diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index e8d8392a45e3..142679661d68 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -32,6 +32,10 @@
 
   Refer to the [GNOME release notes](https://release.gnome.org/49/) for more details.
 
+- FirewallD support has been added. It can be configured both as a standalone service (through `services.firewalld`), and as a backend to the existing `networking.firewall` options.
+
+- `networking.firewall` now has a `backend` option for choosing which backend to use.
+
 ## New Modules {#sec-release-25.11-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -53,6 +57,8 @@
 
 - [umami](https://github.com/umami-software/umami), a simple, fast, privacy-focused alternative to Google Analytics. Available with [services.umami](#opt-services.umami.enable).
 
+- [FirewallD](https://firewalld.org/), a firewall daemon with D-Bus interface providing a dynamic firewall. Available as [services.firewalld](#opt-services.firewalld.enable) and a [networking.firewall.backend](#opt-networking.firewall.backend).
+
 - [FileBrowser](https://filebrowser.org/), a web application for managing and sharing files. Available as [services.filebrowser](#opt-services.filebrowser.enable).
 
 - Options under [networking.getaddrinfo](#opt-networking.getaddrinfo.enable) are now allowed to declaratively configure address selection and sorting behavior of `getaddrinfo` in dual-stack networks.
diff --git a/nixos/modules/hardware/facter/default.nix b/nixos/modules/hardware/facter/default.nix
index f3bd58443dc7..30db0d10e48a 100644
--- a/nixos/modules/hardware/facter/default.nix
+++ b/nixos/modules/hardware/facter/default.nix
@@ -7,6 +7,7 @@
   imports = [
     ./disk.nix
     ./firmware.nix
+    ./graphics
     ./keyboard.nix
     ./networking
     ./system.nix
diff --git a/nixos/modules/hardware/facter/disk.nix b/nixos/modules/hardware/facter/disk.nix
index 4bb76f16366d..4158bd171bb9 100644
--- a/nixos/modules/hardware/facter/disk.nix
+++ b/nixos/modules/hardware/facter/disk.nix
@@ -22,7 +22,7 @@ in
     '';
   };
 
-  config = {
+  config = lib.mkIf (config.hardware.facter.reportPath != null) {
     boot.initrd.availableKernelModules = config.hardware.facter.detected.boot.disk.kernelModules;
   };
 }
diff --git a/nixos/modules/hardware/facter/firmware.nix b/nixos/modules/hardware/facter/firmware.nix
index 10962018890c..b614cab85253 100644
--- a/nixos/modules/hardware/facter/firmware.nix
+++ b/nixos/modules/hardware/facter/firmware.nix
@@ -8,7 +8,7 @@ let
   hasIntelCpu = facterLib.hasIntelCpu report;
 in
 {
-  config = lib.mkIf isBaremetal {
+  config = lib.mkIf (config.hardware.facter.reportPath != null && isBaremetal) {
     # none (e.g. bare-metal)
     # provide firmware for devices that might not have been detected by nixos-facter
     hardware.enableRedistributableFirmware = lib.mkDefault true;
diff --git a/nixos/modules/hardware/facter/graphics/amd.nix b/nixos/modules/hardware/facter/graphics/amd.nix
new file mode 100644
index 000000000000..b2ec114677a0
--- /dev/null
+++ b/nixos/modules/hardware/facter/graphics/amd.nix
@@ -0,0 +1,18 @@
+{ lib, config, ... }:
+let
+  facterLib = import ../lib.nix lib;
+  cfg = config.hardware.facter.detected.graphics.amd;
+in
+{
+  options.hardware.facter.detected.graphics = {
+    amd.enable = lib.mkEnableOption "Enable the AMD Graphics module" // {
+      default = builtins.elem "amdgpu" (
+        facterLib.collectDrivers (config.hardware.facter.report.hardware.graphics_card or [ ])
+      );
+      defaultText = "hardware dependent";
+    };
+  };
+  config = lib.mkIf (config.hardware.facter.reportPath != null && cfg.enable) {
+    services.xserver.videoDrivers = [ "modesetting" ];
+  };
+}
diff --git a/nixos/modules/hardware/facter/graphics/default.nix b/nixos/modules/hardware/facter/graphics/default.nix
new file mode 100644
index 000000000000..cd29040ce67d
--- /dev/null
+++ b/nixos/modules/hardware/facter/graphics/default.nix
@@ -0,0 +1,42 @@
+{ lib, config, ... }:
+let
+  facterLib = import ../lib.nix lib;
+  cfg = config.hardware.facter.detected.graphics;
+in
+{
+  imports = [
+    ./amd.nix
+  ];
+  options.hardware.facter.detected = {
+    graphics.enable = lib.mkEnableOption "Enable the Graphics module" // {
+      default = builtins.length (config.hardware.facter.report.hardware.monitor or [ ]) > 0;
+      defaultText = "hardware dependent";
+    };
+    boot.graphics.kernelModules = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      # We currently don't auto import nouveau, in case the user might want to use the proprietary nvidia driver,
+      # We might want to change this in future, if we have a better idea, how to handle this.
+      default = lib.remove "nouveau" (
+        lib.uniqueStrings (
+          facterLib.collectDrivers (config.hardware.facter.report.hardware.graphics_card or [ ])
+        )
+      );
+      defaultText = "hardware dependent";
+      description = ''
+        List of kernel modules to load at boot for the graphics card.
+      '';
+    };
+  };
+
+  config = lib.mkIf (config.hardware.facter.reportPath != null && cfg.enable) (
+    {
+      boot.initrd.kernelModules = config.hardware.facter.detected.boot.graphics.kernelModules;
+    }
+    // (
+      if lib.versionOlder lib.version "24.11pre" then
+        { hardware.opengl.enable = lib.mkDefault true; }
+      else
+        { hardware.graphics.enable = lib.mkDefault true; }
+    )
+  );
+}
diff --git a/nixos/modules/hardware/facter/keyboard.nix b/nixos/modules/hardware/facter/keyboard.nix
index d19e17cd6901..62baf5bd32f1 100644
--- a/nixos/modules/hardware/facter/keyboard.nix
+++ b/nixos/modules/hardware/facter/keyboard.nix
@@ -15,7 +15,7 @@ in
     '';
   };
 
-  config = {
+  config = lib.mkIf (config.hardware.facter.reportPath != null) {
     boot.initrd.availableKernelModules = config.hardware.facter.detected.boot.keyboard.kernelModules;
   };
 }
diff --git a/nixos/modules/hardware/facter/networking/default.nix b/nixos/modules/hardware/facter/networking/default.nix
index dfbc54c8396d..7f662d8785a0 100644
--- a/nixos/modules/hardware/facter/networking/default.nix
+++ b/nixos/modules/hardware/facter/networking/default.nix
@@ -60,10 +60,12 @@ in
       ];
     };
   };
-  config = lib.mkIf config.hardware.facter.detected.dhcp.enable {
-    networking.useDHCP = lib.mkDefault true;
+  config =
+    lib.mkIf (config.hardware.facter.reportPath != null && config.hardware.facter.detected.dhcp.enable)
+      {
+        networking.useDHCP = lib.mkDefault true;
 
-    # Per-interface DHCP configuration
-    networking.interfaces = perInterfaceConfig;
-  };
+        # Per-interface DHCP configuration
+        networking.interfaces = perInterfaceConfig;
+      };
 }
diff --git a/nixos/modules/hardware/facter/networking/initrd.nix b/nixos/modules/hardware/facter/networking/initrd.nix
index 56be802b7cd9..8c3135354f93 100644
--- a/nixos/modules/hardware/facter/networking/initrd.nix
+++ b/nixos/modules/hardware/facter/networking/initrd.nix
@@ -14,7 +14,7 @@ in
     '';
   };
 
-  config = lib.mkIf config.boot.initrd.network.enable {
+  config = lib.mkIf (config.hardware.facter.reportPath != null && config.boot.initrd.network.enable) {
     boot.initrd.kernelModules = config.hardware.facter.detected.boot.initrd.networking.kernelModules;
   };
 }
diff --git a/nixos/modules/hardware/facter/networking/intel.nix b/nixos/modules/hardware/facter/networking/intel.nix
index 4ae693a3c636..a28e8ecf580d 100644
--- a/nixos/modules/hardware/facter/networking/intel.nix
+++ b/nixos/modules/hardware/facter/networking/intel.nix
@@ -49,7 +49,7 @@ in
     };
   };
 
-  config = {
+  config = lib.mkIf (config.hardware.facter.reportPath != null) {
     networking.enableIntel2200BGFirmware = lib.mkIf cfg._2200BG.enable (lib.mkDefault true);
     hardware.enableRedistributableFirmware = lib.mkIf cfg._3945ABG.enable (lib.mkDefault true);
   };
diff --git a/nixos/modules/hardware/facter/system.nix b/nixos/modules/hardware/facter/system.nix
index ef51b0e44f1d..2019bfa522d3 100644
--- a/nixos/modules/hardware/facter/system.nix
+++ b/nixos/modules/hardware/facter/system.nix
@@ -6,9 +6,12 @@
 }:
 {
   # Skip setting hostPlatform if it's read-only
-  nixpkgs =
+  config.nixpkgs =
     lib.optionalAttrs
-      (config.hardware.facter.report.system or null != null && !options.nixpkgs.hostPlatform.readOnly)
+      (
+        config.hardware.facter.report.system or null != null
+        && !(options.nixpkgs.hostPlatform.readOnly or false)
+      )
       {
         hostPlatform = lib.mkDefault config.hardware.facter.report.system;
       };
diff --git a/nixos/modules/hardware/facter/virtualisation.nix b/nixos/modules/hardware/facter/virtualisation.nix
index 15cf6bab5aee..e1a9a1647708 100644
--- a/nixos/modules/hardware/facter/virtualisation.nix
+++ b/nixos/modules/hardware/facter/virtualisation.nix
@@ -51,13 +51,20 @@ in
     };
   };
 
-  config = {
+  config = lib.mkIf (config.hardware.facter.reportPath != null) {
 
     # KVM support
     boot.kernelModules =
       let
         hasCPUFeature =
-          feature: lib.any ({ features, ... }: lib.elem feature features) (report.hardware.cpu or [ ]);
+          feature:
+          lib.any (
+            {
+              features ? [ ],
+              ...
+            }:
+            lib.elem feature features
+          ) (report.hardware.cpu or [ ]);
       in
       lib.mkMerge [
         (lib.mkIf (hasCPUFeature "vmx") [ "kvm-intel" ])
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 0b9bd6d976f6..d0a4f0b7db12 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1162,9 +1162,11 @@
   ./services/networking/ferm.nix
   ./services/networking/firefox-syncserver.nix
   ./services/networking/fireqos.nix
+  ./services/networking/firewall-firewalld.nix
   ./services/networking/firewall-iptables.nix
   ./services/networking/firewall-nftables.nix
   ./services/networking/firewall.nix
+  ./services/networking/firewalld
   ./services/networking/firezone/gateway.nix
   ./services/networking/firezone/gui-client.nix
   ./services/networking/firezone/headless-client.nix
diff --git a/nixos/modules/services/networking/firewall-firewalld.nix b/nixos/modules/services/networking/firewall-firewalld.nix
new file mode 100644
index 000000000000..2db34eb1cad1
--- /dev/null
+++ b/nixos/modules/services/networking/firewall-firewalld.nix
@@ -0,0 +1,61 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.networking.firewall;
+in
+{
+  config = lib.mkIf (cfg.enable && cfg.backend == "firewalld") {
+    assertions = [
+      {
+        assertion = cfg.interfaces == { };
+        message = ''
+          Per interface configurations is not supported with the firewalld based firewall.
+          Create zones with `services.firewalld.zones` instead.
+        '';
+      }
+    ];
+
+    boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" =
+      if cfg.checkReversePath == false then
+        0
+      else if cfg.checkReversePath == "loose" then
+        1
+      else
+        2;
+
+    services.firewalld = {
+      settings = {
+        DefaultZone = lib.mkDefault "nixos-fw-default";
+        LogDenied =
+          if cfg.logRefusedConnections then
+            (if cfg.logRefusedUnicastsOnly then "unicast" else "all")
+          else
+            "off";
+        IPv6_rpfilter =
+          if cfg.checkReversePath == false then
+            "no"
+          else
+            let
+              mode = if cfg.checkReversePath == true then "strict" else cfg.checkReversePath;
+              suffix = if cfg.filterForward then "" else "-forward";
+            in
+            "${mode}${suffix}";
+      };
+      zones = {
+        nixos-fw-default = {
+          target = if cfg.rejectPackets then "%%REJECT%%" else "DROP";
+          icmpBlockInversion = true;
+          icmpBlocks = lib.mkIf cfg.allowPing [ "echo-request" ];
+          ports =
+            let
+              f = protocol: port: { inherit protocol port; };
+              tcpPorts = map (f "tcp") (cfg.allowedTCPPorts ++ cfg.allowedTCPPortRanges);
+              udpPorts = map (f "udp") (cfg.allowedUDPPorts ++ cfg.allowedUDPPortRanges);
+            in
+            tcpPorts ++ udpPorts;
+        };
+        trusted.interfaces = cfg.trustedInterfaces;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/firewall-iptables.nix b/nixos/modules/services/networking/firewall-iptables.nix
index 53d7d3434dae..36b4cfc6f9b7 100644
--- a/nixos/modules/services/networking/firewall-iptables.nix
+++ b/nixos/modules/services/networking/firewall-iptables.nix
@@ -285,9 +285,7 @@ let
 in
 
 {
-
   options = {
-
     networking.firewall = {
       extraCommands = lib.mkOption {
         type = lib.types.lines;
@@ -317,13 +315,11 @@ in
         '';
       };
     };
-
   };
 
   # FIXME: Maybe if `enable' is false, the firewall should still be
   # built but not started by default?
-  config = lib.mkIf (cfg.enable && config.networking.nftables.enable == false) {
-
+  config = lib.mkIf (cfg.enable && cfg.backend == "iptables") {
     assertions = [
       # This is approximately "checkReversePath -> kernelHasRPFilter",
       # but the checkReversePath option can include non-boolean
@@ -336,6 +332,8 @@ in
 
     networking.firewall.checkReversePath = lib.mkIf (!kernelHasRPFilter) (lib.mkDefault false);
 
+    environment.systemPackages = [ pkgs.nixos-firewall-tool ];
+
     systemd.services.firewall = {
       description = "Firewall";
       wantedBy = [ "sysinit.target" ];
@@ -365,7 +363,5 @@ in
         ExecStop = "@${stopScript} firewall-stop";
       };
     };
-
   };
-
 }
diff --git a/nixos/modules/services/networking/firewall-nftables.nix b/nixos/modules/services/networking/firewall-nftables.nix
index d9695c0e4d27..a22fc29d35ff 100644
--- a/nixos/modules/services/networking/firewall-nftables.nix
+++ b/nixos/modules/services/networking/firewall-nftables.nix
@@ -19,9 +19,7 @@ let
 in
 
 {
-
   options = {
-
     networking.firewall = {
       extraInputRules = lib.mkOption {
         type = lib.types.lines;
@@ -59,11 +57,9 @@ in
         '';
       };
     };
-
   };
 
-  config = lib.mkIf (cfg.enable && config.networking.nftables.enable) {
-
+  config = lib.mkIf (cfg.enable && cfg.backend == "nftables") {
     assertions = [
       {
         assertion = cfg.extraCommands == "";
@@ -83,6 +79,8 @@ in
       }
     ];
 
+    environment.systemPackages = [ pkgs.nixos-firewall-tool ];
+
     networking.nftables.tables."nixos-fw".family = "inet";
     networking.nftables.tables."nixos-fw".content = ''
       set temp-ports {
@@ -203,7 +201,5 @@ in
         }
       ''}
     '';
-
   };
-
 }
diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix
index e733e9e6b87b..95308c2a9cfc 100644
--- a/nixos/modules/services/networking/firewall.nix
+++ b/nixos/modules/services/networking/firewall.nix
@@ -68,9 +68,7 @@ let
 in
 
 {
-
   options = {
-
     networking.firewall = {
       enable = lib.mkOption {
         type = lib.types.bool;
@@ -82,6 +80,32 @@ in
         '';
       };
 
+      backend = lib.mkOption {
+        type = lib.types.enum [
+          "iptables"
+          "nftables"
+          "firewalld"
+        ];
+        default =
+          if config.services.firewalld.enable then
+            "firewalld"
+          else if config.networking.nftables.enable then
+            "nftables"
+          else
+            "iptables";
+        defaultText = lib.literalExpression ''
+          if config.services.firewalld.enable then
+            "firewalld"
+          else if config.networking.nftables.enable then
+            "nftables"
+          else
+            "iptables"
+        '';
+        description = ''
+          Underlying implementation for the firewall service.
+        '';
+      };
+
       package = lib.mkOption {
         type = lib.types.package;
         default = if config.networking.nftables.enable then pkgs.nftables else pkgs.iptables;
@@ -292,11 +316,9 @@ in
       };
     }
     // commonOptions;
-
   };
 
   config = lib.mkIf cfg.enable {
-
     assertions = [
       {
         assertion = cfg.filterForward -> config.networking.nftables.enable;
@@ -311,11 +333,7 @@ in
 
     networking.firewall.trustedInterfaces = [ "lo" ];
 
-    environment.systemPackages = [
-      cfg.package
-      pkgs.nixos-firewall-tool
-    ]
-    ++ cfg.extraPackages;
+    environment.systemPackages = [ cfg.package ] ++ cfg.extraPackages;
 
     boot.kernelModules =
       (lib.optional cfg.autoLoadConntrackHelpers "nf_conntrack")
@@ -323,7 +341,5 @@ in
     boot.extraModprobeConfig = lib.optionalString cfg.autoLoadConntrackHelpers ''
       options nf_conntrack nf_conntrack_helper=1
     '';
-
   };
-
 }
diff --git a/nixos/modules/services/networking/firewalld/default.nix b/nixos/modules/services/networking/firewalld/default.nix
new file mode 100644
index 000000000000..e0e8bf4cb47c
--- /dev/null
+++ b/nixos/modules/services/networking/firewalld/default.nix
@@ -0,0 +1,66 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.firewalld;
+  paths = pkgs.buildEnv {
+    name = "firewalld-paths";
+    paths = cfg.packages;
+    pathsToLink = [ "/lib/firewalld" ];
+  };
+in
+{
+  imports = [
+    ./service.nix
+    ./settings.nix
+    ./zone.nix
+  ];
+
+  options.services.firewalld = {
+    enable = lib.mkEnableOption "FirewallD";
+    package = lib.mkPackageOption pkgs "firewalld" { };
+    packages = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ ];
+      description = ''
+        Packages providing firewalld zones and other files.
+        Files found in `/lib/firewalld` will be included.
+      '';
+    };
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "--debug" ];
+      description = "Extra arguments to pass to FirewallD.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    services.dbus.packages = [ cfg.package ];
+    services.firewalld.packages = [ cfg.package ];
+
+    services.logrotate.settings."/var/log/firewalld" = {
+      copytruncate = true;
+      minsize = "1M";
+    };
+
+    environment.etc."sysconfig/firewalld".text = ''
+      FIREWALLD_ARGS=${lib.concatStringsSep " " cfg.extraArgs}
+    '';
+
+    systemd.packages = [ cfg.package ];
+    systemd.services.firewalld = {
+      aliases = [ "dbus-org.fedoraproject.FirewallD1.service" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig.ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
+      environment.NIX_FIREWALLD_CONFIG_PATH = "${paths}/lib/firewalld";
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ prince213 ];
+}
diff --git a/nixos/modules/services/networking/firewalld/lib.nix b/nixos/modules/services/networking/firewalld/lib.nix
new file mode 100644
index 000000000000..c8977dd346e7
--- /dev/null
+++ b/nixos/modules/services/networking/firewalld/lib.nix
@@ -0,0 +1,55 @@
+{ lib }:
+
+let
+  inherit (lib) mkOption;
+  inherit (lib.types)
+    either
+    enum
+    nullOr
+    port
+    submodule
+    ;
+  mkPortOption =
+    {
+      optional ? false,
+    }:
+    mkOption {
+      type =
+        let
+          type = either port (submodule {
+            options = {
+              from = mkOption { type = port; };
+              to = mkOption { type = port; };
+            };
+          });
+        in
+        if optional then (nullOr type) else type;
+      description = "";
+      apply =
+        value: if builtins.isAttrs value then "${toString value.from}-${toString value.to}" else value;
+    };
+  protocolOption = mkOption {
+    type = enum [
+      "tcp"
+      "udp"
+      "sctp"
+      "dccp"
+    ];
+    description = "";
+  };
+in
+{
+  inherit mkPortOption;
+  inherit protocolOption;
+
+  toXmlAttrs = lib.mapAttrs' (name: lib.nameValuePair ("@" + name));
+  mkXmlAttr = name: value: { "@${name}" = value; };
+  filterNullAttrs = lib.filterAttrsRecursive (_: value: value != null);
+
+  portProtocolOptions = {
+    options = {
+      port = mkPortOption { };
+      protocol = protocolOption;
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/firewalld/service.nix b/nixos/modules/services/networking/firewalld/service.nix
new file mode 100644
index 000000000000..92db5b251d10
--- /dev/null
+++ b/nixos/modules/services/networking/firewalld/service.nix
@@ -0,0 +1,121 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.firewalld;
+  format = pkgs.formats.xml { };
+  lib' = import ./lib.nix { inherit lib; };
+  inherit (lib')
+    filterNullAttrs
+    mkXmlAttr
+    portProtocolOptions
+    toXmlAttrs
+    ;
+  inherit (lib) mkOption;
+  inherit (lib.types)
+    attrsOf
+    listOf
+    nonEmptyStr
+    nullOr
+    strMatching
+    submodule
+    ;
+in
+{
+  options.services.firewalld.services = mkOption {
+    description = ''
+      firewalld service configuration files. See {manpage}`firewalld.service(5)`.
+    '';
+    default = { };
+    type = attrsOf (submodule {
+      options = {
+        version = mkOption {
+          type = nullOr nonEmptyStr;
+          description = "Version of the service.";
+          default = null;
+        };
+        short = mkOption {
+          type = nullOr nonEmptyStr;
+          description = "Short description for the service.";
+          default = null;
+        };
+        description = mkOption {
+          type = nullOr nonEmptyStr;
+          description = "Description for the service.";
+          default = null;
+        };
+        ports = mkOption {
+          type = listOf (submodule portProtocolOptions);
+          description = "Ports of the service.";
+          default = [ ];
+        };
+        protocols = mkOption {
+          type = listOf nonEmptyStr;
+          description = "Protocols for the service.";
+          default = [ ];
+        };
+        sourcePorts = mkOption {
+          type = listOf (submodule portProtocolOptions);
+          description = "Source ports for the service.";
+          default = [ ];
+        };
+        destination = mkOption {
+          type = submodule {
+            options = {
+              ipv4 = mkOption {
+                type = nullOr (strMatching "([0-9]{1,3}\\.){3}[0-9]{1,3}(/[0-9]{1,2})?");
+                description = "IPv4 destination.";
+                default = null;
+              };
+              ipv6 = mkOption {
+                type = nullOr (strMatching "[0-9A-Fa-f:]{3,39}(/[0-9]{1,3})?");
+                description = "IPv6 destination.";
+                default = null;
+              };
+            };
+          };
+          description = "Destinations for the service.";
+          default = { };
+        };
+        includes = mkOption {
+          type = listOf nonEmptyStr;
+          description = "Services to include for the service.";
+          default = [ ];
+        };
+        helpers = mkOption {
+          type = listOf nonEmptyStr;
+          description = "Helpers for the service.";
+          default = [ ];
+        };
+      };
+    });
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.etc = lib.mapAttrs' (
+      name: value:
+      lib.nameValuePair "firewalld/services/${name}.xml" {
+        source = format.generate "firewalld-service-${name}.xml" {
+          service = filterNullAttrs (
+            lib.mergeAttrsList [
+              (toXmlAttrs { inherit (value) version; })
+              {
+                inherit (value) short description;
+                port = builtins.map toXmlAttrs value.ports;
+                protocol = builtins.map (mkXmlAttr "value") value.protocols;
+                source-port = builtins.map toXmlAttrs value.sourcePorts;
+                destination = toXmlAttrs value.destination;
+                include = builtins.map (mkXmlAttr "service") value.includes;
+                helper = builtins.map (mkXmlAttr "name") value.helpers;
+              }
+            ]
+          );
+        };
+      }
+    ) cfg.services;
+  };
+}
diff --git a/nixos/modules/services/networking/firewalld/settings.nix b/nixos/modules/services/networking/firewalld/settings.nix
new file mode 100644
index 000000000000..d47e56aac17d
--- /dev/null
+++ b/nixos/modules/services/networking/firewalld/settings.nix
@@ -0,0 +1,198 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.firewalld;
+  format = pkgs.formats.keyValue { };
+  inherit (lib) mkOption;
+  inherit (lib.types)
+    bool
+    commas
+    either
+    enum
+    nonEmptyStr
+    separatedString
+    submodule
+    ;
+in
+{
+  options.services.firewalld.settings = mkOption {
+    description = ''
+      FirewallD config file.
+      See {manpage}`firewalld.conf(5)`.
+    '';
+    default = { };
+    type = submodule {
+      freeformType = format.type;
+      options = {
+        DefaultZone = mkOption {
+          type = nonEmptyStr;
+          description = "Default zone for connections.";
+          default = "public";
+        };
+        CleanupOnExit = mkOption {
+          type = bool;
+          description = "Whether to clean up firewall rules when firewalld stops.";
+          default = true;
+        };
+        CleanupModulesOnExit = mkOption {
+          type = bool;
+          description = "Whether to unload all firewall-related kernel modules when firewalld stops.";
+          default = false;
+        };
+        IPv6_rpfilter = mkOption {
+          type = enum [
+            "strict"
+            "loose"
+            "strict-forward"
+            "loose-forward"
+            "no"
+          ];
+          description = ''
+            Performs reverse path filtering (RPF) on IPv6 packets as per RFC 3704.
+
+            Possible values:
+
+            `"strict"`
+            : Performs "strict" filtering as per RFC 3704.
+              This check verifies that the in ingress interface is the same interface that would be used to send a packet reply to the source.
+              That is, `ingress == egress`.
+
+            `"loose"`
+            : Performs "loose" filtering as per RFC 3704.
+              This check only verifies that there is a route back to the source through any interface; even if it's not the same one on which the packet arrived.
+
+            `"strict-forward"`
+            : This is almost identical to "strict", but does not perform RPF for packets targeted to the host (INPUT).
+
+            `"loose-forward"`
+            : This is almost identical to "loose", but does not perform RPF for packets targeted to the host (INPUT).
+
+            `"no"`
+            : RPF is completely disabled.
+
+            The rp_filter for IPv4 is controlled using sysctl.
+          '';
+          default = "strict";
+        };
+        IndividualCalls = mkOption {
+          type = bool;
+          description = ''
+            Whether to use individual -restore calls to apply changes to the firewall.
+            The use of individual calls increases the time that is needed to apply changes and to start the daemon, but is good for debugging as error messages are more specific.
+          '';
+          default = false;
+        };
+        LogDenied = mkOption {
+          type = enum [
+            "all"
+            "unicast"
+            "broadcast"
+            "multicast"
+            "off"
+          ];
+          description = ''
+            Add logging rules right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also final reject and drop rules in zones for the configured link-layer packet type.
+          '';
+          default = "off";
+        };
+        FirewallBackend = mkOption {
+          type = enum [
+            "nftables"
+            "iptables"
+          ];
+          description = ''
+            The firewall backend implementation.
+            This applies to all firewalld primitives.
+            The only exception is direct and passthrough rules which always use the traditional iptables, ip6tables, and ebtables backends.
+
+            ::: {.caution}
+            The iptables backend is deprecated.
+            It will be removed in a future release.
+            :::
+          '';
+          default = "nftables";
+        };
+        FlushAllOnReload = mkOption {
+          type = bool;
+          description = "Whether to flush all runtime rules on a reload.";
+          default = true;
+        };
+        ReloadPolicy = mkOption {
+          type =
+            let
+              policy = enum [
+                "DROP"
+                "REJECT"
+                "ACCEPT"
+              ];
+            in
+            either policy commas;
+          description = "The policy during reload.";
+          default = "INPUT:DROP,FORWARD:DROP,OUTPUT:DROP";
+        };
+        RFC3964_IPv4 = mkOption {
+          type = bool;
+          description = ''
+            Whether to filter IPv6 traffic with 6to4 destination addresses that correspond to IPv4 addresses that should not be routed over the public internet.
+          '';
+          default = true;
+        };
+        StrictForwardPorts = mkOption {
+          type = bool;
+          description = ''
+            If enabled, the generated destination NAT (DNAT) rules will NOT accept traffic that was DNAT'd by other entities, e.g. docker.
+            Firewalld will be strict and not allow published container ports until they're explicitly allowed via firewalld.
+            If set to `false`, then docker (and podman) integrates seamlessly with firewalld.
+            Published container ports are implicitly allowed.
+          '';
+          default = false;
+        };
+        NftablesFlowtable = mkOption {
+          type = separatedString " ";
+          description = ''
+            This may improve forwarded traffic throughput by enabling nftables flowtable.
+            It is a software fastpath and avoids calling nftables rule evaluation for data packets.
+            Its value is a space separate list of interfaces.
+          '';
+          default = "off";
+        };
+        NftablesCounters = mkOption {
+          type = bool;
+          description = "Whether to add a counter to every nftables rule.";
+          default = false;
+        };
+        NftablesTableOwner = mkOption {
+          type = bool;
+          description = ''
+            If enabled, the generated nftables rule set will be owned exclusively by firewalld.
+            This prevents other entities from mistakenly (or maliciously) modifying firewalld's rule set.
+            If you intend to modify firewalld's rules, set this to `false`.
+          '';
+          default = true;
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.settings.FirewallBackend == "nftables" -> config.networking.nftables.enable;
+        message = ''
+          FirewallD uses nftables as the firewall backend (by default), but nftables support isn't enabled.
+          Please read the description of networking.nftables.enable for possible problems.
+          If using nftables is not desired, set services.firewalld.settings.FirewallBackend to "iptables", but be aware that FirewallD has deprecated support for it, and will override firewall rule set by other services, if any.
+        '';
+      }
+    ];
+
+    environment.etc."firewalld/firewalld.conf" = {
+      source = format.generate "firewalld.conf" cfg.settings;
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/firewalld/zone.nix b/nixos/modules/services/networking/firewalld/zone.nix
new file mode 100644
index 000000000000..574c45304dd8
--- /dev/null
+++ b/nixos/modules/services/networking/firewalld/zone.nix
@@ -0,0 +1,281 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.firewalld;
+  format = pkgs.formats.xml { };
+  lib' = import ./lib.nix { inherit lib; };
+  inherit (lib')
+    filterNullAttrs
+    mkPortOption
+    mkXmlAttr
+    portProtocolOptions
+    protocolOption
+    toXmlAttrs
+    ;
+  inherit (lib) mkOption;
+  inherit (lib.types)
+    attrTag
+    attrsOf
+    bool
+    enum
+    ints
+    listOf
+    nonEmptyStr
+    nullOr
+    strMatching
+    submodule
+    ;
+in
+{
+  options.services.firewalld.zones = mkOption {
+    description = ''
+      firewalld zone configuration files.
+      See {manpage}`firewalld.zone(5)`.
+    '';
+    default = { };
+    example = {
+      public = {
+        forward = true;
+        services = [
+          "ssh"
+          "dhcpv6-client"
+        ];
+      };
+      external = {
+        forward = true;
+        services = [
+          "ssh"
+        ];
+        masquerade = true;
+      };
+      dmz = {
+        forward = true;
+        services = [
+          "ssh"
+        ];
+      };
+      work = {
+        forward = true;
+        services = [
+          "ssh"
+          "dhcpv6-client"
+        ];
+      };
+      home = {
+        forward = true;
+        services = [
+          "ssh"
+          "mdns"
+          "samba-client"
+          "dhcpv6-client"
+        ];
+      };
+      internal = {
+        forward = true;
+        services = [
+          "ssh"
+          "mdns"
+          "samba-client"
+          "dhcpv6-client"
+        ];
+      };
+    };
+    type = attrsOf (submodule {
+      options = {
+        version = mkOption {
+          type = nullOr nonEmptyStr;
+          description = "Version of the zone.";
+          default = null;
+        };
+        target = mkOption {
+          type = enum [
+            "ACCEPT"
+            "%%REJECT%%"
+            "DROP"
+          ];
+          description = "Action for packets that doesn't match any rules.";
+          default = "%%REJECT%%";
+        };
+        ingressPriority = mkOption {
+          type = nullOr ints.s16;
+          description = ''
+            Priority for inbound traffic.
+            Lower values have higher priority.
+          '';
+          default = null;
+        };
+        egressPriority = mkOption {
+          type = nullOr ints.s16;
+          description = ''
+            Priority for outbound traffic.
+            Lower values have higher priority.
+          '';
+          default = null;
+        };
+        interfaces = mkOption {
+          type = listOf nonEmptyStr;
+          description = "Interfaces to bind.";
+          default = [ ];
+        };
+        sources = mkOption {
+          type = listOf (attrTag {
+            address = mkOption {
+              type = nonEmptyStr;
+              description = ''
+                An IP address or a network IP address with a mask for IPv4 or IPv6.
+                For IPv4, the mask can be a network mask or a plain number.
+                For IPv6 the mask is a plain number.
+                The use of host names is not supported.
+              '';
+            };
+            mac = mkOption {
+              type = strMatching "([[:xdigit:]]{2}:){5}[[:xdigit:]]{2}";
+              description = "A MAC address.";
+            };
+            ipset = mkOption {
+              type = nonEmptyStr;
+              description = "An ipset.";
+            };
+          });
+          description = "Source addresses, address ranges, MAC addresses or ipsets to bind.";
+          default = [ ];
+        };
+        icmpBlockInversion = mkOption {
+          type = bool;
+          description = ''
+            Whether to invert the icmp block handling.
+            Only enabled ICMP types are accepted and all others are rejected in the zone.
+          '';
+          default = false;
+        };
+        forward = mkOption {
+          type = bool;
+          description = ''
+            Whether to enable intra-zone forwarding.
+            When enabled, packets will be forwarded between interfaces or sources within a zone, even if the zone's target is not set to ACCEPT.
+          '';
+          default = false;
+        };
+        short = mkOption {
+          type = nullOr nonEmptyStr;
+          description = "Short description for the zone.";
+          default = null;
+        };
+        description = mkOption {
+          type = nullOr nonEmptyStr;
+          description = "Description for the zone.";
+          default = null;
+        };
+        services = mkOption {
+          type = listOf nonEmptyStr;
+          description = "Services to allow in the zone.";
+          default = [ ];
+        };
+        ports = mkOption {
+          type = listOf (submodule portProtocolOptions);
+          description = "Ports to allow in the zone.";
+          default = [ ];
+        };
+        protocols = mkOption {
+          type = listOf nonEmptyStr;
+          description = "Protocols to allow in the zone.";
+          default = [ ];
+        };
+        icmpBlocks = mkOption {
+          type = listOf nonEmptyStr;
+          description = "ICMP types to block in the zone.";
+          default = [ ];
+        };
+        masquerade = mkOption {
+          type = bool;
+          description = "Whether to enable masquerading in the zone.";
+          default = false;
+        };
+        forwardPorts = mkOption {
+          type = listOf (submodule {
+            options = {
+              port = mkPortOption { };
+              protocol = protocolOption;
+              to-port = (mkPortOption { optional = true; }) // {
+                default = null;
+              };
+              to-addr = mkOption {
+                type = nullOr nonEmptyStr;
+                description = "Destination IP address.";
+                default = null;
+              };
+            };
+          });
+          description = "Ports to forward in the zone.";
+          default = [ ];
+        };
+        sourcePorts = mkOption {
+          type = listOf (submodule portProtocolOptions);
+          description = "Source ports to allow in the zone.";
+          default = [ ];
+        };
+        rules = mkOption {
+          type = listOf (format.type);
+          description = "Rich rules for the zone.";
+          default = [ ];
+        };
+      };
+    });
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.firewalld.zones = {
+      drop = {
+        target = "DROP";
+        forward = true;
+      };
+      block = {
+        forward = true;
+      };
+      trusted = {
+        target = "ACCEPT";
+        forward = true;
+      };
+    };
+
+    environment.etc = lib.mapAttrs' (
+      name: value:
+      lib.nameValuePair "firewalld/zones/${name}.xml" {
+        source = format.generate "firewalld-zone-${name}.xml" {
+          zone =
+            let
+              mkXmlAttrList = name: builtins.map (mkXmlAttr name);
+              mkXmlTag = value: if value then "" else null;
+            in
+            filterNullAttrs (
+              lib.mergeAttrsList [
+                (toXmlAttrs { inherit (value) version target; })
+                (mkXmlAttr "ingress-priority" value.ingressPriority)
+                (mkXmlAttr "egress-priority" value.egressPriority)
+                {
+                  interface = mkXmlAttrList "name" value.interfaces;
+                  source = builtins.map toXmlAttrs value.sources;
+                  icmp-block-inversion = mkXmlTag value.icmpBlockInversion;
+                  forward = mkXmlTag value.forward;
+                  inherit (value) short description;
+                  service = mkXmlAttrList "name" value.services;
+                  port = builtins.map toXmlAttrs value.ports;
+                  protocol = mkXmlAttrList "value" value.protocols;
+                  icmp-block = mkXmlAttrList "name" value.icmpBlocks;
+                  masquerade = mkXmlTag value.masquerade;
+                  forward-port = builtins.map toXmlAttrs (builtins.map filterNullAttrs value.forwardPorts);
+                  source-port = builtins.map toXmlAttrs value.sourcePorts;
+                  rule = value.rules;
+                }
+              ]
+            );
+        };
+      }
+    ) cfg.zones;
+  };
+}
diff --git a/nixos/modules/services/networking/netbird.nix b/nixos/modules/services/networking/netbird.nix
index ba2c1be37c52..c19cf7d88edb 100644
--- a/nixos/modules/services/networking/netbird.nix
+++ b/nixos/modules/services/networking/netbird.nix
@@ -507,19 +507,35 @@ in
         ) "loose";
 
         # Ports opened on a specific
-        interfaces = listToAttrs (
-          toClientList (client: {
-            name = client.interface;
-            value.allowedUDPPorts = optionals client.openInternalFirewall [
-              # note: those should be opened up by NetBird itself, but it needs additional
-              #  NixOS -specific debugging and tweaking before it works
-              5353 # <0.59.0 DNS forwarder port, kept for compatibility with those clients
-              22054 # >=0.59.0 DNS forwarder port
-            ];
-          })
+        interfaces = lib.mkIf (config.networking.firewall.backend != "firewalld") (
+          listToAttrs (
+            toClientList (client: {
+              name = client.interface;
+              value.allowedUDPPorts = optionals client.openInternalFirewall [
+                # note: those should be opened up by NetBird itself, but it needs additional
+                #  NixOS -specific debugging and tweaking before it works
+                5353 # <0.59.0 DNS forwarder port, kept for compatibility with those clients
+                22054 # >=0.59.0 DNS forwarder port
+              ];
+            })
+          )
         );
       };
 
+      services.firewalld.zones.netbird = {
+        interfaces = lib.pipe cfg.clients [
+          (lib.filterAttrs (_: client: client.openFirewall))
+          lib.attrValues
+          (map (client: client.interface))
+        ];
+        ports = [
+          {
+            protocol = "udp";
+            port = 5353;
+          }
+        ];
+      };
+
       systemd.network.networks = mkIf config.networking.useNetworkd (
         toClientAttrs (
           client:
diff --git a/nixos/modules/services/video/wivrn.nix b/nixos/modules/services/video/wivrn.nix
index 9c7250fb7d08..5508a51137c3 100644
--- a/nixos/modules/services/video/wivrn.nix
+++ b/nixos/modules/services/video/wivrn.nix
@@ -231,6 +231,8 @@ in
       allowedUDPPorts = [ 9757 ];
     };
 
+    services.firewalld.packages = [ cfg.package ];
+
     environment = {
       systemPackages = [
         cfg.package
diff --git a/nixos/modules/services/x11/desktop-managers/kodi.nix b/nixos/modules/services/x11/desktop-managers/kodi.nix
index 0dd2f8ffb829..01252e47b37e 100644
--- a/nixos/modules/services/x11/desktop-managers/kodi.nix
+++ b/nixos/modules/services/x11/desktop-managers/kodi.nix
@@ -38,5 +38,7 @@ in
     ];
 
     environment.systemPackages = [ cfg.package ];
+
+    services.firewalld.packages = [ cfg.package ];
   };
 }
diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix
index b4a5e1cebc49..a4ae4e2c7ffc 100644
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -447,6 +447,8 @@ in
       Include ${cfg.package}/etc/ssh/ssh_config.d/30-libvirt-ssh-proxy.conf
     '';
 
+    services.firewalld.packages = [ cfg.package ];
+
     systemd.packages = [ cfg.package ];
 
     systemd.services.libvirtd-config = {
@@ -480,11 +482,12 @@ in
         ln -s --force ${cfg.qemu.package}/bin/qemu-pr-helper /run/${dirName}/nix-helpers/
 
         # Symlink to OVMF firmware code and variable template images distributed with QEMU
-        cp -sfv $(
+        readarray -t firmware_files < <(
           ${pkgs.jq}/bin/jq -rs \
             '[.[] | .mapping.executable.filename, .mapping."nvram-template".filename] | unique | .[]' \
-          ${cfg.qemu.package}/share/qemu/firmware/* \
-        ) /run/${dirName}/nix-ovmf
+          ${cfg.qemu.package}/share/qemu/firmware/*
+        )
+        cp -sfv "''${firmware_files[@]}" /run/${dirName}/nix-ovmf
 
         # Symlink hooks to /var/lib/libvirt
         ${concatStringsSep "\n" (
@@ -542,6 +545,8 @@ in
         OOMScoreAdjust = "-999";
       };
       restartIfChanged = false;
+
+      enableStrictShellChecks = true;
     };
 
     systemd.services.virtchd = {
diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix
index 8145c099eead..5f01142b4a13 100644
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@@ -249,7 +249,9 @@ in
       };
 
       # containers cannot reach aardvark-dns otherwise
-      networking.firewall.interfaces.${network_interface}.allowedUDPPorts = lib.mkIf dns_enabled [ 53 ];
+      networking.firewall = lib.mkIf (config.networking.firewall.backend != "firewalld") {
+        interfaces.${network_interface}.allowedUDPPorts = lib.mkIf dns_enabled [ 53 ];
+      };
 
       virtualisation.containers = {
         enable = true; # Enable common /etc/containers configuration
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 0b4b244b263b..40f6d0afbf65 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -569,12 +569,17 @@ in
   firejail = runTest ./firejail.nix;
   firewall = runTest {
     imports = [ ./firewall.nix ];
-    _module.args.nftables = false;
+    _module.args.backend = "iptables";
+  };
+  firewall-firewalld = runTest {
+    imports = [ ./firewall.nix ];
+    _module.args.backend = "firewalld";
   };
   firewall-nftables = runTest {
     imports = [ ./firewall.nix ];
-    _module.args.nftables = true;
+    _module.args.backend = "nftables";
   };
+  firewalld = runTest ./firewalld.nix;
   firezone = runTest ./firezone/firezone.nix;
   fish = runTest ./fish.nix;
   flannel = runTestOn [ "x86_64-linux" ] ./flannel.nix;
diff --git a/nixos/tests/firewall.nix b/nixos/tests/firewall.nix
index 019508adb0b2..31db36ef8dc1 100644
--- a/nixos/tests/firewall.nix
+++ b/nixos/tests/firewall.nix
@@ -1,10 +1,11 @@
 # Test the firewall module.
 
-{ lib, nftables, ... }:
+{ lib, backend, ... }:
 {
-  name = "firewall" + lib.optionalString nftables "-nftables";
+  name = "firewall-${backend}";
   meta = with lib.maintainers; {
     maintainers = [
+      prince213
       rvfg
       garyguo
     ];
@@ -12,10 +13,11 @@
 
   nodes = {
     walled =
-      { ... }:
+      { lib, ... }:
       {
         networking.firewall = {
           enable = true;
+          inherit backend;
           logRefusedPackets = true;
           # Syntax smoke test, not actually verified otherwise
           allowedTCPPorts = [
@@ -37,26 +39,29 @@
               to = 8010;
             }
           ];
-          interfaces.eth0 = {
-            allowedTCPPorts = [ 10003 ];
-            allowedTCPPortRanges = [
-              {
-                from = 10000;
-                to = 10005;
-              }
-            ];
-          };
-          interfaces.eth3 = {
-            allowedUDPPorts = [ 10003 ];
-            allowedUDPPortRanges = [
-              {
-                from = 10000;
-                to = 10005;
-              }
-            ];
+          interfaces = lib.mkIf (backend != "firewalld") {
+            eth0 = {
+              allowedTCPPorts = [ 10003 ];
+              allowedTCPPortRanges = [
+                {
+                  from = 10000;
+                  to = 10005;
+                }
+              ];
+            };
+            eth3 = {
+              allowedUDPPorts = [ 10003 ];
+              allowedUDPPortRanges = [
+                {
+                  from = 10000;
+                  to = 10005;
+                }
+              ];
+            };
           };
         };
-        networking.nftables.enable = nftables;
+        services.firewalld.enable = backend == "firewalld";
+        networking.nftables.enable = backend != "iptables";
         services.httpd.enable = true;
         services.httpd.adminAddr = "foo@example.org";
 
@@ -77,7 +82,13 @@
   testScript =
     { nodes, ... }:
     let
-      unit = if nftables then "nftables" else "firewall";
+      unit = if backend == "iptables" then "firewall" else backend;
+      openPort =
+        if backend == "firewalld" then
+          "firewall-cmd --add-port=80/tcp"
+        else
+          "nixos-firewall-tool open tcp 80";
+      reset = if backend == "firewalld" then "firewall-cmd --reload" else "nixos-firewall-tool reset";
     in
     ''
       start_all()
@@ -98,11 +109,11 @@
       walled.succeed("ping -c 1 attacker >&2")
 
       # Open tcp port 80 at runtime
-      walled.succeed("nixos-firewall-tool open tcp 80")
+      walled.succeed("${openPort}")
       attacker.succeed("curl -v http://walled/ >&2")
 
       # Reset the firewall
-      walled.succeed("nixos-firewall-tool reset")
+      walled.succeed("${reset}")
       attacker.fail("curl --fail --connect-timeout 2 http://walled/ >&2")
 
       # If we stop the firewall, then connections should succeed.
diff --git a/nixos/tests/firewalld.nix b/nixos/tests/firewalld.nix
new file mode 100644
index 000000000000..a191fe806354
--- /dev/null
+++ b/nixos/tests/firewalld.nix
@@ -0,0 +1,52 @@
+{ lib, pkgs, ... }:
+{
+  name = "firewalld";
+  meta.maintainers = with pkgs.lib.maintainers; [
+    prince213
+  ];
+
+  nodes = {
+    walled = {
+      networking.nftables.enable = true;
+      services.firewalld.enable = true;
+      services.httpd.enable = true;
+      services.httpd.adminAddr = "foo@example.org";
+    };
+
+    open = {
+      networking.nftables.enable = true;
+      services.firewalld = {
+        enable = true;
+        settings.DefaultZone = "trusted";
+      };
+      services.httpd.enable = true;
+      services.httpd.adminAddr = "foo@example.org";
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    walled.wait_for_unit("firewalld")
+    walled.wait_for_unit("httpd")
+
+    open.wait_for_unit("network.target")
+
+    with subtest("walled local httpd works"):
+      walled.succeed("curl -v http://localhost/ >&2")
+
+    with subtest("incoming connections are blocked"):
+      open.fail("curl --fail --connect-timeout 2 http://walled/ >&2")
+
+    with subtest("outgoing connections are allowed"):
+      walled.succeed("curl -v http://open/ >&2")
+
+    with subtest("runtime configuration can be changed"):
+      walled.succeed("firewall-cmd --add-service=http")
+      open.succeed("curl -v http://walled/ >&2")
+
+    with subtest("runtime configuration are not permanent"):
+      walled.succeed("firewall-cmd --complete-reload")
+      open.fail("curl --fail --connect-timeout 2 http://walled/ >&2")
+  '';
+}
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index aa3537e5ea0e..0a1bdb5cc947 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4831,8 +4831,8 @@ let
         mktplcRef = {
           name = "uiua-vscode";
           publisher = "uiua-lang";
-          version = "0.0.66";
-          hash = "sha256-eFdRzkoYJeQdpebKcSFhhnZZXFcA3oKURvqjBx5hReQ=";
+          version = "0.0.67";
+          hash = "sha256-Q/wJZ+ObCU+hRpZZKQGQtdt99/I6QHkSuHlNy7oe5Pk=";
         };
         meta = {
           description = "VSCode language extension for Uiua";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index dc0e4971be21..6a0dee3059cc 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1228,11 +1228,11 @@
     "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
   },
   "spacelift-io_spacelift": {
-    "hash": "sha256-d26HPdufp8HgZSMA/wkEMtwXUOXSRgFd7+wqRc3V0OI=",
+    "hash": "sha256-aOpS9KJm31Rz3LnSLAAxV9A5XLuJxGzIWkv9JuEG3H8=",
     "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
     "owner": "spacelift-io",
     "repo": "terraform-provider-spacelift",
-    "rev": "v1.37.0",
+    "rev": "v1.38.0",
     "spdx": "MIT",
     "vendorHash": "sha256-cX5K221Jnq701Nb+2bC1LmXVL7YvkZ8dkc2wYjDNOSw="
   },
diff --git a/pkgs/by-name/bo/bookstack/package.nix b/pkgs/by-name/bo/bookstack/package.nix
index 9350af25b54e..2c0031122167 100644
--- a/pkgs/by-name/bo/bookstack/package.nix
+++ b/pkgs/by-name/bo/bookstack/package.nix
@@ -8,16 +8,16 @@
 
 php83.buildComposerProject2 (finalAttrs: {
   pname = "bookstack";
-  version = "25.11.1";
+  version = "25.11.2";
 
   src = fetchFromGitHub {
     owner = "bookstackapp";
     repo = "bookstack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qRJBBas54x/IoLs97/SBQW1FvhI/HYXQ9etQ+2LUse8=";
+    hash = "sha256-HHNiGnMVUtFWn2rexmbtbbKWtLs+og70sWYVtgw9Mas=";
   };
 
-  vendorHash = "sha256-cIkfYc078NMP7QAGuoC4f77SaVPEnQ3H4zqIU4P3wd8=";
+  vendorHash = "sha256-sqoUGv4+WMblJAW2iJ80v89+dkvAlaNiDaTSCWcavy8=";
 
   passthru = {
     phpPackage = php83;
diff --git a/pkgs/by-name/bo/bottom/package.nix b/pkgs/by-name/bo/bottom/package.nix
index 45dd64fb0c90..a524235e2078 100644
--- a/pkgs/by-name/bo/bottom/package.nix
+++ b/pkgs/by-name/bo/bottom/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bottom";
-  version = "0.11.3";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "ClementTsang";
     repo = "bottom";
     tag = finalAttrs.version;
-    hash = "sha256-7rVvKAqK8hqICnSr/Ax9ndsIZAdTaUyOAoVZ13W5BJs=";
+    hash = "sha256-hyEYSkoV86BWVMjolU9IjU0rTABxE4ag26el0UydsFQ=";
   };
 
-  cargoHash = "sha256-OXprj84ixm5KFayWsHuxCB3p5Ob/oZgsk3u3lqkOiuk=";
+  cargoHash = "sha256-VnpSgaBxSHJj+brMtNwmbrXUN9H3y0oinF8ya+vsl88=";
 
   nativeBuildInputs = [
     autoAddDriverRunpath
diff --git a/pkgs/by-name/br/brutespray/package.nix b/pkgs/by-name/br/brutespray/package.nix
index f455089ea7da..fa0797ad7a33 100644
--- a/pkgs/by-name/br/brutespray/package.nix
+++ b/pkgs/by-name/br/brutespray/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "brutespray";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "x90skysn3k";
     repo = "brutespray";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tws3BvVQSlGcBgiJ8Ho7V/KJjzoq3TEOiChqTzrMbiU=";
+    hash = "sha256-szW4Cvby93aWbdH4I/RbGVvPBuM11sJGLuZA4nP2Cb4=";
   };
 
-  vendorHash = "sha256-Fe3W5rlKygw4z5bF+6xy5mv86wKcBuCf3nhtdtFWJPM=";
+  vendorHash = "sha256-NJV5lCjr9wNZAZYtO1jWpLW2otWutUSQKdvnKUiFtBo=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
@@ -29,14 +29,15 @@ buildGoModule (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://github.com/x90skysn3k/brutespray";
     description = "Tool to do brute-forcing from Nmap output";
-    mainProgram = "brutespray";
+    homepage = "https://github.com/x90skysn3k/brutespray";
     longDescription = ''
       This tool automatically attempts default credentials on found services
       directly from Nmap output.
     '';
+    changelog = "https://github.com/x90skysn3k/brutespray/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = [ ];
+    mainProgram = "brutespray";
   };
 })
diff --git a/pkgs/by-name/bu/bulky/package.nix b/pkgs/by-name/bu/bulky/package.nix
index f926e9979b78..2592d397beb1 100644
--- a/pkgs/by-name/bu/bulky/package.nix
+++ b/pkgs/by-name/bu/bulky/package.nix
@@ -10,17 +10,18 @@
   gtk3,
   glib,
   common-licenses,
+  xapp-symbolic-icons,
 }:
 
 stdenv.mkDerivation rec {
   pname = "bulky";
-  version = "3.9";
+  version = "4.0";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "bulky";
     tag = version;
-    hash = "sha256-LrArLx0AOEaeAvLBVhV9ho5H+qeiaBfjs8+iV5W9u+w=";
+    hash = "sha256-BHMCtvnz3Ua4pa3Pnh2PbxZ9a0vJOJ+Se2/DaPbUqQA=";
   };
 
   nativeBuildInputs = [
@@ -45,10 +46,10 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace usr/lib/bulky/bulky.py \
-                     --replace "/usr/share/locale" "$out/share/locale" \
-                     --replace /usr/share/bulky "$out/share/bulky" \
-                     --replace /usr/share/common-licenses "${common-licenses}/share/common-licenses" \
-                     --replace __DEB_VERSION__  "${version}"
+      --replace-fail "/usr/share/locale" "$out/share/locale" \
+      --replace-fail /usr/share/bulky "$out/share/bulky" \
+      --replace-fail /usr/share/common-licenses "${common-licenses}/share/common-licenses" \
+      --replace-fail __DEB_VERSION__  "${version}"
   '';
 
   installPhase = ''
@@ -63,6 +64,12 @@ stdenv.mkDerivation rec {
     glib-compile-schemas $out/share/glib-2.0/schemas
   '';
 
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : ${lib.makeSearchPath "share" [ xapp-symbolic-icons ]}
+    )
+  '';
+
   meta = with lib; {
     description = "Bulk rename app";
     mainProgram = "bulky";
diff --git a/pkgs/by-name/ca/cargo-all-features/package.nix b/pkgs/by-name/ca/cargo-all-features/package.nix
index fd8ecb5d28d4..3c21481999e4 100644
--- a/pkgs/by-name/ca/cargo-all-features/package.nix
+++ b/pkgs/by-name/ca/cargo-all-features/package.nix
@@ -13,6 +13,11 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-pHwQq6/KGCIYm3Q63YbUit6yUjwEFnpBJCE6lpGBcZc=";
   };
 
+  postPatch = ''
+    substituteInPlace tests/settings.rs \
+      --replace-fail 'cmd.env("RUSTFLAGS", "-Cinstrument-coverage");' '''
+  '';
+
   cargoHash = "sha256-tAwU7vJLp4KLzYAEbtSpNKbZBz+hBdAiIkUD/A5CpwI=";
 
   meta = with lib; {
diff --git a/pkgs/by-name/ca/cargo-shear/package.nix b/pkgs/by-name/ca/cargo-shear/package.nix
index d7fa1f01c8fc..613b3dce7aea 100644
--- a/pkgs/by-name/ca/cargo-shear/package.nix
+++ b/pkgs/by-name/ca/cargo-shear/package.nix
@@ -8,15 +8,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-shear";
-  version = "1.6.2";
+  version = "1.6.3";
 
   src = fetchCrate {
     pname = "cargo-shear";
     version = finalAttrs.version;
-    hash = "sha256-5N8sAKStdQnrgzXECxu/oRuGVLwLx/KfW2vcPClVZGM=";
+    hash = "sha256-8aRIDzMaVbu0oKU1Ufig3rBj/X8P/DPzUdrTfA77z0w=";
   };
 
-  cargoHash = "sha256-WdB4oJtQAh90Fe+Km+SddpmyvHdyemo3KsuRyBtZ5FY=";
+  cargoHash = "sha256-A29u5ZI6zKUuBtpEEVkM4dVbTqETZlK8f33MG8V1SwE=";
 
   env = {
     # https://github.com/Boshen/cargo-shear/blob/v1.6.2/src/lib.rs#L51-L54
diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix
index 368814776125..ccd5586fdff2 100644
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.2.9";
+  version = "1.2.10";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-d1j/1DYeKolBBJ2DdPBduAymL68DRV0eUFoEuJSL0qU=";
+    hash = "sha256-KX+LEVRRPGtMEmYgrrSWBsvXyd7nvC5CHoRNI3kuVqI=";
   };
 
   vendorHash = "sha256-XLfbuqyu+U11v8TZifPyltLQtx+zAFxlTh0rgpXOpYU=";
diff --git a/pkgs/by-name/cr/croc/package.nix b/pkgs/by-name/cr/croc/package.nix
index 6e0741fcb36d..52c9f555acf1 100644
--- a/pkgs/by-name/cr/croc/package.nix
+++ b/pkgs/by-name/cr/croc/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "croc";
-  version = "10.2.7";
+  version = "10.3.0";
 
   src = fetchFromGitHub {
     owner = "schollz";
     repo = "croc";
     rev = "v${version}";
-    hash = "sha256-eIWLTWFnF7lMU2b43Txoi8yxAEmPIKl5xmK2Q5wgXeg=";
+    hash = "sha256-5mxrfYAR4kTy9hdbsC7wFdroHf68dknPH3mq4KXG36Y=";
   };
 
-  vendorHash = "sha256-kuJrh9cK+ezxbScks0slj7f/nGHQTQpxg5I5bJ16ORk=";
+  vendorHash = "sha256-xEF1vjYQaeDYxcC3FTgR0zCFqvziNIrJVpJJT4o1cVU=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/da/dart-sass/package.nix b/pkgs/by-name/da/dart-sass/package.nix
index f0f9fcf50df1..3997f438b6ed 100644
--- a/pkgs/by-name/da/dart-sass/package.nix
+++ b/pkgs/by-name/da/dart-sass/package.nix
@@ -23,13 +23,13 @@ let
 in
 buildDartApplication rec {
   pname = "dart-sass";
-  version = "1.94.0";
+  version = "1.94.2";
 
   src = fetchFromGitHub {
     owner = "sass";
     repo = "dart-sass";
     tag = version;
-    hash = "sha256-upE3IVMvwLABzq3rlgKN6LOnAH1TE8kdsTAh3Hr5QE0=";
+    hash = "sha256-/ygA4Ymo7n3JWCv/qxkQs6JWoIhMIwHjKCqk4KyKOMw=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
diff --git a/pkgs/by-name/da/dart-sass/pubspec.lock.json b/pkgs/by-name/da/dart-sass/pubspec.lock.json
index 8f46beed4389..0831edb476a4 100644
--- a/pkgs/by-name/da/dart-sass/pubspec.lock.json
+++ b/pkgs/by-name/da/dart-sass/pubspec.lock.json
@@ -184,11 +184,11 @@
       "dependency": "transitive",
       "description": {
         "name": "dart_style",
-        "sha256": "c87dfe3d56f183ffe9106a18aebc6db431fc7c98c31a54b952a77f3d54a85697",
+        "sha256": "a9c30492da18ff84efe2422ba2d319a89942d93e58eb0b73d32abe822ef54b7b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.2"
+      "version": "3.1.3"
     },
     "dartdoc": {
       "dependency": "direct dev",
diff --git a/pkgs/by-name/de/dediprog-sf100/package.nix b/pkgs/by-name/de/dediprog-sf100/package.nix
index ea9abd8f5be2..300e4ac8b126 100644
--- a/pkgs/by-name/de/dediprog-sf100/package.nix
+++ b/pkgs/by-name/de/dediprog-sf100/package.nix
@@ -47,6 +47,9 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Linux software for DediProg SF100/SF600 programmers";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ thillux ];
+    maintainers = with lib.maintainers; [
+      thillux
+      felixsinger
+    ];
   };
 })
diff --git a/pkgs/by-name/di/di-tui/package.nix b/pkgs/by-name/di/di-tui/package.nix
index 9201fc2b853a..7b8ec127ef6d 100644
--- a/pkgs/by-name/di/di-tui/package.nix
+++ b/pkgs/by-name/di/di-tui/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "di-tui";
-  version = "1.11.3";
+  version = "1.11.4";
 
   src = fetchFromGitHub {
     owner = "acaloiaro";
     repo = "di-tui";
     rev = "v${version}";
-    hash = "sha256-Qd+Rwyw0aC5RGucvl3v3mHbV6dB9VHvk9/nh/glWU90=";
+    hash = "sha256-CTZ98EbOdM/uCFZHtCGnU4OHmFw4iPwqseb0RuJvDnk=";
   };
 
   vendorHash = "sha256-b7dG0nSjPQpjWUbOlIxWudPZWKqtq96sQaJxKvsQT9I=";
diff --git a/pkgs/by-name/fa/fabric-ai/package.nix b/pkgs/by-name/fa/fabric-ai/package.nix
index 30b34799a7c4..4c75df83538e 100644
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "fabric-ai";
-  version = "1.4.323";
+  version = "1.4.328";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     tag = "v${version}";
-    hash = "sha256-1l0O6o6bFqfFjEAwgU8KM5K1Bx0BC654lSY+SmGUNu4=";
+    hash = "sha256-s7XZDYD8y36zUw5StJnYMNxCkDiub3ubg7/I7AY91mE=";
   };
 
   vendorHash = "sha256-bOA4vKwiRNRCyDWKCmzwLZlhsZwjSVe194Th6MNlwvM=";
diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 5443f135d9d2..a42428b4e197 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -26,6 +26,7 @@
   sysctl,
   wrapGAppsNoGuiHook,
   withGui ? false,
+  nixosTests,
 }:
 
 let
@@ -153,6 +154,11 @@ stdenv.mkDerivation rec {
     wrapPythonProgramsIn "$out/bin" "$out ${pythonPath}"
   '';
 
+  passthru.tests = {
+    firewalld = nixosTests.firewalld;
+    firewall-firewalld = nixosTests.firewall-firewalld;
+  };
+
   meta = {
     description = "Firewall daemon with D-Bus interface";
     homepage = "https://firewalld.org";
diff --git a/pkgs/by-name/ge/gemini-cli-bin/package.nix b/pkgs/by-name/ge/gemini-cli-bin/package.nix
index 240d1444418f..03384973e181 100644
--- a/pkgs/by-name/ge/gemini-cli-bin/package.nix
+++ b/pkgs/by-name/ge/gemini-cli-bin/package.nix
@@ -8,11 +8,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "gemini-cli-bin";
-  version = "0.15.4";
+  version = "0.16.0";
 
   src = fetchurl {
     url = "https://github.com/google-gemini/gemini-cli/releases/download/v${finalAttrs.version}/gemini.js";
-    hash = "sha256-X4QXDZYtTY0LO9OiE9F99DBvit79Tsz/4zhfVHPQxSE=";
+    hash = "sha256-BL+qIQgqqVuOQzCVjS9lnExijM0XDj5v3+RPkbspw9Q=";
   };
 
   dontUnpack = true;
@@ -25,6 +25,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook preInstall
 
     install -D "$src" "$out/bin/gemini"
+    sed -i '/disableAutoUpdate: {/,/}/ s/default: false/default: true/' "$out/bin/gemini"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix b/pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix
index ef4e232f9b7d..63428397976d 100644
--- a/pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix
+++ b/pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix
@@ -11,17 +11,18 @@
   gnome-online-accounts,
   gtk4,
   libadwaita,
+  xapp-symbolic-icons,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-online-accounts-gtk";
-  version = "3.50.7";
+  version = "3.50.8";
 
   src = fetchFromGitHub {
     owner = "xapp-project";
     repo = "gnome-online-accounts-gtk";
     rev = finalAttrs.version;
-    hash = "sha256-CFPaCx3tfOIoovm9AXofBdZzl/Rxiz5RVOrVKCuxZbI=";
+    hash = "sha256-DcW88Zx8uoxOL+2mV7uBIsnmQEuy02tbAO1ljf0ZigQ=";
   };
 
   nativeBuildInputs = [
@@ -39,6 +40,12 @@ stdenv.mkDerivation (finalAttrs: {
     libadwaita # for goa-backend
   ];
 
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : ${lib.makeSearchPath "share" [ xapp-symbolic-icons ]}
+    )
+  '';
+
   meta = with lib; {
     description = "Online accounts configuration utility";
     homepage = "https://github.com/xapp-project/gnome-online-accounts-gtk";
diff --git a/pkgs/by-name/gv/gvm-libs/package.nix b/pkgs/by-name/gv/gvm-libs/package.nix
index 982db26458f1..d5930d14e505 100644
--- a/pkgs/by-name/gv/gvm-libs/package.nix
+++ b/pkgs/by-name/gv/gvm-libs/package.nix
@@ -1,11 +1,12 @@
 {
   lib,
   stdenv,
+  cjson,
   cmake,
+  curl,
   doxygen,
   fetchFromGitHub,
   glib,
-  glib-networking,
   gnutls,
   gpgme,
   hiredis,
@@ -25,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gvm-libs";
-  version = "22.11.0";
+  version = "22.31.1";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "gvm-libs";
     tag = "v${version}";
-    hash = "sha256-VYFAy6VVASNOBLs39qukePYr5pV0IR1qjztv+veNCVc=";
+    hash = "sha256-/2r5jPWqOb9KQyCW1ja9xV/RBQnsZCeJJHL2a6oH3bk=";
   };
 
   postPatch = ''
@@ -45,8 +46,9 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    cjson
+    curl
     glib
-    glib-networking
     gnutls
     gpgme
     hiredis
@@ -71,7 +73,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Libraries module for the Greenbone Vulnerability Management Solution";
     homepage = "https://github.com/greenbone/gvm-libs";
-    changelog = "https://github.com/greenbone/gvm-libs/releases/tag/v${version}";
+    changelog = "https://github.com/greenbone/gvm-libs/releases/tag/${src.tag}";
     license = with lib.licenses; [ gpl2Plus ];
     maintainers = with lib.maintainers; [ fab ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/ki/kimai/package.nix b/pkgs/by-name/ki/kimai/package.nix
index b668aed83bb5..9e09d9948f00 100644
--- a/pkgs/by-name/ki/kimai/package.nix
+++ b/pkgs/by-name/ki/kimai/package.nix
@@ -7,13 +7,13 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "kimai";
-  version = "2.42.0";
+  version = "2.43.0";
 
   src = fetchFromGitHub {
     owner = "kimai";
     repo = "kimai";
     tag = finalAttrs.version;
-    hash = "sha256-5CPNUneOHbKxI/7/ARRt2hDKGmpvtmJwBAWdblCNmCQ=";
+    hash = "sha256-gleeUCV9Id0GINFfpdYrS8A0yFv8VNCbApv9lsqb6SA=";
   };
 
   php = php.buildEnv {
@@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-z0bSqSCSPF61x+zCbIVxRJ4SsxWaqL5yrK6+E8cxgiI=";
+  vendorHash = "sha256-vXkR8UV7CHUfKtfC/onmde0VIqu6HxxoTOKgLrP3Cik=";
 
   composerNoPlugins = false;
 
diff --git a/pkgs/by-name/li/libgedit-gfls/package.nix b/pkgs/by-name/li/libgedit-gfls/package.nix
index 02000133db28..2cc1093e87ac 100644
--- a/pkgs/by-name/li/libgedit-gfls/package.nix
+++ b/pkgs/by-name/li/libgedit-gfls/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgedit-gfls";
-  version = "0.3.0";
+  version = "0.3.1";
 
   outputs = [
     "out"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "gedit";
     repo = "libgedit-gfls";
     tag = finalAttrs.version;
-    hash = "sha256-X56QPcmNB0Ey+kzSqDnb6/j6/w7IU7MFSAxW8mX8I3w=";
+    hash = "sha256-HBXOphDvFwXea0mlfPqPtaXgNpAZyHYwuHBn5f7hPso=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/lu/luau-lsp/package.nix b/pkgs/by-name/lu/luau-lsp/package.nix
index 176a8c7532a2..9156dae7f9c8 100644
--- a/pkgs/by-name/lu/luau-lsp/package.nix
+++ b/pkgs/by-name/lu/luau-lsp/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau-lsp";
-  version = "1.56.1";
+  version = "1.56.2";
 
   src = fetchFromGitHub {
     owner = "JohnnyMorganz";
     repo = "luau-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-IRBVLLWycc4zkjR82jAEcTlmDgXSLbaAA7ejSIYm41U=";
+    hash = "sha256-lEv4ZysuYrK86JRoH8M2PesGEo7LI9ybGLIOExPtTZQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/mo/mocha/package.nix b/pkgs/by-name/mo/mocha/package.nix
index 8b358c766a57..fbfeebd78808 100644
--- a/pkgs/by-name/mo/mocha/package.nix
+++ b/pkgs/by-name/mo/mocha/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "mocha";
-  version = "11.7.4";
+  version = "11.7.5";
 
   src = fetchFromGitHub {
     owner = "mochajs";
     repo = "mocha";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mRXdAPKDNnQzr8oz6NrTeUFgT7aBbsTl4TxFvjcVqCs=";
+    hash = "sha256-Bk/yF3z/DZ4h9mj1a/EG5ofC6/CIpLd81iQ1w7XkZ0A=";
   };
 
-  npmDepsHash = "sha256-NTJ27KucQcrnpPVtEX3zr6qQZjaLzNHPhgJefntE8hg=";
+  npmDepsHash = "sha256-dcq6P4BB6w7GGMzW2GfF8AzDnqPV/BS5nz+dxVjnc3o=";
 
   postInstall = ''
     # Installed only for backwards compat, but should just be removed.
diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 6f3972882dd6..0c76fb13dbc4 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -6,19 +6,19 @@
   nix-update-script,
   writableTmpDirAsHomeHook,
 }:
-stdenvNoCC.mkDerivation (finalAttrs: {
+let
   pname = "models-dev";
-  version = "0-unstable-2025-11-17";
+  version = "0-unstable-2025-11-20";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "models.dev";
-    rev = "0cb3e3498ba712bd31528926d2efdd26e925267b";
-    hash = "sha256-ICMR59DaqriZZmO7260iuyMjuIRJ9AYtWlzVZY0KFXw=";
+    rev = "5389818cb714afeeca30ceef3c012498bba7f709";
+    hash = "sha256-ld/bWHJPGoDO7lyXnmGCzSt1f3A/JA8azJcj0C5HT8E=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
-    pname = "models-dev-node_modules";
-    inherit (finalAttrs) version src;
+    pname = "${pname}-node_modules";
+    inherit version src;
 
     impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
       "GIT_PROXY_COMMAND"
@@ -69,13 +69,21 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  inherit
+    pname
+    version
+    src
+    node_modules
+    ;
 
   nativeBuildInputs = [ bun ];
 
   configurePhase = ''
     runHook preConfigure
 
-    cp -R ${finalAttrs.node_modules}/. .
+    cp -R ${node_modules}/. .
 
     runHook postConfigure
   '';
diff --git a/pkgs/by-name/ob/obfs4/package.nix b/pkgs/by-name/ob/obfs4/package.nix
index 744c2cac6965..e61f4c1df65a 100644
--- a/pkgs/by-name/ob/obfs4/package.nix
+++ b/pkgs/by-name/ob/obfs4/package.nix
@@ -3,11 +3,13 @@
   buildGoModule,
   fetchFromGitLab,
   installShellFiles,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "obfs4";
-  version = "0.4.0";
+  version = "0.6.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -16,15 +18,16 @@ buildGoModule rec {
     # We don't use pname = lyrebird and we use the old obfs4 name as the first
     # will collide with lyrebird Gtk3 program.
     repo = "lyrebird";
-    rev = "lyrebird-${version}";
-    hash = "sha256-aPALWvngC/BVQO73yUAykHvEb6T0DZcGMowXINDqhpQ=";
+    tag = "lyrebird-${finalAttrs.version}";
+    hash = "sha256-0Nny97bapiyolmCHcty+HtZTziA50bqoCD+3gyFZIQE=";
   };
 
-  vendorHash = "sha256-iR3+ZMEF0SB3EoLTf2gtqTe3CQcjtDRhfwwbwGj3pXo=";
+  vendorHash = "sha256-ifJyOhbaB7BDBayvbh1otF1hxCuxzSG9NLb7Xtvaupg=";
 
   ldflags = [
     "-s"
     "-w"
+    "-X main.lyrebirdVersion=${finalAttrs.version}"
   ];
 
   subPackages = [ "cmd/lyrebird" ];
@@ -36,7 +39,15 @@ buildGoModule rec {
     ln -s $out/share/man/man1/{lyrebird,obfs4proxy}.1
   '';
 
-  meta = with lib; {
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex=^lyrebird-(\\d+\\.\\d+\\.\\d+)$" ];
+  };
+
+  meta = {
     description = "Circumvents censorship by transforming Tor traffic between clients and bridges";
     longDescription = ''
       Obfs4proxy is a tool that attempts to circumvent censorship by
@@ -50,13 +61,16 @@ buildGoModule rec {
       multiple pluggable transports.
     '';
     homepage = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird";
-    maintainers = with maintainers; [ thoughtpolice ];
-    mainProgram = "lyrebird";
-    changelog = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/raw/${src.rev}/ChangeLog";
+    changelog = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/blob/lyrebird-${finalAttrs.version}/ChangeLog";
     license = with lib.licenses; [
       bsd2
       bsd3
       gpl3
     ];
+    maintainers = with lib.maintainers; [
+      thoughtpolice
+      defelo
+    ];
+    mainProgram = "lyrebird";
   };
-}
+})
diff --git a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
index 4d6b6c382823..10356dba4314 100644
--- a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
+++ b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "plasma-panel-colorizer";
-  version = "5.3.0";
+  version = "5.4.0";
 
   src = fetchFromGitHub {
     owner = "luisbocanegra";
     repo = "plasma-panel-colorizer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hv0XBBeXjpwtjFuQ5RRFf/v3ygZbTfsKjWBsd7vs7ps=";
+    hash = "sha256-8cjOyQzX3MOcXLux0raiAlx6kNreLa5jGdGQDlFNGiw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/renderdoc/package.nix b/pkgs/by-name/re/renderdoc/package.nix
index 105deb7bc02e..5346e76c0e7e 100644
--- a/pkgs/by-name/re/renderdoc/package.nix
+++ b/pkgs/by-name/re/renderdoc/package.nix
@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "renderdoc";
-  version = "1.40";
+  version = "1.41";
 
   src = fetchFromGitHub {
     owner = "baldurk";
     repo = "renderdoc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-420UV9I+jJ8sLOQVhfGfkGPqAnN+kgPy8k0rZLt5X+Y=";
+    hash = "sha256-1Us+hwvsHX2Zn0BCv8YkOCN1226gAXeZYsg4btyJi8w=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/to/tor/package.nix b/pkgs/by-name/to/tor/package.nix
index ab5d0e8b7bd9..e3691a0467b6 100644
--- a/pkgs/by-name/to/tor/package.nix
+++ b/pkgs/by-name/to/tor/package.nix
@@ -46,11 +46,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tor";
-  version = "0.4.8.20";
+  version = "0.4.8.21";
 
   src = fetchurl {
     url = "https://dist.torproject.org/tor-${finalAttrs.version}.tar.gz";
-    hash = "sha256-G7IjKM3R7pSGR7/O1XHvp4wS/FBkGHtB1SVAhbUoL6c=";
+    hash = "sha256-6vb1tzCRuVV2lF6t6YgW3f980AW+/k2UcYpvdmuECQM=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/we/wechat/package.nix b/pkgs/by-name/we/wechat/package.nix
index d9424500e0d4..828df591d7d9 100644
--- a/pkgs/by-name/we/wechat/package.nix
+++ b/pkgs/by-name/we/wechat/package.nix
@@ -30,14 +30,14 @@ let
       # https://dldir1.qq.com/weixin/mac/mac-release.xml
       any-darwin =
         let
-          version = "4.1.5.11-31899";
+          version = "4.1.5.17-31953";
           version' = lib.replaceString "-" "_" version;
         in
         {
           inherit version;
           src = fetchurl {
             url = "https://dldir1v6.qq.com/weixin/Universal/Mac/xWeChatMac_universal_${version'}.dmg";
-            hash = "sha256-uBOjBrUH2kTxSMJjycHynCN/FZqxphzp3zkgouiJp+o=";
+            hash = "sha256-eItxPcvlzxwqXG7IxN001aoR+9SqyVOA7y71Sh83jYI=";
           };
         };
     in
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 7c702660d390..d7f9a42511ad 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -90,7 +90,15 @@ let
         substituteInPlace Configurations/unix-Makefile.tmpl \
           --replace 'ENGINESDIR=$(libdir)/engines-{- $sover_dirname -}' \
                     'ENGINESDIR=$(OPENSSLDIR)/engines-{- $sover_dirname -}'
-      '';
+      ''
+      # This test will fail if the error strings between the build libc and host
+      # libc mismatch, e.g. when cross-compiling from glibc to musl
+      +
+        lib.optionalString
+          (finalAttrs.finalPackage.doCheck && stdenv.hostPlatform.libc != stdenv.buildPlatform.libc)
+          ''
+            rm test/recipes/02-test_errstr.t
+          '';
 
       outputs = [
         "bin"
@@ -186,11 +194,6 @@ let
             "--openssldir=/.$(etc)/etc/ssl"
         )
       ]
-      # Tell build system it's cross environment. This allows to skip tests
-      # that would fail when libc is different. Otherwise, run the tests.
-      ++ lib.optional (
-        !lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform
-      ) "--cross-compile-prefix=${lib.getBin stdenv.cc}/bin/"
       ++ lib.optionals withCryptodev [
         "-DHAVE_CRYPTODEV"
         "-DUSE_CRYPTODEV_DIGESTS"
diff --git a/pkgs/development/python-modules/beautysh/default.nix b/pkgs/development/python-modules/beautysh/default.nix
index 199e6bab6ed5..b66f2b58173a 100644
--- a/pkgs/development/python-modules/beautysh/default.nix
+++ b/pkgs/development/python-modules/beautysh/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "beautysh";
-  version = "6.4.1";
+  version = "6.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lovesegfault";
     repo = "beautysh";
     tag = "v${version}";
-    hash = "sha256-B+1qwivb9MZ+W0u7hccDt3aTjDOcbEQ89Alc8mWd2Sg=";
+    hash = "sha256-wLqysNhkagZ+sphqMC78cLoKvsMJpJCJr16lgvU37JI=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/cantools/default.nix b/pkgs/development/python-modules/cantools/default.nix
index 73da6bd0fbe2..a3a2bf11142d 100644
--- a/pkgs/development/python-modules/cantools/default.nix
+++ b/pkgs/development/python-modules/cantools/default.nix
@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "cantools";
-  version = "41.0.0";
+  version = "41.0.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gdfvoy1moUmTSyG2kaQPtA254LdPoCwk9PJX9YfRaa4=";
+    hash = "sha256-WycDUgKJuRFR5fPFT8wBxoijgrqDqjf6RnQxV4Pl8uk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/frozendict/default.nix b/pkgs/development/python-modules/frozendict/default.nix
index 7fe6bf02311c..db16aa1bafe7 100644
--- a/pkgs/development/python-modules/frozendict/default.nix
+++ b/pkgs/development/python-modules/frozendict/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "frozendict";
-  version = "2.4.6";
+  version = "2.4.7";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Marco-Sulla";
     repo = "python-frozendict";
     tag = "v${version}";
-    hash = "sha256-cdKI0wIr0w6seV12cigqyJL6PSkLVzwVxASUB8n7lFY=";
+    hash = "sha256-ehx8X3jbKls/DVgCzWJ+nTX+m/Cdknnu/sjrAMxnJFo=";
   };
 
   # build C version if it exists
diff --git a/pkgs/development/python-modules/lacuscore/default.nix b/pkgs/development/python-modules/lacuscore/default.nix
index e4017d2c7899..14924e955cb1 100644
--- a/pkgs/development/python-modules/lacuscore/default.nix
+++ b/pkgs/development/python-modules/lacuscore/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "lacuscore";
-  version = "1.19.3";
+  version = "1.20.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ail-project";
     repo = "LacusCore";
     tag = "v${version}";
-    hash = "sha256-mm9oInWx7xZ+39kNOt77TLjCCf60Tmisefh71+2ZIMw=";
+    hash = "sha256-L7hmqNymXkZD/NQk1OQ9H34aJcCa6W23gkQSjomv7Iw=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-milvus/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-milvus/default.nix
index e29574277fe2..b534afc3d8be 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-milvus/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-milvus/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "llama-index-vector-stores-milvus";
-  version = "0.9.3";
+  version = "0.9.4";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_vector_stores_milvus";
     inherit version;
-    hash = "sha256-JiGsSKKlwV3efEkT5p3lXcEY7hCbVWRdCAX9X539Ke0=";
+    hash = "sha256-Zf+/xk3bqN/ARvwzDiN4/g7Neo6l9x5wTcTSvzto//A=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index 555c4b605a8f..b49e18f29e1b 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -2,23 +2,20 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
   rns,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "lxmf";
-  version = "0.9.2";
+  version = "0.9.3";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "markqvist";
     repo = "lxmf";
     tag = version;
-    hash = "sha256-9xmg0ofp/0Cy8+et80qWNFIRyiF3vTmdzACLIO+t27U=";
+    hash = "sha256-bPRoKJGMy+JAyhKcRXKR3Jra5K1UAjRMg0lMt2lOvzA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pytenable/default.nix b/pkgs/development/python-modules/pytenable/default.nix
index ad1fa92a6980..e3d05bc51238 100644
--- a/pkgs/development/python-modules/pytenable/default.nix
+++ b/pkgs/development/python-modules/pytenable/default.nix
@@ -15,7 +15,6 @@
   pytestCheckHook,
   python-box,
   python-dateutil,
-  pythonOlder,
   requests-pkcs12,
   requests-toolbelt,
   requests,
@@ -28,16 +27,14 @@
 
 buildPythonPackage rec {
   pname = "pytenable";
-  version = "1.8.4";
+  version = "1.9.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
-
   src = fetchFromGitHub {
     owner = "tenable";
     repo = "pyTenable";
     tag = version;
-    hash = "sha256-Dt6jN+0Ktv3CO88RmbgKCU8v3Oa10MnKjyJaePxXsaI=";
+    hash = "sha256-ml5364D3qvd6VNhF2JyGoCzxbdO0DBkaBMoD38O5x8o=";
   };
 
   pythonRelaxDeps = [
@@ -102,7 +99,7 @@ buildPythonPackage rec {
     description = "Python library for the Tenable.io and TenableSC API";
     homepage = "https://github.com/tenable/pyTenable";
     changelog = "https://github.com/tenable/pyTenable/releases/tag/${src.tag}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 08d7b9d6d394..6cb2b200cf47 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "1.0.2";
+  version = "1.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "markqvist";
     repo = "Reticulum";
     tag = version;
-    hash = "sha256-c2k+jEiDwtauM+2x8HNqLZIUv4d53hVngS6LbIIs+k4=";
+    hash = "sha256-Tvn51iODNES35VRDR7/Ev/8El5XDe1nObujrjhcvrM8=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/svgdigitizer/default.nix b/pkgs/development/python-modules/svgdigitizer/default.nix
index aaac0e457a36..1c12a5f258be 100644
--- a/pkgs/development/python-modules/svgdigitizer/default.nix
+++ b/pkgs/development/python-modules/svgdigitizer/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  stdenv,
 
   # build-system
   setuptools,
@@ -29,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "svgdigitizer";
-  version = "0.13.0";
+  version = "0.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "echemdb";
     repo = "svgdigitizer";
     tag = version;
-    hash = "sha256-UlcvCfNoEijIKoqSbufEZ6988rqwT2xDEy4P/9fdgVM=";
+    hash = "sha256-ZOR9CviQhPyJQjbLpR53ZVwaarrICg87vtzCL1nq+jE=";
   };
 
   build-system = [
@@ -70,6 +69,11 @@ buildPythonPackage rec {
     "svgdigitizer"
   ];
 
+  disabledTests = [
+    # test tries to connect to doi.org
+    "svgdigitizer.pdf.Pdf.bibliographic_entry"
+  ];
+
   pythonImportsCheck = [
     "svgdigitizer"
   ];
diff --git a/pkgs/development/python-modules/yara-x/default.nix b/pkgs/development/python-modules/yara-x/default.nix
index dccaaea60ea1..01c4e15df120 100644
--- a/pkgs/development/python-modules/yara-x/default.nix
+++ b/pkgs/development/python-modules/yara-x/default.nix
@@ -9,21 +9,21 @@
 
 buildPythonPackage rec {
   pname = "yara-x";
-  version = "1.9.0";
+  version = "1.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${version}";
-    hash = "sha256-yoQoAtgXBgniNebU9HMxF1m0UHFD6iU095he9tCNNIo=";
+    hash = "sha256-aRFDutYFD476xq2TTVWB5CxF1pi3C24NJpfc5kD+aNA=";
   };
 
   buildAndTestSubdir = "py";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname src version;
-    hash = "sha256-/HMyNofKpeYaFfRcZ1LAb3vfW/TQy+DsILXRCpJFlCQ=";
+    hash = "sha256-CT+walpFIFTaO480ATHO1E38K9Tw14QqLRYzztWQmeA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 1c0435d1306f..235bae47ff91 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -16,9 +16,9 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.17.7"; # zen
+      version = "6.17.8"; # zen
       suffix = "zen1"; # zen
-      sha256 = "01dh7cdqa4rx0fmr22yyn8d6qb8ns7v0x53k2ij3vrp9pz6p5cs4"; # zen
+      sha256 = "0khz49xgqvbxsq0gk127xspic3ks1x61v3ggnjzwhzsgpqyvjv04"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx
diff --git a/pkgs/servers/sql/postgresql/ext/postgis.nix b/pkgs/servers/sql/postgresql/ext/postgis.nix
index 2c2126190ff6..2ca28f659af8 100644
--- a/pkgs/servers/sql/postgresql/ext/postgis.nix
+++ b/pkgs/servers/sql/postgresql/ext/postgis.nix
@@ -35,7 +35,7 @@ let
 in
 postgresqlBuildExtension (finalAttrs: {
   pname = "postgis";
-  version = "3.6.0";
+  version = "3.6.1";
 
   outputs = [
     "out"
@@ -46,7 +46,7 @@ postgresqlBuildExtension (finalAttrs: {
     owner = "postgis";
     repo = "postgis";
     tag = finalAttrs.version;
-    hash = "sha256-L8k3yk1Dn4Dk7UyHse+8RJsjYsYMebdsiZp6fS7cC0Y=";
+    hash = "sha256-WVS2TWKishTnCWJ87Vvdcb0i3VR+g/qSjcTDO1cx1s0=";
   };
 
   buildInputs = [