diff --git a/.github/actions/checkout/action.yml b/.github/actions/checkout/action.yml
index b70749564c01..128398e5e02f 100644
--- a/.github/actions/checkout/action.yml
+++ b/.github/actions/checkout/action.yml
@@ -20,6 +20,7 @@ runs:
         PIN_BUMP_SHA: ${{ inputs.untrusted-pin-bump }}
       with:
         script: |
+          const { rm, writeFile } = require('node:fs/promises')
           const { spawn } = require('node:child_process')
           const { join } = require('node:path')
 
@@ -55,10 +56,19 @@ runs:
             return pinned.pins.nixpkgs.revision
           }
 
-          const pin_bump_sha = process.env.PIN_BUMP_SHA
+          // Getting the pin-bump diff via the API avoids issues with `git fetch`
+          // thin-packs not having enough base objects to be applied locally.
+          // Returns a unified diff suitable for `git apply`.
+          async function getPinBumpDiff(ref) {
+            const { data } = await github.rest.repos.getCommit({
+              mediaType: { format: 'diff' },
+              ...context.repo,
+              ref,
+            })
+            return data
+          }
 
-          // When dealing with a pin bump commit, we need `--depth=2` to view & apply its diff
-          const depth = pin_bump_sha ? 2 : 1
+          const pin_bump_sha = process.env.PIN_BUMP_SHA
 
           const commits = [
             {
@@ -76,17 +86,14 @@ runs:
             {
               sha: await getPinnedSha(process.env.TARGET_SHA),
               path: 'trusted-pinned'
-            },
-            {
-              sha: pin_bump_sha
             }
           ].filter(({ sha }) => Boolean(sha))
 
-          console.log('Fetching the following commits:', commits)
+          console.log('Checking out the following commits:', commits)
 
           // Fetching all commits at once is much faster than doing multiple checkouts.
           // This would fail without --refetch, because the we had a partial clone before, but changed it above.
-          await run('git', 'fetch', `--depth=${depth}`, '--refetch', 'origin', ...(commits.map(({ sha }) => sha)))
+          await run('git', 'fetch', '--depth=1', '--refetch', 'origin', ...(commits.map(({ sha }) => sha)))
 
           // Checking out onto tmpfs takes 1s and is faster by at least factor 10x.
           await run('mkdir', 'nixpkgs')
@@ -101,20 +108,21 @@ runs:
 
           // Create all worktrees in parallel.
           await Promise.all(
-            commits
-              .filter(({ path }) => Boolean(path))
-              .map(async ({ sha, path }) => {
-                await run('git', 'worktree', 'add', join('nixpkgs', path), sha, '--no-checkout')
-                await run('git', '-C', join('nixpkgs', path), 'sparse-checkout', 'disable')
-                await run('git', '-C', join('nixpkgs', path), 'checkout', '--progress')
-              })
+            commits.map(async ({ sha, path }) => {
+              await run('git', 'worktree', 'add', join('nixpkgs', path), sha, '--no-checkout')
+              await run('git', '-C', join('nixpkgs', path), 'sparse-checkout', 'disable')
+              await run('git', '-C', join('nixpkgs', path), 'checkout', '--progress')
+            })
           )
 
           // Apply pin bump to untrusted worktree
           if (pin_bump_sha) {
-            console.log('Applying untrusted ci/pinned.json bump:', pin_bump_sha)
+            console.log('Fetching ci/pinned.json bump commit:', pin_bump_sha)
+            await writeFile('pin-bump.patch', await getPinBumpDiff(pin_bump_sha))
+
+            console.log('Applying untrusted ci/pinned.json bump to ./nixpkgs/untrusted')
             try {
-              await run('git', '-C', join('nixpkgs', 'untrusted'), 'cherry-pick', '--no-commit', pin_bump_sha)
+              await run('git', '-C', join('nixpkgs', 'untrusted'), 'apply', '--3way', join('..', '..', 'pin-bump.patch'))
             } catch {
               core.setFailed([
                 `Failed to apply ci/pinned.json bump commit ${pin_bump_sha}.`,
@@ -122,5 +130,7 @@ runs:
                 `Please rebase the PR or ensure the pin bump is standalone.`
               ].join(' '))
               return
+            } finally {
+              await rm('pin-bump.patch')
             }
           }
diff --git a/.github/labeler-no-sync.yml b/.github/labeler-no-sync.yml
index 1cb675a2a57b..6bdfd28328a3 100644
--- a/.github/labeler-no-sync.yml
+++ b/.github/labeler-no-sync.yml
@@ -26,7 +26,7 @@
   - all:
       - changed-files:
           - any-glob-to-any-file:
-              - .github/actions/*
+              - .github/actions/**/*
               - .github/workflows/*
               - .github/labeler*.yml
               - ci/**/*.*
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 2e40f225818d..2643708fce0b 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -20,6 +20,8 @@
 
 - [reaction](https://reaction.ppom.me/), a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as [services.reaction](#opt-services.reaction.enable).
 
+- [Tailscale Serve](https://tailscale.com/kb/1552/tailscale-services), configure Tailscale Serve for exposing local services to your tailnet. Available as [services.tailscale.serve](#opt-services.tailscale.serve.enable).
+
 - [qui](https://github.com/autobrr/qui), a modern alternative webUI for qBittorrent, with multi-instance support. Written in Go/React. Available as [services.qui](#opt-services.qui.enable).
 
 - [LibreChat](https://www.librechat.ai/), open-source self-hostable ChatGPT clone with Agents and RAG APIs. Available as [services.librechat](#opt-services.librechat.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 8422d5f308c2..f14958e655f9 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1392,6 +1392,7 @@
   ./services/networking/syncthing.nix
   ./services/networking/tailscale-auth.nix
   ./services/networking/tailscale-derper.nix
+  ./services/networking/tailscale-serve.nix
   ./services/networking/tailscale.nix
   ./services/networking/tayga.nix
   ./services/networking/tcpcrypt.nix
diff --git a/nixos/modules/services/networking/tailscale-serve.nix b/nixos/modules/services/networking/tailscale-serve.nix
new file mode 100644
index 000000000000..87ee4026c1c4
--- /dev/null
+++ b/nixos/modules/services/networking/tailscale-serve.nix
@@ -0,0 +1,145 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.tailscale.serve;
+  settingsFormat = pkgs.formats.json { };
+
+  # Build the serve config structure with svc: prefix on service names
+  serveConfig = {
+    version = "0.0.1";
+    services = lib.mapAttrs' (
+      name: serviceCfg:
+      lib.nameValuePair "svc:${name}" (
+        {
+          endpoints = serviceCfg.endpoints;
+        }
+        // lib.optionalAttrs (serviceCfg.advertised != null) {
+          inherit (serviceCfg) advertised;
+        }
+      )
+    ) cfg.services;
+  };
+
+  configFile =
+    if cfg.configFile != null then
+      cfg.configFile
+    else
+      settingsFormat.generate "tailscale-serve-config.json" serveConfig;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    bouk
+  ];
+
+  options.services.tailscale.serve = {
+    enable = lib.mkEnableOption "Tailscale Serve configuration";
+
+    configFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to a Tailscale Serve configuration file in JSON format.
+        If set, this takes precedence over {option}`services.tailscale.serve.services`.
+
+        See <https://tailscale.com/kb/1589/tailscale-services-configuration-file> for the configuration format.
+      '';
+      example = "/run/secrets/tailscale-serve.json";
+    };
+
+    services = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            endpoints = lib.mkOption {
+              type = lib.types.attrsOf lib.types.str;
+              description = ''
+                Map of incoming traffic patterns to local targets.
+
+                Keys should be in the format `<protocol>:<port>` or `<protocol>:<port-range>`.
+                Currently only `tcp` protocol is supported.
+
+                Values should be in the format `<protocol>://<host:port>` where protocol
+                is `http`, `https`, or `tcp`.
+              '';
+              example = {
+                "tcp:443" = "https://localhost:443";
+                "tcp:8080" = "http://localhost:8080";
+              };
+            };
+
+            advertised = lib.mkOption {
+              type = lib.types.nullOr lib.types.bool;
+              default = null;
+              description = ''
+                Whether the service should accept new connections.
+                Defaults to `true` when not specified.
+              '';
+            };
+          };
+        }
+      );
+      default = { };
+      description = ''
+        Services to configure for Tailscale Serve.
+
+        Each attribute name should be the service name (without the `svc:` prefix).
+        The `svc:` prefix will be added automatically.
+
+        See <https://tailscale.com/kb/1589/tailscale-services-configuration-file> for details.
+      '';
+      example = lib.literalExpression ''
+        {
+          web-server = {
+            endpoints = {
+              "tcp:443" = "https://localhost:443";
+            };
+          };
+          api = {
+            endpoints = {
+              "tcp:8080" = "http://localhost:8080";
+            };
+            advertised = true;
+          };
+        }
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.services.tailscale.enable;
+        message = "services.tailscale.serve requires services.tailscale.enable to be true";
+      }
+      {
+        assertion = cfg.configFile != null || cfg.services != { };
+        message = "services.tailscale.serve requires either configFile or services to be set";
+      }
+    ];
+
+    systemd.services.tailscale-serve = {
+      description = "Tailscale Serve Configuration";
+
+      after = [
+        "tailscaled.service"
+        "tailscaled-autoconnect.service"
+        "tailscaled-set.service"
+      ];
+      wants = [ "tailscaled.service" ];
+      wantedBy = [ "multi-user.target" ];
+
+      restartTriggers = [ configFile ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = "${lib.getExe config.services.tailscale.package} serve set-config --all ${configFile}";
+      };
+    };
+  };
+}
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 91738c9f925a..a03c9a07b638 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -813,7 +813,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "144.0.7559.59",
+    "version": "144.0.7559.96",
     "deps": {
       "depot_tools": {
         "rev": "2e88a3f08bd8c4a0014eae82729beca935f7f188",
@@ -825,16 +825,16 @@
         "hash": "sha256-04h38X/hqWwMiAOVsVu4OUrt8N+S7yS/JXc5yvRGo1I="
       },
       "ungoogled-patches": {
-        "rev": "144.0.7559.59-1",
-        "hash": "sha256-u4jg04k/HilI5i8eWS2b+MDvi9RYD1UP8KNNKNWZcfQ="
+        "rev": "144.0.7559.96-1",
+        "hash": "sha256-gbEKKGGi6FBhRoCEerSdJJtn5vXaFo9G74lYHDsz0Xs="
       },
       "npmHash": "sha256-13sgV/5BD7QvDLBAEmoLN5vongw+S5v5znvZcctxhWc="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "cd1d73dd77daadf4581dc29ca73482fc241e079d",
-        "hash": "sha256-K/dmiy5u+XJIpS6AOTaXDLVYp5qAtfUbfSbGCpt9Cv8=",
+        "rev": "d7b80622cfab91c265741194e7942eefd2d21811",
+        "hash": "sha256-Cz3iDS0raJHRh+byrs7GYp6sck54mJq7yzsjLUWDWqA=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -944,8 +944,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "a8d1e554a9bd35b0418ba7fd6b0bc005250a7703",
-        "hash": "sha256-GJuT3rqNxvKkRTMvoMi8/QYda0y0RTkZLhb5v9QkwGA="
+        "rev": "9e0e116de6735ab113349675d31a23c121254fe0",
+        "hash": "sha256-MsUmRx5fQYWbkPJ/JvaoT//qjPYy5xxZXIa3t5LDxSY="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1069,8 +1069,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "d5efa4236f8676254c9f39ccfef18bd633de5fd3",
-        "hash": "sha256-BmwsvTjgYQayFnyT9EfFzpCfbgdTt9xZlsUba0uJelg="
+        "rev": "a3064782146fc247c488d44c1ad3496b29d55ec4",
+        "hash": "sha256-vLkWH/EiDHxl/dz4soKybQF1hgud/7MlnDhVPicYJGY="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1619,8 +1619,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "ad25f9ae50a53bee50f459bfee25fb1e6f64adc3",
-        "hash": "sha256-vyOtnPA3tAeorNOGTDuAnwJ/UtpjeO8z+RSjx9RIFFc="
+        "rev": "6c2c296f23a5487ccb2536cf7c90d01f35d03077",
+        "hash": "sha256-gBzwGvl/tqj4Z6acdLN326I80kBLEk+Nn8oN6D193o4="
       }
     }
   }
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index b10933837c5e..eedb827b72af 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1310,11 +1310,11 @@
     "vendorHash": "sha256-omxEb+ntQuHDfS2Rmt0rj0BF0Q2T8DLhobLua2uU/0o="
   },
   "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-VgmXFRmwgCkGMwcle0zop41pr+uuj4ILlNXIcHQ9n0g=",
+    "hash": "sha256-kXdu7rtGo4J9waREkVMWqFf4/Ki22fm6p/Nhtts/Ycs=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.82.54",
+    "rev": "v1.82.57",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/applications/networking/instant-messengers/gajim/default.nix
index de846c7c7c0a..ee0137e4fdd5 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@@ -43,14 +43,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gajim";
-  version = "2.3.6";
+  version = "2.4.2";
 
   src = fetchFromGitLab {
     domain = "dev.gajim.org";
     owner = "gajim";
     repo = "gajim";
     tag = version;
-    hash = "sha256-Mvi69FI2zRefcCnLsurdVNMxYaqKsUCKgeFxOh6vg/o=";
+    hash = "sha256-VBo0+8lOXWbi3a9FT0qcEkyoxzVAm+QLrBtHmRjUHbg=";
   };
 
   pyproject = true;
@@ -112,6 +112,9 @@ python3.pkgs.buildPythonApplication rec {
       qrcode
       sqlalchemy
       emoji
+      httpx
+      h2
+      truststore
     ]
     ++ lib.optionals enableE2E [
       pycrypto
diff --git a/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/mount.conf b/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/mount.conf
index dad6c229df2b..7113acc881a9 100644
--- a/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/mount.conf
+++ b/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/mount.conf
@@ -20,8 +20,20 @@ extraMounts:
       mountPoint: /sys/firmware/efi/efivars
       efi: true
 
-# Ensure the right fmask/dmask is set on the ESP, as it will be
-# picked up by nixos-generate-config later
+# Btrfs subvolume layout for NixOS
+# Empty subvolume for / means no subvolume (top-level) for GRUB compatibility
+btrfsSubvolumes:
+    - mountPoint: /
+      subvolume: ""
+    - mountPoint: /home
+      subvolume: /home
+    - mountPoint: /nix
+      subvolume: /nix
+
+# Mount options by filesystem type
+# nixos-generate-config picks these up for hardware-configuration.nix
 mountOptions:
     - filesystem: efi
       options: [ fmask=0077, dmask=0077 ]
+    - filesystem: btrfs
+      options: [ compress=zstd, noatime ]
diff --git a/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/partition.conf b/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/partition.conf
index 3e067e8d2343..75d04cec9dfa 100644
--- a/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/partition.conf
+++ b/pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/partition.conf
@@ -12,11 +12,29 @@ userSwapChoices:
 
 luksGeneration: luks2
 
+defaultFileSystemType: "ext4"
+
+availableFileSystemTypes:
+    - ext4
+    - btrfs
+    - xfs
+    - f2fs
+
 showNotEncryptedBootMessage: false
 
+bios:
+    mountPoint: "/boot"
+    minimumSize: 512MiB
+    recommendedSize: 1GiB
+    label: "BOOT"
+
 partitionLayout:
-    - name: "root"
+    - name: "boot"
       filesystem: "ext4"
+      mountPoint: "/boot"
+      size: 1GiB
+    - name: "root"
+      filesystem: "unknown"
       noEncrypt: false
       mountPoint: "/"
       size: 100%
diff --git a/pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py b/pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py
index 5987724728f8..e9bee7a245d4 100644
--- a/pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py
+++ b/pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py
@@ -45,6 +45,15 @@ cfgbootbios = """  # Bootloader.
 
 """
 
+cfgbootbiosbtrfs = """  # Bootloader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "@@bootdev@@";
+  boot.loader.grub.useOSProber = true;
+  # Use provided UUIDs instead of blkid probing (required for btrfs subvolumes)
+  boot.loader.grub.fsIdentifier = "provided";
+
+"""
+
 cfgbootnone = """  # Disable bootloader.
   boot.loader.grub.enable = false;
 
@@ -360,6 +369,46 @@ def catenate(d, key, *values):
     d[key] = "".join(values)
 
 
+def fix_btrfs_subvolumes(hardware_config, partitions):
+    """
+    Fix btrfs subvolume configuration in hardware-configuration.nix.
+
+    nixos-generate-config generates incorrect subvol options for btrfs
+    by setting them to mount points instead of actual subvolume names.
+    This function corrects the subvol options to match what Calamares configured.
+    """
+    # Map of mount points to their correct btrfs subvolume names
+    # These match what is configured in mount.conf btrfsSubvolumes
+    # Root uses top-level (no subvolume) for GRUB compatibility
+    subvol_map = {
+        "/home": "home",
+        "/nix": "nix",
+    }
+
+    # Check if root is actually btrfs
+    root_is_btrfs = False
+    for part in partitions:
+        if part.get("mountPoint") == "/" and part.get("fs") == "btrfs":
+            root_is_btrfs = True
+            break
+
+    if not root_is_btrfs:
+        return hardware_config
+
+    libcalamares.utils.debug("Fixing btrfs subvolume configuration")
+
+    # Fix subvol options for each mount point
+    # nixos-generate-config may generate "subvol=/" instead of "subvol=@"
+    for mount_point, correct_subvol in subvol_map.items():
+        # Match any "subvol=<something>" and replace with correct subvolume
+        # This handles cases like "subvol=/" or "subvol=/home"
+        pattern = r'(fileSystems\."{}"[^;]*"subvol=)[^"]*"'.format(re.escape(mount_point))
+        replacement = r'\g<1>{}"'.format(correct_subvol)
+        hardware_config = re.sub(pattern, replacement, hardware_config, flags=re.DOTALL)
+
+    return hardware_config
+
+
 def run():
     """NixOS Configuration."""
 
@@ -388,11 +437,22 @@ def run():
 
     # Pick config parts and prepare substitution
 
+    # Check if root filesystem is btrfs
+    root_is_btrfs = False
+    for part in gs.value("partitions"):
+        if part.get("mountPoint") == "/" and part.get("fs") == "btrfs":
+            root_is_btrfs = True
+            break
+
     # Check bootloader
     if fw_type == "efi":
         cfg += cfgbootefi
     elif bootdev != "nodev":
-        cfg += cfgbootbios
+        # Use btrfs-specific config to avoid blkid issues with subvolumes
+        if root_is_btrfs:
+            cfg += cfgbootbiosbtrfs
+        else:
+            cfg += cfgbootbios
         catenate(variables, "bootdev", bootdev)
     else:
         cfg += cfgbootnone
@@ -734,9 +794,20 @@ def run():
             libcalamares.utils.error(e.output.decode("utf8"))
         return (_("nixos-generate-config failed"), _(e.output.decode("utf8")))
 
-    # Check for unfree stuff in hardware-configuration.nix
+    # Read and fix hardware-configuration.nix
     hf = open(root_mount_point + "/etc/nixos/hardware-configuration.nix", "r")
     htxt = hf.read()
+    hf.close()
+
+    hardware_modified = False
+
+    # Fix btrfs subvolume configuration if needed
+    htxt_fixed = fix_btrfs_subvolumes(htxt, gs.value("partitions"))
+    if htxt_fixed != htxt:
+        htxt = htxt_fixed
+        hardware_modified = True
+
+    # Check for unfree stuff in hardware-configuration.nix
     search = re.search(r"boot\.extraModulePackages = \[ (.*) \];", htxt)
 
     # Check if any extraModulePackages are defined, and remove if only free packages are allowed
@@ -765,14 +836,17 @@ def run():
                     )
                 )
                 expkgs.remove(pkg)
-        hardwareout = re.sub(
+        htxt = re.sub(
             r"boot\.extraModulePackages = \[ (.*) \];",
             "boot.extraModulePackages = [ {}];".format(
                 "".join(map(lambda x: x + " ", expkgs))
             ),
             htxt,
         )
-        # Write the hardware-configuration.nix file
+        hardware_modified = True
+
+    # Write the hardware-configuration.nix file if modified
+    if hardware_modified:
         libcalamares.utils.host_env_process_output(
             [
                 "cp",
@@ -780,7 +854,7 @@ def run():
                 root_mount_point + "/etc/nixos/hardware-configuration.nix",
             ],
             None,
-            hardwareout,
+            htxt,
         )
 
     # Write the configuration.nix file
@@ -789,6 +863,14 @@ def run():
     status = _("Installing NixOS")
     libcalamares.job.setprogress(0.3)
 
+    try:
+        subprocess.check_output(
+            ["pkexec", "chmod", "755", root_mount_point],
+            stderr=subprocess.STDOUT,
+        )
+    except subprocess.CalledProcessError as e:
+        libcalamares.utils.warning("Failed to set permissions on {}: {}".format(root_mount_point, e.output))
+
     # build nixos-install command
     nixosInstallCmd = [ "pkexec" ]
     nixosInstallCmd.extend(generateProxyStrings())
diff --git a/pkgs/by-name/co/corrosion/package.nix b/pkgs/by-name/co/corrosion/package.nix
index cd1250ce1ad0..ab018ed8f613 100644
--- a/pkgs/by-name/co/corrosion/package.nix
+++ b/pkgs/by-name/co/corrosion/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "corrosion";
-  version = "0.5.2";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "corrosion-rs";
     repo = "corrosion";
     rev = "v${version}";
-    hash = "sha256-sO2U0llrDOWYYjnfoRZE+/ofg3kb+ajFmqvaweRvT7c=";
+    hash = "sha256-ppuDNObfKhneD9AlnPAvyCRHKW3BidXKglD1j/LE9CM=";
   };
 
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;
@@ -32,12 +32,22 @@ stdenv.mkDerivation rec {
   checkPhase =
     let
       excludedTests = [
-        "cbindgen_rust2cpp_build"
-        "cbindgen_rust2cpp_run_cpp-exe"
+        "cbindgen_install"
+        "cbindgen_manual_build"
+        "cbindgen_manual_run_cpp-exe"
+        "cbindgen_rust2cpp_auto_build"
+        "cbindgen_rust2cpp_auto_run_cpp-exe"
+        "config_discovery_build"
+        "config_discovery_run_cargo_clean"
+        "config_discovery_run_config_discovery"
+        "custom_target_build"
+        "custom_target_run_rust-bin"
+        "custom_target_run_test-exe"
         "hostbuild_build"
         "hostbuild_run_rust-host-program"
-        "parse_target_triple_build"
-        "rustup_proxy_build"
+        "install_lib_build"
+        "install_lib_run_main-shared"
+        "install_lib_run_main-static"
       ];
       excludedTestsRegex = lib.concatStringsSep "|" excludedTests;
     in
diff --git a/pkgs/by-name/ea/eask-cli/package.nix b/pkgs/by-name/ea/eask-cli/package.nix
index 97a289fa105a..eb0cde010adc 100644
--- a/pkgs/by-name/ea/eask-cli/package.nix
+++ b/pkgs/by-name/ea/eask-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "eask-cli";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "emacs-eask";
     repo = "cli";
     rev = version;
-    hash = "sha256-GUOimlbArD1GbeBPfIgcIcGKGHx+fEp6+CMYsqHB0t8=";
+    hash = "sha256-n2NL8B6hxQLB8xdRWzclVlqp3B4K7VxgdQ3zgFC1YyI=";
   };
 
-  npmDepsHash = "sha256-69yGfQuIot0gKZIvLbMqJ0C3qxjqg3TnRDJl4qYHGrQ=";
+  npmDepsHash = "sha256-kHi/8kPTk9hg5NI4u0b+k9OoocHLX2rY3diXt9WMlRo=";
 
   dontBuild = true;
 
diff --git a/pkgs/by-name/fo/forge-mtg/package.nix b/pkgs/by-name/fo/forge-mtg/package.nix
index 87e50d99a892..737261cc0e6f 100644
--- a/pkgs/by-name/fo/forge-mtg/package.nix
+++ b/pkgs/by-name/fo/forge-mtg/package.nix
@@ -16,13 +16,13 @@
 }:
 
 let
-  version = "2.0.08";
+  version = "2.0.09";
 
   src = fetchFromGitHub {
     owner = "Card-Forge";
     repo = "forge";
     rev = "forge-${version}";
-    hash = "sha256-BiBvHpEgvDp0u8g87LAt4/1FTc9t8FRAtSvPEedndEg=";
+    hash = "sha256-TRK6fUOLbI3lLdkSXvvuix0sGbpKLvMmYMx5ozViDRE=";
   };
 
   # launch4j downloads and runs a native binary during the package phase.
diff --git a/pkgs/by-name/ge/gemini-cli-bin/package.nix b/pkgs/by-name/ge/gemini-cli-bin/package.nix
index 976a8ed25215..aa35c96df451 100644
--- a/pkgs/by-name/ge/gemini-cli-bin/package.nix
+++ b/pkgs/by-name/ge/gemini-cli-bin/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "gemini-cli-bin";
-  version = "0.24.4";
+  version = "0.25.0";
 
   src = fetchurl {
     url = "https://github.com/google-gemini/gemini-cli/releases/download/v${finalAttrs.version}/gemini.js";
-    hash = "sha256-xteIV43P5qPOamxsGjCXeCkd1zQmNNbMhvzSWc26DQU=";
+    hash = "sha256-7Co3DPZs/ZtdLfhZnOcpdFFQPnyeLkvxTZG+tv+FbBQ=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/mh/mhabit/package.nix b/pkgs/by-name/mh/mhabit/package.nix
index b1d11829cb4a..82aec6204858 100644
--- a/pkgs/by-name/mh/mhabit/package.nix
+++ b/pkgs/by-name/mh/mhabit/package.nix
@@ -12,13 +12,13 @@
 }:
 
 let
-  version = "1.23.3+142";
+  version = "1.23.6+145";
 
   src = fetchFromGitHub {
     owner = "FriesI23";
     repo = "mhabit";
     tag = "v${version}";
-    hash = "sha256-jseb1AcM+AygVLFN3O5P2LiQppxOuLWMmBON0FRqPFQ=";
+    hash = "sha256-9+UXMOogySW3f9LPaj0YSfov1cSgLb3I+jWvAV8yEsM=";
   };
 in
 flutter338.buildFlutterApplication {
diff --git a/pkgs/by-name/ne/netgen-vlsi/package.nix b/pkgs/by-name/ne/netgen-vlsi/package.nix
index f878476fd6cf..8992ffddc133 100644
--- a/pkgs/by-name/ne/netgen-vlsi/package.nix
+++ b/pkgs/by-name/ne/netgen-vlsi/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "netgen";
-  version = "1.5.314";
+  version = "1.5.315";
 
   src = fetchFromGitHub {
     owner = "RTimothyEdwards";
     repo = "netgen";
     tag = finalAttrs.version;
-    hash = "sha256-g8d/faYjhL6WXSShqWn9n+4cUJ8qKtqyEgyIRsrHo5o=";
+    hash = "sha256-dXCZm5zVwn23y7DLPSUrTKGMcu/FjdVKsyry59lEt7U=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ng/ngt/package.nix b/pkgs/by-name/ng/ngt/package.nix
index bd4bb134f750..f892bfde284b 100644
--- a/pkgs/by-name/ng/ngt/package.nix
+++ b/pkgs/by-name/ng/ngt/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "NGT";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "yahoojapan";
     repo = "NGT";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-2cCuVeg7y3butTIAQaYIgx+DPqIFEA2qqVe3exAoAY8=";
+    sha256 = "sha256-T+ZFmvak1ZfY7I/9QKpC7qqXLq/tBdy+KUjx/0twceg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/op/openrgb/package.nix b/pkgs/by-name/op/openrgb/package.nix
index a014e40cf1f7..d4f91908405a 100644
--- a/pkgs/by-name/op/openrgb/package.nix
+++ b/pkgs/by-name/op/openrgb/package.nix
@@ -11,6 +11,7 @@
   mbedtls,
   symlinkJoin,
   qt6Packages,
+  autoAddDriverRunpath,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -35,6 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
+    autoAddDriverRunpath
   ]
   ++ (with qt6Packages; [
     qmake
diff --git a/pkgs/by-name/st/stalwart-mail/package.nix b/pkgs/by-name/st/stalwart-mail/package.nix
index 89f81f4a97cf..4be73405bd7e 100644
--- a/pkgs/by-name/st/stalwart-mail/package.nix
+++ b/pkgs/by-name/st/stalwart-mail/package.nix
@@ -21,16 +21,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stalwart-mail" + (lib.optionalString stalwartEnterprise "-enterprise");
-  version = "0.14.1";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "stalwart";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Wsk4n6jLOAFhxYb5Hw8XvQem0xccGGoD729nRz3bRF0=";
+    hash = "sha256-MIy1/8r5CMrTbVTjLFuUneoL3J38kZIgUMweoeaf3L0=";
   };
 
-  cargoHash = "sha256-LFXpv8/rHQwzdKEyS4VplQSwFUnZrgv0qDIhZUOGfpo=";
+  cargoHash = "sha256-jVD11wz9Ab1E9KdNG4kp8Jqm2rJ2aUWuFTAOBga6Fgg=";
 
   depsBuildBuild = [
     pkg-config
@@ -61,9 +61,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "postgres"
     "mysql"
     "rocks"
-    "elastic"
     "s3"
     "redis"
+    "azure"
+    "nats"
   ]
   ++ lib.optionals withFoundationdb [ "foundationdb" ]
   ++ lib.optionals stalwartEnterprise [ "enterprise" ];
@@ -87,7 +88,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mkdir -p $out/lib/systemd/system
 
     substitute resources/systemd/stalwart-mail.service $out/lib/systemd/system/stalwart-mail.service \
-      --replace "__PATH__" "$out"
+      --replace-fail "__PATH__" "$out"
   '';
 
   checkFlags = lib.forEach [
@@ -169,6 +170,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     #   left: ElementEnd
     #  right: Bytes([...])
     "responses::tests::parse_responses"
+    # thread 'store::search_tests' (912386) panicked at tests/src/store/mod.rs:116:10:
+    # Missing store type. Try running `STORE=<store_type> cargo test`: NotPresent
+    "store::search_tests"
   ] (test: "--skip=${test}");
 
   doCheck = !(stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
diff --git a/pkgs/by-name/st/stalwart-mail/webadmin.nix b/pkgs/by-name/st/stalwart-mail/webadmin.nix
index 818314de323d..e77e8ba4c90d 100644
--- a/pkgs/by-name/st/stalwart-mail/webadmin.nix
+++ b/pkgs/by-name/st/stalwart-mail/webadmin.nix
@@ -17,13 +17,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "webadmin";
-  version = "0.1.32";
+  version = "0.1.37";
 
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "webadmin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HmQBMU7o0A20SY4tBw4SPVfHFfw8e0JsNQDNdZcex24=";
+    hash = "sha256-82QvuLkp6j6nJs7jX4NRcnxZ+KNv9RREpM+x8dicfGo=";
   };
 
   npmDeps = fetchNpmDeps {
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-na1HEueX8w7kuDp8LEtJ0nD1Yv39cyk6sEMpS1zix2s=";
   };
 
-  cargoHash = "sha256-a2+3uNNSLfb81QXjZfftbwpgjORPRSgC056U3FINP4o=";
+  cargoHash = "sha256-qYIg1BthkpS77I6duYGGX168Y/IO8Mx4SWMQbE0BwDA=";
 
   postPatch = ''
     # Using local tailwindcss for compilation
diff --git a/pkgs/by-name/wo/worker-build/package.nix b/pkgs/by-name/wo/worker-build/package.nix
index fbdb8aeec39b..81ce70935c72 100644
--- a/pkgs/by-name/wo/worker-build/package.nix
+++ b/pkgs/by-name/wo/worker-build/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "worker-build";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "workers-rs";
     tag = "v${version}";
-    hash = "sha256-OWtlW9aJwDIfwRK6y1ajx8OLL1mMhbr6RDPuk+8Pyo0=";
+    hash = "sha256-LeW0CHYBaib81AqftYpW38FFR3P7q7OJE2NmrK9oi9Q=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-dcew0BCU1NqADquJ08MWLskrNox8LP/fA2QIC6LqETQ=";
+  cargoHash = "sha256-W1m7W7LepgZ3WPjmZ7qXlu3WnvZkpGO35sHryOFqhfk=";
 
   buildAndTestSubdir = "worker-build";
 
diff --git a/pkgs/by-name/wv/wvkbd/package.nix b/pkgs/by-name/wv/wvkbd/package.nix
index 1c6dd084f69e..f7023d52f5fe 100644
--- a/pkgs/by-name/wv/wvkbd/package.nix
+++ b/pkgs/by-name/wv/wvkbd/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wvkbd";
-  version = "0.18";
+  version = "0.19";
 
   src = fetchFromGitHub {
     owner = "jjsullivan5196";
     repo = "wvkbd";
     tag = "v${version}";
-    hash = "sha256-RfZbPAaf8UB4scUZ9XSL12QZ4UkYMzXqfmNt9ObOgQ0=";
+    hash = "sha256-oaySfijJBzD+tsaNMmXQ168un9Z0IMwN+7sxAmVr3xs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix b/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix
index c9b661eee919..cbce1c8e2635 100644
--- a/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix
+++ b/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix
@@ -5,23 +5,25 @@
   setuptools,
   click,
   jinja2,
+  python-dotenv,
   pyyaml,
   rich,
   pytest-cov-stub,
   pytestCheckHook,
   scikit-learn,
+  requests,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "agentic-threat-hunting-framework";
-  version = "0.2.2";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Nebulock-Inc";
     repo = "agentic-threat-hunting-framework";
-    tag = "v${version}";
-    hash = "sha256-rt7WmBCbSqoZBpwGi7dzh8QDw8Iby3LSdavnCot1Hr0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WU58wQGlUgbOqcIE7EKtABNvTKtvTiRO9iJLW4gXDlI=";
   };
 
   build-system = [ setuptools ];
@@ -29,6 +31,7 @@ buildPythonPackage rec {
   dependencies = [
     click
     jinja2
+    python-dotenv
     pyyaml
     rich
   ];
@@ -40,6 +43,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytest-cov-stub
     pytestCheckHook
+    requests
   ];
 
   pythonImportsCheck = [ "athf" ];
@@ -47,8 +51,8 @@ buildPythonPackage rec {
   meta = {
     description = "Framework for agentic threat hunting";
     homepage = "https://github.com/Nebulock-Inc/agentic-threat-hunting-framework";
-    changelog = "https://github.com/Nebulock-Inc/agentic-threat-hunting-framework/releases/tag/${src.tag}";
+    changelog = "https://github.com/Nebulock-Inc/agentic-threat-hunting-framework/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/banks/default.nix b/pkgs/development/python-modules/banks/default.nix
index 83db9ac6b498..213b90d4e75d 100644
--- a/pkgs/development/python-modules/banks/default.nix
+++ b/pkgs/development/python-modules/banks/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "banks";
-  version = "2.2.0";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "masci";
     repo = "banks";
     tag = "v${version}";
-    hash = "sha256-lzU1SwgZ7EKCmpDtCp4jKDBIdZVB+S1s/Oh3GfZCmtg=";
+    hash = "sha256-6+BQS9srj2VT2XcGe9g5Ios6g/vk3GcOXgCWEKq6YHI=";
   };
 
   SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
diff --git a/pkgs/development/python-modules/datalad/default.nix b/pkgs/development/python-modules/datalad/default.nix
index 864870560936..73797b37af1e 100644
--- a/pkgs/development/python-modules/datalad/default.nix
+++ b/pkgs/development/python-modules/datalad/default.nix
@@ -41,6 +41,7 @@
   pythonOlder,
   typing-extensions,
   # tests
+  pytest-retry,
   pytest-xdist,
   pytestCheckHook,
   p7zip,
@@ -48,16 +49,16 @@
   httpretty,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "datalad";
-  version = "1.2.3";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "datalad";
     repo = "datalad";
-    tag = version;
-    hash = "sha256-C3e9k4RDFfDMaimZ/7TtAJNzdlfVrKoTHVl0zKL9EjI=";
+    tag = finalAttrs.version;
+    hash = "sha256-aTpiwcwRJyUF68+OsT+u9j/cibZEDhmL45I1MSY3Q7E=";
   };
 
   postPatch = ''
@@ -76,7 +77,9 @@ buildPythonPackage rec {
   ];
 
   dependencies =
-    optional-dependencies.core ++ optional-dependencies.downloaders ++ optional-dependencies.publish;
+    finalAttrs.passthru.optional-dependencies.core
+    ++ finalAttrs.passthru.optional-dependencies.downloaders
+    ++ finalAttrs.passthru.optional-dependencies.publish;
 
   optional-dependencies = {
     core = [
@@ -124,113 +127,43 @@ buildPythonPackage rec {
 
   preCheck = ''
     export HOME=$TMPDIR
+    export DATALAD_TESTS_NONETWORK=1
+    export PATH="$PATH:$out/bin"
   '';
 
-  # tests depend on apps in $PATH which only will get installed after the test
+  disabledTestMarks = [
+    "flaky"
+  ];
+
   disabledTests = [
-    # No such file or directory: 'datalad'
-    "test_script_shims"
-    "test_cfg_override"
-    "test_completion"
-    "test_nested_pushclone_cycle_allplatforms"
-    "test_create_sub_gh3463"
-    "test_create_sub_dataset_dot_no_path"
-    "test_cfg_passthrough"
-    "test_addurls_stdin_input_command_line"
-    "test_run_datalad_help"
-    "test_status_custom_summary_no_repeats"
-    "test_quoting"
-
-    #  No such file or directory: 'git-annex-remote-[...]"
-    "test_create"
-    "test_ensure_datalad_remote_maybe_enable"
-
-    # "git-annex: unable to use external special remote git-annex-remote-datalad"
-    "test_ria_postclonecfg"
-    "test_ria_postclone_noannex"
-    "test_ria_push"
-    "test_basic_scenario"
-    "test_annex_get_from_subdir"
-    "test_ensure_datalad_remote_init_and_enable_needed"
-    "test_ensure_datalad_remote_maybe_enable[False]"
-    "test_ensure_datalad_remote_maybe_enable[True]"
-    "test_create_simple"
-    "test_create_alias"
-    "test_storage_only"
-    "test_initremote"
-    "test_read_access"
-    "test_ephemeral"
-    "test_initremote_basic_fileurl"
-    "test_initremote_basic_httpurl"
-    "test_remote_layout"
-    "test_version_check"
-    "test_gitannex_local"
-    "test_push_url"
-    "test_url_keys"
-    "test_obtain_permission_root"
-    "test_source_candidate_subdataset"
-    "test_update_fetch_all"
-    "test_add_archive_dirs"
-    "test_add_archive_content"
-    "test_add_archive_content_strip_leading"
-    "test_add_archive_content_zip"
-    "test_add_archive_content_absolute_path"
-    "test_add_archive_use_archive_dir"
-    "test_add_archive_single_file"
-    "test_add_delete"
-    "test_add_archive_leading_dir"
-    "test_add_delete_after_and_drop"
-    "test_add_delete_after_and_drop_subdir"
-    "test_override_existing_under_git"
-    "test_copy_file_datalad_specialremote"
-    "test_download_url_archive"
-    "test_download_url_archive_from_subdir"
-    "test_download_url_archive_trailing_separator"
-    "test_download_url_need_datalad_remote"
-    "test_datalad_credential_helper - assert False"
-
-    # need internet access
-    "test_clone_crcns"
-    "test_clone_datasets_root"
+    # Tries to run `git` and fails
     "test_reckless"
-    "test_autoenabled_remote_msg"
-    "test_ria_http_storedataladorg"
-    "test_gin_cloning"
-    "test_nonuniform_adjusted_subdataset"
-    "test_install_datasets_root"
-    "test_install_simple_local"
-    "test_install_dataset_from_just_source"
-    "test_install_dataset_from_just_source_via_path"
-    "test_datasets_datalad_org"
-    "test_get_cached_dataset"
-    "test_cached_dataset"
-    "test_cached_url"
-    "test_anonymous_s3"
-    "test_protocols"
-    "test_get_versioned_url_anon"
-    "test_install_recursive_github"
-    "test_failed_install_multiple"
+    "test_create"
+    "test_subsuperdataset_save"
 
+    # Tries to spawn a subshell and fails
+    "test_shell_completion_source"
+
+    # Times out
+    "test_rerun_unrelated_nonrun_left_run_right"
+
+    # Top five slowest (2/3 of total runtime)
+    "test_files_split"
+    "test_gitannex_local"
+    "test_save_hierarchy"
+    "test_recurse_existing"
+    "test_source_candidate_subdataset"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # pbcopy not found
     "test_wtf"
-
-    # CommandError: 'git -c diff.ignoreSubmodules=none -c core.quotepath=false ls-files -z -m -d' failed with exitcode 128
-    "test_subsuperdataset_save"
-  ]
-  ++ lib.optionals (pythonAtLeast "3.14") [
-    # For all: https://github.com/datalad/datalad/issues/7781
-    # AssertionError: `assert 1 == 0` (refcount error)
-    "test_GitRepo_flyweight"
-    "test_Dataset_flyweight"
-    "test_AnnexRepo_flyweight"
-    # TypeError: cannot pickle '_thread.lock' object
-    "test_popen_invocation"
-    # datalad.runner.exception.CommandError: '/python3.14 -i -u -q -']' timed out after 0.5 seconds
-    "test_asyncio_loop_noninterference1"
+    # hangs
+    "test_keyring"
   ];
 
   nativeCheckInputs = [
     p7zip
+    pytest-retry
     pytest-xdist
     pytestCheckHook
     git-annex
@@ -243,15 +176,20 @@ buildPythonPackage rec {
     "-Wignore::DeprecationWarning"
   ];
 
+  # Tests use ports on localhost
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "datalad" ];
 
   meta = {
     description = "Keep code, data, containers under control with git and git-annex";
     homepage = "https://www.datalad.org";
+    changelog = "https://github.com/datalad/datalad/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       renesat
       malik
+      sarahec
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/google-cloud-org-policy/default.nix b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
index 6e98b77e95aa..359a05c07da6 100644
--- a/pkgs/development/python-modules/google-cloud-org-policy/default.nix
+++ b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
@@ -10,15 +10,15 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "google-cloud-org-policy";
-  version = "1.15.0";
+  version = "1.16.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_org_policy";
-    inherit version;
-    hash = "sha256-Jx0WoQ51NH6s5g0CzeMisrG2E7zJmRcQng6/KkECJTo=";
+    inherit (finalAttrs) version;
+    hash = "sha256-xyFHEn2I2YCa+HOLKr40gG6sUpw83FeqkVzAihuEKhM=";
   };
 
   build-system = [ setuptools ];
@@ -45,8 +45,8 @@ buildPythonPackage rec {
   meta = {
     description = "Protobufs for Google Cloud Organization Policy";
     homepage = "https://github.com/googleapis/python-org-policy";
-    changelog = "https://github.com/googleapis/python-org-policy/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/python-org-policy/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ austinbutler ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/nbxmpp/default.nix b/pkgs/development/python-modules/nbxmpp/default.nix
index ad9be9312a9b..6de2732e7a3c 100644
--- a/pkgs/development/python-modules/nbxmpp/default.nix
+++ b/pkgs/development/python-modules/nbxmpp/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "nbxmpp";
-  version = "6.4.0";
+  version = "7.0.0";
   pyproject = true;
 
   src = fetchFromGitLab {
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "gajim";
     repo = "python-nbxmpp";
     tag = version;
-    hash = "sha256-q910WbBp0TBqXw8WfYniliVGnr4Hi6dDhVDqZszSL0c=";
+    hash = "sha256-NzSXvuPf7PZbMPgD3nhPgTH4Vd8DVx49fjf7cPcvywc=";
   };
 
   nativeBuildInputs = [
@@ -40,12 +40,7 @@ buildPythonPackage rec {
     idna
     libsoup_3
     packaging
-    (pygobject3.overrideAttrs (o: {
-      src = fetchurl {
-        url = "mirror://gnome/sources/pygobject/3.52/pygobject-3.52.3.tar.gz";
-        hash = "sha256-AOQn0pHpV0Yqj61lmp+ci+d2/4Kot2vfQC8eruwIbYI=";
-      };
-    }))
+    pygobject3
     pyopenssl
   ];
 
diff --git a/pkgs/development/python-modules/omemo-dr/default.nix b/pkgs/development/python-modules/omemo-dr/default.nix
index 12acd1cbb7e7..7c33e56c1dd5 100644
--- a/pkgs/development/python-modules/omemo-dr/default.nix
+++ b/pkgs/development/python-modules/omemo-dr/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   cryptography,
-  fetchPypi,
+  fetchFromGitLab,
   protobuf,
   pytestCheckHook,
   setuptools,
@@ -10,12 +10,15 @@
 
 buildPythonPackage rec {
   pname = "omemo-dr";
-  version = "1.0.1";
+  version = "1.2.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-KoqMdyMdc5Sb3TdSeNTVomElK9ruUstiQayyUcIC02E=";
+  src = fetchFromGitLab {
+    domain = "dev.gajim.org";
+    owner = "gajim";
+    repo = "omemo-dr";
+    tag = "v${version}";
+    hash = "sha256-8+uBO7Nl6YcEwthWmChqCTLvUelF8QJl+dHzkqbPVqM=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/readability-lxml/default.nix b/pkgs/development/python-modules/readability-lxml/default.nix
index 1d426588e4e1..e016767db614 100644
--- a/pkgs/development/python-modules/readability-lxml/default.nix
+++ b/pkgs/development/python-modules/readability-lxml/default.nix
@@ -1,8 +1,8 @@
 {
-  stdenv,
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  poetry-core,
   pytestCheckHook,
   chardet,
   cssselect,
@@ -13,37 +13,32 @@
 
 buildPythonPackage rec {
   pname = "readability-lxml";
-  version = "0.8.4";
-  format = "setuptools";
+  version = "0.8.4.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "buriy";
     repo = "python-readability";
-    rev = "v${version}";
-    hash = "sha256-6A4zpe3GvHHf235Ovr2RT/cJgj7bWasn96yqy73pVgY=";
+    rev = "${version}";
+    hash = "sha256-tL0OnvCrbrpBvcy+6RJ+u/BDdra+MnVT51DSAeYxJbc=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  pythonRelaxDeps = [ "lxml" ];
+
+  dependencies = [
     chardet
     cssselect
     lxml
     lxml-html-clean
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py --replace 'sys.platform == "darwin"' "False"
-  '';
-
   nativeCheckInputs = [
     pytestCheckHook
     timeout-decorator
   ];
 
-  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
-    # Test is broken on darwin. Fix in master from https://github.com/buriy/python-readability/pull/178
-    "test_many_repeated_spaces"
-  ];
-
   meta = {
     description = "Fast python port of arc90's readability tool";
     homepage = "https://github.com/buriy/python-readability";
diff --git a/pkgs/development/python-modules/rucio/default.nix b/pkgs/development/python-modules/rucio/default.nix
index becc4d8ac713..b82b661370a3 100644
--- a/pkgs/development/python-modules/rucio/default.nix
+++ b/pkgs/development/python-modules/rucio/default.nix
@@ -40,13 +40,13 @@
 }:
 
 let
-  version = "39.0.0";
+  version = "39.1.0";
 
   src = fetchFromGitHub {
     owner = "rucio";
     repo = "rucio";
     tag = version;
-    hash = "sha256-3KRcoS1VwjRynBgDIvCRu1dOIVF8mlAG7P17ROLE1ZY=";
+    hash = "sha256-ef8rVRDVkkEcsQ5AKz1W2L21abyY2dfHMWh2Rv0oxPA=";
   };
 in
 buildPythonPackage {