diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 843c86b6ef5a..6f78f44c5670 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2451,6 +2451,12 @@
     githubId = 206242;
     name = "Andreas Wiese";
   };
+  awwpotato = {
+    email = "awwpotato@voidq.com";
+    github = "awwpotato";
+    githubId = 153149335;
+    name = "awwpotato";
+  };
   axertheaxe = {
     email = "axertheaxe@proton.me";
     github = "AxerTheAxe";
diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index 3fd252086518..5853940e6758 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -790,12 +790,12 @@ in
       ++ concatLists (
         flip mapAttrsToList (filterPresent cfg.provision.systems.oauth2) (
           oauth2: oauth2Cfg:
-          (optionals (cfg.provision.extraJsonFile == null) (
+          (optional (cfg.provision.extraJsonFile == null) (
             assertGroupsKnown "services.kanidm.provision.systems.oauth2.${oauth2}.scopeMaps" (
               attrNames oauth2Cfg.scopeMaps
             )
           ))
-          ++ (optionals (cfg.provision.extraJsonFile == null) (
+          ++ (optional (cfg.provision.extraJsonFile == null) (
             assertGroupsKnown "services.kanidm.provision.systems.oauth2.${oauth2}.supplementaryScopeMaps" (
               attrNames oauth2Cfg.supplementaryScopeMaps
             )
diff --git a/nixos/tests/acme-dns.nix b/nixos/tests/acme-dns.nix
index 16c33c8460e5..cb65d1bd460c 100644
--- a/nixos/tests/acme-dns.nix
+++ b/nixos/tests/acme-dns.nix
@@ -1,58 +1,55 @@
-import ./make-test-python.nix (
-  { ... }:
-  {
-    name = "acme-dns";
+{
+  name = "acme-dns";
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.acme-dns = {
-          enable = true;
-          settings = {
-            general = rec {
-              domain = "acme-dns.home.arpa";
-              nsname = domain;
-              nsadmin = "admin.home.arpa";
-              records = [
-                "${domain}. A 127.0.0.1"
-                "${domain}. AAAA ::1"
-                "${domain}. NS ${domain}."
-              ];
-            };
-            logconfig.loglevel = "debug";
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.acme-dns = {
+        enable = true;
+        settings = {
+          general = rec {
+            domain = "acme-dns.home.arpa";
+            nsname = domain;
+            nsadmin = "admin.home.arpa";
+            records = [
+              "${domain}. A 127.0.0.1"
+              "${domain}. AAAA ::1"
+              "${domain}. NS ${domain}."
+            ];
           };
+          logconfig.loglevel = "debug";
         };
-        environment.systemPackages = with pkgs; [
-          curl
-          bind
-        ];
       };
+      environment.systemPackages = with pkgs; [
+        curl
+        bind
+      ];
+    };
 
-    testScript = ''
-      import json
+  testScript = ''
+    import json
 
-      machine.wait_for_unit("acme-dns.service")
-      machine.wait_for_open_port(53) # dns
-      machine.wait_for_open_port(8080) # http api
+    machine.wait_for_unit("acme-dns.service")
+    machine.wait_for_open_port(53) # dns
+    machine.wait_for_open_port(8080) # http api
 
-      result = machine.succeed("curl --fail -X POST http://localhost:8080/register")
-      print(result)
+    result = machine.succeed("curl --fail -X POST http://localhost:8080/register")
+    print(result)
 
-      registration = json.loads(result)
+    registration = json.loads(result)
 
-      machine.succeed(f'dig -t TXT @localhost {registration["fulldomain"]} | grep "SOA" | grep "admin.home.arpa"')
+    machine.succeed(f'dig -t TXT @localhost {registration["fulldomain"]} | grep "SOA" | grep "admin.home.arpa"')
 
-      # acme-dns exspects a TXT value string length of exactly 43 chars
-      txt = "___dummy_validation_token_for_txt_record___"
+    # acme-dns exspects a TXT value string length of exactly 43 chars
+    txt = "___dummy_validation_token_for_txt_record___"
 
-      machine.succeed(
-        "curl --fail -X POST http://localhost:8080/update "
-        + f' -H "X-Api-User: {registration["username"]}"'
-        + f' -H "X-Api-Key: {registration["password"]}"'
-        + f' -d \'{{"subdomain":"{registration["subdomain"]}", "txt":"{txt}"}}\'''
-      )
+    machine.succeed(
+      "curl --fail -X POST http://localhost:8080/update "
+      + f' -H "X-Api-User: {registration["username"]}"'
+      + f' -H "X-Api-Key: {registration["password"]}"'
+      + f' -d \'{{"subdomain":"{registration["subdomain"]}", "txt":"{txt}"}}\'''
+    )
 
-      assert txt in machine.succeed(f'dig -t TXT +short @localhost {registration["fulldomain"]}')
-    '';
-  }
-)
+    assert txt in machine.succeed(f'dig -t TXT +short @localhost {registration["fulldomain"]}')
+  '';
+}
diff --git a/nixos/tests/actual.nix b/nixos/tests/actual.nix
index b8ee303f8127..26ddcb3d236e 100644
--- a/nixos/tests/actual.nix
+++ b/nixos/tests/actual.nix
@@ -1,18 +1,16 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "actual";
-    meta.maintainers = [ lib.maintainers.oddlama ];
+{ lib, ... }:
+{
+  name = "actual";
+  meta.maintainers = [ lib.maintainers.oddlama ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.actual.enable = true;
-      };
+  nodes.machine =
+    { ... }:
+    {
+      services.actual.enable = true;
+    };
 
-    testScript = ''
-      machine.wait_for_open_port(3000)
-      machine.succeed("curl -fvvv -Ls http://localhost:3000/ | grep 'Actual'")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_open_port(3000)
+    machine.succeed("curl -fvvv -Ls http://localhost:3000/ | grep 'Actual'")
+  '';
+}
diff --git a/nixos/tests/agda.nix b/nixos/tests/agda.nix
index 3f48c8353b63..dfc733f4f576 100644
--- a/nixos/tests/agda.nix
+++ b/nixos/tests/agda.nix
@@ -1,49 +1,47 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    hello-world = pkgs.writeText "hello-world" ''
-      {-# OPTIONS --guardedness #-}
-      open import IO
-      open import Level
+let
+  hello-world = pkgs.writeText "hello-world" ''
+    {-# OPTIONS --guardedness #-}
+    open import IO
+    open import Level
 
-      main = run {0ℓ} (putStrLn "Hello World!")
-    '';
-  in
-  {
-    name = "agda";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        alexarice
-        turion
+    main = run {0ℓ} (putStrLn "Hello World!")
+  '';
+in
+{
+  name = "agda";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      alexarice
+      turion
+    ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        (pkgs.agda.withPackages {
+          pkgs = p: [ p.standard-library ];
+        })
       ];
+      virtualisation.memorySize = 2000; # Agda uses a lot of memory
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [
-          (pkgs.agda.withPackages {
-            pkgs = p: [ p.standard-library ];
-          })
-        ];
-        virtualisation.memorySize = 2000; # Agda uses a lot of memory
-      };
+  testScript = ''
+    # Minimal script that typechecks
+    machine.succeed("touch TestEmpty.agda")
+    machine.succeed("agda TestEmpty.agda")
 
-    testScript = ''
-      # Minimal script that typechecks
-      machine.succeed("touch TestEmpty.agda")
-      machine.succeed("agda TestEmpty.agda")
-
-      # Hello world
-      machine.succeed(
-          "cp ${hello-world} HelloWorld.agda"
-      )
-      machine.succeed("agda -l standard-library -i . -c HelloWorld.agda")
-      # Check execution
-      assert "Hello World!" in machine.succeed(
-          "./HelloWorld"
-      ), "HelloWorld does not run properly"
-    '';
-  }
-)
+    # Hello world
+    machine.succeed(
+        "cp ${hello-world} HelloWorld.agda"
+    )
+    machine.succeed("agda -l standard-library -i . -c HelloWorld.agda")
+    # Check execution
+    assert "Hello World!" in machine.succeed(
+        "./HelloWorld"
+    ), "HelloWorld does not run properly"
+  '';
+}
diff --git a/nixos/tests/airsonic.nix b/nixos/tests/airsonic.nix
index d214d5d1e1f7..26e6aa7bfc44 100644
--- a/nixos/tests/airsonic.nix
+++ b/nixos/tests/airsonic.nix
@@ -1,32 +1,30 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "airsonic";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ sumnerevans ];
+{ pkgs, ... }:
+{
+  name = "airsonic";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ sumnerevans ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.airsonic = {
+        enable = true;
+        maxMemory = 800;
+      };
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.airsonic = {
-          enable = true;
-          maxMemory = 800;
-        };
-      };
-
-    testScript = ''
-      def airsonic_is_up(_) -> bool:
-          status, _ = machine.execute("curl --fail http://localhost:4040/login")
-          return status == 0
+  testScript = ''
+    def airsonic_is_up(_) -> bool:
+        status, _ = machine.execute("curl --fail http://localhost:4040/login")
+        return status == 0
 
 
-      machine.start()
-      machine.wait_for_unit("airsonic.service")
-      machine.wait_for_open_port(4040)
+    machine.start()
+    machine.wait_for_unit("airsonic.service")
+    machine.wait_for_open_port(4040)
 
-      with machine.nested("Waiting for UI to work"):
-          retry(airsonic_is_up)
-    '';
-  }
-)
+    with machine.nested("Waiting for UI to work"):
+        retry(airsonic_is_up)
+  '';
+}
diff --git a/nixos/tests/alice-lg.nix b/nixos/tests/alice-lg.nix
index 7397ed3779dc..f2f21e3e61a2 100644
--- a/nixos/tests/alice-lg.nix
+++ b/nixos/tests/alice-lg.nix
@@ -1,18 +1,10 @@
 # This test does a basic functionality check for alice-lg
-
 {
-  system ? builtins.currentSystem,
-  pkgs ? import ../.. {
-    inherit system;
-    config = { };
-  },
+  pkgs,
+  ...
 }:
 
-let
-  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
-  inherit (pkgs.lib) optionalString;
-in
-makeTest {
+{
   name = "alice-lg";
   nodes = {
     host1 = {
diff --git a/nixos/tests/all-terminfo.nix b/nixos/tests/all-terminfo.nix
index 9eddb6be94f6..4b547ee47d2c 100644
--- a/nixos/tests/all-terminfo.nix
+++ b/nixos/tests/all-terminfo.nix
@@ -1,48 +1,46 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  rec {
-    name = "all-terminfo";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ jkarlson ];
+{ pkgs, ... }:
+{
+  name = "all-terminfo";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jkarlson ];
+  };
+
+  nodes.machine =
+    {
+      pkgs,
+      config,
+      lib,
+      ...
+    }:
+    let
+      infoFilter =
+        name: drv:
+        let
+          o = builtins.tryEval drv;
+        in
+        o.success
+        && lib.isDerivation o.value
+        && o.value ? outputs
+        && builtins.elem "terminfo" o.value.outputs
+        && !o.value.meta.broken;
+      terminfos = lib.filterAttrs infoFilter pkgs;
+      excludedTerminfos = lib.filterAttrs (
+        _: drv: !(builtins.elem drv.terminfo config.environment.systemPackages)
+      ) terminfos;
+      includedOuts = lib.filterAttrs (
+        _: drv: builtins.elem drv.out config.environment.systemPackages
+      ) terminfos;
+    in
+    {
+      environment = {
+        enableAllTerminfo = true;
+        etc."terminfo-missing".text = builtins.concatStringsSep "\n" (builtins.attrNames excludedTerminfos);
+        etc."terminfo-extra-outs".text = builtins.concatStringsSep "\n" (builtins.attrNames includedOuts);
+      };
     };
 
-    nodes.machine =
-      {
-        pkgs,
-        config,
-        lib,
-        ...
-      }:
-      let
-        infoFilter =
-          name: drv:
-          let
-            o = builtins.tryEval drv;
-          in
-          o.success
-          && lib.isDerivation o.value
-          && o.value ? outputs
-          && builtins.elem "terminfo" o.value.outputs
-          && !o.value.meta.broken;
-        terminfos = lib.filterAttrs infoFilter pkgs;
-        excludedTerminfos = lib.filterAttrs (
-          _: drv: !(builtins.elem drv.terminfo config.environment.systemPackages)
-        ) terminfos;
-        includedOuts = lib.filterAttrs (
-          _: drv: builtins.elem drv.out config.environment.systemPackages
-        ) terminfos;
-      in
-      {
-        environment = {
-          enableAllTerminfo = true;
-          etc."terminfo-missing".text = builtins.concatStringsSep "\n" (builtins.attrNames excludedTerminfos);
-          etc."terminfo-extra-outs".text = builtins.concatStringsSep "\n" (builtins.attrNames includedOuts);
-        };
-      };
-
-    testScript = ''
-      machine.fail("grep . /etc/terminfo-missing >&2")
-      machine.fail("grep . /etc/terminfo-extra-outs >&2")
-    '';
-  }
-)
+  testScript = ''
+    machine.fail("grep . /etc/terminfo-missing >&2")
+    machine.fail("grep . /etc/terminfo-extra-outs >&2")
+  '';
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index f1e11ba0ccd3..65c02c1d9405 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -147,48 +147,54 @@ in {
   _3proxy = runTest ./3proxy.nix;
   aaaaxy = runTest ./aaaaxy.nix;
   acme = import ./acme/default.nix { inherit runTest; };
-  acme-dns = handleTest ./acme-dns.nix {};
-  actual = handleTest ./actual.nix {};
+  acme-dns = runTest ./acme-dns.nix;
+  actual = runTest ./actual.nix;
   adguardhome = runTest ./adguardhome.nix;
   aesmd = runTestOn ["x86_64-linux"] ./aesmd.nix;
   agate = runTest ./web-servers/agate.nix;
-  agda = handleTest ./agda.nix {};
+  agda = runTest ./agda.nix;
   age-plugin-tpm-decrypt = runTest ./age-plugin-tpm-decrypt.nix;
   agorakit = runTest ./web-apps/agorakit.nix;
-  airsonic = handleTest ./airsonic.nix {};
+  airsonic = runTest ./airsonic.nix;
   akkoma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./akkoma.nix {};
   akkoma-confined = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./akkoma.nix { confined = true; };
-  alice-lg = handleTest ./alice-lg.nix {};
-  alloy = handleTest ./alloy.nix {};
-  allTerminfo = handleTest ./all-terminfo.nix {};
-  alps = handleTest ./alps.nix {};
-  amazon-cloudwatch-agent = handleTest ./amazon-cloudwatch-agent.nix {};
-  amazon-init-shell = handleTest ./amazon-init-shell.nix {};
-  amazon-ssm-agent = handleTest ./amazon-ssm-agent.nix {};
+  alice-lg = runTest ./alice-lg.nix;
+  alloy = runTest ./alloy.nix;
+  allTerminfo = runTest ./all-terminfo.nix;
+  alps = runTest ./alps.nix;
+  amazon-cloudwatch-agent = runTest ./amazon-cloudwatch-agent.nix;
+  amazon-init-shell = runTest ./amazon-init-shell.nix;
+  amazon-ssm-agent = runTest ./amazon-ssm-agent.nix;
   amd-sev = runTest ./amd-sev.nix;
-  angie-api = handleTest ./angie-api.nix {};
-  anki-sync-server = handleTest ./anki-sync-server.nix {};
-  anuko-time-tracker = handleTest ./anuko-time-tracker.nix {};
-  apcupsd = handleTest ./apcupsd.nix {};
+  angie-api = runTest ./angie-api.nix;
+  anki-sync-server = runTest ./anki-sync-server.nix;
+  anuko-time-tracker = runTest ./anuko-time-tracker.nix;
+  apcupsd = runTest ./apcupsd.nix;
   apfs = runTest ./apfs.nix;
   appliance-repart-image = runTest ./appliance-repart-image.nix;
   appliance-repart-image-verity-store = runTest ./appliance-repart-image-verity-store.nix;
-  apparmor = handleTest ./apparmor {};
-  archi = handleTest ./archi.nix {};
-  aria2 = handleTest ./aria2.nix {};
-  armagetronad = handleTest ./armagetronad.nix {};
+  apparmor = runTest ./apparmor;
+  archi = runTest ./archi.nix;
+  aria2 = runTest ./aria2.nix;
+  armagetronad = runTest ./armagetronad.nix;
   artalk = runTest ./artalk.nix;
-  atd = handleTest ./atd.nix {};
+  atd = runTest ./atd.nix;
   atop = handleTest ./atop.nix {};
   atticd = runTest ./atticd.nix;
   atuin = runTest ./atuin.nix;
-  audiobookshelf = handleTest ./audiobookshelf.nix {};
-  auth-mysql = handleTest ./auth-mysql.nix {};
-  authelia = handleTest ./authelia.nix {};
-  auto-cpufreq = handleTest ./auto-cpufreq.nix {};
-  autobrr = handleTest ./autobrr.nix {};
-  avahi = handleTest ./avahi.nix {};
-  avahi-with-resolved = handleTest ./avahi.nix { networkd = true; };
+  audiobookshelf = runTest ./audiobookshelf.nix;
+  auth-mysql = runTest ./auth-mysql.nix;
+  authelia = runTest ./authelia.nix;
+  auto-cpufreq = runTest ./auto-cpufreq.nix;
+  autobrr = runTest ./autobrr.nix;
+  avahi = runTest {
+    imports = [ ./avahi.nix ];
+    _module.args.networkd = false;
+  };
+  avahi-with-resolved = runTest {
+    imports = [ ./avahi.nix ];
+    _module.args.networkd = true;
+  };
   ayatana-indicators = runTest ./ayatana-indicators.nix;
   babeld = runTest ./babeld.nix;
   bazarr = handleTest ./bazarr.nix {};
diff --git a/nixos/tests/alloy.nix b/nixos/tests/alloy.nix
index d6595c61f991..aad9568ef471 100644
--- a/nixos/tests/alloy.nix
+++ b/nixos/tests/alloy.nix
@@ -1,37 +1,35 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, ... }:
 
-  let
-    nodes = {
-      machine = {
-        services.alloy = {
-          enable = true;
-        };
-        environment.etc."alloy/config.alloy".text = "";
+let
+  nodes = {
+    machine = {
+      services.alloy = {
+        enable = true;
       };
+      environment.etc."alloy/config.alloy".text = "";
     };
-  in
-  {
-    name = "alloy";
+  };
+in
+{
+  name = "alloy";
 
-    meta = with lib.maintainers; {
-      maintainers = [
-        flokli
-        hbjydev
-      ];
-    };
+  meta = with lib.maintainers; {
+    maintainers = [
+      flokli
+      hbjydev
+    ];
+  };
 
-    inherit nodes;
+  inherit nodes;
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine.wait_for_unit("alloy.service")
-      machine.wait_for_open_port(12345)
-      machine.succeed(
-          "curl -sSfN http://127.0.0.1:12345/-/healthy"
-      )
-      machine.shutdown()
-    '';
-  }
-)
+    machine.wait_for_unit("alloy.service")
+    machine.wait_for_open_port(12345)
+    machine.succeed(
+        "curl -sSfN http://127.0.0.1:12345/-/healthy"
+    )
+    machine.shutdown()
+  '';
+}
diff --git a/nixos/tests/alps.nix b/nixos/tests/alps.nix
index 3e990cea8035..fd4ee51e6e20 100644
--- a/nixos/tests/alps.nix
+++ b/nixos/tests/alps.nix
@@ -2,118 +2,116 @@ let
   certs = import ./common/acme/server/snakeoil-certs.nix;
   domain = certs.domain;
 in
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "alps";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ hmenke ];
+{ pkgs, ... }:
+{
+  name = "alps";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ hmenke ];
+  };
+
+  nodes = {
+    server = {
+      imports = [ ./common/user-account.nix ];
+      security.pki.certificateFiles = [
+        certs.ca.cert
+      ];
+      networking.extraHosts = ''
+        127.0.0.1 ${domain}
+      '';
+      networking.firewall.allowedTCPPorts = [
+        25
+        465
+        993
+      ];
+      services.postfix = {
+        enable = true;
+        enableSubmission = true;
+        enableSubmissions = true;
+        tlsTrustedAuthorities = "${certs.ca.cert}";
+        sslCert = "${certs.${domain}.cert}";
+        sslKey = "${certs.${domain}.key}";
+      };
+      services.dovecot2 = {
+        enable = true;
+        enableImap = true;
+        sslCACert = "${certs.ca.cert}";
+        sslServerCert = "${certs.${domain}.cert}";
+        sslServerKey = "${certs.${domain}.key}";
+      };
     };
 
-    nodes = {
-      server = {
-        imports = [ ./common/user-account.nix ];
+    client =
+      { nodes, config, ... }:
+      {
         security.pki.certificateFiles = [
           certs.ca.cert
         ];
         networking.extraHosts = ''
-          127.0.0.1 ${domain}
+          ${nodes.server.config.networking.primaryIPAddress} ${domain}
         '';
-        networking.firewall.allowedTCPPorts = [
-          25
-          465
-          993
-        ];
-        services.postfix = {
+        services.alps = {
           enable = true;
-          enableSubmission = true;
-          enableSubmissions = true;
-          tlsTrustedAuthorities = "${certs.ca.cert}";
-          sslCert = "${certs.${domain}.cert}";
-          sslKey = "${certs.${domain}.key}";
-        };
-        services.dovecot2 = {
-          enable = true;
-          enableImap = true;
-          sslCACert = "${certs.ca.cert}";
-          sslServerCert = "${certs.${domain}.cert}";
-          sslServerKey = "${certs.${domain}.key}";
-        };
-      };
-
-      client =
-        { nodes, config, ... }:
-        {
-          security.pki.certificateFiles = [
-            certs.ca.cert
-          ];
-          networking.extraHosts = ''
-            ${nodes.server.config.networking.primaryIPAddress} ${domain}
-          '';
-          services.alps = {
-            enable = true;
-            theme = "alps";
-            imaps = {
-              host = domain;
-              port = 993;
-            };
-            smtps = {
-              host = domain;
-              port = 465;
-            };
+          theme = "alps";
+          imaps = {
+            host = domain;
+            port = 993;
+          };
+          smtps = {
+            host = domain;
+            port = 465;
           };
-          environment.systemPackages = [
-            (pkgs.writers.writePython3Bin "test-alps-login" { } ''
-              from urllib.request import build_opener, HTTPCookieProcessor, Request
-              from urllib.parse import urlencode, urljoin
-              from http.cookiejar import CookieJar
-
-              baseurl = "http://localhost:${toString config.services.alps.port}"
-              username = "alice"
-              password = "${nodes.server.config.users.users.alice.password}"
-              cookiejar = CookieJar()
-              cookieprocessor = HTTPCookieProcessor(cookiejar)
-              opener = build_opener(cookieprocessor)
-
-              data = urlencode({"username": username, "password": password}).encode()
-              req = Request(urljoin(baseurl, "login"), data=data, method="POST")
-              with opener.open(req) as ret:
-                  # Check that the alps_session cookie is set
-                  print(cookiejar)
-                  assert any(cookie.name == "alps_session" for cookie in cookiejar)
-
-              req = Request(baseurl)
-              with opener.open(req) as ret:
-                  # Check that the alps_session cookie is still there...
-                  print(cookiejar)
-                  assert any(cookie.name == "alps_session" for cookie in cookiejar)
-                  # ...and that we have not been redirected back to the login page
-                  print(ret.url)
-                  assert ret.url == urljoin(baseurl, "mailbox/INBOX")
-
-              req = Request(urljoin(baseurl, "logout"))
-              with opener.open(req) as ret:
-                  # Check that the alps_session cookie is now gone
-                  print(cookiejar)
-                  assert all(cookie.name != "alps_session" for cookie in cookiejar)
-            '')
-          ];
         };
-    };
+        environment.systemPackages = [
+          (pkgs.writers.writePython3Bin "test-alps-login" { } ''
+            from urllib.request import build_opener, HTTPCookieProcessor, Request
+            from urllib.parse import urlencode, urljoin
+            from http.cookiejar import CookieJar
 
-    testScript =
-      { nodes, ... }:
-      ''
-        server.start()
-        server.wait_for_unit("postfix.service")
-        server.wait_for_unit("dovecot2.service")
-        server.wait_for_open_port(465)
-        server.wait_for_open_port(993)
+            baseurl = "http://localhost:${toString config.services.alps.port}"
+            username = "alice"
+            password = "${nodes.server.config.users.users.alice.password}"
+            cookiejar = CookieJar()
+            cookieprocessor = HTTPCookieProcessor(cookiejar)
+            opener = build_opener(cookieprocessor)
 
-        client.start()
-        client.wait_for_unit("alps.service")
-        client.wait_for_open_port(${toString nodes.client.config.services.alps.port})
-        client.succeed("test-alps-login")
-      '';
-  }
-)
+            data = urlencode({"username": username, "password": password}).encode()
+            req = Request(urljoin(baseurl, "login"), data=data, method="POST")
+            with opener.open(req) as ret:
+                # Check that the alps_session cookie is set
+                print(cookiejar)
+                assert any(cookie.name == "alps_session" for cookie in cookiejar)
+
+            req = Request(baseurl)
+            with opener.open(req) as ret:
+                # Check that the alps_session cookie is still there...
+                print(cookiejar)
+                assert any(cookie.name == "alps_session" for cookie in cookiejar)
+                # ...and that we have not been redirected back to the login page
+                print(ret.url)
+                assert ret.url == urljoin(baseurl, "mailbox/INBOX")
+
+            req = Request(urljoin(baseurl, "logout"))
+            with opener.open(req) as ret:
+                # Check that the alps_session cookie is now gone
+                print(cookiejar)
+                assert all(cookie.name != "alps_session" for cookie in cookiejar)
+          '')
+        ];
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      server.start()
+      server.wait_for_unit("postfix.service")
+      server.wait_for_unit("dovecot2.service")
+      server.wait_for_open_port(465)
+      server.wait_for_open_port(993)
+
+      client.start()
+      client.wait_for_unit("alps.service")
+      client.wait_for_open_port(${toString nodes.client.config.services.alps.port})
+      client.succeed("test-alps-login")
+    '';
+}
diff --git a/nixos/tests/amazon-cloudwatch-agent.nix b/nixos/tests/amazon-cloudwatch-agent.nix
index 199f74c9b2a6..ecb4e7c8c8d1 100644
--- a/nixos/tests/amazon-cloudwatch-agent.nix
+++ b/nixos/tests/amazon-cloudwatch-agent.nix
@@ -1,92 +1,90 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    # See https://docs.aws.amazon.com/sdkref/latest/guide/file-format.html.
-    iniFormat = pkgs.formats.ini { };
+{ pkgs, ... }:
+let
+  # See https://docs.aws.amazon.com/sdkref/latest/guide/file-format.html.
+  iniFormat = pkgs.formats.ini { };
 
-    region = "ap-northeast-1";
-    sharedConfigurationDefaultProfile = "default";
-    sharedConfigurationFile = iniFormat.generate "config" {
-      "${sharedConfigurationDefaultProfile}" = {
-        region = region;
-      };
+  region = "ap-northeast-1";
+  sharedConfigurationDefaultProfile = "default";
+  sharedConfigurationFile = iniFormat.generate "config" {
+    "${sharedConfigurationDefaultProfile}" = {
+      region = region;
     };
-    sharedCredentialsFile = iniFormat.generate "credentials" {
-      "${sharedConfigurationDefaultProfile}" = {
-        aws_access_key_id = "placeholder";
-        aws_secret_access_key = "placeholder";
-        aws_session_token = "placeholder";
-      };
+  };
+  sharedCredentialsFile = iniFormat.generate "credentials" {
+    "${sharedConfigurationDefaultProfile}" = {
+      aws_access_key_id = "placeholder";
+      aws_secret_access_key = "placeholder";
+      aws_session_token = "placeholder";
     };
-    sharedConfigurationDirectory = pkgs.runCommand ".aws" { } ''
-      mkdir $out
+  };
+  sharedConfigurationDirectory = pkgs.runCommand ".aws" { } ''
+    mkdir $out
 
-      cp ${sharedConfigurationFile} $out/config
-      cp ${sharedCredentialsFile} $out/credentials
-    '';
-  in
-  {
-    name = "amazon-cloudwatch-agent";
+    cp ${sharedConfigurationFile} $out/config
+    cp ${sharedCredentialsFile} $out/credentials
+  '';
+in
+{
+  name = "amazon-cloudwatch-agent";
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        services.amazon-cloudwatch-agent = {
-          enable = true;
-          commonConfiguration = {
-            credentials = {
-              shared_credential_profile = sharedConfigurationDefaultProfile;
-              shared_credential_file = "${sharedConfigurationDirectory}/credentials";
-            };
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      services.amazon-cloudwatch-agent = {
+        enable = true;
+        commonConfiguration = {
+          credentials = {
+            shared_credential_profile = sharedConfigurationDefaultProfile;
+            shared_credential_file = "${sharedConfigurationDirectory}/credentials";
           };
-          configuration = {
-            agent = {
-              # Required despite documentation saying the agent ignores it in "onPremise" mode.
-              region = region;
-
-              # Show debug logs and write to a file for interactive debugging.
-              debug = true;
-              logfile = "/var/log/amazon-cloudwatch-agent/amazon-cloudwatch-agent.log";
-            };
-            logs = {
-              logs_collected = {
-                files = {
-                  collect_list = [
-                    {
-                      file_path = "/var/log/amazon-cloudwatch-agent/amazon-cloudwatch-agent.log";
-                      log_group_name = "/var/log/amazon-cloudwatch-agent/amazon-cloudwatch-agent.log";
-                      log_stream_name = "{local_hostname}";
-                    }
-                  ];
-                };
-              };
-            };
-            traces = {
-              local_mode = true;
-              traces_collected = {
-                xray = { };
-              };
-            };
-          };
-          mode = "onPremise";
         };
+        configuration = {
+          agent = {
+            # Required despite documentation saying the agent ignores it in "onPremise" mode.
+            region = region;
 
-        # Keep the runtime directory for interactive debugging.
-        systemd.services.amazon-cloudwatch-agent.serviceConfig.RuntimeDirectoryPreserve = true;
+            # Show debug logs and write to a file for interactive debugging.
+            debug = true;
+            logfile = "/var/log/amazon-cloudwatch-agent/amazon-cloudwatch-agent.log";
+          };
+          logs = {
+            logs_collected = {
+              files = {
+                collect_list = [
+                  {
+                    file_path = "/var/log/amazon-cloudwatch-agent/amazon-cloudwatch-agent.log";
+                    log_group_name = "/var/log/amazon-cloudwatch-agent/amazon-cloudwatch-agent.log";
+                    log_stream_name = "{local_hostname}";
+                  }
+                ];
+              };
+            };
+          };
+          traces = {
+            local_mode = true;
+            traces_collected = {
+              xray = { };
+            };
+          };
+        };
+        mode = "onPremise";
       };
 
-    testScript = ''
-      start_all()
+      # Keep the runtime directory for interactive debugging.
+      systemd.services.amazon-cloudwatch-agent.serviceConfig.RuntimeDirectoryPreserve = true;
+    };
 
-      machine.wait_for_unit("amazon-cloudwatch-agent.service")
+  testScript = ''
+    start_all()
 
-      machine.wait_for_file("/run/amazon-cloudwatch-agent/amazon-cloudwatch-agent.pid")
-      machine.wait_for_file("/run/amazon-cloudwatch-agent/amazon-cloudwatch-agent.toml")
-      # "config-translator" omits this file if no trace configurations are specified.
-      #
-      # See https://github.com/aws/amazon-cloudwatch-agent/issues/1320.
-      machine.wait_for_file("/run/amazon-cloudwatch-agent/amazon-cloudwatch-agent.yaml")
-      machine.wait_for_file("/run/amazon-cloudwatch-agent/env-config.json")
-    '';
-  }
-)
+    machine.wait_for_unit("amazon-cloudwatch-agent.service")
+
+    machine.wait_for_file("/run/amazon-cloudwatch-agent/amazon-cloudwatch-agent.pid")
+    machine.wait_for_file("/run/amazon-cloudwatch-agent/amazon-cloudwatch-agent.toml")
+    # "config-translator" omits this file if no trace configurations are specified.
+    #
+    # See https://github.com/aws/amazon-cloudwatch-agent/issues/1320.
+    machine.wait_for_file("/run/amazon-cloudwatch-agent/amazon-cloudwatch-agent.yaml")
+    machine.wait_for_file("/run/amazon-cloudwatch-agent/env-config.json")
+  '';
+}
diff --git a/nixos/tests/amazon-init-shell.nix b/nixos/tests/amazon-init-shell.nix
index f79cd0364684..e051faa4e2f1 100644
--- a/nixos/tests/amazon-init-shell.nix
+++ b/nixos/tests/amazon-init-shell.nix
@@ -6,41 +6,35 @@
 # configuration expression.
 
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  lib,
+  ...
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
-
-makeTest {
+{
   name = "amazon-init";
-  meta = with maintainers; {
+  meta = with lib.maintainers; {
     maintainers = [ urbas ];
   };
-  nodes.machine =
-    { lib, pkgs, ... }:
-    {
-      imports = [
-        ../modules/profiles/headless.nix
-        ../modules/virtualisation/amazon-init.nix
-      ];
-      services.openssh.enable = true;
-      system.switch.enable = true;
-      networking.hostName = "";
-      environment.etc."ec2-metadata/user-data" = {
-        text = ''
-          #!/usr/bin/bash
+  nodes.machine = {
+    imports = [
+      ../modules/profiles/headless.nix
+      ../modules/virtualisation/amazon-init.nix
+    ];
+    services.openssh.enable = true;
+    system.switch.enable = true;
+    networking.hostName = "";
+    environment.etc."ec2-metadata/user-data" = {
+      text = ''
+        #!/usr/bin/bash
 
-          echo successful > /tmp/evidence
+        echo successful > /tmp/evidence
 
-          # Emulate running nixos-rebuild switch, just without any building.
-          # https://github.com/nixos/nixpkgs/blob/4c62505847d88f16df11eff3c81bf9a453a4979e/nixos/modules/virtualisation/amazon-init.nix#L55
-          /run/current-system/bin/switch-to-configuration test
-        '';
-      };
+        # Emulate running nixos-rebuild switch, just without any building.
+        # https://github.com/nixos/nixpkgs/blob/4c62505847d88f16df11eff3c81bf9a453a4979e/nixos/modules/virtualisation/amazon-init.nix#L55
+        /run/current-system/bin/switch-to-configuration test
+      '';
     };
+  };
   testScript = ''
     # To wait until amazon-init terminates its run
     unnamed.wait_for_unit("amazon-init.service")
diff --git a/nixos/tests/amazon-ssm-agent.nix b/nixos/tests/amazon-ssm-agent.nix
index 4c55fc1c4faf..1c8034ff0ee4 100644
--- a/nixos/tests/amazon-ssm-agent.nix
+++ b/nixos/tests/amazon-ssm-agent.nix
@@ -1,22 +1,18 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "amazon-ssm-agent";
-    meta.maintainers = [ lib.maintainers.anthonyroussel ];
+{ lib, ... }:
+{
+  name = "amazon-ssm-agent";
+  meta.maintainers = [ lib.maintainers.anthonyroussel ];
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        services.amazon-ssm-agent.enable = true;
-      };
+  nodes.machine = {
+    services.amazon-ssm-agent.enable = true;
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      machine.wait_for_file("/etc/amazon/ssm/seelog.xml")
-      machine.wait_for_file("/etc/amazon/ssm/amazon-ssm-agent.json")
+    machine.wait_for_file("/etc/amazon/ssm/seelog.xml")
+    machine.wait_for_file("/etc/amazon/ssm/amazon-ssm-agent.json")
 
-      machine.wait_for_unit("amazon-ssm-agent.service")
-    '';
-  }
-)
+    machine.wait_for_unit("amazon-ssm-agent.service")
+  '';
+}
diff --git a/nixos/tests/angie-api.nix b/nixos/tests/angie-api.nix
index 95e66de9060e..5e31ceff0247 100644
--- a/nixos/tests/angie-api.nix
+++ b/nixos/tests/angie-api.nix
@@ -1,170 +1,168 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  let
-    hosts = ''
-      192.168.2.101 example.com
-      192.168.2.101 api.example.com
-      192.168.2.101 backend.example.com
-    '';
+{ lib, pkgs, ... }:
+let
+  hosts = ''
+    192.168.2.101 example.com
+    192.168.2.101 api.example.com
+    192.168.2.101 backend.example.com
+  '';
 
-  in
-  {
-    name = "angie-api";
-    meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
+in
+{
+  name = "angie-api";
+  meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
 
-    nodes = {
-      server =
-        { pkgs, ... }:
-        {
-          networking = {
-            interfaces.eth1 = {
-              ipv4.addresses = [
-                {
-                  address = "192.168.2.101";
-                  prefixLength = 24;
-                }
-              ];
+  nodes = {
+    server =
+      { pkgs, ... }:
+      {
+        networking = {
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = "192.168.2.101";
+                prefixLength = 24;
+              }
+            ];
+          };
+          extraHosts = hosts;
+          firewall.allowedTCPPorts = [ 80 ];
+        };
+
+        services.nginx = {
+          enable = true;
+          package = pkgs.angie;
+
+          upstreams = {
+            "backend-http" = {
+              servers = {
+                "backend.example.com:8080" = {
+                  fail_timeout = "0";
+                };
+              };
+              extraConfig = ''
+                zone upstream 256k;
+              '';
+            };
+            "backend-socket" = {
+              servers = {
+                "unix:/run/example.sock" = {
+                  fail_timeout = "0";
+                };
+              };
+              extraConfig = ''
+                zone upstream 256k;
+              '';
             };
-            extraHosts = hosts;
-            firewall.allowedTCPPorts = [ 80 ];
           };
 
-          services.nginx = {
-            enable = true;
-            package = pkgs.angie;
+          virtualHosts."api.example.com" = {
+            locations."/console/" = {
+              extraConfig = ''
+                api /status/;
 
-            upstreams = {
-              "backend-http" = {
-                servers = {
-                  "backend.example.com:8080" = {
-                    fail_timeout = "0";
-                  };
-                };
-                extraConfig = ''
-                  zone upstream 256k;
-                '';
-              };
-              "backend-socket" = {
-                servers = {
-                  "unix:/run/example.sock" = {
-                    fail_timeout = "0";
-                  };
-                };
-                extraConfig = ''
-                  zone upstream 256k;
-                '';
-              };
+                allow 192.168.2.201;
+                deny all;
+              '';
             };
+          };
 
-            virtualHosts."api.example.com" = {
-              locations."/console/" = {
-                extraConfig = ''
-                  api /status/;
+          virtualHosts."example.com" = {
+            locations."/test/" = {
+              root = lib.mkForce (
+                pkgs.runCommandLocal "testdir" { } ''
+                  mkdir -p "$out/test"
+                  cat > "$out/test/index.html" <<EOF
+                  <html><body>Hello World!</body></html>
+                  EOF
+                ''
+              );
+              extraConfig = ''
+                status_zone test_zone;
 
-                  allow 192.168.2.201;
-                  deny all;
-                '';
-              };
+                allow 192.168.2.201;
+                deny all;
+              '';
             };
+            locations."/test/locked/" = {
+              extraConfig = ''
+                status_zone test_zone;
 
-            virtualHosts."example.com" = {
-              locations."/test/" = {
-                root = lib.mkForce (
-                  pkgs.runCommandLocal "testdir" { } ''
-                    mkdir -p "$out/test"
-                    cat > "$out/test/index.html" <<EOF
-                    <html><body>Hello World!</body></html>
-                    EOF
-                  ''
-                );
-                extraConfig = ''
-                  status_zone test_zone;
+                deny all;
+              '';
+            };
+            locations."/test/error/" = {
+              extraConfig = ''
+                status_zone test_zone;
 
-                  allow 192.168.2.201;
-                  deny all;
-                '';
-              };
-              locations."/test/locked/" = {
-                extraConfig = ''
-                  status_zone test_zone;
-
-                  deny all;
-                '';
-              };
-              locations."/test/error/" = {
-                extraConfig = ''
-                  status_zone test_zone;
-
-                  allow all;
-                '';
-              };
-              locations."/upstream-http/" = {
-                proxyPass = "http://backend-http";
-              };
-              locations."/upstream-socket/" = {
-                proxyPass = "http://backend-socket";
-              };
+                allow all;
+              '';
+            };
+            locations."/upstream-http/" = {
+              proxyPass = "http://backend-http";
+            };
+            locations."/upstream-socket/" = {
+              proxyPass = "http://backend-socket";
             };
           };
         };
+      };
 
-      client =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
-          networking = {
-            interfaces.eth1 = {
-              ipv4.addresses = [
-                {
-                  address = "192.168.2.201";
-                  prefixLength = 24;
-                }
-              ];
-            };
-            extraHosts = hosts;
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
+        networking = {
+          interfaces.eth1 = {
+            ipv4.addresses = [
+              {
+                address = "192.168.2.201";
+                prefixLength = 24;
+              }
+            ];
           };
+          extraHosts = hosts;
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      server.wait_for_unit("nginx")
-      server.wait_for_open_port(80)
+    server.wait_for_unit("nginx")
+    server.wait_for_open_port(80)
 
-      # Check Angie version
-      client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.angie.version' | grep '${pkgs.angie.version}'")
+    # Check Angie version
+    client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.angie.version' | grep '${pkgs.angie.version}'")
 
-      # Check access
-      client.succeed("curl --verbose --head http://api.example.com/console/ | grep 'HTTP/1.1 200'")
-      server.succeed("curl --verbose --head http://api.example.com/console/ | grep 'HTTP/1.1 403 Forbidden'")
+    # Check access
+    client.succeed("curl --verbose --head http://api.example.com/console/ | grep 'HTTP/1.1 200'")
+    server.succeed("curl --verbose --head http://api.example.com/console/ | grep 'HTTP/1.1 403 Forbidden'")
 
-      # Check responses and requests
-      client.succeed("curl --verbose http://example.com/test/")
-      client.succeed("curl --verbose http://example.com/test/locked/")
-      client.succeed("curl --verbose http://example.com/test/locked/")
-      client.succeed("curl --verbose http://example.com/test/error/")
-      client.succeed("curl --verbose http://example.com/test/error/")
-      client.succeed("curl --verbose http://example.com/test/error/")
-      server.succeed("curl --verbose http://example.com/test/")
-      client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.location_zones.test_zone.responses.\"200\"' | grep '1'")
-      client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.location_zones.test_zone.responses.\"403\"' | grep '3'")
-      client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.location_zones.test_zone.responses.\"404\"' | grep '3'")
-      client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.location_zones.test_zone.requests.total' | grep '7'")
+    # Check responses and requests
+    client.succeed("curl --verbose http://example.com/test/")
+    client.succeed("curl --verbose http://example.com/test/locked/")
+    client.succeed("curl --verbose http://example.com/test/locked/")
+    client.succeed("curl --verbose http://example.com/test/error/")
+    client.succeed("curl --verbose http://example.com/test/error/")
+    client.succeed("curl --verbose http://example.com/test/error/")
+    server.succeed("curl --verbose http://example.com/test/")
+    client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.location_zones.test_zone.responses.\"200\"' | grep '1'")
+    client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.location_zones.test_zone.responses.\"403\"' | grep '3'")
+    client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.location_zones.test_zone.responses.\"404\"' | grep '3'")
+    client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.location_zones.test_zone.requests.total' | grep '7'")
 
-      # Check upstreams
-      client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.upstreams.\"backend-http\".peers.\"192.168.2.101:8080\".state' | grep 'up'")
-      client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.upstreams.\"backend-http\".peers.\"192.168.2.101:8080\".health.fails' | grep '0'")
-      client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.upstreams.\"backend-socket\".peers.\"unix:/run/example.sock\".state' | grep 'up'")
-      client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.upstreams.\"backend-socket\".peers.\"unix:/run/example.sock\".health.fails' | grep '0'")
-      client.succeed("curl --verbose http://example.com/upstream-http/")
-      client.succeed("curl --verbose http://example.com/upstream-socket/")
-      client.succeed("curl --verbose http://example.com/upstream-socket/")
-      client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.upstreams.\"backend-http\".peers.\"192.168.2.101:8080\".health.fails' | grep '1'")
-      client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.upstreams.\"backend-socket\".peers.\"unix:/run/example.sock\".health.fails' | grep '2'")
+    # Check upstreams
+    client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.upstreams.\"backend-http\".peers.\"192.168.2.101:8080\".state' | grep 'up'")
+    client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.upstreams.\"backend-http\".peers.\"192.168.2.101:8080\".health.fails' | grep '0'")
+    client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.upstreams.\"backend-socket\".peers.\"unix:/run/example.sock\".state' | grep 'up'")
+    client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.upstreams.\"backend-socket\".peers.\"unix:/run/example.sock\".health.fails' | grep '0'")
+    client.succeed("curl --verbose http://example.com/upstream-http/")
+    client.succeed("curl --verbose http://example.com/upstream-socket/")
+    client.succeed("curl --verbose http://example.com/upstream-socket/")
+    client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.upstreams.\"backend-http\".peers.\"192.168.2.101:8080\".health.fails' | grep '1'")
+    client.succeed("curl --verbose http://api.example.com/console/ | jq -e '.http.upstreams.\"backend-socket\".peers.\"unix:/run/example.sock\".health.fails' | grep '2'")
 
-      server.shutdown()
-      client.shutdown()
-    '';
-  }
-)
+    server.shutdown()
+    client.shutdown()
+  '';
+}
diff --git a/nixos/tests/anki-sync-server.nix b/nixos/tests/anki-sync-server.nix
index 49075e1d7705..07794db35b09 100644
--- a/nixos/tests/anki-sync-server.nix
+++ b/nixos/tests/anki-sync-server.nix
@@ -1,75 +1,71 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    ankiSyncTest = pkgs.writeScript "anki-sync-test.py" ''
-      #!${pkgs.python3}/bin/python
+{ pkgs, ... }:
+let
+  ankiSyncTest = pkgs.writeScript "anki-sync-test.py" ''
+    #!${pkgs.python3}/bin/python
 
-      import sys
+    import sys
 
-      # get site paths from anki itself
-      from runpy import run_path
-      run_path("${pkgs.anki}/bin/.anki-wrapped")
-      import anki
+    # get site paths from anki itself
+    from runpy import run_path
+    run_path("${pkgs.anki}/bin/.anki-wrapped")
+    import anki
 
-      col = anki.collection.Collection('test_collection')
-      endpoint = 'http://localhost:27701'
+    col = anki.collection.Collection('test_collection')
+    endpoint = 'http://localhost:27701'
 
-      # Sanity check: verify bad login fails
-      try:
-         col.sync_login('baduser', 'badpass', endpoint)
-         print("bad user login worked?!")
-         sys.exit(1)
-      except anki.errors.SyncError:
-          pass
+    # Sanity check: verify bad login fails
+    try:
+       col.sync_login('baduser', 'badpass', endpoint)
+       print("bad user login worked?!")
+       sys.exit(1)
+    except anki.errors.SyncError:
+        pass
 
-      # test logging in to users
-      col.sync_login('user', 'password', endpoint)
-      col.sync_login('passfileuser', 'passfilepassword', endpoint)
+    # test logging in to users
+    col.sync_login('user', 'password', endpoint)
+    col.sync_login('passfileuser', 'passfilepassword', endpoint)
 
-      # Test actual sync. login apparently doesn't remember the endpoint...
-      login = col.sync_login('user', 'password', endpoint)
-      login.endpoint = endpoint
-      sync = col.sync_collection(login, False)
-      assert sync.required == sync.NO_CHANGES
-      # TODO: create an archive with server content including a test card
-      # and check we got it?
-    '';
-    testPasswordFile = pkgs.writeText "anki-password" "passfilepassword";
-  in
-  {
-    name = "anki-sync-server";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ martinetd ];
+    # Test actual sync. login apparently doesn't remember the endpoint...
+    login = col.sync_login('user', 'password', endpoint)
+    login.endpoint = endpoint
+    sync = col.sync_collection(login, False)
+    assert sync.required == sync.NO_CHANGES
+    # TODO: create an archive with server content including a test card
+    # and check we got it?
+  '';
+  testPasswordFile = pkgs.writeText "anki-password" "passfilepassword";
+in
+{
+  name = "anki-sync-server";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ martinetd ];
+  };
+
+  nodes.machine = {
+    services.anki-sync-server = {
+      enable = true;
+      users = [
+        {
+          username = "user";
+          password = "password";
+        }
+        {
+          username = "passfileuser";
+          passwordFile = testPasswordFile;
+        }
+      ];
     };
+  };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.anki-sync-server = {
-          enable = true;
-          users = [
-            {
-              username = "user";
-              password = "password";
-            }
-            {
-              username = "passfileuser";
-              passwordFile = testPasswordFile;
-            }
-          ];
-        };
-      };
+  testScript = ''
+    start_all()
 
-    testScript = ''
-      start_all()
+    with subtest("Server starts successfully"):
+        # service won't start without users
+        machine.wait_for_unit("anki-sync-server.service")
+        machine.wait_for_open_port(27701)
 
-      with subtest("Server starts successfully"):
-          # service won't start without users
-          machine.wait_for_unit("anki-sync-server.service")
-          machine.wait_for_open_port(27701)
-
-      with subtest("Can sync"):
-          machine.succeed("${ankiSyncTest}")
-    '';
-  }
-)
+    with subtest("Can sync"):
+        machine.succeed("${ankiSyncTest}")
+  '';
+}
diff --git a/nixos/tests/anuko-time-tracker.nix b/nixos/tests/anuko-time-tracker.nix
index f341056e8532..d65194664165 100644
--- a/nixos/tests/anuko-time-tracker.nix
+++ b/nixos/tests/anuko-time-tracker.nix
@@ -1,20 +1,18 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "anuko-time-tracker";
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ michaelshmitty ];
+{ pkgs, ... }:
+{
+  name = "anuko-time-tracker";
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ michaelshmitty ];
+  };
+  nodes = {
+    machine = {
+      services.anuko-time-tracker.enable = true;
     };
-    nodes = {
-      machine = {
-        services.anuko-time-tracker.enable = true;
-      };
-    };
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("phpfpm-anuko-time-tracker")
-      machine.wait_for_open_port(80);
-      machine.wait_until_succeeds("curl -s --fail -L http://localhost/time.php | grep 'Anuko Time Tracker'")
-    '';
-  }
-)
+  };
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("phpfpm-anuko-time-tracker")
+    machine.wait_for_open_port(80);
+    machine.wait_until_succeeds("curl -s --fail -L http://localhost/time.php | grep 'Anuko Time Tracker'")
+  '';
+}
diff --git a/nixos/tests/apcupsd.nix b/nixos/tests/apcupsd.nix
index 041103252efb..dfe27d681fdc 100644
--- a/nixos/tests/apcupsd.nix
+++ b/nixos/tests/apcupsd.nix
@@ -2,45 +2,43 @@ let
   # arbitrary address
   ipAddr = "192.168.42.42";
 in
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "apcupsd";
-    meta.maintainers = with lib.maintainers; [ bjornfor ];
+{ lib, ... }:
+{
+  name = "apcupsd";
+  meta.maintainers = with lib.maintainers; [ bjornfor ];
 
-    nodes = {
-      machine = {
-        services.apcupsd = {
-          enable = true;
-          configText = ''
-            UPSTYPE usb
-            BATTERYLEVEL 42
-            # Configure NISIP so that the only way apcaccess can work is to read
-            # this config.
-            NISIP ${ipAddr}
-          '';
-        };
-        networking.interfaces.eth1 = {
-          ipv4.addresses = [
-            {
-              address = ipAddr;
-              prefixLength = 24;
-            }
-          ];
-        };
+  nodes = {
+    machine = {
+      services.apcupsd = {
+        enable = true;
+        configText = ''
+          UPSTYPE usb
+          BATTERYLEVEL 42
+          # Configure NISIP so that the only way apcaccess can work is to read
+          # this config.
+          NISIP ${ipAddr}
+        '';
+      };
+      networking.interfaces.eth1 = {
+        ipv4.addresses = [
+          {
+            address = ipAddr;
+            prefixLength = 24;
+          }
+        ];
       };
     };
+  };
 
-    # Check that the service starts, that the CLI (apcaccess) works and that it
-    # uses the config (ipAddr) defined in the service config.
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("apcupsd.service")
-      machine.wait_for_open_port(3551, "${ipAddr}")
-      res = machine.succeed("apcaccess")
-      expect_line="MBATTCHG : 42 Percent"
-      assert "MBATTCHG : 42 Percent" in res, f"expected apcaccess output to contain '{expect_line}' but got '{res}'"
-      machine.shutdown()
-    '';
-  }
-)
+  # Check that the service starts, that the CLI (apcaccess) works and that it
+  # uses the config (ipAddr) defined in the service config.
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("apcupsd.service")
+    machine.wait_for_open_port(3551, "${ipAddr}")
+    res = machine.succeed("apcaccess")
+    expect_line="MBATTCHG : 42 Percent"
+    assert "MBATTCHG : 42 Percent" in res, f"expected apcaccess output to contain '{expect_line}' but got '{res}'"
+    machine.shutdown()
+  '';
+}
diff --git a/nixos/tests/apparmor/default.nix b/nixos/tests/apparmor/default.nix
index c618cabf5184..e2667df8ec80 100644
--- a/nixos/tests/apparmor/default.nix
+++ b/nixos/tests/apparmor/default.nix
@@ -1,130 +1,126 @@
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    helloProfileContents = ''
-      abi <abi/4.0>,
-      include <tunables/global>
-      profile hello ${lib.getExe pkgs.hello} {
-        include <abstractions/base>
-      }
-    '';
-  in
-  {
-    name = "apparmor";
-    meta.maintainers = with lib.maintainers; [
-      julm
-      grimmauld
-    ];
+{ pkgs, lib, ... }:
+let
+  helloProfileContents = ''
+    abi <abi/4.0>,
+    include <tunables/global>
+    profile hello ${lib.getExe pkgs.hello} {
+      include <abstractions/base>
+    }
+  '';
+in
+{
+  name = "apparmor";
+  meta.maintainers = with lib.maintainers; [
+    julm
+    grimmauld
+  ];
 
-    nodes.machine =
-      {
-        lib,
-        pkgs,
-        config,
-        ...
-      }:
-      {
-        security.apparmor = {
-          enable = lib.mkDefault true;
+  nodes.machine =
+    {
+      lib,
+      ...
+    }:
+    {
+      security.apparmor = {
+        enable = lib.mkDefault true;
 
-          policies.hello = {
-            # test profile enforce and content definition
-            state = "enforce";
-            profile = helloProfileContents;
-          };
+        policies.hello = {
+          # test profile enforce and content definition
+          state = "enforce";
+          profile = helloProfileContents;
+        };
 
-          policies.sl = {
-            # test profile complain and path definition
-            state = "complain";
-            path = ./sl_profile;
-          };
+        policies.sl = {
+          # test profile complain and path definition
+          state = "complain";
+          path = ./sl_profile;
+        };
 
-          policies.hexdump = {
-            # test profile complain and path definition
-            state = "enforce";
-            profile = ''
-              abi <abi/4.0>,
-              include <tunables/global>
-              profile hexdump /nix/store/*/bin/hexdump {
-                include <abstractions/base>
-                deny /tmp/** r,
-              }
-            '';
-          };
-
-          includes."abstractions/base" = ''
-            /nix/store/*/bin/** mr,
-            /nix/store/*/lib/** mr,
-            /nix/store/** r,
+        policies.hexdump = {
+          # test profile complain and path definition
+          state = "enforce";
+          profile = ''
+            abi <abi/4.0>,
+            include <tunables/global>
+            profile hexdump /nix/store/*/bin/hexdump {
+              include <abstractions/base>
+              deny /tmp/** r,
+            }
           '';
         };
+
+        includes."abstractions/base" = ''
+          /nix/store/*/bin/** mr,
+          /nix/store/*/lib/** mr,
+          /nix/store/** r,
+        '';
       };
+    };
 
-    testScript =
-      let
-        inherit (lib) getExe getExe';
-      in
-      ''
-        machine.wait_for_unit("multi-user.target")
+  testScript =
+    let
+      inherit (lib) getExe getExe';
+    in
+    ''
+      machine.wait_for_unit("multi-user.target")
 
-        with subtest("AppArmor profiles are loaded"):
-            machine.succeed("systemctl status apparmor.service")
+      with subtest("AppArmor profiles are loaded"):
+          machine.succeed("systemctl status apparmor.service")
 
-        # AppArmor securityfs
-        with subtest("AppArmor securityfs is mounted"):
-            machine.succeed("mountpoint -q /sys/kernel/security")
-            machine.succeed("cat /sys/kernel/security/apparmor/profiles")
+      # AppArmor securityfs
+      with subtest("AppArmor securityfs is mounted"):
+          machine.succeed("mountpoint -q /sys/kernel/security")
+          machine.succeed("cat /sys/kernel/security/apparmor/profiles")
 
-        # Test apparmorRulesFromClosure by:
-        # 1. Prepending a string of the relevant packages' name and version on each line.
-        # 2. Sorting according to those strings.
-        # 3. Removing those prepended strings.
-        # 4. Using `diff` against the expected output.
-        with subtest("apparmorRulesFromClosure"):
-            machine.succeed(
-                "${getExe' pkgs.diffutils "diff"} -u ${
-                  pkgs.writeText "expected.rules" (import ./makeExpectedPolicies.nix { inherit pkgs; })
-                } ${
-                  pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
-                    ${getExe pkgs.gnused} -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
-                      pkgs.apparmorRulesFromClosure {
-                        name = "ping";
-                        additionalRules = [ "x $path/foo/**" ];
-                      } [ pkgs.libcap ]
-                    } |
-                    ${getExe' pkgs.coreutils "sort"} -n -k1 |
-                    ${getExe pkgs.gnused} -e 's:^[^ ]* ::' >$out
-                  ''
-                }"
-            )
+      # Test apparmorRulesFromClosure by:
+      # 1. Prepending a string of the relevant packages' name and version on each line.
+      # 2. Sorting according to those strings.
+      # 3. Removing those prepended strings.
+      # 4. Using `diff` against the expected output.
+      with subtest("apparmorRulesFromClosure"):
+          machine.succeed(
+              "${getExe' pkgs.diffutils "diff"} -u ${
+                pkgs.writeText "expected.rules" (import ./makeExpectedPolicies.nix { inherit pkgs; })
+              } ${
+                pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
+                  ${getExe pkgs.gnused} -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
+                    pkgs.apparmorRulesFromClosure {
+                      name = "ping";
+                      additionalRules = [ "x $path/foo/**" ];
+                    } [ pkgs.libcap ]
+                  } |
+                  ${getExe' pkgs.coreutils "sort"} -n -k1 |
+                  ${getExe pkgs.gnused} -e 's:^[^ ]* ::' >$out
+                ''
+              }"
+          )
 
-        # Test apparmor profile states by using `diff` against `aa-status`
-        with subtest("apparmorProfileStates"):
-            machine.succeed("${getExe' pkgs.diffutils "diff"} -u \
-              <(${getExe' pkgs.apparmor-bin-utils "aa-status"} --json | ${getExe pkgs.jq} --sort-keys . ) \
-              <(${getExe pkgs.jq} --sort-keys . ${
-                pkgs.writers.writeJSON "expectedStates.json" {
-                  version = "2";
-                  processes = { };
-                  profiles = {
-                    hexdump = "enforce";
-                    hello = "enforce";
-                    sl = "complain";
-                  };
-                }
-              })")
+      # Test apparmor profile states by using `diff` against `aa-status`
+      with subtest("apparmorProfileStates"):
+          machine.succeed("${getExe' pkgs.diffutils "diff"} -u \
+            <(${getExe' pkgs.apparmor-bin-utils "aa-status"} --json | ${getExe pkgs.jq} --sort-keys . ) \
+            <(${getExe pkgs.jq} --sort-keys . ${
+              pkgs.writers.writeJSON "expectedStates.json" {
+                version = "2";
+                processes = { };
+                profiles = {
+                  hexdump = "enforce";
+                  hello = "enforce";
+                  sl = "complain";
+                };
+              }
+            })")
 
-        # Test apparmor profile files in /etc/apparmor.d/<name> to be either a correct symlink (sl) or have the right file contents (hello)
-        with subtest("apparmorProfileTargets"):
-            machine.succeed("${getExe' pkgs.diffutils "diff"} -u <(${getExe pkgs.file} /etc/static/apparmor.d/sl) ${pkgs.writeText "expected.link" ''
-              /etc/static/apparmor.d/sl: symbolic link to ${./sl_profile}
-            ''}")
-            machine.succeed("${getExe' pkgs.diffutils "diff"} -u /etc/static/apparmor.d/hello ${pkgs.writeText "expected.content" helloProfileContents}")
+      # Test apparmor profile files in /etc/apparmor.d/<name> to be either a correct symlink (sl) or have the right file contents (hello)
+      with subtest("apparmorProfileTargets"):
+          machine.succeed("${getExe' pkgs.diffutils "diff"} -u <(${getExe pkgs.file} /etc/static/apparmor.d/sl) ${pkgs.writeText "expected.link" ''
+            /etc/static/apparmor.d/sl: symbolic link to ${./sl_profile}
+          ''}")
+          machine.succeed("${getExe' pkgs.diffutils "diff"} -u /etc/static/apparmor.d/hello ${pkgs.writeText "expected.content" helloProfileContents}")
 
 
-        with subtest("apparmorProfileEnforce"):
-            machine.succeed("${getExe pkgs.hello} 1> /tmp/test-file")
-            machine.fail("${lib.getExe' pkgs.util-linux "hexdump"} /tmp/test-file") # no access to /tmp/test-file granted by apparmor
-      '';
-  }
-)
+      with subtest("apparmorProfileEnforce"):
+          machine.succeed("${getExe pkgs.hello} 1> /tmp/test-file")
+          machine.fail("${lib.getExe' pkgs.util-linux "hexdump"} /tmp/test-file") # no access to /tmp/test-file granted by apparmor
+    '';
+}
diff --git a/nixos/tests/archi.nix b/nixos/tests/archi.nix
index 387c4093a8bb..74cca03829c5 100644
--- a/nixos/tests/archi.nix
+++ b/nixos/tests/archi.nix
@@ -1,38 +1,36 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "archi";
-    meta.maintainers = with lib.maintainers; [ paumr ];
+{ lib, ... }:
+{
+  name = "archi";
+  meta.maintainers = with lib.maintainers; [ paumr ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
-        ];
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
 
-        environment.systemPackages = with pkgs; [ archi ];
-      };
+      environment.systemPackages = with pkgs; [ archi ];
+    };
 
-    enableOCR = true;
+  enableOCR = true;
 
-    testScript = ''
-      machine.wait_for_x()
+  testScript = ''
+    machine.wait_for_x()
 
-      with subtest("createEmptyModel via CLI"):
-           machine.succeed("Archi -application com.archimatetool.commandline.app -consoleLog -nosplash --createEmptyModel --saveModel smoke.archimate")
-           machine.copy_from_vm("smoke.archimate", "")
+    with subtest("createEmptyModel via CLI"):
+         machine.succeed("Archi -application com.archimatetool.commandline.app -consoleLog -nosplash --createEmptyModel --saveModel smoke.archimate")
+         machine.copy_from_vm("smoke.archimate", "")
 
-      with subtest("UI smoketest"):
-           machine.succeed("DISPLAY=:0 Archi --createEmptyModel >&2 &")
-           machine.wait_for_window("Archi")
+    with subtest("UI smoketest"):
+         machine.succeed("DISPLAY=:0 Archi --createEmptyModel >&2 &")
+         machine.wait_for_window("Archi")
 
-           # wait till main UI is open
-           # since OCR seems to be buggy wait_for_text was replaced by sleep, issue: #302965
-           # machine.wait_for_text("Welcome to Archi")
-           machine.sleep(20)
+         # wait till main UI is open
+         # since OCR seems to be buggy wait_for_text was replaced by sleep, issue: #302965
+         # machine.wait_for_text("Welcome to Archi")
+         machine.sleep(20)
 
-           machine.screenshot("welcome-screen")
-    '';
-  }
-)
+         machine.screenshot("welcome-screen")
+  '';
+}
diff --git a/nixos/tests/aria2.nix b/nixos/tests/aria2.nix
index cf8e4da8977c..fbae6598b6c6 100644
--- a/nixos/tests/aria2.nix
+++ b/nixos/tests/aria2.nix
@@ -1,54 +1,52 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    rpcSecret = "supersecret";
-    rpc-listen-port = 6800;
-    curlBody = {
-      jsonrpc = 2.0;
-      id = 1;
-      method = "aria2.getVersion";
-      params = [ "token:${rpcSecret}" ];
-    };
-  in
-  rec {
-    name = "aria2";
+{ pkgs, ... }:
+let
+  rpcSecret = "supersecret";
+  rpc-listen-port = 6800;
+  curlBody = {
+    jsonrpc = 2.0;
+    id = 1;
+    method = "aria2.getVersion";
+    params = [ "token:${rpcSecret}" ];
+  };
+in
+{
+  name = "aria2";
 
-    nodes.machine = {
-      environment.etc."aria2Rpc".text = rpcSecret;
-      services.aria2 = {
-        enable = true;
-        rpcSecretFile = "/etc/aria2Rpc";
-        settings = {
-          inherit rpc-listen-port;
-          allow-overwrite = false;
-          check-integrity = true;
-          console-log-level = "warn";
-          listen-port = [
-            {
-              from = 20000;
-              to = 20010;
-            }
-            {
-              from = 22222;
-              to = 22222;
-            }
-          ];
-          max-concurrent-downloads = 50;
-          seed-ratio = 1.2;
-          summary-interval = 0;
-        };
+  nodes.machine = {
+    environment.etc."aria2Rpc".text = rpcSecret;
+    services.aria2 = {
+      enable = true;
+      rpcSecretFile = "/etc/aria2Rpc";
+      settings = {
+        inherit rpc-listen-port;
+        allow-overwrite = false;
+        check-integrity = true;
+        console-log-level = "warn";
+        listen-port = [
+          {
+            from = 20000;
+            to = 20010;
+          }
+          {
+            from = 22222;
+            to = 22222;
+          }
+        ];
+        max-concurrent-downloads = 50;
+        seed-ratio = 1.2;
+        summary-interval = 0;
       };
     };
+  };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("aria2.service")
-      curl_cmd = 'curl --fail-with-body -X POST -H "Content-Type: application/json" \
-                  -d \'${builtins.toJSON curlBody}\' http://localhost:${toString rpc-listen-port}/jsonrpc'
-      print(machine.wait_until_succeeds(curl_cmd, timeout=10))
-      machine.shutdown()
-    '';
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("aria2.service")
+    curl_cmd = 'curl --fail-with-body -X POST -H "Content-Type: application/json" \
+                -d \'${builtins.toJSON curlBody}\' http://localhost:${toString rpc-listen-port}/jsonrpc'
+    print(machine.wait_until_succeeds(curl_cmd, timeout=10))
+    machine.shutdown()
+  '';
 
-    meta.maintainers = [ pkgs.lib.maintainers.timhae ];
-  }
-)
+  meta.maintainers = [ pkgs.lib.maintainers.timhae ];
+}
diff --git a/nixos/tests/armagetronad.nix b/nixos/tests/armagetronad.nix
index d9c7c5076382..392cdb0437bb 100644
--- a/nixos/tests/armagetronad.nix
+++ b/nixos/tests/armagetronad.nix
@@ -1,11 +1,8 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  lib,
+  pkgs,
+  ...
 }:
-
-with import ../lib/testing-python.nix { inherit system pkgs; };
-
 let
   user = "alice";
 
@@ -27,9 +24,9 @@ let
     };
 
 in
-makeTest {
+{
   name = "armagetronad";
-  meta = with pkgs.lib.maintainers; {
+  meta = with lib.maintainers; {
     maintainers = [ numinit ];
   };
 
diff --git a/nixos/tests/atd.nix b/nixos/tests/atd.nix
index fa61290174fb..4396bac16540 100644
--- a/nixos/tests/atd.nix
+++ b/nixos/tests/atd.nix
@@ -1,36 +1,34 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "atd";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ bjornfor ];
+{
+  name = "atd";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ bjornfor ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      services.atd.enable = true;
+      users.users.alice = {
+        isNormalUser = true;
+      };
     };
 
-    nodes.machine =
-      { ... }:
-      {
-        services.atd.enable = true;
-        users.users.alice = {
-          isNormalUser = true;
-        };
-      };
+  # "at" has a resolution of 1 minute
+  testScript = ''
+    start_all()
 
-    # "at" has a resolution of 1 minute
-    testScript = ''
-      start_all()
+    machine.wait_for_unit("atd.service")  # wait for atd to start
+    machine.fail("test -f ~root/at-1")
+    machine.fail("test -f ~alice/at-1")
 
-      machine.wait_for_unit("atd.service")  # wait for atd to start
-      machine.fail("test -f ~root/at-1")
-      machine.fail("test -f ~alice/at-1")
+    machine.succeed("echo 'touch ~root/at-1' | at now+1min")
+    machine.succeed("su - alice -c \"echo 'touch at-1' | at now+1min\"")
 
-      machine.succeed("echo 'touch ~root/at-1' | at now+1min")
-      machine.succeed("su - alice -c \"echo 'touch at-1' | at now+1min\"")
+    machine.succeed("sleep 1.5m")
 
-      machine.succeed("sleep 1.5m")
-
-      machine.succeed("test -f ~root/at-1")
-      machine.succeed("test -f ~alice/at-1")
-    '';
-  }
-)
+    machine.succeed("test -f ~root/at-1")
+    machine.succeed("test -f ~alice/at-1")
+  '';
+}
diff --git a/nixos/tests/audiobookshelf.nix b/nixos/tests/audiobookshelf.nix
index a4dce23abaf8..8e942f4dddef 100644
--- a/nixos/tests/audiobookshelf.nix
+++ b/nixos/tests/audiobookshelf.nix
@@ -1,22 +1,20 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "audiobookshelf";
-    meta.maintainers = with lib.maintainers; [ wietsedv ];
+{ lib, ... }:
+{
+  name = "audiobookshelf";
+  meta.maintainers = with lib.maintainers; [ wietsedv ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.audiobookshelf = {
-          enable = true;
-          port = 1234;
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.audiobookshelf = {
+        enable = true;
+        port = 1234;
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("audiobookshelf.service")
-      machine.wait_for_open_port(1234)
-      machine.succeed("curl --fail http://localhost:1234/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("audiobookshelf.service")
+    machine.wait_for_open_port(1234)
+    machine.succeed("curl --fail http://localhost:1234/")
+  '';
+}
diff --git a/nixos/tests/auth-mysql.nix b/nixos/tests/auth-mysql.nix
index 0a4d8f577fc7..7009f063afea 100644
--- a/nixos/tests/auth-mysql.nix
+++ b/nixos/tests/auth-mysql.nix
@@ -1,180 +1,178 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 
-  let
-    dbUser = "nixos_auth";
-    dbPassword = "topsecret123";
-    dbName = "auth";
+let
+  dbUser = "nixos_auth";
+  dbPassword = "topsecret123";
+  dbName = "auth";
 
-    mysqlUsername = "mysqltest";
-    mysqlPassword = "topsecretmysqluserpassword123";
-    mysqlGroup = "mysqlusers";
+  mysqlUsername = "mysqltest";
+  mysqlPassword = "topsecretmysqluserpassword123";
+  mysqlGroup = "mysqlusers";
 
-    localUsername = "localtest";
-    localPassword = "topsecretlocaluserpassword123";
+  localUsername = "localtest";
+  localPassword = "topsecretlocaluserpassword123";
 
-    mysqlInit = pkgs.writeText "mysqlInit" ''
-      CREATE USER '${dbUser}'@'localhost' IDENTIFIED BY '${dbPassword}';
-      CREATE DATABASE ${dbName};
-      GRANT ALL PRIVILEGES ON ${dbName}.* TO '${dbUser}'@'localhost';
-      FLUSH PRIVILEGES;
+  mysqlInit = pkgs.writeText "mysqlInit" ''
+    CREATE USER '${dbUser}'@'localhost' IDENTIFIED BY '${dbPassword}';
+    CREATE DATABASE ${dbName};
+    GRANT ALL PRIVILEGES ON ${dbName}.* TO '${dbUser}'@'localhost';
+    FLUSH PRIVILEGES;
 
-      USE ${dbName};
-      CREATE TABLE `groups` (
-        rowid int(11) NOT NULL auto_increment,
-        gid int(11) NOT NULL,
-        name char(255) NOT NULL,
-        PRIMARY KEY (rowid)
-      );
+    USE ${dbName};
+    CREATE TABLE `groups` (
+      rowid int(11) NOT NULL auto_increment,
+      gid int(11) NOT NULL,
+      name char(255) NOT NULL,
+      PRIMARY KEY (rowid)
+    );
 
-      CREATE TABLE `users` (
-        name varchar(255) NOT NULL,
-        uid int(11) NOT NULL auto_increment,
-        gid int(11) NOT NULL,
-        password varchar(255) NOT NULL,
-        PRIMARY KEY (uid),
-        UNIQUE (name)
-      ) AUTO_INCREMENT=5000;
+    CREATE TABLE `users` (
+      name varchar(255) NOT NULL,
+      uid int(11) NOT NULL auto_increment,
+      gid int(11) NOT NULL,
+      password varchar(255) NOT NULL,
+      PRIMARY KEY (uid),
+      UNIQUE (name)
+    ) AUTO_INCREMENT=5000;
 
-      INSERT INTO `users` (name, uid, gid, password) VALUES
-      ('${mysqlUsername}', 5000, 5000, SHA2('${mysqlPassword}', 256));
-      INSERT INTO `groups` (name, gid) VALUES ('${mysqlGroup}', 5000);
-    '';
-  in
-  {
-    name = "auth-mysql";
-    meta.maintainers = with lib.maintainers; [ netali ];
+    INSERT INTO `users` (name, uid, gid, password) VALUES
+    ('${mysqlUsername}', 5000, 5000, SHA2('${mysqlPassword}', 256));
+    INSERT INTO `groups` (name, gid) VALUES ('${mysqlGroup}', 5000);
+  '';
+in
+{
+  name = "auth-mysql";
+  meta.maintainers = with lib.maintainers; [ netali ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.mysql = {
-          enable = true;
-          package = pkgs.mariadb;
-          settings.mysqld.bind-address = "127.0.0.1";
-          initialScript = mysqlInit;
-        };
-
-        users.users.${localUsername} = {
-          isNormalUser = true;
-          password = localPassword;
-        };
-
-        security.pam.services.login.makeHomeDir = true;
-
-        users.mysql = {
-          enable = true;
-          host = "127.0.0.1";
-          user = dbUser;
-          database = dbName;
-          passwordFile = "${builtins.toFile "dbPassword" dbPassword}";
-          pam = {
-            table = "users";
-            userColumn = "name";
-            passwordColumn = "password";
-            passwordCrypt = "sha256";
-            disconnectEveryOperation = true;
-          };
-          nss = {
-            getpwnam = ''
-              SELECT name, 'x', uid, gid, name, CONCAT('/home/', name), "/run/current-system/sw/bin/bash" \
-              FROM users \
-              WHERE name='%1$s' \
-              LIMIT 1
-            '';
-            getpwuid = ''
-              SELECT name, 'x', uid, gid, name, CONCAT('/home/', name), "/run/current-system/sw/bin/bash" \
-              FROM users \
-              WHERE uid=%1$u \
-              LIMIT 1
-            '';
-            getspnam = ''
-              SELECT name, password, 1, 0, 99999, 7, 0, -1, 0 \
-              FROM users \
-              WHERE name='%1$s' \
-              LIMIT 1
-            '';
-            getpwent = ''
-              SELECT name, 'x', uid, gid, name, CONCAT('/home/', name), "/run/current-system/sw/bin/bash" \
-              FROM users
-            '';
-            getspent = ''
-              SELECT name, password, 1, 0, 99999, 7, 0, -1, 0 \
-              FROM users
-            '';
-            getgrnam = ''
-              SELECT name, 'x', gid FROM groups WHERE name='%1$s' LIMIT 1
-            '';
-            getgrgid = ''
-              SELECT name, 'x', gid FROM groups WHERE gid='%1$u' LIMIT 1
-            '';
-            getgrent = ''
-              SELECT name, 'x', gid FROM groups
-            '';
-            memsbygid = ''
-              SELECT name FROM users WHERE gid=%1$u
-            '';
-            gidsbymem = ''
-              SELECT gid FROM users WHERE name='%1$s'
-            '';
-          };
-        };
+  nodes.machine =
+    { ... }:
+    {
+      services.mysql = {
+        enable = true;
+        package = pkgs.mariadb;
+        settings.mysqld.bind-address = "127.0.0.1";
+        initialScript = mysqlInit;
       };
 
-    testScript = ''
-      def switch_to_tty(tty_number):
-          machine.fail(f"pgrep -f 'agetty.*tty{tty_number}'")
-          machine.send_key(f"alt-f{tty_number}")
-          machine.wait_until_succeeds(f"[ $(fgconsole) = {tty_number} ]")
-          machine.wait_for_unit(f"getty@tty{tty_number}.service")
-          machine.wait_until_succeeds(f"pgrep -f 'agetty.*tty{tty_number}'")
+      users.users.${localUsername} = {
+        isNormalUser = true;
+        password = localPassword;
+      };
+
+      security.pam.services.login.makeHomeDir = true;
+
+      users.mysql = {
+        enable = true;
+        host = "127.0.0.1";
+        user = dbUser;
+        database = dbName;
+        passwordFile = "${builtins.toFile "dbPassword" dbPassword}";
+        pam = {
+          table = "users";
+          userColumn = "name";
+          passwordColumn = "password";
+          passwordCrypt = "sha256";
+          disconnectEveryOperation = true;
+        };
+        nss = {
+          getpwnam = ''
+            SELECT name, 'x', uid, gid, name, CONCAT('/home/', name), "/run/current-system/sw/bin/bash" \
+            FROM users \
+            WHERE name='%1$s' \
+            LIMIT 1
+          '';
+          getpwuid = ''
+            SELECT name, 'x', uid, gid, name, CONCAT('/home/', name), "/run/current-system/sw/bin/bash" \
+            FROM users \
+            WHERE uid=%1$u \
+            LIMIT 1
+          '';
+          getspnam = ''
+            SELECT name, password, 1, 0, 99999, 7, 0, -1, 0 \
+            FROM users \
+            WHERE name='%1$s' \
+            LIMIT 1
+          '';
+          getpwent = ''
+            SELECT name, 'x', uid, gid, name, CONCAT('/home/', name), "/run/current-system/sw/bin/bash" \
+            FROM users
+          '';
+          getspent = ''
+            SELECT name, password, 1, 0, 99999, 7, 0, -1, 0 \
+            FROM users
+          '';
+          getgrnam = ''
+            SELECT name, 'x', gid FROM groups WHERE name='%1$s' LIMIT 1
+          '';
+          getgrgid = ''
+            SELECT name, 'x', gid FROM groups WHERE gid='%1$u' LIMIT 1
+          '';
+          getgrent = ''
+            SELECT name, 'x', gid FROM groups
+          '';
+          memsbygid = ''
+            SELECT name FROM users WHERE gid=%1$u
+          '';
+          gidsbymem = ''
+            SELECT gid FROM users WHERE name='%1$s'
+          '';
+        };
+      };
+    };
+
+  testScript = ''
+    def switch_to_tty(tty_number):
+        machine.fail(f"pgrep -f 'agetty.*tty{tty_number}'")
+        machine.send_key(f"alt-f{tty_number}")
+        machine.wait_until_succeeds(f"[ $(fgconsole) = {tty_number} ]")
+        machine.wait_for_unit(f"getty@tty{tty_number}.service")
+        machine.wait_until_succeeds(f"pgrep -f 'agetty.*tty{tty_number}'")
 
 
-      def try_login(tty_number, username, password):
-          machine.wait_until_tty_matches(tty_number, "login: ")
-          machine.send_chars(f"{username}\n")
-          machine.wait_until_tty_matches(tty_number, f"login: {username}")
-          machine.wait_until_succeeds("pgrep login")
-          machine.wait_until_tty_matches(tty_number, "Password: ")
-          machine.send_chars(f"{password}\n")
+    def try_login(tty_number, username, password):
+        machine.wait_until_tty_matches(tty_number, "login: ")
+        machine.send_chars(f"{username}\n")
+        machine.wait_until_tty_matches(tty_number, f"login: {username}")
+        machine.wait_until_succeeds("pgrep login")
+        machine.wait_until_tty_matches(tty_number, "Password: ")
+        machine.send_chars(f"{password}\n")
 
 
-      machine.wait_for_unit("multi-user.target")
-      machine.wait_for_unit("mysql.service")
-      machine.wait_until_succeeds("cat /etc/security/pam_mysql.conf | grep users.db_passwd")
-      machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("mysql.service")
+    machine.wait_until_succeeds("cat /etc/security/pam_mysql.conf | grep users.db_passwd")
+    machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
 
-      with subtest("Local login"):
-          switch_to_tty("2")
-          try_login("2", "${localUsername}", "${localPassword}")
+    with subtest("Local login"):
+        switch_to_tty("2")
+        try_login("2", "${localUsername}", "${localPassword}")
 
-          machine.wait_until_succeeds("pgrep -u ${localUsername} bash")
-          machine.send_chars("id > local_id.txt\n")
-          machine.wait_for_file("/home/${localUsername}/local_id.txt")
-          machine.succeed("cat /home/${localUsername}/local_id.txt | grep 'uid=1000(${localUsername}) gid=100(users) groups=100(users)'")
+        machine.wait_until_succeeds("pgrep -u ${localUsername} bash")
+        machine.send_chars("id > local_id.txt\n")
+        machine.wait_for_file("/home/${localUsername}/local_id.txt")
+        machine.succeed("cat /home/${localUsername}/local_id.txt | grep 'uid=1000(${localUsername}) gid=100(users) groups=100(users)'")
 
-      with subtest("Local incorrect login"):
-          switch_to_tty("3")
-          try_login("3", "${localUsername}", "wrongpassword")
+    with subtest("Local incorrect login"):
+        switch_to_tty("3")
+        try_login("3", "${localUsername}", "wrongpassword")
 
-          machine.wait_until_tty_matches("3", "Login incorrect")
-          machine.wait_until_tty_matches("3", "login:")
+        machine.wait_until_tty_matches("3", "Login incorrect")
+        machine.wait_until_tty_matches("3", "login:")
 
-      with subtest("MySQL login"):
-          switch_to_tty("4")
-          try_login("4", "${mysqlUsername}", "${mysqlPassword}")
+    with subtest("MySQL login"):
+        switch_to_tty("4")
+        try_login("4", "${mysqlUsername}", "${mysqlPassword}")
 
-          machine.wait_until_succeeds("pgrep -u ${mysqlUsername} bash")
-          machine.send_chars("id > mysql_id.txt\n")
-          machine.wait_for_file("/home/${mysqlUsername}/mysql_id.txt")
-          machine.succeed("cat /home/${mysqlUsername}/mysql_id.txt | grep 'uid=5000(${mysqlUsername}) gid=5000(${mysqlGroup}) groups=5000(${mysqlGroup})'")
+        machine.wait_until_succeeds("pgrep -u ${mysqlUsername} bash")
+        machine.send_chars("id > mysql_id.txt\n")
+        machine.wait_for_file("/home/${mysqlUsername}/mysql_id.txt")
+        machine.succeed("cat /home/${mysqlUsername}/mysql_id.txt | grep 'uid=5000(${mysqlUsername}) gid=5000(${mysqlGroup}) groups=5000(${mysqlGroup})'")
 
-      with subtest("MySQL incorrect login"):
-          switch_to_tty("5")
-          try_login("5", "${mysqlUsername}", "wrongpassword")
+    with subtest("MySQL incorrect login"):
+        switch_to_tty("5")
+        try_login("5", "${mysqlUsername}", "wrongpassword")
 
-          machine.wait_until_tty_matches("5", "Login incorrect")
-          machine.wait_until_tty_matches("5", "login:")
-    '';
-  }
-)
+        machine.wait_until_tty_matches("5", "Login incorrect")
+        machine.wait_until_tty_matches("5", "login:")
+  '';
+}
diff --git a/nixos/tests/authelia.nix b/nixos/tests/authelia.nix
index 88e300e4cbe4..98abca0fbc57 100644
--- a/nixos/tests/authelia.nix
+++ b/nixos/tests/authelia.nix
@@ -1,187 +1,183 @@
 # Test Authelia as an auth server for Traefik as a reverse proxy of a local web service
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "authelia";
-    meta.maintainers = with lib.maintainers; [ jk ];
+{ lib, ... }:
+{
+  name = "authelia";
+  meta.maintainers = with lib.maintainers; [ jk ];
 
-    nodes = {
-      authelia =
-        {
-          config,
-          pkgs,
-          lib,
-          ...
-        }:
-        {
-          services.authelia.instances.testing = {
-            enable = true;
-            secrets.storageEncryptionKeyFile = "/etc/authelia/storageEncryptionKeyFile";
-            secrets.jwtSecretFile = "/etc/authelia/jwtSecretFile";
-            settings = {
-              authentication_backend.file.path = "/etc/authelia/users_database.yml";
-              access_control.default_policy = "one_factor";
-              session.domain = "example.com";
-              storage.local.path = "/tmp/db.sqlite3";
-              notifier.filesystem.filename = "/tmp/notifications.txt";
-            };
+  nodes = {
+    authelia =
+      {
+        pkgs,
+        ...
+      }:
+      {
+        services.authelia.instances.testing = {
+          enable = true;
+          secrets.storageEncryptionKeyFile = "/etc/authelia/storageEncryptionKeyFile";
+          secrets.jwtSecretFile = "/etc/authelia/jwtSecretFile";
+          settings = {
+            authentication_backend.file.path = "/etc/authelia/users_database.yml";
+            access_control.default_policy = "one_factor";
+            session.domain = "example.com";
+            storage.local.path = "/tmp/db.sqlite3";
+            notifier.filesystem.filename = "/tmp/notifications.txt";
           };
-
-          # These should not be set from nix but through other means to not leak the secret!
-          # This is purely for testing purposes!
-          environment.etc."authelia/storageEncryptionKeyFile" = {
-            mode = "0400";
-            user = "authelia-testing";
-            text = "you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this";
-          };
-          environment.etc."authelia/jwtSecretFile" = {
-            mode = "0400";
-            user = "authelia-testing";
-            text = "a_very_important_secret";
-          };
-          environment.etc."authelia/users_database.yml" = {
-            mode = "0400";
-            user = "authelia-testing";
-            text = ''
-              users:
-                bob:
-                  disabled: false
-                  displayname: bob
-                  # password of password
-                  password: $argon2id$v=19$m=65536,t=3,p=4$2ohUAfh9yetl+utr4tLcCQ$AsXx0VlwjvNnCsa70u4HKZvFkC8Gwajr2pHGKcND/xs
-                  email: bob@jim.com
-                  groups:
-                    - admin
-                    - dev
-            '';
-          };
-
-          services.traefik = {
-            enable = true;
-
-            dynamicConfigOptions = {
-              tls.certificates =
-                let
-                  certDir = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
-                    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=example.com/CN=auth.example.com/CN=static.example.com' -days 36500
-                    mkdir -p $out
-                    cp key.pem cert.pem $out
-                  '';
-                in
-                [
-                  {
-                    certFile = "${certDir}/cert.pem";
-                    keyFile = "${certDir}/key.pem";
-                  }
-                ];
-              http.middlewares.authelia.forwardAuth = {
-                address = "http://localhost:9091/api/verify?rd=https%3A%2F%2Fauth.example.com%2F";
-                trustForwardHeader = true;
-                authResponseHeaders = [
-                  "Remote-User"
-                  "Remote-Groups"
-                  "Remote-Email"
-                  "Remote-Name"
-                ];
-              };
-              http.middlewares.authelia-basic.forwardAuth = {
-                address = "http://localhost:9091/api/verify?auth=basic";
-                trustForwardHeader = true;
-                authResponseHeaders = [
-                  "Remote-User"
-                  "Remote-Groups"
-                  "Remote-Email"
-                  "Remote-Name"
-                ];
-              };
-
-              http.routers.simplehttp = {
-                rule = "Host(`static.example.com`)";
-                tls = true;
-                entryPoints = "web";
-                service = "simplehttp";
-              };
-              http.routers.simplehttp-basic-auth = {
-                rule = "Host(`static-basic-auth.example.com`)";
-                tls = true;
-                entryPoints = "web";
-                service = "simplehttp";
-                middlewares = [ "authelia-basic@file" ];
-              };
-
-              http.services.simplehttp = {
-                loadBalancer.servers = [
-                  {
-                    url = "http://localhost:8000";
-                  }
-                ];
-              };
-
-              http.routers.authelia = {
-                rule = "Host(`auth.example.com`)";
-                tls = true;
-                entryPoints = "web";
-                service = "authelia@file";
-              };
-
-              http.services.authelia = {
-                loadBalancer.servers = [
-                  {
-                    url = "http://localhost:9091";
-                  }
-                ];
-              };
-            };
-
-            staticConfigOptions = {
-              global = {
-                checkNewVersion = false;
-                sendAnonymousUsage = false;
-              };
-
-              entryPoints.web.address = ":443";
-            };
-          };
-
-          systemd.services.simplehttp =
-            let
-              fakeWebPageDir = pkgs.writeTextDir "index.html" "hello";
-            in
-            {
-              script = "${pkgs.python3}/bin/python -m http.server --directory ${fakeWebPageDir} 8000";
-              serviceConfig.Type = "simple";
-              wantedBy = [ "multi-user.target" ];
-            };
         };
-    };
 
-    testScript = ''
-      start_all()
+        # These should not be set from nix but through other means to not leak the secret!
+        # This is purely for testing purposes!
+        environment.etc."authelia/storageEncryptionKeyFile" = {
+          mode = "0400";
+          user = "authelia-testing";
+          text = "you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this";
+        };
+        environment.etc."authelia/jwtSecretFile" = {
+          mode = "0400";
+          user = "authelia-testing";
+          text = "a_very_important_secret";
+        };
+        environment.etc."authelia/users_database.yml" = {
+          mode = "0400";
+          user = "authelia-testing";
+          text = ''
+            users:
+              bob:
+                disabled: false
+                displayname: bob
+                # password of password
+                password: $argon2id$v=19$m=65536,t=3,p=4$2ohUAfh9yetl+utr4tLcCQ$AsXx0VlwjvNnCsa70u4HKZvFkC8Gwajr2pHGKcND/xs
+                email: bob@jim.com
+                groups:
+                  - admin
+                  - dev
+          '';
+        };
 
-      authelia.wait_for_unit("simplehttp.service")
-      authelia.wait_for_unit("traefik.service")
-      authelia.wait_for_unit("authelia-testing.service")
-      authelia.wait_for_open_port(443)
-      authelia.wait_for_unit("multi-user.target")
+        services.traefik = {
+          enable = true;
 
-      with subtest("Check for authelia"):
-        # expect the login page
-        assert "Login - Authelia", "could not reach authelia" in \
-          authelia.succeed("curl --insecure -sSf -H Host:auth.example.com https://authelia:443/")
+          dynamicConfigOptions = {
+            tls.certificates =
+              let
+                certDir = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+                  openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=example.com/CN=auth.example.com/CN=static.example.com' -days 36500
+                  mkdir -p $out
+                  cp key.pem cert.pem $out
+                '';
+              in
+              [
+                {
+                  certFile = "${certDir}/cert.pem";
+                  keyFile = "${certDir}/key.pem";
+                }
+              ];
+            http.middlewares.authelia.forwardAuth = {
+              address = "http://localhost:9091/api/verify?rd=https%3A%2F%2Fauth.example.com%2F";
+              trustForwardHeader = true;
+              authResponseHeaders = [
+                "Remote-User"
+                "Remote-Groups"
+                "Remote-Email"
+                "Remote-Name"
+              ];
+            };
+            http.middlewares.authelia-basic.forwardAuth = {
+              address = "http://localhost:9091/api/verify?auth=basic";
+              trustForwardHeader = true;
+              authResponseHeaders = [
+                "Remote-User"
+                "Remote-Groups"
+                "Remote-Email"
+                "Remote-Name"
+              ];
+            };
 
-      with subtest("Check contacting basic http server via traefik with https works"):
-        assert "hello", "could not reach raw static site" in \
-          authelia.succeed("curl --insecure -sSf -H Host:static.example.com https://authelia:443/")
+            http.routers.simplehttp = {
+              rule = "Host(`static.example.com`)";
+              tls = true;
+              entryPoints = "web";
+              service = "simplehttp";
+            };
+            http.routers.simplehttp-basic-auth = {
+              rule = "Host(`static-basic-auth.example.com`)";
+              tls = true;
+              entryPoints = "web";
+              service = "simplehttp";
+              middlewares = [ "authelia-basic@file" ];
+            };
 
-      with subtest("Test traefik and authelia"):
-        with subtest("No details fail"):
-          authelia.fail("curl --insecure -sSf -H Host:static-basic-auth.example.com https://authelia:443/")
-        with subtest("Incorrect details fail"):
-          authelia.fail("curl --insecure -sSf -u 'bob:wordpass' -H Host:static-basic-auth.example.com https://authelia:443/")
-          authelia.fail("curl --insecure -sSf -u 'alice:password' -H Host:static-basic-auth.example.com https://authelia:443/")
-        with subtest("Correct details pass"):
-          assert "hello", "could not reach authed static site with valid credentials" in \
-            authelia.succeed("curl --insecure -sSf -u 'bob:password' -H Host:static-basic-auth.example.com https://authelia:443/")
-    '';
-  }
-)
+            http.services.simplehttp = {
+              loadBalancer.servers = [
+                {
+                  url = "http://localhost:8000";
+                }
+              ];
+            };
+
+            http.routers.authelia = {
+              rule = "Host(`auth.example.com`)";
+              tls = true;
+              entryPoints = "web";
+              service = "authelia@file";
+            };
+
+            http.services.authelia = {
+              loadBalancer.servers = [
+                {
+                  url = "http://localhost:9091";
+                }
+              ];
+            };
+          };
+
+          staticConfigOptions = {
+            global = {
+              checkNewVersion = false;
+              sendAnonymousUsage = false;
+            };
+
+            entryPoints.web.address = ":443";
+          };
+        };
+
+        systemd.services.simplehttp =
+          let
+            fakeWebPageDir = pkgs.writeTextDir "index.html" "hello";
+          in
+          {
+            script = "${pkgs.python3}/bin/python -m http.server --directory ${fakeWebPageDir} 8000";
+            serviceConfig.Type = "simple";
+            wantedBy = [ "multi-user.target" ];
+          };
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    authelia.wait_for_unit("simplehttp.service")
+    authelia.wait_for_unit("traefik.service")
+    authelia.wait_for_unit("authelia-testing.service")
+    authelia.wait_for_open_port(443)
+    authelia.wait_for_unit("multi-user.target")
+
+    with subtest("Check for authelia"):
+      # expect the login page
+      assert "Login - Authelia", "could not reach authelia" in \
+        authelia.succeed("curl --insecure -sSf -H Host:auth.example.com https://authelia:443/")
+
+    with subtest("Check contacting basic http server via traefik with https works"):
+      assert "hello", "could not reach raw static site" in \
+        authelia.succeed("curl --insecure -sSf -H Host:static.example.com https://authelia:443/")
+
+    with subtest("Test traefik and authelia"):
+      with subtest("No details fail"):
+        authelia.fail("curl --insecure -sSf -H Host:static-basic-auth.example.com https://authelia:443/")
+      with subtest("Incorrect details fail"):
+        authelia.fail("curl --insecure -sSf -u 'bob:wordpass' -H Host:static-basic-auth.example.com https://authelia:443/")
+        authelia.fail("curl --insecure -sSf -u 'alice:password' -H Host:static-basic-auth.example.com https://authelia:443/")
+      with subtest("Correct details pass"):
+        assert "hello", "could not reach authed static site with valid credentials" in \
+          authelia.succeed("curl --insecure -sSf -u 'bob:password' -H Host:static-basic-auth.example.com https://authelia:443/")
+  '';
+}
diff --git a/nixos/tests/auto-cpufreq.nix b/nixos/tests/auto-cpufreq.nix
index 79129cf1ffaf..a86fe02bf098 100644
--- a/nixos/tests/auto-cpufreq.nix
+++ b/nixos/tests/auto-cpufreq.nix
@@ -1,33 +1,27 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{
+  name = "auto-cpufreq-server";
 
-  {
-    name = "auto-cpufreq-server";
-
-    nodes = {
-      machine =
-        { pkgs, ... }:
-        {
-          # service will still start but since vm inside qemu cpufreq adjustments
-          # cannot be made. This will resource in the following error but the service
-          # remains up:
-          #   ERROR:
-          #   Couldn't find any of the necessary scaling governors.
-          services.auto-cpufreq = {
-            enable = true;
-            settings = {
-              charger = {
-                turbo = "auto";
-              };
-            };
+  nodes = {
+    machine = {
+      # service will still start but since vm inside qemu cpufreq adjustments
+      # cannot be made. This will resource in the following error but the service
+      # remains up:
+      #   ERROR:
+      #   Couldn't find any of the necessary scaling governors.
+      services.auto-cpufreq = {
+        enable = true;
+        settings = {
+          charger = {
+            turbo = "auto";
           };
         };
+      };
     };
+  };
 
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("auto-cpufreq.service")
-      machine.succeed("auto-cpufreq --force reset")
-    '';
-  }
-)
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("auto-cpufreq.service")
+    machine.succeed("auto-cpufreq --force reset")
+  '';
+}
diff --git a/nixos/tests/autobrr.nix b/nixos/tests/autobrr.nix
index f73f7fbb0d4a..c6b820057272 100644
--- a/nixos/tests/autobrr.nix
+++ b/nixos/tests/autobrr.nix
@@ -1,25 +1,23 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "autobrr";
-    meta.maintainers = with lib.maintainers; [ av-gal ];
+{
+  name = "autobrr";
+  meta.maintainers = with lib.maintainers; [ av-gal ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.autobrr = {
-          enable = true;
-          # We create this secret in the Nix store (making it readable by everyone).
-          # DO NOT DO THIS OUTSIDE OF TESTS!!
-          secretFile = pkgs.writeText "session_secret" "not-secret";
-        };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.autobrr = {
+        enable = true;
+        # We create this secret in the Nix store (making it readable by everyone).
+        # DO NOT DO THIS OUTSIDE OF TESTS!!
+        secretFile = pkgs.writeText "session_secret" "not-secret";
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("autobrr.service")
-      machine.wait_for_open_port(7474)
-      machine.succeed("curl --fail http://localhost:7474/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("autobrr.service")
+    machine.wait_for_open_port(7474)
+    machine.succeed("curl --fail http://localhost:7474/")
+  '';
+}
diff --git a/nixos/tests/avahi.nix b/nixos/tests/avahi.nix
index 7d9432396a28..77cb1d5332cb 100644
--- a/nixos/tests/avahi.nix
+++ b/nixos/tests/avahi.nix
@@ -1,17 +1,14 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  pkgs,
   # bool: whether to use networkd in the tests
   networkd ? false,
-}@args:
+  ...
+}:
 
 # Test whether `avahi-daemon' and `libnss-mdns' work as expected.
-import ./make-test-python.nix {
+{
   name = "avahi";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ ];
-  };
+  meta.maintainers = [ ];
 
   nodes =
     let
@@ -29,7 +26,7 @@ import ./make-test-python.nix {
             extraServiceFiles.ssh = "${pkgs.avahi}/etc/avahi/services/ssh.service";
           };
         }
-        // pkgs.lib.optionalAttrs (networkd) {
+        // pkgs.lib.optionalAttrs networkd {
           networking = {
             useNetworkd = true;
             useDHCP = false;
@@ -84,4 +81,4 @@ import ./make-test-python.nix {
 
     one.log(one.execute("systemd-analyze security avahi-daemon.service | grep -v ✓")[1])
   '';
-} args
+}
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test.nix b/pkgs/applications/editors/emacs/build-support/wrapper-test.nix
new file mode 100644
index 000000000000..f23c8afd8856
--- /dev/null
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test.nix
@@ -0,0 +1,21 @@
+{
+  runCommand,
+  emacs,
+  git,
+}:
+
+runCommand "test-emacs-withPackages-wrapper"
+  {
+    nativeBuildInputs = [
+      (emacs.pkgs.withPackages (
+        epkgs: with epkgs; [
+          magit
+        ]
+      ))
+      git # needed by magit
+    ];
+  }
+  ''
+    emacs --batch --eval="(require 'magit)"
+    touch $out
+  ''
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index 4002b222084a..ef8a5d923822 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -128,6 +128,9 @@
   QuartzCore,
   UniformTypeIdentifiers,
   WebKit,
+
+  # test
+  callPackage,
 }:
 
 assert (withGTK3 && !withNS && variant != "macport") -> withX || withPgtk;
@@ -524,7 +527,12 @@ mkDerivation (finalAttrs: {
     inherit withTreeSitter;
     inherit withXwidgets;
     pkgs = recurseIntoAttrs (emacsPackagesFor finalAttrs.finalPackage);
-    tests = { inherit (nixosTests) emacs-daemon; };
+    tests = {
+      inherit (nixosTests) emacs-daemon;
+      withPackages = callPackage ./build-support/wrapper-test.nix {
+        emacs = finalAttrs.finalPackage;
+      };
+    };
   };
 
   meta = meta // {
diff --git a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
index 36b350daf944..06b283a60766 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
@@ -22,7 +22,7 @@ let
       fetchSubmodules = true;
     };
 
-    patches = (oldAttrs.patches or [ ]) ++ [
+    patches = [
       (fetchpatch {
         url = "https://webrtc.googlesource.com/src/+/e7d10047096880feb5e9846375f2da54aef91202%5E%21/?format=TEXT";
         decode = "base64 -d";
diff --git a/pkgs/applications/science/biology/minc-tools/default.nix b/pkgs/applications/science/biology/minc-tools/default.nix
index d4b98fce8719..8cd3cf2b81ad 100644
--- a/pkgs/applications/science/biology/minc-tools/default.nix
+++ b/pkgs/applications/science/biology/minc-tools/default.nix
@@ -50,6 +50,8 @@ stdenv.mkDerivation rec {
     "-DNIFTI_INCLUDE_DIR=${nifticlib}/include/nifti"
   ];
 
+  env.NIX_CFLAGS_COMPILE = "-D_FillValue=NC_FillValue";
+
   postFixup = ''
     for prog in minccomplete minchistory mincpik; do
       wrapProgram $out/bin/$prog --prefix PERL5LIB : $PERL5LIB
@@ -62,5 +64,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ bcdarwin ];
     platforms = platforms.unix;
     license = licenses.free;
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/by-name/co/copywrite/package.nix b/pkgs/by-name/co/copywrite/package.nix
index f25a3272f76c..125e3dcedc50 100644
--- a/pkgs/by-name/co/copywrite/package.nix
+++ b/pkgs/by-name/co/copywrite/package.nix
@@ -4,8 +4,7 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
-  testers,
-  copywrite,
+  versionCheckHook,
 }:
 
 let
@@ -19,7 +18,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "copywrite";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-DmlPioaw/wMk8GoBYNG24P4J1C6h0bjVjjOuMYW6Tgo=";
   };
 
@@ -42,11 +41,8 @@ buildGoModule rec {
     installShellCompletion copywrite.{bash,zsh,fish}
   '';
 
-  passthru.tests.version = testers.testVersion {
-    package = copywrite;
-    command = "copywrite --version";
-    version = "${version}-${shortCommitHash}";
-  };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
 
   meta = {
     description = "Automate copyright headers and license files at scale";
diff --git a/pkgs/by-name/gu/guile-curl/package.nix b/pkgs/by-name/gu/guile-curl/package.nix
new file mode 100644
index 000000000000..a990544b7600
--- /dev/null
+++ b/pkgs/by-name/gu/guile-curl/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  guile,
+  pkg-config,
+  texinfo,
+  curl,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "guile-curl";
+  version = "0.9";
+
+  src = fetchFromGitHub {
+    owner = "spk121";
+    repo = "guile-curl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nVA0cl4Oog3G+Ww0n0QMxJ66iqTn4VxrV+sqd6ACWl4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    guile
+    pkg-config
+    texinfo
+  ];
+
+  buildInputs = [
+    guile
+    curl
+  ];
+
+  meta = {
+    description = "Bindings to cURL for GNU Guile";
+    homepage = "https://github.com/spk121/guile-curl";
+    changelog = "https://github.com/spk121/guile-curl/releases/tag/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    platforms = guile.meta.platforms;
+  };
+})
diff --git a/pkgs/by-name/ht/htop-vim/package.nix b/pkgs/by-name/ht/htop-vim/package.nix
new file mode 100644
index 000000000000..cc9d20600ad3
--- /dev/null
+++ b/pkgs/by-name/ht/htop-vim/package.nix
@@ -0,0 +1,82 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch2,
+  stdenv,
+  autoreconfHook,
+  pkg-config,
+  ncurses,
+  darwin,
+  libcap,
+  libnl,
+  sensorsSupport ? stdenv.hostPlatform.isLinux,
+  lm_sensors,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  systemd,
+}:
+
+assert systemdSupport -> stdenv.hostPlatform.isLinux;
+
+stdenv.mkDerivation rec {
+  pname = "htop-vim";
+  version = "unstable-2023-02-16";
+
+  src = fetchFromGitHub {
+    owner = "KoffeinFlummi";
+    repo = pname;
+    rev = "b2b58f8f152343b70c33b79ba51a298024278621";
+    hash = "sha256-ZfdBAlnjoy8g6xwrR/i2+dGldMOfLlX6DRlNqB8pkGM=";
+  };
+
+  patches = [
+    # See https://github.com/htop-dev/htop/pull/1412
+    # Remove when updating to 3.4.0
+    (fetchpatch2 {
+      name = "htop-resolve-configuration-path.patch";
+      url = "https://github.com/htop-dev/htop/commit/0dac8e7d38ec3aeae901a987717b5177986197e4.patch";
+      hash = "sha256-Er1d/yV1fioYfEmXNlLO5ayAyXkyy+IaGSx1KWXvlv0=";
+    })
+  ];
+
+  nativeBuildInputs = [ autoreconfHook ] ++ lib.optional stdenv.hostPlatform.isLinux pkg-config;
+
+  buildInputs =
+    [ ncurses ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.IOKit ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      libcap
+      libnl
+    ]
+    ++ lib.optional sensorsSupport lm_sensors
+    ++ lib.optional systemdSupport systemd;
+
+  configureFlags =
+    [
+      "--enable-unicode"
+      "--sysconfdir=/etc"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      "--enable-affinity"
+      "--enable-capabilities"
+      "--enable-delayacct"
+    ]
+    ++ lib.optional sensorsSupport "--enable-sensors";
+
+  postFixup =
+    let
+      optionalPatch = pred: so: lib.optionalString pred "patchelf --add-needed ${so} $out/bin/htop";
+    in
+    lib.optionalString (!stdenv.hostPlatform.isStatic) ''
+      ${optionalPatch sensorsSupport "${lib.getLib lm_sensors}/lib/libsensors.so"}
+      ${optionalPatch systemdSupport "${systemd}/lib/libsystemd.so"}
+    '';
+
+  meta = with lib; {
+    description = "Interactive process viewer, with vim-style keybindings";
+    homepage = "https://github.com/KoffeinFlummi/htop-vim";
+    license = licenses.gpl2Only;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ thiagokokada ];
+    mainProgram = "htop";
+  };
+}
diff --git a/pkgs/by-name/it/itgmania/package.nix b/pkgs/by-name/it/itgmania/package.nix
index 2f34f246d5fa..9247d8596b47 100644
--- a/pkgs/by-name/it/itgmania/package.nix
+++ b/pkgs/by-name/it/itgmania/package.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "itgmania";
-  version = "0.9.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "itgmania";
     repo = "itgmania";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-SAEYkAPNUjGNfNnHfwyOj65i2SpEX0ct/fREob5/6fI=";
+    hash = "sha256-GzpsyyjR7NhgCQ9D7q8G4YU7HhV1C1es1C1355gHnV8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
index 4d01dbb77d25..71b6fdf50035 100644
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
@@ -17,20 +17,20 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.125.0";
+  version = "1.126.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-eo4JxNhVdAUeUmh0yUDE7+6csNbgdrYvf7UU/AMce7U=";
+    hash = "sha256-fEJ4gxftC9oPhmcvbMdwxbZsHVfed9NS8Sjb7BTmTQo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-eAlybi5yDlnhdvVet5Xab4s1emyJrlQuEf3YzusU2M4=";
+    hash = "sha256-P0JNGaRUd3fiwfPLnXQGeTDTURLgqO6g4KRIs86omYg=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/misc/megasync/dont-fetch-clang-format.patch b/pkgs/by-name/me/megasync/dont-fetch-clang-format.patch
similarity index 100%
rename from pkgs/applications/misc/megasync/dont-fetch-clang-format.patch
rename to pkgs/by-name/me/megasync/dont-fetch-clang-format.patch
diff --git a/pkgs/applications/misc/megasync/megasync-fix-cmake-install-bindir.patch b/pkgs/by-name/me/megasync/megasync-fix-cmake-install-bindir.patch
similarity index 100%
rename from pkgs/applications/misc/megasync/megasync-fix-cmake-install-bindir.patch
rename to pkgs/by-name/me/megasync/megasync-fix-cmake-install-bindir.patch
diff --git a/pkgs/applications/misc/megasync/default.nix b/pkgs/by-name/me/megasync/package.nix
similarity index 69%
rename from pkgs/applications/misc/megasync/default.nix
rename to pkgs/by-name/me/megasync/package.nix
index d04ef8ad66e7..210ca2db67c9 100644
--- a/pkgs/applications/misc/megasync/default.nix
+++ b/pkgs/by-name/me/megasync/package.nix
@@ -1,49 +1,46 @@
 {
   lib,
   stdenv,
-  c-ares,
-  cmake,
-  cryptopp,
-  curl,
   fetchFromGitHub,
   fetchpatch,
+
+  # nativeBuildInputs
+  cmake,
+  libsForQt5,
+  libtool,
+  pkg-config,
+  unzip,
+
+  # buildInputs
+  c-ares,
+  cryptopp,
+  curl,
   ffmpeg,
   hicolor-icon-theme,
   icu,
   libmediainfo,
   libsodium,
-  libtool,
   libuv,
   libxcb,
   libzen,
-  mkDerivation,
   openssl,
-  pkg-config,
-  qtbase,
-  qtdeclarative,
-  qtgraphicaleffects,
-  qttools,
-  qtquickcontrols,
-  qtquickcontrols2,
-  qtsvg,
-  qtx11extras,
   readline,
   sqlite,
-  unzip,
   wget,
   xorg,
   zlib,
-  qt5,
+
+  nix-update-script,
 }:
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "megasync";
-  version = "5.7.1.0";
+  version = "5.8.0.2";
 
   src = fetchFromGitHub rec {
     owner = "meganz";
     repo = "MEGAsync";
-    rev = "v${version}_Linux";
-    hash = "sha256-lbAI17CyHrppMnxQDV5g0IE+I7Y0DwU+h5MSFZclD2A=";
+    tag = "v${finalAttrs.version}_Linux";
+    hash = "sha256-/q7LD1/06+0MepDz3fVrlvGKh+rvNk6d1hm7Ng54Nmk=";
     fetchSubmodules = false; # DesignTokensImporter cannot be fetched, see #1010 in github:meganz/megasync
     leaveDotGit = true;
     postFetch = ''
@@ -52,46 +49,13 @@ mkDerivation rec {
       git remote add origin $url
       git fetch origin
       git clean -fdx
-      git checkout ${rev}
+      git checkout ${tag}
       git submodule update --init src/MEGASync/mega
 
       rm -rf .git
     ''; # Why so complicated, I just want a single submodule
   };
 
-  nativeBuildInputs = [
-    cmake
-    libtool
-    pkg-config
-    qttools
-    unzip
-  ];
-  buildInputs = [
-    c-ares
-    cryptopp
-    curl
-    ffmpeg
-    hicolor-icon-theme
-    icu
-    libmediainfo
-    libsodium
-    libuv
-    libxcb
-    libzen
-    openssl
-    qtbase
-    qtdeclarative
-    qtgraphicaleffects
-    qtquickcontrols
-    qtquickcontrols2
-    qtsvg
-    qtx11extras
-    readline
-    sqlite
-    wget
-    zlib
-  ];
-
   patches = [
     (fetchpatch {
       url = "https://aur.archlinux.org/cgit/aur.git/plain/020-megasync-sdk-fix-cmake-dependencies-detection.patch?h=megasync&id=ff59780039697591e7e3a966db058b23bee0451c";
@@ -108,12 +72,49 @@ mkDerivation rec {
   ];
 
   postPatch = ''
-    substituteInPlace cmake/modules/desktopapp_options.cmake --replace-fail "ENABLE_ISOLATED_GFX ON" "ENABLE_ISOLATED_GFX OFF"
+    substituteInPlace cmake/modules/desktopapp_options.cmake \
+      --replace-fail "ENABLE_ISOLATED_GFX ON" "ENABLE_ISOLATED_GFX OFF"
+
     for file in $(find src/ -type f \( -iname configure -o -iname \*.sh \) ); do
-      substituteInPlace "$file" --replace "/bin/bash" "${stdenv.shell}"
+      substituteInPlace "$file" --replace-warn "/bin/bash" "${stdenv.shell}"
     done
   '';
 
+  nativeBuildInputs = [
+    cmake
+    libsForQt5.qttools
+    libsForQt5.wrapQtAppsHook
+    libtool
+    pkg-config
+    unzip
+  ];
+
+  buildInputs = [
+    c-ares
+    cryptopp
+    curl
+    ffmpeg
+    hicolor-icon-theme
+    icu
+    libmediainfo
+    libsForQt5.qtbase
+    libsForQt5.qtdeclarative
+    libsForQt5.qtgraphicaleffects
+    libsForQt5.qtquickcontrols
+    libsForQt5.qtquickcontrols2
+    libsForQt5.qtsvg
+    libsForQt5.qtx11extras
+    libsodium
+    libuv
+    libxcb
+    libzen
+    openssl
+    readline
+    sqlite
+    wget
+    zlib
+  ];
+
   dontUseQmakeConfigure = true;
   enableParallelBuilding = true;
 
@@ -127,14 +128,25 @@ mkDerivation rec {
     qtWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ xorg.xrdb ]})
   '';
 
-  meta = with lib; {
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex=^v(.*)_Linux$"
+      ];
+    };
+  };
+
+  meta = {
     description = "Easy automated syncing between your computers and your MEGA Cloud Drive";
     homepage = "https://mega.nz/";
-    license = licenses.unfree;
+    downloadPage = "https://github.com/meganz/MEGAsync";
+    changelog = "https://github.com/meganz/MEGAsync/releases/tag/v${finalAttrs.version}_Linux";
+    license = lib.licenses.unfree;
     platforms = [
       "i686-linux"
       "x86_64-linux"
     ];
     maintainers = [ ];
+    mainProgram = "megasync";
   };
-}
+})
diff --git a/pkgs/by-name/mo/modern-cpp-kafka/package.nix b/pkgs/by-name/mo/modern-cpp-kafka/package.nix
index 3a73192a3ad4..6f1b37ed6452 100644
--- a/pkgs/by-name/mo/modern-cpp-kafka/package.nix
+++ b/pkgs/by-name/mo/modern-cpp-kafka/package.nix
@@ -41,6 +41,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/morganstanley/modern-cpp-kafka/commit/236f8f91f5c3ad6e1055a6f55cd3aebd218e1226.patch";
       hash = "sha256-cy568TQUu08sadq79hDz9jMvDqiDjfr+1cLMxFWGm1Q=";
     })
+    (fetchpatch {
+      name = "macos-find-dylib.patch";
+      url = "https://github.com/morganstanley/modern-cpp-kafka/commit/dc2753cd95b607a7202b40bad3aad472558bf350.patch";
+      hash = "sha256-Te3GwAVRDyb6GFWlvkq1mIcNeXCtMyLr+/w1LilUYbE=";
+    })
   ];
 
   postPatch = ''
@@ -53,13 +58,18 @@ stdenv.mkDerivation rec {
   buildInputs = [ boost ];
   propagatedBuildInputs = [ rdkafka ];
 
-  cmakeFlags = [
-    "-DLIBRDKAFKA_INCLUDE_DIR=${rdkafka.out}/include"
-    "-DGTEST_LIBRARY_DIR=${gtest.out}/lib"
-    "-DGTEST_INCLUDE_DIR=${gtest.dev}/include"
-    "-DRAPIDJSON_INCLUDE_DIRS=${rapidjson.out}/include"
-    "-DCMAKE_CXX_FLAGS=-Wno-uninitialized"
-  ];
+  cmakeFlags =
+    let
+      inherit (lib) cmakeFeature getLib getInclude;
+    in
+    [
+      (cmakeFeature "LIBRDKAFKA_LIBRARY_DIR" "${getLib rdkafka}/lib")
+      (cmakeFeature "LIBRDKAFKA_INCLUDE_DIR" "${getInclude rdkafka}/include")
+      (cmakeFeature "GTEST_LIBRARY_DIR" "${getLib gtest}/lib")
+      (cmakeFeature "GTEST_INCLUDE_DIR" "${getInclude gtest}/include")
+      (cmakeFeature "RAPIDJSON_INCLUDE_DIRS" "${getInclude rapidjson}/include")
+      (cmakeFeature "CMAKE_CXX_FLAGS" "-Wno-uninitialized")
+    ];
 
   checkInputs = [
     gtest
diff --git a/pkgs/by-name/ne/netcdf/package.nix b/pkgs/by-name/ne/netcdf/package.nix
index 1bdaf7068552..42aa89ab7d94 100644
--- a/pkgs/by-name/ne/netcdf/package.nix
+++ b/pkgs/by-name/ne/netcdf/package.nix
@@ -20,11 +20,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "netcdf" + lib.optionalString mpiSupport "-mpi";
-  version = "4.9.2";
+  version = "4.9.3";
 
   src = fetchurl {
     url = "https://downloads.unidata.ucar.edu/netcdf-c/${version}/netcdf-c-${version}.tar.gz";
-    hash = "sha256-zxG6u725lj8J9VB54LAZ9tA3H1L44SZKW6jp/asabEg=";
+    hash = "sha256-pHQUmETmFEVmZz+s8Jf+olPchDw3vAp9PeBH3Irdpd0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ne/netcdfcxx4/netcdf.patch b/pkgs/by-name/ne/netcdfcxx4/netcdf.patch
new file mode 100644
index 000000000000..ad1d65a5da77
--- /dev/null
+++ b/pkgs/by-name/ne/netcdfcxx4/netcdf.patch
@@ -0,0 +1,49 @@
+From b819b3616b96352d23cdf0840df9e6674437948c Mon Sep 17 00:00:00 2001
+From: Orion Poplawski <orion@nwra.com>
+Date: Mon, 17 Feb 2025 15:17:28 -0700
+Subject: [PATCH] Use HAVE_NC_SET_LOG_LEVEL to determine usage of
+ nc_set_log_level (fixes #161)
+
+---
+ cxx4/test_filter.cpp                | 2 ++
+ examples/pres_temp_4D_plugin_wr.cpp | 4 ++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/cxx4/test_filter.cpp b/cxx4/test_filter.cpp
+index 879ba71..f442c64 100644
+--- a/cxx4/test_filter.cpp
++++ b/cxx4/test_filter.cpp
+@@ -30,7 +30,9 @@ int main()
+   try
+     {
+       NcFile test("pres_temp_plugin_4D.nc", NcFile::replace);
++#ifdef HAVE_NC_SET_LOG_LEVEL
+       nc_set_log_level(5);
++#endif
+       // Define the dimensions. NetCDF will hand back an ncDim object for
+       // each.
+       NcDim latDim = test.addDim(LAT_NAME, NLAT);
+diff --git a/examples/pres_temp_4D_plugin_wr.cpp b/examples/pres_temp_4D_plugin_wr.cpp
+index 832d2a6..584e8be 100644
+--- a/examples/pres_temp_4D_plugin_wr.cpp
++++ b/examples/pres_temp_4D_plugin_wr.cpp
+@@ -71,7 +71,9 @@ string LON_UNITS = "degrees_east";
+ 
+ int main()
+ {
++#ifdef HAVE_NC_SET_LOG_LEVEL
+   nc_set_log_level(5);
++#endif
+   // We will write latitude and longitude fields.
+    float lats[NLAT],lons[NLON];
+ 
+@@ -103,7 +105,9 @@ int main()
+ 
+       // Create the file.
+       NcFile test(FILE_NAME, NcFile::replace);
++#ifdef HAVE_NC_SET_LOG_LEVEL
+       nc_set_log_level(5);
++#endif
+       // Define the dimensions. NetCDF will hand back an ncDim object for
+       // each.
+       NcDim lvlDim = test.addDim(LVL_NAME, NLVL);
diff --git a/pkgs/by-name/ne/netcdfcxx4/package.nix b/pkgs/by-name/ne/netcdfcxx4/package.nix
index a94c3bde5624..b96c8f89f6ed 100644
--- a/pkgs/by-name/ne/netcdfcxx4/package.nix
+++ b/pkgs/by-name/ne/netcdfcxx4/package.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
   patches = [
     # This fix is included upstream, remove with next upgrade
     ./cmake-h5free.patch
+    ./netcdf.patch
   ];
 
   preConfigure = ''
diff --git a/pkgs/by-name/pw/pwvucontrol/package.nix b/pkgs/by-name/pw/pwvucontrol/package.nix
index 67811de73122..62975da236f1 100644
--- a/pkgs/by-name/pw/pwvucontrol/package.nix
+++ b/pkgs/by-name/pw/pwvucontrol/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   fetchFromGitLab,
+  fetchpatch,
   cargo,
   desktop-file-utils,
   meson,
@@ -31,6 +32,13 @@ let
       tag = version;
       hash = "sha256-vhpQT67+849WV1SFthQdUeFnYe/okudTQJoL3y+wXwI=";
     };
+
+    patches = [
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/wireplumber/-/commit/f4f495ee212c46611303dec9cd18996830d7f721.patch";
+        hash = "sha256-dxVlXFGyNvWKZBrZniFatPPnK+38pFGig7LGAsc6Ydc=";
+      })
+    ];
   });
 in
 stdenv.mkDerivation (finalAttrs: {
diff --git a/pkgs/by-name/qu/quirc/0001-Don-t-build-demos.patch b/pkgs/by-name/qu/quirc/0001-Don-t-build-demos.patch
index ac873aec2779..0b52417b45c4 100644
--- a/pkgs/by-name/qu/quirc/0001-Don-t-build-demos.patch
+++ b/pkgs/by-name/qu/quirc/0001-Don-t-build-demos.patch
@@ -1,8 +1,33 @@
+From 7435b2e12c2004cb0c497ff313288902f2a6f39a Mon Sep 17 00:00:00 2001
+From: toonn <toonn@toonn.io>
+Date: Fri, 19 Jul 2024 21:53:58 +0200
+Subject: [PATCH] Don't build demos
+
+---
+ Makefile | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
 diff --git a/Makefile b/Makefile
-index 8327b4e..c269291 100644
+index 8327b4e..7901cc5 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -99,9 +99,6 @@ install: libquirc.a libquirc.$(LIB_SUFFIX) quirc-demo quirc-scanner
+@@ -45,7 +45,7 @@ DEMO_UTIL_OBJ = \
+ 
+ OPENCV_CFLAGS := $(shell pkg-config --cflags opencv4 2>&1)
+ OPENCV_LIBS = $(shell pkg-config --libs opencv4)
+-QUIRC_CXXFLAGS = $(QUIRC_CFLAGS) $(OPENCV_CFLAGS) --std=c++17
++QUIRC_CXXFLAGS = $(QUIRC_CFLAGS) --std=c++17
+ 
+ .PHONY: all v4l sdl opencv install uninstall clean
+ 
+@@ -93,15 +93,12 @@ libquirc.$(VERSIONED_LIB_SUFFIX): $(LIB_OBJ)
+ .cxx.o:
+ 	$(CXX) $(QUIRC_CXXFLAGS) -o $@ -c $<
+ 
+-install: libquirc.a libquirc.$(LIB_SUFFIX) quirc-demo quirc-scanner
++install: libquirc.a libquirc.$(LIB_SUFFIX)
+ 	install -o root -g root -m 0644 lib/quirc.h $(DESTDIR)$(PREFIX)/include
+ 	install -o root -g root -m 0644 libquirc.a $(DESTDIR)$(PREFIX)/lib
  	install -o root -g root -m 0755 libquirc.$(VERSIONED_LIB_SUFFIX) \
  		$(DESTDIR)$(PREFIX)/lib
  	cp -d libquirc.$(LIB_SUFFIX) $(DESTDIR)$(PREFIX)/lib
@@ -12,3 +37,6 @@ index 8327b4e..c269291 100644
  
  uninstall:
  	rm -f $(DESTDIR)$(PREFIX)/include/quirc.h
+-- 
+2.42.2
+
diff --git a/pkgs/by-name/rd/rdkafka/package.nix b/pkgs/by-name/rd/rdkafka/package.nix
index 9405e9f3951c..c07800cebd6d 100644
--- a/pkgs/by-name/rd/rdkafka/package.nix
+++ b/pkgs/by-name/rd/rdkafka/package.nix
@@ -4,11 +4,10 @@
   fetchFromGitHub,
   zlib,
   zstd,
-  pkg-config,
-  python3,
   openssl,
-  which,
   curl,
+  cmake,
+  ninja,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -22,10 +21,14 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-OCCsxgEO8UvCcC0XwzqpqmaT8dV0Klrspp+2o1FbH2Y=";
   };
 
+  outputs = [
+    "out"
+    "dev"
+  ];
+
   nativeBuildInputs = [
-    pkg-config
-    python3
-    which
+    cmake
+    ninja
   ];
 
   buildInputs = [
@@ -35,12 +38,30 @@ stdenv.mkDerivation (finalAttrs: {
     curl
   ];
 
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow";
+  # examples and tests don't build on darwin statically
+  cmakeFlags = [
+    (lib.cmakeBool "RDKAFKA_BUILD_STATIC" stdenv.hostPlatform.isStatic)
+    (lib.cmakeBool "RDKAFKA_BUILD_TESTS" (
+      !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isStatic
+    ))
+    (lib.cmakeBool "RDKAFKA_BUILD_EXAMPLES" (
+      !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isStatic
+    ))
+    (lib.cmakeFeature "CMAKE_C_FLAGS" "-Wno-error=strict-overflow")
+  ];
 
   postPatch = ''
     patchShebangs .
   '';
 
+  postFixup = lib.optionalString stdenv.hostPlatform.isStatic ''
+    # rdkafka changes the library names for static libraries but users in pkgsStatic aren't likely to be aware of this
+    # make sure the libraries are findable with both names
+    for pc in rdkafka{,++}; do
+      ln -s $dev/lib/pkgconfig/$pc{-static,}.pc
+    done
+  '';
+
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/by-name/ry/ryubing/deps.json b/pkgs/by-name/ry/ryubing/deps.json
index fc8d66861af9..9d5a449410d2 100644
--- a/pkgs/by-name/ry/ryubing/deps.json
+++ b/pkgs/by-name/ry/ryubing/deps.json
@@ -151,8 +151,8 @@
   },
   {
     "pname": "Gommon",
-    "version": "2.7.1",
-    "hash": "sha256-tD1gdk4umsl7r5jFd2Wyx3zeRE9BX1FQfZMYoCcpmwY="
+    "version": "2.7.1.1",
+    "hash": "sha256-2AnVtyEbg5A+K/LDjgOpKw/CNRDkAhjVa38L5LYYyrw="
   },
   {
     "pname": "HarfBuzzSharp",
@@ -829,11 +829,6 @@
     "version": "0.1.0",
     "hash": "sha256-+K7ObC9ucilwWY+Tlf9KcrAVoTFS65V6Di7JDWDSZTg="
   },
-  {
-    "pname": "SharpMetal",
-    "version": "1.0.0-preview21",
-    "hash": "sha256-ixS88SuK94KfBONdTgXSPSI4tftqekjQ3aJ502rG3Vo="
-  },
   {
     "pname": "SharpZipLib",
     "version": "1.4.2",
diff --git a/pkgs/by-name/ry/ryubing/package.nix b/pkgs/by-name/ry/ryubing/package.nix
index 5a9b762224ef..cb2149c0318c 100644
--- a/pkgs/by-name/ry/ryubing/package.nix
+++ b/pkgs/by-name/ry/ryubing/package.nix
@@ -30,13 +30,13 @@
 
 buildDotnetModule rec {
   pname = "ryubing";
-  version = "1.2.82";
+  version = "1.2.86";
 
   src = fetchFromGitHub {
     owner = "Ryubing";
     repo = "Ryujinx";
     rev = version;
-    hash = "sha256-pLzmfrdjpn2DTg2AJF1yyTJJPxHScQTX+yq9MbuzMHk=";
+    hash = "sha256-fRdSmdejTK4BUAw5nj3hGCu5u2yZ+tZDN0PoCRzEZIw=";
   };
 
   nativeBuildInputs = lib.optional stdenv.isDarwin [
diff --git a/pkgs/by-name/sd/sdl2-compat/find-headers.patch b/pkgs/by-name/sd/sdl2-compat/find-headers.patch
new file mode 100644
index 000000000000..4b6687cc4078
--- /dev/null
+++ b/pkgs/by-name/sd/sdl2-compat/find-headers.patch
@@ -0,0 +1,31 @@
+diff --git a/SDL2Config.cmake.in b/SDL2Config.cmake.in
+index 80c1b99..54f50e6 100644
+--- a/SDL2Config.cmake.in
++++ b/SDL2Config.cmake.in
+@@ -45,7 +45,8 @@ endif()
+ set(SDL2_PREFIX "@PACKAGE_CMAKE_INSTALL_PREFIX@")
+ set(SDL2_EXEC_PREFIX "@PACKAGE_CMAKE_INSTALL_PREFIX@")
+ set(SDL2_INCLUDE_DIR "@PACKAGE_CMAKE_INSTALL_FULL_INCLUDEDIR@/SDL2")
+-set(SDL2_INCLUDE_DIRS "@PACKAGE_CMAKE_INSTALL_FULL_INCLUDEDIR@;@PACKAGE_CMAKE_INSTALL_FULL_INCLUDEDIR@/SDL2")
++set(SDL2_INCLUDE_DIRS "@PACKAGE_CMAKE_INSTALL_FULL_INCLUDEDIR@;@PACKAGE_CMAKE_INSTALL_FULL_INCLUDEDIR@/SDL2" $ENV{SDL2_PATH})
++separate_arguments(SDL2_INCLUDE_DIRS)
+ set(SDL2_BINDIR "@PACKAGE_CMAKE_INSTALL_FULL_BINDIR@")
+ set(SDL2_LIBDIR "@PACKAGE_CMAKE_INSTALL_FULL_LIBDIR@")
+ set(SDL2_LIBRARIES SDL2::SDL2)
+diff --git a/sdl2-config.in b/sdl2-config.in
+index d21b1b2..bb0d624 100644
+--- a/sdl2-config.in
++++ b/sdl2-config.in
+@@ -50,7 +50,11 @@ while test $# -gt 0; do
+       echo @PROJECT_VERSION@
+       ;;
+     --cflags)
+-      echo -I${includedir}/SDL2 @SDL_CFLAGS@
++      SDL_CFLAGS=""
++      for i in @includedir@/SDL2 $SDL2_PATH; do
++        SDL_CFLAGS="$SDL_CFLAGS -I$i"
++      done
++      echo $SDL_CFLAGS @SDL_CFLAGS@
+       ;;
+ @ENABLE_SHARED_TRUE@    --libs)
+ @ENABLE_SHARED_TRUE@      echo -L${libdir} @SDL_RLD_FLAGS@ @SDL_LIBS@
diff --git a/pkgs/by-name/sd/sdl2-compat/package.nix b/pkgs/by-name/sd/sdl2-compat/package.nix
index 6d4507dc41ae..392641b68f36 100644
--- a/pkgs/by-name/sd/sdl2-compat/package.nix
+++ b/pkgs/by-name/sd/sdl2-compat/package.nix
@@ -44,21 +44,21 @@ stdenv.mkDerivation (finalAttrs: {
 
   outputBin = "dev";
 
+  # SDL3 is dlopened at runtime, leave it in runpath
+  dontPatchELF = true;
+
   cmakeFlags = [
     (lib.cmakeBool "SDL2COMPAT_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeFeature "CMAKE_INSTALL_RPATH" (lib.makeLibraryPath [ sdl3 ]))
   ];
 
+  # skip timing-based tests as those are flaky
+  env.SDL_TESTS_QUICK = 1;
+
   doCheck = testSupport && stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
-  postFixup =
-    if stdenv.hostPlatform.isDarwin then
-      ''
-        install_name_tool -add_rpath ${lib.makeLibraryPath [ sdl3 ]} $out/lib/libSDL2.dylib
-      ''
-    else
-      ''
-        patchelf --add-rpath ${lib.makeLibraryPath [ sdl3 ]} $out/lib/libSDL2.so
-      '';
+  patches = [ ./find-headers.patch ];
+  setupHook = ./setup-hook.sh;
 
   passthru = {
     tests =
@@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/libsdl-org/sdl2-compat/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.zlib;
     maintainers = with lib.maintainers; [ nadiaholmquist ];
-    platforms = lib.platforms.unix;
+    platforms = lib.platforms.all;
     pkgConfigModules = [ "sdl2_compat" ];
   };
 })
diff --git a/pkgs/by-name/sd/sdl2-compat/setup-hook.sh b/pkgs/by-name/sd/sdl2-compat/setup-hook.sh
new file mode 100644
index 000000000000..0119926491af
--- /dev/null
+++ b/pkgs/by-name/sd/sdl2-compat/setup-hook.sh
@@ -0,0 +1,7 @@
+addSDL2Path () {
+  if [ -e "$1/include/SDL2" ]; then
+    export SDL2_PATH="${SDL2_PATH-}${SDL2_PATH:+ }$1/include/SDL2"
+  fi
+}
+
+addEnvHooks "$hostOffset" addSDL2Path
diff --git a/pkgs/by-name/sf/sfeed/package.nix b/pkgs/by-name/sf/sfeed/package.nix
index 87a1dd0ba2f7..5a03727e8561 100644
--- a/pkgs/by-name/sf/sfeed/package.nix
+++ b/pkgs/by-name/sf/sfeed/package.nix
@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sfeed";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchgit {
     url = "git://git.codemadness.org/sfeed";
     tag = finalAttrs.version;
-    hash = "sha256-KVZsVCTkwyOVr37vIXbiPjQLnb9lbuIlNxpZNvHxbEo=";
+    hash = "sha256-ULCYZYRTdrsUaL0XJd5Dxa9Cd0Hc6PVNMnnLTGs4pIo=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/by-name/sh/shopware-cli/package.nix b/pkgs/by-name/sh/shopware-cli/package.nix
index b48a858cac0e..1bddf68f0eb3 100644
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@@ -10,12 +10,12 @@
 
 buildGoModule rec {
   pname = "shopware-cli";
-  version = "0.5.7";
+  version = "0.5.9";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "FriendsOfShopware";
     tag = version;
-    hash = "sha256-2Ld1ANokNGvA4nen5dKdZvMHzU1VvWr/28Ech3vvqfk=";
+    hash = "sha256-js1GSaL2Xns61LBQftYe6qxRG23cqIEi1wPdmd9qCpA=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ buildGoModule rec {
     dart-sass
   ];
 
-  vendorHash = "sha256-Q2M0ia2OF5rDiqqpTaNm2NzcM7Ul8pHcKn2r00/k4jM=";
+  vendorHash = "sha256-Slb5OShcDDjStH3PZ/9YnzpL7rtEPZg3Tf6q/Efq5zI=";
 
   postInstall = ''
     installShellCompletion --cmd shopware-cli \
diff --git a/pkgs/by-name/sl/slacky/package.nix b/pkgs/by-name/sl/slacky/package.nix
new file mode 100644
index 000000000000..873b2154aa2e
--- /dev/null
+++ b/pkgs/by-name/sl/slacky/package.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  electron,
+  copyDesktopItems,
+  makeDesktopItem,
+  nix-update-script,
+}:
+buildNpmPackage rec {
+  pname = "slacky";
+  version = "0.0.5";
+
+  src = fetchFromGitHub {
+    owner = "andirsun";
+    repo = "Slacky";
+    tag = "v${version}";
+    hash = "sha256-nDxmzZqi7xEe4hnY6iXJg+613lSKElWxvF3w8bRDW90=";
+  };
+
+  npmDepsHash = "sha256-9+4cxeQw2Elug+xIgzNvpaSMgDVlBFz/+TW1jJwDm40=";
+
+  npmPackFlags = [ "--ignore-scripts" ];
+
+  nativeBuildInputs = [
+    electron
+    copyDesktopItems
+  ];
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  postInstall = ''
+    mkdir -p $out/share/icons
+    ln -s $out/lib/node_modules/slacky/build/icons/icon.png $out/share/icons/slacky.png
+    makeWrapper ${electron}/bin/electron $out/bin/slacky \
+      --add-flags $out/lib/node_modules/slacky/
+  '';
+
+  desktopItems = lib.singleton (makeDesktopItem {
+    name = "slacky";
+    exec = "slacky %u";
+    icon = "slacky";
+    desktopName = "Slacky";
+    comment = "An unofficial Slack desktop client for arm64 Linux";
+    startupWMClass = "com.andersonlaverde.slacky";
+    type = "Application";
+    categories = [
+      "Network"
+      "InstantMessaging"
+    ];
+    mimeTypes = [
+      "x-scheme-handler/slack"
+    ];
+  });
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Unofficial Slack desktop client for arm64 Linux";
+    homepage = "https://github.com/andirsun/Slacky";
+    changelog = "https://github.com/andirsun/Slacky/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ awwpotato ];
+    platforms = [ "aarch64-linux" ];
+    mainProgram = "slacky";
+  };
+}
diff --git a/pkgs/by-name/st/strongswan/package.nix b/pkgs/by-name/st/strongswan/package.nix
index dfbac679e284..83405418bdca 100644
--- a/pkgs/by-name/st/strongswan/package.nix
+++ b/pkgs/by-name/st/strongswan/package.nix
@@ -5,6 +5,7 @@
 , systemd, pam
 , curl
 , enableTNC            ? false, trousers, sqlite, libxml2
+, enableTPM2           ? false, tpm2-tss
 , enableNetworkManager ? false, networkmanager
 , darwin
 , nixosTests
@@ -31,6 +32,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ curl gmp python3 ldns unbound openssl pcsclite ]
     ++ lib.optionals enableTNC [ trousers sqlite libxml2 ]
+    ++ lib.optional enableTPM2 tpm2-tss
     ++ lib.optionals stdenv.hostPlatform.isLinux [ systemd.dev pam iptables ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [ SystemConfiguration ])
     ++ lib.optionals enableNetworkManager [ networkmanager glib ];
@@ -80,6 +82,8 @@ stdenv.mkDerivation rec {
          "--with-tss=trousers"
          "--enable-aikgen"
          "--enable-sqlite" ]
+    ++ lib.optionals enableTPM2 [
+      "--enable-tpm" "--enable-tss-tss2" ]
     ++ lib.optionals enableNetworkManager [
          "--enable-nm"
          "--with-nm-ca-dir=/etc/ssl/certs" ]
diff --git a/pkgs/development/php-packages/rdkafka/default.nix b/pkgs/development/php-packages/rdkafka/default.nix
index 71d411b594e9..ee0d0f640ca0 100644
--- a/pkgs/development/php-packages/rdkafka/default.nix
+++ b/pkgs/development/php-packages/rdkafka/default.nix
@@ -18,7 +18,7 @@ buildPecl {
 
   postPhpize = ''
     substituteInPlace configure \
-      --replace 'SEARCH_PATH="/usr/local /usr"' 'SEARCH_PATH=${rdkafka}'
+      --replace-fail 'SEARCH_PATH="/usr/local /usr"' 'SEARCH_PATH=${lib.getInclude rdkafka}'
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/databricks-sdk/default.nix b/pkgs/development/python-modules/databricks-sdk/default.nix
index afa4de8209e0..efd1e3a228df 100644
--- a/pkgs/development/python-modules/databricks-sdk/default.nix
+++ b/pkgs/development/python-modules/databricks-sdk/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -22,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "databricks-sdk";
-  version = "0.45.0";
+  version = "0.46.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "databricks-sdk-py";
     tag = "v${version}";
-    hash = "sha256-SoE8MgwOhm82ymjaZQZCzw7hd5DMWxSvgaAwIGlm9cQ=";
+    hash = "sha256-bvtIeysj3FW4Kj2WZeKSGwkqKoWIxKIzJFiduNlaBWE=";
   };
 
   build-system = [
@@ -54,28 +53,23 @@ buildPythonPackage rec {
     requests-mock
   ];
 
-  disabledTests =
-    [
-      # Require internet access
-      # ValueError: default auth: cannot configure default credentials, please check...
-      "test_azure_cli_does_not_specify_tenant_id_with_msi"
-      "test_azure_cli_fallback"
-      "test_azure_cli_user_no_management_access"
-      "test_azure_cli_user_with_management_access"
-      "test_azure_cli_with_warning_on_stderr"
-      "test_azure_cli_workspace_header_present"
-      "test_config_azure_cli_host"
-      "test_config_azure_cli_host_and_resource_id"
-      "test_config_azure_cli_host_and_resource_i_d_configuration_precedence"
-      "test_load_azure_tenant_id_404"
-      "test_load_azure_tenant_id_happy_path"
-      "test_load_azure_tenant_id_no_location_header"
-      "test_load_azure_tenant_id_unparsable_location_header"
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-      # requests.exceptions.ChunkedEncodingError: ("Connection broken: ConnectionResetError(54, 'Connection reset by peer')", ConnectionResetError(54, 'Connection reset by peer'))
-      "test_github_oidc_flow_works_with_azure"
-    ];
+  disabledTests = [
+    # Require internet access
+    # ValueError: default auth: cannot configure default credentials, please check...
+    "test_azure_cli_does_not_specify_tenant_id_with_msi"
+    "test_azure_cli_fallback"
+    "test_azure_cli_user_no_management_access"
+    "test_azure_cli_user_with_management_access"
+    "test_azure_cli_with_warning_on_stderr"
+    "test_azure_cli_workspace_header_present"
+    "test_config_azure_cli_host"
+    "test_config_azure_cli_host_and_resource_id"
+    "test_config_azure_cli_host_and_resource_i_d_configuration_precedence"
+    "test_load_azure_tenant_id_404"
+    "test_load_azure_tenant_id_happy_path"
+    "test_load_azure_tenant_id_no_location_header"
+    "test_load_azure_tenant_id_unparsable_location_header"
+  ];
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/development/python-modules/dnf4/default.nix b/pkgs/development/python-modules/dnf4/default.nix
index c8d675d7b6ea..980e49b917b6 100644
--- a/pkgs/development/python-modules/dnf4/default.nix
+++ b/pkgs/development/python-modules/dnf4/default.nix
@@ -18,7 +18,7 @@ in
 
 buildPythonPackage rec {
   pname = "dnf4";
-  version = "4.22.0";
+  version = "4.23.0";
   format = "other";
 
   outputs = [
@@ -30,8 +30,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "rpm-software-management";
     repo = "dnf";
-    rev = version;
-    hash = "sha256-I79cwK+xPmHS3z8/rKar5G5EbK6IYq0Ypq9KrShJ3sg=";
+    tag = version;
+    hash = "sha256-qlOnFtEURhyxfsprhRaYUj141vZJp8qMjLpP1wGxikw=";
   };
 
   patches = [ ./fix-python-install-dir.patch ];
diff --git a/pkgs/development/web/nodejs/v23.nix b/pkgs/development/web/nodejs/v23.nix
index 1db90a82031b..5c2b651e7195 100644
--- a/pkgs/development/web/nodejs/v23.nix
+++ b/pkgs/development/web/nodejs/v23.nix
@@ -16,8 +16,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "23.9.0";
-  sha256 = "c6b420bedbb049a6538c33af28abaf89011ccc879f0f0f81791675263c238f97";
+  version = "23.10.0";
+  sha256 = "b39e5fbd3debb8318ddea6af3e89b07dafb891421fb7ca99fbe19c99adabe5fd";
   patches =
     [
       ./configure-emulator.patch
diff --git a/pkgs/kde/misc/kdevelop-pg-qt/default.nix b/pkgs/kde/misc/kdevelop-pg-qt/default.nix
index 534733516757..408578525ef0 100644
--- a/pkgs/kde/misc/kdevelop-pg-qt/default.nix
+++ b/pkgs/kde/misc/kdevelop-pg-qt/default.nix
@@ -7,14 +7,14 @@
 }:
 mkKdeDerivation rec {
   pname = "kdevelop-pg-qt";
-  version = "2.3.0";
+  version = "2.4.0";
 
   # Breaks with split -dev
   outputs = [ "out" ];
 
   src = fetchurl {
     url = "mirror://kde/stable/kdevelop-pg-qt/${version}/src/kdevelop-pg-qt-${version}.tar.xz";
-    hash = "sha256-PT7zyzlelnDmDDmepthlzHluAOUsNV7tlD++yn2nEg0=";
+    hash = "sha256-rL62HIL116ot3PoY477l4lWRBpcL1tFG1GyV+NAnu4Y=";
   };
 
   extraNativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index f0482b1182e9..ea3bf835b8a0 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -12,16 +12,16 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.13.5"; # zen
+      version = "6.13.7"; # zen
       suffix = "zen1"; # zen
-      sha256 = "1m9lmshvc6mbiplfhrkk03vixkr2mdk09v2j5wsw1gfls9avrf2q"; # zen
+      sha256 = "1gziphpd8lqgz21d22n0pbnbms1qb2f5ri7y2jdfigrp45sh8kz3"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx
     lqx = {
-      version = "6.13.5"; # lqx
+      version = "6.13.7"; # lqx
       suffix = "lqx1"; # lqx
-      sha256 = "1qk6h4g91mn0l4c78jwsbhgprajd4yqm8gzzgh89rpm151kggs82"; # lqx
+      sha256 = "0zijfh3ibdqw9vii0pzj9ld4sj0dcx7i30hpq9cw8ij1q7mp82jc"; # lqx
       isLqx = true;
     };
   };
diff --git a/pkgs/tools/admin/meshcentral/default.nix b/pkgs/tools/admin/meshcentral/default.nix
index 38dc12cc3854..c667f7e04bb4 100644
--- a/pkgs/tools/admin/meshcentral/default.nix
+++ b/pkgs/tools/admin/meshcentral/default.nix
@@ -8,11 +8,11 @@
 }:
 
 yarn2nix-moretea.mkYarnPackage {
-  version = "1.1.39";
+  version = "1.1.42";
 
   src = fetchzip {
-    url = "https://registry.npmjs.org/meshcentral/-/meshcentral-1.1.39.tgz";
-    sha256 = "08pd52hp3kj6h0w8x5x7k7bnhq37lx6m9am3bkq80kykrfxzdima";
+    url = "https://registry.npmjs.org/meshcentral/-/meshcentral-1.1.42.tgz";
+    sha256 = "0mz03jljw37815fvdpc679b5jpzdpmzfrljclzhzw086sdrzypc3";
   };
 
   patches = [
@@ -24,7 +24,7 @@ yarn2nix-moretea.mkYarnPackage {
 
   offlineCache = fetchYarnDeps {
     yarnLock = ./yarn.lock;
-    hash = "sha256-dlbg/mmJRL1aaoG2p3z/Cij0Gtdau6UcWAbtpKWYVVQ=";
+    hash = "sha256-Q4rG6lfSZZQO7GnXRvnof/Pfmqkh4cZ34yhNgoFwAZY=";
   };
 
   # Tarball has CRLF line endings. This makes patching difficult, so let's convert them.
diff --git a/pkgs/tools/admin/meshcentral/package.json b/pkgs/tools/admin/meshcentral/package.json
index ec35ce4d7840..1aa0c2c9873d 100644
--- a/pkgs/tools/admin/meshcentral/package.json
+++ b/pkgs/tools/admin/meshcentral/package.json
@@ -1,6 +1,6 @@
 {
   "name": "meshcentral",
-  "version": "1.1.39",
+  "version": "1.1.42",
   "keywords": [
     "Remote Device Management",
     "Remote Device Monitoring",
diff --git a/pkgs/tools/admin/meshcentral/yarn.lock b/pkgs/tools/admin/meshcentral/yarn.lock
index 7be8d61f706f..b7fccd02dfeb 100644
--- a/pkgs/tools/admin/meshcentral/yarn.lock
+++ b/pkgs/tools/admin/meshcentral/yarn.lock
@@ -477,33 +477,33 @@
   integrity sha512-oH5UPLMWR3L2wEFLnFJ1TZXqHufiTKAiLfqw5zkhS4dKXLJ10yVztfil/twG8EDTA4F/tvVNw9nOl4ZMslB8rQ==
 
 "@babel/core@^7.16.5":
-  version "7.26.9"
-  resolved "https://registry.yarnpkg.com/@babel/core/-/core-7.26.9.tgz#71838542a4b1e49dfed353d7acbc6eb89f4a76f2"
-  integrity sha512-lWBYIrF7qK5+GjY5Uy+/hEgp8OJWOD/rpy74GplYRhEauvbHDeFB8t5hPOZxCZ0Oxf4Cc36tK51/l3ymJysrKw==
+  version "7.26.10"
+  resolved "https://registry.yarnpkg.com/@babel/core/-/core-7.26.10.tgz#5c876f83c8c4dcb233ee4b670c0606f2ac3000f9"
+  integrity sha512-vMqyb7XCDMPvJFFOaT9kxtiRh42GwlZEg1/uIgtZshS5a/8OaduUfCi7kynKgc3Tw/6Uo2D+db9qBttghhmxwQ==
   dependencies:
     "@ampproject/remapping" "^2.2.0"
     "@babel/code-frame" "^7.26.2"
-    "@babel/generator" "^7.26.9"
+    "@babel/generator" "^7.26.10"
     "@babel/helper-compilation-targets" "^7.26.5"
     "@babel/helper-module-transforms" "^7.26.0"
-    "@babel/helpers" "^7.26.9"
-    "@babel/parser" "^7.26.9"
+    "@babel/helpers" "^7.26.10"
+    "@babel/parser" "^7.26.10"
     "@babel/template" "^7.26.9"
-    "@babel/traverse" "^7.26.9"
-    "@babel/types" "^7.26.9"
+    "@babel/traverse" "^7.26.10"
+    "@babel/types" "^7.26.10"
     convert-source-map "^2.0.0"
     debug "^4.1.0"
     gensync "^1.0.0-beta.2"
     json5 "^2.2.3"
     semver "^6.3.1"
 
-"@babel/generator@^7.26.9", "@babel/generator@^7.4.0":
-  version "7.26.9"
-  resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.26.9.tgz#75a9482ad3d0cc7188a537aa4910bc59db67cbca"
-  integrity sha512-kEWdzjOAUMW4hAyrzJ0ZaTOu9OmpyDIQicIh0zg0EEcEkYXZb2TjtBhnHi2ViX7PKwZqF4xwqfAm299/QMP3lg==
+"@babel/generator@^7.26.10", "@babel/generator@^7.4.0":
+  version "7.26.10"
+  resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.26.10.tgz#a60d9de49caca16744e6340c3658dfef6138c3f7"
+  integrity sha512-rRHT8siFIXQrAYOYqZQVsAr8vJ+cBNqcVAY6m5V8/4QqzaPl+zDBe6cLEPRDuNOUf3ww8RfJVlOyQMoSI+5Ang==
   dependencies:
-    "@babel/parser" "^7.26.9"
-    "@babel/types" "^7.26.9"
+    "@babel/parser" "^7.26.10"
+    "@babel/types" "^7.26.10"
     "@jridgewell/gen-mapping" "^0.3.5"
     "@jridgewell/trace-mapping" "^0.3.25"
     jsesc "^3.0.2"
@@ -563,13 +563,13 @@
   resolved "https://registry.yarnpkg.com/@babel/helper-validator-option/-/helper-validator-option-7.25.9.tgz#86e45bd8a49ab7e03f276577f96179653d41da72"
   integrity sha512-e/zv1co8pp55dNdEcCynfj9X7nyUKUXoUEwfXqaZt0omVOmDe9oOTdKStH4GmAw6zxMFs50ZayuMfHDKlO7Tfw==
 
-"@babel/helpers@^7.26.9":
-  version "7.26.9"
-  resolved "https://registry.yarnpkg.com/@babel/helpers/-/helpers-7.26.9.tgz#28f3fb45252fc88ef2dc547c8a911c255fc9fef6"
-  integrity sha512-Mz/4+y8udxBKdmzt/UjPACs4G3j5SshJJEFFKxlCGPydG4JAHXxjWjAwjd09tf6oINvl1VfMJo+nB7H2YKQ0dA==
+"@babel/helpers@^7.26.10":
+  version "7.26.10"
+  resolved "https://registry.yarnpkg.com/@babel/helpers/-/helpers-7.26.10.tgz#6baea3cd62ec2d0c1068778d63cb1314f6637384"
+  integrity sha512-UPYc3SauzZ3JGgj87GgZ89JVdC5dj0AoetR5Bw6wj4niittNyFh6+eOGonYvJ1ao6B8lEa3Q3klS7ADZ53bc5g==
   dependencies:
     "@babel/template" "^7.26.9"
-    "@babel/types" "^7.26.9"
+    "@babel/types" "^7.26.10"
 
 "@babel/node@^7.16.5":
   version "7.26.0"
@@ -583,12 +583,12 @@
     regenerator-runtime "^0.14.0"
     v8flags "^3.1.1"
 
-"@babel/parser@^7.26.9", "@babel/parser@^7.4.3":
-  version "7.26.9"
-  resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.26.9.tgz#d9e78bee6dc80f9efd8f2349dcfbbcdace280fd5"
-  integrity sha512-81NWa1njQblgZbQHxWHpxxCzNsa3ZwvFqpUg7P+NNUU6f3UU2jBEg4OlF/J6rl8+PQGh1q6/zWScd001YwcA5A==
+"@babel/parser@^7.26.10", "@babel/parser@^7.26.9", "@babel/parser@^7.4.3":
+  version "7.26.10"
+  resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.26.10.tgz#e9bdb82f14b97df6569b0b038edd436839c57749"
+  integrity sha512-6aQR2zGE/QFi8JpDLjUZEPYOs7+mhKXm86VaKFiLP35JQwQb6bwUE+XbvkH0EptsYhbNBSUGaUBLKqxH1xSgsA==
   dependencies:
-    "@babel/types" "^7.26.9"
+    "@babel/types" "^7.26.10"
 
 "@babel/plugin-syntax-jsx@^7.25.9":
   version "7.25.9"
@@ -628,23 +628,23 @@
     "@babel/parser" "^7.26.9"
     "@babel/types" "^7.26.9"
 
-"@babel/traverse@^7.25.9", "@babel/traverse@^7.26.9", "@babel/traverse@^7.4.3":
-  version "7.26.9"
-  resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.26.9.tgz#4398f2394ba66d05d988b2ad13c219a2c857461a"
-  integrity sha512-ZYW7L+pL8ahU5fXmNbPF+iZFHCv5scFak7MZ9bwaRPLUhHh7QQEMjZUg0HevihoqCM5iSYHN61EyCoZvqC+bxg==
+"@babel/traverse@^7.25.9", "@babel/traverse@^7.26.10", "@babel/traverse@^7.4.3":
+  version "7.26.10"
+  resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.26.10.tgz#43cca33d76005dbaa93024fae536cc1946a4c380"
+  integrity sha512-k8NuDrxr0WrPH5Aupqb2LCVURP/S0vBEn5mK6iH+GIYob66U5EtoZvcdudR2jQ4cmTwhEwW1DLB+Yyas9zjF6A==
   dependencies:
     "@babel/code-frame" "^7.26.2"
-    "@babel/generator" "^7.26.9"
-    "@babel/parser" "^7.26.9"
+    "@babel/generator" "^7.26.10"
+    "@babel/parser" "^7.26.10"
     "@babel/template" "^7.26.9"
-    "@babel/types" "^7.26.9"
+    "@babel/types" "^7.26.10"
     debug "^4.3.1"
     globals "^11.1.0"
 
-"@babel/types@^7.25.9", "@babel/types@^7.26.9", "@babel/types@^7.4.0":
-  version "7.26.9"
-  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.26.9.tgz#08b43dec79ee8e682c2ac631c010bdcac54a21ce"
-  integrity sha512-Y3IR1cRnOxOCDvMmNiym7XpXQ93iGDDPHx+Zj+NM+rg0fBaShfQLkg+hKPaZCEvg5N/LeCo4+Rj/i3FuJsIQaw==
+"@babel/types@^7.25.9", "@babel/types@^7.26.10", "@babel/types@^7.26.9", "@babel/types@^7.4.0":
+  version "7.26.10"
+  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.26.10.tgz#396382f6335bd4feb65741eacfc808218f859259"
+  integrity sha512-emqcG3vHrpxUKTrxcblR36dcrcoRDvKmnL/dCL6ZsHaShW80qxCAcNhzQZrpeM765VzEos+xOi4s+r4IXzTwdQ==
   dependencies:
     "@babel/helper-string-parser" "^7.25.9"
     "@babel/helper-validator-identifier" "^7.25.9"
@@ -851,9 +851,9 @@
   integrity sha512-MmaX6HeSvyPbWGwFq7mXdo0uQZLGBYCwziiLIGq5JVX+/bdI3SAq6bP98trV5eTWfLuvsMcIC1YJOF2vfteLFA==
 
 "@google-cloud/promisify@^4.0.0":
-  version "4.0.0"
-  resolved "https://registry.yarnpkg.com/@google-cloud/promisify/-/promisify-4.0.0.tgz#a906e533ebdd0f754dca2509933334ce58b8c8b1"
-  integrity sha512-Orxzlfb9c67A15cq2JQEyVc7wEsmFBmHjZWZYQMUyJ1qivXyMwdyNOs9odi79hze+2zqdTtu1E19IM/FtqZ10g==
+  version "4.1.0"
+  resolved "https://registry.yarnpkg.com/@google-cloud/promisify/-/promisify-4.1.0.tgz#df8b060f0121c6462233f5420738dcda09c6df4a"
+  integrity sha512-G/FQx5cE/+DqBbOpA5jKsegGwdPniU6PuIEMt+qxWgFxvxuFOzVmp6zYchtYuwAWV5/8Dgs0yAmjvNZv3uXLQg==
 
 "@google-cloud/storage@^7.7.0":
   version "7.15.2"
@@ -877,9 +877,9 @@
     uuid "^8.0.0"
 
 "@grpc/grpc-js@^1.10.9":
-  version "1.12.6"
-  resolved "https://registry.yarnpkg.com/@grpc/grpc-js/-/grpc-js-1.12.6.tgz#a3586ffdfb6a1f5cd5b4866dec9074c4a1e65472"
-  integrity sha512-JXUj6PI0oqqzTGvKtzOkxtpsyPRNsrmhh41TtIz/zEB6J+AUiZZ0dxWzcMwO9Ns5rmSPuMdghlTbUuqIM48d3Q==
+  version "1.13.0"
+  resolved "https://registry.yarnpkg.com/@grpc/grpc-js/-/grpc-js-1.13.0.tgz#69c229eacb77f3468afa9d375c23dc9b694d1af9"
+  integrity sha512-pMuxInZjUnUkgMT2QLZclRqwk2ykJbIU05aZgPgJYXEpN9+2I7z7aNwcjWZSycRPl232FfhPszyBFJyOxTHNog==
   dependencies:
     "@grpc/proto-loader" "^0.7.13"
     "@js-sdsl/ordered-map" "^4.4.2"
@@ -1635,9 +1635,9 @@
   integrity sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==
 
 "@types/node@*", "@types/node@>=13.7.0", "@types/node@^22.0.1", "@types/node@^22.5.4":
-  version "22.13.5"
-  resolved "https://registry.yarnpkg.com/@types/node/-/node-22.13.5.tgz#23add1d71acddab2c6a4d31db89c0f98d330b511"
-  integrity sha512-+lTU0PxZXn0Dr1NBtC7Y8cR21AJr87dLLU953CWA6pMxxv/UDc7jYAY90upcrie1nRcD6XNG5HOYEDtgW5TxAg==
+  version "22.13.10"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-22.13.10.tgz#df9ea358c5ed991266becc3109dc2dc9125d77e4"
+  integrity sha512-I6LPUvlRH+O6VRUqYOcMudhaIdUVWfsjnZavnsraHvpBwaEyMN29ry+0UVJhImYL16xsscu0aske3yA+uPOWfw==
   dependencies:
     undici-types "~6.20.0"
 
@@ -1707,9 +1707,9 @@
     "@types/webidl-conversions" "*"
 
 "@types/ws@^8.5.3":
-  version "8.5.14"
-  resolved "https://registry.yarnpkg.com/@types/ws/-/ws-8.5.14.tgz#93d44b268c9127d96026cf44353725dd9b6c3c21"
-  integrity sha512-bd/YFLW+URhBzMXurx7lWByOu+xzU9+kb3RboOteXYDfW+tr+JZa99OyNmPINEGB/ahzKrEuc8rcv4gnpJmxTw==
+  version "8.18.0"
+  resolved "https://registry.yarnpkg.com/@types/ws/-/ws-8.18.0.tgz#8a2ec491d6f0685ceaab9a9b7ff44146236993b5"
+  integrity sha512-8svvI3hMyvN0kKCJMvTJP/x6Y/EoQbepff882wL+Sn5QsXb3etnamgrJq4isrBxSJj5L2AuXcI0+bgkoAXGUJw==
   dependencies:
     "@types/node" "*"
 
@@ -2362,9 +2362,9 @@ axios@^0.27.2:
     form-data "^4.0.0"
 
 axios@^1.2.2, axios@^1.7.4:
-  version "1.8.1"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-1.8.1.tgz#7c118d2146e9ebac512b7d1128771cdd738d11e3"
-  integrity sha512-NN+fvwH/kV01dYUQ3PTOZns4LWtWhOFCAhQ/pHb88WQ1hNe5V/dvFwc4VJcDL11LT9xSX0QtsR8sWUuyOuOq7g==
+  version "1.8.3"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-1.8.3.tgz#9ebccd71c98651d547162a018a1a95a4b4ed4de8"
+  integrity sha512-iP4DebzoNlP/YN2dpwCgb8zoCmhtkajzS48JvwmkSkXvPI3DHc7m+XYL5tGnSlJtR6nImXZmdCuN5aP8dh1d8A==
   dependencies:
     follow-redirects "^1.15.6"
     form-data "^4.0.0"
@@ -2722,13 +2722,13 @@ call-bind@^1.0.7, call-bind@^1.0.8:
     get-intrinsic "^1.2.4"
     set-function-length "^1.2.2"
 
-call-bound@^1.0.2, call-bound@^1.0.3:
-  version "1.0.3"
-  resolved "https://registry.yarnpkg.com/call-bound/-/call-bound-1.0.3.tgz#41cfd032b593e39176a71533ab4f384aa04fd681"
-  integrity sha512-YTd+6wGlNlPxSuri7Y6X8tY2dmm12UMH66RpKMhiX6rsk5wXXnYgbUcOt8kiS31/AjfoTOvCsE+w8nZQLQnzHA==
+call-bound@^1.0.2, call-bound@^1.0.3, call-bound@^1.0.4:
+  version "1.0.4"
+  resolved "https://registry.yarnpkg.com/call-bound/-/call-bound-1.0.4.tgz#238de935d2a2a692928c538c7ccfa91067fd062a"
+  integrity sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==
   dependencies:
-    call-bind-apply-helpers "^1.0.1"
-    get-intrinsic "^1.2.6"
+    call-bind-apply-helpers "^1.0.2"
+    get-intrinsic "^1.3.0"
 
 camel-case@^3.0.0:
   version "3.0.0"
@@ -2744,9 +2744,9 @@ camelcase@^5.0.0:
   integrity sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==
 
 caniuse-lite@^1.0.30001688:
-  version "1.0.30001701"
-  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001701.tgz#ad9c90301f7153cf6b3314d16cc30757285bf9e7"
-  integrity sha512-faRs/AW3jA9nTwmJBSO1PQ6L/EOgsB5HMQQq4iCu5zhPgVVgO/pZRHlmatwijZKetFw8/Pr4q6dEN8sJuq8qTw==
+  version "1.0.30001703"
+  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001703.tgz#977cb4920598c158f491ecf4f4f2cfed9e354718"
+  integrity sha512-kRlAGTRWgPsOj7oARC9m1okJEXdL/8fekFVcxA8Hl7GH4r/sN4OJn/i6Flde373T50KS7Y37oFbMwlE8+F42kQ==
 
 caseless@~0.12.0:
   version "0.12.0"
@@ -3055,9 +3055,9 @@ core-js@^2.4.0:
   integrity sha512-Kb2wC0fvsWfQrgk8HU5lW6U/Lcs8+9aaYcy4ZFc6DDlo4nZ7n70dEgE5rtR0oG6ufKDUnrwfWL1mXR5ljDatrQ==
 
 core-js@^3.30.2:
-  version "3.40.0"
-  resolved "https://registry.yarnpkg.com/core-js/-/core-js-3.40.0.tgz#2773f6b06877d8eda102fc42f828176437062476"
-  integrity sha512-7vsMc/Lty6AGnn7uFpYT56QesI5D2Y/UkgKounk87OP9Z2H9Z8kj6jzcSGAxFmUtDOS0ntK6lbQz+Nsa0Jj6mQ==
+  version "3.41.0"
+  resolved "https://registry.yarnpkg.com/core-js/-/core-js-3.41.0.tgz#57714dafb8c751a6095d028a7428f1fb5834a776"
+  integrity sha512-SJ4/EHwS36QMJd6h/Rg+GyR4A5xE0FSI3eZ+iBVpfqf1x0eTSg1smWLHrA+2jQThZSh97fmSgFSU8B61nxosxA==
 
 core-util-is@1.0.2:
   version "1.0.2"
@@ -3459,9 +3459,9 @@ ee-first@1.1.1:
   integrity sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==
 
 electron-to-chromium@^1.5.73:
-  version "1.5.109"
-  resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.109.tgz#905a573d2b4cbb31412a2de6267fb22cf45e097e"
-  integrity sha512-AidaH9JETVRr9DIPGfp1kAarm/W6hRJTPuCnkF+2MqhF4KaAgRIcBc8nvjk+YMXZhwfISof/7WG29eS4iGxQLQ==
+  version "1.5.114"
+  resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.114.tgz#f2bb4fda80a7db4ea273565e75b0ebbe19af0ac3"
+  integrity sha512-DFptFef3iktoKlFQK/afbo274/XNWD00Am0xa7M8FZUepHlHT8PEuiNBoRfFHbH1okqN58AlhbJ4QTkcnXorjA==
 
 emoji-regex@^7.0.1:
   version "7.0.3"
@@ -3982,7 +3982,7 @@ follow-redirects@^1.14.0, follow-redirects@^1.14.8, follow-redirects@^1.14.9, fo
   resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.9.tgz#a604fa10e443bf98ca94228d9eebcc2e8a2c8ee1"
   integrity sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==
 
-for-each@^0.3.3:
+for-each@^0.3.3, for-each@^0.3.5:
   version "0.3.5"
   resolved "https://registry.yarnpkg.com/for-each/-/for-each-0.3.5.tgz#d650688027826920feeb0af747ee7b9421a41d47"
   integrity sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==
@@ -4184,7 +4184,7 @@ get-caller-file@^2.0.1, get-caller-file@^2.0.5:
   resolved "https://registry.yarnpkg.com/get-caller-file/-/get-caller-file-2.0.5.tgz#4f94412a82db32f36e3b0b9741f8a97feb031f7e"
   integrity sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==
 
-get-intrinsic@^1.2.4, get-intrinsic@^1.2.5, get-intrinsic@^1.2.6, get-intrinsic@^1.2.7:
+get-intrinsic@^1.2.4, get-intrinsic@^1.2.5, get-intrinsic@^1.2.6, get-intrinsic@^1.2.7, get-intrinsic@^1.3.0:
   version "1.3.0"
   resolved "https://registry.yarnpkg.com/get-intrinsic/-/get-intrinsic-1.3.0.tgz#743f0e3b6964a93a5491ed1bffaae054d7f98d01"
   integrity sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==
@@ -5568,9 +5568,9 @@ lru-memoizer@^2.2.0:
     lru-cache "6.0.0"
 
 lru.min@^1.0.0:
-  version "1.1.1"
-  resolved "https://registry.yarnpkg.com/lru.min/-/lru.min-1.1.1.tgz#146e01e3a183fa7ba51049175de04667d5701f0e"
-  integrity sha512-FbAj6lXil6t8z4z3j0E5mfRlPzxkySotzUHwRXjlpRh10vc6AI6WN62ehZj82VG7M20rqogJ0GLwar2Xa05a8Q==
+  version "1.1.2"
+  resolved "https://registry.yarnpkg.com/lru.min/-/lru.min-1.1.2.tgz#01ce1d72cc50c7faf8bd1f809ebf05d4331021eb"
+  integrity sha512-Nv9KddBcQSlQopmBHXSsZVY5xsdlZkdH/Iey0BlcBYggMd4two7cZnKOK9vmy3nY0O5RGH99z1PCeTpPqszUYg==
 
 ltx@^3.1.1:
   version "3.1.2"
@@ -5970,9 +5970,9 @@ nan@^2.13.2, nan@^2.19.0, nan@^2.20.0:
   integrity sha512-DANghxFkS1plDdRsX0X9pm0Z6SJNN6gBdtXfanwoZ8hooC5gosGFSBGRYHUVPz1asKA/kMRqDRdHrluZ61SpBQ==
 
 nanoid@^3.3.8:
-  version "3.3.8"
-  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.8.tgz#b1be3030bee36aaff18bacb375e5cce521684baf"
-  integrity sha512-WNLf5Sd8oZxOm+TzppcYk8gVOgP+l58xNy58D0nbUnOxOWRWvlcCV4kUF7ltmI6PsrLl/BgKEyS4mqsGChFN0w==
+  version "3.3.9"
+  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.9.tgz#e0097d8e026b3343ff053e9ccd407360a03f503a"
+  integrity sha512-SppoicMGpZvbF1l3z4x7No3OlIjP7QJvC9XR7AhZr1kL133KHnKPztkKDc+Ir4aJ/1VhTySrtKhrsycmrMQfvg==
 
 napi-build-utils@^2.0.0:
   version "2.0.0"
@@ -6186,9 +6186,9 @@ number-is-nan@^1.0.0:
   integrity sha512-4jbtZXNAsfZbAHiiqjLPBiCl16dES1zI4Hpzzxw61Tk+loF+sBDBKx1ICKKKwIqQ7M0mFn1TmkN7euSncWgHiQ==
 
 nwsapi@^2.2.4:
-  version "2.2.16"
-  resolved "https://registry.yarnpkg.com/nwsapi/-/nwsapi-2.2.16.tgz#177760bba02c351df1d2644e220c31dfec8cdb43"
-  integrity sha512-F1I/bimDpj3ncaNDhfyMWuFqmQDBwDB0Fogc2qpL3BWvkQteFD/8BzWuIRl83rq0DXfm8SGt/HFhLXZyljTXcQ==
+  version "2.2.18"
+  resolved "https://registry.yarnpkg.com/nwsapi/-/nwsapi-2.2.18.tgz#3c4d7927e1ef4d042d319438ecfda6cd81b7ee41"
+  integrity sha512-p1TRH/edngVEHVbwqWnxUViEmq5znDvyB+Sik5cmuLpGOIfDf/39zLiq3swPF8Vakqn+gvNiOQAZu8djYlQILA==
 
 nyc@^14.1.1:
   version "14.1.1"
@@ -6232,9 +6232,9 @@ oauth-sign@~0.9.0:
   integrity sha512-fexhUFFPTGV8ybAtSIGbV6gOkSv8UtRbDBnAyLQw4QPKkgNlsH2ByPGtMUqdWkos6YCRmAqViwgZrJc/mRDzZQ==
 
 oauth@0.10.x:
-  version "0.10.0"
-  resolved "https://registry.yarnpkg.com/oauth/-/oauth-0.10.0.tgz#3551c4c9b95c53ea437e1e21e46b649482339c58"
-  integrity sha512-1orQ9MT1vHFGQxhuy7E/0gECD3fd2fCC+PIX+/jgmU/gI3EpRocXtmtvxCO5x3WZ443FLTLFWNDjl5MPJf9u+Q==
+  version "0.10.2"
+  resolved "https://registry.yarnpkg.com/oauth/-/oauth-0.10.2.tgz#fd7139b0ce1a1037bd11fa4e236afc588132418c"
+  integrity sha512-JtFnB+8nxDEXgNyniwz573xxbKSOu3R8D40xQKqcjwJ2CDkYqUDI53o6IuzDJBx60Z8VKCm271+t8iFjakrl8Q==
 
 oauth@0.9.x:
   version "0.9.15"
@@ -6645,14 +6645,14 @@ pg-int8@1.0.1:
   integrity sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==
 
 pg-pool@^3.7.0:
-  version "3.7.1"
-  resolved "https://registry.yarnpkg.com/pg-pool/-/pg-pool-3.7.1.tgz#d1aaf618618d8f878acf185e86084928b8cd5b3c"
-  integrity sha512-xIOsFoh7Vdhojas6q3596mXFsR8nwBQBXX5JiV7p9buEVAGqYL4yFzclON5P9vFrpu1u7Zwl2oriyDa89n0wbw==
+  version "3.8.0"
+  resolved "https://registry.yarnpkg.com/pg-pool/-/pg-pool-3.8.0.tgz#e6bce7fc4506a8d6106551363fc5283e5445b776"
+  integrity sha512-VBw3jiVm6ZOdLBTIcXLNdSotb6Iy3uOCwDGFAksZCXmi10nyRvnP2v3jl4d+IsLYRyXf6o9hIm/ZtUzlByNUdw==
 
 pg-protocol@^1.7.0:
-  version "1.7.1"
-  resolved "https://registry.yarnpkg.com/pg-protocol/-/pg-protocol-1.7.1.tgz#aad61a6f927b51e89dcf721408b76c0e536d43dc"
-  integrity sha512-gjTHWGYWsEgy9MsY0Gp6ZJxV24IjDqdpTW7Eh0x+WfJLFsm/TJx1MzL6T0D88mBvkpxotCQ6TwW6N+Kko7lhgQ==
+  version "1.8.0"
+  resolved "https://registry.yarnpkg.com/pg-protocol/-/pg-protocol-1.8.0.tgz#c707101dd07813868035a44571488e4b98639d48"
+  integrity sha512-jvuYlEkL03NRvOoyoRktBK7+qU5kOvlAwvmrH8sr3wbLrOdVWsRxQfz8mMy9sZFsqJ1hEWNfdWKI4SAmoL+j7g==
 
 pg-types@^2.1.0:
   version "2.2.0"
@@ -8759,14 +8759,15 @@ which-module@^2.0.0:
   integrity sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ==
 
 which-typed-array@^1.1.16, which-typed-array@^1.1.18, which-typed-array@^1.1.2:
-  version "1.1.18"
-  resolved "https://registry.yarnpkg.com/which-typed-array/-/which-typed-array-1.1.18.tgz#df2389ebf3fbb246a71390e90730a9edb6ce17ad"
-  integrity sha512-qEcY+KJYlWyLH9vNbsr6/5j59AXk5ni5aakf8ldzBvGde6Iz4sxZGkJyWSAueTG7QhOvNRYb1lDdFmL5Td0QKA==
+  version "1.1.19"
+  resolved "https://registry.yarnpkg.com/which-typed-array/-/which-typed-array-1.1.19.tgz#df03842e870b6b88e117524a4b364b6fc689f956"
+  integrity sha512-rEvr90Bck4WZt9HHFC4DJMsjvu7x+r6bImz0/BrbWb7A2djJ8hnZMrWnHo9F8ssv0OMErasDhftrfROTyqSDrw==
   dependencies:
     available-typed-arrays "^1.0.7"
     call-bind "^1.0.8"
-    call-bound "^1.0.3"
-    for-each "^0.3.3"
+    call-bound "^1.0.4"
+    for-each "^0.3.5"
+    get-proto "^1.0.1"
     gopd "^1.2.0"
     has-tostringtag "^1.0.2"
 
diff --git a/pkgs/tools/system/htop/htop-vim.nix b/pkgs/tools/system/htop/htop-vim.nix
deleted file mode 100644
index 28fafbe38829..000000000000
--- a/pkgs/tools/system/htop/htop-vim.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  lib,
-  htop,
-  fetchFromGitHub,
-}:
-
-htop.overrideAttrs (oldAttrs: rec {
-  pname = "htop-vim";
-  version = "unstable-2023-02-16";
-
-  src = fetchFromGitHub {
-    owner = "KoffeinFlummi";
-    repo = pname;
-    rev = "b2b58f8f152343b70c33b79ba51a298024278621";
-    hash = "sha256-ZfdBAlnjoy8g6xwrR/i2+dGldMOfLlX6DRlNqB8pkGM=";
-  };
-
-  meta = with lib; {
-    inherit (oldAttrs.meta) platforms license;
-    description = "Interactive process viewer for Linux, with vim-style keybindings";
-    homepage = "https://github.com/KoffeinFlummi/htop-vim";
-    maintainers = with maintainers; [ thiagokokada ];
-    mainProgram = "htop";
-  };
-})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3ceacdfd653a..d9615cd957c9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2443,8 +2443,6 @@ with pkgs;
 
   materialx = with python3Packages; toPythonApplication materialx;
 
-  megasync = libsForQt5.callPackage ../applications/misc/megasync { };
-
   # while building documentation meson may want to run binaries for host
   # which needs an emulator
   # example of an error which this fixes
@@ -5031,6 +5029,7 @@ with pkgs;
   stutter = haskell.lib.compose.justStaticExecutables haskellPackages.stutter;
 
   strongswanTNC = strongswan.override { enableTNC = true; };
+  strongswanTPM = strongswan.override { enableTPM2 = true; };
   strongswanNM  = strongswan.override { enableNetworkManager = true; };
 
   stylish-haskell = haskell.lib.compose.justStaticExecutables haskellPackages.stylish-haskell;
@@ -11935,8 +11934,6 @@ with pkgs;
     inherit (darwin) IOKit;
   };
 
-  htop-vim = callPackage ../tools/system/htop/htop-vim.nix { };
-
   humility = callPackage ../development/tools/rust/humility {
     inherit (darwin.apple_sdk.frameworks) AppKit;
   };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 058ccac88444..14c65c6df674 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6660,6 +6660,7 @@ self: super: with self; {
     inherit python numpy;
     enablePython = true;
     enableRtk = false;
+    stdenv = if stdenv.cc.isGNU then pkgs.stdenvAdapters.useLibsFrom stdenv pkgs.gcc12Stdenv else stdenv;
   });