diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 8d9c09561ddb0..efa94678ca3e8 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -106,6 +106,8 @@ rec {
   mips64-linux-gnuabi64    = { config = "mips64-unknown-linux-gnuabi64";    } // platforms.gcc_mips64r2_64;
   mips64el-linux-gnuabi64  = { config = "mips64el-unknown-linux-gnuabi64";  } // platforms.gcc_mips64r2_64;
 
+  octeon = { config = "mips64el-unknown-linux-gnuabi64"; } // platforms.gcc_mips64r2_64 // platforms.octeon;
+
   muslpi = raspberryPi // {
     config = "armv6l-unknown-linux-musleabihf";
   };
diff --git a/lib/systems/platforms.nix b/lib/systems/platforms.nix
index d2e8f77bec03e..224d191b51030 100644
--- a/lib/systems/platforms.nix
+++ b/lib/systems/platforms.nix
@@ -526,6 +526,46 @@ rec {
     };
   };
 
+  # Cavium Octeon series chips, which represent nearly all mips64
+  # chips in production as of 2023
+  octeon = {
+
+    # Note: qemu will segfault if you try to run a binary that uses
+    # the -march=octeon instructions.  Much of nixpkgs'
+    # cross-compilation requires qemu.
+
+    # gcc = { arch = "octeon"; };
+
+    linux-kernel = {
+      name = "mips64el";
+      baseConfig = "cavium_octeon_defconfig";
+      target = "vmlinux";
+      DTB = true;
+      autoModules = true;
+      extraConfig =
+        lib.concatStringsSep "\n"
+          (lib.mapAttrsToList (k: v: "${k} ${v}") {
+            CPU_CAVIUM_OCTEON = "y";
+            CPU_LITTLE_ENDIAN = "y";
+            KBUILD_SYM32 = "n";
+            MODULES = "y";
+
+            # MIPS kernels are ELF images, with ELF structure, so you
+            # can stick things into them (and patchelf them!).  We can
+            # also attach the desired DTB directly to the kernel image,
+            # and even use the DTB as a "grub.conf".
+            MIPS_ELF_APPENDED_DTB = "y";
+
+            # Take boot command line from the DTB, but allow the
+            # bootloader to supersede those choices.
+            MIPS_CMDLINE_DTB_EXTEND = "y";
+
+            # > ERROR: modpost: "__tracepoint_ata_bmdma_stop" [drivers/ata/pata_octeon_cf.ko] undefined!
+            PATA_OCTEON_CF = "n";
+          });
+    };
+  };
+
   ##
   ## Other
   ##
diff --git a/nixos/modules/installer/sd-card/sd-image-mips64el.nix b/nixos/modules/installer/sd-card/sd-image-mips64el.nix
new file mode 100644
index 0000000000000..c31f4302f1516
--- /dev/null
+++ b/nixos/modules/installer/sd-card/sd-image-mips64el.nix
@@ -0,0 +1,42 @@
+/*
+To build, use:
+nix-build nixos -I nixos-config=nixos/modules/installer/sd-card/sd-image-mips64el.nix -A config.system.build.sdImage
+
+Since mips hardware is found mostly in routers which are optimized
+for I/O throughput rather than compilation speed, you probably
+want to cross-compile this.  To do so, use:
+
+nix-build nixos \
+  -A config.system.build.sdImage \
+  --arg configuration '{config,lib,pkgs,...}@args: (import ./nixos/modules/installer/sd-card/sd-image-mips64el.nix args) // { nixpkgs.hostPlatform = lib.systems.examples.octeon; nixpkgs.buildPlatform = builtins.currentSystem; }'
+*/
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ../../profiles/base.nix
+    ./sd-image.nix
+  ];
+
+  boot.loader = {
+    grub.enable = false;
+    generic-extlinux-compatible = {
+      enable = true;
+    };
+  };
+
+  services.xserver.enable = lib.mkForce false;
+  services.xserver.libinput.enable = lib.mkForce false;
+
+  boot.consoleLogLevel = lib.mkDefault 7;
+  boot.kernelParams = [ "console=ttyS0,115200" ];
+  boot.initrd.includeDefaultModules = false;
+
+  sdImage = {
+    populateFirmwareCommands = "";
+    populateRootCommands = ''
+      mkdir -p ./files/boot
+      ${config.boot.loader.generic-extlinux-compatible.populateCmd} -c ${config.system.build.toplevel} -d ./files/boot
+    '';
+  };
+}
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 2a6d0d1088ba3..2c318174c1bad 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -3,7 +3,7 @@
 , unbound, dns-root-data, gettext, util-linux
 , cxxBindings ? !stdenv.hostPlatform.isStatic # tries to link libstdc++.so
 , tpmSupport ? false, trousers, which, nettools, libunistring
-, withP11-kit ? !stdenv.hostPlatform.isStatic, p11-kit
+, withP11-kit ? !stdenv.hostPlatform.isStatic && !p11-kit.meta.broken, p11-kit
 , Security  # darwin Security.framework
 # certificate compression - only zlib now, more possible: zstd, brotli
 
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 1d089774cc67a..909627f5e851b 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -84,5 +84,8 @@ stdenv.mkDerivation rec {
     ];
     platforms = platforms.all;
     license = licenses.bsd3;
+
+    # configure: error: cannot run test program while cross compiling
+    broken = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 61013ef090af0..836afc99f580f 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -335,6 +335,11 @@ let
 
         # Remove reference to kmod
         sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
+      ''
+      # The `make install` part of the kernel build process is
+      # highly architecture-specific.
+      + lib.optionalString (stdenv.isMips && (kernelConf.target == "vmlinux" || kernelConf.target == "vmlinuz")) ''
+        mv $out/${kernelConf.target}-${version} $out/${kernelConf.target}
       '';
 
       requiredSystemFeatures = [ "big-parallel" ];
diff --git a/pkgs/os-specific/linux/libnvme/default.nix b/pkgs/os-specific/linux/libnvme/default.nix
index 4ed838051f6ff..b2af0c8eed491 100644
--- a/pkgs/os-specific/linux/libnvme/default.nix
+++ b/pkgs/os-specific/linux/libnvme/default.nix
@@ -11,13 +11,14 @@
 , stdenv
 , swig
 , systemd
+, withDocs ? stdenv.hostPlatform.canExecute stdenv.buildPlatform
 }:
 
 stdenv.mkDerivation rec {
   pname = "libnvme";
   version = "1.4";
 
-  outputs = [ "out" "man" ];
+  outputs = [ "out" ] ++ lib.optionals withDocs [ "man" ];
 
   src = fetchFromGitHub {
     owner = "linux-nvme";
@@ -49,7 +50,7 @@ stdenv.mkDerivation rec {
     python3
   ];
 
-  mesonFlags = [
+  mesonFlags = lib.optionals withDocs [
     "-Ddocs=man"
     "-Ddocs-build=true"
   ];
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index ed4204b9d11a7..1d66b84bd8441 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -67,6 +67,7 @@
 , bash
 , libmicrohttpd
 , libfido2
+, withP11kit ? !p11-kit.meta.broken
 , p11-kit
 
   # the (optional) BPF feature requires bpftool, libbpf, clang and llvm-strip to be available during build time.
@@ -322,7 +323,7 @@ stdenv.mkDerivation (finalAttrs: {
           { name = "libdw.so.1"; pkg = opt withCoredump elfutils; }
 
           # Support for PKCS#11 in systemd-cryptsetup, systemd-cryptenroll and systemd-homed
-          { name = "libp11-kit.so.0"; pkg = opt (withHomed || withCryptsetup) p11-kit; }
+          { name = "libp11-kit.so.0"; pkg = opt ((withHomed || withCryptsetup) && withP11kit) p11-kit; }
         ];
 
       patchDlOpen = dl:
@@ -430,7 +431,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withPCRE2 pcre2
     ++ lib.optional withSelinux libselinux
     ++ lib.optional withRemote libmicrohttpd
-    ++ lib.optionals (withHomed || withCryptsetup) [ p11-kit ]
+    ++ lib.optionals ((withHomed || withCryptsetup) && withP11kit) [ p11-kit ]
     ++ lib.optionals (withHomed || withCryptsetup) [ libfido2 ]
     ++ lib.optionals withLibBPF [ libbpf ]
     ++ lib.optional withTpm2Tss tpm2-tss