diff --git a/pkgs/applications/networking/browsers/lynx/default.nix b/pkgs/applications/networking/browsers/lynx/default.nix
index 713f934f778..40feaebd72c 100644
--- a/pkgs/applications/networking/browsers/lynx/default.nix
+++ b/pkgs/applications/networking/browsers/lynx/default.nix
@@ -2,6 +2,7 @@
 , fetchurl, pkg-config, ncurses, gzip
 , sslSupport ? true, openssl ? null
 , nukeReferences
+, fetchpatch
 }:
 
 assert sslSupport -> openssl != null;
@@ -22,6 +23,14 @@ stdenv.mkDerivation rec {
 
   hardeningEnable = [ "pie" ];
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-38165.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/lynx/CVE-2021-38165.patch?id=3400945dbbb8a87065360963e4caa0e17d3dcc61";
+      sha256 = "1aykb9y2g2vdpbbpvjlm4r40x7py2yv6jbywwcqcxrlciqcw4x57";
+    })
+  ];
+
   configureFlags = [
     "--enable-default-colors"
     "--enable-widec"
diff --git a/pkgs/applications/networking/instant-messengers/psi-plus/default.nix b/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
index c180cdb4e01..60556bbc7a4 100644
--- a/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
+++ b/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
@@ -1,14 +1,45 @@
-{ lib, mkDerivation, fetchFromGitHub, cmake
-, qtbase, qtmultimedia, qtx11extras, qttools, qtwebengine
-, libidn, qca-qt5, libXScrnSaver, hunspell
-, libsecret, libgcrypt, libotr, html-tidy, libgpgerror, libsignal-protocol-c
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, qtbase
+, qtmultimedia
+, qtx11extras
+, qttools
+, libidn
+, qca-qt5
+, libXScrnSaver
+, hunspell
+, libsecret
+, libgcrypt
+, libotr
+, html-tidy
+, libgpgerror
+, libsignal-protocol-c
 , usrsctp
 
-# Voice messages
+, chatType ? "basic" # See the assertion below for available options
+, qtwebkit
+, qtwebengine
+
+, enablePlugins ? true
+
+  # Voice messages
 , voiceMessagesSupport ? true
 , gst_all_1
+
+, enablePsiMedia ? false
+, pkg-config
 }:
 
+assert builtins.elem (lib.toLower chatType) [
+  "basic" # Basic implementation, no web stuff involved
+  "webkit" # Legacy one, based on WebKit (see https://wiki.qt.io/Qt_WebKit)
+  "webengine" # QtWebEngine (see https://wiki.qt.io/QtWebEngine)
+];
+
+assert enablePsiMedia -> enablePlugins;
+
 mkDerivation rec {
   pname = "psi-plus";
   version = "1.5.1520";
@@ -21,19 +52,40 @@ mkDerivation rec {
   };
 
   cmakeFlags = [
-    "-DENABLE_PLUGINS=ON"
+    "-DCHAT_TYPE=${chatType}"
+    "-DENABLE_PLUGINS=${if enablePlugins then "ON" else "OFF"}"
+    "-DBUILD_PSIMEDIA=${if enablePsiMedia then "ON" else "OFF"}"
   ];
 
-  nativeBuildInputs = [ cmake qttools ];
+  nativeBuildInputs = [
+    cmake
+    qttools
+  ] ++ lib.optionals enablePsiMedia [
+    pkg-config
+  ];
 
   buildInputs = [
-    qtbase qtmultimedia qtx11extras qtwebengine
-    libidn qca-qt5 libXScrnSaver hunspell
-    libsecret libgcrypt libotr html-tidy libgpgerror libsignal-protocol-c
+    qtbase
+    qtmultimedia
+    qtx11extras
+    libidn
+    qca-qt5
+    libXScrnSaver
+    hunspell
+    libsecret
+    libgcrypt
+    libotr
+    html-tidy
+    libgpgerror
+    libsignal-protocol-c
     usrsctp
   ] ++ lib.optionals voiceMessagesSupport [
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
+  ] ++ lib.optionals (chatType == "webkit") [
+    qtwebkit
+  ] ++ lib.optionals (chatType == "webengine") [
+    qtwebengine
   ];
 
   preFixup = lib.optionalString voiceMessagesSupport ''
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index 70fc5126a93..769f60d7f73 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -46,11 +46,17 @@ installPhase() {
     fi
 
     # Install systemd power management executables
+    if [ -e systemd/nvidia-sleep.sh ]; then
+        mv systemd/nvidia-sleep.sh ./
+    fi
     if [ -e nvidia-sleep.sh ]; then
         sed -E 's#(PATH=).*#\1"$PATH"#' nvidia-sleep.sh > nvidia-sleep.sh.fixed
         install -Dm755 nvidia-sleep.sh.fixed $out/bin/nvidia-sleep.sh
     fi
 
+    if [ -e systemd/system-sleep/nvidia ]; then
+        mv systemd/system-sleep/nvidia ./
+    fi
     if [ -e nvidia ]; then
         sed -E "s#/usr(/bin/nvidia-sleep.sh)#$out\\1#" nvidia > nvidia.fixed
         install -Dm755 nvidia.fixed $out/lib/systemd/system-sleep/nvidia
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 8fc439aeb3c..059fef24d83 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -19,10 +19,10 @@ rec {
   # Policy: use the highest stable version as the default (on our master).
   stable = if stdenv.hostPlatform.system == "x86_64-linux"
     then generic {
-      version = "460.73.01";
-      sha256_64bit = "120ymf59l6nipczszf82lrm2p4ihhqyv2pfwwfg9wy96vqcckc8i";
-      settingsSha256 = "08jh7g34p9yxv5fh1cw0r2pjx65ryiv3w2lk1qg0gxn2r7xypkx0";
-      persistencedSha256 = "040gx4wqp3hxcfb4aba4sl7b01ixr5slhzw0xldwcqlmhpwqphi5";
+      version = "470.57.02";
+      sha256_64bit = "sha256-VdeuEEgn+qeel1Mh/itg+d1C+/9lZCBTRDwOVv20xH0=";
+      settingsSha256 = "sha256-DJg5QbyuKJmPpLQVYgTLvucI1e9YgQOO16690VXIWvk=";
+      persistencedSha256 = "sha256-Cqv6oUFnsSi3S1sjplJKeq9bI2pqgBXPPb11HOJSlDo=";
     }
     else legacy_390;
 
diff --git a/pkgs/tools/bluetooth/blueman/default.nix b/pkgs/tools/bluetooth/blueman/default.nix
index 0939584fa97..528f0999b2c 100644
--- a/pkgs/tools/bluetooth/blueman/default.nix
+++ b/pkgs/tools/bluetooth/blueman/default.nix
@@ -9,11 +9,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "blueman";
-  version = "2.2.1";
+  version = "2.2.2";
 
   src = fetchurl {
     url = "https://github.com/blueman-project/blueman/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0whs1bqnn1fgzrq7y2w1d06ldvfafq6h2xzmcfncbwmyb4i0mhgw";
+    sha256 = "sha256-Ge1ZsaE09YT8AF9HKV/vZAqXCf2bmyMHOI4RKjLs0PY=";
   };
 
   nativeBuildInputs = [