From 054ebe60c011dba4e9589ea3576af22e7532f0a4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 4 Jul 2025 05:57:37 +0200
Subject: [PATCH 01/23] linux: drop dependency on nettools

This is not a required dependency per [1] and indeed building without it
works just fine.

[1] https://www.kernel.org/doc/html/latest/process/changes.html#current-minimal-requirements
---
 pkgs/os-specific/linux/kernel/manual-config.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 77eb4965bda1..16972d20dfd2 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPackages,
   runCommand,
-  nettools,
   bc,
   bison,
   flex,
@@ -214,7 +213,6 @@ lib.makeOverridable (
             flex
             perl
             bc
-            nettools
             openssl
             rsync
             gmp

From 8d3f60a85908683a5f68644b114654a372da95db Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 5 Jul 2025 16:26:42 +0300
Subject: [PATCH 02/23] linux/common-config: enable "untested" support for
 RTL8xxxU

---
 pkgs/os-specific/linux/kernel/common-config.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 0408659f19c6..4a6d742f6057 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -435,6 +435,13 @@ let
       ATH10K_DFS_CERTIFIED = option yes;
       B43_PHY_HT = option yes;
       BCMA_HOST_PCI = option yes;
+
+      # Enable "untested" hardware support for RTL8xxxU.
+      # There's a bunch of those still floating around,
+      # and given how old the hardware is, we're unlikely
+      # to kill any, so let's enable all known device IDs.
+      RTL8XXXU_UNTESTED = option yes;
+
       RTW88 = module;
       RTW88_8822BE = lib.mkMerge [
         (whenOlder "5.8" yes)

From da6ccbe56e1f25b1e947c13768095f8ddea3e175 Mon Sep 17 00:00:00 2001
From: Glenn Hartmann <hartmann.glenn@gmail.com>
Date: Sat, 5 Jul 2025 15:47:46 -0400
Subject: [PATCH 03/23] tor: 0.4.8.16 -> 0.4.8.17

Release notes: https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes
---
 pkgs/tools/security/tor/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 76aec1462571..18aabfcd33c4 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -50,11 +50,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "tor";
-  version = "0.4.8.16";
+  version = "0.4.8.17";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ZUDdN3oSD7jn0nUwqjt/9yoPpbT2cP4dZMmHwc/TkMs=";
+    sha256 = "sha256-ebRyXh1LiHueaP0JsNIkN3fVzjzUceU4WDvPb52M21Y=";
   };
 
   outputs = [

From ce19aa51280451c63ad5d58dcb321c9c8b987d17 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 5 Jul 2025 23:40:13 +0000
Subject: [PATCH 04/23] tideways-daemon: 1.9.40 -> 1.9.44

---
 pkgs/by-name/ti/tideways-daemon/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ti/tideways-daemon/package.nix b/pkgs/by-name/ti/tideways-daemon/package.nix
index 0fdf077aa2fe..3fe6156af3e9 100644
--- a/pkgs/by-name/ti/tideways-daemon/package.nix
+++ b/pkgs/by-name/ti/tideways-daemon/package.nix
@@ -10,7 +10,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-daemon";
-  version = "1.9.40";
+  version = "1.9.44";
 
   src =
     finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
@@ -28,15 +28,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_amd64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-6U6Vq908tJmR4JzZlbK/qjlfCl/iWrCIOJNvUh0Xvag=";
+        hash = "sha256-JzsSyUqKuH4msdSqN+rFdfrnNvlkFFFmspfpYLsiRZc=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_aarch64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-2Yq2HvQoBPPDvEyZPjwyTjjc/bb4+zOrwknqHUnZsjc=";
+        hash = "sha256-1nE61XHqnycMgjvjKIZnbgVSak0HYOIUHgF67RjcJi8=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_macos_arm64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-ab7ZAUYH4Em6KuE/VlVLItf3N0yMvIRuJnf7vOGDGsY=";
+        hash = "sha256-4KwUsFK3G73hGiVGqF1sAOv7gEjqJXSAj99wLyHE+qM=";
       };
     };
     updateScript = "${

From c9cba7a1ea804dfcbd4bbef723373b9966f0b624 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 5 Jul 2025 20:52:35 -0700
Subject: [PATCH 05/23] python3Packages.valkey: cleanup

---
 pkgs/development/python-modules/valkey/default.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/valkey/default.nix b/pkgs/development/python-modules/valkey/default.nix
index 3f56124ed71d..48801cf68b73 100644
--- a/pkgs/development/python-modules/valkey/default.nix
+++ b/pkgs/development/python-modules/valkey/default.nix
@@ -32,8 +32,6 @@ buildPythonPackage rec {
   version = "6.1.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "valkey-io";
     repo = "valkey-py";
@@ -86,11 +84,11 @@ buildPythonPackage rec {
     "test_psync"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Python client for Redis key-value store";
     homepage = "https://github.com/valkey-io/valkey-py";
     changelog = "https://github.com/valkey-io/valkey-py/releases/tag/${src.tag}";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ hexa ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
   };
 }

From 61511b707e7c2d1a3d6bb460461dfd6596b39191 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 5 Jul 2025 21:05:50 -0700
Subject: [PATCH 06/23] python3Packages.valkey: fix test errors on Darwin

---
 .../python-modules/valkey/default.nix         | 26 ++++++++++++++-----
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/valkey/default.nix b/pkgs/development/python-modules/valkey/default.nix
index 48801cf68b73..25cac9c152b2 100644
--- a/pkgs/development/python-modules/valkey/default.nix
+++ b/pkgs/development/python-modules/valkey/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   buildPythonPackage,
   pythonOlder,
@@ -76,14 +77,27 @@ buildPythonPackage rec {
 
   pytestFlagsArray = [ "-m 'not onlycluster and not ssl'" ];
 
-  disabledTests = [
-    # valkey.sentinel.MasterNotFoundError: No master found for 'valkey-py-test'
-    "test_get_from_cache"
-    "test_cache_decode_response"
-    # Expects another valkey instance on port 6380 *shrug*
-    "test_psync"
+  disabledTests =
+    [
+      # valkey.sentinel.MasterNotFoundError: No master found for 'valkey-py-test'
+      "test_get_from_cache"
+      "test_cache_decode_response"
+      # Expects another valkey instance on port 6380 *shrug*
+      "test_psync"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      #  OSError: AF_UNIX path too long
+      "test_uds_connect"
+      "test_network_connection_failure"
+    ];
+
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    # AttributeError: Can't get local object 'TestMultiprocessing.test_valkey_client.<locals>.target'
+    "tests/test_multiprocessing.py"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "Python client for Redis key-value store";
     homepage = "https://github.com/valkey-io/valkey-py";

From 7a526337ac62346b9cba3ba6840f04641da84ed9 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 5 Jul 2025 21:23:03 -0700
Subject: [PATCH 07/23] python3Packages.limits: disable flaky test

---
 pkgs/development/python-modules/limits/default.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/limits/default.nix b/pkgs/development/python-modules/limits/default.nix
index d7f7d55ce343..0b1b5870c642 100644
--- a/pkgs/development/python-modules/limits/default.nix
+++ b/pkgs/development/python-modules/limits/default.nix
@@ -102,15 +102,19 @@ buildPythonPackage rec {
 
   pytestFlagsArray = [ "--benchmark-disable" ];
 
-  disabledTests = [ "test_moving_window_memcached" ];
+  disabledTests = [
+    "test_moving_window_memcached"
+    # Flaky: compares time to magic value
+    "test_sliding_window_counter_previous_window"
+  ];
 
   pythonImportsCheck = [ "limits" ];
 
-  meta = with lib; {
+  meta = {
     description = "Rate limiting using various strategies and storage backends such as redis & memcached";
     homepage = "https://github.com/alisaifee/limits";
     changelog = "https://github.com/alisaifee/limits/releases/tag/${src.tag}";
-    license = licenses.mit;
-    maintainers = [ ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
   };
 }

From 935ba2a1ef3ca968e861918cae8d19e17c41874f Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 5 Jul 2025 21:23:30 -0700
Subject: [PATCH 08/23] python3Packages.limits: add sarahec as maintainer

---
 pkgs/development/python-modules/limits/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/limits/default.nix b/pkgs/development/python-modules/limits/default.nix
index 0b1b5870c642..fe8aa2753624 100644
--- a/pkgs/development/python-modules/limits/default.nix
+++ b/pkgs/development/python-modules/limits/default.nix
@@ -115,6 +115,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/alisaifee/limits";
     changelog = "https://github.com/alisaifee/limits/releases/tag/${src.tag}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ sarahec ];
   };
 }

From c44703367b447820e73c19b04e19e2e7f4c7dc81 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 5 Jul 2025 21:27:07 -0700
Subject: [PATCH 09/23] python3Packages.limits: 5.2.0 -> 5.4.0

https://github.com/alisaifee/limits/releases/tag/5.3.0
https://github.com/alisaifee/limits/releases/tag/5.4.0
---
 pkgs/development/python-modules/limits/default.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/limits/default.nix b/pkgs/development/python-modules/limits/default.nix
index fe8aa2753624..f2e76f1cf317 100644
--- a/pkgs/development/python-modules/limits/default.nix
+++ b/pkgs/development/python-modules/limits/default.nix
@@ -27,11 +27,9 @@
 
 buildPythonPackage rec {
   pname = "limits";
-  version = "5.2.0";
+  version = "5.4.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "alisaifee";
     repo = "limits";
@@ -39,10 +37,10 @@ buildPythonPackage rec {
     # Upstream uses versioneer, which relies on git attributes substitution.
     # This leads to non-reproducible archives on github. Remove the substituted
     # file here, and recreate it later based on our version info.
+    hash = "sha256-EHLqkd5Muazr52/oYaLklFVvF+AzJWGbFaaIG+T0ulE=";
     postFetch = ''
       rm "$out/limits/_version.py"
     '';
-    hash = "sha256-0D44XaSZtebMnn9mqXbaE7FB7usdu/eZ/4UE3Ye0oyA=";
   };
 
   patches = [

From 32a1da937087f3ccb26ff61465c58aafd298e100 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 6 Jul 2025 05:40:12 +0000
Subject: [PATCH 10/23] renovate: 41.16.0 -> 41.21.3

---
 pkgs/by-name/re/renovate/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/re/renovate/package.nix b/pkgs/by-name/re/renovate/package.nix
index 12c51932cfc4..14bbd4886fd1 100644
--- a/pkgs/by-name/re/renovate/package.nix
+++ b/pkgs/by-name/re/renovate/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "renovate";
-  version = "41.16.0";
+  version = "41.21.3";
 
   src = fetchFromGitHub {
     owner = "renovatebot";
     repo = "renovate";
     tag = finalAttrs.version;
-    hash = "sha256-hMcGK89YIqYCA201f+fxorHA3sseDL3nZTjH/90/JGQ=";
+    hash = "sha256-np21ghEbfaM7Z4ETmrAWUjrauQOf5FW+krl156UB2Ek=";
   };
 
   postPatch = ''
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-VF2fq6o4O5Ua+98PJ1d+vj5W8TMYL4ks3ekf27eQmIY=";
+    hash = "sha256-XOlFJFFyzbx8Bg92HXhVFFCI51j2GUK7+LJKfqVOQyU=";
   };
 
   env.COREPACK_ENABLE_STRICT = 0;

From f772e38277b387b1e225987fb84ed61af38174b3 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sat, 5 Jul 2025 12:01:32 +0200
Subject: [PATCH 11/23] freecad: enable ifc unconditionally

closes #370121

follow-up to #330190

The BIM workspace depends on ifc, there is little reason
why it should be conditional to a flag that causes a
from-source rebuild. It should just be always enabled.
---
 pkgs/by-name/fr/freecad/package.nix       | 39 ++++++++++-------------
 pkgs/by-name/fr/freecad/tests/default.nix |  2 --
 2 files changed, 17 insertions(+), 24 deletions(-)

diff --git a/pkgs/by-name/fr/freecad/package.nix b/pkgs/by-name/fr/freecad/package.nix
index 384a2fd97d8f..61a1630e2f39 100644
--- a/pkgs/by-name/fr/freecad/package.nix
+++ b/pkgs/by-name/fr/freecad/package.nix
@@ -23,7 +23,6 @@
   pkg-config,
   python3Packages,
   spaceNavSupport ? stdenv.hostPlatform.isLinux,
-  ifcSupport ? false,
   stdenv,
   swig,
   vtk,
@@ -35,27 +34,23 @@
   nix-update-script,
 }:
 let
-  pythonDeps =
-    with python3Packages;
-    [
-      boost
-      gitpython # for addon manager
-      matplotlib
-      opencamlib
-      pivy
-      ply # for openSCAD file support
-      py-slvs
-      pybind11
-      pycollada
-      pyside6
-      python
-      pyyaml # (at least for) PyrateWorkbench
-      scipy
-      shiboken6
-    ]
-    ++ lib.optionals ifcSupport [
-      ifcopenshell
-    ];
+  pythonDeps = with python3Packages; [
+    boost
+    gitpython # for addon manager
+    ifcopenshell
+    matplotlib
+    opencamlib
+    pivy
+    ply # for openSCAD file support
+    py-slvs
+    pybind11
+    pycollada
+    pyside6
+    python
+    pyyaml # (at least for) PyrateWorkbench
+    scipy
+    shiboken6
+  ];
 
   freecad-utils = callPackage ./freecad-utils.nix { };
 in
diff --git a/pkgs/by-name/fr/freecad/tests/default.nix b/pkgs/by-name/fr/freecad/tests/default.nix
index 954aadaf17ff..26fa5db07640 100644
--- a/pkgs/by-name/fr/freecad/tests/default.nix
+++ b/pkgs/by-name/fr/freecad/tests/default.nix
@@ -1,9 +1,7 @@
 {
   callPackage,
-  freecad,
 }:
 {
   python-path = callPackage ./python-path.nix { };
   modules = callPackage ./modules.nix { };
-  withIfcSupport = freecad.override { ifcSupport = true; };
 }

From cf02809424363ed72f62caa6925ac22148386618 Mon Sep 17 00:00:00 2001
From: Luflosi <luflosi@luflosi.de>
Date: Sun, 6 Jul 2025 11:36:22 +0200
Subject: [PATCH 12/23] nixos/tests/kubo: use diff instead of grep to properly
 check the contents of a file

This should be a little more robust.
---
 nixos/tests/kubo/kubo-fuse.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/nixos/tests/kubo/kubo-fuse.nix b/nixos/tests/kubo/kubo-fuse.nix
index b909697643e7..adc1ab1b9e41 100644
--- a/nixos/tests/kubo/kubo-fuse.nix
+++ b/nixos/tests/kubo/kubo-fuse.nix
@@ -27,8 +27,12 @@
   testScript = ''
     start_all()
 
-    with subtest("FUSE mountpoint"):
-        machine.fail("echo a | su bob -l -c 'ipfs add --quieter'")
+    with subtest("Create a file for testing"):
+        machine.succeed("echo 'fnord3' > /tmp/test.txt")
+
+
+    with subtest("/ipfs/ FUSE mountpoint"):
+        machine.fail("su bob -l -c 'ipfs add --quieter' < /tmp/test.txt")
         # The FUSE mount functionality is broken as of v0.13.0. This is still the case with v0.29.0.
         # See https://github.com/ipfs/kubo/issues/9044.
         # Workaround: using CID Version 1 avoids that.
@@ -36,13 +40,14 @@
             "echo fnord3 | su alice -l -c 'ipfs add --quieter --cid-version=1'"
         ).strip()
 
-        machine.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+        machine.succeed(f"diff /tmp/test.txt /ipfs/{ipfs_hash}")
+
 
     with subtest("Unmounting of /ipns and /ipfs"):
         # Force Kubo to crash and wait for it to restart
         machine.systemctl("kill --signal=SIGKILL ipfs.service")
         machine.wait_for_unit("ipfs.service", timeout = 30)
 
-        machine.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+        machine.succeed(f"diff /tmp/test.txt /ipfs/{ipfs_hash}")
   '';
 }

From 6af6c7ea8ca0f72bccf140c85726ae12a76ab92f Mon Sep 17 00:00:00 2001
From: Luflosi <luflosi@luflosi.de>
Date: Sun, 25 May 2025 15:30:20 +0200
Subject: [PATCH 13/23] kubo: 0.34.1 -> 0.35.0

https://github.com/ipfs/kubo/releases/tag/v0.35.0

This version introduces a new FUSE mount point, requiring some changes.
---
 nixos/modules/services/network-filesystems/kubo.nix | 13 ++++++++++---
 pkgs/by-name/ku/kubo/package.nix                    |  4 ++--
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/network-filesystems/kubo.nix b/nixos/modules/services/network-filesystems/kubo.nix
index e13bd0b9c105..b28e112f14dd 100644
--- a/nixos/modules/services/network-filesystems/kubo.nix
+++ b/nixos/modules/services/network-filesystems/kubo.nix
@@ -161,7 +161,7 @@ in
       autoMount = lib.mkOption {
         type = lib.types.bool;
         default = false;
-        description = "Whether Kubo should try to mount /ipfs and /ipns at startup.";
+        description = "Whether Kubo should try to mount /ipfs, /ipns and /mfs at startup.";
       };
 
       autoMigrate = lib.mkOption {
@@ -236,6 +236,12 @@ in
               default = "/ipns";
               description = "Where to mount the IPNS namespace to";
             };
+
+            Mounts.MFS = lib.mkOption {
+              type = lib.types.str;
+              default = "/mfs";
+              description = "Where to mount the MFS namespace to";
+            };
           };
         };
         description = ''
@@ -356,6 +362,7 @@ in
         ${cfg.dataDir}.d = defaultConfig;
         ${cfg.settings.Mounts.IPFS}.d = lib.mkIf (cfg.autoMount) defaultConfig;
         ${cfg.settings.Mounts.IPNS}.d = lib.mkIf (cfg.autoMount) defaultConfig;
+        ${cfg.settings.Mounts.MFS}.d = lib.mkIf (cfg.autoMount) defaultConfig;
       };
 
     # The hardened systemd unit breaks the fuse-mount function according to documentation in the unit file itself
@@ -401,8 +408,8 @@ in
               ipfs --offline config replace -
           '';
         postStop = lib.mkIf cfg.autoMount ''
-          # After an unclean shutdown the fuse mounts at cfg.settings.Mounts.IPFS and cfg.settings.Mounts.IPNS are locked
-          umount --quiet '${cfg.settings.Mounts.IPFS}' '${cfg.settings.Mounts.IPNS}' || true
+          # After an unclean shutdown the fuse mounts at cfg.settings.Mounts.IPFS, cfg.settings.Mounts.IPNS and cfg.settings.Mounts.MFS are locked
+          umount --quiet '${cfg.settings.Mounts.IPFS}' '${cfg.settings.Mounts.IPNS}' '${cfg.settings.Mounts.MFS}' || true
         '';
         serviceConfig = {
           ExecStart = [
diff --git a/pkgs/by-name/ku/kubo/package.nix b/pkgs/by-name/ku/kubo/package.nix
index efce344392da..78b542d6d841 100644
--- a/pkgs/by-name/ku/kubo/package.nix
+++ b/pkgs/by-name/ku/kubo/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "kubo";
-  version = "0.34.1"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.35.0"; # When updating, also check if the repo version changed and adjust repoVersion below
   rev = "v${version}";
 
   passthru.repoVersion = "16"; # Also update kubo-migrator when changing the repo version
@@ -16,7 +16,7 @@ buildGoModule rec {
   # Kubo makes changes to its source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-wrAnmPfls7LFO3gQBISSmn4ucuUVmzvYEoz+eVc/A5M=";
+    hash = "sha256-OubXaa2JWbEaakDV6pExm5PkiZ5XPd9uG+S4KwWb0xQ=";
   };
 
   # tarball contains multiple files/directories

From 27ab7b4f770980a98c8ca74e81c731a66c109cfa Mon Sep 17 00:00:00 2001
From: Luflosi <luflosi@luflosi.de>
Date: Sun, 6 Jul 2025 11:42:30 +0200
Subject: [PATCH 14/23] nixos/tests/kubo: test new /mfs/ FUSE mount point

---
 nixos/tests/kubo/kubo-fuse.nix | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/nixos/tests/kubo/kubo-fuse.nix b/nixos/tests/kubo/kubo-fuse.nix
index adc1ab1b9e41..a1afd4e1eb0b 100644
--- a/nixos/tests/kubo/kubo-fuse.nix
+++ b/nixos/tests/kubo/kubo-fuse.nix
@@ -43,11 +43,39 @@
         machine.succeed(f"diff /tmp/test.txt /ipfs/{ipfs_hash}")
 
 
-    with subtest("Unmounting of /ipns and /ipfs"):
+    with subtest("/mfs/ FUSE mountpoint"):
+        with subtest("Write the test file in three different ways"):
+            machine.succeed("cp /tmp/test.txt /mfs/test-1.txt")
+            machine.succeed("su alice -c 'ipfs files write --create /test-2.txt < /tmp/test.txt'")
+            machine.succeed(f"ipfs files cp /ipfs/{ipfs_hash} /test-3.txt")
+
+        with subtest("Show the files (for debugging)"):
+            # Different hashes for the different ways of adding the file to the MFS probably come from different linking structures of the merkle tree. Copying the file to /mfs with `cp` is even non-deterministic.
+            machine.succeed("ipfs files ls --long >&2")
+            machine.succeed("ls -l /mfs >&2")
+
+        with subtest("Check that everyone has permission to read the file (because of Mounts.FuseAllowOther)"):
+            machine.succeed("su alice -c 'cat /mfs/test-1.txt' | grep fnord3")
+            machine.succeed("su bob -c 'cat /mfs/test-1.txt' | grep fnord3")
+
+        with subtest("Check the file contents"):
+            machine.succeed("diff /tmp/test.txt /mfs/test-1.txt")
+            machine.succeed("diff /tmp/test.txt /mfs/test-2.txt")
+            machine.succeed("diff /tmp/test.txt /mfs/test-3.txt")
+
+        with subtest("Check the CID extended attribute"):
+            output = machine.succeed(
+                "getfattr --only-values --name=ipfs_cid /mfs/test-3.txt"
+            ).strip()
+            assert ipfs_hash == output, f"Expected {ipfs_hash} but got {output}"
+
+
+    with subtest("Unmounting of /ipns, /ipfs and /mfs"):
         # Force Kubo to crash and wait for it to restart
         machine.systemctl("kill --signal=SIGKILL ipfs.service")
         machine.wait_for_unit("ipfs.service", timeout = 30)
 
         machine.succeed(f"diff /tmp/test.txt /ipfs/{ipfs_hash}")
+        machine.succeed("diff /tmp/test.txt /mfs/test-3.txt")
   '';
 }

From d4b8e14efd866f02944fbb297fd3511f1416fd80 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 26 Jun 2025 10:02:09 +0200
Subject: [PATCH 15/23] python312Packages.app-model: 0.3.1 -> 0.4.0

Diff: https://github.com/pyapp-kit/app-model/compare/refs/tags/v0.3.1...refs/tags/v0.4.0

Changelog: https://github.com/pyapp-kit/app-model/blob/v0.4.0/CHANGELOG.md
---
 pkgs/development/python-modules/app-model/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/app-model/default.nix b/pkgs/development/python-modules/app-model/default.nix
index 707990d470fc..70ca05f56e89 100644
--- a/pkgs/development/python-modules/app-model/default.nix
+++ b/pkgs/development/python-modules/app-model/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "app-model";
-  version = "0.3.1";
+  version = "0.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "pyapp-kit";
     repo = "app-model";
     tag = "v${version}";
-    hash = "sha256-bIqcbKjAj5TMZD9mZ+7G4q+sR0aRqn6E4hf99srgRIE=";
+    hash = "sha256-T7aUwdne1rUzhVRotlxDvEBm3mi/frUQziZdLo53Lsg=";
   };
 
   build-system = [

From c523820064b969b1a5c2a46aa1de0dcd94f222cf Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 6 Jul 2025 13:20:23 +0200
Subject: [PATCH 16/23] python312Packages.napari: 0.6.1 -> 0.6.2

Diff: https://github.com/napari/napari/compare/refs/tags/v0.6.1...refs/tags/v0.6.2

Changelog: https://github.com/napari/napari/releases/tag/v0.6.2
---
 pkgs/development/python-modules/napari/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/napari/default.nix b/pkgs/development/python-modules/napari/default.nix
index 4e3a41bc999f..f6bacf9cfb33 100644
--- a/pkgs/development/python-modules/napari/default.nix
+++ b/pkgs/development/python-modules/napari/default.nix
@@ -45,14 +45,14 @@
 
 mkDerivationWith buildPythonPackage rec {
   pname = "napari";
-  version = "0.6.1";
+  version = "0.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "napari";
     repo = "napari";
     tag = "v${version}";
-    hash = "sha256-qgyhoxXROlm+DASJV2QOA1IqpHxPhsIEv+TGU2mhiuc=";
+    hash = "sha256-p6deNHnlvgZXV3Ym3OADC44j5bOkMDjlmM2N3yE5GxE=";
   };
 
   postPatch = ''

From 14c73e071c8de787beaa63311e4bb9c8e9f06848 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 6 Jul 2025 14:33:29 +0300
Subject: [PATCH 17/23] linux_testing: 6.16-rc3 -> 6.16-rc4

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index c07ea4d45058..378a8d761b82 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "6.16-rc3",
-        "hash": "sha256:04inkd3aqpikjarxy3lxzw2v2f45mnfzlq82r8mdsm23lkn68glr"
+        "version": "6.16-rc4",
+        "hash": "sha256:1h66i51d8m4zwbrxh7xayvqsnkrzj5wipf7rm8szyqmf86isjkpi"
     },
     "6.1": {
         "version": "6.1.142",

From f0f801902518c2d9a8cbacf329cee145cf72e58a Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 6 Jul 2025 14:33:32 +0300
Subject: [PATCH 18/23] linux_6_15: 6.15.4 -> 6.15.5

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 378a8d761b82..c7186dab60d1 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -28,7 +28,7 @@
         "hash": "sha256:0j577lqmzbzx45gxvxirx627pv6cbhq9slzb50rqqmyy3nqf1x05"
     },
     "6.15": {
-        "version": "6.15.4",
-        "hash": "sha256:05psir6p8x5a89d9kxkxlv5iifln67yf803xj5rqvx82nqkxdbqf"
+        "version": "6.15.5",
+        "hash": "sha256:1dc8qrwvvy34s5lgm43j295ipwaqm8wd8x4qchr14hqlkj9hg9rc"
     }
 }

From fa1020ecfa1dcd755696f6c2a7deb5c1a50fc343 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 6 Jul 2025 14:33:35 +0300
Subject: [PATCH 19/23] linux_6_12: 6.12.35 -> 6.12.36

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index c7186dab60d1..69e7cadc2a28 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -24,8 +24,8 @@
         "hash": "sha256:11gaczm68mqm72f3mfg656nkiqd9y66kf943hvwghln9lblhlr0q"
     },
     "6.12": {
-        "version": "6.12.35",
-        "hash": "sha256:0j577lqmzbzx45gxvxirx627pv6cbhq9slzb50rqqmyy3nqf1x05"
+        "version": "6.12.36",
+        "hash": "sha256:135s057ya63zw4v1jr9lzjdxk60ahr9v38hbv6nima755pnql5ja"
     },
     "6.15": {
         "version": "6.15.5",

From 3bd523d0021c42acf342bf0759b8adb6f5abe4cb Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 6 Jul 2025 14:33:39 +0300
Subject: [PATCH 20/23] linux_6_6: 6.6.95 -> 6.6.96

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 69e7cadc2a28..0f0f2d0a2d8c 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -20,8 +20,8 @@
         "hash": "sha256:1adn0pbk8y1zp1yrz83ch6h4wypm2qvbnx4xig3sls2nfgvmi0f4"
     },
     "6.6": {
-        "version": "6.6.95",
-        "hash": "sha256:11gaczm68mqm72f3mfg656nkiqd9y66kf943hvwghln9lblhlr0q"
+        "version": "6.6.96",
+        "hash": "sha256:1p8v49w7z8w3wc68mbw46cz9xqrllc8cpa7nqlm2xnrssi1mir4y"
     },
     "6.12": {
         "version": "6.12.36",

From 3b96bd3244bdc0bcceba405a057f84c953b6aaeb Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 6 Jul 2025 14:33:42 +0300
Subject: [PATCH 21/23] linux_6_1: 6.1.142 -> 6.1.143

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 0f0f2d0a2d8c..c15ca067bc07 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -4,8 +4,8 @@
         "hash": "sha256:1h66i51d8m4zwbrxh7xayvqsnkrzj5wipf7rm8szyqmf86isjkpi"
     },
     "6.1": {
-        "version": "6.1.142",
-        "hash": "sha256:1am31xw70sbxzdnvj70fx9l946nadcbrc7qk2yxxssy96nhnxlnw"
+        "version": "6.1.143",
+        "hash": "sha256:02ivq22hv42bcnssfpkkbqlhz1by9jrfrqlrz1wi0svysz2dlnz2"
     },
     "5.15": {
         "version": "5.15.186",

From 63e2606ddf48204a320a34787b51182c374316c5 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 27 Mar 2024 17:58:42 +0100
Subject: [PATCH 22/23] nixos.runTest: Add extend, overrideTestDerivation

---
 .../writing-nixos-tests.section.md            | 23 +++++++++
 nixos/doc/manual/redirects.json               |  6 +++
 nixos/lib/testing/call-test.nix               | 32 ++++++++++++-
 nixos/lib/testing/run.nix                     | 48 ++++++++++++++++++-
 4 files changed, 106 insertions(+), 3 deletions(-)

diff --git a/nixos/doc/manual/development/writing-nixos-tests.section.md b/nixos/doc/manual/development/writing-nixos-tests.section.md
index 5b08975e5ea4..ca2ff2765ec1 100644
--- a/nixos/doc/manual/development/writing-nixos-tests.section.md
+++ b/nixos/doc/manual/development/writing-nixos-tests.section.md
@@ -275,6 +275,29 @@ added using the parameter `extraPythonPackages`. For example, you could add
 
 In that case, `numpy` is chosen from the generic `python3Packages`.
 
+## Overriding a test {#sec-override-nixos-test}
+
+The NixOS test framework returns tests with multiple overriding methods.
+
+`overrideTestDerivation` *function*
+:   Like applying `overrideAttrs` on the [test](#test-opt-test) derivation.
+
+    This is a convenience for `extend` with an override on the [`rawTestDerivationArg`](#test-opt-rawTestDerivationArg) option.
+
+    *function*
+    :   An extension function, e.g. `finalAttrs: prevAttrs: { /* … */ }`, the result of which is passed to [`mkDerivation`](https://nixos.org/manual/nixpkgs/stable/#sec-using-stdenv).
+        Just as with `overrideAttrs`, an abbreviated form can be used, e.g. `prevAttrs: { /* … */ }` or even `{ /* … */ }`.
+        See [`lib.extends`](https://nixos.org/manual/nixpkgs/stable/#function-library-lib.fixedPoints.extends).
+
+`extend { modules = ` *modules* `; specialArgs = ` *specialArgs* `; }`
+:   Adds new `nixosTest` modules and/or module arguments to the test, which are evaluated together with the existing modules and [built-in options](#sec-test-options-reference).
+
+    `modules`
+    :   A list of modules to add to the test. These are added to the existing modules and then [evaluated](https://nixos.org/manual/nixpkgs/stable/index.html#module-system-lib-evalModules) together.
+
+    `specialArgs`
+    :   An attribute of arguments to pass to the test. These override the existing arguments, as well as any `_module.args.<name>` that the modules may define. See [`evalModules`/`specialArgs`](https://nixos.org/manual/nixpkgs/stable/#module-system-lib-evalModules-param-specialArgs).
+
 ## Test Options Reference {#sec-test-options-reference}
 
 The following options can be used when writing tests.
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 44ab6c6b860c..8823d5d226b3 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -1,4 +1,10 @@
 {
+  "sec-override-nixos-test": [
+    "index.html#sec-override-nixos-test"
+  ],
+  "test-opt-rawTestDerivationArg": [
+    "index.html#test-opt-rawTestDerivationArg"
+  ],
   "book-nixos-manual": [
     "index.html#book-nixos-manual"
   ],
diff --git a/nixos/lib/testing/call-test.nix b/nixos/lib/testing/call-test.nix
index 9abcea07455e..b85cdaf49244 100644
--- a/nixos/lib/testing/call-test.nix
+++ b/nixos/lib/testing/call-test.nix
@@ -1,6 +1,19 @@
-{ config, lib, ... }:
+{
+  config,
+  extendModules,
+  lib,
+  ...
+}:
 let
   inherit (lib) mkOption types;
+
+  unsafeGetAttrPosStringOr =
+    default: name: value:
+    let
+      p = builtins.unsafeGetAttrPos name value;
+    in
+    if p == null then default else p.file + ":" + toString p.line + ":" + toString p.column;
+
 in
 {
   options = {
@@ -9,4 +22,21 @@ in
       default = config;
     };
   };
+  config = {
+    # Docs: nixos/doc/manual/development/writing-nixos-tests.section.md
+    /**
+      See https://nixos.org/manual/nixos/unstable#sec-override-nixos-test
+    */
+    passthru.extend =
+      args@{
+        modules,
+        specialArgs ? { },
+      }:
+      (extendModules {
+        inherit specialArgs;
+        modules = map (lib.setDefaultModuleLocation (
+          unsafeGetAttrPosStringOr "<test.extend module>" "modules" args
+        )) modules;
+      }).config.test;
+  };
 }
diff --git a/nixos/lib/testing/run.nix b/nixos/lib/testing/run.nix
index f37aa1bcd0e5..752c1e911803 100644
--- a/nixos/lib/testing/run.nix
+++ b/nixos/lib/testing/run.nix
@@ -2,10 +2,31 @@
   config,
   hostPkgs,
   lib,
+  options,
   ...
 }:
 let
   inherit (lib) types mkOption;
+
+  # TODO (lib): Also use lib equivalent in nodes.nix
+  /**
+    Create a module system definition that overrides an existing option from a different module evaluation.
+
+    Type: Option a -> (a -> a) -> Definition a
+  */
+  mkOneUp =
+    /**
+      Option from an existing module evaluation, e.g.
+      - `(lib.evalModules ...).options.x` when invoking `evalModules` again,
+      - or `{ options, ... }:` when invoking `extendModules`.
+    */
+    opt:
+    /**
+      Function from the old value to the new definition, which will be wrapped with `mkOverride`.
+    */
+    f:
+    lib.mkOverride (opt.highestPrio - 1) (f opt.value);
+
 in
 {
   options = {
@@ -30,6 +51,13 @@ in
       internal = true;
     };
 
+    rawTestDerivationArg = mkOption {
+      type = types.functionTo types.raw;
+      description = ''
+        Argument passed to `mkDerivation` to create the `rawTestDerivation`.
+      '';
+    };
+
     test = mkOption {
       type = types.package;
       # TODO: can the interactive driver be configured to access the network?
@@ -43,10 +71,12 @@ in
   };
 
   config = {
-    rawTestDerivation =
+    rawTestDerivation = hostPkgs.stdenv.mkDerivation config.rawTestDerivationArg;
+    rawTestDerivationArg =
+      finalAttrs:
       assert lib.assertMsg (!config.sshBackdoor.enable)
         "The SSH backdoor is currently not supported for non-interactive testing! Please make sure to only set `interactive.sshBackdoor.enable = true;`!";
-      hostPkgs.stdenv.mkDerivation {
+      {
         name = "vm-test-run-${config.name}";
 
         requiredSystemFeatures =
@@ -75,5 +105,19 @@ in
 
     # useful for inspection (debugging / exploration)
     passthru.config = config;
+
+    # Docs: nixos/doc/manual/development/writing-nixos-tests.section.md
+    /**
+      See https://nixos.org/manual/nixos/unstable#sec-override-nixos-test
+    */
+    passthru.overrideTestDerivation =
+      f:
+      config.passthru.extend {
+        modules = [
+          {
+            rawTestDerivationArg = mkOneUp options.rawTestDerivationArg (lib.extends (lib.toExtension f));
+          }
+        ];
+      };
   };
 }

From f2b3aeb383761620ca69fae35b837221e9fd5a77 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 6 Jul 2025 13:37:55 +0200
Subject: [PATCH 23/23] nixos.runTest: Add extendNixOS

---
 .../writing-nixos-tests.section.md            | 33 +++++++++++
 nixos/doc/manual/redirects.json               |  3 +
 nixos/lib/testing/nodes.nix                   | 22 +++++++
 pkgs/build-support/testers/test/default.nix   | 57 +++++++++++++------
 4 files changed, 97 insertions(+), 18 deletions(-)

diff --git a/nixos/doc/manual/development/writing-nixos-tests.section.md b/nixos/doc/manual/development/writing-nixos-tests.section.md
index ca2ff2765ec1..773b8d26d64f 100644
--- a/nixos/doc/manual/development/writing-nixos-tests.section.md
+++ b/nixos/doc/manual/development/writing-nixos-tests.section.md
@@ -289,9 +289,42 @@ The NixOS test framework returns tests with multiple overriding methods.
         Just as with `overrideAttrs`, an abbreviated form can be used, e.g. `prevAttrs: { /* … */ }` or even `{ /* … */ }`.
         See [`lib.extends`](https://nixos.org/manual/nixpkgs/stable/#function-library-lib.fixedPoints.extends).
 
+`extendNixOS { module = ` *module* `; specialArgs = ` *specialArgs* `; }`
+:   Evaluates the test with additional NixOS modules and/or arguments.
+
+    `module`
+    :   A NixOS module to add to all the nodes in the test. Sets test option [`extraBaseModules`](#test-opt-extraBaseModules).
+
+    `specialArgs`
+    :   An attribute set of arguments to pass to all NixOS modules. These override the existing arguments, as well as any `_module.args.<name>` that the modules may define. Sets test option [`node.specialArgs`](#test-opt-node.specialArgs).
+
+    This is a convenience function for `extend` that overrides the aforementioned test options.
+
+    :::{.example #ex-nixos-test-extendNixOS}
+
+    # Using extendNixOS in `passthru.tests` to make `(openssh.tests.overrideAttrs f).tests.nixos` coherent
+
+    ```nix
+    mkDerivation (finalAttrs: {
+      # …
+      passthru = {
+        tests = {
+          nixos = nixosTests.openssh.extendNixOS {
+            module = {
+              services.openssh.package = finalAttrs.finalPackage;
+            };
+          };
+        };
+      };
+    })
+    ```
+    :::
+
 `extend { modules = ` *modules* `; specialArgs = ` *specialArgs* `; }`
 :   Adds new `nixosTest` modules and/or module arguments to the test, which are evaluated together with the existing modules and [built-in options](#sec-test-options-reference).
 
+    If you're only looking to extend the _NixOS_ configurations of the test, and not something else about the test, you may use the `extendNixOS` convenience function instead.
+
     `modules`
     :   A list of modules to add to the test. These are added to the existing modules and then [evaluated](https://nixos.org/manual/nixpkgs/stable/index.html#module-system-lib-evalModules) together.
 
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 8823d5d226b3..395038427f72 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -5,6 +5,9 @@
   "test-opt-rawTestDerivationArg": [
     "index.html#test-opt-rawTestDerivationArg"
   ],
+  "ex-nixos-test-extendNixOS": [
+    "index.html#ex-nixos-test-extendNixOS"
+  ],
   "book-nixos-manual": [
     "index.html#book-nixos-manual"
   ],
diff --git a/nixos/lib/testing/nodes.nix b/nixos/lib/testing/nodes.nix
index b2352c478110..15bcc464f481 100644
--- a/nixos/lib/testing/nodes.nix
+++ b/nixos/lib/testing/nodes.nix
@@ -3,6 +3,7 @@ testModuleArgs@{
   lib,
   hostPkgs,
   nodes,
+  options,
   ...
 }:
 
@@ -73,6 +74,9 @@ let
     ];
   };
 
+  # TODO (lib): Dedup with run.nix, add to lib/options.nix
+  mkOneUp = opt: f: lib.mkOverride (opt.highestPrio - 1) (f opt.value);
+
 in
 
 {
@@ -233,5 +237,23 @@ in
       ))
     ];
 
+    # Docs: nixos/doc/manual/development/writing-nixos-tests.section.md
+    /**
+      See https://nixos.org/manual/nixos/unstable#sec-override-nixos-test
+    */
+    passthru.extendNixOS =
+      {
+        module,
+        specialArgs ? { },
+      }:
+      config.passthru.extend {
+        modules = [
+          {
+            extraBaseModules = module;
+            node.specialArgs = mkOneUp options.node.specialArgs (_: specialArgs);
+          }
+        ];
+      };
+
   };
 }
diff --git a/pkgs/build-support/testers/test/default.nix b/pkgs/build-support/testers/test/default.nix
index fbcf6c0cad7d..c38c19862040 100644
--- a/pkgs/build-support/testers/test/default.nix
+++ b/pkgs/build-support/testers/test/default.nix
@@ -30,6 +30,24 @@ let
         __structuredAttrs = enable;
       });
     });
+  runNixOSTest-example = pkgs-with-overlay.testers.runNixOSTest (
+    { lib, ... }:
+    {
+      name = "runNixOSTest-test";
+      nodes.machine =
+        { pkgs, ... }:
+        {
+          system.nixos = dummyVersioning;
+          environment.systemPackages = [
+            pkgs.proof-of-overlay-hello
+            pkgs.figlet
+          ];
+        };
+      testScript = ''
+        machine.succeed("hello | figlet >/dev/console")
+      '';
+    }
+  );
 
 in
 lib.recurseIntoAttrs {
@@ -64,24 +82,27 @@ lib.recurseIntoAttrs {
     };
   };
 
-  runNixOSTest-example = pkgs-with-overlay.testers.runNixOSTest (
-    { lib, ... }:
-    {
-      name = "runNixOSTest-test";
-      nodes.machine =
-        { pkgs, ... }:
-        {
-          system.nixos = dummyVersioning;
-          environment.systemPackages = [
-            pkgs.proof-of-overlay-hello
-            pkgs.figlet
-          ];
-        };
-      testScript = ''
-        machine.succeed("hello | figlet >/dev/console")
-      '';
-    }
-  );
+  inherit runNixOSTest-example;
+
+  runNixOSTest-extendNixOS =
+    let
+      t = runNixOSTest-example.extendNixOS {
+        module =
+          { hi, lib, ... }:
+          {
+            config = {
+              assertions = [ { assertion = hi; } ];
+            };
+            options = {
+              itsProofYay = lib.mkOption { };
+            };
+          };
+        specialArgs.hi = true;
+      };
+    in
+    assert lib.isDerivation t;
+    assert t.nodes.machine ? itsProofYay;
+    t;
 
   # Check that the wiring of nixosTest is correct.
   # Correct operation of the NixOS test driver should be asserted elsewhere.