diff --git a/.github/workflows/build-aarch64-darwin.yml b/.github/workflows/build-aarch64-darwin.yml
index cf5a0377d..cb40b9528 100644
--- a/.github/workflows/build-aarch64-darwin.yml
+++ b/.github/workflows/build-aarch64-darwin.yml
@@ -11,7 +11,7 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install Nix
         uses: DeterminateSystems/determinate-nix-action@main
       - uses: DeterminateSystems/flakehub-cache-action@main
diff --git a/.github/workflows/build-aarch64-linux.yml b/.github/workflows/build-aarch64-linux.yml
index b6563347a..eb8d21356 100644
--- a/.github/workflows/build-aarch64-linux.yml
+++ b/.github/workflows/build-aarch64-linux.yml
@@ -11,7 +11,7 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install Nix
         uses: DeterminateSystems/determinate-nix-action@main
       - uses: DeterminateSystems/flakehub-cache-action@main
diff --git a/.github/workflows/build-x86_64-darwin.yml b/.github/workflows/build-x86_64-darwin.yml
index 1ceea99b1..d2a3fb05c 100644
--- a/.github/workflows/build-x86_64-darwin.yml
+++ b/.github/workflows/build-x86_64-darwin.yml
@@ -11,7 +11,7 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install Nix
         uses: DeterminateSystems/determinate-nix-action@main
       - uses: DeterminateSystems/flakehub-cache-action@main
diff --git a/.github/workflows/build-x86_64-linux.yml b/.github/workflows/build-x86_64-linux.yml
index 682916eaa..59b959fb1 100644
--- a/.github/workflows/build-x86_64-linux.yml
+++ b/.github/workflows/build-x86_64-linux.yml
@@ -11,7 +11,7 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install Nix
         uses: DeterminateSystems/determinate-nix-action@main
       - uses: DeterminateSystems/flakehub-cache-action@main
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fdbe69f7b..f238b4389 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Check Nixpkgs input
         uses: DeterminateSystems/flake-checker-action@main
         with:
@@ -63,9 +63,9 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Restore Github cache artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-x86_64-linux
       - name: Move & set executable
@@ -180,9 +180,9 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Restore Github cache artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-x86_64-linux
       - name: Move & set executable
@@ -303,9 +303,9 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Restore Github cache artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-x86_64-darwin
       - name: Move & set executable
@@ -392,9 +392,9 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Restore Github cache artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-aarch64-linux
       - name: Move & set executable
@@ -509,9 +509,9 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Restore Github cache artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-aarch64-darwin
       - name: Move & set executable
@@ -604,9 +604,9 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Restore Github cache artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-x86_64-linux
       - name: Move & set executable
diff --git a/.github/workflows/release-branches.yml b/.github/workflows/release-branches.yml
index 7d0adae53..d91aac244 100644
--- a/.github/workflows/release-branches.yml
+++ b/.github/workflows/release-branches.yml
@@ -32,24 +32,24 @@ jobs:
       - build-aarch64-darwin
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Create artifacts directory
         run: mkdir -p ./artifacts
 
       - name: Fetch x86_64-linux binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-x86_64-linux
       - name: Fetch aarch64-linux binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-aarch64-linux
       - name: Fetch x86_64-darwin binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-x86_64-darwin
       - name: Fetch aarch64-darwin binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-aarch64-darwin
       - name: Move binaries into upload staging dir
@@ -60,7 +60,7 @@ jobs:
           mv nix-installer-aarch64-darwin artifacts/
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: ${{ secrets.AWS_S3_UPLOAD_ROLE }}
           aws-region: us-east-2
diff --git a/.github/workflows/release-prs.yml b/.github/workflows/release-prs.yml
index 290b123c5..71c94d349 100644
--- a/.github/workflows/release-prs.yml
+++ b/.github/workflows/release-prs.yml
@@ -76,24 +76,24 @@ jobs:
       - build-aarch64-darwin
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Create artifacts directory
         run: mkdir -p ./artifacts
 
       - name: Fetch x86_64-linux binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-x86_64-linux
       - name: Fetch aarch64-linux binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-aarch64-linux
       - name: Fetch x86_64-darwin binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-x86_64-darwin
       - name: Fetch aarch64-darwin binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-aarch64-darwin
       - name: Move binaries into upload staging dir
@@ -104,7 +104,7 @@ jobs:
           mv nix-installer-aarch64-darwin artifacts/
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: ${{ secrets.AWS_S3_UPLOAD_ROLE }}
           aws-region: us-east-2
diff --git a/.github/workflows/release-tags.yml b/.github/workflows/release-tags.yml
index 8fad39067..befe7868e 100644
--- a/.github/workflows/release-tags.yml
+++ b/.github/workflows/release-tags.yml
@@ -29,24 +29,24 @@ jobs:
       - build-aarch64-darwin
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Create artifacts directory
         run: mkdir -p ./artifacts
 
       - name: Fetch x86_64-linux binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-x86_64-linux
       - name: Fetch aarch64-linux binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-aarch64-linux
       - name: Fetch x86_64-darwin binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-x86_64-darwin
       - name: Fetch aarch64-darwin binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nix-installer-aarch64-darwin
       - name: Move binaries into upload staging dir
@@ -57,7 +57,7 @@ jobs:
           mv nix-installer-aarch64-darwin artifacts/
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: ${{ secrets.AWS_S3_UPLOAD_ROLE }}
           aws-region: us-east-2
@@ -67,7 +67,7 @@ jobs:
         run: |
           ./upload_s3.sh "$GITHUB_REF_NAME" "$GITHUB_SHA" "https://install.determinate.systems/nix/tag/$GITHUB_REF_NAME"
       - name: Publish Release to GitHub (Tag)
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         with:
           fail_on_unmatched_files: true
           draft: true
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index 336906bd1..41c89368e 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: DeterminateSystems/determinate-nix-action@v3
       - uses: DeterminateSystems/update-flake-lock@main
         with:
diff --git a/Cargo.lock b/Cargo.lock
index b1c5d774f..00f6e5b98 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -429,7 +429,7 @@ dependencies = [
  "serde_json",
  "sys-locale",
  "sysinfo",
- "target-lexicon 0.13.3",
+ "target-lexicon",
  "tempfile",
  "thiserror 2.0.16",
  "tokio",
@@ -450,7 +450,7 @@ dependencies = [
  "futures-util",
  "hickory-resolver",
  "http",
- "rand 0.9.2",
+ "rand",
  "thiserror 2.0.16",
  "tracing",
  "url",
@@ -458,23 +458,23 @@ dependencies = [
 
 [[package]]
 name = "dirs"
-version = "5.0.1"
+version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
+checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
 dependencies = [
  "dirs-sys",
 ]
 
 [[package]]
 name = "dirs-sys"
-version = "0.4.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
 dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.48.0",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
@@ -494,12 +494,6 @@ version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
-[[package]]
-name = "either"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
-
 [[package]]
 name = "enum-as-inner"
 version = "0.6.1"
@@ -512,6 +506,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "env_home"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f84e12ccf0a7ddc17a6c41c93326024c42920d7ee630d04950e6926645c0fe"
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -753,7 +753,7 @@ dependencies = [
  "idna",
  "ipnet",
  "once_cell",
- "rand 0.9.2",
+ "rand",
  "ring",
  "thiserror 2.0.16",
  "tinyvec",
@@ -775,7 +775,7 @@ dependencies = [
  "moka",
  "once_cell",
  "parking_lot",
- "rand 0.9.2",
+ "rand",
  "resolv-conf",
  "smallvec",
  "thiserror 2.0.16",
@@ -783,15 +783,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "home"
-version = "0.5.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
-dependencies = [
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "http"
 version = "1.3.1"
@@ -1188,12 +1179,6 @@ dependencies = [
  "redox_syscall",
 ]
 
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.11.0"
@@ -1308,9 +1293,9 @@ dependencies = [
 
 [[package]]
 name = "nix"
-version = "0.29.0"
+version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
  "bitflags",
  "cfg-if",
@@ -1350,7 +1335,7 @@ dependencies = [
  "os-release",
  "owo-colors",
  "plist",
- "rand 0.8.5",
+ "rand",
  "reqwest",
  "semver",
  "serde",
@@ -1359,10 +1344,10 @@ dependencies = [
  "strum",
  "sysctl",
  "tar",
- "target-lexicon 0.12.16",
+ "target-lexicon",
  "tempfile",
  "term",
- "thiserror 1.0.69",
+ "thiserror 2.0.16",
  "tokio",
  "tracing",
  "tracing-error",
@@ -1620,7 +1605,7 @@ dependencies = [
  "bytes 1.10.1",
  "getrandom 0.3.3",
  "lru-slab",
- "rand 0.9.2",
+ "rand",
  "ring",
  "rustc-hash",
  "rustls",
@@ -1661,35 +1646,14 @@ version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
-[[package]]
-name = "rand"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
-dependencies = [
- "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "rand"
 version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
 dependencies = [
- "rand_chacha 0.9.0",
- "rand_core 0.9.3",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.6.4",
+ "rand_chacha",
+ "rand_core",
 ]
 
 [[package]]
@@ -1699,16 +1663,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.9.3",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-dependencies = [
- "getrandom 0.2.16",
+ "rand_core",
 ]
 
 [[package]]
@@ -1731,13 +1686,13 @@ dependencies = [
 
 [[package]]
 name = "redox_users"
-version = "0.4.6"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
 dependencies = [
  "getrandom 0.2.16",
  "libredox",
- "thiserror 1.0.69",
+ "thiserror 2.0.16",
 ]
 
 [[package]]
@@ -1860,19 +1815,6 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rustix"
-version = "0.38.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
-dependencies = [
- "bitflags",
- "errno",
- "libc",
- "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "rustix"
 version = "1.1.2"
@@ -1882,7 +1824,7 @@ dependencies = [
  "bitflags",
  "errno",
  "libc",
- "linux-raw-sys 0.11.0",
+ "linux-raw-sys",
  "windows-sys 0.61.0",
 ]
 
@@ -2177,23 +2119,22 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "strum"
-version = "0.26.3"
+version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06"
+checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
 dependencies = [
  "strum_macros",
 ]
 
 [[package]]
 name = "strum_macros"
-version = "0.26.4"
+version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be"
+checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "rustversion",
  "syn",
 ]
 
@@ -2264,15 +2205,15 @@ dependencies = [
 
 [[package]]
 name = "sysctl"
-version = "0.6.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01198a2debb237c62b6826ec7081082d951f46dbb64b0e8c7649a452230d1dfc"
+checksum = "cca424247104946a59dacd27eaad296223b7feec3d168a6dd04585183091eb0b"
 dependencies = [
  "bitflags",
  "byteorder",
  "enum-as-inner",
  "libc",
- "thiserror 1.0.69",
+ "thiserror 2.0.16",
  "walkdir",
 ]
 
@@ -2307,12 +2248,6 @@ dependencies = [
  "xattr",
 ]
 
-[[package]]
-name = "target-lexicon"
-version = "0.12.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
-
 [[package]]
 name = "target-lexicon"
 version = "0.13.3"
@@ -2328,7 +2263,7 @@ dependencies = [
  "fastrand",
  "getrandom 0.3.3",
  "once_cell",
- "rustix 1.1.2",
+ "rustix",
  "windows-sys 0.61.0",
 ]
 
@@ -2880,13 +2815,12 @@ dependencies = [
 
 [[package]]
 name = "which"
-version = "6.0.3"
+version = "8.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ee928febd44d98f2f459a4a79bd4d928591333a494a10a868418ac1b39cf1f"
+checksum = "d3fabb953106c3c8eea8306e4393700d7657561cb43122571b172bbfb7c7ba1d"
 dependencies = [
- "either",
- "home",
- "rustix 0.38.44",
+ "env_home",
+ "rustix",
  "winsafe",
 ]
 
@@ -3341,7 +3275,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "af3a19837351dc82ba89f8a125e22a3c475f05aba604acc023d62b2739ae2909"
 dependencies = [
  "libc",
- "rustix 1.1.2",
+ "rustix",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index c0337b2e2..07ecbfab1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -25,15 +25,15 @@ color-eyre = { version = "0.6.2", default-features = false, features = [ "track-
 detsys-ids-client = { version = "0.6", optional = true }
 eyre = { version = "0.6.8", default-features = false, features = [ "track-caller" ], optional = true }
 glob = { version = "0.3.0", default-features = false }
-nix = { version = "0.29.0", default-features = false, features = ["user", "fs", "process", "term"] }
+nix = { version = "0.30.1", default-features = false, features = ["user", "fs", "process", "term"] }
 owo-colors = { version = "4.0.0", default-features = false, features = [ "supports-colors" ] }
 reqwest = { version = "0.12.4", default-features = false, features = ["rustls-tls-native-roots", "stream", "socks"] }
 serde = { version = "1.0.203", default-features = false, features = [ "std", "derive" ] }
 serde_json = { version = "1.0.120", default-features = false, features = [ "std" ] }
 serde_with = { version = "3", default-features = false, features = [ "std", "macros" ] }
 tar = { version = "0.4.38", default-features = false, features = [ "xattr" ] }
-target-lexicon = { version = "0.12.4", default-features = false, features = [ "std" ] }
-thiserror = { version = "1.0.61", default-features = false }
+target-lexicon = { version = "0.13.3", default-features = false, features = [ "std" ] }
+thiserror = { version = "2.0.16", default-features = false }
 tokio = { version = "1.21.0", default-features = false, features = ["time", "io-std", "process", "fs", "signal", "tracing", "rt-multi-thread", "macros", "io-util", "parking_lot" ] }
 tracing = { version = "0.1.36", default-features = false, features = [ "std", "attributes" ] }
 tracing-error = { version = "0.2.0", default-features = false, optional = true, features = ["traced-error"] }
@@ -41,19 +41,19 @@ tracing-subscriber = { version = "0.3.15", default-features = false, features =
 url = { version = "2.3.1", default-features = false, features = ["serde"] }
 xz2 = { version = "0.1.7", default-features = false, features = ["static", "tokio"] }
 plist = { version = "=1.7.2", default-features = false, features = [ "serde" ]}
-dirs = { version = "5.0.0", default-features = false }
+dirs = { version = "6.0.0", default-features = false }
 typetag = { version = "0.2.17", default-features = false }
 dyn-clone = { version = "1.0.9", default-features = false }
-rand = { version = "0.8.5", default-features = false, features = [ "std", "std_rng" ] }
+rand = { version = "0.9.2", default-features = false, features = [ "std", "std_rng" ] }
 semver = { version = "1.0.23", default-features = false, features = ["serde", "std"] }
 term = { version = "1.0.0", default-features = false }
 uuid = { version = "1.2.2", features = ["serde"] }
 os-release = { version = "0.1.0", default-features = false }
 is_ci = { version = "1.1.1", default-features = false, optional = true }
-strum = { version = "0.26.1", features = ["derive"] }
+strum = { version = "0.27.2", features = ["derive"] }
 nix-config-parser = { version = "0.2", features = ["serde"] }
-which = "6.0.0"
-sysctl = "0.6.0"
+which = "8.0.0"
+sysctl = "0.7.1"
 walkdir = "2.3.3"
 indexmap = { version = "2.0.2", features = ["serde"] }
 once_cell = "1.19.0"
diff --git a/README.md b/README.md
index 35baec81f..1eef5ad30 100644
--- a/README.md
+++ b/README.md
@@ -56,7 +56,7 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: DeterminateSystems/determinate-nix-action@v3
       - name: Run `nix build`
         run: nix build .
@@ -74,7 +74,7 @@ jobs:
 #### Pinning the GitHub Action
 
 The [determinate-nix-action] is updated and tagged for every Determinate release.
-For example, `DeterminateSystems/determinate-nix-action@v3.5.2` will always install Determinate Nix v3.5.2.
+For example, `DeterminateSystems/determinate-nix-action@v3.11.2` will always install Determinate Nix v3.11.2.
 
 Additionally, an extra tag on the major version is kept up to date with the current release.
 The `DeterminateSystems/determinate-nix-action@v3` reference, for example, installs the most recent release in the `v3.x.y` series.
@@ -348,7 +348,7 @@ You can pin to a specific version of Determinate Nix Installer by modifying the
 Here's an example:
 
 ```shell
-VERSION="v0.6.0"
+VERSION="v3.11.2"
 curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix/tag/${VERSION} | \
   sh -s -- install
 ```
diff --git a/docs/building.md b/docs/building.md
index c11e13b5d..e977d6791 100644
--- a/docs/building.md
+++ b/docs/building.md
@@ -13,7 +13,7 @@ nix build -L ".#nix-installer-static"
 # to build the remote main development branch
 nix build -L "github:determinatesystems/nix-installer#nix-installer-static"
 # for a specific version of the installer:
-export NIX_INSTALLER_TAG="v0.6.0"
+export NIX_INSTALLER_TAG="v3.11.2"
 nix build -L "github:determinatesystems/nix-installer/$NIX_INSTALLER_TAG#nix-installer-static"
 ```
 
@@ -25,7 +25,7 @@ nix build -L ".#nix-installer"
 # to build the remote main development branch
 nix build -L "github:determinatesystems/nix-installer#nix-installer"
 # for a specific version of the installer:
-export NIX_INSTALLER_TAG="v0.6.0"
+export NIX_INSTALLER_TAG="v3.11.2"
 nix build -L "github:determinatesystems/nix-installer/$NIX_INSTALLER_TAG#nix-installer"
 ```
 
@@ -41,7 +41,7 @@ RUSTFLAGS="--cfg tokio_unstable" cargo run -- --help
 RUSTFLAGS="--cfg tokio_unstable" cargo install --git https://github.com/DeterminateSystems/nix-installer
 nix-installer --help
 # for a specific version of the installer:
-export NIX_INSTALLER_TAG="v0.6.0"
+export NIX_INSTALLER_TAG="v3.11.2"
 RUSTFLAGS="--cfg tokio_unstable" cargo install --git https://github.com/DeterminateSystems/nix-installer --tag $NIX_INSTALLER_TAG
 nix-installer --help
 ```
diff --git a/docs/rust-library.md b/docs/rust-library.md
index e84d98673..7ee4bb70b 100644
--- a/docs/rust-library.md
+++ b/docs/rust-library.md
@@ -21,7 +21,7 @@ You'll also need to edit your `.cargo/config.toml` to use `tokio_unstable` as we
 rustflags=["--cfg", "tokio_unstable"]
 ```
 
-You'll also need to set the `NIX_INSTALLER_TARBALL_PATH` environment variable to point to a target-appropriate Nix installation tarball, like nix-2.21.2-aarch64-darwin.tar.xz.
+You'll also need to set the `DETERMINATE_NIX_TARBALL_PATH` environment variable to point to a target-appropriate Nix installation tarball, like nix-2.31.1-aarch64-darwin.tar.xz.
 The contents are embedded in the resulting binary instead of downloaded at installation time.
 
 Then it's possible to review the [documentation]:
@@ -40,5 +40,5 @@ firefox result-doc/nix-installer/index.html
 [clap]: https://clap.rs
 [documentation]: https://docs.rs/nix-installer/latest/nix_installer
 [lib]: https://docs.rs/nix-installer
-[process-groups]: https://docs.rs/tokio/1.24.1/tokio/process/struct.Command.html#method.process_group
+[process-groups]: https://docs.rs/tokio/latest/tokio/process/struct.Command.html#method.process_group
 [rust]: https://rust-lang.com
diff --git a/flake.lock b/flake.lock
index 565638fee..567000c6c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,16 +2,16 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1734808813,
-        "narHash": "sha256-3aH/0Y6ajIlfy7j52FGZ+s4icVX0oHhqBzRdlOeztqg=",
+        "lastModified": 1758758545,
+        "narHash": "sha256-NU5WaEdfwF6i8faJ2Yh+jcK9vVFrofLcwlD/mP65JrI=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "72e2d02dbac80c8c86bf6bf3e785536acf8ee926",
+        "rev": "95d528a5f54eaba0d12102249ce42f4d01f4e364",
         "type": "github"
       },
       "original": {
         "owner": "ipetkov",
-        "ref": "v0.20.0",
+        "ref": "v0.21.1",
         "repo": "crane",
         "type": "github"
       }
@@ -210,16 +210,16 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1746328495,
-        "narHash": "sha256-uKCfuDs7ZM3QpCE/jnfubTg459CnKnJG/LwqEVEdEiw=",
-        "rev": "979daf34c8cacebcd917d540070b52a3c2b9b16e",
-        "revCount": 793735,
+        "lastModified": 1758589230,
+        "narHash": "sha256-zMTCFGe8aVGTEr2RqUi/QzC1nOIQ0N1HRsbqB4f646k=",
+        "rev": "d1d883129b193f0b495d75c148c2c3a7d95789a0",
+        "revCount": 810308,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.793735%2Brev-979daf34c8cacebcd917d540070b52a3c2b9b16e/01969d23-5ba8-7fc5-8c51-ca8a03c73413/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2505.810308%2Brev-d1d883129b193f0b495d75c148c2c3a7d95789a0/01997816-a6f6-7040-8535-2ae74ed9bd44/source.tar.gz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://flakehub.com/f/NixOS/nixpkgs/%3D0.1.793735"
+        "url": "https://flakehub.com/f/NixOS/nixpkgs/%3D0.2505.810308"
       }
     },
     "root": {
diff --git a/flake.nix b/flake.nix
index 501288068..c9dcab63b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,9 +2,9 @@
   description = "The Determinate Nix Installer";
 
   inputs = {
-    nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/=0.1.793735";
+    nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/=0.2505.810308";
 
-    crane.url = "github:ipetkov/crane/v0.20.0";
+    crane.url = "github:ipetkov/crane/v0.21.1";
 
     nix = {
       url = "https://flakehub.com/f/DeterminateSystems/nix-src/*";
@@ -123,7 +123,7 @@
               rust-analyzer
               cargo-outdated
               cacert
-              # cargo-audit # NOTE(cole-h): build currently broken because of time dependency and Rust 1.80
+              cargo-audit
               cargo-watch
               nixpkgs-fmt
               check.check-rustfmt
diff --git a/nix/tests/container-test/default.nix b/nix/tests/container-test/default.nix
index 6bfb4c43b..c0cd55e53 100644
--- a/nix/tests/container-test/default.nix
+++ b/nix/tests/container-test/default.nix
@@ -5,31 +5,21 @@ let
   images = {
 
     # Found via https://hub.docker.com/_/ubuntu/ under "How is the rootfs build?"
-    # Jammy
-    "ubuntu-v22_04" = {
+    # Noble
+    "ubuntu-v24_04" = {
       tarball = builtins.fetchurl {
-        url = "http://cdimage.ubuntu.com/ubuntu-base/releases/22.04/release/ubuntu-base-22.04-base-amd64.tar.gz";
-        sha256 = "01sbpjb32x1z1yr9q78zrk0a6kfw5c4fxw1jqmm23g8ixryffvyz";
+        url = "https://cdimage.ubuntu.com/ubuntu-base/releases/24.04/release/ubuntu-base-24.04.3-base-amd64.tar.gz";
+        sha256 = "1ybl31qj4ixyxi89h80gh71mpllnkqklbyj6pfrqil0ajgiwvhkb";
       };
       tester = ./default/Dockerfile;
       system = "x86_64-linux";
     };
 
-    # focal
-    "ubuntu-v20_04" = {
-      tarball = builtins.fetchurl {
-        url = "http://cdimage.ubuntu.com/ubuntu-base/releases/20.04/release/ubuntu-base-20.04.1-base-amd64.tar.gz";
-        sha256 = "0ryn38csmx41a415g9b3wk30csaxxlkgkdij9v4754pk877wpxlp";
-      };
-      tester = ./default/Dockerfile;
-      system = "x86_64-linux";
-    };
-
-    # bionic
-    "ubuntu-v18_04" = {
+    # Jammy
+    "ubuntu-v22_04" = {
       tarball = builtins.fetchurl {
-        url = "http://cdimage.ubuntu.com/ubuntu-base/releases/18.04/release/ubuntu-base-18.04.5-base-amd64.tar.gz";
-        sha256 = "1sh73pqwgyzkyssv3ngpxa2ynnkbdvjpxdw1v9ql4ghjpd3hpwlg";
+        url = "https://cdimage.ubuntu.com/ubuntu-base/releases/22.04/release/ubuntu-base-22.04.5-base-amd64.tar.gz";
+        sha256 = "06pz70j6jrki5x2q90yii7wzjxkwxmv10fziymp81sikif4xhb14";
       };
       tester = ./default/Dockerfile;
       system = "x86_64-linux";
@@ -97,4 +87,3 @@ container-tests // {
     });
   };
 }
-
diff --git a/nix/tests/vm-test/default.nix b/nix/tests/vm-test/default.nix
index c6f8ae24c..fb5f2a7f0 100644
--- a/nix/tests/vm-test/default.nix
+++ b/nix/tests/vm-test/default.nix
@@ -438,23 +438,10 @@ let
   images = {
 
     # End of standard support https://wiki.ubuntu.com/Releases
-    # No systemd
-    /*
-      "ubuntu-v14_04" = {
+    "ubuntu-v20_04" = {
       image = import <nix/fetchurl.nix> {
-      url = "https://app.vagrantup.com/ubuntu/boxes/trusty64/versions/20190514.0.0/providers/virtualbox.box";
-      hash = "sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8=";
-      };
-      rootDisk = "box-disk1.vmdk";
-      system = "x86_64-linux";
-      };
-    */
-
-    # End of standard support https://wiki.ubuntu.com/Releases
-    "ubuntu-v16_04" = {
-      image = import <nix/fetchurl.nix> {
-        url = "https://app.vagrantup.com/generic/boxes/ubuntu1604/versions/4.1.12/providers/libvirt.box";
-        hash = "sha256-lO4oYQR2tCh5auxAYe6bPOgEqOgv3Y3GC1QM1tEEEU8=";
+        url = "https://app.vagrantup.com/generic/boxes/ubuntu2004/versions/4.3.12/providers/libvirt.box";
+        hash = "sha256-lo6fkz6N/Q9mdD+RWoUssak9TVod0F7QSgZvxnMj9IQ=";
       };
       rootDisk = "box.img";
       system = "x86_64-linux";
@@ -462,64 +449,37 @@ let
 
     "ubuntu-v22_04" = {
       image = import <nix/fetchurl.nix> {
-        url = "https://app.vagrantup.com/generic/boxes/ubuntu2204/versions/4.1.12/providers/libvirt.box";
-        hash = "sha256-HNll0Qikw/xGIcogni5lz01vUv+R3o8xowP2EtqjuUQ=";
-      };
-      rootDisk = "box.img";
-      system = "x86_64-linux";
-    };
-
-    "fedora-v36" = {
-      image = import <nix/fetchurl.nix> {
-        url = "https://app.vagrantup.com/generic/boxes/fedora36/versions/4.1.12/providers/libvirt.box";
-        hash = "sha256-rxPgnDnFkTDwvdqn2CV3ZUo3re9AdPtSZ9SvOHNvaks=";
+        url = "https://app.vagrantup.com/generic/boxes/ubuntu2204/versions/4.3.12/providers/libvirt.box";
+        hash = "sha256-xiUt25lRPIpM/HKepJbS15Pp9+PraPR1BLT6lVZko5k=";
       };
       rootDisk = "box.img";
       system = "x86_64-linux";
-      upstreamScriptsWork = false; # SELinux!
     };
 
-    "fedora-v37" = {
+    "fedora-v38" = {
       image = import <nix/fetchurl.nix> {
-        url = "https://app.vagrantup.com/generic/boxes/fedora37/versions/4.2.14/providers/libvirt.box";
-        hash = "sha256-rxPgnDnFkTDwvdqn2CV3ZUo3re9AdPtSZ9SvOHNvaks=";
+        url = "https://app.vagrantup.com/generic/boxes/fedora38/versions/4.3.12/providers/libvirt.box";
+        hash = "sha256-nz+sW771/P6yeUJmpfUYSTYxLFgq0mkfu8h/mflhPV8=";
       };
       rootDisk = "box.img";
       system = "x86_64-linux";
       upstreamScriptsWork = false; # SELinux!
     };
 
-    # Currently fails with 'error while loading shared libraries:
-    # libsodium.so.23: cannot stat shared object: Invalid argument'.
-    /*
-      "rhel-v6" = {
+    "fedora-v39" = {
       image = import <nix/fetchurl.nix> {
-      url = "https://app.vagrantup.com/generic/boxes/rhel6/versions/4.1.12/providers/libvirt.box";
-      hash = "sha256-QwzbvRoRRGqUCQptM7X/InRWFSP2sqwRt2HaaO6zBGM=";
+        url = "https://app.vagrantup.com/generic/boxes/fedora39/versions/4.3.12/providers/libvirt.box";
+        hash = "sha256-VJbWmcy3XiEm7cUAXtod8VlFwsIwnVYlZ/LYTuoj9WI=";
       };
       rootDisk = "box.img";
-      upstreamScriptsWork = false; # SELinux!
       system = "x86_64-linux";
-      };
-    */
-
-    "rhel-v7" = {
-      image = import <nix/fetchurl.nix> {
-        url = "https://app.vagrantup.com/generic/boxes/rhel7/versions/4.1.12/providers/libvirt.box";
-        hash = "sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U=";
-      };
-      rootDisk = "box.img";
       upstreamScriptsWork = false; # SELinux!
-      system = "x86_64-linux";
-      skip = [
-        "install-determinate" # RHEL v7 has systemd 219 (2015-02-16); determinate-nixd requires at least 227 (2015-10-07)
-      ];
     };
 
     "rhel-v8" = {
       image = import <nix/fetchurl.nix> {
-        url = "https://app.vagrantup.com/generic/boxes/rhel8/versions/4.1.12/providers/libvirt.box";
-        hash = "sha256-zFOPjSputy1dPgrQRixBXmlyN88cAKjJ21VvjSWUCUY=";
+        url = "https://app.vagrantup.com/generic/boxes/rhel8/versions/4.3.12/providers/libvirt.box";
+        hash = "sha256-1BTKt196Qb381zkyzPTOzzbnMGbIloebEpyycLu2myY=";
       };
       rootDisk = "box.img";
       system = "x86_64-linux";
@@ -528,8 +488,8 @@ let
 
     "rhel-v9" = {
       image = import <nix/fetchurl.nix> {
-        url = "https://app.vagrantup.com/generic/boxes/rhel9/versions/4.1.12/providers/libvirt.box";
-        hash = "sha256-vL/FbB3kK1rcSaR627nWmScYGKGk4seSmAdq6N5diMg=";
+        url = "https://app.vagrantup.com/generic/boxes/rhel9/versions/4.3.12/providers/libvirt.box";
+        hash = "sha256-Gp3VSqSOnyysHFqQDoeBjYrshEHfqQw3XPzS3VxZaPA=";
       };
       rootDisk = "box.img";
       system = "x86_64-linux";
diff --git a/src/action/base/add_user_to_group.rs b/src/action/base/add_user_to_group.rs
index 16662d868..7b6126a14 100644
--- a/src/action/base/add_user_to_group.rs
+++ b/src/action/base/add_user_to_group.rs
@@ -38,7 +38,7 @@ impl AddUserToGroup {
         };
 
         match OperatingSystem::host() {
-            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => (),
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => (),
             _ => {
                 if !(which::which("addgroup").is_ok() || which::which("gpasswd").is_ok()) {
                     return Err(Self::error(ActionErrorKind::MissingAddUserToGroupCommand));
@@ -74,12 +74,7 @@ impl AddUserToGroup {
 
             // See if group membership needs to be done
             match OperatingSystem::host() {
-                OperatingSystem::MacOSX {
-                    major: _,
-                    minor: _,
-                    patch: _,
-                }
-                | OperatingSystem::Darwin => {
+                OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => {
                     let mut command = Command::new("/usr/sbin/dseditgroup");
                     command.process_group(0);
                     command.args(["-o", "checkmember", "-m"]);
@@ -144,7 +139,7 @@ impl AddUserToGroup {
                     .await
                     .map_err(Self::error)?;
                     let output_str = String::from_utf8(output.stdout).map_err(Self::error)?;
-                    let user_in_group = output_str.split(' ').any(|v| v == this.groupname);
+                    let user_in_group = output_str.split_whitespace().any(|v| v == this.groupname);
 
                     if user_in_group {
                         tracing::debug!(
@@ -199,12 +194,7 @@ impl Action for AddUserToGroup {
     async fn execute(&mut self) -> Result<(), ActionError> {
         use target_lexicon::OperatingSystem;
         match OperatingSystem::host() {
-            OperatingSystem::MacOSX {
-                major: _,
-                minor: _,
-                patch: _,
-            }
-            | OperatingSystem::Darwin => {
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => {
                 execute_command(
                     Command::new("/usr/bin/dscl")
                         .process_group(0)
@@ -252,9 +242,7 @@ impl Action for AddUserToGroup {
                     .await
                     .map_err(Self::error)?;
                 } else {
-                    return Err(Self::error(Self::error(
-                        ActionErrorKind::MissingAddUserToGroupCommand,
-                    )));
+                    return Err(Self::error(ActionErrorKind::MissingAddUserToGroupCommand));
                 }
             },
         }
@@ -285,12 +273,7 @@ impl Action for AddUserToGroup {
 
         use target_lexicon::OperatingSystem;
         match target_lexicon::OperatingSystem::host() {
-            OperatingSystem::MacOSX {
-                major: _,
-                minor: _,
-                patch: _,
-            }
-            | OperatingSystem::Darwin => {
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => {
                 execute_command(
                     Command::new("/usr/bin/dscl")
                         .process_group(0)
diff --git a/src/action/base/create_directory.rs b/src/action/base/create_directory.rs
index cbe718d27..2c0022a75 100644
--- a/src/action/base/create_directory.rs
+++ b/src/action/base/create_directory.rs
@@ -77,7 +77,7 @@ impl CreateDirectory {
                 let expected_gid = Group::from_name(group.as_str())
                     .map_err(|e| ActionErrorKind::GettingGroupId(group.clone(), e))
                     .map_err(Self::error)?
-                    .ok_or_else(|| ActionErrorKind::NoUser(group.clone()))
+                    .ok_or_else(|| ActionErrorKind::NoGroup(group.clone()))
                     .map_err(Self::error)?
                     .gid;
                 let found_gid = metadata.gid();
@@ -301,7 +301,7 @@ async fn path_is_mountpoint(path: &Path) -> Result<bool, ActionErrorKind> {
     };
 
     let mut mount_command = match OperatingSystem::host() {
-        OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => {
+        OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => {
             let mut cmd = Command::new("/sbin/mount");
             cmd.arg("-d"); // `-d` means `--dry-run`
             cmd
@@ -331,7 +331,7 @@ async fn path_is_mountpoint(path: &Path) -> Result<bool, ActionErrorKind> {
 
         let split_token = match OperatingSystem::host() {
             // Each line on MacOS looks like `/dev/disk3s6 on /System/Volumes/VM (apfs, local, noexec, journaled, noatime, nobrowse)`
-            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => "(",
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => "(",
             // Each line on Linux looks like `portal on /run/user/1000/doc type fuse.portal (rw,nosuid,nodev,relatime,user_id=1000,group_id=100)`
             _ => "type",
         };
diff --git a/src/action/base/create_file.rs b/src/action/base/create_file.rs
index 9fe7a7766..7810e7674 100644
--- a/src/action/base/create_file.rs
+++ b/src/action/base/create_file.rs
@@ -110,7 +110,7 @@ impl CreateFile {
                 let expected_gid = Group::from_name(group.as_str())
                     .map_err(|e| ActionErrorKind::GettingGroupId(group.clone(), e))
                     .map_err(Self::error)?
-                    .ok_or_else(|| ActionErrorKind::NoUser(group.clone()))
+                    .ok_or_else(|| ActionErrorKind::NoGroup(group.clone()))
                     .map_err(Self::error)?
                     .gid;
                 let found_gid = metadata.gid();
diff --git a/src/action/base/create_group.rs b/src/action/base/create_group.rs
index d54e67539..5b58764de 100644
--- a/src/action/base/create_group.rs
+++ b/src/action/base/create_group.rs
@@ -27,7 +27,7 @@ impl CreateGroup {
         };
 
         match OperatingSystem::host() {
-            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => (),
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => (),
             _ => {
                 if !(which::which("groupadd").is_ok() || which::which("addgroup").is_ok()) {
                     return Err(Self::error(ActionErrorKind::MissingGroupCreationCommand));
@@ -92,12 +92,7 @@ impl Action for CreateGroup {
 
         use OperatingSystem;
         match OperatingSystem::host() {
-            OperatingSystem::MacOSX {
-                major: _,
-                minor: _,
-                patch: _,
-            }
-            | OperatingSystem::Darwin => {
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => {
                 execute_command(
                     Command::new("/usr/sbin/dseditgroup")
                         .process_group(0)
@@ -159,12 +154,7 @@ impl Action for CreateGroup {
 
         use OperatingSystem;
         match OperatingSystem::host() {
-            OperatingSystem::MacOSX {
-                major: _,
-                minor: _,
-                patch: _,
-            }
-            | OperatingSystem::Darwin => {
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => {
                 execute_command(
                     Command::new("/usr/bin/dscl")
                         .args([".", "-delete", &format!("/Groups/{name}")])
diff --git a/src/action/base/create_or_insert_into_file.rs b/src/action/base/create_or_insert_into_file.rs
index 3c3687591..1b0bdfe78 100644
--- a/src/action/base/create_or_insert_into_file.rs
+++ b/src/action/base/create_or_insert_into_file.rs
@@ -117,7 +117,7 @@ impl CreateOrInsertIntoFile {
                 let expected_gid = Group::from_name(group.as_str())
                     .map_err(|e| ActionErrorKind::GettingGroupId(group.clone(), e))
                     .map_err(Self::error)?
-                    .ok_or_else(|| ActionErrorKind::NoUser(group.clone()))
+                    .ok_or_else(|| ActionErrorKind::NoGroup(group.clone()))
                     .map_err(Self::error)?
                     .gid;
                 let found_gid = metadata.gid();
@@ -212,8 +212,8 @@ impl Action for CreateOrInsertIntoFile {
 
         let mut temp_file_path = parent_dir.to_owned();
         {
-            let mut rng = rand::thread_rng();
-            temp_file_path.push(format!("nix-installer-tmp.{}", rng.gen::<u32>()));
+            let mut rng = rand::rng();
+            temp_file_path.push(format!("nix-installer-tmp.{}", rng.random::<u32>()));
         }
         let mut temp_file = OpenOptions::new()
             .create(true)
diff --git a/src/action/base/create_or_merge_nix_config.rs b/src/action/base/create_or_merge_nix_config.rs
index fac59841e..98c8ce06b 100644
--- a/src/action/base/create_or_merge_nix_config.rs
+++ b/src/action/base/create_or_merge_nix_config.rs
@@ -28,8 +28,8 @@ const NIX_CONF_COMMENT_CHAR: char = '#';
 pub enum CreateOrMergeNixConfigError {
     #[error(transparent)]
     ParseNixConfig(#[from] nix_config_parser::ParseError),
-    #[error("Could not merge Nix configuration for key(s) {}; consider removing them from `{1}` in your editor, or removing your existing configuration with `rm {1}`",
-        .0
+    #[error("Could not merge Nix configuration for key(s) {keys}; consider removing them from `{1}` in your editor, or removing your existing configuration with `rm {1}`",
+        keys = .0
         .iter()
         .map(|v| format!("`{v}`"))
         .collect::<Vec<_>>()
@@ -294,8 +294,8 @@ impl Action for CreateOrMergeNixConfig {
         let parent_dir = self.path.parent().expect("File must be in a directory");
         let mut temp_file_path = parent_dir.to_owned();
         {
-            let mut rng = rand::thread_rng();
-            temp_file_path.push(format!("nix-installer-tmp.{}", rng.gen::<u32>()));
+            let mut rng = rand::rng();
+            temp_file_path.push(format!("nix-installer-tmp.{}", rng.random::<u32>()));
         }
         let mut temp_file = OpenOptions::new()
             .create(true)
diff --git a/src/action/base/create_user.rs b/src/action/base/create_user.rs
index 664f9aa07..b0a1b95b1 100644
--- a/src/action/base/create_user.rs
+++ b/src/action/base/create_user.rs
@@ -45,7 +45,7 @@ impl CreateUser {
         };
 
         match OperatingSystem::host() {
-            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => (),
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => (),
             _ => {
                 if !(which::which("useradd").is_ok() || which::which("adduser").is_ok()) {
                     return Err(Self::error(ActionErrorKind::MissingUserCreationCommand));
@@ -131,7 +131,7 @@ impl Action for CreateUser {
         } = self;
 
         match OperatingSystem::host() {
-            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => {
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => {
                 create_user_macos(name, *uid, *gid)
                     .await
                     .map_err(Self::error)?;
@@ -212,7 +212,7 @@ impl Action for CreateUser {
     #[tracing::instrument(level = "debug", skip_all)]
     async fn revert(&mut self) -> Result<(), ActionError> {
         match OperatingSystem::host() {
-            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => {
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => {
                 delete_user_macos(&self.name).await.map_err(Self::error)?;
             },
             _ => {
diff --git a/src/action/base/delete_user.rs b/src/action/base/delete_user.rs
index 077c6f80c..bcd6c9594 100644
--- a/src/action/base/delete_user.rs
+++ b/src/action/base/delete_user.rs
@@ -24,7 +24,7 @@ impl DeleteUser {
         let this = Self { name: name.clone() };
 
         match OperatingSystem::host() {
-            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => (),
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => (),
             _ => {
                 if !(which::which("userdel").is_ok() || which::which("deluser").is_ok()) {
                     return Err(Self::error(ActionErrorKind::MissingUserDeletionCommand));
@@ -75,7 +75,7 @@ impl Action for DeleteUser {
     #[tracing::instrument(level = "debug", skip_all)]
     async fn execute(&mut self) -> Result<(), ActionError> {
         match OperatingSystem::host() {
-            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => {
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => {
                 delete_user_macos(&self.name).await.map_err(Self::error)?;
             },
             _ => {
diff --git a/src/action/common/create_users_and_groups.rs b/src/action/common/create_users_and_groups.rs
index 47d5d8f7b..f748c944f 100644
--- a/src/action/common/create_users_and_groups.rs
+++ b/src/action/common/create_users_and_groups.rs
@@ -155,12 +155,7 @@ impl Action for CreateUsersAndGroups {
         // Mac is apparently not threadsafe here...
         use target_lexicon::OperatingSystem;
         match OperatingSystem::host() {
-            OperatingSystem::MacOSX {
-                major: _,
-                minor: _,
-                patch: _,
-            }
-            | OperatingSystem::Darwin => {
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => {
                 for create_user in create_users.iter_mut() {
                     create_user.try_execute().await.map_err(Self::error)?;
                 }
diff --git a/src/action/common/place_nix_configuration.rs b/src/action/common/place_nix_configuration.rs
index 01a5370cb..a9708ac04 100644
--- a/src/action/common/place_nix_configuration.rs
+++ b/src/action/common/place_nix_configuration.rs
@@ -54,7 +54,7 @@ impl PlaceNixConfiguration {
         let is_macos = matches!(
             target_lexicon::OperatingSystem::host(),
             target_lexicon::OperatingSystem::MacOSX { .. }
-                | target_lexicon::OperatingSystem::Darwin
+                | target_lexicon::OperatingSystem::Darwin(_)
         );
         let configured_ssl_cert_file = if distribution == Distribution::DeterminateNix && is_macos {
             // On macOS, determinate-nixd will handle configuring the ssl-cert-file option for Nix
diff --git a/src/action/macos/encrypt_apfs_volume.rs b/src/action/macos/encrypt_apfs_volume.rs
index 57ca4a0b9..599ef0e9f 100644
--- a/src/action/macos/encrypt_apfs_volume.rs
+++ b/src/action/macos/encrypt_apfs_volume.rs
@@ -162,11 +162,11 @@ impl Action for EncryptApfsVolume {
                                 abcdefghijklmnopqrstuvwxyz\
                                     0123456789)(*&^%$#@!~";
             const PASSWORD_LEN: usize = 32;
-            let mut rng = rand::thread_rng();
+            let mut rng = rand::rng();
 
             (0..PASSWORD_LEN)
                 .map(|_| {
-                    let idx = rng.gen_range(0..CHARSET.len());
+                    let idx = rng.random_range(0..CHARSET.len());
                     CHARSET[idx] as char
                 })
                 .collect()
diff --git a/src/action/macos/kickstart_launchctl_service.rs b/src/action/macos/kickstart_launchctl_service.rs
index 6cd46bb45..916d45419 100644
--- a/src/action/macos/kickstart_launchctl_service.rs
+++ b/src/action/macos/kickstart_launchctl_service.rs
@@ -139,6 +139,6 @@ impl Action for KickstartLaunchctlService {
 
 #[derive(Debug, thiserror::Error)]
 pub enum KickstartLaunchctlServiceError {
-    #[error("Command `{0}` failed, stderr: {}", String::from_utf8(.1.stderr.clone()).unwrap_or_else(|_e| String::from("<Non-UTF-8>")))]
+    #[error("Command `{0}` failed, stderr: {msg}", msg = String::from_utf8(.1.stderr.clone()).unwrap_or_else(|_e| String::from("<Non-UTF-8>")))]
     CannotStopService(String, Output),
 }
diff --git a/src/action/mod.rs b/src/action/mod.rs
index 6d4e82d17..d96c4af12 100644
--- a/src/action/mod.rs
+++ b/src/action/mod.rs
@@ -162,7 +162,7 @@ impl Planner for MyPlanner {
     async fn platform_check(&self) -> Result<(), PlannerError> {
         use target_lexicon::OperatingSystem;
         match target_lexicon::OperatingSystem::host() {
-            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => Ok(()),
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => Ok(()),
             host_os => Err(PlannerError::IncompatibleOperatingSystem {
                 planner: self.typetag_name(),
                 host_os,
diff --git a/src/cli/mod.rs b/src/cli/mod.rs
index f3de2fb7a..a749aac3d 100644
--- a/src/cli/mod.rs
+++ b/src/cli/mod.rs
@@ -124,7 +124,7 @@ impl CommandExecute for NixInstallerCli {
         let is_macos = matches!(
             target_lexicon::OperatingSystem::host(),
             target_lexicon::OperatingSystem::MacOSX { .. }
-                | target_lexicon::OperatingSystem::Darwin
+                | target_lexicon::OperatingSystem::Darwin(_)
         );
 
         if is_install_subcommand && is_macos {
diff --git a/src/cli/subcommand/install/determinate.rs b/src/cli/subcommand/install/determinate.rs
index 99719c36f..91db656d1 100644
--- a/src/cli/subcommand/install/determinate.rs
+++ b/src/cli/subcommand/install/determinate.rs
@@ -27,7 +27,7 @@ For more details: https://dtr.mn/determinate-nix\
 pub(crate) async fn inform_macos_about_pkg<T: Feedback>(feedback: &T) {
     if matches!(
         target_lexicon::OperatingSystem::host(),
-        target_lexicon::OperatingSystem::MacOSX { .. } | target_lexicon::OperatingSystem::Darwin
+        target_lexicon::OperatingSystem::MacOSX { .. } | target_lexicon::OperatingSystem::Darwin(_)
     ) {
         let msg = feedback
             .get_feature_ptr_payload::<String>("dni-det-msg-start-pkg-ptr")
diff --git a/src/cli/subcommand/repair.rs b/src/cli/subcommand/repair.rs
index fdef21e9c..9e8eb5e21 100644
--- a/src/cli/subcommand/repair.rs
+++ b/src/cli/subcommand/repair.rs
@@ -195,7 +195,7 @@ impl CommandExecute for Repair {
                 repair_actions.push(reconfigure);
 
                 match OperatingSystem::host() {
-                    OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => {
+                    OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => {
                         let reconfigure = crate::action::macos::ConfigureRemoteBuilding::plan()
                             .await
                             .map_err(PlannerError::Action)?
@@ -217,7 +217,7 @@ impl CommandExecute for Repair {
             } => {
                 if !matches!(
                     OperatingSystem::host(),
-                    OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin
+                    OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_)
                 ) {
                     return Err(color_eyre::eyre::eyre!(
                         "The `sequoia` repair command is only available on macOS"
diff --git a/src/cli/subcommand/uninstall.rs b/src/cli/subcommand/uninstall.rs
index be511d9b8..d2454ec4a 100644
--- a/src/cli/subcommand/uninstall.rs
+++ b/src/cli/subcommand/uninstall.rs
@@ -84,11 +84,11 @@ impl CommandExecute for Uninstall {
                                         abcdefghijklmnopqrstuvwxyz\
                                             0123456789";
                     const PASSWORD_LEN: usize = 16;
-                    let mut rng = rand::thread_rng();
+                    let mut rng = rand::rng();
 
                     (0..PASSWORD_LEN)
                         .map(|_| {
-                            let idx = rng.gen_range(0..CHARSET.len());
+                            let idx = rng.random_range(0..CHARSET.len());
                             CHARSET[idx] as char
                         })
                         .collect()
diff --git a/src/distribution.rs b/src/distribution.rs
index c6cdac78f..7692eb406 100644
--- a/src/distribution.rs
+++ b/src/distribution.rs
@@ -46,7 +46,7 @@ pub const NIX_TARBALL_URL: &str = env!("NIX_TARBALL_URL");
 
 pub const DETERMINATE_NIX_TARBALL_PATH: &str = env!("DETERMINATE_NIX_TARBALL_PATH");
 /// The DETERMINATE_NIX_TARBALL environment variable should point to a target-appropriate
-/// Determinate Nix installation tarball, like determinate-nix-2.21.2-aarch64-darwin.tar.xz.
+/// Determinate Nix installation tarball, like determinate-nix-2.31.1-aarch64-darwin.tar.xz.
 /// The contents are embedded in the resulting binary.
 pub const DETERMINATE_NIX_TARBALL: &[u8] = include_bytes!(env!("DETERMINATE_NIX_TARBALL_PATH"));
 
diff --git a/src/planner/macos/mod.rs b/src/planner/macos/mod.rs
index ff7779159..821bfa8d1 100644
--- a/src/planner/macos/mod.rs
+++ b/src/planner/macos/mod.rs
@@ -380,7 +380,7 @@ impl Planner for Macos {
     async fn platform_check(&self) -> Result<(), PlannerError> {
         use target_lexicon::OperatingSystem;
         match target_lexicon::OperatingSystem::host() {
-            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => Ok(()),
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => Ok(()),
             host_os => Err(PlannerError::IncompatibleOperatingSystem {
                 planner: self.typetag_name(),
                 host_os,
diff --git a/src/planner/mod.rs b/src/planner/mod.rs
index 84ee2b580..8b65f40c3 100644
--- a/src/planner/mod.rs
+++ b/src/planner/mod.rs
@@ -73,7 +73,7 @@ impl Planner for MyPlanner {
     async fn platform_check(&self) -> Result<(), PlannerError> {
         use target_lexicon::OperatingSystem;
         match target_lexicon::OperatingSystem::host() {
-            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => Ok(()),
+            OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => Ok(()),
             host_os => Err(PlannerError::IncompatibleOperatingSystem {
                 planner: self.typetag_name(),
                 host_os,
@@ -185,11 +185,11 @@ impl BuiltinPlanner {
                 Ok(Self::Linux(linux::Linux::default().await?))
             },
             (Architecture::X86_64, OperatingSystem::MacOSX { .. })
-            | (Architecture::X86_64, OperatingSystem::Darwin) => {
+            | (Architecture::X86_64, OperatingSystem::Darwin(_)) => {
                 Ok(Self::Macos(macos::Macos::default().await?))
             },
             (Architecture::Aarch64(_), OperatingSystem::MacOSX { .. })
-            | (Architecture::Aarch64(_), OperatingSystem::Darwin) => {
+            | (Architecture::Aarch64(_), OperatingSystem::Darwin(_)) => {
                 Ok(Self::Macos(macos::Macos::default().await?))
             },
             _ => Err(PlannerError::UnsupportedArchitecture(target_lexicon::HOST)),
@@ -332,7 +332,7 @@ pub struct FishShellProfileLocations {
     under which Fish will look for the file named by
     `confd_suffix`.
 
-    More info: <https://fishshell.com/docs/3.3/index.html#configuration-files>
+    More info: <https://fishshell.com/docs/current/language.html#configuration>
     */
     pub vendor_confd_prefixes: Vec<PathBuf>,
 }
diff --git a/src/profile/nixenv/mod.rs b/src/profile/nixenv/mod.rs
index e1d80ab67..730383c48 100644
--- a/src/profile/nixenv/mod.rs
+++ b/src/profile/nixenv/mod.rs
@@ -267,6 +267,7 @@ impl NixEnv<'_> {
 #[derive(Debug, serde::Deserialize)]
 struct PackageInfo {
     #[serde(default)]
+    #[allow(dead_code)]
     outputs: HashMap<String, PathBuf>,
 }
 
diff --git a/src/profile/nixprofile/mod.rs b/src/profile/nixprofile/mod.rs
index 05ec18735..24c7d0ea2 100644
--- a/src/profile/nixprofile/mod.rs
+++ b/src/profile/nixprofile/mod.rs
@@ -285,6 +285,7 @@ impl NixProfile<'_> {
 #[derive(Debug, serde::Deserialize)]
 struct PackageInfo {
     #[serde(default)]
+    #[allow(dead_code)]
     outputs: HashMap<String, PathBuf>,
 }
 
diff --git a/src/settings.rs b/src/settings.rs
index 3073c4a43..6334efc56 100644
--- a/src/settings.rs
+++ b/src/settings.rs
@@ -193,7 +193,7 @@ pub(crate) fn default_nix_build_user_id_base() -> u32 {
     use target_lexicon::OperatingSystem;
 
     match OperatingSystem::host() {
-        OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => 350,
+        OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => 350,
         _ => 30_000,
     }
 }
@@ -202,7 +202,7 @@ pub(crate) fn default_nix_build_group_id() -> u32 {
     use target_lexicon::OperatingSystem;
 
     match OperatingSystem::host() {
-        OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin => 350,
+        OperatingSystem::MacOSX { .. } | OperatingSystem::Darwin(_) => 350,
         _ => 30_000,
     }
 }
@@ -224,11 +224,11 @@ impl CommonSettings {
                 nix_build_user_prefix = "nixbld";
             },
             (Architecture::X86_64, OperatingSystem::MacOSX { .. })
-            | (Architecture::X86_64, OperatingSystem::Darwin) => {
+            | (Architecture::X86_64, OperatingSystem::Darwin(_)) => {
                 nix_build_user_prefix = "_nixbld";
             },
             (Architecture::Aarch64(_), OperatingSystem::MacOSX { .. })
-            | (Architecture::Aarch64(_), OperatingSystem::Darwin) => {
+            | (Architecture::Aarch64(_), OperatingSystem::Darwin(_)) => {
                 nix_build_user_prefix = "_nixbld";
             },
             _ => {
@@ -400,9 +400,9 @@ impl InitSettings {
                 (InitSystem::Systemd, linux_detect_systemd_started().await)
             },
             (Architecture::X86_64, OperatingSystem::MacOSX { .. })
-            | (Architecture::X86_64, OperatingSystem::Darwin) => (InitSystem::Launchd, true),
+            | (Architecture::X86_64, OperatingSystem::Darwin(_)) => (InitSystem::Launchd, true),
             (Architecture::Aarch64(_), OperatingSystem::MacOSX { .. })
-            | (Architecture::Aarch64(_), OperatingSystem::Darwin) => (InitSystem::Launchd, true),
+            | (Architecture::Aarch64(_), OperatingSystem::Darwin(_)) => (InitSystem::Launchd, true),
             _ => {
                 return Err(InstallSettingsError::UnsupportedArchitecture(
                     target_lexicon::HOST,
diff --git a/tests/windows/test-wsl.ps1 b/tests/windows/test-wsl.ps1
index b3ab95857..0a7600ebb 100644
--- a/tests/windows/test-wsl.ps1
+++ b/tests/windows/test-wsl.ps1
@@ -4,8 +4,8 @@ $ErrorActionPreference = "Stop"
 
 
 # 22.04 https://cloud-images.ubuntu.com/wsl/jammy/current/
-$url = "https://cloud-images.ubuntu.com/wsl/jammy/current/ubuntu-jammy-wsl-amd64-wsl.rootfs.tar.gz"
-$File = "ubuntu-jammy-wsl-amd64-wsl.rootfs.tar.gz"
+$url = "https://cloud-images.ubuntu.com/wsl/jammy/current/ubuntu-jammy-wsl-amd64-ubuntu22.04lts.rootfs.tar.gz"
+$File = "ubuntu-jammy-wsl-amd64-ubuntu22.04lts.rootfs.tar.gz"
 $Name = "ubuntu-jammy"
 
 
@@ -14,7 +14,7 @@ $Image = "$TemporaryDirectory\$File"
 if (!(Test-Path -Path $Image)) {
     Write-Output "Fetching $File to $Image..."
     New-Item $TemporaryDirectory -ItemType Directory | Out-Null
-    Invoke-WebRequest -Uri "https://cloud-images.ubuntu.com/wsl/jammy/current/ubuntu-jammy-wsl-amd64-wsl.rootfs.tar.gz" -OutFile $Image
+    Invoke-WebRequest -Uri "https://cloud-images.ubuntu.com/wsl/jammy/current/ubuntu-jammy-wsl-amd64-ubuntu22.04lts.rootfs.tar.gz" -OutFile $Image
 } else {
     Write-Output "Found existing $Image..."
 }
@@ -50,7 +50,7 @@ if ($Systemd) {
     }
 }
 
-Write-Output "Building and runnings nix-installer in $DistroName..."
+Write-Output "Building and running nix-installer in $DistroName..."
 Copy-Item -Recurse "$PSScriptRoot\..\.." -Destination "\\wsl$\$DistroName\nix-installer"
 $MaybeInitChoice = switch ($Systemd) {
     $true { "" }