diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/arm64-darwin-sha.nix b/pkgs/applications/networking/instant-messengers/zoom-us/arm64-darwin-sha.nix
deleted file mode 100644
index 9b4a21cb7d28..000000000000
--- a/pkgs/applications/networking/instant-messengers/zoom-us/arm64-darwin-sha.nix
+++ /dev/null
@@ -1 +0,0 @@
-"0cwplzza8vv4nzxf35i2p4gfnna4dpgp0ddqbpdxl8cxrikq5rji"
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/arm64-darwin-version.nix b/pkgs/applications/networking/instant-messengers/zoom-us/arm64-darwin-version.nix
deleted file mode 100644
index 4fd4c471b3cf..000000000000
--- a/pkgs/applications/networking/instant-messengers/zoom-us/arm64-darwin-version.nix
+++ /dev/null
@@ -1 +0,0 @@
-"5.11.1.8356"
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index a8fd025a88ad..7b5c737d7c67 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -44,24 +44,26 @@ let
   throwSystem = throw "Unsupported system: ${system}";
 
   # Zoom versions are released at different times for each platform
-  version = {
-    aarch64-darwin =import ./arm64-darwin-version.nix;
-    x86_64-darwin = import ./x86_64-darwin-version.nix;
-    x86_64-linux = import ./x86_64-linux-version.nix;
-   }.${system} or throwSystem;
+  # and often with different versions.  We write them on three lines
+  # like this (rather than using {}) so that the updater script can
+  # find where to edit them.
+  versions.aarch64-darwin = "5.11.9.10046";
+  versions.x86_64-darwin = "5.11.9.10046";
+  versions.x86_64-linux = "5.11.10.4400";
 
   srcs = {
     aarch64-darwin = fetchurl {
-      url = "https://zoom.us/client/${version}/Zoom.pkg?archType=arm64";
-      sha256 = import ./arm64-darwin-sha.nix;
+      url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
+      name = "zoomusInstallerFull.pkg";
+      hash = "sha256-Z+K811azMRnhptZ1UvM+o5IgE0F4p9BrntJC9IgPU7U=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://zoom.us/client/${version}/Zoom.pkg";
-      sha256 = import ./x86_64-darwin-sha.nix;
+      url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
+      hash = "sha256-7U7qT3xlm5LqcJByMWxhZnqs6XBzylEGhqTNUgiaXJY=";
     };
     x86_64-linux = fetchurl {
-      url = "https://zoom.us/client/${version}/zoom_x86_64.pkg.tar.xz";
-      sha256 = import ./x86_64-linux-sha.nix;
+      url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
+      hash = "sha256-Pi1MtuCHzkQACamsNOIS6pbM03L1CmyosbpdrYVNCkQ=";
     };
   };
 
@@ -109,7 +111,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "zoom";
-  inherit version;
+  version = versions.${system} or throwSystem;
 
   src = srcs.${system} or throwSystem;
 
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/update.sh b/pkgs/applications/networking/instant-messengers/zoom-us/update.sh
index 6d9b50252d12..3684f057a08c 100755
--- a/pkgs/applications/networking/instant-messengers/zoom-us/update.sh
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/update.sh
@@ -1,30 +1,34 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl pup
+#!nix-shell -i bash -p common-updater-scripts curl jq
 
 set -eu -o pipefail
 
-dirname="$(dirname "$0")"
+scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
+nixpkgs=$(realpath "$scriptDir"/../../../../..)
 
-uname="$(uname)"
+echo >&2 "=== Obtaining version data from https://zoom.us/rest/download ..."
+linux_data=$(curl -Ls 'https://zoom.us/rest/download?os=linux' | jq .result.downloadVO)
+mac_data=$(curl -Ls 'https://zoom.us/rest/download?os=mac' | jq .result.downloadVO)
 
-if [[ "$uname" == "Linux" ]]; then
-    version="$(curl -Ls https://zoom.us/download\?os\=linux | \
-      pup '.linux-ver-text text{}' | \
-      awk -F'[ ().]' '{printf $2"."$3"."$4"."$6"\n"}')"
-    printf '"%s"\n' ${version} > $dirname/x86_64-linux-version.nix
-    printf '"%s"\n' \
-        $(nix-prefetch-url https://zoom.us/client/${version}/zoom_x86_64.pkg.tar.xz) > \
-        $dirname/x86_64-linux-sha.nix
-elif [[ $uname == "Darwin" ]]; then
-    # The 1st line might be empty
-    # 2nd line is the version of the conference room application
-    version="$(curl -Ls https://zoom.us/download\?os\=mac | \
-      pup '.ver text{}' | \
-      sed '/^$/d' |\
-      head -1 | \
-      awk -F'[ ().]' '{printf $2"."$3"."$4"."$6"\n"}')"
-    printf '"%s"\n' ${version} > "$dirname/$(uname -m)-darwin-version.nix"
-    printf '"%s"\n' \
-        $(nix-prefetch-url "https://zoom.us/client/${version}/Zoom.pkg?archType=$(uname -m)") > \
-        "$dirname/$(uname -m)-darwin-sha.nix"
-fi
+version_aarch64_darwin=$(jq -r .zoomArm64.version <<<"$mac_data")
+version_x86_64_darwin=$(jq -r .zoom.version <<<"$mac_data")
+version_x86_64_linux=$(jq -r .zoom.version <<<"$linux_data")
+
+echo >&2 "=== Downloading packages and computing hashes..."
+# We precalculate the hashes before calling update-source-version
+# because it attempts to calculate each architecture's package's hash
+# by running `nix-build --system <architecture> -A zoom-us.src` which
+# causes cross compiling headaches; using nix-prefetch-url with
+# hard-coded URLs is simpler.  Keep these URLs in sync with the ones
+# in default.nix where `srcs` is defined.
+hash_aarch64_darwin=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_aarch64_darwin}/zoomusInstallerFull.pkg?archType=arm64"))
+hash_x86_64_darwin=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_x86_64_darwin}/zoomusInstallerFull.pkg"))
+hash_x86_64_linux=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_x86_64_linux}/zoom_x86_64.pkg.tar.xz"))
+
+echo >&2 "=== Updating default.nix ..."
+# update-source-version expects to be at the root of nixpkgs
+(cd "$nixpkgs" && update-source-version zoom-us "$version_aarch64_darwin" $hash_aarch64_darwin --system=aarch64-darwin --version-key=versions.aarch64-darwin)
+(cd "$nixpkgs" && update-source-version zoom-us "$version_x86_64_darwin" $hash_x86_64_darwin --system=x86_64-darwin --version-key=versions.x86_64-darwin)
+(cd "$nixpkgs" && update-source-version zoom-us "$version_x86_64_linux" $hash_x86_64_linux --system=x86_64-linux --version-key=versions.x86_64-linux)
+
+echo >&2 "=== Done!"
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/x86_64-darwin-sha.nix b/pkgs/applications/networking/instant-messengers/zoom-us/x86_64-darwin-sha.nix
deleted file mode 100644
index a5ef33d28b56..000000000000
--- a/pkgs/applications/networking/instant-messengers/zoom-us/x86_64-darwin-sha.nix
+++ /dev/null
@@ -1 +0,0 @@
-"12s4z80n1qk1vcp5vppabj6fxanm4q7pjj7mggalmjbj6984fsza"
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/x86_64-darwin-version.nix b/pkgs/applications/networking/instant-messengers/zoom-us/x86_64-darwin-version.nix
deleted file mode 100644
index 4fd4c471b3cf..000000000000
--- a/pkgs/applications/networking/instant-messengers/zoom-us/x86_64-darwin-version.nix
+++ /dev/null
@@ -1 +0,0 @@
-"5.11.1.8356"
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/x86_64-linux-sha.nix b/pkgs/applications/networking/instant-messengers/zoom-us/x86_64-linux-sha.nix
deleted file mode 100644
index c50424c7a5b0..000000000000
--- a/pkgs/applications/networking/instant-messengers/zoom-us/x86_64-linux-sha.nix
+++ /dev/null
@@ -1 +0,0 @@
-"1ir5akl4vrzb0b5s37s2viqisvf4sylw8rfnfj434h1q0gqz79sc"
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/x86_64-linux-version.nix b/pkgs/applications/networking/instant-messengers/zoom-us/x86_64-linux-version.nix
deleted file mode 100644
index e776017ccb04..000000000000
--- a/pkgs/applications/networking/instant-messengers/zoom-us/x86_64-linux-version.nix
+++ /dev/null
@@ -1 +0,0 @@
-"5.11.1.3595"
diff --git a/pkgs/development/libraries/drogon/default.nix b/pkgs/development/libraries/drogon/default.nix
index 432e7626156b..26d1692b109c 100644
--- a/pkgs/development/libraries/drogon/default.nix
+++ b/pkgs/development/libraries/drogon/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "drogon";
-  version = "1.7.5";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "drogonframework";
     repo = "drogon";
     rev = "v${version}";
-    sha256 = "sha256-DrpaXUaoO35DgmX8cYb3kbXfd6PlqI6pjEKnroiRxvg=";
+    sha256 = "sha256-rpn1TaEdiD/tM8F0Uc7yjF3EFGpu3/hAS0CITraLkMU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index 17a1717812fe..48d4b1c488c9 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -44,6 +44,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-oPmqo5GLrXgQOfwwemNWUqFNGzkc1Vm2bt7Evtujxdc=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-38784.patch";
+      url = "https://gitlab.freedesktop.org/poppler/poppler/-/commit/27354e9d9696ee2bc063910a6c9a6b27c5184a52.patch";
+      sha256 = "sha256-M12zaHxcgQB/37tHffllqzd+Juq9BH5gpKVGaRY00vI=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index ef697295407d..9eeb8a84299a 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -46,13 +46,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "github-runner";
-  version = "2.296.0";
+  version = "2.296.1";
 
   src = fetchFromGitHub {
     owner = "actions";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-TLBd+L4k/qtY9q0j+soxaLCfER/USZyYCqk0r8A6sSo=";
+    hash = "sha256-vE1x/wRzjcRR56jUgW8PVM2SzsG87IKXOZghloZBgYM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index 3e3cd149c4d9..0beab0725f6a 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -8,13 +8,14 @@
 #
 # See also <nixos/modules/profiles/hardened.nix>
 
-{ lib, version }:
+{ stdenv, lib, version }:
 
 with lib;
 with lib.kernel;
 with (lib.kernel.whenHelpers version);
 
 assert (versionAtLeast version "4.9");
+assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
 
 {
   # Report BUG() conditions and kill the offending process.
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 30c6d68b5aef..83a5efd7cf19 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -36,7 +36,7 @@ let
       modDirVersion' = builtins.replaceStrings [ kernel.version ] [ version ] kernel.modDirVersion;
     in kernel.override {
       structuredExtraConfig = import ../os-specific/linux/kernel/hardened/config.nix {
-        inherit lib version;
+        inherit stdenv lib version;
       };
       argsOverride = {
         inherit version;