diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 6e50e5d0e96ff..ea1bbeb6490bd 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21638,6 +21638,17 @@
     githubId = 6064962;
     name = "TakWolf";
   };
+  talhaHavadar = {
+    email = "havadartalha@gmail.com";
+    github = "talhaHavadar";
+    githubId = 6908462;
+    name = "Talha Can Havadar";
+    keys = [
+      {
+        fingerprint = "1E13 12DF 4B71 58B6 EBF9  DE78 2574 3879 62FE B0D1";
+      }
+    ];
+  };
   talkara = {
     email = "taito.horiuchi@relexsolutions.com";
     github = "talkara";
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 5423182e1d99d..39849d5d64c24 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -31,6 +31,9 @@
 
 - `buildGoPackage` has been removed. Use `buildGoModule` instead. See the [Go section in the nixpkgs manual](https://nixos.org/manual/nixpkgs/unstable/#sec-language-go) for details.
 
+- `strawberry` has been updated to 1.2, which drops support for the VLC backend and Qt 5. The `strawberry-qt5` package
+  and `withGstreamer`/`withVlc` override options have been removed due to this.
+
 - `timescaledb` requires manual upgrade steps.
     After you run ALTER EXTENSION, you must run [this SQL script](https://github.com/timescale/timescaledb-extras/blob/master/utils/2.15.X-fix_hypertable_foreign_keys.sql). For more details, see the following pull requests [#6797](https://github.com/timescale/timescaledb/pull/6797).
     PostgreSQL 13 is no longer supported in TimescaleDB v2.16.
@@ -53,6 +56,8 @@
   [official website](https://www.nerdfonts.com/font-downloads) as the titles in preview images, with the "Nerd Font"
   suffix and any whitespaces trimmed.
 
+- `retroarch` has been refactored and the older `retroarch.override { cores = [ ... ]; }` to create a RetroArch derivation with custom cores doesn't work anymore, use `retroarch.withCores (cores: [ ... ])` instead. If you need more customization (e.g.: custom settings), use `wrapRetroArch` instead.
+
 - `gkraken` software and `hardware.gkraken.enable` option have been removed, use `coolercontrol` via `programs.coolercontrol.enable` option instead.
 
 - `containerd` has been updated to v2, which contains breaking changes. See the [containerd
diff --git a/pkgs/README.md b/pkgs/README.md
index f907d79ef3480..49c31a76ed43c 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -492,7 +492,9 @@ Examples going from bad to best practices:
 Sometimes, changes are needed to the source to allow building a derivation in nixpkgs, or to get earlier access to an upstream fix or improvement.
 When using the `patches` parameter to `mkDerivation`, make sure the patch name clearly describes the reason for the patch, or add a comment.
 
-Patches already merged upstream or published elsewhere should be retrieved using `fetchpatch`.
+### Fetching patches
+
+In the interest of keeping our maintenance burden and the size of Nixpkgs to a minimum, patches already merged upstream or published elsewhere _should_ be retrieved using `fetchpatch`:
 
 ```nix
 {
@@ -506,15 +508,22 @@ Patches already merged upstream or published elsewhere should be retrieved using
 }
 ```
 
-Otherwise, you can add a `.patch` file to the `nixpkgs` repository.
-In the interest of keeping our maintenance burden and the size of nixpkgs to a minimum, only do this for patches that are unique to `nixpkgs` or that have been proposed upstream but are not merged yet, cannot be easily fetched or have a high chance to disappear in the future due to unstable or unreliable URLs.
-The latter avoids link rot when the upstream abandons, squashes or rebases their change, in which case the commit may get garbage-collected.
-
 If a patch is available online but does not cleanly apply, it can be modified in some fixed ways by using additional optional arguments for `fetchpatch`. Check [the `fetchpatch` reference](https://nixos.org/manual/nixpkgs/unstable/#fetchpatch) for details.
 
+### Vendoring patches
+
+In the following cases, a `.patch` file _should_ be added to Nixpkgs repository, instead of retrieved:
+
+- solves problems unique to packaging in Nixpkgs
+- is already proposed upstream but not merged yet
+- cannot be fetched easily
+- has a high chance to disappear in the future due to unstable or unreliable URLs
+
+The latter avoids link rot when the upstream abandons, squashes or rebases their change, in which case the commit may get garbage-collected.
+
 ```nix
 {
-  patches = [ ./0001-changes.patch ];
+  patches = [ ./0001-add-missing-include.patch ];
 }
 ```
 
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/applications/audio/strawberry/default.nix
index 58ac8f60ff1c7..bd85eef99f509 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@@ -1,57 +1,52 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, cmake
-, pkg-config
-, wrapQtAppsHook
-, alsa-lib
-, boost
-, chromaprint
-, fftw
-, gnutls
-, libcdio
-, libebur128
-, libmtp
-, libpthreadstubs
-, libtasn1
-, libXdmcp
-, ninja
-, pcre
-, protobuf
-, sqlite
-, taglib
-, libgpod
-, libidn2
-, libpulseaudio
-, libselinux
-, libsepol
-, p11-kit
-, util-linux
-, qtbase
-, qtx11extras ? null # doesn't exist in qt6
-, qttools
-, withGstreamer ? true
-, glib-networking
-, gst_all_1
-, withVlc ? true
-, libvlc
-, nix-update-script
+{
+  alsa-lib,
+  boost,
+  chromaprint,
+  cmake,
+  fetchFromGitHub,
+  fftw,
+  glib-networking,
+  gnutls,
+  gst_all_1,
+  kdsingleapplication,
+  lib,
+  libXdmcp,
+  libcdio,
+  libebur128,
+  libgpod,
+  libidn2,
+  libmtp,
+  libpthreadstubs,
+  libpulseaudio,
+  libselinux,
+  libsepol,
+  libtasn1,
+  ninja,
+  nix-update-script,
+  p11-kit,
+  pkg-config,
+  qtbase,
+  qttools,
+  sqlite,
+  stdenv,
+  taglib,
+  util-linux,
+  wrapQtAppsHook,
 }:
 
 let
-  inherit (lib) optionals optionalString;
+  inherit (lib) optionals;
 
 in
 stdenv.mkDerivation rec {
   pname = "strawberry";
-  version = "1.1.3";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    hash = "sha256-yca1BJWhSUVamqSKfvEzU3xbzdR+kwfSs0pyS08oUR0=";
-    fetchSubmodules = true;
+    hash = "sha256-X752GsP2b7rumQHzw52zI7PeE8tdM9Scgl3nHVcpO/s=";
   };
 
   # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead
@@ -60,52 +55,55 @@ stdenv.mkDerivation rec {
       --replace pictures/strawberry.png pictures/strawberry-grey.png
   '';
 
-  buildInputs = [
-    alsa-lib
-    boost
-    chromaprint
-    fftw
-    gnutls
-    libcdio
-    libebur128
-    libidn2
-    libmtp
-    libpthreadstubs
-    libtasn1
-    libXdmcp
-    pcre
-    protobuf
-    sqlite
-    taglib
-    qtbase
-    qtx11extras
-  ] ++ optionals stdenv.hostPlatform.isLinux [
-    libgpod
-    libpulseaudio
-    libselinux
-    libsepol
-    p11-kit
-  ] ++ optionals withGstreamer (with gst_all_1; [
-    glib-networking
-    gstreamer
-    gst-libav
-    gst-plugins-base
-    gst-plugins-good
-    gst-plugins-bad
-    gst-plugins-ugly
-  ]) ++ optionals withVlc [ libvlc ];
+  buildInputs =
+    [
+      alsa-lib
+      boost
+      chromaprint
+      fftw
+      gnutls
+      kdsingleapplication
+      libXdmcp
+      libcdio
+      libebur128
+      libidn2
+      libmtp
+      libpthreadstubs
+      libtasn1
+      qtbase
+      sqlite
+      taglib
+    ]
+    ++ optionals stdenv.hostPlatform.isLinux [
+      libgpod
+      libpulseaudio
+      libselinux
+      libsepol
+      p11-kit
+    ]
+    ++ (with gst_all_1; [
+      glib-networking
+      gst-libav
+      gst-plugins-bad
+      gst-plugins-base
+      gst-plugins-good
+      gst-plugins-ugly
+      gstreamer
+    ]);
 
-  nativeBuildInputs = [
-    cmake
-    ninja
-    pkg-config
-    qttools
-    wrapQtAppsHook
-  ] ++ optionals stdenv.hostPlatform.isLinux [
-    util-linux
-  ];
+  nativeBuildInputs =
+    [
+      cmake
+      ninja
+      pkg-config
+      qttools
+      wrapQtAppsHook
+    ]
+    ++ optionals stdenv.hostPlatform.isLinux [
+      util-linux
+    ];
 
-  postInstall = optionalString withGstreamer ''
+  postInstall = ''
     qtWrapperArgs+=(
       --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
       --prefix GIO_EXTRA_MODULES : "${glib-networking.out}/lib/gio/modules"
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index b1f96ef6c89b1..6187302840749 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,9 +1,9 @@
 {
   "chromium": {
-    "version": "131.0.6778.85",
+    "version": "131.0.6778.108",
     "chromedriver": {
-      "hash_darwin": "sha256-li9wQkcgh5ORPu2kjdyfwvvuykRz1gTL3b8UVQs+MY4=",
-      "hash_darwin_aarch64": "sha256-r/C6QpmkVzovLJKfMTjUome9nL5WoEvPGRFB+AJJFqk="
+      "hash_darwin": "sha256-X0kzihCQsICn5SRdU+THdthov0EPxsmMcrm6YJ6hMhs=",
+      "hash_darwin_aarch64": "sha256-3Qdj44cZD4wQTzkBx47ZCfqHE2HckkLuqYKpJxxfESk="
     },
     "deps": {
       "depot_tools": {
@@ -19,8 +19,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "3d81e41b6f3ac8bcae63b32e8145c9eb0cd60a2d",
-        "hash": "sha256-fREToEHVbTD0IVGx/sn7csSju4BYajWZ+LDCiKWV4cI=",
+        "rev": "3b014839fbc4fb688b2f5af512d6ce312ad208b1",
+        "hash": "sha256-ypzu3LveMFcOFm7+JlaERjzs3SK/n9+sfm5wOKB8/zw=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -120,8 +120,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "7e742cac42c29a14ab7f54b134b2f17592711267",
-        "hash": "sha256-K2gwKNwonzCIu4hnlYuOaYyKaRV11hwDzF4oykiKsl0="
+        "rev": "740d2502dbbd719a76c5a8d3fb4dac1b5363f42e",
+        "hash": "sha256-R41YVv4uWCU6SsACXPRppeCDguTs+/NVJckvMGGTgJE="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -600,8 +600,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "94631d9b9a10697325589e1642af63a0137cac94",
-        "hash": "sha256-SKKLOxjimQWt8W+Q3wlCJaUC/lxw6EIZDFBuVQKmnVY="
+        "rev": "f14f6b1ab7cf544c0190074488d17821281cfa4d",
+        "hash": "sha256-0p57otDuIShl6MngYs22XA1QYxptDVa3vCwJsH59H34="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -725,8 +725,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "8445abdf8069cadcbd134369b70d0ebd436ef477",
-        "hash": "sha256-EitEjXNtm0gB9wtAwIYHBHkU7paHg5zvsTz171hRmK4="
+        "rev": "79aff54b0fa9238ce3518dd9eaf9610cd6f22e82",
+        "hash": "sha256-xkMnUduSG88EWiwq6PITN0KgAKjFd4QOis3dgxedK30="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -760,8 +760,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "bd2671b973062afc614b852ec190524b80aaef8a",
-        "hash": "sha256-uq0CE7Chqzy2d+iifC3hV9RTnDVinpwjl1pOzyNGbSo="
+        "rev": "e38771cb283b9689683c5ac0b5831dd89f8ec690",
+        "hash": "sha256-csSDnepYxil0R3PD/LVxW7JBcasOKG4l6q6vj8zHV/I="
       }
     }
   },
diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix
index ed1da779fb23e..4915cc4a1fbc3 100644
--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@@ -30,6 +30,12 @@ let
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ jvanbruegge risson ];
+    knownVulnerabilities = [
+      "CVE-2024-52307"
+      "CVE-2024-52287"
+      "CVE-2024-52289"
+      "Authentik 2024.6.x is end-of-life, consider using https://github.com/nix-community/authentik-nix for an up-to-date alternative"
+    ];
   };
 
   website = buildNpmPackage {
diff --git a/pkgs/by-name/bo/bombsquad/package.nix b/pkgs/by-name/bo/bombsquad/package.nix
index 55afb4eb444ca..054f1b11d4917 100644
--- a/pkgs/by-name/bo/bombsquad/package.nix
+++ b/pkgs/by-name/bo/bombsquad/package.nix
@@ -9,7 +9,7 @@
   curl,
   gnugrep,
   libgcc,
-  makeWrapper,
+  makeBinaryWrapper,
   makeDesktopItem,
   autoPatchelfHook,
   copyDesktopItems,
@@ -22,38 +22,44 @@ let
     {
       x86_64-linux = {
         name = "BombSquad_Linux_x86_64";
-        hash = "sha256-aujLYzFcKaW0ff7sRdyJ6SvSQowafWVbmwycQfDQUYY=";
+        hash = "sha256-ICjaNZSCUbslB5pELbI4e+1zXWrZzkCkv69jLRx4dr0=";
       };
       aarch-64-linux = {
         name = "BombSquad_Linux_Arm64";
-        hash = "sha256-pPP7QZzToTOQtSxzF7Q3ZzlDjUjQWMBM/y79d6Yf38I=";
+        hash = "sha256-/m0SOQbHssk0CqZJPRLK9YKphup3dtMqkbWGzqcF0+g=";
       };
     }
     .${stdenv.targetPlatform.system} or (throw "${stdenv.targetPlatform.system} is unsupported.");
+
+  bombsquadIcon = fetchurl {
+    url = "https://files.ballistica.net/bombsquad/promo/BombSquadIcon.png";
+    hash = "sha256-MfOvjVmjhLejrJmdLo/goAM9DTGubnYGhlN6uF2GugA=";
+  };
+
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "bombsquad";
   version = "1.7.37";
-  sourceRoot = ".";
+
   src = fetchurl {
-    url = "https://files.ballistica.net/bombsquad/builds/${archive.name}_${finalAttrs.version}.tar.gz";
+    url = "https://web.archive.org/web/20240825230506if_/https://files.ballistica.net/bombsquad/builds/${archive.name}_${finalAttrs.version}.tar.gz";
     inherit (archive) hash;
   };
 
-  bombsquadIcon = fetchurl {
-    url = "https://files.ballistica.net/bombsquad/promo/BombSquadIcon.png";
-    hash = "sha256-MfOvjVmjhLejrJmdLo/goAM9DTGubnYGhlN6uF2GugA=";
-  };
+  sourceRoot = "${archive.name}_${finalAttrs.version}";
 
-  nativeBuildInputs = [
-    python312
+  buildInputs = [
     SDL2
+    libgcc
     libvorbis
     openal
-    libgcc
-    makeWrapper
+    python312
+  ];
+
+  nativeBuildInputs = [
     autoPatchelfHook
     copyDesktopItems
+    makeBinaryWrapper
   ];
 
   desktopItems = [
@@ -61,6 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
       name = "bombsquad";
       genericName = "bombsquad";
       desktopName = "BombSquad";
+
       icon = "bombsquad";
       exec = "bombsquad";
       comment = "An explosive arcade-style party game.";
@@ -71,17 +78,16 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    base=${archive.name}_${finalAttrs.version}
+    mkdir -p $out/bin $out/libexec $out/share/bombsquad/ba_data
 
-    install -m755 -D $base/bombsquad $out/bin/bombsquad
-    install -dm755 $base/ba_data $out/usr/share/bombsquad/ba_data
-    cp -r $base/ba_data $out/usr/share/bombsquad/
+    install -Dm555 -t $out/libexec ${finalAttrs.meta.mainProgram}
+    cp -r ba_data $out/share/bombsquad
 
-    wrapProgram "$out/bin/bombsquad" \
+    makeWrapper "$out/libexec/${finalAttrs.meta.mainProgram}" "$out/bin/${finalAttrs.meta.mainProgram}" \
       --add-flags ${lib.escapeShellArg commandLineArgs} \
-      --add-flags "-d $out/usr/share/bombsquad"
+      --add-flags "-d $out/share/bombsquad"
 
-    install -Dm755 ${finalAttrs.bombsquadIcon} $out/usr/share/icons/hicolor/32x32/apps/bombsquad.png
+    install -Dm755 ${bombsquadIcon} $out/share/icons/hicolor/1024x1024/apps/bombsquad.png
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/br/brave/make-brave.nix b/pkgs/by-name/br/brave/make-brave.nix
index 6f7f5d0687d80..11f77869d0a49 100644
--- a/pkgs/by-name/br/brave/make-brave.nix
+++ b/pkgs/by-name/br/brave/make-brave.nix
@@ -242,7 +242,7 @@ stdenv.mkDerivation {
 
       mkdir -p $out/{Applications,bin}
 
-      cp -r "Brave Browser.app" $out/Applications/
+      cp -r . "$out/Applications/Brave Browser.app"
 
       makeWrapper "$out/Applications/Brave Browser.app/Contents/MacOS/Brave Browser" $out/bin/brave
 
diff --git a/pkgs/by-name/dm/dmd/generic.nix b/pkgs/by-name/dm/dmd/generic.nix
index cf8cae7b4f5aa..1c68817ead2e3 100644
--- a/pkgs/by-name/dm/dmd/generic.nix
+++ b/pkgs/by-name/dm/dmd/generic.nix
@@ -82,6 +82,13 @@ stdenv.mkDerivation (finalAttrs: {
       extraPrefix = "dmd/";
       hash = "sha256-N21mAPfaTo+zGCip4njejasraV5IsWVqlGR5eOdFZZE=";
     })
+  ] ++ lib.optionals (lib.versionOlder version "2.110.0") [
+    (fetchpatch {
+      url = "https://github.com/dlang/dmd/commit/fdd25893e0ac04893d6eba8652903d499b7b0dfc.patch";
+      stripLen = 1;
+      extraPrefix = "dmd/";
+      hash = "sha256-Uccb8rBPBLAEPWbOYWgdR5xN3wJoIkKKhLGu58IK1sM=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/hi/highs/package.nix b/pkgs/by-name/hi/highs/package.nix
index 836e947706e5f..73460ab54164d 100644
--- a/pkgs/by-name/hi/highs/package.nix
+++ b/pkgs/by-name/hi/highs/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "highs";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "ERGO-Code";
     repo = "HiGHS";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3ACo6V6Y99XPe4dvurWflNGPjHy3irURv4jYHMrgSms=";
+    hash = "sha256-JuUPnsCNImWpkeh0B//7yM1Wix9SpnfApp8cxX9WeYk=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ka/kaput-cli/package.nix b/pkgs/by-name/ka/kaput-cli/package.nix
new file mode 100644
index 0000000000000..a03f37ff97bf4
--- /dev/null
+++ b/pkgs/by-name/ka/kaput-cli/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  openssl,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "kaput-cli";
+  version = "2.5.0";
+
+  src = fetchFromGitHub {
+    owner = "davidchalifoux";
+    repo = "kaput-cli";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-sy8k9L9rmiRFzvhLc+hYl9OqmmP8INLxMNRjAx7/V8g=";
+  };
+
+  cargoHash = "sha256-fnTcCVppI5wIzwG2fA8LjpC1+gTAhdRkWv/EQXUok0c=";
+
+  env = {
+    OPENSSL_NO_VENDOR = 1;
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/davidchalifoux/kaput-cli/releases/tag/v${version}";
+    description = "unofficial CLI client for Put.io";
+    homepage = "https://kaput.sh/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pyrox0 ];
+    mainProgram = "kaput";
+  };
+}
diff --git a/pkgs/by-name/ku/kubernetes-kcp/package.nix b/pkgs/by-name/ku/kubernetes-kcp/package.nix
index 7a5ff9afea4b4..fa73327a3c709 100644
--- a/pkgs/by-name/ku/kubernetes-kcp/package.nix
+++ b/pkgs/by-name/ku/kubernetes-kcp/package.nix
@@ -5,6 +5,7 @@
   fetchFromGitHub,
   installShellFiles,
   testers,
+  kubernetes-kcp,
 }:
 
 buildGoModule rec {
@@ -50,6 +51,7 @@ buildGoModule rec {
   '';
 
   passthru.tests.version = testers.testVersion {
+    package = kubernetes-kcp;
     command = "kcp --version";
     # NOTE: Once the go.mod version is pulled in, the version info here needs
     # to be also updated.
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/README.md b/pkgs/by-name/ni/nixos-rebuild-ng/README.md
index a6199e873060d..9a565de2dd18b 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/README.md
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/README.md
@@ -91,24 +91,6 @@ ruff format .
   conflicting with the current `nixos-rebuild`. This means you can keep both in
   your system at the same time, but it also means that a few things like bash
   completion are broken right now (since it looks at `nixos-rebuild` binary)
-- `_NIXOS_REBUILD_EXEC` is **not** implemented yet, so different from
-  `nixos-rebuild`, this will use the current version of `nixos-rebuild-ng` in
-  your `PATH` to build/set profile/switch, while `nixos-rebuild` builds the new
-  version (the one that will be switched) and re-exec to it instead. This means
-  that in case of bugs in `nixos-rebuild-ng`, the only way that you will get
-  them fixed is **after** you switch to a new version
-- `nix` bootstrap is also **not** implemented yet, so this means that you will
-  eval with an old version of Nix instead of a newer one. This is unlikely to
-  cause issues, because the build will happen in the daemon anyway (that is
-  only changed after the switch), and unless you are using bleeding edge `nix`
-  features you will probably have zero problems here. You can basically think
-  that using `nixos-rebuild-ng` is similar to running `nixos-rebuild --fast`
-  right now
-- Ignore any performance advantages of the rewrite right now, because of the 2
-  caveats above
-- `--target-host` and `--build-host` are not implemented yet and this is
-  probably the thing that will be most difficult to implement. Help here is
-  welcome
 - Bugs in the profile manipulation can cause corruption of your profile that
   may be difficult to fix, so right now I only recommend using
   `nixos-rebuild-ng` if you are testing in a VM or in a filesystem with
@@ -118,20 +100,29 @@ ruff format .
 
 ## TODO
 
-- [ ] Remote host/builders (via SSH)
+- [x] Remote host/builders (via SSH)
 - [x] Improve nix arguments handling (e.g.: `nixFlags` vs `copyFlags` in the
   old `nixos-rebuild`)
-- [ ] `_NIXOS_REBUILD_EXEC`
+- [x] `_NIXOS_REBUILD_REEXEC`
 - [ ] Port `nixos-rebuild.passthru.tests`
 - [ ] Change module system to allow easier opt-in, like
   `system.switch.enableNg` for `switch-to-configuration-ng`
 - [ ] Improve documentation
-- [ ] `nixos-rebuild repl` (calling old `nixos-rebuild` for now)
-- [ ] `nix` build/bootstrap
+- [x] `nixos-rebuild repl`
 - [ ] Generate tab completion via [`shtab`](https://docs.iterative.ai/shtab/)
 - [x] Reduce build closure
 
 ## TODON'T
 
-- Reimplement `systemd-run` logic (will be moved to the new
-  [`apply`](https://github.com/NixOS/nixpkgs/pull/344407) script)
+- Reimplement `systemd-run` logic: will be moved to the new
+  [`apply`](https://github.com/NixOS/nixpkgs/pull/344407) script
+- Nix bootstrap: it is only used for non-Flake paths and it is basically
+  useless nowadays. It was created at a time when Nix was changing frequently
+  and there was a need to bootstrap a new version of Nix before evaluating the
+  configuration (otherwise the new Nixpkgs version may have code that is only
+  compatible with a newer version of Nix). Nixpkgs now has a policy to be
+  compatible with Nix 2.3, and even if this is bumped as long we don't do
+  drastic minimum version changes this should not be an issue. Also, the daemon
+  itself always run with the previous version since even we can replace Nix in
+  `PATH` (so Nix client), but we can't replace the daemon without switching to
+  a new version.
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/package.nix b/pkgs/by-name/ni/nixos-rebuild-ng/package.nix
index b111c7cb108a3..4ef9d29807f56 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/package.nix
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/package.nix
@@ -39,11 +39,6 @@ python3Packages.buildPythonApplication rec {
     nix
   ];
 
-  preBuild = ''
-    substituteInPlace nixos_rebuild/__init__.py \
-      --subst-var-by nixos_rebuild ${lib.getExe nixos-rebuild}
-  '';
-
   postInstall =
     ''
       installManPage ${nixos-rebuild}/share/man/man8/nixos-rebuild.8
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index 25519dac6240d..c7dbf8acb3501 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -1,19 +1,20 @@
 import argparse
 import atexit
 import json
+import logging
 import os
 import sys
 from pathlib import Path
-from subprocess import run
-from tempfile import TemporaryDirectory
+from subprocess import CalledProcessError, run
 from typing import assert_never
 
 from . import nix
-from .models import Action, Flake, NRError, Profile
+from .models import Action, BuildAttr, Flake, NRError, Profile
 from .process import Remote, cleanup_ssh
-from .utils import info
+from .utils import Args, LogFormatter
 
-VERBOSE = 0
+logger = logging.getLogger()
+logger.setLevel(logging.INFO)
 
 
 def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentParser]]:
@@ -52,7 +53,9 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
     classic_build_flags.add_argument("--no-build-output", "-Q", action="store_true")
 
     copy_flags = argparse.ArgumentParser(add_help=False)
-    copy_flags.add_argument("--use-substitutes", "-s", action="store_true")
+    copy_flags.add_argument(
+        "--use-substitutes", "--substitute-on-destination", "-s", action="store_true"
+    )
 
     sub_parsers = {
         "common_flags": common_flags,
@@ -86,8 +89,10 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
     main_parser.add_argument("--ask-sudo-password", action="store_true")
     main_parser.add_argument("--use-remote-sudo", action="store_true")  # deprecated
     main_parser.add_argument("--no-ssh-tty", action="store_true")  # deprecated
-    # parser.add_argument("--build-host")  # TODO
+    main_parser.add_argument("--fast", action="store_true")
+    main_parser.add_argument("--build-host")
     main_parser.add_argument("--target-host")
+    main_parser.add_argument("--no-build-nix", action="store_true")  # deprecated
     main_parser.add_argument("action", choices=Action.values(), nargs="?")
 
     return main_parser, sub_parsers
@@ -104,11 +109,11 @@ def parse_args(
     }
 
     def parser_warn(msg: str) -> None:
-        info(f"{parser.prog}: warning: {msg}")
+        print(f"{parser.prog}: warning: {msg}", file=sys.stderr)
 
-    global VERBOSE
     # This flag affects both nix and this script
-    VERBOSE = args.verbose
+    if args.verbose:
+        logger.setLevel(logging.DEBUG)
 
     # https://github.com/NixOS/nixpkgs/blob/master/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh#L56
     if args.action == Action.DRY_RUN.value:
@@ -117,6 +122,10 @@ def parser_warn(msg: str) -> None:
     if args.ask_sudo_password:
         args.sudo = True
 
+    if args.help or args.action is None:
+        r = run(["man", "8", "nixos-rebuild"], check=False)
+        parser.exit(r.returncode)
+
     # TODO: use deprecated=True in Python >=3.13
     if args.install_grub:
         parser_warn("--install-grub deprecated, use --install-bootloader instead")
@@ -131,10 +140,14 @@ def parser_warn(msg: str) -> None:
     if args.no_ssh_tty:
         parser_warn("--no-ssh-tty deprecated, SSH's TTY is never used anymore")
 
+    # TODO: use deprecated=True in Python >=3.13
+    if args.no_build_nix:
+        parser_warn("--no-build-nix deprecated, we do not build nix anymore")
+
     if args.action == Action.EDIT.value and (args.file or args.attr):
         parser.error("--file and --attr are not supported with 'edit'")
 
-    if args.target_host and args.action not in (
+    if (args.target_host or args.build_host) and args.action not in (
         Action.SWITCH.value,
         Action.BOOT.value,
         Action.TEST.value,
@@ -142,36 +155,67 @@ def parser_warn(msg: str) -> None:
         Action.DRY_BUILD.value,
         Action.DRY_ACTIVATE.value,
     ):
-        parser.error(f"--target-host is not supported with '{args.action}'")
+        parser.error(
+            f"--target-host/--build-host is not supported with '{args.action}'"
+        )
 
     if args.flake and (args.file or args.attr):
         parser.error("--flake cannot be used with --file or --attr")
 
-    if args.help or args.action is None:
-        r = run(["man", "8", "nixos-rebuild"], check=False)
-        parser.exit(r.returncode)
-
     return args, args_groups
 
 
+def reexec(
+    argv: list[str],
+    args: argparse.Namespace,
+    build_flags: dict[str, Args],
+    flake_build_flags: dict[str, Args],
+) -> None:
+    drv = None
+    try:
+        # Need to set target_host=None, to avoid connecting to remote
+        if flake := Flake.from_arg(args.flake, None):
+            drv = nix.build_flake(
+                "pkgs.nixos-rebuild-ng",
+                flake,
+                **flake_build_flags,
+                no_link=True,
+            )
+        else:
+            drv = nix.build(
+                "pkgs.nixos-rebuild-ng",
+                BuildAttr.from_arg(args.attr, args.file),
+                **build_flags,
+                no_out_link=True,
+            )
+    except CalledProcessError:
+        logger.warning("could not find a newer version of nixos-rebuild")
+
+    if drv:
+        new = drv / "bin/nixos-rebuild-ng"
+        current = Path(argv[0])
+        # Disable re-exec during development
+        if current.name != "__main__.py" and new != current:
+            logging.debug(
+                "detected newer version of script, re-exec'ing, current=%s, new=%s",
+                argv[0],
+                new,
+            )
+            cleanup_ssh()
+            os.execve(new, argv, os.environ | {"_NIXOS_REBUILD_REEXEC": "1"})
+
+
 def execute(argv: list[str]) -> None:
     args, args_groups = parse_args(argv)
 
+    atexit.register(cleanup_ssh)
+
     common_flags = vars(args_groups["common_flags"])
     common_build_flags = common_flags | vars(args_groups["common_build_flags"])
     build_flags = common_build_flags | vars(args_groups["classic_build_flags"])
     flake_build_flags = common_build_flags | vars(args_groups["flake_build_flags"])
     copy_flags = common_flags | vars(args_groups["copy_flags"])
 
-    # Will be cleaned up on exit automatically.
-    tmpdir = TemporaryDirectory(prefix="nixos-rebuild.")
-    tmpdir_path = Path(tmpdir.name)
-    atexit.register(cleanup_ssh, tmpdir_path)
-
-    profile = Profile.from_name(args.profile_name)
-    target_host = Remote.from_arg(args.target_host, args.ask_sudo_password, tmpdir_path)
-    flake = Flake.from_arg(args.flake, target_host)
-
     if args.upgrade or args.upgrade_all:
         nix.upgrade_channels(bool(args.upgrade_all))
 
@@ -182,6 +226,23 @@ def execute(argv: list[str]) -> None:
     # executed, so it's safe to run nixos-rebuild against a potentially
     # untrusted tree.
     can_run = action in (Action.SWITCH, Action.BOOT, Action.TEST)
+
+    # Re-exec to a newer version of the script before building to ensure we get
+    # the latest fixes
+    if (
+        False  # disabled until we introduce `config.system.build.nixos-rebuild-ng`
+        and can_run
+        and not args.fast
+        and not os.environ.get("_NIXOS_REBUILD_REEXEC")
+    ):
+        reexec(argv, args, build_flags, flake_build_flags)
+
+    profile = Profile.from_arg(args.profile_name)
+    target_host = Remote.from_arg(args.target_host, args.ask_sudo_password)
+    build_host = Remote.from_arg(args.build_host, False, validate_opts=False)
+    build_attr = BuildAttr.from_arg(args.attr, args.file)
+    flake = Flake.from_arg(args.flake, target_host)
+
     if can_run and not flake:
         nixpkgs_path = nix.find_file("nixpkgs", **build_flags)
         rev = nix.get_nixpkgs_rev(nixpkgs_path)
@@ -189,88 +250,111 @@ def execute(argv: list[str]) -> None:
             (nixpkgs_path / ".version-suffix").write_text(rev)
 
     match action:
-        case Action.SWITCH | Action.BOOT:
-            info("building the system configuration...")
-            if args.rollback:
-                path_to_config = nix.rollback(profile, target_host, sudo=args.sudo)
-            else:
-                if flake:
-                    path_to_config = nix.nixos_build_flake(
-                        "toplevel",
+        case (
+            Action.SWITCH
+            | Action.BOOT
+            | Action.TEST
+            | Action.BUILD
+            | Action.DRY_BUILD
+            | Action.DRY_ACTIVATE
+        ):
+            logger.info("building the system configuration...")
+
+            attr = "config.system.build.toplevel"
+            dry_run = action == Action.DRY_BUILD
+            no_link = action in (Action.SWITCH, Action.BOOT)
+            rollback = bool(args.rollback)
+
+            match (action, rollback, build_host, flake):
+                case (Action.SWITCH | Action.BOOT, True, _, _):
+                    path_to_config = nix.rollback(profile, target_host, sudo=args.sudo)
+                case (Action.TEST | Action.BUILD, True, _, _):
+                    maybe_path_to_config = nix.rollback_temporary_profile(
+                        profile,
+                        target_host,
+                        sudo=args.sudo,
+                    )
+                    if maybe_path_to_config:  # kinda silly but this makes mypy happy
+                        path_to_config = maybe_path_to_config
+                    else:
+                        raise NRError("could not find previous generation")
+                case (_, True, _, _):
+                    raise NRError(f"--rollback is incompatible with '{action}'")
+                case (_, False, Remote(_), Flake(_)):
+                    path_to_config = nix.remote_build_flake(
+                        attr,
                         flake,
-                        no_link=True,
+                        build_host,
+                        flake_build_flags=flake_build_flags,
+                        copy_flags=copy_flags,
+                        build_flags=build_flags,
+                    )
+                case (_, False, None, Flake(_)):
+                    path_to_config = nix.build_flake(
+                        attr,
+                        flake,
+                        no_link=no_link,
+                        dry_run=dry_run,
                         **flake_build_flags,
                     )
-                else:
-                    path_to_config = nix.nixos_build(
-                        "system",
-                        args.attr,
-                        args.file,
-                        no_out_link=True,
+                case (_, False, Remote(_), None):
+                    path_to_config = nix.remote_build(
+                        attr,
+                        build_attr,
+                        build_host,
+                        instantiate_flags=common_flags,
+                        copy_flags=copy_flags,
+                        build_flags=build_flags,
+                    )
+                case (_, False, None, None):
+                    path_to_config = nix.build(
+                        attr,
+                        build_attr,
+                        no_out_link=no_link,
+                        dry_run=dry_run,
                         **build_flags,
                     )
-                nix.copy_closure(path_to_config, target_host, **copy_flags)
-                nix.set_profile(profile, path_to_config, target_host, sudo=args.sudo)
-            nix.switch_to_configuration(
-                path_to_config,
-                action,
-                target_host,
-                sudo=args.sudo,
-                specialisation=args.specialisation,
-                install_bootloader=args.install_bootloader,
-            )
-        case Action.TEST | Action.BUILD | Action.DRY_BUILD | Action.DRY_ACTIVATE:
-            info("building the system configuration...")
-            dry_run = action == Action.DRY_BUILD
-            if args.rollback:
-                if action not in (Action.TEST, Action.BUILD):
-                    raise NRError(f"--rollback is incompatible with '{action}'")
-                maybe_path_to_config = nix.rollback_temporary_profile(
-                    profile,
-                    target_host,
-                    sudo=args.sudo,
-                )
-                if maybe_path_to_config:  # kinda silly but this makes mypy happy
-                    path_to_config = maybe_path_to_config
-                else:
-                    raise NRError("could not find previous generation")
-            elif flake:
-                path_to_config = nix.nixos_build_flake(
-                    "toplevel",
-                    flake,
-                    dry_run=dry_run,
-                    **flake_build_flags,
-                )
-            else:
-                path_to_config = nix.nixos_build(
-                    "system",
-                    args.attr,
-                    args.file,
-                    dry_run=dry_run,
-                    **build_flags,
+                case m:
+                    # should never happen, but mypy is not smart enough to
+                    # handle this with assert_never
+                    raise NRError(f"invalid match for build: {m}")
+
+            if not rollback:
+                nix.copy_closure(
+                    path_to_config,
+                    to_host=target_host,
+                    from_host=build_host,
+                    **copy_flags,
                 )
-            if action in (Action.TEST, Action.DRY_ACTIVATE):
+                if action in (Action.SWITCH, Action.BOOT):
+                    nix.set_profile(
+                        profile,
+                        path_to_config,
+                        target_host=target_host,
+                        sudo=args.sudo,
+                    )
+            if action in (Action.SWITCH, Action.BOOT, Action.TEST, Action.DRY_ACTIVATE):
                 nix.switch_to_configuration(
                     path_to_config,
                     action,
-                    target_host,
+                    target_host=target_host,
                     sudo=args.sudo,
                     specialisation=args.specialisation,
+                    install_bootloader=args.install_bootloader,
                 )
         case Action.BUILD_VM | Action.BUILD_VM_WITH_BOOTLOADER:
-            info("building the system configuration...")
+            logger.info("building the system configuration...")
             attr = "vm" if action == Action.BUILD_VM else "vmWithBootLoader"
             if flake:
-                path_to_config = nix.nixos_build_flake(
-                    attr,
+                path_to_config = nix.build_flake(
+                    f"config.system.build.{attr}",
                     flake,
                     **flake_build_flags,
                 )
             else:
-                path_to_config = nix.nixos_build(
-                    attr,
-                    args.attr,
-                    args.file,
+                path_to_config = nix.build(
+                    f"config.system.build.{attr}",
+                    build_attr,
                     **build_flags,
                 )
             vm_path = next(path_to_config.glob("bin/run-*-vm"), "./result/bin/run-*-vm")
@@ -307,21 +391,23 @@ def execute(argv: list[str]) -> None:
                 )
                 print(table)
         case Action.REPL:
-            # For now just redirect it to `nixos-rebuild` instead of
-            # duplicating the code
-            os.execv(
-                "@nixos_rebuild@",
-                argv,
-            )
+            if flake:
+                nix.repl_flake("toplevel", flake, **flake_build_flags)
+            else:
+                nix.repl("system", build_attr, **build_flags)
         case _:
             assert_never(action)
 
 
 def main() -> None:
+    ch = logging.StreamHandler()
+    ch.setFormatter(LogFormatter())
+    logger.addHandler(ch)
+
     try:
         execute(sys.argv)
     except (Exception, KeyboardInterrupt) as ex:
-        if VERBOSE:
-            raise ex
+        if logger.level == logging.DEBUG:
+            raise
         else:
             sys.exit(str(ex))
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
index 51cee3b7c5178..47ce0f5ca91d1 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
@@ -1,5 +1,3 @@
-from __future__ import annotations
-
 import platform
 import re
 import subprocess
@@ -45,12 +43,30 @@ def values() -> list[str]:
         return [a.value for a in Action]
 
 
+@dataclass(frozen=True)
+class BuildAttr:
+    path: str | Path
+    attr: str | None
+
+    def to_attr(self, *attrs: str) -> str:
+        return f"{self.attr + '.' if self.attr else ''}{".".join(attrs)}"
+
+    @classmethod
+    def from_arg(cls, attr: str | None, file: str | None) -> Self:
+        if not (attr or file):
+            return cls("<nixpkgs/nixos>", None)
+        return cls(Path(file or "default.nix"), attr)
+
+
 @dataclass(frozen=True)
 class Flake:
     path: Path
     attr: str
     _re: ClassVar = re.compile(r"^(?P<path>[^\#]*)\#?(?P<attr>[^\#\"]*)$")
 
+    def to_attr(self, *attrs: str) -> str:
+        return f"{self}.{".".join(attrs)}"
+
     @override
     def __str__(self) -> str:
         return f"{self.path}#{self.attr}"
@@ -125,7 +141,7 @@ class Profile:
     path: Path
 
     @classmethod
-    def from_name(cls, name: str = "system") -> Self:
+    def from_arg(cls, name: str) -> Self:
         match name:
             case "system":
                 return cls(name, Path("/nix/var/nix/profiles/system"))
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index f0c328cff4c04..7c9338b3ef92a 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -1,11 +1,15 @@
+import logging
 import os
 from datetime import datetime
+from importlib.resources import files
 from pathlib import Path
+from string import Template
 from subprocess import PIPE, CalledProcessError
 from typing import Final
 
 from .models import (
     Action,
+    BuildAttr,
     Flake,
     Generation,
     GenerationJson,
@@ -13,30 +17,152 @@
     Profile,
     Remote,
 )
-from .process import run_wrapper
-from .utils import Args, dict_to_flags, info
+from .process import SSH_DEFAULT_OPTS, run_wrapper
+from .utils import Args, dict_to_flags
 
 FLAKE_FLAGS: Final = ["--extra-experimental-features", "nix-command flakes"]
+FLAKE_REPL_TEMPLATE: Final = "repl.nix.template"
+logger = logging.getLogger(__name__)
+
+
+def build(
+    attr: str,
+    build_attr: BuildAttr,
+    **build_flags: Args,
+) -> Path:
+    """Build NixOS attribute using classic Nix.
+
+    Returns the built attribute as path.
+    """
+    run_args = [
+        "nix-build",
+        build_attr.path,
+        "--attr",
+        build_attr.to_attr(attr),
+        *dict_to_flags(build_flags),
+    ]
+    r = run_wrapper(run_args, stdout=PIPE)
+    return Path(r.stdout.strip())
+
+
+def build_flake(
+    attr: str,
+    flake: Flake,
+    **flake_build_flags: Args,
+) -> Path:
+    """Build NixOS attribute using Flakes.
+
+    Returns the built attribute as path.
+    """
+    run_args = [
+        "nix",
+        *FLAKE_FLAGS,
+        "build",
+        "--print-out-paths",
+        flake.to_attr(attr),
+        *dict_to_flags(flake_build_flags),
+    ]
+    r = run_wrapper(run_args, stdout=PIPE)
+    return Path(r.stdout.strip())
+
+
+def remote_build(
+    attr: str,
+    build_attr: BuildAttr,
+    build_host: Remote | None,
+    build_flags: dict[str, Args] | None = None,
+    instantiate_flags: dict[str, Args] | None = None,
+    copy_flags: dict[str, Args] | None = None,
+) -> Path:
+    r = run_wrapper(
+        [
+            "nix-instantiate",
+            "--raw",
+            build_attr.path,
+            "--attr",
+            build_attr.to_attr(attr),
+            *dict_to_flags(instantiate_flags or {}),
+        ],
+        stdout=PIPE,
+    )
+    drv = Path(r.stdout.strip())
+    copy_closure(drv, to_host=build_host, from_host=None, **(copy_flags or {}))
+    r = run_wrapper(
+        ["nix-store", "--realise", drv, *dict_to_flags(build_flags or {})],
+        remote=build_host,
+        stdout=PIPE,
+    )
+    return Path(r.stdout.strip())
+
+
+def remote_build_flake(
+    attr: str,
+    flake: Flake,
+    build_host: Remote,
+    flake_build_flags: dict[str, Args] | None = None,
+    copy_flags: dict[str, Args] | None = None,
+    build_flags: dict[str, Args] | None = None,
+) -> Path:
+    r = run_wrapper(
+        [
+            "nix",
+            *FLAKE_FLAGS,
+            "eval",
+            "--raw",
+            flake.to_attr(attr, "drvPath"),
+            *dict_to_flags(flake_build_flags or {}),
+        ],
+        stdout=PIPE,
+    )
+    drv = Path(r.stdout.strip())
+    copy_closure(drv, to_host=build_host, from_host=None, **(copy_flags or {}))
+    r = run_wrapper(
+        [
+            "nix",
+            *FLAKE_FLAGS,
+            "build",
+            f"{drv}^*",
+            "--print-out-paths",
+            *dict_to_flags(build_flags or {}),
+        ],
+        remote=build_host,
+        stdout=PIPE,
+    )
+    return Path(r.stdout.strip())
 
 
 def copy_closure(
     closure: Path,
-    target_host: Remote | None,
+    to_host: Remote | None,
+    from_host: Remote | None = None,
     **copy_flags: Args,
 ) -> None:
-    host = target_host
+    """Copy a nix closure to or from host to localhost.
+
+    Also supports copying a closure from a remote to another remote."""
+    host = to_host or from_host
     if not host:
         return
 
+    sshopts = os.getenv("NIX_SSHOPTS", "")
     run_wrapper(
         [
             "nix-copy-closure",
             *dict_to_flags(copy_flags),
-            "--to",
+            "--to" if to_host else "--from",
             host.host,
             closure,
         ],
-        extra_env={"NIX_SSHOPTS": " ".join(host.opts)},
+        extra_env={
+            # Using raw NIX_SSHOPTS here to avoid messing up with the passed
+            # parameters, and we do not add the SSH_DEFAULT_OPTS in the remote
+            # to remote case, otherwise it will fail because of ControlPath
+            # will not exist in remote
+            "NIX_SSHOPTS": sshopts
+            if from_host and to_host
+            else " ".join(filter(lambda x: x, [*SSH_DEFAULT_OPTS, sshopts]))
+        },
+        remote=from_host if to_host else None,
     )
 
 
@@ -58,13 +184,7 @@ def edit(flake: Flake | None, **flake_flags: Args) -> None:
         if flake_flags:
             raise NRError("'edit' does not support extra Nix flags")
         nixos_config = Path(
-            os.getenv("NIXOS_CONFIG")
-            or run_wrapper(
-                ["nix-instantiate", "--find-file", "nixos-config"],
-                stdout=PIPE,
-                check=False,
-            ).stdout.strip()
-            or "/etc/nixos/default.nix"
+            os.getenv("NIXOS_CONFIG") or find_file("nixos-config") or "/etc/nixos"
         )
         if nixos_config.is_dir():
             nixos_config /= "default.nix"
@@ -76,7 +196,7 @@ def edit(flake: Flake | None, **flake_flags: Args) -> None:
 
 
 def find_file(file: str, **nix_flags: Args) -> Path | None:
-    "Find classic Nixpkgs location."
+    "Find classic Nix file location."
     r = run_wrapper(
         ["nix-instantiate", "--find-file", file, *dict_to_flags(nix_flags)],
         stdout=PIPE,
@@ -103,7 +223,7 @@ def get_nixpkgs_rev(nixpkgs_path: Path | None) -> str | None:
         )
     except FileNotFoundError:
         # Git is not included in the closure so we need to check
-        info(f"warning: Git not found; cannot figure out revision of '{nixpkgs_path}'")
+        logger.warning(f"Git not found; cannot figure out revision of '{nixpkgs_path}'")
         return None
 
     if rev := r.stdout.strip():
@@ -199,13 +319,15 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
         )
         try:
             nixos_version = (generation_path / "nixos-version").read_text().strip()
-        except IOError:
+        except IOError as ex:
+            logger.debug("could not get nixos-version: %s", ex)
             nixos_version = "Unknown"
         try:
             kernel_version = next(
                 (generation_path / "kernel-modules/lib/modules").iterdir()
             ).name
-        except IOError:
+        except IOError as ex:
+            logger.debug("could not get kernel version: %s", ex)
             kernel_version = "Unknown"
         specialisations = [
             s.name for s in (generation_path / "specialisation").glob("*") if s.is_dir()
@@ -215,7 +337,8 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
                 [generation_path / "sw/bin/nixos-version", "--configuration-revision"],
                 capture_output=True,
             ).stdout.strip()
-        except (CalledProcessError, IOError):
+        except (CalledProcessError, IOError) as ex:
+            logger.debug("could not get configuration revision: %s", ex)
             configuration_revision = "Unknown"
 
         result.append(
@@ -233,53 +356,35 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
     return result
 
 
-def nixos_build(
-    attr: str,
-    pre_attr: str | None,
-    file: str | None,
-    **nix_flags: Args,
-) -> Path:
-    """Build NixOS attribute using classic Nix.
+def repl(attr: str, build_attr: BuildAttr, **nix_flags: Args) -> None:
+    run_args = ["nix", "repl", "--file", build_attr.path]
+    if build_attr.attr:
+        run_args.append(build_attr.attr)
+    run_wrapper([*run_args, *dict_to_flags(nix_flags)])
 
-    It will by default build  `<nixpkgs/nixos>` with `attr`, however it
-    optionally supports building from an external file and custom attributes
-    paths.
 
-    Returns the built attribute as path.
-    """
-    if pre_attr or file:
-        run_args = [
-            "nix-build",
-            file or "default.nix",
-            "--attr",
-            f"{'.'.join(x for x in [pre_attr, attr] if x)}",
+def repl_flake(attr: str, flake: Flake, **flake_flags: Args) -> None:
+    expr = Template(
+        files(__package__).joinpath(FLAKE_REPL_TEMPLATE).read_text()
+    ).substitute(
+        flake_path=flake.path,
+        flake_attr=flake.attr,
+        bold="\033[1m",
+        blue="\033[34;1m",
+        attention="\033[35;1m",
+        reset="\033[0m",
+    )
+    run_wrapper(
+        [
+            "nix",
+            *FLAKE_FLAGS,
+            "repl",
+            "--impure",
+            "--expr",
+            expr,
+            *dict_to_flags(flake_flags),
         ]
-    else:
-        run_args = ["nix-build", "<nixpkgs/nixos>", "--attr", attr]
-    run_args += dict_to_flags(nix_flags)
-    r = run_wrapper(run_args, stdout=PIPE)
-    return Path(r.stdout.strip())
-
-
-def nixos_build_flake(
-    attr: str,
-    flake: Flake,
-    **flake_flags: Args,
-) -> Path:
-    """Build NixOS attribute using Flakes.
-
-    Returns the built attribute as path.
-    """
-    run_args = [
-        "nix",
-        *FLAKE_FLAGS,
-        "build",
-        "--print-out-paths",
-        f"{flake}.config.system.build.{attr}",
-        *dict_to_flags(flake_flags),
-    ]
-    r = run_wrapper(run_args, stdout=PIPE)
-    return Path(r.stdout.strip())
+    )
 
 
 def rollback(profile: Profile, target_host: Remote | None, sudo: bool) -> Path:
@@ -368,7 +473,7 @@ def upgrade_channels(all: bool = False) -> None:
     that has a `.update-on-nixos-rebuild` file) or all.
     """
     for channel_path in Path("/nix/var/nix/profiles/per-user/root/channels/").glob("*"):
-        if (
+        if channel_path.is_dir() and (
             all
             or channel_path.name == "nixos"
             or (channel_path / ".update-on-nixos-rebuild").exists()
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
index db470ee5753cb..07d01c6f121bd 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
@@ -1,13 +1,25 @@
-from __future__ import annotations
-
+import logging
 import os
+import shlex
 import subprocess
 from dataclasses import dataclass
 from getpass import getpass
 from pathlib import Path
+from tempfile import TemporaryDirectory
 from typing import Self, Sequence, TypedDict, Unpack
 
-from .utils import info
+logger = logging.getLogger(__name__)
+
+TMPDIR = TemporaryDirectory(prefix="nixos-rebuild.")
+TMPDIR_PATH = Path(TMPDIR.name)
+SSH_DEFAULT_OPTS = [
+    "-o",
+    "ControlMaster=auto",
+    "-o",
+    f"ControlPath={TMPDIR_PATH / "ssh-%n"}",
+    "-o",
+    "ControlPersist=60",
+]
 
 
 @dataclass(frozen=True)
@@ -21,22 +33,14 @@ def from_arg(
         cls,
         host: str | None,
         ask_sudo_password: bool | None,
-        tmp_dir: Path,
+        validate_opts: bool = True,
     ) -> Self | None:
         if not host:
             return None
 
-        opts = os.getenv("NIX_SSHOPTS", "").split()
-        cls._validate_opts(opts, ask_sudo_password)
-        opts += [
-            # SSH ControlMaster flags, allow for faster re-connection
-            "-o",
-            "ControlMaster=auto",
-            "-o",
-            f"ControlPath={tmp_dir / "ssh-%n"}",
-            "-o",
-            "ControlPersist=60",
-        ]
+        opts = shlex.split(os.getenv("NIX_SSHOPTS", ""))
+        if validate_opts:
+            cls._validate_opts(opts, ask_sudo_password)
         sudo_password = None
         if ask_sudo_password:
             sudo_password = getpass(f"[sudo] password for {host}: ")
@@ -46,13 +50,13 @@ def from_arg(
     def _validate_opts(opts: list[str], ask_sudo_password: bool | None) -> None:
         for o in opts:
             if o in ["-t", "-tt", "RequestTTY=yes", "RequestTTY=force"]:
-                info(
-                    f"warning: detected option '{o}' in NIX_SSHOPTS. SSH's TTY "
-                    + "may cause issues, it is recommended to remove this option"
+                logger.warning(
+                    f"detected option '{o}' in NIX_SSHOPTS. SSH's TTY may "
+                    + "cause issues, it is recommended to remove this option"
                 )
                 if not ask_sudo_password:
-                    info(
-                        "If you want to prompt for sudo password use "
+                    logger.warning(
+                        "if you want to prompt for sudo password use "
                         + "'--ask-sudo-password' option instead"
                     )
 
@@ -64,10 +68,15 @@ class RunKwargs(TypedDict, total=False):
     stdout: int | None
 
 
-def cleanup_ssh(tmp_dir: Path) -> None:
+def cleanup_ssh() -> None:
     "Close SSH ControlMaster connection."
-    for ctrl in tmp_dir.glob("ssh-*"):
-        subprocess.run(["ssh", "-o", f"ControlPath={ctrl}", "exit"], check=False)
+    for ctrl in TMPDIR_PATH.glob("ssh-*"):
+        run_wrapper(
+            ["ssh", "-o", f"ControlPath={ctrl}", "-O", "exit", "dummyhost"],
+            check=False,
+            capture_output=True,
+        )
+    TMPDIR.cleanup()
 
 
 def run_wrapper(
@@ -92,21 +101,52 @@ def run_wrapper(
                 input = remote.sudo_password + "\n"
             else:
                 args = ["sudo", *args]
-        args = ["ssh", *remote.opts, remote.host, "--", *args]
+        args = [
+            "ssh",
+            *remote.opts,
+            *SSH_DEFAULT_OPTS,
+            remote.host,
+            "--",
+            # SSH will join the parameters here and pass it to the shell, so we
+            # need to quote it to avoid issues.
+            # We can't use `shlex.join`, otherwise we will hit MAX_ARG_STRLEN
+            # limits when the command becomes too big.
+            *[shlex.quote(str(a)) for a in args],
+        ]
     else:
         if extra_env:
             env = os.environ | extra_env
         if sudo:
             args = ["sudo", *args]
 
-    return subprocess.run(
+    logger.debug(
+        "calling run with args=%r, kwargs=%r, extra_env=%r",
         args,
-        check=check,
-        env=env,
-        input=input,
-        # Hope nobody is using NixOS with non-UTF8 encodings, but "surrogateescape"
-        # should still work in those systems.
-        text=True,
-        errors="surrogateescape",
-        **kwargs,
+        kwargs,
+        extra_env,
     )
+
+    try:
+        r = subprocess.run(
+            args,
+            check=check,
+            env=env,
+            input=input,
+            # Hope nobody is using NixOS with non-UTF8 encodings, but "surrogateescape"
+            # should still work in those systems.
+            text=True,
+            errors="surrogateescape",
+            **kwargs,
+        )
+
+        if kwargs.get("capture_output") or kwargs.get("stderr") or kwargs.get("stdout"):
+            logger.debug("captured output stdout=%r, stderr=%r", r.stdout, r.stderr)
+
+        return r
+    except subprocess.CalledProcessError:
+        if sudo and remote:
+            logger.error(
+                "while running command with remote sudo, did you forget to use "
+                + "--ask-sudo-password?"
+            )
+        raise
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/repl.nix.template b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/repl.nix.template
new file mode 100644
index 0000000000000..17db87423711b
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/repl.nix.template
@@ -0,0 +1,41 @@
+# vim: set syntax=nix:
+let
+  flake = builtins.getFlake ''${flake_path}'';
+  configuration = flake.${flake_attr};
+  motd = ''
+    $${"\n"}
+    Hello and welcome to the NixOS configuration
+        ${flake_attr}
+        in ${flake_path}
+
+    The following is loaded into nix repl's scope:
+
+        - ${blue}config${reset}   All option values
+        - ${blue}options${reset}  Option data and metadata
+        - ${blue}pkgs${reset}     Nixpkgs package set
+        - ${blue}lib${reset}      Nixpkgs library functions
+        - other module arguments
+
+        - ${blue}flake${reset}    Flake outputs, inputs and source info of ${flake_path}
+
+    Use tab completion to browse around ${blue}config${reset}.
+
+    Use ${bold}:r${reset} to ${bold}reload${reset} everything after making a change in the flake.
+      (assuming ${flake_path} is a mutable flake ref)
+
+    See ${bold}:?${reset} for more repl commands.
+
+    ${attention}warning:${reset} nixos-rebuild repl does not currently enforce pure evaluation.
+  '';
+  scope =
+    assert configuration._type or null == ''configuration'';
+    assert configuration.class or ''nixos'' == ''nixos'';
+    configuration._module.args
+    // configuration._module.specialArgs
+    // {
+      inherit (configuration) config options;
+      lib = configuration.lib or configuration.pkgs.lib;
+      inherit flake;
+    };
+in
+builtins.seq scope builtins.trace motd scope
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
index 8d4f128075d40..cd89435f2d4f8 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
@@ -1,11 +1,23 @@
-import sys
-from functools import partial
-from typing import TypeAlias
+import logging
+from typing import TypeAlias, override
 
-info = partial(print, file=sys.stderr)
 Args: TypeAlias = bool | str | list[str] | int | None
 
 
+class LogFormatter(logging.Formatter):
+    formatters = {
+        logging.INFO: logging.Formatter("%(message)s"),
+        logging.DEBUG: logging.Formatter("%(levelname)s: %(name)s: %(message)s"),
+        "DEFAULT": logging.Formatter("%(levelname)s: %(message)s"),
+    }
+
+    @override
+    def format(self, record: logging.LogRecord) -> str:
+        record.levelname = record.levelname.lower()
+        formatter = self.formatters.get(record.levelno, self.formatters["DEFAULT"])
+        return formatter.format(record)
+
+
 def dict_to_flags(d: dict[str, Args]) -> list[str]:
     flags = []
     for key, value in d.items():
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml b/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml
index f26b3cba70562..d773e88889233 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml
@@ -9,6 +9,9 @@ version = "0.0.0"
 [project.scripts]
 nixos-rebuild = "nixos_rebuild:main"
 
+[tool.setuptools.package-data]
+nixos_rebuild = ["*.template.nix"]
+
 [tool.mypy]
 # `--strict` config, but explicit options to avoid breaking build when mypy is
 # updated
@@ -40,6 +43,8 @@ extend-select = [
     "I",
     # require `check` argument for `subprocess.run`
     "PLW1510",
+    # check for needless exception names in raise statements
+    "TRY201",
 ]
 
 [tool.ruff.lint.per-file-ignores]
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/helpers.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/helpers.py
index 0474c6671edd0..77ddad740865b 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/helpers.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/helpers.py
@@ -1,5 +1,3 @@
-from __future__ import annotations
-
 from types import ModuleType
 from typing import Any, Callable
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index e3bb1ba8f6e7c..913103985f664 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -1,3 +1,4 @@
+import logging
 import textwrap
 from pathlib import Path
 from subprocess import PIPE, CompletedProcess
@@ -43,7 +44,7 @@ def test_parse_args() -> None:
             "bar",
         ]
     )
-    assert nr.VERBOSE == 0
+    assert nr.logger.level == logging.INFO
     assert r1.flake == "/etc/nixos"
     assert r1.install_bootloader is True
     assert r1.install_grub is True
@@ -65,7 +66,7 @@ def test_parse_args() -> None:
             "-vvv",
         ]
     )
-    assert nr.VERBOSE == 3
+    assert nr.logger.level == logging.DEBUG
     assert r2.verbose == 3
     assert r2.flake is False
     assert r2.action == "dry-build"
@@ -94,7 +95,7 @@ def test_execute_nix_boot(mock_run: Any, tmp_path: Path) -> None:
         CompletedProcess([], 0),
     ]
 
-    nr.execute(["nixos-rebuild", "boot", "--no-flake", "-vvv"])
+    nr.execute(["nixos-rebuild", "boot", "--no-flake", "-vvv", "--fast"])
 
     assert mock_run.call_count == 6
     mock_run.assert_has_calls(
@@ -121,7 +122,7 @@ def test_execute_nix_boot(mock_run: Any, tmp_path: Path) -> None:
                     "nix-build",
                     "<nixpkgs/nixos>",
                     "--attr",
-                    "system",
+                    "config.system.build.toplevel",
                     "--no-out-link",
                     "-vvv",
                 ],
@@ -172,6 +173,7 @@ def test_execute_nix_switch_flake(mock_run: Any, tmp_path: Path) -> None:
             "--install-bootloader",
             "--sudo",
             "--verbose",
+            "--fast",
         ]
     )
 
@@ -216,9 +218,9 @@ def test_execute_nix_switch_flake(mock_run: Any, tmp_path: Path) -> None:
 
 @patch.dict(nr.process.os.environ, {}, clear=True)
 @patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
-@patch(get_qualified_name(nr.TemporaryDirectory, nr))  # can't autospec
-def test_execute_nix_switch_flake_remote(
-    mock_tmpdir: Any,
+@patch(get_qualified_name(nr.cleanup_ssh, nr), autospec=True)
+def test_execute_nix_switch_flake_target_host(
+    mock_cleanup_ssh: Any,
     mock_run: Any,
     tmp_path: Path,
 ) -> None:
@@ -234,7 +236,6 @@ def test_execute_nix_switch_flake_remote(
         # switch_to_configuration
         CompletedProcess([], 0),
     ]
-    mock_tmpdir.return_value.name = "/tmp/test"
 
     nr.execute(
         [
@@ -245,6 +246,7 @@ def test_execute_nix_switch_flake_remote(
             "--use-remote-sudo",
             "--target-host",
             "user@localhost",
+            "--fast",
         ]
     )
 
@@ -273,20 +275,15 @@ def test_execute_nix_switch_flake_remote(
             call(
                 [
                     "ssh",
-                    "-o",
-                    "ControlMaster=auto",
-                    "-o",
-                    "ControlPath=/tmp/test/ssh-%n",
-                    "-o",
-                    "ControlPersist=60",
+                    *nr.process.SSH_DEFAULT_OPTS,
                     "user@localhost",
                     "--",
                     "sudo",
                     "nix-env",
                     "-p",
-                    Path("/nix/var/nix/profiles/system"),
+                    "/nix/var/nix/profiles/system",
                     "--set",
-                    config_path,
+                    str(config_path),
                 ],
                 check=True,
                 **DEFAULT_RUN_KWARGS,
@@ -294,18 +291,13 @@ def test_execute_nix_switch_flake_remote(
             call(
                 [
                     "ssh",
-                    "-o",
-                    "ControlMaster=auto",
-                    "-o",
-                    "ControlPath=/tmp/test/ssh-%n",
-                    "-o",
-                    "ControlPersist=60",
+                    *nr.process.SSH_DEFAULT_OPTS,
                     "user@localhost",
                     "--",
                     "sudo",
                     "env",
                     "NIXOS_INSTALL_BOOTLOADER=0",
-                    config_path / "bin/switch-to-configuration",
+                    f"{config_path / 'bin/switch-to-configuration'}",
                     "switch",
                 ],
                 check=True,
@@ -315,12 +307,117 @@ def test_execute_nix_switch_flake_remote(
     )
 
 
+@patch.dict(nr.process.os.environ, {}, clear=True)
+@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+@patch(get_qualified_name(nr.cleanup_ssh, nr), autospec=True)
+def test_execute_nix_switch_flake_build_host(
+    mock_cleanup_ssh: Any,
+    mock_run: Any,
+    tmp_path: Path,
+) -> None:
+    config_path = tmp_path / "test"
+    config_path.touch()
+    mock_run.side_effect = [
+        # nixos_build_flake
+        CompletedProcess([], 0, str(config_path)),
+        CompletedProcess([], 0),
+        CompletedProcess([], 0, str(config_path)),
+        # set_profile
+        CompletedProcess([], 0),
+        # copy_closure
+        CompletedProcess([], 0),
+        # switch_to_configuration
+        CompletedProcess([], 0),
+    ]
+
+    nr.execute(
+        [
+            "nixos-rebuild",
+            "switch",
+            "--flake",
+            "/path/to/config#hostname",
+            "--build-host",
+            "user@localhost",
+            "--fast",
+        ]
+    )
+
+    assert mock_run.call_count == 6
+    mock_run.assert_has_calls(
+        [
+            call(
+                [
+                    "nix",
+                    "--extra-experimental-features",
+                    "nix-command flakes",
+                    "eval",
+                    "--raw",
+                    "/path/to/config#nixosConfigurations.hostname.config.system.build.toplevel.drvPath",
+                ],
+                check=True,
+                stdout=PIPE,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                ["nix-copy-closure", "--to", "user@localhost", config_path],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                [
+                    "ssh",
+                    *nr.process.SSH_DEFAULT_OPTS,
+                    "user@localhost",
+                    "--",
+                    "nix",
+                    "--extra-experimental-features",
+                    "'nix-command flakes'",
+                    "build",
+                    f"'{config_path}^*'",
+                    "--print-out-paths",
+                ],
+                check=True,
+                stdout=PIPE,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                [
+                    "nix-copy-closure",
+                    "--from",
+                    "user@localhost",
+                    config_path,
+                ],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                [
+                    "nix-env",
+                    "-p",
+                    Path("/nix/var/nix/profiles/system"),
+                    "--set",
+                    config_path,
+                ],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                [config_path / "bin/switch-to-configuration", "switch"],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
+        ]
+    )
+
+
 @patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
 def test_execute_switch_rollback(mock_run: Any, tmp_path: Path) -> None:
     nixpkgs_path = tmp_path / "nixpkgs"
     nixpkgs_path.touch()
 
-    nr.execute(["nixos-rebuild", "switch", "--rollback", "--install-bootloader"])
+    nr.execute(
+        ["nixos-rebuild", "switch", "--rollback", "--install-bootloader", "--fast"]
+    )
 
     assert mock_run.call_count >= 2
     # ignoring update_nixpkgs_rev calls
@@ -348,6 +445,35 @@ def test_execute_switch_rollback(mock_run: Any, tmp_path: Path) -> None:
     )
 
 
+@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+def test_execute_build(mock_run: Any, tmp_path: Path) -> None:
+    config_path = tmp_path / "test"
+    config_path.touch()
+    mock_run.side_effect = [
+        # nixos_build_flake
+        CompletedProcess([], 0, str(config_path)),
+    ]
+
+    nr.execute(["nixos-rebuild", "build", "--no-flake", "--fast"])
+
+    assert mock_run.call_count == 1
+    mock_run.assert_has_calls(
+        [
+            call(
+                [
+                    "nix-build",
+                    "<nixpkgs/nixos>",
+                    "--attr",
+                    "config.system.build.toplevel",
+                ],
+                check=True,
+                stdout=PIPE,
+                **DEFAULT_RUN_KWARGS,
+            )
+        ]
+    )
+
+
 @patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
 @patch(get_qualified_name(nr.nix.Path.exists, nr.nix), autospec=True, return_value=True)
 @patch(get_qualified_name(nr.nix.Path.mkdir, nr.nix), autospec=True)
@@ -372,13 +498,7 @@ def test_execute_test_rollback(
     ]
 
     nr.execute(
-        [
-            "nixos-rebuild",
-            "test",
-            "--rollback",
-            "--profile-name",
-            "foo",
-        ]
+        ["nixos-rebuild", "test", "--rollback", "--profile-name", "foo", "--fast"]
     )
 
     assert mock_run.call_count == 2
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
index f30ef40593107..4da2d6ed73564 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
@@ -9,6 +9,27 @@
 from .helpers import get_qualified_name
 
 
+def test_build_attr_from_arg() -> None:
+    assert m.BuildAttr.from_arg(None, None) == m.BuildAttr("<nixpkgs/nixos>", None)
+    assert m.BuildAttr.from_arg("attr", None) == m.BuildAttr(
+        Path("default.nix"), "attr"
+    )
+    assert m.BuildAttr.from_arg("attr", "file.nix") == m.BuildAttr(
+        Path("file.nix"), "attr"
+    )
+    assert m.BuildAttr.from_arg(None, "file.nix") == m.BuildAttr(Path("file.nix"), None)
+
+
+def test_build_attr_to_attr() -> None:
+    assert (
+        m.BuildAttr("<nixpkgs/nixos>", None).to_attr("attr1", "attr2") == "attr1.attr2"
+    )
+    assert (
+        m.BuildAttr("<nixpkgs/nixos>", "preAttr").to_attr("attr1", "attr2")
+        == "preAttr.attr1.attr2"
+    )
+
+
 def test_flake_parse() -> None:
     assert m.Flake.parse("/path/to/flake#attr") == m.Flake(
         Path("/path/to/flake"), "nixosConfigurations.attr"
@@ -24,6 +45,15 @@ def test_flake_parse() -> None:
     assert m.Flake.parse(".") == m.Flake(Path("."), "nixosConfigurations.default")
 
 
+def test_flake_to_attr() -> None:
+    assert (
+        m.Flake(Path("/path/to/flake"), "nixosConfigurations.preAttr").to_attr(
+            "attr1", "attr2"
+        )
+        == "/path/to/flake#nixosConfigurations.preAttr.attr1.attr2"
+    )
+
+
 @patch(get_qualified_name(platform.node), autospec=True)
 def test_flake_from_arg(mock_node: Any) -> None:
     mock_node.return_value = "hostname"
@@ -100,13 +130,13 @@ def test_flake_from_arg(mock_node: Any) -> None:
 
 
 @patch(get_qualified_name(m.Path.mkdir, m), autospec=True)
-def test_profile_from_name(mock_mkdir: Any) -> None:
-    assert m.Profile.from_name("system") == m.Profile(
+def test_profile_from_arg(mock_mkdir: Any) -> None:
+    assert m.Profile.from_arg("system") == m.Profile(
         "system",
         Path("/nix/var/nix/profiles/system"),
     )
 
-    assert m.Profile.from_name("something") == m.Profile(
+    assert m.Profile.from_arg("something") == m.Profile(
         "something",
         Path("/nix/var/nix/profiles/system-profiles/something"),
     )
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index 8234f0ff98f9f..6a34f98bd066d 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -8,21 +8,214 @@
 
 import nixos_rebuild.models as m
 import nixos_rebuild.nix as n
+import nixos_rebuild.process as p
 
 from .helpers import get_qualified_name
 
 
+@patch(
+    get_qualified_name(n.run_wrapper, n),
+    autospec=True,
+    return_value=CompletedProcess([], 0, stdout=" \n/path/to/file\n "),
+)
+def test_build(mock_run: Any, monkeypatch: Any) -> None:
+    assert n.build(
+        "config.system.build.attr", m.BuildAttr("<nixpkgs/nixos>", None), nix_flag="foo"
+    ) == Path("/path/to/file")
+    mock_run.assert_called_with(
+        [
+            "nix-build",
+            "<nixpkgs/nixos>",
+            "--attr",
+            "config.system.build.attr",
+            "--nix-flag",
+            "foo",
+        ],
+        stdout=PIPE,
+    )
+
+    assert n.build(
+        "config.system.build.attr", m.BuildAttr(Path("file"), "preAttr")
+    ) == Path("/path/to/file")
+    mock_run.assert_called_with(
+        ["nix-build", Path("file"), "--attr", "preAttr.config.system.build.attr"],
+        stdout=PIPE,
+    )
+
+
+@patch(
+    get_qualified_name(n.run_wrapper, n),
+    autospec=True,
+    return_value=CompletedProcess([], 0, stdout=" \n/path/to/file\n "),
+)
+def test_build_flake(mock_run: Any) -> None:
+    flake = m.Flake.parse(".#hostname")
+
+    assert n.build_flake(
+        "config.system.build.toplevel",
+        flake,
+        no_link=True,
+        nix_flag="foo",
+    ) == Path("/path/to/file")
+    mock_run.assert_called_with(
+        [
+            "nix",
+            "--extra-experimental-features",
+            "nix-command flakes",
+            "build",
+            "--print-out-paths",
+            ".#nixosConfigurations.hostname.config.system.build.toplevel",
+            "--no-link",
+            "--nix-flag",
+            "foo",
+        ],
+        stdout=PIPE,
+    )
+
+
+@patch(
+    get_qualified_name(n.run_wrapper, n),
+    autospec=True,
+    return_value=CompletedProcess([], 0, stdout=" \n/path/to/file\n "),
+)
+def test_remote_build(mock_run: Any, monkeypatch: Any) -> None:
+    build_host = m.Remote("user@host", [], None)
+    monkeypatch.setenv("NIX_SSHOPTS", "--ssh opts")
+    assert n.remote_build(
+        "config.system.build.toplevel",
+        m.BuildAttr("<nixpkgs/nixos>", "preAttr"),
+        build_host,
+        build_flags={"build": True},
+        instantiate_flags={"inst": True},
+        copy_flags={"copy": True},
+    ) == Path("/path/to/file")
+    mock_run.assert_has_calls(
+        [
+            call(
+                [
+                    "nix-instantiate",
+                    "--raw",
+                    "<nixpkgs/nixos>",
+                    "--attr",
+                    "preAttr.config.system.build.toplevel",
+                    "--inst",
+                ],
+                stdout=PIPE,
+            ),
+            call(
+                [
+                    "nix-copy-closure",
+                    "--copy",
+                    "--to",
+                    "user@host",
+                    Path("/path/to/file"),
+                ],
+                extra_env={
+                    "NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh opts"])
+                },
+                remote=None,
+            ),
+            call(
+                ["nix-store", "--realise", Path("/path/to/file"), "--build"],
+                remote=build_host,
+                stdout=PIPE,
+            ),
+        ]
+    )
+
+
+@patch(
+    get_qualified_name(n.run_wrapper, n),
+    autospec=True,
+    return_value=CompletedProcess([], 0, stdout=" \n/path/to/file\n "),
+)
+def test_remote_build_flake(mock_run: Any, monkeypatch: Any) -> None:
+    flake = m.Flake.parse(".#hostname")
+    build_host = m.Remote("user@host", [], None)
+    monkeypatch.setenv("NIX_SSHOPTS", "--ssh opts")
+
+    assert n.remote_build_flake(
+        "config.system.build.toplevel",
+        flake,
+        build_host,
+        flake_build_flags={"flake": True},
+        copy_flags={"copy": True},
+        build_flags={"build": True},
+    ) == Path("/path/to/file")
+    mock_run.assert_has_calls(
+        [
+            call(
+                [
+                    "nix",
+                    "--extra-experimental-features",
+                    "nix-command flakes",
+                    "eval",
+                    "--raw",
+                    ".#nixosConfigurations.hostname.config.system.build.toplevel.drvPath",
+                    "--flake",
+                ],
+                stdout=PIPE,
+            ),
+            call(
+                [
+                    "nix-copy-closure",
+                    "--copy",
+                    "--to",
+                    "user@host",
+                    Path("/path/to/file"),
+                ],
+                extra_env={
+                    "NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh opts"])
+                },
+                remote=None,
+            ),
+            call(
+                [
+                    "nix",
+                    "--extra-experimental-features",
+                    "nix-command flakes",
+                    "build",
+                    "/path/to/file^*",
+                    "--print-out-paths",
+                    "--build",
+                ],
+                remote=build_host,
+                stdout=PIPE,
+            ),
+        ]
+    )
+
+
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
-def test_copy_closure(mock_run: Any) -> None:
+def test_copy_closure(mock_run: Any, monkeypatch: Any) -> None:
     closure = Path("/path/to/closure")
     n.copy_closure(closure, None)
     mock_run.assert_not_called()
 
-    target_host = m.Remote("user@host", ["--ssh", "opt"], None)
+    target_host = m.Remote("user@target.host", [], None)
+    build_host = m.Remote("user@build.host", [], None)
+
     n.copy_closure(closure, target_host)
     mock_run.assert_called_with(
-        ["nix-copy-closure", "--to", "user@host", closure],
-        extra_env={"NIX_SSHOPTS": "--ssh opt"},
+        ["nix-copy-closure", "--to", "user@target.host", closure],
+        extra_env={"NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS)},
+        remote=None,
+    )
+
+    monkeypatch.setenv("NIX_SSHOPTS", "--ssh build-opt")
+    n.copy_closure(closure, None, build_host)
+    mock_run.assert_called_with(
+        ["nix-copy-closure", "--from", "user@build.host", closure],
+        extra_env={"NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS + ["--ssh build-opt"])},
+        remote=None,
+    )
+
+    monkeypatch.setenv("NIX_SSHOPTS", "--ssh build-target-opt")
+    n.copy_closure(closure, target_host, build_host)
+    mock_run.assert_called_with(
+        ["nix-copy-closure", "--to", "user@target.host", closure],
+        remote=build_host,
+        extra_env={"NIX_SSHOPTS": "--ssh build-target-opt"},
     )
 
 
@@ -193,65 +386,23 @@ def test_list_generations(mock_get_generations: Any, tmp_path: Path) -> None:
     ]
 
 
-@patch(
-    get_qualified_name(n.run_wrapper, n),
-    autospec=True,
-    return_value=CompletedProcess([], 0, stdout=" \n/path/to/file\n "),
-)
-def test_nixos_build_flake(mock_run: Any) -> None:
-    flake = m.Flake.parse(".#hostname")
-
-    assert n.nixos_build_flake(
-        "toplevel",
-        flake,
-        no_link=True,
-        nix_flag="foo",
-    ) == Path("/path/to/file")
-    mock_run.assert_called_with(
-        [
-            "nix",
-            "--extra-experimental-features",
-            "nix-command flakes",
-            "build",
-            "--print-out-paths",
-            ".#nixosConfigurations.hostname.config.system.build.toplevel",
-            "--no-link",
-            "--nix-flag",
-            "foo",
-        ],
-        stdout=PIPE,
-    )
-
-
-@patch(
-    get_qualified_name(n.run_wrapper, n),
-    autospec=True,
-    return_value=CompletedProcess([], 0, stdout=" \n/path/to/file\n "),
-)
-def test_nixos_build(mock_run: Any, monkeypatch: Any) -> None:
-    assert n.nixos_build("attr", None, None, nix_flag="foo") == Path("/path/to/file")
+@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
+def test_repl(mock_run: Any) -> None:
+    n.repl("attr", m.BuildAttr("<nixpkgs/nixos>", None), nix_flag=True)
     mock_run.assert_called_with(
-        ["nix-build", "<nixpkgs/nixos>", "--attr", "attr", "--nix-flag", "foo"],
-        stdout=PIPE,
+        ["nix", "repl", "--file", "<nixpkgs/nixos>", "--nix-flag"]
     )
 
-    n.nixos_build("attr", "preAttr", "file")
-    mock_run.assert_called_with(
-        ["nix-build", "file", "--attr", "preAttr.attr"],
-        stdout=PIPE,
-    )
+    n.repl("attr", m.BuildAttr(Path("file.nix"), "myAttr"))
+    mock_run.assert_called_with(["nix", "repl", "--file", Path("file.nix"), "myAttr"])
 
-    n.nixos_build("attr", None, "file", no_out_link=True)
-    mock_run.assert_called_with(
-        ["nix-build", "file", "--attr", "attr", "--no-out-link"],
-        stdout=PIPE,
-    )
 
-    n.nixos_build("attr", "preAttr", None, no_out_link=False, keep_going=True)
-    mock_run.assert_called_with(
-        ["nix-build", "default.nix", "--attr", "preAttr.attr", "--keep-going"],
-        stdout=PIPE,
-    )
+@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
+def test_repl_flake(mock_run: Any) -> None:
+    n.repl_flake("attr", m.Flake(Path("flake.nix"), "myAttr"), nix_flag=True)
+    # This method would be really annoying to test, and it is not that important
+    # So just check that we are at least calling it
+    assert mock_run.called
 
 
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
@@ -418,7 +569,8 @@ def test_switch_to_configuration(mock_run: Any, monkeypatch: Any) -> None:
         Path("/nix/var/nix/profiles/per-user/root/channels/home-manager"),
     ],
 )
-def test_upgrade_channels(mock_glob: Any) -> None:
+@patch(get_qualified_name(n.Path.is_dir, n), autospec=True, return_value=True)
+def test_upgrade_channels(mock_is_dir: Any, mock_glob: Any) -> None:
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
         n.upgrade_channels(False)
     mock_run.assert_called_with(["nix-channel", "--update", "nixos"], check=False)
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
index 6987aac9283bd..6c2ca22892457 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
@@ -1,4 +1,3 @@
-from pathlib import Path
 from typing import Any
 from unittest.mock import patch
 
@@ -8,7 +7,7 @@
 from .helpers import get_qualified_name
 
 
-@patch(get_qualified_name(p.subprocess.run))
+@patch(get_qualified_name(p.subprocess.run), autospec=True)
 def test_run(mock_run: Any) -> None:
     p.run_wrapper(["test", "--with", "flags"], check=True)
     mock_run.assert_called_with(
@@ -40,12 +39,22 @@ def test_run(mock_run: Any) -> None:
     )
 
     p.run_wrapper(
-        ["test", "--with", "flags"],
+        ["test", "--with", "some flags"],
         check=True,
         remote=m.Remote("user@localhost", ["--ssh", "opt"], "password"),
     )
     mock_run.assert_called_with(
-        ["ssh", "--ssh", "opt", "user@localhost", "--", "test", "--with", "flags"],
+        [
+            "ssh",
+            "--ssh",
+            "opt",
+            *p.SSH_DEFAULT_OPTS,
+            "user@localhost",
+            "--",
+            "test",
+            "--with",
+            "'some flags'",
+        ],
         check=True,
         text=True,
         errors="surrogateescape",
@@ -65,6 +74,7 @@ def test_run(mock_run: Any) -> None:
             "ssh",
             "--ssh",
             "opt",
+            *p.SSH_DEFAULT_OPTS,
             "user@localhost",
             "--",
             "sudo",
@@ -84,38 +94,20 @@ def test_run(mock_run: Any) -> None:
     )
 
 
-def test_remote_from_name(monkeypatch: Any, tmpdir: Path) -> None:
+def test_remote_from_name(monkeypatch: Any) -> None:
     monkeypatch.setenv("NIX_SSHOPTS", "")
-    assert m.Remote.from_arg("user@localhost", None, tmpdir) == m.Remote(
+    assert m.Remote.from_arg("user@localhost", None, False) == m.Remote(
         "user@localhost",
-        opts=[
-            "-o",
-            "ControlMaster=auto",
-            "-o",
-            f"ControlPath={tmpdir / "ssh-%n"}",
-            "-o",
-            "ControlPersist=60",
-        ],
+        opts=[],
         sudo_password=None,
     )
 
     # get_qualified_name doesn't work because getpass is aliased to another
     # function
     with patch(f"{p.__name__}.getpass", return_value="password"):
-        monkeypatch.setenv("NIX_SSHOPTS", "-f foo -b bar")
-        assert m.Remote.from_arg("user@localhost", True, tmpdir) == m.Remote(
+        monkeypatch.setenv("NIX_SSHOPTS", "-f foo -b bar -t")
+        assert m.Remote.from_arg("user@localhost", True, True) == m.Remote(
             "user@localhost",
-            opts=[
-                "-f",
-                "foo",
-                "-b",
-                "bar",
-                "-o",
-                "ControlMaster=auto",
-                "-o",
-                f"ControlPath={tmpdir / "ssh-%n"}",
-                "-o",
-                "ControlPersist=60",
-            ],
+            opts=["-f", "foo", "-b", "bar", "-t"],
             sudo_password="password",
         )
diff --git a/pkgs/by-name/se/seatd/package.nix b/pkgs/by-name/se/seatd/package.nix
index c10d5085dfc85..b47e6bc461993 100644
--- a/pkgs/by-name/se/seatd/package.nix
+++ b/pkgs/by-name/se/seatd/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "seatd";
-  version = "0.8.0";
+  version = "0.9.1";
 
   src = fetchFromSourcehut {
     owner = "~kennylevinsen";
     repo = "seatd";
     rev = finalAttrs.version;
-    hash = "sha256-YaR4VuY+wrzbnhER4bkwdm0rTY1OVMtixdDEhu7Lnws=";
+    hash = "sha256-6F+TPSpcEwX4wW5GPy5Ck2AeHyH/Ba2oBUSUnVyAMeA=";
   };
 
   outputs = [ "bin" "out" "dev" "man" ];
diff --git a/pkgs/by-name/si/silx/package.nix b/pkgs/by-name/si/silx/package.nix
index 3fa944d5ae53e..6b80d173da79f 100644
--- a/pkgs/by-name/si/silx/package.nix
+++ b/pkgs/by-name/si/silx/package.nix
@@ -6,13 +6,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "silx";
-  version = "2.1.1";
+  version = "2.1.2";
 
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LfCRWkUrqQb7zxiFTPhy/g9FWhNMXTRbhEgek4tZb5I=";
+    hash = "sha256-Uep/BkH3ngGDbPMVptab64SKBbOGqa0qazUoT47idqU=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/to/to-html/package.nix b/pkgs/by-name/to/to-html/package.nix
index 5ddba61276d45..cfa80570f50c3 100644
--- a/pkgs/by-name/to/to-html/package.nix
+++ b/pkgs/by-name/to/to-html/package.nix
@@ -1,24 +1,33 @@
 { lib
 , fetchFromGitHub
+, installShellFiles
 , rustPlatform
 }:
 
 rustPlatform.buildRustPackage rec {
-  version = "0.1.4";
+  version = "0.1.6";
   pname = "to-html";
 
   src = fetchFromGitHub {
     owner = "Aloso";
     repo = "to-html";
     rev = "v${version}";
-    hash = "sha256-zkTBjsMFhRz7lVRh8i+XkaJ/qWmTAMPnkH5aDhbHf8U=";
+    hash = "sha256-eNFt9/yK4oHOspNM8PMTewhx8APaHzmgNdrWqrUuQSU=";
   };
 
-  cargoHash = "sha256-hXc+lB3DKnRZkp1U5wW/vPKSZ0c1UknQCAxDfE7Eubg=";
+  cargoHash = "sha256-UxDyk7m6eWvuWPHWUY2OJI59p43/bag8pcZyeGJr/QA=";
 
   # Requires external resources
   doCheck = false;
 
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion \
+      $releaseDir/build/to-html-*/out/to-html.{bash,fish} \
+      --zsh $releaseDir/build/to-html-*/out/_to-html
+  '';
+
   meta = {
     description = "Terminal wrapper for rendering a terminal on a website by converting ANSI escape sequences to HTML";
     mainProgram = "to-html";
diff --git a/pkgs/by-name/uh/uhubctl/package.nix b/pkgs/by-name/uh/uhubctl/package.nix
index c4ea65eebd97e..8feda34f2ad3e 100644
--- a/pkgs/by-name/uh/uhubctl/package.nix
+++ b/pkgs/by-name/uh/uhubctl/package.nix
@@ -1,6 +1,8 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, which
+, pkg-config
 , libusb1
 }:
 
@@ -15,6 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-mpeDePHLsa4sGe2+8X9KQ8AYn7wtybDnaZzxnf4oETQ=";
   };
 
+  nativeBuildInputs = [ which pkg-config ];
+
   buildInputs = [ libusb1 ];
 
   installFlags = [ "prefix=${placeholder "out"}" ];
@@ -23,7 +27,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/mvp/uhubctl";
     description = "Utility to control USB power per-port on smart USB hubs";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ prusnak ];
+    maintainers = with maintainers; [ prusnak carlossless ];
     platforms = with platforms; linux ++ darwin;
     mainProgram = "uhubctl";
   };
diff --git a/pkgs/by-name/wl/wl-clicker/package.nix b/pkgs/by-name/wl/wl-clicker/package.nix
new file mode 100644
index 0000000000000..aa54cf4d6db77
--- /dev/null
+++ b/pkgs/by-name/wl/wl-clicker/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  wayland-scanner,
+  wlr-protocols,
+  wayland,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "wl-clicker";
+  version = "0.3.1";
+
+  nativeBuildInputs = [ wayland-scanner ];
+  buildInputs = [
+    wlr-protocols
+    wayland
+  ];
+
+  src = fetchFromGitHub {
+    owner = "phonetic112";
+    repo = "wl-clicker";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-HuUK1kkqIdB5SdcewJ1J8elzqrFaFWC3BRV3GgcasTU=";
+  };
+
+  postPatch = ''
+    sed -i 's|/usr|${wlr-protocols}|g' Makefile
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install build/wl-clicker $out/bin/wl-clicker
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Wayland autoclicker";
+    longDescription = "Script for auto clicking at incredibly high speeds - user must be a part of `input` group to run.";
+    homepage = "https://github.com/phonetic112/wl-clicker";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.Flameopathic ];
+    mainProgram = "wl-clicker";
+    platforms = lib.platforms.linux;
+    broken = stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64;
+  };
+})
diff --git a/pkgs/by-name/zo/zotero/darwin.nix b/pkgs/by-name/zo/zotero/darwin.nix
index ad60ee9d409ef..12697c31a085b 100644
--- a/pkgs/by-name/zo/zotero/darwin.nix
+++ b/pkgs/by-name/zo/zotero/darwin.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.zotero.org/client/release/${version}/Zotero-${version}.dmg";
-    hash = "sha256-z1HAkHz4JGRfQJna2cINZTmYPzyj9ofp7mJHN/mNyOo=";
+    hash = "sha256-JP9zRPsEDICw6Q7VHRd7IB0J9+v0qU7QuLf7eTPafBo=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/by-name/zo/zotero/linux.nix b/pkgs/by-name/zo/zotero/linux.nix
index 1b7d58f86883e..5a3d3570fc3f2 100644
--- a/pkgs/by-name/zo/zotero/linux.nix
+++ b/pkgs/by-name/zo/zotero/linux.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    hash = "sha256-utiqS4/PvlkQesqTOyEvj8uwW1sDxlqjnhv6GFfY5uk=";
+    hash = "sha256-t0LApaU13tT/14nvRpnWZwFyWiJq+WfZNgVyhNayMcs=";
   };
 
   dontPatchELF = true;
diff --git a/pkgs/by-name/zo/zotero/package.nix b/pkgs/by-name/zo/zotero/package.nix
index f6117050c97fd..a56aef7d3ae77 100644
--- a/pkgs/by-name/zo/zotero/package.nix
+++ b/pkgs/by-name/zo/zotero/package.nix
@@ -6,7 +6,7 @@
 
 let
   pname = "zotero";
-  version = "7.0.8";
+  version = "7.0.10";
   meta = {
     homepage = "https://www.zotero.org";
     description = "Collect, organize, cite, and share your research sources";
diff --git a/pkgs/desktops/lxqt/lxqt-notificationd/default.nix b/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
index a88f3317b3eac..4f01a9d7114ab 100644
--- a/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lxqt-notificationd";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-Iu3U036ebh9lMxCn1gt29nCQxs7N2ZLQHfg9HP3FSm0=";
+    hash = "sha256-L2eXab1V2t7+h51wEh0p2Uzdc3ImR4euoiXVVJ8BguA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/lxqt/lxqt-panel/default.nix b/pkgs/desktops/lxqt/lxqt-panel/default.nix
index 8fe19bc3254c4..bee22f7405f5a 100644
--- a/pkgs/desktops/lxqt/lxqt-panel/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-panel/default.nix
@@ -35,13 +35,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lxqt-panel";
-  version = "2.1.2";
+  version = "2.1.3";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-090zBmRUFac9Tt10l20Vxvn234Br5YPpdLR6+KreEFM=";
+    hash = "sha256-p4Y+0Ym0NNG4yrlfrLqCQyMYVjyogNb1V1QAooQ82LE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/lxqt/lxqt-wayland-session/default.nix b/pkgs/desktops/lxqt/lxqt-wayland-session/default.nix
index 21f4ef2548d99..430cde7762c5f 100644
--- a/pkgs/desktops/lxqt/lxqt-wayland-session/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-wayland-session/default.nix
@@ -4,12 +4,15 @@
   fetchFromGitHub,
   cmake,
   kwindowsystem,
+  layer-shell-qt,
   liblxqt,
   libqtxdg,
   lxqt-build-tools,
+  lxqt-session,
   pkg-config,
   qtsvg,
   qttools,
+  qtxdg-tools,
   xdg-user-dirs,
   xkeyboard_config,
   gitUpdater,
@@ -17,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lxqt-wayland-session";
-  version = "0.1.0";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = "lxqt-wayland-session";
     rev = version;
-    hash = "sha256-5WdfwJ89HWlXL6y9Lpgs7H3mbN/wbf+9VbP9ERPasBM=";
+    hash = "sha256-UMlV8LqUXM2+3ZSLj30FFgC+ZVPmt2W8uE2RrZKqCJE=";
   };
 
   nativeBuildInputs = [
@@ -35,15 +38,19 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     kwindowsystem
+    layer-shell-qt # for applications that need layer-shell-qt (ex: lxqt-panel)
     liblxqt
     libqtxdg
+    lxqt-session
     qtsvg
-    xdg-user-dirs
+    qtxdg-tools # allow to use xdg-utils under LXQt, similar to https://github.com/lxqt/lxqt-session/blob/2.0.0/CHANGELOG#L27
+    xdg-user-dirs # startlxqtwayland sets XDG_CURRENT_DESKTOP
   ];
 
   postPatch = ''
     substituteInPlace startlxqtwayland.in \
-      --replace-fail /usr/share/X11/xkb/rules ${xkeyboard_config}/share/X11/xkb/rules
+      --replace-fail /usr/share/X11/xkb/rules ${xkeyboard_config}/share/X11/xkb/rules \
+      --replace-fail "cp -av " "cp -av --no-preserve=mode "
 
     substituteInPlace configurations/{labwc/autostart,lxqt-hyprland.conf,lxqt-wayfire.ini} \
       --replace-fail /usr/share/lxqt/wallpapers $out/share/lxqt/wallpapers
diff --git a/pkgs/development/node-packages/aliases.nix b/pkgs/development/node-packages/aliases.nix
index a65be6e33ae71..a38d11119a235 100644
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@@ -124,6 +124,7 @@ mapAliases {
   ionic = throw "ionic was replaced by @ionic/cli"; # added 2023-08-19
   inherit (pkgs) jake; # added 2023-08-19
   inherit (pkgs) javascript-typescript-langserver; # added 2023-08-19
+  inherit (pkgs) kaput-cli; # added 2024-12-03
   karma = pkgs.karma-runner; # added 2023-07-29
   leetcode-cli = self.vsc-leetcode-cli; # added 2023-08-31
   inherit (pkgs) lv_font_conv; # added 2024-06-28
diff --git a/pkgs/development/node-packages/main-programs.nix b/pkgs/development/node-packages/main-programs.nix
index 38eb64559fd58..d18dd10b11e2a 100644
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@@ -32,7 +32,6 @@
   graphql-language-service-cli = "graphql-lsp";
   grunt-cli = "grunt";
   gulp-cli = "gulp";
-  kaput-cli = "kaput";
   less = "lessc";
   localtunnel = "lt";
   lua-fmt = "luafmt";
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 24a13c5541035..6c57b171efe2f 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -119,7 +119,6 @@
 , "json-server"
 , "jsonlint"
 , "jsonplaceholder"
-, "kaput-cli"
 , "katex"
 , "keyoxide"
 , "lcov-result-merger"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index e7c23ab18931f..9d2c508122511 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -7249,42 +7249,6 @@ let
         sha512 = "/2WZxKCNjeHlQogCs1VBtJWlPXjwWke/9gMrwsVsrUt00g2V6LUBvwgwrxhrXepjOmq4IZ5QeNbpDMEOUlx/JA==";
       };
     };
-    "@oclif/command-1.8.36" = {
-      name = "_at_oclif_slash_command";
-      packageName = "@oclif/command";
-      version = "1.8.36";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@oclif/command/-/command-1.8.36.tgz";
-        sha512 = "/zACSgaYGtAQRzc7HjzrlIs14FuEYAZrMOEwicRoUnZVyRunG4+t5iSEeQu0Xy2bgbCD0U1SP/EdeNZSTXRwjQ==";
-      };
-    };
-    "@oclif/config-1.18.16" = {
-      name = "_at_oclif_slash_config";
-      packageName = "@oclif/config";
-      version = "1.18.16";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@oclif/config/-/config-1.18.16.tgz";
-        sha512 = "VskIxVcN22qJzxRUq+raalq6Q3HUde7sokB7/xk5TqRZGEKRVbFeqdQBxDWwQeudiJEgcNiMvIFbMQ43dY37FA==";
-      };
-    };
-    "@oclif/config-1.18.17" = {
-      name = "_at_oclif_slash_config";
-      packageName = "@oclif/config";
-      version = "1.18.17";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@oclif/config/-/config-1.18.17.tgz";
-        sha512 = "k77qyeUvjU8qAJ3XK3fr/QVAqsZO8QOBuESnfeM5HHtPNLSyfVcwiMM2zveSW5xRdLSG3MfV8QnLVkuyCL2ENg==";
-      };
-    };
-    "@oclif/config-1.18.2" = {
-      name = "_at_oclif_slash_config";
-      packageName = "@oclif/config";
-      version = "1.18.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@oclif/config/-/config-1.18.2.tgz";
-        sha512 = "cE3qfHWv8hGRCP31j7fIS7BfCflm/BNZ2HNqHexH+fDrdF2f1D5S8VmXWLC77ffv3oDvWyvE9AZeR0RfmHCCaA==";
-      };
-    };
     "@oclif/core-1.26.2" = {
       name = "_at_oclif_slash_core";
       packageName = "@oclif/core";
@@ -7312,15 +7276,6 @@ let
         sha512 = "aXM2O4g7f+kPNzhhOfqGOVRVYDxTVrH7Y720MuH0Twq5WHMxI4XwntnyBaRscoCPG6FWhItZLtiZxsvaUdupGg==";
       };
     };
-    "@oclif/errors-1.3.5" = {
-      name = "_at_oclif_slash_errors";
-      packageName = "@oclif/errors";
-      version = "1.3.5";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@oclif/errors/-/errors-1.3.5.tgz";
-        sha512 = "OivucXPH/eLLlOT7FkCMoZXiaVYf8I/w1eTAM1+gKzfhALwWTusxEx7wBmW0uzvkSg/9ovWLycPaBgJbM3LOCQ==";
-      };
-    };
     "@oclif/errors-1.3.6" = {
       name = "_at_oclif_slash_errors";
       packageName = "@oclif/errors";
@@ -7330,15 +7285,6 @@ let
         sha512 = "fYaU4aDceETd89KXP+3cLyg9EHZsLD3RxF2IU9yxahhBpspWjkWi3Dy3bTgcwZ3V47BgxQaGapzJWDM33XIVDQ==";
       };
     };
-    "@oclif/help-1.0.15" = {
-      name = "_at_oclif_slash_help";
-      packageName = "@oclif/help";
-      version = "1.0.15";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@oclif/help/-/help-1.0.15.tgz";
-        sha512 = "Yt8UHoetk/XqohYX76DfdrUYLsPKMc5pgkzsZVHDyBSkLiGRzujVaGZdjr32ckVZU9q3a47IjhWxhip7Dz5W/g==";
-      };
-    };
     "@oclif/linewrap-1.0.0" = {
       name = "_at_oclif_slash_linewrap";
       packageName = "@oclif/linewrap";
@@ -7348,15 +7294,6 @@ let
         sha512 = "Ups2dShK52xXa8w6iBWLgcjPJWjais6KPJQq3gQ/88AY6BXoTX+MIGFPrWQO1KLMiQfoTpcLnUwloN4brrVUHw==";
       };
     };
-    "@oclif/parser-3.8.17" = {
-      name = "_at_oclif_slash_parser";
-      packageName = "@oclif/parser";
-      version = "3.8.17";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@oclif/parser/-/parser-3.8.17.tgz";
-        sha512 = "l04iSd0xoh/16TGVpXb81Gg3z7tlQGrEup16BrVLsZBK6SEYpYHRJZnM32BwZrHI97ZSFfuSwVlzoo6HdsaK8A==";
-      };
-    };
     "@oclif/plugin-autocomplete-2.3.10" = {
       name = "_at_oclif_slash_plugin-autocomplete";
       packageName = "@oclif/plugin-autocomplete";
@@ -7366,15 +7303,6 @@ let
         sha512 = "Ow1AR8WtjzlyCtiWWPgzMyT8SbcDJFr47009riLioHa+MHX2BCDtVn2DVnN/E6b9JlPV5ptQpjefoRSNWBesmg==";
       };
     };
-    "@oclif/plugin-help-3.3.1" = {
-      name = "_at_oclif_slash_plugin-help";
-      packageName = "@oclif/plugin-help";
-      version = "3.3.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@oclif/plugin-help/-/plugin-help-3.3.1.tgz";
-        sha512 = "QuSiseNRJygaqAdABYFWn/H1CwIZCp9zp/PLid6yXvy6VcQV7OenEFF5XuYaCvSARe2Tg9r8Jqls5+fw1A9CbQ==";
-      };
-    };
     "@oclif/plugin-help-5.2.20" = {
       name = "_at_oclif_slash_plugin-help";
       packageName = "@oclif/plugin-help";
@@ -8482,15 +8410,6 @@ let
         sha512 = "ioXoq9gPxkss4MYhD+SFaU9p1IHFUX0ILAWFPyjGaBdjLsYAlZw6j1iLA0N/m12uVHLFDfSYNF7EQccjinIMDA==";
       };
     };
-    "@putdotio/api-client-8.49.0" = {
-      name = "_at_putdotio_slash_api-client";
-      packageName = "@putdotio/api-client";
-      version = "8.49.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/@putdotio/api-client/-/api-client-8.49.0.tgz";
-        sha512 = "PqD4exebcZIZ7lZj9tYg5NAFqU/wjSiZNM1ak0uXpff3qG+Pw6T/pW5gt0lrWwq132Ct68/Q4by18jg9uXBqMw==";
-      };
-    };
     "@react-native/normalize-color-2.1.0" = {
       name = "_at_react-native_slash_normalize-color";
       packageName = "@react-native/normalize-color";
@@ -17230,15 +17149,6 @@ let
         sha512 = "/1owvF0SZ5Gn54cgrikJ0QskgTzeg30HGjkmjFoaHDJzAqFpuX1DBpFR8aLvsE1J5s9MgeYRENQK4BFwOag5VA==";
       };
     };
-    "cli-ux-5.6.7" = {
-      name = "cli-ux";
-      packageName = "cli-ux";
-      version = "5.6.7";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/cli-ux/-/cli-ux-5.6.7.tgz";
-        sha512 = "dsKAurMNyFDnO6X1TiiRNiVbL90XReLKcvIq4H777NMqXGBxBws23ag8ubCJE97vVZEgWG2eSUhsyLf63Jv8+g==";
-      };
-    };
     "cli-width-2.2.1" = {
       name = "cli-width";
       packageName = "cli-width";
@@ -18211,15 +18121,6 @@ let
         sha512 = "fIWyWUXrJ45cHCIQX+Ck1hrZDIf/9DR0P0Zewn3uNht28hbt5OfGUq8rRWsxi96pZWPyBEd0eY9ama01JTaknA==";
       };
     };
-    "conf-6.2.4" = {
-      name = "conf";
-      packageName = "conf";
-      version = "6.2.4";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/conf/-/conf-6.2.4.tgz";
-        sha512 = "GjgyPRLo1qK1LR9RWAdUagqo+DP18f5HWCFk4va7GS+wpxQTOzfuKTwKOvGW2c01/YXNicAyyoyuSddmdkBzZQ==";
-      };
-    };
     "config-chain-1.1.13" = {
       name = "config-chain";
       packageName = "config-chain";
@@ -20390,15 +20291,6 @@ let
         sha512 = "XRRe6Glud4rd/ZGQfiV1ruXSfbvfJedlV9Y6zOlP+2K04vBYiJEte6stfFkCP03aMnY5tsipamumUjL14fofug==";
       };
     };
-    "debounce-fn-3.0.1" = {
-      name = "debounce-fn";
-      packageName = "debounce-fn";
-      version = "3.0.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/debounce-fn/-/debounce-fn-3.0.1.tgz";
-        sha512 = "aBoJh5AhpqlRoHZjHmOzZlRx+wz2xVwGL9rjs+Kj0EWUrL4/h4K7OD176thl2Tdoqui/AaA4xhHrNArGLAaI3Q==";
-      };
-    };
     "debounce-fn-5.1.2" = {
       name = "debounce-fn";
       packageName = "debounce-fn";
@@ -24162,15 +24054,6 @@ let
         sha512 = "M5Ge0JIrn12EtIVpje2G+hI5X78hmX4UDzynZ7Vnp1MiPSqleEonmgr2Rh59eygEEgq3YJ1GDP96rnM8tnVg/Q==";
       };
     };
-    "extract-stack-2.0.0" = {
-      name = "extract-stack";
-      packageName = "extract-stack";
-      version = "2.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/extract-stack/-/extract-stack-2.0.0.tgz";
-        sha512 = "AEo4zm+TenK7zQorGK1f9mJ8L14hnTDi2ZQPR+Mub1NX8zimka1mXpV5LpH8x9HoUmFSHZCfLHqWvp0Y4FxxzQ==";
-      };
-    };
     "extract-zip-2.0.1" = {
       name = "extract-zip";
       packageName = "extract-zip";
@@ -31309,15 +31192,6 @@ let
         sha512 = "TcezgCLdtAn0dTzPXK6kdnzJV4k9vcdTVxt7l0teFV+7LGWRCFIhs49U3WeNKU0aereFtlR5N5qrSWBGqPlw0A==";
       };
     };
-    "js-base64-2.6.3" = {
-      name = "js-base64";
-      packageName = "js-base64";
-      version = "2.6.3";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/js-base64/-/js-base64-2.6.3.tgz";
-        sha512 = "fiUvdfCaAXoQTHdKMgTvg6IkecXDcVz6V5rlftUTclF9IKBjMizvSdQaCl/z/6TApDeby5NL+axYou3i0mu1Pg==";
-      };
-    };
     "js-base64-3.7.7" = {
       name = "js-base64";
       packageName = "js-base64";
@@ -31696,15 +31570,6 @@ let
         sha512 = "NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==";
       };
     };
-    "json-schema-typed-7.0.3" = {
-      name = "json-schema-typed";
-      packageName = "json-schema-typed";
-      version = "7.0.3";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/json-schema-typed/-/json-schema-typed-7.0.3.tgz";
-        sha512 = "7DE8mpG+/fVw+dTpjbxnx47TaMnDfOI1jwft9g1VybltZCduyRQPJPvc+zzKY9WPHxhPWczyFuYa6I8Mw4iU5A==";
-      };
-    };
     "json-schema-typed-8.0.1" = {
       name = "json-schema-typed";
       packageName = "json-schema-typed";
@@ -37620,15 +37485,6 @@ let
         sha512 = "M85rnSC7WQ7wnfQTARPT4LrK7nwCHLdDFOCcItZMhTQjyCebJH8GciKqYJNgaOFZs9nFmTmd/VMyi3OW5jA47w==";
       };
     };
-    "node-downloader-helper-1.0.19" = {
-      name = "node-downloader-helper";
-      packageName = "node-downloader-helper";
-      version = "1.0.19";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/node-downloader-helper/-/node-downloader-helper-1.0.19.tgz";
-        sha512 = "Bwp8WWDDP5ftg+FmAKU08a9+oiUTPoYzMvXgUqZZPQ7VMo1qKBzW3XdTXHeYnqjGLfkTZ2GPibgAWpApfpeS2g==";
-      };
-    };
     "node-emoji-1.10.0" = {
       name = "node-emoji";
       packageName = "node-emoji";
@@ -71837,227 +71693,6 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-  kaput-cli = nodeEnv.buildNodePackage {
-    name = "kaput-cli";
-    packageName = "kaput-cli";
-    version = "1.1.1";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/kaput-cli/-/kaput-cli-1.1.1.tgz";
-      sha512 = "JbF3PiO1wNawJnOQlb4nJZ2rvDfDWnD7ROCdzqgFXhqi3XTNXBqjpoC7PT3ylfNR6BGibjchndH27VieqyMA0A==";
-    };
-    dependencies = [
-      sources."@nodelib/fs.scandir-2.1.5"
-      sources."@nodelib/fs.stat-2.0.5"
-      sources."@nodelib/fs.walk-1.2.8"
-      sources."@oclif/command-1.8.36"
-      sources."@oclif/config-1.18.17"
-      sources."@oclif/errors-1.3.6"
-      (sources."@oclif/help-1.0.15" // {
-        dependencies = [
-          sources."@oclif/config-1.18.16"
-          sources."wrap-ansi-6.2.0"
-        ];
-      })
-      sources."@oclif/linewrap-1.0.0"
-      sources."@oclif/parser-3.8.17"
-      (sources."@oclif/plugin-help-3.3.1" // {
-        dependencies = [
-          sources."@oclif/config-1.18.2"
-          (sources."@oclif/errors-1.3.5" // {
-            dependencies = [
-              sources."wrap-ansi-7.0.0"
-            ];
-          })
-          sources."wrap-ansi-6.2.0"
-        ];
-      })
-      sources."@oclif/screen-1.0.4"
-      (sources."@putdotio/api-client-8.49.0" // {
-        dependencies = [
-          sources."axios-0.21.4"
-        ];
-      })
-      sources."ajv-6.12.6"
-      sources."ansi-escapes-4.3.2"
-      sources."ansi-regex-5.0.1"
-      sources."ansi-styles-4.3.0"
-      sources."ansicolors-0.3.2"
-      sources."argparse-1.0.10"
-      sources."array-union-2.1.0"
-      (sources."axios-0.19.2" // {
-        dependencies = [
-          sources."debug-3.1.0"
-          sources."follow-redirects-1.5.10"
-          sources."ms-2.0.0"
-        ];
-      })
-      sources."braces-3.0.3"
-      sources."call-bind-1.0.7"
-      sources."cardinal-2.1.1"
-      sources."chalk-4.1.2"
-      sources."chardet-0.7.0"
-      sources."clean-stack-3.0.1"
-      sources."cli-cursor-3.1.0"
-      sources."cli-progress-3.12.0"
-      (sources."cli-ux-5.6.7" // {
-        dependencies = [
-          sources."supports-color-8.1.1"
-        ];
-      })
-      sources."cli-width-3.0.0"
-      sources."color-convert-2.0.1"
-      sources."color-name-1.1.4"
-      (sources."conf-6.2.4" // {
-        dependencies = [
-          sources."semver-6.3.1"
-        ];
-      })
-      sources."cross-spawn-7.0.3"
-      sources."d-1.0.2"
-      sources."debounce-fn-3.0.1"
-      sources."debug-4.3.7"
-      sources."define-data-property-1.1.4"
-      sources."dir-glob-3.0.1"
-      sources."dot-prop-5.3.0"
-      sources."dotenv-8.6.0"
-      sources."emoji-regex-8.0.0"
-      sources."env-paths-2.2.1"
-      sources."es-define-property-1.0.0"
-      sources."es-errors-1.3.0"
-      sources."es5-ext-0.10.64"
-      sources."es6-iterator-2.0.3"
-      sources."es6-symbol-3.1.4"
-      sources."escape-string-regexp-4.0.0"
-      sources."esniff-2.0.1"
-      sources."esprima-4.0.1"
-      sources."event-emitter-0.3.5"
-      sources."ext-1.7.0"
-      sources."external-editor-3.1.0"
-      sources."extract-stack-2.0.0"
-      sources."fast-deep-equal-3.1.3"
-      sources."fast-glob-3.3.2"
-      sources."fast-json-stable-stringify-2.1.0"
-      sources."fastq-1.17.1"
-      (sources."figures-3.2.0" // {
-        dependencies = [
-          sources."escape-string-regexp-1.0.5"
-        ];
-      })
-      sources."fill-range-7.1.1"
-      sources."find-up-3.0.0"
-      sources."follow-redirects-1.15.9"
-      sources."fs-extra-8.1.0"
-      sources."function-bind-1.1.2"
-      sources."get-intrinsic-1.2.4"
-      sources."glob-parent-5.1.2"
-      sources."globby-11.1.0"
-      sources."gopd-1.0.1"
-      sources."graceful-fs-4.2.11"
-      sources."has-flag-4.0.0"
-      sources."has-property-descriptors-1.0.2"
-      sources."has-proto-1.0.3"
-      sources."has-symbols-1.0.3"
-      sources."hasown-2.0.2"
-      sources."hyperlinker-1.0.0"
-      sources."iconv-lite-0.4.24"
-      sources."ignore-5.3.2"
-      sources."imurmurhash-0.1.4"
-      sources."indent-string-4.0.0"
-      sources."inquirer-7.3.3"
-      sources."is-docker-2.2.1"
-      sources."is-extglob-2.1.1"
-      sources."is-fullwidth-code-point-3.0.0"
-      sources."is-glob-4.0.3"
-      sources."is-number-7.0.0"
-      sources."is-obj-2.0.0"
-      sources."is-typedarray-1.0.0"
-      sources."is-wsl-2.2.0"
-      sources."isexe-2.0.0"
-      sources."js-base64-2.6.3"
-      sources."js-yaml-3.14.1"
-      sources."json-schema-traverse-0.4.1"
-      sources."json-schema-typed-7.0.3"
-      sources."jsonfile-4.0.0"
-      sources."locate-path-3.0.0"
-      sources."lodash-4.17.21"
-      (sources."make-dir-3.1.0" // {
-        dependencies = [
-          sources."semver-6.3.1"
-        ];
-      })
-      sources."merge2-1.4.1"
-      sources."micromatch-4.0.8"
-      sources."mimic-fn-2.1.0"
-      sources."moment-2.30.1"
-      sources."ms-2.1.3"
-      sources."mute-stream-0.0.8"
-      sources."natural-orderby-2.0.3"
-      sources."next-tick-1.1.0"
-      sources."node-downloader-helper-1.0.19"
-      sources."object-inspect-1.13.2"
-      sources."object-treeify-1.1.33"
-      sources."onetime-5.1.2"
-      sources."os-tmpdir-1.0.2"
-      sources."p-limit-2.3.0"
-      sources."p-locate-3.0.0"
-      sources."p-try-2.2.0"
-      sources."password-prompt-1.1.3"
-      sources."path-exists-3.0.0"
-      sources."path-key-3.1.1"
-      sources."path-type-4.0.0"
-      sources."picomatch-2.3.1"
-      sources."pkg-up-3.1.0"
-      sources."punycode-2.3.1"
-      sources."qs-6.13.0"
-      sources."queue-microtask-1.2.3"
-      sources."redeyed-2.1.1"
-      sources."restore-cursor-3.1.0"
-      sources."reusify-1.0.4"
-      sources."run-async-2.4.1"
-      sources."run-parallel-1.2.0"
-      (sources."rxjs-6.6.7" // {
-        dependencies = [
-          sources."tslib-1.14.1"
-        ];
-      })
-      sources."safer-buffer-2.1.2"
-      sources."semver-7.6.3"
-      sources."set-function-length-1.2.2"
-      sources."shebang-command-2.0.0"
-      sources."shebang-regex-3.0.0"
-      sources."side-channel-1.0.6"
-      sources."signal-exit-3.0.7"
-      sources."slash-3.0.0"
-      sources."sprintf-js-1.0.3"
-      sources."string-width-4.2.3"
-      sources."strip-ansi-6.0.1"
-      sources."supports-color-7.2.0"
-      sources."supports-hyperlinks-2.3.0"
-      sources."through-2.3.8"
-      sources."tmp-0.0.33"
-      sources."to-regex-range-5.0.1"
-      sources."tslib-2.7.0"
-      sources."type-2.7.3"
-      sources."type-fest-0.21.3"
-      sources."typedarray-to-buffer-3.1.5"
-      sources."universalify-0.1.2"
-      sources."uri-js-4.4.1"
-      sources."urijs-1.19.11"
-      sources."which-2.0.2"
-      sources."widest-line-3.1.0"
-      sources."wrap-ansi-7.0.0"
-      sources."write-file-atomic-3.0.3"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "CLI tools for Put.io";
-      homepage = "https://github.com/davidchalifoux/kaput-cli";
-      license = "MIT";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
   katex = nodeEnv.buildNodePackage {
     name = "katex";
     packageName = "katex";
diff --git a/pkgs/development/ocaml-modules/ocamlformat/generic.nix b/pkgs/development/ocaml-modules/ocamlformat/generic.nix
index d9dfd6dc1b1ee..6e6f39630239d 100644
--- a/pkgs/development/ocaml-modules/ocamlformat/generic.nix
+++ b/pkgs/development/ocaml-modules/ocamlformat/generic.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, version ? "0.26.2", astring, base, camlp-streams, cmdliner_1_0
+{ lib, fetchurl, version ? "0.27.0", astring, base, camlp-streams, cmdliner_1_0
 , cmdliner_1_1, csexp, dune-build-info, either, fix, fpath, menhirLib, menhirSdk
 , ocaml-version, ocp-indent, odoc-parser, result, stdio, uuseg, uutf
 , janeStreet_0_15, ... }:
@@ -26,6 +26,7 @@ rec {
       "0.26.0" = "sha256-AxSUq3cM7xCo9qocvrVmDkbDqmwM1FexEP7IWadeh30=";
       "0.26.1" = "sha256-2gBuQn8VuexhL7gI1EZZm9m3w+4lq+s9VVdHpw10xtc=";
       "0.26.2" = "sha256-Lk9Za/eqNnqET+g7oPawvxSyplF53cCCNj/peT0DdcU=";
+      "0.27.0" = "sha256-3b9ITAdtCPmUAO6Et5DsIx9cj8vV0zJKZADVOI6EbRU=";
     }."${version}";
   };
 
diff --git a/pkgs/development/python-modules/adafruit-board-toolkit/default.nix b/pkgs/development/python-modules/adafruit-board-toolkit/default.nix
new file mode 100644
index 0000000000000..a719881b9d135
--- /dev/null
+++ b/pkgs/development/python-modules/adafruit-board-toolkit/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pythonOlder,
+  # build-system
+  setuptools-scm,
+  # dependencies
+  pyserial,
+}:
+
+buildPythonPackage rec {
+  pname = "adafruit-board-toolkit";
+  version = "1.1.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-k8TwmztGnCqS6F5ZrXSBnefZzc2kvuUqYxGAejRAdsI=";
+  };
+
+  # Project has not published tests yet
+  doCheck = false;
+
+  build-system = [
+    setuptools-scm
+  ];
+
+  dependencies = [
+    pyserial
+  ];
+  pythonImportsCheck = [ "adafruit_board_toolkit" ];
+  meta = {
+    description = "CircuitPython board identification and information";
+    homepage = "https://github.com/adafruit/Adafruit_Board_Toolkit";
+    changelog = "https://github.com/adafruit/Adafruit_Board_Toolkit/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ talhaHavadar ];
+  };
+}
diff --git a/pkgs/development/python-modules/jupyterlab-server/default.nix b/pkgs/development/python-modules/jupyterlab-server/default.nix
index 2461e5ea0de34..357b2b2925950 100644
--- a/pkgs/development/python-modules/jupyterlab-server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-server/default.nix
@@ -79,16 +79,15 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [
     "jupyterlab_server"
-    "jupyterlab_server.pytest_plugin"
   ];
 
   __darwinAllowLocalNetworking = true;
 
-  meta = with lib; {
+  meta = {
     description = "Set of server components for JupyterLab and JupyterLab like applications";
     homepage = "https://github.com/jupyterlab/jupyterlab_server";
     changelog = "https://github.com/jupyterlab/jupyterlab_server/blob/v${version}/CHANGELOG.md";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
     maintainers = lib.teams.jupyter.members;
   };
 }
diff --git a/pkgs/development/python-modules/latex2pydata/default.nix b/pkgs/development/python-modules/latex2pydata/default.nix
index 80005a173af04..e4bbd47c0eb03 100644
--- a/pkgs/development/python-modules/latex2pydata/default.nix
+++ b/pkgs/development/python-modules/latex2pydata/default.nix
@@ -1,18 +1,19 @@
-{ lib
-, fetchPypi
-, buildPythonPackage
-, setuptools
-, pytestCheckHook
+{
+  lib,
+  fetchPypi,
+  buildPythonPackage,
+  setuptools,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "latex2pydata";
-  version = "0.4.0";
+  version = "0.4.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ega1cHSP187njyelb0yiCdpk08QZyObelRa2S79AE1E=";
+    hash = "sha256-9MsAwzP8j52mh+azaEkfkaLmDOBWZoVnr9LnGSvK3mk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/lottie/default.nix b/pkgs/development/python-modules/lottie/default.nix
index a1ced236e8c8f..91f375d664e36 100644
--- a/pkgs/development/python-modules/lottie/default.nix
+++ b/pkgs/development/python-modules/lottie/default.nix
@@ -7,12 +7,12 @@
 }:
 buildPythonPackage rec {
   pname = "lottie";
-  version = "0.7.0";
+  version = "0.7.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-oyQvi6NwUfvddQPs0WggOgjkrybxe+LsygimSvHn08E=";
+    hash = "sha256-If05yOaLsfBDvVxmnDxgxwqc3lkCjTW8YV3e+S9CU2o=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/recipe-scrapers/default.nix b/pkgs/development/python-modules/recipe-scrapers/default.nix
index eba4cd32df881..de3f12e7680b4 100644
--- a/pkgs/development/python-modules/recipe-scrapers/default.nix
+++ b/pkgs/development/python-modules/recipe-scrapers/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "recipe-scrapers";
-  version = "15.2.1";
+  version = "15.3.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "hhursev";
     repo = "recipe-scrapers";
     rev = "refs/tags/${version}";
-    hash = "sha256-2rwy7tfTKaUmPJv59WMVGAOUP+vGWquJbF/3BbS3kkA=";
+    hash = "sha256-Q3pbvLbSpV1DOUGSGydgmGOCGrlfGKVENneC6iuVNxs=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/voip-utils/default.nix b/pkgs/development/python-modules/voip-utils/default.nix
index 04e0eb2ede826..6cf7ebb9375df 100644
--- a/pkgs/development/python-modules/voip-utils/default.nix
+++ b/pkgs/development/python-modules/voip-utils/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "voip-utils";
-  version = "0.2.0";
+  version = "0.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "voip-utils";
-    rev = "refs/tags/${version}";
-    hash = "sha256-/DBBTL+t0VQJL43HgXGdhMHMKr8uBEkJ7Mf7Xp1mwhU=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ONvbkYP1hGMYOVZs5gvs/cr+Tde9gT3jloP6veqE/Ac=";
   };
 
   postPatch = ''
@@ -34,9 +34,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  # no tests as of v0.1.0
-  doCheck = false;
-
   meta = {
     changelog = "https://github.com/home-assistant-libs/voip-utils/blob/${src.rev}/CHANGELOG.md";
     description = "Voice over IP Utilities";
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index f4eda83e6f643..47a8ac0151a89 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -5,16 +5,16 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.11.5"; #zen
+      version = "6.12.1"; #zen
       suffix = "zen1"; #zen
-      sha256 = "1w342k54ns6rwkk13l9f7h0qzikn6hbnb2ydxyqalrmll8n2g237"; #zen
+      sha256 = "18aws41zlayv4xd6489jzrhr8b3kwmrx2q1b50g67v4rsp02sb4p"; #zen
       isLqx = false;
     };
     # ./update-zen.py lqx
     lqx = {
-      version = "6.11.5"; #lqx
+      version = "6.12.1"; #lqx
       suffix = "lqx1"; #lqx
-      sha256 = "0ql7nw6sph4ai44n66c7l06aj4ibhdy45415yzgibin1jg9rqa6d"; #lqx
+      sha256 = "1q8rdghkgq0kn530pxncwsrfqlf3xfn4mdvxysdizyfn71vmrz8f"; #lqx
       isLqx = true;
     };
   };
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 818b834349af8..f1fa3e4920cc2 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -360,6 +360,8 @@ let
           rev = "refs/tags/v${version}";
           hash = "sha256-PG4L6KphH9JIZO76cCN8eClFE2CneEIExlXS+x79k3U=";
         };
+        # tests were not implemented until version 0.2.0
+        doCheck = false;
       });
 
       vulcan-api = super.vulcan-api.overridePythonAttrs (oldAttrs: rec {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 35dc2bf8a77a3..61f8f88d0745d 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1199,6 +1199,7 @@ mapAliases {
   steam-small = steam; # Added 2024-09-12
   steam-run-native = steam-run; # added 2022-02-21
   StormLib = stormlib; # Added 2024-01-21
+  strawberry-qt5 = throw "strawberry-qt5 has been replaced by strawberry-qt6"; # Added 2024-11-22
   sumneko-lua-language-server = lua-language-server; # Added 2023-02-07
   sumokoin = throw "sumokoin has been removed as it was abandoned upstream"; # Added 2024-11-23
   swiProlog = lib.warnOnInstantiate "swiProlog has been renamed to swi-prolog" swi-prolog; # Added 2024-09-07
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fb7d56216dbff..f7c3a0a6b7b08 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3235,11 +3235,9 @@ with pkgs;
 
   sonobuoy = callPackage ../applications/networking/cluster/sonobuoy { };
 
-  strawberry-qt5 = libsForQt5.callPackage ../applications/audio/strawberry { };
-
   strawberry-qt6 = qt6Packages.callPackage ../applications/audio/strawberry { };
 
-  strawberry = strawberry-qt5;
+  strawberry = strawberry-qt6;
 
   schleuder = callPackage ../tools/security/schleuder { };
 
@@ -6789,7 +6787,7 @@ with pkgs;
 
   inherit (ocamlPackages)
     ocamlformat # latest version
-    ocamlformat_0_26_2;
+    ocamlformat_0_26_2 ocamlformat_0_27_0;
 
   inherit (ocamlPackages) odig;
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 35cb14aff5350..5691515d8ba56 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1339,6 +1339,7 @@ let
     ocamlformat_0_26_0 = ocamlformat.override { version = "0.26.0"; };
     ocamlformat_0_26_1 = ocamlformat.override { version = "0.26.1"; };
     ocamlformat_0_26_2 = ocamlformat.override { version = "0.26.2"; };
+    ocamlformat_0_27_0 = ocamlformat.override { version = "0.27.0"; };
 
     ocamlformat = callPackage ../development/ocaml-modules/ocamlformat/ocamlformat.nix {};
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e97f3474650cb..31b7a56714c29 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -55,6 +55,8 @@ self: super: with self; {
 
   adafruit-io = callPackage ../development/python-modules/adafruit-io { };
 
+  adafruit-board-toolkit = callPackage ../development/python-modules/adafruit-board-toolkit { };
+
   adafruit-platformdetect = callPackage ../development/python-modules/adafruit-platformdetect { };
 
   adafruit-pureio = callPackage ../development/python-modules/adafruit-pureio { };