diff --git a/pkgs/by-name/am/amnezia-vpn/package.nix b/pkgs/by-name/am/amnezia-vpn/package.nix
index 73de41bbe6eb..0855cd8f657b 100644
--- a/pkgs/by-name/am/amnezia-vpn/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn/package.nix
@@ -12,7 +12,7 @@
   libssh,
   openssl,
   tun2socks,
-  v2ray-rules-dat,
+  xray-rules-dat,
   runtimeShell,
   callPackage,
   nix-update-script,
@@ -152,7 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Xray otherwise looks for geoip.dat and geosite.dat beside the service binary.
     substituteInPlace service/server/xray.cpp \
-      --replace-fail 'qDebug() << "Xray::startXray()";' $'qDebug() << "Xray::startXray()";\n    qputenv("XRAY_LOCATION_ASSET", QByteArrayLiteral("${v2ray-rules-dat}/share/v2ray"));'
+      --replace-fail 'qDebug() << "Xray::startXray()";' $'qDebug() << "Xray::startXray()";\n    qputenv("XRAY_LOCATION_ASSET", QByteArrayLiteral("${xray-rules-dat}/share/xray"));'
 
     # Link the Nix-built bindings directly instead of using a Conan package.
     substituteInPlace service/server/CMakeLists.txt \
diff --git a/pkgs/by-name/xr/xray-rules-dat/package.nix b/pkgs/by-name/xr/xray-rules-dat/package.nix
new file mode 100644
index 000000000000..715833ec6195
--- /dev/null
+++ b/pkgs/by-name/xr/xray-rules-dat/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+  nix-update-script,
+
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "xray-rules-dat";
+  version = "26.10.31";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchzip {
+    # We cannot use Xray-rules-dat releases directly because they are only kept for 7 days.
+    # The architecture doesn't matter since we only use geoip.dat and geosite.dat, so the smallest bundle is chosen.
+    url = "https://github.com/XTLS/Xray-core/releases/download/v${finalAttrs.version}/Xray-openbsd-arm64-v8a.zip";
+    hash = "sha256-3DI6jEb8+LlCK/+PQacX6CqhhfkNVBKH1xR9mY6u88g=";
+    stripRoot = false;
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/xray
+    ln -s ${finalAttrs.src}/geoip.dat $out/share/xray/geoip.dat
+    ln -s ${finalAttrs.src}/geosite.dat $out/share/xray/geosite.dat
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "GeoIP and GeoSite data for Xray";
+    homepage = "https://github.com/XTLS/Xray-rules-dat";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ nix-julia ];
+  };
+})
diff --git a/pkgs/by-name/xr/xray/package.nix b/pkgs/by-name/xr/xray/package.nix
index f399f2f30caa..cae2112d7a3f 100644
--- a/pkgs/by-name/xr/xray/package.nix
+++ b/pkgs/by-name/xr/xray/package.nix
@@ -5,24 +5,33 @@
   buildGo127Module,
   makeWrapper,
   nix-update-script,
-  v2ray-rules-dat,
+  xray-rules-dat,
   assets ? [
-    v2ray-rules-dat
+    xray-rules-dat
   ],
 }:
 
 buildGo127Module (finalAttrs: {
   pname = "xray";
-  version = "26.9.9";
+  version = "26.10.31";
 
   src = fetchFromGitHub {
     owner = "XTLS";
     repo = "Xray-core";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GqPEAgWM9Wx19uxMj0LGeOyHreLbU0IMSmalwLe/SIc=";
+    hash = "sha256-wTKW8XUP/HXWI7e4jbBw3aGSPpPX7KjkxFwLMb9vxSA=";
   };
 
-  vendorHash = "sha256-6Qa05hFdvfLlH8WQd426IU7MScmeevIgrgP5037pNek=";
+  vendorHash = "sha256-+beH/Cfu3YLo6CmP/vFo0ULQ89NzZ8MFPfTYs+V/Sow=";
+
+  patches = [
+    ./use-system-certs.patch
+  ];
+
+  postPatch = ''
+    sed -i '/golang\.org\/x\/crypto\/x509roots\/fallback/d' go.mod
+    sed -i '/golang\.org\/x\/crypto\/x509roots\/fallback/d' go.sum
+  '';
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -41,14 +50,14 @@ buildGo127Module (finalAttrs: {
   '';
 
   assetsDrv = symlinkJoin {
-    name = "v2ray-assets";
+    name = "xray-assets";
     paths = assets;
   };
 
   postFixup = ''
     wrapProgram $out/bin/xray \
-      --set-default V2RAY_LOCATION_ASSET $assetsDrv/share/v2ray \
-      --set-default XRAY_LOCATION_ASSET $assetsDrv/share/v2ray
+      --set-default V2RAY_LOCATION_ASSET $assetsDrv/share/xray \
+      --set-default XRAY_LOCATION_ASSET $assetsDrv/share/xray
   '';
 
   passthru = {
@@ -60,6 +69,9 @@ buildGo127Module (finalAttrs: {
     mainProgram = "xray";
     homepage = "https://github.com/XTLS/Xray-core";
     license = lib.licenses.mpl20;
-    maintainers = with lib.maintainers; [ iopq ];
+    maintainers = with lib.maintainers; [
+      iopq
+      nix-julia
+    ];
   };
 })
diff --git a/pkgs/by-name/xr/xray/use-system-certs.patch b/pkgs/by-name/xr/xray/use-system-certs.patch
new file mode 100644
index 000000000000..8fbb53fb75c8
--- /dev/null
+++ b/pkgs/by-name/xr/xray/use-system-certs.patch
@@ -0,0 +1,54 @@
+diff --git a/transport/internet/tls/config.go b/transport/internet/tls/config.go
+index 71bd6cec..e48eb4cd 100644
+--- a/transport/internet/tls/config.go
++++ b/transport/internet/tls/config.go
+@@ -19,7 +19,6 @@ import (
+ 	"github.com/xtls/xray-core/common/platform/filesystem"
+ 	"github.com/xtls/xray-core/common/protocol/tls/cert"
+ 	"github.com/xtls/xray-core/transport/internet"
+-	"golang.org/x/crypto/x509roots/fallback/bundle"
+ )
+ 
+ var globalSessionCache = tls.NewLRUClientSessionCache(128)
+@@ -580,38 +579,17 @@ func verifyChain(certs []*x509.Certificate, pinnedPeerCertSha256 [][]byte) (veri
+ 	return certNotFound, nil
+ }
+ 
+-var bundleCertPool = sync.OnceValue(func() *x509.CertPool {
+-	pool := x509.NewCertPool()
+-	for r := range bundle.Roots() {
+-		cert, err := x509.ParseCertificate(r.Certificate)
+-		if err != nil {
+-			continue
+-		}
+-		if r.Constraint != nil {
+-			pool.AddCertWithConstraint(cert, r.Constraint)
+-		} else {
+-			pool.AddCert(cert)
+-		}
+-	}
+-	return pool
+-})
+-
+ var systemCertPool = sync.OnceValue(func() *x509.CertPool {
+ 	pool, err := x509.SystemCertPool()
+ 	if err != nil {
+-		// use bundle cert pool as fallback
+-		pool = bundleCertPool()
++		panic("This panic is related to a specific nixpkgs patch. Please create an issue in the nixpkgs repository. Reference: https://github.com/NixOS/nixpkgs/pull/576986")
+ 	}
+ 	return pool
+ })
+ 
+ // pool should not be modified directly, use CertPool.Clone() if needed.
+-func loadCA(useSystem bool) *x509.CertPool {
++func loadCA(_ bool) *x509.CertPool {
+ 	var pool *x509.CertPool
+-	if useSystem {
+-		pool = systemCertPool()
+-	} else {
+-		pool = bundleCertPool()
+-	}
++	pool = systemCertPool()
+ 	return pool
+ }