diff --git a/flake.lock b/flake.lock
index 1f7bb189..dad55a08 100644
--- a/flake.lock
+++ b/flake.lock
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771505064,
-        "narHash": "sha256-lh9rF+C/nKFyWAqbHIa6tK9L/6N0UaQg7zw15aP4jBM=",
+        "lastModified": 1770654520,
+        "narHash": "sha256-mg5WZMIPGsFu9MxSrUcuJUPMbfMsF77el5yb/7rc10k=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a0a01d8811fd5e99e003078ed64a0e7b531545dd",
+        "rev": "6c4fdbe1ad198fac36c320fd45c5957324a80b8e",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771369470,
-        "narHash": "sha256-0NBlEBKkN3lufyvFegY4TYv5mCNHbi5OmBDrzihbBMQ=",
+        "lastModified": 1770562336,
+        "narHash": "sha256-ub1gpAONMFsT/GU2hV6ZWJjur8rJ6kKxdm9IlCT0j84=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0182a361324364ae3f436a63005877674cf45efb",
+        "rev": "d6c71932130818840fc8fe9509cf50be8c64634f",
         "type": "github"
       },
       "original": {
@@ -199,11 +199,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771506707,
-        "narHash": "sha256-R9oBi0EPsWN4bHfYgcyiSzx31/Fkgg3IHubf30II7Ow=",
+        "lastModified": 1770732881,
+        "narHash": "sha256-yGkibRit67Pz1uo1Kk55kZBHQq90K3gc0N762JGW/uQ=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "30ad144e51a0ae8b47aa84c1139e84fc278d6e86",
+        "rev": "06490c1287ab62a8c5075c440fd3e247913bc29c",
         "type": "github"
       },
       "original": {
diff --git a/flake/checks.nix b/flake/checks.nix
index 73e64d52..01d3c7a5 100644
--- a/flake/checks.nix
+++ b/flake/checks.nix
@@ -15,6 +15,10 @@
             enable = true;
           };
 
+          nixf-diagnose = {
+            enable = true;
+          };
+
           nixpkgs-fmt = {
             enable = true;
           };
diff --git a/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age b/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age
index b8cbe6aa..94fdf975 100644
Binary files a/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age and b/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age differ
diff --git a/modules/home/calibre/default.nix b/modules/home/calibre/default.nix
index de7c1263..fcd62f86 100644
--- a/modules/home/calibre/default.nix
+++ b/modules/home/calibre/default.nix
@@ -10,7 +10,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    home.packages = with pkgs; [
+    home.packages = [
       cfg.package
     ];
   };
diff --git a/modules/home/gdb/default.nix b/modules/home/gdb/default.nix
index 1ffc6bd9..b7c3aca5 100644
--- a/modules/home/gdb/default.nix
+++ b/modules/home/gdb/default.nix
@@ -17,7 +17,7 @@ in
 
   config = lib.mkIf cfg.enable (lib.mkMerge [
     {
-      home.packages = with pkgs; [
+      home.packages = [
         cfg.package
       ];
 
diff --git a/modules/home/mail/accounts/default.nix b/modules/home/mail/accounts/default.nix
index 5216ad5e..ca5e6ea6 100644
--- a/modules/home/mail/accounts/default.nix
+++ b/modules/home/mail/accounts/default.nix
@@ -11,7 +11,7 @@ let
       lib.mkDefault [ (lib.getExe pkgs.ambroisie.rbw-pass) "Mail" passName ];
 
     address = mkMailAddress address domain;
-    aliases = builtins.map (lib.flip mkMailAddress domain) aliases;
+    aliases = map (lib.flip mkMailAddress domain) aliases;
 
     inherit primary;
 
diff --git a/modules/home/trgui/default.nix b/modules/home/trgui/default.nix
index ee545a98..63df3550 100644
--- a/modules/home/trgui/default.nix
+++ b/modules/home/trgui/default.nix
@@ -10,7 +10,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    home.packages = with pkgs; [
+    home.packages = [
       cfg.package
     ];
   };
diff --git a/modules/home/wm/i3bar/default.nix b/modules/home/wm/i3bar/default.nix
index 5ae0e7d7..28c19355 100644
--- a/modules/home/wm/i3bar/default.nix
+++ b/modules/home/wm/i3bar/default.nix
@@ -69,7 +69,7 @@ in
                     inactive_state = "Idle";
                   };
                 in
-                builtins.map (block: defaults // block) cfg.vpn.blockConfigs
+                map (block: defaults // block) cfg.vpn.blockConfigs
               )
             )
             {
diff --git a/modules/nixos/programs/steam/default.nix b/modules/nixos/programs/steam/default.nix
index 0c7f9dad..c859bdb2 100644
--- a/modules/nixos/programs/steam/default.nix
+++ b/modules/nixos/programs/steam/default.nix
@@ -23,7 +23,7 @@ in
       enable = true;
     };
 
-    environment.systemPackages = builtins.map lib.hiPrio [
+    environment.systemPackages = map lib.hiPrio [
       # Respect XDG conventions, leave my HOME alone
       (pkgs.writeShellScriptBin "steam" ''
         mkdir -p "${cfg.dataDir}"
diff --git a/modules/nixos/services/backup/default.nix b/modules/nixos/services/backup/default.nix
index 8aeeae19..79884063 100644
--- a/modules/nixos/services/backup/default.nix
+++ b/modules/nixos/services/backup/default.nix
@@ -96,7 +96,7 @@ in
       # Contains the UID/GID map, and other useful state
       "/var/lib/nixos"
       # SSH host keys (and public keys for convenience)
-      (builtins.map (key: [ key.path "${key.path}.pub" ]) config.services.openssh.hostKeys)
+      (map (key: [ key.path "${key.path}.pub" ]) config.services.openssh.hostKeys)
     ];
 
     services.restic.backups.backblaze = {
diff --git a/modules/nixos/services/nginx/default.nix b/modules/nixos/services/nginx/default.nix
index ff530b0a..153a299f 100644
--- a/modules/nixos/services/nginx/default.nix
+++ b/modules/nixos/services/nginx/default.nix
@@ -188,14 +188,14 @@ in
       ++ (lib.flip lib.mapAttrsToList cfg.virtualHosts (_: { subdomain, ... } @ args:
       let
         conflicts = [ "port" "root" "socket" "redirect" ];
-        optionsNotNull = builtins.map (v: args.${v} != null) conflicts;
+        optionsNotNull = map (v: args.${v} != null) conflicts;
         optionsSet = lib.filter lib.id optionsNotNull;
       in
       {
         assertion = builtins.length optionsSet == 1;
         message = ''
           Subdomain '${subdomain}' must have exactly one of ${
-            lib.concatStringsSep ", " (builtins.map (v: "'${v}'") conflicts)
+            lib.concatStringsSep ", " (map (v: "'${v}'") conflicts)
           } configured.
         '';
       }))
@@ -208,7 +208,7 @@ in
         assertion = args.websocketsLocations != [ ] -> proxyPassUsed;
         message = ''
           Subdomain '${subdomain}' can only use 'websocketsLocations' with one of ${
-            lib.concatStringsSep ", " (builtins.map (v: "'${v}'") proxyPass)
+            lib.concatStringsSep ", " (map (v: "'${v}'") proxyPass)
           }.
         '';
       }))
diff --git a/modules/nixos/services/sabnzbd/default.nix b/modules/nixos/services/sabnzbd/default.nix
index 37ba96cf..9e0d9c3c 100644
--- a/modules/nixos/services/sabnzbd/default.nix
+++ b/modules/nixos/services/sabnzbd/default.nix
@@ -2,35 +2,17 @@
 { config, lib, ... }:
 let
   cfg = config.my.services.sabnzbd;
+  port = 9090; # NOTE: not declaratively set...
 in
 {
   options.my.services.sabnzbd = with lib; {
     enable = mkEnableOption "SABnzbd binary news reader";
-
-    port = mkOption {
-      type = types.port;
-      default = 9090;
-      example = 4242;
-      description = "The port on which SABnzbd will listen for incoming HTTP traffic";
-    };
   };
 
   config = lib.mkIf cfg.enable {
     services.sabnzbd = {
       enable = true;
       group = "media";
-
-      # Don't warn about the config file
-      configFile = null;
-      # I want to configure servers outside of Nix
-      allowConfigWrite = true;
-
-      settings = {
-        misc = {
-          host = "127.0.0.1";
-          inherit (cfg) port;
-        };
-      };
     };
 
     # Set-up media group
@@ -38,7 +20,7 @@ in
 
     my.services.nginx.virtualHosts = {
       sabnzbd = {
-        inherit (cfg) port;
+        inherit port;
       };
     };
 
diff --git a/modules/nixos/services/servarr/bazarr.nix b/modules/nixos/services/servarr/bazarr.nix
index 637da0c7..67d34169 100644
--- a/modules/nixos/services/servarr/bazarr.nix
+++ b/modules/nixos/services/servarr/bazarr.nix
@@ -4,7 +4,7 @@ let
 in
 {
   options.my.services.servarr.bazarr = with lib; {
-    enable = lib.mkEnableOption "Bazarr" // {
+    enable = mkEnableOption "Bazarr" // {
       default = config.my.services.servarr.enableAll;
     };
 
diff --git a/modules/nixos/services/servarr/jackett.nix b/modules/nixos/services/servarr/jackett.nix
index 481cd3de..8e8a5c3e 100644
--- a/modules/nixos/services/servarr/jackett.nix
+++ b/modules/nixos/services/servarr/jackett.nix
@@ -4,7 +4,7 @@ let
 in
 {
   options.my.services.servarr.jackett = with lib; {
-    enable = lib.mkEnableOption "Jackett" // {
+    enable = mkEnableOption "Jackett" // {
       default = config.my.services.servarr.enableAll;
     };
 
diff --git a/modules/nixos/services/servarr/nzbhydra.nix b/modules/nixos/services/servarr/nzbhydra.nix
index 7b639869..f2f82ac2 100644
--- a/modules/nixos/services/servarr/nzbhydra.nix
+++ b/modules/nixos/services/servarr/nzbhydra.nix
@@ -4,7 +4,7 @@ let
 in
 {
   options.my.services.servarr.nzbhydra = with lib; {
-    enable = lib.mkEnableOption "NZBHydra2" // {
+    enable = mkEnableOption "NZBHydra2" // {
       default = config.my.services.servarr.enableAll;
     };
   };
diff --git a/modules/nixos/services/servarr/prowlarr.nix b/modules/nixos/services/servarr/prowlarr.nix
index ce044c63..6825843c 100644
--- a/modules/nixos/services/servarr/prowlarr.nix
+++ b/modules/nixos/services/servarr/prowlarr.nix
@@ -5,7 +5,7 @@ let
 in
 {
   options.my.services.servarr.prowlarr = with lib; {
-    enable = lib.mkEnableOption "Prowlarr" // {
+    enable = mkEnableOption "Prowlarr" // {
       default = config.my.services.servarr.enableAll;
     };
 
diff --git a/modules/nixos/services/servarr/starr.nix b/modules/nixos/services/servarr/starr.nix
index 2bf7c114..0ccdaa42 100644
--- a/modules/nixos/services/servarr/starr.nix
+++ b/modules/nixos/services/servarr/starr.nix
@@ -12,7 +12,7 @@ let
 in
 {
   options.my.services.servarr.${starr} = with lib; {
-    enable = lib.mkEnableOption (lib.toSentenceCase starr) // {
+    enable = mkEnableOption (lib.toSentenceCase starr) // {
       default = config.my.services.servarr.enableAll;
     };
 
diff --git a/overlays/default.nix b/overlays/default.nix
index 683e021b..d3e30aa8 100644
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -1,6 +1,6 @@
 # Automatically import all overlays in the directory
 let
   files = builtins.readDir ./.;
-  overlays = builtins.removeAttrs files [ "default.nix" ];
+  overlays = removeAttrs files [ "default.nix" ];
 in
 builtins.mapAttrs (name: _: import "${./.}/${name}") overlays
diff --git a/overlays/downgrade-transmission/default.nix b/overlays/downgrade-transmission/default.nix
index 9fc6d140..9d3fc8ae 100644
--- a/overlays/downgrade-transmission/default.nix
+++ b/overlays/downgrade-transmission/default.nix
@@ -1,7 +1,14 @@
-self: _prev:
+self: prev:
 {
-  transmission_4 = self.callPackage ./transmission_4.nix {
-    fmt = self.fmt_9;
-    libutp = self.libutp_3_4;
-  };
+  transmission_4 = prev.transmission_4.overrideAttrs (_: {
+    version = "4.0.5";
+
+    src = self.fetchFromGitHub {
+      owner = "transmission";
+      repo = "transmission";
+      rev = "4.0.5";
+      hash = "sha256-gd1LGAhMuSyC/19wxkoE2mqVozjGPfupIPGojKY0Hn4=";
+      fetchSubmodules = true;
+    };
+  });
 }
diff --git a/overlays/downgrade-transmission/transmission_4.nix b/overlays/downgrade-transmission/transmission_4.nix
deleted file mode 100644
index a49f6b9b..00000000
--- a/overlays/downgrade-transmission/transmission_4.nix
+++ /dev/null
@@ -1,232 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, fetchpatch2
-, cmake
-, pkg-config
-, python3
-, openssl
-, curl
-, libevent
-, inotify-tools
-, systemd
-, zlib
-, pcre
-, libb64
-, libutp
-, libdeflate
-, utf8cpp
-, fast-float
-, fmt
-, libpsl
-, miniupnpc
-, dht
-, libnatpmp
-, # Build options
-  enableGTK3 ? false
-, gtkmm3
-, libpthread-stubs
-, wrapGAppsHook3
-, enableQt5 ? false
-, enableQt6 ? false
-, qt5
-, qt6Packages
-, nixosTests
-, enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
-, enableDaemon ? true
-, enableCli ? true
-, installLib ? false
-, apparmorRulesFromClosure
-}:
-
-let
-  inherit (lib) cmakeBool optionals;
-
-  apparmorRules = apparmorRulesFromClosure { name = "transmission-daemon"; } (
-    [
-      curl
-      libdeflate
-      libevent
-      libnatpmp
-      libpsl
-      miniupnpc
-      openssl
-      pcre
-      zlib
-    ]
-    ++ optionals enableSystemd [ systemd ]
-    ++ optionals stdenv.hostPlatform.isLinux [ inotify-tools ]
-  );
-
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "transmission";
-  version = "4.0.5";
-
-  src = fetchFromGitHub {
-    owner = "transmission";
-    repo = "transmission";
-    rev = finalAttrs.version;
-    hash = "sha256-gd1LGAhMuSyC/19wxkoE2mqVozjGPfupIPGojKY0Hn4=";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    (fetchpatch2 {
-      url = "https://github.com/transmission/transmission/commit/febfe49ca3ecab1a7142ecb34012c1f0b2bcdee8.patch?full_index=1";
-      hash = "sha256-Ge0+AXf/ilfMieGBAdvvImY7JOb0gGIdeKprC37AROs=";
-      excludes = [
-        # The submodule that we don't use (we use our miniupnp)
-        "third-party/miniupnp"
-        # Hunk fails for this one, but we don't care because we don't rely upon
-        # xcode definitions even for the Darwin build.
-        "Transmission.xcodeproj/project.pbxproj"
-      ];
-    })
-  ];
-
-  outputs = [
-    "out"
-    "apparmor"
-  ];
-
-  cmakeFlags = [
-    (cmakeBool "ENABLE_CLI" enableCli)
-    (cmakeBool "ENABLE_DAEMON" enableDaemon)
-    (cmakeBool "ENABLE_GTK" enableGTK3)
-    (cmakeBool "ENABLE_MAC" false) # requires xcodebuild
-    (cmakeBool "ENABLE_QT" (enableQt5 || enableQt6))
-    (cmakeBool "INSTALL_LIB" installLib)
-  ]
-  ++ optionals stdenv.hostPlatform.isDarwin [
-    # Transmission sets this to 10.13 if not explicitly specified, see https://github.com/transmission/transmission/blob/0be7091eb12f4eb55f6690f313ef70a66795ee72/CMakeLists.txt#L7-L16.
-    "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.hostPlatform.darwinMinVersion}"
-  ];
-
-  postPatch = ''
-    # Clean third-party libraries to ensure system ones are used.
-    # Excluding gtest since it is hardcoded to vendored version. The rest of the listed libraries are not packaged.
-    pushd third-party
-    for f in *; do
-        if [[ ! $f =~ googletest|wildmat|wide-integer|jsonsl ]]; then
-            rm -r "$f"
-        fi
-    done
-    popd
-    rm \
-      cmake/FindFastFloat.cmake \
-      cmake/FindFmt.cmake \
-      cmake/FindUtfCpp.cmake
-    # Upstream uses different config file name.
-    substituteInPlace CMakeLists.txt --replace 'find_package(UtfCpp)' 'find_package(utf8cpp)'
-
-    # Use gettext even on Darwin
-    substituteInPlace libtransmission/utils.h \
-      --replace-fail '#if defined(HAVE_GETTEXT) && !defined(__APPLE__)' '#if defined(HAVE_GETTEXT)'
-  '';
-
-  nativeBuildInputs = [
-    pkg-config
-    cmake
-    python3
-  ]
-  ++ optionals enableGTK3 [ wrapGAppsHook3 ]
-  ++ optionals enableQt5 [ qt5.wrapQtAppsHook ]
-  ++ optionals enableQt6 [ qt6Packages.wrapQtAppsHook ];
-
-  buildInputs = [
-    curl
-    dht
-    fast-float
-    fmt
-    libb64
-    libdeflate
-    libevent
-    libnatpmp
-    libpsl
-    libutp
-    miniupnpc
-    openssl
-    pcre
-    utf8cpp
-    zlib
-  ]
-  ++ optionals enableQt5 (
-    with qt5;
-    [
-      qttools
-      qtbase
-    ]
-  )
-  ++ optionals enableQt6 (
-    with qt6Packages;
-    [
-      qttools
-      qtbase
-      qtsvg
-    ]
-  )
-  ++ optionals enableGTK3 [
-    gtkmm3
-    libpthread-stubs
-  ]
-  ++ optionals enableSystemd [ systemd ]
-  ++ optionals stdenv.hostPlatform.isLinux [ inotify-tools ];
-
-  postInstall = ''
-    mkdir $apparmor
-    cat >$apparmor/bin.transmission-daemon <<EOF
-    abi <abi/4.0>,
-    include <tunables/global>
-    profile $out/bin/transmission-daemon {
-      include <abstractions/base>
-      include <abstractions/nameservice>
-      include <abstractions/ssl_certs>
-      include "${apparmorRules}"
-      @{PROC}/sys/kernel/random/uuid r,
-      @{PROC}/sys/vm/overcommit_memory r,
-      @{PROC}/@{pid}/environ r,
-      @{PROC}/@{pid}/mounts r,
-      /tmp/tr_session_id_* rwk,
-
-      $out/share/transmission/public_html/** r,
-
-      include if exists <local/bin.transmission-daemon>
-    }
-    EOF
-    install -Dm0444 -t $out/share/icons ../qt/icons/transmission.svg
-  '';
-
-  passthru.tests = {
-    apparmor = nixosTests.transmission_4; # starts the service with apparmor enabled
-    smoke-test = nixosTests.bittorrent;
-  };
-
-  meta = {
-    description = "Fast, easy and free BitTorrent client";
-    mainProgram =
-      if (enableQt5 || enableQt6) then
-        "transmission-qt"
-      else if enableGTK3 then
-        "transmission-gtk"
-      else
-        "transmission-cli";
-    longDescription = ''
-      Transmission is a BitTorrent client which features a simple interface
-      on top of a cross-platform back-end.
-      Feature spotlight:
-        * Uses fewer resources than other clients
-        * Native Mac, GTK and Qt GUI clients
-        * Daemon ideal for servers, embedded systems, and headless use
-        * All these can be remote controlled by Web and Terminal clients
-        * Bluetack (PeerGuardian) blocklists with automatic updates
-        * Full encryption, DHT, and PEX support
-    '';
-    homepage = "https://www.transmissionbt.com/";
-    license = with lib.licenses; [
-      gpl2Plus
-      mit
-    ];
-    platforms = lib.platforms.unix;
-  };
-})
diff --git a/pkgs/i3-get-window-criteria/default.nix b/pkgs/i3-get-window-criteria/default.nix
index cba51944..2fc840dc 100644
--- a/pkgs/i3-get-window-criteria/default.nix
+++ b/pkgs/i3-get-window-criteria/default.nix
@@ -1,4 +1,4 @@
-{ lib, coreutils, gnused, makeWrapper, stdenvNoCC, xprop, xwininfo }:
+{ lib, coreutils, gnused, makeWrapper, stdenvNoCC, xorg }:
 stdenvNoCC.mkDerivation rec {
   pname = "i3-get-window-criteria";
   version = "0.1.0";
@@ -22,8 +22,8 @@ stdenvNoCC.mkDerivation rec {
   wrapperPath = lib.makeBinPath [
     coreutils
     gnused
-    xprop
-    xwininfo
+    xorg.xprop
+    xorg.xwininfo
   ];
 
   fixupPhase = ''
diff --git a/templates/c++-cmake/flake.nix b/templates/c++-cmake/flake.nix
index 7796f5e5..eb2767d6 100644
--- a/templates/c++-cmake/flake.nix
+++ b/templates/c++-cmake/flake.nix
@@ -95,7 +95,7 @@
               self.packages.${system}.project
             ];
 
-            packages = with pkgs; [
+            packages = [
               self.checks.${system}.pre-commit.enabledPackages
             ];
 
diff --git a/templates/c++-meson/flake.nix b/templates/c++-meson/flake.nix
index cb14eb56..44189179 100644
--- a/templates/c++-meson/flake.nix
+++ b/templates/c++-meson/flake.nix
@@ -95,7 +95,7 @@
               self.packages.${system}.project
             ];
 
-            packages = with pkgs; [
+            packages = [
               self.checks.${system}.pre-commit.enabledPackages
             ];