diff --git a/default.nix b/default.nix
index 7a2cb9a30..948e102aa 100644
--- a/default.nix
+++ b/default.nix
@@ -176,11 +176,42 @@ rec {
         runtimeInputs = with pkgs; [ nix-update ];
         text =
           let
+            skipped-packages = [
+              "atomic-browser" # -> atomic-server
+              "atomic-cli" # -> atomic-server
+              "firefox-meta-press" # -> meta-press
+              "inventaire" # -> inventaire-client
+              "kbin" # -> kbin-backend
+              "kbin-frontend" # -> kbin-backend
+              "pretalxFull" # -> pretalx
+              # FIX: needs custom update script
+              "marginalia-search"
+              "peertube-plugin-livechat"
+              # FIX: dream2nix
+              "corestore"
+              "liberaforms"
+              # FIX: package scope
+              "bigbluebutton"
+              "heads"
+              # FIX: don't update `sparql-queries` if there is no version change
+              "inventaire-client"
+              # fetcher not supported
+              "libervia-backend"
+              "libervia-desktop-kivy"
+              "libervia-media"
+              "libervia-templates"
+              "sat-tmp"
+              "urwid-satext"
+              # broken package
+              "libresoc-nmigen"
+              "libresoc-verilog"
+            ];
+            update-packages = with lib; filter (x: !elem x skipped-packages) (attrNames ngipkgs);
             update-commands = lib.concatMapStringsSep "\n" (package: ''
               if ! nix-update --flake --use-update-script "${package}" "$@"; then
                 echo "${package}" >> "$TMPDIR/failed_updates.txt"
               fi
-            '') (lib.attrNames ngipkgs);
+            '') update-packages;
           in
           # bash
           ''
diff --git a/pkgs/by-name/inventaire-client/package.nix b/pkgs/by-name/inventaire-client/package.nix
index 562fb7ff7..193db17ad 100644
--- a/pkgs/by-name/inventaire-client/package.nix
+++ b/pkgs/by-name/inventaire-client/package.nix
@@ -49,7 +49,7 @@ let
     '';
   };
 in
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "inventaire-client";
   version = "4.0.1";
 
@@ -57,7 +57,7 @@ buildNpmPackage rec {
     domain = "codeberg.org";
     owner = "inventaire";
     repo = "inventaire-client";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-5v6JNqinlaiyDFidn6j7zaXdIoCaf8L6qHoa6qhC5Uk=";
   };
 
@@ -109,7 +109,9 @@ buildNpmPackage rec {
       --replace-fail './scripts/build_i18n' '${lib.getExe copyI18nDataScript}' \
       --replace-fail 'webpack --config ./bundle/webpack.config.prod.cjs --progress' 'webpack --config ./bundle/webpack.config.prod.cjs' \
       --replace-fail 'date -Ins' 'date -d "@$SOURCE_DATE_EPOCH" -Ins' \
-      --replace-fail '$(git rev-parse --short HEAD)' '"${if src.tag != null then src.tag else src.rev}"'
+      --replace-fail '$(git rev-parse --short HEAD)' '"${
+        with finalAttrs; if src.tag != null then src.tag else src.rev
+      }"'
   '';
 
   # "Your cache folder contains root-owned files" error from NPM
@@ -129,9 +131,7 @@ buildNpmPackage rec {
   '';
 
   passthru = rec {
-    updateSourceScript = gitUpdater {
-      rev-prefix = "v";
-    };
+    updateSourceScript = gitUpdater { rev-prefix = "v"; };
     updateQueriesScript = writeShellApplication {
       name = "inventaire-client-sparql-queries-update-script";
       runtimeInputs = [
@@ -145,9 +145,10 @@ buildNpmPackage rec {
       };
       text = lib.strings.readFile ./update-sparql-queries.sh;
     };
+    # FIX: don't update `sparql-queries` if there is no version change
     updateScript = _experimental-update-script-combinators.sequence [
       updateSourceScript.command
-      updateQueriesScript
+      (lib.getExe updateQueriesScript)
     ];
   };
 
@@ -155,7 +156,7 @@ buildNpmPackage rec {
     description = "A libre collaborative resources mapper powered by open-knowledge (client-side)";
     homepage = "https://inventaire.io";
     license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.all;
+    teams = with lib.teams; [ ngi ];
   };
-}
+})
diff --git a/pkgs/by-name/inventaire-i18n/package.nix b/pkgs/by-name/inventaire-i18n/package.nix
index 138399032..c966a4abc 100644
--- a/pkgs/by-name/inventaire-i18n/package.nix
+++ b/pkgs/by-name/inventaire-i18n/package.nix
@@ -2,23 +2,19 @@
   lib,
   buildNpmPackage,
   fetchFromGitea,
-  unstableGitUpdater,
-  writeShellApplication,
-  _experimental-update-script-combinators,
-  nix,
-  sd,
+  nix-update-script,
 }:
 
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "inventaire-i18n";
-  version = "0-unstable-2025-10-07";
+  version = "0-unstable-2025-10-20";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "inventaire";
     repo = "inventaire-i18n";
-    rev = "21121fab751ac85bd4d4f609b727685830560137";
-    hash = "sha256-YcVWayPIdaLFHmCnE5lECS15epIUNrDip/baPCwyvjE=";
+    rev = "ff65e4b40549955decdcc5c6913daa1672242901";
+    hash = "sha256-N9/zIul/rzd/vvTJmN1cXIXM9cgvDKlishmw0kH+z34=";
   };
 
   npmDepsHash = "sha256-hJ9L9X53n44Iz0lKX2NspMLtQbQA0nRgJvYZc5+xNuA=";
@@ -27,40 +23,13 @@ buildNpmPackage rec {
     patchShebangs scripts
   '';
 
-  passthru = {
-    updateScriptSrc = unstableGitUpdater { };
-    updateScriptNpmDeps = writeShellApplication {
-      name = "update-inventaire-i18n-npmDepsHash";
-      runtimeInputs = [
-        nix
-        sd
-      ];
-      text = ''
-        export UPDATE_NIX_ATTR_PATH="''${UPDATE_NIX_ATTR_PATH:-inventaire-i18n}"
-
-        oldhash="$(nix-instantiate . --eval --strict -A ngipkgs."$UPDATE_NIX_ATTR_PATH".npmDepsHash | cut -d'"' -f2)"
-        newhash="$(nix-build -A ngipkgs."$UPDATE_NIX_ATTR_PATH".npmDeps --no-out-link 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
-
-        if [ "$newhash" == "" ]; then
-          echo "No new npmDepsHash."
-          exit 0
-        fi
-
-        fname="$(nix-instantiate --eval -E "with import ./. {}; (builtins.unsafeGetAttrPos \"version\" ngipkgs.$UPDATE_NIX_ATTR_PATH).file" | cut -d'"' -f2)"
-        ${sd.meta.mainProgram} --string-mode "$oldhash" "$newhash" "$fname"
-      '';
-    };
-    updateScript = _experimental-update-script-combinators.sequence [
-      passthru.updateScriptSrc
-      (lib.getExe passthru.updateScriptNpmDeps)
-    ];
-  };
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
   meta = {
     description = "Repository hosting inventaire i18n strings and scripts";
     homepage = "https://codeberg.org/inventaire/inventaire-i18n";
     license = lib.licenses.agpl3Only;
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ ];
+    teams = with lib.teams; [ ngi ];
   };
-}
+})
diff --git a/pkgs/by-name/kazarma/package.nix b/pkgs/by-name/kazarma/package.nix
index b0df36086..bd240927a 100644
--- a/pkgs/by-name/kazarma/package.nix
+++ b/pkgs/by-name/kazarma/package.nix
@@ -1,13 +1,18 @@
 {
   lib,
-  beamPackages,
+  beam27Packages,
   buildNpmPackage,
   cacert,
   fetchFromGitHub,
   fetchFromGitLab,
   nodejs,
+  _experimental-update-script-combinators,
+  unstableGitUpdater,
+  nix-update-script,
 }:
 let
+  beamPackages = beam27Packages;
+
   # https://github.com/elixir-lang/elixir/issues/13976
   beamPackages' = beamPackages.extend (self: super: { elixir = self.elixir_1_17; });
 
@@ -77,6 +82,13 @@ beamPackages'.mixRelease {
     mix do deps.loadpaths --no-deps-check, phx.digest
   '';
 
+  # Can't update from GitLab with fetchSubmodules
+  # https://github.com/Mic92/nix-update/issues/281
+  passthru.updateScript = _experimental-update-script-combinators.sequence [
+    (unstableGitUpdater { tagPrefix = "v"; }) # update version + source
+    (nix-update-script { extraArgs = [ "--version=skip" ]; }) # update deps
+  ];
+
   meta = {
     description = "Matrix bridge to ActivityPub";
     homepage = "https://kazar.ma/";
@@ -84,9 +96,5 @@ beamPackages'.mixRelease {
     license = lib.licenses.agpl3Only;
     teams = [ lib.teams.ngi ];
     mainProgram = "kazarma";
-    # elixir 1.17 requires erlang >= 25 and <= 27
-    # even when that's true, cldr compilation still fails
-    # https://github.com/ngi-nix/ngipkgs/issues/1096
-    broken = true;
   };
 }
diff --git a/pkgs/by-name/proximity-matcher/package.nix b/pkgs/by-name/proximity-matcher/package.nix
index 5f3be3578..21ba068d2 100644
--- a/pkgs/by-name/proximity-matcher/package.nix
+++ b/pkgs/by-name/proximity-matcher/package.nix
@@ -2,6 +2,7 @@
   lib,
   fetchFromGitHub,
   python3Packages,
+  nix-update-script,
 }:
 
 let
@@ -74,6 +75,8 @@ python3Packages.buildPythonPackage {
     "proximity_matcher_webservice"
   ];
 
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
   meta = {
     description = "Webservice for proximity matching based on TLSH and vantage point trees";
     homepage = "https://github.com/armijnhemel/proximity_matcher_webservice";
diff --git a/pkgs/by-name/reoxide-plugin-simple/package.nix b/pkgs/by-name/reoxide-plugin-simple/package.nix
index 47068d990..51884739d 100644
--- a/pkgs/by-name/reoxide-plugin-simple/package.nix
+++ b/pkgs/by-name/reoxide-plugin-simple/package.nix
@@ -7,11 +7,13 @@
   clang,
   ninja,
   reoxide,
+
+  nix-update-script,
 }:
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "reoxide-plugin-simple";
-  version = "0-unstable-2025-09-12";
+  version = "0-unstable-2025-09-04";
 
   # use latest dev branch commit
   src = fetchFromGitea {
@@ -37,13 +39,11 @@ clangStdenv.mkDerivation (finalAttrs: {
   mesonBuildType = "release";
 
   preConfigure = ''
-
     mkdir -p .config/reoxide
     touch .config/reoxide/reoxide.toml
     export HOME=$PWD
 
     meson setup --buildtype=release build
-
   '';
 
   postInstall = ''
@@ -51,6 +51,8 @@ clangStdenv.mkDerivation (finalAttrs: {
     cp simple/libsimple.so $out/lib/
   '';
 
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
   meta = {
     description = "Simple plugin template for reoxide";
     homepage = "https://codeberg.org/ReOxide/reoxide";
diff --git a/pkgs/by-name/taldir/package.nix b/pkgs/by-name/taldir/package.nix
index 3b7c4a831..971d7bf7f 100644
--- a/pkgs/by-name/taldir/package.nix
+++ b/pkgs/by-name/taldir/package.nix
@@ -3,22 +3,21 @@
   fetchgit,
   recutils,
   buildGoModule,
-  gitUpdater,
-  writeShellApplication,
-  nix,
   _experimental-update-script-combinators,
+  unstableGitUpdater,
+  nix-update-script,
 }:
 buildGoModule (finalAttrs: {
   pname = "taldir";
-  version = "1.0.5";
+  version = "1.0.5-unstable-2025-10-15";
 
   src = fetchgit {
     url = "https://git.taler.net/taldir.git";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-ZKNkMV0IV6E+yCQeabGXpIQclx1S4YEgFn4whGXTaks=";
+    rev = "8fbc813afb14807dbc62c4c95402f282a8165f07";
+    hash = "sha256-2tIS98MTPGTEYym7L9ch+tWdDJBvKVQwpfAkxZiJaSc=";
   };
 
-  vendorHash = "sha256-QCwakJTpRP7VT69EzQeInCCGBuNu3WsNCytnQcBdKQw=";
+  vendorHash = "sha256-G8eujeYLSlQ95hNLspAlWSj7MSB/eyg4iD2pp3kSupQ=";
 
   nativeBuildInputs = [
     recutils
@@ -43,32 +42,12 @@ buildGoModule (finalAttrs: {
   # dial error (dial tcp [::1]:5432: connect: connection refused)
   doCheck = false;
 
-  passthru = {
-    updateScriptSrc = gitUpdater { rev-prefix = "v"; };
-    updateScriptVendor = writeShellApplication {
-      name = "update-taldir-vendorHash";
-      runtimeInputs = [ nix ];
-      text = ''
-        export UPDATE_NIX_ATTR_PATH="''${UPDATE_NIX_ATTR_PATH:-taldir}"
-
-        oldhash="$(nix-instantiate . --eval --strict -A "$UPDATE_NIX_ATTR_PATH.goModules.drvAttrs.outputHash" | cut -d'"' -f2)"
-        newhash="$(nix-build -A "$UPDATE_NIX_ATTR_PATH.goModules" --no-out-link 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
-
-        if [ "$newhash" == "" ]; then
-          echo "No new vendorHash."
-          exit 0
-        fi
-
-        fname="$(nix-instantiate --eval -E "with import ./. {}; (builtins.unsafeGetAttrPos \"version\" $UPDATE_NIX_ATTR_PATH).file" | cut -d'"' -f2)"
-
-        sed -i "s/$oldhash/$newhash/" "$fname"
-      '';
-    };
-    updateScript = _experimental-update-script-combinators.sequence [
-      finalAttrs.passthru.updateScriptSrc.command
-      (lib.getExe finalAttrs.passthru.updateScriptVendor)
-    ];
-  };
+  # Currently, `nix-update-script` can only get latest version from:
+  # codeberg/crates.io/gitea/github/gitlab/pypi/savannah/sourcehut/rubygems/npm
+  passthru.updateScript = _experimental-update-script-combinators.sequence [
+    (unstableGitUpdater { tagPrefix = "v"; }) # update version + source
+    (nix-update-script { extraArgs = [ "--version=skip" ]; }) # update deps
+  ];
 
   meta = {
     homepage = "https://git.taler.net/taldir.git";
diff --git a/pkgs/by-name/taler-mdb/package.nix b/pkgs/by-name/taler-mdb/package.nix
index 623e27d08..c81e8f750 100644
--- a/pkgs/by-name/taler-mdb/package.nix
+++ b/pkgs/by-name/taler-mdb/package.nix
@@ -14,31 +14,20 @@
   taler-exchange,
   taler-merchant,
   qrencode,
+  gitUpdater,
 }:
 
-let
-  docs = fetchgit {
-    url = "https://git.taler.net/taler-docs.git";
-    rev = "b97d82f99dc32b0fdb7942dbb501603a2c86f8b1";
-    hash = "sha256-qyp/iHHGxE0A2UCSY+muyzUd0upuJeQK1OIaacsmrjs=";
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "taler-mdb";
-  version = "0.14.1";
+  version = "1.0.0";
 
   src = fetchgit {
     url = "https://git.taler.net/taler-mdb.git";
     rev = "v${finalAttrs.version}";
-    # fatal: repository 'https://git.taler.net/docs.git/' not found
-    fetchSubmodules = false;
-    hash = "sha256-+raX3O2RNaMsN7Wi6F0P/lccpLOtL13EU4Fpe9lCueA=";
+    hash = "sha256-AAFnF8bN2Pnhy8OZbgA6CRHBIC6iP785HpVjPEVu+IQ=";
+    fetchSubmodules = true;
   };
 
-  postPatch = ''
-    cp -R ${docs}/* doc/prebuilt/
-  '';
-
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
@@ -59,6 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   doInstallCheck = true;
 
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
   meta = {
     homepage = "https://git.taler.net/taler-mdb.git";
     description = "Sales integration with the Multi-Drop-Bus of Snack machines, NFC readers and QR code display.";
diff --git a/pkgs/by-name/hkdf/package.nix b/pkgs/by-name/vula/hkdf.nix
similarity index 100%
rename from pkgs/by-name/hkdf/package.nix
rename to pkgs/by-name/vula/hkdf.nix
diff --git a/pkgs/by-name/vula/package.nix b/pkgs/by-name/vula/package.nix
index 45a1583e4..cf7ba3608 100644
--- a/pkgs/by-name/vula/package.nix
+++ b/pkgs/by-name/vula/package.nix
@@ -1,27 +1,33 @@
 {
-  gobject-introspection,
   lib,
+  callPackage,
+  fetchFromGitea,
+  gobject-introspection,
   libayatana-appindicator,
   python3,
-  fetchgit,
-  hkdf,
   wrapGAppsHook,
+  unstableGitUpdater,
 }:
 let
   inherit (lib)
     licenses
     maintainers
     ;
+
+  hkdf = callPackage ./hkdf.nix { };
+  rendez = callPackage ./rendez.nix { };
 in
 python3.pkgs.buildPythonApplication {
   pname = "vula";
-  version = "0.2-unstable-2024-05-17";
-  format = "setuptools";
+  version = "0.2.2024011000-unstable-2025-07-15";
+  pyproject = true;
 
-  src = fetchgit {
-    url = "https://codeberg.org/vula/vula";
-    rev = "b82933c2d45496afb91727e7ce3dff61ae262473";
-    hash = "sha256-DVjEg28GFmA3fOgXZ8MQ7rwfZtt6WkK1qHnyTnYbKcY=";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "vula";
+    repo = "vula";
+    rev = "59611c2c7d1ac69be71961ecccf52c61c6b3dd3e";
+    hash = "sha256-hYXkfgTlcQ7HIMiYRxkuWuVGjZxWNqRgbjfKFT6gnaw=";
   };
 
   # without removing `pyproject.toml` we don't end up with an executable.
@@ -31,7 +37,11 @@ python3.pkgs.buildPythonApplication {
       --replace "IMAGE_BASE_PATH = '/usr/share/icons/vula/'" "IMAGE_BASE_PATH = '$out/share/icons/vula/'"
   '';
 
-  propagatedBuildInputs =
+  build-system = with python3.pkgs; [
+    setuptools
+  ];
+
+  dependencies =
     (with python3.pkgs; [
       click
       cryptography
@@ -49,16 +59,23 @@ python3.pkgs.buildPythonApplication {
       setuptools
       tkinter
       zeroconf
+      typing-extensions
+      dbus-python
     ])
     ++ [
       hkdf
+      rendez
     ];
 
-  buildInputs = [ libayatana-appindicator ];
   nativeBuildInputs = [
     wrapGAppsHook
     gobject-introspection
   ];
+
+  buildInputs = [
+    libayatana-appindicator
+  ];
+
   nativeCheckInputs = with python3.pkgs; [ pytestCheckHook ];
 
   postInstall = ''
@@ -66,6 +83,8 @@ python3.pkgs.buildPythonApplication {
     ln -s $out/${python3.sitePackages}/usr/share/icons $out/share
   '';
 
+  passthru.updateScript = unstableGitUpdater { tagPrefix = "v"; };
+
   meta = {
     description = "Automatic local network encryption";
     homepage = "https://vula.link/";
diff --git a/pkgs/by-name/vula/pymonocypher.nix b/pkgs/by-name/vula/pymonocypher.nix
new file mode 100644
index 000000000..263aebb87
--- /dev/null
+++ b/pkgs/by-name/vula/pymonocypher.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "pymonocypher";
+  version = "4.0.2.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jetperch";
+    repo = "pymonocypher";
+    rev = "v${version}";
+    hash = "sha256-3vnF2MnrjI7pRiOTjPZ0D8tDojfdGJ2kSlLqF7Kkp5Y=";
+  };
+
+  build-system = with python3Packages; [
+    cython
+    setuptools
+    wheel
+  ];
+
+  pythonImportsCheck = [
+    "monocypher"
+  ];
+
+  meta = {
+    description = "Python ctypes bindings to the Monocypher library";
+    homepage = "https://pypi.org/project/pymonocypher/";
+    license = with lib.licenses; [
+      cc0
+      bsd2
+    ];
+    mainProgram = "pymonocypher";
+  };
+}
diff --git a/pkgs/by-name/vula/rendez.nix b/pkgs/by-name/vula/rendez.nix
new file mode 100644
index 000000000..3ccbaffa8
--- /dev/null
+++ b/pkgs/by-name/vula/rendez.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  python3,
+  fetchPypi,
+  callPackage,
+}:
+
+let
+  hkdf = callPackage ./hkdf.nix { };
+  pymonocypher = callPackage ./pymonocypher.nix { };
+in
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "rendez";
+  version = "1.2.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-V1hbhlBngIrHHozpR2B+NhTnljHumYvUS9Sz6ms20Eg=";
+  };
+
+  build-system = [
+    python3.pkgs.flit-core
+  ];
+
+  dependencies = with python3.pkgs; [
+    click
+    cryptography
+    flask
+    highctidh
+    hkdf
+    ifaddr
+    pymonocypher
+    pysocks
+    requests
+    stem
+    toml
+  ];
+
+  pythonImportsCheck = [
+    "rendez"
+  ];
+
+  meta = {
+    description = "From rendez.vous import reunion";
+    homepage = "https://pypi.org/project/rendez/";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "rendez";
+  };
+}
diff --git a/pkgs/by-name/wax-client/package.nix b/pkgs/by-name/wax-client/package.nix
index 00d1b6322..e34decd48 100644
--- a/pkgs/by-name/wax-client/package.nix
+++ b/pkgs/by-name/wax-client/package.nix
@@ -9,24 +9,25 @@
   nodejs,
   makeWrapper,
   nodePackages,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wax-client";
-  version = "0-unstable-2025-08-14";
+  version = "0-unstable-2025-10-07";
 
   src = fetchFromGitHub {
     owner = "Wax-Platform";
     repo = "Wax";
-    rev = "01316b557d201b09b4ce9745c7d7e841d94b8268";
-    hash = "sha256-afc15miIzzEBRrzvJaRzSK+IWe4/36+Lvo7IbmNM2CA=";
+    rev = "e87966c0b3c629e3ae03ba3423f8cb8c4ce8a6d7";
+    hash = "sha256-2gOv6S9TfzAZH5OloNtRo1jJFvfrrP8/i2zNX6hEq2U=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/client";
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/packages/client/yarn.lock";
-    hash = "sha256-ztT3uwlTM+Dz7dzvfExvUc4zLU/SHSYQaKsMUUCGPrA=";
+    hash = "sha256-yvl8VrAHqPuiDEWO4KB6NKRhRzxkZhD/SvQVGzrX2fU=";
   };
 
   nativeBuildInputs = [
@@ -73,6 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
       --prefix PATH : ${lib.makeBinPath [ nodePackages.serve ]} \
   '';
 
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
   meta = {
     homepage = "https://github.com/Wax-Platform/Wax";
     description = "Wax Platform web client for collaborative document editing";
diff --git a/pkgs/by-name/wax-server/package.nix b/pkgs/by-name/wax-server/package.nix
index a168c9aa7..e8eb573a3 100644
--- a/pkgs/by-name/wax-server/package.nix
+++ b/pkgs/by-name/wax-server/package.nix
@@ -16,17 +16,18 @@
   potrace,
   yarn,
   node-pre-gyp,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wax-server";
-  version = "0-unstable-2025-08-14";
+  version = "0-unstable-2025-10-07";
 
   src = fetchFromGitHub {
     owner = "Wax-Platform";
     repo = "Wax";
-    rev = "01316b557d201b09b4ce9745c7d7e841d94b8268";
-    hash = "sha256-afc15miIzzEBRrzvJaRzSK+IWe4/36+Lvo7IbmNM2CA=";
+    rev = "e87966c0b3c629e3ae03ba3423f8cb8c4ce8a6d7";
+    hash = "sha256-2gOv6S9TfzAZH5OloNtRo1jJFvfrrP8/i2zNX6hEq2U=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/server";
@@ -60,7 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
     # Building bcrypt with node-gyp requires node headers
     # See https://nixos.org/manual/nixpkgs/unstable/#javascript-yarn2nix-pitfalls
     export npm_config_nodedir=${nodejs}
-
   '';
 
   postInstall = ''
@@ -81,6 +81,8 @@ stdenv.mkDerivation (finalAttrs: {
       }
   '';
 
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
   meta = {
     homepage = "https://github.com/Wax-Platform/Wax";
     description = "Wax Platform web server for collaborative document editing";
diff --git a/pkgs/by-name/wireguard-rs/package.nix b/pkgs/by-name/wireguard-rs/package.nix
index bb3c487bf..7848c183c 100644
--- a/pkgs/by-name/wireguard-rs/package.nix
+++ b/pkgs/by-name/wireguard-rs/package.nix
@@ -2,6 +2,7 @@
   lib,
   rustPlatform,
   fetchgit,
+  unstableGitUpdater,
 }:
 let
   inherit (lib)
@@ -26,6 +27,8 @@ rustPlatform.buildRustPackage {
     cp ${./Cargo.lock} Cargo.lock
   '';
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = {
     homepage = "https://git.zx2c4.com/wireguard-rs";
     description = "Rust implementation of WireGuard";
diff --git a/projects/Kazarma/default.nix b/projects/Kazarma/default.nix
index 3c224fcb7..ed0943721 100644
--- a/projects/Kazarma/default.nix
+++ b/projects/Kazarma/default.nix
@@ -36,12 +36,6 @@
         module = ./services/kazarma/examples/basic.nix;
         description = null;
         tests.basic.module = import ./services/kazarma/tests/basic.nix args;
-        tests.basic.problem.broken.reason = ''
-          elixir 1.17 requires erlang >= 25 and <= 27
-          even when that's true, cldr compilation still fails
-
-          See: https://github.com/ngi-nix/ngipkgs/issues/1096
-        '';
       };
     };
   };
diff --git a/projects/Vula/default.nix b/projects/Vula/default.nix
index 46cb09eb9..5ea0cd68d 100644
--- a/projects/Vula/default.nix
+++ b/projects/Vula/default.nix
@@ -23,13 +23,7 @@
 
         Add users to the group defined in `config.services.vula.operatorsGroup` to grant them permissions to manage Vula through the `vula` command.
       '';
-      # FIX:
-      tests.test = {
-        module = import ./test.nix args;
-        problem.broken.reason = ''
-          https://buildbot.ngi.nixos.org/#/builders/193/builds/1789
-        '';
-      };
+      tests.basic.module = import ./test.nix args;
     };
   };
 }