcbdf6f9757be183bf2f4ff44b7e44d1e2";
+      sha256 = "27093bd2b6373dc87174473b087afa19fb9073978819157adca9afac9c1b01a7";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/it/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/it/firefox-140.0b2.tar.xz";
       locale = "it";
       arch = "linux-x86_64";
-      sha256 = "9957340442c44bbc4ce06897545bb977a290263377ee3eae5b64616e561b1a21";
+      sha256 = "d7cd7f8f77550be23ac2f834ec892711bdfd40301eb60eb8041b6373881a8063";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ja/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ja/firefox-140.0b2.tar.xz";
       locale = "ja";
       arch = "linux-x86_64";
-      sha256 = "8eebb7e6d6351a8269b83fd8095b86bf8b2f4177565cd2fdd323717cef6971ef";
+      sha256 = "547d409c2fae32d519b85a0ecaa4fa798035de83a99a24b8679841450816e918";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ka/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ka/firefox-140.0b2.tar.xz";
       locale = "ka";
       arch = "linux-x86_64";
-      sha256 = "fafdbba964ad85b38565589118323d1551ac5021e041a00e29b8a629229e2085";
+      sha256 = "7c8283de2bd1b175da442f54374737d1c483714ff5a65614393a831d87da5587";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/kab/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/kab/firefox-140.0b2.tar.xz";
       locale = "kab";
       arch = "linux-x86_64";
-      sha256 = "ef2f0225bab971c7b6b6237cf2795e9281730b459812209f2d11656ad39e698d";
+      sha256 = "f79764adead47510e6af35e084c4bc23e550a07d700e9bf315825eaab019da2e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/kk/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/kk/firefox-140.0b2.tar.xz";
       locale = "kk";
       arch = "linux-x86_64";
-      sha256 = "cdfebcd9afe5c55c6ff84543580e08108f3e362751f09b99cb703c20dc1de3fe";
+      sha256 = "efafd746dbcc752c401d19475513a567cbd334f6ea3f9d64470bb5e1f67bf443";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/km/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/km/firefox-140.0b2.tar.xz";
       locale = "km";
       arch = "linux-x86_64";
-      sha256 = "ea997189f11e283f1d37e7e8a148f45ae0f7557fefc23501d2cf534a4f4d423f";
+      sha256 = "5f06885bc54c63e176f521e39030a5cc6efa850a49b1329a06332881143d9d56";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/kn/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/kn/firefox-140.0b2.tar.xz";
       locale = "kn";
       arch = "linux-x86_64";
-      sha256 = "005b89059b12d1369c338f9206e899c76c0d5a97ad94f28564778fc092694814";
+      sha256 = "2af7d765a6093ad174cfb34b89782d6c0ce17555d6b12650ac9e17f4fd383d87";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ko/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ko/firefox-140.0b2.tar.xz";
       locale = "ko";
       arch = "linux-x86_64";
-      sha256 = "56282aec275e94b3a556e3a9b95e107e68cf366f6d2a9dc8ce7fbcea9bc23ddd";
+      sha256 = "7ebf5fda02c87f0eeae2036ba3ef26f166cddc131ee165ae4e18c50e69ed676f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/lij/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/lij/firefox-140.0b2.tar.xz";
       locale = "lij";
       arch = "linux-x86_64";
-      sha256 = "8ff69cc72d47d3e212280b8ae004abbb9a34b6e052cfb81f6fed4b1c0d85f8cd";
+      sha256 = "c864a48999305e753d72ece78900eb7a97a3dad8eedfc8a72374c58f1d5227ba";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/lt/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/lt/firefox-140.0b2.tar.xz";
       locale = "lt";
       arch = "linux-x86_64";
-      sha256 = "353a5ff5baa875628c32f6a0b7cbe5234209616684641032493394c986811cdc";
+      sha256 = "04d711be33f1fae9366442584a7f2bbffd74fc3b3854728db5dcce37e50f31c1";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/lv/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/lv/firefox-140.0b2.tar.xz";
       locale = "lv";
       arch = "linux-x86_64";
-      sha256 = "7eb1a0e3e0441da2df5082693588135b8e7069a29c82c1331d3defdf3e68b837";
+      sha256 = "1568ed415833621077555b9c9ab1341882ec1f8f1ba17c596d51bbf40bace3bf";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/mk/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/mk/firefox-140.0b2.tar.xz";
       locale = "mk";
       arch = "linux-x86_64";
-      sha256 = "d7df7d215f440025117d472c7962f10b3db26536d424b633860bd0a2b8634e13";
+      sha256 = "f7fab263b90e197038ced58d845c8ff1220d4b7b10dc2afa3265ad0027856353";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/mr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/mr/firefox-140.0b2.tar.xz";
       locale = "mr";
       arch = "linux-x86_64";
-      sha256 = "9d6b1174365423cac77f4066e174ac0e24808cb8147cb0fc4a04f526883f3038";
+      sha256 = "6e7b7b1d9977bc6d4462e08ed6e2a49ce22dcc8ae408dcc832f63d04b878e5e8";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ms/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ms/firefox-140.0b2.tar.xz";
       locale = "ms";
       arch = "linux-x86_64";
-      sha256 = "1e3eb5e62665157538768e85c30728e1b0916e9637a4d7d5f3fb390c9bba31c1";
+      sha256 = "17306a80a5bbbaa00ca9c1bb3717f25c49ed94c18c58c751c01292e8a92e8a03";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/my/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/my/firefox-140.0b2.tar.xz";
       locale = "my";
       arch = "linux-x86_64";
-      sha256 = "76fed1cabb2e1ec137e939d6b0318c32e23e5fa9d5602c08f6a9e56f0a469734";
+      sha256 = "eff89fa784ad8b0f039fa182ed67159aca185093402ddbf33752ef327bb4dd43";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/nb-NO/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/nb-NO/firefox-140.0b2.tar.xz";
       locale = "nb-NO";
       arch = "linux-x86_64";
-      sha256 = "afb07ebb11a8e3247b8689a7809bb33a83cbe88ded223e5967d4251541f3d55b";
+      sha256 = "cddb858d97fd0206ad5b138d41d29acff16199b35cd6fcbe1c70d3ca126da3e5";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ne-NP/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ne-NP/firefox-140.0b2.tar.xz";
       locale = "ne-NP";
       arch = "linux-x86_64";
-      sha256 = "a877b86d57e978bb020d9a4447a96ae85f0d8c9bad117373f81561e8379ac051";
+      sha256 = "291570b761874ce5146d1282972abde6da445c7cf63be89f3d4a2abb5ae52369";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/nl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/nl/firefox-140.0b2.tar.xz";
       locale = "nl";
       arch = "linux-x86_64";
-      sha256 = "5aead7a62bbfa6f765be274d64d6d8a6402b2dd6ee68a571600e64433a871854";
+      sha256 = "00139cb8cc6c4c5f6f478c476ffc00450d57ba239288462bd296b72aee205562";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/nn-NO/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/nn-NO/firefox-140.0b2.tar.xz";
       locale = "nn-NO";
       arch = "linux-x86_64";
-      sha256 = "d35f50beb12afd6427c615f4faba025e2679289b7eed8772b9c2521c0f096130";
+      sha256 = "1c3f80cd5e39d450564a7266a58104e117f892243a5166ba6a5c79a12371cb66";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/oc/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/oc/firefox-140.0b2.tar.xz";
       locale = "oc";
       arch = "linux-x86_64";
-      sha256 = "a309df62f5d50210dab2d410ddf72cf8ce83124e49250d010a3098d45a519403";
+      sha256 = "6fafc879c80e60d49c32b7752dce41906213132e3a19e3eaef5edeccb2d6b389";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/pa-IN/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/pa-IN/firefox-140.0b2.tar.xz";
       locale = "pa-IN";
       arch = "linux-x86_64";
-      sha256 = "76fa9af171ca8ef48f2d40dd357dff2f4f434ec5972934d8d5660b975d9ff14e";
+      sha256 = "c7bf8f30d961adcd6b560d855357a0503bfb5ffa0295ced4f92f6e7b6f0c63b2";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/pl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/pl/firefox-140.0b2.tar.xz";
       locale = "pl";
       arch = "linux-x86_64";
-      sha256 = "441c0d7aa570ab16c13da29e1eef27bd58277b0546481dd455af687eed1c3546";
+      sha256 = "43345fd177e16fda3bead11b3e6c094ce947b4913d401c2d849b13607d8f1474";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/pt-BR/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/pt-BR/firefox-140.0b2.tar.xz";
       locale = "pt-BR";
       arch = "linux-x86_64";
-      sha256 = "401cbd05af87d88f8351a6780a200f32d3e5521ddf8dea09f4caceb565eff554";
+      sha256 = "8d20b449e1f5dec93f7526bddcb01682478df46b7d6b647235f94d86ff47327d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/pt-PT/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/pt-PT/firefox-140.0b2.tar.xz";
       locale = "pt-PT";
       arch = "linux-x86_64";
-      sha256 = "1a64160ff804281709b279c0671be0a378020c3e9cbbafc21c537212af67566d";
+      sha256 = "0f9febcfb684ea28734508fa27dcbb89282174c8ab04fca0d99adb2596b1bb08";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/rm/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/rm/firefox-140.0b2.tar.xz";
       locale = "rm";
       arch = "linux-x86_64";
-      sha256 = "d05161f9d5a54db76b46be34c13bd628645f57175e237d691b4607f8bb1ad13c";
+      sha256 = "505a664aa0b5eb7fb919437655f807f87224ca346bdde982eaa6bc755e14bae1";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ro/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ro/firefox-140.0b2.tar.xz";
       locale = "ro";
       arch = "linux-x86_64";
-      sha256 = "01813e83959f3c51d841d5d5a134b903fdd6908c77f932219f7f2976be33d151";
+      sha256 = "fe1317999e0d07e634f4da7813e25d553844339ef484d055115be201d351c94d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ru/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ru/firefox-140.0b2.tar.xz";
       locale = "ru";
       arch = "linux-x86_64";
-      sha256 = "60562e6b5bad99bd61b31790993b1af13d66b71888b75680ea2ff2a0a429a682";
+      sha256 = "45808d9eaff267c7aa5263291352f459e30988e00a3ec867ac0e4eb9e3fa5828";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/sat/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/sat/firefox-140.0b2.tar.xz";
       locale = "sat";
       arch = "linux-x86_64";
-      sha256 = "363eedd05b26529651905995a75d4fa7cc4a4cb0eabd71223011df8819b2c9e2";
+      sha256 = "e2ddcf9086a5aab8039b2ee40264ea5349bf27f424c8cebfd8d3f8be64b4812c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/sc/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/sc/firefox-140.0b2.tar.xz";
       locale = "sc";
       arch = "linux-x86_64";
-      sha256 = "d4893587265913d0cdab363809038afd61a0c96f8add8605f8f709d7cf6df1c2";
+      sha256 = "6c10bf086c38c7f030cd1ac37ddeee3e7900262367a26d873f1130f1b1a3fa1a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/sco/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/sco/firefox-140.0b2.tar.xz";
       locale = "sco";
       arch = "linux-x86_64";
-      sha256 = "9c56abbb7208a26d8fbf1ebd3dccf42f23da60c73df628eaa44b9293e128f5d7";
+      sha256 = "fc5a205155469cdd157423b526c5ddbb8ef6619518543d0a13138e4548902c98";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/si/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/si/firefox-140.0b2.tar.xz";
       locale = "si";
       arch = "linux-x86_64";
-      sha256 = "f9d59c8e43c249293c844c8e46fe001aaea050fc32a9e06dac0544319b248872";
+      sha256 = "f0165747a086b031eaed9fe6d56a6a664d48cc2cc1fcb4acf4cb2980680bbb18";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/sk/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/sk/firefox-140.0b2.tar.xz";
       locale = "sk";
       arch = "linux-x86_64";
-      sha256 = "d7e396c453b86e7181a0af09f5a608b7b3120d0b2df93fbce472c4935ee1cb25";
+      sha256 = "3139af3d80de44cabe66907b1ff1a0c9abd6d4dcce7cb8f6a8a4c64cc96d0d6e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/skr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/skr/firefox-140.0b2.tar.xz";
       locale = "skr";
       arch = "linux-x86_64";
-      sha256 = "4b120fda51484bcc9e7251ffa267a42dea1328148476252dff33c22aa10da3c2";
+      sha256 = "4bfd49af3b1a4af17b4830ddad90e3d4742baf9ad3b296ad82c186e46e002c43";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/sl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/sl/firefox-140.0b2.tar.xz";
       locale = "sl";
       arch = "linux-x86_64";
-      sha256 = "c145d10b2a5ed42b1e0ec7aac49caf51468f200f361b0d3b576430f14825e0ea";
+      sha256 = "e58e08c08ce875647350c17919a247d1d959e9aa7cf090b9e1f631e3904e1c49";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/son/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/son/firefox-140.0b2.tar.xz";
       locale = "son";
       arch = "linux-x86_64";
-      sha256 = "bb0a17d3089ea0fd8809fffc43258b2ea2d98e8a3ce96385ea80fd859f82ba2e";
+      sha256 = "df8df3a9d363721f5d7284c95e690938a9669bad7d1cbc659318e71807bfef61";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/sq/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/sq/firefox-140.0b2.tar.xz";
       locale = "sq";
       arch = "linux-x86_64";
-      sha256 = "a013d51f7dfd0ac9da4cb6159034027ef7bc3360de3421211f5ff453912d9065";
+      sha256 = "78c45ef74932ad3264ceffa6ca2a3d5863642b8febd784016b5dbe4ad515ce3f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/sr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/sr/firefox-140.0b2.tar.xz";
       locale = "sr";
       arch = "linux-x86_64";
-      sha256 = "5388d19db672524f2a4d5975070a4e5fe09d9bddba8b9a3a54c2cb3052b3c28f";
+      sha256 = "9a3b7e25cd80c19c9ee0ebf2b9cd7fb956969b1a699348859193bb3d138a16f5";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/sv-SE/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/sv-SE/firefox-140.0b2.tar.xz";
       locale = "sv-SE";
       arch = "linux-x86_64";
-      sha256 = "49600c47143f89d34657577d1175db5c415d4a4a6766e1c410db58337371004b";
+      sha256 = "864703a7933ca315ef1dcaf1e978b9fa61035a160cc3017bb6df53d50e42cfe9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/szl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/szl/firefox-140.0b2.tar.xz";
       locale = "szl";
       arch = "linux-x86_64";
-      sha256 = "25a6cce7c972c74bb8f8f881200417765ae7deab09405a947a4010002cb5fa82";
+      sha256 = "e63cd0f41501fccf3d6da7779e6926971122b9a40509cb57719ca987417d6231";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ta/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ta/firefox-140.0b2.tar.xz";
       locale = "ta";
       arch = "linux-x86_64";
-      sha256 = "ca4eb3d2ffcbfdf0e70a42bc358854b99fb9d8b297959530b25db69fff8da6b1";
+      sha256 = "8d45af2c0e6cf88a02c25b7c5fb31dc844bb90ddc8aeec774ad8c700ec12919c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/te/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/te/firefox-140.0b2.tar.xz";
       locale = "te";
       arch = "linux-x86_64";
-      sha256 = "a642f8335f263b9fc58ec32128ac3467c1dd2879ab72b90e74411afa723685eb";
+      sha256 = "0d0868ec91ad13430488eba13840a0fdb238a355a0b74ede0bd536c6cdc2d013";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/tg/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/tg/firefox-140.0b2.tar.xz";
       locale = "tg";
       arch = "linux-x86_64";
-      sha256 = "08636c243613e677caf9726e73e640165f90d0fb3b7f5d7a85535a9d20af06e2";
+      sha256 = "2112d847a6377c3f4b6fddc2064891f17348a0639a6341833cc6a8681aca2496";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/th/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/th/firefox-140.0b2.tar.xz";
       locale = "th";
       arch = "linux-x86_64";
-      sha256 = "4586b68f7a73cbaa86eab8a2a67b904a3300ae485b85ff878f442e58f2c25a86";
+      sha256 = "a49f6e380f2ee83e08b9bce632ac9adc8863eff92f043886e6dff361af0d9fd6";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/tl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/tl/firefox-140.0b2.tar.xz";
       locale = "tl";
       arch = "linux-x86_64";
-      sha256 = "29d943a1e465b089e4b4216bff1343a3b267bc2d0e6757429dfdefe1123c87be";
+      sha256 = "a05dc7b3b86eb5c6c8e8bbd405c356ce6716ff7f57048c502a16dba1dc616778";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/tr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/tr/firefox-140.0b2.tar.xz";
       locale = "tr";
       arch = "linux-x86_64";
-      sha256 = "c0ebd1339d95eff201d85bf549f38ca93907021853a2841dbb48bb7587f84890";
+      sha256 = "be4ff7df882a6bbbb82426868abd07b3bc31328b72faab12c50f44910a04157b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/trs/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/trs/firefox-140.0b2.tar.xz";
       locale = "trs";
       arch = "linux-x86_64";
-      sha256 = "fbdd2bf864b5d2cbb0b633b733c70c71457c04cb405b0aa14c4dc83a5380f4e1";
+      sha256 = "b59cd940914a1dc6034648cb4d2eb98a27db282a63f549670112c005a4fc2c22";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/uk/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/uk/firefox-140.0b2.tar.xz";
       locale = "uk";
       arch = "linux-x86_64";
-      sha256 = "9f2af01f2187bc3dece162cd493ffa46bbb7b4af25aed176f81bc1bf99ab8f3e";
+      sha256 = "cd723b22c8bf8d857e68ba7b7101a42451fd4e0e9216898165194dba6f66600c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/ur/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/ur/firefox-140.0b2.tar.xz";
       locale = "ur";
       arch = "linux-x86_64";
-      sha256 = "4d3e57b37ea0d9f498701e768e6a1d3ebed495c83715df9b0623845b9ebf4464";
+      sha256 = "23307a580138e4f1e8de9de441c1dfa274b871daa68274510683ce02d1bc4554";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/uz/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/uz/firefox-140.0b2.tar.xz";
       locale = "uz";
       arch = "linux-x86_64";
-      sha256 = "c9419b604b2a6e91cdf9f3c7fcc1a7213eeba095a7ca4950138d4757326a5337";
+      sha256 = "75554e0cb06a1244106e2cab513286d0a48c4b5c5c2645b373e20245d8163d5d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/vi/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/vi/firefox-140.0b2.tar.xz";
       locale = "vi";
       arch = "linux-x86_64";
-      sha256 = "436b6789d5c91955affae937528b38532c09b96f80cca4ff893b593c10720138";
+      sha256 = "a502e8408f00db0089081072b813debb97bc5c60e31c632b460cdc3d1f9f3d71";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/xh/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/xh/firefox-140.0b2.tar.xz";
       locale = "xh";
       arch = "linux-x86_64";
-      sha256 = "ad35a67010effc02db685ab1b05a534e8454a3d7d8d9eac2abb20ea3494440bb";
+      sha256 = "a87cb0aff09dfd91acac6931f5f8ff1bd000533448f8e79950dee7baa29f072b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/zh-CN/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/zh-CN/firefox-140.0b2.tar.xz";
       locale = "zh-CN";
       arch = "linux-x86_64";
-      sha256 = "25efcfc912e9e20d7479ec869afb471d4a4be279500e06f2609bfb5df9d65e21";
+      sha256 = "7616247e8ee73956d925b4a4d4b3ba1b269db286390250ff04ffd066c37e6323";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-x86_64/zh-TW/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-x86_64/zh-TW/firefox-140.0b2.tar.xz";
       locale = "zh-TW";
       arch = "linux-x86_64";
-      sha256 = "a694e1461292c471cbf263f1fca962b27e5bc1dcc655cd9c0f22b6ec868b0196";
+      sha256 = "1070fc52e45b0827958fc4ebe74f4fd4643738a1d20a9647b37620066cf18896";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ach/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ach/firefox-140.0b2.tar.xz";
       locale = "ach";
       arch = "linux-i686";
-      sha256 = "8acea013f0230e45e5dfe7cb2d1495fc31fe8f62e3f0c71021faaeed56f88d90";
+      sha256 = "15dd9a2a6103f8b4e11d558aa1b5def0119929f304fe330f14fec35452ba88fe";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/af/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/af/firefox-140.0b2.tar.xz";
       locale = "af";
       arch = "linux-i686";
-      sha256 = "e9cd59e8ecb6f05aa3f71fbdc898e38f5fe16e7366283a899dc918639bbfabe2";
+      sha256 = "076016952832f1f9923426ccabc14fdce0016572134be4413c323f04929d2b7a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/an/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/an/firefox-140.0b2.tar.xz";
       locale = "an";
       arch = "linux-i686";
-      sha256 = "06f077e94b604c14d4b23b5c7ca90988a91fd77b4923762880a8ecf6d0d96549";
+      sha256 = "55e43ac6458d7be27db5aeeef0a4e25732555645faba647f379140b5b18f1cca";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ar/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ar/firefox-140.0b2.tar.xz";
       locale = "ar";
       arch = "linux-i686";
-      sha256 = "d766a8ce6766609052f059d44b324cf67e872eea704095190a00099b472d1312";
+      sha256 = "1640b262104f1f637240480cb5d7727aadc003ce320f444fa7446b2345239a8b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ast/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ast/firefox-140.0b2.tar.xz";
       locale = "ast";
       arch = "linux-i686";
-      sha256 = "2b4f5ea265d192b4ff27e24ccc60a1b2e70b5e19f5957ab482c6b0d36a4182eb";
+      sha256 = "726dad49420e6f8f6f48b00df01419fa1e25022e1a9034c917732f591d899ab5";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/az/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/az/firefox-140.0b2.tar.xz";
       locale = "az";
       arch = "linux-i686";
-      sha256 = "1659ad578e6b9768e3a2bd2dd2ccffcf1b8d8060c08bb2dd9f45a5a8b35ce6fc";
+      sha256 = "32f38f9452d6bfe9ed0059402286ba86b8e7d49767b84ef68a807009b3928a71";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/be/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/be/firefox-140.0b2.tar.xz";
       locale = "be";
       arch = "linux-i686";
-      sha256 = "7959c9e95a1858961a2322ea9ff572c53d08c5f1e855d5115cf68343f1dfce63";
+      sha256 = "d205be69a64a92dd2dd4938cbe3804e41f9370bd572b0e6bde337feaacc7c80a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/bg/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/bg/firefox-140.0b2.tar.xz";
       locale = "bg";
       arch = "linux-i686";
-      sha256 = "74d7142554e8621b5662d322c5d1eb63a6bb4422365d037212813fc2b1ca17c4";
+      sha256 = "a6a8a3d4b40853a7bcbcae6c142896b69632720d1cd8ff0ef38944dee718110d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/bn/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/bn/firefox-140.0b2.tar.xz";
       locale = "bn";
       arch = "linux-i686";
-      sha256 = "5d40f8cdadf7510337271c98350a14b002462dbb58fd89c7f5a5e898d4d96522";
+      sha256 = "b1ee7cd72876760977922e48ac38cbf55f45bdd191015fd98b72b9169f88c905";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/br/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/br/firefox-140.0b2.tar.xz";
       locale = "br";
       arch = "linux-i686";
-      sha256 = "98606dd41a554c6642b07c7012c8fc0e831cae305c77b17018abd7cf1f835126";
+      sha256 = "df82db0effa2010c5c90fb0795ba63cd8985716d68649d97e15408dc37c6c84e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/bs/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/bs/firefox-140.0b2.tar.xz";
       locale = "bs";
       arch = "linux-i686";
-      sha256 = "319901c06f9ae63714f5e50def341f7af82446d657a4792f6aa0dacefa6c5aa5";
+      sha256 = "87c0752bd5b5a9c2b87c6e538621c2626b4464bd585f906e305e4c5715f97c86";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ca-valencia/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ca-valencia/firefox-140.0b2.tar.xz";
       locale = "ca-valencia";
       arch = "linux-i686";
-      sha256 = "bdbee33f7f53270a075e45854b42f5879eb081875310285ad4b99dfc2494c766";
+      sha256 = "632893b5ad32cc730ade803beef2b413b4df144ea80f233e2b24574092a8036c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ca/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ca/firefox-140.0b2.tar.xz";
       locale = "ca";
       arch = "linux-i686";
-      sha256 = "9b8af77f7db2bd74065f7b56823ea68db58822db1d55e1a9c98d4654d5178e42";
+      sha256 = "000cfb032ec853d10c5130b04e88da02998fd57bf70a07844390cbff55f9885f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/cak/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/cak/firefox-140.0b2.tar.xz";
       locale = "cak";
       arch = "linux-i686";
-      sha256 = "649a2617e215d8f3610de863ddfc29dc0c2b27fb7d642c1e0c9f2c6aa365ecbc";
+      sha256 = "009ba5baaa7d454aa9dcfde0b2b4e6940590b6fd6ad7d5a90003ebaf450a93f0";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/cs/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/cs/firefox-140.0b2.tar.xz";
       locale = "cs";
       arch = "linux-i686";
-      sha256 = "8e8c2e892caa8bc5db5804f42332ad57d1264eda034feb467d6d75827c3a7cd7";
+      sha256 = "67ebd37c779ce36133ccac10894ced3faf9d1131a6d0a71a9f35d73bf4bbae36";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/cy/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/cy/firefox-140.0b2.tar.xz";
       locale = "cy";
       arch = "linux-i686";
-      sha256 = "394bb39242b8631d46d42586611e91b54028fea43d78248af3bb446e6c6834e6";
+      sha256 = "baad091e481f7e3c3e7affc3261a22a5a390e3cb739875af53b4fd09f8995ec6";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/da/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/da/firefox-140.0b2.tar.xz";
       locale = "da";
       arch = "linux-i686";
-      sha256 = "b42f902cab834a1a177afec0812b118280f3733adba9433d31098df63d184d83";
+      sha256 = "62315dee7ee9cbe3eef1b01359ccfd45ef7348d526fb6adf35077c74178dbacd";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/de/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/de/firefox-140.0b2.tar.xz";
       locale = "de";
       arch = "linux-i686";
-      sha256 = "420f1853b37b823edbccdb02e19669d5caca76b2ba3f607a81d11b5654f04c1e";
+      sha256 = "c32d7e2e8f07db2c92c876f835d506568d5aa5df587742aac5b5b38b1d741224";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/dsb/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/dsb/firefox-140.0b2.tar.xz";
       locale = "dsb";
       arch = "linux-i686";
-      sha256 = "5987303e490b524c31619d18cdbcedff7f24d70a1652bb9bba15120d34befed6";
+      sha256 = "9bfbe5c14cc47de7c04d89fc8d753e8cb07e0722b01e694e40769578ab41f80c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/el/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/el/firefox-140.0b2.tar.xz";
       locale = "el";
       arch = "linux-i686";
-      sha256 = "4001d4bce1fff3dba641b7c38c2b26338e40ba28ddad8554c4f7dbbebf1536d6";
+      sha256 = "b847df7a731151defb9a7195e52e5170f914df02f125474c44e3aa63c676c34a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/en-CA/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/en-CA/firefox-140.0b2.tar.xz";
       locale = "en-CA";
       arch = "linux-i686";
-      sha256 = "35707a5d0e7df572c341da8d4ccb76f560267feeb8df785eec304e6c920da3f8";
+      sha256 = "7812b2ddeda5bc1ed121e8512ba2d019edf1596a0ebd5d1a8349613e1745d685";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/en-GB/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/en-GB/firefox-140.0b2.tar.xz";
       locale = "en-GB";
       arch = "linux-i686";
-      sha256 = "02b5a1f051e02b949e7c8df2d4196e6e45cc02a0ae0178f8500c99b67737042d";
+      sha256 = "5b7e6a78a8d98b36cf640282e2aec5b34d9d54dc1c244d45e043de18be59ede4";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/en-US/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/en-US/firefox-140.0b2.tar.xz";
       locale = "en-US";
       arch = "linux-i686";
-      sha256 = "ddf19c5fd706f7d20060d009e26e5f98d15707d7ce1130a3e5209a80237c4d45";
+      sha256 = "60ca80fc4bdfbabe6810ba4ffb1b49eb02147fb05134a3c3eb19cbb2d7ef5ff3";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/eo/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/eo/firefox-140.0b2.tar.xz";
       locale = "eo";
       arch = "linux-i686";
-      sha256 = "75a9e8c3f3f1a11b22be4501fcc6743f6d7233591df6f1f3eee8243fea27e6a6";
+      sha256 = "61947e8887d2f0010de1b1cdd1df5ece9dcf4f9abaa17c76deb48b47a14ef79b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/es-AR/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/es-AR/firefox-140.0b2.tar.xz";
       locale = "es-AR";
       arch = "linux-i686";
-      sha256 = "5a66e9d13ae53b0e163630f1b9a20c4b68f4e7cdbf88c2d2ca702fcf9846d064";
+      sha256 = "8c0c291f1150c6cc45180dce4d94540c947791aaee2172e2f37b57b002aa1784";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/es-CL/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/es-CL/firefox-140.0b2.tar.xz";
       locale = "es-CL";
       arch = "linux-i686";
-      sha256 = "79dd1dcc771346f0aadab81fdfcbc6fe1d532001ae17793447b423b1a85a4aae";
+      sha256 = "aa1444a6092cb96637ef7dc9c44506702cb96eaf633a39302673d040f0b2a9ac";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/es-ES/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/es-ES/firefox-140.0b2.tar.xz";
       locale = "es-ES";
       arch = "linux-i686";
-      sha256 = "90054b5ee7292a1df8f0e7688b35fedcb19f2a8945f0bfb440c44913bd123c4e";
+      sha256 = "0442ff731adeae06a0ea178098ef17c1d0aca3f34ab854a7807c56d2b1ace7d5";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/es-MX/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/es-MX/firefox-140.0b2.tar.xz";
       locale = "es-MX";
       arch = "linux-i686";
-      sha256 = "f18593686f6a02b0bfb66b364b93fbf1f868365eb96e8152ce1500d6c739b457";
+      sha256 = "b260521cef1779ccd7d6b1cbfe66ac2d5cd8ee72f282b6e81110ea40995e9b30";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/et/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/et/firefox-140.0b2.tar.xz";
       locale = "et";
       arch = "linux-i686";
-      sha256 = "b6f65d28916d962223af04027a1b5550ef7e6326924f83115a7b86791220bf2c";
+      sha256 = "f7b752e18302aeab61df546a0423fbdc297d538c35b2038e6e9dd3f0432d55fe";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/eu/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/eu/firefox-140.0b2.tar.xz";
       locale = "eu";
       arch = "linux-i686";
-      sha256 = "410f33a12c705d8ff753b4cbb11942df9aaca3777774e7cb2db5277b7791de1f";
+      sha256 = "e0d403ce1c3fb69e692c0679c7ed65464bd28cdfcb107756bcf66b03bb20f15a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/fa/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/fa/firefox-140.0b2.tar.xz";
       locale = "fa";
       arch = "linux-i686";
-      sha256 = "67728e0982b672da05cf00b46a12e18539a0ce2c3cfbc3f91e0c5b62b6d01408";
+      sha256 = "75eefefa501b4e46f84672aacd3d8e5c96f4bbee41dd652436624de5bbd837e4";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ff/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ff/firefox-140.0b2.tar.xz";
       locale = "ff";
       arch = "linux-i686";
-      sha256 = "ea729dd3c19b979d00c25b6dfdd2f2d633055a9ca389ad5cde5b5154886d25d3";
+      sha256 = "197ccaeb27559a1dd913969a3a8dd011555c8125fcbb55a28caf4a6074b963b5";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/fi/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/fi/firefox-140.0b2.tar.xz";
       locale = "fi";
       arch = "linux-i686";
-      sha256 = "40b78a9e4cea933865f06a41c8a32d276a59bae2488601afa6d6e936669eef4e";
+      sha256 = "61ac2a275d6410f7eb8cc4f9bfd70e1e5e56fd63eaac9447a56f15920221be7e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/fr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/fr/firefox-140.0b2.tar.xz";
       locale = "fr";
       arch = "linux-i686";
-      sha256 = "5828e6b8ebc7b7508f363f9309554b544205479c22b9632e230340774c46e442";
+      sha256 = "9322f072928c09b3d45e9e683ef26480f404def390315f46eaad3aa76c5db4a5";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/fur/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/fur/firefox-140.0b2.tar.xz";
       locale = "fur";
       arch = "linux-i686";
-      sha256 = "bae0801fdbab156db54f0562f246a59eb5f8c24c79ba17fe2b6c98fc9ed91c58";
+      sha256 = "4ca712790eb5a98804b6b21e68cf1d875f9dccd5bd729a7f1231cd3d7b4c85a0";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/fy-NL/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/fy-NL/firefox-140.0b2.tar.xz";
       locale = "fy-NL";
       arch = "linux-i686";
-      sha256 = "0e21ed14bcfc78650f62cffa63d1d9f1a8f21b64b0d258b0e15e346b6f497f93";
+      sha256 = "3ca2c4a2ef1de935d5a3ec0f29314596ef64611fb9025efbee2e809b8bf51da2";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ga-IE/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ga-IE/firefox-140.0b2.tar.xz";
       locale = "ga-IE";
       arch = "linux-i686";
-      sha256 = "a873d3ce455f8f8c82901d9e2b6795e59515263380443801b2e0c9fd050f03b9";
+      sha256 = "2e43d6679a844f9241110f67a785525b09124f004d697b41400686851a45811a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/gd/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/gd/firefox-140.0b2.tar.xz";
       locale = "gd";
       arch = "linux-i686";
-      sha256 = "13d114359f5c30759febb7bfffe79286f3261477a160a35faa3d5d2e1e236271";
+      sha256 = "a51f8e4c872a39f307bbd8c71e56a3f90d84163feed7ca79067ab0f51f7eef11";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/gl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/gl/firefox-140.0b2.tar.xz";
       locale = "gl";
       arch = "linux-i686";
-      sha256 = "57c6b29e1b05a4e75224085c7a8f13a3948930e92204f882092cc71efc7d4071";
+      sha256 = "24fdfac7aa372ea38d4ce642b5e30cdd49c46428e5431b004f368c40d52a450e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/gn/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/gn/firefox-140.0b2.tar.xz";
       locale = "gn";
       arch = "linux-i686";
-      sha256 = "6a197a8c1b138f1eb95f85770e4734fcb400679fe18c0241352dc9d0d025dc5e";
+      sha256 = "9f81e0d531c7a9826889328afcd0e8e8c29cf00b253b0b6ef420fb798ea3d2de";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/gu-IN/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/gu-IN/firefox-140.0b2.tar.xz";
       locale = "gu-IN";
       arch = "linux-i686";
-      sha256 = "53bb01d3b87a5a463b993e69ea9472b9b7dce818ffd41a3efc74b0def2880c10";
+      sha256 = "72ca1ecac233a4e8d51a70edc8d39d6bcbf036827e868b14c9d166c70a7140f6";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/he/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/he/firefox-140.0b2.tar.xz";
       locale = "he";
       arch = "linux-i686";
-      sha256 = "d2f51a83e9f625df054c75b6212c95a2ee98a6ac6912fb37f6dcce151f0d8cc5";
+      sha256 = "2cbffa2df9acd1b30b7e96b14e9dd7d9cc9658779fc24d87cf89f5a5989770df";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/hi-IN/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/hi-IN/firefox-140.0b2.tar.xz";
       locale = "hi-IN";
       arch = "linux-i686";
-      sha256 = "72b1cb85cf3c3774befbafbec03aa95084356b955b6c86acdc2d12fad9a05d57";
+      sha256 = "301469bd1372c6153612dda25c686461d55d5140e65a8f4048d9159b7fba67d9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/hr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/hr/firefox-140.0b2.tar.xz";
       locale = "hr";
       arch = "linux-i686";
-      sha256 = "9d0b4cfa3f23f962e2784f9a17e8998d2a6ee1a3e54740317473e32c790fb1b4";
+      sha256 = "b00411fb0539a1de5a4d025fc938f6352cd38f2a3d586d7c5023cea8d3fc976f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/hsb/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/hsb/firefox-140.0b2.tar.xz";
       locale = "hsb";
       arch = "linux-i686";
-      sha256 = "6ad41bdaeaa4bba9360ea98787f0c84760f849570452425508f3dbb0472e7349";
+      sha256 = "0e9daab014b58ca0b5b065ceb8429b576765ddf692886c0b2709f9cecda54373";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/hu/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/hu/firefox-140.0b2.tar.xz";
       locale = "hu";
       arch = "linux-i686";
-      sha256 = "583782cc9ee0da5f8ff488643ea6a1573979653130bb6120affc1a7ba57d10c4";
+      sha256 = "d1ebe95c9ca85f7ad097a42f01728f7ca4b67e0b0325993cd7a8788bfaacf186";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/hy-AM/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/hy-AM/firefox-140.0b2.tar.xz";
       locale = "hy-AM";
       arch = "linux-i686";
-      sha256 = "bab8bcfd4374d076023b6e1fccf797fb3d83f26d0fa8df75a0d3c5f69879c5c3";
+      sha256 = "84d00b6cf98ff0a2ffc08ead1b7dc61e74f689d69a946f2ab8c0c7ce96299f3a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ia/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ia/firefox-140.0b2.tar.xz";
       locale = "ia";
       arch = "linux-i686";
-      sha256 = "2bd01c27ac6e282be53d72b7993fe9b35847ef5639104924a5d45fc20a42e56e";
+      sha256 = "54fff386745c615db563a7e1344ad4c0dfedbfe9ff1b69311fb96106130eda46";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/id/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/id/firefox-140.0b2.tar.xz";
       locale = "id";
       arch = "linux-i686";
-      sha256 = "d110ba5a2d529cc020a476fcaa8781c35f1071224b33814983b83722fcad0078";
+      sha256 = "d52a44a22505daf7236e289b1653b991d640c2b2be5a9ac4effe0a819e9ef063";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/is/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/is/firefox-140.0b2.tar.xz";
       locale = "is";
       arch = "linux-i686";
-      sha256 = "1bb68a757bb2c9ec9c87522d91733fe55cf5aab0ccfec58cbee67c3a3764df85";
+      sha256 = "f01b7bc84a711c72491dffe4be999cff939ba3fd433572f693d9e3a0a97d2a6a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/it/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/it/firefox-140.0b2.tar.xz";
       locale = "it";
       arch = "linux-i686";
-      sha256 = "6eeaaa32990d457aaaf37804f54e39fee7fbcf90e024797461c76b7b1522bb84";
+      sha256 = "b885a44f52597ece4a719245709263626fefdc94702162523d0c6392e95a9817";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ja/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ja/firefox-140.0b2.tar.xz";
       locale = "ja";
       arch = "linux-i686";
-      sha256 = "ad3d2dc245f06c540b7705e4c43b18477f3ef2b6cb21046f2c6aea5ec3343744";
+      sha256 = "5deaef5a05465c8bfa5f10480f0c0928a498c1b5f495e198bbf5bb187c2139dd";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ka/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ka/firefox-140.0b2.tar.xz";
       locale = "ka";
       arch = "linux-i686";
-      sha256 = "5d1c0a0642967fcd4646e2a615c5033634913b4e55b53669de1a27f6de18d39d";
+      sha256 = "6c8ea6cab65bae0429c9f63b906e63f40233a01dffb061b0c37d60b0c966346d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/kab/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/kab/firefox-140.0b2.tar.xz";
       locale = "kab";
       arch = "linux-i686";
-      sha256 = "fb3636bc0836dc5754a86f40274e3cabb1d32ea1e493cb84bdd0f61b1ce526ae";
+      sha256 = "2c1b647450c0e179548aef5794a596e2053322be9c4b36da78616cad106537b6";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/kk/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/kk/firefox-140.0b2.tar.xz";
       locale = "kk";
       arch = "linux-i686";
-      sha256 = "ff7faeccbc3977063bc69628c64320e0113a6cf0cf487fc0b6253debd7c1da04";
+      sha256 = "36349bedecc9a5d3cc4eca66232925583b82a5f9b7ec2104259f7e5ab2704041";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/km/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/km/firefox-140.0b2.tar.xz";
       locale = "km";
       arch = "linux-i686";
-      sha256 = "fad1f93e314bde16894eb472b2cc2ea41b5227f4d916d15c536b3892fead5587";
+      sha256 = "a50643354ee4c99602b2a31c6ab79a651a6a74692eee373c988c0ccba8ae9574";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/kn/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/kn/firefox-140.0b2.tar.xz";
       locale = "kn";
       arch = "linux-i686";
-      sha256 = "32891d6d78f97ce1eb3f72751252e8ac15474a67ff3b69e0fe78f21efbe50aea";
+      sha256 = "bf484b8f53ce0703250f4ae0adca41b327addd29319a99087a930abaf92296d0";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ko/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ko/firefox-140.0b2.tar.xz";
       locale = "ko";
       arch = "linux-i686";
-      sha256 = "f4f7315ddffe3bd50d927cb29e6a29887f31601c6c062dd349e26920fa1faaa2";
+      sha256 = "4297f9355f72fbbddb7a337f0de9877c88cfe6a74b98262791d4eea48a9e8b44";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/lij/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/lij/firefox-140.0b2.tar.xz";
       locale = "lij";
       arch = "linux-i686";
-      sha256 = "ffd066b6b01c2180e8d85ac3c91521b3c2d0a349184bd6c3a5daa220dde51942";
+      sha256 = "d1128743a077f51f9dabfc3b949a64500dbe5936bd29347e0042ce118b5621f6";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/lt/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/lt/firefox-140.0b2.tar.xz";
       locale = "lt";
       arch = "linux-i686";
-      sha256 = "6d14d17de1c256b6c2f44dc032a09b99244cf9dc81619c18cb750f9900857f94";
+      sha256 = "ca2d1ae064e99bd1cc490b8d47cac1a342419ab23a3dd39919873d102d416d7f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/lv/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/lv/firefox-140.0b2.tar.xz";
       locale = "lv";
       arch = "linux-i686";
-      sha256 = "d9f0720f4d1b663406b14db66f739ff1d0e2dc5e849f88640d0899c3de528f4c";
+      sha256 = "cab179bfcd42b5a93311a3b0e7d298ff1130e17c5c5493b8321693b9149b5b48";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/mk/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/mk/firefox-140.0b2.tar.xz";
       locale = "mk";
       arch = "linux-i686";
-      sha256 = "e770c64d793af8d63bb33434f427ecc9cdffb49345ef966ee7b27232214a11ad";
+      sha256 = "ddbf2ffebf122e83bc865808782cb3d1e0700cc29467b6ad8506ee03499580bf";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/mr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/mr/firefox-140.0b2.tar.xz";
       locale = "mr";
       arch = "linux-i686";
-      sha256 = "bf0a4fb9bec478a1fa1d48be903509b5f23c45dfa7754afb78aca3962e7fd21e";
+      sha256 = "b7635fbe1baff6f7edeb4b832aabd21d12582a7c66cd086b95b0a02aebba4f56";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ms/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ms/firefox-140.0b2.tar.xz";
       locale = "ms";
       arch = "linux-i686";
-      sha256 = "8d09acce703795b35bc04887cb26e4020af5c397fa396c2f2806548b5980b6da";
+      sha256 = "953a47f53c007d2cf02b22a787e8c476c763ebc5b15796973cc406d34301440c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/my/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/my/firefox-140.0b2.tar.xz";
       locale = "my";
       arch = "linux-i686";
-      sha256 = "f0b894a6462f5a80c23cf83a1a011c491a0fcbf61fc04c2b0aad6a0ecf9b6a42";
+      sha256 = "a6ff85aead2ee5d55bcf055a42452d44439b9a51ae25b5336a3b22a573c0b46a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/nb-NO/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/nb-NO/firefox-140.0b2.tar.xz";
       locale = "nb-NO";
       arch = "linux-i686";
-      sha256 = "2af8e1f308a6010c3b8523c1e9d12d0e1b5b9724ad1f444394ca58433a2298c0";
+      sha256 = "ae4dadeba15ae17d3307f09392ebb3f85f0212332f9a9a857ba5b6118452c2cf";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ne-NP/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ne-NP/firefox-140.0b2.tar.xz";
       locale = "ne-NP";
       arch = "linux-i686";
-      sha256 = "004f3b52f367a1bbd35aa06d7040035bfaf5da5524370810c789746ed78af888";
+      sha256 = "28e20f4d661bd7e95495155249faecf8fbb5e7e654298ed1fbdd62cc971476e0";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/nl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/nl/firefox-140.0b2.tar.xz";
       locale = "nl";
       arch = "linux-i686";
-      sha256 = "eef545c2a3937500dd825e5e0ba94735246bb2e8750a3b3c2266026f5b1859b6";
+      sha256 = "dafc7696a404c8fad558b649677988c076c5eb4685fb801840710657631c5356";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/nn-NO/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/nn-NO/firefox-140.0b2.tar.xz";
       locale = "nn-NO";
       arch = "linux-i686";
-      sha256 = "794b917cedc6dc92964665da249dd018ddf288f837ab2968794b63c2360a8cce";
+      sha256 = "992fe42be2e1521e85b9f5baed59f0e87ed71bf62c99190801bf9c2f5f5351f9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/oc/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/oc/firefox-140.0b2.tar.xz";
       locale = "oc";
       arch = "linux-i686";
-      sha256 = "3b83f2fbbf74b91e44a7f0043940d242b1b736d75394caecbb9401e328e23da6";
+      sha256 = "accf61fd69c7e00bdd48163403b6bbacb37202a2db113983fbaf8dc1a3598b0b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/pa-IN/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/pa-IN/firefox-140.0b2.tar.xz";
       locale = "pa-IN";
       arch = "linux-i686";
-      sha256 = "72e016689aa5823d0c1023afa000780e6e60bcf752eaa7f1fd68da107f22f6e3";
+      sha256 = "6fe0de8669c63d79837ea4dc062f4550b5ee709446c24cdb54572fa9a3916469";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/pl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/pl/firefox-140.0b2.tar.xz";
       locale = "pl";
       arch = "linux-i686";
-      sha256 = "263dbd2d79cbc7a2c0a0b21a3fbff69fa22383f39d7824ffdc31194f03a69327";
+      sha256 = "71d4c24b490678d5941caa81eb9206c8aef0688eb6d134766588b2ba1a4fd808";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/pt-BR/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/pt-BR/firefox-140.0b2.tar.xz";
       locale = "pt-BR";
       arch = "linux-i686";
-      sha256 = "2c9b08173760317cebebe8ab746b8a024db38bc7a7aaf4e9de034bfb50abe5be";
+      sha256 = "85a69113a9348f3aea241a7de7439dea2c3ce3768ddd8d4b2a3ca5c1769059fe";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/pt-PT/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/pt-PT/firefox-140.0b2.tar.xz";
       locale = "pt-PT";
       arch = "linux-i686";
-      sha256 = "df8fdc9ca8a2a16decff55ac6b64775ae2dc7c64d6dbdd8fc15df014a8f8a656";
+      sha256 = "4586e1e50cb48044075c4128ae7671d23daa9ea186c8d60272aed76ac5d3bc7c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/rm/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/rm/firefox-140.0b2.tar.xz";
       locale = "rm";
       arch = "linux-i686";
-      sha256 = "2b6f3c308e293955fd8243fa724dc969d054b7c0d086bc1a243e2c19bef27bed";
+      sha256 = "d06072037678bb49711952a3f5c7a082b0a39258bbbc951578110ab7f1314bf8";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ro/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ro/firefox-140.0b2.tar.xz";
       locale = "ro";
       arch = "linux-i686";
-      sha256 = "81d6fb48b838aeb5e9fbbfaffac8936f376289b162958169a50e8a48bdb4bdbe";
+      sha256 = "cdc758063dc9dff54e5d4ca6809798e239c7e096ab7c21c91738c86bd50c4499";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ru/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ru/firefox-140.0b2.tar.xz";
       locale = "ru";
       arch = "linux-i686";
-      sha256 = "6fbcd6ea92f5e2c81c926dd407ff2523e551f388b56154a3324c1f04f66c80b7";
+      sha256 = "094f692ad849c608df35112dcaab251f3710145fd28a6426f578d984de4e2bef";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/sat/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/sat/firefox-140.0b2.tar.xz";
       locale = "sat";
       arch = "linux-i686";
-      sha256 = "77b8647e8702ec7dd982ec622151de4eac6e1873fd632c57bc174d4ebcadb675";
+      sha256 = "5922623b038eb20d5e600d1dfe48af7cadf9e731de85abb5fa12f6e11b59629b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/sc/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/sc/firefox-140.0b2.tar.xz";
       locale = "sc";
       arch = "linux-i686";
-      sha256 = "cb23ce760425c17792dfb75fe52d39f4fd377b640f69ba8bb575df6fba3f80d1";
+      sha256 = "922dd68c7737deab349f55f8c978a2408e6d405b5a6add9c9ec0728dac4d8e72";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/sco/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/sco/firefox-140.0b2.tar.xz";
       locale = "sco";
       arch = "linux-i686";
-      sha256 = "f1f71c42b2626d0dcfc3552a1224db422328f4f312512b3fce292b69b24b7560";
+      sha256 = "b5aa0dc79307853f86a37404d9bc42fbedbd94d94c5d65b2600e4505ff4a8553";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/si/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/si/firefox-140.0b2.tar.xz";
       locale = "si";
       arch = "linux-i686";
-      sha256 = "7600e8c27c2e795f7cc4481badc279b461901aa516bbb0728128874791d6639b";
+      sha256 = "3b43ce4e8f2ff93ce083d4202269ca316c7f74407b30386b0cb8c290dc88b895";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/sk/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/sk/firefox-140.0b2.tar.xz";
       locale = "sk";
       arch = "linux-i686";
-      sha256 = "45d7b3b578ead0d40175954f9e65e124853e295a0c528dd6abde891622534e3e";
+      sha256 = "38d4002072a718b74a479e5c733a572565e761a68b906bd7f0e0bc6fd896366a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/skr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/skr/firefox-140.0b2.tar.xz";
       locale = "skr";
       arch = "linux-i686";
-      sha256 = "187fbb481c64cc981b20de374913b9d17c3b117a80ab1feec58c18c965ef3e4b";
+      sha256 = "39bb8166cb65e836fa2d4462c8af2bda38ce896b918304a776f1d2cce1419f98";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/sl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/sl/firefox-140.0b2.tar.xz";
       locale = "sl";
       arch = "linux-i686";
-      sha256 = "17b5faa5a116cc9ab8fa1a322bf6555450f4bcee1a2abf09709645b17bd46ecc";
+      sha256 = "6c72f3e2c35c677ef755e9dfa39ff8c9947a341b4b91d3a8906350fa9395030c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/son/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/son/firefox-140.0b2.tar.xz";
       locale = "son";
       arch = "linux-i686";
-      sha256 = "4639c5d5d267896d07214291c468546ff26478c26c435ee4d10cb2e9dc307e65";
+      sha256 = "2d0711bdbfc89da98a0baa43ce8ef0027c86aa7db78b0a1bd18672b667ab0e30";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/sq/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/sq/firefox-140.0b2.tar.xz";
       locale = "sq";
       arch = "linux-i686";
-      sha256 = "a0aa72766d7cee37f9d9a4c3a28ae8b954a2d28810bf553cbf442b30edd623d1";
+      sha256 = "1435a9477d2040a926eae4161026f7d343c15dd154af39c785fd0c69a60ccb10";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/sr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/sr/firefox-140.0b2.tar.xz";
       locale = "sr";
       arch = "linux-i686";
-      sha256 = "607d5e9a73671eb99735e619a2ee701f31ed6dc55ba016a237618de6fe159933";
+      sha256 = "ce3002b8360b73d0ad16175dc65ced8a6a5051b01947ef747bf7aa4bbd2c9ac1";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/sv-SE/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/sv-SE/firefox-140.0b2.tar.xz";
       locale = "sv-SE";
       arch = "linux-i686";
-      sha256 = "dada2e913de21d7ecf323d302fe2b9263ef6820450622b3b06e73963a6d48f9a";
+      sha256 = "56dbd4190064e6f4e34d85c25771b30decdf97c7050336badb6875137780c70b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/szl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/szl/firefox-140.0b2.tar.xz";
       locale = "szl";
       arch = "linux-i686";
-      sha256 = "12526451c0f4c8a8446b0638be2e3c24a52cbd8277928a45e9dafb2c65eb2d03";
+      sha256 = "a3f255842ba2050b100d26ee84a6afb31665f8dbe701db7557449b14672a3c12";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ta/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ta/firefox-140.0b2.tar.xz";
       locale = "ta";
       arch = "linux-i686";
-      sha256 = "d3153deeb5951fc6dbff2fac07a51e587d98559042cf1cfea70a55c4c8ad25c7";
+      sha256 = "73f008cf652c7a4453d710674d9d8c635e1feb3187f615a087b3ec87b4b16035";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/te/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/te/firefox-140.0b2.tar.xz";
       locale = "te";
       arch = "linux-i686";
-      sha256 = "21377ea235bb38c01aa1a21516722e2a91ce679ef7d1b32487c8813f1cdd2aea";
+      sha256 = "4307336f634d2bd01aacaeeab52bc995cbc127bc8fd5d9503dbec7c24a4d2f0d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/tg/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/tg/firefox-140.0b2.tar.xz";
       locale = "tg";
       arch = "linux-i686";
-      sha256 = "a428becb1a20753379791ae6538b0b1bf0ebad0d55f98d7d8c19af0a7294f7e0";
+      sha256 = "97b28078ce5f731948c1e12f0920fa4a307a03d2ed65efe12019ec29b23ab7a9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/th/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/th/firefox-140.0b2.tar.xz";
       locale = "th";
       arch = "linux-i686";
-      sha256 = "28a30d8cda25aa1e63fbbcd1bbcdda5a3ae990e1d973f10d4744499a27f13ef8";
+      sha256 = "c159df215ddea3e0372cc738d13897a89470031d4302a0d28612ace823ce1398";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/tl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/tl/firefox-140.0b2.tar.xz";
       locale = "tl";
       arch = "linux-i686";
-      sha256 = "80bd0de1021edfe3178abc43017669dbcfe1885c66b71729372bcdb27d381ab5";
+      sha256 = "bd888218d668794483dc75778fbe4afd83443a655b9eaf2c9b367cf32c95d7c7";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/tr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/tr/firefox-140.0b2.tar.xz";
       locale = "tr";
       arch = "linux-i686";
-      sha256 = "f9bc32e243c091be454fc5b4356b986cbbd87bb76135e7cb9f9dd44115af2f5d";
+      sha256 = "88b9244ee99bdd1ffd602df92cd25d02b240ff4aa3a45cd931c0bd9f5d4c9893";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/trs/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/trs/firefox-140.0b2.tar.xz";
       locale = "trs";
       arch = "linux-i686";
-      sha256 = "fc7e927f0ed152dea1940b6965c79c3f2a21d22c117d52d9f32568d5f80bd48f";
+      sha256 = "14278135b7debd30d31853d9189ec21f400c2d32cc8a390f1e01675f26aec36c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/uk/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/uk/firefox-140.0b2.tar.xz";
       locale = "uk";
       arch = "linux-i686";
-      sha256 = "f529c85cd2f12c7b2fb66b1f79268af7ba889c8a6c4cc1accc5b19b74f77301f";
+      sha256 = "93b22572fdbd3095d8e30deea395625b788fb9a778ac2229cb195ce63bfcfe46";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/ur/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/ur/firefox-140.0b2.tar.xz";
       locale = "ur";
       arch = "linux-i686";
-      sha256 = "e677de49b31054981a22dfa36d9b29339cdc2dc230077b48a381edefa1a17271";
+      sha256 = "f3917596f5f0ca2afd8faa99e916ee272e99bb969c0532775b4b250492e80065";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/uz/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/uz/firefox-140.0b2.tar.xz";
       locale = "uz";
       arch = "linux-i686";
-      sha256 = "46d1fa8b789e3c4adb313883a438a8dc051b67b3f005541a31967921b4cf280f";
+      sha256 = "cd5eba259c10496a1febcb3e45af097fef27a1988b46d3da92f41acd2f0ae523";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/vi/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/vi/firefox-140.0b2.tar.xz";
       locale = "vi";
       arch = "linux-i686";
-      sha256 = "65e242430ce65fa104fbb0bdaff6cc53a5c0dc60b2094362f2dcebc9aecabb3a";
+      sha256 = "f40f814223621311d4e61330aba019463bce28b238176ee241b5182dcd23fd5d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/xh/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/xh/firefox-140.0b2.tar.xz";
       locale = "xh";
       arch = "linux-i686";
-      sha256 = "979438f443e8c0ab980af19e9bead77f3039c955c46a2c450db7265bbcf6259e";
+      sha256 = "194e2abca87a28bc6fac3fd8a2e81c2948d82bb02e9a21d77ebbb852d4d3323d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/zh-CN/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/zh-CN/firefox-140.0b2.tar.xz";
       locale = "zh-CN";
       arch = "linux-i686";
-      sha256 = "c79ad34593f9ef472d0231fe57082a1d4ec62bb4c7cc870c4e510cee5ba3ff44";
+      sha256 = "19d5bd43ee524ec3a7b4bf7d743c382ab21ad8738f821359fa5b076e38dc71a7";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-i686/zh-TW/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-i686/zh-TW/firefox-140.0b2.tar.xz";
       locale = "zh-TW";
       arch = "linux-i686";
-      sha256 = "0e169aa02e3102b396e0d721b15138fe39277e4d84935fe6c8931ef69117b4fe";
+      sha256 = "aae9ed93330ba2097ea3b3281ea5c91dcd21f4577acdc87b368a5b2a30f8e46c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ach/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ach/firefox-140.0b2.tar.xz";
       locale = "ach";
       arch = "linux-aarch64";
-      sha256 = "bd3e5c69934115d423aa111c257520f9cc5219a29588843ee1c5b61b1a3e3da5";
+      sha256 = "8e333cc92651318838354682396e621d91346f82515106a44645db9d58a3af4d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/af/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/af/firefox-140.0b2.tar.xz";
       locale = "af";
       arch = "linux-aarch64";
-      sha256 = "f3b63934c1632d71f49d9a401dc8bf6073936dcd656fb0462a3d34e352075352";
+      sha256 = "b73650f86928fb676d4a1b4ad13abd48a99b3a87c69099f4e67891f2f16b8916";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/an/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/an/firefox-140.0b2.tar.xz";
       locale = "an";
       arch = "linux-aarch64";
-      sha256 = "313da7d73bf645cea5125e3909c310f3aa81b1713297fb7b66493b79f16d34cf";
+      sha256 = "0087d94bccd33bf7cd38e5272b4722fc6ce0654c86329e5fa400212ba2deae5d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ar/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ar/firefox-140.0b2.tar.xz";
       locale = "ar";
       arch = "linux-aarch64";
-      sha256 = "9bd0294aec83fb9bdb4164eb8eeeeda22fc3b2d26e8cb8b1a5e036251be3bcdd";
+      sha256 = "ea37bd6670ac8c1074db798729b2b6372ddc081546f05f5ab492e45edf491280";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ast/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ast/firefox-140.0b2.tar.xz";
       locale = "ast";
       arch = "linux-aarch64";
-      sha256 = "2a3229c50482cd3b86ba9892985680b6cffe4259503d3efcee1ecd6fad4a6005";
+      sha256 = "048e5268852cbb2882daa7e768b661b0168feadd538068724b771564addafd32";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/az/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/az/firefox-140.0b2.tar.xz";
       locale = "az";
       arch = "linux-aarch64";
-      sha256 = "b64a348dab5618276f0102c23d7e74b4e1bc2af38b36e678b3db53fac08e3125";
+      sha256 = "69be7ed2489c62f4d4aabe0b6e0e356ae0708fd963243a43843f098624883218";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/be/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/be/firefox-140.0b2.tar.xz";
       locale = "be";
       arch = "linux-aarch64";
-      sha256 = "6e19e16df133ea7b7b796a92c470ddec4ad9db281361210dc249851dd9c05e3b";
+      sha256 = "831ac7b7469b7a94a63f8687f8c8d1a6626d0555f084602b341b7875100ec6e8";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/bg/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/bg/firefox-140.0b2.tar.xz";
       locale = "bg";
       arch = "linux-aarch64";
-      sha256 = "c691fcf4ff5aa896b51e12c01b5faddf1ab8d3e990fcb5a37c89450511647335";
+      sha256 = "071125d022f167f209c6b5fa6099a1eb4819ac095e44e28c72835af09dfc857d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/bn/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/bn/firefox-140.0b2.tar.xz";
       locale = "bn";
       arch = "linux-aarch64";
-      sha256 = "b88a34520fbc6cfa328e879478857b10a738dd5ed6c99d6db16d380e1b80b71a";
+      sha256 = "05bdb1c8f3bb8d673b2956471a60b616565d9acdc3ab673004c5fe30d4dd8b03";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/br/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/br/firefox-140.0b2.tar.xz";
       locale = "br";
       arch = "linux-aarch64";
-      sha256 = "d2a051c03154c151367d01d887dd22d9c029c948c7ff406e5ba975a981e3270d";
+      sha256 = "cce32f7d6985778559a2559f9dd2d27acee239823176676732869f99fd114ac8";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/bs/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/bs/firefox-140.0b2.tar.xz";
       locale = "bs";
       arch = "linux-aarch64";
-      sha256 = "b7ba2f914aacea218596d2118c001961c1151b9df842b5afb498d7729f4c7efc";
+      sha256 = "22b677d215dfc64350e9cc08cf77facdf56f2248d0be32136310014fcb8bc4c5";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ca-valencia/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ca-valencia/firefox-140.0b2.tar.xz";
       locale = "ca-valencia";
       arch = "linux-aarch64";
-      sha256 = "3d9cb24a0d049de007c4125efa869119aef50263f70bad64fb8ce328cce6abb0";
+      sha256 = "070138cb5c1576458df1acf2d7c735aeee45fd831cf6a5c058f705a555f08074";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ca/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ca/firefox-140.0b2.tar.xz";
       locale = "ca";
       arch = "linux-aarch64";
-      sha256 = "40288f778e9706bb3c2bccd641b7f79a9b96f5129bfb282a88fe891f95d20e9d";
+      sha256 = "3397ef999dabaef0f21e9c94597e5c1da632a525aac547635fc39ecdc4f7f8de";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/cak/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/cak/firefox-140.0b2.tar.xz";
       locale = "cak";
       arch = "linux-aarch64";
-      sha256 = "79a734a1a83b350d123b7c76dd991e9139d14c84b795486587bac3e001e43fdf";
+      sha256 = "f4bdcf93142b268ad5ece77deff6684197acc671c39ec3408269a5636761e9c9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/cs/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/cs/firefox-140.0b2.tar.xz";
       locale = "cs";
       arch = "linux-aarch64";
-      sha256 = "3fbf932baa5ecb2c4ba06c6f8f29251d8c33c173df96ceef38250decdef6d73a";
+      sha256 = "f93563b2f365be59e77b205cd582fbab900aef88aa954c1bece23a6ee8d01a2a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/cy/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/cy/firefox-140.0b2.tar.xz";
       locale = "cy";
       arch = "linux-aarch64";
-      sha256 = "4bf4c523a593907dba5ef4ed211d721ce89ca13af52852b61a8a812f7da6473f";
+      sha256 = "6ffa2b32e82102eec535998ee3593f9c6bae6290546425ad3d19f6038be42d7c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/da/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/da/firefox-140.0b2.tar.xz";
       locale = "da";
       arch = "linux-aarch64";
-      sha256 = "f459937cbe98b49931130dc0ff35741600d919afc84226a0907f6b373496090d";
+      sha256 = "4cb2c407cf89df1a1add90caa9aaae5947ae389a322666ac5fc3f4534ab9f3be";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/de/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/de/firefox-140.0b2.tar.xz";
       locale = "de";
       arch = "linux-aarch64";
-      sha256 = "c1cbb2e1a978612c0fa60ba060fcd00f45ab0610a49f42f3ea59a0032c1fdc5c";
+      sha256 = "25e3d5ff4e13d7b716d664f92bb60bedc0b695700c743cc27badba490df4cc2b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/dsb/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/dsb/firefox-140.0b2.tar.xz";
       locale = "dsb";
       arch = "linux-aarch64";
-      sha256 = "94288aba032c65e197001b10641ae42ea05a9a6c87f8ca6d98b48f5924ccb314";
+      sha256 = "a85a8c6d39afb495e1b34a896b3cc1aa930334fa8e720a06ba86620ebcb64641";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/el/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/el/firefox-140.0b2.tar.xz";
       locale = "el";
       arch = "linux-aarch64";
-      sha256 = "143f849d261a87f066952914b466e6737a337cbd412117add91e7731b088c89e";
+      sha256 = "9a2abda0113c66b95d1bade25336432618e0123c3e344b97ed27f59a03257b13";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/en-CA/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/en-CA/firefox-140.0b2.tar.xz";
       locale = "en-CA";
       arch = "linux-aarch64";
-      sha256 = "a08ab6a5968ebf60d9c4c082475e1c7cfd840d90e8dc1265d999eab45d0bb26f";
+      sha256 = "05b6af15963426fbd845b2b43dc45499d366d476ad59cc80a1558009bd1d63a3";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/en-GB/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/en-GB/firefox-140.0b2.tar.xz";
       locale = "en-GB";
       arch = "linux-aarch64";
-      sha256 = "a14d387031ea588bddc104982f11480983a45f2d4e08c814ae91a6f9e8bdc4be";
+      sha256 = "b1babf23c66ddf5ac23188b272cbc61d0c9821c8d2ce4924b15d7231aaca96cc";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/en-US/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/en-US/firefox-140.0b2.tar.xz";
       locale = "en-US";
       arch = "linux-aarch64";
-      sha256 = "a8b95ece65cf5ebc5d5ae2144943c66135a2a32d64d7ca1c2424a621b8ffc152";
+      sha256 = "b6b38968b00781bbc144065f0294947bdcd1f23bfa641f57efb6e88f5905cb40";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/eo/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/eo/firefox-140.0b2.tar.xz";
       locale = "eo";
       arch = "linux-aarch64";
-      sha256 = "0bf932cdb5b2b672bad8875e4bd59da43fda2fc8293b14f5b6fa5cf58c11dee1";
+      sha256 = "195e8ad6973822bd5f1919a82bdf2206cf9d12baa7ed38e467eb360dc5dd2c42";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/es-AR/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/es-AR/firefox-140.0b2.tar.xz";
       locale = "es-AR";
       arch = "linux-aarch64";
-      sha256 = "991cd0e2894a4293fe8d8bb78dadc51b7c0527a1d64b1bbad6328e553b65ec7d";
+      sha256 = "b4c3d0c5fe505ac5e7c9a38584683ce3c8236ecd497f055c7ffcd7b08604fc3b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/es-CL/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/es-CL/firefox-140.0b2.tar.xz";
       locale = "es-CL";
       arch = "linux-aarch64";
-      sha256 = "15f27bd91d2d9f1833a3dff0ebf957bff6ab740bd5de214482e348240968259c";
+      sha256 = "42fdd9a3dc09de733adb19bc07eb40448390a4ae9a32039f695564915fca8537";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/es-ES/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/es-ES/firefox-140.0b2.tar.xz";
       locale = "es-ES";
       arch = "linux-aarch64";
-      sha256 = "0abd7d09a96262f226564b01633ddf9912ab190e448b57422c965d7ab544bdaa";
+      sha256 = "8946e80d10fbf064eb6fe4565afbf4b7c320d3e224871c33fd45a4c22c53554d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/es-MX/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/es-MX/firefox-140.0b2.tar.xz";
       locale = "es-MX";
       arch = "linux-aarch64";
-      sha256 = "651f09eb5e0818805219e57f9e9567fde5ea538e62b0970270547349cdd6bf09";
+      sha256 = "2e04c6985567aaec38c91f7d45da067153b12d6d800ff6653356af6a39bde95e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/et/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/et/firefox-140.0b2.tar.xz";
       locale = "et";
       arch = "linux-aarch64";
-      sha256 = "3f970da97eba78efcb840aaa9e7812fc07340ead7b8939648fb8839c743298cd";
+      sha256 = "a331657da8a21a447d94ccf778b766abf845f73f2350fd75b4066a1a97cb7255";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/eu/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/eu/firefox-140.0b2.tar.xz";
       locale = "eu";
       arch = "linux-aarch64";
-      sha256 = "eb5464b8618eeda6aa507d09e403528ac991f883e4ea6070c01ecf7ccb34a2f9";
+      sha256 = "1b10be47d311454b148558de6e6a98947286d66b32627fe9da586f6e764b3846";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/fa/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/fa/firefox-140.0b2.tar.xz";
       locale = "fa";
       arch = "linux-aarch64";
-      sha256 = "6f78eb8b602d2b349d564d08e1797f7dd381a818b4f5fc4916e5e2d80a6890d1";
+      sha256 = "61ec0edc1639d7c69f258b4860135955addb730c382cd693faccd07acc9ee59e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ff/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ff/firefox-140.0b2.tar.xz";
       locale = "ff";
       arch = "linux-aarch64";
-      sha256 = "dd74dfd1b55dc2005764ee2237f4bd0cd841a90dcca88f97f4d7ea1cda57be28";
+      sha256 = "97a5d77fd30cf21502b8b9c8005112180396f26d24dce88f6086671b3711d710";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/fi/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/fi/firefox-140.0b2.tar.xz";
       locale = "fi";
       arch = "linux-aarch64";
-      sha256 = "108304dedc88ed30195dc443a62df7f1d579a8540fef911e7ebecc544aeebd2c";
+      sha256 = "180a4a853a9f03cb5c4b6467b8476edeee17ea5cf324ea4415648dcf3d85b228";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/fr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/fr/firefox-140.0b2.tar.xz";
       locale = "fr";
       arch = "linux-aarch64";
-      sha256 = "c02dfe50d5b405f8fb90868ad317f1020c85d6bd15c6167d4bb8af152af29f29";
+      sha256 = "6490b20b7cdb731df9d8e0df8ca46bc834b362c577c235d5397665a617b271ac";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/fur/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/fur/firefox-140.0b2.tar.xz";
       locale = "fur";
       arch = "linux-aarch64";
-      sha256 = "c110494b901de0d5cf4623bab3fb7aa523c2c8afe14ce1339207a07715c24e0c";
+      sha256 = "6d7c83bb94c905b02365b0502cb5d1ed7924eff2ffac575994598d7382aa4635";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/fy-NL/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/fy-NL/firefox-140.0b2.tar.xz";
       locale = "fy-NL";
       arch = "linux-aarch64";
-      sha256 = "09fefbf594c1c840dc18611d303c8aeae70eb7126e17b5d0e41e96868601acbb";
+      sha256 = "9b11642f4ebd8e27f12d3c244ee467a668976a17edfb12b71e94238eb2a98d6e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ga-IE/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ga-IE/firefox-140.0b2.tar.xz";
       locale = "ga-IE";
       arch = "linux-aarch64";
-      sha256 = "51e4f9ad18f29f46875ce2e146a4300afb0f3b860f0bc9bbab2cd6be9c20a564";
+      sha256 = "2fea6d116c6be60aa0a0a46278fe29e29f0ea2d6b48396211d500fdfe5669d29";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/gd/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/gd/firefox-140.0b2.tar.xz";
       locale = "gd";
       arch = "linux-aarch64";
-      sha256 = "cab4cdd9d7b1af933f53863be982d427f59435522f24bdef27a302b9221dac7f";
+      sha256 = "22832b70b7504b7bea490b45a70ed88488951d4b9f4e50cec6869cedf5fdf916";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/gl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/gl/firefox-140.0b2.tar.xz";
       locale = "gl";
       arch = "linux-aarch64";
-      sha256 = "48b3771b813b62c8ade64e55ca5ea2e39671f2556e6057c49374b089adfbd2c7";
+      sha256 = "0fefa4add517fbd4a49ef4305c0a37dab58d5cd1cc579ac9dc4db005fd434e9d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/gn/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/gn/firefox-140.0b2.tar.xz";
       locale = "gn";
       arch = "linux-aarch64";
-      sha256 = "63e40c6ee16180e62fa6ef06f0bf1bf04fc9b368940013f2442e034229bbe586";
+      sha256 = "0dd0a13c53de0ff825cb563381ad0fd2956cc1b485f270cd9fd07fb791d7da79";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/gu-IN/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/gu-IN/firefox-140.0b2.tar.xz";
       locale = "gu-IN";
       arch = "linux-aarch64";
-      sha256 = "3c3c3847fc36800336e000c7a5ca479edf4832f80b44ca7b4f79151a67119a16";
+      sha256 = "0afc4e0cf35f8668cd41026532b05070f5bfb116213d7f195a9e2458a2538c33";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/he/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/he/firefox-140.0b2.tar.xz";
       locale = "he";
       arch = "linux-aarch64";
-      sha256 = "b77b031493a228f911f29ad93d55d9895005c31ba90a99a5b1b4e2d7d7034cbc";
+      sha256 = "f53438739efa25fb3bf2e76ea57105005c048ee8f87e3fdbaddb6987bd8b41f1";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/hi-IN/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/hi-IN/firefox-140.0b2.tar.xz";
       locale = "hi-IN";
       arch = "linux-aarch64";
-      sha256 = "a0ada0fe2c28f6e0bf6abdfcdf60ceb5cdab896ff1c86a58d33c9bfb4faedeec";
+      sha256 = "e82d7805936223b363613138e1641e7ef042ca6229896b1f261cf9db85095921";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/hr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/hr/firefox-140.0b2.tar.xz";
       locale = "hr";
       arch = "linux-aarch64";
-      sha256 = "56fdf616a68d2701b4c505da83e70c14a6c08541ec826c7a187c23a30323c8a2";
+      sha256 = "5ccbd439a15849ab7cf33899e52190d7823042c05ad119e54d968284fd95cbc9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/hsb/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/hsb/firefox-140.0b2.tar.xz";
       locale = "hsb";
       arch = "linux-aarch64";
-      sha256 = "dc133236dcd7500e46b2bb806212a41b11e906cf66a744dad2ab6aef663ab482";
+      sha256 = "6671d4973471337ff156fb0aa8d8a89026ea001a82a3c39151236e450ba83d11";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/hu/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/hu/firefox-140.0b2.tar.xz";
       locale = "hu";
       arch = "linux-aarch64";
-      sha256 = "d2c85ea926529b2caea6f3d5a07a954eac9fcb1feb1cd1780a7115fb38f7d03b";
+      sha256 = "f2b96cd0724c64b2bb946d03fbe4f689e06aeacfe25546521a85fc823df19190";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/hy-AM/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/hy-AM/firefox-140.0b2.tar.xz";
       locale = "hy-AM";
       arch = "linux-aarch64";
-      sha256 = "b7e324693725687422ec9ffad3bec53e559fc755d9eb169783a0737edd9b173e";
+      sha256 = "9b57ab8d9dc9cf31b1e8c5983085ca6380b4edabc78c823cc5957862011c14d7";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ia/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ia/firefox-140.0b2.tar.xz";
       locale = "ia";
       arch = "linux-aarch64";
-      sha256 = "1016c382f3add7c82860d4a7f980770ca8d2332e182b1b14a958012378f272f0";
+      sha256 = "188793a0c4619be9fafb870583c716f2f71026505312050b38c90ba69a7ecba3";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/id/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/id/firefox-140.0b2.tar.xz";
       locale = "id";
       arch = "linux-aarch64";
-      sha256 = "331b1885e004f602ebc004460ad4780725dbb3829ed04714b21df919e4972661";
+      sha256 = "69601bbff0fe4b1719d9f76326ff363aed11404d0cc3b1babd6de85f174beae9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/is/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/is/firefox-140.0b2.tar.xz";
       locale = "is";
       arch = "linux-aarch64";
-      sha256 = "4ec80ba6afb69479b2cbc942551cc129aa0d8887ee32a2803b07ae14de800744";
+      sha256 = "a446c41c5055ab8b81d28394aa0c3a204012a7409028a610269d6b8c31cab303";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/it/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/it/firefox-140.0b2.tar.xz";
       locale = "it";
       arch = "linux-aarch64";
-      sha256 = "9d04dfe6d24db792b2091f6726f8ba5edf0ab2d9373f2e0957c951f1a055dce4";
+      sha256 = "68ec8352f64a031b2e12f43104822a2fbcd80b4061d8cd8ce87498112fd7e5a9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ja/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ja/firefox-140.0b2.tar.xz";
       locale = "ja";
       arch = "linux-aarch64";
-      sha256 = "7d2b0709f649b8a6b2edb124a2a501f2309b2570b1807efb038c5400cb0216b2";
+      sha256 = "a21480a969ac74e85749a6e2904af86dcbee8a85b799b45e09b23c9e7553b783";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ka/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ka/firefox-140.0b2.tar.xz";
       locale = "ka";
       arch = "linux-aarch64";
-      sha256 = "06eef2411c405e2a17267bddd6d958c7fb55497478b6213fe259e40fb273dcff";
+      sha256 = "279672ac2c1b8d7f0e0d942f027a7fdfa7245c9676a406889f420e6b55131ae7";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/kab/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/kab/firefox-140.0b2.tar.xz";
       locale = "kab";
       arch = "linux-aarch64";
-      sha256 = "eaafc34c8c596602091810cbc2af966e003d870c66a647c0cdd2a2a343f4a068";
+      sha256 = "502c7aefb553e3dd95dd66ee5c20f3314996e0a9551c6da66b3210a2af3268b2";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/kk/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/kk/firefox-140.0b2.tar.xz";
       locale = "kk";
       arch = "linux-aarch64";
-      sha256 = "dfef47c7d3255b1a711b611afd9adbb53be80eebefdac763da04af2157faece1";
+      sha256 = "71b29a6a4b5d8520c74b4321da341fd7d249396d898535f5ddcabdcb63c3fd05";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/km/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/km/firefox-140.0b2.tar.xz";
       locale = "km";
       arch = "linux-aarch64";
-      sha256 = "9074c6ee90c6582c1202582d35d81f97b43789ebc3f9019261130dabcb01fd46";
+      sha256 = "dd9e94f1c57b55e16cbeaffa85ad406a9a845b7f67c2675b7f0cce97837b389c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/kn/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/kn/firefox-140.0b2.tar.xz";
       locale = "kn";
       arch = "linux-aarch64";
-      sha256 = "f8badc895b36bdcb7666510faf5f775470ab90733ac31201f147f3b45dc4ad9e";
+      sha256 = "9ef46633c7abf9862442181598534019b5da16d64cb0150bfa82a06c85a3410f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ko/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ko/firefox-140.0b2.tar.xz";
       locale = "ko";
       arch = "linux-aarch64";
-      sha256 = "9d8739e1e382c5b96240a6564219c7b0ce161524386539141f4dcc020cbb5fee";
+      sha256 = "bcfa77af5b291c24b0c60e730c39dd0217a6ff54818e2728ccbf84e04d20d2f9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/lij/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/lij/firefox-140.0b2.tar.xz";
       locale = "lij";
       arch = "linux-aarch64";
-      sha256 = "c36fd45434f81e1c20c8793bd52cb85637999206b06ea9b094b2d1b0442f95cb";
+      sha256 = "2ab2cd1914eb0cf2429d9f02e95f5752a5284e12f85e29c54fbfde1ba95bff55";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/lt/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/lt/firefox-140.0b2.tar.xz";
       locale = "lt";
       arch = "linux-aarch64";
-      sha256 = "24d94d2ef16561bb3750d607fda39f4b39060efb83fd4d435cbef7383bf8f76d";
+      sha256 = "21854475ae62c250dd11e3265b109ccc755cfe4b7827c6911dd4246f26987318";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/lv/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/lv/firefox-140.0b2.tar.xz";
       locale = "lv";
       arch = "linux-aarch64";
-      sha256 = "6eb7553cd275cbf11b387088e52d9f508486d3f737b2482d1f53af1a2c1e0dbb";
+      sha256 = "1fb6f3e717bd7f285f1d084fea8be957eb7959c29035c4c1de3b116a21f9af67";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/mk/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/mk/firefox-140.0b2.tar.xz";
       locale = "mk";
       arch = "linux-aarch64";
-      sha256 = "8a1b20b6be53d68dd1effedc3522fec9b2d8c64a4d8e30c7a7113bf0fdb2317c";
+      sha256 = "9f52a7a077d6578820ae9011936ba436eb121814aeeae80e3c5aae097fc3af28";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/mr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/mr/firefox-140.0b2.tar.xz";
       locale = "mr";
       arch = "linux-aarch64";
-      sha256 = "4dc0347a86f3e4f784ae32e2324f3d134ce5b4fdec4eec34572f51c13763889b";
+      sha256 = "3f2b240659b7354b2d3cbdd8175f33a2a5884c90133fa394cd15b4f6e86ba4a1";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ms/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ms/firefox-140.0b2.tar.xz";
       locale = "ms";
       arch = "linux-aarch64";
-      sha256 = "7b3fbd663639fe8575eaadf01d3a9299f0c132a4b2fbbf25ddc2d18378102cf4";
+      sha256 = "73a18b565e742dbf56c406f2f1cf729a0dd0cbbb3c8660c8c01b2081cc924fba";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/my/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/my/firefox-140.0b2.tar.xz";
       locale = "my";
       arch = "linux-aarch64";
-      sha256 = "8a039ed198a5b338fd32dd632f05c4de8a9dd61cb09247d5f37a1ffbc640e0fa";
+      sha256 = "e5e43ede829a329c553e786659e980d5e6e94f5228c42c2a44eb34b399210bb3";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/nb-NO/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/nb-NO/firefox-140.0b2.tar.xz";
       locale = "nb-NO";
       arch = "linux-aarch64";
-      sha256 = "70404a9fe3361dff890f344eebb61001bdcb6a3d4356cc06386783d70a163857";
+      sha256 = "bd5feca0d1a34e6ba4cc4839ba50d89bf0beda61ba975a2ef76f1a053d725605";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ne-NP/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ne-NP/firefox-140.0b2.tar.xz";
       locale = "ne-NP";
       arch = "linux-aarch64";
-      sha256 = "e148000a58bd8b834985ad9dee1eb6724ed2550fc70279ab915c06fea148afe1";
+      sha256 = "864e1ede94813108b75fbd870884f93f77628e6cce0449b76018b9118a2c4b0b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/nl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/nl/firefox-140.0b2.tar.xz";
       locale = "nl";
       arch = "linux-aarch64";
-      sha256 = "b15ebbf39c475a53fc5b01d1c5c6559f74c42e35c1d7b7bbd4cda37366359fee";
+      sha256 = "4bba7f1feaa30adc2bfcc769469eb03361b6193260424d3af0092047c6e777a3";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/nn-NO/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/nn-NO/firefox-140.0b2.tar.xz";
       locale = "nn-NO";
       arch = "linux-aarch64";
-      sha256 = "90221ff410eca0d1aed97186e45106b7ab826029965e2b4fb54d93c74f743ee0";
+      sha256 = "968d80dbeb5418f968d584ce0c51bfd322b1189c2122a1205f64c0ade22b66f9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/oc/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/oc/firefox-140.0b2.tar.xz";
       locale = "oc";
       arch = "linux-aarch64";
-      sha256 = "7cbad01d0adb697bcae6c072bb69cb151e83920f39b67df2a340f7c1dc4faaf2";
+      sha256 = "66f45ad09dd4a90a3b0c6d66a73b8833a1f1f62f58719a98905ae57c60805b9c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/pa-IN/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/pa-IN/firefox-140.0b2.tar.xz";
       locale = "pa-IN";
       arch = "linux-aarch64";
-      sha256 = "1601a8192da0564af21b4cb7e63d87b6015d5533c08e96187a0d895e32bb03fd";
+      sha256 = "05f4b146691ca748e27b524c7e1889bee07290d417b8bab59c0582d48019f61e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/pl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/pl/firefox-140.0b2.tar.xz";
       locale = "pl";
       arch = "linux-aarch64";
-      sha256 = "f62fa06e9e651e7db14cfdbd0af5acac3d6f282a2842e41bed7b6ea323342ff7";
+      sha256 = "da9d5833e75feba4034b9b708ff0d17dd93364f0d2f0b5bcb2fcfa5b70717fba";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/pt-BR/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/pt-BR/firefox-140.0b2.tar.xz";
       locale = "pt-BR";
       arch = "linux-aarch64";
-      sha256 = "493c505bc795451989d58049e0a16397eb32c6d26f3ff5c285b845b35cf63a53";
+      sha256 = "680f083f8dcae74b053214b8a20ff2e253829b3b811212356847f99a108438d1";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/pt-PT/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/pt-PT/firefox-140.0b2.tar.xz";
       locale = "pt-PT";
       arch = "linux-aarch64";
-      sha256 = "ce1caab07d4ca3f93e5be33580e09c1109f3a19176144d7cfa06e97ab04fe7fd";
+      sha256 = "0a5eb3f4a0c9f0c47fd157a26bc8ea6b70007f912f5e50d38d6ea1487c23f7c1";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/rm/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/rm/firefox-140.0b2.tar.xz";
       locale = "rm";
       arch = "linux-aarch64";
-      sha256 = "d580649d6aa0f7fc519dbbc7c72943b36a437806020f6a56fb7659befb9dea7a";
+      sha256 = "33f73c88fd97ac68c415c9bb55db59c68cc7f482d381ca1a96b235ba2854b9d3";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ro/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ro/firefox-140.0b2.tar.xz";
       locale = "ro";
       arch = "linux-aarch64";
-      sha256 = "a78d357d761f72d5795608199701c429f2016ad618e2899c10d13b9f7ee8e3ef";
+      sha256 = "77c641e73af901a2986661790890dbd831e586b579ae398433ce98117e310b8d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ru/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ru/firefox-140.0b2.tar.xz";
       locale = "ru";
       arch = "linux-aarch64";
-      sha256 = "8892c5688612eda284319c1df7c366d529be0d0c96a55d89958d7185a78ab30e";
+      sha256 = "cc6994ffc7d98817352c390db1d06cd215acb5459121d657862c15a95f27ce4f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/sat/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/sat/firefox-140.0b2.tar.xz";
       locale = "sat";
       arch = "linux-aarch64";
-      sha256 = "c6d9eec9c8ebe83c966c904611d6d865328b5a7f401b42b06d72dae32174fec3";
+      sha256 = "f2ca87b4c371399e211874e60e25abbcc320eae84993c066ae9c491d6eece514";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/sc/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/sc/firefox-140.0b2.tar.xz";
       locale = "sc";
       arch = "linux-aarch64";
-      sha256 = "d504d52b43598ec3fdcf02949868fa65d6e6a72f78f131c53fce804817de4ee2";
+      sha256 = "3703ff4a67d1c503fe90726aa63dfa4cb266350aa4c0b5f29723a57ce677fda1";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/sco/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/sco/firefox-140.0b2.tar.xz";
       locale = "sco";
       arch = "linux-aarch64";
-      sha256 = "89962ba5d9de002d3f03b4527eb9ef84235d59c19abb46165dfa9c52a085ad2a";
+      sha256 = "963234677f4cd4c3beb7299541700f865132646b39df9e12e89d0f99d2d9e8df";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/si/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/si/firefox-140.0b2.tar.xz";
       locale = "si";
       arch = "linux-aarch64";
-      sha256 = "247261439dc9594b9ad95fa066431ce1629537b8cfc01df7716c491044a7c72a";
+      sha256 = "3632f156201c1c86b9497e09b45707f3126cb02b0cd93a936f9fbcea47af57e2";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/sk/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/sk/firefox-140.0b2.tar.xz";
       locale = "sk";
       arch = "linux-aarch64";
-      sha256 = "29cb232a5339abc4890b306a12b0f55cd2700cfe2521fa745491903ee87a26ad";
+      sha256 = "e5b6158136204fc90b960d1650e5c7f0f8b74ecaa46529f3f48c9a9bf7a9cbe6";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/skr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/skr/firefox-140.0b2.tar.xz";
       locale = "skr";
       arch = "linux-aarch64";
-      sha256 = "f606442e9a6f87616a77d2fd392412a8dd61e596ddc8c067e38846331cbfca0f";
+      sha256 = "ee71bf891c728250978a0d19290ddad63e893a68362f73e47249c8600e496c58";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/sl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/sl/firefox-140.0b2.tar.xz";
       locale = "sl";
       arch = "linux-aarch64";
-      sha256 = "43cc2db32879fce3424c1a3ff2f862cca4835b0a4c5df5c3e28def64812ce73c";
+      sha256 = "1b38a650fd3e2c41e4e20e19468483b4001719741bc2de99ab555784baea34f2";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/son/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/son/firefox-140.0b2.tar.xz";
       locale = "son";
       arch = "linux-aarch64";
-      sha256 = "cfec396b94bcc091927c0884ccddd3969f69acba8c09467609319c54c0bef55e";
+      sha256 = "5b0ee6db02cb38b7f340f074d4e454c29babf2bab55282aa29bc51174cebe9fe";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/sq/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/sq/firefox-140.0b2.tar.xz";
       locale = "sq";
       arch = "linux-aarch64";
-      sha256 = "ec827f911bb4553cd7caefbdf2aa3aa6b4521059beab32b23e65e80f9858181c";
+      sha256 = "14fcb51691a9a4addb2b4d01c0bfff630359c7e1c94181a1b1f41a0bc64f9a9e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/sr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/sr/firefox-140.0b2.tar.xz";
       locale = "sr";
       arch = "linux-aarch64";
-      sha256 = "284b34324291ba29a1d1d7b36cff68fff0f00213a7e12fa7f48536fc5a80990a";
+      sha256 = "9297b97dd92c4a9b848a0b59f6490014c323d54c63965512719cb766b5ec98b3";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/sv-SE/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/sv-SE/firefox-140.0b2.tar.xz";
       locale = "sv-SE";
       arch = "linux-aarch64";
-      sha256 = "07e48d548cfbc4c4ab3fb3b4ec630385a125d3c5cbe30526be95d0476b4d8f87";
+      sha256 = "36c4d22521d6515ef705d59b42cbc86ea385b6713049bac544db89cbe79929f1";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/szl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/szl/firefox-140.0b2.tar.xz";
       locale = "szl";
       arch = "linux-aarch64";
-      sha256 = "84cfbf70da99b4f544193d6d167a2280142f8ae37d8de1e9b4093f7ca6671fea";
+      sha256 = "47cef94cb8d05f1e67fa3c805761bc556181769778d86f91014b01e722da0a95";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ta/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ta/firefox-140.0b2.tar.xz";
       locale = "ta";
       arch = "linux-aarch64";
-      sha256 = "dca3f4fd1b468cae66bdb6ef3817860760a2527b94928359c302e789ca2c04c3";
+      sha256 = "eb1ba963923ff35be8d85e2e432db2eea1815e23245006c153616fa643a923af";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/te/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/te/firefox-140.0b2.tar.xz";
       locale = "te";
       arch = "linux-aarch64";
-      sha256 = "bfa4f775d02a2b2cf0dfcfbf4ed3d2342f7db943256c2e73bddd7f9a8077484c";
+      sha256 = "f20e07229cd5cb062b1ce2c07bce7eace439dee11c1de11b956a2ed3dbbde26b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/tg/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/tg/firefox-140.0b2.tar.xz";
       locale = "tg";
       arch = "linux-aarch64";
-      sha256 = "1515a00b6d53e074bfb60b1bc7e37ac60fd977131a6ac6e772433b1daaaa4efa";
+      sha256 = "b25eac2f5a213045980536b4d5ca04f802f083c0467c56dd02680370ea3c7329";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/th/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/th/firefox-140.0b2.tar.xz";
       locale = "th";
       arch = "linux-aarch64";
-      sha256 = "507d9c041c8874095a52f57e5a46adf8db6d4116d5ccdca0b100d831c41c0422";
+      sha256 = "d2242d267cfa67a147becb147b6ce9540d24049d601a4f00776c0eceac02849b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/tl/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/tl/firefox-140.0b2.tar.xz";
       locale = "tl";
       arch = "linux-aarch64";
-      sha256 = "cba3d10cee0a09ed530f6e8ec71e1da36fc29c972136bcf6beacd7ccf91bd162";
+      sha256 = "74891370d6b308e15b200355152ba34a31a23fcccee53ad2472a4be17a38667f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/tr/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/tr/firefox-140.0b2.tar.xz";
       locale = "tr";
       arch = "linux-aarch64";
-      sha256 = "f5e68e280db29872b7570484dbc841756693b3d00eda2cc0840a77e5600628af";
+      sha256 = "6ffa80dc70a4b37da1a0dd45ee26512b60352f5f0a7d7753ae0f786dc3ecc120";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/trs/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/trs/firefox-140.0b2.tar.xz";
       locale = "trs";
       arch = "linux-aarch64";
-      sha256 = "028e3728920e5978501773da88c2eb1d5d86927d83e5f51e910692fd4482d9f4";
+      sha256 = "c34973c0d13355f79461880372fed959c4a5872a72b22f570c8480cee4e403ed";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/uk/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/uk/firefox-140.0b2.tar.xz";
       locale = "uk";
       arch = "linux-aarch64";
-      sha256 = "9e63e86af01787ceec6b4776b78cd98db74230287f1c065eeda6b5e5f6133b42";
+      sha256 = "f0c0b73f4dddc526b058954b4ad3c6757388646dcad0c1fd694947f7f06bb479";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/ur/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/ur/firefox-140.0b2.tar.xz";
       locale = "ur";
       arch = "linux-aarch64";
-      sha256 = "964b123de671b9f763861d626a444c86d48516cdefe9ab71f866dc564428d119";
+      sha256 = "7cfa2930a547d9b0b15e6ebc571ec8447c42b6a845fd228ccc023df7ddbce914";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/uz/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/uz/firefox-140.0b2.tar.xz";
       locale = "uz";
       arch = "linux-aarch64";
-      sha256 = "e603da60f6be77a60584bd361f773a5e12612e8fad84f0aecaf33756fa13d9a5";
+      sha256 = "1d86c24fcac2d62b946d9bc957a9dfeeebc7d519b4662f5a973beb509b946cdf";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/vi/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/vi/firefox-140.0b2.tar.xz";
       locale = "vi";
       arch = "linux-aarch64";
-      sha256 = "c8ce7aa8546ecaa76af778e29de3bfb12490c2e9e4f667888449939ac424f122";
+      sha256 = "126e1f815c3e57cade53f92fdb57f0f2c8f93436523f5947df4e1bc64ad32263";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/xh/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/xh/firefox-140.0b2.tar.xz";
       locale = "xh";
       arch = "linux-aarch64";
-      sha256 = "dc9071c3a8553cee661223eadaccb949944d11f4631cef76775e6b3d93f89eaa";
+      sha256 = "e3cf2284986f716bb80eac9bc258af4ad089fcb9f24e20dedbc718da3324370e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/zh-CN/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/zh-CN/firefox-140.0b2.tar.xz";
       locale = "zh-CN";
       arch = "linux-aarch64";
-      sha256 = "f8561851a5acce3ba9ea763855464592777d2371d1918d70cce0a01d833ee77c";
+      sha256 = "4b4d6d3dbf2fff5efea5c659d5d95c45b55fbc68d0767f7cbd8c052bfdcc5a0b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/linux-aarch64/zh-TW/firefox-139.0b3.tar.xz";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/linux-aarch64/zh-TW/firefox-140.0b2.tar.xz";
       locale = "zh-TW";
       arch = "linux-aarch64";
-      sha256 = "180c46473119cdbe027f13a26a53234e63e1f2dfd291925b0af2edf68ff05650";
+      sha256 = "7725257c301afb843517120dbd5f28d2af0e394aa838d56e208680e8a51183ca";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ach/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ach/Firefox%20140.0b2.dmg";
       locale = "ach";
       arch = "mac";
-      sha256 = "e0a518e46e2f11edca8e5e0ac47449947c3c2777505ef4da832cadcadd093a23";
+      sha256 = "4ed0131e4684690e82a3365020d901921255096dcf3a9d59c9ea6845dad75373";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/af/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/af/Firefox%20140.0b2.dmg";
       locale = "af";
       arch = "mac";
-      sha256 = "680fd32905798aed50dd4a0bb0bb88817581ac246bf12ad7db49c90809619424";
+      sha256 = "b880748c005d6036dd89d9d303976393f3d9ac2a91c185c641ccd647ed056ab8";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/an/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/an/Firefox%20140.0b2.dmg";
       locale = "an";
       arch = "mac";
-      sha256 = "bff5ee309b3f73e65b5de3f40f1a7025a4137e806399c703d20c492ca925585c";
+      sha256 = "6b35af1d4cf4965bae7bfa7ed4df969a81f24b490033c59a9e41eea21fc3e730";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ar/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ar/Firefox%20140.0b2.dmg";
       locale = "ar";
       arch = "mac";
-      sha256 = "71f47f400126a2729f37bf8947c8577cb012a787b9c37f8dda516f4e765e5b2f";
+      sha256 = "866cfb8c17c8e2382c6ea691187507db00157aaaaf53448d49b95407e18e5c85";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ast/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ast/Firefox%20140.0b2.dmg";
       locale = "ast";
       arch = "mac";
-      sha256 = "a614feb3d06e2cf3430bcfc3daa02d53bbff1dca8a5433d43745efa03f0c7e73";
+      sha256 = "7f6aa9adad62d9991e693775e91ed6826594405f17cdebccb99cb8dcc39bf095";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/az/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/az/Firefox%20140.0b2.dmg";
       locale = "az";
       arch = "mac";
-      sha256 = "07482d9ffdbc3629e9c7c4fe419cbe2824b947cf93b4cc7fa371bf9c1083198a";
+      sha256 = "6fe3f217f783eb93cd8d84b903a9453893b9f1de3f48f68e5484b351b93ef711";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/be/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/be/Firefox%20140.0b2.dmg";
       locale = "be";
       arch = "mac";
-      sha256 = "6163ec17db5b8bbe2e897ee3820334928f18fae85055262561cedf1a1ee8918d";
+      sha256 = "aae7e9683edee898fd2c665eb1e11572ac4ba61a4960daaa09c19675fa1a19c1";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/bg/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/bg/Firefox%20140.0b2.dmg";
       locale = "bg";
       arch = "mac";
-      sha256 = "575f9b58298f0981566ba826294f80edc45dfd9de69d79e6c82d28d0c884c58c";
+      sha256 = "45cdf56dd70258d1c20ed870adfe2772b7a1b30cf834409edf397d0dca6f395f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/bn/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/bn/Firefox%20140.0b2.dmg";
       locale = "bn";
       arch = "mac";
-      sha256 = "076b89297184b520cce7ffc362b7bca90c4ebade5d64dccf0f7315bd2584f678";
+      sha256 = "51e9862caf96e94224efee1300fd54eefdafb03cae20d15b40b02bc9d44ed731";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/br/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/br/Firefox%20140.0b2.dmg";
       locale = "br";
       arch = "mac";
-      sha256 = "1a29076fab57e50c45cd6fcc8f25cbfbd9d6a962705b88a607935c6184ebe2df";
+      sha256 = "be935dc3369b54d1cdb61ce4662b45839d4bd97ab7e2e66edf2693c9b6716b56";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/bs/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/bs/Firefox%20140.0b2.dmg";
       locale = "bs";
       arch = "mac";
-      sha256 = "267526f268fc1deec51cfd16fce9c24fbf7fa9789e1d3d82c42df7bef754787e";
+      sha256 = "2cbe8ca8c678cb81385e657660bd92346dafbebf58b6c73d1f6f77e48f52aa6a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ca-valencia/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ca-valencia/Firefox%20140.0b2.dmg";
       locale = "ca-valencia";
       arch = "mac";
-      sha256 = "713b6a6a73f06e3a6f09bf1ec06fd9914bf0672b5569b51d4a8fce689fa02c67";
+      sha256 = "3a2312c808f9342b7fac383b075ca13b272861f79f49015fb51ae4d9a01c92f3";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ca/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ca/Firefox%20140.0b2.dmg";
       locale = "ca";
       arch = "mac";
-      sha256 = "1537068f9e353f37f69d39acb852fd25bfee7c9bc6f83af2b2dab2da21737ca9";
+      sha256 = "367bfe9dc9f53f783eb59a2e345a3cf8e65dc4b15f535d8f25be9f2c0ab3ca68";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/cak/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/cak/Firefox%20140.0b2.dmg";
       locale = "cak";
       arch = "mac";
-      sha256 = "726df556a936dbfd4cf756c7736abbe406c7c774986a745eba460a82f79a2f50";
+      sha256 = "055b667349f3962d352bc29a69e2ce67ff19893d2520e1c70043bbb1248d8c53";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/cs/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/cs/Firefox%20140.0b2.dmg";
       locale = "cs";
       arch = "mac";
-      sha256 = "ef6701cb85dbc9af3f2e0013c2813e4cc140307b2c7ddf77ed18307b2a3583a9";
+      sha256 = "c424df549e13c0a6041b212d9e7e49d09bedd634ad0a35daf5ff8b7f08b705fe";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/cy/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/cy/Firefox%20140.0b2.dmg";
       locale = "cy";
       arch = "mac";
-      sha256 = "911406e16a06a37be909b298d84fbca827b74a771e13ad7d1921f62c11e8b9dd";
+      sha256 = "4cb05bb577e421bc3004831bf878267edb6f6c98b5d776522acd57600b7813ba";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/da/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/da/Firefox%20140.0b2.dmg";
       locale = "da";
       arch = "mac";
-      sha256 = "4080196890c2a15ef88a55a97e5f4ddbe03cfafb80f536894b3a9c25fb0ee8b1";
+      sha256 = "793fa4ff34f9f04d83a6f316b8cfa0099f2228648d6fd8e2f066ed381affe5aa";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/de/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/de/Firefox%20140.0b2.dmg";
       locale = "de";
       arch = "mac";
-      sha256 = "40eae4dc5ab677b214dc13afd066444b892bd444f6ab09922a73ceb9ea00d4b3";
+      sha256 = "9284ff990ecbc6260d82aed6e0ffb3608348c5c084c0ca50d59cd75c84e5f4da";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/dsb/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/dsb/Firefox%20140.0b2.dmg";
       locale = "dsb";
       arch = "mac";
-      sha256 = "3ee17df8b247301f376652f938f24464d0809b7fb6b402b9f5083ce2cee9bf34";
+      sha256 = "e433105013e8b543ad239f0ca7a0007e40541056c8a3bd57adc6136b0fe1d117";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/el/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/el/Firefox%20140.0b2.dmg";
       locale = "el";
       arch = "mac";
-      sha256 = "11fafe77ea6929eff1dcc1da0df306c0f8520d7f522c316518889ef6b4bdd273";
+      sha256 = "b9b8a5f25aebdc89e672793436e3d1f1c35aa6af0ef13f080c89ec23d66ccdd2";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/en-CA/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/en-CA/Firefox%20140.0b2.dmg";
       locale = "en-CA";
       arch = "mac";
-      sha256 = "a15fcbf8b20e47ec62f8a0421d21f67ae091a3fb29aced137a52ba05247762d6";
+      sha256 = "3f6db147fc75e6d2c3efe2dee4e889ead1b3d46909bfa555da8012d48fc7f418";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/en-GB/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/en-GB/Firefox%20140.0b2.dmg";
       locale = "en-GB";
       arch = "mac";
-      sha256 = "cdf313854d38f48bc31f30fa4e546d2ea8867f49872b7398005b574d26362548";
+      sha256 = "8328b5267b092e75a646da81563461b6d660cfd1000a2da26ca404acb516badf";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/en-US/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/en-US/Firefox%20140.0b2.dmg";
       locale = "en-US";
       arch = "mac";
-      sha256 = "bb516b07c4519ae946b79a6fc34e911221e5d83851aab2bafdff87c3e5b74b3c";
+      sha256 = "880d44a98e9232eabf61ed9949047c235d4fc68145a97cf3f3569c8557ac848b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/eo/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/eo/Firefox%20140.0b2.dmg";
       locale = "eo";
       arch = "mac";
-      sha256 = "00c505dc9fd5c7e10e424022ce7807a886567b9ef01817e0d86ebd7bcb51e38a";
+      sha256 = "ae306283229c379bfc29cf47b3dfc1fcb5a71d038e4e851781206f619fd19023";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/es-AR/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/es-AR/Firefox%20140.0b2.dmg";
       locale = "es-AR";
       arch = "mac";
-      sha256 = "cb8cd92f3762979b88dfc445bf5d71d83fc7eccd138995b1f6f8662a00c06751";
+      sha256 = "e9d3b45ad4454c8b3ae7b04ad9976b46c9d2b5b96271a58fee55dff00f7044ef";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/es-CL/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/es-CL/Firefox%20140.0b2.dmg";
       locale = "es-CL";
       arch = "mac";
-      sha256 = "4d54031158a87e46f4dd79a2f3835fa2ecafe059160fece167a3eccb213d4ded";
+      sha256 = "1e1fc107c05a73888155a9eb89287a5eb4dd9c4eb61fa54afc096a53b4283fd3";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/es-ES/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/es-ES/Firefox%20140.0b2.dmg";
       locale = "es-ES";
       arch = "mac";
-      sha256 = "2e150d79a2ba9e065128963097289a4ed340473de8a6b5f73a6435ca3bc8ae88";
+      sha256 = "639b027643f251dc168d3b93530d8bd3fcd394f3ff62a3eab964b00f9904a175";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/es-MX/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/es-MX/Firefox%20140.0b2.dmg";
       locale = "es-MX";
       arch = "mac";
-      sha256 = "4e22a347506019c216f3d8f3b363677f9677a44816de1b1cb42a11fb3beb62b7";
+      sha256 = "f9f13f56e74d999c13b17c565087bdc62d38228c49bdebacd2ffe5d972172131";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/et/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/et/Firefox%20140.0b2.dmg";
       locale = "et";
       arch = "mac";
-      sha256 = "f887cf78873cce42ec474a9bf7e2de793b39087b5d71a86a00ace6543d5f06ed";
+      sha256 = "c05c637c4e1e3f5ac941ed86f3eb35a25e910eefd08901322aca5aaef1aa9c3b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/eu/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/eu/Firefox%20140.0b2.dmg";
       locale = "eu";
       arch = "mac";
-      sha256 = "832d8dc7d0d7d011967825e747ffca5697c6a8bbcd0592b60f77bcb602e64b3e";
+      sha256 = "38ed25cbd21e84d73408fd4b2a934b0e4a975cd9b67050b2f584f462f6175cc2";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/fa/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/fa/Firefox%20140.0b2.dmg";
       locale = "fa";
       arch = "mac";
-      sha256 = "bd2fd21b2efddcbad65057b06059c93e4a3ed4535966f71f59b213b9dddcf110";
+      sha256 = "781e74251240e31bc03c6453cd912c6b8c1399bde374d9218ed0b4a4fa3be374";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ff/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ff/Firefox%20140.0b2.dmg";
       locale = "ff";
       arch = "mac";
-      sha256 = "2268a7857090100091254d57e47d72826965e94d3d2922ae0713d8331c0c3fa7";
+      sha256 = "1e02316b5877b8ac781edb9c97b3341d923d02b04eb0a625cc48220f3fa595dd";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/fi/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/fi/Firefox%20140.0b2.dmg";
       locale = "fi";
       arch = "mac";
-      sha256 = "72c7f214ac536cddd3bdd12e14f8e18e82d91e2341622e340691dc119b44b459";
+      sha256 = "444db967472e296569612d6686ac31bd0d13d16c58fa87a05edce7a04d8aa8c8";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/fr/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/fr/Firefox%20140.0b2.dmg";
       locale = "fr";
       arch = "mac";
-      sha256 = "1392ee9e9ece7c3c0a1034ea3460ce18d4dc09695a6c3872f75b44e2083dd6cf";
+      sha256 = "4b8b893500b27eaa571b87f5a02fb2259cc8e0be6dfa11bbbc43635b9656233b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/fur/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/fur/Firefox%20140.0b2.dmg";
       locale = "fur";
       arch = "mac";
-      sha256 = "6b37a09f9e0d05747bf71f6bf33bfee5405900a6486b0e327af7958c4848b889";
+      sha256 = "1e049b0c7b303bb59425280c838f5855329b523e092e151323c5f3e4b14b1446";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/fy-NL/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/fy-NL/Firefox%20140.0b2.dmg";
       locale = "fy-NL";
       arch = "mac";
-      sha256 = "c1ba5e0babab78374c0644917a985bd016fc84383e848c0c08e424ae229f33ee";
+      sha256 = "a66abc76de786b262bf98b903ec78509d4bdd760ec4b7664befaf7a34c29ba9f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ga-IE/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ga-IE/Firefox%20140.0b2.dmg";
       locale = "ga-IE";
       arch = "mac";
-      sha256 = "ab89350cad0a76f3aa3b7958f5e41af7b3f0362ae5716ed764019d86cd55830a";
+      sha256 = "f3d3846347c1295cdd2ce5f9eedb7924ca3eb58b1dfb62cb941b09166dd5d5fe";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/gd/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/gd/Firefox%20140.0b2.dmg";
       locale = "gd";
       arch = "mac";
-      sha256 = "4e36e3ca3e6f2336c10bb1c78db21449b0e893b56f8e0220ad783a0481676e2b";
+      sha256 = "31ffc94d1dd8dd5fe8586cdaf62289f3dfeadb13f98a7253463ad1e31d3b01c4";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/gl/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/gl/Firefox%20140.0b2.dmg";
       locale = "gl";
       arch = "mac";
-      sha256 = "8834cb809f19bbe04bcb97fa0d231049fb0636d701ed04c2eb5c29cf2bb938cd";
+      sha256 = "a35e82b0ea8b3dda94af2250e88fbabe73d1e80c3107a0858510797564e508dd";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/gn/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/gn/Firefox%20140.0b2.dmg";
       locale = "gn";
       arch = "mac";
-      sha256 = "d14cd07d0fd5b9b0f805b327bcb76966ca52ea1790145e47ae770f6361245727";
+      sha256 = "027723af70d814b569ed34f3aac20f88b3f240f385c74938cd17c4f51a5d821f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/gu-IN/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/gu-IN/Firefox%20140.0b2.dmg";
       locale = "gu-IN";
       arch = "mac";
-      sha256 = "c2c14a42f72894d17751c324b5a372a2141c5f3228e8c2055e302ce5a619b795";
+      sha256 = "fd90192e423f2ebd31b2fc3cf5489203c64cec7a32e407eefa67d9f855ea9e01";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/he/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/he/Firefox%20140.0b2.dmg";
       locale = "he";
       arch = "mac";
-      sha256 = "36499814455eea5f4b625c332739530bcbe67b884fb3634086c51841043ab861";
+      sha256 = "cf93ebd15ad94671080e7e1cedb89b62269ffea14eb577b6fe0e2bf07850207e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/hi-IN/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/hi-IN/Firefox%20140.0b2.dmg";
       locale = "hi-IN";
       arch = "mac";
-      sha256 = "6aaae4c73c81bbff984c8b94dbbc51c403161ce0658e713215167c62b9bd5a26";
+      sha256 = "e31224609e571576e63fbc976ef5d19f829cc4f3651079f31da4e2121dccdf4f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/hr/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/hr/Firefox%20140.0b2.dmg";
       locale = "hr";
       arch = "mac";
-      sha256 = "1d05037ef618476b485a1ee5f54fd379978caac33aed2601da1196b531ff9251";
+      sha256 = "db90c833900707d4f4a5774fc63481883ba49dc5fe64a8f6356b3d050d62124e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/hsb/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/hsb/Firefox%20140.0b2.dmg";
       locale = "hsb";
       arch = "mac";
-      sha256 = "c5dc2bea7cc3035da37e6adbbb7ff5e4c9c8dadb18a0f284aa6480ba0523fa27";
+      sha256 = "062a1815118ab0b8504f1fe68ef15e989f228ff8cfde50df0ec0cb23bb64edb9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/hu/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/hu/Firefox%20140.0b2.dmg";
       locale = "hu";
       arch = "mac";
-      sha256 = "98747da364f017149e792d392c3799f5817960f84ef0fb291c2dc76bd2acff93";
+      sha256 = "0d58e286af8a98faebe766da043523ec6ed558c65284d791e82efc5a1defdad1";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/hy-AM/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/hy-AM/Firefox%20140.0b2.dmg";
       locale = "hy-AM";
       arch = "mac";
-      sha256 = "caf0feb89b4d2830699d9e6beb4f799269a291a8de1c7792b9ae7ea59cf33c4b";
+      sha256 = "b3129366bab54573c690bece87689f971c33f0255865b57f836d87583241054a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ia/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ia/Firefox%20140.0b2.dmg";
       locale = "ia";
       arch = "mac";
-      sha256 = "e07aac3d382089f3b2739427a687f77ba1b4e366988c64dfca24fa7aa154ff41";
+      sha256 = "af5c9f132655b2a5a64faad3bc5f4334108d5cfbb860313fdbb5959c67f4846f";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/id/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/id/Firefox%20140.0b2.dmg";
       locale = "id";
       arch = "mac";
-      sha256 = "b080f0e359a540b588f44388fdeb340e73e00eca8183e75d3df34eb0c94e6adc";
+      sha256 = "159eef1610be0923f99b77ad48ab2bbaf451bb0d8b1e6651ca164ba993e25611";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/is/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/is/Firefox%20140.0b2.dmg";
       locale = "is";
       arch = "mac";
-      sha256 = "14ea2fdb726247ff132736ee16abf640a50e2c4626d4128cabf29c92868b9c64";
+      sha256 = "08569f11b397506b4376ccd634fcdf3c548a78b1ccfb1bbff43704cd73d4fded";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/it/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/it/Firefox%20140.0b2.dmg";
       locale = "it";
       arch = "mac";
-      sha256 = "896c2b89b0e74550ffee1b2b64cbabba41a5e966f0a606b1cd1109c82fa7b839";
+      sha256 = "d7469d7f3117ea3ea013df5dec0003a9890504d2f3d70550217dc80b290bf93d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ja-JP-mac/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ja-JP-mac/Firefox%20140.0b2.dmg";
       locale = "ja-JP-mac";
       arch = "mac";
-      sha256 = "bce36ac2f32606f1ee92fd9bda765bb7a3956efb4b87827b94ea246779caff51";
+      sha256 = "2991001790e31d97bd5e7378dc3fd6f78bf496db091dcb7e5e8929980a3ca8c0";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ka/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ka/Firefox%20140.0b2.dmg";
       locale = "ka";
       arch = "mac";
-      sha256 = "15c2a3a3f1b4d4b3602afd3e25774b1ea073b6cc1394c623ebde0d5cb2196d59";
+      sha256 = "053c5217774c857a6dc15007e447dea36dc76d403cd1024938987bd6e15ca8af";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/kab/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/kab/Firefox%20140.0b2.dmg";
       locale = "kab";
       arch = "mac";
-      sha256 = "3647fb09d5c77bb90788aab0329da3e7e562cb455483289d5152bd845162aaef";
+      sha256 = "57a6e16519fa59c2dd902d26308ce1f9bd1e28ab7d20ca55736cfa275192e951";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/kk/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/kk/Firefox%20140.0b2.dmg";
       locale = "kk";
       arch = "mac";
-      sha256 = "bc253d2686952356ae7b6ee8429fc30b3b67b9c99ce1f8372b7a280172bc340a";
+      sha256 = "bc6974ccea65432855aa31f5183578ada6562efce971588c3fc6bfe1b841986a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/km/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/km/Firefox%20140.0b2.dmg";
       locale = "km";
       arch = "mac";
-      sha256 = "62ffcffd64359b8cae0138819e4783678f2a50f9359a4d71a883731117cfc5c1";
+      sha256 = "893979330f94c241f95188b479628e6a3c20f771e778459bdd95cf6e9b6abdc4";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/kn/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/kn/Firefox%20140.0b2.dmg";
       locale = "kn";
       arch = "mac";
-      sha256 = "c213cbd3f6d7267f39be082f93dd5d46ead2df09878f31f2c2b472e3c795c718";
+      sha256 = "12cd26e5fc8dc9355ac7e75964cff9553ce300949fe0c9646c901b4b31ea8e97";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ko/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ko/Firefox%20140.0b2.dmg";
       locale = "ko";
       arch = "mac";
-      sha256 = "257a6db2f9324b4f983ab0bd655096391dc193733ab0a4c3fcd8525f8e0d2e8b";
+      sha256 = "f81b961491a67e97ed738a49f1a09dbf42654df0921ee0a7b8b711b72ac906c7";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/lij/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/lij/Firefox%20140.0b2.dmg";
       locale = "lij";
       arch = "mac";
-      sha256 = "13ab3253431ca8903376986973944f50930d81ba5265b20063819e425ccf03be";
+      sha256 = "3ebcf3cf0fa5bfcc742f915aa5c35bf83cd51e9da0e196bc2d8ba66e9692cd9a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/lt/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/lt/Firefox%20140.0b2.dmg";
       locale = "lt";
       arch = "mac";
-      sha256 = "eaf604655b8851623523e07adeb17d3c491a6446483f8ae08a0e3b26ac00537b";
+      sha256 = "49f53843360a4b9b5ac9464a5d2a94d795f5dae355d590127e8804229b4e55a9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/lv/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/lv/Firefox%20140.0b2.dmg";
       locale = "lv";
       arch = "mac";
-      sha256 = "68a8759f7b87d60a5888bc3e411ff1d96c8fbe2d777d955405c7175a26785947";
+      sha256 = "33506586c4e1672039cf32e62c0558d06ee96d3f0172565f9bd1ecee7ea38f65";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/mk/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/mk/Firefox%20140.0b2.dmg";
       locale = "mk";
       arch = "mac";
-      sha256 = "dfaf7648103b53050f8e6bfd9d15a16c91b5c8097ae66dbf29b4816c98585f8d";
+      sha256 = "0798de1794c577af5e0545f4682baa4e72cb700bc153ce23d597fbb58882a32e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/mr/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/mr/Firefox%20140.0b2.dmg";
       locale = "mr";
       arch = "mac";
-      sha256 = "98b55e60b28c26f2d4b64ccc6c2a168eb3778b3eb7f30338c7fe65b93c4947aa";
+      sha256 = "a73d3ae4ebd2e80e4fb7280ca335ad99146d71faabf6dbb0c114f98f088d89f3";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ms/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ms/Firefox%20140.0b2.dmg";
       locale = "ms";
       arch = "mac";
-      sha256 = "0f4dfebfe6a49408c9e6f86f08fbeeba1752e2338547414d3f951b54301a0190";
+      sha256 = "73c3351e7e63bbd50b7b9c79c3a604fd31efcf381d1a9c023f9c7bdc6f0f5303";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/my/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/my/Firefox%20140.0b2.dmg";
       locale = "my";
       arch = "mac";
-      sha256 = "69a6343204688fb6917ae3bc8246dbf05aa0d33ba1e3ab1dd63bff15517927eb";
+      sha256 = "631e0ece9a4af6e8ae1bc447ee433c95cdae9a9c18ae75c49022655ace95395a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/nb-NO/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/nb-NO/Firefox%20140.0b2.dmg";
       locale = "nb-NO";
       arch = "mac";
-      sha256 = "e53432862824641c579b83b0390c5266fd9acd775774e675b92c85dd0a1f283b";
+      sha256 = "632a6cafabc4fb5bb579d00938a727e169453bca23727c4f981bc6af49487958";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ne-NP/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ne-NP/Firefox%20140.0b2.dmg";
       locale = "ne-NP";
       arch = "mac";
-      sha256 = "1ec4db3a6a73d9c89c1abac64c3f21f203a312d03239c634aab1b5fc1e1978f7";
+      sha256 = "5fc19a06fdb469fa27246f5541887fb36a5f05826f645fd4dd5941d37ac46ad8";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/nl/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/nl/Firefox%20140.0b2.dmg";
       locale = "nl";
       arch = "mac";
-      sha256 = "c4d22c9a149fc3b9fe1026e12463e95e96dd684dba1d6087d295d83b214ee419";
+      sha256 = "68c88cac72f77231dd4e26a6e1790f13facb0bc37cfc04eb5e17020ad1c6521d";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/nn-NO/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/nn-NO/Firefox%20140.0b2.dmg";
       locale = "nn-NO";
       arch = "mac";
-      sha256 = "8ed77e09b7f21288f0afab5eeaa3f37d516d65c98937e6651362d1655be35b27";
+      sha256 = "25cd5de92e437b848c83d049380a10d9dce7f26456c20fb3da1e29d7adb98b6c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/oc/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/oc/Firefox%20140.0b2.dmg";
       locale = "oc";
       arch = "mac";
-      sha256 = "228a5983879f3d71ed5c3f0e3147814889e647a495083a18b99ec0a352620138";
+      sha256 = "6a8a2d6a6f85d8583d14abb61b7aba1dadb5830f5d33b80ad1b7ef5ed010341a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/pa-IN/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/pa-IN/Firefox%20140.0b2.dmg";
       locale = "pa-IN";
       arch = "mac";
-      sha256 = "8b2c24e4396863b73b514035ef1bd950bbdce38a891bfd157e8dce2b47be0ce9";
+      sha256 = "72d017a1115c861d89ba13ffaa673d1a33b459426cf2be7434ac526473e458b5";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/pl/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/pl/Firefox%20140.0b2.dmg";
       locale = "pl";
       arch = "mac";
-      sha256 = "54dbd4a9a0ff77c603108afda46ad70d492795dfd1de37e0baa61fc1a1892839";
+      sha256 = "868b42e0a9752172fe8871a5e74a6ee6d1e6ace89480a2b8f937f57187581d17";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/pt-BR/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/pt-BR/Firefox%20140.0b2.dmg";
       locale = "pt-BR";
       arch = "mac";
-      sha256 = "67a1c150bf04edc8d4cc15fdb864828feeb3329cdd454be8b25bf455cd64b863";
+      sha256 = "edf314c2893d2a07ae3c0e98fd4faa01a8c70afa1c42bf96f4b908e987d65d30";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/pt-PT/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/pt-PT/Firefox%20140.0b2.dmg";
       locale = "pt-PT";
       arch = "mac";
-      sha256 = "8f64369b64b5bdecfd25eabd0efc4ddc1b2ca724e0532f1a79c4d1875217aba8";
+      sha256 = "7c23718aae1119db08e6225104c3748e7b175eb6c96eb21ff7e098f3b3b457bf";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/rm/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/rm/Firefox%20140.0b2.dmg";
       locale = "rm";
       arch = "mac";
-      sha256 = "2f2f00063d3bf05c486734567e26cbc9563d699208b180ee969bda9a3e990872";
+      sha256 = "0dee6e7eabfb1d2727ae10ffe3efde28e87574573271793f27f4696cc6ed4735";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ro/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ro/Firefox%20140.0b2.dmg";
       locale = "ro";
       arch = "mac";
-      sha256 = "8c4f64ff21c0fc81559d29958a9f3419680272a8fe3a309e07b2848b3a0756b2";
+      sha256 = "258337f48e73793368e35586b22ab61f441eeb5c884fb1fae2a19fe750dee283";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ru/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ru/Firefox%20140.0b2.dmg";
       locale = "ru";
       arch = "mac";
-      sha256 = "c0976a0c47d82613fbcbd3054cc92f1239ec8af017b79f9cc3c7e2a46058b085";
+      sha256 = "0d94677e22915b79deddfbfdb80c8be4699fbb47fda59b5e54ea26ab80064210";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/sat/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/sat/Firefox%20140.0b2.dmg";
       locale = "sat";
       arch = "mac";
-      sha256 = "ca292c59e2845540369343d79572523e1e4cf383ab27b079e5503ca9b336db40";
+      sha256 = "78f600da1286888e95132da917f0881e2fb480cdaab5f339914f7a3509b5cb12";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/sc/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/sc/Firefox%20140.0b2.dmg";
       locale = "sc";
       arch = "mac";
-      sha256 = "bef03d37448cd88fd7d455e263673ad057e51e5e375766c79dc96d10c807904c";
+      sha256 = "567c98cf0a6d6c789dce738546e02a8c31574b718e997a9e287abc3eedec8c39";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/sco/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/sco/Firefox%20140.0b2.dmg";
       locale = "sco";
       arch = "mac";
-      sha256 = "6d303464a114597524152610c4e431a81fae3b9282764874f2a0548bc5d20974";
+      sha256 = "d71db15059d870d0dfb7492403342df38f7ec0942f72363914153357141b780b";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/si/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/si/Firefox%20140.0b2.dmg";
       locale = "si";
       arch = "mac";
-      sha256 = "4f4c76296bc4f04ad97cbd35a02987d99ef9c05a3a02b06e8d48860087adbf8d";
+      sha256 = "894c1f664aacb2dd66ba0428d27bb07918c50fbf5529243591f93447c4a21811";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/sk/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/sk/Firefox%20140.0b2.dmg";
       locale = "sk";
       arch = "mac";
-      sha256 = "07d0440034e2c92c183682ebc9778f32f7549e9e3668a9a012faebf64b66d1b3";
+      sha256 = "29bbcf6c57010f28cbba52d2fffa909387c3660d0fdda5a53486e05a872adf9e";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/skr/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/skr/Firefox%20140.0b2.dmg";
       locale = "skr";
       arch = "mac";
-      sha256 = "f8ceb672752e27a354ff54250a182465a718e1d83ccc6d7f3716c36d343b8ff7";
+      sha256 = "3d65a2d0b7ae8546feee7720261cbcde1f100adb31305c4f2ffcc26206b475db";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/sl/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/sl/Firefox%20140.0b2.dmg";
       locale = "sl";
       arch = "mac";
-      sha256 = "76a258adaadc52b24f596495766cab8ce4344db2d06d291afcc20029627d9ea9";
+      sha256 = "60f74c2dfaac5b049ffc480ed6fd77280ed839caaa8872d3a30eaf5698f5273a";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/son/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/son/Firefox%20140.0b2.dmg";
       locale = "son";
       arch = "mac";
-      sha256 = "6356d093eafd677b78e76fe1fa7247ec723df4432fe69024fc80de6ebd98a146";
+      sha256 = "513be0645fa2800fdc4f228727fbb9b4f93364caba511673265a8993850100bd";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/sq/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/sq/Firefox%20140.0b2.dmg";
       locale = "sq";
       arch = "mac";
-      sha256 = "b57ecf837b0930f369a87bac330854dc952ea8fd664bc4d9367a1bc602884543";
+      sha256 = "29e2b1ea31394dc37021433220e8962dfa24e146491280a93b97b4bc5a0a4bb1";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/sr/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/sr/Firefox%20140.0b2.dmg";
       locale = "sr";
       arch = "mac";
-      sha256 = "608a72824910e43dc62d6c6e856edf886e280fa1499eda3fb15df01aa58475ae";
+      sha256 = "df4ecb60378e381c578952e0f3be3adcf7453b21c43a4c2015a596b118c7d683";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/sv-SE/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/sv-SE/Firefox%20140.0b2.dmg";
       locale = "sv-SE";
       arch = "mac";
-      sha256 = "64c79d0c96810221692d65cf3830a4dc68c0123e93c15b4e6425825f2a485bc6";
+      sha256 = "b0f0d77d48cd31bc6b61253ecec6a99c7b4e5ae79659dad34b937790118e64e9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/szl/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/szl/Firefox%20140.0b2.dmg";
       locale = "szl";
       arch = "mac";
-      sha256 = "598d0cedf0037f92e579917de539a72d2bf89963cc09e182dc298912724adc7b";
+      sha256 = "460465dc52fb1d8c4776d20b275fa31dd6a6b3c959ae29a17ac0a57570deaeeb";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ta/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ta/Firefox%20140.0b2.dmg";
       locale = "ta";
       arch = "mac";
-      sha256 = "5046f6a144780b890bd13599b5043b95989838ae021180c08479755411de60a3";
+      sha256 = "aa67060f3c84e4691b24e6673e8320031422f4443038fa6534a963c63a60e37c";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/te/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/te/Firefox%20140.0b2.dmg";
       locale = "te";
       arch = "mac";
-      sha256 = "e5dd35d5878bf0b397c6b55e4bf03405068e188c655f426160f00a2dee4eda87";
+      sha256 = "35df147c9ef6d765889ff758c3c5214bc5dc5eff7f9eb0080724bf70d2192a25";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/tg/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/tg/Firefox%20140.0b2.dmg";
       locale = "tg";
       arch = "mac";
-      sha256 = "245f224cb73ea1337c04d839cd10b5d5d67e9d1d278696cc408c7e7d71154124";
+      sha256 = "dac6ebb25fe418ffc29811398bdbd2b5ec2c5ac522b1baacc8b0ed15923e18a9";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/th/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/th/Firefox%20140.0b2.dmg";
       locale = "th";
       arch = "mac";
-      sha256 = "056638b388bd20f14c6c41662aa0a495600a40ec9393e5d157fa9fcb0649ec78";
+      sha256 = "d055912dca60a974f7301ce63599cd685c24a375df4622c28ccbeff67eb1df50";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/tl/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/tl/Firefox%20140.0b2.dmg";
       locale = "tl";
       arch = "mac";
-      sha256 = "32d4699b72e0e0adbca59d84fc63a3ce5a3780976545d1a3d150cabf0856b78b";
+      sha256 = "c7f9cb0e805776940e0f33849ff9f321f53b93e21470057432e45ad2638cce43";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/tr/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/tr/Firefox%20140.0b2.dmg";
       locale = "tr";
       arch = "mac";
-      sha256 = "a8a3028435311d2c4124254372a5d6008ced3fae5cbcadbf25b02d74509c0c7d";
+      sha256 = "97d25c6dc788e64f1857f0c1fec8745a0f3a16cd802dd5af3d3c167d9158e1dc";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/trs/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/trs/Firefox%20140.0b2.dmg";
       locale = "trs";
       arch = "mac";
-      sha256 = "f1d8039af76a04dca82979c42971d1096456e196f4a1124ec4beed727f2185d3";
+      sha256 = "aed82548580fef5dda24a7b48f301ff7fb23041f9e00f651392e38ef92dc7a80";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/uk/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/uk/Firefox%20140.0b2.dmg";
       locale = "uk";
       arch = "mac";
-      sha256 = "838a1942ea4ca9e163b06df9bc72970e128af87e4a35376f912623ef73b5b52b";
+      sha256 = "792e2b27880a62f5eef7b93c36a35d89404b964cd17b879bd14e567e846d55c0";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/ur/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/ur/Firefox%20140.0b2.dmg";
       locale = "ur";
       arch = "mac";
-      sha256 = "306d04d7c9965e1c3c5ce1f45574b82437c32316dd5857c066c228d2a22606d2";
+      sha256 = "1e9c8922a7cf00a080b9e69186136dee0f84d44ab61cb8ac8390f77dfb5d7982";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/uz/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/uz/Firefox%20140.0b2.dmg";
       locale = "uz";
       arch = "mac";
-      sha256 = "93c61ed4ffb6875756b366f1ffe01682303bdb6ed20c6d2d7e44979305d31254";
+      sha256 = "674551891bbe01db98fbc843ce035c473a19bb6ea7f9b50cfca6a57d281f4345";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/vi/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/vi/Firefox%20140.0b2.dmg";
       locale = "vi";
       arch = "mac";
-      sha256 = "60fad61144cfdeeaad641b714e4e63ca184079d58091dc555975543657d54fcc";
+      sha256 = "14d97055a0487c9a7f82959ff4e0978bc67867c5f969ea90cedf1d18a976a344";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/xh/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/xh/Firefox%20140.0b2.dmg";
       locale = "xh";
       arch = "mac";
-      sha256 = "00f599dfacd33bb98f67e05fab0d9588456de666f9bb78eb52e22d96a4f1e323";
+      sha256 = "e91833e99b4e8b04f690c1e041e2db288d5f64412e04f34bbc3d8b00123a32b0";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/zh-CN/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/zh-CN/Firefox%20140.0b2.dmg";
       locale = "zh-CN";
       arch = "mac";
-      sha256 = "0ab249304b86ca7ae055291353a4627e507d2699b6346b9ff3dbeba3766ba044";
+      sha256 = "721f621b057bcfea7397b16f8e5da98e0059a742809c8b0d3fd54d3b459ac1bc";
     }
     {
-      url = "https://archive.mozilla.org/pub/devedition/releases/139.0b3/mac/zh-TW/Firefox%20139.0b3.dmg";
+      url = "https://archive.mozilla.org/pub/devedition/releases/140.0b2/mac/zh-TW/Firefox%20140.0b2.dmg";
       locale = "zh-TW";
       arch = "mac";
-      sha256 = "b9c4765a5aed85cece38efa50fed10fa361ba9ba56d9c40925661885680d8165";
+      sha256 = "0f0dc4ebad9ff5c09a4c015cff5e76a7ca271dbadf185a23034806976a6dd1e5";
     }
   ];
 }
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index a4231f204e28..8a69a594d02f 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = pname;
-  version = "138.0b4";
+  version = "140.0b2";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "a8f9e645c80d9c40b0435ee00261aa9fcac801efcfcbf42b10e6af9390290b9f643358aca6a01d9465eab3b64f46b2b71b4a3ea4c7e0a8f96bdfce15bf817f92";
+    sha512 = "c8010b6cdf90f52d5105971d726139460a0194ca7e84ed57184897f4f258957ff64117ef14a38a6dba4cab3074f3a92aee0eaf221ecf22218f6408636ab9c960";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index 79b2e0745b44..77b5c35b6748 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = pname;
-  version = "138.0b9";
+  version = "140.0b2";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "cf737b8c394150430cda512a84ebdf04426db0c413863eb37a327c44fc952db7de1be07956aaded3ddb769480fb307a102c1f4f7dab4ba8a38f2371fdd35a961";
+    sha512 = "4a369638dab1202f21f071a1eb48552888adf01e49ee4e029dfe7b42919312719004099b203a066057fd4d9ef9a684e5f95b0aa06ecf82cc88df0025f33f6368";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/librewolf/default.nix b/pkgs/applications/networking/browsers/librewolf/default.nix
index e8ca16d5a5c1..047af6d1bb6a 100644
--- a/pkgs/applications/networking/browsers/librewolf/default.nix
+++ b/pkgs/applications/networking/browsers/librewolf/default.nix
@@ -32,6 +32,7 @@ in
       squalus
       dwrege
       fpletz
+      grimmauld
     ];
     platforms = lib.platforms.unix;
     broken = stdenv.buildPlatform.is32bit;
diff --git a/pkgs/applications/networking/browsers/librewolf/librewolf.nix b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
index 85dc784ae873..a87745795204 100644
--- a/pkgs/applications/networking/browsers/librewolf/librewolf.nix
+++ b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
@@ -15,12 +15,8 @@ rec {
 
   extraPostPatch = ''
     while read patch_name; do
-      if [ "$patch_name" != "patches/macos-import-vector.patch" ]; then
-        echo "applying LibreWolf patch: $patch_name"
-        patch -p1 < ${source}/$patch_name
-      else
-        echo "skipping LibreWolf patch: $patch"
-      fi
+      echo "applying LibreWolf patch: $patch_name"
+      patch -p1 < ${source}/$patch_name
     done <${source}/assets/patches.txt
 
     cp -r ${source}/themes/browser .
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 9f579f6aacb2..91f4e6e1e690 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "138.0.4-1",
+  "packageVersion": "139.0-1",
   "source": {
-    "rev": "138.0.4-1",
-    "hash": "sha256-KR8ZiueaEOXt2dw8T6ZvrQURV49Xu4cYe0XE8tEUmbw="
+    "rev": "139.0-1",
+    "hash": "sha256-dhi9hUgEoOFQj7IixFKz1J81zo43h4MkAMpr2OIgass="
   },
   "firefox": {
-    "version": "138.0.4",
-    "hash": "sha512-ZNgEVtqN8n1+7tfrIMNfzyE7yUjrSHObYQHixHbqmpEz2pKEd6eWg8lsFg+NU77VK+SH8BqNKeONOQcfEmdoBg=="
+    "version": "139.0",
+    "hash": "sha512-hKK0fy/3GqwiandKsKyauNmhb1YgoG96u2ZIcyIJ0CKu81qdSHPpHr1npPxJT8I4Uk4lw4+tgEbbJq/aBub5cA=="
   }
 }
diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
deleted file mode 100644
index ff6fe11e6d50..000000000000
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ /dev/null
@@ -1,251 +0,0 @@
-{
-  lib,
-  stdenv,
-  coreutils,
-  fetchurl,
-  zlib,
-  libX11,
-  libXext,
-  libSM,
-  libICE,
-  libxkbcommon,
-  libxshmfence,
-  libXfixes,
-  libXt,
-  libXi,
-  libXcursor,
-  libXScrnSaver,
-  libXcomposite,
-  libXdamage,
-  libXtst,
-  libXrandr,
-  alsa-lib,
-  dbus,
-  cups,
-  libexif,
-  ffmpeg,
-  systemd,
-  libva,
-  libGL,
-  freetype,
-  fontconfig,
-  libXft,
-  libXrender,
-  libxcb,
-  expat,
-  libuuid,
-  libxml2,
-  glib,
-  gtk3,
-  pango,
-  gdk-pixbuf,
-  cairo,
-  atk,
-  at-spi2-atk,
-  at-spi2-core,
-  qt5,
-  libdrm,
-  libgbm,
-  vulkan-loader,
-  nss,
-  nspr,
-  patchelf,
-  makeWrapper,
-  wayland,
-  pipewire,
-  isSnapshot ? false,
-  proprietaryCodecs ? false,
-  vivaldi-ffmpeg-codecs ? null,
-  enableWidevine ? false,
-  widevine-cdm ? null,
-  commandLineArgs ? "",
-  pulseSupport ? stdenv.hostPlatform.isLinux,
-  libpulseaudio,
-  kerberosSupport ? true,
-  libkrb5,
-}:
-
-let
-  branch = if isSnapshot then "snapshot" else "stable";
-  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
-in
-stdenv.mkDerivation rec {
-  pname = "vivaldi";
-  version = "7.4.3684.38";
-
-  suffix =
-    {
-      aarch64-linux = "arm64";
-      x86_64-linux = "amd64";
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  src = fetchurl {
-    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
-    hash =
-      {
-        aarch64-linux = "sha256-SmmmEFSzAGgm9eKeTKpUFuW/UVNyXw8x8c1uRp69fbw=";
-        x86_64-linux = "sha256-h/ZcJq51gsb03V5KFlPOE9H0NonYxJNeWVg2UCQEBPs=";
-      }
-      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  };
-
-  unpackPhase = ''
-    ar vx $src
-    tar -xvf data.tar.xz
-  '';
-
-  nativeBuildInputs = [
-    patchelf
-    makeWrapper
-    qt5.wrapQtAppsHook
-  ];
-
-  dontWrapQtApps = true;
-
-  buildInputs =
-    [
-      stdenv.cc.cc
-      stdenv.cc.libc
-      zlib
-      libX11
-      libXt
-      libXext
-      libSM
-      libICE
-      libxcb
-      libxkbcommon
-      libxshmfence
-      libXi
-      libXft
-      libXcursor
-      libXfixes
-      libXScrnSaver
-      libXcomposite
-      libXdamage
-      libXtst
-      libXrandr
-      atk
-      at-spi2-atk
-      at-spi2-core
-      alsa-lib
-      dbus
-      cups
-      gtk3
-      gdk-pixbuf
-      libexif
-      ffmpeg
-      systemd
-      libva
-      qt5.qtbase
-      qt5.qtwayland
-      freetype
-      fontconfig
-      libXrender
-      libuuid
-      expat
-      glib
-      nss
-      nspr
-      libGL
-      libxml2
-      pango
-      cairo
-      libdrm
-      libgbm
-      vulkan-loader
-      wayland
-      pipewire
-    ]
-    ++ lib.optional proprietaryCodecs vivaldi-ffmpeg-codecs
-    ++ lib.optional pulseSupport libpulseaudio
-    ++ lib.optional kerberosSupport libkrb5;
-
-  libPath =
-    lib.makeLibraryPath buildInputs
-    + lib.optionalString (stdenv.hostPlatform.is64bit) (
-      ":" + lib.makeSearchPathOutput "lib" "lib64" buildInputs
-    )
-    + ":$out/opt/${vivaldiName}/lib";
-
-  buildPhase =
-    ''
-      runHook preBuild
-      echo "Patching Vivaldi binaries"
-      for f in chrome_crashpad_handler vivaldi-bin vivaldi-sandbox ; do
-        patchelf \
-          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          --set-rpath "${libPath}" \
-          opt/${vivaldiName}/$f
-      done
-
-      for f in libGLESv2.so libqt5_shim.so ; do
-        patchelf --set-rpath "${libPath}" opt/${vivaldiName}/$f
-      done
-    ''
-    + lib.optionalString proprietaryCodecs ''
-      ln -s ${vivaldi-ffmpeg-codecs}/lib/libffmpeg.so opt/${vivaldiName}/libffmpeg.so.''${version%\.*\.*}
-    ''
-    + ''
-      echo "Finished patching Vivaldi binaries"
-      runHook postBuild
-    '';
-
-  dontPatchELF = true;
-  dontStrip = true;
-
-  installPhase =
-    ''
-      runHook preInstall
-      mkdir -p "$out"
-      cp -r opt "$out"
-      mkdir "$out/bin"
-      ln -s "$out/opt/${vivaldiName}/${vivaldiName}" "$out/bin/vivaldi"
-      mkdir -p "$out/share"
-      cp -r usr/share/{applications,xfce4} "$out"/share
-      substituteInPlace "$out"/share/applications/*.desktop \
-        --replace /usr/bin/${vivaldiName} "$out"/bin/vivaldi
-      substituteInPlace "$out"/share/applications/*.desktop \
-        --replace vivaldi-stable vivaldi
-      local d
-      for d in 16 22 24 32 48 64 128 256; do
-        mkdir -p "$out"/share/icons/hicolor/''${d}x''${d}/apps
-        ln -s \
-          "$out"/opt/${vivaldiName}/product_logo_''${d}.png \
-          "$out"/share/icons/hicolor/''${d}x''${d}/apps/vivaldi.png
-      done
-      wrapProgram "$out/bin/vivaldi" \
-        --add-flags ${lib.escapeShellArg commandLineArgs} \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
-        --set-default FONTCONFIG_FILE "${fontconfig.out}/etc/fonts/fonts.conf" \
-        --set-default FONTCONFIG_PATH "${fontconfig.out}/etc/fonts" \
-        --suffix XDG_DATA_DIRS : ${gtk3}/share/gsettings-schemas/${gtk3.name}/ \
-        --prefix PATH : ${coreutils}/bin \
-        ''${qtWrapperArgs[@]} \
-        ${lib.optionalString enableWidevine "--suffix LD_LIBRARY_PATH : ${libPath}"}
-    ''
-    + lib.optionalString enableWidevine ''
-      ln -sf ${widevine-cdm}/share/google/chrome/WidevineCdm $out/opt/${vivaldiName}/WidevineCdm
-    ''
-    + ''
-      runHook postInstall
-    '';
-
-  passthru.updateScript = ./update-vivaldi.sh;
-
-  meta = with lib; {
-    description = "Browser for our Friends, powerful and personal";
-    homepage = "https://vivaldi.com";
-    license = licenses.unfree;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    mainProgram = "vivaldi";
-    maintainers = with maintainers; [
-      otwieracz
-      badmutex
-    ];
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
-  };
-}
diff --git a/pkgs/applications/networking/browsers/vivaldi/update-vivaldi.sh b/pkgs/applications/networking/browsers/vivaldi/update-vivaldi.sh
deleted file mode 100755
index 994257889ee6..000000000000
--- a/pkgs/applications/networking/browsers/vivaldi/update-vivaldi.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl common-updater-scripts
-
-set -eu -o pipefail
-
-version=$(curl -sS https://vivaldi.com/download/ | sed -rne 's/.*vivaldi-stable_([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)-1_amd64\.deb.*/\1/p')
-
-update_hash() {
-    url="https://downloads.vivaldi.com/stable/vivaldi-stable_$version-1_$2.deb"
-    hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$url"))
-    update-source-version vivaldi "$version" "$hash" --system=$1 --ignore-same-version
-}
-
-update_hash aarch64-linux arm64
-update_hash x86_64-linux amd64
diff --git a/pkgs/applications/networking/browsers/vivaldi/update.sh b/pkgs/applications/networking/browsers/vivaldi/update.sh
deleted file mode 100755
index 461b38e3ec44..000000000000
--- a/pkgs/applications/networking/browsers/vivaldi/update.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p libarchive curl common-updater-scripts
-
-set -eu -o pipefail
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-root=../../../../..
-export NIXPKGS_ALLOW_UNFREE=1
-
-version() {
-  (cd "$root" && nix-instantiate --eval --strict -A "$1.version" | tr -d '"')
-}
-
-vivaldi_version_old=$(version vivaldi)
-vivaldi_version=$(curl -sS https://vivaldi.com/download/ | sed -rne 's/.*vivaldi-stable_([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)-1_amd64\.deb.*/\1/p')
-
-if [[ ! "$vivaldi_version" = "$vivaldi_version_old" ]]; then
-  echo "vivaldi is not up-to-date, not updating codecs"
-  (cd "$root" && nix-shell maintainers/scripts/update.nix --argstr package vivaldi)
-  exit
-fi
-
-echo "vivaldi is up-to-date, updating codecs"
-
-# Download vivaldi and save file path.
-url="https://downloads.vivaldi.com/stable/vivaldi-stable_${vivaldi_version}-1_amd64.deb"
-mapfile -t prefetch < <(nix-prefetch-url --print-path "$url")
-path=${prefetch[1]}
-
-nixpkgs="$(git rev-parse --show-toplevel)"
-default_nix="$nixpkgs/pkgs/applications/networking/browsers/vivaldi/default.nix"
-ffmpeg_nix="$nixpkgs/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix"
-
-# Check vivaldi-ffmpeg-codecs version.
-chromium_version_old=$(version vivaldi-ffmpeg-codecs)
-ffmpeg_update_script=$(bsdtar xOf "$path" data.tar.xz | bsdtar xOf - ./opt/vivaldi/update-ffmpeg)
-chromium_version=$(sed -rne 's/^FFMPEG_VERSION_DEB\=([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*/\1/p' <<< $ffmpeg_update_script)
-download_subdir=$(sed -rne 's/.*FFMPEG_URL_DEB\=https:\/\/launchpadlibrarian\.net\/([0-9]+)\/.*_amd64\.deb/\1/p' <<< $ffmpeg_update_script)
-
-if [[ "$chromium_version" != "$chromium_version_old" ]]; then
-  # replace the download prefix
-  sed -i $ffmpeg_nix -e "s/\(https:\/\/launchpadlibrarian\.net\/\)[0-9]\+/\1$download_subdir/g"
-  (cd "$root" && update-source-version vivaldi-ffmpeg-codecs "$chromium_version")
-
-  git add "${ffmpeg_nix}"
-  git commit -m "vivaldi-ffmpeg-codecs: $chromium_version_old -> $chromium_version"
-fi
diff --git a/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
index 5d212c7f9e0e..8caf711a8a74 100644
--- a/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.0%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "2822af9a2341033243bd1aff7433c0670bcad4059a8d0a35fb314dba24692674"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.1%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "5fd0e18b7cd7457773d30e86270a4e1caed66d2e5c1380e65b3d0375227d241c"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.0%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "cf175be8674dd1812cd92930a852ef7a11572c4588180f51d5c19bdfd0a810e4"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.1%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "518343da6213e7edba9da2f58fcf30c268600fc8003f92f245d9818ead2db03e"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.0%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "c97f7a86a04aad7d5dc74d7e85e0fbc097e9edf76358f8a7c2097e6ca9740211"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.1%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "2ac40b650104a1dc21b4b77fccf943efca8893de0432e6cdf1e7e1534eb6f4aa"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.0%2Bk3s1/k3s-images.txt",
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.1%2Bk3s1/k3s-images.txt",
     "sha256": "aa8e10337aef453cb17e6408dbaec9eb2da409ca6ba1f8bc7332fcef97fdaf3a"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_33/versions.nix b/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
index be10b6dd7b6a..9665eb3c02af 100644
--- a/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
@@ -1,15 +1,15 @@
 {
-  k3sVersion = "1.33.0+k3s1";
-  k3sCommit = "63ab8e534cdfce2a60f4b016dfedb4f8d74ae8ec";
-  k3sRepoSha256 = "1ysfzb4216qk9gjmp2zp103xzjgz8irc7h9m4yp041gkvffa7pyg";
-  k3sVendorHash = "sha256-eVMCrOAOCB7saYuxQQUUrmRHT+ZURXESTI6ZRKSDGZs=";
+  k3sVersion = "1.33.1+k3s1";
+  k3sCommit = "99d91538b1327da933356c318dc8040335fbb66c";
+  k3sRepoSha256 = "1ncj30nid3x96irw2raxf1naa2jap1d0s1ygxsvfckblbb6rjnmx";
+  k3sVendorHash = "sha256-jrPVY+FVZV9wlbik/I35W8ChcLrHlYbLAwUYU16mJLM=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";
   k3sRootSha256 = "0svbi42agqxqh5q2ri7xmaw2a2c70s7q5y587ls0qkflw5vx4sl7";
   k3sCNIVersion = "1.6.0-k3s1";
   k3sCNISha256 = "0g7zczvwba5xqawk37b0v96xysdwanyf1grxn3l3lhxsgjjsmkd7";
-  containerdVersion = "2.0.4-k3s4";
-  containerdSha256 = "05j5jyjnirks11z2930w4k5ij015hsm4pd2wxgj2531fyiy98azl";
+  containerdVersion = "2.0.5-k3s1";
+  containerdSha256 = "1c3hv22zx8y94zwmv5r59bnwgqyhxd10zkinm0jrcvny32ijqdfj";
   criCtlVersion = "1.31.0-k3s2";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
index 8cbb824230f0..e2662f989452 100644
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -333,16 +333,10 @@ let
     }).overrideAttrs
       overrideContainerdAttrs;
 
-  # TODO (#405952): remove this patch. We had to add it to avoid a mass rebuild
-  # for the 25.05 release. Once the above PR is merged, switch back to plain util-linuxMinimal.
-  k3sUtilLinux = util-linuxMinimal.overrideAttrs (prev: {
-    patches =
-      prev.patches or [ ]
-      ++ lib.singleton (fetchpatch {
-        url = "https://github.com/util-linux/util-linux/commit/7dbfe31a83f45d5aef2b508697e9511c569ffbc8.patch";
-        hash = "sha256-bJqpZiPli5Pm/XpDA445Ab5jesXrlcnaO6e4V0B3rSw=";
-      });
-  });
+  # TODO (#409339): remove this patch. We had to add it to avoid a mass rebuild
+  # for the 25.05 release. Once the staging cycle referenced in the above PR completes,
+  # switch back to plain util-linuxMinimal.
+  k3sUtilLinux = util-linuxMinimal.withPatches;
 in
 buildGoModule rec {
   pname = "k3s";
diff --git a/pkgs/applications/networking/cluster/spark/default.nix b/pkgs/applications/networking/cluster/spark/default.nix
index a2472525b122..4ce7f56f2197 100644
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@@ -97,8 +97,8 @@ in
   # a new NixOS release.
   spark_3_5 = spark {
     pname = "spark";
-    version = "3.5.4";
-    hash = "sha256-rSr7UH1dZIkUYW6ehc/dYxlmN9yVjEKwrwLMT+uMd/0=";
+    version = "3.5.5";
+    hash = "sha256-vzcWgIfHPhN3nyrxdk3f0p4fW3MpQ+FuEPnWPw0xNPg=";
   };
   spark_3_4 = spark rec {
     pname = "spark";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 1e832248c2f1..6ea26b5e75d1 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -317,13 +317,13 @@
     "vendorHash": "sha256-ZCMSmOCPEMxCSpl3DjIUGPj1W/KNJgyjtHpmQ19JquA="
   },
   "datadog": {
-    "hash": "sha256-exndOGDZQqvh6m8sJg9/dIGup5SQruwE7qK9T0s/FJ8=",
+    "hash": "sha256-+C+pvw3ghriw3mR/lvpsSH0inTMPNwc6QAEtt6nXINw=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v3.62.0",
+    "rev": "v3.63.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-uLNBbgW4oA8Cq0mjjMQFh7g37V+Ea9ek+ugBYJww88I="
+    "vendorHash": "sha256-FmNeAwJ/lZZEIGt5QlYm9Cqu2cgkXVa1B/ej+5/G7wg="
   },
   "deno": {
     "hash": "sha256-7IvJrhXMeAmf8e21QBdYNSJyVMEzLpat4Tm4zHWglW8=",
@@ -516,13 +516,13 @@
     "vendorHash": "sha256-rGpnPH8ebHXasvelGoJEUU4YbeGJY4adFBbgAHJ8vSs="
   },
   "google-beta": {
-    "hash": "sha256-b79IHQxSid4LhIl3ZPd2rok8V4BdXejcYe5LBCjgvlQ=",
+    "hash": "sha256-VpfIfzIG1h5qnvEqogCK359LLLSgdgxg0DtRGvdZtLU=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v6.35.0",
+    "rev": "v6.37.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Qad4Dfg65aX8dsan4gimGP/hzSaQ7Ay+WTFlr2TgUzw="
+    "vendorHash": "sha256-oz4zVv5swFokYCdcJhBE+PLrIOjwszl58Cn0e7hOKmI="
   },
   "googleworkspace": {
     "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@@ -750,13 +750,13 @@
     "vendorHash": "sha256-fP6brpY/wRI1Yjgapzi+FfOci65gxWeOZulXbGdilrE="
   },
   "linode": {
-    "hash": "sha256-LyGqcWYdwUfAKq3bTHMyZmIyJkndOUzWHkVXduESxus=",
+    "hash": "sha256-DNH+q9FSRlT/SoyW9+n+FLzy/Zi5l82sRigBZIaKabc=",
     "homepage": "https://registry.terraform.io/providers/linode/linode",
     "owner": "linode",
     "repo": "terraform-provider-linode",
-    "rev": "v2.39.0",
+    "rev": "v2.41.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-4YMqzX/vQvWj0sb46NlTADb0be9+/0lwKs+3QArBvUk="
+    "vendorHash": "sha256-j/YgQ4w89XRZPYMCGAT72ervryIeutvk0ivFPR8E1yI="
   },
   "linuxbox": {
     "hash": "sha256-svQRz1/PdVLpHoxOam1sfRTwHqgqs4ohJQs3IPMMAM4=",
@@ -858,13 +858,13 @@
     "vendorHash": null
   },
   "newrelic": {
-    "hash": "sha256-2Bmk1b84oL8DkPShff4RPQSlAu6ufwcb7sp6mJGeo84=",
+    "hash": "sha256-jmvCEJM+hcYToawCcUasWN+gMY9rw5Niw8YT28hk3aw=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.61.0",
+    "rev": "v3.62.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-wqraBQqxpD69iIM45MZLWhgIEiyu300bok3OST+Hegs="
+    "vendorHash": "sha256-UArO7zOOAlnWzzg+t/IWWuMfRAmauvLO4M7Y/mmdz2k="
   },
   "nexus": {
     "hash": "sha256-Lm5CZ+eBDUNIL2KuK/iKc5dTif7P+E9II714vwvYuyU=",
@@ -958,13 +958,13 @@
     "vendorHash": "sha256-Z8ARwVWhep9qrUpl/B7Gj9Aey07Wtwn1XiLnCirV11M="
   },
   "openstack": {
-    "hash": "sha256-Qx4OQzVjhrlILrl5htROVvAzaHQ4AmdkBqpKP17mrBc=",
+    "hash": "sha256-7oQ4O76yEF8QKFUHTrwchbShtiG0LAp67MqfIcDLU7o=",
     "homepage": "https://registry.terraform.io/providers/terraform-provider-openstack/openstack",
     "owner": "terraform-provider-openstack",
     "repo": "terraform-provider-openstack",
-    "rev": "v3.0.0",
+    "rev": "v3.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-0Atbzx1DjInPMa1lNxyNKfNMILjN4S814TlIAQeTfdI="
+    "vendorHash": "sha256-HQVKblAm8H0Q5pbJdIVSMc5FLi3O9TV475yass6BraY="
   },
   "opentelekomcloud": {
     "hash": "sha256-nCtltzYV9yDYEkAuOJVdBlk11nSpdQtk/zlKEn81srs=",
@@ -1111,13 +1111,13 @@
     "vendorHash": "sha256-KezwDRmQQj0MnmsVlrX1OhNG6oMgw8fCxX5VFGdUynw="
   },
   "routeros": {
-    "hash": "sha256-/tTd8EzA1/Js7S3eGg3L9AY9dyoIA3lFSU6VlT6p4us=",
+    "hash": "sha256-vL1ijiP+WDe8nqtSudOuOTPohHe8JRU6wF4el5P/pWg=",
     "homepage": "https://registry.terraform.io/providers/terraform-routeros/routeros",
     "owner": "terraform-routeros",
     "repo": "terraform-provider-routeros",
-    "rev": "v1.85.0",
+    "rev": "v1.85.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-DDmJ/mEOd94E7DqLKjT6Y4XkpVdXyKeAaE/Wj6M3vuw="
+    "vendorHash": "sha256-ysmNy+xojcHPSs++HofOxBKg1AlUO7taYVIcsmW/2kM="
   },
   "rundeck": {
     "hash": "sha256-cf+0qXpgxIsc/JbB7+u3MpmWFwUmpsinp1uARRhuBw0=",
@@ -1391,13 +1391,13 @@
     "vendorHash": null
   },
   "utils": {
-    "hash": "sha256-BnC5ihbOnua4ddTzM8mvWbKz5L13R2NT9c68teVLWo0=",
+    "hash": "sha256-vCdPG8cZUdFhs1OmqDlgCDqBdyFiL99p6I8JhL8C6lY=",
     "homepage": "https://registry.terraform.io/providers/cloudposse/utils",
     "owner": "cloudposse",
     "repo": "terraform-provider-utils",
-    "rev": "v1.29.0",
+    "rev": "v1.30.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-rHJabyfgu3wU79h3DHHYQauFmcR/SDuikauBF+CybZA="
+    "vendorHash": "sha256-giqZi1CmuyANNwzW+y9BUUUEfBhFZKkVGAvIPVvZnzE="
   },
   "vault": {
     "hash": "sha256-6gCpXzvF4p2otwo3dJ8c+EvzbsMZfzVZymb41+hEZoM=",
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 5c98668d49f8..5fd920588f03 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -10,15 +10,15 @@ let
     if stdenv.hostPlatform.isLinux then
       {
         stable = "0.0.95";
-        ptb = "0.0.143";
-        canary = "0.0.678";
+        ptb = "0.0.144";
+        canary = "0.0.687";
         development = "0.0.75";
       }
     else
       {
-        stable = "0.0.345";
-        ptb = "0.0.173";
-        canary = "0.0.784";
+        stable = "0.0.347";
+        ptb = "0.0.174";
+        canary = "0.0.793";
         development = "0.0.88";
       };
   version = versions.${branch};
@@ -30,11 +30,11 @@ let
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-Ki6+o+8/yQjc6kxKS7Re2gBbpfMi3m02L69muqsNm04=";
+        hash = "sha256-URTBQ2YzkC8p7524RqR1OCqI3WkvtsClvd91RIWEQqU=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-Z+pTuR5xZfbmucdx9aBti5diNp5oCpP1mu60mq7oPB8=";
+        hash = "sha256-OaDN+Qklxieo9xlP8qVeCwWzPBe6bLXoFUkMOFCoqPg=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
@@ -44,15 +44,15 @@ let
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-uyMcHV8dbCwKFQWy/s77KfEHKc+NiAq1X9Q0ih1ELLk=";
+        hash = "sha256-X9c5ruehxEd8FIdaQigiz7WGnh851BMqdo7Cz1wEb7Q=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-Fmh3EGjF3Xb2Vv39WEchrseo2t+4y1k+nLdb43GhJXI=";
+        hash = "sha256-/suI1rVJZE1z8wLfiD65p7IdBJsJnz8zX1A2xmMMDnc=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-N3OdQZiLpkkaxr4yTfszHPj9/zfeVlUup5r2GB8OCMg=";
+        hash = "sha256-/5jSp6dQiElzofpV7bRNPyUqRgq3Adzb8r40Nd8+Fn0=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
diff --git a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
index 26c11480272b..08adc6ff9b47 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
@@ -1,1193 +1,1193 @@
 {
-  version = "138.0.1";
+  version = "139.0";
   sources = [
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/af/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/af/thunderbird-139.0.tar.xz";
       locale = "af";
       arch = "linux-x86_64";
-      sha256 = "db0a833bd7e89dcf627aaca2a9ed27f4d6661ed755e69dc4a5c177bae24f9dc0";
+      sha256 = "84eca2a5194370d5af70f125000f479bbd7f19cce36d66f134f6fbe6b71dd2ad";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/ar/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/ar/thunderbird-139.0.tar.xz";
       locale = "ar";
       arch = "linux-x86_64";
-      sha256 = "775b9abca39f5a38f42508081bee10c680eab7226f14d0b4b47a24b8c6859593";
+      sha256 = "740956b16435fdf49ef73f98afffddc3c4c284d65abf4d4bb189c9b96d8d2da8";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/ast/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/ast/thunderbird-139.0.tar.xz";
       locale = "ast";
       arch = "linux-x86_64";
-      sha256 = "66481bfc9e9cefe3865b57dc021e25cecb6473ac39f114795be2808a2888304d";
+      sha256 = "a2d4538c039bd0cbdb2ae622578342ad95bd66cd085fb3652819fb29d11a804b";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/be/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/be/thunderbird-139.0.tar.xz";
       locale = "be";
       arch = "linux-x86_64";
-      sha256 = "479d8fc38b7d90b3927699e87433a1b53313e52aa552a02bb67d95dbefce2321";
+      sha256 = "3581659d0c64ee37a7d96788e6b199839b508d9019650ba76e3d1f5bbe823fca";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/bg/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/bg/thunderbird-139.0.tar.xz";
       locale = "bg";
       arch = "linux-x86_64";
-      sha256 = "c097bc1bcd38aeefc677409af611f46250ffbd1623a34f5ebb1e6d18ce46901d";
+      sha256 = "3acc2e43429f193cb863a9e3e50dc15ee8232b06431cdbd499fa1ca3b1f8f219";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/br/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/br/thunderbird-139.0.tar.xz";
       locale = "br";
       arch = "linux-x86_64";
-      sha256 = "0b974402095a491917a542fedfdf337686fab6d4b3df2a11741b918d6d3de9a1";
+      sha256 = "545f2d3d689579a64e3d544f3e2db970ac65e3789825e3dda07d2d5080bb3368";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/ca/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/ca/thunderbird-139.0.tar.xz";
       locale = "ca";
       arch = "linux-x86_64";
-      sha256 = "2fa6490081001048db2cafcfffa137a3faac7ab4fa5f8fab1b961ec3385f9127";
+      sha256 = "ea4da0f5d94de50ec09043ee6cc213ea6b9ee4545d52e9a4e8bf7715143e3b66";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/cak/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/cak/thunderbird-139.0.tar.xz";
       locale = "cak";
       arch = "linux-x86_64";
-      sha256 = "3e5671a1fac2f525f55cfca7b22dd54e6405e7798250534932ebb15dd7528281";
+      sha256 = "a46cec03536e2862ed7c409dc5cd757094d9ca25b2df1d276ae337ef819a9d7d";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/cs/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/cs/thunderbird-139.0.tar.xz";
       locale = "cs";
       arch = "linux-x86_64";
-      sha256 = "818be66330654c33dae58f6d12f964fcbd303087794e63d9882b24d27291cc95";
+      sha256 = "e3e85562e23dcfb250ac762af68469dd366d26566d8873d103c9f5700a2a9168";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/cy/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/cy/thunderbird-139.0.tar.xz";
       locale = "cy";
       arch = "linux-x86_64";
-      sha256 = "cc694a7830b02a99e44139d22645601e82c229493182a4f56c6de963ce44f460";
+      sha256 = "1f20853442d0e559436ba42a9eb4d3a7f3afd49717c0ae23f2df7b320563e926";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/da/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/da/thunderbird-139.0.tar.xz";
       locale = "da";
       arch = "linux-x86_64";
-      sha256 = "ba493c8f8090ff2d07e09e80e567004e6c75d4147e41994d2137978101f12ec5";
+      sha256 = "ac8b754794ae9846332dc7b23e24ca601af47a12212d83684a433ae3106bfb2e";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/de/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/de/thunderbird-139.0.tar.xz";
       locale = "de";
       arch = "linux-x86_64";
-      sha256 = "5dc96feca1b53e73b5c4a5c705a299f92be0f0d7bf97305c849639660adccb64";
+      sha256 = "355d5916ec358587e48da147777e9ff0095e1acb05bc5a5e6f5d0aa1d6f8be43";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/dsb/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/dsb/thunderbird-139.0.tar.xz";
       locale = "dsb";
       arch = "linux-x86_64";
-      sha256 = "eca7dd892230772da73825322d848d81bd689e3dee86424a1adbc41dd9150bd5";
+      sha256 = "57b7b6d9cc8c85a1f818b7be457bbcbe7c38b7c97304a54e136faa68fca8762e";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/el/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/el/thunderbird-139.0.tar.xz";
       locale = "el";
       arch = "linux-x86_64";
-      sha256 = "8a11983a86ec9a8733a3c33a8b3487a68d087dd1473f7e1b7025e2501303562d";
+      sha256 = "576dfffd856c453621d004a37c6a7da9ab64886bf7004fa9f7565ecf4b6c3c7e";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/en-CA/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/en-CA/thunderbird-139.0.tar.xz";
       locale = "en-CA";
       arch = "linux-x86_64";
-      sha256 = "79052f38101956280b2be5920eafc082a77250ceb680b2d576b8241271f1d553";
+      sha256 = "7225ce6dca0ed0fa03b8d1b964cd1cdd189dc2167276c12ff7b48f1909905159";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/en-GB/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/en-GB/thunderbird-139.0.tar.xz";
       locale = "en-GB";
       arch = "linux-x86_64";
-      sha256 = "b5c577b6ecf8f3db288cbc4a0dfdd5042545189a86a4e19cc8839c621efd3a7b";
+      sha256 = "d0862a511498c99d61e5c66398ca25cd71d6298d62954fc7626b27c9c0d63bb8";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/en-US/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/en-US/thunderbird-139.0.tar.xz";
       locale = "en-US";
       arch = "linux-x86_64";
-      sha256 = "e5c98a14416debd9c80df438ce5da71ab389f9ae4f0b4b7a7a7c53e105f475a3";
+      sha256 = "1f8514fb99dcb7bcfe12e290ca7e194f8b4b3d5c5ed246a16f4a283d2bddf691";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/es-AR/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/es-AR/thunderbird-139.0.tar.xz";
       locale = "es-AR";
       arch = "linux-x86_64";
-      sha256 = "1b75191c44eeaa0c7bc8dd4f3d74b2748b26adf6c84609e673f2511816240015";
+      sha256 = "6d0ad20cce34018487abd11a995d36d71a220ab8be4639048114d847712617d3";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/es-ES/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/es-ES/thunderbird-139.0.tar.xz";
       locale = "es-ES";
       arch = "linux-x86_64";
-      sha256 = "d4a80cae7aa734a2f3dd8345f28364ecd6053040f0e27d8b4191dd13b9ecb23a";
+      sha256 = "c7d950eb70fc92efbfcca9dba10cdde664715825a68dd6459e9e13fa746e6f32";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/es-MX/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/es-MX/thunderbird-139.0.tar.xz";
       locale = "es-MX";
       arch = "linux-x86_64";
-      sha256 = "4f0ccc9d0aaebc9948f516674de57b330482e32c213b17a913beaa6310f7ddb1";
+      sha256 = "e424d4db1417fdda36eea5974d67216bf57a8450a90948b7abcbf9e3f7073270";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/et/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/et/thunderbird-139.0.tar.xz";
       locale = "et";
       arch = "linux-x86_64";
-      sha256 = "9dd981bcaf090807b5e39e25620bc0e16f97343223d788f682e6ff17f36a3d4f";
+      sha256 = "7487d998475443c997dce5e5547b8cd76dc68fe2e6cc115eb2bbbe7a8ccbee70";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/eu/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/eu/thunderbird-139.0.tar.xz";
       locale = "eu";
       arch = "linux-x86_64";
-      sha256 = "187b407ab590ac5edf8be7057137a63f90db905fe99d21387680181e9a676e43";
+      sha256 = "ca41074f29861e8ef86c395029a7a57d0862687fa36bfb05ed60a724833443cc";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/fi/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/fi/thunderbird-139.0.tar.xz";
       locale = "fi";
       arch = "linux-x86_64";
-      sha256 = "86d41c0c869d2174d4960d27e891d4ea9358a4d49e43ecc458aa9678cd2b787b";
+      sha256 = "1e3869b73e836112091b729eac3da06aa172d511a2f3506f82d82d6e9db17d6c";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/fr/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/fr/thunderbird-139.0.tar.xz";
       locale = "fr";
       arch = "linux-x86_64";
-      sha256 = "c59e22fb1d68f6d152d7b11e8d8bd8e804c60426b76e45362dfb496a39000551";
+      sha256 = "5c3fea43f9dd66ef90595937d1d5b3fda420822d2a49691f79d2b3f578f8dba7";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/fy-NL/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/fy-NL/thunderbird-139.0.tar.xz";
       locale = "fy-NL";
       arch = "linux-x86_64";
-      sha256 = "dd8655d113338975ced5e247429419f59a1d0f08c980c74eb8cd074bb7503dfa";
+      sha256 = "910f9627e91feda9e1f98bf6348d708eb3f00574ea99ae0a30f32012b78c3b39";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/ga-IE/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/ga-IE/thunderbird-139.0.tar.xz";
       locale = "ga-IE";
       arch = "linux-x86_64";
-      sha256 = "9af1b23145e139752692f10ee86448a48dd1bde852c68eac800c17c9a7c8c2e3";
+      sha256 = "35607d66b02e47257d15cab48c54c087fc5b2b905e841f9944cfda33f255ee1b";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/gd/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/gd/thunderbird-139.0.tar.xz";
       locale = "gd";
       arch = "linux-x86_64";
-      sha256 = "45c4a6e3e70cf57770c09130d469a643e400992136d1e6b31b9d8c6abaf72ead";
+      sha256 = "bea781be5d94f901bbb5fe9e94e4176944d3041385fcb943da53c12245a88385";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/gl/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/gl/thunderbird-139.0.tar.xz";
       locale = "gl";
       arch = "linux-x86_64";
-      sha256 = "dc1707ecbba8f7c41aa5bea66d5c05a042bbeb43965fd61605b913850b107e9c";
+      sha256 = "a7309e0e2f3a91e31ce4ba9509fd54eb30ef42aaa82132b634ad509b8d1d0a4d";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/he/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/he/thunderbird-139.0.tar.xz";
       locale = "he";
       arch = "linux-x86_64";
-      sha256 = "d3c563a5a08b7da302070afcbf22b3b282fe04c24804ae20f3bab72e108724b1";
+      sha256 = "43365b9bf523a15808f300570c896c9e5bfa18e79c6a968636057dc70f71a67c";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/hr/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/hr/thunderbird-139.0.tar.xz";
       locale = "hr";
       arch = "linux-x86_64";
-      sha256 = "8432b563726859aae9b48cde72fe9052bd470b677503569f7b94b8099afb2d49";
+      sha256 = "bcc5879e8945bbb394f729d17f226fccdd10ed5e72ce9b1d2e40f32be4f53132";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/hsb/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/hsb/thunderbird-139.0.tar.xz";
       locale = "hsb";
       arch = "linux-x86_64";
-      sha256 = "ef81ff26964f54a6fbf0514eaa5daebcd9bdd14e1adfe760f97e63957ab4f79b";
+      sha256 = "b4e1c56febc88d1e826d1540e216d02095ebb6cef3f5e28bce77c0f076acf40b";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/hu/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/hu/thunderbird-139.0.tar.xz";
       locale = "hu";
       arch = "linux-x86_64";
-      sha256 = "eeb149d1f78476478dabec94d7cb52bd7231374356ee5921df367553a79a7146";
+      sha256 = "cba03b64d552da09345673dcd6242a2df5b20d887c6d88bdf7689eef8d305c62";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/hy-AM/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/hy-AM/thunderbird-139.0.tar.xz";
       locale = "hy-AM";
       arch = "linux-x86_64";
-      sha256 = "006f60bdbd72652fbb1001f647415035a77673b385b0e9e3543a22a5b9a99cfd";
+      sha256 = "235b500c2fe2e04efd174359bcea6fda17358aca7a43ddfeadfecff6406889f0";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/id/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/id/thunderbird-139.0.tar.xz";
       locale = "id";
       arch = "linux-x86_64";
-      sha256 = "9b31f9d2266fecf4fd2c07fbb50c978a64cf704a5ac5d31339972ab518df025b";
+      sha256 = "5c72b39ad88327245c0c6b6867f5d4fb11579a85fd251c5023750334d35da7d5";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/is/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/is/thunderbird-139.0.tar.xz";
       locale = "is";
       arch = "linux-x86_64";
-      sha256 = "8c1a612ecb43cb2785b4cf7f60a063da236363cd9cd08f353a78eacf934bdf4d";
+      sha256 = "8e7eb286fbf0015997c9dfb5c97950f4d424b8f48b6c21e93a7d836e121e005f";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/it/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/it/thunderbird-139.0.tar.xz";
       locale = "it";
       arch = "linux-x86_64";
-      sha256 = "8f5144673ba515ca85fa6eb137f593cefe5b31ada7a7413938890a949252a4c9";
+      sha256 = "ad0cff4824e242de98853271b992fb5195327cb20fc792509bcd7ab8aee860dd";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/ja/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/ja/thunderbird-139.0.tar.xz";
       locale = "ja";
       arch = "linux-x86_64";
-      sha256 = "1770106e37a0e02ae38f728c906dc81895dd6842c3e22399d1b5f7fed80cdef9";
+      sha256 = "c16a82cfdec8d41fae86eafd0671a9cec6aac0e5916cfc7ef920ae143ac22e16";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/ka/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/ka/thunderbird-139.0.tar.xz";
       locale = "ka";
       arch = "linux-x86_64";
-      sha256 = "78c156ba92139ac3e9a56db05f21a32b27600aed08981108c71e3a2a3c0bde6b";
+      sha256 = "0497c237996d343a3526de8343802bc1a32bed9db0e6f1c2e26736d9a48a867c";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/kab/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/kab/thunderbird-139.0.tar.xz";
       locale = "kab";
       arch = "linux-x86_64";
-      sha256 = "74678a0d449fe58328c3fad25596072cb06d1148cc66bb97cd43aeef38528204";
+      sha256 = "768e6a5732030fcc9603a0e21a47c87a3c4b994c991aa6c2c8d5ab83033bc692";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/kk/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/kk/thunderbird-139.0.tar.xz";
       locale = "kk";
       arch = "linux-x86_64";
-      sha256 = "10321de8b1609f8acdb271329847666e79aeaa830fd16f1bccf64be3fbd26dee";
+      sha256 = "97644e44c041cc6fb46bba7031d22b1f4f7d2aeb5c1e5d3dc0bd6a357f2243ea";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/ko/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/ko/thunderbird-139.0.tar.xz";
       locale = "ko";
       arch = "linux-x86_64";
-      sha256 = "b6a457343b31ada9c59a8a17eb477fe01ebe56a49b4ab986653578c2ddc3da01";
+      sha256 = "c04f654a0fb7d1bfb1d9d5ad84692b3834aa74ff7e506ee9f5e2f3b43026897f";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/lt/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/lt/thunderbird-139.0.tar.xz";
       locale = "lt";
       arch = "linux-x86_64";
-      sha256 = "116035a5d42b54f8865af476eee059e7d9abaf3e41f7ab52f02cca1a15a172f5";
+      sha256 = "b574c7f9048f4f32fd1144ecd581c4663d590ee4f480b5c03cbb214570a7cb9d";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/lv/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/lv/thunderbird-139.0.tar.xz";
       locale = "lv";
       arch = "linux-x86_64";
-      sha256 = "b3e38dc0da3c0833db054a754fb439189567acc16f642960af3b082c9179069b";
+      sha256 = "2db4ef87a14b1a50419aaefa26dab86b223aef43f9ccf8f9fe841d4c5d53ce54";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/ms/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/ms/thunderbird-139.0.tar.xz";
       locale = "ms";
       arch = "linux-x86_64";
-      sha256 = "64465e3cb59dcdcf4c7b56c9b926f443878e25326fc0dc74116d9abe9af9ef25";
+      sha256 = "c4ba0e0014eeffcaee21ecd922e3cb2490425d15eaeb3eb61a6245106fa37e08";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/nb-NO/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/nb-NO/thunderbird-139.0.tar.xz";
       locale = "nb-NO";
       arch = "linux-x86_64";
-      sha256 = "eeeb6164e4dd9273b8f1fc1c5ba1e5c303448d6c08ff0496db1402e7df51cecf";
+      sha256 = "f816eece9ab39146c93f0c662f352d263b51e62b21b10deb9278a90df67c842c";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/nl/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/nl/thunderbird-139.0.tar.xz";
       locale = "nl";
       arch = "linux-x86_64";
-      sha256 = "fe05f8fac31904e93338a56ed960982b987d99c6fcf81dd3e9793c697c9b32fa";
+      sha256 = "a023abfc21d9666e65df50d2465b6998854034503a48fa617c28f2c9535a9f28";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/nn-NO/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/nn-NO/thunderbird-139.0.tar.xz";
       locale = "nn-NO";
       arch = "linux-x86_64";
-      sha256 = "b4a5fa5632cc73fa8816c2dddf55a0c76ccd05b223965b8653516e2f007cf09b";
+      sha256 = "b4c2fe2fc8d0097e393bc0ee81668b4f19a4f507d7c2739a96d986e84facf604";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/pa-IN/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/pa-IN/thunderbird-139.0.tar.xz";
       locale = "pa-IN";
       arch = "linux-x86_64";
-      sha256 = "efa30ca09eae5bb522748b29909724bb6edaea8072af2a15dd46d661f7d46f87";
+      sha256 = "75a63fccd953f4520cd8792ee9cde95266014e5faeeb43620432a3483ce3db96";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/pl/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/pl/thunderbird-139.0.tar.xz";
       locale = "pl";
       arch = "linux-x86_64";
-      sha256 = "466958dcc8382a11d0b8ea73ab0cca0a00b7b50681096fcb68e097f4ec956605";
+      sha256 = "21fb95a23574db84da3103dbf3b3bc0aa046983fe0f11e582cf080967d9aaf48";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/pt-BR/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/pt-BR/thunderbird-139.0.tar.xz";
       locale = "pt-BR";
       arch = "linux-x86_64";
-      sha256 = "1682598d3af19c40546c8143e6b1b58e5359bf9540106ecaef35d5a7a06b15bd";
+      sha256 = "af3e1ee11930cffe57ecca9977b622da7ee525168229101d94d870a4e0f78372";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/pt-PT/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/pt-PT/thunderbird-139.0.tar.xz";
       locale = "pt-PT";
       arch = "linux-x86_64";
-      sha256 = "ed64a1da61ddcedbed536baaf97c176cf4a056fd6513951ab91060538978292f";
+      sha256 = "7882d929048e9b06af3699468e2db15b82af795b02767933c84c4a0514f220e3";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/rm/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/rm/thunderbird-139.0.tar.xz";
       locale = "rm";
       arch = "linux-x86_64";
-      sha256 = "06a27257ce8635a7828b47a98745697c4a55a206459aa9b242e7e73a8f2727bf";
+      sha256 = "f217b0696f1033f2af9417db6568a81a16fc76e1733e7bfb698c2a5741ca8795";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/ro/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/ro/thunderbird-139.0.tar.xz";
       locale = "ro";
       arch = "linux-x86_64";
-      sha256 = "d94d5adfcf899b015b8cd46ae2c5ae95730e61fe70b8520ba314ecaeeeba919a";
+      sha256 = "71568029deccda0357faa339b6d843cb9d07e369923297896d4be2cfd981cf8c";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/ru/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/ru/thunderbird-139.0.tar.xz";
       locale = "ru";
       arch = "linux-x86_64";
-      sha256 = "e1e494b8de2d7756773fedecfe91d59c34cc6963c98a46f38c44f21dc59309d9";
+      sha256 = "d0950d2d9cd58d8e4af6d158218b1b4d613081edab2117f4d245d15efe23ba85";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/sk/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/sk/thunderbird-139.0.tar.xz";
       locale = "sk";
       arch = "linux-x86_64";
-      sha256 = "5bf96757eed943df474353feade2d2a7bf17d619f23331ab9e5983d6d049c2ea";
+      sha256 = "a844c9711775d72e7710ee9c45469037be60c1e2c431948b38b3c82e54184520";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/sl/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/sl/thunderbird-139.0.tar.xz";
       locale = "sl";
       arch = "linux-x86_64";
-      sha256 = "04c62c0f1e14d62ca77be2832952f864a752cf430c0c5b00c0c0db8e6ea55c78";
+      sha256 = "44d549a4b483201616b73c1b8cd9303d93d826535e6fb249f38f65b47d7b7373";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/sq/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/sq/thunderbird-139.0.tar.xz";
       locale = "sq";
       arch = "linux-x86_64";
-      sha256 = "8070a7238d820f2ce8f645845f43a3817c1f9064ddc4e9cc5c26324e8edaf56e";
+      sha256 = "58841c4cd7ed509306dbb887f747ab99a108ab702367f1a7315c2c3fc68d1d5c";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/sr/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/sr/thunderbird-139.0.tar.xz";
       locale = "sr";
       arch = "linux-x86_64";
-      sha256 = "af63eddbbc5db5e88062c1610482bcac520d84d11dcdfeccf39d925b975873a2";
+      sha256 = "fe49124005cbb8e7448e2a2bc136f2128d7db08a73b16d106c0318e84389b9fe";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/sv-SE/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/sv-SE/thunderbird-139.0.tar.xz";
       locale = "sv-SE";
       arch = "linux-x86_64";
-      sha256 = "c0a8624eb183e23afb340c72e10585439a73393d553125917fec8bbf373568b7";
+      sha256 = "92e30e054c660ccb19be54e0a877abc2ba10367575ce37c2f877d46481edf9a4";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/th/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/th/thunderbird-139.0.tar.xz";
       locale = "th";
       arch = "linux-x86_64";
-      sha256 = "2759a85d183d2e3543aa7553f3be5db4cafc20ae308c237a24ec6e880b3e849c";
+      sha256 = "d9d4ce5c403865b554f899419cf1606896226857fc811d5002084196ba0afbee";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/tr/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/tr/thunderbird-139.0.tar.xz";
       locale = "tr";
       arch = "linux-x86_64";
-      sha256 = "64ed929bcdb833b0f4503e8b18e0f3983dcbed9974e64e99de3280899c0f9873";
+      sha256 = "688e13ed1e9d7f97b1861d51c6fe0e8003e034c6feb391386cb43593ba19ddc7";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/uk/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/uk/thunderbird-139.0.tar.xz";
       locale = "uk";
       arch = "linux-x86_64";
-      sha256 = "d0a827e29dd6ea28c7da1e239189d4803c173aafe35ada6cf8519d7a970fb2d3";
+      sha256 = "6a57e4c60b6c75258eaf856c4d680f7e60c4e97908740e7becfa8246e07dab59";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/uz/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/uz/thunderbird-139.0.tar.xz";
       locale = "uz";
       arch = "linux-x86_64";
-      sha256 = "6c2012f2bea9869b96e900d5bb26fc55b7927f5d096029ff209a998adb5bbc11";
+      sha256 = "2eb9707fd675dbecba020a384d52381418642e818693a719d57a2b3a46233ab4";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/vi/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/vi/thunderbird-139.0.tar.xz";
       locale = "vi";
       arch = "linux-x86_64";
-      sha256 = "6d9661ab3aea6472c327ad5ab2627ceb6beb67d92b91c21698d3ee22f54724a8";
+      sha256 = "3d8062756bb67088f492c63abae0196434f1f93bafd42fd6ba31902348a41e13";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/zh-CN/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/zh-CN/thunderbird-139.0.tar.xz";
       locale = "zh-CN";
       arch = "linux-x86_64";
-      sha256 = "418ec9e56842c77071f3685a2ae73136596e93a22c5fd875f5534f5ac672c0f5";
+      sha256 = "43f63eabe89b1eeadb7c6e96f9cfaa9ea1f7a0efc4822ba4322117fd6b489390";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-x86_64/zh-TW/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-x86_64/zh-TW/thunderbird-139.0.tar.xz";
       locale = "zh-TW";
       arch = "linux-x86_64";
-      sha256 = "c0cf4be622372833ab3f9d51ecef1e7d772145be502b7d9a97cb56d9b97f1c6f";
+      sha256 = "23d15794e5ad9d0a656e627b3b480411f22433eb0954ade97a9b6f4327fbec49";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/af/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/af/thunderbird-139.0.tar.xz";
       locale = "af";
       arch = "linux-i686";
-      sha256 = "e2c47db628d68d639268849d68213d82a062ec82eec7a2e0b07c9e12f6482214";
+      sha256 = "e6df1b5ed2b0f4683228f4c5bc39242b8a9cf5b8a0a250abbbcbb1a78fb88321";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/ar/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/ar/thunderbird-139.0.tar.xz";
       locale = "ar";
       arch = "linux-i686";
-      sha256 = "793861fbdd418f1632c199f58e3cfe703d0354b0fcc4a8ded4a61b9793ddab7a";
+      sha256 = "14137218644380f9e67a053d61e619767359a8bac3b4036562967aa5e3d5e3de";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/ast/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/ast/thunderbird-139.0.tar.xz";
       locale = "ast";
       arch = "linux-i686";
-      sha256 = "a66b5113959b41455166555b4da22e2b30984cf8026102ebc25c10dcfec5115f";
+      sha256 = "c6c90de75261b2fe7043129321cd7b0c5c30bda8d286f9cb01d6e9d4f74970a8";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/be/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/be/thunderbird-139.0.tar.xz";
       locale = "be";
       arch = "linux-i686";
-      sha256 = "d72c9847333d8948c7b5d8e881329145791a6b5c363bd45731e9972a4aff93a2";
+      sha256 = "ee48b4bcc87601b3e780643eb9352714ba0ac1ab0f554fc90cdaad57555b0863";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/bg/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/bg/thunderbird-139.0.tar.xz";
       locale = "bg";
       arch = "linux-i686";
-      sha256 = "88fea655659504e54f74aa17e9bc4dd40d29f2f697c98fae0b68c77ddb39a4a2";
+      sha256 = "3f76f7db424cd350a0ec3cf0b26305c9805d1559069fab1c656b4f52d983e378";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/br/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/br/thunderbird-139.0.tar.xz";
       locale = "br";
       arch = "linux-i686";
-      sha256 = "996442f38fc3a2de497cb25fc91d10f2568298e39240ae93a04522515c93af55";
+      sha256 = "618b0da481e6c356fda6b0536dd84c11dcf0a2c73ef7dd9a015683a94bb34751";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/ca/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/ca/thunderbird-139.0.tar.xz";
       locale = "ca";
       arch = "linux-i686";
-      sha256 = "7935dc9fa50fa7ad994c376175f468a6d74e8618de6801380b8394671043b6f5";
+      sha256 = "3d0879a9be2091a4f72254826624203e2e7d3b3c1bea5ec9a74cb89e3c390654";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/cak/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/cak/thunderbird-139.0.tar.xz";
       locale = "cak";
       arch = "linux-i686";
-      sha256 = "d0ba74c8fc5a8f301368a38938c46a8676732dc45dab7c4868363e1340ebca75";
+      sha256 = "fad8eaf3dccf8e50c514118e1dc091a6e19c59dd4c2042ada163cedae0c40858";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/cs/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/cs/thunderbird-139.0.tar.xz";
       locale = "cs";
       arch = "linux-i686";
-      sha256 = "4c70ca2c6e16042f1eb4fef918c43bf389b39447f31b5fee713fbfed99cf7a0f";
+      sha256 = "ddc92e4d02b1efa457c94bd13014c434ca74a15cebe25f194e7567309d2ec7da";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/cy/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/cy/thunderbird-139.0.tar.xz";
       locale = "cy";
       arch = "linux-i686";
-      sha256 = "c62154e97241623738b87bca3cb2408f6f0364d0cedf66cb3621590d4593ffe7";
+      sha256 = "2b9fc5863f4211e2f7ad99b5fffef97e931068ea4ab2c0df456482372b7ef80f";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/da/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/da/thunderbird-139.0.tar.xz";
       locale = "da";
       arch = "linux-i686";
-      sha256 = "fba811be171677ae1c3df18ca44455b2c970f0bfc08e354ad57e7d23694df7e5";
+      sha256 = "4f37515f68731ad67f5b6961cf9751f6be7da6f60c317d06486999bec2ad36b0";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/de/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/de/thunderbird-139.0.tar.xz";
       locale = "de";
       arch = "linux-i686";
-      sha256 = "f5caddbc7e9ac83590a73dc14496afa1e878d386aac331854c04bb6032587a8e";
+      sha256 = "cd4040c698090036415a80cb170a648b326e4e174df79d57b691ca001ead820a";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/dsb/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/dsb/thunderbird-139.0.tar.xz";
       locale = "dsb";
       arch = "linux-i686";
-      sha256 = "c97031a8a6cae87dc6bc2e4dca932a88a9a23c82d997614231e2010ec0f17467";
+      sha256 = "cc1e46beb5cdbd2108cc08be2ddffae0a624297220aff479fe09d67ed1a493c3";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/el/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/el/thunderbird-139.0.tar.xz";
       locale = "el";
       arch = "linux-i686";
-      sha256 = "ab14f412fe36e1cd6960c263d2c474ea80c7f7639b93d040834210dbf997c81c";
+      sha256 = "5b6f1d105c67fa6229c75023fa318a7ba1c7d76d6da82c12f57d32694e118ea7";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/en-CA/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/en-CA/thunderbird-139.0.tar.xz";
       locale = "en-CA";
       arch = "linux-i686";
-      sha256 = "a6f70738aeb1202f1e0b88555de146d03feac763399d20fabd5f8892ee5dedfa";
+      sha256 = "f1511ed4b4f441b1c6f339eab3e5fa2664de05c569f069740204acc758823057";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/en-GB/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/en-GB/thunderbird-139.0.tar.xz";
       locale = "en-GB";
       arch = "linux-i686";
-      sha256 = "77320c069210f578fd27f5a6cca9ca378bb1ede004ec462740a4f91d475e8b7b";
+      sha256 = "ed758c43c9fbe6a95cc4d08748374270a0c3f4109d076e7eae7de91d95168c21";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/en-US/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/en-US/thunderbird-139.0.tar.xz";
       locale = "en-US";
       arch = "linux-i686";
-      sha256 = "06ea548b598fe695a0ace46caeeb8411acf9ec0fb2b884c9127f486a85459bd9";
+      sha256 = "cb3e8bc577d6ebcea0222ea712cd3e5f086bce72f8567444722ff1f17c8d469c";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/es-AR/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/es-AR/thunderbird-139.0.tar.xz";
       locale = "es-AR";
       arch = "linux-i686";
-      sha256 = "3dfb2bbdf56ccaffe8622cfad900c093256ef27449ed34d34493b695cf5af94e";
+      sha256 = "4c5d67e60326b1eec69d6cf302863d7f521e8c471f7426c97bba404dd3bbec46";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/es-ES/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/es-ES/thunderbird-139.0.tar.xz";
       locale = "es-ES";
       arch = "linux-i686";
-      sha256 = "e1449a696809c7dc71f99cfb13b2eacc0b53d5d341f6446e0d73c1005cada388";
+      sha256 = "76d75d7b97815d5acb6a42592a219d5528ee83675c4acd888a1e5d98964545dc";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/es-MX/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/es-MX/thunderbird-139.0.tar.xz";
       locale = "es-MX";
       arch = "linux-i686";
-      sha256 = "3cc0e3fe2d6aae3ff4c4923c1a7c18a3cdecbd719d0376a75b321e9e4ae0a5c5";
+      sha256 = "eae45d64869521bad908af05cd595ce5a05c6c53f4d0019c5e8228883c8b907d";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/et/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/et/thunderbird-139.0.tar.xz";
       locale = "et";
       arch = "linux-i686";
-      sha256 = "46a28361d44aaf719c4c894459e32440caa4de49f5d5a002dbb8654aefa1abad";
+      sha256 = "d3b0488a56623e0cc1f156b8a825d21c85ae265ced3bc4a9337a13b2c66c2718";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/eu/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/eu/thunderbird-139.0.tar.xz";
       locale = "eu";
       arch = "linux-i686";
-      sha256 = "7dc8e38d9f9d7feb73413615372acc033935d486bc77e54cfa93550d4de14a82";
+      sha256 = "fff16b5a11f5e959dc5c3b731a9c2e57ac1e8c116ffd1c44f2eb83eb0269c2b3";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/fi/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/fi/thunderbird-139.0.tar.xz";
       locale = "fi";
       arch = "linux-i686";
-      sha256 = "ad0ac62d302c1391b61fbcdfe1a98b8b79c654b7f292b94586c807d13afbc6e5";
+      sha256 = "f45c4c5c8f26e747ef996fee9ff84a1417dcf270c6f2cf66ec6619d6c41a2e18";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/fr/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/fr/thunderbird-139.0.tar.xz";
       locale = "fr";
       arch = "linux-i686";
-      sha256 = "39b7df4c5dff1cc5123957d4510026d913316508cb04d8309f845cbb98e99f1e";
+      sha256 = "3a832ef894712cc5b6ba874e58545aeb9bb7a60360ef27c544ad624b2a6edb3f";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/fy-NL/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/fy-NL/thunderbird-139.0.tar.xz";
       locale = "fy-NL";
       arch = "linux-i686";
-      sha256 = "c8b232c1177c68969dfd256b6fbcf26d976c45251147c47a46293bc56ca89ed1";
+      sha256 = "0252215a25fbe2f87042c6a0010de1e50336c4851e8c388bddd632a32b625898";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/ga-IE/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/ga-IE/thunderbird-139.0.tar.xz";
       locale = "ga-IE";
       arch = "linux-i686";
-      sha256 = "afb5d8dc4afd2888d1ce55cbfaa68c022d652e419966e01e4fd7d0078abff3e2";
+      sha256 = "01e66dbb8dad8e7dbf83985e9eae32a0ae4abe453a6e15548d813b9c2ce7ce79";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/gd/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/gd/thunderbird-139.0.tar.xz";
       locale = "gd";
       arch = "linux-i686";
-      sha256 = "08bbc41f7a2acf01bd89d57a91681403aad36793908a43aa6fed3875e00e6920";
+      sha256 = "6a40f905994a5ccbe958143ac55fb2b03b2f0046751eab8e1621d67b4b472ae4";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/gl/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/gl/thunderbird-139.0.tar.xz";
       locale = "gl";
       arch = "linux-i686";
-      sha256 = "2cf7142ff9fd6a783fa4af4d5ed89045ef803b5a7a37d114baad59807734c027";
+      sha256 = "4ab320599ca299326037e78a730fc37d446c1a5f00aa9cea1743138596f13fee";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/he/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/he/thunderbird-139.0.tar.xz";
       locale = "he";
       arch = "linux-i686";
-      sha256 = "5ef3cea0112d39d12ccccfc01b528b3a4247d40bcf8d8984c194d94ac7c16060";
+      sha256 = "1480bf2b6aa48f3419ac95df3d6eb73637e4c920f0380bc0d531224de6c8bef0";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/hr/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/hr/thunderbird-139.0.tar.xz";
       locale = "hr";
       arch = "linux-i686";
-      sha256 = "59a172bf3adde06e4ca8e4a28924fe945e99662df6dc7b8f6644759ac0e8965b";
+      sha256 = "65a667c812826affe4d7734dbea4c5a0fb2ec6e24315545a5339240430d38c1b";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/hsb/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/hsb/thunderbird-139.0.tar.xz";
       locale = "hsb";
       arch = "linux-i686";
-      sha256 = "4a4f9ad2ecdc0c9012d433e4f2932b0606e6670cd064847fa00d8f2ca8ec496c";
+      sha256 = "836e26d55a4a58beb5a26650f910e2e522d6fa2b98a3645d3514496d5cbccabe";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/hu/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/hu/thunderbird-139.0.tar.xz";
       locale = "hu";
       arch = "linux-i686";
-      sha256 = "7847b8aca04fee6ba436670e62c16b5487336127bdb6bf2a26922b1416279586";
+      sha256 = "f5347366588703bf3f98441db56431b4a1903b38cd349ec53be6503a42ac990e";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/hy-AM/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/hy-AM/thunderbird-139.0.tar.xz";
       locale = "hy-AM";
       arch = "linux-i686";
-      sha256 = "9f8a01e15323079187b5b4c59665bb1a1458afb39a81ffc0be9cd5af9a60da51";
+      sha256 = "9a9ae5c9bafb90fc22aaf6c3ae22e58eeb0237d1d48c253046a723e993b21591";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/id/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/id/thunderbird-139.0.tar.xz";
       locale = "id";
       arch = "linux-i686";
-      sha256 = "9cfcd3a5ccc5c4a91e9df3b598918ab31edad8d7e87277a57852939daeedfe1b";
+      sha256 = "0b720169f6fbf34dd8866b6f08669338af02b064461244e73dc02e2d47b540be";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/is/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/is/thunderbird-139.0.tar.xz";
       locale = "is";
       arch = "linux-i686";
-      sha256 = "9a935f74deb5eec502800c3e154d7a093c7eb1119a39ac8f0e49e8b9359b0bf7";
+      sha256 = "b4e032102c3f066d7168d80823c4acd8a723a1efc2d54fcb627e47b27836b8c7";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/it/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/it/thunderbird-139.0.tar.xz";
       locale = "it";
       arch = "linux-i686";
-      sha256 = "7f7b01bfad09ad5380af4a35b4f83dd4f43150aaeea5d40a61fc019c5db70a58";
+      sha256 = "c80fa59aaf1d5ad7ce9ff12733e4ecc2fb3740e8aa8fa68e57c5cc275a84a0ba";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/ja/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/ja/thunderbird-139.0.tar.xz";
       locale = "ja";
       arch = "linux-i686";
-      sha256 = "d84f431eab26f51e49c2dd7fe5150fe6398aa08363faa7cb1fbd5ed442468536";
+      sha256 = "dba5e61bf92c5e1de64dd53cd768cc3d4f8621d0efd8104a068f9022dd40fd08";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/ka/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/ka/thunderbird-139.0.tar.xz";
       locale = "ka";
       arch = "linux-i686";
-      sha256 = "bfe0e4d68c8c79ff86fe1f48b37adb54fd68edb84ab75ee2c840687ceacb2ce6";
+      sha256 = "0284d175b41c074ba864a035dd31765bd7593c0d8524d468f20ed43115f60d92";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/kab/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/kab/thunderbird-139.0.tar.xz";
       locale = "kab";
       arch = "linux-i686";
-      sha256 = "d53199af37f8fb6b0b1f28b1159500be226fe07f040cb99d9ac484807abb7cad";
+      sha256 = "b0f1741667b9a3ca0cf6122e043361763401d6351e9c53679ee5ff3ce4a92d13";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/kk/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/kk/thunderbird-139.0.tar.xz";
       locale = "kk";
       arch = "linux-i686";
-      sha256 = "5b9082954c5fc81d58415883e3d1cbf598e4e048fab78a153f10304789aeb4e3";
+      sha256 = "1e9b291160b8a901955ca830c37927c4c07115ad6afc503bcfbf76eee8d1a77e";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/ko/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/ko/thunderbird-139.0.tar.xz";
       locale = "ko";
       arch = "linux-i686";
-      sha256 = "7560daed426c866f6e08dc6d799341dc390de391e26e12fe7b9aed5c4fa3b175";
+      sha256 = "d376f06222f27eab6d50b91c36e06fec09efbe75479c4e0461b5f9b9344a76ab";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/lt/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/lt/thunderbird-139.0.tar.xz";
       locale = "lt";
       arch = "linux-i686";
-      sha256 = "1c537135a2b6fa170a396e640f4a52d654095f790a4846ebb78115a8a0594429";
+      sha256 = "24523eae3d11246032dfda9bdf3416aa5fab19332cd30d64ef631ee8837af8ea";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/lv/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/lv/thunderbird-139.0.tar.xz";
       locale = "lv";
       arch = "linux-i686";
-      sha256 = "f8d2233a7d992e2bbc6da2f903dd64a67ffbf6af472421fb7ff55c5b298b6178";
+      sha256 = "69a290d9fd1b227f007d6154868fb73ed0099704c0238ec11f560126dca6aedc";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/ms/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/ms/thunderbird-139.0.tar.xz";
       locale = "ms";
       arch = "linux-i686";
-      sha256 = "71a0e722f0b0f00d62ed301517c4e06a868a3d2db6c3edc42c999f2b1a9f1552";
+      sha256 = "7bfd003d7ce6966bf2d61703ff986d7d22dd2fdcff975b0bff2bb995deca21e2";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/nb-NO/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/nb-NO/thunderbird-139.0.tar.xz";
       locale = "nb-NO";
       arch = "linux-i686";
-      sha256 = "3eb35e25aaf92496947b2c719f414d0b1e5f708884213e380eafc291c5cfa0e8";
+      sha256 = "55adb9926dca7153895c3dfe4758bce54ae6930f1bf81af1bd71f718b7bcf064";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/nl/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/nl/thunderbird-139.0.tar.xz";
       locale = "nl";
       arch = "linux-i686";
-      sha256 = "bca190672fcb0fc3ea95e3cb4e011d102ea80ccaea74099a726704cd9e3cf794";
+      sha256 = "bb9486fff0daf01972b63fe12b53828bc27c1bf9a617b3fc3d34e67458fe0d4f";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/nn-NO/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/nn-NO/thunderbird-139.0.tar.xz";
       locale = "nn-NO";
       arch = "linux-i686";
-      sha256 = "4403a003a05d4677e8de524532f93eb4ea2202d915527cc30961197be4e6ad35";
+      sha256 = "34da26b4048a0942ea13225fdf427ad16c86508812c3fc5e6aec44f78323dba9";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/pa-IN/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/pa-IN/thunderbird-139.0.tar.xz";
       locale = "pa-IN";
       arch = "linux-i686";
-      sha256 = "ce7bd32e48e1b77fda60ddbfc21ad13adbaed94fad9b6135139b3e03421f3076";
+      sha256 = "9816726ab770efe86cc826df157174df695021bf51f1966115337238dc0298cf";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/pl/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/pl/thunderbird-139.0.tar.xz";
       locale = "pl";
       arch = "linux-i686";
-      sha256 = "87da5768d12cd03ef87f48d0b6a8838827324a4d5dbbfc6a0fd9025b602ce9e5";
+      sha256 = "a22df85fb46cf0ab9453bc4785656ebc791c96940231726622bfb0147d350785";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/pt-BR/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/pt-BR/thunderbird-139.0.tar.xz";
       locale = "pt-BR";
       arch = "linux-i686";
-      sha256 = "4b9039b2a6e26eb42bd6b1938a5ff1e45eb6dac9571030c7587bf9a7740e237b";
+      sha256 = "8fcb3cf417fcb53db3c4a3b69dc84b55a683f2718c233c2d845baa2495b93605";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/pt-PT/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/pt-PT/thunderbird-139.0.tar.xz";
       locale = "pt-PT";
       arch = "linux-i686";
-      sha256 = "5ee608b291985adf2db7d19b03a9fc6843bfca555947607c9ac17b267c54b40b";
+      sha256 = "b560c4e55cc27aa479ff8625d6b821b070a292bfd175cb15c0b7c6ff222d6e80";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/rm/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/rm/thunderbird-139.0.tar.xz";
       locale = "rm";
       arch = "linux-i686";
-      sha256 = "3a6938191b9f1d02a70aea6a681a3c93099715534f156f774ff6518a1a424b15";
+      sha256 = "582d287e7b294be741bcae607ab92acc33972470188a79d35a6a342331d2af10";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/ro/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/ro/thunderbird-139.0.tar.xz";
       locale = "ro";
       arch = "linux-i686";
-      sha256 = "d8fc232f93b38dde2bd1db9b183bfd420c992db19ab536f1eed8bbf9fec02e4f";
+      sha256 = "141ffe063241c269782dab044e7e846a47964da6f56090a76a4989e8df3aa328";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/ru/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/ru/thunderbird-139.0.tar.xz";
       locale = "ru";
       arch = "linux-i686";
-      sha256 = "ad1ae9629cb9aeced56094d3bc550633ea2105b9ca962655029c2ae3aa5a1166";
+      sha256 = "7e15e6e55347b42077bfd9c9969132bd9996922303d77a33e8378567006c4fe1";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/sk/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/sk/thunderbird-139.0.tar.xz";
       locale = "sk";
       arch = "linux-i686";
-      sha256 = "4e2c8cc1470ecae57ea82c16b0d738410941b1f559f0dc2e6dacc7ac85129265";
+      sha256 = "02aca9611988eaf7a953f7ea47ea2384d4363c1f9084554267aa642369b501c1";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/sl/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/sl/thunderbird-139.0.tar.xz";
       locale = "sl";
       arch = "linux-i686";
-      sha256 = "ca1f072f1466245dc31e0f79a7d8e30dddbc0a98f49e811e9f842a8869677c4e";
+      sha256 = "e5c1aa1838e39862efa394d98d8b37f593671439ea5c9c18956bbbcf4b55f15e";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/sq/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/sq/thunderbird-139.0.tar.xz";
       locale = "sq";
       arch = "linux-i686";
-      sha256 = "716aa9e5d31d3108511ea5a48e8eacddf822a9cae75d0e866a342b219db71e91";
+      sha256 = "835dda20f6b4980ff2d52b49798fc7efb8467bbeb813c5c3f8fc30c150e432c1";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/sr/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/sr/thunderbird-139.0.tar.xz";
       locale = "sr";
       arch = "linux-i686";
-      sha256 = "be595fe3d06377e99841cb60e0bbb7914ef17b127c9723c5d6e09b18b1f8f08f";
+      sha256 = "5ea1613af7f48a427d57090b39ff14866143c9902e327e77904051360b8ba583";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/sv-SE/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/sv-SE/thunderbird-139.0.tar.xz";
       locale = "sv-SE";
       arch = "linux-i686";
-      sha256 = "876755afdc57e49c0d482ab6bcc7794a53cac87d81122727d3a03cd65b8589bf";
+      sha256 = "4973656b71e5efd38ff9d9a3acaa68a6dc4fed01b5bdb1ec56d2a4ce1961e268";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/th/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/th/thunderbird-139.0.tar.xz";
       locale = "th";
       arch = "linux-i686";
-      sha256 = "b91110dc6eaeeca1067568e37b278fc99d58430663b7890e9d4c32ad39878059";
+      sha256 = "3305793dc3c1dab070e5b4eeefbc9c86725f9555741fbed592f92287214d5b3a";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/tr/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/tr/thunderbird-139.0.tar.xz";
       locale = "tr";
       arch = "linux-i686";
-      sha256 = "05f8ed78d2395f33f6ae960319e2c7ffd1b828464b5412d7c297faa393a92920";
+      sha256 = "cf1537022ae7d25bfe943736ced0160b83678a993e58c1c0654718db70db7369";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/uk/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/uk/thunderbird-139.0.tar.xz";
       locale = "uk";
       arch = "linux-i686";
-      sha256 = "699174466c46f3b3c5b9864744ab65749c722753f328bb7eca5382d245c1dfc8";
+      sha256 = "e34a9ff79d458fc8fe1eb6b62acfcf20d3ae0746076f221d3abf1e2f33b63a45";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/uz/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/uz/thunderbird-139.0.tar.xz";
       locale = "uz";
       arch = "linux-i686";
-      sha256 = "78ca18f5d3be3a5a97b81761acca219b810c1aef0f44b60821459cb30c933bef";
+      sha256 = "0730b7af5c94498a6096f5d3106cc70c09d16e9b1ac21a3bcbd6a48d071f5c03";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/vi/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/vi/thunderbird-139.0.tar.xz";
       locale = "vi";
       arch = "linux-i686";
-      sha256 = "171b681fb7ebac8d4e0ec46617c8cc8898241852ade34803590762cf6ebc2b66";
+      sha256 = "734729613deaa930e85bf595f329f81f096da247bf3c6f6203bd56e5551bb0c8";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/zh-CN/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/zh-CN/thunderbird-139.0.tar.xz";
       locale = "zh-CN";
       arch = "linux-i686";
-      sha256 = "8c13808ff6a74a7208276cbb3e4894dc443b502280532eff0aee54a692945f85";
+      sha256 = "904ccfbb390e6e52bc1258e4bf11210ea8fe28f611437d12e7b92d9ae5d0fe1d";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/linux-i686/zh-TW/thunderbird-138.0.1.tar.xz";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/linux-i686/zh-TW/thunderbird-139.0.tar.xz";
       locale = "zh-TW";
       arch = "linux-i686";
-      sha256 = "d305e97b01698f51b596a78578a72b92230a03af4b86d87aea9e361e422d95d6";
+      sha256 = "34382b81709683099227e2654edcd7cd836a998dd36342f2e37ee07bd1fc29e0";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/af/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/af/Thunderbird%20139.0.dmg";
       locale = "af";
       arch = "mac";
-      sha256 = "f39e2dcbaf48ed142a7ce075a6a12dd4b58942e56aa5023d3e62763ec46c5701";
+      sha256 = "8839a216be481b6430cc42d88e49d4a6d8eefb400599493bf41ed4724ce041c1";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/ar/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/ar/Thunderbird%20139.0.dmg";
       locale = "ar";
       arch = "mac";
-      sha256 = "75d67a02c58f580f8b49a7979d40fcd7c4e82f431dd51d31a3c08dc062b54d46";
+      sha256 = "62598cb9fa7396d4288e9f3f41e6b24b439d7fe2ba02f05b3c470f53f29099f9";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/ast/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/ast/Thunderbird%20139.0.dmg";
       locale = "ast";
       arch = "mac";
-      sha256 = "4bfac15cea5864b3d1d7f4fb2caa26ae5a8244f17f33fb7042dd9847db61e287";
+      sha256 = "9c086ae45194409c8a08ad420118c33f501f6989d0056a42df38e97934e693d7";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/be/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/be/Thunderbird%20139.0.dmg";
       locale = "be";
       arch = "mac";
-      sha256 = "9a40aa547eb32c3792651f25dd101efca3d29f4bf17cefa0dbf03a505a7d5de8";
+      sha256 = "a36623cb54965e718e070453219b2e3ab019c97b22588ffcf2f02ae018aeaaf4";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/bg/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/bg/Thunderbird%20139.0.dmg";
       locale = "bg";
       arch = "mac";
-      sha256 = "0d546959e3f889b7c8a80d4b3a00c9d6f2f30cd1fedfc4a9f217835f6b676350";
+      sha256 = "8267b91946df77a974f1d3917beaf68b34bc949fa3cd6331b0be918ecff06906";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/br/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/br/Thunderbird%20139.0.dmg";
       locale = "br";
       arch = "mac";
-      sha256 = "363a9bf423f0f2af817fe35b2c08857570a6f09e190f6be88038fb055e3f2a22";
+      sha256 = "5e50fbdb23946562306f6c3dc90d09f00e756d28ff2da3ad8147365acbe4a39a";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/ca/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/ca/Thunderbird%20139.0.dmg";
       locale = "ca";
       arch = "mac";
-      sha256 = "1be0974f36326ff5b468afc067a399ddf7a77cfbc2ae5ab71772ac36cbfe700a";
+      sha256 = "602097919baf8f3c040801a58fc96fe84ac41f44fc340f4e0cc52d41f48366c7";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/cak/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/cak/Thunderbird%20139.0.dmg";
       locale = "cak";
       arch = "mac";
-      sha256 = "f34c6d9fa6ad46322e04bb5960beb391a511aa709503f7419e4012e0d4400281";
+      sha256 = "a86ae4b7906bad48cae83999eec561f48658d520d9d0f66e4fc69adfb089e532";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/cs/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/cs/Thunderbird%20139.0.dmg";
       locale = "cs";
       arch = "mac";
-      sha256 = "71c850f32439bb9cb90c0f841ccfb69ffa8bacfdf42accb55c0937ec70d57577";
+      sha256 = "d0863dd356169fdd7bd39a3e074f07c734a105192d820a81f07c5c11366727a7";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/cy/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/cy/Thunderbird%20139.0.dmg";
       locale = "cy";
       arch = "mac";
-      sha256 = "b90061e96c105503a7ee7fccb5a99cb9d62de424813ddcb7164afa2f38c66936";
+      sha256 = "c69e70b0eb95c2803696872280168f492c76fdb5f2cdc80b4cbf0be3050a2692";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/da/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/da/Thunderbird%20139.0.dmg";
       locale = "da";
       arch = "mac";
-      sha256 = "d1e07140711662c157c729b1c75a1586cf3088a397767d90757d5b723cfb99da";
+      sha256 = "3f49ef88b986f91a8fe2fde725ae69a34c716acd1d332c38b4152745681305df";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/de/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/de/Thunderbird%20139.0.dmg";
       locale = "de";
       arch = "mac";
-      sha256 = "73afe766aba05dfd6e77872c26ee7bcd53c6e3bb7a0311e16f0e43e87818b1a4";
+      sha256 = "57d2e361f7a9e71ac581ef135df1ec7e55b541b8e9a3c9a444b313f575aeeb31";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/dsb/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/dsb/Thunderbird%20139.0.dmg";
       locale = "dsb";
       arch = "mac";
-      sha256 = "965e443230a501f44cdb7bf13e5eec08b862e69b69a5b2ad7433e3d474a4de9a";
+      sha256 = "1edb7d0749919f203481997e779ddd892633d78596991bb3d6fb78048a6a4f97";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/el/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/el/Thunderbird%20139.0.dmg";
       locale = "el";
       arch = "mac";
-      sha256 = "24498593eaa082b1823c8a01b3acec1969df939cd32a37413185238eda6a3c17";
+      sha256 = "316344df75d62012a8ba4880691d78ba5cc812cb74f3f8e9985bef5b85f10580";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/en-CA/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/en-CA/Thunderbird%20139.0.dmg";
       locale = "en-CA";
       arch = "mac";
-      sha256 = "691be978c0b567d905317be7db7f9ad7d1a82826ff328a546c4fe168499a7f38";
+      sha256 = "7e2f899e87268da61298eb95c3058686da3b3ec78e1d380aaa7ca7063fdc791d";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/en-GB/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/en-GB/Thunderbird%20139.0.dmg";
       locale = "en-GB";
       arch = "mac";
-      sha256 = "d0baa7c3ca51b25a281a58061417c8ff7c6ae96827d22de76cc3dd9c77446b88";
+      sha256 = "4054b05073d8667b4f57a9e4d20dfaa3562cf62f88c422bd8f5106a0a60c6619";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/en-US/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/en-US/Thunderbird%20139.0.dmg";
       locale = "en-US";
       arch = "mac";
-      sha256 = "382b7f07b925b38d5cc95b1187ff610219a662f3b0afc22d6450545a8aa2af74";
+      sha256 = "e86605582eaa95be9c553bae02d18ba6f6a2a1fd0f6f61139f7b63632fa9db4f";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/es-AR/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/es-AR/Thunderbird%20139.0.dmg";
       locale = "es-AR";
       arch = "mac";
-      sha256 = "647433beec652fbade598e7b17258ed57c87b74dafaecca289884a2142fe8d54";
+      sha256 = "a190e4c5694c519f59a21b26808a423ba8a68987e08927445aee8fb668316f5e";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/es-ES/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/es-ES/Thunderbird%20139.0.dmg";
       locale = "es-ES";
       arch = "mac";
-      sha256 = "7d85e011d379b9799e81eeb63d841ae48bae02c3328ff4127fc4562a1da5d880";
+      sha256 = "cad06901502a5c80284e690115b8f0b81066c766b9a0917b35b8044733a6611a";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/es-MX/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/es-MX/Thunderbird%20139.0.dmg";
       locale = "es-MX";
       arch = "mac";
-      sha256 = "c91f33456fdbdfde74130272b8c8acd0b2b2272df71b8ab61b57e6fbcefecb15";
+      sha256 = "806e8534d6c859219dbff8f86c2bb7ecb71c6d66a845187c5f78f6a966aea038";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/et/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/et/Thunderbird%20139.0.dmg";
       locale = "et";
       arch = "mac";
-      sha256 = "7e71c684e3c9dcfd659588de6c51d6d6b1ff087c94abde63f342f0118794bfbb";
+      sha256 = "8f8726bf3c85709d1d6290118743a7c7a0d5a285c89e78ce7a00a0fb0ed86bdb";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/eu/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/eu/Thunderbird%20139.0.dmg";
       locale = "eu";
       arch = "mac";
-      sha256 = "c701f330f3eb64c5658da3bb849971e786b8b0f27fc1a1fcde703806b2bc1856";
+      sha256 = "20292453d67b2e62f80f969150b1cbe6c6500e38e8a7e0b373e3b48401688347";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/fi/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/fi/Thunderbird%20139.0.dmg";
       locale = "fi";
       arch = "mac";
-      sha256 = "76ef42834ed3547aff00b7087de5fb88dbb21e6b00a5f87d860b716037434348";
+      sha256 = "684fbdf8c215962db439b9e2f5eb5cf4d01c08712cbba5ebaff0bf2ffb560ed7";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/fr/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/fr/Thunderbird%20139.0.dmg";
       locale = "fr";
       arch = "mac";
-      sha256 = "fb92caede31a4c35f26d81c01cfd14a01ee287101ce9f604263925e4ac4ee7a5";
+      sha256 = "4d50fc0de08d1a2f4180164cbbdbc5d352da2af24a29c7b87b2bb458af5d9e14";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/fy-NL/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/fy-NL/Thunderbird%20139.0.dmg";
       locale = "fy-NL";
       arch = "mac";
-      sha256 = "5769a9bd17bf7962cee09d3dc21f3cdc010df37db58e2af0e3b289511cc89e24";
+      sha256 = "98315fe25cb8a15819655117a6eca5c0d2c89f97c8eca1d92520f3f78a4b488f";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/ga-IE/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/ga-IE/Thunderbird%20139.0.dmg";
       locale = "ga-IE";
       arch = "mac";
-      sha256 = "31e31af3e14f24c7d9429fe65e9d62424a06dd8c049eee4eb6ad73973d35d17f";
+      sha256 = "365f214ea8f447a3fa4b8601568bbb59ccecb5ad6c73e811b246cd36765d5e73";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/gd/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/gd/Thunderbird%20139.0.dmg";
       locale = "gd";
       arch = "mac";
-      sha256 = "dbba8bc55c4ca995b36bb26bb1f0de77612149726fadb27b55d9adf72b678255";
+      sha256 = "d9d0e7488f7f810b01a3f1c51cce9f5b9d47e9319d8b23517ecae307c5dfbe38";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/gl/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/gl/Thunderbird%20139.0.dmg";
       locale = "gl";
       arch = "mac";
-      sha256 = "61c7a3d6f691a30fd5015ff69ce613c8f62abc7b77ee5642a2752a0710695a5a";
+      sha256 = "9421bc28ac12e09d205dc9f28bdf49497cae24c61d88ec1fc95f69561621092f";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/he/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/he/Thunderbird%20139.0.dmg";
       locale = "he";
       arch = "mac";
-      sha256 = "85306063c7b2362b4a60636f08ab85e661ff843b27a12eeea1769caa31917c13";
+      sha256 = "4341a6b25d6ed307d36379eaf7130a2b867382252d2dcbc950125b1bd69379ec";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/hr/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/hr/Thunderbird%20139.0.dmg";
       locale = "hr";
       arch = "mac";
-      sha256 = "ac2b4fe79344ea7dad0b9e6c9e3ca8ce2fc28bb3c2a1c5fccf26782977014e1a";
+      sha256 = "9e9033f4fd7d804c345f7044fcfdd0aa1438815ecde88074d48e4288d13d396b";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/hsb/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/hsb/Thunderbird%20139.0.dmg";
       locale = "hsb";
       arch = "mac";
-      sha256 = "bd53027d99a34202a4215f4be4b70e81be403274c33a4972de7723e6010201f3";
+      sha256 = "97f398522af49fd23446be9d0fc4061748e13bdf97aca37250ee07c5656e8cf0";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/hu/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/hu/Thunderbird%20139.0.dmg";
       locale = "hu";
       arch = "mac";
-      sha256 = "d791c97ae4784143943dfa670e63d8697ec6fc9f73b5d7dc98a09a39a6fa6d8f";
+      sha256 = "67b37f3bb9e7817328ea66c27e82f81ee28bab87b4930999e14c83af2e5aebb1";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/hy-AM/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/hy-AM/Thunderbird%20139.0.dmg";
       locale = "hy-AM";
       arch = "mac";
-      sha256 = "3e4c3b299ba79e3604bf39a02a2182f7ac345ed092a3ec196b75ac726c227c3a";
+      sha256 = "d4d8aa5623ebe32ebcb43b8e056804c70097667c06577234448f1fb8a32a84d6";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/id/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/id/Thunderbird%20139.0.dmg";
       locale = "id";
       arch = "mac";
-      sha256 = "160667120ad1ec4061b96b9cbda02705eabeed5de7591fc7a487da04863e3b6d";
+      sha256 = "fe77069e0e155dc73f4c449ba4d3f63460bad98eeb2ff32a8634b0d00dce3b13";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/is/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/is/Thunderbird%20139.0.dmg";
       locale = "is";
       arch = "mac";
-      sha256 = "7d89cad5ae165947e8cd130b264b2a19d716916bffbab65c63fd93266e65a4ef";
+      sha256 = "b6ff29d44ff6a4d4816d64844c53f8472072b1533caf9e66ec20e22163ac421e";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/it/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/it/Thunderbird%20139.0.dmg";
       locale = "it";
       arch = "mac";
-      sha256 = "01ce3c4afdf7ddff923c31d30f12b9b2209dfb7dca0a4de9c3d6516f807ed72e";
+      sha256 = "c1301f006607a969bd305f8a690a1bf9264330aa860001ca407f1f5ad225de9f";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/ja-JP-mac/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/ja-JP-mac/Thunderbird%20139.0.dmg";
       locale = "ja-JP-mac";
       arch = "mac";
-      sha256 = "14cbfcd0513da0c5366f18b7d349dd3b7381c4a2a2211b5ce01de5be7602d595";
+      sha256 = "ef7e02cee6d6864082b8b9d9843ed8ba73d822a14915b8f7da725737ad050397";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/ka/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/ka/Thunderbird%20139.0.dmg";
       locale = "ka";
       arch = "mac";
-      sha256 = "a33e4cae7078fb524554daae9aa0bc2c4b9eac22ab27d053de8536c74a0d6c75";
+      sha256 = "d3308e8b30f91c271f4489dc11ed9ca9f91d3078b1b9e687b51993f4d31ce294";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/kab/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/kab/Thunderbird%20139.0.dmg";
       locale = "kab";
       arch = "mac";
-      sha256 = "f24949dc16d79f0292ad2b4bd59b8cdcb7ebbf8dafb32b6bf114427382723dd7";
+      sha256 = "724297f7684512bc32e85c76852a5b931c63eacf55ab87749850c604df85f8c3";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/kk/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/kk/Thunderbird%20139.0.dmg";
       locale = "kk";
       arch = "mac";
-      sha256 = "1bcd911e3b3d9bb3d07b007cbd23796c1d7a4c3b535c4a294479c8b71d7ae11f";
+      sha256 = "2cd7799c01adb972e7b8eb3813751d43825067c2cffa786cfc37c3ca0107d7d6";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/ko/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/ko/Thunderbird%20139.0.dmg";
       locale = "ko";
       arch = "mac";
-      sha256 = "6b6a4a11ac0bfa7ec20e192766987d43ba592215decbe8dd54a3b0c3102259ab";
+      sha256 = "dcd9e64c281f4d3baeafcd5b750c6d013012e6db5330f086e8e1f35ff16732f0";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/lt/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/lt/Thunderbird%20139.0.dmg";
       locale = "lt";
       arch = "mac";
-      sha256 = "7edd65e5372214eaf1ed21872bca57973af14c6c6b7d5c83fd690045e30f42f4";
+      sha256 = "00b38e4796be3ec59003add60c8a3cbe19e0263422327ed0e759b3ce4b4576bb";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/lv/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/lv/Thunderbird%20139.0.dmg";
       locale = "lv";
       arch = "mac";
-      sha256 = "3e00b0e95f0be4f969bfc089005313baea44511feec992ccbb07ddbb6901dba7";
+      sha256 = "dbec5169ea98ec7e859ebf0688eae3361a0bbb83aeb39c8a73ed4e30ce79bc42";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/ms/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/ms/Thunderbird%20139.0.dmg";
       locale = "ms";
       arch = "mac";
-      sha256 = "7e5df9e3fe8cd1e94fe5eb83c54a7efc725b45c5dcaa78744b8631f55f60620e";
+      sha256 = "718e972521281fb9a5531d4532ada890aa9f1d79a2dc4b7f44c82ea687ef8098";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/nb-NO/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/nb-NO/Thunderbird%20139.0.dmg";
       locale = "nb-NO";
       arch = "mac";
-      sha256 = "860227e0b5603e42bf37a6324e4e787aa29ff3fdf593ce4da5fa854399a1552d";
+      sha256 = "505e9dc656d9f96162a645aa974a02088a54e0b6bcf781ae8044f06b2b13846b";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/nl/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/nl/Thunderbird%20139.0.dmg";
       locale = "nl";
       arch = "mac";
-      sha256 = "c5732ec80cb3a5c1f4be37efdbb0e5877fb1905c8c61f6a78deb11129aaeab64";
+      sha256 = "5edc8de68c6b73b271591d63bcaa262e6eddafbf1f79428c2008be62cb828746";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/nn-NO/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/nn-NO/Thunderbird%20139.0.dmg";
       locale = "nn-NO";
       arch = "mac";
-      sha256 = "994e11db8ddf0409078c237eb97a53d573f3e755f0d84d28770bbac0c8877d48";
+      sha256 = "d762da49e6de40ae246fd0c9aeb14e6c18a8f2009cb03a7d62e0c68293ee557b";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/pa-IN/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/pa-IN/Thunderbird%20139.0.dmg";
       locale = "pa-IN";
       arch = "mac";
-      sha256 = "b35020db83a3ebd62bd7d8f59680f74ac9fd5ca84a6f92e30c1b43bb1df55063";
+      sha256 = "c40d709a65025e8c1e7b93aba2539bc4268a3b515c77558f3f4679d10a2b4978";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/pl/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/pl/Thunderbird%20139.0.dmg";
       locale = "pl";
       arch = "mac";
-      sha256 = "e806e5a5ef2f3fa54f65980eba84f572f119968ab13b50a12d77baf22e3b1cde";
+      sha256 = "1efa46e12beb32ce1ae9be134d8410c517565f0957ef0473ea35b4ff40e91f1c";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/pt-BR/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/pt-BR/Thunderbird%20139.0.dmg";
       locale = "pt-BR";
       arch = "mac";
-      sha256 = "ba94c6f4dd08502a545cb5a8a3c7a40a827f78b92a37bc58c683bac66bd4aff2";
+      sha256 = "f1edbbada6b14080637157b9da8ebe543ff7c4e5883b20e1133bdc49370e2158";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/pt-PT/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/pt-PT/Thunderbird%20139.0.dmg";
       locale = "pt-PT";
       arch = "mac";
-      sha256 = "a43b659c99ffeb230132f0a4f961696bcfb57fc8da5ec8ff23de36f830c76f8a";
+      sha256 = "76e77122f82675e7f78053e093a27bbabdf26ce0a2b27ce3ee3e5cb070e40fea";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/rm/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/rm/Thunderbird%20139.0.dmg";
       locale = "rm";
       arch = "mac";
-      sha256 = "de3b344e91fedd0bfc49f17f3571b5d028ecf8291c2bc54cd0c0d5c319c66eb8";
+      sha256 = "54d034a454d0f7e5dbe7dc109557fb2bd7f05c89ce78fa8107cb1d48c5ffec2e";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/ro/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/ro/Thunderbird%20139.0.dmg";
       locale = "ro";
       arch = "mac";
-      sha256 = "7ddbb8d39221e881a21aa2ba44499a542ac18233acea67d474f5bf9237ebef32";
+      sha256 = "013a405d07602a23b8fb59a6c4989f857c9b6d7f7292403892ba4190d4553052";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/ru/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/ru/Thunderbird%20139.0.dmg";
       locale = "ru";
       arch = "mac";
-      sha256 = "f8d469fe85da543025656225244c32180e4091db57ef77a7940c5bcefaab3189";
+      sha256 = "7ada75eeb7b97ca36eb5b8319145d748864e3faa694fd6b2818fb3fbcd7611d1";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/sk/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/sk/Thunderbird%20139.0.dmg";
       locale = "sk";
       arch = "mac";
-      sha256 = "fc38afe62984fa56bcd0f465060e3f8e9c5dc9c19f44fb2a7a272e193803670e";
+      sha256 = "f73dc5c60187b9c02d821e588d2b28dd68954a271b904f54e579a379586d49f0";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/sl/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/sl/Thunderbird%20139.0.dmg";
       locale = "sl";
       arch = "mac";
-      sha256 = "f7b3ef64000a34b3fb8ee6c6a3f24e7478fcffea14c7302bb2eb523dd1119cc7";
+      sha256 = "07dae9c56d5c3491669bb74a74a34cc779f8ccd1ab979fb750f3db272db54827";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/sq/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/sq/Thunderbird%20139.0.dmg";
       locale = "sq";
       arch = "mac";
-      sha256 = "d06c5b7460d114c5bb11db6935fa948414eb312be9b9a2aae4cab427a36dc638";
+      sha256 = "3e3eb87df03083c30a5c8ff860692e15c5abaf32a2fda03beebe0880c5cc376d";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/sr/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/sr/Thunderbird%20139.0.dmg";
       locale = "sr";
       arch = "mac";
-      sha256 = "cc2c1ad2fdf145590453b40f39319644c9bc07c614ddd69b22053b7a11a80708";
+      sha256 = "08ec6cea78b0b6315b65dc10be9b927dd0b30b3a6d1735ffb5d7a36e97fe6f2d";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/sv-SE/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/sv-SE/Thunderbird%20139.0.dmg";
       locale = "sv-SE";
       arch = "mac";
-      sha256 = "08193a52095a62b2c9df8dbae84500d467be39b4265450b9a6d1ebab5af45807";
+      sha256 = "80e56cf996625935c2ef6db0f054990c48351cffee20ad6199e233801c9576b4";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/th/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/th/Thunderbird%20139.0.dmg";
       locale = "th";
       arch = "mac";
-      sha256 = "21eb67c8c0441213cff96b2dec37583c514df91ccb02c90ee17daec4a821053f";
+      sha256 = "b0ceeca000186b9c7cbbecc2c2f1124576484d4615cc20d4f1f6569f462910c0";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/tr/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/tr/Thunderbird%20139.0.dmg";
       locale = "tr";
       arch = "mac";
-      sha256 = "046165d96b491e29d89516333505af7e160e28086be722886bc7294bdf142b95";
+      sha256 = "ad483fb238a3b792f2a2c03ccda30acbb9d7cf3029560a47718691dcbd63c53c";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/uk/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/uk/Thunderbird%20139.0.dmg";
       locale = "uk";
       arch = "mac";
-      sha256 = "c8c1881eea72039d49c53100cbfbd1e2869d7a5ddef2e88355728713fff6637a";
+      sha256 = "27e6a7f9aa40678b8c0a7b87bb91ae7bc2856af265378e45b27298fd5d30ad58";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/uz/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/uz/Thunderbird%20139.0.dmg";
       locale = "uz";
       arch = "mac";
-      sha256 = "4182d0673851f7fc5975719dab4687280aeda1ffe8d4c8d328ed52747b122426";
+      sha256 = "225420dc0b3cbbcc916579022496512ecf636318b47a8f137510871aab98d797";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/vi/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/vi/Thunderbird%20139.0.dmg";
       locale = "vi";
       arch = "mac";
-      sha256 = "5c0ae5f619c40b59a5e8360e3eb5373e0c24accb36b166cc834f30a12c1d2d1d";
+      sha256 = "eea1f05a500092beb82485d6de25222c3beb57201815b02896339db9d3080002";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/zh-CN/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/zh-CN/Thunderbird%20139.0.dmg";
       locale = "zh-CN";
       arch = "mac";
-      sha256 = "63e98c9ddc09a67e663d249355f0779e9aec60729f03e1205292afdb4a18d5a9";
+      sha256 = "9009bbb641bdd72b4cc1baecf1a1806c9e252235d6bfdb7b7d05d6358008aba3";
     }
     {
-      url = "http://archive.mozilla.org/pub/thunderbird/releases/138.0.1/mac/zh-TW/Thunderbird%20138.0.1.dmg";
+      url = "http://archive.mozilla.org/pub/thunderbird/releases/139.0/mac/zh-TW/Thunderbird%20139.0.dmg";
       locale = "zh-TW";
       arch = "mac";
-      sha256 = "5da04b70cc5cfdfb8c880fc6bd9969bc42140aaa5f93c70bbdbe2ce0d931fb34";
+      sha256 = "89ec028df63ffd5f29d8965fd781ca2ac98ff6e58e2e677b4543fa6dad62e7fa";
     }
   ];
 }
diff --git a/pkgs/applications/networking/sync/rclone/default.nix b/pkgs/applications/networking/sync/rclone/default.nix
index 82de95739948..10df3c901135 100644
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@@ -17,7 +17,7 @@
 
 buildGoModule rec {
   pname = "rclone";
-  version = "1.69.2";
+  version = "1.69.3";
 
   outputs = [
     "out"
@@ -28,15 +28,10 @@ buildGoModule rec {
     owner = "rclone";
     repo = "rclone";
     tag = "v${version}";
-    hash = "sha256-WhviYa9H3FsYRgnUhheP6dRj9A9l2nrGeFAhUj5TCKU=";
+    hash = "sha256-VLE9cWR4Wp+MDbwmfNaJArxhXTOcVfM2C1TMCymKflw=";
   };
 
-  patches = [
-    # TODO: remove after updating to 1.69.3
-    ./purego-update.patch
-  ];
-
-  vendorHash = "sha256-Wu9d98SIENCkJYoGT/f9KN8vnYYGMN7HxhzqtkOYQ/8=";
+  vendorHash = "sha256-WY5xBBOhDRl+mU0KuVxph0wDhfUYLI0gmiGY1boxmKU=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/sync/rclone/purego-update.patch b/pkgs/applications/networking/sync/rclone/purego-update.patch
deleted file mode 100644
index b936c1c0a07f..000000000000
--- a/pkgs/applications/networking/sync/rclone/purego-update.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/go.mod b/go.mod
-index f4d830b89..af23fc0d9 100644
---- a/go.mod
-+++ b/go.mod
-@@ -134,7 +134,7 @@ require (
- 	github.com/cronokirby/saferith v0.33.0 // indirect
- 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
- 	github.com/dustin/go-humanize v1.0.1 // indirect
--	github.com/ebitengine/purego v0.8.1 // indirect
-+	github.com/ebitengine/purego v0.8.3 // indirect
- 	github.com/emersion/go-message v0.18.0 // indirect
- 	github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594 // indirect
- 	github.com/emersion/go-vcard v0.0.0-20230815062825-8fda7d206ec9 // indirect
-diff --git a/go.sum b/go.sum
-index 06a76c5ef..28b4dddbe 100644
---- a/go.sum
-+++ b/go.sum
-@@ -213,8 +213,8 @@ github.com/dsnet/try v0.0.3/go.mod h1:WBM8tRpUmnXXhY1U6/S8dt6UWdHTQ7y8A5YSkRCkq4
- github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
- github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
- github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
--github.com/ebitengine/purego v0.8.1 h1:sdRKd6plj7KYW33EH5As6YKfe8m9zbN9JMrOjNVF/BE=
--github.com/ebitengine/purego v0.8.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
-+github.com/ebitengine/purego v0.8.3 h1:K+0AjQp63JEZTEMZiwsI9g0+hAMNohwUOtY0RPGexmc=
-+github.com/ebitengine/purego v0.8.3/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
- github.com/emersion/go-message v0.18.0 h1:7LxAXHRpSeoO/Wom3ZApVZYG7c3d17yCScYce8WiXA8=
- github.com/emersion/go-message v0.18.0/go.mod h1:Zi69ACvzaoV/MBnrxfVBPV3xWEuCmC2nEN39oJF4B8A=
- github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594 h1:IbFBtwoTQyw0fIM5xv1HF+Y+3ZijDR839WMulgxCcUY=
diff --git a/pkgs/applications/radio/gqrx/default.nix b/pkgs/applications/radio/gqrx/default.nix
index 8b2610cf88b6..61e77bba6824 100644
--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@@ -32,13 +32,13 @@ assert !(pulseaudioSupport && portaudioSupport);
 
 gnuradioMinimal.pkgs.mkDerivation rec {
   pname = "gqrx";
-  version = "2.17.6";
+  version = "2.17.7";
 
   src = fetchFromGitHub {
     owner = "gqrx-sdr";
     repo = "gqrx";
     rev = "v${version}";
-    hash = "sha256-/ykKcwOotu8kn+EpJI+EUeqSkHZ2IrSh+o7lBGeHrZ0=";
+    hash = "sha256-uvKIxppnNkQge0QE5d1rw0qKo1fT8jwJPTiHilYaT28=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/chemistry/jmol/default.nix b/pkgs/applications/science/chemistry/jmol/default.nix
index 55e3dd1f6e2e..5b6854a1d354 100644
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@@ -31,7 +31,7 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  version = "16.3.17";
+  version = "16.3.23";
   pname = "jmol";
 
   src =
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     in
     fetchurl {
       url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-      hash = "sha256-5L9+JGVHKwgW9bOX/Xm/fQUOisO7aivWhhBdQaNpzyk=";
+      hash = "sha256-qZDkEsdl1kxwyavtBv9N8E33WSGJoe82w4v8x8v9SPs=";
     };
 
   patchPhase = ''
diff --git a/pkgs/applications/science/misc/colmap/default.nix b/pkgs/applications/science/misc/colmap/default.nix
index c28c1b15b96e..39c5798ff096 100644
--- a/pkgs/applications/science/misc/colmap/default.nix
+++ b/pkgs/applications/science/misc/colmap/default.nix
@@ -46,7 +46,7 @@ stdenv'.mkDerivation rec {
   cmakeFlags = lib.optionals cudaSupport [
     (lib.cmakeBool "CUDA_ENABLED" true)
     (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" (
-      lib.strings.concatStringsSep ";" (map cudaPackages.flags.dropDot cudaCapabilities)
+      lib.strings.concatStringsSep ";" (map cudaPackages.flags.dropDots cudaCapabilities)
     ))
   ];
 
diff --git a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
index b1423b30a846..d8bc2a855598 100644
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@@ -53,8 +53,8 @@ let
       }
     else
       {
-        version = "2025.1";
-        hash = "sha256-Ct9iGoD9gEP43v7ITOAoEcDN9CoFIjKJCTLYHyXE0oo=";
+        version = "2025.2";
+        hash = "sha256-DfCfnUWpnvAOZrm6qUk6J+kGgTdjo7bHZyIXxmtD6hE=";
       };
 
 in
diff --git a/pkgs/applications/version-management/danger-gitlab/Gemfile.lock b/pkgs/applications/version-management/danger-gitlab/Gemfile.lock
index d68ec3108ca2..230297e9357e 100644
--- a/pkgs/applications/version-management/danger-gitlab/Gemfile.lock
+++ b/pkgs/applications/version-management/danger-gitlab/Gemfile.lock
@@ -1,9 +1,11 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.0)
-      public_suffix (>= 2.0.2, < 5.0)
-    claide (1.0.3)
+    addressable (2.8.7)
+      public_suffix (>= 2.0.2, < 7.0)
+    base64 (0.2.0)
+    bigdecimal (3.1.9)
+    claide (1.1.0)
     claide-plugins (0.9.2)
       cork
       nap
@@ -11,82 +13,77 @@ GEM
     colored2 (3.1.2)
     cork (0.3.0)
       colored2 (~> 3.1)
-    danger (8.3.1)
+    csv (3.3.4)
+    danger (9.5.1)
+      base64 (~> 0.2)
       claide (~> 1.0)
       claide-plugins (>= 0.9.2)
       colored2 (~> 3.1)
       cork (~> 0.1)
-      faraday (>= 0.9.0, < 2.0)
+      faraday (>= 0.9.0, < 3.0)
       faraday-http-cache (~> 2.0)
-      git (~> 1.7)
+      git (~> 1.13)
       kramdown (~> 2.3)
       kramdown-parser-gfm (~> 1.0)
-      no_proxy_fix
-      octokit (~> 4.7)
+      octokit (>= 4.0)
+      pstore (~> 0.1)
       terminal-table (>= 1, < 4)
-    danger-gitlab (8.0.0)
+    danger-gitlab (9.0.0)
       danger
-      gitlab (~> 4.2, >= 4.2.0)
-    faraday (1.7.0)
-      faraday-em_http (~> 1.0)
-      faraday-em_synchrony (~> 1.0)
-      faraday-excon (~> 1.1)
-      faraday-httpclient (~> 1.0.1)
-      faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.1)
-      faraday-patron (~> 1.0)
-      faraday-rack (~> 1.0)
-      multipart-post (>= 1.2, < 3)
-      ruby2_keywords (>= 0.0.4)
-    faraday-em_http (1.0.0)
-    faraday-em_synchrony (1.0.0)
-    faraday-excon (1.1.0)
-    faraday-http-cache (2.2.0)
+      gitlab (~> 5.0)
+    faraday (2.13.1)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-http-cache (2.5.1)
       faraday (>= 0.8)
-    faraday-httpclient (1.0.1)
-    faraday-net_http (1.0.1)
-    faraday-net_http_persistent (1.2.0)
-    faraday-patron (1.0.0)
-    faraday-rack (1.0.0)
-    git (1.9.1)
+    faraday-net_http (3.4.0)
+      net-http (>= 0.5.0)
+    git (1.19.1)
+      addressable (~> 2.8)
       rchardet (~> 1.8)
-    gitlab (4.17.0)
-      httparty (~> 0.18)
-      terminal-table (~> 1.5, >= 1.5.1)
-    httparty (0.18.1)
-      mime-types (~> 3.0)
+    gitlab (5.1.0)
+      base64 (~> 0.2.0)
+      httparty (~> 0.20)
+      terminal-table (>= 1.5.1)
+    httparty (0.23.1)
+      csv
+      mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
-    kramdown (2.3.1)
-      rexml
+    json (2.12.0)
+    kramdown (2.5.1)
+      rexml (>= 3.3.9)
     kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)
-    mime-types (3.3.1)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2021.0704)
-    multi_xml (0.6.0)
-    multipart-post (2.1.1)
+    logger (1.7.0)
+    mini_mime (1.1.5)
+    multi_xml (0.7.2)
+      bigdecimal (~> 3.1)
     nap (1.1.0)
-    no_proxy_fix (0.1.2)
-    octokit (4.21.0)
-      faraday (>= 0.9)
-      sawyer (~> 0.8.0, >= 0.5.3)
+    net-http (0.6.0)
+      uri
+    octokit (10.0.0)
+      faraday (>= 1, < 3)
+      sawyer (~> 0.9)
     open4 (1.3.4)
-    public_suffix (4.0.6)
-    rchardet (1.8.0)
-    rexml (3.2.5)
-    ruby2_keywords (0.0.5)
-    sawyer (0.8.2)
+    pstore (0.2.0)
+    public_suffix (6.0.2)
+    rchardet (1.9.0)
+    rexml (3.4.1)
+    sawyer (0.9.2)
       addressable (>= 2.3.5)
-      faraday (> 0.8, < 2.0)
-    terminal-table (1.8.0)
-      unicode-display_width (~> 1.1, >= 1.1.1)
-    unicode-display_width (1.7.0)
+      faraday (>= 0.17.3, < 3)
+    terminal-table (3.0.2)
+      unicode-display_width (>= 1.1.1, < 3)
+    unicode-display_width (2.6.0)
+    uri (1.0.3)
 
 PLATFORMS
   ruby
+  x86_64-linux
 
 DEPENDENCIES
   danger-gitlab
 
 BUNDLED WITH
-   2.1.4
+   2.5.22
diff --git a/pkgs/applications/version-management/danger-gitlab/gemset.nix b/pkgs/applications/version-management/danger-gitlab/gemset.nix
index 70b12e0d609f..2f47e820eb89 100644
--- a/pkgs/applications/version-management/danger-gitlab/gemset.nix
+++ b/pkgs/applications/version-management/danger-gitlab/gemset.nix
@@ -5,20 +5,40 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "022r3m9wdxljpbya69y2i3h9g3dhhfaqzidf95m6qjzms792jvgp";
+      sha256 = "0cl2qpvwiffym62z991ynks7imsm87qmgxf0yfsmlwzkgi9qcaa6";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.8.7";
+  };
+  base64 = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "01qml0yilb9basf7is2614skjp8384h2pycfx86cr8023arfj98g";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  bigdecimal = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1k6qzammv9r6b2cw3siasaik18i6wjc5m0gw5nfdc6jj64h79z1g";
+      type = "gem";
+    };
+    version = "3.1.9";
   };
   claide = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0kasxsms24fgcdsq680nz99d5lazl9rmz1qkil2y5gbbssx89g0z";
+      sha256 = "0bpqhc0kqjp1bh9b7ffc395l9gfls0337rrhmab4v46ykl45qg3d";
       type = "gem";
     };
-    version = "1.0.3";
+    version = "1.1.0";
   };
   claide-plugins = {
     dependencies = [
@@ -56,8 +76,19 @@
     };
     version = "0.3.0";
   };
+  csv = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1kfqg0m6vqs6c67296f10cr07im5mffj90k2b5dsm51liidcsvp9";
+      type = "gem";
+    };
+    version = "3.3.4";
+  };
   danger = {
     dependencies = [
+      "base64"
       "claide"
       "claide-plugins"
       "colored2"
@@ -67,18 +98,18 @@
       "git"
       "kramdown"
       "kramdown-parser-gfm"
-      "no_proxy_fix"
       "octokit"
+      "pstore"
       "terminal-table"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12nmycrlwr8ca2s0fx76k81gjw12iz15k1n0qanszv5d4l1ykj2l";
+      sha256 = "0s6liclz7vn2q1vzraq7gq6n2rfj4p3hn2gixgnx2qvggg2qsai1";
       type = "gem";
     };
-    version = "8.3.1";
+    version = "9.5.1";
   };
   danger-gitlab = {
     dependencies = [
@@ -89,62 +120,25 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a530kx5s5rbx5yx3jqay56lkksqh0yj468hcpg16faiyv8dfza9";
+      sha256 = "0bmsyv03n2ravjc0mzq73iairgc1apzc388jalg2c3rag1psgr47";
       type = "gem";
     };
-    version = "8.0.0";
+    version = "9.0.0";
   };
   faraday = {
     dependencies = [
-      "faraday-em_http"
-      "faraday-em_synchrony"
-      "faraday-excon"
-      "faraday-httpclient"
       "faraday-net_http"
-      "faraday-net_http_persistent"
-      "faraday-patron"
-      "faraday-rack"
-      "multipart-post"
-      "ruby2_keywords"
+      "json"
+      "logger"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0r6ik2yvsbx6jj30vck32da2bbvj4m0gf4jhp09vr75i1d6jzfvb";
+      sha256 = "0xbv450qj2bx0qz9l2pjrd3kc057y6bglc3na7a78zby8ssiwlyc";
       type = "gem";
     };
-    version = "1.7.0";
-  };
-  faraday-em_http = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "12cnqpbak4vhikrh2cdn94assh3yxza8rq2p9w2j34bqg5q4qgbs";
-      type = "gem";
-    };
-    version = "1.0.0";
-  };
-  faraday-em_synchrony = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1vgrbhkp83sngv6k4mii9f2s9v5lmp693hylfxp2ssfc60fas3a6";
-      type = "gem";
-    };
-    version = "1.0.0";
-  };
-  faraday-excon = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0h09wkb0k0bhm6dqsd47ac601qiaah8qdzjh8gvxfd376x1chmdh";
-      type = "gem";
-    };
-    version = "1.1.0";
+    version = "2.13.1";
   };
   faraday-http-cache = {
     dependencies = [ "faraday" ];
@@ -152,74 +146,39 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0lhfwlk4mhmw9pdlgdsl2bq4x45w7s51jkxjryf18wym8iiw36g7";
+      sha256 = "10wld3vk3i8zsr3pa9zyjiyi2zlyyln872812f08bbg1hnd15z6b";
       type = "gem";
     };
-    version = "2.2.0";
-  };
-  faraday-httpclient = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0fyk0jd3ks7fdn8nv3spnwjpzx2lmxmg2gh4inz3by1zjzqg33sc";
-      type = "gem";
-    };
-    version = "1.0.1";
+    version = "2.5.1";
   };
   faraday-net_http = {
+    dependencies = [ "net-http" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1fi8sda5hc54v1w3mqfl5yz09nhx35kglyx72w7b8xxvdr0cwi9j";
+      sha256 = "0jp5ci6g40d6i50bsywp35l97nc2fpi9a592r2cibwicdb6y9wd1";
       type = "gem";
     };
-    version = "1.0.1";
-  };
-  faraday-net_http_persistent = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0dc36ih95qw3rlccffcb0vgxjhmipsvxhn6cw71l7ffs0f7vq30b";
-      type = "gem";
-    };
-    version = "1.2.0";
-  };
-  faraday-patron = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "19wgsgfq0xkski1g7m96snv39la3zxz6x7nbdgiwhg5v82rxfb6w";
-      type = "gem";
-    };
-    version = "1.0.0";
-  };
-  faraday-rack = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1h184g4vqql5jv9s9im6igy00jp6mrah2h14py6mpf9bkabfqq7g";
-      type = "gem";
-    };
-    version = "1.0.0";
+    version = "3.4.0";
   };
   git = {
-    dependencies = [ "rchardet" ];
+    dependencies = [
+      "addressable"
+      "rchardet"
+    ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0s6426k24ph44kbx1qb16ciar170iczs8ivyl29ckin2ygmrrlvm";
+      sha256 = "0w3xhay1z7qx9ab04wmy5p4f1fadvqa6239kib256wsiyvcj595h";
       type = "gem";
     };
-    version = "1.9.1";
+    version = "1.19.1";
   };
   gitlab = {
     dependencies = [
+      "base64"
       "httparty"
       "terminal-table"
     ];
@@ -227,24 +186,35 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "00p8z8sxk78zik2dwdhflkvaynp5ximy2xc8cw6bz93gkr1xy8n3";
+      sha256 = "1ivj6pq3s3lz8z0islynvdb3fv82ghr5k97drz07kwwqga02f702";
       type = "gem";
     };
-    version = "4.17.0";
+    version = "5.1.0";
   };
   httparty = {
     dependencies = [
-      "mime-types"
+      "csv"
+      "mini_mime"
       "multi_xml"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "17gpnbf2a7xkvsy20jig3ljvx8hl5520rqm9pffj2jrliq1yi3w7";
+      sha256 = "0mbbjr774zxb2wcpbwc93l0i481bxk7ga5hpap76w3q1y9idvh9s";
       type = "gem";
     };
-    version = "0.18.1";
+    version = "0.23.1";
+  };
+  json = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0l0av82l1i5703fd5qnxr263zw21xmbpx737av3r9pjn0w0cw3xk";
+      type = "gem";
+    };
+    version = "2.12.0";
   };
   kramdown = {
     dependencies = [ "rexml" ];
@@ -252,10 +222,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jdbcjv4v7sj888bv3vc6d1dg4ackkh7ywlmn9ln2g9alk7kisar";
+      sha256 = "131nwypz8b4pq1hxs6gsz3k00i9b75y3cgpkq57vxknkv6mvdfw7";
       type = "gem";
     };
-    version = "2.3.1";
+    version = "2.5.1";
   };
   kramdown-parser-gfm = {
     dependencies = [ "kramdown" ];
@@ -268,46 +238,36 @@
     };
     version = "1.1.0";
   };
-  mime-types = {
-    dependencies = [ "mime-types-data" ];
+  logger = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zj12l9qk62anvk9bjvandpa6vy4xslil15wl6wlivyf51z773vh";
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
       type = "gem";
     };
-    version = "3.3.1";
+    version = "1.7.0";
   };
-  mime-types-data = {
+  mini_mime = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0dlxwc75iy0dj23x824cxpvpa7c8aqcpskksrmb32j6m66h5mkcy";
+      sha256 = "1vycif7pjzkr29mfk4dlqv3disc5dn0va04lkwajlpr1wkibg0c6";
       type = "gem";
     };
-    version = "3.2021.0704";
+    version = "1.1.5";
   };
   multi_xml = {
+    dependencies = [ "bigdecimal" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0lmd4f401mvravi1i1yq7b2qjjli0yq7dfc4p1nj5nwajp7r6hyj";
+      sha256 = "1kl7ax7zcj8czlxs6vn3kdhpnz1dwva4y5zwnavssfv193f9cyih";
       type = "gem";
     };
-    version = "0.6.0";
-  };
-  multipart-post = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1zgw9zlwh2a6i1yvhhc4a84ry1hv824d6g2iw2chs3k5aylpmpfj";
-      type = "gem";
-    };
-    version = "2.1.1";
+    version = "0.7.2";
   };
   nap = {
     groups = [ "default" ];
@@ -319,15 +279,16 @@
     };
     version = "1.1.0";
   };
-  no_proxy_fix = {
+  net-http = {
+    dependencies = [ "uri" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "006dmdb640v1kq0sll3dnlwj1b0kpf3i1p27ygyffv8lpcqlr6sf";
+      sha256 = "1ysrwaabhf0sn24jrp0nnp51cdv0jf688mh5i6fsz63q2c6b48cn";
       type = "gem";
     };
-    version = "0.1.2";
+    version = "0.6.0";
   };
   octokit = {
     dependencies = [
@@ -338,10 +299,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ak64rb48d8z98nw6q70r6i0i3ivv61iqla40ss5l79491qfnn27";
+      sha256 = "1s14kbjfm9vdvcrwqdarfdbfsjqs1jxpglp60plvfdvnkd9rmsc2";
       type = "gem";
     };
-    version = "4.21.0";
+    version = "10.0.0";
   };
   open4 = {
     groups = [ "default" ];
@@ -353,45 +314,45 @@
     };
     version = "1.3.4";
   };
+  pstore = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1a3lrq8k62n8bazhxgdmjykni9wv0mcjks5vi1g274i3wblcgrfn";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
   public_suffix = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xqcgkl7bwws1qrlnmxgh8g4g9m10vg60bhlw40fplninb3ng6d9";
+      sha256 = "1543ap9w3ydhx39ljcd675cdz9cr948x9mp00ab8qvq6118wv9xz";
       type = "gem";
     };
-    version = "4.0.6";
+    version = "6.0.2";
   };
   rchardet = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1isj1b3ywgg2m1vdlnr41lpvpm3dbyarf1lla4dfibfmad9csfk9";
+      sha256 = "1455yhd1arccrns3ghhvn4dl6gnrf4zn1xxsaa33ffyqrn399216";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.9.0";
   };
   rexml = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
+      sha256 = "1jmbf6lf7pcyacpb939xjjpn1f84c3nw83dy3p1lwjx0l2ljfif7";
       type = "gem";
     };
-    version = "3.2.5";
-  };
-  ruby2_keywords = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1vz322p8n39hz3b4a9gkmz9y7a5jaz41zrm2ywf31dvkqm03glgz";
-      type = "gem";
-    };
-    version = "0.0.5";
+    version = "3.4.1";
   };
   sawyer = {
     dependencies = [
@@ -402,10 +363,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0yrdchs3psh583rjapkv33mljdivggqn99wkydkjdckcjn43j3cz";
+      sha256 = "1jks1qjbmqm8f9kvwa81vqj39avaj9wdnzc531xm29a55bb74fps";
       type = "gem";
     };
-    version = "0.8.2";
+    version = "0.9.2";
   };
   terminal-table = {
     dependencies = [ "unicode-display_width" ];
@@ -413,19 +374,29 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1512cngw35hsmhvw4c05rscihc59mnj09m249sm9p3pik831ydqk";
+      sha256 = "14dfmfjppmng5hwj7c5ka6qdapawm3h6k9lhn8zj001ybypvclgr";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "3.0.2";
   };
   unicode-display_width = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "06i3id27s60141x6fdnjn5rar1cywdwy64ilc59cz937303q3mna";
+      sha256 = "0nkz7fadlrdbkf37m0x7sw8bnz8r355q3vwcfb9f9md6pds9h9qj";
       type = "gem";
     };
-    version = "1.7.0";
+    version = "2.6.0";
+  };
+  uri = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "04bhfvc25b07jaiaf62yrach7khhr5jlr5bx6nygg8pf11329wp9";
+      type = "gem";
+    };
+    version = "1.0.3";
   };
 }
diff --git a/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix b/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix
index e59fce3b9cec..618d40b2006c 100644
--- a/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix
+++ b/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix
@@ -7,14 +7,14 @@
 }:
 buildLua (finalAttrs: {
   pname = "modernx-zydezu";
-  version = "0.4.1";
+  version = "0.4.2";
 
   scriptPath = "modernx.lua";
   src = fetchFromGitHub {
     owner = "zydezu";
     repo = "ModernX";
     rev = finalAttrs.version;
-    hash = "sha256-tm1vsHEFX2YnQ1w3DcLd/zHASetkqQ4wYcYT9w8HVok=";
+    hash = "sha256-7DkW3b0YEkV4VPURcg4kkUy8pSTFFb8jaJOuEtzTDow=";
   };
 
   postInstall = ''
diff --git a/pkgs/applications/video/obs-studio/plugins/default.nix b/pkgs/applications/video/obs-studio/plugins/default.nix
index 8019aa4a8b3a..4da72ab45f92 100644
--- a/pkgs/applications/video/obs-studio/plugins/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/default.nix
@@ -30,6 +30,8 @@
 
   obs-composite-blur = callPackage ./obs-composite-blur.nix { };
 
+  obs-dvd-screensaver = callPackage ./obs-dvd-screensaver.nix { };
+
   obs-freeze-filter = qt6Packages.callPackage ./obs-freeze-filter.nix { };
 
   obs-gradient-source = callPackage ./obs-gradient-source.nix { };
@@ -40,6 +42,8 @@
 
   obs-livesplit-one = callPackage ./obs-livesplit-one { };
 
+  obs-media-controls = qt6Packages.callPackage ./obs-media-controls.nix { };
+
   obs-move-transition = callPackage ./obs-move-transition.nix { };
 
   obs-multi-rtmp = qt6Packages.callPackage ./obs-multi-rtmp { };
@@ -48,16 +52,22 @@
 
   obs-ndi = qt6Packages.callPackage ./obs-ndi { };
 
+  obs-noise = callPackage ./obs-noise.nix { };
+
   obs-nvfbc = callPackage ./obs-nvfbc.nix { };
 
   obs-pipewire-audio-capture = callPackage ./obs-pipewire-audio-capture.nix { };
 
+  obs-recursion-effect = callPackage ./obs-recursion-effect.nix { };
+
   obs-replay-source = qt6Packages.callPackage ./obs-replay-source.nix { };
 
-  obs-rgb-levels-filter = callPackage ./obs-rgb-levels-filter.nix { };
+  obs-rgb-levels = callPackage ./obs-rgb-levels.nix { };
 
   obs-scale-to-sound = callPackage ./obs-scale-to-sound.nix { };
 
+  obs-scene-as-transition = callPackage ./obs-scene-as-transition.nix { };
+
   obs-shaderfilter = qt6Packages.callPackage ./obs-shaderfilter.nix { };
 
   obs-source-clone = callPackage ./obs-source-clone.nix { };
@@ -66,6 +76,8 @@
 
   obs-source-switcher = callPackage ./obs-source-switcher.nix { };
 
+  obs-stroke-glow-shadow = callPackage ./obs-stroke-glow-shadow.nix { };
+
   obs-teleport = callPackage ./obs-teleport { };
 
   obs-text-pthread = callPackage ./obs-text-pthread.nix { };
@@ -74,6 +86,8 @@
 
   obs-tuna = qt6Packages.callPackage ./obs-tuna { };
 
+  obs-urlsource = qt6Packages.callPackage ./obs-urlsource.nix { };
+
   obs-vaapi = callPackage ./obs-vaapi { };
 
   obs-vertical-canvas = qt6Packages.callPackage ./obs-vertical-canvas.nix { };
@@ -88,6 +102,8 @@
 
   obs-webkitgtk = callPackage ./obs-webkitgtk.nix { };
 
+  pixel-art = callPackage ./pixel-art.nix { };
+
   wlrobs = callPackage ./wlrobs.nix { };
 
   waveform = callPackage ./waveform { };
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-dvd-screensaver.nix b/pkgs/applications/video/obs-studio/plugins/obs-dvd-screensaver.nix
new file mode 100644
index 000000000000..ab7e6891b067
--- /dev/null
+++ b/pkgs/applications/video/obs-studio/plugins/obs-dvd-screensaver.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "obs-dvd-screensaver";
+  version = "0.0.2";
+
+  src = fetchFromGitHub {
+    owner = "wimpysworld";
+    repo = "obs-dvd-screensaver";
+    tag = "${finalAttrs.version}";
+    hash = "sha256-uZdFP3TULECzYNKtwaxFIcFYeFYdEoJ+ZKAqh9y9MEo=";
+  };
+  strictDeps = true;
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  meta = {
+    description = "DVD screen saver for OBS Studio";
+    homepage = "https://github.com/wimpysworld/obs-dvd-screensaver";
+    maintainers = with lib.maintainers; [ flexiondotorg ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-media-controls.nix b/pkgs/applications/video/obs-studio/plugins/obs-media-controls.nix
new file mode 100644
index 000000000000..39868bc33002
--- /dev/null
+++ b/pkgs/applications/video/obs-studio/plugins/obs-media-controls.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+  qtbase,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "obs-media-controls";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "exeldro";
+    repo = "obs-media-controls";
+    tag = "${finalAttrs.version}";
+    hash = "sha256-r9fqpg0G9rzGSqq5FUS8ul58rj0796aGZIND8PCJ9jk=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [
+    obs-studio
+    qtbase
+  ];
+
+  dontWrapQtApps = true;
+
+  postInstall = ''
+    rm -rf $out/obs-plugins $out/data
+  '';
+
+  meta = {
+    description = "Plugin for OBS Studio to add a Media Controls dock.";
+    homepage = "https://github.com/exeldro/obs-media-controls";
+    maintainers = with lib.maintainers; [ flexiondotorg ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-noise.nix b/pkgs/applications/video/obs-studio/plugins/obs-noise.nix
new file mode 100644
index 000000000000..e40348455940
--- /dev/null
+++ b/pkgs/applications/video/obs-studio/plugins/obs-noise.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-noise";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "FiniteSingularity";
+    repo = "obs-noise";
+    rev = "v${version}";
+    sha256 = "sha256-D9vGXCrmQ8IDRmL8qZ1ZBiOz9AjhKm45W37zC16kRCk=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  postFixup = ''
+    mv $out/data/obs-plugins/${pname}/shaders $out/share/obs/obs-plugins/${pname}/
+    rm -rf $out/data $out/obs-plugins
+  '';
+
+  meta = with lib; {
+    description = "A plug-in for noise generation and noise effects for OBS.";
+    homepage = "https://github.com/FiniteSingularity/obs-noise";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Only;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-recursion-effect.nix b/pkgs/applications/video/obs-studio/plugins/obs-recursion-effect.nix
new file mode 100644
index 000000000000..2158ce22db16
--- /dev/null
+++ b/pkgs/applications/video/obs-studio/plugins/obs-recursion-effect.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "obs-recursion-effect";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "exeldro";
+    repo = "obs-recursion-effect";
+    tag = "${finalAttrs.version}";
+    hash = "sha256-PeWJy423QbX4NULuS15LJ/IR/W+tXCJD9TjZdJOGk6A=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  # Fix OBS API deprecations warnings
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/exeldro/obs-recursion-effect/commit/889a8484d5c0eb33267b44ccda545a8fadc189a5.diff";
+      hash = "sha256-J2GnsoPUTqvEkuBuAae2TrxXMQg0Sm3dq75ZjGN65IE=";
+    })
+  ];
+
+  postInstall = ''
+    rm -rf $out/obs-plugins $out/data
+  '';
+
+  meta = {
+    description = "Plugin for OBS Studio to add recursion effect to a source using a filter";
+    homepage = "https://github.com/exeldro/obs-recursion-effect";
+    maintainers = with lib.maintainers; [ flexiondotorg ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-replay-source.nix b/pkgs/applications/video/obs-studio/plugins/obs-replay-source.nix
index b589a6639332..8279fee497f9 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-replay-source.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-replay-source.nix
@@ -3,44 +3,35 @@
   lib,
   fetchFromGitHub,
   cmake,
-  libcaption,
   obs-studio,
-  qtbase,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation rec {
   pname = "obs-replay-source";
   version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-replay-source";
-    tag = finalAttrs.version;
-    hash = "sha256-+PSALDqHXPyR0J7YnLn3QgPN6eIoH3yTIm1Bp7Li8c8=";
+    rev = version;
+    sha256 = "sha256-+PSALDqHXPyR0J7YnLn3QgPN6eIoH3yTIm1Bp7Li8c8=";
   };
 
   nativeBuildInputs = [ cmake ];
-
-  buildInputs = [
-    libcaption
-    obs-studio
-    qtbase
-  ];
+  buildInputs = [ obs-studio ];
 
   postInstall = ''
-    mkdir -p $out/lib $out/share
-    mv $out/obs-plugins/64bit $out/lib/obs-plugins
-    rm -rf $out/obs-plugins
-    mv $out/data $out/share/obs
+    rm -rf $out/obs-plugins $out/data
   '';
 
-  dontWrapQtApps = true;
-
-  meta = {
+  meta = with lib; {
     description = "Replay source for OBS studio";
     homepage = "https://github.com/exeldro/obs-replay-source";
-    license = lib.licenses.gpl2Only;
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ pschmitt ];
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [
+      flexiondotorg
+      pschmitt
+    ];
   };
-})
+}
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-rgb-levels-filter.nix b/pkgs/applications/video/obs-studio/plugins/obs-rgb-levels.nix
similarity index 50%
rename from pkgs/applications/video/obs-studio/plugins/obs-rgb-levels-filter.nix
rename to pkgs/applications/video/obs-studio/plugins/obs-rgb-levels.nix
index f51d7963089a..3779e14e4aee 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-rgb-levels-filter.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-rgb-levels.nix
@@ -7,28 +7,24 @@
 }:
 
 stdenv.mkDerivation rec {
-  pname = "obs-rgb-levels-filter";
-  version = "1.0.0";
+  pname = "obs-rgb-levels";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "wimpysworld";
-    repo = "obs-rgb-levels-filter";
+    repo = "obs-rgb-levels";
     rev = version;
-    sha256 = "sha256-QREwK9nBhjCBFslXUj9bGUGPgfEns8QqlgP5e2O/0oU=";
+    sha256 = "sha256-W79KUUUodlARlIMg/DaN+fxq/NEkp4k8MuEOHrJTbCk=";
   };
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ obs-studio ];
 
-  cmakeFlags = [
-    "-DOBS_SRC_DIR=${obs-studio.src}"
-  ];
-
   meta = with lib; {
-    description = "Simple OBS Studio filter to adjust RGB levels";
-    homepage = "https://github.com/wimpysworld/obs-rgb-levels-filter";
+    description = "A simple OBS Studio filter to adjust RGB levels.";
+    homepage = "https://github.com/wimpysworld/obs-rgb-levels";
     maintainers = with maintainers; [ flexiondotorg ];
-    license = licenses.gpl2Plus;
+    license = licenses.gpl2Only;
     platforms = [
       "x86_64-linux"
       "i686-linux"
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-scene-as-transition.nix b/pkgs/applications/video/obs-studio/plugins/obs-scene-as-transition.nix
new file mode 100644
index 000000000000..cb1e41b6d286
--- /dev/null
+++ b/pkgs/applications/video/obs-studio/plugins/obs-scene-as-transition.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-scene-as-transition";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "andilippi";
+    repo = "obs-scene-as-transition";
+    rev = "v${version}";
+    sha256 = "sha256-qeiJR68MqvhpzvY7yNnR6w77SvavlZTdbnGBWrd7iZM=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  postInstall = ''
+    rm -rf $out/obs-plugins $out/data
+  '';
+
+  meta = with lib; {
+    description = "An OBS Studio plugin that will allow you to use a Scene as a transition";
+    homepage = "https://github.com/andilippi/obs-scene-as-transition";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Plus;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-stroke-glow-shadow.nix b/pkgs/applications/video/obs-studio/plugins/obs-stroke-glow-shadow.nix
new file mode 100644
index 000000000000..5865f595a38e
--- /dev/null
+++ b/pkgs/applications/video/obs-studio/plugins/obs-stroke-glow-shadow.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obs-stroke-glow-shadow";
+  version = "v1.5.2";
+
+  src = fetchFromGitHub {
+    owner = "FiniteSingularity";
+    repo = "obs-stroke-glow-shadow";
+    rev = version;
+    sha256 = "sha256-+2hb4u+6UG7IV9pAvPjp4wvDYhYnxe98U5QQjUcdD/k=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  postFixup = ''
+    rm -rf $out/obs-plugins
+    rm -rf $out/data
+  '';
+
+  meta = with lib; {
+    description = "An OBS plugin to provide efficient Stroke, Glow, and Shadow effects on masked sources.";
+    homepage = "https://github.com/FiniteSingularity/obs-stroke-glow-shadow";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Only;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-urlsource.nix b/pkgs/applications/video/obs-studio/plugins/obs-urlsource.nix
new file mode 100644
index 000000000000..0ced62150e21
--- /dev/null
+++ b/pkgs/applications/video/obs-studio/plugins/obs-urlsource.nix
@@ -0,0 +1,98 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  curl,
+  git,
+  obs-studio,
+  pugixml,
+  qtbase,
+  writeScript,
+}:
+
+let
+  websocketpp = fetchFromGitHub {
+    owner = "zaphoyd";
+    repo = "websocketpp";
+    rev = "0.8.2";
+    sha256 = "sha256-9fIwouthv2GcmBe/UPvV7Xn9P2o0Kmn2hCI4jCh0hPM=";
+  };
+
+  lexbor = fetchFromGitHub {
+    owner = "lexbor";
+    repo = "lexbor";
+    rev = "v2.3.0";
+    sha256 = "sha256-s5fZWBhXC0fuHIUk1YX19bHagahOtSLlKQugyHCIlgI=";
+  };
+
+  asio = fetchFromGitHub {
+    owner = "chriskohlhoff";
+    repo = "asio";
+    rev = "asio-1-28-0";
+    sha256 = "sha256-dkiUdR8FgDnnqdptaJjE4rvNlgpC5HZl6SQQ5Di2C2s=";
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "obs-urlsource";
+  version = "0.3.7";
+
+  src = fetchFromGitHub {
+    owner = "locaal-ai";
+    repo = "obs-urlsource";
+    rev = version;
+    sha256 = "sha256-ZWwD8jJkL1rAUeanD4iChcgpnJaC5pPo36Ot36XOSx8=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    git
+  ];
+  buildInputs = [
+    curl
+    obs-studio
+    pugixml
+    qtbase
+  ];
+  dontWrapQtApps = true;
+
+  # Update websocketpp and lexabor configurations to use pre-fetched sources
+  postPatch = ''
+    sed -i 's|URL .*|SOURCE_DIR "${websocketpp}"\n    DOWNLOAD_COMMAND ""|' cmake/FetchWebsocketpp.cmake
+    sed -i \
+      -e 's|GIT_REPOSITORY .*|SOURCE_DIR "${lexbor}"|' \
+      -e 's|GIT_TAG .*|DOWNLOAD_COMMAND ""\n    UPDATE_COMMAND ""|' \
+      cmake/BuildLexbor.cmake
+  '';
+
+  postInstall = ''
+    rm -rf $out/lib/cmake
+  '';
+
+  NIX_CFLAGS_COMPILE = [
+    "-I${websocketpp}"
+    "-I${asio}/asio/include"
+  ];
+
+  cmakeFlags = [
+    # Prevent deprecation warnings from failing the build
+    (lib.cmakeOptionType "string" "CMAKE_CXX_FLAGS" "-Wno-error=deprecated-declarations")
+    (lib.cmakeBool "ENABLE_QT" true)
+    (lib.cmakeBool "USE_SYSTEM_CURL" true)
+    (lib.cmakeBool "USE_SYSTEM_PUGIXML" true)
+    (lib.cmakeBool "CMAKE_COMPILE_WARNING_AS_ERROR" false)
+    "-Wno-dev"
+  ];
+
+  meta = with lib; {
+    description = "OBS plugin to fetch data from a URL or file, connect to an API or AI service, parse responses and display text, image or audio on scene";
+    homepage = "https://github.com/locaal-ai/obs-urlsource";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Only;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}
diff --git a/pkgs/applications/video/obs-studio/plugins/pixel-art.nix b/pkgs/applications/video/obs-studio/plugins/pixel-art.nix
new file mode 100644
index 000000000000..dd01049e6802
--- /dev/null
+++ b/pkgs/applications/video/obs-studio/plugins/pixel-art.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  obs-studio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pixel-art";
+  version = "0.0.4";
+
+  src = fetchFromGitHub {
+    owner = "dspstanky";
+    repo = "pixel-art";
+    rev = version;
+    sha256 = "sha256-7o63e7nK/JsK2SQg0AzUYcc4ZsPx0lt8gtAQm8Zy+9w=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio ];
+
+  meta = with lib; {
+    description = "An OBS Plugin that can be used to create retro-inspired pixel art visuals.";
+    homepage = "https://github.com/dspstanky/pixel-art";
+    maintainers = with maintainers; [ flexiondotorg ];
+    license = licenses.gpl2Only;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+  };
+}
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
index 890bda27dff7..a25a2c419ec7 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
@@ -8,13 +8,13 @@
 
 mkHyprlandPlugin hyprland {
   pluginName = "hypr-dynamic-cursors";
-  version = "0-unstable-2025-05-08";
+  version = "0-unstable-2025-05-23";
 
   src = fetchFromGitHub {
     owner = "VirtCode";
     repo = "hypr-dynamic-cursors";
-    rev = "1aabd346eb7ad12a614fd18d095d13422d8b95b4";
-    hash = "sha256-KophdgmuoPO4adpgXxhDBAMQoRRoHjngiFWQxLoGgWY=";
+    rev = "761acf0e602e0f6549e5e6c0289a0402e6073489";
+    hash = "sha256-7L2MRMB2ONEh7wlgQzraEoA+0o88EOV87KNqZg7vpHA=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/build-support/agda/default.nix b/pkgs/build-support/agda/default.nix
index 957b423c31f6..45fa66ad4587 100644
--- a/pkgs/build-support/agda/default.nix
+++ b/pkgs/build-support/agda/default.nix
@@ -66,7 +66,7 @@ let
       ''
         mkdir -p $out/bin
         makeWrapper ${Agda.bin}/bin/agda $out/bin/agda \
-          --add-flags "--with-compiler=${ghc}/bin/ghc" \
+          ${lib.optionalString (ghc != null) ''--add-flags "--with-compiler=${ghc}/bin/ghc"''} \
           --add-flags "--library-file=${library-file}"
         ln -s ${Agda.bin}/bin/agda-mode $out/bin/agda-mode
       '';
diff --git a/pkgs/build-support/fetchgit/builder.sh b/pkgs/build-support/fetchgit/builder.sh
index 569a67182844..819b0127a852 100644
--- a/pkgs/build-support/fetchgit/builder.sh
+++ b/pkgs/build-support/fetchgit/builder.sh
@@ -13,6 +13,7 @@ $SHELL $fetcher --builder --url "$url" --out "$out" --rev "$rev" --name "$name"
   ${fetchLFS:+--fetch-lfs} \
   ${deepClone:+--deepClone} \
   ${fetchSubmodules:+--fetch-submodules} \
+  ${fetchTags:+--fetch-tags} \
   ${sparseCheckout:+--sparse-checkout "$sparseCheckout"} \
   ${nonConeMode:+--non-cone-mode} \
   ${branchName:+--branch-name "$branchName"}
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index 1da8d2591c5b..9fd433ff6d66 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -28,7 +28,7 @@ lib.makeOverridable (
       url,
       tag ? null,
       rev ? null,
-      leaveDotGit ? deepClone,
+      leaveDotGit ? deepClone || fetchTags,
       outputHash ? lib.fakeHash,
       outputHashAlgo ? null,
       fetchSubmodules ? true,
@@ -55,6 +55,8 @@ lib.makeOverridable (
       netrcImpureEnvVars ? [ ],
       meta ? { },
       allowedRequisites ? null,
+      # fetch all tags after tree (useful for git describe)
+      fetchTags ? false,
     }:
 
     /*
@@ -81,6 +83,7 @@ lib.makeOverridable (
     */
 
     assert nonConeMode -> (sparseCheckout != [ ]);
+    assert fetchTags -> leaveDotGit;
 
     let
       revWithTag =
@@ -136,6 +139,7 @@ lib.makeOverridable (
           nonConeMode
           preFetch
           postFetch
+          fetchTags
           ;
         rev = revWithTag;
 
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index 7ba7fa568cd6..9d55c9019e08 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -11,6 +11,7 @@ leaveDotGit=$NIX_PREFETCH_GIT_LEAVE_DOT_GIT
 fetchSubmodules=
 fetchLFS=
 builder=
+fetchTags=
 branchName=$NIX_PREFETCH_GIT_BRANCH_NAME
 
 # ENV params
@@ -56,6 +57,7 @@ Options:
       --leave-dotGit  Keep the .git directories.
       --fetch-lfs     Fetch git Large File Storage (LFS) files.
       --fetch-submodules Fetch submodules.
+      --fetch-tags    Fetch all tags (useful for git describe).
       --builder       Clone as fetchgit does, but url, rev, and out option are mandatory.
       --quiet         Only print the final json summary.
 "
@@ -86,6 +88,7 @@ for arg; do
             --leave-dotGit) leaveDotGit=true;;
             --fetch-lfs) fetchLFS=true;;
             --fetch-submodules) fetchSubmodules=true;;
+            --fetch-tags) fetchTags=true;;
             --builder) builder=true;;
             -h|--help) usage; exit;;
             *)
@@ -234,6 +237,12 @@ clone(){
         exit 1
     )
 
+    # Fetch all tags if requested
+    if test -n "$fetchTags"; then
+        echo "fetching all tags..." >&2
+        clean_git fetch origin 'refs/tags/*:refs/tags/*' || echo "warning: failed to fetch some tags" >&2
+    fi
+
     # Checkout linked sources.
     if test -n "$fetchSubmodules"; then
         init_submodules
@@ -403,6 +412,7 @@ print_results() {
   "fetchLFS": $([[ -n "$fetchLFS" ]] && echo true || echo false),
   "fetchSubmodules": $([[ -n "$fetchSubmodules" ]] && echo true || echo false),
   "deepClone": $([[ -n "$deepClone" ]] && echo true || echo false),
+  "fetchTags": $([[ -n "$fetchTags" ]] && echo true || echo false),
   "leaveDotGit": $([[ -n "$leaveDotGit" ]] && echo true || echo false)
 }
 EOF
diff --git a/pkgs/build-support/fetchgit/tests.nix b/pkgs/build-support/fetchgit/tests.nix
index e26917a4f673..ce733347cfa0 100644
--- a/pkgs/build-support/fetchgit/tests.nix
+++ b/pkgs/build-support/fetchgit/tests.nix
@@ -83,4 +83,16 @@
     rev = "v3.0.14";
     sha256 = "sha256-bd0Lx75Gd1pcBJtwz5WGki7XoYSpqhinCT3a77wpY2c=";
   };
+
+  fetchTags = testers.invalidateFetcherByDrvHash fetchgit {
+    name = "fetchgit-fetch-tags-test";
+    url = "https://github.com/NixOS/nix";
+    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+    fetchTags = true;
+    leaveDotGit = true;
+    sha256 = "sha256-2vfZnYjZlnC8ODz6B6aOqAqtb1Wbjojnn/5TmzwUrmo=";
+    postFetch = ''
+      cd $out && git describe --tags --always > describe-output.txt 2>&1 || echo "git describe failed" > describe-output.txt
+    '';
+  };
 }
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index fe2e42855e0e..95bb2d6ea3c4 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -909,7 +909,7 @@ rec {
         nativeBuildInputs = [
           buildPackages.perl
           buildPackages.dpkg
-          pkgs.nixfmt-rfc-style
+          buildPackages.nixfmt-rfc-style
         ];
       }
       ''
diff --git a/pkgs/by-name/_1/_1password-cli/package.nix b/pkgs/by-name/_1/_1password-cli/package.nix
index fbd1e8db8cc9..c3bfcf383d1f 100644
--- a/pkgs/by-name/_1/_1password-cli/package.nix
+++ b/pkgs/by-name/_1/_1password-cli/package.nix
@@ -23,13 +23,13 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.31.0";
+  version = "2.31.1";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-l42h6mGqcb7Wy1ryXM0gxnt2fUUDr8+4nc9qIG0nDgc=" "zip";
-    i686-linux = fetch "linux_386" "sha256-3oxBu0SAbWNgHZxirmKXm0Mk/uRZRPX/qCfYvkANTfM=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-hlktdQCGMtTIbd2j9x0aHKCIoIAydDj/caKaIWJfJTI=" "zip";
+    aarch64-linux = fetch "linux_arm64" "sha256-cFGIzB1452XVSkajHbD45Pxp8Hfu10q68nMnbE9dtzg=" "zip";
+    i686-linux = fetch "linux_386" "sha256-EckUFVr5MQ75XW4eHCxWt9vtcqzAFHLUDlmr//pcmf8=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-jPZxqaLrtBC42bGVOByKuORyl2YFicILlQDHkNuuJuc=" "zip";
     aarch64-darwin =
-      fetch "apple_universal" "sha256-PahPWQ4HpaOvEC1zda8X1Bft+8l/0qGWSJUEcfuWlxg="
+      fetch "apple_universal" "sha256-B71apQ2JPyyVHhavMziKNtLNs+WfCDdUEtvfwGFkE+Y="
         "pkg";
     x86_64-darwin = aarch64-darwin;
   };
diff --git a/pkgs/by-name/_1/_1password-gui/sources.json b/pkgs/by-name/_1/_1password-gui/sources.json
index 072a76f730b0..ef4f2c8ee395 100644
--- a/pkgs/by-name/_1/_1password-gui/sources.json
+++ b/pkgs/by-name/_1/_1password-gui/sources.json
@@ -1,38 +1,38 @@
 {
   "stable": {
     "x86_64-linux": {
-      "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.10.76.x64.tar.gz",
-      "hash": "sha256-vEbmZP0WQ0Ha92V/owFKtxavahWMpV73vRiflZ1dpzQ="
+      "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.10.78.x64.tar.gz",
+      "hash": "sha256-COmXSjbCetPsbm40OrWGVtULPheEgnHEO0ZcIgWaG1w="
     },
     "aarch64-linux": {
-      "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.10.76.arm64.tar.gz",
-      "hash": "sha256-4GHFLlpThIJ5oAVgwXUAy4Gb0569RLXK1kdLErOr6j8="
+      "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.10.78.arm64.tar.gz",
+      "hash": "sha256-diy7VhKRluSnVSR35Ogamf9RDHdqxSJifLOOYmMrJHE="
     },
     "x86_64-darwin": {
-      "url": "https://downloads.1password.com/mac/1Password-8.10.76-x86_64.zip",
-      "hash": "sha256-hAIVQ7QVpZzQqW5ikCjp6HsskQWH5bbzM85DNyY0hFQ="
+      "url": "https://downloads.1password.com/mac/1Password-8.10.78-x86_64.zip",
+      "hash": "sha256-8fbjEc/Z0xCdXq/uHp4bQE5Js5hNLbVCRZxnepUdLUs="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.1password.com/mac/1Password-8.10.76-aarch64.zip",
-      "hash": "sha256-jfdtLBsd1IvntJHZOJ0pxIrwjIUOcG3thfyjTMNIMK4="
+      "url": "https://downloads.1password.com/mac/1Password-8.10.78-aarch64.zip",
+      "hash": "sha256-x03dZ/eVrvFcbese1cBAvyJKwtWe6rOcgytn0OsEFDQ="
     }
   },
   "beta": {
     "x86_64-linux": {
-      "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.10.76-32.BETA.x64.tar.gz",
-      "hash": "sha256-149kU1CKQ0iLlD6O7jOjrcwwlxMdd5iAm53ILK2mv2o="
+      "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.10.80-18.BETA.x64.tar.gz",
+      "hash": "sha256-X2Wu/dQQ7fv+tTAU2/70S38wL6WdJuc/DXWoiHZvSP4="
     },
     "aarch64-linux": {
-      "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.10.76-32.BETA.arm64.tar.gz",
-      "hash": "sha256-xHurzI8OcooSOCkQlSgtOH1Bgdur2oO1sNwKUOvSckA="
+      "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.10.80-18.BETA.arm64.tar.gz",
+      "hash": "sha256-52aRg6QD/fKOzOHoG88q8VNJIizxnISFnpxek7bJ05w="
     },
     "x86_64-darwin": {
-      "url": "https://downloads.1password.com/mac/1Password-8.10.76-32.BETA-x86_64.zip",
-      "hash": "sha256-LgDl5DLUdn4bSRXrx11QOv0J6VXyns+KQgbU/Y0JxDU="
+      "url": "https://downloads.1password.com/mac/1Password-8.10.80-18.BETA-x86_64.zip",
+      "hash": "sha256-kUU+nm19DmdY8ZG6d+EJFQXcCy/BOauXh83suQLSvz0="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.1password.com/mac/1Password-8.10.76-32.BETA-aarch64.zip",
-      "hash": "sha256-mJFuejGiUKV0PEJF8ajiL3cMRQTRghoaCRyP8afatgY="
+      "url": "https://downloads.1password.com/mac/1Password-8.10.80-18.BETA-aarch64.zip",
+      "hash": "sha256-eZG0QaB5NRwRCYcmlfZA/HTceLq7eUzR+AvzDeOrzAY="
     }
   }
 }
diff --git a/pkgs/by-name/_1/_1password-gui/versions.json b/pkgs/by-name/_1/_1password-gui/versions.json
index 93f47b2a9435..491385dbe990 100644
--- a/pkgs/by-name/_1/_1password-gui/versions.json
+++ b/pkgs/by-name/_1/_1password-gui/versions.json
@@ -1,6 +1,6 @@
 {
-  "stable-linux": "8.10.76",
-  "stable-darwin": "8.10.76",
-  "beta-linux":"8.10.76-32.BETA",
-  "beta-darwin": "8.10.76-32.BETA"
+  "stable-linux": "8.10.78",
+  "stable-darwin": "8.10.78",
+  "beta-linux":"8.10.80-18.BETA",
+  "beta-darwin": "8.10.80-18.BETA"
 }
diff --git a/pkgs/by-name/_3/_3mux/package.nix b/pkgs/by-name/_3/_3mux/package.nix
index f56a328ce644..0364e9bd6968 100644
--- a/pkgs/by-name/_3/_3mux/package.nix
+++ b/pkgs/by-name/_3/_3mux/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "aaronjanse";
-    repo = pname;
+    repo = "3mux";
     rev = "v${version}";
     sha256 = "sha256-QT4QXTlJf2NfTqXE4GF759EoW6Ri12lxDyodyEFc+ag=";
   };
diff --git a/pkgs/by-name/aa/aaaaxy/package.nix b/pkgs/by-name/aa/aaaaxy/package.nix
index de8587f0ef8a..8c41dbe8c3da 100644
--- a/pkgs/by-name/aa/aaaaxy/package.nix
+++ b/pkgs/by-name/aa/aaaaxy/package.nix
@@ -26,7 +26,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "divVerent";
-    repo = pname;
+    repo = "aaaaxy";
     rev = "v${version}";
     hash = "sha256-4iL3+GeyOZoZN8IXo0jjSq3hYHKBTpytk8owXMdfACo=";
     fetchSubmodules = true;
diff --git a/pkgs/by-name/ag/agebox/package.nix b/pkgs/by-name/ag/agebox/package.nix
index 5267e0984456..5e71b011056a 100644
--- a/pkgs/by-name/ag/agebox/package.nix
+++ b/pkgs/by-name/ag/agebox/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "slok";
-    repo = pname;
+    repo = "agebox";
     rev = "v${version}";
     hash = "sha256-/FTNvGV7PsJmpSU1dI/kjfiY5G7shomvLd3bvFqORfg=";
   };
diff --git a/pkgs/by-name/ai/aiac/package.nix b/pkgs/by-name/ai/aiac/package.nix
index 82b3238ccbb8..8570da9a4621 100644
--- a/pkgs/by-name/ai/aiac/package.nix
+++ b/pkgs/by-name/ai/aiac/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "gofireflyio";
-    repo = pname;
+    repo = "aiac";
     rev = "v${version}";
     hash = "sha256-Lk3Bmzg1owkIWzz7jgq1YpdPyRzyZ7aNoWPIU5aWzu0=";
   };
diff --git a/pkgs/by-name/ai/aiodnsbrute/package.nix b/pkgs/by-name/ai/aiodnsbrute/package.nix
index bee53975d4ab..ee7202936ff6 100644
--- a/pkgs/by-name/ai/aiodnsbrute/package.nix
+++ b/pkgs/by-name/ai/aiodnsbrute/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "blark";
-    repo = pname;
+    repo = "aiodnsbrute";
     tag = "v${version}";
     hash = "sha256-cEpk71VoQJZfKeAZummkk7yjtXKSMndgo0VleYiMlWE=";
   };
diff --git a/pkgs/by-name/ai/airwindows/package.nix b/pkgs/by-name/ai/airwindows/package.nix
index ea41dc9fbf98..0048aa8be958 100644
--- a/pkgs/by-name/ai/airwindows/package.nix
+++ b/pkgs/by-name/ai/airwindows/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation {
   pname = "airwindows";
-  version = "0-unstable-2025-04-27";
+  version = "0-unstable-2025-05-18";
 
   src = fetchFromGitHub {
     owner = "airwindows";
     repo = "airwindows";
-    rev = "f8a3f0d1b4ba5ad15777a7143f338731b9658d1a";
-    hash = "sha256-Kdz8Q71LHeYhH+Lbgg9fhAYsC62LJLdQo5R+h9DwpXY=";
+    rev = "083d3d6df8ce3688fb328fd434e27653fa6433b5";
+    hash = "sha256-Pfh+zVsAqlP7aVtzTzdaTDB0E/d3bJrexsFm6n93ABQ=";
   };
 
   # we patch helpers because honestly im spooked out by where those variables
diff --git a/pkgs/by-name/al/align/package.nix b/pkgs/by-name/al/align/package.nix
index 12666a286b8f..4b5edb6f8a9c 100644
--- a/pkgs/by-name/al/align/package.nix
+++ b/pkgs/by-name/al/align/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "Guitarbum722";
-    repo = pname;
+    repo = "align";
     rev = "v${version}";
     sha256 = "17gs3417633z71kc6l5zqg4b3rjhpn2v8qs8rnfrk4nbwzz4nrq3";
   };
diff --git a/pkgs/by-name/al/alistral/package.nix b/pkgs/by-name/al/alistral/package.nix
index a817172589f3..1199b8f73079 100644
--- a/pkgs/by-name/al/alistral/package.nix
+++ b/pkgs/by-name/al/alistral/package.nix
@@ -10,26 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alistral";
-  version = "0.5.8";
+  version = "0.5.10";
 
   src = fetchFromGitHub {
     owner = "RustyNova016";
     repo = "Alistral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LSuNVfGus9kO1g4EfVCw6yWxudvYqBnM5mpJWH7MBCs=";
+    hash = "sha256-O19Btz6jLJJnCbAusRHKfUa6II8mofzifW+cbPOaHVI=";
   };
 
-  # remove if updating to rust 1.85
-  postPatch = ''
-    substituteInPlace Cargo.toml \
-      --replace-fail "[package]" ''$'cargo-features = ["edition2024"]\n[package]'\
-      --replace-fail 'rust-version = "1.85.0"' ""
-  '';
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-lq+0R5g4MwVm8ESjKpz+aymjpqcaAE856XnBtYXYs8A=";
-
-  env.RUSTC_BOOTSTRAP = 1;
+  cargoHash = "sha256-zQvPgigUQW9dpyLe7fgW8i9I4nm38bQKDLwezeSYx9Q=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/al/aliyun-cli/package.nix b/pkgs/by-name/al/aliyun-cli/package.nix
index 70bc20f74d59..912562c174b4 100644
--- a/pkgs/by-name/al/aliyun-cli/package.nix
+++ b/pkgs/by-name/al/aliyun-cli/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.277";
+  version = "3.0.278";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${version}";
-    hash = "sha256-4HWSebmMys3yzj2H3JC7hAayl9xQeVBQWCEGlZSudUc=";
+    hash = "sha256-SFoTeFKPUlP0clAP4gkPiNNVjqetJ8syNJDhGhNs6vo=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/al/alpaca/package.nix b/pkgs/by-name/al/alpaca/package.nix
index 8403c0b37c79..78b1263c3610 100644
--- a/pkgs/by-name/al/alpaca/package.nix
+++ b/pkgs/by-name/al/alpaca/package.nix
@@ -20,14 +20,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "alpaca";
-  version = "5.2.0";
+  version = "6.0.5";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "Jeffser";
     repo = "Alpaca";
     tag = version;
-    hash = "sha256-uUGsdHrqzA5fZ4LNtX04H4ue9n4JQrkTYW2PCCFYFHc=";
+    hash = "sha256-faxqSUYqf3vRZYeuXAzv+n1inMVwl5KmnndABF77Sus=";
   };
 
   nativeBuildInputs = [
@@ -51,7 +51,6 @@ python3Packages.buildPythonApplication rec {
     pygobject3
     requests
     pillow
-    pypdf
     html2text
     youtube-transcript-api
     pydbus
@@ -59,8 +58,13 @@ python3Packages.buildPythonApplication rec {
     pyicu
     matplotlib
     openai
+    markitdown
   ];
 
+  optional-dependencies = {
+    speech-to-text = [ python3Packages.openai-whisper ];
+  };
+
   dontWrapGApps = true;
 
   makeWrapperArgs = [
diff --git a/pkgs/by-name/al/altair/package.nix b/pkgs/by-name/al/altair/package.nix
index 38ae1087564e..074b78c145c0 100644
--- a/pkgs/by-name/al/altair/package.nix
+++ b/pkgs/by-name/al/altair/package.nix
@@ -7,11 +7,11 @@
 
 let
   pname = "altair";
-  version = "8.2.2";
+  version = "8.2.3";
 
   src = fetchurl {
     url = "https://github.com/imolorhe/altair/releases/download/v${version}/altair_${version}_x86_64_linux.AppImage";
-    sha256 = "sha256-3tLBZNuiqhSRg/a2g2PC53esnNb1jVFpCO2YiC7Rw6k=";
+    sha256 = "sha256-oOtQbTKD9UY+aXPqphGHeaXWxMI0/+9q82QaiQSXvwA=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/by-name/am/amazon-qldb-shell/package.nix b/pkgs/by-name/am/amazon-qldb-shell/package.nix
index 61a942bb021c..3967409eb9fe 100644
--- a/pkgs/by-name/am/amazon-qldb-shell/package.nix
+++ b/pkgs/by-name/am/amazon-qldb-shell/package.nix
@@ -14,7 +14,7 @@ let
 
     src = fetchFromGitHub {
       owner = "awslabs";
-      repo = pname;
+      repo = "amazon-qldb-shell";
       rev = "v${version}";
       sha256 = "sha256-aXScqJ1LijMSAy9YkS5QyXtTqxd19lLt3BbyVXlbw8o=";
     };
diff --git a/pkgs/by-name/am/amber/package.nix b/pkgs/by-name/am/amber/package.nix
index 8a8eef4bb0d2..968822579d8f 100644
--- a/pkgs/by-name/am/amber/package.nix
+++ b/pkgs/by-name/am/amber/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "dalance";
-    repo = pname;
+    repo = "amber";
     tag = "v${version}";
     sha256 = "sha256-q0o2PQngbDLumck27V0bIiB35zesn55Y+MwK2GjNVWo=";
   };
diff --git a/pkgs/by-name/am/amd-blis/package.nix b/pkgs/by-name/am/amd-blis/package.nix
index 9e798a882edd..7cb8b272d384 100644
--- a/pkgs/by-name/am/amd-blis/package.nix
+++ b/pkgs/by-name/am/amd-blis/package.nix
@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "amd-blis";
-  version = "5.0";
+  version = "5.1";
 
   src = fetchFromGitHub {
     owner = "amd";
     repo = "blis";
     rev = version;
-    hash = "sha256-E6JmV4W0plFJfOAPK1Vn7qkmFalwl6OjqSpxYnhAPmw=";
+    hash = "sha256-hqb/Q1CBqtC4AXqHNd7voewGUD675hJ9IwvP3Mn9b+M=";
   };
 
   inherit blas64;
diff --git a/pkgs/by-name/am/amdgpu_top/package.nix b/pkgs/by-name/am/amdgpu_top/package.nix
index a4627056ac62..d007ccf92adb 100644
--- a/pkgs/by-name/am/amdgpu_top/package.nix
+++ b/pkgs/by-name/am/amdgpu_top/package.nix
@@ -16,17 +16,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "amdgpu_top";
-  version = "0.10.4";
+  version = "0.10.5";
 
   src = fetchFromGitHub {
     owner = "Umio-Yasuno";
     repo = "amdgpu_top";
     rev = "v${version}";
-    hash = "sha256-OvxrcVjngIW/fVIPX1XhbGImAeDifoLzlaZpXUYS9FA=";
+    hash = "sha256-BT451a9S3hyugEFH1rHPiJLAb6LzB8rqMAZdWf4UNC8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-na6pghbJ7Ek+rdbX4qJt2kv7C3AAqpgU/nYHaT9CQdo=";
+  cargoHash = "sha256-bZuwouL8kuEhEiuLsehON1OEPKR3QtSHtn8HvXTovSs=";
 
   buildInputs = [
     libdrm
diff --git a/pkgs/by-name/am/amoco/package.nix b/pkgs/by-name/am/amoco/package.nix
index 42e76b5bd4e1..66e18956e439 100644
--- a/pkgs/by-name/am/amoco/package.nix
+++ b/pkgs/by-name/am/amoco/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "bdcht";
-    repo = pname;
+    repo = "amoco";
     rev = "v${version}";
     hash = "sha256-3+1ssFyU7SKFJgDYBQY0kVjmTHOD71D2AjnH+4bfLXo=";
   };
diff --git a/pkgs/by-name/am/amp-cli/package-lock.json b/pkgs/by-name/am/amp-cli/package-lock.json
index 4af359c48208..28c2a16ea664 100644
--- a/pkgs/by-name/am/amp-cli/package-lock.json
+++ b/pkgs/by-name/am/amp-cli/package-lock.json
@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "@sourcegraph/amp": "^0.0.1747886591-g90f24f"
+        "@sourcegraph/amp": "^0.0.1748404992-ga3f78f"
       }
     },
     "node_modules/@colors/colors": {
@@ -29,12 +29,14 @@
       }
     },
     "node_modules/@sourcegraph/amp": {
-      "version": "0.0.1747886591-g90f24f",
-      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1747886591-g90f24f.tgz",
-      "integrity": "sha512-therl4OchUfqcVPhG3YNJKjcZUvXadnfowKzJeZtVNZAcJMWz2+u0gZoWE+V8FPgrMaX/crYcYwPmiBl5NM6lg==",
+      "version": "0.0.1748404992-ga3f78f",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1748404992-ga3f78f.tgz",
+      "integrity": "sha512-+BvCW8zrbO7ENRzMg0LdAeKigjzL+ASIDBjJ/m2uL2CVT8WPk1h34FTNCbvnO6kssimEtdP8FcxR/2O4AHwUbA==",
       "dependencies": {
         "@types/runes": "^0.4.3",
         "@vscode/ripgrep": "1.15.11",
+        "commander": "^11.1.0",
+        "fuse.js": "^7.0.0",
         "runes": "^0.4.3",
         "string-width": "^6.1.0",
         "winston": "^3.17.0",
@@ -152,6 +154,15 @@
         "text-hex": "1.0.x"
       }
     },
+    "node_modules/commander": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-11.1.0.tgz",
+      "integrity": "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16"
+      }
+    },
     "node_modules/debug": {
       "version": "4.4.0",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.0.tgz",
@@ -208,6 +219,15 @@
       "integrity": "sha512-GRnmB5gPyJpAhTQdSZTSp9uaPSvl09KoYcMQtsB9rQoOmzs9dH6ffeccH+Z+cv6P68Hu5bC6JjRh4Ah/mHSNRw==",
       "license": "MIT"
     },
+    "node_modules/fuse.js": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/fuse.js/-/fuse.js-7.1.0.tgz",
+      "integrity": "sha512-trLf4SzuuUxfusZADLINj+dE8clK1frKdmqiJNb1Es75fmI5oY6X2mxLVUciLLjxqw/xr72Dhy+lER6dGd02FQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/https-proxy-agent": {
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
diff --git a/pkgs/by-name/am/amp-cli/package.nix b/pkgs/by-name/am/amp-cli/package.nix
index b1a7664d338b..f62ec5f897ea 100644
--- a/pkgs/by-name/am/amp-cli/package.nix
+++ b/pkgs/by-name/am/amp-cli/package.nix
@@ -8,11 +8,11 @@
 
 buildNpmPackage rec {
   pname = "amp-cli";
-  version = "0.0.1747886591-g90f24f";
+  version = "0.0.1748404992-ga3f78f";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${version}.tgz";
-    hash = "sha256-knNzJYGXmLuerlw6j+lbIf45uv0tYtMOfsIQVfpJ0Kc=";
+    hash = "sha256-axd5VP7afa4ptAl/y8CEVguqoRKVRhWfRDSI0sgyXqA=";
   };
 
   postPatch = ''
@@ -44,7 +44,7 @@ buildNpmPackage rec {
     chmod +x bin/amp-wrapper.js
   '';
 
-  npmDepsHash = "sha256-ir13FuVQtxEcryqmSh5BOdrCUWeXAUUX72BYZweUNBU=";
+  npmDepsHash = "sha256-05+hBr+eX3I92U9TsqPQrYcJCmKXTvz3n6ZTxR1XvC8=";
 
   propagatedBuildInputs = [
     ripgrep
@@ -71,7 +71,7 @@ buildNpmPackage rec {
   passthru.updateScript = ./update.sh;
 
   meta = {
-    description = "Amp is an AI coding agent, in research preview from Sourcegraph. This is the CLI for Amp.";
+    description = "CLI for Amp, an agentic coding agent in research preview from Sourcegraph";
     homepage = "https://ampcode.com/";
     downloadPage = "https://www.npmjs.com/package/@sourcegraph/amp";
     license = lib.licenses.unfree;
diff --git a/pkgs/by-name/am/amphetype/package.nix b/pkgs/by-name/am/amphetype/package.nix
index 286a2cc162cb..26d990224685 100644
--- a/pkgs/by-name/am/amphetype/package.nix
+++ b/pkgs/by-name/am/amphetype/package.nix
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication {
 
   src = fetchFromGitLab {
     owner = "franksh";
-    repo = pname;
+    repo = "amphetype";
     rev = "v${version}";
     hash = "sha256-pve2f+XMfFokMCtW3KdeOJ9Ey330Gwv/dk1+WBtrBEQ=";
   };
@@ -48,14 +48,14 @@ python3Packages.buildPythonApplication {
 
   desktopItems = [
     (makeDesktopItem {
-      name = pname;
+      name = "amphetype";
       desktopName = "Amphetype";
       genericName = "Typing Practice";
       categories = [
         "Education"
         "Qt"
       ];
-      exec = pname;
+      exec = "amphetype";
       comment = description;
     })
   ];
diff --git a/pkgs/by-name/an/anyrun/package.nix b/pkgs/by-name/an/anyrun/package.nix
index 232cb1c23748..76061af6b4ab 100644
--- a/pkgs/by-name/an/anyrun/package.nix
+++ b/pkgs/by-name/an/anyrun/package.nix
@@ -17,13 +17,13 @@
 
 rustPlatform.buildRustPackage {
   pname = "anyrun";
-  version = "0-unstable-2025-04-29";
+  version = "0-unstable-2025-05-19";
 
   src = fetchFromGitHub {
     owner = "kirottu";
     repo = "anyrun";
-    rev = "005333a60c03cf58e0a59b03e76989441276e88b";
-    hash = "sha256-0zJs4J4w1jG83hByNJ+WxANHW7sLzMdvA408LDCCnTY=";
+    rev = "54b462b87129cf059a348fc3a6cc170b9714e0e7";
+    hash = "sha256-7VcdMOgQ/PRLr0bnJwNWZX7asrWbRJlLFw21xffm6g8=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/ao/aoc-cli/package.nix b/pkgs/by-name/ao/aoc-cli/package.nix
index f63e2586bc79..a36e21b53919 100644
--- a/pkgs/by-name/ao/aoc-cli/package.nix
+++ b/pkgs/by-name/ao/aoc-cli/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "scarvalhojr";
-    repo = pname;
+    repo = "aoc-cli";
     rev = version;
     hash = "sha256-UdeCKhEWr1BjQ6OMLP19OLWPlvvP7FGAO+mi+bQUPQA=";
   };
diff --git a/pkgs/by-name/ap/apkg/package.nix b/pkgs/by-name/ap/apkg/package.nix
index be42b1ac9d1d..91a1a20e2d63 100644
--- a/pkgs/by-name/ap/apkg/package.nix
+++ b/pkgs/by-name/ap/apkg/package.nix
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitLab {
     domain = "gitlab.nic.cz";
     owner = "packaging";
-    repo = pname;
+    repo = "apkg";
     rev = "v${version}";
     hash = "sha256-VQNUzbWIDo/cbCdtx8JxN5UUMBW3mQ2B42In4b3AA+A=";
   };
diff --git a/pkgs/by-name/ap/appflowy/package.nix b/pkgs/by-name/ap/appflowy/package.nix
index 7c5dc7e4b330..5eef97b1fa68 100644
--- a/pkgs/by-name/ap/appflowy/package.nix
+++ b/pkgs/by-name/ap/appflowy/package.nix
@@ -17,11 +17,11 @@ let
     rec {
       x86_64-linux = {
         urlSuffix = "linux-x86_64.tar.gz";
-        hash = "sha256-EuioRmdN4kUDh2P4Qb5YQZeNZqxwBgZ57VsY0YD1ru4=";
+        hash = "sha256-2DdYPtEejIt5SUg4UjbYUMN4K+E3S1QbipKKL7IlQpY=";
       };
       x86_64-darwin = {
         urlSuffix = "macos-universal.zip";
-        hash = "sha256-uLM6hMASA9D5rOChgLnPsfeCAmgoo0IW8CsyfgRGBIU=";
+        hash = "sha256-J/lmjIbZp54Ntdrf8oiGQe3sf7LcTfDO6SgecxofrVM=";
       };
       aarch64-darwin = x86_64-darwin;
     }
@@ -30,7 +30,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "appflowy";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchzip {
     url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${finalAttrs.version}/AppFlowy-${finalAttrs.version}-${dist.urlSuffix}";
diff --git a/pkgs/by-name/ap/appvm/package.nix b/pkgs/by-name/ap/appvm/package.nix
index 5947b482ad9a..6b60aca231bc 100644
--- a/pkgs/by-name/ap/appvm/package.nix
+++ b/pkgs/by-name/ap/appvm/package.nix
@@ -26,7 +26,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jollheef";
-    repo = pname;
+    repo = "appvm";
     tag = "v${version}";
     sha256 = "sha256-n+YputGiNWSOYbwes/rjz0h3RWZONDTc8+LDc0La/KU=";
   };
@@ -47,7 +47,7 @@ buildGoModule rec {
 
   meta = {
     description = "Nix-based app VMs";
-    homepage = "https://code.dumpstack.io/tools/${pname}";
+    homepage = "https://code.dumpstack.io/tools/appvm";
     maintainers = with lib.maintainers; [
       dump_stack
       cab404
diff --git a/pkgs/by-name/aq/aquosctl/package.nix b/pkgs/by-name/aq/aquosctl/package.nix
index cbc018674c94..ebb64e54246a 100644
--- a/pkgs/by-name/aq/aquosctl/package.nix
+++ b/pkgs/by-name/aq/aquosctl/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   src = fetchFromGitHub {
     owner = "jdwhite";
-    repo = pname;
+    repo = "aquosctl";
     rev = "b5e48d9ef848188b97dfb24bfcc99d5196cab5f6";
     hash = "sha256-FA3LR58KMG5RzSxxnOkVw1+inM/gMGPtw5+JQwSHBYs=";
   };
diff --git a/pkgs/by-name/ar/archiver/package.nix b/pkgs/by-name/ar/archiver/package.nix
index ed8f4c909ccf..474f9c746034 100644
--- a/pkgs/by-name/ar/archiver/package.nix
+++ b/pkgs/by-name/ar/archiver/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "mholt";
-    repo = pname;
+    repo = "archiver";
     rev = "v${version}";
     hash = "sha256-l9exOq8QF3WSQ/+WQr0NfPeRQ/R6VQwfT+YS76BBwd8=";
   };
diff --git a/pkgs/by-name/ar/arduinoOTA/package.nix b/pkgs/by-name/ar/arduinoOTA/package.nix
index 218b38db301d..ac86e5fac134 100644
--- a/pkgs/by-name/ar/arduinoOTA/package.nix
+++ b/pkgs/by-name/ar/arduinoOTA/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "arduino";
-    repo = pname;
+    repo = "arduinoOTA";
     rev = version;
     hash = "sha256-HaNMkeV/PDEotYp8+rUKFaBxGbZO8qA99Yp2sa6glz8=";
   };
diff --git a/pkgs/by-name/ar/argocd-vault-plugin/package.nix b/pkgs/by-name/ar/argocd-vault-plugin/package.nix
index e3e7496c5db2..cf8995226633 100644
--- a/pkgs/by-name/ar/argocd-vault-plugin/package.nix
+++ b/pkgs/by-name/ar/argocd-vault-plugin/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "argoproj-labs";
-    repo = pname;
+    repo = "argocd-vault-plugin";
     rev = "v${version}";
     hash = "sha256-rWNR4GVivuEprdX/xhwk/9SReeJ19UWDWx8Bf8z6CTI=";
   };
diff --git a/pkgs/by-name/ar/aribb25/package.nix b/pkgs/by-name/ar/aribb25/package.nix
index 820ae89b83ca..211d2c548b6a 100644
--- a/pkgs/by-name/ar/aribb25/package.nix
+++ b/pkgs/by-name/ar/aribb25/package.nix
@@ -8,7 +8,7 @@
   pcsclite,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "aribb25";
   # FIXME: change the rev for fetchFromGitLab in next release
   version = "0.2.7";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "videolan";
-    repo = pname;
+    repo = "aribb25";
     # rev = version; FIXME: uncomment in next release
     rev = "c14938692b313b5ba953543fd94fd1cad0eeef18"; # 0.2.7 with build fixes
     sha256 = "1kb9crfqib0npiyjk4zb63zqlzbhqm35nz8nafsvdjd71qbd2amp";
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   patches =
     let
-      url = commit: "https://code.videolan.org/videolan/${pname}/-/commit/${commit}.diff";
+      url = commit: "https://code.videolan.org/videolan/aribb25/-/commit/${commit}.diff";
     in
     [
       (fetchpatch {
diff --git a/pkgs/by-name/ar/arrayfire/package.nix b/pkgs/by-name/ar/arrayfire/package.nix
index d0259c6016b2..96a564dfe128 100644
--- a/pkgs/by-name/ar/arrayfire/package.nix
+++ b/pkgs/by-name/ar/arrayfire/package.nix
@@ -62,8 +62,8 @@ stdenv.mkDerivation rec {
   version = "3.9.0";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "arrayfire";
+    repo = "arrayfire";
     rev = "v3.9.0";
     hash = "sha256-80fxdkaeAQ5u0X/UGPaI/900cdkZ/vXNcOn5tkZ+C3Y=";
   };
@@ -74,25 +74,25 @@ stdenv.mkDerivation rec {
   #
   # This can be removed once ArrayFire upstream their changes.
   clfft = fetchFromGitHub {
-    owner = pname;
+    owner = "arrayfire";
     repo = "clfft";
     rev = "760096b37dcc4f18ccd1aac53f3501a83b83449c";
     sha256 = "sha256-vJo1YfC2AJIbbRj/zTfcOUmi0Oj9v64NfA9MfK8ecoY=";
   };
   glad = fetchFromGitHub {
-    owner = pname;
+    owner = "arrayfire";
     repo = "glad";
     rev = "ef8c5508e72456b714820c98e034d9a55b970650";
     sha256 = "sha256-u9Vec7XLhE3xW9vzM7uuf+b18wZsh/VMtGbB6nMVlno=";
   };
   threads = fetchFromGitHub {
-    owner = pname;
+    owner = "arrayfire";
     repo = "threads";
     rev = "4d4a4f0384d1ac2f25b2c4fc1d57b9e25f4d6818";
     sha256 = "sha256-qqsT9woJDtQvzuV323OYXm68pExygYs/+zZNmg2sN34=";
   };
   test-data = fetchFromGitHub {
-    owner = pname;
+    owner = "arrayfire";
     repo = "arrayfire-data";
     rev = "a5f533d7b864a4d8f0dd7c9aaad5ff06018c4867";
     sha256 = "sha256-AWzhsrDXyZrQN2bd0Ng/XlE8v02x7QWTiFTyaAuRXSw=";
diff --git a/pkgs/by-name/as/asciigraph/package.nix b/pkgs/by-name/as/asciigraph/package.nix
index ec9151cd9a90..f70593abe5e5 100644
--- a/pkgs/by-name/as/asciigraph/package.nix
+++ b/pkgs/by-name/as/asciigraph/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "guptarohit";
-    repo = pname;
+    repo = "asciigraph";
     rev = "v${version}";
     sha256 = "sha256-+4aGkumO42cloHWV8qEEJ5bj8TTdtfXTWGFCgCRE4Mg=";
   };
diff --git a/pkgs/by-name/as/assign-lb-ip/package.nix b/pkgs/by-name/as/assign-lb-ip/package.nix
index f3fa137a6392..b80fd5c5ce23 100644
--- a/pkgs/by-name/as/assign-lb-ip/package.nix
+++ b/pkgs/by-name/as/assign-lb-ip/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "Nordix";
-    repo = pname;
+    repo = "assign-lb-ip";
     rev = "v${version}";
     sha256 = "sha256-Sfi58wcX61HNCmlDoparTqnfsuxu6barSnV0uYlC+ng=";
   };
diff --git a/pkgs/by-name/as/asuka/package.nix b/pkgs/by-name/as/asuka/package.nix
index 32ae8dfc7d8c..a46f24708d14 100644
--- a/pkgs/by-name/as/asuka/package.nix
+++ b/pkgs/by-name/as/asuka/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromSourcehut {
     owner = "~julienxx";
-    repo = pname;
+    repo = "asuka";
     rev = version;
     sha256 = "sha256-+rj6P3ejc4Qb/uqbf3N9MqyqDT7yg9JFE0yfW/uzd6M=";
   };
diff --git a/pkgs/by-name/at/atomic-operator/package.nix b/pkgs/by-name/at/atomic-operator/package.nix
index 89d7e6840451..711bcdd7ce91 100644
--- a/pkgs/by-name/at/atomic-operator/package.nix
+++ b/pkgs/by-name/at/atomic-operator/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "swimlane";
-    repo = pname;
+    repo = "atomic-operator";
     rev = version;
     hash = "sha256-DyNqu3vndyLkmfybCfTbgxk3t/ALg7IAkAMg4kBkH7Q=";
   };
diff --git a/pkgs/by-name/at/atomicparsley/package.nix b/pkgs/by-name/at/atomicparsley/package.nix
index 823693975ac0..75f736148ea2 100644
--- a/pkgs/by-name/at/atomicparsley/package.nix
+++ b/pkgs/by-name/at/atomicparsley/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "wez";
-    repo = pname;
+    repo = "atomicparsley";
     rev = version;
     sha256 = "sha256-VhrOMpGNMkNNYjcfCqlHI8gdApWr1ThtcxDwQ6gyV/g=";
   };
diff --git a/pkgs/by-name/au/ausweiskopie/package.nix b/pkgs/by-name/au/ausweiskopie/package.nix
index 2a33cdd80b6f..e7b6db1c15f6 100644
--- a/pkgs/by-name/au/ausweiskopie/package.nix
+++ b/pkgs/by-name/au/ausweiskopie/package.nix
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "Varbin";
-    repo = pname;
+    repo = "ausweiskopie";
     tag = "v${version}";
     hash = "sha256-axy/cI5n2uvMKZ2Fkb0seFMRBKv6rpU01kgKSiQ10jE=";
   };
diff --git a/pkgs/by-name/au/auth0-cli/package.nix b/pkgs/by-name/au/auth0-cli/package.nix
index 999362ef86b6..641488703fb9 100644
--- a/pkgs/by-name/au/auth0-cli/package.nix
+++ b/pkgs/by-name/au/auth0-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "auth0-cli";
-  version = "1.13.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "auth0";
     repo = "auth0-cli";
     tag = "v${version}";
-    hash = "sha256-RcRJBW8FgCi9Lxz/KARql7ArozqYgttpQ9IXIKzvo6s=";
+    hash = "sha256-SrevadJWgs7nxRTfTG/3MhCaZ1F0F0re7q2KI4kPyeo=";
   };
 
-  vendorHash = "sha256-6y2iGxaromnMYIU2rnvwmQwn8f1PdihB4DH9r5sRT68=";
+  vendorHash = "sha256-y7tRtK1R/K7JIcMIeGU1OXhl4Cs3L3zW5rtbTuvjQZc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/au/authz0/package.nix b/pkgs/by-name/au/authz0/package.nix
index fa500b9b8064..ebac18bcfe67 100644
--- a/pkgs/by-name/au/authz0/package.nix
+++ b/pkgs/by-name/au/authz0/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "hahwul";
-    repo = pname;
+    repo = "authz0";
     rev = "v${version}";
     hash = "sha256-NrArxuhzd57NIdM4d9p/wfCB1e6l83pV+cjjCgZ9YtM=";
   };
diff --git a/pkgs/by-name/au/autocorrect/package.nix b/pkgs/by-name/au/autocorrect/package.nix
index ec62b9adca50..ac54d6b6756b 100644
--- a/pkgs/by-name/au/autocorrect/package.nix
+++ b/pkgs/by-name/au/autocorrect/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "huacnlee";
-    repo = pname;
+    repo = "autocorrect";
     rev = "v${version}";
     sha256 = "sha256-fwq+Q2GpPXWfIQjfSACBjdyjrmYwVKSSZxCy3+NIKNI=";
   };
diff --git a/pkgs/by-name/au/autorestic/package.nix b/pkgs/by-name/au/autorestic/package.nix
index 4df100e0bfaf..632cd25d7577 100644
--- a/pkgs/by-name/au/autorestic/package.nix
+++ b/pkgs/by-name/au/autorestic/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "cupcakearmy";
-    repo = pname;
+    repo = "autorestic";
     rev = "v${version}";
     sha256 = "sha256-rladzcW6l5eR6ICj4kKd4e2R9vRIV/1enCzHLFdQDlk=";
   };
diff --git a/pkgs/by-name/au/autosuspend/package.nix b/pkgs/by-name/au/autosuspend/package.nix
index 52eb5146fc30..7b3a05412b2e 100644
--- a/pkgs/by-name/au/autosuspend/package.nix
+++ b/pkgs/by-name/au/autosuspend/package.nix
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "languitar";
-    repo = pname;
+    repo = "autosuspend";
     tag = "v${version}";
     hash = "sha256-of2b5K4ccONPGZfUwEIoFs86xLM2aLCV8tVGxVqykiQ=";
   };
diff --git a/pkgs/by-name/av/aviator/package.nix b/pkgs/by-name/av/aviator/package.nix
index 17b7a7d2e7cf..8322341497a2 100644
--- a/pkgs/by-name/av/aviator/package.nix
+++ b/pkgs/by-name/av/aviator/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "herrjulz";
-    repo = pname;
+    repo = "aviator";
     rev = "v${version}";
     sha256 = "sha256-Oa4z8n+q7LKWMnwk+xj9UunzOa3ChaPBCTo828yYJGQ=";
   };
diff --git a/pkgs/by-name/av/avizo/package.nix b/pkgs/by-name/av/avizo/package.nix
index 47a44f05aa73..cbec1c25b6b2 100644
--- a/pkgs/by-name/av/avizo/package.nix
+++ b/pkgs/by-name/av/avizo/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "avizo";
-  version = "1.3";
+  version = "1.3-unstable-2024-11-03";
 
   src = fetchFromGitHub {
     owner = "misterdanb";
     repo = "avizo";
-    rev = version;
-    sha256 = "sha256-Vj8OrNlAstl0AXTeVAPdEf5JgnAmJwl9s3Jdc0ZiYQc=";
+    rev = "5efaa22968b2cc1a3c15a304cac3f22ec2727b17";
+    sha256 = "sha256-KYQPHVxjvqKt4d7BabplnrXP30FuBQ6jQ1NxzR5U7qI=";
   };
 
   nativeBuildInputs = [
@@ -59,6 +59,9 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/misterdanb/avizo";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = [ maintainers.berbiche ];
+    maintainers = [
+      maintainers.berbiche
+      maintainers.flexiondotorg
+    ];
   };
 }
diff --git a/pkgs/by-name/aw/aws-c-io/package.nix b/pkgs/by-name/aw/aws-c-io/package.nix
index ddf698b7bb54..2d6201cf37a2 100644
--- a/pkgs/by-name/aw/aws-c-io/package.nix
+++ b/pkgs/by-name/aw/aws-c-io/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "awslabs";
-    repo = pname;
+    repo = "aws-c-io";
     rev = "v${version}";
     hash = "sha256-/pG/+MHAu/TYTtY/RQrr1U1ev2FZ1p/O8kIRUDDOcvQ=";
   };
diff --git a/pkgs/by-name/aw/aws-gate/package.nix b/pkgs/by-name/aw/aws-gate/package.nix
index b7282325d761..6e72b6a6616f 100644
--- a/pkgs/by-name/aw/aws-gate/package.nix
+++ b/pkgs/by-name/aw/aws-gate/package.nix
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "xen0l";
-    repo = pname;
+    repo = "aws-gate";
     rev = version;
     hash = "sha256-9w2jP4s1HXf1gYiXX05Dt2iXt0bR0U48yc8h9T5M+EQ=";
   };
@@ -52,7 +52,7 @@ python3Packages.buildPythonApplication rec {
   '';
 
   checkPhase = ''
-    $out/bin/${pname} --version
+    $out/bin/aws-gate --version
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/aw/aws-iam-authenticator/package.nix b/pkgs/by-name/aw/aws-iam-authenticator/package.nix
index 40957f4d229c..5bd7daaaf416 100644
--- a/pkgs/by-name/aw/aws-iam-authenticator/package.nix
+++ b/pkgs/by-name/aw/aws-iam-authenticator/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
-    repo = pname;
+    repo = "aws-iam-authenticator";
     tag = "v${version}";
     hash = "sha256-ZoK6GYAGNIRNzKAn1m5SaytBwEpufqDBWo2oJB4YA8c=";
   };
diff --git a/pkgs/by-name/aw/aws-sso-cli/package.nix b/pkgs/by-name/aw/aws-sso-cli/package.nix
index c46a6230b9da..4c1d3935204c 100644
--- a/pkgs/by-name/aw/aws-sso-cli/package.nix
+++ b/pkgs/by-name/aw/aws-sso-cli/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "synfinatic";
-    repo = pname;
+    repo = "aws-sso-cli";
     rev = "v${version}";
     hash = "sha256-hzX5gqr8tJk9EtP3ophbJ5m3rb92ZOs9UuDVTvxFcpI=";
   };
diff --git a/pkgs/by-name/aw/aws-sso-creds/package.nix b/pkgs/by-name/aw/aws-sso-creds/package.nix
index 3a7a5f115f67..e5a431a7c5bc 100644
--- a/pkgs/by-name/aw/aws-sso-creds/package.nix
+++ b/pkgs/by-name/aw/aws-sso-creds/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jaxxstorm";
-    repo = pname;
+    repo = "aws-sso-creds";
     rev = "v${version}";
     sha256 = "sha256-QYE+HvvBEWPxopVP8QMqb4lNRyAtVDewuiWzja9XdM4=";
   };
diff --git a/pkgs/by-name/aw/aws-vault/package.nix b/pkgs/by-name/aw/aws-vault/package.nix
index bd08e2269a09..b868b140f2d8 100644
--- a/pkgs/by-name/aw/aws-vault/package.nix
+++ b/pkgs/by-name/aw/aws-vault/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "99designs";
-    repo = pname;
+    repo = "aws-vault";
     rev = "v${version}";
     hash = "sha256-Qs4vxFgehWQYYECBGBSU8YI/BHLwOQUO5wBlNEUzD7c=";
   };
diff --git a/pkgs/by-name/aw/aws-workspaces/workspacesclient.nix b/pkgs/by-name/aw/aws-workspaces/workspacesclient.nix
index b1234722ec64..4c4d93b53cd1 100644
--- a/pkgs/by-name/aw/aws-workspaces/workspacesclient.nix
+++ b/pkgs/by-name/aw/aws-workspaces/workspacesclient.nix
@@ -12,15 +12,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "workspacesclient";
-  version = "2024.8.5191";
+  version = "2025.0.5296";
 
   src = fetchurl {
     urls = [
       # Check new version at https://d3nt0h4h6pmmc4.cloudfront.net/ubuntu/dists/jammy/main/binary-amd64/Packages
       "https://d3nt0h4h6pmmc4.cloudfront.net/ubuntu/dists/jammy/main/binary-amd64/workspacesclient_${finalAttrs.version}_amd64.deb"
-      "https://d3nt0h4h6pmmc4.cloudfront.net/new_workspacesclient_jammy_amd64.deb"
     ];
-    hash = "sha256-BDxMycVgWciJZe8CtElXaWVnqYDQO5NmawK10GvP2+k=";
+    hash = "sha256-VPNZN9AsrGJ56O8B5jxlgLMvrUViTv6yto8c5pGQc0A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/aw/awslogs/package.nix b/pkgs/by-name/aw/awslogs/package.nix
index e90da6b3fee4..173e59944b61 100644
--- a/pkgs/by-name/aw/awslogs/package.nix
+++ b/pkgs/by-name/aw/awslogs/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "jorgebastida";
-    repo = pname;
+    repo = "awslogs";
     rev = version;
     sha256 = "sha256-o6xZqwlqAy01P+TZ0rB5rpEddWNUBzzHp7/cycpcwes=";
   };
diff --git a/pkgs/by-name/aw/awsls/package.nix b/pkgs/by-name/aw/awsls/package.nix
index 4ea289d01b55..aafdfdd850ef 100644
--- a/pkgs/by-name/aw/awsls/package.nix
+++ b/pkgs/by-name/aw/awsls/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jckuester";
-    repo = pname;
+    repo = "awsls";
     rev = "v${version}";
     sha256 = "sha256-iy9tohmVUtNXYVfe6pZ+pbbLlcK6Fu1GgzTWMD+3xP0=";
   };
diff --git a/pkgs/by-name/aw/awsrm/package.nix b/pkgs/by-name/aw/awsrm/package.nix
index 20d0e120ed43..cb415a3182a9 100644
--- a/pkgs/by-name/aw/awsrm/package.nix
+++ b/pkgs/by-name/aw/awsrm/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jckuester";
-    repo = pname;
+    repo = "awsrm";
     rev = "v${version}";
     sha256 = "sha256-KAujqYDtZbCBRO5WK9b9mxqe84ZllbBoO2tLnDH/bdo=";
   };
diff --git a/pkgs/by-name/aw/awsweeper/package.nix b/pkgs/by-name/aw/awsweeper/package.nix
index 2a37ef68238e..954f8e7d9456 100644
--- a/pkgs/by-name/aw/awsweeper/package.nix
+++ b/pkgs/by-name/aw/awsweeper/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jckuester";
-    repo = pname;
+    repo = "awsweeper";
     rev = "v${version}";
     sha256 = "sha256-5D/4Z8ADlA+4+2EINmP5OfX5exzhfbq2TydPRlJDA6Y=";
   };
diff --git a/pkgs/by-name/ba/badrobot/package.nix b/pkgs/by-name/ba/badrobot/package.nix
index b43b46894d58..79197e8f539a 100644
--- a/pkgs/by-name/ba/badrobot/package.nix
+++ b/pkgs/by-name/ba/badrobot/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "controlplaneio";
-    repo = pname;
+    repo = "badrobot";
     rev = "v${version}";
     sha256 = "sha256-U3b5Xw+GjnAEXteivztHdcAcXx7DYtgaUbW5oax0mIk=";
   };
diff --git a/pkgs/by-name/ba/basedpyright/package.nix b/pkgs/by-name/ba/basedpyright/package.nix
index 31dbedb36fe3..f65ebd810d35 100644
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@@ -16,16 +16,16 @@
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.29.1";
+  version = "1.29.2";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-DUcrR4UwqbP968QYPsjivf2FOUL6hwr5ZAGH+qA8Xtw=";
+    hash = "sha256-xzbIAzZS6kCrFDcbh7uFWV8Rbs91yx25RVKeGMSM5Dc=";
   };
 
-  npmDepsHash = "sha256-wzetOJxHJXK7oY1cwOG9YOrKKIDhFPD17em6UQ2859M=";
+  npmDepsHash = "sha256-s2Bavzd1IGuI7HfdKLAsFWHmr1RxBZO/21KXt060jbI=";
   npmWorkspace = "packages/pyright";
 
   preBuild = ''
diff --git a/pkgs/by-name/ba/bazel-gazelle/package.nix b/pkgs/by-name/ba/bazel-gazelle/package.nix
index 65d514eb6438..3cebe0fa394f 100644
--- a/pkgs/by-name/ba/bazel-gazelle/package.nix
+++ b/pkgs/by-name/ba/bazel-gazelle/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
-    repo = pname;
+    repo = "bazel-gazelle";
     rev = "v${version}";
     hash = "sha256-jj2mAGzz5BOim008LNRH0tVLbJy/mNodsTENMVbjUbk=";
   };
diff --git a/pkgs/by-name/ba/bazel-remote/package.nix b/pkgs/by-name/ba/bazel-remote/package.nix
index d7b14def753a..51deeed0a6ab 100644
--- a/pkgs/by-name/ba/bazel-remote/package.nix
+++ b/pkgs/by-name/ba/bazel-remote/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "buchgr";
-    repo = pname;
+    repo = "bazel-remote";
     rev = "v${version}";
     hash = "sha256-PjhLybiZoq7Uies2bWdlLKAbKcG3+AQZ55Qp706u7hc=";
   };
diff --git a/pkgs/by-name/ba/bazelisk/package.nix b/pkgs/by-name/ba/bazelisk/package.nix
index 85018dfb7ce5..a815002957f3 100644
--- a/pkgs/by-name/ba/bazelisk/package.nix
+++ b/pkgs/by-name/ba/bazelisk/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
-    repo = pname;
+    repo = "bazelisk";
     rev = "v${version}";
     sha256 = "sha256-1/J/Y2NlIghxQS/5CnGX+2z+glOeOZVEgSE4KWft9Zw=";
   };
diff --git a/pkgs/by-name/bc/bctoolbox/package.nix b/pkgs/by-name/bc/bctoolbox/package.nix
index 8cf80c7a8c94..3f33b2ed484e 100644
--- a/pkgs/by-name/bc/bctoolbox/package.nix
+++ b/pkgs/by-name/bc/bctoolbox/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     domain = "gitlab.linphone.org";
     owner = "public";
     group = "BC";
-    repo = pname;
+    repo = "bctoolbox";
     rev = version;
     hash = "sha256-OwwSGzMFwR2ajUUgAy7ea/Q2pWxn3DO72W7ukcjBJnU=";
   };
diff --git a/pkgs/by-name/be/berglas/package.nix b/pkgs/by-name/be/berglas/package.nix
index 23d58fc3a53b..86925484ca48 100644
--- a/pkgs/by-name/be/berglas/package.nix
+++ b/pkgs/by-name/be/berglas/package.nix
@@ -39,7 +39,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
-    repo = pname;
+    repo = "berglas";
     rev = "v${version}";
     sha256 = "sha256-gBZY/xj/T7UYQ5mnN6udpBKViE/RYz9tmbmYN+JqsBk=";
   };
diff --git a/pkgs/by-name/be/bettercap/package.nix b/pkgs/by-name/be/bettercap/package.nix
index e0d5de396d28..f271c9eff7f3 100644
--- a/pkgs/by-name/be/bettercap/package.nix
+++ b/pkgs/by-name/be/bettercap/package.nix
@@ -15,8 +15,8 @@ buildGoModule rec {
   version = "2.32.0";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "bettercap";
+    repo = "bettercap";
     rev = "v${version}";
     sha256 = "sha256-OND8WPqU/95rKykqMAPWmDsJ+AjsjGjrncZ2/m3mpt0=";
   };
diff --git a/pkgs/by-name/bf/bfscripts/package.nix b/pkgs/by-name/bf/bfscripts/package.nix
index 322183078c2a..65be3bf4cdb6 100644
--- a/pkgs/by-name/bf/bfscripts/package.nix
+++ b/pkgs/by-name/bf/bfscripts/package.nix
@@ -34,13 +34,13 @@ let
     "bfup"
   ];
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "bfscripts";
   version = "unstable-2023-05-15";
 
   src = fetchFromGitHub {
     owner = "Mellanox";
-    repo = pname;
+    repo = "bfscripts";
     rev = "1da79f3ece7cdf99b2571c00e8b14d2e112504a4";
     hash = "sha256-pTubrnZKEFmtAj/omycFYeYwrCog39zBDEszoCrsQNQ=";
   };
diff --git a/pkgs/by-name/bi/bindle/package.nix b/pkgs/by-name/bi/bindle/package.nix
index 88867342500c..55f780753af1 100644
--- a/pkgs/by-name/bi/bindle/package.nix
+++ b/pkgs/by-name/bi/bindle/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "deislabs";
-    repo = pname;
+    repo = "bindle";
     rev = "v${version}";
     sha256 = "sha256-xehn74fqP0tEtP4Qy9TRGv+P2QoHZLxRHzGoY5cQuv0=";
   };
diff --git a/pkgs/by-name/bi/binocle/package.nix b/pkgs/by-name/bi/binocle/package.nix
index 8c35e3ff33c2..16bb8b0691e1 100644
--- a/pkgs/by-name/bi/binocle/package.nix
+++ b/pkgs/by-name/bi/binocle/package.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "sharkdp";
-    repo = pname;
+    repo = "binocle";
     rev = "v${version}";
     sha256 = "sha256-WAk7xIrCRfVofn4w+gP5E3wnSZbXm/6MZWlNmtoLm20=";
   };
diff --git a/pkgs/by-name/bi/binserve/package.nix b/pkgs/by-name/bi/binserve/package.nix
index df1cf540b52c..dc4235c56c44 100644
--- a/pkgs/by-name/bi/binserve/package.nix
+++ b/pkgs/by-name/bi/binserve/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "mufeedvh";
-    repo = pname;
+    repo = "binserve";
     rev = "v${version}";
     hash = "sha256-Chm2xPB0BrLXSZslg9wnbDyHSJRQAvOtpH0Rw6w1q1s=";
   };
diff --git a/pkgs/by-name/bi/bird2/package.nix b/pkgs/by-name/bi/bird2/package.nix
index 4fd22de7de28..080045ffcaa3 100644
--- a/pkgs/by-name/bi/bird2/package.nix
+++ b/pkgs/by-name/bi/bird2/package.nix
@@ -1,7 +1,8 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitLab,
+  autoreconfHook,
   flex,
   bison,
   readline,
@@ -13,15 +14,20 @@ stdenv.mkDerivation rec {
   pname = "bird";
   version = "2.17.1";
 
-  src = fetchurl {
-    url = "https://bird.network.cz/download/bird-${version}.tar.gz";
-    hash = "sha256-v9cY36WWgZs4AWiHgyElFLRnFjMprsm7zQ+j3uA+EOk=";
+  src = fetchFromGitLab {
+    domain = "gitlab.nic.cz";
+    owner = "labs";
+    repo = "bird";
+    rev = "v${version}";
+    hash = "sha256-9Zg3UmNEW+Q26PMj3Z1XDbPFC5vatX8i7RQSUlKXlwg=";
   };
 
   nativeBuildInputs = [
+    autoreconfHook
     flex
     bison
   ];
+
   buildInputs = [
     readline
     libssh
diff --git a/pkgs/by-name/bi/bird3/package.nix b/pkgs/by-name/bi/bird3/package.nix
index 1c839dadb796..9a397106203d 100644
--- a/pkgs/by-name/bi/bird3/package.nix
+++ b/pkgs/by-name/bi/bird3/package.nix
@@ -1,7 +1,8 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitLab,
+  autoreconfHook,
   flex,
   bison,
   readline,
@@ -11,14 +12,18 @@
 
 stdenv.mkDerivation rec {
   pname = "bird";
-  version = "3.1.1";
+  version = "3.1.2";
 
-  src = fetchurl {
-    url = "https://bird.nic.cz/download/bird-${version}.tar.gz";
-    hash = "sha256-KXJRl0/4g+TvA/zNbJEtEW7Un/Lxxjtm0dul8HCUREo=";
+  src = fetchFromGitLab {
+    domain = "gitlab.nic.cz";
+    owner = "labs";
+    repo = "bird";
+    rev = "v${version}";
+    hash = "sha256-3Ms9yozF/Ox/kSP9rzKvkrA0VBPQb1VjtbEInl8/KZM=";
   };
 
   nativeBuildInputs = [
+    autoreconfHook
     flex
     bison
   ];
diff --git a/pkgs/by-name/bi/bit/package.nix b/pkgs/by-name/bi/bit/package.nix
index 38750cf58f87..76bdfa373a7f 100644
--- a/pkgs/by-name/bi/bit/package.nix
+++ b/pkgs/by-name/bi/bit/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "chriswalz";
-    repo = pname;
+    repo = "bit";
     rev = "v${version}";
     sha256 = "sha256-18R0JGbG5QBDghF4SyhXaKe9UY5UzF7Ap0Y061Z1SZ8=";
   };
diff --git a/pkgs/by-name/bi/bitbake-language-server/package.nix b/pkgs/by-name/bi/bitbake-language-server/package.nix
index d0f441fad9dc..ea0d3de4642f 100644
--- a/pkgs/by-name/bi/bitbake-language-server/package.nix
+++ b/pkgs/by-name/bi/bitbake-language-server/package.nix
@@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "Freed-Wu";
-    repo = pname;
+    repo = "bitbake-language-server";
     rev = version;
     hash = "sha256-NLDQ2P5peweugkoNYskpCyCEgBwVFA7RTs8+NvH8fj8=";
   };
diff --git a/pkgs/by-name/bi/bitbox/genassets.patch b/pkgs/by-name/bi/bitbox/genassets.patch
deleted file mode 100644
index 0c09f22ec6ea..000000000000
--- a/pkgs/by-name/bi/bitbox/genassets.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/frontends/qt/genassets.sh b/frontends/qt/genassets.sh
-index 4b1ba87be..b5a9ad279 100755
---- a/frontends/qt/genassets.sh
-+++ b/frontends/qt/genassets.sh
-@@ -20,7 +20,7 @@ if [ ! -d ../web/build ]; then
- fi
- 
- echo '<!DOCTYPE RCC><RCC version="1.0"><qresource>' > assets.qrc
--/usr/bin/find ../web/build/ -maxdepth 3 -type f | sed -e "s|../web/build/||" | awk '{ print "<file alias=\"" $1 "\">../web/build/" $1 "</file>" '} >> assets.qrc
-+find ../web/build/ -maxdepth 3 -type f | sort | sed -e "s|../web/build/||" | awk '{ print "<file alias=\"" $1 "\">../web/build/" $1 "</file>" '} >> assets.qrc
- 
- echo '<file alias="trayicon.png">resources/trayicon.png</file>' >> assets.qrc
- echo '</qresource></RCC>' >> assets.qrc
diff --git a/pkgs/by-name/bi/bitbox/package.nix b/pkgs/by-name/bi/bitbox/package.nix
index cb040646f516..95924f254bbb 100644
--- a/pkgs/by-name/bi/bitbox/package.nix
+++ b/pkgs/by-name/bi/bitbox/package.nix
@@ -2,28 +2,34 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  runCommand,
   buildNpmPackage,
   clang,
   go,
   libsForQt5,
+  qt6,
 }:
 
+let
+  # Qt 6 doesn’t provide the rcc binary so we create an ad hoc package pulling
+  # it from Qt 5.
+  rcc = runCommand "rcc" { } ''
+    mkdir -p $out/bin
+    cp ${lib.getExe' libsForQt5.qt5.qtbase.dev "rcc"} $out/bin
+  '';
+in
 stdenv.mkDerivation rec {
   pname = "bitbox";
-  version = "4.46.3";
+  version = "4.47.2";
 
   src = fetchFromGitHub {
     owner = "BitBoxSwiss";
     repo = "bitbox-wallet-app";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-2oGVQ022NGOHLo7TBdeXG3ng1nYW8fyLwSV0hJdAl9I=";
+    hash = "sha256-sRE+Nnb3oqiJEjqiyG+3/sZLp23nquw5+4VpbZVFCQ8=";
   };
 
-  patches = [
-    ./genassets.patch
-  ];
-
   postPatch = ''
     substituteInPlace frontends/qt/resources/linux/usr/share/applications/bitbox.desktop \
         --replace-fail 'Exec=BitBox %u' 'Exec=bitbox %u'
@@ -36,7 +42,7 @@ stdenv.mkDerivation rec {
     inherit version;
     inherit src;
     sourceRoot = "source/frontends/web";
-    npmDepsHash = "sha256-w98wwKHiZtor5ivKd+sh5K8HnAepu6cw9RyVJ+eTq3k=";
+    npmDepsHash = "sha256-eazc3OIusY8cbaF8RJOrVcyWPQexcz6lZYLLCpB1mHc=";
     installPhase = "cp -r build $out";
   };
 
@@ -70,12 +76,13 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  buildInputs = [ libsForQt5.qtwebengine ];
+  buildInputs = [ qt6.qtwebengine ];
 
   nativeBuildInputs = [
     clang
     go
-    libsForQt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
+    rcc
   ];
 
   meta = {
diff --git a/pkgs/by-name/bl/blockbook/package.nix b/pkgs/by-name/bl/blockbook/package.nix
index b246fc368970..43f5bacc0f42 100644
--- a/pkgs/by-name/bl/blockbook/package.nix
+++ b/pkgs/by-name/bl/blockbook/package.nix
@@ -6,7 +6,7 @@
   lz4,
   nixosTests,
   pkg-config,
-  rocksdb_7_10,
+  rocksdb_9_10,
   snappy,
   stdenv,
   zeromq,
@@ -14,23 +14,23 @@
 }:
 
 let
-  rocksdb = rocksdb_7_10;
+  rocksdb = rocksdb_9_10;
 in
 buildGoModule rec {
   pname = "blockbook";
-  version = "0.4.0";
-  commit = "b227dfe";
+  version = "0.5.0";
+  commit = "657cbcf";
 
   src = fetchFromGitHub {
     owner = "trezor";
     repo = "blockbook";
     rev = "v${version}";
-    hash = "sha256-98tp3QYaHfhVIiJ4xkA3bUanXwK1q05t+YNroFtBUxE=";
+    hash = "sha256-8/tyqmZE9NJWGg7zYcdei0f1lpXfehy6LM6k5VHW33g=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-n03eWWy+58KAbYnKxI3/ulWIpmR+ivtImQSqbe2kpYU=";
+  vendorHash = "sha256-W29AvzfleCYC2pgHj2OB00PWBTcD2UUDbDH/z5A3bQ4=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -49,8 +49,6 @@ buildGoModule rec {
     "-X github.com/trezor/blockbook/common.buildDate=unknown"
   ];
 
-  tags = [ "rocksdb_7_10" ];
-
   CGO_LDFLAGS = [
     "-L${lib.getLib stdenv.cc.cc}/lib"
     "-lrocksdb"
@@ -84,7 +82,6 @@ buildGoModule rec {
     license = licenses.agpl3Only;
     maintainers = with maintainers; [
       mmahut
-      _1000101
     ];
     platforms = platforms.unix;
     mainProgram = "blockbook";
diff --git a/pkgs/by-name/bl/blocky/package.nix b/pkgs/by-name/bl/blocky/package.nix
index e2a39acd6905..0b3206d5f3c1 100644
--- a/pkgs/by-name/bl/blocky/package.nix
+++ b/pkgs/by-name/bl/blocky/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "0xERR0R";
-    repo = pname;
+    repo = "blocky";
     rev = "v${version}";
     hash = "sha256-yd9qncTuzf7p1hIYHzzXyxAx1C1QiuQAIYSKcjCiF0E=";
   };
diff --git a/pkgs/by-name/bl/blueberry/package.nix b/pkgs/by-name/bl/blueberry/package.nix
index 1bcd602ccac5..17c28b564b6c 100644
--- a/pkgs/by-name/bl/blueberry/package.nix
+++ b/pkgs/by-name/bl/blueberry/package.nix
@@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "linuxmint";
-    repo = pname;
+    repo = "blueberry";
     rev = version;
     sha256 = "sha256-MyIjcTyKn1aC2th6fCOw4cIqrRKatk2s4QD5R9cm83A=";
   };
diff --git a/pkgs/by-name/bl/bluewalker/package.nix b/pkgs/by-name/bl/bluewalker/package.nix
index 8f2872f6045b..c8bbe1bce5ba 100644
--- a/pkgs/by-name/bl/bluewalker/package.nix
+++ b/pkgs/by-name/bl/bluewalker/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitLab {
     owner = "jtaimisto";
-    repo = pname;
+    repo = "bluewalker";
     rev = "v${version}";
     hash = "sha256-wAzBlCczsLfHboGYIsyN7dGwz52CMw+L3XQ0njfLVR0=";
   };
diff --git a/pkgs/by-name/bo/bob/package.nix b/pkgs/by-name/bo/bob/package.nix
index 2b4f0769f68c..4d1662e8c24d 100644
--- a/pkgs/by-name/bo/bob/package.nix
+++ b/pkgs/by-name/bo/bob/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "benchkram";
-    repo = pname;
+    repo = "bob";
     rev = version;
     hash = "sha256-zmWfOLBb+GWw9v6LdCC7/WaP1Wz7UipPwqkmI1+rG8Q=";
   };
diff --git a/pkgs/by-name/bo/boltbrowser/package.nix b/pkgs/by-name/bo/boltbrowser/package.nix
index 48c6c3eb93eb..a16f46094afe 100644
--- a/pkgs/by-name/bo/boltbrowser/package.nix
+++ b/pkgs/by-name/bo/boltbrowser/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "br0xen";
-    repo = pname;
+    repo = "boltbrowser";
     rev = version;
     sha256 = "sha256-3t0U1bSJbo3RJZe+PwaUeuzSt23Gs++WRe/uehfa4cA=";
   };
diff --git a/pkgs/by-name/bo/bom/package.nix b/pkgs/by-name/bo/bom/package.nix
index 9a057938d525..b9dbc8eb97e0 100644
--- a/pkgs/by-name/bo/bom/package.nix
+++ b/pkgs/by-name/bo/bom/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
-    repo = pname;
+    repo = "bom";
     rev = "v${version}";
     hash = "sha256-nYzBaFtOJhqO0O6MJsxTw/mxsIOa+cnU27nOFRe2/uI=";
     # populate values that require us to use git. By doing this in postFetch we
diff --git a/pkgs/by-name/bo/booster/package.nix b/pkgs/by-name/bo/booster/package.nix
index 37e67b1215f4..e0fa317952a1 100644
--- a/pkgs/by-name/bo/booster/package.nix
+++ b/pkgs/by-name/bo/booster/package.nix
@@ -21,7 +21,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "anatol";
-    repo = pname;
+    repo = "booster";
     rev = version;
     hash = "sha256-uHxPzuD3PxKAI2JOZd7lcLvcqYqk9gW9yeZgOS1Y7x4=";
   };
diff --git a/pkgs/by-name/bo/bosh-cli/package.nix b/pkgs/by-name/bo/bosh-cli/package.nix
index 1625c109899e..7ed428798bde 100644
--- a/pkgs/by-name/bo/bosh-cli/package.nix
+++ b/pkgs/by-name/bo/bosh-cli/package.nix
@@ -9,13 +9,13 @@
 buildGoModule rec {
   pname = "bosh-cli";
 
-  version = "7.9.5";
+  version = "7.9.6";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
-    repo = pname;
+    repo = "bosh-cli";
     rev = "v${version}";
-    sha256 = "sha256-CyrOsPx55hZubBV0t5uMTTLVWC1qmEym1IwinvmSlWM=";
+    sha256 = "sha256-jWT34XdphNrkUwJq72EkvWLNoLVOc8rGf6SY4/CUvc0=";
   };
   vendorHash = null;
 
diff --git a/pkgs/by-name/bo/boxflat/package.nix b/pkgs/by-name/bo/boxflat/package.nix
index e41ca1994904..816d2a7bb31d 100644
--- a/pkgs/by-name/bo/boxflat/package.nix
+++ b/pkgs/by-name/bo/boxflat/package.nix
@@ -13,14 +13,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "boxflat";
-  version = "1.30.1";
+  version = "1.31.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lawstorant";
     repo = "boxflat";
     tag = "v${version}";
-    hash = "sha256-5P6To0VRnvdu316bPIL7gDRuZLRjXLFbOpB9wZKs/t8=";
+    hash = "sha256-2x7voGnbvaUg1G2SfdjD0QPVXolHkUcrwGyoclnOLMo=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/br/brev-cli/package.nix b/pkgs/by-name/br/brev-cli/package.nix
index 698103ae8a71..2a7bdc0ee24d 100644
--- a/pkgs/by-name/br/brev-cli/package.nix
+++ b/pkgs/by-name/br/brev-cli/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "brevdev";
-    repo = pname;
+    repo = "brev-cli";
     rev = "v${version}";
     sha256 = "sha256-dZY87iUPr1NYZNERAzuxX/en0fgefekpXAi5Um1nTBc=";
   };
diff --git a/pkgs/by-name/br/brook/package.nix b/pkgs/by-name/br/brook/package.nix
index 19ed8ed89519..a4c4cfca1e42 100644
--- a/pkgs/by-name/br/brook/package.nix
+++ b/pkgs/by-name/br/brook/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "txthinking";
-    repo = pname;
+    repo = "brook";
     rev = "v${version}";
     sha256 = "sha256-rfCqYI0T/nbK+rlPGl5orLo3qHKITesdFNtXc/ECATA=";
   };
diff --git a/pkgs/by-name/br/brutalmaze/package.nix b/pkgs/by-name/br/brutalmaze/package.nix
index 2846fcabdc7d..ba4559dc2b4e 100644
--- a/pkgs/by-name/br/brutalmaze/package.nix
+++ b/pkgs/by-name/br/brutalmaze/package.nix
@@ -12,7 +12,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromSourcehut {
     owner = "~cnx";
-    repo = pname;
+    repo = "brutalmaze";
     rev = version;
     sha256 = "1m105iq378mypj64syw59aldbm6bj4ma4ynhc50gafl656fabg4y";
   };
diff --git a/pkgs/by-name/bt/btcd/package.nix b/pkgs/by-name/bt/btcd/package.nix
index 3ea386726b76..97655efad17b 100644
--- a/pkgs/by-name/bt/btcd/package.nix
+++ b/pkgs/by-name/bt/btcd/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "btcsuite";
-    repo = pname;
+    repo = "btcd";
     rev = "v${version}";
     hash = "sha256-83eiVYXpyiGgLmYxj3rFk4CHG7F9UQ3vk1ZHm64Cm4A=";
   };
diff --git a/pkgs/by-name/bt/btop/package.nix b/pkgs/by-name/bt/btop/package.nix
index 9926e922a985..aa6a0d40ecbf 100644
--- a/pkgs/by-name/bt/btop/package.nix
+++ b/pkgs/by-name/bt/btop/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "aristocratos";
-    repo = pname;
+    repo = "btop";
     rev = "v${version}";
     hash = "sha256-4x2vGmH2dfHZHG+zj2KGsL/pRNIZ8K8sXYRHy0io5IE=";
   };
diff --git a/pkgs/by-name/bu/bugdom/package.nix b/pkgs/by-name/bu/bugdom/package.nix
index 924b69f29f50..32fa26ad1b72 100644
--- a/pkgs/by-name/bu/bugdom/package.nix
+++ b/pkgs/by-name/bu/bugdom/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "jorio";
-    repo = pname;
+    repo = "bugdom";
     rev = version;
     hash = "sha256-0c7v5tSqYuqtLOFl4sqD7+naJNqX/wlKHVntkZQGJ8A=";
     fetchSubmodules = true;
diff --git a/pkgs/by-name/bu/bump/package.nix b/pkgs/by-name/bu/bump/package.nix
index e2ae2ebaaf65..43f0e64d774c 100644
--- a/pkgs/by-name/bu/bump/package.nix
+++ b/pkgs/by-name/bu/bump/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "mroth";
-    repo = pname;
+    repo = "bump";
     rev = "v${version}";
     sha256 = "sha256-a+vmpmWb/jICNdErkvCQKNIdaKtSrIJZ3BApLvKG/hg=";
   };
diff --git a/pkgs/by-name/bu/bupstash/package.nix b/pkgs/by-name/bu/bupstash/package.nix
index 86367d92dad7..d468a134984b 100644
--- a/pkgs/by-name/bu/bupstash/package.nix
+++ b/pkgs/by-name/bu/bupstash/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "andrewchambers";
-    repo = pname;
+    repo = "bupstash";
     rev = "v${version}";
     sha256 = "sha256-Ekjxna3u+71s1q7jjXp7PxYUQIfbp2E+jAqKGuszU6g=";
   };
diff --git a/pkgs/by-name/bu/bustools/package.nix b/pkgs/by-name/bu/bustools/package.nix
index 38ae60fa0ab9..31e66e6542f4 100644
--- a/pkgs/by-name/bu/bustools/package.nix
+++ b/pkgs/by-name/bu/bustools/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bustools";
-  version = "0.45.0";
+  version = "0.45.1";
 
   src = fetchFromGitHub {
     owner = "BUStools";
     repo = "bustools";
     rev = "v${version}";
-    sha256 = "sha256-Af2WUryx4HQuAlNJ1RWJK1Mj2M7X+4Ckap3rqEJ3vto=";
+    sha256 = "sha256-G+ZMoUmhINp18XKmXpdb5GT7YMsiK/XX2zrjt56CbLg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/bu/butane/package.nix b/pkgs/by-name/bu/butane/package.nix
index ddd3d18e237d..9cf981a59c4f 100644
--- a/pkgs/by-name/bu/butane/package.nix
+++ b/pkgs/by-name/bu/butane/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "butane";
-  version = "0.23.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "coreos";
     repo = "butane";
     rev = "v${version}";
-    hash = "sha256-UJRHqvfCeKxbE+SRQZEm797WqwGpwjlqol8z36l3nS4=";
+    hash = "sha256-xb5CDuwGpYJgnG0KzlvkzTyeqo1d2fUcXh0a2hbCEd0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ca/caeml/package.nix b/pkgs/by-name/ca/caeml/package.nix
index a518e2cd1d3e..e76fc9992bfe 100644
--- a/pkgs/by-name/ca/caeml/package.nix
+++ b/pkgs/by-name/ca/caeml/package.nix
@@ -3,13 +3,13 @@
   buildGoModule,
   fetchFromGitHub,
 }:
-buildGoModule rec {
+buildGoModule {
   pname = "caeml";
   version = "unstable-2023-05-24";
 
   src = fetchFromGitHub {
     owner = "ferdinandyb";
-    repo = pname;
+    repo = "caeml";
     rev = "25dbe10e99aac9b0ce3b80787c162628104f5cd2";
     sha256 = "UIQCNkUyrtMF0IiAfkDvE8siqxNvfFc9TZdlZiTxCVc=";
   };
diff --git a/pkgs/by-name/ca/caffeine-ng/package.nix b/pkgs/by-name/ca/caffeine-ng/package.nix
index 59baf698693a..a9ebf1dcba98 100644
--- a/pkgs/by-name/ca/caffeine-ng/package.nix
+++ b/pkgs/by-name/ca/caffeine-ng/package.nix
@@ -25,7 +25,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "WhyNotHugo";
-    repo = pname;
+    repo = "caffeine-ng";
     rev = "v${version}";
     hash = "sha256-uYzLRZ+6ZgIwhSuJWRBpLYHgonX7sFXgUZid0V26V0Q=";
   };
diff --git a/pkgs/by-name/ca/cameradar/package.nix b/pkgs/by-name/ca/cameradar/package.nix
index 329a41babd1a..1da114cbfed4 100644
--- a/pkgs/by-name/ca/cameradar/package.nix
+++ b/pkgs/by-name/ca/cameradar/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "Ullaakut";
-    repo = pname;
+    repo = "cameradar";
     rev = "v${version}";
     sha256 = "sha256-GOqmz/aiOLGMfs9rQBIEQSgBycPzhu8BohcAc2U+gBw=";
   };
diff --git a/pkgs/by-name/ca/candy-icons/package.nix b/pkgs/by-name/ca/candy-icons/package.nix
index 08be228942e6..0dc9fedfe78c 100644
--- a/pkgs/by-name/ca/candy-icons/package.nix
+++ b/pkgs/by-name/ca/candy-icons/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "candy-icons";
-  version = "0-unstable-2025-05-08";
+  version = "0-unstable-2025-05-24";
 
   src = fetchFromGitHub {
     owner = "EliverLara";
     repo = "candy-icons";
-    rev = "47abaeba8de75a1805b10f4fc8d698c6e8c614c9";
-    hash = "sha256-COC926EPA7w1eUnXq40iFuANUF3Rch83e/BekBsHNFo=";
+    rev = "b099e7f437da41f65ffb710d801471e2f813f1b2";
+    hash = "sha256-gy58GQMoYOFXbvXoKELUydg/X/B8BJ6hIbcOl5com1E=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/by-name/ca/capacities/package.nix b/pkgs/by-name/ca/capacities/package.nix
new file mode 100644
index 000000000000..9d5244c11a01
--- /dev/null
+++ b/pkgs/by-name/ca/capacities/package.nix
@@ -0,0 +1,66 @@
+{
+  fetchurl,
+  appimageTools,
+  makeWrapper,
+  imagemagick,
+  lib,
+}:
+let
+  pname = "capacities";
+  version = "1.48.7";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "https://web.archive.org/web/20250519011655/https://capacities-desktop-app.fra1.cdn.digitaloceanspaces.com/capacities-${version}.AppImage";
+    hash = "sha256-fa1Wk3w+f467n0JtRz+Zjw9QKDKKnhS23biEtNqO17Y=";
+  };
+
+  appimageContents = appimageTools.extractType2 {
+    inherit
+      pname
+      src
+      version
+      ;
+  };
+in
+appimageTools.wrapType2 {
+  inherit
+    pname
+    src
+    version
+    ;
+
+  extraInstallCommands = ''
+    source "${makeWrapper}/nix-support/setup-hook"
+    wrapProgram $out/bin/capacities \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+
+    # Check for required desktop file
+    if [ ! -f ${appimageContents}/capacities.desktop ]; then
+      echo "Error: Missing .desktop file in ${appimageContents}"
+      exit 1
+    else
+      # Install and modify the desktop file
+      install -m 444 -D ${appimageContents}/capacities.desktop $out/share/applications/capacities.desktop
+    fi
+
+    # Check for required icon file
+    if [ ! -f ${appimageContents}/capacities.png ]; then
+      echo "Error: Missing icon file in ${appimageContents}"
+      exit 1
+    else
+      # Resize and install the icon
+      ${lib.getExe imagemagick} ${appimageContents}/capacities.png -resize 512x512 capacities_512.png
+      install -m 444 -D capacities_512.png $out/share/icons/hicolor/512x512/apps/capacities.png
+    fi
+  '';
+
+  meta = {
+    description = "Calm place to make sense of the world and create amazing things";
+    homepage = "https://capacities.io/";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    license = lib.licenses.unfree;
+    mainProgram = "capacities";
+  };
+}
diff --git a/pkgs/by-name/ca/carapace-bridge/package.nix b/pkgs/by-name/ca/carapace-bridge/package.nix
index 39c2699bc2da..a49ac279ace5 100644
--- a/pkgs/by-name/ca/carapace-bridge/package.nix
+++ b/pkgs/by-name/ca/carapace-bridge/package.nix
@@ -8,19 +8,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "carapace-bridge";
-  version = "1.2.9";
+  version = "1.2.10";
 
   src = fetchFromGitHub {
     owner = "carapace-sh";
     repo = "carapace-bridge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y69byUUDJJ+nJuZ6lcl+McFtJGYb5zgE8+QTbhoZ9Bc=";
+    hash = "sha256-XQtbOQw2a2B5zhTgFiAuECtY/uM7AQnbwyRpzoKcF8I=";
   };
 
   # buildGoModule try to run `go mod vendor` instead of `go work vendor` on the
   # workspace if proxyVendor is off
   proxyVendor = true;
-  vendorHash = "sha256-TVqQrqdMmzv1w4Y37pB2t/apdMPm6QO/0VVS3x86GpE=";
+  vendorHash = "sha256-01WRJJiAqxmb1grvz9gWdYJ4i9pVUYmxFg9BGEuUhdA=";
 
   postPatch = ''
     substituteInPlace cmd/carapace-bridge/main.go \
diff --git a/pkgs/by-name/ca/cargo-cache/package.nix b/pkgs/by-name/ca/cargo-cache/package.nix
index 90fd9685b3d7..47c4f105b843 100644
--- a/pkgs/by-name/ca/cargo-cache/package.nix
+++ b/pkgs/by-name/ca/cargo-cache/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "matthiaskrgr";
-    repo = pname;
+    repo = "cargo-cache";
     rev = version;
     sha256 = "sha256-q9tYKXK8RqiqbDZ/lTxUI1Dm/h28/yZR8rTQuq+roZs=";
   };
diff --git a/pkgs/by-name/ca/cargo-careful/package.nix b/pkgs/by-name/ca/cargo-careful/package.nix
index 8d168b4f9961..5cd6a3c6d920 100644
--- a/pkgs/by-name/ca/cargo-careful/package.nix
+++ b/pkgs/by-name/ca/cargo-careful/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-careful";
-  version = "0.4.5";
+  version = "0.4.6";
 
   src = fetchFromGitHub {
     owner = "RalfJung";
     repo = "cargo-careful";
     rev = "v${version}";
-    hash = "sha256-dalsBILFZzVHBIhGGIOUMSCWuM7xE46w91MbzCYa1Io=";
+    hash = "sha256-aKmaNDk9yZ/1MS3vQ9c1rCySfxiNv8PRwnIjT5bdhMg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Es5BT0jfyJXuw7TTtGRhI4PeplZgTYm6JhSxQiZ+6NE=";
+  cargoHash = "sha256-KtTTpYwhNYvghb8k2NXyCRV5NGn07d7iaW+5uTI6qJ4=";
 
   meta = with lib; {
     description = "Tool to execute Rust code carefully, with extra checking along the way";
diff --git a/pkgs/by-name/ca/cargo-clone/package.nix b/pkgs/by-name/ca/cargo-clone/package.nix
index a67332aa956c..976846a2920d 100644
--- a/pkgs/by-name/ca/cargo-clone/package.nix
+++ b/pkgs/by-name/ca/cargo-clone/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-clone";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "janlikar";
-    repo = pname;
+    repo = "cargo-clone";
     rev = "v${version}";
-    sha256 = "sha256-kK0J1Vfx1T17CgZ3DV9kQbAUxk4lEfje5p6QvdBS5VQ=";
+    sha256 = "sha256-tAY4MUytFVa7kXLeOg4xak8XKGgApnEGWiK51W/7uDg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-IbNwlVKGsi70G+ATimRZbHbW91vFddQl//dfAM6JO8I=";
+  cargoHash = "sha256-AFCCXZKm6XmiaayOqvGhMzjyMwAqVK1GZccWHWV5/9c=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ca/cargo-edit/package.nix b/pkgs/by-name/ca/cargo-edit/package.nix
index 93b405e1c825..385328f1b2d2 100644
--- a/pkgs/by-name/ca/cargo-edit/package.nix
+++ b/pkgs/by-name/ca/cargo-edit/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-edit";
-  version = "0.13.4";
+  version = "0.13.6";
 
   src = fetchFromGitHub {
     owner = "killercup";
-    repo = pname;
+    repo = "cargo-edit";
     rev = "v${version}";
-    hash = "sha256-gs7+OuW0av7p45+wgXVVS17YKTwIqDFQWc3kKE7y/Yw=";
+    hash = "sha256-z+LTgCeTUr3D0LEbw0yHlk1di2W95XewbYlgusD2TLg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-JafagbF+JCp3ATtGjlExLDUehYqO9DhI39uD4fLafsQ=";
+  cargoHash = "sha256-/+DDA64kemZKzKdaKnXK+R4e8FV59qT5HCGcwyOz7R8=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ca/cargo-expand/package.nix b/pkgs/by-name/ca/cargo-expand/package.nix
index 33a053d1e725..44d329130cdc 100644
--- a/pkgs/by-name/ca/cargo-expand/package.nix
+++ b/pkgs/by-name/ca/cargo-expand/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-expand";
-  version = "1.0.106";
+  version = "1.0.107";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = "cargo-expand";
     rev = version;
-    hash = "sha256-7j8i0wvbbAFPNgHamy+lybQpz1ht+n90oidVGSXP6MA=";
+    hash = "sha256-oAZ7xt/Ji36XtGh7UXHbseBRQtpmsKHcAABiloITPXA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-e6K97VUsCYx56Y9r7QPVBV3eMwWnjEhZoEKpmuKmkJk=";
+  cargoHash = "sha256-4HH25MEj3iCrm9iCW8vWVMDou/F3YidRIWDH0m5FTaY=";
 
   meta = with lib; {
     description = "Cargo subcommand to show result of macro expansion";
diff --git a/pkgs/by-name/ca/cargo-fund/package.nix b/pkgs/by-name/ca/cargo-fund/package.nix
index f76b85b33093..01acf17c95af 100644
--- a/pkgs/by-name/ca/cargo-fund/package.nix
+++ b/pkgs/by-name/ca/cargo-fund/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "acfoltzer";
-    repo = pname;
+    repo = "cargo-fund";
     rev = version;
     hash = "sha256-8mnCwWwReNH9s/gbxIhe7XdJRIA6BSUKm5jzykU5qMU=";
   };
diff --git a/pkgs/by-name/ca/cargo-mobile2/package.nix b/pkgs/by-name/ca/cargo-mobile2/package.nix
index c14cb9982ec1..7003e539fe32 100644
--- a/pkgs/by-name/ca/cargo-mobile2/package.nix
+++ b/pkgs/by-name/ca/cargo-mobile2/package.nix
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage {
   inherit pname version;
   src = fetchFromGitHub {
     owner = "tauri-apps";
-    repo = pname;
+    repo = "cargo-mobile2";
     rev = "cargo-mobile2-v${version}";
     hash = "sha256-7/ol4Jb/2s007LeSMo6YYDT5vipsZZF6O4hfJ7ylHGg=";
   };
diff --git a/pkgs/by-name/ca/cargo-ndk/package.nix b/pkgs/by-name/ca/cargo-ndk/package.nix
index cbd1db25b326..d3274a4a9284 100644
--- a/pkgs/by-name/ca/cargo-ndk/package.nix
+++ b/pkgs/by-name/ca/cargo-ndk/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "bbqsrc";
-    repo = pname;
+    repo = "cargo-ndk";
     rev = "v${version}";
     sha256 = "sha256-tzjiq1jjluWqTl+8MhzFs47VRp3jIRJ7EOLhUP8ydbM=";
   };
diff --git a/pkgs/by-name/ca/cargo-profiler/package.nix b/pkgs/by-name/ca/cargo-profiler/package.nix
index 0874582ea0ab..6fd13b165fcb 100644
--- a/pkgs/by-name/ca/cargo-profiler/package.nix
+++ b/pkgs/by-name/ca/cargo-profiler/package.nix
@@ -17,12 +17,12 @@ let
 
   inherit (rustPlatform) buildRustPackage;
 in
-buildRustPackage rec {
+buildRustPackage {
   inherit pname version;
 
   src = fetchFromGitHub {
     inherit owner rev hash;
-    repo = pname;
+    repo = "cargo-profiler";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/ca/cargo-public-api/package.nix b/pkgs/by-name/ca/cargo-public-api/package.nix
index 204189edcb52..2003550946e9 100644
--- a/pkgs/by-name/ca/cargo-public-api/package.nix
+++ b/pkgs/by-name/ca/cargo-public-api/package.nix
@@ -9,15 +9,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-public-api";
-  version = "0.47.0";
+  version = "0.47.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-g0kaJ3HPFeS5PvWQfUTanxCgm9sduW9nBx/N61kt3ZI=";
+    hash = "sha256-xDMOrL9yyaEEwPhcrkPugVMTyKW4T6X1yE4tN9dmPas=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-jQx4VCarfbdTXOE/GAAzxeXf7xVwEaXDPhw6ywBR3wA=";
+  cargoHash = "sha256-HhYGc0S/i6KWZsv4E1NTkZb+jdUkcKDP/c0hdVTHJXE=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ca/cargo-shear/package.nix b/pkgs/by-name/ca/cargo-shear/package.nix
index 96815b728efd..e10c1d9c5237 100644
--- a/pkgs/by-name/ca/cargo-shear/package.nix
+++ b/pkgs/by-name/ca/cargo-shear/package.nix
@@ -6,7 +6,7 @@
   cargo-shear,
 }:
 let
-  version = "1.2.7";
+  version = "1.3.0";
 in
 rustPlatform.buildRustPackage {
   pname = "cargo-shear";
@@ -16,11 +16,11 @@ rustPlatform.buildRustPackage {
     owner = "Boshen";
     repo = "cargo-shear";
     rev = "v${version}";
-    hash = "sha256-IOTlDLHSFH93tgCaF8ZOboIRkGImcT+oDfbmKKjNDlM=";
+    hash = "sha256-OOjN6JI5RWo2J2awX3ts4wlVptQ1mhQEk8acNOVjFz0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-6Pu7qFOT9fPjtgjNqZ4mF37xNLuCIl1U3a23vGpRs4k=";
+  cargoHash = "sha256-ha/soHq6lEZUQ/gfk4zQkRBGN3S6npJ2CHI2oyjDsXA=";
 
   # https://github.com/Boshen/cargo-shear/blob/a0535415a3ea94c86642f39f343f91af5cdc3829/src/lib.rs#L20-L23
   SHEAR_VERSION = version;
diff --git a/pkgs/by-name/ca/cargo-tauri/hook.nix b/pkgs/by-name/ca/cargo-tauri/hook.nix
index bc1d57f52356..4683e5a2ac5c 100644
--- a/pkgs/by-name/ca/cargo-tauri/hook.nix
+++ b/pkgs/by-name/ca/cargo-tauri/hook.nix
@@ -42,7 +42,8 @@ makeSetupHook {
         '';
 
         linux = ''
-          mv "$targetDir"/bundle/deb/*/data/usr $out
+          mkdir -p $out
+          mv "$targetDir"/bundle/deb/*/data/usr/* $out/
         '';
       }
       .${kernelName} or (throw "${kernelName} is not supported by cargo-tauri.hook");
diff --git a/pkgs/by-name/ca/cargo-udeps/package.nix b/pkgs/by-name/ca/cargo-udeps/package.nix
index a98e53c83c39..18a8e46589a5 100644
--- a/pkgs/by-name/ca/cargo-udeps/package.nix
+++ b/pkgs/by-name/ca/cargo-udeps/package.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "est31";
-    repo = pname;
+    repo = "cargo-udeps";
     rev = "v${version}";
     sha256 = "sha256-4/JfD2cH46it8PkU58buTHwFXBZI3sytyJCUWl+vSAE=";
   };
diff --git a/pkgs/by-name/ca/cargo-watch/package.nix b/pkgs/by-name/ca/cargo-watch/package.nix
index b994a7a853c5..1d85e4dc5fc7 100644
--- a/pkgs/by-name/ca/cargo-watch/package.nix
+++ b/pkgs/by-name/ca/cargo-watch/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "watchexec";
-    repo = pname;
+    repo = "cargo-watch";
     rev = "v${version}";
     hash = "sha256-agwK20MkvnhqSVAWMy3HLkUJbraINn12i6VAg8mTzBk=";
   };
diff --git a/pkgs/by-name/ca/cargo-whatfeatures/package.nix b/pkgs/by-name/ca/cargo-whatfeatures/package.nix
index e46acabfeb9b..276e5e41c2f7 100644
--- a/pkgs/by-name/ca/cargo-whatfeatures/package.nix
+++ b/pkgs/by-name/ca/cargo-whatfeatures/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "museun";
-    repo = pname;
+    repo = "cargo-whatfeatures";
     rev = "v${version}";
     sha256 = "sha256-YJ08oBTn9OwovnTOuuc1OuVsQp+/TPO3vcY4ybJ26Ms=";
   };
diff --git a/pkgs/by-name/ca/cassowary/package.nix b/pkgs/by-name/ca/cassowary/package.nix
index f2f255e7ac5c..5d36ac2a2ceb 100644
--- a/pkgs/by-name/ca/cassowary/package.nix
+++ b/pkgs/by-name/ca/cassowary/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "rogerwelin";
-    repo = pname;
+    repo = "cassowary";
     rev = "v${version}";
     sha256 = "sha256-zaG4HrdTGXTalMFz/huRW32RZBQx55AvUi29tz6vFD8=";
   };
diff --git a/pkgs/by-name/ca/catatonit/package.nix b/pkgs/by-name/ca/catatonit/package.nix
index b97867aecb29..687b68fb353e 100644
--- a/pkgs/by-name/ca/catatonit/package.nix
+++ b/pkgs/by-name/ca/catatonit/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "openSUSE";
-    repo = pname;
+    repo = "catatonit";
     rev = "v${version}";
     sha256 = "sha256-sc/T4WjCPFfwUWxlBx07mQTmcOApblHygfVT824HcJM=";
   };
diff --git a/pkgs/by-name/cb/cbmc/package.nix b/pkgs/by-name/cb/cbmc/package.nix
index 9f43b14131de..b154d6cc9a82 100644
--- a/pkgs/by-name/cb/cbmc/package.nix
+++ b/pkgs/by-name/cb/cbmc/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cbmc";
-  version = "6.4.1";
+  version = "6.6.0";
 
   src = fetchFromGitHub {
     owner = "diffblue";
     repo = "cbmc";
     tag = "cbmc-${finalAttrs.version}";
-    hash = "sha256-O8aZTW+Eylshl9bmm9GzbljWB0+cj2liZHs2uScERkM=";
+    hash = "sha256-ot0vVBgiSVru/RE7KeyTsXzDfs0CSa5vaFsON+PCZZo=";
   };
 
   srcglucose = fetchFromGitHub {
@@ -51,12 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
       cudd = cudd.src;
     })
     ./0002-Do-not-download-sources-in-cmake.patch
-    # Fixes build with libc++ >= 19 due to the removal of std::char_traits<unsigned>.
-    # Remove for versions > 6.4.1.
-    (fetchpatch {
-      url = "https://github.com/diffblue/cbmc/commit/684bf4221c8737952e6469304f5a360dc3d5439d.patch";
-      hash = "sha256-3hHu6FcyHjfeFjNxhyhxxk7I/SK98BXT+xy7NgtEt50=";
-    })
   ];
 
   postPatch =
diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix
index 4c74cb1c8f05..e913134cfa21 100644
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.1.19";
+  version = "1.1.20";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-Zp3ObJkK60g4VgH8e1aghHjCbueu/9FNru9RUx6uIuE=";
+    hash = "sha256-qL2SNVHsAH+Z0A5Vv+kBa1O9VgdR7eZ29Z19s5GuTXA=";
   };
 
   vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";
diff --git a/pkgs/by-name/ce/cerca/package.nix b/pkgs/by-name/ce/cerca/package.nix
index b8787a7a47df..1a9134458728 100644
--- a/pkgs/by-name/ce/cerca/package.nix
+++ b/pkgs/by-name/ce/cerca/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cerca";
-  version = "0-unstable-2025-05-06";
+  version = "0-unstable-2025-05-21";
 
   src = fetchFromGitHub {
     owner = "cblgh";
     repo = "cerca";
-    rev = "a2706a35e3efc8b816b4374e24493548429041db";
-    hash = "sha256-FDlASFjI+D/iOH0r2Yd638aS0na19TxkN7Z1kD/o/fY";
+    rev = "722c38d96160ccf69dd7a8122b62660102b64a59";
+    hash = "sha256-M5INnik/TIzH0Afi8/6/PnhwsAhd+kFaDHejfsmuhn0=";
   };
 
   vendorHash = "sha256-yfsI0nKfzyzmtbS9bSHRaD2pEgxN6gOKAA/FRDxJx40=";
diff --git a/pkgs/by-name/ce/certgraph/package.nix b/pkgs/by-name/ce/certgraph/package.nix
index 7f5eac96c4e5..594fddb273de 100644
--- a/pkgs/by-name/ce/certgraph/package.nix
+++ b/pkgs/by-name/ce/certgraph/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "lanrat";
-    repo = pname;
+    repo = "certgraph";
     rev = version;
     sha256 = "sha256-7tvPiJHZE9X7I79DFNF1ZAQiaAkrtrXiD2fY7AkbWMk=";
   };
diff --git a/pkgs/by-name/ce/certigo/package.nix b/pkgs/by-name/ce/certigo/package.nix
index bf5286c1a693..f5ac323da6c7 100644
--- a/pkgs/by-name/ce/certigo/package.nix
+++ b/pkgs/by-name/ce/certigo/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "square";
-    repo = pname;
+    repo = "certigo";
     rev = "v${version}";
     sha256 = "sha256-+j1NeQJPDwQxXVYnHNmL49Li2IMH+9ehS0HSM3kqyxU=";
   };
diff --git a/pkgs/by-name/cf/cf-vault/package.nix b/pkgs/by-name/cf/cf-vault/package.nix
index 47f49ab1b817..1619ab764142 100644
--- a/pkgs/by-name/cf/cf-vault/package.nix
+++ b/pkgs/by-name/cf/cf-vault/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jacobbednarz";
-    repo = pname;
+    repo = "cf-vault";
     rev = version;
     sha256 = "sha256-vp9ufjNZabY/ck2lIT+QpD6IgaVj1BkBRTjPxkb6IjQ=";
   };
diff --git a/pkgs/by-name/ch/chafa/package.nix b/pkgs/by-name/ch/chafa/package.nix
index ef46ea903727..c6d4522596f4 100644
--- a/pkgs/by-name/ch/chafa/package.nix
+++ b/pkgs/by-name/ch/chafa/package.nix
@@ -18,15 +18,15 @@
   glib,
 }:
 
-stdenv.mkDerivation rec {
-  version = "1.14.5";
+stdenv.mkDerivation (finalAttrs: {
+  version = "1.16.1";
   pname = "chafa";
 
   src = fetchFromGitHub {
     owner = "hpjansson";
     repo = "chafa";
-    rev = version;
-    sha256 = "sha256-9RkN0yZnHf5cx6tsp3P6jsi0/xtplWxMm3hYCPjWj0M=";
+    tag = finalAttrs.version;
+    hash = "sha256-O57L/VR3M1dTMg+UES6NGh4hU2D7/e9boTMNo6sR/ws=";
   };
 
   outputs = [
@@ -69,15 +69,20 @@ stdenv.mkDerivation rec {
   ];
 
   postInstall = ''
-    installShellCompletion --cmd chafa tools/completions/zsh-completion.zsh
+    installShellCompletion --cmd chafa \
+      --fish tools/completions/fish-completion.fish \
+      --zsh tools/completions/zsh-completion.zsh
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Terminal graphics for the 21st century";
     homepage = "https://hpjansson.org/chafa/";
-    license = licenses.lgpl3Plus;
-    platforms = platforms.all;
-    maintainers = [ maintainers.mog ];
+    license = lib.licenses.lgpl3Plus;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [
+      mog
+      prince213
+    ];
     mainProgram = "chafa";
   };
-}
+})
diff --git a/pkgs/by-name/ch/chain-bench/package.nix b/pkgs/by-name/ch/chain-bench/package.nix
index 4fde0f9ce10c..3bcbe63a2955 100644
--- a/pkgs/by-name/ch/chain-bench/package.nix
+++ b/pkgs/by-name/ch/chain-bench/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
-    repo = pname;
+    repo = "chain-bench";
     rev = "v${version}";
     sha256 = "sha256-5+jSbXbT1UwHMVeZ07qcY8Is88ddHdr7QlgcbQK+8FA=";
   };
diff --git a/pkgs/by-name/ch/chamber/package.nix b/pkgs/by-name/ch/chamber/package.nix
index 9f721954031f..a4bf2c1fdd53 100644
--- a/pkgs/by-name/ch/chamber/package.nix
+++ b/pkgs/by-name/ch/chamber/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "segmentio";
-    repo = pname;
+    repo = "chamber";
     rev = "v${version}";
     sha256 = "sha256-9+I/zH4sHlLQkEn+fCboI3vCjYjlk+hdYnWuxq47r5I=";
   };
diff --git a/pkgs/by-name/ch/changelogger/package.nix b/pkgs/by-name/ch/changelogger/package.nix
index f0b911d15c18..75f4e32ce76b 100644
--- a/pkgs/by-name/ch/changelogger/package.nix
+++ b/pkgs/by-name/ch/changelogger/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "MarkusFreitag";
-    repo = pname;
+    repo = "changelogger";
     rev = "v${version}";
     sha256 = "sha256-XDiO8r1HpdsfBKzFLnsWdxte2EqL1blPH21137fNm5M=";
   };
diff --git a/pkgs/by-name/ch/chars/package.nix b/pkgs/by-name/ch/chars/package.nix
index ae87f1efd6c8..933280bbc9d2 100644
--- a/pkgs/by-name/ch/chars/package.nix
+++ b/pkgs/by-name/ch/chars/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "antifuchs";
-    repo = pname;
+    repo = "chars";
     rev = "v${version}";
     sha256 = "sha256-mBtwdPzIc6RgEFTyReStFlhS4UhhRWjBTKT6gD3tzpQ=";
   };
diff --git a/pkgs/by-name/ch/chart-testing/package.nix b/pkgs/by-name/ch/chart-testing/package.nix
index bc580ea44807..707e20c0c92d 100644
--- a/pkgs/by-name/ch/chart-testing/package.nix
+++ b/pkgs/by-name/ch/chart-testing/package.nix
@@ -18,7 +18,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "helm";
-    repo = pname;
+    repo = "chart-testing";
     rev = "v${version}";
     hash = "sha256-q56ZM+YzL7RRC3RD3xO3K0hIDomKun5xmSKuiDTq1cU=";
   };
diff --git a/pkgs/by-name/ch/chatgpt-cli/package.nix b/pkgs/by-name/ch/chatgpt-cli/package.nix
index 61982d798fdb..047336868ae2 100644
--- a/pkgs/by-name/ch/chatgpt-cli/package.nix
+++ b/pkgs/by-name/ch/chatgpt-cli/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "j178";
-    repo = pname;
+    repo = "chatgpt";
     rev = "v${version}";
     hash = "sha256-+U5fDG/t1x7F4h+D3rVdgvYICoQDH7dd5GUNOCkXw/Q=";
   };
diff --git a/pkgs/by-name/ch/check50/package.nix b/pkgs/by-name/ch/check50/package.nix
new file mode 100644
index 000000000000..4651da8a8150
--- /dev/null
+++ b/pkgs/by-name/ch/check50/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "check50";
+  version = "3.3.11";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cs50";
+    repo = "check50";
+    tag = "v${version}";
+    hash = "sha256-+qyEMzAJG/fyIqj+0mk0HTxTlQk6sHZhvmfd9Hgj/aw=";
+  };
+
+  build-system = [
+    python3Packages.setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    attrs
+    beautifulsoup4
+    jinja2
+    lib50
+    packaging
+    pexpect
+    pyyaml
+    requests
+    setuptools # required for import pkg_resources
+    termcolor
+  ];
+
+  pythonImportsCheck = [ "check50" ];
+
+  nativeCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  # no python tests
+
+  meta = {
+    description = "Testing tool for checking student CS50 code";
+    homepage = "https://cs50.readthedocs.io/projects/check50/en/latest/";
+    downloadPage = "https://github.com/cs50/check50";
+    changelog = "https://github.com/cs50/check50/releases/tag/v${version}";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    mainProgram = "check50";
+  };
+}
diff --git a/pkgs/by-name/ch/checkip/package.nix b/pkgs/by-name/ch/checkip/package.nix
index 10617fb3d6c7..219492583f40 100644
--- a/pkgs/by-name/ch/checkip/package.nix
+++ b/pkgs/by-name/ch/checkip/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jreisinger";
-    repo = pname;
+    repo = "checkip";
     tag = "v${version}";
     hash = "sha256-bjKRHIY9OIEft//g8VHKHTUrwWn8UU38SPP4IdPbIQE=";
   };
diff --git a/pkgs/by-name/ch/checkmake/package.nix b/pkgs/by-name/ch/checkmake/package.nix
index 400552061f8b..920cad4793be 100644
--- a/pkgs/by-name/ch/checkmake/package.nix
+++ b/pkgs/by-name/ch/checkmake/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "mrtazz";
-    repo = pname;
+    repo = "checkmake";
     rev = version;
     hash = "sha256-Ql8XSQA/w7wT9GbmYOM2vG15GVqj9LxOGIu8Wqp9Wao=";
   };
diff --git a/pkgs/by-name/ch/checkmate/package.nix b/pkgs/by-name/ch/checkmate/package.nix
index 64b8bf9b2fd6..573323dd27c7 100644
--- a/pkgs/by-name/ch/checkmate/package.nix
+++ b/pkgs/by-name/ch/checkmate/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "adedayo";
-    repo = pname;
+    repo = "checkmate";
     rev = "v${version}";
     hash = "sha256-XzzN4oIG6E4NsMGl4HzFlgAGhkRieRn+jyA0bT8fcrg=";
   };
diff --git a/pkgs/by-name/ch/checkov/package.nix b/pkgs/by-name/ch/checkov/package.nix
index a6c1a3310361..85c2a75ac2d1 100644
--- a/pkgs/by-name/ch/checkov/package.nix
+++ b/pkgs/by-name/ch/checkov/package.nix
@@ -25,14 +25,14 @@ with py.pkgs;
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.427";
+  version = "3.2.435";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = version;
-    hash = "sha256-jdlTSWdojaM7M5g7yWCudZeCuQqaZZWFYJ0kWWup4ts=";
+    hash = "sha256-zV430pGFkfyf0oznXe69lTsMkGUrrA5TTyGobE4AK9I=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/ch/chisel/package.nix b/pkgs/by-name/ch/chisel/package.nix
index 081ef937a79d..f5aabdd2a7d9 100644
--- a/pkgs/by-name/ch/chisel/package.nix
+++ b/pkgs/by-name/ch/chisel/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jpillora";
-    repo = pname;
+    repo = "chisel";
     tag = "v${version}";
     hash = "sha256-b3r4D/P7D3kfIyMd1s/ntciY04qMrvSTru9+HjAOrnA=";
   };
diff --git a/pkgs/by-name/ch/chntpw/package.nix b/pkgs/by-name/ch/chntpw/package.nix
index 603120053e27..28f72fbd0285 100644
--- a/pkgs/by-name/ch/chntpw/package.nix
+++ b/pkgs/by-name/ch/chntpw/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   unzip,
-  fetchpatch,
+  fetchDebianPatch,
 }:
 
 stdenv.mkDerivation rec {
@@ -18,52 +18,65 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ unzip ];
 
-  patches = [
-    ./00-chntpw-build-arch-autodetect.patch
-    ./01-chntpw-install-target.patch
-    # Import various bug fixes from debian
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/04_get_abs_path";
-      sha256 = "17h0gaczqd5b792481synr1ny72frwslb779lm417pyrz6kh9q8n";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/06_correct_test_open_syscall";
-      sha256 = "00lg83bimbki988n71w54mmhjp9529r0ngm40d7fdmnc2dlpj3hd";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/07_detect_failure_to_write_key";
-      sha256 = "0pk6xnprh2pqyx4n4lw3836z6fqsw3mclkzppl5rhjaahriwxw4l";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/08_no_deref_null";
-      sha256 = "1g7pfmjaj0c2sm64s3api2kglj7jbgddjjd3r4drw6phwdkah0zs";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/09_improve_robustness";
-      sha256 = "1nszkdy01ixnain7cwdmfbhjngphw1300ifagc1wgl9wvghzviaa";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/11_improve_documentation";
-      sha256 = "0yql6hj72q7cq69rrspsjkpiipdhcwb0b9w5j8nhq40cnx9mgqgg";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/12_readonly_filesystem";
-      sha256 = "1kxcy7f2pl6fqgmjg8bnl3pl5wgiw5xnbyx12arinmqkkggp4fa4";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/13_write_to_hive";
-      sha256 = "1638lcyxjkrkmbr3n28byixny0qrxvkciw1xd97x48mj6bnwqrkv";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/c/chntpw/140201-1/debian/patches/14_improve_description";
-      sha256 = "11y5kc4dh4zv24nkb0jw2zwlifx6nzsd4jbizn63l6dbpqgb25rs";
-    })
-    (fetchpatch {
-      name = "17_hexdump-pointer-type.patch";
-      url = "https://git.launchpad.net/ubuntu/+source/chntpw/plain/debian/patches/17_hexdump-pointer-type.patch?id=aed501c87499f403293e7b9f505277567c2f3b52";
-      sha256 = "sha256-ir9LFl8FJq141OwF5SbyVMtjQ1kTMH1NXlHl0XZq7m8=";
-    })
-  ];
+  patches =
+    let
+      fetchChntpwDebianPatch =
+        { patch, hash }:
+        fetchDebianPatch {
+          inherit
+            hash
+            patch
+            pname
+            version
+            ;
+          debianRevision = "1.2";
+        };
+    in
+    [
+      ./00-chntpw-build-arch-autodetect.patch
+      ./01-chntpw-install-target.patch
+      # Import various bug fixes from debian
+      (fetchChntpwDebianPatch {
+        patch = "04_get_abs_path";
+        hash = "sha256-FuEEp/nZ3xNIpemcRTXPThxvQ7ZeB0REOqs0/Jl6AJ4=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "06_correct_test_open_syscall";
+        hash = "sha256-DQ55aRPM1uZOA6Q+C3ISJV0JayWFh2MRSnGuGtdAjwI=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "07_detect_failure_to_write_key";
+        hash = "sha256-lPDOY4ZKSZgLvfdPyurgGjvzzUCDU2JJ9/gKmK/tZl4=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "08_no_deref_null";
+        hash = "sha256-+gOoZuPwGp4byaNJ2dpb8kj6pohXDU1M1YIBqWR197w=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "09_improve_robustness";
+        hash = "sha256-SsX94ds80ccDe8pFAEbg8D4r4XK1cXZsVLbHAHybX9s=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "11_improve_documentation";
+        hash = "sha256-7+FXU7cMEAwtkoWnBRZnsN0Y75T66pyTwexgcSQ0FHs=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "12_readonly_filesystem";
+        hash = "sha256-RDly35sTVxuzEqH7ZXvh8fFC76B2oSfrw87QK9zxrM8=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "13_write_to_hive";
+        hash = "sha256-e2bM7TKyItJPaj3wyObuGQNve/QLCTvyqjNP2T2jaJg=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "14_improve_description";
+        hash = "sha256-OhexHr6rGTqM/XFJ0vS3prtI+RdcgjUtEfsT2AibxYc=";
+      })
+      (fetchChntpwDebianPatch {
+        patch = "17_hexdump-pointer-type.patch";
+        hash = "sha256-ir9LFl8FJq141OwF5SbyVMtjQ1kTMH1NXlHl0XZq7m8=";
+      })
+    ];
 
   installPhase = ''
     make install PREFIX=$out
diff --git a/pkgs/by-name/ch/chroma/package.nix b/pkgs/by-name/ch/chroma/package.nix
index 20c100d07f31..7dd707c5d280 100644
--- a/pkgs/by-name/ch/chroma/package.nix
+++ b/pkgs/by-name/ch/chroma/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
   # nix-prefetch-git --rev v${version} https://github.com/alecthomas/chroma.git > src.json
   src = fetchFromGitHub {
     owner = "alecthomas";
-    repo = pname;
+    repo = "chroma";
     rev = "v${version}";
     inherit (srcInfo) sha256;
   };
diff --git a/pkgs/by-name/ci/circleci-cli/package.nix b/pkgs/by-name/ci/circleci-cli/package.nix
index 763b862a5732..add220315944 100644
--- a/pkgs/by-name/ci/circleci-cli/package.nix
+++ b/pkgs/by-name/ci/circleci-cli/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.31792";
+  version = "0.1.32067";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
-    repo = pname;
+    repo = "circleci-cli";
     rev = "v${version}";
-    sha256 = "sha256-0D0jCBE027zEQI/3iX4nF5ut8PS+nKuKhNf5+buazb8=";
+    sha256 = "sha256-jYj6iuQqX5njKtJa4VfqES9j/+kTETRY25YPMIlYjFY=";
   };
 
-  vendorHash = "sha256-H7q373HL6M6ETkXEY5tAwN32rx0eMkqRAAZ4kQf9rKk=";
+  vendorHash = "sha256-mMMZ0EntLT9YC0Q1ya/uTRA2cl95aqg/XBtLXC7ufqc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ci/cirrusgo/package.nix b/pkgs/by-name/ci/cirrusgo/package.nix
index 27b88bc477df..a5ec32866a7b 100644
--- a/pkgs/by-name/ci/cirrusgo/package.nix
+++ b/pkgs/by-name/ci/cirrusgo/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "Ph33rr";
-    repo = pname;
+    repo = "cirrusgo";
     rev = "v${version}";
     hash = "sha256-FYI/Ldu91YB/4wCiVADeYxYQOeBGro1msY5VXsnixw4=";
   };
diff --git a/pkgs/by-name/cl/clair/package.nix b/pkgs/by-name/cl/clair/package.nix
index c0f1450e05c1..fc020d500d9a 100644
--- a/pkgs/by-name/cl/clair/package.nix
+++ b/pkgs/by-name/cl/clair/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "quay";
-    repo = pname;
+    repo = "clair";
     rev = "v${version}";
     hash = "sha256-itIjDdTKQ0PCfOkefXxqu6MpdWK3F1j6ArvaInQd/hc=";
   };
diff --git a/pkgs/by-name/cl/clairvoyance/package.nix b/pkgs/by-name/cl/clairvoyance/package.nix
index c54c6db6bbe0..4e93632a0a2c 100644
--- a/pkgs/by-name/cl/clairvoyance/package.nix
+++ b/pkgs/by-name/cl/clairvoyance/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "nikitastupin";
-    repo = pname;
+    repo = "clairvoyance";
     tag = "v${version}";
     hash = "sha256-CVXa2HvX7M0cwqnTeZVETg07j324ATQuMNreEgAC2QA=";
   };
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index 035b36b59263..35324cbbaa07 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.3"
+        "@anthropic-ai/claude-code": "^1.0.5"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.3.tgz",
-      "integrity": "sha512-a4aBhcXGG7k4YtyF2aYVKt08h48BG+F12RA/G3K1vb6unl9CAvWDP/A7xudtCOzxFKxLwxctrn74pHEdpmHSPw==",
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.5.tgz",
+      "integrity": "sha512-A4RkIuHktcNygeZXfj/EcF1M5KXlPSwBBXLQLldUNyX4DFAeCpKh9b0UqnLlMd519QBmfmRYDvZqUlt7Fx0a7g==",
       "hasInstallScript": true,
       "license": "SEE LICENSE IN README.md",
       "bin": {
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index 456488949cad..baa811cfdf53 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "1.0.3";
+  version = "1.0.5";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-LjDxVv6KSTuRZhCHztvf81E5DQbkqs8cbrnbbGkCeQU=";
+    hash = "sha256-bvfP1fkfRURLjgJ3mu5a+Rq9IqcU/Y/LkDp4MXzudww=";
   };
 
-  npmDepsHash = "sha256-muMukVEj6uXkupSoyp41FihsLth0ENgfzBlD5CwlE2w=";
+  npmDepsHash = "sha256-u7coCE1bu5Z8r59vaoQOaWfXTRytX4HH3QIA6vf3DNc=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/cl/claws/package.nix b/pkgs/by-name/cl/claws/package.nix
index d189fa3690c0..873c6ef6d8d1 100644
--- a/pkgs/by-name/cl/claws/package.nix
+++ b/pkgs/by-name/cl/claws/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     rev = version;
     owner = "thehowl";
-    repo = pname;
+    repo = "claws";
     hash = "sha256-3zzUBeYfu9x3vRGX1DionLnAs1e44tFj8Z1dpVwjdCg=";
   };
 
diff --git a/pkgs/by-name/cl/cli50/package.nix b/pkgs/by-name/cl/cli50/package.nix
new file mode 100644
index 000000000000..08b849ae1fdc
--- /dev/null
+++ b/pkgs/by-name/cl/cli50/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "cli50";
+  version = "8.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cs50";
+    repo = "cli50";
+    tag = "v${version}";
+    hash = "sha256-0gu31NPql8pFPN4jFbPwYkQmF/rbrAai6EY1ZVfXLew=";
+  };
+
+  build-system = [
+    python3Packages.setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    inflect
+    packaging
+    requests
+    tzlocal
+  ];
+
+  pythonImportsCheck = [ "cli50" ];
+
+  nativeCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  # no python tests
+
+  meta = {
+    description = "Mount directories into cs50/cli containers";
+    homepage = "https://cs50.readthedocs.io/cli50/";
+    downloadPage = "https://github.com/cs50/cli50";
+    changelog = "https://github.com/cs50/cli50/releases/tag/v${version}";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    mainProgram = "cli50";
+  };
+}
diff --git a/pkgs/by-name/cl/cliam/package.nix b/pkgs/by-name/cl/cliam/package.nix
index c1084bf82620..fea95ffc1b9c 100644
--- a/pkgs/by-name/cl/cliam/package.nix
+++ b/pkgs/by-name/cl/cliam/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "securisec";
-    repo = pname;
+    repo = "cliam";
     rev = version;
     hash = "sha256-59nPoH0+k1umMwFg95hQHOr/SRGKqr1URFG7xtVRiTs=";
   };
diff --git a/pkgs/by-name/cl/clipman/package.nix b/pkgs/by-name/cl/clipman/package.nix
index 2db613c3fb10..d3f75c80d72e 100644
--- a/pkgs/by-name/cl/clipman/package.nix
+++ b/pkgs/by-name/cl/clipman/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "chmouel";
-    repo = pname;
+    repo = "clipman";
     rev = "v${version}";
     sha256 = "sha256-kuW74iUVLfIUWf3gaKM7IuMU1nfpU9SbSsfeZDbYGhY=";
   };
diff --git a/pkgs/by-name/cl/clorinde/package.nix b/pkgs/by-name/cl/clorinde/package.nix
index c6a4052d8999..981fd2cf1b14 100644
--- a/pkgs/by-name/cl/clorinde/package.nix
+++ b/pkgs/by-name/cl/clorinde/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "clorinde";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "halcyonnouveau";
     repo = "clorinde";
     tag = "clorinde-v${finalAttrs.version}";
-    hash = "sha256-PUAySbgmbulSlkabABiSFeDDa+o0tQ2uQtiQGSqO1/w=";
+    hash = "sha256-Ynz1pdgckQzMLuUJUGSzNRNwWZKrEZuYgrrT/BxAxzc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-zSeAD3MBflO+lhuLxH57YhR6wxsqZn62XQ0dgImdNLE=";
+  cargoHash = "sha256-g3pWvoTq1DlKlIDJq79IJrvDiLR0HZRPIt4K1YUPsvM=";
 
   cargoBuildFlags = [ "--package=clorinde" ];
 
diff --git a/pkgs/by-name/cl/cloud-nuke/package.nix b/pkgs/by-name/cl/cloud-nuke/package.nix
index d07604647318..b24e1aaa58ad 100644
--- a/pkgs/by-name/cl/cloud-nuke/package.nix
+++ b/pkgs/by-name/cl/cloud-nuke/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
-    repo = pname;
+    repo = "cloud-nuke";
     tag = "v${version}";
     hash = "sha256-zf/aHRZ1WhHwXn+1OJEiTNlOLedP7zXQLuFF2C4D0mw=";
   };
diff --git a/pkgs/by-name/cn/cnquery/package.nix b/pkgs/by-name/cn/cnquery/package.nix
index b31597fcbee4..a73b10d0a012 100644
--- a/pkgs/by-name/cn/cnquery/package.nix
+++ b/pkgs/by-name/cn/cnquery/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "11.54.0";
+  version = "11.56.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-w9O3uEgzSe7e6+ij3AGVOVmDemDY8D1I4UcGXKb1B3E=";
+    hash = "sha256-PkwGfQQiKGUfiUhqzowCaPSBMBaN2S3n7kA3W2UiTQw=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-iGWdx4bgc4TFZ6opc/W9FfXkn6Xgff8pQjOl5SczgSE=";
+  vendorHash = "sha256-JoFj3bHDb0jWwlrioYQv/V6e69ae7HFGkLYBNgntB00=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/by-name/co/cobra-cli/package.nix b/pkgs/by-name/co/cobra-cli/package.nix
index c0883a60c71b..e17156a45a5e 100644
--- a/pkgs/by-name/co/cobra-cli/package.nix
+++ b/pkgs/by-name/co/cobra-cli/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "spf13";
-    repo = pname;
+    repo = "cobra-cli";
     rev = "v${version}";
     sha256 = "sha256-E0I/Pxw4biOv7aGVzGlQOFXnxkc+zZaEoX1JmyMh6UE=";
   };
diff --git a/pkgs/by-name/co/cocom/package.nix b/pkgs/by-name/co/cocom/package.nix
index 0e3d79ec2d32..f359afe36edd 100644
--- a/pkgs/by-name/co/cocom/package.nix
+++ b/pkgs/by-name/co/cocom/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "LamdaLamdaLamda";
-    repo = pname;
+    repo = "cocom";
     rev = "v${version}";
     sha256 = "0sl4ivn95sr5pgw2z877gmhyfc4mk9xr457i5g2i4wqnf2jmy14j";
   };
diff --git a/pkgs/by-name/co/cod/package.nix b/pkgs/by-name/co/cod/package.nix
index 6dd5ef4d82a5..edb4095f26a6 100644
--- a/pkgs/by-name/co/cod/package.nix
+++ b/pkgs/by-name/co/cod/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "dim-an";
-    repo = pname;
+    repo = "cod";
     rev = "v${version}";
     hash = "sha256-mT7OkR8fXXTE3TPx9AmH6ehKGLk4CP9euBPs2zVAJnI=";
   };
diff --git a/pkgs/by-name/co/codebraid/package.nix b/pkgs/by-name/co/codebraid/package.nix
index 9c31dc624501..dce3ab1ba8e6 100644
--- a/pkgs/by-name/co/codebraid/package.nix
+++ b/pkgs/by-name/co/codebraid/package.nix
@@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "gpoore";
-    repo = pname;
+    repo = "codebraid";
     rev = "v${version}";
     hash = "sha256-E9vzGK9ZEVwF+UBpSkdM+hm6vINen/A+LgnnPpc77QQ=";
   };
diff --git a/pkgs/by-name/co/codeowners/package.nix b/pkgs/by-name/co/codeowners/package.nix
index 067870f13b79..00ff848bc03a 100644
--- a/pkgs/by-name/co/codeowners/package.nix
+++ b/pkgs/by-name/co/codeowners/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "hmarr";
-    repo = pname;
+    repo = "codeowners";
     rev = "v${version}";
     hash = "sha256-PMT3ihxCD4TNgTZOD4KB9Od1djIhnlMa8zuD6t1OieU=";
   };
diff --git a/pkgs/by-name/co/cointop/package.nix b/pkgs/by-name/co/cointop/package.nix
index 14f2c8a17c60..9376f2a725c3 100644
--- a/pkgs/by-name/co/cointop/package.nix
+++ b/pkgs/by-name/co/cointop/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "miguelmota";
-    repo = pname;
+    repo = "cointop";
     rev = "v${version}";
     sha256 = "sha256-NAw1uoBL/FnNLJ86L9aBCOY65aJn1DDGK0Cd0IO2kr0=";
   };
diff --git a/pkgs/by-name/co/colima/package.nix b/pkgs/by-name/co/colima/package.nix
index 52cdc4f08e5b..50c3ca8af8e1 100644
--- a/pkgs/by-name/co/colima/package.nix
+++ b/pkgs/by-name/co/colima/package.nix
@@ -18,7 +18,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "abiosoft";
-    repo = pname;
+    repo = "colima";
     rev = "v${version}";
     hash = "sha256-RQnHqEabxyoAKr8BfmVhk8z+l5oy8pa5JPTWk/0FV5g=";
     # We need the git revision
diff --git a/pkgs/by-name/co/colloid-gtk-theme/package.nix b/pkgs/by-name/co/colloid-gtk-theme/package.nix
index de4cdee70ffe..7d64b3261e18 100644
--- a/pkgs/by-name/co/colloid-gtk-theme/package.nix
+++ b/pkgs/by-name/co/colloid-gtk-theme/package.nix
@@ -16,7 +16,7 @@ let
   pname = "colloid-gtk-theme";
 
 in
-lib.checkListOfEnum "${pname}: theme variants"
+lib.checkListOfEnum "colloid-gtk-theme: theme variants"
   [
     "default"
     "purple"
@@ -31,15 +31,15 @@ lib.checkListOfEnum "${pname}: theme variants"
   ]
   themeVariants
   lib.checkListOfEnum
-  "${pname}: color variants"
+  "colloid-gtk-theme: color variants"
   [ "standard" "light" "dark" ]
   colorVariants
   lib.checkListOfEnum
-  "${pname}: size variants"
+  "colloid-gtk-theme: size variants"
   [ "standard" "compact" ]
   sizeVariants
   lib.checkListOfEnum
-  "${pname}: tweaks"
+  "colloid-gtk-theme: tweaks"
   [
     "nord"
     "dracula"
@@ -61,7 +61,7 @@ lib.checkListOfEnum "${pname}: theme variants"
 
     src = fetchFromGitHub {
       owner = "vinceliuice";
-      repo = pname;
+      repo = "colloid-gtk-theme";
       rev = version;
       hash = "sha256-70HDn87acG0me+zbXk6AoGmakY6VLuawq1ubgGcRZVk=";
     };
diff --git a/pkgs/by-name/co/colloid-icon-theme/package.nix b/pkgs/by-name/co/colloid-icon-theme/package.nix
index 03b93d6848cd..1713fcd89b54 100644
--- a/pkgs/by-name/co/colloid-icon-theme/package.nix
+++ b/pkgs/by-name/co/colloid-icon-theme/package.nix
@@ -14,7 +14,7 @@ let
   pname = "colloid-icon-theme";
 
 in
-lib.checkListOfEnum "${pname}: scheme variants"
+lib.checkListOfEnum "colloid-icon-theme: scheme variants"
   [
     "default"
     "nord"
@@ -26,7 +26,7 @@ lib.checkListOfEnum "${pname}: scheme variants"
   ]
   schemeVariants
   lib.checkListOfEnum
-  "${pname}: color variants"
+  "colloid-icon-theme: color variants"
   [
     "default"
     "purple"
@@ -48,7 +48,7 @@ lib.checkListOfEnum "${pname}: scheme variants"
 
     src = fetchFromGitHub {
       owner = "vinceliuice";
-      repo = pname;
+      repo = "colloid-icon-theme";
       rev = version;
       hash = "sha256-x2SSaIkKm1415avO7R6TPkpghM30HmMdjMFUUyPWZsk=";
     };
diff --git a/pkgs/by-name/co/compdb/package.nix b/pkgs/by-name/co/compdb/package.nix
index c840cd85b1fd..fb213a5d39e1 100644
--- a/pkgs/by-name/co/compdb/package.nix
+++ b/pkgs/by-name/co/compdb/package.nix
@@ -10,7 +10,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "Sarcasm";
-    repo = pname;
+    repo = "compdb";
     rev = "v${version}";
     sha256 = "sha256-nFAgTrup6V5oE+LP4UWDOCgTVCv2v9HbQbkGW+oDnTg=";
   };
diff --git a/pkgs/by-name/co/connman/package.nix b/pkgs/by-name/co/connman/package.nix
index e62def2dccab..1995a54fa143 100644
--- a/pkgs/by-name/co/connman/package.nix
+++ b/pkgs/by-name/co/connman/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   autoreconfHook,
   dbus,
   file,
@@ -78,13 +79,26 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ElfOvjJ+eQC34rhMD7MwqpCBXkVYmM0vlB9DCO0r47w=";
   };
 
-  patches = optionals stdenv.hostPlatform.isMusl [
-    # Fix Musl build by avoiding a Glibc-only API.
-    (fetchurl {
-      url = "https://git.alpinelinux.org/aports/plain/community/connman/libresolv.patch?id=e393ea84386878cbde3cccadd36a30396e357d1e";
-      hash = "sha256-7Q1bp8rD/gGVYUqnIXqjr9vypR8jlC926p3KYWl9kLw=";
-    })
-  ];
+  patches =
+    [
+      (fetchpatch {
+        name = "CVE-2025-32366.patch";
+        url = "https://git.kernel.org/pub/scm/network/connman/connman.git/patch/?id=8d3be0285f1d4667bfe85dba555c663eb3d704b4";
+        hash = "sha256-kPb4pZVWvnvTUcpc4wRc8x/pMUTXGIywj3w8IYKRTBs=";
+      })
+      (fetchpatch {
+        name = "CVE-2025-32743.patch";
+        url = "https://git.kernel.org/pub/scm/network/connman/connman.git/patch/?id=d90b911f6760959bdf1393c39fe8d1118315490f";
+        hash = "sha256-odkjYC/iM6dTIJx2WM/KKotXdTtgv8NMFNJMzx5+YU4=";
+      })
+    ]
+    ++ optionals stdenv.hostPlatform.isMusl [
+      # Fix Musl build by avoiding a Glibc-only API.
+      (fetchurl {
+        url = "https://git.alpinelinux.org/aports/plain/community/connman/libresolv.patch?id=e393ea84386878cbde3cccadd36a30396e357d1e";
+        hash = "sha256-7Q1bp8rD/gGVYUqnIXqjr9vypR8jlC926p3KYWl9kLw=";
+      })
+    ];
 
   nativeBuildInputs = [
     autoreconfHook
diff --git a/pkgs/by-name/co/consul/package.nix b/pkgs/by-name/co/consul/package.nix
index e6c24dbd212a..ff04f86b7aef 100644
--- a/pkgs/by-name/co/consul/package.nix
+++ b/pkgs/by-name/co/consul/package.nix
@@ -20,7 +20,7 @@ buildGoModule rec {
   # to apply your changes as patches on top of a release commit.
   src = fetchFromGitHub {
     owner = "hashicorp";
-    repo = pname;
+    repo = "consul";
     tag = "v${version}";
     hash = "sha256-bkBjKvSJapkiqCKENR+mG3sWYTBUZf9klw2UHqgccdc=";
   };
diff --git a/pkgs/by-name/co/containerd/package.nix b/pkgs/by-name/co/containerd/package.nix
index 3d2016a256cd..555f0bc2fe80 100644
--- a/pkgs/by-name/co/containerd/package.nix
+++ b/pkgs/by-name/co/containerd/package.nix
@@ -16,7 +16,7 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "2.1.0";
+  version = "2.1.1";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ buildGoModule rec {
     owner = "containerd";
     repo = "containerd";
     tag = "v${version}";
-    hash = "sha256-5Fd9LrpJUf5MEtfQaRM6zo5C8RUsOasR2NHCDj8vMBk=";
+    hash = "sha256-ZqQX+bogzAsMvqYNKyWvHF2jdPOIhNQDizKEDbcbmOg=";
   };
 
   postPatch = "patchShebangs .";
diff --git a/pkgs/by-name/co/containerlab/package.nix b/pkgs/by-name/co/containerlab/package.nix
index ab1f24407686..74ac889dda8a 100644
--- a/pkgs/by-name/co/containerlab/package.nix
+++ b/pkgs/by-name/co/containerlab/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "containerlab";
-  version = "0.67.0";
+  version = "0.68.0";
 
   src = fetchFromGitHub {
     owner = "srl-labs";
     repo = "containerlab";
     rev = "v${version}";
-    hash = "sha256-wTVGvaosHhQleRDytCdA1R4YKlzgGN4nWRZx6Ok+O3U=";
+    hash = "sha256-x6QDwduAMCD+Trj0awQXW0Tdleb2U6YBi/7mdMB6V/8=";
   };
 
-  vendorHash = "sha256-Bba2Lt43I9jKg6zWhXWE0yJsVx7SlQ2GmrK++cZ9TrM=";
+  vendorHash = "sha256-XRgKfRw6VGg+lkbtPWUVNfAk5a7ZdFwVmhjtM7uSwHs=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/co/convmv/package.nix b/pkgs/by-name/co/convmv/package.nix
index 9670d85dcd64..50036f87495f 100644
--- a/pkgs/by-name/co/convmv/package.nix
+++ b/pkgs/by-name/co/convmv/package.nix
@@ -2,7 +2,9 @@
   lib,
   stdenv,
   fetchzip,
+  makeWrapper,
   perl,
+  perlPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -10,8 +12,9 @@ stdenv.mkDerivation (finalAttrs: {
   version = "2.06";
 
   outputs = [
-    "out"
+    "bin"
     "man"
+    "out"
   ];
 
   src = fetchzip {
@@ -21,12 +24,20 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [
+    makeWrapper
+    perl
+  ];
 
-  buildInputs = [ perl ];
+  buildInputs = [
+    perl
+    perlPackages.EncodeHanExtra
+    perlPackages.EncodeIMAPUTF7
+    perlPackages.EncodeJIS2K
+  ];
 
   makeFlags = [
-    "PREFIX=${placeholder "out"}"
+    "PREFIX=${placeholder "bin"}"
     "MANDIR=${placeholder "man"}/share/man"
   ];
 
@@ -46,6 +57,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontPatchShebangs = true;
 
+  postFixup = ''
+    wrapProgram "$bin/bin/convmv" --prefix PERL5LIB : "$PERL5LIB"
+  '';
+
   meta = with lib; {
     description = "Converts filenames from one encoding to another";
     downloadPage = "https://www.j3e.de/linux/convmv/";
diff --git a/pkgs/by-name/co/copilot-cli/package.nix b/pkgs/by-name/co/copilot-cli/package.nix
index c490225de5a0..c7f1c7af4d85 100644
--- a/pkgs/by-name/co/copilot-cli/package.nix
+++ b/pkgs/by-name/co/copilot-cli/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "aws";
-    repo = pname;
+    repo = "copilot-cli";
     rev = "v${version}";
     hash = "sha256-Oxt1+0z+woNPsFuCkj4t71/e21mHtoCd281BwbHCGc8=";
   };
diff --git a/pkgs/by-name/co/cordless/package.nix b/pkgs/by-name/co/cordless/package.nix
index f58b6752ea63..28189ddc9f31 100644
--- a/pkgs/by-name/co/cordless/package.nix
+++ b/pkgs/by-name/co/cordless/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "Bios-Marcel";
-    repo = pname;
+    repo = "cordless";
     rev = version;
     hash = "sha256-nOHLI0N4d8aC7KaWdLezSpVU1DS1fkfW5UO7cVYCbis=";
   };
diff --git a/pkgs/by-name/co/coreth/package.nix b/pkgs/by-name/co/coreth/package.nix
index e17c06da1a5d..b033e6a5b642 100644
--- a/pkgs/by-name/co/coreth/package.nix
+++ b/pkgs/by-name/co/coreth/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ava-labs";
-    repo = pname;
+    repo = "coreth";
     rev = "v${version}";
     hash = "sha256-YUqrbTjye0eNNuf9hGQXtMidRq6y3m3pSKzIRVECy9E=";
   };
diff --git a/pkgs/by-name/co/cotton/package.nix b/pkgs/by-name/co/cotton/package.nix
index 87f20b1acff4..9e884800a7ab 100644
--- a/pkgs/by-name/co/cotton/package.nix
+++ b/pkgs/by-name/co/cotton/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "cotton";
   version = "unstable-2023-09-13";
 
   src = fetchFromGitHub {
     owner = "danielhuang";
-    repo = pname;
+    repo = "cotton";
     rev = "df9d79a4b0bc4b140e87ddd7795924a93775a864";
     sha256 = "sha256-ZMQaVMH8cuOb4PQ19g0pAFAMwP8bR60+eWFhiXk1bYE=";
   };
diff --git a/pkgs/by-name/cr/credential-detector/package.nix b/pkgs/by-name/cr/credential-detector/package.nix
index 145f12910e82..e55eb83f8526 100644
--- a/pkgs/by-name/cr/credential-detector/package.nix
+++ b/pkgs/by-name/cr/credential-detector/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ynori7";
-    repo = pname;
+    repo = "credential-detector";
     rev = "v${version}";
     hash = "sha256-20ySTLpjTc1X0iJsbzbeLmWF0xYzzREGOqEWrB2X1GQ=";
   };
diff --git a/pkgs/by-name/cr/cri-tools/package.nix b/pkgs/by-name/cr/cri-tools/package.nix
index 0a15e50fc610..260bc42cc800 100644
--- a/pkgs/by-name/cr/cri-tools/package.nix
+++ b/pkgs/by-name/cr/cri-tools/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
-    repo = pname;
+    repo = "cri-tools";
     rev = "v${version}";
     hash = "sha256-KxckDpZ3xfD+buCGrQ+udJF0X2D9sg/d3TLSQEcWyV4=";
   };
diff --git a/pkgs/by-name/cr/crlfuzz/package.nix b/pkgs/by-name/cr/crlfuzz/package.nix
index f9b750da7642..fcfde3dc0262 100644
--- a/pkgs/by-name/cr/crlfuzz/package.nix
+++ b/pkgs/by-name/cr/crlfuzz/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "dwisiswant0";
-    repo = pname;
+    repo = "crlfuzz";
     rev = "v${version}";
     sha256 = "sha256-rqhdxOQmZCRtq+IZygKLleb5GoKP2akyEc3rbGcnZmw=";
   };
diff --git a/pkgs/by-name/cr/croc/package.nix b/pkgs/by-name/cr/croc/package.nix
index 8493b0ed7279..24e0b09ea49f 100644
--- a/pkgs/by-name/cr/croc/package.nix
+++ b/pkgs/by-name/cr/croc/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "schollz";
-    repo = pname;
+    repo = "croc";
     rev = "v${version}";
     hash = "sha256-tRWkokgs2SZglkgzK+UxwzbTk99GcPgDBcgJkMURNJ8=";
   };
diff --git a/pkgs/by-name/cr/cromite/package.nix b/pkgs/by-name/cr/cromite/package.nix
index 118bee32b0a0..93af344c49bb 100644
--- a/pkgs/by-name/cr/cromite/package.nix
+++ b/pkgs/by-name/cr/cromite/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchurl,
-  makeBinaryWrapper,
+  makeWrapper,
   patchelf,
   copyDesktopItems,
   makeDesktopItem,
@@ -166,15 +166,15 @@ let
       qt6.qtbase
       qt6.qtwayland
     ];
-  commit = "0ffdb845a6a3308cbd9826bb78269d1d05cfb8aa";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "cromite";
-  version = "135.0.7049.100";
+  version = "137.0.7151.44";
+  commit = "1abdac0aff0916b1e4a4bd52f1896eec00834262";
 
   src = fetchurl {
-    url = "https://github.com/uazo/cromite/releases/download/v${finalAttrs.version}-${commit}/chrome-lin64.tar.gz";
-    hash = "sha256-bB6CPqgwT1p7aXIKauOrRhG4dhCQ9tyO+HHRrkbrsPQ=";
+    url = "https://github.com/uazo/cromite/releases/download/v${finalAttrs.version}-${finalAttrs.commit}/chrome-lin64.tar.gz";
+    hash = "sha256-33GS4uD3RJHy9M0S5TRB6kRb1SZR+ABLyOR1oeVLQto=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly
@@ -182,7 +182,7 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = false;
 
   nativeBuildInputs = [
-    makeBinaryWrapper
+    makeWrapper
     patchelf
     copyDesktopItems
   ];
@@ -234,6 +234,7 @@ stdenv.mkDerivation (finalAttrs: {
       --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
       --set CHROME_WRAPPER  "cromite" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}" \
+      --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
       --add-flags ${lib.escapeShellArg commandLineArgs}
 
     # Make sure that libGL and libvulkan are found by ANGLE libGLESv2.so
@@ -247,6 +248,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     changelog = "https://github.com/uazo/cromite/releases";
     description = "Bromite fork with ad blocking and privacy enhancements";
diff --git a/pkgs/by-name/cr/cromite/update.sh b/pkgs/by-name/cr/cromite/update.sh
new file mode 100755
index 000000000000..5e604bc242db
--- /dev/null
+++ b/pkgs/by-name/cr/cromite/update.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i bash -p curl gnused jq nix bash coreutils nix-update common-updater-scripts
+
+set -eou pipefail
+
+latestTag=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL https://api.github.com/repos/uazo/cromite/releases/latest | jq --raw-output .tag_name | sed 's/^v//')
+latestVersion="${latestTag%-*}"
+commit="${latestTag#*-}"
+
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; cromite.version or (lib.getVersion cromite)" | tr -d '"')
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "package is up-to-date: $currentVersion"
+    exit 0
+fi
+
+update-source-version cromite $commit --version-key=commit || true
+nix-update cromite --version $latestVersion
diff --git a/pkgs/by-name/cr/crowbar/package.nix b/pkgs/by-name/cr/crowbar/package.nix
index 8cd303b6b72f..8f236ceb095e 100644
--- a/pkgs/by-name/cr/crowbar/package.nix
+++ b/pkgs/by-name/cr/crowbar/package.nix
@@ -8,13 +8,13 @@
   tigervnc,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "crowbar";
   version = "unstable-2020-04-23";
 
   src = fetchFromGitHub {
     owner = "galkan";
-    repo = pname;
+    repo = "crowbar";
     rev = "500d633ff5ddfcbc70eb6d0b4d2181e5b8d3c535";
     sha256 = "05m9vywr9976pc7il0ak8nl26mklzxlcqx0p8rlfyx1q766myqzf";
   };
diff --git a/pkgs/by-name/cr/crowdsec/package.nix b/pkgs/by-name/cr/crowdsec/package.nix
index d817e93cd755..eccca789cecd 100644
--- a/pkgs/by-name/cr/crowdsec/package.nix
+++ b/pkgs/by-name/cr/crowdsec/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "crowdsecurity";
-    repo = pname;
+    repo = "crowdsec";
     tag = "v${version}";
     hash = "sha256-/NTlj0kYCOMxShfoKdmouJTiookDjccUj5HFHLPn5HI=";
   };
diff --git a/pkgs/by-name/cr/cryptpad/package.nix b/pkgs/by-name/cr/cryptpad/package.nix
index 804ff3c72a29..ffb27ee1bb8a 100644
--- a/pkgs/by-name/cr/cryptpad/package.nix
+++ b/pkgs/by-name/cr/cryptpad/package.nix
@@ -120,6 +120,8 @@ buildNpmPackage {
     # Move to install directory manually.
     npm run install:components
     mv www/components "$out_cryptpad/www/"
+    # and fix absolute symlink to /build...
+    ln -Tfs ../../src/tweetnacl "$out_cryptpad/www/components/tweetnacl"
 
     # install OnlyOffice (install-onlyoffice.sh without network)
     mkdir -p "$out_cryptpad/www/common/onlyoffice/dist"
diff --git a/pkgs/by-name/cs/cshatag/package.nix b/pkgs/by-name/cs/cshatag/package.nix
index 16dedcf39cff..befc1ee745f8 100644
--- a/pkgs/by-name/cs/cshatag/package.nix
+++ b/pkgs/by-name/cs/cshatag/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "rfjakob";
-    repo = pname;
+    repo = "cshatag";
     rev = "v${version}";
     sha256 = "sha256-RqQPbqfliKg7XPA/C9D7Aq1SsN+tAW44tAFHt9p8Py0=";
   };
diff --git a/pkgs/by-name/cs/css-checker/package.nix b/pkgs/by-name/cs/css-checker/package.nix
index ef5038ec9cb7..09f464a593b4 100644
--- a/pkgs/by-name/cs/css-checker/package.nix
+++ b/pkgs/by-name/cs/css-checker/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ruilisi";
-    repo = pname;
+    repo = "css-checker";
     rev = "v${version}";
     hash = "sha256-lD2uF8zhJG8pVepqxyKKj4GZNB883uDV/9dCMFYJbRs=";
   };
diff --git a/pkgs/by-name/cs/csvs-to-sqlite/package.nix b/pkgs/by-name/cs/csvs-to-sqlite/package.nix
index 171c2c418d67..c054aa2f2301 100644
--- a/pkgs/by-name/cs/csvs-to-sqlite/package.nix
+++ b/pkgs/by-name/cs/csvs-to-sqlite/package.nix
@@ -13,7 +13,7 @@ buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "simonw";
-    repo = pname;
+    repo = "csvs-to-sqlite";
     rev = version;
     hash = "sha256-wV6htULG3lg2IhG2bXmc/9vjcK8/+WA7jm3iJu4ZoOE=";
   };
diff --git a/pkgs/by-name/ct/ctlptl/package.nix b/pkgs/by-name/ct/ctlptl/package.nix
index 49ce61b095e9..a443589f0474 100644
--- a/pkgs/by-name/ct/ctlptl/package.nix
+++ b/pkgs/by-name/ct/ctlptl/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "ctlptl";
-  version = "0.8.41";
+  version = "0.8.42";
 
   src = fetchFromGitHub {
     owner = "tilt-dev";
-    repo = pname;
+    repo = "ctlptl";
     rev = "v${version}";
-    hash = "sha256-PjTgXjA3lP4tzkcnWt711DJtu5/2zR+a2yyYmzf5WvE=";
+    hash = "sha256-aMpQbWdAIRQ8mBQkzf3iGsLezU7jHVQK2KXzyBnUFJ0=";
   };
 
-  vendorHash = "sha256-EYpPZvAhKsKguvDousIs9BTD8fnCcZql3IktKf92wxs=";
+  vendorHash = "sha256-kxayiAymEHnZ+b/a7JgUx3/I5gnNEdg+Vg5ymMO9JG8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ct/ctop/package.nix b/pkgs/by-name/ct/ctop/package.nix
index 1af537b225d2..35e9802562fc 100644
--- a/pkgs/by-name/ct/ctop/package.nix
+++ b/pkgs/by-name/ct/ctop/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "bcicen";
-    repo = pname;
+    repo = "ctop";
     rev = "v${version}";
     sha256 = "sha256-tojSzgpoGQg6MwV/MVpQpCA5w6bZO+9IOvfkw0Ydr6c=";
   };
diff --git a/pkgs/by-name/cu/cucumber/Gemfile.lock b/pkgs/by-name/cu/cucumber/Gemfile.lock
index cc2f3d54144d..5730c2bb6b82 100644
--- a/pkgs/by-name/cu/cucumber/Gemfile.lock
+++ b/pkgs/by-name/cu/cucumber/Gemfile.lock
@@ -1,9 +1,9 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    bigdecimal (3.1.7)
-    builder (3.2.4)
-    cucumber (9.2.0)
+    bigdecimal (3.1.9)
+    builder (3.3.0)
+    cucumber (9.2.1)
       builder (~> 3.2)
       cucumber-ci-environment (> 9, < 11)
       cucumber-core (> 13, < 14)
@@ -16,23 +16,23 @@ GEM
       multi_test (~> 1.1)
       sys-uname (~> 1.2)
     cucumber-ci-environment (10.0.1)
-    cucumber-core (13.0.1)
+    cucumber-core (13.0.3)
       cucumber-gherkin (>= 27, < 28)
       cucumber-messages (>= 20, < 23)
       cucumber-tag-expressions (> 5, < 7)
-    cucumber-cucumber-expressions (17.0.2)
+    cucumber-cucumber-expressions (17.1.0)
       bigdecimal
     cucumber-gherkin (27.0.0)
       cucumber-messages (>= 19.1.4, < 23)
-    cucumber-html-formatter (21.3.0)
-      cucumber-messages (> 19, < 25)
+    cucumber-html-formatter (21.9.0)
+      cucumber-messages (> 19, < 28)
     cucumber-messages (22.0.0)
-    cucumber-tag-expressions (6.1.0)
-    diff-lcs (1.5.1)
-    ffi (1.16.3)
+    cucumber-tag-expressions (6.1.2)
+    diff-lcs (1.6.2)
+    ffi (1.17.2)
     mini_mime (1.1.5)
     multi_test (1.1.0)
-    sys-uname (1.2.3)
+    sys-uname (1.3.1)
       ffi (~> 1.1)
 
 PLATFORMS
@@ -42,4 +42,4 @@ DEPENDENCIES
   cucumber
 
 BUNDLED WITH
-   2.5.6
+   2.6.6
diff --git a/pkgs/by-name/cu/cucumber/gemset.nix b/pkgs/by-name/cu/cucumber/gemset.nix
index ae0dee703c99..2bbb79135cd8 100644
--- a/pkgs/by-name/cu/cucumber/gemset.nix
+++ b/pkgs/by-name/cu/cucumber/gemset.nix
@@ -4,20 +4,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0cq1c29zbkcxgdihqisirhcw76xc768z2zpd5vbccpq0l1lv76g7";
+      sha256 = "1k6qzammv9r6b2cw3siasaik18i6wjc5m0gw5nfdc6jj64h79z1g";
       type = "gem";
     };
-    version = "3.1.7";
+    version = "3.1.9";
   };
   builder = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "045wzckxpwcqzrjr353cxnyaxgf0qg22jh00dcx7z38cys5g1jlr";
+      sha256 = "0pw3r2lyagsxkm71bf44v5b74f7l9r7di22brbyji9fwz791hya9";
       type = "gem";
     };
-    version = "3.2.4";
+    version = "3.3.0";
   };
   cucumber = {
     dependencies = [
@@ -37,10 +37,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "19qsfgahkah4k0pajxc04mjn8pig7g4n9nkcarg1nzs2612c29s8";
+      sha256 = "0cbi1g6qwdh38z2jxm8a1mc63iz887108747c99s3g452hwn2hgs";
       type = "gem";
     };
-    version = "9.2.0";
+    version = "9.2.1";
   };
   cucumber-ci-environment = {
     groups = [ "default" ];
@@ -62,10 +62,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1jf5ngxfc1q2y7l2nci3p91gp253aqdhkhazkz0yxq72n6zrszvm";
+      sha256 = "0i2k5j3l8yy1367hzmg7x3xy984bnmihnzjh0ic8s2nwb3b2h770";
       type = "gem";
     };
-    version = "13.0.1";
+    version = "13.0.3";
   };
   cucumber-cucumber-expressions = {
     dependencies = [ "bigdecimal" ];
@@ -73,10 +73,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0wsczwaqws1hbkirjhl0lh5s5xhc7cpmj2f790lkx10nr85rbpxi";
+      sha256 = "14fkk7bfzm9cyacgcyzgkjc3nblflz4rcnlyz0pzd1ypwpqrvgm1";
       type = "gem";
     };
-    version = "17.0.2";
+    version = "17.1.0";
   };
   cucumber-gherkin = {
     dependencies = [ "cucumber-messages" ];
@@ -95,10 +95,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0wznhl3b8b47zff0yx69828bx33n0vc60kh6110ml0xni7lx8xw1";
+      sha256 = "18bfg6gpijjbka0pp7604src1ajjkmsr79nyvr6zjgw4j0nvdsfn";
       type = "gem";
     };
-    version = "21.3.0";
+    version = "21.9.0";
   };
   cucumber-messages = {
     groups = [ "default" ];
@@ -115,30 +115,30 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1g0fl6v1677q71nkaib2g3p03jdzrwgfanpi96srb1743qd54bk1";
+      sha256 = "0vcifp1fiha6yqi36m26n1vr8sz3dpnn5966hcz4a3dq43lf947p";
       type = "gem";
     };
-    version = "6.1.0";
+    version = "6.1.2";
   };
   diff-lcs = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1znxccz83m4xgpd239nyqxlifdb7m8rlfayk6s259186nkgj6ci7";
+      sha256 = "0qlrj2qyysc9avzlr4zs1py3x684hqm61n4czrsk1pyllz5x5q4s";
       type = "gem";
     };
-    version = "1.5.1";
+    version = "1.6.2";
   };
   ffi = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1yvii03hcgqj30maavddqamqy50h7y6xcn2wcyq72wn823zl4ckd";
+      sha256 = "19kdyjg3kv7x0ad4xsd4swy5izsbb1vl1rpb6qqcqisr5s23awi9";
       type = "gem";
     };
-    version = "1.16.3";
+    version = "1.17.2";
   };
   mini_mime = {
     groups = [ "default" ];
@@ -166,9 +166,9 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "03j9qpqip89a0vk6s0gvhxzhbvafjcj5rss7i3jwha0831aivib3";
+      sha256 = "177l8rrqnb4rxf657mw28sgvgc8a2m7nlqcbdbra5m4xga0ypcxp";
       type = "gem";
     };
-    version = "1.2.3";
+    version = "1.3.1";
   };
 }
diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index 9f3b02d2fc59..ec012ab2bb37 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -103,10 +103,30 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Sgk5eaPC0C3i+8AFSaMncQB/LngDLG+qXs0vep4VICU=";
   };
 
-  patches = [
-    # Backport of https://github.com/curl/curl/commit/5fbd78eb2dc4afbd8884e8eed27147fc3d4318f6
-    ./0001-http2-fix-stream-window-size-after-unpausing.patch
-  ];
+  patches =
+    [
+      # Backport of https://github.com/curl/curl/commit/5fbd78eb2dc4afbd8884e8eed27147fc3d4318f6
+      ./0001-http2-fix-stream-window-size-after-unpausing.patch
+    ]
+    ++ lib.optionals wolfsslSupport [
+      (fetchpatch {
+        # https://curl.se/docs/CVE-2025-4947.html backported to 8.13. Remove when version is bumped to 8.14.
+        # Note that this works since fetchpatch uses curl, but does not use WolfSSL.
+        name = "curl-CVE-2025-4947.patch";
+        url = "https://github.com/curl/curl/commit/a85f1df4803bbd272905c9e7125.diff";
+        hash = "sha256-z4IYAkg/RylTs1m8tbwI2tVqTCHkIpmkzdFBcRBJmH4=";
+
+        # All the test patches fail to apply (seemingly, they were added for 8.14)
+        includes = [ "lib/vquic/vquic-tls.c" ];
+      })
+      (fetchpatch {
+        # https://curl.se/docs/CVE-2025-5025.html backported to 8.13. Remove when version is bumped to 8.14.
+        # Note that this works since fetchpatch uses curl, but does not use WolfSSL.
+        name = "curl-CVE-2025-5025.patch";
+        url = "https://github.com/curl/curl/commit/e1f65937a96a451292e92313396.diff";
+        hash = "sha256-9k05eDGUA7XT+H4p8H8v0lYXC4cW7W2uvO+z4gLapX4=";
+      })
+    ];
 
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
   # necessary for FreeBSD code path in configure
diff --git a/pkgs/by-name/cu/curseradio/package.nix b/pkgs/by-name/cu/curseradio/package.nix
index 431d600830ca..37e2f6134188 100644
--- a/pkgs/by-name/cu/curseradio/package.nix
+++ b/pkgs/by-name/cu/curseradio/package.nix
@@ -6,13 +6,13 @@
   mpv,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   version = "0.2";
   pname = "curseradio";
 
   src = fetchFromGitHub {
     owner = "chronitis";
-    repo = pname;
+    repo = "curseradio";
     rev = "1bd4bd0faeec675e0647bac9a100b526cba19f8d";
     sha256 = "11bf0jnj8h2fxhpdp498189r4s6b47vy4wripv0z4nx7lxajl88i";
   };
diff --git a/pkgs/by-name/cw/cwltool/package.nix b/pkgs/by-name/cw/cwltool/package.nix
index 57cf3be6963c..6cde031522fc 100644
--- a/pkgs/by-name/cw/cwltool/package.nix
+++ b/pkgs/by-name/cw/cwltool/package.nix
@@ -40,6 +40,8 @@ py.pkgs.buildPythonApplication rec {
       --replace-fail "prov == 1.5.1" "prov" \
       --replace-fail '"schema-salad >= 8.7, < 9",' '"schema-salad",' \
       --replace-fail "PYTEST_RUNNER + " ""
+    substituteInPlace pyproject.toml \
+      --replace-fail "mypy==1.14.1" "mypy"
   '';
 
   build-system = with py.pkgs; [
diff --git a/pkgs/by-name/cw/cwtch-ui/package.nix b/pkgs/by-name/cw/cwtch-ui/package.nix
index 957ff202c818..97199ed5092f 100644
--- a/pkgs/by-name/cw/cwtch-ui/package.nix
+++ b/pkgs/by-name/cw/cwtch-ui/package.nix
@@ -1,7 +1,7 @@
 {
   cwtch,
   fetchgit,
-  flutter,
+  flutter329,
   lib,
   tor,
 }:
@@ -10,7 +10,7 @@ let
     tor
   ];
 in
-flutter.buildFlutterApplication rec {
+flutter329.buildFlutterApplication rec {
   pname = "cwtch-ui";
   version = "1.15.5";
   # This Gitea instance has archive downloads disabled, so: fetchgit
diff --git a/pkgs/by-name/d2/d2/package.nix b/pkgs/by-name/d2/d2/package.nix
index 922fed3a9725..8a60df382f4d 100644
--- a/pkgs/by-name/d2/d2/package.nix
+++ b/pkgs/by-name/d2/d2/package.nix
@@ -14,7 +14,7 @@ buildGo123Module rec {
 
   src = fetchFromGitHub {
     owner = "terrastruct";
-    repo = pname;
+    repo = "d2";
     tag = "v${version}";
     hash = "sha256-RlQRf/ueYCbanXXA8tAftQ/9JKkH0QwT4+7Vlwtlnp8=";
   };
diff --git a/pkgs/by-name/da/dashing/package.nix b/pkgs/by-name/da/dashing/package.nix
index 58fb7f68b1ba..9bc4140c1265 100644
--- a/pkgs/by-name/da/dashing/package.nix
+++ b/pkgs/by-name/da/dashing/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "technosophos";
-    repo = pname;
+    repo = "dashing";
     rev = version;
     hash = "sha256-CcEgGPnJGrTXrgo82u5dxQTB/YjFBhHdsv7uggsHG1Y=";
   };
diff --git a/pkgs/by-name/dd/ddns-go/package.nix b/pkgs/by-name/dd/ddns-go/package.nix
index a5a9320038b8..20341acf28ad 100644
--- a/pkgs/by-name/dd/ddns-go/package.nix
+++ b/pkgs/by-name/dd/ddns-go/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jeessy2";
-    repo = pname;
+    repo = "ddns-go";
     rev = "v${version}";
     hash = "sha256-78Y6kJWrF3EtbvLc5Jk+mNZQRfydcIPn4bw7tIUvGoY=";
   };
diff --git a/pkgs/by-name/de/dec-decode/package.nix b/pkgs/by-name/de/dec-decode/package.nix
index f3146c682a89..5f853b3ba6c6 100644
--- a/pkgs/by-name/de/dec-decode/package.nix
+++ b/pkgs/by-name/de/dec-decode/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "dec-decode";
   version = "unstable-2022-12-24";
 
   src = fetchFromGitHub {
     owner = "sammiq";
-    repo = pname;
+    repo = "dec-decode";
     rev = "6ee103c";
     hash = "sha256-vOYKVl00oaXwp77pRLqUPnXQT5QuJfqnGGkQVBMq5W0=";
   };
diff --git a/pkgs/by-name/de/decent-sampler/package.nix b/pkgs/by-name/de/decent-sampler/package.nix
index c388cef5aa75..5742b06a596c 100644
--- a/pkgs/by-name/de/decent-sampler/package.nix
+++ b/pkgs/by-name/de/decent-sampler/package.nix
@@ -14,7 +14,7 @@
 
 let
   pname = "decent-sampler";
-  version = "1.12.5";
+  version = "1.12.14";
 
   icon = fetchurl {
     url = "https://www.decentsamples.com/wp-content/uploads/2018/09/cropped-Favicon_512x512.png";
@@ -26,8 +26,8 @@ let
 
     src = fetchzip {
       # dropbox links: https://www.dropbox.com/sh/dwyry6xpy5uut07/AABBJ84bjTTSQWzXGG5TOQpfa\
-      url = "https://www.dropbox.com/scl/fo/a0i0udw7ggfwnjoi05hh3/APOyrCpI3CaO46Gq1IFUv-A/Decent_Sampler-1.12.5-Linux-Static-x86_64.tar.gz?rlkey=orvjprslmwn0dkfs0ncx6nxnm&dl=0";
-      hash = "sha256-jr2bl8nQhfWdpZZGQU6T6TDKSW6SZpweJ2GiQz7n9Ug=";
+      url = "https://www.dropbox.com/scl/fo/a0i0udw7ggfwnjoi05hh3/AFAQQGWSQ-kxJv5JggeMTrE/Decent_Sampler-1.12.14-Linux-Static-x86_64.tar.gz?rlkey=orvjprslmwn0dkfs0ncx6nxnm&dl=0";
+      hash = "sha256-n9WTR11chK9oCz84uYhymov1axTVRr4OLo6W0cRpdWc=";
     };
 
     nativeBuildInputs = [ copyDesktopItems ];
@@ -91,6 +91,7 @@ buildFHSEnv {
     # It claims to be free but we currently cannot find any license
     # that it is released under.
     license = licenses.unfree;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [
       adam248
diff --git a/pkgs/by-name/de/deepsea/package.nix b/pkgs/by-name/de/deepsea/package.nix
index 5fb90e4ab991..35cc2b5943fe 100644
--- a/pkgs/by-name/de/deepsea/package.nix
+++ b/pkgs/by-name/de/deepsea/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "dsnezhkov";
-    repo = pname;
+    repo = "deepsea";
     rev = "v${version}";
     sha256 = "02s03sha8vwp7dsaw3z446pskhb6wmy0hyj0mhpbx58sf147rkig";
   };
diff --git a/pkgs/by-name/de/deno/librusty_v8.nix b/pkgs/by-name/de/deno/librusty_v8.nix
index fbd9f29aac67..3820d6327bf7 100644
--- a/pkgs/by-name/de/deno/librusty_v8.nix
+++ b/pkgs/by-name/de/deno/librusty_v8.nix
@@ -2,11 +2,11 @@
 { fetchLibrustyV8 }:
 
 fetchLibrustyV8 {
-  version = "135.1.0";
+  version = "137.1.0";
   shas = {
-    x86_64-linux = "sha256-QGpFNkVHO9j4uagYNC5X3JVif80RVazp63oqrdWYUoU=";
-    aarch64-linux = "sha256-J4E32qZNyqmJyFKBuU+6doRYL3ZSaEMSBlML+hSkj+o=";
-    x86_64-darwin = "sha256-UnulsDS1LlrVR2+cz+4zgWxKqbkB5ch3T9UofGCZduQ=";
-    aarch64-darwin = "sha256-mU7N/1vXzCP+mwjzLTsDkT+8YOJifwNju3Rv9Cq5Loo=";
+    x86_64-linux = "sha256-Tiscfy2bzYGR3s0T+SC1IB3xWvTVpVcSEdjq3MCRoRw=";
+    aarch64-linux = "sha256-2GYc+fgZLGUMQCXXSiyYUNKxZM4Mb788by+cWPdA9+4=";
+    x86_64-darwin = "sha256-yOJWfwIdl+uF7z7K6RzTcwnlgkDE8NM+e1tbWshx8+k=";
+    aarch64-darwin = "sha256-QQaC74Itb3D9EaN6PTxrjAGd/F9d6HY6PiLp+8jHK24=";
   };
 }
diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix
index b5725fdb7b62..4bd1e5794f7d 100644
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -21,17 +21,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.2.12";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/5KCwWyPdx/OKjoKgHZ8BAih7dh21VrbC+N1U74B/KI=";
+    hash = "sha256-KfgxKmxkF5/BrAsXkpmyWXV2H+vwX31dnzQORtt3A90=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-3I1yplJjVH7Mf2wjwk8qSdbHTcR20QSJGF9MHtnu+q8=";
+  cargoHash = "sha256-DWODuTslGvx9PHUMsxY+MS15IcECcq7Ne7IUEovWoa0=";
 
   postPatch = ''
     # Use patched nixpkgs libffi in order to fix https://github.com/libffi/libffi/pull/857
diff --git a/pkgs/by-name/de/der-ascii/package.nix b/pkgs/by-name/de/der-ascii/package.nix
index 90c4651363c9..218d973d4314 100644
--- a/pkgs/by-name/de/der-ascii/package.nix
+++ b/pkgs/by-name/de/der-ascii/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "google";
-    repo = pname;
+    repo = "der-ascii";
     rev = "v${version}";
     sha256 = "sha256-xGzxq5AHvzLUOp9VUcI9JMwrCpVIrpDvenWUOEBP6pA=";
   };
diff --git a/pkgs/by-name/de/devede/package.nix b/pkgs/by-name/de/devede/package.nix
index d9342d690216..ff922648b855 100644
--- a/pkgs/by-name/de/devede/package.nix
+++ b/pkgs/by-name/de/devede/package.nix
@@ -12,6 +12,7 @@
   wrapGAppsHook3,
   gdk-pixbuf,
   gobject-introspection,
+  nix-update-script,
 }:
 
 let
@@ -25,14 +26,14 @@ let
 in
 buildPythonApplication rec {
   pname = "devede";
-  version = "4.19.0";
+  version = "4.21.0";
   namePrefix = "";
 
   src = fetchFromGitLab {
     owner = "rastersoft";
     repo = "devedeng";
     rev = version;
-    hash = "sha256-hjt2bXQov4lC6O4VY/eu/PZ2taSKng9gRhFDFhQR9SY=";
+    hash = "sha256-sLJkIKw0ciX6spugbdO0eZ1dIkoHfuu5e/f2XwA70a0=";
   };
 
   nativeBuildInputs = [
@@ -66,10 +67,15 @@ buildPythonApplication rec {
       --replace "/usr/local/share" "$out/share"
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "DVD Creator for Linux";
     homepage = "https://www.rastersoft.com/programas/devede.html";
     license = licenses.gpl3;
-    maintainers = [ maintainers.bdimcheff ];
+    maintainers = [
+      maintainers.bdimcheff
+      maintainers.baksa
+    ];
   };
 }
diff --git a/pkgs/by-name/de/dex-oidc/package.nix b/pkgs/by-name/de/dex-oidc/package.nix
index 1cfde8295079..5146ad0fdac9 100644
--- a/pkgs/by-name/de/dex-oidc/package.nix
+++ b/pkgs/by-name/de/dex-oidc/package.nix
@@ -13,7 +13,7 @@ buildGo124Module rec {
 
   src = fetchFromGitHub {
     owner = "dexidp";
-    repo = pname;
+    repo = "dex";
     rev = "v${version}";
     sha256 = "sha256-FbjNOyECgf26+Z48YwF9uMN8C3zMRshD3VOjoRbA0ys=";
   };
diff --git a/pkgs/by-name/di/didder/package.nix b/pkgs/by-name/di/didder/package.nix
index bb58cde741aa..8cee20b76693 100644
--- a/pkgs/by-name/di/didder/package.nix
+++ b/pkgs/by-name/di/didder/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "makew0rld";
-    repo = pname;
+    repo = "didder";
     rev = "v${version}";
     hash = "sha256-wYAudEyOLxbNfk4M720absGkuWXcaBPyBAcmBNBaaWU=";
   };
diff --git a/pkgs/by-name/di/diffr/package.nix b/pkgs/by-name/di/diffr/package.nix
index a599e8188400..2f4d0e56dfe3 100644
--- a/pkgs/by-name/di/diffr/package.nix
+++ b/pkgs/by-name/di/diffr/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "mookid";
-    repo = pname;
+    repo = "diffr";
     rev = "v${version}";
     sha256 = "sha256-ylZE2NtTXbGqsxE72ylEQCacTyxBO+/WgvEpoXd5OZI=";
   };
diff --git a/pkgs/by-name/di/dirstalk/package.nix b/pkgs/by-name/di/dirstalk/package.nix
index a1bc915da1d5..33d8f38e488b 100644
--- a/pkgs/by-name/di/dirstalk/package.nix
+++ b/pkgs/by-name/di/dirstalk/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "stefanoj3";
-    repo = pname;
+    repo = "dirstalk";
     rev = version;
     hash = "sha256-gSMkTGzMDI+scG3FQ0u0liUDL4qOPPW2UWLlAQcmmaA=";
   };
diff --git a/pkgs/by-name/di/discord-rpc/package.nix b/pkgs/by-name/di/discord-rpc/package.nix
index 530e70732acf..d17df5b33080 100644
--- a/pkgs/by-name/di/discord-rpc/package.nix
+++ b/pkgs/by-name/di/discord-rpc/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "discordapp";
-    repo = pname;
+    repo = "discord-rpc";
     rev = "v${version}";
     sha256 = "04cxhqdv5r92lrpnhxf8702a8iackdf3sfk1050z7pijbijiql2a";
   };
diff --git a/pkgs/by-name/di/diskrsync/package.nix b/pkgs/by-name/di/diskrsync/package.nix
index 94b2c5a0f495..e26668239a27 100644
--- a/pkgs/by-name/di/diskrsync/package.nix
+++ b/pkgs/by-name/di/diskrsync/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "dop251";
-    repo = pname;
+    repo = "diskrsync";
     rev = "v${version}";
     sha256 = "sha256-hM70WD+M3jwze0IG84WTFf1caOUk2s9DQ7pR+KNIt1M=";
   };
diff --git a/pkgs/by-name/di/dismap/package.nix b/pkgs/by-name/di/dismap/package.nix
index 4d84aed8961d..67b25323a7f6 100644
--- a/pkgs/by-name/di/dismap/package.nix
+++ b/pkgs/by-name/di/dismap/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "zhzyker";
-    repo = pname;
+    repo = "dismap";
     rev = "v${version}";
     sha256 = "sha256-YjjiS6iLIQvrPS378v2nyrgwWBJ9YtDeNTPz0ze05mU=";
   };
diff --git a/pkgs/by-name/di/dismember/package.nix b/pkgs/by-name/di/dismember/package.nix
index 589d33adc2f3..624f11de03a4 100644
--- a/pkgs/by-name/di/dismember/package.nix
+++ b/pkgs/by-name/di/dismember/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "liamg";
-    repo = pname;
+    repo = "dismember";
     tag = "v${version}";
     hash = "sha256-myoBXoi7VqHOLmu/XrvnlfBDlEnXm+0fp8WQec+3EJY=";
   };
diff --git a/pkgs/by-name/dl/dlib/package.nix b/pkgs/by-name/dl/dlib/package.nix
index 7817b88b25e5..09135b652d75 100644
--- a/pkgs/by-name/dl/dlib/package.nix
+++ b/pkgs/by-name/dl/dlib/package.nix
@@ -42,7 +42,7 @@
     ]
     ++ lib.optionals cudaSupport [
       (lib.cmakeFeature "DLIB_USE_CUDA_COMPUTE_CAPABILITIES" (
-        builtins.concatStringsSep "," (with cudaPackages.flags; map dropDot cudaCapabilities)
+        builtins.concatStringsSep "," (with cudaPackages.flags; map dropDots cudaCapabilities)
       ))
     ];
 
diff --git a/pkgs/by-name/dn/dnd-tools/package.nix b/pkgs/by-name/dn/dnd-tools/package.nix
index 227de3abe701..3456807771e8 100644
--- a/pkgs/by-name/dn/dnd-tools/package.nix
+++ b/pkgs/by-name/dn/dnd-tools/package.nix
@@ -5,13 +5,13 @@
   lib,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication {
   pname = "dnd-tools";
   version = "unstable-2021-02-18";
 
   src = fetchFromGitHub {
     owner = "savagezen";
-    repo = pname;
+    repo = "dnd-tools";
     rev = "baefb9e4b4b8279be89ec63d256dde9704dee078";
     sha256 = "1rils3gzbfmwvgy51ah77qihwwbvx50q82lkc1kwcb55b3yinnmj";
   };
diff --git a/pkgs/by-name/dn/dnscrypt-proxy/package.nix b/pkgs/by-name/dn/dnscrypt-proxy/package.nix
index 0084aa0c5120..2f9fe584de00 100644
--- a/pkgs/by-name/dn/dnscrypt-proxy/package.nix
+++ b/pkgs/by-name/dn/dnscrypt-proxy/package.nix
@@ -7,7 +7,7 @@
 
 buildGoModule rec {
   pname = "dnscrypt-proxy";
-  version = "2.1.8";
+  version = "2.1.12";
 
   vendorHash = null;
 
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "DNSCrypt";
     repo = "dnscrypt-proxy";
     rev = version;
-    sha256 = "sha256-/D5RE8AbI9i9TVdFQCYW8OLPU4TgIIDRsZfWEyXo92g=";
+    hash = "sha256-HgpcZccx3gaR3dTJJRKPICvNxZj9KdeC0+2ll8TWgeM=";
   };
 
   passthru.tests = { inherit (nixosTests) dnscrypt-proxy2; };
diff --git a/pkgs/by-name/dn/dnsmon-go/package.nix b/pkgs/by-name/dn/dnsmon-go/package.nix
index 69164d6d5cac..f40371fa16e1 100644
--- a/pkgs/by-name/dn/dnsmon-go/package.nix
+++ b/pkgs/by-name/dn/dnsmon-go/package.nix
@@ -5,13 +5,13 @@
   libpcap,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "dnsmon-go";
   version = "unstable-2022-05-13";
 
   src = fetchFromGitHub {
     owner = "jonpulsifer";
-    repo = pname;
+    repo = "dnsmon-go";
     rev = "ec1d59f1f1314ce310ad4c04d2924e0ebd857f1d";
     hash = "sha256-lAJ2bjs5VLzrHd09eFK4X0V/cCee2QsgdgiKq+y2c10=";
   };
diff --git a/pkgs/by-name/do/docker-credential-helpers/package.nix b/pkgs/by-name/do/docker-credential-helpers/package.nix
index a11cd5fb1a20..a16781dcafec 100644
--- a/pkgs/by-name/do/docker-credential-helpers/package.nix
+++ b/pkgs/by-name/do/docker-credential-helpers/package.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "docker";
-    repo = pname;
+    repo = "docker-credential-helpers";
     rev = "v${version}";
     sha256 = "sha256-5KrBiihpWY04PjI9M7NRS5fRu+ochzqRLvX+ZBj/wq8=";
   };
diff --git a/pkgs/by-name/do/dockle/package.nix b/pkgs/by-name/do/dockle/package.nix
index 80f84ffd58e4..b917461c7bd8 100644
--- a/pkgs/by-name/do/dockle/package.nix
+++ b/pkgs/by-name/do/dockle/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "goodwithtech";
-    repo = pname;
+    repo = "dockle";
     rev = "v${version}";
     hash = "sha256-YoDgTKhXpN4UVF/+NDFxaEFwMj81RJaqfjr29t1UdLY=";
   };
diff --git a/pkgs/by-name/do/dokuwiki/package.nix b/pkgs/by-name/do/dokuwiki/package.nix
index 2cca5f6d0852..67be0304401c 100644
--- a/pkgs/by-name/do/dokuwiki/package.nix
+++ b/pkgs/by-name/do/dokuwiki/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "dokuwiki";
-    repo = pname;
+    repo = "dokuwiki";
     rev = "release-${version}";
     sha256 = "sha256-jrxsVBStvRxHCAOGVUkqtzE75wRBiVR+KxSCNuI2vnk=";
   };
diff --git a/pkgs/by-name/do/doppler/package.nix b/pkgs/by-name/do/doppler/package.nix
index 8cfbfa9aeac1..846c523de7e2 100644
--- a/pkgs/by-name/do/doppler/package.nix
+++ b/pkgs/by-name/do/doppler/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "doppler";
-  version = "3.74.0";
+  version = "3.75.0";
 
   src = fetchFromGitHub {
     owner = "dopplerhq";
     repo = "cli";
     rev = version;
-    hash = "sha256-mT6AB3Xtjm7AHtdF3eKn7dfnd/3ul1nCiZ5e4cHUXbc=";
+    hash = "sha256-hxCrAsie44jBNp7UtjTcJmjgNXUc9I/aIsq1UL/pbg8=";
   };
 
   vendorHash = "sha256-tSRtgkDPvDlEfwuNhahvs3Pvt4h7QAJrJtb1XQXGaFM=";
diff --git a/pkgs/by-name/do/dorkscout/package.nix b/pkgs/by-name/do/dorkscout/package.nix
index 28991f77b5f2..a29172a19d41 100644
--- a/pkgs/by-name/do/dorkscout/package.nix
+++ b/pkgs/by-name/do/dorkscout/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "R4yGM";
-    repo = pname;
+    repo = "dorkscout";
     rev = version;
     hash = "sha256-v0OgEfl6L92ux+2GbSPHEgkmA/ZobQHB66O2LlEhVUA=";
   };
diff --git a/pkgs/by-name/do/dotnet-repl/package.nix b/pkgs/by-name/do/dotnet-repl/package.nix
index 3941b45926fa..eb9cda528b7d 100644
--- a/pkgs/by-name/do/dotnet-repl/package.nix
+++ b/pkgs/by-name/do/dotnet-repl/package.nix
@@ -6,15 +6,15 @@
 
 buildDotnetGlobalTool {
   pname = "dotnet-repl";
-  version = "0.3.239";
+  version = "0.3.247";
 
   dotnet-sdk = dotnetCorePackages.sdk_9_0;
   dotnet-runtime = dotnetCorePackages.runtime_9_0;
 
-  nugetHash = "sha256-wn4i0zC56gxnjsgjdiMxLinmUsSROhmimu0lmBZo1hA=";
+  nugetHash = "sha256-nD5GqLG+3VAWMy/8E9XviwJq2wKBg+BISlcB4xWtrx4=";
 
   meta = {
-    description = "A polyglot REPL built on .NET Interactive";
+    description = "Polyglot REPL built on .NET Interactive";
     homepage = "https://github.com/jonsequitur/dotnet-repl";
     license = lib.licenses.mit;
     mainProgram = "dotnet-repl";
diff --git a/pkgs/by-name/dp/dpt-rp1-py/package.nix b/pkgs/by-name/dp/dpt-rp1-py/package.nix
index 27be986648ef..c33779161318 100644
--- a/pkgs/by-name/dp/dpt-rp1-py/package.nix
+++ b/pkgs/by-name/dp/dpt-rp1-py/package.nix
@@ -9,7 +9,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "janten";
-    repo = pname;
+    repo = "dpt-rp1-py";
     rev = "v${version}";
     sha256 = "0zvf09b9rzpx5b0w81ziqd7v321hfhgsgvshdx23karj2hf75bvj";
   };
diff --git a/pkgs/by-name/dr/drawing/package.nix b/pkgs/by-name/dr/drawing/package.nix
index cf75fc8fbbe9..ae4ef226c1ef 100644
--- a/pkgs/by-name/dr/drawing/package.nix
+++ b/pkgs/by-name/dr/drawing/package.nix
@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "maoschanz";
-    repo = pname;
+    repo = "drawing";
     tag = version;
     hash = "sha256-kNF9db8NoHWW1A0WEFQzxHqAQ4A7kxInMRZFJOXQX/k=";
   };
diff --git a/pkgs/by-name/dr/drill/package.nix b/pkgs/by-name/dr/drill/package.nix
index 348780dab757..1ca893b3f762 100644
--- a/pkgs/by-name/dr/drill/package.nix
+++ b/pkgs/by-name/dr/drill/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "fcsonline";
-    repo = pname;
+    repo = "drill";
     rev = version;
     sha256 = "sha256-4y5gpkQB0U6Yq92O6DDD5eq/i/36l/VfeyiE//pcZOk=";
   };
diff --git a/pkgs/by-name/dr/drone-runner-docker/package.nix b/pkgs/by-name/dr/drone-runner-docker/package.nix
index 211a2449fbf9..4090cf3f0ac1 100644
--- a/pkgs/by-name/dr/drone-runner-docker/package.nix
+++ b/pkgs/by-name/dr/drone-runner-docker/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "drone-runners";
-    repo = pname;
+    repo = "drone-runner-docker";
     tag = "v${version}";
     sha256 = "sha256-xJbmxoyL4Sb6YkkwgysGte44ZBKYHjc5QdYa+b62C/M=";
   };
diff --git a/pkgs/by-name/dr/drone-runner-ssh/package.nix b/pkgs/by-name/dr/drone-runner-ssh/package.nix
index 1185a5505e6e..214b1d4eabcd 100644
--- a/pkgs/by-name/dr/drone-runner-ssh/package.nix
+++ b/pkgs/by-name/dr/drone-runner-ssh/package.nix
@@ -4,13 +4,13 @@
   buildGoModule,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "drone-runner-ssh";
   version = "unstable-2022-12-22";
 
   src = fetchFromGitHub {
     owner = "drone-runners";
-    repo = pname;
+    repo = "drone-runner-ssh";
     rev = "ee70745c60e070a7fac57d9cecc41252e7a3ff55";
     sha256 = "sha256-YUyhEA1kYIFLN+BI2A8PFeSgifoVNmNPKtdS58MwwVU=";
   };
diff --git a/pkgs/by-name/ds/dstask/package.nix b/pkgs/by-name/ds/dstask/package.nix
index 54e8a95355b7..a24af94d4308 100644
--- a/pkgs/by-name/ds/dstask/package.nix
+++ b/pkgs/by-name/ds/dstask/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "naggie";
-    repo = pname;
+    repo = "dstask";
     rev = "v${version}";
     sha256 = "sha256-xZFQQDK+yGAv4IbuNe2dvNa3GDASeJY2mOYw94goAIM=";
   };
diff --git a/pkgs/by-name/ds/dstp/package.nix b/pkgs/by-name/ds/dstp/package.nix
index c06a34434a56..a31e10927e73 100644
--- a/pkgs/by-name/ds/dstp/package.nix
+++ b/pkgs/by-name/ds/dstp/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ycd";
-    repo = pname;
+    repo = "dstp";
     rev = "v${version}";
     sha256 = "sha256-QODp9IbIc2Z7N/xfRd0UV9r8t6RndOjdGe9hQXJyiN0=";
   };
diff --git a/pkgs/by-name/du/dump_syms/package.nix b/pkgs/by-name/du/dump_syms/package.nix
index ba113aed246e..9c1c9d5a2607 100644
--- a/pkgs/by-name/du/dump_syms/package.nix
+++ b/pkgs/by-name/du/dump_syms/package.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage {
 
   src = fetchFromGitHub {
     owner = "mozilla";
-    repo = pname;
+    repo = "dump_syms";
     rev = "v${version}";
     hash = "sha256-6VDuZ5rw2N4z6wOVbaOKO6TNaq8QA5RstsIzmuE3QrI=";
   };
diff --git a/pkgs/by-name/dy/dynamic-wallpaper/package.nix b/pkgs/by-name/dy/dynamic-wallpaper/package.nix
index 786db004d7a3..8a95c70eede9 100644
--- a/pkgs/by-name/dy/dynamic-wallpaper/package.nix
+++ b/pkgs/by-name/dy/dynamic-wallpaper/package.nix
@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "dusansimic";
-    repo = pname;
+    repo = "dynamic-wallpaper";
     rev = version;
     hash = "sha256-DAdx34EYO8ysQzbWrAIPoghhibwFtoqCi8oyDVyO5lk=";
   };
diff --git a/pkgs/by-name/e1/e1s/package.nix b/pkgs/by-name/e1/e1s/package.nix
index adf6a1742977..aacc410d5a07 100644
--- a/pkgs/by-name/e1/e1s/package.nix
+++ b/pkgs/by-name/e1/e1s/package.nix
@@ -5,7 +5,7 @@
 }:
 let
   pname = "e1s";
-  version = "1.0.47";
+  version = "1.0.48";
 in
 buildGoModule {
   inherit pname version;
@@ -14,7 +14,7 @@ buildGoModule {
     owner = "keidarcy";
     repo = "e1s";
     tag = "v${version}";
-    hash = "sha256-5lb2j3cfQ2W+r+3UOdxXt15PQNWIMRM+pwChdzL+HUQ=";
+    hash = "sha256-pURUTWlj0iOfHpc4BheprfgAuK05sZDGLbCF/T3LN9w=";
   };
 
   vendorHash = "sha256-1lise/u40Q8W9STsuyrWIbhf2HY+SFCytUL1PTSWvfY=";
diff --git a/pkgs/by-name/ea/eartag/package.nix b/pkgs/by-name/ea/eartag/package.nix
index 411cad1653ed..52c063b6f548 100644
--- a/pkgs/by-name/ea/eartag/package.nix
+++ b/pkgs/by-name/ea/eartag/package.nix
@@ -28,7 +28,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
-    repo = pname;
+    repo = "eartag";
     rev = version;
     hash = "sha256-sxVivQppX8KdkvHaW6xQ64Wi8Nfv5Rmwf4NADBDpOOo=";
   };
diff --git a/pkgs/by-name/ea/easeprobe/package.nix b/pkgs/by-name/ea/easeprobe/package.nix
index e52927a00dfd..1704ca35eedf 100644
--- a/pkgs/by-name/ea/easeprobe/package.nix
+++ b/pkgs/by-name/ea/easeprobe/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "megaease";
-    repo = pname;
+    repo = "easeprobe";
     rev = "v${version}";
     sha256 = "sha256-XPbRtW3UIc6N1D1LKDYxgTHGVmiGDnam+r5Eg4uBa7w=";
   };
diff --git a/pkgs/by-name/ea/easytier/package.nix b/pkgs/by-name/ea/easytier/package.nix
index 39871a0e8bea..7c81311dc3a9 100644
--- a/pkgs/by-name/ea/easytier/package.nix
+++ b/pkgs/by-name/ea/easytier/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "easytier";
-  version = "2.2.4";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "EasyTier";
     repo = "EasyTier";
     tag = "v${version}";
-    hash = "sha256-YrWuNHpNDs1VVz6Sahi2ViPT4kcJf10UUMRWEs4Y0xc=";
+    hash = "sha256-F///8C7lyJZj5+u80nauDdrPFrEE40s0DeNzQeblImw=";
   };
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-uUmF4uIhSx+byG+c4hlUuuy+O87Saw8wRJ5OGk3zaPA=";
+  cargoHash = "sha256-f64tOU8AKC14tqX9Q3MLa7/pmIuI4FeFGOct8ZTAe+k=";
 
   nativeBuildInputs = [
     protobuf
diff --git a/pkgs/by-name/ec/ec2-instance-selector/package.nix b/pkgs/by-name/ec/ec2-instance-selector/package.nix
new file mode 100644
index 000000000000..c6620d0af98f
--- /dev/null
+++ b/pkgs/by-name/ec/ec2-instance-selector/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "ec2-instance-selector";
+  version = "3.1.1";
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "amazon-ec2-instance-selector";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4J66/LiFFeUW20du2clqjz9ozLV+Sn2VVqF9VISXpb0=";
+  };
+
+  vendorHash = "sha256-ocysHrbkmFQ96dEVJvc5YuuBiaXToAcMUUPFiLpMCpU=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.versionID=${finalAttrs.version}"
+    "-X=github.com/aws/amazon-ec2-instance-selector/v3/pkg/selector.versionID=${finalAttrs.version}"
+  ];
+
+  postInstall = ''
+    rm $out/bin/readme-test
+    mv $out/bin/cmd $out/bin/ec2-instance-selector
+  '';
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Recommends instance types based on resource criteria like vcpus and memory";
+    homepage = "https://github.com/aws/amazon-ec2-instance-selector";
+    changelog = "https://github.com/aws/amazon-ec2-instance-selector/tags/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ wcarlsen ];
+    mainProgram = "ec2-instance-selector";
+  };
+})
diff --git a/pkgs/by-name/ec/ecdsautils/package.nix b/pkgs/by-name/ec/ecdsautils/package.nix
index 6b7dec6e11e6..ee4560b82c0a 100644
--- a/pkgs/by-name/ec/ecdsautils/package.nix
+++ b/pkgs/by-name/ec/ecdsautils/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   src = pkgs.fetchFromGitHub {
     owner = "freifunk-gluon";
-    repo = pname;
+    repo = "ecdsautils";
     rev = "v${version}";
     sha256 = "sha256-vGHLAX/XOtePvdT/rljCOdlILHVO20mCt6p+MUi13dg=";
   };
diff --git a/pkgs/by-name/ec/eclint/package.nix b/pkgs/by-name/ec/eclint/package.nix
index 3928cb5ef5b9..9a07e8c9b15f 100644
--- a/pkgs/by-name/ec/eclint/package.nix
+++ b/pkgs/by-name/ec/eclint/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitLab {
     owner = "greut";
-    repo = pname;
+    repo = "eclint";
     rev = "v${version}";
     hash = "sha256-XY+D0bRIgWTm2VH+uDVodYeyGeu+8Xyyq4xDvTDLii4=";
   };
diff --git a/pkgs/by-name/ec/ecpdap/package.nix b/pkgs/by-name/ec/ecpdap/package.nix
index 7b594468a732..78ce5cef1dc4 100644
--- a/pkgs/by-name/ec/ecpdap/package.nix
+++ b/pkgs/by-name/ec/ecpdap/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "adamgreig";
-    repo = pname;
+    repo = "ecpdap";
     rev = "v${version}";
     sha256 = "sha256-pgQqDRdewBSCm1/9/r8E9DBzwSKAaons3e6OLNv5gHM=";
   };
diff --git a/pkgs/by-name/ec/ecs-agent/package.nix b/pkgs/by-name/ec/ecs-agent/package.nix
index 3c2ffdaa1d93..30fcdddd6406 100644
--- a/pkgs/by-name/ec/ecs-agent/package.nix
+++ b/pkgs/by-name/ec/ecs-agent/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aws";
-    repo = pname;
+    repo = "amazon-ecs-agent";
     hash = "sha256-g0yIJ0W71UGgPZ5m/BaeTCOTAfQ6589wAvYZ15Izt8o=";
   };
 
diff --git a/pkgs/by-name/ed/ed-odyssey-materials-helper/deps.json b/pkgs/by-name/ed/ed-odyssey-materials-helper/deps.json
index cc345d6abf3f..8f96bfec3d6f 100644
--- a/pkgs/by-name/ed/ed-odyssey-materials-helper/deps.json
+++ b/pkgs/by-name/ed/ed-odyssey-materials-helper/deps.json
@@ -493,10 +493,10 @@
    "module": "sha256-rwV/vBEyR6Pp/cYOWU+dh2xPW8oZy4sb2myBGP9ixpU=",
    "pom": "sha256-EeldzI+ywwumAH/f9GxW+HF2/lwwLFGEQThZEk1Tq60="
   },
-  "io/sentry#sentry/8.11.1": {
-   "jar": "sha256-0EmSqkQXOQazcYAmpRyUMXDc663czsRTtszYAdGuZkg=",
-   "module": "sha256-x4i43VQ1Avv5hy7X11gvLfBPZwEzEoWb0fgun5sqgRM=",
-   "pom": "sha256-Fcd/SfMLh3uTBDq5O05T5KlFDlXxgWz+++/2fd47X2c="
+  "io/sentry#sentry/8.12.0": {
+   "jar": "sha256-LkfktB4/El/cgKUS1fUaA5DRD9haWRHR+A5im7p3AAQ=",
+   "module": "sha256-LrKRmE4DJppwx0nCTSBwZHF9Rw8ex1lAD96birtXim4=",
+   "pom": "sha256-pwlifFbJHCooUNMFXPWWFTk+TCEMcMojMEpifX9SAlg="
   },
   "jakarta/json/bind#jakarta.json.bind-api/2.0.0": {
    "jar": "sha256-peYGtYiLQStIkHrWiLNN/k4wroGJxvJ8wEkbjzwDYoc=",
diff --git a/pkgs/by-name/ed/ed-odyssey-materials-helper/package.nix b/pkgs/by-name/ed/ed-odyssey-materials-helper/package.nix
index 0605d65747e1..f24b30fc7263 100644
--- a/pkgs/by-name/ed/ed-odyssey-materials-helper/package.nix
+++ b/pkgs/by-name/ed/ed-odyssey-materials-helper/package.nix
@@ -16,13 +16,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "ed-odyssey-materials-helper";
-  version = "2.173";
+  version = "2.178";
 
   src = fetchFromGitHub {
     owner = "jixxed";
     repo = "ed-odyssey-materials-helper";
     tag = version;
-    hash = "sha256-PW5AnplciFenupASEqXA7NqQrH14Wfz1SSm1c/LWA7A=";
+    hash = "sha256-a/nrRw5FjUZBJE0CmSevGAw4LBI/A3jPAEJfg7GY5+U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ed/edk2/package.nix b/pkgs/by-name/ed/edk2/package.nix
index b552a7675fe1..247ecbeddb4a 100644
--- a/pkgs/by-name/ed/edk2/package.nix
+++ b/pkgs/by-name/ed/edk2/package.nix
@@ -34,14 +34,14 @@ let
 
   edk2 = stdenv.mkDerivation {
     pname = "edk2";
-    version = "202411";
+    version = "202505";
 
     srcWithVendoring = fetchFromGitHub {
       owner = "tianocore";
       repo = "edk2";
-      rev = "edk2-stable${edk2.version}";
+      tag = "edk2-stable${edk2.version}";
       fetchSubmodules = true;
-      hash = "sha256-KYaTGJ3DHtWbPEbP+n8MTk/WwzLv5Vugty/tvzuEUf0=";
+      hash = "sha256-VuiEqVpG/k7pfy0cOC6XmY+8NBtU/OHdDB9Y52tyNe8=";
     };
 
     src = applyPatches {
@@ -62,18 +62,16 @@ let
         })
       ];
 
-      # EDK2 is currently working on OpenSSL 3.3.x support. Use buildpackages.openssl again,
-      # when "https://github.com/tianocore/edk2/pull/6167" is merged.
       postPatch = ''
-        # We don't want EDK2 to keep track of OpenSSL, they're frankly bad at it.
+        # de-vendor OpenSSL
         rm -r CryptoPkg/Library/OpensslLib/openssl
         mkdir -p CryptoPkg/Library/OpensslLib/openssl
         (
         cd CryptoPkg/Library/OpensslLib/openssl
-        tar --strip-components=1 -xf ${buildPackages.openssl_3.src}
+        tar --strip-components=1 -xf ${buildPackages.openssl.src}
 
         # Apply OpenSSL patches.
-        ${lib.pipe buildPackages.openssl_3.patches [
+        ${lib.pipe buildPackages.openssl.patches [
           (builtins.filter (
             patch:
             !builtins.elem (baseNameOf patch) [
@@ -144,7 +142,10 @@ let
 
     passthru = {
       # exercise a channel blocker
-      tests.uefiUsb = nixosTests.boot.uefiCdrom;
+      tests = {
+        systemdBootExtraEntries = nixosTests.systemd-boot.extraEntries;
+        uefiUsb = nixosTests.boot.uefiCdrom;
+      };
 
       updateScript = writeScript "update-edk2" ''
         #!/usr/bin/env nix-shell
diff --git a/pkgs/by-name/ed/edusong/package.nix b/pkgs/by-name/ed/edusong/package.nix
index 4c9901f0c766..dec473ccf5f0 100644
--- a/pkgs/by-name/ed/edusong/package.nix
+++ b/pkgs/by-name/ed/edusong/package.nix
@@ -6,25 +6,23 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "edusong";
-  version = "1.0"; # The upstream doesn't provide the version
+  version = "4.0";
 
   src = fetchzip {
     name = "${pname}-${version}";
     url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/eduSong_Unicode.zip";
-    hash = "sha256-pIG1EbFGf2O2AzM4+HCCvGPodBBwUt7ozpb+BpPk5Kw=";
+    hash = "sha256-4NBnwMrYufeZbgSiD2fAhe4tuy0aAA5u9tWwjQQjEQk=";
   };
 
   installPhase = ''
     mkdir -p $out/share/fonts/
-    mv *.ttf $out/share/fonts/
+    mv eduSong_Unicode*.ttf $out/share/fonts/eduSong_Unicode\(2024年12月\).ttf
   '';
 
   meta = {
-    description = "The MOE Standard Song Font, a Chinese font by the Ministry of Education, ROC (Taiwan)";
+    description = "The MOE Song font, a Song-style Chinese character typeface";
     longDescription = ''
-      The MOE Standard Song Font is a Chinese Song font provided by
-      the Midistry of Education, Republic of China (Taiwan).
-      Song or Ming is a category of CKJ typefaces in print.
+      A Song-style Chinese character typeface published by the Ministry of Education of the Republic of China (Taiwan). The Song style is also referred to as 宋體, 宋体, sòngtǐ, 明體, 明体, or míngtǐ, in Chinese; 명조체, 明朝體, or myeongjo in Korean; 明朝体, みんちょうたい, or minchōtai in Japanese.
     '';
     homepage = "https://language.moe.gov.tw/result.aspx?classify_sn=23&subclassify_sn=436&content_sn=48";
     license = lib.licenses.cc-by-nd-30;
diff --git a/pkgs/by-name/eg/eget/package.nix b/pkgs/by-name/eg/eget/package.nix
index 401795ba0e4f..751e81a62008 100644
--- a/pkgs/by-name/eg/eget/package.nix
+++ b/pkgs/by-name/eg/eget/package.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "zyedidia";
-    repo = pname;
+    repo = "eget";
     rev = "v${version}";
     sha256 = "sha256-jhVUYyp6t5LleVotQQme07IJVdVnIOVFFtKEmzt8e2k=";
   };
diff --git a/pkgs/by-name/eg/eggnog-mapper/package.nix b/pkgs/by-name/eg/eggnog-mapper/package.nix
index 80d9be278eda..e4e1e9695f89 100644
--- a/pkgs/by-name/eg/eggnog-mapper/package.nix
+++ b/pkgs/by-name/eg/eggnog-mapper/package.nix
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "eggnogdb";
-    repo = pname;
+    repo = "eggnog-mapper";
     tag = version;
     hash = "sha256-+luxXQmtGufYrA/9Ak3yKzbotOj2HM3vhIoOxE+Ty1U=";
   };
diff --git a/pkgs/by-name/ei/eidolon/Cargo.lock b/pkgs/by-name/ei/eidolon/Cargo.lock
deleted file mode 100644
index 3a800a1263cb..000000000000
--- a/pkgs/by-name/ei/eidolon/Cargo.lock
+++ /dev/null
@@ -1,2087 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "addr2line"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a76fd60b23679b7d19bd066031410fb7e458ccc5e958eb5c325888ce4baedc97"
-dependencies = [
- "gimli",
-]
-
-[[package]]
-name = "adler"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
-
-[[package]]
-name = "aho-corasick"
-version = "0.6.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81ce3d38065e618af2d7b77e10c5ad9a069859b4be3c2250f674af3840d9c8a5"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "aho-corasick"
-version = "0.7.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc936419f96fa211c1b9166887b38e5e40b19958e5b895be7c1f93adec7071ac"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "ansi_term"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2"
-dependencies = [
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "arrayref"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4c527152e37cf757a3f78aae5a06fbeefdb07ccc535c980a3208ee3060dd544"
-
-[[package]]
-name = "arrayvec"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b"
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi 0.1.19",
- "libc",
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "autocfg"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dde43e75fd43e8a1bf86103336bc699aa8d17ad1be60c76c0bdfd4828e19b78"
-dependencies = [
- "autocfg 1.1.0",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
-
-[[package]]
-name = "backtrace"
-version = "0.3.67"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "233d376d6d185f2a3093e58f283f60f880315b6c60075b01f36b3b85154564ca"
-dependencies = [
- "addr2line",
- "cc",
- "cfg-if 1.0.0",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
-]
-
-[[package]]
-name = "base64"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b25d992356d2eb0ed82172f5248873db5560c4721f564b13cb5193bda5e668e"
-dependencies = [
- "byteorder",
-]
-
-[[package]]
-name = "base64"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "blake2b_simd"
-version = "0.5.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "afa748e348ad3be8263be728124b24a24f268266f6f5d58af9d75f6a40b5c587"
-dependencies = [
- "arrayref",
- "arrayvec",
- "constant_time_eq",
-]
-
-[[package]]
-name = "butlerd"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "095899eb6b69e0a1c98215e51a44c67b8e3c902ebb9440afaafe2eb45e650a09"
-dependencies = [
- "hyper",
- "rand 0.5.6",
- "regex 1.7.1",
- "reqwest",
- "serde",
- "serde_derive",
- "serde_json",
-]
-
-[[package]]
-name = "byteorder"
-version = "1.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
-
-[[package]]
-name = "bytes"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "206fdffcfa2df7cbe15601ef46c813fce0965eb3286db6b56c583b814b51c81c"
-dependencies = [
- "byteorder",
- "either",
- "iovec",
-]
-
-[[package]]
-name = "cc"
-version = "1.0.79"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
-
-[[package]]
-name = "cfg-if"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "clap"
-version = "2.34.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
-dependencies = [
- "ansi_term",
- "atty",
- "bitflags",
- "strsim",
- "textwrap",
- "unicode-width",
- "vec_map",
-]
-
-[[package]]
-name = "cloudabi"
-version = "0.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddfc5b9aa5d4507acaf872de71051dfd0e309860e88966e1051e462a077aac4f"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "concolor"
-version = "0.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "318d6c16e73b3a900eb212ad6a82fc7d298c5ab8184c7a9998646455bc474a16"
-dependencies = [
- "bitflags",
- "concolor-query",
- "is-terminal",
-]
-
-[[package]]
-name = "concolor-query"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82a90734b3d5dcf656e7624cca6bce9c3a90ee11f900e80141a7427ccfb3d317"
-
-[[package]]
-name = "constant_time_eq"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
-
-[[package]]
-name = "cookie"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "888604f00b3db336d2af898ec3c1d5d0ddf5e6d462220f2ededc33a87ac4bbd5"
-dependencies = [
- "time",
- "url 1.7.2",
-]
-
-[[package]]
-name = "cookie_store"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46750b3f362965f197996c4448e4a0935e791bf7d6631bfce9ee0af3d24c919c"
-dependencies = [
- "cookie",
- "failure",
- "idna 0.1.5",
- "log",
- "publicsuffix",
- "serde",
- "serde_json",
- "time",
- "try_from",
- "url 1.7.2",
-]
-
-[[package]]
-name = "core-foundation"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5827cebf4670468b8772dd191856768aedcb1b0278a04f989f7766351917b9dc"
-
-[[package]]
-name = "crc32fast"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
-dependencies = [
- "cfg-if 1.0.0",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c20ff29ded3204c5106278a81a38f4b482636ed4fa1e6cfbeef193291beb29ed"
-dependencies = [
- "crossbeam-epoch",
- "crossbeam-utils 0.7.2",
- "maybe-uninit",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "058ed274caafc1f60c4997b5fc07bf7dc7cca454af7c6e81edffe5f33f70dace"
-dependencies = [
- "autocfg 1.1.0",
- "cfg-if 0.1.10",
- "crossbeam-utils 0.7.2",
- "lazy_static",
- "maybe-uninit",
- "memoffset",
- "scopeguard",
-]
-
-[[package]]
-name = "crossbeam-queue"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "774ba60a54c213d409d5353bda12d49cd68d14e45036a285234c8d6f91f92570"
-dependencies = [
- "cfg-if 0.1.10",
- "crossbeam-utils 0.7.2",
- "maybe-uninit",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3c7c73a2d1e9fc0886a08b93e98eb643461230d5f1925e4036204d5f2e261a8"
-dependencies = [
- "autocfg 1.1.0",
- "cfg-if 0.1.10",
- "lazy_static",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fb766fa798726286dbbb842f174001dab8abc7b627a1dd86e0b7222a95d929f"
-dependencies = [
- "cfg-if 1.0.0",
-]
-
-[[package]]
-name = "dirs"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fd78930633bd1c6e35c4b42b1df7b0cbc6bc191146e512bb3bedf243fcc3901"
-dependencies = [
- "libc",
- "redox_users",
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "dtoa"
-version = "0.4.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56899898ce76aaf4a0f24d914c97ea6ed976d42fec6ad33fcbb0a1103e07b2b0"
-
-[[package]]
-name = "eidolon"
-version = "1.4.6"
-dependencies = [
- "butlerd",
- "dirs",
- "human-panic",
- "regex 0.2.11",
- "serde",
- "serde_derive",
- "serde_json",
- "structopt",
-]
-
-[[package]]
-name = "either"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
-
-[[package]]
-name = "encoding_rs"
-version = "0.8.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071a31f4ee85403370b58aca746f01041ede6f0da2730960ad001edc2b71b394"
-dependencies = [
- "cfg-if 1.0.0",
-]
-
-[[package]]
-name = "errno"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f639046355ee4f37944e44f60642c6f3a7efa3cf6b78c78a0d989a8ce6c396a1"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc",
-]
-
-[[package]]
-name = "failure"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d32e9bd16cc02eae7db7ef620b392808b89f6a5e16bb3497d159c6b92a0f4f86"
-dependencies = [
- "backtrace",
- "failure_derive",
-]
-
-[[package]]
-name = "failure_derive"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa4da3c766cd7a0db8242e326e9e4e081edd567072893ed320008189715366a4"
-dependencies = [
- "proc-macro2 1.0.51",
- "quote 1.0.23",
- "syn 1.0.109",
- "synstructure",
-]
-
-[[package]]
-name = "fastrand"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
-dependencies = [
- "instant",
-]
-
-[[package]]
-name = "flate2"
-version = "1.0.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8a2db397cb1c8772f31494cb8917e48cd1e64f0fa7efac59fbd741a0a8ce841"
-dependencies = [
- "crc32fast",
- "miniz_oxide",
-]
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "foreign-types"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
-dependencies = [
- "foreign-types-shared",
-]
-
-[[package]]
-name = "foreign-types-shared"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
-
-[[package]]
-name = "form_urlencoded"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9c384f161156f5260c24a097c56119f9be8c798586aecc13afbcbe7b7e26bf8"
-dependencies = [
- "percent-encoding 2.2.0",
-]
-
-[[package]]
-name = "fuchsia-cprng"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
-
-[[package]]
-name = "fuchsia-zircon"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e9763c69ebaae630ba35f74888db465e49e259ba1bc0eda7d06f4a067615d82"
-dependencies = [
- "bitflags",
- "fuchsia-zircon-sys",
-]
-
-[[package]]
-name = "fuchsia-zircon-sys"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3dcaa9ae7725d12cdb85b3ad99a434db70b468c09ded17e012d86b5c1010f7a7"
-
-[[package]]
-name = "futures"
-version = "0.1.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a471a38ef8ed83cd6e40aa59c1ffe17db6855c18e3604d9c4ed8c08ebc28678"
-
-[[package]]
-name = "futures-cpupool"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab90cde24b3319636588d0c35fe03b1333857621051837ed769faefb4c2162e4"
-dependencies = [
- "futures",
- "num_cpus",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.1.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
-dependencies = [
- "cfg-if 1.0.0",
- "libc",
- "wasi 0.9.0+wasi-snapshot-preview1",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31"
-dependencies = [
- "cfg-if 1.0.0",
- "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
-]
-
-[[package]]
-name = "gimli"
-version = "0.27.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad0a93d233ebf96623465aad4046a8d3aa4da22d4f4beba5388838c8a434bbb4"
-
-[[package]]
-name = "h2"
-version = "0.1.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5b34c246847f938a410a03c5458c7fee2274436675e76d8b903c08efc29c462"
-dependencies = [
- "byteorder",
- "bytes",
- "fnv",
- "futures",
- "http",
- "indexmap",
- "log",
- "slab",
- "string",
- "tokio-io",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-
-[[package]]
-name = "heck"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
-
-[[package]]
-name = "http"
-version = "0.1.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6ccf5ede3a895d8856620237b2f02972c1bbc78d2965ad7fe8838d4a0ed41f0"
-dependencies = [
- "bytes",
- "fnv",
- "itoa 0.4.8",
-]
-
-[[package]]
-name = "http-body"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6741c859c1b2463a423a1dbce98d418e6c3c3fc720fb0d45528657320920292d"
-dependencies = [
- "bytes",
- "futures",
- "http",
- "tokio-buf",
-]
-
-[[package]]
-name = "httparse"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
-
-[[package]]
-name = "human-panic"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87eb03e654582b31967d414b86711a7bbd7c6b28a6b7d32857b7d1d45c0926f9"
-dependencies = [
- "backtrace",
- "concolor",
- "os_info",
- "serde",
- "serde_derive",
- "termcolor",
- "toml",
- "uuid 0.8.2",
-]
-
-[[package]]
-name = "hyper"
-version = "0.12.36"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c843caf6296fc1f93444735205af9ed4e109a539005abb2564ae1d6fad34c52"
-dependencies = [
- "bytes",
- "futures",
- "futures-cpupool",
- "h2",
- "http",
- "http-body",
- "httparse",
- "iovec",
- "itoa 0.4.8",
- "log",
- "net2",
- "rustc_version",
- "time",
- "tokio",
- "tokio-buf",
- "tokio-executor",
- "tokio-io",
- "tokio-reactor",
- "tokio-tcp",
- "tokio-threadpool",
- "tokio-timer",
- "want",
-]
-
-[[package]]
-name = "hyper-tls"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a800d6aa50af4b5850b2b0f659625ce9504df908e9733b635720483be26174f"
-dependencies = [
- "bytes",
- "futures",
- "hyper",
- "native-tls",
- "tokio-io",
-]
-
-[[package]]
-name = "idna"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38f09e0f0b1fb55fdee1f17470ad800da77af5186a1a76c026b679358b7e844e"
-dependencies = [
- "matches",
- "unicode-bidi",
- "unicode-normalization",
-]
-
-[[package]]
-name = "idna"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "418a0a6fab821475f634efe3ccc45c013f742efe03d853e8d3355d5cb850ecf8"
-dependencies = [
- "matches",
- "unicode-bidi",
- "unicode-normalization",
-]
-
-[[package]]
-name = "idna"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
-dependencies = [
- "unicode-bidi",
- "unicode-normalization",
-]
-
-[[package]]
-name = "indexmap"
-version = "1.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1885e79c1fc4b10f0e172c475f458b7f7b93061064d98c3293e98c5ba0c8b399"
-dependencies = [
- "autocfg 1.1.0",
- "hashbrown",
-]
-
-[[package]]
-name = "instant"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
-dependencies = [
- "cfg-if 1.0.0",
-]
-
-[[package]]
-name = "io-lifetimes"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1abeb7a0dd0f8181267ff8adc397075586500b81b28a73e8a0208b00fc170fb3"
-dependencies = [
- "libc",
- "windows-sys 0.45.0",
-]
-
-[[package]]
-name = "iovec"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2b3ea6ff95e175473f8ffe6a7eb7c00d054240321b84c57051175fe3c1e075e"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "is-terminal"
-version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b6b32576413a8e69b90e952e4a026476040d81017b80445deda5f2d3921857"
-dependencies = [
- "hermit-abi 0.3.1",
- "io-lifetimes",
- "rustix",
- "windows-sys 0.45.0",
-]
-
-[[package]]
-name = "itoa"
-version = "0.4.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b71991ff56294aa922b450139ee08b3bfc70982c6b2c7562771375cf73542dd4"
-
-[[package]]
-name = "itoa"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fad582f4b9e86b6caa621cabeb0963332d92eea04729ab12892c2533951e6440"
-
-[[package]]
-name = "kernel32-sys"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7507624b29483431c0ba2d82aece8ca6cdba9382bff4ddd0f7490560c056098d"
-dependencies = [
- "winapi 0.2.8",
- "winapi-build",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.139"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f051f77a7c8e6957c0696eac88f26b0117e54f52d3fc682ab19397a8812846a4"
-
-[[package]]
-name = "lock_api"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4da24a77a3d8a6d4862d95f72e6fdb9c09a643ecdb402d754004a557f2bec75"
-dependencies = [
- "scopeguard",
-]
-
-[[package]]
-name = "log"
-version = "0.4.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
-dependencies = [
- "cfg-if 1.0.0",
-]
-
-[[package]]
-name = "matches"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
-
-[[package]]
-name = "maybe-uninit"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60302e4db3a61da70c0cb7991976248362f30319e88850c487b9b95bbf059e00"
-
-[[package]]
-name = "memchr"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
-
-[[package]]
-name = "memoffset"
-version = "0.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "043175f069eda7b85febe4a74abbaeff828d9f8b448515d3151a14a3542811aa"
-dependencies = [
- "autocfg 1.1.0",
-]
-
-[[package]]
-name = "mime"
-version = "0.3.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a60c7ce501c71e03a9c9c0d35b861413ae925bd979cc7a4e30d060069aaac8d"
-
-[[package]]
-name = "mime_guess"
-version = "2.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4192263c238a5f0d0c6bfd21f336a313a4ce1c450542449ca191bb657b4642ef"
-dependencies = [
- "mime",
- "unicase",
-]
-
-[[package]]
-name = "miniz_oxide"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b275950c28b37e794e8c55d88aeb5e139d0ce23fdbbeda68f8d7174abdf9e8fa"
-dependencies = [
- "adler",
-]
-
-[[package]]
-name = "mio"
-version = "0.6.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4afd66f5b91bf2a3bc13fad0e21caedac168ca4c707504e75585648ae80e4cc4"
-dependencies = [
- "cfg-if 0.1.10",
- "fuchsia-zircon",
- "fuchsia-zircon-sys",
- "iovec",
- "kernel32-sys",
- "libc",
- "log",
- "miow",
- "net2",
- "slab",
- "winapi 0.2.8",
-]
-
-[[package]]
-name = "miow"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebd808424166322d4a38da87083bfddd3ac4c131334ed55856112eb06d46944d"
-dependencies = [
- "kernel32-sys",
- "net2",
- "winapi 0.2.8",
- "ws2_32-sys",
-]
-
-[[package]]
-name = "native-tls"
-version = "0.2.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07226173c32f2926027b63cce4bcd8076c3552846cbe7925f3aaffeac0a3b92e"
-dependencies = [
- "lazy_static",
- "libc",
- "log",
- "openssl",
- "openssl-probe",
- "openssl-sys",
- "schannel",
- "security-framework",
- "security-framework-sys",
- "tempfile",
-]
-
-[[package]]
-name = "net2"
-version = "0.2.38"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74d0df99cfcd2530b2e694f6e17e7f37b8e26bb23983ac530c0c97408837c631"
-dependencies = [
- "cfg-if 0.1.10",
- "libc",
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "num_cpus"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
-dependencies = [
- "hermit-abi 0.2.6",
- "libc",
-]
-
-[[package]]
-name = "object"
-version = "0.30.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea86265d3d3dcb6a27fc51bd29a4bf387fae9d2986b823079d4986af253eb439"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
-
-[[package]]
-name = "openssl"
-version = "0.10.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b102428fd03bc5edf97f62620f7298614c45cedf287c271e7ed450bbaf83f2e1"
-dependencies = [
- "bitflags",
- "cfg-if 1.0.0",
- "foreign-types",
- "libc",
- "once_cell",
- "openssl-macros",
- "openssl-sys",
-]
-
-[[package]]
-name = "openssl-macros"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b501e44f11665960c7e7fcf062c7d96a14ade4aa98116c004b2e37b5be7d736c"
-dependencies = [
- "proc-macro2 1.0.51",
- "quote 1.0.23",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "openssl-probe"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
-
-[[package]]
-name = "openssl-sys"
-version = "0.9.80"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23bbbf7854cd45b83958ebe919f0e8e516793727652e27fda10a8384cfc790b7"
-dependencies = [
- "autocfg 1.1.0",
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "os_info"
-version = "2.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2cc1b4330bb29087e791ae2a5cf56be64fb8946a4ff5aec2ba11c6ca51f5d60"
-dependencies = [
- "log",
- "serde",
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "parking_lot"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f842b1982eb6c2fe34036a4fbfb06dd185a3f5c8edfaacdf7d1ea10b07de6252"
-dependencies = [
- "lock_api",
- "parking_lot_core",
- "rustc_version",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bda66b810a62be75176a80873726630147a5ca780cd33921e0b5709033e66b0a"
-dependencies = [
- "cfg-if 0.1.10",
- "cloudabi",
- "libc",
- "redox_syscall 0.1.57",
- "rustc_version",
- "smallvec",
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "percent-encoding"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31010dd2e1ac33d5b46a5b413495239882813e0369f8ed8a5e266f173602f831"
-
-[[package]]
-name = "percent-encoding"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
-
-[[package]]
-name = "pkg-config"
-version = "0.3.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
-
-[[package]]
-name = "proc-macro2"
-version = "0.4.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf3d2011ab5c909338f7887f4fc896d35932e29146c12c8d01da6b22a80ba759"
-dependencies = [
- "unicode-xid 0.1.0",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.51"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d727cae5b39d21da60fa540906919ad737832fe0b1c165da3a34d6548c849d6"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "publicsuffix"
-version = "1.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95b4ce31ff0a27d93c8de1849cf58162283752f065a90d508f1105fa6c9a213f"
-dependencies = [
- "idna 0.2.3",
- "url 2.3.1",
-]
-
-[[package]]
-name = "quote"
-version = "0.6.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce23b6b870e8f94f81fb0a363d65d86675884b34a09043c81e5562f11c1f8e1"
-dependencies = [
- "proc-macro2 0.4.30",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8856d8364d252a14d474036ea1358d63c9e6965c8e5c1885c18f73d70bff9c7b"
-dependencies = [
- "proc-macro2 1.0.51",
-]
-
-[[package]]
-name = "rand"
-version = "0.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c618c47cd3ebd209790115ab837de41425723956ad3ce2e6a7f09890947cacb9"
-dependencies = [
- "cloudabi",
- "fuchsia-cprng",
- "libc",
- "rand_core 0.3.1",
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "rand"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d71dacdc3c88c1fde3885a3be3fbab9f35724e6ce99467f7d9c5026132184ca"
-dependencies = [
- "autocfg 0.1.8",
- "libc",
- "rand_chacha",
- "rand_core 0.4.2",
- "rand_hc",
- "rand_isaac",
- "rand_jitter",
- "rand_os",
- "rand_pcg",
- "rand_xorshift",
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "556d3a1ca6600bfcbab7c7c91ccb085ac7fbbcd70e008a98742e7847f4f7bcef"
-dependencies = [
- "autocfg 0.1.8",
- "rand_core 0.3.1",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
-dependencies = [
- "rand_core 0.4.2",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
-
-[[package]]
-name = "rand_hc"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b40677c7be09ae76218dc623efbf7b18e34bced3f38883af07bb75630a21bc4"
-dependencies = [
- "rand_core 0.3.1",
-]
-
-[[package]]
-name = "rand_isaac"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ded997c9d5f13925be2a6fd7e66bf1872597f759fd9dd93513dd7e92e5a5ee08"
-dependencies = [
- "rand_core 0.3.1",
-]
-
-[[package]]
-name = "rand_jitter"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1166d5c91dc97b88d1decc3285bb0a99ed84b05cfd0bc2341bdf2d43fc41e39b"
-dependencies = [
- "libc",
- "rand_core 0.4.2",
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "rand_os"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b75f676a1e053fc562eafbb47838d67c84801e38fc1ba459e8f180deabd5071"
-dependencies = [
- "cloudabi",
- "fuchsia-cprng",
- "libc",
- "rand_core 0.4.2",
- "rdrand",
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "rand_pcg"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abf9b09b01790cfe0364f52bf32995ea3c39f4d2dd011eac241d2914146d0b44"
-dependencies = [
- "autocfg 0.1.8",
- "rand_core 0.4.2",
-]
-
-[[package]]
-name = "rand_xorshift"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbf7e9e623549b0e21f6e97cf8ecf247c1a8fd2e8a992ae265314300b2455d5c"
-dependencies = [
- "rand_core 0.3.1",
-]
-
-[[package]]
-name = "rdrand"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
-dependencies = [
- "rand_core 0.3.1",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.1.57"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce"
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de0737333e7a9502c789a36d7c7fa6092a49895d4faa31ca5df163857ded2e9d"
-dependencies = [
- "getrandom 0.1.16",
- "redox_syscall 0.1.57",
- "rust-argon2",
-]
-
-[[package]]
-name = "regex"
-version = "0.2.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9329abc99e39129fcceabd24cf5d85b4671ef7c29c50e972bc5afe32438ec384"
-dependencies = [
- "aho-corasick 0.6.10",
- "memchr",
- "regex-syntax 0.5.6",
- "thread_local",
- "utf8-ranges",
-]
-
-[[package]]
-name = "regex"
-version = "1.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48aaa5748ba571fb95cd2c85c09f629215d3a6ece942baa100950af03a34f733"
-dependencies = [
- "aho-corasick 0.7.20",
- "memchr",
- "regex-syntax 0.6.28",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d707a4fa2637f2dca2ef9fd02225ec7661fe01a53623c1e6515b6916511f7a7"
-dependencies = [
- "ucd-util",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.6.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "456c603be3e8d448b072f410900c09faf164fbce2d480456f50eea6e25f9c848"
-
-[[package]]
-name = "reqwest"
-version = "0.9.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f88643aea3c1343c804950d7bf983bd2067f5ab59db6d613a08e05572f2714ab"
-dependencies = [
- "base64 0.10.1",
- "bytes",
- "cookie",
- "cookie_store",
- "encoding_rs",
- "flate2",
- "futures",
- "http",
- "hyper",
- "hyper-tls",
- "log",
- "mime",
- "mime_guess",
- "native-tls",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "time",
- "tokio",
- "tokio-executor",
- "tokio-io",
- "tokio-threadpool",
- "tokio-timer",
- "url 1.7.2",
- "uuid 0.7.4",
- "winreg",
-]
-
-[[package]]
-name = "rust-argon2"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b18820d944b33caa75a71378964ac46f58517c92b6ae5f762636247c09e78fb"
-dependencies = [
- "base64 0.13.1",
- "blake2b_simd",
- "constant_time_eq",
- "crossbeam-utils 0.8.14",
-]
-
-[[package]]
-name = "rustc-demangle"
-version = "0.1.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef03e0a2b150c7a90d01faf6254c9c48a41e95fb2a8c2ac1c6f0d2b9aefc342"
-
-[[package]]
-name = "rustc_version"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "138e3e0acb6c9fb258b19b67cb8abd63c00679d2851805ea151465464fe9030a"
-dependencies = [
- "semver",
-]
-
-[[package]]
-name = "rustix"
-version = "0.36.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f43abb88211988493c1abb44a70efa56ff0ce98f233b7b276146f1f3f7ba9644"
-dependencies = [
- "bitflags",
- "errno",
- "io-lifetimes",
- "libc",
- "linux-raw-sys",
- "windows-sys 0.45.0",
-]
-
-[[package]]
-name = "ryu"
-version = "1.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b4b9743ed687d4b4bcedf9ff5eaa7398495ae14e61cba0a295704edbc7decde"
-
-[[package]]
-name = "schannel"
-version = "0.1.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "713cfb06c7059f3588fb8044c0fad1d09e3c01d225e25b9220dbfdcf16dbb1b3"
-dependencies = [
- "windows-sys 0.42.0",
-]
-
-[[package]]
-name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-
-[[package]]
-name = "security-framework"
-version = "2.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a332be01508d814fed64bf28f798a146d73792121129962fdf335bb3c49a4254"
-dependencies = [
- "bitflags",
- "core-foundation",
- "core-foundation-sys",
- "libc",
- "security-framework-sys",
-]
-
-[[package]]
-name = "security-framework-sys"
-version = "2.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31c9bb296072e961fcbd8853511dd39c2d8be2deb1e17c6860b1d30732b323b4"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
-[[package]]
-name = "semver"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d7eb9ef2c18661902cc47e535f9bc51b78acd254da71d375c2f6720d9a40403"
-dependencies = [
- "semver-parser",
-]
-
-[[package]]
-name = "semver-parser"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
-
-[[package]]
-name = "serde"
-version = "1.0.152"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb7d1f0d3021d347a83e556fc4683dea2ea09d87bccdf88ff5c12545d89d5efb"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.152"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af487d118eecd09402d70a5d72551860e788df87b464af30e5ea6a38c75c541e"
-dependencies = [
- "proc-macro2 1.0.51",
- "quote 1.0.23",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.93"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cad406b69c91885b5107daf2c29572f6c8cdb3c66826821e286c533490c0bc76"
-dependencies = [
- "itoa 1.0.5",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "serde_urlencoded"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "642dd69105886af2efd227f75a520ec9b44a820d65bc133a9131f7d229fd165a"
-dependencies = [
- "dtoa",
- "itoa 0.4.8",
- "serde",
- "url 1.7.2",
-]
-
-[[package]]
-name = "slab"
-version = "0.4.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6528351c9bc8ab22353f9d776db39a20288e8d6c37ef8cfe3317cf875eecfc2d"
-dependencies = [
- "autocfg 1.1.0",
-]
-
-[[package]]
-name = "smallvec"
-version = "0.6.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97fcaeba89edba30f044a10c6a3cc39df9c3f17d7cd829dd1446cab35f890e0"
-dependencies = [
- "maybe-uninit",
-]
-
-[[package]]
-name = "string"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d24114bfcceb867ca7f71a0d3fe45d45619ec47a6fbfa98cb14e14250bfa5d6d"
-dependencies = [
- "bytes",
-]
-
-[[package]]
-name = "strsim"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
-
-[[package]]
-name = "structopt"
-version = "0.2.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16c2cdbf9cc375f15d1b4141bc48aeef444806655cd0e904207edc8d68d86ed7"
-dependencies = [
- "clap",
- "structopt-derive",
-]
-
-[[package]]
-name = "structopt-derive"
-version = "0.2.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53010261a84b37689f9ed7d395165029f9cc7abb9f56bbfe86bee2597ed25107"
-dependencies = [
- "heck",
- "proc-macro2 0.4.30",
- "quote 0.6.13",
- "syn 0.15.44",
-]
-
-[[package]]
-name = "syn"
-version = "0.15.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ca4b3b69a77cbe1ffc9e198781b7acb0c7365a883670e8f1c1bc66fba79a5c5"
-dependencies = [
- "proc-macro2 0.4.30",
- "quote 0.6.13",
- "unicode-xid 0.1.0",
-]
-
-[[package]]
-name = "syn"
-version = "1.0.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2 1.0.51",
- "quote 1.0.23",
- "unicode-ident",
-]
-
-[[package]]
-name = "synstructure"
-version = "0.12.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
-dependencies = [
- "proc-macro2 1.0.51",
- "quote 1.0.23",
- "syn 1.0.109",
- "unicode-xid 0.2.4",
-]
-
-[[package]]
-name = "tempfile"
-version = "3.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af18f7ae1acd354b992402e9ec5864359d693cd8a79dcbef59f76891701c1e95"
-dependencies = [
- "cfg-if 1.0.0",
- "fastrand",
- "redox_syscall 0.2.16",
- "rustix",
- "windows-sys 0.42.0",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "textwrap"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
-dependencies = [
- "unicode-width",
-]
-
-[[package]]
-name = "thread_local"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6b53e329000edc2b34dbe8545fd20e55a333362d0a321909685a19bd28c3f1b"
-dependencies = [
- "lazy_static",
-]
-
-[[package]]
-name = "time"
-version = "0.1.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b797afad3f312d1c66a56d11d0316f916356d11bd158fbc6ca6389ff6bf805a"
-dependencies = [
- "libc",
- "wasi 0.10.0+wasi-snapshot-preview1",
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
-[[package]]
-name = "tokio"
-version = "0.1.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a09c0b5bb588872ab2f09afa13ee6e9dac11e10a0ec9e8e3ba39a5a5d530af6"
-dependencies = [
- "bytes",
- "futures",
- "mio",
- "num_cpus",
- "tokio-current-thread",
- "tokio-executor",
- "tokio-io",
- "tokio-reactor",
- "tokio-tcp",
- "tokio-threadpool",
- "tokio-timer",
-]
-
-[[package]]
-name = "tokio-buf"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fb220f46c53859a4b7ec083e41dec9778ff0b1851c0942b211edb89e0ccdc46"
-dependencies = [
- "bytes",
- "either",
- "futures",
-]
-
-[[package]]
-name = "tokio-current-thread"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1de0e32a83f131e002238d7ccde18211c0a5397f60cbfffcb112868c2e0e20e"
-dependencies = [
- "futures",
- "tokio-executor",
-]
-
-[[package]]
-name = "tokio-executor"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb2d1b8f4548dbf5e1f7818512e9c406860678f29c300cdf0ebac72d1a3a1671"
-dependencies = [
- "crossbeam-utils 0.7.2",
- "futures",
-]
-
-[[package]]
-name = "tokio-io"
-version = "0.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57fc868aae093479e3131e3d165c93b1c7474109d13c90ec0dda2a1bbfff0674"
-dependencies = [
- "bytes",
- "futures",
- "log",
-]
-
-[[package]]
-name = "tokio-reactor"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09bc590ec4ba8ba87652da2068d150dcada2cfa2e07faae270a5e0409aa51351"
-dependencies = [
- "crossbeam-utils 0.7.2",
- "futures",
- "lazy_static",
- "log",
- "mio",
- "num_cpus",
- "parking_lot",
- "slab",
- "tokio-executor",
- "tokio-io",
- "tokio-sync",
-]
-
-[[package]]
-name = "tokio-sync"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edfe50152bc8164fcc456dab7891fa9bf8beaf01c5ee7e1dd43a397c3cf87dee"
-dependencies = [
- "fnv",
- "futures",
-]
-
-[[package]]
-name = "tokio-tcp"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98df18ed66e3b72e742f185882a9e201892407957e45fbff8da17ae7a7c51f72"
-dependencies = [
- "bytes",
- "futures",
- "iovec",
- "mio",
- "tokio-io",
- "tokio-reactor",
-]
-
-[[package]]
-name = "tokio-threadpool"
-version = "0.1.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df720b6581784c118f0eb4310796b12b1d242a7eb95f716a8367855325c25f89"
-dependencies = [
- "crossbeam-deque",
- "crossbeam-queue",
- "crossbeam-utils 0.7.2",
- "futures",
- "lazy_static",
- "log",
- "num_cpus",
- "slab",
- "tokio-executor",
-]
-
-[[package]]
-name = "tokio-timer"
-version = "0.2.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93044f2d313c95ff1cb7809ce9a7a05735b012288a888b62d4434fd58c94f296"
-dependencies = [
- "crossbeam-utils 0.7.2",
- "futures",
- "slab",
- "tokio-executor",
-]
-
-[[package]]
-name = "toml"
-version = "0.5.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4f7f0dd8d50a853a531c426359045b1998f04219d88799810762cd4ad314234"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "try-lock"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
-
-[[package]]
-name = "try_from"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "283d3b89e1368717881a9d51dad843cc435380d8109c9e47d38780a324698d8b"
-dependencies = [
- "cfg-if 0.1.10",
-]
-
-[[package]]
-name = "ucd-util"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abd2fc5d32b590614af8b0a20d837f32eca055edd0bbead59a9cfe80858be003"
-
-[[package]]
-name = "unicase"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50f37be617794602aabbeee0be4f259dc1778fabe05e2d67ee8f79326d5cb4f6"
-dependencies = [
- "version_check",
-]
-
-[[package]]
-name = "unicode-bidi"
-version = "0.3.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d54675592c1dbefd78cbd98db9bacd89886e1ca50692a0692baefffdeb92dd58"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84a22b9f218b40614adcb3f4ff08b703773ad44fa9423e4e0d346d5db86e4ebc"
-
-[[package]]
-name = "unicode-normalization"
-version = "0.1.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
-dependencies = [
- "tinyvec",
-]
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"
-
-[[package]]
-name = "unicode-width"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b"
-
-[[package]]
-name = "unicode-xid"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc72304796d0818e357ead4e000d19c9c174ab23dc11093ac919054d20a6a7fc"
-
-[[package]]
-name = "unicode-xid"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
-
-[[package]]
-name = "url"
-version = "1.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd4e7c0d531266369519a4aa4f399d748bd37043b00bde1e4ff1f60a120b355a"
-dependencies = [
- "idna 0.1.5",
- "matches",
- "percent-encoding 1.0.1",
-]
-
-[[package]]
-name = "url"
-version = "2.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d68c799ae75762b8c3fe375feb6600ef5602c883c5d21eb51c09f22b83c4643"
-dependencies = [
- "form_urlencoded",
- "idna 0.3.0",
- "percent-encoding 2.2.0",
-]
-
-[[package]]
-name = "utf8-ranges"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcfc827f90e53a02eaef5e535ee14266c1d569214c6aa70133a624d8a3164ba"
-
-[[package]]
-name = "uuid"
-version = "0.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90dbc611eb48397705a6b0f6e917da23ae517e4d127123d2cf7674206627d32a"
-dependencies = [
- "rand 0.6.5",
-]
-
-[[package]]
-name = "uuid"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc5cf98d8186244414c848017f0e2676b3fcb46807f6668a97dfe67359a3c4b7"
-dependencies = [
- "getrandom 0.2.8",
-]
-
-[[package]]
-name = "vcpkg"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
-
-[[package]]
-name = "vec_map"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
-
-[[package]]
-name = "version_check"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
-
-[[package]]
-name = "want"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6395efa4784b027708f7451087e647ec73cc74f5d9bc2e418404248d679a230"
-dependencies = [
- "futures",
- "log",
- "try-lock",
-]
-
-[[package]]
-name = "wasi"
-version = "0.9.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
-
-[[package]]
-name = "wasi"
-version = "0.10.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
-
-[[package]]
-name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
-
-[[package]]
-name = "winapi"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "167dc9d6949a9b857f3451275e911c3f44255842c1f7a76f33c55103a909087a"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-build"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d315eee3b34aca4797b2da6b13ed88266e6d612562a0c46390af8299fc699bc"
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
-dependencies = [
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "windows-sys"
-version = "0.42.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2522491fbfcd58cc84d47aeb2958948c4b8982e9a2d8a2a35bbaed431390e7"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c9864e83243fdec7fc9c5444389dcbbfd258f745e7853198f365e3c4968a608"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c8b1b673ffc16c47a9ff48570a9d85e25d265735c503681332589af6253c6c7"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de3887528ad530ba7bdbb1faa8275ec7a1155a45ffa57c37993960277145d640"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf4d1122317eddd6ff351aa852118a2418ad4214e6613a50e0191f7004372605"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1040f221285e17ebccbc2591ffdc2d44ee1f9186324dd3e84e99ac68d699c45"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "628bfdf232daa22b0d64fdb62b09fcc36bb01f05a3939e20ab73aaf9470d0463"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "447660ad36a13288b1db4d4248e857b510e8c3a225c822ba4fb748c0aafecffd"
-
-[[package]]
-name = "winreg"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2986deb581c4fe11b621998a5e53361efe6b48a151178d0cd9eeffa4dc6acc9"
-dependencies = [
- "winapi 0.3.9",
-]
-
-[[package]]
-name = "ws2_32-sys"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d59cefebd0c892fa2dd6de581e937301d8552cb44489cdff035c6187cb63fa5e"
-dependencies = [
- "winapi 0.2.8",
- "winapi-build",
-]
diff --git a/pkgs/by-name/ei/eidolon/package.nix b/pkgs/by-name/ei/eidolon/package.nix
deleted file mode 100644
index beab829a0c44..000000000000
--- a/pkgs/by-name/ei/eidolon/package.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  lib,
-  fetchFromSourcehut,
-  rustPlatform,
-  pkg-config,
-  openssl,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "eidolon";
-  version = "1.4.6";
-
-  src = fetchFromSourcehut {
-    owner = "~nicohman";
-    repo = "eidolon";
-    rev = version;
-    hash = "sha256-Ofc3i+iMmbUgY3bomUk4rM3bEQInTV3rIPz3m0yZw/o=";
-  };
-
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ];
-
-  postPatch = ''
-    ln -sf ${./Cargo.lock} Cargo.lock
-  '';
-
-  meta = with lib; {
-    description = "Single TUI-based registry for drm-free, wine and steam games on linux, accessed through a rofi launch menu";
-    mainProgram = "eidolon";
-    homepage = "https://github.com/nicohman/eidolon";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ _0x4A6F ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/by-name/ei/eigen2/package.nix b/pkgs/by-name/ei/eigen2/package.nix
index 37f1017a2531..2df45c985510 100644
--- a/pkgs/by-name/ei/eigen2/package.nix
+++ b/pkgs/by-name/ei/eigen2/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitLab {
     owner = "libeigen";
-    repo = pname;
+    repo = "eigen";
     rev = version;
     hash = "sha256-C1Bu2H4zxd/2QVzz9AOdoCSRwOYjF41Vr/0S8Fm2kzQ=";
   };
diff --git a/pkgs/by-name/ei/eigenmath/package.nix b/pkgs/by-name/ei/eigenmath/package.nix
index 4f9c41f5b012..b4516f825709 100644
--- a/pkgs/by-name/ei/eigenmath/package.nix
+++ b/pkgs/by-name/ei/eigenmath/package.nix
@@ -6,13 +6,13 @@
   unstableGitUpdater,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "eigenmath";
   version = "340-unstable-2025-05-05";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
-    repo = pname;
+    repo = "eigenmath";
     rev = "94fee6b02ebd4cd718dd9ea45583a6af2129dd28";
     hash = "sha256-2bdO0nRXhDZlEmGRfNf6g9zwc65Ih9Ymlo6PxlpAxes=";
   };
diff --git a/pkgs/by-name/ej/ejson2env/package.nix b/pkgs/by-name/ej/ejson2env/package.nix
index 9e34d3ea335c..f165d5ab5057 100644
--- a/pkgs/by-name/ej/ejson2env/package.nix
+++ b/pkgs/by-name/ej/ejson2env/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "Shopify";
-    repo = pname;
+    repo = "ejson2env";
     rev = "v${version}";
     sha256 = "sha256-9i84nHIuAR7PG6/v8O5GEi6xToJk0c+knpVPOPx+1b8=";
   };
diff --git a/pkgs/by-name/ek/eks-node-viewer/package.nix b/pkgs/by-name/ek/eks-node-viewer/package.nix
index 93457be17b94..f52d258e7dbb 100644
--- a/pkgs/by-name/ek/eks-node-viewer/package.nix
+++ b/pkgs/by-name/ek/eks-node-viewer/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "awslabs";
-    repo = pname;
+    repo = "eks-node-viewer";
     tag = "v${version}";
     hash = "sha256-VCRwGxH7adwB6p+UCF1GmAa5f/7GgJlJ7GvRSFOlOto=";
   };
diff --git a/pkgs/by-name/ek/eksctl/package.nix b/pkgs/by-name/ek/eksctl/package.nix
index 79d4e5585fd9..1f2875e14bcd 100644
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "weaveworks";
-    repo = pname;
+    repo = "eksctl";
     rev = version;
     hash = "sha256-lRRB6yAELCNzXWiuxaEHTwlTG7/x3AC97ZnaEtJ3AVs=";
   };
diff --git a/pkgs/by-name/el/electrs/package.nix b/pkgs/by-name/el/electrs/package.nix
index 01e1b624821b..f5b9f1eb8337 100644
--- a/pkgs/by-name/el/electrs/package.nix
+++ b/pkgs/by-name/el/electrs/package.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "romanz";
-    repo = pname;
+    repo = "electrs";
     rev = "v${version}";
     hash = "sha256-Xo7aqP4tIh/kYthPucscxnl+ZtVioEja4TTFdH0Q350=";
   };
diff --git a/pkgs/by-name/el/element/package.nix b/pkgs/by-name/el/element/package.nix
index 1645db9ce4ff..39fc6579cd9f 100644
--- a/pkgs/by-name/el/element/package.nix
+++ b/pkgs/by-name/el/element/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "gennaro-tedesco";
-    repo = pname;
+    repo = "element";
     rev = "v${version}";
     sha256 = "sha256-06RDZnie0Lv7i95AwnBGl6PPucuj8pIT6DHW3e3mu1o=";
   };
diff --git a/pkgs/by-name/em/emptty/package.nix b/pkgs/by-name/em/emptty/package.nix
index 28f5bac65e9e..a8b0af3646c0 100644
--- a/pkgs/by-name/em/emptty/package.nix
+++ b/pkgs/by-name/em/emptty/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "tvrzna";
-    repo = pname;
+    repo = "emptty";
     rev = "v${version}";
     hash = "sha256-AsIt7EI5RkSchhaMGKofOsfPNROhX8f5gDaqZ7Q2394=";
   };
diff --git a/pkgs/by-name/em/emulsion/package.nix b/pkgs/by-name/em/emulsion/package.nix
index c6fe5dc4fc7f..2e6f6ac12deb 100644
--- a/pkgs/by-name/em/emulsion/package.nix
+++ b/pkgs/by-name/em/emulsion/package.nix
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "ArturKovacs";
-    repo = pname;
+    repo = "emulsion";
     rev = "v${version}";
     sha256 = "sha256-0t+MUZu1cvkJSL9Ly9kblH8fMr05KuRpOo+JDn/VUc8=";
   };
diff --git a/pkgs/by-name/en/enumerepo/package.nix b/pkgs/by-name/en/enumerepo/package.nix
index 8f888ff2b62d..c3b74c083c64 100644
--- a/pkgs/by-name/en/enumerepo/package.nix
+++ b/pkgs/by-name/en/enumerepo/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "trickest";
-    repo = pname;
+    repo = "enumerepo";
     tag = "v${version}";
     hash = "sha256-PWWx6b+fttxKxMtuHAYPTeEsta0E6+IQ1DSKO6c7Jdc=";
   };
diff --git a/pkgs/by-name/en/envchain/package.nix b/pkgs/by-name/en/envchain/package.nix
index ef7e7d881656..9a1391028f93 100644
--- a/pkgs/by-name/en/envchain/package.nix
+++ b/pkgs/by-name/en/envchain/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "sorah";
-    repo = pname;
+    repo = "envchain";
     rev = "v${version}";
     sha256 = "sha256-QUy38kJzMbYOyT86as4/yq2ctcszSnB8a3eVWxgd4Fo=";
   };
diff --git a/pkgs/by-name/ep/epick/package.nix b/pkgs/by-name/ep/epick/package.nix
index 14bfac54b081..73b8b1b3297f 100644
--- a/pkgs/by-name/ep/epick/package.nix
+++ b/pkgs/by-name/ep/epick/package.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "vv9k";
-    repo = pname;
+    repo = "epick";
     # Upstream has rewritten tags on multiple occasions.
     rev = "14ee92e049780406fffdc1e4a83bf1433775663f";
     sha256 = "sha256-gjqAQrGJ9KFdzn2a3fOgu0VJ9zrX5stsbzriOGJaD/4=";
diff --git a/pkgs/by-name/ep/epr/package.nix b/pkgs/by-name/ep/epr/package.nix
index 0cdda2e45535..a59abf2b28dd 100644
--- a/pkgs/by-name/ep/epr/package.nix
+++ b/pkgs/by-name/ep/epr/package.nix
@@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "wustho";
-    repo = pname;
+    repo = "epr";
     rev = "v${version}";
     sha256 = "sha256-1qsqYlqGlCRhl7HINrcTDt5bGlb7g5PmaERylT+UvEg=";
   };
diff --git a/pkgs/by-name/er/erigon/package.nix b/pkgs/by-name/er/erigon/package.nix
index a58e2f6a9bdf..16beec52f3b0 100644
--- a/pkgs/by-name/er/erigon/package.nix
+++ b/pkgs/by-name/er/erigon/package.nix
@@ -14,7 +14,7 @@ buildGoModule {
 
   src = fetchFromGitHub {
     owner = "ledgerwatch";
-    repo = pname;
+    repo = "erigon";
     rev = "v${version}";
     hash = "sha256-gSgkdg7677OBOkAbsEjxX1QttuIbfve2A3luUZoZ5Ik=";
     fetchSubmodules = true;
diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index 42ce5755059e..3bae9a97cb27 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.5.0";
+  version = "2025.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "esphome";
+    repo = "esphome";
     tag = version;
-    hash = "sha256-BcPdgAvRR7zataL4KOhLAvQaQnS60z8UZ9xdIK7ydz4=";
+    hash = "sha256-z4FwymWFjyqNx95r2o7LLCmytRQYkogfCKiUFNyGOuA=";
   };
 
   build-systems = with python.pkgs; [
diff --git a/pkgs/by-name/ev/evans/package.nix b/pkgs/by-name/ev/evans/package.nix
index 8deac905eff6..a8636834d0a7 100644
--- a/pkgs/by-name/ev/evans/package.nix
+++ b/pkgs/by-name/ev/evans/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ktr0731";
-    repo = pname;
+    repo = "evans";
     rev = "v${version}";
     sha256 = "sha256-V5M7vXlBSQFX2YZ+Vjt63hLziWy0yuAbCMmSZFEO0OA=";
   };
diff --git a/pkgs/by-name/ev/evdevremapkeys/package.nix b/pkgs/by-name/ev/evdevremapkeys/package.nix
index cd4ec0cd98b4..a99abc407e0d 100644
--- a/pkgs/by-name/ev/evdevremapkeys/package.nix
+++ b/pkgs/by-name/ev/evdevremapkeys/package.nix
@@ -4,13 +4,13 @@
   python3Packages,
 }:
 
-python3Packages.buildPythonPackage rec {
+python3Packages.buildPythonPackage {
   pname = "evdevremapkeys";
   version = "unstable-2021-05-04";
 
   src = fetchFromGitHub {
     owner = "philipl";
-    repo = pname;
+    repo = "evdevremapkeys";
     rev = "9b6f372a9bdf8b27d39f7e655b74f6b9d1a8467f";
     sha256 = "sha256-FwRbo0RTiiV2AB7z6XOalMnwMbj15jM4Dxs41TsIOQI=";
   };
diff --git a/pkgs/by-name/ex/expliot/package.nix b/pkgs/by-name/ex/expliot/package.nix
index 68f335f23ef0..d4496c28d1e8 100644
--- a/pkgs/by-name/ex/expliot/package.nix
+++ b/pkgs/by-name/ex/expliot/package.nix
@@ -27,7 +27,7 @@ buildPythonApplication rec {
 
   src = fetchFromGitLab {
     owner = "expliot_framework";
-    repo = pname;
+    repo = "expliot";
     rev = version;
     hash = "sha256-7Cuj3YKKwDxP2KKueJR9ZO5Bduv+lw0Y87Rw4b0jbGY=";
   };
diff --git a/pkgs/by-name/ex/exploitdb/package.nix b/pkgs/by-name/ex/exploitdb/package.nix
index 4aec5276f880..42ba290d79e4 100644
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2025-05-22";
+  version = "2025-05-26";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     rev = "refs/tags/${version}";
-    hash = "sha256-2dnIchOJJrqqePgOxb7tWw0j1neTlXFyxT30qwTOkrc=";
+    hash = "sha256-e9a0bzlyqI3lR87X+S9XIVTpEv1a9RxlfKqyk6CsDGU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ex/expr/package.nix b/pkgs/by-name/ex/expr/package.nix
index ee5916854ad6..469cc2511e05 100644
--- a/pkgs/by-name/ex/expr/package.nix
+++ b/pkgs/by-name/ex/expr/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "expr";
-  version = "1.17.3";
+  version = "1.17.4";
 
   src = fetchFromGitHub {
     owner = "expr-lang";
     repo = "expr";
     rev = "v${version}";
-    hash = "sha256-oi5dMTuirAnUFOC8zBlu7YErp13DZPoSGNpueKXdNtE=";
+    hash = "sha256-Ss1rs4BiKFOSzfL6VXKZA2Z/LYJ9N+AYkgdVCeintOk=";
   };
 
   sourceRoot = "${src.name}/repl";
 
-  vendorHash = "sha256-tSerrcRS7Nl0rZQqGfUKgdHsGBXEAFFF+Cn7HqFyfqA=";
+  vendorHash = "sha256-mjqbO3qgX7ak8VRFHnz9UYNoOd+bbHBImDLvnaJhdqI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ex/extrude/package.nix b/pkgs/by-name/ex/extrude/package.nix
index 469678b7ec55..9ae410ec7ff4 100644
--- a/pkgs/by-name/ex/extrude/package.nix
+++ b/pkgs/by-name/ex/extrude/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "liamg";
-    repo = pname;
+    repo = "extrude";
     rev = "v${version}";
     hash = "sha256-7gCEBhnNU5CqC5n0KP4Dd/fmddPRwNqyMFXTrRrJjfU=";
   };
diff --git a/pkgs/by-name/f1/f1viewer/package.nix b/pkgs/by-name/f1/f1viewer/package.nix
index 363d914548ef..8ff7b9a58711 100644
--- a/pkgs/by-name/f1/f1viewer/package.nix
+++ b/pkgs/by-name/f1/f1viewer/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "SoMuchForSubtlety";
-    repo = pname;
+    repo = "f1viewer";
     rev = "v${version}";
     sha256 = "sha256-jXC2dENXuqicNQqTHyZKsjibDvjta/npQmf3+uivjX0=";
   };
diff --git a/pkgs/by-name/fa/fabric-ai/package.nix b/pkgs/by-name/fa/fabric-ai/package.nix
index 2f2a6ffc4cd6..14b0745c8bd7 100644
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "fabric-ai";
-  version = "1.4.187";
+  version = "1.4.195";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     tag = "v${version}";
-    hash = "sha256-5vUtw8ttNB2gjVgASfgWke5tCZGzEiSvk+c4K9555ck=";
+    hash = "sha256-83LlJ697CyW8Hmp6cB3RqeVk1OGuF6TUHcfKLqjgLPk=";
   };
 
-  vendorHash = "sha256-ZrIzCKhEa00KOS8tauYEGLR4o7gGVVZ9pdfEQbAGDkI=";
+  vendorHash = "sha256-xfNvmhHNYpanhZKT9o8kImzw4gzigpgc8ri9O1iOqwc=";
 
   # Fabric introduced plugin tests that fail in the nix build sandbox.
   doCheck = false;
diff --git a/pkgs/by-name/fa/falcoctl/package.nix b/pkgs/by-name/fa/falcoctl/package.nix
index 6f36d1ebf140..056c15dc889e 100644
--- a/pkgs/by-name/fa/falcoctl/package.nix
+++ b/pkgs/by-name/fa/falcoctl/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "falcoctl";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "falcosecurity";
     repo = "falcoctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3YsxshQh+LQBpKt7YG52rwOdWyjkfn+kTa6nsHpkA+A=";
+    hash = "sha256-cbrlFxRRHwrK1+mkvEktrOCbg5bhKG7GXvv+YJ6un7I=";
   };
 
-  vendorHash = "sha256-uIs3e2E8ThW7n9SXX2lu63KFmsy/QrVGQ4NgY1J+Qr0=";
+  vendorHash = "sha256-L7VXGMWs2eRQUT37CCtQsiYZnsDi/a8QSwAw/f/mydc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fa/fan2go/package.nix b/pkgs/by-name/fa/fan2go/package.nix
index 579b516b06b0..ff54086d9a5c 100644
--- a/pkgs/by-name/fa/fan2go/package.nix
+++ b/pkgs/by-name/fa/fan2go/package.nix
@@ -11,7 +11,7 @@ buildGo123Module rec {
 
   src = fetchFromGitHub {
     owner = "markusressel";
-    repo = pname;
+    repo = "fan2go";
     rev = version;
     hash = "sha256-eSHeHBzDvzsDAck0zexwR8drasisvlQNTeowv92E2uc=";
   };
diff --git a/pkgs/by-name/fa/fastmod/package.nix b/pkgs/by-name/fa/fastmod/package.nix
index 0c238b3bc21b..1e6411b9d6d5 100644
--- a/pkgs/by-name/fa/fastmod/package.nix
+++ b/pkgs/by-name/fa/fastmod/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
-    repo = pname;
+    repo = "fastmod";
     rev = "v${version}";
     sha256 = "sha256-A/3vzfwaStoQ9gdNM8yjmL2J/pQjj6yb68WThiTF+1E=";
   };
diff --git a/pkgs/by-name/fa/fastp/package.nix b/pkgs/by-name/fa/fastp/package.nix
index d5eeeb41954a..0a2290d2f629 100644
--- a/pkgs/by-name/fa/fastp/package.nix
+++ b/pkgs/by-name/fa/fastp/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fastp";
-  version = "0.24.1";
+  version = "0.24.2";
 
   src = fetchFromGitHub {
     owner = "OpenGene";
     repo = "fastp";
     rev = "v${version}";
-    sha256 = "sha256-vTAuuhnJ5O2mUFUxM5RIq8w/Zo3SmAgQIDd99YpDcww=";
+    sha256 = "sha256-8AJ6wgqbCqH/f3flgdVYUb5u0C5/CQl6MJe7HmZrp60=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/fe/ferium/package.nix b/pkgs/by-name/fe/ferium/package.nix
index 88f212a9f744..d73acd3545bf 100644
--- a/pkgs/by-name/fe/ferium/package.nix
+++ b/pkgs/by-name/fe/ferium/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "gorilla-devs";
-    repo = pname;
+    repo = "ferium";
     rev = "v${version}";
     hash = "sha256-eeQjezB6pRdnPADLgDLo8b+bUSP12gfBhFNt/uYCwHU=";
   };
diff --git a/pkgs/by-name/fi/filebrowser/package.nix b/pkgs/by-name/fi/filebrowser/package.nix
index 4ce239006d9b..94e6a139729a 100644
--- a/pkgs/by-name/fi/filebrowser/package.nix
+++ b/pkgs/by-name/fi/filebrowser/package.nix
@@ -6,6 +6,8 @@
 
   nodejs_22,
   pnpm_9,
+
+  nixosTests,
 }:
 
 let
@@ -70,6 +72,9 @@ buildGo123Module {
 
   passthru = {
     inherit frontend;
+    tests = {
+      inherit (nixosTests) filebrowser;
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/fi/finalfrontier/package.nix b/pkgs/by-name/fi/finalfrontier/package.nix
index ab17053cf6e2..646a1d413271 100644
--- a/pkgs/by-name/fi/finalfrontier/package.nix
+++ b/pkgs/by-name/fi/finalfrontier/package.nix
@@ -9,13 +9,13 @@
   openssl,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "finalfrontier";
   version = "unstable-2022-01-06";
 
   src = fetchFromGitHub {
     owner = "finalfusion";
-    repo = pname;
+    repo = "finalfrontier";
     rev = "2461fb1dde13b73039926aa66606e470907a1b59";
     sha256 = "sha256-bnRzXIYairlBjv2JxU16UXYc5BB3VeKZNiJ4+XDzub4=";
   };
diff --git a/pkgs/by-name/fi/finalfusion-utils/package.nix b/pkgs/by-name/fi/finalfusion-utils/package.nix
index 82c0c8fa015f..06a8f081161e 100644
--- a/pkgs/by-name/fi/finalfusion-utils/package.nix
+++ b/pkgs/by-name/fi/finalfusion-utils/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "finalfusion";
-    repo = pname;
+    repo = "finalfusion-utils";
     rev = version;
     sha256 = "sha256-suzivynlgk4VvDOC2dQR40n5IJHoJ736+ObdrM9dIqE=";
   };
diff --git a/pkgs/by-name/fi/finamp/package.nix b/pkgs/by-name/fi/finamp/package.nix
index c0c2c69ddd9a..88faddb00d3a 100644
--- a/pkgs/by-name/fi/finamp/package.nix
+++ b/pkgs/by-name/fi/finamp/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  flutter,
+  flutter329,
   mpv-unwrapped,
   patchelf,
   fetchFromGitHub,
@@ -11,7 +11,7 @@
 let
   version = "0.9.16-beta";
 in
-flutter.buildFlutterApplication {
+flutter329.buildFlutterApplication {
   inherit version;
   pname = "finamp";
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/fi/firectl/package.nix b/pkgs/by-name/fi/firectl/package.nix
index ec6e30949ae9..c7d603f6a393 100644
--- a/pkgs/by-name/fi/firectl/package.nix
+++ b/pkgs/by-name/fi/firectl/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "firecracker-microvm";
-    repo = pname;
+    repo = "firectl";
     rev = "v${version}";
     hash = "sha256-3MNNgFRq4goWdHFyqWNMAl2K0eKfd03BF05i82FIzNE=";
   };
diff --git a/pkgs/by-name/fi/firmware-updater/package.nix b/pkgs/by-name/fi/firmware-updater/package.nix
index ec75a2e8eb65..b88ad94a9c21 100644
--- a/pkgs/by-name/fi/firmware-updater/package.nix
+++ b/pkgs/by-name/fi/firmware-updater/package.nix
@@ -1,11 +1,11 @@
 {
   lib,
   writeText,
-  flutter,
+  flutter329,
   fetchFromGitHub,
 }:
 
-flutter.buildFlutterApplication rec {
+flutter329.buildFlutterApplication rec {
   pname = "firmware-updater";
   version = "0-unstable-2024-20-11";
 
diff --git a/pkgs/by-name/fl/flashspace/package.nix b/pkgs/by-name/fl/flashspace/package.nix
index 518eeeb1d39a..66418c005820 100644
--- a/pkgs/by-name/fl/flashspace/package.nix
+++ b/pkgs/by-name/fl/flashspace/package.nix
@@ -1,13 +1,12 @@
 {
   fetchzip,
-  gitUpdater,
   lib,
   stdenv,
   nix-update-script,
 }:
 
 let
-  version = "2.3.29";
+  version = "3.3.39";
 in
 stdenv.mkDerivation {
   pname = "flashspace";
@@ -16,7 +15,7 @@ stdenv.mkDerivation {
 
   src = fetchzip {
     url = "https://github.com/wojciech-kulik/FlashSpace/releases/download/v${version}/FlashSpace.app.zip";
-    hash = "sha256-aBqlxIPPhx5GwNowf172Ko10g8RXnN7nIJaD3Zh4TPg=";
+    hash = "sha256-/mgdeRxaxq+oIjbbaxCSExHxyYqqWl80+6jPzPIhT4M=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/fl/fluent-icon-theme/package.nix b/pkgs/by-name/fl/fluent-icon-theme/package.nix
index 132d87e848fb..0e1b0ee2e368 100644
--- a/pkgs/by-name/fl/fluent-icon-theme/package.nix
+++ b/pkgs/by-name/fl/fluent-icon-theme/package.nix
@@ -34,7 +34,7 @@ lib.checkListOfEnum "${pname}: available color variants"
 
     src = fetchFromGitHub {
       owner = "vinceliuice";
-      repo = pname;
+      repo = "Fluent-icon-theme";
       tag = version;
       hash = "sha256-nL9hk+H2ees2grBvVULvJs54FlFTXrA7o1STbDDJGhQ=";
     };
diff --git a/pkgs/by-name/fn/fnm/package.nix b/pkgs/by-name/fn/fnm/package.nix
index 43905399e693..6a9ba6f1218c 100644
--- a/pkgs/by-name/fn/fnm/package.nix
+++ b/pkgs/by-name/fn/fnm/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "Schniz";
-    repo = pname;
+    repo = "fnm";
     rev = "v${version}";
     sha256 = "sha256-WW+jWaClDn78Fw/xj6WvnEUlBI99HA5hQFUpwsYKmbI=";
   };
diff --git a/pkgs/by-name/fp/fprettify/package.nix b/pkgs/by-name/fp/fprettify/package.nix
index 5443dcf9647f..fe9925299d02 100644
--- a/pkgs/by-name/fp/fprettify/package.nix
+++ b/pkgs/by-name/fp/fprettify/package.nix
@@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "pseewald";
-    repo = pname;
+    repo = "fprettify";
     rev = "v${version}";
     sha256 = "17v52rylmsy3m3j5fcb972flazykz2rvczqfh8mxvikvd6454zyj";
   };
diff --git a/pkgs/by-name/fr/frece/package.nix b/pkgs/by-name/fr/frece/package.nix
index 806c1496418b..b334109427e8 100644
--- a/pkgs/by-name/fr/frece/package.nix
+++ b/pkgs/by-name/fr/frece/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "YodaEmbedding";
-    repo = pname;
+    repo = "frece";
     rev = "v${version}";
     sha256 = "sha256-CAiIqT5KuzrqbV9FVK3nZUe8MDs2KDdsKplJMI7rN9w=";
   };
diff --git a/pkgs/by-name/fr/freeswitch/package.nix b/pkgs/by-name/fr/freeswitch/package.nix
index 3cfa51885b9b..c3c801c2c3ef 100644
--- a/pkgs/by-name/fr/freeswitch/package.nix
+++ b/pkgs/by-name/fr/freeswitch/package.nix
@@ -112,7 +112,7 @@ stdenv.mkDerivation rec {
   version = "1.10.12";
   src = fetchFromGitHub {
     owner = "signalwire";
-    repo = pname;
+    repo = "freeswitch";
     rev = "v${version}";
     hash = "sha256-uOO+TpKjJkdjEp4nHzxcHtZOXqXzpkIF3dno1AX17d8=";
   };
diff --git a/pkgs/by-name/fr/freshfetch/package.nix b/pkgs/by-name/fr/freshfetch/package.nix
index 850dc742e840..3c4cbaed11f4 100644
--- a/pkgs/by-name/fr/freshfetch/package.nix
+++ b/pkgs/by-name/fr/freshfetch/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "k4rakara";
-    repo = pname;
+    repo = "freshfetch";
     rev = "v${version}";
     sha256 = "1l9zngr5l12g71j85iyph4jjri3crxc2pi9q0gczrrzvs03439mn";
   };
diff --git a/pkgs/by-name/fr/frp/package.nix b/pkgs/by-name/fr/frp/package.nix
index 748ccb298547..f94ac22badf8 100644
--- a/pkgs/by-name/fr/frp/package.nix
+++ b/pkgs/by-name/fr/frp/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "fatedier";
-    repo = pname;
+    repo = "frp";
     rev = "v${version}";
     hash = "sha256-es8xngdSLLQ3/S0xdFGW7Pa4BJISo51oWPl1GE+7tBo=";
   };
diff --git a/pkgs/by-name/fr/frugal/package.nix b/pkgs/by-name/fr/frugal/package.nix
index 2380581c5e7a..0d1107fe3f98 100644
--- a/pkgs/by-name/fr/frugal/package.nix
+++ b/pkgs/by-name/fr/frugal/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "Workiva";
-    repo = pname;
+    repo = "frugal";
     rev = "v${version}";
     sha256 = "sha256-giPlv3pf0hz2zlQ/9o12SGfwFLCtpN96tfQwP9AaPNo=";
   };
diff --git a/pkgs/by-name/fu/fujprog/package.nix b/pkgs/by-name/fu/fujprog/package.nix
index 224b671f9ff6..6366042848a3 100644
--- a/pkgs/by-name/fu/fujprog/package.nix
+++ b/pkgs/by-name/fu/fujprog/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "kost";
-    repo = pname;
+    repo = "fujprog";
     rev = "v${version}";
     sha256 = "08kzkzd5a1wfd1aycywdynxh3qy6n7z9i8lihkahmb4xac3chmz5";
   };
diff --git a/pkgs/by-name/fu/fulcio/package.nix b/pkgs/by-name/fu/fulcio/package.nix
index 672679e569d4..2cb09b1c94ef 100644
--- a/pkgs/by-name/fu/fulcio/package.nix
+++ b/pkgs/by-name/fu/fulcio/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "sigstore";
-    repo = pname;
+    repo = "fulcio";
     rev = "v${version}";
     hash = "sha256-UVUVT4RvNHvzIwV6azu2h1O9lnNu0PQnnkj4wbrY8BA=";
     # populate values that require us to use git. By doing this in postFetch we
diff --git a/pkgs/by-name/fw/fw/package.nix b/pkgs/by-name/fw/fw/package.nix
index 1c362653909f..e178d77dbc3e 100644
--- a/pkgs/by-name/fw/fw/package.nix
+++ b/pkgs/by-name/fw/fw/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fw";
-  version = "2.20.0";
+  version = "2.21.0";
 
   src = fetchFromGitHub {
     owner = "brocode";
     repo = "fw";
     rev = "v${version}";
-    hash = "sha256-bq8N49qArdF0EFIGiK4lCsC0CZxwmeo0R8OiehrifTg=";
+    hash = "sha256-tqtiAw4+bnCJMF37SluAE9NM55MAjBGkJTvGLcmYFnA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-sU7PfD77Sqi1Vrq2DgkkBF1bzL8d+/csa60CtQ7itSQ=";
+  cargoHash = "sha256-B32GegI3rvame0Ds+8+oBVUbcNhr2kwm3oVVxng8BZY=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/fw/fwanalyzer/package.nix b/pkgs/by-name/fw/fwanalyzer/package.nix
index 667c558f9693..cb15acaf6b3f 100644
--- a/pkgs/by-name/fw/fwanalyzer/package.nix
+++ b/pkgs/by-name/fw/fwanalyzer/package.nix
@@ -13,14 +13,14 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "cruise-automation";
-    repo = pname;
+    repo = "fwanalyzer";
     rev = version;
     sha256 = "sha256-fcqtyfpxdjD+1GsYl05RSJaFDoLSYQDdWcQV6a+vNGA=";
   };
 
   vendorHash = "sha256-nLr12VQogr4nV9E/DJu2XTcgEi7GsOdOn/ZqVk7HS7I=";
 
-  subPackages = [ "cmd/${pname}" ];
+  subPackages = [ "cmd/fwanalyzer" ];
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/fx/fx/package.nix b/pkgs/by-name/fx/fx/package.nix
index 562ea3bd6b89..c02673b3ad81 100644
--- a/pkgs/by-name/fx/fx/package.nix
+++ b/pkgs/by-name/fx/fx/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "antonmedv";
-    repo = pname;
+    repo = "fx";
     rev = version;
     hash = "sha256-wUiyMczToGqfHZ/FMUhCO4ud6h/bNHhVt4eWoZJckbU=";
   };
diff --git a/pkgs/by-name/fy/fypp/package.nix b/pkgs/by-name/fy/fypp/package.nix
index 391b1f4db6ea..c4716e15bdb5 100644
--- a/pkgs/by-name/fy/fypp/package.nix
+++ b/pkgs/by-name/fy/fypp/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "aradi";
-    repo = pname;
+    repo = "fypp";
     rev = version;
     hash = "sha256-MgGVlOqOIrIVoDfBMVpFLT26mhYndxans2hfo/+jdoA=";
   };
diff --git a/pkgs/by-name/ga/gallery-dl/package.nix b/pkgs/by-name/ga/gallery-dl/package.nix
index a1d16594344b..acc5f57b012f 100644
--- a/pkgs/by-name/ga/gallery-dl/package.nix
+++ b/pkgs/by-name/ga/gallery-dl/package.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "gallery-dl";
-  version = "1.29.6";
+  version = "1.29.7";
 in
 python3Packages.buildPythonApplication {
   inherit pname version;
@@ -18,7 +18,7 @@ python3Packages.buildPythonApplication {
     owner = "mikf";
     repo = "gallery-dl";
     tag = "v${version}";
-    hash = "sha256-D/HPAnIwCAfwzBrteGkZSMHFvXDPQLF4bHKDwppdkzc=";
+    hash = "sha256-OngtJ6E7Gvr+/5Vjv1vepPVVksNDRlXZkU9yMYRvh2k=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/ga/gamescope/package.nix b/pkgs/by-name/ga/gamescope/package.nix
index 57a6c6ccc575..26c47796dcdc 100644
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@@ -49,14 +49,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gamescope";
-  version = "3.16.9";
+  version = "3.16.10";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "gamescope";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-Dw9EErOINGoOlnNqroKR+fbRfMGL7Q13gP3E5iw4RhU=";
+    hash = "sha256-MZhIsnSp2uGMQds5zEhF8WZgGNHDGH+3A2TGjB6Vn10=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ga/garnet/package.nix b/pkgs/by-name/ga/garnet/package.nix
index 7e480abafd46..48ff8f1b767d 100644
--- a/pkgs/by-name/ga/garnet/package.nix
+++ b/pkgs/by-name/ga/garnet/package.nix
@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "garnet";
-  version = "1.0.64";
+  version = "1.0.65";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "garnet";
     tag = "v${version}";
-    hash = "sha256-0poitBKuCfUtkGWXomQAictt7ts7Qdgq1TvEMSqvdJ4=";
+    hash = "sha256-Gebd0dj5VbUiYPTmOlkDQEiIDjflV02GLHCEIjh4S04=";
   };
 
   projectFile = "main/GarnetServer/GarnetServer.csproj";
diff --git a/pkgs/by-name/ga/gat/package.nix b/pkgs/by-name/ga/gat/package.nix
index c1796663160b..4375315e49b7 100644
--- a/pkgs/by-name/ga/gat/package.nix
+++ b/pkgs/by-name/ga/gat/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "gat";
-  version = "0.23.2";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "koki-develop";
     repo = "gat";
     tag = "v${version}";
-    hash = "sha256-vJREExCJ+JvPYxNeJWQ6A4LRB2viEisnXrRM6yDGOc4=";
+    hash = "sha256-2AIRFG4YmEr1ZQ6JjhmRmOc5/BfTbeBd4azy1xQQr3Q=";
   };
 
-  vendorHash = "sha256-yGTzDlu9l1Vfnt9Za4Axh7nFWe5CmW2kqssa+51bA3w=";
+  vendorHash = "sha256-9LHTyIL0+aJAUJsn3m1SUrZYM9JLo70JY0zb1oVFJFo=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/gc/gci/package.nix b/pkgs/by-name/gc/gci/package.nix
index a4a587971c0e..82f49fb6a934 100644
--- a/pkgs/by-name/gc/gci/package.nix
+++ b/pkgs/by-name/gc/gci/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "daixiang0";
-    repo = pname;
+    repo = "gci";
     rev = "v${version}";
     sha256 = "sha256-BlR7lQnp9WMjSN5IJOK2HIKXIAkn5Pemf8qbMm83+/w=";
   };
diff --git a/pkgs/by-name/gd/gdm/package.nix b/pkgs/by-name/gd/gdm/package.nix
index 99967c83fd4d..e8ec15980c3e 100644
--- a/pkgs/by-name/gd/gdm/package.nix
+++ b/pkgs/by-name/gd/gdm/package.nix
@@ -115,7 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
     })
 
     # The following patches implement certain environment variables in GDM which are set by
-    # the gdm configuration module (nixos/modules/services/x11/display-managers/gdm.nix).
+    # the gdm configuration module (gdm.nix).
 
     ./gdm-x-session_extra_args.patch
 
diff --git a/pkgs/by-name/ge/gemget/package.nix b/pkgs/by-name/ge/gemget/package.nix
index 96326b5fdbb1..e5d465709cb2 100644
--- a/pkgs/by-name/ge/gemget/package.nix
+++ b/pkgs/by-name/ge/gemget/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "makeworld-the-better-one";
-    repo = pname;
+    repo = "gemget";
     rev = "v${version}";
     sha256 = "sha256-P5+yRaf2HioKOclJMMm8bJ8/BtBbNEeYU57TceZVqQ8=";
   };
diff --git a/pkgs/by-name/ge/geminicommit/package.nix b/pkgs/by-name/ge/geminicommit/package.nix
index eb7cb257a58b..ff58bebd43bd 100644
--- a/pkgs/by-name/ge/geminicommit/package.nix
+++ b/pkgs/by-name/ge/geminicommit/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "geminicommit";
-  version = "0.3.1";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "tfkhdyt";
     repo = "geminicommit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G28vwH9i4eqr4vxidRYLgdFL6y5VztpvrI2UK+6aS8M=";
+    hash = "sha256-hJevJkniyICUUr1UyS0A5SKuuYRU0dGHMWzF99Yr2Eo=";
   };
 
-  vendorHash = "sha256-+eKJLXgKuUHelUjD8MpMa+cRP+clmYK+1olcb/jmabk=";
+  vendorHash = "sha256-IfqlPg+HPcOfjlwwuLi2/R21UD83xQzWyUmzM7JSDEs=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ge/gensio/package.nix b/pkgs/by-name/ge/gensio/package.nix
index 587fe5eb0ac0..041f626cd805 100644
--- a/pkgs/by-name/ge/gensio/package.nix
+++ b/pkgs/by-name/ge/gensio/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "cminyard";
-    repo = pname;
+    repo = "gensio";
     rev = "v${version}";
     sha256 = "sha256-EDa95r8x5yIXibJigJXR3PCYTTvJlqB6XBN1RZHq6KM=";
   };
diff --git a/pkgs/by-name/ge/genxword/package.nix b/pkgs/by-name/ge/genxword/package.nix
index a71628c42146..c1b318889322 100644
--- a/pkgs/by-name/ge/genxword/package.nix
+++ b/pkgs/by-name/ge/genxword/package.nix
@@ -15,7 +15,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "riverrun";
-    repo = pname;
+    repo = "genxword";
     rev = "v${version}";
     sha256 = "17h8saja45bv612yk0pra9ncbp2mjnx5n10q25nqhl765ks4bmb5";
   };
diff --git a/pkgs/by-name/gf/gfold/package.nix b/pkgs/by-name/gf/gfold/package.nix
index 9bd3a11726e9..bf956fbca144 100644
--- a/pkgs/by-name/gf/gfold/package.nix
+++ b/pkgs/by-name/gf/gfold/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage {
 
   src = fetchFromGitHub {
     owner = "nickgerace";
-    repo = pname;
+    repo = "gfold";
     rev = version;
     hash = "sha256-7PnqhS80Ozh5ZQNQ8iYgCiFT0JDLzhA09NV1HgrCOww=";
   };
diff --git a/pkgs/by-name/gf/gftp/package.nix b/pkgs/by-name/gf/gftp/package.nix
index 4d7db1e79dc8..d90a8b663bbf 100644
--- a/pkgs/by-name/gf/gftp/package.nix
+++ b/pkgs/by-name/gf/gftp/package.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "masneyb";
-    repo = pname;
+    repo = "gftp";
     rev = version;
     hash = "sha256-0zdv2oYl24BXh61IGCWby/2CCkzNjLpDrAFc0J89Pw4=";
   };
diff --git a/pkgs/by-name/gh/gh-gei/package.nix b/pkgs/by-name/gh/gh-gei/package.nix
index 68f9040a6036..73f360632092 100644
--- a/pkgs/by-name/gh/gh-gei/package.nix
+++ b/pkgs/by-name/gh/gh-gei/package.nix
@@ -7,13 +7,13 @@
 
 buildDotnetModule rec {
   pname = "gh-gei";
-  version = "1.15.0";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "gh-gei";
     rev = "v${version}";
-    hash = "sha256-33Npwf4C6IFrrsIRq4+udphfovaCXQ8JfN0yzfxIRq0=";
+    hash = "sha256-Iuhz/kaamgMWNxilNvCRnjdTFrhSPhHpFKYllQ8OuGU=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0_4xx;
diff --git a/pkgs/by-name/gi/giara/package.nix b/pkgs/by-name/gi/giara/package.nix
index 5f826a8c2802..b62952bbb134 100644
--- a/pkgs/by-name/gi/giara/package.nix
+++ b/pkgs/by-name/gi/giara/package.nix
@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
-    repo = pname;
+    repo = "giara";
     rev = version;
     hash = "sha256-FTy0ElcoTGXG9eV85pUrF35qKDKOfYIovPtjLfTJVOg=";
   };
diff --git a/pkgs/by-name/gi/git-credential-oauth/package.nix b/pkgs/by-name/gi/git-credential-oauth/package.nix
index b2ebb484bbc3..5dce5e3a02c1 100644
--- a/pkgs/by-name/gi/git-credential-oauth/package.nix
+++ b/pkgs/by-name/gi/git-credential-oauth/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "hickford";
-    repo = pname;
+    repo = "git-credential-oauth";
     rev = "v${version}";
     hash = "sha256-9AoIyQ05Y/usG0Tlehn7U8zjBxC1BYNjNVRtgWgzLbo=";
   };
diff --git a/pkgs/by-name/gi/git-delete-merged-branches/package.nix b/pkgs/by-name/gi/git-delete-merged-branches/package.nix
index 8d74fed20f15..59146cdaf86c 100644
--- a/pkgs/by-name/gi/git-delete-merged-branches/package.nix
+++ b/pkgs/by-name/gi/git-delete-merged-branches/package.nix
@@ -12,7 +12,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "hartwork";
-    repo = pname;
+    repo = "git-delete-merged-branches";
     tag = version;
     sha256 = "sha256-2MSdUpToOiurtiL0Ws2dLEWqd6wj4nQ2RsEepBytgAk=";
   };
diff --git a/pkgs/by-name/gi/git-get/package.nix b/pkgs/by-name/gi/git-get/package.nix
index ccdfbf5e67f2..e8d52c5bf985 100644
--- a/pkgs/by-name/gi/git-get/package.nix
+++ b/pkgs/by-name/gi/git-get/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "grdl";
-    repo = pname;
+    repo = "git-get";
     rev = "v${version}";
     hash = "sha256-v98Ff7io7j1LLzciHNWJBU3LcdSr+lhwYrvON7QjyCI=";
     # populate values that require us to use git. By doing this in postFetch we
diff --git a/pkgs/by-name/gi/git-gr/package.nix b/pkgs/by-name/gi/git-gr/package.nix
index 2996a06c9853..025572e8e2d6 100644
--- a/pkgs/by-name/gi/git-gr/package.nix
+++ b/pkgs/by-name/gi/git-gr/package.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage {
 
   src = fetchFromGitHub {
     owner = "9999years";
-    repo = pname;
+    repo = "git-gr";
     tag = "v${version}";
     hash = "sha256-t308Ep27iRvRHSdvVMOrRGVoajBtnTutHAkKbZkO7Wg=";
   };
diff --git a/pkgs/by-name/gi/git-hound/package.nix b/pkgs/by-name/gi/git-hound/package.nix
index 67431b03b747..e67bc0ba9d76 100644
--- a/pkgs/by-name/gi/git-hound/package.nix
+++ b/pkgs/by-name/gi/git-hound/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "tillson";
-    repo = pname;
+    repo = "git-hound";
     rev = "v${version}";
     hash = "sha256-W+rYDyRIw4jWWO4UZkUHFq/D/7ZXM+y5vdbclk6S0ro=";
   };
diff --git a/pkgs/by-name/gi/git-igitt/package.nix b/pkgs/by-name/gi/git-igitt/package.nix
index 843b1bc8e51c..829067a28545 100644
--- a/pkgs/by-name/gi/git-igitt/package.nix
+++ b/pkgs/by-name/gi/git-igitt/package.nix
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage {
 
   src = fetchFromGitHub {
     owner = "mlange-42";
-    repo = pname;
+    repo = "git-igitt";
     rev = version;
     hash = "sha256-JXEWnekL9Mtw0S3rI5aeO1HB9kJ7bRJDJ6EJ4ATlFeQ=";
   };
diff --git a/pkgs/by-name/gi/git-privacy/package.nix b/pkgs/by-name/gi/git-privacy/package.nix
index e058e8d5ced3..b898beded66e 100644
--- a/pkgs/by-name/gi/git-privacy/package.nix
+++ b/pkgs/by-name/gi/git-privacy/package.nix
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "EMPRI-DEVOPS";
-    repo = pname;
+    repo = "git-privacy";
     rev = "v${version}";
     hash = "sha256-b2RkRL8/mZwqc3xCs+oltzualhQtp/7F9POlLlT3UUU=";
   };
diff --git a/pkgs/by-name/gi/git-quickfix/package.nix b/pkgs/by-name/gi/git-quickfix/package.nix
index 3649ffb7d400..def39e31894d 100644
--- a/pkgs/by-name/gi/git-quickfix/package.nix
+++ b/pkgs/by-name/gi/git-quickfix/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "siedentop";
-    repo = pname;
+    repo = "git-quickfix";
     rev = "v${version}";
     sha256 = "sha256-IAjet/bDG/Hf/whS+yrEQSquj8s5DEmFis+5ysLLuxs=";
   };
diff --git a/pkgs/by-name/gi/git-relevant-history/package.nix b/pkgs/by-name/gi/git-relevant-history/package.nix
index 98dd80e3aa09..4b3ed1a3e403 100644
--- a/pkgs/by-name/gi/git-relevant-history/package.nix
+++ b/pkgs/by-name/gi/git-relevant-history/package.nix
@@ -6,12 +6,12 @@
   git-filter-repo,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication {
   pname = "git-relevant-history";
   version = "2022-09-15";
   src = fetchFromGitHub {
     owner = "rainlabs-eu";
-    repo = pname;
+    repo = "git-relevant-history";
     rev = "84552324d7cb4790db86282fc61bf98a05b7a4fd";
     hash = "sha256-46a6TR1Hi3Lg2DTmOp1aV5Uhd4IukTojZkA3TVbTnRY=";
   };
diff --git a/pkgs/by-name/gi/git-sizer/package.nix b/pkgs/by-name/gi/git-sizer/package.nix
index df6e00c22da5..bd9e2d0cd554 100644
--- a/pkgs/by-name/gi/git-sizer/package.nix
+++ b/pkgs/by-name/gi/git-sizer/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "github";
-    repo = pname;
+    repo = "git-sizer";
     rev = "v${version}";
     sha256 = "sha256-On7QBTzKfnuuzwMQ8m1odxGqfIKL+EDg5V05Kxuhmqw=";
   };
diff --git a/pkgs/by-name/gi/git-subtrac/package.nix b/pkgs/by-name/gi/git-subtrac/package.nix
index 9a454cad5af6..015a601807ff 100644
--- a/pkgs/by-name/gi/git-subtrac/package.nix
+++ b/pkgs/by-name/gi/git-subtrac/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "apenwarr";
-    repo = pname;
+    repo = "git-subtrac";
     rev = "v${version}";
     hash = "sha256-3Z1AbPPsTBa3rqfvNAMBz7CIRq/zc9q5/TcLJWYSNlw=";
   };
diff --git a/pkgs/by-name/gi/git-trim/package.nix b/pkgs/by-name/gi/git-trim/package.nix
index 1c4019f3c5a3..d22dc8675138 100644
--- a/pkgs/by-name/gi/git-trim/package.nix
+++ b/pkgs/by-name/gi/git-trim/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "foriequal0";
-    repo = pname;
+    repo = "git-trim";
     rev = "v${version}";
     sha256 = "sha256-XAO3Qg5I2lYZVNx4+Z5jKHRIFdNwBJsUQwJXFb4CbvM=";
   };
diff --git a/pkgs/by-name/gi/git-upstream/package.nix b/pkgs/by-name/gi/git-upstream/package.nix
index ddadd1a61a3a..8a04fed2de4c 100644
--- a/pkgs/by-name/gi/git-upstream/package.nix
+++ b/pkgs/by-name/gi/git-upstream/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage {
 
   src = fetchFromGitHub {
     owner = "9999years";
-    repo = pname;
+    repo = "git-upstream";
     tag = "v${version}";
     hash = "sha256-rdxpo1OZD/fpBm76zD7U/YeZOBpliKXJN87LJkw6A28=";
   };
diff --git a/pkgs/by-name/gi/github-commenter/package.nix b/pkgs/by-name/gi/github-commenter/package.nix
index 1bf88c51cebd..00965cccad5b 100644
--- a/pkgs/by-name/gi/github-commenter/package.nix
+++ b/pkgs/by-name/gi/github-commenter/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "cloudposse";
-    repo = pname;
+    repo = "github-commenter";
     rev = version;
     hash = "sha256-x3/ae22ub9Us3mvSmvq9ohlkujvZCUfSrmZeQNvIWzE=";
   };
diff --git a/pkgs/by-name/gi/gitlab-ci-local/package.nix b/pkgs/by-name/gi/gitlab-ci-local/package.nix
index bfe81443feaa..6de5e0960772 100644
--- a/pkgs/by-name/gi/gitlab-ci-local/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-local/package.nix
@@ -12,16 +12,16 @@
 
 buildNpmPackage rec {
   pname = "gitlab-ci-local";
-  version = "4.59.0";
+  version = "4.60.1";
 
   src = fetchFromGitHub {
     owner = "firecow";
     repo = "gitlab-ci-local";
     rev = version;
-    hash = "sha256-4C+96rPtEFDJc08D5qXEuNvoDWJR5drvsvZ6mCGd5Vo=";
+    hash = "sha256-6v5iyQCP+3bJdG9uvPAsMaJ7mW2xj1kMhn8h2eLsl28=";
   };
 
-  npmDepsHash = "sha256-brzCPG/keYOGfjqnj8mP28OdSAKTbDQWBxN4oMLHoNU=";
+  npmDepsHash = "sha256-P09uxOtlY9AAJyKLTdnFOfw0H6V4trr2hznEonOO58E=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
diff --git a/pkgs/by-name/gi/gitless/package.nix b/pkgs/by-name/gi/gitless/package.nix
index 3a571c13da3f..a2dc1a72a35e 100644
--- a/pkgs/by-name/gi/gitless/package.nix
+++ b/pkgs/by-name/gi/gitless/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "goldstar611";
-    repo = pname;
+    repo = "gitless";
     rev = version;
     hash = "sha256-XDB1i2b1reMCM6i1uK3IzTnsoLXO7jldYtNlYUo1AoQ=";
   };
diff --git a/pkgs/by-name/gi/gitls/package.nix b/pkgs/by-name/gi/gitls/package.nix
index e03454b74a14..c66244ed4f00 100644
--- a/pkgs/by-name/gi/gitls/package.nix
+++ b/pkgs/by-name/gi/gitls/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "hahwul";
-    repo = pname;
+    repo = "gitls";
     rev = "v${version}";
     hash = "sha256-kLkH/nNidd1QNPKvo7fxZwMhTgd4AVB8Ofw0Wo0z6c0=";
   };
diff --git a/pkgs/by-name/gi/gitoxide/fix-cargo-dependencies.patch b/pkgs/by-name/gi/gitoxide/fix-cargo-dependencies.patch
deleted file mode 100644
index ea9f7f54a7d2..000000000000
--- a/pkgs/by-name/gi/gitoxide/fix-cargo-dependencies.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff -ur a/gix-packetline/Cargo.toml b/gix-packetline/Cargo.toml
---- a/gix-packetline/Cargo.toml
-+++ b/gix-packetline/Cargo.toml
-@@ -24,7 +24,7 @@
- ## If set, all IO will become blocking. The same types will be used preventing side-by-side usage of blocking and non-blocking IO.
- blocking-io = []
- ## Implement IO traits from `futures-io`.
--async-io = ["dep:futures-io", "dep:futures-lite", "dep:pin-project-lite"]
-+async-io = ["dep:futures-io", "futures-lite", "dep:pin-project-lite"]
- 
- #! ### Other
- ## Data structures implement `serde::Serialize` and `serde::Deserialize`.
-diff -ur a/gix-protocol/Cargo.toml b/gix-protocol/Cargo.toml
---- a/gix-protocol/Cargo.toml
-+++ b/gix-protocol/Cargo.toml
-@@ -34,7 +34,7 @@
-     "gix-transport/async-client",
-     "dep:async-trait",
-     "dep:futures-io",
--    "dep:futures-lite",
-+    "futures-lite",
-     "handshake",
-     "fetch"
- ]
diff --git a/pkgs/by-name/gi/gitoxide/package.nix b/pkgs/by-name/gi/gitoxide/package.nix
index 3a3c636ba646..39dbd6e46488 100644
--- a/pkgs/by-name/gi/gitoxide/package.nix
+++ b/pkgs/by-name/gi/gitoxide/package.nix
@@ -16,25 +16,19 @@ let
   gix = "${stdenv.hostPlatform.emulator buildPackages} $out/bin/gix";
   ein = "${stdenv.hostPlatform.emulator buildPackages} $out/bin/ein";
 in
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gitoxide";
-  version = "0.42.0";
+  version = "0.44.0";
 
   src = fetchFromGitHub {
     owner = "GitoxideLabs";
     repo = "gitoxide";
-    rev = "v${version}";
-    hash = "sha256-hrCWt4cCnlH3NKH5Uugf/rvVN+YpbeZgZ/lhnQGZ2I0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-TZK4H0PRxsjzDhW05bXD7GkP2JHrBb1tu/oid6GkAWs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-q35MQGN/tvsK7gg0a/ljoVY6wedy7rwKlSakONgBIgk=";
-
-  patches = [
-    # TODO: remove after next update
-    # https://github.com/GitoxideLabs/gitoxide/pull/1929
-    ./fix-cargo-dependencies.patch
-  ];
+  cargoHash = "sha256-5kd9drLnejphmJ6KQ1jSmerIt+rRB4/rFKxhuedkpRk=";
 
   nativeBuildInputs = [
     cmake
@@ -59,14 +53,14 @@ rustPlatform.buildRustPackage rec {
   # Needed to get openssl-sys to use pkg-config.
   env.OPENSSL_NO_VENDOR = 1;
 
-  meta = with lib; {
+  meta = {
     description = "Command-line application for interacting with git repositories";
     homepage = "https://github.com/GitoxideLabs/gitoxide";
-    changelog = "https://github.com/GitoxideLabs/gitoxide/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [
+    changelog = "https://github.com/GitoxideLabs/gitoxide/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = with lib.licenses; [
       mit # or
       asl20
     ];
-    maintainers = with maintainers; [ syberant ];
+    maintainers = with lib.maintainers; [ syberant ];
   };
-}
+})
diff --git a/pkgs/by-name/gi/gitsign/package.nix b/pkgs/by-name/gi/gitsign/package.nix
index beb12aba56f7..8b4a7f4e1e1d 100644
--- a/pkgs/by-name/gi/gitsign/package.nix
+++ b/pkgs/by-name/gi/gitsign/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "sigstore";
-    repo = pname;
+    repo = "gitsign";
     rev = "v${version}";
     hash = "sha256-sxkQOqlCgS/QFfRN5Rtdih2zjiGHY6H9Kjlw0Q74W2A=";
   };
diff --git a/pkgs/by-name/gi/gittuf/package.nix b/pkgs/by-name/gi/gittuf/package.nix
index fed362c70e3c..fc7da147bfb0 100644
--- a/pkgs/by-name/gi/gittuf/package.nix
+++ b/pkgs/by-name/gi/gittuf/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "gittuf";
-    repo = pname;
+    repo = "gittuf";
     rev = "v${version}";
     hash = "sha256-sHaQOqD8CzAb8LIOqPpvTAzdmm/NoktLnAOhVNdRIeo=";
   };
diff --git a/pkgs/by-name/gl/glab/package.nix b/pkgs/by-name/gl/glab/package.nix
index 6f6b9c8b0390..a831142537c2 100644
--- a/pkgs/by-name/gl/glab/package.nix
+++ b/pkgs/by-name/gl/glab/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "glab";
-  version = "1.56.0";
+  version = "1.57.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dFyVhl4+WdQeoSZSY8JbkjJBhqOX/oN2b9q1CGlLhpc=";
+    hash = "sha256-a5gV47DP8+WOaMVcEWlTcriobnj74JTYKVDqYzJgGRU=";
   };
 
-  vendorHash = "sha256-m4IWtK2PNjs2UxzVCT2oSx6Gic2flN4Fq8w0mNIhHxo=";
+  vendorHash = "sha256-9NKY8CACcR70EdHGRWicROoA4khXYZjLPNd8A+VkjuY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gl/glitchtip/frontend.nix b/pkgs/by-name/gl/glitchtip/frontend.nix
index 2f075b546bde..6b536f6b6425 100644
--- a/pkgs/by-name/gl/glitchtip/frontend.nix
+++ b/pkgs/by-name/gl/glitchtip/frontend.nix
@@ -9,18 +9,18 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "glitchtip-frontend";
-  version = "5.0.1";
+  version = "5.0.4";
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "glitchtip-frontend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mqwPCp7C5n2fOE8kgUnW3SYuuaY8ZkJtuhYXP4HevnM=";
+    hash = "sha256-2XZCIIWQAM2Nk8/JTs5MzUJJOvJS+wrsa2m/XiC9FHM=";
   };
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-Jzwarti+WwKecWn3fPcF9LV+mbU22rgiTP7mslyoqRk=";
+    hash = "sha256-iJFEeUaPP6ZnntoZ2X0TyR6f923zPuzzZNW/zkd8M7E=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/gl/glitchtip/package.nix b/pkgs/by-name/gl/glitchtip/package.nix
index b39900869faa..8de4566399f5 100644
--- a/pkgs/by-name/gl/glitchtip/package.nix
+++ b/pkgs/by-name/gl/glitchtip/package.nix
@@ -102,14 +102,14 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glitchtip";
-  version = "5.0.1";
+  version = "5.0.4";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "glitchtip-backend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vfsuJn6lpaesK40nqCdJMCDiaaqS1EdZdvgmy9jPuo8=";
+    hash = "sha256-ihefyunZc191w9cn7iSqblNA4V4hELi9jwxfFrjPvu0=";
   };
 
   propagatedBuildInputs = pythonPackages;
diff --git a/pkgs/by-name/gl/globalping-cli/package.nix b/pkgs/by-name/gl/globalping-cli/package.nix
index 255ee632f171..367f3d85ceed 100644
--- a/pkgs/by-name/gl/globalping-cli/package.nix
+++ b/pkgs/by-name/gl/globalping-cli/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jsdelivr";
-    repo = pname;
+    repo = "globalping-cli";
     rev = "v${version}";
     hash = "sha256-UB2vYdyJ2+H8rFyJn1KBNnWoGUlRjwYorWXqoB9WDu0=";
   };
diff --git a/pkgs/by-name/gl/glpi-agent/package.nix b/pkgs/by-name/gl/glpi-agent/package.nix
index 2e9ffec1a146..d886bfdf9c38 100644
--- a/pkgs/by-name/gl/glpi-agent/package.nix
+++ b/pkgs/by-name/gl/glpi-agent/package.nix
@@ -15,13 +15,13 @@
 
 perlPackages.buildPerlPackage rec {
   pname = "glpi-agent";
-  version = "1.11";
+  version = "1.14";
 
   src = fetchFromGitHub {
     owner = "glpi-project";
     repo = "glpi-agent";
     tag = version;
-    hash = "sha256-WdQ+/ZnMCRqLZK64oJNoR9dtMPq+CghsA8NUwt3EpjA=";
+    hash = "sha256-6q+JcTFZlZjtMaQKUvCwE9Sjw9662ZXl78kha0tEFv4=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/gl/gluesql/package.nix b/pkgs/by-name/gl/gluesql/package.nix
index b619ebd527ae..c6bd7d8cb2bf 100644
--- a/pkgs/by-name/gl/gluesql/package.nix
+++ b/pkgs/by-name/gl/gluesql/package.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage {
 
   src = fetchFromGitHub {
     owner = "gluesql";
-    repo = pname;
+    repo = "gluesql";
     rev = "v${version}";
     hash = "sha256-z2fpyPJfyPtO13Ly7XRmMW3rp6G3jNLsMMFz83Wmr0E=";
   };
diff --git a/pkgs/by-name/gm/gmnitohtml/package.nix b/pkgs/by-name/gm/gmnitohtml/package.nix
index a57c108bd9f8..70efb122a33c 100644
--- a/pkgs/by-name/gm/gmnitohtml/package.nix
+++ b/pkgs/by-name/gm/gmnitohtml/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromSourcehut {
     owner = "~adnano";
-    repo = pname;
+    repo = "gmnitohtml";
     rev = version;
     hash = "sha256-9lsZgh/OyxAu1rsixD6XUgQzR1xDGOxGt0sR12zrs2M=";
   };
diff --git a/pkgs/by-name/gn/gnome-pomodoro/package.nix b/pkgs/by-name/gn/gnome-pomodoro/package.nix
index 738aff462e90..2c9eeef32709 100644
--- a/pkgs/by-name/gn/gnome-pomodoro/package.nix
+++ b/pkgs/by-name/gn/gnome-pomodoro/package.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
   version = "0.27.0";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "gnome-pomodoro";
+    repo = "gnome-pomodoro";
     rev = version;
     hash = "sha256-ZdTMaCzjA7tsXmnlHGl8MFGGViVPwMZuiu91q5v/v9U=";
   };
diff --git a/pkgs/by-name/gn/gnostic/package.nix b/pkgs/by-name/gn/gnostic/package.nix
index 44ea7bf06a62..5296fbb0e107 100644
--- a/pkgs/by-name/gn/gnostic/package.nix
+++ b/pkgs/by-name/gn/gnostic/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "google";
-    repo = pname;
+    repo = "gnostic";
     rev = "v${version}";
     hash = "sha256-Wpe+rK4XMfMZYhR1xTEr0nsEjRGkSDA7aiLeBbGcRpA=";
   };
diff --git a/pkgs/by-name/go/go-audit/package.nix b/pkgs/by-name/go/go-audit/package.nix
index f562f8fb8c51..7a0975a77d74 100644
--- a/pkgs/by-name/go/go-audit/package.nix
+++ b/pkgs/by-name/go/go-audit/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "slackhq";
-    repo = pname;
+    repo = "go-audit";
     rev = "v${version}";
     sha256 = "sha256-Li/bMgl/wj9bHpXW5gwWvb7BvyBPzeLCP979J2kyRCM=";
   };
diff --git a/pkgs/by-name/go/go-autoconfig/package.nix b/pkgs/by-name/go/go-autoconfig/package.nix
index b5af6a7f3f89..5a56f8cbe994 100644
--- a/pkgs/by-name/go/go-autoconfig/package.nix
+++ b/pkgs/by-name/go/go-autoconfig/package.nix
@@ -4,13 +4,13 @@
   lib,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "go-autoconfig";
   version = "unstable-2022-08-03";
 
   src = fetchFromGitHub {
     owner = "L11R";
-    repo = pname;
+    repo = "go-autoconfig";
     rev = "b1b182202da82cc881dccd715564853395d4f76a";
     sha256 = "sha256-Rbg6Ghp5NdcLSLSIhwwFFMKmZPWsboDyHCG6ePqSSZA=";
   };
diff --git a/pkgs/by-name/go/go-bindata/package.nix b/pkgs/by-name/go/go-bindata/package.nix
index d3f48c5bdd34..49aee51386ae 100644
--- a/pkgs/by-name/go/go-bindata/package.nix
+++ b/pkgs/by-name/go/go-bindata/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "kevinburke";
-    repo = pname;
+    repo = "go-bindata";
     rev = "v${version}";
     hash = "sha256-3/1RqJrv1fsPKsZpurp2dHsMg8FJBcFlI/pwwCf5H6E=";
   };
diff --git a/pkgs/by-name/go/go-camo/package.nix b/pkgs/by-name/go/go-camo/package.nix
index 80939ef6e3dd..542ac4689de1 100644
--- a/pkgs/by-name/go/go-camo/package.nix
+++ b/pkgs/by-name/go/go-camo/package.nix
@@ -12,7 +12,7 @@ buildGo124Module rec {
 
   src = fetchFromGitHub {
     owner = "cactus";
-    repo = pname;
+    repo = "go-camo";
     rev = "v${version}";
     hash = "sha256-uf/r+QDukuFbbsFQal0mfZaGHZYk1fGn8Kt1ipFD/vI=";
   };
diff --git a/pkgs/by-name/go/go-containerregistry/package.nix b/pkgs/by-name/go/go-containerregistry/package.nix
index bd307c577a14..26b93b403b7b 100644
--- a/pkgs/by-name/go/go-containerregistry/package.nix
+++ b/pkgs/by-name/go/go-containerregistry/package.nix
@@ -18,7 +18,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "google";
-    repo = pname;
+    repo = "go-containerregistry";
     rev = "v${version}";
     sha256 = "sha256-HiksVzVuY4uub7Lwfyh3GN8wpH2MgIjKSO4mQJZeNvs=";
   };
diff --git a/pkgs/by-name/go/go-cqhttp/package.nix b/pkgs/by-name/go/go-cqhttp/package.nix
index 5fb59710c74e..26581a209149 100644
--- a/pkgs/by-name/go/go-cqhttp/package.nix
+++ b/pkgs/by-name/go/go-cqhttp/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "Mrs4s";
-    repo = pname;
+    repo = "go-cqhttp";
     rev = "v${version}";
     hash = "sha256-mKenmsGdVg60zjVMTfbEtqtPcJdJo60Nz6IUQ9RB7j0=";
   };
diff --git a/pkgs/by-name/go/go-cve-search/package.nix b/pkgs/by-name/go/go-cve-search/package.nix
index 64d78a9cadd6..a39abcfd17cb 100644
--- a/pkgs/by-name/go/go-cve-search/package.nix
+++ b/pkgs/by-name/go/go-cve-search/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "s-index";
-    repo = pname;
+    repo = "go-cve-search";
     tag = "v${version}";
     hash = "sha256-ofa6lfA3XKj70YM6AVNKRgGI53teK7OB09luAom8HpQ=";
   };
diff --git a/pkgs/by-name/go/go-dork/package.nix b/pkgs/by-name/go/go-dork/package.nix
index a1d6c959ad6a..88c68b8bff3a 100644
--- a/pkgs/by-name/go/go-dork/package.nix
+++ b/pkgs/by-name/go/go-dork/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "dwisiswant0";
-    repo = pname;
+    repo = "go-dork";
     tag = "v${version}";
     hash = "sha256-Q7ECwXH9q6qWba2URh3LjMx8g6vPF1DWfKnmXej7ht4=";
   };
diff --git a/pkgs/by-name/go/go-ethereum/package.nix b/pkgs/by-name/go/go-ethereum/package.nix
index 2855518d0b35..bae99977f408 100644
--- a/pkgs/by-name/go/go-ethereum/package.nix
+++ b/pkgs/by-name/go/go-ethereum/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ethereum";
-    repo = pname;
+    repo = "go-ethereum";
     rev = "v${version}";
     hash = "sha256-2XGKkimwe9h8RxO3SzUta5Bh2Ooldl2LiHqUpn8FK7I=";
   };
diff --git a/pkgs/by-name/go/go-jsonnet/package.nix b/pkgs/by-name/go/go-jsonnet/package.nix
index 418e7609d951..f88fb1f1dcc4 100644
--- a/pkgs/by-name/go/go-jsonnet/package.nix
+++ b/pkgs/by-name/go/go-jsonnet/package.nix
@@ -3,17 +3,16 @@
   buildGoModule,
   fetchFromGitHub,
   testers,
-  go-jsonnet,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "go-jsonnet";
   version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "google";
-    repo = pname;
-    rev = "v${version}";
+    repo = finalAttrs.pname;
+    tag = "v${finalAttrs.version}";
     hash = "sha256-J92xNDpCidbiSsN6NveS6BX6Tx+qDQqkgm6pjk1wBTQ=";
   };
 
@@ -21,9 +20,14 @@ buildGoModule rec {
 
   subPackages = [ "cmd/jsonnet*" ];
 
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
   passthru.tests.version = testers.testVersion {
-    package = go-jsonnet;
-    version = "v${version}";
+    package = finalAttrs.finalPackage;
+    version = "v${finalAttrs.version}";
   };
 
   meta = {
@@ -36,4 +40,4 @@ buildGoModule rec {
     ];
     mainProgram = "jsonnet";
   };
-}
+})
diff --git a/pkgs/by-name/go/go-judge/package.nix b/pkgs/by-name/go/go-judge/package.nix
index c94afc6622b9..fdd9df815a2f 100644
--- a/pkgs/by-name/go/go-judge/package.nix
+++ b/pkgs/by-name/go/go-judge/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "criyle";
-    repo = pname;
+    repo = "go-judge";
     rev = "v${version}";
     hash = "sha256-AmbhfCKUpvZt/me73EhBQqw8yDnItn1zKiemf/JRz24=";
   };
diff --git a/pkgs/by-name/go/go-license-detector/package.nix b/pkgs/by-name/go/go-license-detector/package.nix
index 2b5be457f252..2b02eb6861ae 100644
--- a/pkgs/by-name/go/go-license-detector/package.nix
+++ b/pkgs/by-name/go/go-license-detector/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "go-enry";
-    repo = pname;
+    repo = "go-license-detector";
     rev = "v${version}";
     hash = "sha256-S9LKXjn5dL5FETOOAk+bs7bIVdu2x7MIhfjpZuXzuLo=";
   };
diff --git a/pkgs/by-name/go/go-mod-graph-chart/package.nix b/pkgs/by-name/go/go-mod-graph-chart/package.nix
index 9a435833bba9..abffaf61f7c3 100644
--- a/pkgs/by-name/go/go-mod-graph-chart/package.nix
+++ b/pkgs/by-name/go/go-mod-graph-chart/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "PaulXu-cn";
-    repo = pname;
+    repo = "go-mod-graph-chart";
     rev = "v${version}";
     hash = "sha256-vitUZXQyAj72ed9Gukr/sAT/iWWMhwsxjZhf2a9CM7I=";
   };
diff --git a/pkgs/by-name/go/go-org/package.nix b/pkgs/by-name/go/go-org/package.nix
index dabed8503e25..27c515b08344 100644
--- a/pkgs/by-name/go/go-org/package.nix
+++ b/pkgs/by-name/go/go-org/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "niklasfasching";
-    repo = pname;
+    repo = "go-org";
     rev = "v${version}";
     hash = "sha256-BPCQxl0aJ9PrEC5o5dc5uBbX8eYAxqB+qMLXo1LwCoA=";
   };
diff --git a/pkgs/by-name/go/go-swagger/package.nix b/pkgs/by-name/go/go-swagger/package.nix
index 6d5e428bfead..80d7aaf63cd2 100644
--- a/pkgs/by-name/go/go-swagger/package.nix
+++ b/pkgs/by-name/go/go-swagger/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "go-swagger";
-    repo = pname;
+    repo = "go-swagger";
     tag = "v${version}";
     hash = "sha256-PeH9bkRObsw4+ttuWhaPfPQQTOAw8pwlgTEtPoUBiIQ=";
   };
diff --git a/pkgs/by-name/go/gocover-cobertura/package.nix b/pkgs/by-name/go/gocover-cobertura/package.nix
index a301d7d2551a..13cd99cfe8a8 100644
--- a/pkgs/by-name/go/gocover-cobertura/package.nix
+++ b/pkgs/by-name/go/gocover-cobertura/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "boumenot";
-    repo = pname;
+    repo = "gocover-cobertura";
     rev = "v${version}";
     sha256 = "sha256-Cxv1iuCYHSI0BFR1OLbeDIQfVLlMDxlTgU7ljpXWHjU=";
   };
diff --git a/pkgs/by-name/go/gocryptfs/package.nix b/pkgs/by-name/go/gocryptfs/package.nix
index 39269c428e47..7c25e508a09f 100644
--- a/pkgs/by-name/go/gocryptfs/package.nix
+++ b/pkgs/by-name/go/gocryptfs/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "rfjakob";
-    repo = pname;
+    repo = "gocryptfs";
     rev = "v${version}";
     sha256 = "sha256-lDIKMcZLAE1ehijzhpx6G966xzdhusT40Dy06LXBn74=";
   };
diff --git a/pkgs/by-name/go/goda/package.nix b/pkgs/by-name/go/goda/package.nix
index 64249f441c92..9cb792b72fd1 100644
--- a/pkgs/by-name/go/goda/package.nix
+++ b/pkgs/by-name/go/goda/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "goda";
-  version = "0.6.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "loov";
     repo = "goda";
     rev = "v${version}";
-    hash = "sha256-g/sScj5VDQjpWmZN+1YqKJHixGwSBJi6v6YiGklSsjw=";
+    hash = "sha256-byRficALfYADK2lXskAvYeLxwrzOQXACTLlDRrMoHrw=";
   };
 
-  vendorHash = "sha256-Tkt01WSKMyShcw+/2iCh1ziHHhj24LnmfKY8KTDa+L8=";
+  vendorHash = "sha256-AkO3Ag2FiAC46ZXmG3mVhhWpcaw/Z3oik2cyGmoJFpc=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/go/godu/package.nix b/pkgs/by-name/go/godu/package.nix
index e034badc0ae7..40e123d422ed 100644
--- a/pkgs/by-name/go/godu/package.nix
+++ b/pkgs/by-name/go/godu/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "viktomas";
-    repo = pname;
+    repo = "godu";
     rev = "v${version}";
     hash = "sha256-z1LCPweaf8e/HWkSrRCiMYZl4F4dKo4/wDkWgY+eTvk=";
   };
diff --git a/pkgs/by-name/go/goeland/package.nix b/pkgs/by-name/go/goeland/package.nix
index e3f3f337892d..6df11f8aedb5 100644
--- a/pkgs/by-name/go/goeland/package.nix
+++ b/pkgs/by-name/go/goeland/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "slurdge";
-    repo = pname;
+    repo = "goeland";
     rev = "v${version}";
     sha256 = "sha256-4xhw6L6CuwW2MepwGvpVLVafMcU/g0bn/2M/8ZSRF/U=";
   };
diff --git a/pkgs/by-name/go/gof5/package.nix b/pkgs/by-name/go/gof5/package.nix
index 82047971cd3b..d766ae3bd204 100644
--- a/pkgs/by-name/go/gof5/package.nix
+++ b/pkgs/by-name/go/gof5/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "kayrus";
-    repo = pname;
+    repo = "gof5";
     rev = "v${version}";
     sha256 = "10qh7rj8s540ghjdvymly53vny3n0qd0z0ixy24n026jjhgjvnpl";
   };
diff --git a/pkgs/by-name/go/goflow/package.nix b/pkgs/by-name/go/goflow/package.nix
index fa1ffe01aeb2..2e6e5a05c810 100644
--- a/pkgs/by-name/go/goflow/package.nix
+++ b/pkgs/by-name/go/goflow/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "cloudflare";
-    repo = pname;
+    repo = "goflow";
     rev = "v${version}";
     sha256 = "sha256-dNu/z48wzUExGsfpKSWmLwhtqbs/Xi+4PFKRjTxt9DI=";
   };
diff --git a/pkgs/by-name/go/gofu/package.nix b/pkgs/by-name/go/gofu/package.nix
index 012d20bc8e64..09e4723dfeac 100644
--- a/pkgs/by-name/go/gofu/package.nix
+++ b/pkgs/by-name/go/gofu/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "gofu";
   version = "unstable-2023-04-25";
 
   src = fetchFromGitHub {
     owner = "majewsky";
-    repo = pname;
+    repo = "gofu";
     rev = "f308ca92d1631e579fbfe3b3da13c93709dc18a2";
     hash = "sha256-8c/Z+44gX7diAhXq8sHOqISoGhYdFA7VUYn7eNMCYxY=";
   };
diff --git a/pkgs/by-name/go/gojo/package.nix b/pkgs/by-name/go/gojo/package.nix
index c970aba7ff3f..b675dabd5378 100644
--- a/pkgs/by-name/go/gojo/package.nix
+++ b/pkgs/by-name/go/gojo/package.nix
@@ -6,14 +6,14 @@
   nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "gojo";
   version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "itchyny";
     repo = "gojo";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-DMFTB5CgJTWf+P9ntgBgzdmcF2qjS9t3iUQ1Rer+Ab4=";
   };
 
@@ -23,6 +23,10 @@ buildGoModule rec {
     versionCheckHook
   ];
   versionCheckProgramArg = "-v";
+  postInstallCheck = ''
+    $out/bin/gojo --help > /dev/null
+    seq 1 10 | $out/bin/gojo -a | grep '^\[1,2,3,4,5,6,7,8,9,10\]$' > /dev/null
+  '';
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };
@@ -30,9 +34,9 @@ buildGoModule rec {
   meta = {
     description = "Yet another Go implementation of jo";
     homepage = "https://github.com/itchyny/gojo";
-    changelog = "https://github.com/itchyny/gojo/releases/tag/v${version}";
+    changelog = "https://github.com/itchyny/gojo/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ xiaoxiangmoe ];
     mainProgram = "gojo";
   };
-}
+})
diff --git a/pkgs/by-name/go/gokart/package.nix b/pkgs/by-name/go/gokart/package.nix
index aa3b53fb0e3b..8329362779f6 100644
--- a/pkgs/by-name/go/gokart/package.nix
+++ b/pkgs/by-name/go/gokart/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
-    repo = pname;
+    repo = "gokart";
     rev = "v${version}";
     sha256 = "sha256-G1IjlJ/rmviFWy6RFfLtP+bhfYcDuB97leimU39YCoQ=";
   };
diff --git a/pkgs/by-name/go/golines/package.nix b/pkgs/by-name/go/golines/package.nix
index 2d341924e80b..a978a7ded4f8 100644
--- a/pkgs/by-name/go/golines/package.nix
+++ b/pkgs/by-name/go/golines/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "segmentio";
-    repo = pname;
+    repo = "golines";
     rev = "v${version}";
     sha256 = "sha256-D0gI9BA0vgM1DBqwolNTfPsTCWuOGrcu5gAVFEdyVGg=";
   };
diff --git a/pkgs/by-name/go/gomuks/package.nix b/pkgs/by-name/go/gomuks/package.nix
index 3dc22caaa00a..1dfb2545f52b 100644
--- a/pkgs/by-name/go/gomuks/package.nix
+++ b/pkgs/by-name/go/gomuks/package.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "tulir";
-    repo = pname;
+    repo = "gomuks";
     rev = "v${version}";
     sha256 = "sha256-bDJXo8d9K5UO599HDaABpfwc9/dJJy+9d24KMVZHyvI=";
   };
diff --git a/pkgs/by-name/go/gonic/package.nix b/pkgs/by-name/go/gonic/package.nix
index d8b28ba56194..2c9779a0fb1f 100644
--- a/pkgs/by-name/go/gonic/package.nix
+++ b/pkgs/by-name/go/gonic/package.nix
@@ -23,7 +23,7 @@ buildGoModule rec {
   version = "0.16.4";
   src = fetchFromGitHub {
     owner = "sentriz";
-    repo = pname;
+    repo = "gonic";
     rev = "v${version}";
     sha256 = "sha256-+8rKODoADU2k1quKvbijjs/6S/hpkegHhG7Si0LSE0k=";
   };
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index a9dc1a5ce219..eb061b7902c4 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -3,8 +3,8 @@
   lib,
   makeWrapper,
   patchelf,
-  stdenv,
   stdenvNoCC,
+  bintools,
 
   # Linked dynamic libraries.
   alsa-lib,
@@ -169,13 +169,13 @@ let
       qt6.qtwayland
     ];
 
-  linux = stdenv.mkDerivation (finalAttrs: {
+  linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "136.0.7103.113";
+    version = "137.0.7151.55";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-BnKKu7X34g+zg4rDqjVXT3Kx2E8Gn5ELqs3LQS3GCkg=";
+      hash = "sha256-Q4zf60OQN/2NRozssVrnmbYWGRm05Mt2/6LozfENzgM=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -199,7 +199,7 @@ let
 
     unpackPhase = ''
       runHook preUnpack
-      ar x $src
+      ${lib.getExe' bintools "ar"} x $src
       tar xf data.tar.xz
       runHook postUnpack
     '';
@@ -267,7 +267,7 @@ let
 
       for elf in $out/share/google/$appname/{chrome,chrome-sandbox,chrome_crashpad_handler}; do
         patchelf --set-rpath $rpath $elf
-        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $elf
+        patchelf --set-interpreter ${bintools.dynamicLinker} $elf
       done
 
       runHook postInstall
@@ -276,11 +276,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "137.0.7151.41";
+    version = "137.0.7151.56";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/acracoudzvaateoc4hi5umv6pobq_137.0.7151.41/GoogleChrome-137.0.7151.41.dmg";
-      hash = "sha256-egOl4mjsIxjWxYTLI38U2LqrIs85+cmZG9oEXe/bF7Q=";
+      url = "http://dl.google.com/release2/chrome/acps6il5fco5kfidgoaidec3sdha_137.0.7151.56/GoogleChrome-137.0.7151.56.dmg";
+      hash = "sha256-nFk2qg8+9gipnG+4u1sRO4Uq5Iv4TVvxaTETHzF+huw=";
     };
 
     dontPatch = true;
@@ -327,4 +327,9 @@ let
     mainProgram = "google-chrome-stable";
   };
 in
-if stdenvNoCC.hostPlatform.isDarwin then darwin else linux
+if stdenvNoCC.hostPlatform.isDarwin then
+  darwin
+else if stdenvNoCC.hostPlatform.isLinux then
+  linux
+else
+  throw "Unsupported platform ${stdenvNoCC.hostPlatform.system}"
diff --git a/pkgs/by-name/go/google-guest-agent/package.nix b/pkgs/by-name/go/google-guest-agent/package.nix
index 65168424ad66..9f1ae222b1d3 100644
--- a/pkgs/by-name/go/google-guest-agent/package.nix
+++ b/pkgs/by-name/go/google-guest-agent/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
-    repo = pname;
+    repo = "guest-agent";
     tag = version;
     hash = "sha256-DP15KDnD09edBxOQDwP0cjVIFxjMzE1hu1Sbu6Faj9Y=";
   };
diff --git a/pkgs/by-name/go/google-lighthouse/package.nix b/pkgs/by-name/go/google-lighthouse/package.nix
index bfb4a6c57d22..d9e23d7f7191 100644
--- a/pkgs/by-name/go/google-lighthouse/package.nix
+++ b/pkgs/by-name/go/google-lighthouse/package.nix
@@ -12,18 +12,18 @@
 }:
 stdenv.mkDerivation rec {
   pname = "google-lighthouse";
-  version = "12.5.1";
+  version = "12.6.0";
 
   src = fetchFromGitHub {
     owner = "GoogleChrome";
     repo = "lighthouse";
     tag = "v${version}";
-    hash = "sha256-v4V4K77WC3InQ+jRlzw0JV8ehPF+hwWlnAt3P8yHMGU=";
+    hash = "sha256-XwCitOesSEfzp3N80MsRfJ4gNyX85GzXsYaFMawmsjI=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-qdOR7A8ku8qJyJ3rdzH1okt+P1aekGfdtZbxjYOqehA=";
+    hash = "sha256-5c5xPlFglUDavUkRHxa691qSnKW39qqzv24woJshpTg=";
   };
 
   yarnBuildScript = "build-report";
diff --git a/pkgs/by-name/go/goose/package.nix b/pkgs/by-name/go/goose/package.nix
index c4e780347b10..eaf2d65c495f 100644
--- a/pkgs/by-name/go/goose/package.nix
+++ b/pkgs/by-name/go/goose/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "pressly";
-    repo = pname;
+    repo = "goose";
     rev = "v${version}";
     hash = "sha256-GfHhjpg/fMuctAEZFWnUnpnBUFOeGn2L3BSlfI9cOuE=";
   };
diff --git a/pkgs/by-name/go/gore/package.nix b/pkgs/by-name/go/gore/package.nix
index 35609e4655bb..c9a1e4d8b5f6 100644
--- a/pkgs/by-name/go/gore/package.nix
+++ b/pkgs/by-name/go/gore/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "motemen";
-    repo = pname;
+    repo = "gore";
     rev = "v${version}";
     sha256 = "sha256-7mhfegSSRE9FnKz+tWYMEtEKc+hayPQE8EEOEu33CjU=";
   };
diff --git a/pkgs/by-name/go/gortr/package.nix b/pkgs/by-name/go/gortr/package.nix
index 79c8c4175993..c36fb7a542c6 100644
--- a/pkgs/by-name/go/gortr/package.nix
+++ b/pkgs/by-name/go/gortr/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "cloudflare";
-    repo = pname;
+    repo = "gortr";
     rev = "v${version}";
     hash = "sha256-W6+zCLPcORGcRJF0F6/LRPap4SNVn/oKGs21T4nSNO0=";
   };
diff --git a/pkgs/by-name/go/gosec/package.nix b/pkgs/by-name/go/gosec/package.nix
index 1d182280aea1..7ea910bd9faa 100644
--- a/pkgs/by-name/go/gosec/package.nix
+++ b/pkgs/by-name/go/gosec/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "securego";
-    repo = pname;
+    repo = "gosec";
     rev = "v${version}";
     hash = "sha256-a1rxomazSWm/hLpV6lnkEsIpOKyworKQZRFe9ZuEQ1I=";
   };
diff --git a/pkgs/by-name/go/gospider/package.nix b/pkgs/by-name/go/gospider/package.nix
index 6b3f226106c2..6d11da882709 100644
--- a/pkgs/by-name/go/gospider/package.nix
+++ b/pkgs/by-name/go/gospider/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jaeles-project";
-    repo = pname;
+    repo = "gospider";
     rev = "v${version}";
     sha256 = "sha256-1EnKheHaS1kxw0cjxCahT3rUWBXiqxjKefrDBI2xIvY=";
   };
diff --git a/pkgs/by-name/go/goss/package.nix b/pkgs/by-name/go/goss/package.nix
index 80542fa89cd0..d488354e526e 100644
--- a/pkgs/by-name/go/goss/package.nix
+++ b/pkgs/by-name/go/goss/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "goss-org";
-    repo = pname;
+    repo = "goss";
     tag = "v${version}";
     hash = "sha256-GdkLasokpWegjK4kZzAskp1NGwcuMjrjjau75cEo8kg=";
   };
diff --git a/pkgs/by-name/go/gostatic/package.nix b/pkgs/by-name/go/gostatic/package.nix
index 6b0ce598ca88..6499cc5aa2cd 100644
--- a/pkgs/by-name/go/gostatic/package.nix
+++ b/pkgs/by-name/go/gostatic/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "piranha";
-    repo = pname;
+    repo = "gostatic";
     rev = version;
     hash = "sha256-pxk9tauB7u0oe6g4maHh+dREZXKwMz44v3KB43yYW6c=";
   };
diff --git a/pkgs/by-name/go/gotags/package.nix b/pkgs/by-name/go/gotags/package.nix
index 3b46a4cf9c68..3e2c282e1ce1 100644
--- a/pkgs/by-name/go/gotags/package.nix
+++ b/pkgs/by-name/go/gotags/package.nix
@@ -5,13 +5,13 @@
   fetchpatch,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "gotags";
   version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "jstemmer";
-    repo = pname;
+    repo = "gotags";
     rev = "4c0c4330071a994fbdfdff68f412d768fbcca313";
     hash = "sha256-cHTgt+zW6S6NDWBE6NxSXNPdn84CLD8WmqBe+uXN8sA=";
   };
diff --git a/pkgs/by-name/go/gotest/package.nix b/pkgs/by-name/go/gotest/package.nix
index 4c565840fee6..0a9257e55589 100644
--- a/pkgs/by-name/go/gotest/package.nix
+++ b/pkgs/by-name/go/gotest/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "rakyll";
-    repo = pname;
+    repo = "gotest";
     rev = "v${version}";
     sha256 = "1v11ccrjghq7nsz0f91r17di14yixsw28vs0m3dwzwqkh1a20img";
   };
diff --git a/pkgs/by-name/go/gotestfmt/package.nix b/pkgs/by-name/go/gotestfmt/package.nix
index f0b7babdde9c..8c4cdb33c2ec 100644
--- a/pkgs/by-name/go/gotestfmt/package.nix
+++ b/pkgs/by-name/go/gotestfmt/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "gotesttools";
-    repo = pname;
+    repo = "gotestfmt";
     rev = "v${version}";
     hash = "sha256-7mLn2axlHoXau9JtLhk1zwzhxkFGHgYPo7igI+IAsP4=";
   };
diff --git a/pkgs/by-name/gp/gpodder/package.nix b/pkgs/by-name/gp/gpodder/package.nix
index 738983a6322f..5a6a3c4d55fc 100644
--- a/pkgs/by-name/gp/gpodder/package.nix
+++ b/pkgs/by-name/gp/gpodder/package.nix
@@ -17,8 +17,8 @@ python311Packages.buildPythonApplication rec {
   format = "other";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "gpodder";
+    repo = "gpodder";
     rev = version;
     sha256 = "kEhyV1o8VSQW9qMx6m5avj6LnJuVTONDd6msRuc8t/4=";
   };
diff --git a/pkgs/by-name/gp/gptcommit/package.nix b/pkgs/by-name/gp/gptcommit/package.nix
index 56e8c8fb0491..7bb1c6c1fa52 100644
--- a/pkgs/by-name/gp/gptcommit/package.nix
+++ b/pkgs/by-name/gp/gptcommit/package.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage {
 
   src = fetchFromGitHub {
     owner = "zurawiki";
-    repo = pname;
+    repo = "gptcommit";
     rev = "v${version}";
     hash = "sha256-MB78QsJA90Au0bCUXfkcjnvfPagTPZwFhFVqxix+Clw=";
   };
diff --git a/pkgs/by-name/gp/gptscript/package.nix b/pkgs/by-name/gp/gptscript/package.nix
index a5a56b609a87..384cd441c78d 100644
--- a/pkgs/by-name/gp/gptscript/package.nix
+++ b/pkgs/by-name/gp/gptscript/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "gptscript-ai";
-    repo = pname;
+    repo = "gptscript";
     tag = "v${version}";
     hash = "sha256-9wyDcvY5JCjtvx6XtvHwOsZLCiN1fRn0wBGaIaw2iRQ=";
   };
diff --git a/pkgs/by-name/gp/gpu-burn/package.nix b/pkgs/by-name/gp/gpu-burn/package.nix
index 2028427c96c1..8f95db66b43c 100644
--- a/pkgs/by-name/gp/gpu-burn/package.nix
+++ b/pkgs/by-name/gp/gpu-burn/package.nix
@@ -17,7 +17,7 @@ let
     cuda_nvcc
     libcublas
     ;
-  inherit (cudaPackages.flags) cudaCapabilities dropDot isJetsonBuild;
+  inherit (cudaPackages.flags) cudaCapabilities dropDots isJetsonBuild;
 in
 backendStdenv.mkDerivation {
   pname = "gpu-burn";
@@ -53,7 +53,7 @@ backendStdenv.mkDerivation {
 
   makeFlags = [
     "CUDAPATH=${getBin cuda_nvcc}"
-    "COMPUTE=${last (map dropDot cudaCapabilities)}"
+    "COMPUTE=${last (map dropDots cudaCapabilities)}"
     "IS_JETSON=${boolToString isJetsonBuild}"
   ];
 
diff --git a/pkgs/by-name/gr/grafterm/package.nix b/pkgs/by-name/gr/grafterm/package.nix
index f0b698397e95..0504474e28dd 100644
--- a/pkgs/by-name/gr/grafterm/package.nix
+++ b/pkgs/by-name/gr/grafterm/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "slok";
-    repo = pname;
+    repo = "grafterm";
     rev = "v${version}";
     hash = "sha256-0pM36rAmwx/P1KAlmVaGoSj8eb9JucYycNC2R867dVo=";
   };
diff --git a/pkgs/by-name/gr/granted/package.nix b/pkgs/by-name/gr/granted/package.nix
index 510d676a1549..011b085eae94 100644
--- a/pkgs/by-name/gr/granted/package.nix
+++ b/pkgs/by-name/gr/granted/package.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "common-fate";
-    repo = pname;
+    repo = "granted";
     rev = "v${version}";
     sha256 = "sha256-xHpYtHG0fJ/VvJ/4lJ90ept3yGzJRnmtFQFbYxJtxwY=";
   };
diff --git a/pkgs/by-name/gr/graphinder/package.nix b/pkgs/by-name/gr/graphinder/package.nix
index 432012cdec27..d982f1a1f65a 100644
--- a/pkgs/by-name/gr/graphinder/package.nix
+++ b/pkgs/by-name/gr/graphinder/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "Escape-Technologies";
-    repo = pname;
+    repo = "graphinder";
     tag = "v${version}";
     hash = "sha256-TDc6aIFkxShlfC6fLYMKULfrFUAYhQZrIHZNDuMh68g=";
   };
diff --git a/pkgs/by-name/gr/grizzly/package.nix b/pkgs/by-name/gr/grizzly/package.nix
index ad46068b7a30..d84ffbf73d0a 100644
--- a/pkgs/by-name/gr/grizzly/package.nix
+++ b/pkgs/by-name/gr/grizzly/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "grafana";
-    repo = pname;
+    repo = "grizzly";
     rev = "v${version}";
     hash = "sha256-1caG2QIBfbCgg9TLsW4XB0w+4dqUkQEsdWwRazbWeQA=";
   };
diff --git a/pkgs/by-name/gr/grpc_cli/package.nix b/pkgs/by-name/gr/grpc_cli/package.nix
index debe8f09f95e..27f522f8237f 100644
--- a/pkgs/by-name/gr/grpc_cli/package.nix
+++ b/pkgs/by-name/gr/grpc_cli/package.nix
@@ -11,12 +11,12 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc_cli";
-  version = "1.71.1";
+  version = "1.72.0";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-5O+KsiytR1UBi8eS9pPuGrt7KCZSY0VGHMHVO/LZkg8=";
+    hash = "sha256-3ZFQ59zoxNlS5tdm5Bt8EyKyp+9HEpYvLlWarErIR6g=";
     fetchSubmodules = true;
   };
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gr/grpcui/package.nix b/pkgs/by-name/gr/grpcui/package.nix
index 979a97ca1e83..9e4dfe6207a3 100644
--- a/pkgs/by-name/gr/grpcui/package.nix
+++ b/pkgs/by-name/gr/grpcui/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "fullstorydev";
-    repo = pname;
+    repo = "grpcui";
     rev = "v${version}";
     sha256 = "sha256-Tmema+cMPDGuX6Y8atow58GdGMj7croHyj8oiDXSEYk=";
   };
diff --git a/pkgs/by-name/gs/gscreenshot/package.nix b/pkgs/by-name/gs/gscreenshot/package.nix
index 1cc9f76984f4..eeab1ef85b33 100644
--- a/pkgs/by-name/gs/gscreenshot/package.nix
+++ b/pkgs/by-name/gs/gscreenshot/package.nix
@@ -23,7 +23,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "thenaterhood";
-    repo = "${pname}";
+    repo = "gscreenshot";
     tag = "v${version}";
     sha256 = "sha256-u60wxtWE7VaAE/xKlcY9vE7Chs5TPd0BTe5zy1D7ZAQ=";
   };
diff --git a/pkgs/by-name/gs/gsctl/package.nix b/pkgs/by-name/gs/gsctl/package.nix
index bdab9d5b6cbc..e687abea7eff 100644
--- a/pkgs/by-name/gs/gsctl/package.nix
+++ b/pkgs/by-name/gs/gsctl/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "giantswarm";
-    repo = pname;
+    repo = "gsctl";
     rev = version;
     sha256 = "sha256-eemPsrSFwgUR1Jz7283jjwMkoJR38QiaiilI9G0IQuo=";
   };
diff --git a/pkgs/by-name/gs/gspeech/package.nix b/pkgs/by-name/gs/gspeech/package.nix
index f4e133064e79..8dcc9c6c52f1 100644
--- a/pkgs/by-name/gs/gspeech/package.nix
+++ b/pkgs/by-name/gs/gspeech/package.nix
@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "mothsart";
-    repo = pname;
+    repo = "gSpeech";
     rev = version;
     sha256 = "0z11yxvgi8m2xjmmf56zla91jpmf0a4imwi9qqz6bp51pw4sk8gp";
   };
diff --git a/pkgs/by-name/gt/gtk-doc/package.nix b/pkgs/by-name/gt/gtk-doc/package.nix
index 27bfce5f5312..a609563d1725 100644
--- a/pkgs/by-name/gt/gtk-doc/package.nix
+++ b/pkgs/by-name/gt/gtk-doc/package.nix
@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
-    repo = pname;
+    repo = "gtk-doc";
     rev = version;
     hash = "sha256-Jt6d5wbhAoSQ2sWyYWW68Y81duc3+QOJK/5JR/lCmnQ=";
   };
@@ -87,7 +87,7 @@ python3.pkgs.buildPythonApplication rec {
     # Consumers are expected to copy the m4 files to their source tree, let them reuse the patch
     respect_xml_catalog_files_var_patch = ./respect-xml-catalog-files-var.patch;
     updateScript = gnome.updateScript {
-      packageName = pname;
+      packageName = "gtk-doc";
       versionPolicy = "none";
     };
   };
diff --git a/pkgs/by-name/gu/guile-git/package.nix b/pkgs/by-name/gu/guile-git/package.nix
index cf9c2cc02654..6b8a46b695fc 100644
--- a/pkgs/by-name/gu/guile-git/package.nix
+++ b/pkgs/by-name/gu/guile-git/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitLab {
     owner = "guile-git";
-    repo = pname;
+    repo = "guile-git";
     rev = "v${version}";
     hash = "sha256-lFBoA1VBJRHcZkP3h2gnlXQrMjDFWS4jl9RlF8VVf/Q=";
   };
diff --git a/pkgs/by-name/gu/gum/package.nix b/pkgs/by-name/gu/gum/package.nix
index a9d90274c258..65cb469ecc50 100644
--- a/pkgs/by-name/gu/gum/package.nix
+++ b/pkgs/by-name/gu/gum/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
-    repo = pname;
+    repo = "gum";
     rev = "v${version}";
     hash = "sha256-77102I7pOGfpPBSGelsA/9GJYos05akF0kdmr522RC0=";
   };
diff --git a/pkgs/by-name/gx/gx-go/package.nix b/pkgs/by-name/gx/gx-go/package.nix
index 1bb74d913bd2..082c71b9938c 100644
--- a/pkgs/by-name/gx/gx-go/package.nix
+++ b/pkgs/by-name/gx/gx-go/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "gx-go";
   version = "unstable-2020-03-03";
 
   src = fetchFromGitHub {
     owner = "whyrusleeping";
-    repo = pname;
+    repo = "gx-go";
     rev = "9c30fadeac4aee8346d28c36d6bd5063da3d189a";
     hash = "sha256-lrfAyqAyRnhyw9dPURM1NeFIJW/Zug53ThZiwa89z2M=";
   };
diff --git a/pkgs/by-name/gx/gx/package.nix b/pkgs/by-name/gx/gx/package.nix
index d78c07643b60..66182a09ff09 100644
--- a/pkgs/by-name/gx/gx/package.nix
+++ b/pkgs/by-name/gx/gx/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "whyrusleeping";
-    repo = pname;
+    repo = "gx";
     rev = "v${version}";
     sha256 = "sha256-jGtUsb2gm8dN45wniD+PYoUlk8m1ssrfj1a7PPYEYuo=";
   };
diff --git a/pkgs/by-name/ha/halftone/package.nix b/pkgs/by-name/ha/halftone/package.nix
index c1d0a886554f..68b5c7cb86a5 100644
--- a/pkgs/by-name/ha/halftone/package.nix
+++ b/pkgs/by-name/ha/halftone/package.nix
@@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "tfuxu";
-    repo = pname;
+    repo = "halftone";
     tag = version;
     hash = "sha256-o55eimlDy86mbwveARxVXauMQEneAchVi2RNaj6FYxs=";
   };
diff --git a/pkgs/by-name/ha/hamrs-pro/package.nix b/pkgs/by-name/ha/hamrs-pro/package.nix
index e392175bc8de..ccdff2aefdb8 100644
--- a/pkgs/by-name/ha/hamrs-pro/package.nix
+++ b/pkgs/by-name/ha/hamrs-pro/package.nix
@@ -8,34 +8,36 @@
 
 let
   pname = "hamrs-pro";
-  version = "2.33.0";
+  version = "2.37.1";
 
   throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-x86_64.AppImage";
-      hash = "sha256-FUwyyuXtWaHauZyvRvrH7KDC0du02eNR5TfKJyiKb9k=";
+      hash = "sha256-kLYgqRH+RpyitUSZVoZFfqVsrJjTXeZp80ILHGQmGTk=";
     };
 
     aarch64-linux = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-arm64.AppImage";
-      hash = "sha256-YQPKxjaNXE1AgEspZRLI1OUFU71rAU8NBcS0Jv94MS8=";
+      hash = "sha256-BKS7xPzVoIUToqEbtI+8t4Gf7HvZSWhzfXmToghFPEk=";
     };
 
     x86_64-darwin = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-x64.dmg";
-      hash = "sha256-KtrXF47AwVAUXYk1Wu2aKMTXENv7q9JBb86Oy+UHQYY=";
+      hash = "sha256-gejyYoW7VcR0ILD/PSwFGC2tzLiiR2vjEsErBxbvJ3o=";
     };
 
     aarch64-darwin = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-arm64.dmg";
-      hash = "sha256-H46z4V9lo+n/pZzna7KIiYxQBqTlZULitQrFEEMFDvo=";
+      hash = "sha256-Hi/t5ShfhUFw0aEzb2XIhOIppXg04qnq8tl3LKNH3qQ=";
     };
   };
 
   src = srcs.${stdenvNoCC.hostPlatform.system} or throwSystem;
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     homepage = "https://hamrs.app/";
     description = "Simple, portable logger tailored for activities like Parks on the Air, Field Day, and more";
@@ -58,6 +60,7 @@ let
       pname
       version
       src
+      passthru
       meta
       ;
 
@@ -78,6 +81,7 @@ let
       pname
       version
       src
+      passthru
       meta
       ;
 
diff --git a/pkgs/by-name/ha/hamrs-pro/update.sh b/pkgs/by-name/ha/hamrs-pro/update.sh
new file mode 100755
index 000000000000..dfd93fa6788a
--- /dev/null
+++ b/pkgs/by-name/ha/hamrs-pro/update.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash nix-update common-updater-scripts nix
+
+set -euo pipefail
+
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; hamrs-pro.version or (lib.getVersion hamrs-pro)" | tr -d '"')
+# extracting version from download link
+latestVersion=$(curl -sL https://hamrs.app | grep -Po '(?<=hamrs-pro-)[0-9]+\.[0-9]+\.[0-9]+(?=-linux-x86_64\.AppImage)')
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "package is up-to-date: $currentVersion"
+    exit 0
+fi
+
+update-source-version hamrs-pro $latestVersion || true
+
+for system in \
+    x86_64-linux \
+    aarch64-linux \
+    x86_64-darwin \
+    aarch64-darwin; do
+    hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import ./. {}; hamrs-pro.src.url" --system "$system" | tr -d '"')))
+    update-source-version hamrs-pro $latestVersion $hash --system=$system --ignore-same-version
+done
diff --git a/pkgs/by-name/ha/hamster/package.nix b/pkgs/by-name/ha/hamster/package.nix
index 7ad5fbaac6b5..c2695c344412 100644
--- a/pkgs/by-name/ha/hamster/package.nix
+++ b/pkgs/by-name/ha/hamster/package.nix
@@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "projecthamster";
-    repo = pname;
+    repo = "hamster";
     tag = "v${version}";
     sha256 = "sha256-cUmUvJP9Y3de5OaNgIxvigDsX2ww7NNRY5son/gg+WI=";
   };
diff --git a/pkgs/by-name/ha/hashes/package.nix b/pkgs/by-name/ha/hashes/package.nix
index e2911aa8bf30..7942aad2352f 100644
--- a/pkgs/by-name/ha/hashes/package.nix
+++ b/pkgs/by-name/ha/hashes/package.nix
@@ -19,7 +19,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "hashes";
-  version = "1.1.1";
+  version = "1.1.2";
 
   pyproject = false;
 
@@ -27,7 +27,7 @@ python3Packages.buildPythonApplication rec {
     owner = "zefr0x";
     repo = "hashes";
     tag = "v${version}";
-    hash = "sha256-4khMRtKvYQkTwhiqv7FUy/jroGboNTdG1Q6wlTD4cwA=";
+    hash = "sha256-Nyf7jED6LnsFu86zWhRh05sdGKwVAybVsGLGFFsz6eA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ha/hashi-up/package.nix b/pkgs/by-name/ha/hashi-up/package.nix
index 29f0e3875c7b..2abf848649d2 100644
--- a/pkgs/by-name/ha/hashi-up/package.nix
+++ b/pkgs/by-name/ha/hashi-up/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jsiebens";
-    repo = pname;
+    repo = "hashi-up";
     rev = "v${version}";
     sha256 = "sha256-PdZ8X2pJ5TfT0bJ4/P/XbMTv+yyL5/1AxIFHnL/qNcg=";
   };
diff --git a/pkgs/by-name/ha/haxor-news/package.nix b/pkgs/by-name/ha/haxor-news/package.nix
index 0ec51f9fb355..59bda97d4422 100644
--- a/pkgs/by-name/ha/haxor-news/package.nix
+++ b/pkgs/by-name/ha/haxor-news/package.nix
@@ -40,7 +40,7 @@ buildPythonApplication rec {
   # haven't done a stable release in 3+ years, but actively developed
   src = fetchFromGitHub {
     owner = "donnemartin";
-    repo = pname;
+    repo = "haxor-news";
     rev = "811a5804c09406465b2b02eab638c08bf5c4fa7f";
     hash = "sha256-5v61b49ttwqPOvtoykJBBzwVSi7S8ARlakccMr12bbw=";
   };
diff --git a/pkgs/by-name/hc/hcl2json/package.nix b/pkgs/by-name/hc/hcl2json/package.nix
index 103f8b4a143e..b239f80f1841 100644
--- a/pkgs/by-name/hc/hcl2json/package.nix
+++ b/pkgs/by-name/hc/hcl2json/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "tmccombs";
-    repo = pname;
+    repo = "hcl2json";
     rev = "v${version}";
     sha256 = "sha256-fgRrIJnl7lV3a2+d9/F141xCAKOj0WmeNlrtEwdl1qA=";
   };
diff --git a/pkgs/by-name/hc/hcledit/package.nix b/pkgs/by-name/hc/hcledit/package.nix
index 3a1a5cdc25d6..999ab9f12c29 100644
--- a/pkgs/by-name/hc/hcledit/package.nix
+++ b/pkgs/by-name/hc/hcledit/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "minamijoyo";
-    repo = pname;
+    repo = "hcledit";
     rev = "v${version}";
     hash = "sha256-4PBEcOK16YXQhrQ6Yrtcb6vTE6h6sSY3Ymuxi+mEUt8=";
   };
diff --git a/pkgs/by-name/hd/hd-idle/package.nix b/pkgs/by-name/hd/hd-idle/package.nix
index c87179f74c1a..15a449efc195 100644
--- a/pkgs/by-name/hd/hd-idle/package.nix
+++ b/pkgs/by-name/hd/hd-idle/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "adelolmo";
-    repo = pname;
+    repo = "hd-idle";
     rev = "v${version}";
     sha256 = "sha256-WHJcysTN9LHI1WnDuFGTyTirxXirpLpJIeNDj4sZGY0=";
   };
diff --git a/pkgs/by-name/hd/hdl-dump/package.nix b/pkgs/by-name/hd/hdl-dump/package.nix
index 9f8d6dff3249..a62312ddb34c 100644
--- a/pkgs/by-name/hd/hdl-dump/package.nix
+++ b/pkgs/by-name/hd/hdl-dump/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "hdl-dump";
   version = "unstable-2022-09-19";
 
   src = fetchFromGitHub {
     owner = "ps2homebrew";
-    repo = pname;
+    repo = "hdl-dump";
     rev = "87d3099d2ba39a15e86ebc7dc725e8eaa49f2d5f";
     hash = "sha256-eBqF4OGEaLQXQ4JMtD/Yn+f97RzKVsnC+4oyiEhLTUM=";
   };
diff --git a/pkgs/by-name/he/headache/package.nix b/pkgs/by-name/he/headache/package.nix
index bb4747960b83..1d2a734e6048 100644
--- a/pkgs/by-name/he/headache/package.nix
+++ b/pkgs/by-name/he/headache/package.nix
@@ -17,7 +17,7 @@ buildDunePackage rec {
 
   src = fetchFromGitHub {
     owner = "frama-c";
-    repo = pname;
+    repo = "headache";
     rev = "v${version}";
     sha256 = "sha256-UXQIIsCyJZN4qos7Si7LLm9vQueOduUmLeYHuyT2GZo=";
   };
@@ -31,7 +31,7 @@ buildDunePackage rec {
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
-    homepage = "https://github.com/frama-c/${pname}";
+    homepage = "https://github.com/frama-c/headache";
     description = "Lightweight tool for managing headers in source code files";
     mainProgram = "headache";
     license = licenses.lgpl2Plus;
diff --git a/pkgs/by-name/he/healthchecks/package.nix b/pkgs/by-name/he/healthchecks/package.nix
index c0c42962278f..2bc9f137a515 100644
--- a/pkgs/by-name/he/healthchecks/package.nix
+++ b/pkgs/by-name/he/healthchecks/package.nix
@@ -20,7 +20,7 @@ py.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "healthchecks";
-    repo = pname;
+    repo = "healthchecks";
     tag = "v${version}";
     sha256 = "sha256-78Ku7yYhgIZ+uIMPKkExIXUOKmfiRMjEiBm2SugyD+s=";
   };
diff --git a/pkgs/by-name/he/heisenbridge/package.nix b/pkgs/by-name/he/heisenbridge/package.nix
index e8251a4307db..a09a606715d2 100644
--- a/pkgs/by-name/he/heisenbridge/package.nix
+++ b/pkgs/by-name/he/heisenbridge/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "hifi";
-    repo = pname;
+    repo = "heisenbridge";
     tag = "v${version}";
     sha256 = "sha256-wH3IZcY4CtawEicKCkFMh055SM0chYHsPKxYess9II0=";
   };
diff --git a/pkgs/by-name/he/helm-dashboard/package.nix b/pkgs/by-name/he/helm-dashboard/package.nix
index e3ebea92a4ce..a355c4d43e85 100644
--- a/pkgs/by-name/he/helm-dashboard/package.nix
+++ b/pkgs/by-name/he/helm-dashboard/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "komodorio";
-    repo = pname;
+    repo = "helm-dashboard";
     rev = "v${version}";
     sha256 = "sha256-hjIo2AEXNcFK0z4op59NnC2R8GspF5t808DZ72AxgMw=";
   };
diff --git a/pkgs/by-name/he/heroic-unwrapped/package.nix b/pkgs/by-name/he/heroic-unwrapped/package.nix
index f51612b4fbcc..90cce11b353d 100644
--- a/pkgs/by-name/he/heroic-unwrapped/package.nix
+++ b/pkgs/by-name/he/heroic-unwrapped/package.nix
@@ -3,12 +3,13 @@
   stdenv,
   fetchFromGitHub,
   nix-update-script,
-  pnpm_9,
+  # Pinned, because our FODs are not guaranteed to be stable between major versions.
+  pnpm_10,
   nodejs,
   python3,
   makeWrapper,
-  # Upstream uses EOL Electron 31.  Use next oldest version.
-  electron_34,
+  # Electron updates frequently break Heroic, so pin same version as upstream, or newest non-EOL.
+  electron_36,
   vulkan-helper,
   gogdl,
   legendary-heroic,
@@ -17,27 +18,27 @@
 }:
 
 let
-  electron = electron_34;
+  electron = electron_36;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "heroic-unwrapped";
-  version = "2.16.1";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner = "Heroic-Games-Launcher";
     repo = "HeroicGamesLauncher";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-BnBzbbyi9cdO6W59cnY13hnhH+tjrTryTp9XIcERwh4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Tjme43vw+aIjyXBIsaNE8+bWrLKpIDJZpQaKb/bJYFQ=";
   };
 
-  pnpmDeps = pnpm_9.fetchDeps {
+  pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-2IQyXULgFoz0rFQ8SwERgMDzzo7pZ3DbqhwrWNYSwRo=";
+    hash = "sha256-cV0+HZb6g65kGu1zOBueY954ol1bLGW8ddCniwAVWcw=";
   };
 
   nativeBuildInputs = [
     nodejs
-    pnpm_9.configHook
+    pnpm_10.configHook
     python3
     makeWrapper
   ];
diff --git a/pkgs/by-name/he/hey/package.nix b/pkgs/by-name/he/hey/package.nix
index 08735573fb5a..18cf86788dd1 100644
--- a/pkgs/by-name/he/hey/package.nix
+++ b/pkgs/by-name/he/hey/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "rakyll";
-    repo = pname;
+    repo = "hey";
     rev = "v${version}";
     sha256 = "0gsdksrzlwpba14a43ayyy41l1hxpw4ayjpvqyd4ycakddlkvgzb";
   };
diff --git a/pkgs/by-name/hi/hiksink/package.nix b/pkgs/by-name/hi/hiksink/package.nix
index f9a361179d69..e443c9c424af 100644
--- a/pkgs/by-name/hi/hiksink/package.nix
+++ b/pkgs/by-name/hi/hiksink/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "CornerBit";
-    repo = pname;
+    repo = "hiksink";
     rev = version;
     sha256 = "sha256-k/cBCc7DywyBbAzCRCHdrOVmo+QVCsSgDn8hcyTIUI8=";
   };
diff --git a/pkgs/by-name/hi/himitsu-firefox/package.nix b/pkgs/by-name/hi/himitsu-firefox/package.nix
index fb7d5c098f14..8c680f269dd3 100644
--- a/pkgs/by-name/hi/himitsu-firefox/package.nix
+++ b/pkgs/by-name/hi/himitsu-firefox/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   src = fetchFromSourcehut {
     name = pname + "-src";
     owner = "~sircmpwn";
-    repo = pname;
+    repo = "himitsu-firefox";
     rev = "d6d0fdb30aefc93f6ff7d48e5737557051f1ffea";
     hash = "sha256-5RbNdEGPnfDt1KDeU2LnuRsqqqMRyV/Dh2cgEWkz4vQ=";
   };
diff --git a/pkgs/by-name/hi/hishtory/package.nix b/pkgs/by-name/hi/hishtory/package.nix
index 9ea3a3cfa6bb..77ce3ef96267 100644
--- a/pkgs/by-name/hi/hishtory/package.nix
+++ b/pkgs/by-name/hi/hishtory/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ddworken";
-    repo = pname;
+    repo = "hishtory";
     rev = "v${version}";
     hash = "sha256-nh3dNm+5h+3moeO1PUS6tPkftojMSSWSr0m/5n2iO2w=";
   };
diff --git a/pkgs/by-name/hj/hjson-go/package.nix b/pkgs/by-name/hj/hjson-go/package.nix
index 1918981eaf35..1cac54405c34 100644
--- a/pkgs/by-name/hj/hjson-go/package.nix
+++ b/pkgs/by-name/hj/hjson-go/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "hjson";
-    repo = pname;
+    repo = "hjson-go";
     rev = "v${version}";
     hash = "sha256-0xFTxnXMJA98+Y6gwO8zCDPQvLecG1qmbGAISCFMaPw=";
   };
diff --git a/pkgs/by-name/ho/honggfuzz/package.nix b/pkgs/by-name/ho/honggfuzz/package.nix
index 945020445950..5b4b50b8d0a4 100644
--- a/pkgs/by-name/ho/honggfuzz/package.nix
+++ b/pkgs/by-name/ho/honggfuzz/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "google";
-    repo = pname;
+    repo = "honggfuzz";
     rev = version;
     sha256 = "sha256-/ra6g0qjjC8Lo8/n2XEbwnZ95yDHcGhYd5+TTvQ6FAc=";
   };
diff --git a/pkgs/by-name/ho/hors/package.nix b/pkgs/by-name/ho/hors/package.nix
index df6adfb63088..c1ed13853000 100644
--- a/pkgs/by-name/ho/hors/package.nix
+++ b/pkgs/by-name/ho/hors/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "windsoilder";
-    repo = pname;
+    repo = "hors";
     rev = "v${version}";
     sha256 = "1q17i8zg7dwd8al42wfnkn891dy5hdhw4325plnihkarr50avbr0";
   };
diff --git a/pkgs/by-name/ho/hostctl/package.nix b/pkgs/by-name/ho/hostctl/package.nix
index a5838703674c..d3825ec0319b 100644
--- a/pkgs/by-name/ho/hostctl/package.nix
+++ b/pkgs/by-name/ho/hostctl/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "guumaster";
-    repo = pname;
+    repo = "hostctl";
     rev = "v${version}";
     hash = "sha256-9BbPHqAZKw8Rpjpdd/e9ip3V0Eh06tEFt/skQ97ij4g=";
   };
diff --git a/pkgs/by-name/ho/hostess/package.nix b/pkgs/by-name/ho/hostess/package.nix
index 28ab7185d9df..3ea712b7a08f 100644
--- a/pkgs/by-name/ho/hostess/package.nix
+++ b/pkgs/by-name/ho/hostess/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "cbednarski";
-    repo = pname;
+    repo = "hostess";
     rev = "v${version}";
     sha256 = "1izszf60nsa6pyxx3kd8qdrz3h47ylm17r9hzh9wk37f61pmm42j";
   };
diff --git a/pkgs/by-name/ht/htgettoken/package.nix b/pkgs/by-name/ht/htgettoken/package.nix
index b40ad82713d6..8023cc26df62 100644
--- a/pkgs/by-name/ht/htgettoken/package.nix
+++ b/pkgs/by-name/ht/htgettoken/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "fermitools";
-    repo = pname;
+    repo = "htgettoken";
     tag = "v${version}";
     hash = "sha256-BHDLDAbssDCU59nUAVjKo1cCkXoht1lB+2BA6mGbDFU=";
   };
diff --git a/pkgs/by-name/ht/htmltest/package.nix b/pkgs/by-name/ht/htmltest/package.nix
index 9eed514e874d..de24f604bdd7 100644
--- a/pkgs/by-name/ht/htmltest/package.nix
+++ b/pkgs/by-name/ht/htmltest/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "wjdp";
-    repo = pname;
+    repo = "htmltest";
     rev = "v${version}";
     sha256 = "sha256-8tkk476kGEfHo3XGu3/0r6fhX1c4vkYiUACpw0uEu2g=";
   };
diff --git a/pkgs/by-name/ht/htop-vim/package.nix b/pkgs/by-name/ht/htop-vim/package.nix
index b10a23cc8c62..5c91528a0383 100644
--- a/pkgs/by-name/ht/htop-vim/package.nix
+++ b/pkgs/by-name/ht/htop-vim/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "htop-dev";
-    repo = pname;
+    repo = "htop-vim";
     rev = version;
     hash = "sha256-4M2Kzy/tTpIZzpyubnXWywQh7Np5InT4sYkVG2v6wWs";
   };
diff --git a/pkgs/by-name/ht/htop/package.nix b/pkgs/by-name/ht/htop/package.nix
index ad416c4b77bb..c36ca5ffad5c 100644
--- a/pkgs/by-name/ht/htop/package.nix
+++ b/pkgs/by-name/ht/htop/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "htop-dev";
-    repo = pname;
+    repo = "htop";
     rev = version;
     hash = "sha256-fVqQwXbJus2IVE1Bzf3yJJpKK4qcZN/SCTX1XYkiHhU=";
   };
diff --git a/pkgs/by-name/ht/http3-ytproxy/package.nix b/pkgs/by-name/ht/http3-ytproxy/package.nix
index 49de0c2fe4c1..e891fa9336b2 100644
--- a/pkgs/by-name/ht/http3-ytproxy/package.nix
+++ b/pkgs/by-name/ht/http3-ytproxy/package.nix
@@ -4,13 +4,13 @@
   buildGoModule,
   libwebp,
 }:
-buildGoModule rec {
+buildGoModule {
   pname = "http3-ytproxy";
   version = "unstable-2022-07-03";
 
   src = fetchFromGitHub {
     owner = "TeamPiped";
-    repo = pname;
+    repo = "http3-ytproxy";
     rev = "4059da180bb9d7b0de10c1a041bd0e134f1b6408";
     hash = "sha256-ilIOkZ9lcuSigh/mMU7IGpWlFMFb2/Y11ri3659S8+I=";
   };
diff --git a/pkgs/by-name/ht/httpdump/package.nix b/pkgs/by-name/ht/httpdump/package.nix
index 7e062dd294fe..2f829dc92d15 100644
--- a/pkgs/by-name/ht/httpdump/package.nix
+++ b/pkgs/by-name/ht/httpdump/package.nix
@@ -5,13 +5,13 @@
   libpcap,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "httpdump";
   version = "unstable-2023-05-07";
 
   src = fetchFromGitHub {
     owner = "hsiafan";
-    repo = pname;
+    repo = "httpdump";
     rev = "e971e00e0136d5c770c4fdddb1c2095327d419d8";
     hash = "sha256-3BzvIaZKBr/HHplJe5hM7u8kigmMHxCvkiVXFZopUCQ=";
   };
diff --git a/pkgs/by-name/ht/httpstat/package.nix b/pkgs/by-name/ht/httpstat/package.nix
index a267bbaf4d5b..bc777c3e9bf5 100644
--- a/pkgs/by-name/ht/httpstat/package.nix
+++ b/pkgs/by-name/ht/httpstat/package.nix
@@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
   version = "1.3.1";
   src = fetchFromGitHub {
     owner = "reorx";
-    repo = pname;
+    repo = "httpstat";
     rev = version;
     sha256 = "sha256-zUdis41sQpJ1E3LdNwaCVj6gexi/Rk21IBUgoFISiDM=";
   };
diff --git a/pkgs/by-name/hu/hub/package.nix b/pkgs/by-name/hu/hub/package.nix
index 71c302369fb4..5dbfba555ffb 100644
--- a/pkgs/by-name/hu/hub/package.nix
+++ b/pkgs/by-name/hu/hub/package.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "github";
-    repo = pname;
+    repo = "hub";
     rev = "38bcd4ae469e5f53f01901340b715c7658ab417a";
     hash = "sha256-V2GvwKj0m2UXxE42G23OHXyAsTrVRNw1p5CAaJxGYog=";
   };
diff --git a/pkgs/by-name/hu/humility/package.nix b/pkgs/by-name/hu/humility/package.nix
index b6eb5d2183a7..a2bcb3e682d2 100644
--- a/pkgs/by-name/hu/humility/package.nix
+++ b/pkgs/by-name/hu/humility/package.nix
@@ -8,7 +8,7 @@
   pkg-config,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "humility";
   version = "0-unstable-2025-02-25";
 
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "oxidecomputer";
-    repo = pname;
+    repo = "humility";
     rev = "4e9b9f9efb455d62b44345b7c8659dcd962c73da";
     sha256 = "sha256-BzLduU2Wu4UhmgDvvuCEXsABO/jPC7AjptDW8/zePEk=";
   };
diff --git a/pkgs/by-name/hy/hybridreverb2/package.nix b/pkgs/by-name/hy/hybridreverb2/package.nix
index c9a3a0acce83..29ccc0bdac8b 100644
--- a/pkgs/by-name/hy/hybridreverb2/package.nix
+++ b/pkgs/by-name/hy/hybridreverb2/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     inherit owner;
-    repo = pname;
+    repo = "HybridReverb2";
     rev = rev;
     hash = "sha256-+uwTKHQ3nIWKbBCPtf/axvyW6MU0gemVtd2ZqqiT/w0=";
     fetchSubmodules = true;
@@ -77,8 +77,8 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   postInstall = ''
-    mkdir -p $out/share/${pname}/
-    cp  -r ${impulseDB}/* $out/share/${pname}/
+    mkdir -p $out/share/HybridReverb2/
+    cp  -r ${impulseDB}/* $out/share/HybridReverb2/
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/hy/hydralauncher/package.nix b/pkgs/by-name/hy/hydralauncher/package.nix
index 5306ec860f10..cd8c6338d2ff 100644
--- a/pkgs/by-name/hy/hydralauncher/package.nix
+++ b/pkgs/by-name/hy/hydralauncher/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "hydralauncher";
-  version = "3.5.1";
+  version = "3.5.2";
   src = fetchurl {
     url = "https://github.com/hydralauncher/hydra/releases/download/v${version}/hydralauncher-${version}.AppImage";
-    hash = "sha256-uDlxEtWo/8cOLP+ebHN5YZpZESkYHj9+8lqTIsj9qKA=";
+    hash = "sha256-B1eo/t6HEy+C+5yBLySXToDFPoZb1UeQshZTZ6KiibA=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname src version; };
diff --git a/pkgs/by-name/hy/hydroxide/package.nix b/pkgs/by-name/hy/hydroxide/package.nix
index 34decc37b134..e9f98021c0dd 100644
--- a/pkgs/by-name/hy/hydroxide/package.nix
+++ b/pkgs/by-name/hy/hydroxide/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "emersion";
-    repo = pname;
+    repo = "hydroxide";
     rev = "v${version}";
     sha256 = "sha256-VAbMcON75dTS+1lUqmveN2WruQCCmK3kB86e+vKM64U=";
   };
diff --git a/pkgs/by-name/hy/hypercore/package.nix b/pkgs/by-name/hy/hypercore/package.nix
index 92438f1bbaba..fc5364dd3088 100644
--- a/pkgs/by-name/hy/hypercore/package.nix
+++ b/pkgs/by-name/hy/hypercore/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "hypercore";
-  version = "11.7.0";
+  version = "11.8.3";
 
   src = fetchFromGitHub {
     owner = "holepunchto";
     repo = "hypercore";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZAKWFSOIAQysK9+4YxbUiL0fVsqnGFqhwe9ps6ZXYv0=";
+    hash = "sha256-3b1Q2fDEGEqI/HW/zKgxbzqFn368V5kHVETqRcJF+1U=";
   };
 
   npmDepsHash = "sha256-ZJxVmQWKgHyKkuYfGIlANXFcROjI7fibg6mxIhDZowM=";
diff --git a/pkgs/by-name/hy/hysteria/package.nix b/pkgs/by-name/hy/hysteria/package.nix
index d031de61df7a..ed4c5fa0683a 100644
--- a/pkgs/by-name/hy/hysteria/package.nix
+++ b/pkgs/by-name/hy/hysteria/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "apernet";
-    repo = pname;
+    repo = "hysteria";
     rev = "app/v${version}";
     hash = "sha256-0vd1cV2E07EntiOE0wHrSe4e/SRqbFrXhyBRFGxU7xY=";
   };
diff --git a/pkgs/by-name/ia/iam-policy-json-to-terraform/package.nix b/pkgs/by-name/ia/iam-policy-json-to-terraform/package.nix
index 9d33fa0d6440..de7cbe480958 100644
--- a/pkgs/by-name/ia/iam-policy-json-to-terraform/package.nix
+++ b/pkgs/by-name/ia/iam-policy-json-to-terraform/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "flosell";
-    repo = pname;
+    repo = "iam-policy-json-to-terraform";
     rev = version;
     sha256 = "sha256-xIhe+Mnvog+xRu1qMA7yxS1pCs91cr5EcaJroO+0zJ8=";
   };
diff --git a/pkgs/by-name/ia/iay/package.nix b/pkgs/by-name/ia/iay/package.nix
index ed75f91ce418..50ded0734f65 100644
--- a/pkgs/by-name/ia/iay/package.nix
+++ b/pkgs/by-name/ia/iay/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "aaqaishtyaq";
-    repo = pname;
+    repo = "iay";
     rev = "v${version}";
     sha256 = "sha256-oNUK2ROcocKoIlAuNZcJczDYtSchzpB1qaYbSYsjN50=";
   };
diff --git a/pkgs/by-name/ic/iceshelf/package.nix b/pkgs/by-name/ic/iceshelf/package.nix
index deb1a888f00a..68d7c6453bf6 100644
--- a/pkgs/by-name/ic/iceshelf/package.nix
+++ b/pkgs/by-name/ic/iceshelf/package.nix
@@ -6,7 +6,7 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication {
   pname = "iceshelf";
   version = "unstable-2019-07-03";
 
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "mrworf";
-    repo = pname;
+    repo = "iceshelf";
     rev = "26768dde3fc54fa412e523eb8f8552e866b4853b";
     sha256 = "08rcbd14vn7312rmk2hyvdzvhibri31c4r5lzdrwb1n1y9q761qm";
   };
@@ -26,9 +26,9 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   installPhase = ''
-    mkdir -p $out/bin $out/share/doc/${pname} $out/${python3.sitePackages}
+    mkdir -p $out/bin $out/share/doc/iceshelf $out/${python3.sitePackages}
     cp -v iceshelf iceshelf-restore $out/bin
-    cp -v iceshelf.sample.conf $out/share/doc/${pname}/
+    cp -v iceshelf.sample.conf $out/share/doc/iceshelf/
     cp -rv modules $out/${python3.sitePackages}
   '';
 
diff --git a/pkgs/by-name/if/ifuse/package.nix b/pkgs/by-name/if/ifuse/package.nix
index 38c1a78a9b91..a3cea81b84d6 100644
--- a/pkgs/by-name/if/ifuse/package.nix
+++ b/pkgs/by-name/if/ifuse/package.nix
@@ -9,13 +9,13 @@
   libimobiledevice,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "ifuse";
   version = "1.1.4+date=2022-04-04";
 
   src = fetchFromGitHub {
     owner = "libimobiledevice";
-    repo = pname;
+    repo = "ifuse";
     rev = "6f5b8e410f9615b3369ca5eb5367745e13d83b92";
     hash = "sha256-KbuJLS2BWua9DnhLv2KtsQObin0PQwXQwEdgi3lSAPk=";
   };
diff --git a/pkgs/by-name/ik/ikill/package.nix b/pkgs/by-name/ik/ikill/package.nix
index 5399dce37303..845f45df62c8 100644
--- a/pkgs/by-name/ik/ikill/package.nix
+++ b/pkgs/by-name/ik/ikill/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "pjmp";
-    repo = pname;
+    repo = "ikill";
     rev = "v${version}";
     sha256 = "sha256-hOQBBwxkVnTkAZJi84qArwAo54fMC0zS+IeYMV04kUs=";
   };
diff --git a/pkgs/by-name/im/image-roll/package.nix b/pkgs/by-name/im/image-roll/package.nix
index 8698289f3fef..61e828fa3ddb 100644
--- a/pkgs/by-name/im/image-roll/package.nix
+++ b/pkgs/by-name/im/image-roll/package.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "weclaw1";
-    repo = pname;
+    repo = "image-roll";
     rev = version;
     sha256 = "sha256-CC40TU38bJFnbJl2EHqeB9RBvbVUrBmRdZVS2GxqGu4=";
   };
diff --git a/pkgs/by-name/im/imaginary/package.nix b/pkgs/by-name/im/imaginary/package.nix
index dfe07024292e..0ca8eb5448c2 100644
--- a/pkgs/by-name/im/imaginary/package.nix
+++ b/pkgs/by-name/im/imaginary/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "h2non";
-    repo = pname;
+    repo = "imaginary";
     rev = "v${version}";
     hash = "sha256-oEkFoZMaNNJPMisqpIneeLK/sA23gaTWJ4nqtDHkrwA=";
   };
@@ -44,7 +44,7 @@ buildGoModule rec {
 
   meta = with lib; {
     homepage = "https://fly.io/docs/app-guides/run-a-global-image-service";
-    changelog = "https://github.com/h2non/${pname}/releases/tag/v${version}";
+    changelog = "https://github.com/h2non/imaginary/releases/tag/v${version}";
     description = "Fast, simple, scalable, Docker-ready HTTP microservice for high-level image processing";
     license = licenses.mit;
     maintainers = with maintainers; [
diff --git a/pkgs/by-name/im/imgcat/package.nix b/pkgs/by-name/im/imgcat/package.nix
index aaaa5b0bc065..9df497894901 100644
--- a/pkgs/by-name/im/imgcat/package.nix
+++ b/pkgs/by-name/im/imgcat/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "eddieantonio";
-    repo = pname;
+    repo = "imgcat";
     rev = "v${version}";
     sha256 = "sha256-miFjlahTI0GDpgsjnA/K1R4R5654M8AoK78CycoLTqA=";
   };
diff --git a/pkgs/by-name/im/imgcrypt/package.nix b/pkgs/by-name/im/imgcrypt/package.nix
index 6b30c5b5d2b4..a67c253f96f6 100644
--- a/pkgs/by-name/im/imgcrypt/package.nix
+++ b/pkgs/by-name/im/imgcrypt/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "containerd";
-    repo = pname;
+    repo = "imgcrypt";
     rev = "v${version}";
     hash = "sha256-81jfoWHYYenGQFcQI9kk8uPnv6FcyOtcJjpo1ykdtOI=";
   };
diff --git a/pkgs/by-name/im/imgproxy/package.nix b/pkgs/by-name/im/imgproxy/package.nix
index 77375d6c3725..599a1c41b572 100644
--- a/pkgs/by-name/im/imgproxy/package.nix
+++ b/pkgs/by-name/im/imgproxy/package.nix
@@ -14,8 +14,8 @@ buildGoModule rec {
   version = "3.28.0";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "imgproxy";
+    repo = "imgproxy";
     hash = "sha256-aI+rWXt+tioHFGBJk/RkYeo7JaV+10jurx7YKX448Yk=";
     rev = "v${version}";
   };
diff --git a/pkgs/by-name/im/immich/sources.json b/pkgs/by-name/im/immich/sources.json
index 855b14d14378..4204a1ff0843 100644
--- a/pkgs/by-name/im/immich/sources.json
+++ b/pkgs/by-name/im/immich/sources.json
@@ -1,26 +1,26 @@
 {
-  "version": "1.133.1",
-  "hash": "sha256-8jqFiVNj494GQInfLDTXm43mO+H9YuxPwIqUJFOwwW0=",
+  "version": "1.134.0",
+  "hash": "sha256-TTHgEQyKx54pFWvCD1FT8KZSO9/EZxULZS97VGTfFcE=",
   "components": {
     "cli": {
-      "npmDepsHash": "sha256-oDgO8kb/8VqOAGUfG70x2K58j+OsZe+CjurEShiMeCU=",
-      "version": "2.2.67"
+      "npmDepsHash": "sha256-FOtzQF+3yWJI1lzZq79pbPehDFHAsNk5bx71vm1xWBQ=",
+      "version": "2.2.68"
     },
     "server": {
-      "npmDepsHash": "sha256-3beEul7d4OfByrcm4u28Qv7KTdPW8GJ2gnHfQHT9LY0=",
-      "version": "1.133.1"
+      "npmDepsHash": "sha256-VzduZY7yMgjoCtTzW5rCooFubJeZuSnkYe9mwmI/n6Q=",
+      "version": "1.134.0"
     },
     "web": {
-      "npmDepsHash": "sha256-xvSh0NGm7O+lunbHcE7aGv2OzQNVFlHWIeUAQPF218c=",
-      "version": "1.133.1"
+      "npmDepsHash": "sha256-/T8GZ+kqx/G+9Yn76v2vj+KteoS046d0Cxk58YN+3es=",
+      "version": "1.134.0"
     },
     "open-api/typescript-sdk": {
-      "npmDepsHash": "sha256-y2jwNlqGUIsr3DfNSpEr8BFdP7e8xvNUhBQ52ypf0YI=",
-      "version": "1.133.1"
+      "npmDepsHash": "sha256-gTS+zrhL4mqT0UOLfzrKFdumtwZPmlQntj+DbCaQ2s8=",
+      "version": "1.134.0"
     },
     "geonames": {
-      "timestamp": "20250523191247",
-      "hash": "sha256-TiqUyYre3gGv3yJMoh6B+RZWu1AiMpgSZSW16NTI+Eg="
+      "timestamp": "20250527235755",
+      "hash": "sha256-vAoQS07EEPkDhrnJGz3iX+sBaPDUHB5uF0a/pr5+zD4="
     }
   }
 }
diff --git a/pkgs/by-name/im/immudb/package.nix b/pkgs/by-name/im/immudb/package.nix
index 7bf5429977ef..fa5167e632b0 100644
--- a/pkgs/by-name/im/immudb/package.nix
+++ b/pkgs/by-name/im/immudb/package.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "codenotary";
-    repo = pname;
+    repo = "immudb";
     rev = "v${version}";
     sha256 = "sha256-sQLxHHaKdqocjJVXuuuQqx+BNubl6bjVcp50r4kPQEs=";
   };
diff --git a/pkgs/by-name/in/indicator-sound-switcher/package.nix b/pkgs/by-name/in/indicator-sound-switcher/package.nix
index 8f46f42b439d..2d6b8921eb07 100644
--- a/pkgs/by-name/in/indicator-sound-switcher/package.nix
+++ b/pkgs/by-name/in/indicator-sound-switcher/package.nix
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "yktoo";
-    repo = pname;
+    repo = "indicator-sound-switcher";
     tag = "v${version}";
     sha256 = "sha256-Benhlhz81EgL6+pmjzyruKBOS6O7ce5PPmIIzk2Zong=";
   };
diff --git a/pkgs/by-name/in/infra/package.nix b/pkgs/by-name/in/infra/package.nix
index e42727704b2d..e63a583ac38d 100644
--- a/pkgs/by-name/in/infra/package.nix
+++ b/pkgs/by-name/in/infra/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "infrahq";
-    repo = pname;
+    repo = "infra";
     rev = "v${version}";
     sha256 = "sha256-uz4wimhOfeHSL949m+biIhjfDwwEGnTiJWaz/r3Rsko=";
   };
diff --git a/pkgs/by-name/in/inframap/package.nix b/pkgs/by-name/in/inframap/package.nix
index ddfe0ce63dcd..d8af2a520da9 100644
--- a/pkgs/by-name/in/inframap/package.nix
+++ b/pkgs/by-name/in/inframap/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "cycloidio";
-    repo = pname;
+    repo = "inframap";
     rev = "v${version}";
     hash = "sha256-jV9mMJNSsRWdbvHr7OvF1cF2KVqxUEjlM9AaVMxNqBI=";
   };
diff --git a/pkgs/by-name/in/ingress2gateway/package.nix b/pkgs/by-name/in/ingress2gateway/package.nix
index 33ac44c47dc3..ef86837b4b5e 100644
--- a/pkgs/by-name/in/ingress2gateway/package.nix
+++ b/pkgs/by-name/in/ingress2gateway/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
-    repo = pname;
+    repo = "ingress2gateway";
     rev = "v${version}";
     hash = "sha256-0w2ZM1g2rr46bN8BNgrkmb3tOQw0FZTMLp/koW01c5I=";
   };
diff --git a/pkgs/by-name/in/inkcut/package.nix b/pkgs/by-name/in/inkcut/package.nix
index 9fcc2c5dc567..1d0ba86ab8e3 100644
--- a/pkgs/by-name/in/inkcut/package.nix
+++ b/pkgs/by-name/in/inkcut/package.nix
@@ -12,8 +12,8 @@ python3.pkgs.buildPythonApplication rec {
   version = "2.1.6";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "inkcut";
+    repo = "inkcut";
     tag = "v${version}";
     hash = "sha256-qfgzJTFr4VTV/x4PVnUKJzIndfjXB8z2jTWLXvadBuY=";
   };
diff --git a/pkgs/by-name/in/inlyne/package.nix b/pkgs/by-name/in/inlyne/package.nix
index 98dbc260bc31..9141ea0ab818 100644
--- a/pkgs/by-name/in/inlyne/package.nix
+++ b/pkgs/by-name/in/inlyne/package.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "Inlyne-Project";
-    repo = pname;
+    repo = "inlyne";
     rev = "v${version}";
     hash = "sha256-ueE1NKbCMBUBrrdsHkwZ5Yv6LD3tQL3ZAk2O4xoYOcw=";
   };
diff --git a/pkgs/by-name/in/inql/package.nix b/pkgs/by-name/in/inql/package.nix
index 0e492f7fc46e..29f3968f216d 100644
--- a/pkgs/by-name/in/inql/package.nix
+++ b/pkgs/by-name/in/inql/package.nix
@@ -10,7 +10,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "doyensec";
-    repo = pname;
+    repo = "inql";
     tag = "v${version}";
     hash = "sha256-DFGJHqdrCmOZn8GdY5SZ1PrOhuIsMLoK+2Fry9WkRiY=";
   };
diff --git a/pkgs/by-name/in/inshellisense/package.nix b/pkgs/by-name/in/inshellisense/package.nix
index 88c7abc32697..b03751c40d40 100644
--- a/pkgs/by-name/in/inshellisense/package.nix
+++ b/pkgs/by-name/in/inshellisense/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "inshellisense";
-  version = "0.0.1-rc.20";
+  version = "0.0.1-rc.21";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "inshellisense";
     tag = version;
-    hash = "sha256-UGF7tARMnRaeIEKUhYa63hBpEoMb6qV209ECPirkgyg=";
+    hash = "sha256-zERwrvioPwGm/351kYuK9S3uOrrzs/6OFPRdNSSr7Tc=";
   };
 
-  npmDepsHash = "sha256-ycU0vEMgiKBaGKWMBPzQfIvBx6Q7jIHxgzZyi9VGBhw=";
+  npmDepsHash = "sha256-iD5SvkVbrHh0Hx44y6VtNerwBA8K7vSe/yfvhgndMEw=";
 
   # Needed for dependency `@homebridge/node-pty-prebuilt-multiarch`
   # On Darwin systems the build fails with,
diff --git a/pkgs/by-name/in/instead/package.nix b/pkgs/by-name/in/instead/package.nix
index d5dd0588c017..3dee5046b5c1 100644
--- a/pkgs/by-name/in/instead/package.nix
+++ b/pkgs/by-name/in/instead/package.nix
@@ -38,13 +38,13 @@ let
   ];
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "instead";
-  version = "3.3.2";
+  version = "3.5.2";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/instead/instead/${version}/instead_${version}.tar.gz";
-    sha256 = "u5j2kDKRvMQPsG8iA6uOBScuyE/e1BJIK2+qVL6jqQs=";
+    url = "mirror://sourceforge/project/instead/instead/${finalAttrs.version}/instead_${finalAttrs.version}.tar.gz";
+    hash = "sha256-d5BvzZCZ3P5CLptuCuJ4KxfEp4CDbtmIZDIbGDcyV3o=";
   };
 
   NIX_LDFLAGS = "-llua -lgcc_s";
@@ -53,6 +53,7 @@ stdenv.mkDerivation rec {
     pkg-config
     unzip
   ];
+
   buildInputs = [
     SDL2
     SDL2_ttf
@@ -64,11 +65,15 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace configure.sh \
-      --replace "/tmp/sdl-test" $(mktemp)
+      --replace-fail "/tmp/sdl-test" $(mktemp)
   '';
 
   configurePhase = ''
+    runHook preConfigure
+
     { echo 2; echo $out; } | ./configure.sh
+
+    runHook postConfigure
   '';
 
   inherit games;
@@ -83,11 +88,11 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = {
     description = "Simple text adventure interpreter for Unix and Windows";
     homepage = "https://instead.syscall.ru/";
     license = lib.licenses.mit;
     platforms = with lib.platforms; linux;
-    maintainers = with maintainers; [ pSub ];
+    maintainers = with lib.maintainers; [ pSub ];
   };
-}
+})
diff --git a/pkgs/by-name/in/intel-compute-runtime/package.nix b/pkgs/by-name/in/intel-compute-runtime/package.nix
index 16b529f39ecc..071715a4b08f 100644
--- a/pkgs/by-name/in/intel-compute-runtime/package.nix
+++ b/pkgs/by-name/in/intel-compute-runtime/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "25.13.33276.16";
+  version = "25.18.33578.6";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     tag = version;
-    hash = "sha256-dGOFWmgPOcSQtpfmYTTPLYeHfwba6gp9nJRF999hybw=";
+    hash = "sha256-6HJUwoMzd8T9o0dohLiXz2xwtqnUmkFuftIUPqKpy5s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/in/intelephense/package-lock.json b/pkgs/by-name/in/intelephense/package-lock.json
index 91ccdb19b2b7..2380500bb3ca 100644
--- a/pkgs/by-name/in/intelephense/package-lock.json
+++ b/pkgs/by-name/in/intelephense/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "intelephense",
-  "version": "1.12.5",
+  "version": "1.14.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "intelephense",
-      "version": "1.12.5",
+      "version": "1.14.4",
       "license": "SEE LICENSE IN LICENSE.txt",
       "dependencies": {
         "@bmewburn/js-beautify": "1.15.2",
@@ -70,13 +70,27 @@
       }
     },
     "node_modules/@azure/core-auth": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@azure/core-auth/-/core-auth-1.8.0.tgz",
-      "integrity": "sha512-YvFMowkXzLbXNM11yZtVLhUCmuG0ex7JKOH366ipjmHBhL3vpDcPAeWF+jf0X+jVXwFqo3UhsWUq4kH0ZPdu/g==",
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/@azure/core-auth/-/core-auth-1.9.0.tgz",
+      "integrity": "sha512-FPwHpZywuyasDSLMqJ6fhbOK3TqUdviZNF8OqRGA4W5Ewib2lEEZ+pBsYcBa88B2NGO/SEnYPGhyBqNlE8ilSw==",
       "license": "MIT",
       "dependencies": {
         "@azure/abort-controller": "^2.0.0",
-        "@azure/core-util": "^1.1.0",
+        "@azure/core-util": "^1.11.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@azure/core-auth/node_modules/@azure/core-util": {
+      "version": "1.12.0",
+      "resolved": "https://registry.npmjs.org/@azure/core-util/-/core-util-1.12.0.tgz",
+      "integrity": "sha512-13IyjTQgABPARvG90+N2dXpC+hwp466XCdQXPCRlbWHgd3SJd5Q1VvaBGv6k1BIa4MQm6hAF1UBU1m8QUxV8sQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@azure/abort-controller": "^2.0.0",
+        "@typespec/ts-http-runtime": "^0.2.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -117,13 +131,14 @@
       }
     },
     "node_modules/@azure/core-rest-pipeline/node_modules/form-data": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz",
-      "integrity": "sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==",
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.2.tgz",
+      "integrity": "sha512-hGfm/slu0ZabnNt4oaRZ6uREyfCj6P4fT/n6A1rGV+Z0VdGXjfOhVUpkn6qVQONHGIFwmveGXyDs75+nr6FM8w==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
+        "es-set-tostringtag": "^2.1.0",
         "mime-types": "^2.1.12"
       },
       "engines": {
@@ -131,9 +146,9 @@
       }
     },
     "node_modules/@azure/core-tracing": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.1.2.tgz",
-      "integrity": "sha512-dawW9ifvWAWmUm9/h+/UQ2jrdvjCJ7VJEuCJ6XVNudzcOwm53BFZH4Q845vjfgoUAM8ZxokvVNxNxAITc502YA==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.2.0.tgz",
+      "integrity": "sha512-UKTiEJPkWcESPYJz3X5uKRYyOcJD+4nYph+KpfdPRnQJVrZfk0KJgdnaAWKfhsBBtAf/D58Az4AvCJEmWgIBAg==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.6.2"
@@ -168,11 +183,12 @@
       }
     },
     "node_modules/@azure/logger": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@azure/logger/-/logger-1.1.4.tgz",
-      "integrity": "sha512-4IXXzcCdLdlXuCG+8UKEwLA1T1NHqUfanhXYHiQTn+6sfWCZXduqbtXDGceg3Ce5QxTGo7EqmbV6Bi+aqKuClQ==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@azure/logger/-/logger-1.2.0.tgz",
+      "integrity": "sha512-0hKEzLhpw+ZTAfNJyRrn6s+V0nDWzXk9OjBr2TiGIu0OfMr5s2V4FpKLTAK3Ca5r5OKLbf4hkOGDPyiRjie/jA==",
       "license": "MIT",
       "dependencies": {
+        "@typespec/ts-http-runtime": "^0.2.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -180,26 +196,26 @@
       }
     },
     "node_modules/@azure/opentelemetry-instrumentation-azure-sdk": {
-      "version": "1.0.0-beta.6",
-      "resolved": "https://registry.npmjs.org/@azure/opentelemetry-instrumentation-azure-sdk/-/opentelemetry-instrumentation-azure-sdk-1.0.0-beta.6.tgz",
-      "integrity": "sha512-JP6TJ7vDNX6r0gN2+EQBINTNqZ86frl1RAj5STtbLP1ClgIhcdXXb0hvq7CuEOv7InrroHMDoEYG80OQcWChug==",
+      "version": "1.0.0-beta.8",
+      "resolved": "https://registry.npmjs.org/@azure/opentelemetry-instrumentation-azure-sdk/-/opentelemetry-instrumentation-azure-sdk-1.0.0-beta.8.tgz",
+      "integrity": "sha512-8R+gRqNhbK1lv6CIGt55a73LsuK9EKU54323FFrQqSpGduQjENpRa3Wy+AWzw/i5YGzTuLL8NN5vifCOJdeJcg==",
       "license": "MIT",
       "dependencies": {
-        "@azure/core-tracing": "^1.0.0",
+        "@azure/core-tracing": "^1.2.0",
         "@azure/logger": "^1.0.0",
         "@opentelemetry/api": "^1.9.0",
-        "@opentelemetry/core": "^1.25.1",
-        "@opentelemetry/instrumentation": "^0.52.1",
-        "tslib": "^2.2.0"
+        "@opentelemetry/core": "^1.30.1",
+        "@opentelemetry/instrumentation": "^0.57.1",
+        "tslib": "^2.7.0"
       },
       "engines": {
         "node": ">=18.0.0"
       }
     },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.24.8",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.24.8.tgz",
-      "integrity": "sha512-pO9KhhRcuUyGnJWwyEgnRJTSIZHiT+vMD0kPeD+so0l7mxkMT19g3pjY9GTnHySck/hDzq+dtW/4VgnMkippsQ==",
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
+      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -207,9 +223,9 @@
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.24.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.24.7.tgz",
-      "integrity": "sha512-rR+PBcQ1SMQDDyF6X0wxtG8QyLCgUB0eRAGguqRLfkCA87l7yAP7ehq8SNj96OOGTO8OBV70KhuFYcIkHXOg0w==",
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.27.1.tgz",
+      "integrity": "sha512-D2hP9eA+Sqx1kBZgzxZh0y1trbuU+JoDkiEwqhQ36nodYqJwyEIhPSdMNd7lOm/4io72luTPWH20Yda0xOuUow==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -217,13 +233,13 @@
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.25.6",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.25.6.tgz",
-      "integrity": "sha512-trGdfBdbD0l1ZPmcJ83eNxB9rbEax4ALFTF7fN386TMYbeCQbyme5cOEXQhbGXKebwGaB/J52w1mrklMcbgy6Q==",
+      "version": "7.27.3",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.27.3.tgz",
+      "integrity": "sha512-xyYxRj6+tLNDTWi0KCBcZ9V7yg3/lwL9DWh9Uwh/RIVlIfFidggcgxKX3GCXwCiswwcGRawBKbEg2LG/Y8eJhw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.25.6"
+        "@babel/types": "^7.27.3"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -233,15 +249,14 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.25.6",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.25.6.tgz",
-      "integrity": "sha512-/l42B1qxpG6RdfYf343Uw1vmDjeNhneUXtzhojE7pDgfpEypmRhI6j1kr17XCVv4Cgl9HdAiQY2x0GwKm7rWCw==",
+      "version": "7.27.3",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.27.3.tgz",
+      "integrity": "sha512-Y1GkI4ktrtvmawoSq+4FCVHNryea6uR+qUQy0AGxLSsjCX0nVmkYQMBLHDkXZuo5hGx7eYdnIaslsdBFm7zbUw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.24.8",
-        "@babel/helper-validator-identifier": "^7.24.7",
-        "to-fast-properties": "^2.0.0"
+        "@babel/helper-string-parser": "^7.27.1",
+        "@babel/helper-validator-identifier": "^7.27.1"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -340,9 +355,9 @@
       }
     },
     "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.5.tgz",
-      "integrity": "sha512-IzL8ZoEDIBRWEzlCcRhOaCupYyN5gdIK+Q6fbFdPDg6HqX6jpkItn7DFIpW9LQzXG6Df9sA7+OKnq0qlz/GaQg==",
+      "version": "0.3.8",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.8.tgz",
+      "integrity": "sha512-imAbBGkb+ebQyxKgzv5Hu2nmROxoDOXHh80evxdoXNOrvAnVx7zimzc1Oo5h9RlfV4vPXaE2iM5pOFbvOCClWA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -404,9 +419,9 @@
       }
     },
     "node_modules/@jsdoc/salty": {
-      "version": "0.2.8",
-      "resolved": "https://registry.npmjs.org/@jsdoc/salty/-/salty-0.2.8.tgz",
-      "integrity": "sha512-5e+SFVavj1ORKlKaKr2BmTOekmXbelU7dC0cDkQLqag7xfuTPuGMUFx7KWJuv4bYZrTsoL2Z18VVCOKYxzoHcg==",
+      "version": "0.2.9",
+      "resolved": "https://registry.npmjs.org/@jsdoc/salty/-/salty-0.2.9.tgz",
+      "integrity": "sha512-yYxMVH7Dqw6nO0d5NIV8OQWnitU8k6vXH8NtgqAfIa/IUqRMxRv/NUJJ08VEKbAakwxlgBl5PJdrU0dMPStsnw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -479,24 +494,24 @@
       }
     },
     "node_modules/@opentelemetry/api-logs": {
-      "version": "0.52.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.52.1.tgz",
-      "integrity": "sha512-qnSqB2DQ9TPP96dl8cDubDvrUyWc0/sK81xHTK8eSUspzDM3bsewX903qclQFvVhgStjRWdC5bLb3kQqMkfV5A==",
+      "version": "0.57.2",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.57.2.tgz",
+      "integrity": "sha512-uIX52NnTM0iBh84MShlpouI7UKqkZ7MrUszTmaypHBu4r7NofznSnQRfJ+uUeDtQDj6w8eFGg5KBLDAwAPz1+A==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api": "^1.0.0"
+        "@opentelemetry/api": "^1.3.0"
       },
       "engines": {
         "node": ">=14"
       }
     },
     "node_modules/@opentelemetry/core": {
-      "version": "1.26.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-1.26.0.tgz",
-      "integrity": "sha512-1iKxXXE8415Cdv0yjG3G6hQnB5eVEsJce3QaawX8SjDn0mAS0ZM8fAbZZJD4ajvhC15cePvosSCut404KrIIvQ==",
+      "version": "1.30.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-1.30.1.tgz",
+      "integrity": "sha512-OOCM2C/QIURhJMuKaekP3TRBxBKxG/TWWA0TL2J6nXUtDnuCtccy49LUJF8xPFXMX+0LMcxFpCo8M9cGY1W6rQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/semantic-conventions": "1.27.0"
+        "@opentelemetry/semantic-conventions": "1.28.0"
       },
       "engines": {
         "node": ">=14"
@@ -505,14 +520,23 @@
         "@opentelemetry/api": ">=1.0.0 <1.10.0"
       }
     },
+    "node_modules/@opentelemetry/core/node_modules/@opentelemetry/semantic-conventions": {
+      "version": "1.28.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.28.0.tgz",
+      "integrity": "sha512-lp4qAiMTD4sNWW4DbKLBkfiMZ4jbAboJIGOQr5DvciMRI494OapieI9qiODpOt0XBr1LjIDy1xAGAnVs5supTA==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/@opentelemetry/instrumentation": {
-      "version": "0.52.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.52.1.tgz",
-      "integrity": "sha512-uXJbYU/5/MBHjMp1FqrILLRuiJCs3Ofk0MeRDk8g1S1gD47U8X3JnSwcMO1rtRo1x1a7zKaQHaoYu49p/4eSKw==",
+      "version": "0.57.2",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.57.2.tgz",
+      "integrity": "sha512-BdBGhQBh8IjZ2oIIX6F2/Q3LKm/FDDKi6ccYKcBTeilh6SNdNKveDOLk73BkSJjQLJk6qe4Yh+hHw1UPhCDdrg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/api-logs": "0.52.1",
-        "@types/shimmer": "^1.0.2",
+        "@opentelemetry/api-logs": "0.57.2",
+        "@types/shimmer": "^1.2.0",
         "import-in-the-middle": "^1.8.1",
         "require-in-the-middle": "^7.1.1",
         "semver": "^7.5.2",
@@ -526,13 +550,13 @@
       }
     },
     "node_modules/@opentelemetry/resources": {
-      "version": "1.26.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-1.26.0.tgz",
-      "integrity": "sha512-CPNYchBE7MBecCSVy0HKpUISEeJOniWqcHaAHpmasZ3j9o6V3AyBzhRc90jdmemq0HOxDr6ylhUbDhBqqPpeNw==",
+      "version": "1.30.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-1.30.1.tgz",
+      "integrity": "sha512-5UxZqiAgLYGFjS4s9qm5mBVo433u+dSPUFWVWXmLAD4wB65oMCoXaJP1KJa9DIYYMeHu3z4BZcStG3LC593cWA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "1.26.0",
-        "@opentelemetry/semantic-conventions": "1.27.0"
+        "@opentelemetry/core": "1.30.1",
+        "@opentelemetry/semantic-conventions": "1.28.0"
       },
       "engines": {
         "node": ">=14"
@@ -541,15 +565,24 @@
         "@opentelemetry/api": ">=1.0.0 <1.10.0"
       }
     },
+    "node_modules/@opentelemetry/resources/node_modules/@opentelemetry/semantic-conventions": {
+      "version": "1.28.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.28.0.tgz",
+      "integrity": "sha512-lp4qAiMTD4sNWW4DbKLBkfiMZ4jbAboJIGOQr5DvciMRI494OapieI9qiODpOt0XBr1LjIDy1xAGAnVs5supTA==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "1.26.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-1.26.0.tgz",
-      "integrity": "sha512-olWQldtvbK4v22ymrKLbIcBi9L2SpMO84sCPY54IVsJhP9fRsxJT194C/AVaAuJzLE30EdhhM1VmvVYR7az+cw==",
+      "version": "1.30.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-1.30.1.tgz",
+      "integrity": "sha512-jVPgBbH1gCy2Lb7X0AVQ8XAfgg0pJ4nvl8/IiQA6nxOsPvS+0zMJaFSs2ltXe0J6C8dqjcnpyqINDJmU30+uOg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "1.26.0",
-        "@opentelemetry/resources": "1.26.0",
-        "@opentelemetry/semantic-conventions": "1.27.0"
+        "@opentelemetry/core": "1.30.1",
+        "@opentelemetry/resources": "1.30.1",
+        "@opentelemetry/semantic-conventions": "1.28.0"
       },
       "engines": {
         "node": ">=14"
@@ -558,10 +591,19 @@
         "@opentelemetry/api": ">=1.0.0 <1.10.0"
       }
     },
+    "node_modules/@opentelemetry/sdk-trace-base/node_modules/@opentelemetry/semantic-conventions": {
+      "version": "1.28.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.28.0.tgz",
+      "integrity": "sha512-lp4qAiMTD4sNWW4DbKLBkfiMZ4jbAboJIGOQr5DvciMRI494OapieI9qiODpOt0XBr1LjIDy1xAGAnVs5supTA==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/@opentelemetry/semantic-conventions": {
-      "version": "1.27.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.27.0.tgz",
-      "integrity": "sha512-sAay1RrB+ONOem0OZanAR1ZI/k7yDpnOQSQmTMuGImUQb2y8EbSaCJ94FQluM74xoU03vlb2d2U90hZluL6nQg==",
+      "version": "1.34.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.34.0.tgz",
+      "integrity": "sha512-aKcOkyrorBGlajjRdVoJWHTxfxO1vCNHLJVlSDaRHDIdjU+pX8IYQPvPDkYiujKLbRnWU+1TBwEt0QRgSm4SGA==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=14"
@@ -760,9 +802,9 @@
       "license": "MIT"
     },
     "node_modules/@types/braces": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/braces/-/braces-3.0.4.tgz",
-      "integrity": "sha512-0WR3b8eaISjEW7RpZnclONaLFDf7buaowRHdqLp4vLj54AsSAYWfh3DRbfiYJY9XDxMgx1B4sE1Afw2PGpuHOA==",
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@types/braces/-/braces-3.0.5.tgz",
+      "integrity": "sha512-SQFof9H+LXeWNz8wDe7oN5zu7ket0qwMu5vZubW4GCJ8Kkeh6nBWUz87+KTz/G3Kqsrp0j/W253XJb3KMEeg3w==",
       "dev": true,
       "license": "MIT"
     },
@@ -774,9 +816,9 @@
       "license": "MIT"
     },
     "node_modules/@types/chai": {
-      "version": "4.3.19",
-      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-4.3.19.tgz",
-      "integrity": "sha512-2hHHvQBVE2FiSK4eN0Br6snX9MtolHaTo/batnLjlGRhoQzlCL61iVpxoqO7SfFyOw+P/pwv+0zNHzKoGWz9Cw==",
+      "version": "4.3.20",
+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-4.3.20.tgz",
+      "integrity": "sha512-/pC9HAB5I/xMlc5FP77qjCnI16ChlJfW0tGa0IUcFn38VJrTV6DeZ60NU5KZBtaOZqjdpwTWohz5HU1RrhiYxQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -803,9 +845,9 @@
       }
     },
     "node_modules/@types/estree": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.5.tgz",
-      "integrity": "sha512-/kYRxGDLWzHOB7q+wtSUQlFrtcdUccpfy+X+9iMBpHK8QLLhx2wIPYuS5DYtR9Wa/YlZAbIovy7qVdB1Aq6Lyw==",
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.7.tgz",
+      "integrity": "sha512-w28IoSUCJpidD/TGviZwwMJckNESJZXFu7NBZ5YJ4mEUnNraUn9Pm8HSZm/jDF1pDWYKspWE7oVphigUPRakIQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -887,16 +929,16 @@
       }
     },
     "node_modules/@types/mocha": {
-      "version": "10.0.8",
-      "resolved": "https://registry.npmjs.org/@types/mocha/-/mocha-10.0.8.tgz",
-      "integrity": "sha512-HfMcUmy9hTMJh66VNcmeC9iVErIZJli2bszuXc6julh5YGuRb/W5OnkHjwLNYdFlMis0sY3If5SEAp+PktdJjw==",
+      "version": "10.0.10",
+      "resolved": "https://registry.npmjs.org/@types/mocha/-/mocha-10.0.10.tgz",
+      "integrity": "sha512-xPyYSz1cMPnJQhl0CLMH68j3gprKZaTjG3s5Vi+fDgx+uhG9NOXwbVt52eFS8ECyXhyKcjDLCBEqBExKuiZb7Q==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "20.16.5",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.5.tgz",
-      "integrity": "sha512-VwYCweNo3ERajwy0IUlqqcyZ8/A7Zwa9ZP3MnENWcB11AejO+tLy3pu850goUW2FC/IJMdZUfKpX/yxL1gymCA==",
+      "version": "20.17.52",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.17.52.tgz",
+      "integrity": "sha512-2aj++KfxubvW/Lc0YyXE3OEW7Es8TWn1MsRzYgcOGyTNQxi0L8rxQUCZ7ZbyOBWZQD5I63PV9egZWMsapVaklg==",
       "license": "MIT",
       "dependencies": {
         "undici-types": "~6.19.2"
@@ -929,9 +971,9 @@
       "license": "MIT"
     },
     "node_modules/@types/sinon": {
-      "version": "17.0.3",
-      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-17.0.3.tgz",
-      "integrity": "sha512-j3uovdn8ewky9kRBG19bOwaZbexJu/XjtkHyjvUgt4xfPFz18dcORIMqnYh66Fx3Powhcr85NT5+er3+oViapw==",
+      "version": "17.0.4",
+      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-17.0.4.tgz",
+      "integrity": "sha512-RHnIrhfPO3+tJT0s7cFaXGZvsL4bbR3/k7z3P312qMS4JaS2Tk+KiwiLx1S0rQ56ERj00u1/BtdyVd0FY+Pdew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -952,6 +994,55 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@typespec/ts-http-runtime": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.2.2.tgz",
+      "integrity": "sha512-Gz/Sm64+Sq/vklJu1tt9t+4R2lvnud8NbTD/ZfpZtMiUX7YeVpCA8j6NSW8ptwcoLL+NmYANwqP8DV0q/bwl2w==",
+      "license": "MIT",
+      "dependencies": {
+        "http-proxy-agent": "^7.0.0",
+        "https-proxy-agent": "^7.0.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@typespec/ts-http-runtime/node_modules/agent-base": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.3.tgz",
+      "integrity": "sha512-jRR5wdylq8CkOe6hei19GGZnxM6rBGwFl3Bg0YItGDimvjGtAvdZk4Pu6Cl4u4Igsws4a1fd1Vq3ezrhn4KmFw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/@typespec/ts-http-runtime/node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/@typespec/ts-http-runtime/node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
     "node_modules/@vscode/l10n": {
       "version": "0.0.18",
       "resolved": "https://registry.npmjs.org/@vscode/l10n/-/l10n-0.0.18.tgz",
@@ -959,73 +1050,73 @@
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/ast": {
-      "version": "1.12.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/ast/-/ast-1.12.1.tgz",
-      "integrity": "sha512-EKfMUOPRRUTy5UII4qJDGPpqfwjOmZ5jeGFwid9mnoqIFK+e0vqoi1qH56JpmZSzEL53jKnNzScdmftJyG5xWg==",
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/ast/-/ast-1.14.1.tgz",
+      "integrity": "sha512-nuBEDgQfm1ccRp/8bCQrx1frohyufl4JlbMMZ4P1wpeOfDhF6FQkxZJ1b/e+PLwr6X1Nhw6OLme5usuBWYBvuQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@webassemblyjs/helper-numbers": "1.11.6",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.6"
+        "@webassemblyjs/helper-numbers": "1.13.2",
+        "@webassemblyjs/helper-wasm-bytecode": "1.13.2"
       }
     },
     "node_modules/@webassemblyjs/floating-point-hex-parser": {
-      "version": "1.11.6",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.11.6.tgz",
-      "integrity": "sha512-ejAj9hfRJ2XMsNHk/v6Fu2dGS+i4UaXBXGemOfQ/JfQ6mdQg/WXtwleQRLLS4OvfDhv8rYnVwH27YJLMyYsxhw==",
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.13.2.tgz",
+      "integrity": "sha512-6oXyTOzbKxGH4steLbLNOu71Oj+C8Lg34n6CqRvqfS2O71BxY6ByfMDRhBytzknj9yGUPVJ1qIKhRlAwO1AovA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/helper-api-error": {
-      "version": "1.11.6",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-api-error/-/helper-api-error-1.11.6.tgz",
-      "integrity": "sha512-o0YkoP4pVu4rN8aTJgAyj9hC2Sv5UlkzCHhxqWj8butaLvnpdc2jOwh4ewE6CX0txSfLn/UYaV/pheS2Txg//Q==",
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-api-error/-/helper-api-error-1.13.2.tgz",
+      "integrity": "sha512-U56GMYxy4ZQCbDZd6JuvvNV/WFildOjsaWD3Tzzvmw/mas3cXzRJPMjP83JqEsgSbyrmaGjBfDtV7KDXV9UzFQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/helper-buffer": {
-      "version": "1.12.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-buffer/-/helper-buffer-1.12.1.tgz",
-      "integrity": "sha512-nzJwQw99DNDKr9BVCOZcLuJJUlqkJh+kVzVl6Fmq/tI5ZtEyWT1KZMyOXltXLZJmDtvLCDgwsyrkohEtopTXCw==",
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-buffer/-/helper-buffer-1.14.1.tgz",
+      "integrity": "sha512-jyH7wtcHiKssDtFPRB+iQdxlDf96m0E39yb0k5uJVhFGleZFoNw1c4aeIcVUPPbXUVJ94wwnMOAqUHyzoEPVMA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/helper-numbers": {
-      "version": "1.11.6",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-numbers/-/helper-numbers-1.11.6.tgz",
-      "integrity": "sha512-vUIhZ8LZoIWHBohiEObxVm6hwP034jwmc9kuq5GdHZH0wiLVLIPcMCdpJzG4C11cHoQ25TFIQj9kaVADVX7N3g==",
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-numbers/-/helper-numbers-1.13.2.tgz",
+      "integrity": "sha512-FE8aCmS5Q6eQYcV3gI35O4J789wlQA+7JrqTTpJqn5emA4U2hvwJmvFRC0HODS+3Ye6WioDklgd6scJ3+PLnEA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@webassemblyjs/floating-point-hex-parser": "1.11.6",
-        "@webassemblyjs/helper-api-error": "1.11.6",
+        "@webassemblyjs/floating-point-hex-parser": "1.13.2",
+        "@webassemblyjs/helper-api-error": "1.13.2",
         "@xtuc/long": "4.2.2"
       }
     },
     "node_modules/@webassemblyjs/helper-wasm-bytecode": {
-      "version": "1.11.6",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.11.6.tgz",
-      "integrity": "sha512-sFFHKwcmBprO9e7Icf0+gddyWYDViL8bpPjJJl0WHxCdETktXdmtWLGVzoHbqUcY4Be1LkNfwTmXOJUFZYSJdA==",
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.13.2.tgz",
+      "integrity": "sha512-3QbLKy93F0EAIXLh0ogEVR6rOubA9AoZ+WRYhNbFyuB70j3dRdwH9g+qXhLAO0kiYGlg3TxDV+I4rQTr/YNXkA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/helper-wasm-section": {
-      "version": "1.12.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.12.1.tgz",
-      "integrity": "sha512-Jif4vfB6FJlUlSbgEMHUyk1j234GTNG9dBJ4XJdOySoj518Xj0oGsNi59cUQF4RRMS9ouBUxDDdyBVfPTypa5g==",
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.14.1.tgz",
+      "integrity": "sha512-ds5mXEqTJ6oxRoqjhWDU83OgzAYjwsCV8Lo/N+oRsNDmx/ZDpqalmrtgOMkHwxsG0iI//3BwWAErYRHtgn0dZw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@webassemblyjs/ast": "1.12.1",
-        "@webassemblyjs/helper-buffer": "1.12.1",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
-        "@webassemblyjs/wasm-gen": "1.12.1"
+        "@webassemblyjs/ast": "1.14.1",
+        "@webassemblyjs/helper-buffer": "1.14.1",
+        "@webassemblyjs/helper-wasm-bytecode": "1.13.2",
+        "@webassemblyjs/wasm-gen": "1.14.1"
       }
     },
     "node_modules/@webassemblyjs/ieee754": {
-      "version": "1.11.6",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/ieee754/-/ieee754-1.11.6.tgz",
-      "integrity": "sha512-LM4p2csPNvbij6U1f19v6WR56QZ8JcHg3QIJTlSwzFcmx6WSORicYj6I63f9yU1kEUtrpG+kjkiIAkevHpDXrg==",
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/ieee754/-/ieee754-1.13.2.tgz",
+      "integrity": "sha512-4LtOzh58S/5lX4ITKxnAK2USuNEvpdVV9AlgGQb8rJDHaLeHciwG4zlGr0j/SNWlr7x3vO1lDEsuePvtcDNCkw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1033,9 +1124,9 @@
       }
     },
     "node_modules/@webassemblyjs/leb128": {
-      "version": "1.11.6",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/leb128/-/leb128-1.11.6.tgz",
-      "integrity": "sha512-m7a0FhE67DQXgouf1tbN5XQcdWoNgaAuoULHIfGFIEVKA6tu/edls6XnIlkmS6FrXAquJRPni3ZZKjw6FSPjPQ==",
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/leb128/-/leb128-1.13.2.tgz",
+      "integrity": "sha512-Lde1oNoIdzVzdkNEAWZ1dZ5orIbff80YPdHx20mrHwHrVNNTjNr8E3xz9BdpcGqRQbAEa+fkrCb+fRFTl/6sQw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -1043,79 +1134,79 @@
       }
     },
     "node_modules/@webassemblyjs/utf8": {
-      "version": "1.11.6",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/utf8/-/utf8-1.11.6.tgz",
-      "integrity": "sha512-vtXf2wTQ3+up9Zsg8sa2yWiQpzSsMyXj0qViVP6xKGCUT8p8YJ6HqI7l5eCnWx1T/FYdsv07HQs2wTFbbof/RA==",
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/utf8/-/utf8-1.13.2.tgz",
+      "integrity": "sha512-3NQWGjKTASY1xV5m7Hr0iPeXD9+RDobLll3T9d2AO+g3my8xy5peVyjSag4I50mR1bBSN/Ct12lo+R9tJk0NZQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/wasm-edit": {
-      "version": "1.12.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-edit/-/wasm-edit-1.12.1.tgz",
-      "integrity": "sha512-1DuwbVvADvS5mGnXbE+c9NfA8QRcZ6iKquqjjmR10k6o+zzsRVesil54DKexiowcFCPdr/Q0qaMgB01+SQ1u6g==",
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-edit/-/wasm-edit-1.14.1.tgz",
+      "integrity": "sha512-RNJUIQH/J8iA/1NzlE4N7KtyZNHi3w7at7hDjvRNm5rcUXa00z1vRz3glZoULfJ5mpvYhLybmVcwcjGrC1pRrQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@webassemblyjs/ast": "1.12.1",
-        "@webassemblyjs/helper-buffer": "1.12.1",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
-        "@webassemblyjs/helper-wasm-section": "1.12.1",
-        "@webassemblyjs/wasm-gen": "1.12.1",
-        "@webassemblyjs/wasm-opt": "1.12.1",
-        "@webassemblyjs/wasm-parser": "1.12.1",
-        "@webassemblyjs/wast-printer": "1.12.1"
+        "@webassemblyjs/ast": "1.14.1",
+        "@webassemblyjs/helper-buffer": "1.14.1",
+        "@webassemblyjs/helper-wasm-bytecode": "1.13.2",
+        "@webassemblyjs/helper-wasm-section": "1.14.1",
+        "@webassemblyjs/wasm-gen": "1.14.1",
+        "@webassemblyjs/wasm-opt": "1.14.1",
+        "@webassemblyjs/wasm-parser": "1.14.1",
+        "@webassemblyjs/wast-printer": "1.14.1"
       }
     },
     "node_modules/@webassemblyjs/wasm-gen": {
-      "version": "1.12.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-gen/-/wasm-gen-1.12.1.tgz",
-      "integrity": "sha512-TDq4Ojh9fcohAw6OIMXqiIcTq5KUXTGRkVxbSo1hQnSy6lAM5GSdfwWeSxpAo0YzgsgF182E/U0mDNhuA0tW7w==",
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-gen/-/wasm-gen-1.14.1.tgz",
+      "integrity": "sha512-AmomSIjP8ZbfGQhumkNvgC33AY7qtMCXnN6bL2u2Js4gVCg8fp735aEiMSBbDR7UQIj90n4wKAFUSEd0QN2Ukg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@webassemblyjs/ast": "1.12.1",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
-        "@webassemblyjs/ieee754": "1.11.6",
-        "@webassemblyjs/leb128": "1.11.6",
-        "@webassemblyjs/utf8": "1.11.6"
+        "@webassemblyjs/ast": "1.14.1",
+        "@webassemblyjs/helper-wasm-bytecode": "1.13.2",
+        "@webassemblyjs/ieee754": "1.13.2",
+        "@webassemblyjs/leb128": "1.13.2",
+        "@webassemblyjs/utf8": "1.13.2"
       }
     },
     "node_modules/@webassemblyjs/wasm-opt": {
-      "version": "1.12.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-opt/-/wasm-opt-1.12.1.tgz",
-      "integrity": "sha512-Jg99j/2gG2iaz3hijw857AVYekZe2SAskcqlWIZXjji5WStnOpVoat3gQfT/Q5tb2djnCjBtMocY/Su1GfxPBg==",
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-opt/-/wasm-opt-1.14.1.tgz",
+      "integrity": "sha512-PTcKLUNvBqnY2U6E5bdOQcSM+oVP/PmrDY9NzowJjislEjwP/C4an2303MCVS2Mg9d3AJpIGdUFIQQWbPds0Sw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@webassemblyjs/ast": "1.12.1",
-        "@webassemblyjs/helper-buffer": "1.12.1",
-        "@webassemblyjs/wasm-gen": "1.12.1",
-        "@webassemblyjs/wasm-parser": "1.12.1"
+        "@webassemblyjs/ast": "1.14.1",
+        "@webassemblyjs/helper-buffer": "1.14.1",
+        "@webassemblyjs/wasm-gen": "1.14.1",
+        "@webassemblyjs/wasm-parser": "1.14.1"
       }
     },
     "node_modules/@webassemblyjs/wasm-parser": {
-      "version": "1.12.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-parser/-/wasm-parser-1.12.1.tgz",
-      "integrity": "sha512-xikIi7c2FHXysxXe3COrVUPSheuBtpcfhbpFj4gmu7KRLYOzANztwUU0IbsqvMqzuNK2+glRGWCEqZo1WCLyAQ==",
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-parser/-/wasm-parser-1.14.1.tgz",
+      "integrity": "sha512-JLBl+KZ0R5qB7mCnud/yyX08jWFw5MsoalJ1pQ4EdFlgj9VdXKGuENGsiCIjegI1W7p91rUlcB/LB5yRJKNTcQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@webassemblyjs/ast": "1.12.1",
-        "@webassemblyjs/helper-api-error": "1.11.6",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
-        "@webassemblyjs/ieee754": "1.11.6",
-        "@webassemblyjs/leb128": "1.11.6",
-        "@webassemblyjs/utf8": "1.11.6"
+        "@webassemblyjs/ast": "1.14.1",
+        "@webassemblyjs/helper-api-error": "1.13.2",
+        "@webassemblyjs/helper-wasm-bytecode": "1.13.2",
+        "@webassemblyjs/ieee754": "1.13.2",
+        "@webassemblyjs/leb128": "1.13.2",
+        "@webassemblyjs/utf8": "1.13.2"
       }
     },
     "node_modules/@webassemblyjs/wast-printer": {
-      "version": "1.12.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wast-printer/-/wast-printer-1.12.1.tgz",
-      "integrity": "sha512-+X4WAlOisVWQMikjbcvY2e0rwPsKQ9F688lksZhBcPycBBuii3O7m8FACbDMWDojpAqvjIncrG8J0XHKyQfVeA==",
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wast-printer/-/wast-printer-1.14.1.tgz",
+      "integrity": "sha512-kPSSXE6De1XOR820C90RIo2ogvZG+c3KiHzqUoO/F34Y2shGzesfqv7o57xrxovZJH/MetF5UjroJ/R/3isoiw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@webassemblyjs/ast": "1.12.1",
+        "@webassemblyjs/ast": "1.14.1",
         "@xtuc/long": "4.2.2"
       }
     },
@@ -1190,9 +1281,9 @@
       }
     },
     "node_modules/acorn": {
-      "version": "8.12.1",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.12.1.tgz",
-      "integrity": "sha512-tcpGyI9zbizT9JbV6oYE477V6mTlXvvi0T0G3SNIYE2apm/G5huBa1+K89VGeovbg+jycCrfhl3ADxErOuO6Jg==",
+      "version": "8.14.1",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.14.1.tgz",
+      "integrity": "sha512-OvQ/2pUDKmgfCg++xsTX1wGxfTaszcHVcTctW4UJB4hibJx2HXxxO5UmVgyjMa+ZDsiaf5wWLXYpRWMmBI0QHg==",
       "license": "MIT",
       "bin": {
         "acorn": "bin/acorn"
@@ -1527,9 +1618,9 @@
       "license": "ISC"
     },
     "node_modules/browserslist": {
-      "version": "4.23.3",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.23.3.tgz",
-      "integrity": "sha512-btwCFJVjI4YWDNfau8RhZ+B1Q/VLoUITrm3RlP6y1tYGWIOa+InuYiRGXUBXo8nA1qKmHMyLB/iVQg5TT4eFoA==",
+      "version": "4.25.0",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.25.0.tgz",
+      "integrity": "sha512-PJ8gYKeS5e/whHBh8xrwYK+dAvEj7JXtz6uTucnMRB8OiGTsKccFekoRrjajPBHV8oOY+2tI4uxeceSimKwMFA==",
       "dev": true,
       "funding": [
         {
@@ -1547,10 +1638,10 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "caniuse-lite": "^1.0.30001646",
-        "electron-to-chromium": "^1.5.4",
-        "node-releases": "^2.0.18",
-        "update-browserslist-db": "^1.1.0"
+        "caniuse-lite": "^1.0.30001718",
+        "electron-to-chromium": "^1.5.160",
+        "node-releases": "^2.0.19",
+        "update-browserslist-db": "^1.1.3"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -1566,6 +1657,19 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/camelcase": {
       "version": "6.3.0",
       "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
@@ -1580,9 +1684,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001660",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001660.tgz",
-      "integrity": "sha512-GacvNTTuATm26qC74pt+ad1fW15mlQ/zuTzzY1ZoIzECTP8HURDfF43kNxPgf7H1jmelCBQTTbBNxdSXOA7Bqg==",
+      "version": "1.0.30001720",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001720.tgz",
+      "integrity": "sha512-Ec/2yV2nNPwb4DnTANEV99ZWwm3ZWfdlfkQbWSDDt+PsXEVYwlhPH8tdMaPunYTKKmz7AnHi2oNEi1GcmKCD8g==",
       "dev": true,
       "funding": [
         {
@@ -1727,9 +1831,9 @@
       }
     },
     "node_modules/cjs-module-lexer": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-1.4.1.tgz",
-      "integrity": "sha512-cuSVIHi9/9E/+821Qjdvngor+xpnlwnuwIyZOaLmHBVdXL+gP+I6QQB9VkO7RI77YIcTV+S1W9AreJ5eN63JBA==",
+      "version": "1.4.3",
+      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-1.4.3.tgz",
+      "integrity": "sha512-9z8TZaGM1pfswYeXrUpzPrkx8UnWYdhJclsiYMm6x/w5+nN+8Tf/LnAgfLGQCm59qAOxU8WwHEq2vNwF6i4j+Q==",
       "license": "MIT"
     },
     "node_modules/cliui": {
@@ -1944,9 +2048,9 @@
       "license": "MIT"
     },
     "node_modules/cross-spawn": {
-      "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
-      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "license": "MIT",
       "dependencies": {
         "path-key": "^3.1.0",
@@ -1967,9 +2071,9 @@
       }
     },
     "node_modules/debug": {
-      "version": "4.3.7",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.7.tgz",
-      "integrity": "sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==",
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.1.tgz",
+      "integrity": "sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==",
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -2139,9 +2243,9 @@
       }
     },
     "node_modules/domutils": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/domutils/-/domutils-3.1.0.tgz",
-      "integrity": "sha512-H78uMmQtI2AhgDJjWeQmHwJJ2bLPD3GMmO7Zja/ZZh84wkm+4ut+IUnUdRa8uCGX88DiVx1j6FRe1XfxEgjEZA==",
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/domutils/-/domutils-3.2.2.tgz",
+      "integrity": "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==",
       "license": "BSD-2-Clause",
       "dependencies": {
         "dom-serializer": "^2.0.0",
@@ -2152,6 +2256,20 @@
         "url": "https://github.com/fb55/domutils?sponsor=1"
       }
     },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/eastasianwidth": {
       "version": "0.2.0",
       "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
@@ -2177,9 +2295,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.24",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.24.tgz",
-      "integrity": "sha512-0x0wLCmpdKFCi9ulhvYZebgcPmHTkFVUfU2wzDykadkslKwT4oAmDTHEKLnlrDsMGZe4B+ksn8quZfZjYsBetA==",
+      "version": "1.5.161",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.161.tgz",
+      "integrity": "sha512-hwtetwfKNZo/UlwHIVBlKZVdy7o8bIZxxKs0Mv/ROPiQQQmDgdm5a+KvKtBsxM8ZjFzTaCeLoodZ8jiBE3o9rA==",
       "dev": true,
       "license": "ISC"
     },
@@ -2199,9 +2317,9 @@
       "license": "MIT"
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.17.1",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.17.1.tgz",
-      "integrity": "sha512-LMHl3dXhTcfv8gM4kEzIUeTQ+7fpdA0l2tUf34BddXPkz2A5xJ5L/Pchd5BL6rdccM9QGvu0sWZzK1Z1t4wwyg==",
+      "version": "5.18.1",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.18.1.tgz",
+      "integrity": "sha512-ZSW3ma5GkcQBIpwZTSRAI8N71Uuwgs93IezB7mf7R60tC8ZbJideoDNKjHn2O9KIlx6rkGTTEk1xUCK2E1Y2Yg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2237,13 +2355,58 @@
         "node": ">=4"
       }
     },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/es-module-lexer": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.5.4.tgz",
-      "integrity": "sha512-MVNK56NiMrOwitFB7cqDwq0CQutbw+0BvLshJSse0MUNU+y1FC3bUS/AQg7oUng+/wKrrki7JfmwtVHkVfPLlw==",
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz",
+      "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-set-tostringtag": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
+      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.6",
+        "has-tostringtag": "^1.0.2",
+        "hasown": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/escalade": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
@@ -2417,16 +2580,16 @@
       "license": "MIT"
     },
     "node_modules/fast-glob": {
-      "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.2.tgz",
-      "integrity": "sha512-oX2ruAFQwf/Orj8m737Y5adxDQO0LAB7/S5MnxCdTNDd4p6BsyIVsv9JQsATbTSq8KHRpLwIHbVlUNatxd+1Ow==",
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
+      "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==",
       "license": "MIT",
       "dependencies": {
         "@nodelib/fs.stat": "^2.0.2",
         "@nodelib/fs.walk": "^1.2.3",
         "glob-parent": "^5.1.2",
         "merge2": "^1.3.0",
-        "micromatch": "^4.0.4"
+        "micromatch": "^4.0.8"
       },
       "engines": {
         "node": ">=8.6.0"
@@ -2459,11 +2622,21 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.0.1.tgz",
-      "integrity": "sha512-MWipKbbYiYI0UC7cl8m/i/IWTqfC8YXsqjzybjddLsFjStroQzsHXkc73JutMvBiXmOvapk+axIl79ig5t55Bw==",
+      "version": "3.0.6",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.0.6.tgz",
+      "integrity": "sha512-Atfo14OibSv5wAp4VWNsFYE1AchQRTv9cBGWET4pZWHzYshFSS9NQI6I57rdKn9croWVMbYFbLhJ+yJvmZIIHw==",
       "dev": true,
-      "license": "MIT"
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
     },
     "node_modules/fastest-levenshtein": {
       "version": "1.0.16",
@@ -2476,9 +2649,9 @@
       }
     },
     "node_modules/fastq": {
-      "version": "1.17.1",
-      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.17.1.tgz",
-      "integrity": "sha512-sRVD3lWVIXWg6By68ZN7vho9a1pQcN/WBFaAAsDDFzlJjvoGx0P8z7V1t72grFJfJhu3YPZBuu25f7Kaw2jN1w==",
+      "version": "1.19.1",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.19.1.tgz",
+      "integrity": "sha512-GwLTyxkCXjXbxqIhTsMI2Nui8huMPtnxg7krajPJAjnEG/iiOS7i+zCtWGZR9G0NBKbXKh6X9m9UIsYX/N6vvQ==",
       "license": "ISC",
       "dependencies": {
         "reusify": "^1.0.4"
@@ -2524,12 +2697,12 @@
       }
     },
     "node_modules/foreground-child": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.0.tgz",
-      "integrity": "sha512-Ld2g8rrAyMYFXBhEqMz8ZAHBi4J4uS1i/CxGMDnjyFWddMXLVcDp051DZfu+t7+ab7Wv6SMqpWmyFIj5UbfFvg==",
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
+      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
       "license": "ISC",
       "dependencies": {
-        "cross-spawn": "^7.0.0",
+        "cross-spawn": "^7.0.6",
         "signal-exit": "^4.0.1"
       },
       "engines": {
@@ -2540,15 +2713,17 @@
       }
     },
     "node_modules/form-data": {
-      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.1.tgz",
-      "integrity": "sha512-m21N3WOmEEURgk6B9GLOE4RuWOFf28Lhh9qGYeNlGq4VDXUlJy2th2slBNU8Gp8EzloYZOibZJ7t5ecIrFSjVA==",
+      "version": "2.5.3",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.3.tgz",
+      "integrity": "sha512-XHIrMD0NpDrNM/Ckf7XJiBbLl57KEhT3+i3yY+eWm+cqYZJQTZrKo8Y8AWKnuV5GT4scfuUGt9LzNoIx3dU1nQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
-        "combined-stream": "^1.0.6",
-        "mime-types": "^2.1.12"
+        "combined-stream": "^1.0.8",
+        "es-set-tostringtag": "^2.1.0",
+        "mime-types": "^2.1.35",
+        "safe-buffer": "^5.2.1"
       },
       "engines": {
         "node": ">= 0.12"
@@ -2619,16 +2794,52 @@
         "node": "*"
       }
     },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/get-uri": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/get-uri/-/get-uri-6.0.3.tgz",
-      "integrity": "sha512-BzUrJBS9EcUb4cFol8r4W3v1cPsSyajLSthNkz5BxbpDcHN5tIrM10E2eNvfnvBn3DaT3DUgx0OpsBKkaOpanw==",
+      "version": "6.0.4",
+      "resolved": "https://registry.npmjs.org/get-uri/-/get-uri-6.0.4.tgz",
+      "integrity": "sha512-E1b1lFFLvLgak2whF2xDBcOy6NLVGZBqqjJjsIhvopKfWWEi64pLVTWWehV8KlLerZkfNTA95sTe2OdJKm1OzQ==",
       "license": "MIT",
       "dependencies": {
         "basic-ftp": "^5.0.2",
         "data-uri-to-buffer": "^6.0.2",
-        "debug": "^4.3.4",
-        "fs-extra": "^11.2.0"
+        "debug": "^4.3.4"
       },
       "engines": {
         "node": ">= 14"
@@ -2690,18 +2901,18 @@
       }
     },
     "node_modules/globby": {
-      "version": "14.0.2",
-      "resolved": "https://registry.npmjs.org/globby/-/globby-14.0.2.tgz",
-      "integrity": "sha512-s3Fq41ZVh7vbbe2PN3nrW7yC7U7MFVc5c98/iTl9c2GawNMKx/J648KQRW6WKkuU8GIbbh2IXfIRQjOZnXcTnw==",
+      "version": "14.1.0",
+      "resolved": "https://registry.npmjs.org/globby/-/globby-14.1.0.tgz",
+      "integrity": "sha512-0Ia46fDOaT7k4og1PDW4YbodWWr3scS2vAr2lTbsplOt2WkKp0vQbkI9wKis/T5LV/dqPjO3bpS/z6GTJB82LA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@sindresorhus/merge-streams": "^2.1.0",
-        "fast-glob": "^3.3.2",
-        "ignore": "^5.2.4",
-        "path-type": "^5.0.0",
+        "fast-glob": "^3.3.3",
+        "ignore": "^7.0.3",
+        "path-type": "^6.0.0",
         "slash": "^5.1.0",
-        "unicorn-magic": "^0.1.0"
+        "unicorn-magic": "^0.3.0"
       },
       "engines": {
         "node": ">=18"
@@ -2710,6 +2921,18 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/graceful-fs": {
       "version": "4.2.11",
       "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
@@ -2726,6 +2949,33 @@
         "node": ">=8"
       }
     },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-tostringtag": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
+      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
+      "license": "MIT",
+      "dependencies": {
+        "has-symbols": "^1.0.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/hasown": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
@@ -2811,9 +3061,9 @@
       }
     },
     "node_modules/ignore": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
-      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+      "version": "7.0.4",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.4.tgz",
+      "integrity": "sha512-gJzzk+PQNznz8ysRrC0aOkBNVRBDtE1n53IqyqEf3PXrYwomFs5q4pGMizBMJF+ykh03insJ27hB8gSrD2Hn8A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2821,12 +3071,12 @@
       }
     },
     "node_modules/import-in-the-middle": {
-      "version": "1.11.0",
-      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-1.11.0.tgz",
-      "integrity": "sha512-5DimNQGoe0pLUHbR9qK84iWaWjjbsxiqXnw6Qz64+azRgleqv9k2kTt5fw7QsOpmaGYtuxxursnPPsnTKEx10Q==",
+      "version": "1.14.0",
+      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-1.14.0.tgz",
+      "integrity": "sha512-g5zLT0HaztRJWysayWYiUq/7E5H825QIiecMD2pI5QO7Wzr847l6GDvPvmZaDIdrDtS2w7qRczywxiK6SL5vRw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "acorn": "^8.8.2",
+        "acorn": "^8.14.0",
         "acorn-import-attributes": "^1.9.5",
         "cjs-module-lexer": "^1.2.2",
         "module-details-from-path": "^1.0.3"
@@ -2914,9 +3164,9 @@
       }
     },
     "node_modules/is-core-module": {
-      "version": "2.15.1",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.15.1.tgz",
-      "integrity": "sha512-z0vtXSwucUJtANQWldhbtbt7BnL0vxiFjIdDLAatwhDYty2bad6s+rijD6Ri4YuYJubLzIJLUidCh09e1djEVQ==",
+      "version": "2.16.1",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz",
+      "integrity": "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==",
       "license": "MIT",
       "dependencies": {
         "hasown": "^2.0.2"
@@ -3088,9 +3338,9 @@
       "license": "MIT"
     },
     "node_modules/jsdoc": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/jsdoc/-/jsdoc-4.0.3.tgz",
-      "integrity": "sha512-Nu7Sf35kXJ1MWDZIMAuATRQTg1iIPdzh7tqJ6jjvaU/GfDf+qi5UV8zJR3Mo+/pYFvm8mzay4+6O5EWigaQBQw==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/jsdoc/-/jsdoc-4.0.4.tgz",
+      "integrity": "sha512-zeFezwyXeG4syyYHbvh1A967IAqq/67yXtXvuL5wnqCkFZe8I0vKfm+EO+YEvLguo6w9CDUbrAXVtJSHh2E8rw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3250,6 +3500,7 @@
       "version": "4.4.2",
       "resolved": "https://registry.npmjs.org/lodash.get/-/lodash.get-4.4.2.tgz",
       "integrity": "sha512-z+Uw/vLuy6gQe8cfaFWD7p0wVv8fJl3mbzXh33RS+0oW2wvUqiRXiQ69gLWSLpgB5/6sU+r6BlQR0MBILadqTQ==",
+      "deprecated": "This package is deprecated. Use the optional chaining (?.) operator instead.",
       "dev": true,
       "license": "MIT"
     },
@@ -3271,9 +3522,9 @@
       }
     },
     "node_modules/long": {
-      "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/long/-/long-5.2.3.tgz",
-      "integrity": "sha512-lcHwpNoggQTObv5apGNCTdJrO69eHOZMi4BNC+rTLER8iHAqGrUVeLh/irVIM7zTw2bOXA8T6uNPeujwOLg/2Q==",
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
+      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
       "license": "Apache-2.0"
     },
     "node_modules/loupe": {
@@ -3344,6 +3595,15 @@
         "node": ">= 12"
       }
     },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/mdurl": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-2.0.0.tgz",
@@ -3554,9 +3814,9 @@
       }
     },
     "node_modules/module-details-from-path": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/module-details-from-path/-/module-details-from-path-1.0.3.tgz",
-      "integrity": "sha512-ySViT69/76t8VhE1xXHK6Ch4NcDd26gx0MzKXLO+F7NOtnqH68d9zF94nT8ZWSxXh8ELOERsnJO/sWt1xZYw5A==",
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/module-details-from-path/-/module-details-from-path-1.0.4.tgz",
+      "integrity": "sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w==",
       "license": "MIT"
     },
     "node_modules/ms": {
@@ -3596,9 +3856,9 @@
       }
     },
     "node_modules/nise/node_modules/@sinonjs/fake-timers": {
-      "version": "13.0.2",
-      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-13.0.2.tgz",
-      "integrity": "sha512-4Bb+oqXZTSTZ1q27Izly9lv8B9dlV61CROxPiVtywwzv5SnytJqhvYe6FclHYuXml4cd1VHPo1zd5PmTeJozvA==",
+      "version": "13.0.5",
+      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-13.0.5.tgz",
+      "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -3606,9 +3866,9 @@
       }
     },
     "node_modules/node-releases": {
-      "version": "2.0.18",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.18.tgz",
-      "integrity": "sha512-d9VeXT4SJ7ZeOqGX6R5EM022wpL+eWPooLI+5UpWn2jCT1aosUQEhQP214x33Wkwx3JQMvIm+tIoVOdodFS40g==",
+      "version": "2.0.19",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.19.tgz",
+      "integrity": "sha512-xxOWJsBKtzAq7DY0J+DTzuz58K8e7sJbdgwkbMWQe8UYB6ekmsQ45q0M/tJDsGaZmbC+l7n57UV8Hl5tHxO9uw==",
       "dev": true,
       "license": "MIT"
     },
@@ -3708,32 +3968,29 @@
       }
     },
     "node_modules/pac-proxy-agent": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/pac-proxy-agent/-/pac-proxy-agent-7.0.2.tgz",
-      "integrity": "sha512-BFi3vZnO9X5Qt6NRz7ZOaPja3ic0PhlsmCRYLOpN11+mWBCR6XJDqW5RF3j8jm4WGGQZtBA+bTfxYzeKW73eHg==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/pac-proxy-agent/-/pac-proxy-agent-7.2.0.tgz",
+      "integrity": "sha512-TEB8ESquiLMc0lV8vcd5Ql/JAKAoyzHFXaStwjkzpOpC5Yv+pIzLfHvjTSdf3vpa2bMiUQrg9i6276yn8666aA==",
       "license": "MIT",
       "dependencies": {
         "@tootallnate/quickjs-emscripten": "^0.23.0",
-        "agent-base": "^7.0.2",
+        "agent-base": "^7.1.2",
         "debug": "^4.3.4",
         "get-uri": "^6.0.1",
         "http-proxy-agent": "^7.0.0",
-        "https-proxy-agent": "^7.0.5",
+        "https-proxy-agent": "^7.0.6",
         "pac-resolver": "^7.0.1",
-        "socks-proxy-agent": "^8.0.4"
+        "socks-proxy-agent": "^8.0.5"
       },
       "engines": {
         "node": ">= 14"
       }
     },
     "node_modules/pac-proxy-agent/node_modules/agent-base": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.1.tgz",
-      "integrity": "sha512-H0TSyFNDMomMNJQBn8wFV5YC/2eJ+VXECwOadZJT554xP6cODZHPX3H9QMQECxvrgiSOP1pHjy1sMWQVYJOUOA==",
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.3.tgz",
+      "integrity": "sha512-jRR5wdylq8CkOe6hei19GGZnxM6rBGwFl3Bg0YItGDimvjGtAvdZk4Pu6Cl4u4Igsws4a1fd1Vq3ezrhn4KmFw==",
       "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.4"
-      },
       "engines": {
         "node": ">= 14"
       }
@@ -3752,12 +4009,12 @@
       }
     },
     "node_modules/pac-proxy-agent/node_modules/https-proxy-agent": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.5.tgz",
-      "integrity": "sha512-1e4Wqeblerz+tMKPIq2EMGiiWW1dIjZOksyHWSUm1rmuvw/how9hBHZ38lAGj5ID4Ik6EdkOw7NmWPy6LAwalw==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "^7.0.2",
+        "agent-base": "^7.1.2",
         "debug": "4"
       },
       "engines": {
@@ -3778,9 +4035,9 @@
       }
     },
     "node_modules/package-json-from-dist": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.0.tgz",
-      "integrity": "sha512-dATvCeZN/8wQsGywez1mzHtTlP22H8OEfPrVMLNr4/eGa+ijtLn/6M5f0dY8UKNrC2O9UCU6SSoG3qRKnt7STw==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
+      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
       "license": "BlueOak-1.0.0"
     },
     "node_modules/parseley": {
@@ -3838,9 +4095,9 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.1.0.tgz",
-      "integrity": "sha512-Bqn3vc8CMHty6zuD+tG23s6v2kwxslHEhTj4eYaVKGIEB+YX/2wd0/rgXLFD9G9id9KCtbVy/3ZgmvZjpa0UdQ==",
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.2.0.tgz",
+      "integrity": "sha512-TdrF7fW9Rphjq4RjrW0Kp2AW0Ahwu9sRGTkS6bvDi0SCwZlEZYmcfDbEsTz8RVk0EHIS/Vd1bv3JhG+1xZuAyQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3848,13 +4105,13 @@
       }
     },
     "node_modules/path-type": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/path-type/-/path-type-5.0.0.tgz",
-      "integrity": "sha512-5HviZNaZcfqP95rwpv+1HDgUamezbqdSYTyzjTvwtJSnIH+3vnbmWsItli8OFEndS984VT55M3jduxZbX351gg==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/path-type/-/path-type-6.0.0.tgz",
+      "integrity": "sha512-Vj7sf++t5pBD637NSfkxpHSMfWaeig5+DKWLhcqIYx6mWQz5hdJTGDVMQiJcw1ZYkhs7AazKDGpRVji1LJCZUQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -3880,9 +4137,9 @@
       }
     },
     "node_modules/picocolors": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.0.tgz",
-      "integrity": "sha512-TQ92mBOW0l3LeMeyLV6mzy/kWr8lkd/hp3mTg7wYK7zJhuBStmGMBG0BdeDZS/dZx1IukaX6Bk11zcln25o1Aw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
       "dev": true,
       "license": "ISC"
     },
@@ -4070,32 +4327,29 @@
       }
     },
     "node_modules/proxy-agent": {
-      "version": "6.4.0",
-      "resolved": "https://registry.npmjs.org/proxy-agent/-/proxy-agent-6.4.0.tgz",
-      "integrity": "sha512-u0piLU+nCOHMgGjRbimiXmA9kM/L9EHh3zL81xCdp7m+Y2pHIsnmbdDoEDoAz5geaonNR6q6+yOPQs6n4T6sBQ==",
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/proxy-agent/-/proxy-agent-6.5.0.tgz",
+      "integrity": "sha512-TmatMXdr2KlRiA2CyDu8GqR8EjahTG3aY3nXjdzFyoZbmB8hrBsTyMezhULIXKnC0jpfjlmiZ3+EaCzoInSu/A==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "^7.0.2",
+        "agent-base": "^7.1.2",
         "debug": "^4.3.4",
         "http-proxy-agent": "^7.0.1",
-        "https-proxy-agent": "^7.0.3",
+        "https-proxy-agent": "^7.0.6",
         "lru-cache": "^7.14.1",
-        "pac-proxy-agent": "^7.0.1",
+        "pac-proxy-agent": "^7.1.0",
         "proxy-from-env": "^1.1.0",
-        "socks-proxy-agent": "^8.0.2"
+        "socks-proxy-agent": "^8.0.5"
       },
       "engines": {
         "node": ">= 14"
       }
     },
     "node_modules/proxy-agent/node_modules/agent-base": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.1.tgz",
-      "integrity": "sha512-H0TSyFNDMomMNJQBn8wFV5YC/2eJ+VXECwOadZJT554xP6cODZHPX3H9QMQECxvrgiSOP1pHjy1sMWQVYJOUOA==",
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.3.tgz",
+      "integrity": "sha512-jRR5wdylq8CkOe6hei19GGZnxM6rBGwFl3Bg0YItGDimvjGtAvdZk4Pu6Cl4u4Igsws4a1fd1Vq3ezrhn4KmFw==",
       "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.4"
-      },
       "engines": {
         "node": ">= 14"
       }
@@ -4114,12 +4368,12 @@
       }
     },
     "node_modules/proxy-agent/node_modules/https-proxy-agent": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.5.tgz",
-      "integrity": "sha512-1e4Wqeblerz+tMKPIq2EMGiiWW1dIjZOksyHWSUm1rmuvw/how9hBHZ38lAGj5ID4Ik6EdkOw7NmWPy6LAwalw==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "^7.0.2",
+        "agent-base": "^7.1.2",
         "debug": "4"
       },
       "engines": {
@@ -4238,9 +4492,9 @@
       }
     },
     "node_modules/require-in-the-middle": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-7.4.0.tgz",
-      "integrity": "sha512-X34iHADNbNDfr6OTStIAHWSAvvKQRYgLO6duASaVf7J2VA3lvmNYboAHOuLC2huav1IwgZJtyEcJCKVzFxOSMQ==",
+      "version": "7.5.2",
+      "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-7.5.2.tgz",
+      "integrity": "sha512-gAZ+kLqBdHarXB64XpAe2VCjB7rIRv+mU8tfRWziHRJ5umKsIHN2tLLv6EtMw7WCdP19S0ERVMldNvxYCHnhSQ==",
       "license": "MIT",
       "dependencies": {
         "debug": "^4.3.5",
@@ -4262,18 +4516,21 @@
       }
     },
     "node_modules/resolve": {
-      "version": "1.22.8",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.8.tgz",
-      "integrity": "sha512-oKWePCxqpd6FlLvGV1VU0x7bkPmmCNolxzjMf4NczoDnQcIWrAF+cPtZn5i6n+RfD2d9i0tzpKnG6Yk168yIyw==",
+      "version": "1.22.10",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.10.tgz",
+      "integrity": "sha512-NPRy+/ncIMeDlTAsuqwKIiferiawhefFJtkNSW0qZJEqMEb+qBt/77B/jGeeek+F0uOeN05CDa6HXbbIgtVX4w==",
       "license": "MIT",
       "dependencies": {
-        "is-core-module": "^2.13.0",
+        "is-core-module": "^2.16.0",
         "path-parse": "^1.0.7",
         "supports-preserve-symlinks-flag": "^1.0.0"
       },
       "bin": {
         "resolve": "bin/resolve"
       },
+      "engines": {
+        "node": ">= 0.4"
+      },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
       }
@@ -4302,9 +4559,9 @@
       }
     },
     "node_modules/reusify": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.0.4.tgz",
-      "integrity": "sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz",
+      "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==",
       "license": "MIT",
       "engines": {
         "iojs": ">=1.0.0",
@@ -4356,9 +4613,9 @@
       "license": "MIT"
     },
     "node_modules/schema-utils": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.2.0.tgz",
-      "integrity": "sha512-L0jRsrPpjdckP3oPug3/VxNKt2trR8TcabrM6FOAAlvC/9Phcmm+cuAgTlxBqdBR1WJx7Naj9WHw+aOmheSVbw==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.3.2.tgz",
+      "integrity": "sha512-Gn/JaSk/Mt9gYubxTtSn/QCV4em9mpAPiR1rqy/Ocu19u/G9J5WWdNoUT4SiV6mFC3y6cxyFcFwdzPM3FgxGAQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4368,7 +4625,7 @@
         "ajv-keywords": "^5.1.0"
       },
       "engines": {
-        "node": ">= 12.13.0"
+        "node": ">= 10.13.0"
       },
       "funding": {
         "type": "opencollective",
@@ -4527,9 +4784,9 @@
       }
     },
     "node_modules/socks": {
-      "version": "2.8.3",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.3.tgz",
-      "integrity": "sha512-l5x7VUUWbjVFbafGLxPWkYsHIhEvmF85tbIeFZWc8ZPtoMyybuEhL7Jye/ooC4/d48FgOjSJXgsF/AJPYCW8Zw==",
+      "version": "2.8.4",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.4.tgz",
+      "integrity": "sha512-D3YaD0aRxR3mEcqnidIs7ReYJFVzWdd6fXJYUM8ixcQcJRGTka/b3saV0KflYhyVJXKhb947GndU35SxYNResQ==",
       "license": "MIT",
       "dependencies": {
         "ip-address": "^9.0.5",
@@ -4541,12 +4798,12 @@
       }
     },
     "node_modules/socks-proxy-agent": {
-      "version": "8.0.4",
-      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.4.tgz",
-      "integrity": "sha512-GNAq/eg8Udq2x0eNiFkr9gRg5bA7PXEWagQdeRX4cPSG+X/8V38v637gim9bjFptMk1QWsCTr0ttrJEiXbNnRw==",
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
+      "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "^7.1.1",
+        "agent-base": "^7.1.2",
         "debug": "^4.3.4",
         "socks": "^2.8.3"
       },
@@ -4555,13 +4812,10 @@
       }
     },
     "node_modules/socks-proxy-agent/node_modules/agent-base": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.1.tgz",
-      "integrity": "sha512-H0TSyFNDMomMNJQBn8wFV5YC/2eJ+VXECwOadZJT554xP6cODZHPX3H9QMQECxvrgiSOP1pHjy1sMWQVYJOUOA==",
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.3.tgz",
+      "integrity": "sha512-jRR5wdylq8CkOe6hei19GGZnxM6rBGwFl3Bg0YItGDimvjGtAvdZk4Pu6Cl4u4Igsws4a1fd1Vq3ezrhn4KmFw==",
       "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.4"
-      },
       "engines": {
         "node": ">= 14"
       }
@@ -4737,9 +4991,9 @@
       }
     },
     "node_modules/tapable": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.2.1.tgz",
-      "integrity": "sha512-GNzQvQTOIP6RyTfE2Qxb8ZVlNmw0n88vp1szwWRimP02mnTsx3Wtn5qRdqY9w2XduFNUgvOwhNnQsjwCp+kqaQ==",
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.2.2.tgz",
+      "integrity": "sha512-Re10+NauLTMCudc7T5WLFLAwDhQ0JWdrMK+9B2M8zR5hRExKmsRDCBA7/aV/pNJFltmBFO5BAMlQFi/vq3nKOg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4747,14 +5001,14 @@
       }
     },
     "node_modules/terser": {
-      "version": "5.32.0",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.32.0.tgz",
-      "integrity": "sha512-v3Gtw3IzpBJ0ugkxEX8U0W6+TnPKRRCWGh1jC/iM/e3Ki5+qvO1L1EAZ56bZasc64aXHwRHNIQEzm6//i5cemQ==",
+      "version": "5.40.0",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.40.0.tgz",
+      "integrity": "sha512-cfeKl/jjwSR5ar7d0FGmave9hFGJT8obyo0z+CrQOylLDbk7X81nPU6vq9VORa5jU30SkDnT2FXjLbR8HLP+xA==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
         "@jridgewell/source-map": "^0.3.3",
-        "acorn": "^8.8.2",
+        "acorn": "^8.14.0",
         "commander": "^2.20.0",
         "source-map-support": "~0.5.20"
       },
@@ -4766,17 +5020,17 @@
       }
     },
     "node_modules/terser-webpack-plugin": {
-      "version": "5.3.10",
-      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.10.tgz",
-      "integrity": "sha512-BKFPWlPDndPs+NGGCr1U59t0XScL5317Y0UReNrHaw9/FwhPENlq6bfgs+4yPfyP51vqC1bQ4rp1EfXW5ZSH9w==",
+      "version": "5.3.14",
+      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.14.tgz",
+      "integrity": "sha512-vkZjpUjb6OMS7dhV+tILUW6BhpDR7P2L/aQSAv+Uwk+m8KATX9EccViHTJR2qDtACKPIYndLGCyl3FMo+r2LMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jridgewell/trace-mapping": "^0.3.20",
+        "@jridgewell/trace-mapping": "^0.3.25",
         "jest-worker": "^27.4.5",
-        "schema-utils": "^3.1.1",
-        "serialize-javascript": "^6.0.1",
-        "terser": "^5.26.0"
+        "schema-utils": "^4.3.0",
+        "serialize-javascript": "^6.0.2",
+        "terser": "^5.31.1"
       },
       "engines": {
         "node": ">= 10.13.0"
@@ -4800,59 +5054,6 @@
         }
       }
     },
-    "node_modules/terser-webpack-plugin/node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "fast-deep-equal": "^3.1.1",
-        "fast-json-stable-stringify": "^2.0.0",
-        "json-schema-traverse": "^0.4.1",
-        "uri-js": "^4.2.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/terser-webpack-plugin/node_modules/ajv-keywords": {
-      "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
-      "integrity": "sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ==",
-      "dev": true,
-      "license": "MIT",
-      "peerDependencies": {
-        "ajv": "^6.9.1"
-      }
-    },
-    "node_modules/terser-webpack-plugin/node_modules/json-schema-traverse": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/terser-webpack-plugin/node_modules/schema-utils": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-3.3.0.tgz",
-      "integrity": "sha512-pN/yOAvcC+5rQ5nERGuwrjLlYvLTbCibnZ1I7B1LaiAz9BRBlE9GMgE/eqV30P7aJQUf7Ddimy/RsbYO/GrVGg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/json-schema": "^7.0.8",
-        "ajv": "^6.12.5",
-        "ajv-keywords": "^3.5.2"
-      },
-      "engines": {
-        "node": ">= 10.13.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/webpack"
-      }
-    },
     "node_modules/terser/node_modules/commander": {
       "version": "2.20.3",
       "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
@@ -4870,16 +5071,6 @@
         "node": ">=14.14"
       }
     },
-    "node_modules/to-fast-properties": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
-      "integrity": "sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -4893,9 +5084,9 @@
       }
     },
     "node_modules/ts-loader": {
-      "version": "9.5.1",
-      "resolved": "https://registry.npmjs.org/ts-loader/-/ts-loader-9.5.1.tgz",
-      "integrity": "sha512-rNH3sK9kGZcH9dYzC7CewQm4NtxJTjSEVRJ2DyBZR7f8/wcta+iV44UPCXc5+nzDzivKtlzV6c9P4e+oFhDLYg==",
+      "version": "9.5.2",
+      "resolved": "https://registry.npmjs.org/ts-loader/-/ts-loader-9.5.2.tgz",
+      "integrity": "sha512-Qo4piXvOTWcMGIgRiuFa6nHNm+54HbYaZCKqc9eeZCLRy3XqafQgwX2F7mofrbJG3g7EEb+lkiR+z2Lic2s3Zw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4978,9 +5169,9 @@
       }
     },
     "node_modules/tslib": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.7.0.tgz",
-      "integrity": "sha512-gLXCKdN1/j47AiHiOkJN69hJmcbGTHI0ImLmbYLHykhgeN0jVGola9yVjFgzCUklsZQMW55o+dW7IXv3RCXDzA==",
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
       "license": "0BSD"
     },
     "node_modules/turndown": {
@@ -5068,9 +5259,9 @@
       "license": "MIT"
     },
     "node_modules/unicorn-magic": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/unicorn-magic/-/unicorn-magic-0.1.0.tgz",
-      "integrity": "sha512-lRfVq8fE8gz6QMBuDM6a+LO3IAzTi05H6gCVaUpir2E1Rwpo4ZUog45KpNXKC/Mn3Yb9UDuHumeFTo9iV/D9FQ==",
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/unicorn-magic/-/unicorn-magic-0.3.0.tgz",
+      "integrity": "sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5090,9 +5281,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.0.tgz",
-      "integrity": "sha512-EdRAaAyk2cUE1wOf2DkEhzxqOQvFOoRJFNS6NeyJ01Gp2beMRpBAINjM2iDXE3KCuKhwnvHIQCJm6ThL2Z+HzQ==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.3.tgz",
+      "integrity": "sha512-UxhIZQ+QInVdunkDAaiazvvT/+fXL5Osr0JZlJulepYu6Jd7qJtDZjlur0emRlT71EN3ScPoE7gvsuIKKNavKw==",
       "dev": true,
       "funding": [
         {
@@ -5110,8 +5301,8 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "escalade": "^3.1.2",
-        "picocolors": "^1.0.1"
+        "escalade": "^3.2.0",
+        "picocolors": "^1.1.1"
       },
       "bin": {
         "update-browserslist-db": "cli.js"
@@ -5147,29 +5338,41 @@
       "license": "MIT"
     },
     "node_modules/vscode-css-languageservice": {
-      "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/vscode-css-languageservice/-/vscode-css-languageservice-6.3.1.tgz",
-      "integrity": "sha512-1BzTBuJfwMc3A0uX4JBdJgoxp74cjj4q2mDJdp49yD/GuAq4X0k5WtK6fNcMYr+FfJ9nqgR6lpfCSZDkARJ5qQ==",
+      "version": "6.3.5",
+      "resolved": "https://registry.npmjs.org/vscode-css-languageservice/-/vscode-css-languageservice-6.3.5.tgz",
+      "integrity": "sha512-ehEIMXYPYEz/5Svi2raL9OKLpBt5dSAdoCFoLpo0TVFKrVpDemyuQwS3c3D552z/qQCg3pMp8oOLMObY6M3ajQ==",
       "license": "MIT",
       "dependencies": {
         "@vscode/l10n": "^0.0.18",
         "vscode-languageserver-textdocument": "^1.0.12",
         "vscode-languageserver-types": "3.17.5",
-        "vscode-uri": "^3.0.8"
+        "vscode-uri": "^3.1.0"
       }
     },
+    "node_modules/vscode-css-languageservice/node_modules/vscode-uri": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/vscode-uri/-/vscode-uri-3.1.0.tgz",
+      "integrity": "sha512-/BpdSx+yCQGnCvecbyXdxHDkuk55/G3xwnC0GqY4gmQ3j+A+g8kzzgB4Nk/SINjqn6+waqw3EgbVF2QKExkRxQ==",
+      "license": "MIT"
+    },
     "node_modules/vscode-html-languageservice": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/vscode-html-languageservice/-/vscode-html-languageservice-5.3.1.tgz",
-      "integrity": "sha512-ysUh4hFeW/WOWz/TO9gm08xigiSsV/FOAZ+DolgJfeLftna54YdmZ4A+lIn46RbdO3/Qv5QHTn1ZGqmrXQhZyA==",
+      "version": "5.4.0",
+      "resolved": "https://registry.npmjs.org/vscode-html-languageservice/-/vscode-html-languageservice-5.4.0.tgz",
+      "integrity": "sha512-9/cbc90BSYCghmHI7/VbWettHZdC7WYpz2g5gBK6UDUI1MkZbM773Q12uAYJx9jzAiNHPpyo6KzcwmcnugncAQ==",
       "license": "MIT",
       "dependencies": {
         "@vscode/l10n": "^0.0.18",
         "vscode-languageserver-textdocument": "^1.0.12",
         "vscode-languageserver-types": "^3.17.5",
-        "vscode-uri": "^3.0.8"
+        "vscode-uri": "^3.1.0"
       }
     },
+    "node_modules/vscode-html-languageservice/node_modules/vscode-uri": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/vscode-uri/-/vscode-uri-3.1.0.tgz",
+      "integrity": "sha512-/BpdSx+yCQGnCvecbyXdxHDkuk55/G3xwnC0GqY4gmQ3j+A+g8kzzgB4Nk/SINjqn6+waqw3EgbVF2QKExkRxQ==",
+      "license": "MIT"
+    },
     "node_modules/vscode-jsonrpc": {
       "version": "8.2.0",
       "resolved": "https://registry.npmjs.org/vscode-jsonrpc/-/vscode-jsonrpc-8.2.0.tgz",
@@ -5220,9 +5423,9 @@
       "license": "MIT"
     },
     "node_modules/watchpack": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.2.tgz",
-      "integrity": "sha512-TnbFSbcOCcDgjZ4piURLCbJ3nJhznVh9kw6F6iokjiFPl8ONxe9A6nMDVXDiNbrSfLILs6vB07F7wLBrwPYzJw==",
+      "version": "2.4.4",
+      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.4.tgz",
+      "integrity": "sha512-c5EGNOiyxxV5qmTtAB7rbiXxi1ooX1pQKMLX/MIabJjRA0SJBQOjKF+KSVfHkr9U1cADPon0mRiVe/riyaiDUA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5343,9 +5546,9 @@
       }
     },
     "node_modules/webpack-sources": {
-      "version": "3.2.3",
-      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.2.3.tgz",
-      "integrity": "sha512-/DyMEOrDgLKKIG0fmvtz+4dUX/3Ghozwgm6iPp8KRhvn+eQf9+Q7GWxVNMk3+uCPWfdXYC4ExGBckIXdFEfH1w==",
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.3.0.tgz",
+      "integrity": "sha512-77R0RDmJfj9dyv5p3bM5pOHa+X8/ZkO9c7kpDstigkC4nIDobadsfSGCwB4bKhMVxqAok8tajaoR8rirM7+VFQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5670,4 +5873,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/pkgs/by-name/in/intelephense/package.nix b/pkgs/by-name/in/intelephense/package.nix
index 6e9264f214eb..59cc4987a51c 100644
--- a/pkgs/by-name/in/intelephense/package.nix
+++ b/pkgs/by-name/in/intelephense/package.nix
@@ -19,7 +19,7 @@ buildNpmPackage {
     cp ${./package-lock.json} package-lock.json
   '';
 
-  npmDepsHash = "sha256-FNafLqlyGopWShr0Ltw1YqaY/Ik9TAT8oHO6tQBTiQc=";
+  npmDepsHash = "sha256-UFtJRYKk3unStsdoOa6Dwn41KnaDxdWXTNBcIQkZaLI=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/in/intentrace/package.nix b/pkgs/by-name/in/intentrace/package.nix
index 1059839fe172..d7f6f4dfcf7a 100644
--- a/pkgs/by-name/in/intentrace/package.nix
+++ b/pkgs/by-name/in/intentrace/package.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "0.9.8";
+  version = "0.10.3";
 in
 rustPlatform.buildRustPackage {
   inherit version;
@@ -15,11 +15,11 @@ rustPlatform.buildRustPackage {
     owner = "sectordistrict";
     repo = "intentrace";
     tag = "v${version}";
-    hash = "sha256-5QARHw9Z4+wYrxaAuSt9WjGR6qvSWAFIMdNOzE6FqfU=";
+    hash = "sha256-mCMARX6y9thgYJpDRFnWGZJupdk+EhVaBGbwABYYjNA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-m4kLpJeqAvDI8/1gjqRVkbOvyfcLfwi0y2iavvm25jw=";
+  cargoHash = "sha256-BZ+P6UT9bBuAX9zyZCA+fI2pUtV8b98oPcQDwJV5HC8=";
 
   meta = {
     description = "Prettified Linux syscall tracing tool (like strace)";
diff --git a/pkgs/by-name/in/interactsh/package.nix b/pkgs/by-name/in/interactsh/package.nix
index 400a8dd80c45..55dbde69955c 100644
--- a/pkgs/by-name/in/interactsh/package.nix
+++ b/pkgs/by-name/in/interactsh/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
-    repo = pname;
+    repo = "interactsh";
     tag = "v${version}";
     hash = "sha256-28d+ghJ/A/dg6aeypqPF4EAhDp8k3yXLYylxnQR/J+M=";
   };
diff --git a/pkgs/by-name/in/invoice2data/package.nix b/pkgs/by-name/in/invoice2data/package.nix
index e6871a503bba..5463d0abb1d7 100644
--- a/pkgs/by-name/in/invoice2data/package.nix
+++ b/pkgs/by-name/in/invoice2data/package.nix
@@ -16,7 +16,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "invoice-x";
-    repo = pname;
+    repo = "invoice2data";
     rev = "v${version}";
     hash = "sha256-pAvkp8xkHYi/7ymbxaT7/Jhu44j2P8emm8GyXC6IBnI=";
   };
diff --git a/pkgs/by-name/ip/ipgrep/package.nix b/pkgs/by-name/ip/ipgrep/package.nix
index 42e8a9305614..e91ad3a99b97 100644
--- a/pkgs/by-name/ip/ipgrep/package.nix
+++ b/pkgs/by-name/ip/ipgrep/package.nix
@@ -12,15 +12,15 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "jedisct1";
-    repo = pname;
+    repo = "ipgrep";
     rev = version;
     hash = "sha256-NrhcUFQM+L66KaDRRpAoC+z5s54a+1fqEepTRXVZ5Qs=";
   };
 
   patchPhase = ''
-    mkdir -p ${pname}
+    mkdir -p ipgrep
     substituteInPlace setup.py \
-      --replace "'scripts': []" "'scripts': { '${pname}.py' }"
+      --replace "'scripts': []" "'scripts': { 'ipgrep.py' }"
   '';
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/ip/iprover/package.nix b/pkgs/by-name/ip/iprover/package.nix
index 8ea0e36a7588..a4d043540cef 100644
--- a/pkgs/by-name/ip/iprover/package.nix
+++ b/pkgs/by-name/ip/iprover/package.nix
@@ -8,13 +8,13 @@
   zlib,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "iprover";
   version = "3.8.1";
 
   src = fetchFromGitLab {
     owner = "korovin";
-    repo = pname;
+    repo = "iprover";
     rev = "f61edb113b705606c7314dc4dce0687832c3169f";
     hash = "sha256-XXqbEoYKjoktE3ZBEIEFjLhA1B75zhnfPszhe8SvbI8=";
   };
diff --git a/pkgs/by-name/ip/ipv6calc/package.nix b/pkgs/by-name/ip/ipv6calc/package.nix
index 5c8a4cb73be0..78b613046583 100644
--- a/pkgs/by-name/ip/ipv6calc/package.nix
+++ b/pkgs/by-name/ip/ipv6calc/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "pbiering";
-    repo = pname;
+    repo = "ipv6calc";
     rev = version;
     sha256 = "sha256-zQ8azAd6q7mY3Jtx58cI2OL/xNZi+aA03y5QWHWjnm4=";
   };
diff --git a/pkgs/by-name/ir/irpf/package.nix b/pkgs/by-name/ir/irpf/package.nix
index ec23c1b4a292..c5aeda60c640 100644
--- a/pkgs/by-name/ir/irpf/package.nix
+++ b/pkgs/by-name/ir/irpf/package.nix
@@ -13,7 +13,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "irpf";
-  version = "2025-1.2";
+  version = "2025-1.3";
 
   # https://www.gov.br/receitafederal/pt-br/centrais-de-conteudo/download/pgd/dirpf
   # Para outros sistemas operacionais -> Multi
@@ -23,7 +23,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     in
     fetchzip {
       url = "https://downloadirpf.receita.fazenda.gov.br/irpf/${year}/irpf/arquivos/IRPF${finalAttrs.version}.zip";
-      hash = "sha256-RlkDioXLcD3wHm9DDLw42QCRT4z0rEwlM0sGMORxk/A=";
+      hash = "sha256-BWCxnKPvkijVkXfbA1iVbdcgLZqY5SAzASqnzdjXwiw=";
     };
 
   passthru.updateScript = writeScript "update-irpf" ''
diff --git a/pkgs/by-name/is/isolyzer/package.nix b/pkgs/by-name/is/isolyzer/package.nix
index 0b9e85e88389..b1a1edf6ffaa 100644
--- a/pkgs/by-name/is/isolyzer/package.nix
+++ b/pkgs/by-name/is/isolyzer/package.nix
@@ -10,7 +10,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "KBNLresearch";
-    repo = pname;
+    repo = "isolyzer";
     tag = version;
     sha256 = "sha256-NqkjnEwpaoyguG5GLscKS9UQGtF9N4jUL5JhrMtKCFE=";
   };
diff --git a/pkgs/by-name/is/ispc/package.nix b/pkgs/by-name/is/ispc/package.nix
index 9cafb0c7f323..4c9d2a10717b 100644
--- a/pkgs/by-name/is/ispc/package.nix
+++ b/pkgs/by-name/is/ispc/package.nix
@@ -26,8 +26,8 @@ stdenv.mkDerivation rec {
   dontFixCmake = true; # https://github.com/NixOS/nixpkgs/pull/232522#issuecomment-2133803566
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "ispc";
+    repo = "ispc";
     rev = "v${version}";
     sha256 = "sha256-nNiAlQ+MLkOV0/xLafsUNPV5HKCIqWCD2Fo8ChgFJMk=";
   };
diff --git a/pkgs/by-name/iw/iwgtk/package.nix b/pkgs/by-name/iw/iwgtk/package.nix
index e080ce417423..c665a6488bb0 100644
--- a/pkgs/by-name/iw/iwgtk/package.nix
+++ b/pkgs/by-name/iw/iwgtk/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "j-lentz";
-    repo = pname;
+    repo = "iwgtk";
     rev = "v${version}";
     sha256 = "sha256-/Nxti4PfYVLnIiBgtAuR3KGI8dULszuSdTp+2DzBfbs=";
   };
diff --git a/pkgs/by-name/ja/jaeles/package.nix b/pkgs/by-name/ja/jaeles/package.nix
index 66955ed66824..24fe58d2a16e 100644
--- a/pkgs/by-name/ja/jaeles/package.nix
+++ b/pkgs/by-name/ja/jaeles/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jaeles-project";
-    repo = pname;
+    repo = "jaeles";
     rev = "beta-v${version}";
     hash = "sha256-IGvIjO1nCilg2sPyScGTH5Zmv0rORlGwRv3NRxQk+aM=";
   };
diff --git a/pkgs/by-name/jb/jbrowse/package.nix b/pkgs/by-name/jb/jbrowse/package.nix
index 2bf37b7f2f25..fdc5c8e88d9d 100644
--- a/pkgs/by-name/jb/jbrowse/package.nix
+++ b/pkgs/by-name/jb/jbrowse/package.nix
@@ -6,11 +6,11 @@
 
 let
   pname = "jbrowse";
-  version = "3.4.0";
+  version = "3.5.0";
 
   src = fetchurl {
     url = "https://github.com/GMOD/jbrowse-components/releases/download/v${version}/jbrowse-desktop-v${version}-linux.AppImage";
-    sha256 = "sha256-u7ZVHn1/HUyV27yGx0HZeWgdm4NuVK8ZH0UogrmbxOo=";
+    sha256 = "sha256-UAuKbfvJuCDIaERFVYo6rdhBG2ycp87ZnCrVPLDDv9g=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/by-name/je/jefferson/package.nix b/pkgs/by-name/je/jefferson/package.nix
index d1b95dd2df0a..bc307d7a290c 100644
--- a/pkgs/by-name/je/jefferson/package.nix
+++ b/pkgs/by-name/je/jefferson/package.nix
@@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "onekey-sec";
-    repo = pname;
+    repo = "jefferson";
     rev = "v${version}";
     hash = "sha256-6eh4i9N3aArU8+W8K341pp9J0QYEojDiMrEc8yax4SY=";
   };
diff --git a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
index d419d6b38f42..aa6749446c02 100644
--- a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
+++ b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "7.1.1-1";
+  version = "7.1.1-3";
 in
 
 (ffmpeg_7-full.override {
@@ -14,7 +14,7 @@ in
     owner = "jellyfin";
     repo = "jellyfin-ffmpeg";
     rev = "v${version}";
-    hash = "sha256-gu6+fOCcrGIZiR2hMl9tk97OmCmewOVJibz52DNpL1Q=";
+    hash = "sha256-pJLIhXDPDRhEqzmc1bXViSTSnRifFhMlixkEbGA0GRE=";
   };
 }).overrideAttrs
   (old: {
diff --git a/pkgs/by-name/ji/jiq/package.nix b/pkgs/by-name/ji/jiq/package.nix
index 4123eed59212..153396aad1bf 100644
--- a/pkgs/by-name/ji/jiq/package.nix
+++ b/pkgs/by-name/ji/jiq/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "fiatjaf";
-    repo = pname;
+    repo = "jiq";
     rev = "v${version}";
     sha256 = "sha256-txhttYngN+dofA3Yp3gZUZPRRZWGug9ysXq1Q0RP7ig=";
   };
diff --git a/pkgs/by-name/jo/jobber/package.nix b/pkgs/by-name/jo/jobber/package.nix
index bd8a5967a4a4..42a79db01ba4 100644
--- a/pkgs/by-name/jo/jobber/package.nix
+++ b/pkgs/by-name/jo/jobber/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "dshearer";
-    repo = pname;
+    repo = "jobber";
     rev = "v${version}";
     hash = "sha256-mLYyrscvT/VK9ehwkPUq4RbwHb+6Wjvt7ZXk/fI0HT4=";
   };
diff --git a/pkgs/by-name/jo/jose/package.nix b/pkgs/by-name/jo/jose/package.nix
index ce721eaa9a41..921334d07910 100644
--- a/pkgs/by-name/jo/jose/package.nix
+++ b/pkgs/by-name/jo/jose/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "latchset";
-    repo = pname;
+    repo = "jose";
     rev = "v${version}";
     hash = "sha256-rMNPJaCtVpbwIkMQzBNpmRct6S/NelTwjmsuB0RP6R8=";
   };
diff --git a/pkgs/by-name/jo/joystickwake/package.nix b/pkgs/by-name/jo/joystickwake/package.nix
index a5dad0c49c61..da51d233a279 100644
--- a/pkgs/by-name/jo/joystickwake/package.nix
+++ b/pkgs/by-name/jo/joystickwake/package.nix
@@ -9,7 +9,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "foresto";
-    repo = pname;
+    repo = "joystickwake";
     tag = "v${version}";
     sha256 = "sha256-vSvIpbcDIbRyitVjx3wNSxt5vTIZ9/NPWokOJt0p6oQ=";
   };
diff --git a/pkgs/by-name/jp/jpegoptim/package.nix b/pkgs/by-name/jp/jpegoptim/package.nix
index c842b9217123..a3c0f25a555f 100644
--- a/pkgs/by-name/jp/jpegoptim/package.nix
+++ b/pkgs/by-name/jp/jpegoptim/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "tjko";
-    repo = pname;
+    repo = "jpegoptim";
     rev = "v${version}";
     sha256 = "sha256-3p3kcUur1u09ROdKXG5H8eilu463Rzbn2yfYo5o6+KM=";
   };
diff --git a/pkgs/by-name/jq/jqp/package.nix b/pkgs/by-name/jq/jqp/package.nix
index eb4fe385a9cb..25dc3356d295 100644
--- a/pkgs/by-name/jq/jqp/package.nix
+++ b/pkgs/by-name/jq/jqp/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "noahgorstein";
-    repo = pname;
+    repo = "jqp";
     rev = "v${version}";
     sha256 = "sha256-i22qALVa8EUaTwgN6DocGJArNyOvkQbFuH++EQKBuIc=";
   };
diff --git a/pkgs/by-name/js/json2hcl/package.nix b/pkgs/by-name/js/json2hcl/package.nix
index 8c4883faa1ef..e2c0ca873768 100644
--- a/pkgs/by-name/js/json2hcl/package.nix
+++ b/pkgs/by-name/js/json2hcl/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "kvz";
-    repo = pname;
+    repo = "json2hcl";
     rev = "v${version}";
     sha256 = "sha256-h7DudYVWvDRCbjoIgOoCIudf7ZfUfWXp5OJ4ni0nm6c=";
   };
diff --git a/pkgs/by-name/js/jsubfinder/package.nix b/pkgs/by-name/js/jsubfinder/package.nix
index e4664bd4b0a5..c43380704cfd 100644
--- a/pkgs/by-name/js/jsubfinder/package.nix
+++ b/pkgs/by-name/js/jsubfinder/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "jsubfinder";
   version = "unstable-2022-05-31";
 
   src = fetchFromGitHub {
     owner = "ThreatUnkown";
-    repo = pname;
+    repo = "jsubfinder";
     rev = "e21de1ebc174bb69485f1c224e8063c77d87e4ad";
     hash = "sha256-QjRYJyk0uFGa6FCCYK9SIJhoyam4ALsQJ26DsmbNk8s=";
   };
diff --git a/pkgs/by-name/jt/jtag-remote-server/package.nix b/pkgs/by-name/jt/jtag-remote-server/package.nix
index 62ec3bea3033..25e7ed6aa9a9 100644
--- a/pkgs/by-name/jt/jtag-remote-server/package.nix
+++ b/pkgs/by-name/jt/jtag-remote-server/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "jiegec";
-    repo = pname;
+    repo = "jtag-remote-server";
     rev = "v${version}";
     hash = "sha256-qtgO0BO2hvWi/E2RzGTTuQynKbh7/OLeoLcm60dqro8=";
   };
diff --git a/pkgs/by-name/ju/juicefs/package.nix b/pkgs/by-name/ju/juicefs/package.nix
index ed05bc42ad40..bfcf85230495 100644
--- a/pkgs/by-name/ju/juicefs/package.nix
+++ b/pkgs/by-name/ju/juicefs/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "juicedata";
-    repo = pname;
+    repo = "juicefs";
     rev = "v${version}";
     hash = "sha256-qe8uhSSLeOsr0FmgoOVeZeIpP4Bv5/Viz5N90PGdc9o=";
   };
diff --git a/pkgs/by-name/ju/juicity/package.nix b/pkgs/by-name/ju/juicity/package.nix
index 55311296d837..b56c7c507546 100644
--- a/pkgs/by-name/ju/juicity/package.nix
+++ b/pkgs/by-name/ju/juicity/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "juicity";
-    repo = pname;
+    repo = "juicity";
     rev = "v${version}";
     hash = "sha256-4sej/nb7d58+hSCaD6KIfDsqiGmgECPIbRKR65TbMBM=";
   };
diff --git a/pkgs/by-name/ju/jump/package.nix b/pkgs/by-name/ju/jump/package.nix
index 02b97d03a839..8b8c57d69a44 100644
--- a/pkgs/by-name/ju/jump/package.nix
+++ b/pkgs/by-name/ju/jump/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "gsamokovarov";
-    repo = pname;
+    repo = "jump";
     rev = "v${version}";
     hash = "sha256-nlCuotEiAX2+xx7T8jWZo2p4LNLhWXDdcU6DxJprgx0=";
   };
diff --git a/pkgs/by-name/ju/jumpnbump/package.nix b/pkgs/by-name/ju/jumpnbump/package.nix
index f16770f3f1c3..3e2fca36cae9 100644
--- a/pkgs/by-name/ju/jumpnbump/package.nix
+++ b/pkgs/by-name/ju/jumpnbump/package.nix
@@ -19,7 +19,7 @@ let
   };
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "jumpnbump";
   version = "1.70-dev";
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitLab {
     domain = "gitlab.com";
     owner = "LibreGames";
-    repo = pname;
+    repo = "jumpnbump";
     rev = "5744738211ca691444f779aafee3537fb3562516";
     sha256 = "0f1k26jicmb95bx19wgcdpwsbbl343i7mqqqc2z9lkb8drlsyqcy";
   };
diff --git a/pkgs/by-name/k2/k2tf/package.nix b/pkgs/by-name/k2/k2tf/package.nix
index 1bf631353dcb..4a277964bf83 100644
--- a/pkgs/by-name/k2/k2tf/package.nix
+++ b/pkgs/by-name/k2/k2tf/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "sl1pm4t";
-    repo = pname;
+    repo = "k2tf";
     rev = "v${version}";
     sha256 = "sha256-zkkRzCTZCvbwBj4oIhTo5d3PvqLMJPzT3zV9jU3PEJs=";
   };
diff --git a/pkgs/by-name/k6/k6/package.nix b/pkgs/by-name/k6/k6/package.nix
index 14c95944d2c5..2f56f74cf0b4 100644
--- a/pkgs/by-name/k6/k6/package.nix
+++ b/pkgs/by-name/k6/k6/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "grafana";
-    repo = pname;
+    repo = "k6";
     rev = "v${version}";
     hash = "sha256-wU/Kelv/5N86xHJT6E5dfdzBgSYiTYZJ8rkjLyU7RAo=";
   };
diff --git a/pkgs/by-name/k8/k8s-manifest-sigstore/package.nix b/pkgs/by-name/k8/k8s-manifest-sigstore/package.nix
index 17c12ad9e415..1427093e9429 100644
--- a/pkgs/by-name/k8/k8s-manifest-sigstore/package.nix
+++ b/pkgs/by-name/k8/k8s-manifest-sigstore/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "sigstore";
-    repo = pname;
+    repo = "k8s-manifest-sigstore";
     rev = "v${version}";
     hash = "sha256-BDBkPXDg9DruIt5f7RrpStFeuTGiOOpsb6JiKaCTOOk=";
   };
diff --git a/pkgs/by-name/ka/kafkactl/package.nix b/pkgs/by-name/ka/kafkactl/package.nix
index 632045acd8c7..1f44ad1d3794 100644
--- a/pkgs/by-name/ka/kafkactl/package.nix
+++ b/pkgs/by-name/ka/kafkactl/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "deviceinsight";
-    repo = pname;
+    repo = "kafkactl";
     tag = "v${version}";
     hash = "sha256-e21q4nXN3aI21PbNltRb6mzj67WmLsvJc8J0s7rrQBo=";
   };
diff --git a/pkgs/by-name/ka/kanit-font/package.nix b/pkgs/by-name/ka/kanit-font/package.nix
index 37d15748987e..bf20539f0cdf 100644
--- a/pkgs/by-name/ka/kanit-font/package.nix
+++ b/pkgs/by-name/ka/kanit-font/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "kanit";
   version = "unstable-2020-06-16";
 
   src = fetchFromGitHub {
     owner = "cadsondemak";
-    repo = pname;
+    repo = "kanit";
     rev = "467dfe842185681d8042cd608b8291199dd37cda";
     sha256 = "0p0klb0376r8ki4ap2j99j7jcsq6wgb7m1hf3j1dkncwm7ikmg3h";
   };
diff --git a/pkgs/by-name/ka/kas/package.nix b/pkgs/by-name/ka/kas/package.nix
index 07f99199c362..4e9ffd436471 100644
--- a/pkgs/by-name/ka/kas/package.nix
+++ b/pkgs/by-name/ka/kas/package.nix
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "siemens";
-    repo = pname;
+    repo = "kas";
     tag = version;
     hash = "sha256-P2I3lLa8kuCORdlrwcswrWFwOA8lW2WL4Apv/2T7+f8=";
   };
@@ -32,7 +32,7 @@ python3.pkgs.buildPythonApplication rec {
   doCheck = false;
   passthru.tests.version = testers.testVersion {
     package = kas;
-    command = "${pname} --version";
+    command = "kas --version";
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/kb/kb/package.nix b/pkgs/by-name/kb/kb/package.nix
index f05cf7e325b6..0496ebc96c76 100644
--- a/pkgs/by-name/kb/kb/package.nix
+++ b/pkgs/by-name/kb/kb/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "gnebbia";
-    repo = pname;
+    repo = "kb";
     rev = "v${version}";
     hash = "sha256-K8EAqZbl2e0h03fFwaKIclZTZARDQp1tRo44znxwW0I=";
   };
diff --git a/pkgs/by-name/kb/kbs2/package.nix b/pkgs/by-name/kb/kbs2/package.nix
index 22263bb8d5b5..dd0724da5c2c 100644
--- a/pkgs/by-name/kb/kbs2/package.nix
+++ b/pkgs/by-name/kb/kbs2/package.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "woodruffw";
-    repo = pname;
+    repo = "kbs2";
     rev = "v${version}";
     hash = "sha256-o8/ENAWzVqs7rokST6xnyu9Q/pKqq/UnKWOFRuIuGes=";
   };
diff --git a/pkgs/by-name/kd/kdash/package.nix b/pkgs/by-name/kd/kdash/package.nix
index 6648c35bf91d..8f46aea198a1 100644
--- a/pkgs/by-name/kd/kdash/package.nix
+++ b/pkgs/by-name/kd/kdash/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "kdash-rs";
-    repo = pname;
+    repo = "kdash";
     rev = "v${version}";
     sha256 = "sha256-fFpdWVoeWycnp/hRw2S+hYpnXYmCs+rLqcZdmSSMGwI=";
   };
diff --git a/pkgs/by-name/kd/kdigger/package.nix b/pkgs/by-name/kd/kdigger/package.nix
index db021362c0fa..62c5b159052e 100644
--- a/pkgs/by-name/kd/kdigger/package.nix
+++ b/pkgs/by-name/kd/kdigger/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "quarkslab";
-    repo = pname;
+    repo = "kdigger";
     rev = "v${version}";
     hash = "sha256-hpLhtTENtOBQjm+CZRAcx1BG9831JUFIsLL57wZIrso=";
     # populate values that require us to use git. By doing this in postFetch we
diff --git a/pkgs/by-name/kd/kdsingleapplication/package.nix b/pkgs/by-name/kd/kdsingleapplication/package.nix
index ed53ce683a4a..cbf7906a0d0f 100644
--- a/pkgs/by-name/kd/kdsingleapplication/package.nix
+++ b/pkgs/by-name/kd/kdsingleapplication/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "KDSingleApplication";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "KDAB";
     repo = "KDSingleApplication";
     tag = "v${version}";
-    hash = "sha256-Ymm+qOZMWULg7u5xEpGzcAfIrbWBQ3jsndnFSnh6/PA=";
+    hash = "sha256-rglt89Gw6OHXXVOEwf0TxezDzyHEvWepeGeup7fBlLs=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ke/kepubify/package.nix b/pkgs/by-name/ke/kepubify/package.nix
index 901cd6cba8b0..d7c25858569f 100644
--- a/pkgs/by-name/ke/kepubify/package.nix
+++ b/pkgs/by-name/ke/kepubify/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "pgaskin";
-    repo = pname;
+    repo = "kepubify";
     rev = "v${version}";
     sha256 = "sha256-H6W+C5twXit7Z9hLIJKAftbnvYDA9HAb9tR6yeQGRKI=";
   };
diff --git a/pkgs/by-name/ke/kernel-hardening-checker/package.nix b/pkgs/by-name/ke/kernel-hardening-checker/package.nix
index 05a25f28ad7c..911e25da1f83 100644
--- a/pkgs/by-name/ke/kernel-hardening-checker/package.nix
+++ b/pkgs/by-name/ke/kernel-hardening-checker/package.nix
@@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "a13xp0p0v";
-    repo = pname;
+    repo = "kernel-hardening-checker";
     rev = "v${version}";
     hash = "sha256-gxDaOb14jFezxe/qHZF3e52o7obVL0WMIKxwIj3j5QY=";
   };
diff --git a/pkgs/by-name/ke/kestrel/package.nix b/pkgs/by-name/ke/kestrel/package.nix
index 85ee8fbd1a9b..75655bb1e9cd 100644
--- a/pkgs/by-name/ke/kestrel/package.nix
+++ b/pkgs/by-name/ke/kestrel/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "finfet";
-    repo = pname;
+    repo = "kestrel";
     rev = "v${version}";
     hash = "sha256-bKQBOk9yUqgnufRyyqXatsRHpesbM49rAkz0dD5XE80=";
   };
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
 
   postInstall = ''
     installManPage docs/man/kestrel.1
-    installShellCompletion --bash --name ${pname} completion/kestrel.bash-completion
+    installShellCompletion --bash --name kestrel completion/kestrel.bash-completion
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/ke/keycard-cli/package.nix b/pkgs/by-name/ke/keycard-cli/package.nix
index d30150600405..8a4276aeeb08 100644
--- a/pkgs/by-name/ke/keycard-cli/package.nix
+++ b/pkgs/by-name/ke/keycard-cli/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "status-im";
-    repo = pname;
+    repo = "keycard-cli";
     rev = version;
     hash = "sha256-K2XxajprpPjfIs8rrnf2coIEQjPnir9/U0fTvqV2++g=";
   };
diff --git a/pkgs/by-name/ke/keymapviz/package.nix b/pkgs/by-name/ke/keymapviz/package.nix
index 1188ce02597b..35d41675d7b6 100644
--- a/pkgs/by-name/ke/keymapviz/package.nix
+++ b/pkgs/by-name/ke/keymapviz/package.nix
@@ -10,7 +10,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "yskoht";
-    repo = pname;
+    repo = "keymapviz";
     rev = version;
     sha256 = "sha256-eCvwgco22uPEDDsT8FfTRon1xCGy5p1PBp0pDfNprMs=";
   };
diff --git a/pkgs/by-name/ki/ki/package.nix b/pkgs/by-name/ki/ki/package.nix
index 6c2e6ca89451..cbe61fc23dd3 100644
--- a/pkgs/by-name/ki/ki/package.nix
+++ b/pkgs/by-name/ki/ki/package.nix
@@ -6,7 +6,7 @@
   anki,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "ki";
   version = "0-unstable-2023-11-08";
 
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "langfield";
-    repo = pname;
+    repo = "ki";
     rev = "eb32fbd3229dc1a60bcc76a937ad63f3eb869f65";
     hash = "sha256-5mQhJhvJQC9835goL3t3DRbD+c4P3KxnOflxvqmxL58=";
   };
diff --git a/pkgs/by-name/ki/kicli/package.nix b/pkgs/by-name/ki/kicli/package.nix
index 96d4bd9ef5e3..8b0f75711291 100644
--- a/pkgs/by-name/ki/kicli/package.nix
+++ b/pkgs/by-name/ki/kicli/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "anned20";
-    repo = pname;
+    repo = "kicli";
     rev = "v${version}";
     hash = "sha256-NXKo+zK5HnuMXRsi29lEhoo7RCagwvZdXXPNfp4pHtc=";
   };
diff --git a/pkgs/by-name/ki/kiterunner/package.nix b/pkgs/by-name/ki/kiterunner/package.nix
index 8ac6052fa452..6c553ad05b3f 100644
--- a/pkgs/by-name/ki/kiterunner/package.nix
+++ b/pkgs/by-name/ki/kiterunner/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "assetnote";
-    repo = pname;
+    repo = "kiterunner";
     rev = "v${version}";
     hash = "sha256-vIYPpkbqyk0zH10DGp2FF0aI4lFpsZavulBIiR/3kiA=";
   };
diff --git a/pkgs/by-name/ko/ko/package.nix b/pkgs/by-name/ko/ko/package.nix
index 4f366d7b20a9..16a4fbda5483 100644
--- a/pkgs/by-name/ko/ko/package.nix
+++ b/pkgs/by-name/ko/ko/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ko-build";
-    repo = pname;
+    repo = "ko";
     tag = "v${version}";
     hash = "sha256-fAdogzNCuz8vHWF1UOFmDKSRXbNvY5knKIhfJzXNGzw=";
   };
diff --git a/pkgs/by-name/ko/konstraint/package.nix b/pkgs/by-name/ko/konstraint/package.nix
index 44becc8b0e33..22897ace00d0 100644
--- a/pkgs/by-name/ko/konstraint/package.nix
+++ b/pkgs/by-name/ko/konstraint/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "plexsystems";
-    repo = pname;
+    repo = "konstraint";
     rev = "v${version}";
     sha256 = "sha256-DwfBevCGDndMfQiwiuV+J95prhbxT20siMrEY2T7h1w=";
   };
diff --git a/pkgs/by-name/ko/kor/package.nix b/pkgs/by-name/ko/kor/package.nix
index 9f419bb5e0ff..a449704d27ca 100644
--- a/pkgs/by-name/ko/kor/package.nix
+++ b/pkgs/by-name/ko/kor/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "yonahd";
-    repo = pname;
+    repo = "kor";
     rev = "v${version}";
     hash = "sha256-jqP2GsqliltjabbHDcRseMz7TOWl9YofAG/4Y7ADub8=";
   };
diff --git a/pkgs/by-name/kp/kpt/package.nix b/pkgs/by-name/kp/kpt/package.nix
index 9c6de4cb3b80..51f9aa72542f 100644
--- a/pkgs/by-name/kp/kpt/package.nix
+++ b/pkgs/by-name/kp/kpt/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "kptdev";
-    repo = pname;
+    repo = "kpt";
     rev = "v${version}";
     hash = "sha256-MVrJUsMpt1L56ezy2b2G6Aac9kpe4QgfSosR+PeTuBQ=";
   };
diff --git a/pkgs/by-name/kr/krelay/package.nix b/pkgs/by-name/kr/krelay/package.nix
index 6390e08d1f54..f5eea3642d8d 100644
--- a/pkgs/by-name/kr/krelay/package.nix
+++ b/pkgs/by-name/kr/krelay/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "knight42";
-    repo = pname;
+    repo = "krelay";
     rev = "v${version}";
     hash = "sha256-TonkGh4j+xLGgSpspCedg6c2NpIZIzp5pv8VtWFssPk=";
   };
diff --git a/pkgs/by-name/kr/krill/package.nix b/pkgs/by-name/kr/krill/package.nix
index 2cd92aa24622..dd0a41318895 100644
--- a/pkgs/by-name/kr/krill/package.nix
+++ b/pkgs/by-name/kr/krill/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
-    repo = pname;
+    repo = "krill";
     rev = "v${version}";
     hash = "sha256-U7uanUE/xdmXqtpvnG6b+oDKamNZkCH04OCy3Y5UIhQ=";
   };
diff --git a/pkgs/by-name/kt/ktop/package.nix b/pkgs/by-name/kt/ktop/package.nix
index 964a44fffe1d..e14803723192 100644
--- a/pkgs/by-name/kt/ktop/package.nix
+++ b/pkgs/by-name/kt/ktop/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "vladimirvivien";
-    repo = pname;
+    repo = "ktop";
     rev = "v${version}";
     hash = "sha256-oxyEkDY53HjBgjWRajlcg+8Kx092lyLkPgOJleioO7o=";
   };
diff --git a/pkgs/by-name/ku/kube-bench/package.nix b/pkgs/by-name/ku/kube-bench/package.nix
index 16680335753b..a721d942b887 100644
--- a/pkgs/by-name/ku/kube-bench/package.nix
+++ b/pkgs/by-name/ku/kube-bench/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
-    repo = pname;
+    repo = "kube-bench";
     tag = "v${version}";
     hash = "sha256-+4OSqFU9IoVN9lsw6CwVL60OU4e/yCBZfnD8qqNLTtk=";
   };
diff --git a/pkgs/by-name/ku/kube-capacity/package.nix b/pkgs/by-name/ku/kube-capacity/package.nix
index aad7b224c8dc..3c4124ab17e0 100644
--- a/pkgs/by-name/ku/kube-capacity/package.nix
+++ b/pkgs/by-name/ku/kube-capacity/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "robscott";
-    repo = pname;
+    repo = "kube-capacity";
     sha256 = "sha256-zAwCz4Qs1OF/CdSmy9p4X9hL9iNkAH/EeSU2GgekzV8=";
   };
 
diff --git a/pkgs/by-name/ku/kube-hunter/package.nix b/pkgs/by-name/ku/kube-hunter/package.nix
index 47402ae08555..b67c59cb2fed 100644
--- a/pkgs/by-name/ku/kube-hunter/package.nix
+++ b/pkgs/by-name/ku/kube-hunter/package.nix
@@ -10,7 +10,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
-    repo = pname;
+    repo = "kube-hunter";
     tag = "v${version}";
     sha256 = "sha256-+M8P/VSF9SKPvq+yNPjokyhggY7hzQ9qLLhkiTNbJls=";
   };
diff --git a/pkgs/by-name/ku/kube-linter/package.nix b/pkgs/by-name/ku/kube-linter/package.nix
index e71fc89c0ff9..7ea0b65a581f 100644
--- a/pkgs/by-name/ku/kube-linter/package.nix
+++ b/pkgs/by-name/ku/kube-linter/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "stackrox";
-    repo = pname;
+    repo = "kube-linter";
     rev = "v${version}";
     sha256 = "sha256-abfNzf+84BWHpvLQZKyzl7WBt7UHj2zqzKq3VCqAwwY=";
   };
diff --git a/pkgs/by-name/ku/kube-router/package.nix b/pkgs/by-name/ku/kube-router/package.nix
index ceec86cf0626..c3dabfa29fd9 100644
--- a/pkgs/by-name/ku/kube-router/package.nix
+++ b/pkgs/by-name/ku/kube-router/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "cloudnativelabs";
-    repo = pname;
+    repo = "kube-router";
     rev = "v${version}";
     hash = "sha256-bt7BnMIq/tkRL8d1pf/gG5qBq/1yiMqXDpBrIICo780=";
   };
diff --git a/pkgs/by-name/ku/kube-score/package.nix b/pkgs/by-name/ku/kube-score/package.nix
index 806c79f208ab..121aab8da2b8 100644
--- a/pkgs/by-name/ku/kube-score/package.nix
+++ b/pkgs/by-name/ku/kube-score/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "zegl";
-    repo = pname;
+    repo = "kube-score";
     rev = "v${version}";
     hash = "sha256-ZqhuqPWCfJKi38Jdazr5t5Wulsqzl1D4/81ZTvW10Co=";
   };
diff --git a/pkgs/by-name/ku/kubeclarity/package.nix b/pkgs/by-name/ku/kubeclarity/package.nix
index 7e8a026e7295..6decbb4f611e 100644
--- a/pkgs/by-name/ku/kubeclarity/package.nix
+++ b/pkgs/by-name/ku/kubeclarity/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "openclarity";
-    repo = pname;
+    repo = "kubeclarity";
     tag = "v${version}";
     hash = "sha256-MC9GeJeVG7ROkpmOW2HD/fWMMnHo43q4Du9MzWTk2cg=";
   };
diff --git a/pkgs/by-name/ku/kubeconform/package.nix b/pkgs/by-name/ku/kubeconform/package.nix
index ada2e9adbec2..64725efb1cf1 100644
--- a/pkgs/by-name/ku/kubeconform/package.nix
+++ b/pkgs/by-name/ku/kubeconform/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "yannh";
-    repo = pname;
+    repo = "kubeconform";
     rev = "v${version}";
     sha256 = "sha256-FTUPARckpecz1V/Io4rY6SXhlih3VJr/rTGAiik4ALA=";
   };
diff --git a/pkgs/by-name/ku/kubectl-doctor/package.nix b/pkgs/by-name/ku/kubectl-doctor/package.nix
index c8a6ac0b0a42..039a55757193 100644
--- a/pkgs/by-name/ku/kubectl-doctor/package.nix
+++ b/pkgs/by-name/ku/kubectl-doctor/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "emirozer";
-    repo = pname;
+    repo = "kubectl-doctor";
     rev = version;
     hash = "sha256-yp5OfSDxIASiCgISUVNxfe3dsLukgIoHARVPALIaQfY=";
   };
diff --git a/pkgs/by-name/ku/kubectl-evict-pod/package.nix b/pkgs/by-name/ku/kubectl-evict-pod/package.nix
index 83f3e752a021..e219ebf1ee91 100644
--- a/pkgs/by-name/ku/kubectl-evict-pod/package.nix
+++ b/pkgs/by-name/ku/kubectl-evict-pod/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "rajatjindal";
-    repo = pname;
+    repo = "kubectl-evict-pod";
     rev = "v${version}";
     sha256 = "sha256-Z1NIueonjyO2GHulBbXbsQtX7V/Z95GUoZv9AqjLIR0=";
   };
diff --git a/pkgs/by-name/ku/kubectl-example/package.nix b/pkgs/by-name/ku/kubectl-example/package.nix
index 981fb6e3afcd..9cbc1e666820 100644
--- a/pkgs/by-name/ku/kubectl-example/package.nix
+++ b/pkgs/by-name/ku/kubectl-example/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "seredot";
-    repo = pname;
+    repo = "kubectl-example";
     rev = "v${version}";
     hash = "sha256-YvB4l+7GLSyYWX2Fbk4gT2WLaQpNxeV0aHY3Pg+9LCM=";
   };
diff --git a/pkgs/by-name/ku/kubectl-images/package.nix b/pkgs/by-name/ku/kubectl-images/package.nix
index aac821504bd8..55d0f7e01a3e 100644
--- a/pkgs/by-name/ku/kubectl-images/package.nix
+++ b/pkgs/by-name/ku/kubectl-images/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "chenjiandongx";
-    repo = pname;
+    repo = "kubectl-images";
     rev = "v${version}";
     sha256 = "sha256-FHfj2qRypqQA0Vj9Hq7wuYd0xmpD+IZj3MkwKljQio0=";
   };
diff --git a/pkgs/by-name/ku/kubectl-klock/package.nix b/pkgs/by-name/ku/kubectl-klock/package.nix
index aae2d47da28d..ba056902714d 100644
--- a/pkgs/by-name/ku/kubectl-klock/package.nix
+++ b/pkgs/by-name/ku/kubectl-klock/package.nix
@@ -7,18 +7,24 @@
 
 buildGoModule rec {
   pname = "kubectl-klock";
-  version = "0.7.2";
+  version = "0.8.0";
 
   nativeBuildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
     owner = "applejag";
-    repo = pname;
+    repo = "kubectl-klock";
     rev = "v${version}";
-    hash = "sha256-S7cpVRVboLkU+GgvwozJmfFAO29tKpPlk+r9mbVLxF8=";
+    hash = "sha256-1t/DJ6cTikAl2edJFfDzXAB8OgdZSjk1C7vOGXyTu0U=";
   };
 
-  vendorHash = "sha256-xz1I79FklKNpWdoQdzpXYAnKM+7FJcGn04lKH2E9A50=";
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+  ];
+
+  vendorHash = "sha256-FWfAn3ZWScIXbdv3zwwZxFyMkpzJHZJuhxe22qvv1ac=";
 
   postInstall = ''
     makeWrapper $out/bin/kubectl-klock $out/bin/kubectl_complete-klock --add-flags __complete
diff --git a/pkgs/by-name/ku/kubectl-tree/package.nix b/pkgs/by-name/ku/kubectl-tree/package.nix
index 46b9f9674a7e..206c72dad906 100644
--- a/pkgs/by-name/ku/kubectl-tree/package.nix
+++ b/pkgs/by-name/ku/kubectl-tree/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ahmetb";
-    repo = pname;
+    repo = "kubectl-tree";
     rev = "v${version}";
     sha256 = "sha256-J4/fiTECcTE0N2E+MPrQKE9Msvvm8DLdvLbnDUnUo74=";
   };
diff --git a/pkgs/by-name/ku/kubectl-view-secret/package.nix b/pkgs/by-name/ku/kubectl-view-secret/package.nix
index 63df059f6cb3..678adba5d354 100644
--- a/pkgs/by-name/ku/kubectl-view-secret/package.nix
+++ b/pkgs/by-name/ku/kubectl-view-secret/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "elsesiy";
-    repo = pname;
+    repo = "kubectl-view-secret";
     rev = "v${version}";
     hash = "sha256-l7pyS3eQDETrGCN7+Q0xhm+9Ocpk+qxTNMu4SMq+IDU=";
   };
diff --git a/pkgs/by-name/ku/kubectx/package.nix b/pkgs/by-name/ku/kubectx/package.nix
index 1cfcb192b3d1..2a007665906b 100644
--- a/pkgs/by-name/ku/kubectx/package.nix
+++ b/pkgs/by-name/ku/kubectx/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ahmetb";
-    repo = pname;
+    repo = "kubectx";
     rev = "v${version}";
     hash = "sha256-HVmtUhdMjbkyMpTgbsr5Mm286F9Q7zbc5rOxi7OBZEg=";
   };
diff --git a/pkgs/by-name/ku/kubelogin/package.nix b/pkgs/by-name/ku/kubelogin/package.nix
index 231e15e7e1de..db9c6e79b050 100644
--- a/pkgs/by-name/ku/kubelogin/package.nix
+++ b/pkgs/by-name/ku/kubelogin/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "Azure";
-    repo = pname;
+    repo = "kubelogin";
     rev = "v${version}";
     sha256 = "sha256-aajo43ysA/ItOxFxZbw1i7VQpEm4aqfXFiMUTZt3QDk=";
   };
diff --git a/pkgs/by-name/ku/kubemq-community/package.nix b/pkgs/by-name/ku/kubemq-community/package.nix
index b531534b03b5..e3008d39bf9d 100644
--- a/pkgs/by-name/ku/kubemq-community/package.nix
+++ b/pkgs/by-name/ku/kubemq-community/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
   version = "2.3.7";
   src = fetchFromGitHub {
     owner = "kubemq-io";
-    repo = pname;
+    repo = "kubemq-community";
     rev = "v${version}";
     sha256 = "sha256-oAo/O3T3wtfCumT2kjoyXKfCFHijVzSmxhslaKaeF3Y=";
   };
diff --git a/pkgs/by-name/ku/kubemqctl/package.nix b/pkgs/by-name/ku/kubemqctl/package.nix
index f8d0960db38d..69330987bbb3 100644
--- a/pkgs/by-name/ku/kubemqctl/package.nix
+++ b/pkgs/by-name/ku/kubemqctl/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "kubemq-io";
-    repo = pname;
+    repo = "kubemqctl";
     rev = "v${version}";
     hash = "sha256-PaB5+Sy2ccEQz+wuz88w/M4NXayKA41/ugSPJdtjfiE=";
   };
diff --git a/pkgs/by-name/ku/kubeprompt/package.nix b/pkgs/by-name/ku/kubeprompt/package.nix
index 4b2488f07a4a..20c5370ad9ea 100644
--- a/pkgs/by-name/ku/kubeprompt/package.nix
+++ b/pkgs/by-name/ku/kubeprompt/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jlesquembre";
-    repo = pname;
+    repo = "kubeprompt";
     rev = version;
     hash = "sha256-is6Rz0tw/g4HyGJMTHj+r390HZAytVhfGVRzZ5wKZkU=";
   };
diff --git a/pkgs/by-name/ku/kubernetes-code-generator/package.nix b/pkgs/by-name/ku/kubernetes-code-generator/package.nix
index 006a7ace7cac..aa21573cc988 100644
--- a/pkgs/by-name/ku/kubernetes-code-generator/package.nix
+++ b/pkgs/by-name/ku/kubernetes-code-generator/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "kubernetes";
-    repo = pname;
+    repo = "code-generator";
     rev = "v${version}";
     hash = "sha256-GKF6DXvyZujInOZbV0ePUu71BEl1s/chNTN1PucdIYw=";
   };
diff --git a/pkgs/by-name/ku/kubevpn/package.nix b/pkgs/by-name/ku/kubevpn/package.nix
index 119d07ba0354..a2431e8014cb 100644
--- a/pkgs/by-name/ku/kubevpn/package.nix
+++ b/pkgs/by-name/ku/kubevpn/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "kubevpn";
-  version = "2.7.11";
+  version = "2.7.12";
 
   src = fetchFromGitHub {
     owner = "KubeNetworks";
     repo = "kubevpn";
     rev = "v${version}";
-    hash = "sha256-PqKgBJugibgG/4gGBINuFxWAxSYEKRpPXpofiOKmmIs=";
+    hash = "sha256-Tf0hhhabSP4MxXMb046dBzcjF7T+cmhcCF/1+ZNo1fM=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ku/kubexit/package.nix b/pkgs/by-name/ku/kubexit/package.nix
index 477e380c956c..36e09434ed33 100644
--- a/pkgs/by-name/ku/kubexit/package.nix
+++ b/pkgs/by-name/ku/kubexit/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "karlkfi";
-    repo = pname;
+    repo = "kubexit";
     rev = "v${version}";
     hash = "sha256-Kzom+/Xad6SI9czw4xvmTbJ+bNB9mF2oSq37IFn384U=";
   };
diff --git a/pkgs/by-name/la/lact/package.nix b/pkgs/by-name/la/lact/package.nix
index 8da5d876e930..77a26fa4073f 100644
--- a/pkgs/by-name/la/lact/package.nix
+++ b/pkgs/by-name/la/lact/package.nix
@@ -14,6 +14,7 @@
   coreutils,
   systemdMinimal,
   nix-update-script,
+  nixosTests,
   hwdata,
   fuse3,
   autoAddDriverRunpath,
@@ -58,10 +59,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
         lib.makeLibraryPath [
           vulkan-loader
           libdrm
+          ocl-icd
         ]
       }"
       "-C link-arg=-Wl,--add-needed,${vulkan-loader}/lib/libvulkan.so"
       "-C link-arg=-Wl,--add-needed,${libdrm}/lib/libdrm.so"
+      "-C link-arg=-Wl,--add-needed,${ocl-icd}/lib/libOpenCL.so"
     ]
   );
 
@@ -104,15 +107,20 @@ rustPlatform.buildRustPackage (finalAttrs: {
     patchelf $out/bin/.lact-wrapped \
     --add-needed libvulkan.so \
     --add-needed libdrm.so \
+    --add-needed libOpenCL.so \
     --add-rpath ${
       lib.makeLibraryPath [
         vulkan-loader
         libdrm
+        ocl-icd
       ]
     }
   '';
 
   passthru.updateScript = nix-update-script { };
+  passthru.tests = {
+    inherit (nixosTests) lact;
+  };
 
   meta = {
     description = "Linux GPU Configuration Tool for AMD and NVIDIA";
diff --git a/pkgs/by-name/la/languagetool-rust/package.nix b/pkgs/by-name/la/languagetool-rust/package.nix
index a740365f7a5a..191878d42679 100644
--- a/pkgs/by-name/la/languagetool-rust/package.nix
+++ b/pkgs/by-name/la/languagetool-rust/package.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "jeertmans";
-    repo = pname;
+    repo = "languagetool-rust";
     rev = "v${version}";
     hash = "sha256-8YgSxAF4DA1r7ylj6rx+fGubvT7MeiRQeowuiu0GWwQ=";
   };
diff --git a/pkgs/by-name/la/latex2html/package.nix b/pkgs/by-name/la/latex2html/package.nix
index 73d2ab3f4238..e3a8847e2d35 100644
--- a/pkgs/by-name/la/latex2html/package.nix
+++ b/pkgs/by-name/la/latex2html/package.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
   version = "2025";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "latex2html";
+    repo = "latex2html";
     rev = "v${version}";
     sha256 = "sha256-xylIU2GY/1t9mA8zJzEjHwAIlvVxZmUAUdQ/IXEy+Wg=";
   };
diff --git a/pkgs/by-name/la/laze/package.nix b/pkgs/by-name/la/laze/package.nix
index 7c49d7a0a941..f4dac3b56fc9 100644
--- a/pkgs/by-name/la/laze/package.nix
+++ b/pkgs/by-name/la/laze/package.nix
@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "laze";
-  version = "0.1.35";
+  version = "0.1.36";
 
   src = fetchFromGitHub {
     owner = "kaspar030";
     repo = "laze";
     tag = finalAttrs.version;
-    hash = "sha256-/ACHYaAR9xtC7r5+bn1mXGr1eM3kV0L68+YMRIgxAsI=";
+    hash = "sha256-516VJ6yzQOn8a1ufpxbJ8lCHcs09PVzPmXyWU7F+REk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-xiJz+JEF5feytwYgml+mfrarmLPntKbxCAQQvBnwAkI=";
+  cargoHash = "sha256-vLlkgF8vfL4RbFH7S3pQaAgHs08glHJaIkFIBYLoAWE=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/la/lazygit/package.nix b/pkgs/by-name/la/lazygit/package.nix
index fbb3da058f44..606212d479e2 100644
--- a/pkgs/by-name/la/lazygit/package.nix
+++ b/pkgs/by-name/la/lazygit/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
-    repo = pname;
+    repo = "lazygit";
     tag = "v${version}";
     hash = "sha256-PktxVf+2xOpkZBHlm9oLV4WXoz9bNaXa+cvnI9RCcRA=";
   };
diff --git a/pkgs/by-name/ld/ldapmonitor/package.nix b/pkgs/by-name/ld/ldapmonitor/package.nix
index e44b6d0e02ac..52ded0dc99dc 100644
--- a/pkgs/by-name/ld/ldapmonitor/package.nix
+++ b/pkgs/by-name/ld/ldapmonitor/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "p0dalirius";
-    repo = pname;
+    repo = "ldapmonitor";
     tag = version;
     hash = "sha256-BmTj/6dOUYfia6wO4nvkEW01MIC9TuBk4kYAsVHMsWY=";
   };
diff --git a/pkgs/by-name/ld/ldmud/package.nix b/pkgs/by-name/ld/ldmud/package.nix
index e024c7822a89..71ba320bd654 100644
--- a/pkgs/by-name/ld/ldmud/package.nix
+++ b/pkgs/by-name/ld/ldmud/package.nix
@@ -31,8 +31,8 @@ stdenv.mkDerivation rec {
   version = "3.6.7";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "ldmud";
+    repo = "ldmud";
     rev = version;
     sha256 = "sha256-PkrjP7tSZMaj61Hsn++7+CumhqFPLbf0+eAI6afP9HA=";
   };
diff --git a/pkgs/by-name/le/leanify/package.nix b/pkgs/by-name/le/leanify/package.nix
index e54f4bc74686..11193f2dbf53 100644
--- a/pkgs/by-name/le/leanify/package.nix
+++ b/pkgs/by-name/le/leanify/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation {
   pname = "leanify";
-  version = "unstable-2023-12-17";
+  version = "unstable-2025-05-15";
 
   src = fetchFromGitHub {
     owner = "JayXon";
     repo = "Leanify";
-    rev = "9daa4303cdc03f6b90b72c369e6377c6beb75c39";
-    hash = "sha256-fLazKCQnOT3bN3Kz25Q80RLk54EU5U6HCf6kPLcXn9c=";
+    rev = "42770e600b32962e7110c24b5fcaa8c7c2144b17";
+    hash = "sha256-njfMR2DSKeVh+ZUewall7837E9JY3nhrTxO4LOY1pEo=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -29,7 +29,9 @@ stdenv.mkDerivation {
 
   checkPhase = ''
     runHook preCheck
+
     ./leanify /dev/null
+
     runHook postCheck
   '';
 
diff --git a/pkgs/by-name/le/ledger-live-desktop/package.nix b/pkgs/by-name/le/ledger-live-desktop/package.nix
index b6b3ddeea892..ab9cc2ed715b 100644
--- a/pkgs/by-name/le/ledger-live-desktop/package.nix
+++ b/pkgs/by-name/le/ledger-live-desktop/package.nix
@@ -8,11 +8,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.113.0";
+  version = "2.113.2";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-mF6YwgbqZF5ccJCABoagtEq5WpnhDNFcvij1wL+buF0=";
+    hash = "sha256-jJvIncD1vGZ2t0Rpl42AoVGKPlLGhMsoU91//rxOWnw=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/by-name/le/legendary-heroic/package.nix b/pkgs/by-name/le/legendary-heroic/package.nix
index c0fbd88df158..8aa57c2458e0 100644
--- a/pkgs/by-name/le/legendary-heroic/package.nix
+++ b/pkgs/by-name/le/legendary-heroic/package.nix
@@ -5,7 +5,7 @@
   python3Packages,
 }:
 let
-  version = "0.20.36";
+  version = "0.20.37";
 in
 python3Packages.buildPythonApplication {
   pname = "legendary-heroic";
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication {
     owner = "Heroic-Games-Launcher";
     repo = "legendary";
     rev = version;
-    sha256 = "sha256-+aywgd5RZfkmVuA0MaF2/Ie4a5If/zQxvVCcTfGpQpE=";
+    sha256 = "sha256-mOys7lOPrrzBUBMIM/JvKygFQ/qIGD68BDNigk5BCIo=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/le/lektor/package.nix b/pkgs/by-name/le/lektor/package.nix
index 34c8c28e7cfa..3feca96a4c8c 100644
--- a/pkgs/by-name/le/lektor/package.nix
+++ b/pkgs/by-name/le/lektor/package.nix
@@ -31,7 +31,7 @@ python.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "lektor";
-    repo = pname;
+    repo = "lektor";
     tag = "v${version}";
     # fix for case-insensitive filesystems
     postFetch = ''
diff --git a/pkgs/by-name/le/lemonade/package.nix b/pkgs/by-name/le/lemonade/package.nix
index c402e8a7d2ae..596ffd382a3b 100644
--- a/pkgs/by-name/le/lemonade/package.nix
+++ b/pkgs/by-name/le/lemonade/package.nix
@@ -5,13 +5,13 @@
   fetchpatch,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "lemonade";
   version = "unstable-2021-06-18";
 
   src = fetchFromGitHub {
     owner = "lemonade-command";
-    repo = pname;
+    repo = "lemonade";
     rev = "97ad2f7d63cbe6c696af36a754d399b4be4553bc";
     sha256 = "sha256-77ymkpO/0DE4+m8fnpXGdnLLFxWMnKu2zsqCpQ3wEPM=";
   };
diff --git a/pkgs/by-name/le/lenpaste/package.nix b/pkgs/by-name/le/lenpaste/package.nix
index 757a586b5b38..07670932c23b 100644
--- a/pkgs/by-name/le/lenpaste/package.nix
+++ b/pkgs/by-name/le/lenpaste/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
   src = fetchFromGitea {
     domain = "git.lcomrade.su";
     owner = "root";
-    repo = pname;
+    repo = "lenpaste";
     rev = "v${version}";
     sha256 = "sha256-d+FjfEbInlxUllWIoVLwQRdRWjxBLTpNHYn+oYU3fBc=";
   };
diff --git a/pkgs/by-name/le/leptonica/package.nix b/pkgs/by-name/le/leptonica/package.nix
index c9950cba2174..c4031c912852 100644
--- a/pkgs/by-name/le/leptonica/package.nix
+++ b/pkgs/by-name/le/leptonica/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "DanBloomBerg";
-    repo = pname;
+    repo = "leptonica";
     rev = version;
     hash = "sha256-meiSi0qL4i/KCMe5wsRK1/mbuRLHUb55DDOnxkrXZSs=";
   };
diff --git a/pkgs/by-name/le/lethe/package.nix b/pkgs/by-name/le/lethe/package.nix
index 182258015850..13456c20c78f 100644
--- a/pkgs/by-name/le/lethe/package.nix
+++ b/pkgs/by-name/le/lethe/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "kostassoid";
-    repo = pname;
+    repo = "lethe";
     rev = "v${version}";
     sha256 = "sha256-y2D/80pnpYpTl+q9COTQkvtj9lzBlOWuMcnn5WFnX8E=";
   };
diff --git a/pkgs/by-name/lg/lgpio/package.nix b/pkgs/by-name/lg/lgpio/package.nix
new file mode 100644
index 000000000000..a472ceff3136
--- /dev/null
+++ b/pkgs/by-name/lg/lgpio/package.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  swig,
+  # If we build the python packages, these two are not null
+  buildPythonPackage ? null,
+  lgpioWithoutPython ? null,
+  # When building a python Packages, this specifies the python subproject
+  pyProject ? "",
+}:
+
+let
+  mkDerivation = if pyProject == "" then stdenv.mkDerivation else buildPythonPackage;
+in
+mkDerivation rec {
+  pname = "lgpio";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "joan2937";
+    repo = "lg";
+    tag = "v${version}";
+    hash = "sha256-92lLV+EMuJj4Ul89KIFHkpPxVMr/VvKGEocYSW2tFiE=";
+  };
+
+  nativeBuildInputs = lib.optionals (pyProject == "PY_LGPIO") [
+    swig
+  ];
+
+  preConfigure =
+    if pyProject != "" then
+      ''
+        cd ${pyProject}
+      ''
+    else
+      "";
+  # Emulate ldconfig when building the C API
+  postConfigure =
+    if pyProject == "" then
+      ''
+        substituteInPlace Makefile \
+          --replace ldconfig 'echo ldconfig'
+      ''
+    else
+      "";
+
+  preBuild =
+    if pyProject == "PY_LGPIO" then
+      ''
+        swig -python lgpio.i
+      ''
+    else
+      "";
+
+  buildInputs = [
+    lgpioWithoutPython
+  ];
+
+  makeFlags = [
+    "prefix=$(out)"
+  ];
+
+  meta = {
+    description = "Linux C libraries and Python modules for manipulating GPIO";
+    homepage = "https://github.com/joan2937/lg";
+    license = with lib.licenses; [ unlicense ];
+    maintainers = with lib.maintainers; [ doronbehar ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/lg/lguf-brightness/package.nix b/pkgs/by-name/lg/lguf-brightness/package.nix
index f597fa1c27b1..af221f5ee474 100644
--- a/pkgs/by-name/lg/lguf-brightness/package.nix
+++ b/pkgs/by-name/lg/lguf-brightness/package.nix
@@ -7,14 +7,14 @@
   ncurses5,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "lguf-brightness";
 
   version = "unstable-2018-02-11";
 
   src = fetchFromGitHub {
     owner = "periklis";
-    repo = pname;
+    repo = "lguf-brightness";
     rev = "fcb2bc1738d55c83b6395c24edc27267a520a725";
     sha256 = "0cf7cn2kpmlvz00qxqj1m5zxmh7i2x75djbj4wqk7if7a0nlrd5m";
   };
diff --git a/pkgs/by-name/li/libast/package.nix b/pkgs/by-name/li/libast/package.nix
index c7bbce07f119..3ac848203286 100644
--- a/pkgs/by-name/li/libast/package.nix
+++ b/pkgs/by-name/li/libast/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "mej";
-    repo = pname;
+    repo = "libast";
     rev = version;
     hash = "sha256-rnqToFi+d6D6O+JDHQxkVjTc/0RBag6Jqv4uDcE4PNc=";
   };
diff --git a/pkgs/by-name/li/libbtbb/package.nix b/pkgs/by-name/li/libbtbb/package.nix
index 4e79116c6ab3..2e9fbc46a460 100644
--- a/pkgs/by-name/li/libbtbb/package.nix
+++ b/pkgs/by-name/li/libbtbb/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "greatscottgadgets";
-    repo = pname;
+    repo = "libbtbb";
     rev = version;
     sha256 = "1byv8174xam7siakr1p0523x97wkh0fmwmq341sd3g70qr2g767d";
   };
diff --git a/pkgs/by-name/li/libcaca/package.nix b/pkgs/by-name/li/libcaca/package.nix
index d72b124854f0..d83ed369c1eb 100644
--- a/pkgs/by-name/li/libcaca/package.nix
+++ b/pkgs/by-name/li/libcaca/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "cacalabs";
-    repo = pname;
+    repo = "libcaca";
     rev = "v${version}";
     hash = "sha256-N0Lfi0d4kjxirEbIjdeearYWvStkKMyV6lgeyNKXcVw=";
   };
diff --git a/pkgs/by-name/li/libcmis/package.nix b/pkgs/by-name/li/libcmis/package.nix
index 6eb64381b979..cabd55bd5f78 100644
--- a/pkgs/by-name/li/libcmis/package.nix
+++ b/pkgs/by-name/li/libcmis/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "tdf";
-    repo = pname;
+    repo = "libcmis";
     rev = "v${version}";
     sha256 = "sha256-HXiyQKjOlQXWABY10XrOiYxPqfpmUJC3a6xD98LIHDw=";
   };
diff --git a/pkgs/by-name/li/libdmapsharing/package.nix b/pkgs/by-name/li/libdmapsharing/package.nix
index 0c6812211f9c..91d1388b3812 100644
--- a/pkgs/by-name/li/libdmapsharing/package.nix
+++ b/pkgs/by-name/li/libdmapsharing/package.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
-    repo = pname;
+    repo = "libdmapsharing";
     rev = "${lib.toUpper pname}_${lib.replaceStrings [ "." ] [ "_" ] version}";
     sha256 = "oR9lpOFxgGfrtzncFT6dbmhKQfcuH/NvhOR/USHAHQc=";
   };
diff --git a/pkgs/by-name/li/libeatmydata/package.nix b/pkgs/by-name/li/libeatmydata/package.nix
index af477fdc9285..587133bd9152 100644
--- a/pkgs/by-name/li/libeatmydata/package.nix
+++ b/pkgs/by-name/li/libeatmydata/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "stewartsmith";
-    repo = pname;
+    repo = "libeatmydata";
     tag = "v${version}";
     sha256 = "sha256-0lrYDW51/KSr809whGwg9FYhzcLRfmoxipIgrK1zFCc=";
   };
diff --git a/pkgs/by-name/li/libepoxy/package.nix b/pkgs/by-name/li/libepoxy/package.nix
index 236b97dd0511..4f261f313372 100644
--- a/pkgs/by-name/li/libepoxy/package.nix
+++ b/pkgs/by-name/li/libepoxy/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     with finalAttrs;
     fetchFromGitHub {
       owner = "anholt";
-      repo = pname;
+      repo = "libepoxy";
       rev = version;
       sha256 = "sha256-gZiyPOW2PeTMILcPiUTqPUGRNlMM5mI1z9563v4SgEs=";
     };
diff --git a/pkgs/by-name/li/libetebase/package.nix b/pkgs/by-name/li/libetebase/package.nix
index 7e96c533262a..c10169135e4e 100644
--- a/pkgs/by-name/li/libetebase/package.nix
+++ b/pkgs/by-name/li/libetebase/package.nix
@@ -10,17 +10,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "libetebase";
-  version = "0.5.7";
+  version = "0.5.8";
 
   src = fetchFromGitHub {
     owner = "etesync";
     repo = "libetebase";
     rev = "v${version}";
-    hash = "sha256-sqvfzXHqVeiw+VKWPtCYv0USNpbfBE7ILUiqXZtLmgI=";
+    hash = "sha256-B+MfnYbxIbgMHFWWOYhap1MEbV3/NNYuR9goJDTNn9A=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-z3ho6hTWC6aaWTpG9huhymx2og6xQq+/r+kgiJygC9w=";
+  cargoHash = "sha256-ZLQFERi38+0SUxWaYAL4AepgVuAQKo9pxjcMkzA55BM=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/li/libeufin/deps.json b/pkgs/by-name/li/libeufin/deps.json
index a8bd14c57102..1019bab940f7 100644
--- a/pkgs/by-name/li/libeufin/deps.json
+++ b/pkgs/by-name/li/libeufin/deps.json
@@ -2,17 +2,6 @@
  "!comment": "This is a nixpkgs Gradle dependency lockfile. For more details, refer to the Gradle section in the nixpkgs manual.",
  "!version": 1,
  "https://plugins.gradle.org/m2": {
-  "ch/qos/logback#logback-classic/1.5.6": {
-   "jar": "sha256-YRXGysXtHZ24ENFPL39N1qnyHwrLuoAW5NqsoroPXrg=",
-   "pom": "sha256-SysA32EjwOKmHnG1vis/AHOWeLtLBplA1cScJN9T9Zo="
-  },
-  "ch/qos/logback#logback-core/1.5.6": {
-   "jar": "sha256-iYx9EgGZ834azIEY2XqxWk0CsOcuJ7qfBYQ8s3ThYMY=",
-   "pom": "sha256-BpPQaN02h3R1rYCQbjHHvA1RlbgtTAB1HcGcHqUR5xE="
-  },
-  "ch/qos/logback#logback-parent/1.5.6": {
-   "pom": "sha256-e9/LJJJGgaSRRNujSpJ7i9B5INCS6sw972H55kevTeg="
-  },
   "com/fasterxml#oss-parent/38": {
    "pom": "sha256-yD+PRd/cqNC2s2YcYLP4R4D2cbEuBvka1dHBodH5Zug="
   },
@@ -22,8 +11,8 @@
   "com/fasterxml#oss-parent/50": {
    "pom": "sha256-9dpV3XuI+xcMRoAdF3dKZS+y9FgftbHQpfyGqhgrhXc="
   },
-  "com/fasterxml#oss-parent/56": {
-   "pom": "sha256-/UkfeIV0JBBtLj1gW815m1PTGlZc3IaEY8p+h120WlA="
+  "com/fasterxml#oss-parent/58": {
+   "pom": "sha256-VnDmrBxN3MnUE8+HmXpdou+qTSq+Q5Njr57xAqCgnkA="
   },
   "com/fasterxml/jackson#jackson-base/2.12.7": {
    "pom": "sha256-F55U/ibI1N/pJf7jHUqH0cwl+LfgCUik5laxIp4rdq4="
@@ -31,14 +20,14 @@
   "com/fasterxml/jackson#jackson-bom/2.12.7": {
    "pom": "sha256-GVVDL22K8ygG2C2CGP7f5L47s+I9WadNgUSf/HS/e9E="
   },
-  "com/fasterxml/jackson#jackson-bom/2.16.1": {
-   "pom": "sha256-adi/myp9QsnPHXCtgr5C9qxv14iRim4ddXkuzcwRegs="
+  "com/fasterxml/jackson#jackson-bom/2.17.2": {
+   "pom": "sha256-H0crC8IATVz0IaxIhxQX+EGJ5481wElxg4f9i0T7nzI="
   },
   "com/fasterxml/jackson#jackson-parent/2.12": {
    "pom": "sha256-YqocFnmt4J8XPb8bbDLTXFXnWAAjj9XkjxOqQzfAh1s="
   },
-  "com/fasterxml/jackson#jackson-parent/2.16": {
-   "pom": "sha256-i/YUKBIUiiq/aFCycvCvTD2P8RIe1gTEAvPzjJ5lRqs="
+  "com/fasterxml/jackson#jackson-parent/2.17": {
+   "pom": "sha256-rubeSpcoOwQOQ/Ta1XXnt0eWzZhNiSdvfsdWc4DIop0="
   },
   "com/fasterxml/jackson/core#jackson-annotations/2.12.7": {
    "jar": "sha256-PKzvcUqJ89aLafoRJjr6VaaqL97x//k97SLKoWtUaHw=",
@@ -81,50 +70,151 @@
    "jar": "sha256-ySjWBmXGQV+xw5d1z5XPxE9/RYDPWrAbHDgOv/12iH8=",
    "pom": "sha256-SDllThaxcU509Rq8s3jYNWgUq49NUnPR3S8c6KOQrdw="
   },
-  "com/github/ajalt/clikt#clikt-jvm/4.4.0": {
-   "jar": "sha256-3UJMfEETwRTvwQPaP6uCzL7nSElwEpwHZKRXi1hnc3E=",
-   "module": "sha256-+7VuRAdirxrynHnd26lK40PX+e8ha6m57IjMkaxhoMs=",
-   "pom": "sha256-EsmrEMyQ/YPRPASDj5a8q/NksORNjdJ65V4VLGMxPA4="
+  "com/github/ajalt/clikt#clikt-core-jvm/5.0.3": {
+   "jar": "sha256-acupSiKR90t4yII5zYtn6vPwjg2tKXdJq+ZHez6bgbE=",
+   "module": "sha256-dFtZmw9KoAz3AVYz429KVvJdGLy292htyrOxoRQZ3PE=",
+   "pom": "sha256-CPpCgzMVYwi9KLYyNih6MXIVLcu/ccgx4LOshiPl4XE="
   },
-  "com/github/ajalt/clikt#clikt/4.4.0": {
-   "jar": "sha256-pGJRQhCAqew0Cm92KHhUIOuyx9Ccw7BVOZ+j+676doY=",
-   "module": "sha256-Z84+Rk1+r4GaBRQVd6IERrjkWbfk6RqCzoh7WKiOrWg=",
-   "pom": "sha256-lrjYoujSS0misWTzN9LnAW3aiURAFFgNv/R4nilVZGk="
+  "com/github/ajalt/clikt#clikt-core/5.0.3": {
+   "jar": "sha256-KeBaQXAKBp8NEHSOp9Xwyb8OFjbUsQNXPj98X3q7fDo=",
+   "module": "sha256-CmMddfhkwX5dYQBfYDwSaUtGcy3s1cOckU0pLQXo6zM=",
+   "pom": "sha256-wrBLaB6IqaGSgLZW2mBKIfLj4lUih2i4maaLoejuYBU="
   },
-  "com/github/ajalt/colormath#colormath-jvm/3.5.0": {
-   "jar": "sha256-Q5NdsGVYtKrD3ZAKd1vj6JtUyfSIYBRX3yfSoXQxZ7A=",
-   "module": "sha256-51pnwJ14NuUBlxvoNHiCxmFpsgcn3S4sQjmT8VLuAns=",
-   "pom": "sha256-YGXSHOrrGuPcE0P00XWKWojHTj5hwg60TUknp8G3MtY="
+  "com/github/ajalt/clikt#clikt-jvm/5.0.3": {
+   "jar": "sha256-nNGeBHgvRh3/6xg9F+V2mE/rt5NJMstAZkasQeQohjs=",
+   "module": "sha256-nSm2J+l1mRLhJ+r7136GAYceul6qUthMgXUKiYIC8Xc=",
+   "pom": "sha256-CcAbsS0foX/hKcoSgvHpmpCAEbGDA5ptT8z2tclaTos="
   },
-  "com/github/ajalt/colormath#colormath/3.5.0": {
-   "jar": "sha256-vSKbrzuv1VbRid5yRx2dF8KaofXTJEVgJwvvjmOiMZo=",
-   "module": "sha256-WgMLkC+VqHlsIUX2sppgwpeNxmQR4I6miLT7eK6p7wk=",
-   "pom": "sha256-HZZBrdkDXN1gex2qgJ7sFks8m6zFTysQOFHu1FHRefc="
+  "com/github/ajalt/clikt#clikt/5.0.3": {
+   "jar": "sha256-qLzj6fI3DFVs1FG2AY5Yfu1LCfO3jr72SP2D874LgPw=",
+   "module": "sha256-vNNPHTxGfvq1FuoiqeeazD8SRJxIl/DF6sGCEnMizsY=",
+   "pom": "sha256-GwUigSeaOs6FY7svHtP1Khs9Rq15w9T2wzMjI+VzX9g="
   },
-  "com/github/ajalt/mordant#mordant-jvm/2.5.0": {
-   "jar": "sha256-E9wdFUB0kM+j6bxUAQ8DHWpcUrc100FcxxRPC0aAqtc=",
-   "module": "sha256-HDNjczAEy0z54b/mT9xjIiW8dTXVbrhxApdGf8V7wK8=",
-   "pom": "sha256-095n7fFjX1ytZvkcVnXx+IfJDTuVlPfngQUgfxK04F0="
+  "com/github/ajalt/colormath#colormath-jvm/3.6.0": {
+   "jar": "sha256-WfdBrf5iBTBmeC2LGkWv0GaFpLxkszJ35Uh2uZPtiFw=",
+   "module": "sha256-P6dnMPmJ4ChN8YL87IViDZtIrjIhOYhBrGyviEYvYvg=",
+   "pom": "sha256-8Dw11QURDQZzNF9HQOVbzZdqmp+lobE8qirTmPO8Hl0="
   },
-  "com/github/ajalt/mordant#mordant/2.5.0": {
-   "jar": "sha256-j80uWaxhZQy8d7paxqDaZlMD6xvVURejzZSpi+ir0xM=",
-   "module": "sha256-KMoVBsOzOqA5GK9FWSHfiv49oLtN3O5sezdOAG3g4bY=",
-   "pom": "sha256-CM7jeOmaKfiAw1DUfe6R2H1ypc75WfaoysEd2FYT4VU="
+  "com/github/ajalt/colormath#colormath/3.6.0": {
+   "jar": "sha256-49ox0EqJXlNfXQh2TM9fODQcQr99aNqW6h8ACfclmdY=",
+   "module": "sha256-aQeqSXrbmvY4EsdTZjic7T5ruL7oDnsjmttMU2c/iIQ=",
+   "pom": "sha256-zh3tjA259LxNNjS64Vn9jVu2qWDyzTuWoAyPDnnOZAs="
   },
-  "com/google/code/gson#gson-parent/2.8.9": {
-   "pom": "sha256-sW4CbmNCfBlyrQ/GhwPsN5sVduQRuknDL6mjGrC7z/s="
+  "com/github/ajalt/mordant#mordant-core-jvm/3.0.1": {
+   "jar": "sha256-nPm0bR9J8tbPJjVGKyncWeDCmx+y8IWzMSiIu+nHzTE=",
+   "module": "sha256-5HRMRxB05ezUFh9wcLRZTfAO8XivBEJlkF5e0c61rJI=",
+   "pom": "sha256-1Ylt5eNKnVarJ4Y5iyYHJLGB85zAUIy7Kh9+iGzSXYc="
   },
-  "com/google/code/gson#gson/2.8.9": {
-   "jar": "sha256-05mSkYVd5JXJTHQ3YbirUXbP6r4oGlqw2OjUUyb9cD4=",
-   "pom": "sha256-r97W5qaQ+/OtSuZa2jl/CpCl9jCzA9G3QbnJeSb91N4="
+  "com/github/ajalt/mordant#mordant-core-jvm/3.0.2": {
+   "jar": "sha256-ZRw710/06Y201Y49z0sU6Ame4NIg5nL1cfjP7uRJOQU=",
+   "module": "sha256-5ye2C+d8MTeuuy+nqdhdGF+rt5BNlE3CFTnULAEdNZA=",
+   "pom": "sha256-BOsXQTz97is1U2zyHDT5pD/4u/7J7BAURbLuKsnh/7k="
   },
-  "com/gradleup/shadow#com.gradleup.shadow.gradle.plugin/8.3.0": {
-   "pom": "sha256-v4nrgYvl5YKQuLGSYalP1ycSEJWE2vjPXXRDsNEpN/o="
+  "com/github/ajalt/mordant#mordant-core/3.0.1": {
+   "jar": "sha256-c/UXnY6U+FEUR18Zlo0WWURZTmszjbcciwv9sJUe6z4=",
+   "module": "sha256-BWl6xcBV8Uh2cJ/U6f1ejD0VphrHesVy+RZEmTKgjC8=",
+   "pom": "sha256-Ah3YAdKdWJlqDJv/ux8VHWkHytU20syNGnoHuck4UNo="
   },
-  "com/gradleup/shadow#shadow-gradle-plugin/8.3.0": {
-   "jar": "sha256-mNZNyTlAaZ+ko08P2CnncTSnaPriB6fi7HY8pnOsQz4=",
-   "module": "sha256-dFY5K5OxTedRzEyztww70HaO3M9WjwUUdNSNjgQEYyA=",
-   "pom": "sha256-ozYhcmY11AgiPW2oCANhI+iD8CEtVa8kAa9BhKPZuX8="
+  "com/github/ajalt/mordant#mordant-core/3.0.2": {
+   "jar": "sha256-RyqVWswFRZLut06lYmFaaJxnTmPSbRLovo2nqF4bs3w=",
+   "module": "sha256-0flx5bMpTkS//zr6RA1843pR1Yg1aw+vsJDARrDpzgc=",
+   "pom": "sha256-Oh+bdkH+E7uMTwdCaSPmW5iPZqsPK5w5NwYn8qjZGis="
+  },
+  "com/github/ajalt/mordant#mordant-jvm-ffm-jvm/3.0.1": {
+   "jar": "sha256-IEHC9fe4cJWxFcsZFV7pJXRRhU0I5bhnEWW0O8fhFM8=",
+   "module": "sha256-iE1x/LfBAQrm11qoka5UqYmGEVSwfxIVzVRfDkg34V0=",
+   "pom": "sha256-azbnZhrYKN4DoomS2K6WJWzq3z/aEo+OxImo1lu7rFM="
+  },
+  "com/github/ajalt/mordant#mordant-jvm-ffm-jvm/3.0.2": {
+   "jar": "sha256-ECJHhBJcnxeCwdTx0489VCNvzFXAMKKtAMvkMG4WK6Q=",
+   "module": "sha256-S4/mRlOuA7eSFrXFoOwm1Uyg+VMr3HKY3kCCpaOIcZI=",
+   "pom": "sha256-1quALOXImBg+w59ikbupM2s6e19+Hb0uuC++QZ5amjM="
+  },
+  "com/github/ajalt/mordant#mordant-jvm-ffm/3.0.1": {
+   "module": "sha256-2Frg+0n7bXFHibQ/MbVnUoybit+G0Ou5hpSkGpHgmmc=",
+   "pom": "sha256-/MzpL8GhnxYzgGhDyuVTLIx/2YSnkxRbb7y3iUpk/s0="
+  },
+  "com/github/ajalt/mordant#mordant-jvm-ffm/3.0.2": {
+   "module": "sha256-G9cU09l4urfa1Wt8lIWwH7ta3brEnUvpyDVKw3bOP3Y=",
+   "pom": "sha256-q57bn0Sq3RRIEnJSwVhKgWIfhFxXKcPZn+JJNO6YpEw="
+  },
+  "com/github/ajalt/mordant#mordant-jvm-graal-ffi-jvm/3.0.1": {
+   "jar": "sha256-bdS+vBZK6s3azI+Y6Phx4A/SHOe8LrDRgjDqg73fyGo=",
+   "module": "sha256-DYGba/u8pO6XszB4ZoEpaQdmr/lI/ByDF4j04DSFOsM=",
+   "pom": "sha256-Cm95LxyTYJX4dGmR1k2os/+ECazeOUir5d4v1WiIeDo="
+  },
+  "com/github/ajalt/mordant#mordant-jvm-graal-ffi-jvm/3.0.2": {
+   "jar": "sha256-bdS+vBZK6s3azI+Y6Phx4A/SHOe8LrDRgjDqg73fyGo=",
+   "module": "sha256-zTCkXAow9xwszIyDuOx+TO7DOHGPZoWT+MN839OYwbA=",
+   "pom": "sha256-jrQ4E5SEKRUjq2iWHlZIJmqu8dHvROHF7n0FBLta33A="
+  },
+  "com/github/ajalt/mordant#mordant-jvm-graal-ffi/3.0.1": {
+   "module": "sha256-qu/aIGckg7OwsmDdHvE0LOazTs6IutbfOa4bJgUMjAo=",
+   "pom": "sha256-VAicrH9XCzo84x3cCD+ORgs7ED62oXM8kUE1GgaLR/M="
+  },
+  "com/github/ajalt/mordant#mordant-jvm-graal-ffi/3.0.2": {
+   "module": "sha256-5QTKuCsTKnisa5by3i8IjmP1XHiDfPqdoufR3uDp3y0=",
+   "pom": "sha256-+046A/nMtnRJ2FPS40ZX6eComtgiDVEX5Kq91dn9bmU="
+  },
+  "com/github/ajalt/mordant#mordant-jvm-jna-jvm/3.0.1": {
+   "jar": "sha256-QQY0QsiJGyd0U2qbh6UGKn/SDm8ZSZdMbacvSUctb00=",
+   "module": "sha256-eBcNkl07qnWGYvl2M2FjkN6Q1CoslON2PqpZBXY3jh4=",
+   "pom": "sha256-/hWoxktH4H8vmdiDKG5O+xR0YkVlh0ayVQ9vlohkX4A="
+  },
+  "com/github/ajalt/mordant#mordant-jvm-jna-jvm/3.0.2": {
+   "jar": "sha256-QQY0QsiJGyd0U2qbh6UGKn/SDm8ZSZdMbacvSUctb00=",
+   "module": "sha256-Qx5V+e+NeSxaeF4BRtg19MKuDphY+kIPneBgJoKncSY=",
+   "pom": "sha256-HyiNXD3pQTR2DhhZRwlKvWXv2mqNIfk/Mvq+9olO5Is="
+  },
+  "com/github/ajalt/mordant#mordant-jvm-jna/3.0.1": {
+   "module": "sha256-cn+1FiNOi6/JJ5Xi7L0No4VNcjoWxphCrGGSC/WIebk=",
+   "pom": "sha256-xbxkikqeKmz3+dGAJMi/ZrIYCVDpPxYIODTHv/OqeGE="
+  },
+  "com/github/ajalt/mordant#mordant-jvm-jna/3.0.2": {
+   "module": "sha256-uAoLhp3AhMEeELXnFg6/GJ521ulQgweRanhWf6dnw+U=",
+   "pom": "sha256-uWV/1B1fmGNAXdJ1zzm5PQ+rwJj7lEHAoV3HZcFTaDw="
+  },
+  "com/github/ajalt/mordant#mordant-jvm/3.0.1": {
+   "jar": "sha256-ntO5dvzMx42nRtSYZvqOu48QUwqTxUTqBCAlmmB92V4=",
+   "module": "sha256-peTyMSt69CDG2DLDA4kcGg2GN8z6WpTYnxFGxIZpgLo=",
+   "pom": "sha256-sAnaTDfbjhc2uEgrRPIJ2Cdx/xyNO9+UbraE07nOmWU="
+  },
+  "com/github/ajalt/mordant#mordant-jvm/3.0.2": {
+   "jar": "sha256-ntO5dvzMx42nRtSYZvqOu48QUwqTxUTqBCAlmmB92V4=",
+   "module": "sha256-ePaERgODJINNruNw9ZfWJIsDz6/pZAWtwrbdZs38P4w=",
+   "pom": "sha256-O3C9sHYLuSTrdwmcb8f0kyLFkbZ39YHvS7i+xYhbnEI="
+  },
+  "com/github/ajalt/mordant#mordant/3.0.1": {
+   "jar": "sha256-CQmE0gJpL/70R+iN/ixjaTpd4pZw2ggxuGO8KE2hR+I=",
+   "module": "sha256-lJLcf2NgJt8ulCkim52Ae1d00uZBUQ2Qv4Kb0qyzthU=",
+   "pom": "sha256-BlK5t9Y0kro8J8ZIkANIZRxbKFdEAph7j+KqBUlqkaQ="
+  },
+  "com/github/ajalt/mordant#mordant/3.0.2": {
+   "jar": "sha256-CQmE0gJpL/70R+iN/ixjaTpd4pZw2ggxuGO8KE2hR+I=",
+   "module": "sha256-1JvlTnf/S5YQ3C8ij4HcBlaqklvHJYj2JFjbWZiVCVE=",
+   "pom": "sha256-5cbZkBgl3gKJ5J0tt1A+A546FmCq2sY3Oyp2zd9eZRM="
+  },
+  "com/google/code/gson#gson-parent/2.11.0": {
+   "pom": "sha256-issfO3Km8CaRasBzW62aqwKT1Sftt7NlMn3vE6k2e3o="
+  },
+  "com/google/code/gson#gson/2.11.0": {
+   "jar": "sha256-V5KNblpu3rKr03cKj5W6RNzkXzsjt6ncKzCcWBVSp4s=",
+   "pom": "sha256-wOVHvqmYiI5uJcWIapDnYicryItSdTQ90sBd7Wyi42A="
+  },
+  "com/google/errorprone#error_prone_annotations/2.27.0": {
+   "jar": "sha256-JMkjNyxY410LnxagKJKbua7cd1IYZ8J08r0HNd9bofU=",
+   "pom": "sha256-TKWjXWEjXhZUmsNG0eNFUc3w/ifoSqV+A8vrJV6k5do="
+  },
+  "com/google/errorprone#error_prone_parent/2.27.0": {
+   "pom": "sha256-+oGCnQSVWd9pJ/nJpv1rvQn4tQ5tRzaucsgwC2w9dlQ="
+  },
+  "com/gradleup/shadow#com.gradleup.shadow.gradle.plugin/8.3.6": {
+   "pom": "sha256-vI+Lii1Izey8uwCD39qhI2EVvzDYzJ3foE1W6T7J3e4="
+  },
+  "com/gradleup/shadow#shadow-gradle-plugin/8.3.6": {
+   "jar": "sha256-fOIOvwHuKe7FJFY70UK6wpHXUTXtedDZUamP0skmXDs=",
+   "module": "sha256-+8pm1Bwrz9HiUE9uzIIf4BqbAIx27qnJQM+Ay1aaI/8=",
+   "pom": "sha256-lRJfSJrSuJ5gJXMmnK9h9tSF26gvHcuNCYDODfK2stA="
   },
   "com/itextpdf#barcodes/8.0.5": {
    "jar": "sha256-JxLhfu2Mxizw7c7ZfZI+WBSo9Py3PiiZmBfy7ePTNUI=",
@@ -188,25 +278,25 @@
    "jar": "sha256-P3XR7KqtP/nBoCRE5Te6xasxgcuU6tPLotFY+QkIOGo=",
    "pom": "sha256-ZyRMu8oNwyJ6H+w75zWKHRM2i5biTzgz8TQzztgGt78="
   },
-  "com/kohlschutter#kohlschutter-parent-multirelease/1.7.3": {
-   "pom": "sha256-6DgZawRZPyy3ORdGe0Vc0tIxgwOJ/jXZ2G5PsVTjIh8="
+  "com/kohlschutter#kohlschutter-parent-multirelease/1.7.4": {
+   "pom": "sha256-D4WGWIXlDWSBYqF+qhLiTeZ4j6yg4mwiYfPoS5WF8Zw="
   },
-  "com/kohlschutter#kohlschutter-parent/1.7.3": {
-   "pom": "sha256-EJ4IdUJFTv6SA9to/SXg4lnGxQrZAfnC3Ertx+HxlvA="
+  "com/kohlschutter#kohlschutter-parent/1.7.4": {
+   "pom": "sha256-HGRVEFa32Vf9vGl/AHQgZqpKr9VAh9WXo7lEJxEjBO4="
   },
-  "com/kohlschutter/junixsocket#junixsocket-common/2.10.0": {
-   "jar": "sha256-g/e2Qij4EECSqw+HvkpYg1RfHkyHGaxej+70LjRpD7U=",
-   "pom": "sha256-yeTNYUy1zlSVY5yDYtGhlIgIzwsJ4yrhsnjwSZVaPkE="
+  "com/kohlschutter/junixsocket#junixsocket-common/2.10.1": {
+   "jar": "sha256-GeX3YVrSKT81Mrw/mRsxOWwRYYNOidmmqgx975OcZyk=",
+   "pom": "sha256-HLsKDl8eqevLRfOWJTaNBzvd+Wr8fNzYgBZlMxg5VsI="
   },
-  "com/kohlschutter/junixsocket#junixsocket-core/2.10.0": {
-   "pom": "sha256-KqC24es8CcF2S8Zn4tKYbxJfBgDbnfpahWdpoOOhZ3I="
+  "com/kohlschutter/junixsocket#junixsocket-core/2.10.1": {
+   "pom": "sha256-X2WdPNfqInB5jjoHjf1HSbrjMQKoL5m2MjtHHrMfssM="
   },
-  "com/kohlschutter/junixsocket#junixsocket-native-common/2.10.0": {
-   "jar": "sha256-WZMCw5dpJDbc+gWkVatla2vRJlFGJHTQVitmUsAs1FQ=",
-   "pom": "sha256-GqkDQJqo17kCq7NWwSrIsZHh9ZHzojNW7UHKHLGd5IM="
+  "com/kohlschutter/junixsocket#junixsocket-native-common/2.10.1": {
+   "jar": "sha256-ASbOC68c61de9ReAfU0rFLnzLwYYAgThLsc6tKdyVno=",
+   "pom": "sha256-7vhEVBWe4P24IaBxi5X9WVF4G2MCrvC/1m3i0nYdcbQ="
   },
-  "com/kohlschutter/junixsocket#junixsocket/2.10.0": {
-   "pom": "sha256-ZN0FeWBTfzdVjwqAxm7PeX9HgPdD+0NYyRKDVPO7Flw="
+  "com/kohlschutter/junixsocket#junixsocket/2.10.1": {
+   "pom": "sha256-8ABkSjwfJ0vGcH8jmwKrLglfrIeEaCJLQ/GfPm8Cy6c="
   },
   "com/sun/activation#all/1.2.1": {
    "pom": "sha256-NgiDv2RIbs7xYbjygvZQNTbdGmcNU6Coccj7IBcOZ5U="
@@ -215,373 +305,328 @@
    "jar": "sha256-itpMGFznJBZxLWPgta/cXwCcDN9AXl8m7+zfFWql37Y=",
    "pom": "sha256-tn6vqd0iD/h9ANumiACDpSlqXgxsAxA/XUuOHaEDD/M="
   },
-  "com/zaxxer#HikariCP/5.1.0": {
-   "jar": "sha256-pHpu5iN5aU7lLDADbwkxty+a7iqAHVkDQe2CvYOeITQ=",
-   "pom": "sha256-M0sOCm5lucZJw/6Wc5ZjpEEOGpF2ZTgC5ZVJO4YYLyw="
+  "com/zaxxer#HikariCP/6.3.0": {
+   "jar": "sha256-B8Y0QFmvMKE1FEIJx8i9ZmuIIxJEIuyFmGTSCdSrfKE=",
+   "pom": "sha256-F8+ZOdJTM0af1/Yok6f37tnqDIm5UWsEmfQO6xzATfQ="
   },
   "commons-codec#commons-codec/1.11": {
    "jar": "sha256-5ZnVMY6Xqkj0ITaikn5t+k6Igd/w5sjjEJ3bv/Ude30=",
    "pom": "sha256-wecUDR3qj981KLwePFRErAtUEpcxH0X5gGwhPsPumhA="
   },
-  "commons-io#commons-io/2.16.1": {
-   "jar": "sha256-9B97qs1xaJZEes6XWGIfYsHGsKkdiazuSI2ib8R3yE8=",
-   "pom": "sha256-V3fSkiUceJXASkxXAVaD7Ds1OhJIbJs+cXjpsLPDj/8="
+  "commons-io#commons-io/2.17.0": {
+   "jar": "sha256-SqTKSPPf0wt4Igt4gdjLk+rECT7JQ2G2vvqUh5mKVQs=",
+   "pom": "sha256-SEqTn/9TELjLXGuQKcLc8VXT+TuLjWKF8/VrsroJ/Ek="
   },
   "commons-logging#commons-logging/1.2": {
    "jar": "sha256-2t3qHqC+D1aXirMAa4rJKDSv7vvZt+TmMW/KV98PpjY=",
    "pom": "sha256-yRq1qlcNhvb9B8wVjsa8LFAIBAKXLukXn+JBAHOfuyA="
   },
-  "io/fabric8#kubernetes-client-bom/5.12.4": {
-   "pom": "sha256-0jI5KonD79yFqymcWpToud01vALzQM6ERv9lmqFZE6A="
-  },
-  "io/ktor#ktor-client-apache-jvm/2.3.12": {
-   "jar": "sha256-jUdk/2jpo3wGi4rV04IGUXoEDblJo64QvGBrOkh+fVU=",
-   "module": "sha256-2VWmd8iv3LAP/q8AN9VgZfv1dC/AiX642ge16vnnABA=",
-   "pom": "sha256-tgneuINzcp57HNI9mDkHXflDGpXiWnPtRFftVKA4fb4="
-  },
-  "io/ktor#ktor-client-apache/2.3.12": {
-   "module": "sha256-uZxHiSkKmjGTyilTXqRckq4cRXPv7yc4A4TFPxUmYvY=",
-   "pom": "sha256-mjzG7D1nR7fj8R7xESIFvI4BgcPw7F4Pj7VMv4YQ7qE="
-  },
-  "io/ktor#ktor-client-cio-jvm/2.3.12": {
-   "jar": "sha256-dwqtl12squdWroW/1r8Q5K3YRN8wOkv7TeXmL/EFrxw=",
-   "module": "sha256-zqEPvAP6bwO1d3CqcTy2mKeAgaUP3ZcZWxlpwkxcvr4=",
-   "pom": "sha256-qS1354DZM0X8oSzbkopMr8s4qsf+OHkO1s/8EhnSmDo="
-  },
-  "io/ktor#ktor-client-cio/2.3.12": {
-   "jar": "sha256-vTqw/pFlL+KLl5wgDI0x7oZv8Jj6D0q0koQiJ5aN/84=",
-   "module": "sha256-KOFohTgJHMPuoiIwaLt3qw++6U4RJ/k/Bor+ObW43cQ=",
-   "pom": "sha256-mz5GwlJlufGAK9Ec5xEgd6CwpxpAgLYUy+2wThqurSc="
-  },
-  "io/ktor#ktor-client-core-jvm/2.3.12": {
-   "jar": "sha256-tAeoHZLmzUH5LBUPH9MGDV/KNJHOAq+39xNCRAQIHHo=",
-   "module": "sha256-tLgSabjOWrX2/g+F/kfRVoqOlZxKuUtn1XQn6XEzVh4=",
-   "pom": "sha256-DRlPg9ywetvZfpAp+cotuwCcqXJXd8bRuezOqvw7Fns="
-  },
-  "io/ktor#ktor-client-core/2.3.12": {
-   "jar": "sha256-E/nV7COKqNoX8sCAUA0GipY6OKMaFkFQl7hA5fjDv/Y=",
-   "module": "sha256-hCfawQzvA9tUJUm9tArUlCSP/tB5Ar35BeSw6MVB7UU=",
-   "pom": "sha256-0rEDA3TSk+63skT9xwQxmThMh6oJh0Wv+OqCxcnj8fM="
-  },
-  "io/ktor#ktor-client-mock-jvm/2.3.12": {
-   "jar": "sha256-xjHU6dOxNznWeHyh9nA5hAB8HlC4gevgcGuxLuspsbw=",
-   "module": "sha256-wf5eFcAZC4lGfPbsxUYa1JjzeIOh8wIOOX4omMK52yQ=",
-   "pom": "sha256-F7t0BKMvUVYhoTyFB9iANwzzrCAa7SCMDNmdTl7f2T0="
-  },
-  "io/ktor#ktor-client-mock/2.3.12": {
-   "jar": "sha256-6L8mYY0u7NFcyHzqFJ4He1uo/ErfBUiqdbVJjbNpC4k=",
-   "module": "sha256-5BquV2y7T4t6TXW8CGAusXZmmp+4hEw45OIzEOkySzg=",
-   "pom": "sha256-3QYzQvethN844MCuAaFpa3rD1sJtQgn1XnGbWBG54FA="
-  },
-  "io/ktor#ktor-client-websockets-jvm/2.3.12": {
-   "jar": "sha256-1oyl95W+4IelVSiXQe9jhlFJuOUFuy0I5Fyh8x2MYuI=",
-   "module": "sha256-SNST0Ov+mK7puBx4WrgBR30iVTSC2UGUqEaeuPzp4cA=",
-   "pom": "sha256-VxEuZo1G9lKoq7yyVorduwzHbenEQb7+I86hrwYljNo="
-  },
-  "io/ktor#ktor-client-websockets/2.3.12": {
-   "jar": "sha256-qr3hPBfOOQOkZD+X89uWRfRiuDLtXQeDb2WBtNMMoz0=",
-   "module": "sha256-lBQ+mI228ZzeU2u7pdkwc2gxy+OFaPQoH5VSQgpanJ0=",
-   "pom": "sha256-DjRE95fKkOKxq4ZqH799sfnZBQguKl7v0YKoSrDxQyU="
-  },
-  "io/ktor#ktor-events-jvm/2.3.12": {
-   "jar": "sha256-RPCx3msJRxgtJUCNEQHFbPjAGnuAnuAVK9gdmtyapXY=",
-   "module": "sha256-wbvWTDPBa1jkGAsX84UjGAVQl72vhJFKSCNhkxLtJ7U=",
-   "pom": "sha256-PKeHv6OHkBQvbKaLwYR7+AAtHiSDh3nhihK1vwIna5A="
-  },
-  "io/ktor#ktor-events/2.3.12": {
-   "jar": "sha256-dQdvbe9/VwlGkWmYMw0n28OvdhfOyyXRZXyaDUKQFgQ=",
-   "module": "sha256-+Smg6nj7EudbLYIlbMUfGL77D+8ZpGHuuJOJyVG43q4=",
-   "pom": "sha256-OUMSxuErQx+I/6KbrRS7mTXvJRBgyWWhatNcLxEr56w="
-  },
-  "io/ktor#ktor-http-cio-jvm/2.3.12": {
-   "jar": "sha256-J4pcFmJwHbnYn0nnTqdyGO01rYMO//vfRFIuqGFHf0s=",
-   "module": "sha256-h8242b/858zMHPMNH+TENL5anBc2oOIDrwiEFAOm6Wc=",
-   "pom": "sha256-C960VxzRj9wpNqskIn931suo2bzCSD6zGFHQxoR97uQ="
-  },
-  "io/ktor#ktor-http-cio/2.3.12": {
-   "jar": "sha256-gHWsxhXDR76RNDI84n5q+FaBdlDG6P+Ctz2sYq4Tr4Y=",
-   "module": "sha256-hn6EOqx1exbS59G7SoqD3/w4h419o+Oklu8HyJUcCrM=",
-   "pom": "sha256-aFfrGiF/QmxeLH8BdygdTm9cQYhrEbfN8Hkm/M8vp84="
-  },
-  "io/ktor#ktor-http-jvm/2.3.12": {
-   "jar": "sha256-kHERxDmzvUQz0t67aHkg1fjfjGIpto7VQIBdXjdjtqg=",
-   "module": "sha256-HbJfyAaPHE6s8LRgJCSSclOZItL3xCWOUR+F4FhSuMY=",
-   "pom": "sha256-QULK0p5v7rrjm64YKryEmVrsdwRk8lLfT+ZF4aXdfBM="
-  },
-  "io/ktor#ktor-http/2.3.12": {
-   "jar": "sha256-2RVRfiXE5feMUP0Yg3twtGKbhQ7sXmTz5GF8Jj5ovbc=",
-   "module": "sha256-97kqlGhYpGSFonWEZ7EolLEmNK3B1AKQN62Fiec7MOU=",
-   "pom": "sha256-urBNfz5lqaxHnOzij77ymx/UAVkT6ZUZfHbORE9uWGA="
-  },
-  "io/ktor#ktor-io-jvm/2.3.12": {
-   "jar": "sha256-HZOkVmX2dE/5bNe5ekX7hf/scltjvMMn0zomocfgX70=",
-   "module": "sha256-ZH9Yx3f3Z9IIkwbbiF9o9YyJjqGwm4+956NwUC/61BQ=",
-   "pom": "sha256-W8eJXaz7EhDj8C/Qchz7sSaQOaFqr5PppHGpMa9Ufe4="
-  },
-  "io/ktor#ktor-io/2.3.12": {
-   "jar": "sha256-n4jHL7xCPrCerCM9Qc4/npXZJQ4EntgD4HSoIeQsv3U=",
-   "module": "sha256-QCIhmbDLWK9t6Kv8UzMIVLv3h05GYpsma49J68XW54U=",
-   "pom": "sha256-WAtT3KPqyxvto29WIH+8uA3T9hk5h5/iEhd/G2RLJb8="
-  },
-  "io/ktor#ktor-network-jvm/2.3.12": {
-   "jar": "sha256-CVq4r6salAjlWmf8pvL5aEhXNRnd0i5+jrHBfcS8jRs=",
-   "module": "sha256-RY/WkadOYMNEVz1lTtAs7xDaPdV3uuyRkfWhP1/j8U8=",
-   "pom": "sha256-/kwlQPBd9w5Hte16eitwQM0+djEscT6Q6BSIHOEL5K8="
-  },
-  "io/ktor#ktor-network-tls-certificates-jvm/2.3.12": {
-   "jar": "sha256-LOTzE8BNgWmamFhibm8NvrAzw8MXiayyR4ZqGtU3Ctw=",
-   "module": "sha256-oOIhlv7kjsEGCmsIfnjDzsS5SVEbd1YfI82fM30fXIo=",
-   "pom": "sha256-qX7YO8bHjRnAkYPsf3Kyyoq7uLepCIqpL1xA/NHAveY="
-  },
-  "io/ktor#ktor-network-tls-certificates/2.3.12": {
-   "module": "sha256-md9Pi2llS898JAraQCpR7Bn9Cw/dKBgUjpKQkR0RAag=",
-   "pom": "sha256-lr4TldgKOyVB0kUY2ZhZRM/KFtvPzkaPci6xW1evCzw="
-  },
-  "io/ktor#ktor-network-tls-jvm/2.3.12": {
-   "jar": "sha256-K3S/ahd3ZlhSAQbeUTffncNd+Kwe0BYk+DQJli0SinU=",
-   "module": "sha256-j6Zi98C2xQwnB8qO+2zz5bJJ6+ca/yCBe6txZoWTVIw=",
-   "pom": "sha256-8G26Qv0GNX/7XnTmPHDXaTVI/gXAhDumMgQfMiG0ZOc="
-  },
-  "io/ktor#ktor-network-tls/2.3.12": {
-   "jar": "sha256-pQkzuB2+4tWiAAC4Oc0hjNs9q/bmvDUVMsSM1qLJpqc=",
-   "module": "sha256-jjrtuQYKU5TcFUNc7bcC9w+LQedRkgGW3PzbL2KMSzU=",
-   "pom": "sha256-Jj+UZubuHisfJg63KR9ZSrKctZ4qW2VP1Brrwnbuwc4="
-  },
-  "io/ktor#ktor-network/2.3.12": {
-   "jar": "sha256-DtndmA73WUWELdRZzNbj2juMgEPqh7B1rlCwVNcwMaE=",
-   "module": "sha256-bfkcWAtGbzCli0Pvoy05ZehZj8Wo92nUIVPWARZllhY=",
-   "pom": "sha256-YiKMbrnpWXhKx7lk1Mt7PhqiXDHARQJoTJdkYLtkQII="
-  },
-  "io/ktor#ktor-serialization-jvm/2.3.12": {
-   "jar": "sha256-DgVTT7w7CUESe27znnBcNMNn2uiwoIKQcBxg6X6I+nI=",
-   "module": "sha256-GTKCfmbOzf9dgIaAjJdK/es3fM/bL50f+UBFdX8o1LE=",
-   "pom": "sha256-NrmT7RV8Xg2N6VDQjNIZyykQnY37JPYIyonzI062VzA="
-  },
-  "io/ktor#ktor-serialization-kotlinx-json-jvm/2.3.12": {
-   "jar": "sha256-S5nwc91m561Dy6YLUlmHb4WnXga4TOmzt4m5FZ+0Fwc=",
-   "module": "sha256-Tmgm6TN3WGWkhqV0PLOdO4Was6FvY6Wper644osYLyQ=",
-   "pom": "sha256-7leUKeRFBy7mX49AQ1YQ9RWopYKFH/ClUjha0OhqLEg="
-  },
-  "io/ktor#ktor-serialization-kotlinx-json/2.3.12": {
-   "jar": "sha256-qtaRy5Dm0tfu5aTALTpbyMxt23SrhXYyC6fiarMZm84=",
-   "module": "sha256-hVgEVad6tmzdj3yFJ9dgXTniwLb30IoGgx4Hs87XVMw=",
-   "pom": "sha256-P7B5ls1U5caVkKaHbVXdC93JqonQIK7T+dxZ3zVDR6A="
-  },
-  "io/ktor#ktor-serialization-kotlinx-jvm/2.3.12": {
-   "jar": "sha256-xhQnYJ9dbw45jfvySnyafftK1ZDon1TFwCHNfHEtSn8=",
-   "module": "sha256-UO9Nf4ee4QDi2uz81/tHpIX7/CPcNXDAPki21LZIfgg=",
-   "pom": "sha256-XbOFoQf2k+Mgk+TrG92VWfIqVsJdvxkN77eCrAtQocI="
-  },
-  "io/ktor#ktor-serialization-kotlinx/2.3.12": {
-   "jar": "sha256-+lu+kbBqPGUW1olfbvKp15rAEJO5jDKAzCv/+kgktQg=",
-   "module": "sha256-giYVZjIHuPTT72bZO+yzk1QhDhUEgOcHrI/LFkmYPRA=",
-   "pom": "sha256-1WBIrQOYmjq3ZFiYEZZ/Pt3edNBwPNGIQyS4LWCDHZc="
-  },
-  "io/ktor#ktor-serialization/2.3.12": {
-   "jar": "sha256-I/oFsvofdMi+5JsvpNCmzRaXdvXLw7e00I5nfmr7n14=",
-   "module": "sha256-k6tLV6lbcXNH6smUDI5QkhvQ2EBKw4j6mDlLRaqMRGo=",
-   "pom": "sha256-Q3WCoJTbZp2kPogfpctbs8IGJ+O+HgNkqk53hSqrG4Q="
-  },
-  "io/ktor#ktor-server-call-logging-jvm/2.3.12": {
-   "jar": "sha256-2ZCFAv3jI23WSkP3y/oXle6p4IPPmzCkSFRPzMIIrGg=",
-   "module": "sha256-+J2mtOQ1mwqjIiUe8T6ky3EgQHGYAmaRp2TRDObvuG0=",
-   "pom": "sha256-TJ50lHBMUZo3HK8rEKLQc+N+Y+eILBKwkxgJRaGGBgo="
-  },
-  "io/ktor#ktor-server-call-logging/2.3.12": {
-   "jar": "sha256-9bcBSzx89lyNPJHPmlMZ2NvmMC36i3K1JdgM/j4rYVo=",
-   "module": "sha256-/gl5sCeKn7fHWqq40aZwG6sB1l4D8GnD01+owcbvbJ0=",
-   "pom": "sha256-ffw5Qb9VTBapmMGzVZRvj+dZxy/nSw+f35mKA/wnrGQ="
-  },
-  "io/ktor#ktor-server-content-negotiation-jvm/2.3.12": {
-   "jar": "sha256-8z3S07/SLoQtPNs4mdxiP97xiFMSM+yKa3e5YQG5zyo=",
-   "module": "sha256-WXSV3kPdEANtI6+wRUzreZf2V1zsYZTSOCgxgEW94Lk=",
-   "pom": "sha256-hWxlgYry3cH5pS6I1SjPFSxEdRyayXDuu5CdfeQLRTU="
-  },
-  "io/ktor#ktor-server-content-negotiation/2.3.12": {
-   "jar": "sha256-QIzMqhJQVC3Gi3IeChoqzrgcYscmJspE8CR6pwGwtmI=",
-   "module": "sha256-lsoYcODLo0DAiScd3BmRis714ZJ7GFxgpI4FYd1mJ5I=",
-   "pom": "sha256-IALFuzN7YJ+v2MRY/tYNCWd2ElitDT5y7jJfwO833e8="
-  },
-  "io/ktor#ktor-server-core-jvm/2.3.12": {
-   "jar": "sha256-87MLoTVXIKOf3iFGDODMOoMiJBcjbX3m/f/lQnZFNrk=",
-   "module": "sha256-52SohTBiijvw2ZKu+SW07XDSpqg8ifA2VvI1F9mrTL8=",
-   "pom": "sha256-cq2x0bdiWEQ67EiZYMT9LSF3K3PWHpgzrRJcJLUHQ34="
-  },
-  "io/ktor#ktor-server-core/2.3.12": {
-   "jar": "sha256-PztUA1uh8KXfyq3LoJd62JDVDEUa7iLVPvTVa1Om/O4=",
-   "module": "sha256-dxeztTJwrTUrCERm26NRI/GEhF31hHbhQiN84n7p4f4=",
-   "pom": "sha256-guqcwPrUbOmUfZntglGkJehvBkEGhz2gsbBkLt+CT2o="
-  },
-  "io/ktor#ktor-server-cors-jvm/2.3.12": {
-   "jar": "sha256-xwTT3tMN9HlLRgNECdlNMhCPD3ocLQbn0Sr77fj+Xds=",
-   "module": "sha256-kFyfIXxcaklf2uCwwU6S+S5KspVDhXi3Frxpmp0AFps=",
-   "pom": "sha256-1iX13wJiGJScyoDJ+NoseRZZk/Aei7TEUDMiph/dVwI="
-  },
-  "io/ktor#ktor-server-cors/2.3.12": {
-   "jar": "sha256-fIHP5xLja3p1sC0m7muVaH3W2qJkcOeZ6HEtjNVdSo8=",
-   "module": "sha256-g1jmADVcZB6gsCt1cdT2QsA8/rPHIP3R9UrOncRfsdI=",
-   "pom": "sha256-XxeuBgyCjFqWa62syZ0Tk3sEH1OLg+h7+eT9nqP8HxE="
-  },
-  "io/ktor#ktor-server-forwarded-header-jvm/2.3.12": {
-   "jar": "sha256-PSYjHAFFbvj9l+lrt22wQfIrnDCEVHopoptivwTe1aw=",
-   "module": "sha256-Wp2PoyeUo3JnSJEV4e+I4HOwm1VWcdwSWQeMksSZhgw=",
-   "pom": "sha256-0SoFCtfFOsVuBjygUznMx+S0lLczzPQVMj9CZTDA/VU="
-  },
-  "io/ktor#ktor-server-forwarded-header/2.3.12": {
-   "jar": "sha256-rBeywfo/ojJHL/BeKB0Zvfm93jeb890IJNPNIFS3IoI=",
-   "module": "sha256-BNPJlnykEq8aRxuu04rcMg623ftRVAbyAeMfqgOUkws=",
-   "pom": "sha256-lqtff9lawr1yAleT934ws+tpU2N3E5mWVfRu5ikF0SA="
-  },
-  "io/ktor#ktor-server-host-common-jvm/2.3.12": {
-   "jar": "sha256-PqCwuI/69rOzyL9QbowWi3oK2Sb5YRY4kQ6PszSs+Y0=",
-   "module": "sha256-KaTlZZjUo/QHi1AsjAZDQI0kvFxKwqhvoINV+LpwWsA=",
-   "pom": "sha256-y8TqBs6yF4ydBR0mOgFpdMFsFP03vcarYvRe3BIqTHs="
-  },
-  "io/ktor#ktor-server-host-common/2.3.12": {
-   "jar": "sha256-rszGWDfMza0w0iSK/EGgMmYW4PtIEQ7MdC9FxHAueng=",
-   "module": "sha256-6SXz35o/7+m5wu6LuCJ+r4wzzBfeVQ+X4TPBVb/YxDc=",
-   "pom": "sha256-OrIB6jqq9j02JL7E1rkZ5Gs5ZDsolT9V8pjb21Cm3Mw="
-  },
-  "io/ktor#ktor-server-netty-jvm/2.3.12": {
-   "jar": "sha256-fB6Wuez726JFtTnCKRvZ/V6qk5EDJxNqhZenY9G3zKU=",
-   "module": "sha256-uPdqMoqrgXqUMo3zTPtJoXnGAdbgAKG6uybuXxWJmcI=",
-   "pom": "sha256-PShkR8o1JXiLOKF6rs/Qs8utUIUEpeeNTltQIwM5gtQ="
-  },
-  "io/ktor#ktor-server-netty/2.3.12": {
-   "jar": "sha256-Wkb9vED9LXglmIPEzG6vO14pDdB9HEbqiO6j1I9QV3I=",
-   "module": "sha256-zdTXhSg8NRXKb3hybIzhm540a80u5nyzKWByFTsopMs=",
-   "pom": "sha256-OuuYhKZvErNF8KiUo2kg/9VRITL46mQExWJNao/g/R4="
-  },
-  "io/ktor#ktor-server-status-pages-jvm/2.3.12": {
-   "jar": "sha256-0BCgY9Z8xAZ/uVECbeo5YpCB9/3por8HTHjp4ymz32o=",
-   "module": "sha256-z6BiRbNtUJBj12FUc/zn1tgiv60/BeP7hKBGdA4/oGY=",
-   "pom": "sha256-fmR0X09A7841Xi5cvPO1paM/0mew7TshUdthpcGHIlY="
-  },
-  "io/ktor#ktor-server-status-pages/2.3.12": {
-   "jar": "sha256-1cJm3V9RVm8SvS+M/sf9cl4u4FSt3VTKzKrb8hcPDzw=",
-   "module": "sha256-uNoB5ZdeqdJcEOziZK66a55f8DeDUqDYLGSgvBArflg=",
-   "pom": "sha256-FJUnS6kEF6+rkfdoGkEVWS3H0eyQGLDiOHIo5CV+zcI="
-  },
-  "io/ktor#ktor-server-test-host-jvm/2.3.12": {
-   "jar": "sha256-0Y+qYjowBfvy3ta0WZCg4CUZ7S/NAqEebs7trSRHB4g=",
-   "module": "sha256-a3GD2blocgML02f1k6ZiwaZYAglMDBN9GdJmXf/RNKY=",
-   "pom": "sha256-zt86IcY+yAJNxU6MGTI2XHxKF9q0pN428Q8bYXl3UaU="
-  },
-  "io/ktor#ktor-server-test-host/2.3.12": {
-   "jar": "sha256-RaLXEGOGVhiWAnsk67ZOFU9hQuRzGYLpGtKhiWJgX8A=",
-   "module": "sha256-dLj9g4R9I6nRXjzWFC/WxnjhiTPT/sc/dAo6481zv0c=",
-   "pom": "sha256-6wWYAdVMCxSPHV7ltcT3B9SSayFnE5FYSSmB6dW/tC4="
-  },
-  "io/ktor#ktor-server-websockets-jvm/2.3.12": {
-   "jar": "sha256-W4FiW1RiVsaKYSrBJ/mbqJS8hVlyzMH0KssW9X87c0k=",
-   "module": "sha256-DMchLiP0ke8h0VY58khcgj1WPdVb92nvFaZP+Hl+uLo=",
-   "pom": "sha256-Z56Qmr0F3rPThB2pxIk++JTybhan+FLflikP2PqnB8M="
-  },
-  "io/ktor#ktor-server-websockets/2.3.12": {
-   "module": "sha256-iNhH2pdYDCZfRZOowbTPGkhmW0x8VzhE12+zy6BQnRI=",
-   "pom": "sha256-INYWpc8A9/yIRykFu1JwAwGfI4Xg0vUfEu8HOZuhNaw="
-  },
-  "io/ktor#ktor-test-dispatcher-jvm/2.3.12": {
-   "jar": "sha256-uLeCuPvzyY/wbbYL0/P4wxc/a/PWDYZpsdO3pLQWa24=",
-   "module": "sha256-ZvMSVFkDbgFKVHFEJti1cCOSJstiqIheExBP/xZoxp0=",
-   "pom": "sha256-NzeYrCfmSOP4Sevz5F2cOPMdd8iyMzP4UtLbH1kprmg="
-  },
-  "io/ktor#ktor-test-dispatcher/2.3.12": {
-   "jar": "sha256-m1L5EwHLh9TSOmp8/mzYXlGTXSI8HKf+RF+UwNuee3E=",
-   "module": "sha256-AaVKAzqbS8iPPWyQxQ8EEGMDKeVSgs0gyb1EYGNbylU=",
-   "pom": "sha256-0IfYPn6lFibhi2D1BEznni5qsujP4pHPWuHk7eIjzCw="
-  },
-  "io/ktor#ktor-utils-jvm/2.3.12": {
-   "jar": "sha256-anLWhnMwBl7UYZUv/xnqVbqEQ1L3SM7Bhy9bx7Ie/AI=",
-   "module": "sha256-rYMuChkwgwCinDQNvY2I0pAcLzuw+CFhrWamLSB4VgQ=",
-   "pom": "sha256-Xi3ckkIaAAWDUdMPo45yB6qYsZ6fLYCYRFmIB3yPNGE="
-  },
-  "io/ktor#ktor-utils/2.3.12": {
-   "jar": "sha256-SJeUj4AL85YHGPuaWv9QErcht7iWZjhZWCbGstp8TiU=",
-   "module": "sha256-Rxwq3h1BTGX6Y9C0LIdLqcuUhGsZQQnD0PAEOwtnt6E=",
-   "pom": "sha256-lIfQwBRDfsjcthP6Gl345WmTsc7wQqKXMPw99SQlsrg="
-  },
-  "io/ktor#ktor-websocket-serialization-jvm/2.3.12": {
-   "jar": "sha256-v/iQ16thcVUa5PBjLprsy5BI3zHW1zz1Cr1bMwCArTo=",
-   "module": "sha256-PeyRtQnxTtpFGjWpyOY+bmuNJz/4i2u74BK7dTzdOwk=",
-   "pom": "sha256-pqTtw4NX9DjErB5Zbqp4SILGmurmVz1ksaKrc/cNBp0="
-  },
-  "io/ktor#ktor-websocket-serialization/2.3.12": {
-   "jar": "sha256-JCEwwgnDIoLZ8g7EnlfXSBihpyiADs2QLe7dzwURgMU=",
-   "module": "sha256-lbcbDeXFGs93fnTXkCAnFoZi59dR3aU7lJ/C+ChHSuE=",
-   "pom": "sha256-eU8LskUjFQQH8+ZTrYqUYzKptPmp1ryv/RBlvxN9iSw="
-  },
-  "io/ktor#ktor-websockets-jvm/2.3.12": {
-   "jar": "sha256-3DXMU59N+lpK2bORwU0GUn36xPZLPj8FD1FDzrIVvKQ=",
-   "module": "sha256-Xcz1g9dBybFg9pnYyGS53n6JrFz+f2fTHQIHvaejvl0=",
-   "pom": "sha256-Pc9D1TtWf3T3z2VvF/r7QfRtqztf+6AHZ2EsJH/W7Rw="
-  },
-  "io/ktor#ktor-websockets/2.3.12": {
-   "jar": "sha256-XdKULp+AhVyqGFXiShT3DxqHWcg3tFTplRdqPMl3QVg=",
-   "module": "sha256-7biouqRoijD0YqQtIuirAHY4HvISCkwKqyasIkTsQaw=",
-   "pom": "sha256-fikEQUdSd1ifC2TgEptfmZHQir9YQwZCzMXfiYbEh+E="
-  },
-  "io/netty#netty-bom/4.1.107.Final": {
-   "pom": "sha256-w2mXVYv7ThHyAN2m7i5BpF8t+eGu9njtoI553Yk4whA="
-  },
-  "io/netty#netty-buffer/4.1.111.Final": {
-   "jar": "sha256-fZS2Cfs2r9iDBMc5IkEdCPOD95RaqIK1mhUhm17L+3Y=",
-   "pom": "sha256-avx+dR4KkNLLEWj2pIVNgL87qIgQSvqzAyM80xaE9LQ="
-  },
-  "io/netty#netty-codec-http/4.1.111.Final": {
-   "jar": "sha256-v1DCEsrsh2u2+6hbdPGEgtoteCTdB2bxgpyp+TqgGlI=",
-   "pom": "sha256-gDcuPm5huos6vmI5ZMmGN2VotrvscFrbKdKpWc17n4w="
-  },
-  "io/netty#netty-codec-http2/4.1.111.Final": {
-   "jar": "sha256-qeubBicEH0iR3pKqiWSZrjNM32B9ug3N+v01FqfQ7Mo=",
-   "pom": "sha256-x/AyWqTHXJ6uHjiDBtx9EEJsaipsj3Evh29YpLwVft4="
-  },
-  "io/netty#netty-codec/4.1.111.Final": {
-   "jar": "sha256-pjrHE/YOwLjiu4GCZl0hZmLR9HSHLsXDaNJfFfVE9Lw=",
-   "pom": "sha256-bHMiRpMuE1Z6M8Liuf1KpR1zKvuqdxN8UmCoR+PQo38="
-  },
-  "io/netty#netty-common/4.1.111.Final": {
-   "jar": "sha256-muEumon1nOJPsjOFH92T48Lfrrn6AsYGJ81n+nVhhx0=",
-   "pom": "sha256-uceDN2Fr+NVNVRW6tsuh3y20b9sBtBJDTMf7r+eDRcU="
-  },
-  "io/netty#netty-handler/4.1.111.Final": {
-   "jar": "sha256-GgNGcsomyL5iRcjoZBspeF7SwBhhe7Ldfge+Offqcfw=",
-   "pom": "sha256-9XXURvpc1Ua+T84LvzTBRAQXYbidp3lx4wv4PUKQXRs="
-  },
-  "io/netty#netty-parent/4.1.111.Final": {
-   "pom": "sha256-lrBVrnr38eMts9cmGRjZAPuhXh5YnM1oL5z9V0QkmlE="
-  },
-  "io/netty#netty-resolver/4.1.111.Final": {
-   "jar": "sha256-eOc1dG0fmMqJeTF2NZyXrVu2OT7GPNKWLzDbQ74JDhs=",
-   "pom": "sha256-11JAU0WdQlycu7+T8Hk1BMTQFIx1+0naqz4U1OTTjvA="
-  },
-  "io/netty#netty-transport-classes-epoll/4.1.111.Final": {
-   "jar": "sha256-0jDRaA0VF8fXsuJe9qmofCLrvPJkoNqOgHc08Vt8fK4=",
-   "pom": "sha256-S2Dz1R7m1+WtWC5bAbSLfemiOu1SHjiHmoWGJVlk5E8="
-  },
-  "io/netty#netty-transport-classes-kqueue/4.1.111.Final": {
-   "jar": "sha256-YF/aKEplw4jiI1xWdmstmTiz1NHXJKSxe6P/8Fc8bto=",
-   "pom": "sha256-VkLEWRfCHoogtUYuQmEvNxbPFFs5oxxzzGk4DO5Wa4k="
-  },
-  "io/netty#netty-transport-native-epoll/4.1.111.Final": {
-   "jar": "sha256-nURkDSonUsX2p1wTI8vv4tdfx2JAjnSiSB11TGYm/bk=",
-   "pom": "sha256-wUs+Z3QJhxrhy4BDbdBpRVka4gHOPMlttqUpV8e55XQ="
-  },
-  "io/netty#netty-transport-native-kqueue/4.1.111.Final": {
-   "jar": "sha256-dTGy/wUYKY22fO7eO/EFbdL6otnvFMJX4A5uQERVShE=",
-   "pom": "sha256-0b9EjO2XA+QeY/U5+FIyRvKhY0NN30Mw0hMmLnMdVwc="
-  },
-  "io/netty#netty-transport-native-unix-common/4.1.111.Final": {
-   "jar": "sha256-7EvUV07h7HdqGxQTn7aZgt339QOagDCCB0qB9mBOytI=",
-   "pom": "sha256-LqcKGGSrOPzsK9woxp7pdW261YpGJsZkVU08hg1UCYE="
-  },
-  "io/netty#netty-transport/4.1.111.Final": {
-   "jar": "sha256-SaPMC200I0DwmA8EcCbbdBYcGeoqB3U6FLTSLuBlOqU=",
-   "pom": "sha256-hmK9XX9i03JUj0CtiWuH6lXCsdF5Ap75hYN9zkOlImk="
-  },
-  "it/unimi/dsi#fastutil-core/8.5.12": {
-   "jar": "sha256-8xwg9bBjEvPV4G5hYKMuJ02BmqbOvydSiya2tcDB3xk=",
-   "pom": "sha256-g5JDu+YWEfk3uwtdmzHQyOCWx9DWeZIs9u05+Cxu4NI="
+  "io/ktor#ktor-call-id-jvm/3.1.3": {
+   "jar": "sha256-gLZ42qyYTS/sXE5ZZ2MYItK8G57qk1pizj9uo8anZw8=",
+   "module": "sha256-x1DCb6DCDZfz9ZMtEUiqBhhT4+7ej2KtjALiG17O68Q=",
+   "pom": "sha256-ka+Cj0xtAN7gSn0+YRZLB8krWryTrGB1MD5+3MxyppI="
+  },
+  "io/ktor#ktor-call-id/3.1.3": {
+   "jar": "sha256-I6z4l6bILYmSlPRmZ0YCAPHknNTKp7uH5Dg/LiRzbVA=",
+   "module": "sha256-57YM1/WIqRGu7fHccypNxe+LaWbSmzkUG8xuRPKIxgI=",
+   "pom": "sha256-CgAC7FJxqPycekNdN8JEQIotoDFKuE8Qb4OHl77pZ9A="
+  },
+  "io/ktor#ktor-client-apache-jvm/3.1.3": {
+   "jar": "sha256-YfIjXuxkDJZ6Nip/hhJIUDrF/GywbfvQiakx4g8ztxU=",
+   "module": "sha256-9ECUrA4wO1Oy9SdU4GD5V+LHYPV0Rl3/sz7bodK4JQU=",
+   "pom": "sha256-ELzo+wTaUJxN41YoopyNtnzHOSwH8w7vCGaN5LnAUi4="
+  },
+  "io/ktor#ktor-client-apache/3.1.3": {
+   "module": "sha256-Aa7X/CR5yCi70v80Hpkl0dWpD5SoJthrFsbzPta6JXQ=",
+   "pom": "sha256-r64In4zSRg5gqAHfXNCVJ1ARK+HqQsVp4vMS2SVv134="
+  },
+  "io/ktor#ktor-client-cio-jvm/3.1.3": {
+   "jar": "sha256-moY0FYgFeiPTukVi/civzvb6zQcWeKDCCzsooZ7DXIg=",
+   "module": "sha256-Gf3FXgMKwvEjvNH/Ln9y5kMptpOp6liaI+6ScJrB2ow=",
+   "pom": "sha256-W5X6Bt5nhVLN/vkqmdzS6oaZSitRolVGfk3Arnq6chc="
+  },
+  "io/ktor#ktor-client-cio/3.1.3": {
+   "jar": "sha256-64zDd1PgQKDhC1ZkrqzHic0hPDZJBG9wYrjbmKOxaQI=",
+   "module": "sha256-A8RHfiHmBpt1S5eqX8z4MJXGsK2XfBBo0Zyt2BlkL58=",
+   "pom": "sha256-w8t9kA77xuTM6nvxrJSb1jjJ2CyIQ6bUjq/OInMx/+M="
+  },
+  "io/ktor#ktor-client-core-jvm/3.1.3": {
+   "jar": "sha256-dG4qPezoc3nWTECZlAGWkAHTc94UWP6FHA0uD4gLQu8=",
+   "module": "sha256-5oB4ORvBuH88HMIDRRt9L5uAhHbtptx2RKhYVIkA07Q=",
+   "pom": "sha256-vlfjAdm/W8CML/w7hstr+TRX4ubqpXtWQYb/KnjKTkM="
+  },
+  "io/ktor#ktor-client-core/3.1.3": {
+   "jar": "sha256-7n7a34hBaAPCwgDunledhgDxDkFTIbWOGwto5dn8FVA=",
+   "module": "sha256-EvDAELJfjLyCEWrqFFw6Hw8RAJXPgJE/Ori2ZTij9o8=",
+   "pom": "sha256-x2jprwXTbd2mJ6sk5p2TvM1Zv9MICg9ejvxzSxAPGA4="
+  },
+  "io/ktor#ktor-client-mock-jvm/3.1.3": {
+   "jar": "sha256-KuDVe7n8647irtplNqzG8+HeNVmEtMnacgVmuF8VJeg=",
+   "module": "sha256-fJuLPraloY+Zk+w1jIJ+FtN9aLSrFywUpn5n7N+QZOQ=",
+   "pom": "sha256-OjT7OR5B1MOvM1f15/tiXg5Z3x6OuCpZTZ/q9tYXffM="
+  },
+  "io/ktor#ktor-client-mock/3.1.3": {
+   "jar": "sha256-6zATgJE94DdNhmgvsKGWB6pkNhx5YiCsNGiEVgWyfPY=",
+   "module": "sha256-6E6gbXazYkCKePaK9DRO4ICc0U7JNelanWHjfRnXIfo=",
+   "pom": "sha256-gTytx93jygnLRrYSzaCR/urkneZaqg1EBZOI+CC7DVo="
+  },
+  "io/ktor#ktor-client-websockets-jvm/3.1.3": {
+   "jar": "sha256-mOkOy8uxp7GT2eh59D5wVBBIytE63gIsbWRRj12AJws=",
+   "module": "sha256-9xxqB84CHjXUL6/+6A6VpGalUGcIj5zvc/aUz+p6R7w=",
+   "pom": "sha256-v8mwTaPMfpA87i2PrhHPOiUBkQGA8oKGLtJ7kMysMao="
+  },
+  "io/ktor#ktor-client-websockets/3.1.3": {
+   "jar": "sha256-kaedTZSKg5V+8gireip6nPeO0vzfkuI5vMij6Z5ipXk=",
+   "module": "sha256-4IIc0qsvldXIRdWHAn51dVMGzQvAtdjTc+e80p/R3Ck=",
+   "pom": "sha256-OBV5JptMkfEFPcbwChQuiVsXbKzCZh8cNI4tUDaVSbo="
+  },
+  "io/ktor#ktor-events-jvm/3.1.3": {
+   "jar": "sha256-2nBpxueICdfDfRBOQVYTy9TNXOwe1UozLLZO9qhkoGA=",
+   "module": "sha256-OOQgRWP3P5t/373byAHAmMawHYfTECKQ8sajYuoTUdY=",
+   "pom": "sha256-93csYlM0BJC0293doSvci7K6B+jFvLjAtxvy9rbVgVY="
+  },
+  "io/ktor#ktor-events/3.1.3": {
+   "jar": "sha256-EOdojQWik+k9467ZuxEfmpV00K0IQ9QIzfE0DHncx1c=",
+   "module": "sha256-SrtBkdOeN5QGiSqErN705lqyJiG+hBE5cFn01GIa/vk=",
+   "pom": "sha256-XestkhWtgPoJtSCKhitHo2ydHL0Yo/lM+jgOPUp3GDY="
+  },
+  "io/ktor#ktor-http-cio-jvm/3.1.3": {
+   "jar": "sha256-sErt4Y6cAIFoCW3FOj/AFhd7YaXsMCSvv4ysoM1dv0I=",
+   "module": "sha256-IX4QLGEQ/ocl/6oSUKN+f0t1teTeERcrnPKzOp+wfAg=",
+   "pom": "sha256-gOmz2o6VeGObSyn/TBTP6/IOzNW5xHEz0U+CV5L+CDk="
+  },
+  "io/ktor#ktor-http-cio/3.1.3": {
+   "jar": "sha256-IzLwt1DKuYqOi/YqikkohFAp8Ai79EzF2wgk7qOU3uo=",
+   "module": "sha256-iHbg5qXpx8u3jesES57d9zrGdhAvd86GrXIcm3TtOo0=",
+   "pom": "sha256-GI7a2ilETzpIPqUM1yUDesrifyZuP2+dGycMW/pfWMY="
+  },
+  "io/ktor#ktor-http-jvm/3.1.3": {
+   "jar": "sha256-ilDZS0b5G9VlgLkWknLWzWNvRCAyugeKFB2nBBNGWUY=",
+   "module": "sha256-TspOEQpq9l7faaAXoJJLizyO01cuHvboyhnSp+jOsdI=",
+   "pom": "sha256-+NbU7DyYNRpjYjfuqGVLjC6l2ME9YZR+fbjo+WaOjKo="
+  },
+  "io/ktor#ktor-http/3.1.3": {
+   "jar": "sha256-rUgmpsG5/IZUZ+5jGRCpP7WnGX9wJflqNkwRVcPJRSk=",
+   "module": "sha256-bBO1SCiBE6ubWCOidWV2CulpkWOJ04GgZXyjn7vTim4=",
+   "pom": "sha256-7idNqX1di1SNU4b3fULG67fKrD79rWPRwstbHLDkfqs="
+  },
+  "io/ktor#ktor-io-jvm/3.1.3": {
+   "jar": "sha256-uy+2wAr6o0tTnLMOdYTTe/y6Fxwma725mQ4ANXncJME=",
+   "module": "sha256-pUnfJeuyazKSWYP9oC41YPP++voCniJGncBpPNq7clE=",
+   "pom": "sha256-mNkD8tAjCib7DVxoK61A2MlUq+e5d6FdyMFtENx0tcI="
+  },
+  "io/ktor#ktor-io/3.1.3": {
+   "jar": "sha256-1mdwNHtTpmLFy263VW23Ra0C/yaPZeBYL/SWg41gO5A=",
+   "module": "sha256-YZ/tWS8/2Z8/x/U99YZuJSenDRzUitwSVxJqYxJ/nC8=",
+   "pom": "sha256-7ktgsFmUplhPYYkmL7F/hTXWSW/IlKM16S7UiJogUk0="
+  },
+  "io/ktor#ktor-network-jvm/3.1.3": {
+   "jar": "sha256-+k5hZbWtS/XbM369Xxb5tZbcXkAfvqNDud6sthOCQK8=",
+   "module": "sha256-Si6Qj4EHpZBwIUVoR9cHuGxQzp5tOaFrRO/WzPgvEAI=",
+   "pom": "sha256-TFAXZfbtxft4UvcmvYFXJw2lCfKl58xWlR02Muwro9Y="
+  },
+  "io/ktor#ktor-network-tls-certificates-jvm/3.1.3": {
+   "jar": "sha256-BkwhltwxGzPP+aqaVmTr7dbuiz67IA60jZtfRZQSrlM=",
+   "module": "sha256-gcQGERjUAa6kl6qgylndfhpGJjh5OdRx5JWstsm+OJY=",
+   "pom": "sha256-y7AvvPCe0qrTls3EEiXtE0+t1pEQATHleZ3Y+s0qCxs="
+  },
+  "io/ktor#ktor-network-tls-certificates/3.1.3": {
+   "module": "sha256-/kfhj/9BW9Y/QbJDgAJCbWos1nu2bU3l6fMxWG0puL8=",
+   "pom": "sha256-u91KdHx2L7qlIfadR+KYYEoGqN4xD2L1ub7LB1mcXbk="
+  },
+  "io/ktor#ktor-network-tls-jvm/3.1.3": {
+   "jar": "sha256-9nUHo+i/UqoI11NoLmzdoBlOOr51ARi5nJM2lT5Zi+k=",
+   "module": "sha256-R6w5Z4HWgpnnykgITN4N1ZNrh2FHNAH8wftced8TG7o=",
+   "pom": "sha256-x3zaqx/JtbTUdUvvzgAIbfXxCOn03cL2J4IqACeiFVU="
+  },
+  "io/ktor#ktor-network-tls/3.1.3": {
+   "jar": "sha256-vLgy2Hr+70QUDBlg9ey228QQ9wTzrbL9oi2deO/N3LA=",
+   "module": "sha256-WfzehlGXLzN8L5kJEfakcCxaMcgsRVLnBQH0cFKq9Ok=",
+   "pom": "sha256-YCA6aPexaUd84QS42Y0YGf6p5yPYUSR419IdMcp/FUU="
+  },
+  "io/ktor#ktor-network/3.1.3": {
+   "jar": "sha256-jqkqtUms54rXMCOgdDhnzhDEvH6HuJS8TdPd9EWmh3o=",
+   "module": "sha256-3TRbPopwzopilO5mDnAmO1v2Tkiz5hrJ50dlKpeeZxw=",
+   "pom": "sha256-ilEKTIUHv+XJw7qLFA7eGPWCrBF1+mx46Siiv2XjyrI="
+  },
+  "io/ktor#ktor-serialization-jvm/3.1.3": {
+   "jar": "sha256-DXBLwRSKj9mh8gBeC1GJza7TAw7+JLgjZFnEHDVvViA=",
+   "module": "sha256-hrLAT4uo4LfDEL2gGGd1ra0iQbfx5Dru5CH6aHtD0bs=",
+   "pom": "sha256-4ZshuXOBpTTKtMJCDaZBdTzYYMffWMvEgfrxfgw+LL0="
+  },
+  "io/ktor#ktor-serialization-kotlinx-json-jvm/3.1.3": {
+   "jar": "sha256-m4EPAcqm4/J+Atccq6hZXitLBAcduhbg5CbiARW+01Q=",
+   "module": "sha256-Q8ZICBvOetLCv9HVLiJif/Ctu2WXvR0qBW8kuJfFUBI=",
+   "pom": "sha256-H+t05IxocuBJhVDaoUm51ezRGz8/0rWw16WJ2wJvU4M="
+  },
+  "io/ktor#ktor-serialization-kotlinx-json/3.1.3": {
+   "jar": "sha256-CYtkKozmGWKJ0BsgMOQxfI3hyflxL3tb/dgKyAvoCyE=",
+   "module": "sha256-00l9qrTzDFIDWmtaIxCS6OfTwRkh0kqCQPtW0WO08jc=",
+   "pom": "sha256-GKfcV/J/1w2yrVxQ6NqhQueryuuC1w9XC2K5JekScuo="
+  },
+  "io/ktor#ktor-serialization-kotlinx-jvm/3.1.3": {
+   "jar": "sha256-tNwvnU0d2o1IGgVNf4M7oZXwZPURX946sN/bi0L2H9o=",
+   "module": "sha256-TQfjPiAej7Dz4Au8iPU6czUrNAARd3K6U8b1T03chLI=",
+   "pom": "sha256-MgXGnrCSBOC1v1UiWvKWtqRfWtFfitvdbs9nU8M5CKs="
+  },
+  "io/ktor#ktor-serialization-kotlinx/3.1.3": {
+   "jar": "sha256-AHj3k3AFwnibzWyNaFwBm/7y74WcHrXgsSzCKg7T56o=",
+   "module": "sha256-yc+GGYze19bUrMkH9CRmMEMaKlPCOvJbAkmulngmeBI=",
+   "pom": "sha256-Apcaj2Ndohz/xUbuS2TLhUzxVSPNKO/Jax9BQOsEQ+o="
+  },
+  "io/ktor#ktor-serialization/3.1.3": {
+   "jar": "sha256-1usUAlHKWspctpxK1+8Yk1OiutpxL4Nog4RXCrJCzRA=",
+   "module": "sha256-cEzCV/1TL86ynz3JxpmKhXw8JVuR5sAtlzXCi29Ywr4=",
+   "pom": "sha256-hn199YlXfKzLAkrZuhD9YFZ8CfpoqsAU6QOZzuSEuck="
+  },
+  "io/ktor#ktor-server-call-id-jvm/3.1.3": {
+   "jar": "sha256-rTrEYCx7HiMyWkH2G2lnMJriNcR0yc/Y+3mYSC2vesY=",
+   "module": "sha256-E0rhT6hN6dZmQESVL/Nt5OsgmfaL/GPS+tOFc3W9gGM=",
+   "pom": "sha256-VQUyPQQ9649tC75IijPH75yS5L3Y3wdga8MrzM9GsEI="
+  },
+  "io/ktor#ktor-server-call-id/3.1.3": {
+   "jar": "sha256-QPsVJH80qfHY9NbU6zeNb+Q7GGJ7QU4Ig5MqG8YZDrE=",
+   "module": "sha256-wsauzHFW6QEiqgBvbUBJzA+r4SJnT/vpEMgGKEYDgfQ=",
+   "pom": "sha256-M8us44N1Lsp1fVURdydRZwvuXgCWUeimR+CG7PFqcXc="
+  },
+  "io/ktor#ktor-server-call-logging-jvm/3.1.3": {
+   "jar": "sha256-7X31L642IGDIZyuUMrt7kJl5z7pWqktIZbDvLNglxRM=",
+   "module": "sha256-VCBc70vbjMgJX4lU3JpcfvU8ImYLT5qd5F36JXIuDtc=",
+   "pom": "sha256-t3DDhM7ut6pisXLree6nWqKX1aYcJA94Pg3otS/NJQ8="
+  },
+  "io/ktor#ktor-server-call-logging/3.1.3": {
+   "jar": "sha256-CJ4kQXv59sNO7Fcg7rssvMguooVezvkBM+sX4QedWGg=",
+   "module": "sha256-CgT5aT2q2oRyRQfMrJDFsbhdwOQd4z0Cy9V+c9LmGtg=",
+   "pom": "sha256-TXkBTRr1UUpsDc0mRobP6RZcIUxAwYmVtq3BMdjU0Y8="
+  },
+  "io/ktor#ktor-server-cio-jvm/3.1.3": {
+   "jar": "sha256-8VJv6U6NdsUlG1ol5LS7chmaJdPh9gReS55CeJKT8Gk=",
+   "module": "sha256-jF0I8BCfdzqJxxGy+6UZpxN+s20aNdqsBxlOhHT/cno=",
+   "pom": "sha256-jYVlFWQAUM8hwbsJGwySg+AxA5jq7NF08IDxvMZxDfw="
+  },
+  "io/ktor#ktor-server-cio/3.1.3": {
+   "jar": "sha256-KC7iPoPNM7ETWgb5cKPnFJ1yQAEO1SVPUS9QDgID0l4=",
+   "module": "sha256-/2Sq4LOGKM/ZmC6Oaulpm58Wul9KZEyYVeikTEQfwBk=",
+   "pom": "sha256-Is28uQDeec36fV1VUc81PvreC8sst8ra0XMFY5fNhLg="
+  },
+  "io/ktor#ktor-server-content-negotiation-jvm/3.1.3": {
+   "jar": "sha256-w1b9Wlr7+4tDGOHXcppI9vDsYL4Dxx6cTOajBOTFJ2o=",
+   "module": "sha256-bd72oiTHCSObzfd90inqxNHPzmfuwfu/f088kavQYSU=",
+   "pom": "sha256-K44R9mNdl/LmTNAB6A4l3w5zCQzdiIP9GZJzZk3Jtuc="
+  },
+  "io/ktor#ktor-server-content-negotiation/3.1.3": {
+   "jar": "sha256-zp/Y6sVgtfvD9fUdCT6aqAA86sA/GZo4NhqwtcLsy/A=",
+   "module": "sha256-SvkMyeuDjpzCSjoInox442aX7hEuZU9u2KlrBTC4EBc=",
+   "pom": "sha256-prlMX89HukRZm7b3nD9FtNpzYe2LwgLsaqn8bLkP0h8="
+  },
+  "io/ktor#ktor-server-core-jvm/3.1.3": {
+   "jar": "sha256-v1groARjTQ00O7Lfoe3Q6N4YzcLGB6QInbi3nTCF0Qo=",
+   "module": "sha256-ZHlHr1JToWRVDLpNSDySwdYaQ6OH1vyh+i1KTufmgxI=",
+   "pom": "sha256-0/zeJwXJ3zLhKLLao7ieLEyXWs8WX0yY46ySWbz9k2E="
+  },
+  "io/ktor#ktor-server-core/3.1.3": {
+   "jar": "sha256-n+YeO2DxvKhHcxl/pdkEkpQpM6wNGoxhMBYIjk/HVKA=",
+   "module": "sha256-BxQ9OzY9g3H2iABYcT5McpJNs8K/WLAPka8DdDt8L9E=",
+   "pom": "sha256-VMbKa2gSQD4SxOHzputA+R9bAjjHe7dOz9q4vjx0eJo="
+  },
+  "io/ktor#ktor-server-cors-jvm/3.1.3": {
+   "jar": "sha256-2ugPxtOsO/+i/DPKu+d3b7HihnVxRktUrgkO49qxoOE=",
+   "module": "sha256-YeolK4tzm148tUP51u077wIAj5RtbkuZbOl3miCU6Ro=",
+   "pom": "sha256-MpdTjWVFj9O0xXMDir8A1GK6rjv5Lq6sG21uNEtH5e0="
+  },
+  "io/ktor#ktor-server-cors/3.1.3": {
+   "jar": "sha256-XLfoUSjIQ88lTsNnH9d1KY2ePRwLyQtj0zolzAKTxHc=",
+   "module": "sha256-Gq3OQioAWKS7LRr4J9CB415u/5lpsLVzaUD2W6WYwhw=",
+   "pom": "sha256-j1OZffe+XGR1zXmGO054OWNlXaS0GVVG0LDqWZshWBo="
+  },
+  "io/ktor#ktor-server-forwarded-header-jvm/3.1.3": {
+   "jar": "sha256-s/5ie75S2mX7QNjEerdsRPupljs8nDEjhwQ0GoEHfcI=",
+   "module": "sha256-w4fnLNPOdjpBBijHIZT45HN1vSkG+jTf+7iN8VC7KAE=",
+   "pom": "sha256-OpaLxwNHvyWzUAoOs6+IpHjS4muXFdvd6l8/2mxNG4Y="
+  },
+  "io/ktor#ktor-server-forwarded-header/3.1.3": {
+   "jar": "sha256-HulEGAyI4tFlLm1QeCY5sRLVcdvoukuIFjRPTEoKM3w=",
+   "module": "sha256-Pxd4X7nqMuMkxCaOlPnt/rDHC/8r5Tp0ThbZKlsMDkk=",
+   "pom": "sha256-vMhQMKQcIBuT9G2tPO76XF+QU9Yx0P/9Z+t26Dk13D0="
+  },
+  "io/ktor#ktor-server-status-pages-jvm/3.1.3": {
+   "jar": "sha256-3yRhBJ//jUfWekNSRNN8yxpYB6s09e0Msz9KdN3ylW8=",
+   "module": "sha256-JW6mNpHvN35LumZDQuM77iT4QCuGbDXQd9V9qdjbfS4=",
+   "pom": "sha256-muGktnWGux/LNpQkW0buokeYGdS0p85UefOFZGtbg14="
+  },
+  "io/ktor#ktor-server-status-pages/3.1.3": {
+   "jar": "sha256-emBe4975jEOApk7fge0C0SZ352mLxjmplrkexsRL0MY=",
+   "module": "sha256-ld6F0TrWQOAzu+LYFWptmoHhDcdk5A3+dPCUWwKcsNw=",
+   "pom": "sha256-tNjWQzwDYT3UOISqZT6DVPfWoHs50lz0+b34OzO5hWo="
+  },
+  "io/ktor#ktor-server-test-host-jvm/3.1.3": {
+   "jar": "sha256-JBz8iHfwdYLZ4aPV9kKlMXUbpV1qPPy03UANS+Jl/bI=",
+   "module": "sha256-VS79ptC5+EvuLPMdrM7SNgJbCtDUXmUP7lvB+4DmLAg=",
+   "pom": "sha256-4GSEOaK5jw+2l5Py3HxdOjWS1AcAJGryry0SEYb/Sag="
+  },
+  "io/ktor#ktor-server-test-host/3.1.3": {
+   "jar": "sha256-N3BXI3qHirkZ3VN2ZM7Pal/SpLUZ1fc6FWVBaqOmOB4=",
+   "module": "sha256-YaPbsgWq0MkdHPEpfYYYbZwVcp8KOpr8tmRjwIWjmRM=",
+   "pom": "sha256-KWsnR/usc2YKH/tcAs7EL5qAAKQakM/XZm6LQF8EdV8="
+  },
+  "io/ktor#ktor-server-websockets-jvm/3.1.3": {
+   "jar": "sha256-XX+QXUiqiNepjf/sOU4aUMSKcDqUDUN0tTeYJdYCWzI=",
+   "module": "sha256-bO13M/ikp+IL53YKlFG4YHzB7OI2YRO130BXx3zJgdQ=",
+   "pom": "sha256-Wl34pRgEfol295ye1/2DAryMaMMvboujUHJ7JCNLlhg="
+  },
+  "io/ktor#ktor-server-websockets/3.1.3": {
+   "module": "sha256-H0FP3DbRwIXwMnX4jjMrlHPo0aeaz6GaMYfCj/s5EW8=",
+   "pom": "sha256-QG/cwxgyVWWv34Z1hSFMd3u1Ry6rBljVPole9jRqF4o="
+  },
+  "io/ktor#ktor-sse-jvm/3.1.3": {
+   "jar": "sha256-oq6KM4ux1EbRbc/qIYnvWlvjGogSOzh5Vit5VWZ6Vjk=",
+   "module": "sha256-rdg6VuF2nwNnQhRnvrsHfPywrKIG5GKlJ9xYePU2K1M=",
+   "pom": "sha256-QOpyqdXTF9TMFZl3/HvSlQED4m5/3C3sRKgxWNyzmxE="
+  },
+  "io/ktor#ktor-sse/3.1.3": {
+   "jar": "sha256-CZgN7Mg5zmR1e5ziCOTFcdyH/Iqx1JBq0bVWBfp5s8Q=",
+   "module": "sha256-y6bUpfymP+8fbYEujnoYIC37tlUfFsrjPjM9aJ3xmmo=",
+   "pom": "sha256-zm3mJKVfOZ/FzYOKH1e4NjEp6x5j851TbCQnpe2AZYw="
+  },
+  "io/ktor#ktor-test-dispatcher-jvm/3.1.3": {
+   "jar": "sha256-NrzzX5TEWzqMBQ38UuiJfwnh4IGiSnWjio+nsCk1flc=",
+   "module": "sha256-/tR5MXA2RYzSqhlb5RDEKIIZY8sC73wTPoeI4nYYgF4=",
+   "pom": "sha256-SyL11I6e6FgTtCAeZlxLnn1pHKbhxAaW8TSnhJoV4HE="
+  },
+  "io/ktor#ktor-test-dispatcher/3.1.3": {
+   "jar": "sha256-AN3bYYjb/HGfe6upeVoizfw3YeOaWT6Pf0XkMgco2sc=",
+   "module": "sha256-gHxquj5arC0GbU2CwiN2mimNFyAcwWqSjrR+7sqQ7+A=",
+   "pom": "sha256-B62EIIeEymYaKPwyH+pDmqrMTmxmMqnnJHh0TMKOGFM="
+  },
+  "io/ktor#ktor-utils-jvm/3.1.3": {
+   "jar": "sha256-MzM5N7mPwMjpQ+5LELPqZrSXgt+1acRMFC2k8y2F3/w=",
+   "module": "sha256-lWS9gapHoNIfgfAhNx2KfzP42nJXb42E5YTPe8KCZ7g=",
+   "pom": "sha256-nkoVp9atlvtmX5kPM/TJDIUmPLkxUlDUmzEw3Bxx3Rs="
+  },
+  "io/ktor#ktor-utils/3.1.3": {
+   "jar": "sha256-8x9wURdB2HuriPQcJIu/q8Kokg/CsWr7iWvSkSQDyhk=",
+   "module": "sha256-JZJhaENGuzO48fd5tY0RafZYNLa8SwOxzI6QOaVNFgw=",
+   "pom": "sha256-i3GcmWpfQAiH+9aZyYfyQ59q3DGyS+I8UaOR+Yfinu0="
+  },
+  "io/ktor#ktor-websocket-serialization-jvm/3.1.3": {
+   "jar": "sha256-Z/D1ZuLtUXF/btVfbStN7hyEvk6izZb8Y20L3w/UMGc=",
+   "module": "sha256-u1PzbCOOIEp3AojhuUkEpyDqjMmCpBnr0NlthP/2Dpg=",
+   "pom": "sha256-GE/EIEOdOTZc2yOAp9iqWCRQmuJ2WGYLrdUgiLTtRaY="
+  },
+  "io/ktor#ktor-websocket-serialization/3.1.3": {
+   "jar": "sha256-H4Kdk+9uqBnvMbwuO81vRj8f2/Zgrg6MngFGGSs1khE=",
+   "module": "sha256-49SsMoW7+o4lNURzq9eVpX2Z28k5wL0+1ZjDH1JHSRs=",
+   "pom": "sha256-ZrLLfZtUa9iXxCSSwsFvresrRhtWEK1tQbLwX9MAEeA="
+  },
+  "io/ktor#ktor-websockets-jvm/3.1.3": {
+   "jar": "sha256-7yi08SBU7hJXZbcv4yMOIVpgtzsv8gcqXCgPzwkykHc=",
+   "module": "sha256-0TNZF+t77kMTTSYVARydRRUdDN3+036GsoZN9N959ck=",
+   "pom": "sha256-wpP8Ln5PBBczeWfnK4iFVsDICmv2vjSdzi9WBAVFl78="
+  },
+  "io/ktor#ktor-websockets/3.1.3": {
+   "jar": "sha256-+haBQSo9iI+FM+XkJwLzOOTgUmpr3dKhxOxk0WdTlMk=",
+   "module": "sha256-la4yLJcPwcxRMttyqbkXOYd7eYEaHHAW4P02P4fTTlg=",
+   "pom": "sha256-nfZPKimVknp58bfTOSkwi/8WWJ36VdYix6hSVIZMDWA="
   },
   "jakarta/activation#jakarta.activation-api/1.2.1": {
    "jar": "sha256-iwoPUvqLBcVDGSGgY+2GbvqkHa3y46fuPhlh8rDZZFs=",
@@ -608,23 +653,23 @@
    "jar": "sha256-+9BS0tTNFvcHVHxGhiHGt/uELH7Ihm0BLsvGF43h85Q=",
    "pom": "sha256-GZB0lfvBwjFsjrrXbwe5bRAf6xp+PAm/4VJv0/xu7J0="
   },
-  "net/bytebuddy#byte-buddy-agent/1.14.9": {
-   "jar": "sha256-Ee0QfUt45V+MPTQlBJQ3UIGim8ElofXFbbWCzN1Ig18=",
-   "pom": "sha256-qxHpogIx0YZqfUA16wsAdbgDYNjN3F0KNzw5WE6c0kc="
+  "net/bytebuddy#byte-buddy-agent/1.17.4": {
+   "jar": "sha256-4drn78VWLCmtO2JbkOaGQgjeabrVYyw/k6VH8XYirFE=",
+   "pom": "sha256-1ghCjJXnT6aXreYmDmCUE8O+oL+Wh72hvoe3BAPi/8k="
   },
   "net/bytebuddy#byte-buddy-parent/1.10.9": {
    "pom": "sha256-k9nTgHec0XaMUrS87oLL+u3vmkow3oeuBrRB4WNP04w="
   },
-  "net/bytebuddy#byte-buddy-parent/1.14.9": {
-   "pom": "sha256-Zrg0IlHTXyBj5pMW9juvywVjQv516SHA9GXC2WWTU14="
+  "net/bytebuddy#byte-buddy-parent/1.17.4": {
+   "pom": "sha256-4FQGL6bGDfvTnqmX8zgQZWTR7w3f5vu+qGeD+toDvak="
   },
   "net/bytebuddy#byte-buddy/1.10.9": {
    "jar": "sha256-B7nKbi+XDLA/SyVlHfHy/OJx1JG0TgQJgniHeG9pLU0=",
    "pom": "sha256-QIgdSUiocRWTRicPNpRbwpAlV3xstX9qXdDHwiIGnaw="
   },
-  "net/bytebuddy#byte-buddy/1.14.9": {
-   "jar": "sha256-N3NS4lMoK/hvcxrJDtiDSOj0CmPOAzwAqFmC3n55Dm8=",
-   "pom": "sha256-LWdykQ0WFpvUySKeijZc9U4ZK8Ygy8+n+EJx9dEV6BU="
+  "net/bytebuddy#byte-buddy/1.17.4": {
+   "jar": "sha256-dHaHMSGaWy4MydKxyeIJLgYiJC5BsZJaa6c0bhYHMbw=",
+   "pom": "sha256-7sHUc2OcrqtenXbx+KSGRrCQZ7DFyYS3oL5TAoghg10="
   },
   "net/java/dev/jna#jna-platform/5.9.0": {
    "jar": "sha256-GQO8bYfzq5ICOVe5H0WpyOs1FbrQMDVs6XcgHlFBtyQ=",
@@ -652,16 +697,19 @@
   "org/apache#apache/31": {
    "pom": "sha256-VV0MnqppwEKv+SSSe5OB6PgXQTbTVe6tRFIkRS5ikcw="
   },
-  "org/apache/ant#ant-launcher/1.10.14": {
-   "jar": "sha256-8JCXJaeiTjk4iPP7tVg0er9QbOL368WB/yYzG5TZUaU=",
-   "pom": "sha256-nJ2qQSPp63BzVnk2UsOIo1UQqqWm0UW0T4VdCN1LK7w="
+  "org/apache#apache/33": {
+   "pom": "sha256-14vYUkxfg4ChkKZSVoZimpXf5RLfIRETg6bYwJI6RBU="
   },
-  "org/apache/ant#ant-parent/1.10.14": {
-   "pom": "sha256-CBYQamBniMJw767yFWLPy9j0uvfafBG85RSetWYbMx8="
+  "org/apache/ant#ant-launcher/1.10.15": {
+   "jar": "sha256-XIVRmQMHoDIzbZjdrtVJo5ponwfU1Ma5UGAb8is9ahs=",
+   "pom": "sha256-ea+EKil53F/gAivAc8SYgQ7q2DvGKD7t803E3+MNrJU="
   },
-  "org/apache/ant#ant/1.10.14": {
-   "jar": "sha256-TLvZJD3kwQQtYdmhXbTEPJD/k7FteLOUgdoclWyOlnE=",
-   "pom": "sha256-L6QmnmscRXI6iojmnZhKdm27IEzQ/pgUlMzfP+469lw="
+  "org/apache/ant#ant-parent/1.10.15": {
+   "pom": "sha256-SYhPGHPFEHzCN/QoXER3R5uwgEvwc3OUgBsI114rvrA="
+  },
+  "org/apache/ant#ant/1.10.15": {
+   "jar": "sha256-djrNpKaViMnqiBepUoUf8ML8S/+h0IHCVl3EB/KdV5Q=",
+   "pom": "sha256-R4DmHoeBbu4fIdGE7Jl7Zfk9tfS5BCwXitsp4j50JdY="
   },
   "org/apache/commons#commons-parent/34": {
    "pom": "sha256-Oi5p0G1kHR87KTEm3J4uTqZWO/jDbIfgq2+kKS0Et5w="
@@ -669,8 +717,12 @@
   "org/apache/commons#commons-parent/42": {
    "pom": "sha256-zTE0lMZwtIPsJWlyrxaYszDlmPgHACNU63ZUefYEsJw="
   },
-  "org/apache/commons#commons-parent/69": {
-   "pom": "sha256-1Q2pw5vcqCPWGNG0oDtz8ZZJf8uGFv0NpyfIYjWSqbs="
+  "org/apache/commons#commons-parent/74": {
+   "pom": "sha256-gOthsMh/3YJqBpMTsotnLaPxiFgy2kR7Uebophl+fss="
+  },
+  "org/apache/groovy#groovy-bom/4.0.22": {
+   "module": "sha256-Ul0/SGvArfFvN+YAL9RlqygCpb2l9MZWf778copo5mY=",
+   "pom": "sha256-Hh9rQiKue/1jMgA+33AgGDWZDb1GEGsWzduopT4832U="
   },
   "org/apache/httpcomponents#httpasyncclient/4.1.5": {
    "jar": "sha256-DBh3SJqdG6T6UPbPyrEdESNhiFjLMdVq+qta/dUGTZk=",
@@ -700,22 +752,22 @@
    "jar": "sha256-PLrtCIxJmhD5bd5Y853A55hRcavYgTjKFlWocgEbsUI=",
    "pom": "sha256-Kaz+qoqIu2IPw0Nxows9QDKNxaecx0kCz0RsCUPBvms="
   },
-  "org/apache/logging#logging-parent/10.6.0": {
-   "pom": "sha256-+CdHWECmQIO1heyNu/cJO2/QJiQpPOw31W7fn8NUEJ4="
+  "org/apache/logging#logging-parent/11.3.0": {
+   "pom": "sha256-pcmFtW/hxYQzOTtQkabznlufeFGN2PySE0aQWZtk19A="
   },
-  "org/apache/logging/log4j#log4j-api/2.23.1": {
-   "jar": "sha256-kuwf02qzvAneYZjS18CRRoXA9xJ+qTGswy/S7N2C6ok=",
-   "pom": "sha256-tnzD0JgJJwSaO+sA1Qbs4oh0ZzKw3sgSJFxZ9FP7HKE="
+  "org/apache/logging/log4j#log4j-api/2.24.1": {
+   "jar": "sha256-bne7Ip/I3K8JA4vutekDCyLp4BtRtFiwGDzmaevMku8=",
+   "pom": "sha256-IzAaISnUEAiZJfSvQa7LUlhKPcxFJoI+EyNOyst+c+M="
   },
-  "org/apache/logging/log4j#log4j-bom/2.23.1": {
-   "pom": "sha256-NyOW4EWNTNMsCWytq+DMkzDsEPT1f6O+LnT3m14XijU="
+  "org/apache/logging/log4j#log4j-bom/2.24.1": {
+   "pom": "sha256-vGPPsrS5bbS9cwyWLoJPtpKMuEkCwUFuR3q1y3KwsNM="
   },
-  "org/apache/logging/log4j#log4j-core/2.23.1": {
-   "jar": "sha256-cHk2gAX8NPViSPV/iopTNhw6U+kAfVVtvGb8Zp3wgbU=",
-   "pom": "sha256-yJugwjdXURuSUrJ6cx0B6GOyjd/OUD597pSuIxjILdw="
+  "org/apache/logging/log4j#log4j-core/2.24.1": {
+   "jar": "sha256-ALzziEcsqApocBQYF2O2bXdxd/Isu/F5/WDhsaybybA=",
+   "pom": "sha256-JyQstBek3xl47t/GlYtFyJgg+WzH9NFtH0gr/CN24M0="
   },
-  "org/apache/logging/log4j#log4j/2.23.1": {
-   "pom": "sha256-bOFUBFU2S1PqIqGDQssSamOBYz9lPwlUZ/KqGYURps4="
+  "org/apache/logging/log4j#log4j/2.24.1": {
+   "pom": "sha256-+NcAm1Rl2KhT0QuEG8Bve3JnXwza71OoDprNFDMkfto="
   },
   "org/apache/maven#maven-api-meta/4.0.0-alpha-9": {
    "jar": "sha256-MsT1yturaAw0lS+ctXBFehODzOxMmlewOSYH1xkcaUk=",
@@ -741,37 +793,43 @@
   "org/apache/maven#maven/4.0.0-alpha-9": {
    "pom": "sha256-5QzZ/zefQ3H3/ywsrFF5YfPS9n7fgJCHU8e9UGuRPX4="
   },
-  "org/bouncycastle#bcpkix-jdk18on/1.78.1": {
-   "jar": "sha256-S0jqCE5SMrnXnryhiHud4DexJJMYB81gcQdIwq7gjMk=",
-   "pom": "sha256-CVIrr36Zuqk6JRXRbPHLlT+iJ41+PEbIvv8n3AQXKDE="
+  "org/apiguardian#apiguardian-api/1.1.2": {
+   "jar": "sha256-tQlEisUG1gcxnxglN/CzXXEAdYLsdBgyofER5bW3Czg=",
+   "module": "sha256-4IAoExN1s1fR0oc06aT7QhbahLJAZByz7358fWKCI/w=",
+   "pom": "sha256-MjVQgdEJCVw9XTdNWkO09MG3XVSemD71ByPidy5TAqA="
   },
-  "org/bouncycastle#bcprov-jdk18on/1.78.1": {
-   "jar": "sha256-rdWRXmrPxqtYNuH9il4hxkiFNqjB8h84bus78oC3Atc=",
-   "pom": "sha256-KJEtE5+e7RQcOUNx++W6b//5HnjxycuDSPlEok0gTtI="
+  "org/bouncycastle#bcpkix-jdk18on/1.80": {
+   "jar": "sha256-T0umqSYX6hncGD8PpdtJLu5Cb93ioKLWyUd3/9GvZBM=",
+   "pom": "sha256-pKEiETRntyjhjyb7DP1X8LGg18SlO4Zxis5wv4uG7Uc="
   },
-  "org/bouncycastle#bcutil-jdk18on/1.78.1": {
-   "jar": "sha256-2fpW+XsPdhzjvI2ddMXXE3qYe/W9Or/hAD+br6RaHS8=",
-   "pom": "sha256-dB1Vy0XEwsiJtaQ2t0fcIVKSMTLkJr5u9VUA7uf6UxI="
+  "org/bouncycastle#bcprov-jdk18on/1.80": {
+   "jar": "sha256-6K0gn4xY0pGjfKl1Dp6frGBZaVbJg+Sd2Cgjgd2LMkk=",
+   "pom": "sha256-oKdcdtkcQh7qVtD2Bi+49j7ff6x+xyT9QgzNytcYHUM="
   },
-  "org/checkerframework#checker-qual/3.42.0": {
-   "jar": "sha256-zK7dM68LeJTZ8vO2RPTRnkOSjjKQLmGsTRB3eDD1qsc=",
-   "module": "sha256-4PpiK33mPq4RBH726RtMKtDx8OE8uQP/UggKR/V6V0Y=",
-   "pom": "sha256-v1/KqycvVMvPG753w72WPIIcmrrSBYcIvwvtPIdUlMo="
+  "org/bouncycastle#bcutil-jdk18on/1.80": {
+   "jar": "sha256-Iuymh/eVVBH0Vq8z5uqOaPxzzYDLizKqX3qLGCfXxng=",
+   "pom": "sha256-Qhp95L/rnFs4sfxHxCagh9kIeJVdQQf1t6gusde3R7Y="
   },
-  "org/codehaus/groovy#groovy-bom/3.0.21": {
-   "pom": "sha256-ksw2r/0g9Wi1CSwLlOz1hd3rCigbbIunJWVwuxhdZTQ="
+  "org/bouncycastle/bcutil-jdk18on/maven-metadata": {
+   "xml": {
+    "groupId": "org.bouncycastle",
+    "lastUpdated": "20250114201150",
+    "release": "1.80"
+   }
   },
-  "org/codehaus/plexus#plexus-utils/4.0.1": {
-   "jar": "sha256-lrnMREORkdLQY1l04tROdoc2tPsqvLZflM2V5BkS+os=",
-   "pom": "sha256-vEI1qVzR665CZEyB67qcHUxSVl+B6WqyBLblbj43jME="
+  "org/checkerframework#checker-qual/3.48.3": {
+   "jar": "sha256-RDaFsbIygDuq+APBXW9aQlRzxve4HF8nbfz5MojjiaU=",
+   "module": "sha256-Enu8VRPkHM/ms8tvqngBQjNJqVQUNnrLfPdil2dUnlk=",
+   "pom": "sha256-te+ROQIjzafQKelrKwwcZPVVu0Ad9lfqLLm7fElrqbE="
+  },
+  "org/codehaus/plexus#plexus-utils/4.0.2": {
+   "jar": "sha256-iVcnTnX+LCeLFCjdFqDa7uHdOBUstu/4Fhd6wo/Mtpc=",
+   "pom": "sha256-UVHBO918w6VWlYOn9CZzkvAT/9MRXquNtfht5CCjZq8="
   },
   "org/codehaus/plexus#plexus-xml/4.0.4": {
    "jar": "sha256-Bp54tTcQjcYSSmcHP8mYJkeR9rZJnpVaOOcrs+T+Gt8=",
    "pom": "sha256-Ohb3yn7CRzFFtGHgpylREI1H4SThjIRMCFsaY3jGEVE="
   },
-  "org/codehaus/plexus#plexus/17": {
-   "pom": "sha256-kVJu5mMnx/UPuyW9Qb/LkW4oRBS4aOMdUKIwBL197qc="
-  },
   "org/codehaus/plexus#plexus/18": {
    "pom": "sha256-tD7onIiQueW8SNB5/LTETwgrUTklM1bcRVgGozw92P0="
   },
@@ -788,16 +846,6 @@
   "org/eclipse/ee4j#project/1.0.7": {
    "pom": "sha256-IFwDmkLLrjVW776wSkg+s6PPlVC9db+EJg3I8oIY8QU="
   },
-  "org/eclipse/jetty#jetty-bom/9.4.54.v20240208": {
-   "pom": "sha256-00QQSm7mGdplmEA8JdA6qqrw9U6WRv01EkWN9Xyarrg="
-  },
-  "org/eclipse/jetty#jetty-parent/21": {
-   "pom": "sha256-eXLp7G84UqjuHuXU0Q3Mnc1gd7El+TWqlrNnpsgjN/U="
-  },
-  "org/eclipse/jetty/alpn#alpn-api/1.1.3.v20160715": {
-   "jar": "sha256-B76ZdYtpnhlPcPuXhNlCAtxsmCEod4KePXKwIPJmBXY=",
-   "pom": "sha256-FrRveqUg7VDUR4oM9ndjje3AFDtCNMJ48WDLS9JUgq8="
-  },
   "org/freemarker#freemarker/2.3.32": {
    "jar": "sha256-BNZewb3mzqIONJXV5475ard02ZNkNIYdMlS9iOfpT5I=",
    "pom": "sha256-B6B+Lq8JdgIrVAVnx99iJxK5oDk6bF9tIOb/FXkiKgE="
@@ -828,432 +876,434 @@
    "jar": "sha256-ew8ZckCCy/y8ZuWr6iubySzwih6hHhkZM+1DgB6zzQU=",
    "pom": "sha256-yUkPZVEyMo3yz7z990P1P8ORbWwdEENxdabKbjpndxw="
   },
-  "org/jetbrains#markdown-jvm/0.5.2": {
-   "jar": "sha256-cmSER3JgpVLcfBmwnUZWxIrjsQ2yclAA4YLWFZUptG4=",
-   "module": "sha256-fzA2ZgQteNJMVVEgyIJHjDCaIo7pK1G9ca2/+knDO1A=",
-   "pom": "sha256-D58z0tjpkbt1C7VZ2q1YtsVH5raHQAA4Jne3XFtYpG0="
+  "org/jetbrains#markdown-jvm/0.7.3": {
+   "jar": "sha256-iTq7MfFbYhb3TccEwMa/HlZ9zytizKKc9C5PUxU2N6w=",
+   "module": "sha256-cCm2PHSWTltDNDCO5ynpW1ONpe1qwSsuR31HhXLQIlI=",
+   "pom": "sha256-rLnRV//Hpk7mK+jt2WANJrXbAycKdOi+U815/gsm880="
   },
-  "org/jetbrains#markdown-jvm/0.7.0": {
-   "jar": "sha256-yLRL4zhZiRLou4pJmLAX333RmBUszv/vAc8SipkAE54=",
-   "module": "sha256-PL1M+XdGeY3ODzCIf/TgGig9DvoO5m3en/CvARrLdAU=",
-   "pom": "sha256-0VsK0umlc/l87P+p7UDP5TTV/HazLigPhd0C/lVIn84="
+  "org/jetbrains#markdown/0.7.3": {
+   "module": "sha256-2/rnqoU+teoe66MYllOKhANkb1XFmpkZHWh/wDe9rDk=",
+   "pom": "sha256-EeUuCmQOVKSzsjDRSFyVukuneyx7H8KENzkPngEicUc="
   },
-  "org/jetbrains#markdown/0.5.2": {
-   "module": "sha256-bpFAGmpLbnc1auIzdjDoovLcQawmG3BbOpZv/GI/I+Q=",
-   "pom": "sha256-mH5hITw/ERPsyi/8I6b0hpvuig+zCR8n3xvfq1KMhSg="
+  "org/jetbrains/dokka#all-modules-page-plugin/2.0.0": {
+   "jar": "sha256-01ibU23XRoB5BnKVgZyihXNjEnXMGOzOLy7/DgFtMnI=",
+   "module": "sha256-H2omPRdAFRJHcCQJoQGyGyBEsv5oHtlfPwDIPKL49/w=",
+   "pom": "sha256-k1+S+aXwCPT8akdE00bUIWf6TXQdCYDLh7m3iQTg+pw="
   },
-  "org/jetbrains#markdown/0.7.0": {
-   "jar": "sha256-CyFbRlFaxzcfaK2efq6i+Pkr6R83v70DsAjLVvFnUCE=",
-   "module": "sha256-fRDYKtUAs+iccbTS3Byl1L3Xq/BIcostrtWzsPuVxzs=",
-   "pom": "sha256-AplTmbCmzpt9dfH4f1yR1QwUg+m0oSH2a0ZAcsVIVVU="
+  "org/jetbrains/dokka#analysis-kotlin-descriptors/2.0.0": {
+   "jar": "sha256-gpeIxAiRoqPEuUNcueyA1kVWDZJun7vQjMwp6OTx63w=",
+   "pom": "sha256-EkmpCHEX6hwM/7XNoM+hFJBS+Q13v34Ob9mzoYNdB18="
   },
-  "org/jetbrains/dokka#all-modules-page-plugin/1.9.20": {
-   "jar": "sha256-l6FkXFrUKNN72nqMy/8xHyfAEdAUincdchFnj5qmVsU=",
-   "module": "sha256-5ppgwoB44BoaFSdIs3M32r2RhmB0bS7rv3HexQYDjRs=",
-   "pom": "sha256-t6gKNfwDIkaUQN+1eMvKPG8U727NVX+nxkKkhSj776Y="
+  "org/jetbrains/dokka#analysis-markdown/2.0.0": {
+   "jar": "sha256-2juwVNWQyNO3ms62FTrN5PKKcsWPbvtvopFtqGi5+DQ=",
+   "module": "sha256-Y9Svlf2/ITUM/nfCm44n7fxphC1GIPA3sooAivE2LBc=",
+   "pom": "sha256-hNqWan785ktm0YjoyRsgv+NBf6cstEEeD46dxgdkoXg="
   },
-  "org/jetbrains/dokka#analysis-kotlin-descriptors/1.9.20": {
-   "jar": "sha256-Nq+ECbvk2mov81ZFwntqdoeIQEQ4mLVgWh2avXVclow=",
-   "pom": "sha256-WO9jQY0yViRqjpkfKV8q/N7WefqS/LgpdOJt7Vy2Vkc="
+  "org/jetbrains/dokka#dokka-base/2.0.0": {
+   "jar": "sha256-BBHRw4odEAy9NGxjQMPEtfFUpIqcEZ7RGJPW+ulMkao=",
+   "module": "sha256-JTBdz25Cw739iyyqX74qjc6i6Vw1kALZaB9FCd5XSak=",
+   "pom": "sha256-HG+nzVExr6XbUft5BGqF5GaGaOm2h2t/kJC9D0PW5Dg="
   },
-  "org/jetbrains/dokka#analysis-markdown/1.9.20": {
-   "jar": "sha256-uiEg/wNxXhsmXRgLXVT4j+itp1jXljlQXPoCNfc1wQk=",
-   "module": "sha256-/qwu1TYem5odag9q1jAZrxMIZXlABtWoRSiYw2rAF2A=",
-   "pom": "sha256-kpPTl50NqDO40F+/cuEZnF2VuWMexl/ut1y7uPhBtyg="
+  "org/jetbrains/dokka#dokka-core/2.0.0": {
+   "jar": "sha256-OwIhZrfP49201Tjnb5e8jEE0Z379ZjEDTmP9ci4SU+4=",
+   "module": "sha256-iA7+arXz1MMGrsNVkBQ+5Bhujyuzw6yVKaxTZAVmetY=",
+   "pom": "sha256-SWN/vvKBVW4wjx0Gz8EV00p2q5OvfpXkiSYnNHwov5E="
   },
-  "org/jetbrains/dokka#dokka-base/1.9.20": {
-   "jar": "sha256-xr/alBtH0NpGuAQtweOvYs3G9Kdrv9kJQ9p8max0d4M=",
-   "module": "sha256-IDrGkj+sD1j2YisCrXGeIuBOr4m7sZ2opyDdVP7m8Ik=",
-   "pom": "sha256-hkh3sGo3jO4h4u+aDclp6pCjK/KYviAnS5LM9q/fKow="
+  "org/jetbrains/dokka#dokka-gradle-plugin/2.0.0": {
+   "jar": "sha256-9pSXM7wDyGFfTd0QpTddHaq3b/4gCziRrrVSqw5ueOQ=",
+   "module": "sha256-AukU6HnChqCQGPsrif7JV0M3zDOTbk5lZQLxcao/2/k=",
+   "pom": "sha256-h963mcSbDJo92nmwCLjyM56iBKWbaY4dsCFhboxAqlQ="
   },
-  "org/jetbrains/dokka#dokka-core/1.9.20": {
-   "jar": "sha256-EhizoInIX41byc7lNGp4f2QUPW/HtPBLBRtqW3Sv3IY=",
-   "module": "sha256-w+z7y6JqmLbouDusckOZKz6d/jilB9d6UnvL5E75ua0=",
-   "pom": "sha256-N9LsB2+hsvlR92bUjxHVHXOrjlNwkGy/XXnMPkbRjxI="
+  "org/jetbrains/dokka#gfm-plugin/2.0.0": {
+   "jar": "sha256-hxTAhA5WUog28yrrSwQVnwbwusy9IZdmgQlz22z1528=",
+   "module": "sha256-b7RU/rlsO7nK6tj3YG5mTKZbAUQBJkon0l1zE6AClJQ=",
+   "pom": "sha256-UNSVocw91I8Z0Zw6bBpbNvXHKNAtHcntzvyV4egFuPc="
   },
-  "org/jetbrains/dokka#dokka-gradle-plugin/1.9.20": {
-   "jar": "sha256-7dbOLDEoeI2k6lPe3sB/8LhI6p+mg8Ywv3k1Vw+7QhA=",
-   "module": "sha256-RMEY9JsqY95tLAdVYixHNKhVGviWx9ZAuEDSGL4M2CA=",
-   "pom": "sha256-cmyCm7TGy1h9pYYJVLLxJN8NQ9W/LxaQ7Rk9r2JSGGI="
+  "org/jetbrains/dokka#gfm-template-processing-plugin/2.0.0": {
+   "jar": "sha256-gT8k5SHnIPZNkZy/iURLT4jgcpXiCczh7VMgDqYo0Kg=",
+   "module": "sha256-gyXcecQGFajlN8LXiVPnym1F/e/coMrCHZFSsuXFX+Q=",
+   "pom": "sha256-4BMmXKjl/J9rKued/DJxxQfr1WwQnZPRQsl8zxWvZOo="
   },
-  "org/jetbrains/dokka#gfm-plugin/1.9.20": {
-   "jar": "sha256-f5qvOPhLGwZGeCfnNvOkmeMefUg8unKHy77MU9WE8y8=",
-   "module": "sha256-0cPvGZtJZTQ/TdEpr+tujKF+iAoQ0jPd6dyN+hOGvxs=",
-   "pom": "sha256-JGElNBZW5N+87fgk3sSbT9KDzgn8iRr+RbarIoz2Ntc="
+  "org/jetbrains/dokka#jekyll-plugin/2.0.0": {
+   "jar": "sha256-mXX12/1XgWWQquhV4VXb7EYffDwYzMcZJaUFKwyG2/M=",
+   "module": "sha256-73ceMvAQZCkSDGxUI4G8OEcJS3Tm/w2LZ6kSoFD5uow=",
+   "pom": "sha256-pFiMSooMuHuNE/ASaJN8TXHigvgNzDyKrjVCMsHxxYQ="
   },
-  "org/jetbrains/dokka#gfm-template-processing-plugin/1.9.20": {
-   "jar": "sha256-04wGZ1R7bI7K/AUNH967Cq5nnatHxb3Xs938btQXHKg=",
-   "module": "sha256-mjhaQy+qWiK2SAewLkK2RBJMBRiX5DX7Hh8GR3Jh+jQ=",
-   "pom": "sha256-1ND/ZwqyZ3P8/KQXd9b87ZlZLw00I2EvbJGcb1+dZu4="
+  "org/jetbrains/dokka#jekyll-template-processing-plugin/2.0.0": {
+   "jar": "sha256-9fKVXJeP9R86N4tlWbCS2DrV6MRGQIJbMSlbRndOFKk=",
+   "module": "sha256-LPL9uY4DSHo5DF8sUtw8iXOejxuMnvgvDanWoqInoOs=",
+   "pom": "sha256-njK1/mOrlDIJrD6wyjZzLEV1cA4Z60WGTUwd08N1m3I="
   },
-  "org/jetbrains/dokka#jekyll-plugin/1.9.20": {
-   "jar": "sha256-iduNwnd+N1HeLw0FNxZbRmxUThnD9BBClRc3E23bGu4=",
-   "module": "sha256-kojGi60yAH7eXDkmvkhAeu46mW/xtNTg2Pl0sancfXM=",
-   "pom": "sha256-9IWudDvcJYU0o5Cl28iwanJiTZtJdVA6JZHE4eA6f5o="
+  "org/jetbrains/dokka#org.jetbrains.dokka.gradle.plugin/2.0.0": {
+   "pom": "sha256-4fxoagGDfn6GKRGFkBUH/+r3lLip7JR7XQQ2j6cOAMo="
   },
-  "org/jetbrains/dokka#jekyll-template-processing-plugin/1.9.20": {
-   "jar": "sha256-cmnUZPPlAuFUBosmvtYS5fkQn3j+JHn5F0xtC8Qq6CY=",
-   "module": "sha256-P83z3bPpEvoFBXD0rL10ASc1vZqQ1HEE3WRnxfPcf1M=",
-   "pom": "sha256-UnZTelL3jYHat+c2hCikLqqYemAPNzmyUeJsCEOm3QY="
-  },
-  "org/jetbrains/dokka#org.jetbrains.dokka.gradle.plugin/1.9.20": {
-   "pom": "sha256-J7WLy2erfv8EO20nz2Oo9C18bx3AlzoQ53gDTXIrDpw="
-  },
-  "org/jetbrains/dokka#templating-plugin/1.9.20": {
-   "jar": "sha256-5dJx2ACr4mtAzTJrsbgz+agl4jcYuDDhTTnpFy9Fv4I=",
-   "module": "sha256-+THUhm1wio69b+1YRA8qLI2tN1oxRUc3v+ezMlIWijw=",
-   "pom": "sha256-87lBCuL3huImPl4+/JXTn0ZckTdc2GxKEE9h9rE4m4I="
+  "org/jetbrains/dokka#templating-plugin/2.0.0": {
+   "jar": "sha256-gmXG5qAozQ45wRaMG3bw/wY5ngvmi57/Snj8LdSugYM=",
+   "module": "sha256-YIna696ws1DZHuCxqxarB5j63II7Eo3UNDmWOxdkmsQ=",
+   "pom": "sha256-rqDS7WCgzoRhO3nxh8It7eTbBPIfV/mRPhapC/0ONdk="
   },
   "org/jetbrains/intellij/deps#trove4j/1.0.20200330": {
    "jar": "sha256-xf1yW/+rUYRr88d9sTg8YKquv+G3/i8A0j/ht98KQ50=",
    "pom": "sha256-h3IcuqZaPJfYsbqdIHhA8WTJ/jh1n8nqEP/iZWX40+k="
   },
-  "org/jetbrains/kotlin#kotlin-build-common/2.0.20": {
-   "jar": "sha256-NvDXXOmviQZNnbT9IeIsVQdyAP5OOufZnjREmCZ6oNs=",
-   "pom": "sha256-EOhYxaCAxN21Wx0GvujV6Ea4YQX1aw5A8ojj+mGWEXI="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.1.20": {
+   "module": "sha256-6NVkojvCA3s++xxbAP+3SuRPmXJFd+L8jYf/u8nLn7U=",
+   "pom": "sha256-oRA6cKb4/8EITdwIGyS6smpWRJcvnM0UG4mU2fUFRHg="
   },
-  "org/jetbrains/kotlin#kotlin-build-statistics/2.0.20": {
-   "jar": "sha256-c6fXFRN1WzF9Kxttp2bW5reiXcmdzv5DEzJTNkIuzhE=",
-   "pom": "sha256-10GK0lyAbeg2FQvdNQsAvmwtJQmeXXQd3+PzgcUurY0="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.1.20/gradle85": {
+   "jar": "sha256-ZnTyl1XTJq3cdWov3Kvyu2AvAABKDtLbZp2j306EgAY="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.0.20": {
-   "jar": "sha256-V+1QIg547DnoqAAUMw8pXlSFtWOMESmvntfVPXhYxcI=",
-   "pom": "sha256-nHrVho+yGJsb9NbCL2yUmDs6jhopTpWlQSy4Lg9C3bI="
+  "org/jetbrains/kotlin#kotlin-build-statistics/2.1.20": {
+   "jar": "sha256-TSjxg6dsMKjKwg56P6hwVMLdHbiGSzyc04nhjdmX0x4=",
+   "pom": "sha256-OR9tc0uDTJG3qAHiI638c2tYDb3ODxOafkvUdknATKM="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.0.20": {
-   "jar": "sha256-nOb4Gmmcw32zY6KDcVC8YqJJA9r2EhA00Sl5qpUBRGs=",
-   "pom": "sha256-DyiqOx3o2AWm+HlX08PWbDOeDEMmaZlc9Zf58r6J4II="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.1.20": {
+   "jar": "sha256-Uzw2yzYubtLRX1hzLn9MbSvtXJ1RebiXvEsJ0W1gU3c=",
+   "pom": "sha256-kn9h95cmHFnktTEDFNaf1KOrjvT3A596UyYHXEKkFzo="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.0.20": {
-   "jar": "sha256-o2BL81DIvM4nECFYu7OD+k0YFLxIaq7VnyeOraUf9q0=",
-   "pom": "sha256-WXBD+4xlJ/QpmcoE7TUpY5Is0W5piKqlLT2zLaHbhZ0="
+  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.1.20": {
+   "jar": "sha256-bpSJbjIWA+O/6J/vAkeORNHWSj0l1J0GlIkv/AHGCs8=",
+   "pom": "sha256-EPseNeDocGdH6Og+ro+LQ0BrpmTkIB7J38ua99prQro="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.0.20": {
-   "jar": "sha256-4DzwSwNA8a4VEhBjC10pFcKXmIxuIuTe206nz7dKz2c=",
-   "pom": "sha256-3M3xugxPzYvUIwNFroP6fb6SglY9ilP9XmHFM1tbcYA="
+  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.1.20": {
+   "jar": "sha256-xUoAcYyMDj7oWL9Cdxx/QBxePBc4hh4Y6VNjcQQvobM=",
+   "pom": "sha256-InQE6sbYCbwNlN74kzbf332afVOHkqI01Svbr8Kuha8="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.0.20": {
-   "jar": "sha256-cxUswf2CHQcTlHOry/jH0B0A5oaEuWHhkurogNycfaQ=",
-   "pom": "sha256-qUcReIj0z/tjk9QurqYRtj31ib8pYXgmzLclNxK/OsM="
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.1.20": {
+   "jar": "sha256-3jtUI9j7+G6ivRM01AG8SqhOKOxIlFlS0RwAsQsUArY=",
+   "pom": "sha256-xgNdI3KARTSALDfOVU6MjLqq6EUUp7rWzAlkJNjySUU="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.0.20": {
-   "jar": "sha256-W9URO4WrhSjhkuK7P8GX9bw0SLzb0Fh5Czf9N/TuV68=",
-   "pom": "sha256-IZgoJm6keO7rQuT1L5bQuQfYykhHz4aq45FprYsupKU="
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.1.20": {
+   "jar": "sha256-NjCjAYLGNXDrUZrmWqqUGSF9utCBT+3kLI3ecERlpMY=",
+   "pom": "sha256-+qpgvkJw6RSbWUOSZjlhkr60f/XjpAmF3u3FTlkXItI="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.0.20": {
-   "jar": "sha256-i2O0/7e6aOKHIFaa1HqWzAZclFZO0WHuoVrIZIh7pN4=",
-   "pom": "sha256-D8eaPIg8fbbsD6lU1cimiugRBlIm+4WRbhy/9pnlwUc="
+  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.1.20": {
+   "jar": "sha256-2eg98dhHogG6PAFqeGztCRvpUDmX0J9qnPF5buSJ83Q=",
+   "pom": "sha256-sdOMCv1uHRXEjBxdFWzmBXj0MxNr7FI/TrGZ968/gik="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.0.20": {
-   "jar": "sha256-D3NXvFzMjjaB7DtGQ8cMrSiDskbIt699bZccQeOTTy0=",
-   "module": "sha256-CJ8SCJE61calM09nu8pI/HsK+hCv0L2lFT+8tSzCqWw=",
-   "pom": "sha256-IQOK734wtxG0qE3grS1TO9MgXhOKrWfP1YnXl+/afII="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.1.20": {
+   "jar": "sha256-sk9SbQ3++wKWrg9Ks2L51soCV3JcwnMIOprjN+ooJn0=",
+   "pom": "sha256-wKs06ffQCv3LIv0D5S6PhZpGR9lY4Lh7fQzSY0QWOlo="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.0.20/gradle85": {
-   "jar": "sha256-D3NXvFzMjjaB7DtGQ8cMrSiDskbIt699bZccQeOTTy0="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.1.20": {
+   "jar": "sha256-fjYZlm/jid9IV59DsY8sCwc2llWZFTd8lELrqM+7+/Y=",
+   "module": "sha256-AsJsJlASRw1yrc3buCTSOOayieEAzUu/moJ1Cj1Jv8A=",
+   "pom": "sha256-t02/6klcg6xWRwS6qDmk56W3kRiMj3llbJwZ3XfeLxg="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.0.20": {
-   "jar": "sha256-Ce2wJ7mh899xYnGuyte7QaHdvC+cETFyl5ANTyvc6Iw=",
-   "pom": "sha256-wZireMJmzzvnodJHBeW7GIbUlF/cpPcX9U77hv9M10o="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.1.20/gradle85": {
+   "jar": "sha256-fjYZlm/jid9IV59DsY8sCwc2llWZFTd8lELrqM+7+/Y="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.0.20": {
-   "jar": "sha256-wfTqDBkmfx7tR0tUGwdxXEkWes+/AnqKL9B8u8gbjnI=",
-   "module": "sha256-wy8Uw0SXgCqOjXk7K11nkj4gIlOUePNm4Yp+9kFOut4=",
-   "pom": "sha256-Vn7N8kaceWkMLgmdz6r8PhF67GTe3BejtJ/Uo/ptDgg="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.1.20": {
+   "jar": "sha256-6vELILujkjoH+PsYL7jNVlaZ4Vfuc9Elma8fXKuiUEA=",
+   "pom": "sha256-PdYeaTbcUQBs5MN+/+Q+/hQAuEHgnsSx7kqU9rkZOCo="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-model/2.0.20": {
-   "jar": "sha256-UUx/F9xeVO5dFqdhs2S500OVa8rUnf0I4IWWIldzfhk=",
-   "module": "sha256-HPn20+xtMFqgiQMqyJL/rogcwQUAP0VvLBX9PDAyCm4=",
-   "pom": "sha256-SEIbKUnHKiDU4OPybYcYxruScIbHbF/AlSCg1jbPumc="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.1.20": {
+   "jar": "sha256-APb4Q6vJMNDGGrtOPjAsjRd2EpH5srwlhv4SsMuXXq0=",
+   "module": "sha256-td7wBfIpohsq1pJt9wjPhLqe+8TsGcY16/5baTcx2wg=",
+   "pom": "sha256-CjCxRdSY1H2yVdDUzWp3hMXx+QyL+YgsupWCKjvzMHA="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.0.20": {
-   "module": "sha256-aBPMpB7w+/FciL7MQB44cGuWlEwhtr7HPdiM+QoPIB4=",
-   "pom": "sha256-eEmYfUbGj7neKvOwReEq1nPm1mOvbqpf2MYRlCt3LF0="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-model/2.1.20": {
+   "jar": "sha256-1jf7pHCzv3E7CmXmcXrV3QOocl/MlFMCiUc6smtC6Cs=",
+   "module": "sha256-WJm5fnqbFx5sBeVJziqbo8ddJZMVnUsrAVZkFLVoUWo=",
+   "pom": "sha256-18CRV8ehutuNrk6Jv54N9FRbBM0DqqQJZqJm87hG0sM="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.0.20/gradle85": {
-   "jar": "sha256-gSn2LLfGJ7XOghh+QqbYfEKVK8e6ZLgFo1R/aFIxlmI="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.1.20": {
+   "module": "sha256-6Ue1RPTNCcFQr9h5G70yoxN92uMEWn1TlL6lCaq5bFc=",
+   "pom": "sha256-H2OowlwTZmlled2VLz639CoKSns/avaRpIIjEwb82sk="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.0.20": {
-   "module": "sha256-GwMjHvp7O20xsJNocpQfh+J6gZwANxiz0JiAt25j180=",
-   "pom": "sha256-TDLrNQlMFjWd943q7BHOUjvjYEB0FPoK7Miu/GftSkM="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.1.20/gradle85": {
+   "jar": "sha256-+wFuZDtY4Koq7IkRDq8U54s3aMFX8lQ0V5X9aqEEk+s="
   },
-  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.0.20": {
-   "jar": "sha256-QsQvvic/oDBOThf3OSxms56R+Z01+FwGixG91Wuemdw=",
-   "pom": "sha256-5f4GjE69XIhYw1w56GI6vrnIb4oXJUdC5/VZjkP62jw="
+  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.1.20": {
+   "module": "sha256-IF4RacYovsBfHVnkTTIJFSiun9U6fjPsVDvO/bEojeY=",
+   "pom": "sha256-Y5ymx2U+Gp2pXfKjuuJsy3AcA6/VjHl6tr9vJV9kwwE="
   },
-  "org/jetbrains/kotlin#kotlin-klib-commonizer-embeddable/2.0.20": {
-   "jar": "sha256-ZzHCVkuXOXGDWCVJAUC3rZ63Jtk4/gzvTr7y7Fkt6wM=",
-   "pom": "sha256-rVSg2nLxASl08e7sdp2EopMnzzfMrVUxt4cT/GD0tnY="
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.1.20": {
+   "jar": "sha256-EyGYEVmGCVkEsMsB76rh2BJJZB75FJ4Fs0T4ZKrpdfQ=",
+   "pom": "sha256-LZayVvD8kesSvOtuR2HhPXAf8TU/BZL8VymI2uai0Zs="
   },
-  "org/jetbrains/kotlin#kotlin-native-prebuilt/2.0.20": {
-   "pom": "sha256-xYoRfPul4AVC+QrYLytqsh4Z46Ifzvy0mLq5k69FDwY="
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-embeddable/2.1.20": {
+   "jar": "sha256-TRP+4Fu7RxlCw7Xt4PKKui4BGWDmQSZ0uCh7rYZuLfo=",
+   "pom": "sha256-xAVqvU8vDg7JUBdZ2H1aRLlQ5/IquAc+dG7OPrc2HII="
   },
-  "org/jetbrains/kotlin#kotlin-native-utils/2.0.20": {
-   "jar": "sha256-wWbyBR6R0ZnpYP/HsnZEhcFRDNF2dN17jOPC/NBqhys=",
-   "pom": "sha256-mISZMftwkWhS6qfCDm2Pr1IsUNd627r9k2T1JrfN7EI="
+  "org/jetbrains/kotlin#kotlin-native-utils/2.1.20": {
+   "jar": "sha256-pyVic6u53yI1kk2A/dNtZ4tFhGfDB2xmhRxCQ3vdPGY=",
+   "pom": "sha256-1Gec6AsERY5fzL1pteMUvxwMFnmH4EOVRv3+z7U+M0Y="
   },
   "org/jetbrains/kotlin#kotlin-reflect/1.6.10": {
    "jar": "sha256-MnesECrheq0QpVq+x1/1aWyNEJeQOWQ0tJbnUIeFQgM=",
    "pom": "sha256-V5BVJCdKAK4CiqzMJyg/a8WSWpNKBGwcxdBsjuTW1ak="
   },
-  "org/jetbrains/kotlin#kotlin-reflect/1.8.22": {
-   "jar": "sha256-ZVgl+mURIg/tDK5arU3+oqv5j9EPCud+uNr2q/zQ8Cc=",
-   "pom": "sha256-KeHqCKPTq0gtH9/UH76TRZEt9Gbbr6+0sS0YN8cr4yg="
+  "org/jetbrains/kotlin#kotlin-reflect/2.0.20": {
+   "jar": "sha256-GPRR5rS3vR0fnWCEnDy/Fg4RUwL5eiAIwZDVBcQ5xnA=",
+   "pom": "sha256-Y+Y4sFbdRJ5vUtcenCxdxdsNFkRDI5cOFtf8DWWDk9s="
   },
-  "org/jetbrains/kotlin#kotlin-reflect/1.9.22": {
-   "jar": "sha256-d/MRyhOEgR1Rn9o4n8sSaL2qBY1gUEbg7edsA7DfPpc=",
-   "pom": "sha256-xxLjWN97kxi2j1RjlxsIhnODf8DKQoXRw4LIEC7da18="
+  "org/jetbrains/kotlin#kotlin-reflect/2.1.20": {
+   "jar": "sha256-QZd48reoJrrW7iyh5L3r5jmrMG0pBPo+8qMI7PqrOBE=",
+   "pom": "sha256-XgIIh67A2JqcFo79ka7WKGVVOHf5MD8UXby50jumDcc="
   },
-  "org/jetbrains/kotlin#kotlin-script-runtime/2.0.20": {
-   "jar": "sha256-/pcAKmeY9yB1ZGSJGdbuzPszi5XcBLSIhthWZVvGSk4=",
-   "pom": "sha256-o6N2KcmFzt17+d12rGdJaz+ApZIoVB6WiAKg7obEuRQ="
+  "org/jetbrains/kotlin#kotlin-script-runtime/2.1.20": {
+   "jar": "sha256-rkOX+7OqKhraCSkOdTu6maQRRUiXfDEVUmuZWPTLGgQ=",
+   "pom": "sha256-D4O1qQFWxhpv8QlVey2YjicQ7j++n0pCV6bqDYdIw9Y="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-common/2.0.20": {
-   "jar": "sha256-XTdTOT5/7PHSG67l2314gyZ4K9v4qOxqKyzM97Ve5sY=",
-   "pom": "sha256-BesUmiCZ8ILJf1xFQ1HQuMphLFUwo6wyHSyMB12wEVU="
+  "org/jetbrains/kotlin#kotlin-scripting-common/2.1.20": {
+   "jar": "sha256-X9v2rnIjfOM11gPrEsSbCbycGjPAwB8dYud/8zZjzvs=",
+   "pom": "sha256-H3dwkEXdkF63UFqUKA037HV/CHCc/p86dKunO7+Z95s="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.0.20": {
-   "jar": "sha256-Ie8wOrS54Pnzl8FIliU6rkkCV7+w3VAInBwcBPAYcXE=",
-   "pom": "sha256-zr8swRmuHPJqP2tECxidwrruhS0nASU06qNqrNue4VI="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.1.20": {
+   "jar": "sha256-PU93KyOEFGUAF+l0YiVrfE1e36EBPL9Ud1c+sawuKIQ=",
+   "pom": "sha256-D/9/8dO/qczj77tNs4mJwmilHrZ/ge/QMRuKZGGLhak="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.0.20": {
-   "jar": "sha256-WgaucwO1TL0XdYnWEFumv9WbGxgur7W2aHJf9ypf0y0=",
-   "pom": "sha256-z6al9YOJy3K0SRLTABoB9eqL+vx5mbr6BRGz7t/LYdI="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.1.20": {
+   "jar": "sha256-9mXXCxoIN/86Dve+xPxdn+1n6nXkaX3hWOtR8epQHD8=",
+   "pom": "sha256-tjmuINh6gV4wTd0goOTEk34Ttfx6Qme14VwOWQIphmU="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.0.20": {
-   "jar": "sha256-sLtQD2MztLFsjraeo5TvaE8zRT+NNDEDSokHqfGNtvE=",
-   "pom": "sha256-m8uNHCOvcm21KpNrpbkXeyRoKSBYxT8Ckd5MwNpOzh4="
+  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.1.20": {
+   "jar": "sha256-afRXrKuYNkwOtXjEl+DDypMLjPuCvndASdoEzeOAh/c=",
+   "pom": "sha256-PERTORE37EVcdL5Jb3HZpJhpbSVJvmT1mmBkfO7iVT0="
   },
-  "org/jetbrains/kotlin#kotlin-serialization-compiler-plugin-embeddable/2.0.20": {
-   "jar": "sha256-zI9QG2dslESLAWgNyvZ68cjFfOqEFQKnFuttEX+Xy4Y=",
-   "pom": "sha256-X74y6I+ly4WFjb1wpPZKWsJTSaTijzlQ3zJrMSRmUGY="
+  "org/jetbrains/kotlin#kotlin-serialization-compiler-plugin-embeddable/2.1.20": {
+   "jar": "sha256-5pZQZxDSxI0BfMiczB6kkQF5lXcJK3Ah/q2pX/Yv1X8=",
+   "pom": "sha256-Al1rBx59fPPsennw0/5He9Ydveir9ZbYn41DL3wBmCU="
   },
-  "org/jetbrains/kotlin#kotlin-serialization/2.0.20": {
-   "module": "sha256-rsyQ8DJ7IQJTYRNdyJQBDmHDVzVFBtLTP3pZeakRxGQ=",
-   "pom": "sha256-wYgmEN73pFKwREi8GVqr+D6CqMEcUSmFYUAbGyxfKCw="
+  "org/jetbrains/kotlin#kotlin-serialization/2.1.20": {
+   "module": "sha256-OMZPybedsk2Y415NutDvDjOxdsKXSTE8c7k6D5bCIgs=",
+   "pom": "sha256-Ffv0qiQBTCr6vmXjwzrY39LYocR8z5dsBbqKNqGou0I="
   },
-  "org/jetbrains/kotlin#kotlin-serialization/2.0.20/gradle85": {
-   "jar": "sha256-Jjd6xiKasd8/ojVJPYxWfkcLjYa2PolUSMwmbL/Ob1o="
+  "org/jetbrains/kotlin#kotlin-serialization/2.1.20/gradle85": {
+   "jar": "sha256-rNawwcN18ocop1LMbI0itREnbFT1DZcb7UM957K9qjI="
   },
   "org/jetbrains/kotlin#kotlin-stdlib-common/1.8.20": {
    "pom": "sha256-YFWRuJs3ISfmspxpMl+i9qjEb0aMRdCUEOeOtZ/IChc="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib-common/1.8.22": {
-   "pom": "sha256-pysR3wi1Mi16Xo5iB4nuPkz+846GxDDn0RO/qeVMWB4="
-  },
-  "org/jetbrains/kotlin#kotlin-stdlib-common/1.9.22": {
-   "module": "sha256-+Tyemr+NUtjo/Y6FGqgC7OxVEyFhxK7ufTzZJL95QkY=",
-   "pom": "sha256-10k21oh1ZK63EOhCmLVCB/U+m88jpSrSv6IsIIZ3V2c="
-  },
   "org/jetbrains/kotlin#kotlin-stdlib-common/2.0.20": {
    "module": "sha256-tZe3Be/U4tgnFCCQw2BUJlVI7VG09SN38r+JxFlNU28=",
    "pom": "sha256-o11/wINw+TE6S5U7zu7d2F4OHnLTEGLTe/jHeBs/b18="
   },
+  "org/jetbrains/kotlin#kotlin-stdlib-common/2.1.20": {
+   "module": "sha256-lNCtKyMZuFxANRz57nB32hLdOFA5LmzxCj/oFZ+8c/c=",
+   "pom": "sha256-1iLjAAVmBil0Qmj6iRKPt97U1C4XTOsIH2f3BWrJqLs="
+  },
   "org/jetbrains/kotlin#kotlin-stdlib-jdk7/1.8.20": {
    "jar": "sha256-rx7EDDuVGv3MDCoBc8e4F2PFKBwtW6+/CoVEokxdzAw=",
    "pom": "sha256-NiLRBleM3cwKnsIPjOgV9/Sf9UL2QCKNIUH8r4BhawY="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib-jdk7/1.8.22": {
-   "jar": "sha256-BV9cskKH+hBhAJlae0erkhJrgegy6HX1+izwvVVpPQs=",
-   "pom": "sha256-T5WKqZPVmE+PXr7UFGVipfOp9pW2BJyfKHOBN5ytqzM="
-  },
-  "org/jetbrains/kotlin#kotlin-stdlib-jdk7/1.9.0": {
-   "jar": "sha256-t5eaeqyUBV8Nnx/TtHzl/+HLYDKoQrqfvnGG8IUokXg=",
-   "pom": "sha256-wRB08MiYqYuGPGFEcdQ409+Soewzgqbjf5NdfXGVS1o="
-  },
   "org/jetbrains/kotlin#kotlin-stdlib-jdk8/1.8.20": {
    "jar": "sha256-45i2eXdiJxi/GP+ZtznH2doGDzP7RYouJSAyIcFq8BA=",
    "pom": "sha256-OkYiFKM26ZVod2lTGx43sMgdjhDJlJzV6nrh14A6AjI="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib-jdk8/1.8.22": {
-   "jar": "sha256-QZiw6vCQpPJbb35aWVgfQxS6jJ9s0dE+6dNI5l7Y9wc=",
-   "pom": "sha256-ko8hhyF0djE8uBbUgHC8dlSqO5pa6B0/xfjCecyPjZ4="
-  },
-  "org/jetbrains/kotlin#kotlin-stdlib-jdk8/1.9.0": {
-   "jar": "sha256-pZ+iT98f+1lLrs2/D9EAEPl3zqECNtSH/jRkl3pzd/o=",
-   "pom": "sha256-ZNWY3YjiUEZnMeIDBKtvBsu7urfuMitHA7a1n4gcT5I="
-  },
-  "org/jetbrains/kotlin#kotlin-stdlib/1.9.22": {
-   "jar": "sha256-ar4UbCeGQTi4dMzM/l9TTj65I8maG3tdRUlO5WlPPgo=",
-   "module": "sha256-9IIxS1B5wUVfb7DUJXp0XRAcYSTOlhUiuob53JCQHkc=",
-   "pom": "sha256-zOLxUoXsgHijd0a1cwigVAQt1cwlQgxD9zt4V8JGjwM="
-  },
   "org/jetbrains/kotlin#kotlin-stdlib/2.0.20": {
    "jar": "sha256-+xaVlmWaUYNXxLLBb0PcdascSYBWXtS0oxegUOXjkAY=",
    "module": "sha256-3AUdwExqGW8tBtDTya8zufErybT+E5rhKQFAUII2tns=",
    "pom": "sha256-Cu6WIJHn3QKIzDykz0qSjFYgcUYCEb+PQXkAkwbmGf4="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.0.20/all": {
-   "jar": "sha256-UP+t6yC00kVqUmWVpPep6FiJaCcVBz5s26Gx2A461Fg="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.1.20": {
+   "jar": "sha256-G8x06M6E4sJeqv3hDxJINJzOMGK242l4y+7GENsekwo=",
+   "module": "sha256-VdKW5FRF9siGmbCJZwbqlVCvh62Uhz3BO2W+u9VmCm8=",
+   "pom": "sha256-Z1DheZ7lAgd9rlw9WZeW9mdgb2DTXpXLeQRI3HkStAs="
   },
-  "org/jetbrains/kotlin#kotlin-test-junit/2.0.20": {
-   "jar": "sha256-ryZqI26bENE7D71MjJZizVs51mibQcnYLK2oaCLANcU=",
-   "module": "sha256-Q0jdPuxQxh/4DPBSBq0s8CErIjDySJ5QuOuf971YWQg=",
-   "pom": "sha256-0i0KJ5solDxw26YYkhvIc0QQqsTYl1q5xzfD+eG9qIk="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.1.20/all": {
+   "jar": "sha256-geB9406Esp4U8/3vkC9LxM8dXalZuGffaD++HMVM4eE="
   },
-  "org/jetbrains/kotlin#kotlin-test/2.0.20": {
-   "jar": "sha256-oVbXu3S7hHABkQ2s++5JyXF/jrZwxBQ3qSdoezN6Bf8=",
-   "module": "sha256-0wJTt8l9i4KWVQUITlTJ1qP2NWe4/G7H73kPR/gREcw=",
-   "pom": "sha256-yCDFnJRFdVYiqsuhkTg5lhSdfM3mBiMWLfHGnCxG+yE="
+  "org/jetbrains/kotlin#kotlin-test-junit/2.1.20": {
+   "jar": "sha256-/JyFRHUR3oPiEPfenSA67HLvRT9yXETXvP/H6Qed+tw=",
+   "module": "sha256-NnictkXfB/pR3tuXVy871W//MsXrk8oI1dgx1upBqBo=",
+   "pom": "sha256-WYfnDG7E65vAb8Ao8saDKTteNgH5YjtwfuX2YbqrsGw="
   },
-  "org/jetbrains/kotlin#kotlin-test/2.0.20/all": {
-   "jar": "sha256-2iho+pWj+4814rTjMcouKTIUhnAZZex2a66CD5jgJ3w="
+  "org/jetbrains/kotlin#kotlin-test/2.1.20": {
+   "jar": "sha256-ACi1x0GRGEUZ9g5yfFqk5dfjrAT8C+1Vn0nTcWXeyWE=",
+   "module": "sha256-3M5BCYnVErxDug/4sgYkU0DJ86An36Fl9y6BQy3ssVY=",
+   "pom": "sha256-2SCpd6AcRqNwv3Npji1BcJE8afDeRoXURWTtUW9BtMo="
   },
-  "org/jetbrains/kotlin#kotlin-tooling-core/2.0.20": {
-   "jar": "sha256-W28UhUj+ngdN9R9CJTREM78DdaxbOf/NPXvX1/YC1ik=",
-   "pom": "sha256-XhIxEeAQewRmSIOgpAjB/zvbXQR+SQH4L0xC8QV4Bi0="
+  "org/jetbrains/kotlin#kotlin-test/2.1.20/all": {
+   "jar": "sha256-07fPliK3To6kwNNvS9X/nR0xsy/jUORuCCBHxb48alc="
   },
-  "org/jetbrains/kotlin#kotlin-util-io/2.0.20": {
-   "jar": "sha256-ZGTbjUFywhoXp5C20XiQIu1nrbN8UL5ri59YK1UrhSI=",
-   "pom": "sha256-LrBxVfqEF46ZVjnOe3aRcofK5UKjXSm1a7CZEB0oajw="
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.1.20": {
+   "jar": "sha256-tPu1I+hmLUqEUbmjap5/1D9jfLDNapueNoFxlmXavY0=",
+   "pom": "sha256-PO8cS3yC7KjMAcMMrt0VSQWeZfL51BYsjJ13+6JBMXY="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib/2.0.20": {
-   "jar": "sha256-h92Djcd3gsuVZ/GnYUmbPkpQ9SjABbJjii4+V0EKljs=",
-   "pom": "sha256-fbTRw72mdZvifuk35gfoscRpWNwIR3Ey/a7t4BbnOP8="
+  "org/jetbrains/kotlin#kotlin-util-io/2.1.20": {
+   "jar": "sha256-gqOymmEdR85jSuLmxQnN4qhvlLI7hr4whk6z1Lj+jn4=",
+   "pom": "sha256-eSQnftICC4UQ1F8N0QgREmVoEDAH2D+ZcfwYRmC9hKM="
   },
-  "org/jetbrains/kotlin/jvm#org.jetbrains.kotlin.jvm.gradle.plugin/2.0.20": {
-   "pom": "sha256-JyOoqUP6SkTTcD8VTEW31UcMcZ1OYKvz4ixzt3s4i5M="
+  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.1.20": {
+   "jar": "sha256-8tXmhHFbkgtghJaObDPIuwWwtrl5GYAOLyIdlBgkDH0=",
+   "pom": "sha256-hCdVuVwx20vbks9tQshUGhcB+ivc8lIahwa8sDKgoZc="
   },
-  "org/jetbrains/kotlin/kotlin-native-prebuilt/2.0.20/kotlin-native-prebuilt-2.0.20-linux-x86_64": {
-   "tar.gz": "sha256-soKRi19RWLL41bU94ICTpyIG/CO5E4Lh3dJjDHIChCc="
+  "org/jetbrains/kotlin#kotlin-util-klib/2.1.20": {
+   "jar": "sha256-/3nFsObkLZIOuxx2uhDMLdvyJOgFZFqO6sreSRbiqs4=",
+   "pom": "sha256-ps3TjXdd/QfQe9FZ00LPegqWg4qH50guIgxjrtluEoA="
   },
-  "org/jetbrains/kotlin/plugin/serialization#org.jetbrains.kotlin.plugin.serialization.gradle.plugin/2.0.20": {
-   "pom": "sha256-0s2V9THwNRgW+fg0bsbWB2xxyt9jLz6PZX3dft+RukE="
+  "org/jetbrains/kotlin/jvm#org.jetbrains.kotlin.jvm.gradle.plugin/2.1.20": {
+   "pom": "sha256-q8TDh14/l1U6F2qQ9ReI7A9ero4dJkI+qOvb+KpqF4Y="
   },
-  "org/jetbrains/kotlinx#atomicfu/0.19.0": {
-   "module": "sha256-lDjpxD+24dVMUZvO8MaTmJTn9hrzIAXXu0Krp28tpX8=",
-   "pom": "sha256-FXTQlXamSA++51jvCiRwcRV3UUdcVmh60eHSwO6YQ6E="
-  },
-  "org/jetbrains/kotlinx#atomicfu/0.20.2": {
-   "module": "sha256-LJleDoPFg+ElcG+6P+hRcAINF6iPidYpSlPNi9fEw4Q=",
-   "pom": "sha256-fZSYii/6cay7jKEEhQ/sG+Je8YCeOlEPAOvUo8C1vPc="
-  },
-  "org/jetbrains/kotlinx#atomicfu/0.20.2/all": {
-   "jar": "sha256-KpHxC4JtP+vEfCtmTiaGFXV8MREUI5eH9dw3SB/exEE="
+  "org/jetbrains/kotlin/plugin/serialization#org.jetbrains.kotlin.plugin.serialization.gradle.plugin/2.1.20": {
+   "pom": "sha256-YjXePQABYjdcj3IvCO2hU/CQ4RoDW0qbi+fqxO8UX+Y="
   },
   "org/jetbrains/kotlinx#atomicfu/0.23.1": {
    "jar": "sha256-fbhmDr5LkbtHjts2FsTjpQulnAfcpRfR4ShMA/6GrFc=",
    "module": "sha256-Pokf5ja1UQgZIQD884saObzRwlM+I8Ri/AdkTur8sg8=",
    "pom": "sha256-aIt5ABn0F87APmldZWexc7o7skGJVBZi8U/2ZEG1Pas="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.6.4": {
-   "pom": "sha256-qyYUhV+6ZqqKQlFNvj1aiEMV/+HtY/WTLnEKgAYkXOE="
-  },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.7.1": {
-   "pom": "sha256-uSWqmIxApceqDHeyE3P+sYw5QUkmvVHHbvRENPW66cI="
+  "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.10.2": {
+   "pom": "sha256-+vDGU45T3cBJmmNmTY52PCFlgLLhjnIsy98bQxpq/iY="
   },
   "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.7.3": {
    "pom": "sha256-Tl0ZAOY3nvP1lw0EqPMFKa3IL4WejMEHwhzoFJ72ZsQ="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.8.1": {
-   "pom": "sha256-Vj5Kop+o/gmm4XRtCltRMI98fe3EaNxaDKgQpIWHcDA="
+  "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.8.0": {
+   "pom": "sha256-Ejnp2+E5fNWXE0KVayURvDrOe2QYQuQ3KgiNz6i5rVU="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-core-jvm/1.6.4": {
-   "jar": "sha256-wkyLsnuzIMSpOHFQGn5eDGFgdjiQexl672dVE9TIIL4=",
-   "module": "sha256-DZTIpBSD58Jwfr1pPhsTV6hBUpmM6FVQ67xUykMho6c=",
-   "pom": "sha256-Cdlg+FkikDwuUuEmsX6fpQILQlxGnsYZRLPAGDVUciQ="
-  },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-core-jvm/1.7.1": {
-   "jar": "sha256-dJbP/dPrEBCazdocMhL2rHgVeJ4JOA3J4szexJbbo/w=",
-   "module": "sha256-2x/gEQ+oK1ZdMy050/PmLB3H62I4Mz47FeQ3f6VuOcs=",
-   "pom": "sha256-hcGdsQ28RIoEZjzftHgkPtoKjWsSfxCPGZVbFtSJs10="
+  "org/jetbrains/kotlinx#kotlinx-coroutines-core-jvm/1.10.2": {
+   "jar": "sha256-XKF1s43zMf1kFVs1zYyuElH6nuNpcJs21C4KKIzM4/0=",
+   "module": "sha256-6eSnS02/4PXr7tiNSfNUbD7DCJQZsg5SUEAxNcLGTFM=",
+   "pom": "sha256-ZY9Xa5bIMuc4JAatsZfWTY4ul94Q6W36NwDez6KmDe8="
   },
   "org/jetbrains/kotlinx#kotlinx-coroutines-core-jvm/1.7.3": {
    "jar": "sha256-GrOsw48+c1XE+dHsYhB6RvpzyJnzBw0FXl1Dc9/mfhI=",
    "module": "sha256-NNbumbdqwGK1FVW0pwvhg0n+VWbaeaGQYU8XHIC2U44=",
    "pom": "sha256-dThYdT3su7I5c0PiuHHwYvaXgS6UIuQcnuRqZrk+7jA="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-core-jvm/1.8.1": {
-   "jar": "sha256-89T13hw5G7zCDzs0Ncy6wBNSHna2kC19WWNewVwfeX4=",
-   "module": "sha256-CbgcnRHC3uvxM62HtweSfB8ECZy2Ee8AjHcls+swgyk=",
-   "pom": "sha256-R8alCxQVHo+vfzUKlSNcN9EqvDi/sFW2aJdCkxctryw="
+  "org/jetbrains/kotlinx#kotlinx-coroutines-core-jvm/1.8.0": {
+   "jar": "sha256-mGCQahk3SQv187BtLw4Q70UeZblbJp8i2vaKPR9QZcU=",
+   "module": "sha256-/2oi2kAECTh1HbCuIRd+dlF9vxJqdnlvVCZye/dsEig=",
+   "pom": "sha256-pWM6vVNGfOuRYi2B8umCCAh3FF4LduG3V4hxVDSIXQs="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-core/1.7.1": {
-   "module": "sha256-qcwMK+48b8S6jQ51Oj8+cOGB2l3zolie5U6SgHszrM8=",
-   "pom": "sha256-BGsBD8eg5D0r/HOp3nZ13lVBAGy86WFjEhdGA01p1yM="
-  },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-core/1.7.1/all": {
-   "jar": "sha256-t9U3DtDlSVIAOxNZWme5fO0/hz2Rn13fvlD81JnL8Kc="
+  "org/jetbrains/kotlinx#kotlinx-coroutines-core/1.10.2": {
+   "jar": "sha256-MZtlMAnUnHCYL5jfKcyE/HAlsJLLBXHI51MuOtQ2ba4=",
+   "module": "sha256-j+JUF35xGnzRijwG2CQvzpRfQcLMoT3BmzOuQqVDUBY=",
+   "pom": "sha256-UZ2lQACW80YqTa6AeDrQUEE9S8gex65T+udq7wzL7Uw="
   },
   "org/jetbrains/kotlinx#kotlinx-coroutines-core/1.7.3": {
    "module": "sha256-f7FiOWWU7CjhtqRBG0V5SadnD14SAZF2d04f1rlHG78=",
    "pom": "sha256-7W6wOYcXA14p8cHWCk4927iYWPPbnge1etdZ03Ta6Ck="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-core/1.8.1": {
-   "jar": "sha256-2vUPHJQEsiSh1t1Shvjo7n1j/oB/eOqY9xeVwYO2Al8=",
-   "module": "sha256-CMuvMyW1Tg+O+NqF5OtZb32Ub4Q+XRYAOFRj8yaKTvA=",
-   "pom": "sha256-+IkY2/qHh8TRcasCVToUrR3viqmwxcLCDMmUVdMkHiI="
+  "org/jetbrains/kotlinx#kotlinx-coroutines-core/1.8.0": {
+   "module": "sha256-FE7s1TZd4+MNe0YibAWAUeOZVbXBieMfpMfP+5nWILo=",
+   "pom": "sha256-yglaS/iLR0+trOgzLBCXC3nLgBu/XfBHo5Ov4Ql28yE="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-debug/1.7.1": {
-   "jar": "sha256-UzPLuaF/1FZC8/Bf8SQAbNZ0NUlBPC9To1z5rNEUHpE=",
-   "module": "sha256-AeRqdLiVP/LovNqfCNdLjBcI6VxaDYcKdIACA288LQA=",
-   "pom": "sha256-MjPHSkqNioWksCh/aWIKSSMmq9iIfT6AxhzApQTHcls="
+  "org/jetbrains/kotlinx#kotlinx-coroutines-debug/1.10.2": {
+   "jar": "sha256-3HZK9XY8o/101yZpJFmjzSX4oPcPpsceV/65yX4djuk=",
+   "module": "sha256-XyuY3zJHW1OzsphxzhvqN3zt20vkezy05w3hrOmDocE=",
+   "pom": "sha256-CZTCJxRGRYsuwrSYCH2DQqyj0KRB/wXiId8EM/ZZpFc="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-debug/1.8.1": {
-   "jar": "sha256-JFUwMZoX18m8ShFSb0LpV1Dkqz/IZMlA2evo9UjqGHA=",
-   "module": "sha256-CA+LzOocTvqCk+0p/5z3xKfR0s3ekBzIZKz3Ly6AdXI=",
-   "pom": "sha256-x9+Ci/O0+ofumYH7ATaN1NwHmV0XzLqPpmEhcTwF69Q="
+  "org/jetbrains/kotlinx#kotlinx-coroutines-slf4j/1.10.2": {
+   "jar": "sha256-1l3uPK+m97+u/ttJP8aLXGOr51BzT7ivkvrHoNMQFFc=",
+   "module": "sha256-B7xJACLGWAQpQfUrFxwPXOBkvWxjUikEMDmS5BegRbs=",
+   "pom": "sha256-xHdj+siNuwlDhJ0W4RucBdReYDhMfNExBe5xD7TdX7M="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-jdk8/1.7.1": {
-   "jar": "sha256-uW9xRbpptI9JQFNMuOGcfhWcRUQ+J8NoIWJhSLoXEPI=",
-   "module": "sha256-sJV+aTzxwefUrWJGqm4weV2/S/t1jB5LMv25wkQJuXM=",
-   "pom": "sha256-x3kWU2lOpaVLnN1HCAgtv7i9apeKX0IYSxFBz7SjDnU="
+  "org/jetbrains/kotlinx#kotlinx-coroutines-test-jvm/1.10.2": {
+   "jar": "sha256-WQpUn4wdtZDJ2YqKIEJKH1gaNBYqNp5qa9iEzn0209c=",
+   "module": "sha256-VrIIF8xRrYi9tZwBIWsJiXzU+mmNUXu0d9kqlyp6Gq8=",
+   "pom": "sha256-Y96yqGiry+JIjrzrqnXnMbLvIQQQO4FzjnY3/JolpfM="
   },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-jdk8/1.8.1": {
-   "jar": "sha256-2M+0w2PJHHczU7EVvUprWgRgjnkW/iNdOp2H78uZbAE=",
-   "module": "sha256-Ifl7EL6TJkGBfTULclRP+LoyQYf/uREMbo2IESdv2TM=",
-   "pom": "sha256-3uCuamO2M1ETIAqW2eHHgJ32DQ1CS7/xy7tTsxQWWvk="
-  },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-slf4j/1.7.1": {
-   "jar": "sha256-+7QMp+VaeAF/6siXGAvmT1YqLreBxqP2ybsv+I2SIj8=",
-   "module": "sha256-I8EQcq7URvsrZsj57aP4mWbe09mP9bnfCg3LeTwBX/o=",
-   "pom": "sha256-HEWyu0XLYIIjT06yJj46XBxzQ4Rm6NUlr2gZCxbIklM="
-  },
-  "org/jetbrains/kotlinx#kotlinx-coroutines-slf4j/1.8.1": {
-   "jar": "sha256-cuELwT27MkpWx0R2xIzu4HsHbbWY+SYBe+djkrnn+zo=",
-   "module": "sha256-X8jvr3vGkS1yLchCQBoTMMvwcUSlkXvIvulJX8tqmhE=",
-   "pom": "sha256-RJqCH80/zFLz1YP4kANiu1j/yHOXN8zIYoxCRLCgq88="
+  "org/jetbrains/kotlinx#kotlinx-coroutines-test/1.10.2": {
+   "jar": "sha256-+tvgT72noncodw2OrsvewKmwspaTwgy+p3ZV14PYvXg=",
+   "module": "sha256-QiByzuO2n2jVsVA7tmUb54lGsEw5KEocwCbM6L3x+AY=",
+   "pom": "sha256-vyXI3w7J8+rHu+5Tm2AbYBm36Z9fPzAR4ugXixQHUNs="
   },
   "org/jetbrains/kotlinx#kotlinx-html-jvm/0.9.1": {
    "jar": "sha256-to85zZrXtG3goOd+f1kI1OdmHz0MhdLZFxVD/NWxVvs=",
    "module": "sha256-yic/19Bs3g8yr4MjBwCr2bD1c7mErohHzpDj3F0NE1M=",
    "pom": "sha256-CwfOpOggKjkGxUbxfi5akjR2rKhZ01TnnocfKehL0pc="
   },
-  "org/jetbrains/kotlinx#kotlinx-serialization-bom/1.5.1": {
-   "pom": "sha256-iLPXUHk1rZMqoao9sVF0NJ12iDoGzCwkthnZm4qwewI="
+  "org/jetbrains/kotlinx#kotlinx-io-bytestring-jvm/0.7.0": {
+   "jar": "sha256-6jimaw/0btgt3tnoHS3OcOX74DvWzFK0/IhpOB3qe30=",
+   "module": "sha256-D852CxW6wLkL7xvZDJfi0V+sQ6ZtwSCbSq7Jadk0Nv8=",
+   "pom": "sha256-mhfWfOIxynIhqWkS1WVtjRZ1gJ5FI/LDmupvs+o6bV8="
   },
-  "org/jetbrains/kotlinx#kotlinx-serialization-core-jvm/1.5.1": {
-   "jar": "sha256-pAU6NavrWb9wfXlIJFVW/o3DeenP7QiK7AgTTImWBdQ=",
-   "module": "sha256-9f9aY8GLCdhaN5Lm/tcooq07pyL4GhFxj8QWDflXrEU=",
-   "pom": "sha256-XQ3dpcR3TtUVQkMzNKluNs8hd5h3eAjCpY1/CLHUKOQ="
+  "org/jetbrains/kotlinx#kotlinx-io-bytestring/0.6.0": {
+   "module": "sha256-aO+bxmrpVPRzxZ9R679Ywdewb9b/9zNd0/s9JPipOQA=",
+   "pom": "sha256-I1NofPyzbJCaW8T08LUj0wv2WuXI34CsxW6enFJb528="
   },
-  "org/jetbrains/kotlinx#kotlinx-serialization-core/1.5.1": {
-   "module": "sha256-9V/lzh319wlKmo0QNrj3bOdQvImRd0Fg2lZ4TqXlhxs=",
-   "pom": "sha256-u3XOgDi/QxBDf37XEbn1DFA2/URJyD6PS82RCgvUsxU="
+  "org/jetbrains/kotlinx#kotlinx-io-bytestring/0.7.0": {
+   "jar": "sha256-01Y1Kw5VW+Emqtypvjm7d0kx4ypQCO3QYAmNu0fVfp4=",
+   "module": "sha256-3NfGKkJ9279ezgt5jcEqD41VcSN/UScFEKUHIotjM3k=",
+   "pom": "sha256-b+eWaxTo7fC/rO+FfIiUpr9EtmFsbwK/7UoJMU7+0Zw="
   },
-  "org/jetbrains/kotlinx#kotlinx-serialization-core/1.5.1/all": {
-   "jar": "sha256-C5rBEssP4lEwdtw3odxMPFcR0GyqR8cwSlZohT850BI="
+  "org/jetbrains/kotlinx#kotlinx-io-core-jvm/0.6.0": {
+   "module": "sha256-tZuXjCxEJJpnRkGmlONaKs7LqBLah9NlpRZzQqjKU0c=",
+   "pom": "sha256-3DNkYsj1BEkGHNRdXLHI9oC+VEGqgQ6UQR/4GQmdT2s="
   },
-  "org/jetbrains/kotlinx#kotlinx-serialization-json-jvm/1.5.1": {
-   "jar": "sha256-b8ELBW4QBpY6uyufw5Pc1OOEJTWLbxYoXo9j00Kf/SE=",
-   "module": "sha256-/6eWooex6Ya7mse4HBfrqNysMNUiQMM9XlicF1uggPk=",
-   "pom": "sha256-90mH/1adthY7Yd3GLVXjjn8JFh+ejxXyjbRSGWtzLTI="
+  "org/jetbrains/kotlinx#kotlinx-io-core-jvm/0.7.0": {
+   "jar": "sha256-bt7cm+TYeK6oDH3WCfkb/Ef809NsyR/Q8/Mo+9ZlbI8=",
+   "module": "sha256-dDDspoloWorXVm2MgIIUpylQsdbwNjQd+MTYKah3Bsg=",
+   "pom": "sha256-I4nhfLeFp854BZ7v7yv5fpGCbCe4PMzhkbTkLtlfiBo="
   },
-  "org/jetbrains/kotlinx#kotlinx-serialization-json/1.5.1": {
-   "module": "sha256-Sc1MAGoAGNtElIjEAO86IlejPn3w/FPCGSzo7RULwj0=",
-   "pom": "sha256-MYDroHos5F+dV+t2/qZM/jO/mU26eDHEiuo1aZfgldI="
+  "org/jetbrains/kotlinx#kotlinx-io-core/0.6.0": {
+   "module": "sha256-FIX7aljyQWnRr3PEFDAiUKx4u0axpD4Csa4hILKhJPA=",
+   "pom": "sha256-QIZ+EY9KW7uz291WZ3DY8Yu07w02MtyE+WyZ+2vD6oE="
   },
-  "org/jetbrains/kotlinx#kotlinx-serialization-json/1.5.1/all": {
-   "jar": "sha256-9/FQf3Nui2ZSCe//t7VWlECFBTsLybno3zDV0jK3ZlY="
+  "org/jetbrains/kotlinx#kotlinx-io-core/0.7.0": {
+   "jar": "sha256-4QKwiGCeeovbzCd6VH5GhOwER+QIk9coWDH769Gyfug=",
+   "module": "sha256-gTKXY+sZquO3OGcb7DFrkESEkcO/Unj24Q6kxwKS4iQ=",
+   "pom": "sha256-fu4E9DS9OmrRjhQFT0SH9DvKyQwDabBFA7FltzG+3Mo="
+  },
+  "org/jetbrains/kotlinx#kotlinx-serialization-bom/1.6.0": {
+   "pom": "sha256-bKZIdTuB5O4L9/N2wGNreMr6o7BxbBykXM0AzZSXdHc="
+  },
+  "org/jetbrains/kotlinx#kotlinx-serialization-bom/1.8.1": {
+   "pom": "sha256-APNVWudiSFHGfbEsMIvJziauMnzw1yR2akAeW6AGCMc="
+  },
+  "org/jetbrains/kotlinx#kotlinx-serialization-core-jvm/1.6.0": {
+   "jar": "sha256-7DUSjE+5BE6Zu88H8F7yVDv6bUIDDXqtq66s/7FucsU=",
+   "module": "sha256-uVDCZfLD4WO/1kdETbSsGqrAXX56jSrbBoRHs0wxxsg=",
+   "pom": "sha256-0VZ6zJLhdIK8ATwZA1EbtbG/36GUKWLXAia+3FK3xII="
+  },
+  "org/jetbrains/kotlinx#kotlinx-serialization-core-jvm/1.8.1": {
+   "jar": "sha256-NWW21NeJv3BoPEVWaUQof8HY3HXCPZi9h9AQWcx28rM=",
+   "module": "sha256-++GdWIrX1fZGZmaCA0/0Tglo0iBx/mzPn5ngPHpe+lc=",
+   "pom": "sha256-RGZV6NQ4KL+7OHzp0VGpNxowkrSLkJ6AYGtT/FiXnig="
+  },
+  "org/jetbrains/kotlinx#kotlinx-serialization-core/1.6.0": {
+   "module": "sha256-0lw7Wm4k3nKasF1JmDxg7CmY290q5O/iS2JV2MqC+nc=",
+   "pom": "sha256-O0Ni9LSZwS3/XUzOriTCaLBFe1Scha56Dyetslzgs3M="
+  },
+  "org/jetbrains/kotlinx#kotlinx-serialization-core/1.8.1": {
+   "jar": "sha256-2ZhZ/4zEmudp+Uivgj9GlHs+Vhf+wmg/3pUdTQ4Kd0k=",
+   "module": "sha256-eL3oMFSUrxs445ZrUleskINAFkk/i60hm4iGx/vbJdU=",
+   "pom": "sha256-Rz8Ko+Sheqt4YNykkNxC6rthJPHSlT5qmVoIcX5QxxQ="
+  },
+  "org/jetbrains/kotlinx#kotlinx-serialization-json-io-jvm/1.8.1": {
+   "jar": "sha256-q17I6kiBUZfEan359BimJ5H+kc2lAjuUHOTehy2BDME=",
+   "module": "sha256-vz47hoSxN/py0pZVZ1/c4xRGewh5JikYMm2vedE+Afo=",
+   "pom": "sha256-27ETuPvVUEVZjiTmATIGrrzKkSr+Vjnr2VJjC579kjw="
+  },
+  "org/jetbrains/kotlinx#kotlinx-serialization-json-io/1.8.1": {
+   "jar": "sha256-v2dav1Fi3Xc9TltbbSQ9Lpg2GtQRl1SRmQSXA+qnzN0=",
+   "module": "sha256-WTtZ8otvvbjsNRD4+ZQksTTlv8Qe2GS82LAiDv4APnM=",
+   "pom": "sha256-2e2KSEKd687/Z05u1OdgPR1K5Ao3lWT9BlPQ3V9gJb8="
+  },
+  "org/jetbrains/kotlinx#kotlinx-serialization-json-jvm/1.6.0": {
+   "jar": "sha256-H3K8q5I1ZCWR+1qrqG4UMXAe8A7/pfQFTTWEPceVEXY=",
+   "module": "sha256-OG9a4BhhX0cAIEcQ0c8Jh4MncnzrATBDjg9WTwit1MI=",
+   "pom": "sha256-CKbxhALfOeKfAj/f1VrfaHHpXLJkcpv3ikkciSUavDw="
+  },
+  "org/jetbrains/kotlinx#kotlinx-serialization-json-jvm/1.8.1": {
+   "jar": "sha256-h2nlZHVX43AJGcMtUI9cXa1TxdgjTNEIRjVPvP8UqiQ=",
+   "module": "sha256-uZHLSTQAwdlgut+oYhcVjGN+XsqIgbIM0BJbtOz8+DE=",
+   "pom": "sha256-1mXWtB/gWPZmpvOGrS5JzBAe+P0u7+/vy8ER6R7oJDY="
+  },
+  "org/jetbrains/kotlinx#kotlinx-serialization-json/1.6.0": {
+   "module": "sha256-IagQNSE8nNiADHbXYFfPRaqJxp2jsSkqn4zQf+DaLQc=",
+   "pom": "sha256-6hSUk17ZJHsWf8DXD/i/xJurjzLNLMahWnpXPNTXBgU="
+  },
+  "org/jetbrains/kotlinx#kotlinx-serialization-json/1.8.1": {
+   "jar": "sha256-WK3zNYoPmd2NZqVQ++GQZNOV4NX38eRlFc00cKVvu7A=",
+   "module": "sha256-f33wBUM932BPUqq9avsh65YJMZfLS90Hk8SEydPEtnU=",
+   "pom": "sha256-x3AMmcg94CtGVBo9fktps4h0m3wPV9zrRU0UPyzYens="
+  },
+  "org/jline#jline-parent/3.29.0": {
+   "pom": "sha256-eSLv09hwp9euA7GWwwDjXF3gIo5ZpbASrqZB4215ko4="
+  },
+  "org/jline#jline/3.29.0": {
+   "jar": "sha256-mcIqlmg4ukKR5ppd1Wia/QSVAOuTYrI7qs5zH5ycl90=",
+   "pom": "sha256-3kA5CpgAeh+lw1PW1PYTKA4JXTA4VY7LXnwjHb0SanA="
   },
   "org/jsoup#jsoup/1.16.1": {
    "jar": "sha256-HxFXJlQN33GVjBS8UX6/xJz0gekc2Rew+s6E8BJy6QE=",
    "pom": "sha256-bMUH9jBTbyBb3iwbOMPFkHUR3i17GkRL6dY41GFPJDw="
   },
-  "org/junit#junit-bom/5.10.0": {
-   "module": "sha256-6z7mEnYIAQaUqJgFbnQH0RcpYAOrpfXbgB30MLmIf88=",
-   "pom": "sha256-4AbdiJT5/Ht1/DK7Ev5e2L5lZn1bRU+Z4uC4xbuNMLM="
-  },
   "org/junit#junit-bom/5.10.1": {
    "module": "sha256-IbCvz//i7LN3D16wCuehn+rulOdx+jkYFzhQ2ueAZ7c=",
    "pom": "sha256-IcSwKG9LIAaVd/9LIJeKhcEArIpGtvHIZy+6qzN7w/I="
@@ -1266,71 +1316,118 @@
    "module": "sha256-qnlAydaDEuOdiaZShaqa9F8U2PQ02FDujZPbalbRZ7s=",
    "pom": "sha256-EJN9RMQlmEy4c5Il00cS4aMUVkHKk6w/fvGG+iX2urw="
   },
+  "org/junit#junit-bom/5.11.0": {
+   "module": "sha256-9+2+Z/IgQnCMQQq8VHQI5cR29An1ViNqEXkiEnSi7S0=",
+   "pom": "sha256-5nRZ1IgkJKxjdPQNscj0ouiJRrNAugcsgL6TKivkZE0="
+  },
+  "org/junit#junit-bom/5.12.1": {
+   "module": "sha256-TdKqnplFecYwRX35lbkZsDVFYzZGNy6q3R0WXQv1jBo=",
+   "pom": "sha256-fIJrxyvt3IF9rZJjAn+QEqD1Wjd9ON+JxCkyolAcK/A="
+  },
+  "org/junit/jupiter#junit-jupiter-api/5.12.1": {
+   "jar": "sha256-pAHgtgNz7fffCWLCXrMhPkUaR3h5LTOnaHbDuKW7IJs=",
+   "module": "sha256-iv9r5FYIFhBl7mO4QDyfKTE6HdnzkfP5eIVlpiMxGXY=",
+   "pom": "sha256-zqRvFdpTNT8vtSYZyvbcAH7CqE8O2vQMwSV/jjzvd9w="
+  },
+  "org/junit/jupiter#junit-jupiter-engine/5.12.1": {
+   "jar": "sha256-Dn8tvrkb+usNTLM6SHNRuvDlpu1ykGFU2P2ZddMpxZI=",
+   "module": "sha256-tvSQZ/FmJdFN7gmT8weKTGYeF8kOV0yf0SoWRur98tA=",
+   "pom": "sha256-GCeXDlNI10sY6757guDLGdxOj5np1NmEyyZJTVcTPao="
+  },
+  "org/junit/jupiter#junit-jupiter-params/5.12.1": {
+   "jar": "sha256-WVFwaZnjWVHU3w7KbgkdNhn2WanBCFjy9aPOGRy1dnM=",
+   "module": "sha256-KYwQtU+G3dtCeclfSYnRW+DV5QDEU+yTXv1Wd8v6Guk=",
+   "pom": "sha256-dHNtHnFnHQDeQFyxnD2GhOHFl9BwfeJmH7gHGyeEJ8M="
+  },
+  "org/junit/jupiter#junit-jupiter/5.12.1": {
+   "jar": "sha256-IoqUye50PVW/6gm1djBoHqeyCmYaR3RH9cH2DcEtnjo=",
+   "module": "sha256-OY71Q1eCyqfceKDRVRBpP6Xt7w/HP5PFVOZ3FxtCIj4=",
+   "pom": "sha256-m42YgPjFl2/JUEKEnzsSwRWdom5UUkMSY3edCx54yKQ="
+  },
+  "org/junit/platform#junit-platform-commons/1.12.1": {
+   "jar": "sha256-wxYWNYGqpWSSgBIrEuo2/k6cICoaImd1P+p8nh3wVes=",
+   "module": "sha256-ypN54aC/xbLOQ8dOh0SxT7fEkhPiISv1pH7QIv3bMM4=",
+   "pom": "sha256-tzKBEektR47QlWxjCgwkZm52gbUTgWj6FchbUJRqcAM="
+  },
+  "org/junit/platform#junit-platform-engine/1.12.1": {
+   "jar": "sha256-f+3/k/2SrsfSn8YNwB+gJyRrNrgIhCOl78SUnl9q/6Q=",
+   "module": "sha256-Vb3CX4rhKh3yQQisSArgiAKMiOMV+ou01HbU4RXyrGE=",
+   "pom": "sha256-TANohTegh/d9NLNNjczZO5NhcWu5u/S0ucbYMXkBS5w="
+  },
   "org/mockito#mockito-bom/4.11.0": {
    "pom": "sha256-2FMadGyYj39o7V8YjN6pRQBq6pk+xd+eUk4NJ9YUkdo="
   },
-  "org/mockito#mockito-bom/5.5.0": {
-   "pom": "sha256-U8DSPp0xhzL7IFrt+rKcB/srOtUMd80ep1InLiCjjqc="
+  "org/mockito#mockito-bom/5.13.0": {
+   "pom": "sha256-M7Wzq5+zSPUKHI9BRG1NKpn46wqk88Og13Vifqp/aNE="
   },
   "org/mockito#mockito-bom/5.7.0": {
    "pom": "sha256-dlcAW89JAw1nzF1S3rxm3xj0jVTbs+1GZ/1yWwZ5+6A="
   },
+  "org/opentest4j#opentest4j/1.3.0": {
+   "jar": "sha256-SOLfY2yrZWPO1k3N/4q7I1VifLI27wvzdZhoLd90Lxs=",
+   "module": "sha256-SL8dbItdyU90ZSvReQD2VN63FDUCSM9ej8onuQkMjg0=",
+   "pom": "sha256-m/fP/EEPPoNywlIleN+cpW2dQ72TfjCUhwbCMqlDs1U="
+  },
   "org/ow2#ow2/1.5.1": {
    "pom": "sha256-Mh3bt+5v5PU96mtM1tt0FU1r+kI5HB92OzYbn0hazwU="
   },
-  "org/ow2/asm#asm-commons/9.7": {
-   "jar": "sha256-OJvCR5WOBJ/JoECNOYySxtNwwYA1EgOV1Muh2dkwS3o=",
-   "pom": "sha256-Ws7j7nJS7ZC4B0x1XQInh0malfr/+YrEpoUQfE2kCbQ="
+  "org/ow2/asm#asm-commons/9.7.1": {
+   "jar": "sha256-mlebVNKSrZvhcdQxP9RznGNVksK1rDpFm70QSc3exqA=",
+   "pom": "sha256-C/HTHaDJ+djtwvJ9u/279z8acVtyzS+ijz8ZWZTXStE="
   },
-  "org/ow2/asm#asm-tree/9.7": {
-   "jar": "sha256-YvSzvENgRcGstcO6LY7FVuwzaQk9f10Gx0frBLVtUrE=",
-   "pom": "sha256-o06h4+QSjAEDjbQ8aXbojHec9a+EsFBdombf5pZWaOw="
+  "org/ow2/asm#asm-tree/9.7.1": {
+   "jar": "sha256-mSmIH1nra4QOhtVFcMd7Wc5yHRBObf16QJeJkcLTtB8=",
+   "pom": "sha256-E7kF9l5/1DynZ09Azao3Z5ukhYxsnZ+48Xp6/ZuqvJ4="
   },
-  "org/ow2/asm#asm/9.7": {
-   "jar": "sha256-rfRtXjSUC98Ujs3Sap7o7qlElqcgNP9xQQZrPupcTp0=",
-   "pom": "sha256-3gARXx2E86Cy7jpLb2GS0Gb4bRhdZ7nRUi8sgP6sXwA="
+  "org/ow2/asm#asm/9.7.1": {
+   "jar": "sha256-jK3UOsXrbQneBfrsyji5F6BAu5E5x+3rTMgcdAtxMoE=",
+   "pom": "sha256-cimwOzCnPukQCActnkVppR2FR/roxQ9SeEGu9MGwuqg="
   },
-  "org/postgresql#postgresql/42.7.4": {
-   "jar": "sha256-GIl2ch6tjoYn622DidUA3MwMm+vYhSaKMEcYAnSmAx4=",
-   "pom": "sha256-3fwfCT5VJ6+bPQWhG+sJtGYfLCsv8zdkmnNp7qDMcd4="
+  "org/postgresql#postgresql/42.7.5": {
+   "jar": "sha256-aQILO9IJhFQ+gXOT8ubAGokO8uN6d90R1thQgYHQeas=",
+   "pom": "sha256-FB6pP8GF3rFdKPz+P+qAivQBic9pEtaPMW6GjXzq/kg="
   },
   "org/slf4j#slf4j-api/1.7.36": {
    "jar": "sha256-0+9XXj5JeWeNwBvx3M5RAhSTtNEft/G+itmCh3wWocA=",
    "pom": "sha256-+wRqnCKUN5KLsRwtJ8i113PriiXmDL0lPZhSEN7cJoQ="
   },
-  "org/slf4j#slf4j-api/2.0.13": {
-   "jar": "sha256-58KkjoUVuh9J+mN9V7Ti9ZCz9b2XQHrGmcOqXvsSBKk=",
-   "pom": "sha256-UYBc/agMoqyCBBuQbZhl056YI+NYoO62I3nf7UdcFXE="
+  "org/slf4j#slf4j-api/2.0.16": {
+   "jar": "sha256-oSV43eG6AL2bgW04iguHmSjQC6s8g8JA9wE79BlsV5o=",
+   "pom": "sha256-saAPWxxNvmK4BdZdI5Eab3cGOInXyx6G/oOJ1hkEc/c="
   },
-  "org/slf4j#slf4j-bom/2.0.13": {
-   "pom": "sha256-evJy16c44rmHY3kf/diWBA6L6ymKiP1gYhRAeXbNMQo="
+  "org/slf4j#slf4j-api/2.0.17": {
+   "jar": "sha256-e3UdlSBhlU1av+1xgcH2RdM2CRtnmJFZHWMynGIuuDI=",
+   "pom": "sha256-FQxAKH987NwhuTgMqsmOkoxPM8Aj22s0jfHFrJdwJr8="
+  },
+  "org/slf4j#slf4j-bom/2.0.16": {
+   "pom": "sha256-BWYEjsglzfKHWGIK9k2eFK44qc2HSN1vr6bfSkGUwnk="
+  },
+  "org/slf4j#slf4j-bom/2.0.17": {
+   "pom": "sha256-940ntkK0uIbrg5/BArXNn+fzDzdZn/5oGFvk4WCQMek="
   },
   "org/slf4j#slf4j-parent/1.7.36": {
    "pom": "sha256-uziNN/vN083mTDzt4hg4aTIY3EUfBAQMXfNgp47X6BI="
   },
-  "org/slf4j#slf4j-parent/2.0.13": {
-   "pom": "sha256-Z/rP1R8Gk1zqhWFaBHddcNgL/QOtDzdnA1H5IO0LtYo="
+  "org/slf4j#slf4j-parent/2.0.16": {
+   "pom": "sha256-CaC0zIFNcnRhbJsW1MD9mq8ezIEzNN5RMeVHJxsZguU="
   },
-  "org/sonatype/oss#oss-parent/7": {
-   "pom": "sha256-tR+IZ8kranIkmVV/w6H96ne9+e9XRyL+kM5DailVlFQ="
+  "org/slf4j#slf4j-parent/2.0.17": {
+   "pom": "sha256-lc1x6FLf2ykSbli3uTnVfsKy5gJDkYUuC1Rd7ggrvzs="
   },
-  "org/sonatype/oss#oss-parent/9": {
-   "pom": "sha256-+0AmX5glSCEv+C42LllzKyGH7G8NgBgohcFO8fmCgno="
+  "org/springframework#spring-framework-bom/5.3.39": {
+   "module": "sha256-+ItA4qUDM7QLQvGB7uJyt17HXdhmbLFFvZCxW5fhg+M=",
+   "pom": "sha256-9tSBCT51dny6Gsfh2zj49pLL4+OHRGkzcada6yHGFIs="
   },
-  "org/springframework#spring-framework-bom/5.3.32": {
-   "module": "sha256-R6cJH2l8pjEYXtQY8Morhu7wyCqhbRdx3exLLDu3s70=",
-   "pom": "sha256-glr3ES49kupDa7DfeMGVFIhfXAFtD8YMiyTUdjoBWhA="
+  "org/vafer#jdependency/2.12": {
+   "jar": "sha256-xuxNA/nwT7ZEjTavQ6HMBpoh7LXocBM90Y/tT02x3mg=",
+   "pom": "sha256-LY6Zq9RS9eZCxtK74xACuSh5naw6CeA+PknyE3ozt+s="
   },
-  "org/vafer#jdependency/2.10": {
-   "jar": "sha256-Hc2DVauevO1odxW/ElLrKu5dDnRJeiAU/TOHz86N+F8=",
-   "pom": "sha256-q1PyWatfZIPT27AjVGngeNSiLP2JB3GrBPh9s6W0YGc="
+  "uk/org/webcompere#system-stubs-core/2.1.8": {
+   "jar": "sha256-nCcyLPxwQ8dThK1EQAewiAyhj+cjHWm/ppYWvHc8r+E=",
+   "pom": "sha256-xrz30a6C5STH6pAsty9FpYyh4xlgattd+goxjhq1/HE="
   },
-  "uk/org/webcompere#system-stubs-core/2.1.6": {
-   "jar": "sha256-3fwxmZiGbCWONnTTsanIfnZ049mwLaofTXUmATywhFM=",
-   "pom": "sha256-SnIy8ZqLYl1GupI24+3d7Zb2SFUF17QtTSdxQ0hzcic="
-  },
-  "uk/org/webcompere#system-stubs-parent/2.1.6": {
-   "pom": "sha256-pWWDCYZXTi4/RKbyKrejtMCNeSczAWTYtyRbjbmZVmQ="
+  "uk/org/webcompere#system-stubs-parent/2.1.8": {
+   "pom": "sha256-1xIK3nu0LjTx62S/5oAa+JhZvhIxrqsTs/fsgMvwcRM="
   }
  }
 }
diff --git a/pkgs/by-name/li/libeufin/package.nix b/pkgs/by-name/li/libeufin/package.nix
index 71717721a894..b0ef18dea909 100644
--- a/pkgs/by-name/li/libeufin/package.nix
+++ b/pkgs/by-name/li/libeufin/package.nix
@@ -16,19 +16,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libeufin";
-  version = "0.13.0";
+  version = "1.0.2";
 
   src = fetchgit {
     url = "https://git.taler.net/libeufin.git/";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-whGcFZYuyeFfhu+mIi7oUNJRXjaVGuL67sfUrHF85Fs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZjZo0oCsrnc413OY7ElU95Vto9Smp6fuPI3RzJzC3Zk=";
     fetchSubmodules = true;
     leaveDotGit = true; # required for correct submodule fetching
-    # Delete .git folder for reproducibility (otherwise, the hash changes unexpectedly after fetching submodules)
     # Save the HEAD short commit hash in a file so it can be retrieved later for versioning.
+    # Delete .git folder for reproducibility (otherwise, the hash changes unexpectedly after fetching submodules)
     postFetch = ''
       pushd $out
-      git rev-parse --short HEAD > ./common/src/main/resources/HEAD.txt
+      git rev-parse HEAD > ./common/src/main/resources/HEAD.txt
       rm -rf .git
       popd
     '';
@@ -116,6 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Integration and sandbox testing for FinTech APIs and data formats";
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [ atemu ];
+    teams = with lib.teams; [ ngi ];
     mainProgram = "libeufin-bank";
     sourceProvenance = with lib.sourceTypes; [
       fromSource
diff --git a/pkgs/by-name/li/libexif/package.nix b/pkgs/by-name/li/libexif/package.nix
index 35f37c9c41a9..17962c419380 100644
--- a/pkgs/by-name/li/libexif/package.nix
+++ b/pkgs/by-name/li/libexif/package.nix
@@ -11,9 +11,9 @@ stdenv.mkDerivation rec {
   version = "0.6.25";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "${pname}-${builtins.replaceStrings [ "." ] [ "_" ] version}-release";
+    owner = "libexif";
+    repo = "libexif";
+    rev = "libexif-${builtins.replaceStrings [ "." ] [ "_" ] version}-release";
     sha256 = "sha256-H8YzfNO2FCrYAwEA4bkOpRdxISK9RXaHVuK8zz70TlM=";
   };
 
diff --git a/pkgs/by-name/li/libfaketime/package.nix b/pkgs/by-name/li/libfaketime/package.nix
index 9eba7b189c1f..6feb112f8074 100644
--- a/pkgs/by-name/li/libfaketime/package.nix
+++ b/pkgs/by-name/li/libfaketime/package.nix
@@ -49,10 +49,21 @@ stdenv.mkDerivation rec {
   PREFIX = placeholder "out";
   LIBDIRNAME = "/lib";
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=cast-function-type -Wno-error=format-truncation";
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.cc.isClang [
+      "-Wno-error=cast-function-type"
+      "-Wno-error=format-truncation"
+    ]
+    # https://github.com/wolfcw/libfaketime/blob/6714b98794a9e8a413bf90d2927abf5d888ada99/README#L101-L104
+    ++ lib.optionals (stdenv.hostPlatform.isLoongArch64 || stdenv.hostPlatform.isRiscV64) [
+      "-DFORCE_PTHREAD_NONVER"
+    ]
+  );
 
   nativeCheckInputs = [ perl ];
 
+  doCheck = true;
+
   meta = with lib; {
     description = "Report faked system time to programs without having to change the system-wide time";
     homepage = "https://github.com/wolfcw/libfaketime/";
diff --git a/pkgs/by-name/li/libfreeaptx/package.nix b/pkgs/by-name/li/libfreeaptx/package.nix
index 0780ba270cbb..38d08a2f592b 100644
--- a/pkgs/by-name/li/libfreeaptx/package.nix
+++ b/pkgs/by-name/li/libfreeaptx/package.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "iamthehorker";
-    repo = pname;
+    repo = "libfreeaptx";
     rev = version;
     sha256 = "sha256-ntbF0jz/ilOk45xMQxx00WJtJq4Wb7VyKE0eKvghYnY=";
   };
diff --git a/pkgs/by-name/li/libgen-cli/package.nix b/pkgs/by-name/li/libgen-cli/package.nix
index b296e9e140a2..33aa2fc8cfa1 100644
--- a/pkgs/by-name/li/libgen-cli/package.nix
+++ b/pkgs/by-name/li/libgen-cli/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ciehanski";
-    repo = pname;
+    repo = "libgen-cli";
     rev = "v${version}";
     sha256 = "sha256-EicXsxAvVe/umpcOn4dVlTexaAol1qYPg/h5MU5dysM=";
   };
diff --git a/pkgs/by-name/li/libglibutil/package.nix b/pkgs/by-name/li/libglibutil/package.nix
index 920a71a61475..63d212faf79a 100644
--- a/pkgs/by-name/li/libglibutil/package.nix
+++ b/pkgs/by-name/li/libglibutil/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "sailfishos";
-    repo = pname;
+    repo = "libglibutil";
     rev = version;
     sha256 = "sha256-wp87cStOuQILSKFPFlFDL2vGvTQ4Cg5kuSlwnM4kc64=";
   };
diff --git a/pkgs/by-name/li/libimobiledevice-glue/package.nix b/pkgs/by-name/li/libimobiledevice-glue/package.nix
index 01a0ea4f8494..f8288ffb50e1 100644
--- a/pkgs/by-name/li/libimobiledevice-glue/package.nix
+++ b/pkgs/by-name/li/libimobiledevice-glue/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "libimobiledevice";
-    repo = pname;
+    repo = "libimobiledevice-glue";
     rev = version;
     hash = "sha256-Fu0zQIryESRaTGzDlAaewX9Yo2nPEeUxmcb3yPJLuSI=";
   };
diff --git a/pkgs/by-name/li/libimobiledevice/package.nix b/pkgs/by-name/li/libimobiledevice/package.nix
index 715fb7dc6fcd..9a630dedf1fb 100644
--- a/pkgs/by-name/li/libimobiledevice/package.nix
+++ b/pkgs/by-name/li/libimobiledevice/package.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "libimobiledevice";
-    repo = pname;
+    repo = "libimobiledevice";
     rev = "9ccc52222c287b35e41625cc282fb882544676c6";
     hash = "sha256-pNvtDGUlifp10V59Kah4q87TvLrcptrCJURHo+Y+hs4=";
   };
diff --git a/pkgs/by-name/li/libirecovery/package.nix b/pkgs/by-name/li/libirecovery/package.nix
index f9be0ab0146b..e052527856be 100644
--- a/pkgs/by-name/li/libirecovery/package.nix
+++ b/pkgs/by-name/li/libirecovery/package.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "libimobiledevice";
-    repo = pname;
+    repo = "libirecovery";
     rev = version;
     hash = "sha256-R+oBC7F4op0qoIk3d/WqS4MwzZY3WMAMIqlJfJb188Q=";
   };
diff --git a/pkgs/by-name/li/liblinphone/package.nix b/pkgs/by-name/li/liblinphone/package.nix
index f22403a79cb3..e3eebef53ba3 100644
--- a/pkgs/by-name/li/liblinphone/package.nix
+++ b/pkgs/by-name/li/liblinphone/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     domain = "gitlab.linphone.org";
     owner = "public";
     group = "BC";
-    repo = pname;
+    repo = "liblinphone";
     rev = version;
     hash = "sha256-kQZePMa7MTaSJLEObM8khfSFYLqhlgTcVyKfTPLwKYU=";
   };
diff --git a/pkgs/by-name/li/libmkv/package.nix b/pkgs/by-name/li/libmkv/package.nix
index 1a16268daa7d..5bbf2e44c110 100644
--- a/pkgs/by-name/li/libmkv/package.nix
+++ b/pkgs/by-name/li/libmkv/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "saintdev";
-    repo = pname;
+    repo = "libmkv";
     tag = version;
     sha256 = "0pr9q7yprndl8d15ir7i7cznvmf1yqpvnsyivv763n6wryssq6dl";
   };
diff --git a/pkgs/by-name/li/libnsl/package.nix b/pkgs/by-name/li/libnsl/package.nix
index d03bc44888de..fe251a5ee1bd 100644
--- a/pkgs/by-name/li/libnsl/package.nix
+++ b/pkgs/by-name/li/libnsl/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "thkukuk";
-    repo = pname;
+    repo = "libnsl";
     rev = "v${version}";
     sha256 = "sha256-bCToqXVE4RZcoZ2eTNZcVHyzKlWyIpSAssQCOZcfmEA=";
   };
diff --git a/pkgs/by-name/li/libplacebo/package.nix b/pkgs/by-name/li/libplacebo/package.nix
index d50c722327ac..b959f62574b9 100644
--- a/pkgs/by-name/li/libplacebo/package.nix
+++ b/pkgs/by-name/li/libplacebo/package.nix
@@ -21,14 +21,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libplacebo";
-  version = "7.349.0";
+  version = "7.351.0";
 
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "videolan";
     repo = "libplacebo";
     rev = "v${version}";
-    hash = "sha256-mIjQvc7SRjE1Orb2BkHK+K1TcRQvzj2oUOCUT4DzIuA=";
+    hash = "sha256-ccoEFpp6tOFdrfMyE0JNKKMAdN4Q95tP7j7vzUj+lSQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libqb/package.nix b/pkgs/by-name/li/libqb/package.nix
index 094a1c53790f..07c42ad714c4 100644
--- a/pkgs/by-name/li/libqb/package.nix
+++ b/pkgs/by-name/li/libqb/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "ClusterLabs";
-    repo = pname;
+    repo = "libqb";
     rev = "v${version}";
     sha256 = "sha256-ZjxC7W4U8T68mZy/OvWj/e4W9pJIj2lVDoEjxXYr/G8=";
   };
diff --git a/pkgs/by-name/li/libre-graph-api-cpp-qt-client/package.nix b/pkgs/by-name/li/libre-graph-api-cpp-qt-client/package.nix
index 5fbed39c692d..f9230dac9edd 100644
--- a/pkgs/by-name/li/libre-graph-api-cpp-qt-client/package.nix
+++ b/pkgs/by-name/li/libre-graph-api-cpp-qt-client/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "owncloud";
-    repo = pname;
+    repo = "libre-graph-api-cpp-qt-client";
     tag = "v${version}";
     hash = "sha256-wbdamPi2XSLWeprrYZtBUDH1A2gdp6/5geFZv+ZqSWk=";
   };
diff --git a/pkgs/by-name/li/librenms/package.nix b/pkgs/by-name/li/librenms/package.nix
index 5d7ea073b901..133fa42cf57f 100644
--- a/pkgs/by-name/li/librenms/package.nix
+++ b/pkgs/by-name/li/librenms/package.nix
@@ -31,7 +31,7 @@ phpPackage.buildComposerProject2 rec {
 
   src = fetchFromGitHub {
     owner = "librenms";
-    repo = pname;
+    repo = "librenms";
     tag = version;
     sha256 = "sha256-I1bHEFWGgwHq1U8Ipbm9tu7t6ikfMG+EIPjCsLAP/tk=";
   };
diff --git a/pkgs/by-name/li/libretrack/package.nix b/pkgs/by-name/li/libretrack/package.nix
index 0d238702d7ec..a2e37af40362 100644
--- a/pkgs/by-name/li/libretrack/package.nix
+++ b/pkgs/by-name/li/libretrack/package.nix
@@ -5,7 +5,7 @@
   libappindicator,
 }:
 
-flutterPackages-source.stable.buildFlutterApplication rec {
+flutterPackages-source.v3_29.buildFlutterApplication rec {
   pname = "libretrack";
   version = "1.7.0";
 
diff --git a/pkgs/by-name/li/libretro-shaders-slang/package.nix b/pkgs/by-name/li/libretro-shaders-slang/package.nix
index d371b4371d03..ff39c9c8fa65 100644
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2025-05-17";
+  version = "0-unstable-2025-05-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "37aa1f355e19701b192ae0b88855094fe2f5ff22";
-    hash = "sha256-30xMYR54z7aJqQZL8zqO93n12vYA7uE3GnZTHP92uRc=";
+    rev = "8c630e0d3234d93b6c2bc847371f86aa4e535686";
+    hash = "sha256-BDxgVBWDUYgSvEl9dn/PB8c4ceYgM1Bo4aEzvqwTaYA=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/li/libserdes/package.nix b/pkgs/by-name/li/libserdes/package.nix
index 69d479e43575..1909f44b4434 100644
--- a/pkgs/by-name/li/libserdes/package.nix
+++ b/pkgs/by-name/li/libserdes/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "confluentinc";
-    repo = pname;
+    repo = "libserdes";
     rev = "v${version}";
     hash = "sha256-rg4SWa9nIDT6JrnnCDwdiFE1cvpUn0HWHn+bPkXMHQ4=";
   };
diff --git a/pkgs/by-name/li/libsndfile/package.nix b/pkgs/by-name/li/libsndfile/package.nix
index dd7e36b7da31..583cecb84572 100644
--- a/pkgs/by-name/li/libsndfile/package.nix
+++ b/pkgs/by-name/li/libsndfile/package.nix
@@ -29,8 +29,8 @@ stdenv.mkDerivation rec {
   version = "1.2.2";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "libsndfile";
+    repo = "libsndfile";
     rev = version;
     hash = "sha256-MOOX/O0UaoeMaQPW9PvvE0izVp+6IoE5VbtTx0RvMkI=";
   };
diff --git a/pkgs/by-name/li/libucontext/package.nix b/pkgs/by-name/li/libucontext/package.nix
index 375fc20164ac..0e921bd02efc 100644
--- a/pkgs/by-name/li/libucontext/package.nix
+++ b/pkgs/by-name/li/libucontext/package.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "kaniini";
-    repo = pname;
+    repo = "libucontext";
     rev = "v${version}";
     hash = "sha256-fk3ZKkp3dsyeF6SOWSccr5MkKEwS4AAuosD/h+6wjSw=";
   };
diff --git a/pkgs/by-name/li/libuiohook/package.nix b/pkgs/by-name/li/libuiohook/package.nix
index 709e75bc8ec7..faaeaf9ce7cf 100644
--- a/pkgs/by-name/li/libuiohook/package.nix
+++ b/pkgs/by-name/li/libuiohook/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "kwhat";
-    repo = pname;
+    repo = "libuiohook";
     rev = version;
     sha256 = "1qlz55fp4i9dd8sdwmy1m8i4i1jy1s09cpmlxzrgf7v34w72ncm7";
   };
diff --git a/pkgs/by-name/li/libusbmuxd/package.nix b/pkgs/by-name/li/libusbmuxd/package.nix
index cb77300acec0..5b83647f9a3b 100644
--- a/pkgs/by-name/li/libusbmuxd/package.nix
+++ b/pkgs/by-name/li/libusbmuxd/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "libimobiledevice";
-    repo = pname;
+    repo = "libusbmuxd";
     rev = version;
     hash = "sha256-coQqNGPsqrOYbBjO0eQZQNK8ZTB+ZzfMWvQ6Z1by9PY=";
   };
diff --git a/pkgs/by-name/li/libvpx/package.nix b/pkgs/by-name/li/libvpx/package.nix
index dc33fa0bef67..a891f9b2dea5 100644
--- a/pkgs/by-name/li/libvpx/package.nix
+++ b/pkgs/by-name/li/libvpx/package.nix
@@ -135,7 +135,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "webmproject";
-    repo = pname;
+    repo = "libvpx";
     rev = "v${version}";
     hash = "sha256-ewkx1okhpa05jn4DyN8pkl6UJoz4Ymw4jRe6GN1lWuA=";
   };
diff --git a/pkgs/by-name/li/libxls/package.nix b/pkgs/by-name/li/libxls/package.nix
index 55c58f9518a6..50dab3f68365 100644
--- a/pkgs/by-name/li/libxls/package.nix
+++ b/pkgs/by-name/li/libxls/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "libxls";
-    repo = pname;
+    repo = "libxls";
     rev = "v${version}";
     hash = "sha256-KbITHQ9s2RUeo8zR53R9s4WUM6z8zzddz1k47So0Mlw=";
   };
diff --git a/pkgs/by-name/li/lighthouse-steamvr/package.nix b/pkgs/by-name/li/lighthouse-steamvr/package.nix
index 775a22a16c3f..c0f6a180fbf6 100644
--- a/pkgs/by-name/li/lighthouse-steamvr/package.nix
+++ b/pkgs/by-name/li/lighthouse-steamvr/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "ShayBox";
-    repo = pname;
+    repo = "Lighthouse";
     rev = version;
     hash = "sha256-FiS+jB5l5xtFIVISA6+K/jbyJZFPwLvy7G+dA+78kZU=";
   };
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 5b2c52b1c11b..480b43914bae 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -42,14 +42,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "9.3.2";
+  version = "9.3.3";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/limine-bootloader/limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-aYzNgErrlRIIv4hmekdoPMCZ4g5xDYIeTUJhEkfuuJQ=";
+    hash = "sha256-+yhHFt9SvYUl/tjfwZyR0OJK8+BDzieLS2AFY1VyNLE=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/li/lint-staged/package.nix b/pkgs/by-name/li/lint-staged/package.nix
index 68e16790e4bc..a4c7b302b818 100644
--- a/pkgs/by-name/li/lint-staged/package.nix
+++ b/pkgs/by-name/li/lint-staged/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "16.0.0";
+  version = "16.1.0";
 
   src = fetchFromGitHub {
     owner = "okonet";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-vMk8KrWkrMETEGUev0C5ZaMFZH95/VaASr9v5nI2JGo=";
+    hash = "sha256-dR0z/60CHDqCl9pEc9KQww1S5aSZ4XGsfNqxBSZe0Ig=";
   };
 
-  npmDepsHash = "sha256-lj1+a/+X/0Qj41S+C50Z5cQfu/5KUgXgls+tYbN16OU=";
+  npmDepsHash = "sha256-MznWvv61Z+8t+Nicj6yWlQqUHVx7AAtkDXu2L2E5dw8=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/li/linux-exploit-suggester/package.nix b/pkgs/by-name/li/linux-exploit-suggester/package.nix
index e9af8bcaea36..e98b189c7cd5 100644
--- a/pkgs/by-name/li/linux-exploit-suggester/package.nix
+++ b/pkgs/by-name/li/linux-exploit-suggester/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation {
   pname = "linux-exploit-suggester";
   version = "unstable-2022-04-01";
 
   src = fetchFromGitHub {
     owner = "mzet-";
-    repo = pname;
+    repo = "linux-exploit-suggester";
     rev = "54a5c01497d6655be88f6262ccad5bc5a5e4f4ec";
     sha256 = "v0Q8O+aaXEqwWAwGP/u5Nkm4DzM6nM11GI4XbK2PeWM=";
   };
@@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    install -Dm755 linux-exploit-suggester.sh $out/bin/${pname}
+    install -Dm755 linux-exploit-suggester.sh $out/bin/linux-exploit-suggester
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/li/linuxConsoleTools/package.nix b/pkgs/by-name/li/linuxConsoleTools/package.nix
index 323c83b9d26b..f9aeeae682c8 100644
--- a/pkgs/by-name/li/linuxConsoleTools/package.nix
+++ b/pkgs/by-name/li/linuxConsoleTools/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchurl,
   pkg-config,
-  SDL,
   SDL2,
 }:
 
@@ -18,7 +17,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    SDL
     SDL2
   ];
 
diff --git a/pkgs/by-name/li/linx-server/package.nix b/pkgs/by-name/li/linx-server/package.nix
index 27bd8cbf2d53..9e895bd600e3 100644
--- a/pkgs/by-name/li/linx-server/package.nix
+++ b/pkgs/by-name/li/linx-server/package.nix
@@ -5,13 +5,13 @@
   lib,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "linx-server";
   version = "unstable-2021-12-24";
 
   src = fetchFromGitHub {
     owner = "zizzydizzymc";
-    repo = pname;
+    repo = "linx-server";
     rev = "3f503442f10fca68a3212975b23cf74d92c9988c";
     hash = "sha256-tTHw/rIb2Gs5i5vZKsSgbUePIY7Np6HofBXu4TTjKbw=";
   };
diff --git a/pkgs/by-name/li/lite/package.nix b/pkgs/by-name/li/lite/package.nix
index fd19d3bd1f83..21191c70baec 100644
--- a/pkgs/by-name/li/lite/package.nix
+++ b/pkgs/by-name/li/lite/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "rxi";
-    repo = pname;
+    repo = "lite";
     rev = "v${version}";
     sha256 = "0wxqfb4ly8g7w5qph76xys95b55ackkags8jgd1nasmiyi8gcd5a";
   };
@@ -52,10 +52,10 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    mkdir -p $out/bin $out/lib/${pname}
-    cp -a lite $out/lib/${pname}
-    cp -a data $out/lib/${pname}
-    makeWrapper $out/lib/${pname}/lite $out/bin/lite
+    mkdir -p $out/bin $out/lib/lite
+    cp -a lite $out/lib/lite
+    cp -a data $out/lib/lite
+    makeWrapper $out/lib/lite/lite $out/bin/lite
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/li/litefs/package.nix b/pkgs/by-name/li/litefs/package.nix
index 83226ec9b449..455b77971f8a 100644
--- a/pkgs/by-name/li/litefs/package.nix
+++ b/pkgs/by-name/li/litefs/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "superfly";
-    repo = pname;
+    repo = "litefs";
     rev = "v${version}";
     sha256 = "sha256-URwHnOvvz/UnrxoFIuUYpw10uPHgxQf9LPO1xECixDE=";
   };
diff --git a/pkgs/by-name/li/litestream/package.nix b/pkgs/by-name/li/litestream/package.nix
index fdb205a271ed..9407d958f7d9 100644
--- a/pkgs/by-name/li/litestream/package.nix
+++ b/pkgs/by-name/li/litestream/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "benbjohnson";
-    repo = pname;
+    repo = "litestream";
     rev = "v${version}";
     sha256 = "sha256-p858gK+ICKDQ+/LUiBaxF/kfrZzQAXnYMZDFU8kNCJ4=";
   };
diff --git a/pkgs/by-name/li/livedl/package.nix b/pkgs/by-name/li/livedl/package.nix
index 1034cad36ede..82304bcfbd50 100644
--- a/pkgs/by-name/li/livedl/package.nix
+++ b/pkgs/by-name/li/livedl/package.nix
@@ -5,13 +5,13 @@
   stdenv,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "livedl";
   version = "unstable-2021-05-16";
 
   src = fetchFromGitHub {
     owner = "himananiito";
-    repo = pname;
+    repo = "livedl";
     rev = "a8720f1e358e5b0ade6fdeb8aacc00781e6cc504";
     sha256 = "1zax215jp6sl47m8ahssyyrbzn96dh74srq9g61jc76sq10xg329";
   };
diff --git a/pkgs/by-name/ll/lla/package.nix b/pkgs/by-name/ll/lla/package.nix
index 0323e2b709d0..3fc5f2f5e39a 100644
--- a/pkgs/by-name/ll/lla/package.nix
+++ b/pkgs/by-name/ll/lla/package.nix
@@ -8,7 +8,7 @@
   nix-update-script,
 }:
 let
-  version = "0.3.10";
+  version = "0.3.11";
 in
 rustPlatform.buildRustPackage {
   pname = "lla";
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage {
     owner = "chaqchase";
     repo = "lla";
     tag = "v${version}";
-    hash = "sha256-/6p23JW3ZaSuDf34IWcTggR92/zUTMRerQ32bTsRujo=";
+    hash = "sha256-HxHUpFTAeK3/pE+ozHGmMUj0Jt7iKrbZ1xnFj7828Ng=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage {
   ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-aX8nm/V0ug2g40QeFU9AWxjuFAnW+gYTR8RC5CV7wRQ=";
+  cargoHash = "sha256-YvxzuOUowr5tcKZaZwgpeskfMJcOKJyHci43CfQWhOY=";
 
   cargoBuildFlags = [ "--workspace" ];
 
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 589f6c2c3dc2..c0ac00cdc34b 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -72,13 +72,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "5416";
+  version = "5535";
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-/UFfHPGJRPnLEA9JninLazrwO3koE5AaK4oHK7yoN+0=";
+    hash = "sha256-n6h4aiszPU7/JV3btPQEJBHeR/YrzVqOzNFAXNPSEAg=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
diff --git a/pkgs/by-name/ln/lnch/package.nix b/pkgs/by-name/ln/lnch/package.nix
index 20ecc2a7c8b4..803e88daf275 100644
--- a/pkgs/by-name/ln/lnch/package.nix
+++ b/pkgs/by-name/ln/lnch/package.nix
@@ -4,13 +4,13 @@
   buildGoModule,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "lnch";
   version = "unstable-2021-08-15";
 
   src = fetchFromGitHub {
     owner = "oem";
-    repo = pname;
+    repo = "lnch";
     rev = "56b5e256b46c002821bef3b9c1b6f68b9dbb4207";
     sha256 = "sha256-Iro/FjPFMqulcK90MbludnOXkMEHW0QSCoQRL01/LDE";
   };
diff --git a/pkgs/by-name/ln/lndconnect/package.nix b/pkgs/by-name/ln/lndconnect/package.nix
index d5105e6fc1c0..1de170f5e8db 100644
--- a/pkgs/by-name/ln/lndconnect/package.nix
+++ b/pkgs/by-name/ln/lndconnect/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "LN-Zap";
-    repo = pname;
+    repo = "lndconnect";
     rev = "v${version}";
     hash = "sha256-cuZkVeFUQq7+kQo/YjXCMPANUL5QooAWgegcoWo3M0c=";
   };
diff --git a/pkgs/by-name/ln/lndmanage/package.nix b/pkgs/by-name/ln/lndmanage/package.nix
index c91b680fcbe0..7b40b4d23ed6 100644
--- a/pkgs/by-name/ln/lndmanage/package.nix
+++ b/pkgs/by-name/ln/lndmanage/package.nix
@@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "bitromortac";
-    repo = pname;
+    repo = "lndmanage";
     tag = "v${version}";
     hash = "sha256-VUeGnk/DtNAyEYFESV6kXIRbKqUv4IcMnU3fo0NB4uQ=";
   };
diff --git a/pkgs/by-name/lo/lock/package.nix b/pkgs/by-name/lo/lock/package.nix
index 6d331e18cc2a..3e7a33fea314 100644
--- a/pkgs/by-name/lo/lock/package.nix
+++ b/pkgs/by-name/lo/lock/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lock";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "konstantintutsch";
     repo = "Lock";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2AHnzJ5lwm/CXOTBumTxllIzFo88EAENwQFny7TjrUk=";
+    hash = "sha256-Ct5INzqSNbGVSlpQsAuAXFlcZHmN/L4eLCZ4/Di5apQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/lo/log4j-detect/package.nix b/pkgs/by-name/lo/log4j-detect/package.nix
index fc576a604254..9dc1117a524a 100644
--- a/pkgs/by-name/lo/log4j-detect/package.nix
+++ b/pkgs/by-name/lo/log4j-detect/package.nix
@@ -4,14 +4,14 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication {
   pname = "log4j-detect";
   version = "unstable-2021-12-14";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "takito1812";
-    repo = pname;
+    repo = "log4j-detect";
     rev = "2f5b7a598a6d0b4aee8111bb574ea72c6a1c76d6";
     sha256 = "sha256-fFKW7uPBfrnze0UoPL3Mfwd4sFOuHYuDP7kv6VtdM3o=";
   };
@@ -21,12 +21,12 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   postPatch = ''
-    sed -i "1 i #!/usr/bin/python" ${pname}.py
+    sed -i "1 i #!/usr/bin/python" log4j-detect.py
   '';
 
   installPhase = ''
     runHook preInstall
-    install -vD ${pname}.py $out/bin/${pname}
+    install -vD log4j-detect.py $out/bin/log4j-detect
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/lo/log4j-scan/package.nix b/pkgs/by-name/lo/log4j-scan/package.nix
index 08e28da2a0d8..e8717c32e2fd 100644
--- a/pkgs/by-name/lo/log4j-scan/package.nix
+++ b/pkgs/by-name/lo/log4j-scan/package.nix
@@ -4,14 +4,14 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication {
   pname = "log4j-scan";
   version = "unstable-2021-12-18";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "fullhunt";
-    repo = pname;
+    repo = "log4j-scan";
     rev = "070fbd00f0945645bd5e0daa199a554ef3884b95";
     sha256 = "sha256-ORSc4KHyAMjuA7QHReDh6SYY5yZRunBBN1+lkCayqL4=";
   };
@@ -30,7 +30,7 @@ python3.pkgs.buildPythonApplication rec {
   installPhase = ''
     runHook preInstall
 
-    install -vD ${pname}.py $out/bin/${pname}
+    install -vD log4j-scan.py $out/bin/log4j-scan
     install -vD headers.txt headers-large.txt -t $out/share
 
     runHook postInstall
diff --git a/pkgs/by-name/lo/log4j-sniffer/package.nix b/pkgs/by-name/lo/log4j-sniffer/package.nix
index 4e5102574abb..649e4d20efdc 100644
--- a/pkgs/by-name/lo/log4j-sniffer/package.nix
+++ b/pkgs/by-name/lo/log4j-sniffer/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "palantir";
-    repo = pname;
+    repo = "log4j-sniffer";
     rev = "v${version}";
     sha256 = "sha256-pO6difzNvQvKQtRLyksXmExtQHlnnwyF3iNEmSBgUmU=";
   };
diff --git a/pkgs/by-name/lo/log4jcheck/package.nix b/pkgs/by-name/lo/log4jcheck/package.nix
index 7a8c3a429d5b..4018382e51a1 100644
--- a/pkgs/by-name/lo/log4jcheck/package.nix
+++ b/pkgs/by-name/lo/log4jcheck/package.nix
@@ -4,14 +4,14 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication {
   pname = "log4jcheck";
   version = "unstable-2021-12-14";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "NorthwaveSecurity";
-    repo = pname;
+    repo = "log4jcheck";
     rev = "736f1f4044e8a9b7bf5db515e2d1b819253f0f6d";
     sha256 = "sha256-1al7EMYbE/hFXKV4mYZlkEWTUIKYxgXYU3qBLlczYvs=";
   };
@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication rec {
 
   installPhase = ''
     runHook preInstall
-    install -vD nw_log4jcheck.py $out/bin/${pname}
+    install -vD nw_log4jcheck.py $out/bin/log4jcheck
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/lo/log4shell-detector/package.nix b/pkgs/by-name/lo/log4shell-detector/package.nix
index 208a18a24b79..4115d59d1586 100644
--- a/pkgs/by-name/lo/log4shell-detector/package.nix
+++ b/pkgs/by-name/lo/log4shell-detector/package.nix
@@ -4,14 +4,14 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication {
   pname = "log4shell-detector";
   version = "unstable-2021-12-16";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Neo23x0";
-    repo = pname;
+    repo = "log4shell-detector";
     rev = "622b88e7ea36819da23ce6ac090785cd6cca77f9";
     sha256 = "sha256-N81x9hq473LfM+bQIQLWizCAsVc/pzyB84PV7/N5jk4=";
   };
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
 
   installPhase = ''
     runHook preInstall
-    install -vD ${pname}.py $out/bin/${pname}
+    install -vD log4shell-detector.py $out/bin/log4shell-detector
     install -vd $out/${python3.sitePackages}/
     cp -R Log4ShellDetector $out/${python3.sitePackages}
     runHook postInstall
diff --git a/pkgs/by-name/lo/logmap/package.nix b/pkgs/by-name/lo/logmap/package.nix
index 8e0a4a7852a0..71502bddd93f 100644
--- a/pkgs/by-name/lo/logmap/package.nix
+++ b/pkgs/by-name/lo/logmap/package.nix
@@ -4,14 +4,14 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication {
   pname = "logmap";
   version = "unstable-2021-12-15";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "zhzyker";
-    repo = pname;
+    repo = "logmap";
     rev = "5040707b4ae260830072de93ccd6a23615073abf";
     sha256 = "sha256-LOGjK5l/gaKObWbC9vaLruE8DdDsabztnEW/TjvCdtE=";
   };
@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication rec {
 
   installPhase = ''
     runHook preInstall
-    install -vD ${pname}.py $out/bin/${pname}
+    install -vD logmap.py $out/bin/logmap
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/lo/logseq/package.nix b/pkgs/by-name/lo/logseq/package.nix
index dccb3963563e..fb243ffb49c2 100644
--- a/pkgs/by-name/lo/logseq/package.nix
+++ b/pkgs/by-name/lo/logseq/package.nix
@@ -5,12 +5,12 @@
   fetchFromGitHub,
   fetchYarnDeps,
   replaceVars,
-  runCommand,
   writeShellScriptBin,
 
   copyDesktopItems,
   cctools,
   clojure,
+  darwin,
   makeDesktopItem,
   makeWrapper,
   nodejs,
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "logseq";
-  version = "0.10.9-unstable-2025-03-11";
+  version = "0.10.12";
 
   src = fetchFromGitHub {
     owner = "logseq";
     repo = "logseq";
-    rev = "ac0a0dae727c46b348d0f1410138d5e49d446692";
-    hash = "sha256-esCB51BeWnni/JFL4yMKcJj5lka2+hLpcvWGify0T2o=";
+    tag = finalAttrs.version;
+    hash = "sha256-SUzt4hYHE6XJOEMxFp2a0om2oVUk1MHQUteGFiM9Lkc=";
   };
 
   patches = [
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
   yarnOfflineCacheRoot = fetchYarnDeps {
     name = "logseq-${finalAttrs.version}-yarn-deps-root";
     inherit (finalAttrs) src;
-    hash = "sha256-z4G675kxfpmG2AJlbK5bfeUUgX7jz1ys2FlMNHJqrQ4=";
+    hash = "sha256-sbC6WQLjEHIKTuejSQXplQOWZwUmBJdGXuAkilQGjYs=";
   };
 
   # ./static and ./resources are combined into ./static by the build process
@@ -107,7 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
     name = "logseq-${finalAttrs.version}-yarn-deps-static-resources";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/static";
-    hash = "sha256-xuZj2EKHxvkiDPKMLh3ZSvLT54k+buHqg9lRTFv8rNI=";
+    hash = "sha256-01t6lolMbBL5f6SFk4qTkTx6SQXWtHuVkBhDwW+HScc=";
   };
 
   yarnOfflineCacheAmplify = fetchYarnDeps {
@@ -151,6 +151,7 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       cctools
+      darwin.autoSignDarwinBinariesHook
       xcbuild
     ];
 
diff --git a/pkgs/by-name/lo/lollypop/package.nix b/pkgs/by-name/lo/lollypop/package.nix
index 9a07d38e6bf2..32fbea586e43 100644
--- a/pkgs/by-name/lo/lollypop/package.nix
+++ b/pkgs/by-name/lo/lollypop/package.nix
@@ -35,7 +35,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
-    repo = pname;
+    repo = "lollypop";
     rev = version;
     fetchSubmodules = true;
     hash = "sha256-hdReviNgcigXuNqJns6aPW+kixlpmRXtqrLlm/LGHBo=";
diff --git a/pkgs/by-name/lo/lorri/package.nix b/pkgs/by-name/lo/lorri/package.nix
index 340cb69988bc..848c8703e381 100644
--- a/pkgs/by-name/lo/lorri/package.nix
+++ b/pkgs/by-name/lo/lorri/package.nix
@@ -23,7 +23,7 @@ in
 
   src = fetchFromGitHub {
     owner = "nix-community";
-    repo = pname;
+    repo = "lorri";
     rev = version;
     inherit sha256;
   };
diff --git a/pkgs/by-name/lo/loudgain/package.nix b/pkgs/by-name/lo/loudgain/package.nix
index 0a29ea0e7e3d..0a16ff5a706e 100644
--- a/pkgs/by-name/lo/loudgain/package.nix
+++ b/pkgs/by-name/lo/loudgain/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "Moonbase59";
-    repo = pname;
+    repo = "loudgain";
     rev = "v${version}";
     hash = "sha256-XLj+n0GlY/GAkJlW2JVMd0jxMzgdv/YeSTuF6QUIGwU=";
   };
diff --git a/pkgs/by-name/lo/lounge-gtk-theme/package.nix b/pkgs/by-name/lo/lounge-gtk-theme/package.nix
index aec0a74eaf18..0e885c112efe 100644
--- a/pkgs/by-name/lo/lounge-gtk-theme/package.nix
+++ b/pkgs/by-name/lo/lounge-gtk-theme/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "monday15";
-    repo = pname;
+    repo = "lounge-gtk-theme";
     rev = version;
     sha256 = "0ima0aa5j296xn4y0d1zj6vcdrdpnihqdidj7bncxzgbnli1vazs";
   };
diff --git a/pkgs/by-name/lp/lparchive2epub/package.nix b/pkgs/by-name/lp/lparchive2epub/package.nix
index f2727f445cd6..b5f1058363ce 100644
--- a/pkgs/by-name/lp/lparchive2epub/package.nix
+++ b/pkgs/by-name/lp/lparchive2epub/package.nix
@@ -12,7 +12,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "Arwalk";
-    repo = pname;
+    repo = "lparchive2epub";
     tag = "v${version}";
     hash = "sha256-h1i/p14Zzzr0SK+OjcCnXpsVjJl7mrbeLJ5JlnA0wPU=";
   };
diff --git a/pkgs/by-name/ls/lshw/package.nix b/pkgs/by-name/ls/lshw/package.nix
index 2e3a8cedc670..b0ed05e9f07b 100644
--- a/pkgs/by-name/ls/lshw/package.nix
+++ b/pkgs/by-name/ls/lshw/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "lyonel";
-    repo = pname;
+    repo = "lshw";
     rev = "B.${version}";
     hash = "sha256-4etC7ymMgn1Q4f98DNASv8vn0AT55dYPdacZo6GRDw0=";
   };
diff --git a/pkgs/by-name/lu/lucky-commit/package.nix b/pkgs/by-name/lu/lucky-commit/package.nix
index 0eddf327835f..2484002725f8 100644
--- a/pkgs/by-name/lu/lucky-commit/package.nix
+++ b/pkgs/by-name/lu/lucky-commit/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "not-an-aardvark";
-    repo = pname;
+    repo = "lucky-commit";
     rev = "v${version}";
     sha256 = "sha256-pghc2lTI81/z1bPJ6P2bFPyZkM8pko0V7lqv9rUUxWM=";
   };
diff --git a/pkgs/by-name/lu/ludtwig/package.nix b/pkgs/by-name/lu/ludtwig/package.nix
index b3ebe3f092e0..4c4995f26707 100644
--- a/pkgs/by-name/lu/ludtwig/package.nix
+++ b/pkgs/by-name/lu/ludtwig/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "MalteJanz";
-    repo = pname;
+    repo = "ludtwig";
     rev = "v${version}";
     hash = "sha256-3E1W6AlGQ9AhMzLvTV5KBjlKiWXyi7rFwHOdU3CIp60=";
   };
diff --git a/pkgs/by-name/lx/lxc/package.nix b/pkgs/by-name/lx/lxc/package.nix
index 5c14f5f64172..14b13e73527d 100644
--- a/pkgs/by-name/lx/lxc/package.nix
+++ b/pkgs/by-name/lx/lxc/package.nix
@@ -17,6 +17,7 @@
   pkg-config,
   systemd,
 
+  fetchpatch,
   nix-update-script,
 }:
 
@@ -57,6 +58,13 @@ stdenv.mkDerivation (finalAttrs: {
     # Fix hardcoded path of lxc-user-nic
     # This is needed to use unprivileged containers
     ./user-nic.diff
+
+    # Fixes https://github.com/zabbly/incus/issues/81
+    (fetchpatch {
+      name = "4536.patch";
+      url = "https://patch-diff.githubusercontent.com/raw/lxc/lxc/pull/4536.patch";
+      hash = "sha256-yEqK9deO2MhfPROPfBw44Z752Mc5bR8DBKl1KrGC+5c=";
+    })
   ];
 
   mesonFlags = [
diff --git a/pkgs/by-name/ly/lychee/package.nix b/pkgs/by-name/ly/lychee/package.nix
index 50d841d2a8a0..2aadf0989b47 100644
--- a/pkgs/by-name/ly/lychee/package.nix
+++ b/pkgs/by-name/ly/lychee/package.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "lycheeverse";
-    repo = pname;
+    repo = "lychee";
     rev = "lychee-v${version}";
     hash = "sha256-aT7kVN2KM90M193h4Xng6+v69roW0J4GLd+29BzALhI=";
   };
diff --git a/pkgs/by-name/ly/lynis/package.nix b/pkgs/by-name/ly/lynis/package.nix
index 30584284c6c8..d58d24cfc514 100644
--- a/pkgs/by-name/ly/lynis/package.nix
+++ b/pkgs/by-name/ly/lynis/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "CISOfy";
-    repo = pname;
+    repo = "lynis";
     rev = version;
     sha256 = "sha256-OnEEdJGU7ma6f7aA6ihgixHWZGZDmx7nzqmJH3p+ijk=";
   };
diff --git a/pkgs/by-name/ma/macchina/package.nix b/pkgs/by-name/ma/macchina/package.nix
index 03d34ca4257f..f6005277dff6 100644
--- a/pkgs/by-name/ma/macchina/package.nix
+++ b/pkgs/by-name/ma/macchina/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "Macchina-CLI";
-    repo = pname;
+    repo = "macchina";
     rev = "v${version}";
     hash = "sha256-GZO9xGc3KGdq2WdA10m/XV8cNAlQjUZFUVu1CzidJ5c=";
   };
diff --git a/pkgs/by-name/ma/mackerel-agent/package.nix b/pkgs/by-name/ma/mackerel-agent/package.nix
index 7c2c798072b7..35c9b5460f4d 100644
--- a/pkgs/by-name/ma/mackerel-agent/package.nix
+++ b/pkgs/by-name/ma/mackerel-agent/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "mackerelio";
-    repo = pname;
+    repo = "mackerel-agent";
     rev = "v${version}";
     sha256 = "sha256-wTL+zxa0uaRT8cP2P+iYW6qC8RS5g8wSpvsa01iSUXA=";
   };
diff --git a/pkgs/by-name/ma/mage/package.nix b/pkgs/by-name/ma/mage/package.nix
index a4217149813f..bf4f016dc8b7 100644
--- a/pkgs/by-name/ma/mage/package.nix
+++ b/pkgs/by-name/ma/mage/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "magefile";
-    repo = pname;
+    repo = "mage";
     rev = "v${version}";
     sha256 = "sha256-aZPv3+F4VMiThjR0nFP+mKQLI9zKj2jaOawClROnT34=";
   };
diff --git a/pkgs/by-name/ma/majima/package.nix b/pkgs/by-name/ma/majima/package.nix
index 69b3d37a5e5a..67ef20d5c259 100644
--- a/pkgs/by-name/ma/majima/package.nix
+++ b/pkgs/by-name/ma/majima/package.nix
@@ -5,17 +5,17 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "majima";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromSourcehut {
-    owner = "~cucumber-zoom";
+    owner = "~wq";
     repo = "majima";
-    rev = "0f32dceeaf09c082cf33ab31b40d3bfc45aaa6f8";
-    hash = "sha256-P5E0Wiy3mNPRCQ/bsIW4fG7LnPSPRXmW7pnbgl0/lBQ=";
+    rev = "630427fcd158ccbaafe8bc3f7368fa8577b03548";
+    hash = "sha256-znlJY/U7H+BvBM7n4IqE5x9ek1/QVxYkptsAnODz/Q0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-bb3rg7vWRBSOPf0LM7avQQNlMjLiLFRtrGIfJbFWtHI=";
+  cargoHash = "sha256-I0txA41rmTZ3AHllRVsJzmZXbrm5+GSdd08EatxKCzk=";
 
   meta = {
     description = "Generate random usernames quickly and in various formats";
diff --git a/pkgs/by-name/ma/mangal/package.nix b/pkgs/by-name/ma/mangal/package.nix
index 332c1d33ec25..e06d33506753 100644
--- a/pkgs/by-name/ma/mangal/package.nix
+++ b/pkgs/by-name/ma/mangal/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "metafates";
-    repo = pname;
+    repo = "mangal";
     rev = "v${version}";
     hash = "sha256-nbJdePlzZFM2ihbvFIMKyYZ9C0uKjU3TE5VLduLvtKE=";
   };
diff --git a/pkgs/by-name/ma/mapcidr/package.nix b/pkgs/by-name/ma/mapcidr/package.nix
index aaad9a46dd70..3ca5dd65ca98 100644
--- a/pkgs/by-name/ma/mapcidr/package.nix
+++ b/pkgs/by-name/ma/mapcidr/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
-    repo = pname;
+    repo = "mapcidr";
     tag = "v${version}";
     hash = "sha256-/bZ6LimkdbR7nG7XcetNshk0KXw1FGbuaTXP+DH7hQg=";
   };
diff --git a/pkgs/by-name/ma/mari0/package.nix b/pkgs/by-name/ma/mari0/package.nix
index deb7d959bc14..385df03910ee 100644
--- a/pkgs/by-name/ma/mari0/package.nix
+++ b/pkgs/by-name/ma/mari0/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "Stabyourself";
-    repo = pname;
+    repo = "mari0";
     rev = version;
     sha256 = "1zqaq4w599scsjvy1rsb21fd2r8j3srx9vym4ir9bh666dp36gxa";
   };
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   desktopItems = [
     (makeDesktopItem {
       name = "mari0";
-      exec = pname;
+      exec = "mari0";
       comment = "Crossover between Super Mario Bros. and Portal";
       desktopName = "mari0";
       genericName = "mari0";
diff --git a/pkgs/by-name/ma/materia-theme/package.nix b/pkgs/by-name/ma/materia-theme/package.nix
index 24c0e7a42ebc..b5363da9f2b4 100644
--- a/pkgs/by-name/ma/materia-theme/package.nix
+++ b/pkgs/by-name/ma/materia-theme/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "nana-4";
-    repo = pname;
+    repo = "materia-theme";
     rev = "v${version}";
     sha256 = "1fsicmcni70jkl4jb3fvh7yv0v9jhb8nwjzdq8vfwn256qyk0xvl";
   };
diff --git a/pkgs/by-name/ma/matrix-brandy/no-lrt.patch b/pkgs/by-name/ma/matrix-brandy/no-lrt.patch
new file mode 100644
index 000000000000..7f42553852a9
--- /dev/null
+++ b/pkgs/by-name/ma/matrix-brandy/no-lrt.patch
@@ -0,0 +1,13 @@
+diff --git a/makefile b/makefile
+index d89cee1..37c1ac5 100644
+--- a/makefile
++++ b/makefile
+@@ -13,7 +13,7 @@ CFLAGS = -O3 -fPIE $(shell sdl-config --cflags) -DUSE_SDL -DDEFAULT_IGNORE -Wall
+ 
+ LDFLAGS +=
+ 
+-LIBS = -lm $(shell sdl-config --libs) -ldl -pthread -lrt -lX11
++LIBS = -lm $(shell sdl-config --libs) -ldl -pthread -lX11
+ 
+ SRCDIR = src
+ 
diff --git a/pkgs/by-name/ma/matrix-brandy/package.nix b/pkgs/by-name/ma/matrix-brandy/package.nix
index bf9d518783c3..2adc72a2e897 100644
--- a/pkgs/by-name/ma/matrix-brandy/package.nix
+++ b/pkgs/by-name/ma/matrix-brandy/package.nix
@@ -3,20 +3,28 @@
   stdenv,
   fetchFromGitHub,
   libX11,
+  nix-update-script,
   SDL,
 }:
 
 stdenv.mkDerivation rec {
   pname = "matrix-brandy";
-  version = "1.23.3";
+  version = "1.23.5";
 
   src = fetchFromGitHub {
     owner = "stardot";
     repo = "MatrixBrandy";
     rev = "V${version}";
-    hash = "sha256-jw5SxCQ2flvCjO/JO3BHpnpt31wBsBxDkVH7uwVxTS0=";
+    hash = "sha256-sMgYgV4/vV1x5xSICXRpW6K8uCdVlJrS7iEg6XzQRo8=";
   };
 
+  patches = lib.optionals stdenv.isDarwin [ ./no-lrt.patch ];
+
+  makeFlags = lib.optionals stdenv.isDarwin [
+    "CC=cc"
+    "LD=clang"
+  ];
+
   buildInputs = [
     libX11
     SDL
@@ -27,12 +35,14 @@ stdenv.mkDerivation rec {
     cp brandy $out/bin
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     homepage = "http://brandy.matrixnetwork.co.uk/";
     description = "Matrix Brandy BASIC VI for Linux, Windows, MacOSX";
     mainProgram = "brandy";
     license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ fiq ];
   };
 }
diff --git a/pkgs/by-name/ma/matrix-corporal/package.nix b/pkgs/by-name/ma/matrix-corporal/package.nix
index e15c4657a2fa..f37b3342dad0 100644
--- a/pkgs/by-name/ma/matrix-corporal/package.nix
+++ b/pkgs/by-name/ma/matrix-corporal/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "devture";
-    repo = pname;
+    repo = "matrix-corporal";
     rev = version;
     sha256 = "sha256-KSKPTbF1hhzLyD+iL4+hW9EuV+xFYzSzHu1DSGXWm90=";
   };
diff --git a/pkgs/by-name/ma/matrix-dl/package.nix b/pkgs/by-name/ma/matrix-dl/package.nix
index 83f61c4b92ce..21d7ed670403 100644
--- a/pkgs/by-name/ma/matrix-dl/package.nix
+++ b/pkgs/by-name/ma/matrix-dl/package.nix
@@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "rubo77";
-    repo = pname;
+    repo = "matrix-dl";
     rev = "b1a86d1421f39ee327284e1023f09dc165e3c8a5";
     sha256 = "1l8nh8z7kz24v0wcy3ll3w6in2yxwa1yz8lyc3x0blz37d8ss4ql";
   };
diff --git a/pkgs/by-name/ma/mattermost/tests.nix b/pkgs/by-name/ma/mattermost/tests.nix
index 84452edb54ba..e6918b8bff70 100644
--- a/pkgs/by-name/ma/mattermost/tests.nix
+++ b/pkgs/by-name/ma/mattermost/tests.nix
@@ -140,6 +140,10 @@ mattermost.overrideAttrs (
         "TestElasticSearchIndexerJobIsEnabled"
         "TestElasticSearchIndexerPending"
 
+        # Broken in the sandbox.
+        "TestVersion"
+        "TestRunServerNoSystemd"
+
         # Appear to be broken.
         "TestSessionStore/MySQL/SessionGetWithDeviceId"
         "TestSessionStore/MySQL/GetMobileSessionMetadata"
diff --git a/pkgs/by-name/ma/mautrix-gmessages/package.nix b/pkgs/by-name/ma/mautrix-gmessages/package.nix
index d96347f9ec1f..ddbd96cbabcb 100644
--- a/pkgs/by-name/ma/mautrix-gmessages/package.nix
+++ b/pkgs/by-name/ma/mautrix-gmessages/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "mautrix-gmessages";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "gmessages";
     tag = "v${version}";
-    hash = "sha256-qpqFWQ4ZhgzG7SG6phW6LnS52Ve1S+Ky6YtjzfBkBmE=";
+    hash = "sha256-NzLHCVJaYl8q5meKZDy8St8J9c8oyASLLrXhWG7K+yw=";
   };
 
-  vendorHash = "sha256-Ps9I8WtTtrc3gSMxt4XZ/IUipZL2+kbgNfbY2PYFoa8=";
+  vendorHash = "sha256-+aX0r7IvsjXwmz5d6X0yzhG28mBYKvyDGoCbKMwkvk8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/mb/mbtileserver/package.nix b/pkgs/by-name/mb/mbtileserver/package.nix
index a8e19da119f4..0cfdf7ac133b 100644
--- a/pkgs/by-name/mb/mbtileserver/package.nix
+++ b/pkgs/by-name/mb/mbtileserver/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "consbio";
-    repo = pname;
+    repo = "mbtileserver";
     rev = "v${version}";
     sha256 = "sha256-RLaAhc24zdCFvpSN2LZXNyS1ygg9zCi4jEj8owdreWU=";
   };
diff --git a/pkgs/by-name/mc/mcat-unwrapped/package.nix b/pkgs/by-name/mc/mcat-unwrapped/package.nix
index 9732a5dfd3ab..12e941b39717 100644
--- a/pkgs/by-name/mc/mcat-unwrapped/package.nix
+++ b/pkgs/by-name/mc/mcat-unwrapped/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mcat-unwrapped";
-  version = "0.2.8";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "Skardyy";
     repo = "mcat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XvZBikp+Q/pe80eOTQj2rKZ14kXEUBjIroWsh8xmr8A=";
+    hash = "sha256-+uq2mqUpdpO5lStf4dj6nYpOff3LOL45fXB338mnlZ8=";
   };
 
-  cargoHash = "sha256-DIvKCPyqD82IgOqs7+fsAz3sj5IkXacxfZOttSEQ1aA=";
+  cargoHash = "sha256-m1TJ255jwQOEGqz22t5CmrW0zRyGqgQls84yGK5taWU=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/md/md-tangle/package.nix b/pkgs/by-name/md/md-tangle/package.nix
index 534a2d41a2e7..6a65a4e69fd6 100644
--- a/pkgs/by-name/md/md-tangle/package.nix
+++ b/pkgs/by-name/md/md-tangle/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonPackage rec {
   # By some strange reason, fetchPypi fails miserably
   src = fetchFromGitHub {
     owner = "joakimmj";
-    repo = pname;
+    repo = "md-tangle";
     tag = "v${version}";
     hash = "sha256-PkOKSsyY8uwS4mhl0lB+KGeUvXfEc7PUDHZapHMYv4c=";
   };
diff --git a/pkgs/by-name/md/mdbook-linkcheck/package.nix b/pkgs/by-name/md/mdbook-linkcheck/package.nix
index 498cb0f85582..113c1a77a400 100644
--- a/pkgs/by-name/md/mdbook-linkcheck/package.nix
+++ b/pkgs/by-name/md/mdbook-linkcheck/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "Michael-F-Bryan";
-    repo = pname;
+    repo = "mdbook-linkcheck";
     rev = "v${version}";
     sha256 = "sha256-ZbraChBHuKAcUA62EVHZ1RygIotNEEGv24nhSPAEj00=";
   };
diff --git a/pkgs/by-name/md/mdhtml/package.nix b/pkgs/by-name/md/mdhtml/package.nix
index 5c58990b162f..9051cd55fd3b 100644
--- a/pkgs/by-name/md/mdhtml/package.nix
+++ b/pkgs/by-name/md/mdhtml/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "Tomkoid";
-    repo = pname;
+    repo = "mdhtml";
     rev = version;
     hash = "sha256-Fv5XpWA2ebqXdA+46gZQouuZ3XxH4WDj/W6xJ0ETg8E=";
   };
diff --git a/pkgs/by-name/md/mdr/package.nix b/pkgs/by-name/md/mdr/package.nix
index f0b2d4fa9114..79aa9c543817 100644
--- a/pkgs/by-name/md/mdr/package.nix
+++ b/pkgs/by-name/md/mdr/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "MichaelMure";
-    repo = pname;
+    repo = "mdr";
     rev = "v${version}";
     sha256 = "sha256-ibM3303pXnseAFP9qFTOzj0G/SxRPX+UeRfbJ+MCABk=";
   };
diff --git a/pkgs/by-name/me/me_cleaner/package.nix b/pkgs/by-name/me/me_cleaner/package.nix
index 6957173c7687..9019cecd7e04 100644
--- a/pkgs/by-name/me/me_cleaner/package.nix
+++ b/pkgs/by-name/me/me_cleaner/package.nix
@@ -10,7 +10,7 @@ python3.pkgs.buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "corna";
-    repo = pname;
+    repo = "me_cleaner";
     rev = "v${version}";
     sha256 = "1bdj2clm13ir441vn7sv860xsc5gh71ja5lc2wn0gggnff0adxj4";
   };
diff --git a/pkgs/by-name/me/mediamtx/package.nix b/pkgs/by-name/me/mediamtx/package.nix
index 5bd4506f7f75..ad98797bcc45 100644
--- a/pkgs/by-name/me/mediamtx/package.nix
+++ b/pkgs/by-name/me/mediamtx/package.nix
@@ -8,23 +8,23 @@
 
 let
   hlsJs = fetchurl {
-    url = "https://cdn.jsdelivr.net/npm/hls.js@v1.5.20/dist/hls.min.js";
-    hash = "sha256-0BbBIwSW7lnz9bAcFszkzAG1odPTV63sIAyQixMevkk=";
+    url = "https://cdn.jsdelivr.net/npm/hls.js@v1.6.2/dist/hls.min.js";
+    hash = "sha256-5lAT3DQ1tVo0tSV6fmWDWSbB9NVyCduomoENNQX08UM=";
   };
 in
 buildGoModule (finalAttrs: {
   pname = "mediamtx";
   # check for hls.js version updates in internal/servers/hls/hlsjsdownloader/VERSION
-  version = "1.12.2";
+  version = "1.12.3";
 
   src = fetchFromGitHub {
     owner = "bluenviron";
     repo = "mediamtx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-O3Iu9gvCiAVuoJw77MWPyCfuJVcw0E8YWcJBiJq+/Ms=";
+    hash = "sha256-2eTvRWFSR6sXnUJJPKvzQhSqbg1Unh8QuxmyixAw8Cc=";
   };
 
-  vendorHash = "sha256-0927IeFIC2rhApPVs5ZIvS3yoDN8Km3tHgrRXnP/wBc=";
+  vendorHash = "sha256-CdJS+RebJA6CpOo6YLlTpCXzE0eWSAnWzVXECvgMBvc=";
 
   postPatch = ''
     cp ${hlsJs} internal/servers/hls/hls.min.js
diff --git a/pkgs/by-name/me/melange/package.nix b/pkgs/by-name/me/melange/package.nix
index 7af30fb483be..a93346be1751 100644
--- a/pkgs/by-name/me/melange/package.nix
+++ b/pkgs/by-name/me/melange/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
-    repo = pname;
+    repo = "melange";
     rev = "v${version}";
     hash = "sha256-LlcPkxTeT1jD6PTj22Jn4T6kD8HBuw58LXhEdX5MDtk=";
     # populate values that require us to use git. By doing this in postFetch we
diff --git a/pkgs/by-name/me/melos/package.nix b/pkgs/by-name/me/melos/package.nix
index 4d9654af977c..a821d74fdb66 100644
--- a/pkgs/by-name/me/melos/package.nix
+++ b/pkgs/by-name/me/melos/package.nix
@@ -5,12 +5,12 @@
 }:
 let
   pname = "melos";
-  version = "6.2.0";
+  version = "6.3.2";
   src = fetchFromGitHub {
     owner = "invertase";
     repo = "melos";
     rev = "melos-v${version}";
-    hash = "sha256-00K/LwrwjvO4LnXM2PDooQMJ6sXcJy9FBErtEwoMZlM=";
+    hash = "sha256-hD4UlQPFugRqtOZecyT/6wV3vFocoQ6OO5w+SZsYdO0=";
   };
 in
 buildDartApplication {
diff --git a/pkgs/by-name/me/melos/pubspec.lock.json b/pkgs/by-name/me/melos/pubspec.lock.json
index 959553a3e607..3b04d9d91464 100644
--- a/pkgs/by-name/me/melos/pubspec.lock.json
+++ b/pkgs/by-name/me/melos/pubspec.lock.json
@@ -100,6 +100,16 @@
       "source": "hosted",
       "version": "1.3.1"
     },
+    "checked_yaml": {
+      "dependency": "transitive",
+      "description": {
+        "name": "checked_yaml",
+        "sha256": "feb6bed21949061731a7a75fc5d2aa727cf160b91af9a3e464c5e3a32e28b5ff",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.3"
+    },
     "cli_launcher": {
       "dependency": "direct main",
       "description": {
@@ -470,25 +480,15 @@
       "source": "hosted",
       "version": "0.4.0"
     },
-    "pubspec": {
+    "pubspec_parse": {
       "dependency": "direct main",
       "description": {
-        "name": "pubspec",
-        "sha256": "f534a50a2b4d48dc3bc0ec147c8bd7c304280fff23b153f3f11803c4d49d927e",
+        "name": "pubspec_parse",
+        "sha256": "81876843eb50dc2e1e5b151792c9a985c5ed2536914115ed04e9c8528f6647b0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.3.0"
-    },
-    "quiver": {
-      "dependency": "transitive",
-      "description": {
-        "name": "quiver",
-        "sha256": "b1c1ac5ce6688d77f65f3375a9abb9319b3cb32486bdc7a1e0fdf004d7ba4e47",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "3.2.1"
+      "version": "1.4.0"
     },
     "shelf": {
       "dependency": "transitive",
@@ -650,16 +650,6 @@
       "source": "hosted",
       "version": "1.3.2"
     },
-    "uri": {
-      "dependency": "transitive",
-      "description": {
-        "name": "uri",
-        "sha256": "889eea21e953187c6099802b7b4cf5219ba8f3518f604a1033064d45b1b8268a",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "1.0.0"
-    },
     "vm_service": {
       "dependency": "transitive",
       "description": {
@@ -745,5 +735,3 @@
     "dart": ">=3.3.0 <4.0.0"
   }
 }
-
-
diff --git a/pkgs/by-name/me/menyoki/package.nix b/pkgs/by-name/me/menyoki/package.nix
index 34f657bf71e9..54c629ade471 100644
--- a/pkgs/by-name/me/menyoki/package.nix
+++ b/pkgs/by-name/me/menyoki/package.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "orhun";
-    repo = pname;
+    repo = "menyoki";
     rev = "v${version}";
     sha256 = "sha256-owP3G1Rygraifdc4iPURQ1Es0msNhYZIlfrtj0CSU6Y=";
   };
diff --git a/pkgs/by-name/me/meowlnir/package.nix b/pkgs/by-name/me/meowlnir/package.nix
index 13c8d3d0c8ca..6c9fda7e91ba 100644
--- a/pkgs/by-name/me/meowlnir/package.nix
+++ b/pkgs/by-name/me/meowlnir/package.nix
@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "meowlnir";
-  version = "0.3.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "maunium";
     repo = "meowlnir";
     tag = "v${version}";
-    hash = "sha256-ig803e4onU3E4Nj5aJo2+QfwZt12iKIJ7fS/BjXsojc=";
+    hash = "sha256-1YuSXKRiMUCRbxGIDOQKGKK7CxM3VD0LLEeULQJ/zRo=";
   };
 
   buildInputs = [ olm ];
 
-  vendorHash = "sha256-+P7tlpGTo9N+uSn22uAlzyB36hu3re+KfOe3a/uzLZE=";
+  vendorHash = "sha256-g0be4ftBRV6Ver1kULfhnVBAF+iL3+/4e25sozpJ7+s=";
 
   doCheck = true;
   doInstallCheck = true;
diff --git a/pkgs/by-name/me/mesos-dns/package.nix b/pkgs/by-name/me/mesos-dns/package.nix
index 1ae38d4ac4cb..d70fa1793cce 100644
--- a/pkgs/by-name/me/mesos-dns/package.nix
+++ b/pkgs/by-name/me/mesos-dns/package.nix
@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "mesos-dns";
   version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "m3scluster";
     repo = "mesos-dns";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-/zcjQ2AxZ17rAxrRmfztj5gH1pu2QswJgaCE022FieU=";
   };
 
@@ -26,10 +26,10 @@ buildGoModule rec {
 
   meta = {
     homepage = "https://m3scluster.github.io/mesos-dns/";
-    changelog = "https://github.com/m3scluster/mesos-dns/releases/tag/v${version}";
+    changelog = "https://github.com/m3scluster/mesos-dns/releases/tag/v${finalAttrs.version}";
     description = "DNS-based service discovery for Mesos";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ aaronjheng ];
     mainProgram = "mesos-dns";
   };
-}
+})
diff --git a/pkgs/by-name/me/meteo/package.nix b/pkgs/by-name/me/meteo/package.nix
index bc24c52e249d..c7e6027a2ecf 100644
--- a/pkgs/by-name/me/meteo/package.nix
+++ b/pkgs/by-name/me/meteo/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitLab {
     owner = "bitseater";
-    repo = pname;
+    repo = "meteo";
     rev = version;
     hash = "sha256-hubKusrs0Hh8RryoEI29pnhTSNsIbtGMltlH4qoM6gE=";
   };
diff --git a/pkgs/by-name/mg/mgmt/package.nix b/pkgs/by-name/mg/mgmt/package.nix
index c574e8f2dd61..f0c11262d407 100644
--- a/pkgs/by-name/mg/mgmt/package.nix
+++ b/pkgs/by-name/mg/mgmt/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "purpleidea";
-    repo = pname;
+    repo = "mgmt";
     rev = "d8820fa1855668d9e0f7a7829d9dd0d122b2c5a9";
     hash = "sha256-jurZvEtiaTjWeDkmCJDIFlTzR5EVglfoDxkFgOilo8s=";
   };
@@ -50,7 +50,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X main.program=${pname}"
+    "-X main.program=mgmt"
     "-X main.version=${version}"
   ];
 
diff --git a/pkgs/by-name/mh/mhost/package.nix b/pkgs/by-name/mh/mhost/package.nix
index 436ac744cb4b..03a70bdcd2d8 100644
--- a/pkgs/by-name/mh/mhost/package.nix
+++ b/pkgs/by-name/mh/mhost/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "lukaspustina";
-    repo = pname;
+    repo = "mhost";
     rev = "v${version}";
     sha256 = "sha256-6jn9jOCh96d9y2l1OZ5hgxg7sYXPUFzJiiT95OR7lD0=";
   };
diff --git a/pkgs/by-name/mi/migra/package.nix b/pkgs/by-name/mi/migra/package.nix
index 48fa2a1e5c07..73ad73000298 100644
--- a/pkgs/by-name/mi/migra/package.nix
+++ b/pkgs/by-name/mi/migra/package.nix
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "djrobstep";
-    repo = pname;
+    repo = "migra";
     rev = version;
     hash = "sha256-LSCJA5Ym1LuV3EZl6gnl9jTHGc8A1LXmR1fj0ZZc+po=";
   };
diff --git a/pkgs/by-name/mi/mimir/package.nix b/pkgs/by-name/mi/mimir/package.nix
index c4b335ba16c0..354d77be9b5d 100644
--- a/pkgs/by-name/mi/mimir/package.nix
+++ b/pkgs/by-name/mi/mimir/package.nix
@@ -10,9 +10,9 @@ buildGoModule rec {
   version = "2.16.0";
 
   src = fetchFromGitHub {
-    rev = "${pname}-${version}";
+    rev = "mimir-${version}";
     owner = "grafana";
-    repo = pname;
+    repo = "mimir";
     hash = "sha256-75KHS+jIPEvcB7SHBBcBi5uycwY7XR4RNc1khNYVZFE=";
   };
 
diff --git a/pkgs/by-name/mi/minc_widgets/package.nix b/pkgs/by-name/mi/minc_widgets/package.nix
index 054af1323a82..535433ea41d1 100644
--- a/pkgs/by-name/mi/minc_widgets/package.nix
+++ b/pkgs/by-name/mi/minc_widgets/package.nix
@@ -11,13 +11,13 @@
   minc_tools,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "minc-widgets";
   version = "unstable-2016-04-20";
 
   src = fetchFromGitHub {
     owner = "BIC-MNI";
-    repo = pname;
+    repo = "minc-widgets";
     rev = "f08b643894c81a1a2e0fbfe595a17a42ba8906db";
     sha256 = "1b9g6lf37wpp211ikaji4rf74rl9xcmrlyqcw1zq3z12ji9y33bm";
   };
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://github.com/BIC-MNI/${pname}";
+    homepage = "https://github.com/BIC-MNI/minc-widgets";
     description = "Collection of Perl and shell scripts for processing MINC files";
     maintainers = with maintainers; [ bcdarwin ];
     platforms = platforms.unix;
diff --git a/pkgs/by-name/mi/minecraft-server-hibernation/package.nix b/pkgs/by-name/mi/minecraft-server-hibernation/package.nix
index e5279d2e3bf2..53269a87f573 100644
--- a/pkgs/by-name/mi/minecraft-server-hibernation/package.nix
+++ b/pkgs/by-name/mi/minecraft-server-hibernation/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "gekware";
-    repo = pname;
+    repo = "minecraft-server-hibernation";
     rev = "v${version}";
     hash = "sha256-b6LeqjIraIasHBpaVgy8esl4NV8rdBrfO7ewgeIocS8=";
   };
diff --git a/pkgs/by-name/mi/minetest-mapserver/package.nix b/pkgs/by-name/mi/minetest-mapserver/package.nix
index 5e9fb2aade10..46ab3f8b3254 100644
--- a/pkgs/by-name/mi/minetest-mapserver/package.nix
+++ b/pkgs/by-name/mi/minetest-mapserver/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "minetest-mapserver";
-  version = "4.9.3";
+  version = "4.9.4";
 
   src = fetchFromGitHub {
     owner = "minetest-mapserver";
     repo = "mapserver";
     rev = "v${version}";
-    hash = "sha256-6tDhfYG/zcFjGNCR6yir71FM/qFHK5p/3+q+P6V1a4c=";
+    hash = "sha256-YKJbqD0dtQGLXDRLOwLl6E5R36gftDD98+/XpTGwZSk=";
   };
 
-  vendorHash = "sha256-P3+M1ciRmFbOFnjy1+oWPhngPYFe/5o6Cs8pRlYNx2Q=";
+  vendorHash = "sha256-sPqwY3c/ehrrP6aeUyRUMqCpHqBErwIXUlgoX0P99/w=";
 
   meta = with lib; {
     description = "Realtime mapserver for minetest";
diff --git a/pkgs/by-name/mi/minicom/package.nix b/pkgs/by-name/mi/minicom/package.nix
index a4252e97065e..c6358136efd4 100644
--- a/pkgs/by-name/mi/minicom/package.nix
+++ b/pkgs/by-name/mi/minicom/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "minicom-team";
-    repo = pname;
+    repo = "minicom";
     rev = version;
     sha256 = "sha256-wC6VlMRwuhV1zQ26wNx7gijuze8E2CvnzpqOSIPzq2s=";
   };
diff --git a/pkgs/by-name/mi/miniflux/package.nix b/pkgs/by-name/mi/miniflux/package.nix
index 75397b7ecc80..3b8b68c3d549 100644
--- a/pkgs/by-name/mi/miniflux/package.nix
+++ b/pkgs/by-name/mi/miniflux/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "miniflux";
-  version = "2.2.8";
+  version = "2.2.9";
 
   src = fetchFromGitHub {
     owner = "miniflux";
     repo = "v2";
     tag = version;
-    hash = "sha256-AQ6HVRVlWt1D8fA4Z2FH7VIEKydDva7txwa/9Rfq0Ho=";
+    hash = "sha256-pp+QaofbU6Vkh2ifQLpUq+dbQTx/jX2JgM/9uji13tU=";
   };
 
-  vendorHash = "sha256-9I0/dyjanuV8oZystox9RY/gGx1SZuFRTghArv5aJ64=";
+  vendorHash = "sha256-6tgZdwr9g/VCnLUEmwAl8vzOzQu6SEGV9PhTp47eXds=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/mi/minify/package.nix b/pkgs/by-name/mi/minify/package.nix
index 2ade8acd9428..7332ee4a394d 100644
--- a/pkgs/by-name/mi/minify/package.nix
+++ b/pkgs/by-name/mi/minify/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "tdewolff";
-    repo = pname;
+    repo = "minify";
     rev = "v${version}";
     hash = "sha256-v0KLQlf2WhI18uanVtvWfX6/7s9ZtfPM5AGyEIHZf54=";
   };
diff --git a/pkgs/by-name/mi/minisat/package.nix b/pkgs/by-name/mi/minisat/package.nix
index 112a73e1df42..3aba039e6f18 100644
--- a/pkgs/by-name/mi/minisat/package.nix
+++ b/pkgs/by-name/mi/minisat/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "stp";
-    repo = pname;
+    repo = "minisat";
     rev = "releases/${version}";
     sha256 = "14vcbjnlia00lpyv2fhbmw3wbc9bk9h7bln9zpyc3nwiz5cbjz4a";
   };
diff --git a/pkgs/by-name/mi/mistral-rs/package.nix b/pkgs/by-name/mi/mistral-rs/package.nix
index 18d3eccf6e3f..a3c22e807014 100644
--- a/pkgs/by-name/mi/mistral-rs/package.nix
+++ b/pkgs/by-name/mi/mistral-rs/package.nix
@@ -60,7 +60,7 @@ let
       ))
     else
       cudaCapability;
-  cudaCapability' = lib.toInt (cudaPackages.flags.dropDot cudaCapabilityString);
+  cudaCapability' = lib.toInt (cudaPackages.flags.dropDots cudaCapabilityString);
 
   mklSupport =
     assert accelIsValid;
diff --git a/pkgs/by-name/mk/mkcert/package.nix b/pkgs/by-name/mk/mkcert/package.nix
index b918cb4da0fd..0252a7d758d8 100644
--- a/pkgs/by-name/mk/mkcert/package.nix
+++ b/pkgs/by-name/mk/mkcert/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "FiloSottile";
-    repo = pname;
+    repo = "mkcert";
     rev = "v${version}";
     sha256 = "sha256-FMAXjRL+kJ/hwGmaWBy8ecON+JCMgRytfpryeLWsSVc=";
   };
diff --git a/pkgs/by-name/mo/moar/package.nix b/pkgs/by-name/mo/moar/package.nix
index cbac530d7a6d..fd9eaaa73b9c 100644
--- a/pkgs/by-name/mo/moar/package.nix
+++ b/pkgs/by-name/mo/moar/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "walles";
-    repo = pname;
+    repo = "moar";
     rev = "v${version}";
     hash = "sha256-o3vPC8P3yu3i0B/+BsIOFWfS2cWNFNYz4Ae0Z8L2TvE=";
   };
diff --git a/pkgs/by-name/mo/mole/package.nix b/pkgs/by-name/mo/mole/package.nix
index 0665e0951c1b..b531ec44960a 100644
--- a/pkgs/by-name/mo/mole/package.nix
+++ b/pkgs/by-name/mo/mole/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "davrodpin";
-    repo = pname;
+    repo = "mole";
     rev = "v${version}";
     hash = "sha256-JwLiuw00g2h5uqNmaqAbal0KCY6LwF2fcL2MrB1HBIc=";
   };
diff --git a/pkgs/by-name/mo/mona-sans/package.nix b/pkgs/by-name/mo/mona-sans/package.nix
index bc41d2d58f28..c7942b3ef057 100644
--- a/pkgs/by-name/mo/mona-sans/package.nix
+++ b/pkgs/by-name/mo/mona-sans/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mona-sans";
-  version = "1.0.1";
+  version = "2.0";
 
   src = fetchFromGitHub {
     rev = "v${finalAttrs.version}";
     owner = "github";
     repo = "mona-sans";
-    sha256 = "sha256-XvqLFzlgIqx9aZH2SEAtwMiuWgUiDi/gHGSpfreUHuk=";
+    sha256 = "sha256-pFc6EUzf4FlA0LVdDEnFNr7m5V1FLc4jTAvtZdOslTg=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/mo/mongoaudit/package.nix b/pkgs/by-name/mo/mongoaudit/package.nix
index 931e6f5d1ea7..d95e810b01db 100644
--- a/pkgs/by-name/mo/mongoaudit/package.nix
+++ b/pkgs/by-name/mo/mongoaudit/package.nix
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "stampery";
-    repo = pname;
+    repo = "mongoaudit";
     rev = version;
     sha256 = "17k4vw5d3kr961axl49ywid4cf3n7zxvm885c4lv15w7s2al1425";
   };
diff --git a/pkgs/by-name/mo/monolith/package.nix b/pkgs/by-name/mo/monolith/package.nix
index 0b3fce941328..1a6d20d2a38e 100644
--- a/pkgs/by-name/mo/monolith/package.nix
+++ b/pkgs/by-name/mo/monolith/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "Y2Z";
-    repo = pname;
+    repo = "monolith";
     rev = "v${version}";
     hash = "sha256-7D/r9/uY1JcShKgfNUGVTn8P5kUAwUIa/xBbhpReeNw=";
   };
diff --git a/pkgs/by-name/mo/monosat/package.nix b/pkgs/by-name/mo/monosat/package.nix
index 9fa647f2c2bd..3d8159624586 100644
--- a/pkgs/by-name/mo/monosat/package.nix
+++ b/pkgs/by-name/mo/monosat/package.nix
@@ -24,7 +24,7 @@ let
 
   src = fetchFromGitHub {
     owner = "sambayless";
-    repo = pname;
+    repo = "monosat";
     inherit rev sha256;
   };
 
diff --git a/pkgs/by-name/mo/moshi/package.nix b/pkgs/by-name/mo/moshi/package.nix
index 94fd6af59326..f0e2b3db2235 100644
--- a/pkgs/by-name/mo/moshi/package.nix
+++ b/pkgs/by-name/mo/moshi/package.nix
@@ -38,7 +38,7 @@ let
       ))
     else
       cudaCapability;
-  cudaCapability' = lib.toInt (cudaPackages.flags.dropDot cudaCapabilityString);
+  cudaCapability' = lib.toInt (cudaPackages.flags.dropDots cudaCapabilityString);
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "moshi";
diff --git a/pkgs/by-name/mo/mozwire/package.nix b/pkgs/by-name/mo/mozwire/package.nix
index 081f399a73db..4cc6e1abd0b0 100644
--- a/pkgs/by-name/mo/mozwire/package.nix
+++ b/pkgs/by-name/mo/mozwire/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "NilsIrl";
-    repo = pname;
+    repo = "MozWire";
     rev = "v${version}";
     hash = "sha256-2i8C1XgfI3MXnwXZzY6n8tIcw45G9h3vZqRlFaVoLH0=";
   };
diff --git a/pkgs/by-name/mp/mpd-mpris/package.nix b/pkgs/by-name/mp/mpd-mpris/package.nix
index 8d7096eed503..c3daa6ae4f38 100644
--- a/pkgs/by-name/mp/mpd-mpris/package.nix
+++ b/pkgs/by-name/mp/mpd-mpris/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "natsukagami";
-    repo = pname;
+    repo = "mpd-mpris";
     rev = "v${version}";
     sha256 = "sha256-QxPkGWpCWiyEbChH9SHeD+SiV8k0c/G7MG/azksP3xU=";
   };
@@ -28,7 +28,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  subPackages = [ "cmd/${pname}" ];
+  subPackages = [ "cmd/mpd-mpris" ];
 
   postInstall = ''
     install -Dm644 mpd-mpris.service $out/lib/systemd/user/mpd-mpris.service
diff --git a/pkgs/by-name/mp/mpdris2/package.nix b/pkgs/by-name/mp/mpdris2/package.nix
index c9f6578efbca..77629454a09e 100644
--- a/pkgs/by-name/mp/mpdris2/package.nix
+++ b/pkgs/by-name/mp/mpdris2/package.nix
@@ -17,7 +17,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "eonpatapon";
-    repo = pname;
+    repo = "mpDris2";
     rev = version;
     sha256 = "sha256-1Y6K3z8afUXeKhZzeiaEF3yqU0Ef7qdAj9vAkRlD2p8=";
   };
diff --git a/pkgs/by-name/mp/mpls/package.nix b/pkgs/by-name/mp/mpls/package.nix
index 9498995027d8..0e9abac8f657 100644
--- a/pkgs/by-name/mp/mpls/package.nix
+++ b/pkgs/by-name/mp/mpls/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "mpls";
-  version = "0.15.0";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     owner = "mhersson";
     repo = "mpls";
     tag = "v${version}";
-    hash = "sha256-7uBhc4FRe9KxRloHJQoDb8JvKPcev2DuTftnMBnmiGs=";
+    hash = "sha256-UQIGg31OJ8vTqlj5JLYxOxg9oS0+PXPcdocAJbUgpzY=";
   };
 
-  vendorHash = "sha256-zEJBB5xJBJuLZQ/+yDyoFbkYXpqEkRXuIIhReBPKi+g=";
+  vendorHash = "sha256-n3DG3sR7HOQPQJW1t1qC94EKkDBgXpdmjUWtLzAE7kY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/mp/mpvpaper/package.nix b/pkgs/by-name/mp/mpvpaper/package.nix
index 69e25ab380e9..e2897d6558a0 100644
--- a/pkgs/by-name/mp/mpvpaper/package.nix
+++ b/pkgs/by-name/mp/mpvpaper/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "GhostNaN";
-    repo = pname;
+    repo = "mpvpaper";
     rev = version;
     sha256 = "sha256-JTlZSl8CZmWx7YTd0T58pwq10L1GKXNfAw0XlIsz7F8=";
   };
diff --git a/pkgs/by-name/mq/mqtt-benchmark/package.nix b/pkgs/by-name/mq/mqtt-benchmark/package.nix
index 6ed8032ee98d..b7dbca6aa693 100644
--- a/pkgs/by-name/mq/mqtt-benchmark/package.nix
+++ b/pkgs/by-name/mq/mqtt-benchmark/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "krylovsk";
-    repo = pname;
+    repo = "mqtt-benchmark";
     tag = "v${version}";
     hash = "sha256-gejLDtJ1geO4eDBapHjXgpc+M2TRGKcv5YzybmIyQSs=";
   };
diff --git a/pkgs/by-name/mu/muffin/package.nix b/pkgs/by-name/mu/muffin/package.nix
index 1550ae874f93..a6e5f521e004 100644
--- a/pkgs/by-name/mu/muffin/package.nix
+++ b/pkgs/by-name/mu/muffin/package.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "linuxmint";
-    repo = pname;
+    repo = "muffin";
     rev = version;
     hash = "sha256-cGC1yGft3uEqefm2DvZrMaROoZKYd6LNY0IJ+58f6vs=";
   };
diff --git a/pkgs/by-name/mu/mujmap/package.nix b/pkgs/by-name/mu/mujmap/package.nix
index bda3f618763f..7c60ec0b8764 100644
--- a/pkgs/by-name/mu/mujmap/package.nix
+++ b/pkgs/by-name/mu/mujmap/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "elizagamedev";
-    repo = pname;
+    repo = "mujmap";
     rev = "v${version}";
     sha256 = "sha256-Qb9fEPQrdn+Ek9bdOMfaPIxlGGpQ9RfQZOeeqoOf17E=";
   };
diff --git a/pkgs/by-name/mu/multus-cni/package.nix b/pkgs/by-name/mu/multus-cni/package.nix
index 6db149fca3f7..040accb1f5df 100644
--- a/pkgs/by-name/mu/multus-cni/package.nix
+++ b/pkgs/by-name/mu/multus-cni/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "k8snetworkplumbingwg";
-    repo = pname;
+    repo = "multus-cni";
     rev = "v${version}";
     sha256 = "sha256-Q6ACXOv1E3Ouki4ksdlUZFbWcDgo9xbCiTfEiVG5l18=";
   };
diff --git a/pkgs/by-name/mu/murex/package.nix b/pkgs/by-name/mu/murex/package.nix
index 9dc5478f7504..139b0203c991 100644
--- a/pkgs/by-name/mu/murex/package.nix
+++ b/pkgs/by-name/mu/murex/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "lmorg";
-    repo = pname;
+    repo = "murex";
     rev = "v${version}";
     sha256 = "sha256-czo2JCUwzENPuBBTaO4RYo7WRvepacaKElAj9DznFY0=";
   };
diff --git a/pkgs/by-name/mu/museeks/package.nix b/pkgs/by-name/mu/museeks/package.nix
index eb551c222a8b..86d0f0e85459 100644
--- a/pkgs/by-name/mu/museeks/package.nix
+++ b/pkgs/by-name/mu/museeks/package.nix
@@ -1,41 +1,60 @@
 {
   lib,
+  stdenv,
   fetchurl,
-  appimageTools,
+  dpkg,
+  autoPatchelfHook,
+  webkitgtk_4_1,
+  libsoup_3,
+  glib,
+  gtk3,
+  cairo,
+  dbus,
+  gdk-pixbuf,
+  nix-update-script,
 }:
 
-let
+stdenv.mkDerivation (finalAttrs: {
   pname = "museeks";
-  version = "0.13.1";
+  version = "0.20.9";
 
   src = fetchurl {
-    url = "https://github.com/martpie/museeks/releases/download/${version}/museeks-x86_64.AppImage";
-    hash = "sha256-LvunhCFmpv00TnXzWjp3kQUAhoKpmp6pqKgcaUqZV+o=";
+    url = "https://github.com/martpie/museeks/releases/download/${finalAttrs.version}/Museeks_${finalAttrs.version}_amd64.deb";
+    hash = "sha256-7jRgMpfQTJr3yW3YAPTnPSvtrqumScN3Tr7YXQX3Fi8=";
   };
 
-  appimageContents = appimageTools.extractType2 {
-    inherit pname version src;
-  };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
+  nativeBuildInputs = [
+    dpkg
+    autoPatchelfHook
+  ];
 
-  extraInstallCommands = ''
-    mkdir -p $out/share/${pname}
-    cp -a ${appimageContents}/{locales,resources} $out/share/${pname}
-    cp -a ${appimageContents}/usr/share/icons $out/share/
-    install -Dm 444 ${appimageContents}/${pname}.desktop -t $out/share/applications
+  buildInputs = [
+    dbus
+    webkitgtk_4_1
+    libsoup_3
+    gtk3
+    cairo
+    gdk-pixbuf
+    glib
+    (lib.getLib stdenv.cc.cc)
+  ];
 
-    substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace 'Exec=AppRun' 'Exec=${pname}'
+  installPhase = ''
+    runHook preInstall
+
+    cp -r usr $out
+
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Simple, clean and cross-platform music player";
     homepage = "https://github.com/martpie/museeks";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ zendo ];
+    maintainers = with lib.maintainers; [ zendo ];
     mainProgram = "museeks";
   };
-}
+})
diff --git a/pkgs/by-name/mu/muso/package.nix b/pkgs/by-name/mu/muso/package.nix
index 029d728a7305..e285f0273b81 100644
--- a/pkgs/by-name/mu/muso/package.nix
+++ b/pkgs/by-name/mu/muso/package.nix
@@ -7,13 +7,13 @@
   wrapGAppsHook3,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "muso";
   version = "unstable-2021-09-02";
 
   src = fetchFromGitHub {
     owner = "quebin31";
-    repo = pname;
+    repo = "muso";
     rev = "6dd1c6d3a82b21d4fb2606accf2f26179eb6eaf9";
     hash = "sha256-09DWUER0ZWQuwfE3sjov2GjJNI7coE3D3E5iUy9mlSE=";
   };
diff --git a/pkgs/by-name/mu/mutagen-compose/package.nix b/pkgs/by-name/mu/mutagen-compose/package.nix
index 5d412f3d3c09..73c85bbfd420 100644
--- a/pkgs/by-name/mu/mutagen-compose/package.nix
+++ b/pkgs/by-name/mu/mutagen-compose/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "mutagen-io";
-    repo = pname;
+    repo = "mutagen-compose";
     rev = "v${version}";
     hash = "sha256-MK/icz/d7wymUm0m3aq4bBR1ZmxFngPVp+iPC9ufluU=";
   };
diff --git a/pkgs/by-name/mu/mutagen/package.nix b/pkgs/by-name/mu/mutagen/package.nix
index 93d581bdf0f8..7f1177ad06b7 100644
--- a/pkgs/by-name/mu/mutagen/package.nix
+++ b/pkgs/by-name/mu/mutagen/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "mutagen-io";
-    repo = pname;
+    repo = "mutagen";
     rev = "v${version}";
     hash = "sha256-/UigWQMk+VDMGna/ixctU8MR7VNPpOTOGNUtuYx8DS0=";
   };
diff --git a/pkgs/by-name/mu/mutmut/package.nix b/pkgs/by-name/mu/mutmut/package.nix
index a7512adeaebd..caaa5438d9ab 100644
--- a/pkgs/by-name/mu/mutmut/package.nix
+++ b/pkgs/by-name/mu/mutmut/package.nix
@@ -9,7 +9,7 @@ python3Packages.buildPythonApplication rec {
   version = "3.2.0";
 
   src = fetchFromGitHub {
-    repo = pname;
+    repo = "mutmut";
     owner = "boxed";
     tag = version;
     hash = "sha256-+e2FmfpGtK401IW8LNqeHk0v8Hh5rF3LbZJkSOJ3yPY=";
diff --git a/pkgs/by-name/mu/muvm/package.nix b/pkgs/by-name/mu/muvm/package.nix
index 64ad1e8c4ca4..7b59f1052e20 100644
--- a/pkgs/by-name/mu/muvm/package.nix
+++ b/pkgs/by-name/mu/muvm/package.nix
@@ -55,7 +55,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "AsahiLinux";
-    repo = pname;
+    repo = "muvm";
     rev = "muvm-${version}";
     hash = "sha256-1XPhVEj7iqTxdWyYwNk6cbb9VRGuhpvvowYDPJb1cWU=";
   };
diff --git a/pkgs/by-name/mv/mvnd/package.nix b/pkgs/by-name/mv/mvnd/package.nix
index 473580df7738..59a8645d3a81 100644
--- a/pkgs/by-name/mv/mvnd/package.nix
+++ b/pkgs/by-name/mv/mvnd/package.nix
@@ -19,6 +19,7 @@ let
     x86_64-darwin = "darwin-amd64";
     x86_64-linux = "linux-amd64";
   };
+  inherit (platformMap.${stdenv.system}) os arch;
 in
 
 maven.buildMavenPackage rec {
@@ -30,10 +31,11 @@ maven.buildMavenPackage rec {
     rev = version;
     sha256 = "sha256-c1jD7m4cOdPWQEoaUMcNap2zvvX7H9VaWQv8JSgAnRU=";
   };
+  patches = [ ./patches/0001-update-groovy-for-compatibility-with-Java-24.patch ];
 
   # need graalvm at build-time for the `native-image` tool
   mvnJdk = graalvmPackages.graalvm-ce;
-  mvnHash = "sha256-Bx0XSnpHNxNX07uVPc18py9qbnG5b3b7J4vs44ty034=";
+  mvnHash = "sha256-/Ful6v3hfm+0aa0vBQhqMK6VE+93L3o7pwZ6wmeXzQY=";
 
   nativeBuildInputs = [
     graalvmPackages.graalvm-ce
@@ -101,7 +103,7 @@ maven.buildMavenPackage rec {
     description = "The Apache Maven Daemon";
     homepage = "https://maven.apache.org/";
     license = lib.licenses.asl20;
-    platforms = lib.platforms.unix;
+    platforms = builtins.attrNames platformMap;
     maintainers = with lib.maintainers; [ nathanregner ];
     mainProgram = "mvnd";
   };
diff --git a/pkgs/by-name/mv/mvnd/patches/0001-update-groovy-for-compatibility-with-Java-24.patch b/pkgs/by-name/mv/mvnd/patches/0001-update-groovy-for-compatibility-with-Java-24.patch
new file mode 100644
index 000000000000..8bbf9dbd41ab
--- /dev/null
+++ b/pkgs/by-name/mv/mvnd/patches/0001-update-groovy-for-compatibility-with-Java-24.patch
@@ -0,0 +1,34 @@
+From 4d92b26f6cfc7c5f164caf11c1d5325815058624 Mon Sep 17 00:00:00 2001
+From: Nathan Regner <nathanregner@gmail.com>
+Date: Fri, 16 May 2025 23:28:13 -0600
+Subject: [PATCH] build: update groovy for compatibility with Java 24
+
+---
+ pom.xml | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pom.xml b/pom.xml
+index c1cec38b..7534ffd5 100644
+--- a/pom.xml
++++ b/pom.xml
+@@ -80,7 +80,7 @@
+     <!-- cannot upgrade graalvm to 23.0.0 which requires JDK >= 20 -->
+     <graalvm.version>24.0.2</graalvm.version>
+     <graalvm.plugin.version>0.10.2</graalvm.plugin.version>
+-    <groovy.version>4.0.22</groovy.version>
++    <groovy.version>4.0.24</groovy.version>
+     <jakarta.inject.version>1.0</jakarta.inject.version>
+     <jline.version>3.26.3</jline.version>
+     <maven.version>3.9.9</maven.version>
+@@ -91,7 +91,7 @@
+ 
+     <!-- plugin versions a..z -->
+     <buildnumber-maven-plugin.version>3.2.0</buildnumber-maven-plugin.version>
+-    <groovy-maven-plugin.version>3.0.2</groovy-maven-plugin.version>
++    <groovy-maven-plugin.version>4.2.0</groovy-maven-plugin.version>
+     <mrm.version>1.6.0</mrm.version>
+     <junit-platform-launcher.version>1.10.3</junit-platform-launcher.version>
+     <takari-provisio.version>1.0.25</takari-provisio.version>
+-- 
+2.49.0
+
diff --git a/pkgs/by-name/my/mymcplus/package.nix b/pkgs/by-name/my/mymcplus/package.nix
index 4b64cd634fda..60b1a7136979 100644
--- a/pkgs/by-name/my/mymcplus/package.nix
+++ b/pkgs/by-name/my/mymcplus/package.nix
@@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromSourcehut {
     owner = "~thestr4ng3r";
-    repo = pname;
+    repo = "mymcplus";
     rev = "v${version}";
     sha256 = "sha256-GFReOgM8zi5oyePpJm5HxtizUVqqUUINTRwyG/LGWB8=";
   };
diff --git a/pkgs/by-name/my/mympd/package.nix b/pkgs/by-name/my/mympd/package.nix
index d04843e56c44..faeafc52ac60 100644
--- a/pkgs/by-name/my/mympd/package.nix
+++ b/pkgs/by-name/my/mympd/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "21.0.0";
+  version = "21.0.1";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-K86kOCJ9Fnf/ZvS11Tyf81mdKA9R5pgBz1XzDY4N/8E=";
+    sha256 = "sha256-A4wjnITpI9Cy5kIVljXvmnunsqJXFSi4CqBmlqVcqZM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/na/nanosaur/package.nix b/pkgs/by-name/na/nanosaur/package.nix
index 7230d3322a27..7617b0308783 100644
--- a/pkgs/by-name/na/nanosaur/package.nix
+++ b/pkgs/by-name/na/nanosaur/package.nix
@@ -9,13 +9,13 @@
   unstableGitUpdater,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "nanosaur";
   version = "1.4.4-unstable-2024-04-06";
 
   src = fetchFromGitHub {
     owner = "jorio";
-    repo = pname;
+    repo = "nanosaur";
     rev = "4f2612f81697a0852f63fa2ea1ac80892f8a5a9c";
     hash = "sha256-MQmlZbsQSREAIqKXyIIOF6Psa1rqY/iUsBHpeKGekBI=";
     fetchSubmodules = true;
diff --git a/pkgs/by-name/na/nanosaur2/package.nix b/pkgs/by-name/na/nanosaur2/package.nix
index 476524125e28..81dda4473f29 100644
--- a/pkgs/by-name/na/nanosaur2/package.nix
+++ b/pkgs/by-name/na/nanosaur2/package.nix
@@ -9,13 +9,13 @@
   unstableGitUpdater,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "nanosaur2";
   version = "2.1.0-unstable-2023-05-21";
 
   src = fetchFromGitHub {
     owner = "jorio";
-    repo = pname;
+    repo = "nanosaur2";
     rev = "72d93ed08148d81aa89bab511a9650d7b929d4c7";
     hash = "sha256-1AvM2KTQB9aUYB0e/7Y6h18yQvzsxMOgGkF9zPgTzFo=";
     fetchSubmodules = true;
diff --git a/pkgs/by-name/na/nap/package.nix b/pkgs/by-name/na/nap/package.nix
index 68d344d3a33f..323be8e97cb1 100644
--- a/pkgs/by-name/na/nap/package.nix
+++ b/pkgs/by-name/na/nap/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "maaslalani";
-    repo = pname;
+    repo = "nap";
     rev = "v${version}";
     sha256 = "0b3sz8zp1nwcjl02b3lli5yjc7vfay1ig6fs8bgxwz22imfx076p";
   };
diff --git a/pkgs/by-name/na/nasc/package.nix b/pkgs/by-name/na/nasc/package.nix
index 5a255668d75c..2083dce063ca 100644
--- a/pkgs/by-name/na/nasc/package.nix
+++ b/pkgs/by-name/na/nasc/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "parnold-x";
-    repo = pname;
+    repo = "nasc";
     rev = version;
     sha256 = "02b9a59a9fzsb6nn3ycwwbcbv04qfzm6x7csq2addpzx5wak6dd8";
     fetchSubmodules = true;
diff --git a/pkgs/by-name/na/nats-kafka/package.nix b/pkgs/by-name/na/nats-kafka/package.nix
index df63a9af602c..a7f2e54c2914 100644
--- a/pkgs/by-name/na/nats-kafka/package.nix
+++ b/pkgs/by-name/na/nats-kafka/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "nats-io";
-    repo = pname;
+    repo = "nats-kafka";
     rev = "v${version}";
     hash = "sha256-RboNlKpD+4mOx6iL6JpguR90y6Ux1x0twFcazIPj0w0=";
   };
diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index 41f5d202f377..06d81da7c492 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "nats-io";
-    repo = pname;
+    repo = "nats-server";
     rev = "v${version}";
     hash = "sha256-Z4EBXWUtBzW65ONvt94sKzVDHw8qVz2cR5qewUm5nXI=";
   };
diff --git a/pkgs/by-name/na/nats-streaming-server/package.nix b/pkgs/by-name/na/nats-streaming-server/package.nix
index 7431132ae47a..9f6da2be4195 100644
--- a/pkgs/by-name/na/nats-streaming-server/package.nix
+++ b/pkgs/by-name/na/nats-streaming-server/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "nats-io";
-    repo = pname;
+    repo = "nats-streaming-server";
     sha256 = "sha256-i5fNxeJQXiyy+9NOGT1X68u9Pztxvnnba64rxIgjbZc=";
   };
 
diff --git a/pkgs/by-name/na/nats-top/package.nix b/pkgs/by-name/na/nats-top/package.nix
index 56e671ec6d95..08a828613d09 100644
--- a/pkgs/by-name/na/nats-top/package.nix
+++ b/pkgs/by-name/na/nats-top/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "nats-io";
-    repo = pname;
+    repo = "nats-top";
     tag = "v${version}";
     hash = "sha256-NOU0U1hyP9FCSLK0ulf28cx1K0/KWKQd+t3KtaVqWWo=";
   };
diff --git a/pkgs/by-name/na/nautilus-open-any-terminal/package.nix b/pkgs/by-name/na/nautilus-open-any-terminal/package.nix
index 94f6cb402b1d..b5e0085740a8 100644
--- a/pkgs/by-name/na/nautilus-open-any-terminal/package.nix
+++ b/pkgs/by-name/na/nautilus-open-any-terminal/package.nix
@@ -21,7 +21,7 @@ python3.pkgs.buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "Stunkymonkey";
-    repo = pname;
+    repo = "nautilus-open-any-terminal";
     tag = version;
     hash = "sha256-oiyXDeunAgs3uCrqHKdTcOvXD4vmx8Z3uFutNYpGxtc=";
   };
diff --git a/pkgs/by-name/nc/ncgopher/package.nix b/pkgs/by-name/nc/ncgopher/package.nix
index 50deded81024..a4652d0c2f25 100644
--- a/pkgs/by-name/nc/ncgopher/package.nix
+++ b/pkgs/by-name/nc/ncgopher/package.nix
@@ -6,35 +6,40 @@
   ncurses6,
   openssl,
   sqlite,
+  perl,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ncgopher";
-  version = "0.5.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "jansc";
     repo = "ncgopher";
-    rev = "v${version}";
-    sha256 = "sha256-KrvTwcIeINIBkia6PTnKXp4jFd6GEMBh/xbn0Ot/wmE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9bwQgFZkwOV28qflWL7ZyUE3SLvPhf77sjomurqMK6E=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-QhkYyvoWMGtLH5HhpOJ3JsBIWeZN/CllcXwNW+iM3WI=";
+  cargoHash = "sha256-wfodxA1fvdsvWvmnzYmL4GzgdIiQbXuhGq/U9spM+0s=";
+
+  nativeBuildInputs = [
+    pkg-config
+    perl
+  ];
 
-  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     ncurses6
     openssl
     sqlite
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Gopher and gemini client for the modern internet";
     homepage = "https://github.com/jansc/ncgopher";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ shamilton ];
-    platforms = platforms.linux;
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ shamilton ];
+    platforms = lib.platforms.linux;
     mainProgram = "ncgopher";
   };
-}
+})
diff --git a/pkgs/by-name/nc/ncnn/package.nix b/pkgs/by-name/nc/ncnn/package.nix
index ed6f8616bafc..64fdee7449a9 100644
--- a/pkgs/by-name/nc/ncnn/package.nix
+++ b/pkgs/by-name/nc/ncnn/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "Tencent";
-    repo = pname;
+    repo = "ncnn";
     rev = version;
     hash = "sha256-XmIuXR/uxJbXaB0G+tS9I47Pke20qj8jI1vqnDDgrpE=";
   };
diff --git a/pkgs/by-name/ne/nebula/package.nix b/pkgs/by-name/ne/nebula/package.nix
index 79bb79f6ed24..c6adb5462402 100644
--- a/pkgs/by-name/ne/nebula/package.nix
+++ b/pkgs/by-name/ne/nebula/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "slackhq";
-    repo = pname;
+    repo = "nebula";
     tag = "v${version}";
     hash = "sha256-IJMmVKdgYCXCaRndlcoozFBr+RsUhzC1Eqo427K1k+o=";
   };
diff --git a/pkgs/by-name/ne/nemo-seahorse/package.nix b/pkgs/by-name/ne/nemo-seahorse/package.nix
index 8c8bd4396d72..6c829fadc151 100644
--- a/pkgs/by-name/ne/nemo-seahorse/package.nix
+++ b/pkgs/by-name/ne/nemo-seahorse/package.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
           libcryptui
         ];
 
-        services.xserver.desktopManager.gnome.extraGSettingsOverridePackages = with pkgs; [
+        services.desktopManager.gnome.extraGSettingsOverridePackages = with pkgs; [
           nemo
           gcr
           libcryptui
diff --git a/pkgs/by-name/ne/nemo/package.nix b/pkgs/by-name/ne/nemo/package.nix
index 9d93c359a3d1..d8bec61fdbd6 100644
--- a/pkgs/by-name/ne/nemo/package.nix
+++ b/pkgs/by-name/ne/nemo/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "linuxmint";
-    repo = pname;
+    repo = "nemo";
     rev = version;
     hash = "sha256-9JfCBC5YjfQadF7KzPgZ1yPkiSjmuEO1tfMU2BmJES8=";
   };
diff --git a/pkgs/by-name/ne/nerdctl/package.nix b/pkgs/by-name/ne/nerdctl/package.nix
index 9e69d6761fb1..e5258f41b30e 100644
--- a/pkgs/by-name/ne/nerdctl/package.nix
+++ b/pkgs/by-name/ne/nerdctl/package.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "containerd";
-    repo = pname;
+    repo = "nerdctl";
     rev = "v${version}";
     hash = "sha256-GHFs8QvLcXu+DZ851TCLI7EVc9wMS5fRC4TYBXzyv3Q=";
   };
diff --git a/pkgs/by-name/ne/netcoredbg/package.nix b/pkgs/by-name/ne/netcoredbg/package.nix
index f0e6f88abe98..fe5883c70264 100644
--- a/pkgs/by-name/ne/netcoredbg/package.nix
+++ b/pkgs/by-name/ne/netcoredbg/package.nix
@@ -29,7 +29,7 @@ let
 
   src = fetchFromGitHub {
     owner = "Samsung";
-    repo = pname;
+    repo = "netcoredbg";
     rev = version;
     inherit hash;
   };
diff --git a/pkgs/by-name/ne/netdiscover/package.nix b/pkgs/by-name/ne/netdiscover/package.nix
index cd508518ee1d..7c208f3b7379 100644
--- a/pkgs/by-name/ne/netdiscover/package.nix
+++ b/pkgs/by-name/ne/netdiscover/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "netdiscover-scanner";
-    repo = pname;
+    repo = "netdiscover";
     tag = version;
     hash = "sha256-I3t9GsgKFo/eJrqYzj8T2Epfi3SURicwRYPBK25uHEw=";
   };
diff --git a/pkgs/by-name/ne/nex/package.nix b/pkgs/by-name/ne/nex/package.nix
index e7487144b5c3..09536fea4662 100644
--- a/pkgs/by-name/ne/nex/package.nix
+++ b/pkgs/by-name/ne/nex/package.nix
@@ -5,13 +5,13 @@
 }:
 # upstream is pretty stale, but it still works, so until they merge module
 # support we have to use gopath: see blynn/nex#57
-buildGoModule rec {
+buildGoModule {
   pname = "nex";
   version = "0-unstable-2021-03-30";
 
   src = fetchFromGitHub {
     owner = "blynn";
-    repo = pname;
+    repo = "nex";
     rev = "1a3320dab988372f8910ccc838a6a7a45c8980ff";
     hash = "sha256-DtJkV380T2B5j0+u7lYZfbC0ej0udF4GW2lbRmmbjAM=";
   };
diff --git a/pkgs/by-name/ne/next-ls/package.nix b/pkgs/by-name/ne/next-ls/package.nix
index 6dd203a0857a..59ae21a50839 100644
--- a/pkgs/by-name/ne/next-ls/package.nix
+++ b/pkgs/by-name/ne/next-ls/package.nix
@@ -11,7 +11,7 @@ beamPackages.mixRelease rec {
 
   src = fetchFromGitHub {
     owner = "elixir-tools";
-    repo = pname;
+    repo = "next-ls";
     tag = "v${version}";
     hash = "sha256-2KzBOzrfoQQIqjEtYufvhT9bBibfEjNDiC+d3l5eaUc=";
   };
diff --git a/pkgs/by-name/ne/nextinspace/package.nix b/pkgs/by-name/ne/nextinspace/package.nix
index b6e27482ee59..6f0a5fcac2a7 100644
--- a/pkgs/by-name/ne/nextinspace/package.nix
+++ b/pkgs/by-name/ne/nextinspace/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "not-stirred";
-    repo = pname;
+    repo = "nextinspace";
     tag = "v${version}";
     hash = "sha256-CrhzCvIA3YAFsWvdemvK1RLMacsM5RtgMjLeiqz5MwY=";
   };
diff --git a/pkgs/by-name/nf/nfpm/package.nix b/pkgs/by-name/nf/nfpm/package.nix
index 89cc40e3e21c..9caf82dc8492 100644
--- a/pkgs/by-name/nf/nfpm/package.nix
+++ b/pkgs/by-name/nf/nfpm/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "goreleaser";
-    repo = pname;
+    repo = "nfpm";
     rev = "v${version}";
     hash = "sha256-uHtrxBlSlVBmpVqE645nRNQ3mL07Uj9YrmG/jAfuyyg=";
   };
diff --git a/pkgs/by-name/ng/nghttp3/package.nix b/pkgs/by-name/ng/nghttp3/package.nix
index 0b7e8b830d5f..4a2bcba514b0 100644
--- a/pkgs/by-name/ng/nghttp3/package.nix
+++ b/pkgs/by-name/ng/nghttp3/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
-    repo = pname;
+    repo = "nghttp3";
     rev = "v${version}";
     hash = "sha256-CTra8vmpIig8LX7RWqRzhWhX9yn0RnFrnV/kYPgZgJk=";
     fetchSubmodules = true;
diff --git a/pkgs/by-name/ng/ngrok/versions.json b/pkgs/by-name/ng/ngrok/versions.json
index 534f529f3337..8831f0240f5c 100644
--- a/pkgs/by-name/ng/ngrok/versions.json
+++ b/pkgs/by-name/ng/ngrok/versions.json
@@ -1,38 +1,38 @@
 {
   "linux-386": {
     "sys": "linux-386",
-    "url": "https://bin.equinox.io/a/7rWAoLaoN6E/ngrok-v3-3.19.1-linux-386",
-    "sha256": "ade3cb371e0420b4d314051f702029661ec051158892ae8de87b0dd3fb8c9ae2",
-    "version": "3.19.1"
+    "url": "https://bin.equinox.io/a/fK7zHbUXRW4/ngrok-v3-3.22.1-linux-386",
+    "sha256": "25d1317d5f2014b6ee8e27408256c96efb68e5ae855ae31ec78f39a16c6af2c9",
+    "version": "3.22.1"
   },
   "linux-amd64": {
     "sys": "linux-amd64",
-    "url": "https://bin.equinox.io/a/aNKWdiDQehF/ngrok-v3-3.19.1-linux-amd64",
-    "sha256": "eea9510a71beab13f50024c23938d00ba9cfe4a8b4840030b8432c8637b4427a",
-    "version": "3.19.1"
+    "url": "https://bin.equinox.io/a/jBvFVwnCxra/ngrok-v3-3.22.1-linux-amd64",
+    "sha256": "edf3b724fd9768c380257aec415ea0636f3e1e8d4f67318e3e1ad71c71fb7c3d",
+    "version": "3.22.1"
   },
   "linux-arm": {
     "sys": "linux-arm",
-    "url": "https://bin.equinox.io/a/fHwvcnrN4W1/ngrok-v3-3.19.1-linux-arm",
-    "sha256": "ff1260e987641b0b280e5da3004d020093745a7586ecca65e1025bc3738d55d9",
-    "version": "3.19.1"
+    "url": "https://bin.equinox.io/a/3nCe4mzMEnu/ngrok-v3-3.22.1-linux-arm",
+    "sha256": "ef9e6d0796d9e73e3811a6b45f40dc534b2bafdf2c53e9d837d633417916bf0e",
+    "version": "3.22.1"
   },
   "linux-arm64": {
     "sys": "linux-arm64",
-    "url": "https://bin.equinox.io/a/ckBcN6JRV3s/ngrok-v3-3.19.1-linux-arm64",
-    "sha256": "1f8eec521c00eece4a4a15750927dc492f1243e34598868b15996940ab2bed5b",
-    "version": "3.19.1"
+    "url": "https://bin.equinox.io/a/7qiGrRXJ1od/ngrok-v3-3.22.1-linux-arm64",
+    "sha256": "ef154e04bbc0d48a28f387c20ccf7a57d38485fbdad2c7e46c04749cd79e42b5",
+    "version": "3.22.1"
   },
   "darwin-amd64": {
     "sys": "darwin-amd64",
-    "url": "https://bin.equinox.io/a/yubNbWvsvB/ngrok-v3-3.19.1-darwin-amd64",
-    "sha256": "4e19fee94598a74164516a8b439742bd8bee8844bfea4e3f41ba33b761323583",
-    "version": "3.19.1"
+    "url": "https://bin.equinox.io/a/bCPsqUE6DvJ/ngrok-v3-3.22.1-darwin-amd64",
+    "sha256": "7b2fb1bb04a4e18756ff59903bc5dc06a99a3426713058259f5359965a699b70",
+    "version": "3.22.1"
   },
   "darwin-arm64": {
     "sys": "darwin-arm64",
-    "url": "https://bin.equinox.io/a/iv6WKkDK2i5/ngrok-v3-3.19.1-darwin-arm64",
-    "sha256": "1da4acdf28b7c64ded056d29a2f3bb452481b4112a04f520f33fcead8794e2a1",
-    "version": "3.19.1"
+    "url": "https://bin.equinox.io/a/4XSXTVcG6uw/ngrok-v3-3.22.1-darwin-arm64",
+    "sha256": "7911865275673426fc8bc24afbbe079a3047e61300ffe622b6e6214d4da85786",
+    "version": "3.22.1"
   }
 }
diff --git a/pkgs/by-name/nh/nh/package.nix b/pkgs/by-name/nh/nh/package.nix
index 83a6d04ed5f9..85e860a9bbde 100644
--- a/pkgs/by-name/nh/nh/package.nix
+++ b/pkgs/by-name/nh/nh/package.nix
@@ -18,13 +18,13 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nh";
-  version = "4.0.3";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BCD0tfDNlQHFM75THRtXM3GegMg/KbREsYllg7Az9ao=";
+    hash = "sha256-OiuhBrJe1AyVxC+AV4HMJ+vhDvUfCyLpBmj+Fy7MDtM=";
   };
 
   strictDeps = true;
@@ -34,15 +34,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
     makeBinaryWrapper
   ];
 
-  preFixup = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
     let
       emulator = stdenv.hostPlatform.emulator buildPackages;
     in
     ''
       mkdir completions
-      ${emulator} $out/bin/nh completions bash > completions/nh.bash
-      ${emulator} $out/bin/nh completions zsh > completions/nh.zsh
-      ${emulator} $out/bin/nh completions fish > completions/nh.fish
+
+      for shell in bash zsh fish; do
+        NH_NO_CHECKS=1 ${emulator} $out/bin/nh completions $shell > completions/nh.$shell
+      done
 
       installShellCompletion completions/*
     ''
@@ -54,10 +55,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-cNYPxM2DOLdyq0YcZ0S/WIa3gAx7aTzPp7Zhbtu4PKg=";
+  cargoHash = "sha256-/tbmzGUd1b4oa+29+eFdkE4l8vxMoIdHx40YgErY9pY=";
 
   passthru.updateScript = nix-update-script { };
 
+  env.NH_REV = finalAttrs.src.tag;
+
   meta = {
     changelog = "https://github.com/nix-community/nh/blob/${finalAttrs.version}/CHANGELOG.md";
     description = "Yet another nix cli helper";
diff --git a/pkgs/by-name/nh/nhentai/package.nix b/pkgs/by-name/nh/nhentai/package.nix
index 29a9498b2548..5a805481532c 100644
--- a/pkgs/by-name/nh/nhentai/package.nix
+++ b/pkgs/by-name/nh/nhentai/package.nix
@@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "RicterZ";
-    repo = pname;
+    repo = "nhentai";
     rev = version;
     hash = "sha256-SjWIctAyczjYGP4buXQBA/RcrdikMSuSBtfhORNmXMc=";
   };
diff --git a/pkgs/by-name/ni/nimbo/package.nix b/pkgs/by-name/ni/nimbo/package.nix
index 151393c804b4..cc0a5ac020f6 100644
--- a/pkgs/by-name/ni/nimbo/package.nix
+++ b/pkgs/by-name/ni/nimbo/package.nix
@@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "nimbo-sh";
-    repo = pname;
+    repo = "nimbo";
     rev = "v${version}";
     sha256 = "YC5T02Sw22Uczufbyts8l99oCQW4lPq0gPMRXCoKsvw=";
   };
diff --git a/pkgs/by-name/ni/nix-bisect/package.nix b/pkgs/by-name/ni/nix-bisect/package.nix
index 10232985c27d..421b2e035a9f 100644
--- a/pkgs/by-name/ni/nix-bisect/package.nix
+++ b/pkgs/by-name/ni/nix-bisect/package.nix
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication {
 
   src = fetchFromGitHub {
     owner = "timokau";
-    repo = pname;
+    repo = "nix-bisect";
     rev = "4f26082fec0817acbfa8cc6ca4c25caaf77ddcd2";
     hash = "sha256-zyeE1jYo/9NEG8fB4gQBAR01siP4tyLvjjHN1yUS4Ug=";
   };
diff --git a/pkgs/by-name/ni/nix-fast-build/package.nix b/pkgs/by-name/ni/nix-fast-build/package.nix
index 2c4e485d8d4b..0996d4a98b41 100644
--- a/pkgs/by-name/ni/nix-fast-build/package.nix
+++ b/pkgs/by-name/ni/nix-fast-build/package.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nix-fast-build";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "nix-fast-build";
     rev = "refs/tags/${version}";
-    hash = "sha256-HkaJeIFgxncLm8MC1BaWRTkge9b1/+mjPcbzXTRshoM=";
+    hash = "sha256-lOouOgusUU3x97wClX8+WdbzpneMiRTdCqDSxGc/RlU=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/ni/nixfmt-tree/package.nix b/pkgs/by-name/ni/nixfmt-tree/package.nix
index f9a7991544ef..a36a449b3449 100644
--- a/pkgs/by-name/ni/nixfmt-tree/package.nix
+++ b/pkgs/by-name/ni/nixfmt-tree/package.nix
@@ -4,6 +4,8 @@
   treefmt,
   nixfmt-rfc-style,
   nixfmt-tree,
+  git,
+  writableTmpDirAsHomeHook,
 
   settings ? { },
   runtimeInputs ? [ ],
@@ -30,9 +32,6 @@ let
         # The default is warn, which would be too annoying for people who just care about Nix
         on-unmatched = lib.mkOptionDefault "info";
 
-        # Assume the tree is a Git repository, will fail if it's not
-        tree-root-file = lib.mkOptionDefault ".git/index";
-
         # NOTE: The `mkIf` condition should not be needed once `runtimePackages` is removed.
         formatter.nixfmt = lib.mkIf (lib.any isNixfmt allRuntimeInputs) {
           command = "nixfmt";
@@ -102,9 +101,6 @@ treefmtWithConfig.overrideAttrs {
           # Log level for files treefmt won't format
           on-unmatched = "info";
 
-          # Assume the tree is a Git repository, will fail if it's not
-          tree-root-file = ".git/index";
-
           # Configure nixfmt for .nix files
           formatter.nixfmt = {
             command = "nixfmt";
@@ -122,49 +118,63 @@ treefmtWithConfig.overrideAttrs {
     platforms = lib.platforms.all;
   };
 
-  passthru.tests.simple = runCommand "nixfmt-tree-test-simple" { } ''
-    export XDG_CACHE_HOME=$(mktemp -d)
-    cat > unformatted.nix <<EOF
-    let to = "be formatted"; in to
-    EOF
+  passthru.tests.simple =
+    runCommand "nixfmt-tree-test-simple"
+      {
+        nativeBuildInputs = [
+          git
+          nixfmt-tree
+          writableTmpDirAsHomeHook
+        ];
+      }
+      ''
+        git config --global user.email "nix-builder@nixos.org"
+        git config --global user.name "Nix Builder"
 
-    cat > formatted.nix <<EOF
-    let
-      to = "be formatted";
-    in
-    to
-    EOF
+        cat > unformatted.nix <<EOF
+        let to = "be formatted"; in to
+        EOF
 
-    mkdir -p repo
-    (
-      cd repo
-      mkdir .git dir
-      touch .git/index
-      cp ../unformatted.nix a.nix
-      cp ../unformatted.nix dir/b.nix
+        cat > formatted.nix <<EOF
+        let
+          to = "be formatted";
+        in
+        to
+        EOF
 
-      ${lib.getExe nixfmt-tree} dir
-      if [[ "$(<dir/b.nix)" != "$(<../formatted.nix)" ]]; then
-        echo "File dir/b.nix was not formatted properly after dir was requested to be formatted"
-        exit 1
-      elif [[ "$(<a.nix)" != "$(<../unformatted.nix)" ]]; then
-        echo "File a.nix was formatted when only dir was requested to be formatted"
-        exit 1
-      fi
+        mkdir -p repo
+        (
+          cd repo
+          mkdir dir
+          cp ../unformatted.nix a.nix
+          cp ../unformatted.nix dir/b.nix
 
-      (
-        cd dir
-        ${lib.getExe nixfmt-tree}
-      )
+          git init
+          git add .
+          git commit -m "Initial commit"
 
-      if [[ "$(<a.nix)" != "$(<../formatted.nix)" ]]; then
-        echo "File a.nix was not formatted properly after running treefmt without arguments in dir"
-        exit 1
-      fi
-    )
+          treefmt dir
+          if [[ "$(<dir/b.nix)" != "$(<../formatted.nix)" ]]; then
+            echo "File dir/b.nix was not formatted properly after dir was requested to be formatted"
+            exit 1
+          elif [[ "$(<a.nix)" != "$(<../unformatted.nix)" ]]; then
+            echo "File a.nix was formatted when only dir was requested to be formatted"
+            exit 1
+          fi
 
-    echo "Success!"
+          (
+            cd dir
+            treefmt
+          )
 
-    touch $out
-  '';
+          if [[ "$(<a.nix)" != "$(<../formatted.nix)" ]]; then
+            echo "File a.nix was not formatted properly after running treefmt without arguments in dir"
+            exit 1
+          fi
+        )
+
+        echo "Success!"
+
+        touch $out
+      '';
 }
diff --git a/pkgs/by-name/ni/nixos-render-docs/README.md b/pkgs/by-name/ni/nixos-render-docs/README.md
index 5ef0faebcd79..a27e9fdbc9eb 100644
--- a/pkgs/by-name/ni/nixos-render-docs/README.md
+++ b/pkgs/by-name/ni/nixos-render-docs/README.md
@@ -75,3 +75,17 @@ In case this identifier is renamed, the mapping would change into:
   ]
 }
 ```
+
+## Rendering multiple pages
+
+The `include` directive accepts an argument `into-file` to specify the file into which the imported markdown should be rendered to. We can use this argument to set up multipage rendering of the manuals.
+
+For example
+
+~~~
+```{=include=} appendix html:into-file=//release-notes.html
+release-notes/release-notes.md
+```
+~~~
+
+will render the release notes into a `release-notes.html` file, instead of making it a section within the default `index.html`.
diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py
index 1a891a1af238..ba338edeb17a 100644
--- a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py
+++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py
@@ -28,8 +28,7 @@ Identifiers must not be identical to any historical location's anchor of the sam
     The following identifiers violate this rule:
     - {"\n    - ".join(self.conflicting_anchors)}
 
-    This can break links or redirects. If you added new content, choose a different identifier.
-""")
+    This can break links or redirects. If you added new content, choose a different identifier.""")
         if self.divergent_redirects:
             error_messages.append(f"""
 All historical content locations must correspond to exactly one identifier.
@@ -37,8 +36,7 @@ All historical content locations must correspond to exactly one identifier.
     - {"\n    - ".join(self.divergent_redirects)}
 
     It leads to inconsistent behavior depending on which redirect is applied.
-    Please update doc/redirects.json or nixos/doc/manual/redirects.json!
-""")
+    Please update doc/redirects.json or nixos/doc/manual/redirects.json!""")
         if self.identifiers_missing_current_outpath:
             error_messages.append(f"""
 The first element of an identifier's redirects list must denote its current location.
@@ -46,52 +44,34 @@ The first element of an identifier's redirects list must denote its current loca
     - {"\n    - ".join(self.identifiers_missing_current_outpath)}
 
     If you moved content, add its new location as the first element of the redirects mapping.
-    Please update doc/redirects.json or nixos/doc/manual/redirects.json!
-""")
+    Please update doc/redirects.json or nixos/doc/manual/redirects.json!""")
         if self.identifiers_without_redirects:
             error_messages.append(f"""
 Identifiers present in the source must have a mapping in the redirects file.
-    - {"\n    - ".join(self.identifiers_without_redirects)}
-
-    This can happen when an identifier was added or renamed.
-
-    Added new content?
-        redirects add-content ❬identifier❭ ❬path❭
-
-    Moved existing content to a different output path?
-        redirects move-content ❬identifier❭ ❬path❭
-
-    Renamed existing identifiers?
-        redirects rename-identifier ❬old-identifier❭ ❬new-identifier❭
-
-    Removed content? Redirect to alternatives or relevant release notes.
-        redirects remove-and-redirect ❬identifier❭ ❬target-identifier❭
-
-    Note that you need to run `nix-shell doc` or `nix-shell nixos/doc/manual` to be able to run this command.
-""")
+    - {"\n    - ".join(self.identifiers_without_redirects)}""")
         if self.orphan_identifiers:
             error_messages.append(f"""
 Keys of the redirects mapping must correspond to some identifier in the source.
-    - {"\n    - ".join(self.orphan_identifiers)}
-
-    This can happen when an identifier was removed or renamed.
+    - {"\n    - ".join(self.orphan_identifiers)}""")
+        if self.identifiers_without_redirects or self.orphan_identifiers or self.identifiers_missing_current_outpath:
+            error_messages.append(f"""
+This can happen when an identifier was added, renamed, or removed.
 
     Added new content?
-        redirects add-content ❬identifier❭ ❬path❭
+        $ redirects add-content ❬identifier❭ ❬path❭
 
     Moved existing content to a different output path?
-        redirects move-content ❬identifier❭ ❬path❭
+        $ redirects move-content ❬identifier❭ ❬path❭
 
     Renamed existing identifiers?
-        redirects rename-identifier ❬old-identifier❭ ❬new-identifier❭
+        $ redirects rename-identifier ❬old-identifier❭ ❬new-identifier❭
 
-    Removed content? (good for redirecting deprecations to new content or release notes)
-        redirects remove-and-redirect ❬identifier❭ ❬target-identifier❭
+    Removed content? Redirect to alternatives or relevant release notes.
+        $ redirects remove-and-redirect ❬identifier❭ ❬target-identifier❭
 
-    Note that you need to run `nix-shell doc` or `nix-shell nixos/doc/manual` to be able to run this command.
+    NOTE: Run `nix-shell doc` or `nix-shell nixos/doc/manual` to make this command available.
 """)
-
-        error_messages.append("NOTE: If your Manual build passes locally and you see this message in CI, you probably need a rebase.")
+        error_messages.append("NOTE: If your build passes locally and you see this message in CI, you probably need a rebase.")
         return "\n".join(error_messages)
 
 
diff --git a/pkgs/by-name/ni/nixpkgs-track/package.nix b/pkgs/by-name/ni/nixpkgs-track/package.nix
index 955473055eeb..c2f98068d525 100644
--- a/pkgs/by-name/ni/nixpkgs-track/package.nix
+++ b/pkgs/by-name/ni/nixpkgs-track/package.nix
@@ -39,6 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       isabelroses
       uncenter
+      matthiasbeyer
     ];
   };
 })
diff --git a/pkgs/by-name/nk/nkeys/package.nix b/pkgs/by-name/nk/nkeys/package.nix
index 9fa508349456..2495bfee0241 100644
--- a/pkgs/by-name/nk/nkeys/package.nix
+++ b/pkgs/by-name/nk/nkeys/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "nats-io";
-    repo = pname;
+    repo = "nkeys";
     tag = "v${version}";
     hash = "sha256-dSkIT+KW+hT/Rk3NSkrb5ABLLiGGz2dppr9rwhjLOnM=";
   };
diff --git a/pkgs/by-name/nm/nmap-formatter/package.nix b/pkgs/by-name/nm/nmap-formatter/package.nix
index 60299fdb366a..eedcf3690869 100644
--- a/pkgs/by-name/nm/nmap-formatter/package.nix
+++ b/pkgs/by-name/nm/nmap-formatter/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "vdjagilev";
-    repo = pname;
+    repo = "nmap-formatter";
     rev = "v${version}";
     hash = "sha256-jpgAcnDDVVboZEMkLIE9ei0oT91Y9yp8KUJkH6LQSY4=";
   };
diff --git a/pkgs/by-name/nn/nnd/package.nix b/pkgs/by-name/nn/nnd/package.nix
new file mode 100644
index 000000000000..d0cb7818c71c
--- /dev/null
+++ b/pkgs/by-name/nn/nnd/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  fetchFromGitHub,
+  pkgsCross,
+}:
+let
+  inherit (pkgsCross.musl64) rustPlatform;
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "nnd";
+  version = "0.19";
+
+  src = fetchFromGitHub {
+    owner = "al13n321";
+    repo = "nnd";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DjJDNsyOrDLaMruGLP3arfrCs/7hW24wfjvPncndY+Q=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-Iwipxy0xKDyFLMmdB2FQve6DULX+46Pi9rOaK0bDTB0=";
+
+  meta = {
+    description = "Debugger for Linux";
+    homepage = "https://github.com/al13n321/nnd/tree/main";
+    license = lib.licenses.asl20;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ sinjin2300 ];
+    mainProgram = "nnd";
+  };
+})
diff --git a/pkgs/by-name/no/node-problem-detector/package.nix b/pkgs/by-name/no/node-problem-detector/package.nix
index 16e23d8310d6..c4c65c1ca5e8 100644
--- a/pkgs/by-name/no/node-problem-detector/package.nix
+++ b/pkgs/by-name/no/node-problem-detector/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "kubernetes";
-    repo = pname;
+    repo = "node-problem-detector";
     rev = "v${version}";
     sha256 = "sha256-Aw6TDyWczqWgUOCV7f4JSAI4eVcjWgwe2V5qSrx4TBI=";
   };
@@ -38,7 +38,7 @@ buildGoModule rec {
   tags = lib.optionals stdenv.hostPlatform.isLinux [ "journald" ];
 
   ldflags = [
-    "-X k8s.io/${pname}/pkg/version.version=v${version}"
+    "-X k8s.io/node-problem-detector/pkg/version.version=v${version}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/no/nodezator/package.nix b/pkgs/by-name/no/nodezator/package.nix
new file mode 100644
index 000000000000..ce27eb6e2758
--- /dev/null
+++ b/pkgs/by-name/no/nodezator/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "nodezator";
+  version = "1.5.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "IndieSmiths";
+    repo = "nodezator";
+    tag = "v${version}";
+    hash = "sha256-kdkOAJB7cVaayJOzof7dV9EBczEoEKXzCM7TcY8Ex5g=";
+  };
+
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
+    pygame-ce
+    numpy
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Generalist Python node editor";
+    homepage = "https://nodezator.com";
+    downloadPage = "https://github.com/IndiePython/nodezator";
+    changelog = "https://github.com/IndiePython/nodezator/releases/tag/v${version}";
+    license = lib.licenses.unlicense;
+    maintainers = with lib.maintainers; [ theobori ];
+    mainProgram = "nodezator";
+  };
+}
diff --git a/pkgs/by-name/no/nom/package.nix b/pkgs/by-name/no/nom/package.nix
index 59b38088fe9c..58fd59144f78 100644
--- a/pkgs/by-name/no/nom/package.nix
+++ b/pkgs/by-name/no/nom/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "nom";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "guyfedwards";
     repo = "nom";
     tag = "v${version}";
-    hash = "sha256-2YXecurdmlho5LvkkMc97GiyrSy/kTZINTPtC+J+eL0=";
+    hash = "sha256-PqoTpy+Pz5OS+7pzzdxNKeqIZRipOvHKMs9o67XzdqY=";
   };
 
   vendorHash = "sha256-d5KTDZKfuzv84oMgmsjJoXGO5XYLVKxOB5XehqgRvYw=";
diff --git a/pkgs/by-name/no/nomad-driver-containerd/package.nix b/pkgs/by-name/no/nomad-driver-containerd/package.nix
index 6f56e85b83f9..c5bbc5a936d2 100644
--- a/pkgs/by-name/no/nomad-driver-containerd/package.nix
+++ b/pkgs/by-name/no/nomad-driver-containerd/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "Roblox";
-    repo = pname;
+    repo = "nomad-driver-containerd";
     rev = "v${version}";
     sha256 = "sha256-11K1ACk2hhEi+sAlI932eKpyy82Md7j1edRWH2JJ8sI=";
   };
diff --git a/pkgs/by-name/no/nomad-driver-podman/package.nix b/pkgs/by-name/no/nomad-driver-podman/package.nix
index dd848e09826b..45e09131d3ea 100644
--- a/pkgs/by-name/no/nomad-driver-podman/package.nix
+++ b/pkgs/by-name/no/nomad-driver-podman/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "hashicorp";
-    repo = pname;
+    repo = "nomad-driver-podman";
     rev = "v${version}";
     sha256 = "sha256-QvIc0RNQX9do6pTyGbJTTR7jANp50DVlHsl/8teiCnY=";
   };
diff --git a/pkgs/by-name/no/norminette/package.nix b/pkgs/by-name/no/norminette/package.nix
index bec1adc9d304..af2cef24142b 100644
--- a/pkgs/by-name/no/norminette/package.nix
+++ b/pkgs/by-name/no/norminette/package.nix
@@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "42School";
-    repo = pname;
+    repo = "norminette";
     tag = version;
     hash = "sha256-6hBBbfW2PQFb8rcDihvtWK0df7WcvOk0il1E82GOxaU=";
   };
diff --git a/pkgs/by-name/no/norouter/package.nix b/pkgs/by-name/no/norouter/package.nix
index 6cd63474af38..12ad91496a84 100644
--- a/pkgs/by-name/no/norouter/package.nix
+++ b/pkgs/by-name/no/norouter/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "norouter";
-    repo = pname;
+    repo = "norouter";
     rev = "v${version}";
     sha256 = "sha256-EY/Yfyaz2DeQKHJ4awpQDbrVkse9crIZlLzfviPy3Tk=";
   };
diff --git a/pkgs/by-name/no/nosqli/package.nix b/pkgs/by-name/no/nosqli/package.nix
index 7930a9626b5c..883459be732e 100644
--- a/pkgs/by-name/no/nosqli/package.nix
+++ b/pkgs/by-name/no/nosqli/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "Charlie-belmer";
-    repo = pname;
+    repo = "nosqli";
     rev = "v${version}";
     sha256 = "sha256-CgD9b5eHDK/8QhQmrqT09Jf9snn9WItNMtTNbJFT2sI=";
   };
diff --git a/pkgs/by-name/no/notation/package.nix b/pkgs/by-name/no/notation/package.nix
index 865b6da8a14a..1d3ee6f1eb1f 100644
--- a/pkgs/by-name/no/notation/package.nix
+++ b/pkgs/by-name/no/notation/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "notaryproject";
-    repo = pname;
+    repo = "notation";
     rev = "v${version}";
     hash = "sha256-l9A5AwKJ/atN92Oral6PRH2nCbMJ+/ST9weXYRZXWms=";
   };
diff --git a/pkgs/by-name/no/notejot/package.nix b/pkgs/by-name/no/notejot/package.nix
index 9214af6c8fa2..b2545754249d 100644
--- a/pkgs/by-name/no/notejot/package.nix
+++ b/pkgs/by-name/no/notejot/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "lainsce";
-    repo = pname;
+    repo = "notejot";
     rev = version;
     hash = "sha256-p5F0OITgfZyvHwndI5r5BE524+nft7A2XfR3BJZFamU=";
   };
diff --git a/pkgs/by-name/no/notify/package.nix b/pkgs/by-name/no/notify/package.nix
index d2a5ae5280ed..8dbf247b00e2 100644
--- a/pkgs/by-name/no/notify/package.nix
+++ b/pkgs/by-name/no/notify/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
-    repo = pname;
+    repo = "notify";
     rev = "v${version}";
     sha256 = "sha256-QXioBUCMZ4ANkF2WOXiKUlExVq4abkaVFBd3efAGXMs=";
   };
diff --git a/pkgs/by-name/no/nova/package.nix b/pkgs/by-name/no/nova/package.nix
index 06cade043435..0f6822fb9a47 100644
--- a/pkgs/by-name/no/nova/package.nix
+++ b/pkgs/by-name/no/nova/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
-    repo = pname;
+    repo = "nova";
     rev = "v${version}";
     hash = "sha256-7GAA5Kc5ximdf71Bd8Q5o2pXixLOobXykKxfI31j/4A=";
   };
diff --git a/pkgs/by-name/nq/nqptp/package.nix b/pkgs/by-name/nq/nqptp/package.nix
index 90912643b004..bd536ebd8043 100644
--- a/pkgs/by-name/nq/nqptp/package.nix
+++ b/pkgs/by-name/nq/nqptp/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "mikebrady";
-    repo = pname;
+    repo = "nqptp";
     tag = version;
     hash = "sha256-roTNcr3v2kzE6vQ5plAVtlw1+2yJplltOYsGGibtoZo=";
   };
diff --git a/pkgs/by-name/ns/nsc/package.nix b/pkgs/by-name/ns/nsc/package.nix
index 3c8fe2fc3d2a..e8494a0c1493 100644
--- a/pkgs/by-name/ns/nsc/package.nix
+++ b/pkgs/by-name/ns/nsc/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "nats-io";
-    repo = pname;
+    repo = "nsc";
     rev = "v${version}";
     hash = "sha256-/xfNl91cb82kV2IC/m56p94nb3WLDPU5O+1H+sTZnW4=";
   };
diff --git a/pkgs/by-name/nu/nu_scripts/package.nix b/pkgs/by-name/nu/nu_scripts/package.nix
index 8130882db143..78b6e4c0b9e4 100644
--- a/pkgs/by-name/nu/nu_scripts/package.nix
+++ b/pkgs/by-name/nu/nu_scripts/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "nu_scripts";
-  version = "0-unstable-2025-05-15";
+  version = "0-unstable-2025-05-22";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = "nu_scripts";
-    rev = "b2d512f6c67f68895a26136c6ce552281efbec6e";
-    hash = "sha256-iC5Qmyn9vDr4b1BWtJkC3pl2dOam2Se51+ENvRdXlvA=";
+    rev = "765555beddc3c81555e6b70abb2542c37a1c0ad6";
+    hash = "sha256-/LoeL4BILPSOv3jnURcuuQhuRLdE0amBGnEOTB+LLgI=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/nu/nuclei-templates/package.nix b/pkgs/by-name/nu/nuclei-templates/package.nix
index 0e910eff0737..78563010798a 100644
--- a/pkgs/by-name/nu/nuclei-templates/package.nix
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nuclei-templates";
-  version = "10.2.1";
+  version = "10.2.2";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei-templates";
     tag = "v${version}";
-    hash = "sha256-r2c6mmW/bLUGb8n1zvNJWrxyvSWBfPuTsU7tneeGaVE=";
+    hash = "sha256-FWOfh/W2Hy01Z7oEItLtWidbvEfwVBDU9KAaCoFO0AI=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/nv/nvidia-container-toolkit/package.nix b/pkgs/by-name/nv/nvidia-container-toolkit/package.nix
index 7543a52d4634..b2a09728409f 100644
--- a/pkgs/by-name/nv/nvidia-container-toolkit/package.nix
+++ b/pkgs/by-name/nv/nvidia-container-toolkit/package.nix
@@ -31,7 +31,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
-    repo = pname;
+    repo = "nvidia-container-toolkit";
     rev = "v${version}";
     hash = "sha256-MQQTQ6AaoA4VIAT7YPo3z6UbZuKHjOvu9sW2975TveM=";
 
diff --git a/pkgs/by-name/nv/nvpy/package.nix b/pkgs/by-name/nv/nvpy/package.nix
index 96ecfeaa0ba0..e2f1e1112c37 100644
--- a/pkgs/by-name/nv/nvpy/package.nix
+++ b/pkgs/by-name/nv/nvpy/package.nix
@@ -13,7 +13,7 @@ pythonPackages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "cpbotha";
-    repo = pname;
+    repo = "nvpy";
     tag = "v${version}";
     sha256 = "sha256-guNdLu/bCk89o5M3gQU7J0W4h7eZdLHM0FG5IAPLE7c=";
   };
diff --git a/pkgs/by-name/nw/nwg-bar/package.nix b/pkgs/by-name/nw/nwg-bar/package.nix
index 17ef7dea548b..15bbaa60e2d0 100644
--- a/pkgs/by-name/nw/nwg-bar/package.nix
+++ b/pkgs/by-name/nw/nwg-bar/package.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
-    repo = pname;
+    repo = "nwg-bar";
     rev = "v${version}";
     sha256 = "sha256-5N+WKZ+fuHQ0lVLd95/KkNAwzg/C4ImZ4DnSuKNGunk=";
   };
diff --git a/pkgs/by-name/nw/nwg-dock/package.nix b/pkgs/by-name/nw/nwg-dock/package.nix
index c3cc4c19ea72..43eea2388399 100644
--- a/pkgs/by-name/nw/nwg-dock/package.nix
+++ b/pkgs/by-name/nw/nwg-dock/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
-    repo = pname;
+    repo = "nwg-dock";
     rev = "v${version}";
     sha256 = "sha256-Ymk4lpX8RAxWot7U+cFtu1eJd6VHP+JS1I2vF0V1T70=";
   };
diff --git a/pkgs/by-name/nw/nwg-wrapper/package.nix b/pkgs/by-name/nw/nwg-wrapper/package.nix
index e6718120726c..f9f113143400 100644
--- a/pkgs/by-name/nw/nwg-wrapper/package.nix
+++ b/pkgs/by-name/nw/nwg-wrapper/package.nix
@@ -15,7 +15,7 @@ python3Packages.buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
-    repo = pname;
+    repo = "nwg-wrapper";
     tag = "v${version}";
     sha256 = "sha256-GKDAdjO67aedCEFHKDukQ+oPMomTPwFE/CvJu112fus=";
   };
diff --git a/pkgs/by-name/nz/nzbhydra2/package.nix b/pkgs/by-name/nz/nzbhydra2/package.nix
index 1fa9cd840c55..4c38a3ef3810 100644
--- a/pkgs/by-name/nz/nzbhydra2/package.nix
+++ b/pkgs/by-name/nz/nzbhydra2/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nzbhydra2";
-  version = "7.13.0";
+  version = "7.13.2";
 
   src = fetchzip {
     url = "https://github.com/theotherp/nzbhydra2/releases/download/v${version}/nzbhydra2-${version}-generic.zip";
-    hash = "sha256-jMiSVzAulM7xs6Z3KYIFHjJHx8dWFVbr/PqNeItV81g=";
+    hash = "sha256-l2BBbNW6Yy6oFXYNhqKNscBg7x/vNJNh7LD+AbXDdd4=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/oa/oak/package.nix b/pkgs/by-name/oa/oak/package.nix
index 3584fccfc394..f630344ec013 100644
--- a/pkgs/by-name/oa/oak/package.nix
+++ b/pkgs/by-name/oa/oak/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "thesephist";
-    repo = pname;
+    repo = "oak";
     rev = "v${version}";
     sha256 = "sha256-DK5n8xK57CQiukyBt9+CFK1j8+nphP//T2jTXq64VH8=";
   };
diff --git a/pkgs/by-name/oa/oapi-codegen/package.nix b/pkgs/by-name/oa/oapi-codegen/package.nix
index add1f72532a6..ee2bbcf61521 100644
--- a/pkgs/by-name/oa/oapi-codegen/package.nix
+++ b/pkgs/by-name/oa/oapi-codegen/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "deepmap";
-    repo = pname;
+    repo = "oapi-codegen";
     tag = "v${version}";
     hash = "sha256-21VhHSyfF+NHkXlr2svjwBNZmfS1O448POBP9XUQxak=";
   };
diff --git a/pkgs/by-name/oa/oauth2-proxy/package.nix b/pkgs/by-name/oa/oauth2-proxy/package.nix
index f6bd1318e80a..52f525b83bab 100644
--- a/pkgs/by-name/oa/oauth2-proxy/package.nix
+++ b/pkgs/by-name/oa/oauth2-proxy/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
   version = "7.9.0";
 
   src = fetchFromGitHub {
-    repo = pname;
+    repo = "oauth2-proxy";
     owner = "oauth2-proxy";
     sha256 = "sha256-ykC29q7/rTv7POGETMiypj9CQYdYVo7rjT5B+3nfj/U=";
     rev = "v${version}";
diff --git a/pkgs/by-name/oa/oauth2c/package.nix b/pkgs/by-name/oa/oauth2c/package.nix
index cb75d2fc9060..41affa2ab8e3 100644
--- a/pkgs/by-name/oa/oauth2c/package.nix
+++ b/pkgs/by-name/oa/oauth2c/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "cloudentity";
-    repo = pname;
+    repo = "oauth2c";
     rev = "v${version}";
     hash = "sha256-axCzPCYPn6T8AGqE92Yf/aVJ78Wl004Ts4YebSWYa6U=";
   };
diff --git a/pkgs/by-name/oc/oci-cli/package.nix b/pkgs/by-name/oc/oci-cli/package.nix
index c7599f674d20..f4320471c193 100644
--- a/pkgs/by-name/oc/oci-cli/package.nix
+++ b/pkgs/by-name/oc/oci-cli/package.nix
@@ -30,7 +30,7 @@ py.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "oracle";
-    repo = pname;
+    repo = "oci-cli";
     tag = "v${version}";
     hash = "sha256-KvyhQ8MM74MYR8gf18XVYZrOSEKcOqdmyITg2UyNqp8=";
   };
diff --git a/pkgs/by-name/oc/ockam/package.nix b/pkgs/by-name/oc/ockam/package.nix
index 70d4ffc4f253..d4c0871daf72 100644
--- a/pkgs/by-name/oc/ockam/package.nix
+++ b/pkgs/by-name/oc/ockam/package.nix
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage {
 
   src = fetchFromGitHub {
     owner = "build-trust";
-    repo = pname;
+    repo = "ockam";
     rev = "ockam_v${version}";
     hash = "sha256-AY0i7qXA7JXfIEY0htmL+/yn71xAuh7WowXOs2fD6n8=";
   };
diff --git a/pkgs/by-name/oc/octofetch/package.nix b/pkgs/by-name/oc/octofetch/package.nix
index 516ea40f1317..7a4852593ced 100644
--- a/pkgs/by-name/oc/octofetch/package.nix
+++ b/pkgs/by-name/oc/octofetch/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "azur1s";
-    repo = pname;
+    repo = "octofetch";
     rev = version;
     sha256 = "sha256-/AXE1e02NfxQzJZd0QX6gJDjmFFmuUTOndulZElgIMI=";
   };
diff --git a/pkgs/by-name/oc/octoprint/package.nix b/pkgs/by-name/oc/octoprint/package.nix
index cec7024bccc3..182f7382702f 100644
--- a/pkgs/by-name/oc/octoprint/package.nix
+++ b/pkgs/by-name/oc/octoprint/package.nix
@@ -132,7 +132,7 @@ let
               zeroconf
               zipstream-ng
               class-doc
-              pydantic_1
+              pydantic
             ]
             ++ lib.optionals stdenv.hostPlatform.isDarwin [ py.pkgs.appdirs ]
             ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ octoprint-pisupport ];
diff --git a/pkgs/by-name/oc/octosql/package.nix b/pkgs/by-name/oc/octosql/package.nix
index 51be01c38baf..a11e397635e7 100644
--- a/pkgs/by-name/oc/octosql/package.nix
+++ b/pkgs/by-name/oc/octosql/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "cube2222";
-    repo = pname;
+    repo = "octosql";
     rev = "v${version}";
     hash = "sha256-kzbIts5d2KmFfaAnOdpIXI1fiqBYXe5t981g4Uyk/cc=";
   };
diff --git a/pkgs/by-name/of/offensive-azure/package.nix b/pkgs/by-name/of/offensive-azure/package.nix
index 5c715bf6ea67..77f5493e370e 100644
--- a/pkgs/by-name/of/offensive-azure/package.nix
+++ b/pkgs/by-name/of/offensive-azure/package.nix
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "blacklanternsecurity";
-    repo = pname;
+    repo = "offensive-azure";
     rev = "v${version}";
     hash = "sha256-5JHix+/uGGhXM89VLimI81g4evci5ZUtNV1c1xopjuI=";
   };
diff --git a/pkgs/by-name/oh/oh-my-posh/package.nix b/pkgs/by-name/oh/oh-my-posh/package.nix
index 88f3bd6100ac..4940574315d4 100644
--- a/pkgs/by-name/oh/oh-my-posh/package.nix
+++ b/pkgs/by-name/oh/oh-my-posh/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
-    repo = pname;
+    repo = "oh-my-posh";
     tag = "v${version}";
     hash = "sha256-hb5XgwBg9llX/PDX8A8hL5fJbG03nTjrvEd252k2Il0=";
   };
diff --git a/pkgs/by-name/oh/oh/package.nix b/pkgs/by-name/oh/oh/package.nix
index 0277d0194405..57a55ce2b539 100644
--- a/pkgs/by-name/oh/oh/package.nix
+++ b/pkgs/by-name/oh/oh/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "michaelmacinnis";
-    repo = pname;
+    repo = "oh";
     rev = "v${version}";
     sha256 = "sha256-ryIh6MRIOVZPm2USpJC69Z/upIXGUHgcd17eZBA9Edc=";
   };
diff --git a/pkgs/by-name/oi/oidc-agent/package.nix b/pkgs/by-name/oi/oidc-agent/package.nix
index 5f2eeb6492b2..9647f65903cc 100644
--- a/pkgs/by-name/oi/oidc-agent/package.nix
+++ b/pkgs/by-name/oi/oidc-agent/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "indigo-dc";
-    repo = pname;
+    repo = "oidc-agent";
     rev = "v${version}";
     hash = "sha256-Vj/YoZpbiV8psU70i3SIKJM/qPQYuy96ogEhT8cG7RU=";
   };
diff --git a/pkgs/by-name/ol/olaris-server/package.nix b/pkgs/by-name/ol/olaris-server/package.nix
index fb4de53b716e..5449ea448ac3 100644
--- a/pkgs/by-name/ol/olaris-server/package.nix
+++ b/pkgs/by-name/ol/olaris-server/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   src = fetchFromGitLab {
     owner = "olaris";
-    repo = pname;
+    repo = "olaris-server";
     rev = "bdb2aeb1595c941210249164a97c12404c1ae0d8";
     hash = "sha256-Uhnh6GC85ORKnfHeYNtbSA40osuscxXDF5/kXJrF2Cs=";
   };
diff --git a/pkgs/by-name/ol/olivetin/package.nix b/pkgs/by-name/ol/olivetin/package.nix
index 24cb51325a2a..38833afae1ea 100644
--- a/pkgs/by-name/ol/olivetin/package.nix
+++ b/pkgs/by-name/ol/olivetin/package.nix
@@ -56,7 +56,7 @@ buildGoModule (
       pname = "olivetin-webui";
       inherit (finalAttrs) version src;
 
-      npmDepsHash = "sha256-VxIPjpsbxEPP15cu5Wvz0qeDGXTMb2tojdry8YaHMVI=";
+      npmDepsHash = "sha256-59ImpfuLtsZG2Y6B3R09ePaTEuFbIhklk2jKibaB+wg=";
 
       sourceRoot = "${finalAttrs.src.name}/webui.dev";
 
@@ -81,18 +81,18 @@ buildGoModule (
 
   {
     pname = "olivetin";
-    version = "2025.4.22";
+    version = "2025.5.26";
 
     src = fetchFromGitHub {
       owner = "OliveTin";
       repo = "OliveTin";
       tag = finalAttrs.version;
-      hash = "sha256-dgoYGtBsyaCTgxCT/y7rU5B9pEvIU/yiLU2/pPm/vJU=";
+      hash = "sha256-BD52MxIHE56y3oWuRTCYmrEYMge70/MXt4B6g84ahF0=";
     };
 
     modRoot = "service";
 
-    vendorHash = "sha256-yUW4BrC7Oqs+mvvZGp6oxdGQ9fxP5gQNacq6Pz5ZHAQ=";
+    vendorHash = "sha256-kfk4QFG+l+XKkKoOs2C1B6ZuMeeDz9DrzzR46S8Qnyk=";
 
     ldflags = [
       "-s"
diff --git a/pkgs/by-name/ol/olsrd/package.nix b/pkgs/by-name/ol/olsrd/package.nix
index e0b709dbf816..3e52a9a05017 100644
--- a/pkgs/by-name/ol/olsrd/package.nix
+++ b/pkgs/by-name/ol/olsrd/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "OLSR";
-    repo = pname;
+    repo = "olsrd";
     rev = "v${version}";
     sha256 = "1xk355dm5pfjil1j4m724vkdnc178lv6hi6s1g0xgpd59avbx90j";
   };
diff --git a/pkgs/by-name/om/omnictl/package.nix b/pkgs/by-name/om/omnictl/package.nix
index ee28971dd468..dba1f3c45bc4 100644
--- a/pkgs/by-name/om/omnictl/package.nix
+++ b/pkgs/by-name/om/omnictl/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "omnictl";
-  version = "0.49.1";
+  version = "0.50.0";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "omni";
     rev = "v${version}";
-    hash = "sha256-0SLeR91KVwpAKLLVVZ3pEKI2Vy0QaysezX2M3X5aZdQ=";
+    hash = "sha256-zxtBAFfZrXbUL1V2AN8Cblm6M7HhogoncOzGyjOUcK4=";
   };
 
-  vendorHash = "sha256-dT0sniTYli+zRYN/uLETS3SrM5cfDY5ZYYAthaiQ93U=";
+  vendorHash = "sha256-ewJTnoJpnz/237j/mpYpi8Otwu3ge9QN8cNrAfCHvUM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/on/oncall/package.nix b/pkgs/by-name/on/oncall/package.nix
index ede210ae2bb2..4c56b281699c 100644
--- a/pkgs/by-name/on/oncall/package.nix
+++ b/pkgs/by-name/on/oncall/package.nix
@@ -15,7 +15,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "linkedin";
-    repo = pname;
+    repo = "oncall";
     #tag = "v${version}";
     rev = "030f5d0286b253e4300d36de1954c7b2a7490a76";
     hash = "sha256-Lox9aqYKsl/vg6mNwr0MoLmJQkC+kEf7AqvCCKhgo94=";
diff --git a/pkgs/by-name/on/onetun/package.nix b/pkgs/by-name/on/onetun/package.nix
index 000163a2fdb6..551ec59afbf2 100644
--- a/pkgs/by-name/on/onetun/package.nix
+++ b/pkgs/by-name/on/onetun/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "aramperes";
-    repo = pname;
+    repo = "onetun";
     rev = "v${version}";
     sha256 = "sha256-bggBBl2YQUncfOYIDsPgrHPwznCJQOlIOY3bbiZz7Rw=";
   };
diff --git a/pkgs/by-name/on/oniux/package.nix b/pkgs/by-name/on/oniux/package.nix
index e63fe4a308b3..ef7dc10d54d4 100644
--- a/pkgs/by-name/on/oniux/package.nix
+++ b/pkgs/by-name/on/oniux/package.nix
@@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oniux";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
     owner = "tpo/core";
     repo = "oniux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wWB/ch8DB2tO4+NuNDaGv8K4AbV5/MbyY01oRGai86A=";
+    hash = "sha256-rtQUHTDPQXL4gT8/Nl0hV/F06ybPIfemibCzH3mFHaY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-tUOxs9bTcXS3Gq6cHYe+eAGAEYSRvf3JVGugBImbvJM=";
+  cargoHash = "sha256-79KNytAXxuYi9VBmkkOJg2ugjjoKJ/BPBqWa7Z72HGI=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/op/open-fprintd/package.nix b/pkgs/by-name/op/open-fprintd/package.nix
index 1bdb2f2cade4..54de6a6e7457 100644
--- a/pkgs/by-name/op/open-fprintd/package.nix
+++ b/pkgs/by-name/op/open-fprintd/package.nix
@@ -12,7 +12,7 @@ python3Packages.buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "uunicorn";
-    repo = pname;
+    repo = "open-fprintd";
     rev = version;
     hash = "sha256-uVFuwtsmR/9epoqot3lJ/5v5OuJjuRjL7FJF7oXNDzU=";
   };
diff --git a/pkgs/by-name/op/open-vm-tools/package.nix b/pkgs/by-name/op/open-vm-tools/package.nix
index aa5290520a8c..b24a8459b35b 100644
--- a/pkgs/by-name/op/open-vm-tools/package.nix
+++ b/pkgs/by-name/op/open-vm-tools/package.nix
@@ -51,13 +51,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "open-vm-tools";
-  version = "12.5.0";
+  version = "12.5.2";
 
   src = fetchFromGitHub {
     owner = "vmware";
     repo = "open-vm-tools";
-    rev = "stable-${finalAttrs.version}";
-    hash = "sha256-pjMXhVN4xdmPCk1Aeb83VZjDJ1t1mb9wryC6h3O+Qvc=";
+    tag = "stable-${finalAttrs.version}";
+    hash = "sha256-gKtPyLsmTrbA3aG/Jiod/oAl5aMpVm3enuCe+b7jsY4=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/open-vm-tools";
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index 036a1767ed82..dcc8fbd39452 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -2,7 +2,6 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
-  fetchpatch2,
   python3Packages,
   nixosTests,
   fetchurl,
@@ -10,28 +9,19 @@
 }:
 let
   pname = "open-webui";
-  version = "0.6.10";
+  version = "0.6.12";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-OZPZlF6tXzfuFU8/ZavE67E8+XdRu+7oCA1eD0EA9fg=";
+    hash = "sha256-q8pb+XIBKzU8zWohBtKNQhYBwcQF51/uqgVrMxcKcUc=";
   };
 
   frontend = buildNpmPackage rec {
     pname = "open-webui-frontend";
     inherit version src;
 
-    patches = [
-      # Git is not available in the sandbox
-      # Remove this patch at the next release
-      (fetchpatch2 {
-        url = "https://github.com/open-webui/open-webui/commit/ed0659aca60eedadadba4362b309015b4a8368c6.patch";
-        hash = "sha256-lTzCdAk9gagIfN5Ld1tCS3gp/oVm4+CRy/lD42702WM=";
-      })
-    ];
-
     # the backend for run-on-client-browser python execution
     # must match lock file in open-webui
     # TODO: should we automate this?
@@ -42,7 +32,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-F/xum76SHFwX/77kPHTFayJ00wv6ZWE09hw8taUbMMQ=";
+    npmDepsHash = "sha256-576Cd7I4CzOItSycQH8CwLAelLoNnQcJVZ338IhMb/k=";
 
     # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
     # Until this is solved, running python packages from the browser will not work.
@@ -197,6 +187,7 @@ python3Packages.buildPythonApplication rec {
       sentence-transformers
       sentencepiece
       soundfile
+      starlette-compress
       tencentcloud-sdk-python
       tiktoken
       transformers
diff --git a/pkgs/by-name/op/openapi-changes/package.nix b/pkgs/by-name/op/openapi-changes/package.nix
index 4b2225416adb..014a89e7caa4 100644
--- a/pkgs/by-name/op/openapi-changes/package.nix
+++ b/pkgs/by-name/op/openapi-changes/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "pb33f";
-    repo = pname;
+    repo = "openapi-changes";
     rev = "v${version}";
     hash = "sha256-Ct4VyYFqdMmROg9SE/pFNOJozSkQtKpgktJVgvtW/HA=";
   };
diff --git a/pkgs/by-name/op/openbsm/package.nix b/pkgs/by-name/op/openbsm/package.nix
index 7fb9dd48fa20..ad66db72e64f 100644
--- a/pkgs/by-name/op/openbsm/package.nix
+++ b/pkgs/by-name/op/openbsm/package.nix
@@ -9,9 +9,9 @@ stdenv.mkDerivation rec {
   version = "1.1";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = lib.toUpper (builtins.replaceStrings [ "." "-" ] [ "_" "_" ] "${pname}-${version}");
+    owner = "openbsm";
+    repo = "openbsm";
+    rev = lib.toUpper (builtins.replaceStrings [ "." "-" ] [ "_" "_" ] "openbsm-${version}");
     sha256 = "0b98359hd8mm585sh145ss828pg2y8vgz38lqrb7nypapiyqdnd1";
   };
 
diff --git a/pkgs/by-name/op/openring/package.nix b/pkgs/by-name/op/openring/package.nix
index 0d7d7c0b3298..1321868651e8 100644
--- a/pkgs/by-name/op/openring/package.nix
+++ b/pkgs/by-name/op/openring/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
-    repo = pname;
+    repo = "openring";
     rev = version;
     sha256 = "sha256-BY2AtgZXzPLqHk3hd6D+XXbrwvWS9DNTKwLqsua/3uw=";
   };
diff --git a/pkgs/by-name/op/openstack-rs/package.nix b/pkgs/by-name/op/openstack-rs/package.nix
index 836eac472b81..a865f74b9e2a 100644
--- a/pkgs/by-name/op/openstack-rs/package.nix
+++ b/pkgs/by-name/op/openstack-rs/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "openstack-rs";
-  version = "0.12.0";
+  version = "0.12.1";
   src = fetchFromGitHub {
     owner = "gtema";
     repo = "openstack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n3tVkEDn5giAYxcFWI/sc0yCjK1A80L7+dp44QXoCc4=";
+    hash = "sha256-jJNEZF0aGD4pdKWdWOa64nIr/CKJlBL7Vo9MFiQ54xo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-lu3OeBP2fHGX1SV1LnDv/RCAVhoEVZIRiMoXWJ3H4IQ=";
+  cargoHash = "sha256-edKIJM4FQ/SmR7IU/7WxNm+hHouXMWUV8n3rbKzvV0A=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/op/opera/package.nix b/pkgs/by-name/op/opera/package.nix
deleted file mode 100644
index a18655c63acb..000000000000
--- a/pkgs/by-name/op/opera/package.nix
+++ /dev/null
@@ -1,147 +0,0 @@
-{
-  alsa-lib,
-  atk,
-  cairo,
-  cups,
-  curl,
-  dbus,
-  dpkg,
-  expat,
-  fetchurl,
-  fontconfig,
-  freetype,
-  gdk-pixbuf,
-  glib,
-  gtk3,
-  gtk4,
-  lib,
-  libX11,
-  libxcb,
-  libXScrnSaver,
-  libXcomposite,
-  libXcursor,
-  libXdamage,
-  libXext,
-  libXfixes,
-  libXi,
-  libXrandr,
-  libXrender,
-  libXtst,
-  libdrm,
-  libnotify,
-  libpulseaudio,
-  libuuid,
-  libxshmfence,
-  libgbm,
-  nspr,
-  nss,
-  pango,
-  stdenv,
-  systemd,
-  at-spi2-atk,
-  at-spi2-core,
-  autoPatchelfHook,
-  wrapGAppsHook3,
-  qt6,
-  proprietaryCodecs ? false,
-  vivaldi-ffmpeg-codecs,
-}:
-
-let
-  mirror = "https://get.geo.opera.com/pub/opera/desktop";
-in
-stdenv.mkDerivation rec {
-  pname = "opera";
-  version = "118.0.5461.60";
-
-  src = fetchurl {
-    url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    hash = "sha256-SApVqrMeOrpw9GDMwBgpxMfSgMXJS1YV2bPx+KXBY/4=";
-  };
-
-  nativeBuildInputs = [
-    dpkg
-    autoPatchelfHook
-    wrapGAppsHook3
-    qt6.wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    alsa-lib
-    at-spi2-atk
-    at-spi2-core
-    atk
-    cairo
-    cups
-    curl
-    dbus
-    expat
-    fontconfig.lib
-    freetype
-    gdk-pixbuf
-    glib
-    gtk3
-    libX11
-    libXScrnSaver
-    libXcomposite
-    libXcursor
-    libXdamage
-    libXext
-    libXfixes
-    libXi
-    libXrandr
-    libXrender
-    libXtst
-    libdrm
-    libnotify
-    libuuid
-    libxcb
-    libxshmfence
-    libgbm
-    nspr
-    nss
-    pango
-    (lib.getLib stdenv.cc.cc)
-    qt6.qtbase
-  ];
-
-  runtimeDependencies =
-    [
-      # Works fine without this except there is no sound.
-      libpulseaudio.out
-
-      # This is a little tricky. Without it the app starts then crashes. Then it
-      # brings up the crash report, which also crashes. `strace -f` hints at a
-      # missing libudev.so.0.
-      (lib.getLib systemd)
-
-      # Error at startup:
-      # "Illegal instruction (core dumped)"
-      gtk3
-      gtk4
-    ]
-    ++ lib.optionals proprietaryCodecs [
-      vivaldi-ffmpeg-codecs
-    ];
-
-  dontWrapQtApps = true;
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp -r usr $out
-    cp -r usr/share $out/share
-
-    # we already using QT6, autopatchelf wants to patch this as well
-    rm $out/usr/lib/x86_64-linux-gnu/opera/libqt5_shim.so
-    ln -s $out/usr/bin/opera $out/bin/opera
-  '';
-
-  meta = with lib; {
-    homepage = "https://www.opera.com";
-    description = "Faster, safer and smarter web browser";
-    platforms = [ "x86_64-linux" ];
-    license = licenses.unfree;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ kindrowboat ];
-  };
-}
diff --git a/pkgs/by-name/op/operator-sdk/package.nix b/pkgs/by-name/op/operator-sdk/package.nix
index aa409ccb1ea5..f6298e4a85c0 100644
--- a/pkgs/by-name/op/operator-sdk/package.nix
+++ b/pkgs/by-name/op/operator-sdk/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "operator-framework";
-    repo = pname;
+    repo = "operator-sdk";
     tag = "v${version}";
     hash = "sha256-2Kv6mDC1MndUgttRYODnI8DZ84RVz8jn3+RpXmOemq0=";
   };
diff --git a/pkgs/by-name/op/opkssh/package.nix b/pkgs/by-name/op/opkssh/package.nix
index 7586bca5f127..eec9e82baaec 100644
--- a/pkgs/by-name/op/opkssh/package.nix
+++ b/pkgs/by-name/op/opkssh/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "opkssh";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "openpubkey";
     repo = "opkssh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BK34zw/VYv6mAn68U8tRoOU6Obz3P+6Hw12fsKBuUf8=";
+    hash = "sha256-8fbOhyrHgNG9ulu/DZvUHzIojvoHG/gb5+Ft/RmMHXk=";
   };
 
   ldflags = [ "-X main.Version=${finalAttrs.version}" ];
 
-  vendorHash = "sha256-6nTRiybsNtP/BiDaNrFEGEGM41BAjGpOyQ0AlQimSE4=";
+  vendorHash = "sha256-bkTQqtlZhZ2/WnQNRdZzfblkGKjaAS22RFl6I1O3/yA=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/op/ops/package.nix b/pkgs/by-name/op/ops/package.nix
index ae0ffffecc65..67742993b9c1 100644
--- a/pkgs/by-name/op/ops/package.nix
+++ b/pkgs/by-name/op/ops/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "nanovms";
-    repo = pname;
+    repo = "ops";
     rev = version;
     sha256 = "sha256-ac+17hywzyK7ChCP/nhwTP1WEIZ89+BKX9/YmsPpfg8=";
   };
diff --git a/pkgs/by-name/or/orbuculum/package.nix b/pkgs/by-name/or/orbuculum/package.nix
index 8b20e5e78edf..eeef29d76404 100644
--- a/pkgs/by-name/or/orbuculum/package.nix
+++ b/pkgs/by-name/or/orbuculum/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "orbcode";
-    repo = pname;
+    repo = "orbuculum";
     rev = "V${version}";
     sha256 = "sha256-Ohcc8739W/EmDjOYhcMgzEPVhzbWrUYgsPLdy4qzxhY=";
   };
diff --git a/pkgs/by-name/or/orchard/package.nix b/pkgs/by-name/or/orchard/package.nix
index fb1199274458..a164336c7c05 100644
--- a/pkgs/by-name/or/orchard/package.nix
+++ b/pkgs/by-name/or/orchard/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
-    repo = pname;
+    repo = "orchard";
     rev = version;
     hash = "sha256-yiCMnP73C5MJLYjnZfqcKtdSzPyL/9WlAtylMXDl4E8=";
     # populate values that require us to use git. By doing this in postFetch we
diff --git a/pkgs/by-name/os/oshka/package.nix b/pkgs/by-name/os/oshka/package.nix
index 4727b3ab1e1e..58c7c2bc4e5d 100644
--- a/pkgs/by-name/os/oshka/package.nix
+++ b/pkgs/by-name/os/oshka/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "k1LoW";
-    repo = pname;
+    repo = "oshka";
     rev = "v${version}";
     sha256 = "sha256-fpWhqFK5h/U7DCC/SyhAlMyCMhjZHRLMlwakvlhOd3w=";
   };
diff --git a/pkgs/by-name/os/osv-detector/package.nix b/pkgs/by-name/os/osv-detector/package.nix
index 470197738dcb..76fb133961d0 100644
--- a/pkgs/by-name/os/osv-detector/package.nix
+++ b/pkgs/by-name/os/osv-detector/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "G-Rath";
-    repo = pname;
+    repo = "osv-detector";
     rev = "v${version}";
     hash = "sha256-vIkLrKyDeMfRe/0EPhlKlHAO6XB0/OFY5mTUHeZbcg8=";
   };
diff --git a/pkgs/by-name/ot/otel-cli/package.nix b/pkgs/by-name/ot/otel-cli/package.nix
index a3550e94225b..0ed768400d9d 100644
--- a/pkgs/by-name/ot/otel-cli/package.nix
+++ b/pkgs/by-name/ot/otel-cli/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "equinix-labs";
-    repo = pname;
+    repo = "otel-cli";
     rev = "v${version}";
     hash = "sha256-JYi9CbP4mUhX0zNjhi6QlBzLKcj2zdPwlyBSIYKp6vk=";
   };
diff --git a/pkgs/by-name/ot/ots/package.nix b/pkgs/by-name/ot/ots/package.nix
index c88430e76097..e370123c6f71 100644
--- a/pkgs/by-name/ot/ots/package.nix
+++ b/pkgs/by-name/ot/ots/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "sniptt-official";
-    repo = pname;
+    repo = "ots";
     rev = "v${version}";
     hash = "sha256-GOCuH9yiVs3N3sHCCoSGaQkaaJs4NY/klNBRWjZGLE4=";
   };
diff --git a/pkgs/by-name/ov/overmind/package.nix b/pkgs/by-name/ov/overmind/package.nix
index 54bbc8153267..6325a76239b3 100644
--- a/pkgs/by-name/ov/overmind/package.nix
+++ b/pkgs/by-name/ov/overmind/package.nix
@@ -24,7 +24,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "DarthSim";
-    repo = pname;
+    repo = "overmind";
     rev = "v${version}";
     sha256 = "sha256-wX29nFmzmbxbaXtwIWZNvueXFv9SKIOqexkc5pEITpw=";
   };
diff --git a/pkgs/by-name/ow/owncast/package.nix b/pkgs/by-name/ow/owncast/package.nix
index 66a2c11e9210..c1b8e0fbbd27 100644
--- a/pkgs/by-name/ow/owncast/package.nix
+++ b/pkgs/by-name/ow/owncast/package.nix
@@ -5,12 +5,11 @@
   nixosTests,
   bash,
   which,
-  ffmpeg,
+  ffmpeg-full,
   makeBinaryWrapper,
 }:
-
 let
-  version = "0.2.0";
+  version = "0.2.3";
 in
 buildGoModule {
   pname = "owncast";
@@ -19,21 +18,27 @@ buildGoModule {
     owner = "owncast";
     repo = "owncast";
     rev = "v${version}";
-    hash = "sha256-MdquhDdbOdP1shnKHBlzQrSDe41fp0qnMzgaqL89jTk=";
+    hash = "sha256-JCIB4G3cOSkEEO/jcsj4mUP+HeQfgn0jX4OL8NX9/C0=";
   };
-  vendorHash = "sha256-ERilQZ8vnhGW1IEcLA4CcmozDooHKbnmASMw87tjYD4=";
+  vendorHash = "sha256-FuynEBoPS0p1bRgmaeCxn1RPqbYHcltZpQ9SE71xHEE=";
 
-  propagatedBuildInputs = [ ffmpeg ];
+  propagatedBuildInputs = [ ffmpeg-full ];
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
+  # lefthook is included as a tool in go.mod for a pre-commit hook, but causes the build to fail
+  preBuild = ''
+    # Remove lefthook from tools section in go.mod
+    sed -i '/tool (/,/)/{ /[[:space:]]*github.com\/evilmartians\/lefthook[[:space:]]*$/d; }' go.mod
+  '';
+
   postInstall = ''
     wrapProgram $out/bin/owncast \
       --prefix PATH : ${
         lib.makeBinPath [
           bash
           which
-          ffmpeg
+          ffmpeg-full
         ]
       }
   '';
@@ -51,8 +56,10 @@ buildGoModule {
     homepage = "https://owncast.online";
     license = licenses.mit;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ MayNiklas ];
+    maintainers = with maintainers; [
+      flexiondotorg
+      MayNiklas
+    ];
     mainProgram = "owncast";
   };
-
 }
diff --git a/pkgs/by-name/ox/oxidized/.bundle/config b/pkgs/by-name/ox/oxidized/.bundle/config
new file mode 100644
index 000000000000..ccff7eafdc14
--- /dev/null
+++ b/pkgs/by-name/ox/oxidized/.bundle/config
@@ -0,0 +1 @@
+BUNDLE_BUILD__RUGGED: --with-ssh
diff --git a/pkgs/by-name/ox/oxidized/Gemfile.lock b/pkgs/by-name/ox/oxidized/Gemfile.lock
index 667fe8266d0d..84ab95bf8dd6 100644
--- a/pkgs/by-name/ox/oxidized/Gemfile.lock
+++ b/pkgs/by-name/ox/oxidized/Gemfile.lock
@@ -8,7 +8,7 @@ GEM
     bcrypt_pbkdf (1.1.1-x86_64-darwin)
     charlock_holmes (0.7.9)
     date (3.4.1)
-    ed25519 (1.3.0)
+    ed25519 (1.4.0)
     emk-sinatra-url-for (0.2.1)
       sinatra (>= 0.9.1.1)
     haml (6.3.0)
@@ -16,7 +16,7 @@ GEM
       thor
       tilt
     htmlentities (4.3.4)
-    json (2.11.3)
+    json (2.12.0)
     logger (1.7.0)
     multi_json (1.15.0)
     mustermann (3.0.3)
@@ -60,17 +60,17 @@ GEM
       puma (>= 3.11.4)
       sinatra (>= 1.4.6)
       sinatra-contrib (>= 1.4.6)
-    psych (5.2.3)
+    psych (5.2.6)
       date
       stringio
     puma (6.6.0)
       nio4r (~> 2.0)
-    rack (3.1.13)
+    rack (3.1.14)
     rack-protection (4.1.1)
       base64 (>= 0.1.0)
       logger (>= 1.6.0)
       rack (>= 3.0.0, < 4)
-    rack-session (2.1.0)
+    rack-session (2.1.1)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
     ruby2_keywords (0.0.5)
diff --git a/pkgs/by-name/ox/oxidized/gemset.nix b/pkgs/by-name/ox/oxidized/gemset.nix
index c946d8773f98..b97b55961bfc 100644
--- a/pkgs/by-name/ox/oxidized/gemset.nix
+++ b/pkgs/by-name/ox/oxidized/gemset.nix
@@ -54,10 +54,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0zb2dr2ihb1qiknn5iaj1ha1w9p7lj9yq5waasndlfadz225ajji";
+      sha256 = "01n5rbyws1ijwc5dw7s88xx3zzacxx9k97qn8x11b6k8k18pzs8n";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.4.0";
   };
   emk-sinatra-url-for = {
     dependencies = [ "sinatra" ];
@@ -100,10 +100,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1hfcz73wszgqprg2pr83qjbyfb0k93frbdvyhgmw0ryyl9cgc44s";
+      sha256 = "0l0av82l1i5703fd5qnxr263zw21xmbpx737av3r9pjn0w0cw3xk";
       type = "gem";
     };
-    version = "2.11.3";
+    version = "2.12.0";
   };
   logger = {
     groups = [ "default" ];
@@ -291,10 +291,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vjrx3yd596zzi42dcaq5xw7hil1921r769dlbz08iniaawlp9c4";
+      sha256 = "0vii1xc7x81hicdbp7dlllhmbw5w3jy20shj696n0vfbbnm2hhw1";
       type = "gem";
     };
-    version = "5.2.3";
+    version = "5.2.6";
   };
   puma = {
     dependencies = [ "nio4r" ];
@@ -312,10 +312,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14jpch41i6iclbgc8rykvkyn7ii8s9dwvn98k96qi0hqcbdpj30p";
+      sha256 = "0i2bjh42cmlkwxjrldqj8g5sfrasdp64xhfr25kvp4ziilm3qqc4";
       type = "gem";
     };
-    version = "3.1.13";
+    version = "3.1.14";
   };
   rack-protection = {
     dependencies = [
@@ -341,10 +341,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1452c1bhh6fdnv17s1z65ajwh08axqnlmkhnr1qyyn2vacb3jz23";
+      sha256 = "1sg4laz2qmllxh1c5sqlj9n1r7scdn08p3m4b0zmhjvyx9yw0v8b";
       type = "gem";
     };
-    version = "2.1.0";
+    version = "2.1.1";
   };
   ruby2_keywords = {
     groups = [ "default" ];
diff --git a/pkgs/by-name/ox/oxigraph/package.nix b/pkgs/by-name/ox/oxigraph/package.nix
index 7aaa0f023f6d..9b85bc6e75ec 100644
--- a/pkgs/by-name/ox/oxigraph/package.nix
+++ b/pkgs/by-name/ox/oxigraph/package.nix
@@ -10,8 +10,8 @@ rustPlatform.buildRustPackage rec {
   version = "0.4.9";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "oxigraph";
+    repo = "oxigraph";
     rev = "v${version}";
     hash = "sha256-sv9LpAoPQ4oFrGI6j6NgVZwEwpM1wt93lHkUwnvmhIY=";
     fetchSubmodules = true;
diff --git a/pkgs/by-name/pa/pactorio/package.nix b/pkgs/by-name/pa/pactorio/package.nix
index bbced1b8b592..ae57c9eac102 100644
--- a/pkgs/by-name/pa/pactorio/package.nix
+++ b/pkgs/by-name/pa/pactorio/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "figsoda";
-    repo = pname;
+    repo = "pactorio";
     rev = "v${version}";
     sha256 = "sha256-3+irejeDltf7x+gyJxWBgvPgpQx5uU3DewU23Z4Nr/A=";
   };
diff --git a/pkgs/by-name/pa/paleta/package.nix b/pkgs/by-name/pa/paleta/package.nix
index 072acba9cb02..6517e38ad6ab 100644
--- a/pkgs/by-name/pa/paleta/package.nix
+++ b/pkgs/by-name/pa/paleta/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "nate-xyz";
-    repo = pname;
+    repo = "paleta";
     rev = "v${version}";
     hash = "sha256-c+X49bMywstRg7cSAbbpG/vd8OUB7RhdQVRumTIBDDk=";
   };
diff --git a/pkgs/by-name/pa/panicparse/package.nix b/pkgs/by-name/pa/panicparse/package.nix
index f0ab5e64e45e..4e23655a5309 100644
--- a/pkgs/by-name/pa/panicparse/package.nix
+++ b/pkgs/by-name/pa/panicparse/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "maruel";
-    repo = pname;
+    repo = "panicparse";
     rev = "v${version}";
     sha256 = "sha256-EBNOHI04v47sXAWrjHsU4pixP4TPOuHy8S3YmlkiLN4=";
   };
diff --git a/pkgs/by-name/pa/pantheon-tweaks/package.nix b/pkgs/by-name/pa/pantheon-tweaks/package.nix
index e90b3365cadc..6e67a74f74d3 100644
--- a/pkgs/by-name/pa/pantheon-tweaks/package.nix
+++ b/pkgs/by-name/pa/pantheon-tweaks/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "pantheon-tweaks";
-    repo = pname;
+    repo = "pantheon-tweaks";
     rev = version;
     hash = "sha256-+dkjmeY4WJfXwgNR8HlRaVfvS/2icbi8eSAkiB9x7uI=";
   };
diff --git a/pkgs/by-name/pa/papeer/package.nix b/pkgs/by-name/pa/papeer/package.nix
index c447075c5137..8c4183f5f37d 100644
--- a/pkgs/by-name/pa/papeer/package.nix
+++ b/pkgs/by-name/pa/papeer/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "lapwat";
-    repo = pname;
+    repo = "papeer";
     rev = "v${version}";
     hash = "sha256-dkOLlWeG6ixbqLJU/1x2R1meKpcXb63C8EXH5FlD38k=";
   };
diff --git a/pkgs/by-name/pa/papirus-folders/package.nix b/pkgs/by-name/pa/papirus-folders/package.nix
index 11c08f69406a..e43337172e2a 100644
--- a/pkgs/by-name/pa/papirus-folders/package.nix
+++ b/pkgs/by-name/pa/papirus-folders/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "papirus-folders";
-  version = "1.13.1";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = "papirus-folders";
     rev = "v${version}";
-    sha256 = "sha256-BY1hnAGz31Deffy/EGKy/nuPKmpAA0u8FzPYgr1Plfs=";
+    sha256 = "sha256-pkzYhE4dNqyl5TvXQqs915QzwZwsXtdAQ+4B29oe9LA=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/pa/parlatype/package.nix b/pkgs/by-name/pa/parlatype/package.nix
index 56080d475222..e4b76c0e81f8 100644
--- a/pkgs/by-name/pa/parlatype/package.nix
+++ b/pkgs/by-name/pa/parlatype/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "gkarsay";
-    repo = pname;
+    repo = "parlatype";
     rev = "v${version}";
     sha256 = "1wi9f23zgvsa98xcxgghm53jlafnr3pan1zl4gkn0yd8b2d6avhk";
   };
diff --git a/pkgs/by-name/pa/parseable/package.nix b/pkgs/by-name/pa/parseable/package.nix
index ab2f9187c8d0..7cec83344729 100644
--- a/pkgs/by-name/pa/parseable/package.nix
+++ b/pkgs/by-name/pa/parseable/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "parseable";
-  version = "2.2.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "parseablehq";
     repo = "parseable";
     tag = "v${version}";
-    hash = "sha256-oMDFi5cBcghxzwmmR/Gg50PcYCb6HaxDqWA8vVyw30Y=";
+    hash = "sha256-+l3z8afss8NlyHWrUujtJLYKDlhq8EXfB/skpKTg+gU=";
   };
 
   LOCAL_ASSETS_PATH = fetchzip {
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-kVLUSu+9jW3M0YosmpZWDIKCj7GilZZibMMtufHPdfM=";
+  cargoHash = "sha256-TCKYr288Ish2j+KNgLS462K7NdllzJRxcPKpXyYryzY=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/pa/parsero/package.nix b/pkgs/by-name/pa/parsero/package.nix
index a059e44a17f0..c1d2de15f2fc 100644
--- a/pkgs/by-name/pa/parsero/package.nix
+++ b/pkgs/by-name/pa/parsero/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "parsero";
   version = "0.81";
 
   src = fetchFromGitHub {
     owner = "behindthefirewalls";
-    repo = pname;
+    repo = "parsero";
     rev = "e5b585a19b79426975a825cafa4cc8a353cd267e";
     sha256 = "rqupeJxslL3AfQ+CzBWRb4ZS32VoYd8hlA+eACMKGPY=";
   };
diff --git a/pkgs/by-name/pa/passphrase2pgp/package.nix b/pkgs/by-name/pa/passphrase2pgp/package.nix
index 001eae79cbbf..eada0badb888 100644
--- a/pkgs/by-name/pa/passphrase2pgp/package.nix
+++ b/pkgs/by-name/pa/passphrase2pgp/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "skeeto";
-    repo = pname;
+    repo = "passphrase2pgp";
     rev = "v${version}";
     hash = "sha256-it1XYzLiteL0oq4SZp5E3s6oSkFKi3ZY0Lt+P0gmNag=";
   };
diff --git a/pkgs/by-name/pa/pastebinit/package.nix b/pkgs/by-name/pa/pastebinit/package.nix
index d798f11ece56..b4f52a0c411e 100644
--- a/pkgs/by-name/pa/pastebinit/package.nix
+++ b/pkgs/by-name/pa/pastebinit/package.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
   pname = "pastebinit";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "pastebinit";
+    repo = "pastebinit";
     rev = version;
     hash = "sha256-vuAWkHlQM6QTWarThpSbY0qrxzej0GvLU0jT2JOS/qc=";
   };
diff --git a/pkgs/by-name/pa/pastel/package.nix b/pkgs/by-name/pa/pastel/package.nix
index 01f2f3623b3a..87e3cfb3887d 100644
--- a/pkgs/by-name/pa/pastel/package.nix
+++ b/pkgs/by-name/pa/pastel/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "sharkdp";
-    repo = pname;
+    repo = "pastel";
     rev = "v${version}";
     sha256 = "sha256-kr2aLRd143ksVx42ZDO/NILydObinn3AwPCniXVVmY0=";
   };
diff --git a/pkgs/by-name/pb/pbgopy/package.nix b/pkgs/by-name/pb/pbgopy/package.nix
index a58cce6be115..2647a80cc856 100644
--- a/pkgs/by-name/pb/pbgopy/package.nix
+++ b/pkgs/by-name/pb/pbgopy/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "nakabonne";
-    repo = pname;
+    repo = "pbgopy";
     rev = "v${version}";
     sha256 = "sha256-P/MFDFMsqSTVErTM9izJJSMIbiOcbQ9Ya10/w6NRcYw=";
   };
diff --git a/pkgs/by-name/pc/pc-ble-driver/package.nix b/pkgs/by-name/pc/pc-ble-driver/package.nix
index e7bce66d8175..c69b3cbdb76a 100644
--- a/pkgs/by-name/pc/pc-ble-driver/package.nix
+++ b/pkgs/by-name/pc/pc-ble-driver/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "NordicSemiconductor";
-    repo = pname;
+    repo = "pc-ble-driver";
     rev = "v${version}";
     hash = "sha256-srH7Gdiy9Lsv68fst/9jhifx03R2e+4kMia6pU/oCZg=";
   };
diff --git a/pkgs/by-name/pc/pcapc/package.nix b/pkgs/by-name/pc/pcapc/package.nix
index 0e7d8121d9cd..2c1fd2144f45 100644
--- a/pkgs/by-name/pc/pcapc/package.nix
+++ b/pkgs/by-name/pc/pcapc/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitLab {
     owner = "post-factum";
-    repo = pname;
+    repo = "pcapc";
     rev = "v${version}";
     hash = "sha256-oDg9OSvi9aQsZ2SQm02NKAcppE0w5SGZaI13gdp7gv4=";
   };
diff --git a/pkgs/by-name/pd/pdfcpu/package.nix b/pkgs/by-name/pd/pdfcpu/package.nix
index f05af5f56ea7..2563b35be678 100644
--- a/pkgs/by-name/pd/pdfcpu/package.nix
+++ b/pkgs/by-name/pd/pdfcpu/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "pdfcpu";
-  version = "0.10.2";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "pdfcpu";
-    repo = pname;
+    repo = "pdfcpu";
     rev = "v${version}";
-    hash = "sha256-vfU0mFfOW9K3rgVNdfN2RBiKJLbijoVMtuywsoclEgE=";
+    hash = "sha256-HTqaFl/ug/4sdchZBD4VQiXbD1L0/DVf2efZ3BV/vx4=";
     # Apparently upstream requires that the compiled executable will know the
     # commit hash and the date of the commit. This information is also presented
     # in the output of `pdfcpu version` which we use as a sanity check in the
@@ -37,7 +37,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-27YTR/vYuNggjUIbpKs3/yEJheUXMaLZk8quGPwgNNk=";
+  vendorHash = "sha256-5qB3zXiee4yMFpV8Ia8jICZaw+8Zpxd2Fs7DZ/DW/Jg=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pd/pdfmm/package.nix b/pkgs/by-name/pd/pdfmm/package.nix
index 718d6bde3065..0afddc6f64ae 100644
--- a/pkgs/by-name/pd/pdfmm/package.nix
+++ b/pkgs/by-name/pd/pdfmm/package.nix
@@ -10,13 +10,13 @@
   resholve,
 }:
 
-resholve.mkDerivation rec {
+resholve.mkDerivation {
   pname = "pdfmm";
   version = "unstable-2019-01-24";
 
   src = fetchFromGitHub {
     owner = "jpfleury";
-    repo = pname;
+    repo = "pdfmm";
     rev = "45ee7796659d23bb030bf06647f1af85e1d2b52d";
     hash = "sha256-TOISD/2g7MwnLrtpMnfr2Ln0IiwlJVNavWl4eh/uwN0=";
   };
diff --git a/pkgs/by-name/pd/pdftitle/package.nix b/pkgs/by-name/pd/pdftitle/package.nix
index a8a134e3b645..7ddc73feb785 100644
--- a/pkgs/by-name/pd/pdftitle/package.nix
+++ b/pkgs/by-name/pd/pdftitle/package.nix
@@ -2,24 +2,33 @@
   lib,
   fetchFromGitHub,
   python3Packages,
+  openai,
   pdfminer,
+
+  withOpenai ? false,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "pdftitle";
-  version = "0.18";
+  version = "0.20";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "metebalci";
     repo = "pdftitle";
     tag = "v${version}";
-    hash = "sha256-rGGO4Cy+DZRU3ywb6Jq55JiM8ALgs/9wQmeXcSbPpG0=";
+    hash = "sha256-05SaAXYJ7l0ZldYufj0x9mYRwwGT7vlmq9a+ZF4pYiA=";
   };
 
   build-system = with python3Packages; [ setuptools ];
 
-  dependencies = with python3Packages; [ pdfminer ];
+  dependencies =
+    with python3Packages;
+    [
+      pdfminer
+      python-dotenv
+    ]
+    ++ lib.optional withOpenai openai;
 
   pythonImportsCheck = [ "pdftitle" ];
 
diff --git a/pkgs/by-name/pe/pebble/package.nix b/pkgs/by-name/pe/pebble/package.nix
index f3e70c2d1295..f3b0ff9e0418 100644
--- a/pkgs/by-name/pe/pebble/package.nix
+++ b/pkgs/by-name/pe/pebble/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "letsencrypt";
-    repo = pname;
+    repo = "pebble";
     rev = "v${version}";
     hash = "sha256-YPU/bl7h6rOWg+5ut0Thn2UupeKpJ7u4KXc2svIeZEM=";
   };
diff --git a/pkgs/by-name/pe/peering-manager/package.nix b/pkgs/by-name/pe/peering-manager/package.nix
index 7dd8f0238d2d..dc3d23069ccf 100644
--- a/pkgs/by-name/pe/peering-manager/package.nix
+++ b/pkgs/by-name/pe/peering-manager/package.nix
@@ -12,8 +12,8 @@ python3.pkgs.buildPythonApplication rec {
   version = "1.8.3";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "peering-manager";
+    repo = "peering-manager";
     tag = "v${version}";
     sha256 = "sha256-UV1zSX9C9y5faOBUQ7bfj2DT6ffhMW28MIT7SaYjMgw=";
   };
diff --git a/pkgs/by-name/pe/percollate/package.nix b/pkgs/by-name/pe/percollate/package.nix
index 174e4de6d5ee..2b7c761ae05c 100644
--- a/pkgs/by-name/pe/percollate/package.nix
+++ b/pkgs/by-name/pe/percollate/package.nix
@@ -12,7 +12,7 @@ buildNpmPackage rec {
 
   src = fetchFromGitHub {
     owner = "danburzo";
-    repo = pname;
+    repo = "percollate";
     rev = "v${version}";
     hash = "sha256-JpdSEockALXtuuMMi5mgD5AXcayojyK0qMMWF+XFfZE=";
   };
diff --git a/pkgs/by-name/pf/pffft/package.nix b/pkgs/by-name/pf/pffft/package.nix
index 07cca51f09a1..c55074f98a49 100644
--- a/pkgs/by-name/pf/pffft/package.nix
+++ b/pkgs/by-name/pf/pffft/package.nix
@@ -5,13 +5,13 @@
   cmake,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "pffft";
   version = "unstable-2022-04-10";
 
   src = fetchFromGitHub {
     owner = "marton78";
-    repo = pname;
+    repo = "pffft";
     rev = "08f5ed2618ac06d7dcc83d209d7253dc215274d5";
     sha256 = "sha256-9LfLQ17IRsbEwGQJZzhW2Av4en1KuJVicLrS2AyjUZY=";
   };
diff --git a/pkgs/by-name/pg/pg_activity/package.nix b/pkgs/by-name/pg/pg_activity/package.nix
index a162cf283a7b..595de7b7d003 100644
--- a/pkgs/by-name/pg/pg_activity/package.nix
+++ b/pkgs/by-name/pg/pg_activity/package.nix
@@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "dalibo";
-    repo = pname;
+    repo = "pg_activity";
     tag = "v${version}";
     sha256 = "sha256-7nHtJl/b2pZqiJbpWArMS5jh7B8dv8V1esic6uFPV/0=";
   };
diff --git a/pkgs/by-name/pg/pg_featureserv/package.nix b/pkgs/by-name/pg/pg_featureserv/package.nix
index c12bf67c2f22..5079509c8e42 100644
--- a/pkgs/by-name/pg/pg_featureserv/package.nix
+++ b/pkgs/by-name/pg/pg_featureserv/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "CrunchyData";
-    repo = pname;
+    repo = "pg_featureserv";
     rev = "v${version}";
     sha256 = "sha256-GsloUZFgrOrJc23vKv+8iSeyIEKblaukPSCpZGRtSL4=";
   };
diff --git a/pkgs/by-name/pg/pg_flame/package.nix b/pkgs/by-name/pg/pg_flame/package.nix
index 35f860063d1a..7781dfc31ea2 100644
--- a/pkgs/by-name/pg/pg_flame/package.nix
+++ b/pkgs/by-name/pg/pg_flame/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "mgartner";
-    repo = pname;
+    repo = "pg_flame";
     rev = "v${version}";
     hash = "sha256-glvIv9GHIbp6IZUvZo9fyvkJ6QR03nMlrAOpZ3HfA6g=";
   };
diff --git a/pkgs/by-name/pg/pgmetrics/package.nix b/pkgs/by-name/pg/pgmetrics/package.nix
index d2ff1864fbff..5e9ef426b4b0 100644
--- a/pkgs/by-name/pg/pgmetrics/package.nix
+++ b/pkgs/by-name/pg/pgmetrics/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "rapidloop";
-    repo = pname;
+    repo = "pgmetrics";
     rev = "v${version}";
     sha256 = "sha256-SaJc09RRm8MR8OiBIznCRHLhpflQ4Gi8tlXQvYd/j9A=";
   };
diff --git a/pkgs/by-name/pg/pgroll/package.nix b/pkgs/by-name/pg/pgroll/package.nix
index 18f4647e8484..a68235ea8f98 100644
--- a/pkgs/by-name/pg/pgroll/package.nix
+++ b/pkgs/by-name/pg/pgroll/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "pgroll";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "xataio";
     repo = "pgroll";
     tag = "v${version}";
-    hash = "sha256-hmFCXVlcqvOXbDkHcsWcdVoxZoMe+Gaji011kCqU0lI=";
+    hash = "sha256-mueZ2x7yB9jrmyCI2Doox4rLUDUhwqvUUcotDvcLqvo=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/pg/pgweb/package.nix b/pkgs/by-name/pg/pgweb/package.nix
index 7b59121c4f54..28e073de8e41 100644
--- a/pkgs/by-name/pg/pgweb/package.nix
+++ b/pkgs/by-name/pg/pgweb/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "sosedoff";
-    repo = pname;
+    repo = "pgweb";
     rev = "v${version}";
     hash = "sha256-gZK8+H3dBMzSVyE96E7byihKMR4+1YlVFZJtCTGUZwI=";
   };
diff --git a/pkgs/by-name/ph/phantomsocks/package.nix b/pkgs/by-name/ph/phantomsocks/package.nix
index 83cbe8435c77..a5dfea20714d 100644
--- a/pkgs/by-name/ph/phantomsocks/package.nix
+++ b/pkgs/by-name/ph/phantomsocks/package.nix
@@ -9,13 +9,13 @@
   withRawsocket ? (stdenv.hostPlatform.isLinux && !withPcap),
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "phantomsocks";
   version = "unstable-2023-11-30";
 
   src = fetchFromGitHub {
     owner = "macronut";
-    repo = pname;
+    repo = "phantomsocks";
     rev = "b1b13c5b88cf3bac54f39c37c0ffcb0b46e31049";
     hash = "sha256-ptCzd2/8dNHjAkhwA2xpZH8Ki/9DnblHI2gAIpgM+8E=";
   };
diff --git a/pkgs/by-name/ph/phetch/package.nix b/pkgs/by-name/ph/phetch/package.nix
index a198f7c0443b..b795386ced24 100644
--- a/pkgs/by-name/ph/phetch/package.nix
+++ b/pkgs/by-name/ph/phetch/package.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "xvxx";
-    repo = pname;
+    repo = "phetch";
     tag = "v${version}";
     hash = "sha256-J+ka7/B37WzVPPE2Krkd/TIiVwuKfI2QYWmT0JHgBGQ=";
   };
diff --git a/pkgs/by-name/ph/phraze/package.nix b/pkgs/by-name/ph/phraze/package.nix
index 4d955ec9fa12..6b54abdc47f0 100644
--- a/pkgs/by-name/ph/phraze/package.nix
+++ b/pkgs/by-name/ph/phraze/package.nix
@@ -10,19 +10,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "phraze";
-  version = "0.3.19";
+  version = "0.3.23";
 
   src = fetchFromGitHub {
     owner = "sts10";
     repo = "phraze";
     rev = "v${version}";
-    hash = "sha256-4RdPN2l0tQbxgTVxwdl0APYD8h9DrF9f5MIQkcozt48=";
+    hash = "sha256-CQhzH6x8Fxx0ynHbLh8FTY7urbiXHrvTbMh+/TAwS2A=";
   };
 
   doCheck = true;
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hXo1pdbOZ/qNDTm3CcmOIgef7u6Imn25luJdsCVeg5I=";
+  cargoHash = "sha256-d4qj4rvH5CyHTH3RWDV6ADSGK/kz6yQLp3JjQdb6Wyo=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pi/pianotrans/package.nix b/pkgs/by-name/pi/pianotrans/package.nix
index 3d73cbf97e6c..61b5af46512f 100644
--- a/pkgs/by-name/pi/pianotrans/package.nix
+++ b/pkgs/by-name/pi/pianotrans/package.nix
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "azuwis";
-    repo = pname;
+    repo = "pianotrans";
     rev = "v${version}";
     hash = "sha256-gRbyUQmPtGvx5QKAyrmeJl0stp7hwLBWwjSbJajihdE=";
   };
diff --git a/pkgs/by-name/pi/picoloop/package.nix b/pkgs/by-name/pi/picoloop/package.nix
index 2ea5d75e0b0a..b96de2311fca 100644
--- a/pkgs/by-name/pi/picoloop/package.nix
+++ b/pkgs/by-name/pi/picoloop/package.nix
@@ -15,9 +15,9 @@ stdenv.mkDerivation rec {
   version = "0.77e";
 
   src = fetchFromGitHub {
-    repo = pname;
+    repo = "picoloop";
     owner = "yoyz";
-    rev = "${pname}-${version}";
+    rev = "picoloop-${version}";
     sha256 = "0i8j8rgyha3ara6d4iis3wcimszf2csxdwrm5yq0wyhg74g7cvjd";
   };
 
diff --git a/pkgs/by-name/pi/pict-rs/package.nix b/pkgs/by-name/pi/pict-rs/package.nix
index b75a4b8a74db..1590119c6d70 100644
--- a/pkgs/by-name/pi/pict-rs/package.nix
+++ b/pkgs/by-name/pi/pict-rs/package.nix
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitea {
     domain = "git.asonix.dog";
     owner = "asonix";
-    repo = pname;
+    repo = "pict-rs";
     rev = "v${version}";
     sha256 = "sha256-ifuN3Kb7Hhq8H/eoZcumO5yyrxOCA+nWQQvAdFk7w2Q=";
   };
diff --git a/pkgs/by-name/pi/pigpio/package.nix b/pkgs/by-name/pi/pigpio/package.nix
new file mode 100644
index 000000000000..ddde61ca0b7b
--- /dev/null
+++ b/pkgs/by-name/pi/pigpio/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  buildPythonPackage ? null,
+}:
+
+let
+  mkDerivation =
+    if builtins.isNull buildPythonPackage then stdenv.mkDerivation else buildPythonPackage;
+in
+mkDerivation rec {
+  pname = "pigpio";
+  version = "79";
+
+  src = fetchFromGitHub {
+    owner = "joan2937";
+    repo = "pigpio";
+    tag = "v${version}";
+    hash = "sha256-Z+SwUlBbtWtnbjTe0IghR3gIKS43ZziN0amYtmXy7HE=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  meta = {
+    description = "C library for the Raspberry which allows control of the General Purpose Input Outputs (GPIO)";
+    homepage = "https://github.com/joan2937/pigpio";
+    license = with lib.licenses; [ unlicense ];
+    maintainers = with lib.maintainers; [ doronbehar ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/pi/pigz/package.nix b/pkgs/by-name/pi/pigz/package.nix
index 8562b76e13bf..c1c390993993 100644
--- a/pkgs/by-name/pi/pigz/package.nix
+++ b/pkgs/by-name/pi/pigz/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "madler";
-    repo = pname;
+    repo = "pigz";
     tag = "v${version}";
     sha256 = "sha256-PzdxyO4mCg2jE/oBk1MH+NUdWM95wIIIbncBg71BkmQ=";
   };
diff --git a/pkgs/by-name/pi/pinsel/package.nix b/pkgs/by-name/pi/pinsel/package.nix
index 0fc192511c84..4699aabe70b6 100644
--- a/pkgs/by-name/pi/pinsel/package.nix
+++ b/pkgs/by-name/pi/pinsel/package.nix
@@ -8,13 +8,13 @@
   glib,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "pinsel";
   version = "unstable-2021-09-13";
 
   src = fetchFromGitHub {
     owner = "Nooo37";
-    repo = pname;
+    repo = "pinsel";
     rev = "24b0205ca041511b3efb2a75ef296539442f9f54";
     sha256 = "sha256-w+jiKypZODsmZq3uWGNd8PZhe1SowHj0thcQTX8WHfQ=";
   };
diff --git a/pkgs/by-name/pi/pinyin-tool/package.nix b/pkgs/by-name/pi/pinyin-tool/package.nix
index bbd3e0b42097..b7b24bec28d4 100644
--- a/pkgs/by-name/pi/pinyin-tool/package.nix
+++ b/pkgs/by-name/pi/pinyin-tool/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "briankung";
-    repo = pname;
+    repo = "pinyin-tool";
     rev = version;
     sha256 = "1gwqwxlvdrm4sdyqkvpvvfi6jh6qqn6qybn0z66wm06k62f8zj5b";
   };
diff --git a/pkgs/by-name/pi/pipes-rs/package.nix b/pkgs/by-name/pi/pipes-rs/package.nix
index 9f1dee272b65..fadc16a23a80 100644
--- a/pkgs/by-name/pi/pipes-rs/package.nix
+++ b/pkgs/by-name/pi/pipes-rs/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "lhvy";
-    repo = pname;
+    repo = "pipes-rs";
     rev = "v${version}";
     sha256 = "sha256-NrBmkA7sV1RhfG9KEqQNMR5s0l2u66b7KK0toDjQIps=";
   };
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage rec {
   doInstallCheck = true;
 
   installCheckPhase = ''
-    if [[ "$("$out/bin/${pname}" --version)" == "${pname} ${version}" ]]; then
-      echo '${pname} smoke check passed'
+    if [[ "$("$out/bin/pipes-rs" --version)" == "pipes-rs ${version}" ]]; then
+      echo 'pipes-rs smoke check passed'
     else
-      echo '${pname} smoke check failed'
+      echo 'pipes-rs smoke check failed'
       return 1
     fi
   '';
diff --git a/pkgs/by-name/pi/piping-server-rust/package.nix b/pkgs/by-name/pi/piping-server-rust/package.nix
index cbdc1e60553a..88261b5d39d7 100644
--- a/pkgs/by-name/pi/piping-server-rust/package.nix
+++ b/pkgs/by-name/pi/piping-server-rust/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "nwtgck";
-    repo = pname;
+    repo = "piping-server-rust";
     rev = "v${version}";
     sha256 = "sha256-8kYaANVWmBOncTdhtjjbaYnEFQeuWjemdz/kTjwj2fw=";
   };
diff --git a/pkgs/by-name/pi/piscope/package.nix b/pkgs/by-name/pi/piscope/package.nix
new file mode 100644
index 000000000000..8191f53aa1c9
--- /dev/null
+++ b/pkgs/by-name/pi/piscope/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  # nativeBuildInputs
+  pkg-config,
+  wrapGAppsHook3,
+  installShellFiles,
+
+  # buildInputs
+  gtk3,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "piscope";
+  version = "0.8";
+
+  src = fetchFromGitHub {
+    owner = "joan2937";
+    repo = "piscope";
+    tag = "V${finalAttrs.version}";
+    hash = "sha256-VDrx/RLSpMhyD64PmdeWVacb9LleHakcy7D6zFxeyhw=";
+  };
+  # Fix FHS paths
+  postConfigure = ''
+    substituteInPlace piscope.c \
+      --replace /usr/share/piscope $out/share/piscope
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+    wrapGAppsHook3
+    installShellFiles
+  ];
+  buildInputs = [
+    gtk3
+  ];
+  # Upstream's Makefile assumes FHS
+  installPhase = ''
+    runHook preInstall
+
+    installBin piscope
+    install -D -m 0644 piscope.glade $out/share/piscope/piscope.glade
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "http://abyz.me.uk/rpi/pigpio/piscope.html";
+    description = "A logic analyser (digital waveform viewer) for the Raspberry";
+    license = lib.licenses.unlicense;
+    maintainers = with lib.maintainers; [ doronbehar ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/pi/pistol/package.nix b/pkgs/by-name/pi/pistol/package.nix
index b38a4a34e6e8..7e5df216e50f 100644
--- a/pkgs/by-name/pi/pistol/package.nix
+++ b/pkgs/by-name/pi/pistol/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "doronbehar";
-    repo = pname;
+    repo = "pistol";
     rev = "v${version}";
     sha256 = "sha256-/w2BenBIzhD0KHtELlFy7YGv0lykHrjrROZeW75gHis=";
   };
diff --git a/pkgs/by-name/pi/pix/package.nix b/pkgs/by-name/pi/pix/package.nix
index 323d9189c80d..87066c993e65 100644
--- a/pkgs/by-name/pi/pix/package.nix
+++ b/pkgs/by-name/pi/pix/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "linuxmint";
-    repo = pname;
+    repo = "pix";
     rev = version;
     hash = "sha256-c/+NQHvscW/XE49Twmg1Rk1IfsjReCtRQWffobZtgTs=";
   };
diff --git a/pkgs/by-name/pi/pixelflasher/package.nix b/pkgs/by-name/pi/pixelflasher/package.nix
index 5b20e7213998..71d9e9c4dc6b 100644
--- a/pkgs/by-name/pi/pixelflasher/package.nix
+++ b/pkgs/by-name/pi/pixelflasher/package.nix
@@ -10,14 +10,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "pixelflasher";
-  version = "7.11.4.0";
+  version = "8.0.1.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "badabing2005";
     repo = "PixelFlasher";
     tag = "v${version}";
-    hash = "sha256-TFvMxYGiRNpuwQyDmSqnksQ31azucZzXq9mZHvl/C4U=";
+    hash = "sha256-3cIrQ5MbYfWpxFZBJTg0h/Q8PHsWP4KYZvGUnhMEjK4=";
   };
 
   desktopItems = [
@@ -43,6 +43,7 @@ python3Packages.buildPythonApplication rec {
     lz4
     markdown
     platformdirs
+    polib
     protobuf4
     psutil
     pyperclip
diff --git a/pkgs/by-name/pi/pixi-pack/package.nix b/pkgs/by-name/pi/pixi-pack/package.nix
index 17d72dfda4b9..8be13f2aa4bd 100644
--- a/pkgs/by-name/pi/pixi-pack/package.nix
+++ b/pkgs/by-name/pi/pixi-pack/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pixi-pack";
-  version = "0.6.2";
+  version = "0.6.6";
 
   src = fetchFromGitHub {
     owner = "Quantco";
     repo = "pixi-pack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ccKJtGKhfYiJm8/2yOlCZtRECvax1dTgtNOtabzfhI4=";
+    hash = "sha256-U5I/wc0HDoi+EHQ3JIs2S/ky/uH5pA1KaTuTo6Bllus=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-+rwG9lPK0Ec7CCtVccwGrFOqfZqeXNA3WsN1QivABQA=";
+  cargoHash = "sha256-RqTaBs+kU8j6TmeX7cROZPEN4CeTKojwRJtXvfj2f8w=";
 
   buildInputs = [ openssl ];
 
diff --git a/pkgs/by-name/pk/pkg/package.nix b/pkgs/by-name/pk/pkg/package.nix
index 45c1319334e5..a6296a956d88 100644
--- a/pkgs/by-name/pk/pkg/package.nix
+++ b/pkgs/by-name/pk/pkg/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pkg";
-  version = "2.1.2";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "freebsd";
     repo = "pkg";
     rev = finalAttrs.version;
-    hash = "sha256-mIuUewuW+aw0ZDGstUadfHkjamDxPRp1O/YVZ9JuCtg=";
+    hash = "sha256-aqNJGor6gH/7XjwuT2uD7L89wn1kzsFKBMlitSVjUCM=";
   };
 
   setOutputFlags = false;
diff --git a/pkgs/by-name/pk/pkgsite/package.nix b/pkgs/by-name/pk/pkgsite/package.nix
index 67add1f5ad3a..0b917fcf7088 100644
--- a/pkgs/by-name/pk/pkgsite/package.nix
+++ b/pkgs/by-name/pk/pkgsite/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule {
   pname = "pkgsite";
-  version = "0-unstable-2025-05-06";
+  version = "0-unstable-2025-05-23";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "pkgsite";
-    rev = "1bc9132f566501f5f66bfcb147479cf741704cf4";
-    hash = "sha256-FfgwHiqbDhVp31YQzalveG+JVe93gXUq/XvTwPV7zsI=";
+    rev = "0e6de173c6b5ef31749de2ae384bb05ddc6726ba";
+    hash = "sha256-WRNw+BjUY8/gj7tcPs0Ifz47JtBlU+SEIt12EZmtOjw=";
   };
 
   vendorHash = "sha256-s8uYvMQENqeUN8DbZ/jNhcTe2dJeiE9UYPCPGeScO10=";
diff --git a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
index 11f6132ab4ff..f3e901fd2dbf 100644
--- a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
+++ b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "plasma-panel-colorizer";
-  version = "3.0.1";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "luisbocanegra";
     repo = "plasma-panel-colorizer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-d1NqC8m2ujNsAuHTKRiNz179DzlTc08SKtY/QKHB1xw=";
+    hash = "sha256-fqhuW7SoUluUJU0tv1MIUX1IhOn3j514Hlrdxlnqvvg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pl/plecost/package.nix b/pkgs/by-name/pl/plecost/package.nix
index 942b0f232665..bd017ea978aa 100644
--- a/pkgs/by-name/pl/plecost/package.nix
+++ b/pkgs/by-name/pl/plecost/package.nix
@@ -5,13 +5,13 @@
   fetchpatch,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "plecost";
   version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "iniqua";
-    repo = pname;
+    repo = "plecost";
     # Release is untagged
     rev = "aa40e504bee95cf731f0cc9f228bcf5fdfbe6194";
     sha256 = "K8ESI2EOqH9zBDfSKgVcTKjCMdRhBiwltIbXDt1vF+M=";
diff --git a/pkgs/by-name/pl/plex-desktop/package.nix b/pkgs/by-name/pl/plex-desktop/package.nix
index 8d114601d70f..0d69c75c4052 100644
--- a/pkgs/by-name/pl/plex-desktop/package.nix
+++ b/pkgs/by-name/pl/plex-desktop/package.nix
@@ -23,8 +23,8 @@
 }:
 let
   pname = "plex-desktop";
-  version = "1.108.1";
-  rev = "84";
+  version = "1.109.0";
+  rev = "85";
   meta = {
     homepage = "https://plex.tv/";
     description = "Streaming media player for Plex";
@@ -44,7 +44,7 @@ let
 
     src = fetchurl {
       url = "https://api.snapcraft.io/api/v1/snaps/download/qc6MFRM433ZhI1XjVzErdHivhSOhlpf0_${rev}.snap";
-      hash = "sha512-ZcP84maap5Dskf9yECd76gn5x+tWxyVcIo+c0P2VJiQ4VwN2KCgWmwH2JkHzafFCcCFm9EqFBrFlNXWEvnUieQ==";
+      hash = "sha512-BSnA84purHv6qIVELp+AJI2m6erTngnupbuoCZTaje6LCd2+5+U+7gqWdahmO1mxJEGvuBwzetdDrp1Ibz5a6A==";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/pl/plumber/package.nix b/pkgs/by-name/pl/plumber/package.nix
index 1c838f2456db..ef5fd9881c01 100644
--- a/pkgs/by-name/pl/plumber/package.nix
+++ b/pkgs/by-name/pl/plumber/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "streamdal";
-    repo = pname;
+    repo = "plumber";
     rev = "v${version}";
     hash = "sha256-0pyeCTkmS7gG51Xm4Gc62p+I5DRUA2F9tPHaZjO+/WE=";
   };
diff --git a/pkgs/by-name/pm/pm2/package.nix b/pkgs/by-name/pm/pm2/package.nix
index 6884ea8d91eb..731c0c8b0561 100644
--- a/pkgs/by-name/pm/pm2/package.nix
+++ b/pkgs/by-name/pm/pm2/package.nix
@@ -2,20 +2,26 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+  npm-lockfile-fix,
 }:
 
 buildNpmPackage rec {
   pname = "pm2";
-  version = "5.4.2";
+  version = "6.0.6";
 
   src = fetchFromGitHub {
     owner = "Unitech";
     repo = "pm2";
     rev = "v${version}";
-    hash = "sha256-8Fsh7rld7rtT55qVgj3/XbujNpZx0BfzTRcLjdPLFSA=";
+    hash = "sha256-ji6IOlPSEj+qpSusF3OX056KuZDL3JjvaTNT/UQTiqA=";
+
+    # Requested patch upstream: https://github.com/Unitech/pm2/pull/5985
+    postFetch = ''
+      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
+    '';
   };
 
-  npmDepsHash = "sha256-Rp3euhURkZgVyszyAwrIftL7lY4aoP+Q4kSQBFxwTcs=";
+  npmDepsHash = "sha256-b+SSal4eNruQOMNAFoLLJdzfFhz1T3EieDv4kTwwA1Y=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/po/podgrab/package.nix b/pkgs/by-name/po/podgrab/package.nix
index 6092a440923a..4f544c2f3cfe 100644
--- a/pkgs/by-name/po/podgrab/package.nix
+++ b/pkgs/by-name/po/podgrab/package.nix
@@ -5,13 +5,13 @@
   nixosTests,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "podgrab";
   version = "unstable-2021-04-14";
 
   src = fetchFromGitHub {
     owner = "akhilrex";
-    repo = pname;
+    repo = "podgrab";
     rev = "3179a875b8b638fb86d0e829d12a9761c1cd7f90";
     sha256 = "sha256-vhxIm20ZUi+RusrAsSY54tv/D570/oMO5qLz9dNqgqo=";
   };
diff --git a/pkgs/by-name/po/podman-tui/package.nix b/pkgs/by-name/po/podman-tui/package.nix
index 15a4d6bb0c62..b56e597385aa 100644
--- a/pkgs/by-name/po/podman-tui/package.nix
+++ b/pkgs/by-name/po/podman-tui/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "podman-tui";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     rev = "v${version}";
-    hash = "sha256-dtXJRoOb/FhGuCaRB43/8y2DM3ZgpYVts1ATzsVsUFE=";
+    hash = "sha256-t9VhDl4pBW5H5RhpskU8Us9NxpPJmyishKROvbAc2V0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/po/poetry2conda/package.nix b/pkgs/by-name/po/poetry2conda/package.nix
index ee2c500ad28d..f2e2c6b4b079 100644
--- a/pkgs/by-name/po/poetry2conda/package.nix
+++ b/pkgs/by-name/po/poetry2conda/package.nix
@@ -14,7 +14,7 @@ buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "dojeda";
-    repo = pname;
+    repo = "poetry2conda";
     rev = "v${version}";
     sha256 = "sha256-UqNoEGgStvqtxhYwExk7wO4SvATaM2kGaFbB5ViJa7U=";
   };
diff --git a/pkgs/by-name/po/polarity/package.nix b/pkgs/by-name/po/polarity/package.nix
index 0e3d35aae305..3d65af77c032 100644
--- a/pkgs/by-name/po/polarity/package.nix
+++ b/pkgs/by-name/po/polarity/package.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "polarity";
-  version = "latest-unstable-2025-05-14";
+  version = "latest-unstable-2025-05-19";
 
   src = fetchFromGitHub {
     owner = "polarity-lang";
     repo = "polarity";
-    rev = "6c0370011b827886e87b7afec644788a1a54f6f7";
-    hash = "sha256-RKuL0gn734eqNQHIsSA0kLF1qUNtyEUpYf8Zv359GAs=";
+    rev = "b715e6529210242d79f304d34170eba8473174b2";
+    hash = "sha256-/yq6fqjkZoEw4MhsOWlRdQciA/Wqds9TgCczcVQV8Rw=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/po/polkadot/package.nix b/pkgs/by-name/po/polkadot/package.nix
index d81e136d5174..85137d3cdbfc 100644
--- a/pkgs/by-name/po/polkadot/package.nix
+++ b/pkgs/by-name/po/polkadot/package.nix
@@ -17,13 +17,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "2503-2";
+  version = "2503-5";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot-sdk";
     rev = "polkadot-stable${version}";
-    hash = "sha256-sUBUWFAJ8PwWUVSqPef0SMJcvSt+bGruTW+GmJGTLdE=";
+    hash = "sha256-hQ0tXPore1kbezBCsacAsSZAB1GHXEp5BJatxdi19eI=";
 
     # the build process of polkadot requires a .git folder in order to determine
     # the git commit hash that is being built and add it to the version string.
@@ -45,7 +45,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-U3roe7rQL1BaHr3rKV1Dl7Lhjic3pZlxo2DpD9C2ong=";
+  cargoHash = "sha256-fK8EBgIdXHfxpNWUyquEutZpkTGSe11ZsLwe13ZZ1+0=";
 
   buildType = "production";
   buildAndTestSubdir = "polkadot";
diff --git a/pkgs/by-name/po/ponyc/package.nix b/pkgs/by-name/po/ponyc/package.nix
index 2fcb07cb780b..1a3d176c9642 100644
--- a/pkgs/by-name/po/ponyc/package.nix
+++ b/pkgs/by-name/po/ponyc/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (rec {
 
   src = fetchFromGitHub {
     owner = "ponylang";
-    repo = pname;
+    repo = "ponyc";
     rev = version;
     hash = "sha256-4gDv8UWTk0RWVNC4PU70YKSK9fIMbWBsQbHboVls2BA=";
     fetchSubmodules = true;
diff --git a/pkgs/by-name/po/popura/package.nix b/pkgs/by-name/po/popura/package.nix
index b28cee329d49..86fc33248c80 100644
--- a/pkgs/by-name/po/popura/package.nix
+++ b/pkgs/by-name/po/popura/package.nix
@@ -9,8 +9,8 @@ buildGoModule rec {
   version = "0.4.6";
 
   src = fetchFromGitHub {
-    owner = "${pname}-network";
-    repo = pname;
+    owner = "popura-network";
+    repo = "popura";
     rev = "v${version}";
     hash = "sha256-iCu6/vD4vgn7aGdwK+OB8ib/QwUwoFuxDUs7vqbTZQc=";
   };
diff --git a/pkgs/by-name/po/portal/package.nix b/pkgs/by-name/po/portal/package.nix
index c64c8050c531..1ec52592b8b5 100644
--- a/pkgs/by-name/po/portal/package.nix
+++ b/pkgs/by-name/po/portal/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "SpatiumPortae";
-    repo = pname;
+    repo = "portal";
     rev = "v${version}";
     sha256 = "sha256-hGB82a2WirUL1Tph6EuoITOQGYA0Lo4zOeKPC46B5Qk=";
   };
diff --git a/pkgs/by-name/po/portmidi/package.nix b/pkgs/by-name/po/portmidi/package.nix
index 3806a1be2d52..2cac8af54dc3 100644
--- a/pkgs/by-name/po/portmidi/package.nix
+++ b/pkgs/by-name/po/portmidi/package.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   version = "2.0.4";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "portmidi";
+    repo = "portmidi";
     rev = "v${version}";
     sha256 = "sha256-uqBeh9vBP6+V+FN4lfeGxePQcpZMDYUuAo/d9a5rQxU=";
   };
diff --git a/pkgs/by-name/po/pouf/package.nix b/pkgs/by-name/po/pouf/package.nix
index 780120135f6f..faed38561102 100644
--- a/pkgs/by-name/po/pouf/package.nix
+++ b/pkgs/by-name/po/pouf/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "mothsart";
-    repo = pname;
+    repo = "pouf";
     rev = version;
     hash = "sha256-tW86b9a7u1jyfmHjwjs+5DaUujRZH+VhGQsj0CBj0yk=";
   };
diff --git a/pkgs/by-name/po/power-calibrate/package.nix b/pkgs/by-name/po/power-calibrate/package.nix
index 5162b39f3f99..633db9812a3f 100644
--- a/pkgs/by-name/po/power-calibrate/package.nix
+++ b/pkgs/by-name/po/power-calibrate/package.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
-    repo = pname;
+    repo = "power-calibrate";
     rev = "V${version}";
     hash = "sha256-DZ6rXbhaSNy3TEX+lwv3tyKQ7BXOZ9ycrff/7pF60j0=";
   };
diff --git a/pkgs/by-name/po/powerjoular/package.nix b/pkgs/by-name/po/powerjoular/package.nix
index 9cb31c00c8f8..6df0ecac49c8 100644
--- a/pkgs/by-name/po/powerjoular/package.nix
+++ b/pkgs/by-name/po/powerjoular/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "joular";
-    repo = pname;
+    repo = "powerjoular";
     rev = version;
     hash = "sha256-fJYcJKbZ6PoTJSfEDEKPOy+CDwDRsaeAn/2BW5r4p7k=";
   };
diff --git a/pkgs/by-name/po/powerline-go/package.nix b/pkgs/by-name/po/powerline-go/package.nix
index 852a49f4981e..704b46a4a214 100644
--- a/pkgs/by-name/po/powerline-go/package.nix
+++ b/pkgs/by-name/po/powerline-go/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "justjanne";
-    repo = pname;
+    repo = "powerline-go";
     rev = "v${version}";
     hash = "sha256-DLw/6jnJo0IAh0/Y21mfCLP4GgTFlUGvuwyWJwhzYFU=";
   };
diff --git a/pkgs/by-name/pq/pqos-wrapper/package.nix b/pkgs/by-name/pq/pqos-wrapper/package.nix
index d993ad6b1db0..202b7972dfeb 100644
--- a/pkgs/by-name/pq/pqos-wrapper/package.nix
+++ b/pkgs/by-name/pq/pqos-wrapper/package.nix
@@ -4,14 +4,14 @@
   fetchFromGitLab,
   python3,
 }:
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication {
   pname = "pqos-wrapper";
   version = "unstable-2022-01-31";
 
   src = fetchFromGitLab {
     group = "sosy-lab";
     owner = "software";
-    repo = pname;
+    repo = "pqos-wrapper";
     rev = "ce816497a07dcb4b931652b98359e4601a292b15";
     hash = "sha256-SaYr6lVucpJjVtGgxRbDGYbOoBwdfEDVKtvD+M1L0o4=";
   };
diff --git a/pkgs/by-name/pr/pre-commit-hook-ensure-sops/package.nix b/pkgs/by-name/pr/pre-commit-hook-ensure-sops/package.nix
index 0352005f0726..46d477840186 100644
--- a/pkgs/by-name/pr/pre-commit-hook-ensure-sops/package.nix
+++ b/pkgs/by-name/pr/pre-commit-hook-ensure-sops/package.nix
@@ -12,7 +12,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "yuvipanda";
-    repo = pname;
+    repo = "pre-commit-hook-ensure-sops";
     tag = "v${version}";
     hash = "sha256-8sMmHNzmYwOmHYSWoZ4rKb/2lKziFmT6ux+s+chd/Do=";
   };
diff --git a/pkgs/by-name/pr/precice-config-visualizer/package.nix b/pkgs/by-name/pr/precice-config-visualizer/package.nix
index af1a86b366cd..48745d3c2a0c 100644
--- a/pkgs/by-name/pr/precice-config-visualizer/package.nix
+++ b/pkgs/by-name/pr/precice-config-visualizer/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "config-visualizer";
   version = "unstable-2022-02-23";
 
   src = fetchFromGitHub {
     owner = "precice";
-    repo = pname;
+    repo = "config-visualizer";
     rev = "60f2165f25352c8261f370dc4ceb64a8b422d4ec";
     hash = "sha256-2dnpkec9hN4oAqwu+1WmDJrfeu+JbfqZ6guv3bC4H1c=";
   };
diff --git a/pkgs/by-name/pr/pretalx/package.nix b/pkgs/by-name/pr/pretalx/package.nix
index 66afbf46c56f..a2dccadd422e 100644
--- a/pkgs/by-name/pr/pretalx/package.nix
+++ b/pkgs/by-name/pr/pretalx/package.nix
@@ -22,13 +22,13 @@ let
     };
   };
 
-  version = "2024.3.1";
+  version = "2025.1.0";
 
   src = fetchFromGitHub {
     owner = "pretalx";
     repo = "pretalx";
     rev = "v${version}";
-    hash = "sha256-y3BsNmLh9M5NgDPURCjCGWYci40hYcQtDVqsu2HqPRU=";
+    hash = "sha256-BlPmrfHbpsLI8DCldzoRudpf7T4SUpJXQA5h9o4Thek=";
   };
 
   meta = with lib; {
@@ -48,7 +48,7 @@ let
 
     sourceRoot = "${src.name}/src/pretalx/frontend/schedule-editor";
 
-    npmDepsHash = "sha256-i7awRuR7NxhpxN2IZuI01PsN6FjXht7BxTbB1k039HA=";
+    npmDepsHash = "sha256-8difCdoG7j75wqwuWA/VBRk9oTjsM0QqLnR0iLkd/FY=";
 
     npmBuildScript = "build";
 
@@ -79,6 +79,7 @@ python.pkgs.buildPythonApplication rec {
   ];
 
   pythonRelaxDeps = [
+    "beautifulsoup4"
     "bleach"
     "celery"
     "css-inline"
@@ -106,8 +107,8 @@ python.pkgs.buildPythonApplication rec {
       beautifulsoup4
       bleach
       celery
-      css-inline
       csscompressor
+      css-inline
       cssutils
       defusedcsv
       defusedxml
@@ -124,6 +125,8 @@ python.pkgs.buildPythonApplication rec {
       django-libsass
       django-scopes
       djangorestframework
+      drf-flex-fields
+      drf-spectacular
       libsass
       markdown
       pillow
diff --git a/pkgs/by-name/pr/pretalx/plugins/media-ccc-de.nix b/pkgs/by-name/pr/pretalx/plugins/media-ccc-de.nix
index c240be878ad1..ce8225a2d3d7 100644
--- a/pkgs/by-name/pr/pretalx/plugins/media-ccc-de.nix
+++ b/pkgs/by-name/pr/pretalx/plugins/media-ccc-de.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pretalx-media-ccc-de";
-  version = "1.4.0";
+  version = "1.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretalx";
     repo = "pretalx-media-ccc-de";
     rev = "v${version}";
-    hash = "sha256-U+26hit4xXUzN8JT3WL+iGohqomX1ENb+ihM9IT1XWQ=";
+    hash = "sha256-76hxS9cYvaRcToD8ooW0Fnp36+7n17j3UR1VD9v2zR8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/by-name/pr/pretalx/plugins/pages.nix b/pkgs/by-name/pr/pretalx/plugins/pages.nix
index 76395ed666d2..6df8a7472148 100644
--- a/pkgs/by-name/pr/pretalx/plugins/pages.nix
+++ b/pkgs/by-name/pr/pretalx/plugins/pages.nix
@@ -1,20 +1,20 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
+  fetchPypi,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pretalx-pages";
-  version = "1.6.0";
+  version = "1.7.0";
   pyproject = true;
 
-  src = fetchFromGitHub {
-    owner = "pretalx";
-    repo = "pretalx-pages";
-    rev = "v${version}";
-    hash = "sha256-9ZJSW6kdxpwHd25CuGTE4MMXylXaZKL3eAEKKdYiuXs=";
+  # TODO: https://github.com/pretalx/pretalx-pages/issues/6
+  src = fetchPypi {
+    pname = "pretalx_pages";
+    inherit version;
+    hash = "sha256-XFZS0FUzouZzVh9AADK5dnezFZiAWoBihD4C184+690=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/by-name/pr/pretalx/plugins/public-voting.nix b/pkgs/by-name/pr/pretalx/plugins/public-voting.nix
index 993bfd6def88..b1dd574b98da 100644
--- a/pkgs/by-name/pr/pretalx/plugins/public-voting.nix
+++ b/pkgs/by-name/pr/pretalx/plugins/public-voting.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pretalx-public-voting";
-  version = "1.7.0";
+  version = "1.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretalx";
     repo = "pretalx-public-voting";
     rev = "v${version}";
-    hash = "sha256-ei6GgPPEXv9WVhh+4U+WDFCMsT4bND9O85cPLpPWMhQ=";
+    hash = "sha256-8l+ugonT0WTHyyMJnU3Vi2QVD2Xxpl286m3YEKu+Ij4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/by-name/pr/pretender/package.nix b/pkgs/by-name/pr/pretender/package.nix
index 75cf8f6be8ca..5499ba5c948c 100644
--- a/pkgs/by-name/pr/pretender/package.nix
+++ b/pkgs/by-name/pr/pretender/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "RedTeamPentesting";
-    repo = pname;
+    repo = "pretender";
     tag = "v${version}";
     hash = "sha256-c8uXN7UMj6UZPVt2aNSg6mRex8w+u7J5I7TAB7MzEWg=";
   };
diff --git a/pkgs/by-name/pr/prettier-plugin-go-template/package.nix b/pkgs/by-name/pr/prettier-plugin-go-template/package.nix
index 02edecce4a52..62e4bad88d5c 100644
--- a/pkgs/by-name/pr/prettier-plugin-go-template/package.nix
+++ b/pkgs/by-name/pr/prettier-plugin-go-template/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-buildNpmPackage rec {
+buildNpmPackage {
   pname = "prettier-plugin-go-template";
   version = "0.0.15-unstable-2023-07-26";
 
   src = fetchFromGitHub {
     owner = "NiklasPor";
-    repo = pname;
+    repo = "prettier-plugin-go-template";
     rev = "d91c82e1377b89592ea3365e7e5569688fbc7954";
     hash = "sha256-3Tvh+OzqDTtzoaTp5dZpgEQiNA2Y2dbyq4SV9Od499A=";
   };
diff --git a/pkgs/by-name/pr/pretty-php/package.nix b/pkgs/by-name/pr/pretty-php/package.nix
index 97efb357c8bb..ab9e61be897d 100644
--- a/pkgs/by-name/pr/pretty-php/package.nix
+++ b/pkgs/by-name/pr/pretty-php/package.nix
@@ -6,16 +6,16 @@
 }:
 php.buildComposerProject2 (finalAttrs: {
   pname = "pretty-php";
-  version = "0.4.93";
+  version = "0.4.94";
 
   src = fetchFromGitHub {
     owner = "lkrms";
     repo = "pretty-php";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5gFTL4hcnEMKrffMpLRfneq5zeMHH50fjpvZcnefJZ8=";
+    hash = "sha256-zBhxuEViLxeQ9m3u1L0wYqeL+YEWWwvJS7PtsFPO5QU=";
   };
 
-  vendorHash = "sha256-cp6WPlEc3WCW19UqLgrqMv8zE9UrCiTuN+WqTpAsuWE=";
+  vendorHash = "sha256-vnmp/HLzaOzHu22lzugRXIHL43YQ/hm223gcUbIiLT4=";
 
   passthru = {
     tests.version = testers.testVersion {
diff --git a/pkgs/by-name/pr/pridefetch/package.nix b/pkgs/by-name/pr/pridefetch/package.nix
index 971c3c482d26..c1b3f758caa1 100644
--- a/pkgs/by-name/pr/pridefetch/package.nix
+++ b/pkgs/by-name/pr/pridefetch/package.nix
@@ -14,7 +14,7 @@ let
   pname = "pridefetch";
   src = fetchFromGitHub {
     owner = "SpyHoodle";
-    repo = pname;
+    repo = "pridefetch";
     rev = "v" + version;
     inherit sha256;
   };
diff --git a/pkgs/by-name/pr/probe-rs-tools/package.nix b/pkgs/by-name/pr/probe-rs-tools/package.nix
index 3b72a79ef788..8da8a62ac711 100644
--- a/pkgs/by-name/pr/probe-rs-tools/package.nix
+++ b/pkgs/by-name/pr/probe-rs-tools/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "probe-rs-tools";
-  version = "0.28.0";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "probe-rs";
     repo = "probe-rs";
     tag = "v${version}";
-    hash = "sha256-CCB7NdLSg3Ve/iBSG7TuTbXKnGsevzhnELA2gN3n2t4=";
+    hash = "sha256-5EppB6XVUHM7TrvpdqdvojuFbjw8RTDOudpypVdLPbQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-jBkMUaC8aFCP0N8cbYDEJtJtVbagB+YAHge0IT8xm+c=";
+  cargoHash = "sha256-sdMRauSaDYMgpfAYhEBEqz0s9WHAZJLjijdvQqO6fMs=";
 
   buildAndTestSubdir = pname;
 
diff --git a/pkgs/by-name/pr/process-compose/package.nix b/pkgs/by-name/pr/process-compose/package.nix
index 0836348aa050..5ffb72dcd49b 100644
--- a/pkgs/by-name/pr/process-compose/package.nix
+++ b/pkgs/by-name/pr/process-compose/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
-    repo = pname;
+    repo = "process-compose";
     rev = "v${version}";
     hash = "sha256-qv/fVfuQD7Nan5Nn1RkwXoGZuPYSRWQaojEn6MCF9BQ=";
     # populate values that require us to use git. By doing this in postFetch we
diff --git a/pkgs/by-name/pr/procodile/Gemfile.lock b/pkgs/by-name/pr/procodile/Gemfile.lock
index f53a07d6657c..1efd63725204 100644
--- a/pkgs/by-name/pr/procodile/Gemfile.lock
+++ b/pkgs/by-name/pr/procodile/Gemfile.lock
@@ -1,8 +1,8 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    json (2.2.0)
-    procodile (1.0.23)
+    json (2.12.2)
+    procodile (1.0.26)
       json
 
 PLATFORMS
@@ -12,4 +12,4 @@ DEPENDENCIES
   procodile
 
 BUNDLED WITH
-   2.1.4
+   2.6.6
diff --git a/pkgs/by-name/pr/procodile/gemset.nix b/pkgs/by-name/pr/procodile/gemset.nix
index bfb2a2d6a5bc..015ac84b9a0f 100644
--- a/pkgs/by-name/pr/procodile/gemset.nix
+++ b/pkgs/by-name/pr/procodile/gemset.nix
@@ -4,10 +4,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0sx97bm9by389rbzv8r1f43h06xcz8vwi3h5jv074gvparql7lcx";
+      sha256 = "1x5b8ipv6g0z44wgc45039k04smsyf95h2m5m67mqq35sa5a955s";
       type = "gem";
     };
-    version = "2.2.0";
+    version = "2.12.2";
   };
   procodile = {
     dependencies = [ "json" ];
@@ -15,9 +15,9 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "025pbr1kah7cgs527n5q56m5agaa2smzac4rpmpk619xg4r1rdhs";
+      sha256 = "1f2xf460p0dd8871dfjm3mx669hiy4fz2n53za0pfrd6mvwx5qkq";
       type = "gem";
     };
-    version = "1.0.23";
+    version = "1.0.26";
   };
 }
diff --git a/pkgs/by-name/pr/programmer-calculator/package.nix b/pkgs/by-name/pr/programmer-calculator/package.nix
index 75c4b15b7c12..4921ad30d153 100644
--- a/pkgs/by-name/pr/programmer-calculator/package.nix
+++ b/pkgs/by-name/pr/programmer-calculator/package.nix
@@ -11,7 +11,7 @@ gccStdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "alt-romes";
-    repo = pname;
+    repo = "programmer-calculator";
     rev = "v${version}";
     sha256 = "sha256-9mv8Jac6j3fKWLLCu1Bd/T5dbegUB8rRgsj9MaQhFDw=";
   };
diff --git a/pkgs/by-name/pr/projectm-sdl-cpp/package.nix b/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
index e7d9679e20cc..374ae12bcfdd 100644
--- a/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
+++ b/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation {
   pname = "projectm-sdl-cpp";
-  version = "0-unstable-2025-03-17";
+  version = "0-unstable-2025-05-20";
 
   src = fetchFromGitHub {
     owner = "projectM-visualizer";
     repo = "frontend-sdl-cpp";
-    rev = "080e48b303fe9d7eebaba6d266ddef0543bba0d3";
-    hash = "sha256-5thnZhw22U2IVn6VNDEIw1fEaTnTwJv8pkgAdWdrHu8=";
+    rev = "85dfdda3dcb139c7e1eb47fd5e4723114e4fb86b";
+    hash = "sha256-FHOncC6fhs1CPNMBGtA+QB+NHVn4QlF2Qn9NJb5j3p8=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/pr/prometheus-dcgm-exporter/package.nix b/pkgs/by-name/pr/prometheus-dcgm-exporter/package.nix
index 2d8ba68ac1c5..92863b5b8008 100644
--- a/pkgs/by-name/pr/prometheus-dcgm-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-dcgm-exporter/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
-    repo = pname;
+    repo = "dcgm-exporter";
     tag = version;
     hash = "sha256-BAMN2yuIW5FcHY3o9MUIMgPnTEFFRCbqhoAkcaZDxcM=";
   };
diff --git a/pkgs/by-name/pr/prometheus-smartctl-exporter/package.nix b/pkgs/by-name/pr/prometheus-smartctl-exporter/package.nix
index 6a3547a37f91..5864a43516b8 100644
--- a/pkgs/by-name/pr/prometheus-smartctl-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-smartctl-exporter/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "prometheus-community";
-    repo = pname;
+    repo = "smartctl_exporter";
     tag = "v${version}";
     hash = "sha256-9woQgqkPYKMu8p35aeSv3ua1l35BuMzFT4oCVpmyG2E=";
   };
diff --git a/pkgs/by-name/pr/promql-cli/package.nix b/pkgs/by-name/pr/promql-cli/package.nix
index b92927a19f64..941ce9a1131b 100644
--- a/pkgs/by-name/pr/promql-cli/package.nix
+++ b/pkgs/by-name/pr/promql-cli/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "nalbury";
-    repo = pname;
+    repo = "promql-cli";
     rev = "v${version}";
     hash = "sha256-EV63fdG+GF+kVLH2TxHPhRcUU5xBvkW5bhHC1lEoj84=";
   };
diff --git a/pkgs/by-name/pr/promscale/package.nix b/pkgs/by-name/pr/promscale/package.nix
index 9c350a7f8866..5c4195f7e24d 100644
--- a/pkgs/by-name/pr/promscale/package.nix
+++ b/pkgs/by-name/pr/promscale/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "timescale";
-    repo = pname;
+    repo = "promscale";
     rev = version;
     hash = "sha256-JizUI9XRzOEHF1kAblYQRYB11z9KWX7od3lPiRN+JNI=";
   };
diff --git a/pkgs/by-name/pr/proto-contrib/package.nix b/pkgs/by-name/pr/proto-contrib/package.nix
index 0581335fe17f..1a8ad389ea5e 100644
--- a/pkgs/by-name/pr/proto-contrib/package.nix
+++ b/pkgs/by-name/pr/proto-contrib/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "emicklei";
-    repo = pname;
+    repo = "proto-contrib";
     rev = "v${version}";
     sha256 = "0ksxic7cypv9gg8q5lkl5bla1n9i65z7b03cx9lwq6252glmf2jk";
   };
diff --git a/pkgs/by-name/pr/protoc-gen-es/package.nix b/pkgs/by-name/pr/protoc-gen-es/package.nix
index bffd37a9b187..ea38a71b109b 100644
--- a/pkgs/by-name/pr/protoc-gen-es/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-es/package.nix
@@ -7,20 +7,20 @@
 
 buildNpmPackage rec {
   pname = "protoc-gen-es";
-  version = "2.2.5";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "protobuf-es";
     tag = "v${version}";
-    hash = "sha256-7g7DZSSFyidgpWJQNuKQRpyDuCDQT6gGgIKNk1JsbEk=";
+    hash = "sha256-wllLeX7veCbpb/mTAIs0cf/hcVItEmw2HW/UR4k0Epc=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-NclrKsBBHlcYIgWf0bEq7xI3pUq2RvZ+0Ebj77ICars=";
+  npmDepsHash = "sha256-PGieFyPgb2ERTdQc3HH5mg/uh5xj7nkUa0qwmgxofVY=";
 
   npmWorkspace = "packages/protoc-gen-es";
 
diff --git a/pkgs/by-name/pr/protolint/package.nix b/pkgs/by-name/pr/protolint/package.nix
index 240e7bc8b7e3..5fbfce23b211 100644
--- a/pkgs/by-name/pr/protolint/package.nix
+++ b/pkgs/by-name/pr/protolint/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "yoheimuta";
-    repo = pname;
+    repo = "protolint";
     rev = "v${version}";
     hash = "sha256-uim4M1C51VVCOhcE/dyCLzx/Bks0h50+haw5mbAfiN8=";
   };
diff --git a/pkgs/by-name/pr/protonplus/package.nix b/pkgs/by-name/pr/protonplus/package.nix
index 50443df49692..46146e95fe32 100644
--- a/pkgs/by-name/pr/protonplus/package.nix
+++ b/pkgs/by-name/pr/protonplus/package.nix
@@ -20,13 +20,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "protonplus";
-  version = "0.4.27";
+  version = "0.4.30";
 
   src = fetchFromGitHub {
     owner = "Vysp3r";
     repo = "protonplus";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-y6fqn02Ui5RbBy5oMeX5HPRHQDUYD2MphoubZxIwQI8=";
+    hash = "sha256-bI21042EHpNigS2wB0WdM06BF2GHdoXsVpNoHe7ZuLk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/prototool/package.nix b/pkgs/by-name/pr/prototool/package.nix
index 211c86bd7c07..9b9fc2017063 100644
--- a/pkgs/by-name/pr/prototool/package.nix
+++ b/pkgs/by-name/pr/prototool/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "uber";
-    repo = pname;
+    repo = "prototool";
     rev = "v${version}";
     hash = "sha256-T6SjjyHC4j5du2P4Emcfq/ZFbuCpMPPJFJTHb/FNMAo=";
   };
diff --git a/pkgs/by-name/pr/prowlarr/package.nix b/pkgs/by-name/pr/prowlarr/package.nix
index 85180da593bf..2368d0d7eea7 100644
--- a/pkgs/by-name/pr/prowlarr/package.nix
+++ b/pkgs/by-name/pr/prowlarr/package.nix
@@ -37,16 +37,16 @@ let
 
   hash =
     {
-      aarch64-darwin = "sha256-zHaYgR9UXKnyikt5z3UUmh6oTNoNv5mqtnAId9kCzgE=";
-      aarch64-linux = "sha256-xChYbzs4zTWe71xwn3TfUZHGTOHHjzDwbkzPgQEfQZk=";
-      x86_64-darwin = "sha256-mual72UuFh9h7Hc/hHqSUeFInwm09f+UptX8jqknXlg=";
-      x86_64-linux = "sha256-UCiHeg46ncRQA6rDW4uxoFRqC7cuwMdr33OrN7yj51o=";
+      aarch64-darwin = "sha256-IkFkQoEPVaV+eVp2DkZECXTkzJyyNYTUBsCBdXCBZC8=";
+      aarch64-linux = "sha256-uwg5Ec9MC6jLwNdauF1tj2gSkhWdyhvWnUTLt8P1OZw=";
+      x86_64-darwin = "sha256-mdDZvKyhKXnHEKvZRH8Di6dZP80AEktnkMOnIZW+Gik=";
+      x86_64-linux = "sha256-N0KDb6MsGAJKSh5GSm7aiamjflHRXb06fL1KM2T1+bg=";
     }
     .${stdenv.hostPlatform.system} or unsupported;
 in
 stdenv.mkDerivation rec {
   inherit pname;
-  version = "1.35.1.5034";
+  version = "1.36.3.5071";
 
   src = fetchurl {
     url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.master.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/by-name/pr/prox/package.nix b/pkgs/by-name/pr/prox/package.nix
index adc0751adb2d..408cc8b2f651 100644
--- a/pkgs/by-name/pr/prox/package.nix
+++ b/pkgs/by-name/pr/prox/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "fgrosse";
-    repo = pname;
+    repo = "prox";
     rev = "v${version}";
     hash = "sha256-KSHTlcAmnuU8F17N0LBS0s5b/k6Of0OEHVd3v50bH3g=";
   };
diff --git a/pkgs/by-name/pr/prrte/package.nix b/pkgs/by-name/pr/prrte/package.nix
index 075e86594fb3..7e9b68ddceb8 100644
--- a/pkgs/by-name/pr/prrte/package.nix
+++ b/pkgs/by-name/pr/prrte/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "prrte";
-  version = "3.0.10";
+  version = "3.0.11";
 
   src = fetchFromGitHub {
     owner = "openpmix";
     repo = "prrte";
     rev = "v${version}";
-    hash = "sha256-Pnm0t7dJhT0MEYEKBHh6l16V5b/zOSxsd5OWda5SIzI=";
+    hash = "sha256-4JEh4N/38k0Xgp0CqnFipaEZlJBQr8nyxoncyz0/7yo=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ps/ps_mem/package.nix b/pkgs/by-name/ps/ps_mem/package.nix
index 2b8365f04077..7d5c6389119a 100644
--- a/pkgs/by-name/ps/ps_mem/package.nix
+++ b/pkgs/by-name/ps/ps_mem/package.nix
@@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "pixelb";
-    repo = pname;
+    repo = "ps_mem";
     rev = "v${version}";
     hash = "sha256-jCfPtPSky/QFk9Xo/tq3W7609Pie1yLC4iS4dqjCa+E=";
   };
diff --git a/pkgs/by-name/ps/pscale/package.nix b/pkgs/by-name/ps/pscale/package.nix
index 174a3b39f63a..58dfc057515a 100644
--- a/pkgs/by-name/ps/pscale/package.nix
+++ b/pkgs/by-name/ps/pscale/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.241.0";
+  version = "0.243.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-he9LLC8ijbgfmTDVURKZhU5RyOJC8U4vjPQBNNtC9WI=";
+    sha256 = "sha256-/ElqKIwaRT7y0i+nWgVKRm70CFOt2QVNdZiJotYObGY=";
   };
 
-  vendorHash = "sha256-Gt2dDgIAn7Hjlb2VI5VBKP7IfzkMZvCyLmOYYBtLx3o=";
+  vendorHash = "sha256-FqKAQxb6kEE5dm1V+RZBP1Jv5q4TC1MEfexTUjI+u6c=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ps/psmisc/package.nix b/pkgs/by-name/ps/psmisc/package.nix
index d96dfa9456b7..e8aaff467f92 100644
--- a/pkgs/by-name/ps/psmisc/package.nix
+++ b/pkgs/by-name/ps/psmisc/package.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
   version = "23.7";
 
   src = fetchFromGitLab {
-    owner = pname;
-    repo = pname;
+    owner = "psmisc";
+    repo = "psmisc";
     rev = "v${version}";
     hash = "sha256-49YpdIh0DxLHfxos4sw1HUkV0XQBqmm4M9b0T4eN2xI=";
   };
diff --git a/pkgs/by-name/pt/ptyxis/package.nix b/pkgs/by-name/pt/ptyxis/package.nix
index 22eb0f46f25e..ec51df831bd6 100644
--- a/pkgs/by-name/pt/ptyxis/package.nix
+++ b/pkgs/by-name/pt/ptyxis/package.nix
@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ptyxis";
-  version = "48.3";
+  version = "48.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "chergert";
     repo = "ptyxis";
     tag = finalAttrs.version;
-    hash = "sha256-Uj3RUMaPU/KHhhtsrw+kD5HBM+UY4MY/Ov4/8wjNpyI=";
+    hash = "sha256-Z5tTvKFivLKsRj/Ba9ZzQh/LCts4ngzYdHsRTy/ocXg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pu/puffin/package.nix b/pkgs/by-name/pu/puffin/package.nix
index 93b60c891f06..a5832a605554 100644
--- a/pkgs/by-name/pu/puffin/package.nix
+++ b/pkgs/by-name/pu/puffin/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "siddhantac";
-    repo = pname;
+    repo = "puffin";
     rev = "v${version}";
     hash = "sha256-cXhnCCg5A/G/FKWfCpq130qSD1iTGpgidqzGGnIPqO8=";
   };
diff --git a/pkgs/by-name/pv/pv-migrate/package.nix b/pkgs/by-name/pv/pv-migrate/package.nix
index 4878c27a2b7d..744d48af917e 100644
--- a/pkgs/by-name/pv/pv-migrate/package.nix
+++ b/pkgs/by-name/pv/pv-migrate/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "utkuozdemir";
-    repo = pname;
+    repo = "pv-migrate";
     tag = "v${version}";
     sha256 = "sha256-ZCNOg2HZjcEEM+hsAOtRR6hYmoKLyThpIw3warnravc=";
   };
diff --git a/pkgs/by-name/pw/pw-viz/package.nix b/pkgs/by-name/pw/pw-viz/package.nix
index 0d193713e6e8..cc279b08ff96 100644
--- a/pkgs/by-name/pw/pw-viz/package.nix
+++ b/pkgs/by-name/pw/pw-viz/package.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "ax9d";
-    repo = pname;
+    repo = "pw-viz";
     rev = "v${version}";
     sha256 = "sha256-fB7PnWWahCMKhGREg6neLmOZjh2OWLu61Vpmfsl03wA=";
   };
diff --git a/pkgs/by-name/pw/pwgen/package.nix b/pkgs/by-name/pw/pwgen/package.nix
index 05585886da8b..f11f58a489dd 100644
--- a/pkgs/by-name/pw/pwgen/package.nix
+++ b/pkgs/by-name/pw/pwgen/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "tytso";
-    repo = pname;
+    repo = "pwgen";
     rev = "v${version}";
     sha256 = "1j6c6m9fcy24jn8mk989x49yk765xb26lpr8yhpiaqk206wlss2z";
   };
diff --git a/pkgs/by-name/pw/pwsafe/package.nix b/pkgs/by-name/pw/pwsafe/package.nix
index 55978beac35d..9ec64dd13e10 100644
--- a/pkgs/by-name/pw/pwsafe/package.nix
+++ b/pkgs/by-name/pw/pwsafe/package.nix
@@ -28,8 +28,8 @@ stdenv.mkDerivation rec {
   version = "1.21.0fp"; # do NOT update to 3.x Windows releases
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "pwsafe";
+    repo = "pwsafe";
     rev = version;
     hash = "sha256-pPKUFX6NNGtGGjHL3g0Y6xzj+bHU2KDNMhYCnpP9wgM=";
   };
diff --git a/pkgs/by-name/py/pyfa/package.nix b/pkgs/by-name/py/pyfa/package.nix
index 578ef30da73e..b9ed915f53b3 100644
--- a/pkgs/by-name/py/pyfa/package.nix
+++ b/pkgs/by-name/py/pyfa/package.nix
@@ -10,7 +10,7 @@
   copyDesktopItems,
 }:
 let
-  version = "2.62.3";
+  version = "2.63.0";
 in
 python3Packages.buildPythonApplication rec {
   inherit version;
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication rec {
     owner = "pyfa-org";
     repo = "Pyfa";
     tag = "v${version}";
-    hash = "sha256-PqiwZwok7Mv1M4txU3D5MZYu8WxDCetLmvTqZ30rypY=";
+    hash = "sha256-2GLfI3NvhxsnxlApjRM+X+QoqkB8GE1WOgGibvK1k7M=";
   };
 
   desktopItems = [
diff --git a/pkgs/by-name/py/pylint-exit/package.nix b/pkgs/by-name/py/pylint-exit/package.nix
index 9095d4456e9d..5a1cb57dabf1 100644
--- a/pkgs/by-name/py/pylint-exit/package.nix
+++ b/pkgs/by-name/py/pylint-exit/package.nix
@@ -11,7 +11,7 @@ buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "jongracecox";
-    repo = pname;
+    repo = "pylint-exit";
     rev = "v${version}";
     sha256 = "0hwfny48g394visa3xd15425fsw596r3lhkfhswpjrdk2mnk3cny";
   };
diff --git a/pkgs/by-name/py/pylode/package.nix b/pkgs/by-name/py/pylode/package.nix
index 46c44ae6f870..ca8ae3f243e9 100644
--- a/pkgs/by-name/py/pylode/package.nix
+++ b/pkgs/by-name/py/pylode/package.nix
@@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "RDFLib";
-    repo = pname;
+    repo = "pylode";
     tag = version;
     sha256 = "sha256-AtqkxnpEL+580S/iKCaRcsQO6LLYhkJxyNx6fi3atbE=";
   };
diff --git a/pkgs/by-name/py/pypi-mirror/package.nix b/pkgs/by-name/py/pypi-mirror/package.nix
index d097803701ee..b5a1645451f9 100644
--- a/pkgs/by-name/py/pypi-mirror/package.nix
+++ b/pkgs/by-name/py/pypi-mirror/package.nix
@@ -10,7 +10,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "montag451";
-    repo = pname;
+    repo = "pypi-mirror";
     tag = "v${version}";
     hash = "sha256-hRqQDYgOKpv4jmNvyrt/+EInPM/Xwsr3IjtrySAGRgY=";
   };
diff --git a/pkgs/by-name/py/pyrosimple/package.nix b/pkgs/by-name/py/pyrosimple/package.nix
index 488419993e11..88af7907c8e6 100644
--- a/pkgs/by-name/py/pyrosimple/package.nix
+++ b/pkgs/by-name/py/pyrosimple/package.nix
@@ -16,7 +16,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "kannibalox";
-    repo = pname;
+    repo = "pyrosimple";
     tag = "v${version}";
     hash = "sha256-qER73B6wuRczwV23A+NwfDL4oymvSwmauA0uf2AE+kY=";
   };
diff --git a/pkgs/by-name/qa/qastools/package.nix b/pkgs/by-name/qa/qastools/package.nix
index b94318db64e2..e3cb0ebb8bab 100644
--- a/pkgs/by-name/qa/qastools/package.nix
+++ b/pkgs/by-name/qa/qastools/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitLab {
     owner = "sebholt";
-    repo = pname;
+    repo = "qastools";
     rev = "v${version}";
     hash = "sha256-mJjhM1y50f44kvxMidM7uqlkkXx1sbJC21vIMEDenoU=";
   };
diff --git a/pkgs/by-name/qg/qgroundcontrol/package.nix b/pkgs/by-name/qg/qgroundcontrol/package.nix
index cdc03f547e39..8f2dff91913f 100644
--- a/pkgs/by-name/qg/qgroundcontrol/package.nix
+++ b/pkgs/by-name/qg/qgroundcontrol/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "qgroundcontrol";
-  version = "4.4.4";
+  version = "4.4.5";
 
   propagatedBuildInputs = with libsForQt5; [
     qtbase
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
     owner = "mavlink";
     repo = "qgroundcontrol";
     rev = "v${version}";
-    hash = "sha256-+BsI79p0XJ1nCjEtaCVgHbD+jseVGLQZOll79xZ5THo=";
+    hash = "sha256-wjrfwE97J+UzBPIARQ6cPadN6xIdqR8i+ZKbtiDproM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/qo/qogir-icon-theme/package.nix b/pkgs/by-name/qo/qogir-icon-theme/package.nix
index 26b7c6e39bdc..775b3e31cb0d 100644
--- a/pkgs/by-name/qo/qogir-icon-theme/package.nix
+++ b/pkgs/by-name/qo/qogir-icon-theme/package.nix
@@ -27,7 +27,7 @@ lib.checkListOfEnum "${pname}: color variants" [ "standard" "dark" "all" ] color
 
     src = fetchFromGitHub {
       owner = "vinceliuice";
-      repo = pname;
+      repo = "qogir-icon-theme";
       rev = version;
       hash = "sha256-Eh4TWoFfArFmpM/9tkrf2sChQ0zzOZJE9pElchu8DCM=";
     };
diff --git a/pkgs/by-name/qu/quake3e/package.nix b/pkgs/by-name/qu/quake3e/package.nix
index 4bd6d9508ee7..5c2b26273e4a 100644
--- a/pkgs/by-name/qu/quake3e/package.nix
+++ b/pkgs/by-name/qu/quake3e/package.nix
@@ -19,13 +19,13 @@
 let
   arch = if stdenv.hostPlatform.isx86_64 then "x64" else stdenv.hostPlatform.parsed.cpu.name;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "Quake3e";
   version = "2024-09-02-dev";
 
   src = fetchFromGitHub {
     owner = "ec-";
-    repo = pname;
+    repo = "Quake3e";
     rev = "b6e7ce4f78711e1c9d2924044a9a9d8a9db7020f";
     sha256 = "sha256-tQgrHiP+QhBzcUnHRwzaDe38Th0uDt450fra8O3Vjqc=";
   };
diff --git a/pkgs/by-name/qu/quickjs/package.nix b/pkgs/by-name/qu/quickjs/package.nix
index c589035588e8..339195f5db76 100644
--- a/pkgs/by-name/qu/quickjs/package.nix
+++ b/pkgs/by-name/qu/quickjs/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quickjs";
-  version = "2024-01-13";
+  version = "2025-04-26";
 
   src = fetchurl {
     url = "https://bellard.org/quickjs/quickjs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-PEv4+JW/pUvrSGyNEhgRJ3Hs/FrDvhA2hR70FWghLgM=";
+    hash = "sha256-LyAHTCUWbvb3gfOBxQ1XtQLLhdRw1jmrzOu+95VMg78=";
   };
 
   outputs = [
@@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postBuild = ''
+    make doc/version.texi
     pushd doc
     makeinfo *texi
     popd
@@ -61,7 +62,6 @@ stdenv.mkDerivation (finalAttrs: {
     ''
       set +o pipefail
       qjs     --help 2>&1 | grep "QuickJS version"
-      qjscalc --help 2>&1 | grep "QuickJS version"
       set -o pipefail
     ''
 
@@ -93,10 +93,6 @@ stdenv.mkDerivation (finalAttrs: {
       ES2023 specification including modules, asynchronous generators, proxies
       and BigInt.
 
-      It optionally supports mathematical extensions such as big decimal
-      floating point numbers (BigDecimal), big binary floating point numbers
-      (BigFloat) and operator overloading.
-
       Main Features:
 
       - Small and easily embeddable: just a few C files, no external
@@ -112,8 +108,6 @@ stdenv.mkDerivation (finalAttrs: {
       - Can compile Javascript sources to executables with no external dependency.
       - Garbage collection using reference counting (to reduce memory usage and
         have deterministic behavior) with cycle removal.
-      - Mathematical extensions: BigDecimal, BigFloat, operator overloading,
-        bigint mode, math mode.
       - Command line interpreter with contextual colorization implemented in
         Javascript.
       - Small built-in standard library with C library wrappers.
diff --git a/pkgs/by-name/qu/quorum/package.nix b/pkgs/by-name/qu/quorum/package.nix
index 5d7d48744084..bf90365276b1 100644
--- a/pkgs/by-name/qu/quorum/package.nix
+++ b/pkgs/by-name/qu/quorum/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "Consensys";
-    repo = pname;
+    repo = "quorum";
     rev = "v${version}";
     hash = "sha256-pW8I4ivcKo6dsa8rQVKU6nUZuKxaki/7cMDKwEsSzNw=";
   };
diff --git a/pkgs/by-name/r2/r2modman/package.nix b/pkgs/by-name/r2/r2modman/package.nix
index 8ff252ef6fdf..cef3abad2691 100644
--- a/pkgs/by-name/r2/r2modman/package.nix
+++ b/pkgs/by-name/r2/r2modman/package.nix
@@ -15,18 +15,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "r2modman";
-  version = "3.1.58";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "ebkr";
     repo = "r2modmanPlus";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ICLKkhgEi0ThWHLgm9fr0QXXtWMCAOJ6nkD66JR8XMo=";
+    hash = "sha256-RCMb9NaGzFRV2sXBxeb9G9pHmKf66/wwlNrpKIUE2iQ=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-3SMvUx+TwUmOur/50HDLWt0EayY5tst4YANWIlXdiPQ=";
+    hash = "sha256-F+TYP8F/2YAubeBIFMXlhNjjAPVTPMkZ+oH6UVt/gbs=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ra/railway/package.nix b/pkgs/by-name/ra/railway/package.nix
index 0f974486cd84..5c5f8c74109c 100644
--- a/pkgs/by-name/ra/railway/package.nix
+++ b/pkgs/by-name/ra/railway/package.nix
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "railway";
-  version = "4.5.1";
+  version = "4.5.3";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-tZwVkZDT4WtM7cxI0FKPtX7C7NdhRbIOsDIrS4hbz+I=";
+    hash = "sha256-Z8ZjpD6uyqlCFItSHqAqVkdthhnwweSZasEVzg4dbpY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-eK91RATbTqYJYKM5I67281oHY90aaTVvbqQnysz/8k4=";
+  cargoHash = "sha256-k3wzGEs3rRI9DG5LW7GrAGCmT0GjkUGoL73rUa9nj50=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ra/rain/package.nix b/pkgs/by-name/ra/rain/package.nix
index 30a334aee635..b9618bbc6308 100644
--- a/pkgs/by-name/ra/rain/package.nix
+++ b/pkgs/by-name/ra/rain/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "aws-cloudformation";
-    repo = pname;
+    repo = "rain";
     rev = "v${version}";
     sha256 = "sha256-Dsg8vUMs6aep4FfrulHdtH3H7fitWdzENfTPm+9z5m0=";
   };
diff --git a/pkgs/by-name/ra/rakkess/package.nix b/pkgs/by-name/ra/rakkess/package.nix
index a1a349637ab8..8ea988b69a57 100644
--- a/pkgs/by-name/ra/rakkess/package.nix
+++ b/pkgs/by-name/ra/rakkess/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "corneliusweig";
-    repo = pname;
+    repo = "rakkess";
     rev = "v${version}";
     sha256 = "sha256-igovWWk8GfNmOS/NbZWfv9kox6QLNIbM09jdvA/lL3A=";
   };
diff --git a/pkgs/by-name/ra/randomx/package.nix b/pkgs/by-name/ra/randomx/package.nix
index 75e72e16fbc1..07291efc01e6 100644
--- a/pkgs/by-name/ra/randomx/package.nix
+++ b/pkgs/by-name/ra/randomx/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "tevador";
-    repo = pname;
+    repo = "randomX";
     rev = "v${version}";
     sha256 = "sha256-dfImzwbEfJQcaPZCoWypHiI6dishVRdqS/r+n3tfjvM=";
   };
diff --git a/pkgs/by-name/ra/raylib-games/package.nix b/pkgs/by-name/ra/raylib-games/package.nix
index 3ca74877fbb4..ae9eb728fb2f 100644
--- a/pkgs/by-name/ra/raylib-games/package.nix
+++ b/pkgs/by-name/ra/raylib-games/package.nix
@@ -5,13 +5,13 @@
   raylib,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "raylib-games";
   version = "2022-10-24";
 
   src = fetchFromGitHub {
     owner = "raysan5";
-    repo = pname;
+    repo = "raylib-games";
     rev = "e00d77cf96ba63472e8316ae95a23c624045dcbe";
     hash = "sha256-N9ip8yFUqXmNMKcvQuOyxDI4yF/w1YaoIh0prvS4Xr4=";
   };
diff --git a/pkgs/by-name/rb/rbdoom-3-bfg/package.nix b/pkgs/by-name/rb/rbdoom-3-bfg/package.nix
index 137be74c7a0d..ef44167c38f6 100644
--- a/pkgs/by-name/rb/rbdoom-3-bfg/package.nix
+++ b/pkgs/by-name/rb/rbdoom-3-bfg/package.nix
@@ -2,12 +2,10 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   directx-shader-compiler,
-  libGLU,
-  libpng,
-  libjpeg_turbo,
+  ispc,
+  ncurses,
   openal,
   rapidjson,
   SDL2,
@@ -18,22 +16,16 @@
 
 stdenv.mkDerivation rec {
   pname = "rbdoom-3-bfg";
-  version = "1.5.1";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "RobertBeckebans";
-    repo = pname;
+    repo = "rbdoom-3-bfg";
     rev = "v${version}";
-    hash = "sha256-bjjeTdbQDWTibSrIWhCnr6F0Ef17efLgWGQAAwezjUw=";
+    hash = "sha256-9BZEFO+e5IG6hv9+QI9OJecQ84rLTWBDz4k0GU6SeDE=";
     fetchSubmodules = true;
   };
 
-  patches = fetchpatch {
-    name = "replace-HLSL-ternary-operators.patch";
-    url = "https://github.com/RobertBeckebans/RBDOOM-3-BFG/commit/feffa4a4dd9a2a5f3c608f720cde41bea37797d3.patch";
-    hash = "sha256-aR1eoWZL3+ps7P7yFXFvGsMFxpUSBDiyBsja/ISin4I=";
-  };
-
   postPatch = ''
     substituteInPlace neo/extern/nvrhi/tools/shaderCompiler/CMakeLists.txt \
       --replace "AppleClang" "Clang"
@@ -42,12 +34,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     directx-shader-compiler
+    ispc
   ];
 
   buildInputs = [
-    libGLU
-    libpng
-    libjpeg_turbo
+    ncurses
     openal
     rapidjson
     SDL2
@@ -60,9 +51,6 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DFFMPEG=OFF"
     "-DBINKDEC=ON"
-    "-DUSE_SYSTEM_LIBGLEW=ON"
-    "-DUSE_SYSTEM_LIBPNG=ON"
-    "-DUSE_SYSTEM_LIBJPEG=ON"
     "-DUSE_SYSTEM_RAPIDJSON=ON"
     "-DUSE_SYSTEM_ZLIB=ON"
   ];
diff --git a/pkgs/by-name/re/realesrgan-ncnn-vulkan/package.nix b/pkgs/by-name/re/realesrgan-ncnn-vulkan/package.nix
index 6e0cd13ee84e..919abf1b5480 100644
--- a/pkgs/by-name/re/realesrgan-ncnn-vulkan/package.nix
+++ b/pkgs/by-name/re/realesrgan-ncnn-vulkan/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "xinntao";
-    repo = pname;
+    repo = "Real-ESRGAN-ncnn-vulkan";
     rev = "v${version}";
     sha256 = "sha256-F+NfkAbk8UtAKzsF42ppPF2UGjK/M6iFfBsRRBbCmcI=";
   };
diff --git a/pkgs/by-name/re/rebels-in-the-sky/package.nix b/pkgs/by-name/re/rebels-in-the-sky/package.nix
index 7f6cbe16c746..7a8cf044293f 100644
--- a/pkgs/by-name/re/rebels-in-the-sky/package.nix
+++ b/pkgs/by-name/re/rebels-in-the-sky/package.nix
@@ -3,7 +3,6 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  fetchpatch,
   cmake,
   pkg-config,
   alsa-lib,
@@ -15,28 +14,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rebels-in-the-sky";
-  version = "1.0.29";
+  version = "1.0.30";
 
   src = fetchFromGitHub {
     owner = "ricott1";
     repo = "rebels-in-the-sky";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rWBaD4nxSmr1RZRbc51Sz9Xl2Te2yv4HNuFqWj8KayM=";
+    hash = "sha256-eC8n9g2kFErTRWWNo6jwAMGBX3+xGjtzq23+r3w0n0I=";
   };
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ZRxq6/mgXZ33o1AEHnSOt4HJAI1y+F+ysVNvvbb9M28=";
+  cargoHash = "sha256-dGD0RpelENEWe9W/3CXUS2GhOXRaWhCoD8AI2n4mUfs=";
 
-  patches =
-    lib.optionals (!withRadio) [
-      ./disable-radio.patch
-    ]
-    ++ [
-      # https://github.com/ricott1/rebels-in-the-sky/pull/25
-      (fetchpatch {
-        url = "https://github.com/ricott1/rebels-in-the-sky/commit/31778fee783637fe8af09f71754f35c5d15b800a.patch";
-        hash = "sha256-PO/aY+fB72gQpxE5eaIP/s4xevfQ/Ac1TH5ZEKwpw1I=";
-      })
-    ];
+  patches = lib.optionals (!withRadio) [
+    ./disable-radio.patch
+  ];
 
   nativeBuildInputs =
     [
diff --git a/pkgs/by-name/re/regexploit/package.nix b/pkgs/by-name/re/regexploit/package.nix
index 0ed524edd4fa..ac724a52c333 100644
--- a/pkgs/by-name/re/regexploit/package.nix
+++ b/pkgs/by-name/re/regexploit/package.nix
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "doyensec";
-    repo = pname;
+    repo = "regexploit";
     rev = "v${version}";
     sha256 = "0z3fghsyw0ll36in7ihc0qi3gy7mqi6cw1mi8m8c8xb1nlwpfr0y";
   };
diff --git a/pkgs/by-name/re/rehex/package.nix b/pkgs/by-name/re/rehex/package.nix
index 8f6d56e3a3fa..a01733c04ea4 100644
--- a/pkgs/by-name/re/rehex/package.nix
+++ b/pkgs/by-name/re/rehex/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "solemnwarning";
-    repo = pname;
+    repo = "rehex";
     rev = version;
     hash = "sha256-RlYpg3aon1d25n8K/bbHGVLn5/iOOUSlvjT8U0fp9hA=";
   };
diff --git a/pkgs/by-name/re/reindeer/package.nix b/pkgs/by-name/re/reindeer/package.nix
index 672152e9f1a7..97fe361b4546 100644
--- a/pkgs/by-name/re/reindeer/package.nix
+++ b/pkgs/by-name/re/reindeer/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "2025.05.12.00";
+  version = "2025.05.26.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "reindeer";
     tag = "v${version}";
-    hash = "sha256-e6kP2vLJURjp+iCgyQGX3gHFaHyLhGzNJ1qjEcDBjz4=";
+    hash = "sha256-I5I5m9UutBMgX7PygPjMgglqvRfZxuWiyJ4l+77WYAQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hpOcPMrgUXDUrTml8nl737NFe0WYPdIY66rU+QRqyx0=";
+  cargoHash = "sha256-i0HAT8L9rf0r/jOqDFe60PakXwHz9lr4gwXm0ZwN4No=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/relic/package.nix b/pkgs/by-name/re/relic/package.nix
index 2231b6441e87..31dc67b2e2ea 100644
--- a/pkgs/by-name/re/relic/package.nix
+++ b/pkgs/by-name/re/relic/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "sassoftware";
-    repo = pname;
+    repo = "relic";
     rev = "v${version}";
     sha256 = "sha256-dXvKbuAJCL+H0Gh0ZF1VvtY+7cgjq7gs8zwtenI3JuI=";
   };
diff --git a/pkgs/by-name/re/remote-touchpad/package.nix b/pkgs/by-name/re/remote-touchpad/package.nix
index 72c81bd39393..afc31bae09c0 100644
--- a/pkgs/by-name/re/remote-touchpad/package.nix
+++ b/pkgs/by-name/re/remote-touchpad/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "unrud";
-    repo = pname;
+    repo = "remote-touchpad";
     rev = "v${version}";
     sha256 = "sha256-UZjbU9Ti5+IjcxIf+LDWlcqxb4kMIwa8zHmZDdZbnw8=";
   };
diff --git a/pkgs/by-name/re/renderizer/package.nix b/pkgs/by-name/re/renderizer/package.nix
index 1b3f49fa5d68..043ca33ef1b3 100644
--- a/pkgs/by-name/re/renderizer/package.nix
+++ b/pkgs/by-name/re/renderizer/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "gomatic";
-    repo = pname;
+    repo = "renderizer";
     rev = "v${version}";
     sha256 = "sha256-jl98LuEsGN40L9IfybJhLnbzoYP/XpwFVQnjrlmDL9A=";
   };
diff --git a/pkgs/by-name/re/renovate/package.nix b/pkgs/by-name/re/renovate/package.nix
index 841fb24a3123..6adc21902578 100644
--- a/pkgs/by-name/re/renovate/package.nix
+++ b/pkgs/by-name/re/renovate/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "renovate";
-  version = "40.14.4";
+  version = "40.33.1";
 
   src = fetchFromGitHub {
     owner = "renovatebot";
     repo = "renovate";
     tag = finalAttrs.version;
-    hash = "sha256-qL1pXlY9rBoZ5o4ZdiDAEv2zmLN42q9kma5/5yOlOno=";
+    hash = "sha256-W2FoiU48rJr6o7HQW9MFNr92sag4QUGaRLbtMeM5418=";
   };
 
   postPatch = ''
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Uj+w9jzbWKLoJgRS5GVGY5QZAwIKsH/MoIu6OailgAw=";
+    hash = "sha256-NEqgX3OHy9kbIhdaHiR7C7wGHZKe35it5G7kOro5RPQ=";
   };
 
   env.COREPACK_ENABLE_STRICT = 0;
diff --git a/pkgs/by-name/re/replibyte/package.nix b/pkgs/by-name/re/replibyte/package.nix
index 02c7ce30822d..d3f868b2924d 100644
--- a/pkgs/by-name/re/replibyte/package.nix
+++ b/pkgs/by-name/re/replibyte/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "Qovery";
-    repo = pname;
+    repo = "replibyte";
     rev = "v${version}";
     hash = "sha256-VExA92g+1y65skxLKU62ZPUPOwdm9N73Ne9xW7Q0Sic=";
   };
diff --git a/pkgs/by-name/re/rescrobbled/package.nix b/pkgs/by-name/re/rescrobbled/package.nix
index 59914fbb785c..eef97daf1511 100644
--- a/pkgs/by-name/re/rescrobbled/package.nix
+++ b/pkgs/by-name/re/rescrobbled/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  bash,
+  dash,
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
@@ -11,17 +11,17 @@
 rustPlatform.buildRustPackage rec {
 
   pname = "rescrobbled";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "InputUsername";
     repo = "rescrobbled";
     rev = "v${version}";
-    hash = "sha256-1E+SeKjHCah+IFn2QLAyyv7jgEcZ1gtkh8iHgiVBuz4=";
+    hash = "sha256-HWv0r0eqzY4q+Q604ZIkdhnjmCGX+L6HHXa6iCtH2KE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-oXj3pMT7lBcj/cNa6FY8ehr9TVSRUwqW3B4g5VeyH2w=";
+  cargoHash = "sha256-zZqDbXIXuNX914EmeSv3hZFnpjYzYdYZk7av3W60YuM=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -32,11 +32,11 @@ rustPlatform.buildRustPackage rec {
 
   postPatch = ''
     # Required for tests
-    substituteInPlace src/filter.rs --replace '#!/usr/bin/bash' '#!${bash}/bin/bash'
+    substituteInPlace src/filter.rs --replace-fail '#!/usr/bin/env sh' '#!${dash}/bin/dash'
   '';
 
   postInstall = ''
-    substituteInPlace rescrobbled.service --replace '%h/.cargo/bin/rescrobbled' "$out/bin/rescrobbled"
+    substituteInPlace rescrobbled.service --replace-fail '%h/.cargo/bin/rescrobbled' "$out/bin/rescrobbled"
     install -Dm644 rescrobbled.service -t "$out/share/systemd/user"
   '';
 
diff --git a/pkgs/by-name/re/resgate/package.nix b/pkgs/by-name/re/resgate/package.nix
index 160c7b42d8c6..1dc4cfaf9f9c 100644
--- a/pkgs/by-name/re/resgate/package.nix
+++ b/pkgs/by-name/re/resgate/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "resgateio";
-    repo = pname;
+    repo = "resgate";
     rev = "v${version}";
     hash = "sha256-HQgBWH6dqfmAfKMezUjPbwXif8bqAClns589la2lBVA=";
   };
diff --git a/pkgs/by-name/re/resolve-march-native/package.nix b/pkgs/by-name/re/resolve-march-native/package.nix
index 71a3580064ad..950c0642cb99 100644
--- a/pkgs/by-name/re/resolve-march-native/package.nix
+++ b/pkgs/by-name/re/resolve-march-native/package.nix
@@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "hartwork";
-    repo = pname;
+    repo = "resolve-march-native";
     tag = version;
     hash = "sha256-YJvKLHxn80RRVEOGeg9BwxhDZ8Hhg5Qa6ryLOXumY5w=";
   };
diff --git a/pkgs/by-name/re/restream/package.nix b/pkgs/by-name/re/restream/package.nix
index 80587208efc2..436caa754b45 100644
--- a/pkgs/by-name/re/restream/package.nix
+++ b/pkgs/by-name/re/restream/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "rien";
-    repo = pname;
+    repo = "restream";
     rev = "v${version}";
     hash = "sha256-AXHKOfdIM3LsHF6u3M/lMhhcuPZADoEal7de3zlx7L4=";
   };
diff --git a/pkgs/by-name/re/reth/package.nix b/pkgs/by-name/re/reth/package.nix
index 159e4ff84917..c6ef3b794d23 100644
--- a/pkgs/by-name/re/reth/package.nix
+++ b/pkgs/by-name/re/reth/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "paradigmxyz";
-    repo = pname;
+    repo = "reth";
     rev = "v${version}";
     hash = "sha256-pl0eQU7BjkSg8ECxeB13oNMO9CNIwLyOOHiWWC4CWhY=";
   };
diff --git a/pkgs/by-name/re/reviewdog/package.nix b/pkgs/by-name/re/reviewdog/package.nix
index 099ee1949cb1..6e79a2151804 100644
--- a/pkgs/by-name/re/reviewdog/package.nix
+++ b/pkgs/by-name/re/reviewdog/package.nix
@@ -9,8 +9,8 @@ buildGoModule rec {
   version = "0.20.3";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "reviewdog";
+    repo = "reviewdog";
     rev = "v${version}";
     hash = "sha256-B0gu6vhbnhMx2CNQzQlIIwsycBup6bnmAk/1C6F/AWE=";
   };
diff --git a/pkgs/by-name/re/revive/package.nix b/pkgs/by-name/re/revive/package.nix
index 8fe71fa96d2d..37ecaa4f11bb 100644
--- a/pkgs/by-name/re/revive/package.nix
+++ b/pkgs/by-name/re/revive/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "revive";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "mgechev";
-    repo = pname;
+    repo = "revive";
     rev = "v${version}";
-    hash = "sha256-mHyXymMJZeHXYOB6JB5VTqeP1flOACnNE/dLApAenH4=";
+    hash = "sha256-pQ6Gc9gCpU4GTy+4ipWH/kccadTCveM9KD74sOHpwmQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -24,7 +24,7 @@ buildGoModule rec {
       rm -rf $out/.git
     '';
   };
-  vendorHash = "sha256-oRhex0WC0MUxX1luKJeMvA7NpN7aS/9ecXkrfRYEnvM=";
+  vendorHash = "sha256-LrZMpq8ck9G5aXzXW3HZWiQ3KN7ze9WO/pmMGDLUXRw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/rf/rfc-bibtex/package.nix b/pkgs/by-name/rf/rfc-bibtex/package.nix
index 38254cae5c6a..e594574388bc 100644
--- a/pkgs/by-name/rf/rfc-bibtex/package.nix
+++ b/pkgs/by-name/rf/rfc-bibtex/package.nix
@@ -12,7 +12,7 @@ buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "iluxonchik";
-    repo = pname;
+    repo = "rfc-bibtex";
     tag = version;
     hash = "sha256-bPCNQqiG50vWVFA6J2kyxftwsXunHTNBdSkoIRYkb0s=";
   };
diff --git a/pkgs/by-name/ri/rime-cli/package.nix b/pkgs/by-name/ri/rime-cli/package.nix
index 40c08fa5e66f..3f2e31dc59bf 100644
--- a/pkgs/by-name/ri/rime-cli/package.nix
+++ b/pkgs/by-name/ri/rime-cli/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "puddinging";
-    repo = pname;
+    repo = "rime-cli";
     rev = "v${version}";
     hash = "sha256-CI0Jva7oA/zUGatv+wCdByqbTBNQRw+4clr8IDKX6HQ=";
   };
diff --git a/pkgs/by-name/ri/ristate/package.nix b/pkgs/by-name/ri/ristate/package.nix
index 34015139accb..7c20c4a34274 100644
--- a/pkgs/by-name/ri/ristate/package.nix
+++ b/pkgs/by-name/ri/ristate/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitLab,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "ristate";
   version = "unstable-2021-09-10";
 
   src = fetchFromGitLab {
     owner = "snakedye";
-    repo = pname;
+    repo = "ristate";
     rev = "34dfd0a0bab5b36df118d8da3956fd938c625b15";
     hash = "sha256-CH9DZ/7Bhbe6qKg1Nbj1rA9SzIsqVlBJg51XxAh0XnY=";
   };
diff --git a/pkgs/by-name/ri/rivalcfg/package.nix b/pkgs/by-name/ri/rivalcfg/package.nix
index cdf942f4e1d1..efdbfe24a680 100644
--- a/pkgs/by-name/ri/rivalcfg/package.nix
+++ b/pkgs/by-name/ri/rivalcfg/package.nix
@@ -6,13 +6,13 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "rivalcfg";
-  version = "4.14.0";
+  version = "4.15.0";
 
   src = fetchFromGitHub {
     owner = "flozz";
     repo = "rivalcfg";
     tag = "v${version}";
-    sha256 = "sha256-LQpEHcKXkepfsgG7tGYsmM43FkUSBgm1Cn5C1RmTggI=";
+    sha256 = "sha256-UqVogJLv+sNhAxdMjBEvhBQw6LU+QUq1IekvWpeeMqk=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/rk/rke/package.nix b/pkgs/by-name/rk/rke/package.nix
index 54c509328db3..66d0ad91b5df 100644
--- a/pkgs/by-name/rk/rke/package.nix
+++ b/pkgs/by-name/rk/rke/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "rancher";
-    repo = pname;
+    repo = "rke";
     rev = "v${version}";
     hash = "sha256-+AS8vxMTVKuxVUVyjbMED4pqznMj5lEpr+WhH9DnT84=";
   };
diff --git a/pkgs/by-name/rl/rlama/package.nix b/pkgs/by-name/rl/rlama/package.nix
index 4a519c9bbc54..622a1606fe41 100644
--- a/pkgs/by-name/rl/rlama/package.nix
+++ b/pkgs/by-name/rl/rlama/package.nix
@@ -15,13 +15,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "rlama";
-  version = "0.1.36";
+  version = "0.1.39";
 
   src = fetchFromGitHub {
     owner = "dontizi";
     repo = "rlama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SzrnpAkh+SMzF9xOAxZXondRulwPRUZYHrhe3rf06bA=";
+    hash = "sha256-9qm9QSMko+ZHfKMMaTesA26X4OuemyB/w1w+0QOEpyE=";
   };
 
   vendorHash = "sha256-GHmLCgL79BdGw/5zz50Y1kR/6JYNalvOj2zjIHQ9IF0=";
diff --git a/pkgs/by-name/ro/rofi-screenshot/package.nix b/pkgs/by-name/ro/rofi-screenshot/package.nix
index b37ebb5895be..57827fc96453 100644
--- a/pkgs/by-name/ro/rofi-screenshot/package.nix
+++ b/pkgs/by-name/ro/rofi-screenshot/package.nix
@@ -14,13 +14,13 @@
   procps,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "rofi-screenshot";
   version = "2024-09-27";
 
   src = fetchFromGitHub {
     owner = "ceuk";
-    repo = pname;
+    repo = "rofi-screenshot";
     rev = "09a07d9c2ff2efbf75b1753bb412f4f8f086708f";
     hash = "sha256-3UpYdXAX3LD1ZAQ429JkzWWooiBpuf/uPf0CRh5EXd8=";
   };
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
 
   postFixup = ''
-    wrapProgram $out/bin/${pname} \
+    wrapProgram $out/bin/rofi-screenshot \
       --set PATH ${
         lib.makeBinPath [
           libnotify
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    install -Dm755 ${pname} $out/bin/${pname}
+    install -Dm755 rofi-screenshot $out/bin/rofi-screenshot
   '';
 
   meta = {
diff --git a/pkgs/by-name/ro/round/package.nix b/pkgs/by-name/ro/round/package.nix
index dc55727a2b09..c2681172e1a8 100644
--- a/pkgs/by-name/ro/round/package.nix
+++ b/pkgs/by-name/ro/round/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "mingrammer";
-    repo = pname;
+    repo = "round";
     rev = "v${version}";
     hash = "sha256-vP2q0inU5zNJ/eiAqEzwHSqril8hTtpbpNBiAkeWeSU=";
   };
diff --git a/pkgs/by-name/ro/routinator/package.nix b/pkgs/by-name/ro/routinator/package.nix
index b394ddc6d0e4..becc0b690658 100644
--- a/pkgs/by-name/ro/routinator/package.nix
+++ b/pkgs/by-name/ro/routinator/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
-    repo = pname;
+    repo = "routinator";
     rev = "v${version}";
     hash = "sha256-itD9d+EqEdJ2bTJEpHxJCFFS8Mpc7AFQ1JgkNQxncV0=";
   };
diff --git a/pkgs/by-name/rq/rqlite/package.nix b/pkgs/by-name/rq/rqlite/package.nix
index 38012ae4f93b..e9185ffcb4c7 100644
--- a/pkgs/by-name/rq/rqlite/package.nix
+++ b/pkgs/by-name/rq/rqlite/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "rqlite";
-  version = "8.37.0";
+  version = "8.37.1";
 
   src = fetchFromGitHub {
     owner = "rqlite";
-    repo = pname;
+    repo = "rqlite";
     rev = "v${version}";
-    sha256 = "sha256-a5A6tcoMKaA0oRZQpmurQxlIvTdtcih/6rnM3p4awW8=";
+    sha256 = "sha256-GouVEUqxqNUtc9jyqhfLiX2M+I4ykQRsmbEvWmOaINc=";
   };
 
   vendorHash = "sha256-jvZ2ZRA/DkjDNnYauS9sJLE8KROS197kSeNVZ363Htk=";
diff --git a/pkgs/by-name/rs/rssguard/package.nix b/pkgs/by-name/rs/rssguard/package.nix
index 95654c1282b3..8c0076f1600b 100644
--- a/pkgs/by-name/rs/rssguard/package.nix
+++ b/pkgs/by-name/rs/rssguard/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "martinrotter";
-    repo = pname;
+    repo = "rssguard";
     tag = version;
     sha256 = "sha256-CWRsuIvjgQHnCfHVUvellFLma8vvqoROfPjKOIuCSCI=";
   };
diff --git a/pkgs/by-name/rt/rtrtr/package.nix b/pkgs/by-name/rt/rtrtr/package.nix
index aa0cf55f8739..507652fe2dec 100644
--- a/pkgs/by-name/rt/rtrtr/package.nix
+++ b/pkgs/by-name/rt/rtrtr/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
-    repo = pname;
+    repo = "rtrtr";
     rev = "v${version}";
     hash = "sha256-1TmzC/d/odfYdo1CiCsFW3U7OCpTF4Gkw2w4c2yaxxw=";
   };
diff --git a/pkgs/by-name/rt/rttr/package.nix b/pkgs/by-name/rt/rttr/package.nix
index cc8d057d8651..9cf8dee8a877 100644
--- a/pkgs/by-name/rt/rttr/package.nix
+++ b/pkgs/by-name/rt/rttr/package.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
   version = "0.9.6";
 
   src = fetchFromGitHub {
-    owner = "${pname}org";
-    repo = pname;
+    owner = "rttrorg";
+    repo = "rttr";
     rev = "v${version}";
     sha256 = "1yxad8sj40wi75hny8w6imrsx8wjasjmsipnlq559n4b6kl84ijp";
   };
diff --git a/pkgs/by-name/ru/rubyripper/package.nix b/pkgs/by-name/ru/rubyripper/package.nix
index 453f171ae901..30882350ab21 100644
--- a/pkgs/by-name/ru/rubyripper/package.nix
+++ b/pkgs/by-name/ru/rubyripper/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "bleskodev";
-    repo = pname;
+    repo = "rubyripper";
     rev = "v${version}";
     sha256 = "1qfwv8bgc9pyfh3d40bvyr9n7sjc2na61481693wwww640lm0f9f";
   };
diff --git a/pkgs/by-name/ru/runitor/package.nix b/pkgs/by-name/ru/runitor/package.nix
index b5e157aca970..afcc7c661565 100644
--- a/pkgs/by-name/ru/runitor/package.nix
+++ b/pkgs/by-name/ru/runitor/package.nix
@@ -8,14 +8,14 @@
 
 buildGoModule rec {
   pname = "runitor";
-  version = "1.3.0";
-  vendorHash = null;
+  version = "1.4.0";
+  vendorHash = "sha256-SYYAAtuWt/mTmZPBilYxf2uZ6OcgeTnobYiye47i8mI=";
 
   src = fetchFromGitHub {
     owner = "bdd";
     repo = "runitor";
     rev = "v${version}";
-    sha256 = "sha256-9sg+ku3Qh/X/EZ2VCrvIc0pq5iyn4O8RZrO4KpkciAI=";
+    sha256 = "sha256-eD8bJ34ZfTPToQrZ8kZGcSBdMmmCwRtuXgwZmz15O3s=";
   };
 
   ldflags = [
diff --git a/pkgs/by-name/ru/ruplacer/package.nix b/pkgs/by-name/ru/ruplacer/package.nix
index 2bade1d3b9ee..f15a57d67639 100644
--- a/pkgs/by-name/ru/ruplacer/package.nix
+++ b/pkgs/by-name/ru/ruplacer/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "TankerHQ";
-    repo = pname;
+    repo = "ruplacer";
     rev = "v${version}";
     sha256 = "sha256-Zvbb9pQpxbJZi0qcDU6f2jEgavl9cA7gIYU7NRXZ9fc=";
   };
diff --git a/pkgs/by-name/ru/rust-motd/package.nix b/pkgs/by-name/ru/rust-motd/package.nix
index e45e0f090f6c..9d9f4951ea74 100644
--- a/pkgs/by-name/ru/rust-motd/package.nix
+++ b/pkgs/by-name/ru/rust-motd/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "rust-motd";
-    repo = pname;
+    repo = "rust-motd";
     rev = "v${version}";
     hash = "sha256-pgmAf9izrIun6+EayxSNy9glTUFd0x/uy5r/aijVi4U=";
   };
diff --git a/pkgs/by-name/ru/rustc-demangle/package.nix b/pkgs/by-name/ru/rustc-demangle/package.nix
index edb6be2d7321..9a868684f80d 100644
--- a/pkgs/by-name/ru/rustc-demangle/package.nix
+++ b/pkgs/by-name/ru/rustc-demangle/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "alexcrichton";
-    repo = pname;
+    repo = "rustc-demangle";
     rev = version;
     sha256 = "sha256-elxclyuLmr3N66s+pR4/6OU98k1oXI2wKVJtzWPY8FI=";
   };
diff --git a/pkgs/by-name/ry/ryzenadj/package.nix b/pkgs/by-name/ry/ryzenadj/package.nix
index 3f6a9206a24a..2476ab3019bb 100644
--- a/pkgs/by-name/ry/ryzenadj/package.nix
+++ b/pkgs/by-name/ry/ryzenadj/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "ryzenadj";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "FlyGoat";
     repo = "RyzenAdj";
     rev = "v${version}";
-    sha256 = "sha256-VuIrA5UrRqwUta/mrYd+6F4gh/Z65+zzoTXUlRA8wzA=";
+    sha256 = "sha256-28ld8htm3DewTSV3WTG4dFOcX4JAEUMK9rq4AAm1/zY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/s3/s3proxy/package.nix b/pkgs/by-name/s3/s3proxy/package.nix
index b2281b7f2ad9..302e6bd4c504 100644
--- a/pkgs/by-name/s3/s3proxy/package.nix
+++ b/pkgs/by-name/s3/s3proxy/package.nix
@@ -9,17 +9,17 @@
 
 let
   pname = "s3proxy";
-  version = "2.1.0";
+  version = "2.6.0";
 in
 maven.buildMavenPackage {
   inherit pname version;
-  mvnHash = "sha256-85mE/pZ0DXkzOKvTAqBXGatAt8gc4VPRCxmEyIlyVGI=";
+  mvnHash = "sha256-OCFs1Q4NL5heP8AVvkQ+ZdhmPD2SNZMCF2gxjXpbfW4=";
 
   src = fetchFromGitHub {
     owner = "gaul";
-    repo = pname;
+    repo = "s3proxy";
     rev = "s3proxy-${version}";
-    hash = "sha256-GhZPvo8wlXInHwg8rSmpwMMkZVw5SMpnZyKqFUYLbrE=";
+    hash = "sha256-wd3GdSAcoJvlyFqnccdhM83IY2Q7KJQHoyV+sQGEwo4=";
   };
 
   doCheck = !stdenv.hostPlatform.isDarwin;
diff --git a/pkgs/by-name/s3/s3rs/package.nix b/pkgs/by-name/s3/s3rs/package.nix
index fa40ad221611..4447c5822265 100644
--- a/pkgs/by-name/s3/s3rs/package.nix
+++ b/pkgs/by-name/s3/s3rs/package.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "yanganto";
-    repo = pname;
+    repo = "s3rs";
     rev = "v${version}";
     sha256 = "sha256-mJ1bMfv/HY74TknpRvu8RIs1d2VlNreEVtHCtQSHQw8=";
   };
diff --git a/pkgs/by-name/s5/s5/package.nix b/pkgs/by-name/s5/s5/package.nix
index 0a5debe0e087..195d932aaed0 100644
--- a/pkgs/by-name/s5/s5/package.nix
+++ b/pkgs/by-name/s5/s5/package.nix
@@ -10,14 +10,14 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "mvisonneau";
-    repo = pname;
+    repo = "s5";
     rev = "v${version}";
     hash = "sha256-QQMnzDRWdW0awwNx2vqtzrOW9Ua7EmJ9YFznQoK33J0=";
   };
 
   vendorHash = "sha256-axcZ4XzgsPVU9at/g3WS8Hv92P2hmZRb+tUfw+h9iH0=";
 
-  subPackages = [ "cmd/${pname}" ];
+  subPackages = [ "cmd/s5" ];
 
   ldflags = [
     "-X main.version=v${version}"
diff --git a/pkgs/by-name/sa/saldl/package.nix b/pkgs/by-name/sa/saldl/package.nix
index 530cba04b078..e91076d9747e 100644
--- a/pkgs/by-name/sa/saldl/package.nix
+++ b/pkgs/by-name/sa/saldl/package.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
   version = "41";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "saldl";
+    repo = "saldl";
     rev = "v${version}";
     sha256 = "sha256-PAX2MUyBWWU8kGkaeoCJteidgszh7ipwDJbrLXzVsn0=";
   };
diff --git a/pkgs/by-name/sa/sampler/package.nix b/pkgs/by-name/sa/sampler/package.nix
index 1f1f993d4915..b08787ce5ab6 100644
--- a/pkgs/by-name/sa/sampler/package.nix
+++ b/pkgs/by-name/sa/sampler/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "sqshq";
-    repo = pname;
+    repo = "sampler";
     rev = "v${version}";
     hash = "sha256-H7QllAqPp35wHeJ405YSfPX3S4lH0/hdQ8Ja2OGLVtE=";
   };
diff --git a/pkgs/by-name/sa/sane-airscan/package.nix b/pkgs/by-name/sa/sane-airscan/package.nix
index 6723521379ac..dd37d24c4f07 100644
--- a/pkgs/by-name/sa/sane-airscan/package.nix
+++ b/pkgs/by-name/sa/sane-airscan/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "alexpevzner";
-    repo = pname;
+    repo = "sane-airscan";
     rev = version;
     sha256 = "sha256-sWBqYoeCEAIM5Gug+w4b4WZ8SwFrywqJVzo0nt69diA=";
   };
diff --git a/pkgs/by-name/sa/sasutils/package.nix b/pkgs/by-name/sa/sasutils/package.nix
index 604b31630178..9ffa2b7ceb66 100644
--- a/pkgs/by-name/sa/sasutils/package.nix
+++ b/pkgs/by-name/sa/sasutils/package.nix
@@ -12,7 +12,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "stanford-rc";
-    repo = pname;
+    repo = "sasutils";
     tag = "v${version}";
     sha256 = "sha256-rx4IxS5q1c3z617F4DBWxuxxSPHKFrw2bTW6b6/qkds=";
   };
diff --git a/pkgs/by-name/sa/savepagenow/package.nix b/pkgs/by-name/sa/savepagenow/package.nix
index 3e1dfc256bc9..89b4f1511381 100644
--- a/pkgs/by-name/sa/savepagenow/package.nix
+++ b/pkgs/by-name/sa/savepagenow/package.nix
@@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "pastpages";
-    repo = pname;
+    repo = "savepagenow";
     rev = "v${version}";
     sha256 = "1lz6rc47cds9rb35jdf8n13gr61wdkh5jqzx4skikm1yrqkwjyhm";
   };
diff --git a/pkgs/by-name/sc/scaphandre/package.nix b/pkgs/by-name/sc/scaphandre/package.nix
index 6e99301be1df..fc7f73931463 100644
--- a/pkgs/by-name/sc/scaphandre/package.nix
+++ b/pkgs/by-name/sc/scaphandre/package.nix
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "hubblo-org";
-    repo = pname;
+    repo = "scaphandre";
     rev = "v${version}";
     hash = "sha256-I+cECdpLoIj4yuWXfirwHlcn0Hkm9NxPqo/EqFiBObw=";
   };
diff --git a/pkgs/by-name/sc/scli/package.nix b/pkgs/by-name/sc/scli/package.nix
index 73f1a164128f..05b7fbbcc9fd 100644
--- a/pkgs/by-name/sc/scli/package.nix
+++ b/pkgs/by-name/sc/scli/package.nix
@@ -15,7 +15,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "isamert";
-    repo = pname;
+    repo = "scli";
     tag = "v${version}";
     sha256 = "sha256-pp3uVABsncXXL2PZvTymHPKGAFvB24tnX+3K+C0VW8g=";
   };
diff --git a/pkgs/by-name/sc/scmpuff/package.nix b/pkgs/by-name/sc/scmpuff/package.nix
index dabc7226af31..3a8045cb002c 100644
--- a/pkgs/by-name/sc/scmpuff/package.nix
+++ b/pkgs/by-name/sc/scmpuff/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "mroth";
-    repo = pname;
+    repo = "scmpuff";
     rev = "v${version}";
     sha256 = "sha256-+L0W+M8sZdUSCWj9Ftft1gkRRfWMHdxon2xNnotx8Xs=";
   };
diff --git a/pkgs/by-name/sc/scotty/package.nix b/pkgs/by-name/sc/scotty/package.nix
index 6d6990c7f09f..22cbaa18b126 100644
--- a/pkgs/by-name/sc/scotty/package.nix
+++ b/pkgs/by-name/sc/scotty/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "scotty";
-  version = "0.5.2";
+  version = "0.6.0";
 
   src = fetchFromSourcehut {
     owner = "~phw";
     repo = "scotty";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3SIgsAdcG44dhEZnoE1FE0prI8aVKtkeYYsmwK+UvUI=";
+    hash = "sha256-VvBnTnW4ngJ0yPT2CV7t7HEUwJlBfWNE3coTHxGcAs4=";
   };
 
   # Otherwise checks fail with `panic: open /etc/protocols: operation not permitted` when sandboxing is enabled on Darwin
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
       --replace-fail '!os.IsNotExist(err)' '!os.IsNotExist(err) && !os.IsPermission(err)'
   '';
 
-  vendorHash = "sha256-9LkWoep4R8Mii34m5wkLCw6AAMP92I1lgQnHajgzae8=";
+  vendorHash = "sha256-5mDY3vlRzoqJleNukB8NcPaAcDLX/UNegUSBYFMzGGA=";
 
   env = {
     # *Some* locale is required to be set
diff --git a/pkgs/by-name/sc/scout/package.nix b/pkgs/by-name/sc/scout/package.nix
index e0935322b274..ccb5aeaec7df 100644
--- a/pkgs/by-name/sc/scout/package.nix
+++ b/pkgs/by-name/sc/scout/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "liamg";
-    repo = pname;
+    repo = "scout";
     rev = "v${version}";
     hash = "sha256-9SimePyBUXXfT4+ZtciQMaoyXpyKi9D3LTwud8QMJ6w=";
   };
diff --git a/pkgs/by-name/sc/screenkey/package.nix b/pkgs/by-name/sc/screenkey/package.nix
index 5a7a5698c161..476557f79f33 100644
--- a/pkgs/by-name/sc/screenkey/package.nix
+++ b/pkgs/by-name/sc/screenkey/package.nix
@@ -15,8 +15,8 @@ python3.pkgs.buildPythonApplication rec {
   version = "1.5";
 
   src = fetchFromGitLab {
-    owner = pname;
-    repo = pname;
+    owner = "screenkey";
+    repo = "screenkey";
     rev = "v${version}";
     hash = "sha256-kWktKzRyWHGd1lmdKhPwrJoSzAIN2E5TKyg30uhM4Ug=";
   };
diff --git a/pkgs/by-name/sd/sd-local/package.nix b/pkgs/by-name/sd/sd-local/package.nix
index 7c3adcdc7a4f..961bbcb79009 100644
--- a/pkgs/by-name/sd/sd-local/package.nix
+++ b/pkgs/by-name/sd/sd-local/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "screwdriver-cd";
-    repo = pname;
+    repo = "sd-local";
     rev = "v${version}";
     sha256 = "sha256-7nL+9tJt4EnGGIhsGASXdBp0u7PXbbt50ADdK2Ciel0=";
   };
diff --git a/pkgs/by-name/sd/sdlookup/package.nix b/pkgs/by-name/sd/sdlookup/package.nix
index 9b41119a5812..8c61e611c652 100644
--- a/pkgs/by-name/sd/sdlookup/package.nix
+++ b/pkgs/by-name/sd/sdlookup/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "sdlookup";
   version = "unstable-2022-03-10";
 
   src = fetchFromGitHub {
     owner = "j3ssie";
-    repo = pname;
+    repo = "sdlookup";
     rev = "8554bfa27284c4764401dbd8da23800d4ae968a2";
     hash = "sha256-c6xAgOxle51waiFsSWvwO9eyt1KXuM0dEeepVsRQHkk=";
   };
diff --git a/pkgs/by-name/se/seagoat/package.nix b/pkgs/by-name/se/seagoat/package.nix
index 1efa4851ec4c..771f5ca58bb7 100644
--- a/pkgs/by-name/se/seagoat/package.nix
+++ b/pkgs/by-name/se/seagoat/package.nix
@@ -14,14 +14,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "seagoat";
-  version = "0.54.17";
+  version = "0.54.18";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kantord";
     repo = "SeaGOAT";
     tag = "v${version}";
-    hash = "sha256-8pLBZXj9p+nO+deozo57H/FlxDKd9KSQHZ8qkGsNzhA=";
+    hash = "sha256-vRaC6YrqejtRs8NHoTj6DB0CAYMSygRMDOTaJyk1BZc=";
   };
 
   build-system = [ python3Packages.poetry-core ];
diff --git a/pkgs/by-name/se/seasocks/package.nix b/pkgs/by-name/se/seasocks/package.nix
index 34bb25e5704e..2e72fee8bf51 100644
--- a/pkgs/by-name/se/seasocks/package.nix
+++ b/pkgs/by-name/se/seasocks/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "mattgodbolt";
-    repo = pname;
+    repo = "seasocks";
     rev = "v${version}";
     sha256 = "sha256-R1McxZm2qsUoggFGfL587g+8eQf7si56xVkR8B8nehQ=";
   };
diff --git a/pkgs/by-name/se/seaweedfs/package.nix b/pkgs/by-name/se/seaweedfs/package.nix
index 02f152cd6767..68f2a0c3c845 100644
--- a/pkgs/by-name/se/seaweedfs/package.nix
+++ b/pkgs/by-name/se/seaweedfs/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "3.87";
+  version = "3.88";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
     repo = "seaweedfs";
     rev = version;
-    hash = "sha256-B6MgmgxvbGTcJ4GHK+TT30sb++29gvr0Ce004YCGF2E=";
+    hash = "sha256-66yZtRF+gMSafcXQoUJ0bMuBJMDHXvImCWB3vMze/K8=";
   };
 
-  vendorHash = "sha256-39MXGJvaKipqTRN5w9UKeRnkbsNgNx0eSdnRR/cnd4Y=";
+  vendorHash = "sha256-aSNmEY82ODnxtlnQG6dZWTQfZ+zKCqLtj0DfpPcu3ik=";
 
   subPackages = [ "weed" ];
 
diff --git a/pkgs/by-name/se/senv/package.nix b/pkgs/by-name/se/senv/package.nix
index d7fd3e766918..55d836885367 100644
--- a/pkgs/by-name/se/senv/package.nix
+++ b/pkgs/by-name/se/senv/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "SpectralOps";
-    repo = pname;
+    repo = "senv";
     rev = "v${version}";
     sha256 = "sha256-TjlIX8FPNiPDQo41pIt04cki/orc+v30pV3o2bQQhAQ=";
   };
diff --git a/pkgs/by-name/se/setools/package.nix b/pkgs/by-name/se/setools/package.nix
index d00a1b9789f9..8fc3472d98f6 100644
--- a/pkgs/by-name/se/setools/package.nix
+++ b/pkgs/by-name/se/setools/package.nix
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
-    repo = pname;
+    repo = "setools";
     tag = version;
     hash = "sha256-/6dOzSz2Do4d6TSS50fuak0CysoQ532zJ0bJ532BUCE=";
   };
diff --git a/pkgs/by-name/sf/sfizz/package.nix b/pkgs/by-name/sf/sfizz/package.nix
index 39b35f4e664d..08bade12ae73 100644
--- a/pkgs/by-name/sf/sfizz/package.nix
+++ b/pkgs/by-name/sf/sfizz/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "sfztools";
-    repo = pname;
+    repo = "sfizz";
     rev = version;
     hash = "sha256-/G9tvJ4AcBSTmo44xDDKf6et1nSn/FV5m27ztDu10kI=";
     fetchSubmodules = true;
diff --git a/pkgs/by-name/sf/sfsexp/package.nix b/pkgs/by-name/sf/sfsexp/package.nix
index c7e9cde3ad1e..9106e785e005 100644
--- a/pkgs/by-name/sf/sfsexp/package.nix
+++ b/pkgs/by-name/sf/sfsexp/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "mjsottile";
-    repo = pname;
+    repo = "sfsexp";
     rev = "v${version}";
     sha256 = "sha256-uAk/8Emf23J0D3D5+eUEpWLY2fIvdQ7a80eGe9i1WQ8=";
   };
diff --git a/pkgs/by-name/sf/sftpman/package.nix b/pkgs/by-name/sf/sftpman/package.nix
index c0274be1de79..e51c6b3e3ed6 100644
--- a/pkgs/by-name/sf/sftpman/package.nix
+++ b/pkgs/by-name/sf/sftpman/package.nix
@@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "spantaleev";
-    repo = pname;
+    repo = "sftpman";
     rev = version;
     hash = "sha256-YxqN4+u0nYUWehbyRhjddIo2sythH3E0fiPSyrUlWhM=";
   };
diff --git a/pkgs/by-name/sh/shadered/package.nix b/pkgs/by-name/sh/shadered/package.nix
index ff9d322b9854..7d56afbfe763 100644
--- a/pkgs/by-name/sh/shadered/package.nix
+++ b/pkgs/by-name/sh/shadered/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "dfranx";
-    repo = pname;
+    repo = "SHADERed";
     rev = "v${version}";
     fetchSubmodules = true;
     sha256 = "0drf8wwx0gcmi22jq2yyjy7ppxynfq172wqakchscm313j248fjr";
diff --git a/pkgs/by-name/sh/shadowenv/package.nix b/pkgs/by-name/sh/shadowenv/package.nix
index b9cb01474888..f4eec683b660 100644
--- a/pkgs/by-name/sh/shadowenv/package.nix
+++ b/pkgs/by-name/sh/shadowenv/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "Shopify";
-    repo = pname;
+    repo = "shadowenv";
     rev = version;
     hash = "sha256-ZipFcwTpKKFnQWOPxXg07V71jitG0NSLpGLEzUSsUFA=";
   };
diff --git a/pkgs/by-name/sh/sheldon/package.nix b/pkgs/by-name/sh/sheldon/package.nix
index cdcb57ada5da..490f8e338dd1 100644
--- a/pkgs/by-name/sh/sheldon/package.nix
+++ b/pkgs/by-name/sh/sheldon/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "rossmacarthur";
-    repo = pname;
+    repo = "sheldon";
     rev = version;
     hash = "sha256-4tI/D9Z5+BAH7K9mA/sU/qPKWcPvZqpY5v4dDA0qfr0=";
   };
diff --git a/pkgs/by-name/sh/shellz/package.nix b/pkgs/by-name/sh/shellz/package.nix
index b1a263c3fddc..7a85730c3ab3 100644
--- a/pkgs/by-name/sh/shellz/package.nix
+++ b/pkgs/by-name/sh/shellz/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "evilsocket";
-    repo = pname;
+    repo = "shellz";
     rev = "v${version}";
     hash = "sha256-sUYDopSxaUPyrHev8XXobRoX6uxbdf5goJ75KYEPFNY=";
   };
diff --git a/pkgs/by-name/sh/shiori/package.nix b/pkgs/by-name/sh/shiori/package.nix
index 606db18f04c3..a7feee99616c 100644
--- a/pkgs/by-name/sh/shiori/package.nix
+++ b/pkgs/by-name/sh/shiori/package.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "go-shiori";
-    repo = pname;
+    repo = "shiori";
     rev = "v${version}";
     sha256 = "sha256-T4EFwvejLgNkcykPjSHU8WXJwqSqYPFaAD+9JX+uiJU=";
   };
diff --git a/pkgs/by-name/sh/showmethekey/package.nix b/pkgs/by-name/sh/showmethekey/package.nix
index 3281b3b5a123..092be4dbe8de 100644
--- a/pkgs/by-name/sh/showmethekey/package.nix
+++ b/pkgs/by-name/sh/showmethekey/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "showmethekey";
-  version = "1.18.1";
+  version = "1.18.2";
 
   src = fetchFromGitHub {
     owner = "AlynxZhou";
     repo = "showmethekey";
     tag = "v${version}";
-    hash = "sha256-/pfXAn6dWFIHsP1VBj+Cf989RuVzv4IbSClbJEvGstI=";
+    hash = "sha256-lLlNWMqVrtXVfXwObCjtmcOOQ2xfe7gK+izmxr4crlc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/si/signalbackup-tools/package.nix b/pkgs/by-name/si/signalbackup-tools/package.nix
index 67408a76f914..36724a0f8983 100644
--- a/pkgs/by-name/si/signalbackup-tools/package.nix
+++ b/pkgs/by-name/si/signalbackup-tools/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20250522";
+  version = "20250529";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     rev = version;
-    hash = "sha256-gfwlFvLoOPqL4GfV+Xv2m+afsfXjWR1gumn9VHp3etU=";
+    hash = "sha256-7TUyH2J4DFOAM1HWjWK4l4Dta0/aANhVUBNEbNF1G14=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/si/simdutf/package.nix b/pkgs/by-name/si/simdutf/package.nix
index 9351d0c02835..50183972f8fe 100644
--- a/pkgs/by-name/si/simdutf/package.nix
+++ b/pkgs/by-name/si/simdutf/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "simdutf";
-  version = "7.1.0";
+  version = "7.2.0";
 
   src = fetchFromGitHub {
     owner = "simdutf";
     repo = "simdutf";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2nDTARUH5gb/pP4WnCfSPzreAThMAuAuwRT7y2aumBA=";
+    hash = "sha256-ZfC0k1Z7nOeauHYTKjMt73qhoTn4c15dZWvICeuYhM8=";
   };
 
   # Fix build on darwin
diff --git a/pkgs/by-name/si/simh/package.nix b/pkgs/by-name/si/simh/package.nix
index 28d03352d3d6..55b856d65353 100644
--- a/pkgs/by-name/si/simh/package.nix
+++ b/pkgs/by-name/si/simh/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "simh";
-    repo = pname;
+    repo = "simh";
     rev = "v${version}";
     sha256 = "sha256-65+YfOWpVXPeT64TZcSaWJY+ODQ0q/pwF9jb8xGdpIs=";
   };
diff --git a/pkgs/by-name/si/simplotask/package.nix b/pkgs/by-name/si/simplotask/package.nix
index 67cb01ac86c7..8fd2638c5d2a 100644
--- a/pkgs/by-name/si/simplotask/package.nix
+++ b/pkgs/by-name/si/simplotask/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "simplotask";
-  version = "1.17.0";
+  version = "1.17.1";
 
   src = fetchFromGitHub {
     owner = "umputun";
     repo = "spot";
     rev = "v${version}";
-    hash = "sha256-uMS2Nf5Brx4hXMGMG3vTU3V2y83gLPb8vau7GA+DGak=";
+    hash = "sha256-6SWWf1ZprCZPXLvUtIln1+TrOztn7WWkN8o/fQXau5I=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/si/sioyek/package.nix b/pkgs/by-name/si/sioyek/package.nix
index 97e864bb51e6..a44e9826df8d 100644
--- a/pkgs/by-name/si/sioyek/package.nix
+++ b/pkgs/by-name/si/sioyek/package.nix
@@ -15,13 +15,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "sioyek";
-  version = "2.0.0-unstable-2025-05-13";
+  version = "2.0.0-unstable-2025-05-23";
 
   src = fetchFromGitHub {
     owner = "ahrm";
     repo = "sioyek";
-    rev = "eb03410682f70fa27cbe2f9ec3bf59ac086457d7";
-    hash = "sha256-iLGgiHQ5MiTvKcSgT3Kqw4lCFFkuAHoZhT+mpIdlBkQ=";
+    rev = "d73a2fcd74c0a119c397372a79aeea628205d4a7";
+    hash = "sha256-ZKAv/G/Bgb3lxEx+WRupTBxo4Gf5yFbZ+siNyz5lABY=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/si/sipexer/package.nix b/pkgs/by-name/si/sipexer/package.nix
index ca194801d204..2923565da7d3 100644
--- a/pkgs/by-name/si/sipexer/package.nix
+++ b/pkgs/by-name/si/sipexer/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "miconda";
-    repo = pname;
+    repo = "sipexer";
     rev = "v${version}";
     hash = "sha256-7L29nyFOc/5XAHpzGsFSngxMTwwIDkmwhIKIjHYGszc=";
   };
diff --git a/pkgs/by-name/sk/skim/package.nix b/pkgs/by-name/sk/skim/package.nix
index 85df95d7cc10..0656f449a518 100644
--- a/pkgs/by-name/sk/skim/package.nix
+++ b/pkgs/by-name/sk/skim/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "skim";
-  version = "0.17.2";
+  version = "0.17.3";
 
   outputs = [
     "out"
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
     owner = "skim-rs";
     repo = "skim";
     tag = "v${version}";
-    hash = "sha256-S9gHrGbEDRwMSsQWzPSIrYJaLhnCvfLtsS2eI3rPwdg=";
+    hash = "sha256-aq6qOlxFftiUyMqzbIgv/PnxqSNt6TsHCsy586LdZy0=";
   };
 
   postPatch = ''
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-IsPcVNwRx0ZDWATtbxmjuRERrhu8DpHh9v6Svj1dHzc=";
+  cargoHash = "sha256-yhZFLrpI2U/9VWGZkzYGzF5nPRmKpqJnfZ+6bmBYXNI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/sk/skopeo/package.nix b/pkgs/by-name/sk/skopeo/package.nix
index abdc1c4ebd31..9e8eeff9ad1d 100644
--- a/pkgs/by-name/sk/skopeo/package.nix
+++ b/pkgs/by-name/sk/skopeo/package.nix
@@ -19,13 +19,13 @@
 
 buildGoModule rec {
   pname = "skopeo";
-  version = "1.18.0";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "containers";
     repo = "skopeo";
-    hash = "sha256-Ws01dYx2Jq/zB8rWiWSnV4ZgcxyBWHWvE3DfG7gvFOc=";
+    hash = "sha256-Xi3M8M8UukxwWXNTnbFLA8RIWa6CHs84PjrOvtJEl78=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/sl/slackdump/package.nix b/pkgs/by-name/sl/slackdump/package.nix
index 7e951c177f4d..4edf9e05cda1 100644
--- a/pkgs/by-name/sl/slackdump/package.nix
+++ b/pkgs/by-name/sl/slackdump/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "slackdump";
-  version = "3.1.1";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "rusq";
     repo = "slackdump";
     tag = "v${version}";
-    hash = "sha256-DBIBOHoQIUp2WXj50w2ixhB9W8qBzdrBmNCKSuAJMGk=";
+    hash = "sha256-Ophs/HLdjwVPn8Q6Jng2F/GKp+Dmy8ULxGJm9L7IQXI=";
   };
 
   nativeCheckInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.IOKitTools;
@@ -32,7 +32,7 @@ buildGoModule rec {
       "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$"
     ];
 
-  vendorHash = "sha256-TEeYHT2jvU0ioMb3h/xjUg1fISsi5oHY5xKEcHwhC0Y=";
+  vendorHash = "sha256-iT5hCLOSWuquNsaSe3Wra6LsJeRF4NvI3+NXYkPoLEI=";
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/by-name/sl/sleep-on-lan/package.nix b/pkgs/by-name/sl/sleep-on-lan/package.nix
index b9f655d04633..10801694eef1 100644
--- a/pkgs/by-name/sl/sleep-on-lan/package.nix
+++ b/pkgs/by-name/sl/sleep-on-lan/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "SR-G";
-    repo = pname;
+    repo = "sleep-on-lan";
     rev = "${version}-RELEASE";
     sha256 = "sha256-WooFGIdXIIoJPMqmPpnT+bc+P+IARMSxa3CvXY9++mw=";
   };
diff --git a/pkgs/by-name/sl/sloth/package.nix b/pkgs/by-name/sl/sloth/package.nix
index 83c9dba28207..d57007c2ff0b 100644
--- a/pkgs/by-name/sl/sloth/package.nix
+++ b/pkgs/by-name/sl/sloth/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "slok";
-    repo = pname;
+    repo = "sloth";
     rev = "v${version}";
     hash = "sha256-qyDKM5Y8wRvqFE9rqnPePBvi/1UwR4vDRQRVTxPc6Ug=";
   };
diff --git a/pkgs/by-name/sm/smag/package.nix b/pkgs/by-name/sm/smag/package.nix
index fc0b1198de61..ec302ef8d20a 100644
--- a/pkgs/by-name/sm/smag/package.nix
+++ b/pkgs/by-name/sm/smag/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "aantn";
-    repo = pname;
+    repo = "smag";
     rev = "v${version}";
     hash = "sha256-Vyd35wYDNI4T7DdqihwpmJOAZGxjnCeWS609o3L+gHM=";
   };
diff --git a/pkgs/by-name/sm/smbscan/package.nix b/pkgs/by-name/sm/smbscan/package.nix
index 0171ab87d754..4cfffcff424a 100644
--- a/pkgs/by-name/sm/smbscan/package.nix
+++ b/pkgs/by-name/sm/smbscan/package.nix
@@ -4,14 +4,14 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication {
   pname = "smbscan";
   version = "unstable-2022-05-26";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "jeffhacks";
-    repo = pname;
+    repo = "smbscan";
     rev = "1b19d6040cab279b97bf002934bf6f8b34d6a8b4";
     hash = "sha256-cL1mnyzIbHB/X4c7sZKVv295LNnjqwR8TZBMe9s/peg=";
   };
diff --git a/pkgs/by-name/sm/smlfut/package.nix b/pkgs/by-name/sm/smlfut/package.nix
index 21938595b301..323f3ca6c3f3 100644
--- a/pkgs/by-name/sm/smlfut/package.nix
+++ b/pkgs/by-name/sm/smlfut/package.nix
@@ -7,15 +7,15 @@
   futhark,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "smlfut";
-  version = "1.6.2";
+  version = "1.6.4";
 
   src = fetchFromGitHub {
     owner = "diku-dk";
     repo = "smlfut";
-    rev = "v${version}";
-    hash = "sha256-0Bqgoyp43Y961BMghJFBUx+1lcM2HHlPDjPyLHquWiE=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-xICcobdvSdHZfNxz4WRDOsaL4JGFRK7LmhMzKOZY5FY=";
   };
 
   enableParallelBuilding = true;
@@ -43,4 +43,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ athas ];
     mainProgram = "smlfut";
   };
-}
+})
diff --git a/pkgs/by-name/sn/snapper-gui/package.nix b/pkgs/by-name/sn/snapper-gui/package.nix
index 83789dfa31be..4255b8caa8d5 100644
--- a/pkgs/by-name/sn/snapper-gui/package.nix
+++ b/pkgs/by-name/sn/snapper-gui/package.nix
@@ -11,13 +11,13 @@
   gobject-introspection,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "snapper-gui";
   version = "2020-10-20";
 
   src = fetchFromGitHub {
     owner = "ricardomv";
-    repo = pname;
+    repo = "snapper-gui";
     rev = "f0c67abe0e10cc9e2ebed400cf80ecdf763fb1d1";
     sha256 = "13j4spbi9pxg69zifzai8ifk4207sn0vwh6vjqryi0snd5sylh7h";
   };
diff --git a/pkgs/by-name/sn/snazy/package.nix b/pkgs/by-name/sn/snazy/package.nix
index 59e930056ffb..9aaeac88954e 100644
--- a/pkgs/by-name/sn/snazy/package.nix
+++ b/pkgs/by-name/sn/snazy/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "chmouel";
-    repo = pname;
+    repo = "snazy";
     rev = version;
     hash = "sha256-VR4IRMmSQCF/CXgKfJ5OEFbXg9o/40lBonupOF38lFg=";
   };
diff --git a/pkgs/by-name/sn/snippetpixie/package.nix b/pkgs/by-name/sn/snippetpixie/package.nix
index fde8bb973b85..2d6666446513 100644
--- a/pkgs/by-name/sn/snippetpixie/package.nix
+++ b/pkgs/by-name/sn/snippetpixie/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "bytepixie";
-    repo = pname;
+    repo = "snippetpixie";
     rev = version;
     sha256 = "0gs3d9hdywg4vcfbp4qfcagfjqalfgw9xpvywg4pw1cm3rzbdqmz";
   };
diff --git a/pkgs/by-name/sn/snips-sh/package.nix b/pkgs/by-name/sn/snips-sh/package.nix
index 5661aae79101..b28ae5a6b341 100644
--- a/pkgs/by-name/sn/snips-sh/package.nix
+++ b/pkgs/by-name/sn/snips-sh/package.nix
@@ -27,7 +27,10 @@ buildGoModule rec {
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
     homepage = "https://snips.sh";
-    maintainers = with lib.maintainers; [ jeremiahs ];
+    maintainers = with lib.maintainers; [
+      jeremiahs
+      matthiasbeyer
+    ];
     mainProgram = "snips.sh";
   };
 }
diff --git a/pkgs/by-name/sn/snowcat/package.nix b/pkgs/by-name/sn/snowcat/package.nix
index aa4899dda997..960c7777b88d 100644
--- a/pkgs/by-name/sn/snowcat/package.nix
+++ b/pkgs/by-name/sn/snowcat/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
-    repo = pname;
+    repo = "snowcat";
     rev = "v${version}";
     sha256 = "sha256-EulQYGOMIh952e4Xp13hT/HMW3qP1QXYtt5PEej1VTY=";
   };
diff --git a/pkgs/by-name/so/social-engineer-toolkit/package.nix b/pkgs/by-name/so/social-engineer-toolkit/package.nix
index 696ed2d71fb2..85bbb4c31773 100644
--- a/pkgs/by-name/so/social-engineer-toolkit/package.nix
+++ b/pkgs/by-name/so/social-engineer-toolkit/package.nix
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "trustedsec";
-    repo = pname;
+    repo = "social-engineer-toolkit";
     rev = version;
     sha256 = "ePbmUvnzLO0Wfuhym3bNSPV1x8rcCPqKMeWSRcbJGAo=";
   };
diff --git a/pkgs/by-name/so/sockdump/package.nix b/pkgs/by-name/so/sockdump/package.nix
index d79b4bf4a0b7..f2828422cbc1 100644
--- a/pkgs/by-name/so/sockdump/package.nix
+++ b/pkgs/by-name/so/sockdump/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "mechpen";
-    repo = pname;
+    repo = "sockdump";
     rev = "d40ec77e960d021861220bc14a273c5dcad13160";
     hash = "sha256-FLK1rgWvIoFGv/6+DtDhZGeOZrn7V1jYNS3S8qwL/dc=";
   };
@@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
 
   format = "other"; # none
 
-  installPhase = "install -D ${pname}.py $out/bin/${pname}";
+  installPhase = "install -D sockdump.py $out/bin/sockdump";
 
   meta = src.meta // {
     description = "Dump unix domain socket traffic with bpf";
diff --git a/pkgs/by-name/so/soco-cli/package.nix b/pkgs/by-name/so/soco-cli/package.nix
index 437d2cd92b53..edf5ffc461fe 100644
--- a/pkgs/by-name/so/soco-cli/package.nix
+++ b/pkgs/by-name/so/soco-cli/package.nix
@@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "avantrec";
-    repo = pname;
+    repo = "soco-cli";
     rev = "v${version}";
     hash = "sha256-WxBwHjh5tCXclQXqrHrpvZdcQU93RObteAfZyyVvKf0=";
   };
diff --git a/pkgs/by-name/so/sofia_sip/package.nix b/pkgs/by-name/so/sofia_sip/package.nix
index 0042c50b1dce..05c37421286b 100644
--- a/pkgs/by-name/so/sofia_sip/package.nix
+++ b/pkgs/by-name/so/sofia_sip/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "freeswitch";
-    repo = pname;
+    repo = "sofia-sip";
     rev = "v${version}";
     sha256 = "sha256-7QmK2UxEO5lC0KBDWB3bwKTy0Nc7WrdTLjoQYzezoaY=";
   };
diff --git a/pkgs/by-name/so/solo2-cli/package.nix b/pkgs/by-name/so/solo2-cli/package.nix
index 18f5e509a71f..9f20b67b499d 100644
--- a/pkgs/by-name/so/solo2-cli/package.nix
+++ b/pkgs/by-name/so/solo2-cli/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "solokeys";
-    repo = pname;
+    repo = "solo2-cli";
     rev = "v${version}";
     sha256 = "sha256-7tpO5ir42mIKJXD0NJzEPXi/Xe6LdyEeBQWNfOdgX5I=";
   };
diff --git a/pkgs/by-name/so/songrec/package.nix b/pkgs/by-name/so/songrec/package.nix
index aaff4caac201..a07210abb246 100644
--- a/pkgs/by-name/so/songrec/package.nix
+++ b/pkgs/by-name/so/songrec/package.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "marin-m";
-    repo = pname;
+    repo = "songrec";
     rev = version;
     hash = "sha256-pTonrxlYvfuLRKMXW0Lao4KCoNFlMzE9rH+hwpa60JY=";
   };
diff --git a/pkgs/by-name/so/soundfont-generaluser/package.nix b/pkgs/by-name/so/soundfont-generaluser/package.nix
index df1a24af9589..72be24893163 100644
--- a/pkgs/by-name/so/soundfont-generaluser/package.nix
+++ b/pkgs/by-name/so/soundfont-generaluser/package.nix
@@ -1,29 +1,31 @@
 {
   lib,
   stdenv,
-  fetchzip,
+  fetchFromGitHub,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "generaluser";
-  version = "1.471";
+  version = "2.0.2-unstable-2025-04-21";
 
-  # we can't use fetchurl since stdenv does not handle unpacking *.zip's by default.
-  src = fetchzip {
-    # Linked on https://www.schristiancollins.com/generaluser.php:
-    url = "https://www.dropbox.com/s/4x27l49kxcwamp5/GeneralUser_GS_${version}.zip";
-    sha256 = "sha256-lwUlWubXiVZ8fijKuNF54YQjT0uigjNAbjKaNjmC51s=";
+  src = fetchFromGitHub {
+    owner = "mrbumpy409";
+    repo = "GeneralUser-GS";
+    rev = "74d4cfe4042a61ddab17d4f86dbccd9d2570eb2a";
+    hash = "sha256-I27l8F/BFAo6YSNbtAV14AKVsPIJTHFG2eGudseWmjo=";
   };
 
   installPhase = ''
-    install -Dm644 GeneralUser*.sf2 $out/share/soundfonts/GeneralUser-GS.sf2
+    runHook preInstall
+    install -Dm644 $src/GeneralUser-GS.sf2 $out/share/soundfonts/GeneralUser-GS.sf2
+    runHook postInstall
   '';
 
-  meta = with lib; {
-    description = "SoundFont bank featuring 259 instrument presets and 11 drum kits";
+  meta = {
+    description = "General MIDI SoundFont with a low memory footprint";
     homepage = "https://www.schristiancollins.com/generaluser.php";
-    license = licenses.generaluser;
-    platforms = platforms.all;
-    maintainers = [ ];
+    license = lib.licenses.generaluser;
+    maintainers = with lib.maintainers; [ keenanweaver ];
+    platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/sp/speedtest-go/package.nix b/pkgs/by-name/sp/speedtest-go/package.nix
index f59435e1a6be..61d471de56c8 100644
--- a/pkgs/by-name/sp/speedtest-go/package.nix
+++ b/pkgs/by-name/sp/speedtest-go/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "showwin";
-    repo = pname;
+    repo = "speedtest-go";
     tag = "v${version}";
     hash = "sha256-w0gIyeoQP+MfA9Q2CD7+laABmSrJ9u836E+UIhJeWdk=";
   };
diff --git a/pkgs/by-name/sp/spire/package.nix b/pkgs/by-name/sp/spire/package.nix
index 8bd8ea72c7ca..ed97b14cd0f8 100644
--- a/pkgs/by-name/sp/spire/package.nix
+++ b/pkgs/by-name/sp/spire/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "spiffe";
-    repo = pname;
+    repo = "spire";
     rev = "v${version}";
     sha256 = "sha256-+jy0hvvjkkp6vDUEkoskjgTlq+wd0eKh/i1xkOLXbrA=";
   };
diff --git a/pkgs/by-name/sp/spruce/package.nix b/pkgs/by-name/sp/spruce/package.nix
index 7e84b075cfae..a04ecd0e2c72 100644
--- a/pkgs/by-name/sp/spruce/package.nix
+++ b/pkgs/by-name/sp/spruce/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "geofffranks";
-    repo = pname;
+    repo = "spruce";
     rev = "v${version}";
     hash = "sha256-wLxPHaCU0fciSIdK26dV4XOnJsp5EKKEXzgspWC1GvA=";
   };
diff --git a/pkgs/by-name/sp/sptlrx/package.nix b/pkgs/by-name/sp/sptlrx/package.nix
index 4c20e7a6d59a..3dfd390d2ecb 100644
--- a/pkgs/by-name/sp/sptlrx/package.nix
+++ b/pkgs/by-name/sp/sptlrx/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "raitonoberu";
-    repo = pname;
+    repo = "sptlrx";
     rev = "v${version}";
     hash = "sha256-b8ALhEjolH0RH+I9HVQeOagPBi2isLNUxqKdj5u2O9s=";
   };
diff --git a/pkgs/by-name/sp/spyre/package.nix b/pkgs/by-name/sp/spyre/package.nix
index c9296162f014..c2d7786f88f4 100644
--- a/pkgs/by-name/sp/spyre/package.nix
+++ b/pkgs/by-name/sp/spyre/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "spyre-project";
-    repo = pname;
+    repo = "spyre";
     rev = "v${version}";
     hash = "sha256-wlGZTMCJE6Ki5/6R6J9EJP06/S125BNNd/jNPYGwKNw=";
   };
diff --git a/pkgs/by-name/sq/sq/package.nix b/pkgs/by-name/sq/sq/package.nix
index 6b18c426d126..29f32422002f 100644
--- a/pkgs/by-name/sq/sq/package.nix
+++ b/pkgs/by-name/sq/sq/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "neilotoole";
-    repo = pname;
+    repo = "sq";
     rev = "v${version}";
     hash = "sha256-y7+UfwTbL0KTQgz4JX/q6QQqL0n8SO1qgKTrK9AFhO4=";
   };
diff --git a/pkgs/by-name/sq/sqldef/package.nix b/pkgs/by-name/sq/sqldef/package.nix
index d9a1cd4eda76..b98f4a856fe7 100644
--- a/pkgs/by-name/sq/sqldef/package.nix
+++ b/pkgs/by-name/sq/sqldef/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "sqldef";
-  version = "1.0.7";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "sqldef";
     repo = "sqldef";
     rev = "v${version}";
-    hash = "sha256-FDJeRIrx2LS6TQAlm9Kj13O4fccnRG6mYcLwTrOGrOI=";
+    hash = "sha256-+KU/oROHl7i5GI0KYEzV8MILE6SQyAG3UHoiL6PHYSU=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/sq/squeekboard/package.nix b/pkgs/by-name/sq/squeekboard/package.nix
index 0579a91b4fbc..189403cb4238 100644
--- a/pkgs/by-name/sq/squeekboard/package.nix
+++ b/pkgs/by-name/sq/squeekboard/package.nix
@@ -30,14 +30,14 @@ stdenv.mkDerivation rec {
     domain = "gitlab.gnome.org";
     group = "World";
     owner = "Phosh";
-    repo = pname;
+    repo = "squeekboard";
     rev = "v${version}";
     hash = "sha256-UsUr4UnYNo2ybEdNyOD/IiafEZ1YJFwRQ3CVy76X2H0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    name = "${pname}-${version}";
+    name = "squeekboard-${version}";
     hash = "sha256-3K1heokPYxYbiAGha9TrrjQXguzGv/djIB4eWa8dVjg=";
   };
 
diff --git a/pkgs/by-name/ss/sshchecker/package.nix b/pkgs/by-name/ss/sshchecker/package.nix
index 9aef78f68877..58a82acd63ee 100644
--- a/pkgs/by-name/ss/sshchecker/package.nix
+++ b/pkgs/by-name/ss/sshchecker/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "lazytools";
-    repo = pname;
+    repo = "sshchecker";
     rev = "v${version}";
     hash = "sha256-QMc64ynPLHQGsmDOsoChgmqmpRDyMYmmSAPwAEFBK40=";
   };
diff --git a/pkgs/by-name/ss/sshed/package.nix b/pkgs/by-name/ss/sshed/package.nix
index 3927b72ce3d2..4ab40cc6cad9 100644
--- a/pkgs/by-name/ss/sshed/package.nix
+++ b/pkgs/by-name/ss/sshed/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "trntv";
-    repo = pname;
+    repo = "sshed";
     rev = version;
     hash = "sha256-y8IQzOGs78T44jLcNNjPlfopyptX3Mhv2LdawqS1T+U=";
   };
diff --git a/pkgs/by-name/ss/sslsplit/package.nix b/pkgs/by-name/ss/sslsplit/package.nix
index 3f1a8fd9e8b7..73ba386ae1cb 100644
--- a/pkgs/by-name/ss/sslsplit/package.nix
+++ b/pkgs/by-name/ss/sslsplit/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "droe";
-    repo = pname;
+    repo = "sslsplit";
     rev = version;
     sha256 = "1p43z9ln5rbc76v0j1k3r4nhvfw71hq8jzsallb54z9hvwfvqp3l";
   };
diff --git a/pkgs/by-name/ss/ssmsh/package.nix b/pkgs/by-name/ss/ssmsh/package.nix
index e613ec7c0b7a..c0d7c1ff74d3 100644
--- a/pkgs/by-name/ss/ssmsh/package.nix
+++ b/pkgs/by-name/ss/ssmsh/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "bwhaley";
-    repo = pname;
+    repo = "ssmsh";
     rev = "v${version}";
     sha256 = "sha256-UmfwDukRVyfX+DmUfRi+KepqFrPtDNImKd22/dI7ytk=";
   };
diff --git a/pkgs/by-name/st/stacs/package.nix b/pkgs/by-name/st/stacs/package.nix
index 7cc6c87151c0..4d96c29f1730 100644
--- a/pkgs/by-name/st/stacs/package.nix
+++ b/pkgs/by-name/st/stacs/package.nix
@@ -10,7 +10,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "stacscan";
-    repo = pname;
+    repo = "stacs";
     rev = version;
     sha256 = "00ZYdpJktqUXdzPcouHyZcOQyFm7jdFNVuDqsufOviE=";
   };
diff --git a/pkgs/by-name/st/starboard/package.nix b/pkgs/by-name/st/starboard/package.nix
index a14786838b63..26bdf9ba4afa 100644
--- a/pkgs/by-name/st/starboard/package.nix
+++ b/pkgs/by-name/st/starboard/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
-    repo = pname;
+    repo = "starboard";
     rev = "v${version}";
     hash = "sha256-mCYnJ1SFa3OuYQlPWTq9vWV9s/jtaQ6dOousV/UNR18=";
     # populate values that require us to use git. By doing this in postFetch we
diff --git a/pkgs/by-name/st/stc-cli/package.nix b/pkgs/by-name/st/stc-cli/package.nix
index 6fcef93d0d74..18a7c7c24b46 100644
--- a/pkgs/by-name/st/stc-cli/package.nix
+++ b/pkgs/by-name/st/stc-cli/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "tenox7";
-    repo = pname;
+    repo = "stc";
     rev = version;
     sha256 = "sha256-ftlq7vrnTb4N2bqwiF9gtRj7hZlo6PTUMb/bk2hn/cU=";
   };
diff --git a/pkgs/by-name/st/steam-tui/package.nix b/pkgs/by-name/st/steam-tui/package.nix
index 822b234fe549..2e205882e9ab 100644
--- a/pkgs/by-name/st/steam-tui/package.nix
+++ b/pkgs/by-name/st/steam-tui/package.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "dmadisetti";
-    repo = pname;
+    repo = "steam-tui";
     rev = version;
     sha256 = "sha256-3vBIpPIsh+7PjTuNNqp7e/pdciOYnzuGkjb/Eks6QJw=";
   };
diff --git a/pkgs/by-name/st/step-kms-plugin/package.nix b/pkgs/by-name/st/step-kms-plugin/package.nix
index 681ee769333a..93f455bb1a96 100644
--- a/pkgs/by-name/st/step-kms-plugin/package.nix
+++ b/pkgs/by-name/st/step-kms-plugin/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "smallstep";
-    repo = pname;
+    repo = "step-kms-plugin";
     rev = "v${version}";
     hash = "sha256-XZRNEUMko3HMlKOyHYK3TQywkqC6K5VvdvGFTSk6V68=";
   };
diff --git a/pkgs/by-name/st/sticky/package.nix b/pkgs/by-name/st/sticky/package.nix
index 8fc848008d0a..43788cc9ea15 100644
--- a/pkgs/by-name/st/sticky/package.nix
+++ b/pkgs/by-name/st/sticky/package.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "linuxmint";
-    repo = pname;
+    repo = "sticky";
     rev = version;
     hash = "sha256-Mj14S4M7NMQE17SN8uED4UIJN6nwTo3E+D3j0tGKXc4=";
   };
diff --git a/pkgs/by-name/st/stone-kingdoms/package.nix b/pkgs/by-name/st/stone-kingdoms/package.nix
index 6065059b5ee0..4aba7cfb2fa7 100644
--- a/pkgs/by-name/st/stone-kingdoms/package.nix
+++ b/pkgs/by-name/st/stone-kingdoms/package.nix
@@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation rec {
 
   src = fetchFromGitLab {
     owner = "stone-kingdoms";
-    repo = pname;
+    repo = "stone-kingdoms";
     rev = version;
     hash = "sha256-W2hzJg22O857Kh7CJVVHV5qu8QKjXCwW3hmgKBc0n2g=";
   };
@@ -30,12 +30,12 @@ stdenvNoCC.mkDerivation rec {
 
   desktopItems = [
     (makeDesktopItem {
-      name = pname;
-      exec = pname;
-      icon = pname;
+      name = "stone-kingdoms";
+      exec = "stone-kingdoms";
+      icon = "stone-kingdoms";
       comment = "A real-time strategy game made with LÖVE based on the original Stronghold by Firefly studios";
       desktopName = "Stone Kingdoms";
-      genericName = pname;
+      genericName = "stone-kingdoms";
       categories = [ "Game" ];
     })
   ];
diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix
index 68930c92d64d..f8b521af0d57 100644
--- a/pkgs/by-name/st/strace/package.nix
+++ b/pkgs/by-name/st/strace/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "strace";
-  version = "6.14";
+  version = "6.15";
 
   src = fetchurl {
     url = "https://strace.io/files/${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-JE87XCCjKFTKm3yno+4JHdPUvSCTOhcezujbSGx308k=";
+    hash = "sha256-hVLfqwirwioPIEjJj9lUH9TXG2iCUHlSeA2rfHxRL1E=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/st/stratis-cli/package.nix b/pkgs/by-name/st/stratis-cli/package.nix
index d38088428f79..d63f3e442dd0 100644
--- a/pkgs/by-name/st/stratis-cli/package.nix
+++ b/pkgs/by-name/st/stratis-cli/package.nix
@@ -7,21 +7,21 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "stratis-cli";
-  version = "3.7.0";
+  version = "3.8.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stratis-storage";
-    repo = pname;
+    repo = "stratis-cli";
     tag = "v${version}";
-    hash = "sha256-F/RP/bWf2fV1IvNbrkYX3d94om1kACNe+oJI8pXM5P4=";
+    hash = "sha256-zyby53QEC9txH/EP0plV4vUg9fRV6tZJtdQEWQ2iKCA=";
   };
 
-  nativeBuildInputs = with python3Packages; [
+  build-system = with python3Packages; [
     setuptools
   ];
 
-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python3Packages; [
     dbus-client-gen
     dbus-python-client-gen
     justbytes
@@ -42,6 +42,8 @@ python3Packages.buildPythonApplication rec {
 
   pythonImportsCheck = [ "stratis_cli" ];
 
+  env.STRATIS_STRICT_POOL_FEATURES = "1"; # required for unit tests
+
   passthru.tests = nixosTests.stratis;
 
   meta = with lib; {
diff --git a/pkgs/by-name/st/stratisd/package.nix b/pkgs/by-name/st/stratisd/package.nix
index 1b8259928646..2b88e75a6bba 100644
--- a/pkgs/by-name/st/stratisd/package.nix
+++ b/pkgs/by-name/st/stratisd/package.nix
@@ -29,18 +29,18 @@
 
 stdenv.mkDerivation rec {
   pname = "stratisd";
-  version = "3.7.3";
+  version = "3.8.1";
 
   src = fetchFromGitHub {
     owner = "stratis-storage";
-    repo = pname;
+    repo = "stratisd";
     tag = "stratisd-v${version}";
-    hash = "sha256-W8ssLTFU36t6iLrt9S9V8qcN7EP4IsL7VbhNPLpftio=";
+    hash = "sha256-vYqvYC3r1TQ62YtMJYOx8bRxFJOam5ntbOS+FJZL/gQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-blhB+UfvG22Xe2O0csZ00/jgnVcLTUIkDJG5P22mffQ=";
+    hash = "sha256-B3n9Ot4CFcVL/R2wHPuDIPBca/5pb2VgcuP1pxnnUrA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/su/subjs/package.nix b/pkgs/by-name/su/subjs/package.nix
index 9bc455593bba..b2ad1e60feaf 100644
--- a/pkgs/by-name/su/subjs/package.nix
+++ b/pkgs/by-name/su/subjs/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "lc";
-    repo = pname;
+    repo = "subjs";
     rev = "v${version}";
     hash = "sha256-csxFn3YUnuYjZ5/4jIi7DfuujB/gFjHogLaV4XK5kQU=";
   };
diff --git a/pkgs/by-name/su/sublime_syntax_convertor/Gemfile.lock b/pkgs/by-name/su/sublime_syntax_convertor/Gemfile.lock
index 82c833feb066..1f079d3c6c56 100644
--- a/pkgs/by-name/su/sublime_syntax_convertor/Gemfile.lock
+++ b/pkgs/by-name/su/sublime_syntax_convertor/Gemfile.lock
@@ -4,16 +4,15 @@ GEM
 GEM
   remote: https://rubygems.org/
   specs:
-    plist (3.7.1)
+    plist (3.7.2)
     sublime_syntax_convertor (0.1.0)
       plist
 
 PLATFORMS
   ruby
-  x86_64-linux
 
 DEPENDENCIES
   sublime_syntax_convertor!
 
 BUNDLED WITH
-   2.5.5
+   2.6.6
diff --git a/pkgs/by-name/su/sublime_syntax_convertor/gemset.nix b/pkgs/by-name/su/sublime_syntax_convertor/gemset.nix
index 246a8f8e5297..86122b31f069 100644
--- a/pkgs/by-name/su/sublime_syntax_convertor/gemset.nix
+++ b/pkgs/by-name/su/sublime_syntax_convertor/gemset.nix
@@ -4,10 +4,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0b643i5b7b7galvlb2fc414ifmb78b5lsq47gnvhzl8m27dl559z";
+      sha256 = "0hlaf4b3d8grxm9fqbnam5gwd55wvghl0jyzjd1hc5hirhklaynk";
       type = "gem";
     };
-    version = "3.7.1";
+    version = "3.7.2";
   };
   sublime_syntax_convertor = {
     dependencies = [ "plist" ];
diff --git a/pkgs/by-name/su/sublime_syntax_convertor/package.nix b/pkgs/by-name/su/sublime_syntax_convertor/package.nix
index 869498bfb4ed..2a654168bccb 100644
--- a/pkgs/by-name/su/sublime_syntax_convertor/package.nix
+++ b/pkgs/by-name/su/sublime_syntax_convertor/package.nix
@@ -1,9 +1,16 @@
-{ lib, bundlerApp }:
-bundlerApp {
+{
+  lib,
+  bundlerApp,
+  bundlerUpdateScript,
+}:
+
+bundlerApp rec {
   pname = "sublime_syntax_convertor";
   gemdir = ./.;
   exes = [ "sublime_syntax_convertor" ];
 
+  passthru.updateScript = bundlerUpdateScript pname;
+
   meta = {
     description = "Converts tmLanguage to sublime-syntax";
     homepage = "https://github.com/aziz/SublimeSyntaxConvertor/";
diff --git a/pkgs/by-name/su/subtitlr/package.nix b/pkgs/by-name/su/subtitlr/package.nix
index ffcb31ed21ae..4d06c340010e 100644
--- a/pkgs/by-name/su/subtitlr/package.nix
+++ b/pkgs/by-name/su/subtitlr/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "yoanbernabeu";
-    repo = pname;
+    repo = "Subtitlr";
     rev = version;
     hash = "sha256-PbeQzNkFj4eSg/zhk8bXij36DvJ9+g22kF5TqdX5O04=";
   };
diff --git a/pkgs/by-name/su/suckit/package.nix b/pkgs/by-name/su/suckit/package.nix
index af8db72d3c13..137a5632d00b 100644
--- a/pkgs/by-name/su/suckit/package.nix
+++ b/pkgs/by-name/su/suckit/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "skallwar";
-    repo = pname;
+    repo = "suckit";
     rev = "v${version}";
     sha256 = "sha256-M4/vD1sVny7hAf4h56Z2xy7yuCqH/H3qHYod6haZOs0=";
   };
diff --git a/pkgs/by-name/su/supercronic/package.nix b/pkgs/by-name/su/supercronic/package.nix
index 49ac6669c58a..f3ec30d7a435 100644
--- a/pkgs/by-name/su/supercronic/package.nix
+++ b/pkgs/by-name/su/supercronic/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "aptible";
-    repo = pname;
+    repo = "supercronic";
     rev = "v${version}";
     hash = "sha256-tvDjjG8ym1wdQzQSO7T5BkbYbqD1M+EnPSPumbFKRhE=";
   };
diff --git a/pkgs/by-name/su/superd/package.nix b/pkgs/by-name/su/superd/package.nix
index 498988b15a6b..95773ac0e43f 100644
--- a/pkgs/by-name/su/superd/package.nix
+++ b/pkgs/by-name/su/superd/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromSourcehut {
     owner = "~craftyguy";
-    repo = pname;
+    repo = "superd";
     rev = version;
     hash = "sha256-5g9Y1Lpxp9cUe0sNvU5CdsTGcN+j00gIKPO9pD5j8uM=";
   };
diff --git a/pkgs/by-name/su/surrealdb-migrations/package.nix b/pkgs/by-name/su/surrealdb-migrations/package.nix
index fe2fa0b647e9..41dbc363a552 100644
--- a/pkgs/by-name/su/surrealdb-migrations/package.nix
+++ b/pkgs/by-name/su/surrealdb-migrations/package.nix
@@ -11,12 +11,12 @@ let
   pname = "surrealdb-migrations";
   version = "2.2.2";
 in
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   inherit pname version;
 
   src = fetchFromGitHub {
     owner = "Odonno";
-    repo = pname;
+    repo = "surrealdb-migrations";
     rev = "v${version}";
     hash = "sha256-PLCnfkjmmp7Xx6sF9u15X52JB3x8135xjBr8yYkqYhQ=";
   };
diff --git a/pkgs/by-name/su/surrealdb/package.nix b/pkgs/by-name/su/surrealdb/package.nix
index 4a3a3c38b991..287be7331cc2 100644
--- a/pkgs/by-name/su/surrealdb/package.nix
+++ b/pkgs/by-name/su/surrealdb/package.nix
@@ -11,17 +11,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "surrealdb";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "surrealdb";
     repo = "surrealdb";
     tag = "v${version}";
-    hash = "sha256-D7eujFJiFHmWlEoVkMkUSIdJt5fx+jTTqDwZs0JJw4o=";
+    hash = "sha256-1qdO9uRuR/s7j58HjA9k3XQWoqdPMRVcReTqIWTdWGc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-dXLJKwwNIv4QcbROJyWB9oGBqh6bztz37tXMzc5jYUM=";
+  cargoHash = "sha256-OfSSrHwjqIZ8DYE2XAPnHBsPy4ILS+57hLXJdDgafGk=";
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''
diff --git a/pkgs/by-name/sv/svdtools/package.nix b/pkgs/by-name/sv/svdtools/package.nix
index 86f0059cca56..313d6bbdd3c2 100644
--- a/pkgs/by-name/sv/svdtools/package.nix
+++ b/pkgs/by-name/sv/svdtools/package.nix
@@ -6,15 +6,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svdtools";
-  version = "0.4.6";
+  version = "0.5.0";
 
   src = fetchCrate {
     inherit version pname;
-    hash = "sha256-AfRFtybGEpArLGKp4AkGlokfNFMK8Ez5VA5Fu5GUhRI=";
+    hash = "sha256-2GemBVTRvYC5bvlYgJKmDJM78ZoE63B1QwV8cfSHYPg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-0GR9pbrevb0USu8de1oFHePJH1hGTvcVh3Gc9WKP0uA=";
+  cargoHash = "sha256-sn+Z3/p4Ek/wxwTj6uwDBFP1hFNGDb2EZ7MO0zvPjPk=";
 
   meta = with lib; {
     description = "Tools to handle vendor-supplied, often buggy SVD files";
diff --git a/pkgs/by-name/sv/svix-cli/package.nix b/pkgs/by-name/sv/svix-cli/package.nix
index 33f39c11f926..82915128fcdc 100644
--- a/pkgs/by-name/sv/svix-cli/package.nix
+++ b/pkgs/by-name/sv/svix-cli/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "svix";
-    repo = pname;
+    repo = "svix-cli";
     rev = revision;
     hash = "sha256-bHcxhJs4Nu/hdiftQFZMx4M5iqFtpOzrsvXOgo9NlDc=";
   };
diff --git a/pkgs/by-name/sv/svu/package.nix b/pkgs/by-name/sv/svu/package.nix
index 82eddfa960d7..13a25e5eb109 100644
--- a/pkgs/by-name/sv/svu/package.nix
+++ b/pkgs/by-name/sv/svu/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "caarlos0";
-    repo = pname;
+    repo = "svu";
     rev = "v${version}";
     sha256 = "sha256-jnUVl34luj6kUyx27+zWFxKZMD+R1uzu78oJV7ziSag=";
   };
diff --git a/pkgs/by-name/sw/swaggerhole/package.nix b/pkgs/by-name/sw/swaggerhole/package.nix
index 3f07eb76b5d8..d1311c61fd8f 100644
--- a/pkgs/by-name/sw/swaggerhole/package.nix
+++ b/pkgs/by-name/sw/swaggerhole/package.nix
@@ -4,14 +4,14 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication {
   pname = "swaggerhole";
   version = "1.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Liodeus";
-    repo = pname;
+    repo = "swaggerhole";
     # Source is not tagged at the moment, https://github.com/Liodeus/swaggerHole/issues/2
     rev = "14846406fbd0f145d71ad51c3b87f383e4afbc3b";
     hash = "sha256-3HmIpn1A86PXZRL+SqMdr84O16hW1mCUWHKnOVolmx8=";
diff --git a/pkgs/by-name/sw/swappy/package.nix b/pkgs/by-name/sw/swappy/package.nix
index 91afa5de1f1b..71f07769e2b4 100644
--- a/pkgs/by-name/sw/swappy/package.nix
+++ b/pkgs/by-name/sw/swappy/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "jtheoof";
-    repo = pname;
+    repo = "swappy";
     rev = "v${version}";
     hash = "sha256-/XPvy98Il4i8cDl9vH6f0/AZmiSqseSXnen7HfMqCDo=";
   };
diff --git a/pkgs/by-name/sw/swaynotificationcenter/package.nix b/pkgs/by-name/sw/swaynotificationcenter/package.nix
index 91e3b871cfa3..565ff0e2e499 100644
--- a/pkgs/by-name/sw/swaynotificationcenter/package.nix
+++ b/pkgs/by-name/sw/swaynotificationcenter/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: rec {
 
   src = fetchFromGitHub {
     owner = "ErikReider";
-    repo = pname;
+    repo = "SwayNotificationCenter";
     rev = "v${version}";
     hash = "sha256-kRawYbBLVx0ie4t7tChkA8QJShS83fUcGrJSKkxBy8Q=";
   };
diff --git a/pkgs/by-name/sw/swww/package.nix b/pkgs/by-name/sw/swww/package.nix
index ca08abbd81d7..ee26b51a9786 100644
--- a/pkgs/by-name/sw/swww/package.nix
+++ b/pkgs/by-name/sw/swww/package.nix
@@ -7,25 +7,31 @@
   libxkbcommon,
   installShellFiles,
   scdoc,
+  wayland-protocols,
+  wayland-scanner,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "swww";
-  version = "0.9.5";
+  version = "0.10.0-unstable-2025-05-27";
 
+  # Fixes build for locating wayland.xml, go back to regular tagged releases at next version bump
+  # https://codeberg.org/LGFae/waybackend/issues/2
   src = fetchFromGitHub {
     owner = "LGFae";
     repo = "swww";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-ldy9HhIsWdtTdvtRLV3qDT80oX646BI4Q+YX5wJXbsc=";
+    rev = "800619eb70c0f4293a5b449103f55a0a3cfe2963";
+    hash = "sha256-zkw1r2mmICkplgXTyN6GckTy0XEBAEoz4H1VQuP8eMU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-K1ww0bOD747EDtqYkA0Dlu7cwbjYcPwSXPSqQDbTwZo=";
+  cargoHash = "sha256-L2mbQJ0dAiB8+NOATnrPhVrjHvE5zjA1frhPbLUJ3sI=";
 
   buildInputs = [
     lz4
     libxkbcommon
+    wayland-protocols
+    wayland-scanner
   ];
 
   doCheck = false; # Integration tests do not work in sandbox environment
diff --git a/pkgs/by-name/sy/synth/package.nix b/pkgs/by-name/sy/synth/package.nix
index b6f061f4647e..48f1a17c592b 100644
--- a/pkgs/by-name/sy/synth/package.nix
+++ b/pkgs/by-name/sy/synth/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "shuttle-hq";
-    repo = pname;
+    repo = "synth";
     rev = "v${version}";
     sha256 = "sha256-/z2VEfeCCuffxlMh4WOpYkMSAgmh+sbx3ajcD5d4DdE=";
   };
diff --git a/pkgs/by-name/sy/sysbench/package.nix b/pkgs/by-name/sy/sysbench/package.nix
index 873932a81805..972d9a6337d8 100644
--- a/pkgs/by-name/sy/sysbench/package.nix
+++ b/pkgs/by-name/sy/sysbench/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "akopytov";
-    repo = pname;
+    repo = "sysbench";
     rev = version;
     sha256 = "1sanvl2a52ff4shj62nw395zzgdgywplqvwip74ky8q7s6qjf5qy";
   };
diff --git a/pkgs/by-name/sy/systemd-wait/package.nix b/pkgs/by-name/sy/systemd-wait/package.nix
index d1a7e0c1f92f..3d5c37d4751d 100644
--- a/pkgs/by-name/sy/systemd-wait/package.nix
+++ b/pkgs/by-name/sy/systemd-wait/package.nix
@@ -4,13 +4,13 @@
   lib,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "systemd-wait";
   version = "0.1+2018-10-05";
 
   src = fetchFromGitHub {
     owner = "Stebalien";
-    repo = pname;
+    repo = "systemd-wait";
     rev = "bbb58dd4584cc08ad20c3888edb7628f28aee3c7";
     sha256 = "1l8rd0wzf3m7fk0g1c8wc0csdisdfac0filhixpgp0ck9ignayq5";
   };
diff --git a/pkgs/by-name/ta/tab-rs/package.nix b/pkgs/by-name/ta/tab-rs/package.nix
index 3469d56bc7e1..cfdb619e807c 100644
--- a/pkgs/by-name/ta/tab-rs/package.nix
+++ b/pkgs/by-name/ta/tab-rs/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "austinjones";
-    repo = pname;
+    repo = "tab-rs";
     rev = "v${version}";
     sha256 = "1crj0caimin667f9kz34c0sm77892dmqaf1kxryqakqm75az5wfr";
   };
diff --git a/pkgs/by-name/ta/tacacsplus/package.nix b/pkgs/by-name/ta/tacacsplus/package.nix
index a818498b627b..9ab2eeeca8b6 100644
--- a/pkgs/by-name/ta/tacacsplus/package.nix
+++ b/pkgs/by-name/ta/tacacsplus/package.nix
@@ -2,11 +2,13 @@
   lib,
   stdenv,
   fetchurl,
-  tcp_wrappers,
   flex,
   bison,
   perl,
   libnsl,
+  # --with-libwrap=yes is currently broken, TODO unbreak
+  withLibWrap ? false,
+  tcp_wrappers,
 }:
 
 stdenv.mkDerivation rec {
@@ -22,10 +24,17 @@ stdenv.mkDerivation rec {
     flex
     bison
   ];
-  buildInputs = [
-    tcp_wrappers
-    perl
-    libnsl
+  buildInputs =
+    [
+      perl
+      libnsl
+    ]
+    ++ lib.optionals withLibWrap [
+      tcp_wrappers
+    ];
+
+  configureFlags = lib.optionals (!withLibWrap) [
+    "--with-libwrap=no"
   ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/ta/tailscale-systray/package.nix b/pkgs/by-name/ta/tailscale-systray/package.nix
index 9bff3c33a57e..a40e95b64603 100644
--- a/pkgs/by-name/ta/tailscale-systray/package.nix
+++ b/pkgs/by-name/ta/tailscale-systray/package.nix
@@ -6,13 +6,13 @@
   gtk3,
   libayatana-appindicator,
 }:
-buildGoModule rec {
+buildGoModule {
   pname = "tailscale-systray";
   version = "2022-10-19";
 
   src = fetchFromGitHub {
     owner = "mattn";
-    repo = pname;
+    repo = "tailscale-systray";
     rev = "e7f8893684e7b8779f34045ca90e5abe6df6056d";
     sha256 = "sha256-3kozp6jq0xGllxoK2lGCNUahy/FvXyq11vNSxfDehKE=";
   };
diff --git a/pkgs/by-name/ta/tailwindcss-language-server/package.nix b/pkgs/by-name/ta/tailwindcss-language-server/package.nix
index 75deeb6f8a53..a60394c1945b 100644
--- a/pkgs/by-name/ta/tailwindcss-language-server/package.nix
+++ b/pkgs/by-name/ta/tailwindcss-language-server/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tailwindcss-language-server";
-  version = "0.14.18";
+  version = "0.14.19";
 
   src = fetchFromGitHub {
     owner = "tailwindlabs";
     repo = "tailwindcss-intellisense";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CdjlioWLDvEG1G76zZ9lPmOPV1Y88VdwTXxrdIr28fE=";
+    hash = "sha256-lAZ3BoecPB3+zmI8RataAcbk32avV9Ie+Ek6q/JcXnU=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
diff --git a/pkgs/by-name/ta/tailwindcss_4/package.nix b/pkgs/by-name/ta/tailwindcss_4/package.nix
index c7a31b4ba1a1..c0dfe093055b 100644
--- a/pkgs/by-name/ta/tailwindcss_4/package.nix
+++ b/pkgs/by-name/ta/tailwindcss_4/package.nix
@@ -7,7 +7,7 @@
   makeWrapper,
 }:
 let
-  version = "4.1.7";
+  version = "4.1.8";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "tailwindcss has not been packaged for ${system} yet.";
 
@@ -22,10 +22,10 @@ let
 
   hash =
     {
-      aarch64-darwin = "sha256-CjzOBmhnEW0c+V6utNKPROhAOx1ql2vG8S4G1hT6Wdo=";
-      aarch64-linux = "sha256-jEGaZiGW8FcmVRrQBr2DQfR7i+344MtlFofZrjwK4GY=";
-      x86_64-darwin = "sha256-TN7TKW561j9qvgadL/P/cQhhum1lCrsjNglhxgz9GSw=";
-      x86_64-linux = "sha256-BwYpKTWpdzxsh54X0jYlMi5EkOfo96CtDmiPquTe+YE=";
+      aarch64-darwin = "sha256-GeUnkdNW3VnbaCdK42pYebqwzp2sI8x7Dxn8e3wdN6I=";
+      aarch64-linux = "sha256-KKd9Hlmw5FtBaDweOUdiH9/nP2iVsF23w09j8/SJjo0=";
+      x86_64-darwin = "sha256-SmyyYNdcS9ygck+8w7I6WttScVrW14WVRjyGEoyhwyk=";
+      x86_64-linux = "sha256-j4TOgQvf8iXlmXgdHi2qgrQoIikCHIZ6cbQZ9Z+aqDY=";
     }
     .${system} or throwSystem;
 in
diff --git a/pkgs/by-name/ta/taler-challenger/package.nix b/pkgs/by-name/ta/taler-challenger/package.nix
index c59e90506bd2..288b2c06b36f 100644
--- a/pkgs/by-name/ta/taler-challenger/package.nix
+++ b/pkgs/by-name/ta/taler-challenger/package.nix
@@ -21,12 +21,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "taler-challenger";
-  version = "0.14.3-unstable-2025-02-17";
+  version = "1.0.0";
 
   src = fetchgit {
     url = "https://git.taler.net/challenger.git";
-    rev = "e49e33a13df92c6a1d6f119775baa31778163531";
-    hash = "sha256-AOtCx/r6JzwOSF3b3lDeY0/S+dGGNrJELerFoQ/K4tA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZKRqNlva3LZCuAva7h6Wk2NIuHF3rReR+yNETqbCv1k=";
   };
 
   # https://git.taler.net/challenger.git/tree/bootstrap
@@ -76,6 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://git.taler.net/challenger.git";
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [ wegank ];
+    teams = with lib.teams; [ ngi ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/ta/taler-exchange/package.nix b/pkgs/by-name/ta/taler-exchange/package.nix
index 090db22e04ca..dc4bc7fac66c 100644
--- a/pkgs/by-name/ta/taler-exchange/package.nix
+++ b/pkgs/by-name/ta/taler-exchange/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "taler-exchange";
-  version = "0.14.6-unstable-2025-03-02";
+  version = "1.0.4";
 
   src = fetchgit {
     url = "https://git.taler.net/exchange.git";
-    rev = "13e058a902a3dbee9d7fe327030b88c2d126675b";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-fqlYpFggQkB/IqD6V01ec+G4EtoNaA/FXigM+jqIMe0=";
+    hash = "sha256-k2e9pzy7vSIjCVGOVif9ntYvLcvoJA6J63vB/lg3iwA=";
   };
 
   patches = [ ./0001-add-TALER_TEMPLATING_init_path.patch ];
@@ -125,6 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://git.taler.net/exchange.git/tree/ChangeLog";
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [ astro ];
+    teams = with lib.teams; [ ngi ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/ta/taler-merchant/package.nix b/pkgs/by-name/ta/taler-merchant/package.nix
index 4372de34d697..fc5c87e56816 100644
--- a/pkgs/by-name/ta/taler-merchant/package.nix
+++ b/pkgs/by-name/ta/taler-merchant/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "taler-merchant";
-  version = "0.14.6-unstable-2025-03-02";
+  version = "1.0.1";
 
   src = fetchgit {
     url = "https://git.taler.net/merchant.git";
-    rev = "c84ed905e2d4af60162a7def5c0fc430394930e6";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-LXmrY8foiYOxCik23d3f4t9+tldbm7bVGG8eQOLsm+A=";
+    hash = "sha256-H/JqMGLP0u68g/bMqsollAk6sKL73TCZ9no49psYST0=";
   };
 
   postUnpack = ''
@@ -104,6 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://git.taler.net/merchant.git/tree/ChangeLog";
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [ astro ];
+    teams = with lib.teams; [ ngi ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/ta/taler-sync/package.nix b/pkgs/by-name/ta/taler-sync/package.nix
index 7eb982f9b120..43f5fad03afd 100644
--- a/pkgs/by-name/ta/taler-sync/package.nix
+++ b/pkgs/by-name/ta/taler-sync/package.nix
@@ -19,12 +19,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "taler-sync";
-  version = "0.14.2-unstable-2025-03-02";
+  version = "1.0.0";
 
   src = fetchgit {
     url = "https://git.taler.net/sync.git";
-    rev = "10d0e97f191a8bd7de07049559a2eccb29a78507";
-    hash = "sha256-aihxgknPCE8tbRfncbMO/zHGg395LHVuXWyln2ryiCw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-di+AgCCgOTvzR6Fberz1ISo6ZT+OsKikeNCU2HZHSz4=";
   };
 
   strictDeps = true;
@@ -58,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://git.taler.net/sync.git";
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [ wegank ];
+    teams = with lib.teams; [ ngi ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/ta/taler-wallet-core/package.nix b/pkgs/by-name/ta/taler-wallet-core/package.nix
index 815f77cbae09..43f7cf4d89c5 100644
--- a/pkgs/by-name/ta/taler-wallet-core/package.nix
+++ b/pkgs/by-name/ta/taler-wallet-core/package.nix
@@ -37,12 +37,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "taler-wallet-core";
-  version = "0.14.1";
+  version = "1.0.12";
 
   src = fetchgit {
-    url = "https://git.taler.net/wallet-core.git";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-Sae83qGPqVwuxKf30zHCmdOoo5rDPBHKSOE1hxNn7Xo=";
+    url = "https://git.taler.net/taler-typescript-core.git";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lTFiaIgkPw0FhrpYPwg5/MMl8Yo1MfkDPYEDSJ11rQ8=";
   };
 
   nativeBuildInputs = [
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-BVVmv0VVvQ2YhL0zOKiM1oVKJKvqwMGNR47DkcCj874=";
+    hash = "sha256-pLe5smsXdzSBgz/OYNO5FVEI2L6y/p+jMxEkzqUaX34=";
   };
 
   buildInputs = [ nodejs_20 ];
diff --git a/pkgs/by-name/ta/tambura/package.nix b/pkgs/by-name/ta/tambura/package.nix
index 5c7fb003ba3d..5f5123ad4237 100644
--- a/pkgs/by-name/ta/tambura/package.nix
+++ b/pkgs/by-name/ta/tambura/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "olilarkin";
-    repo = pname;
+    repo = "Tambura";
     rev = "v${version}";
     sha256 = "1w80cmiyzca1wirf5gypg3hcix1ky777id8wnd3k92mn1jf4a24y";
   };
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
   dontWrapQtApps = true;
 
   buildPhase = ''
-    faust2jaqt -vec -time -t 99999 ${pname}.dsp
-    faust2lv2 -vec -time -gui -t 99999 ${pname}.dsp
+    faust2jaqt -vec -time -t 99999 Tambura.dsp
+    faust2lv2 -vec -time -gui -t 99999 Tambura.dsp
   '';
 
   installPhase = ''
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
       cp $f $out/bin/
     done
     mkdir -p $out/lib/lv2
-    cp -r ${pname}.lv2/ $out/lib/lv2
+    cp -r Tambura.lv2/ $out/lib/lv2
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/ta/tangara-companion/package.nix b/pkgs/by-name/ta/tangara-companion/package.nix
index 7e636f5114d2..f42587e21e02 100644
--- a/pkgs/by-name/ta/tangara-companion/package.nix
+++ b/pkgs/by-name/ta/tangara-companion/package.nix
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "haileys";
-    repo = pname;
+    repo = "tangara-companion";
     tag = "v${version}";
     hash = "sha256-pTE+xlXWIOOt1oiKosnbXTCLYoAqP3CfXA283a//Ds0=";
   };
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage rec {
 
   desktopItems = [
     (makeDesktopItem {
-      name = pname;
+      name = "tangara-companion";
       desktopName = "Tangara Companion";
       comment = meta.description;
       type = "Application";
diff --git a/pkgs/by-name/ta/tanka/package.nix b/pkgs/by-name/ta/tanka/package.nix
index 0dda8eec080c..3acd0f5ac34b 100644
--- a/pkgs/by-name/ta/tanka/package.nix
+++ b/pkgs/by-name/ta/tanka/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "grafana";
-    repo = pname;
+    repo = "tanka";
     rev = "v${version}";
     sha256 = "sha256-+875PMDATNarFhnAhpi9QxBNgV9irrjRWd/hHsqlH+c=";
   };
diff --git a/pkgs/by-name/ta/tarsnapper/package.nix b/pkgs/by-name/ta/tarsnapper/package.nix
index b1afa06f6008..bca32fd20cd3 100644
--- a/pkgs/by-name/ta/tarsnapper/package.nix
+++ b/pkgs/by-name/ta/tarsnapper/package.nix
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "miracle2k";
-    repo = pname;
+    repo = "tarsnapper";
     rev = version;
     hash = "sha256-5i9eum9hbh6VFhvEIDq5Uapy6JtIbf9jZHhRYZVoC1w=";
   };
diff --git a/pkgs/by-name/ta/tarssh/package.nix b/pkgs/by-name/ta/tarssh/package.nix
index 031a2a214b37..5e91b03eae6a 100644
--- a/pkgs/by-name/ta/tarssh/package.nix
+++ b/pkgs/by-name/ta/tarssh/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "Freaky";
-    repo = pname;
+    repo = "tarssh";
     sha256 = "sha256-AoKc8VF6rqYIsijIfgvevwu+6+suOO7XQCXXgAPNgLk=";
   };
 
diff --git a/pkgs/by-name/ta/tasktimer/package.nix b/pkgs/by-name/ta/tasktimer/package.nix
index de2cdc50fe71..2143d317b53a 100644
--- a/pkgs/by-name/ta/tasktimer/package.nix
+++ b/pkgs/by-name/ta/tasktimer/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "caarlos0";
-    repo = pname;
+    repo = "tasktimer";
     rev = "v${version}";
     sha256 = "sha256-CAqOsxmJxDgQRMx8cN23TajHd6BNiCFraFvhf5kKnzc=";
   };
diff --git a/pkgs/by-name/tb/tbls/package.nix b/pkgs/by-name/tb/tbls/package.nix
index c2b38588ce33..4d5b68871deb 100644
--- a/pkgs/by-name/tb/tbls/package.nix
+++ b/pkgs/by-name/tb/tbls/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "tbls";
-  version = "1.85.3";
+  version = "1.85.4";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     tag = "v${version}";
-    hash = "sha256-07Xx/BoBXCQuZHveH00Wn65POnTpfDx8rfIcbqSoQLg=";
+    hash = "sha256-K+GIETe/SpBCgJS7KD8Rw8z1zrmnXdYjjTyl36pUzmg=";
   };
 
   vendorHash = "sha256-Sqr5UiT4NNiFKNEqZRDbS92AYa9SKWqYTYl4Ljx/raY=";
diff --git a/pkgs/by-name/tc/tcat/package.nix b/pkgs/by-name/tc/tcat/package.nix
index 25c826e70326..c27e3faa13d3 100644
--- a/pkgs/by-name/tc/tcat/package.nix
+++ b/pkgs/by-name/tc/tcat/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
   version = "1.0.0";
   src = fetchFromGitHub {
     owner = "rsc";
-    repo = pname;
+    repo = "tcat";
     rev = "v${version}";
     sha256 = "1szzfz5xsx9l8gjikfncgp86hydzpvsi0y5zvikd621xkp7g7l21";
   };
diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index f4e1769e8caf..434226ffef39 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -16,16 +16,16 @@
 
 buildNpmPackage rec {
   pname = "teams-for-linux";
-  version = "2.0.13";
+  version = "2.0.14";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     tag = "v${version}";
-    hash = "sha256-xkVJ8PrW2huf3oNVSYySQnzKPadsYFXnrMgi+mFXBQU=";
+    hash = "sha256-B7u5xJHss09QOP1AHoHZWIiHyd2RBcF/XU3BB9N2C60=";
   };
 
-  npmDepsHash = "sha256-jDJH/lAbmUURMkdv49S1KeE4I/MOEzK0ZDWh1sbnzXY=";
+  npmDepsHash = "sha256-JJUkZlol09Hehxc26DMdEzdxy8Nxa16G8YdTZkHhi78=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/te/teller/package.nix b/pkgs/by-name/te/teller/package.nix
index f3b6564c1617..33610fedeaf0 100644
--- a/pkgs/by-name/te/teller/package.nix
+++ b/pkgs/by-name/te/teller/package.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage {
 
   src = fetchFromGitHub {
     owner = "tellerops";
-    repo = pname;
+    repo = "teller";
     rev = "v${version}";
     hash = "sha256-CI74nMMTIPwjJfy7ASR19V6EbYZ62NoAOxlP3Xt2BuI=";
   };
diff --git a/pkgs/by-name/te/temporalite/package.nix b/pkgs/by-name/te/temporalite/package.nix
index 578f81790a26..eb9305942cc5 100644
--- a/pkgs/by-name/te/temporalite/package.nix
+++ b/pkgs/by-name/te/temporalite/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "temporalio";
-    repo = pname;
+    repo = "temporalite";
     rev = "v${version}";
     sha256 = "sha256-IEB9AFEt8U2zXYfbChfL/UH1rNSLPnfS396/cPE8UdE=";
   };
diff --git a/pkgs/by-name/te/tenacity/package.nix b/pkgs/by-name/te/tenacity/package.nix
index 2281a9f7237c..bed63fd78f6a 100644
--- a/pkgs/by-name/te/tenacity/package.nix
+++ b/pkgs/by-name/te/tenacity/package.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "tenacityteam";
-    repo = pname;
+    repo = "tenacity";
     fetchSubmodules = true;
     rev = "v${version}";
     hash = "sha256-2gndOwgEJK2zDSbjcZigbhEpGv301/ygrf+EQhKp8PI=";
diff --git a/pkgs/by-name/te/tendermint/package.nix b/pkgs/by-name/te/tendermint/package.nix
index 919df2219340..77d9f8510a26 100644
--- a/pkgs/by-name/te/tendermint/package.nix
+++ b/pkgs/by-name/te/tendermint/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "tendermint";
-    repo = pname;
+    repo = "tendermint";
     rev = "v${version}";
     sha256 = "sha256-3tggW+M3vZChDT1g77W5M3hchEN6pTSVvkrZda6ZTCY=";
   };
diff --git a/pkgs/by-name/te/terminal-typeracer/package.nix b/pkgs/by-name/te/terminal-typeracer/package.nix
index 4e3e7e441369..7e28bbda2b9d 100644
--- a/pkgs/by-name/te/terminal-typeracer/package.nix
+++ b/pkgs/by-name/te/terminal-typeracer/package.nix
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitLab {
     owner = "ttyperacer";
-    repo = pname;
+    repo = "terminal-typeracer";
     rev = "v${version}";
     hash = "sha256-S3OW6KihRd6ReTWUXRb1OWC7+YoxehjFRBxcnJVgImU=";
   };
diff --git a/pkgs/by-name/te/termtekst/package.nix b/pkgs/by-name/te/termtekst/package.nix
index 09b13dd74459..947ec77b00e8 100644
--- a/pkgs/by-name/te/termtekst/package.nix
+++ b/pkgs/by-name/te/termtekst/package.nix
@@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "zevv";
-    repo = pname;
+    repo = "termtekst";
     rev = "v${version}";
     sha256 = "1gm7j5d49a60wm7px82b76f610i8pl8ccz4r6qsz90z4mp3lyw9b";
   };
diff --git a/pkgs/by-name/te/terracognita/package.nix b/pkgs/by-name/te/terracognita/package.nix
index f5afcc70ef02..42df437f594d 100644
--- a/pkgs/by-name/te/terracognita/package.nix
+++ b/pkgs/by-name/te/terracognita/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "cycloidio";
-    repo = pname;
+    repo = "terracognita";
     rev = "v${version}";
     hash = "sha256-pPY8y+pQdk9/F7dnUBz/y4lvcR1k/EClywcZATArZVA=";
   };
diff --git a/pkgs/by-name/te/terraform-docs/package.nix b/pkgs/by-name/te/terraform-docs/package.nix
index bbeb074c625d..fbee13db8c5c 100644
--- a/pkgs/by-name/te/terraform-docs/package.nix
+++ b/pkgs/by-name/te/terraform-docs/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "terraform-docs";
-    repo = pname;
+    repo = "terraform-docs";
     rev = "v${version}";
     hash = "sha256-DiKoYAe7vcNy35ormKHYZcZrGK/MEb6VmcHWPgrbmUg=";
   };
diff --git a/pkgs/by-name/te/terraform-ls/package.nix b/pkgs/by-name/te/terraform-ls/package.nix
index 9449895a8cb8..cd50d350b84d 100644
--- a/pkgs/by-name/te/terraform-ls/package.nix
+++ b/pkgs/by-name/te/terraform-ls/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "hashicorp";
-    repo = pname;
+    repo = "terraform-ls";
     rev = "v${version}";
     hash = "sha256-20spDPVJC48r6Qy6KS8Yp6lUE22DuoOM17WPS3+KN9E=";
   };
diff --git a/pkgs/by-name/te/terraform-lsp/package.nix b/pkgs/by-name/te/terraform-lsp/package.nix
index 385aca330aaa..f1f6b372b96e 100644
--- a/pkgs/by-name/te/terraform-lsp/package.nix
+++ b/pkgs/by-name/te/terraform-lsp/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "juliosueiras";
-    repo = pname;
+    repo = "terraform-lsp";
     rev = "v${version}";
     sha256 = "111350jbq0dp0qhk48j12hrlisd1fwzqpcv357igrbqf6ki7r78q";
   };
diff --git a/pkgs/by-name/te/terraformer/package.nix b/pkgs/by-name/te/terraformer/package.nix
index cf7f10285783..ffe8efbe0a35 100644
--- a/pkgs/by-name/te/terraformer/package.nix
+++ b/pkgs/by-name/te/terraformer/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
-    repo = pname;
+    repo = "terraformer";
     rev = version;
     sha256 = "sha256-xbZm0FOa/W6/qXMnJHuGgJhgu2NWtKrMoP0Ttd+hhdw=";
   };
diff --git a/pkgs/by-name/te/terrascan/package.nix b/pkgs/by-name/te/terrascan/package.nix
index cc7d29033348..042843b183e0 100644
--- a/pkgs/by-name/te/terrascan/package.nix
+++ b/pkgs/by-name/te/terrascan/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "accurics";
-    repo = pname;
+    repo = "terrascan";
     tag = "v${version}";
     hash = "sha256-4XIhmUUOSROwEPSB+DcMOfG5+q/pmWkVUwKGrWVcNtM=";
   };
diff --git a/pkgs/by-name/te/terraspace/Gemfile.lock b/pkgs/by-name/te/terraspace/Gemfile.lock
index 74b43d988b07..10b57cecdbe3 100644
--- a/pkgs/by-name/te/terraspace/Gemfile.lock
+++ b/pkgs/by-name/te/terraspace/Gemfile.lock
@@ -15,17 +15,18 @@ GEM
       tzinfo (~> 2.0, >= 2.0.5)
       uri (>= 0.13.1)
     aws-eventstream (1.3.2)
-    aws-partitions (1.1071.0)
-    aws-sdk-core (3.220.2)
+    aws-partitions (1.1107.0)
+    aws-sdk-core (3.224.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
       base64
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.99.0)
+      logger
+    aws-sdk-kms (1.101.0)
       aws-sdk-core (~> 3, >= 3.216.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.182.0)
+    aws-sdk-s3 (1.186.1)
       aws-sdk-core (~> 3, >= 3.216.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
@@ -39,11 +40,11 @@ GEM
       text-table
       zeitwerk
     concurrent-ruby (1.3.5)
-    connection_pool (2.5.0)
+    connection_pool (2.5.3)
     deep_merge (1.2.2)
-    diff-lcs (1.6.0)
-    dotenv (3.1.7)
-    drb (2.2.1)
+    diff-lcs (1.6.2)
+    dotenv (3.1.8)
+    drb (2.2.3)
     dsl_evaluator (0.3.2)
       activesupport
       memoist
@@ -58,11 +59,11 @@ GEM
     i18n (1.14.7)
       concurrent-ruby (~> 1.0)
     jmespath (1.6.2)
-    logger (1.6.6)
+    logger (1.7.0)
     memoist (0.16.2)
-    mini_portile2 (2.8.8)
+    mini_portile2 (2.8.9)
     minitest (5.25.5)
-    nokogiri (1.18.5)
+    nokogiri (1.18.8)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     racc (1.8.1)
@@ -80,13 +81,13 @@ GEM
       rspec-mocks (~> 3.13.0)
     rspec-core (3.13.3)
       rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.3)
+    rspec-expectations (3.13.4)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.2)
+    rspec-mocks (3.13.4)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-support (3.13.2)
+    rspec-support (3.13.3)
     rspec-terraspace (0.3.3)
       activesupport
       memoist
@@ -132,7 +133,7 @@ GEM
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     uri (1.0.3)
-    zeitwerk (2.7.2)
+    zeitwerk (2.7.3)
     zip_folder (0.1.0)
       rubyzip
 
@@ -143,4 +144,4 @@ DEPENDENCIES
   terraspace
 
 BUNDLED WITH
-   2.6.2
+   2.6.6
diff --git a/pkgs/by-name/te/terraspace/gemset.nix b/pkgs/by-name/te/terraspace/gemset.nix
index 6a07f9ece302..183797d226c4 100644
--- a/pkgs/by-name/te/terraspace/gemset.nix
+++ b/pkgs/by-name/te/terraspace/gemset.nix
@@ -38,10 +38,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1qlygf2bg086hr5cpyg8hh0jwvx4xvkh8v09maxdj7xqplzplhg7";
+      sha256 = "0h25l48fy06yba48ymsflda93yclk0335kdcnf74f5axsah84qfn";
       type = "gem";
     };
-    version = "1.1071.0";
+    version = "1.1107.0";
   };
   aws-sdk-core = {
     dependencies = [
@@ -50,15 +50,16 @@
       "aws-sigv4"
       "base64"
       "jmespath"
+      "logger"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qydjik09i110rxpkz4g8kfq5n10x0fwp2cwpb9zw44kprzwvcmn";
+      sha256 = "1b0pi1iibp644dn78g53s7hs7gcxghfa7h8rz3lvz8ivykisl5y6";
       type = "gem";
     };
-    version = "3.220.2";
+    version = "3.224.0";
   };
   aws-sdk-kms = {
     dependencies = [
@@ -69,10 +70,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a3mh89kfh6flqxw48wfv9wfwkj2zxazw096mqm56wnnzz1jyads";
+      sha256 = "1mv8jc8sbvim2m3y3zxm8z4i5sh4x9ds7y9h5z04qfg7kjvbbn24";
       type = "gem";
     };
-    version = "1.99.0";
+    version = "1.101.0";
   };
   aws-sdk-s3 = {
     dependencies = [
@@ -84,10 +85,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "03a55dbihv6xvgfwhx0f35rwc7q3rr0555vfpxlwpdjw75wkbz6h";
+      sha256 = "00sq22mfibxq3rjy9c4vj1s8yjszv8988di7z7rs8v62my53nw2v";
       type = "gem";
     };
-    version = "1.182.0";
+    version = "1.186.1";
   };
   aws-sigv4 = {
     dependencies = [ "aws-eventstream" ];
@@ -160,10 +161,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1z7bag6zb2vwi7wp2bkdkmk7swkj6zfnbsnc949qq0wfsgw94fr3";
+      sha256 = "0nrhsk7b3sjqbyl1cah6ibf1kvi3v93a7wf4637d355hp614mmyg";
       type = "gem";
     };
-    version = "2.5.0";
+    version = "2.5.3";
   };
   deep_merge = {
     groups = [ "default" ];
@@ -180,30 +181,30 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0bnss89lcm3b1k3xcjd35grxqz5q040d12imd73qybwnfarggrx1";
+      sha256 = "0qlrj2qyysc9avzlr4zs1py3x684hqm61n4czrsk1pyllz5x5q4s";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.6.2";
   };
   dotenv = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1wrw6fm0s38cd6h55w79bkvjhcj2zfkargjpws4kilkmhr3xyw66";
+      sha256 = "1hwjsddv666wpp42bip3fqx7c5qq6s8lwf74dj71yn7d1h37c4cy";
       type = "gem";
     };
-    version = "3.1.7";
+    version = "3.1.8";
   };
   drb = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0h5kbj9hvg5hb3c7l425zpds0vb42phvln2knab8nmazg2zp5m79";
+      sha256 = "0wrkl7yiix268s2md1h6wh91311w95ikd8fy8m5gx589npyxc00b";
       type = "gem";
     };
-    version = "2.2.1";
+    version = "2.2.3";
   };
   dsl_evaluator = {
     dependencies = [
@@ -289,10 +290,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "05s008w9vy7is3njblmavrbdzyrwwc1fsziffdr58w9pwqj8sqfx";
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
       type = "gem";
     };
-    version = "1.6.6";
+    version = "1.7.0";
   };
   memoist = {
     groups = [ "default" ];
@@ -309,10 +310,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0x8asxl83msn815lwmb2d7q5p29p7drhjv5va0byhk60v9n16iwf";
+      sha256 = "12f2830x7pq3kj0v8nz0zjvaw02sv01bqs1zwdrc04704kwcgmqc";
       type = "gem";
     };
-    version = "2.8.8";
+    version = "2.8.9";
   };
   minitest = {
     groups = [ "default" ];
@@ -333,10 +334,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1p1nl5gqs56wlv2gwzdj0px3dw018ywpkg14a4s23b0qjkdgi9n8";
+      sha256 = "0rb306hbky6cxfyc8vrwpvl40fdapjvhsk62h08gg9wwbn3n8x4c";
       type = "gem";
     };
-    version = "1.18.5";
+    version = "1.18.8";
   };
   racc = {
     groups = [ "default" ];
@@ -429,10 +430,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0n3cyrhsa75x5wwvskrrqk56jbjgdi2q1zx0irllf0chkgsmlsqf";
+      sha256 = "1n7cb6szws90hxbzqrfybs4rj1xb0vhn24xa4l5r1vnzcnblahsf";
       type = "gem";
     };
-    version = "3.13.3";
+    version = "3.13.4";
   };
   rspec-mocks = {
     dependencies = [
@@ -443,20 +444,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vxxkb2sf2b36d8ca2nq84kjf85fz4x7wqcvb8r6a5hfxxfk69r3";
+      sha256 = "14xr5bq7s80hm97fcp3pvk4v515qfw3lrlsf20idalwwf6h5icbb";
       type = "gem";
     };
-    version = "3.13.2";
+    version = "3.13.4";
   };
   rspec-support = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1v6v6xvxcpkrrsrv7v1xgf7sl0d71vcfz1cnrjflpf6r7x3a58yf";
+      sha256 = "0hrzdcklbl8pv721cq906yfl38fmqmlnh33ff8l752z1ys9y6q9a";
       type = "gem";
     };
-    version = "3.13.2";
+    version = "3.13.3";
   };
   rspec-terraspace = {
     dependencies = [
@@ -612,10 +613,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ws6rpyj0y9iadjg1890dwnnbjfdbzxsv6r48zbj7f8yn5y0cbl4";
+      sha256 = "119ypabas886gd0n9kiid3q41w76gz60s8qmiak6pljpkd56ps5j";
       type = "gem";
     };
-    version = "2.7.2";
+    version = "2.7.3";
   };
   zip_folder = {
     dependencies = [ "rubyzip" ];
diff --git a/pkgs/by-name/te/tev/package.nix b/pkgs/by-name/te/tev/package.nix
index 4fe472b6affc..e92ba4b63958 100644
--- a/pkgs/by-name/te/tev/package.nix
+++ b/pkgs/by-name/te/tev/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "Tom94";
-    repo = pname;
+    repo = "tev";
     rev = "v${version}";
     fetchSubmodules = true;
     hash = "sha256-ke1T5nOrDoJilpfshAIAFWw/640Gm5OaxZ+ZakCevTs=";
diff --git a/pkgs/by-name/te/text-engine/package.nix b/pkgs/by-name/te/text-engine/package.nix
index 6250ff9c88c3..e2b4eb6418e4 100644
--- a/pkgs/by-name/te/text-engine/package.nix
+++ b/pkgs/by-name/te/text-engine/package.nix
@@ -15,13 +15,13 @@
   libxml2,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "text-engine";
   version = "0.1.1-unstable-2024-09-16";
 
   src = fetchFromGitHub {
     owner = "mjakeman";
-    repo = pname;
+    repo = "text-engine";
     rev = "4c26887556fd8e28211324c4058d49508eb5f557";
     hash = "sha256-0rMBz2s3wYv7gZiJTj8rixWxBjT6Dd6SaINP8kDbTyw=";
   };
diff --git a/pkgs/by-name/te/texturepacker/package.nix b/pkgs/by-name/te/texturepacker/package.nix
index 61dc23ea5ee6..389c685de710 100644
--- a/pkgs/by-name/te/texturepacker/package.nix
+++ b/pkgs/by-name/te/texturepacker/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "texturepacker";
-  version = "7.6.3";
+  version = "7.7.0";
 
   src = fetchurl {
     url = "https://www.codeandweb.com/download/texturepacker/${finalAttrs.version}/TexturePacker-${finalAttrs.version}.deb";
-    hash = "sha256-A1YNy6Y5EdOnV0dY0VN/k7nX26L/uaHqDHmdC5N1Otk=";
+    hash = "sha256-0HSKushYQXt13z619ZmZt0ADpQA20jmRrext1w6/Ghc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tf/tfautomv/package.nix b/pkgs/by-name/tf/tfautomv/package.nix
index 97eb4ba2054a..68b851ff5ae4 100644
--- a/pkgs/by-name/tf/tfautomv/package.nix
+++ b/pkgs/by-name/tf/tfautomv/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "busser";
-    repo = pname;
+    repo = "tfautomv";
     rev = "v${version}";
     hash = "sha256-qUeIbHJqxGkt2esMm4w6fM52ZE16jWnxugVXxqBh1Qc=";
   };
diff --git a/pkgs/by-name/tf/tflint/package.nix b/pkgs/by-name/tf/tflint/package.nix
index 5f586cac6606..2b378148d409 100644
--- a/pkgs/by-name/tf/tflint/package.nix
+++ b/pkgs/by-name/tf/tflint/package.nix
@@ -18,7 +18,7 @@ buildGoModule {
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
-    repo = pname;
+    repo = "tflint";
     tag = "v${version}";
     hash = "sha256-AaY2UghPvYveZ4xtUphPOnnoA6FcyO9Y2Uzz3bN8Q8I=";
   };
diff --git a/pkgs/by-name/tg/tgpt/package.nix b/pkgs/by-name/tg/tgpt/package.nix
index b009bb76ed5a..9917e4cac5ca 100644
--- a/pkgs/by-name/tg/tgpt/package.nix
+++ b/pkgs/by-name/tg/tgpt/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "tgpt";
-  version = "2.9.4";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "aandrew-me";
     repo = "tgpt";
     tag = "v${version}";
-    hash = "sha256-FCc1D/q+8i/ZFZDgtBoMpF+GEnHne4M5bazJWnF5GbE=";
+    hash = "sha256-q7dod5kKvKny4Zht6KpHpRa7N9Je+tmKVyn9PEde/+c=";
   };
 
   vendorHash = "sha256-hPbvzhYHOxytQs3NkSVaZhFH0TbOlr4U/QiH+vemTrc=";
@@ -24,8 +24,8 @@ buildGoModule rec {
 
   preCheck = ''
     # Remove test which need network access
-    rm providers/koboldai/koboldai_test.go
-    rm providers/phind/phind_test.go
+    rm src/providers/koboldai/koboldai_test.go
+    rm src/providers/phind/phind_test.go
   '';
 
   meta = {
diff --git a/pkgs/by-name/th/thc-ipv6/package.nix b/pkgs/by-name/th/thc-ipv6/package.nix
index c28e42efb764..d2ba60af7177 100644
--- a/pkgs/by-name/th/thc-ipv6/package.nix
+++ b/pkgs/by-name/th/thc-ipv6/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "vanhauser-thc";
-    repo = pname;
+    repo = "thc-ipv6";
     rev = "v${version}";
     sha256 = "07kwika1zdq62s5p5z94xznm77dxjxdg8k0hrg7wygz50151nzmx";
   };
diff --git a/pkgs/by-name/th/theharvester/package.nix b/pkgs/by-name/th/theharvester/package.nix
index e0a2265c7f9f..3bd47f4d947e 100644
--- a/pkgs/by-name/th/theharvester/package.nix
+++ b/pkgs/by-name/th/theharvester/package.nix
@@ -6,20 +6,17 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "theharvester";
-  version = "4.7.1";
+  version = "4.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "laramies";
     repo = "theharvester";
     tag = version;
-    hash = "sha256-IBisnQGdhPCoVPPH/GHLJg5qoh08KfMuMxbsqF3jjpE=";
+    hash = "sha256-zKytU80jmZl5TwY5ti6YZ85DbJnXIMqFLKjMN9jfw7E=";
   };
 
-  postPatch = ''
-    # Requirements are pinned
-    sed -i 's/==.*//' requirements/base.txt
-  '';
+  pythonRelaxDeps = true;
 
   pythonRemoveDeps = [ "winloop" ];
 
diff --git a/pkgs/by-name/th/thonny/package.nix b/pkgs/by-name/th/thonny/package.nix
index e47e8d6d16ed..d3b15515995b 100644
--- a/pkgs/by-name/th/thonny/package.nix
+++ b/pkgs/by-name/th/thonny/package.nix
@@ -15,8 +15,8 @@ buildPythonApplication rec {
   version = "4.1.7";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "thonny";
+    repo = "thonny";
     tag = "v${version}";
     hash = "sha256-RnjnXB5jU13uwRpL/Pn14QY7fRbRkq09Vopc3fv+z+Y=";
   };
diff --git a/pkgs/by-name/th/threatest/package.nix b/pkgs/by-name/th/threatest/package.nix
index 7c13e8453101..f64a14c5515c 100644
--- a/pkgs/by-name/th/threatest/package.nix
+++ b/pkgs/by-name/th/threatest/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "DataDog";
-    repo = pname;
+    repo = "threatest";
     tag = "v${version}";
     hash = "sha256-rVRBrf/RTcHvKOLHNASzvij3fV+uQEuIVKb07CZ/cT0=";
   };
diff --git a/pkgs/by-name/th/thumbdrives/package.nix b/pkgs/by-name/th/thumbdrives/package.nix
index f4f4015c8ed4..f8ad4e9c0827 100644
--- a/pkgs/by-name/th/thumbdrives/package.nix
+++ b/pkgs/by-name/th/thumbdrives/package.nix
@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromSourcehut {
     owner = "~martijnbraam";
-    repo = pname;
+    repo = "thumbdrives";
     rev = version;
     hash = "sha256-Mh3NSEYscnzw6kjR9m0XbTygj07cIQwdyLcdLpfKi3Y=";
   };
diff --git a/pkgs/by-name/ti/ticker/package.nix b/pkgs/by-name/ti/ticker/package.nix
index 8e544c4c2de3..66415d3c5811 100644
--- a/pkgs/by-name/ti/ticker/package.nix
+++ b/pkgs/by-name/ti/ticker/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "achannarasappa";
-    repo = pname;
+    repo = "ticker";
     tag = "v${version}";
     hash = "sha256-fRmW9Cs0Rxp+St4BUswHt/JxHgVy1Go4OR9oarkAufw=";
   };
diff --git a/pkgs/by-name/ti/tidb/package.nix b/pkgs/by-name/ti/tidb/package.nix
index caa55285b65a..c50105b6f17f 100644
--- a/pkgs/by-name/ti/tidb/package.nix
+++ b/pkgs/by-name/ti/tidb/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "pingcap";
-    repo = pname;
+    repo = "tidb";
     rev = "v${version}";
     sha256 = "sha256-lJrW61FARZO1ll7Ln9mgCTZxGhcMlBaL6AeAVGgExIA=";
   };
diff --git a/pkgs/by-name/ti/timescaledb-tune/package.nix b/pkgs/by-name/ti/timescaledb-tune/package.nix
index 1c17f31484df..c085daa0f264 100644
--- a/pkgs/by-name/ti/timescaledb-tune/package.nix
+++ b/pkgs/by-name/ti/timescaledb-tune/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "timescale";
-    repo = pname;
+    repo = "timescaledb-tune";
     rev = "v${version}";
     sha256 = "sha256-SW+JCH+oxAHAmgPO7XmSVFFug7NOvslblMViG+oooAo=";
   };
diff --git a/pkgs/by-name/ti/timew-sync-server/package.nix b/pkgs/by-name/ti/timew-sync-server/package.nix
index 54bd274b4c97..12050685de5f 100644
--- a/pkgs/by-name/ti/timew-sync-server/package.nix
+++ b/pkgs/by-name/ti/timew-sync-server/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "timewarrior-synchronize";
-    repo = pname;
+    repo = "timew-sync-server";
     rev = "v${version}";
     hash = "sha256-3THRP+hydvq/dnxzUOFGeuu8//qL7pFN0RHJVxzgibI=";
   };
diff --git a/pkgs/by-name/ti/tiny-cuda-nn/package.nix b/pkgs/by-name/ti/tiny-cuda-nn/package.nix
index 924d691e52bd..e2c2f75d13da 100644
--- a/pkgs/by-name/ti/tiny-cuda-nn/package.nix
+++ b/pkgs/by-name/ti/tiny-cuda-nn/package.nix
@@ -43,7 +43,7 @@ let
 
   cudaCapabilities = lists.subtractLists unsupportedCudaCapabilities flags.cudaCapabilities;
 
-  cudaArchitecturesString = strings.concatMapStringsSep ";" flags.dropDot cudaCapabilities;
+  cudaArchitecturesString = strings.concatMapStringsSep ";" flags.dropDots cudaCapabilities;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "tiny-cuda-nn";
diff --git a/pkgs/by-name/ti/tiny8086/package.nix b/pkgs/by-name/ti/tiny8086/package.nix
index 59241d28e736..c3eb5540776b 100644
--- a/pkgs/by-name/ti/tiny8086/package.nix
+++ b/pkgs/by-name/ti/tiny8086/package.nix
@@ -8,13 +8,13 @@
   SDL,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "8086tiny";
   version = "1.25";
 
   src = fetchFromGitHub {
     owner = "adriancable";
-    repo = pname;
+    repo = "8086tiny";
     rev = "c79ca2a34d96931d55ef724c815b289d0767ae3a";
     sha256 = "00aydg8f28sgy8l3rd2a7jvp56lx3b63hhak43p7g7vjdikv495w";
   };
diff --git a/pkgs/by-name/to/toast/package.nix b/pkgs/by-name/to/toast/package.nix
index ea88fde7dcaf..6b0441f57c39 100644
--- a/pkgs/by-name/to/toast/package.nix
+++ b/pkgs/by-name/to/toast/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "stepchowfun";
-    repo = pname;
+    repo = "toast";
     rev = "v${version}";
     sha256 = "sha256-vp70jv4F0VKd/OZHVRDcIJlKLwK9w+cV28lh0C7ESqg=";
   };
diff --git a/pkgs/by-name/to/toastify/package.nix b/pkgs/by-name/to/toastify/package.nix
index 7271aa6834c9..97dc8f36d078 100644
--- a/pkgs/by-name/to/toastify/package.nix
+++ b/pkgs/by-name/to/toastify/package.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "hoodie";
-    repo = pname;
+    repo = "toastify";
     rev = "v${version}";
     sha256 = "sha256-hSBh1LTfe3rQDPUryo2Swdf/yLYrOQ/Fg3Dz7ZqV3gw=";
   };
diff --git a/pkgs/by-name/to/toolbox/package.nix b/pkgs/by-name/to/toolbox/package.nix
index cb2b136ab9c0..dcec72c5eb9e 100644
--- a/pkgs/by-name/to/toolbox/package.nix
+++ b/pkgs/by-name/to/toolbox/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "containers";
-    repo = pname;
+    repo = "toolbox";
     rev = version;
     hash = "sha256-9HiWgEtaMypLOwXJ6Xg3grLSZOQ4NInZtcvLPV51YO8=";
   };
diff --git a/pkgs/by-name/to/topicctl/package.nix b/pkgs/by-name/to/topicctl/package.nix
index 4274c97bfae7..f1090b3701e6 100644
--- a/pkgs/by-name/to/topicctl/package.nix
+++ b/pkgs/by-name/to/topicctl/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "topicctl";
-  version = "1.19.2";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = "topicctl";
     rev = "v${version}";
-    sha256 = "sha256-sYt/t16OVJiWFVqSdLNog/mj1gj/TeY0r7z/gMZspls=";
+    sha256 = "sha256-QY3+Il/U0Y1rlRS2ptKIprbaGOQV71r6HsSr35gB9FY=";
   };
 
-  vendorHash = "sha256-vPeqStOjoJPYKpdkHQNTBJFKc8NBjTH4A/W9B+HAy1I=";
+  vendorHash = "sha256-M/lNhGD9zNmwkzTAjp0lbAeliNpLOCVJbOG16N76QL4=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"
diff --git a/pkgs/by-name/to/topydo/package.nix b/pkgs/by-name/to/topydo/package.nix
index f0a888787dd1..56f5d353f3eb 100644
--- a/pkgs/by-name/to/topydo/package.nix
+++ b/pkgs/by-name/to/topydo/package.nix
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "topydo";
-    repo = pname;
+    repo = "topydo";
     rev = version;
     sha256 = "1lpfdai0pf90ffrzgmmkadbd86rb7250i3mglpkc82aj6prjm6yb";
   };
diff --git a/pkgs/by-name/to/toss/package.nix b/pkgs/by-name/to/toss/package.nix
index a1f877837c71..f2e62bbf153c 100644
--- a/pkgs/by-name/to/toss/package.nix
+++ b/pkgs/by-name/to/toss/package.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   version = "1.1";
   src = fetchFromGitHub {
     owner = "zerotier";
-    repo = pname;
+    repo = "toss";
     rev = version;
     sha256 = "05ql0d8wbdhnmh3dw8ch5bi6clfb9h8v21lq2a74iy02slya2y0r";
   };
diff --git a/pkgs/by-name/to/touchegg/package.nix b/pkgs/by-name/to/touchegg/package.nix
index ceb7da0e9b52..5bc94928283b 100644
--- a/pkgs/by-name/to/touchegg/package.nix
+++ b/pkgs/by-name/to/touchegg/package.nix
@@ -10,22 +10,20 @@
   cairo,
   xorg,
   gtk3-x11,
-  pcre,
   pkg-config,
   cmake,
-  pantheon,
   withPantheon ? false,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "touchegg";
   version = "2.0.18";
 
   src = fetchFromGitHub {
     owner = "JoseExposito";
     repo = "touchegg";
-    rev = version;
-    sha256 = "sha256-7LJ5gD2e6e4edKDabqmsiXTdNKJ39557Q4sEGWF8H1U=";
+    tag = finalAttrs.version;
+    hash = "sha256-7LJ5gD2e6e4edKDabqmsiXTdNKJ39557Q4sEGWF8H1U=";
   };
 
   patches = lib.optionals withPantheon [
@@ -33,14 +31,14 @@ stdenv.mkDerivation rec {
     # Reverts https://github.com/JoseExposito/touchegg/pull/603
     (fetchpatch {
       url = "https://github.com/JoseExposito/touchegg/commit/34e947181d84620021601e7f28deb1983a154da8.patch";
-      sha256 = "sha256-qbWwmEzVXvDAhhrGvMkKN4YNtnFfRW+Yra+i6VEQX4g=";
+      hash = "sha256-qbWwmEzVXvDAhhrGvMkKN4YNtnFfRW+Yra+i6VEQX4g=";
       revert = true;
     })
     # Disable per-application gesture by default to make sure the default
     # config does not conflict with Pantheon switchboard settings.
     (fetchpatch {
       url = "https://github.com/elementary/os-patches/commit/7d9b133e02132d7f13cf2fe850b2fe4c015c3c5e.patch";
-      sha256 = "sha256-ZOGVkxiXoTORXC6doz5r9IObAbYjhsDjgg3HtzlTSUc=";
+      hash = "sha256-ZOGVkxiXoTORXC6doz5r9IObAbYjhsDjgg3HtzlTSUc=";
     })
   ];
 
@@ -56,7 +54,6 @@ stdenv.mkDerivation rec {
       pugixml
       cairo
       gtk3-x11
-      pcre
     ]
     ++ (with xorg; [
       libX11
@@ -74,12 +71,12 @@ stdenv.mkDerivation rec {
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/JoseExposito/touchegg";
     description = "Linux multi-touch gesture recognizer";
     mainProgram = "touchegg";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    teams = [ teams.pantheon ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    teams = [ lib.teams.pantheon ];
   };
-}
+})
diff --git a/pkgs/by-name/to/toybox/package.nix b/pkgs/by-name/to/toybox/package.nix
index 4301f58926c1..e12d2f9edc98 100644
--- a/pkgs/by-name/to/toybox/package.nix
+++ b/pkgs/by-name/to/toybox/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "landley";
-    repo = pname;
+    repo = "toybox";
     rev = version;
     sha256 = "sha256-D+tf2bJQlf2pLMNZdMUOoUdE3ea/KgkqoXGsnl1MVOE=";
   };
diff --git a/pkgs/by-name/tp/tparse/package.nix b/pkgs/by-name/tp/tparse/package.nix
index 338ab7df26f8..5fe61b6088a7 100644
--- a/pkgs/by-name/tp/tparse/package.nix
+++ b/pkgs/by-name/tp/tparse/package.nix
@@ -12,7 +12,7 @@ buildGoModule {
 
   src = fetchFromGitHub {
     owner = "mfridman";
-    repo = pname;
+    repo = "tparse";
     rev = "v${version}";
     hash = "sha256-yU4hP+EJ+Ci3Ms0dAoSuqZFT9RRwqmN1V0x5cV+87z0=";
   };
diff --git a/pkgs/by-name/tr/traefik-certs-dumper/package.nix b/pkgs/by-name/tr/traefik-certs-dumper/package.nix
index 521e56259ddb..38efd9ee76c6 100644
--- a/pkgs/by-name/tr/traefik-certs-dumper/package.nix
+++ b/pkgs/by-name/tr/traefik-certs-dumper/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ldez";
-    repo = pname;
+    repo = "traefik-certs-dumper";
     rev = "v${version}";
     sha256 = "sha256-zXbtabh5ZziELZHzvYisXETPUmhHAVo6sMuF4O3crBY=";
   };
diff --git a/pkgs/by-name/tr/traitor/package.nix b/pkgs/by-name/tr/traitor/package.nix
index df86de2717dd..2db704d6e2d3 100644
--- a/pkgs/by-name/tr/traitor/package.nix
+++ b/pkgs/by-name/tr/traitor/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "liamg";
-    repo = pname;
+    repo = "traitor";
     rev = "v${version}";
     sha256 = "sha256-LQfKdjZaTm5z8DUt6He/RJHbOUCUwP3CV3Fyt5rJIfU=";
   };
diff --git a/pkgs/by-name/tr/tran/package.nix b/pkgs/by-name/tr/tran/package.nix
index f4a36a4110b1..cc6c4f91e1ff 100644
--- a/pkgs/by-name/tr/tran/package.nix
+++ b/pkgs/by-name/tr/tran/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "abdfnx";
-    repo = pname;
+    repo = "tran";
     rev = "v${version}";
     sha256 = "sha256-qp4g1ZLRIIz0CZ/Zey354g0j9ePE4pGb82IivLezU7s=";
   };
diff --git a/pkgs/by-name/tr/tremc/package.nix b/pkgs/by-name/tr/tremc/package.nix
index adfdebdee737..5268128e41fa 100644
--- a/pkgs/by-name/tr/tremc/package.nix
+++ b/pkgs/by-name/tr/tremc/package.nix
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "tremc";
-    repo = pname;
+    repo = "tremc";
     rev = version;
     hash = "sha256-219rntmetmj1JFG+4NyYMFTWmrHKJL7fnLoMIvnTP4Y=";
   };
diff --git a/pkgs/by-name/tr/tribler/package.nix b/pkgs/by-name/tr/tribler/package.nix
index 0ff1b90b8f60..1747d011fd8a 100644
--- a/pkgs/by-name/tr/tribler/package.nix
+++ b/pkgs/by-name/tr/tribler/package.nix
@@ -29,6 +29,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-fQJOs9P4y71De/+svmD7YZ4+tm/bC3rspm7SbOHlSR4=";
   };
 
+  patches = [
+    ./startupwmclass.patch
+  ];
+
   nativeBuildInputs = [
     python3.pkgs.wrapPython
     makeWrapper
diff --git a/pkgs/by-name/tr/tribler/startupwmclass.patch b/pkgs/by-name/tr/tribler/startupwmclass.patch
new file mode 100644
index 000000000000..ce1ec9e4a59a
--- /dev/null
+++ b/pkgs/by-name/tr/tribler/startupwmclass.patch
@@ -0,0 +1,9 @@
+diff --git a/build/debian/tribler/usr/share/applications/org.tribler.Tribler.desktop b/build/debian/tribler/usr/share/applications/org.tribler.Tribler.desktop
+index b0472a18d..0e0be14f3 100644
+--- a/build/debian/tribler/usr/share/applications/org.tribler.Tribler.desktop
++++ b/build/debian/tribler/usr/share/applications/org.tribler.Tribler.desktop
+@@ -7,3 +7,4 @@ Terminal=false
+ Type=Application
+ Categories=Application;Network;P2P
+ MimeType=x-scheme-handler/ppsp;x-scheme-handler/tswift;x-scheme-handler/magnet;application/x-bittorrent
++StartupWMClass=Tribler
diff --git a/pkgs/by-name/tr/trickest-cli/package.nix b/pkgs/by-name/tr/trickest-cli/package.nix
index 293cd3470ec2..1692571a4208 100644
--- a/pkgs/by-name/tr/trickest-cli/package.nix
+++ b/pkgs/by-name/tr/trickest-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "trickest-cli";
-  version = "2.0.2";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "trickest";
     repo = "trickest-cli";
     tag = "v${version}";
-    hash = "sha256-b0UiZEuuNqjY43xhwm01PtHTe2YMx6AHLJk336NB0no=";
+    hash = "sha256-EyUeYlWQWCGmCoQpuYXa9h93rXmTRmtSqIDrQRrTQgA=";
   };
 
   vendorHash = "sha256-Ae0fNzYOAeCMrNFVhw4VvG/BkOMcguIMiBvLGt7wxEo=";
diff --git a/pkgs/by-name/tr/trillian/package.nix b/pkgs/by-name/tr/trillian/package.nix
index f1e957f8bfad..29114681f358 100644
--- a/pkgs/by-name/tr/trillian/package.nix
+++ b/pkgs/by-name/tr/trillian/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "google";
-    repo = pname;
+    repo = "trillian";
     rev = "v${version}";
     sha256 = "sha256-DFSG67MMpGzTlvQlW9DttLqqDkS8d8wMkeOlLQuElxU=";
   };
diff --git a/pkgs/by-name/ts/tsukae/package.nix b/pkgs/by-name/ts/tsukae/package.nix
index de4ad64d9ad5..7614bb284931 100644
--- a/pkgs/by-name/ts/tsukae/package.nix
+++ b/pkgs/by-name/ts/tsukae/package.nix
@@ -4,13 +4,13 @@
   buildGoModule,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "tsukae";
   version = "unstable-2021-04-19";
 
   src = fetchFromGitHub {
     owner = "irevenko";
-    repo = pname;
+    repo = "tsukae";
     rev = "8111dddd67e4b4f83ae4bca7d7305f6dc64e77cd";
     sha256 = "sha256-1y/WYLW6/HMGmuaX2wOlQbwYn0LcgQCMb4qw8BtCgxQ=";
   };
diff --git a/pkgs/by-name/tu/tuc/package.nix b/pkgs/by-name/tu/tuc/package.nix
index d07b518c253a..20d912cc9f50 100644
--- a/pkgs/by-name/tu/tuc/package.nix
+++ b/pkgs/by-name/tu/tuc/package.nix
@@ -9,7 +9,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "riquito";
-    repo = pname;
+    repo = "tuc";
     rev = "v${version}";
     sha256 = "sha256-+QkkwQfp818bKVo1yUkWKLMqbdzRJ+oHpjxB+UFDRsU=";
   };
diff --git a/pkgs/by-name/tu/tuir/package.nix b/pkgs/by-name/tu/tuir/package.nix
index e193ea2d9ecf..7d1c87ec7d7f 100644
--- a/pkgs/by-name/tu/tuir/package.nix
+++ b/pkgs/by-name/tu/tuir/package.nix
@@ -11,7 +11,7 @@ buildPythonApplication rec {
 
   src = fetchFromGitLab {
     owner = "Chocimier";
-    repo = pname;
+    repo = "tuir";
     rev = "v${version}";
     hash = "sha256-VYBtD3Ex6+iIRNvX6jF0b0iPvno41/58xCRydiyssvk=";
   };
diff --git a/pkgs/by-name/tu/tun2socks/package.nix b/pkgs/by-name/tu/tun2socks/package.nix
index c35c0887baa0..65d9dd4be456 100644
--- a/pkgs/by-name/tu/tun2socks/package.nix
+++ b/pkgs/by-name/tu/tun2socks/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "xjasonlyu";
-    repo = pname;
+    repo = "tun2socks";
     rev = "8c7c9085c21d8be8d18bf79ff547e1f2225842a9";
     hash = "sha256-LdiCVp6w5yGbFnbArUcjPIwbqFk3zgbbZO1rQNW4w0M=";
   };
diff --git a/pkgs/by-name/tu/tunnelto/package.nix b/pkgs/by-name/tu/tunnelto/package.nix
index 4d6b2eccebac..bf0b426a52f5 100644
--- a/pkgs/by-name/tu/tunnelto/package.nix
+++ b/pkgs/by-name/tu/tunnelto/package.nix
@@ -7,13 +7,13 @@
   pkg-config,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "tunnelto";
   version = "unstable-2022-09-25";
 
   src = fetchFromGitHub {
     owner = "agrinman";
-    repo = pname;
+    repo = "tunnelto";
     rev = "06428f13c638180dd349a4c42a17b569ab51a25f";
     sha256 = "sha256-84jGcR/E1QoqIlbGu67muYUtZU66ZJtj4tdZvmYbII4=";
   };
diff --git a/pkgs/by-name/tu/tut/package.nix b/pkgs/by-name/tu/tut/package.nix
index 4e2cc64c3dac..aca4fb4051ed 100644
--- a/pkgs/by-name/tu/tut/package.nix
+++ b/pkgs/by-name/tu/tut/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "RasmusLindroth";
-    repo = pname;
+    repo = "tut";
     rev = version;
     sha256 = "sha256-AtwwLRZx9O8IWPFgFI/ZK0tbeshEmaKpTQxA1PepnWM=";
   };
diff --git a/pkgs/by-name/tu/tuxmux/package.nix b/pkgs/by-name/tu/tuxmux/package.nix
index 2609f4b9dbc6..a719cbdc826c 100644
--- a/pkgs/by-name/tu/tuxmux/package.nix
+++ b/pkgs/by-name/tu/tuxmux/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "edeneast";
-    repo = pname;
+    repo = "tuxmux";
     rev = "v${version}";
     hash = "sha256-WcHsFKpYexBEg382837NqGgNMTKzVUG3XIER9aa1zK8=";
   };
diff --git a/pkgs/by-name/tw/twitch-cli/package.nix b/pkgs/by-name/tw/twitch-cli/package.nix
index 6d97656a1ffd..225f33809928 100644
--- a/pkgs/by-name/tw/twitch-cli/package.nix
+++ b/pkgs/by-name/tw/twitch-cli/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "twitchdev";
-    repo = pname;
+    repo = "twitch-cli";
     rev = "v${version}";
     hash = "sha256-+6/o2vhj1iaT0hkyQRedn7ga1dhNZOupX4lOadnTDU0=";
   };
@@ -37,8 +37,8 @@ buildGoModule rec {
 
   passthru.tests.version = testers.testVersion {
     package = twitch-cli;
-    command = "HOME=$(mktemp -d) ${pname} version";
-    version = "${pname}/${version}";
+    command = "HOME=$(mktemp -d) twitch-cli version";
+    version = "twitch-cli/${version}";
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/ty/typst/package.nix b/pkgs/by-name/ty/typst/package.nix
index eda1ea51344f..e7b3c02efe20 100644
--- a/pkgs/by-name/ty/typst/package.nix
+++ b/pkgs/by-name/ty/typst/package.nix
@@ -5,7 +5,9 @@
   installShellFiles,
   pkg-config,
   openssl,
-  nix-update-script,
+  writeShellScript,
+  nix-update,
+  gitMinimal,
   versionCheckHook,
   callPackage,
 }:
@@ -60,7 +62,25 @@ rustPlatform.buildRustPackage (finalAttrs: {
   versionCheckProgramArg = "--version";
 
   passthru = {
-    updateScript = nix-update-script { };
+    updateScript = {
+      command = [
+        (writeShellScript "update-typst.sh" ''
+          currentVersion=$(nix-instantiate --eval -E "with import ./. {}; typst.version or (lib.getVersion typst)" | tr -d '"')
+          ${lib.getExe nix-update} typst > /dev/null
+          latestVersion=$(nix-instantiate --eval -E "with import ./. {}; typst.version or (lib.getVersion typst)" | tr -d '"')
+          changes=()
+          if [[ "$currentVersion" != "$latestVersion" ]]; then
+            changes+=("{\"attrPath\":\"typst\",\"oldVersion\":\"$currentVersion\",\"newVersion\":\"$latestVersion\",\"files\":[\"pkgs/by-name/ty/typst/package.nix\"]}")
+          fi
+          maintainers/scripts/update-typst-packages.py --output pkgs/by-name/ty/typst/typst-packages-from-universe.toml > /dev/null
+          ${lib.getExe gitMinimal} diff --quiet HEAD -- pkgs/by-name/ty/typst/typst-packages-from-universe.toml || changes+=("{\"attrPath\":\"typstPackages\",\"oldVersion\":\"0\",\"newVersion\":\"1\",\"files\":[\"pkgs/by-name/ty/typst/typst-packages-from-universe.toml\"]}")
+          echo -n "["
+            IFS=,; echo -n "''${changes[*]}"
+          echo "]"
+        '')
+      ];
+      supportedFeatures = [ "commit" ];
+    };
     packages = callPackage ./typst-packages.nix { };
     withPackages = callPackage ./with-packages.nix { };
   };
diff --git a/pkgs/by-name/ud/uddup/package.nix b/pkgs/by-name/ud/uddup/package.nix
index 00045852ee98..9f8ec15df2cf 100644
--- a/pkgs/by-name/ud/uddup/package.nix
+++ b/pkgs/by-name/ud/uddup/package.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "rotemreiss";
-    repo = pname;
+    repo = "uddup";
     rev = "v${version}";
     sha256 = "1f5dm3772hiik9irnyvbs7wygcafbwi7czw3b47cwhb90b8fi5hg";
   };
diff --git a/pkgs/by-name/ui/uivonim/package.nix b/pkgs/by-name/ui/uivonim/package.nix
index e0ab2a1f8d18..8b2f548b63c1 100644
--- a/pkgs/by-name/ui/uivonim/package.nix
+++ b/pkgs/by-name/ui/uivonim/package.nix
@@ -12,7 +12,7 @@ buildNpmPackage rec {
 
   src = fetchFromGitHub {
     owner = "smolck";
-    repo = pname;
+    repo = "uivonim";
     rev = "v${version}";
     hash = "sha256-TcsKjRwiCTRQLxolRuJ7nRTGxFC0V2Q8LQC5p9iXaaY=";
   };
diff --git a/pkgs/by-name/un/undertime/package.nix b/pkgs/by-name/un/undertime/package.nix
index 309e00ea2e23..dbc28888671d 100644
--- a/pkgs/by-name/un/undertime/package.nix
+++ b/pkgs/by-name/un/undertime/package.nix
@@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitLab {
     owner = "anarcat";
-    repo = pname;
+    repo = "undertime";
     rev = version;
     hash = "sha256-BshgSnYaeX01KQ1fggB+yXEfg3Trhpcf/k4AmBDPxy8=";
   };
diff --git a/pkgs/by-name/un/unflac/package.nix b/pkgs/by-name/un/unflac/package.nix
index 2d5d1b3d1b9e..ad7c1c925408 100644
--- a/pkgs/by-name/un/unflac/package.nix
+++ b/pkgs/by-name/un/unflac/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromSourcehut {
     owner = "~ft";
-    repo = pname;
+    repo = "unflac";
     rev = version;
     sha256 = "sha256-xJEVrzooNcS3zEKeF6DB7ZRZEjHfC7dGKgQfswxbD+U=";
   };
diff --git a/pkgs/by-name/un/unimatrix/package.nix b/pkgs/by-name/un/unimatrix/package.nix
index 69ff40f2c2f0..2b64f3b5bf40 100644
--- a/pkgs/by-name/un/unimatrix/package.nix
+++ b/pkgs/by-name/un/unimatrix/package.nix
@@ -4,14 +4,14 @@
   fetchFromGitHub,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "unimatrix";
   version = "unstable-2023-04-25";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "will8211";
-    repo = pname;
+    repo = "unimatrix";
     rev = "65793c237553bf657af2f2248d2a2dc84169f5c4";
     hash = "sha256-fiaVEc0rtZarUQlUwe1V817qWRx4LnUyRD/j2vWX5NM=";
   };
diff --git a/pkgs/by-name/ur/urh/package.nix b/pkgs/by-name/ur/urh/package.nix
index 41920b00b71b..c622dc056390 100644
--- a/pkgs/by-name/ur/urh/package.nix
+++ b/pkgs/by-name/ur/urh/package.nix
@@ -24,7 +24,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "jopohl";
-    repo = pname;
+    repo = "urh";
     tag = "v${version}";
     hash = "sha256-r3d80dzGwgf5Tuwt1IWGcmNbblwBNKTKKm+GGx1r2HE=";
   };
diff --git a/pkgs/by-name/ur/urlhunter/package.nix b/pkgs/by-name/ur/urlhunter/package.nix
index 9347fa3dfabd..758c7ed937b1 100644
--- a/pkgs/by-name/ur/urlhunter/package.nix
+++ b/pkgs/by-name/ur/urlhunter/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "utkusen";
-    repo = pname;
+    repo = "urlhunter";
     rev = "v${version}";
     sha256 = "sha256-QRQLN8NFIIvlK+sHNj0MMs7tlBODMKHdWJFh/LwnysI=";
   };
diff --git a/pkgs/by-name/ur/urlscan/package.nix b/pkgs/by-name/ur/urlscan/package.nix
index 0b7336b23305..3d586251f197 100644
--- a/pkgs/by-name/ur/urlscan/package.nix
+++ b/pkgs/by-name/ur/urlscan/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "urlscan";
-  version = "1.0.6";
+  version = "1.0.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "firecat53";
     repo = "urlscan";
     tag = version;
-    hash = "sha256-VbpKMaEjchfpLECCt1YtmiVynYgSLgAVP1iuHL7t8FQ=";
+    hash = "sha256-grQZ1dYa6OII1ah2FWOZg17rnTV/wfzXUtV3ijE8oDE=";
   };
 
   build-system = with python3.pkgs; [
@@ -31,7 +31,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = with lib; {
     description = "Mutt and terminal url selector (similar to urlview)";
     homepage = "https://github.com/firecat53/urlscan";
-    changelog = "https://github.com/firecat53/urlscan/releases/tag/${version}";
+    changelog = "https://github.com/firecat53/urlscan/releases/tag/${src.tag}";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ dpaetzel ];
     mainProgram = "urlscan";
diff --git a/pkgs/by-name/ur/uroboros/package.nix b/pkgs/by-name/ur/uroboros/package.nix
index c798631aaf5e..49297f84248e 100644
--- a/pkgs/by-name/ur/uroboros/package.nix
+++ b/pkgs/by-name/ur/uroboros/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "evilsocket";
-    repo = pname;
+    repo = "uroboros";
     inherit rev;
     hash = "sha256-JB4KMjD0ldJkKWKkArA/vfIdeX/TwxWPPOteob5gK6g=";
   };
diff --git a/pkgs/by-name/us/usbguard/package.nix b/pkgs/by-name/us/usbguard/package.nix
index bdcd016cf0e3..5ff76bf68f60 100644
--- a/pkgs/by-name/us/usbguard/package.nix
+++ b/pkgs/by-name/us/usbguard/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "USBGuard";
-    repo = pname;
+    repo = "usbguard";
     rev = "usbguard-${version}";
     hash = "sha256-8y8zaKJfoIXc9AvG1wi3EzZA7BR2wVFLuOyD+zpBY0s=";
     fetchSubmodules = true;
diff --git a/pkgs/by-name/us/usbmuxd/package.nix b/pkgs/by-name/us/usbmuxd/package.nix
index bf0ac9051ef2..77da3cb9a76d 100644
--- a/pkgs/by-name/us/usbmuxd/package.nix
+++ b/pkgs/by-name/us/usbmuxd/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "libimobiledevice";
-    repo = pname;
+    repo = "usbmuxd";
     rev = "01c94c77f59404924f1c46d99c4e5e0c7817281b";
     hash = "sha256-WqbobkzlJ9g5fb9S2QPi3qdpCLx3pxtNlT7qDI63Zp4=";
   };
diff --git a/pkgs/by-name/us/usbrip/package.nix b/pkgs/by-name/us/usbrip/package.nix
index 703c8e4deb55..832c460eacf1 100644
--- a/pkgs/by-name/us/usbrip/package.nix
+++ b/pkgs/by-name/us/usbrip/package.nix
@@ -4,7 +4,7 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication {
   pname = "usbrip";
   version = "unstable-2021-07-02";
 
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "snovvcrash";
-    repo = pname;
+    repo = "usbrip";
     rev = "0f3701607ba13212ebefb4bbd9e68ec0e22d76ac";
     sha256 = "1vws8ybhv7szpqvlbmv0hrkys2fhhaa5bj9dywv3q2y1xmljl0py";
   };
diff --git a/pkgs/by-name/ut/util-linux/fix-mount-regression.patch b/pkgs/by-name/ut/util-linux/fix-mount-regression.patch
new file mode 100644
index 000000000000..973ba7493e7d
--- /dev/null
+++ b/pkgs/by-name/ut/util-linux/fix-mount-regression.patch
@@ -0,0 +1,39 @@
+From 7dbfe31a83f45d5aef2b508697e9511c569ffbc8 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Mon, 24 Mar 2025 14:31:05 +0100
+Subject: [PATCH] libmount: fix --no-canonicalize regression
+
+Fixes: https://github.com/util-linux/util-linux/issues/3474
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ libmount/src/context.c | 3 ---
+ sys-utils/mount.8.adoc | 2 +-
+ 2 files changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/libmount/src/context.c b/libmount/src/context.c
+index 0323cb23d34..15a8ad3bbd0 100644
+--- a/libmount/src/context.c
++++ b/libmount/src/context.c
+@@ -530,9 +530,6 @@ int mnt_context_is_xnocanonicalize(
+ 	assert(cxt);
+ 	assert(type);
+ 
+-	if (mnt_context_is_nocanonicalize(cxt))
+-		return 1;
+-
+ 	ol = mnt_context_get_optlist(cxt);
+ 	if (!ol)
+ 		return 0;
+diff --git a/sys-utils/mount.8.adoc b/sys-utils/mount.8.adoc
+index 4f23f8d1f0e..5103b91c578 100644
+--- a/sys-utils/mount.8.adoc
++++ b/sys-utils/mount.8.adoc
+@@ -756,7 +756,7 @@ Allow to make a target directory (mountpoint) if it does not exist yet. The opti
+ *X-mount.nocanonicalize*[**=**_type_]::
+ Allows disabling of canonicalization for mount source and target paths. By default, the `mount` command resolves all paths to their absolute paths without symlinks. However, this behavior may not be desired in certain situations, such as when binding a mount over a symlink, or a symlink over a directory or another symlink. The optional argument _type_ can be either "source" or "target" (mountpoint). If no _type_ is specified, then canonicalization is disabled for both types. This mount option does not affect the conversion of source tags (e.g. LABEL= or UUID=) and fstab processing.
+ +
+-The command line option *--no-canonicalize* overrides this mount option and affects all path and tag conversions in all situations, but it does not modify flags for open_tree syscalls.
++The command-line option *--no-canonicalize* overrides this mount option and affects all path and tag conversions in all situations, but for backward compatibility, it does not modify open_tree syscall flags and does not allow the bind-mount over a symlink use case.
+ +
+ Note that *mount*(8) still sanitizes and canonicalizes the source and target paths specified on the command line by non-root users, regardless of the X-mount.nocanonicalize setting.
+ 
diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix
index eef5a90698c7..66b24424b7ef 100644
--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@@ -34,7 +34,7 @@
 let
   isMinimal = cryptsetupSupport == false && !nlsSupport && !ncursesSupport && !systemdSupport;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalPackage: rec {
   pname = "util-linux" + lib.optionalString isMinimal "-minimal";
   version = "2.41";
 
@@ -200,6 +200,18 @@ stdenv.mkDerivation rec {
     '';
 
   passthru = {
+    # TODO (#409339): Remove this hack. We had to add it to avoid a mass rebuild
+    # for the 25.05 release to fix Kubernetes. Once the staging cycle referenced
+    # in the above PR completes, this passthru and all consumers of it should go away.
+    withPatches = finalPackage.overrideAttrs (prev: {
+      patches = lib.unique (
+        prev.patches or [ ]
+        ++ [
+          ./fix-mount-regression.patch
+        ]
+      );
+    });
+
     updateScript = gitUpdater {
       # No nicer place to find latest release.
       url = "https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git";
@@ -237,4 +249,4 @@ stdenv.mkDerivation rec {
     ];
     priority = 6; # lower priority than coreutils ("kill") and shadow ("login" etc.) packages
   };
-}
+})
diff --git a/pkgs/by-name/uu/uutils-coreutils/package.nix b/pkgs/by-name/uu/uutils-coreutils/package.nix
index 1a43ed4ae530..f02730ad88d1 100644
--- a/pkgs/by-name/uu/uutils-coreutils/package.nix
+++ b/pkgs/by-name/uu/uutils-coreutils/package.nix
@@ -10,26 +10,46 @@
 
   prefix ? "uutils-",
   buildMulticallBinary ? true,
+
+  selinuxSupport ? false,
+  libselinux,
+
+  acl,
 }:
 
+assert selinuxSupport -> lib.meta.availableOn stdenv.hostPlatform libselinux;
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "uutils-coreutils";
-  version = "0.0.30";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "coreutils";
     tag = finalAttrs.version;
-    hash = "sha256-OZ9AsCJmQmn271OzEmqSZtt1OPn7zHTScQiiqvPhqB0=";
+    hash = "sha256-nKKjc6Bui7k50SR7BY09dRGt3Za1Ch/E+3KiCO5KtOg=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "uutils-coreutils-${finalAttrs.version}";
-    hash = "sha256-DsVLp2Y15k+KQI7S6A4hylOhJN016MEdEWx9VQIQEgQ=";
+    hash = "sha256-PTIypl9uqFkp6GrF7Pp40AItbWFlXT2V2x/C8L2J8S0=";
   };
 
+  patches = [
+    ./selinux_no_auto_detect.diff
+  ];
+
+  buildInputs =
+    lib.optionals (lib.meta.availableOn stdenv.hostPlatform acl) [
+      acl
+    ]
+    ++ lib.optionals selinuxSupport [
+      libselinux
+    ];
+
   nativeBuildInputs = [
+    rustPlatform.bindgenHook
     rustPlatform.cargoSetupHook
     python3Packages.sphinx
   ];
@@ -39,11 +59,35 @@ stdenv.mkDerivation (finalAttrs: {
       "CARGO=${lib.getExe cargo}"
       "PREFIX=${placeholder "out"}"
       "PROFILE=release"
+      "SELINUX_ENABLED=${if selinuxSupport then "1" else "0"}"
       "INSTALLDIR_MAN=${placeholder "out"}/share/man/man1"
+      # Explicitly enable acl, and if requested selinux.
+      # We cannot rely on SELINUX_ENABLED here since our explicit assignment
+      # overrides its effect in the makefile.
+      "BUILD_SPEC_FEATURE=${
+        lib.concatStringsSep "," (
+          # We can always enable acl, on non-Linux, libc provides the headers,
+          # only in Linux we need to add the acl lib to buildInputs.
+          [
+            "feat_acl"
+          ]
+          ++ (lib.optionals selinuxSupport [
+            "feat_selinux"
+          ])
+        )
+      }"
     ]
     ++ lib.optionals (prefix != null) [ "PROG_PREFIX=${prefix}" ]
     ++ lib.optionals buildMulticallBinary [ "MULTICALL=y" ];
 
+  env = lib.optionalAttrs selinuxSupport {
+    SELINUX_INCLUDE_DIR = ''${libselinux.dev}/include'';
+    SELINUX_LIB_DIR = lib.makeLibraryPath [
+      libselinux
+    ];
+    SELINUX_STATIC = "0";
+  };
+
   # too many impure/platform-dependent tests
   doCheck = false;
 
@@ -70,7 +114,10 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://github.com/uutils/coreutils";
     changelog = "https://github.com/uutils/coreutils/releases/tag/${finalAttrs.version}";
-    maintainers = with lib.maintainers; [ siraben ];
+    maintainers = with lib.maintainers; [
+      siraben
+      matthiasbeyer
+    ];
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/uu/uutils-coreutils/selinux_no_auto_detect.diff b/pkgs/by-name/uu/uutils-coreutils/selinux_no_auto_detect.diff
new file mode 100644
index 000000000000..1ee8a0550bf9
--- /dev/null
+++ b/pkgs/by-name/uu/uutils-coreutils/selinux_no_auto_detect.diff
@@ -0,0 +1,37 @@
+diff --git a/GNUmakefile b/GNUmakefile
+index f46126a82..44be8f13b 100644
+--- a/GNUmakefile
++++ b/GNUmakefile
+@@ -57,20 +57,6 @@ TOYBOX_ROOT := $(BASEDIR)/tmp
+ TOYBOX_VER  := 0.8.12
+ TOYBOX_SRC  := $(TOYBOX_ROOT)/toybox-$(TOYBOX_VER)
+ 
+-
+-ifdef SELINUX_ENABLED
+-	override SELINUX_ENABLED := 0
+-# Now check if we should enable it (only on non-Windows)
+-	ifneq ($(OS),Windows_NT)
+-		ifeq ($(shell if [ -x /sbin/selinuxenabled ] && /sbin/selinuxenabled 2>/dev/null; then echo 0; else echo 1; fi),0)
+-			override SELINUX_ENABLED := 1
+-$(info /sbin/selinuxenabled successful)
+-	    else
+-$(info SELINUX_ENABLED=1 but /sbin/selinuxenabled failed)
+-		endif
+-	endif
+-endif
+-
+ # Possible programs
+ PROGS       := \
+ 	base32 \
+@@ -181,8 +167,10 @@ SELINUX_PROGS := \
+ 
+ ifneq ($(OS),Windows_NT)
+ 	PROGS := $(PROGS) $(UNIX_PROGS)
++	ifeq ($(SELINUX_ENABLED),1)
+ # Build the selinux command even if not on the system
+-	PROGS := $(PROGS) $(SELINUX_PROGS)
++		PROGS := $(PROGS) $(SELINUX_PROGS)
++	endif
+ endif
+ 
+ UTILS ?= $(PROGS)
diff --git a/pkgs/by-name/uv/uvwasi/package.nix b/pkgs/by-name/uv/uvwasi/package.nix
new file mode 100644
index 000000000000..a01f7f21c4cc
--- /dev/null
+++ b/pkgs/by-name/uv/uvwasi/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  cmake,
+  fetchFromGitHub,
+  fetchpatch2,
+  libuv,
+  nix-update-script,
+  stdenv,
+  testers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "uvwasi";
+  version = "0.0.21";
+
+  src = fetchFromGitHub {
+    owner = "nodejs";
+    repo = "uvwasi";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-po2Pwqf97JXGKY8WysvyR1vSkqQ4XIF0VQG+83yV9nM=";
+  };
+
+  # Patch was sent upstream: https://github.com/nodejs/uvwasi/pull/302.
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'DESTINATION ''${CMAKE_INSTALL_INCLUDEDIR}/uvwasi' 'DESTINATION ''${CMAKE_INSTALL_INCLUDEDIR}'
+  '';
+
+  outputs = [
+    "out"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+  buildInputs = [
+    libuv
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      moduleNames = [ "uvwasi" ];
+    };
+  };
+
+  meta = {
+    description = "WASI syscall API built atop libuv";
+    homepage = "https://github.com/nodejs/uvwasi";
+    changelog = "https://github.com/nodejs/uvwasi/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ aduh95 ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index 7f7bba7e1eac..0d266543990b 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,17 +7,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.16.10";
+  version = "0.16.13";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8ECq5WgNK8XvExpdN2Jb6HUOCmzJBXN9XROEBaPGhDg=";
+    hash = "sha256-S4YhPXPSB60infsjkI1GdPrBYb0bXoj0+rc9GINuh3Y=";
   };
 
-  vendorHash = "sha256-R34e1RDFj3/5jwqoXiXF4whS0BsrkHP2g0+CZDs8rjw=";
+  vendorHash = "sha256-rzJtYxnRWtSmMPeKEbBy6I2DFEOLEJ1Uj+nPpTKIDhw=";
 
   env.CGO_ENABLED = 0;
   ldflags = [
diff --git a/pkgs/by-name/va/vala-language-server/package.nix b/pkgs/by-name/va/vala-language-server/package.nix
index 87d67a44acf4..507e1d7fbc62 100644
--- a/pkgs/by-name/va/vala-language-server/package.nix
+++ b/pkgs/by-name/va/vala-language-server/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "vala-lang";
-    repo = pname;
+    repo = "vala-language-server";
     rev = version;
     sha256 = "sha256-Vl5DjKBdpk03aPD+0xGoTwD9Slg1rREorqZGX5o10cY=";
   };
diff --git a/pkgs/by-name/va/vals/package.nix b/pkgs/by-name/va/vals/package.nix
index 9377ec7f2993..67468de32c8d 100644
--- a/pkgs/by-name/va/vals/package.nix
+++ b/pkgs/by-name/va/vals/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "helmfile";
-    repo = pname;
+    repo = "vals";
     sha256 = "sha256-zgIU4J7p7tXFTdwznC4solJD22QlizzJyBkKyCprayA=";
   };
 
diff --git a/pkgs/by-name/va/vault-ssh-plus/package.nix b/pkgs/by-name/va/vault-ssh-plus/package.nix
index f624f915bb76..0fa3a0658513 100644
--- a/pkgs/by-name/va/vault-ssh-plus/package.nix
+++ b/pkgs/by-name/va/vault-ssh-plus/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "isometry";
-    repo = pname;
+    repo = "vault-ssh-plus";
     rev = "v${version}";
     hash = "sha256-5rajB4pSRp7Pw4yx0u6MoOLxfkWWjhB7T2JGGb8ICRU=";
   };
diff --git a/pkgs/by-name/va/vault-tasks/package.nix b/pkgs/by-name/va/vault-tasks/package.nix
index 423adab5fe02..711c88a01459 100644
--- a/pkgs/by-name/va/vault-tasks/package.nix
+++ b/pkgs/by-name/va/vault-tasks/package.nix
@@ -5,7 +5,7 @@
   nix-update-script,
 }:
 let
-  version = "0.11.0";
+  version = "0.11.1";
 in
 rustPlatform.buildRustPackage {
   pname = "vault-tasks";
@@ -14,10 +14,10 @@ rustPlatform.buildRustPackage {
     owner = "louis-thevenet";
     repo = "vault-tasks";
     rev = "v${version}";
-    hash = "sha256-3hRn3x86XLVMBtDlMsuqeEWgsgSeapri9MYNLqDxGF4=";
+    hash = "sha256-7stFa2fLczGyoM/O2S/uKCfjSDyABUw/b3tXp7Olqq8=";
   };
   useFetchCargoVendor = true;
-  cargoHash = "sha256-mh6LUb1gS/cICyVWCYvmCSeqxaIWI6PyLeQx13dZ0CA=";
+  cargoHash = "sha256-RSW0N0icKAZbh8KQNkI9TgcKwa6hTKjhaJWCGADtfq8=";
 
   postInstall = "install -Dm444 desktop/vault-tasks.desktop -t $out/share/applications";
 
diff --git a/pkgs/by-name/va/vaultwarden/package.nix b/pkgs/by-name/va/vaultwarden/package.nix
index 0eba9e6e26c6..077791d40554 100644
--- a/pkgs/by-name/va/vaultwarden/package.nix
+++ b/pkgs/by-name/va/vaultwarden/package.nix
@@ -19,17 +19,17 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "vaultwarden";
-  version = "1.33.2";
+  version = "1.34.1";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = "vaultwarden";
     rev = version;
-    hash = "sha256-Lu3/qVTi5Eedcm+3XlHAAJ1nPHm9hW4HZncQKmzDdoo=";
+    hash = "sha256-SVEQX+uAYb4/qFQZRm2khOi8ti76v3F5lRnUgoHk8wA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-T/ehLSPJmEuQYhotK12iqXQSe5Ke8+dkr9PVDe4Kmis=";
+  cargoHash = "sha256-Or259iQP89Ptf/XHpkHD08VDyCk/nQcFlyoKRUUQKt0=";
 
   # used for "Server Installed" version in admin panel
   env.VW_VERSION = version;
diff --git a/pkgs/by-name/va/vaultwarden/webvault.nix b/pkgs/by-name/va/vaultwarden/webvault.nix
index 9779d63b25b8..5e306c9860b0 100644
--- a/pkgs/by-name/va/vaultwarden/webvault.nix
+++ b/pkgs/by-name/va/vaultwarden/webvault.nix
@@ -2,43 +2,23 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
-  git,
   nixosTests,
   python3,
   vaultwarden,
 }:
 
-let
-  version = "2025.1.1";
-
-  suffix = lib.head (lib.match "[0-9.]*([a-z]*)" version);
-
-  bw_web_builds = fetchFromGitHub {
-    owner = "dani-garcia";
-    repo = "bw_web_builds";
-    rev = "v${version}";
-    hash = "sha256-wQGpl7N0D83FrrV4T+LFe9h3n5Q/MqLbGGO2F5R9k2g=";
-  };
-
-in
 buildNpmPackage rec {
   pname = "vaultwarden-webvault";
-  inherit version;
+  version = "2025.5.0.0";
 
   src = fetchFromGitHub {
-    owner = "bitwarden";
-    repo = "clients";
-    rev = "web-v${lib.removeSuffix suffix version}";
-    hash = "sha256-Bq133V8CsDMnLeaKrW5JmLTGRaZVLRbp+tTgG725tqE=";
+    owner = "vaultwarden";
+    repo = "vw_web_builds";
+    tag = "v${version}";
+    hash = "sha256-Z3QPKeo7+QV3XnECvLXz2Upv41h579WoVH0Vev0fixk=";
   };
 
-  npmDepsHash = "sha256-bWcp3VJI2bObLH/XBx3cdxXQY9Cw+IFpeNA2TXVTtFg=";
-
-  postPatch = ''
-    ln -s ${bw_web_builds}/{patches,resources} ..
-    PATH="${git}/bin:$PATH" VAULT_VERSION="${lib.removePrefix "web-" src.rev}" \
-      bash ${bw_web_builds}/scripts/apply_patches.sh
-  '';
+  npmDepsHash = "sha256-FC3x7H0MQDVGajtaMA2PUK5+soG6kD9AaDbq/s1pOnY=";
 
   nativeBuildInputs = [
     python3
@@ -73,7 +53,6 @@ buildNpmPackage rec {
   '';
 
   passthru = {
-    inherit bw_web_builds;
     tests = nixosTests.vaultwarden;
   };
 
diff --git a/pkgs/by-name/vc/vcpkg-tool/package.nix b/pkgs/by-name/vc/vcpkg-tool/package.nix
index b497e3d30fad..5817c9b49f86 100644
--- a/pkgs/by-name/vc/vcpkg-tool/package.nix
+++ b/pkgs/by-name/vc/vcpkg-tool/package.nix
@@ -24,13 +24,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vcpkg-tool";
-  version = "2025-04-16";
+  version = "2025-05-19";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vcpkg-tool";
     rev = finalAttrs.version;
-    hash = "sha256-4XqpYEbE7TJyfdDPomcghII3iqcoX99I2GDuSHX5q2g=";
+    hash = "sha256-st9VLiuvKHKkokUToxw4KQ4aekGMqx8rfVBmmeddgVk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ve/vector/package.nix b/pkgs/by-name/ve/vector/package.nix
index 3dccadda95dd..1d0c100d6100 100644
--- a/pkgs/by-name/ve/vector/package.nix
+++ b/pkgs/by-name/ve/vector/package.nix
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage {
 
   src = fetchFromGitHub {
     owner = "vectordotdev";
-    repo = pname;
+    repo = "vector";
     rev = "v${version}";
     hash = "sha256-09CjhSckptXbbTzBneo5aQ76YwLPSacRlsMpexsw54c=";
   };
diff --git a/pkgs/by-name/ve/veilid/package.nix b/pkgs/by-name/ve/veilid/package.nix
index bde4286180b5..50829eaca45e 100644
--- a/pkgs/by-name/ve/veilid/package.nix
+++ b/pkgs/by-name/ve/veilid/package.nix
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitLab {
     owner = "veilid";
-    repo = pname;
+    repo = "veilid";
     rev = "v${version}";
     hash = "sha256-bKll7VB6LjkmmhN5lmjcSeP2zZbyWnl4XiZbZe3tKgg=";
   };
diff --git a/pkgs/by-name/ve/verapdf/package.nix b/pkgs/by-name/ve/verapdf/package.nix
index 77e3185e5818..729ffecf834a 100644
--- a/pkgs/by-name/ve/verapdf/package.nix
+++ b/pkgs/by-name/ve/verapdf/package.nix
@@ -10,7 +10,7 @@
 }:
 maven.buildMavenPackage rec {
   pname = "verapdf";
-  version = "1.26.4";
+  version = "1.26.5";
 
   mvnParameters = "-pl '!installer' -Dverapdf.timestamp=1980-01-01T00:00:02Z -Dproject.build.outputTimestamp=1980-01-01T00:00:02Z";
 
@@ -23,7 +23,8 @@ maven.buildMavenPackage rec {
 
   patches = [ ./stable-maven-plugins.patch ];
 
-  mvnHash = "sha256-VXivLGt440MfloWedtQlGukuZk0yui1QhjrpXGNNzqY=";
+  # FIXME: this hash keeps changing over time??
+  mvnHash = "sha256-uFY92BFsIu9B6clwQV3l718DsBxvswANrKEBIFGNXN4=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/ve/versitygw/package.nix b/pkgs/by-name/ve/versitygw/package.nix
index 6c2647111389..71c96193c772 100644
--- a/pkgs/by-name/ve/versitygw/package.nix
+++ b/pkgs/by-name/ve/versitygw/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "versitygw";
-  version = "1.0.13";
+  version = "1.0.14";
 
   src = fetchFromGitHub {
     owner = "versity";
     repo = "versitygw";
     tag = "v${version}";
-    hash = "sha256-BsosWFzaN7P/QXPf86t+fJ6PkBGuykUCTmFEGCgclOE=";
+    hash = "sha256-/64SiVZUXGRI3guvSIqDBXOmbxucPCZEceCObTee6jI=";
   };
 
-  vendorHash = "sha256-yDHuNqrCfrvKz4spofdw9EH7J9JZvpCYejlz893nwBk=";
+  vendorHash = "sha256-HzPjHNZdQ+IJl91QviVG6zydhTb/1tOZGdFBpHLUTfE=";
 
   doCheck = false; # Require access to online S3 services
 
diff --git a/pkgs/by-name/ve/versus/package.nix b/pkgs/by-name/ve/versus/package.nix
index 668178b438db..1345f44e1433 100644
--- a/pkgs/by-name/ve/versus/package.nix
+++ b/pkgs/by-name/ve/versus/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "INFURA";
-    repo = pname;
+    repo = "versus";
     rev = "v${version}";
     hash = "sha256-jX2HRdrLwDjnrUofRzmsSFLMbiPh0a1DPv1tzl+StUg=";
   };
diff --git a/pkgs/by-name/vg/vgmstream/package.nix b/pkgs/by-name/vg/vgmstream/package.nix
index f6901368baae..fdcfcdfe91db 100644
--- a/pkgs/by-name/vg/vgmstream/package.nix
+++ b/pkgs/by-name/vg/vgmstream/package.nix
@@ -37,13 +37,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "vgmstream";
-  version = "1980";
+  version = "2023";
 
   src = fetchFromGitHub {
     owner = "vgmstream";
     repo = "vgmstream";
     tag = "r${version}";
-    hash = "sha256-TmaWC04XbtFfBYhmTO4ouh3NoByio1BCpDJGJy3r0NY=";
+    hash = "sha256-RyVh9twBZqFs4bKRZKmat0JB25R+rQtnAARo0dvCS+8=";
   };
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/by-name/vg/vgrep/package.nix b/pkgs/by-name/vg/vgrep/package.nix
index e24a35769773..1e20565bd69e 100644
--- a/pkgs/by-name/vg/vgrep/package.nix
+++ b/pkgs/by-name/vg/vgrep/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "vrothberg";
-    repo = pname;
+    repo = "vgrep";
     rev = "v${version}";
     hash = "sha256-OQjuNRuzFluZLssM+q+WpoRncdJMj6Sl/A+mUZA7UpI=";
   };
diff --git a/pkgs/by-name/vh/vhs/package.nix b/pkgs/by-name/vh/vhs/package.nix
index 14729aa532b6..bfd2c5e04626 100644
--- a/pkgs/by-name/vh/vhs/package.nix
+++ b/pkgs/by-name/vh/vhs/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
-    repo = pname;
+    repo = "vhs";
     rev = "v${version}";
     hash = "sha256-ceY4zLd+4EwXpwunKiWnaAB25qutSK1b1SyIriAbAI0=";
   };
diff --git a/pkgs/by-name/vi/vi-mongo/package.nix b/pkgs/by-name/vi/vi-mongo/package.nix
index e949c68dfa51..d5bb129d22c5 100644
--- a/pkgs/by-name/vi/vi-mongo/package.nix
+++ b/pkgs/by-name/vi/vi-mongo/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "vi-mongo";
-  version = "0.1.27";
+  version = "0.1.28";
 
   src = fetchFromGitHub {
     owner = "kopecmaciej";
     repo = "vi-mongo";
     tag = "v${version}";
-    hash = "sha256-/hj2JMjBKl3HLd6Mfuz4UnaWbPKPYHYfqKPj3kjxLZg=";
+    hash = "sha256-vqwsFWU/DSxvmlHGG91MK8MqRYmSZrzB1ypjMNug6v0=";
   };
 
-  vendorHash = "sha256-OVd2wIssVJHamWpNrK+piQFl9Lz0xgYnnz/4D5yl1D4=";
+  vendorHash = "sha256-Z1qvTde0TtoIKUppfDRcNx9qAFbAqFf3xIOTNQnPQng=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/vi/viceroy/package.nix b/pkgs/by-name/vi/viceroy/package.nix
index 19ff19753ec3..fcd95aa2b647 100644
--- a/pkgs/by-name/vi/viceroy/package.nix
+++ b/pkgs/by-name/vi/viceroy/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "fastly";
-    repo = pname;
+    repo = "viceroy";
     rev = "v${version}";
     hash = "sha256-DeViAqL+7mta/wH7rLyltOCtHCTFXZczn2vAL1k+R2Y=";
   };
diff --git a/pkgs/by-name/vi/vieb/package.nix b/pkgs/by-name/vi/vieb/package.nix
index ab4feb991bb2..a292c7865065 100644
--- a/pkgs/by-name/vi/vieb/package.nix
+++ b/pkgs/by-name/vi/vieb/package.nix
@@ -15,7 +15,7 @@ buildNpmPackage rec {
 
   src = fetchFromGitHub {
     owner = "Jelmerro";
-    repo = pname;
+    repo = "vieb";
     rev = version;
     hash = "sha256-g3L+bzsDP3vfTaroqCWzRDymFTZE+6nLytRWzPMBoX8=";
   };
diff --git a/pkgs/by-name/vi/vimiv-qt/package.nix b/pkgs/by-name/vi/vimiv-qt/package.nix
index f11716993ce5..854b885788ed 100644
--- a/pkgs/by-name/vi/vimiv-qt/package.nix
+++ b/pkgs/by-name/vi/vimiv-qt/package.nix
@@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "karlch";
-    repo = pname;
+    repo = "vimiv-qt";
     rev = "v${version}";
     sha256 = "sha256-28sk5qDVmrgXYX2wm5G8zv564vG6GwxNp+gjrFHCRfU=";
   };
diff --git a/pkgs/by-name/vi/vitess/package.nix b/pkgs/by-name/vi/vitess/package.nix
index 2d3a3c0d57c1..17cb7e380973 100644
--- a/pkgs/by-name/vi/vitess/package.nix
+++ b/pkgs/by-name/vi/vitess/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "vitessio";
-    repo = pname;
+    repo = "vitess";
     rev = "v${version}";
     hash = "sha256-YfFGKOYlsCy9mSjtRB+ajmXnXIB8Awjm54DGGhTnu5U=";
   };
diff --git a/pkgs/by-name/vk/vkbasalt-cli/package.nix b/pkgs/by-name/vk/vkbasalt-cli/package.nix
index 3c66ba9c0781..2a28cc1551ef 100644
--- a/pkgs/by-name/vk/vkbasalt-cli/package.nix
+++ b/pkgs/by-name/vk/vkbasalt-cli/package.nix
@@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitLab {
     owner = "TheEvilSkeleton";
-    repo = pname;
+    repo = "vkbasalt-cli";
     rev = "v${version}";
     hash = "sha256-4MFqndnvwAsqyer9kMNuCZFP/Xdl7W//AyCe7n83328=";
   };
diff --git a/pkgs/by-name/vo/volctl/package.nix b/pkgs/by-name/vo/volctl/package.nix
index 9be2580032c4..78b6b6131f41 100644
--- a/pkgs/by-name/vo/volctl/package.nix
+++ b/pkgs/by-name/vo/volctl/package.nix
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "buzz";
-    repo = pname;
+    repo = "volctl";
     rev = "v${version}";
     sha256 = "sha256-jzS97KV17wKeBI6deKE4rEj5lvqC38fq1JGundHn2So=";
   };
diff --git a/pkgs/by-name/vo/voxelands/package.nix b/pkgs/by-name/vo/voxelands/package.nix
index c8c9e5468e80..19f2e4c22c60 100644
--- a/pkgs/by-name/vo/voxelands/package.nix
+++ b/pkgs/by-name/vo/voxelands/package.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
   version = "1704.00";
 
   src = fetchFromGitLab {
-    owner = pname;
-    repo = pname;
+    owner = "voxelands";
+    repo = "voxelands";
     rev = version;
     sha256 = "0yj9z9nygpn0z63y739v72l3kg81wd71xgix5k045vfzhqsam5m0";
   };
diff --git a/pkgs/by-name/vt/vt-cli/package.nix b/pkgs/by-name/vt/vt-cli/package.nix
index 3469cb63dc1f..0ca91305822d 100644
--- a/pkgs/by-name/vt/vt-cli/package.nix
+++ b/pkgs/by-name/vt/vt-cli/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
-    repo = pname;
+    repo = "vt-cli";
     tag = version;
     hash = "sha256-NB5eo+6IwIxhQX1lwJzPOZ0pSeFVo7LYIEEmDqE4A7Y=";
   };
diff --git a/pkgs/by-name/vu/vulkan-hdr-layer-kwin6/package.nix b/pkgs/by-name/vu/vulkan-hdr-layer-kwin6/package.nix
index 73f95bb30fcd..30cbf761822b 100644
--- a/pkgs/by-name/vu/vulkan-hdr-layer-kwin6/package.nix
+++ b/pkgs/by-name/vu/vulkan-hdr-layer-kwin6/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation {
   pname = "vulkan-hdr-layer-kwin6";
-  version = "0-unstable-2025-04-16";
+  version = "0-unstable-2025-05-22";
 
   depsBuildBuild = [ pkg-config ];
 
@@ -40,8 +40,8 @@ stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "Zamundaaa";
     repo = "VK_hdr_layer";
-    rev = "3b276e68136eb10825aa7cabd06abb324897f0e8";
-    hash = "sha256-c3OLT2qMKAQnQYrTVhrs3BEVS55HoaeBijgzygz6zgs=";
+    rev = "1384036ea24a9bc38a5c684dac5122d5e3431ae6";
+    hash = "sha256-xm0S1vLE8MAov8gf6rN5ZKZAe6NMKfHDlUlmNd332qw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/vu/vultr-cli/package.nix b/pkgs/by-name/vu/vultr-cli/package.nix
index a69bce393302..5f8c67d2a1bf 100644
--- a/pkgs/by-name/vu/vultr-cli/package.nix
+++ b/pkgs/by-name/vu/vultr-cli/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "vultr";
-    repo = pname;
+    repo = "vultr-cli";
     rev = "v${version}";
     hash = "sha256-uk0tG66u0gQgEzpiFAeMC0qPrd+Pk6nbrXuuyOtVLe4=";
   };
diff --git a/pkgs/by-name/w3/w3m/package.nix b/pkgs/by-name/w3/w3m/package.nix
index 3722c6a5ceba..e20fffde7614 100644
--- a/pkgs/by-name/w3/w3m/package.nix
+++ b/pkgs/by-name/w3/w3m/package.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "tats";
-    repo = pname;
+    repo = "w3m";
     rev = "v${version}";
     hash = "sha256-upb5lWqhC1jRegzTncIz5e21v4Pw912FyVn217HucFs=";
   };
diff --git a/pkgs/by-name/wa/waf-tester/package.nix b/pkgs/by-name/wa/waf-tester/package.nix
index abc02cc1465e..f07758b17591 100644
--- a/pkgs/by-name/wa/waf-tester/package.nix
+++ b/pkgs/by-name/wa/waf-tester/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "jreisinger";
-    repo = pname;
+    repo = "waf-tester";
     tag = "v${version}";
     hash = "sha256-UPviooQNGRVwf/bTz9ApedJDAGeCvh9iD1HXFOQXPcw=";
   };
diff --git a/pkgs/by-name/wa/wagyu/package.nix b/pkgs/by-name/wa/wagyu/package.nix
index c40d2add083c..96537c15f5fb 100644
--- a/pkgs/by-name/wa/wagyu/package.nix
+++ b/pkgs/by-name/wa/wagyu/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "AleoHQ";
-    repo = pname;
+    repo = "wagyu";
     rev = "v${version}";
     hash = "sha256-5n8BmETv5jUvgu0rskAPYaBgYyNL2QU2t/iUb3hNMMw=";
   };
diff --git a/pkgs/by-name/wa/waifu2x-converter-cpp/package.nix b/pkgs/by-name/wa/waifu2x-converter-cpp/package.nix
index 51f5552c970b..ecfa7899d65a 100644
--- a/pkgs/by-name/wa/waifu2x-converter-cpp/package.nix
+++ b/pkgs/by-name/wa/waifu2x-converter-cpp/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "DeadSix27";
-    repo = pname;
+    repo = "waifu2x-converter-cpp";
     rev = "v${version}";
     sha256 = "0rv8bnyxz89za6gwk9gmdbaf3j7c1j52mip7h81rir288j35m84x";
   };
diff --git a/pkgs/by-name/wa/wait4x/package.nix b/pkgs/by-name/wa/wait4x/package.nix
index 45a720138c15..b5283121812d 100644
--- a/pkgs/by-name/wa/wait4x/package.nix
+++ b/pkgs/by-name/wa/wait4x/package.nix
@@ -12,7 +12,7 @@ buildGoModule {
 
   src = fetchFromGitHub {
     owner = "wait4x";
-    repo = pname;
+    repo = "wait4x";
     rev = "v${version}";
     hash = "sha256-3s+ug4KqFv1P55eqNfAB2jbSPVzySxlHmkDMuuVlJcQ=";
   };
diff --git a/pkgs/by-name/wa/wander/package.nix b/pkgs/by-name/wa/wander/package.nix
index b838a623b78f..a921e5e5d308 100644
--- a/pkgs/by-name/wa/wander/package.nix
+++ b/pkgs/by-name/wa/wander/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "robinovitch61";
-    repo = pname;
+    repo = "wander";
     rev = "v${version}";
     sha256 = "sha256-1+bKdIAWdg/+5FBDbtvjDV0xpZ5jot3y6F+KuLO9WVk=";
   };
diff --git a/pkgs/by-name/wa/warpinator/package.nix b/pkgs/by-name/wa/warpinator/package.nix
index dac1fee1046f..e8bcf117ca4f 100644
--- a/pkgs/by-name/wa/warpinator/package.nix
+++ b/pkgs/by-name/wa/warpinator/package.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "linuxmint";
-    repo = pname;
+    repo = "warpinator";
     rev = version;
     hash = "sha256-aqqKCYlCAL/6srbyYRoVQlIFKpTmwYZsdfLibRyAUXg=";
   };
diff --git a/pkgs/by-name/wa/wasm-tools/package.nix b/pkgs/by-name/wa/wasm-tools/package.nix
index 028613edbf86..0a9877d93599 100644
--- a/pkgs/by-name/wa/wasm-tools/package.nix
+++ b/pkgs/by-name/wa/wasm-tools/package.nix
@@ -6,20 +6,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasm-tools";
-  version = "1.230.0";
+  version = "1.232.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasm-tools";
     rev = "v${version}";
-    hash = "sha256-xtGPZXb/tgReshmpW5zzG0EOVYPMoXU+avnO5uLKJnI=";
+    hash = "sha256-iEHZXxE/cOs438KVXJ5o7+LobrODKtXGt92TPKxtOpU=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
   useFetchCargoVendor = true;
-  cargoHash = "sha256-P+5g1ynZVFIU2bgait+2rwJoVYClF7lyq4j2roV/w2o=";
+  cargoHash = "sha256-W01pqmqJWwEOLv/ng0ZRFcPpOPO9s0IqcaEM7IN7v9g=";
   cargoBuildFlags = [
     "--package"
     "wasm-tools"
diff --git a/pkgs/by-name/wa/watcher/package.nix b/pkgs/by-name/wa/watcher/package.nix
index 91f0cf7a9536..8f53e767e215 100644
--- a/pkgs/by-name/wa/watcher/package.nix
+++ b/pkgs/by-name/wa/watcher/package.nix
@@ -25,7 +25,10 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/e-dant/watcher";
     changelog = "https://github.com/e-dant/watcher/releases/tag/${src.tag}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ gaelreyrol ];
+    maintainers = with lib.maintainers; [
+      gaelreyrol
+      matthiasbeyer
+    ];
     mainProgram = "tw";
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/by-name/wa/watchexec/package.nix b/pkgs/by-name/wa/watchexec/package.nix
index 93ca9ba9e438..37a8fcb6c891 100644
--- a/pkgs/by-name/wa/watchexec/package.nix
+++ b/pkgs/by-name/wa/watchexec/package.nix
@@ -11,8 +11,8 @@ rustPlatform.buildRustPackage rec {
   version = "2.3.1";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "watchexec";
+    repo = "watchexec";
     rev = "v${version}";
     hash = "sha256-ldxB1/WgOe1uGfKXkMEtGHIlWiKJgnZz6j/7eCOGD8s=";
   };
diff --git a/pkgs/by-name/wa/waypaper/package.nix b/pkgs/by-name/wa/waypaper/package.nix
index 8d3b0018582f..bca1f3039aa0 100644
--- a/pkgs/by-name/wa/waypaper/package.nix
+++ b/pkgs/by-name/wa/waypaper/package.nix
@@ -1,22 +1,22 @@
 {
   lib,
-  python3,
+  python3Packages,
   fetchFromGitHub,
   gobject-introspection,
   wrapGAppsHook3,
   killall,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "waypaper";
-  version = "2.5";
+  version = "2.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anufrievroman";
     repo = "waypaper";
     tag = version;
-    hash = "sha256-g1heJUBVJzRZXcNQCwRcqp6cTUaroKVpcTjG0KldlxU=";
+    hash = "sha256-MGfTuQcVChI4g7RONiTZZ4a5uX5SDjfLeMxbLIZ7VH4=";
   };
 
   nativeBuildInputs = [
@@ -24,15 +24,15 @@ python3.pkgs.buildPythonApplication rec {
     wrapGAppsHook3
   ];
 
-  build-system = [ python3.pkgs.setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  dependencies = [
-    python3.pkgs.pygobject3
-    python3.pkgs.platformdirs
-    python3.pkgs.pillow
-    python3.pkgs.imageio
-    python3.pkgs.imageio-ffmpeg
-    python3.pkgs.screeninfo
+  dependencies = with python3Packages; [
+    imageio
+    imageio-ffmpeg
+    pillow
+    platformdirs
+    pygobject3
+    screeninfo
   ];
 
   propagatedBuildInputs = [ killall ];
@@ -46,7 +46,7 @@ python3.pkgs.buildPythonApplication rec {
     makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
   '';
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/anufrievroman/waypaper/releases/tag/${version}";
     description = "GUI wallpaper setter for Wayland-based window managers";
     mainProgram = "waypaper";
@@ -56,8 +56,11 @@ python3.pkgs.buildPythonApplication rec {
       If wallpaper does not change, make sure that swaybg or swww is installed.
     '';
     homepage = "https://github.com/anufrievroman/waypaper";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ totalchaos ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      prince213
+      totalchaos
+    ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/wa/wayst/package.nix b/pkgs/by-name/wa/wayst/package.nix
index 4c2c10049bce..76ec0b2449a5 100644
--- a/pkgs/by-name/wa/wayst/package.nix
+++ b/pkgs/by-name/wa/wayst/package.nix
@@ -37,13 +37,13 @@ let
     comment = "A simple terminal emulator";
   };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "wayst";
   version = "unstable-2023-07-16";
 
   src = fetchFromGitHub {
     owner = "91861";
-    repo = pname;
+    repo = "wayst";
     rev = "f8b218eec1af706fd5ae287f5073e6422eb8b6d8";
     hash = "sha256-tA2R6Snk5nqWkPXSbs7wmovWkT97xafdK0e/pKBUIUg=";
   };
diff --git a/pkgs/by-name/wa/wayvnc/package.nix b/pkgs/by-name/wa/wayvnc/package.nix
index 746cf31bacbc..f19832b77740 100644
--- a/pkgs/by-name/wa/wayvnc/package.nix
+++ b/pkgs/by-name/wa/wayvnc/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "any1";
-    repo = pname;
+    repo = "wayvnc";
     rev = "v${version}";
     hash = "sha256-LINzkC18gitj1a8Giqlt/6LyydOdV+8YXRJmuxT/Nq8=";
   };
diff --git a/pkgs/by-name/wc/wcurl/package.nix b/pkgs/by-name/wc/wcurl/package.nix
index 55615ea97964..630f2072f970 100644
--- a/pkgs/by-name/wc/wcurl/package.nix
+++ b/pkgs/by-name/wc/wcurl/package.nix
@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "wcurl";
-  version = "2025.04.20";
+  version = "2025.05.26";
 
   src = fetchFromGitHub {
     owner = "curl";
     repo = "wcurl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6ZW1VTtggp72vDgOAnieWK68ITU+E5x0gV2N2IJ5JDQ=";
+    hash = "sha256-YeH+K+P+3iJ4v9et/B1PBi9nAr9L2xaYoMfSMP9ar9c=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/we/weave-gitops/package.nix b/pkgs/by-name/we/weave-gitops/package.nix
index b70aa20dba6a..29cdf6d2de86 100644
--- a/pkgs/by-name/we/weave-gitops/package.nix
+++ b/pkgs/by-name/we/weave-gitops/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "weaveworks";
-    repo = pname;
+    repo = "weave-gitops";
     rev = "v${version}";
     sha256 = "sha256-Gm4DIQK8T+dTwB5swdrD+SjGgy/wFQ/fJYdSqNDSy9c=";
   };
diff --git a/pkgs/by-name/we/weaver/package.nix b/pkgs/by-name/we/weaver/package.nix
index 1c50d46d1154..151fc1628729 100644
--- a/pkgs/by-name/we/weaver/package.nix
+++ b/pkgs/by-name/we/weaver/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "weaver";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "weaver";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aAxVSk12bPaWbvCWd+ntPeozd/rtQxdu53APWXI6fTg=";
+    hash = "sha256-cEexfPtlbcLR+u5bfwLtDX7iT8ayelSTGdVXSRhKGkY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Sc5tSK/0C8iqwb4yM6Ra2/PcdOdn1UkpUQjgmWmfVBE=";
+  cargoHash = "sha256-b06bNgRYlsqk/evGubgtnBJM76mm5rQP6VuiHOxyCuw=";
 
   checkFlags = [
     # Skip tests requiring network
diff --git a/pkgs/by-name/we/webanalyze/package.nix b/pkgs/by-name/we/webanalyze/package.nix
index 02081bcb69a0..906a94e6cc42 100644
--- a/pkgs/by-name/we/webanalyze/package.nix
+++ b/pkgs/by-name/we/webanalyze/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "rverton";
-    repo = pname;
+    repo = "webanalyze";
     tag = "v${version}";
     hash = "sha256-rnNbEPlbye0gjUamwq1xjFM/4g0eEHsGOAZWziEqxwM=";
   };
diff --git a/pkgs/by-name/we/webmesh/package.nix b/pkgs/by-name/we/webmesh/package.nix
index 053669528c11..f3b3cf5c65a4 100644
--- a/pkgs/by-name/we/webmesh/package.nix
+++ b/pkgs/by-name/we/webmesh/package.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "webmeshproj";
-    repo = pname;
+    repo = "webmesh";
     rev = "v${version}";
     hash = "sha256-Inh7j01/xBJgGYmX1tGBRNYjn1N4AO2sywBwZ8yXlsY=";
   };
diff --git a/pkgs/by-name/we/websocketd/package.nix b/pkgs/by-name/we/websocketd/package.nix
index 78e5db1f1ed9..6c9b59cc9ac4 100644
--- a/pkgs/by-name/we/websocketd/package.nix
+++ b/pkgs/by-name/we/websocketd/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "joewalnes";
-    repo = pname;
+    repo = "websocketd";
     rev = "v${version}";
     sha256 = "sha256-cp4iBSQ6Cd0+NPZ2i79Mulg1z17u//OCm3yoArbZEHs=";
   };
diff --git a/pkgs/by-name/we/webull-desktop/package.nix b/pkgs/by-name/we/webull-desktop/package.nix
index ca1a86fd1f43..edfa1df37f61 100644
--- a/pkgs/by-name/we/webull-desktop/package.nix
+++ b/pkgs/by-name/we/webull-desktop/package.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "webull-desktop";
-  version = "8.2.0";
+  version = "8.9.0";
 
   src = fetchurl {
-    url = "https://u1sweb.webullfintech.com/us/Webull%20Desktop_8.2.0_800200_global_x64signed.deb";
-    hash = "sha256-/KVY6I9gYWWZSJhsTW5GECCeOsx+6XAVIRpghlJUK4k=";
+    url = "https://u1sweb.webullfintech.com/us/Webull%20Desktop_8.9.0_80009000_global_x64signed.deb";
+    hash = "sha256-brt5EXUE9g72vN2Kx9/jf4P/lkVfWLsbzJIf13phgdI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/we/webwormhole/package.nix b/pkgs/by-name/we/webwormhole/package.nix
index f5a7f58a9980..7728cfc81c70 100644
--- a/pkgs/by-name/we/webwormhole/package.nix
+++ b/pkgs/by-name/we/webwormhole/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "webwormhole";
   version = "0-unstable-2023-11-15";
 
   src = fetchFromGitHub {
     owner = "saljam";
-    repo = pname;
+    repo = "webwormhole";
     rev = "6ceee76274ee881e828bd48c5cc15c758b9ad77c";
     hash = "sha256-C9r6wFhP5BkIClgTQol7LyMUHXOzyrX9Pn91VqBaqFQ=";
   };
diff --git a/pkgs/by-name/we/wego/package.nix b/pkgs/by-name/we/wego/package.nix
index 107ff1421bc7..91ae217c4a7d 100644
--- a/pkgs/by-name/we/wego/package.nix
+++ b/pkgs/by-name/we/wego/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "schachmat";
-    repo = pname;
+    repo = "wego";
     rev = version;
     sha256 = "sha256-YGUll0Wi/oulNMXSrSFeAVe+aGpyFeyXRZTW4ngC3Zk=";
   };
diff --git a/pkgs/by-name/we/werf/package.nix b/pkgs/by-name/we/werf/package.nix
index cc144e717e26..4765870a926a 100644
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "werf";
-  version = "2.35.8";
+  version = "2.36.3";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-akrhVRjoWrBdSrYWe4MZnCAMdT2KfXxAI4oBvrHBwC8=";
+    hash = "sha256-vTw2kUaCemRwZwzF6NGkqJ67A88AakbynQn55e4cnGw=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-9caBSJ/eMEdVQ55eebjibtsZJOMZk4OcP1D/NckWxCQ=";
+  vendorHash = "sha256-wo7hXzSUwT+gdtu82S88bPr2DUvBGAHIcRQ75j4mY2o=";
 
   subPackages = [ "cmd/werf" ];
 
diff --git a/pkgs/by-name/we/weylus/package.nix b/pkgs/by-name/we/weylus/package.nix
index 24a6ba2067e4..e922598d716b 100644
--- a/pkgs/by-name/we/weylus/package.nix
+++ b/pkgs/by-name/we/weylus/package.nix
@@ -23,13 +23,13 @@
   libxkbcommon,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "weylus";
   version = "unstable-2025-02-24";
 
   src = fetchFromGitHub {
     owner = "H-M-H";
-    repo = pname;
+    repo = "weylus";
     rev = "5202806798ccca67c24da52ba51ee50b973b7089";
     sha256 = "sha256-lx1ZVp5DkQiL9/vw6PAZ34Lge+K8dfEVh6vLnCUNf7M=";
   };
diff --git a/pkgs/by-name/wf/wf-recorder/package.nix b/pkgs/by-name/wf/wf-recorder/package.nix
index 4389f5caa463..c52dc85fa9a5 100644
--- a/pkgs/by-name/wf/wf-recorder/package.nix
+++ b/pkgs/by-name/wf/wf-recorder/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "ammen99";
-    repo = pname;
+    repo = "wf-recorder";
     rev = "v${version}";
     hash = "sha256-7/fQOkfAw5v3irD5blJOdq88j0VBrPVQQufdt9wsACk=";
   };
diff --git a/pkgs/by-name/wg/wgcf/package.nix b/pkgs/by-name/wg/wgcf/package.nix
index 8545eb51c80d..5b094d83086a 100644
--- a/pkgs/by-name/wg/wgcf/package.nix
+++ b/pkgs/by-name/wg/wgcf/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ViRb3";
-    repo = pname;
+    repo = "wgcf";
     tag = "v${version}";
     hash = "sha256-5bVGW17zNc4sS/vwtXXWP8F4QuM+ldA00GD/z3llpCA=";
   };
diff --git a/pkgs/by-name/wg/wget2/package.nix b/pkgs/by-name/wg/wget2/package.nix
index f0c1c3eef7eb..aacd147c1332 100644
--- a/pkgs/by-name/wg/wget2/package.nix
+++ b/pkgs/by-name/wg/wget2/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitLab {
     owner = "gnuwget";
-    repo = pname;
+    repo = "wget2";
     tag = "v${version}";
     hash = "sha256-0tOoStZHr5opehFmuQdFRPYvOv8IMrDTBNFtoweY3VM=";
   };
diff --git a/pkgs/by-name/wg/wgpu-native/package.nix b/pkgs/by-name/wg/wgpu-native/package.nix
index 95988dddf8f3..9af1f9616686 100644
--- a/pkgs/by-name/wg/wgpu-native/package.nix
+++ b/pkgs/by-name/wg/wgpu-native/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wgpu-native";
-  version = "24.0.3.1";
+  version = "25.0.2.1";
 
   src = fetchFromGitHub {
     owner = "gfx-rs";
     repo = "wgpu-native";
     tag = "v${version}";
-    hash = "sha256-0GPwTm23i/UMoGQ71qybQS9sHN7XTtiPAZWG229Tn2k=";
+    hash = "sha256-w0qzJxdJioiQAmsh56vLaR34TjaUK/qqHhWcvO93IQ8=";
     fetchSubmodules = true;
   };
 
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-sYwDbSglOS8h8XG5sC6yX5JfRmmmc8v8mxPBicoKxEU=";
+  cargoHash = "sha256-iOnz//eHQ6WRPWOGcKOXyuwZS9WcbJWslRAz8yDamn8=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/wh/whatip/package.nix b/pkgs/by-name/wh/whatip/package.nix
index 7acf9236830d..f6e308d989ce 100644
--- a/pkgs/by-name/wh/whatip/package.nix
+++ b/pkgs/by-name/wh/whatip/package.nix
@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GabMus";
-    repo = pname;
+    repo = "whatip";
     rev = version;
     hash = "sha256-gt/NKgnCpRoVmLvEJJq2geng4miM2g+YhXYEOm5pPTA=";
   };
diff --git a/pkgs/by-name/wi/wineasio/package.nix b/pkgs/by-name/wi/wineasio/package.nix
index 9152b850216c..50e40a56a2ae 100644
--- a/pkgs/by-name/wi/wineasio/package.nix
+++ b/pkgs/by-name/wi/wineasio/package.nix
@@ -13,8 +13,8 @@ multiStdenv.mkDerivation rec {
   version = "1.2.0";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "wineasio";
+    repo = "wineasio";
     rev = "v${version}";
     hash = "sha256-d5BGJAkaM5XZXyqm6K/UzFE4sD6QVHHGnLi1bcHxiaM=";
     fetchSubmodules = true;
diff --git a/pkgs/by-name/wi/wingpanel-indicator-ayatana/package.nix b/pkgs/by-name/wi/wingpanel-indicator-ayatana/package.nix
index 7e771b85670b..531049d00d63 100644
--- a/pkgs/by-name/wi/wingpanel-indicator-ayatana/package.nix
+++ b/pkgs/by-name/wi/wingpanel-indicator-ayatana/package.nix
@@ -14,13 +14,13 @@
   indicator-application-gtk3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "wingpanel-indicator-ayatana";
   version = "2.0.7-unstable-2023-04-18";
 
   src = fetchFromGitHub {
     owner = "Lafydev";
-    repo = pname;
+    repo = "wingpanel-indicator-ayatana";
     rev = "d554663b4e199d44c1f1d53b5cc39b9a775b3f1c";
     sha256 = "sha256-dEk0exLh+TGuQt7be2YRTS2EzPD55+edR8WibthXwhI=";
   };
diff --git a/pkgs/by-name/wi/wingpanel-indicator-namarupa/package.nix b/pkgs/by-name/wi/wingpanel-indicator-namarupa/package.nix
index 83528bd53035..82029aa3fe9c 100644
--- a/pkgs/by-name/wi/wingpanel-indicator-namarupa/package.nix
+++ b/pkgs/by-name/wi/wingpanel-indicator-namarupa/package.nix
@@ -15,13 +15,13 @@
   indicator-application-gtk3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "wingpanel-indicator-namarupa";
   version = "0.0.0-unstable-2024-12-17";
 
   src = fetchFromGitHub {
     owner = "lenemter";
-    repo = pname;
+    repo = "wingpanel-indicator-namarupa";
     rev = "d9fc4e47d58c72e0cf08aa11246910ce84fcef50";
     sha256 = "sha256-8jzhrCMkP5ui964JRZUs+tl2ShxeB8q60fBUI4okrpg=";
   };
diff --git a/pkgs/by-name/wi/wireworld/package.nix b/pkgs/by-name/wi/wireworld/package.nix
index 7e487a528a14..a9018ee75544 100644
--- a/pkgs/by-name/wi/wireworld/package.nix
+++ b/pkgs/by-name/wi/wireworld/package.nix
@@ -10,13 +10,13 @@
   strip-nondeterminism,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "wireworld";
   version = "unstable-2023-05-09";
 
   src = fetchFromGitLab {
     owner = "blinry";
-    repo = pname;
+    repo = "wireworld";
     rev = "03b82bf5d604d6d4ad3c07b224583de6c396fd17";
     hash = "sha256-8BshnGLuA8lmG9g7FU349DWKP/fZvlvjrQBau/LSJ4E=";
   };
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   desktopItems = [
     (makeDesktopItem {
       name = "Wireworld";
-      exec = pname;
+      exec = "wireworld";
       comment = "";
       desktopName = "Wireworld";
       genericName = "Wireworld";
diff --git a/pkgs/by-name/wi/wiseunpacker/package.nix b/pkgs/by-name/wi/wiseunpacker/package.nix
index f5c9690a757f..891255b2e345 100644
--- a/pkgs/by-name/wi/wiseunpacker/package.nix
+++ b/pkgs/by-name/wi/wiseunpacker/package.nix
@@ -8,12 +8,12 @@ let
   version = "1.3.3";
   pname = "WiseUnpacker";
 in
-buildDotnetModule rec {
+buildDotnetModule {
   inherit version pname;
 
   src = fetchFromGitHub {
     owner = "mnadareski";
-    repo = pname;
+    repo = "WiseUnpacker";
     rev = version;
     hash = "sha256-APbfo2D/p733AwNNByu5MvC9LA8WW4mAzq6t2w/YNrs=";
   };
diff --git a/pkgs/by-name/wl/wl-screenrec/package.nix b/pkgs/by-name/wl/wl-screenrec/package.nix
index 2c82f0e328ce..f90cd7c5f2ac 100644
--- a/pkgs/by-name/wl/wl-screenrec/package.nix
+++ b/pkgs/by-name/wl/wl-screenrec/package.nix
@@ -8,13 +8,13 @@
   wayland,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "wl-screenrec";
   version = "0.1.4-unstable-2024-07-28";
 
   src = fetchFromGitHub {
     owner = "russelltg";
-    repo = pname;
+    repo = "wl-screenrec";
     rev = "b817accf1d4f2373cb6f466f760de35e5b8626bd";
     hash = "sha256-07O2YM9dOHWzriM2+uiBWjEt2hKAuXtRtnKBuzb02Us=";
   };
diff --git a/pkgs/by-name/wl/wldash/package.nix b/pkgs/by-name/wl/wldash/package.nix
index 287f9da37e37..1f1df74fa30b 100644
--- a/pkgs/by-name/wl/wldash/package.nix
+++ b/pkgs/by-name/wl/wldash/package.nix
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage {
 
   src = fetchFromGitHub {
     owner = "kennylevinsen";
-    repo = pname;
+    repo = "wldash";
     rev = "v${version}";
     hash = "sha256-ZzsBD3KKTT+JGiFCpdumPyVAE2gEJvzCq+nRnK3RdxI=";
   };
diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix
index bccd65d015f9..b7c1bca77bf5 100644
--- a/pkgs/by-name/wo/wolfssl/package.nix
+++ b/pkgs/by-name/wo/wolfssl/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wolfssl-${variant}";
-  version = "5.7.4";
+  version = "5.7.6";
 
   src = fetchFromGitHub {
     owner = "wolfSSL";
     repo = "wolfssl";
     tag = "v${finalAttrs.version}-stable";
-    hash = "sha256-/dtW1E1wYfQEuotclUEOK5+Vg4S7vt1xWhr1lEtu60w=";
+    hash = "sha256-q3V2cxk7dBRJoE8EpfWxkYmXPfDzoMwrX1JLazrHOuA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/wo/woodpecker-plugin-git/package.nix b/pkgs/by-name/wo/woodpecker-plugin-git/package.nix
index 01b04bac2f36..31f5d450ff34 100644
--- a/pkgs/by-name/wo/woodpecker-plugin-git/package.nix
+++ b/pkgs/by-name/wo/woodpecker-plugin-git/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "woodpecker-plugin-git";
-  version = "2.6.3";
+  version = "2.6.4";
 
   src = fetchFromGitHub {
     owner = "woodpecker-ci";
     repo = "plugin-git";
     tag = version;
-    hash = "sha256-8CioqP0+L4DMF3S7QOGAmq3Uj0WAi0W7jhw0HNWVPwQ=";
+    hash = "sha256-iCB2GQ8SpuW+uT8RyMNb6cq4bbWIeMO069yq4a+nIVI=";
   };
 
-  vendorHash = "sha256-X9cpR45fB4HqTn3TiehAw6J7G2lXAQ3OfxRh5N+ceFc=";
+  vendorHash = "sha256-Zn2TYNyKvtmtEAlKmWBhjyzHiM0dwDT3E/LOtSzjFK0=";
 
   env.CGO_ENABLED = "0";
 
diff --git a/pkgs/by-name/wp/wprecon/package.nix b/pkgs/by-name/wp/wprecon/package.nix
index c6aedc564b4c..275d78a7e806 100644
--- a/pkgs/by-name/wp/wprecon/package.nix
+++ b/pkgs/by-name/wp/wprecon/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "blackbinn";
-    repo = pname;
+    repo = "wprecon";
     rev = version;
     hash = "sha256-23zJD3Nnkeko+J2FjPq5RA5dIjORMXvwt3wtAYiVlQs=";
   };
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   postFixup = ''
     # Rename binary
-    mv $out/bin/cli $out/bin/${pname}
+    mv $out/bin/cli $out/bin/wprecon
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/wr/writefreely/package.nix b/pkgs/by-name/wr/writefreely/package.nix
index f952481f828d..e5349e47276a 100644
--- a/pkgs/by-name/wr/writefreely/package.nix
+++ b/pkgs/by-name/wr/writefreely/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "writefreely";
-    repo = pname;
+    repo = "writefreely";
     rev = "v${version}";
     sha256 = "sha256-Qr31XSbAckLElD81yxD+K7tngWECQ+wyuESC+biAbyw=";
   };
diff --git a/pkgs/by-name/wu/wuzz/package.nix b/pkgs/by-name/wu/wuzz/package.nix
index d67236051250..caf1249bdaf4 100644
--- a/pkgs/by-name/wu/wuzz/package.nix
+++ b/pkgs/by-name/wu/wuzz/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "asciimoo";
-    repo = pname;
+    repo = "wuzz";
     rev = "v${version}";
     sha256 = "sha256-H0soiKOytchfcFx17az0pGoFbA+hhXLxGJVdaARvnDc=";
   };
diff --git a/pkgs/by-name/wx/wxmacmolplt/package.nix b/pkgs/by-name/wx/wxmacmolplt/package.nix
index 6252ff7d5f24..511833221102 100644
--- a/pkgs/by-name/wx/wxmacmolplt/package.nix
+++ b/pkgs/by-name/wx/wxmacmolplt/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "brettbode";
-    repo = pname;
+    repo = "wxmacmolplt";
     rev = "v${version}";
     hash = "sha256-gFGstyq9bMmBaIS4QE6N3EIC9GxRvyJYUr8DUvwRQBc=";
   };
diff --git a/pkgs/by-name/x4/x42-plugins/package.nix b/pkgs/by-name/x4/x42-plugins/package.nix
index d327058c33d1..f235f1babda8 100644
--- a/pkgs/by-name/x4/x42-plugins/package.nix
+++ b/pkgs/by-name/x4/x42-plugins/package.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "x42-plugins";
-  version = "20240611";
+  version = "20250512";
 
   src = fetchurl {
     url = "https://gareus.org/misc/x42-plugins/${pname}-${version}.tar.xz";
-    hash = "sha256-lO6Y1zEGGhv6HIrHmq9b0LA37K3ZzBtC/ERzBsGUZiw=";
+    hash = "sha256-HBENTb1BGxBDIOWtswCe6t0mEzVNZf65NhLjsfE4KYk=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/xa/xannotate/package.nix b/pkgs/by-name/xa/xannotate/package.nix
index 8b580b66ea5e..77ede9d55589 100644
--- a/pkgs/by-name/xa/xannotate/package.nix
+++ b/pkgs/by-name/xa/xannotate/package.nix
@@ -5,13 +5,13 @@
   fetchpatch,
   libX11,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "xannotate";
   version = "20150301";
 
   src = fetchFromBitbucket {
     owner = "blais";
-    repo = pname;
+    repo = "xannotate";
     rev = "e5591c2ec67ca39988f1fb2966e94f0f623f9aa7";
     sha256 = "02jy19if0rnbxvs6b0l5mi9ifvdj2qmv0pv278v9kfs0kvir68ik";
   };
diff --git a/pkgs/by-name/xa/xapp/package.nix b/pkgs/by-name/xa/xapp/package.nix
index 10f411e9409b..5e4ce77f2336 100644
--- a/pkgs/by-name/xa/xapp/package.nix
+++ b/pkgs/by-name/xa/xapp/package.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "linuxmint";
-    repo = pname;
+    repo = "xapp";
     rev = version;
     hash = "sha256-ub5OwtB+LR86gt17342cmgvoWJu2kYzkWhl9V1QVCzQ=";
   };
diff --git a/pkgs/by-name/xb/xbanish/package.nix b/pkgs/by-name/xb/xbanish/package.nix
index 0e6536592b4c..d03b9240967f 100644
--- a/pkgs/by-name/xb/xbanish/package.nix
+++ b/pkgs/by-name/xb/xbanish/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "jcs";
-    repo = pname;
+    repo = "xbanish";
     rev = "v${version}";
     sha256 = "sha256-jwCoJ2shFGuJHhmXmlw/paFpMl5ARD6e5zDnDZHlsoo=";
   };
diff --git a/pkgs/by-name/xc/xc/package.nix b/pkgs/by-name/xc/xc/package.nix
index e369418dc05f..d38e8070f544 100644
--- a/pkgs/by-name/xc/xc/package.nix
+++ b/pkgs/by-name/xc/xc/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "joerdav";
-    repo = pname;
+    repo = "xc";
     tag = "v${version}";
     sha256 = "sha256-eaFHK7VsfLSgSJehv4urxq8qMPT+zzs2tRypz4q+MLc=";
   };
diff --git a/pkgs/by-name/xc/xcaddy/package.nix b/pkgs/by-name/xc/xcaddy/package.nix
index fc21390fcd48..227dfc7905be 100644
--- a/pkgs/by-name/xc/xcaddy/package.nix
+++ b/pkgs/by-name/xc/xcaddy/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "caddyserver";
-    repo = pname;
+    repo = "xcaddy";
     rev = "v${version}";
     hash = "sha256-vpaweUU++3ZHj7KT5WNUCw3X93sQBTgjKlB8rJwrHlM=";
   };
diff --git a/pkgs/by-name/xc/xcat/package.nix b/pkgs/by-name/xc/xcat/package.nix
index fcca8ee73cdd..085b9f874f7b 100644
--- a/pkgs/by-name/xc/xcat/package.nix
+++ b/pkgs/by-name/xc/xcat/package.nix
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "orf";
-    repo = pname;
+    repo = "xcat";
     rev = "v${version}";
     sha256 = "01r5998gdvqjdrahpk0ci27lx9yghbddlanqcspr3qp5y5930i0s";
   };
diff --git a/pkgs/by-name/xc/xcode-install/Gemfile.lock b/pkgs/by-name/xc/xcode-install/Gemfile.lock
index ff44c187b2e2..5a015c6a640a 100644
--- a/pkgs/by-name/xc/xcode-install/Gemfile.lock
+++ b/pkgs/by-name/xc/xcode-install/Gemfile.lock
@@ -11,18 +11,18 @@ GEM
     artifactory (3.0.17)
     atomos (0.1.3)
     aws-eventstream (1.3.2)
-    aws-partitions (1.1075.0)
-    aws-sdk-core (3.221.0)
+    aws-partitions (1.1107.0)
+    aws-sdk-core (3.224.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
       base64
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-kms (1.99.0)
+    aws-sdk-kms (1.101.0)
       aws-sdk-core (~> 3, >= 3.216.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.182.0)
+    aws-sdk-s3 (1.186.1)
       aws-sdk-core (~> 3, >= 3.216.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
@@ -71,7 +71,7 @@ GEM
     faraday_middleware (1.2.1)
       faraday (~> 1.0)
     fastimage (2.4.0)
-    fastlane (2.227.0)
+    fastlane (2.227.2)
       CFPropertyList (>= 2.3, < 4.0.0)
       addressable (>= 2.8, < 3.0.0)
       artifactory (~> 3.0)
@@ -111,7 +111,7 @@ GEM
       tty-spinner (>= 0.8.0, < 1.0.0)
       word_wrap (~> 1.0.0)
       xcodeproj (>= 1.13.0, < 2.0.0)
-      xcpretty (~> 0.4.0)
+      xcpretty (~> 0.4.1)
       xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
     fastlane-sirp (1.0.0)
       sysrandom (~> 1.0)
@@ -158,7 +158,7 @@ GEM
     httpclient (2.9.0)
       mutex_m
     jmespath (1.6.2)
-    json (2.10.2)
+    json (2.12.2)
     jwt (2.10.1)
       base64
     logger (1.7.0)
@@ -173,7 +173,7 @@ GEM
     optparse (0.6.0)
     os (1.1.4)
     plist (3.7.2)
-    public_suffix (6.0.1)
+    public_suffix (6.0.2)
     rake (13.2.1)
     representable (3.2.0)
       declarative (< 0.1.0)
@@ -185,7 +185,7 @@ GEM
     ruby2_keywords (0.0.5)
     rubyzip (2.4.1)
     security (0.1.5)
-    signet (0.19.0)
+    signet (0.20.0)
       addressable (~> 2.8)
       faraday (>= 0.17.5, < 3.a)
       jwt (>= 1.5, < 3.0)
@@ -228,4 +228,4 @@ DEPENDENCIES
   xcode-install
 
 BUNDLED WITH
-   2.6.2
+   2.6.6
diff --git a/pkgs/by-name/xc/xcode-install/gemset.nix b/pkgs/by-name/xc/xcode-install/gemset.nix
index 3b1531131812..2284c96f5556 100644
--- a/pkgs/by-name/xc/xcode-install/gemset.nix
+++ b/pkgs/by-name/xc/xcode-install/gemset.nix
@@ -55,10 +55,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1jb72jj18a9l98ghmi8ny9nys4w3hcny0xyi0dzl3ms0knsrrn3i";
+      sha256 = "0h25l48fy06yba48ymsflda93yclk0335kdcnf74f5axsah84qfn";
       type = "gem";
     };
-    version = "1.1075.0";
+    version = "1.1107.0";
   };
   aws-sdk-core = {
     dependencies = [
@@ -73,10 +73,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jmd8rf68jf99ksklwaflym07issvr1il1qpzmpaf59avhcxgjjy";
+      sha256 = "1b0pi1iibp644dn78g53s7hs7gcxghfa7h8rz3lvz8ivykisl5y6";
       type = "gem";
     };
-    version = "3.221.0";
+    version = "3.224.0";
   };
   aws-sdk-kms = {
     dependencies = [
@@ -87,10 +87,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a3mh89kfh6flqxw48wfv9wfwkj2zxazw096mqm56wnnzz1jyads";
+      sha256 = "1mv8jc8sbvim2m3y3zxm8z4i5sh4x9ds7y9h5z04qfg7kjvbbn24";
       type = "gem";
     };
-    version = "1.99.0";
+    version = "1.101.0";
   };
   aws-sdk-s3 = {
     dependencies = [
@@ -102,10 +102,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "03a55dbihv6xvgfwhx0f35rwc7q3rr0555vfpxlwpdjw75wkbz6h";
+      sha256 = "00sq22mfibxq3rjy9c4vj1s8yjszv8988di7z7rs8v62my53nw2v";
       type = "gem";
     };
-    version = "1.182.0";
+    version = "1.186.1";
   };
   aws-sigv4 = {
     dependencies = [ "aws-eventstream" ];
@@ -461,10 +461,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12lqn70c3v5h2z2svn1gickyhkhny6rwnm2xfrs3gmjc6pvfrqhb";
+      sha256 = "1dw9smmpzhlca2zzp2pgmr2slhwnz8926s5rnjfjrclilz33p22z";
       type = "gem";
     };
-    version = "2.227.0";
+    version = "2.227.2";
   };
   fastlane-sirp = {
     dependencies = [ "sysrandom" ];
@@ -668,10 +668,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01lbdaizhkxmrw4y8j3wpvsryvnvzmg0pfs56c52laq2jgdfmq1l";
+      sha256 = "1x5b8ipv6g0z44wgc45039k04smsyf95h2m5m67mqq35sa5a955s";
       type = "gem";
     };
-    version = "2.10.2";
+    version = "2.12.2";
   };
   jwt = {
     dependencies = [ "base64" ];
@@ -809,10 +809,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0vqcw3iwby3yc6avs1vb3gfd0vcp2v7q310665dvxfswmcf4xm31";
+      sha256 = "1543ap9w3ydhx39ljcd675cdz9cr948x9mp00ab8qvq6118wv9xz";
       type = "gem";
     };
-    version = "6.0.1";
+    version = "6.0.2";
   };
   rake = {
     groups = [ "default" ];
@@ -910,10 +910,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0cfxa11wy1nv9slmnzjczkdgld0gqizajsb03rliy53zylwkjzsk";
+      sha256 = "18s7xiclzajp9w9cmq8k28iy5ig1zpx1zv1mrm416cb2c0m0wrmw";
       type = "gem";
     };
-    version = "0.19.0";
+    version = "0.20.0";
   };
   simctl = {
     dependencies = [
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-wlr/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-wlr/package.nix
index 0151ea6ed1cb..6dfac779d3c7 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-wlr/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-wlr/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "emersion";
-    repo = pname;
+    repo = "xdg-desktop-portal-wlr";
     rev = "v${version}";
     sha256 = "sha256-GIIDeZMIGUiZV0IUhcclRVThE5LKaqVc5VwnNT8beNU=";
   };
diff --git a/pkgs/by-name/xd/xdgmenumaker/package.nix b/pkgs/by-name/xd/xdgmenumaker/package.nix
index d52029b89ee3..aa473a6afd84 100644
--- a/pkgs/by-name/xd/xdgmenumaker/package.nix
+++ b/pkgs/by-name/xd/xdgmenumaker/package.nix
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "gapan";
-    repo = pname;
+    repo = "xdgmenumaker";
     rev = version;
     sha256 = "rh1rRgbw8uqii4oN3XXNNKsWam1d8TY0qGceHERlG1k=";
   };
diff --git a/pkgs/by-name/xd/xdp-tools/emacs-30.patch b/pkgs/by-name/xd/xdp-tools/emacs-30.patch
deleted file mode 100644
index f95f301372a9..000000000000
--- a/pkgs/by-name/xd/xdp-tools/emacs-30.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/configure b/configure
-index 271c370..33aabfa 100755
---- a/configure
-+++ b/configure
-@@ -97,7 +97,7 @@ check_toolchain()
-         EMACS=""
-     else
-         emacs_version=$($EMACS --version 2>/dev/null | head -n 1)
--        if echo $emacs_version | grep -Eq 'GNU Emacs 2[6789]'; then
-+        if echo $emacs_version | grep -Eq 'GNU Emacs (2[6789]|30)'; then
-             echo "using emacs: $emacs_version"
-         else
-             echo "not using emacs: $emacs_version"
diff --git a/pkgs/by-name/xd/xdp-tools/package.nix b/pkgs/by-name/xd/xdp-tools/package.nix
index 7b6a0fd9606a..5fef58f3756d 100644
--- a/pkgs/by-name/xd/xdp-tools/package.nix
+++ b/pkgs/by-name/xd/xdp-tools/package.nix
@@ -16,22 +16,15 @@
 }:
 stdenv.mkDerivation rec {
   pname = "xdp-tools";
-  version = "1.5.2";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "xdp-project";
     repo = "xdp-tools";
     rev = "v${version}";
-    hash = "sha256-NJawacCrmTuRXsOiAOMD8RaljPnuPFISoWEgiDcInw8=";
+    hash = "sha256-dK+ZpD1wv20iU51dsMUiW/Z9jojuwC8P3rrjU3LEB1Y=";
   };
 
-  patches = [
-    # Allow building with emacs 30
-    # Submitted upstream: https://github.com/xdp-project/xdp-tools/pull/484
-    # FIXME: remove when merged
-    ./emacs-30.patch
-  ];
-
   outputs = [
     "out"
     "lib"
diff --git a/pkgs/by-name/xe/xenomapper/package.nix b/pkgs/by-name/xe/xenomapper/package.nix
index 212b5c7ef9dd..1f101fa06e47 100644
--- a/pkgs/by-name/xe/xenomapper/package.nix
+++ b/pkgs/by-name/xe/xenomapper/package.nix
@@ -10,7 +10,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "genomematt";
-    repo = pname;
+    repo = "xenomapper";
     rev = "v${version}";
     sha256 = "0mnmfzlq5mhih6z8dq5bkx95vb8whjycz9mdlqwbmlqjb3gb3zhr";
   };
diff --git a/pkgs/by-name/xk/xkeysnail/package.nix b/pkgs/by-name/xk/xkeysnail/package.nix
index 4ebbfe05edd7..ebc5dc9799f0 100644
--- a/pkgs/by-name/xk/xkeysnail/package.nix
+++ b/pkgs/by-name/xk/xkeysnail/package.nix
@@ -5,13 +5,13 @@
   fetchpatch,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "xkeysnail";
   version = "0.4";
 
   src = fetchFromGitHub {
     owner = "mooz";
-    repo = pname;
+    repo = "xkeysnail";
     rev = "bf3c93b4fe6efd42893db4e6588e5ef1c4909cfb";
     hash = "sha256-12AkB6Zb1g9hY6mcphO8HlquxXigiiFhadr9Zsm6jF4=";
   };
diff --git a/pkgs/by-name/xm/xmoto/package.nix b/pkgs/by-name/xm/xmoto/package.nix
index a25518bc2507..bf82cb08c9d4 100644
--- a/pkgs/by-name/xm/xmoto/package.nix
+++ b/pkgs/by-name/xm/xmoto/package.nix
@@ -30,8 +30,8 @@ stdenv.mkDerivation rec {
   version = "0.6.3";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "xmoto";
+    repo = "xmoto";
     rev = "v${version}";
     hash = "sha256-DNljUd7FSH0fTgQx8LMqItZ54aLZtwMUPzqR8Z820SM=";
   };
diff --git a/pkgs/by-name/xo/xortool/package.nix b/pkgs/by-name/xo/xortool/package.nix
index bd1caf0e4185..b570a909e5f0 100644
--- a/pkgs/by-name/xo/xortool/package.nix
+++ b/pkgs/by-name/xo/xortool/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "xortool";
-  version = "1.0.0";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hellman";
     repo = "xortool";
     tag = "v${version}";
-    hash = "sha256-xxaWhGUh/r34eS2TJt8c3Q795OsZOoQLXQllJGJTjqY=";
+    hash = "sha256-KakpXRhBVgUtIiqqvq30u7sIIeXe9vr5aqndOb0cR64=";
   };
 
   build-system = with python3Packages; [ poetry-core ];
diff --git a/pkgs/by-name/xo/xow_dongle-firmware/package.nix b/pkgs/by-name/xo/xow_dongle-firmware/package.nix
index a91702950a59..e0cd58af0470 100644
--- a/pkgs/by-name/xo/xow_dongle-firmware/package.nix
+++ b/pkgs/by-name/xo/xow_dongle-firmware/package.nix
@@ -4,36 +4,53 @@
   fetchurl,
   cabextract,
 }:
-
 stdenvNoCC.mkDerivation rec {
   pname = "xow_dongle-firmware";
-  version = "2017-07";
+  version = "0-unstable-2025-04-22";
+
+  srcs = [
+    (fetchurl {
+      name = "xow_dongle.cab";
+      url = "http://download.windowsupdate.com/c/msdownload/update/driver/drvs/2017/07/1cd6a87c-623f-4407-a52d-c31be49e925c_e19f60808bdcbfbd3c3df6be3e71ffc52e43261e.cab";
+      hash = "sha256-ZXNqhP9ANmRbj47GAr7ZGrY1MBnJyzIz3sq5/uwPbwQ=";
+    })
+    (fetchurl {
+      name = "xow_dongle_045e_02e6.cab";
+      url = "https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2015/12/20810869_8ce2975a7fbaa06bcfb0d8762a6275a1cf7c1dd3.cab";
+      hash = "sha256-5jiKJ6dXVpIN5zryRo461V16/vWavDoLUICU4JHRnwg=";
+    })
+  ];
+
+  sourceRoot = ".";
 
   dontConfigure = true;
   dontBuild = true;
 
-  src = fetchurl {
-    url = "http://download.windowsupdate.com/c/msdownload/update/driver/drvs/2017/07/1cd6a87c-623f-4407-a52d-c31be49e925c_e19f60808bdcbfbd3c3df6be3e71ffc52e43261e.cab";
-    sha256 = "013g1zngxffavqrk5jy934q3bdhsv6z05ilfixdn8dj0zy26lwv5";
-  };
-
   nativeBuildInputs = [ cabextract ];
 
-  sourceRoot = ".";
+  unpackPhase = ''
+    sources=($srcs)
 
-  unpackCmd = ''
-    cabextract -F FW_ACC_00U.bin ${src}
+    cabextract -F FW_ACC_00U.bin ''${sources[0]}
+    mv FW_ACC_00U.bin xow_dongle.bin
+
+    cabextract -F FW_ACC_00U.bin ''${sources[1]}
+    mv FW_ACC_00U.bin xow_dongle_045e_02e6.bin
   '';
 
   installPhase = ''
-    install -Dm644 FW_ACC_00U.bin ${placeholder "out"}/lib/firmware/xow_dongle.bin
+    install -Dm644 xow_dongle.bin $out/lib/firmware/xow_dongle.bin
+    install -Dm644 xow_dongle_045e_02e6.bin $out/lib/firmware/xow_dongle_045e_02e6.bin
   '';
 
   meta = with lib; {
     description = "Xbox One wireless dongle firmware";
     homepage = "https://www.xbox.com/en-NZ/accessories/adapters/wireless-adapter-windows";
     license = licenses.unfree;
-    maintainers = with lib.maintainers; [ rhysmdnz ];
+    maintainers = with maintainers; [
+      rhysmdnz
+      fazzi
+    ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/by-name/xp/xpano/package.nix b/pkgs/by-name/xp/xpano/package.nix
index da0ef84d8a93..423d2cd20a87 100644
--- a/pkgs/by-name/xp/xpano/package.nix
+++ b/pkgs/by-name/xp/xpano/package.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "krupkat";
-    repo = pname;
+    repo = "xpano";
     rev = "v${version}";
     sha256 = "sha256-f2qoBpZ5lPBocPas8KMsY5bSYL20gO+ZHLz2R66qSig=";
     fetchSubmodules = true;
diff --git a/pkgs/by-name/xp/xpaste/package.nix b/pkgs/by-name/xp/xpaste/package.nix
index cec48ddd9d2b..2e1050ec8db6 100644
--- a/pkgs/by-name/xp/xpaste/package.nix
+++ b/pkgs/by-name/xp/xpaste/package.nix
@@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "ossobv";
-    repo = pname;
+    repo = "xpaste";
     tag = "v${version}";
     hash = "sha256-eVnoLG+06UTOkvGhzL/XS4JBrEwbXYZ1fuNTIW7YAfE=";
   };
diff --git a/pkgs/by-name/xp/xpipe/package.nix b/pkgs/by-name/xp/xpipe/package.nix
index 073fda85e381..67c153fb2983 100644
--- a/pkgs/by-name/xp/xpipe/package.nix
+++ b/pkgs/by-name/xp/xpipe/package.nix
@@ -39,7 +39,7 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-u2T2pKO+rOs29Un8dKc+sUqBJiruu6GS6wzrJhKKW9Y=";
+      x86_64-linux = "sha256-Ma2WWknZ0rF9NZNqOaPyQ2eil34HWmgSIHMnfaSaFjs=";
     }
     .${system} or throwSystem;
 
@@ -48,7 +48,7 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "xpipe";
-  version = "14.2";
+  version = "16.4.1";
 
   src = fetchzip {
     url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";
@@ -90,7 +90,7 @@ stdenvNoCC.mkDerivation rec {
     categories = [ "Network" ];
     comment = "Your entire server infrastructure at your fingertips";
     desktopName = displayname;
-    exec = "/opt/${pname}/cli/bin/xpipe open %U";
+    exec = "/opt/${pname}/bin/xpipe open %U";
     genericName = "Shell connection hub";
     icon = "/opt/${pname}/logo.png";
     name = displayname;
@@ -104,22 +104,19 @@ stdenvNoCC.mkDerivation rec {
     cp -r ./ $out/opt/$pkg
 
     mkdir -p "$out/bin"
-    ln -s "$out/opt/$pkg/cli/bin/xpipe" "$out/bin/$pkg"
+    ln -s "$out/opt/$pkg/bin/xpipe" "$out/bin/$pkg"
 
     mkdir -p "$out/share/applications"
     cp -r "${desktopItem}/share/applications/" "$out/share/"
 
-    mkdir -p "$out/etc/bash_completion.d"
-    ln -s "$out/opt/$pkg/cli/xpipe_completion" "$out/etc/bash_completion.d/$pkg"
-
     substituteInPlace "$out/share/applications/${displayname}.desktop" --replace "Exec=" "Exec=$out"
     substituteInPlace "$out/share/applications/${displayname}.desktop" --replace "Icon=" "Icon=$out"
 
-    mv "$out/opt/$pkg/app/bin/xpiped" "$out/opt/$pkg/app/bin/xpiped_raw"
-    mv "$out/opt/$pkg/app/lib/app/xpiped.cfg" "$out/opt/$pkg/app/lib/app/xpiped_raw.cfg"
-    mv "$out/opt/$pkg/app/scripts/xpiped_debug.sh" "$out/opt/$pkg/app/scripts/xpiped_debug_raw.sh"
+    mv "$out/opt/$pkg/bin/xpiped" "$out/opt/$pkg/bin/xpiped_raw"
+    mv "$out/opt/$pkg/lib/app/xpiped.cfg" "$out/opt/$pkg/lib/app/xpiped_raw.cfg"
+    mv "$out/opt/$pkg/scripts/xpiped_debug.sh" "$out/opt/$pkg/scripts/xpiped_debug_raw.sh"
 
-    makeShellWrapper "$out/opt/$pkg/app/bin/xpiped_raw" "$out/opt/$pkg/app/bin/xpiped" \
+    makeShellWrapper "$out/opt/$pkg/bin/xpiped_raw" "$out/opt/$pkg/bin/xpiped" \
       --prefix LD_LIBRARY_PATH : "${
         lib.makeLibraryPath [
           fontconfig
@@ -129,7 +126,8 @@ stdenvNoCC.mkDerivation rec {
           socat
         ]
       }"
-    makeShellWrapper "$out/opt/$pkg/app/scripts/xpiped_debug_raw.sh" "$out/opt/$pkg/app/scripts/xpiped_debug.sh" \
+
+    makeShellWrapper "$out/opt/$pkg/scripts/xpiped_debug_raw.sh" "$out/opt/$pkg/scripts/xpiped_debug.sh" \
       --prefix LD_LIBRARY_PATH : "${
         lib.makeLibraryPath [
           fontconfig
diff --git a/pkgs/by-name/xp/xplorer/package.nix b/pkgs/by-name/xp/xplorer/package.nix
index 59e50baec034..ea5babaf73ab 100644
--- a/pkgs/by-name/xp/xplorer/package.nix
+++ b/pkgs/by-name/xp/xplorer/package.nix
@@ -24,7 +24,7 @@ let
 
   src = fetchFromGitHub {
     owner = "kimlimjustin";
-    repo = pname;
+    repo = "xplorer";
     rev = "8d69a281cbceda277958796cb6b77669fb062ee3";
     sha256 = "sha256-VFRdkSfe2mERaYYtZlg9dvH1loGWVBGwiTRj4AoNEAo=";
   };
diff --git a/pkgs/by-name/xp/xplr/package.nix b/pkgs/by-name/xp/xplr/package.nix
index b099994eaae1..dcd7d0b1f12a 100644
--- a/pkgs/by-name/xp/xplr/package.nix
+++ b/pkgs/by-name/xp/xplr/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "sayanarijit";
-    repo = pname;
+    repo = "xplr";
     rev = "v${version}";
     hash = "sha256-QeR7KXwRGfAU31ueI6v26pKnoQdj2C7bXlcMP4qKvZg=";
   };
diff --git a/pkgs/by-name/xr/xrdp/package.nix b/pkgs/by-name/xr/xrdp/package.nix
index 69e8592aa7dd..b48f43dbb2b7 100644
--- a/pkgs/by-name/xr/xrdp/package.nix
+++ b/pkgs/by-name/xr/xrdp/package.nix
@@ -12,7 +12,7 @@
   openssl,
   systemd,
   pam,
-  fuse,
+  fuse3,
   libdrm,
   libjpeg,
   libopus,
@@ -29,13 +29,13 @@
 let
   xorgxrdp = stdenv.mkDerivation rec {
     pname = "xorgxrdp";
-    version = "0.10.2";
+    version = "0.10.4";
 
     src = fetchFromGitHub {
       owner = "neutrinolabs";
       repo = "xorgxrdp";
       rev = "v${version}";
-      hash = "sha256-xwkGY9dD747kyTvoXrYAIoiFBzQe5ngskUYQhDawnbU=";
+      hash = "sha256-TuzUerfOn8+3YfueG00IBP9sMpvy2deyL16mWQ8cRHg=";
     };
 
     nativeBuildInputs = [
@@ -74,7 +74,7 @@ let
 
   xrdp = stdenv.mkDerivation rec {
     pname = "xrdp";
-    version = "0.10.1";
+    version = "0.10.3";
 
     src = applyPatches {
       inherit version;
@@ -85,7 +85,7 @@ let
         repo = "xrdp";
         rev = "v${version}";
         fetchSubmodules = true;
-        hash = "sha256-lqifQJ/JX+0304arVctsEBEDFPhEPn2OWLyjAQW1who=";
+        hash = "sha256-6QSz0a0ed1UxfYYibehPgGUzU/xf1HmqEvVE4xU5hRg=";
       };
     };
 
@@ -100,7 +100,7 @@ let
     ];
 
     buildInputs = [
-      fuse
+      fuse3
       lame
       libjpeg
       libjpeg_turbo
diff --git a/pkgs/by-name/xr/xreader/package.nix b/pkgs/by-name/xr/xreader/package.nix
index bd3bdfacf302..b0061d28a50c 100644
--- a/pkgs/by-name/xr/xreader/package.nix
+++ b/pkgs/by-name/xr/xreader/package.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "linuxmint";
-    repo = pname;
+    repo = "xreader";
     rev = version;
     hash = "sha256-ELqO8pYMWgU6DUS5vg+F+xFp3w3H6u0Jzms3xaNlTqE=";
   };
diff --git a/pkgs/by-name/xv/xviewer/package.nix b/pkgs/by-name/xv/xviewer/package.nix
index d71f276fbf5b..a32350065a4b 100644
--- a/pkgs/by-name/xv/xviewer/package.nix
+++ b/pkgs/by-name/xv/xviewer/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "linuxmint";
-    repo = pname;
+    repo = "xviewer";
     rev = version;
     hash = "sha256-Wn1a/tGNIJNGbgDKoMMMo/oCXrqCXDM1nTUgCZt0O/U=";
   };
diff --git a/pkgs/by-name/xx/xxh/package.nix b/pkgs/by-name/xx/xxh/package.nix
index 1892af6abf80..ff85fc04f267 100644
--- a/pkgs/by-name/xx/xxh/package.nix
+++ b/pkgs/by-name/xx/xxh/package.nix
@@ -12,8 +12,8 @@ python3.pkgs.buildPythonApplication rec {
   disabled = python3.pkgs.pythonOlder "3.6";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "xxh";
+    repo = "xxh";
     tag = version;
     hash = "sha256-Y1yTn0lZemQgWsW9wlW+aNndyTXGo46PCbCl0TGYspQ=";
   };
diff --git a/pkgs/by-name/ya/yai/package.nix b/pkgs/by-name/ya/yai/package.nix
index cad6fe75f8be..68934039ec64 100644
--- a/pkgs/by-name/ya/yai/package.nix
+++ b/pkgs/by-name/ya/yai/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "ekkinox";
-    repo = pname;
+    repo = "yai";
     rev = version;
     sha256 = "sha256-MoblXLfptlIYJbXQTpbc8GBo2a3Zgxdvwra8IUEGiZs==";
   };
diff --git a/pkgs/by-name/ya/yamlpath/package.nix b/pkgs/by-name/ya/yamlpath/package.nix
index a40cfbaa7318..9f5fa770d681 100644
--- a/pkgs/by-name/ya/yamlpath/package.nix
+++ b/pkgs/by-name/ya/yamlpath/package.nix
@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "wwkimball";
-    repo = pname;
+    repo = "yamlpath";
     tag = "v${version}";
     sha256 = "sha256-6N2s/LWFa3mgMQ88rt3IaWk+b2PTWfT7z1mi+ioQEyU=";
   };
diff --git a/pkgs/by-name/ya/yandex-cloud/sources.json b/pkgs/by-name/ya/yandex-cloud/sources.json
index 1a6cb940358b..4b2a80b9da4b 100644
--- a/pkgs/by-name/ya/yandex-cloud/sources.json
+++ b/pkgs/by-name/ya/yandex-cloud/sources.json
@@ -1,25 +1,25 @@
 {
-  "version": "0.148.0",
+  "version": "0.149.0",
   "binaries": {
     "aarch64-darwin": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.148.0/darwin/arm64/yc",
-      "hash": "sha256-wFc3/ikLFO8JEE5lTEU4z+KR8aKSs9qjuDVAGQefoFA="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.149.0/darwin/arm64/yc",
+      "hash": "sha256-9mxc0E0pZlX/kM6Lm9CZcVyR3ih8oNZwicaEYrGVLWY="
     },
     "aarch64-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.148.0/linux/arm64/yc",
-      "hash": "sha256-8yt8BHGg52kXdwLMYtnwNqeozvkwKFJnLAnkvhaocFk="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.149.0/linux/arm64/yc",
+      "hash": "sha256-oDcBQq3bqRfAKRltpMoxI/tXHOzdmcGOY8Du/VkvVYs="
     },
     "i686-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.148.0/linux/386/yc",
-      "hash": "sha256-A+BM2evI7FN0IxUMh9KOUlaAyCSFBOg9n++GcHBq1aU="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.149.0/linux/386/yc",
+      "hash": "sha256-09MR0gx3UBox4Ue1649WpdOxY+hTnchHD1v3PeFdMBs="
     },
     "x86_64-darwin": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.148.0/darwin/amd64/yc",
-      "hash": "sha256-3vmbRJm/L9LVjle5gfRG/uLEfvDhhz3gXN/NaOxSKD8="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.149.0/darwin/amd64/yc",
+      "hash": "sha256-7AhcJKYeVxpJNEl8dEvjVcFR/6aJtqqKRCDv8inyKM8="
     },
     "x86_64-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.148.0/linux/amd64/yc",
-      "hash": "sha256-XlKnb0RtSu/f5UUnepHfp9UnQhCfI+SaJePQ6pOFeJg="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.149.0/linux/amd64/yc",
+      "hash": "sha256-vsxxGgqpewpQhUt3eMs6zOWKXgO0nTDOBB0ODfGDWNM="
     }
   }
 }
diff --git a/pkgs/by-name/ya/yaru-remix-theme/package.nix b/pkgs/by-name/ya/yaru-remix-theme/package.nix
index 281ada4dac35..532c15f79864 100644
--- a/pkgs/by-name/ya/yaru-remix-theme/package.nix
+++ b/pkgs/by-name/ya/yaru-remix-theme/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "Muqtxdir";
-    repo = pname;
+    repo = "yaru-remix";
     rev = "v${version}";
     sha256 = "0xilhw5gbxsyy80ixxgj0nw6w782lz9dsinhi24026li1xny804c";
   };
diff --git a/pkgs/by-name/ya/yaws/package.nix b/pkgs/by-name/ya/yaws/package.nix
index db34b0e92014..3be0ebbbeb1a 100644
--- a/pkgs/by-name/ya/yaws/package.nix
+++ b/pkgs/by-name/ya/yaws/package.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "erlyaws";
-    repo = pname;
-    rev = "${pname}-${version}";
+    repo = "yaws";
+    rev = "yaws-${version}";
     hash = "sha256-acO8Vc8sZJl22HUml2kTxVswLEirqMbqHQdRIbkkcvs=";
   };
 
diff --git a/pkgs/by-name/ya/yaydl/package.nix b/pkgs/by-name/ya/yaydl/package.nix
index 8ad5b99c893f..7ce1a4e313db 100644
--- a/pkgs/by-name/ya/yaydl/package.nix
+++ b/pkgs/by-name/ya/yaydl/package.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "dertuxmalwieder";
-    repo = pname;
+    repo = "yaydl";
     rev = "release-${version}";
     sha256 = "sha256-r+UkwEtuGL6los9ohv86KA/3qsaEkpnI4yV/UnYelgk=";
   };
diff --git a/pkgs/by-name/ya/yazi-unwrapped/package.nix b/pkgs/by-name/ya/yazi-unwrapped/package.nix
index 6b5a3a724f28..25f0becdca75 100644
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@@ -8,18 +8,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yazi";
-  version = "25.4.8";
+  version = "25.5.28";
 
   srcs = builtins.attrValues finalAttrs.passthru.srcs;
 
   sourceRoot = finalAttrs.passthru.srcs.code_src.name;
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-RqAolwIQqJQo9cVZ1uA0D+6yAmQKN2a7Uk3f4b/FjHU=";
+  cargoHash = "sha256-g+6RawDZsgYnXiybhaiosOfz/k4LHe5iX+VqHikfPzM=";
 
   env.YAZI_GEN_COMPLETIONS = true;
   env.VERGEN_GIT_SHA = "Nixpkgs";
-  env.VERGEN_BUILD_DATE = "2025-04-08";
+  env.VERGEN_BUILD_DATE = "2025-05-28";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];
@@ -42,7 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       owner = "sxyazi";
       repo = "yazi";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-oxO7nT4AZJilxA2DliYk57NETHu78xQ8nFdV+UwyKHE=";
+      hash = "sha256-z+dh1lO6lvStlv58mi5T/cxYdewo2+5bRSO7naVcHMs=";
     };
 
     man_src = fetchFromGitHub {
diff --git a/pkgs/by-name/ya/yazi/plugins/nord/default.nix b/pkgs/by-name/ya/yazi/plugins/nord/default.nix
index 5bb867500c5e..57d4b6e5d012 100644
--- a/pkgs/by-name/ya/yazi/plugins/nord/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/nord/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "nord.yazi";
-  version = "0-unstable-2025-05-14";
+  version = "0-unstable-2025-05-20";
 
   src = fetchFromGitHub {
     owner = "stepbrobd";
     repo = "nord.yazi";
-    rev = "0f8eff4367021be1b741391d98853fbd1a34baf9";
-    hash = "sha256-bcYIbKFU1bvGRS6lgEBMe2jT13bECYgQATuh3QKmhQE=";
+    rev = "c9a58b4361ac82d5ddc91e6e27b620bb096d0bee";
+    hash = "sha256-yjxdoZlOPFliNbp+SwNFd+PPWlD7j8edXC8urQo7WZA=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ye/yeetgif/package.nix b/pkgs/by-name/ye/yeetgif/package.nix
index 42395ceaa54d..9cc57cdcaa11 100644
--- a/pkgs/by-name/ye/yeetgif/package.nix
+++ b/pkgs/by-name/ye/yeetgif/package.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "sgreben";
-    repo = pname;
+    repo = "yeetgif";
     rev = version;
     hash = "sha256-Z05GhtEPj3PLXpjF1wK8+pNUY3oDjbwZWQsYlTX14Rc=";
   };
diff --git a/pkgs/by-name/yo/yor/package.nix b/pkgs/by-name/yo/yor/package.nix
index 4c6e20ec6116..84f5eb42427b 100644
--- a/pkgs/by-name/yo/yor/package.nix
+++ b/pkgs/by-name/yo/yor/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
-    repo = pname;
+    repo = "yor";
     rev = version;
     hash = "sha256-IoQe1/D3Sl1y76dXH0CuwU6/LBC6n6or9vsysHhDeeg=";
   };
diff --git a/pkgs/by-name/yt/ytdl-sub/package.nix b/pkgs/by-name/yt/ytdl-sub/package.nix
index 98abd0cd17e3..ab07b43ded8f 100644
--- a/pkgs/by-name/yt/ytdl-sub/package.nix
+++ b/pkgs/by-name/yt/ytdl-sub/package.nix
@@ -8,14 +8,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "ytdl-sub";
-  version = "2025.05.05";
+  version = "2025.05.23";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jmbannon";
     repo = "ytdl-sub";
     tag = version;
-    hash = "sha256-zLYP3iGbTcWuffed7o5RuoYjlUvVFRt8FUOhL1vbW/U=";
+    hash = "sha256-296lizseyBJdpu80MnquPB1ldGgpAcey3iDwiaLqpOQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/yu/yubico-pam/package.nix b/pkgs/by-name/yu/yubico-pam/package.nix
index 1b3b79256ed1..482b27fdebe9 100644
--- a/pkgs/by-name/yu/yubico-pam/package.nix
+++ b/pkgs/by-name/yu/yubico-pam/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   version = "2.27";
   src = fetchFromGitHub {
     owner = "Yubico";
-    repo = pname;
+    repo = "yubico-pam";
     rev = version;
     sha256 = "0hb773zlf11xz4bwmsqv2mq5d4aq2g0crdr5cp9xwc4ivi5gd4kg";
   };
diff --git a/pkgs/by-name/za/zabbixctl/package.nix b/pkgs/by-name/za/zabbixctl/package.nix
index 4fdca75b17d2..a5679fe68c15 100644
--- a/pkgs/by-name/za/zabbixctl/package.nix
+++ b/pkgs/by-name/za/zabbixctl/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "zabbixctl";
   version = "unstable-2021-05-25";
 
   src = fetchFromGitHub {
     owner = "kovetskiy";
-    repo = pname;
+    repo = "zabbixctl";
     rev = "872d73b12901b143898bffe3711b93a34ca75abe";
     sha256 = "sha256-fWT3cgIHjHcKwFDjWIf3BUUUaVZ7hyc2ibkpU+AsW0I=";
   };
diff --git a/pkgs/by-name/zd/zdns/package.nix b/pkgs/by-name/zd/zdns/package.nix
index 5a8907fca38c..39e72d1fe71f 100644
--- a/pkgs/by-name/zd/zdns/package.nix
+++ b/pkgs/by-name/zd/zdns/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "zmap";
-    repo = pname;
+    repo = "zdns";
     tag = "v${version}";
     hash = "sha256-jnrewp0wXaRFVBY6Wo9JHGDnDxzQFOhh3JoLqxRicew=";
   };
diff --git a/pkgs/by-name/ze/zed-editor/0001-linux-linker.patch b/pkgs/by-name/ze/zed-editor/0001-linux-linker.patch
index 4529e038dc2f..5deef7339a72 100644
--- a/pkgs/by-name/ze/zed-editor/0001-linux-linker.patch
+++ b/pkgs/by-name/ze/zed-editor/0001-linux-linker.patch
@@ -1,5 +1,5 @@
 diff --git a/.cargo/config.toml b/.cargo/config.toml
-index 07cbc23195..b3c4d43e0f 100644
+index 717c5e1..0bb7b6c 100644
 --- a/.cargo/config.toml
 +++ b/.cargo/config.toml
 @@ -5,14 +5,6 @@ rustflags = ["-C", "symbol-mangling-version=v0", "--cfg", "tokio_unstable"]
@@ -14,6 +14,6 @@ index 07cbc23195..b3c4d43e0f 100644
 -linker = "clang"
 -rustflags = ["-C", "link-arg=-fuse-ld=mold"]
 -
- [target.aarch64-apple-darwin]
- rustflags = ["-C", "link-args=-Objc -all_load"]
- 
+ [target.'cfg(target_os = "windows")']
+ rustflags = [
+     "--cfg",
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 71171c8a6106..1730a70423c0 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -99,7 +99,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.187.6";
+  version = "0.188.3";
 
   outputs =
     [ "out" ]
@@ -111,7 +111,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aib6RJPkNQQmK+zVfNvf/LwfKuloj6xHN4tT8p0yPZo=";
+    hash = "sha256-ZyKFzb6/kVw/uLTmhnyrwmgyTHTwgu/WbOga409eZvg=";
   };
 
   patches = [
@@ -138,7 +138,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-fIOgakr2Wni8BJB7VD63worcHEwnL0WKI88kjJ4YTMg=";
+  cargoHash = "sha256-0Nwdw20YdezGvUCkFw6ZV55qsebIhtnIoPoHd4tgIyA=";
 
   nativeBuildInputs =
     [
diff --git a/pkgs/by-name/ze/zed/package.nix b/pkgs/by-name/ze/zed/package.nix
index 3f49bdec0d5b..72db6bcb5d4c 100644
--- a/pkgs/by-name/ze/zed/package.nix
+++ b/pkgs/by-name/ze/zed/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "brimdata";
-    repo = pname;
+    repo = "zed";
     rev = "v${version}";
     sha256 = "sha256-NCoeTeOkxkCsj/nRBhMJeEshFuwozOXNJvgp8vyCQDk=";
   };
diff --git a/pkgs/by-name/zf/zfs-prune-snapshots/package.nix b/pkgs/by-name/zf/zfs-prune-snapshots/package.nix
index a272cb93cdb8..db28a89c6fc3 100644
--- a/pkgs/by-name/zf/zfs-prune-snapshots/package.nix
+++ b/pkgs/by-name/zf/zfs-prune-snapshots/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "bahamas10";
-    repo = pname;
+    repo = "zfs-prune-snapshots";
     rev = "v${version}";
     sha256 = "sha256-gCf/ZIeIh84WQNs5wZO1/l3zpnl2sNxsFO7cOa92JUM=";
   };
diff --git a/pkgs/by-name/zg/zgrab2/package.nix b/pkgs/by-name/zg/zgrab2/package.nix
index 9651c9ee54fa..c0c510ec5f14 100644
--- a/pkgs/by-name/zg/zgrab2/package.nix
+++ b/pkgs/by-name/zg/zgrab2/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule {
   pname = "zgrab2";
   version = "unstable-2023-03-23";
 
   src = fetchFromGitHub {
     owner = "zmap";
-    repo = pname;
+    repo = "zgrab2";
     rev = "911c86f13080ceae98f8d63d1ae0e85c4a8f7f61";
     hash = "sha256-VOWkBM/SziY3jiIaYYWq+LRzG4vKitiscqdIDfRUkYY=";
   };
diff --git a/pkgs/by-name/zi/zig-zlint/build.zig.zon.nix b/pkgs/by-name/zi/zig-zlint/build.zig.zon.nix
new file mode 100644
index 000000000000..dbdbc40b385e
--- /dev/null
+++ b/pkgs/by-name/zi/zig-zlint/build.zig.zon.nix
@@ -0,0 +1,31 @@
+# generated by zon2nix (https://github.com/nix-community/zon2nix)
+
+{
+  linkFarm,
+  fetchzip,
+  fetchgit,
+}:
+
+linkFarm "zig-packages" [
+  {
+    name = "chameleon-3.0.0-bqfnCfhtAAAAxXGw5t9odkb4ayCTTqOcPvL-TgSMUacF";
+    path = fetchzip {
+      url = "https://github.com/DonIsaac/chameleon/archive/7c7477fa76da53c2791f9e1f860481f64140ccbc.zip";
+      hash = "sha256-fbKhLQLE/6aHmpYr8+daxyUSWNpDq5zApHP4brRYvlo=";
+    };
+  }
+  {
+    name = "recover-1.1.0-Zd97oqomAADqISI8KEhW_UUjiPSExhw9hzeoNpg1Nveo";
+    path = fetchzip {
+      url = "https://github.com/dimdin/zig-recover/archive/36133afaa1b085db7063ffc97c08ae0bddc2de4e.zip";
+      hash = "sha256-0oPP6BLVEIR79Q8KcvOlSeDfNLT+8inmIU6ZkuJWrfU=";
+    };
+  }
+  {
+    name = "smart_pointers-0.0.3-NPos2MOwAABoujUzLcVLofXqRAgYWLc5pG-TKDhyK0cq";
+    path = fetchzip {
+      url = "https://github.com/DonIsaac/smart-pointers/archive/refs/tags/v0.0.3.tar.gz";
+      hash = "sha256-oSI76wyiAX7YDvKGhzRbZdEvl7+DPLtMb56w0QsYrkg=";
+    };
+  }
+]
diff --git a/pkgs/by-name/zi/zig-zlint/package.nix b/pkgs/by-name/zi/zig-zlint/package.nix
new file mode 100644
index 000000000000..19a689ba6374
--- /dev/null
+++ b/pkgs/by-name/zi/zig-zlint/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  callPackage,
+  zig_0_14,
+  versionCheckHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zig-zlint";
+  version = "0.7.6";
+
+  src = fetchFromGitHub {
+    name = "zlint"; # tests expect this
+    owner = "DonIsaac";
+    repo = "zlint";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-S0FhugmrNHCEpIWX7oL1vZ8heikpo/mok7ciTgSdOpg=";
+  };
+
+  nativeBuildInputs = [
+    zig_0_14.hook
+  ];
+
+  zigBuildFlags = [
+    "-Dversion=v${finalAttrs.version}"
+    "--system"
+    (callPackage ./build.zig.zon.nix { })
+  ];
+
+  doCheck = true;
+  zigCheckFlags = finalAttrs.zigBuildFlags;
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/zlint";
+  versionCheckProgramArg = "--version";
+
+  # `zig build` produces a lot more artifacts, just copy over the ones we want
+  installPhase = ''
+    runHook preInstall
+    install -vDm755 zig-out/bin/zlint $out/bin/zlint
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Linter for the Zig programming language";
+    homepage = "https://github.com/DonIsaac/zlint";
+    changelog = "https://github.com/DonIsaac/zlint/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ christoph-heiss ];
+    mainProgram = "zlint";
+    inherit (zig_0_14.meta) platforms;
+  };
+})
diff --git a/pkgs/by-name/zm/zmap/package.nix b/pkgs/by-name/zm/zmap/package.nix
index 765430c409e1..405eae398e33 100644
--- a/pkgs/by-name/zm/zmap/package.nix
+++ b/pkgs/by-name/zm/zmap/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "zmap";
-    repo = pname;
+    repo = "zmap";
     rev = "v${version}";
     sha256 = "sha256-fHCVo8OwQUzpdDq7dMBxvK15Ojth5UmNoPTVuTGUP58=";
   };
diff --git a/pkgs/by-name/zo/zoxide/package.nix b/pkgs/by-name/zo/zoxide/package.nix
index c90b1ae926ce..6d59e9786ea5 100644
--- a/pkgs/by-name/zo/zoxide/package.nix
+++ b/pkgs/by-name/zo/zoxide/package.nix
@@ -49,6 +49,7 @@ rustPlatform.buildRustPackage rec {
       ysndr
       cole-h
       SuperSandro2000
+      matthiasbeyer
     ];
     mainProgram = "zoxide";
   };
diff --git a/pkgs/by-name/zp/zpool-iostat-viz/package.nix b/pkgs/by-name/zp/zpool-iostat-viz/package.nix
index 772660bddce7..3a10620dad60 100644
--- a/pkgs/by-name/zp/zpool-iostat-viz/package.nix
+++ b/pkgs/by-name/zp/zpool-iostat-viz/package.nix
@@ -5,14 +5,14 @@
   installShellFiles,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "zpool-iostat-viz";
   version = "unstable-2021-11-13";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "chadmiller";
-    repo = pname;
+    repo = "zpool-iostat-viz";
     rev = "cdd8f3d882ab7a9990fb2d26af3e5b2bcc4bb312";
     sha256 = "sha256-vNXD5SauBpCtP7VPTumQ0/wXfW0PjtooS21cjpAole8=";
   };
diff --git a/pkgs/by-name/zs/zsh-defer/package.nix b/pkgs/by-name/zs/zsh-defer/package.nix
index b256e19d539d..efc93ed23428 100644
--- a/pkgs/by-name/zs/zsh-defer/package.nix
+++ b/pkgs/by-name/zs/zsh-defer/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "zsh-defer";
   version = "unstable-2022-06-13";
 
   src = fetchFromGitHub {
     owner = "romkatv";
-    repo = pname;
+    repo = "zsh-defer";
     rev = "57a6650ff262f577278275ddf11139673e01e471";
     sha256 = "sha256-/rcIS2AbTyGw2HjsLPkHtt50c2CrtAFDnLuV5wsHcLc=";
   };
diff --git a/pkgs/tools/security/zsteg/Gemfile b/pkgs/by-name/zs/zsteg/Gemfile
similarity index 100%
rename from pkgs/tools/security/zsteg/Gemfile
rename to pkgs/by-name/zs/zsteg/Gemfile
diff --git a/pkgs/tools/security/zsteg/Gemfile.lock b/pkgs/by-name/zs/zsteg/Gemfile.lock
similarity index 80%
rename from pkgs/tools/security/zsteg/Gemfile.lock
rename to pkgs/by-name/zs/zsteg/Gemfile.lock
index 0cd593f60a0f..ef7578657924 100644
--- a/pkgs/tools/security/zsteg/Gemfile.lock
+++ b/pkgs/by-name/zs/zsteg/Gemfile.lock
@@ -2,12 +2,12 @@ GEM
   remote: https://rubygems.org/
   specs:
     forwardable (1.3.3)
-    iostruct (0.0.5)
-    prime (0.1.2)
+    iostruct (0.5.0)
+    prime (0.1.3)
       forwardable
       singleton
     rainbow (3.1.1)
-    singleton (0.2.0)
+    singleton (0.3.0)
     zpng (0.4.5)
       rainbow (~> 3.1.1)
     zsteg (0.2.13)
@@ -22,4 +22,4 @@ DEPENDENCIES
   zsteg
 
 BUNDLED WITH
-   2.4.13
+   2.6.6
diff --git a/pkgs/tools/security/zsteg/gemset.nix b/pkgs/by-name/zs/zsteg/gemset.nix
similarity index 85%
rename from pkgs/tools/security/zsteg/gemset.nix
rename to pkgs/by-name/zs/zsteg/gemset.nix
index 07dfcf016f01..37fa75cb8113 100644
--- a/pkgs/tools/security/zsteg/gemset.nix
+++ b/pkgs/by-name/zs/zsteg/gemset.nix
@@ -14,10 +14,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1z3vnb8mhzns3ybf78vlj5cy6lq4pyfm8n40kqba2s33xccs3kl0";
+      sha256 = "0pswyhjz9d90bympsz6s0rgv24b8nrd4lk5y16kz67vdw6vbaqbp";
       type = "gem";
     };
-    version = "0.0.5";
+    version = "0.5.0";
   };
   prime = {
     dependencies = [
@@ -28,10 +28,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1973kz8lbck6ga5v42f55jk8b8pnbgwp9p67dl1xw15gvz55dsfl";
+      sha256 = "1qsk9q2n4yb80f5mwslxzfzm2ckar25grghk95cj7sbc1p2k3w5s";
       type = "gem";
     };
-    version = "0.1.2";
+    version = "0.1.3";
   };
   rainbow = {
     groups = [ "default" ];
@@ -48,10 +48,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qq54imvbksnckzf9hrq9bjzcdb0n8wfv6l5jc0di10n88277jx6";
+      sha256 = "0y2pc7lr979pab5n5lvk3jhsi99fhskl5f2s6004v8sabz51psl3";
       type = "gem";
     };
-    version = "0.2.0";
+    version = "0.3.0";
   };
   zpng = {
     dependencies = [ "rainbow" ];
diff --git a/pkgs/tools/security/zsteg/default.nix b/pkgs/by-name/zs/zsteg/package.nix
similarity index 72%
rename from pkgs/tools/security/zsteg/default.nix
rename to pkgs/by-name/zs/zsteg/package.nix
index c078189f4f29..d2f58193729a 100644
--- a/pkgs/tools/security/zsteg/default.nix
+++ b/pkgs/by-name/zs/zsteg/package.nix
@@ -1,12 +1,18 @@
-{ lib, bundlerApp }:
+{
+  lib,
+  bundlerApp,
+  bundlerUpdateScript,
+}:
 
-bundlerApp {
+bundlerApp rec {
   pname = "zsteg";
 
   gemdir = ./.;
 
   exes = [ "zsteg" ];
 
+  passthru.updateScript = bundlerUpdateScript pname;
+
   meta = with lib; {
     description = "Detect stegano-hidden data in PNG & BMP";
     homepage = "http://zed.0xff.me/";
diff --git a/pkgs/by-name/zw/zwave-js-ui/package.nix b/pkgs/by-name/zw/zwave-js-ui/package.nix
index 379c160f4d0f..890d361a2bae 100644
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@@ -7,15 +7,15 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "10.4.2";
+  version = "10.6.1";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-shjjxdjbPdjbLcVyF3CfSKtsB24m+ez5/vehSOWcjls=";
+    hash = "sha256-tvs0PFxV7Ang4aoAWLWpKrAfqE7d2bDmXg1dB1coweQ=";
   };
-  npmDepsHash = "sha256-Wq/R9pvYfnE4RYBX7DB68/lgJ1Tz1nbjFK1SomVwkXA=";
+  npmDepsHash = "sha256-vw4OhJ1rwnHNG/zeNa9jGGQsGyp6453LVZGAYPxrQ+M=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 
diff --git a/pkgs/desktops/deepin/core/dde-tray-loader/default.nix b/pkgs/desktops/deepin/core/dde-tray-loader/default.nix
index 6c3b7febf80b..858924b5d140 100644
--- a/pkgs/desktops/deepin/core/dde-tray-loader/default.nix
+++ b/pkgs/desktops/deepin/core/dde-tray-loader/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dde-tray-loader";
-  version = "1.0.7";
+  version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = "dde-tray-loader";
     rev = finalAttrs.version;
-    hash = "sha256-LzRjOl3kHArpxwerh7XOisYIJ+t+r/zWUbvYh6k6zKw=";
+    hash = "sha256-3rmLQRGtBLASr0VSsIfGP0R9HDxFlea+iNbVjkqKTVg=";
   };
 
   patches = [
diff --git a/pkgs/desktops/lomiri/applications/lomiri-music-app/default.nix b/pkgs/desktops/lomiri/applications/lomiri-music-app/default.nix
index 3a1dcf319dff..34654e838795 100644
--- a/pkgs/desktops/lomiri/applications/lomiri-music-app/default.nix
+++ b/pkgs/desktops/lomiri/applications/lomiri-music-app/default.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitLab,
-  fetchpatch,
   gitUpdater,
   nixosTests,
   cmake,
@@ -12,6 +11,7 @@
   lomiri-content-hub,
   lomiri-thumbnailer,
   lomiri-ui-toolkit,
+  mediascanner2,
   qtbase,
   qtdeclarative,
   qtmultimedia,
@@ -22,31 +22,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-music-app";
-  version = "3.2.2";
+  version = "3.3.0";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/apps/lomiri-music-app";
-    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-tHCbZF+7i/gYs8WqM5jDBhhKmM4ZeUbG3DYBdQAiUT8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lCpRt0SeNszlCsmJOZvnzoDmHV7xCGKdmIZBJTlBQDo=";
   };
 
-  patches = [
-    # Remove when version > 3.2.2
-    (fetchpatch {
-      name = "0001-lomiri-music-app-Fix-GNUInstallDirs-usage.patch";
-      url = "https://gitlab.com/ubports/development/apps/lomiri-music-app/-/commit/32591f2332aa204b9ee2857992e50594db0e6ff2.patch";
-      hash = "sha256-SXn+7jItzi1Q0xK0iK57+W3SpEdSCx1dKSfeghOCePg=";
-    })
-
-    # Remove when version > 3.2.2
-    (fetchpatch {
-      name = "0002-lomiri-music-app-bindtextdomain.patch";
-      url = "https://gitlab.com/ubports/development/apps/lomiri-music-app/-/commit/4e950521a67e201f3d02b3b71c6bb1ddce8ef2b2.patch";
-      hash = "sha256-HgGKk44FU+IXRVx2NK3iGSo/wPJce1T2k/vP8nZtewQ=";
-    })
-  ];
-
   postPatch = ''
     # We don't want absolute paths in desktop files
     substituteInPlace CMakeLists.txt \
@@ -73,6 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
       lomiri-content-hub
       lomiri-thumbnailer
       lomiri-ui-toolkit
+      mediascanner2
       qtmultimedia
       qtsystems
     ]
@@ -113,7 +98,9 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Default Music application for Ubuntu devices";
     homepage = "https://gitlab.com/ubports/development/apps/lomiri-music-app";
-    changelog = "https://gitlab.com/ubports/development/apps/lomiri-music-app/-/blob/v${finalAttrs.version}/ChangeLog";
+    changelog = "https://gitlab.com/ubports/development/apps/lomiri-music-app/-/blob/${
+      if (!builtins.isNull finalAttrs.src.tag) then finalAttrs.src.tag else finalAttrs.src.rev
+    }/ChangeLog";
     license = with lib.licenses; [
       gpl3Only
     ];
diff --git a/pkgs/desktops/lomiri/services/lomiri-url-dispatcher/default.nix b/pkgs/desktops/lomiri/services/lomiri-url-dispatcher/default.nix
index 0ece914e0eef..c46beb634630 100644
--- a/pkgs/desktops/lomiri/services/lomiri-url-dispatcher/default.nix
+++ b/pkgs/desktops/lomiri/services/lomiri-url-dispatcher/default.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitLab,
-  fetchpatch,
   gitUpdater,
   testers,
   cmake,
@@ -31,13 +30,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-url-dispatcher";
-  version = "0.1.3";
+  version = "0.1.4";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-url-dispatcher";
-    rev = finalAttrs.version;
-    hash = "sha256-kde/HzhBHxTeyc2TCUJwpG7IfC8doDd/jNMF8KLM7KU=";
+    tag = finalAttrs.version;
+    hash = "sha256-+3/C6z8wyiNSpt/eyMl+j/TGJW0gZ5T3Vd1NmghK67k=";
   };
 
   outputs = [
@@ -46,22 +45,6 @@ stdenv.mkDerivation (finalAttrs: {
     "lib"
   ];
 
-  patches = [
-    # Fix case-sensitivity in tests
-    # Remove when https://gitlab.com/ubports/development/core/lomiri-url-dispatcher/-/merge_requests/8 merged & in release
-    (fetchpatch {
-      url = "https://gitlab.com/sunweaver/lomiri-url-dispatcher/-/commit/ebdd31b9640ca243e90bc7b8aca7951085998bd8.patch";
-      hash = "sha256-g4EohB3oDcWK4x62/3r/g6CFxqb7/rdK51+E/Fji1Do=";
-    })
-
-    # Make lomiri-url-dispatcher-gui wrappable
-    # Remove when https://gitlab.com/ubports/development/core/lomiri-url-dispatcher/-/merge_requests/28 merged & in release
-    (fetchpatch {
-      url = "https://gitlab.com/ubports/development/core/lomiri-url-dispatcher/-/commit/6512937e2b388ad1350072b8ed3b4140439b2321.patch";
-      hash = "sha256-P1A3hi8l7fJWFjGeK5hWYl8BoZMzRfo44MUTeM7vG2A=";
-    })
-  ];
-
   postPatch =
     ''
       substituteInPlace CMakeLists.txt \
@@ -174,6 +157,9 @@ stdenv.mkDerivation (finalAttrs: {
       starting them inside its own Application Confinement.
     '';
     homepage = "https://gitlab.com/ubports/development/core/lomiri-url-dispatcher";
+    changelog = "https://gitlab.com/ubports/development/core/lomiri-url-dispatcher/-/blob/${
+      if (!builtins.isNull finalAttrs.src.tag) then finalAttrs.src.tag else finalAttrs.src.rev
+    }/ChangeLog";
     license = with lib.licenses; [
       lgpl3Only
       gpl3Only
diff --git a/pkgs/desktops/lxqt/screengrab/default.nix b/pkgs/desktops/lxqt/screengrab/default.nix
index 430e2abff2b5..e652e55424d8 100644
--- a/pkgs/desktops/lxqt/screengrab/default.nix
+++ b/pkgs/desktops/lxqt/screengrab/default.nix
@@ -6,30 +6,34 @@
   autoPatchelfHook,
   gitUpdater,
   kwindowsystem,
+  layer-shell-qt,
   libXdmcp,
   libpthreadstubs,
   libqtxdg,
+  lxqt-build-tools,
   perl,
   pkg-config,
   qtbase,
   qtsvg,
   qttools,
+  qtwayland,
   wrapQtAppsHook,
 }:
 
 stdenv.mkDerivation rec {
   pname = "screengrab";
-  version = "2.10.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-cTDGVNnnjgIiCS/KzEVmTagJvNwDKAP2UrWKwdn3WmE=";
+    hash = "sha256-6cGj3Ijv4DsAdJjcHKUg5et+yYc5miIHHZOTD2D9ASk=";
   };
 
   nativeBuildInputs = [
     cmake
+    lxqt-build-tools
     pkg-config
     perl # needed by LXQtTranslateDesktop.cmake
     qttools
@@ -39,11 +43,13 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     kwindowsystem
+    layer-shell-qt
     libXdmcp
     libpthreadstubs
     libqtxdg
     qtbase
     qtsvg
+    qtwayland
   ];
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/desktops/xfce/thunar-plugins/archive/default.nix b/pkgs/desktops/xfce/thunar-plugins/archive/default.nix
index c7a46404c9d8..0a544de1728c 100644
--- a/pkgs/desktops/xfce/thunar-plugins/archive/default.nix
+++ b/pkgs/desktops/xfce/thunar-plugins/archive/default.nix
@@ -1,38 +1,53 @@
 {
+  stdenv,
   lib,
-  mkXfceDerivation,
+  fetchFromGitLab,
+  meson,
+  ninja,
+  pkg-config,
+  glib,
   gtk3,
   thunar,
-  exo,
   libxfce4util,
   gettext,
+  gitUpdater,
 }:
 
-mkXfceDerivation {
-  category = "thunar-plugins";
+stdenv.mkDerivation (finalAttrs: {
   pname = "thunar-archive-plugin";
-  version = "0.5.3";
-  odd-unstable = false;
+  version = "0.6.0";
 
-  sha256 = "sha256-9EjEQml/Xdj/jCtC4ZuGdmpeNnOqUWJOqoVzLuxzG6s=";
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "thunar-plugins";
+    repo = "thunar-archive-plugin";
+    tag = "thunar-archive-plugin-${finalAttrs.version}";
+    hash = "sha256-/WLkEqzFAKpB7z8mWSgufo4Qbj6KP3Ax8MWVZxIwDs0=";
+  };
+
+  strictDeps = true;
 
   nativeBuildInputs = [
     gettext
+    meson
+    ninja
+    pkg-config
   ];
 
   buildInputs = [
     thunar
-    exo
+    glib
     gtk3
     libxfce4util
   ];
 
-  preConfigure = ''
-    ./autogen.sh
-  '';
+  passthru.updateScript = gitUpdater { rev-prefix = "thunar-archive-plugin-"; };
 
-  meta = with lib; {
+  meta = {
     description = "Thunar plugin providing file context menus for archives";
-    teams = [ teams.xfce ];
+    homepage = "https://gitlab.xfce.org/thunar-plugins/thunar-archive-plugin";
+    license = lib.licenses.lgpl2Only;
+    teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/desktops/xfce/thunar-plugins/media-tags/default.nix b/pkgs/desktops/xfce/thunar-plugins/media-tags/default.nix
index ff8dce3843c3..7f6eb45d72f4 100644
--- a/pkgs/desktops/xfce/thunar-plugins/media-tags/default.nix
+++ b/pkgs/desktops/xfce/thunar-plugins/media-tags/default.nix
@@ -1,24 +1,48 @@
 {
+  stdenv,
   lib,
-  mkXfceDerivation,
+  fetchFromGitLab,
+  fetchpatch,
+  meson,
+  ninja,
+  pkg-config,
   glib,
   gtk3,
   thunar,
   libxfce4util,
   gettext,
   taglib,
+  gitUpdater,
 }:
 
-mkXfceDerivation {
-  category = "thunar-plugins";
+stdenv.mkDerivation (finalAttrs: {
   pname = "thunar-media-tags-plugin";
-  version = "0.5.0";
-  odd-unstable = false;
+  version = "0.6.0";
 
-  sha256 = "sha256-71YBA1deR8aV8hoZ4F0TP+Q5sdcVQAB9n3B+pcpJMSQ=";
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "thunar-plugins";
+    repo = "thunar-media-tags-plugin";
+    tag = "thunar-media-tags-plugin-${finalAttrs.version}";
+    hash = "sha256-qEoBga+JSxpByOjqhOspjYknF0p74oXZnpoDz2MSBOA=";
+  };
+
+  patches = [
+    # meson-build: Fix typo libxfce4ui -> libxfce4util
+    # https://gitlab.xfce.org/thunar-plugins/thunar-media-tags-plugin/-/merge_requests/14
+    (fetchpatch {
+      url = "https://gitlab.xfce.org/thunar-plugins/thunar-media-tags-plugin/-/commit/4e19a56deeeefa6d913f7b15a12b30a5d99119d4.patch";
+      hash = "sha256-ASVknxEiGOWbE82hVlgEAOqE+8TknAh/ULQg55mfs9o=";
+    })
+  ];
+
+  strictDeps = true;
 
   nativeBuildInputs = [
     gettext
+    meson
+    ninja
+    pkg-config
   ];
 
   buildInputs = [
@@ -29,9 +53,14 @@ mkXfceDerivation {
     taglib
   ];
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { rev-prefix = "thunar-media-tags-plugin-"; };
+
+  meta = {
     description = "Thunar plugin providing tagging and renaming features for media files";
-    maintainers = with maintainers; [ ncfavier ];
-    teams = [ teams.xfce ];
+    homepage = "https://gitlab.xfce.org/thunar-plugins/thunar-media-tags-plugin";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ ncfavier ];
+    teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/desktops/xfce/thunar-plugins/vcs/default.nix b/pkgs/desktops/xfce/thunar-plugins/vcs/default.nix
index ca61c18632ec..defbd834841b 100644
--- a/pkgs/desktops/xfce/thunar-plugins/vcs/default.nix
+++ b/pkgs/desktops/xfce/thunar-plugins/vcs/default.nix
@@ -1,8 +1,15 @@
 {
+  stdenv,
   lib,
-  mkXfceDerivation,
+  fetchFromGitLab,
+  gettext,
+  meson,
+  ninja,
+  pkg-config,
+  wrapGAppsHook3,
   thunar,
   exo,
+  libxfce4ui,
   libxfce4util,
   gtk3,
   glib,
@@ -10,19 +17,36 @@
   apr,
   aprutil,
   withSubversion ? false,
+  gitUpdater,
 }:
-mkXfceDerivation {
-  category = "thunar-plugins";
-  pname = "thunar-vcs-plugin";
-  version = "0.3.0";
-  odd-unstable = false;
 
-  sha256 = "sha256-e9t6lIsvaV/2AAL/7I4Pbcokvy7Lp2+D9sJefTZqB1g=";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "thunar-vcs-plugin";
+  version = "0.4.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "thunar-plugins";
+    repo = "thunar-vcs-plugin";
+    tag = "thunar-vcs-plugin-${finalAttrs.version}";
+    hash = "sha256-VuTTao46/3JNzCHv7phCC8DCy9rjlEcMuGmGiIOSsMM=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    gettext
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook3
+  ];
 
   buildInputs =
     [
       thunar
       exo
+      libxfce4ui
       libxfce4util
       gtk3
       glib
@@ -33,9 +57,18 @@ mkXfceDerivation {
       subversion
     ];
 
+  mesonFlags = [
+    (lib.mesonEnable "svn" withSubversion)
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "thunar-vcs-plugin-"; };
+
   meta = {
     description = "Thunar plugin providing support for Subversion and Git";
+    homepage = "https://gitlab.xfce.org/thunar-plugins/thunar-vcs-plugin";
+    license = lib.licenses.lgpl2Only;
     maintainers = with lib.maintainers; [ lordmzte ];
     teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/development/ada-modules/gnatprove/0003-Adjust-after-category-change-for-N_Formal_Package_De.patch b/pkgs/development/ada-modules/gnatprove/0003-Adjust-after-category-change-for-N_Formal_Package_De.patch
new file mode 100644
index 000000000000..aea33821f045
--- /dev/null
+++ b/pkgs/development/ada-modules/gnatprove/0003-Adjust-after-category-change-for-N_Formal_Package_De.patch
@@ -0,0 +1,33 @@
+From 3c06fb993ae628b5069c1f3e23f11c53815e1cbe Mon Sep 17 00:00:00 2001
+From: Eric Botcazou <ebotcazou@adacore.com>
+Date: Sat, 8 Mar 2025 00:09:57 +0100
+Subject: [PATCH] Adjust after category change for N_Formal_Package_Declaration
+
+Issue: eng/toolchain/gnat#1354
+---
+ src/why/gnat2why-borrow_checker.adb | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/why/gnat2why-borrow_checker.adb b/src/why/gnat2why-borrow_checker.adb
+index a97f225b06..f3ab8be3e9 100644
+--- a/src/why/gnat2why-borrow_checker.adb
++++ b/src/why/gnat2why-borrow_checker.adb
+@@ -1693,6 +1693,7 @@ procedure Check_Declaration (Decl : Node_Id) is
+          --  Ignored constructs for pointer checking
+ 
+          when N_Formal_Object_Declaration
++            | N_Formal_Package_Declaration
+             | N_Formal_Type_Declaration
+             | N_Incomplete_Type_Declaration
+             | N_Private_Extension_Declaration
+@@ -3326,7 +3327,6 @@ procedure Check_Node (N : Node_Id) is
+             | N_Empty
+             | N_Enumeration_Representation_Clause
+             | N_Exception_Renaming_Declaration
+-            | N_Formal_Package_Declaration
+             | N_Formal_Subprogram_Declaration
+             | N_Freeze_Entity
+             | N_Freeze_Generic_Entity
+-- 
+2.48.1
+
diff --git a/pkgs/development/ada-modules/gnatprove/default.nix b/pkgs/development/ada-modules/gnatprove/default.nix
index c9377237be8c..c59c77c3a4cb 100644
--- a/pkgs/development/ada-modules/gnatprove/default.nix
+++ b/pkgs/development/ada-modules/gnatprove/default.nix
@@ -64,6 +64,9 @@ let
 
         # Suppress warnings on aarch64: https://github.com/AdaCore/spark2014/issues/54
         ./0002-mute-aarch64-warnings.patch
+
+        # Changes to the GNAT frontend: https://github.com/AdaCore/spark2014/issues/58
+        ./0003-Adjust-after-category-change-for-N_Formal_Package_De.patch
       ];
       commit_date = "2024-01-11";
     };
@@ -121,8 +124,8 @@ stdenv.mkDerivation {
 
   postPatch = ''
     # gnat2why/gnat_src points to the GNAT sources
-    tar xf ${gnat.cc.src} gcc-${gnat.cc.version}/gcc/ada
-    mv gcc-${gnat.cc.version}/gcc/ada gnat2why/gnat_src
+    tar xf ${gnat.cc.src} --wildcards 'gcc-*/gcc/ada'
+    mv gcc-*/gcc/ada gnat2why/gnat_src
   '';
 
   configurePhase = ''
diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index 01d038a687d7..c168f87ab64b 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   python3,
   nodejs,
   closurecompiler,
@@ -60,6 +61,17 @@ stdenv.mkDerivation rec {
     (replaceVars ./0001-emulate-clang-sysroot-include-logic.patch {
       resourceDir = "${llvmEnv}/lib/clang/${lib.versions.major llvmPackages.llvm.version}/";
     })
+    # The following patches work around a bug where EM_CACHE is not copied with
+    # the correct permissions; the bug will be fixed in the next release (probably 4.0.10).
+    # See also: https://github.com/emscripten-core/emscripten/issues/24404
+    (fetchpatch {
+      url = "https://github.com/emscripten-core/emscripten/commit/99c6e41154f701e423074e33a4fdaf5eea49d073.patch";
+      hash = "sha256-/wkhz08NhbgxsrXd7YFfdCGX6LrS2Ncct8dcwxBMsjY=";
+    })
+    (fetchpatch {
+      url = "https://github.com/emscripten-core/emscripten/commit/f4d358d740a238b67a1d6935e71638519d25afa0.patch";
+      hash = "sha256-hib5ZAN/R2dH+rTv3nYF37+xKZmeboKxnS+5mkht2lM=";
+    })
   ];
 
   buildPhase = ''
diff --git a/pkgs/development/compilers/flutter/versions/3_32/data.json b/pkgs/development/compilers/flutter/versions/3_32/data.json
index 42781fe3577d..a4e1d1db18c4 100644
--- a/pkgs/development/compilers/flutter/versions/3_32/data.json
+++ b/pkgs/development/compilers/flutter/versions/3_32/data.json
@@ -1,73 +1,73 @@
 {
-  "version": "3.32.0-0.4.pre",
-  "engineVersion": "38e19d01dcac654bbb941b771cc06efd4ed4a93f",
+  "version": "3.32.0",
+  "engineVersion": "18818009497c581ede5d8a3b8b833b81d00cebb7",
   "engineSwiftShaderHash": "sha256-ATVcuxqPHqHOWYyO7DoX9LdgUiO3INUi7m9Mc6ccc1M=",
   "engineSwiftShaderRev": "d040a5bab638bf7c226235c95787ba6288bb6416",
-  "channel": "beta",
+  "channel": "stable",
   "engineHashes": {
     "aarch64-linux": {
-      "aarch64-linux": "sha256-qAibCHpb582058h/62f3/EnWrKDMrci0dUrEc2BjE6Q=",
-      "x86_64-linux": "sha256-qAibCHpb582058h/62f3/EnWrKDMrci0dUrEc2BjE6Q="
+      "aarch64-linux": "sha256-zGlgnVbNPZ9OX5VFxaajc8xqPKftzZMkyem2NLk8EH8=",
+      "x86_64-linux": "sha256-zGlgnVbNPZ9OX5VFxaajc8xqPKftzZMkyem2NLk8EH8="
     },
     "x86_64-linux": {
-      "aarch64-linux": "sha256-hekNsaCiB7cKuD9+6coKs556KfNnkcPtuOIYI5lC1NA=",
-      "x86_64-linux": "sha256-hekNsaCiB7cKuD9+6coKs556KfNnkcPtuOIYI5lC1NA="
+      "aarch64-linux": "sha256-TWwsPtAnkQzsvNLUd5Q3G80ALeh7nM/XV4M6rfBvUGY=",
+      "x86_64-linux": "sha256-TWwsPtAnkQzsvNLUd5Q3G80ALeh7nM/XV4M6rfBvUGY="
     }
   },
-  "dartVersion": "3.8.0-278.4.beta",
+  "dartVersion": "3.8.0",
   "dartHash": {
-    "x86_64-linux": "sha256-jyLGethyv9KGGV9IjlXnSno6oJTwUFpR8wsgVbT+UTY=",
-    "aarch64-linux": "sha256-NEYfdqLA5+Po9fI0YfAbsXPMgaEkhkDfm2XHOROU4MM=",
-    "x86_64-darwin": "sha256-09AvWYmW2LHaUe2hTv/EVGwjY6GTCV7reiqUVQKDkrM=",
-    "aarch64-darwin": "sha256-IwJJGFW+hdt7Yb86DdGxWjiEp0XJnLJUzqJvKrN9iTs="
+    "x86_64-linux": "sha256-/b6dNwqeMymHKI4cz2ggfVtcHWtdsrlVyEZ1Z2G0RKw=",
+    "aarch64-linux": "sha256-tXIeGM7n1lx9GOwOMEFapiW0sHBlhupx5NCAtFd73Pk=",
+    "x86_64-darwin": "sha256-wD9Z3J29N4ecWKmCetj5GnbTQ8LiJ1tZFEbPuG6ny5w=",
+    "aarch64-darwin": "sha256-IIFn6OTpTH8LzwZzF7V8yUrhHkjavMUWX7n62YEMABk="
   },
-  "flutterHash": "sha256-+UQNtN0BrSxEwGdnb9f63Bg46q+zKwqStYBKgIB/hic=",
+  "flutterHash": "sha256-Wk84RfnPvPVVnnbwGcnHIcRnu3Kizo2AkRQbVSEw+1M=",
   "artifactHashes": {
     "android": {
-      "aarch64-darwin": "sha256-bknwCOFzj6Qj63I4VwTvuedmvLjdvCDdSpf9fFiRha0=",
-      "aarch64-linux": "sha256-tHl0+NBCDcn/JJ+XJ8Ow5yFHK3UiUIzpjCuOddgVEiE=",
-      "x86_64-darwin": "sha256-bknwCOFzj6Qj63I4VwTvuedmvLjdvCDdSpf9fFiRha0=",
-      "x86_64-linux": "sha256-tHl0+NBCDcn/JJ+XJ8Ow5yFHK3UiUIzpjCuOddgVEiE="
+      "aarch64-darwin": "sha256-+YUzIG/qUFb4X2ftR6Gf0h1mt/5Dy59B7QD09X1XVYY=",
+      "aarch64-linux": "sha256-lZIo8AGzrXant29kfiOKlfQ0SJAPXpsdZCaKfqxn0zA=",
+      "x86_64-darwin": "sha256-+YUzIG/qUFb4X2ftR6Gf0h1mt/5Dy59B7QD09X1XVYY=",
+      "x86_64-linux": "sha256-lZIo8AGzrXant29kfiOKlfQ0SJAPXpsdZCaKfqxn0zA="
     },
     "fuchsia": {
-      "aarch64-darwin": "sha256-JkxTpBlkmlq+ENnUBqRTGITVjHsicPN1p99XlGhdCPc=",
-      "aarch64-linux": "sha256-JkxTpBlkmlq+ENnUBqRTGITVjHsicPN1p99XlGhdCPc=",
-      "x86_64-darwin": "sha256-JkxTpBlkmlq+ENnUBqRTGITVjHsicPN1p99XlGhdCPc=",
-      "x86_64-linux": "sha256-JkxTpBlkmlq+ENnUBqRTGITVjHsicPN1p99XlGhdCPc="
+      "aarch64-darwin": "sha256-F4uNyPIt6FSVCSOjR6mtgHHMMcJd3pAdT4uEiBJSASk=",
+      "aarch64-linux": "sha256-F4uNyPIt6FSVCSOjR6mtgHHMMcJd3pAdT4uEiBJSASk=",
+      "x86_64-darwin": "sha256-F4uNyPIt6FSVCSOjR6mtgHHMMcJd3pAdT4uEiBJSASk=",
+      "x86_64-linux": "sha256-F4uNyPIt6FSVCSOjR6mtgHHMMcJd3pAdT4uEiBJSASk="
     },
     "ios": {
-      "aarch64-darwin": "sha256-PlFE5eoLdJOsnWR5QfENrGR0WQ0nP7ZkeBMbjpD12GU=",
-      "aarch64-linux": "sha256-PlFE5eoLdJOsnWR5QfENrGR0WQ0nP7ZkeBMbjpD12GU=",
-      "x86_64-darwin": "sha256-PlFE5eoLdJOsnWR5QfENrGR0WQ0nP7ZkeBMbjpD12GU=",
-      "x86_64-linux": "sha256-PlFE5eoLdJOsnWR5QfENrGR0WQ0nP7ZkeBMbjpD12GU="
+      "aarch64-darwin": "sha256-HlGXG7hyi4oCdN4bGP6GYa++rTruZC7v+laR4733xS4=",
+      "aarch64-linux": "sha256-HlGXG7hyi4oCdN4bGP6GYa++rTruZC7v+laR4733xS4=",
+      "x86_64-darwin": "sha256-HlGXG7hyi4oCdN4bGP6GYa++rTruZC7v+laR4733xS4=",
+      "x86_64-linux": "sha256-HlGXG7hyi4oCdN4bGP6GYa++rTruZC7v+laR4733xS4="
     },
     "linux": {
-      "aarch64-darwin": "sha256-GLG6kNllEwbdsF1pJ5MPZ14Pqpw2nCkadthECfk6FD8=",
-      "aarch64-linux": "sha256-GLG6kNllEwbdsF1pJ5MPZ14Pqpw2nCkadthECfk6FD8=",
-      "x86_64-darwin": "sha256-aq/yB8vH9lQwv2sbVg0PlZBuLOUTeO0ptuEqBJuUUvU=",
-      "x86_64-linux": "sha256-aq/yB8vH9lQwv2sbVg0PlZBuLOUTeO0ptuEqBJuUUvU="
+      "aarch64-darwin": "sha256-y/xxUQK/9GeXjMTUPZSGhfP83rJzCm1Pd2PMjnAHdnk=",
+      "aarch64-linux": "sha256-y/xxUQK/9GeXjMTUPZSGhfP83rJzCm1Pd2PMjnAHdnk=",
+      "x86_64-darwin": "sha256-P5UQiY4QHLJQMmTpTfTFfh6QrqelhWyaGpSXNtM8vJE=",
+      "x86_64-linux": "sha256-P5UQiY4QHLJQMmTpTfTFfh6QrqelhWyaGpSXNtM8vJE="
     },
     "macos": {
-      "aarch64-darwin": "sha256-XMtNe03SXtmBc9i588N7BTRg/xqLCohEjovDXHC1hpI=",
-      "aarch64-linux": "sha256-XMtNe03SXtmBc9i588N7BTRg/xqLCohEjovDXHC1hpI=",
-      "x86_64-darwin": "sha256-XMtNe03SXtmBc9i588N7BTRg/xqLCohEjovDXHC1hpI=",
-      "x86_64-linux": "sha256-XMtNe03SXtmBc9i588N7BTRg/xqLCohEjovDXHC1hpI="
+      "aarch64-darwin": "sha256-FkvjRiKWa/FUITdwK1ldLCcsfjs8nrH7L0mXGHnVIko=",
+      "aarch64-linux": "sha256-FkvjRiKWa/FUITdwK1ldLCcsfjs8nrH7L0mXGHnVIko=",
+      "x86_64-darwin": "sha256-FkvjRiKWa/FUITdwK1ldLCcsfjs8nrH7L0mXGHnVIko=",
+      "x86_64-linux": "sha256-FkvjRiKWa/FUITdwK1ldLCcsfjs8nrH7L0mXGHnVIko="
     },
     "universal": {
-      "aarch64-darwin": "sha256-EocA/pXkEw7fe0fdDkC/WDk5JAVlwTJybNAQDw0/wO4=",
-      "aarch64-linux": "sha256-yIwNmd0DVsLsEUH1+W4AeJXf9l/WIC8HLbHooIZdqk0=",
-      "x86_64-darwin": "sha256-5Y5gRLoCzTYuP4JXf9APKbHXl+khuzleQIxNiWyVjbM=",
-      "x86_64-linux": "sha256-jqe3Z4caAe890CeJST9pAjgunGJsqnycGFqNvn8XNAI="
+      "aarch64-darwin": "sha256-bt/UiY3t1wZUnpMo1uVQPdlG/7X+OrAOZRXIaXKH3Ls=",
+      "aarch64-linux": "sha256-NShVNyK6Cx5bddhv6hg3rM+QPczrm2MmHCgb14h78SA=",
+      "x86_64-darwin": "sha256-zXSufTmlyaHM0fJinirUfB3XjD3dzKFD6iyhUADsyQY=",
+      "x86_64-linux": "sha256-MQw71FYYuLKd60cwMddAjVe9vgwx8MR4xVe0Z9J7uAo="
     },
     "web": {
-      "aarch64-darwin": "sha256-CBW+e9/dI+3Osu6AyiUrMej9/viz26nh490uHP7l9JA=",
-      "aarch64-linux": "sha256-CBW+e9/dI+3Osu6AyiUrMej9/viz26nh490uHP7l9JA=",
-      "x86_64-darwin": "sha256-CBW+e9/dI+3Osu6AyiUrMej9/viz26nh490uHP7l9JA=",
-      "x86_64-linux": "sha256-CBW+e9/dI+3Osu6AyiUrMej9/viz26nh490uHP7l9JA="
+      "aarch64-darwin": "sha256-dpMJQsUd98X+tmUnqRZQ1o5g334i7dyxBNvg2znJeaE=",
+      "aarch64-linux": "sha256-dpMJQsUd98X+tmUnqRZQ1o5g334i7dyxBNvg2znJeaE=",
+      "x86_64-darwin": "sha256-dpMJQsUd98X+tmUnqRZQ1o5g334i7dyxBNvg2znJeaE=",
+      "x86_64-linux": "sha256-dpMJQsUd98X+tmUnqRZQ1o5g334i7dyxBNvg2znJeaE="
     },
     "windows": {
-      "x86_64-darwin": "sha256-VUa58cPGlNstQS1QIkC8vhtdA7a/qPC9FMtFM32G2xg=",
-      "x86_64-linux": "sha256-VUa58cPGlNstQS1QIkC8vhtdA7a/qPC9FMtFM32G2xg="
+      "x86_64-darwin": "sha256-3ZfYqlyjBaBaZjxp9k2DCsD4QZL/+fbXfCFxX3i4Q/Q=",
+      "x86_64-linux": "sha256-3ZfYqlyjBaBaZjxp9k2DCsD4QZL/+fbXfCFxX3i4Q/Q="
     }
   },
   "pubspecLock": {
diff --git a/pkgs/development/compilers/flutter/versions/3_32/patches/fix-native-assets.patch b/pkgs/development/compilers/flutter/versions/3_32/patches/fix-native-assets.patch
new file mode 100644
index 000000000000..3e266db224f3
--- /dev/null
+++ b/pkgs/development/compilers/flutter/versions/3_32/patches/fix-native-assets.patch
@@ -0,0 +1,38 @@
+This patch introducing error handling in the invocation of packagesWithNativeAssets within flutter_tools.
+
+--- a/packages/flutter_tools/lib/src/isolated/native_assets/native_assets.dart
++++ b/packages/flutter_tools/lib/src/isolated/native_assets/native_assets.dart
+@@ -357,7 +357,15 @@
+ }
+
+ Future<bool> _nativeBuildRequired(FlutterNativeAssetsBuildRunner buildRunner) async {
+-  final List<String> packagesWithNativeAssets = await buildRunner.packagesWithNativeAssets();
++  late final List<String> packagesWithNativeAssets;
++  try {
++    packagesWithNativeAssets = await buildRunner.packagesWithNativeAssets();
++  } catch (error, stackTrace) {
++    globals.logger.printTrace(
++      'Error while checking for native assets packages: $error\n$stackTrace'
++    );
++    packagesWithNativeAssets = <String>[];
++  }
+   if (packagesWithNativeAssets.isEmpty) {
+     globals.logger.printTrace(
+       'No packages with native assets. Skipping native assets compilation.',
+@@ -385,7 +393,15 @@
+   FileSystem fileSystem,
+   FlutterNativeAssetsBuildRunner buildRunner,
+ ) async {
+-  final List<String> packagesWithNativeAssets = await buildRunner.packagesWithNativeAssets();
++  late final List<String> packagesWithNativeAssets;
++  try {
++    packagesWithNativeAssets = await buildRunner.packagesWithNativeAssets();
++  } catch (error, stackTrace) {
++    globals.logger.printTrace(
++      'Error while checking for native assets packages: $error\n$stackTrace'
++    );
++    packagesWithNativeAssets = <String>[];
++  }
+   if (packagesWithNativeAssets.isEmpty) {
+     globals.logger.printTrace(
+       'No packages with native assets. Skipping native assets compilation.',
diff --git a/pkgs/development/compilers/gcc/patches/15/libgcc-darwin-detection.patch b/pkgs/development/compilers/gcc/patches/15/libgcc-darwin-detection.patch
new file mode 100644
index 000000000000..810d8e6f69a1
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/15/libgcc-darwin-detection.patch
@@ -0,0 +1,11 @@
+--- a/libgcc/config.host
++++ b/libgcc/config.host
+@@ -239,7 +239,7 @@ case ${host} in
+     x86_64-*-darwin2[0-2]*)
+       tmake_file="t-darwin-min-11 t-darwin-libgccs1 $tmake_file"
+       ;;
+-    *-*-darwin2*)
++    *-*-darwin2* | *-*-darwin)
+       tmake_file="t-darwin-min-11 $tmake_file"
+       ;;
+     *-*-darwin1[89]*)
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 598c42a48d3e..709d35caff38 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -27,11 +27,13 @@
 }:
 
 let
+  atLeast15 = lib.versionAtLeast version "15";
   atLeast14 = lib.versionAtLeast version "14";
   atLeast13 = lib.versionAtLeast version "13";
   atLeast12 = lib.versionAtLeast version "12";
   atLeast11 = lib.versionAtLeast version "11";
   atLeast10 = lib.versionAtLeast version "10";
+  is15 = majorVersion == "15";
   is14 = majorVersion == "14";
   is13 = majorVersion == "13";
   is12 = majorVersion == "12";
@@ -67,6 +69,10 @@ in
   [ (if atLeast12 then ./gcc-12-no-sys-dirs.patch else ./no-sys-dirs.patch) ]
   ++ (
     {
+      "15" = [
+        ./13/no-sys-dirs-riscv.patch
+        ./13/mangle-NIX_STORE-in-__FILE__.patch
+      ];
       "14" = [
         ./13/no-sys-dirs-riscv.patch
         ./13/mangle-NIX_STORE-in-__FILE__.patch
@@ -146,8 +152,11 @@ in
 
 # Fixes detection of Darwin on x86_64-darwin. Otherwise, GCC uses a deployment target of 10.5, which crashes ld64.
 ++ optional (
-  atLeast14 && stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64
+  is14 && stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64
 ) ../patches/14/libgcc-darwin-detection.patch
+++ optional (
+  atLeast15 && stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64
+) ../patches/15/libgcc-darwin-detection.patch
 
 # Fix detection of bootstrap compiler Ada support (cctools as) on Nix Darwin
 ++ optional (
@@ -162,6 +171,7 @@ in
 # Use absolute path in GNAT dylib install names on Darwin
 ++ optionals (stdenv.hostPlatform.isDarwin && langAda) (
   {
+    "15" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
     "14" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
     "13" = [ ./gnat-darwin-dylib-install-name-13.patch ];
     "12" = [ ./gnat-darwin-dylib-install-name.patch ];
@@ -171,6 +181,13 @@ in
 
 ++ optionals canApplyIainsDarwinPatches (
   {
+    "15" = [
+      (fetchpatch {
+        name = "gcc-15-darwin-aarch64-support.patch";
+        url = "https://raw.githubusercontent.com/Homebrew/formula-patches/a25079204c1cb3d78ba9dd7dd22b8aecce7ce264/gcc/gcc-15.1.0.diff";
+        sha256 = "sha256-MJxSGv6LEP1sIM8cDqbmfUV7byV0bYgADeIBY/Teyu8=";
+      })
+    ];
     "14" = [
       (fetchpatch {
         name = "gcc-14-darwin-aarch64-support.patch";
diff --git a/pkgs/development/coq-modules/parseque/default.nix b/pkgs/development/coq-modules/parseque/default.nix
new file mode 100644
index 000000000000..def3689a3911
--- /dev/null
+++ b/pkgs/development/coq-modules/parseque/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  mkCoqDerivation,
+  which,
+  coq,
+  version ? null,
+}:
+
+with lib;
+mkCoqDerivation {
+  pname = "parseque";
+  repo = "parseque";
+  owner = "rocq-community";
+
+  inherit version;
+  defaultVersion =
+    with versions;
+    switch
+      [ coq.coq-version ]
+      [
+        {
+          cases = [ (range "8.16" "8.20") ];
+          out = "0.2.2";
+        }
+      ]
+      null;
+
+  release."0.2.2".sha256 = "sha256-O50Rs7Yf1H4wgwb7ltRxW+7IF0b04zpfs+mR83rxT+E=";
+
+  releaseRev = v: "v${v}";
+
+  meta = {
+    description = "Total parser combinators in Rocq";
+    maintainers = with maintainers; [ womeier ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/cuda-modules/README.md b/pkgs/development/cuda-modules/README.md
index d79f5bede0bb..1a88761c4d51 100644
--- a/pkgs/development/cuda-modules/README.md
+++ b/pkgs/development/cuda-modules/README.md
@@ -8,18 +8,6 @@
 The files in this directory are added (in some way) to the `cudaPackages`
 package set by [cuda-packages.nix](../../top-level/cuda-packages.nix).
 
-## Top-level files
-
-Top-level nix files are included in the initial creation of the `cudaPackages`
-scope. These are typically required for the creation of the finalized
-`cudaPackages` scope:
-
-- `backend-stdenv.nix`: Standard environment for CUDA packages.
-- `flags.nix`: Flags set, or consumed by, NVCC in order to build packages.
-- `gpus.nix`: A list of supported NVIDIA GPUs.
-- `nvcc-compatibilities.nix`: NVCC releases and the version range of GCC/Clang
-    they support.
-
 ## Top-level directories
 
 - `cuda`: CUDA redistributables! Provides extension to `cudaPackages` scope.
@@ -48,9 +36,8 @@ scope. These are typically required for the creation of the finalized
     own. `cudnn` and `tensorrt` are examples of packages which provide such
     shims. These modules are further described in the
     [Modules](./modules/README.md) documentation.
-- `nccl`: NVIDIA NCCL library.
-- `nccl-tests`: NVIDIA NCCL tests.
-- `saxpy`: Example CMake project that uses CUDA.
+- `packages`: Contains packages which exist in every instance of the CUDA
+    package set. These packages are built in a `by-name` fashion.
 - `setup-hooks`: Nixpkgs setup hooks for CUDA.
 - `tensorrt`: NVIDIA TensorRT library.
 
diff --git a/pkgs/development/cuda-modules/_cuda/db/bootstrap/cuda.nix b/pkgs/development/cuda-modules/_cuda/db/bootstrap/cuda.nix
new file mode 100644
index 000000000000..e852bc85b639
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/db/bootstrap/cuda.nix
@@ -0,0 +1,299 @@
+{ lib }:
+{
+
+  /**
+    Attribute set of supported CUDA capability mapped to information about that capability.
+
+    NOTE: For more on baseline, architecture-specific, and family-specific feature sets, see
+    https://developer.nvidia.com/blog/nvidia-blackwell-and-nvidia-cuda-12-9-introduce-family-specific-architecture-features.
+
+    NOTE: For information on when support for a given architecture was added, see
+    https://docs.nvidia.com/cuda/parallel-thread-execution/#release-notes
+
+    NOTE: For baseline feature sets, `dontDefaultAfterCudaMajorMinorVersion` is generally set to the CUDA release
+    immediately prior to TensorRT removing support for that architecture.
+
+    Many thanks to Arnon Shimoni for maintaining a list of these architectures and capabilities.
+    Without your work, this would have been much more difficult.
+    https://arnon.dk/matching-sm-architectures-arch-and-gencode-for-various-nvidia-cards/
+
+    # Type
+
+    ```
+    cudaCapabilityToInfo ::
+      AttrSet
+        CudaCapability
+        { archName :: String
+        , cudaCapability :: CudaCapability
+        , isJetson :: Bool
+        , isArchitectureSpecific :: Bool
+        , isFamilySpecific :: Bool
+        , minCudaMajorMinorVersion :: MajorMinorVersion
+        , maxCudaMajorMinorVersion :: MajorMinorVersion
+        , dontDefaultAfterCudaMajorMinorVersion :: Null | MajorMinorVersion
+        }
+    ```
+
+    `archName`
+
+    : The name of the microarchitecture
+
+    `cudaCapability`
+
+    : The CUDA capability
+
+    `isJetson`
+
+    : Whether this capability is part of NVIDIA's line of Jetson embedded computers. This field is notable
+      because it tells us what architecture to build for (as Jetson devices are aarch64).
+      More on Jetson devices here: https://www.nvidia.com/en-us/autonomous-machines/embedded-systems/
+      NOTE: These architectures are only built upon request.
+
+    `isArchitectureSpecific`
+
+    : Whether this capability is an architecture-specific feature set.
+      NOTE: These architectures are only built upon request.
+
+    `isFamilySpecific`
+
+    : Whether this capability is a family-specific feature set.
+      NOTE: These architectures are only built upon request.
+
+    `minCudaMajorMinorVersion`
+
+    : The minimum (inclusive) CUDA version that supports this capability.
+
+    `maxCudaMajorMinorVersion`
+
+    : The maximum (exclusive) CUDA version that supports this capability.
+      `null` means there is no maximum.
+
+    `dontDefaultAfterCudaMajorMinorVersion`
+
+    : The CUDA version after which to exclude this capability from the list of default capabilities we build.
+  */
+  cudaCapabilityToInfo =
+    lib.mapAttrs
+      (
+        cudaCapability:
+        # Supplies default values.
+        {
+          archName,
+          isJetson ? false,
+          isArchitectureSpecific ? (lib.hasSuffix "a" cudaCapability),
+          isFamilySpecific ? (lib.hasSuffix "f" cudaCapability),
+          minCudaMajorMinorVersion,
+          maxCudaMajorMinorVersion ? null,
+          dontDefaultAfterCudaMajorMinorVersion ? null,
+        }:
+        {
+          inherit
+            archName
+            cudaCapability
+            isJetson
+            isArchitectureSpecific
+            isFamilySpecific
+            minCudaMajorMinorVersion
+            maxCudaMajorMinorVersion
+            dontDefaultAfterCudaMajorMinorVersion
+            ;
+        }
+      )
+      {
+        # Tesla K40
+        "3.5" = {
+          archName = "Kepler";
+          minCudaMajorMinorVersion = "10.0";
+          dontDefaultAfterCudaMajorMinorVersion = "11.0";
+          maxCudaMajorMinorVersion = "11.8";
+        };
+
+        # Tesla K80
+        "3.7" = {
+          archName = "Kepler";
+          minCudaMajorMinorVersion = "10.0";
+          dontDefaultAfterCudaMajorMinorVersion = "11.0";
+          maxCudaMajorMinorVersion = "11.8";
+        };
+
+        # Tesla/Quadro M series
+        "5.0" = {
+          archName = "Maxwell";
+          minCudaMajorMinorVersion = "10.0";
+          dontDefaultAfterCudaMajorMinorVersion = "11.0";
+        };
+
+        # Quadro M6000 , GeForce 900, GTX-970, GTX-980, GTX Titan X
+        "5.2" = {
+          archName = "Maxwell";
+          minCudaMajorMinorVersion = "10.0";
+          dontDefaultAfterCudaMajorMinorVersion = "11.0";
+        };
+
+        # Quadro GP100, Tesla P100, DGX-1 (Generic Pascal)
+        "6.0" = {
+          archName = "Pascal";
+          minCudaMajorMinorVersion = "10.0";
+          # Removed from TensorRT 10.0, which corresponds to CUDA 12.4 release.
+          # https://docs.nvidia.com/deeplearning/tensorrt/archives/tensorrt-1001/support-matrix/index.html
+          dontDefaultAfterCudaMajorMinorVersion = "12.3";
+        };
+
+        # GTX 1080, GTX 1070, GTX 1060, GTX 1050, GTX 1030 (GP108), GT 1010 (GP108) Titan Xp, Tesla
+        # P40, Tesla P4, Discrete GPU on the NVIDIA Drive PX2
+        "6.1" = {
+          archName = "Pascal";
+          minCudaMajorMinorVersion = "10.0";
+          # Removed from TensorRT 10.0, which corresponds to CUDA 12.4 release.
+          # https://docs.nvidia.com/deeplearning/tensorrt/archives/tensorrt-1001/support-matrix/index.html
+          dontDefaultAfterCudaMajorMinorVersion = "12.3";
+        };
+
+        # DGX-1 with Volta, Tesla V100, GTX 1180 (GV104), Titan V, Quadro GV100
+        "7.0" = {
+          archName = "Volta";
+          minCudaMajorMinorVersion = "10.0";
+          # Removed from TensorRT 10.5, which corresponds to CUDA 12.6 release.
+          # https://docs.nvidia.com/deeplearning/tensorrt/archives/tensorrt-1050/support-matrix/index.html
+          dontDefaultAfterCudaMajorMinorVersion = "12.5";
+        };
+
+        # Jetson AGX Xavier, Drive AGX Pegasus, Xavier NX
+        "7.2" = {
+          archName = "Volta";
+          minCudaMajorMinorVersion = "10.0";
+          # Note: without `cuda_compat`, maxCudaMajorMinorVersion is 11.8
+          # https://docs.nvidia.com/cuda/cuda-for-tegra-appnote/index.html#deployment-considerations-for-cuda-upgrade-package
+          maxCudaMajorMinorVersion = "12.2";
+          isJetson = true;
+        };
+
+        # GTX/RTX Turing – GTX 1660 Ti, RTX 2060, RTX 2070, RTX 2080, Titan RTX, Quadro RTX 4000,
+        # Quadro RTX 5000, Quadro RTX 6000, Quadro RTX 8000, Quadro T1000/T2000, Tesla T4
+        "7.5" = {
+          archName = "Turing";
+          minCudaMajorMinorVersion = "10.0";
+        };
+
+        # NVIDIA A100 (the name “Tesla” has been dropped – GA100), NVIDIA DGX-A100
+        "8.0" = {
+          archName = "Ampere";
+          minCudaMajorMinorVersion = "11.2";
+        };
+
+        # Tesla GA10x cards, RTX Ampere – RTX 3080, GA102 – RTX 3090, RTX A2000, A3000, RTX A4000,
+        # A5000, A6000, NVIDIA A40, GA106 – RTX 3060, GA104 – RTX 3070, GA107 – RTX 3050, RTX A10, RTX
+        # A16, RTX A40, A2 Tensor Core GPU
+        "8.6" = {
+          archName = "Ampere";
+          minCudaMajorMinorVersion = "11.2";
+        };
+
+        # Jetson AGX Orin and Drive AGX Orin only
+        "8.7" = {
+          archName = "Ampere";
+          minCudaMajorMinorVersion = "11.5";
+          isJetson = true;
+        };
+
+        # NVIDIA GeForce RTX 4090, RTX 4080, RTX 6000, Tesla L40
+        "8.9" = {
+          archName = "Ada";
+          minCudaMajorMinorVersion = "11.8";
+        };
+
+        # NVIDIA H100 (GH100)
+        "9.0" = {
+          archName = "Hopper";
+          minCudaMajorMinorVersion = "11.8";
+        };
+
+        "9.0a" = {
+          archName = "Hopper";
+          minCudaMajorMinorVersion = "12.0";
+        };
+
+        # NVIDIA B100
+        "10.0" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.7";
+        };
+
+        "10.0a" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.7";
+        };
+
+        "10.0f" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.9";
+        };
+
+        # NVIDIA Jetson Thor Blackwell
+        "10.1" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.7";
+          isJetson = true;
+        };
+
+        "10.1a" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.7";
+          isJetson = true;
+        };
+
+        "10.1f" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.9";
+          isJetson = true;
+        };
+
+        # NVIDIA ???
+        "10.3" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.9";
+        };
+
+        "10.3a" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.9";
+        };
+
+        "10.3f" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.9";
+        };
+
+        # NVIDIA GeForce RTX 5090 (GB202) etc.
+        "12.0" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.8";
+        };
+
+        "12.0a" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.8";
+        };
+
+        "12.0f" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.9";
+        };
+
+        # NVIDIA ???
+        "12.1" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.9";
+        };
+
+        "12.1a" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.9";
+        };
+
+        "12.1f" = {
+          archName = "Blackwell";
+          minCudaMajorMinorVersion = "12.9";
+        };
+      };
+}
diff --git a/pkgs/development/cuda-modules/_cuda/db/bootstrap/default.nix b/pkgs/development/cuda-modules/_cuda/db/bootstrap/default.nix
new file mode 100644
index 000000000000..8cfea1406934
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/db/bootstrap/default.nix
@@ -0,0 +1,30 @@
+{ lib }:
+{
+  # See ./cuda.nix for documentation.
+  inherit (import ./cuda.nix { inherit lib; })
+    cudaCapabilityToInfo
+    ;
+
+  # See ./nvcc.nix for documentation.
+  inherit (import ./nvcc.nix)
+    nvccCompatibilities
+    ;
+
+  # See ./redist.nix for documentation.
+  inherit (import ./redist.nix)
+    redistNames
+    redistSystems
+    redistUrlPrefix
+    ;
+
+  /**
+    The path to the CUDA packages root directory, for use with `callPackage` to create new package sets.
+
+    # Type
+
+    ```
+    cudaPackagesPath :: Path
+    ```
+  */
+  cudaPackagesPath = ./../../..;
+}
diff --git a/pkgs/development/cuda-modules/_cuda/db/bootstrap/nvcc.nix b/pkgs/development/cuda-modules/_cuda/db/bootstrap/nvcc.nix
new file mode 100644
index 000000000000..535f64b40991
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/db/bootstrap/nvcc.nix
@@ -0,0 +1,268 @@
+{
+  /**
+      Mapping of CUDA versions to NVCC compatibilities
+
+      Taken from
+      https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+
+        NVCC performs a version check on the host compiler's major version and so newer minor versions
+        of the compilers listed below will be supported, but major versions falling outside the range
+        will not be supported.
+
+      NOTE: These constraints don't apply to Jetson, which uses something else.
+
+      NOTE: NVIDIA can and will add support for newer compilers even during patch releases.
+      E.g.: CUDA 12.2.1 maxxed out with support for Clang 15.0; 12.2.2 added support for Clang 16.0.
+
+      NOTE: Because all platforms NVIDIA supports use GCC and Clang, we omit the architectures here.
+
+      # Type
+
+      ```
+      nvccCompatibilities ::
+        AttrSet
+          String
+          { clang :: { maxMajorVersion :: String, minMajorVersion :: String }
+          , gcc :: { maxMajorVersion :: String, minMajorVersion :: String }
+          }
+      ```
+  */
+  nvccCompatibilities = {
+    # Our baseline
+    # https://docs.nvidia.com/cuda/archive/11.0/cuda-toolkit-release-notes/index.html#cuda-compiler-new-features
+    "11.0" = {
+      clang = {
+        maxMajorVersion = "9";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "9";
+        minMajorVersion = "6";
+      };
+    };
+
+    # Added support for Clang 10 and GCC 10
+    # https://docs.nvidia.com/cuda/archive/11.1.1/cuda-toolkit-release-notes/index.html#cuda-compiler-new-features
+    "11.1" = {
+      clang = {
+        maxMajorVersion = "10";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "10";
+        minMajorVersion = "6";
+      };
+    };
+
+    # Added support for Clang 11
+    # https://docs.nvidia.com/cuda/archive/11.2.2/cuda-installation-guide-linux/index.html#system-requirements
+    "11.2" = {
+      clang = {
+        maxMajorVersion = "11";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "10";
+        minMajorVersion = "6";
+      };
+    };
+
+    # No changes from 11.2 to 11.3
+    "11.3" = {
+      clang = {
+        maxMajorVersion = "11";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "10";
+        minMajorVersion = "6";
+      };
+    };
+
+    # Added support for Clang 12 and GCC 11
+    # https://docs.nvidia.com/cuda/archive/11.4.4/cuda-toolkit-release-notes/index.html#cuda-general-new-features
+    # NOTE: There is a bug in the version of GLIBC that GCC 11 uses which causes it to fail to compile some CUDA
+    # code. As such, we skip it for this release, and do the bump in 11.6 (skipping 11.5).
+    # https://forums.developer.nvidia.com/t/cuda-11-5-samples-throw-multiple-error-attribute-malloc-does-not-take-arguments/192750/15
+    "11.4" = {
+      clang = {
+        maxMajorVersion = "12";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "10";
+        minMajorVersion = "6";
+      };
+    };
+
+    # No changes from 11.4 to 11.5
+    "11.5" = {
+      clang = {
+        maxMajorVersion = "12";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "10";
+        minMajorVersion = "6";
+      };
+    };
+
+    # No changes from 11.5 to 11.6
+    # However, as mentioned above, we add GCC 11 this release.
+    "11.6" = {
+      clang = {
+        maxMajorVersion = "12";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "11";
+        minMajorVersion = "6";
+      };
+    };
+
+    # Added support for Clang 13
+    # https://docs.nvidia.com/cuda/archive/11.7.1/cuda-toolkit-release-notes/index.html#cuda-compiler-new-features
+    "11.7" = {
+      clang = {
+        maxMajorVersion = "13";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "11";
+        minMajorVersion = "6";
+      };
+    };
+
+    # Added support for Clang 14
+    # https://docs.nvidia.com/cuda/archive/11.8.0/cuda-installation-guide-linux/index.html#system-requirements
+    "11.8" = {
+      clang = {
+        maxMajorVersion = "14";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "11";
+        minMajorVersion = "6";
+      };
+    };
+
+    # Added support for GCC 12
+    # https://docs.nvidia.com/cuda/archive/12.0.1/cuda-installation-guide-linux/index.html#system-requirements
+    "12.0" = {
+      clang = {
+        maxMajorVersion = "14";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "12";
+        minMajorVersion = "6";
+      };
+    };
+
+    # Added support for Clang 15
+    # https://docs.nvidia.com/cuda/archive/12.1.1/cuda-toolkit-release-notes/index.html#cuda-compilers-new-features
+    "12.1" = {
+      clang = {
+        maxMajorVersion = "15";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "12";
+        minMajorVersion = "6";
+      };
+    };
+
+    # Added support for Clang 16
+    # https://docs.nvidia.com/cuda/archive/12.2.2/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    "12.2" = {
+      clang = {
+        maxMajorVersion = "16";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "12";
+        minMajorVersion = "6";
+      };
+    };
+
+    # No changes from 12.2 to 12.3
+    # https://docs.nvidia.com/cuda/archive/12.3.2/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    "12.3" = {
+      clang = {
+        maxMajorVersion = "16";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "12";
+        minMajorVersion = "6";
+      };
+    };
+
+    # Maximum Clang version is 17
+    # Minimum GCC version is still 6, but all versions prior to GCC 7.3 are deprecated.
+    # Maximum GCC version is 13.2
+    # https://docs.nvidia.com/cuda/archive/12.4.1/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    "12.4" = {
+      clang = {
+        maxMajorVersion = "17";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "13";
+        minMajorVersion = "6";
+      };
+    };
+
+    # No changes from 12.4 to 12.5
+    # https://docs.nvidia.com/cuda/archive/12.5.1/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    "12.5" = {
+      clang = {
+        maxMajorVersion = "17";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "13";
+        minMajorVersion = "6";
+      };
+    };
+
+    # Maximum Clang version is 18
+    # https://docs.nvidia.com/cuda/archive/12.6.0/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    "12.6" = {
+      clang = {
+        maxMajorVersion = "18";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "13";
+        minMajorVersion = "6";
+      };
+    };
+
+    # Maximum Clang version is 19, maximum GCC version is 14
+    # https://docs.nvidia.com/cuda/archive/12.8.1/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    "12.8" = {
+      clang = {
+        maxMajorVersion = "19";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "14";
+        minMajorVersion = "6";
+      };
+    };
+
+    # No changes from 12.8 to 12.9
+    # https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    "12.9" = {
+      clang = {
+        maxMajorVersion = "19";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "14";
+        minMajorVersion = "6";
+      };
+    };
+  };
+}
diff --git a/pkgs/development/cuda-modules/_cuda/db/bootstrap/redist.nix b/pkgs/development/cuda-modules/_cuda/db/bootstrap/redist.nix
new file mode 100644
index 000000000000..52e91f81c35c
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/db/bootstrap/redist.nix
@@ -0,0 +1,56 @@
+{
+  /**
+    A list of redistributable names to use in creation of the `redistName` option type.
+
+    # Type
+
+    ```
+    redistNames :: [String]
+    ```
+  */
+  redistNames = [
+    "cublasmp"
+    "cuda"
+    "cudnn"
+    "cudss"
+    "cuquantum"
+    "cusolvermp"
+    "cusparselt"
+    "cutensor"
+    "nppplus"
+    "nvcomp"
+    # "nvidia-driver",  # NOTE: Some of the earlier manifests don't follow our scheme.
+    "nvjpeg2000"
+    "nvpl"
+    "nvtiff"
+    "tensorrt" # NOTE: not truly a redist; uses different naming convention
+  ];
+
+  /**
+    A list of redistributable systems to use in creation of the `redistSystem` option type.
+
+    # Type
+
+    ```
+    redistSystems :: [String]
+    ```
+  */
+  redistSystems = [
+    "linux-aarch64"
+    "linux-all" # Taken to mean all other linux systems
+    "linux-sbsa"
+    "linux-x86_64"
+    "source" # Source-agnostic platform
+  ];
+
+  /**
+    The prefix of the URL for redistributable files.
+
+    # Type
+
+    ```
+    redistUrlPrefix :: String
+    ```
+  */
+  redistUrlPrefix = "https://developer.download.nvidia.com/compute";
+}
diff --git a/pkgs/development/cuda-modules/_cuda/db/default.nix b/pkgs/development/cuda-modules/_cuda/db/default.nix
new file mode 100644
index 000000000000..e6d404102aab
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/db/default.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  bootstrapData,
+  db,
+}:
+
+bootstrapData
+// {
+  /**
+    All CUDA capabilities, sorted by version.
+
+    NOTE: Since the capabilities are sorted by version and architecture/family-specific features are
+    appended to the minor version component, the sorted list groups capabilities by baseline feature
+    set.
+
+    # Type
+
+    ```
+    allSortedCudaCapabilities :: [CudaCapability]
+    ```
+
+    # Example
+
+    ```
+    allSortedCudaCapabilities = [
+      "5.0"
+      "5.2"
+      "6.0"
+      "6.1"
+      "7.0"
+      "7.2"
+      "7.5"
+      "8.0"
+      "8.6"
+      "8.7"
+      "8.9"
+      "9.0"
+      "9.0a"
+      "10.0"
+      "10.0a"
+      "10.0f"
+      "10.1"
+      "10.1a"
+      "10.1f"
+      "10.3"
+      "10.3a"
+      "10.3f"
+    ];
+    ```
+  */
+  allSortedCudaCapabilities = lib.sort lib.versionOlder (lib.attrNames db.cudaCapabilityToInfo);
+
+  /**
+    Mapping of CUDA micro-architecture name to capabilities belonging to that micro-architecture.
+
+    # Type
+
+    ```
+    cudaArchNameToCapabilities :: AttrSet NonEmptyStr (NonEmptyListOf CudaCapability)
+    ```
+  */
+  cudaArchNameToCapabilities = lib.groupBy (
+    cudaCapability: db.cudaCapabilityToInfo.${cudaCapability}.archName
+  ) db.allSortedCudaCapabilities;
+}
diff --git a/pkgs/development/cuda-modules/_cuda/default.nix b/pkgs/development/cuda-modules/_cuda/default.nix
new file mode 100644
index 000000000000..0f6f80506616
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/default.nix
@@ -0,0 +1,30 @@
+# The _cuda attribute set is a fixed-point which contains the static functionality required to construct CUDA package
+# sets. For example, `_cuda.bootstrapData` includes information about NVIDIA's redistributables (such as the names
+# NVIDIA uses for different systems), `_cuda.lib` contains utility functions like `formatCapabilities` (which generate
+# common arguments passed to NVCC and `cmakeFlags`), and `_cuda.fixups` contains `callPackage`-able functions which
+# are provided to the corresponding package's `overrideAttrs` attribute to provide package-specific fixups
+# out of scope of the generic redistributable builder.
+#
+# Since this attribute set is used to construct the CUDA package sets, it must exist outside the fixed point of the
+# package sets. Make these attributes available directly in the package set construction could cause confusion if
+# users override the attribute set with the expection that changes will be reflected in the enclosing CUDA package
+# set. To avoid this, we declare `_cuda` and inherit its members here, at top-level. (This also allows us to benefit
+# from import caching, as it should be evaluated once per system, rather than per-system and CUDA package set.)
+
+let
+  lib = import ../../../../lib;
+in
+lib.fixedPoints.makeExtensible (final: {
+  bootstrapData = import ./db/bootstrap {
+    inherit lib;
+  };
+  db = import ./db {
+    inherit (final) bootstrapData db;
+    inherit lib;
+  };
+  fixups = import ./fixups { inherit lib; };
+  lib = import ./lib {
+    _cuda = final;
+    inherit lib;
+  };
+})
diff --git a/pkgs/development/cuda-modules/fixups/cuda_compat.nix b/pkgs/development/cuda-modules/_cuda/fixups/cuda_compat.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/cuda_compat.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/cuda_compat.nix
diff --git a/pkgs/development/cuda-modules/fixups/cuda_cudart.nix b/pkgs/development/cuda-modules/_cuda/fixups/cuda_cudart.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/cuda_cudart.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/cuda_cudart.nix
diff --git a/pkgs/development/cuda-modules/fixups/cuda_demo_suite.nix b/pkgs/development/cuda-modules/_cuda/fixups/cuda_demo_suite.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/cuda_demo_suite.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/cuda_demo_suite.nix
diff --git a/pkgs/development/cuda-modules/fixups/cuda_gdb.nix b/pkgs/development/cuda-modules/_cuda/fixups/cuda_gdb.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/cuda_gdb.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/cuda_gdb.nix
diff --git a/pkgs/development/cuda-modules/fixups/cuda_nvcc.nix b/pkgs/development/cuda-modules/_cuda/fixups/cuda_nvcc.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/cuda_nvcc.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/cuda_nvcc.nix
diff --git a/pkgs/development/cuda-modules/fixups/cuda_nvprof.nix b/pkgs/development/cuda-modules/_cuda/fixups/cuda_nvprof.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/cuda_nvprof.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/cuda_nvprof.nix
diff --git a/pkgs/development/cuda-modules/fixups/cuda_sanitizer_api.nix b/pkgs/development/cuda-modules/_cuda/fixups/cuda_sanitizer_api.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/cuda_sanitizer_api.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/cuda_sanitizer_api.nix
diff --git a/pkgs/development/cuda-modules/fixups/cudnn.nix b/pkgs/development/cuda-modules/_cuda/fixups/cudnn.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/cudnn.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/cudnn.nix
diff --git a/pkgs/development/cuda-modules/fixups/default.nix b/pkgs/development/cuda-modules/_cuda/fixups/default.nix
similarity index 99%
rename from pkgs/development/cuda-modules/fixups/default.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/default.nix
index 9166e413bb71..0c9874672ce4 100644
--- a/pkgs/development/cuda-modules/fixups/default.nix
+++ b/pkgs/development/cuda-modules/_cuda/fixups/default.nix
@@ -1,5 +1,4 @@
 { lib }:
-
 lib.concatMapAttrs (
   fileName: _type:
   let
diff --git a/pkgs/development/cuda-modules/fixups/nvidia_driver.nix b/pkgs/development/cuda-modules/_cuda/fixups/driver_assistant.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/nvidia_driver.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/driver_assistant.nix
diff --git a/pkgs/development/cuda-modules/fixups/fabricmanager.nix b/pkgs/development/cuda-modules/_cuda/fixups/fabricmanager.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/fabricmanager.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/fabricmanager.nix
diff --git a/pkgs/development/cuda-modules/fixups/imex.nix b/pkgs/development/cuda-modules/_cuda/fixups/imex.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/imex.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/imex.nix
diff --git a/pkgs/development/cuda-modules/fixups/libcufile.nix b/pkgs/development/cuda-modules/_cuda/fixups/libcufile.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/libcufile.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/libcufile.nix
diff --git a/pkgs/development/cuda-modules/fixups/libcusolver.nix b/pkgs/development/cuda-modules/_cuda/fixups/libcusolver.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/libcusolver.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/libcusolver.nix
diff --git a/pkgs/development/cuda-modules/fixups/libcusparse.nix b/pkgs/development/cuda-modules/_cuda/fixups/libcusparse.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/libcusparse.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/libcusparse.nix
diff --git a/pkgs/development/cuda-modules/fixups/libcusparse_lt.nix b/pkgs/development/cuda-modules/_cuda/fixups/libcusparse_lt.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/libcusparse_lt.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/libcusparse_lt.nix
diff --git a/pkgs/development/cuda-modules/fixups/libcutensor.nix b/pkgs/development/cuda-modules/_cuda/fixups/libcutensor.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/libcutensor.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/libcutensor.nix
diff --git a/pkgs/development/cuda-modules/fixups/nsight_compute.nix b/pkgs/development/cuda-modules/_cuda/fixups/nsight_compute.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/nsight_compute.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/nsight_compute.nix
diff --git a/pkgs/development/cuda-modules/fixups/nsight_systems.nix b/pkgs/development/cuda-modules/_cuda/fixups/nsight_systems.nix
similarity index 100%
rename from pkgs/development/cuda-modules/fixups/nsight_systems.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/nsight_systems.nix
diff --git a/pkgs/development/cuda-modules/_cuda/fixups/nvidia_driver.nix b/pkgs/development/cuda-modules/_cuda/fixups/nvidia_driver.nix
new file mode 100644
index 000000000000..e9c50b2f4eaf
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/fixups/nvidia_driver.nix
@@ -0,0 +1,5 @@
+_: prevAttrs: {
+  badPlatformsConditions = prevAttrs.badPlatformsConditions or { } // {
+    "Package is not supported; use drivers from linuxPackages" = true;
+  };
+}
diff --git a/pkgs/development/cuda-modules/fixups/tensorrt.nix b/pkgs/development/cuda-modules/_cuda/fixups/tensorrt.nix
similarity index 96%
rename from pkgs/development/cuda-modules/fixups/tensorrt.nix
rename to pkgs/development/cuda-modules/_cuda/fixups/tensorrt.nix
index a836debf0604..2b73e8c2d4be 100644
--- a/pkgs/development/cuda-modules/fixups/tensorrt.nix
+++ b/pkgs/development/cuda-modules/_cuda/fixups/tensorrt.nix
@@ -1,9 +1,9 @@
 {
+  _cuda,
   cudaOlder,
   cudaPackages,
   cudaMajorMinorVersion,
   lib,
-  mkVersionedPackageName,
   patchelf,
   requireFile,
   stdenv,
@@ -103,7 +103,9 @@ finalAttrs: prevAttrs: {
     # unless it is not available, in which case the default cudnn derivation will be used.
     cudnn =
       let
-        desiredName = mkVersionedPackageName "cudnn" finalAttrs.passthru.featureRelease.cudnnVersion;
+        desiredName = _cuda.lib.mkVersionedName "cudnn" (
+          lib.versions.majorMinor finalAttrs.passthru.featureRelease.cudnnVersion
+        );
       in
       if finalAttrs.passthru.featureRelease.cudnnVersion == null || (cudaPackages ? desiredName) then
         cudaPackages.cudnn
diff --git a/pkgs/development/cuda-modules/_cuda/lib/assertions.nix b/pkgs/development/cuda-modules/_cuda/lib/assertions.nix
new file mode 100644
index 000000000000..f4413b28e4f3
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/lib/assertions.nix
@@ -0,0 +1,139 @@
+{ _cuda, lib }:
+{
+  /**
+    Evaluate assertions and add error context to return value.
+
+    NOTE: No guarantees are made about this function's stability. You may use it at your own risk.
+
+    # Type
+
+    ```
+    _evaluateAssertions
+      :: (assertions :: List { assertion :: Bool, message :: String })
+      -> Bool
+    ```
+  */
+  _evaluateAssertions =
+    assertions:
+    let
+      failedAssertionsString = _cuda.lib._mkFailedAssertionsString assertions;
+    in
+    if failedAssertionsString == "" then
+      true
+    else
+      lib.addErrorContext "with failed assertions:${failedAssertionsString}" false;
+
+  /**
+    Function to generate a string of failed assertions.
+
+    NOTE: No guarantees are made about this function's stability. You may use it at your own risk.
+
+    # Type
+
+    ```
+    _mkFailedAssertionsString
+      :: (assertions :: List { assertion :: Bool, message :: String })
+      -> String
+    ```
+
+    # Inputs
+
+    `assertions`
+
+    : A list of assertions to evaluate
+
+    # Examples
+
+    :::{.example}
+    ## `_cuda.lib._mkFailedAssertionsString` usage examples
+
+    ```nix
+    _mkFailedAssertionsString [
+      { assertion = false; message = "Assertion 1 failed"; }
+      { assertion = true; message = "Assertion 2 failed"; }
+    ]
+    => "\n- Assertion 1 failed"
+    ```
+
+    ```nix
+    _mkFailedAssertionsString [
+      { assertion = false; message = "Assertion 1 failed"; }
+      { assertion = false; message = "Assertion 2 failed"; }
+    ]
+    => "\n- Assertion 1 failed\n- Assertion 2 failed"
+    ```
+    :::
+  */
+  _mkFailedAssertionsString = lib.foldl' (
+    failedAssertionsString:
+    { assertion, message }:
+    failedAssertionsString + lib.optionalString (!assertion) ("\n- " + message)
+  ) "";
+
+  /**
+    Utility function to generate assertions for missing packages.
+
+    Used to mark a package as unsupported if any of its required packages are missing (null).
+
+    Expects a set of attributes.
+
+    Most commonly used in overrides files on a callPackage-provided attribute set of packages.
+
+    NOTE: We typically use platfromAssertions instead of brokenAssertions because the presence of packages set to null
+    means evaluation will fail if package attributes are accessed without checking for null first. OfBorg evaluation
+    sets allowBroken to true, which means we can't rely on brokenAssertions to prevent evaluation of a package with
+    missing dependencies.
+
+    NOTE: No guarantees are made about this function's stability. You may use it at your own risk.
+
+    # Type
+
+    ```
+    _mkMissingPackagesAssertions
+      :: (attrs :: AttrSet)
+      -> (assertions :: List { assertion :: Bool, message :: String })
+    ```
+
+    # Inputs
+
+    `attrs`
+
+    : The attributes to check for null
+
+    # Examples
+
+    :::{.example}
+    ## `_cuda.lib._mkMissingPackagesAssertions` usage examples
+
+    ```nix
+    {
+      lib,
+      libcal ? null,
+      libcublas,
+      utils,
+    }:
+    let
+      inherit (lib.attrsets) recursiveUpdate;
+      inherit (_cuda.lib) _mkMissingPackagesAssertions;
+    in
+    prevAttrs: {
+      passthru = prevAttrs.passthru or { } // {
+        platformAssertions =
+          prevAttrs.passthru.platformAssertions or [ ]
+          ++ _mkMissingPackagesAssertions { inherit libcal; };
+      };
+    }
+    ```
+    :::
+  */
+  _mkMissingPackagesAssertions = lib.flip lib.pipe [
+    # Take the attributes that are null.
+    (lib.filterAttrs (_: value: value == null))
+    lib.attrNames
+    # Map them to assertions.
+    (lib.map (name: {
+      message = "${name} is available";
+      assertion = false;
+    }))
+  ];
+}
diff --git a/pkgs/development/cuda-modules/_cuda/lib/cuda.nix b/pkgs/development/cuda-modules/_cuda/lib/cuda.nix
new file mode 100644
index 000000000000..16f99e57709a
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/lib/cuda.nix
@@ -0,0 +1,129 @@
+{ lib }:
+{
+  /**
+    Returns whether a capability should be built by default for a particular CUDA version.
+
+    Capabilities built by default are baseline, non-Jetson capabilities with relatively recent CUDA support.
+
+    NOTE: No guarantees are made about this function's stability. You may use it at your own risk.
+
+    # Type
+
+    ```
+    _cudaCapabilityIsDefault
+      :: (cudaMajorMinorVersion :: Version)
+      -> (cudaCapabilityInfo :: CudaCapabilityInfo)
+      -> Bool
+    ```
+
+    # Inputs
+
+    `cudaMajorMinorVersion`
+
+    : The CUDA version to check
+
+    `cudaCapabilityInfo`
+
+    : The capability information to check
+  */
+  _cudaCapabilityIsDefault =
+    cudaMajorMinorVersion: cudaCapabilityInfo:
+    let
+      recentCapability =
+        cudaCapabilityInfo.dontDefaultAfterCudaMajorMinorVersion == null
+        || lib.versionAtLeast cudaCapabilityInfo.dontDefaultAfterCudaMajorMinorVersion cudaMajorMinorVersion;
+    in
+    recentCapability
+    && !cudaCapabilityInfo.isJetson
+    && !cudaCapabilityInfo.isArchitectureSpecific
+    && !cudaCapabilityInfo.isFamilySpecific;
+
+  /**
+    Returns whether a capability is supported for a particular CUDA version.
+
+    NOTE: No guarantees are made about this function's stability. You may use it at your own risk.
+
+    # Type
+
+    ```
+    _cudaCapabilityIsSupported
+      :: (cudaMajorMinorVersion :: Version)
+      -> (cudaCapabilityInfo :: CudaCapabilityInfo)
+      -> Bool
+    ```
+
+    # Inputs
+
+    `cudaMajorMinorVersion`
+
+    : The CUDA version to check
+
+    `cudaCapabilityInfo`
+
+    : The capability information to check
+  */
+  _cudaCapabilityIsSupported =
+    cudaMajorMinorVersion: cudaCapabilityInfo:
+    let
+      lowerBoundSatisfied = lib.versionAtLeast cudaMajorMinorVersion cudaCapabilityInfo.minCudaMajorMinorVersion;
+      upperBoundSatisfied =
+        cudaCapabilityInfo.maxCudaMajorMinorVersion == null
+        || lib.versionAtLeast cudaCapabilityInfo.maxCudaMajorMinorVersion cudaMajorMinorVersion;
+    in
+    lowerBoundSatisfied && upperBoundSatisfied;
+
+  /**
+    Generates a CUDA variant name from a version.
+
+    NOTE: No guarantees are made about this function's stability. You may use it at your own risk.
+
+    # Type
+
+    ```
+    _mkCudaVariant :: (version :: String) -> String
+    ```
+
+    # Inputs
+
+    `version`
+
+    : The version string
+
+    # Examples
+
+    :::{.example}
+    ## `_cuda.lib._mkCudaVariant` usage examples
+
+    ```nix
+    _mkCudaVariant "11.0"
+    => "cuda11"
+    ```
+    :::
+  */
+  _mkCudaVariant = version: "cuda${lib.versions.major version}";
+
+  /**
+    A predicate which, given a package, returns true if the package has a free license or one of NVIDIA's licenses.
+
+    This function is intended to be provided as `config.allowUnfreePredicate` when `import`-ing Nixpkgs.
+
+    # Type
+
+    ```
+    allowUnfreeCudaPredicate :: (package :: Package) -> Bool
+    ```
+  */
+  allowUnfreeCudaPredicate =
+    package:
+    lib.all (
+      license:
+      license.free
+      || lib.elem license.shortName [
+        "CUDA EULA"
+        "cuDNN EULA"
+        "cuSPARSELt EULA"
+        "cuTENSOR EULA"
+        "NVidia OptiX EULA"
+      ]
+    ) (lib.toList package.meta.license);
+}
diff --git a/pkgs/development/cuda-modules/_cuda/lib/default.nix b/pkgs/development/cuda-modules/_cuda/lib/default.nix
new file mode 100644
index 000000000000..b2fe9838de61
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/lib/default.nix
@@ -0,0 +1,52 @@
+{
+  _cuda,
+  lib,
+}:
+{
+  # See ./assertions.nix for documentation.
+  inherit (import ./assertions.nix { inherit _cuda lib; })
+    _evaluateAssertions
+    _mkFailedAssertionsString
+    _mkMissingPackagesAssertions
+    ;
+
+  # See ./cuda.nix for documentation.
+  inherit (import ./cuda.nix { inherit lib; })
+    _cudaCapabilityIsDefault
+    _cudaCapabilityIsSupported
+    _mkCudaVariant
+    allowUnfreeCudaPredicate
+    ;
+
+  # See ./meta.nix for documentation.
+  inherit (import ./meta.nix { inherit _cuda lib; })
+    _mkMetaBadPlatforms
+    _mkMetaBroken
+    ;
+
+  # See ./redist.nix for documentation.
+  inherit (import ./redist.nix { inherit _cuda lib; })
+    _redistSystemIsSupported
+    getNixSystems
+    getRedistSystem
+    mkRedistUrl
+    ;
+
+  # See ./strings.nix for documentation.
+  inherit (import ./strings.nix { inherit _cuda lib; })
+    dotsToUnderscores
+    dropDots
+    formatCapabilities
+    mkCmakeCudaArchitecturesString
+    mkGencodeFlag
+    mkRealArchitecture
+    mkVersionedName
+    mkVirtualArchitecture
+    ;
+
+  # See ./versions.nix for documentation.
+  inherit (import ./versions.nix { inherit _cuda lib; })
+    majorMinorPatch
+    trimComponents
+    ;
+}
diff --git a/pkgs/development/cuda-modules/_cuda/lib/meta.nix b/pkgs/development/cuda-modules/_cuda/lib/meta.nix
new file mode 100644
index 000000000000..72f71973b0cd
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/lib/meta.nix
@@ -0,0 +1,71 @@
+{ _cuda, lib }:
+{
+  /**
+    Returns a list of bad platforms for a given package if assertsions in `finalAttrs.passthru.platformAssertions`
+    fail, optionally logging evaluation warnings for each reason.
+
+    NOTE: No guarantees are made about this function's stability. You may use it at your own risk.
+
+    NOTE: This function requires `finalAttrs.passthru.platformAssertions` to be a list of assertions and
+    `finalAttrs.finalPackage.name` and `finalAttrs.finalPackage.stdenv` to be available.
+
+    # Type
+
+    ```
+    _mkMetaBadPlatforms :: (warn :: Bool) -> (finalAttrs :: AttrSet) -> List String
+    ```
+  */
+  _mkMetaBadPlatforms =
+    warn: finalAttrs:
+    let
+      failedAssertionsString = _cuda.lib._mkFailedAssertionsString finalAttrs.passthru.platformAssertions;
+      hasFailedAssertions = failedAssertionsString != "";
+      finalStdenv = finalAttrs.finalPackage.stdenv;
+    in
+    lib.warnIf (warn && hasFailedAssertions)
+      "Package ${finalAttrs.finalPackage.name} is unsupported on this platform due to the following failed assertions:${failedAssertionsString}"
+      (
+        lib.optionals hasFailedAssertions (
+          lib.unique [
+            finalStdenv.buildPlatform.system
+            finalStdenv.hostPlatform.system
+            finalStdenv.targetPlatform.system
+          ]
+        )
+      );
+
+  /**
+    Returns a boolean indicating whether the package is broken as a result of `finalAttrs.passthru.brokenAssertions`,
+    optionally logging evaluation warnings for each reason.
+
+    NOTE: No guarantees are made about this function's stability. You may use it at your own risk.
+
+    NOTE: This function requires `finalAttrs.passthru.brokenAssertions` to be a list of assertions and
+    `finalAttrs.finalPackage.name` to be available.
+
+    # Type
+
+    ```
+    _mkMetaBroken :: (warn :: Bool) -> (finalAttrs :: AttrSet) -> Bool
+    ```
+
+    # Inputs
+
+    `warn`
+
+    : A boolean indicating whether to log warnings
+
+    `finalAttrs`
+
+    : The final attributes of the package
+  */
+  _mkMetaBroken =
+    warn: finalAttrs:
+    let
+      failedAssertionsString = _cuda.lib._mkFailedAssertionsString finalAttrs.passthru.brokenAssertions;
+      hasFailedAssertions = failedAssertionsString != "";
+    in
+    lib.warnIf (warn && hasFailedAssertions)
+      "Package ${finalAttrs.finalPackage.name} is marked as broken due to the following failed assertions:${failedAssertionsString}"
+      hasFailedAssertions;
+}
diff --git a/pkgs/development/cuda-modules/_cuda/lib/redist.nix b/pkgs/development/cuda-modules/_cuda/lib/redist.nix
new file mode 100644
index 000000000000..a7053dc582c4
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/lib/redist.nix
@@ -0,0 +1,196 @@
+{ _cuda, lib }:
+{
+  /**
+    Returns a boolean indicating whether the provided redist system is supported by any of the provided redist systems.
+
+    NOTE: No guarantees are made about this function's stability. You may use it at your own risk.
+
+    # Type
+
+    ```
+    _redistSystemIsSupported
+      :: (redistSystem :: RedistSystem)
+      -> (redistSystems :: List RedistSystem)
+      -> Bool
+    ```
+
+    # Inputs
+
+    `redistSystem`
+
+    : The redist system to check
+
+    `redistSystems`
+
+    : The list of redist systems to check against
+
+    # Examples
+
+    :::{.example}
+    ## `cudaLib._redistSystemIsSupported` usage examples
+
+    ```nix
+    _redistSystemIsSupported "linux-x86_64" [ "linux-x86_64" ]
+    => true
+    ```
+
+    ```nix
+    _redistSystemIsSupported "linux-x86_64" [ "linux-aarch64" ]
+    => false
+    ```
+
+    ```nix
+    _redistSystemIsSupported "linux-x86_64" [ "linux-aarch64" "linux-x86_64" ]
+    => true
+    ```
+
+    ```nix
+    _redistSystemIsSupported "linux-x86_64" [ "linux-aarch64" "linux-all" ]
+    => true
+    ```
+    :::
+  */
+  _redistSystemIsSupported =
+    redistSystem: redistSystems:
+    lib.findFirst (
+      redistSystem':
+      redistSystem' == redistSystem || redistSystem' == "linux-all" || redistSystem' == "source"
+    ) null redistSystems != null;
+
+  /**
+    Maps a NVIDIA redistributable system to Nix systems.
+
+    NOTE: This function returns a list of systems because the redistributable systems `"linux-all"` and `"source"` can
+    be built on multiple systems.
+
+    NOTE: This function *will* be called by unsupported systems because `cudaPackages` is evaluated on all systems. As
+    such, we need to handle unsupported systems gracefully.
+
+    # Type
+
+    ```
+    getNixSystems :: (redistSystem :: RedistSystem) -> [String]
+    ```
+
+    # Inputs
+
+    `redistSystem`
+
+    : The NVIDIA redistributable system
+
+    # Examples
+
+    :::{.example}
+    ## `cudaLib.getNixSystems` usage examples
+
+    ```nix
+    getNixSystems "linux-sbsa"
+    => [ "aarch64-linux" ]
+    ```
+
+    ```nix
+    getNixSystems "linux-aarch64"
+    => [ "aarch64-linux" ]
+    ```
+    :::
+  */
+  getNixSystems =
+    redistSystem:
+    if redistSystem == "linux-x86_64" then
+      [ "x86_64-linux" ]
+    else if redistSystem == "linux-sbsa" || redistSystem == "linux-aarch64" then
+      [ "aarch64-linux" ]
+    else if redistSystem == "linux-all" || redistSystem == "source" then
+      [
+        "aarch64-linux"
+        "x86_64-linux"
+      ]
+    else
+      [ ];
+
+  /**
+    Maps a Nix system to a NVIDIA redistributable system.
+
+    NOTE: We swap out the default `linux-sbsa` redist (for server-grade ARM chips) with the `linux-aarch64` redist
+    (which is for Jetson devices) if we're building any Jetson devices. Since both are based on aarch64, we can only
+    have one or the other, otherwise there's an ambiguity as to which should be used.
+
+    NOTE: This function *will* be called by unsupported systems because `cudaPackages` is evaluated on all systems. As
+    such, we need to handle unsupported systems gracefully.
+
+    # Type
+
+    ```
+    getRedistSystem :: (hasJetsonCudaCapability :: Bool) -> (nixSystem :: String) -> String
+    ```
+
+    # Inputs
+
+    `hasJetsonCudaCapability`
+
+    : If configured for a Jetson device
+
+    `nixSystem`
+
+    : The Nix system
+
+    # Examples
+
+    :::{.example}
+    ## `cudaLib.getRedistSystem` usage examples
+
+    ```nix
+    getRedistSystem true "aarch64-linux"
+    => "linux-aarch64"
+    ```
+
+    ```nix
+    getRedistSystem false "aarch64-linux"
+    => "linux-sbsa"
+    ```
+    :::
+  */
+  getRedistSystem =
+    hasJetsonCudaCapability: nixSystem:
+    if nixSystem == "x86_64-linux" then
+      "linux-x86_64"
+    else if nixSystem == "aarch64-linux" then
+      if hasJetsonCudaCapability then "linux-aarch64" else "linux-sbsa"
+    else
+      "unsupported";
+
+  /**
+    Function to generate a URL for something in the redistributable tree.
+
+    # Type
+
+    ```
+    mkRedistUrl :: (redistName :: RedistName) -> (relativePath :: NonEmptyStr) -> RedistUrl
+    ```
+
+    # Inputs
+
+    `redistName`
+
+    : The name of the redistributable
+
+    `relativePath`
+
+    : The relative path to a file in the redistributable tree
+  */
+  mkRedistUrl =
+    redistName: relativePath:
+    lib.concatStringsSep "/" (
+      [ _cuda.db.redistUrlPrefix ]
+      ++ (
+        if redistName != "tensorrt" then
+          [
+            redistName
+            "redist"
+          ]
+        else
+          [ "machine-learning" ]
+      )
+      ++ [ relativePath ]
+    );
+}
diff --git a/pkgs/development/cuda-modules/_cuda/lib/strings.nix b/pkgs/development/cuda-modules/_cuda/lib/strings.nix
new file mode 100644
index 000000000000..f25157b4da4c
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/lib/strings.nix
@@ -0,0 +1,382 @@
+{ _cuda, lib }:
+let
+  cudaLib = _cuda.lib;
+in
+{
+  /**
+    Replaces dots in a string with underscores.
+
+    # Type
+
+    ```
+    dotsToUnderscores :: (str :: String) -> String
+    ```
+
+    # Inputs
+
+    `str`
+
+    : The string for which dots shall be replaced by underscores
+
+    # Examples
+
+    :::{.example}
+    ## `cudaLib.dotsToUnderscores` usage examples
+
+    ```nix
+    dotsToUnderscores "1.2.3"
+    => "1_2_3"
+    ```
+    :::
+  */
+  dotsToUnderscores = lib.replaceStrings [ "." ] [ "_" ];
+
+  /**
+    Removes the dots from a string.
+
+    # Type
+
+    ```
+    dropDots :: (str :: String) -> String
+    ```
+
+    # Inputs
+
+    `str`
+
+    : The string to remove dots from
+
+    # Examples
+
+    :::{.example}
+    ## `cudaLib.dropDots` usage examples
+
+    ```nix
+    dropDots "1.2.3"
+    => "123"
+    ```
+    :::
+  */
+  dropDots = lib.replaceStrings [ "." ] [ "" ];
+
+  /**
+    Produces an attribute set of useful data and functionality for packaging CUDA software within Nixpkgs.
+
+    # Type
+
+    ```
+    formatCapabilities
+      :: { cudaCapabilityToInfo :: AttrSet CudaCapability CudaCapabilityInfo
+         , cudaCapabilities :: List CudaCapability
+         , cudaForwardCompat :: Bool
+         }
+      -> { cudaCapabilities :: List CudaCapability
+         , cudaForwardCompat :: Bool
+         , gencode :: List String
+         , realArches :: List String
+         , virtualArches :: List String
+         , archNames :: List String
+         , arches :: List String
+         , gencodeString :: String
+         , cmakeCudaArchitecturesString :: String
+         }
+    ```
+
+    # Inputs
+
+    `cudaCapabilityToInfo`
+
+    : A mapping of CUDA capabilities to their information
+
+    `cudaCapabilities`
+
+    : A list of CUDA capabilities to use
+
+    `cudaForwardCompat`
+
+    : A boolean indicating whether to include the forward compatibility gencode (+PTX) to support future GPU
+      generations
+  */
+  formatCapabilities =
+    {
+      cudaCapabilityToInfo,
+      cudaCapabilities,
+      cudaForwardCompat,
+    }:
+    let
+      /**
+        The real architectures for the given CUDA capabilities.
+
+        # Type
+
+        ```
+        realArches :: List String
+        ```
+      */
+      realArches = lib.map cudaLib.mkRealArchitecture cudaCapabilities;
+
+      /**
+        The virtual architectures for the given CUDA capabilities.
+
+        These are typically used for forward compatibility, when trying to support an architecture newer than the CUDA
+        version allows.
+
+        # Type
+
+        ```
+        virtualArches :: List String
+        ```
+      */
+      virtualArches = lib.map cudaLib.mkVirtualArchitecture cudaCapabilities;
+
+      /**
+        The gencode flags for the given CUDA capabilities.
+
+        # Type
+
+        ```
+        gencode :: List String
+        ```
+      */
+      gencode =
+        let
+          base = lib.map (cudaLib.mkGencodeFlag "sm") cudaCapabilities;
+          forward = cudaLib.mkGencodeFlag "compute" (lib.last cudaCapabilities);
+        in
+        base ++ lib.optionals cudaForwardCompat [ forward ];
+    in
+    {
+      inherit
+        cudaCapabilities
+        cudaForwardCompat
+        gencode
+        realArches
+        virtualArches
+        ;
+
+      /**
+        The architecture names for the given CUDA capabilities.
+
+        # Type
+
+        ```
+        archNames :: List String
+        ```
+      */
+      # E.g. [ "Ampere" "Turing" ]
+      archNames = lib.pipe cudaCapabilities [
+        (lib.map (cudaCapability: cudaCapabilityToInfo.${cudaCapability}.archName))
+        lib.unique
+        lib.naturalSort
+      ];
+
+      /**
+        The architectures for the given CUDA capabilities, including both real and virtual architectures.
+
+        When `cudaForwardCompat` is enabled, the last architecture in the list is used as the forward compatibility architecture.
+
+        # Type
+
+        ```
+        arches :: List String
+        ```
+      */
+      # E.g. [ "sm_75" "sm_86" "compute_86" ]
+      arches = realArches ++ lib.optionals cudaForwardCompat [ (lib.last virtualArches) ];
+
+      /**
+        The CMake-compatible CUDA architectures string for the given CUDA capabilities.
+
+        # Type
+
+        ```
+        cmakeCudaArchitecturesString :: String
+        ```
+      */
+      cmakeCudaArchitecturesString = cudaLib.mkCmakeCudaArchitecturesString cudaCapabilities;
+
+      /**
+        The gencode string for the given CUDA capabilities.
+
+        # Type
+
+        ```
+        gencodeString :: String
+        ```
+      */
+      gencodeString = lib.concatStringsSep " " gencode;
+    };
+
+  /**
+    Produces a CMake-compatible CUDA architecture string from a list of CUDA capabilities.
+
+    # Type
+
+    ```
+    mkCmakeCudaArchitecturesString :: (cudaCapabilities :: List String) -> String
+    ```
+
+    # Inputs
+
+    `cudaCapabilities`
+
+    : The CUDA capabilities to convert
+
+    # Examples
+
+    :::{.example}
+    ## `cudaLib.mkCmakeCudaArchitecturesString` usage examples
+
+    ```nix
+    mkCmakeCudaArchitecturesString [ "8.9" "10.0a" ]
+    => "89;100a"
+    ```
+    :::
+  */
+  mkCmakeCudaArchitecturesString = lib.concatMapStringsSep ";" cudaLib.dropDots;
+
+  /**
+    Produces a gencode flag from a CUDA capability.
+
+    # Type
+
+    ```
+    mkGencodeFlag :: (archPrefix :: String) -> (cudaCapability :: String) -> String
+    ```
+
+    # Inputs
+
+    `archPrefix`
+
+    : The architecture prefix to use for the `code` field
+
+    `cudaCapability`
+
+    : The CUDA capability to convert
+
+    # Examples
+
+    :::{.example}
+    ## `cudaLib.mkGencodeFlag` usage examples
+
+    ```nix
+    mkGencodeFlag "sm" "8.9"
+    => "-gencode=arch=compute_89,code=sm_89"
+    ```
+
+    ```nix
+    mkGencodeFlag "compute" "10.0a"
+    => "-gencode=arch=compute_100a,code=compute_100a"
+    ```
+    :::
+  */
+  mkGencodeFlag =
+    archPrefix: cudaCapability:
+    let
+      cap = cudaLib.dropDots cudaCapability;
+    in
+    "-gencode=arch=compute_${cap},code=${archPrefix}_${cap}";
+
+  /**
+    Produces a real architecture string from a CUDA capability.
+
+    # Type
+
+    ```
+    mkRealArchitecture :: (cudaCapability :: String) -> String
+    ```
+
+    # Inputs
+
+    `cudaCapability`
+
+    : The CUDA capability to convert
+
+    # Examples
+
+    :::{.example}
+    ## `cudaLib.mkRealArchitecture` usage examples
+
+    ```nix
+    mkRealArchitecture "8.9"
+    => "sm_89"
+    ```
+
+    ```nix
+    mkRealArchitecture "10.0a"
+    => "sm_100a"
+    ```
+    :::
+  */
+  mkRealArchitecture = cudaCapability: "sm_" + cudaLib.dropDots cudaCapability;
+
+  /**
+    Create a versioned attribute name from a version by replacing dots with underscores.
+
+    # Type
+
+    ```
+    mkVersionedName :: (name :: String) -> (version :: Version) -> String
+    ```
+
+    # Inputs
+
+    `name`
+
+    : The name to use
+
+    `version`
+
+    : The version to use
+
+    # Examples
+
+    :::{.example}
+    ## `cudaLib.mkVersionedName` usage examples
+
+    ```nix
+    mkVersionedName "hello" "1.2.3"
+    => "hello_1_2_3"
+    ```
+
+    ```nix
+    mkVersionedName "cudaPackages" "12.8"
+    => "cudaPackages_12_8"
+    ```
+    :::
+  */
+  mkVersionedName = name: version: "${name}_${cudaLib.dotsToUnderscores version}";
+
+  /**
+    Produces a virtual architecture string from a CUDA capability.
+
+    # Type
+
+    ```
+    mkVirtualArchitecture :: (cudaCapability :: String) -> String
+    ```
+
+    # Inputs
+
+    `cudaCapability`
+
+    : The CUDA capability to convert
+
+    # Examples
+
+    :::{.example}
+    ## `cudaLib.mkVirtualArchitecture` usage examples
+
+    ```nix
+    mkVirtualArchitecture "8.9"
+    => "compute_89"
+    ```
+
+    ```nix
+    mkVirtualArchitecture "10.0a"
+    => "compute_100a"
+    ```
+    :::
+  */
+  mkVirtualArchitecture = cudaCapability: "compute_" + cudaLib.dropDots cudaCapability;
+}
diff --git a/pkgs/development/cuda-modules/_cuda/lib/versions.nix b/pkgs/development/cuda-modules/_cuda/lib/versions.nix
new file mode 100644
index 000000000000..e231f795f13f
--- /dev/null
+++ b/pkgs/development/cuda-modules/_cuda/lib/versions.nix
@@ -0,0 +1,79 @@
+{ _cuda, lib }:
+let
+  cudaLib = _cuda.lib;
+in
+{
+  /**
+    Extracts the major, minor, and patch version from a string.
+
+    # Type
+
+    ```
+    majorMinorPatch :: (version :: String) -> String
+    ```
+
+    # Inputs
+
+    `version`
+
+    : The version string
+
+    # Examples
+
+    :::{.example}
+    ## `_cuda.lib.majorMinorPatch` usage examples
+
+    ```nix
+    majorMinorPatch "11.0.3.4"
+    => "11.0.3"
+    ```
+    :::
+  */
+  majorMinorPatch = cudaLib.trimComponents 3;
+
+  /**
+    Get a version string with no more than than the specified number of components.
+
+    # Type
+
+    ```
+    trimComponents :: (numComponents :: Integer) -> (version :: String) -> String
+    ```
+
+    # Inputs
+
+    `numComponents`
+    : A positive integer corresponding to the maximum number of components to keep
+
+    `version`
+    : A version string
+
+    # Examples
+
+    :::{.example}
+    ## `_cuda.lib.trimComponents` usage examples
+
+    ```nix
+    trimComponents 1 "1.2.3.4"
+    => "1"
+    ```
+
+    ```nix
+    trimComponents 3 "1.2.3.4"
+    => "1.2.3"
+    ```
+
+    ```nix
+    trimComponents 9 "1.2.3.4"
+    => "1.2.3.4"
+    ```
+    :::
+  */
+  trimComponents =
+    n: v:
+    lib.pipe v [
+      lib.splitVersion
+      (lib.take n)
+      (lib.concatStringsSep ".")
+    ];
+}
diff --git a/pkgs/development/cuda-modules/aliases.nix b/pkgs/development/cuda-modules/aliases.nix
index 14975410d378..1c8e9c1d5fab 100644
--- a/pkgs/development/cuda-modules/aliases.nix
+++ b/pkgs/development/cuda-modules/aliases.nix
@@ -1,11 +1,12 @@
 # Packages which have been deprecated or removed from cudaPackages
-final: _:
+{ lib }:
 let
   mkRenamed =
     oldName:
     { path, package }:
-    final.lib.warn "cudaPackages.${oldName} is deprecated, use ${path} instead" package;
+    lib.warn "cudaPackages.${oldName} is deprecated, use ${path} instead" package;
 in
+final: _:
 builtins.mapAttrs mkRenamed {
   # A comment to prevent empty { } from collapsing into a single line
 
diff --git a/pkgs/development/cuda-modules/cuda/extension.nix b/pkgs/development/cuda-modules/cuda/extension.nix
index 09d8999270a2..c46c39dcea2d 100644
--- a/pkgs/development/cuda-modules/cuda/extension.nix
+++ b/pkgs/development/cuda-modules/cuda/extension.nix
@@ -43,7 +43,7 @@ let
   };
 
   # Generally we prefer to do things involving getting attribute names with feature_manifest instead
-  # of redistrib_manifest because the feature manifest will have *only* the redist architecture
+  # of redistrib_manifest because the feature manifest will have *only* the redist system
   # names as the keys, whereas the redistrib manifest will also have things like version, name, license,
   # and license_path.
   featureManifest = evaluatedModules.config.cuda.manifests.feature;
diff --git a/pkgs/development/cuda-modules/cudnn/shims.nix b/pkgs/development/cuda-modules/cudnn/shims.nix
index 0a7f09bc9f0f..01918e88f07b 100644
--- a/pkgs/development/cuda-modules/cudnn/shims.nix
+++ b/pkgs/development/cuda-modules/cudnn/shims.nix
@@ -1,14 +1,14 @@
 # Shims to mimic the shape of ../modules/generic/manifests/{feature,redistrib}/release.nix
 {
   package,
-  # redistArch :: String
+  # redistSystem :: String
   # String is "unsupported" if the given architecture is unsupported.
-  redistArch,
+  redistSystem,
 }:
 {
   featureRelease = {
     inherit (package) minCudaVersion maxCudaVersion;
-    ${redistArch}.outputs = {
+    ${redistSystem}.outputs = {
       lib = true;
       static = true;
       dev = true;
diff --git a/pkgs/development/cuda-modules/cusparselt/extension.nix b/pkgs/development/cuda-modules/cusparselt/extension.nix
index e72be0d7cb99..f53405e3d099 100644
--- a/pkgs/development/cuda-modules/cusparselt/extension.nix
+++ b/pkgs/development/cuda-modules/cusparselt/extension.nix
@@ -1,11 +1,9 @@
 # Support matrix can be found at
 # https://docs.nvidia.com/deeplearning/cudnn/archives/cudnn-880/support-matrix/index.html
 {
+  cudaLib,
   lib,
-  stdenv,
-  cudaMajorMinorVersion,
-  flags,
-  mkVersionedPackageName,
+  redistSystem,
 }:
 let
   inherit (lib)
@@ -15,8 +13,6 @@ let
     trivial
     ;
 
-  inherit (stdenv) hostPlatform;
-
   redistName = "cusparselt";
   pname = "libcusparse_lt";
 
@@ -54,17 +50,12 @@ let
       releaseGrabber
     ]) cusparseltVersions;
 
-  # A release is supported if it has a libPath that matches our CUDA version for our platform.
-  # LibPath are not constant across the same release -- one platform may support fewer
-  # CUDA versions than another.
-  # redistArch :: String
-  redistArch = flags.getRedistArch hostPlatform.system;
   # platformIsSupported :: Manifests -> Boolean
   platformIsSupported =
     { feature, redistrib, ... }:
     (attrsets.attrByPath [
       pname
-      redistArch
+      redistSystem
     ] null feature) != null;
 
   # TODO(@connorbaker): With an auxiliary file keeping track of the CUDA versions each release supports,
@@ -77,7 +68,8 @@ let
   # Compute versioned attribute name to be used in this package set
   # Patch version changes should not break the build, so we only use major and minor
   # computeName :: RedistribRelease -> String
-  computeName = { version, ... }: mkVersionedPackageName redistName version;
+  computeName =
+    { version, ... }: cudaLib.mkVersionedName redistName (lib.versions.majorMinor version);
 in
 final: _:
 let
diff --git a/pkgs/development/cuda-modules/cutensor/extension.nix b/pkgs/development/cuda-modules/cutensor/extension.nix
index deb6cc7e8e51..57de518aa7ac 100644
--- a/pkgs/development/cuda-modules/cutensor/extension.nix
+++ b/pkgs/development/cuda-modules/cutensor/extension.nix
@@ -13,11 +13,10 @@
 # - Instead of providing different releases for each version of CUDA, CuTensor has multiple subdirectories in `lib`
 #   -- one for each version of CUDA.
 {
+  cudaLib,
   cudaMajorMinorVersion,
-  flags,
   lib,
-  mkVersionedPackageName,
-  stdenv,
+  redistSystem,
 }:
 let
   inherit (lib)
@@ -28,8 +27,6 @@ let
     trivial
     ;
 
-  inherit (stdenv) hostPlatform;
-
   redistName = "cutensor";
   pname = "libcutensor";
 
@@ -92,14 +89,12 @@ let
   # A release is supported if it has a libPath that matches our CUDA version for our platform.
   # LibPath are not constant across the same release -- one platform may support fewer
   # CUDA versions than another.
-  # redistArch :: String
-  redistArch = flags.getRedistArch hostPlatform.system;
   # platformIsSupported :: Manifests -> Boolean
   platformIsSupported =
     { feature, redistrib, ... }:
     (attrsets.attrByPath [
       pname
-      redistArch
+      redistSystem
     ] null feature) != null;
 
   # TODO(@connorbaker): With an auxiliary file keeping track of the CUDA versions each release supports,
@@ -112,7 +107,8 @@ let
   # Compute versioned attribute name to be used in this package set
   # Patch version changes should not break the build, so we only use major and minor
   # computeName :: RedistribRelease -> String
-  computeName = { version, ... }: mkVersionedPackageName redistName version;
+  computeName =
+    { version, ... }: cudaLib.mkVersionedName redistName (lib.versions.majorMinor version);
 in
 final: _:
 let
diff --git a/pkgs/development/cuda-modules/flags.nix b/pkgs/development/cuda-modules/flags.nix
deleted file mode 100644
index 980f33c7863f..000000000000
--- a/pkgs/development/cuda-modules/flags.nix
+++ /dev/null
@@ -1,399 +0,0 @@
-# Type aliases
-# Gpu :: AttrSet
-#   - See the documentation in ./gpus.nix.
-{
-  config,
-  cudaCapabilities ? (config.cudaCapabilities or [ ]),
-  cudaForwardCompat ? (config.cudaForwardCompat or true),
-  lib,
-  cudaMajorMinorVersion,
-  stdenv,
-  # gpus :: List Gpu
-  gpus,
-}:
-let
-  inherit (lib)
-    asserts
-    attrsets
-    lists
-    strings
-    trivial
-    ;
-
-  inherit (stdenv) hostPlatform;
-
-  # Flags are determined based on your CUDA toolkit by default.  You may benefit
-  # from improved performance, reduced file size, or greater hardware support by
-  # passing a configuration based on your specific GPU environment.
-  #
-  # cudaCapabilities :: List Capability
-  # List of hardware generations to build.
-  # E.g. [ "8.0" ]
-  # Currently, the last item is considered the optional forward-compatibility arch,
-  # but this may change in the future.
-  #
-  # cudaForwardCompat :: Bool
-  # Whether to include the forward compatibility gencode (+PTX)
-  # to support future GPU generations.
-  # E.g. true
-  #
-  # Please see the accompanying documentation or https://github.com/NixOS/nixpkgs/pull/205351
-
-  # isSupported :: Gpu -> Bool
-  isSupported =
-    gpu:
-    let
-      inherit (gpu) minCudaVersion maxCudaVersion;
-      lowerBoundSatisfied = strings.versionAtLeast cudaMajorMinorVersion minCudaVersion;
-      upperBoundSatisfied =
-        (maxCudaVersion == null) || !(strings.versionOlder maxCudaVersion cudaMajorMinorVersion);
-    in
-    lowerBoundSatisfied && upperBoundSatisfied;
-
-  # NOTE: Jetson is never built by default.
-  # isDefault :: Gpu -> Bool
-  isDefault =
-    gpu:
-    let
-      inherit (gpu) dontDefaultAfter isJetson;
-      newGpu = dontDefaultAfter == null;
-      recentGpu = newGpu || strings.versionAtLeast dontDefaultAfter cudaMajorMinorVersion;
-    in
-    recentGpu && !isJetson;
-
-  # supportedGpus :: List Gpu
-  # GPUs which are supported by the provided CUDA version.
-  supportedGpus = builtins.filter isSupported gpus;
-
-  # defaultGpus :: List Gpu
-  # GPUs which are supported by the provided CUDA version and we want to build for by default.
-  defaultGpus = builtins.filter isDefault supportedGpus;
-
-  # supportedCapabilities :: List Capability
-  supportedCapabilities = lists.map (gpu: gpu.computeCapability) supportedGpus;
-
-  # defaultCapabilities :: List Capability
-  # The default capabilities to target, if not overridden by the user.
-  defaultCapabilities = lists.map (gpu: gpu.computeCapability) defaultGpus;
-
-  # cudaArchNameToVersions :: AttrSet String (List String)
-  # Maps the name of a GPU architecture to different versions of that architecture.
-  # For example, "Ampere" maps to [ "8.0" "8.6" "8.7" ].
-  cudaArchNameToVersions = lists.groupBy' (versions: gpu: versions ++ [ gpu.computeCapability ]) [ ] (
-    gpu: gpu.archName
-  ) supportedGpus;
-
-  # cudaComputeCapabilityToName :: AttrSet String String
-  # Maps the version of a GPU architecture to the name of that architecture.
-  # For example, "8.0" maps to "Ampere".
-  cudaComputeCapabilityToName = builtins.listToAttrs (
-    lists.map (gpu: attrsets.nameValuePair gpu.computeCapability gpu.archName) supportedGpus
-  );
-
-  # cudaComputeCapabilityToIsJetson :: AttrSet String Boolean
-  cudaComputeCapabilityToIsJetson = builtins.listToAttrs (
-    lists.map (attrs: attrsets.nameValuePair attrs.computeCapability attrs.isJetson) supportedGpus
-  );
-
-  # jetsonComputeCapabilities :: List String
-  jetsonComputeCapabilities = trivial.pipe cudaComputeCapabilityToIsJetson [
-    (attrsets.filterAttrs (_: isJetson: isJetson))
-    builtins.attrNames
-  ];
-
-  # Find the intersection with the user-specified list of cudaCapabilities.
-  # NOTE: Jetson devices are never built by default because they cannot be targeted along with
-  # non-Jetson devices and require an aarch64 host platform. As such, if they're present anywhere,
-  # they must be in the user-specified cudaCapabilities.
-  # NOTE: We don't need to worry about mixes of Jetson and non-Jetson devices here -- there's
-  # sanity-checking for all that in below.
-  jetsonTargets = lists.intersectLists jetsonComputeCapabilities cudaCapabilities;
-
-  # dropDot :: String -> String
-  dropDot = ver: builtins.replaceStrings [ "." ] [ "" ] ver;
-
-  # archMapper :: String -> List String -> List String
-  # Maps a feature across a list of architecture versions to produce a list of architectures.
-  # For example, "sm" and [ "8.0" "8.6" "8.7" ] produces [ "sm_80" "sm_86" "sm_87" ].
-  archMapper = feat: lists.map (computeCapability: "${feat}_${dropDot computeCapability}");
-
-  # gencodeMapper :: String -> List String -> List String
-  # Maps a feature across a list of architecture versions to produce a list of gencode arguments.
-  # For example, "sm" and [ "8.0" "8.6" "8.7" ] produces [ "-gencode=arch=compute_80,code=sm_80"
-  # "-gencode=arch=compute_86,code=sm_86" "-gencode=arch=compute_87,code=sm_87" ].
-  gencodeMapper =
-    feat:
-    lists.map (
-      computeCapability:
-      "-gencode=arch=compute_${dropDot computeCapability},code=${feat}_${dropDot computeCapability}"
-    );
-
-  # Maps Nix system to NVIDIA redist arch.
-  # NOTE: We swap out the default `linux-sbsa` redist (for server-grade ARM chips) with the
-  # `linux-aarch64` redist (which is for Jetson devices) if we're building any Jetson devices.
-  # Since both are based on aarch64, we can only have one or the other, otherwise there's an
-  # ambiguity as to which should be used.
-  # NOTE: This function *will* be called by unsupported systems because `cudaPackages` is part of
-  # `all-packages.nix`, which is evaluated on all systems. As such, we need to handle unsupported
-  # systems gracefully.
-  # getRedistArch :: String -> String
-  getRedistArch =
-    nixSystem:
-    attrsets.attrByPath [ nixSystem ] "unsupported" {
-      aarch64-linux = if jetsonTargets != [ ] then "linux-aarch64" else "linux-sbsa";
-      x86_64-linux = "linux-x86_64";
-      ppc64le-linux = "linux-ppc64le";
-      x86_64-windows = "windows-x86_64";
-    };
-
-  # Maps NVIDIA redist arch to Nix system.
-  # NOTE: This function *will* be called by unsupported systems because `cudaPackages` is part of
-  # `all-packages.nix`, which is evaluated on all systems. As such, we need to handle unsupported
-  # systems gracefully.
-  # getNixSystem :: String -> String
-  getNixSystem =
-    redistArch:
-    attrsets.attrByPath [ redistArch ] "unsupported-${redistArch}" {
-      linux-sbsa = "aarch64-linux";
-      linux-aarch64 = "aarch64-linux";
-      linux-x86_64 = "x86_64-linux";
-      linux-ppc64le = "ppc64le-linux";
-      windows-x86_64 = "x86_64-windows";
-    };
-
-  formatCapabilities =
-    {
-      cudaCapabilities,
-      enableForwardCompat ? true,
-    }:
-    rec {
-      inherit cudaCapabilities enableForwardCompat;
-
-      # archNames :: List String
-      # E.g. [ "Turing" "Ampere" ]
-      #
-      # Unknown architectures are rendered as sm_XX gencode flags.
-      archNames = lists.unique (
-        lists.map (cap: cudaComputeCapabilityToName.${cap} or "sm_${dropDot cap}") cudaCapabilities
-      );
-
-      # realArches :: List String
-      # The real architectures are physical architectures supported by the CUDA version.
-      # E.g. [ "sm_75" "sm_86" ]
-      realArches = archMapper "sm" cudaCapabilities;
-
-      # virtualArches :: List String
-      # The virtual architectures are typically used for forward compatibility, when trying to support
-      # an architecture newer than the CUDA version allows.
-      # E.g. [ "compute_75" "compute_86" ]
-      virtualArches = archMapper "compute" cudaCapabilities;
-
-      # arches :: List String
-      # By default, build for all supported architectures and forward compatibility via a virtual
-      # architecture for the newest supported architecture.
-      # E.g. [ "sm_75" "sm_86" "compute_86" ]
-      arches = realArches ++ lists.optional enableForwardCompat (lists.last virtualArches);
-
-      # gencode :: List String
-      # A list of CUDA gencode arguments to pass to NVCC.
-      # E.g. [ "-gencode=arch=compute_75,code=sm_75" ... "-gencode=arch=compute_86,code=compute_86" ]
-      gencode =
-        let
-          base = gencodeMapper "sm" cudaCapabilities;
-          forward = gencodeMapper "compute" [ (lists.last cudaCapabilities) ];
-        in
-        base ++ lib.optionals enableForwardCompat forward;
-
-      # gencodeString :: String
-      # A space-separated string of CUDA gencode arguments to pass to NVCC.
-      # E.g. "-gencode=arch=compute_75,code=sm_75 ... -gencode=arch=compute_86,code=compute_86"
-      gencodeString = strings.concatStringsSep " " gencode;
-
-      # cmakeCudaArchitecturesString :: String
-      # A semicolon-separated string of CUDA capabilities without dots, suitable for passing to CMake.
-      # E.g. "75;86"
-      cmakeCudaArchitecturesString = strings.concatMapStringsSep ";" dropDot cudaCapabilities;
-
-      # Jetson devices cannot be targeted by the same binaries which target non-Jetson devices. While
-      # NVIDIA provides both `linux-aarch64` and `linux-sbsa` packages, which both target `aarch64`,
-      # they are built with different settings and cannot be mixed.
-      # isJetsonBuild :: Boolean
-      isJetsonBuild =
-        let
-          requestedJetsonDevices = lists.filter (
-            cap: cudaComputeCapabilityToIsJetson.${cap} or false
-          ) cudaCapabilities;
-          requestedNonJetsonDevices = lists.filter (
-            cap: !(builtins.elem cap requestedJetsonDevices)
-          ) cudaCapabilities;
-          jetsonBuildSufficientCondition = requestedJetsonDevices != [ ];
-          jetsonBuildNecessaryCondition = requestedNonJetsonDevices == [ ] && hostPlatform.isAarch64;
-        in
-        trivial.throwIf (jetsonBuildSufficientCondition && !jetsonBuildNecessaryCondition) ''
-          Jetson devices cannot be targeted with non-Jetson devices. Additionally, they require hostPlatform to be aarch64.
-          You requested ${builtins.toJSON cudaCapabilities} for host platform ${hostPlatform.system}.
-          Requested Jetson devices: ${builtins.toJSON requestedJetsonDevices}.
-          Requested non-Jetson devices: ${builtins.toJSON requestedNonJetsonDevices}.
-          Exactly one of the following must be true:
-          - All CUDA capabilities belong to Jetson devices and hostPlatform is aarch64.
-          - No CUDA capabilities belong to Jetson devices.
-          See ${./gpus.nix} for a list of architectures supported by this version of Nixpkgs.
-        '' jetsonBuildSufficientCondition
-        && jetsonBuildNecessaryCondition;
-    };
-in
-# When changing names or formats: pause, validate, and update the assert
-assert
-  let
-    expected = {
-      cudaCapabilities = [
-        "7.5"
-        "8.6"
-      ];
-      enableForwardCompat = true;
-
-      archNames = [
-        "Turing"
-        "Ampere"
-      ];
-      realArches = [
-        "sm_75"
-        "sm_86"
-      ];
-      virtualArches = [
-        "compute_75"
-        "compute_86"
-      ];
-      arches = [
-        "sm_75"
-        "sm_86"
-        "compute_86"
-      ];
-
-      gencode = [
-        "-gencode=arch=compute_75,code=sm_75"
-        "-gencode=arch=compute_86,code=sm_86"
-        "-gencode=arch=compute_86,code=compute_86"
-      ];
-      gencodeString = "-gencode=arch=compute_75,code=sm_75 -gencode=arch=compute_86,code=sm_86 -gencode=arch=compute_86,code=compute_86";
-
-      cmakeCudaArchitecturesString = "75;86";
-
-      isJetsonBuild = false;
-    };
-    actual = formatCapabilities {
-      cudaCapabilities = [
-        "7.5"
-        "8.6"
-      ];
-    };
-    actualWrapped = (builtins.tryEval (builtins.deepSeq actual actual)).value;
-  in
-  asserts.assertMsg
-    ((strings.versionAtLeast cudaMajorMinorVersion "11.2") -> (expected == actualWrapped))
-    ''
-      This test should only fail when using a version of CUDA older than 11.2, the first to support
-      8.6.
-      Expected: ${builtins.toJSON expected}
-      Actual: ${builtins.toJSON actualWrapped}
-    '';
-# Check mixed Jetson and non-Jetson devices
-assert
-  let
-    expected = false;
-    actual = formatCapabilities {
-      cudaCapabilities = [
-        "7.2"
-        "7.5"
-      ];
-    };
-    actualWrapped = (builtins.tryEval (builtins.deepSeq actual actual)).value;
-  in
-  asserts.assertMsg (expected == actualWrapped) ''
-    Jetson devices capabilities cannot be mixed with non-jetson devices.
-    Capability 7.5 is non-Jetson and should not be allowed with Jetson 7.2.
-    Expected: ${builtins.toJSON expected}
-    Actual: ${builtins.toJSON actualWrapped}
-  '';
-# Check Jetson-only
-assert
-  let
-    expected = {
-      cudaCapabilities = [
-        "6.2"
-        "7.2"
-      ];
-      enableForwardCompat = true;
-
-      archNames = [
-        "Pascal"
-        "Volta"
-      ];
-      realArches = [
-        "sm_62"
-        "sm_72"
-      ];
-      virtualArches = [
-        "compute_62"
-        "compute_72"
-      ];
-      arches = [
-        "sm_62"
-        "sm_72"
-        "compute_72"
-      ];
-
-      gencode = [
-        "-gencode=arch=compute_62,code=sm_62"
-        "-gencode=arch=compute_72,code=sm_72"
-        "-gencode=arch=compute_72,code=compute_72"
-      ];
-      gencodeString = "-gencode=arch=compute_62,code=sm_62 -gencode=arch=compute_72,code=sm_72 -gencode=arch=compute_72,code=compute_72";
-
-      cmakeCudaArchitecturesString = "62;72";
-
-      isJetsonBuild = true;
-    };
-    actual = formatCapabilities {
-      cudaCapabilities = [
-        "6.2"
-        "7.2"
-      ];
-    };
-    actualWrapped = (builtins.tryEval (builtins.deepSeq actual actual)).value;
-  in
-  asserts.assertMsg
-    # We can't do this test unless we're targeting aarch64
-    (hostPlatform.isAarch64 -> (expected == actualWrapped))
-    ''
-      Jetson devices can only be built with other Jetson devices.
-      Both 6.2 and 7.2 are Jetson devices.
-      Expected: ${builtins.toJSON expected}
-      Actual: ${builtins.toJSON actualWrapped}
-    '';
-{
-  # formatCapabilities :: { cudaCapabilities: List Capability, enableForwardCompat: Boolean } ->  { ... }
-  inherit formatCapabilities;
-
-  # cudaArchNameToVersions :: String => String
-  inherit cudaArchNameToVersions;
-
-  # cudaComputeCapabilityToName :: String => String
-  inherit cudaComputeCapabilityToName;
-
-  # dropDot :: String -> String
-  inherit dropDot;
-
-  inherit
-    defaultCapabilities
-    supportedCapabilities
-    jetsonComputeCapabilities
-    jetsonTargets
-    getNixSystem
-    getRedistArch
-    ;
-}
-// formatCapabilities {
-  cudaCapabilities = if cudaCapabilities == [ ] then defaultCapabilities else cudaCapabilities;
-  enableForwardCompat = cudaForwardCompat;
-}
diff --git a/pkgs/development/cuda-modules/generic-builders/manifest.nix b/pkgs/development/cuda-modules/generic-builders/manifest.nix
index f36cc2d989ad..36872cf9682f 100644
--- a/pkgs/development/cuda-modules/generic-builders/manifest.nix
+++ b/pkgs/development/cuda-modules/generic-builders/manifest.nix
@@ -5,8 +5,8 @@
   autoPatchelfHook,
   backendStdenv,
   callPackage,
+  _cuda,
   fetchurl,
-  fixups,
   lib,
   markForCudatoolkitRootHook,
   flags,
@@ -44,18 +44,18 @@ let
   # Last step before returning control to `callPackage` (adds the `.override` method)
   # we'll apply (`overrideAttrs`) necessary package-specific "fixup" functions.
   # Order is significant.
-  maybeFixup = fixups.${pname} or null;
+  maybeFixup = _cuda.fixups.${pname} or null;
   fixup = if maybeFixup != null then callPackage maybeFixup { } else { };
 
-  # Get the redist architectures for which package provides distributables.
+  # Get the redist systems for which package provides distributables.
   # These are used by meta.platforms.
-  supportedRedistArchs = builtins.attrNames featureRelease;
-  # redistArch :: String
-  # The redistArch is the name of the architecture for which the redistributable is built.
-  # It is `"unsupported"` if the redistributable is not supported on the target platform.
-  redistArch = flags.getRedistArch hostPlatform.system;
+  supportedRedistSystems = builtins.attrNames featureRelease;
+  # redistSystem :: String
+  # The redistSystem is the name of the system for which the redistributable is built.
+  # It is `"unsupported"` if the redistributable is not supported on the target system.
+  redistSystem = _cuda.lib.getRedistSystem backendStdenv.hasJetsonCudaCapability hostPlatform.system;
 
-  sourceMatchesHost = flags.getNixSystem redistArch == hostPlatform.system;
+  sourceMatchesHost = lib.elem hostPlatform.system (_cuda.lib.getNixSystems redistSystem);
 in
 (backendStdenv.mkDerivation (finalAttrs: {
   # NOTE: Even though there's no actual buildPhase going on here, the derivations of the
@@ -81,7 +81,7 @@ in
       hasOutput =
         output:
         attrsets.attrByPath [
-          redistArch
+          redistSystem
           "outputs"
           output
         ] false featureRelease;
@@ -99,12 +99,15 @@ in
       # NOTE: In the case the redistributable isn't supported on the target platform,
       # we will have `outputs = [ "out" ] ++ possibleOutputs`. This is of note because platforms which
       # aren't supported would otherwise have evaluation errors when trying to access outputs other than `out`.
-      # The alternative would be to have `outputs = [ "out" ]` when`redistArch = "unsupported"`, but that would
+      # The alternative would be to have `outputs = [ "out" ]` when`redistSystem = "unsupported"`, but that would
       # require adding guards throughout the entirety of the CUDA package set to ensure `cudaSupport` is true --
       # recall that OfBorg will evaluate packages marked as broken and that `cudaPackages` will be evaluated with
       # `cudaSupport = false`!
       additionalOutputs =
-        if redistArch == "unsupported" then possibleOutputs else builtins.filter hasOutput possibleOutputs;
+        if redistSystem == "unsupported" then
+          possibleOutputs
+        else
+          builtins.filter hasOutput possibleOutputs;
       # The out output is special -- it's the default output and we always include it.
       outputs = [ "out" ] ++ additionalOutputs;
     in
@@ -155,14 +158,14 @@ in
   };
 
   # src :: Optional Derivation
-  # If redistArch doesn't exist in redistribRelease, return null.
+  # If redistSystem doesn't exist in redistribRelease, return null.
   src = trivial.mapNullable (
     { relative_path, sha256, ... }:
     fetchurl {
       url = "https://developer.download.nvidia.com/compute/${redistName}/redist/${relative_path}";
       inherit sha256;
     }
-  ) (redistribRelease.${redistArch} or null);
+  ) (redistribRelease.${redistSystem} or null);
 
   postPatch =
     # Pkg-config's setup hook expects configuration files in $out/share/pkgconfig
@@ -321,11 +324,13 @@ in
     description = "${redistribRelease.name}. By downloading and using the packages you accept the terms and conditions of the ${finalAttrs.meta.license.shortName}";
     sourceProvenance = [ sourceTypes.binaryNativeCode ];
     broken = lists.any trivial.id (attrsets.attrValues finalAttrs.brokenConditions);
-    platforms = trivial.pipe supportedRedistArchs [
-      # Map each redist arch to the equivalent nix system or null if there is no equivalent.
-      (builtins.map flags.getNixSystem)
-      # Filter out unsupported systems
-      (builtins.filter (nixSystem: !(strings.hasPrefix "unsupported-" nixSystem)))
+    platforms = trivial.pipe supportedRedistSystems [
+      # Map each redist system to the equivalent nix systems.
+      (lib.concatMap _cuda.lib.getNixSystems)
+      # Take all the unique values.
+      lib.unique
+      # Sort the list.
+      lib.naturalSort
     ];
     badPlatforms =
       let
diff --git a/pkgs/development/cuda-modules/generic-builders/multiplex.nix b/pkgs/development/cuda-modules/generic-builders/multiplex.nix
index 816a375e620f..3085ae3e4610 100644
--- a/pkgs/development/cuda-modules/generic-builders/multiplex.nix
+++ b/pkgs/development/cuda-modules/generic-builders/multiplex.nix
@@ -1,11 +1,9 @@
 {
-  # callPackage-provided arguments
   lib,
+  cudaLib,
   cudaMajorMinorVersion,
-  flags,
+  redistSystem,
   stdenv,
-  # Expected to be passed by the caller
-  mkVersionedPackageName,
   # Builder-specific arguments
   # Short package name (e.g., "cuda_cccl")
   # pname : String
@@ -26,7 +24,7 @@
   # The featureRelease is used to populate meta.platforms (by way of looking at the attribute names), determine the
   # outputs of the package, and provide additional package-specific constraints (e.g., min/max supported CUDA versions,
   # required versions of other packages, etc.).
-  # shimFn :: {package, redistArch} -> AttrSet
+  # shimFn :: {package, redistSystem} -> AttrSet
   shimsFn ? (throw "shimsFn must be provided"),
 }:
 let
@@ -41,10 +39,6 @@ let
   # - Releases: ../modules/${pname}/releases/releases.nix
   # - Package: ../modules/${pname}/releases/package.nix
 
-  # redistArch :: String
-  # Value is `"unsupported"` if the platform is not supported.
-  redistArch = flags.getRedistArch stdenv.hostPlatform.system;
-
   # Check whether a package supports our CUDA version.
   # satisfiesCudaVersion :: Package -> Bool
   satisfiesCudaVersion =
@@ -53,7 +47,7 @@ let
     && lib.versionAtLeast package.maxCudaVersion cudaMajorMinorVersion;
 
   # FIXME: do this at the module system level
-  propagatePlatforms = lib.mapAttrs (redistArch: lib.map (p: { inherit redistArch; } // p));
+  propagatePlatforms = lib.mapAttrs (redistSystem: lib.map (p: { inherit redistSystem; } // p));
 
   # Releases for all platforms and all CUDA versions.
   allReleases = propagatePlatforms evaluatedModules.config.${pname}.releases;
@@ -65,12 +59,12 @@ let
   allPackages = lib.concatLists (lib.attrValues allReleases');
 
   packageOlder = p1: p2: lib.versionOlder p1.version p2.version;
-  packageSupportedPlatform = p: p.redistArch == redistArch;
+  packageSupportedPlatform = p: p.redistSystem == redistSystem;
 
   # Compute versioned attribute name to be used in this package set
   # Patch version changes should not break the build, so we only use major and minor
   # computeName :: Package -> String
-  computeName = package: mkVersionedPackageName pname package.version;
+  computeName = { version, ... }: cudaLib.mkVersionedName pname (lib.versions.majorMinor version);
 
   # The newest package for each major-minor version, with newest first.
   # newestPackages :: List Package
@@ -113,7 +107,7 @@ let
       buildPackage =
         package:
         let
-          shims = final.callPackage shimsFn { inherit package redistArch; };
+          shims = final.callPackage shimsFn { inherit package redistSystem; };
           name = computeName package;
           drv = final.callPackage ./manifest.nix {
             inherit pname redistName;
diff --git a/pkgs/development/cuda-modules/gpus.nix b/pkgs/development/cuda-modules/gpus.nix
deleted file mode 100644
index a5466a2ef15f..000000000000
--- a/pkgs/development/cuda-modules/gpus.nix
+++ /dev/null
@@ -1,244 +0,0 @@
-# Type aliases
-#
-# Gpu = {
-#   archName: String
-#     - The name of the microarchitecture.
-#   computeCapability: String
-#     - The compute capability of the GPU.
-#   isJetson: Boolean
-#     - Whether a GPU is part of NVIDIA's line of Jetson embedded computers. This field is
-#       notable because it tells us what architecture to build for (as Jetson devices are
-#       aarch64).
-#       More on Jetson devices here:
-#       https://www.nvidia.com/en-us/autonomous-machines/embedded-systems/
-#       NOTE: These architectures are only built upon request.
-#   minCudaVersion: String
-#     - The minimum (inclusive) CUDA version that supports this GPU.
-#   dontDefaultAfter: null | String
-#     - The CUDA version after which to exclude this GPU from the list of default capabilities
-#       we build. null means we always include this GPU in the default capabilities if it is
-#       supported.
-#   maxCudaVersion: null | String
-#     - The maximum (exclusive) CUDA version that supports this GPU. null means there is no
-#       maximum.
-# }
-#
-# Many thanks to Arnon Shimoni for maintaining a list of these architectures and capabilities.
-# Without your work, this would have been much more difficult.
-# https://arnon.dk/matching-sm-architectures-arch-and-gencode-for-various-nvidia-cards/
-#
-# https://en.wikipedia.org/wiki/CUDA#GPUs_supported
-
-[
-  {
-    # Tesla K40
-    archName = "Kepler";
-    computeCapability = "3.5";
-    isJetson = false;
-    minCudaVersion = "10.0";
-    dontDefaultAfter = "11.0";
-    maxCudaVersion = "11.8";
-  }
-  {
-    # Tesla K80
-    archName = "Kepler";
-    computeCapability = "3.7";
-    isJetson = false;
-    minCudaVersion = "10.0";
-    dontDefaultAfter = "11.0";
-    maxCudaVersion = "11.8";
-  }
-  {
-    # Tesla/Quadro M series
-    archName = "Maxwell";
-    computeCapability = "5.0";
-    isJetson = false;
-    minCudaVersion = "10.0";
-    dontDefaultAfter = "11.0";
-    maxCudaVersion = null;
-  }
-  {
-    # Quadro M6000, GeForce 900, GTX-970, GTX-980, GTX Titan X
-    archName = "Maxwell";
-    computeCapability = "5.2";
-    isJetson = false;
-    minCudaVersion = "10.0";
-    dontDefaultAfter = "11.0";
-    maxCudaVersion = null;
-  }
-  {
-    # Tegra (Jetson) TX1 / Tegra X1, Drive CX, Drive PX, Jetson Nano
-    archName = "Maxwell";
-    computeCapability = "5.3";
-    isJetson = true;
-    minCudaVersion = "10.0";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # Quadro GP100, Tesla P100, DGX-1 (Generic Pascal)
-    archName = "Pascal";
-    computeCapability = "6.0";
-    isJetson = false;
-    minCudaVersion = "10.0";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # GTX 1080, GTX 1070, GTX 1060, GTX 1050, GTX 1030 (GP108), GT 1010 (GP108) Titan Xp, Tesla
-    # P40, Tesla P4, Discrete GPU on the NVIDIA Drive PX2
-    archName = "Pascal";
-    computeCapability = "6.1";
-    isJetson = false;
-    minCudaVersion = "10.0";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # Integrated GPU on the NVIDIA Drive PX2, Tegra (Jetson) TX2
-    archName = "Pascal";
-    computeCapability = "6.2";
-    isJetson = true;
-    minCudaVersion = "10.0";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # DGX-1 with Volta, Tesla V100, GTX 1180 (GV104), Titan V, Quadro GV100
-    archName = "Volta";
-    computeCapability = "7.0";
-    isJetson = false;
-    minCudaVersion = "10.0";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # Jetson AGX Xavier, Drive AGX Pegasus, Xavier NX
-    archName = "Volta";
-    computeCapability = "7.2";
-    isJetson = true;
-    minCudaVersion = "10.0";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # GTX/RTX Turing – GTX 1660 Ti, RTX 2060, RTX 2070, RTX 2080, Titan RTX, Quadro RTX 4000,
-    # Quadro RTX 5000, Quadro RTX 6000, Quadro RTX 8000, Quadro T1000/T2000, Tesla T4
-    archName = "Turing";
-    computeCapability = "7.5";
-    isJetson = false;
-    minCudaVersion = "10.0";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # NVIDIA A100 (the name “Tesla” has been dropped – GA100), NVIDIA DGX-A100
-    archName = "Ampere";
-    computeCapability = "8.0";
-    isJetson = false;
-    minCudaVersion = "11.2";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # Tesla GA10x cards, RTX Ampere – RTX 3080, GA102 – RTX 3090, RTX A2000, A3000, RTX A4000,
-    # A5000, A6000, NVIDIA A40, GA106 – RTX 3060, GA104 – RTX 3070, GA107 – RTX 3050, RTX A10, RTX
-    # A16, RTX A40, A2 Tensor Core GPU
-    archName = "Ampere";
-    computeCapability = "8.6";
-    isJetson = false;
-    minCudaVersion = "11.2";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # Jetson AGX Orin and Drive AGX Orin only
-    archName = "Ampere";
-    computeCapability = "8.7";
-    isJetson = true;
-    minCudaVersion = "11.5";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # NVIDIA GeForce RTX 4090, RTX 4080, RTX 6000, Tesla L40
-    archName = "Ada";
-    computeCapability = "8.9";
-    isJetson = false;
-    minCudaVersion = "11.8";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # NVIDIA H100 (GH100)
-    archName = "Hopper";
-    computeCapability = "9.0";
-    isJetson = false;
-    minCudaVersion = "11.8";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # NVIDIA H100 (GH100) (Thor)
-    archName = "Hopper";
-    computeCapability = "9.0a";
-    isJetson = false;
-    minCudaVersion = "12.0";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # NVIDIA B100
-    archName = "Blackwell";
-    computeCapability = "10.0";
-    isJetson = false;
-    minCudaVersion = "12.8";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # NVIDIA B100 Accelerated
-    archName = "Blackwell";
-    computeCapability = "10.0a";
-    isJetson = false;
-    minCudaVersion = "12.8";
-    dontDefaultAfter = "12.0"; # disable to reduce size of OnnxRuntime and Torch CUDA binaries
-    maxCudaVersion = null;
-  }
-  {
-    # NVIDIA Blackwell
-    archName = "Blackwell";
-    computeCapability = "10.1";
-    isJetson = false;
-    minCudaVersion = "12.8";
-    dontDefaultAfter = "12.0"; # disable to reduce size of OnnxRuntime and Torch CUDA binaries
-    maxCudaVersion = null;
-  }
-  {
-    # NVIDIA Blackwell Accelerated
-    archName = "Blackwell";
-    computeCapability = "10.1a";
-    isJetson = false;
-    minCudaVersion = "12.8";
-    dontDefaultAfter = "12.0"; # disable to reduce size of OnnxRuntime and Torch CUDA binaries
-    maxCudaVersion = null;
-  }
-  {
-    # NVIDIA GeForce RTX 5090 (GB202), RTX 5080 (GB203), RTX 5070 (GB205)
-    archName = "Blackwell";
-    computeCapability = "12.0";
-    isJetson = false;
-    minCudaVersion = "12.8";
-    dontDefaultAfter = null;
-    maxCudaVersion = null;
-  }
-  {
-    # NVIDIA Blackwell Accelerated
-    archName = "Blackwell";
-    computeCapability = "12.0a";
-    isJetson = false;
-    minCudaVersion = "12.8";
-    dontDefaultAfter = "12.0"; # disable to reduce size of OnnxRuntime and Torch CUDA binaries
-    maxCudaVersion = null;
-  }
-]
diff --git a/pkgs/development/cuda-modules/nvcc-compatibilities.nix b/pkgs/development/cuda-modules/nvcc-compatibilities.nix
deleted file mode 100644
index e4be18ea85ab..000000000000
--- a/pkgs/development/cuda-modules/nvcc-compatibilities.nix
+++ /dev/null
@@ -1,125 +0,0 @@
-# Taken from
-# https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#host-compiler-support-policy
-#
-#   NVCC performs a version check on the host compiler’s major version and so newer minor versions
-#   of the compilers listed below will be supported, but major versions falling outside the range
-#   will not be supported.
-#
-# NOTE: These constraints don't apply to Jetson, which uses something else.
-# NOTE: NVIDIA can and will add support for newer compilers even during patch releases.
-# E.g.: CUDA 12.2.1 maxxed out with support for Clang 15.0; 12.2.2 added support for Clang 16.0.
-# NOTE: Because all platforms NVIDIA supports use GCC and Clang, we omit the architectures here.
-# Type Aliases
-# CudaVersion = String (two-part version number, e.g. "11.2")
-# Platform = String (e.g. "x86_64-linux")
-# CompilerCompatibilities = {
-#  clangMaxMajorVersion = String (e.g. "15")
-#  clangMinMajorVersion = String (e.g. "7")
-#  gccMaxMajorVersion = String (e.g. "11")
-#  gccMinMajorVersion = String (e.g. "6")
-# }
-let
-  # attrs :: AttrSet CudaVersion CompilerCompatibilities
-  attrs = {
-    # Our baseline
-    # https://docs.nvidia.com/cuda/archive/11.0/cuda-toolkit-release-notes/index.html#cuda-compiler-new-features
-    "11.0" = {
-      clangMaxMajorVersion = "9";
-      clangMinMajorVersion = "7";
-      gccMaxMajorVersion = "9";
-      gccMinMajorVersion = "6";
-    };
-
-    # Added support for Clang 10 and GCC 10
-    # https://docs.nvidia.com/cuda/archive/11.1.1/cuda-toolkit-release-notes/index.html#cuda-compiler-new-features
-    "11.1" = attrs."11.0" // {
-      clangMaxMajorVersion = "10";
-      gccMaxMajorVersion = "10";
-    };
-
-    # Added support for Clang 11
-    # https://docs.nvidia.com/cuda/archive/11.2.2/cuda-installation-guide-linux/index.html#system-requirements
-    "11.2" = attrs."11.1" // {
-      clangMaxMajorVersion = "11";
-    };
-
-    # No changes from 11.2 to 11.3
-    "11.3" = attrs."11.2";
-
-    # Added support for Clang 12 and GCC 11
-    # https://docs.nvidia.com/cuda/archive/11.4.4/cuda-toolkit-release-notes/index.html#cuda-general-new-features
-    "11.4" = attrs."11.3" // {
-      clangMaxMajorVersion = "12";
-      # NOTE: There is a bug in the version of GLIBC that GCC 11 uses which causes it to fail to compile some CUDA
-      # code. As such, we skip it for this release, and do the bump in 11.6 (skipping 11.5).
-      # https://forums.developer.nvidia.com/t/cuda-11-5-samples-throw-multiple-error-attribute-malloc-does-not-take-arguments/192750/15
-      # gccMaxMajorVersion = "11";
-    };
-
-    # No changes from 11.4 to 11.5
-    "11.5" = attrs."11.4";
-
-    # No changes from 11.5 to 11.6
-    # However, as mentioned above, we add GCC 11 this release.
-    "11.6" = attrs."11.5" // {
-      gccMaxMajorVersion = "11";
-    };
-
-    # Added support for Clang 13
-    # https://docs.nvidia.com/cuda/archive/11.7.1/cuda-toolkit-release-notes/index.html#cuda-compiler-new-features
-    "11.7" = attrs."11.6" // {
-      clangMaxMajorVersion = "13";
-    };
-
-    # Added support for Clang 14
-    # https://docs.nvidia.com/cuda/archive/11.8.0/cuda-installation-guide-linux/index.html#system-requirements
-    "11.8" = attrs."11.7" // {
-      clangMaxMajorVersion = "14";
-    };
-
-    # Added support for GCC 12
-    # https://docs.nvidia.com/cuda/archive/12.0.1/cuda-installation-guide-linux/index.html#system-requirements
-    "12.0" = attrs."11.8" // {
-      gccMaxMajorVersion = "12";
-    };
-
-    # Added support for Clang 15
-    # https://docs.nvidia.com/cuda/archive/12.1.1/cuda-toolkit-release-notes/index.html#cuda-compilers-new-features
-    "12.1" = attrs."12.0" // {
-      clangMaxMajorVersion = "15";
-    };
-
-    # Added support for Clang 16
-    # https://docs.nvidia.com/cuda/archive/12.2.2/cuda-installation-guide-linux/index.html#host-compiler-support-policy
-    "12.2" = attrs."12.1" // {
-      clangMaxMajorVersion = "16";
-    };
-
-    # No changes from 12.2 to 12.3
-    "12.3" = attrs."12.2";
-
-    # Added support for Clang 17 and GCC 13
-    # https://docs.nvidia.com/cuda/archive/12.4.0/cuda-installation-guide-linux/index.html#host-compiler-support-policy
-    "12.4" = attrs."12.3" // {
-      clangMaxMajorVersion = "17";
-      gccMaxMajorVersion = "13";
-    };
-
-    # No changes from 12.4 to 12.5
-    "12.5" = attrs."12.4";
-
-    # Added support for Clang 18
-    # https://docs.nvidia.com/cuda/archive/12.6.0/cuda-installation-guide-linux/index.html#host-compiler-support-policy
-    "12.6" = attrs."12.4" // {
-      clangMaxMajorVersion = "18";
-    };
-
-    # Added support for Clang 19 and GCC 14
-    # https://docs.nvidia.com/cuda/archive/12.8.0/cuda-installation-guide-linux/index.html#host-compiler-support-policy
-    "12.8" = attrs."12.6" // {
-      clangMaxMajorVersion = "19";
-      gccMaxMajorVersion = "14";
-    };
-  };
-in
-attrs
diff --git a/pkgs/development/cuda-modules/packages/backendStdenv.nix b/pkgs/development/cuda-modules/packages/backendStdenv.nix
index b3595835fe38..7122ad2da319 100644
--- a/pkgs/development/cuda-modules/packages/backendStdenv.nix
+++ b/pkgs/development/cuda-modules/packages/backendStdenv.nix
@@ -1,4 +1,3 @@
-# Exposed as cudaPackages.backendStdenv.
 # This is what nvcc uses as a backend,
 # and it has to be an officially supported one (e.g. gcc11 for cuda11).
 #
@@ -7,26 +6,149 @@
 # E.g. for cudaPackages_11_8 we use gcc11 with gcc12's libstdc++
 # Cf. https://github.com/NixOS/nixpkgs/pull/218265 for context
 {
+  config,
+  _cuda,
   cudaMajorMinorVersion,
   lib,
-  nvccCompatibilities,
   pkgs,
   stdenv,
   stdenvAdapters,
 }:
-
 let
-  gccMajorVersion = nvccCompatibilities.${cudaMajorMinorVersion}.gccMaxMajorVersion;
-  cudaStdenv = stdenvAdapters.useLibsFrom stdenv pkgs."gcc${gccMajorVersion}Stdenv";
+  inherit (builtins) toJSON;
+  inherit (_cuda.db) allSortedCudaCapabilities cudaCapabilityToInfo nvccCompatibilities;
+  inherit (_cuda.lib)
+    _cudaCapabilityIsDefault
+    _cudaCapabilityIsSupported
+    _evaluateAssertions
+    getRedistSystem
+    mkVersionedName
+    ;
+  inherit (lib) addErrorContext;
+  inherit (lib.customisation) extendDerivation;
+  inherit (lib.lists) filter intersectLists subtractLists;
+
+  # NOTE: By virtue of processing a sorted list (allSortedCudaCapabilities), our groups will be sorted.
+
+  architectureSpecificCudaCapabilities = filter (
+    cudaCapability: cudaCapabilityToInfo.${cudaCapability}.isArchitectureSpecific
+  ) allSortedCudaCapabilities;
+
+  familySpecificCudaCapabilities = filter (
+    cudaCapability: cudaCapabilityToInfo.${cudaCapability}.isFamilySpecific
+  ) allSortedCudaCapabilities;
+
+  jetsonCudaCapabilities = filter (
+    cudaCapability: cudaCapabilityToInfo.${cudaCapability}.isJetson
+  ) allSortedCudaCapabilities;
+
   passthruExtra = {
-    # cudaPackages.backendStdenv.nixpkgsCompatibleLibstdcxx has been removed,
-    # if you need it you're likely doing something wrong. There has been a
-    # warning here for a month or so. Now we can no longer return any
-    # meaningful value in its place and drop the attribute entirely.
+    nvccHostCCMatchesStdenvCC = backendStdenv.cc == stdenv.cc;
+
+    # The Nix system of the host platform.
+    hostNixSystem = stdenv.hostPlatform.system;
+
+    # The Nix system of the host platform for the CUDA redistributable.
+    hostRedistSystem = getRedistSystem passthruExtra.hasJetsonCudaCapability stdenv.hostPlatform.system;
+
+    # Sets whether packages should be built with forward compatibility.
+    # TODO(@connorbaker): If the requested CUDA capabilities are not supported by the current CUDA version,
+    # should we throw an evaluation warning and build with forward compatibility?
+    cudaForwardCompat = config.cudaForwardCompat or true;
+
+    # CUDA capabilities which are supported by the current CUDA version.
+    supportedCudaCapabilities = filter (
+      cudaCapability:
+      _cudaCapabilityIsSupported cudaMajorMinorVersion cudaCapabilityToInfo.${cudaCapability}
+    ) allSortedCudaCapabilities;
+
+    # Find the default set of capabilities for this CUDA version using the list of supported capabilities.
+    # Includes only baseline capabilities.
+    defaultCudaCapabilities = filter (
+      cudaCapability:
+      _cudaCapabilityIsDefault cudaMajorMinorVersion cudaCapabilityToInfo.${cudaCapability}
+    ) passthruExtra.supportedCudaCapabilities;
+
+    # The resolved requested or default CUDA capabilities.
+    cudaCapabilities =
+      if config.cudaCapabilities or [ ] != [ ] then
+        config.cudaCapabilities
+      else
+        passthruExtra.defaultCudaCapabilities;
+
+    # Requested architecture-specific CUDA capabilities.
+    requestedArchitectureSpecificCudaCapabilities = intersectLists architectureSpecificCudaCapabilities passthruExtra.cudaCapabilities;
+
+    # Whether the requested CUDA capabilities include architecture-specific CUDA capabilities.
+    hasArchitectureSpecificCudaCapability =
+      passthruExtra.requestedArchitectureSpecificCudaCapabilities != [ ];
+
+    # Requested family-specific CUDA capabilities.
+    requestedFamilySpecificCudaCapabilities = intersectLists familySpecificCudaCapabilities passthruExtra.cudaCapabilities;
+
+    # Whether the requested CUDA capabilities include family-specific CUDA capabilities.
+    hasFamilySpecificCudaCapability = passthruExtra.requestedFamilySpecificCudaCapabilities != [ ];
+
+    # Requested Jetson CUDA capabilities.
+    requestedJetsonCudaCapabilities = intersectLists jetsonCudaCapabilities passthruExtra.cudaCapabilities;
+
+    # Whether the requested CUDA capabilities include Jetson CUDA capabilities.
+    hasJetsonCudaCapability = passthruExtra.requestedJetsonCudaCapabilities != [ ];
   };
-  assertCondition = true;
+
+  assertions =
+    let
+      # Jetson devices cannot be targeted by the same binaries which target non-Jetson devices. While
+      # NVIDIA provides both `linux-aarch64` and `linux-sbsa` packages, which both target `aarch64`,
+      # they are built with different settings and cannot be mixed.
+      jetsonMesssagePrefix = "Jetson CUDA capabilities (${toJSON passthruExtra.requestedJetsonCudaCapabilities})";
+
+      # Remove all known capabilities from the user's list to find unrecognized capabilities.
+      unrecognizedCudaCapabilities = subtractLists allSortedCudaCapabilities passthruExtra.cudaCapabilities;
+
+      # Remove all supported capabilities from the user's list to find unsupported capabilities.
+      unsupportedCudaCapabilities = subtractLists passthruExtra.supportedCudaCapabilities passthruExtra.cudaCapabilities;
+    in
+    [
+      {
+        message = "Unrecognized CUDA capabilities: ${toJSON unrecognizedCudaCapabilities}";
+        assertion = unrecognizedCudaCapabilities == [ ];
+      }
+      {
+        message = "Unsupported CUDA capabilities: ${toJSON unsupportedCudaCapabilities}";
+        assertion = unsupportedCudaCapabilities == [ ];
+      }
+      {
+        message =
+          "${jetsonMesssagePrefix} require hostPlatform (currently ${passthruExtra.hostNixSystem}) "
+          + "to be aarch64-linux";
+        assertion = passthruExtra.hasJetsonCudaCapability -> passthruExtra.hostNixSystem == "aarch64-linux";
+      }
+      {
+        message =
+          let
+            # Find the capabilities which are not Jetson capabilities.
+            requestedNonJetsonCudaCapabilities = subtractLists (
+              passthruExtra.requestedJetsonCudaCapabilities
+              ++ passthruExtra.requestedArchitectureSpecificCudaCapabilities
+              ++ passthruExtra.requestedFamilySpecificCudaCapabilities
+            ) passthruExtra.cudaCapabilities;
+          in
+          "${jetsonMesssagePrefix} cannot be specified with non-Jetson capabilities "
+          + "(${toJSON requestedNonJetsonCudaCapabilities})";
+        assertion =
+          passthruExtra.hasJetsonCudaCapability
+          -> passthruExtra.requestedJetsonCudaCapabilities == passthruExtra.cudaCapabilities;
+      }
+    ];
+
+  assertCondition = addErrorContext "while evaluating ${mkVersionedName "cudaPackages" cudaMajorMinorVersion}.backendStdenv" (
+    _evaluateAssertions assertions
+  );
+
+  backendStdenv =
+    stdenvAdapters.useLibsFrom stdenv
+      pkgs."gcc${nvccCompatibilities.${cudaMajorMinorVersion}.gcc.maxMajorVersion}Stdenv";
 in
-
 # TODO: Consider testing whether we in fact use the newer libstdc++
-
-lib.extendDerivation assertCondition passthruExtra cudaStdenv
+extendDerivation assertCondition passthruExtra backendStdenv
diff --git a/pkgs/development/cuda-modules/tensorrt/shims.nix b/pkgs/development/cuda-modules/tensorrt/shims.nix
index d347ef7e294c..b452a515404c 100644
--- a/pkgs/development/cuda-modules/tensorrt/shims.nix
+++ b/pkgs/development/cuda-modules/tensorrt/shims.nix
@@ -1,14 +1,14 @@
 # Shims to mimic the shape of ../modules/generic/manifests/{feature,redistrib}/release.nix
 {
   package,
-  # redistArch :: String
+  # redistSystem :: String
   # String is `"unsupported"` if the given architecture is unsupported.
-  redistArch,
+  redistSystem,
 }:
 {
   featureRelease = {
     inherit (package) cudnnVersion minCudaVersion maxCudaVersion;
-    ${redistArch}.outputs = {
+    ${redistSystem}.outputs = {
       bin = true;
       lib = true;
       static = true;
diff --git a/pkgs/development/cuda-modules/tests/flags.nix b/pkgs/development/cuda-modules/tests/flags.nix
new file mode 100644
index 000000000000..926a9be5220f
--- /dev/null
+++ b/pkgs/development/cuda-modules/tests/flags.nix
@@ -0,0 +1,79 @@
+{
+  _cuda,
+  cudaNamePrefix,
+  lib,
+  runCommand,
+}:
+let
+  inherit (builtins) deepSeq toJSON tryEval;
+  inherit (_cuda.bootstrapData) cudaCapabilityToInfo;
+  inherit (_cuda.lib) formatCapabilities;
+  inherit (lib.asserts) assertMsg;
+in
+# When changing names or formats: pause, validate, and update the assert
+assert assertMsg (
+  cudaCapabilityToInfo ? "7.5" && cudaCapabilityToInfo ? "8.6"
+) "The following test requires both 7.5 and 8.6 be known CUDA capabilities";
+assert
+  let
+    expected = {
+      cudaCapabilities = [
+        "7.5"
+        "8.6"
+      ];
+      cudaForwardCompat = true;
+
+      # Sorted alphabetically
+      archNames = [
+        "Ampere"
+        "Turing"
+      ];
+
+      realArches = [
+        "sm_75"
+        "sm_86"
+      ];
+
+      virtualArches = [
+        "compute_75"
+        "compute_86"
+      ];
+
+      arches = [
+        "sm_75"
+        "sm_86"
+        "compute_86"
+      ];
+
+      gencode = [
+        "-gencode=arch=compute_75,code=sm_75"
+        "-gencode=arch=compute_86,code=sm_86"
+        "-gencode=arch=compute_86,code=compute_86"
+      ];
+
+      gencodeString = "-gencode=arch=compute_75,code=sm_75 -gencode=arch=compute_86,code=sm_86 -gencode=arch=compute_86,code=compute_86";
+
+      cmakeCudaArchitecturesString = "75;86";
+    };
+    actual = formatCapabilities {
+      inherit cudaCapabilityToInfo;
+      cudaCapabilities = [
+        "7.5"
+        "8.6"
+      ];
+      cudaForwardCompat = true;
+    };
+    actualWrapped = (tryEval (deepSeq actual actual)).value;
+  in
+  assertMsg (expected == actualWrapped) ''
+    Expected: ${toJSON expected}
+    Actual: ${toJSON actualWrapped}
+  '';
+runCommand "${cudaNamePrefix}-tests-flags"
+  {
+    __structuredAttrs = true;
+    strictDeps = true;
+  }
+  ''
+    touch "$out"
+  ''
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index c9d080b3a790..5fe56724dd13 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -2123,6 +2123,26 @@ self: super:
   gi-gtk_4 = self.gi-gtk_4_0_12;
   gi-gdk_4 = self.gi-gdk_4_0_10;
 
+  # Missing dependency on gi-gdkpixbuf
+  # https://github.com/haskell-gi/haskell-gi/commit/889f478456b38425eca7df42b01f85fae626f113
+  # Fixed in 2.91.35
+  gi-vte = overrideCabal (
+    oldAttrs:
+    assert lib.versionOlder oldAttrs.version "2.91.35";
+    {
+      # This is implemented as a sed expression instead of pulling a patch
+      # from upstream because the gi-vte repo doesn't actually contain a
+      # gi-vte.cabal file. The gi-vte.cabal file is generated from metadata in
+      # the repo.
+      postPatch =
+        (oldAttrs.postPatch or "")
+        + ''
+          sed -i 's/\(gi-gtk == .*\),/\1, gi-gdkpixbuf == 2.0.*,/' ./gi-vte.cabal
+        '';
+      buildDepends = (oldAttrs.buildDepends or [ ]) ++ [ self.gi-gdkpixbuf ];
+    }
+  ) super.gi-vte;
+
   # 2023-04-09: haskell-ci needs Cabal-syntax 3.10
   # 2024-03-21: pins specific version of ShellCheck
   # 2025-03-10: jailbreak, https://github.com/haskell-CI/haskell-ci/issues/771
diff --git a/pkgs/development/interpreters/erlang/generic-builder.nix b/pkgs/development/interpreters/erlang/generic-builder.nix
index 1943a92bbd6b..4ca3312609a1 100644
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@@ -9,6 +9,7 @@
   libxml2,
   libxslt,
   ncurses,
+  nix-update-script,
   openssl,
   perl,
   runtimeShell,
@@ -23,11 +24,6 @@
   wxSupport ? true,
   # systemd support for epmd
   systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  # updateScript deps
-  writeScript,
-  common-updater-scripts,
-  coreutils,
-  git,
   wrapGAppsHook3,
   zlib,
 }:
@@ -104,6 +100,7 @@ let
     ;
   wxPackages2 = if stdenv.hostPlatform.isDarwin then [ wxGTK ] else wxPackages;
 
+  major = builtins.head (builtins.splitVersion version);
 in
 stdenv.mkDerivation (
   {
@@ -201,30 +198,14 @@ stdenv.mkDerivation (
     '';
 
     passthru = {
-      updateScript =
-        let
-          major = builtins.head (builtins.splitVersion version);
-        in
-        writeScript "update.sh" ''
-          #!${stdenv.shell}
-          set -ox errexit
-          PATH=${
-            lib.makeBinPath [
-              common-updater-scripts
-              coreutils
-              git
-              gnused
-            ]
-          }
-          latest=$(list-git-tags --url=https://github.com/erlang/otp.git | sed -n 's/^OTP-${major}/${major}/p' | sort -V | tail -1)
-          if [ "$latest" != "${version}" ]; then
-            nixpkgs="$(git rev-parse --show-toplevel)"
-            nix_file="$nixpkgs/pkgs/development/interpreters/erlang/${major}.nix"
-            update-source-version ${baseName}_${major} "$latest" --version-key=version --print-changes --file="$nix_file"
-          else
-            echo "${baseName}R${major} is already up-to-date"
-          fi
-        '';
+      updateScript = nix-update-script {
+        extraArgs = [
+          "--version-regex"
+          "OTP-(${major}.*)"
+          "--override-filename"
+          "pkgs/development/interpreters/erlang/${major}.nix"
+        ];
+      };
     };
 
     meta =
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 727aa262ced5..7ed88db526b4 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -93,9 +93,9 @@
         major = "3";
         minor = "14";
         patch = "0";
-        suffix = "b1";
+        suffix = "b2";
       };
-      hash = "sha256-Ld0wp3yfYuBlzmSGZKJUubDAEbzaqMHCeHCH5kTL6zk=";
+      hash = "sha256-esnoSES7wKWo8feaN6aLO4yvKli0qlmZxJInyzbnDqY=";
       inherit passthruFun;
     };
     # Minimal versions of Python (built without optional dependencies)
diff --git a/pkgs/development/libraries/kde-frameworks/kjs.nix b/pkgs/development/libraries/kde-frameworks/kjs.nix
index 83ed383345e6..681748d86e70 100644
--- a/pkgs/development/libraries/kde-frameworks/kjs.nix
+++ b/pkgs/development/libraries/kde-frameworks/kjs.nix
@@ -1,8 +1,8 @@
 {
+  lib,
   mkDerivation,
   extra-cmake-modules,
   kdoctools,
-  pcre,
   qtbase,
 }:
 
@@ -13,7 +13,12 @@ mkDerivation {
     kdoctools
   ];
   buildInputs = [
-    pcre
     qtbase
   ];
+  cmakeFlags = [
+    # this can break stuff, see:
+    # https://invent.kde.org/frameworks/kjs/-/blob/3c663ad8ac16f8982784a5ebd5d9200e7aa07936/CMakeLists.txt#L36-46
+    # However: It shouldn't break much considering plasma 5 is planned to be removed.
+    (lib.cmakeBool "KJS_FORCE_DISABLE_PCRE" true)
+  ];
 }
diff --git a/pkgs/development/libraries/libfive/default.nix b/pkgs/development/libraries/libfive/default.nix
index c9c88e104ecd..38b3005bbc0c 100644
--- a/pkgs/development/libraries/libfive/default.nix
+++ b/pkgs/development/libraries/libfive/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation {
   pname = "libfive";
-  version = "0-unstable-2025-05-04";
+  version = "0-unstable-2025-05-22";
 
   src = fetchFromGitHub {
     owner = "libfive";
     repo = "libfive";
-    rev = "e704d1096f00bdfde1d1766f40dcae79f6fe5082";
-    hash = "sha256-Yu4LGf5nx9dF+8WXyQQycqFfIq4AZdEnHaekhDSWEpw=";
+    rev = "daa458279121a95b51482508bcfa906d6227442e";
+    hash = "sha256-YPP3ZSMDCQgeOPugRPmZCDI9iesIMwnU7Xu8yGwV9JM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libint/default.nix b/pkgs/development/libraries/libint/default.nix
index dbf62d6db2a9..f4db760b7fbd 100644
--- a/pkgs/development/libraries/libint/default.nix
+++ b/pkgs/development/libraries/libint/default.nix
@@ -128,7 +128,7 @@ assert (
 
 let
   pname = "libint";
-  version = "2.11.0";
+  version = "2.11.1";
 
   meta = {
     description = "Library for the evaluation of molecular integrals of many-body operators over Gaussian functions";
@@ -151,7 +151,7 @@ let
       owner = "evaleev";
       repo = pname;
       rev = "v${version}";
-      hash = "sha256-z5D3wX+AFBM4KcU77Rwma8lgqx8vwDmerFxu0mC1XCk=";
+      hash = "sha256-oV/RWWfD0Kf2egI40fV8z2atG+4Cs+9+Wvy0euNNjtM=";
     };
 
     # Replace hardcoded "/bin/rm" with normal "rm"
diff --git a/pkgs/development/libraries/pcre/default.nix b/pkgs/development/libraries/pcre/default.nix
index 7a49561e7a4f..ac6f192e3706 100644
--- a/pkgs/development/libraries/pcre/default.nix
+++ b/pkgs/development/libraries/pcre/default.nix
@@ -14,7 +14,6 @@
 assert lib.elem variant [
   null
   "cpp"
-  "pcre16"
   "pcre32"
 ];
 
diff --git a/pkgs/development/libraries/science/math/magma/generic.nix b/pkgs/development/libraries/science/math/magma/generic.nix
index 53407ebe7bcb..c7938b98368a 100644
--- a/pkgs/development/libraries/science/math/magma/generic.nix
+++ b/pkgs/development/libraries/science/math/magma/generic.nix
@@ -94,7 +94,7 @@ let
   minArch =
     let
       # E.g. [ "80" "86" "90" ]
-      cudaArchitectures = (builtins.map flags.dropDot flags.cudaCapabilities);
+      cudaArchitectures = (builtins.map flags.dropDots flags.cudaCapabilities);
       minArch' = builtins.head (builtins.sort strings.versionOlder cudaArchitectures);
     in
     # "75" -> "750"  Cf. https://github.com/icl-utk-edu/magma/blob/v2.9.0/CMakeLists.txt#L200-L201
diff --git a/pkgs/development/mobile/androidenv/README.md b/pkgs/development/mobile/androidenv/README.md
index bf3726342091..7ebb9d640c0b 100644
--- a/pkgs/development/mobile/androidenv/README.md
+++ b/pkgs/development/mobile/androidenv/README.md
@@ -1,15 +1,13 @@
 # How to update
 
-1. `./fetchrepo.sh`
-2. `./mkrepo.sh`
-3. Check the `repo.json` diff for new stable versions of `tools`, `platform-tools`, `build-tools`, `emulator` and/or `ndk`
-4. Update the relevant argument defaults in `compose-android-packages.nix`
+`nix-shell maintainers/scripts/update.nix  --argstr package androidenv.test-suite --argstr commit true`
 
 # How to run tests
+
 You may need to make yourself familiar with [package tests](../../../README.md#package-tests), and [Writing larger package tests](../../../README.md#writing-larger-package-tests), then run tests locally with:
 
 ```shell
 $ export NIXPKGS_ALLOW_UNFREE=1
 $ cd path/to/nixpkgs
-$ nix-build -A androidenv.test-suite.tests
+$ nix-build -A androidenv.test-suite
 ```
diff --git a/pkgs/development/mobile/androidenv/compose-android-packages.nix b/pkgs/development/mobile/androidenv/compose-android-packages.nix
index 57a9afc8a9de..1803a04a6638 100644
--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@@ -31,7 +31,7 @@ in
     # Reads the repo JSON. If repoXmls is provided, will build a repo JSON into the Nix store.
     if repoXmls != null then
       let
-        # Uses mkrepo.rb to create a repo spec.
+        # Uses update.rb to create a repo spec.
         mkRepoJson =
           {
             packages ? [ ],
@@ -43,6 +43,7 @@ in
               ruby.withPackages (
                 pkgs: with pkgs; [
                   slop
+                  curb
                   nokogiri
                 ]
               )
@@ -68,7 +69,7 @@ in
             preferLocalBuild = true;
             unpackPhase = "true";
             buildPhase = ''
-              ruby ${./mkrepo.rb} ${lib.escapeShellArgs mkRepoRubyArguments} > repo.json
+              env ruby -e 'load "${./update.rb}"' -- ${lib.escapeShellArgs mkRepoRubyArguments} --input /dev/null --output repo.json
             '';
             installPhase = ''
               mv repo.json $out
diff --git a/pkgs/development/mobile/androidenv/examples/shell-ifd.nix b/pkgs/development/mobile/androidenv/examples/shell-ifd.nix
new file mode 100644
index 000000000000..254bc6112311
--- /dev/null
+++ b/pkgs/development/mobile/androidenv/examples/shell-ifd.nix
@@ -0,0 +1,60 @@
+{
+  # If you want to use the in-tree version of nixpkgs:
+  pkgs ? import ../../../../.. {
+    config.allowUnfree = true;
+  },
+
+  licenseAccepted ? pkgs.callPackage ../license.nix { },
+}:
+
+# Tests IFD with androidenv. Needs a folder of `../xml` in your local tree;
+# use ../fetchrepo.sh to produce it.
+let
+  androidEnv = pkgs.callPackage ./.. {
+    inherit pkgs licenseAccepted;
+  };
+
+  sdkArgs = {
+    repoXmls = {
+      packages = [ ../xml/repository2-3.xml ];
+      images = [
+        ../xml/android-sys-img2-3.xml
+        ../xml/android-tv-sys-img2-3.xml
+        ../xml/google_apis-sys-img2-3.xml
+        ../xml/google_apis_playstore-sys-img2-3.xml
+        ../xml/android-wear-sys-img2-3.xml
+        ../xml/android-wear-cn-sys-img2-3.xml
+        ../xml/android-automotive-sys-img2-3.xml
+      ];
+      addons = [ ../xml/addon2-3.xml ];
+    };
+  };
+
+  androidComposition = androidEnv.composeAndroidPackages sdkArgs;
+  androidSdk = androidComposition.androidsdk;
+  platformTools = androidComposition.platform-tools;
+  jdk = pkgs.jdk;
+in
+pkgs.mkShell {
+  name = "androidenv-example-ifd-demo";
+  packages = [
+    androidSdk
+    platformTools
+    jdk
+  ];
+
+  LANG = "C.UTF-8";
+  LC_ALL = "C.UTF-8";
+  JAVA_HOME = jdk.home;
+
+  # Note: ANDROID_HOME is deprecated. Use ANDROID_SDK_ROOT.
+  ANDROID_SDK_ROOT = "${androidSdk}/libexec/android-sdk";
+
+  shellHook = ''
+    # Write out local.properties for Android Studio.
+    cat <<EOF > local.properties
+    # This file was automatically generated by nix-shell.
+    sdk.dir=$ANDROID_SDK_ROOT
+    EOF
+  '';
+}
diff --git a/pkgs/development/mobile/androidenv/mkrepo.sh b/pkgs/development/mobile/androidenv/mkrepo.sh
deleted file mode 100755
index 174b765e9c34..000000000000
--- a/pkgs/development/mobile/androidenv/mkrepo.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p "ruby.withPackages (pkgs: with pkgs; [ slop nokogiri moreutils ])"
-
-set -e
-
-pushd "$(dirname "$0")" &>/dev/null || exit 1
-
-echo "Writing repo.json" >&2
-ruby mkrepo.rb \
-    --packages ./xml/repository2-3.xml \
-    --images ./xml/android-sys-img2-3.xml \
-    --images ./xml/android-tv-sys-img2-3.xml \
-    --images ./xml/android-wear-cn-sys-img2-3.xml \
-    --images ./xml/android-wear-sys-img2-3.xml \
-    --images ./xml/android-automotive-sys-img2-3.xml \
-    --images ./xml/google_apis-sys-img2-3.xml \
-    --images ./xml/google_apis_playstore-sys-img2-3.xml \
-    --addons ./xml/addon2-3.xml <./repo.json
-popd &>/dev/null
diff --git a/pkgs/development/mobile/androidenv/repo.json b/pkgs/development/mobile/androidenv/repo.json
index 26dc4252f547..d0bed2fdbd75 100644
--- a/pkgs/development/mobile/androidenv/repo.json
+++ b/pkgs/development/mobile/androidenv/repo.json
@@ -12,7 +12,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-10",
@@ -91,7 +91,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-11",
@@ -156,7 +156,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-12",
@@ -233,7 +233,7 @@
           }
         ],
         "displayName": "Google TV Addon",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-googletv-license",
         "name": "google_tv_addon",
         "path": "add-ons/addon-google_tv_addon-google-12",
@@ -280,7 +280,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-13",
@@ -357,7 +357,7 @@
           }
         ],
         "displayName": "Google TV Addon",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-googletv-license",
         "name": "google_tv_addon",
         "path": "add-ons/addon-google_tv_addon-google-13",
@@ -404,7 +404,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-14",
@@ -483,7 +483,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-15",
@@ -576,7 +576,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-16",
@@ -669,7 +669,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-17",
@@ -762,7 +762,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-18",
@@ -855,7 +855,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-19",
@@ -948,7 +948,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-21",
@@ -1041,7 +1041,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-22",
@@ -1134,7 +1134,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-23",
@@ -1227,7 +1227,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-24",
@@ -1320,7 +1320,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-25",
@@ -1413,7 +1413,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-3",
@@ -1478,7 +1478,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-4",
@@ -1543,7 +1543,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-5",
@@ -1608,7 +1608,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-6",
@@ -1673,7 +1673,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-7",
@@ -1738,7 +1738,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-8",
@@ -1803,7 +1803,7 @@
           }
         ],
         "displayName": "Google APIs",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "google_apis",
         "path": "add-ons/addon-google_apis-google-9",
@@ -1869,7 +1869,7 @@
         }
       ],
       "displayName": "Android Support Repository",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-android-m2repository",
       "path": "extras/android/m2repository",
@@ -1900,7 +1900,7 @@
         }
       ],
       "displayName": "Android Emulator hypervisor driver (installer)",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-Android_Emulator_Hypervisor_Driver",
       "path": "extras/google/Android_Emulator_Hypervisor_Driver",
@@ -1931,7 +1931,7 @@
         }
       ],
       "displayName": "Google AdMob Ads SDK",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-admob_ads_sdk",
       "path": "extras/google/admob_ads_sdk",
@@ -1960,7 +1960,7 @@
         }
       ],
       "displayName": "Google Analytics App Tracking SDK",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-analytics_sdk_v2",
       "path": "extras/google/analytics_sdk_v2",
@@ -2010,7 +2010,7 @@
         }
       ],
       "displayName": "Android Auto Desktop Head Unit Emulator",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-auto",
       "path": "extras/google/auto",
@@ -2036,7 +2036,7 @@
         }
       ],
       "displayName": "Google Cloud Messaging for Android Library",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-gcm",
       "path": "extras/google/gcm",
@@ -2072,7 +2072,7 @@
         }
       },
       "displayName": "Google Play services",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-google_play_services",
       "path": "extras/google/google_play_services",
@@ -2101,7 +2101,7 @@
         }
       ],
       "displayName": "Google Play services for Froyo",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-google_play_services_froyo",
       "path": "extras/google/google_play_services_froyo",
@@ -2130,7 +2130,7 @@
         }
       ],
       "displayName": "Google Play Instant Development SDK",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-instantapps",
       "path": "extras/google/instantapps",
@@ -2168,7 +2168,7 @@
         }
       },
       "displayName": "Google Repository",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-m2repository",
       "path": "extras/google/m2repository",
@@ -2197,7 +2197,7 @@
         }
       ],
       "displayName": "Google Play APK Expansion library",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-market_apk_expansion",
       "path": "extras/google/market_apk_expansion",
@@ -2226,7 +2226,7 @@
         }
       ],
       "displayName": "Google Play Licensing Library",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-market_licensing",
       "path": "extras/google/market_licensing",
@@ -2256,7 +2256,7 @@
         }
       ],
       "displayName": "Android Auto API Simulators",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-simulators",
       "path": "extras/google/simulators",
@@ -2285,7 +2285,7 @@
         }
       ],
       "displayName": "Google USB Driver",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-usb_driver",
       "path": "extras/google/usb_driver",
@@ -2314,7 +2314,7 @@
         }
       ],
       "displayName": "Google Web Driver",
-      "last-available-day": 20174,
+      "last-available-day": 20237,
       "license": "android-sdk-license",
       "name": "extras-google-webdriver",
       "path": "extras/google/webdriver",
@@ -2984,7 +2984,7 @@
             }
           },
           "displayName": "ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-10-default-armeabi-v7a",
           "path": "system-images/android-10/default/armeabi-v7a",
@@ -3030,7 +3030,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-10-default-x86",
           "path": "system-images/android-10/default/x86",
@@ -3078,7 +3078,7 @@
             }
           },
           "displayName": "Google APIs ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-10-google_apis-armeabi-v7a",
           "path": "system-images/android-10/google_apis/armeabi-v7a",
@@ -3130,7 +3130,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-10-google_apis-x86",
           "path": "system-images/android-10/google_apis/x86",
@@ -3179,7 +3179,7 @@
             }
           ],
           "displayName": "ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-14-default-armeabi-v7a",
           "path": "system-images/android-14/default/armeabi-v7a",
@@ -3229,7 +3229,7 @@
             }
           },
           "displayName": "ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-15-default-armeabi-v7a",
           "path": "system-images/android-15/default/armeabi-v7a",
@@ -3275,7 +3275,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-15-default-x86",
           "path": "system-images/android-15/default/x86",
@@ -3323,7 +3323,7 @@
             }
           },
           "displayName": "Google APIs ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-15-google_apis-armeabi-v7a",
           "path": "system-images/android-15/google_apis/armeabi-v7a",
@@ -3375,7 +3375,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-15-google_apis-x86",
           "path": "system-images/android-15/google_apis/x86",
@@ -3431,7 +3431,7 @@
             }
           },
           "displayName": "ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-16-default-armeabi-v7a",
           "path": "system-images/android-16/default/armeabi-v7a",
@@ -3470,7 +3470,7 @@
             }
           ],
           "displayName": "MIPS System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "mips-android-sysimage-license",
           "name": "system-image-16-default-mips",
           "path": "system-images/android-16/default/mips",
@@ -3516,7 +3516,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-16-default-x86",
           "path": "system-images/android-16/default/x86",
@@ -3564,7 +3564,7 @@
             }
           },
           "displayName": "Google APIs ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-16-google_apis-armeabi-v7a",
           "path": "system-images/android-16/google_apis/armeabi-v7a",
@@ -3616,7 +3616,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-16-google_apis-x86",
           "path": "system-images/android-16/google_apis/x86",
@@ -3672,7 +3672,7 @@
             }
           },
           "displayName": "ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-17-default-armeabi-v7a",
           "path": "system-images/android-17/default/armeabi-v7a",
@@ -3711,7 +3711,7 @@
             }
           ],
           "displayName": "MIPS System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "mips-android-sysimage-license",
           "name": "system-image-17-default-mips",
           "path": "system-images/android-17/default/mips",
@@ -3757,7 +3757,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-17-default-x86",
           "path": "system-images/android-17/default/x86",
@@ -3811,7 +3811,7 @@
             }
           },
           "displayName": "Google APIs ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-17-google_apis-armeabi-v7a",
           "path": "system-images/android-17/google_apis/armeabi-v7a",
@@ -3863,7 +3863,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-17-google_apis-x86",
           "path": "system-images/android-17/google_apis/x86",
@@ -3919,7 +3919,7 @@
             }
           },
           "displayName": "ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-18-default-armeabi-v7a",
           "path": "system-images/android-18/default/armeabi-v7a",
@@ -3965,7 +3965,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-18-default-x86",
           "path": "system-images/android-18/default/x86",
@@ -4013,7 +4013,7 @@
             }
           },
           "displayName": "Google APIs ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-18-google_apis-armeabi-v7a",
           "path": "system-images/android-18/google_apis/armeabi-v7a",
@@ -4065,7 +4065,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-18-google_apis-x86",
           "path": "system-images/android-18/google_apis/x86",
@@ -4121,7 +4121,7 @@
             }
           },
           "displayName": "ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-19-default-armeabi-v7a",
           "path": "system-images/android-19/default/armeabi-v7a",
@@ -4167,7 +4167,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-19-default-x86",
           "path": "system-images/android-19/default/x86",
@@ -4215,7 +4215,7 @@
             }
           },
           "displayName": "Google APIs ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-19-google_apis-armeabi-v7a",
           "path": "system-images/android-19/google_apis/armeabi-v7a",
@@ -4267,7 +4267,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-19-google_apis-x86",
           "path": "system-images/android-19/google_apis/x86",
@@ -4316,7 +4316,7 @@
             }
           ],
           "displayName": "Android TV ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-21-android-tv-armeabi-v7a",
           "path": "system-images/android-21/android-tv/armeabi-v7a",
@@ -4353,7 +4353,7 @@
             }
           ],
           "displayName": "Android TV Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-21-android-tv-x86",
           "path": "system-images/android-21/android-tv/x86",
@@ -4392,7 +4392,7 @@
             }
           ],
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-21-default-arm64-v8a",
           "path": "system-images/android-21/default/arm64-v8a",
@@ -4438,7 +4438,7 @@
             }
           },
           "displayName": "ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-21-default-armeabi-v7a",
           "path": "system-images/android-21/default/armeabi-v7a",
@@ -4484,7 +4484,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-21-default-x86",
           "path": "system-images/android-21/default/x86",
@@ -4530,7 +4530,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-21-default-x86_64",
           "path": "system-images/android-21/default/x86_64",
@@ -4571,7 +4571,7 @@
             }
           ],
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-21-google_apis-arm64-v8a",
           "path": "system-images/android-21/google_apis/arm64-v8a",
@@ -4623,7 +4623,7 @@
             }
           },
           "displayName": "Google APIs ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-21-google_apis-armeabi-v7a",
           "path": "system-images/android-21/google_apis/armeabi-v7a",
@@ -4675,7 +4675,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-21-google_apis-x86",
           "path": "system-images/android-21/google_apis/x86",
@@ -4727,7 +4727,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-21-google_apis-x86_64",
           "path": "system-images/android-21/google_apis/x86_64",
@@ -4776,7 +4776,7 @@
             }
           ],
           "displayName": "Android TV Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-22-android-tv-x86",
           "path": "system-images/android-22/android-tv/x86",
@@ -4815,7 +4815,7 @@
             }
           ],
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-22-default-arm64-v8a",
           "path": "system-images/android-22/default/arm64-v8a",
@@ -4861,7 +4861,7 @@
             }
           },
           "displayName": "ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-22-default-armeabi-v7a",
           "path": "system-images/android-22/default/armeabi-v7a",
@@ -4907,7 +4907,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-22-default-x86",
           "path": "system-images/android-22/default/x86",
@@ -4953,7 +4953,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-22-default-x86_64",
           "path": "system-images/android-22/default/x86_64",
@@ -4994,7 +4994,7 @@
             }
           ],
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-22-google_apis-arm64-v8a",
           "path": "system-images/android-22/google_apis/arm64-v8a",
@@ -5046,7 +5046,7 @@
             }
           },
           "displayName": "Google APIs ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-22-google_apis-armeabi-v7a",
           "path": "system-images/android-22/google_apis/armeabi-v7a",
@@ -5098,7 +5098,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-22-google_apis-x86",
           "path": "system-images/android-22/google_apis/x86",
@@ -5150,7 +5150,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-22-google_apis-x86_64",
           "path": "system-images/android-22/google_apis/x86_64",
@@ -5199,7 +5199,7 @@
             }
           ],
           "displayName": "Android TV ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-23-android-tv-armeabi-v7a",
           "path": "system-images/android-23/android-tv/armeabi-v7a",
@@ -5243,7 +5243,7 @@
             }
           },
           "displayName": "Android TV Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-23-android-tv-x86",
           "path": "system-images/android-23/android-tv/x86",
@@ -5282,7 +5282,7 @@
             }
           ],
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-23-default-arm64-v8a",
           "path": "system-images/android-23/default/arm64-v8a",
@@ -5328,7 +5328,7 @@
             }
           },
           "displayName": "ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-23-default-armeabi-v7a",
           "path": "system-images/android-23/default/armeabi-v7a",
@@ -5374,7 +5374,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-23-default-x86",
           "path": "system-images/android-23/default/x86",
@@ -5420,7 +5420,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-23-default-x86_64",
           "path": "system-images/android-23/default/x86_64",
@@ -5461,7 +5461,7 @@
             }
           ],
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-23-google_apis-arm64-v8a",
           "path": "system-images/android-23/google_apis/arm64-v8a",
@@ -5513,7 +5513,7 @@
             }
           },
           "displayName": "Google APIs ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-23-google_apis-armeabi-v7a",
           "path": "system-images/android-23/google_apis/armeabi-v7a",
@@ -5565,7 +5565,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-23-google_apis-x86",
           "path": "system-images/android-23/google_apis/x86",
@@ -5617,7 +5617,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-23-google_apis-x86_64",
           "path": "system-images/android-23/google_apis/x86_64",
@@ -5673,7 +5673,7 @@
             }
           },
           "displayName": "Android TV Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-24-android-tv-x86",
           "path": "system-images/android-24/android-tv/x86",
@@ -5712,7 +5712,7 @@
             }
           ],
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-24-default-arm64-v8a",
           "path": "system-images/android-24/default/arm64-v8a",
@@ -5758,7 +5758,7 @@
             }
           },
           "displayName": "ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-24-default-armeabi-v7a",
           "path": "system-images/android-24/default/armeabi-v7a",
@@ -5804,7 +5804,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-24-default-x86",
           "path": "system-images/android-24/default/x86",
@@ -5850,7 +5850,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-24-default-x86_64",
           "path": "system-images/android-24/default/x86_64",
@@ -5898,7 +5898,7 @@
             }
           },
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-24-google_apis-arm64-v8a",
           "path": "system-images/android-24/google_apis/arm64-v8a",
@@ -5950,7 +5950,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-24-google_apis-x86",
           "path": "system-images/android-24/google_apis/x86",
@@ -6002,7 +6002,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-24-google_apis-x86_64",
           "path": "system-images/android-24/google_apis/x86_64",
@@ -6056,7 +6056,7 @@
             }
           },
           "displayName": "Google Play Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-24-google_apis_playstore-x86",
           "path": "system-images/android-24/google_apis_playstore/x86",
@@ -6112,7 +6112,7 @@
             }
           },
           "displayName": "Android TV Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-25-android-tv-x86",
           "path": "system-images/android-25/android-tv/x86",
@@ -6158,7 +6158,7 @@
             }
           },
           "displayName": "Android Wear ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-25-android-wear-armeabi-v7a",
           "path": "system-images/android-25/android-wear/armeabi-v7a",
@@ -6202,7 +6202,7 @@
             }
           },
           "displayName": "Android Wear Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-25-android-wear-x86",
           "path": "system-images/android-25/android-wear/x86",
@@ -6241,7 +6241,7 @@
             }
           ],
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-25-default-arm64-v8a",
           "path": "system-images/android-25/default/arm64-v8a",
@@ -6287,7 +6287,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-25-default-x86",
           "path": "system-images/android-25/default/x86",
@@ -6333,7 +6333,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-25-default-x86_64",
           "path": "system-images/android-25/default/x86_64",
@@ -6374,7 +6374,7 @@
             }
           ],
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-25-google_apis-arm64-v8a",
           "path": "system-images/android-25/google_apis/arm64-v8a",
@@ -6426,7 +6426,7 @@
             }
           },
           "displayName": "Google APIs ARM EABI v7a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-25-google_apis-armeabi-v7a",
           "path": "system-images/android-25/google_apis/armeabi-v7a",
@@ -6478,7 +6478,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-25-google_apis-x86",
           "path": "system-images/android-25/google_apis/x86",
@@ -6530,7 +6530,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-25-google_apis-x86_64",
           "path": "system-images/android-25/google_apis/x86_64",
@@ -6584,7 +6584,7 @@
             }
           },
           "displayName": "Google Play Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-25-google_apis_playstore-x86",
           "path": "system-images/android-25/google_apis_playstore/x86",
@@ -6655,7 +6655,7 @@
             }
           },
           "displayName": "Android TV Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-26-android-tv-x86",
           "path": "system-images/android-26/android-tv/x86",
@@ -6701,7 +6701,7 @@
             }
           },
           "displayName": "Android Wear Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-26-android-wear-x86",
           "path": "system-images/android-26/android-wear/x86",
@@ -6752,7 +6752,7 @@
             }
           },
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-26-default-arm64-v8a",
           "path": "system-images/android-26/default/arm64-v8a",
@@ -6796,7 +6796,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-26-default-x86",
           "path": "system-images/android-26/default/x86",
@@ -6840,7 +6840,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-26-default-x86_64",
           "path": "system-images/android-26/default/x86_64",
@@ -6891,7 +6891,7 @@
             }
           },
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-26-google_apis-arm64-v8a",
           "path": "system-images/android-26/google_apis/arm64-v8a",
@@ -6958,7 +6958,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-26-google_apis-x86",
           "path": "system-images/android-26/google_apis/x86",
@@ -7025,7 +7025,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-26-google_apis-x86_64",
           "path": "system-images/android-26/google_apis/x86_64",
@@ -7094,7 +7094,7 @@
             }
           },
           "displayName": "Google Play Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-26-google_apis_playstore-x86",
           "path": "system-images/android-26/google_apis_playstore/x86",
@@ -7150,7 +7150,7 @@
             }
           },
           "displayName": "Android TV Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-27-android-tv-x86",
           "path": "system-images/android-27/android-tv/x86",
@@ -7201,7 +7201,7 @@
             }
           },
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-27-default-arm64-v8a",
           "path": "system-images/android-27/default/arm64-v8a",
@@ -7245,7 +7245,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-27-default-x86",
           "path": "system-images/android-27/default/x86",
@@ -7289,7 +7289,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-27-default-x86_64",
           "path": "system-images/android-27/default/x86_64",
@@ -7340,7 +7340,7 @@
             }
           },
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-27-google_apis-arm64-v8a",
           "path": "system-images/android-27/google_apis/arm64-v8a",
@@ -7407,7 +7407,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-27-google_apis-x86",
           "path": "system-images/android-27/google_apis/x86",
@@ -7476,7 +7476,7 @@
             }
           },
           "displayName": "Google Play Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-27-google_apis_playstore-x86",
           "path": "system-images/android-27/google_apis_playstore/x86",
@@ -7537,7 +7537,7 @@
             }
           },
           "displayName": "Automotive Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-28-android-automotive-playstore-x86",
           "path": "system-images/android-28/android-automotive-playstore/x86",
@@ -7582,7 +7582,7 @@
             }
           },
           "displayName": "Android TV Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-28-android-tv-x86",
           "path": "system-images/android-28/android-tv/x86",
@@ -7628,7 +7628,7 @@
             }
           },
           "displayName": "Wear OS Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-28-android-wear-x86",
           "path": "system-images/android-28/android-wear/x86",
@@ -7679,7 +7679,7 @@
             }
           },
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-28-default-arm64-v8a",
           "path": "system-images/android-28/default/arm64-v8a",
@@ -7716,7 +7716,7 @@
             }
           ],
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-28-default-x86",
           "path": "system-images/android-28/default/x86",
@@ -7753,7 +7753,7 @@
             }
           ],
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-28-default-x86_64",
           "path": "system-images/android-28/default/x86_64",
@@ -7804,7 +7804,7 @@
             }
           },
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-28-google_apis-arm64-v8a",
           "path": "system-images/android-28/google_apis/arm64-v8a",
@@ -7871,7 +7871,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-28-google_apis-x86",
           "path": "system-images/android-28/google_apis/x86",
@@ -7938,7 +7938,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-28-google_apis-x86_64",
           "path": "system-images/android-28/google_apis/x86_64",
@@ -7997,7 +7997,7 @@
             }
           },
           "displayName": "Google ARM64-V8a Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-28-google_apis_playstore-arm64-v8a",
           "path": "system-images/android-28/google_apis_playstore/arm64-v8a",
@@ -8064,7 +8064,7 @@
             }
           },
           "displayName": "Google Play Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-28-google_apis_playstore-x86",
           "path": "system-images/android-28/google_apis_playstore/x86",
@@ -8131,7 +8131,7 @@
             }
           },
           "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-28-google_apis_playstore-x86_64",
           "path": "system-images/android-28/google_apis_playstore/x86_64",
@@ -8192,7 +8192,7 @@
             }
           },
           "displayName": "Automotive with Play Store Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-29-android-automotive-playstore-x86",
           "path": "system-images/android-29/android-automotive-playstore/x86",
@@ -8252,7 +8252,7 @@
             }
           },
           "displayName": "Android TV Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-29-android-tv-x86",
           "path": "system-images/android-29/android-tv/x86",
@@ -8291,7 +8291,7 @@
             }
           ],
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-29-default-arm64-v8a",
           "path": "system-images/android-29/default/arm64-v8a",
@@ -8354,7 +8354,7 @@
             }
           },
           "displayName": "Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-29-default-x86",
           "path": "system-images/android-29/default/x86",
@@ -8417,7 +8417,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-29-default-x86_64",
           "path": "system-images/android-29/default/x86_64",
@@ -8468,7 +8468,7 @@
             }
           },
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-29-google_apis-arm64-v8a",
           "path": "system-images/android-29/google_apis/arm64-v8a",
@@ -8525,7 +8525,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-29-google_apis-x86",
           "path": "system-images/android-29/google_apis/x86",
@@ -8582,7 +8582,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-29-google_apis-x86_64",
           "path": "system-images/android-29/google_apis/x86_64",
@@ -8641,7 +8641,7 @@
             }
           },
           "displayName": "Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-29-google_apis_playstore-arm64-v8a",
           "path": "system-images/android-29/google_apis_playstore/arm64-v8a",
@@ -8722,7 +8722,7 @@
             }
           },
           "displayName": "Google Play Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-29-google_apis_playstore-x86",
           "path": "system-images/android-29/google_apis_playstore/x86",
@@ -8803,7 +8803,7 @@
             }
           },
           "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-29-google_apis_playstore-x86_64",
           "path": "system-images/android-29/google_apis_playstore/x86_64",
@@ -8864,7 +8864,7 @@
             }
           },
           "displayName": "Automotive with Play Store Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-30-android-automotive-playstore-x86_64",
           "path": "system-images/android-30/android-automotive-playstore/x86_64",
@@ -8924,7 +8924,7 @@
             }
           },
           "displayName": "Android TV Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-30-android-tv-x86",
           "path": "system-images/android-30/android-tv/x86",
@@ -8957,8 +8957,8 @@
             {
               "arch": "all",
               "os": "all",
-              "sha1": "56c0c2550580f2ba1b33009c77db017dbcb3d470",
-              "size": 827418923,
+              "sha1": "ef7b5554a5f77fb33c7965604552411c155a38ac",
+              "size": 649112314,
               "url": "https://dl.google.com/android/repository/sys-img/android-wear/arm64-v8a-30_r12.zip"
             }
           ],
@@ -8969,11 +8969,11 @@
               }
             }
           },
-          "displayName": "Wear OS 3 ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "displayName": "China version of Wear OS 3 ARM 64 v8a System Image",
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-30-android-wear-arm64-v8a",
-          "path": "system-images/android-30/android-wear/arm64-v8a",
+          "path": "system-images/android-30/android-wear-cn/arm64-v8a",
           "revision": "30-android-wear-arm64-v8a",
           "revision-details": {
             "major:0": "12"
@@ -8991,7 +8991,7 @@
               "id:0": "android-wear"
             },
             "tag:2": {
-              "display:1": "Wear OS 3",
+              "display:1": "China version of Wear OS 3",
               "id:0": "android-wear"
             }
           }
@@ -9001,8 +9001,8 @@
             {
               "arch": "all",
               "os": "all",
-              "sha1": "73a96614a2ddcf586e4c659c436d2360bc25badc",
-              "size": 901929440,
+              "sha1": "42548b2bd1696ad6bd2f01a1cf83ef7a10971932",
+              "size": 759598676,
               "url": "https://dl.google.com/android/repository/sys-img/android-wear/x86-30_r12.zip"
             }
           ],
@@ -9013,11 +9013,11 @@
               }
             }
           },
-          "displayName": "Wear OS 3 Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "displayName": "China version of Wear OS 3 Intel x86 Atom System Image",
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-30-android-wear-x86",
-          "path": "system-images/android-30/android-wear/x86",
+          "path": "system-images/android-30/android-wear-cn/x86",
           "revision": "30-android-wear-x86",
           "revision-details": {
             "major:0": "12"
@@ -9035,7 +9035,7 @@
               "id:0": "android-wear"
             },
             "tag:2": {
-              "display:1": "Wear OS 3",
+              "display:1": "China version of Wear OS 3",
               "id:0": "android-wear"
             }
           }
@@ -9053,7 +9053,7 @@
             }
           ],
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-30-default-arm64-v8a",
           "path": "system-images/android-30/default/arm64-v8a",
@@ -9102,7 +9102,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-30-default-x86_64",
           "path": "system-images/android-30/default/x86_64",
@@ -9153,7 +9153,7 @@
             }
           },
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-30-google_apis-arm64-v8a",
           "path": "system-images/android-30/google_apis/arm64-v8a",
@@ -9220,7 +9220,7 @@
             }
           },
           "displayName": "Google APIs Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-30-google_apis-x86",
           "path": "system-images/android-30/google_apis/x86",
@@ -9287,7 +9287,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-30-google_apis-x86_64",
           "path": "system-images/android-30/google_apis/x86_64",
@@ -9353,7 +9353,7 @@
             }
           },
           "displayName": "Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-30-google_apis_playstore-arm64-v8a",
           "path": "system-images/android-30/google_apis_playstore/arm64-v8a",
@@ -9434,7 +9434,7 @@
             }
           },
           "displayName": "Google Play Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-30-google_apis_playstore-x86",
           "path": "system-images/android-30/google_apis_playstore/x86",
@@ -9515,7 +9515,7 @@
             }
           },
           "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-30-google_apis_playstore-x86_64",
           "path": "system-images/android-30/google_apis_playstore/x86_64",
@@ -9586,7 +9586,7 @@
             }
           },
           "displayName": "Android TV ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-31-android-tv-arm64-v8a",
           "path": "system-images/android-31/android-tv/arm64-v8a",
@@ -9645,7 +9645,7 @@
             }
           },
           "displayName": "Android TV Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-31-android-tv-x86",
           "path": "system-images/android-31/android-tv/x86",
@@ -9696,7 +9696,7 @@
             }
           },
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-31-default-arm64-v8a",
           "path": "system-images/android-31/default/arm64-v8a",
@@ -9745,7 +9745,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-31-default-x86_64",
           "path": "system-images/android-31/default/x86_64",
@@ -9806,7 +9806,7 @@
             }
           },
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-31-google_apis-arm64-v8a",
           "path": "system-images/android-31/google_apis/arm64-v8a",
@@ -9873,7 +9873,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-31-google_apis-x86_64",
           "path": "system-images/android-31/google_apis/x86_64",
@@ -9949,7 +9949,7 @@
             }
           },
           "displayName": "Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-31-google_apis_playstore-arm64-v8a",
           "path": "system-images/android-31/google_apis_playstore/arm64-v8a",
@@ -10016,7 +10016,7 @@
             }
           },
           "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-31-google_apis_playstore-x86_64",
           "path": "system-images/android-31/google_apis_playstore/x86_64",
@@ -10077,7 +10077,7 @@
             }
           },
           "displayName": "Android Automotive with Google Play arm64-v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-32-android-automotive-playstore-arm64-v8a",
           "path": "system-images/android-32/android-automotive-playstore/arm64-v8a",
@@ -10130,7 +10130,7 @@
             }
           },
           "displayName": "Android Automotive with Google Play x86_64 System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-32-android-automotive-playstore-x86_64",
           "path": "system-images/android-32/android-automotive-playstore/x86_64",
@@ -10185,7 +10185,7 @@
             }
           },
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-32-default-arm64-v8a",
           "path": "system-images/android-32/default/arm64-v8a",
@@ -10234,7 +10234,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-32-default-x86_64",
           "path": "system-images/android-32/default/x86_64",
@@ -10295,7 +10295,7 @@
             }
           },
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-32-google_apis-arm64-v8a",
           "path": "system-images/android-32/google_apis/arm64-v8a",
@@ -10362,7 +10362,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-32-google_apis-x86_64",
           "path": "system-images/android-32/google_apis/x86_64",
@@ -10438,7 +10438,7 @@
             }
           },
           "displayName": "Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-32-google_apis_playstore-arm64-v8a",
           "path": "system-images/android-32/google_apis_playstore/arm64-v8a",
@@ -10519,7 +10519,7 @@
             }
           },
           "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-32-google_apis_playstore-x86_64",
           "path": "system-images/android-32/google_apis_playstore/x86_64",
@@ -10562,9 +10562,9 @@
             {
               "arch": "all",
               "os": "all",
-              "sha1": "ca95328e871a6ec613fffc410b2e81ca7c7c2c95",
-              "size": 1314179288,
-              "url": "https://dl.google.com/android/repository/sys-img/android-automotive/arm64-v8a-33_r04.zip"
+              "sha1": "1350f29ead803659be77949886e4cc0fca543ae3",
+              "size": 1311397288,
+              "url": "https://dl.google.com/android/repository/sys-img/android-automotive/arm64-v8a-33_r05.zip"
             }
           ],
           "dependencies": {
@@ -10580,13 +10580,13 @@
             }
           },
           "displayName": "Android Automotive with Google APIs arm64-v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-33-android-automotive-arm64-v8a",
           "path": "system-images/android-33/android-automotive/arm64-v8a",
           "revision": "33-android-automotive-arm64-v8a",
           "revision-details": {
-            "major:0": "4"
+            "major:0": "5"
           },
           "type-details": {
             "abi:6": "arm64-v8a",
@@ -10615,9 +10615,9 @@
             {
               "arch": "all",
               "os": "all",
-              "sha1": "f23487d919389c9c5bf1882c030830de31ed0a21",
-              "size": 1336031457,
-              "url": "https://dl.google.com/android/repository/sys-img/android-automotive/x86_64-33_r04.zip"
+              "sha1": "4657b6da29ad4273986f3b8fa9b1caac3bb5195f",
+              "size": 1333244962,
+              "url": "https://dl.google.com/android/repository/sys-img/android-automotive/x86_64-33_r05.zip"
             }
           ],
           "dependencies": {
@@ -10633,13 +10633,13 @@
             }
           },
           "displayName": "Android Automotive with Google APIs x86_64 System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-33-android-automotive-x86_64",
           "path": "system-images/android-33/android-automotive/x86_64",
           "revision": "33-android-automotive-x86_64",
           "revision-details": {
-            "major:0": "4"
+            "major:0": "5"
           },
           "type-details": {
             "abi:6": "x86_64",
@@ -10698,7 +10698,7 @@
             }
           },
           "displayName": "Android TV ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-33-android-tv-arm64-v8a",
           "path": "system-images/android-33/android-tv/arm64-v8a",
@@ -10757,7 +10757,7 @@
             }
           },
           "displayName": "Android TV Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-33-android-tv-x86",
           "path": "system-images/android-33/android-tv/x86",
@@ -10803,7 +10803,7 @@
             }
           },
           "displayName": "Wear OS 4 ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-33-android-wear-arm64-v8a",
           "path": "system-images/android-33/android-wear/arm64-v8a",
@@ -10847,7 +10847,7 @@
             }
           },
           "displayName": "Wear OS 4 Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-33-android-wear-x86_64",
           "path": "system-images/android-33/android-wear/x86_64",
@@ -10898,7 +10898,7 @@
             }
           },
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-33-default-arm64-v8a",
           "path": "system-images/android-33/default/arm64-v8a",
@@ -10947,7 +10947,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-33-default-x86_64",
           "path": "system-images/android-33/default/x86_64",
@@ -11008,7 +11008,7 @@
             }
           },
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-33-google_apis-arm64-v8a",
           "path": "system-images/android-33/google_apis/arm64-v8a",
@@ -11075,7 +11075,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-33-google_apis-x86_64",
           "path": "system-images/android-33/google_apis/x86_64",
@@ -11144,7 +11144,7 @@
             }
           },
           "displayName": "Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-33-google_apis_playstore-arm64-v8a",
           "path": "system-images/android-33/google_apis_playstore/arm64-v8a",
@@ -11211,7 +11211,7 @@
             }
           },
           "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-33-google_apis_playstore-x86_64",
           "path": "system-images/android-33/google_apis_playstore/x86_64",
@@ -11286,7 +11286,7 @@
             }
           },
           "displayName": "Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-33x-google_apis_playstore-arm64-v8a",
           "path": "system-images/android-33-ext4/google_apis_playstore/arm64-v8a",
@@ -11335,7 +11335,7 @@
             }
           },
           "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-33x-google_apis_playstore-x86_64",
           "path": "system-images/android-33-ext4/google_apis_playstore/x86_64",
@@ -11398,7 +11398,7 @@
             }
           },
           "displayName": "Android TV ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-34-android-tv-arm64-v8a",
           "path": "system-images/android-34/android-tv/arm64-v8a",
@@ -11458,7 +11458,7 @@
             }
           },
           "displayName": "Android TV Intel x86 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-34-android-tv-x86",
           "path": "system-images/android-34/android-tv/x86",
@@ -11498,7 +11498,7 @@
             }
           ],
           "displayName": "Wear OS 5 ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-34-android-wear-arm64-v8a",
           "path": "system-images/android-34/android-wear/arm64-v8a",
@@ -11535,7 +11535,7 @@
             }
           ],
           "displayName": "Wear OS 5 Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-34-android-wear-x86_64",
           "path": "system-images/android-34/android-wear/x86_64",
@@ -11586,7 +11586,7 @@
             }
           },
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-34-default-arm64-v8a",
           "path": "system-images/android-34/default/arm64-v8a",
@@ -11635,7 +11635,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-34-default-x86_64",
           "path": "system-images/android-34/default/x86_64",
@@ -11696,7 +11696,7 @@
             }
           },
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-34-google_apis-arm64-v8a",
           "path": "system-images/android-34/google_apis/arm64-v8a",
@@ -11764,7 +11764,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-34-google_apis-x86_64",
           "path": "system-images/android-34/google_apis/x86_64",
@@ -11834,7 +11834,7 @@
             }
           },
           "displayName": "Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-34-google_apis_playstore-arm64-v8a",
           "path": "system-images/android-34/google_apis_playstore/arm64-v8a",
@@ -11903,7 +11903,7 @@
             }
           },
           "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-34-google_apis_playstore-x86_64",
           "path": "system-images/android-34/google_apis_playstore/x86_64",
@@ -11948,9 +11948,9 @@
             {
               "arch": "all",
               "os": "all",
-              "sha1": "2c0b4d0ed7aa50d498fb0e31ac500343deb90b7c",
-              "size": 1397481780,
-              "url": "https://dl.google.com/android/repository/sys-img/android-automotive/arm64-v8a-34-ext9_playstore_r03.zip"
+              "sha1": "ce75a3152c34862f8092e31be13024693564cfa5",
+              "size": 1409602624,
+              "url": "https://dl.google.com/android/repository/sys-img/android-automotive/arm64-v8a-34-ext9_playstore_r04.zip"
             }
           ],
           "dependencies": {
@@ -11966,13 +11966,13 @@
             }
           },
           "displayName": "Android Automotive with Google APIs arm64-v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-34x-android-automotive-arm64-v8a",
           "path": "system-images/android-34-ext9/android-automotive/arm64-v8a",
           "revision": "34x-android-automotive-arm64-v8a",
           "revision-details": {
-            "major:0": "4"
+            "major:0": "5"
           },
           "type-details": {
             "abi:6": "arm64-v8a",
@@ -12001,9 +12001,9 @@
             {
               "arch": "all",
               "os": "all",
-              "sha1": "ccbfbf77c5b83a6bfb66032e25c1634104c66354",
-              "size": 1436319949,
-              "url": "https://dl.google.com/android/repository/sys-img/android-automotive/x86_64-34-ext9_playstore_r03.zip"
+              "sha1": "1a52bb3dc6a1b0e7ac19b1f512047df9d0b93c1b",
+              "size": 1451722407,
+              "url": "https://dl.google.com/android/repository/sys-img/android-automotive/x86_64-34-ext9_playstore_r04.zip"
             }
           ],
           "dependencies": {
@@ -12019,13 +12019,13 @@
             }
           },
           "displayName": "Android Automotive with Google APIs x86_64 System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-34x-android-automotive-x86_64",
           "path": "system-images/android-34-ext9/android-automotive/x86_64",
           "revision": "34x-android-automotive-x86_64",
           "revision-details": {
-            "major:0": "4"
+            "major:0": "5"
           },
           "type-details": {
             "abi:6": "x86_64",
@@ -12088,7 +12088,7 @@
             }
           },
           "displayName": "Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-34x-google_apis_playstore-arm64-v8a",
           "path": "system-images/android-34-ext12/google_apis_playstore/arm64-v8a",
@@ -12137,7 +12137,7 @@
             }
           },
           "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-34x-google_apis_playstore-x86_64",
           "path": "system-images/android-34-ext12/google_apis_playstore/x86_64",
@@ -12178,7 +12178,7 @@
             }
           ],
           "displayName": "Wear OS 5.1 - Preview ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-35-android-wear-arm64-v8a",
           "path": "system-images/android-35/android-wear/arm64-v8a",
@@ -12210,7 +12210,7 @@
             }
           ],
           "displayName": "Wear OS 5.1 - Preview Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-preview-license",
           "name": "system-image-35-android-wear-x86_64",
           "path": "system-images/android-35/android-wear/x86_64",
@@ -12256,7 +12256,7 @@
             }
           },
           "displayName": "ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-35-default-arm64-v8a",
           "path": "system-images/android-35/default/arm64-v8a",
@@ -12301,7 +12301,7 @@
             }
           },
           "displayName": "Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-35-default-x86_64",
           "path": "system-images/android-35/default/x86_64",
@@ -12348,7 +12348,7 @@
             }
           },
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-35-google_apis-arm64-v8a",
           "path": "system-images/android-35/google_apis/arm64-v8a",
@@ -12406,7 +12406,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-35-google_apis-x86_64",
           "path": "system-images/android-35/google_apis/x86_64",
@@ -12466,7 +12466,7 @@
             }
           },
           "displayName": "Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-35-google_apis_playstore-arm64-v8a",
           "path": "system-images/android-35/google_apis_playstore/arm64-v8a",
@@ -12524,7 +12524,7 @@
             }
           },
           "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-35-google_apis_playstore-x86_64",
           "path": "system-images/android-35/google_apis_playstore/x86_64",
@@ -12584,7 +12584,7 @@
             }
           },
           "displayName": "Pre-Release 16 KB Page Size Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-35-page_size_16kb-arm64-v8a",
           "path": "system-images/android-35/google_apis_playstore_ps16k/arm64-v8a",
@@ -12645,8 +12645,8 @@
               }
             }
           },
-          "displayName": "Pre-Release 16 KB Page Size Google Play ARM Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "displayName": "Pre-Release 16 KB Page Size Google Play Intel x86_64 Atom System Image",
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-35-page_size_16kb-x86_64",
           "path": "system-images/android-35/google_apis_playstore_ps16k/x86_64",
@@ -12700,7 +12700,7 @@
             }
           ],
           "displayName": "Wear OS 5.1 ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-35x-android-wear-arm64-v8a",
           "path": "system-images/android-35-ext15/android-wear/arm64-v8a",
@@ -12733,7 +12733,7 @@
             }
           ],
           "displayName": "Wear OS 5.1 Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-35x-android-wear-x86_64",
           "path": "system-images/android-35-ext15/android-wear/x86_64",
@@ -12756,6 +12756,106 @@
           }
         }
       },
+      "google_apis": {
+        "arm64-v8a": {
+          "archives": [
+            {
+              "arch": "all",
+              "os": "all",
+              "sha1": "5ccebb92efc75d4924fb9f6a1680c2a90b4455d2",
+              "size": 1782795864,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis/arm64-v8a-35-ext15_r01.zip"
+            }
+          ],
+          "dependencies": {
+            "dependency:0": {
+              "element-attributes": {
+                "path": "emulator"
+              },
+              "min-revision:0": {
+                "major:0": "30",
+                "micro:2": "2",
+                "minor:1": "8"
+              }
+            }
+          },
+          "displayName": "Google APIs ARM 64 v8a System Image",
+          "last-available-day": 20237,
+          "license": "android-sdk-arm-dbt-license",
+          "name": "system-image-35x-google_apis-arm64-v8a",
+          "path": "system-images/android-35-ext15/google_apis/arm64-v8a",
+          "revision": "35x-google_apis-arm64-v8a",
+          "revision-details": {
+            "major:0": "1"
+          },
+          "type-details": {
+            "abi:5": "arm64-v8a",
+            "api-level:0": "35x",
+            "base-extension:2": "false",
+            "element-attributes": {
+              "xsi:type": "ns12:sysImgDetailsType"
+            },
+            "extension-level:1": "15",
+            "tag:3": {
+              "display:1": "Google APIs",
+              "id:0": "google_apis"
+            },
+            "vendor:4": {
+              "display:1": "Google Inc.",
+              "id:0": "google"
+            }
+          }
+        },
+        "x86_64": {
+          "archives": [
+            {
+              "arch": "all",
+              "os": "all",
+              "sha1": "5e359834781e52fefcccd922a15f04bef5bade76",
+              "size": 1742908646,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis/x86_64-35-ext15_r01.zip"
+            }
+          ],
+          "dependencies": {
+            "dependency:0": {
+              "element-attributes": {
+                "path": "emulator"
+              },
+              "min-revision:0": {
+                "major:0": "30",
+                "micro:2": "2",
+                "minor:1": "8"
+              }
+            }
+          },
+          "displayName": "Google APIs Intel x86_64 Atom System Image",
+          "last-available-day": 20237,
+          "license": "android-sdk-license",
+          "name": "system-image-35x-google_apis-x86_64",
+          "path": "system-images/android-35-ext15/google_apis/x86_64",
+          "revision": "35x-google_apis-x86_64",
+          "revision-details": {
+            "major:0": "1"
+          },
+          "type-details": {
+            "abi:5": "x86_64",
+            "api-level:0": "35x",
+            "base-extension:2": "false",
+            "element-attributes": {
+              "xsi:type": "ns12:sysImgDetailsType"
+            },
+            "extension-level:1": "15",
+            "tag:3": {
+              "display:1": "Google APIs",
+              "id:0": "google_apis"
+            },
+            "vendor:4": {
+              "display:1": "Google Inc.",
+              "id:0": "google"
+            }
+          }
+        }
+      },
       "google_apis_playstore": {
         "arm64-v8a": {
           "archives": [
@@ -12780,10 +12880,10 @@
             }
           },
           "displayName": "Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-35x-google_apis_playstore-arm64-v8a",
-          "path": "system-images/android-35-ext14/google_apis_playstore/arm64-v8a",
+          "path": "system-images/android-35-ext15/google_apis_playstore/arm64-v8a",
           "revision": "35x-google_apis_playstore-arm64-v8a",
           "revision-details": {
             "major:0": "1"
@@ -12795,7 +12895,7 @@
             "element-attributes": {
               "xsi:type": "ns12:sysImgDetailsType"
             },
-            "extension-level:1": "14",
+            "extension-level:1": "15",
             "tag:3": {
               "display:1": "Google Play",
               "id:0": "google_apis_playstore"
@@ -12829,10 +12929,10 @@
             }
           },
           "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-35x-google_apis_playstore-x86_64",
-          "path": "system-images/android-35-ext14/google_apis_playstore/x86_64",
+          "path": "system-images/android-35-ext15/google_apis_playstore/x86_64",
           "revision": "35x-google_apis_playstore-x86_64",
           "revision-details": {
             "major:0": "1"
@@ -12844,7 +12944,7 @@
             "element-attributes": {
               "xsi:type": "ns12:sysImgDetailsType"
             },
-            "extension-level:1": "14",
+            "extension-level:1": "15",
             "tag:3": {
               "display:1": "Google Play",
               "id:0": "google_apis_playstore"
@@ -12858,15 +12958,83 @@
       }
     },
     "36": {
+      "android-wear": {
+        "arm64-v8a": {
+          "archives": [
+            {
+              "arch": "all",
+              "os": "all",
+              "sha1": "53f3fa2adea692b7eabf698d59fdc34d36ff08e4",
+              "size": 1139080003,
+              "url": "https://dl.google.com/android/repository/sys-img/android-wear/arm64-v8a-36_signed_r01.zip"
+            }
+          ],
+          "displayName": "Wear OS 6.0 - Preview ARM 64 v8a System Image (signed)",
+          "last-available-day": 20237,
+          "license": "android-sdk-license",
+          "name": "system-image-36-android-wear-arm64-v8a",
+          "path": "system-images/signed/android-36/android-wear/arm64-v8a",
+          "revision": "36-android-wear-arm64-v8a",
+          "revision-details": {
+            "major:0": "1"
+          },
+          "type-details": {
+            "abi:4": "arm64-v8a",
+            "api-level:0": "36",
+            "base-extension:2": "true",
+            "element-attributes": {
+              "xsi:type": "ns12:sysImgDetailsType"
+            },
+            "extension-level:1": "17",
+            "tag:3": {
+              "display:1": "Wear OS 6.0 - Preview",
+              "id:0": "android-wear"
+            }
+          }
+        },
+        "x86_64": {
+          "archives": [
+            {
+              "arch": "all",
+              "os": "all",
+              "sha1": "7ae6c4e1c614a649f75ccb653769ccd8cdb30e4a",
+              "size": 1116094453,
+              "url": "https://dl.google.com/android/repository/sys-img/android-wear/x86_64-36_signed_r01.zip"
+            }
+          ],
+          "displayName": "Wear OS 6.0 - Preview Intel x86_64 Atom System Image (signed)",
+          "last-available-day": 20237,
+          "license": "android-sdk-license",
+          "name": "system-image-36-android-wear-x86_64",
+          "path": "system-images/signed/android-36/android-wear/x86_64",
+          "revision": "36-android-wear-x86_64",
+          "revision-details": {
+            "major:0": "1"
+          },
+          "type-details": {
+            "abi:4": "x86_64",
+            "api-level:0": "36",
+            "base-extension:2": "true",
+            "element-attributes": {
+              "xsi:type": "ns12:sysImgDetailsType"
+            },
+            "extension-level:1": "17",
+            "tag:3": {
+              "display:1": "Wear OS 6.0 - Preview",
+              "id:0": "android-wear"
+            }
+          }
+        }
+      },
       "google_apis": {
         "arm64-v8a": {
           "archives": [
             {
               "arch": "all",
               "os": "all",
-              "sha1": "82c8c75e78c73e80a663472f278e61ae3219ff7e",
-              "size": 1814357571,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis/arm64-v8a-36_r05.zip"
+              "sha1": "d4e36a020d33b1411e14ca1d4dd74d3b908e538f",
+              "size": 1852726191,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis/arm64-v8a-36_r06.zip"
             }
           ],
           "dependencies": {
@@ -12882,13 +13050,13 @@
             }
           },
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-36-google_apis-arm64-v8a",
           "path": "system-images/android-36/google_apis/arm64-v8a",
           "revision": "36-google_apis-arm64-v8a",
           "revision-details": {
-            "major:0": "5"
+            "major:0": "6"
           },
           "type-details": {
             "abi:5": "arm64-v8a",
@@ -12913,9 +13081,9 @@
             {
               "arch": "all",
               "os": "all",
-              "sha1": "069c5654cb549e7ff7c817e7023d0c680a623f8c",
-              "size": 1706610245,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis/x86_64-36_r05.zip"
+              "sha1": "a9b0b4a0488e0c6c380f5485507950f011388511",
+              "size": 1875550742,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis/x86_64-36_r06.zip"
             }
           ],
           "dependencies": {
@@ -12931,13 +13099,13 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-36-google_apis-x86_64",
           "path": "system-images/android-36/google_apis/x86_64",
           "revision": "36-google_apis-x86_64",
           "revision-details": {
-            "major:0": "5"
+            "major:0": "6"
           },
           "type-details": {
             "abi:5": "x86_64",
@@ -12964,9 +13132,9 @@
             {
               "arch": "all",
               "os": "all",
-              "sha1": "1605ca6608e2e83f250c4375e15489ade9169c52",
-              "size": 1835226829,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-36_r05.zip"
+              "sha1": "b4de516b43b508947d04484732351d9a36fee33f",
+              "size": 1874450592,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-36_r06.zip"
             }
           ],
           "dependencies": {
@@ -12982,13 +13150,13 @@
             }
           },
           "displayName": "Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-36-google_apis_playstore-arm64-v8a",
           "path": "system-images/android-36/google_apis_playstore/arm64-v8a",
           "revision": "36-google_apis_playstore-arm64-v8a",
           "revision-details": {
-            "major:0": "5"
+            "major:0": "6"
           },
           "type-details": {
             "abi:5": "arm64-v8a",
@@ -13013,9 +13181,9 @@
             {
               "arch": "all",
               "os": "all",
-              "sha1": "b24c50ec8e211cc116f448b67f49ed482c55bd55",
-              "size": 1741001393,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-36_r05.zip"
+              "sha1": "398e02989fb3c274dd2d99541cf71255de538651",
+              "size": 1912630049,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-36_r06.zip"
             }
           ],
           "dependencies": {
@@ -13031,13 +13199,13 @@
             }
           },
           "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-36-google_apis_playstore-x86_64",
           "path": "system-images/android-36/google_apis_playstore/x86_64",
           "revision": "36-google_apis_playstore-x86_64",
           "revision-details": {
-            "major:0": "5"
+            "major:0": "6"
           },
           "type-details": {
             "abi:5": "x86_64",
@@ -13064,9 +13232,9 @@
             {
               "arch": "all",
               "os": "all",
-              "sha1": "da544188ab47a89f4b3cf6614523cf3cb3440129",
-              "size": 1887754420,
-              "url": "https://dl.google.com/android/repository/sys-img/page_size_16kb/arm64-v8a-playstore-ps16k-36_r05.zip"
+              "sha1": "2edacb5f0d7cd63e838b9e313a2b0cd002f29381",
+              "size": 1928649616,
+              "url": "https://dl.google.com/android/repository/sys-img/page_size_16kb/arm64-v8a-playstore-ps16k-36_r06.zip"
             }
           ],
           "dependencies": {
@@ -13082,13 +13250,13 @@
             }
           },
           "displayName": "Pre-Release 16 KB Page Size Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-36-page_size_16kb-arm64-v8a",
           "path": "system-images/android-36/google_apis_playstore_ps16k/arm64-v8a",
           "revision": "36-page_size_16kb-arm64-v8a",
           "revision-details": {
-            "major:0": "5"
+            "major:0": "6"
           },
           "type-details": {
             "abi:6": "arm64-v8a",
@@ -13117,9 +13285,9 @@
             {
               "arch": "all",
               "os": "all",
-              "sha1": "d1f4ccf971300511e5f8d606c6d5fabf97647b36",
-              "size": 1738939657,
-              "url": "https://dl.google.com/android/repository/sys-img/page_size_16kb/x86_64-playstore-ps16k-36_r05.zip"
+              "sha1": "8ab4c932fce799060be81978ebfe00055303ebee",
+              "size": 1912261645,
+              "url": "https://dl.google.com/android/repository/sys-img/page_size_16kb/x86_64-playstore-ps16k-36_r06.zip"
             }
           ],
           "dependencies": {
@@ -13134,14 +13302,14 @@
               }
             }
           },
-          "displayName": "Pre-Release 16 KB Page Size Google Play ARM Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "displayName": "Pre-Release 16 KB Page Size Google Play Intel x86_64 Atom System Image",
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-36-page_size_16kb-x86_64",
           "path": "system-images/android-36/google_apis_playstore_ps16k/x86_64",
           "revision": "36-page_size_16kb-x86_64",
           "revision-details": {
-            "major:0": "5"
+            "major:0": "6"
           },
           "type-details": {
             "abi:6": "x86_64",
@@ -13192,7 +13360,7 @@
             }
           },
           "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-Baklava-google_apis-arm64-v8a",
           "path": "system-images/android-Baklava/google_apis/arm64-v8a",
@@ -13242,7 +13410,7 @@
             }
           },
           "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-Baklava-google_apis-x86_64",
           "path": "system-images/android-Baklava/google_apis/x86_64",
@@ -13294,7 +13462,7 @@
             }
           },
           "displayName": "Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-Baklava-google_apis_playstore-arm64-v8a",
           "path": "system-images/android-Baklava/google_apis_playstore/arm64-v8a",
@@ -13344,7 +13512,7 @@
             }
           },
           "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-Baklava-google_apis_playstore-x86_64",
           "path": "system-images/android-Baklava/google_apis_playstore/x86_64",
@@ -13396,7 +13564,7 @@
             }
           },
           "displayName": "Pre-Release 16 KB Page Size Google Play ARM 64 v8a System Image",
-          "last-available-day": 20174,
+          "last-available-day": 20237,
           "license": "android-sdk-arm-dbt-license",
           "name": "system-image-Baklava-page_size_16kb-arm64-v8a",
           "path": "system-images/android-Baklava/google_apis_playstore_ps16k/arm64-v8a",
@@ -13449,8 +13617,8 @@
               }
             }
           },
-          "displayName": "Pre-Release 16 KB Page Size Google Play ARM Intel x86_64 Atom System Image",
-          "last-available-day": 20174,
+          "displayName": "Pre-Release 16 KB Page Size Google Play Intel x86_64 Atom System Image",
+          "last-available-day": 20237,
           "license": "android-sdk-license",
           "name": "system-image-Baklava-page_size_16kb-x86_64",
           "path": "system-images/android-Baklava/google_apis_playstore_ps16k/x86_64",
@@ -13705,222 +13873,8 @@
     },
     "UpsideDownCake": {
       "google_apis": {
-        "arm64-v8a": {
-          "archives": [
-            {
-              "os": "all",
-              "sha1": "2335c0cf2c76cb1883a6d6ee38e6fff99989596f",
-              "size": 1549237055,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis/arm64-v8a-UpsideDownCake_r04.zip"
-            }
-          ],
-          "dependencies": {
-            "dependency:0": {
-              "element-attributes": {
-                "path": "patcher;v4"
-              }
-            },
-            "dependency:1": {
-              "element-attributes": {
-                "path": "emulator"
-              },
-              "min-revision:0": {
-                "major:0": "32",
-                "micro:2": "8",
-                "minor:1": "1"
-              }
-            }
-          },
-          "displayName": "Google APIs ARM 64 v8a System Image",
-          "last-available-day": 19489,
-          "license": "android-sdk-arm-dbt-license",
-          "name": "system-image-UpsideDownCake-google_apis-arm64-v8a",
-          "path": "system-images/android-UpsideDownCake/google_apis/arm64-v8a",
-          "revision": "UpsideDownCake-google_apis-arm64-v8a",
-          "revision-details": {
-            "major:0": "4"
-          },
-          "type-details": {
-            "abi:4": "arm64-v8a",
-            "api-level:0": "33",
-            "codename:1": "UpsideDownCake",
-            "element-attributes": {
-              "xsi:type": "ns12:sysImgDetailsType"
-            },
-            "tag:2": {
-              "display:1": "Google APIs",
-              "id:0": "google_apis"
-            },
-            "vendor:3": {
-              "display:1": "Google Inc.",
-              "id:0": "google"
-            }
-          }
-        },
-        "x86_64": {
-          "archives": [
-            {
-              "os": "all",
-              "sha1": "15a514144f57865a84abbd6df8e6897c80bb8b88",
-              "size": 1491492723,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis/x86_64-UpsideDownCake_r04.zip"
-            }
-          ],
-          "dependencies": {
-            "dependency:0": {
-              "element-attributes": {
-                "path": "patcher;v4"
-              }
-            },
-            "dependency:1": {
-              "element-attributes": {
-                "path": "emulator"
-              },
-              "min-revision:0": {
-                "major:0": "32",
-                "micro:2": "8",
-                "minor:1": "1"
-              }
-            }
-          },
-          "displayName": "Google APIs Intel x86_64 Atom System Image",
-          "last-available-day": 19489,
-          "license": "android-sdk-preview-license",
-          "name": "system-image-UpsideDownCake-google_apis-x86_64",
-          "path": "system-images/android-UpsideDownCake/google_apis/x86_64",
-          "revision": "UpsideDownCake-google_apis-x86_64",
-          "revision-details": {
-            "major:0": "4"
-          },
-          "type-details": {
-            "abi:4": "x86_64",
-            "api-level:0": "33",
-            "codename:1": "UpsideDownCake",
-            "element-attributes": {
-              "xsi:type": "ns12:sysImgDetailsType"
-            },
-            "tag:2": {
-              "display:1": "Google APIs",
-              "id:0": "google_apis"
-            },
-            "vendor:3": {
-              "display:1": "Google Inc.",
-              "id:0": "google"
-            }
-          }
-        }
       },
       "google_apis_playstore": {
-        "arm64-v8a": {
-          "archives": [
-            {
-              "os": "macosx",
-              "sha1": "b9f7a7d25450e2385a8334af688ab862fc723dba",
-              "size": 1513459071,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-UpsideDownCake_r04-darwin.zip"
-            },
-            {
-              "os": "linux",
-              "sha1": "b9f7a7d25450e2385a8334af688ab862fc723dba",
-              "size": 1513459071,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-UpsideDownCake_r04-linux.zip"
-            }
-          ],
-          "dependencies": {
-            "dependency:0": {
-              "element-attributes": {
-                "path": "patcher;v4"
-              }
-            },
-            "dependency:1": {
-              "element-attributes": {
-                "path": "emulator"
-              },
-              "min-revision:0": {
-                "major:0": "32",
-                "micro:2": "8",
-                "minor:1": "1"
-              }
-            }
-          },
-          "displayName": "Google Play ARM 64 v8a System Image",
-          "last-available-day": 19489,
-          "license": "android-sdk-arm-dbt-license",
-          "name": "system-image-UpsideDownCake-google_apis_playstore-arm64-v8a",
-          "path": "system-images/android-UpsideDownCake/google_apis_playstore/arm64-v8a",
-          "revision": "UpsideDownCake-google_apis_playstore-arm64-v8a",
-          "revision-details": {
-            "major:0": "4"
-          },
-          "type-details": {
-            "abi:4": "arm64-v8a",
-            "api-level:0": "33",
-            "codename:1": "UpsideDownCake",
-            "element-attributes": {
-              "xsi:type": "ns12:sysImgDetailsType"
-            },
-            "tag:2": {
-              "display:1": "Google Play",
-              "id:0": "google_apis_playstore"
-            },
-            "vendor:3": {
-              "display:1": "Google Inc.",
-              "id:0": "google"
-            }
-          }
-        },
-        "x86_64": {
-          "archives": [
-            {
-              "os": "all",
-              "sha1": "4647cbb1877cca1394b1a4fff52c644e6220d07a",
-              "size": 1464098477,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-UpsideDownCake_r04.zip"
-            }
-          ],
-          "dependencies": {
-            "dependency:0": {
-              "element-attributes": {
-                "path": "patcher;v4"
-              }
-            },
-            "dependency:1": {
-              "element-attributes": {
-                "path": "emulator"
-              },
-              "min-revision:0": {
-                "major:0": "32",
-                "micro:2": "8",
-                "minor:1": "1"
-              }
-            }
-          },
-          "displayName": "Google Play Intel x86_64 Atom System Image",
-          "last-available-day": 19489,
-          "license": "android-sdk-preview-license",
-          "name": "system-image-UpsideDownCake-google_apis_playstore-x86_64",
-          "path": "system-images/android-UpsideDownCake/google_apis_playstore/x86_64",
-          "revision": "UpsideDownCake-google_apis_playstore-x86_64",
-          "revision-details": {
-            "major:0": "4"
-          },
-          "type-details": {
-            "abi:4": "x86_64",
-            "api-level:0": "33",
-            "codename:1": "UpsideDownCake",
-            "element-attributes": {
-              "xsi:type": "ns12:sysImgDetailsType"
-            },
-            "tag:2": {
-              "display:1": "Google Play",
-              "id:0": "google_apis_playstore"
-            },
-            "vendor:3": {
-              "display:1": "Google Inc.",
-              "id:0": "google"
-            }
-          }
-        }
       }
     },
     "UpsideDownCakePrivacySandbox": {
@@ -14272,10 +14226,10 @@
   },
   "latest": {
     "build-tools": "36.0.0",
-    "cmake": "3.31.6",
+    "cmake": "4.0.2",
     "cmdline-tools": "19.0",
-    "emulator": "35.5.8",
-    "ndk": "28.0.13004108",
+    "emulator": "35.6.9",
+    "ndk": "28.1.13356709",
     "ndk-bundle": "22.1.7171670",
     "platform-tools": "35.0.2",
     "platforms": "36",
@@ -14346,7 +14300,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 17",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -14395,7 +14349,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 18.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -14444,7 +14398,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 18.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -14493,7 +14447,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 18.1.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -14542,7 +14496,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 19",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -14591,7 +14545,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 19.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -14640,7 +14594,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 19.0.2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -14689,7 +14643,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 19.0.3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -14738,7 +14692,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 19.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/19.1.0",
@@ -14786,7 +14740,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 20",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/20.0.0",
@@ -14834,7 +14788,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 21",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -14883,7 +14837,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 21.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -14932,7 +14886,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 21.0.2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -14981,7 +14935,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 21.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -15030,7 +14984,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 21.1.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -15079,7 +15033,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 21.1.2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/21.1.2",
@@ -15127,7 +15081,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 22",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -15176,7 +15130,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 22.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/22.0.1",
@@ -15224,7 +15178,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 23",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -15273,7 +15227,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 23.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/23.0.1",
@@ -15321,7 +15275,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 23.0.2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/23.0.2",
@@ -15369,7 +15323,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 23.0.3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/23.0.3",
@@ -15417,7 +15371,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 24",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/24.0.0",
@@ -15465,7 +15419,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 24.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/24.0.1",
@@ -15513,7 +15467,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 24.0.2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/24.0.2",
@@ -15561,7 +15515,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 24.0.3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/24.0.3",
@@ -15609,7 +15563,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 25",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/25.0.0",
@@ -15657,7 +15611,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 25.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/25.0.1",
@@ -15705,7 +15659,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 25.0.2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/25.0.2",
@@ -15753,7 +15707,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 25.0.3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/25.0.3",
@@ -15801,7 +15755,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 26",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/26.0.0",
@@ -15849,7 +15803,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 26.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/26.0.1",
@@ -15897,7 +15851,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 26.0.2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/26.0.2",
@@ -15945,7 +15899,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 26.0.3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/26.0.3",
@@ -15993,7 +15947,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 27",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/27.0.0",
@@ -16041,7 +15995,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 27.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/27.0.1",
@@ -16089,7 +16043,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 27.0.2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/27.0.2",
@@ -16137,7 +16091,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 27.0.3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/27.0.3",
@@ -16185,7 +16139,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 28",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/28.0.0",
@@ -16233,7 +16187,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 28-rc1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -16283,7 +16237,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 28-rc2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -16333,7 +16287,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 28.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/28.0.1",
@@ -16381,7 +16335,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 28.0.2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/28.0.2",
@@ -16429,7 +16383,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 28.0.3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/28.0.3",
@@ -16477,7 +16431,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 29",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/29.0.0",
@@ -16525,7 +16479,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 29-rc1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -16575,7 +16529,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 29-rc2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -16625,7 +16579,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 29-rc3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "obsolete": "true",
@@ -16675,7 +16629,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 29.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/29.0.1",
@@ -16723,7 +16677,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 29.0.2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/29.0.2",
@@ -16771,7 +16725,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 29.0.3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/29.0.3",
@@ -16819,7 +16773,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 30",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/30.0.0",
@@ -16867,7 +16821,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 30.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/30.0.1",
@@ -16915,7 +16869,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 30.0.2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/30.0.2",
@@ -16963,7 +16917,7 @@
           }
         },
         "displayName": "Android SDK Build-Tools 30.0.3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/30.0.3",
@@ -17004,7 +16958,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 31",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/31.0.0",
@@ -17045,7 +16999,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 32",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/32.0.0",
@@ -17086,7 +17040,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 32.1-rc1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "path": "build-tools/32.1.0-rc1",
@@ -17128,7 +17082,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 33",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/33.0.0",
@@ -17169,7 +17123,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 33.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/33.0.1",
@@ -17210,7 +17164,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 33.0.2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/33.0.2",
@@ -17251,7 +17205,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 33.0.3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/33.0.3",
@@ -17292,7 +17246,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 34",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/34.0.0",
@@ -17333,7 +17287,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 34-rc1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "path": "build-tools/34.0.0-rc1",
@@ -17375,7 +17329,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 34-rc2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "path": "build-tools/34.0.0-rc2",
@@ -17417,7 +17371,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 34-rc3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "path": "build-tools/34.0.0-rc3",
@@ -17434,45 +17388,6 @@
           }
         }
       },
-      "34.0.0-rc4": {
-        "archives": [
-          {
-            "os": "linux",
-            "sha1": "61f7cfa64786bffbf6c6c9a3d74d025a07239928",
-            "size": 61206867,
-            "url": "https://dl.google.com/android/repository/build-tools_r34-rc4-linux.zip"
-          },
-          {
-            "os": "macosx",
-            "sha1": "522431b33cd7fa1407914a8fa66a27bfe1755cbb",
-            "size": 76553187,
-            "url": "https://dl.google.com/android/repository/build-tools_r34-rc4-macosx.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "699f1cb99a8de88b1746ce12302d6c2ddce81186",
-            "size": 58219308,
-            "url": "https://dl.google.com/android/repository/build-tools_r34-rc4-windows.zip"
-          }
-        ],
-        "displayName": "Android SDK Build-Tools 34-rc4",
-        "last-available-day": 19489,
-        "license": "android-sdk-preview-license",
-        "name": "build-tools",
-        "path": "build-tools/34.0.0-rc4",
-        "revision": "34.0.0-rc4",
-        "revision-details": {
-          "major:0": "34",
-          "micro:2": "0",
-          "minor:1": "0",
-          "preview:3": "4"
-        },
-        "type-details": {
-          "element-attributes": {
-            "xsi:type": "ns5:genericDetailsType"
-          }
-        }
-      },
       "35.0.0": {
         "archives": [
           {
@@ -17498,7 +17413,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 35",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/35.0.0",
@@ -17539,7 +17454,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 35-rc1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "path": "build-tools/35.0.0-rc1",
@@ -17581,7 +17496,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 35-rc2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "path": "build-tools/35.0.0-rc2",
@@ -17623,7 +17538,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 35-rc3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "path": "build-tools/35.0.0-rc3",
@@ -17665,7 +17580,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 35-rc4",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "path": "build-tools/35.0.0-rc4",
@@ -17707,7 +17622,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 35.0.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/35.0.1",
@@ -17748,7 +17663,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 36",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "build-tools",
         "path": "build-tools/36.0.0",
@@ -17789,7 +17704,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 36-rc1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "path": "build-tools/36.0.0-rc1",
@@ -17831,7 +17746,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 36-rc3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "path": "build-tools/36.0.0-rc3",
@@ -17873,7 +17788,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 36-rc4",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "path": "build-tools/36.0.0-rc4",
@@ -17915,7 +17830,7 @@
           }
         ],
         "displayName": "Android SDK Build-Tools 36-rc5",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "build-tools",
         "path": "build-tools/36.0.0-rc5",
@@ -17966,7 +17881,7 @@
           }
         ],
         "displayName": "CMake 3.10.2.4988404",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.10.2.4988404",
@@ -18007,7 +17922,7 @@
           }
         ],
         "displayName": "CMake 3.18.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.18.1",
@@ -18048,7 +17963,7 @@
           }
         ],
         "displayName": "CMake 3.22.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.22.1",
@@ -18089,7 +18004,7 @@
           }
         ],
         "displayName": "CMake 3.30.3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.30.3",
@@ -18130,7 +18045,7 @@
           }
         ],
         "displayName": "CMake 3.30.4",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.30.4",
@@ -18171,7 +18086,7 @@
           }
         ],
         "displayName": "CMake 3.30.5",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.30.5",
@@ -18212,7 +18127,7 @@
           }
         ],
         "displayName": "CMake 3.31.0",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.31.0",
@@ -18253,7 +18168,7 @@
           }
         ],
         "displayName": "CMake 3.31.1",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.31.1",
@@ -18294,7 +18209,7 @@
           }
         ],
         "displayName": "CMake 3.31.4",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.31.4",
@@ -18335,7 +18250,7 @@
           }
         ],
         "displayName": "CMake 3.31.5",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.31.5",
@@ -18376,7 +18291,7 @@
           }
         ],
         "displayName": "CMake 3.31.6",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.31.6",
@@ -18424,7 +18339,7 @@
           }
         ],
         "displayName": "CMake 3.6.4111459",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmake",
         "path": "cmake/3.6.4111459",
@@ -18439,6 +18354,47 @@
             "xsi:type": "ns5:genericDetailsType"
           }
         }
+      },
+      "4.0.2": {
+        "archives": [
+          {
+            "arch": "all",
+            "os": "linux",
+            "sha1": "83295132168f6a41d6461746e1e9844583adac00",
+            "size": 30909648,
+            "url": "https://dl.google.com/android/repository/cmake-4.0.2-linux.zip"
+          },
+          {
+            "arch": "all",
+            "os": "macosx",
+            "sha1": "82f5dfe96433d1085f49697f7f985266ebece998",
+            "size": 43157416,
+            "url": "https://dl.google.com/android/repository/cmake-4.0.2-darwin.zip"
+          },
+          {
+            "arch": "all",
+            "os": "windows",
+            "sha1": "337378ae8fb6b7c88b8c439dbe2714cc17a3ab04",
+            "size": 20621162,
+            "url": "https://dl.google.com/android/repository/cmake-4.0.2-windows.zip"
+          }
+        ],
+        "displayName": "CMake 4.0.2",
+        "last-available-day": 20237,
+        "license": "android-sdk-license",
+        "name": "cmake",
+        "path": "cmake/4.0.2",
+        "revision": "4.0.2",
+        "revision-details": {
+          "major:0": "4",
+          "micro:2": "2",
+          "minor:1": "0"
+        },
+        "type-details": {
+          "element-attributes": {
+            "xsi:type": "ns5:genericDetailsType"
+          }
+        }
       }
     },
     "cmdline-tools": {
@@ -18467,7 +18423,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/1.0",
@@ -18507,7 +18463,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/10.0",
@@ -18522,44 +18478,6 @@
           }
         }
       },
-      "10.0-rc04": {
-        "archives": [
-          {
-            "os": "linux",
-            "sha1": "fe41906d2ce82df4cde74fe258e0ccdb283de60a",
-            "size": 138718717,
-            "url": "https://dl.google.com/android/repository/commandlinetools-linux-9645777_latest.zip"
-          },
-          {
-            "os": "macosx",
-            "sha1": "021540982a843ae2c9b4e0a5c2034b29681b4f70",
-            "size": 138718701,
-            "url": "https://dl.google.com/android/repository/commandlinetools-mac-9645777_latest.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "9c3877a2926c1e73af981964b0f4381a6d68fb21",
-            "size": 138694572,
-            "url": "https://dl.google.com/android/repository/commandlinetools-win-9645777_latest.zip"
-          }
-        ],
-        "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 19489,
-        "license": "android-sdk-preview-license",
-        "name": "cmdline-tools",
-        "path": "cmdline-tools/10.0-beta04",
-        "revision": "10.0-rc04",
-        "revision-details": {
-          "major:0": "10",
-          "minor:1": "0",
-          "preview:2": "04"
-        },
-        "type-details": {
-          "element-attributes": {
-            "xsi:type": "ns5:genericDetailsType"
-          }
-        }
-      },
       "11.0": {
         "archives": [
           {
@@ -18585,7 +18503,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/11.0",
@@ -18638,44 +18556,6 @@
           }
         }
       },
-      "11.0-rc07": {
-        "archives": [
-          {
-            "os": "linux",
-            "sha1": "c43e4fb8567c4625e8daf4cee0a5490f826a5442",
-            "size": 147822296,
-            "url": "https://dl.google.com/android/repository/commandlinetools-linux-9644228_latest.zip"
-          },
-          {
-            "os": "macosx",
-            "sha1": "2c97234849128cb75b0691cf652ab098707c610c",
-            "size": 147822280,
-            "url": "https://dl.google.com/android/repository/commandlinetools-mac-9644228_latest.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "2bfc8fad022acce100a5b0583def1ca5bc56eff1",
-            "size": 147798151,
-            "url": "https://dl.google.com/android/repository/commandlinetools-win-9644228_latest.zip"
-          }
-        ],
-        "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 19489,
-        "license": "android-sdk-preview-license",
-        "name": "cmdline-tools",
-        "path": "cmdline-tools/11.0-alpha07",
-        "revision": "11.0-rc07",
-        "revision-details": {
-          "major:0": "11",
-          "minor:1": "0",
-          "preview:2": "07"
-        },
-        "type-details": {
-          "element-attributes": {
-            "xsi:type": "ns5:genericDetailsType"
-          }
-        }
-      },
       "12.0": {
         "archives": [
           {
@@ -18701,7 +18581,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/12.0",
@@ -18779,7 +18659,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/13.0",
@@ -18819,7 +18699,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/13.0-rc01",
@@ -18860,7 +18740,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/14.0-alpha01",
@@ -18901,7 +18781,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/16.0",
@@ -18941,7 +18821,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/16.0-alpha01",
@@ -18982,7 +18862,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/17.0",
@@ -19022,7 +18902,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/19.0",
@@ -19062,7 +18942,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/19.0-alpha01",
@@ -19103,7 +18983,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "obsolete": "true",
@@ -19144,7 +19024,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/2.1",
@@ -19184,7 +19064,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/3.0",
@@ -19224,7 +19104,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/4.0",
@@ -19264,7 +19144,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/5.0",
@@ -19304,7 +19184,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/6.0",
@@ -19344,7 +19224,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/7.0",
@@ -19384,7 +19264,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/8.0",
@@ -19424,7 +19304,7 @@
           }
         ],
         "displayName": "Android SDK Command-line Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "cmdline-tools",
         "path": "cmdline-tools/9.0",
@@ -19441,96 +19321,6 @@
       }
     },
     "emulator": {
-      "31.3.10": {
-        "archives": [
-          {
-            "os": "macosx",
-            "sha1": "4a35a2702f9138653cd1b67d04e01ffa65fb37bc",
-            "size": 347308456,
-            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-8807927.zip"
-          },
-          {
-            "os": "linux",
-            "sha1": "43df6ed553b89e1553d588251526aae8f79da214",
-            "size": 293822881,
-            "url": "https://dl.google.com/android/repository/emulator-linux_x64-8807927.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "52f8bfa4a09074e607d393302fe8a627846a18e9",
-            "size": 380246403,
-            "url": "https://dl.google.com/android/repository/emulator-windows_x64-8807927.zip"
-          }
-        ],
-        "dependencies": {
-          "dependency:0": {
-            "element-attributes": {
-              "path": "patcher;v4"
-            }
-          }
-        },
-        "displayName": "Android Emulator",
-        "last-available-day": 19469,
-        "license": "android-sdk-license",
-        "name": "emulator",
-        "path": "emulator",
-        "revision": "31.3.10",
-        "revision-details": {
-          "major:0": "31",
-          "micro:2": "10",
-          "minor:1": "3"
-        },
-        "type-details": {
-          "element-attributes": {
-            "xsi:type": "ns5:genericDetailsType"
-          }
-        }
-      },
-      "31.3.14": {
-        "archives": [
-          {
-            "os": "linux",
-            "sha1": "b5ab96ebffc6ea6816a5b0e9474859463b21ab78",
-            "size": 293826836,
-            "url": "https://dl.google.com/android/repository/emulator-linux_x64-9322596.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "632eba430f67abeddcf15ceb0a872b25fdbb7e62",
-            "size": 381130167,
-            "url": "https://dl.google.com/android/repository/emulator-windows_x64-9322596.zip"
-          },
-          {
-            "os": "macosx",
-            "sha1": "00e8685beffbe19f803cd5d698fbe6406b5ee6f3",
-            "size": 347313356,
-            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-9322596.zip"
-          }
-        ],
-        "dependencies": {
-          "dependency:0": {
-            "element-attributes": {
-              "path": "patcher;v4"
-            }
-          }
-        },
-        "displayName": "Android Emulator",
-        "last-available-day": 19469,
-        "license": "android-sdk-license",
-        "name": "emulator",
-        "path": "emulator",
-        "revision": "31.3.14",
-        "revision-details": {
-          "major:0": "31",
-          "micro:2": "14",
-          "minor:1": "3"
-        },
-        "type-details": {
-          "element-attributes": {
-            "xsi:type": "ns5:genericDetailsType"
-          }
-        }
-      },
       "32.1.10": {
         "archives": [
           {
@@ -19576,51 +19366,6 @@
           }
         }
       },
-      "32.1.12": {
-        "archives": [
-          {
-            "os": "linux",
-            "sha1": "556fb884d6e72b597bf5c1fa959f59744994fb68",
-            "size": 270165820,
-            "url": "https://dl.google.com/android/repository/emulator-linux_x64-9751036.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "0ee17dd9b4410d38dc2f6a6227e899d6910b2c55",
-            "size": 332999329,
-            "url": "https://dl.google.com/android/repository/emulator-windows_x64-9751036.zip"
-          },
-          {
-            "os": "macosx",
-            "sha1": "d37d6e301f36d8f0797ca96a3fd6b8ee5f8d46ae",
-            "size": 307219070,
-            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-9751036.zip"
-          }
-        ],
-        "dependencies": {
-          "dependency:0": {
-            "element-attributes": {
-              "path": "patcher;v4"
-            }
-          }
-        },
-        "displayName": "Android Emulator",
-        "last-available-day": 19489,
-        "license": "android-sdk-license",
-        "name": "emulator",
-        "path": "emulator",
-        "revision": "32.1.12",
-        "revision-details": {
-          "major:0": "32",
-          "micro:2": "12",
-          "minor:1": "1"
-        },
-        "type-details": {
-          "element-attributes": {
-            "xsi:type": "ns5:genericDetailsType"
-          }
-        }
-      },
       "32.1.14": {
         "archives": [
           {
@@ -19704,96 +19449,6 @@
           }
         }
       },
-      "32.1.8": {
-        "archives": [
-          {
-            "os": "macosx",
-            "sha1": "13cadd038b401fdfa04e4af153a7f696ccd422cc",
-            "size": 309314692,
-            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-9310560.zip"
-          },
-          {
-            "os": "linux",
-            "sha1": "7d82689a73aacdd56684d7134dc88cc3537fb911",
-            "size": 270158359,
-            "url": "https://dl.google.com/android/repository/emulator-linux_x64-9310560.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "8324aeb3bd74a214978252c51574b40cdb56b4ba",
-            "size": 333001267,
-            "url": "https://dl.google.com/android/repository/emulator-windows_x64-9310560.zip"
-          }
-        ],
-        "dependencies": {
-          "dependency:0": {
-            "element-attributes": {
-              "path": "patcher;v4"
-            }
-          }
-        },
-        "displayName": "Android Emulator",
-        "last-available-day": 19469,
-        "license": "android-sdk-preview-license",
-        "name": "emulator",
-        "path": "emulator",
-        "revision": "32.1.8",
-        "revision-details": {
-          "major:0": "32",
-          "micro:2": "8",
-          "minor:1": "1"
-        },
-        "type-details": {
-          "element-attributes": {
-            "xsi:type": "ns5:genericDetailsType"
-          }
-        }
-      },
-      "33.1.10": {
-        "archives": [
-          {
-            "os": "macosx",
-            "sha1": "f38b9ec7e9c9ff3b8c4022e7f9baa1d6622634a0",
-            "size": 325272345,
-            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-10078095.zip"
-          },
-          {
-            "os": "linux",
-            "sha1": "e97f77ce116ff8fb13bd8f89a2097cc4ab1dbc67",
-            "size": 180494623,
-            "url": "https://dl.google.com/android/repository/emulator-linux_x64-10078095.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "8738b20ee568c4e6a84b66b1fa848517db646c47",
-            "size": 354011689,
-            "url": "https://dl.google.com/android/repository/emulator-windows_x64-10078095.zip"
-          }
-        ],
-        "dependencies": {
-          "dependency:0": {
-            "element-attributes": {
-              "path": "patcher;v4"
-            }
-          }
-        },
-        "displayName": "Android Emulator",
-        "last-available-day": 19489,
-        "license": "android-sdk-preview-license",
-        "name": "emulator",
-        "path": "emulator",
-        "revision": "33.1.10",
-        "revision-details": {
-          "major:0": "33",
-          "micro:2": "10",
-          "minor:1": "1"
-        },
-        "type-details": {
-          "element-attributes": {
-            "xsi:type": "ns5:genericDetailsType"
-          }
-        }
-      },
       "33.1.17": {
         "archives": [
           {
@@ -19877,96 +19532,6 @@
           }
         }
       },
-      "33.1.4": {
-        "archives": [
-          {
-            "os": "macosx",
-            "sha1": "33be82356a352b79b742154f7c71f6f13455f27b",
-            "size": 345831055,
-            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-9936625.zip"
-          },
-          {
-            "os": "linux",
-            "sha1": "cfa28a326b6328e2f3a068ac3030a075471d9df0",
-            "size": 260288819,
-            "url": "https://dl.google.com/android/repository/emulator-linux_x64-9936625.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "0aab97a7b84853c8f8c7618191dc23416e2a7a4b",
-            "size": 373623936,
-            "url": "https://dl.google.com/android/repository/emulator-windows_x64-9936625.zip"
-          }
-        ],
-        "dependencies": {
-          "dependency:0": {
-            "element-attributes": {
-              "path": "patcher;v4"
-            }
-          }
-        },
-        "displayName": "Android Emulator",
-        "last-available-day": 19469,
-        "license": "android-sdk-preview-license",
-        "name": "emulator",
-        "path": "emulator",
-        "revision": "33.1.4",
-        "revision-details": {
-          "major:0": "33",
-          "micro:2": "4",
-          "minor:1": "1"
-        },
-        "type-details": {
-          "element-attributes": {
-            "xsi:type": "ns5:genericDetailsType"
-          }
-        }
-      },
-      "33.1.6": {
-        "archives": [
-          {
-            "os": "macosx",
-            "sha1": "a31338f160fc5fa7973946d34a0d0ce1a2c0759a",
-            "size": 332134756,
-            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-10047184.zip"
-          },
-          {
-            "os": "linux",
-            "sha1": "9f5c71277f52837d4fb43f72c80103bdf81c0569",
-            "size": 254562719,
-            "url": "https://dl.google.com/android/repository/emulator-linux_x64-10047184.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "11ba13425c6fcd275f5e1aa95923f736dd2bcb64",
-            "size": 361497029,
-            "url": "https://dl.google.com/android/repository/emulator-windows_x64-10047184.zip"
-          }
-        ],
-        "dependencies": {
-          "dependency:0": {
-            "element-attributes": {
-              "path": "patcher;v4"
-            }
-          }
-        },
-        "displayName": "Android Emulator",
-        "last-available-day": 19489,
-        "license": "android-sdk-preview-license",
-        "name": "emulator",
-        "path": "emulator",
-        "revision": "33.1.6",
-        "revision-details": {
-          "major:0": "33",
-          "micro:2": "6",
-          "minor:1": "1"
-        },
-        "type-details": {
-          "element-attributes": {
-            "xsi:type": "ns5:genericDetailsType"
-          }
-        }
-      },
       "34.1.19": {
         "archives": [
           {
@@ -20501,6 +20066,54 @@
           }
         }
       },
+      "35.5.10": {
+        "archives": [
+          {
+            "arch": "x64",
+            "os": "linux",
+            "sha1": "0f7336a0477654cfbe5593f1888d9c2b1bdf30e0",
+            "size": 301181039,
+            "url": "https://dl.google.com/android/repository/emulator-linux_x64-13402964.zip"
+          },
+          {
+            "arch": "x64",
+            "os": "macosx",
+            "sha1": "5339e2be893ee74e352b3dde3d0700deda380a7d",
+            "size": 394068912,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-13402964.zip"
+          },
+          {
+            "arch": "aarch64",
+            "os": "macosx",
+            "sha1": "4b607dfa4797de2356bf54f4c6caaef3b8bf187d",
+            "size": 312167479,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_aarch64-13402964.zip"
+          },
+          {
+            "arch": "x64",
+            "os": "windows",
+            "sha1": "5523c285900e345adad65b1bd50daba101d692d0",
+            "size": 423391334,
+            "url": "https://dl.google.com/android/repository/emulator-windows_x64-13402964.zip"
+          }
+        ],
+        "displayName": "Android Emulator",
+        "last-available-day": 20237,
+        "license": "android-sdk-license",
+        "name": "emulator",
+        "path": "emulator",
+        "revision": "35.5.10",
+        "revision-details": {
+          "major:0": "35",
+          "micro:2": "10",
+          "minor:1": "5"
+        },
+        "type-details": {
+          "element-attributes": {
+            "xsi:type": "ns5:genericDetailsType"
+          }
+        }
+      },
       "35.5.2": {
         "archives": [
           {
@@ -20692,6 +20305,102 @@
             "xsi:type": "ns5:genericDetailsType"
           }
         }
+      },
+      "35.6.9": {
+        "archives": [
+          {
+            "arch": "x64",
+            "os": "linux",
+            "sha1": "66a9c575d3bcc2098e0eba68fcf8b2c87d0eb241",
+            "size": 319085855,
+            "url": "https://dl.google.com/android/repository/emulator-linux_x64-13473012.zip"
+          },
+          {
+            "arch": "x64",
+            "os": "macosx",
+            "sha1": "a9d670e765fc573c99273de7eb768a5256dea883",
+            "size": 394682677,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-13473012.zip"
+          },
+          {
+            "arch": "aarch64",
+            "os": "macosx",
+            "sha1": "569e708aa89eb4d3d5787d97764215690f31b46b",
+            "size": 312519726,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_aarch64-13473012.zip"
+          },
+          {
+            "arch": "x64",
+            "os": "windows",
+            "sha1": "2288e8aa9b9db7943093435875052f9c1cda7817",
+            "size": 440020709,
+            "url": "https://dl.google.com/android/repository/emulator-windows_x64-13473012.zip"
+          }
+        ],
+        "displayName": "Android Emulator",
+        "last-available-day": 20237,
+        "license": "android-sdk-license",
+        "name": "emulator",
+        "path": "emulator",
+        "revision": "35.6.9",
+        "revision-details": {
+          "major:0": "35",
+          "micro:2": "9",
+          "minor:1": "6"
+        },
+        "type-details": {
+          "element-attributes": {
+            "xsi:type": "ns5:genericDetailsType"
+          }
+        }
+      },
+      "36.1.2": {
+        "archives": [
+          {
+            "arch": "x64",
+            "os": "linux",
+            "sha1": "74a1c093bea491f3ecbd80a027bc28dd7c184688",
+            "size": 324772288,
+            "url": "https://dl.google.com/android/repository/emulator-linux_x64-13544801.zip"
+          },
+          {
+            "arch": "x64",
+            "os": "macosx",
+            "sha1": "802bbec21bbbe151440690f65fdb24b33005ef2a",
+            "size": 402124565,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-13544801.zip"
+          },
+          {
+            "arch": "aarch64",
+            "os": "macosx",
+            "sha1": "26087d0d3b70cc196c2317d24d71b02b699fc3d8",
+            "size": 319759472,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_aarch64-13544801.zip"
+          },
+          {
+            "arch": "x64",
+            "os": "windows",
+            "sha1": "8f7a97fb9d23e2c7f670bd2b03ea61215f43b25d",
+            "size": 446247044,
+            "url": "https://dl.google.com/android/repository/emulator-windows_x64-13544801.zip"
+          }
+        ],
+        "displayName": "Android Emulator",
+        "last-available-day": 20237,
+        "license": "android-sdk-preview-license",
+        "name": "emulator",
+        "path": "emulator",
+        "revision": "36.1.2",
+        "revision-details": {
+          "major:0": "36",
+          "micro:2": "2",
+          "minor:1": "1"
+        },
+        "type-details": {
+          "element-attributes": {
+            "xsi:type": "ns5:genericDetailsType"
+          }
+        }
       }
     },
     "extras": {
@@ -20817,7 +20526,7 @@
           }
         },
         "displayName": "NDK (Side by side) 16.1.4479499",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/16.1.4479499",
@@ -20879,7 +20588,7 @@
           }
         },
         "displayName": "NDK (Side by side) 17.2.4988734",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/17.2.4988734",
@@ -20941,7 +20650,7 @@
           }
         },
         "displayName": "NDK (Side by side) 18.1.5063045",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/18.1.5063045",
@@ -21003,7 +20712,7 @@
           }
         },
         "displayName": "NDK (Side by side) 19.0.5232133",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "obsolete": "true",
@@ -21066,7 +20775,7 @@
           }
         },
         "displayName": "NDK (Side by side) 19.2.5345600",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/19.2.5345600",
@@ -21128,7 +20837,7 @@
           }
         },
         "displayName": "NDK (Side by side) 20.0.5392854",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "obsolete": "true",
@@ -21192,7 +20901,7 @@
           }
         },
         "displayName": "NDK (Side by side) 20.0.5471264",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "obsolete": "true",
@@ -21256,7 +20965,7 @@
           }
         },
         "displayName": "NDK (Side by side) 20.0.5594570",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/20.0.5594570",
@@ -21318,7 +21027,7 @@
           }
         },
         "displayName": "NDK (Side by side) 20.1.5948944",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/20.1.5948944",
@@ -21366,7 +21075,7 @@
           }
         },
         "displayName": "NDK (Side by side) 21.0.6011959",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/21.0.6011959",
@@ -21415,7 +21124,7 @@
           }
         },
         "displayName": "NDK (Side by side) 21.0.6113669",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/21.0.6113669",
@@ -21463,7 +21172,7 @@
           }
         },
         "displayName": "NDK (Side by side) 21.1.6210238",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/21.1.6210238",
@@ -21519,7 +21228,7 @@
           }
         },
         "displayName": "NDK (Side by side) 21.1.6273396",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/21.1.6273396",
@@ -21575,7 +21284,7 @@
           }
         },
         "displayName": "NDK (Side by side) 21.1.6352462",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/21.1.6352462",
@@ -21630,7 +21339,7 @@
           }
         },
         "displayName": "NDK (Side by side) 21.1.6363665",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/21.1.6363665",
@@ -21686,7 +21395,7 @@
           }
         },
         "displayName": "NDK (Side by side) 21.2.6472646",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/21.2.6472646",
@@ -21741,7 +21450,7 @@
           }
         },
         "displayName": "NDK (Side by side) 21.3.6528147",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/21.3.6528147",
@@ -21796,7 +21505,7 @@
           }
         },
         "displayName": "NDK (Side by side) 21.4.7075529",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/21.4.7075529",
@@ -21851,7 +21560,7 @@
           }
         },
         "displayName": "NDK (Side by side) 22.0.6917172",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/22.0.6917172",
@@ -21907,7 +21616,7 @@
           }
         },
         "displayName": "NDK (Side by side) 22.0.7026061",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/22.0.7026061",
@@ -21962,7 +21671,7 @@
           }
         },
         "displayName": "NDK (Side by side) 22.1.7171670",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/22.1.7171670",
@@ -22017,7 +21726,7 @@
           }
         },
         "displayName": "NDK (Side by side) 23.0.7123448",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/23.0.7123448",
@@ -22073,7 +21782,7 @@
           }
         },
         "displayName": "NDK (Side by side) 23.0.7196353",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/23.0.7196353",
@@ -22129,7 +21838,7 @@
           }
         },
         "displayName": "NDK (Side by side) 23.0.7272597",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/23.0.7272597",
@@ -22185,7 +21894,7 @@
           }
         },
         "displayName": "NDK (Side by side) 23.0.7344513",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/23.0.7344513",
@@ -22234,7 +21943,7 @@
           }
         },
         "displayName": "NDK (Side by side) 23.0.7421159",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/23.0.7421159",
@@ -22283,7 +21992,7 @@
           }
         },
         "displayName": "NDK (Side by side) 23.0.7530507",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/23.0.7530507",
@@ -22332,7 +22041,7 @@
           }
         },
         "displayName": "NDK (Side by side) 23.0.7599858",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/23.0.7599858",
@@ -22380,7 +22089,7 @@
           }
         },
         "displayName": "NDK (Side by side) 23.1.7779620",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/23.1.7779620",
@@ -22428,7 +22137,7 @@
           }
         },
         "displayName": "NDK (Side by side) 23.2.8568313",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/23.2.8568313",
@@ -22476,7 +22185,7 @@
           }
         },
         "displayName": "NDK (Side by side) 24.0.7856742",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/24.0.7856742",
@@ -22525,7 +22234,7 @@
           }
         },
         "displayName": "NDK (Side by side) 24.0.7956693",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/24.0.7956693",
@@ -22574,7 +22283,7 @@
           }
         },
         "displayName": "NDK (Side by side) 24.0.8079956",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/24.0.8079956",
@@ -22623,7 +22332,7 @@
           }
         },
         "displayName": "NDK (Side by side) 24.0.8215888",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/24.0.8215888",
@@ -22671,7 +22380,7 @@
           }
         },
         "displayName": "NDK (Side by side) 25.0.8151533",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/25.0.8151533",
@@ -22720,7 +22429,7 @@
           }
         },
         "displayName": "NDK (Side by side) 25.0.8221429",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/25.0.8221429",
@@ -22769,7 +22478,7 @@
           }
         },
         "displayName": "NDK (Side by side) 25.0.8355429",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/25.0.8355429",
@@ -22818,7 +22527,7 @@
           }
         },
         "displayName": "NDK (Side by side) 25.0.8528842",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/25.0.8528842",
@@ -22867,7 +22576,7 @@
           }
         },
         "displayName": "NDK (Side by side) 25.0.8775105",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/25.0.8775105",
@@ -22915,7 +22624,7 @@
           }
         },
         "displayName": "NDK (Side by side) 25.1.8937393",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/25.1.8937393",
@@ -22963,7 +22672,7 @@
           }
         },
         "displayName": "NDK (Side by side) 25.2.9519653",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/25.2.9519653",
@@ -23011,7 +22720,7 @@
           }
         },
         "displayName": "NDK (Side by side) 26.0.10404224",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/26.0.10404224",
@@ -23053,7 +22762,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 26.0.10636728",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/26.0.10636728",
@@ -23095,7 +22804,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 26.0.10792818",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/26.0.10792818",
@@ -23136,7 +22845,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 26.1.10909125",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/26.1.10909125",
@@ -23177,7 +22886,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 26.2.11394342",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/26.2.11394342",
@@ -23218,7 +22927,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 26.3.11579264",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/26.3.11579264",
@@ -23259,7 +22968,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 27.0.11718014",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/27.0.11718014",
@@ -23301,7 +23010,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 27.0.11902837",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/27.0.11902837",
@@ -23343,7 +23052,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 27.0.12077973",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/27.0.12077973",
@@ -23384,7 +23093,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 27.1.12297006",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/27.1.12297006",
@@ -23425,7 +23134,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 27.2.12479018",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/27.2.12479018",
@@ -23466,7 +23175,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 28.0.12433566",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/28.0.12433566",
@@ -23508,7 +23217,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 28.0.12674087",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/28.0.12674087",
@@ -23550,7 +23259,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 28.0.12916984",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/28.0.12916984",
@@ -23592,7 +23301,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 28.0.13004108",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk",
         "path": "ndk/28.0.13004108",
@@ -23608,6 +23317,47 @@
           }
         }
       },
+      "28.1.13356709": {
+        "archives": [
+          {
+            "arch": "all",
+            "os": "linux",
+            "sha1": "f574d3165405bd59ffc5edaadac02689075a729f",
+            "size": 722264879,
+            "url": "https://dl.google.com/android/repository/android-ndk-r28b-linux.zip"
+          },
+          {
+            "arch": "all",
+            "os": "macosx",
+            "sha1": "6dec1444aceeadd46cf5e1438c28bcc521fc6668",
+            "size": 949590256,
+            "url": "https://dl.google.com/android/repository/android-ndk-r28b-darwin.zip"
+          },
+          {
+            "arch": "all",
+            "os": "windows",
+            "sha1": "c7d82072807fcabbd6ee356476761d8729307185",
+            "size": 748117965,
+            "url": "https://dl.google.com/android/repository/android-ndk-r28b-windows.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 28.1.13356709",
+        "last-available-day": 20237,
+        "license": "android-sdk-license",
+        "name": "ndk",
+        "path": "ndk/28.1.13356709",
+        "revision": "28.1.13356709",
+        "revision-details": {
+          "major:0": "28",
+          "micro:2": "13356709",
+          "minor:1": "1"
+        },
+        "type-details": {
+          "element-attributes": {
+            "xsi:type": "ns5:genericDetailsType"
+          }
+        }
+      },
       "29.0.13113456-rc1": {
         "archives": [
           {
@@ -23633,7 +23383,7 @@
           }
         ],
         "displayName": "NDK (Side by side) 29.0.13113456",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk",
         "path": "ndk/29.0.13113456",
@@ -23698,7 +23448,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -23760,7 +23510,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -23822,7 +23572,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -23884,7 +23634,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "obsolete": "true",
@@ -23947,7 +23697,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24009,7 +23759,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk-bundle",
         "obsolete": "true",
@@ -24073,7 +23823,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk-bundle",
         "obsolete": "true",
@@ -24137,7 +23887,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24199,7 +23949,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24247,7 +23997,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24296,7 +24046,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24344,7 +24094,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24400,7 +24150,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24456,7 +24206,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24511,7 +24261,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24567,7 +24317,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24622,7 +24372,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24677,7 +24427,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24732,7 +24482,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24788,7 +24538,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24843,7 +24593,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24898,7 +24648,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -24954,7 +24704,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -25010,7 +24760,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -25066,7 +24816,7 @@
           }
         },
         "displayName": "NDK",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-preview-license",
         "name": "ndk-bundle",
         "path": "ndk-bundle",
@@ -25111,82 +24861,6 @@
       }
     },
     "platform-tools": {
-      "33.0.3": {
-        "archives": [
-          {
-            "os": "macosx",
-            "sha1": "250da3216e4c93ccd2612dcec0b64c2668354b09",
-            "size": 12767128,
-            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.3-darwin.zip"
-          },
-          {
-            "os": "linux",
-            "sha1": "deb43a0f9eaccd16a47937367ef3b53db3db8d10",
-            "size": 7505569,
-            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.3-linux.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "6028a80149c0ccde2db22d69e7fe84a352d852a2",
-            "size": 5642796,
-            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.3-windows.zip"
-          }
-        ],
-        "displayName": "Android SDK Platform-Tools",
-        "last-available-day": 19469,
-        "license": "android-sdk-license",
-        "name": "platform-tools",
-        "path": "platform-tools",
-        "revision": "33.0.3",
-        "revision-details": {
-          "major:0": "33",
-          "micro:2": "3",
-          "minor:1": "0"
-        },
-        "type-details": {
-          "element-attributes": {
-            "xsi:type": "ns5:genericDetailsType"
-          }
-        }
-      },
-      "34.0.1": {
-        "archives": [
-          {
-            "os": "macosx",
-            "sha1": "40f24dc4f2baf911ccb2a53c14bfb69fb8088c57",
-            "size": 11215880,
-            "url": "https://dl.google.com/android/repository/platform-tools_r34.0.1-darwin.zip"
-          },
-          {
-            "os": "linux",
-            "sha1": "7e8f205a0cfe574ffecb6ec41e6496f5328211fd",
-            "size": 6336109,
-            "url": "https://dl.google.com/android/repository/platform-tools_r34.0.1-linux.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "3806f15fddb6ffc5ce38efe78df1708be666a9f4",
-            "size": 6079357,
-            "url": "https://dl.google.com/android/repository/platform-tools_r34.0.1-windows.zip"
-          }
-        ],
-        "displayName": "Android SDK Platform-Tools",
-        "last-available-day": 19489,
-        "license": "android-sdk-license",
-        "name": "platform-tools",
-        "path": "platform-tools",
-        "revision": "34.0.1",
-        "revision-details": {
-          "major:0": "34",
-          "micro:2": "1",
-          "minor:1": "0"
-        },
-        "type-details": {
-          "element-attributes": {
-            "xsi:type": "ns5:genericDetailsType"
-          }
-        }
-      },
       "34.0.4": {
         "archives": [
           {
@@ -25326,7 +25000,7 @@
           }
         ],
         "displayName": "Android SDK Platform-Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platform-tools",
         "path": "platform-tools",
@@ -25341,6 +25015,47 @@
             "xsi:type": "ns5:genericDetailsType"
           }
         }
+      },
+      "36.0.0": {
+        "archives": [
+          {
+            "arch": "all",
+            "os": "linux",
+            "sha1": "ddb0cd76d952d9a1f4c8a32e4ec0e73d7a8bebb8",
+            "size": 7904253,
+            "url": "https://dl.google.com/android/repository/platform-tools_r36.0.0-linux.zip"
+          },
+          {
+            "arch": "all",
+            "os": "macosx",
+            "sha1": "48ebbd2fc67d894d7fd7b21679a7c8eb3fed9b28",
+            "size": 14186209,
+            "url": "https://dl.google.com/android/repository/platform-tools_r36.0.0-darwin.zip"
+          },
+          {
+            "arch": "all",
+            "os": "windows",
+            "sha1": "342b69dcbab46c9d3b802d7e21b95a91c8c9b3ff",
+            "size": 7138793,
+            "url": "https://dl.google.com/android/repository/platform-tools_r36.0.0-win.zip"
+          }
+        ],
+        "displayName": "Android SDK Platform-Tools",
+        "last-available-day": 20237,
+        "license": "android-sdk-preview-license",
+        "name": "platform-tools",
+        "path": "platform-tools",
+        "revision": "36.0.0",
+        "revision-details": {
+          "major:0": "36",
+          "micro:2": "0",
+          "minor:1": "0"
+        },
+        "type-details": {
+          "element-attributes": {
+            "xsi:type": "ns5:genericDetailsType"
+          }
+        }
       }
     },
     "platforms": {
@@ -25355,7 +25070,7 @@
           }
         ],
         "displayName": "Android SDK Platform 10",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-10",
@@ -25394,7 +25109,7 @@
           }
         ],
         "displayName": "Android SDK Platform 11",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-11",
@@ -25433,7 +25148,7 @@
           }
         ],
         "displayName": "Android SDK Platform 12",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-12",
@@ -25472,7 +25187,7 @@
           }
         ],
         "displayName": "Android SDK Platform 13",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-13",
@@ -25511,7 +25226,7 @@
           }
         ],
         "displayName": "Android SDK Platform 14",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-14",
@@ -25550,7 +25265,7 @@
           }
         ],
         "displayName": "Android SDK Platform 15",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-15",
@@ -25589,7 +25304,7 @@
           }
         ],
         "displayName": "Android SDK Platform 16",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-16",
@@ -25628,7 +25343,7 @@
           }
         ],
         "displayName": "Android SDK Platform 17",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-17",
@@ -25667,7 +25382,7 @@
           }
         ],
         "displayName": "Android SDK Platform 18",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-18",
@@ -25706,7 +25421,7 @@
           }
         ],
         "displayName": "Android SDK Platform 19",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-19",
@@ -25759,7 +25474,7 @@
           }
         ],
         "displayName": "Android SDK Platform 2",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "obsolete": "true",
@@ -25799,7 +25514,7 @@
           }
         ],
         "displayName": "Android SDK Platform 20",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-20",
@@ -25838,7 +25553,7 @@
           }
         ],
         "displayName": "Android SDK Platform 21",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-21",
@@ -25877,7 +25592,7 @@
           }
         ],
         "displayName": "Android SDK Platform 22",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-22",
@@ -25916,7 +25631,7 @@
           }
         ],
         "displayName": "Android SDK Platform 23",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-23",
@@ -25955,7 +25670,7 @@
           }
         ],
         "displayName": "Android SDK Platform 24",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-24",
@@ -25994,7 +25709,7 @@
           }
         ],
         "displayName": "Android SDK Platform 25",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-25",
@@ -26033,7 +25748,7 @@
           }
         ],
         "displayName": "Android SDK Platform 26",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-26",
@@ -26072,7 +25787,7 @@
           }
         ],
         "displayName": "Android SDK Platform 27",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-27",
@@ -26111,7 +25826,7 @@
           }
         ],
         "displayName": "Android SDK Platform 28",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-28",
@@ -26150,7 +25865,7 @@
           }
         ],
         "displayName": "Android SDK Platform 29",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-29",
@@ -26203,7 +25918,7 @@
           }
         ],
         "displayName": "Android SDK Platform 3",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "obsolete": "true",
@@ -26243,7 +25958,7 @@
           }
         ],
         "displayName": "Android SDK Platform 30",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-30",
@@ -26282,7 +25997,7 @@
           }
         ],
         "displayName": "Android SDK Platform 31",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-31",
@@ -26321,7 +26036,7 @@
           }
         ],
         "displayName": "Android SDK Platform 32",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-32",
@@ -26360,7 +26075,7 @@
           }
         ],
         "displayName": "Android SDK Platform 33",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-33",
@@ -26400,7 +26115,7 @@
           }
         ],
         "displayName": "Android SDK Platform 33-ext5",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-33-ext5",
@@ -26435,7 +26150,7 @@
           }
         ],
         "displayName": "Android SDK Platform 34",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "obsolete": "true",
@@ -26481,7 +26196,7 @@
           }
         ],
         "displayName": "Android SDK Platform 34-ext12",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-34-ext12",
@@ -26514,7 +26229,7 @@
           }
         ],
         "displayName": "Android SDK Platform 35",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-35",
@@ -26551,11 +26266,11 @@
             "url": "https://dl.google.com/android/repository/platform-35-ext14_r01.zip"
           }
         ],
-        "displayName": "Android SDK Platform 35-ext14",
-        "last-available-day": 20174,
+        "displayName": "Android SDK Platform 35-ext15",
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
-        "path": "platforms/android-35-ext14",
+        "path": "platforms/android-35-ext15",
         "revision": "35x",
         "revision-details": {
           "major:0": "1"
@@ -26566,7 +26281,7 @@
           "element-attributes": {
             "xsi:type": "ns11:platformDetailsType"
           },
-          "extension-level:1": "14",
+          "extension-level:1": "15",
           "layoutlib:3": {
             "element-attributes": {
               "api": "15"
@@ -26579,19 +26294,19 @@
           {
             "arch": "all",
             "os": "all",
-            "sha1": "feed7041652a3744582bb233506013969dbadb46",
-            "size": 65749783,
-            "url": "https://dl.google.com/android/repository/platform-36_r01.zip"
+            "sha1": "2c1a80dd4d9f7d0e6dd336ec603d9b5c55a6f576",
+            "size": 65878410,
+            "url": "https://dl.google.com/android/repository/platform-36_r02.zip"
           }
         ],
         "displayName": "Android SDK Platform 36",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-36",
         "revision": "36",
         "revision-details": {
-          "major:0": "1"
+          "major:0": "2"
         },
         "type-details": {
           "api-level:0": "36",
@@ -26632,7 +26347,7 @@
           }
         ],
         "displayName": "Android SDK Platform 4",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "obsolete": "true",
@@ -26686,7 +26401,7 @@
           }
         ],
         "displayName": "Android SDK Platform 5",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "obsolete": "true",
@@ -26740,7 +26455,7 @@
           }
         ],
         "displayName": "Android SDK Platform 6",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "obsolete": "true",
@@ -26780,7 +26495,7 @@
           }
         ],
         "displayName": "Android SDK Platform 7",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-7",
@@ -26819,7 +26534,7 @@
           }
         ],
         "displayName": "Android SDK Platform 8",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-8",
@@ -26858,7 +26573,7 @@
           }
         ],
         "displayName": "Android SDK Platform 9",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-9",
@@ -26897,7 +26612,7 @@
           }
         ],
         "displayName": "Android SDK Platform Baklava",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "path": "platforms/android-Baklava",
@@ -26962,7 +26677,7 @@
           }
         ],
         "displayName": "Android SDK Platform UpsideDownCake",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "platforms",
         "obsolete": "true",
@@ -27055,42 +26770,6 @@
       }
     },
     "skiaparser": {
-      "1": {
-        "archives": [
-          {
-            "os": "linux",
-            "sha1": "72be6f7630b28e02449a8bbadff7589688f3c3d6",
-            "size": 7014665,
-            "url": "https://dl.google.com/android/repository/skiaparser-8339467-linux.zip"
-          },
-          {
-            "os": "macosx",
-            "sha1": "53c688b0d2458bcead273791745fb27efa3b58ce",
-            "size": 17231541,
-            "url": "https://dl.google.com/android/repository/skiaparser-8339467-mac.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "8d08dc7c56531092f1704a24b3457bd0455a4be1",
-            "size": 10174177,
-            "url": "https://dl.google.com/android/repository/skiaparser-8339467-win.zip"
-          }
-        ],
-        "displayName": "Layout Inspector image server for API 31 and T",
-        "last-available-day": 19469,
-        "license": "android-sdk-license",
-        "name": "skiaparser",
-        "path": "skiaparser/3",
-        "revision": "1",
-        "revision-details": {
-          "major:0": "1"
-        },
-        "type-details": {
-          "element-attributes": {
-            "xsi:type": "ns5:genericDetailsType"
-          }
-        }
-      },
       "3": {
         "archives": [
           {
@@ -27116,7 +26795,7 @@
           }
         ],
         "displayName": "Layout Inspector image server for API S",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "skiaparser",
         "path": "skiaparser/2",
@@ -27237,7 +26916,7 @@
           }
         ],
         "displayName": "Layout Inspector image server for API 29-30",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "skiaparser",
         "path": "skiaparser/1",
@@ -27283,7 +26962,7 @@
           }
         ],
         "displayName": "Layout Inspector image server for API 31-36",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "skiaparser",
         "path": "skiaparser/3",
@@ -27310,7 +26989,7 @@
           }
         ],
         "displayName": "Sources for Android 14",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "obsolete": "true",
@@ -27340,7 +27019,7 @@
           }
         ],
         "displayName": "Sources for Android 15",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-15",
@@ -27369,7 +27048,7 @@
           }
         ],
         "displayName": "Sources for Android 16",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-16",
@@ -27398,7 +27077,7 @@
           }
         ],
         "displayName": "Sources for Android 17",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-17",
@@ -27427,7 +27106,7 @@
           }
         ],
         "displayName": "Sources for Android 18",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-18",
@@ -27456,7 +27135,7 @@
           }
         ],
         "displayName": "Sources for Android 19",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-19",
@@ -27485,7 +27164,7 @@
           }
         ],
         "displayName": "Sources for Android 20",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-20",
@@ -27514,7 +27193,7 @@
           }
         ],
         "displayName": "Sources for Android 21",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-21",
@@ -27543,7 +27222,7 @@
           }
         ],
         "displayName": "Sources for Android 22",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-22",
@@ -27572,7 +27251,7 @@
           }
         ],
         "displayName": "Sources for Android 23",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-23",
@@ -27601,7 +27280,7 @@
           }
         ],
         "displayName": "Sources for Android 24",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-24",
@@ -27630,7 +27309,7 @@
           }
         ],
         "displayName": "Sources for Android 25",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-25",
@@ -27659,7 +27338,7 @@
           }
         ],
         "displayName": "Sources for Android 26",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-26",
@@ -27688,7 +27367,7 @@
           }
         ],
         "displayName": "Sources for Android 27",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-27",
@@ -27717,7 +27396,7 @@
           }
         ],
         "displayName": "Sources for Android 28",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-28",
@@ -27746,7 +27425,7 @@
           }
         ],
         "displayName": "Sources for Android 29",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-29",
@@ -27775,7 +27454,7 @@
           }
         ],
         "displayName": "Sources for Android 30",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-30",
@@ -27804,7 +27483,7 @@
           }
         ],
         "displayName": "Sources for Android 31",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-31",
@@ -27833,7 +27512,7 @@
           }
         ],
         "displayName": "Sources for Android 32",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-32",
@@ -27862,7 +27541,7 @@
           }
         ],
         "displayName": "Sources for Android 33",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-33",
@@ -27892,7 +27571,7 @@
           }
         ],
         "displayName": "Sources for Android 34",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-34",
@@ -27922,7 +27601,7 @@
           }
         ],
         "displayName": "Sources for Android 35",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-35",
@@ -27946,13 +27625,13 @@
           {
             "arch": "all",
             "os": "all",
-            "sha1": "57b6cbc3acff91f6b1bc56f4083c9446052a9851",
-            "size": 51345538,
+            "sha1": "cbd2cf0e67abf996c4ad6cf6955c3a781d75852a",
+            "size": 51654722,
             "url": "https://dl.google.com/android/repository/source-36_r01.zip"
           }
         ],
         "displayName": "Sources for Android 36",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "sources",
         "path": "sources/android-36",
@@ -28019,7 +27698,7 @@
           }
         },
         "displayName": "Android SDK Tools",
-        "last-available-day": 20174,
+        "last-available-day": 20237,
         "license": "android-sdk-license",
         "name": "tools",
         "obsolete": "true",
diff --git a/pkgs/development/mobile/androidenv/test-suite.nix b/pkgs/development/mobile/androidenv/test-suite.nix
index ba745109462b..b4f4d06157bb 100644
--- a/pkgs/development/mobile/androidenv/test-suite.nix
+++ b/pkgs/development/mobile/androidenv/test-suite.nix
@@ -18,6 +18,7 @@ let
 in
 stdenv.mkDerivation {
   name = "androidenv-test-suite";
+  version = "1";
   buildInputs = lib.mapAttrsToList (name: value: value) all-tests;
 
   buildCommand = ''
@@ -26,9 +27,8 @@ stdenv.mkDerivation {
 
   passthru.tests = all-tests;
 
-  # This is the toplevel package, so inherit the update script
   passthru.updateScript = {
-    command = [ ./update.sh ];
+    command = [ ./update.rb ];
     attrPath = "androidenv.test-suite";
     supportedFeatures = [ "commit" ];
   };
diff --git a/pkgs/development/mobile/androidenv/mkrepo.rb b/pkgs/development/mobile/androidenv/update.rb
old mode 100644
new mode 100755
similarity index 82%
rename from pkgs/development/mobile/androidenv/mkrepo.rb
rename to pkgs/development/mobile/androidenv/update.rb
index 66fee5c47322..0b5f3be92fbc
--- a/pkgs/development/mobile/androidenv/mkrepo.rb
+++ b/pkgs/development/mobile/androidenv/update.rb
@@ -1,11 +1,15 @@
-#!/usr/bin/env ruby
+#!/usr/bin/env nix-shell
+#!nix-shell -i ruby -p "ruby.withPackages (ps: with ps; [ slop curb nokogiri ])"
 
 require 'json'
 require 'rubygems'
-require 'nokogiri'
-require 'slop'
 require 'shellwords'
 require 'erb'
+require 'uri'
+require 'stringio'
+require 'slop'
+require 'curb'
+require 'nokogiri'
 
 # Returns a repo URL for a given package name.
 def repo_url value
@@ -32,6 +36,36 @@ def image_url value, dir
   end
 end
 
+# Runs a GET with curl.
+def _curl_get url
+  curl = Curl::Easy.new(url) do |http|
+    http.headers['User-Agent'] = 'nixpkgs androidenv update bot'
+    yield http if block_given?
+  end
+  STDERR.print "GET #{url}"
+  curl.perform
+  STDERR.puts "... #{curl.response_code}"
+
+  StringIO.new(curl.body_str)
+end
+
+# Retrieves a repo from the filesystem or a URL.
+def get location
+  uri = URI.parse(location)
+  case uri.scheme
+  when 'repo'
+    _curl_get repo_url("#{uri.host}#{uri.fragment}.xml")
+  when 'image'
+    _curl_get image_url("sys-img#{uri.fragment}.xml", uri.host)
+  else
+    if File.exist?(uri.path)
+      File.open(uri.path, 'rt')
+    else
+      raise "Repository #{uri} was neither a file nor a repo URL"
+    end
+  end
+end
+
 # Returns a JSON with the data and structure of the input XML
 def to_json_collector doc
   json = {}
@@ -438,9 +472,19 @@ def merge dest, src
 end
 
 opts = Slop.parse do |o|
-  o.array '-p', '--packages', 'packages repo XMLs to parse'
-  o.array '-i', '--images', 'system image repo XMLs to parse'
-  o.array '-a', '--addons', 'addon repo XMLs to parse'
+  o.array '-p', '--packages', 'packages repo XMLs to parse', default: %w[repo://repository#2-3]
+  o.array '-i', '--images', 'system image repo XMLs to parse', default: %w[
+    image://android#2-3
+    image://android-tv#2-3
+    image://android-wear#2-3
+    image://android-wear-cn#2-3
+    image://android-automotive#2-3
+    image://google_apis#2-3
+    image://google_apis_playstore#2-3
+  ]
+  o.array '-a', '--addons', 'addon repo XMLs to parse', default: %w[repo://addon#2-3]
+  o.string '-I', '--input', 'input JSON file for repo', default: File.join(__dir__, 'repo.json')
+  o.string '-O', '--output', 'output JSON file for repo', default: File.join(__dir__, 'repo.json')
 end
 
 result = {}
@@ -451,20 +495,20 @@ result['addons'] = {}
 result['extras'] = {}
 
 opts[:packages].each do |filename|
-  licenses, packages, extras = parse_package_xml(Nokogiri::XML(File.open(filename)) { |conf| conf.noblanks })
+  licenses, packages, extras = parse_package_xml(Nokogiri::XML(get(filename)) { |conf| conf.noblanks })
   merge result['licenses'], licenses
   merge result['packages'], packages
   merge result['extras'], extras
 end
 
 opts[:images].each do |filename|
-  licenses, images = parse_image_xml(Nokogiri::XML(File.open(filename)) { |conf| conf.noblanks })
+  licenses, images = parse_image_xml(Nokogiri::XML(get(filename)) { |conf| conf.noblanks })
   merge result['licenses'], licenses
   merge result['images'], images
 end
 
 opts[:addons].each do |filename|
-  licenses, addons, extras = parse_addon_xml(Nokogiri::XML(File.open(filename)) { |conf| conf.noblanks })
+  licenses, addons, extras = parse_addon_xml(Nokogiri::XML(get(filename)) { |conf| conf.noblanks })
   merge result['licenses'], licenses
   merge result['addons'], addons
   merge result['extras'], extras
@@ -491,7 +535,14 @@ two_years_ago = today - 2 * 365
 input = {}
 prev_latest = {}
 begin
-  input_json = (STDIN.tty?) ? "{}" : STDIN.read
+  input_json = if File.exist?(opts[:input])
+                 STDERR.puts "Reading #{opts[:input]}"
+                 File.read(opts[:input])
+               else
+                 STDERR.puts "Creating new repo"
+                 "{}"
+               end
+
   if input_json != nil && !input_json.empty?
     input = expire_records(JSON.parse(input_json), two_years_ago)
 
@@ -511,40 +562,37 @@ fixup_result = fixup(result)
 # therefore the old packages will work as long as the links are working on the Google servers.
 output = merge input, fixup_result
 
-# See if there are any changes in the latest versions.
-cur_latest = output['latest'] || {}
-
-old_versions = []
-new_versions = []
-changes = []
-changed = false
-
-cur_latest.each do |k, v|
-  prev = prev_latest[k]
-  if prev && prev != v
-    old_versions << "#{k}:#{prev}"
-    new_versions << "#{k}:#{v}"
-    changes << "#{k}: #{prev} -> #{v}"
-    changed = true
-  end
-end
-
 # Write the repository. Append a \n to keep nixpkgs Github Actions happy.
-File.write 'repo.json', (JSON.pretty_generate(sort_recursively(output)) + "\n")
+STDERR.puts "Writing #{opts[:output]}"
+File.write opts[:output], (JSON.pretty_generate(sort_recursively(output)) + "\n")
 
 # Output metadata for the nixpkgs update script.
-changed_paths = []
-if changed
-  if ENV['UPDATE_NIX_ATTR_PATH']
-    # Instantiate it.
-    test_result = `NIXPKGS_ALLOW_UNFREE=1 NIXPKGS_ACCEPT_ANDROID_SDK_LICENSE=1 nix-build ../../../../default.nix -A #{Shellwords.join [ENV['UPDATE_NIX_ATTR_PATH']]} 2>&1`
-    test_status = $?.exitstatus
-    tests_ran = true
-  else
-    tests_ran = false
+if ENV['UPDATE_NIX_ATTR_PATH']
+  # See if there are any changes in the latest versions.
+  cur_latest = output['latest'] || {}
+
+  old_versions = []
+  new_versions = []
+  changes = []
+  changed = false
+
+  cur_latest.each do |k, v|
+    prev = prev_latest[k]
+    if prev && prev != v
+      old_versions << "#{k}:#{prev}"
+      new_versions << "#{k}:#{v}"
+      changes << "#{k}: #{prev} -> #{v}"
+      changed = true
+    end
   end
 
-  template = ERB.new(<<-EOF, trim_mode: '<>-')
+  changed_paths = []
+  if changed
+    # Instantiate it.
+    test_result = `NIXPKGS_ALLOW_UNFREE=1 NIXPKGS_ACCEPT_ANDROID_SDK_LICENSE=1 nix-build #{Shellwords.escape(File.realpath(File.join(__dir__, '..', '..', '..', '..', 'default.nix')))} -A #{Shellwords.join [ENV['UPDATE_NIX_ATTR_PATH']]} 2>&1`
+    test_status = $?.exitstatus
+
+    template = ERB.new(<<-EOF, trim_mode: '<>-')
 androidenv: <%= changes.join('; ') %>
 
 Performed the following automatic androidenv updates:
@@ -553,7 +601,6 @@ Performed the following automatic androidenv updates:
 - <%= change -%>
 <% end %>
 
-<% if tests_ran %>
 Tests exited with status: <%= test_status -%>
 
 <% if !test_result.empty? %>
@@ -562,19 +609,19 @@ Last 100 lines of output:
 <%= test_result.lines.last(100).join -%>
 ```
 <% end %>
-<% end %>
 EOF
 
-  changed_paths << {
-    attrPath: 'androidenv.androidPkgs.androidsdk',
-    oldVersion: old_versions.join('; '),
-    newVersion: new_versions.join('; '),
-    files: [
-      File.realpath('repo.json')
-    ],
-    commitMessage: template.result(binding)
-  }
-end
+    changed_paths << {
+      attrPath: 'androidenv.androidPkgs.androidsdk',
+      oldVersion: old_versions.join('; '),
+      newVersion: new_versions.join('; '),
+      files: [
+        opts[:output]
+      ],
+      commitMessage: template.result(binding)
+    }
+  end
 
-# nix-update info is on stderr
-STDOUT.puts JSON.pretty_generate(changed_paths)
+  # nix-update info is on stdout
+  STDOUT.puts JSON.pretty_generate(changed_paths)
+end
diff --git a/pkgs/development/mobile/androidenv/update.sh b/pkgs/development/mobile/androidenv/update.sh
deleted file mode 100755
index f79676069f9c..000000000000
--- a/pkgs/development/mobile/androidenv/update.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-
-pushd "$(dirname "$0")" &>/dev/null || exit 1
-./fetchrepo.sh && ./mkrepo.sh
-popd &>/dev/null
diff --git a/pkgs/development/ocaml-modules/containers/default.nix b/pkgs/development/ocaml-modules/containers/default.nix
index 804cea216a4b..c5888c737a5a 100644
--- a/pkgs/development/ocaml-modules/containers/default.nix
+++ b/pkgs/development/ocaml-modules/containers/default.nix
@@ -14,7 +14,7 @@
 }:
 
 buildDunePackage rec {
-  version = "3.15";
+  version = "3.16";
   pname = "containers";
 
   minimalOCamlVersion = "4.08";
@@ -23,7 +23,7 @@ buildDunePackage rec {
     owner = "c-cube";
     repo = "ocaml-containers";
     rev = "v${version}";
-    hash = "sha256-PMtyJOuw+9u6rF5EGif/66ZSbkTu1Msgke9JVpDWC1c=";
+    hash = "sha256-WaHAZRLjaEJUba/I2r3Yof/iUqA3PFUuVbzm88izG1k=";
   };
 
   buildInputs = [ dune-configurator ];
diff --git a/pkgs/development/ocaml-modules/lwt_eio/default.nix b/pkgs/development/ocaml-modules/lwt_eio/default.nix
new file mode 100644
index 000000000000..2fa9aed6cca1
--- /dev/null
+++ b/pkgs/development/ocaml-modules/lwt_eio/default.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  buildDunePackage,
+  fetchurl,
+  eio,
+  lwt,
+}:
+buildDunePackage rec {
+  pname = "lwt_eio";
+  version = "0.5.1";
+
+  minimalOCamlVersion = "5.1";
+
+  src = fetchurl {
+    url = "https://github.com/ocaml-multicore/${pname}/releases/download/v${version}/${pname}-${version}.tbz";
+    hash = "sha256-dlJnhHh4VNO60NZJZqc1HS8wPR95WhdeBJTK37pPbCE=";
+  };
+
+  propagatedBuildInputs = [
+    eio
+    lwt
+  ];
+
+  meta = {
+    homepage = "https://github.com/ocaml-multicore/${pname}";
+    changelog = "https://github.com/ocaml-multicore/${pname}/raw/v${version}/CHANGES.md";
+    description = "Use Lwt libraries from within Eio";
+    license = with lib.licenses; [ isc ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/melange-json/default.nix b/pkgs/development/ocaml-modules/melange-json/default.nix
new file mode 100644
index 000000000000..69b2e7004ab5
--- /dev/null
+++ b/pkgs/development/ocaml-modules/melange-json/default.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildDunePackage,
+  yojson,
+  melange,
+  ppxlib,
+}:
+
+buildDunePackage rec {
+  pname = "melange-json";
+  version = "2.0.0";
+  src = fetchFromGitHub {
+    owner = "melange-community";
+    repo = "melange-json";
+    tag = version;
+    hash = "sha256-vgcvPRc2vEHE1AtHyttvs1T0LcoeTOFfmPUCz95goT0=";
+  };
+
+  nativeBuildInputs = [ melange ];
+  buildInputs = [
+    melange
+    yojson
+    ppxlib
+  ];
+  meta = {
+    description = "Compositional JSON encode/decode library and PPX for Melange and OCaml";
+    homepage = "https://github.com/melange-community/melange-json";
+    license = lib.licenses.lgpl3;
+    maintainers = [ lib.maintainers.GirardR1006 ];
+  };
+}
diff --git a/pkgs/development/octave-modules/mapping/default.nix b/pkgs/development/octave-modules/mapping/default.nix
index 679712503304..490841816bc2 100644
--- a/pkgs/development/octave-modules/mapping/default.nix
+++ b/pkgs/development/octave-modules/mapping/default.nix
@@ -9,14 +9,14 @@
 
 buildOctavePackage rec {
   pname = "mapping";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "sha256-mrUQWqC15Ul5AHDvhMlNStqIMG2Zxa+hB2vDyeizLaI=";
+    sha256 = "sha256-IYiyRjnHCHhAFy5gR/dcuKWY11gSCubggQzmMAqGmhs=";
   };
 
-  buildInputs = [
+  propagatedBuildInputs = [
     gdal
   ];
 
diff --git a/pkgs/development/python-modules/aider-chat/default.nix b/pkgs/development/python-modules/aider-chat/default.nix
index c320215ef204..4e7fcc9a01a9 100644
--- a/pkgs/development/python-modules/aider-chat/default.nix
+++ b/pkgs/development/python-modules/aider-chat/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  replaceVars,
   gitMinimal,
   portaudio,
   playwright-driver,
@@ -254,9 +255,11 @@ let
       gitMinimal
     ];
 
-    postPatch = ''
-      substituteInPlace aider/linter.py --replace-fail "\"flake8\"" "\"${flake8}\""
-    '';
+    patches = [
+      (replaceVars ./fix-flake8-invoke.patch {
+        flake8 = lib.getExe flake8;
+      })
+    ];
 
     disabledTestPaths = [
       # Tests require network access
diff --git a/pkgs/development/python-modules/aider-chat/fix-flake8-invoke.patch b/pkgs/development/python-modules/aider-chat/fix-flake8-invoke.patch
new file mode 100644
index 000000000000..80b3ba9f645c
--- /dev/null
+++ b/pkgs/development/python-modules/aider-chat/fix-flake8-invoke.patch
@@ -0,0 +1,13 @@
+--- a/aider/linter.py	2025-05-28 17:12:07.177786621 +0000
++++ b/aider/linter.py	2025-05-28 17:12:45.834897524 +0000
+@@ -136,9 +136,7 @@
+     def flake8_lint(self, rel_fname):
+         fatal = "E9,F821,F823,F831,F406,F407,F701,F702,F704,F706"
+         flake8_cmd = [
+-            sys.executable,
+-            "-m",
+-            "flake8",
++            "@flake8@",
+             f"--select={fatal}",
+             "--show-source",
+             "--isolated",
diff --git a/pkgs/development/python-modules/aiogithubapi/default.nix b/pkgs/development/python-modules/aiogithubapi/default.nix
index 409dd2f6cd8f..8d948ef3f24f 100644
--- a/pkgs/development/python-modules/aiogithubapi/default.nix
+++ b/pkgs/development/python-modules/aiogithubapi/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "aiogithubapi";
-  version = "24.6.0";
+  version = "25.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "ludeeus";
     repo = "aiogithubapi";
     tag = version;
-    hash = "sha256-z7l7Qx9Kg1FZ9nM0V2NzTyi3gbE2hakbc/GZ1CzDmKw=";
+    hash = "sha256-zl9QpFpkvSTs0BUDMBmwTeLY1YvNRSqbkIZ5LDUP3zw=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/aiolifx-themes/default.nix b/pkgs/development/python-modules/aiolifx-themes/default.nix
index 011dde9cef09..20cf615b03ee 100644
--- a/pkgs/development/python-modules/aiolifx-themes/default.nix
+++ b/pkgs/development/python-modules/aiolifx-themes/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiolifx-themes";
-  version = "0.6.10";
+  version = "0.6.11";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Djelibeybi";
     repo = "aiolifx-themes";
     tag = "v${version}";
-    hash = "sha256-fn8of81RvNWyCgobF/QuI7lXvv/AdCSHXlbmGXPoMRA=";
+    hash = "sha256-H5fjmGfvC/d1qTzEHtmGDPlZ0aY1UaTYPOqUAxDmb3I=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/aiolifx/default.nix b/pkgs/development/python-modules/aiolifx/default.nix
index 1f8efb348851..062fb683e1fa 100644
--- a/pkgs/development/python-modules/aiolifx/default.nix
+++ b/pkgs/development/python-modules/aiolifx/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "aiolifx";
-  version = "1.1.4";
+  version = "1.1.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7T7nHmnK1ZLoIgi6e8VVrq6NVAmL7tVi+F/6G3Ayh2Q=";
+    hash = "sha256-KRUe8qn/3jYKxgKvqPeA6oXZF3IYfRBBftWxjLhe/ow=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiovodafone/default.nix b/pkgs/development/python-modules/aiovodafone/default.nix
index de779c57d848..4d1e857a25e0 100644
--- a/pkgs/development/python-modules/aiovodafone/default.nix
+++ b/pkgs/development/python-modules/aiovodafone/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aiovodafone";
-  version = "0.11.0";
+  version = "1.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "chemelli74";
     repo = "aiovodafone";
     tag = "v${version}";
-    hash = "sha256-/H3v5ZRAaWWouow82nr/+TOuL+IX6Ez+Mjk/C120MWM=";
+    hash = "sha256-qjhezzetTKBaPeToQ9TSZ3+epgW/nMsADVL3Hb4kTBU=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/albumentations/default.nix b/pkgs/development/python-modules/albumentations/default.nix
index a4b62d21c3b9..114da34aae8c 100644
--- a/pkgs/development/python-modules/albumentations/default.nix
+++ b/pkgs/development/python-modules/albumentations/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "albumentations";
-  version = "2.0.7";
+  version = "2.0.8";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "albumentations-team";
     repo = "albumentations";
     tag = version;
-    hash = "sha256-3obvlYj+UwniEf+NokJDNqMysCGFXcJdI1Wckdfng2Y=";
+    hash = "sha256-8vUipdkIelRtKwMw63oUBDN/GUI0gegMGQaqDyXAOTQ=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index ae2808a5ad90..cc8dda49389b 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "6.4.0";
+  version = "6.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "AppThreat";
     repo = "vulnerability-db";
     tag = "v${version}";
-    hash = "sha256-BW8MN4sbQ+Z7Mi1EyrhmIOzGl1Gd8RS7vuaVMBPCtpE=";
+    hash = "sha256-yPe8AWh2L6KUFPb9rmUSjQ7/iDP77Tw2aTBF2rr8/dY=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/asdf-coordinates-schemas/default.nix b/pkgs/development/python-modules/asdf-coordinates-schemas/default.nix
index ee9562e96624..0a7505db1801 100644
--- a/pkgs/development/python-modules/asdf-coordinates-schemas/default.nix
+++ b/pkgs/development/python-modules/asdf-coordinates-schemas/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "asdf-coordinates-schemas";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "asdf-format";
     repo = "asdf-coordinates-schemas";
     tag = version;
-    hash = "sha256-LuC0m25OqQwivK/Z3OfoCtdhBV87rk16XrkJxUxG07o=";
+    hash = "sha256-ZE86W93PzKWdLrI+LNvxzrwMjOTy1fBV2AVJAaFWDMo=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/asdf-transform-schemas/default.nix b/pkgs/development/python-modules/asdf-transform-schemas/default.nix
index 4a96c06dac39..964d87f7c66e 100644
--- a/pkgs/development/python-modules/asdf-transform-schemas/default.nix
+++ b/pkgs/development/python-modules/asdf-transform-schemas/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "asdf-transform-schemas";
-  version = "0.5.0";
+  version = "0.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "asdf_transform_schemas";
     inherit version;
-    hash = "sha256-gs9MeCV1c0qJUyfyX/WDzpSZ1+K4Nv6IgLLXlhxrRis=";
+    hash = "sha256-D1D44Jb//S0UucgplZASZu8lsj0N/8MK1Bu6RoUalzI=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/auditwheel/default.nix b/pkgs/development/python-modules/auditwheel/default.nix
index 831d9eeef95e..c652b6014190 100644
--- a/pkgs/development/python-modules/auditwheel/default.nix
+++ b/pkgs/development/python-modules/auditwheel/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "auditwheel";
-  version = "6.3.0";
+  version = "6.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BccKI0+hTBQKptkHYTXZVQli2VhJkRuNXQQZo63QnwA=";
+    hash = "sha256-IJkMyyQW/bgZg+9lTRDfcvnyWziOMBBbw9l7Btauyvs=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/azure-eventhub/default.nix b/pkgs/development/python-modules/azure-eventhub/default.nix
index 5f4c8615ddf8..1cfda2439a9e 100644
--- a/pkgs/development/python-modules/azure-eventhub/default.nix
+++ b/pkgs/development/python-modules/azure-eventhub/default.nix
@@ -3,6 +3,7 @@
   azure-core,
   buildPythonPackage,
   fetchFromGitHub,
+  gitUpdater,
   setuptools,
   typing-extensions,
 }:
@@ -36,6 +37,10 @@ buildPythonPackage rec {
     "azure.eventhub.aio"
   ];
 
+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "azure.eventhub."; };
+  };
+
   meta = with lib; {
     description = "Microsoft Azure Event Hubs Client Library for Python";
     homepage = "https://github.com/Azure/azure-sdk-for-python/tree/master/sdk/eventhub/azure-eventhub";
diff --git a/pkgs/development/python-modules/azure-mgmt-apimanagement/default.nix b/pkgs/development/python-modules/azure-mgmt-apimanagement/default.nix
index 5262587ba133..27687e4340d2 100644
--- a/pkgs/development/python-modules/azure-mgmt-apimanagement/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-apimanagement/default.nix
@@ -11,19 +11,20 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-apimanagement";
-  version = "4.0.1";
+  version = "5.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-XPUJzALti7QXTmgtuwVDhCA2luWz7zfykWEsJmpHzA4=";
+    pname = "azure_mgmt_apimanagement";
+    inherit version;
+    hash = "sha256-Crf+F+cP4xVM2ED/R9GdekYQIXAD6qfCGs81EableZk=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     azure-common
     azure-mgmt-core
     isodate
diff --git a/pkgs/development/python-modules/azure-mgmt-appcontainers/default.nix b/pkgs/development/python-modules/azure-mgmt-appcontainers/default.nix
index 0be4aa8e3c01..9020c2924ed0 100644
--- a/pkgs/development/python-modules/azure-mgmt-appcontainers/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-appcontainers/default.nix
@@ -6,22 +6,26 @@
   azure-common,
   azure-mgmt-core,
   isodate,
+  setuptools,
   typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "azure-mgmt-appcontainers";
-  version = "3.1.0";
-  format = "setuptools";
+  version = "3.2.0";
+  pyroject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-PHlDnxK8788UCvjG572LUWJOlx/ZH1rOmKzAc8Lm+uw=";
+    pname = "azure_mgmt_appcontainers";
+    inherit version;
+    hash = "sha256-bp7WPCwssPZD+tZ52BMIxKomFWztQfwDPl9MBJghjz4=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     azure-common
     azure-mgmt-core
     isodate
diff --git a/pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix b/pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix
index 78e82de8f903..67221f5c5077 100644
--- a/pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-cosmosdb";
-  version = "9.7.0";
+  version = "9.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "azure_mgmt_cosmosdb";
     inherit version;
-    hash = "sha256-tQctMZ8RlT2PEuIkWa3tGRLV8n5ELh2LSVlqhQBUEKE=";
+    hash = "sha256-IU7kcWU4flePhuZhH7MptNVNwpWtedo3udksXW0g0bE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/azure-search-documents/default.nix b/pkgs/development/python-modules/azure-search-documents/default.nix
index 243d8d82ff09..c5a1095287f4 100644
--- a/pkgs/development/python-modules/azure-search-documents/default.nix
+++ b/pkgs/development/python-modules/azure-search-documents/default.nix
@@ -6,18 +6,19 @@
   azure-common,
   azure-core,
   isodate,
+  gitUpdater,
 }:
 
 buildPythonPackage rec {
   pname = "azure-search-documents";
-  version = "14.0.0";
+  version = "11.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-sdk-for-python";
-    tag = "azure-mgmt-containerregistry_${version}";
-    hash = "sha256-FRdXdk3+G/xPraB2laTV6Xs/yNY65gebvMCKPOgby1g=";
+    tag = "azure_search_documents_${version}";
+    hash = "sha256-RcVdqI50lsYed9L6Kz7faNLec1Y9zq685SGnwaEw6Qc=";
   };
 
   sourceRoot = "${src.name}/sdk/search/azure-search-documents";
@@ -35,8 +36,11 @@ buildPythonPackage rec {
   # require devtools_testutils which is a internal package for azure-sdk
   doCheck = false;
 
-  # multiple packages in the repo and the updater picks the wrong tag
-  passthru.skipBulkUpdate = true;
+  passthru = {
+    # multiple packages in the repo and the updater picks the wrong tag
+    skipBulkUpdate = true;
+    updateScript = gitUpdater { rev-prefix = "azure.search.documents_"; };
+  };
 
   meta = {
     description = "Microsoft Azure Cognitive Search Client Library for Python";
diff --git a/pkgs/development/python-modules/bilibili-api-python/default.nix b/pkgs/development/python-modules/bilibili-api-python/default.nix
index 1f524dab9ce5..91db287eb3e9 100644
--- a/pkgs/development/python-modules/bilibili-api-python/default.nix
+++ b/pkgs/development/python-modules/bilibili-api-python/default.nix
@@ -24,13 +24,13 @@
 }:
 buildPythonPackage rec {
   pname = "bilibili-api-python";
-  version = "17.1.4";
+  version = "17.2.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "bilibili_api_python";
     inherit version;
-    hash = "sha256-Wmfrf4rJzKk088ZoWNmoR9mI9NjLKJGjo5QYDWzwuVA=";
+    hash = "sha256-WzNuoVpl2ZDkuGgfWm3surJJyRVdYDUf+MqF5jUil/s=";
   };
 
   # The upstream uses requirements.txt, which overly strict version constraints.
diff --git a/pkgs/development/python-modules/blake3/Cargo.lock b/pkgs/development/python-modules/blake3/Cargo.lock
index 22072ed3dd23..8ae8210a38e7 100644
--- a/pkgs/development/python-modules/blake3/Cargo.lock
+++ b/pkgs/development/python-modules/blake3/Cargo.lock
@@ -22,9 +22,9 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
 name = "blake3"
-version = "1.0.4"
+version = "1.0.5"
 dependencies = [
- "blake3 1.5.5",
+ "blake3 1.8.2",
  "hex",
  "pyo3",
  "rayon",
@@ -32,9 +32,9 @@ dependencies = [
 
 [[package]]
 name = "blake3"
-version = "1.5.5"
+version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8ee0c1824c4dea5b5f81736aff91bae041d2c07ee1192bec91054e10e3e601e"
+checksum = "3888aaa89e4b2a40fca9848e400f6a658a5a3978de7be858e209cafa8be9a4a0"
 dependencies = [
  "arrayref",
  "arrayvec",
@@ -47,9 +47,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.10"
+version = "1.2.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13208fcbb66eaeffe09b99fffbe1af420f00a7b35aa99ad683dfc1aa76145229"
+checksum = "16595d3be041c03b09d08d0858631facccee9221e579704070e6e9e4915d3bc7"
 dependencies = [
  "shlex",
 ]
@@ -93,9 +93,9 @@ checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "either"
-version = "1.13.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
 
 [[package]]
 name = "heck"
@@ -111,15 +111,15 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "indoc"
-version = "2.0.5"
+version = "2.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
+checksum = "f4c7245a08504955605670dbf141fceab975f15ca21570696aebe9d2e71576bd"
 
 [[package]]
 name = "libc"
-version = "0.2.169"
+version = "0.2.172"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
 
 [[package]]
 name = "memmap2"
@@ -141,30 +141,30 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.20.2"
+version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
 [[package]]
 name = "portable-atomic"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "280dc24453071f1b63954171985a0b0d30058d287960968b9b2aca264c8d4ee6"
+checksum = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.93"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60946a68e5f9d28b0dc1c21bb8a97ee7d018a8b322fa57838ba31cc878e22d99"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "pyo3"
-version = "0.23.4"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57fe09249128b3173d092de9523eaa75136bf7ba85e0d69eca241c7939c933cc"
+checksum = "e5203598f366b11a02b13aa20cab591229ff0a89fd121a308a5df751d5fc9219"
 dependencies = [
  "cfg-if",
  "indoc",
@@ -180,9 +180,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.23.4"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cd3927b5a78757a0d71aa9dff669f903b1eb64b54142a9bd9f757f8fde65fd7"
+checksum = "99636d423fa2ca130fa5acde3059308006d46f98caac629418e53f7ebb1e9999"
 dependencies = [
  "once_cell",
  "target-lexicon",
@@ -190,9 +190,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.23.4"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dab6bb2102bd8f991e7749f130a70d05dd557613e39ed2deeee8e9ca0c4d548d"
+checksum = "78f9cf92ba9c409279bc3305b5409d90db2d2c22392d443a87df3a1adad59e33"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -200,9 +200,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.23.4"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91871864b353fd5ffcb3f91f2f703a22a9797c91b9ab497b1acac7b07ae509c7"
+checksum = "0b999cb1a6ce21f9a6b147dcf1be9ffedf02e0043aec74dc390f3007047cecd9"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -212,9 +212,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.23.4"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43abc3b80bc20f3facd86cd3c60beed58c3e2aa26213f3cda368de39c60a27e4"
+checksum = "822ece1c7e1012745607d5cf0bcb2874769f0f7cb34c4cde03b9358eb9ef911a"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -225,9 +225,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.38"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
 dependencies = [
  "proc-macro2",
 ]
@@ -260,9 +260,9 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
 name = "syn"
-version = "2.0.96"
+version = "2.0.101"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5d0adab1ae378d7f53bdebc67a39f1f151407ef230f0ce2883572f5d8985c80"
+checksum = "8ce2b7fc941b3a24138a0a7cf8e858bfc6a992e7978a068a5c760deb0ed43caf"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -271,18 +271,18 @@ dependencies = [
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.16"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
+checksum = "e502f78cdbb8ba4718f566c418c52bc729126ffd16baee5baa718cf25dd5a69a"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.15"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11cd88e12b17c6494200a9c1b683a04fcac9573ed74cd1b62aeb2727c5592243"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
 
 [[package]]
 name = "unindent"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7de7d73e1754487cb58364ee906a499937a0dfabd86bcb980fa99ec8c8fa2ce"
+checksum = "7264e107f553ccae879d21fbea1d6724ac785e8c3bfc762137959b5802826ef3"
diff --git a/pkgs/development/python-modules/blake3/default.nix b/pkgs/development/python-modules/blake3/default.nix
index 6bbb786926a6..b2a9e3830451 100644
--- a/pkgs/development/python-modules/blake3/default.nix
+++ b/pkgs/development/python-modules/blake3/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "blake3";
-  version = "1.0.4";
+  version = "1.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oconnor663";
     repo = "blake3-py";
     tag = version;
-    hash = "sha256-ziAL3F+8YahtrTf4/pYWdsdDfhoh7pND6DAZOn/S2lo=";
+    hash = "sha256-7u0HOgutKIvYF/hoCXKJN1a7OgY4SvWYwieG21sawsw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 32df472d6292..298f1ebb9431 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.38.23";
+  version = "1.38.24";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-92MsGT8GgouYTX4rz7yMXsqAZu05CiNa2fNfcjB1Erw=";
+    hash = "sha256-Fgd4T9N5RY5V7pL0/R12vzKHgaJ928Miw91ht85KoeM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 6266183ea45d..2daaf2fb2e07 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.38.19";
+  version = "1.38.24";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-hPZ6QrskCo6gxf5PBdSXzEERd9tgC8cBIYLkmawkvxk=";
+    hash = "sha256-7TRpF1kdG3SZLq3IvQIKCdVSKMvfnTJzpNsriPC9uPk=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/bthome-ble/default.nix b/pkgs/development/python-modules/bthome-ble/default.nix
index b93d14b3b9c8..15a164235268 100644
--- a/pkgs/development/python-modules/bthome-ble/default.nix
+++ b/pkgs/development/python-modules/bthome-ble/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "bthome-ble";
-  version = "3.12.5";
+  version = "3.13.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "bthome-ble";
     tag = "v${version}";
-    hash = "sha256-SuGmNcx+z/4GOxgAsupY7NW+2ni7vLaAEC3EKn6ctpw=";
+    hash = "sha256-e6R3Qjj82z0E+gIxqDVM08Op3KlK9ZG1iNmkqqIEjWY=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/caldav/default.nix b/pkgs/development/python-modules/caldav/default.nix
index 76ffc259e48f..1343bae47695 100644
--- a/pkgs/development/python-modules/caldav/default.nix
+++ b/pkgs/development/python-modules/caldav/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "caldav";
-  version = "1.4.0";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-caldav";
     repo = "caldav";
     tag = "v${version}";
-    hash = "sha256-rixhEIcl37ZIiYFOnJY0Ww75xZy3o/436JcgLmoOGi0=";
+    hash = "sha256-SYjfQG4muuBcnVeu9cl00Zb2fGUhw157LLxA5/N5EJ0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/canmatrix/default.nix b/pkgs/development/python-modules/canmatrix/default.nix
index 372a8ed685fb..511afe5f353a 100644
--- a/pkgs/development/python-modules/canmatrix/default.nix
+++ b/pkgs/development/python-modules/canmatrix/default.nix
@@ -4,50 +4,39 @@
   buildPythonPackage,
   click,
   fetchFromGitHub,
-  future,
-  importlib-metadata,
   ldfparser,
   lxml,
   openpyxl,
+  pytest-cov-stub,
+  pytest-timeout,
   pytestCheckHook,
   pythonOlder,
   pyyaml,
   setuptools,
-  six,
-  versioneer,
   xlrd,
   xlwt,
 }:
 
 buildPythonPackage rec {
   pname = "canmatrix";
-  version = "1.0";
+  version = "1.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "ebroecker";
     repo = "canmatrix";
     tag = version;
-    hash = "sha256-UUJnLVt+uOj8Eav162btprkUeTemItGrSnBBB9UhJJI=";
+    hash = "sha256-PfegsFha7ernSqnMeaDoLf1jLx1CiOoiYi34dESEgBY=";
   };
 
-  postPatch = ''
-    # Remove vendorized versioneer.py
-    rm versioneer.py
-  '';
-
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ versioneer ];
-
   dependencies = [
     attrs
     click
-    future
-    six
-  ] ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
+  ];
 
   optional-dependencies = {
     arxml = [ lxml ];
@@ -64,12 +53,15 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
+    pytest-cov-stub
+    pytest-timeout
     pytestCheckHook
   ] ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   pytestFlagsArray = [
     # long_envvar_name_imports requires stable key value pair ordering
     "-s src/canmatrix"
+    "tests/"
   ];
 
   disabledTests = [ "long_envvar_name_imports" ];
diff --git a/pkgs/development/python-modules/cement/default.nix b/pkgs/development/python-modules/cement/default.nix
index 85071fbb0301..ea70f7895ab0 100644
--- a/pkgs/development/python-modules/cement/default.nix
+++ b/pkgs/development/python-modules/cement/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "cement";
-  version = "3.0.12";
+  version = "3.0.14";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "datafolklabs";
     repo = "cement";
     tag = version;
-    hash = "sha256-weBqmNEjeSh5YQfHK48VVFW3UbZQmV4MiIQ3UPQKTTI=";
+    hash = "sha256-hZ9kKQmMomjy5nnHKQ2RWB+6vIID8XMn3qutg0wCBq8=";
   };
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/cloudflare/default.nix b/pkgs/development/python-modules/cloudflare/default.nix
index 72e25bd96cc5..7fb8db480f51 100644
--- a/pkgs/development/python-modules/cloudflare/default.nix
+++ b/pkgs/development/python-modules/cloudflare/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "cloudflare";
-  version = "4.1.0";
+  version = "4.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-a5++mUhW/pQq3GpIgbe+3tIIA03FxT3Wg3UfYy5Hoaw=";
+    hash = "sha256-QKpxgWOpsHYagVvVKnzBilBioQvjF3yy1Kk2dwzACCY=";
   };
 
   postPatch = ''
@@ -52,7 +52,7 @@ buildPythonPackage rec {
   meta = {
     description = "Official Python library for the Cloudflare API";
     homepage = "https://github.com/cloudflare/cloudflare-python";
-    changelog = "https://github.com/cloudflare/cloudflare-python/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/cloudflare/cloudflare-python/blob/v${version}/CHANGELOG.md";
     maintainers = with lib.maintainers; [
       marie
       jemand771
diff --git a/pkgs/development/python-modules/colcon-output/default.nix b/pkgs/development/python-modules/colcon-output/default.nix
new file mode 100644
index 000000000000..388b49c4bbda
--- /dev/null
+++ b/pkgs/development/python-modules/colcon-output/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  colcon,
+  pytest-cov-stub,
+  pytestCheckHook,
+  setuptools,
+  scspell,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage rec {
+  pname = "colcon-output";
+  version = "0.2.13";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "colcon";
+    repo = "colcon-output";
+    tag = version;
+    hash = "sha256-6HFpqGJMjQswKaGSUXVdzoKW677mdmy/PeEZFBCzaMU=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    colcon
+  ];
+
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+    scspell
+    writableTmpDirAsHomeHook
+  ];
+
+  pythonImportsCheck = [
+    "colcon_output"
+  ];
+
+  disabledTestPaths = [
+    "test/test_flake8.py"
+  ];
+
+  meta = {
+    description = "Extension for colcon-core to customize the output in various ways";
+    downloadPage = "https://github.com/colcon/colcon-output";
+    homepage = "http://colcon.readthedocs.io/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ guelakais ];
+  };
+}
diff --git a/pkgs/development/python-modules/commitizen/default.nix b/pkgs/development/python-modules/commitizen/default.nix
index af0c9fee6d10..8c8c5c6dc9bc 100644
--- a/pkgs/development/python-modules/commitizen/default.nix
+++ b/pkgs/development/python-modules/commitizen/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "commitizen";
-  version = "4.7.1";
+  version = "4.8.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "commitizen-tools";
     repo = "commitizen";
     tag = "v${version}";
-    hash = "sha256-SSj9K1ujwi/KNzugB0mIo0VMOz3WbCQ6X07ztB0JJsU=";
+    hash = "sha256-qpbq9Q1/FMKiSIIRUfB/2AkTAasBWpnQg4KbEq/tRns=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/cwl-utils/default.nix b/pkgs/development/python-modules/cwl-utils/default.nix
index 7fe9475b469e..2bb0a6444896 100644
--- a/pkgs/development/python-modules/cwl-utils/default.nix
+++ b/pkgs/development/python-modules/cwl-utils/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "cwl-utils";
-  version = "0.37";
+  version = "0.38";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "common-workflow-language";
     repo = "cwl-utils";
     tag = "v${version}";
-    hash = "sha256-OD8Nz8SIqB0Ie3S5663sQg3GjlCkC+qBvOXM9HZNuQU=";
+    hash = "sha256-goeMlyHYiS4JLOVBFjcLSzdYrdoIZ904hJHFPGZyxKo=";
   };
 
   build-system = [ setuptools ];
@@ -65,6 +65,15 @@ buildPythonPackage rec {
     "test_cwl_inputs_to_jsonschema"
   ];
 
+  disabledTestPaths = [
+    # Tests require podman
+    "tests/test_docker_extract.py"
+    # Tests requires singularity
+    "tests/test_js_sandbox.py"
+    # Circular dependencies
+    "tests/test_graph_split.py"
+  ];
+
   meta = with lib; {
     description = "Utilities for CWL";
     homepage = "https://github.com/common-workflow-language/cwl-utils";
diff --git a/pkgs/development/python-modules/cyclopts/default.nix b/pkgs/development/python-modules/cyclopts/default.nix
index 81565417bae5..a043a16843d1 100644
--- a/pkgs/development/python-modules/cyclopts/default.nix
+++ b/pkgs/development/python-modules/cyclopts/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "cyclopts";
-  version = "3.16.1";
+  version = "3.16.2";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "BrianPugh";
     repo = "cyclopts";
     tag = "v${version}";
-    hash = "sha256-Y9CTsKj7E2P6ZhN1k1VqiFbMhsB1dgDmfhlmbTxrszM=";
+    hash = "sha256-rwlJk19DLmiD7gAbknrRgcw+t3+mEfqth5P+aQB7eMM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/databricks-sdk/default.nix b/pkgs/development/python-modules/databricks-sdk/default.nix
index 61210550ece6..b8647c483e2e 100644
--- a/pkgs/development/python-modules/databricks-sdk/default.nix
+++ b/pkgs/development/python-modules/databricks-sdk/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "databricks-sdk";
-  version = "0.53.0";
+  version = "0.55.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "databricks-sdk-py";
     tag = "v${version}";
-    hash = "sha256-QuPoez1F9v87LGM0Ov6Wg2f5pLAr0uDqZ0b08Xda5+k=";
+    hash = "sha256-H/LtuqVRW3Ii/z/AU4d/PLxywG41G4aZH3xz+nOM0FY=";
   };
 
   build-system = [
@@ -82,7 +82,7 @@ buildPythonPackage rec {
   meta = {
     description = "Databricks SDK for Python";
     homepage = "https://github.com/databricks/databricks-sdk-py";
-    changelog = "https://github.com/databricks/databricks-sdk-py/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/databricks/databricks-sdk-py/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
diff --git a/pkgs/development/python-modules/dataclass-wizard/default.nix b/pkgs/development/python-modules/dataclass-wizard/default.nix
index 21a5ddcee0fa..b4fdfdc24194 100644
--- a/pkgs/development/python-modules/dataclass-wizard/default.nix
+++ b/pkgs/development/python-modules/dataclass-wizard/default.nix
@@ -1,42 +1,46 @@
 {
   lib,
-  fetchFromGitHub,
   buildPythonPackage,
-  pythonOlder,
+  fetchFromGitHub,
+  pytest-mock,
+  pytestCheckHook,
+  python-dotenv,
   pythonAtLeast,
+  pythonOlder,
   pytimeparse,
   pyyaml,
-  pytestCheckHook,
-  pytest-mock,
+  setuptools,
   typing-extensions,
+  tomli-w,
 }:
 
 buildPythonPackage rec {
   pname = "dataclass-wizard";
-  version = "0.22.2";
-  format = "setuptools";
+  version = "0.35.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rnag";
     repo = "dataclass-wizard";
-    rev = "v${version}";
-    hash = "sha256-Ufi4lZc+UkM6NZr4bS2OibpOmMjyiBEoVKxmrqauW50=";
+    tag = "v${version}";
+    hash = "sha256-Ed9/y2blOGYfNcmCCAe4TPWssKWUS0gxvRXKMf+cJh0=";
   };
 
-  propagatedBuildInputs = [ ] ++ lib.optionals (pythonOlder "3.9") [ typing-extensions ];
+  build-system = [ setuptools ];
+
+  dependencies = [ typing-extensions ];
 
   optional-dependencies = {
+    dotenv = [ python-dotenv ];
     timedelta = [ pytimeparse ];
+    toml = [ tomli-w ];
     yaml = [ pyyaml ];
   };
 
-  nativeCheckInputs =
-    [
-      pytestCheckHook
-      pytest-mock
-    ]
-    ++ optional-dependencies.timedelta
-    ++ optional-dependencies.yaml;
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-mock
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   disabledTests =
     [ ]
@@ -53,11 +57,11 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "dataclass_wizard" ];
 
   meta = with lib; {
-    description = "Set of simple, yet elegant wizarding tools for interacting with the Python dataclasses module";
-    mainProgram = "wiz";
+    description = "Wizarding tools for interacting with the Python dataclasses module";
     homepage = "https://github.com/rnag/dataclass-wizard";
-    changelog = "https://github.com/rnag/dataclass-wizard/releases/tag/v${version}";
+    changelog = "https://github.com/rnag/dataclass-wizard/releases/tag/${src.tag}";
     license = licenses.asl20;
     maintainers = with maintainers; [ codifryed ];
+    mainProgram = "wiz";
   };
 }
diff --git a/pkgs/development/python-modules/dazl/default.nix b/pkgs/development/python-modules/dazl/default.nix
index 9658de515077..ee74e5e21878 100644
--- a/pkgs/development/python-modules/dazl/default.nix
+++ b/pkgs/development/python-modules/dazl/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "dazl";
-  version = "8.2.1";
+  version = "8.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "digital-asset";
     repo = "dazl-client";
     tag = "v${version}";
-    hash = "sha256-JeAdg+OW3Zd275zIYDmfBaF7RWEb+sLQ7xFIl67L2R8=";
+    hash = "sha256-w0jWhOOjOVLKUcfY2zR8dgckp7r/Gko+p3cuO8IIrM4=";
   };
 
   pythonRelaxDeps = [
@@ -59,6 +59,6 @@ buildPythonPackage rec {
     description = "High-level Ledger API client for Daml ledgers";
     license = lib.licenses.asl20;
     homepage = "https://github.com/digital-asset/dazl-client";
-    changelog = "https://github.com/digital-asset/dazl-client/releases/tag/v${version}";
+    changelog = "https://github.com/digital-asset/dazl-client/releases/tag/${src.tag}";
   };
 }
diff --git a/pkgs/development/python-modules/debugpy/default.nix b/pkgs/development/python-modules/debugpy/default.nix
index e1344bac92f1..61ff197c524e 100644
--- a/pkgs/development/python-modules/debugpy/default.nix
+++ b/pkgs/development/python-modules/debugpy/default.nix
@@ -84,6 +84,7 @@ buildPythonPackage rec {
             "x86_64-linux" = "-shared -o attach_linux_amd64.so";
             "i686-linux" = "-shared -o attach_linux_x86.so";
             "aarch64-linux" = "-shared -o attach_linux_arm64.so";
+            "riscv64-linux" = "-shared -o attach_linux_riscv64.so";
             "x86_64-darwin" = "-D_REENTRANT -dynamiclib -lc -o attach_x86_64.dylib";
             "aarch64-darwin" = "-D_REENTRANT -dynamiclib -lc -o attach_arm64.dylib";
           }
@@ -154,6 +155,7 @@ buildPythonPackage rec {
       "aarch64-linux"
       "x86_64-darwin"
       "aarch64-darwin"
+      "riscv64-linux"
     ];
   };
 }
diff --git a/pkgs/development/python-modules/devito/default.nix b/pkgs/development/python-modules/devito/default.nix
index 3503ea42f522..34a18bca77af 100644
--- a/pkgs/development/python-modules/devito/default.nix
+++ b/pkgs/development/python-modules/devito/default.nix
@@ -6,11 +6,11 @@
 
   # build-system
   setuptools,
+  setuptools-scm,
 
   # dependencies
   anytree,
   cgen,
-  click,
   cloudpickle,
   codepy,
   llvmPackages,
@@ -22,6 +22,7 @@
   sympy,
 
   # tests
+  click,
   gcc,
   matplotlib,
   pytest-xdist,
@@ -31,26 +32,28 @@
 
 buildPythonPackage rec {
   pname = "devito";
-  version = "4.8.16";
+  version = "4.8.17";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "devitocodes";
     repo = "devito";
     tag = "v${version}";
-    hash = "sha256-yG4nJLnzIrITRMbtT/9UxDB0xvRiwnQMW13Z9HNQIq8=";
+    hash = "sha256-1aZSL23yNi/X9hnYKpIvgEOjEZtvPgTo5Pi5kKOWJhQ=";
   };
 
   pythonRemoveDeps = [ "pip" ];
 
   pythonRelaxDeps = true;
 
-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
   dependencies = [
     anytree
     cgen
-    click
     cloudpickle
     codepy
     multidict
@@ -62,6 +65,7 @@ buildPythonPackage rec {
   ] ++ lib.optionals stdenv.cc.isClang [ llvmPackages.openmp ];
 
   nativeCheckInputs = [
+    click
     gcc
     matplotlib
     pytest-xdist
diff --git a/pkgs/development/python-modules/django-google-analytics-app/default.nix b/pkgs/development/python-modules/django-google-analytics-app/default.nix
index 9d7f3de0f8aa..77fce01da096 100644
--- a/pkgs/development/python-modules/django-google-analytics-app/default.nix
+++ b/pkgs/development/python-modules/django-google-analytics-app/default.nix
@@ -7,17 +7,15 @@
   fetchFromGitHub,
   importlib-metadata,
   python,
-  pythonOlder,
   requests,
+  setuptools,
   structlog,
 }:
 
 buildPythonPackage rec {
   pname = "django-google-analytics-app";
   version = "6.0.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "praekeltfoundation";
@@ -26,7 +24,14 @@ buildPythonPackage rec {
     hash = "sha256-0KLfGZY8qq5JGb+LJXpQRS76+qXtrf/hv6QLenm+BhQ=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  pythonRelaxDeps = [
+    "celery"
+    "django"
+  ];
+
+  dependencies = [
     beautifulsoup4
     celery
     django
@@ -43,11 +48,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "google_analytics" ];
 
-  meta = with lib; {
+  meta = {
     description = "Django Google Analytics brings the power of server side/non-js Google Analytics to your Django projects";
     homepage = "https://github.com/praekeltfoundation/django-google-analytics/";
     changelog = "https://github.com/praekeltfoundation/django-google-analytics/releases/tag/${version}";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ derdennisop ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ derdennisop ];
   };
 }
diff --git a/pkgs/development/python-modules/django-tenants/default.nix b/pkgs/development/python-modules/django-tenants/default.nix
index c8bbf47937ef..a4e22199ae12 100644
--- a/pkgs/development/python-modules/django-tenants/default.nix
+++ b/pkgs/development/python-modules/django-tenants/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "django-tenants";
-  version = "3.7.0";
+  version = "3.7.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-tenants";
     repo = "django-tenants";
     tag = "v${version}";
-    hash = "sha256-QdEONKVFW/DWBjXWRTG+ahvirw9BP8M6PztUMZGZ33Q=";
+    hash = "sha256-WC9NWykSnAD7ywjMGuhNdlasGhrnZJfoh/3wJ+2BF2E=";
   };
 
   build-system = [ setuptools ];
@@ -31,7 +31,7 @@ buildPythonPackage rec {
   meta = {
     description = "Django tenants using PostgreSQL Schemas";
     homepage = "https://github.com/django-tenants/django-tenants";
-    changelog = "https://github.com/django-tenants/django-tenants/releases/tag/v${version}";
+    changelog = "https://github.com/django-tenants/django-tenants/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ jopejoe1 ];
   };
diff --git a/pkgs/development/python-modules/djangosaml2/default.nix b/pkgs/development/python-modules/djangosaml2/default.nix
index 37db74d9c29b..27a23298d60a 100644
--- a/pkgs/development/python-modules/djangosaml2/default.nix
+++ b/pkgs/development/python-modules/djangosaml2/default.nix
@@ -47,7 +47,7 @@ buildPythonPackage rec {
   meta = {
     description = "Django SAML2 Service Provider based on pySAML2";
     homepage = "https://github.com/IdentityPython/djangosaml2";
-    changelog = "https://github.com/IdentityPython/djangosaml2/blob/${src.tag}/CHANGES";
+    changelog = "https://github.com/IdentityPython/djangosaml2/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ melvyn2 ];
   };
diff --git a/pkgs/development/python-modules/drf-flex-fields/default.nix b/pkgs/development/python-modules/drf-flex-fields/default.nix
new file mode 100644
index 000000000000..5309cd811908
--- /dev/null
+++ b/pkgs/development/python-modules/drf-flex-fields/default.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  appdirs,
+  asgiref,
+  attrs,
+  black,
+  click,
+  django,
+  djangorestframework,
+  entrypoints,
+  flake8,
+  mccabe,
+  mypy,
+  mypy-extensions,
+  pycodestyle,
+  pyflakes,
+  pytz,
+  sqlparse,
+  toml,
+  typing-extensions,
+
+  # tests
+  pytestCheckHook,
+  pytest-django,
+}:
+
+buildPythonPackage rec {
+  pname = "drf-flex-fields";
+  version = "1.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "rsinger86";
+    repo = "drf-flex-fields";
+    tag = version;
+    hash = "sha256-+9ToxCEIDpsA+BK8Uk0VueVjoId41/S93+a716EGvCU=";
+  };
+
+  patches = [ ./django4-compat.patch ];
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [
+    django
+    djangorestframework
+    pytestCheckHook
+    pytest-django
+  ];
+
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE=tests.settings
+  '';
+
+  meta = {
+    changelog = "https://github.com/rsinger86/drf-flex-fields/releases/tag/${src.tag}";
+    description = "Dynamically set fields and expand nested resources in Django REST Framework serializers";
+    homepage = "https://github.com/rsinger86/drf-flex-fields";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/drf-flex-fields/django4-compat.patch b/pkgs/development/python-modules/drf-flex-fields/django4-compat.patch
new file mode 100644
index 000000000000..2ed8fec43443
--- /dev/null
+++ b/pkgs/development/python-modules/drf-flex-fields/django4-compat.patch
@@ -0,0 +1,17 @@
+diff --git a/tests/urls.py b/tests/urls.py
+index 998b0aa..62996c0 100644
+--- a/tests/urls.py
++++ b/tests/urls.py
+@@ -1,4 +1,5 @@
+-from django.conf.urls import url, include
++from django.conf.urls import include
++from django.urls import re_path
+ from rest_framework import routers
+ from tests.testapp.views import PetViewSet, TaggedItemViewSet
+ 
+@@ -7,4 +8,4 @@ router = routers.DefaultRouter()
+ router.register(r"pets", PetViewSet, basename="pet")
+ router.register(r"tagged-items", TaggedItemViewSet, basename="tagged-item")
+ 
+-urlpatterns = [url(r"^", include(router.urls))]
++urlpatterns = [re_path(r"^", include(router.urls))]
diff --git a/pkgs/development/python-modules/elastic-apm/default.nix b/pkgs/development/python-modules/elastic-apm/default.nix
index 0146091c8ea6..d94312c9b11a 100644
--- a/pkgs/development/python-modules/elastic-apm/default.nix
+++ b/pkgs/development/python-modules/elastic-apm/default.nix
@@ -86,7 +86,10 @@ buildPythonPackage rec {
     webob
   ];
 
-  disabledTests = [ "elasticapm_client" ];
+  disabledTests = [
+    "elasticapm_client"
+    "test_get_name_from_func_partialmethod_unbound"
+  ];
 
   disabledTestPaths =
     [
diff --git a/pkgs/development/python-modules/elevenlabs/default.nix b/pkgs/development/python-modules/elevenlabs/default.nix
index 970f98c7cbed..a74a12f99d77 100644
--- a/pkgs/development/python-modules/elevenlabs/default.nix
+++ b/pkgs/development/python-modules/elevenlabs/default.nix
@@ -13,7 +13,7 @@
 }:
 
 let
-  version = "2.0.0";
+  version = "2.2.0";
   tag = "v${version}";
 in
 buildPythonPackage {
@@ -25,7 +25,7 @@ buildPythonPackage {
     owner = "elevenlabs";
     repo = "elevenlabs-python";
     inherit tag;
-    hash = "sha256-QiV/B0ikXxEGs9UQUeqkPqdgxPwQi6UQ+tj6KT30Rv8=";
+    hash = "sha256-XZld32WJlZKnVQAUQV9FfJZgNOlW4JKVCqVdb8xCO7I=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/falconpy/default.nix b/pkgs/development/python-modules/falconpy/default.nix
index 360376093b6c..b018861f08cf 100644
--- a/pkgs/development/python-modules/falconpy/default.nix
+++ b/pkgs/development/python-modules/falconpy/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "falconpy";
-  version = "1.5.0";
+  version = "1.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CrowdStrike";
     repo = "falconpy";
     tag = "v${version}";
-    hash = "sha256-Yto32iXtO4po6sPHTautLLjDCRSLIS8K4YRFCbiF3m4=";
+    hash = "sha256-neZ0V0OpX1GTchkLdE+hKMRl9jKnJ/OCtXY0q1eAxzA=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/firedrake/default.nix b/pkgs/development/python-modules/firedrake/default.nix
index 6fa7ef63a24a..d790c3315725 100644
--- a/pkgs/development/python-modules/firedrake/default.nix
+++ b/pkgs/development/python-modules/firedrake/default.nix
@@ -140,8 +140,9 @@ buildPythonPackage rec {
       # required by script spydump
       matplotlib
     ]
-    ++ pytools.optional-dependencies.siphash
-    ++ lib.optional stdenv.hostPlatform.isDarwin islpy;
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      islpy
+    ];
 
   postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
     install_name_tool -add_rpath ${libsupermesh}/${python.sitePackages}/libsupermesh/lib \
diff --git a/pkgs/development/python-modules/gcal-sync/default.nix b/pkgs/development/python-modules/gcal-sync/default.nix
index b1378dcb6586..16860b78d8e6 100644
--- a/pkgs/development/python-modules/gcal-sync/default.nix
+++ b/pkgs/development/python-modules/gcal-sync/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "gcal-sync";
-  version = "7.0.1";
+  version = "7.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = "gcal_sync";
     tag = version;
-    hash = "sha256-MeXmVQ1NIlxccWM1fvmM8up+oOGEWKwC8GRx9NDxdyQ=";
+    hash = "sha256-jdhPoZdkgMg9TBIV9j3dvaEnEOpOoa1OKBeR1YAWWKs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/globus-sdk/default.nix b/pkgs/development/python-modules/globus-sdk/default.nix
index 35d0ee7a959c..2f3eab1ca574 100644
--- a/pkgs/development/python-modules/globus-sdk/default.nix
+++ b/pkgs/development/python-modules/globus-sdk/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "globus-sdk";
-  version = "3.56.0";
+  version = "3.56.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "globus";
     repo = "globus-sdk-python";
     tag = version;
-    hash = "sha256-/Ft4vyZEZpvmpBefBGdTXNr+bZFzF9WJso/kKFST1IY=";
+    hash = "sha256-M7ZOtj8zekKrouiipOafKBQP/EhPY4hGODXAovBF5ew=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-container/default.nix b/pkgs/development/python-modules/google-cloud-container/default.nix
index 6a2d0c0fb325..9370066bdc27 100644
--- a/pkgs/development/python-modules/google-cloud-container/default.nix
+++ b/pkgs/development/python-modules/google-cloud-container/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-container";
-  version = "2.56.1";
+  version = "2.57.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_container";
     inherit version;
-    hash = "sha256-QADuXKwndJvGDEWTftNIGRX7vwmJJdkoUjcC1w8vT6E=";
+    hash = "sha256-+n5vWT9YNIuYvW3Vk0TJpgOOn7psC5hY4j2dJ4NG8Sk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-dns/default.nix b/pkgs/development/python-modules/google-cloud-dns/default.nix
index 0bc3237aad09..5e1eae819e12 100644
--- a/pkgs/development/python-modules/google-cloud-dns/default.nix
+++ b/pkgs/development/python-modules/google-cloud-dns/default.nix
@@ -12,14 +12,15 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-dns";
-  version = "0.35.0";
+  version = "0.35.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-CsRNqesPoLEilRPNiIB0q9AhGZLEBCMAr9HBbUFHRVM=";
+    pname = "google_cloud_dns";
+    inherit version;
+    hash = "sha256-lU9EYV16tv/NBjJOL552D5awffH83bAkuaEJ0LMwqR8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-netapp/default.nix b/pkgs/development/python-modules/google-cloud-netapp/default.nix
index 2f4a1b850fc8..5e8cec8ea9e3 100644
--- a/pkgs/development/python-modules/google-cloud-netapp/default.nix
+++ b/pkgs/development/python-modules/google-cloud-netapp/default.nix
@@ -1,15 +1,15 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   google-api-core,
   google-auth,
   mock,
+  nix-update-script,
   proto-plus,
   protobuf,
   pytest-asyncio,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
 }:
 
@@ -18,14 +18,15 @@ buildPythonPackage rec {
   version = "0.3.23";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
-  src = fetchPypi {
-    pname = "google_cloud_netapp";
-    inherit version;
-    hash = "sha256-PP4o+qHCa3Ok6y9Ehyevmq1ac9Wb2zZoEDQgIpm0sr0=";
+  src = fetchFromGitHub {
+    owner = "googleapis";
+    repo = "google-cloud-python";
+    rev = "google-cloud-netapp-v${version}";
+    hash = "sha256-ietiyPCghGUD1jlGdZMhVgVozAlyfdvYgkV6NNlzLQg=";
   };
 
+  sourceRoot = "${src.name}/packages/google-cloud-netapp";
+
   build-system = [ setuptools ];
 
   dependencies = [
@@ -46,11 +47,18 @@ buildPythonPackage rec {
     "google.cloud.netapp_v1"
   ];
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "google-cloud-netapp-v([0-9.]+)"
+    ];
+  };
+
+  meta = {
     description = "Python Client for NetApp API";
     homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-netapp";
     changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-netapp-v${version}/packages/google-cloud-netapp/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = [ ];
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.sarahec ];
   };
 }
diff --git a/pkgs/development/python-modules/google-genai/default.nix b/pkgs/development/python-modules/google-genai/default.nix
index 634683d16678..31d72928d775 100644
--- a/pkgs/development/python-modules/google-genai/default.nix
+++ b/pkgs/development/python-modules/google-genai/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-genai";
-  version = "1.16.1";
+  version = "1.17.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "python-genai";
     tag = "v${version}";
-    hash = "sha256-P37dGIfpr02aO7N6Y3jGWXTjwz8IZPuZQYG0uJqeek4=";
+    hash = "sha256-ks8MU+Sg6TM57QiNmZD6rTGF8Di32mKtHFTF1pCTouQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/google-photos-library-api/default.nix b/pkgs/development/python-modules/google-photos-library-api/default.nix
index bc2965b3eeb1..87a7c8a5f626 100644
--- a/pkgs/development/python-modules/google-photos-library-api/default.nix
+++ b/pkgs/development/python-modules/google-photos-library-api/default.nix
@@ -39,6 +39,8 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     changelog = "https://github.com/allenporter/python-google-photos-library-api/releases/tag/${version}";
     description = "Python client library for Google Photos Library API";
diff --git a/pkgs/development/python-modules/googlemaps/default.nix b/pkgs/development/python-modules/googlemaps/default.nix
index e9967d69813c..504a45d1fefe 100644
--- a/pkgs/development/python-modules/googlemaps/default.nix
+++ b/pkgs/development/python-modules/googlemaps/default.nix
@@ -4,17 +4,15 @@
   fetchFromGitHub,
   pytest-cov-stub,
   pytestCheckHook,
-  pythonOlder,
   requests,
   responses,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "googlemaps";
   version = "4.10.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.5";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlemaps";
@@ -23,7 +21,11 @@ buildPythonPackage rec {
     hash = "sha256-8oGZEMKUGaDHKq4qIZy10cbLNMmVclJnQE/dx877pNQ=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [
+    requests
+  ];
 
   nativeCheckInputs = [
     pytest-cov-stub
@@ -39,11 +41,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "googlemaps" ];
 
-  meta = with lib; {
+  meta = {
     description = "Python client library for Google Maps API Web Services";
     homepage = "https://github.com/googlemaps/google-maps-services-python";
     changelog = "https://github.com/googlemaps/google-maps-services-python/releases/tag/v${version}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ Scriptkiddi ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ Scriptkiddi ];
   };
 }
diff --git a/pkgs/development/python-modules/gql/default.nix b/pkgs/development/python-modules/gql/default.nix
index 930198e1b3ca..818d16cfd922 100644
--- a/pkgs/development/python-modules/gql/default.nix
+++ b/pkgs/development/python-modules/gql/default.nix
@@ -38,12 +38,6 @@ buildPythonPackage rec {
     hash = "sha256-0mVMhJHlF6EZ3D9fuNrzkoHm9vIAKxbuajmUs1JL0HY=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py --replace \
-      "websockets>=10,<11;python_version>'3.6'" \
-      "websockets>=10,<12;python_version>'3.6'"
-  '';
-
   build-system = [ setuptools ];
 
   dependencies = [
@@ -115,11 +109,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "gql" ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "GraphQL client in Python";
     homepage = "https://github.com/graphql-python/gql";
     changelog = "https://github.com/graphql-python/gql/releases/tag/${src.tag}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
     mainProgram = "gql-cli";
   };
diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 301da0fc46dd..2c8d9818f9bb 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchurl,
   fetchpatch,
@@ -78,6 +79,10 @@ buildPythonPackage rec {
   # https://github.com/NixOS/nixpkgs/issues/47390
   installCheckPhase = "meson test --print-errorlogs";
 
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export DYLD_LIBRARY_PATH="${gst_all_1.gst-plugins-base}/lib"
+  '';
+
   passthru = {
     updateScript = directoryListingUpdater { };
   };
diff --git a/pkgs/development/python-modules/http-sf/default.nix b/pkgs/development/python-modules/http-sf/default.nix
index cddce17259ec..fcbde1e7d21d 100644
--- a/pkgs/development/python-modules/http-sf/default.nix
+++ b/pkgs/development/python-modules/http-sf/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "http-sf";
-  version = "1.0.3";
+  version = "1.0.4";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "mnot";
     repo = "http-sf";
     tag = "v${version}";
-    hash = "sha256-P4dr0prd4FeMdHP4vu6SBWNjYLF/gPAkkL8xyBMtDxQ=";
+    hash = "sha256-swstFntoox9cafLZ5tj02uFoReIRf+9xGOxHvga+Q5o=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/huggingface-hub/default.nix b/pkgs/development/python-modules/huggingface-hub/default.nix
index 7f0f3155bbf8..a97b354d2a32 100644
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@@ -25,6 +25,8 @@
   safetensors,
   # hf_transfer
   hf-transfer,
+  # hf_xet
+  hf-xet,
   # fastai
   toml,
   fastai,
@@ -93,7 +95,7 @@ buildPythonPackage rec {
       keras
     ];
     hf_xet = [
-      # hf-xet (unpackaged)
+      hf-xet
     ];
   };
 
diff --git a/pkgs/development/python-modules/ical/default.nix b/pkgs/development/python-modules/ical/default.nix
index 99785b8f1523..9eabfdd0a426 100644
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "ical";
-  version = "9.2.4";
+  version = "9.2.5";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = "ical";
     tag = version;
-    hash = "sha256-R9BuCLuVYuUvrmF/arEDsUPPUeSLjpqiEJ/ovvGIsYQ=";
+    hash = "sha256-db7xwNN7xAoeqPngZNJxQNM2wLVcr7VpuG2IWswLCEE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/identify/default.nix b/pkgs/development/python-modules/identify/default.nix
index 2de77a776357..f59607f9981e 100644
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "2.6.10";
+  version = "2.6.12";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "pre-commit";
     repo = "identify";
     tag = "v${version}";
-    hash = "sha256-PI7EDA6CZs6nGcggCt008LaQtJLlkAHj0Pnx44plggY=";
+    hash = "sha256-zV9NRHFh/bfbg+pO0xX5aXunc1y4aGfKDugyCFLj/xA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/influxdb-client/default.nix b/pkgs/development/python-modules/influxdb-client/default.nix
index f9054acb542d..e081e6e9d02b 100644
--- a/pkgs/development/python-modules/influxdb-client/default.nix
+++ b/pkgs/development/python-modules/influxdb-client/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "influxdb-client";
-  version = "1.48.0";
+  version = "1.49.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "influxdata";
     repo = "influxdb-client-python";
     tag = "v${version}";
-    hash = "sha256-MKTfRsqizZDXPMqJAypUDQBm+a2s6FaEG3TM30wucrI=";
+    hash = "sha256-lu3we/KXwP3oC9bfv6gzbwacOVLGSuPBf9giwmsHXgI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/json-repair/default.nix b/pkgs/development/python-modules/json-repair/default.nix
index 34a28f5ba76c..04d252c45e4b 100644
--- a/pkgs/development/python-modules/json-repair/default.nix
+++ b/pkgs/development/python-modules/json-repair/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "json-repair";
-  version = "0.44.1";
+  version = "0.46.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mangiucugna";
     repo = "json_repair";
     tag = "v${version}";
-    hash = "sha256-S3hSbvNyvCx4qia9PRgUy+UugURjtA4hV5kuJIuLafw=";
+    hash = "sha256-MfjWZYDYiFBTy0Tsm0OKY/89ziSTXNB5m99VkpS0Mco=";
   };
 
   build-system = [ setuptools ];
@@ -24,7 +24,6 @@ buildPythonPackage rec {
 
   disabledTestPaths = [
     "tests/test_performance.py"
-    "tests/test_coverage.py"
   ];
 
   pythonImportsCheck = [ "json_repair" ];
diff --git a/pkgs/development/python-modules/jupyterlab-git/default.nix b/pkgs/development/python-modules/jupyterlab-git/default.nix
index eced578e768b..5c31e1bf2133 100644
--- a/pkgs/development/python-modules/jupyterlab-git/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-git/default.nix
@@ -1,8 +1,12 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   git,
+  gitMinimal,
+  nodejs,
+  writableTmpDirAsHomeHook,
+  yarn-berry_3,
   jupyter-server,
   hatch-jupyter-builder,
   hatch-nodejs-version,
@@ -10,12 +14,12 @@
   jupyterlab,
   nbdime,
   nbformat,
+  packaging,
   pexpect,
   pytest-asyncio,
   pytest-jupyter,
   pytest-tornasync,
   pytestCheckHook,
-  pythonOlder,
   traitlets,
 }:
 
@@ -24,49 +28,52 @@ buildPythonPackage rec {
   version = "0.51.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
-  src = fetchPypi {
-    pname = "jupyterlab_git";
-    inherit version;
-    hash = "sha256-t7zol5XVzojIqvDXnrepPQU1Yi+b5rAZyprk07mpymo=";
+  src = fetchFromGitHub {
+    owner = "jupyterlab";
+    repo = "jupyterlab-git";
+    tag = "v${version}";
+    hash = "sha256-gAE8Qx+R97D5DCsgXgb1XtnRcdIkKWxe+J+Sk4OnYJM=";
   };
 
   nativeBuildInputs = [
+    nodejs
+    yarn-berry_3.yarnBerryConfigHook
+  ];
+
+  offlineCache = yarn-berry_3.fetchYarnBerryDeps {
+    inherit src;
+    hash = "sha256-r52Hj1Z2CpgH2AjeyGNuRO/WPWfdaY/e1d37jGJacBc=";
+  };
+
+  build-system = [
     hatch-jupyter-builder
     hatch-nodejs-version
     hatchling
     jupyterlab
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     jupyter-server
     nbdime
-    git
     nbformat
+    packaging
     pexpect
     traitlets
   ];
 
+  propagatedBuildInputs = [ git ];
+
   nativeCheckInputs = [
-    jupyterlab
+    gitMinimal
     pytest-asyncio
     pytest-jupyter
     pytest-tornasync
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export HOME=$TMPDIR
-  '';
-
   disabledTestPaths = [
     "jupyterlab_git/tests/test_handlers.py"
-    # PyPI doesn't ship all required files for the tests
-    "jupyterlab_git/tests/test_config.py"
-    "jupyterlab_git/tests/test_integrations.py"
-    "jupyterlab_git/tests/test_remote.py"
-    "jupyterlab_git/tests/test_settings.py"
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/kopf/default.nix b/pkgs/development/python-modules/kopf/default.nix
index b36d8a983962..e003a6bef744 100644
--- a/pkgs/development/python-modules/kopf/default.nix
+++ b/pkgs/development/python-modules/kopf/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "kopf";
-  version = "1.37.5";
+  version = "1.38.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nolar";
     repo = "kopf";
     tag = version;
-    hash = "sha256-FwQnt5UoK+Qx7suFACwEtTIvBneJQ19/WmdelWmf+Z0=";
+    hash = "sha256-H2Q5nDIODp2VFtMIJ0g8b+/SMZzLueRGBkh1g6LBbgc=";
   };
 
   build-system = [
@@ -79,7 +79,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python framework to write Kubernetes operators";
     homepage = "https://kopf.readthedocs.io/";
-    changelog = "https://github.com/nolar/kopf/releases/tag/${version}";
+    changelog = "https://github.com/nolar/kopf/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ genga898 ];
   };
diff --git a/pkgs/development/python-modules/lib50/default.nix b/pkgs/development/python-modules/lib50/default.nix
new file mode 100644
index 000000000000..4dedfc40b05b
--- /dev/null
+++ b/pkgs/development/python-modules/lib50/default.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  attrs,
+  pexpect,
+  pyyaml,
+  requests,
+  termcolor,
+  jellyfish,
+  cryptography,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "lib50";
+  version = "3.0.12";
+  pyproject = true;
+
+  # latest GitHub release is several years old. Pypi is up to date.
+  src = fetchPypi {
+    pname = "lib50";
+    inherit version;
+    hash = "sha256-Fc4Hb1AbSeetK3gH1/dRCUfHGDlMzfzgF1cnK3Se01U=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    attrs
+    pexpect
+    pyyaml
+    requests
+    termcolor
+    jellyfish
+    cryptography
+  ];
+
+  pythonRelaxDeps = [
+    "attrs"
+    "pyyaml"
+    "termcolor"
+    "jellyfish"
+  ];
+
+  pythonImportsCheck = [ "lib50" ];
+
+  # latest GitHub release is several years old and doesn't include
+  # tests and neither does pypi version include tests
+  doCheck = false;
+
+  meta = {
+    description = "CS50's own internal library used in many of its tools";
+    homepage = "https://github.com/cs50/lib50";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+  };
+}
diff --git a/pkgs/development/python-modules/libtmux/default.nix b/pkgs/development/python-modules/libtmux/default.nix
index 732881f975e9..b1f99424c52b 100644
--- a/pkgs/development/python-modules/libtmux/default.nix
+++ b/pkgs/development/python-modules/libtmux/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "libtmux";
-  version = "0.46.1";
+  version = "0.46.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tmux-python";
     repo = "libtmux";
     tag = "v${version}";
-    hash = "sha256-x+zEfHFTAF0m6j/WFmelcBVOzh7oJE02BdB3bz/EcNM=";
+    hash = "sha256-M3su+bDFuvmNEDVK+poWfxwbpsw/0L1/R6Z4CL0mvZ4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/llama-cloud/default.nix b/pkgs/development/python-modules/llama-cloud/default.nix
index b8fddf1197be..a5be40deffb2 100644
--- a/pkgs/development/python-modules/llama-cloud/default.nix
+++ b/pkgs/development/python-modules/llama-cloud/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-cloud";
-  version = "0.1.22";
+  version = "0.1.23";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_cloud";
     inherit version;
-    hash = "sha256-XZOCc2ktpQ9zMBqt/tG0sQ+U3767nx4THAMeAz67Kn8=";
+    hash = "sha256-PYSiSoYPBG05oQbAZ0LsDqOaV0rEK7+RcG/gJfROIz4=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix b/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix
index e160ec6136e6..4f225c8abf44 100644
--- a/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix
+++ b/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  poetry-core,
+  hatchling,
   llama-cloud,
   llama-index-core,
   pythonOlder,
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-indices-managed-llama-cloud";
-  version = "0.6.11";
+  version = "0.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,10 +18,10 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_indices_managed_llama_cloud";
     inherit version;
-    hash = "sha256-klUy92DNLrsllIKNoxGtrD1UzSyuPf8pCEke67K4vQ8=";
+    hash = "sha256-+GtifVEN1PvlFEdzTxmBG9ipVcQtUx8jeoVpi50eQUA=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];
 
   dependencies = [
     llama-cloud
diff --git a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
index 3409c2ce7da4..afd8c6e45f44 100644
--- a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
@@ -2,15 +2,15 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  hatchling,
   llama-index-core,
   ollama,
-  poetry-core,
   pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "llama-index-llms-ollama";
-  version = "0.5.4";
+  version = "0.5.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,10 +18,10 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_llms_ollama";
     inherit version;
-    hash = "sha256-5efnpOZUeMdikG0I9ZRkfYFI/9wyrpCNVrc8DfjqBPI=";
+    hash = "sha256-RDiMv6riuVcvbqZzTAcBXHcoI/vm0ssmx9/jT65R3cU=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];
 
   dependencies = [
     llama-index-core
diff --git a/pkgs/development/python-modules/llama-index-readers-file/default.nix b/pkgs/development/python-modules/llama-index-readers-file/default.nix
index 6007eb969fd3..7be23381629b 100644
--- a/pkgs/development/python-modules/llama-index-readers-file/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-file/default.nix
@@ -3,8 +3,8 @@
   beautifulsoup4,
   buildPythonPackage,
   fetchPypi,
+  hatchling,
   llama-index-core,
-  poetry-core,
   pymupdf,
   pypdf,
   pythonOlder,
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-readers-file";
-  version = "0.4.7";
+  version = "0.4.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_readers_file";
     inherit version;
-    hash = "sha256-iadlI4oQavDx4xq41Ms+4zrIlwgChbzOWRAbQgJl69E=";
+    hash = "sha256-0oIbFkwRRTt5k0VjVabFRGMaCuhlamRt+fwAnxbPuZ8=";
   };
 
   pythonRelaxDeps = [
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     "striprtf"
   ];
 
-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];
 
   dependencies = [
     beautifulsoup4
diff --git a/pkgs/development/python-modules/losant-rest/default.nix b/pkgs/development/python-modules/losant-rest/default.nix
index 385e5832d218..7453a9b7dc63 100644
--- a/pkgs/development/python-modules/losant-rest/default.nix
+++ b/pkgs/development/python-modules/losant-rest/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "losant-rest";
-  version = "1.20.1";
+  version = "1.22.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Losant";
     repo = "losant-rest-python";
     tag = "v${version}";
-    hash = "sha256-1CxcA9/FvKP3P0Q02by0hBHQTAcbfLCp3AualHhZyvY=";
+    hash = "sha256-8h8EGG13C3zSB/KBdk6Oa5dKHTIftO7mCYay/wAe9Y4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/minikerberos/default.nix b/pkgs/development/python-modules/minikerberos/default.nix
index 44d44f3b969d..03b560720c13 100644
--- a/pkgs/development/python-modules/minikerberos/default.nix
+++ b/pkgs/development/python-modules/minikerberos/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "minikerberos";
-  version = "0.4.4";
+  version = "0.4.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GweGHGxAOLZqOnVdzOtw0xuvsrKsaB1gf1xZ/WuFR7w=";
+    hash = "sha256-Vv04ngYZcEO32J7ucT6aXyu1RgINtqBk4ZIddA+VcpA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mkdocstrings-python/default.nix b/pkgs/development/python-modules/mkdocstrings-python/default.nix
index cfc8be4f681a..062556804584 100644
--- a/pkgs/development/python-modules/mkdocstrings-python/default.nix
+++ b/pkgs/development/python-modules/mkdocstrings-python/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "mkdocstrings-python";
-  version = "1.16.10";
+  version = "1.16.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mkdocstrings";
     repo = "python";
     tag = version;
-    hash = "sha256-HwGo+o78SDo+RM2UxQB4A8OTY5FVuav1TS6J+aVVWdc=";
+    hash = "sha256-Vee8pNslf/nELnIeMPkuBsbMVLLcK5CyIAaKTh/OEMM=";
   };
 
   build-system = [ pdm-backend ];
@@ -51,7 +51,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python handler for mkdocstrings";
     homepage = "https://github.com/mkdocstrings/python";
-    changelog = "https://github.com/mkdocstrings/python/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/mkdocstrings/python/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/mscerts/default.nix b/pkgs/development/python-modules/mscerts/default.nix
index 9cfa07589258..70faf2fb926c 100644
--- a/pkgs/development/python-modules/mscerts/default.nix
+++ b/pkgs/development/python-modules/mscerts/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "mscerts";
-  version = "2025.2.26";
+  version = "2025.5.28";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "ralphje";
     repo = "mscerts";
     tag = version;
-    hash = "sha256-W9F+M/fMsQB8vld6+m18NDTJr526N/AVHvgLrlVIfcI=";
+    hash = "sha256-FdREuLoUNL0uJczX5IDOFEWSo4YoYV7n0PnD+TJKcYY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/murmurhash/default.nix b/pkgs/development/python-modules/murmurhash/default.nix
index dc3aa8a32468..a508e3257ff8 100644
--- a/pkgs/development/python-modules/murmurhash/default.nix
+++ b/pkgs/development/python-modules/murmurhash/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "murmurhash";
-  version = "1.0.12";
+  version = "1.0.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Rnt+4xwfefRtAENqGVf8UqDlgBNp3S8w63ZV84BzW18=";
+    hash = "sha256-c3JG1B7gD/dLB7C9HwiIvjBNIDzmaOZCyGqmTt4w+Lc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mypy-boto3-builder/default.nix b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
index 7afc3c03d8ab..532c9a93b5de 100644
--- a/pkgs/development/python-modules/mypy-boto3-builder/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "8.10.1";
+  version = "8.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -31,12 +31,12 @@ buildPythonPackage rec {
     owner = "youtype";
     repo = "mypy_boto3_builder";
     tag = version;
-    hash = "sha256-2XWFmmTkT5LpGqzHK3h8KeqQXP1+nwNEPeGHt/gowRo=";
+    hash = "sha256-7NrN42DcM+NNTjRnOdDzPBTKFRex8Ph4bVjdVgJa4Po=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail 'version = "8.10.0"' 'version = "${version}"'
+      --replace-fail 'version = "8.10.1"' 'version = "${version}"'
   '';
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index b7983c31f475..d8683b2d05f5 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -182,8 +182,8 @@ rec {
       "sha256-WXMpTKmBXa1q51tnLTE5sOxJyn0LLqOwpV2wdZfM1v0=";
 
   mypy-boto3-ce =
-    buildMypyBoto3Package "ce" "1.38.0"
-      "sha256-bdy/QUEmHR1czRK79z/vlayX3HGX0pzKQSQSg+eyTac=";
+    buildMypyBoto3Package "ce" "1.38.24"
+      "sha256-daz9r4KWlK/n3ZcxDRARlOlSKcUbhyW/12HPWja30RY=";
 
   mypy-boto3-chime =
     buildMypyBoto3Package "chime" "1.38.0"
@@ -446,8 +446,8 @@ rec {
       "sha256-RQh46jrXqj4bXTRJ+tPR9sql7yUn7Ek9u4p0OU0A7b0=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.38.23"
-      "sha256-rS6zGXH0fa6FpSHWczTtfe0ywJbFKRij4eD4YoH48Sc=";
+    buildMypyBoto3Package "ec2" "1.38.24"
+      "sha256-QehCKooiP5jPrE6UA4OA6MJTdCczUTPsoFfDi/R13TQ=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.38.0"
diff --git a/pkgs/development/python-modules/napari/default.nix b/pkgs/development/python-modules/napari/default.nix
index ed7736c072b7..4e3a41bc999f 100644
--- a/pkgs/development/python-modules/napari/default.nix
+++ b/pkgs/development/python-modules/napari/default.nix
@@ -45,14 +45,14 @@
 
 mkDerivationWith buildPythonPackage rec {
   pname = "napari";
-  version = "0.6.0";
+  version = "0.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "napari";
     repo = "napari";
     tag = "v${version}";
-    hash = "sha256-OGEnB+GVqBwtYQegPuR7MOYFxmc4aNHCQt2+OKHLZ5M=";
+    hash = "sha256-qgyhoxXROlm+DASJV2QOA1IqpHxPhsIEv+TGU2mhiuc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/nutpie/default.nix b/pkgs/development/python-modules/nutpie/default.nix
index e627c3d23fe0..a5b42f2d775c 100644
--- a/pkgs/development/python-modules/nutpie/default.nix
+++ b/pkgs/development/python-modules/nutpie/default.nix
@@ -31,20 +31,20 @@
 
 buildPythonPackage rec {
   pname = "nutpie";
-  version = "0.14.3";
+  version = "0.15.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pymc-devs";
     repo = "nutpie";
     tag = "v${version}";
-    hash = "sha256-l2TEGa9VVJmU4mKZwfUdhiloW6Bh41OqIQzTRvYK3eg=";
+    hash = "sha256-Mt3hCgmkgT9zWaHMvyjmO6U77/2os7E4zNOiyKWrRMo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-hPKT+YM9s7XZhI3sfnLBfokbGQhwDa9y5Fgg1TItO4M=";
+    hash = "sha256-ZUBrZqdesy0qKaxuD5gSlq7qOoXWn0aZNOidUb0grMM=";
   };
 
   build-system = [
@@ -82,6 +82,10 @@ buildPythonPackage rec {
     writableTmpDirAsHomeHook
   ];
 
+  pytestFlagsArray = [
+    "-v"
+  ];
+
   disabledTests = lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
     # flaky (assert np.float64(0.0017554642626285276) > 0.01)
     "test_normalizing_flow"
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index eb9bb7e62dde..3c20c954510b 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "16.10.1";
+  version = "16.10.2";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-9gjLznyR7LLvq+5HHyK5qSFAQEWW3i00N2SLM7x4NXo=";
+    hash = "sha256-kEPVufS8wpoGi/A4Eh1u9gLVIEdJmoPDmAiY38DYDv4=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/ocrmypdf/use-pillow-heif.patch b/pkgs/development/python-modules/ocrmypdf/use-pillow-heif.patch
index fc464cf71b66..c30706fc6fc0 100644
--- a/pkgs/development/python-modules/ocrmypdf/use-pillow-heif.patch
+++ b/pkgs/development/python-modules/ocrmypdf/use-pillow-heif.patch
@@ -1,18 +1,18 @@
 diff --git a/pyproject.toml b/pyproject.toml
-index d045458f..efa9161d 100644
+index 451d83d9..817b27ea 100644
 --- a/pyproject.toml
 +++ b/pyproject.toml
 @@ -16,7 +16,7 @@ dependencies = [
    "img2pdf>=0.5",
    "packaging>=20",
    "pdfminer.six>=20220319",
--  "pi-heif",                # Heif image format - maintainers: if this is removed, it will NOT break
-+  "pillow-heif",                # Heif image format - maintainers: if this is removed, it will NOT break
-   "pikepdf>=8.10.1",
+-  "pi-heif",                   # Heif image format - maintainers: if this is removed, it will NOT break
++  "pillow-heif",                   # Heif image format - maintainers: if this is removed, it will NOT break
+   "pikepdf>=8.10.1, != 9.8.0",
    "Pillow>=10.0.1",
    "pluggy>=1",
 diff --git a/src/ocrmypdf/_pipeline.py b/src/ocrmypdf/_pipeline.py
-index 043a78a0..522197b1 100644
+index 90524d58..0be5a0f8 100644
 --- a/src/ocrmypdf/_pipeline.py
 +++ b/src/ocrmypdf/_pipeline.py
 @@ -42,7 +42,7 @@ from ocrmypdf.pdfinfo import Colorspace, Encoding, PageInfo, PdfInfo
diff --git a/pkgs/development/python-modules/oelint-data/default.nix b/pkgs/development/python-modules/oelint-data/default.nix
index 580bae09ecf8..01c53b7eda78 100644
--- a/pkgs/development/python-modules/oelint-data/default.nix
+++ b/pkgs/development/python-modules/oelint-data/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "oelint-data";
-  version = "1.0.14";
+  version = "1.0.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-data";
     tag = version;
-    hash = "sha256-4EfvRj9vtSZRtsypCshg2T7raV3a0bozZVu1IdRdtdg=";
+    hash = "sha256-OZtBJWjAYuwXt1ehgt6bIZPeVByXCjOcctPJGLrsxiU=";
   };
 
   build-system = [
@@ -34,7 +34,7 @@ buildPythonPackage rec {
   meta = {
     description = "Data for oelint-adv";
     homepage = "https://github.com/priv-kweihmann/oelint-data";
-    changelog = "https://github.com/priv-kweihmann/oelint-data/releases/tag/${version}";
+    changelog = "https://github.com/priv-kweihmann/oelint-data/releases/tag/${src.tag}";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
diff --git a/pkgs/development/python-modules/opensfm/0005-fix-numpy-2-test-failures.patch b/pkgs/development/python-modules/opensfm/0005-fix-numpy-2-test-failures.patch
new file mode 100644
index 000000000000..444471d37f4d
--- /dev/null
+++ b/pkgs/development/python-modules/opensfm/0005-fix-numpy-2-test-failures.patch
@@ -0,0 +1,239 @@
+diff --git a/opensfm/exif.py b/opensfm/exif.py
+--- a/opensfm/exif.py
++++ b/opensfm/exif.py
+@@ -509,7 +509,7 @@ class EXIF:
+                     )
+                 )
+ 
+-            if np.all(ypr) is not None:
++            if np.all(ypr != None):
+                 ypr = np.radians(ypr)
+ 
+                 # Convert YPR --> OPK
+diff --git a/opensfm/transformations.py b/opensfm/transformations.py
+--- a/opensfm/transformations.py
++++ b/opensfm/transformations.py
+@@ -232,7 +232,7 @@ def translation_from_matrix(matrix: numpy.ndarray) -> numpy.ndarray:
+     True
+ 
+     """
+-    return numpy.array(matrix, copy=False)[:3, 3].copy()
++    return numpy.asarray(matrix)[:3, 3].copy()
+ 
+ 
+ def reflection_matrix(point: numpy.ndarray, normal: numpy.ndarray) -> numpy.ndarray:
+@@ -275,7 +275,7 @@ def reflection_from_matrix(
+     True
+ 
+     """
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=False)
++    M = numpy.asarray(matrix, dtype=numpy.float64)
+     # normal: unit eigenvector corresponding to eigenvalue -1
+     w, V = numpy.linalg.eig(M[:3, :3])
+     i = numpy.where(abs(numpy.real(w) + 1.0) < 1e-8)[0]
+@@ -339,7 +339,7 @@ def rotation_matrix(
+     M[:3, :3] = R
+     if point is not None:
+         # rotation not around origin
+-        point = numpy.array(point[:3], dtype=numpy.float64, copy=False)
++        point = numpy.asarray(point[:3], dtype=numpy.float64)
+         M[:3, 3] = point - numpy.dot(R, point)
+     return M
+ 
+@@ -359,7 +359,7 @@ def rotation_from_matrix(
+     True
+ 
+     """
+-    R = numpy.array(matrix, dtype=numpy.float64, copy=False)
++    R = numpy.asarray(matrix, dtype=numpy.float64)
+     R33 = R[:3, :3]
+     # direction: unit eigenvector of R33 corresponding to eigenvalue of 1
+     w, W = numpy.linalg.eig(R33.T)
+@@ -444,7 +444,7 @@ def scale_from_matrix(
+     True
+ 
+     """
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=False)
++    M = numpy.asarray(matrix, dtype=numpy.float64)
+     M33 = M[:3, :3]
+     factor = numpy.trace(M33) - 2.0
+     try:
+@@ -505,11 +505,11 @@ def projection_matrix(
+ 
+     """
+     M = numpy.identity(4)
+-    point = numpy.array(point[:3], dtype=numpy.float64, copy=False)
++    point = numpy.asarray(point[:3], dtype=numpy.float64)
+     normal = unit_vector(normal[:3])
+     if perspective is not None:
+         # perspective projection
+-        perspective = numpy.array(perspective[:3], dtype=numpy.float64, copy=False)
++        perspective = numpy.asarray(perspective[:3], dtype=numpy.float64)
+         M[0, 0] = M[1, 1] = M[2, 2] = numpy.dot(perspective - point, normal)
+         M[:3, :3] -= numpy.outer(perspective, normal)
+         if pseudo:
+@@ -522,7 +522,7 @@ def projection_matrix(
+         M[3, 3] = numpy.dot(perspective, normal)
+     elif direction is not None:
+         # parallel projection
+-        direction = numpy.array(direction[:3], dtype=numpy.float64, copy=False)
++        direction = numpy.asarray(direction[:3], dtype=numpy.float64)
+         scale = numpy.dot(direction, normal)
+         M[:3, :3] -= numpy.outer(direction, normal) / scale
+         M[:3, 3] = direction * (numpy.dot(point, normal) / scale)
+@@ -569,7 +569,7 @@ def projection_from_matrix(
+     True
+ 
+     """
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=False)
++    M = numpy.asarray(matrix, dtype=numpy.float64)
+     M33 = M[:3, :3]
+     w, V = numpy.linalg.eig(M)
+     i = numpy.where(abs(numpy.real(w) - 1.0) < 1e-8)[0]
+@@ -726,7 +726,7 @@ def shear_from_matrix(
+     True
+ 
+     """
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=False)
++    M = numpy.asarray(matrix, dtype=numpy.float64)
+     M33 = M[:3, :3]
+     # normal: cross independent eigenvectors corresponding to the eigenvalue 1
+     w, V = numpy.linalg.eig(M33)
+@@ -790,7 +790,7 @@ def decompose_matrix(
+     True
+ 
+     """
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=True).T
++    M = numpy.asarray(matrix, dtype=numpy.float64, copy=True).T
+     if abs(M[3, 3]) < _EPS:
+         raise ValueError("M[3, 3] is zero")
+     M /= M[3, 3]
+@@ -982,8 +982,8 @@ def affine_matrix_from_points(
+     More examples in superimposition_matrix()
+ 
+     """
+-    v0 = numpy.array(v0, dtype=numpy.float64, copy=True)
+-    v1 = numpy.array(v1, dtype=numpy.float64, copy=True)
++    v0 = numpy.asarray(v0, dtype=numpy.float64, copy=True)
++    v1 = numpy.asarray(v1, dtype=numpy.float64, copy=True)
+ 
+     ndims = v0.shape[0]
+     if ndims < 2 or v0.shape[1] < ndims or v0.shape != v1.shape:
+@@ -1099,8 +1099,8 @@ def superimposition_matrix(
+     True
+ 
+     """
+-    v0 = numpy.array(v0, dtype=numpy.float64, copy=False)[:3]
+-    v1 = numpy.array(v1, dtype=numpy.float64, copy=False)[:3]
++    v0 = numpy.asarray(v0, dtype=numpy.float64)[:3]
++    v1 = numpy.asarray(v1, dtype=numpy.float64)[:3]
+     return affine_matrix_from_points(v0, v1, shear=False, scale=scale, usesvd=usesvd)
+ 
+ 
+@@ -1198,7 +1198,7 @@ def euler_from_matrix(
+     j = _NEXT_AXIS[i + parity]
+     k = _NEXT_AXIS[i - parity + 1]
+ 
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=False)[:3, :3]
++    M = numpy.asarray(matrix, dtype=numpy.float64)[:3, :3]
+     if repetition:
+         sy = math.sqrt(M[i, j] * M[i, j] + M[i, k] * M[i, k])
+         if sy > _EPS:
+@@ -1329,7 +1329,7 @@ def quaternion_matrix(quaternion: numpy.ndarray) -> numpy.ndarray:
+     True
+ 
+     """
+-    q = numpy.array(quaternion, dtype=numpy.float64, copy=True)
++    q = numpy.asarray(quaternion, dtype=numpy.float64, copy=True)
+     n = numpy.dot(q, q)
+     if n < _EPS:
+         return numpy.identity(4)
+@@ -1379,7 +1379,7 @@ def quaternion_from_matrix(
+     True
+ 
+     """
+-    M = numpy.array(matrix, dtype=numpy.float64, copy=False)[:4, :4]
++    M = numpy.asarray(matrix, dtype=numpy.float64)[:4, :4]
+     if isprecise:
+         q = numpy.empty((4,))
+         t = numpy.trace(M)
+@@ -1460,7 +1460,7 @@ def quaternion_conjugate(quaternion: numpy.ndarray) -> numpy.ndarray:
+     True
+ 
+     """
+-    q = numpy.array(quaternion, dtype=numpy.float64, copy=True)
++    q = numpy.asarray(quaternion, dtype=numpy.float64, copy=True)
+     numpy.negative(q[1:], q[1:])
+     return q
+ 
+@@ -1474,7 +1474,7 @@ def quaternion_inverse(quaternion: numpy.ndarray) -> numpy.ndarray:
+     True
+ 
+     """
+-    q = numpy.array(quaternion, dtype=numpy.float64, copy=True)
++    q = numpy.asarray(quaternion, dtype=numpy.float64, copy=True)
+     numpy.negative(q[1:], q[1:])
+     return q / numpy.dot(q, q)
+ 
+@@ -1496,7 +1496,7 @@ def quaternion_imag(quaternion: numpy.ndarray) -> numpy.ndarray:
+     array([ 0.,  1.,  2.])
+ 
+     """
+-    return numpy.array(quaternion[1:4], dtype=numpy.float64, copy=True)
++    return numpy.asarray(quaternion[1:4], dtype=numpy.float64, copy=True)
+ 
+ 
+ def quaternion_slerp(
+@@ -1654,7 +1654,7 @@ def vector_norm(
+     1.0
+ 
+     """
+-    data = numpy.array(data, dtype=numpy.float64, copy=True)
++    data = numpy.asarray(data, dtype=numpy.float64, copy=True)
+     if out is None:
+         if data.ndim == 1:
+             return math.sqrt(numpy.dot(data, data))
+@@ -1697,13 +1697,13 @@ def unit_vector(
+ 
+     """
+     if out is None:
+-        data = numpy.array(data, dtype=numpy.float64, copy=True)
++        data = numpy.asarray(data, dtype=numpy.float64, copy=True)
+         if data.ndim == 1:
+             data /= math.sqrt(numpy.dot(data, data))
+             return data
+     else:
+         if out is not data:
+-            out[:] = numpy.array(data, copy=False)
++            out[:] = numpy.asarray(data)
+         data = out
+     length = numpy.atleast_1d(numpy.sum(data * data, axis))
+     numpy.sqrt(length, length)
+@@ -1777,8 +1777,8 @@ def angle_between_vectors(
+     True
+ 
+     """
+-    v0 = numpy.array(v0, dtype=numpy.float64, copy=False)
+-    v1 = numpy.array(v1, dtype=numpy.float64, copy=False)
++    v0 = numpy.asarray(v0, dtype=numpy.float64)
++    v1 = numpy.asarray(v1, dtype=numpy.float64)
+     dot = numpy.sum(v0 * v1, axis=axis)
+     dot /= vector_norm(v0, axis=axis) * vector_norm(v1, axis=axis)
+     dot = numpy.clip(dot, -1.0, 1.0)
+@@ -1826,9 +1826,9 @@ def is_same_transform(matrix0: numpy.ndarray, matrix1: numpy.ndarray) -> numpy.n
+     False
+ 
+     """
+-    matrix0 = numpy.array(matrix0, dtype=numpy.float64, copy=True)
++    matrix0 = numpy.asarray(matrix0, dtype=numpy.float64, copy=True)
+     matrix0 /= matrix0[3, 3]
+-    matrix1 = numpy.array(matrix1, dtype=numpy.float64, copy=True)
++    matrix1 = numpy.asarray(matrix1, dtype=numpy.float64, copy=True)
+     matrix1 /= matrix1[3, 3]
+     return numpy.allclose(matrix0, matrix1)
+ 
+@@ -1874,3 +1874,4 @@ if __name__ == "__main__":
+ 
+     numpy.set_printoptions(suppress=True, precision=5)
+     doctest.testmod()
++
diff --git a/pkgs/development/python-modules/opensfm/default.nix b/pkgs/development/python-modules/opensfm/default.nix
index bfaa8b8f1b73..c7b8f3f7a368 100644
--- a/pkgs/development/python-modules/opensfm/default.nix
+++ b/pkgs/development/python-modules/opensfm/default.nix
@@ -9,6 +9,7 @@
   suitesparse,
   metis,
   eigen,
+  setuptools,
   pkg-config,
   pybind11,
   numpy,
@@ -27,6 +28,7 @@
   joblib,
   repoze-lru,
   xmltodict,
+  distutils,
   cloudpickle,
   scipy,
   sphinx,
@@ -34,13 +36,10 @@
   fpdf,
 }:
 
-let
-  ceresSplit = (builtins.length ceres-solver.outputs) > 1;
-  ceres' = if ceresSplit then ceres-solver.dev else ceres-solver;
-in
 buildPythonPackage rec {
   pname = "opensfm";
   version = "unstable-2023-12-09";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mapillary";
@@ -48,12 +47,15 @@ buildPythonPackage rec {
     rev = "7f170d0dc352340295ff480378e3ac37d0179f8e";
     sha256 = "sha256-l/HTVenC+L+GpMNnDgnSGZ7+Qd2j8b8cuTs3SmORqrg=";
   };
+
   patches = [
     ./0002-cmake-find-system-distributed-gtest.patch
     ./0003-cmake-use-system-pybind11.patch
     ./0004-pybind_utils.h-conflicts-with-nixpkgs-pybind.patch
+    ./0005-fix-numpy-2-test-failures.patch # not upstreamed due to cla, but you're free upstream it -@pbsds
     ./fix-scripts.patch
   ];
+
   postPatch = ''
     rm opensfm/src/cmake/FindGlog.cmake
     rm opensfm/src/cmake/FindGflags.cmake
@@ -64,16 +66,22 @@ buildPythonPackage rec {
     echo 'feature_type: SIFT' >> data/berlin/config.yaml
     echo 'feature_type: HAHOG' >> data/lund/config.yaml
 
+    # make opensfm correctly import glog headers
+    export CXXFLAGS=-DGLOG_USE_GLOG_EXPORT
+
     sed -i -e 's/^.*BuildDoc.*$//' setup.py
   '';
 
+  build-system = [ setuptools ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
     sphinx
   ];
+
   buildInputs = [
-    ceres'
+    ceres-solver
     suitesparse
     metis
     eigen
@@ -83,7 +91,8 @@ buildPythonPackage rec {
     glog
     pybind11
   ];
-  propagatedBuildInputs = [
+
+  dependencies = [
     numpy
     scipy
     pyyaml
@@ -101,7 +110,11 @@ buildPythonPackage rec {
     xmltodict
     cloudpickle
   ];
-  nativeCheckInputs = [ pytestCheckHook ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    distutils
+  ];
 
   dontUseCmakeBuildDir = true;
   cmakeFlags = [
@@ -122,7 +135,10 @@ buildPythonPackage rec {
 
   meta = {
     broken = stdenv.hostPlatform.isDarwin;
-    maintainers = [ lib.maintainers.SomeoneSerge ];
+    maintainers = [
+      lib.maintainers.pbsds
+      lib.maintainers.SomeoneSerge
+    ];
     license = lib.licenses.bsd2;
     changelog = "https://github.com/mapillary/OpenSfM/blob/${src.rev}/CHANGELOG.md";
     description = "Open source Structure-from-Motion pipeline from Mapillary";
diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index 00f656dfab46..84d5348a85b6 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "opower";
-  version = "0.12.1";
+  version = "0.12.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "tronikos";
     repo = "opower";
     tag = "v${version}";
-    hash = "sha256-4Sbx7qvQFY/9yKXF4CiRqKh3CNTsHZrmS5BjJ80UaXM=";
+    hash = "sha256-9qDkhhx96+Zu2yr+EWJc0m2ntNlCo0luFOr6NxWtJSw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/percol/default.nix b/pkgs/development/python-modules/percol/default.nix
deleted file mode 100644
index 1710fb7db566..000000000000
--- a/pkgs/development/python-modules/percol/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  cmigemo,
-}:
-
-buildPythonPackage {
-  pname = "percol";
-  version = "unstable-2019-07-24";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "mooz";
-    repo = "percol";
-    rev = "4b28037e328da3d0fe8165c11b800cbaddcb525e";
-    sha256 = "07sq3517wzn04j2dzlmczmcvx3w6r7xnzz3634zgf1zi6dbr2a3g";
-  };
-
-  propagatedBuildInputs = [ cmigemo ];
-
-  # package has no tests
-  doCheck = false;
-  pythonImportsCheck = [ "percol" ];
-
-  meta = with lib; {
-    homepage = "https://github.com/mooz/percol";
-    description = "Adds flavor of interactive filtering to the traditional pipe concept of shell";
-    mainProgram = "percol";
-    license = licenses.mit;
-    maintainers = with maintainers; [ koral ];
-  };
-}
diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index 032cb278bd3e..944af3c4f07c 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "posthog";
-  version = "4.0.1";
+  version = "4.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
     tag = "v${version}";
-    hash = "sha256-JEoltzbpbHOehdqaKkGJbrcjaOXC7wDQh++S/klsW9o=";
+    hash = "sha256-RpD4+NuClYmmXCn9eBa2oxMW3TwvVZcTkgaV+mNOkYU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/preshed/default.nix b/pkgs/development/python-modules/preshed/default.nix
index 1ca058038fbf..dcd022909e81 100644
--- a/pkgs/development/python-modules/preshed/default.nix
+++ b/pkgs/development/python-modules/preshed/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "preshed";
-  version = "3.0.9";
+  version = "3.0.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-chhjxSRP/NJlGtCSiVGix8d7EC9OEaJRrYXTfudiFmA=";
+    hash = "sha256-WlyOaF6UH0/+yX8fvzJpS4EHhYiRpLw0EH+smB2Clv8=";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index 2e9b44f5c676..fcf7ba5ddab0 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "1.0.2.20250523";
+  version = "1.0.2.20250529";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-68T4kTmN7PBhf3fla7zkm5dSHLKp9jMJMSuLiFZAmzc=";
+    hash = "sha256-0hK9gd9nW5WVCDbc7BqvBi0Xn5Vysn0wS08UwNpyY3s=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyathena/default.nix b/pkgs/development/python-modules/pyathena/default.nix
index 0bf6692537e4..ccfbde940234 100644
--- a/pkgs/development/python-modules/pyathena/default.nix
+++ b/pkgs/development/python-modules/pyathena/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "pyathena";
-  version = "3.14.0";
+  version = "3.14.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Dgst0gFmHsQwhScz83cIE7B1xbcSKcYslfCGtm3yuh0=";
+    hash = "sha256-/2KCYVlbUrwrdICcQu+JiG90vgE3FQbiif2wvE9lOZM=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pyexploitdb/default.nix b/pkgs/development/python-modules/pyexploitdb/default.nix
index f0af917126a1..b283032a9ff3 100644
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyexploitdb";
-  version = "0.2.81";
+  version = "0.2.82";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyExploitDb";
     inherit version;
-    hash = "sha256-dUWt8PstzKVQaY1rwc7XgZHwXwctbCRAr3X0PSXr8XI=";
+    hash = "sha256-SA/7tQDYcpGKQQr/eD5U3sJUqxk/JW+NR5tv18Qijhg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pygitguardian/default.nix b/pkgs/development/python-modules/pygitguardian/default.nix
index 2e46ac552fcf..c9988971da3b 100644
--- a/pkgs/development/python-modules/pygitguardian/default.nix
+++ b/pkgs/development/python-modules/pygitguardian/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pygitguardian";
-  version = "1.21.0";
+  version = "1.22.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "GitGuardian";
     repo = "py-gitguardian";
     tag = "v${version}";
-    hash = "sha256-pFbryvVwAQbhjNDZ0v+edvtWpkHZ1AVTz0tEsfYBXz8=";
+    hash = "sha256-AXgsB1ap233o6TP6htOFuQ++AubCRUqGbs5NWT0Qv+w=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pyinstrument/default.nix b/pkgs/development/python-modules/pyinstrument/default.nix
index 12d6a1346797..e8874dc61abd 100644
--- a/pkgs/development/python-modules/pyinstrument/default.nix
+++ b/pkgs/development/python-modules/pyinstrument/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyinstrument";
-  version = "5.0.0";
+  version = "5.0.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "joerick";
     repo = "pyinstrument";
     tag = "v${version}";
-    hash = "sha256-uJ9KRgSETuxpeEIpBKFz66+Qci86jy36lKkUKpvmKIg=";
+    hash = "sha256-30e8J7TF16SRgDTt5Eizc7ofg00bCF61O9y+2jA63GY=";
   };
 
   nativeBuildInputs = [
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     description = "Call stack profiler for Python";
     mainProgram = "pyinstrument";
     homepage = "https://github.com/joerick/pyinstrument";
-    changelog = "https://github.com/joerick/pyinstrument/releases/tag/v${version}";
+    changelog = "https://github.com/joerick/pyinstrument/releases/tag/${src.tag}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ onny ];
   };
diff --git a/pkgs/development/python-modules/pylamarzocco/default.nix b/pkgs/development/python-modules/pylamarzocco/default.nix
index 7440a43e76db..378343d7fb02 100644
--- a/pkgs/development/python-modules/pylamarzocco/default.nix
+++ b/pkgs/development/python-modules/pylamarzocco/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pylamarzocco";
-  version = "2.0.4";
+  version = "2.0.7";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "zweckj";
     repo = "pylamarzocco";
     tag = "v${version}";
-    hash = "sha256-ING00Xz+ipEnwX+u4M6upN5aYX2JrKZS/ho6b72QyFw=";
+    hash = "sha256-IFac66zBGvRASXJDa/Y6F3BxZhRD9tG8yAB2l2IsDVk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pymc/default.nix b/pkgs/development/python-modules/pymc/default.nix
index 8f2ea6ee717a..d6a478165ea5 100644
--- a/pkgs/development/python-modules/pymc/default.nix
+++ b/pkgs/development/python-modules/pymc/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "pymc";
-  version = "5.22.0";
+  version = "5.23.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pymc-devs";
     repo = "pymc";
     tag = "v${version}";
-    hash = "sha256-NQYvtt/cjssJ7Lv3RyDeBMQByKMmt1p0X9F+LqhtTV4=";
+    hash = "sha256-Hlj5kOSMz8uoqeBkLiq9kT6CZrb2XJW9mas45G2EZB4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyngrok/default.nix b/pkgs/development/python-modules/pyngrok/default.nix
index 7c4f55112c93..619d98e60636 100644
--- a/pkgs/development/python-modules/pyngrok/default.nix
+++ b/pkgs/development/python-modules/pyngrok/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyngrok";
-  version = "7.2.8";
+  version = "7.2.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gIBoyO+PLToMBbPnPAxlaXFzLvtn5oof4f9jl+b3tMU=";
+    hash = "sha256-Ixt/1Kel6CZajWFQ07o8gtnf/UCe2u23LE5isy3kT5E=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyopencl/default.nix b/pkgs/development/python-modules/pyopencl/default.nix
index ce5a284b3017..65a6d25973ba 100644
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@@ -67,7 +67,7 @@ buildPythonPackage rec {
     mako
     pytestCheckHook
     writableTmpDirAsHomeHook
-  ] ++ pytools.optional-dependencies.siphash;
+  ];
 
   env = {
     CL_INC_DIR = "${opencl-headers}/include";
diff --git a/pkgs/development/python-modules/pyspellchecker/default.nix b/pkgs/development/python-modules/pyspellchecker/default.nix
index 693863346bb7..5d7321371d74 100644
--- a/pkgs/development/python-modules/pyspellchecker/default.nix
+++ b/pkgs/development/python-modules/pyspellchecker/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyspellchecker";
-  version = "0.8.2";
+  version = "0.8.3";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "barrust";
     repo = "pyspellchecker";
     tag = "v${version}";
-    hash = "sha256-sQNYtm+EK/F4S/Kfy87MwqDjCfV33/v8bYi48UBz+qc=";
+    hash = "sha256-cfYtUOXO4xzO2CYYhWMv3o40iw5/+nvA8MAzJn6LPlQ=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/python-bsblan/default.nix b/pkgs/development/python-modules/python-bsblan/default.nix
index bd508b0307f9..53967ac7a55d 100644
--- a/pkgs/development/python-modules/python-bsblan/default.nix
+++ b/pkgs/development/python-modules/python-bsblan/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "python-bsblan";
-  version = "1.2.1";
+  version = "1.2.2";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "liudger";
     repo = "python-bsblan";
     tag = "v${version}";
-    hash = "sha256-b+/Cy8F2xUsYOr8PGQxkdXD07pAECNmbeWbuysSAT2I=";
+    hash = "sha256-qzQP77bfV21g7DIdZfJCyv9FN/U6aQk9wWV9xPZFolk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-telegram-bot/default.nix b/pkgs/development/python-modules/python-telegram-bot/default.nix
index efd3f5c4bb42..fdcffd2da479 100644
--- a/pkgs/development/python-modules/python-telegram-bot/default.nix
+++ b/pkgs/development/python-modules/python-telegram-bot/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "python-telegram-bot";
-  version = "22.0";
+  version = "22.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "python-telegram-bot";
     repo = "python-telegram-bot";
     tag = "v${version}";
-    hash = "sha256-/8sWlq2f71B3Y2fAsdluGqW5I07KNfFmqtXtk+7crE4=";
+    hash = "sha256-zysqE1WZCHdoJUr9+yE7L5xY5pInNUKC4qw4v3zPSRg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pytibber/default.nix b/pkgs/development/python-modules/pytibber/default.nix
index 398840a3fea2..9ee6c4abdd32 100644
--- a/pkgs/development/python-modules/pytibber/default.nix
+++ b/pkgs/development/python-modules/pytibber/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pytibber";
-  version = "0.31.2";
+  version = "0.31.5";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pyTibber";
     tag = version;
-    hash = "sha256-/k9XnRgfaE59+Fi/5AhCJt4/jFLdYeDCNaoGCDYGWso=";
+    hash = "sha256-U6WMBX7p0dHQ7vEbw3lmFmysWEcoSbojG2dVZik9gA4=";
   };
 
   build-system = [ setuptools ];
@@ -47,7 +47,7 @@ buildPythonPackage rec {
     description = "Python library to communicate with Tibber";
     homepage = "https://github.com/Danielhiversen/pyTibber";
     changelog = "https://github.com/Danielhiversen/pyTibber/releases/tag/${src.tag}";
-    license = lib.licenses.mit;
+    license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/pytools/default.nix b/pkgs/development/python-modules/pytools/default.nix
index 625cb55badbd..8fc38098f3e5 100644
--- a/pkgs/development/python-modules/pytools/default.nix
+++ b/pkgs/development/python-modules/pytools/default.nix
@@ -13,31 +13,31 @@
 
 buildPythonPackage rec {
   pname = "pytools";
-  version = "2025.1.2";
+  version = "2025.1.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wA25T92aljmJlzLL+RvLKReGdRzJA4CwfXOBgspQ8rE=";
+    hash = "sha256-im+YrLBc6UGRu+j4WnPz7J7Ut2PBxpoHgQWeGgF8YeU=";
   };
 
   build-system = [ hatchling ];
 
   dependencies = [
     platformdirs
+    siphash24
     typing-extensions
   ];
 
   optional-dependencies = {
     numpy = [ numpy ];
-    siphash = [ siphash24 ];
   };
 
   nativeCheckInputs = [
     pytestCheckHook
-  ] ++ optional-dependencies.siphash;
+  ];
 
   pythonImportsCheck = [
     "pytools"
diff --git a/pkgs/development/python-modules/pytricia/default.nix b/pkgs/development/python-modules/pytricia/default.nix
deleted file mode 100644
index d2caf52c6010..000000000000
--- a/pkgs/development/python-modules/pytricia/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-}:
-
-buildPythonPackage {
-  pname = "pytricia";
-  version = "unstable-2019-01-16";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "jsommers";
-    repo = "pytricia";
-    rev = "4ba88f68c3125f789ca8cd1cfae156e1464bde87";
-    sha256 = "0qp5774xkm700g35k5c76pck8pdzqlyzbaqgrz76a1yh67s2ri8h";
-  };
-
-  meta = with lib; {
-    description = "Library for fast IP address lookup in Python";
-    homepage = "https://github.com/jsommers/pytricia";
-    license = with licenses; [ lgpl3Plus ];
-    maintainers = with maintainers; [ mkg ];
-  };
-}
diff --git a/pkgs/development/python-modules/pytubefix/default.nix b/pkgs/development/python-modules/pytubefix/default.nix
index c68df308b68a..4091e62307de 100644
--- a/pkgs/development/python-modules/pytubefix/default.nix
+++ b/pkgs/development/python-modules/pytubefix/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pytubefix";
-  version = "8.13.1";
+  version = "9.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "JuanBindez";
     repo = "pytubefix";
     tag = "v${version}";
-    hash = "sha256-CjnlIyXI7usgSsz7npM61lHzuJ/evdTabtQOUnY9OEY=";
+    hash = "sha256-TIrt20FAQumtDisscY9jcJY+Cuh1zA92hU3HVmwr4Bk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/reolink-aio/default.nix b/pkgs/development/python-modules/reolink-aio/default.nix
index bc9da18d8115..5ae40b5523f1 100644
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "reolink-aio";
-  version = "0.13.3";
+  version = "0.13.4";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "starkillerOG";
     repo = "reolink_aio";
     tag = version;
-    hash = "sha256-VOVVUDcjSn8BkXEIRJKHiPkDoFE+4w2iI/uNkY7I8Yg=";
+    hash = "sha256-/r7aMZqX7JxvG/3FVXLABPP9zDOWhEmWaxzgIsb5SAk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/sensorpro-ble/default.nix b/pkgs/development/python-modules/sensorpro-ble/default.nix
index 637af7a57e88..dec2a5b5a5ef 100644
--- a/pkgs/development/python-modules/sensorpro-ble/default.nix
+++ b/pkgs/development/python-modules/sensorpro-ble/default.nix
@@ -43,7 +43,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Sensorpro BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/sensorpro-ble";
-    changelog = "https://github.com/Bluetooth-Devices/sensorpro-ble/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/Bluetooth-Devices/sensorpro-ble/blob/${src.tag}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/smolagents/default.nix b/pkgs/development/python-modules/smolagents/default.nix
index f89b1a595f62..8da324604d45 100644
--- a/pkgs/development/python-modules/smolagents/default.nix
+++ b/pkgs/development/python-modules/smolagents/default.nix
@@ -34,14 +34,14 @@
 
 buildPythonPackage rec {
   pname = "smolagents";
-  version = "1.16.1";
+  version = "1.17.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "smolagents";
     tag = "v${version}";
-    hash = "sha256-4G55fASE8D4UfqO7/j+2VjqdQ8FxFPLkYO2pl5sSlxw=";
+    hash = "sha256-BMyLN8eNGBhywpN/EEE8hFf4Wb5EDpZvqBbX0ojRYec=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/sparse/default.nix b/pkgs/development/python-modules/sparse/default.nix
index 6100873d5b42..35a3e4066dd3 100644
--- a/pkgs/development/python-modules/sparse/default.nix
+++ b/pkgs/development/python-modules/sparse/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "sparse";
-  version = "0.16.0";
+  version = "0.17.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydata";
     repo = "sparse";
     tag = version;
-    hash = "sha256-ChSEb+IwzutDgYBJxhlunRaF8VvkLHW/ae5RdrljWj0=";
+    hash = "sha256-LYJ7YnR7WtzamK6py1NRPBe+h28L7JT+52wmourAc/c=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/spsdk-pyocd/default.nix b/pkgs/development/python-modules/spsdk-pyocd/default.nix
index 87aa71450d14..bd10411161e5 100644
--- a/pkgs/development/python-modules/spsdk-pyocd/default.nix
+++ b/pkgs/development/python-modules/spsdk-pyocd/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "spsdk-pyocd";
-  version = "0.3.1";
+  version = "0.3.2";
   pyproject = true;
 
   # Latest tag missing on GitHub
   src = fetchPypi {
     pname = "spsdk_pyocd";
     inherit version;
-    hash = "sha256-yVQtX2T1l0TmFwaZDSFCXMuoFxTalfOr3b4CCTeteKI=";
+    hash = "sha256-OcRGYZ1U5jQyRv2OSKwS3uJpvRQRW6Fbm/rDxlzyxPg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/starlette-compress/default.nix b/pkgs/development/python-modules/starlette-compress/default.nix
new file mode 100644
index 000000000000..970d665ae9a4
--- /dev/null
+++ b/pkgs/development/python-modules/starlette-compress/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  brotli,
+  brotlicffi,
+  starlette,
+  zstandard,
+  pytestCheckHook,
+  httpx,
+  trio,
+}:
+
+buildPythonPackage rec {
+  pname = "starlette-compress";
+  version = "1.6.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Zaczero";
+    repo = "starlette-compress";
+    tag = version;
+    hash = "sha256-VEVPbCGE4BQo/0t/P785TyMHZGSKCicV6H0LbBsv8uo=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    brotli
+    brotlicffi
+    starlette
+    zstandard
+  ];
+
+  checkInputs = [
+    httpx
+    trio
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "starlette_compress" ];
+
+  meta = {
+    description = "Compression middleware for Starlette - supporting ZStd, Brotli, and GZip";
+    homepage = "https://pypi.org/p/starlette-compress";
+    license = lib.licenses.bsd0;
+    maintainers = with lib.maintainers; [ wrvsrx ];
+  };
+}
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 45497b38789f..25f899573a62 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1386";
+  version = "3.0.1389";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-Xr+i29fKfoRkvj4LX1cVqfBcJJ5pvKgvnYeZgkdx1Vo=";
+    hash = "sha256-mLBC1ZOLO8vh5QMmG15TD07hHwBBlaRABY5ZMjKES1I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tensorflow-datasets/default.nix b/pkgs/development/python-modules/tensorflow-datasets/default.nix
index 728e669aae08..eb121d899ae0 100644
--- a/pkgs/development/python-modules/tensorflow-datasets/default.nix
+++ b/pkgs/development/python-modules/tensorflow-datasets/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
 
   # dependencies
   array-record,
@@ -58,25 +57,16 @@
 
 buildPythonPackage rec {
   pname = "tensorflow-datasets";
-  version = "4.9.8";
+  version = "4.9.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tensorflow";
     repo = "datasets";
     tag = "v${version}";
-    hash = "sha256-nqveZ+8b0f5sGIn6WufKeA37yEsZjzhCIbCfwMZ9JOM=";
+    hash = "sha256-ZXaPYmj8aozfe6ygzKybId8RZ1TqPuIOSpd8XxnRHus=";
   };
 
-  patches = [
-    # mlmlcroissant uses encoding_formats, not encoding_formats.
-    # Backport https://github.com/tensorflow/datasets/pull/11037 until released.
-    (fetchpatch {
-      url = "https://github.com/tensorflow/datasets/commit/92cbcff725a1036569a515cc3356aa8480740451.patch";
-      hash = "sha256-2hnMvQP83+eAJllce19aHujcoWQzUz3+LsasWCo4BtM=";
-    })
-  ];
-
   dependencies = [
     array-record
     dill
diff --git a/pkgs/development/python-modules/torchmetrics/default.nix b/pkgs/development/python-modules/torchmetrics/default.nix
index 7b2eb68b21b4..077310e39567 100644
--- a/pkgs/development/python-modules/torchmetrics/default.nix
+++ b/pkgs/development/python-modules/torchmetrics/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "torchmetrics";
-  version = "1.7.1";
+  version = "1.7.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "torchmetrics";
     tag = "v${version}";
-    hash = "sha256-pjUGv064xVOfXiLDMTaFu6Fu4kt/2tfg2l2YGKlhjfw=";
+    hash = "sha256-E/ZmP0eyNdSYb0+wKNsOZM2ViEldUWcwSmSGzZEYXfw=";
   };
 
   dependencies = [
diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index b3da1a43d6d2..41b7db0a5dcc 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -54,6 +54,7 @@
   torchvision,
   av,
   sentencepiece,
+  hf-xet,
 }:
 
 buildPythonPackage rec {
@@ -135,7 +136,7 @@ buildPythonPackage rec {
         optax
       ];
       hf_xet = [
-        # hf-xet (unpackaged)
+        hf-xet
       ];
       tokenizers = [ tokenizers ];
       ftfy = [ ftfy ];
diff --git a/pkgs/development/python-modules/typedunits/default.nix b/pkgs/development/python-modules/typedunits/default.nix
index 3f0ed6e1d4ac..941db335c3e0 100644
--- a/pkgs/development/python-modules/typedunits/default.nix
+++ b/pkgs/development/python-modules/typedunits/default.nix
@@ -42,7 +42,7 @@ buildPythonPackage {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+  disabledTests = lib.optionals stdenv.hostPlatform.isAarch [
     # Rounding differences
     "test_float_to_twelths_frac"
   ];
diff --git a/pkgs/development/python-modules/ufomerge/default.nix b/pkgs/development/python-modules/ufomerge/default.nix
index 97e85393ac12..b5d23696dc29 100644
--- a/pkgs/development/python-modules/ufomerge/default.nix
+++ b/pkgs/development/python-modules/ufomerge/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "ufomerge";
-  version = "1.9.2";
+  version = "1.9.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "ufomerge";
     tag = "v${version}";
-    hash = "sha256-vGRNfLZoI0ufEbfdGdyUyL9sS+9HdpeUj7ztqaQHI0I=";
+    hash = "sha256-AWEuHFm9upYrONaHXubPzK5qLsvYJ1M9/vcC5OgqRJM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/ultralytics/default.nix b/pkgs/development/python-modules/ultralytics/default.nix
index 9f16d7775fcc..33c89f940659 100644
--- a/pkgs/development/python-modules/ultralytics/default.nix
+++ b/pkgs/development/python-modules/ultralytics/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "ultralytics";
-  version = "8.3.130";
+  version = "8.3.143";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ultralytics";
     repo = "ultralytics";
     tag = "v${version}";
-    hash = "sha256-lB4Q1LK3hbn67mHcVn2qCh9YjVPDBl4DM3LXDL7lsvQ=";
+    hash = "sha256-qpFQcGLTEQS7Bt9CvdXgv2JyNfOONS0Cf71dckCrlPw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/unstructured-client/default.nix b/pkgs/development/python-modules/unstructured-client/default.nix
index 9f1e3770ce6a..feedb3e2a49e 100644
--- a/pkgs/development/python-modules/unstructured-client/default.nix
+++ b/pkgs/development/python-modules/unstructured-client/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "unstructured-client";
-  version = "0.35.0";
+  version = "0.36.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Unstructured-IO";
     repo = "unstructured-python-client";
     tag = "v${version}";
-    hash = "sha256-f1sJei3OnLxVahsirZFUzdIpkEEMc8rZR3+8JfihCuM=";
+    hash = "sha256-WEltF3puitytIFN/CxG6TCpWGxs8dubCqvU7byba1Yg=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/vfblib/default.nix b/pkgs/development/python-modules/vfblib/default.nix
index 4a88c543569b..b59bdc5e1387 100644
--- a/pkgs/development/python-modules/vfblib/default.nix
+++ b/pkgs/development/python-modules/vfblib/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "vfblib";
-  version = "0.9.2";
+  version = "0.9.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LucasFonts";
     repo = "vfbLib";
     rev = "v${version}";
-    hash = "sha256-kXuaxdGj2dcenZ4SfRBiDjcLzA3Ehb25T7bKk4dXK9g=";
+    hash = "sha256-D5dMjRjgi+4JQbtRc7RNMKG1CXRr2wsHa4pFPhEO6fY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/vispy/default.nix b/pkgs/development/python-modules/vispy/default.nix
index 875c06b5fe71..0d77d9c77373 100644
--- a/pkgs/development/python-modules/vispy/default.nix
+++ b/pkgs/development/python-modules/vispy/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "vispy";
-  version = "0.14.3";
+  version = "0.15.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-77u4R6kIuvfnFpq5vylhOKOTZPNn5ssKjsA61xaZ0x0=";
+    hash = "sha256-1S0QwGl/SJkFVc6iorrT+fWncjkYVv2jZOpLvGn9B1w=";
   };
 
   patches = lib.optionals (!stdenv.hostPlatform.isDarwin) [
diff --git a/pkgs/development/python-modules/vt-py/default.nix b/pkgs/development/python-modules/vt-py/default.nix
index 31898840acef..a7556309236e 100644
--- a/pkgs/development/python-modules/vt-py/default.nix
+++ b/pkgs/development/python-modules/vt-py/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "vt-py";
-  version = "0.20.0";
+  version = "0.21.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "VirusTotal";
     repo = "vt-py";
     tag = version;
-    hash = "sha256-5go6O5V8mY1Ph3peF6ISJ63/cnhNtDIlgeLztp2zpkY=";
+    hash = "sha256-hp9MjFSakFezlT/rTHa70KrL3VShhpayXaK88LxY7I4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/wagtail/default.nix b/pkgs/development/python-modules/wagtail/default.nix
index b653033193f0..450b9207c3bf 100644
--- a/pkgs/development/python-modules/wagtail/default.nix
+++ b/pkgs/development/python-modules/wagtail/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
+  fetchPypi,
 
   # build-system
   setuptools,
@@ -34,11 +34,12 @@ buildPythonPackage rec {
   version = "6.4.1";
   pyproject = true;
 
-  src = fetchFromGitHub {
-    owner = "wagtail";
-    repo = "wagtail";
-    tag = "v${version}";
-    hash = "sha256-2qixbJK3f+3SBnsfVEcObFJmuBvE2J9o3LIkILZQRLQ=";
+  # The GitHub source requires some assets to be compiled, which in turn
+  # requires fixing the upstream package lock. We need to use the PyPI release
+  # until https://github.com/wagtail/wagtail/pull/13136 gets merged.
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-zsPm1JIKbRePoetvSvgLNw/dVXDtkkuXkQThV/EMoJc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/yara-x/default.nix b/pkgs/development/python-modules/yara-x/default.nix
index 3e1eae5394ce..6d5be2c0fda7 100644
--- a/pkgs/development/python-modules/yara-x/default.nix
+++ b/pkgs/development/python-modules/yara-x/default.nix
@@ -9,7 +9,7 @@
 }:
 buildPythonPackage rec {
   pname = "yara-x";
-  version = "0.14.0";
+  version = "0.15.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -18,14 +18,14 @@ buildPythonPackage rec {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${version}";
-    hash = "sha256-C8wBGmilouNcNN3HkwvSTWcZY1fe0jVc2TeWDN4w5xA=";
+    hash = "sha256-fbuh/SMfOygnuvG9zTZqem4oLaS+5uXScXPhU3aVDjM=";
   };
 
   buildAndTestSubdir = "py";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname src version;
-    hash = "sha256-afCBuWr12trjEIDvE0qnGFxTXU7LKZCzZB8RqgqperY=";
+    hash = "sha256-+dPIujaxDJ7JrtNvX4VjGHFmgtCb1BJpFQL4c3E1/GY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/yaramod/default.nix b/pkgs/development/python-modules/yaramod/default.nix
index 2e8788fa52c7..b31b5324163f 100644
--- a/pkgs/development/python-modules/yaramod/default.nix
+++ b/pkgs/development/python-modules/yaramod/default.nix
@@ -21,14 +21,14 @@ let
 in
 buildPythonPackage rec {
   pname = "yaramod";
-  version = "4.3.1";
+  version = "4.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "avast";
     repo = "yaramod";
     tag = "v${version}";
-    hash = "sha256-NAKQxKY3FdlSDbDBwiBricvMOwwlhtMNz9RPEaB6NOw=";
+    hash = "sha256-b0IdhnKlOPkjq/oZtEHbOzEjp5gUhX+NqDid61ubovc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/zxcvbn/default.nix b/pkgs/development/python-modules/zxcvbn/default.nix
index 1c4708846e13..689d7dd3459f 100644
--- a/pkgs/development/python-modules/zxcvbn/default.nix
+++ b/pkgs/development/python-modules/zxcvbn/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "zxcvbn";
-  version = "4.4.28";
+  version = "4.5.0";
   format = "setuptools";
 
   # no tests included in PyPI tarball
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "dwolfhub";
     repo = "zxcvbn-python";
     tag = "v${version}";
-    hash = "sha256-etcST7pxlpOH5Q9KtOPGf1vmnkyjEp6Cd5QCmBjW9Hc=";
+    hash = "sha256-0SVJkJMEMnZVMpamDVP02kMwWRSj5zGlrMYG9kn0aXQ=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index 21861c5693f2..78483cd61b7e 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -2160,6 +2160,10 @@ let
       ];
     });
 
+    CNEr = old.CNEr.overrideAttrs (attrs: {
+      patches = [ ./patches/CNEr.patch ];
+    });
+
     covidsymptom = old.covidsymptom.overrideAttrs (attrs: {
       preConfigure = "rm R/covidsymptomdata.R";
     });
diff --git a/pkgs/development/r-modules/patches/CNEr.patch b/pkgs/development/r-modules/patches/CNEr.patch
new file mode 100644
index 000000000000..1534ac91fd9a
--- /dev/null
+++ b/pkgs/development/r-modules/patches/CNEr.patch
@@ -0,0 +1,48 @@
+diff --git a/src/ucsc/common.c b/src/ucsc/common.c
+index a3fc893..e4198d3 100644
+--- a/src/ucsc/common.c
++++ b/src/ucsc/common.c
+@@ -341,7 +341,7 @@ if (count > 1)
+     }
+ }
+ 
+-void slUniqify(void *pList, int (*compare )(const void *elem1,  const void *elem2), void (*free)())
++void slUniqify(void *pList, int (*compare )(const void *elem1,  const void *elem2), void (*freeFunc)())
+ /* Return sorted list with duplicates removed.
+  * Compare should be same type of function as slSort's compare (taking
+  * pointers to pointers to elements.  Free should take a simple
+@@ -356,7 +356,7 @@ while ((el = slPopHead(&oldList)) != NULL)
+     {
+     if ((newList == NULL) || (compare(&newList, &el) != 0))
+         slAddHead(&newList, el);
+-    else if (free != NULL)
++    else if (freeFunc != NULL)
+         free(el);
+     }
+ slReverse(&newList);
+diff --git a/src/ucsc/hash.c b/src/ucsc/hash.c
+index 320b360..6ed9c70 100644
+--- a/src/ucsc/hash.c
++++ b/src/ucsc/hash.c
+@@ -611,7 +611,7 @@ if ((hash = *pHash) != NULL)
+     }
+ }
+ 
+-void hashFreeWithVals(struct hash **pHash, void (freeFunc)())
++void hashFreeWithVals(struct hash **pHash, void (*freeFunc)(void **))
+ /* Free up hash table and all values associated with it. freeFunc is a
+  * function to free an entry, should take a pointer to a pointer to an
+  * entry. */
+diff --git a/src/ucsc/hash.h b/src/ucsc/hash.h
+index a7fc017..0d06bb9 100644
+--- a/src/ucsc/hash.h
++++ b/src/ucsc/hash.h
+@@ -244,7 +244,7 @@ void freeHashAndVals(struct hash **pHash);
+ /* Free up hash table and all values associated with it.
+  * (Just calls freeMem on each hel->val) */
+ 
+-void hashFreeWithVals(struct hash **pHash, void (freeFunc)());
++void hashFreeWithVals(struct hash **pHash, void (*freeFunc)(void **));
+ /* Free up hash table and all values associated with it. freeFunc is a
+  * function to free an entry, should take a pointer to a pointer to an
+  * entry. */
diff --git a/pkgs/development/tools/ocaml/dune/3.nix b/pkgs/development/tools/ocaml/dune/3.nix
index 881476dcc5ce..6d8ce464eb1e 100644
--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@@ -14,11 +14,11 @@ else
 
   stdenv.mkDerivation rec {
     pname = "dune";
-    version = "3.18.2";
+    version = "3.19.0";
 
     src = fetchurl {
       url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-      hash = "sha256-Vr5Qn/w8W6ZSET2ea0PtsEppHx4fbLuhe50kOxI5p68=";
+      hash = "sha256-0vYX39NPfYgvQYGiLjWbuQtGZp7YeyZQ64QvBTL8aWw=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/kde/misc/klevernotes/default.nix b/pkgs/kde/misc/klevernotes/default.nix
index 0ad4056f0d15..2a7c14b9cefd 100644
--- a/pkgs/kde/misc/klevernotes/default.nix
+++ b/pkgs/kde/misc/klevernotes/default.nix
@@ -5,6 +5,7 @@
   qtsvg,
   qtwebengine,
   kconfigwidgets,
+  kitemmodels,
 }:
 mkKdeDerivation rec {
   pname = "klevernotes";
@@ -19,6 +20,7 @@ mkKdeDerivation rec {
     qtsvg
     qtwebengine
     kconfigwidgets
+    kitemmodels
   ];
 
   meta.license = with lib.licenses; [
diff --git a/pkgs/os-specific/linux/asus-wmi-sensors/default.nix b/pkgs/os-specific/linux/asus-wmi-sensors/default.nix
deleted file mode 100644
index c73086722de5..000000000000
--- a/pkgs/os-specific/linux/asus-wmi-sensors/default.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  kernel,
-}:
-
-stdenv.mkDerivation rec {
-  name = "asus-wmi-sensors-${version}-${kernel.version}";
-  version = "unstable-2019-11-07";
-
-  # The original was deleted from github, but this seems to be an active fork
-  src = fetchFromGitHub {
-    owner = "electrified";
-    repo = "asus-wmi-sensors";
-    rev = "8daafd45d1b860cf5b17eee1c94d93feb04164a9";
-    sha256 = "0kc0xlrsmf783ln5bqyj6qxzmrhdxdfdd2b9ygf2lbl2153i04vc";
-  };
-
-  hardeningDisable = [ "pic" ];
-
-  nativeBuildInputs = kernel.moduleBuildDependencies;
-
-  preConfigure = ''
-    sed -i 's|depmod|#depmod|' Makefile
-  '';
-
-  makeFlags = [
-    "TARGET=${kernel.modDirVersion}"
-    "KERNEL_MODULES=${kernel.dev}/lib/modules/${kernel.modDirVersion}"
-    "MODDESTDIR=${placeholder "out"}/lib/modules/${kernel.modDirVersion}/kernel/drivers/hwmon"
-  ];
-
-  meta = with lib; {
-    description = "Linux HWMON (lmsensors) sensors driver for various ASUS Ryzen and Threadripper motherboards";
-    homepage = "https://github.com/electrified/asus-wmi-sensors";
-    license = licenses.gpl2Only;
-    platforms = [
-      "x86_64-linux"
-      "i686-linux"
-    ];
-    maintainers = with maintainers; [ Frostman ];
-    broken = versionOlder kernel.version "4.12";
-  };
-}
diff --git a/pkgs/os-specific/linux/ithc/default.nix b/pkgs/os-specific/linux/ithc/default.nix
index 9f721bfae939..e9dce7825361 100644
--- a/pkgs/os-specific/linux/ithc/default.nix
+++ b/pkgs/os-specific/linux/ithc/default.nix
@@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
     license = licenses.publicDomain;
     maintainers = with maintainers; [ aacebedo ];
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "5.9";
+    broken = kernel.kernelOlder "5.9" || kernel.kernelAtLeast "6.10";
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 16bbc6e7e32f..a5d2afcc2308 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -12,12 +12,12 @@
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v5.15.183-hardened1.patch",
-            "sha256": "135ab4z2a1rs94ysf8jgdy8p51n776y88lmwgyf75pbdpiac5wgd",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.15.183-hardened1/linux-hardened-v5.15.183-hardened1.patch"
+            "name": "linux-hardened-v5.15.184-hardened1.patch",
+            "sha256": "1s4naybf1rd2a42xqyrvp0g94pfxx766lnwnnfwiid7j3pz7fbi5",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.15.184-hardened1/linux-hardened-v5.15.184-hardened1.patch"
         },
-        "sha256": "1s4fqm83api3xk0b443b4bhgrx7bx6n8bchdpmzahqadk9i7yvyh",
-        "version": "5.15.183"
+        "sha256": "1nf1v89ikwi9philrw6h03hzb085mwz44lfxx71agp67vk39hglw",
+        "version": "5.15.184"
     },
     "5.4": {
         "patch": {
@@ -32,22 +32,22 @@
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.1.139-hardened1.patch",
-            "sha256": "055640hrki8br3g4ka8y0lg4zqnrjab3cm0y06p8lpk1bnmsdhms",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.1.139-hardened1/linux-hardened-v6.1.139-hardened1.patch"
+            "name": "linux-hardened-v6.1.140-hardened1.patch",
+            "sha256": "0a40j1s1il05wlcp7dfpg20rlff2va4vdcx3vid1dg2h17b2kr3s",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.1.140-hardened1/linux-hardened-v6.1.140-hardened1.patch"
         },
-        "sha256": "064zzk7kwkq7i5160s0alzkz16pp89wcq07s9jhzhv4bxvgzyspn",
-        "version": "6.1.139"
+        "sha256": "0x7b856hxmli8qnkps9x62q8sca101v4sfwjqgivzxvprb5gjyap",
+        "version": "6.1.140"
     },
     "6.12": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.12.29-hardened1.patch",
-            "sha256": "0ccg5vr9sfyxd5yhj3zw129ga46x3vvcglcsdsz39hzvi1dmgq5j",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.29-hardened1/linux-hardened-v6.12.29-hardened1.patch"
+            "name": "linux-hardened-v6.12.30-hardened1.patch",
+            "sha256": "0c04fl4qf47gr72q1kbn3gyzhl27v1w2mmq9dwizkzvb4cf8kvdb",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.30-hardened1/linux-hardened-v6.12.30-hardened1.patch"
         },
-        "sha256": "0k86nmmpg0jsx11w34vlj20cxpxavip4y5g7dp4bkk1q4dzfrcp8",
-        "version": "6.12.29"
+        "sha256": "0bpqkh64bj6nslbb43hj28lxmrxinrapwgh05q5wwh0yjx46l16z",
+        "version": "6.12.30"
     },
     "6.13": {
         "patch": {
@@ -62,21 +62,21 @@
     "6.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.14.7-hardened1.patch",
-            "sha256": "03ca9s4ricjdyk4k0i3zfrih1jxhwyqpvl1kc6z1fk14cj727h4y",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.14.7-hardened1/linux-hardened-v6.14.7-hardened1.patch"
+            "name": "linux-hardened-v6.14.8-hardened1.patch",
+            "sha256": "10vr63mx42vnz7jlr737hsaz20ch972bvv1c7lj6kk5slidwg1rb",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.14.8-hardened1/linux-hardened-v6.14.8-hardened1.patch"
         },
-        "sha256": "0wj9yl0ymzjx3ig0l3wdl5dqqiylvjk0j8adm5bnj23dq8mj04l1",
-        "version": "6.14.7"
+        "sha256": "0199maj3mk577wwaszbi0cl5a0afx1ynad896bmmg8vm636jxcb2",
+        "version": "6.14.8"
     },
     "6.6": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.6.91-hardened1.patch",
-            "sha256": "08dhn42n73gx7inkczq1q3qass91imqkxs2r423z9g7dh0hgjgxk",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.91-hardened1/linux-hardened-v6.6.91-hardened1.patch"
+            "name": "linux-hardened-v6.6.92-hardened1.patch",
+            "sha256": "1wm1wm76mlw0vyp6d28rf4qz8wqx0ri7zaajycwymh1zh4600pn7",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.92-hardened1/linux-hardened-v6.6.92-hardened1.patch"
         },
-        "sha256": "1x2lwaaqzlgszk41cy6k5j9dcbxxkca5xjaznb82r987ahbkv3fh",
-        "version": "6.6.91"
+        "sha256": "1v1pq9yzxrlaxx4y4cj5q3wska0jbv2inc7phqfw70fj88kai0hx",
+        "version": "6.6.92"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 62ea09bef719..baec656fcae8 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -5,8 +5,8 @@
   linux,
   scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19795";
-    sha256 = "1gcg9n5b2yyd3nhzf4v8xiy7xxnizmk33bwnp6c768vckxbzmhdh";
+    rev = "19812";
+    sha256 = "1bhkc0r5p3d4mmmi26k5lsk56jgbc8hi46bfih313hxmrnsd07dy";
   },
   ...
 }@args:
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index 570c7db2a285..a621d24576fd 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "5.4.290-rt96"; # updated by ./update-rt.sh
+  version = "5.4.293-rt98"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -22,7 +22,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-      sha256 = "0mm4q8f6kbqddy4zaxjf5xyqpnla5qprvsf7v3vq01gmlzr3rivc";
+      sha256 = "0b9p8l6ndm75751f7s03rnxg7yg9c4pj9rb537lhsv6pqx096n1l";
     };
 
     kernelPatches =
@@ -31,7 +31,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "1vcyz46n6yznbil5lqiqrn9vrdf0cpva7br9fj7lrr958yjv7101";
+            sha256 = "0vsb893cmc1rqrb2jqpc748748py2dc8nz8p5x3rh35ky8p3shss";
           };
         };
       in
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index ec5c1056188c..174be9aacc18 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -14,12 +14,12 @@ let
   # kernel config in the xanmod version commit
   variants = {
     lts = {
-      version = "6.12.28";
-      hash = "sha256-afmAC1tdiggI2qN1Kf9fJiUJqC9d8gzTj5PAg7wsiuw=";
+      version = "6.12.30";
+      hash = "sha256-OqO41rbb3nBegL+ZjgqR0RGwrka6oLv0QOYXJ8Wdpv8=";
     };
     main = {
-      version = "6.14.6";
-      hash = "sha256-wI383p+g03RrNUkPdo0TnB1n5yZI7bGwcSjB/9HpQH0=";
+      version = "6.14.8";
+      hash = "sha256-ap3NaM/pk+TWg3RBRxFJPwnfv2n042r47bo66jhj3ck=";
     };
   };
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/TTM-fbdev-emulation-for-Linux-6.13.patch b/pkgs/os-specific/linux/nvidia-x11/TTM-fbdev-emulation-for-Linux-6.13.patch
deleted file mode 100644
index 3376f8341b9f..000000000000
--- a/pkgs/os-specific/linux/nvidia-x11/TTM-fbdev-emulation-for-Linux-6.13.patch
+++ /dev/null
@@ -1,156 +0,0 @@
-From 88b8ae7642ef21e685d51148e8f57c3dfa1323ac Mon Sep 17 00:00:00 2001
-From: Bingwu Zhang <xtex@aosc.io>
-Date: Sat, 7 Dec 2024 23:56:43 +0800
-Subject: [PATCH 10/10] FROM AOSC: TTM fbdev emulation for Linux 6.13+
-
-Link: https://github.com/torvalds/linux/commit/1000634477d8d178179b1ad45d92e925fabe3deb
-Link: https://github.com/NVIDIA/open-gpu-kernel-modules/issues/749
-Signed-off-by: xtex <xtexchooser@duck.com>
-Signed-off-by: Eric Naim <dnaim@cachyos.org>
----
- kernel-open/nvidia-drm/nvidia-drm-drv.c       | 72 +++++++++++++++++++
- kernel-open/nvidia-drm/nvidia-drm-linux.c     |  4 ++
- .../nvidia-drm/nvidia-drm-os-interface.h      |  5 ++
- 3 files changed, 81 insertions(+)
-
-diff --git a/kernel-open/nvidia-drm/nvidia-drm-drv.c b/kernel-open/nvidia-drm/nvidia-drm-drv.c
-index 2e4f6404..ab85152f 100644
---- a/kernel-open/nvidia-drm/nvidia-drm-drv.c
-+++ b/kernel-open/nvidia-drm/nvidia-drm-drv.c
-@@ -1951,7 +1951,60 @@ void nv_drm_update_drm_driver_features(void)
- #endif /* NV_DRM_ATOMIC_MODESET_AVAILABLE */
- }
- 
-+#if !defined(NV_DRM_FBDEV_TTM_AVAILABLE) &&                                    \
-+    !defined(NV_DRM_FBDEV_GENERIC_AVAILABLE)
-+// AOSC OS: Workaround for Linux 6.13+
- 
-+static const struct drm_fb_helper_funcs nv_drm_fbdev_helper_funcs = {
-+    .fb_probe = drm_fbdev_ttm_driver_fbdev_probe,
-+};
-+
-+static void nv_drm_fbdev_client_unregister(struct drm_client_dev *client)
-+{
-+	struct drm_fb_helper *fb_helper = drm_fb_helper_from_client(client);
-+	if (fb_helper->info) {
-+		drm_fb_helper_unregister_info(fb_helper);
-+	} else {
-+		drm_client_release(&fb_helper->client);
-+		drm_fb_helper_unprepare(fb_helper);
-+		kfree(fb_helper);
-+	}
-+}
-+static int nv_drm_fbdev_client_restore(struct drm_client_dev *client)
-+{
-+	drm_fb_helper_lastclose(client->dev);
-+	return 0;
-+}
-+static int nv_drm_fbdev_client_hotplug(struct drm_client_dev *client)
-+{
-+	struct drm_fb_helper *fb_helper = drm_fb_helper_from_client(client);
-+	struct drm_device *dev = client->dev;
-+	int ret;
-+	if (dev->fb_helper)
-+		return drm_fb_helper_hotplug_event(dev->fb_helper);
-+	ret = drm_fb_helper_init(dev, fb_helper);
-+	if (ret)
-+		goto err_drm_err;
-+	if (!drm_drv_uses_atomic_modeset(dev))
-+		drm_helper_disable_unused_functions(dev);
-+	ret = drm_fb_helper_initial_config(fb_helper);
-+	if (ret)
-+		goto err_drm_fb_helper_fini;
-+	return 0;
-+err_drm_fb_helper_fini:
-+	drm_fb_helper_fini(fb_helper);
-+err_drm_err:
-+	drm_err(dev, "AOSC OS: NV-DRM: fbdev: Failed to setup emulation (ret=%d)\n", ret);
-+	return ret;
-+}
-+
-+static const struct drm_client_funcs nv_drm_fbdev_client_funcs = {
-+	.owner		= THIS_MODULE,
-+	.unregister	= nv_drm_fbdev_client_unregister,
-+	.restore	= nv_drm_fbdev_client_restore,
-+	.hotplug	= nv_drm_fbdev_client_hotplug,
-+};
-+#endif
- 
- /*
-  * Helper function for allocate/register DRM device for given NVIDIA GPU ID.
-@@ -1961,6 +2014,7 @@ void nv_drm_register_drm_device(const nv_gpu_info_t *gpu_info)
-     struct nv_drm_device *nv_dev = NULL;
-     struct drm_device *dev = NULL;
-     struct device *device = gpu_info->os_device_ptr;
-+    struct drm_fb_helper *fb_helper = NULL;
-     bool bus_is_pci;
- 
-     DRM_DEBUG(
-@@ -2039,6 +2093,20 @@ void nv_drm_register_drm_device(const nv_gpu_info_t *gpu_info)
-         drm_fbdev_ttm_setup(dev, 32);
-         #elif defined(NV_DRM_FBDEV_GENERIC_AVAILABLE)
-         drm_fbdev_generic_setup(dev, 32);
-+        #else
-+        // AOSC OS: Workaround for Linux 6.13+
-+        int drm_client_ret;
-+        fb_helper = kzalloc(sizeof(*fb_helper), GFP_KERNEL);
-+        if (!fb_helper)
-+            return;
-+        drm_fb_helper_prepare(dev, fb_helper, 32, &nv_drm_fbdev_helper_funcs);
-+        drm_client_ret = drm_client_init(dev, &fb_helper->client, "fbdev",
-+                                         &nv_drm_fbdev_client_funcs);
-+        if (drm_client_ret) {
-+            drm_err(dev, "AOSC OS: NV-DRM: Failed to register DRM client: %d\n", drm_client_ret);
-+            goto failed_drm_client_init;
-+        }
-+        drm_client_register(&fb_helper->client);
-         #endif
-     }
- #endif /* defined(NV_DRM_FBDEV_AVAILABLE) */
-@@ -2050,6 +2118,10 @@ void nv_drm_register_drm_device(const nv_gpu_info_t *gpu_info)
- 
-     return; /* Success */
- 
-+failed_drm_client_init:
-+    drm_fb_helper_unprepare(fb_helper);
-+    kfree(fb_helper);
-+
- failed_drm_register:
- 
-     nv_drm_dev_free(dev);
-diff --git a/kernel-open/nvidia-drm/nvidia-drm-linux.c b/kernel-open/nvidia-drm/nvidia-drm-linux.c
-index 83d40983..ac4fe967 100644
---- a/kernel-open/nvidia-drm/nvidia-drm-linux.c
-+++ b/kernel-open/nvidia-drm/nvidia-drm-linux.c
-@@ -39,8 +39,12 @@ MODULE_PARM_DESC(
-     fbdev,
-     "Create a framebuffer device (1 = enable (default), 0 = disable) (EXPERIMENTAL)");
- module_param_named(fbdev, nv_drm_fbdev_module_param, bool, 0400);
-+#else
-+#error "nvidia-drm fbdev should always be available."
- #endif
- 
-+#else
-+#error "nvidia-drm is not available"
- #endif /* NV_DRM_AVAILABLE */
- 
- /*************************************************************************
-diff --git a/kernel-open/nvidia-drm/nvidia-drm-os-interface.h b/kernel-open/nvidia-drm/nvidia-drm-os-interface.h
-index 71ca5f22..8195af32 100644
---- a/kernel-open/nvidia-drm/nvidia-drm-os-interface.h
-+++ b/kernel-open/nvidia-drm/nvidia-drm-os-interface.h
-@@ -78,6 +78,11 @@ typedef struct nv_timer nv_drm_timer;
- #define NV_DRM_FBDEV_TTM_AVAILABLE
- #endif
- 
-+// AOSC OS: Always enable DRM fbdev
-+// FIXME: Add config test for drm helper functions.
-+// The implementation uses drm_client_register, which is added in v5.2-rc1.
-+#define NV_DRM_FBDEV_AVAILABLE
-+
- struct page;
- 
- /* Set to true when the atomic modeset feature is enabled. */
--- 
-2.47.1
-
diff --git a/pkgs/os-specific/linux/nvidia-x11/Use-linux-aperture.c-for-removing-conflict.patch b/pkgs/os-specific/linux/nvidia-x11/Use-linux-aperture.c-for-removing-conflict.patch
deleted file mode 100644
index ecff6a2bb0ce..000000000000
--- a/pkgs/os-specific/linux/nvidia-x11/Use-linux-aperture.c-for-removing-conflict.patch
+++ /dev/null
@@ -1,146 +0,0 @@
-From 11501d99348a04c608a19330d984188f4766e603 Mon Sep 17 00:00:00 2001
-From: Bingwu Zhang <xtex@aosc.io>
-Date: Sat, 7 Dec 2024 23:01:26 +0800
-Subject: [PATCH 09/10] FROM AOSC: Use linux/aperture.c for removing
- conflicting PCI devices on Linux 6.13.0-rc1+
-
-Link: https://github.com/torvalds/linux/commit/689274a56c0c088796d359f6c6267323931a2429
-Link: https://github.com/torvalds/linux/commit/7283f862bd991c8657e9bf1c02db772fcf018f13
-Link: https://github.com/NVIDIA/open-gpu-kernel-modules/issues/749
-Signed-off-by: Eric Naim <dnaim@cachyos.org>
----
- kernel-open/conftest.sh                       | 19 +++++++++++++++++++
- kernel-open/header-presence-tests.mk          |  1 +
- kernel-open/nvidia-drm/nvidia-drm-drv.c       | 15 +++++++++++++++
- .../nvidia-drm/nvidia-drm-os-interface.h      | 10 ++++++++++
- kernel-open/nvidia-drm/nvidia-drm-sources.mk  |  1 +
- 5 files changed, 46 insertions(+)
-
-diff --git a/kernel-open/conftest.sh b/kernel-open/conftest.sh
-index fdceda72..5a0f39e0 100755
---- a/kernel-open/conftest.sh
-+++ b/kernel-open/conftest.sh
-@@ -6615,6 +6615,8 @@ compile_test() {
-             # Added by commit 2916059147ea ("drm/aperture: Add infrastructure
-             # for aperture ownership") in v5.14.
-             #
-+            # Removed by commit 689274a56c0c ("drm: Remove DRM aperture helpers") in v6.13.
-+            #
-             CODE="
-             #if defined(NV_DRM_DRM_APERTURE_H_PRESENT)
-             #include <drm/drm_aperture.h>
-@@ -6626,6 +6628,23 @@ compile_test() {
-             compile_check_conftest "$CODE" "NV_DRM_APERTURE_REMOVE_CONFLICTING_PCI_FRAMEBUFFERS_PRESENT" "" "functions"
-         ;;
- 
-+        aperture_remove_conflicting_pci_devices)
-+            #
-+            # Determine whether aperture_remove_conflicting_pci_devices is present.
-+            #
-+            # Added by commit 7283f862bd99 ("drm: Implement DRM aperture helpers under video/") in v6.0.
-+            #
-+            CODE="
-+            #if defined(NV_LINUX_APERTURE_H_PRESENT)
-+            #include <linux/aperture.h>
-+            #endif
-+            void conftest_aperture_remove_conflicting_pci_devices(void) {
-+                aperture_remove_conflicting_pci_devices();
-+            }"
-+
-+            compile_check_conftest "$CODE" "NV_APERTURE_REMOVE_CONFLICTING_PCI_DEVICES_PRESENT" "" "functions"
-+        ;;
-+
-         drm_aperture_remove_conflicting_pci_framebuffers_has_driver_arg)
-             #
-             # Determine whether drm_aperture_remove_conflicting_pci_framebuffers
-diff --git a/kernel-open/header-presence-tests.mk b/kernel-open/header-presence-tests.mk
-index 9d5217a9..b0268541 100644
---- a/kernel-open/header-presence-tests.mk
-+++ b/kernel-open/header-presence-tests.mk
-@@ -34,6 +34,7 @@ NV_HEADER_PRESENCE_TESTS = \
-   generated/autoconf.h \
-   generated/compile.h \
-   generated/utsrelease.h \
-+  linux/aperture.h \
-   linux/efi.h \
-   linux/kconfig.h \
-   linux/platform/tegra/mc_utils.h \
-diff --git a/kernel-open/nvidia-drm/nvidia-drm-drv.c b/kernel-open/nvidia-drm/nvidia-drm-drv.c
-index 8f905f82..2e4f6404 100644
---- a/kernel-open/nvidia-drm/nvidia-drm-drv.c
-+++ b/kernel-open/nvidia-drm/nvidia-drm-drv.c
-@@ -65,7 +65,16 @@
- #endif
- 
- #if defined(NV_DRM_FBDEV_AVAILABLE)
-+// Commit 7283f862bd99 ("drm: Implement DRM aperture helpers under video/")
-+//  moved implementation of drm_aperture_... to linux/aperture.c.
-+// Commit 689274a56c0c ("drm: Remove DRM aperture helpers")
-+//  removed drm/drm_aperture.h.
-+#if defined(NV_DRM_APERTURE_REMOVE_CONFLICTING_PCI_FRAMEBUFFERS_PRESENT)
- #include <drm/drm_aperture.h>
-+#endif
-+#if defined(NV_APERTURE_REMOVE_CONFLICTING_PCI_DEVICES_PRESENT)
-+#include <linux/aperture.h>
-+#endif
- #include <drm/drm_fb_helper.h>
- #endif
- 
-@@ -2013,10 +2022,16 @@ void nv_drm_register_drm_device(const nv_gpu_info_t *gpu_info)
-         if (bus_is_pci) {
-             struct pci_dev *pdev = to_pci_dev(device);
- 
-+#if defined(NV_DRM_APERTURE_REMOVE_CONFLICTING_PCI_FRAMEBUFFERS_PRESENT)
-+            printk(KERN_INFO "%s: using drm_aperture for old kernels\n", nv_drm_driver.name);
- #if defined(NV_DRM_APERTURE_REMOVE_CONFLICTING_PCI_FRAMEBUFFERS_HAS_DRIVER_ARG)
-             drm_aperture_remove_conflicting_pci_framebuffers(pdev, &nv_drm_driver);
- #else
-             drm_aperture_remove_conflicting_pci_framebuffers(pdev, nv_drm_driver.name);
-+#endif
-+#elif defined(NV_APERTURE_REMOVE_CONFLICTING_PCI_DEVICES_PRESENT)
-+            printk(KERN_INFO "%s: using linux/aperture workaround for Linux 6.13+\n", nv_drm_driver.name);
-+            aperture_remove_conflicting_pci_devices(pdev, nv_drm_driver.name);
- #endif
-             nvKms->framebufferConsoleDisabled(nv_dev->pDevice);
-         }
-diff --git a/kernel-open/nvidia-drm/nvidia-drm-os-interface.h b/kernel-open/nvidia-drm/nvidia-drm-os-interface.h
-index a6b0f947..71ca5f22 100644
---- a/kernel-open/nvidia-drm/nvidia-drm-os-interface.h
-+++ b/kernel-open/nvidia-drm/nvidia-drm-os-interface.h
-@@ -63,11 +63,21 @@ typedef struct nv_timer nv_drm_timer;
- #define NV_DRM_FBDEV_GENERIC_AVAILABLE
- #endif
- 
-+#if defined(NV_DRM_FBDEV_GENERIC_SETUP_PRESENT) && defined(NV_APERTURE_REMOVE_CONFLICTING_PCI_DEVICES_PRESENT)
-+#define NV_DRM_FBDEV_AVAILABLE
-+#define NV_DRM_FBDEV_GENERIC_AVAILABLE
-+#endif
-+
- #if defined(NV_DRM_FBDEV_TTM_SETUP_PRESENT) && defined(NV_DRM_APERTURE_REMOVE_CONFLICTING_PCI_FRAMEBUFFERS_PRESENT)
- #define NV_DRM_FBDEV_AVAILABLE
- #define NV_DRM_FBDEV_TTM_AVAILABLE
- #endif
- 
-+#if defined(NV_DRM_FBDEV_TTM_SETUP_PRESENT) && defined(NV_APERTURE_REMOVE_CONFLICTING_PCI_DEVICES_PRESENT)
-+#define NV_DRM_FBDEV_AVAILABLE
-+#define NV_DRM_FBDEV_TTM_AVAILABLE
-+#endif
-+
- struct page;
- 
- /* Set to true when the atomic modeset feature is enabled. */
-diff --git a/kernel-open/nvidia-drm/nvidia-drm-sources.mk b/kernel-open/nvidia-drm/nvidia-drm-sources.mk
-index 9aaebd04..a4dcad6d 100644
---- a/kernel-open/nvidia-drm/nvidia-drm-sources.mk
-+++ b/kernel-open/nvidia-drm/nvidia-drm-sources.mk
-@@ -66,6 +66,7 @@ NV_CONFTEST_FUNCTION_COMPILE_TESTS += dma_fence_set_error
- NV_CONFTEST_FUNCTION_COMPILE_TESTS += fence_set_error
- NV_CONFTEST_FUNCTION_COMPILE_TESTS += sync_file_get_fence
- NV_CONFTEST_FUNCTION_COMPILE_TESTS += drm_aperture_remove_conflicting_pci_framebuffers
-+NV_CONFTEST_FUNCTION_COMPILE_TESTS += aperture_remove_conflicting_pci_devices
- NV_CONFTEST_FUNCTION_COMPILE_TESTS += drm_fbdev_generic_setup
- NV_CONFTEST_FUNCTION_COMPILE_TESTS += drm_fbdev_ttm_setup
- NV_CONFTEST_FUNCTION_COMPILE_TESTS += drm_connector_attach_hdr_output_metadata_property
--- 
-2.47.1
-
diff --git a/pkgs/os-specific/linux/nvidia-x11/crypto-Add-fix-for-6.13-Module-compilation.patch b/pkgs/os-specific/linux/nvidia-x11/crypto-Add-fix-for-6.13-Module-compilation.patch
deleted file mode 100644
index 1fc6063740b7..000000000000
--- a/pkgs/os-specific/linux/nvidia-x11/crypto-Add-fix-for-6.13-Module-compilation.patch
+++ /dev/null
@@ -1,251 +0,0 @@
-diff --git a/kernel-open/conftest.sh b/kernel-open/conftest.sh
-index fdceda72..3bfe39aa 100755
---- a/kernel-open/conftest.sh
-+++ b/kernel-open/conftest.sh
-@@ -6721,6 +6721,47 @@ compile_test() {
-             compile_check_conftest "$CODE" "NV_CRYPTO_PRESENT" "" "symbols"
-         ;;
- 
-+        crypto_akcipher_verify)
-+            #
-+            # Determine whether the crypto_akcipher_verify API is still present.
-+            # It was removed by commit 6b34562 ('crypto: akcipher - Drop sign/verify operations')
-+            # in v6.13-rc1 (2024-10-04).
-+            #
-+            # This test is dependent on the crypto conftest to determine whether crypto should be
-+            # enabled at all. That means that if the kernel is old enough such that crypto_akcipher_verify
-+            #
-+            # The test merely checks for the presence of the API, as it assumes that if the API
-+            # is no longer present, the new API to replace it (crypto_sig_verify) must be present.
-+            # If the kernel version is too old to have crypto_akcipher_verify, it will fail the crypto
-+            # conftest above and all crypto code will be compiled out.
-+            #
-+            CODE="
-+            #include <crypto/akcipher.h>
-+            #include <linux/crypto.h>
-+            void conftest_crypto_akcipher_verify(void) {
-+                (void)crypto_akcipher_verify;
-+            }"
-+
-+            compile_check_conftest "$CODE" "NV_CRYPTO_AKCIPHER_VERIFY_PRESENT" "" "symbols"
-+            ;;
-+
-+        ecc_digits_from_bytes)
-+            #
-+            # Determine whether ecc_digits_from_bytes is present.
-+            # It was added in commit c6ab5c915da4 ('crypto: ecc - Prevent ecc_digits_from_bytes from
-+            # reading too many bytes') in v6.10.
-+            #
-+            # This functionality is needed when crypto_akcipher_verify is not present.
-+            #
-+            CODE="
-+            #include <crypto/internal/ecc.h>
-+            void conftest_ecc_digits_from_bytes(void) {
-+                (void)ecc_digits_from_bytes;
-+            }"
-+
-+            compile_check_conftest "$CODE" "NV_ECC_DIGITS_FROM_BYTES_PRESENT" "" "symbols"
-+        ;;
-+
-         mempolicy_has_unified_nodes)
-             #
-             # Determine if the 'mempolicy' structure has
-diff --git a/kernel-open/nvidia/internal_crypt_lib.h b/kernel-open/nvidia/internal_crypt_lib.h
-index 2eac7d5e..917acb26 100644
---- a/kernel-open/nvidia/internal_crypt_lib.h
-+++ b/kernel-open/nvidia/internal_crypt_lib.h
-@@ -64,7 +64,9 @@
-  * old or even just user disabled. If we should use LKCA, include headers, else
-  * define stubs to return errors.
-  */
--#if defined(NV_CRYPTO_PRESENT) && defined (NV_CONFIG_CRYPTO_PRESENT)
-+#if defined(NV_CRYPTO_PRESENT) && defined (NV_CONFIG_CRYPTO_PRESENT) && \
-+    (defined(NV_CRYPTO_AKCIPHER_VERIFY_PRESENT) || \
-+     (defined(NV_CRYPTO_SIG_H_PRESENT) && defined(NV_ECC_DIGITS_FROM_BYTES_PRESENT)))
- #define USE_LKCA 1
- #endif
- 
-diff --git a/kernel-open/nvidia/libspdm_ecc.c b/kernel-open/nvidia/libspdm_ecc.c
-index 1f8f0100..a9eb4db5 100644
---- a/kernel-open/nvidia/libspdm_ecc.c
-+++ b/kernel-open/nvidia/libspdm_ecc.c
-@@ -30,14 +30,26 @@ MODULE_SOFTDEP("pre: ecdh_generic,ecdsa_generic");
- #include <crypto/akcipher.h>
- #include <crypto/ecdh.h>
- #include <crypto/internal/ecc.h>
-+#ifndef NV_CRYPTO_AKCIPHER_VERIFY_PRESENT
-+#include <crypto/sig.h>
-+
-+struct signature
-+{
-+    u64 r[ECC_MAX_DIGITS];
-+    u64 s[ECC_MAX_DIGITS];
-+};
-+#endif // NV_CRYPTO_AKCIPHER_VERIFY_PRESENT
-+
-+#define ECDSA_PUBKEY_HEADER_XY_PRESENT (0x4)
- 
- struct ecc_ctx {
-     unsigned int curve_id;
-     u64 priv_key[ECC_MAX_DIGITS]; // In big endian
- 
-     struct {
--        // ecdsa wants byte preceding pub_key to be set to '4'
--        u64 pub_key_prefix;
-+        // ecdsa pubkey has header indicating length of pubkey
-+        u8  padding[7];
-+        u8  pub_key_prefix;
-         u64 pub_key[2 * ECC_MAX_DIGITS];
-     };
- 
-@@ -221,25 +233,84 @@ bool lkca_ec_compute_key(void *ec_context, const uint8_t *peer_public,
- #endif
- }
- 
--bool lkca_ecdsa_verify(void *ec_context, size_t hash_nid,
--                       const uint8_t *message_hash, size_t hash_size,
--                       const uint8_t *signature, size_t sig_size)
-+#ifndef NV_CRYPTO_AKCIPHER_VERIFY_PRESENT
-+static bool lkca_ecdsa_verify_crypto_sig(void *ec_context, size_t hash_nid,
-+                                         const uint8_t *message_hash, size_t hash_size,
-+                                         const uint8_t *signature, size_t sig_size)
- {
- #ifndef USE_LKCA
-     return false;
- #else
-     struct ecc_ctx *ctx = ec_context;
-+    u8 *pub_key;
-+    int err;
-+    DECLARE_CRYPTO_WAIT(wait);
-+    struct crypto_sig * tfm = NULL;
-+    struct signature sig;
-+
-+    if (sig_size != ctx->size || !ctx->pub_key_set)
-+    {
-+        return false;
-+    }
-+
-+    tfm = crypto_alloc_sig(ctx->name, CRYPTO_ALG_TYPE_SIG, 0);
-+    if (IS_ERR(tfm)) {
-+        pr_info("crypto_alloc_sig failed in lkca_ecdsa_verify\n");
-+        return false;
-+    }
-+
-+    // modify header of pubkey to indicate size
-+    pub_key = (u8 *) &(ctx->pub_key_prefix);
-+    *pub_key = ECDSA_PUBKEY_HEADER_XY_PRESENT;
-+    err = crypto_sig_set_pubkey(tfm, pub_key, ctx->size + 1);
-+    if (err != 0)
-+    {
-+        pr_info("crypto_sig_set_pubkey failed in lkca_ecdsa_verify: %d", -err);
-+        goto failTfm;
-+    }
-+
-+    //
-+    // Compared to the way we receive the signature, we need to:
-+    // - swap order of all digits
-+    // - swap endianness for each digit
-+    //
-+    memset(&sig, 0, sizeof(sig));
-+    ecc_digits_from_bytes(signature, ctx->size/2, sig.r, ECC_MAX_DIGITS);
-+    ecc_digits_from_bytes(signature + ctx->size/2, ctx->size/2, sig.s, ECC_MAX_DIGITS);
-+
-+    err = crypto_sig_verify(tfm, (void *)&sig, sizeof(sig), message_hash, hash_size);
-+    if (err != 0)
-+    {
-+        pr_info("crypto_sig_verify failed in lkca_ecdsa_verify %d\n", -err);
-+    }
-+
-+failTfm:
-+    crypto_free_sig(tfm);
-+
-+    return err == 0;
-+#endif // USE_LKCA
-+}
-+
-+#else // NV_CRYPTO_AKCIPHER_VERIFY_PRESENT
-+static bool lkca_ecdsa_verify_akcipher(void *ec_context, size_t hash_nid,
-+                                       const uint8_t *message_hash, size_t hash_size,
-+                                       const uint8_t *signature, size_t sig_size)
-+{
-+#ifndef USE_LKCA
-+    return false;
-+#else // USE_LKCA
-+    struct ecc_ctx *ctx = ec_context;
-+    u8 *pub_key;
-+    int err;
-+    DECLARE_CRYPTO_WAIT(wait);
- 
-     // Roundabout way
-     u64 ber_max_len = 3 + 2 * (4 + (ECC_MAX_BYTES));
-     u64 ber_len = 0;
-     u8 *ber = NULL;
--    u8 *pub_key;
-     struct akcipher_request *req = NULL;
-     struct crypto_akcipher *tfm = NULL;
-     struct scatterlist sg;
--    DECLARE_CRYPTO_WAIT(wait);
--    int err;
- 
-     if (sig_size != ctx->size) {
-         return false;
-@@ -251,21 +322,21 @@ bool lkca_ecdsa_verify(void *ec_context, size_t hash_nid,
- 
-     tfm = crypto_alloc_akcipher(ctx->name, CRYPTO_ALG_TYPE_AKCIPHER, 0);
-     if (IS_ERR(tfm)) {
--        pr_info("ALLOC FAILED\n");
-+        pr_info("crypto_alloc_akcipher failed in lkca_ecdsa_verify\n");
-         return false;
-     }
- 
--    pub_key = (u8 *) ctx->pub_key;
--    pub_key--; // Go back into byte of pub_key_prefix
--    *pub_key = 4; // And set it to 4 to placate kernel
-+    // modify header of pubkey to indicate size
-+    pub_key = (u8 *) &(ctx->pub_key_prefix);
-+    *pub_key = ECDSA_PUBKEY_HEADER_XY_PRESENT;
-     if ((err = crypto_akcipher_set_pub_key(tfm, pub_key, ctx->size + 1)) != 0) {
--        pr_info("SET PUB KEY FAILED: %d\n", -err);
-+        pr_info("crypto_akcipher_set_pub_key failed in lkca_ecdsa_verify: %d\n", -err);
-         goto failTfm;
-     }
- 
-     req = akcipher_request_alloc(tfm, GFP_KERNEL);
-     if (IS_ERR(req)) {
--        pr_info("REQUEST ALLOC FAILED\n");
-+        pr_info("akcipher_request_alloc failed in lkca_ecdsa_verify\n");
-         goto failTfm;
-     }
- 
-@@ -310,9 +381,8 @@ bool lkca_ecdsa_verify(void *ec_context, size_t hash_nid,
-                                   CRYPTO_TFM_REQ_MAY_SLEEP, crypto_req_done, &wait);
-     akcipher_request_set_crypt(req, &sg, NULL, ber_len, hash_size);
-     err = crypto_wait_req(crypto_akcipher_verify(req), &wait);
--
-     if (err != 0){
--        pr_info("Verify FAILED %d\n", -err);
-+        pr_info("crypto_akcipher_verify failed in lkca_ecdsa_verify %d\n", -err);
-     }
- 
-     kfree(ber);
-@@ -322,5 +392,19 @@ failTfm:
-     crypto_free_akcipher(tfm);
- 
-     return err == 0;
--#endif
-+#endif // USE_LKCA
-+}
-+#endif // NV_CRYPTO_AKCIPHER_VERIFY_PRESENT
-+
-+bool lkca_ecdsa_verify(void *ec_context, size_t hash_nid,
-+                       const uint8_t *message_hash, size_t hash_size,
-+                       const uint8_t *signature, size_t sig_size)
-+{
-+#ifndef NV_CRYPTO_AKCIPHER_VERIFY_PRESENT
-+    return lkca_ecdsa_verify_crypto_sig(ec_context, hash_nid, message_hash, hash_size,
-+                                        signature, sig_size);
-+#else // NV_CRYPTO_AKCIPHER_VERIFY_PRESENT
-+    return lkca_ecdsa_verify_akcipher(ec_context, hash_nid, message_hash, hash_size,
-+                                      signature, sig_size);
-+#endif // NV_CRYPTO_AKCIPHER_VERIFY_PRESENT
- }
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 5c8fca50ea56..8064396631b4 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -53,6 +53,14 @@ let
     rev = "94dffc01e23a93c354a765ea7ac64484a3ef96c1";
     hash = "sha256-c94qXNZyMrSf7Dik7jvz2ECaGELqN7WEYNpnbUkzeeU=";
   };
+
+  # https://github.com/NVIDIA/open-gpu-kernel-modules/issues/840
+  gpl_symbols_linux_615_patch = fetchpatch {
+    url = "https://github.com/CachyOS/kernel-patches/raw/914aea4298e3744beddad09f3d2773d71839b182/6.15/misc/nvidia/0003-Workaround-nv_vm_flags_-calling-GPL-only-code.patch";
+    hash = "sha256-YOTAvONchPPSVDP9eJ9236pAPtxYK5nAePNtm2dlvb4=";
+    stripLen = 1;
+    extraPrefix = "kernel/";
+  };
 in
 rec {
   mkDriver = generic;
@@ -70,24 +78,19 @@ rec {
     openSha256 = "sha256-2DpY3rgQjYFuPfTY4U/5TcrvNqsWWnsOSX0f2TfVgTs=";
     settingsSha256 = "sha256-5m6caud68Owy4WNqxlIQPXgEmbTe4kZV2vZyTWHWe+M=";
     persistencedSha256 = "sha256-OSo4Od7NmezRdGm7BLLzYseWABwNGdsomBCkOsNvOxA=";
+
+    patches = [ gpl_symbols_linux_615_patch ];
   };
 
   latest = selectHighestVersion production (generic {
-    version = "565.77";
-    sha256_64bit = "sha256-CnqnQsRrzzTXZpgkAtF7PbH9s7wbiTRNcM0SPByzFHw=";
-    sha256_aarch64 = "sha256-LSAYUnhfnK3rcuPe1dixOwAujSof19kNOfdRHE7bToE=";
-    openSha256 = "sha256-Fxo0t61KQDs71YA8u7arY+503wkAc1foaa51vi2Pl5I=";
-    settingsSha256 = "sha256-VUetj3LlOSz/LB+DDfMCN34uA4bNTTpjDrb6C6Iwukk=";
-    persistencedSha256 = "sha256-wnDjC099D8d9NJSp9D0CbsL+vfHXyJFYYgU3CwcqKww=";
-    patches = [
-      ./fix-for-linux-6.13.patch
-    ];
-    patchesOpen = [
-      ./nvidia-nv-Convert-symbol-namespace-to-string-literal.patch
-      ./crypto-Add-fix-for-6.13-Module-compilation.patch
-      ./Use-linux-aperture.c-for-removing-conflict.patch
-      ./TTM-fbdev-emulation-for-Linux-6.13.patch
-    ];
+    version = "575.57.08";
+    sha256_64bit = "sha256-KqcB2sGAp7IKbleMzNkB3tjUTlfWBYDwj50o3R//xvI=";
+    sha256_aarch64 = "sha256-VJ5z5PdAL2YnXuZltuOirl179XKWt0O4JNcT8gUgO98=";
+    openSha256 = "sha256-DOJw73sjhQoy+5R0GHGnUddE6xaXb/z/Ihq3BKBf+lg=";
+    settingsSha256 = "sha256-AIeeDXFEo9VEKCgXnY3QvrW5iWZeIVg4LBCeRtMs5Io=";
+    persistencedSha256 = "sha256-Len7Va4HYp5r3wMpAhL4VsPu5S0JOshPFywbO7vYnGo=";
+
+    patches = [ gpl_symbols_linux_615_patch ];
   });
 
   beta = selectHighestVersion latest (generic {
diff --git a/pkgs/os-specific/linux/nvidia-x11/fix-for-linux-6.13.patch b/pkgs/os-specific/linux/nvidia-x11/fix-for-linux-6.13.patch
deleted file mode 100644
index 2d3d88065af6..000000000000
--- a/pkgs/os-specific/linux/nvidia-x11/fix-for-linux-6.13.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff --git a/kernel/nvidia-modeset/nvidia-modeset.Kbuild b/kernel/nvidia-modeset/nvidia-modeset.Kbuild
-index a7d84e0..d417c28 100644
---- a/kernel/nvidia-modeset/nvidia-modeset.Kbuild
-+++ b/kernel/nvidia-modeset/nvidia-modeset.Kbuild
-@@ -40,13 +40,15 @@ NV_KERNEL_MODULE_TARGETS += $(NVIDIA_MODESET_KO)
- NVIDIA_MODESET_BINARY_OBJECT := $(src)/nvidia-modeset/nv-modeset-kernel.o_binary
- NVIDIA_MODESET_BINARY_OBJECT_O := nvidia-modeset/nv-modeset-kernel.o
- 
--quiet_cmd_symlink = SYMLINK $@
--cmd_symlink = ln -sf $< $@
-+# Rel. commit 80f289101690 "kbuild: change working directory to external module directory with M=" (Masahiro Yamada, 10 Nov 2024)
-+# Ensure `$<` is absolute, since the link target is resolved relative to its path, not from where `ln` is run from.
-+quiet_cmd_symlinkabs = SYMLINK $@
-+ cmd_symlinkabs = ln -sf $(abspath $<) $@
- 
- targets += $(NVIDIA_MODESET_BINARY_OBJECT_O)
- 
- $(obj)/$(NVIDIA_MODESET_BINARY_OBJECT_O): $(NVIDIA_MODESET_BINARY_OBJECT) FORCE
--	$(call if_changed,symlink)
-+	$(call if_changed,symlinkabs)
- 
- nvidia-modeset-y += $(NVIDIA_MODESET_BINARY_OBJECT_O)
- 
-diff --git a/kernel/nvidia/nvidia.Kbuild b/kernel/nvidia/nvidia.Kbuild
-index 31a6f92..62689f6 100644
---- a/kernel/nvidia/nvidia.Kbuild
-+++ b/kernel/nvidia/nvidia.Kbuild
-@@ -40,13 +40,15 @@ NVIDIA_KO = nvidia/nvidia.ko
- NVIDIA_BINARY_OBJECT := $(src)/nvidia/nv-kernel.o_binary
- NVIDIA_BINARY_OBJECT_O := nvidia/nv-kernel.o
- 
--quiet_cmd_symlink = SYMLINK $@
-- cmd_symlink = ln -sf $< $@
-+# Rel. commit 80f289101690 "kbuild: change working directory to external module directory with M=" (Masahiro Yamada, 10 Nov 2024)
-+# Ensure `$<` is absolute, since the link target is resolved relative to its path, not from where `ln` is run from.
-+quiet_cmd_symlinkabs = SYMLINK $@
-+ cmd_symlinkabs = ln -sf $(abspath $<) $@
- 
- targets += $(NVIDIA_BINARY_OBJECT_O)
- 
- $(obj)/$(NVIDIA_BINARY_OBJECT_O): $(NVIDIA_BINARY_OBJECT) FORCE
--	$(call if_changed,symlink)
-+	$(call if_changed,symlinkabs)
- 
- nvidia-y += $(NVIDIA_BINARY_OBJECT_O)
- 
--- 
-2.47.0
diff --git a/pkgs/os-specific/linux/nvidia-x11/nvidia-nv-Convert-symbol-namespace-to-string-literal.patch b/pkgs/os-specific/linux/nvidia-x11/nvidia-nv-Convert-symbol-namespace-to-string-literal.patch
deleted file mode 100644
index 98d17e8834e8..000000000000
--- a/pkgs/os-specific/linux/nvidia-x11/nvidia-nv-Convert-symbol-namespace-to-string-literal.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 35a25dda24d8f02ca89d53e5975fa7705058c39e Mon Sep 17 00:00:00 2001
-From: Eric Naim <dnaim@cachyos.org>
-Date: Mon, 9 Dec 2024 19:45:50 +0800
-Subject: [PATCH 07/10] nvidia/nv: Convert symbol namespace to string literal
-
-Commit https://github.com/torvalds/linux/commit/cdd30ebb1b9f36159d66f088b61aee264e649d7a ("module: Convert symbol namespace to string literal")
-breaks importing symbol namespaces. Apply this change only for 6.13 and higher.
-
-Signed-off-by: Eric Naim <dnaim@cachyos.org>
----
- kernel-open/nvidia/nv.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/kernel-open/nvidia/nv.c b/kernel-open/nvidia/nv.c
-index 83705a05..1e7de9ea 100644
---- a/kernel-open/nvidia/nv.c
-+++ b/kernel-open/nvidia/nv.c
-@@ -22,6 +22,7 @@
-  */
- 
- #include <linux/module.h>  // for MODULE_FIRMWARE
-+#include <linux/version.h>
- 
- // must precede "nv.h" and "nv-firmware.h" includes
- #define NV_FIRMWARE_FOR_NAME(name)  "nvidia/" NV_VERSION_STRING "/" name ".bin"
-@@ -127,7 +128,11 @@ MODULE_ALIAS_CHARDEV_MAJOR(NV_MAJOR_DEVICE_NUMBER);
-  * DMA_BUF namespace is added by commit id 16b0314aa746
-  * ("dma-buf: move dma-buf symbols into the DMA_BUF module namespace") in 5.16
-  */
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0)
-+MODULE_IMPORT_NS("DMA_BUF");
-+#else
- MODULE_IMPORT_NS(DMA_BUF);
-+#endif
- #endif  // defined(MODULE_IMPORT_NS)
- 
- const NvBool nv_is_rm_firmware_supported_os = NV_TRUE;
--- 
-2.47.1
-
diff --git a/pkgs/os-specific/linux/v4l2loopback/default.nix b/pkgs/os-specific/linux/v4l2loopback/default.nix
index f119c5c1ad24..f1b0d4ba1a53 100644
--- a/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "0.13.2";
+  version = "0.15.0";
 
 in
 stdenv.mkDerivation {
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
     owner = "umlaeute";
     repo = "v4l2loopback";
     rev = "v${version}";
-    hash = "sha256-rcwgOXnhRPTmNKUppupfe/2qNUBDUqVb3TeDbrP5pnU=";
+    hash = "sha256-fa3f8GDoQTkPppAysrkA7kHuU5z2P2pqI8dKhuKYh04=";
   };
 
   hardeningDisable = [
diff --git a/pkgs/os-specific/linux/xone/default.nix b/pkgs/os-specific/linux/xone/default.nix
index 2d25ba6cdb67..0a53277ff9bf 100644
--- a/pkgs/os-specific/linux/xone/default.nix
+++ b/pkgs/os-specific/linux/xone/default.nix
@@ -4,16 +4,15 @@
   fetchFromGitHub,
   kernel,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "xone";
-  version = "0.3-unstable-2024-12-23";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "dlundqvist";
     repo = "xone";
-    rev = "6b9d59aed71f6de543c481c33df4705d4a590a31";
-    hash = "sha256-MpxP2cb0KEPKaarjfX/yCbkxIFTwwEwVpTMhFcis+A4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qMZlQgAe5vB5zfuhyK7EBxIwfhnC5MvnF/qr3BGnDms=";
   };
 
   setSourceRoot = ''
@@ -43,6 +42,6 @@ stdenv.mkDerivation (finalAttrs: {
       fazzi
     ];
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "5.11";
+    broken = kernel.kernelOlder "6";
   };
 })
diff --git a/pkgs/servers/authelia/sources.nix b/pkgs/servers/authelia/sources.nix
index 61a553705af0..a12804d8abfc 100644
--- a/pkgs/servers/authelia/sources.nix
+++ b/pkgs/servers/authelia/sources.nix
@@ -1,14 +1,14 @@
 { fetchFromGitHub }:
 rec {
   pname = "authelia";
-  version = "4.39.3";
+  version = "4.39.4";
 
   src = fetchFromGitHub {
     owner = "authelia";
     repo = "authelia";
     rev = "v${version}";
-    hash = "sha256-HBkHN7c8O07b2ZI6R7KFvdBF5GWuYU6rmisxLMSH5EQ=";
+    hash = "sha256-OIf7Q84uWk2q+lTBQNHHO11QEl7FBGv2uNx+g2GNHE0=";
   };
-  vendorHash = "sha256-2wJvX6jAjU9iaFMIcC5Qm1agRMPv4fFfsCeTkvXSpYs=";
-  pnpmDepsHash = "sha256-uy6uKfZpsFEl2n6zOriRsKwlw3av1f0xBF/CwhWLJMU=";
+  vendorHash = "sha256-Vndkts5e3NSdtTk3rVZSjfuGuafQ3eswoSLLFspXTIw=";
+  pnpmDepsHash = "sha256-hA9STLJbFw5pFHx2Wi3X6JFsTvHzCMFVS3HEJApQ9zM=";
 }
diff --git a/pkgs/servers/monitoring/icinga2/default.nix b/pkgs/servers/monitoring/icinga2/default.nix
index 2c50c42bf9e0..4122049490e5 100644
--- a/pkgs/servers/monitoring/icinga2/default.nix
+++ b/pkgs/servers/monitoring/icinga2/default.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "icinga2${nameSuffix}";
-  version = "2.14.5";
+  version = "2.14.6";
 
   src = fetchFromGitHub {
     owner = "icinga";
     repo = "icinga2";
     rev = "v${version}";
-    hash = "sha256-5FQIcOvuq1GHX80rYuZ3jCM3CF9Fq1149nvlO1njqfA=";
+    hash = "sha256-/6w4AOfPQXjwrAUrioN4Macg8r/8Ap92nO8CGmz6VRk=";
   };
 
   patches = [
diff --git a/pkgs/servers/monitoring/nagios-plugins/check_ssl_cert/default.nix b/pkgs/servers/monitoring/nagios-plugins/check_ssl_cert/default.nix
index 7dc48ad6ae32..139c9477f141 100644
--- a/pkgs/servers/monitoring/nagios-plugins/check_ssl_cert/default.nix
+++ b/pkgs/servers/monitoring/nagios-plugins/check_ssl_cert/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "check_ssl_cert";
-  version = "2.92.0";
+  version = "2.93.0";
 
   src = fetchFromGitHub {
     owner = "matteocorti";
     repo = "check_ssl_cert";
     tag = "v${version}";
-    hash = "sha256-00zJt/MQ4uU/JvJfJ70mtCqtL63w2NRfUgDNmhTF8w8=";
+    hash = "sha256-uD9NGMiGDE8in7K9jUmPV3NNuLL52n90S07bKVK927k=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/nosql/mongodb/6.0.nix b/pkgs/servers/nosql/mongodb/6.0.nix
index b23fa286c50a..cc99fa2d4fae 100644
--- a/pkgs/servers/nosql/mongodb/6.0.nix
+++ b/pkgs/servers/nosql/mongodb/6.0.nix
@@ -20,8 +20,8 @@ let
 in
 buildMongoDB {
   inherit avxSupport;
-  version = "6.0.19";
-  sha256 = "sha256-qcf+6hMg0LASeOoZJPoRCQ9ajCJBqSsBDg2Wp+2SMKY=";
+  version = "6.0.23";
+  sha256 = "sha256-E87l73bA2i/wEPkzYBX70UptX7tWqBRyhb4fIyrwHZk=";
   patches = [
     # Patches a bug that it couldn't build MongoDB 6.0 on gcc 13 because a include in ctype.h was missing
     ./fix-gcc-13-ctype-6_0.patch
diff --git a/pkgs/servers/openafs/1.8/module.nix b/pkgs/servers/openafs/1.8/module.nix
index 2ca0e2b9ca51..5e3c9010ed55 100644
--- a/pkgs/servers/openafs/1.8/module.nix
+++ b/pkgs/servers/openafs/1.8/module.nix
@@ -40,6 +40,42 @@ stdenv.mkDerivation {
       decode = "base64 -d";
       hash = "sha256-08jedwZ1KX1RSs8y9sh7BUvv5xK9tlzZ6uBOR4kS0Jo=";
     })
+    # Linux: Add required MODULE_DESCRIPTION
+    (fetchpatch {
+      url = "https://gerrit.openafs.org/changes/16372/revisions/39189eba45542376e668636bd79a93ae6a8a7cd2/patch";
+      decode = "base64 -d";
+      hash = "sha256-j5ckKQvybEvmlnFs5jX8g8Dfw37LYWGnfsl4hnZ3+A4=";
+    })
+    # linux: inode_ops mkdir returns struct dentry *
+    (fetchpatch {
+      url = "https://gerrit.openafs.org/changes/16373/revisions/769847e205d5908a0c430f7bcfbd2f48e19f8bf8/patch";
+      decode = "base64 -d";
+      hash = "sha256-znv5gunyPnJgi4SRFERJudtYFqiS+AVYDWfvr52Ku3s=";
+    })
+    # Linux: Use __filemap_get_folio()
+    (fetchpatch {
+      url = "https://gerrit.openafs.org/changes/16374/revisions/f187add554da9e9c52752edbfa98f486f683cf25/patch";
+      decode = "base64 -d";
+      hash = "sha256-+ay87ThSn6QyPZcN0+oE01Wqbxmz0Z1KXYwocQCvYLg=";
+    })
+    # Linux: Use folio_wait_locked()
+    (fetchpatch {
+      url = "https://gerrit.openafs.org/changes/16375/revisions/87a93f6488585553d833e1397e7f0dae0545cb7e/patch";
+      decode = "base64 -d";
+      hash = "sha256-MOVX2LFe8OBnvsQ2UdLvwKrwztOmnu1rdIou4CF+EBs=";
+    })
+    # cf: Introduce AC_CHECK_LINUX_SYMBOL
+    (fetchpatch {
+      url = "https://gerrit.openafs.org/changes/16376/revisions/bab5968d7f4639d4a0cbe81aaa3e9716dda00632/patch";
+      decode = "base64 -d";
+      hash = "sha256-d6DZqDTW1uEKSB5PsomS4ix9fYYQzdQVmDATKl6n7x4=";
+    })
+    # cf: check for dentry flag macros/enums
+    (fetchpatch {
+      url = "https://gerrit.openafs.org/changes/16377/revisions/f791d8ca4804486c656bc7c221076480df39b465/patch";
+      decode = "base64 -d";
+      hash = "sha256-7B0VJE3FeSQU1ElvXI5zXCPq1JRLAycyhqIQuDdR7xE=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/spicedb/default.nix b/pkgs/servers/spicedb/default.nix
index f9e013028ab4..f79111b56fad 100644
--- a/pkgs/servers/spicedb/default.nix
+++ b/pkgs/servers/spicedb/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  installShellFiles,
 }:
 
 buildGoModule rec {
@@ -23,6 +24,15 @@ buildGoModule rec {
 
   subPackages = [ "cmd/spicedb" ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd spicedb \
+      --bash <($out/bin/spicedb completion bash) \
+      --fish <($out/bin/spicedb completion fish) \
+      --zsh <($out/bin/spicedb completion zsh)
+  '';
+
   meta = with lib; {
     description = "Open source permission database";
     longDescription = ''
@@ -31,7 +41,10 @@ buildGoModule rec {
     '';
     homepage = "https://authzed.com/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ thoughtpolice ];
+    maintainers = with maintainers; [
+      squat
+      thoughtpolice
+    ];
     mainProgram = "spicedb";
   };
 }
diff --git a/pkgs/servers/spicedb/zed.nix b/pkgs/servers/spicedb/zed.nix
index f7ae38c731c0..a0ab08a1200b 100644
--- a/pkgs/servers/spicedb/zed.nix
+++ b/pkgs/servers/spicedb/zed.nix
@@ -2,24 +2,36 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  installShellFiles,
 }:
 
 buildGoModule rec {
   pname = "zed";
-  version = "0.27.0";
+  version = "0.30.2";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "zed";
     rev = "v${version}";
-    hash = "sha256-m9RHgMqbYBo/p4hXVbLa6j8ms9JcNH0CccF8rjfeUns=";
+    hash = "sha256-ftSgp0zxUmSTJ7lFHxFdebKrCKbsRocDkfabVpyQ5Kg=";
   };
 
-  vendorHash = "sha256-GxKMY9Uh8o2Gfz3wJ1xKckkfSl5BU08hUPTH9Hrw6y8=";
+  vendorHash = "sha256-2AkknaufRhv79c9WQtcW5oSwMptkR+FB+1/OJazyGSM=";
 
-  ldflags = [
-    "-X 'github.com/jzelinskie/cobrautil/v2.Version=${src.rev}'"
-  ];
+  ldflags = [ "-X 'github.com/jzelinskie/cobrautil/v2.Version=${src.rev}'" ];
+
+  preCheck = ''
+    export NO_COLOR=true
+  '';
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd zed \
+      --bash <($out/bin/zed completion bash) \
+      --fish <($out/bin/zed completion fish) \
+      --zsh <($out/bin/zed completion zsh)
+  '';
 
   meta = with lib; {
     description = "Command line for managing SpiceDB";
@@ -30,6 +42,9 @@ buildGoModule rec {
     '';
     homepage = "https://authzed.com/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ thoughtpolice ];
+    maintainers = with maintainers; [
+      squat
+      thoughtpolice
+    ];
   };
 }
diff --git a/pkgs/servers/sql/percona-server/8_0.nix b/pkgs/servers/sql/percona-server/8_0.nix
index 626dca351a70..7a7efd9dbb31 100644
--- a/pkgs/servers/sql/percona-server/8_0.nix
+++ b/pkgs/servers/sql/percona-server/8_0.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   gitUpdater,
   bison,
   cmake,
@@ -61,6 +62,15 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ rpcsvc-proto ];
 
   patches = [
+    # adapted from mysql80's llvm 19 fixes
+    ./libcpp-fixes.patch
+    # fixes using -DWITH_SSL=system with CMAKE_PREFIX_PATH on darwin
+    # https://github.com/Homebrew/homebrew-core/pull/204799
+    (fetchpatch {
+      name = "fix-system-ssl-darwin.patch";
+      url = "https://github.com/percona/percona-server/pull/5537/commits/a693e5d67abf6f27f5284c86361604babec529c6.patch";
+      hash = "sha256-fFBy3AYTMLvHvbsh0g0UvuPkmVMKZzxPsxeBKbsN8Ho=";
+    })
     ./no-force-outline-atomics.patch # Do not force compilers to turn on -moutline-atomics switch
     ./coredumper-explicitly-import-unistd.patch # fix build on aarch64-linux
   ];
diff --git a/pkgs/servers/sql/percona-server/libcpp-fixes.patch b/pkgs/servers/sql/percona-server/libcpp-fixes.patch
new file mode 100644
index 000000000000..7e8de096415e
--- /dev/null
+++ b/pkgs/servers/sql/percona-server/libcpp-fixes.patch
@@ -0,0 +1,207 @@
+diff --git a/include/my_char_traits.h b/include/my_char_traits.h
+new file mode 100644
+index 00000000000..6336bc039c8
+--- /dev/null
++++ b/include/my_char_traits.h
+@@ -0,0 +1,65 @@
++/* Copyright (c) 2024, Oracle and/or its affiliates.
++
++   This program is free software; you can redistribute it and/or modify
++   it under the terms of the GNU General Public License, version 2.0,
++   as published by the Free Software Foundation.
++
++   This program is designed to work with certain software (including
++   but not limited to OpenSSL) that is licensed under separate terms,
++   as designated in a particular file or component or in included license
++   documentation.  The authors of MySQL hereby grant you an additional
++   permission to link the program and your derivative works with the
++   separately licensed software that they have either included with
++   the program or referenced in the documentation.
++
++   This program is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++   GNU General Public License, version 2.0, for more details.
++
++   You should have received a copy of the GNU General Public License
++   along with this program; if not, write to the Free Software
++   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA */
++
++#ifndef MY_CHAR_TRAITS_INCLUDED
++#define MY_CHAR_TRAITS_INCLUDED
++
++#include <cstring>
++
++template <class CharT>
++struct my_char_traits;
++
++/*
++  This is a standards-compliant, drop-in replacement for
++    std::char_traits<unsigned char>
++  We need this because clang libc++ is removing support for it in clang 19.
++  It is not a complete implementation. Rather we implement just enough to
++  compile any usage of char_traits<uchar> we have in our codebase.
++ */
++template <>
++struct my_char_traits<unsigned char> {
++  using char_type = unsigned char;
++  using int_type = unsigned int;
++
++  static void assign(char_type &c1, const char_type &c2) { c1 = c2; }
++
++  static char_type *assign(char_type *s, std::size_t n, char_type a) {
++    return static_cast<char_type *>(memset(s, a, n));
++  }
++
++  static int compare(const char_type *s1, const char_type *s2, std::size_t n) {
++    return memcmp(s1, s2, n);
++  }
++
++  static char_type *move(char_type *s1, const char_type *s2, std::size_t n) {
++    if (n == 0) return s1;
++    return static_cast<char_type *>(memmove(s1, s2, n));
++  }
++
++  static char_type *copy(char_type *s1, const char_type *s2, std::size_t n) {
++    if (n == 0) return s1;
++    return static_cast<char_type *>(memcpy(s1, s2, n));
++  }
++};
++
++#endif  // MY_CHAR_TRAITS_INCLUDED
+diff --git a/sql/mdl_context_backup.h b/sql/mdl_context_backup.h
+index 89e7e23df34..cf9c307ec2d 100644
+--- a/sql/mdl_context_backup.h
++++ b/sql/mdl_context_backup.h
+@@ -28,6 +28,7 @@
+ #include <map>
+ #include <memory>
+ 
++#include "my_char_traits.h"
+ #include "sql/malloc_allocator.h"
+ #include "sql/mdl.h"
+ 
+@@ -47,7 +48,8 @@ class MDL_context_backup_manager {
+   /**
+     Key for uniquely identifying MDL_context in the MDL_context_backup map.
+   */
+-  typedef std::basic_string<uchar> MDL_context_backup_key;
++  using MDL_context_backup_key =
++      std::basic_string<uchar, my_char_traits<uchar>>;
+ 
+   class MDL_context_backup;
+ 
+diff --git a/sql/range_optimizer/index_range_scan_plan.cc b/sql/range_optimizer/index_range_scan_plan.cc
+index 74fbb100397..8ed1f50da33 100644
+--- a/sql/range_optimizer/index_range_scan_plan.cc
++++ b/sql/range_optimizer/index_range_scan_plan.cc
+@@ -54,6 +54,8 @@
+ #include "sql/thr_malloc.h"
+ #include "sql_string.h"
+ 
++#include "my_char_traits.h"
++
+ using opt_range::null_element;
+ using std::max;
+ using std::min;
+@@ -1025,8 +1027,8 @@ static bool null_part_in_key(KEY_PART *key_part, const uchar *key,
+ 
+ // TODO(sgunders): This becomes a bit simpler with C++20's string_view
+ // constructors.
+-static inline std::basic_string_view<uchar> make_string_view(const uchar *start,
+-                                                             const uchar *end) {
++static inline std::basic_string_view<uchar, my_char_traits<uchar>>
++make_string_view(const uchar *start, const uchar *end) {
+   return {start, static_cast<size_t>(end - start)};
+ }
+ 
+diff --git a/sql/stream_cipher.h b/sql/stream_cipher.h
+index 606d40645c6..358fbb41959 100644
+--- a/sql/stream_cipher.h
++++ b/sql/stream_cipher.h
+@@ -28,6 +28,8 @@
+ #include <memory>
+ #include <string>
+ 
++#include "my_char_traits.h"
++
+ /**
+   @file stream_cipher.h
+ 
+@@ -35,7 +37,8 @@
+          binary log files.
+ */
+ 
+-typedef std::basic_string<unsigned char> Key_string;
++using Key_string =
++    std::basic_string<unsigned char, my_char_traits<unsigned char>>;
+ 
+ /**
+   @class Stream_cipher
+diff --git a/unittest/gunit/binlogevents/transaction_compression-t.cc b/unittest/gunit/binlogevents/transaction_compression-t.cc
+index ba13f979aa3..01af0e3a360 100644
+--- a/unittest/gunit/binlogevents/transaction_compression-t.cc
++++ b/unittest/gunit/binlogevents/transaction_compression-t.cc
+@@ -23,6 +23,7 @@
+ */
+ 
+ #include <array>
++#include <string>
+ 
+ #include <gtest/gtest.h>
+ #include "libbinlogevents/include/binary_log.h"
+@@ -51,14 +52,13 @@ class TransactionPayloadCompressionTest : public ::testing::Test {
+   using Managed_buffer_t = Decompressor_t::Managed_buffer_t;
+   using Size_t = Decompressor_t::Size_t;
+   using Char_t = Decompressor_t::Char_t;
+-  using String_t = std::basic_string<Char_t>;
+   using Decompress_status_t =
+       binary_log::transaction::compression::Decompress_status;
+   using Compress_status_t =
+       binary_log::transaction::compression::Compress_status;
+ 
+-  static String_t constant_data(Size_t size) {
+-    return String_t(size, (Char_t)'a');
++  static std::string constant_data(Size_t size) {
++    return std::string(size, (Char_t)'a');
+   }
+ 
+  protected:
+@@ -69,7 +69,7 @@ class TransactionPayloadCompressionTest : public ::testing::Test {
+   void TearDown() override {}
+ 
+   static void compression_idempotency_test(Compressor_t &c, Decompressor_t &d,
+-                                           String_t data) {
++                                           const std::string &data) {
+     auto debug_string = concat(
+         binary_log::transaction::compression::type_to_string(c.get_type_code()),
+         " ", data.size());
+@@ -104,8 +104,8 @@ class TransactionPayloadCompressionTest : public ::testing::Test {
+ 
+     // Check decompressed data
+     ASSERT_EQ(managed_buffer.read_part().size(), data.size()) << debug_string;
+-    ASSERT_EQ(data, String_t(managed_buffer.read_part().begin(),
+-                             managed_buffer.read_part().end()))
++    ASSERT_EQ(data, std::string(managed_buffer.read_part().begin(),
++                                managed_buffer.read_part().end()))
+         << debug_string;
+ 
+     // Check that we reached EOF
+@@ -118,7 +118,7 @@ TEST_F(TransactionPayloadCompressionTest, CompressDecompressZstdTest) {
+   for (auto size : buffer_sizes) {
+     binary_log::transaction::compression::Zstd_dec d;
+     binary_log::transaction::compression::Zstd_comp c;
+-    String_t data{TransactionPayloadCompressionTest::constant_data(size)};
++    std::string data{TransactionPayloadCompressionTest::constant_data(size)};
+     TransactionPayloadCompressionTest::compression_idempotency_test(c, d, data);
+     c.set_compression_level(22);
+     TransactionPayloadCompressionTest::compression_idempotency_test(c, d, data);
+@@ -129,7 +129,7 @@ TEST_F(TransactionPayloadCompressionTest, CompressDecompressNoneTest) {
+   for (auto size : buffer_sizes) {
+     binary_log::transaction::compression::None_dec d;
+     binary_log::transaction::compression::None_comp c;
+-    String_t data{TransactionPayloadCompressionTest::constant_data(size)};
++    std::string data{TransactionPayloadCompressionTest::constant_data(size)};
+     TransactionPayloadCompressionTest::compression_idempotency_test(c, d, data);
+   }
+ }
diff --git a/pkgs/servers/sql/postgresql/ext/pg_ivm.nix b/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
index 05f71a2ec1d4..4e2e3c3d3776 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
@@ -7,13 +7,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_ivm";
-  version = "1.10";
+  version = "1.11";
 
   src = fetchFromGitHub {
     owner = "sraoss";
     repo = "pg_ivm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4/ftJkm2ZInm9lkjJG7y4ZULwlyVC19lP0wGXu56SGw=";
+    hash = "sha256-fPtDwP+IZ/RQOriRklSvpUnJ8qEwJaxIrcfnAReRQeQ=";
   };
 
   meta = {
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 09001e5d212c..d98e997ffbd2 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -13,13 +13,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.20.0";
+  version = "2.20.1";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "timescaledb";
     tag = finalAttrs.version;
-    hash = "sha256-CdunXknZoOnxYK3i37TMSR+ma2JAXLsRVSVaa0giJMA=";
+    hash = "sha256-eB88YPoK3uUhvbKP1mob5L+pyemxvGVuGGcJAXDDets=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index c088be485201..9cdc0889e307 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -46,13 +46,13 @@
 }@args:
 
 let
-  version = "3.4.3";
+  version = "3.4.4";
 
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse";
     rev = "v${version}";
-    sha256 = "sha256-TvJKQAdtKuyiWuFrG67NkO/KiXeTjOOQrAnLeyPZ9K8=";
+    sha256 = "sha256-rA42fOhSJVrNPcFSB2+On7JVeZch8t2yNo+36UK+QcA=";
   };
 
   ruby = ruby_3_3;
diff --git a/pkgs/shells/carapace/default.nix b/pkgs/shells/carapace/default.nix
index f639bd38ef1f..e95c6a36b45d 100644
--- a/pkgs/shells/carapace/default.nix
+++ b/pkgs/shells/carapace/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "carapace";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "carapace-sh";
     repo = "carapace-bin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VKc4JnezPdbgUIiSOnHIkUCLas//4TMIKiYd71EMamk=";
+    hash = "sha256-DgWC3IsuHncJzVfWxIGWDxknTAdHJEijvjhO7q14EYQ=";
   };
 
-  vendorHash = "sha256-APJBCUdicKb81gY3ukhMHVgapDl+4tsMdNHEwZbarKE=";
+  vendorHash = "sha256-oq1hZ2P093zsI+UAGHi5XfRXqGGxWpR5j7x7N7ng3xE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/games/pokefinder/default.nix b/pkgs/tools/games/pokefinder/default.nix
index ed9d62db08ce..874dc499debc 100644
--- a/pkgs/tools/games/pokefinder/default.nix
+++ b/pkgs/tools/games/pokefinder/default.nix
@@ -17,24 +17,18 @@
 
 stdenv.mkDerivation rec {
   pname = "pokefinder";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "Admiral-Fish";
     repo = "PokeFinder";
     rev = "v${version}";
-    sha256 = "R0FrRRQRe0tWrHUoU4PPwOgIsltUEImEMTXL79ISfRE=";
+    sha256 = "wjHqox0Vxc73/UTcE7LSo/cG9o4eOqkcjTIW99BxsAc=";
     fetchSubmodules = true;
   };
 
   patches = [
     ./set-desktop-file-name.patch
-    # fix compatibility with our libstdc++
-    # https://github.com/Admiral-Fish/PokeFinder/pull/392
-    (fetchpatch {
-      url = "https://github.com/Admiral-Fish/PokeFinder/commit/2cb1b049cabdf0d1b32c8cf29bf6c9d9c5c55cb0.patch";
-      hash = "sha256-F/w7ydsZ5tZParMWi33W3Tv8A6LLiJt4dAoCrs40DIo=";
-    })
   ];
 
   postPatch = ''
diff --git a/pkgs/tools/misc/ncdu/1.nix b/pkgs/tools/misc/ncdu/1.nix
index fde4411d393c..b4f3de7afabf 100644
--- a/pkgs/tools/misc/ncdu/1.nix
+++ b/pkgs/tools/misc/ncdu/1.nix
@@ -2,26 +2,33 @@
   lib,
   stdenv,
   fetchurl,
+  pkg-config,
   ncurses,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ncdu";
-  version = "1.18.1";
+  version = "1.22";
 
   src = fetchurl {
-    url = "https://dev.yorhel.nl/download/${pname}-${version}.tar.gz";
-    sha256 = "sha256-fA+h6ynYWq7UuhdBZL27jwEbXDkNAXxX1mj8cjEzJAU=";
+    url = "https://dev.yorhel.nl/download/ncdu-${finalAttrs.version}.tar.gz";
+    sha256 = "sha256-CtbAltwE1RIFgRBHYMAbj06X1BkdbJ73llT6PGkaF2s=";
   };
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [ ncurses ];
 
-  meta = with lib; {
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
     description = "Disk usage analyzer with an ncurses interface";
     homepage = "https://dev.yorhel.nl/ncdu";
-    license = licenses.mit;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ pSub ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ pSub ];
     mainProgram = "ncdu";
   };
-}
+})
diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index f50bff766f90..0188f43e6fdb 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -37,7 +37,9 @@
   withFIDO ? stdenv.hostPlatform.isUnix && !stdenv.hostPlatform.isMusl && withSecurityKey,
   withPAM ? stdenv.hostPlatform.isLinux,
   # Attempts to mlock the entire sshd process on startup to prevent swapping.
-  withLinuxMemlock ? stdenv.hostPlatform.isLinux,
+  # Currently disabled when PAM support is enabled due to crashes
+  # See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103418
+  withLinuxMemlock ? (stdenv.hostPlatform.isLinux && !withPAM),
   linkOpenssl ? true,
   isNixos ? stdenv.hostPlatform.isLinux,
 }:
diff --git a/pkgs/tools/package-management/nix/modular/packaging/components.nix b/pkgs/tools/package-management/nix/modular/packaging/components.nix
index 1f11dc94d98a..144f75a61331 100644
--- a/pkgs/tools/package-management/nix/modular/packaging/components.nix
+++ b/pkgs/tools/package-management/nix/modular/packaging/components.nix
@@ -155,6 +155,7 @@ let
       // lib.optionalAttrs (
         stdenv.isLinux
         && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")
+        && !(stdenv.system == "loongarch64-linux")
         && !(stdenv.hostPlatform.useLLVM or false)
       ) { LDFLAGS = "-fuse-ld=gold"; };
   };
diff --git a/pkgs/tools/security/ggshield/default.nix b/pkgs/tools/security/ggshield/default.nix
index 6461a07688dc..9d932c6613d8 100644
--- a/pkgs/tools/security/ggshield/default.nix
+++ b/pkgs/tools/security/ggshield/default.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ggshield";
-  version = "1.39.0";
+  version = "1.40.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "GitGuardian";
     repo = "ggshield";
     tag = "v${version}";
-    hash = "sha256-9VQLWeZPYz3ZqNUzw1vLC5no2NjRru4GcUpjW4QhuBY=";
+    hash = "sha256-Y42MBRyjPljUAGTwhH2FS8drUAceuJse8Qd1GbctWQs=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 505e75df85a7..127f52d8669c 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -239,7 +239,9 @@ stdenv.mkDerivation (finalAttrs: {
     wrapProgram $out/bin/netdata-claim.sh --prefix PATH : ${lib.makeBinPath [ openssl ]}
     wrapProgram $out/libexec/netdata/plugins.d/cgroup-network-helper.sh --prefix PATH : ${lib.makeBinPath [ bash ]}
     wrapProgram $out/bin/netdatacli --set NETDATA_PIPENAME /run/netdata/ipc
-    substituteInPlace $out/lib/netdata/conf.d/go.d/sensors.conf --replace-fail '/usr/bin/sensors' '${lm_sensors}/bin/sensors'
+    ${lib.optionalString (stdenv.hostPlatform.isLinux) ''
+      substituteInPlace $out/lib/netdata/conf.d/go.d/sensors.conf --replace-fail '/usr/bin/sensors' '${lm_sensors}/bin/sensors'
+    ''}
 
     # Time to cleanup the output directory.
     unlink $out/sbin
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 4a9ae7cc05a4..00958a6fc011 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -576,6 +576,7 @@ mapAliases {
   edUnstable = throw "edUnstable was removed; use ed instead"; # Added 2024-07-01
   edgedb = throw "edgedb replaced to gel because of change of upstream"; # Added 2025-02-24
   edge-runtime = throw "'edge-runtime' was removed as it was unused, unmaintained, likely insecure and failed to build"; # Added 2025-05-18
+  eidolon = throw "eidolon was removed as it is unmaintained upstream."; # Added 2025-05-28
   eintopf = lauti; # Project was renamed, added 2025-05-01
   elasticsearch7Plugins = elasticsearchPlugins;
   electronplayer = throw "'electronplayer' has been removed as it had been discontinued upstream since October 2024"; # Added 2024-12-17
@@ -1428,6 +1429,7 @@ mapAliases {
   opensycl = lib.warnOnInstantiate "'opensycl' has been renamed to 'adaptivecpp'" adaptivecpp; # Added 2024-12-04
   opensyclWithRocm = lib.warnOnInstantiate "'opensyclWithRocm' has been renamed to 'adaptivecppWithRocm'" adaptivecppWithRocm; # Added 2024-12-04
   openvdb_11 = throw "'openvdb_11' has been removed in favor of the latest version'"; # Added 2025-05-03
+  opera = throw "'opera' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-05-19
   orchis = throw "'orchis' has been renamed to/replaced by 'orchis-theme'"; # Converted to throw 2024-10-17
   omping = throw "'omping' has been removed because its upstream has been archived"; # Added 2025-05-10
   onlyoffice-bin = onlyoffice-desktopeditors; # Added 2024-09-20
@@ -1474,6 +1476,7 @@ mapAliases {
   partition-manager = makePlasma5Throw "partitionmanager"; # Added 2024-01-08
   patchelfStable = patchelf; # Added 2024-01-25
   paup = paup-cli; # Added 2024-09-11
+  pcre16 = throw "'pcre16' has been removed because it is obsolete. Consider migrating to 'pcre2' instead."; # Added 2025-05-29
   pcsctools = pcsc-tools; # Added 2023-12-07
   pcsxr = throw "pcsxr was removed as it has been abandoned for over a decade; please use DuckStation, Mednafen, or the RetroArch PCSX ReARMed core"; # Added 2024-08-20
   pdf4tcl = tclPackages.pdf4tcl; # Added 2024-10-02
@@ -2001,6 +2004,7 @@ mapAliases {
   vistafonts = vista-fonts; # Added 2025-02-03
   vistafonts-chs = vista-fonts-chs; # Added 2025-02-03
   vistafonts-cht = vista-fonts-cht; # Added 2025-02-03
+  vivaldi = throw "'vivaldi' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-05-29
   vkBasalt = vkbasalt; # Added 2022-11-22
   vkdt-wayland = vkdt; # Added 2024-04-19
   vocal = throw "'vocal' has been archived upstream. Consider using 'gnome-podcasts' or 'kasts' instead."; # Added 2025-04-12
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 76949cbd03f0..31d490db37ae 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2719,6 +2719,9 @@ with pkgs;
 
   cron = isc-cron;
 
+  # Top-level fix-point used in `cudaPackages`' internals
+  _cuda = import ../development/cuda-modules/_cuda;
+
   cudaPackages_11_0 = callPackage ./cuda-packages.nix { cudaMajorMinorVersion = "11.0"; };
   cudaPackages_11_1 = callPackage ./cuda-packages.nix { cudaMajorMinorVersion = "11.1"; };
   cudaPackages_11_2 = callPackage ./cuda-packages.nix { cudaMajorMinorVersion = "11.2"; };
@@ -6625,10 +6628,12 @@ with pkgs;
 
   # https://py-free-threading.github.io
   python313FreeThreading = python313.override {
+    self = python313FreeThreading;
     pythonAttr = "python313FreeThreading";
     enableGIL = false;
   };
   python314FreeThreading = python314.override {
+    self = python314FreeThreading;
     pythonAttr = "python313FreeThreading";
     enableGIL = false;
   };
@@ -9307,7 +9312,6 @@ with pkgs;
   };
 
   pcre = callPackage ../development/libraries/pcre { };
-  pcre16 = res.pcre.override { variant = "pcre16"; };
   # pcre32 seems unused
   pcre-cpp = res.pcre.override { variant = "cpp"; };
 
@@ -9535,6 +9539,17 @@ with pkgs;
     jvm = jre8;
   };
 
+  rocksdb_9_10 = rocksdb.overrideAttrs rec {
+    pname = "rocksdb";
+    version = "9.10.0";
+    src = fetchFromGitHub {
+      owner = "facebook";
+      repo = pname;
+      rev = "v${version}";
+      hash = "sha256-G+DlQwEUyd7JOCjS1Hg1cKWmA/qAiK8UpUIKcP+riGQ=";
+    };
+  };
+
   rocksdb_8_11 = rocksdb.overrideAttrs rec {
     pname = "rocksdb";
     version = "8.11.4";
@@ -13610,8 +13625,6 @@ with pkgs;
 
   organicmaps = qt6Packages.callPackage ../applications/misc/organicmaps { };
 
-  vivaldi = callPackage ../applications/networking/browsers/vivaldi { };
-
   openrazer-daemon = python3Packages.toPythonApplication python3Packages.openrazer-daemon;
 
   orpie = callPackage ../applications/misc/orpie {
@@ -14692,8 +14705,6 @@ with pkgs;
 
   zotero_7 = pkgs.zotero;
 
-  zsteg = callPackage ../tools/security/zsteg { };
-
   zynaddsubfx = callPackage ../applications/audio/zynaddsubfx {
     guiModule = "zest";
     fftw = fftwSinglePrec;
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index 81c9423e6b21..83cc3bde1585 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -187,6 +187,7 @@ let
       paco = callPackage ../development/coq-modules/paco { };
       paramcoq = callPackage ../development/coq-modules/paramcoq { };
       parsec = callPackage ../development/coq-modules/parsec { };
+      parseque = callPackage ../development/coq-modules/parseque { };
       pocklington = callPackage ../development/coq-modules/pocklington { };
       QuickChick = callPackage ../development/coq-modules/QuickChick { };
       reglang = callPackage ../development/coq-modules/reglang { };
diff --git a/pkgs/top-level/cuda-packages.nix b/pkgs/top-level/cuda-packages.nix
index 740efe03b346..53dd4b6029ea 100644
--- a/pkgs/top-level/cuda-packages.nix
+++ b/pkgs/top-level/cuda-packages.nix
@@ -22,10 +22,10 @@
 # I've (@connorbaker) attempted to do that, though I'm unsure of how this will interact with overrides.
 {
   config,
+  _cuda,
   cudaMajorMinorVersion,
   lib,
   newScope,
-  pkgs,
   stdenv,
 }:
 let
@@ -37,41 +37,38 @@ let
     strings
     versions
     ;
-  # MUST be defined outside fix-point (cf. "NAMESET STRICTNESS" above)
-  fixups = import ../development/cuda-modules/fixups { inherit lib; };
-  gpus = import ../development/cuda-modules/gpus.nix;
-  nvccCompatibilities = import ../development/cuda-modules/nvcc-compatibilities.nix;
-  flags = import ../development/cuda-modules/flags.nix {
-    inherit
-      config
-      cudaMajorMinorVersion
-      gpus
-      lib
-      stdenv
-      ;
-  };
 
-  mkVersionedPackageName =
-    name: version: name + "_" + strings.replaceStrings [ "." ] [ "_" ] (versions.majorMinor version);
+  cudaLib = _cuda.lib;
+
+  # Since Jetson capabilities are never built by default, we can check if any of them were requested
+  # through final.config.cudaCapabilities and use that to determine if we should change some manifest versions.
+  # Copied from backendStdenv.
+  jetsonCudaCapabilities = lib.filter (
+    cudaCapability: _cuda.db.cudaCapabilityToInfo.${cudaCapability}.isJetson
+  ) _cuda.db.allSortedCudaCapabilities;
+  hasJetsonCudaCapability =
+    lib.intersectLists jetsonCudaCapabilities (config.cudaCapabilities or [ ]) != [ ];
+  redistSystem = _cuda.lib.getRedistSystem hasJetsonCudaCapability stdenv.hostPlatform.system;
 
   passthruFunction = final: {
-    inherit
-      cudaMajorMinorVersion
-      fixups
-      flags
-      gpus
-      lib
-      nvccCompatibilities
-      pkgs
-      ;
+    # NOTE:
+    # It is important that _cuda is not part of the package set fixed-point. As described by
+    # @SomeoneSerge:
+    # > The layering should be: configuration -> (identifies/is part of) cudaPackages -> (is built using) cudaLib.
+    # > No arrows should point in the reverse directions.
+    # That is to say that cudaLib should only know about package sets and configurations, because it implements
+    # functionality for interpreting configurations, resolving them against data, and constructing package sets.
+    # This decision is driven both by a separation of concerns and by "NAMESET STRICTNESS" (see above).
+    # Also see the comment in `pkgs/top-level/all-packages.nix` about the `_cuda` attribute.
+
+    inherit cudaMajorMinorVersion;
+
+    cudaNamePrefix = "cuda${cudaMajorMinorVersion}";
+
     cudaMajorVersion = versions.major cudaMajorMinorVersion;
     cudaOlder = strings.versionOlder cudaMajorMinorVersion;
     cudaAtLeast = strings.versionAtLeast cudaMajorMinorVersion;
 
-    # NOTE: mkVersionedPackageName is an internal, implementation detail and should not be relied on by outside consumers.
-    # It may be removed in the future.
-    inherit mkVersionedPackageName;
-
     # Maintain a reference to the final cudaPackages.
     # Without this, if we use `final.callPackage` and a package accepts `cudaPackages` as an
     # argument, it's provided with `cudaPackages` from the top-level scope, which is not what we
@@ -82,6 +79,21 @@ let
       __attrsFailEvaluation = true;
     };
 
+    flags =
+      cudaLib.formatCapabilities {
+        inherit (final.backendStdenv) cudaCapabilities cudaForwardCompat;
+        inherit (_cuda.db) cudaCapabilityToInfo;
+      }
+      # TODO(@connorbaker): Enable the corresponding warnings in `../development/cuda-modules/aliases.nix` after some
+      # time to allow users to migrate to cudaLib and backendStdenv.
+      // {
+        inherit (cudaLib) dropDots;
+        cudaComputeCapabilityToName =
+          cudaCapability: _cuda.db.cudaCapabilityToInfo.${cudaCapability}.archName;
+        dropDot = cudaLib.dropDots;
+        isJetsonBuild = final.backendStdenv.hasJetsonCudaCapability;
+      };
+
     # Loose packages
     # Barring packages which share a home (e.g., cudatoolkit and cudatoolkit-legacy-runfile), new packages
     # should be added to ../development/cuda-modules/packages in "by-name" style, where they will be automatically
@@ -128,7 +140,10 @@ let
             value = final.callPackage ../development/cuda-modules/tests/opencv-and-torch config;
           };
       in
-      attrsets.listToAttrs (attrsets.mapCartesianProduct builder configs);
+      attrsets.listToAttrs (attrsets.mapCartesianProduct builder configs)
+      // {
+        flags = final.callPackage ../development/cuda-modules/tests/flags.nix { };
+      };
   };
 
   composedExtension = fixedPoints.composeManyExtensions (
@@ -143,10 +158,10 @@ let
       (import ../development/cuda-modules/cuda/extension.nix { inherit cudaMajorMinorVersion lib; })
       (import ../development/cuda-modules/generic-builders/multiplex.nix {
         inherit
+          cudaLib
           cudaMajorMinorVersion
-          flags
           lib
-          mkVersionedPackageName
+          redistSystem
           stdenv
           ;
         pname = "cudnn";
@@ -156,28 +171,25 @@ let
       })
       (import ../development/cuda-modules/cutensor/extension.nix {
         inherit
+          cudaLib
           cudaMajorMinorVersion
-          flags
           lib
-          mkVersionedPackageName
-          stdenv
+          redistSystem
           ;
       })
       (import ../development/cuda-modules/cusparselt/extension.nix {
         inherit
-          cudaMajorMinorVersion
-          flags
+          cudaLib
           lib
-          mkVersionedPackageName
-          stdenv
+          redistSystem
           ;
       })
       (import ../development/cuda-modules/generic-builders/multiplex.nix {
         inherit
+          cudaLib
           cudaMajorMinorVersion
-          flags
           lib
-          mkVersionedPackageName
+          redistSystem
           stdenv
           ;
         pname = "tensorrt";
@@ -190,7 +202,9 @@ let
       })
       (import ../development/cuda-modules/cuda-library-samples/extension.nix { inherit lib stdenv; })
     ]
-    ++ lib.optionals config.allowAliases [ (import ../development/cuda-modules/aliases.nix) ]
+    ++ lib.optionals config.allowAliases [
+      (import ../development/cuda-modules/aliases.nix { inherit lib; })
+    ]
   );
 
   cudaPackages = customisation.makeScope newScope (
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index be373bc68e26..20be82251746 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -470,8 +470,6 @@ in
 
         asus-ec-sensors = callPackage ../os-specific/linux/asus-ec-sensors { };
 
-        asus-wmi-sensors = callPackage ../os-specific/linux/asus-wmi-sensors { };
-
         ena = callPackage ../os-specific/linux/ena { };
 
         lenovo-legion-module = callPackage ../os-specific/linux/lenovo-legion { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index e9bee00dcd49..215827d0b2c4 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1147,6 +1147,8 @@ let
 
         lwt-dllist = callPackage ../development/ocaml-modules/lwt-dllist { };
 
+        lwt_eio = callPackage ../development/ocaml-modules/lwt_eio { };
+
         lwt-exit = callPackage ../development/ocaml-modules/lwt-exit { };
 
         lwt_log = callPackage ../development/ocaml-modules/lwt_log { };
@@ -1194,6 +1196,8 @@ let
 
         melange = callPackage ../development/tools/ocaml/melange { };
 
+        melange-json = callPackage ../development/ocaml-modules/melange-json { };
+
         memprof-limits = callPackage ../development/ocaml-modules/memprof-limits { };
 
         memtrace = callPackage ../development/ocaml-modules/memtrace { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 0deb086166fe..da86ac731d97 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -456,6 +456,10 @@ with self;
       url = "mirror://cpan/authors/id/R/RU/RUZ/Alien-LibGumbo-0.05.tar.gz";
       hash = "sha256-D76RarEfaA5cKM0ayAA3IyPioOBq/8bIs2J5/GTXZRc=";
     };
+    # Fix linker detection broken by exported LD (see nixpkgs#9f2a89f)
+    preBuild = ''
+      export LD="${lib.getExe' stdenv.cc.bintools "${stdenv.cc.bintools.targetPrefix}ld"}"
+    '';
     buildInputs = [ AlienBaseModuleBuild ];
     propagatedBuildInputs = [
       AlienBuild
@@ -468,7 +472,7 @@ with self;
         artistic1
         gpl1Plus
       ];
-      broken = stdenv.hostPlatform.isLinux; # Fails with: cannot find ./.libs/libgumbo.so
+      broken = stdenv.hostPlatform.isDarwin; # Fails with: ld: unknown option
     };
   };
 
@@ -37571,12 +37575,17 @@ with self;
       url = "mirror://cpan/authors/id/C/CV/CVLIBRARY/UUID4-Tiny-0.003.tar.gz";
       hash = "sha256-4S9sgrg1dcORd3O0HA+1HPeDx8bPcuDJkWks4u8Hg2I=";
     };
-    postPatch = lib.optionalString (stdenv.hostPlatform.isAarch64) ''
-      # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/asm-generic/unistd.h
-      # printf SYS_getrandom | gcc -include sys/syscall.h -E -
-      substituteInPlace lib/UUID4/Tiny.pm \
-        --replace "syscall( 318" "syscall( 278"
-    '';
+    postPatch =
+      lib.optionalString
+        (
+          stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isLoongArch64 || stdenv.hostPlatform.isRiscV64
+        )
+        ''
+          # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/asm-generic/unistd.h
+          # printf SYS_getrandom | gcc -include sys/syscall.h -E -
+          substituteInPlace lib/UUID4/Tiny.pm \
+            --replace "syscall( 318" "syscall( 278"
+        '';
     meta = {
       description = "Cryptographically secure v4 UUIDs for Linux x64";
       license = with lib.licenses; [
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index a49d67cfe7ed..ae174ee65244 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -485,6 +485,7 @@ mapAliases ({
   pdfminer = pdfminer-six; # added 2022-05-25
   pdfx = throw "pdfx has been removed because the upstream repository was archived in 2023"; # Added 2024-10-04
   pep257 = pydocstyle; # added 2022-04-12
+  percol = throw "percol has been removed because it hasn't been updated since 2019"; # added 2025-05-25
   pillow-simd = throw "pillow-simd has been removed for lagging behind pillow upstream, which exposes it to various security issues."; # Added 2024-10-24
   pipenv-poetry-migrate = throw "pipenv-poetry-migrate was promoted to a top-level attribute"; # added 2025-01-14
   pixelmatch = "pixelmatch has been removed as it was unmaintained"; # Added 2024-08-18
@@ -521,6 +522,7 @@ mapAliases ({
   pwndbg = throw "'pwndbg' has been removed due to dependency version incompatibilities that are infeasible to maintain in nixpkgs. Use the downstream flake that pwndbg provides instead: https://github.com/pwndbg/pwndbg"; # Added 2025-02-09
   pxml = throw "pxml was removed, because it was disabled on all python version since 3.8 and last updated in 2020."; # added 2024-05-13
   py3to2 = throw "py3to2 is unmaintained and source is no longer available"; # added 2024-10-23
+  pytricia = throw "pytricia has been removed, since it is unmaintained"; # added 2025-05-25
   py-radix = throw "py-radix has been removed, since it abandoned"; # added 2023-07-07
   py_stringmatching = py-stringmatching; # added 2023-11-12
   py17track = throw "py17track was removed because Home Assistant switched to pyseventeentrack"; # added 2024-08-08
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 16ed1fa0480e..daaf98b06d4c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2695,6 +2695,8 @@ self: super: with self; {
 
   colcon-notification = callPackage ../development/python-modules/colcon-notification { };
 
+  colcon-output = callPackage ../development/python-modules/colcon-output { };
+
   colcon-parallel-executor = callPackage ../development/python-modules/colcon-parallel-executor { };
 
   colcon-ros-domain-id-coordinator =
@@ -4201,6 +4203,8 @@ self: super: with self; {
 
   drf-extra-fields = callPackage ../development/python-modules/drf-extra-fields { };
 
+  drf-flex-fields = callPackage ../development/python-modules/drf-flex-fields { };
+
   drf-jwt = callPackage ../development/python-modules/drf-jwt { };
 
   drf-nested-routers = callPackage ../development/python-modules/drf-nested-routers { };
@@ -7791,6 +7795,14 @@ self: super: with self; {
 
   lexilang = callPackage ../development/python-modules/lexilang { };
 
+  lgpio = toPythonModule (
+    pkgs.lgpio.override {
+      inherit buildPythonPackage;
+      pyProject = "PY_LGPIO";
+      lgpioWithoutPython = pkgs.lgpio;
+    }
+  );
+
   lhapdf = toPythonModule (pkgs.lhapdf.override { python3 = python; });
 
   lib4package = callPackage ../development/python-modules/lib4package { };
@@ -7799,6 +7811,8 @@ self: super: with self; {
 
   lib4vex = callPackage ../development/python-modules/lib4vex { };
 
+  lib50 = callPackage ../development/python-modules/lib50 { };
+
   libagent = callPackage ../development/python-modules/libagent { };
 
   libais = callPackage ../development/python-modules/libais { };
@@ -11054,8 +11068,6 @@ self: super: with self; {
 
   peppercorn = callPackage ../development/python-modules/peppercorn { };
 
-  percol = callPackage ../development/python-modules/percol { };
-
   perfplot = callPackage ../development/python-modules/perfplot { };
 
   periodictable = callPackage ../development/python-modules/periodictable { };
@@ -11174,6 +11186,12 @@ self: super: with self; {
 
   piexif = callPackage ../development/python-modules/piexif { };
 
+  pigpio = toPythonModule (
+    pkgs.pigpio.override {
+      inherit buildPythonPackage;
+    }
+  );
+
   pijuice = callPackage ../development/python-modules/pijuice { };
 
   pika = callPackage ../development/python-modules/pika { };
@@ -14520,8 +14538,6 @@ self: super: with self; {
 
   pytransportnswv2 = callPackage ../development/python-modules/pytransportnswv2 { };
 
-  pytricia = callPackage ../development/python-modules/pytricia { };
-
   pytrydan = callPackage ../development/python-modules/pytrydan { };
 
   pyttsx3 = callPackage ../development/python-modules/pyttsx3 { };
@@ -15199,6 +15215,13 @@ self: super: with self; {
 
   rflink = callPackage ../development/python-modules/rflink { };
 
+  rgpio = toPythonModule (
+    pkgs.lgpio.override {
+      inherit buildPythonPackage;
+      pyProject = "PY_RGPIO";
+    }
+  );
+
   rich = callPackage ../development/python-modules/rich { };
 
   rich-argparse = callPackage ../development/python-modules/rich-argparse { };
@@ -16726,6 +16749,8 @@ self: super: with self; {
 
   starlette-admin = callPackage ../development/python-modules/starlette-admin { };
 
+  starlette-compress = callPackage ../development/python-modules/starlette-compress { };
+
   starlette-context = callPackage ../development/python-modules/starlette-context { };
 
   starlette-wtf = callPackage ../development/python-modules/starlette-wtf { };
diff --git a/pkgs/top-level/release-cuda.nix b/pkgs/top-level/release-cuda.nix
index d2e515556bb7..f5800cc7828f 100644
--- a/pkgs/top-level/release-cuda.nix
+++ b/pkgs/top-level/release-cuda.nix
@@ -14,20 +14,7 @@
 
 let
   lib = import ../../lib;
-  ensureList = x: if builtins.isList x then x else [ x ];
-  allowUnfreePredicate =
-    p:
-    builtins.all (
-      license:
-      license.free
-      || builtins.elem license.shortName [
-        "CUDA EULA"
-        "cuDNN EULA"
-        "cuSPARSELt EULA"
-        "cuTENSOR EULA"
-        "NVidia OptiX EULA"
-      ]
-    ) (ensureList p.meta.license);
+  cudaLib = (import ../development/cuda-modules/_cuda).lib;
 in
 
 {
@@ -40,7 +27,7 @@ in
   # Attributes passed to nixpkgs.
   nixpkgsArgs ? {
     config = {
-      inherit allowUnfreePredicate;
+      allowUnfreePredicate = cudaLib.allowUnfreeCudaPredicate;
       "${variant}Support" = true;
       inHydra = true;
 
diff --git a/pkgs/top-level/release-outpaths.nix b/pkgs/top-level/release-outpaths.nix
index 8ca14fc95007..731c65da73e3 100644
--- a/pkgs/top-level/release-outpaths.nix
+++ b/pkgs/top-level/release-outpaths.nix
@@ -27,7 +27,7 @@ let
           config = {
             allowAliases = false;
             allowBroken = includeBroken;
-            allowUnfree = false;
+            allowUnfree = true;
             allowInsecurePredicate = x: true;
             checkMeta = checkMeta;
 
diff --git a/pkgs/top-level/variants.nix b/pkgs/top-level/variants.nix
index 8465c61da529..3609aa3ca178 100644
--- a/pkgs/top-level/variants.nix
+++ b/pkgs/top-level/variants.nix
@@ -119,7 +119,6 @@ self: super: {
           # causes shadowstack disablement
           pcre = super'.pcre.override { enableJit = false; };
           pcre-cpp = super'.pcre-cpp.override { enableJit = false; };
-          pcre16 = super'.pcre16.override { enableJit = false; };
         }
       )
     ] ++ overlays;