diff --git a/pkgs/applications/editors/openvi/default.nix b/pkgs/applications/editors/openvi/default.nix
index 3a522e8ff575..e361e8b4628c 100644
--- a/pkgs/applications/editors/openvi/default.nix
+++ b/pkgs/applications/editors/openvi/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openvi";
-  version = "7.5.29";
+  version = "7.6.30";
 
   src = fetchFromGitHub {
     owner = "johnsonjh";
     repo = "OpenVi";
     rev = version;
-    hash = "sha256-ukNgTtVrYkL7Bf7O7ERyQ9TOR8ss/EHCTMbzHi3tkG4=";
+    hash = "sha256-P4w/PM9UmHmTzS9+WDK3x3MyZ7OoY2yO/Rx0vRMJuLI=";
   };
 
   buildInputs = [ ncurses perl ];
diff --git a/pkgs/by-name/pa/paper-clip/package.nix b/pkgs/by-name/pa/paper-clip/package.nix
index 032bb9b5dbc4..d7376dde2226 100644
--- a/pkgs/by-name/pa/paper-clip/package.nix
+++ b/pkgs/by-name/pa/paper-clip/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "paper-clip";
-  version = "5.5";
+  version = "5.5.1";
 
   src = fetchFromGitHub {
     owner = "Diego-Ivan";
     repo = "Paper-Clip";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-WCnWWVYaKq4U2RG3S4Xfja0NvreJIqU2VUJzpX7KI/E=";
+    hash = "sha256-Jdsx5ZhujP0SgEtr4NMbXsTkMYrkQj7Vs+SSYziWpiw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/mbedtls/3.nix b/pkgs/development/libraries/mbedtls/3.nix
index f8f53522db13..9655393615b9 100644
--- a/pkgs/development/libraries/mbedtls/3.nix
+++ b/pkgs/development/libraries/mbedtls/3.nix
@@ -1,6 +1,6 @@
 { callPackage }:
 
 callPackage ./generic.nix {
-  version = "3.6.1";
-  hash = "sha256-SVWz2uOvGIplnBr4g6nwfxKMWVpzdZjusseAhw6GOJ8=";
+  version = "3.6.2";
+  hash = "sha256-tSWhF8i0Tx9QSFmyDEHdd2xveZvpyd+HXR+8xYj2Syo=";
 }
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 9a5f1c634dd7..3c4f37d789f4 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,19 +1,19 @@
 {
     "testing": {
-        "version": "6.12-rc3",
-        "hash": "sha256:11jspf9h3zmqnnyjardyk1g9k09fivwbl267iddb2ildfhgrlvqw"
+        "version": "6.12-rc4",
+        "hash": "sha256:0qr5sbpm512rlkylqmqhy644s4lmfr1igvmx8ds0mrb54h3qhkwk"
     },
     "6.1": {
-        "version": "6.1.113",
-        "hash": "sha256:0c4y8j65b3im0bf4ji4n7nfqaqa7c7ym2515li855k1g363i1bsl"
+        "version": "6.1.114",
+        "hash": "sha256:0mm2392qk01p9685bv9pilmvm5591br7kxyv4d8fdyx25shf91i2"
     },
     "5.15": {
-        "version": "5.15.168",
-        "hash": "sha256:0yp1705rjadv2v7hw2yq9n3bxgqzmlyam2bnp49p10jnfkavpgng"
+        "version": "5.15.169",
+        "hash": "sha256:0w2k4yrfrdnywbg3lqppig41yydy9c48v3jhfyach6zx8pccc676"
     },
     "5.10": {
-        "version": "5.10.227",
-        "hash": "sha256:1hknbfxq59731zmxgig7b69lfdmgh5jdg391hapvmlrh07hrvq2j"
+        "version": "5.10.228",
+        "hash": "sha256:0wkvn49sdy9ykyz6cqdqd9yplqfhc6b255w6wc17ky182mzqvk3n"
     },
     "5.4": {
         "version": "5.4.284",
@@ -24,8 +24,8 @@
         "hash": "sha256:0qj106lj554y1kdqj8kwyf7pk9bvrrpgz6s8zyh7d61mk7wws9sf"
     },
     "6.6": {
-        "version": "6.6.57",
-        "hash": "sha256:1cxpmgbp8hhwa045gappf2wzh3kk1iw2xivsxzhvi6bgz5p45kk6"
+        "version": "6.6.58",
+        "hash": "sha256:1nwrd017l5m4w12yrcf31y3g0l9xqm5b0fzcqdgan3ypi3jq3pz7"
     },
     "6.8": {
         "version": "6.8.12",
@@ -40,7 +40,7 @@
         "hash": "sha256:0gj2z9ax1qv59n2mld0pg2svwi28lbq92ql98vy7crynd2ybrram"
     },
     "6.11": {
-        "version": "6.11.4",
-        "hash": "sha256:0mcg1rrw9b0lwj88jkaw6ic2mks8xh8i92v90sbr2x35ljhb0m5x"
+        "version": "6.11.5",
+        "hash": "sha256:01rafnqal2v96dzkabz0irymq4sc9ja00ggyv1xn7yzjnyrqa527"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 5d4ebc214dc7..70b822870ec6 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -65,4 +65,14 @@
     name = "export-rt-sched-migrate";
     patch = ./export-rt-sched-migrate.patch;
   };
+
+  # Backport upstream fix for very annoying Tailscale issue
+  # FIXME: remove when merged upstream
+  netfilter-typo-fix = {
+    name = "netfilter-typo-fix";
+    patch = fetchpatch {
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/patch/?id=306ed1728e8438caed30332e1ab46b28c25fe3d8";
+      hash = "sha256-ZGc1xAIjf+MlV02jhIWZ4jHC742+z/WpN7RenqpU7e4=";
+    };
+  };
 }
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index d64a3a3240c4..bc71f74066e6 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -146,6 +146,7 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
+        kernelPatches.netfilter-typo-fix
       ];
     };
 
@@ -154,6 +155,7 @@ in {
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
         kernelPatches.export-rt-sched-migrate
+        kernelPatches.netfilter-typo-fix
       ];
     };
 
@@ -162,6 +164,7 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
+        kernelPatches.netfilter-typo-fix
       ];
     };
 
@@ -170,6 +173,7 @@ in {
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
         kernelPatches.export-rt-sched-migrate
+        kernelPatches.netfilter-typo-fix
       ];
     };
 
@@ -178,6 +182,7 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
+        kernelPatches.netfilter-typo-fix
       ];
     };
 
@@ -186,6 +191,7 @@ in {
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
         kernelPatches.export-rt-sched-migrate
+        kernelPatches.netfilter-typo-fix
       ];
     };
 
@@ -202,6 +208,7 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
+        kernelPatches.netfilter-typo-fix
       ];
     };
 
@@ -213,6 +220,7 @@ in {
         kernelPatches = [
           kernelPatches.bridge_stp_helper
           kernelPatches.request_key_helper
+          kernelPatches.netfilter-typo-fix
         ];
       };
       latest = packageAliases.linux_latest.kernel;