diff --git a/flake.lock b/flake.lock
index a58f4d2..882c0d3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -118,11 +118,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1792127429,
-        "narHash": "sha256-Rmi/jXFWi6VMYGYPnlMmB/7umLPNJYE/WVlUZ9LoqyU=",
+        "lastModified": 1793639154,
+        "narHash": "sha256-nX+KippNM1uBiqPoObeHJ8V4SYqbs8IwwA+FKscdO74=",
         "owner": "noamsto",
         "repo": "nix-amd-ai",
-        "rev": "8e1fd17dcc61bd179a90433109d5c5fa45631ff1",
+        "rev": "81e0fe56256568c2046b89a2129bc1dc6253883b",
         "type": "github"
       },
       "original": {
@@ -170,11 +170,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1791594108,
-        "narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
+        "lastModified": 1793540411,
+        "narHash": "sha256-fiPJ88izTVucjeo2EQ3jk4aWmLg03I1D4vxnX2QjEgE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
+        "rev": "0bb2eedc20e4739f29e8045034f2828ad7054f8f",
         "type": "github"
       },
       "original": {
@@ -201,11 +201,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1792210252,
-        "narHash": "sha256-Mh0PUaIv4nFY+8wAGonaEh8iBzwsmdNlwjVHmFg1Biw=",
+        "lastModified": 1793540411,
+        "narHash": "sha256-fiPJ88izTVucjeo2EQ3jk4aWmLg03I1D4vxnX2QjEgE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "09063bd1f2b36fd9fd793c36dfade7bd40a93dfc",
+        "rev": "0bb2eedc20e4739f29e8045034f2828ad7054f8f",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1792056300,
-        "narHash": "sha256-YU1LjDe1o2Ymg5zEiCHbmMXLkDCtxHQRiVqZ3nC5GGk=",
+        "lastModified": 1793657466,
+        "narHash": "sha256-GoOvpdsjO5hqZuO6T6ok9u6sJEjO0iPli2zRr9oNUNw=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "44931708c62937c2b1bf7953902989fa5bb9ee1b",
+        "rev": "b18e01ce148eb3efff5de2f2d3181ca53b2b2a54",
         "type": "github"
       },
       "original": {
diff --git a/modules/packages.nix b/modules/packages.nix
index 12c4cf6..db2c3f5 100644
--- a/modules/packages.nix
+++ b/modules/packages.nix
@@ -1,6 +1,20 @@
 # System packages configuration
 { config, pkgs, lib, inputs, ... }:
 
+let
+  # nixpkgs 2026-10-17 (previous lock) for packages the 2026-11-01 bump broke:
+  # - tlp-profile-switcher: upstream declares only GNOME 48, so nixpkgs dropped
+  #   it; it runs on 50 here because version validation is disabled.
+  # - aider-chat: its posthog dependency is marked broken (python 3.14).
+  # Drop each entry once it evaluates on the current nixpkgs again.
+  pkgsPrev = import (builtins.fetchTree {
+    type = "github";
+    owner = "NixOS";
+    repo = "nixpkgs";
+    rev = "09063bd1f2b36fd9fd793c36dfade7bd40a93dfc";
+    narHash = "sha256-Mh0PUaIv4nFY+8wAGonaEh8iBzwsmdNlwjVHmFg1Biw=";
+  }) { inherit (pkgs.stdenv.hostPlatform) system; };
+in
 {
   # Allow unfree packages
   nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
@@ -113,7 +127,7 @@
     # terragrunt    # broken in nixpkgs
     gh
     forgejo-cli     # fj, for Forgejo (dev.narayana.im, dev.another.im)
-    aider-chat      # AI pair programming CLI (OpenRouter via ~/.local/bin/aider)
+    pkgsPrev.aider-chat  # AI pair programming CLI (OpenRouter via ~/.local/bin/aider)
 
     # WWAN modem tools
     libmbim
@@ -143,7 +157,7 @@
     xray
 
     # GNOME extensions
-    gnomeExtensions.tlp-profile-switcher
+    pkgsPrev.gnomeExtensions.tlp-profile-switcher
     gnomeExtensions.appindicator  # tray icons (StatusNotifierItem): another.im's "Stay connected when closed"
   ];
 
diff --git a/modules/security.nix b/modules/security.nix
index a614c67..90f1b41 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -48,7 +48,8 @@
   # Drop these roots from the system CA bundle (names must match bundle labels)
   security.pki.caCertificateBlacklist = [
     "Comodo AAA Services root"
-    "emSign ECC Root CA - G3"
+    # "emSign ECC Root CA - G3": removed upstream in NSS 3.131.1; a stale
+    # entry fails the cacert build.
   ];
 
   # USBGuard configuration
diff --git a/modules/xray.nix b/modules/xray.nix
index 3369f8d..1712d75 100644
--- a/modules/xray.nix
+++ b/modules/xray.nix
@@ -1,18 +1,6 @@
 # Xray VLESS+Reality (PQ encryption) with sing-box TUN
 { config, pkgs, lib, ... }:
 
-let
-  # Pin Firefox DevEdition to nixpkgs 2026-07-05: 152.0b8 is cached there,
-  # whereas the current nixpkgs ships the same version uncached with a broken
-  # source build (webrender COUNT identifier error). Drop this pin once a
-  # newer, cached devedition lands upstream.
-  pkgsFirefox = import (builtins.fetchTree {
-    type = "github";
-    owner = "NixOS";
-    repo = "nixpkgs";
-    rev = "d407951447dcd00442e97087bf374aad70c04cea";
-  }) { inherit (pkgs.stdenv.hostPlatform) system; config.allowUnfree = true; };
-in
 {
   # Config is sops-encrypted; decrypted to /run/secrets at activation and
   # handed to the DynamicUser service via LoadCredential (stays root-only 0400).
@@ -143,7 +131,7 @@ in
   # Firefox dev edition
   programs.firefox = {
     enable = true;
-    package = pkgsFirefox.firefox-devedition;
+    package = pkgs.firefox-devedition;
     policies = {
       # Estonian ID: load OpenSC PKCS#11 for TLS client-cert auth,
       # and force-install the Web eID extension (talks to web-eid-app host).