diff --git a/.cirrus.yml b/.cirrus.yml
index 058ea3e..b1d2036 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -9,7 +9,7 @@ task:
 
   container:
     # Defined in https://github.com/nix-community/docker-nixpkgs
-    image: nixpkgs/nix-flakes:nixos-24.11
+    image: nixpkgs/nix-flakes:nixos-25.05
 
   matrix:
     - name: modules_test
@@ -29,7 +29,7 @@ task:
           - scenario: netnsRegtest
       # This script is run as root
       build_script:
-        - echo "sandbox = true" >> /etc/nix/nix.conf
+        - printf '%s\n' 'sandbox = true' 'max-jobs = auto' >> /etc/nix/nix.conf
         - nix shell --inputs-from . nixpkgs#{bash,coreutils,cachix} -c ./test/ci/build.sh $scenario
 
     - name: flake
diff --git a/dev/README.md b/dev/README.md
index fce515e..ff6c038 100644
--- a/dev/README.md
+++ b/dev/README.md
@@ -97,5 +97,5 @@ It's easiest to use an existing service as a template:
   Most other services use packages that are already included in nixpkgs.
 
 ## Switching to a new NixOS release
-- Run command `update-flake.sh 24.11`
+- Run command `update-flake.sh 25.05`
 - Treewide: check if any `TODO-EXTERNAL` comments can be resolved
diff --git a/dev/topics/rtl.sh b/dev/topics/rtl.sh
index 933504a..f9d4202 100644
--- a/dev/topics/rtl.sh
+++ b/dev/topics/rtl.sh
@@ -28,7 +28,7 @@ runuser -u "$(logname)" -- xdg-open "http://$ip:3000"
 rtl_src=~/s/RTL
 git clone https://github.com/Ride-The-Lightning/RTL "$rtl_src"
 
-nix build -o /tmp/nix-bitcoin-dev/nodejs --inputs-from . nixpkgs#nodejs-18_x
+nix build -o /tmp/nix-bitcoin-dev/nodejs --inputs-from . nixpkgs#nodejs_22
 # Start a shell in a sandbox
 env --chdir "$rtl_src" nix-bitcoin-firejail --whitelist="$rtl_src" --whitelist=/tmp/nix-bitcoin-dev/nodejs
 PATH=/tmp/nix-bitcoin-dev/nodejs/bin:"$PATH"
diff --git a/examples/configuration.nix b/examples/configuration.nix
index 0f4918f..3987529 100644
--- a/examples/configuration.nix
+++ b/examples/configuration.nix
@@ -318,7 +318,7 @@
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "24.11"; # Did you read the comment?
+  system.stateVersion = "25.05"; # Did you read the comment?
 
   # The nix-bitcoin release version that your config is compatible with.
   # When upgrading to a backwards-incompatible release, nix-bitcoin will display an
diff --git a/examples/container/flake.nix b/examples/container/flake.nix
index c3aef68..9401c14 100644
--- a/examples/container/flake.nix
+++ b/examples/container/flake.nix
@@ -12,7 +12,7 @@
   inputs = {
     nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release";
     # You can also use a version branch to track a specific NixOS release
-    # nix-bitcoin.url = "github:fort-nix/nix-bitcoin/nixos-24.11";
+    # nix-bitcoin.url = "github:fort-nix/nix-bitcoin/nixos-25.05";
 
     nixpkgs.follows = "nix-bitcoin/nixpkgs";
     nixpkgs-unstable.follows = "nix-bitcoin/nixpkgs-unstable";
diff --git a/examples/flakes/flake.nix b/examples/flakes/flake.nix
index 63b69c4..dce09b7 100644
--- a/examples/flakes/flake.nix
+++ b/examples/flakes/flake.nix
@@ -10,7 +10,7 @@
 
   inputs.nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release";
   # You can also use a version branch to track a specific NixOS release
-  # inputs.nix-bitcoin.url = "github:fort-nix/nix-bitcoin/nixos-24.11";
+  # inputs.nix-bitcoin.url = "github:fort-nix/nix-bitcoin/nixos-25.05";
 
   inputs.nixpkgs.follows = "nix-bitcoin/nixpkgs";
   inputs.nixpkgs-unstable.follows = "nix-bitcoin/nixpkgs-unstable";
diff --git a/flake.lock b/flake.lock
index 5020ca7..87aae64 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,16 +44,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1748037224,
-        "narHash": "sha256-92vihpZr6dwEMV6g98M5kHZIttrWahb9iRPBm1atcPk=",
+        "lastModified": 1749237914,
+        "narHash": "sha256-N5waoqWt8aMr/MykZjSErOokYH6rOsMMXu3UOVH5kiw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f09dede81861f3a83f7f06641ead34f02f37597f",
+        "rev": "70c74b02eac46f4e4aa071e45a6189ce0f6d9265",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index b5dd486..fd7aec5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,7 +5,7 @@
   '';
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
     flake-utils.url = "github:numtide/flake-utils";
     extra-container = {
diff --git a/helper/fetch-release b/helper/fetch-release
index 2066b3b..7b447a0 100755
--- a/helper/fetch-release
+++ b/helper/fetch-release
@@ -4,7 +4,7 @@ set -euo pipefail
 
 scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
 
-trap 'echo "Error at ${BASH_SOURCE[0]}, line $LINENO"' ERR
+trap 'echo "Error at ${BASH_SOURCE[0]}:$LINENO"' ERR
 
 repo=fort-nix/nix-bitcoin
 if [[ ! -v version ]]; then
diff --git a/pkgs/clightning-rest/default.nix b/pkgs/clightning-rest/default.nix
index 488627b..8d9256b 100644
--- a/pkgs/clightning-rest/default.nix
+++ b/pkgs/clightning-rest/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenvNoCC
-, nodejs-18_x
-, nodejs-slim-18_x
+, nodejs_22
+, nodejs-slim_22
 , fetchNodeModules
 , fetchurl
 , makeWrapper
@@ -17,8 +17,8 @@ let self = stdenvNoCC.mkDerivation {
   };
 
   passthru = {
-    nodejs = nodejs-18_x;
-    nodejsRuntime = nodejs-slim-18_x;
+    nodejs = nodejs_22;
+    nodejsRuntime = nodejs-slim_22;
 
     nodeModules = fetchNodeModules {
       inherit (self) src nodejs;
diff --git a/pkgs/clnrest/default.nix b/pkgs/clnrest/default.nix
index e5e9c7b..c042b2b 100644
--- a/pkgs/clnrest/default.nix
+++ b/pkgs/clnrest/default.nix
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
 
   inherit (clightning) src;
 
-  cargoHash = "sha256-rXOpRNzIDohfvn3n1xEhc/C1pCpzgfFXHjob7/qOeXM=";
+  cargoHash = "sha256-nR4jSpjnB0k/v+E78Jy5AhOLwqJgvAfDKFca3DqaSwQ=";
 
   depsExtraArgs = {
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/pinned.nix b/pkgs/pinned.nix
index 1b71d26..46407d6 100644
--- a/pkgs/pinned.nix
+++ b/pkgs/pinned.nix
@@ -2,13 +2,6 @@
 pkgs: pkgsUnstable:
 {
   inherit (pkgs)
-    extra-container
-    hwi
-    lightning-loop
-    lightning-pool
-    lndconnect;
-
-  inherit (pkgsUnstable)
     bitcoin
     bitcoind
     bitcoind-knots
@@ -18,8 +11,16 @@ pkgs: pkgsUnstable:
     clightning
     electrs
     elementsd
+    extra-container
     fulcrum
-    lnd;
+    hwi
+    lightning-loop
+    lightning-pool
+    lnd
+    lndconnect;
+
+  inherit (pkgsUnstable)
+    ;
 
   inherit pkgs pkgsUnstable;
 }
diff --git a/pkgs/python-packages/default.nix b/pkgs/python-packages/default.nix
index ca6a33c..96e6247 100644
--- a/pkgs/python-packages/default.nix
+++ b/pkgs/python-packages/default.nix
@@ -26,10 +26,6 @@ rec {
 
       # autobahn 20.12.3, required by joinmarketclient
       autobahn = callPackage ./specific-versions/autobahn.nix {};
-      # coincurve 20, required by pyln-proto.
-      coincurve = callPackage ./specific-versions/coincurve_20 {};
-      # scikit-build-core 0_10, required by coincurve.
-      scikit-build-core = callPackage ./specific-versions/scikit-build-core_0_10 {};
     };
 
   nbPython3Packages = (python3.override {
diff --git a/pkgs/python-packages/joinmarket/default.nix b/pkgs/python-packages/joinmarket/default.nix
index 2cdbb55..4721017 100644
--- a/pkgs/python-packages/joinmarket/default.nix
+++ b/pkgs/python-packages/joinmarket/default.nix
@@ -74,9 +74,9 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail 'twisted==23.10.0' 'twisted==24.7.0' \
-      --replace-fail 'service-identity==21.1.0' 'service-identity==24.1.0' \
-      --replace-fail 'cryptography==41.0.6' 'cryptography==43.0.1' \
+      --replace-fail 'twisted==23.10.0' 'twisted==24.11.0' \
+      --replace-fail 'service-identity==21.1.0' 'service-identity==24.2.0' \
+      --replace-fail 'cryptography==41.0.6' 'cryptography==44.0.2' \
       --replace-fail 'txtorcon==23.11.0' 'txtorcon==24.8.0' \
 
     # Modify pyproject.toml to include only specific modules. Do not include 'jmqtui'.
diff --git a/pkgs/python-packages/pyln-proto/default.nix b/pkgs/python-packages/pyln-proto/default.nix
index 98f7d6b..2dd3b95 100644
--- a/pkgs/python-packages/pyln-proto/default.nix
+++ b/pkgs/python-packages/pyln-proto/default.nix
@@ -32,6 +32,6 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail 'cryptography = "^42"' 'cryptography = "43.0.1"'
+      --replace-fail 'cryptography = "^42"' 'cryptography = "44.0.2"'
   '';
 }
diff --git a/pkgs/python-packages/specific-versions/coincurve_20/default.nix b/pkgs/python-packages/specific-versions/coincurve_20/default.nix
deleted file mode 100644
index afa9d41..0000000
--- a/pkgs/python-packages/specific-versions/coincurve_20/default.nix
+++ /dev/null
@@ -1,87 +0,0 @@
-# Copied from nixpkgs revision 673d99f1406cb09b8eb6feab4743ebdf70046557
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-
-  # build-system
-  cmake,
-  hatchling,
-  ninja,
-  pkg-config,
-  setuptools,
-  scikit-build-core,
-
-  # dependencies
-  asn1crypto,
-  cffi,
-  secp256k1,
-
-  # checks
-  pytestCheckHook,
-  pythonOlder,
-}:
-
-buildPythonPackage rec {
-  pname = "coincurve";
-  version = "20.0.0";
-  pyproject = true;
-
-  disabled = pythonOlder "3.7";
-
-  src = fetchFromGitHub {
-    owner = "ofek";
-    repo = "coincurve";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-NKx/iLuzFEu1UBuwa14x55Ab3laVAKEtX6dtoWi0dOg=";
-  };
-
-  postPatch = ''
-    # don't try to load .dll files
-    cp -r --no-preserve=mode ${secp256k1.src} libsecp256k1
-    patchShebangs secp256k1/autogen.sh
-  '';
-
-  build-system = [
-    hatchling
-    cffi
-    cmake
-    ninja
-    pkg-config
-    setuptools
-    scikit-build-core
-  ];
-
-  dontUseCmakeConfigure = true;
-
-  env.COINCURVE_IGNORE_SYSTEM_LIB = "OFF";
-
-  buildInputs = [ secp256k1 ];
-
-  dependencies = [
-    asn1crypto
-    cffi
-  ];
-
-  preCheck = ''
-    # https://github.com/ofek/coincurve/blob/master/tox.ini#L20-L22=
-    rm -rf coincurve
-
-    # don't run benchmark tests
-    rm tests/test_bench.py
-  '';
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  pythonImportsCheck = [ "coincurve" ];
-
-  meta = with lib; {
-    description = "Cross-platform bindings for libsecp256k1";
-    homepage = "https://github.com/ofek/coincurve";
-    license = with licenses; [
-      asl20
-      mit
-    ];
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/python-packages/specific-versions/scikit-build-core_0_10/default.nix b/pkgs/python-packages/specific-versions/scikit-build-core_0_10/default.nix
deleted file mode 100644
index 587e4c6..0000000
--- a/pkgs/python-packages/specific-versions/scikit-build-core_0_10/default.nix
+++ /dev/null
@@ -1,97 +0,0 @@
-# Copied from nixpkgs revision 673d99f1406cb09b8eb6feab4743ebdf70046557
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  pythonOlder,
-
-  # build-system
-  hatch-vcs,
-  hatchling,
-  cmake,
-  ninja,
-
-  # dependencies
-  packaging,
-  pathspec,
-  exceptiongroup,
-
-  # tests
-  build,
-  cattrs,
-  numpy,
-  pybind11,
-  pytest-subprocess,
-  pytestCheckHook,
-  setuptools,
-  tomli,
-  virtualenv,
-  wheel,
-}:
-
-buildPythonPackage rec {
-  pname = "scikit-build-core";
-  version = "0.10.5";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "scikit-build";
-    repo = "scikit-build-core";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-hpwXEWPofgMT4ua2tZI1mtGbaBkT2XPBd6QL8xTi1A0=";
-  };
-
-  postPatch = lib.optionalString (pythonOlder "3.11") ''
-    substituteInPlace pyproject.toml \
-      --replace-fail '"error",' '"error", "ignore::UserWarning",'
-  '';
-
-  build-system = [
-    hatch-vcs
-    hatchling
-  ];
-
-  dependencies =
-    [
-      packaging
-      pathspec
-    ]
-    ++ lib.optionals (pythonOlder "3.11") [
-      exceptiongroup
-      tomli
-    ];
-
-  nativeCheckInputs = [
-    build
-    cattrs
-    cmake
-    ninja
-    numpy
-    pybind11
-    pytest-subprocess
-    pytestCheckHook
-    setuptools
-    virtualenv
-    wheel
-  ];
-
-  # cmake is only used for tests
-  dontUseCmakeConfigure = true;
-
-  pytestFlagsArray = [ "-m 'not isolated and not network'" ];
-
-  disabledTestPaths = [
-    # store permissions issue in Nix:
-    "tests/test_editable.py"
-  ];
-
-  pythonImportsCheck = [ "scikit_build_core" ];
-
-  meta = with lib; {
-    description = "Next generation Python CMake adaptor and Python API for plugins";
-    homepage = "https://github.com/scikit-build/scikit-build-core";
-    changelog = "https://github.com/scikit-build/scikit-build-core/releases/tag/v${version}";
-    license = with licenses; [ asl20 ];
-    maintainers = with maintainers; [ veprbl ];
-  };
-}
diff --git a/pkgs/rtl/default.nix b/pkgs/rtl/default.nix
index c706974..e25d36e 100644
--- a/pkgs/rtl/default.nix
+++ b/pkgs/rtl/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenvNoCC
-, nodejs-18_x
-, nodejs-slim-18_x
+, nodejs_22
+, nodejs-slim_22
 , fetchNodeModules
 , fetchpatch
 , fetchurl
@@ -17,8 +17,8 @@ let self = stdenvNoCC.mkDerivation {
   };
 
   passthru = {
-    nodejs = nodejs-18_x;
-    nodejsRuntime = nodejs-slim-18_x;
+    nodejs = nodejs_22;
+    nodejsRuntime = nodejs-slim_22;
 
     nodeModules = fetchNodeModules {
       inherit (self) src nodejs;
diff --git a/test/ci/build-to-cachix.sh b/test/ci/build-to-cachix.sh
index 88bfe6e..dcea712 100755
--- a/test/ci/build-to-cachix.sh
+++ b/test/ci/build-to-cachix.sh
@@ -9,7 +9,7 @@ set -euo pipefail
 CACHIX_SIGNING_KEY="${CACHIX_SIGNING_KEY:-}"
 cachixCache=nix-bitcoin
 
-trap 'echo Error at line $LINENO' ERR
+trap 'echo "Error at ${BASH_SOURCE[0]}:$LINENO"' ERR
 
 tmpDir=$(mktemp -d -p /tmp)
 trap 'rm -rf $tmpDir' EXIT
@@ -17,9 +17,10 @@ trap 'rm -rf $tmpDir' EXIT
 ## Instantiate
 
 time nix-instantiate "$@" --add-root "$tmpDir/drv" --indirect > /dev/null
-printf "instantiated "; realpath "$tmpDir/drv"
+drv=$(realpath "$tmpDir/drv")
+echo "instantiated $drv"
 
-outPath=$(nix-store --query "$tmpDir/drv")
+outPath=$(nix-store --query "$drv")
 if nix path-info --store "https://${cachixCache}.cachix.org" "$outPath" &>/dev/null; then
     echo "$outPath has already been built successfully."
     exit 0
@@ -33,12 +34,12 @@ fi
 
 if [[ $CACHIX_SIGNING_KEY ]]; then
     # Speed up task by uploading store paths as soon as they are created
-    buildCmd="cachix watch-exec $cachixCache nix-build --"
+    buildCmd="cachix watch-exec $cachixCache nix -- build"
 else
-    buildCmd=nix-build
+    buildCmd="nix build"
 fi
 
-$buildCmd --out-link "$tmpDir/result" "$tmpDir/drv" >/dev/null
+$buildCmd --out-link "$tmpDir/result" --print-build-logs "$drv^*"
 
 if [[ $CACHIX_SIGNING_KEY ]]; then
     cachix push "$cachixCache" "$outPath"