diff --git a/pkgs/development/ocaml-modules/ssl/default.nix b/pkgs/development/ocaml-modules/ssl/default.nix
index ad75b4a3dac0..ef8ce098f3ce 100644
--- a/pkgs/development/ocaml-modules/ssl/default.nix
+++ b/pkgs/development/ocaml-modules/ssl/default.nix
@@ -13,7 +13,9 @@ stdenv.mkDerivation {
     sha256 = "0i0j89b10n3xmmawcq4qfwa42133pddw4x5nysmsnpd15srv5gp9";
   };
 
-  buildInputs = [which openssl ocaml findlib];
+  buildInputs = [which ocaml findlib];
+
+  propagatedBuildInputs = [openssl];
 
   dontAddPrefix = true;
 
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index 10fd71a07541..0018a2762e78 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -3,7 +3,7 @@
 , libusb ? null, gnutls ? null, avahi ? null, libpaper ? null
 }:
 
-let version = "2.0.2"; in
+let version = "2.0.3"; in
 
 with stdenv.lib;
 stdenv.mkDerivation {
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.cups.org/software/${version}/cups-${version}-source.tar.bz2";
-    sha256 = "12xild9nrhqnrzx8zqh78v3chm4mpp5gf5iamr0h9zb6dgvj11w5";
+    sha256 = "10c84ppc9prx6gcyskmm6fh0rks346yryzd356gkg9whhq26fcdw";
   };
 
   buildInputs = [ pkgconfig zlib libjpeg libpng libtiff libusb gnutls avahi libpaper ]
diff --git a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index 8ab80ee1e4d0..dc166da3ae1d 100644
--- a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "firmware-linux-nonfree-${version}";
-  version = "2015-05-13";
+  version = "2015-06-30";
 
   src = fetchgit {
-    url = "http://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git";
-    rev = "3161bfa479d5e9ed4f46b57df9bcecbbc4f8eb3c";
-    sha256 = "0np6vwcnas3pzp38man3cs8j5ijs0p3skyzla19sfxzpwmjvfpjq";
+    url = "http://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/linux-firmware.git";
+    rev = "ea901a57054441907e9b127ad407a8554532f992";
+    sha256 = "00899r0gakdy2vpgq5zbhbxrl4kyczg1kybv1h3m2lrk9a0j7v67";
   };
 
   preInstall = ''
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 15c84a79a870..357ee2b9f213 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -13,19 +13,18 @@ let
     url = mirror://sourceforge/hpnssh/openssh-6.6p1-hpnssh14v5.diff.gz;
     sha256 = "682b4a6880d224ee0b7447241b684330b731018585f1ba519f46660c10d63950";
   };
-  optionalString = stdenv.lib.optionalString;
 
 in
-
+with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "openssh-6.8p1";
+  name = "openssh-6.9p1";
 
   src = fetchurl {
     url = "mirror://openbsd/OpenSSH/portable/${name}.tar.gz";
-    sha256 = "03hnrqvjq6ghg1mp3gkarfxh6g3x1n1vjrzpbc5lh9717vklrxiz";
+    sha256 = "1zkci5nbpb4frmzj2vr3kv9j47x2h72kvybcpr0d8mzk73sls1vf";
   };
 
-  prePatch = stdenv.lib.optionalString hpnSupport
+  prePatch = optionalString hpnSupport
     ''
       gunzip -c ${hpnSrc} | patch -p1
       export NIX_LDFLAGS="$NIX_LDFLAGS -lgcc_s"
@@ -34,43 +33,39 @@ stdenv.mkDerivation rec {
   patches = [ ./locale_archive.patch ];
 
   buildInputs = [ zlib openssl libedit pkgconfig pam ]
-    ++ stdenv.lib.optional withKerberos [ kerberos ];
+    ++ optional withKerberos [ kerberos ];
 
   # I set --disable-strip because later we strip anyway. And it fails to strip
   # properly when cross building.
-  configureFlags =
-    ''
-      --with-mantype=man
-      --with-libedit=yes
-      --disable-strip
-      ${if pam != null then "--with-pam" else "--without-pam"}
-      ${optionalString (etcDir != null) "--sysconfdir=${etcDir}"}
-      ${optionalString withKerberos "--with-kerberos5=${kerberos}"}
-      ${optionalString stdenv.isDarwin "--disable-libutil"}
-    '';
+  configureFlags = [
+    "--localstatedir=/var"
+    "--with-mantype=man"
+    "--with-libedit=yes"
+    "--disable-strip"
+    (if pam != null then "--with-pam" else "--without-pam")
+  ] ++ optional (etcDir != null) "--sysconfdir=${etcDir}"
+    ++ optional withKerberos "--with-kerberos5=${kerberos}"
+    ++ optional stdenv.isDarwin "--disable-libutil";
 
-  preConfigure =
-    ''
-      configureFlags="$configureFlags --with-privsep-path=$out/empty"
-      mkdir -p $out/empty
-    '';
+  preConfigure = ''
+    configureFlagsArray+=("--with-privsep-path=$out/empty")
+    mkdir -p $out/empty
+  '';
 
   enableParallelBuilding = true;
 
-  postInstall =
-    ''
-      # Install ssh-copy-id, it's very useful.
-      cp contrib/ssh-copy-id $out/bin/
-      chmod +x $out/bin/ssh-copy-id
-      cp contrib/ssh-copy-id.1 $out/share/man/man1/
+  postInstall = ''
+    # Install ssh-copy-id, it's very useful.
+    cp contrib/ssh-copy-id $out/bin/
+    chmod +x $out/bin/ssh-copy-id
+    cp contrib/ssh-copy-id.1 $out/share/man/man1/
+  '';
 
-      mkdir -p $out/etc/ssh
-      cp moduli $out/etc/ssh/
-    '';
+  installFlags = [
+    "sysconfdir=\${out}/etc/ssh"
+  ];
 
-  installTargets = "install-nosysconf";
-
-  meta = with stdenv.lib; {
+  meta = {
     homepage = "http://www.openssh.org/";
     description = "An implementation of the SSH protocol";
     license = stdenv.lib.licenses.bsd2;