diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c3c7bf5e0971..6459c81087cb 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1151,6 +1151,12 @@
     githubId = 56650223;
     name = "Artturi N";
   };
+  ayazhafiz = {
+    email = "ayaz.hafiz.1@gmail.com";
+    github = "ayazhafiz";
+    githubId = 262763;
+    name = "Ayaz Hafiz";
+  };
   b4dm4n = {
     email = "fabianm88@gmail.com";
     github = "B4dM4n";
diff --git a/nixos/modules/services/web-apps/dokuwiki.nix b/nixos/modules/services/web-apps/dokuwiki.nix
index bc5b1a8be545..fc0e23729b3c 100644
--- a/nixos/modules/services/web-apps/dokuwiki.nix
+++ b/nixos/modules/services/web-apps/dokuwiki.nix
@@ -66,6 +66,8 @@ let
   siteOpts = { config, lib, name, ... }:
     {
       options = {
+        enable = mkEnableOption "DokuWiki web application.";
+
         package = mkOption {
           type = types.package;
           default = pkgs.dokuwiki;
diff --git a/nixos/modules/system/boot/stage-2-init.sh b/nixos/modules/system/boot/stage-2-init.sh
index 50ee0b8841e5..afaca2e4158d 100644
--- a/nixos/modules/system/boot/stage-2-init.sh
+++ b/nixos/modules/system/boot/stage-2-init.sh
@@ -62,9 +62,11 @@ chown -f 0:30000 /nix/store
 chmod -f 1775 /nix/store
 if [ -n "@readOnlyStore@" ]; then
     if ! [[ "$(findmnt --noheadings --output OPTIONS /nix/store)" =~ ro(,|$) ]]; then
-        # FIXME when linux < 4.5 is EOL, switch to atomic bind mounts
-        #mount /nix/store /nix/store -o bind,remount,ro
-        mount --bind /nix/store /nix/store
+        if [ -z "$container" ]; then
+            mount --bind /nix/store /nix/store
+        else
+            mount --rbind /nix/store /nix/store
+        fi
         mount -o remount,ro,bind /nix/store
     fi
 fi
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index fc01cb9dad6c..9152280a8b39 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -352,6 +352,7 @@ in
   php80 = handleTest ./php { php = pkgs.php80; };
   pinnwand = handleTest ./pinnwand.nix {};
   plasma5 = handleTest ./plasma5.nix {};
+  plasma5-systemd-start = handleTest ./plasma5-systemd-start.nix {};
   plausible = handleTest ./plausible.nix {};
   pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix {};
   plikd = handleTest ./plikd.nix {};
diff --git a/nixos/tests/plasma5-systemd-start.nix b/nixos/tests/plasma5-systemd-start.nix
new file mode 100644
index 000000000000..ac6fad7da6c6
--- /dev/null
+++ b/nixos/tests/plasma5-systemd-start.nix
@@ -0,0 +1,43 @@
+import ./make-test-python.nix ({ pkgs, ...} :
+
+{
+  name = "plasma5-systemd-start";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ oxalica ];
+  };
+
+  machine = { ... }:
+
+  {
+    imports = [ ./common/user-account.nix ];
+    services.xserver = {
+      enable = true;
+      displayManager.sddm.enable = true;
+      displayManager.defaultSession = "plasma";
+      desktopManager.plasma5.enable = true;
+      desktopManager.plasma5.runUsingSystemd = true;
+      displayManager.autoLogin = {
+        enable = true;
+        user = "alice";
+      };
+    };
+    virtualisation.memorySize = 1024;
+  };
+
+  testScript = { nodes, ... }: let
+    user = nodes.machine.config.users.users.alice;
+  in ''
+    with subtest("Wait for login"):
+        start_all()
+        machine.wait_for_file("${user.home}/.Xauthority")
+        machine.succeed("xauth merge ${user.home}/.Xauthority")
+
+    with subtest("Check plasmashell started"):
+        machine.wait_until_succeeds("pgrep plasmashell")
+        machine.wait_for_window("^Desktop ")
+
+    status, result = machine.systemctl('--no-pager show plasma-plasmashell.service', user='alice')
+    assert status == 0, 'Service not found'
+    assert 'ActiveState=active' in result.split('\n'), 'Systemd service not active'
+  '';
+})
diff --git a/pkgs/desktops/plasma-5/plasma-workspace/0003-startkde-unit-detection.patch b/pkgs/desktops/plasma-5/plasma-workspace/0003-startkde-unit-detection.patch
new file mode 100644
index 000000000000..57779b3f559d
--- /dev/null
+++ b/pkgs/desktops/plasma-5/plasma-workspace/0003-startkde-unit-detection.patch
@@ -0,0 +1,17 @@
+diff --git a/startkde/startplasma.cpp b/startkde/startplasma.cpp
+index a17967b47..6e6141b48 100644
+--- a/startkde/startplasma.cpp
++++ b/startkde/startplasma.cpp
+@@ -431,7 +431,11 @@ bool hasSystemdService(const QString &serviceName)
+                                               QStringLiteral("/org/freedesktop/systemd1"),
+                                               QStringLiteral("org.freedesktop.systemd1.Manager"),
+                                               QStringLiteral("ListUnitFilesByPatterns"));
+-    msg << QStringList({QStringLiteral("enabled"), QStringLiteral("static")}) << QStringList({serviceName});
++    msg << QStringList({QStringLiteral("enabled"),
++                        QStringLiteral("static"),
++                        QStringLiteral("linked"),
++                        QStringLiteral("linked-runtime")});
++    msg << QStringList({serviceName});
+     QDBusReply<QList<QPair<QString, QString>>> reply = QDBusConnection::sessionBus().call(msg);
+     if (!reply.isValid()) {
+         return false;
diff --git a/pkgs/desktops/plasma-5/plasma-workspace/default.nix b/pkgs/desktops/plasma-5/plasma-workspace/default.nix
index 17d4bc15e09e..f44becda9020 100644
--- a/pkgs/desktops/plasma-5/plasma-workspace/default.nix
+++ b/pkgs/desktops/plasma-5/plasma-workspace/default.nix
@@ -52,6 +52,7 @@ mkDerivation {
   patches = [
     ./0001-startkde.patch
     ./0002-absolute-wallpaper-install-dir.patch
+    ./0003-startkde-unit-detection.patch
     # Included in 5.23.2
     (fetchpatch {
       name = "ignore-placeholder-screens";
diff --git a/pkgs/development/python-modules/entry-points-txt/default.nix b/pkgs/development/python-modules/entry-points-txt/default.nix
new file mode 100644
index 000000000000..d52e9ea0d3be
--- /dev/null
+++ b/pkgs/development/python-modules/entry-points-txt/default.nix
@@ -0,0 +1,22 @@
+{ lib
+, buildPythonPackage
+, fetchurl
+}:
+
+buildPythonPackage rec {
+  pname = "entry-points-txt";
+  version = "0.1.0";
+  format = "wheel";
+
+  src = fetchurl {
+    url = "https://github.com/jwodder/entry-points-txt/releases/download/v0.1.0/entry_points_txt-0.1.0-py3-none-any.whl";
+    sha256 = "29773bed3d9d337766a394e19d6f7ab0be3ed7d6f3ebb753ff0f7f48f056aa8e";
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/jwodder/entry-points-txt";
+    description = "Read & write entry_points.txt files";
+    license = with licenses; [ mit ];
+    maintainers = with lib.maintainers; [ ayazhafiz ];
+  };
+}
diff --git a/pkgs/development/python-modules/headerparser/default.nix b/pkgs/development/python-modules/headerparser/default.nix
new file mode 100644
index 000000000000..3ad265c217f7
--- /dev/null
+++ b/pkgs/development/python-modules/headerparser/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, entry-points-txt
+, six
+}:
+
+buildPythonPackage rec {
+  pname = "headerparser";
+  version = "0.4.0";
+
+  src = fetchPypi{
+    inherit pname;
+    inherit version;
+    sha256 = "b8ceae4c5e6133fda666d022684e93f9b3d45815c2c7881018123c71ff28c5cc";
+  };
+
+  buildInputs = [
+    six
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/jwodder/headerparser";
+    description = "argparse for mail-style headers";
+    license = with licenses; [ mit ];
+    maintainers = with lib.maintainers; [ ayazhafiz ];
+  };
+}
diff --git a/pkgs/development/python-modules/jupyter_server/default.nix b/pkgs/development/python-modules/jupyter_server/default.nix
index 85ac49673795..0e1469e0940e 100644
--- a/pkgs/development/python-modules/jupyter_server/default.nix
+++ b/pkgs/development/python-modules/jupyter_server/default.nix
@@ -26,12 +26,12 @@
 
 buildPythonPackage rec {
   pname = "jupyter_server";
-  version = "1.11.1";
+  version = "1.11.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ab7ab1cc38512f15026cbcbb96300fb46ec8b24aa162263d9edd00e0a749b1e8";
+    sha256 = "c1f32e0c1807ab2de37bf70af97a36b4436db0bc8af3124632b1f4441038bf95";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index 277e59125dfa..66fa42e74013 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.5.10";
+  version = "1.5.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "925b9b18d2880f7c74ebf53694b4cd8b9e04ca2cc27d57c265acda5f27b0dc89";
+    sha256 = "196021f0eff1699853675ee80e13bc856c9f1a088d93a0ac023651d2a3f62cf5";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/wheel-filename/default.nix b/pkgs/development/python-modules/wheel-filename/default.nix
new file mode 100644
index 000000000000..351bc86686a3
--- /dev/null
+++ b/pkgs/development/python-modules/wheel-filename/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildPythonPackage
+, fetchurl
+, attrs
+}:
+
+buildPythonPackage rec {
+  pname = "wheel-filename";
+  version = "1.3.0";
+  format = "wheel";
+
+  src = fetchurl {
+    url = "https://github.com/jwodder/wheel-filename/releases/download/v1.1.0/wheel_filename-1.1.0-py3-none-any.whl";
+    sha256 = "0aee45553f34e3a1b8a5db64aa832326f13c138b7f925a53daf96f984f9e6a38";
+  };
+
+  buildInputs = [
+    attrs
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/jwodder/wheel-filename";
+    description = "Parse wheel filenames";
+    license = with licenses; [ mit ];
+    maintainers = with lib.maintainers; [ ayazhafiz ];
+  };
+}
diff --git a/pkgs/development/python-modules/wheel-inspect/default.nix b/pkgs/development/python-modules/wheel-inspect/default.nix
new file mode 100644
index 000000000000..88fd592da8fb
--- /dev/null
+++ b/pkgs/development/python-modules/wheel-inspect/default.nix
@@ -0,0 +1,65 @@
+{ lib
+, buildPythonPackage
+, fetchurl
+, bleach, docutils, pygments, six
+, attrs, entry-points-txt, headerparser, packaging, wheel-filename
+}:
+
+# wheel-filename is stuck on readme_renderer~=24.0.0, but the upstream is at a
+# future version.
+let readme_renderer_24 = buildPythonPackage rec {
+  pname = "readme_renderer";
+  version = "24.0.0";
+  format = "wheel";
+
+  src = fetchurl {
+    url = "https://files.pythonhosted.org/packages/c3/7e/d1aae793900f36b097cbfcc5e70eef82b5b56423a6c52a36dce51fedd8f0/readme_renderer-24.0-py2.py3-none-any.whl";
+    sha256 = "c8532b79afc0375a85f10433eca157d6b50f7d6990f337fa498c96cd4bfc203d";
+  };
+
+  doCheck = false;
+
+  buildInputs = [
+    bleach
+    docutils
+    pygments
+    six
+  ];
+
+  meta = with lib; {
+    description = "Python library for rendering readme descriptions";
+    homepage = "https://github.com/pypa/readme_renderer";
+    license = with licenses; [ asl20 ];
+    maintainers = with lib.maintainers; [ ayazhafiz ];
+  };
+};
+
+in buildPythonPackage rec {
+  version = "1.7.0";
+  pname = "wheel-inspect";
+  format = "wheel";
+
+  src = fetchurl {
+    url = "https://github.com/jwodder/wheel-inspect/releases/download/v1.7.0/wheel_inspect-1.7.0-py3-none-any.whl";
+    sha256 = "69b34de1f4464ddfc76280c4563e4afc644de2c88e3ae6882f030afdad3d73e4";
+  };
+
+  propagatedBuildInputs = [
+    attrs
+    bleach
+    docutils
+    entry-points-txt
+    headerparser
+    packaging
+    pygments
+    readme_renderer_24
+    wheel-filename
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/jwodder/wheel-inspect";
+    description = "Extract information from wheels";
+    license = with licenses; [ mit ];
+    maintainers = with lib.maintainers; [ ayazhafiz ];
+  };
+}
diff --git a/pkgs/tools/networking/shadowsocks-rust/default.nix b/pkgs/tools/networking/shadowsocks-rust/default.nix
index 971570717331..065b842c384f 100644
--- a/pkgs/tools/networking/shadowsocks-rust/default.nix
+++ b/pkgs/tools/networking/shadowsocks-rust/default.nix
@@ -2,28 +2,36 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowsocks-rust";
-  version = "1.10.7";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "shadowsocks";
     repo = pname;
-    sha256 = "08k5j469750bhlq49qc5nwc2jjgmy9qsm58nf2jfwhxlpflv12sc";
+    sha256 = "0ry3zfwxs5j243jpbp5ymnz14ycyk6gpgb50lcazhn1yy52p8wac";
   };
 
-  cargoSha256 = "1r8w5cdygd26m95q9qpqa85aixx25jr510hpjlllbpfvm7zjpbqk";
+  cargoSha256 = "1hvrp3zf5h33j6fgqyzn2jvjbyi8c8pyqwrj5wg3lw38h0z5rvaj";
 
   RUSTC_BOOTSTRAP = 1;
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices libiconv ];
 
-  checkFlags = [ "--skip=http_proxy" "--skip=udp_tunnel" ];
+  # all of these rely on connecting to www.example.com:80
+  checkFlags = [
+    "--skip=http_proxy"
+    "--skip=tcp_tunnel"
+    "--skip=udp_tunnel"
+    "--skip=udp_relay"
+    "--skip=socks4_relay_connect"
+    "--skip=socks5_relay_aead"
+    "--skip=socks5_relay_stream"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/shadowsocks/shadowsocks-rust";
     description = "A Rust port of shadowsocks";
     license = licenses.mit;
     maintainers = [ maintainers.marsam ];
-    broken = stdenv.isAarch64;  # crypto2 crate doesn't build on aarch64
   };
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fe149ef1be41..f61a92249c0c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2438,6 +2438,8 @@ in {
     routerFeatures = true;
   };
 
+  entry-points-txt = callPackage ../development/python-modules/entry-points-txt { };
+
   entrypoint2 = callPackage ../development/python-modules/entrypoint2 { };
 
   entrypoints = callPackage ../development/python-modules/entrypoints { };
@@ -3438,6 +3440,8 @@ in {
 
   hdmedians = callPackage ../development/python-modules/hdmedians { };
 
+  headerparser = callPackage ../development/python-modules/headerparser { };
+
   heapdict = callPackage ../development/python-modules/heapdict { };
 
   helpdev = callPackage ../development/python-modules/helpdev { };
@@ -9801,6 +9805,10 @@ in {
 
   wheel = callPackage ../development/python-modules/wheel { };
 
+  wheel-filename = callPackage ../development/python-modules/wheel-filename { };
+
+  wheel-inspect = callPackage ../development/python-modules/wheel-inspect { };
+
   whichcraft = callPackage ../development/python-modules/whichcraft { };
 
   whirlpool-sixth-sense = callPackage ../development/python-modules/whirlpool-sixth-sense { };