diff --git a/lib/path/tests/default.nix b/lib/path/tests/default.nix
index 6b8e515f4330..50d40cdfa476 100644
--- a/lib/path/tests/default.nix
+++ b/lib/path/tests/default.nix
@@ -18,7 +18,14 @@ pkgs.runCommand "lib-path-tests" {
   ];
 } ''
   # Needed to make Nix evaluation work
-  export NIX_STATE_DIR=$(mktemp -d)
+  export TEST_ROOT=$(pwd)/test-tmp
+  export NIX_BUILD_HOOK=
+  export NIX_CONF_DIR=$TEST_ROOT/etc
+  export NIX_LOCALSTATE_DIR=$TEST_ROOT/var
+  export NIX_LOG_DIR=$TEST_ROOT/var/log/nix
+  export NIX_STATE_DIR=$TEST_ROOT/var/nix
+  export NIX_STORE_DIR=$TEST_ROOT/store
+  export PAGER=cat
 
   cp -r ${libpath} lib
   export TEST_LIB=$PWD/lib
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 2e364b5c7f74..a22978098c01 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "116.0-1",
+  "packageVersion": "116.0.2-1",
   "source": {
-    "rev": "116.0-1",
-    "sha256": "1nah5a5l5ajyvy8aw4xdpdfs2s3ybfs5jw9c4qj9qczxdp541a66"
+    "rev": "116.0.2-1",
+    "sha256": "08q50yjb8q168zb2y4iajjqd9ygbpywwr9i4vfn67wchqlsc1mrp"
   },
   "firefox": {
-    "version": "116.0",
-    "sha512": "4370c65a99bf8796524aca11ea8e99fa4f875176a5805ad49f35ae149080eb54be42e7eae84627e87e17b88b262649e48f3b30b317170ac7c208960200d1005d"
+    "version": "116.0.2",
+    "sha512": "2c0ae18672fe22c75002744831130e13da764f83726951e5b58cfe74f7f473e22634ce08ebc11a98bac5baec0a4ac099a3a350a8b756af9c5bea6d5f4432da6d"
   }
 }
diff --git a/pkgs/tools/networking/mozillavpn/default.nix b/pkgs/tools/networking/mozillavpn/default.nix
index dd8ce048af07..abbaa00dcbe5 100644
--- a/pkgs/tools/networking/mozillavpn/default.nix
+++ b/pkgs/tools/networking/mozillavpn/default.nix
@@ -4,6 +4,8 @@
 , fetchFromGitHub
 , go
 , lib
+, libgcrypt
+, libgpg-error
 , libsecret
 , pkg-config
 , polkit
@@ -23,47 +25,49 @@
 
 let
   pname = "mozillavpn";
-  version = "2.14.1";
+  version = "2.16.0";
   src = fetchFromGitHub {
     owner = "mozilla-mobile";
     repo = "mozilla-vpn-client";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-xWm21guI+h0bKd/rEyxVMyxypCitLWEbVy7TaVBKh4o=";
+    hash = "sha256-Yd53QUnoZ+5imt8kWpfGL6mkWeEFvqRrTpSu6efGgOA=";
   };
+  patches = [ ];
 
-  netfilter-go-modules = (buildGoModule {
-    inherit pname version src;
+  netfilterGoModules = (buildGoModule {
+    inherit pname version src patches;
     modRoot = "linux/netfilter";
     vendorHash = "sha256-Cmo0wnl0z5r1paaEf1MhCPbInWeoMhGjnxCxGh0cyO8=";
   }).go-modules;
 
   extensionBridgeDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
+    inherit src patches;
     name = "${pname}-${version}-extension-bridge";
     preBuild = "cd extension/bridge";
-    hash = "sha256-XW47EnNHm5JUWCqDU/iHB6ZRGny4v5x7Fs/1dv5TfzM=";
+    hash = "sha256-WKnc2nGXJVhzNluh0RFSdmPtGdo2QnNuEJ7r5xJCGi0=";
   };
   signatureDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
+    inherit src patches;
     name = "${pname}-${version}-signature";
     preBuild = "cd signature";
-    hash = "sha256-CNPL1Orn+ZbX0HL+CHMaoXPI9G8MoC+hY8pJTJlWH1U=";
+    hash = "sha256-XlOnUB0TO6rrLkWU9eT1sTOcDtJdz4yi/ejKcEfFcFc=";
   };
-  vpngleanDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}-vpnglean";
-    preBuild = "cd vpnglean";
-    hash = "sha256-5vazbCqzJG6iA0MFaTNha42jb1pgLhr0P9I8rQxSKtw=";
+  qtgleanDeps = rustPlatform.fetchCargoTarball {
+    inherit src patches;
+    name = "${pname}-${version}-qtglean";
+    preBuild = "cd qtglean";
+    hash = "sha256-BU++ZWb4Fp8LS2woohuDSD2iYo/3rBO6xgeLzyrdLkU=";
   };
 
 in
 stdenv.mkDerivation {
-  inherit pname version src;
+  inherit pname version src patches;
 
   buildInputs = [
+    libgcrypt
+    libgpg-error
     libsecret
-    polkit
     qt5compat
     qtbase
     qtnetworkauth
@@ -71,6 +75,7 @@ stdenv.mkDerivation {
     qtwebsockets
   ];
   nativeBuildInputs = [
+    cargo
     cmake
     go
     pkg-config
@@ -78,8 +83,8 @@ stdenv.mkDerivation {
     python3.pkgs.glean-parser
     python3.pkgs.pyyaml
     python3.pkgs.setuptools
+    qttools
     rustPlatform.cargoSetupHook
-    cargo
     rustc
     wrapQtAppsHook
   ];
@@ -95,30 +100,23 @@ stdenv.mkDerivation {
     signatureDepsCopy="$cargoDepsCopy"
     popd
 
-    pushd source/vpnglean
-    cargoDeps='${vpngleanDeps}' cargoSetupPostUnpackHook
-    vpngleanDepsCopy="$cargoDepsCopy"
+    pushd source/qtglean
+    cargoDeps='${qtgleanDeps}' cargoSetupPostUnpackHook
+    qtgleanDepsCopy="$cargoDepsCopy"
     popd
   '';
   dontCargoSetupPostUnpack = true;
 
   postPatch = ''
-    substituteInPlace src/apps/vpn/platforms/linux/daemon/org.mozilla.vpn.dbus.service --replace /usr/bin/mozillavpn "$out/bin/mozillavpn"
-
-    substituteInPlace scripts/addon/build.py \
-      --replace 'qtbinpath = args.qtpath' 'qtbinpath = "${qttools.dev}/bin"' \
-      --replace 'rcc = os.path.join(qtbinpath, rcc_bin)' 'rcc = "${qtbase.dev}/libexec/rcc"'
-
     substituteInPlace src/apps/vpn/cmake/linux.cmake \
       --replace '/etc/xdg/autostart' "$out/etc/xdg/autostart" \
-      --replace '${"$"}{POLKIT_POLICY_DIR}' "$out/share/polkit-1/actions" \
       --replace '/usr/share/dbus-1' "$out/share/dbus-1" \
       --replace '${"$"}{SYSTEMD_UNIT_DIR}' "$out/lib/systemd/system"
 
     substituteInPlace extension/CMakeLists.txt \
       --replace '/etc' "$out/etc"
 
-    ln -s '${netfilter-go-modules}' linux/netfilter/vendor
+    ln -s '${netfilterGoModules}' linux/netfilter/vendor
 
     pushd extension/bridge
     cargoDepsCopy="$extensionBridgeDepsCopy" cargoSetupPostPatchHook
@@ -128,8 +126,8 @@ stdenv.mkDerivation {
     cargoDepsCopy="$signatureDepsCopy" cargoSetupPostPatchHook
     popd
 
-    pushd vpnglean
-    cargoDepsCopy="$vpngleanDepsCopy" cargoSetupPostPatchHook
+    pushd qtglean
+    cargoDepsCopy="$qtgleanDepsCopy" cargoSetupPostPatchHook
     popd
 
     cargoSetupPostPatchHook() { true; }