diff --git a/packages/awg-tool/package.nix b/packages/awg-tool/package.nix
index d991f6e..6c1afff 100644
--- a/packages/awg-tool/package.nix
+++ b/packages/awg-tool/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "awg-tool";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "Vadim-Khristenko";
     repo = "awg-containers-and-tools";
     rev = "v${version}";
-    hash = "sha256-IRi2LPTDLT6qfuolCUHSJWaXTg5pt/kqVlosxqCMQDs=";
+    hash = "sha256-ggQjlHxNY3uXdLkE3CsSjsijFQScaJyCMhaXwASARSg=";
   };
 
   # awg-core builds ssh2 with vendored-openssl, which compiles libssh2
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
     perl
   ];
 
-  cargoHash = "sha256-7sDpdjvA3kAHtwQ2qmpRPQywmyQBXZzM2ClfLKbGoKc=";
+  cargoHash = "sha256-2Vh9DXn6qdUT6wiITDID09j1iqpTHkZt/mpjAlYFA60=";
 
   # Upstream tests exercise Docker/SSH targets; unit tests are already
   # covered by the upstream CI before a release is cut.
diff --git a/packages/ds4/package.nix b/packages/ds4/package.nix
index c458be5..105229d 100644
--- a/packages/ds4/package.nix
+++ b/packages/ds4/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "ds4";
-  version = "0-unstable-2026-09-12";
+  version = "0-unstable-2026-09-20";
 
   src = fetchFromGitHub {
     owner = "antirez";
     repo = "ds4";
-    rev = "bd66c402070042bf0a79ad6ece8242de4c93680c";
-    hash = "sha256-F/MKv3/0Oj8DLa+q6jMtv0wFDgUvii+Xo2f1dPBDg6A=";
+    rev = "0aaea5a238fb41a35106a551e73c8409dfb751ac";
+    hash = "sha256-Bo/td1HwVjw6bwz3BDwTP+ZSudkVFCo2aIVK4axvmXg=";
   };
 
   nativeBuildInputs = [
diff --git a/packages/freebuff/package.nix b/packages/freebuff/package.nix
index 6104117..4ba8078 100644
--- a/packages/freebuff/package.nix
+++ b/packages/freebuff/package.nix
@@ -9,11 +9,11 @@
 }:
 
 let
-  version = "0.0.174";
+  version = "0.2.19";
 
   freebuffSrc = fetchurl {
     url = "https://registry.npmjs.org/freebuff/-/freebuff-${version}.tgz";
-    hash = "sha256-o767MqjDbhiu+Zy3Jc/43kBNIgLVLEgqC7D3GwtU0hg=";
+    hash = "sha256-vIypYxwCuA/PKpldhwuFVNqwtm4UXZM6xInKZ5A+u9w=";
   };
 
   pkgTar = fetchurl {
@@ -48,14 +48,14 @@ let
 
   binarySrc = fetchurl {
     url = "https://github.com/CodebuffAI/codebuff-community/releases/download/freebuff-v${version}/freebuff-linux-x64.tar.gz";
-    hash = "sha256-W/+lPhdHxq0a5TWY/JodAuP2hLpCGlLU7E8SoNe+OYA=";
+    hash = "sha256-8EfFlhc6k0fEDws3w4kw1rIPQr5RXZHtekjxwouWW7Q=";
   };
 
 in
 
 stdenv.mkDerivation rec {
   pname = "freebuff";
-  version = "0.0.174";
+  version = "0.2.19";
 
   src = freebuffSrc;
 
diff --git a/packages/freetoken/package.nix b/packages/freetoken/package.nix
index dd43dfd..986ef79 100644
--- a/packages/freetoken/package.nix
+++ b/packages/freetoken/package.nix
@@ -81,14 +81,14 @@ let
 in
 py.buildPythonApplication (finalAttrs: {
   pname = "freetoken";
-  version = "0.1.2";
+  version = "0.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "FlashML-org";
     repo = "FreeToken";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0MhuubuTjNvtQZxisC2cg1dJeR+A6wZ901H5FRv+l+c=";
+    hash = "sha256-59itjnwDr4P7I/ZLIbkNw9/8CCPvTP7yNWl9ogBnZ3o=";
   };
 
   # setup.py imports torch.utils.cpp_extension at build time and compiles two
diff --git a/packages/g3/package.nix b/packages/g3/package.nix
index 687a63b..2b0e1fb 100644
--- a/packages/g3/package.nix
+++ b/packages/g3/package.nix
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
   # Upstream has no git tags or releases; pin main and let nix-update
   # track the branch. Version shape matches nix-update --version=branch=main
   # for a tagless repository (package version is 0.1.0 upstream).
-  version = "0.1.0-unstable-2026-09-06";
+  version = "0-unstable-2026-09-06";
 
   src = fetchFromGitHub {
     owner = "dhanji";
diff --git a/packages/graphify/package.nix b/packages/graphify/package.nix
index f45c414..90838a8 100644
--- a/packages/graphify/package.nix
+++ b/packages/graphify/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "graphify";
-  version = "0.9.61";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "safishamsi";
+    owner = "Graphify-Labs";
     repo = "graphify";
     rev = "v${version}";
-    hash = "sha256-9AEbHmqqZv/fBioUMNv60KAb/FpvWpwC6QhGSdBxISs=";
+    hash = "sha256-YPiQChaoX64XBFORI5CmKe/LX0ECu1cYZWElGD7X2eA=";
   };
 
   build-system = with python3Packages; [
@@ -77,7 +77,6 @@ python3Packages.buildPythonApplication rec {
       "nix-update"
       "--flake"
       ".#graphify"
-      "--version=branch=main"
     ];
   };
 
diff --git a/packages/haivemind/package.nix b/packages/haivemind/package.nix
index 3faa2ff..c70f7d6 100644
--- a/packages/haivemind/package.nix
+++ b/packages/haivemind/package.nix
@@ -6,7 +6,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "haivemind";
-  version = "0.1.0";
+  version = "0-unstable-2026-07-01";
   pyproject = true;
 
   src = fetchFromGitHub {
diff --git a/packages/hipengine/package.nix b/packages/hipengine/package.nix
index 9299197..224cd92 100644
--- a/packages/hipengine/package.nix
+++ b/packages/hipengine/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "hipengine";
-  version = "0.5.0";
+  version = "0.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "shisa-ai";
     repo = "hipEngine";
     rev = "v${version}";
-    hash = "sha256-xjVpdr2avDKA2IoXA9W5Q/c6cT+G/BxrTDzjP5Tm+3Y=";
+    hash = "sha256-7FQZuExTTqcMKZkCRzLC5nYLpGytswhEsBTUliQqoTI=";
   };
 
   build-system = with python3Packages; [
diff --git a/packages/kubernetes-mcp-server/package.nix b/packages/kubernetes-mcp-server/package.nix
index ceb5a65..9cfe4a5 100644
--- a/packages/kubernetes-mcp-server/package.nix
+++ b/packages/kubernetes-mcp-server/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "kubernetes-mcp-server";
-  version = "0.0.66";
+  version = "0.0.67";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "kubernetes-mcp-server";
     rev = "v${version}";
-    hash = "sha256-vnJxSCfnpvOZJXQpKrCAW4QKt5R2PJDYQevA7O1uXZg=";
+    hash = "sha256-rejF9JsszB3ZirZhoK1VDbCH/P0Xzmh4TJw5j+okj+M=";
   };
 
-  vendorHash = "sha256-gbqoT4X+wVOEktHm7jaAH9vHrUBrYgR8OjyFz1ljP6k=";
+  vendorHash = "sha256-TSB2jAWh2PlDHpvzA/rrBbjaR8sgyjivDO0vsbcuvgg=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/packages/llama-cpp/package.nix b/packages/llama-cpp/package.nix
index b08a7c6..781281d 100644
--- a/packages/llama-cpp/package.nix
+++ b/packages/llama-cpp/package.nix
@@ -18,7 +18,7 @@ let
   # Upstream release tag. Bump with:
   #   nix flake prefetch github:ggml-org/llama.cpp/b<NNNN>
   # then update buildNumber and the src hash.
-  buildNumber = "9645";
+  buildNumber = "11439";
 
   # HIP flags from the llm-engine.nix bring-up config. The -I paths for
   # hipBLASLt/rocWMMA are dropped because this tag's HIP backend links
@@ -51,7 +51,7 @@ in
       repo = "llama.cpp";
       tag = "b${buildNumber}";
       # Tarball hash (this tag has no submodules).
-      hash = "sha256-ntRwfI2/yVqi3QjQfO0ZajMFSD8r/6XPiuy0X2BhwVk=";
+      hash = "sha256-9KUkThRm+kvYOguP08JOPtjQjtDsDqgh1e50NdR0V5I=";
     };
 
     # The embedded web UI is disabled via cmakeFlags, so none of the npm
diff --git a/packages/marmel/package.nix b/packages/marmel/package.nix
index 28d9310..4655f71 100644
--- a/packages/marmel/package.nix
+++ b/packages/marmel/package.nix
@@ -10,16 +10,16 @@ rustPlatform.buildRustPackage rec {
   # Upstream publishes no git tags or releases, so this is pinned to a commit.
   # The version shape matches what `nix-update --version=branch=main` generates
   # for a tagless repository.
-  version = "unstable-2026-09-13";
+  version = "0-unstable-2026-10-05";
 
   src = fetchFromGitHub {
     owner = "Na1w";
     repo = "marmel";
-    rev = "fd551ae3198d427b0f0df3429f88764c49095b23";
-    hash = "sha256-nghvUF0EdqTGWT6GMG5oW1iK76r9vgvYeUj98hNraIo=";
+    rev = "31f4e90553655b664c4bdb6839ddb92c21b144cf";
+    hash = "sha256-D8/bRBp+Wq5RTsGxMeIgl0pORmU4Ev5D5X9BnHIB1Rs=";
   };
 
-  cargoHash = "sha256-sUSsxcj4m4uJ28RKdJWKsb+MlVW6GkWjZdhKPFKlE/Y=";
+  cargoHash = "sha256-etqW3xcxkiNfkiPxl/Emt5pQCkNnoIhHFkX0Zqfs4rc=";
 
   nativeCheckInputs = [ cacert ];
 
diff --git a/packages/open-code-review/package.nix b/packages/open-code-review/package.nix
index 7cb8443..243b2a7 100644
--- a/packages/open-code-review/package.nix
+++ b/packages/open-code-review/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "open-code-review";
-  version = "1.12.9";
+  version = "1.12.12";
 
   src = fetchFromGitHub {
     owner = "alibaba";
     repo = "open-code-review";
     rev = "v${version}";
-    hash = "sha256-g/l4Ezv1YJYjRNI2DU5WgkaPvYp+/SC3yL+HEl/8kFI=";
+    hash = "sha256-U8C1LdO+6QQKDStitCDVypdNq5IkRgBlPbH4udpXLRM=";
   };
 
   vendorHash = "sha256-f5Ty22wicf1J8+RKnHYcEO7flWn9gkWQODlfunn23EA=";
diff --git a/packages/radar/package.nix b/packages/radar/package.nix
index 0a8cdf1..9dfc476 100644
--- a/packages/radar/package.nix
+++ b/packages/radar/package.nix
@@ -6,13 +6,13 @@
 }:
 
 let
-  version = "1.13.1";
+  version = "1.16.2";
 
   src = fetchFromGitHub {
     owner = "skyhook-io";
     repo = "radar";
-    rev = "v${version}";
-    hash = "sha256-jRcX7wv+uHxH2hoYSoLEjcVnuRGAnrTt4tbwZozDb7Y=";
+    rev = "k8s-ui-v${version}";
+    hash = "sha256-OrG628fEXVRwH3W4EBUBeqzFUyp12m3Xt4qTC5r5kVE=";
   };
 
   # Build the frontend as a separate derivation.
@@ -26,7 +26,7 @@ let
     # Upstream lockfile ships complete resolved/integrity fields for all
     # packages since v1.9.x, so no lockfile patching is needed anymore.
 
-    npmDepsHash = "sha256-TuSBPGktl6s1adHWbP81+TOEZufo5y2gwiUnfiaLoOc=";
+    npmDepsHash = "sha256-1wznZuUbDKQlqJZpuNU+s7l24OY9981ak66HroXUtLk=";
     npmDepsFetcherVersion = 2;
     makeCacheWritable = true;
 
@@ -54,7 +54,7 @@ buildGoModule {
   pname = "radar";
   inherit version src;
 
-  vendorHash = "sha256-sFlj1sE+ciXQauReWm3mLQZK21lqTaU4cAj06flpx30=";
+  vendorHash = "sha256-4xkFqa0hWN57bjfA0bgO8mcCsk3iVW45F8RJQnS2nm0=";
 
   # Copy pre-built frontend assets before Go compilation for go:embed
   preBuild = ''
@@ -91,7 +91,7 @@ buildGoModule {
   meta = with lib; {
     description = "Modern Kubernetes visibility — topology, event timeline, service traffic, resource browsing, Helm management, and GitOps support";
     homepage = "https://github.com/skyhook-io/radar";
-    changelog = "https://github.com/skyhook-io/radar/releases/tag/v${version}";
+    changelog = "https://github.com/skyhook-io/radar/releases/tag/k8s-ui-v${version}";
     license = licenses.asl20;
     mainProgram = "radar";
     platforms = platforms.linux;
diff --git a/packages/shardr/package.nix b/packages/shardr/package.nix
index 8e9c897..a5f14ee 100644
--- a/packages/shardr/package.nix
+++ b/packages/shardr/package.nix
@@ -8,7 +8,7 @@ buildGoModule rec {
   pname = "shardr";
   # Pinned to a commit: upstream has no tagged source releases, only
   # prebuilt "shardr-runner" bundles.
-  version = "0.1.0+unstable";
+  version = "0-unstable-2026-10-02";
 
   src = fetchFromGitHub {
     owner = "Cyb3rDudu";
diff --git a/packages/skillsmcp/package.nix b/packages/skillsmcp/package.nix
index 3fcbb30..de1bb4b 100644
--- a/packages/skillsmcp/package.nix
+++ b/packages/skillsmcp/package.nix
@@ -8,7 +8,7 @@ python3Packages.buildPythonApplication {
   pname = "skillsmcp";
   # Pinned to a commit rather than a release tag because upstream
   # has not yet published a tagged release containing all features.
-  version = "0.2.0+unstable";
+  version = "0-unstable-2026-04-08";
   pyproject = true;
 
   src = fetchFromGitHub {
diff --git a/packages/traycer/package.nix b/packages/traycer/package.nix
index 05c9469..cb5798d 100644
--- a/packages/traycer/package.nix
+++ b/packages/traycer/package.nix
@@ -5,10 +5,10 @@
 }:
 
 let
-  version = "1.3.0";
+  version = "1.4.2";
   src = fetchurl {
     url = "https://github.com/traycerai/traycer/releases/download/desktop-v${version}/traycer-desktop-linux-x86_64.AppImage";
-    hash = "sha256-iDpbpDpd0OeRGTKwUVRYiIpRSltnAIb59W+yIfH8HFU=";
+    hash = "sha256-OIJ2e+BAomg3Fq7zaxlVi5o8hpDECaVUYsPpLiYib1I=";
   };
   appimageContents = appimageTools.extractType2 {
     pname = "traycer";