diff --git a/nixos/modules/services/web-apps/immich.nix b/nixos/modules/services/web-apps/immich.nix
index 415a79790519..f1c88c1e2ff6 100644
--- a/nixos/modules/services/web-apps/immich.nix
+++ b/nixos/modules/services/web-apps/immich.nix
@@ -404,7 +404,7 @@ in
       wantedBy = [ "multi-user.target" ];
       inherit (cfg.machine-learning) environment;
       serviceConfig = commonServiceConfig // {
-        ExecStart = lib.getExe (cfg.package.machine-learning.override { immich = cfg.package; });
+        ExecStart = lib.getExe cfg.package.machine-learning;
         Slice = "system-immich.slice";
         CacheDirectory = "immich";
         User = cfg.user;
diff --git a/pkgs/by-name/ex/extism-js/package.nix b/pkgs/by-name/ex/extism-js/package.nix
new file mode 100644
index 000000000000..6c7d2e8d217c
--- /dev/null
+++ b/pkgs/by-name/ex/extism-js/package.nix
@@ -0,0 +1,74 @@
+# Building this from source requires cross-compiling Rust to wasm32-wasip1.
+# An attempt to do so was made in https://github.com/NixOS/nixpkgs/pull/463349.
+# FIXME revisit once https://github.com/NixOS/nixpkgs/pull/463720 is merged
+
+{
+  autoPatchelfHook,
+  fetchurl,
+  lib,
+  libgcc,
+  stdenvNoCC,
+  versionCheckHook,
+}:
+
+let
+  version = "1.5.1";
+  tag = "v${version}";
+  system = lib.replaceStrings [ "darwin" ] [ "macos" ] stdenvNoCC.hostPlatform.system;
+  hashes = {
+    aarch64-darwin = "sha256-BHld8Dwwd6fexc05oHOIawa5PtGZAI61wQGWE8T+iMs=";
+    aarch64-linux = "sha256-KM3/y31OdLmEAcc48TSLmXei2GD6FhOHYlD7W/ErP+I=";
+    x86_64-darwin = "sha256-cE0JJK92pTJyGnHEZ7wA6+dpMvVOTMzFM2Mkwfy5kbQ=";
+    x86_64-linux = "sha256-9qSjqPFmUaUnpGQ/ldIpyFSgTWbUYozcckpYxpm5PJU=";
+  };
+in
+stdenvNoCC.mkDerivation {
+  pname = "extism-js";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://github.com/extism/js-pdk/releases/download/${tag}/extism-js-${system}-${tag}.gz";
+    hash = hashes.${stdenvNoCC.hostPlatform.system};
+  };
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    gunzip -cf "$src" > extism-js
+
+    runHook postUnpack
+  '';
+
+  nativeBuildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
+    autoPatchelfHook
+  ];
+
+  buildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
+    libgcc
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt $out/bin extism-js
+
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  meta = {
+    changelog = "https://github.com/extism/js-pdk/releases/tag/${tag}";
+    description = "Write Extism plugins in JavaScript & TypeScript";
+    homepage = "https://github.com/extism/js-pdk";
+    license = lib.licenses.bsd3;
+    mainProgram = "extism-js";
+    maintainers = [ lib.maintainers.dotlambda ];
+    platforms = lib.attrNames hashes;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+}
diff --git a/pkgs/by-name/im/immich-cli/package.nix b/pkgs/by-name/im/immich-cli/package.nix
index 8d65760c9002..f3346434bef2 100644
--- a/pkgs/by-name/im/immich-cli/package.nix
+++ b/pkgs/by-name/im/immich-cli/package.nix
@@ -12,7 +12,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "immich-cli";
-  version = "2.2.101";
+  version = "2.2.103";
   inherit (immich) src pnpmDeps;
 
   postPatch = ''
diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index 5adde1118fde..4b70e0bd8f8c 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -12,8 +12,10 @@
   # build-time deps
   pkg-config,
   makeWrapper,
+  binaryen,
   curl,
   cacert,
+  extism-js,
   unzip,
   # runtime deps
   cairo,
@@ -34,7 +36,6 @@
 }:
 let
   pnpm = pnpm_10;
-  version = "2.2.3";
 
   esbuild' = buildPackages.esbuild.override {
     buildGoModule =
@@ -103,54 +104,25 @@ let
         unzip ./cities500.zip -d $out/
         echo "${date}" > $out/geodata-date.txt
       '';
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "immich";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "immich-app";
     repo = "immich";
-    tag = "v${version}";
-    hash = "sha256-OoToTRDPXWOa7d1j1xvkZt+vKWBX4eHDiIsFs3bIlvw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-K/E5bQraTlvNx1Cd0bKyY6ZhesafGccqVZ9Mu6Q0pZ0=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     pname = "immich";
-    inherit version src;
+    inherit (finalAttrs) version src;
     fetcherVersion = 2;
-    hash = "sha256-igkO0ID0/9uPtFAXL2v5bcFbCpZK2lcYEctWBKtFKdU=";
+    hash = "sha256-i0JHKjsQcdDUrDLK0hJGOvVRh/aOyvms/k+6WEPbyh8=";
   };
 
-  web = stdenv.mkDerivation {
-    pname = "immich-web";
-    inherit version src pnpmDeps;
-
-    nativeBuildInputs = [
-      nodejs
-      pnpm
-      pnpm.configHook
-    ];
-
-    buildPhase = ''
-      runHook preBuild
-
-      pnpm --filter @immich/sdk build
-      pnpm --filter immich-web build
-
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      cd web
-      cp -r build $out
-
-      runHook postInstall
-    '';
-  };
-in
-stdenv.mkDerivation {
-  pname = "immich";
-  inherit version src pnpmDeps;
-
   postPatch = ''
     # pg_dumpall fails without database root access
     # see https://github.com/immich-app/immich/issues/13971
@@ -219,7 +191,8 @@ stdenv.mkDerivation {
     \) -exec rm -r {} +
 
     mkdir -p "$packageOut/build"
-    ln -s '${web}' "$packageOut/build/www"
+    ln -s '${finalAttrs.passthru.plugins}' "$packageOut/build/corePlugin"
+    ln -s '${finalAttrs.passthru.web}' "$packageOut/build/www"
     ln -s '${geodata}' "$packageOut/build/geodata"
 
     echo '${builtins.toJSON buildLock}' > "$packageOut/build/build-lock.json"
@@ -248,18 +221,78 @@ stdenv.mkDerivation {
       inherit (nixosTests) immich immich-vectorchord-migration;
     };
 
-    machine-learning = immich-machine-learning;
+    machine-learning = immich-machine-learning.override {
+      immich = finalAttrs.finalPackage;
+    };
+
+    plugins = stdenv.mkDerivation {
+      pname = "immich-plugins";
+      inherit (finalAttrs) version src pnpmDeps;
+
+      nativeBuildInputs = [
+        binaryen
+        extism-js
+        nodejs
+        pnpm
+        pnpm.configHook
+      ];
+
+      buildPhase = ''
+        runHook preBuild
+
+        pnpm --filter plugins build
+
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        cd plugins
+        mkdir $out
+        cp -r dist manifest.json $out
+
+        runHook postInstall
+      '';
+    };
+
+    web = stdenv.mkDerivation {
+      pname = "immich-web";
+      inherit (finalAttrs) version src pnpmDeps;
+
+      nativeBuildInputs = [
+        nodejs
+        pnpm
+        pnpm.configHook
+      ];
+
+      buildPhase = ''
+        runHook preBuild
+
+        pnpm --filter @immich/sdk build
+        pnpm --filter immich-web build
+
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        cd web
+        cp -r build $out
+
+        runHook postInstall
+      '';
+    };
 
     inherit
-      src
-      web
       geodata
       pnpm
       ;
   };
 
   meta = {
-    changelog = "https://github.com/immich-app/immich/releases/tag/${src.tag}";
+    changelog = "https://github.com/immich-app/immich/releases/tag/${finalAttrs.src.tag}";
     description = "Self-hosted photo and video backup solution";
     homepage = "https://immich.app/";
     license = with lib.licenses; [
@@ -275,4 +308,4 @@ stdenv.mkDerivation {
     platforms = lib.platforms.linux ++ lib.platforms.freebsd;
     mainProgram = "server";
   };
-}
+})