diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 92c856ea5d68..89442bbd33de 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11835,6 +11835,13 @@
     githubId = 2072185;
     name = "Marc Scholten";
   };
+  mrcjkb = {
+    email = "marc@jakobi.dev";
+    matrix = "@mrcjk:matrix.org";
+    name = "Marc Jakobi";
+    github = "mrcjkb";
+    githubId = 12857160;
+  };
   mredaelli = {
     email = "massimo@typish.io";
     github = "mredaelli";
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 780388117282..164fa0d5ee43 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -87,6 +87,8 @@
 
 - [NNCP](http://www.nncpgo.org/). Added nncp-daemon and nncp-caller services. Configuration is set with [programs.nncp.settings](#opt-programs.nncp.settings) and the daemons are enabled at [services.nncp](#opt-services.nncp.caller.enable).
 
+- [tuxedo-rs](https://github.com/AaronErhardt/tuxedo-rs), Rust utilities for interacting with hardware from TUXEDO Computers.
+
 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}
 
 - The `boot.loader.raspberryPi` options have been marked deprecated, with intent for removal for NixOS 24.11. They had a limited use-case, and do not work like people expect. They required either very old installs ([before mid-2019](https://github.com/NixOS/nixpkgs/pull/62462)) or customized builds out of scope of the standard and generic AArch64 support. That option set never supported the Raspberry Pi 4 family of devices.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 54fd5c7b0403..cbd5e6467f82 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -541,6 +541,7 @@
   ./services/hardware/tlp.nix
   ./services/hardware/trezord.nix
   ./services/hardware/triggerhappy.nix
+  ./services/hardware/tuxedo-rs.nix
   ./services/hardware/udev.nix
   ./services/hardware/udisks2.nix
   ./services/hardware/undervolt.nix
diff --git a/nixos/modules/services/hardware/tlp.nix b/nixos/modules/services/hardware/tlp.nix
index d2cc7c661c69..cad510e571cb 100644
--- a/nixos/modules/services/hardware/tlp.nix
+++ b/nixos/modules/services/hardware/tlp.nix
@@ -65,7 +65,7 @@ in
       "tlp.conf".text = (mkTlpConfig cfg.settings) + cfg.extraConfig;
     } // optionalAttrs enableRDW {
       "NetworkManager/dispatcher.d/99tlp-rdw-nm".source =
-        "${tlp}/etc/NetworkManager/dispatcher.d/99tlp-rdw-nm";
+        "${tlp}/usr/lib/NetworkManager/dispatcher.d/99tlp-rdw-nm";
     };
 
     environment.systemPackages = [ tlp ];
diff --git a/nixos/modules/services/hardware/tuxedo-rs.nix b/nixos/modules/services/hardware/tuxedo-rs.nix
new file mode 100644
index 000000000000..343f6845fabb
--- /dev/null
+++ b/nixos/modules/services/hardware/tuxedo-rs.nix
@@ -0,0 +1,49 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.hardware.tuxedo-rs;
+
+in
+{
+  options = {
+    hardware.tuxedo-rs = {
+      enable = mkEnableOption (lib.mdDoc "Rust utilities for interacting with hardware from TUXEDO Computers.");
+
+      tailor-gui.enable = mkEnableOption (lib.mdDoc "Alternative to TUXEDO Control Center, written in Rust.");
+    };
+  };
+
+  config = mkIf cfg.enable (mkMerge [
+    {
+      hardware.tuxedo-keyboard.enable = true;
+
+      systemd = {
+        services.tailord = {
+          enable = true;
+          description = "Tuxedo Tailor hardware control service";
+          after = [ "systemd-logind.service" ];
+          wantedBy = [ "multi-user.target" ];
+
+          serviceConfig = {
+            Type = "dbus";
+            BusName = "com.tux.Tailor";
+            ExecStart = "${pkgs.tuxedo-rs}/bin/tailord";
+            Environment = "RUST_BACKTRACE=1";
+            Restart = "on-failure";
+          };
+        };
+      };
+
+      services.dbus.packages = [ pkgs.tuxedo-rs ];
+
+      environment.systemPackages = [ pkgs.tuxedo-rs ];
+    }
+    (mkIf cfg.tailor-gui.enable {
+      environment.systemPackages = [ pkgs.tailor-gui ];
+    })
+  ]);
+
+  meta.maintainers = with maintainers; [ mrcjkb ];
+}
diff --git a/pkgs/applications/misc/appcleaner/default.nix b/pkgs/applications/misc/appcleaner/default.nix
new file mode 100644
index 000000000000..eff32c76f988
--- /dev/null
+++ b/pkgs/applications/misc/appcleaner/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, unzip
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "appcleaner";
+  version = "3.6.8";
+
+  src = fetchurl {
+    url = "https://freemacsoft.net/downloads/AppCleaner_${finalAttrs.version}.zip";
+    hash = "sha256-4BL3KUQkc8IOfM4zSwAYJSHktmcupoGzSTGxgP6z1r4=";
+  };
+  dontUnpack = true;
+
+  nativeBuildInputs = [ unzip ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    unzip -d $out/Applications $src
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Uninstall unwanted apps";
+    homepage = "https://freemacsoft.net/appcleaner";
+    license = licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ emilytrau Enzime ];
+    platforms = platforms.darwin;
+  };
+})
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index b0dddb974115..24797b0602c8 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -15,6 +15,8 @@
 , potrace
 , openxr-loader
 , embree, gmp, libharu
+, mesa
+, runCommand
 }:
 
 let
@@ -26,7 +28,7 @@ let
   };
 
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: rec {
   pname = "blender";
   version = "3.6.3";
 
@@ -184,7 +186,45 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  passthru = { inherit python; };
+  passthru = {
+    inherit python;
+
+    tests = {
+      render = runCommand "${pname}-test" { } ''
+        set -euo pipefail
+
+        export LIBGL_DRIVERS_PATH=${mesa.drivers}/lib/dri
+        export __EGL_VENDOR_LIBRARY_FILENAMES=${mesa.drivers}/share/glvnd/egl_vendor.d/50_mesa.json
+
+        cat <<'PYTHON' > scene-config.py
+        import bpy
+        bpy.context.scene.eevee.taa_render_samples = 32
+        bpy.context.scene.cycles.samples = 32
+        if ${if stdenv.isAarch64 then "True" else "False"}:
+            bpy.context.scene.cycles.use_denoising = False
+        bpy.context.scene.render.resolution_x = 100
+        bpy.context.scene.render.resolution_y = 100
+        bpy.context.scene.render.threads_mode = 'FIXED'
+        bpy.context.scene.render.threads = 1
+        PYTHON
+
+        mkdir $out
+        for engine in BLENDER_EEVEE CYCLES; do
+          echo "Rendering with $engine..."
+          # Beware that argument order matters
+          ${finalAttrs.finalPackage}/bin/blender \
+            --background \
+            -noaudio \
+            --factory-startup \
+            --python-exit-code 1 \
+            --python scene-config.py \
+            --engine "$engine" \
+            --render-output "$out/$engine" \
+            --render-frame 1
+        done
+      '';
+    };
+  };
 
   meta = with lib; {
     description = "3D Creation/Animation/Publishing System";
@@ -198,4 +238,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ goibhniu veprbl ];
     mainProgram = "blender";
   };
-}
+})
diff --git a/pkgs/applications/science/logic/lean4/default.nix b/pkgs/applications/science/logic/lean4/default.nix
index 7509ca63c804..12465ad9087f 100644
--- a/pkgs/applications/science/logic/lean4/default.nix
+++ b/pkgs/applications/science/logic/lean4/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lean4";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "leanprover";
     repo = "lean4";
     rev = "v${version}";
-    hash = "sha256-3Ni+NiD0iSsOruUyRpBd+aC0TZNYfOLhwqCpPHPruPg=";
+    hash = "sha256-6qbCafG0bL5KxQt2gL6hV4PFDsEMM0UXfldeOOqxsaE=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/video/bilibili/default.nix b/pkgs/applications/video/bilibili/default.nix
index 9e3875453305..71d8ef75e213 100644
--- a/pkgs/applications/video/bilibili/default.nix
+++ b/pkgs/applications/video/bilibili/default.nix
@@ -7,10 +7,10 @@
 
 stdenv.mkDerivation rec {
   pname = "bilibili";
-  version = "1.12.0-1";
+  version = "1.12.0-2";
   src = fetchurl {
     url = "https://github.com/msojocs/bilibili-linux/releases/download/v${version}/io.github.msojocs.bilibili_${version}_amd64.deb";
-    hash = "sha256-WSnHyO71VIZDXYTcTCXcXZUkw5ScbIscs9daQokj3kA=";
+    hash = "sha256-LnTRznIUXU7h0SyOCfVjfqhNv2OCRujNoM1PtGUVJeU=";
   };
 
   unpackPhase = ''
diff --git a/pkgs/development/libraries/libpinyin/default.nix b/pkgs/development/libraries/libpinyin/default.nix
index ce0b396eed18..2ae333d61ad8 100644
--- a/pkgs/development/libraries/libpinyin/default.nix
+++ b/pkgs/development/libraries/libpinyin/default.nix
@@ -29,11 +29,16 @@ stdenv.mkDerivation rec {
     tar -xzf ${modelData} -C $sourceRoot/data
   '';
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
     glib
     db
-    pkg-config
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/simdjson/default.nix b/pkgs/development/libraries/simdjson/default.nix
index 0e73ed979eba..873e107513a1 100644
--- a/pkgs/development/libraries/simdjson/default.nix
+++ b/pkgs/development/libraries/simdjson/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "simdjson";
-  version = "3.2.3";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "simdjson";
     repo = "simdjson";
     rev = "v${version}";
-    sha256 = "sha256-h15IyPYvIUPDOJ03KgEDyRhXe0Oi8XCR5LnzSpPc4PI=";
+    sha256 = "sha256-81CvuQduIV1R/FN7nbVIQQs79B/Cy1ylOldNXix1KMw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/hist/default.nix b/pkgs/development/python-modules/hist/default.nix
index 07f8035fb2a2..8d47c7de0f73 100644
--- a/pkgs/development/python-modules/hist/default.nix
+++ b/pkgs/development/python-modules/hist/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "hist";
-  version = "2.7.1";
+  version = "2.7.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/74xTCvQPDQrnxaNznFa2PNigesjFyoAlwiCqTRP6Yg=";
+    hash = "sha256-JrGrgQ2LECIttdFh1KyvZKqgT+a6rtKWbUHB2sVgHQY=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index 172ddb5970a9..89a02ae69f15 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "0.28.0";
+  version = "0.28.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7.1";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "openai";
     repo = "openai-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-NDIHOX0W1nERvOWxnGBD42v+EjrND/9u90SS7KJzOW8=";
+    hash = "sha256-liJyeGxnYIC/jUQKdeATHpVJb/12KGbeM94Y2YQphfY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/yq-go/default.nix b/pkgs/development/tools/yq-go/default.nix
index a18f88d6d158..2e870975d339 100644
--- a/pkgs/development/tools/yq-go/default.nix
+++ b/pkgs/development/tools/yq-go/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "4.35.1";
+  version = "4.35.2";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     rev = "v${version}";
-    hash = "sha256-L0F3e2SsBAI6b3lrBJl9W2392ZlW0jHwJJ7MlvJ64es=";
+    hash = "sha256-iQJx++MeyXT7hS4NATvzYq+YErTEKYCajAzcn1QIWDU=";
   };
 
-  vendorHash = "sha256-XJW7ftx+V7H22EraQZlRFi+Li8fsl7ZALVnaiuE1rXI=";
+  vendorHash = "sha256-nh7boYBNYvNe+uMxV460bkmWQ61VYuvFYQ5CIaNEv98=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/misc/flashfocus/default.nix b/pkgs/misc/flashfocus/default.nix
index d300711deb2a..2f673a347de4 100644
--- a/pkgs/misc/flashfocus/default.nix
+++ b/pkgs/misc/flashfocus/default.nix
@@ -1,12 +1,14 @@
-{ lib, python3, fetchPypi, netcat-openbsd, nix-update-script }:
+{ lib, python3Packages, fetchPypi, netcat-openbsd, nix-update-script }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "flashfocus";
-  version = "2.3.1";
+  version = "2.4.0";
+
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-XT3CKJWn1uKnPPsJC+MWlEAd8sWdVTEXz5b3n0UUedY=";
+    sha256 = "sha256-TKqPUJq3t2EjX6sY3NSuW0sCq4IS4PNMaaFNe+5hvoY=";
   };
 
   postPatch = ''
@@ -14,8 +16,9 @@ python3.pkgs.buildPythonApplication rec {
       --replace "nc" "${lib.getExe netcat-openbsd}"
   '';
 
-  nativeBuildInputs = with python3.pkgs; [
+  nativeBuildInputs = with python3Packages; [
     pythonRelaxDepsHook
+    setuptools
   ];
 
   pythonRelaxDeps = [
@@ -23,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     "xcffib"
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python3Packages; [
     i3ipc
     xcffib
     click
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index 55900f86d21c..44cf8bfdb7b8 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -144,9 +144,14 @@ lib.makeScope
     mes = lib.recurseIntoAttrs (callPackage ./mes { });
     mes-libc = callPackage ./mes/libc.nix { };
 
+    musl11 = callPackage ./musl/1.1.nix {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+      gnused = gnused-mes;
+    };
+
     musl = callPackage ./musl {
       gcc = gcc46;
-      gawk = gawk-mes;
     };
 
     stage0-posix = callPackage ./stage0-posix { };
@@ -155,6 +160,10 @@ lib.makeScope
 
     tinycc-bootstrappable = lib.recurseIntoAttrs (callPackage ./tinycc/bootstrappable.nix { });
     tinycc-mes = lib.recurseIntoAttrs (callPackage ./tinycc/mes.nix { });
+    tinycc-musl = lib.recurseIntoAttrs (callPackage ./tinycc/musl.nix {
+      bash = bash_2_05;
+      musl = musl11;
+    });
 
     xz = callPackage ./xz {
       bash = bash_2_05;
@@ -187,6 +196,7 @@ lib.makeScope
       echo ${mes.compiler.tests.get-version}
       echo ${musl.tests.hello-world}
       echo ${tinycc-mes.compiler.tests.chain}
+      echo ${tinycc-musl.compiler.tests.hello-world}
       echo ${xz.tests.get-version}
       mkdir ''${out}
     '';
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/musl/1.1.nix b/pkgs/os-specific/linux/minimal-bootstrap/musl/1.1.nix
new file mode 100644
index 000000000000..eceb9b72aeb6
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/musl/1.1.nix
@@ -0,0 +1,114 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnupatch
+, gnused
+, gnugrep
+, gnutar
+, gzip
+}:
+
+let
+  inherit (import ./common.nix { inherit lib; }) pname meta;
+  version = "1.1.24";
+
+  src = fetchurl {
+    url = "https://musl.libc.org/releases/musl-${version}.tar.gz";
+    hash = "sha256-E3DJqBKyzyp9koAlEMygBYzDfmanvt1wBR8KNAFQIqM=";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/d98f97e21413efc32c770d0356f1feda66025686/sysa/musl-1.1.24/musl-1.1.24.sh
+  liveBootstrap = "https://github.com/fosslinux/live-bootstrap/raw/d98f97e21413efc32c770d0356f1feda66025686/sysa/musl-1.1.24";
+  patches = [
+    (fetchurl {
+      url = "${liveBootstrap}/patches/avoid_set_thread_area.patch";
+      hash = "sha256-TsbBZXk4/KMZG9EKi7cF+sullVXrxlizLNH0UHGXsPs=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/avoid_sys_clone.patch";
+      hash = "sha256-/ZmH64J57MmbxdfQ4RNjamAiBdkImMTlHsHdgV4gMj4=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/fenv.patch";
+      hash = "sha256-vMVGjoN4deAJW5gsSqA207SJqAbvhrnOsGK49DdEiTI=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/makefile.patch";
+      hash = "sha256-03iYBAUnsrEdLIIhhhq5mM6BGnPn2EfUmIHu51opxbw=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/musl_weak_symbols.patch";
+      hash = "sha256-/d9a2eUkpe9uyi1ye6T4CiYc9MR3FZ9na0Gb90+g4v0=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/set_thread_area.patch";
+      hash = "sha256-RIZYqbbRSx4X/0iFUhriwwBRmoXVR295GNBUjf2UrM0=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/sigsetjmp.patch";
+      hash = "sha256-wd2Aev1zPJXy3q933aiup5p1IMKzVJBquAyl3gbK4PU=";
+    })
+    # FIXME: this patch causes the build to fail
+    # (fetchurl {
+    #   url = "${liveBootstrap}/patches/stdio_flush_on_exit.patch";
+    #   hash = "sha256-/z5ze3h3QTysay8nRvyvwPv3pmTcKptdkBIaMCoeLDg=";
+    # })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/va_list.patch";
+      hash = "sha256-UmcMIl+YCi3wIeVvjbsCyqFlkyYsM4ECNwTfXP+s7vg=";
+    })
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version meta;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+    gnused
+    gnugrep
+    gnutar
+    gzip
+  ];
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd musl-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+  # tcc does not support complex types
+  rm -rf src/complex
+  # Configure fails without this
+  mkdir -p /dev
+  # https://github.com/ZilchOS/bootstrap-from-tcc/blob/2e0c68c36b3437386f786d619bc9a16177f2e149/using-nix/2a3-intermediate-musl.nix
+  sed -i 's|/bin/sh|${bash}/bin/bash|' \
+    tools/*.sh
+  chmod 755 tools/*.sh
+  # patch popen/system to search in PATH instead of hardcoding /bin/sh
+  sed -i 's|posix_spawn(&pid, "/bin/sh",|posix_spawnp(\&pid, "sh",|' \
+    src/stdio/popen.c src/process/system.c
+  sed -i 's|execl("/bin/sh", "sh", "-c",|execlp("sh", "-c",|'\
+    src/misc/wordexp.c
+
+  # Configure
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-shared \
+    CC=tcc
+
+  # Build
+  make AR="tcc -ar" RANLIB=true CFLAGS="-DSYSCALL_NO_TLS"
+
+  # Install
+  make install
+  cp ${tinycc.libs}/lib/libtcc1.a $out/lib
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix b/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix
new file mode 100644
index 000000000000..52db5f947425
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix
@@ -0,0 +1,13 @@
+{ lib }:
+
+{
+  pname = "musl";
+
+  meta = with lib; {
+    description = "An efficient, small, quality libc implementation";
+    homepage = "https://musl.libc.org";
+    license = licenses.mit;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/musl/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/musl/default.nix
index c252d60328e9..5ccfbdf67080 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/musl/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/musl/default.nix
@@ -8,12 +8,11 @@
 , gnumake
 , gnugrep
 , gnused
-, gawk
 , gnutar
 , gzip
 }:
 let
-  pname = "musl";
+  inherit (import ./common.nix { inherit lib; }) pname meta;
   version = "1.2.4";
 
   src = fetchurl {
@@ -22,7 +21,7 @@ let
   };
 in
 bash.runCommand "${pname}-${version}" {
-  inherit pname version;
+  inherit pname version meta;
 
   nativeBuildInputs = [
     gcc
@@ -30,7 +29,6 @@ bash.runCommand "${pname}-${version}" {
     gnumake
     gnused
     gnugrep
-    gawk
     gnutar
     gzip
   ];
@@ -50,14 +48,6 @@ bash.runCommand "${pname}-${version}" {
         ./test
         mkdir $out
       '';
-
-  meta = with lib; {
-    description = "An efficient, small, quality libc implementation";
-    homepage = "https://musl.libc.org";
-    license = licenses.mit;
-    maintainers = teams.minimal-bootstrap.members;
-    platforms = platforms.unix;
-  };
 } ''
   # Unpack
   tar xzf ${src}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/musl.nix
new file mode 100644
index 000000000000..6debf25c36b0
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/musl.nix
@@ -0,0 +1,155 @@
+# Build steps adapted from https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/tcc-0.9.27/tcc-musl-pass1.sh
+#
+# SPDX-FileCopyrightText: 2021-22 fosslinux <fosslinux@aussies.space>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+{ lib
+, fetchurl
+, callPackage
+, bash
+, tinycc-bootstrappable
+, musl
+, gnupatch
+, gnutar
+, bzip2
+}:
+let
+  pname = "tinycc-musl";
+  version = "0.9.27";
+
+  src = fetchurl {
+    url = "https://download.savannah.gnu.org/releases/tinycc/tcc-${version}.tar.bz2";
+    hash = "sha256-3iOvePypDOMt/y3UWzQysjNHQLubt7Bb9g/b/Dls65w=";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/424aa5be38a3023aa6842883a3954599b1597986/sysa/tcc-0.9.27/tcc-musl-pass1.sh
+  liveBootstrap = "https://github.com/fosslinux/live-bootstrap/raw/424aa5be38a3023aa6842883a3954599b1597986/sysa/tcc-0.9.27";
+  patches = [
+    (fetchurl {
+      url = "${liveBootstrap}/patches/ignore-duplicate-symbols.patch";
+      hash = "sha256-6Js8HkzjYlA8ETxeEYRWu+03OJI60NvR5h1QPkcMTlQ=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/ignore-static-inside-array.patch";
+      hash = "sha256-IF4RevLGjzRBuYqhuyG7+x6SVljzMAsYRKicNsmtbDY=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/static-link.patch";
+      hash = "sha256-gX/hJ9a/0Zg29KIBUme+mOA8WrPQvp0SvojP8DN9mSI=";
+    })
+  ];
+
+  meta = with lib; {
+      description = "Small, fast, and embeddable C compiler and interpreter";
+      homepage = "http://savannah.nongnu.org/projects/tinycc";
+      license = licenses.lgpl21Only;
+      maintainers = teams.minimal-bootstrap.members;
+      platforms = [ "i686-linux" ];
+    };
+
+  tinycc-musl = bash.runCommand "${pname}-${version}" {
+    inherit pname version meta;
+
+    nativeBuildInputs = [
+      tinycc-bootstrappable.compiler
+      gnupatch
+      gnutar
+      bzip2
+    ];
+  } ''
+    # Unpack
+    cp ${src} tinycc.tar.bz2
+    bunzip2 tinycc.tar.bz2
+    tar xf tinycc.tar
+    rm tinycc.tar
+    cd tcc-${version}
+
+    # Patch
+    ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+
+    # Configure
+    touch config.h
+
+    # Build
+    # We first have to recompile using tcc-0.9.26 as tcc-0.9.27 is not self-hosting,
+    # but when linked with musl it is.
+    ln -s ${musl}/lib/libtcc1.a ./libtcc1.a
+
+    tcc -v \
+      -static \
+      -o tcc-musl \
+      -D TCC_TARGET_I386=1 \
+      -D CONFIG_TCCDIR=\"\" \
+      -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
+      -D CONFIG_TCC_ELFINTERP=\"/musl/loader\" \
+      -D CONFIG_TCC_LIBPATHS=\"{B}\" \
+      -D CONFIG_TCC_SYSINCLUDEPATHS=\"${musl}/include\" \
+      -D TCC_LIBGCC=\"libc.a\" \
+      -D TCC_LIBTCC1=\"libtcc1.a\" \
+      -D CONFIG_TCC_STATIC=1 \
+      -D CONFIG_USE_LIBGCC=1 \
+      -D TCC_VERSION=\"0.9.27\" \
+      -D ONE_SOURCE=1 \
+      -B . \
+      -B ${tinycc-bootstrappable.libs}/lib \
+      tcc.c
+    # libtcc1.a
+    rm -f libtcc1.a
+    tcc -c -D HAVE_CONFIG_H=1 lib/libtcc1.c
+    tcc -ar cr libtcc1.a libtcc1.o
+
+    # Rebuild tcc-musl with itself
+    ./tcc-musl \
+      -v \
+      -static \
+      -o tcc-musl \
+      -D TCC_TARGET_I386=1 \
+      -D CONFIG_TCCDIR=\"\" \
+      -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
+      -D CONFIG_TCC_ELFINTERP=\"/musl/loader\" \
+      -D CONFIG_TCC_LIBPATHS=\"{B}\" \
+      -D CONFIG_TCC_SYSINCLUDEPATHS=\"${musl}/include\" \
+      -D TCC_LIBGCC=\"libc.a\" \
+      -D TCC_LIBTCC1=\"libtcc1.a\" \
+      -D CONFIG_TCC_STATIC=1 \
+      -D CONFIG_USE_LIBGCC=1 \
+      -D TCC_VERSION=\"0.9.27\" \
+      -D ONE_SOURCE=1 \
+      -B . \
+      -B ${musl}/lib \
+      tcc.c
+    # libtcc1.a
+    rm -f libtcc1.a
+    ./tcc-musl -c -D HAVE_CONFIG_H=1 lib/libtcc1.c
+    ./tcc-musl -ar cr libtcc1.a libtcc1.o
+
+    # Install
+    install -D tcc-musl $out/bin/tcc
+    install -Dm444 libtcc1.a $out/lib/libtcc1.a
+  '';
+in
+{
+  compiler = bash.runCommand "${pname}-${version}-compiler" {
+    inherit pname version meta;
+    passthru.tests.hello-world = result:
+      bash.runCommand "${pname}-simple-program-${version}" {} ''
+        cat <<EOF >> test.c
+        #include <stdio.h>
+        int main() {
+          printf("Hello World!\n");
+          return 0;
+        }
+        EOF
+        ${result}/bin/tcc -v -static -B${musl}/lib -o test test.c
+        ./test
+        mkdir $out
+      '';
+    passthru.tinycc-musl = tinycc-musl;
+  } "install -D ${tinycc-musl}/bin/tcc $out/bin/tcc";
+
+  libs = bash.runCommand "${pname}-${version}-libs" {
+    inherit pname version meta;
+  } "install -D ${tinycc-musl}/lib/libtcc1.a $out/lib/libtcc1.a";
+}
diff --git a/pkgs/os-specific/linux/rtl8821cu/default.nix b/pkgs/os-specific/linux/rtl8821cu/default.nix
index d85186301071..806df9f6dd4d 100644
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rtl8821cu";
-  version = "${kernel.version}-unstable-2023-04-28";
+  version = "${kernel.version}-unstable-2023-09-10";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8821cu-20210916";
-    rev = "e49409f22ceea0d5b5ef431e6170580028b84c9d";
-    hash = "sha256-mElZRr4RkRFiraBM8BxT8yesYgvDaj6xP+9T3P+0Ns4=";
+    rev = "f6d4598290c5e9c8e545130e8a31d130f6d135f4";
+    hash = "sha256-jpMf8K9diJ3mbEkP9Cp+VwairK+pwiEGU/AtUIouCqM=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/tailor-gui/default.nix b/pkgs/os-specific/linux/tailor-gui/default.nix
new file mode 100644
index 000000000000..86964ab4d36a
--- /dev/null
+++ b/pkgs/os-specific/linux/tailor-gui/default.nix
@@ -0,0 +1,60 @@
+{ stdenv
+, lib
+, rustPlatform
+, cargo
+, rustc
+, pkg-config
+, desktop-file-utils
+, appstream-glib
+, wrapGAppsHook4
+, meson
+, ninja
+, libadwaita
+, gtk4
+, tuxedo-rs
+}:
+let
+  src = tuxedo-rs.src;
+  sourceRoot = "source/tailor_gui";
+  pname = "tailor_gui";
+  version = tuxedo-rs.version;
+in
+stdenv.mkDerivation {
+
+  inherit src sourceRoot pname version;
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src sourceRoot;
+    name = "${pname}-${version}";
+    hash = "sha256-DUaSLv1V6skWXQ7aqD62uspq+I9KiWmjlwwxykVve5A=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    pkg-config
+    desktop-file-utils
+    appstream-glib
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    cargo
+    rustc
+    meson
+    ninja
+    libadwaita
+    gtk4
+  ];
+
+  meta = with lib; {
+    description = "Rust GUI for interacting with hardware from TUXEDO Computers";
+    longDescription = ''
+      An alternative to the TUXEDO Control Center (https://www.tuxedocomputers.com/en/TUXEDO-Control-Center.tuxedo),
+      written in Rust.
+    '';
+    homepage = "https://github.com/AaronErhardt/tuxedo-rs";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ mrcjkb ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/tuxedo-rs/default.nix b/pkgs/os-specific/linux/tuxedo-rs/default.nix
new file mode 100644
index 000000000000..c9fb057da68b
--- /dev/null
+++ b/pkgs/os-specific/linux/tuxedo-rs/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+}:
+let
+
+  # NOTE: This src is shared with tailor-gui.
+  # When updating, the tailor-gui.cargoDeps hash needs to be updated.
+  src = fetchFromGitHub {
+    owner = "AaronErhardt";
+    repo = "tuxedo-rs";
+    rev = "a77a9f6c64e6dd1ede3511934392cbc16271ef6b";
+    hash = "sha256-bk17vI1gLHayvCWfmZdCMqgmbJFOTDaaCaHcj9cLpMY=";
+  };
+
+in
+rustPlatform.buildRustPackage {
+  pname = "tuxedo-rs";
+  version = "0.2.2";
+
+  inherit src;
+
+  # Some of the tests are impure and rely on files in /etc/tailord
+  doCheck = false;
+
+  cargoHash = "sha256-vuXqab9W8NSD5U9dk15xM4fM/vd/fGgGdsvReMncWHg=";
+
+  postInstall = ''
+    install -Dm444 tailord/com.tux.Tailor.conf -t $out/share/dbus-1/system.d
+  '';
+
+  meta = with lib; {
+    description = "Rust utilities for interacting with hardware from TUXEDO Computers";
+    longDescription = ''
+      An alternative to the TUXEDO Control Center daemon.
+
+      Contains the following binaries:
+      - tailord: Daemon handling fan, keyboard and general HW support for Tuxedo laptops
+      - tailor: CLI
+    '';
+    homepage = "https://github.com/AaronErhardt/tuxedo-rs";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ mrcjkb ];
+    platforms = platforms.linux;
+  };
+}
+
diff --git a/pkgs/servers/matrix-synapse/matrix-hookshot/package.json b/pkgs/servers/matrix-synapse/matrix-hookshot/package.json
index 744f593caf13..5f4e0c309f09 100644
--- a/pkgs/servers/matrix-synapse/matrix-hookshot/package.json
+++ b/pkgs/servers/matrix-synapse/matrix-hookshot/package.json
@@ -1,6 +1,6 @@
 {
   "name": "matrix-hookshot",
-  "version": "4.4.1",
+  "version": "4.5.1",
   "description": "A bridge between Matrix and multiple project management services, such as GitHub, GitLab and JIRA.",
   "main": "lib/app.js",
   "repository": "https://github.com/matrix-org/matrix-hookshot",
@@ -57,7 +57,7 @@
     "jira-client": "^8.0.0",
     "markdown-it": "^12.3.2",
     "matrix-appservice-bridge": "^9.0.1",
-    "matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@^0.6.6-element.1",
+    "matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@^0.6.7-element.1",
     "matrix-widget-api": "^1.0.0",
     "micromatch": "^4.0.4",
     "mime": "^3.0.0",
@@ -65,11 +65,11 @@
     "nyc": "^15.1.0",
     "p-queue": "^6.6.2",
     "prom-client": "^14.2.0",
+    "quickjs-emscripten": "^0.23.0",
     "reflect-metadata": "^0.1.13",
     "source-map-support": "^0.5.21",
     "string-argv": "^0.3.1",
     "tiny-typed-emitter": "^2.1.0",
-    "vm2": "^3.9.18",
     "winston": "^3.3.3",
     "xml2js": "^0.5.0",
     "yaml": "^2.2.2"
@@ -92,13 +92,13 @@
     "@types/node-emoji": "^1.8.1",
     "@types/uuid": "^8.3.3",
     "@types/xml2js": "^0.4.11",
-    "@typescript-eslint/eslint-plugin": "^5.59.1",
-    "@typescript-eslint/parser": "^5.59.1",
+    "@typescript-eslint/eslint-plugin": "^6.6.0",
+    "@typescript-eslint/parser": "^6.6.0",
     "@uiw/react-codemirror": "^4.12.3",
     "chai": "^4.3.4",
-    "eslint": "^8.39.0",
+    "eslint": "^8.49.0",
     "eslint-config-preact": "^1.3.0",
-    "eslint-plugin-mocha": "^9.0.0",
+    "eslint-plugin-mocha": "^10.1.0",
     "mini.css": "^3.0.1",
     "mocha": "^8.2.1",
     "preact": "^10.5.15",
diff --git a/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json b/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json
index 503d692256d5..e27f39681c78 100644
--- a/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json
+++ b/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json
@@ -1,6 +1,6 @@
 {
-  "version": "4.4.1",
-  "srcHash": "sha256-pQSivF/90BvvqtBGTi8eSssPzJdkUNW9cXztG+V+Joo=",
-  "yarnHash": "1adcl20d5nis8w3amwkcxddybikn5whgx9ixv78lm9h2mc45y6jw",
-  "cargoHash": "sha256-c5hZroZ3A9dhviSuqVfNMSr5KL/FEXecuyMfZwMD9kc="
+  "version": "4.5.1",
+  "srcHash": "sha256-uqLpwgVEfwcMTeGMDn3lDUD91GHPNyWHmCSPxuV/VC0=",
+  "yarnHash": "08dw9vbhlmqwj2nah6fv1b2sf15ibl5kg38ghkxkbccs4j7adans",
+  "cargoHash": "sha256-bIpsQni3kaoYCGLz01YdauYM8ybpx+BvVTiB6N72rIA="
 }
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index a7c136ba691f..863e22f18b50 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -1,19 +1,8 @@
 { lib, stdenv, fetchFromGitHub, cmake, postgresql, openssl, libkrb5, enableUnfree ? true }:
 
-# # To enable on NixOS:
-# config.services.postgresql = let
-#   # The postgresql pkgs has to be taken from the
-#   # postgresql package used, so the extensions
-#   # are built for the correct postgresql version.
-#   postgresqlPackages = config.services.postgresql.package.pkgs;
-# in {
-#   extraPlugins = with postgresqlPackages; [ timescaledb ];
-#   settings.shared_preload_libraries = "timescaledb";
-# }
-
 stdenv.mkDerivation rec {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.11.2";
+  version = "2.12.0";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ postgresql openssl libkrb5 ];
@@ -22,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "timescale";
     repo = "timescaledb";
     rev = version;
-    sha256 = "sha256-c2fztGtl2cLThT0JhHCM0UaYkiWTp5T6TUZ3Au7CG7c=";
+    sha256 = "sha256-e4Sq5VzX5YPiFzG4T8OcCqzgxaWsyVeB21GAKl0aPDk=";
   };
 
   cmakeFlags = [ "-DSEND_TELEMETRY_DEFAULT=OFF" "-DREGRESS_CHECKS=OFF" "-DTAP_CHECKS=OFF" ]
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index cb66e6d9fd5a..7bf5120f77b0 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.157.0";
+  version = "0.158.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-OTWCTpxVBTJHaVmnuiGQEmRezDLLUnJKKKWYo+J5fLk=";
+    hash = "sha256-FFBWC/zgLSTrNJYx9t0lS5iPe33Zm/iIoAKmrLyaeOw=";
   };
 
-  vendorHash = "sha256-gOQ//+DJXn+5Ip0Ii1j08LD+op5WgHaPg/Wqz8Nwt1w=";
+  vendorHash = "sha256-KqrDKAU16iubJTCUQBk2T5QKbSIrcUE+ib5AEHqnpNI=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/system/smartmontools/default.nix b/pkgs/tools/system/smartmontools/default.nix
index a54c85bdaf92..02c4340aded2 100644
--- a/pkgs/tools/system/smartmontools/default.nix
+++ b/pkgs/tools/system/smartmontools/default.nix
@@ -23,11 +23,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "smartmontools";
-  version = "7.3";
+  version = "7.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/smartmontools/${pname}-${version}.tar.gz";
-    sha256 = "sha256-pUT4gI0MWM+w50JMoYQcuFipdJIrA11QXU5MJIvjois=";
+    hash = "sha256-6aYfZB/5bKlTGe37F5SM0pfQzTNCc2ssScmdRxb7mT0=";
   };
 
   patches = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a1f5b4a89445..56b1b2ec4a85 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30599,6 +30599,8 @@ with pkgs;
   apngasm = callPackage ../applications/graphics/apngasm { };
   apngasm_2 = callPackage ../applications/graphics/apngasm/2.nix { };
 
+  appcleaner = callPackage ../applications/misc/appcleaner { };
+
   appeditor = callPackage ../applications/misc/appeditor { };
 
   appgate-sdp = callPackage ../applications/networking/appgate-sdp { };
@@ -35857,6 +35859,8 @@ with pkgs;
 
   tailor = callPackage ../applications/version-management/tailor { };
 
+  tailor-gui = callPackage ../os-specific/linux/tailor-gui { };
+
   taizen = callPackage ../applications/misc/taizen { };
 
   talosctl = callPackage ../applications/networking/cluster/talosctl { };
@@ -36187,6 +36191,8 @@ with pkgs;
 
   tut = callPackage ../applications/misc/tut { };
 
+  tuxedo-rs = callPackage ../os-specific/linux/tuxedo-rs { };
+
   tuxguitar = callPackage ../applications/editors/music/tuxguitar {
     jre = jre8;
     swt = swt_jdk8;