diff --git a/pkgs/applications/blockchains/btcpayserver/default.nix b/pkgs/applications/blockchains/btcpayserver/default.nix
index 6952d9c0072..7b6e3918da5 100644
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "btcpayserver";
-  version = "1.0.7.2";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1hxpbzc4l1zxrcvmdm93vvphhksfwd0mw2dv6h8vi4451p77dhd9";
+    sha256 = "sha256-cCm4CZdVtjO2nj69CgRCrcwO0lAbiQVD6KocOj4CSdY=";
   };
 
   nativeBuildInputs = [ dotnetSdk dotnetPackages.Nuget makeWrapper ];
diff --git a/pkgs/applications/blockchains/btcpayserver/deps.nix b/pkgs/applications/blockchains/btcpayserver/deps.nix
index b579fc8f7f8..20b97972107 100644
--- a/pkgs/applications/blockchains/btcpayserver/deps.nix
+++ b/pkgs/applications/blockchains/btcpayserver/deps.nix
@@ -94,6 +94,21 @@
     version = "0.6.3";
     sha256 = "1vb7ahafcd3lcbiiz552aisilwm1yq3j600gkf1wik8vhvsk02fs";
   })
+  (fetchNuGet {
+    name = "Fido2.AspNet";
+    version = "2.0.1";
+    sha256 = "1d6bjyck3mlhb9b4c75xhzr2pcs47vdqg2ayi5wnjh1aszyam3nq";
+  })
+  (fetchNuGet {
+    name = "Fido2.Models";
+    version = "2.0.1";
+    sha256 = "0llpzkik82n5gpgjawx181j85d2lizimkbdkxj1wyrjvxb2xbg3q";
+  })
+  (fetchNuGet {
+    name = "Fido2";
+    version = "2.0.1";
+    sha256 = "1s829n970lxngbhac9lvarwa9n9hqxr79kwv8i12amnmg6ir8ny5";
+  })
   (fetchNuGet {
     name = "Google.Api.Gax.Rest";
     version = "2.5.0";
@@ -149,6 +164,11 @@
     version = "5.0.372";
     sha256 = "1gllp58vdbql2ybwf05i2178x7p4g8zyyk64317d1pyss5217g7r";
   })
+  (fetchNuGet {
+    name = "libsodium";
+    version = "1.0.18";
+    sha256 = "15qzl5k31yaaapqlijr336lh4lzz1qqxlimgxy8fdyig8jdmgszn";
+  })
   (fetchNuGet {
     name = "McMaster.NETCore.Plugins.Mvc";
     version = "1.3.1";
@@ -359,6 +379,11 @@
     version = "3.1.4";
     sha256 = "11w63yp7fk9qwmnq3lmpf1h30mlbzfx4zpm89vrs0lprj86g0742";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Caching.Abstractions";
+    version = "2.2.0";
+    sha256 = "0hhxc5dp52faha1bdqw0k426zicsv6x1kfqi30m9agr0b2hixj52";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.Caching.Abstractions";
     version = "3.1.4";
@@ -389,6 +414,11 @@
     version = "3.1.4";
     sha256 = "0r33m68y1vgpmqams4sgciizl0w6y97qkp93m0hyn0nlkxqf72l6";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Configuration.Abstractions";
+    version = "3.1.5";
+    sha256 = "03jwqjrfyx11ax19bq84c28qzaiyj4whrx7vayy4hr7sv0p28h8k";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.Configuration.Binder";
     version = "2.0.0";
@@ -399,6 +429,11 @@
     version = "3.1.4";
     sha256 = "1bnf213zlrh0m3sbhsv601yx21l5xp254jiy2g4hm7zpm8vsz1hz";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Configuration.Binder";
+    version = "3.1.5";
+    sha256 = "0310pvrwbbqak7k4s32syryqxlkwli8w8bwlpnqmz42svh2302wv";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.Configuration.EnvironmentVariables";
     version = "2.1.0";
@@ -429,6 +464,11 @@
     version = "3.1.4";
     sha256 = "0npc18pjl86d06czb0fy6ln3prfpwfb16p6709xx2jrsl96dp9bp";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Configuration";
+    version = "3.1.5";
+    sha256 = "1i7zm8ghgxwp655anyfm910qm7rcpvrz48fxjyzw9w63hj4sv6bk";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.DependencyInjection.Abstractions";
     version = "2.0.0";
@@ -444,6 +484,11 @@
     version = "3.1.4";
     sha256 = "03ys96pqca93zwxvh0vprzms09i9y0lmq32w98m6klbizq01fc06";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.DependencyInjection.Abstractions";
+    version = "3.1.5";
+    sha256 = "1wkf8ajh4pj6g3wwd18g3hjc3lqqny8052rl373ddcardxrs2gvn";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.DependencyInjection";
     version = "2.0.0";
@@ -539,6 +584,11 @@
     version = "3.1.4";
     sha256 = "1rkl0yqmi5vfivn641866v2mdsgdy8amym546y6lzbab39g24b5n";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Logging.Abstractions";
+    version = "3.1.5";
+    sha256 = "0lr22hlf52csrna9ly2lbz3y1agfgdlg7rvsqjg7ik488dhkmhji";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.Logging.Filter";
     version = "1.1.2";
@@ -559,6 +609,11 @@
     version = "2.0.0";
     sha256 = "1isc3rjbzz60f7wbmgcwslx5d10hm5hisnk7v54vfi2bz7132gll";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Options.ConfigurationExtensions";
+    version = "3.1.5";
+    sha256 = "10w78fj2jpmghvprz6b046xcr68zzp6x550a7m1iivn0h7a3l7pi";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.Options";
     version = "2.0.0";
@@ -569,6 +624,11 @@
     version = "3.1.4";
     sha256 = "0jphncx82l7jm5xi49dfxhbh24wv86sy44022chd7bkizllsypp4";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Options";
+    version = "3.1.5";
+    sha256 = "0rhqyqa7vhlmz2g0250zhypaayvckx4dv89micdg521cpvr5arpr";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.PlatformAbstractions";
     version = "1.1.0";
@@ -589,11 +649,36 @@
     version = "2.1.0";
     sha256 = "1r9gzwdfmb8ysnc4nzmyz5cyar1lw0qmizsvrsh252nhlyg06nmb";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Primitives";
+    version = "2.2.0";
+    sha256 = "0znah6arbcqari49ymigg3wiy2hgdifz8zsq8vdc3ynnf45r7h0c";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.Primitives";
     version = "3.1.4";
     sha256 = "12xvysk024aghrcwzv4525vznnk8lqmknl2vqqxhq4k5hjxpsysp";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Primitives";
+    version = "3.1.5";
+    sha256 = "0n2pk1sy8ikd29282sx4ps9r1wnhzgg4nwmkka9ypjizd8lkkk2m";
+  })
+  (fetchNuGet {
+    name = "Microsoft.IdentityModel.JsonWebTokens";
+    version = "6.6.0";
+    sha256 = "06z5a1jpqpdd1pix85is7kkpn4v0l4an909skji2p8gm09p5sfyv";
+  })
+  (fetchNuGet {
+    name = "Microsoft.IdentityModel.Logging";
+    version = "6.6.0";
+    sha256 = "1mpkx544cbxws1a22zwxbp3lqqamcc3x915l23spsxqvgr02jjrq";
+  })
+  (fetchNuGet {
+    name = "Microsoft.IdentityModel.Tokens";
+    version = "6.6.0";
+    sha256 = "0h5vbsd5x9cf7nqyrwn7d7y1axhf1zz0jr9prvi4xpxawa3kajyj";
+  })
   (fetchNuGet {
     name = "Microsoft.NET.Test.Sdk";
     version = "16.6.1";
@@ -671,8 +756,8 @@
   })
   (fetchNuGet {
     name = "NBitcoin.Altcoins";
-    version = "2.0.28";
-    sha256 = "1zfirfmhgigp733km9rqkgz560h5wg88bpba499x49h5j650cnn4";
+    version = "2.0.31";
+    sha256 = "13gcfsxpfq8slmsvgzf6iv581x7n535zq0p9c88bqs5p88r6lygm";
   })
   (fetchNuGet {
     name = "NBitcoin";
@@ -694,6 +779,11 @@
     version = "5.0.73";
     sha256 = "0vqgcb0ws5fnkrdzqfkyh78041c6q4l22b93rr0006dd4bmqrmg1";
   })
+  (fetchNuGet {
+    name = "NBitcoin";
+    version = "5.0.77";
+    sha256 = "0ykz4ii6lh6gdlz6z264wnib5pfnmq9q617qqbg0f04mq654jygb";
+  })
   (fetchNuGet {
     name = "NBitpayClient";
     version = "1.0.0.39";
@@ -701,8 +791,8 @@
   })
   (fetchNuGet {
     name = "NBXplorer.Client";
-    version = "3.0.20";
-    sha256 = "1mwa6ncmg5r6q7yn6skm9dgqm631c7r7nadcg9mvbw81113h0xxy";
+    version = "3.0.21";
+    sha256 = "1asri2wsjq3ljf2p4r4x52ba9cirh8ccc5ysxpnv4cvladkdazbi";
   })
   (fetchNuGet {
     name = "NETStandard.Library";
@@ -784,6 +874,11 @@
     version = "4.1.3.1";
     sha256 = "0qk3hb8s521c2gy4k3m1i6fhpr133mnw9w85cwsy9j7ghxyca1nv";
   })
+  (fetchNuGet {
+    name = "NSec.Cryptography";
+    version = "20.2.0";
+    sha256 = "19slji51v8s8i4836nqqg7qb3i3p4ahqahz0fbb3gwpp67pn6izx";
+  })
   (fetchNuGet {
     name = "NuGet.Frameworks";
     version = "5.0.0";
@@ -794,6 +889,21 @@
     version = "1.5.12";
     sha256 = "0f4gs31z8dwfvd246nrv3m0qkxzav37hxynx2maykza017khynyf";
   })
+  (fetchNuGet {
+    name = "PeterO.Cbor";
+    version = "4.1.3";
+    sha256 = "0882i3bhhx2yag2m4lbdsgngjwaj9ff4v0ab9zb839i4r77aq1yn";
+  })
+  (fetchNuGet {
+    name = "PeterO.Numbers";
+    version = "1.6.0";
+    sha256 = "04kfdkfr600h69g67g6izbn57bxqjamvaadyw3p9gjsc0wrivi98";
+  })
+  (fetchNuGet {
+    name = "PeterO.URIUtility";
+    version = "1.0.0";
+    sha256 = "04ihfbk2lf0smznwfb62h57qknls5jyxirdz72g5wn9h1dcgkdac";
+  })
   (fetchNuGet {
     name = "Pomelo.EntityFrameworkCore.MySql";
     version = "3.1.1";
@@ -804,11 +914,6 @@
     version = "2.2.1";
     sha256 = "1w6s9wjbsyvq8cnqknkdzm9chnv0g5gcsrq5i94zp6br9vg7c627";
   })
-  (fetchNuGet {
-    name = "Portable.BouncyCastle";
-    version = "1.8.1.3";
-    sha256 = "1lv1ljaz8df835jgmp3ny1xgqqjf1s9f25baw7bf8d24qlf25i2g";
-  })
   (fetchNuGet {
     name = "QRCoder";
     version = "1.4.1";
@@ -1164,6 +1269,11 @@
     version = "4.3.0";
     sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki";
   })
+  (fetchNuGet {
+    name = "System.IdentityModel.Tokens.Jwt";
+    version = "6.6.0";
+    sha256 = "17i6a43g1fksq9xy77dgsz54klz71pz062pb58lqx8h06p1818h1";
+  })
   (fetchNuGet {
     name = "System.Interactive.Async";
     version = "3.1.1";
@@ -1239,11 +1349,21 @@
     version = "4.5.0";
     sha256 = "1layqpcx1q4l805fdnj2dfqp6ncx2z42ca06rgsr6ikq4jjgbv30";
   })
+  (fetchNuGet {
+    name = "System.Memory";
+    version = "4.5.1";
+    sha256 = "0f07d7hny38lq9w69wx4lxkn4wszrqf9m9js6fh9is645csm167c";
+  })
   (fetchNuGet {
     name = "System.Memory";
     version = "4.5.3";
     sha256 = "0naqahm3wljxb5a911d37mwjqjdxv9l0b49p5dmfyijvni2ppy8a";
   })
+  (fetchNuGet {
+    name = "System.Memory";
+    version = "4.5.4";
+    sha256 = "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y";
+  })
   (fetchNuGet {
     name = "System.Net.Http";
     version = "4.3.0";
@@ -1409,6 +1529,11 @@
     version = "4.5.0";
     sha256 = "17labczwqk3jng3kkky73m0jhi8wc21vbl7cz5c0hj2p1dswin43";
   })
+  (fetchNuGet {
+    name = "System.Runtime.CompilerServices.Unsafe";
+    version = "4.5.1";
+    sha256 = "1xcrjx5fwg284qdnxyi2d0lzdm5q4frlpkp0nf6vvkx1kdz2prrf";
+  })
   (fetchNuGet {
     name = "System.Runtime.CompilerServices.Unsafe";
     version = "4.5.2";
@@ -1529,6 +1654,11 @@
     version = "4.3.0";
     sha256 = "1k468aswafdgf56ab6yrn7649kfqx2wm9aslywjam1hdmk5yypmv";
   })
+  (fetchNuGet {
+    name = "System.Security.Cryptography.Cng";
+    version = "4.7.0";
+    sha256 = "00797sqbba8lys486ifxblz9j52m29kidclvmqpk531820k55x9j";
+  })
   (fetchNuGet {
     name = "System.Security.Cryptography.Csp";
     version = "4.3.0";
@@ -1789,11 +1919,6 @@
     version = "2.12.1";
     sha256 = "0m41dxzc3hh0f4j1k4q915pvcq6zr0hv1pj6b3sayrn8vjhk64qb";
   })
-  (fetchNuGet {
-    name = "U2F.Core";
-    version = "1.0.4";
-    sha256 = "0mk32yyihigp9njs54z411fswgzr6x3kw134c7ylwy2d2wmq2n9b";
-  })
   (fetchNuGet {
     name = "WindowsAzure.Storage";
     version = "9.3.3";
diff --git a/pkgs/applications/blockchains/btcpayserver/update.sh b/pkgs/applications/blockchains/btcpayserver/update.sh
index 1f7dbedd020..9debe6780f2 100755
--- a/pkgs/applications/blockchains/btcpayserver/update.sh
+++ b/pkgs/applications/blockchains/btcpayserver/update.sh
@@ -2,5 +2,10 @@
 set -euo pipefail
 
 scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
+cd "$scriptDir"
 
-"$scriptDir"/../nbxplorer/util/update-common.sh btcpayserver "$scriptDir"/deps.nix
+echo "Updating nbxplorer"
+../nbxplorer/update.sh
+echo
+echo "Updating btcpayserver"
+../nbxplorer/util/update-common.sh btcpayserver deps.nix
diff --git a/pkgs/applications/blockchains/nbxplorer/default.nix b/pkgs/applications/blockchains/nbxplorer/default.nix
index ffa061edc72..7e279b22696 100644
--- a/pkgs/applications/blockchains/nbxplorer/default.nix
+++ b/pkgs/applications/blockchains/nbxplorer/default.nix
@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "nbxplorer";
-  version = "2.1.49";
+  version = "2.1.51";
 
   src = fetchFromGitHub {
     owner = "dgarage";
     repo = "NBXplorer";
     rev = "v${version}";
-    sha256 = "0xg5gbq6rbzgsbgwf94qcy2b0m5kdspi6hc5a64smaj9i7i0136l";
+    sha256 = "sha256-tvuuoDZCSDFa8gAVyH+EP1DLtdPfbkr+w5lSxZkzZXg=";
   };
 
   nativeBuildInputs = [ dotnetSdk dotnetPackages.Nuget makeWrapper ];
diff --git a/pkgs/applications/blockchains/nbxplorer/deps.nix b/pkgs/applications/blockchains/nbxplorer/deps.nix
index b0bf85f623f..de75ad228d3 100644
--- a/pkgs/applications/blockchains/nbxplorer/deps.nix
+++ b/pkgs/applications/blockchains/nbxplorer/deps.nix
@@ -181,18 +181,23 @@
   })
   (fetchNuGet {
     name = "NBitcoin.Altcoins";
-    version = "2.0.28";
-    sha256 = "1zfirfmhgigp733km9rqkgz560h5wg88bpba499x49h5j650cnn4";
+    version = "2.0.31";
+    sha256 = "13gcfsxpfq8slmsvgzf6iv581x7n535zq0p9c88bqs5p88r6lygm";
   })
   (fetchNuGet {
     name = "NBitcoin.TestFramework";
-    version = "2.0.21";
-    sha256 = "1k26fkss6d7x2yqlid31z5i04b5dmlbbbwijg9c8i3d996i1z7sq";
+    version = "2.0.22";
+    sha256 = "1zwhjy6xppl01jhkgl7lqjsmi8crny4qq22ml20cz8l437j1zi4n";
   })
   (fetchNuGet {
     name = "NBitcoin";
-    version = "5.0.73";
-    sha256 = "0vqgcb0ws5fnkrdzqfkyh78041c6q4l22b93rr0006dd4bmqrmg1";
+    version = "5.0.76";
+    sha256 = "0q3ilmsrw9ip1s38qmfs4qi02xvccmy1naafffn5yxj08q0n1p79";
+  })
+  (fetchNuGet {
+    name = "NBitcoin";
+    version = "5.0.77";
+    sha256 = "0ykz4ii6lh6gdlz6z264wnib5pfnmq9q617qqbg0f04mq654jygb";
   })
   (fetchNuGet {
     name = "NETStandard.Library";
diff --git a/pkgs/applications/blockchains/nbxplorer/util/create-deps.sh b/pkgs/applications/blockchains/nbxplorer/util/create-deps.sh
index 1402d1cd1eb..14b1687dfff 100755
--- a/pkgs/applications/blockchains/nbxplorer/util/create-deps.sh
+++ b/pkgs/applications/blockchains/nbxplorer/util/create-deps.sh
@@ -6,7 +6,7 @@ set -euo pipefail
 # Expects $pkgSrc to contain a single .sln file.
 
 pkgSrc=$1
-depsFile=$2
+depsFile=$(realpath "$2")
 
 sln=$(cd "$pkgSrc"; find * -maxdepth 0 -name '*.sln' | head -1)
 [[ $sln ]] || { echo "No .sln file in $pkgSrc" ; exit 1; }
diff --git a/pkgs/applications/blockchains/nbxplorer/util/update-common.sh b/pkgs/applications/blockchains/nbxplorer/util/update-common.sh
index c69168ccbbb..7a9262bf483 100755
--- a/pkgs/applications/blockchains/nbxplorer/util/update-common.sh
+++ b/pkgs/applications/blockchains/nbxplorer/util/update-common.sh
@@ -1,16 +1,16 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils curl jq common-updater-scripts dotnet-sdk_3
+#!nix-shell -i bash -p coreutils curl jq common-updater-scripts dotnet-sdk_3 git gnupg
 set -euo pipefail
 
 # This script uses the following env vars:
 # getVersionFromTags
-# onlyCreateDeps
+# refetch
 
 pkgName=$1
 depsFile=$2
 
 : ${getVersionFromTags:=}
-: ${onlyCreateDeps:=}
+: ${refetch:=}
 
 scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
 nixpkgs=$(realpath "$scriptDir"/../../../../..)
@@ -29,23 +29,46 @@ getLatestVersionTag() {
     | sort -V | tail -1 | sed 's|^v||'
 }
 
-if [[ ! $onlyCreateDeps ]]; then
-  oldVersion=$(evalNixpkgs "$pkgName.version")
-  if [[ $getVersionFromTags ]]; then
-    newVersion=$(getLatestVersionTag)
-  else
-    newVersion=$(curl -s "https://api.github.com/repos/$(getRepo)/releases" | jq -r '.[0].name')
-  fi
-
-  if [[ $newVersion == $oldVersion ]]; then
-    echo "nixpkgs already has the latest version $newVersion"
-    echo "Run this script with env var onlyCreateDeps=1 to recreate "$(basename "$depsFile")
-    exit 0
-  else
-    echo "Updating $pkgName: $oldVersion -> $newVersion"
-    (cd "$nixpkgs" && update-source-version "$pkgName" "$newVersion")
-  fi
+oldVersion=$(evalNixpkgs "$pkgName.version")
+if [[ $getVersionFromTags ]]; then
+  newVersion=$(getLatestVersionTag)
+else
+  newVersion=$(curl -s "https://api.github.com/repos/$(getRepo)/releases" | jq -r '.[0].name')
 fi
 
+if [[ $newVersion == $oldVersion && ! $refetch ]]; then
+  echo "nixpkgs already has the latest version $newVersion"
+  echo "Run this script with env var refetch=1 to re-verify the content hash via GPG"
+  echo "and to recreate $(basename "$depsFile"). This is useful for reviewing a version update."
+  exit 0
+fi
+
+# Fetch release and GPG-verify the content hash
+tmpdir=$(mktemp -d /tmp/$pkgName-verify-gpg.XXX)
+repo=$tmpdir/repo
+trap "rm -rf $tmpdir" EXIT
+git clone --depth 1 --branch v${newVersion} -c advice.detachedHead=false https://github.com/$(getRepo) $repo
+export GNUPGHOME=$tmpdir
+# Fetch Nicolas Dorier's key (64-bit key ID: 6618763EF09186FE)
+gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys AB4CFA9895ACA0DBE27F6B346618763EF09186FE 2> /dev/null
+echo
+echo "Verifying commit"
+git -C $repo verify-commit HEAD
+rm -rf $repo/.git
+newHash=$(nix hash-path $repo)
+rm -rf $tmpdir
+echo
+
+# Update pkg version and hash
+echo "Updating $pkgName: $oldVersion -> $newVersion"
+if [[ $newVersion == $oldVersion ]]; then
+  # Temporarily set a source version that doesn't equal $newVersion so that $newHash
+  # is always updated in the next call to update-source-version.
+  (cd "$nixpkgs" && update-source-version "$pkgName" "0" "0000000000000000000000000000000000000000000000000000")
+fi
+(cd "$nixpkgs" && update-source-version "$pkgName" "$newVersion" "$newHash")
+echo
+
+# Create deps file
 storeSrc="$(nix-build "$nixpkgs" -A $pkgName.src --no-out-link)"
 . "$scriptDir"/create-deps.sh "$storeSrc" "$depsFile"