diff --git a/devices/homie/modules/home-assistant/assist.nix b/devices/homie/modules/home-assistant/assist.nix
index ee550036..4d30e8e0 100644
--- a/devices/homie/modules/home-assistant/assist.nix
+++ b/devices/homie/modules/home-assistant/assist.nix
@@ -34,6 +34,32 @@
               doCheck = false;
               pytestFlagsArray = ["intents/tests"];
             };
+
+            # FIXME: some cfn-lint tests don't pass. make nixpkgs issue?
+            aws-sam-translator = prev.aws-sam-translator.overridePythonAttrs (o: rec {
+              version = "1.91.0";
+              format = "setuptools";
+
+              src = pkgs.fetchFromGitHub {
+                owner = "aws";
+                repo = "serverless-application-model";
+                rev = "refs/tags/v${version}";
+                hash = "sha256-jcRpn9STkfg1xTwYzkpoYyuG0Hrv0XnbW1h6+SxzEjA=";
+              };
+            });
+
+            cfn-lint = prev.cfn-lint.overridePythonAttrs (o: {
+              version = "1.17.2+0a31357";
+              format = "pyproject";
+              src = pkgs.fetchFromGitHub {
+                owner = "aws-cloudformation";
+                repo = "cfn-lint";
+                rev = "0a31357504a25af5c0357a4b59e0d6b10f39571b";
+                hash = "sha256-wsRK/DDKSCrGsz2h0rG10VLkpbVKqwTqC3UQ1j0ee/U=";
+              };
+              nativeBuildInputs = [final.defusedxml];
+              disabledTests = o.disabledTests ++ ["test_build_graph"];
+            });
           };
         })
         .overrideAttrs {
diff --git a/devices/nos/modules/docker/forgejo/images/act_runner.nix b/devices/nos/modules/docker/forgejo/images/act_runner.nix
index fe2800e7..6d175bc4 100644
--- a/devices/nos/modules/docker/forgejo/images/act_runner.nix
+++ b/devices/nos/modules/docker/forgejo/images/act_runner.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "vegardit/gitea-act-runner";
-  imageDigest = "sha256:06ab3f910c5015792942d8c338fd865d3dff1163cea2e8c3efd32330c7775802";
-  sha256 = "1rvn2wgv54dlrw3g6hzzri543s668f2j6ppkys7g33pdbk435yvh";
+  imageDigest = "sha256:74c7cddafcf4c8cadad1317f043cd7ed9f675617197051d38812b262a7afd82b";
+  sha256 = "1ify93xr6vcphbflrh654vy8z8937v0qmhfnfn1fidzjg4774zar";
   finalImageName = imageName;
   finalImageTag = "dind-latest";
 }
diff --git a/devices/nos/modules/docker/forgejo/images/forgejo.nix b/devices/nos/modules/docker/forgejo/images/forgejo.nix
index 55872619..efa47f02 100644
--- a/devices/nos/modules/docker/forgejo/images/forgejo.nix
+++ b/devices/nos/modules/docker/forgejo/images/forgejo.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "codeberg.org/forgejo/forgejo";
-  imageDigest = "sha256:1f7c844e1c723ba09411a31f9a3ef8f551e6d77c9ff4f200ef36b870e8c8a3d7";
-  sha256 = "0mcanyy9hyvypvakyg4416w03r4qjxl4rpf9z6mbmbxi9xy7lgd4";
+  imageDigest = "sha256:085092799d1b25370956972185145607246d692da64c18ef55c2da20eecc855d";
+  sha256 = "1qqla94dw8jr2rq85316xqs0lbihmlq75kpskdhlx6n9kh2z7x88";
   finalImageName = imageName;
-  finalImageTag = "8";
+  finalImageTag = "9";
 }
diff --git a/devices/nos/modules/docker/forgejo/images/postgres.nix b/devices/nos/modules/docker/forgejo/images/postgres.nix
index 44b7a452..a45195da 100644
--- a/devices/nos/modules/docker/forgejo/images/postgres.nix
+++ b/devices/nos/modules/docker/forgejo/images/postgres.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "postgres";
-  imageDigest = "sha256:626046694f31a4a6a92511bbeca43f7e78ea8c6ae2f2ed70bbaa9b9abd5b67ab";
-  sha256 = "1z0rq47apkk5y5qlpd9yqsdhgz2vzkslnrmm4m2dxzq394h0nmbh";
+  imageDigest = "sha256:c9fcaef49a1ca7deae24437c705bf7485922f8a768a140006c5d8abb3f6cac7b";
+  sha256 = "0mv71as2k3889idc0m451wr5av0v30f7rb5rrrzgdvy174w39vq6";
   finalImageName = imageName;
   finalImageTag = "14";
 }
diff --git a/devices/nos/modules/docker/freshrss/images/postgres.nix b/devices/nos/modules/docker/freshrss/images/postgres.nix
index 44b7a452..a45195da 100644
--- a/devices/nos/modules/docker/freshrss/images/postgres.nix
+++ b/devices/nos/modules/docker/freshrss/images/postgres.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "postgres";
-  imageDigest = "sha256:626046694f31a4a6a92511bbeca43f7e78ea8c6ae2f2ed70bbaa9b9abd5b67ab";
-  sha256 = "1z0rq47apkk5y5qlpd9yqsdhgz2vzkslnrmm4m2dxzq394h0nmbh";
+  imageDigest = "sha256:c9fcaef49a1ca7deae24437c705bf7485922f8a768a140006c5d8abb3f6cac7b";
+  sha256 = "0mv71as2k3889idc0m451wr5av0v30f7rb5rrrzgdvy174w39vq6";
   finalImageName = imageName;
   finalImageTag = "14";
 }
diff --git a/devices/nos/modules/docker/freshrss/images/rss-bridge.nix b/devices/nos/modules/docker/freshrss/images/rss-bridge.nix
index e7260131..8a7bee65 100644
--- a/devices/nos/modules/docker/freshrss/images/rss-bridge.nix
+++ b/devices/nos/modules/docker/freshrss/images/rss-bridge.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "rssbridge/rss-bridge";
-  imageDigest = "sha256:c4fd6ad6e395310cc5d49665bfca638d09ba6cf9d03ad60a5c36361cb7c05251";
-  sha256 = "1vicsdlyr103qxp1hnwa30qq25k7vi1m4p4hvb1sran1qd7hcas3";
+  imageDigest = "sha256:da785b43f43e4f718c525d71453d6b7011db98c68434f02315cb7ee1ecc88889";
+  sha256 = "0zd27m1gwiw2n2dslv1mxvi54p5gbgfilib99i7f8vh3sf0z7dcd";
   finalImageName = imageName;
   finalImageTag = "latest";
 }
diff --git a/devices/nos/modules/docker/media/bazarr/images/bazarr.nix b/devices/nos/modules/docker/media/bazarr/images/bazarr.nix
index 397805df..1d714430 100644
--- a/devices/nos/modules/docker/media/bazarr/images/bazarr.nix
+++ b/devices/nos/modules/docker/media/bazarr/images/bazarr.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "ghcr.io/linuxserver/bazarr";
-  imageDigest = "sha256:d7d431c29d1c94e7009b6b8b1eb5078689416278b5e6664cad864b28b9ead345";
-  sha256 = "0j5yblqqljv7rcvfk2a9m4xlng3gq3amc740xljhmsac1wlsn0r1";
+  imageDigest = "sha256:5baf571c177eda579fbaa080ade2135bce9097bc3c165f92d30e399df64d0bc4";
+  sha256 = "1sgdlrkm3wmcbncv4488365vjhfg00vn4jghnrpd402cypvkrqch";
   finalImageName = imageName;
   finalImageTag = "latest";
 }
diff --git a/devices/nos/modules/docker/media/sabnzbd/images/sabnzbd.nix b/devices/nos/modules/docker/media/sabnzbd/images/sabnzbd.nix
index c0c4ff92..97e79172 100644
--- a/devices/nos/modules/docker/media/sabnzbd/images/sabnzbd.nix
+++ b/devices/nos/modules/docker/media/sabnzbd/images/sabnzbd.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "ghcr.io/linuxserver/sabnzbd";
-  imageDigest = "sha256:f87f9d4fa0e19f8e7b292638b3fa89cafc4a96d858fbda8106e3cea6343432c1";
-  sha256 = "0vxk5w9yf9aray1aq13djs6yqpmd2082zjldb1m5ijfxba85iq9y";
+  imageDigest = "sha256:ab4fc46cb5e2702f640b28bdc9b460c98b73a9898dd61f7068229f140c26409a";
+  sha256 = "0zx1glxr3adwcd6migh8lal30aih9rzmlzkqzlz2vrad7j3i5h1y";
   finalImageName = imageName;
   finalImageTag = "latest";
 }
diff --git a/devices/nos/modules/docker/media/seerr/images/jellyseerr.nix b/devices/nos/modules/docker/media/seerr/images/jellyseerr.nix
index ee9ffaf3..47c10df4 100644
--- a/devices/nos/modules/docker/media/seerr/images/jellyseerr.nix
+++ b/devices/nos/modules/docker/media/seerr/images/jellyseerr.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "docker.io/fallenbagel/jellyseerr";
-  imageDigest = "sha256:319b09a7db75d697bedc41f6784efd47b8f213a26819d636dec2050efe816567";
-  sha256 = "1c1g70kycqk97ia6nqws44d6paw6k70xh5dxmmqh0hmizzdhlbvi";
+  imageDigest = "sha256:8ff28894f9fd28bf36626fb98ddd0ee79d778de22a5dc75d69a845281e19115b";
+  sha256 = "01q9bx0arpxqn7npxsyqkgzs0jvnbzq5kiz1y6wwn0g5hl0jcb8p";
   finalImageName = imageName;
   finalImageTag = "latest";
 }
diff --git a/devices/nos/modules/docker/nextcloud/images/nextcloud.nix b/devices/nos/modules/docker/nextcloud/images/nextcloud.nix
index 2a6031d2..cb7cfeef 100644
--- a/devices/nos/modules/docker/nextcloud/images/nextcloud.nix
+++ b/devices/nos/modules/docker/nextcloud/images/nextcloud.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "nextcloud";
-  imageDigest = "sha256:38149fa4fefab1e56a976d37db0bb22a049c4e6faf4e1d755fdc536ff5e7f69a";
-  sha256 = "006vd51qnmy30jxyfby870fwxkzi832ll5jhi7fkma4hkh8h44vn";
+  imageDigest = "sha256:29088f7a332ae59f57b0b121bd9d6c6cf0dda1c536c8b7c889f28182e1c26601";
+  sha256 = "00r8l6h2wjqygr9sarp5s6a20gvj1rw4wq7qqmdrl0sm13vzficg";
   finalImageName = imageName;
   finalImageTag = "fpm";
 }
diff --git a/devices/nos/modules/docker/nextcloud/images/nginx.nix b/devices/nos/modules/docker/nextcloud/images/nginx.nix
index f5ae8a9c..3fdf4a8a 100644
--- a/devices/nos/modules/docker/nextcloud/images/nginx.nix
+++ b/devices/nos/modules/docker/nextcloud/images/nginx.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "nginx";
-  imageDigest = "sha256:d2eb56950b84efe34f966a2b92efb1a1a2ea53e7e93b94cdf45a27cf3cd47fc0";
-  sha256 = "0vzd1mh3z88wgc7cwrb1a7yhjzq0ldrg8rw5d7iak9nxx91p8w6q";
+  imageDigest = "sha256:28402db69fec7c17e179ea87882667f1e054391138f77ffaf0c3eb388efc3ffb";
+  sha256 = "0zas3xrxlrr1qd3hc5p63q5hpja3cdfvv6alx10j8q489wn21m0s";
   finalImageName = imageName;
   finalImageTag = "latest";
 }
diff --git a/devices/nos/modules/docker/nextcloud/images/onlyoffice.nix b/devices/nos/modules/docker/nextcloud/images/onlyoffice.nix
index 976bb640..0aeb358d 100644
--- a/devices/nos/modules/docker/nextcloud/images/onlyoffice.nix
+++ b/devices/nos/modules/docker/nextcloud/images/onlyoffice.nix
@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "onlyoffice/documentserver";
-  imageDigest = "sha256:b9e3c35eab182d3de822a53b109b0f27070f6eacea3b1388b9c50d1182f638f2";
-  sha256 = "1r59f8b1f8aaps7ghnlb4k9h29rbzr1mlpm1sy4gb7cqyz0i7l8y";
+  imageDigest = "sha256:2b0180b8ca27b36f27e0ddea0e9e8a5b1d40fcf478dc31f7e2efcfb9ce1bf42a";
+  sha256 = "1yq92d7wqjwkbhacxjrw85426iyrv59l4rh2cbphbgpavbakzqym";
   finalImageName = imageName;
   finalImageTag = "latest";
 }
diff --git a/devices/nos/modules/llm.nix b/devices/nos/modules/llm.nix
index 2b5684fa..a484b4cc 100644
--- a/devices/nos/modules/llm.nix
+++ b/devices/nos/modules/llm.nix
@@ -1,4 +1,8 @@
-{self, ...}: let
+{
+  pkgs,
+  self,
+  ...
+}: let
   tailscaleIP = "100.64.0.4";
 in {
   imports = [self.nixosModules.wyoming-plus];
@@ -8,14 +12,39 @@ in {
 
   services = {
     # Speech-to-Text
-    wyoming.faster-whisper.servers."en" = {
-      enable = true;
-      uri = "tcp://${tailscaleIP}:10300";
+    wyoming.faster-whisper = {
+      # FIXME: wyoming-faster-whisper requires av < 13.0.0. make issue in nixpkgs?
+      package = pkgs.wyoming-faster-whisper.override {
+        python3Packages =
+          (pkgs.python3.override {
+            packageOverrides = pyfinal: pyprev: {
+              av =
+                (pyprev.av.override {
+                  ffmpeg-headless = pkgs.ffmpeg_6-headless;
+                })
+                .overridePythonAttrs (o: rec {
+                  version = "12.3.0";
+                  src = pkgs.fetchFromGitHub {
+                    owner = "PyAV-Org";
+                    repo = "PyAV";
+                    rev = "refs/tags/v${version}";
+                    hash = "sha256-ezeYv55UzNnnYDjrMz5YS5g2pV6U/Fxx3e2bCoPP3eI=";
+                  };
+                });
+            };
+          })
+          .pkgs;
+      };
 
-      # see https://github.com/rhasspy/wyoming-faster-whisper/releases/tag/v2.0.0
-      model = "medium";
-      language = "en";
-      device = "cuda";
+      servers."en" = {
+        enable = true;
+        uri = "tcp://${tailscaleIP}:10300";
+
+        # see https://github.com/rhasspy/wyoming-faster-whisper/releases/tag/v2.0.0
+        model = "medium";
+        language = "en";
+        device = "cuda";
+      };
     };
 
     # Text-to-Intent
diff --git a/flake.lock b/flake.lock
index c8273ae8..12e16c81 100644
Binary files a/flake.lock and b/flake.lock differ
diff --git a/legacyPackages/firefox-addons/generated-firefox-addons.nix b/legacyPackages/firefox-addons/generated-firefox-addons.nix
index 9b1d48b8..e3774552 100644
--- a/legacyPackages/firefox-addons/generated-firefox-addons.nix
+++ b/legacyPackages/firefox-addons/generated-firefox-addons.nix
@@ -29,10 +29,10 @@
   };
   "bitwarden" = buildFirefoxXpiAddon {
     pname = "bitwarden";
-    version = "2024.9.1";
+    version = "2024.10.0";
     addonId = "{446900e4-71c2-419f-a6a7-df9c091e268b}";
-    url = "https://addons.mozilla.org/firefox/downloads/file/4355865/bitwarden_password_manager-2024.9.1.xpi";
-    sha256 = "f484fbcd1e45e4a68f2eec8fb8c22fed5a77f1a00b515f38c167e36b4d6118bf";
+    url = "https://addons.mozilla.org/firefox/downloads/file/4363548/bitwarden_password_manager-2024.10.0.xpi";
+    sha256 = "9ea9428444870a74ae1999d77eb12d97a45275c85e83d6afdcbc4597fa3eccfb";
     meta = with lib; {
       homepage = "https://bitwarden.com";
       description = "At home, at work, or on the go, Bitwarden easily secures all your passwords, passkeys, and sensitive information.";
diff --git a/packages/trash-d/default.nix b/packages/trash-d/default.nix
index d78f4322..06b4eba9 100644
--- a/packages/trash-d/default.nix
+++ b/packages/trash-d/default.nix
@@ -16,7 +16,20 @@ in
 
     src = trash-d-src;
 
-    buildInputs = [dub dmd ronn];
+    buildInputs = [
+      dub
+      ronn
+
+      # FIXME: dmd doesn't build on latest nixos-unstable. make issue?
+      # FIXME: `config.nixpkgs.overlays` don't seem to apply on `self.packages` or `self.legacyPackages`
+      (dmd.overrideAttrs (o: {
+        postPatch =
+          o.postPatch
+          + ''
+            rm dmd/compiler/test/fail_compilation/needspkgmod.d
+          '';
+      }))
+    ];
 
     buildPhase = ''
       # https://github.com/svanderburg/node2nix/issues/217#issuecomment-751311272