diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 684986d9a7c7..f6eef7ecf70a 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1289,6 +1289,12 @@
     name = "Alexandru Tocar";
     keys = [ { fingerprint = "B617 DD24 3AB0 2E3F 2E67  DBFD 1305 2A85 D7A4 2AA4"; } ];
   };
+  AlexAntonik = {
+    email = "antonikavv@gmail.com";
+    github = "AlexAntonik";
+    githubId = 55547934;
+    name = "Alex Antonik";
+  };
   alexarice = {
     email = "alexrice999@hotmail.co.uk";
     github = "alexarice";
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index d9de29b0c06e..15365b49c57e 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -99,6 +99,8 @@
 
 - `services.plantuml-server.packages.jetty` now supports `jetty_12`, it no longer supports `jetty_11`.
 
+- `services.komodo-periphery` has been updated to support version 2.0.0. Some options have been renamed to match the new configuration structure; compatibility aliases are provided for the renamed options. The `passkeys` and `outbound.onboardingKey` options have been removed; use `passkeyFiles`, `auth.privateKey`/`auth.corePublicKeys`, or `outbound.onboardingKeyFile` instead. New outbound mode configuration is available under `outbound.*`.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/services/admin/komodo-periphery.nix b/nixos/modules/services/admin/komodo-periphery.nix
index 5b7643baeea6..d4b0426903da 100644
--- a/nixos/modules/services/admin/komodo-periphery.nix
+++ b/nixos/modules/services/admin/komodo-periphery.nix
@@ -8,41 +8,65 @@ let
   cfg = config.services.komodo-periphery;
   settingsFormat = pkgs.formats.toml { };
 
+  actualRepoDir = if cfg.repoDir != null then cfg.repoDir else "${cfg.rootDirectory}/repos";
+  actualStackDir = if cfg.stackDir != null then cfg.stackDir else "${cfg.rootDirectory}/stacks";
+  actualBuildDir = if cfg.buildDir != null then cfg.buildDir else "${cfg.rootDirectory}/builds";
+
   genFinalSettings =
     let
+      actualServerEnabled =
+        if cfg.inbound.serverEnabled != null then
+          cfg.inbound.serverEnabled
+        else
+          (cfg.outbound.coreAddress == "");
+
+      hasAnyPrivateKey = cfg.auth.privateKey != "";
+
       baseSettings = {
-        port = cfg.port;
-        bind_ip = cfg.bindIp;
-        root_directory = cfg.rootDirectory;
-        repo_dir = "${cfg.rootDirectory}/repos";
-        stack_dir = "${cfg.rootDirectory}/stacks";
-        ssl_enabled = cfg.ssl.enable;
+        default_terminal_command = cfg.defaultTerminalCommand;
+        disable_terminals = cfg.disableTerminals;
+        disable_container_terminals = cfg.disableContainerTerminals;
+
+        stats_polling_rate = cfg.statsPollingRate;
+        container_stats_polling_rate = cfg.containerStatsPollingRate;
+        legacy_compose_cli = cfg.legacyComposeCli;
+
+        include_disk_mounts = cfg.includeDiskMounts;
+        exclude_disk_mounts = cfg.excludeDiskMounts;
+
+        # When a private key is explicitly configured, it's passed via env var.
+        # Otherwise, use the default file path so Periphery auto-generates a key.
+        private_key = if !hasAnyPrivateKey then "file:${cfg.rootDirectory}/keys/periphery.key" else "";
+        core_public_keys = [ ];
+        passkeys = [ ];
+
+        server_enabled = actualServerEnabled;
+        port = cfg.inbound.port;
+        bind_ip = cfg.inbound.bindIp;
+        allowed_ips = cfg.inbound.allowedIps;
+        ssl_enabled = cfg.inbound.ssl.enable;
       }
-      // lib.optionalAttrs cfg.ssl.enable {
-        ssl_key_file = cfg.ssl.keyFile;
-        ssl_cert_file = cfg.ssl.certFile;
+      // {
+        core_address = cfg.outbound.coreAddress;
+        connect_as = cfg.outbound.connectAs;
+        onboarding_key = "";
       }
       // {
         logging = {
           level = cfg.logging.level;
           stdio = cfg.logging.stdio;
+          opentelemetry_service_name = cfg.logging.opentelemetryServiceName;
+          opentelemetry_scope_name = cfg.logging.opentelemetryScopeName;
+          pretty = cfg.logging.pretty;
         }
         // lib.optionalAttrs (cfg.logging.otlpEndpoint != "") {
           otlp_endpoint = cfg.logging.otlpEndpoint;
         };
-        allowed_ips = cfg.allowedIps;
-        passkeys = cfg.passkeys;
-        disable_terminals = cfg.disableTerminals;
-        disable_container_exec = cfg.disableContainerExec;
-        stats_polling_rate = cfg.statsPollingRate;
-        container_stats_polling_rate = cfg.containerStatsPollingRate;
-        legacy_compose_cli = cfg.legacyComposeCli;
-        include_disk_mounts = cfg.includeDiskMounts;
-        exclude_disk_mounts = cfg.excludeDiskMounts;
+        pretty_startup_config = cfg.prettyStartupConfig;
       }
       // cfg.extraSettings;
     in
-    lib.filterAttrsRecursive (_: v: v != null && v != { } && v != [ ]) baseSettings;
+    lib.filterAttrsRecursive (_: v: v != null && v != { } && v != [ ] && v != "") baseSettings;
 
   configFile =
     if cfg.configFile == null then
@@ -51,36 +75,98 @@ let
       cfg.configFile;
 in
 {
+  imports = with lib; [
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "port" ]
+      [ "services" "komodo-periphery" "inbound" "port" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "bindIp" ]
+      [ "services" "komodo-periphery" "inbound" "bindIp" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "allowedIps" ]
+      [ "services" "komodo-periphery" "inbound" "allowedIps" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "ssl" "enable" ]
+      [ "services" "komodo-periphery" "inbound" "ssl" "enable" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "ssl" "keyFile" ]
+      [ "services" "komodo-periphery" "inbound" "ssl" "keyFile" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "ssl" "certFile" ]
+      [ "services" "komodo-periphery" "inbound" "ssl" "certFile" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "serverEnabled" ]
+      [ "services" "komodo-periphery" "inbound" "serverEnabled" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "komodo-periphery" "disableContainerExec" ]
+      [ "services" "komodo-periphery" "disableContainerTerminals" ]
+    )
+    (mkRemovedOptionModule [ "services" "komodo-periphery" "passkeys" ]
+      "services.komodo-periphery.passkeys has been removed. Use passkeyFiles for v1.X compatibility, or migrate to auth.privateKey and auth.corePublicKeys (v2.0+)."
+    )
+    (mkRemovedOptionModule [ "services" "komodo-periphery" "outbound" "onboardingKey" ]
+      "services.komodo-periphery.outbound.onboardingKey has been removed. Use outbound.onboardingKeyFile instead for better security."
+    )
+  ];
+
   options.services.komodo-periphery = {
     enable = lib.mkEnableOption "Periphery, a multi-server Docker and Git deployment agent by Komodo";
 
     package = lib.mkPackageOption pkgs "komodo" { };
 
-    configFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
+    dockerHost = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
-      description = "Path to the periphery configuration file. If null, a configuration file will be generated from the module options.";
+      description = ''
+        Docker host socket URI to use for container operations.
+        If null, uses the default Docker socket and automatically enables Docker.
+        Set this to use alternative container runtimes like Podman or remote Docker hosts.
+      '';
       example = lib.literalExpression ''
-        pkgs.writeText "periphery.toml" '''
-          port = 8120
-          bind_ip = "[::]"
-          ssl_enabled = true
-          [logging]
-          level = "info"
-        '''
+        # Podman rootless
+        "unix:///run/user/1000/podman/podman.sock"
+
+        # Podman rootful
+        "unix:///run/podman/podman.sock"
+
+        # Remote Docker
+        "tcp://192.168.1.100:2375"
       '';
     };
 
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 8120;
-      description = "Port for the Periphery agent to listen on.";
-    };
+    configFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to the Periphery configuration file.
 
-    bindIp = lib.mkOption {
-      type = lib.types.str;
-      default = "[::]";
-      description = "IP address to bind to.";
+        - If `null` (default), a configuration file will be automatically generated
+          from the module options (recommended for most users).
+        - If set to a path, that file will be used directly as the configuration file.
+        - You can also use `pkgs.writeText` to write configuration inline in your NixOS configuration.
+
+        When using a custom config file, all other module options (except `package`, `user`, `group`,
+        `environment`, and `environmentFile`) will be ignored.
+      '';
+      example = lib.literalExpression ''
+        # Option 1: Use an existing config file
+        "/etc/komodo/periphery.toml"
+
+        # Option 2: Write config inline using pkgs.writeText
+        pkgs.writeText "periphery.toml" '''
+          root_directory = "/var/lib/komodo-periphery"
+
+          logging.level = "info"
+          logging.stdio = "standard"
+        '''
+      '';
     };
 
     rootDirectory = lib.mkOption {
@@ -89,24 +175,25 @@ in
       description = "Root directory for Komodo Periphery data.";
     };
 
-    ssl = {
-      enable = lib.mkEnableOption "SSL/TLS support" // {
-        default = true;
-      };
+    repoDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/repos"'';
+      description = "Directory for Komodo Periphery to manage repos. If null, defaults to `\${rootDirectory}/repos`.";
+    };
 
-      keyFile = lib.mkOption {
-        type = lib.types.path;
-        default = "${cfg.rootDirectory}/ssl/key.pem";
-        defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/key.pem"'';
-        description = "Path to SSL key file.";
-      };
+    stackDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/stacks"'';
+      description = "Directory for Komodo Periphery to manage stacks. If null, defaults to `\${rootDirectory}/stacks`.";
+    };
 
-      certFile = lib.mkOption {
-        type = lib.types.path;
-        default = "${cfg.rootDirectory}/ssl/cert.pem";
-        defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/cert.pem"'';
-        description = "Path to SSL certificate file.";
-      };
+    buildDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/builds"'';
+      description = "Directory for Komodo Periphery to manage builds. If null, defaults to `\${rootDirectory}/builds`.";
     };
 
     logging = {
@@ -139,26 +226,41 @@ in
         description = "OpenTelemetry OTLP endpoint for traces.";
         example = "http://localhost:4317";
       };
+
+      opentelemetryServiceName = lib.mkOption {
+        type = lib.types.str;
+        default = "Periphery";
+        description = "(v2.0+) OpenTelemetry service name attached to telemetry.";
+      };
+
+      opentelemetryScopeName = lib.mkOption {
+        type = lib.types.str;
+        default = "Komodo";
+        description = "(v2.0+) OpenTelemetry scope name attached to telemetry.";
+      };
+
+      pretty = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "(v2.0+) Enable human-readable logging (multi-line).";
+      };
     };
 
-    allowedIps = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      description = "IP addresses or subnets allowed to call the periphery API. Empty list allows all.";
-      example = [
-        "::ffff:12.34.56.78"
-        "10.0.10.0/24"
-      ];
+    prettyStartupConfig = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "(v2.0+) Enable human-readable startup config log (multi-line).";
     };
 
-    passkeys = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
+    passkeyFiles = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
       description = ''
-        Passkeys required to access the periphery API.
-        WARNING: These will be stored in the Nix store in plain text!
+        Path to file containing passkeys (v1.X compatibility).
+        This will be passed via `PERIPHERY_PASSKEYS_FILE` environment variable.
+        Consider migrating to the new v2.0+ authentication mechanism.
       '';
-      example = [ "your-secure-passkey" ];
+      example = "/run/secrets/komodo-passkey";
     };
 
     extraSettings = lib.mkOption {
@@ -170,16 +272,23 @@ in
       };
     };
 
+    defaultTerminalCommand = lib.mkOption {
+      type = lib.types.str;
+      default = "bash";
+      description = "(v2.0+) Default terminal command used to initialize the shell.";
+      example = "zsh";
+    };
+
     disableTerminals = lib.mkOption {
       type = lib.types.bool;
       default = false;
       description = "Disable remote shell access through Periphery.";
     };
 
-    disableContainerExec = lib.mkOption {
+    disableContainerTerminals = lib.mkOption {
       type = lib.types.bool;
       default = false;
-      description = "Disable remote container shell access through Periphery.";
+      description = "(v2.0+) Disable remote container shell access through Periphery.";
     };
 
     statsPollingRate = lib.mkOption {
@@ -222,6 +331,147 @@ in
       ];
     };
 
+    auth = {
+      privateKey = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          (v2.0+) Private key used with the Noise handshake.
+
+          Use `file:/path/to/file` prefix to load from a file. If the file doesn't exist,
+          Periphery will generate and write a new key to the path.
+
+          If empty, defaults to `file:''${rootDirectory}/keys/periphery.key`.
+        '';
+        example = lib.literalExpression ''
+          # Reference a secret file
+          "file:''${config.age.secrets.komodo-private-key.path}"
+
+          # Or direct path
+          "file:/run/secrets/komodo-private-key"
+        '';
+      };
+
+      corePublicKeys = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = ''
+          (v2.0+) Accepted public keys to allow Core(s) to connect.
+          Accepts Spki base64 DER directly or can reference files using `file:/path/to/core.pub` prefix.
+          You can mix direct keys and file references.
+
+          For better security, use the `file:` prefix to reference secret files.
+        '';
+        example = lib.literalExpression ''
+          [
+            # Direct key value
+            "MCowBQYDK2VuAyEATZgrjGHeF0KJUe0+n77+qAWOg3YzEzXOmQWaRgO3OGQ="
+            # Reference secret files
+            "file:''${config.age.secrets.komodo-core1-pub.path}"
+            "file:''${config.age.secrets.komodo-core2-pub.path}"
+          ]
+        '';
+      };
+    };
+
+    inbound = {
+      serverEnabled = lib.mkOption {
+        type = lib.types.nullOr lib.types.bool;
+        default = null;
+        description = ''
+          Enable the inbound connection server for Core -> Periphery connections.
+          If null, defaults to false when `outbound.coreAddress` is defined, otherwise true.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 8120;
+        description = "Port for the inbound Periphery server to listen on.";
+      };
+
+      bindIp = lib.mkOption {
+        type = lib.types.str;
+        default = "[::]";
+        description = ''
+          IP address the periphery server will bind to.
+          The default allows external IPv4 and IPv6 connections.
+        '';
+      };
+
+      allowedIps = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = ''
+          Limit the IP addresses which can connect to Periphery.
+          Supports IPv4/IPv6 addresses and subnets.
+          Empty list allows all connections.
+        '';
+        example = [
+          "::ffff:12.34.56.78"
+          "10.0.10.0/24"
+        ];
+      };
+
+      ssl = {
+        enable = lib.mkEnableOption "(v2.0+) SSL/TLS support for inbound connections" // {
+          default = true;
+        };
+
+        keyFile = lib.mkOption {
+          type = lib.types.path;
+          default = "${cfg.rootDirectory}/ssl/key.pem";
+          defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/key.pem"'';
+          description = ''
+            Path to SSL key file.
+            If the file doesn't exist and SSL is enabled, self-signed keys will be generated using openssl.
+          '';
+        };
+
+        certFile = lib.mkOption {
+          type = lib.types.path;
+          default = "${cfg.rootDirectory}/ssl/cert.pem";
+          defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/cert.pem"'';
+          description = ''
+            Path to SSL certificate file.
+            If the file doesn't exist and SSL is enabled, self-signed certificate will be generated using openssl.
+          '';
+        };
+      };
+    };
+
+    outbound = {
+      coreAddress = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          (v2.0+) The address of Komodo Core. Must be reachable from this host.
+          If provided, Periphery will operate in outbound mode.
+        '';
+        example = "demo.komo.do";
+      };
+
+      connectAs = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          (v2.0+) The Server this Periphery agent should connect as.
+          Must match an existing Server name or id.
+        '';
+        example = "server-name";
+      };
+
+      onboardingKeyFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = ''
+          (v2.0+) Path to file containing the onboarding key.
+          This will be passed via `PERIPHERY_ONBOARDING_KEY_FILE` environment variable.
+        '';
+        example = lib.literalExpression ''"''${config.age.secrets.komodo-onboarding.path}"'';
+      };
+    };
+
     user = lib.mkOption {
       type = lib.types.str;
       default = "komodo-periphery";
@@ -253,14 +503,14 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    virtualisation.docker.enable = true;
+    virtualisation.docker.enable = lib.mkDefault (cfg.dockerHost == null);
 
     users.users.${cfg.user} = lib.mkIf (cfg.user == "komodo-periphery") {
       isSystemUser = true;
       group = cfg.group;
       description = "Komodo Periphery service user";
       home = cfg.rootDirectory;
-      extraGroups = [ "docker" ];
+      extraGroups = lib.optional (cfg.dockerHost == null) "docker";
     };
 
     users.groups.${cfg.group} = lib.mkIf (cfg.group == "komodo-periphery") { };
@@ -271,16 +521,26 @@ in
         user = cfg.user;
         group = cfg.group;
       };
-      "${cfg.rootDirectory}/repos".d = {
+      "${actualRepoDir}".d = {
         mode = "0755";
         user = cfg.user;
         group = cfg.group;
       };
-      "${cfg.rootDirectory}/stacks".d = {
+      "${actualStackDir}".d = {
         mode = "0755";
         user = cfg.user;
         group = cfg.group;
       };
+      "${actualBuildDir}".d = {
+        mode = "0755";
+        user = cfg.user;
+        group = cfg.group;
+      };
+      "${cfg.rootDirectory}/keys".d = {
+        mode = "0700";
+        user = cfg.user;
+        group = cfg.group;
+      };
       "${cfg.rootDirectory}/ssl".d = {
         mode = "0700";
         user = cfg.user;
@@ -292,35 +552,63 @@ in
       description = "Komodo Periphery - Multi-server Docker and Git deployment agent";
       after = [
         "network-online.target"
-        "docker.service"
-      ];
+      ]
+      ++ lib.optional (cfg.dockerHost == null) "docker.service";
       wants = [
         "network-online.target"
-        "docker.service"
-      ];
+      ]
+      ++ lib.optional (cfg.dockerHost == null) "docker.service";
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
         Type = "simple";
         User = cfg.user;
         Group = cfg.group;
-        SupplementaryGroups = [ "docker" ];
+        SupplementaryGroups = lib.mkIf (cfg.dockerHost == null) [ "docker" ];
         Restart = "on-failure";
         RestartSec = "10s";
         WorkingDirectory = cfg.rootDirectory;
 
         ExecStart = lib.escapeShellArgs [
-          "${lib.getExe' cfg.package "periphery"}"
+          (lib.getExe' cfg.package "periphery")
           "--config-path"
-          (if cfg.configFile != null then cfg.configFile else configFile)
+          configFile
         ];
 
         Environment = lib.mapAttrsToList (name: value: "${name}=${value}") (
-          cfg.environment
-          // lib.optionalAttrs (!cfg.disableTerminals) {
-            PATH = "/run/current-system/sw/bin:/run/wrappers/bin";
+          lib.optionalAttrs (cfg.configFile == null) {
+            PERIPHERY_ROOT_DIRECTORY = cfg.rootDirectory;
+            PERIPHERY_REPO_DIR = actualRepoDir;
+            PERIPHERY_STACK_DIR = actualStackDir;
+            PERIPHERY_BUILD_DIR = actualBuildDir;
           }
+          // lib.optionalAttrs (cfg.configFile == null && cfg.inbound.ssl.enable) {
+            PERIPHERY_SSL_KEY_FILE = cfg.inbound.ssl.keyFile;
+            PERIPHERY_SSL_CERT_FILE = cfg.inbound.ssl.certFile;
+          }
+          // lib.optionalAttrs (cfg.dockerHost != null) {
+            DOCKER_HOST = cfg.dockerHost;
+          }
+          // lib.optionalAttrs (cfg.passkeyFiles != null) {
+            PERIPHERY_PASSKEYS_FILE = cfg.passkeyFiles;
+          }
+          // lib.optionalAttrs (cfg.auth.privateKey != "") {
+            PERIPHERY_PRIVATE_KEY = cfg.auth.privateKey;
+          }
+          // lib.optionalAttrs (cfg.auth.corePublicKeys != [ ]) {
+            PERIPHERY_CORE_PUBLIC_KEYS = lib.concatStringsSep "," cfg.auth.corePublicKeys;
+          }
+          // lib.optionalAttrs (cfg.outbound.onboardingKeyFile != null) {
+            PERIPHERY_ONBOARDING_KEY_FILE = cfg.outbound.onboardingKeyFile;
+          }
+          // cfg.environment
         );
+
+        ExecSearchPath = lib.mkIf (!cfg.disableTerminals) [
+          "/run/current-system/sw/bin"
+          "/run/wrappers/bin"
+        ];
+
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
 
         StateDirectory = "komodo-periphery";
@@ -329,7 +617,7 @@ in
         NoNewPrivileges = true;
         PrivateTmp = true;
         ProtectSystem = "full";
-        ProtectHome = true;
+        ProtectHome = "read-only";
       };
     };
   };
diff --git a/nixos/tests/komodo-periphery.nix b/nixos/tests/komodo-periphery.nix
index 64bcbfa7b6e3..e376ddee6506 100644
--- a/nixos/tests/komodo-periphery.nix
+++ b/nixos/tests/komodo-periphery.nix
@@ -5,22 +5,63 @@
     maintainers = with lib.maintainers; [ channinghe ];
   };
 
-  nodes.machine =
-    { config, pkgs, ... }:
-    {
-      virtualisation.docker.enable = true;
-      services.komodo-periphery = {
-        enable = true;
-        bindIp = "127.0.0.1";
-        port = 8120;
-        ssl.enable = false;
-        passkeys = [ "test-passkey" ];
+  nodes = {
+    periphery =
+      { ... }:
+      {
+        virtualisation.docker.enable = true;
+        services.komodo-periphery = {
+          enable = true;
+          inbound.bindIp = "127.0.0.1";
+          inbound.port = 8120;
+          inbound.ssl.enable = false;
+          inbound.serverEnabled = true;
+          disableTerminals = true;
+          disableContainerTerminals = true;
+          statsPollingRate = "10-sec";
+          containerStatsPollingRate = "1-min";
+          logging.level = "debug";
+          extraSettings = {
+            secrets.TEST_SECRET = "test-value";
+          };
+          auth.privateKey = "file:/var/lib/komodo-periphery/keys/test.key";
+          auth.corePublicKeys = [ "MCowBQYDK2VuAyEATZgrjGHeF0KJUe0+n77+qAWOg3YzEzXOmQWaRgO3OGQ=" ];
+        };
       };
-    };
+
+    peripheryOutbound =
+      { ... }:
+      {
+        virtualisation.docker.enable = true;
+        services.komodo-periphery = {
+          enable = true;
+          inbound.ssl.enable = false;
+          logging.level = "debug";
+          outbound.coreAddress = "core.invalid";
+          outbound.connectAs = "test-server";
+        };
+      };
+  };
 
   testScript = ''
-    machine.wait_for_unit("komodo-periphery.service")
-    machine.wait_for_open_port(8120)
-    machine.succeed("systemctl status komodo-periphery.service")
+    start_all()
+
+    with subtest("Inbound periphery starts and serves /version"):
+        periphery.wait_for_unit("komodo-periphery.service")
+        periphery.wait_for_open_port(8120)
+        periphery.succeed("curl -fsS --max-time 10 http://127.0.0.1:8120/version")
+
+    with subtest("Periphery creates managed directories"):
+        periphery.succeed("test -d /var/lib/komodo-periphery")
+        periphery.succeed("test -d /var/lib/komodo-periphery/repos")
+        periphery.succeed("test -d /var/lib/komodo-periphery/stacks")
+        periphery.succeed("test -d /var/lib/komodo-periphery/builds")
+        periphery.succeed("test -d /var/lib/komodo-periphery/keys")
+        periphery.succeed("test -d /var/lib/komodo-periphery/ssl")
+
+    with subtest("Outbound periphery stays active despite unreachable core"):
+        peripheryOutbound.wait_for_unit("komodo-periphery.service")
+        peripheryOutbound.sleep(15)
+        peripheryOutbound.succeed("systemctl is-active komodo-periphery")
   '';
 }
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 93e524df8ec2..eb4262845e1d 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2359,6 +2359,8 @@ let
         };
       };
 
+      inferrinizzard.prettier-sql-vscode = callPackage ./inferrinizzard.prettier-sql-vscode { };
+
       intellsmi.comment-translate = buildVscodeMarketplaceExtension {
         mktplcRef = {
           publisher = "intellsmi";
@@ -2451,6 +2453,8 @@ let
 
       jackmacwindows.craftos-pc = callPackage ./jackmacwindows.craftos-pc { };
 
+      jacobdufault.fuzzy-search = callPackage ./jacobdufault.fuzzy-search { };
+
       jakestanger.corn = callPackage ./jakestanger.corn { };
 
       james-yu.latex-workshop = callPackage ./james-yu.latex-workshop { };
@@ -3728,6 +3732,8 @@ let
 
       oxc.oxc-vscode = callPackage ./oxc.oxc-vscode { };
 
+      pflannery.vscode-versionlens = callPackage ./pflannery.vscode-versionlens { };
+
       ph-hawkins.arc-plus = callPackage ./ph-hawkins.arc-plus { };
 
       phind.phind = buildVscodeMarketplaceExtension {
@@ -3867,6 +3873,8 @@ let
         };
       };
 
+      rangav.vscode-thunder-client = callPackage ./rangav.vscode-thunder-client { };
+
       rebornix.ruby = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "ruby";
diff --git a/pkgs/applications/editors/vscode/extensions/inferrinizzard.prettier-sql-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/inferrinizzard.prettier-sql-vscode/default.nix
new file mode 100644
index 000000000000..c87dde51734a
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/inferrinizzard.prettier-sql-vscode/default.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "prettier-sql-vscode";
+    publisher = "inferrinizzard";
+    version = "1.6.0";
+    hash = "sha256-l6pf/+uv8Bn4uDMX0CbzSjydTStr73uRY550Ad9wm7Q=";
+  };
+
+  meta = {
+    description = "VSCode Extension to format SQL files";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=inferrinizzard.prettier-sql-vscode";
+    homepage = "https://github.com/sql-formatter-org/sql-formatter";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ AlexAntonik ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/jacobdufault.fuzzy-search/default.nix b/pkgs/applications/editors/vscode/extensions/jacobdufault.fuzzy-search/default.nix
new file mode 100644
index 000000000000..ca91a9ea3754
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/jacobdufault.fuzzy-search/default.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "fuzzy-search";
+    publisher = "jacobdufault";
+    version = "0.0.3";
+    hash = "sha256-oN1SzXypjpKOTUzPbLCTC+H3I/40LMVdjbW3T5gib0M=";
+  };
+
+  meta = {
+    description = "Provides a fuzzy search using the quick pick window of the current text document.";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=jacobdufault.fuzzy-search";
+    homepage = "https://github.com/jacobdufault/vscode-fuzzy-search";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ AlexAntonik ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/pflannery.vscode-versionlens/default.nix b/pkgs/applications/editors/vscode/extensions/pflannery.vscode-versionlens/default.nix
new file mode 100644
index 000000000000..e39cded3c0eb
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/pflannery.vscode-versionlens/default.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "vscode-versionlens";
+    publisher = "pflannery";
+    version = "1.28.0";
+    hash = "sha256-IZjTHE51hdrQpDndsz5bBCKre0zmWkCAJa/v8k4iLy0=";
+  };
+
+  meta = {
+    description = "Shows the latest version for each package using code lens";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=pflannery.vscode-versionlens";
+    homepage = "https://gitlab.com/versionlens/vscode-versionlens";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ AlexAntonik ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/rangav.vscode-thunder-client/default.nix b/pkgs/applications/editors/vscode/extensions/rangav.vscode-thunder-client/default.nix
new file mode 100644
index 000000000000..53033e8dee08
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/rangav.vscode-thunder-client/default.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "vscode-thunder-client";
+    publisher = "rangav";
+    version = "2.41.0";
+    hash = "sha256-c5oEaRMeTEWT0dtd6bzWMumhTEchOsLDXp+D76orL+k=";
+  };
+
+  meta = {
+    description = "Lightweight Rest API Client for VS Code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=rangav.vscode-thunder-client";
+    homepage = "https://github.com/thunderclient/thunder-client-support";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ AlexAntonik ];
+  };
+}
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
index 41606db701de..ac579479844a 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
@@ -1,5 +1,4 @@
 {
-  stdenv,
   lib,
   callPackage,
   fetchurl,
@@ -22,9 +21,6 @@ buildMozillaMach rec {
     homepage = "http://www.mozilla.com/en-US/firefox/";
     maintainers = with lib.maintainers; [ hexa ];
     platforms = lib.platforms.unix;
-    broken = stdenv.buildPlatform.is32bit;
-    # since Firefox 60, build on 32-bit platforms fails with "out of memory".
-    # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
     maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
     license = lib.licenses.mpl20;
     mainProgram = "firefox";
diff --git a/pkgs/applications/video/obs-studio/plugins/droidcam-obs/default.nix b/pkgs/applications/video/obs-studio/plugins/droidcam-obs/default.nix
index d296352940d5..0f5090b0bed9 100644
--- a/pkgs/applications/video/obs-studio/plugins/droidcam-obs/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/droidcam-obs/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   obs-studio,
   ffmpeg,
   libjpeg,
@@ -13,24 +12,15 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "droidcam-obs";
-  version = "2.4.1";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "dev47apps";
     repo = "droidcam-obs-plugin";
     tag = finalAttrs.version;
-    sha256 = "sha256-hxG/v15Q4D+6LU4BNV6ErSa1WvPk4kMPl07pIqiMcc4=";
+    hash = "sha256-JPAQoGZFzTIdBQ7GpCPaYUVPkkcBdCRFkVPU+nyRa7Q=";
   };
 
-  patches = [
-    # Fix build with ffmpeg 8 / libavcodec 62
-    # TODO: Drop this once v2.4.3+ is released
-    (fetchpatch {
-      url = "https://github.com/dev47apps/droidcam-obs-plugin/commit/73ec2a01e234e6b2287866c25b4242dca6d9d2f6.patch";
-      hash = "sha256-AI2Z9i3+KfvmpyVX9WwX3jcA1hyUZiFO7kWRsb+8/10=";
-    })
-  ];
-
   preBuild = ''
     mkdir ./build
   '';
diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index 58f3f6000a56..09eef8b2496f 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -145,7 +145,13 @@ in
   ),
   overrideCC,
   buildPackages,
-  pgoSupport ? (stdenv.hostPlatform.isLinux && stdenv.hostPlatform == stdenv.buildPlatform),
+  # PGO merges profile data with a 32-bit llvm-profdata, which runs out of
+  # address space on the huge libxul profile, so disable it on 32-bit.
+  pgoSupport ? (
+    stdenv.hostPlatform.isLinux
+    && stdenv.hostPlatform == stdenv.buildPlatform
+    && stdenv.hostPlatform.is64bit
+  ),
   xvfb-run,
   elfhackSupport ?
     isElfhackPlatform stdenv && !(stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isAarch64),
diff --git a/pkgs/by-name/do/doc2dash/package.nix b/pkgs/by-name/do/doc2dash/package.nix
new file mode 100644
index 000000000000..fb5609690a05
--- /dev/null
+++ b/pkgs/by-name/do/doc2dash/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  nix-update-script,
+}:
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "doc2dash";
+  version = "3.1.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "hynek";
+    repo = "doc2dash";
+    tag = finalAttrs.version;
+    hash = "sha256-u6K+BDc9tUxq4kCekTaqQLtNN/OLVc3rh14sVSfPtoQ=";
+  };
+
+  build-system = with python3Packages; [
+    hatchling
+    hatch-vcs
+    hatch-fancy-pypi-readme
+  ];
+
+  dependencies = with python3Packages; [
+    attrs
+    beautifulsoup4
+    click
+    rich
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytestCheckHook
+    pytest-cov-stub
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/hynek/doc2dash/releases/tag/${finalAttrs.src.tag}";
+    description = "Create docsets for Dash.app-compatible API browsers";
+    homepage = "https://doc2dash.hynek.me";
+    license = with lib.licenses; [ mit ];
+    maintainers = [ lib.maintainers.pyrox0 ];
+    mainProgram = "doc2dash";
+  };
+})
diff --git a/pkgs/by-name/ex/exfatprogs/package.nix b/pkgs/by-name/ex/exfatprogs/package.nix
index b8a13a4e687b..16d83bebb7ba 100644
--- a/pkgs/by-name/ex/exfatprogs/package.nix
+++ b/pkgs/by-name/ex/exfatprogs/package.nix
@@ -5,17 +5,18 @@
   pkg-config,
   autoreconfHook,
   file,
+  util-linux,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "exfatprogs";
-  version = "1.3.2";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "exfatprogs";
     repo = "exfatprogs";
-    rev = finalAttrs.version;
-    sha256 = "sha256-eXJg4mMYydOpYVgOup7WJze0qx6RVkia0xSZOlG+IOQ=";
+    tag = finalAttrs.version;
+    hash = "sha256-c1tdSX/xpZw56B7LPWwvKI7U6xk55lDc7D0k5FI7zwQ";
   };
 
   nativeBuildInputs = [
@@ -24,6 +25,10 @@ stdenv.mkDerivation (finalAttrs: {
     file
   ];
 
+  buildInputs = [
+    util-linux
+  ];
+
   outputs = [
     "out"
     "man"
diff --git a/pkgs/by-name/fo/fosrl-olm/package.nix b/pkgs/by-name/fo/fosrl-olm/package.nix
index 3d90cfeb037c..17278da184c5 100644
--- a/pkgs/by-name/fo/fosrl-olm/package.nix
+++ b/pkgs/by-name/fo/fosrl-olm/package.nix
@@ -2,24 +2,28 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "olm";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "olm";
     tag = finalAttrs.version;
-    hash = "sha256-4Kg/9X1TVhOZ/ogjiPV9BBr1Nls25ZJNf5HNVSSZEwg=";
+    hash = "sha256-kPxFjGpwFjz5BZfgtbo5o/NveFLjAGjOh4o1h2RtGWI=";
   };
 
-  vendorHash = "sha256-EJtcAmioC5EltsBeBa9aNDwKLR8rMQbQ2oHz+OVuZj0=";
+  vendorHash = "sha256-OSW7WRIIHg0xXp7Zanxy9PJEthMSsHYWn8WdPjzt0fc=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
 
   ldflags = [
     "-s"
     "-w"
+    "-X=main.olmVersion=${finalAttrs.version}"
   ];
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/gp/gpclient/package.nix b/pkgs/by-name/gp/gpclient/package.nix
index dcf730dde72e..066f21314e26 100644
--- a/pkgs/by-name/gp/gpclient/package.nix
+++ b/pkgs/by-name/gp/gpclient/package.nix
@@ -41,11 +41,15 @@ rustPlatform.buildRustPackage {
   # nixpkgs-update: no auto update
   inherit (gpauth)
     cargoHash
-    meta
     src
     version
     ;
 
+  meta = gpauth.meta // {
+    # Re-anchor meta.position here so nixpkgs-update sees the opt-out above.
+    inherit (gpauth.meta) description;
+  };
+
   buildAndTestSubdir = "apps/gpclient";
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mu/muse-sounds-manager/package.nix b/pkgs/by-name/mu/muse-sounds-manager/package.nix
index 66c43e3c2df3..cc85d539d1a3 100644
--- a/pkgs/by-name/mu/muse-sounds-manager/package.nix
+++ b/pkgs/by-name/mu/muse-sounds-manager/package.nix
@@ -13,30 +13,21 @@
   libice,
   libsm,
   openssl,
-  unzip,
   xdg-utils,
-  makeWrapper,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "muse-sounds-manager";
   version = "2.2.1.953";
 
-  # Use web.archive.org since upstream does not provide a stable (versioned) URL.
-  # To see if there are new versions on the Web Archive, visit
-  # http://web.archive.org/cdx/search/cdx?url=https://muse-cdn.com/Muse_Sounds_Manager_x64.tar.gz
-  # then replace the date in the URL below with date when the SHA1
-  # changes (currently CQDUS5RIVPTNZF65NNOVKDG2BCVCXH6H) and replace
-  # the version above with the version in the .deb metadata (or in the
-  # settings of muse-sounds-manager).
+  # Permalink from https://support.musehub.com/en/articles/15070607-changelog
   src = fetchurl {
-    url = "https://web.archive.org/web/20260710024139if_/https://muse-cdn.com/Muse_Sounds_Manager_x64.tar.gz";
+    url = "https://muse-cdn.com/muse-sounds-manager/Muse_Sounds_Manager_x64_${finalAttrs.version}.tar.gz";
     hash = "sha256-y7fKHh2pG8uT4p0vq20rsW8bSAp1mepkd2sW/06N3EI=";
   };
 
   nativeBuildInputs = [
     autoPatchelfHook
-    makeWrapper
   ];
 
   buildInputs = [
@@ -44,7 +35,7 @@ stdenv.mkDerivation rec {
     stdenv.cc.cc
     zlib
   ]
-  ++ runtimeDependencies;
+  ++ finalAttrs.runtimeDependencies;
 
   runtimeDependencies = map lib.getLib [
     icu
@@ -70,8 +61,6 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     ln -s ${xdg-utils}/bin/xdg-open $out/bin/open
-    wrapProgram $out/bin/muse-sounds-manager \
-      --prefix PATH : ${lib.makeBinPath [ unzip ]}
   '';
 
   dontStrip = true;
@@ -87,4 +76,4 @@ stdenv.mkDerivation rec {
     platforms = [ "x86_64-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
-}
+})
diff --git a/pkgs/by-name/pr/prometheus-ping-exporter/package.nix b/pkgs/by-name/pr/prometheus-ping-exporter/package.nix
index e02fc586d156..f260837f5504 100644
--- a/pkgs/by-name/pr/prometheus-ping-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-ping-exporter/package.nix
@@ -4,18 +4,18 @@
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "ping-exporter";
-  version = "1.1.4";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "czerwonk";
     repo = "ping_exporter";
-    rev = version;
-    hash = "sha256-H+HcwDMnRgvEnbaI/tcS457Ir2Xtq30g44EYo4UPCE0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YbdODBKXvBNtIt+Hqu/xA52p5TZGhcVbqZfTcmyyV+Y=";
   };
 
-  vendorHash = "sha256-bEJstamu0+EfHL2cduWb/iDeYCp8tzGCS2Lvc7Onp48=";
+  vendorHash = "sha256-mZ29jH1572VDLOJb/x3FCI2Q6xVjJ3Ghy/ay343kA3Y=";
 
   meta = {
     description = "Prometheus exporter for ICMP echo requests";
@@ -24,4 +24,4 @@ buildGoModule rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ nudelsalat ];
   };
-}
+})
diff --git a/pkgs/by-name/se/seanime/package.nix b/pkgs/by-name/se/seanime/package.nix
index b9ceacb02f12..cae4edbb38d4 100644
--- a/pkgs/by-name/se/seanime/package.nix
+++ b/pkgs/by-name/se/seanime/package.nix
@@ -10,13 +10,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "seanime";
-  version = "3.9.1";
+  version = "3.10.1";
 
   src = fetchFromGitHub {
     owner = "5rahim";
     repo = "seanime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-T4TLQ3wMvUFURu5rDfUDWfnhSsmYWq4GGQBZvAd2ivs=";
+    hash = "sha256-4BXb+9eTzH23pNyatFyhbfmt2tCqEF8K+iLlwXCxAeQ=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     npmRoot = "seanime-web";
     npmDeps = fetchNpmDeps {
       src = "${finalAttrs.src}/seanime-web";
-      hash = "sha256-mODqMuU1AtlNjLr9+OpORyXIyt7yMhIBJZTLDSj4fLQ=";
+      hash = "sha256-4w4SYBt8bkFtRKnoxOWEFAcNT+Aa8/ALKgGza9LBZ5Q=";
     };
   };
 
diff --git a/pkgs/by-name/se/server-box/package.nix b/pkgs/by-name/se/server-box/package.nix
index c9b7d8193fb6..88c542323ea6 100644
--- a/pkgs/by-name/se/server-box/package.nix
+++ b/pkgs/by-name/se/server-box/package.nix
@@ -13,14 +13,14 @@
 }:
 
 let
-  version = "1.0.1450";
+  version = "1.0.1466";
 
   src = fetchFromGitHub {
     owner = "lollipopkit";
     repo = "flutter_server_box";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-jgbuEgUxsN1ijH++NjXr3eZeTPUQbB/9axCMM/FWp54=";
+    hash = "sha256-Q4iKj+q9MOqIAmWuUXu6897caMg1CBOXz8LpvoGfSF4=";
   };
 in
 flutter344.buildFlutterApplication {
diff --git a/pkgs/by-name/se/server-box/pubspec.lock.json b/pkgs/by-name/se/server-box/pubspec.lock.json
index e13cca57ba31..a7a49829ac62 100644
--- a/pkgs/by-name/se/server-box/pubspec.lock.json
+++ b/pkgs/by-name/se/server-box/pubspec.lock.json
@@ -194,11 +194,11 @@
       "dependency": "transitive",
       "description": {
         "name": "camera_web",
-        "sha256": "57f49a635c8bf249d07fb95eb693d7e4dda6796dedb3777f9127fb54847beba7",
+        "sha256": "1245a480a113437f8d46d19c0fb90cea9db921436d9cf2ba5fb11854a1312693",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.3.5+3"
+      "version": "0.3.5+4"
     },
     "characters": {
       "dependency": "transitive",
@@ -324,11 +324,11 @@
       "dependency": "transitive",
       "description": {
         "name": "coverage",
-        "sha256": "5da775aa218eaf2151c721b16c01c7676fbfdd99cebba2bf64e8b807a28ff94d",
+        "sha256": "956a3de0725ca232ad353565a8290d3357592bf4250f6f298a185e2d949c5d3d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.15.0"
+      "version": "1.15.1"
     },
     "cross_file": {
       "dependency": "transitive",
@@ -377,7 +377,7 @@
         "relative": true
       },
       "source": "path",
-      "version": "2.17.1"
+      "version": "2.18.0"
     },
     "dbus": {
       "dependency": "transitive",
@@ -393,21 +393,21 @@
       "dependency": "direct main",
       "description": {
         "name": "dio",
-        "sha256": "aff32c08f92787a557dd5c0145ac91536481831a01b4648136373cddb0e64f8c",
+        "sha256": "ea2bad3c89a27635ce2d85cce4d6b199da49a5a48ec77b03e45b65a3b90922b0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.9.2"
+      "version": "5.10.0"
     },
     "dio_web_adapter": {
       "dependency": "transitive",
       "description": {
         "name": "dio_web_adapter",
-        "sha256": "2f9e64323a7c3c7ef69567d5c800424a11f8337b8b228bad02524c9fb3c1f340",
+        "sha256": "dd58dc3861eb36edb13b217efc006a1c21e5bbc341de8c229b85634fa5e362e4",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.2"
+      "version": "2.2.0"
     },
     "dynamic_color": {
       "dependency": "direct main",
@@ -1286,11 +1286,11 @@
       "dependency": "transitive",
       "description": {
         "name": "path_provider",
-        "sha256": "50c5dd5b6e1aaf6fb3a78b33f6aa3afca52bf903a8a5298f53101fdaee55bbcd",
+        "sha256": "a7f4874f987173da295a61c181b8ee71dab59b332a486b391babf26a1b884825",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.5"
+      "version": "2.1.6"
     },
     "path_provider_android": {
       "dependency": "transitive",
@@ -1316,21 +1316,21 @@
       "dependency": "transitive",
       "description": {
         "name": "path_provider_linux",
-        "sha256": "f7a1fe3a634fe7734c8d3f2766ad746ae2a2884abe22e241a8b301bf5cac3279",
+        "sha256": "58c2005f147315b11e9b4a7bc889cd5203e250cba8e3f012dae259b4972b5c16",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.1"
+      "version": "2.2.2"
     },
     "path_provider_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "path_provider_platform_interface",
-        "sha256": "88f5779f72ba699763fa3a3b06aa4bf6de76c8e5de842cf6f29e2e06476c2334",
+        "sha256": "484838772624c3a4b94f1e44a3e19897fee738f2d5c4ce448443b0417f7c9dda",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.2"
+      "version": "2.1.3"
     },
     "path_provider_windows": {
       "dependency": "transitive",
@@ -1586,51 +1586,51 @@
       "dependency": "transitive",
       "description": {
         "name": "screen_retriever",
-        "sha256": "570dbc8e4f70bac451e0efc9c9bb19fa2d6799a11e6ef04f946d7886d2e23d0c",
+        "sha256": "42cc3b402a0f67d2455a0d067553d0f13453f6a008d98eababf8b63958d506bd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.0"
+      "version": "0.2.1"
     },
     "screen_retriever_linux": {
       "dependency": "transitive",
       "description": {
         "name": "screen_retriever_linux",
-        "sha256": "f7f8120c92ef0784e58491ab664d01efda79a922b025ff286e29aa123ea3dd18",
+        "sha256": "2a476f1a5538065bc5badf376cfdc83d6ecf07d77eb2391b9c2bff5a76970048",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.0"
+      "version": "0.2.1"
     },
     "screen_retriever_macos": {
       "dependency": "transitive",
       "description": {
         "name": "screen_retriever_macos",
-        "sha256": "71f956e65c97315dd661d71f828708bd97b6d358e776f1a30d5aa7d22d78a149",
+        "sha256": "b5abb900fcb86614ff10b738b34e37b9e1d03b0447280668e2bc8a98bdc7bd59",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.0"
+      "version": "0.2.1"
     },
     "screen_retriever_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "screen_retriever_platform_interface",
-        "sha256": "ee197f4581ff0d5608587819af40490748e1e39e648d7680ecf95c05197240c0",
+        "sha256": "3af22d926bedf20c2caa308eea376776451a3af125919ce072e56525fded8901",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.0"
+      "version": "0.2.1"
     },
     "screen_retriever_windows": {
       "dependency": "transitive",
       "description": {
         "name": "screen_retriever_windows",
-        "sha256": "449ee257f03ca98a57288ee526a301a430a344a161f9202b4fcc38576716fe13",
+        "sha256": "c44b38a4c4bab34af259180a70a4eee1e29384e7b82e627c9faa68afcdab2e73",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.0"
+      "version": "0.2.1"
     },
     "share_plus": {
       "dependency": "transitive",
@@ -1666,11 +1666,11 @@
       "dependency": "transitive",
       "description": {
         "name": "shared_preferences_android",
-        "sha256": "a2c49fc1fed7140cadd892d765bd47edbe4ac0b9c7e7e3c493dcb58126f99cf0",
+        "sha256": "93ae5884a9df5d3bb696825bceb3a17590754548b5d740eba51500afc8d088f5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.25"
+      "version": "2.4.26"
     },
     "shared_preferences_foundation": {
       "dependency": "transitive",
@@ -2052,11 +2052,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics_compiler",
-        "sha256": "7ee12e6dffe0fc8e755179d6d91b3b34f5924223fc104d85572ef9180d73d172",
+        "sha256": "142a9146f447d15b10bdc00e21d5f4d83e5b32bb5f8f8f5a04c75311344923a3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.2.5"
+      "version": "1.2.6"
     },
     "vector_math": {
       "dependency": "transitive",
diff --git a/pkgs/by-name/te/technitium-dns-server-library/package.nix b/pkgs/by-name/te/technitium-dns-server-library/package.nix
index c5db4bfb27f8..8187a23d8f72 100644
--- a/pkgs/by-name/te/technitium-dns-server-library/package.nix
+++ b/pkgs/by-name/te/technitium-dns-server-library/package.nix
@@ -3,7 +3,6 @@
   buildDotnetModule,
   fetchFromGitHub,
   dotnetCorePackages,
-  nix-update-script,
 }:
 buildDotnetModule rec {
   pname = "technitium-dns-server-library";
@@ -27,8 +26,6 @@ buildDotnetModule rec {
     "TechnitiumLibrary.Security.OTP/TechnitiumLibrary.Security.OTP.csproj"
   ];
 
-  passthru.updateScript = nix-update-script { };
-
   meta = {
     changelog = "https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md";
     description = "Library for Authorative and Recursive DNS server for Privacy and Security";
diff --git a/pkgs/by-name/te/technitium-dns-server/package.nix b/pkgs/by-name/te/technitium-dns-server/package.nix
index 6ddd88f61f89..e4bb8b7cbaa9 100644
--- a/pkgs/by-name/te/technitium-dns-server/package.nix
+++ b/pkgs/by-name/te/technitium-dns-server/package.nix
@@ -6,7 +6,6 @@
   technitium-dns-server-library,
   libmsquic,
   nixosTests,
-  nix-update-script,
 }:
 buildDotnetModule rec {
   pname = "technitium-dns-server";
@@ -45,7 +44,7 @@ buildDotnetModule rec {
     inherit (nixosTests) technitium-dns-server;
   };
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = ./update.sh;
 
   meta = {
     changelog = "https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md";
diff --git a/pkgs/by-name/te/technitium-dns-server/update.sh b/pkgs/by-name/te/technitium-dns-server/update.sh
new file mode 100755
index 000000000000..c4a3033366e5
--- /dev/null
+++ b/pkgs/by-name/te/technitium-dns-server/update.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i bash -p curl jq common-updater-scripts gnused nix coreutils
+
+set -euo pipefail
+
+latestVersion="$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/TechnitiumSoftware/DnsServer/releases?per_page=1" | jq -r ".[0].tag_name" | sed 's/^v//')"
+currentVersion="${UPDATE_NIX_OLD_VERSION:-$(nix-instantiate --eval -E 'with import ./. {}; technitium-dns-server.version or (lib.getVersion technitium-dns-server)' | tr -d '"')}"
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+  echo "technitium-dns-server is up-to-date: $currentVersion"
+  exit 0
+fi
+
+update-source-version technitium-dns-server-library "$latestVersion"
+update-source-version technitium-dns-server "$latestVersion"
+
+# Regenerate nuget dependencies for both packages
+$(nix-build . -A technitium-dns-server-library.fetch-deps --no-out-link)
+$(nix-build . -A technitium-dns-server.fetch-deps --no-out-link)
diff --git a/pkgs/development/python-modules/simple-di/default.nix b/pkgs/development/python-modules/simple-di/default.nix
index 3ebabd2d896a..0b74fbd785c2 100644
--- a/pkgs/development/python-modules/simple-di/default.nix
+++ b/pkgs/development/python-modules/simple-di/default.nix
@@ -6,18 +6,22 @@
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "simple-di";
   version = "0.1.5";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "simple_di";
-    inherit version;
+    inherit (finalAttrs) version;
     hash = "sha256-GSuZne5M1PsRpdhhFlyq0C2PBhfA+Ab8Wwn5BfGgPKA=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     setuptools
     typing-extensions
   ];
@@ -33,4 +37,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ sauyon ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/types-freezegun/default.nix b/pkgs/development/python-modules/types-freezegun/default.nix
index a87687e39bd3..4179bb10949b 100644
--- a/pkgs/development/python-modules/types-freezegun/default.nix
+++ b/pkgs/development/python-modules/types-freezegun/default.nix
@@ -2,18 +2,24 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "types-freezegun";
   version = "1.1.10";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "types-freezegun";
+    inherit (finalAttrs) version;
     hash = "sha256-yzotLu6VDqy6rAZzq1BJmCM2XOuMZVursVRKQURkCew=";
   };
 
+  build-system = [ setuptools ];
+
   # Module doesn't have tests
   doCheck = false;
 
@@ -25,4 +31,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ jpetrucciani ];
   };
-}
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6b5218382f8e..f62814d35dc6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8680,7 +8680,6 @@ with pkgs;
     import ../applications/networking/browsers/firefox/packages/firefox-esr-140.nix
       {
         inherit
-          stdenv
           lib
           callPackage
           fetchurl