diff --git a/pkgs/by-name/py/pynitrokey/package.nix b/pkgs/by-name/py/pynitrokey/package.nix
new file mode 100644
index 000000000000..beafb787b63b
--- /dev/null
+++ b/pkgs/by-name/py/pynitrokey/package.nix
@@ -0,0 +1,28 @@
+{ python3
+, fetchPypi
+, rustPlatform
+}:
+
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      # https://github.com/nxp-mcuxpresso/spsdk/issues/64
+      cryptography = super.cryptography.overridePythonAttrs (old: rec {
+        version = "41.0.7";
+        src = fetchPypi {
+          inherit (old) pname;
+          inherit version;
+          hash = "sha256-E/k86b6oAWwlOzSvxr1qdZk+XEBnLtVAWpyDLw1KALw=";
+        };
+        cargoDeps = rustPlatform.fetchCargoTarball {
+          inherit src;
+          sourceRoot = "${old.pname}-${version}/${old.cargoRoot}";
+          name = "${old.pname}-${version}";
+          hash = "sha256-VeZhKisCPDRvmSjGNwCgJJeVj65BZ0Ge+yvXbZw86Rw=";
+        };
+        patches = [ ];
+        doCheck = false; # would require overriding cryptography-vectors
+      });
+    };
+  };
+in with python.pkgs; toPythonApplication pynitrokey
diff --git a/pkgs/development/python-modules/nbdime/default.nix b/pkgs/development/python-modules/nbdime/default.nix
index 582d46b52108..3f58201e2c92 100644
--- a/pkgs/development/python-modules/nbdime/default.nix
+++ b/pkgs/development/python-modules/nbdime/default.nix
@@ -1,20 +1,11 @@
 { lib
 , buildPythonPackage
-, fetchPypi
 , pythonOlder
-, hypothesis
-, setuptools-scm
-, six
-, attrs
-, py
-, setuptools
-, pytest-timeout
-, pytest-tornado
-, mock
-, tabulate
+, fetchPypi
+, hatch-jupyter-builder
+, hatchling
+, jupyterlab
 , nbformat
-, jsonschema
-, pytestCheckHook
 , colorama
 , pygments
 , tornado
@@ -22,14 +13,16 @@
 , gitpython
 , jupyter-server
 , jupyter-server-mathjax
-, notebook
 , jinja2
+, git
+, pytest-tornado
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "nbdime";
   version = "4.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -39,48 +32,42 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    setuptools-scm
+    hatch-jupyter-builder
+    hatchling
+    jupyterlab
   ];
 
   propagatedBuildInputs = [
-    attrs
-    py
-    setuptools
-    six
-    jupyter-server-mathjax
     nbformat
     colorama
     pygments
     tornado
     requests
     gitpython
-    notebook
+    jupyter-server
+    jupyter-server-mathjax
     jinja2
   ];
 
   nativeCheckInputs = [
-    hypothesis
-    pytest-timeout
+    git
     pytest-tornado
-    jsonschema
-    mock
-    tabulate
     pytestCheckHook
   ];
 
   disabledTests = [
-    "test_apply_filter_no_repo"
-    "test_diff_api_checkpoint"
-    "test_filter_cmd_invalid_filter"
-    "test_inline_merge_source_add"
-    "test_inline_merge_source_patches"
-    "test_inline_merge_source_replace"
-    "test_inline_merge_cells_insertion"
-    "test_inline_merge_cells_replacement"
-    "test_interrogate_filter_no_repo"
-    "test_merge_input_strategy_inline"
+    "test_git_diffdriver"
+    "test_git_difftool"
+    "test_git_mergedriver"
+    "test_git_mergetool"
   ];
 
+  preCheck = ''
+    export HOME="$TEMP"
+    git config --global user.email "janedoe@example.com"
+    git config --global user.name "Jane Doe"
+  '';
+
   __darwinAllowLocalNetworking = true;
 
   pythonImportsCheck = [
@@ -89,7 +76,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     homepage = "https://github.com/jupyter/nbdime";
-    description = "Tools for diffing and merging of Jupyter notebooks.";
+    changelog = "https://github.com/jupyter/nbdime/blob/${version}/CHANGELOG.md";
+    description = "Tools for diffing and merging of Jupyter notebooks";
     license = licenses.bsd3;
     maintainers = with maintainers; [ tbenst ];
   };
diff --git a/pkgs/development/python-modules/pyocd-pemicro/default.nix b/pkgs/development/python-modules/pyocd-pemicro/default.nix
new file mode 100644
index 000000000000..74dee58903cd
--- /dev/null
+++ b/pkgs/development/python-modules/pyocd-pemicro/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, setuptools-scm
+, pyocd
+, pypemicro
+}:
+
+buildPythonPackage rec {
+  pname = "pyocd-pemicro";
+  version = "1.1.5";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "pyocd";
+    repo = "pyocd-pemicro";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-qi803s8fkrLizcCLeDRz7CTQ56NGLQ4PPwCbxiRigwc=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    pyocd
+    pypemicro
+  ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  meta = {
+    changelog = "https://github.com/pyocd/pyocd-pemicro/releases/tag/v${version}";
+    description = "PEMicro probe plugin for pyOCD";
+    homepage = "https://github.com/pyocd/pyocd-pemicro";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/pytest-notebook/default.nix b/pkgs/development/python-modules/pytest-notebook/default.nix
new file mode 100644
index 000000000000..b20006641057
--- /dev/null
+++ b/pkgs/development/python-modules/pytest-notebook/default.nix
@@ -0,0 +1,82 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flit-core
+, pythonRelaxDepsHook
+, attrs
+, jsonschema
+, nbclient
+, nbdime
+, nbformat
+, pytest
+, black
+, coverage
+, ipykernel
+, pytest-cov
+, pytest-regressions
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-notebook";
+  version = "0.10.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "chrisjsewell";
+    repo = "pytest-notebook";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LoK0wb7rAbVbgyURCbSfckWvJDef3tPY+7V4YU1IBRU=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "attrs"
+    "nbclient"
+  ];
+
+  propagatedBuildInputs = [
+    attrs
+    jsonschema
+    nbclient
+    nbdime
+    nbformat
+  ];
+
+  buildInputs = [
+    pytest
+  ];
+
+  pythonImportsCheck = [ "pytest_notebook" ];
+
+  nativeCheckInputs = [
+    black
+    coverage
+    ipykernel
+    pytest-cov
+    pytest-regressions
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export HOME="$TEMP"
+  '';
+
+  disabledTests = [
+    "test_diff_to_string"
+    "test_execute_notebook_with_coverage"
+    "test_regression_coverage"
+  ];
+
+  meta = {
+    changelog = "https://github.com/chrisjsewell/pytest-notebook/blob/${src.rev}/docs/source/changelog.md";
+    description = "Pytest plugin for regression testing and regenerating Jupyter Notebooks";
+    homepage = "https://github.com/chrisjsewell/pytest-notebook";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/spsdk/default.nix b/pkgs/development/python-modules/spsdk/default.nix
index d0803c6dc729..0764e6c6ccd0 100644
--- a/pkgs/development/python-modules/spsdk/default.nix
+++ b/pkgs/development/python-modules/spsdk/default.nix
@@ -9,21 +9,19 @@
 , click
 , click-command-tree
 , click-option-group
-, cmsis-pack-manager
-, commentjson
+, colorama
 , crcmod
 , cryptography
 , deepmerge
 , fastjsonschema
 , hexdump
-, importlib-metadata
-, jinja2
 , libusbsio
 , oscrypto
-, pycryptodome
-, pyftdi
+, platformdirs
+, prettytable
 , pylink-square
 , pyocd
+, pyocd-pemicro
 , pypemicro
 , pyserial
 , requests
@@ -33,20 +31,22 @@
 , spsdk
 , testers
 , typing-extensions
+, ipykernel
+, pytest-notebook
 , pytestCheckHook
 , voluptuous
 }:
 
 buildPythonPackage rec {
   pname = "spsdk";
-  version = "2.0.1";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nxp-mcuxpresso";
-    repo = pname;
-    rev = version;
-    hash = "sha256-C6cz5jhIHI4WkCYT0rURFa4kBAu6cMcKpQHiHACIiu8=";
+    repo = "spsdk";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ZXNqger5WBk2AjTszJLmemYDPClUPy+kNtBWSPcTDro=";
   };
 
   nativeBuildInputs = [
@@ -55,21 +55,7 @@ buildPythonPackage rec {
   ];
 
   pythonRelaxDeps = [
-    "bincopy"
-    "bitstring"
-    "cmsis-pack-manager"
-    "deepmerge"
-    "jinja2"
-    "pycryptodome"
-    "pylink-square"
-    "pyocd"
-    "typing-extensions"
     "click"
-    "ruamel.yaml"
-  ];
-
-  pythonRemoveDeps = [
-    "pyocd-pemicro"
   ];
 
   propagatedBuildInputs = [
@@ -80,20 +66,19 @@ buildPythonPackage rec {
     click
     click-command-tree
     click-option-group
-    cmsis-pack-manager
-    commentjson
+    colorama
     crcmod
     cryptography
     deepmerge
     fastjsonschema
     hexdump
-    importlib-metadata
-    jinja2
     libusbsio
     oscrypto
-    pycryptodome
+    platformdirs
+    prettytable
     pylink-square
     pyocd
+    pyocd-pemicro
     pypemicro
     pyserial
     requests
@@ -103,16 +88,23 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pyftdi
+    ipykernel
+    pytest-notebook
     pytestCheckHook
     voluptuous
   ];
 
+  disabledTests = [
+    "test_nxpcrypto_create_signature_algorithm"
+    "test_nxpimage_sb31_kaypair_not_matching"
+  ];
+
   pythonImportsCheck = [ "spsdk" ];
 
   passthru.tests.version = testers.testVersion { package = spsdk; };
 
   meta = with lib; {
+    broken = versionAtLeast cryptography.version "41.1";
     changelog = "https://github.com/nxp-mcuxpresso/spsdk/blob/${src.rev}/docs/release_notes.rst";
     description = "NXP Secure Provisioning SDK";
     homepage = "https://github.com/nxp-mcuxpresso/spsdk";
diff --git a/pkgs/tools/security/nitrokey-app2/default.nix b/pkgs/tools/security/nitrokey-app2/default.nix
index d56e882cb09e..6f392f5d7f53 100644
--- a/pkgs/tools/security/nitrokey-app2/default.nix
+++ b/pkgs/tools/security/nitrokey-app2/default.nix
@@ -1,20 +1,38 @@
 { lib
-, buildPythonApplication
+, python3
+, fetchPypi
+, rustPlatform
 , fetchFromGitHub
-, pythonOlder
-, pyside6
-, poetry-core
-, pynitrokey
-, pyudev
-, qt-material
 }:
 
-buildPythonApplication rec {
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      # https://github.com/nxp-mcuxpresso/spsdk/issues/64
+      cryptography = super.cryptography.overridePythonAttrs (old: rec {
+        version = "41.0.7";
+        src = fetchPypi {
+          inherit (old) pname;
+          inherit version;
+          hash = "sha256-E/k86b6oAWwlOzSvxr1qdZk+XEBnLtVAWpyDLw1KALw=";
+        };
+        cargoDeps = rustPlatform.fetchCargoTarball {
+          inherit src;
+          sourceRoot = "${old.pname}-${version}/${old.cargoRoot}";
+          name = "${old.pname}-${version}";
+          hash = "sha256-VeZhKisCPDRvmSjGNwCgJJeVj65BZ0Ge+yvXbZw86Rw=";
+        };
+        patches = [ ];
+        doCheck = false; # would require overriding cryptography-vectors
+      });
+    };
+  };
+in python.pkgs.buildPythonApplication rec {
   pname = "nitrokey-app2";
   version = "2.1.5";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = python.pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "Nitrokey";
@@ -31,11 +49,11 @@ buildPythonApplication rec {
     substituteInPlace pyproject.toml --replace 'pynitrokey = "' 'pynitrokey = ">='
   '';
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python.pkgs; [
     poetry-core
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python.pkgs; [
     pynitrokey
     pyudev
     pyside6
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 10d038e90c1f..de4ce3e1c736 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -41325,11 +41325,9 @@ with pkgs;
 
   xrq = callPackage ../applications/misc/xrq { };
 
-  pynitrokey = with python3Packages; toPythonApplication pynitrokey;
-
   nitrokey-app = libsForQt5.callPackage ../tools/security/nitrokey-app { };
 
-  nitrokey-app2 = python3Packages.callPackage ../tools/security/nitrokey-app2 { };
+  nitrokey-app2 = callPackage ../tools/security/nitrokey-app2 { };
 
   fpm2 = callPackage ../tools/security/fpm2 { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4bb337c30bf6..05759673e9c7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11133,6 +11133,8 @@ self: super: with self; {
 
   pyocd = callPackage ../development/python-modules/pyocd { };
 
+  pyocd-pemicro = callPackage ../development/python-modules/pyocd-pemicro { };
+
   pyocr = callPackage ../development/python-modules/pyocr {
     tesseract = pkgs.tesseract4;
   };
@@ -11825,6 +11827,8 @@ self: super: with self; {
 
   pytest-mypy-plugins = callPackage ../development/python-modules/pytest-mypy-plugins { };
 
+  pytest-notebook = callPackage ../development/python-modules/pytest-notebook { };
+
   pytest-openfiles = callPackage ../development/python-modules/pytest-openfiles { };
 
   pytest-order = callPackage ../development/python-modules/pytest-order { };