From dcc36d1e746d187e6d2f3e057fcd653508c02b33 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Sun, 8 Feb 2026 21:33:33 +0200
Subject: [PATCH 01/25] nixos/power-management: use sleep.target instead of
 listing all individual sleep targets

See https://www.freedesktop.org/software/systemd/man/latest/systemd.special.html#sleep.target
---
 nixos/modules/config/power-management.nix | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/config/power-management.nix b/nixos/modules/config/power-management.nix
index 6b2253068c0b..b061bbe6b707 100644
--- a/nixos/modules/config/power-management.nix
+++ b/nixos/modules/config/power-management.nix
@@ -83,12 +83,8 @@ in
 
     systemd.services.post-resume = {
       description = "Post-Resume Actions";
-      after = [
-        "suspend.target"
-        "hibernate.target"
-        "hybrid-sleep.target"
-        "suspend-then-hibernate.target"
-      ];
+      # Pulled in by post-resume.service above
+      after = [ "sleep.target" ];
       script = ''
         /run/current-system/systemd/bin/systemctl try-restart --no-block post-resume.target
         ${cfg.resumeCommands}

From 34fd3fe6a21e7564416eff18ca57d9df3a5f7f99 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Sun, 8 Feb 2026 21:34:37 +0200
Subject: [PATCH 02/25] nixos/power-management: run postBootCommands in a
 systemd service instead of stage2-init.sh

This reduces our initrd script slightly, and we never made any clear
ordering guarantees about when these commands run anyway.
It also removes this as a blocker for nixos-init.
---
 nixos/modules/config/power-management.nix      | 15 +++++++++++++++
 nixos/modules/system/activation/nixos-init.nix |  4 ----
 nixos/modules/system/boot/stage-2.nix          |  1 -
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/config/power-management.nix b/nixos/modules/config/power-management.nix
index b061bbe6b707..5dcfe5bf013c 100644
--- a/nixos/modules/config/power-management.nix
+++ b/nixos/modules/config/power-management.nix
@@ -81,6 +81,21 @@ in
       serviceConfig.Type = "oneshot";
     };
 
+    systemd.services.post-boot = {
+      description = "Post-boot Actions";
+      # It's not well defined at what point in the bootup sequence this should run
+      # we should eventually just remove this.
+      after = [ "multi-user.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      script = ''
+        ${cfg.powerUpCommands}
+      '';
+    };
+
     systemd.services.post-resume = {
       description = "Post-Resume Actions";
       # Pulled in by post-resume.service above
diff --git a/nixos/modules/system/activation/nixos-init.nix b/nixos/modules/system/activation/nixos-init.nix
index 9d5094017c0b..1ab2e546d40a 100644
--- a/nixos/modules/system/activation/nixos-init.nix
+++ b/nixos/modules/system/activation/nixos-init.nix
@@ -58,10 +58,6 @@ in
           assertion = config.boot.postBootCommands == "";
           message = "nixos-init cannot be used with boot.postBootCommands";
         }
-        {
-          assertion = config.powerManagement.powerUpCommands == "";
-          message = "nixos-init cannot be used with powerManagement.powerUpCommands";
-        }
       ];
     })
   ];
diff --git a/nixos/modules/system/boot/stage-2.nix b/nixos/modules/system/boot/stage-2.nix
index 680f5eed55c0..9b72391c20ac 100644
--- a/nixos/modules/system/boot/stage-2.nix
+++ b/nixos/modules/system/boot/stage-2.nix
@@ -30,7 +30,6 @@ let
       );
       postBootCommands = pkgs.writeText "local-cmds" ''
         ${config.boot.postBootCommands}
-        ${config.powerManagement.powerUpCommands}
       '';
     };
   };

From c12ba2de5b7ee4212cc0826c4d8ad4ae20afea29 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 10 Feb 2026 00:28:43 +0000
Subject: [PATCH 03/25] capstone: 5.0.6 -> 5.0.7

---
 pkgs/by-name/ca/capstone/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ca/capstone/package.nix b/pkgs/by-name/ca/capstone/package.nix
index e774c10f4372..2f0bb919d37c 100644
--- a/pkgs/by-name/ca/capstone/package.nix
+++ b/pkgs/by-name/ca/capstone/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "capstone";
-  version = "5.0.6";
+  version = "5.0.7";
 
   src = fetchFromGitHub {
     owner = "capstone-engine";
     repo = "capstone";
     rev = finalAttrs.version;
-    hash = "sha256-ovIvsxVq+/q5UUMzP4WpxzaE0898uayNc1g2Coignnc=";
+    hash = "sha256-+6QReHZK+iIXspizy6Kvk7cj016HOKgiaKSaP4h7mao=";
   };
 
   cmakeFlags = [

From df0b0d2f147e1cad7683aba0545ac8291c2827d1 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Sun, 8 Feb 2026 21:36:13 +0200
Subject: [PATCH 04/25] nixos/power-management: deprecate powerUpCommands

Their ordering is ill-defined. Users are better off using an explicit systemd service.
---
 nixos/modules/config/power-management.nix | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/config/power-management.nix b/nixos/modules/config/power-management.nix
index 5dcfe5bf013c..b5ae488697a2 100644
--- a/nixos/modules/config/power-management.nix
+++ b/nixos/modules/config/power-management.nix
@@ -62,6 +62,19 @@ in
 
   config = lib.mkIf cfg.enable {
 
+    warnings = lib.optional (cfg.powerUpCommands != "") ''
+      powerManagement.powerUpCommands is deprecated due to it having unclear ordering semantics.
+      It will be removed in NixOS 26.11.
+      It is recommended to create an explicit systemd oneshot service instead,
+      that is pulled in at the right time during the boot process.
+      See https://www.freedesktop.org/software/systemd/man/latest/systemd.special.html
+      for more information on possible targets that can be used for this.
+
+      If you also want to run this service upon waking up from resume, the recommended
+      method to do so is described here:
+      https://www.freedesktop.org/software/systemd/man/latest/systemd.special.html#sleep.target
+    '';
+
     systemd.targets.post-resume = {
       description = "Post-Resume Actions";
       requires = [ "post-resume.service" ];
@@ -85,8 +98,8 @@ in
       description = "Post-boot Actions";
       # It's not well defined at what point in the bootup sequence this should run
       # we should eventually just remove this.
-      after = [ "multi-user.target" ];
       wantedBy = [ "multi-user.target" ];
+      restartIfChanged = false;
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;

From 30cb9399cc7e42e31bc2db104a49ac9d5e0544a7 Mon Sep 17 00:00:00 2001
From: Elec3137 <elec3137@proton.me>
Date: Tue, 10 Feb 2026 11:49:28 -0800
Subject: [PATCH 05/25] nixos-rebuild-ng: add --diff argument

This displays the package updates, additions, and removals to the user.
---
 .../ni/nixos-rebuild-ng/nixos-rebuild.8.scd        |  8 ++++++++
 .../nixos-rebuild-ng/src/nixos_rebuild/__init__.py | 14 ++++++++++++++
 .../ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py   | 12 ++++++++++++
 .../nixos-rebuild-ng/src/nixos_rebuild/services.py |  8 ++++++++
 4 files changed, 42 insertions(+)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
index 43b8c233e290..b2298ce10639 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
@@ -308,6 +308,14 @@ It must be one of the following:
 	option, it is possible to build non-flake NixOS configurations even if
 	the current NixOS systems uses flakes.
 
+*--diff*
+	show the diff between the system closure in /run/current-system
+	and the newly built system closure.
+	(avaliable for actions: build, boot, test, switch)
+
+	This is similar to running:
+	"nix store diff-closures /run/current-system result" after build
+
 In addition, *nixos-rebuild* accepts following options from nix commands that
 the tool calls:
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index ad0f45b3971b..29e05617d60d 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -197,6 +197,12 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
         help="Selects an image variant to build from the "
         "config.system.build.images attribute of the given configuration",
     )
+    main_parser.add_argument(
+        "--diff",
+        action="store_true",
+        help="prints out the diff between the current system "
+        "and the newly built one using nix store diff-closures"
+    )
     main_parser.add_argument("action", choices=Action.values(), nargs="?")
 
     return main_parser, sub_parsers
@@ -259,6 +265,14 @@ def parse_args(
     if args.no_build_nix:
         parser_warn("--no-build-nix is deprecated, we do not build nix anymore")
 
+    if args.diff and args.action not in (
+        Action.SWITCH.value,
+        Action.BOOT.value,
+        Action.BUILD.value,
+        Action.TEST.value
+    ):
+        parser_warn(f"--diff is a no-op with '{args.action}'")
+
     if args.action == Action.EDIT.value and (args.file or args.attr):
         parser.error("--file and --attr are not supported with 'edit'")
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index d2c5ceace95c..9ac72d824ba1 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -537,6 +537,18 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
             reverse=True,
         )
 
+def diff_closures(path_to_config: Path):
+    run_wrapper(
+        [
+            "nix",
+            *FLAKE_FLAGS,
+            "store",
+            "diff-closures",
+            "/run/current-system",
+            path_to_config
+        ]
+    )
+
 
 def repl(build_attr: BuildAttr, nix_flags: Args | None = None) -> None:
     run_args = ["nix", "repl", "--file", build_attr.path]
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
index 735be1680013..95ff0bede090 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
@@ -321,6 +321,14 @@ def build_and_activate_system(
             grouped_nix_args=grouped_nix_args,
         )
 
+    if args.diff and args.action in (
+        Action.SWITCH.value,
+        Action.BOOT.value,
+        Action.BUILD.value,
+        Action.TEST.value
+    ):
+        nix.diff_closures(path_to_config)
+
     _activate_system(
         path_to_config=path_to_config,
         action=action,

From aaae02bd2aa4c99f6d3224ae099c7d20cac65038 Mon Sep 17 00:00:00 2001
From: Electria <117232210+Elec3137@users.noreply.github.com>
Date: Wed, 11 Feb 2026 06:59:04 -0800
Subject: [PATCH 06/25] nixos-rebuild-ng: generalize diff_closures

also adds support for remote hosts

Co-authored-by: Thiago Kenji Okada <thiagokokada@gmail.com>
---
 .../by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 9ac72d824ba1..5726853dd8ba 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -537,16 +537,17 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
             reverse=True,
         )
 
-def diff_closures(path_to_config: Path):
+def diff_closures(current_config: Path, new_config: Path, target_host: Remote | None = None):
     run_wrapper(
         [
             "nix",
             *FLAKE_FLAGS,
             "store",
             "diff-closures",
-            "/run/current-system",
-            path_to_config
-        ]
+            current_config,
+            new_config,
+        ],
+        remote=target_host,
     )
 
 

From c1e16f898e73574891eecab69537a864fbc56ac1 Mon Sep 17 00:00:00 2001
From: Electria <117232210+Elec3137@users.noreply.github.com>
Date: Wed, 11 Feb 2026 07:12:27 -0800
Subject: [PATCH 07/25] nixos-rebuild-ng: adapt to general diff_closures

also adds a check and warning for if the current_config is missing

Co-authored-by: Thiago Kenji Okada <thiagokokada@gmail.com>
---
 .../nixos-rebuild-ng/src/nixos_rebuild/services.py  | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
index 95ff0bede090..2a49084c6f85 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
@@ -321,13 +321,12 @@ def build_and_activate_system(
             grouped_nix_args=grouped_nix_args,
         )
 
-    if args.diff and args.action in (
-        Action.SWITCH.value,
-        Action.BOOT.value,
-        Action.BUILD.value,
-        Action.TEST.value
-    ):
-        nix.diff_closures(path_to_config)
+    current_config = Path("/run/current-system")
+    if args.diff:
+        if current_config.exists():
+            nix.diff_closures(current_config=current_config, new_config=path_to_config, target_host=target_host)
+        else:
+            logger.warn(f"missing '{str(current_config)}', skipping configuration diff...")
 
     _activate_system(
         path_to_config=path_to_config,

From 388d8d23cd7ccb08f6b365ca39d806c678281fe2 Mon Sep 17 00:00:00 2001
From: Elec3137 <elec3137@proton.me>
Date: Wed, 11 Feb 2026 07:21:30 -0800
Subject: [PATCH 08/25] nixos-rebuild-ng: align condition for no-op warning
 with relaxed diff_closures call

---
 .../ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py     | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index 29e05617d60d..814d6c481c2f 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -266,10 +266,16 @@ def parse_args(
         parser_warn("--no-build-nix is deprecated, we do not build nix anymore")
 
     if args.diff and args.action not in (
+        # case for calling build_and_activate_system
+        # except excluding DRY_BUILD and DRY_ACTIVATE,
+        # in which --diff is uniquely a no-op
         Action.SWITCH.value,
         Action.BOOT.value,
+        Action.TEST.value,
         Action.BUILD.value,
-        Action.TEST.value
+        Action.BUILD_IMAGE.value,
+        Action.BUILD_VM.value,
+        Action.BUILD_VM_WITH_BOOTLOADER.value,
     ):
         parser_warn(f"--diff is a no-op with '{args.action}'")
 

From 6ac558781e71c75d65c0f19f9501eebcfbcd60ba Mon Sep 17 00:00:00 2001
From: Elec3137 <elec3137@proton.me>
Date: Wed, 11 Feb 2026 08:44:51 -0800
Subject: [PATCH 09/25] nixos-rebuild-ng: print out diffed closures

---
 pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py   | 6 ++++++
 .../ni/nixos-rebuild-ng/src/nixos_rebuild/services.py       | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 5726853dd8ba..b42af896d3c1 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -1,3 +1,4 @@
+import sys
 import json
 import logging
 import os
@@ -538,6 +539,11 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
         )
 
 def diff_closures(current_config: Path, new_config: Path, target_host: Remote | None = None):
+    print(
+        f"<<< {current_config}"
+        f">>> {new_config}",
+        file=sys.stderr
+    )
     run_wrapper(
         [
             "nix",
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
index 2a49084c6f85..ba8effa134a1 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
@@ -321,12 +321,12 @@ def build_and_activate_system(
             grouped_nix_args=grouped_nix_args,
         )
 
-    current_config = Path("/run/current-system")
+    current_config = Path("/run/current-system").readlink()
     if args.diff:
         if current_config.exists():
             nix.diff_closures(current_config=current_config, new_config=path_to_config, target_host=target_host)
         else:
-            logger.warn(f"missing '{str(current_config)}', skipping configuration diff...")
+            logger.warning(f"missing '{str(current_config)}', skipping configuration diff...")
 
     _activate_system(
         path_to_config=path_to_config,

From e3a7e3dcf53699e8b13f7e6007f51ce736ae376e Mon Sep 17 00:00:00 2001
From: Elec3137 <elec3137@proton.me>
Date: Wed, 11 Feb 2026 09:58:19 -0800
Subject: [PATCH 10/25] nixos-rebuild-ng: fix test failures due to early
 readlink()

---
 .../by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
index ba8effa134a1..933c2f8de10e 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
@@ -321,10 +321,10 @@ def build_and_activate_system(
             grouped_nix_args=grouped_nix_args,
         )
 
-    current_config = Path("/run/current-system").readlink()
+    current_config = Path("/run/current-system")
     if args.diff:
         if current_config.exists():
-            nix.diff_closures(current_config=current_config, new_config=path_to_config, target_host=target_host)
+            nix.diff_closures(current_config=current_config.readlink(), new_config=path_to_config, target_host=target_host)
         else:
             logger.warning(f"missing '{str(current_config)}', skipping configuration diff...")
 

From 5d230871220a27b8ee7c5b18d9a285c4d0789779 Mon Sep 17 00:00:00 2001
From: Elec3137 <elec3137@proton.me>
Date: Wed, 11 Feb 2026 10:24:04 -0800
Subject: [PATCH 11/25] nixos-rebuild-ng: add unit test for diff_closures

---
 .../ni/nixos-rebuild-ng/src/tests/test_nix.py | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index c4b37bf0c32f..bcdefee20f77 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -550,6 +550,28 @@ def test_list_generations(mock_get_generations: Mock, tmp_path: Path) -> None:
     ]
 
 
+@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
+def test_diff_closures(mock_run: Mock) -> None:
+
+    assert n.diff_closures(
+        Path("/run/current-system"),
+        Path("/nix/var/nix/profiles/system"),
+        None
+    ) == None
+    mock_run.assert_called_with(
+        [
+            "nix",
+            "--extra-experimental-features",
+            "nix-command flakes",
+            "store",
+            "diff-closures",
+            Path("/run/current-system"),
+            Path("/nix/var/nix/profiles/system"),
+        ],
+        remote=None
+    )
+
+
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_repl(mock_run: Mock) -> None:
     n.repl(m.BuildAttr("<nixpkgs/nixos>", None), {"nix_flag": True})

From 5bcffa5447893666ff2cfe8daecd412e5dbac9d6 Mon Sep 17 00:00:00 2001
From: Elec3137 <elec3137@proton.me>
Date: Wed, 11 Feb 2026 11:17:31 -0800
Subject: [PATCH 12/25] nixos-rebuild-ng: fix printing

print user info (diffs) into stderr, add back missing newline
---
 pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py | 3 ++-
 pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py    | 4 +++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index b42af896d3c1..2804ea94a7b2 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -540,7 +540,7 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
 
 def diff_closures(current_config: Path, new_config: Path, target_host: Remote | None = None):
     print(
-        f"<<< {current_config}"
+        f"<<< {current_config}\n"
         f">>> {new_config}",
         file=sys.stderr
     )
@@ -554,6 +554,7 @@ def diff_closures(current_config: Path, new_config: Path, target_host: Remote |
             new_config,
         ],
         remote=target_host,
+        stdout=sys.stderr
     )
 
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index bcdefee20f77..69d29422337a 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -1,3 +1,4 @@
+import sys
 import textwrap
 import uuid
 from pathlib import Path
@@ -568,7 +569,8 @@ def test_diff_closures(mock_run: Mock) -> None:
             Path("/run/current-system"),
             Path("/nix/var/nix/profiles/system"),
         ],
-        remote=None
+        remote=None,
+        stdout=sys.stderr
     )
 
 

From 030ba3ca5fc683fda1f9db6235a6277a5a8408a7 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 11 Feb 2026 21:28:16 +0000
Subject: [PATCH 13/25] strace: 6.18 -> 6.19

Changes: https://github.com/strace/strace/releases/tag/v6.19
---
 pkgs/by-name/st/strace/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix
index 7fc77c29599a..9820ae631ab2 100644
--- a/pkgs/by-name/st/strace/package.nix
+++ b/pkgs/by-name/st/strace/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "strace";
-  version = "6.18";
+  version = "6.19";
 
   src = fetchurl {
     url = "https://strace.io/files/${finalAttrs.version}/strace-${finalAttrs.version}.tar.xz";
-    hash = "sha256-CtXcupc6aed5ZQ7xyzNbEu5gcW/HMmYJiVvTPm0qcyU=";
+    hash = "sha256-4HbIUe7AlySG7IQhZP3FRUf50Xq9PRRJ3osSD10pkUM=";
   };
 
   separateDebugInfo = true;

From 8446dfc3c92c82dbd13f39e3ede2b9be8b4890fb Mon Sep 17 00:00:00 2001
From: mlyxshi <mlyxdev@gmail.com>
Date: Wed, 11 Feb 2026 09:12:25 +0800
Subject: [PATCH 14/25] pkgs/build-support/kernel/make-initrd-ng.nix:
 unsafeDiscardReferences.out = true

---
 pkgs/build-support/kernel/make-initrd-ng.nix | 67 +++++++++++---------
 1 file changed, 36 insertions(+), 31 deletions(-)

diff --git a/pkgs/build-support/kernel/make-initrd-ng.nix b/pkgs/build-support/kernel/make-initrd-ng.nix
index 0b1db74f0449..768af8f5c48d 100644
--- a/pkgs/build-support/kernel/make-initrd-ng.nix
+++ b/pkgs/build-support/kernel/make-initrd-ng.nix
@@ -16,7 +16,6 @@ in
   pkgsBuildHost,
   makeInitrdNGTool,
   binutils,
-  runCommand,
   # Name of the derivation (not of the resulting file!)
   name ? "initrd",
 
@@ -74,47 +73,53 @@ in
     _compressorMeta.ubootName
       or (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression"),
 }:
-runCommand name
-  {
-    compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
-    passthru = {
-      compressorExecutableFunction = _compressorFunction;
-      compressorArgs = _compressorArgsReal;
-    };
+stdenvNoCC.mkDerivation (finalAttrs: {
+  __structuredAttrs = true;
 
-    inherit
-      extension
-      makeUInitrd
-      uInitrdArch
-      prepend
-      ;
-    ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;
+  # the initrd will be self-contained so we can drop references
+  # to the closure that was used to build it
+  unsafeDiscardReferences.out = true;
 
-    passAsFile = [ "contents" ];
-    contents = builtins.toJSON contents;
+  inherit
+    name
+    extension
+    makeUInitrd
+    uInitrdArch
+    prepend
+    ;
+  ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;
 
-    nativeBuildInputs = [
-      makeInitrdNGTool
-      cpio
-    ]
-    ++ lib.optional makeUInitrd ubootTools;
-  }
-  ''
+  compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
+  contentsJSON = builtins.toJSON contents;
+
+  nativeBuildInputs = [
+    makeInitrdNGTool
+    cpio
+  ]
+  ++ lib.optional makeUInitrd ubootTools;
+
+  buildCommand = ''
     mkdir -p ./root/{run,tmp,var/empty}
     ln -s ../run ./root/var/run
-    make-initrd-ng "$contentsPath" ./root
+    make-initrd-ng <(echo "$contentsJSON") ./root
     mkdir "$out"
     (cd root && find . -exec touch -h -d '@1' '{}' +)
-    for PREP in $prepend; do
+    for PREP in ''${prepend[@]}; do
       cat $PREP >> $out/initrd
     done
     (cd root && find . -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd")
 
     if [ -n "$makeUInitrd" ]; then
-        mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
-        # Compatibility symlink
-        ln -sf "initrd.img" "$out/initrd"
+      mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
+      # Compatibility symlink
+      ln -sf "initrd.img" "$out/initrd"
     else
-        ln -s "initrd" "$out/initrd$extension"
+      ln -s "initrd" "$out/initrd$extension"
     fi
-  ''
+  '';
+
+  passthru = {
+    compressorExecutableFunction = _compressorFunction;
+    compressorArgs = _compressorArgsReal;
+  };
+})

From de5cb839e4774dace86c102860cdd1d8bdf2300d Mon Sep 17 00:00:00 2001
From: mlyxshi <mlyxdev@gmail.com>
Date: Thu, 12 Feb 2026 15:24:53 +0800
Subject: [PATCH 15/25] pkgs/build-support/kernel/make-initrd.nix:
 unsafeDiscardReferences.out = true

---
 pkgs/build-support/kernel/make-initrd.nix | 68 ++++++++++++-----------
 pkgs/build-support/kernel/make-initrd.sh  | 28 ++++------
 2 files changed, 47 insertions(+), 49 deletions(-)

diff --git a/pkgs/build-support/kernel/make-initrd.nix b/pkgs/build-support/kernel/make-initrd.nix
index 6f300369aa50..364507ba8e7e 100644
--- a/pkgs/build-support/kernel/make-initrd.nix
+++ b/pkgs/build-support/kernel/make-initrd.nix
@@ -81,42 +81,44 @@ in
     _compressorMeta.ubootName
       or (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression"),
 }:
-stdenvNoCC.mkDerivation (
-  rec {
-    inherit
-      name
-      makeUInitrd
-      extension
-      uInitrdArch
-      prepend
-      ;
+stdenvNoCC.mkDerivation (finalAttrs: {
+  __structuredAttrs = true;
 
-    builder = ./make-initrd.sh;
+  # the initrd will be self-contained so we can drop references
+  # to the closure that was used to build it
+  unsafeDiscardReferences.out = true;
 
-    nativeBuildInputs = [
-      cpio
-    ]
-    ++ lib.optional makeUInitrd ubootTools;
+  inherit
+    name
+    extension
+    makeUInitrd
+    uInitrdArch
+    prepend
+    ;
+  ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;
 
-    compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
+  builder = ./make-initrd.sh;
 
-    # Pass the function through, for reuse in append-initrd-secrets. The
-    # function is used instead of the string, in order to support
-    # cross-compilation (append-initrd-secrets running on a different
-    # architecture than what the main initramfs is built on).
-    passthru = {
-      compressorExecutableFunction = _compressorFunction;
-      compressorArgs = _compressorArgsReal;
-    };
+  nativeBuildInputs = [
+    cpio
+  ]
+  ++ lib.optional makeUInitrd ubootTools;
 
-    # !!! should use XML.
-    objects = map (x: x.object) contents;
-    symlinks = map (x: x.symlink) contents;
-    suffices = map (x: if x ? suffix then x.suffix else "none") contents;
+  compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
 
-    closureInfo = "${pkgsBuildHost.closureInfo { rootPaths = objects; }}";
-  }
-  // lib.optionalAttrs makeUInitrd {
-    uInitrdCompression = uInitrdCompression;
-  }
-)
+  # !!! should use XML.
+  objects = map (x: x.object) contents;
+  symlinks = map (x: x.symlink) contents;
+  suffices = map (x: if x ? suffix then x.suffix else "none") contents;
+
+  closureInfo = "${pkgsBuildHost.closureInfo { rootPaths = finalAttrs.objects; }}";
+
+  # Pass the function through, for reuse in append-initrd-secrets. The
+  # function is used instead of the string, in order to support
+  # cross-compilation (append-initrd-secrets running on a different
+  # architecture than what the main initramfs is built on).
+  passthru = {
+    compressorExecutableFunction = _compressorFunction;
+    compressorArgs = _compressorArgsReal;
+  };
+})
diff --git a/pkgs/build-support/kernel/make-initrd.sh b/pkgs/build-support/kernel/make-initrd.sh
index cc67c14a6a50..f3bc977279b5 100644
--- a/pkgs/build-support/kernel/make-initrd.sh
+++ b/pkgs/build-support/kernel/make-initrd.sh
@@ -1,9 +1,5 @@
 set -o pipefail
 
-objects=($objects)
-symlinks=($symlinks)
-suffices=($suffices)
-
 mkdir root
 
 # Needed for splash_helper, which gets run before init.
@@ -12,14 +8,14 @@ mkdir root/sys
 mkdir root/proc
 
 
-for ((n = 0; n < ${#objects[*]}; n++)); do
-    object=${objects[$n]}
-    symlink=${symlinks[$n]}
-    suffix=${suffices[$n]}
-    if test "$suffix" = none; then suffix=; fi
+for ((n = 0; n < ${#objects[@]}; n++)); do
+  object=${objects[n]}
+  symlink=${symlinks[n]}
+  suffix=${suffices[n]}
+  if test "$suffix" = none; then suffix=; fi
 
-    mkdir -p $(dirname root/$symlink)
-    ln -s $object$suffix root/$symlink
+  mkdir -p $(dirname root/$symlink)
+  ln -s $object$suffix root/$symlink
 done
 
 
@@ -34,16 +30,16 @@ storePaths="$(cat $closureInfo/store-paths)"
 
 # Put the closure in a gzipped cpio archive.
 mkdir -p $out
-for PREP in $prepend; do
+for PREP in ${prepend[@]}; do
   cat $PREP >> $out/initrd
 done
 (cd root && find * .[^.*] -exec touch -h -d '@1' '{}' +)
 (cd root && find * .[^.*] -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd")
 
 if [ -n "$makeUInitrd" ]; then
-    mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
-    # Compatibility symlink
-    ln -sf "initrd.img" "$out/initrd"
+  mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
+  # Compatibility symlink
+  ln -sf "initrd.img" "$out/initrd"
 else
-    ln -s "initrd" "$out/initrd$extension"
+  ln -s "initrd" "$out/initrd$extension"
 fi

From b13891782fdec1b72e1e9ab4f86fce1638f20203 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Mon, 2 Feb 2026 23:49:00 +0100
Subject: [PATCH 16/25] nixos/tests: fix luks tests to not rely on autoFormat

This was testing something very odd where we created an empty luks
volume and only created a fs inside the luks volume on first boot when
opening it. This in fact is not possible without patching systemd and
indeed it shouldn't be.

This change makes the creation of the luks volumes more "normal" by also
opening them and creating an fs inside.

This will allow us to drop systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
---
 nixos/tests/initrd-luks-empty-passphrase.nix | 5 ++---
 nixos/tests/luks.nix                         | 6 +++++-
 nixos/tests/systemd-initrd-luks-keyfile.nix  | 3 ++-
 nixos/tests/systemd-initrd-luks-password.nix | 5 ++++-
 nixos/tests/systemd-initrd-luks-tpm2.nix     | 3 ++-
 nixos/tests/systemd-initrd-luks-unl0kr.nix   | 5 ++++-
 6 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/nixos/tests/initrd-luks-empty-passphrase.nix b/nixos/tests/initrd-luks-empty-passphrase.nix
index 47215c4bc998..3a906685f0ca 100644
--- a/nixos/tests/initrd-luks-empty-passphrase.nix
+++ b/nixos/tests/initrd-luks-empty-passphrase.nix
@@ -19,8 +19,6 @@ in
   nodes.machine =
     { pkgs, ... }:
     {
-      imports = lib.optionals (!systemdStage1) [ ./common/auto-format-root-device.nix ];
-
       virtualisation = {
         emptyDiskImages = [ 512 ];
         useBootLoader = true;
@@ -30,7 +28,6 @@ in
         # the new root device is /dev/vdb
         # an empty 512MiB drive, containing no Nix store.
         mountHostNixStore = true;
-        fileSystems."/".autoFormat = lib.mkIf systemdStage1 true;
       };
 
       boot.loader.systemd-boot.enable = true;
@@ -90,6 +87,8 @@ in
     # Create encrypted volume
     machine.wait_for_unit("multi-user.target")
     machine.succeed("echo "" | cryptsetup luksFormat /dev/vdb --batch-mode")
+    machine.succeed("echo "" | cryptsetup luksOpen /dev/vdb cryptroot")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
     machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-wrong-keyfile.conf")
     machine.succeed("sync")
     machine.crash()
diff --git a/nixos/tests/luks.nix b/nixos/tests/luks.nix
index 685643c4c9dc..7440d110ad28 100644
--- a/nixos/tests/luks.nix
+++ b/nixos/tests/luks.nix
@@ -5,7 +5,6 @@
   nodes.machine =
     { pkgs, ... }:
     {
-      imports = [ ./common/auto-format-root-device.nix ];
 
       # Use systemd-boot
       virtualisation = {
@@ -48,7 +47,12 @@
     # Create encrypted volume
     machine.wait_for_unit("multi-user.target")
     machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+    machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+
     machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
+    machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdc cryptroot2")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
 
     # Boot from the encrypted disk
     machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
diff --git a/nixos/tests/systemd-initrd-luks-keyfile.nix b/nixos/tests/systemd-initrd-luks-keyfile.nix
index 3723307946dd..8b7f28947f72 100644
--- a/nixos/tests/systemd-initrd-luks-keyfile.nix
+++ b/nixos/tests/systemd-initrd-luks-keyfile.nix
@@ -38,7 +38,6 @@ in
           };
         };
         virtualisation.rootDevice = "/dev/mapper/cryptroot";
-        virtualisation.fileSystems."/".autoFormat = true;
         boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
       };
     };
@@ -47,6 +46,8 @@ in
     # Create encrypted volume
     machine.wait_for_unit("multi-user.target")
     machine.succeed("cryptsetup luksFormat -q --iter-time=1 -d ${keyfile} /dev/vdb")
+    machine.succeed("cryptsetup luksOpen --key-file ${keyfile} /dev/vdb cryptroot")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
 
     # Boot from the encrypted disk
     machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
diff --git a/nixos/tests/systemd-initrd-luks-password.nix b/nixos/tests/systemd-initrd-luks-password.nix
index 0f7c2f51a034..4e059f514257 100644
--- a/nixos/tests/systemd-initrd-luks-password.nix
+++ b/nixos/tests/systemd-initrd-luks-password.nix
@@ -31,7 +31,6 @@
           cryptroot2.device = "/dev/vdc";
         };
         virtualisation.rootDevice = "/dev/mapper/cryptroot";
-        virtualisation.fileSystems."/".autoFormat = true;
         # test mounting device unlocked in initrd after switching root
         virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2";
       };
@@ -40,7 +39,11 @@
   testScript = ''
     # Create encrypted volume
     machine.wait_for_unit("multi-user.target")
+
     machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+    machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+
     machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
     machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
     machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
diff --git a/nixos/tests/systemd-initrd-luks-tpm2.nix b/nixos/tests/systemd-initrd-luks-tpm2.nix
index 6cc42bbbda73..931959f05464 100644
--- a/nixos/tests/systemd-initrd-luks-tpm2.nix
+++ b/nixos/tests/systemd-initrd-luks-tpm2.nix
@@ -32,7 +32,6 @@
           };
         };
         virtualisation.rootDevice = "/dev/mapper/cryptroot";
-        virtualisation.fileSystems."/".autoFormat = true;
       };
     };
 
@@ -40,6 +39,8 @@
     # Create encrypted volume
     machine.wait_for_unit("multi-user.target")
     machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+    machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
     machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --tpm2-pcrs= --tpm2-device=auto /dev/vdb |& systemd-cat")
 
     # Boot from the encrypted disk
diff --git a/nixos/tests/systemd-initrd-luks-unl0kr.nix b/nixos/tests/systemd-initrd-luks-unl0kr.nix
index 875e1beb7187..f9dbce1ccdd8 100644
--- a/nixos/tests/systemd-initrd-luks-unl0kr.nix
+++ b/nixos/tests/systemd-initrd-luks-unl0kr.nix
@@ -79,9 +79,12 @@ in
     };
 
   testScript = ''
-    # Create encrypted volume
     machine.wait_for_unit("multi-user.target")
+
     machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+    machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
+    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+
     machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
     machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
     machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")

From b9f2fa1c7dc9ae378c5bff43f45fc5c3fd149ae9 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Tue, 3 Feb 2026 00:49:58 +0100
Subject: [PATCH 17/25] nixos/nixos-containers: create load bearing /usr/bin

/usr/bin is load bearing and needs to be inside a root before nspawn
will pivot to it.

This will allow us to drop systemd/0003-Fix-NixOS-containers.patch
---
 nixos/modules/virtualisation/nixos-containers.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index 9f67f937c2f1..ad0121a48498 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -92,6 +92,7 @@ let
     # Declare root explicitly to avoid shellcheck warnings, it comes from the env
     declare root
 
+    mkdir -p "$root/usr/bin"
     mkdir -p "$root/etc" "$root/var/lib"
     chmod 0755 "$root/etc" "$root/var/lib"
     mkdir -p "$root/var/lib/private" "$root/root" /run/nixos-containers

From 4aae99b7d791c4db7a7db534cba10714054c5fdc Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Thu, 5 Feb 2026 01:45:10 +0100
Subject: [PATCH 18/25] nixos-init: init env-generator

The env generator allows us to declaratively set environment variables
via the module system for all systemd generators.

This will allow us to drop systemd/0013-inherit-systemd-environment-when-calling-generators.patch
---
 .../modules/services/networking/ssh/sshd.nix  |  2 +
 nixos/modules/system/boot/systemd.nix         | 49 ++++++++++++++---
 nixos/tests/systemd-ssh-proxy.nix             |  5 ++
 pkgs/by-name/ni/nixos-init/package.nix        |  1 +
 .../ni/nixos-init/src/env_generator.rs        | 53 +++++++++++++++++++
 pkgs/by-name/ni/nixos-init/src/lib.rs         |  2 +
 pkgs/by-name/ni/nixos-init/src/main.rs        |  3 +-
 7 files changed, 108 insertions(+), 7 deletions(-)
 create mode 100644 pkgs/by-name/ni/nixos-init/src/env_generator.rs

diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index c289d1961205..b87e5ccad65f 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -742,6 +742,8 @@ in
       };
 
       systemd = {
+        generatorPath = [ cfg.package ];
+
         sockets.sshd = lib.mkIf cfg.startWhenNeeded {
           description = "SSH Socket";
           wantedBy = [ "sockets.target" ];
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 2d81b1bb3d44..9a187e86d76b 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -233,6 +233,8 @@ let
 
   proxy_env = config.networking.proxy.envVars;
 
+  json = pkgs.formats.json { };
+
 in
 
 {
@@ -356,6 +358,30 @@ in
       '';
     };
 
+    generatorEnvironment = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      example = {
+        MY_VAR = "my-value";
+      };
+      description = ''
+        Environment variables for systemd generators.
+
+        The `PATH` environment variable is populated via `systemd.generatorPath`.
+      '';
+    };
+
+    generatorPath = mkOption {
+      type = types.listOf types.package;
+      default = [ ];
+      example = [
+        pkgs.hello
+      ];
+      description = ''
+        Packages added to the `PATH` environment variable of all systemd generators.
+      '';
+    };
+
     shutdown = mkOption {
       type = types.attrsOf types.path;
       default = { };
@@ -636,6 +662,12 @@ in
         "systemd/user-preset/00-nixos.preset".text = ''
           ignore *
         '';
+
+        "systemd/generator-environment.json".source =
+          json.generate "systemd-generator-environment.json" cfg.generatorEnvironment;
+
+        "systemd/system-environment-generators/env-generator".source =
+          "${config.system.nixos-init.package}/bin/env-generator";
       };
 
     services.dbus.enable = true;
@@ -683,12 +715,7 @@ in
     systemd.managerEnvironment = {
       # Doesn't contain systemd itself - everything works so it seems to use the compiled-in value for its tools
       # util-linux is needed for the main fsck utility wrapping the fs-specific ones
-      PATH = lib.makeBinPath (
-        config.system.fsPackages
-        ++ [ cfg.package.util-linux ]
-        # systemd-ssh-generator needs sshd in PATH
-        ++ lib.optional config.services.openssh.enable config.services.openssh.package
-      );
+      PATH = lib.makeBinPath (config.system.fsPackages ++ [ cfg.package.util-linux ]);
       LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
       TZDIR = "/etc/zoneinfo";
       # If SYSTEMD_UNIT_PATH ends with an empty component (":"), the usual unit load path will be appended to the contents of the variable
@@ -704,6 +731,16 @@ in
       DefaultIPAccounting = lib.mkDefault true;
     };
 
+    # These are needed for systemd-fstab-generator to schedule systemd-fsck@
+    # units.
+    systemd.generatorPath = config.system.fsPackages ++ [
+      cfg.package.util-linux
+    ];
+
+    systemd.generatorEnvironment = {
+      PATH = lib.makeBinPath cfg.generatorPath;
+    };
+
     system.requiredKernelConfig = map config.lib.kernelConfig.isEnabled [
       "DEVTMPFS"
       "CGROUPS"
diff --git a/nixos/tests/systemd-ssh-proxy.nix b/nixos/tests/systemd-ssh-proxy.nix
index 6ccdc0012b4f..38ae79ba9c1c 100644
--- a/nixos/tests/systemd-ssh-proxy.nix
+++ b/nixos/tests/systemd-ssh-proxy.nix
@@ -19,6 +19,7 @@ in
 
   nodes = {
     virthost = {
+      environment.systemPackages = [ pkgs.jq ];
       services.openssh = {
         enable = true;
         settings.PermitRootLogin = "prohibit-password";
@@ -48,6 +49,10 @@ in
     virthost.succeed("cp '${snakeOilEd25519PrivateKey}' ~/.ssh/id_ed25519")
     virthost.succeed("chmod 600 ~/.ssh/id_ed25519")
 
+    with subtest("Check the environment generator"):
+      print(virthost.succeed("jq '.' /etc/systemd/generator-environment.json"))
+      print(virthost.succeed("/etc/systemd/system-environment-generators/env-generator"))
+
     with subtest("ssh into a container with AF_UNIX"):
       virthost.wait_for_unit("container@guest.service")
       virthost.wait_until_succeeds("ssh -i ~/.ssh/id_ed25519 unix/run/systemd/nspawn/unix-export/guest/ssh echo meow | grep meow")
diff --git a/pkgs/by-name/ni/nixos-init/package.nix b/pkgs/by-name/ni/nixos-init/package.nix
index 0e4c26cb2dd3..c84c711c7599 100644
--- a/pkgs/by-name/ni/nixos-init/package.nix
+++ b/pkgs/by-name/ni/nixos-init/package.nix
@@ -48,6 +48,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "initrd-init"
     "find-etc"
     "resolve-in-root"
+    "env-generator"
   ];
 
   postInstall = ''
diff --git a/pkgs/by-name/ni/nixos-init/src/env_generator.rs b/pkgs/by-name/ni/nixos-init/src/env_generator.rs
new file mode 100644
index 000000000000..69995b601e59
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-init/src/env_generator.rs
@@ -0,0 +1,53 @@
+use std::{
+    collections::HashMap,
+    fs,
+    io::{self, Write},
+};
+
+use anyhow::{Context, Result};
+use serde::Deserialize;
+
+const CONFIG_PATH: &str = "/etc/systemd/generator-environment.json";
+const KMSG_PATH: &str = "/dev/kmsg";
+
+#[derive(Deserialize)]
+struct Config(HashMap<String, String>);
+
+/// Implementation for the entrypoint of the `env-generator` binary.
+///
+/// Reads the JSON config for the systemd generator environment and prints it in KEY=VALUE format
+/// to stdout. This makes the configured environment variables available for all systemd
+/// generators.
+fn env_generator_impl() -> Result<()> {
+    let content = fs::read(CONFIG_PATH).with_context(|| format!("Failed to read {CONFIG_PATH}"))?;
+    let config: Config = serde_json::from_slice(&content).context("Failed to parse config")?;
+
+    let mut buffer = Vec::new();
+    for (key, value) in config.0 {
+        writeln!(&mut buffer, "{key}=\"{value}\"").context("Failed to write to buffer")?;
+    }
+
+    let stdout = io::stdout();
+    let mut locked = stdout.lock();
+    locked
+        .write_all(&buffer)
+        .context("Failed to write to stdout")?;
+
+    Ok(())
+}
+
+/// Entrypoint for the `env-generator` binary.
+///
+/// Generators cannot use normal logging but have to write to /dev/kmsg.
+///
+/// The return value is just here so that we can use the `main.rs` entrypoint for this binary.
+/// Errors returned from this function will not be logged and thus are meaningless.
+pub fn env_generator() -> Result<()> {
+    if let Err(err) = env_generator_impl() {
+        // Sometimes we do not have /dev/kmsg, e.g. inside a container
+        if let Ok(mut kmsg) = fs::OpenOptions::new().write(true).open(KMSG_PATH) {
+            let _ = write!(kmsg, "<3>env-generator: {err:#}");
+        }
+    }
+    Ok(())
+}
diff --git a/pkgs/by-name/ni/nixos-init/src/lib.rs b/pkgs/by-name/ni/nixos-init/src/lib.rs
index 2ee90c6f8228..e9a716724051 100644
--- a/pkgs/by-name/ni/nixos-init/src/lib.rs
+++ b/pkgs/by-name/ni/nixos-init/src/lib.rs
@@ -1,5 +1,6 @@
 mod activate;
 mod config;
+mod env_generator;
 mod find_etc;
 mod fs;
 mod init;
@@ -14,6 +15,7 @@ use anyhow::{Context, Result, bail};
 
 pub use crate::{
     activate::activate,
+    env_generator::env_generator,
     find_etc::find_etc,
     init::init,
     initrd_init::initrd_init,
diff --git a/pkgs/by-name/ni/nixos-init/src/main.rs b/pkgs/by-name/ni/nixos-init/src/main.rs
index a051af590be3..4f74415b8d36 100644
--- a/pkgs/by-name/ni/nixos-init/src/main.rs
+++ b/pkgs/by-name/ni/nixos-init/src/main.rs
@@ -2,7 +2,7 @@ use std::{env, io::Write, process::ExitCode};
 
 use log::Level;
 
-use nixos_init::{find_etc, initrd_init, resolve_in_root};
+use nixos_init::{env_generator, find_etc, initrd_init, resolve_in_root};
 
 fn main() -> ExitCode {
     let arg0 = env::args()
@@ -15,6 +15,7 @@ fn main() -> ExitCode {
         "find-etc" => find_etc,
         "resolve-in-root" => resolve_in_root,
         "initrd-init" => initrd_init,
+        "env-generator" => env_generator,
         _ => {
             log::error!("Command {arg0} unknown");
             return ExitCode::FAILURE;

From 21f7ea4ed2b9916ddecc8bbd167d5ee9edf59087 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Fri, 13 Feb 2026 12:03:42 +0100
Subject: [PATCH 19/25] ruff: 0.15.0 -> 0.15.1

Changelog: https://github.com/astral-sh/ruff/releases/tag/0.15.1
Diff: https://github.com/astral-sh/ruff/compare/0.15.0...0.15.1
---
 pkgs/by-name/ru/ruff/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index d4f1aca0b200..70a260c75721 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,18 +16,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-Q3xujVNv5i3mgdsjnvgTiPoKmK9aeSgz+2IoVrNur4k=";
+    hash = "sha256-Bj4ATRVYrKqigISNiDvgjUw4MLMwfgdID8MqaiVxz0g=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-JMMDOANg+nqrCoxiuIXTcdqm7UZ61pIJwUTJB20TjUM=";
+  cargoHash = "sha256-IF60aGv56Kh+wDYyN7XzLBywepvAxv2HMqSOz+Su2b4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From c7e66d558d185948dde22baaed12f31d55978396 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 13 Feb 2026 21:30:48 +0000
Subject: [PATCH 20/25] qemu: 10.2.0 -> 10.2.1

---
 .../virtualization/qemu/default.nix           | 48 +------------------
 1 file changed, 2 insertions(+), 46 deletions(-)

diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 9fd672be28de..eab01e012993 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -136,11 +136,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "10.2.0";
+  version = "10.2.1";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-njCtG4ufe0RjABWC0aspfznPzOpdCFQMDKbWZyeFiDo=";
+    hash = "sha256-o3F0d9jiyE1jC//7wg9s0yk+tFqh5trG0MwnaJmRyeE=";
   };
 
   depsBuildBuild = [
@@ -267,50 +267,6 @@ stdenv.mkDerivation (finalAttrs: {
       sha256 = "sha256-oC+bRjEHixv1QEFO9XAm4HHOwoiT+NkhknKGPydnZ5E=";
       revert = true;
     })
-
-    # Implement termios2 (TCGETS2 etc) for glibc 2.42 compatibility. Should be in the next release.
-    # https://gitlab.com/qemu-project/qemu/-/issues/3065
-    # https://lore.kernel.org/qemu-devel/20260103153239.15787-1-dilfridge@gentoo.org/t/#u
-    (fetchpatch {
-      name = "0001-Add-termios2-support-to-linux-user.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/e9a8a10e84c1bf6e2e8be000e4dd5c83ba0d8470.patch";
-      hash = "sha256-Zc+ZjiSug3uT/F7+mmoYc2VXqw2MV6UubYqB+pr2dNY=";
-    })
-    (fetchpatch {
-      name = "0002-Add-termios2-support-to-alpha-target.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/8d8c6aeee8599a099e49ec4411f3d1e087ae40ad.patch";
-      hash = "sha256-5e5vUp9nr96ZmVA98W/ETReLbkofayysJXlx1Ck9gDs=";
-    })
-    (fetchpatch {
-      name = "0003-Add-termios2-support-to-hppa-target.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/edc741710acedd61011f937967b960d154794258.patch";
-      hash = "sha256-nls6eTOB06eqACjQ/r1sQvb9YaYmrpJcegsDGqKAOaI=";
-    })
-    (fetchpatch {
-      name = "0004-Add-termios2-support-to-mips-target.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/edf9184f4feb691b0f70dc544443db2380891598.patch";
-      hash = "sha256-GrBhyMq2QiCc+WlUwaB9j4G8vB3ipxJRV5Hvyab/5Fk=";
-    })
-    (fetchpatch {
-      name = "0005-Add-termios2-support-to-sh4-target.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/afbe0ff81c29d674b9c18a588bcaab34ddcb8a7b.patch";
-      hash = "sha256-h+9eC6H8/GJ85Lt1Y0ggdJbbgTIvDfIJkPQfX/FgO4c=";
-    })
-    (fetchpatch {
-      name = "0006-Add-termios2-support-to-sparc-target.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/947b971cad90375040f399899909a3f1f32b483f.patch";
-      hash = "sha256-/JvF25aSR2mBSvkpqupDySMJYZI+lv7L0YwhqiaDk3A=";
-    })
-    (fetchpatch {
-      name = "0007-linux-user-Add-missing-termios-baud-rates.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/4f22fcb5c67f40a36e6654f6cfaee23f9f9e93d1.patch";
-      hash = "sha256-CM81yL0/i+fmQe8qzemre13N3A74J1HIC7ilCbb7ESQ=";
-    })
-    (fetchpatch {
-      name = "0008-linux-user-fixup-termios2-related-things-on-PowerPC.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/d68f0e2e906939bef076d0cd52f902d433c8c3da.patch";
-      hash = "sha256-vF47CKqg0wBBOUkHeJ3hv3nUHCftl2OwD3Nh0dL1PNk=";
-    })
   ]
   ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch;
 

From d94e6683f5df6f1d6b565c989d2dad99b24ef20f Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 16 Feb 2026 12:47:19 +0300
Subject: [PATCH 21/25] linux_6_19: 6.19 -> 6.19.1

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 121b8e175905..455c42aa8d0e 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -35,8 +35,8 @@
         "lts": false
     },
     "6.19": {
-        "version": "6.19",
-        "hash": "sha256:0mqka8ii7bvmx9hvfjdiyva9ib0j7m390gxhh8gki3qb4nl7jc1h",
+        "version": "6.19.1",
+        "hash": "sha256:1vlki73j7m2khjl39hq4fy42qql9als18nmnjg00a8yklhqzb0qb",
         "lts": false
     }
 }

From c8dabc8cef0978f1365cce98a3be290a627a0120 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 16 Feb 2026 12:47:23 +0300
Subject: [PATCH 22/25] linux_6_18: 6.18.10 -> 6.18.11

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 455c42aa8d0e..3311b92c569d 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,8 +30,8 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.10",
-        "hash": "sha256:1plfwknqh5831kjq6f2yxcm4lqvp68a6kvcfnbxa5ba12wb7glyn",
+        "version": "6.18.11",
+        "hash": "sha256:1xrsc7s3kh7mipfs0v33n97gfi55ll83x4hxvwi969qh8293ibrq",
         "lts": false
     },
     "6.19": {

From 3ede227389ee870f0b114e32e968c23b9b3967d1 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 16 Feb 2026 12:47:27 +0300
Subject: [PATCH 23/25] linux_6_12: 6.12.70 -> 6.12.72

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 3311b92c569d..17e440704d6f 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -25,8 +25,8 @@
         "lts": true
     },
     "6.12": {
-        "version": "6.12.70",
-        "hash": "sha256:1w1flq4phr3i51c85bz8d9a8cg780vn7dr29y4j4izyfv33wwk4v",
+        "version": "6.12.72",
+        "hash": "sha256:0ybijkw2zadhlg49r0wvnvy3s2czj5jnb149cz8ybvzvp90qgxdi",
         "lts": true
     },
     "6.18": {

From 3cc252124c1744d69efacdba64b3ab78d713de5c Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 16 Feb 2026 12:47:30 +0300
Subject: [PATCH 24/25] linux_6_6: 6.6.124 -> 6.6.125

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 17e440704d6f..140c3ecc04d0 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -20,8 +20,8 @@
         "lts": true
     },
     "6.6": {
-        "version": "6.6.124",
-        "hash": "sha256:0kkri7y9g5c7hylwsdc2wq2drhniay171nnccr533qlvisgzpbm7",
+        "version": "6.6.125",
+        "hash": "sha256:0g88r1v5q0m1n1ii2f16awc8w9m471m6hqx7r5whad4a8dpkpqwf",
         "lts": true
     },
     "6.12": {

From db02377418e30440ecef8e6cee479e97e1456bda Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 16 Feb 2026 13:28:45 +0300
Subject: [PATCH 25/25] nixos/boot/systemd: fix doc build

---
 nixos/modules/system/boot/systemd.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 9a187e86d76b..467a5d04516f 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -374,9 +374,7 @@ in
     generatorPath = mkOption {
       type = types.listOf types.package;
       default = [ ];
-      example = [
-        pkgs.hello
-      ];
+      example = lib.literalExpression "[ pkgs.hello ]";
       description = ''
         Packages added to the `PATH` environment variable of all systemd generators.
       '';