diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index a7c51b9a877f..6d3002166b37 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -248,6 +248,8 @@ in
           "-/etc/localtime"
           "-/etc/kanidm"
           "-/etc/static/kanidm"
+          "-/etc/ssl"
+          "-/etc/static/ssl"
         ];
         BindPaths = [
           # To create the socket
diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix
index d34f680f5224..7f8a4e501777 100644
--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@@ -44,6 +44,12 @@ import ./make-test-python.nix ({ pkgs, ... }:
         enableClient = true;
         clientSettings = {
           uri = "https://${serverDomain}";
+          verify_ca = true;
+          verify_hostnames = true;
+        };
+        enablePam = true;
+        unixSettings = {
+          pam_allowed_login_groups = [ "shell" ];
         };
       };
 
@@ -67,9 +73,11 @@ import ./make-test-python.nix ({ pkgs, ... }:
         start_all()
         server.wait_for_unit("kanidm.service")
         server.wait_until_succeeds("curl -sf https://${serverDomain} | grep Kanidm")
-        server.wait_until_succeeds("ldapsearch -H ldap://[::1]:636 -b '${ldapBaseDN}' -x '(name=test)'")
-        client.wait_until_succeeds("kanidm login -D anonymous && kanidm self whoami | grep anonymous@${serverDomain}")
-        (rv, result) = server.execute("kanidmd recover_account -d quiet -c ${serverConfigFile} -n admin 2>&1 | rg -o '[A-Za-z0-9]{48}'")
+        server.succeed("ldapsearch -H ldap://[::1]:636 -b '${ldapBaseDN}' -x '(name=test)'")
+        client.succeed("kanidm login -D anonymous && kanidm self whoami | grep anonymous@${serverDomain}")
+        rv, result = server.execute("kanidmd recover_account -c ${serverConfigFile} idm_admin 2>&1 | rg -o '[A-Za-z0-9]{48}'")
         assert rv == 0
+        client.wait_for_unit("kanidm-unixd.service")
+        client.succeed("kanidm_unixd_status | grep working!")
       '';
   })
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index c7f326ab5c7c..83223f5c289c 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -70,6 +70,9 @@ rec {
       broken = stdenv.buildPlatform.is32bit; # since Firefox 60, build on 32-bit platforms fails with "out of memory".
                                              # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
       license = lib.licenses.mpl20;
+      knownVulnerabilities = [
+        "Firefox 91.13.0esr was the last release in the 91esr series, which has reached the end of its life. Migrate to the 102esr series instead."
+      ];
     };
     tests = [ nixosTests.firefox-esr-91 ];
     updateScript = callPackage ./update.nix {
diff --git a/pkgs/applications/networking/irc/srain/default.nix b/pkgs/applications/networking/irc/srain/default.nix
index 302fe96f1eca..a12ecca525f1 100644
--- a/pkgs/applications/networking/irc/srain/default.nix
+++ b/pkgs/applications/networking/irc/srain/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Modern IRC client written in GTK";
-    homepage = "https://srain.im";
+    homepage = "https://srain.silverrainz.me";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ rewine ];
diff --git a/pkgs/development/libraries/cmark-gfm/default.nix b/pkgs/development/libraries/cmark-gfm/default.nix
index 599ac2b2e7b0..239577e0732b 100644
--- a/pkgs/development/libraries/cmark-gfm/default.nix
+++ b/pkgs/development/libraries/cmark-gfm/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "cmark-gfm";
-  version = "0.29.0.gfm.3";
+  version = "0.29.0.gfm.6";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "cmark-gfm";
     rev = version;
-    sha256 = "sha256-V3XegSjqKLCMpfnoYHr9/r5fSC2CC7A2jXkAcHUt7eA=";
+    sha256 = "sha256-ekHY5EGSrJrQwlXNjKpyj7k0Bzq1dYPacRsfNZ8K+lk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/servers/kanidm/default.nix b/pkgs/servers/kanidm/default.nix
index f160886fb640..0984a622330c 100644
--- a/pkgs/servers/kanidm/default.nix
+++ b/pkgs/servers/kanidm/default.nix
@@ -17,16 +17,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "kanidm";
-  version = "1.1.0-alpha.8";
+  version = "1.1.0-alpha.9";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-zMtbE6Y9wXFPBqhmiTMJ3m6bLVZl+c6lRY39DWDlJNo=";
+    rev = "985462590b1c49b26a0b0ee01e24b1eb01942165";
+    hash = "sha256-JtoDuA3NCKmX+wDqav30VwrLeDALYat1iKFWpbYOO1s=";
   };
 
-  cargoSha256 = "sha256:1l7xqp457zfd9gfjp6f4lzgadfp6112jbip4irazw4084qwj0z6x";
+  cargoSha256 = "sha256-pkBkXIG2PF5YMeighQwHwhURWbJabfveyszRIdrQjcA=";
 
   KANIDM_BUILD_PROFILE = "release_nixos_${arch}";
 
@@ -56,25 +56,22 @@ rustPlatform.buildRustPackage rec {
     pam
   ];
 
-  # Failing tests, probably due to network issues
-  checkFlags = [
-    "--skip default_entries"
-    "--skip oauth2_openid_basic_flow"
-    "--skip test_server"
-    "--skip test_cache"
-  ];
+  # The UI needs to be in place before the tests are run.
+  postBuild = ''
+    # We don't compile the wasm-part form source, as there isn't a rustc for
+    # wasm32-unknown-unknown in nixpkgs yet.
+    mkdir $out
+    cp -r kanidmd_web_ui/pkg $out/ui
+  '';
 
   preFixup = ''
-    installShellCompletion --bash $releaseDir/build/completions/*.bash
-    installShellCompletion --zsh  $releaseDir/build/completions/_*
+    installShellCompletion \
+      --bash $releaseDir/build/completions/*.bash \
+      --zsh $releaseDir/build/completions/_*
 
     # PAM and NSS need fix library names
     mv $out/lib/libnss_kanidm.so $out/lib/libnss_kanidm.so.2
     mv $out/lib/libpam_kanidm.so $out/lib/pam_kanidm.so
-
-    # We don't compile the wasm-part form source, as there isn't a rustc for
-    # wasm32-unknown-unknown in nixpkgs yet.
-    cp -r kanidmd_web_ui/pkg $out/ui
   '';
 
   passthru.tests = { inherit (nixosTests) kanidm; };