diff --git a/apps/config/package.json b/apps/config/package.json
index 5cb9dd33..04c704e9 100644
--- a/apps/config/package.json
+++ b/apps/config/package.json
@@ -9,8 +9,8 @@
         "eslint": "9.17.0",
         "eslint-plugin-jsdoc": "50.6.1",
         "jiti": "2.4.2",
-        "pkg-types": "1.2.1",
+        "pkg-types": "1.3.0",
         "typescript": "5.7.2",
-        "typescript-eslint": "8.18.1"
+        "typescript-eslint": "8.19.0"
     }
 }
diff --git a/apps/extract-subs/default.nix b/apps/extract-subs/default.nix
index 96f5ec71..c733a366 100644
--- a/apps/extract-subs/default.nix
+++ b/apps/extract-subs/default.nix
@@ -5,7 +5,7 @@
 }:
 buildApp {
   src = ./.;
-  npmDepsHash = "sha256-ytaO1mqoORNB5rP/8X/WpIoHkxmi1+Pc6Nep02+fTZ8=";
+  npmDepsHash = "sha256-Ke1os0/XJi2eRJSqEoEYsfWNtgcTO87Onem8bpBQ0/M=";
 
   runtimeInputs = [
     ffmpeg-full
diff --git a/apps/extract-subs/package-lock.json b/apps/extract-subs/package-lock.json
index 37aeca8c..edcec0ad 100644
Binary files a/apps/extract-subs/package-lock.json and b/apps/extract-subs/package-lock.json differ
diff --git a/apps/extract-subs/package.json b/apps/extract-subs/package.json
index fd4b6871..8afbf74a 100644
--- a/apps/extract-subs/package.json
+++ b/apps/extract-subs/package.json
@@ -12,7 +12,7 @@
     },
     "devDependencies": {
         "eslint-conf": "file:../config",
-        "@types/node": "22.10.2",
+        "@types/node": "22.10.3",
         "esbuild": "0.24.2",
         "eslint": "9.17.0",
         "jiti": "2.4.2",
diff --git a/apps/update-sources/default.nix b/apps/update-sources/default.nix
index f00382d2..8e719e0c 100644
--- a/apps/update-sources/default.nix
+++ b/apps/update-sources/default.nix
@@ -9,7 +9,7 @@
 }:
 buildApp {
   src = ./.;
-  npmDepsHash = "sha256-TU7HoUGeCXUKwm2s4Np6NQahk6gWBN9WC5vob3zw7Ns=";
+  npmDepsHash = "sha256-rXAf3REz6xFkZbb435Jk+Ya81tt+1ubspi+Lodf2V4Y=";
 
   runtimeInputs = [
     go
diff --git a/apps/update-sources/package-lock.json b/apps/update-sources/package-lock.json
index 1ece6460..fd4f924c 100644
Binary files a/apps/update-sources/package-lock.json and b/apps/update-sources/package-lock.json differ
diff --git a/apps/update-sources/package.json b/apps/update-sources/package.json
index 0653dd45..381356bf 100644
--- a/apps/update-sources/package.json
+++ b/apps/update-sources/package.json
@@ -8,7 +8,7 @@
     },
     "devDependencies": {
         "eslint-conf": "file:../config",
-        "@types/node": "22.10.2",
+        "@types/node": "22.10.3",
         "esbuild": "0.24.2",
         "eslint": "9.17.0",
         "jiti": "2.4.2",
diff --git a/apps/update-sources/src/node-modules.ts b/apps/update-sources/src/node-modules.ts
index d969fbc3..0b9ade64 100644
--- a/apps/update-sources/src/node-modules.ts
+++ b/apps/update-sources/src/node-modules.ts
@@ -1,5 +1,5 @@
 import { readPackageJSON, writePackageJSON } from 'pkg-types';
-import { readdirSync } from 'node:fs';
+import { existsSync, readdirSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 
 import { replaceInFile, npmRun } from './lib';
@@ -61,18 +61,19 @@ export default async() => {
     for (const path of packages) {
         if (
             path.name === 'package.json' &&
-            !path.parentPath.includes('node_modules') &&
-            !path.parentPath.includes('apps/config')
+            !path.parentPath.includes('node_modules')
         ) {
             await updatePackageJson(path.parentPath, updates);
 
-            const hash = prefetchNpmDeps(path.parentPath);
+            if (existsSync(`${path.parentPath}/default.nix`)) {
+                const hash = prefetchNpmDeps(path.parentPath);
 
-            replaceInFile(
-                /npmDepsHash = ".*";/,
-                `npmDepsHash = "${hash}";`,
-                `${path.parentPath}/default.nix`,
-            );
+                replaceInFile(
+                    /npmDepsHash = ".*";/,
+                    `npmDepsHash = "${hash}";`,
+                    `${path.parentPath}/default.nix`,
+                );
+            }
         }
     }
 
diff --git a/configurations/nos/modules/docker/forgejo/images/act_runner.nix b/configurations/nos/modules/docker/forgejo/images/act_runner.nix
index 296dcfc5..a26b1d78 100644
--- a/configurations/nos/modules/docker/forgejo/images/act_runner.nix
+++ b/configurations/nos/modules/docker/forgejo/images/act_runner.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "vegardit/gitea-act-runner";
-  imageDigest = "sha256:e4e403c6d197b86f7421c64d682b0e8b766e3703989449930cdaaec82ea82216";
-  hash = "sha256-OWz/9c46zgCdLCPPFU3dx9TNqcnvyRn7CN8vyGonbRg=";
+  imageDigest = "sha256:a587df58615ddadf61caabdd904c6493ef0419efbda3e523edac96bb52689773";
+  hash = "sha256-VLbxiFdaZX0dWIyWurX6exli9y7JKSU/1BWT/9Dyopw=";
   finalImageName = imageName;
   finalImageTag = "dind-latest";
 }
diff --git a/configurations/nos/modules/docker/media/bazarr/images/bazarr.nix b/configurations/nos/modules/docker/media/bazarr/images/bazarr.nix
index 904fb0fe..3d3c5acd 100644
--- a/configurations/nos/modules/docker/media/bazarr/images/bazarr.nix
+++ b/configurations/nos/modules/docker/media/bazarr/images/bazarr.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "ghcr.io/linuxserver/bazarr";
-  imageDigest = "sha256:c99ddc0c3a6c23edec34faf81a21fd9bdb60a02b3b5d916590b7a7e48254c87f";
-  hash = "sha256-poQ3N0Ad3ZR6UJOzx5otoLttXj9MWjP3dpYg8kjzXc8=";
+  imageDigest = "sha256:ac9fe56bee9133bcb9e27fe48faaf83c57b83d75bacc277d9b2619136632b1fe";
+  hash = "sha256-TlsfPNOyZP5NF3Pv9rm7gZd3D7Fj2pznI9itYbhzdgU=";
   finalImageName = imageName;
   finalImageTag = "latest";
 }
diff --git a/configurations/nos/modules/docker/media/prowlarr/images/prowlarr.nix b/configurations/nos/modules/docker/media/prowlarr/images/prowlarr.nix
index ebc55eb7..5ee1914a 100644
--- a/configurations/nos/modules/docker/media/prowlarr/images/prowlarr.nix
+++ b/configurations/nos/modules/docker/media/prowlarr/images/prowlarr.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "ghcr.io/linuxserver/prowlarr";
-  imageDigest = "sha256:447b8d85c4b1290d42b526e4cdd70af380e69bb2f70c4d2497816d7a528d2a08";
-  hash = "sha256-y1i3szizi8hfD2nR/xbCdMyZbdouDUcOtdetJMb6Y6k=";
+  imageDigest = "sha256:d089b21e8ab2584b7e1713bde5d5f0160d7c9e850ceb2db53158a85ad3caac57";
+  hash = "sha256-KCgL7eZopgGT14hysqF6vcAfunrSxJelNZAb+cW0kFE=";
   finalImageName = imageName;
   finalImageTag = "latest";
 }
diff --git a/configurations/nos/modules/docker/media/sabnzbd/images/sabnzbd.nix b/configurations/nos/modules/docker/media/sabnzbd/images/sabnzbd.nix
index 970abd40..d4678976 100644
--- a/configurations/nos/modules/docker/media/sabnzbd/images/sabnzbd.nix
+++ b/configurations/nos/modules/docker/media/sabnzbd/images/sabnzbd.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "ghcr.io/linuxserver/sabnzbd";
-  imageDigest = "sha256:76a15e85e391eb2702ac1c6ccd90fc7b7546913065c1504f708ce9bf863aedbf";
-  hash = "sha256-YxKOWHfOdotuxYUZQPpP28h+LUIYvpx90hFlpuuEeK4=";
+  imageDigest = "sha256:80242140e786c1c73d867e8c84bba16c0ebd20cd27a5c6cf69196168b3fe5e35";
+  hash = "sha256-Ur7RVoZylK7O8kqBd83FGmSO/lkspCsFrQ8rnmIqOYM=";
   finalImageName = imageName;
   finalImageTag = "latest";
 }
diff --git a/configurations/nos/modules/qbittorrent/vuetorrent.nix b/configurations/nos/modules/qbittorrent/vuetorrent.nix
index 3b6f8b3b..e6620fd5 100644
--- a/configurations/nos/modules/qbittorrent/vuetorrent.nix
+++ b/configurations/nos/modules/qbittorrent/vuetorrent.nix
@@ -1,6 +1,6 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  version = "2.19.0";
-  url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.19.0/vuetorrent.zip";
-  hash = "sha256-ZSLXSnYxp7Sr7dZZcIBSZv8hs5VatuxWdv0DsYiOrjE=";
+  version = "2.20.1";
+  url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.20.1/vuetorrent.zip";
+  hash = "sha256-ClHJXrwv5yzWSDpxon/3yrQ/FBeMRUiX8GTpTMZhl2Q=";
 }
diff --git a/flake.lock b/flake.lock
index 4687e4b8..ab35108d 100644
Binary files a/flake.lock and b/flake.lock differ
diff --git a/flake.nix b/flake.nix
index e01d18e8..d0766546 100644
Binary files a/flake.nix and b/flake.nix differ
diff --git a/outputs.nix b/outputs.nix
index 257d6a7f..86ae03e7 100644
--- a/outputs.nix
+++ b/outputs.nix
@@ -11,7 +11,10 @@
       nixpkgs = mkInput {
         owner = "NixOS";
         repo = "nixpkgs";
-        ref = "nixos-unstable";
+        # ref = "nixos-unstable";
+
+        # FIXME: pinned this because of astal issues and build failures
+        rev = "88195a94f390381c6afcdaa933c2f6ff93959cb4";
       };
 
       home-manager = mkDep {
diff --git a/packages/homepage/default.nix b/packages/homepage/default.nix
index da92a480..8da39fd8 100644
--- a/packages/homepage/default.nix
+++ b/packages/homepage/default.nix
@@ -15,7 +15,7 @@
   installLocalIcons = import ./icons.nix {inherit fetchFromGitHub;};
 
   pname = "homepage-dashboard";
-  version = "0.10.6";
+  version = "0.10.7";
 in
   buildNpmPackage {
     inherit pname version;
@@ -24,7 +24,7 @@ in
       owner = "gethomepage";
       repo = "homepage";
       rev = "v${version}";
-      hash = "sha256-5JdCd/A+wmsZic0OsbqBBTUQO/SinnUtDKYy7iUmtAs=";
+      hash = "sha256-JZoAjl7gLp1l8tHDdc37XI4917GnLUISno1KQKAWBv4=";
     };
 
     npmDepsHash = "sha256-AW7lNkvQeeHkAf6Q23912LiSHJMelR9+4KVSKdlFqd0=";