diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index af94c3e9e5bb..d802a82c2ecd 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -44,10 +44,12 @@ assignees: ''
 
 - [ ] checked [latest Nix manual] \([source])
 - [ ] checked [open bug issues and pull requests] for possible duplicates
+- [ ] reviewed the [contributing guide]
 
 [latest Nix manual]: https://nix.dev/manual/nix/development/
 [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
 [open bug issues and pull requests]: https://github.com/NixOS/nix/labels/bug
+[contributing guide]: https://github.com/NixOS/nix/blob/master/CONTRIBUTING.md
 
 ---
 
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
index fe9f9dd209d4..2238b88386ae 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -29,10 +29,12 @@ assignees: ''
 
 - [ ] checked [latest Nix manual] \([source])
 - [ ] checked [open feature issues and pull requests] for possible duplicates
+- [ ] reviewed the [contributing guide]
 
 [latest Nix manual]: https://nix.dev/manual/nix/development/
 [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
 [open feature issues and pull requests]: https://github.com/NixOS/nix/labels/feature
+[contributing guide]: https://github.com/NixOS/nix/blob/master/CONTRIBUTING.md
 
 ---
 
diff --git a/.github/ISSUE_TEMPLATE/installer.md b/.github/ISSUE_TEMPLATE/installer.md
index 070e0bd9b25b..965d4db6fd96 100644
--- a/.github/ISSUE_TEMPLATE/installer.md
+++ b/.github/ISSUE_TEMPLATE/installer.md
@@ -37,10 +37,12 @@ assignees: ''
 
 - [ ] checked [latest Nix manual] \([source])
 - [ ] checked [open installer issues and pull requests] for possible duplicates
+- [ ] reviewed the [contributing guide]
 
 [latest Nix manual]: https://nix.dev/manual/nix/development/
 [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
 [open installer issues and pull requests]: https://github.com/NixOS/nix/labels/installer
+[contributing guide]: https://github.com/NixOS/nix/blob/master/CONTRIBUTING.md
 
 ---
 
diff --git a/.github/ISSUE_TEMPLATE/missing_documentation.md b/.github/ISSUE_TEMPLATE/missing_documentation.md
index 4e05b626d398..5675bf2391a6 100644
--- a/.github/ISSUE_TEMPLATE/missing_documentation.md
+++ b/.github/ISSUE_TEMPLATE/missing_documentation.md
@@ -21,10 +21,12 @@ assignees: ''
 
 - [ ] checked [latest Nix manual] \([source])
 - [ ] checked [open documentation issues and pull requests] for possible duplicates
+- [ ] reviewed the [contributing guide]
 
 [latest Nix manual]: https://nix.dev/manual/nix/development/
 [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
 [open documentation issues and pull requests]: https://github.com/NixOS/nix/labels/documentation
+[contributing guide]: https://github.com/NixOS/nix/blob/master/CONTRIBUTING.md
 
 ---
 
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index c155bf8bfa4f..e861dcfc5fa0 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -13,6 +13,7 @@ so you understand the process and the expectations.
 - what information to include in commit messages
 - proper attribution
 - volunteering contributions effectively
+- AI/automation policy
 - how to get help and our review process.
 
 PR stuck in review? We have two Nix team meetings per week online that are open for everyone in a jitsi conference:
diff --git a/.github/actions/install-nix-action/action.yaml b/.github/actions/install-nix-action/action.yaml
index 535ae9d08fd9..2fb433b741c3 100644
--- a/.github/actions/install-nix-action/action.yaml
+++ b/.github/actions/install-nix-action/action.yaml
@@ -4,22 +4,12 @@ inputs:
   dogfood:
     description: "Whether to use Nix installed from the latest artifact from master branch"
     required: true # Be explicit about the fact that we are using unreleased artifacts
-  experimental-installer:
-    description: "Whether to use the experimental installer to install Nix"
-    default: false
-  experimental-installer-version:
-    description: "Version of the experimental installer to use. If `latest`, the newest artifact from the default branch is used."
-    # TODO: This should probably be pinned to a release after https://github.com/NixOS/experimental-nix-installer/pull/49 lands in one
-    default: "latest"
   extra_nix_config:
     description: "Gets appended to `/etc/nix/nix.conf` if passed."
   install_url:
     description: "URL of the Nix installer"
     required: false
-    default: "https://releases.nixos.org/nix/nix-2.32.1/install"
-  tarball_url:
-    description: "URL of the Nix tarball to use with the experimental installer"
-    required: false
+    default: "https://releases.nixos.org/nix/nix-2.34.8/install"
   github_token:
     description: "Github token"
     required: true
@@ -51,74 +41,14 @@ runs:
 
         gh run download "$RUN_ID" --repo "$DOGFOOD_REPO" -n "$INSTALLER_ARTIFACT" -D "$INSTALLER_DOWNLOAD_DIR"
         echo "installer-path=file://$INSTALLER_DOWNLOAD_DIR" >> "$GITHUB_OUTPUT"
-        TARBALL_PATH="$(find "$INSTALLER_DOWNLOAD_DIR" -name 'nix*.tar.xz' -print | head -n 1)"
-        echo "tarball-path=file://$TARBALL_PATH" >> "$GITHUB_OUTPUT"
 
         echo "::notice ::Dogfooding Nix installer from master (https://github.com/$DOGFOOD_REPO/actions/runs/$RUN_ID)"
       env:
         GH_TOKEN: ${{ inputs.github_token }}
         DOGFOOD_REPO: "NixOS/nix"
-    - name: "Gather system info for experimental installer"
-      shell: bash
-      if: ${{ inputs.experimental-installer == 'true' }}
-      run: |
-        echo "::notice Using experimental installer from $EXPERIMENTAL_INSTALLER_REPO (https://github.com/$EXPERIMENTAL_INSTALLER_REPO)"
-
-        if [ "$RUNNER_OS" == "Linux" ]; then
-          EXPERIMENTAL_INSTALLER_SYSTEM="linux"
-          echo "EXPERIMENTAL_INSTALLER_SYSTEM=$EXPERIMENTAL_INSTALLER_SYSTEM" >> "$GITHUB_ENV"
-        elif [ "$RUNNER_OS" == "macOS" ]; then
-          EXPERIMENTAL_INSTALLER_SYSTEM="darwin"
-          echo "EXPERIMENTAL_INSTALLER_SYSTEM=$EXPERIMENTAL_INSTALLER_SYSTEM" >> "$GITHUB_ENV"
-        else
-          echo "::error ::Unsupported RUNNER_OS: $RUNNER_OS"
-          exit 1
-        fi
-
-        if [ "$RUNNER_ARCH" == "X64" ]; then
-          EXPERIMENTAL_INSTALLER_ARCH=x86_64
-          echo "EXPERIMENTAL_INSTALLER_ARCH=$EXPERIMENTAL_INSTALLER_ARCH" >> "$GITHUB_ENV"
-        elif [ "$RUNNER_ARCH" == "ARM64" ]; then
-          EXPERIMENTAL_INSTALLER_ARCH=aarch64
-          echo "EXPERIMENTAL_INSTALLER_ARCH=$EXPERIMENTAL_INSTALLER_ARCH" >> "$GITHUB_ENV"
-        else
-          echo "::error ::Unsupported RUNNER_ARCH: $RUNNER_ARCH"
-          exit 1
-        fi
-
-        echo "EXPERIMENTAL_INSTALLER_ARTIFACT=nix-installer-$EXPERIMENTAL_INSTALLER_ARCH-$EXPERIMENTAL_INSTALLER_SYSTEM" >> "$GITHUB_ENV"
-      env:
-        EXPERIMENTAL_INSTALLER_REPO: "NixOS/experimental-nix-installer"
-    - name: "Download latest experimental installer"
-      shell: bash
-      id: download-latest-experimental-installer
-      if: ${{ inputs.experimental-installer == 'true' && inputs.experimental-installer-version == 'latest' }}
-      run: |
-        RUN_ID=$(gh run list --repo "$EXPERIMENTAL_INSTALLER_REPO" --workflow ci.yml --branch main --status success --json databaseId --jq ".[0].databaseId")
-
-        EXPERIMENTAL_INSTALLER_DOWNLOAD_DIR="$GITHUB_WORKSPACE/$EXPERIMENTAL_INSTALLER_ARTIFACT"
-        mkdir -p "$EXPERIMENTAL_INSTALLER_DOWNLOAD_DIR"
-
-        gh run download "$RUN_ID" --repo "$EXPERIMENTAL_INSTALLER_REPO" -n "$EXPERIMENTAL_INSTALLER_ARTIFACT" -D "$EXPERIMENTAL_INSTALLER_DOWNLOAD_DIR"
-        # Executable permissions are lost in artifacts
-        find $EXPERIMENTAL_INSTALLER_DOWNLOAD_DIR -type f -exec chmod +x {} +
-        echo "installer-path=$EXPERIMENTAL_INSTALLER_DOWNLOAD_DIR" >> "$GITHUB_OUTPUT"
-      env:
-        GH_TOKEN: ${{ inputs.github_token }}
-        EXPERIMENTAL_INSTALLER_REPO: "NixOS/experimental-nix-installer"
     - uses: cachix/install-nix-action@c134e4c9e34bac6cab09cf239815f9339aaaf84e # v31.5.1
-      if: ${{ inputs.experimental-installer != 'true' }}
       with:
         # Ternary operator in GHA: https://www.github.com/actions/runner/issues/409#issuecomment-752775072
         install_url: ${{ inputs.dogfood == 'true' && format('{0}/install', steps.download-nix-installer.outputs.installer-path) || inputs.install_url }}
         install_options: ${{ inputs.dogfood == 'true' && format('--tarball-url-prefix {0}', steps.download-nix-installer.outputs.installer-path) || '' }}
         extra_nix_config: ${{ inputs.extra_nix_config }}
-    - uses: DeterminateSystems/nix-installer-action@786fff0690178f1234e4e1fe9b536e94f5433196 # v20
-      if: ${{ inputs.experimental-installer == 'true' }}
-      with:
-        diagnostic-endpoint: ""
-        # TODO: It'd be nice to use `artifacts.nixos.org` for both of these, maybe through an `/experimental-installer/latest` endpoint? or `/commit/<hash>`?
-        local-root: ${{ inputs.experimental-installer-version == 'latest' && steps.download-latest-experimental-installer.outputs.installer-path || '' }}
-        source-url: ${{ inputs.experimental-installer-version != 'latest' && 'https://artifacts.nixos.org/experimental-installer/tag/${{ inputs.experimental-installer-version }}/${{ env.EXPERIMENTAL_INSTALLER_ARTIFACT }}' || '' }}
-        nix-package-url: ${{ inputs.dogfood == 'true' && steps.download-nix-installer.outputs.tarball-path || (inputs.tarball_url || '') }}
-        extra-conf: ${{ inputs.extra_nix_config }}
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5ace4600a1f2..1880a89da556 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,3 +4,11 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+  - package-ecosystem: "nix"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      flake-inputs:
+        patterns:
+          - "*"
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 2d01cfefc295..9bc2ee17e672 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -20,13 +20,13 @@ jobs:
         with:
           app-id: ${{ vars.CI_APP_ID }}
           private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           # required to find all branches
           fetch-depth: 0
       - name: Create backport PRs
-        uses: korthout/backport-action@3c06f323a58619da1e8522229ebc8d5de2633e46 # v4.3.0
+        uses: korthout/backport-action@2e830a1d0b8269505846ddd407a70876913ad1f8 # v4.6.0
         id: backport
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index be8cb0f0c4fd..4e603cb1c085 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
   eval:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - uses: ./.github/actions/install-nix-action
@@ -40,7 +40,7 @@ jobs:
     name: pre-commit checks
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/install-nix-action
         with:
           dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
@@ -87,7 +87,7 @@ jobs:
     runs-on: ${{ matrix.runs-on }}
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - uses: ./.github/actions/install-nix-action
@@ -144,7 +144,7 @@ jobs:
     continue-on-error: true
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - uses: ./.github/actions/install-nix-action
@@ -164,23 +164,23 @@ jobs:
           - scenario: on ubuntu
             runs-on: ubuntu-24.04
             os: linux
-            experimental-installer: false
+            rust-installer: false
           - scenario: on macos
             runs-on: macos-14
             os: darwin
-            experimental-installer: false
-          - scenario: on ubuntu (experimental)
+            rust-installer: false
+          - scenario: on ubuntu (rust)
             runs-on: ubuntu-24.04
             os: linux
-            experimental-installer: true
-          - scenario: on macos (experimental)
+            rust-installer: true
+          - scenario: on macos (rust)
             runs-on: macos-14
             os: darwin
-            experimental-installer: true
+            rust-installer: true
     name: installer test ${{ matrix.scenario }}
     runs-on: ${{ matrix.runs-on }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - name: Download installer tarball
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
@@ -188,22 +188,19 @@ jobs:
         path: out
     - name: Looking up the installer tarball URL
       id: installer-tarball-url
-      run: |
-        echo "installer-url=file://$GITHUB_WORKSPACE/out" >> "$GITHUB_OUTPUT"
-        TARBALL_PATH="$(find "$GITHUB_WORKSPACE/out" -name 'nix*.tar.xz' -print | head -n 1)"
-        echo "tarball-path=file://$TARBALL_PATH" >> "$GITHUB_OUTPUT"
-    - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
-      if: ${{ !matrix.experimental-installer }}
+      run: echo "installer-url=file://$GITHUB_WORKSPACE/out" >> "$GITHUB_OUTPUT"
+    - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
+      if: ${{ !matrix.rust-installer }}
       with:
         install_url: ${{ format('{0}/install', steps.installer-tarball-url.outputs.installer-url) }}
         install_options: ${{ format('--tarball-url-prefix {0}', steps.installer-tarball-url.outputs.installer-url) }}
-    - uses: ./.github/actions/install-nix-action
-      if: ${{ matrix.experimental-installer }}
-      with:
-        dogfood: false
-        experimental-installer: true
-        tarball_url: ${{ steps.installer-tarball-url.outputs.tarball-path }}
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Run rust installer
+      if: ${{ matrix.rust-installer }}
+      run: |
+        chmod +x out/nix-installer
+        ./out/nix-installer install --no-confirm
+      env:
+        RUST_BACKTRACE: full
     - run: sudo apt install fish zsh
       if: matrix.os == 'linux'
     - run: brew install fish
@@ -220,7 +217,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: clang-tidy
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - uses: ./.github/actions/install-nix-action
@@ -238,14 +235,14 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout nix
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Checkout flake-regressions
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: NixOS/flake-regressions
           path: flake-regressions
       - name: Checkout flake-regressions-data
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: NixOS/flake-regressions-data
           path: flake-regressions/tests
@@ -258,7 +255,7 @@ jobs:
         id: installer-tarball-url
         run: |
           echo "installer-url=file://$GITHUB_WORKSPACE/out" >> "$GITHUB_OUTPUT"
-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
         with:
           install_url: ${{ format('{0}/install', steps.installer-tarball-url.outputs.installer-url) }}
           install_options: ${{ format('--tarball-url-prefix {0}', steps.installer-tarball-url.outputs.installer-url) }}
@@ -275,7 +272,7 @@ jobs:
       github.event_name == 'push' &&
       github.ref_name == 'master'
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - uses: ./.github/actions/install-nix-action
diff --git a/.github/workflows/upload-release.yml b/.github/workflows/upload-release.yml
index cd21336c8913..332115cfd992 100644
--- a/.github/workflows/upload-release.yml
+++ b/.github/workflows/upload-release.yml
@@ -3,7 +3,7 @@ on:
   workflow_dispatch:
     inputs:
       eval_id:
-        description: "Hydra evaluation ID"
+        description: "Hydra evaluation ID (from the maintenance-X.Y-release jobset)"
         required: true
         type: number
       is_latest:
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-24.04
     environment: releases
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/install-nix-action
         with:
           dogfood: false # Use stable version
@@ -34,7 +34,7 @@ jobs:
           # get the same uberhack that nix-shell has to support it.
           echo "NIX_PATH=nixpkgs=$NIXPKGS_PATH" >> "$GITHUB_ENV"
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
         with:
           role-to-assume: "arn:aws:iam::080433136561:role/nix-release"
           role-session-name: nix-release-oidc-${{ github.run_id }}
@@ -51,12 +51,12 @@ jobs:
           echo '{"features":{"containerd-snapshotter":false}}' | sudo tee /etc/docker/daemon.json > /dev/null
           sudo systemctl restart docker
       - name: Login to Docker Hub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.gitignore b/.gitignore
index 7fd5574cae92..c0d09b7e189c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,23 +5,6 @@ src/.wraplock
 # Python bytecode (clang-tidy runner scripts)
 __pycache__/
 
-# /tests/functional/
-/tests/functional/common/subst-vars.sh
-/tests/functional/restricted-innocent
-/tests/functional/debugger-test-out
-/tests/functional/test-libstoreconsumer/test-libstoreconsumer
-/tests/functional/nix-shell
-
-# /tests/functional/lang/
-/tests/functional/lang/*.out
-/tests/functional/lang/*.out.xml
-/tests/functional/lang/*.err
-/tests/functional/lang/*.ast
-
-# /tests/functional/cli-characterisation/
-/tests/functional/cli-characterisation/*.out
-/tests/functional/cli-characterisation/*.err
-
 /outputs
 
 *~
diff --git a/.version b/.version
index aa5388f63762..3a05135cd86d 100644
--- a/.version
+++ b/.version
@@ -1 +1 @@
-2.35.0
+2.36.0
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 9c170ae4a770..f6679e0a8c93 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -68,6 +68,7 @@ Check out the [security policy](https://github.com/NixOS/nix/security/policy).
 
    * Make sure to have [a clean history of commits on your branch by using rebase](https://www.digitalocean.com/community/tutorials/how-to-rebase-and-update-a-pull-request).
    * [Mark the pull request as draft](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request) if you're not done with the changes.
+   * Review the **Automation/AI Policy** below.
 
 6. Do not expect your pull request to be reviewed immediately.
    Nix maintainers follow a [structured process for reviews and design decisions](https://github.com/NixOS/nix/tree/master/maintainers#project-board-protocol), which may or may not prioritise your work.
@@ -87,6 +88,66 @@ Check out the [security policy](https://github.com/NixOS/nix/security/policy).
 
 7. If you need additional feedback or help to getting pull request into shape, ask other contributors using [@mentions](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#mentioning-people-and-teams).
 
+## Automation/AI policy
+
+Every contribution to Nix and related development venues, including code, documentation, and communication on GitHub and Matrix, must have a responsible person in the loop who is accountable for that contribution and reviews it before submission, and must transparently disclose any non‐trivial use of automation to produce it, including but not limited to LLM‐based AI tools.
+
+Human communication must remain human. Pull request / issue descriptions and comments, documentation, commit messages, and code comments must be human-authored.
+
+The following sections give more detail.
+
+### Scope
+
+Any use of automated tools to generate non‐trivial amounts of output as part of a contribution, in whole or in part, verbatim or edited, is covered by this policy, except as listed in the Exemptions section.
+Both LLM‐based AI tools and hand‐written automation are covered.
+Contributions include code and documentation in commits, commit messages, pull request summaries and reviews, issue and vulnerability reports, GitHub comments, Matrix messages, and Discourse posts.
+The covered venues are the GitHub repositories for Nix and related projects under the jurisdiction of the Nix team, Matrix rooms that are focused on development of those projects, and Discourse topics about Nix development.
+
+PRs that seek to address issues that appear easier to fix, such as those marked with [good first issue](https://github.com/NixOS/nix/labels/good%20first%20issue), are held to the same standard as other issues.
+Just because the problem seems "easy" and more likely to be successfully fixed by an unsupervised agent does not mean bending the rules is permissible.
+Even the most trivial changes still must have a responsible person in the loop.
+
+### Accountability
+
+Everyone who submits a contribution to Nix is responsible for it, regardless of the use of automated tooling.
+Before submission, they must establish a reasonable level of understanding of the contribution and expectation of its correctness.
+A contributor submitting a contribution intended for inclusion in Nix is also responsible for ensuring that it is [appropriately licensed](https://github.com/NixOS/nix/blob/master/COPYING) and credited, and not encumbered by any incompatible copyright.
+
+When output from automated tooling is used in contributions, a contributor must establish confidence in that output.
+
+This policy applies equally to any further discussion of a contribution.
+Comments and reviews must separately satisfy the same requirements of understanding, review, and disclosure.
+Contributors are expected to be able to answer questions about their contribution and respond to feedback appropriately, **without simply forwarding messages back and forth to automated tools**.
+
+It is not permitted to submit automated contributions without any manual review or intervention, outside of standard community automation.
+Automation without any manual review must not be used as the sole arbiter of whether to merge a change.
+
+### Transparency
+
+All covered use of automated tooling for a contribution must be disclosed as part of that contribution.
+
+In the case of LLM‐based AI tooling used for commits, this **must** be in the form of an `Assisted-by:` Git commit trailer, including at least the tool name and the primary model name and version used for the contribution. When using unreleased models, it is acceptable to say "unspecified".
+A `Co-authored-by:` trailer does not satisfy this policy.
+
+Any adequate form of disclosure is permitted for other kinds of tooling and contribution.
+
+### Exemptions
+
+The following situations are fully or partially exempt:
+
+* Use of standard deterministic editor/IDE/formatter/text transformation tooling to produce changes that the author manually reviews and understands is exempt, including inline "auto‐completion" (even if LLM‐based) of short, rote snippets of text that do not contribute anything beyond boilerplate the author would have written anyway, and spelling and grammar checkers.
+
+* Use of standard community automation is exempt (e.g. dependabot).
+
+* Use of AI tools for research, testing, debugging, or review is out of scope, if no substantial amount of their output is included in the resulting contribution.
+  However, if these tools had a significant technical influence on your contribution, you are still responsible for it per the Accountability section, and are expected to disclose this where relevant.
+
+* Use of machine translation for commit and pull request descriptions and comments is exempt from the requirement to understand the translated output.
+  However, the requirements of appropriate confidence in the original text, responsibility, and disclosure still apply, and you should additionally include the original untranslated contribution.
+
+* Use of automation in a contribution clearly marked as not being ready for merge (e.g. a draft pull request) is exempt from the requirement for full self‐review, as long as some amount of review has been done and it is expected that the requirements will be met by the time it is marked as ready.
+  This does not waive any other requirement.
+
 ## Making changes to the Nix manual
 
 The Nix reference manual is hosted on https://nix.dev/manual/nix.
diff --git a/ci/gha/tests/default.nix b/ci/gha/tests/default.nix
index 5e1b23c7a36b..8d2383a92fb9 100644
--- a/ci/gha/tests/default.nix
+++ b/ci/gha/tests/default.nix
@@ -57,8 +57,6 @@ rec {
       nix-expr = prev.nix-expr.override { enableGC = !withSanitizers; };
 
       mesonComponentOverrides = lib.composeManyExtensions componentOverrides;
-      # Unclear how to make Perl bindings work with a dynamically linked ASAN.
-      nix-perl-bindings = if withSanitizers then null else prev.nix-perl-bindings;
     }
   );
 
diff --git a/ci/gha/tests/prepare-installer-for-github-actions b/ci/gha/tests/prepare-installer-for-github-actions
index 0fbecf25c2aa..e240e56fca0a 100755
--- a/ci/gha/tests/prepare-installer-for-github-actions
+++ b/ci/gha/tests/prepare-installer-for-github-actions
@@ -2,10 +2,14 @@
 
 set -euo pipefail
 
-nix build -L ".#installerScriptForGHA" ".#binaryTarball"
+nix build -L \
+  ".#installerScriptForGHA" \
+  ".#binaryTarball" \
+  ".#rustInstaller"
 
 mkdir -p out
 cp ./result/install "out/install"
 name="$(basename "$(realpath ./result-1)")"
 # everything before the first dash
 cp -r ./result-1 "out/${name%%-*}"
+cp ./result-2/bin/nix-installer "out/nix-installer"
diff --git a/doc/manual/generate-store-info.nix b/doc/manual/generate-store-info.nix
index e66611affe08..a58d4f79e132 100644
--- a/doc/manual/generate-store-info.nix
+++ b/doc/manual/generate-store-info.nix
@@ -46,10 +46,12 @@ let
 
         ## Settings
 
-        ${showSettings {
-          prefix = "store-${slug}";
-          inherit inlineHTML;
-        } settings}
+        ${replaceStrings [ "@store-slug@" ] [ "store-${slug}" ] (
+          showSettings {
+            prefix = "store-${slug}";
+            inherit inlineHTML;
+          } settings
+        )}
       '';
 
       experimentalFeatureNote = optionalString (experimentalFeature != null) ''
diff --git a/doc/manual/meson.build b/doc/manual/meson.build
index 6fd841e80cbb..f8c37b75b301 100644
--- a/doc/manual/meson.build
+++ b/doc/manual/meson.build
@@ -1,7 +1,7 @@
 project(
   'nix-manual',
   version : files('.version'),
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -241,7 +241,9 @@ foreach command : nix_nested_manpages
         meson.current_source_dir() / 'source',
         meson.current_build_dir() / 'source',
         doc_url,
-        meson.current_source_dir() / 'source/command-ref' / command[0] / (page + '.md'),
+        meson.current_source_dir() / 'source/command-ref' / command[0] / (
+          page + '.md'
+        ),
         '@OUTPUT0@',
       ],
       input : [
@@ -257,6 +259,7 @@ foreach command : nix_nested_manpages
 endforeach
 
 nix3_manpages = [
+  'nix',
   'nix3-build',
   'nix3-bundle',
   'nix3-config',
@@ -264,29 +267,34 @@ nix3_manpages = [
   'nix3-config-show',
   'nix3-copy',
   'nix3-daemon',
-  'nix3-derivation-add',
   'nix3-derivation',
+  'nix3-derivation-add',
   'nix3-derivation-show',
   'nix3-develop',
   'nix3-edit',
+  'nix3-env',
   'nix3-env-shell',
   'nix3-eval',
+  'nix3-flake',
   'nix3-flake-archive',
   'nix3-flake-check',
   'nix3-flake-clone',
   'nix3-flake-info',
   'nix3-flake-init',
   'nix3-flake-lock',
-  'nix3-flake',
   'nix3-flake-metadata',
   'nix3-flake-new',
   'nix3-flake-prefetch',
+  'nix3-flake-prefetch-inputs',
   'nix3-flake-show',
   'nix3-flake-update',
   'nix3-fmt',
-  'nix3-hash-file',
+  'nix3-formatter',
+  'nix3-formatter-build',
+  'nix3-formatter-run',
   'nix3-hash',
   'nix3-hash-convert',
+  'nix3-hash-file',
   'nix3-hash-path',
   'nix3-hash-to-base16',
   'nix3-hash-to-base32',
@@ -294,15 +302,15 @@ nix3_manpages = [
   'nix3-hash-to-sri',
   'nix3-help',
   'nix3-help-stores',
+  'nix3-key',
   'nix3-key-convert-secret-to-public',
   'nix3-key-generate-secret',
-  'nix3-key',
   'nix3-log',
+  'nix3-nar',
   'nix3-nar-cat',
   'nix3-nar-dump-path',
   'nix3-nar-ls',
   'nix3-nar-pack',
-  'nix3-nar',
   'nix3-path-info',
   'nix3-print-dev-env',
   'nix3-profile',
@@ -314,19 +322,21 @@ nix3_manpages = [
   'nix3-profile-rollback',
   'nix3-profile-upgrade',
   'nix3-profile-wipe-history',
-  'nix3-realisation-info',
-  'nix3-realisation',
+  'nix3-registry',
   'nix3-registry-add',
   'nix3-registry-list',
-  'nix3-registry',
   'nix3-registry-pin',
   'nix3-registry-remove',
+  'nix3-registry-resolve',
   'nix3-repl',
   'nix3-run',
   'nix3-search',
+  'nix3-store',
   'nix3-store-add',
   'nix3-store-add-file',
   'nix3-store-add-path',
+  'nix3-store-build-trace-info',
+  'nix3-store-build-trace',
   'nix3-store-cat',
   'nix3-store-copy-log',
   'nix3-store-copy-sigs',
@@ -337,16 +347,15 @@ nix3_manpages = [
   'nix3-store-info',
   'nix3-store-ls',
   'nix3-store-make-content-addressed',
-  'nix3-store',
   'nix3-store-optimise',
   'nix3-store-path-from-hash-part',
   'nix3-store-prefetch-file',
   'nix3-store-repair',
+  'nix3-store-roots-daemon',
   'nix3-store-sign',
   'nix3-store-verify',
   'nix3-upgrade-nix',
   'nix3-why-depends',
-  'nix',
 ]
 
 foreach page : nix3_manpages
diff --git a/doc/manual/package.nix b/doc/manual/package.nix
index af5e6cf1c229..817b05dbc1c0 100644
--- a/doc/manual/package.nix
+++ b/doc/manual/package.nix
@@ -144,6 +144,21 @@ mkMesonDerivation (finalAttrs: {
               # Exclude undocumented builtins
               ".*/language/builtins\\.html#builtins-addErrorContext"
               ".*/language/builtins\\.html#builtins-appendContext"
+              # `print.html` aggregates content from all pages, including
+              # the JSON schema pages and builtins pages excluded above,
+              # so it inherits the same broken fragment links.
+              ".*/print\\.html#algorithm"
+              ".*/print\\.html#root"
+              ".*/print\\.html#builtins-addErrorContext"
+              ".*/print\\.html#builtins-appendContext"
+              ".*/print\\.html#derivations_pattern1_structuredAttrs_additionalProperties"
+              ".*/print\\.html#structuredAttrs_additionalProperties"
+            ];
+            # `404.html` uses `<base href="/">` so that absolute links
+            # work on the deployed site. Lychee cannot resolve `/` against
+            # a local file path, so skip the file entirely.
+            exclude_path = [
+              ".*/404\\.html"
             ];
           };
         };
diff --git a/doc/manual/redirects.json b/doc/manual/redirects.json
index 0a6c71508006..04e14aacc3d5 100644
--- a/doc/manual/redirects.json
+++ b/doc/manual/redirects.json
@@ -337,7 +337,7 @@
         "string-literal": "string-literals.html"
     },
     "language/derivations.html": {
-        "builder-execution": "../store/building.html#builder-execution"
+        "builder-execution": "../store/building.html"
     },
     "installation/installing-binary.html": {
         "linux": "uninstall.html#linux",
@@ -353,7 +353,6 @@
         "debugging-failing-functional-tests": "testing.html#debugging-failing-functional-tests",
         "integration-tests": "testing.html#integration-tests",
         "installer-tests": "testing.html#installer-tests",
-        "one-time-setup": "testing.html#one-time-setup",
         "using-the-ci-generated-installer-for-manual-testing":
             "testing.html#using-the-ci-generated-installer-for-manual-testing",
         "characterization-testing": "testing.html#characterisation-testing-unit",
@@ -363,6 +362,9 @@
         "reverting": "contributing.html#reverting",
         "branches": "contributing.html#branches"
     },
+    "store/store-path.html": {
+        "store-directory": "#store-directory-path"
+    },
     "glossary.html": {
         "gloss-local-store": "store/types/local-store.html",
         "package-attribute-set": "#package",
diff --git a/doc/manual/remove_before_wrapper.py b/doc/manual/remove_before_wrapper.py
index 6da4c19b0ce7..a0fcb6a55776 100644
--- a/doc/manual/remove_before_wrapper.py
+++ b/doc/manual/remove_before_wrapper.py
@@ -22,7 +22,7 @@ def main():
     shutil.rmtree(output, ignore_errors=True)
     shutil.rmtree(output_temp, ignore_errors=True)
 
-    # Execute nix command with `--write-to` tempary output
+    # Execute nix command with `--write-to` temporary output
     nix_command_write_to = nix_command + ['--write-to', output_temp]
     subprocess.run(nix_command_write_to, check=True)
 
diff --git a/doc/manual/rl-next/async-post-build-hook.md b/doc/manual/rl-next/async-post-build-hook.md
deleted file mode 100644
index ea061f14ae9d..000000000000
--- a/doc/manual/rl-next/async-post-build-hook.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-synopsis: Make post-build-hook asynchronous
-prs: [15451]
-issues: [15406]
----
-
-This change makes the `post-build-hook` run asynchronously but still as part of the goal.
-This retains the current behavior that a waiting goal will not start until the `post-build-hook` of the goal it is waiting on completes.
-However, multiple `post-build-hook`s can now run concurrently just as multiple goals can run concurrently.
diff --git a/doc/manual/rl-next/aws-sts-webidentity-region-fallback.md b/doc/manual/rl-next/aws-sts-webidentity-region-fallback.md
deleted file mode 100644
index 5034c65438cb..000000000000
--- a/doc/manual/rl-next/aws-sts-webidentity-region-fallback.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-synopsis: S3 substituters fall back to the URL's region for STS WebIdentity auth
-prs: [15594]
----
-
-When authenticating to an S3 binary cache via STS WebIdentity (EKS IRSA,
-GitHub Actions OIDC), Nix now uses the `?region=` parameter from the S3 URL
-as a fallback for the STS endpoint region if neither `AWS_REGION` nor
-`AWS_DEFAULT_REGION` is set. Previously, IRSA setups that exported
-`AWS_WEB_IDENTITY_TOKEN_FILE` and `AWS_ROLE_ARN` but no region would fail
-with a misleading "IMDS provider" error.
diff --git a/doc/manual/rl-next/beta-installer b/doc/manual/rl-next/beta-installer
deleted file mode 100644
index b02564d95d2d..000000000000
--- a/doc/manual/rl-next/beta-installer
+++ /dev/null
@@ -1,29 +0,0 @@
----
-synopsis: "Rust nix-installer in beta"
-prs: []
----
-
-The Rust-based rewrite of the Nix installer is now in beta.
-We'd love help testing it out!
-
-To test out the new installer, run:
-```
-curl -sSfL https://artifacts.nixos.org/nix-installer | sh -s -- install
-```
-
-This installer can be run even when you have an existing, script-based Nix installation without any adjustments.
-
-This new installer also comes with the ability to uninstall your Nix installation; run:
-```
-/nix/nix-installer uninstall
-```
-
-This will get rid of your entire Nix installation (even if you installed over an existing, script-based installation).
-
-This installer is a modified version of the [Determinate Nix Installer](https://github.com/DeterminateSystems/nix-installer) by Determinate Systems.
-Thanks to Determinate Systems for all the investment they've put into the installer.
-
-Source for the installer is in https://github.com/NixOS/nix-installer.
-Report any issues in that repo.
-
-For CI usage, a GitHub Action to install Nix using this installer is available at https://github.com/NixOS/nix-installer-action.
diff --git a/doc/manual/rl-next/build-trace-rework.md b/doc/manual/rl-next/build-trace-rework.md
deleted file mode 100644
index 61b6bc51b1c0..000000000000
--- a/doc/manual/rl-next/build-trace-rework.md
+++ /dev/null
@@ -1,96 +0,0 @@
----
-synopsis: "Content-addressed derivations: realisations keyed by store path instead of hash modulo"
-issues: [11897]
-prs: [12464]
----
-
-The experimental content-addressed (CA) derivation feature has undergone a significant change to how build traces (formerly called "realisations") are identified. This affects the **binary cache protocol** and the **wire protocols**.
-
-### What changed
-
-#### Build trace format
-
-Previously, a build trace entry (realisation) was keyed by the **hash modulo** of the derivation.
-A SHA-256 hash computed via the complex "derivation hash modulo" algorithm.
-This required implementations to understand ATerm serialisation and the full derivation hashing scheme just to look up or store build results.
-
-Now, build trace entries are keyed by the **regular derivation store path** plus the output name. For example, instead of:
-
-```
-sha256:ba7816bf8f01...!out
-```
-
-The key is now:
-
-```
-/nix/store/abc...-foo.drv^out
-```
-
-This is simpler, more intuitive, and means that third-party tools implementing CA derivation support (e.g., Hydra)
-no longer need to implement the derivation hash modulo algorithm.
-
-#### Build trace usage
-
-Previously the build trace contained entries for both unresolved and [resolved](@docroot@/store/resolution.md) derivations.
-Now, it only contains entries for resolved derivations.
-For now, unresolved derivations will be resolved from these underlying build trace entries.
-This is slower, but avoids a bunch of correctness issues.
-
-### Binary cache protocol
-
-- The directory for build traces moved from `realisations/` to `build-trace-v2/`.
-- File paths changed from `realisations/<hash>!<output>.doi` to `build-trace-v2/<drvName>/<outputName>.doi`.
-- The JSON format of build trace entries is now split into `key` and `value` objects:
-  ```json
-  {
-    "key": {
-      "drvPath": "abc...-foo.drv",
-      "outputName": "out"
-    },
-    "value": {
-      "outPath": "xyz...-foo",
-      "signatures": [{ "keyName": "cache.example.com-1", "sig": "..." }]
-    }
-  }
-  ```
-  Previously, these were flat objects with a string `id` field like `"sha256:...!out"`.
-- The deprecated `dependentRealisations` field has been removed.
-
-Existing binary caches will need to be re-populated with the new format for CA derivation build traces.
-Old build traces at the previous URLs are simply abandoned.
-Non-CA builds are unaffected.
-
-### Wire protocols
-
-- **Worker protocol**:
-  A new feature flag `realisation-with-path-not-hash` is negotiated during the handshake.
-  Clients and daemons that both support this feature use the new binary serialisation for `DrvOutput`, `UnkeyedRealisation`, and related types.
-  Fallback to older protocol versions gracefully degrades (realisations are unavailable).
-- **Serve protocol**:
-  Bumped from 2.7 to 2.8 with native serialisers for the new types.
-  Fallback to older protocol versions gracefully degrades in the same way.
-
-Stable code paths do use the realization fields (`BuildResult::Success::builtOutputs`), but only the output name and outpath parts of that.
-For older protocols, we can fake enough of the realisation format to provide those two parts forthat map, which keeps operations like `--print-output-paths` working.
-
-### Local Store SQLite schema
-
-The build trace entries no longer have any foreign key store objects in the store.
-This is because we will need to remember the build trace entries for resolved derivations we may have deleted, otherwise we will effectively forget outputs resolved derivations we do have on disk.
-GC for build trace will be implemented later --- there is no single correct choice (there is no closure property) so it will be a question of what policies users want.
-
-### Structured signatures
-
-[Signatures](@docroot@/protocols/json/signature.md) in JSON formats are now represented as structured objects with `keyName` and `sig` fields, rather than colon-separated strings.
-`nix path-info --json --json-format 3` opts into the new version for this command.
-JSON parsing accepts both the old string format and new structured format for backwards compatibility.
-
-### Impact
-
-- **Non-CA derivation users**: No impact. This only affects the experimental `ca-derivations` feature.
-- **Binary cache operators**:
-  Binary caches serving CA derivation build traces will need to be repopulated.
-  Existing NARs and narinfo files are unaffected.
-- **Tool authors**:
-  Implementations interfacing with the CA derivations protocol are simplified.
-  The derivation hash modulo algorithm is no longer required to form build trace keys.
diff --git a/doc/manual/rl-next/closure-gc.md b/doc/manual/rl-next/closure-gc.md
deleted file mode 100644
index fc24d5e08b9b..000000000000
--- a/doc/manual/rl-next/closure-gc.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-synopsis: "Added `--skip-alive` option to `nix store delete` for collecting garbage within a closure"
-issues: 7239
-prs: 15236
----
-
-`nix store delete --recursive --skip-alive` can be used to collect garbage
-within a closure, in which case it will only collect the dead paths that are
-part of the closure of its arguments.
diff --git a/doc/manual/rl-next/filetransfer-retry-backoff.md b/doc/manual/rl-next/filetransfer-retry-backoff.md
deleted file mode 100644
index 0e26ccd54a8c..000000000000
--- a/doc/manual/rl-next/filetransfer-retry-backoff.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-synopsis: Configurable file-transfer retry backoff with full jitter and Retry-After support
-issues: [15419, 15023]
-prs: [15449]
----
-
-File transfer retries (downloads and uploads) now use AWS-style "full jitter"
-exponential backoff, treat HTTP 503 as rate-limited (same longer delay as 429),
-and honor the `Retry-After` response header. Retry timing is configurable via
-new `nix.conf` settings:
-
-- `filetransfer-retry-delay` (default 100ms): base delay for transient errors
-- `filetransfer-retry-delay-rate-limited` (default 5000ms): base delay for 429/503
-- `filetransfer-retry-max-delay` (default 60000ms): per-attempt delay ceiling
-- `filetransfer-retry-jitter` (default true): enable full jitter
-
-The existing `download-attempts` setting has been renamed to
-`filetransfer-retry-attempts` to reflect that it applies to uploads as well as
-downloads. The old name remains as an alias for backwards compatibility.
-
-Per-substituter overrides are available as store URL parameters
-(`retry-delay`, `retry-delay-rate-limited`, `retry-max-delay`,
-`retry-attempts`), e.g. `s3://my-cache?retry-attempts=8`.
-
-This addresses thundering-herd scenarios where many CI jobs hit the same
-S3 prefix and receive 503 SlowDown; previously the retry window for 503
-was only ~4 seconds.
diff --git a/doc/manual/rl-next/fix-primop-eval-state.md b/doc/manual/rl-next/fix-primop-eval-state.md
deleted file mode 100644
index 1a3bc287538f..000000000000
--- a/doc/manual/rl-next/fix-primop-eval-state.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-synopsis: "C API: Fix `EvalState` pointer passed to primop callbacks"
-prs: [15300, 15383]
----
-
-The `EvalState *` passed to C API primop callbacks was incorrectly pointing to
-the internal `nix::EvalState` rather than the C API wrapper struct. This caused
-a segfault when the callback used the pointer with C API functions such as
-`nix_alloc_value()`. The same issue affected `printValueAsJSON` and
-`printValueAsXML` callbacks on external values.
diff --git a/doc/manual/rl-next/getflake-path.md b/doc/manual/rl-next/getflake-path.md
deleted file mode 100644
index 2360fe7693e0..000000000000
--- a/doc/manual/rl-next/getflake-path.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-synopsis: "`builtins.getFlake` now supports path values"
-prs: [15290]
----
-
-`builtins.getFlake` now accepts path values in addition to flakerefs, allowing you to write `builtins.getFlake ./subflake` instead of having to use ugly workarounds to construct a pure flakeref.
diff --git a/doc/manual/rl-next/git-url-scp.md b/doc/manual/rl-next/git-url-scp.md
deleted file mode 100644
index b1125f7b32a7..000000000000
--- a/doc/manual/rl-next/git-url-scp.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-synopsis: Support SCP-like URLs in fetchGit and type = "git" flake inputs
-prs: [14863]
-issues: [14852, 14867]
----
-
-Nix now (once again) recognizes [SCP-like syntax for Git URLs](https://git-scm.com/docs/git-clone#_git_urls). This partially
-restores compatibility with Nix 2.3 for `fetchGit`. The following syntax is once again supported:
-
-```nix
-builtins.fetchGit "host:/absolute/path/to/repo"
-```
-
-Nix also passes through the tilde (for home directories) verbatim:
-
-```nix
-builtins.fetchGit "host:~/relative/to/home"
-```
-
-IPv6 addresses also supported when bracketed:
-
-```nix
-builtins.fetchGit "user@[::1]:~/relative/to/home"
-```
-
-`builtins.fetchTree` also supports this syntax now:
-
-```nix
-builtins.fetchTree { type = "git"; url = "host:/path/to/repo"; }
-```
diff --git a/doc/manual/rl-next/github-fetcher-param-validation.md b/doc/manual/rl-next/github-fetcher-param-validation.md
deleted file mode 100644
index 2fb430ae4b24..000000000000
--- a/doc/manual/rl-next/github-fetcher-param-validation.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-synopsis: GitHub fetcher now validates URL parameters
-prs: [15331]
-issues: [15304]
----
-
-The `github:` fetcher now validates URL parameters, and will error if an invalid parameter like `tag` is provided.
diff --git a/doc/manual/rl-next/mimalloc.md b/doc/manual/rl-next/mimalloc.md
deleted file mode 100644
index dfcde0cab03a..000000000000
--- a/doc/manual/rl-next/mimalloc.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-synopsis: "Link mimalloc for faster evaluation"
-prs: [15596]
----
-
-The `nix` binary now links [mimalloc](https://github.com/microsoft/mimalloc)
-by default on non-Windows platforms, replacing glibc's malloc for all
-non-GC allocations.
-
-This yields a **5–12% wall-clock improvement** on evaluation workloads,
-ranging from `nix-instantiate hello` to `nix-env -qa` and full NixOS
-configurations.
-
-The allocator can be disabled at build time with `-Dmimalloc=disabled`
-or by passing `withMimalloc = false` to the Nix package.
diff --git a/doc/manual/rl-next/s3-credential-chain-web-identity.md b/doc/manual/rl-next/s3-credential-chain-web-identity.md
deleted file mode 100644
index 4dfece0e3b7d..000000000000
--- a/doc/manual/rl-next/s3-credential-chain-web-identity.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-synopsis: "S3: restore STS WebIdentity and ECS container credential providers"
-prs: [15507]
----
-
-Nix 2.33 replaced the S3 backend's `aws-sdk-cpp` credential chain with a
-custom chain built on `aws-c-auth`. That chain omitted two providers,
-breaking S3 binary cache access in container workloads:
-
-- **STS WebIdentity** (`AWS_WEB_IDENTITY_TOKEN_FILE`, `AWS_ROLE_ARN`,
-  `AWS_ROLE_SESSION_NAME`) — used by EKS IRSA, GitHub Actions OIDC, and
-  any `sts:AssumeRoleWithWebIdentity` federation.
-- **ECS container metadata** (`AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`,
-  `AWS_CONTAINER_CREDENTIALS_FULL_URI`) — used by ECS tasks and EKS Pod
-  Identity.
-
-The typical symptom was a misleading IMDS error
-(`Valid credentials could not be sourced by the IMDS provider`), because
-IMDS is the last provider tried after the correct one was skipped.
-
-Both providers are now part of the chain, ordered to match the
-pre-2.33 `DefaultAWSCredentialsProviderChain`:
-`Environment → SSO → Profile → STS WebIdentity → (ECS | IMDS)`.
-As in both the old and new AWS SDK default chains, ECS and IMDS are
-mutually exclusive: when container credential environment variables are
-set, IMDS is skipped.
diff --git a/doc/manual/rl-next/store-config-get-state-dir.md b/doc/manual/rl-next/store-config-get-state-dir.md
deleted file mode 100644
index ba628b140be7..000000000000
--- a/doc/manual/rl-next/store-config-get-state-dir.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-synopsis: "Improve daemon socket path logic for chroot stores"
-prs: [15429]
----
-
-The default daemon socket path now uses the per-store [`state`](@docroot@/store/types/local-store.md#store-setting-state) directory whenever one is defined, rather than always using the global [`NIX_STATE_DIR`](@docroot@/command-ref/env-common.md#env-NIX_STATE_DIR).
-This means [local chroot stores](@docroot@/store/types/local-store.md#chroot) each get their own socket path automatically.
-
-Example:
-
-```bash
-nix-daemon --store /foo/bar
-```
-
-will now use a socket at:
-```
-/foo/bar/nix/var/nix/daemon-socket/socket
-```
-instead of
-```
-$NIX_STATE_DIR/daemon-socket/socket
-```
-
-Users who wish to serve or connect to a chroot store at the old location will have to force the socket location:
-
-- When serving (running a daemon), use the new [`--socket-path`](@docroot@/command-ref/new-cli/nix3-daemon.md#opt-socket-path) flag:
-
-  ```bash
-  nix daemon --socket-path "$NIX_STATE_DIR/daemon-socket/socket"
-  ```
-
-- When connecting as a client  put the path in the [store URL](@docroot@/store/types/local-daemon-store.md):
-
-  ```
-  unix://$NIX_STATE_DIR/daemon-socket/socket
-  ```
diff --git a/doc/manual/rl-next/zstd-multiframe.md b/doc/manual/rl-next/zstd-multiframe.md
deleted file mode 100644
index 6f5d9875df74..000000000000
--- a/doc/manual/rl-next/zstd-multiframe.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-synopsis: zstd compression now emits multi-frame output and uses less memory
-prs: [15550]
----
-
-zstd-compressed NARs are now written as a sequence of independent 16 MiB
-frames instead of a single large frame. This lays the groundwork for
-parallel decompression in a future release without requiring caches to be
-repopulated, and significantly lowers peak memory use during compression
-(e.g. from ~600 MiB to ~100 MiB for a 1 GiB store path).
-
-The output remains standard zstd and is decoded unchanged by existing Nix
-binaries and the `zstd` CLI; compression ratio is effectively unchanged.
-
-Per-frame compression now uses up to 4 worker threads. For zstd this is the
-new default: the `parallel-compression` store setting defaults to `true` when
-`compression=zstd` (it remains `false` for `xz`). Set
-`?parallel-compression=false` to opt out.
diff --git a/doc/manual/source/SUMMARY.md.in b/doc/manual/source/SUMMARY.md.in
index 5a17426b9020..ae77759f5516 100644
--- a/doc/manual/source/SUMMARY.md.in
+++ b/doc/manual/source/SUMMARY.md.in
@@ -19,9 +19,10 @@
 - [Nix Store](store/index.md)
   - [File System Object](store/file-system-object.md)
     - [Content-Addressing File System Objects](store/file-system-object/content-address.md)
+    - [Exposing in OS File Systems](store/file-system-object/os-file-system.md)
   - [Store Object](store/store-object.md)
     - [Content-Addressing Store Objects](store/store-object/content-address.md)
-  - [Store Path](store/store-path.md)
+  - [Store Path and Store Directory](store/store-path.md)
   - [Store Derivation and Deriving Path](store/derivation/index.md)
     - [Derivation Outputs and Types of Derivations](store/derivation/outputs/index.md)
       - [Content-addressing derivation outputs](store/derivation/outputs/content-address.md)
@@ -137,7 +138,9 @@
   - [Serving Tarball Flakes](protocols/tarball-fetcher.md)
   - [Store Path Specification](protocols/store-path.md)
   - [Nix Archive (NAR) Format](protocols/nix-archive/index.md)
-  - [Nix Cache Info Format](protocols/nix-cache-info.md)
+  - [Binary Cache](protocols/binary-cache/index.md)
+    - [`nix-cache-info` Format](protocols/binary-cache/nix-cache-info.md)
+    - [`.narinfo` Format](protocols/binary-cache/narinfo.md)
   - [Derivation "ATerm" file format](protocols/derivation-aterm.md)
   - [Nix32 Encoding](protocols/nix32.md)
 - [C API](c-api.md)
@@ -149,13 +152,14 @@
   - [Debugging](development/debugging.md)
   - [Documentation](development/documentation.md)
   - [CLI guideline](development/cli-guideline.md)
-  - [JSON guideline](development/json-guideline.md)
+  - [Data Modeling Guidelines](development/data-modeling.md)
   - [C++ style guide](development/cxx.md)
   - [Static Analysis](development/static-analysis.md)
   - [Experimental Features](development/experimental-features.md)
   - [Contributing](development/contributing.md)
 - [Releases](release-notes/index.md)
 {{#include ./SUMMARY-rl-next.md}}
+  - [Release 2.35 (2026-06-22)](release-notes/rl-2.35.md)
   - [Release 2.34 (2026-02-27)](release-notes/rl-2.34.md)
   - [Release 2.33 (2025-12-09)](release-notes/rl-2.33.md)
   - [Release 2.32 (2025-10-06)](release-notes/rl-2.32.md)
diff --git a/doc/manual/source/_redirects b/doc/manual/source/_redirects
index 07b3130f9ce9..74815df282c8 100644
--- a/doc/manual/source/_redirects
+++ b/doc/manual/source/_redirects
@@ -27,7 +27,8 @@
 /contributing/documentation /development/documentation 301!
 /contributing/experimental-features /development/experimental-features 301!
 /contributing/cli-guideline /development/cli-guideline 301!
-/contributing/json-guideline /development/json-guideline 301!
+/contributing/json-guideline /development/data-modeling 301!
+/development/json-guideline /development/data-modeling 301!
 /contributing/cxx /development/cxx 301!
 
 /expressions/expression-language /language/ 301!
@@ -36,6 +37,7 @@
 /expressions/language-values /language/values 301!
 /expressions/* /language/:splat 301!
 /language/values /language/types 301!
+/language/values.html /language/types 301!
 /language/constructs /language/syntax 301!
 /language/builtin-constants /language/builtins 301!
 
@@ -46,6 +48,7 @@
 /package-management/package-management /package-management 301!
 /package-management/s3-substituter /store/types/s3-binary-cache-store 301!
 
+/protocols/nix-cache-info /protocols/binary-cache/nix-cache-info 301!
 /protocols/protocols /protocols 301!
 /json/* /protocols/json/:splat 301!
 
diff --git a/doc/manual/source/command-ref/env-common.md b/doc/manual/source/command-ref/env-common.md
index 7ea1d0e5aa99..cc7fe77eae56 100644
--- a/doc/manual/source/command-ref/env-common.md
+++ b/doc/manual/source/command-ref/env-common.md
@@ -160,7 +160,7 @@ When [`use-xdg-base-directories`] is enabled, the configuration directory is res
 
 Likewise for the state and cache directories.
 
-## Miscellanous environment variables
+## Miscellaneous environment variables
 
 - <span id="env-IN_NIX_SHELL">[`IN_NIX_SHELL`](#env-IN_NIX_SHELL)</span>
 
diff --git a/doc/manual/source/command-ref/nix-collect-garbage.md b/doc/manual/source/command-ref/nix-collect-garbage.md
index 763179b8ee18..07229255e7cd 100644
--- a/doc/manual/source/command-ref/nix-collect-garbage.md
+++ b/doc/manual/source/command-ref/nix-collect-garbage.md
@@ -62,9 +62,9 @@ These options are for deleting old [profiles] prior to deleting unreachable [sto
   This is the equivalent of invoking [`nix-env --delete-generations <period>`](@docroot@/command-ref/nix-env/delete-generations.md#generations-time) on each found profile.
   See the documentation of that command for additional information about the *period* argument.
 
-  - <span id="opt-max-freed">[`--max-freed`](#opt-max-freed)</span> *bytes*
+- <span id="opt-max-freed">[`--max-freed`](#opt-max-freed)</span> *bytes*
 
-<!-- duplication from https://github.com/NixOS/nix/blob/442a2623e48357ff72c77bb11cf2cf06d94d2f90/doc/manual/source/command-ref/nix-store/gc.md?plain=1#L39-L44 -->
+   <!-- duplication from https://github.com/NixOS/nix/blob/442a2623e48357ff72c77bb11cf2cf06d94d2f90/doc/manual/source/command-ref/nix-store/gc.md?plain=1#L39-L44 -->
 
   Keep deleting paths until at least *bytes* bytes have been deleted,
   then stop. The argument *bytes* can be followed by the
diff --git a/doc/manual/source/command-ref/nix-hash.md b/doc/manual/source/command-ref/nix-hash.md
index 7c17ce9095b4..c1a4251b0973 100644
--- a/doc/manual/source/command-ref/nix-hash.md
+++ b/doc/manual/source/command-ref/nix-hash.md
@@ -45,20 +45,20 @@ md5sum`.
 
 - `--base32`
 
-  Print the hash in a base-32 representation rather than hexadecimal.
-  This base-32 representation is more compact and can be used in Nix
+  Print the hash in [Nix32](@docroot@/protocols/nix32.md) representation rather than hexadecimal.
+  This representation is more compact and can be used in Nix
   expressions (such as in calls to `fetchurl`).
 
 - `--base64`
 
-  Similar to --base32, but print the hash in a base-64 representation,
-  which is more compact than the base-32 one.
+  Similar to `--base32`, but print the hash in a [Base64](https://en.wikipedia.org/wiki/Base64) representation,
+  which is more compact than the Nix32 one.
 
 - `--sri`
 
-  Print the hash in SRI format with base-64 encoding.
+  Print the hash in [SRI](@docroot@/glossary.md#gloss-sri) format with Base64 encoding.
   The type of hash algorithm will be prepended to the hash string,
-  followed by a hyphen (-) and the base-64 hash body.
+  followed by a hyphen (-) and the Base64 hash body.
 
 - `--truncate`
 
@@ -71,18 +71,18 @@ md5sum`.
 
 - `--to-base16`
 
-  Don’t hash anything, but convert the base-32 hash representation
+  Don’t hash anything, but convert the [Nix32](@docroot@/protocols/nix32.md) hash representation
   *hash* to hexadecimal.
 
 - `--to-base32`
 
   Don’t hash anything, but convert the hexadecimal hash representation
-  *hash* to base-32.
+  *hash* to [Nix32](@docroot@/protocols/nix32.md).
 
 - `--to-base64`
 
   Don’t hash anything, but convert the hexadecimal hash representation
-  *hash* to base-64.
+  *hash* to Base64.
 
 - `--to-sri`
 
@@ -134,7 +134,7 @@ $ nix-hash --type sha256 --flat test/world
 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03
 ```
 
-Converting between hexadecimal, base-32, base-64, and SRI:
+Converting between hexadecimal, Nix32, Base64, and SRI:
 
 ```console
 $ nix-hash --type sha1 --to-base32 e4fd8ba5f7bbeaea5ace89fe10255536cd60dab6
diff --git a/doc/manual/source/command-ref/nix-prefetch-url.md b/doc/manual/source/command-ref/nix-prefetch-url.md
index 8451778ad46d..86c20b9e1de4 100644
--- a/doc/manual/source/command-ref/nix-prefetch-url.md
+++ b/doc/manual/source/command-ref/nix-prefetch-url.md
@@ -32,7 +32,7 @@ Otherwise, the file is downloaded, and an error is signaled if the
 actual hash of the file does not match the specified hash.
 
 This command prints the hash on standard output.
-The hash is printed using base-32 unless `--type md5` is specified,
+The hash is printed using [Nix32](@docroot@/protocols/nix32.md) unless `--type md5` is specified,
 in which case it's printed using base-16.
 Additionally, if the option `--print-path` is used,
 the path of the downloaded file in the Nix store is also printed.
diff --git a/doc/manual/source/development/building.md b/doc/manual/source/development/building.md
index 742170f76c6c..13bcd849e24f 100644
--- a/doc/manual/source/development/building.md
+++ b/doc/manual/source/development/building.md
@@ -199,23 +199,7 @@ Nix uses a string with the following format to identify the *system type* or *pl
 <cpu>-<os>[-<abi>]
 ```
 
-It is set when Nix is compiled for the given system, and based on the output of Meson's [`host_machine` information](https://mesonbuild.com/Reference-manual_builtin_host_machine.html)>
-
-```
-<cpu>-<vendor>-<os>[<version>][-<abi>]
-```
-
-When cross-compiling Nix with Meson for local development, you need to specify a [cross-file](https://mesonbuild.com/Cross-compilation.html) using the `--cross-file` option. Cross-files define the target architecture and toolchain. When cross-compiling Nix with Nix, Nixpkgs takes care of this for you.
-
-In the nix flake we also have some cross-compilation targets available:
-
-```
-nix build .#nix-everything-riscv64-unknown-linux-gnu
-nix build .#nix-everything-armv7l-unknown-linux-gnueabihf
-nix build .#nix-everything-armv7l-unknown-linux-gnueabihf
-nix build .#nix-everything-x86_64-unknown-freebsd
-nix build .#nix-everything-x86_64-w64-mingw32
-```
+It is set when Nix is compiled for the given system, and based on the output of Meson's [`host_machine` information](https://mesonbuild.com/Reference-manual_builtin_host_machine.html).
 
 For historic reasons and backward-compatibility, some CPU and OS identifiers are translated as follows:
 
@@ -232,6 +216,19 @@ For historic reasons and backward-compatibility, some CPU and OS identifiers are
 | `mips`                      | `big`                   | `mips`              |
 | `mips64`                    | `big`                   | `mips64`            |
 
+
+When cross-compiling Nix with Meson for local development, you need to specify a [cross-file](https://mesonbuild.com/Cross-compilation.html) using the `--cross-file` option. Cross-files define the target architecture and toolchain. When cross-compiling Nix with Nix, Nixpkgs takes care of this for you.
+
+In the nix flake we also have some cross-compilation targets available:
+
+```
+nix build .#nix-everything-riscv64-unknown-linux-gnu
+nix build .#nix-everything-armv7l-unknown-linux-gnueabihf
+nix build .#nix-everything-armv7l-unknown-linux-gnueabihf
+nix build .#nix-everything-x86_64-unknown-freebsd
+nix build .#nix-everything-x86_64-w64-mingw32
+```
+
 ## Compilation environments
 
 Nix can be compiled using multiple environments:
diff --git a/doc/manual/source/development/json-guideline.md b/doc/manual/source/development/data-modeling.md
similarity index 86%
rename from doc/manual/source/development/json-guideline.md
rename to doc/manual/source/development/data-modeling.md
index 309b4b3a06e4..a9d131147588 100644
--- a/doc/manual/source/development/json-guideline.md
+++ b/doc/manual/source/development/data-modeling.md
@@ -1,7 +1,12 @@
-# JSON guideline
+# Data Modeling Guidelines
 
-Nix consumes and produces JSON in a variety of contexts.
-These guidelines ensure consistent practices for all our JSON interfaces, for ease of use, and so that experience in one part carries over to another.
+Nix consumes and produces JSON and attribute sets in a variety of contexts.
+These guidelines ensure consistent practices for our interfaces, for ease of use, and so that experience in one part carries over to another.
+
+For these guidelines, we will use JSON terminology, but they apply equally well to new attribute set interfaces (primops, etc.).
+Note that these are guidelines first and foremost. Exceptions include:
+- Feature testing: e.g., it is OK to do `builtins?frobnicate`.
+- Compatibility: we generally do not change stable interfaces just to make them comply. New replacements can be added with care.
 
 ## Extensibility
 
diff --git a/doc/manual/source/development/debugging.md b/doc/manual/source/development/debugging.md
index 6578632d991a..35e4c71ec388 100644
--- a/doc/manual/source/development/debugging.md
+++ b/doc/manual/source/development/debugging.md
@@ -26,7 +26,6 @@ or GCC. This is useful when debugging memory corruption issues.
 ```console
 [nix-shell]$ export mesonBuildType=debugoptimized
 [nix-shell]$ appendToVar mesonFlags "-Dlibexpr:gc=disabled" # Disable Boehm
-[nix-shell]$ appendToVar mesonFlags "-Dbindings=false" # Disable nix-perl
 [nix-shell]$ appendToVar mesonFlags "-Db_sanitize=address,undefined"
 ```
 
diff --git a/doc/manual/source/development/testing.md b/doc/manual/source/development/testing.md
index 3b80e8a266b0..6ea1a233a4aa 100644
--- a/doc/manual/source/development/testing.md
+++ b/doc/manual/source/development/testing.md
@@ -9,7 +9,7 @@ You can build it yourself:
 
 ```
 # nix build .#hydraJobs.coverage
-# xdg-open ./result/coverage/index.html
+# xdg-open ./result/index.html
 ```
 
 [Extensive records of build metrics](https://hydra.nixos.org/job/nix/master/coverage#tabs-charts), such as test coverage over time, are also available online.
@@ -34,31 +34,28 @@ The unit tests are defined using the [googletest] and [rapidcheck] frameworks.
 > │   ├── value/context.cc
 > │   …
 > │
-> ├── tests
-> │   │
+> ├── libutil-tests
+> │   ├── meson.build
 > │   …
-> │   ├── libutil-tests
-> │   │   ├── meson.build
-> │   │   …
-> │   │   └── data
-> │   │       ├── git/tree.txt
-> │   │       …
-> │   │
-> │   ├── libexpr-test-support
+> │   ├── data
+> │   │   ├── git/tree.txt
+> │       …
+> │
+> ├── libexpr-test-support
+> │   ├── meson.build
+> │   ├── include/nix/expr
 > │   │   ├── meson.build
-> │   │   ├── include/nix/expr
-> │   │   │   ├── meson.build
-> │   │   │   └── tests
-> │   │   │       ├── value/context.hh
-> │   │   │       …
 > │   │   └── tests
-> │   │       ├── value/context.cc
+> │   │       ├── value/context.hh
 > │   │       …
-> │   │
-> │   ├── libexpr-tests
-> │   …   ├── meson.build
+> │   ├── tests
 > │       ├── value/context.cc
 > │       …
+> │
+> ├── libexpr-tests
+> │   ├── meson.build
+> │   ├── value/context.cc
+> │    …
 > …
 > ```
 
@@ -257,15 +254,6 @@ GNU gdb (GDB) 12.1
 One can debug the Nix invocation in all the usual ways.
 For example, enter `run` to start the Nix invocation.
 
-### Troubleshooting
-
-Sometimes running tests in the development shell may leave artefacts in the local repository.
-To remove any traces of that:
-
-```console
-git clean -x --force tests
-```
-
 ### Characterisation testing { #characterisation-testing-functional }
 
 Occasionally, Nix utilizes a technique called [Characterisation Testing](https://en.wikipedia.org/wiki/Characterization_test) as part of the functional tests.
@@ -311,78 +299,34 @@ Generally, this build is sufficient, but in nightly or CI we also test the attri
 
 The integration tests are defined in the Nix flake under the `hydraJobs.tests` attribute.
 These tests include everything that needs to interact with external services or run Nix in a non-trivial distributed setup.
-Because these tests are expensive and require more than what the standard github-actions setup provides, they only run on the master branch (on <https://hydra.nixos.org/jobset/nix/master>).
+Because these tests are expensive and require more than what the standard github-actions setup provides, most of them only run on the master branch (on <https://hydra.nixos.org/jobset/nix/master>).
 
 You can run them manually with `nix build .#hydraJobs.tests.{testName}` or `nix-build -A hydraJobs.tests.{testName}`.
 
 ## Installer tests
 
-After a one-time setup, the Nix repository's GitHub Actions continuous integration (CI) workflow can test the installer each time you push to a branch.
-
-Creating a Cachix cache for your installer tests and adding its authorisation token to GitHub enables [two installer-specific jobs in the CI workflow](https://github.com/NixOS/nix/blob/88a45d6149c0e304f6eb2efcc2d7a4d0d569f8af/.github/workflows/ci.yml#L50-L91):
+GitHub Actions CI in the Nix repository also tests the installer on PRs. It does not require additional setup and utilises [GHA Artifacts](https://docs.github.com/en/actions/tutorials/store-and-share-data) and can be run in any Nix repository fork.
 
-- The `installer` job generates installers for the platforms below and uploads them to your Cachix cache:
+- The `tests` job generates installers for the platforms below and uploads them as an artifact:
   - `x86_64-linux`
-  - `armv6l-linux`
-  - `armv7l-linux`
-  - `x86_64-darwin`
-
-- The `installer_test` job (which runs on `ubuntu-24.04` and `macos-14`) will try to install Nix with the cached installer and run a trivial Nix command.
+  - `aarch64-darwin`
 
-### One-time setup
+- The `installer_test` job (which runs on Linux and macOS) will try to install Nix with the cached installer and run a trivial Nix command.
+- Both the scripted installer and the [standalone Rust-based installer](https://github.com/NixOS/nix-installer) are tested.
 
-1. Have a GitHub account with a fork of the [Nix repository](https://github.com/NixOS/nix).
-2. At cachix.org:
-    - Create or log in to an account.
-    - Create a Cachix cache using the format `<github-username>-nix-install-tests`.
-    - Navigate to the new cache > Settings > Auth Tokens.
-    - Generate a new Cachix auth token and copy the generated value.
-3. At github.com:
-    - Navigate to your Nix fork > Settings > Secrets > Actions > New repository secret.
-    - Name the secret `CACHIX_AUTH_TOKEN`.
-    - Paste the copied value of the Cachix cache auth token.
+You can generate the installer tarball and script manually by running `nix build .#hydraJobs.installerScriptForGHA.<system-double>`.
 
 ## Working on documentation
 
 ### Using the CI-generated installer for manual testing
 
-After the CI run completes, you can check the output to extract the installer URL:
+After the CI run completes, you can check the output to extract the installer artifact:
 1. Click into the detailed view of the CI run.
-2. Click into any `installer_test` run (the URL you're here to extract will be the same in all of them).
-3. Click into the `Run cachix/install-nix-action@v...` step and click the detail triangle next to the first log line (it will also be `Run cachix/install-nix-action@v...`)
-4. Copy the value of `install_url`
-5. To generate an install command, plug this `install_url` and your GitHub username into this template:
+2. Scroll down to `Artifacts` section.
+3. Download the corresponding installer artifact (`installer-darwin` for `aarch64-darwin` and `installer-linux` for `x86_64-linux`).
+4. Unpack the downloaded `.zip` artifact.
+5. To generate an install command, plug the path to the unpacked artifact into this template:
 
     ```console
-    curl -L <install_url> | sh -s -- --tarball-url-prefix https://<github-username>-nix-install-tests.cachix.org/serve
+    sh <path/to/artifact>/install --tarball-url-prefix file://<path/to/artifact>
     ```
-
-<!-- #### Manually generating test installers
-
-There's obviously a manual way to do this, and it's still the only way for
-platforms that lack GA runners.
-
-I did do this back in Fall 2020 (before the GA approach encouraged here). I'll
-sketch what I recall in case it encourages someone to fill in detail, but: I
-didn't know what I was doing at the time and had to fumble/ask around a lot--
-so I don't want to uphold any of it as "right". It may have been dumb or
-the _hard_ way from the getgo. Fundamentals may have changed since.
-
-Here's the build command I used to do this on and for x86_64-darwin:
-nix build --out-link /tmp/foo ".#checks.x86_64-darwin.binaryTarball"
-
-I used the stable out-link to make it easier to script the next steps:
-link=$(readlink /tmp/foo)
-cp $link/*-darwin.tar.xz ~/somewheres
-
-I've lost the last steps and am just going from memory:
-
-From here, I think I had to extract and modify the `install` script to point
-it at this tarball (which I scped to my own site, but it might make more sense
-to just share them locally). I extracted this script once and then just
-search/replaced in it for each new build.
-
-The installer now supports a `--tarball-url-prefix` flag which _may_ have
-solved this need?
--->
-
diff --git a/doc/manual/source/glossary.md b/doc/manual/source/glossary.md
index d7436a2052ee..188e384772b5 100644
--- a/doc/manual/source/glossary.md
+++ b/doc/manual/source/glossary.md
@@ -104,7 +104,7 @@
 
   A derivation can be thought of as a [pure function](https://en.wikipedia.org/wiki/Pure_function) that produces new [store objects][store object] from existing store objects.
 
-  Derivations are implemented as [operating system processes that run in a sandbox](@docroot@/store/building.md#builder-execution).
+  Derivations are implemented as [operating system processes that run in a sandbox](@docroot@/store/building.md).
   This sandbox by default only allows reading from store objects specified as inputs, and only allows writing to designated [outputs][output] to be [captured as store objects](@docroot@/store/building.md#processing-outputs).
 
   A derivation is typically specified as a [derivation expression] in the [Nix language], and [instantiated][instantiate] to a [store derivation].
@@ -169,6 +169,11 @@
 
   A [store derivation] where a cryptographic hash of the [output] is determined in advance using the [`outputHash`](./language/advanced-attributes.md#adv-attr-outputHash) attribute, and where the [`builder`](@docroot@/language/derivations.md#attr-builder) executable has access to the network.
 
+- [hermetic]{#gloss-hermetic}
+
+  An evaluation or build process is hermetic when one can mechanically identify the set of all inputs that may affect it.
+  At the build level this is achieved by sandboxing; at the evaluation level by restricting impure access (as in [pure evaluation](@docroot@/command-ref/conf-file.md#conf-pure-eval)) together with [locking](#gloss-locking) or [pinning](#gloss-pinning) of the fetched inputs, taken transitively over [pure fetches](@docroot@/command-ref/conf-file.md#pure-fetch).
+
 - [IFD]{#gloss-ifd}
 
   [Import From Derivation](./language/import-from-derivation.md)
@@ -201,6 +206,10 @@
 
   [instantiate]: #gloss-instantiate
 
+- [locking]{#gloss-locking}
+
+  In package management, *locking* is the concept or process of creating a lock file, which maps each mutable evaluation input to an immutable reference, so that future evaluations resolve to the same immutable versions rather than whatever the mutable references currently point to.
+
 - [Nix Archive (NAR)]{#gloss-nar}
 
   A *N*ix *AR*chive. This is a serialisation of a path in the Nix
@@ -270,6 +279,16 @@
 
   [package]: #package
 
+- [pinning]{#gloss-pinning}
+
+  Like [locking](#gloss-locking), but a pin only locks a single input.
+  A pinning solution may manage a collection of pins,
+  but serves the bottom-up purpose of fixing an input's reference on demand,
+  whereas locking implies a top down approach where all pins are "coerced" into a single place.
+  This "coercion" is generally achieved by means of high-level mechanisms such as programming language module systems.
+  Nix does not have such a restrictive module system, as even a flake can use expressions that pin or lock on their own.
+  It does not rely on the lock being total, but on a transitive fetching property; see [hermeticity](#gloss-hermetic).
+
 - [profile]{#gloss-profile}
 
   A symlink to the current *user environment* of a user, e.g.,
@@ -375,6 +394,13 @@
   [path]: ./language/types.md#type-path
   [attribute name]: ./language/types.md#type-attrs
 
+- [SRI]{#gloss-sri}
+
+  [Subresource Integrity](https://www.w3.org/TR/SRI/) (SRI) is a [W3C specification](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) for integrity metadata.
+  Nix uses the SRI hash format (`<algorithm>-<Base64 hash>`) to specify content hashes in a way that is self-describing, since the hash algorithm is part of the format.
+
+  [SRI]: #gloss-sri
+
 - [substitute]{#gloss-substitute}
 
   A substitute is a command invocation stored in the [Nix database] that
diff --git a/doc/manual/source/installation/prerequisites-source.md b/doc/manual/source/installation/prerequisites-source.md
index 057fd444349e..e98067348ee6 100644
--- a/doc/manual/source/installation/prerequisites-source.md
+++ b/doc/manual/source/installation/prerequisites-source.md
@@ -1,80 +1,52 @@
 # Prerequisites
 
-  - GNU Autoconf (<https://www.gnu.org/software/autoconf/>) and the
-    autoconf-archive macro collection
-    (<https://www.gnu.org/software/autoconf-archive/>). These are
-    needed to run the bootstrap script.
-
-  - GNU Make.
-
-  - Bash Shell. The `./configure` script relies on bashisms, so Bash is
-    required.
-
-  - A version of GCC or Clang that supports C++23.
-
-  - `pkg-config` to locate dependencies. If your distribution does not
-    provide it, you can get it from
-    <http://www.freedesktop.org/wiki/Software/pkg-config>.
-
-  - The OpenSSL library to calculate cryptographic hashes. If your
-    distribution does not provide it, you can get it from
-    <https://www.openssl.org>.
-
-  - The `libbrotlienc` and `libbrotlidec` libraries to provide
-    implementation of the Brotli compression algorithm. They are
-    available for download from the official repository
-    <https://github.com/google/brotli>.
-
-  - cURL and its library. If your distribution does not provide it, you
-    can get it from <https://curl.haxx.se/>.
-
-  - The SQLite embedded database library, version 3.6.19 or higher. If
-    your distribution does not provide it, please install it from
-    <http://www.sqlite.org/>.
-
-  - The [Boehm garbage collector (`bdw-gc`)](http://www.hboehm.info/gc/) to reduce
-    the evaluator’s memory consumption (optional).
-
-    To enable it, install
-    `pkgconfig` and the Boehm garbage collector, and pass the flag
-    `--enable-gc` to `configure`.
-
-  - The `boost` library of version 1.66.0 or higher. It can be obtained
-    from the official web site <https://www.boost.org/>.
-
-  - The `editline` library of version 1.14.0 or higher. It can be
-    obtained from the its repository
-    <https://github.com/troglobit/editline>.
-
-  - The `libsodium` library for verifying cryptographic signatures
-    of contents fetched from binary caches.
-    It can be obtained from the official web site
-    <https://libsodium.org>.
-
-  - Recent versions of Bison and Flex to build the parser. (This is
-    because Nix needs GLR support in Bison and reentrancy support in
-    Flex.) For Bison, you need version 2.6, which can be obtained from
-    the [GNU FTP server](ftp://alpha.gnu.org/pub/gnu/bison). For Flex,
-    you need version 2.5.35, which is available on
-    [SourceForge](http://lex.sourceforge.net/). Slightly older versions
-    may also work, but ancient versions like the ubiquitous 2.5.4a
-    won't.
-
-  - The `libseccomp` is used to provide syscall filtering on Linux. This
-    is an optional dependency and can be disabled passing a
-    `--disable-seccomp-sandboxing` option to the `configure` script (Not
-    recommended unless your system doesn't support `libseccomp`). To get
-    the library, visit <https://github.com/seccomp/libseccomp>.
-
-  - On 64-bit x86 machines only, `libcpuid` library
-    is used to determine which microarchitecture levels are supported
+  This list and lower version bounds are maintained on best-effort basis. When in doubt, check the `meson.build` files.
+
+  - Meson build system (<https://github.com/mesonbuild/meson>).
+
+  - Ninja (<https://ninja-build.org/>).
+
+  - A version of GCC or Clang that supports C++23 (anything newer than Clang 19 or GCC 14 is likely to work).
+
+  - `pkg-config` to locate dependencies.
+    If your distribution does not provide it, you can get it from <http://www.freedesktop.org/wiki/Software/pkg-config>.
+
+  - The OpenSSL library to calculate cryptographic hashes.
+    If your distribution does not provide it, you can get it from <https://www.openssl.org>.
+
+  - The `libbrotlienc` and `libbrotlidec` libraries to provide implementation of the Brotli compression algorithm.
+    They are available for download from the official repository <https://github.com/google/brotli>.
+
+  - cURL library.
+    If your distribution does not provide it, you can get it from <https://curl.haxx.se/>.
+
+  - The SQLite embedded database library, version 3.6.19 or higher.
+    If your distribution does not provide it, please install it from <http://www.sqlite.org/>.
+
+  - The [Boehm garbage collector (`bdw-gc`)](http://www.hboehm.info/gc/) to reduce the evaluator’s memory consumption (optional).
+    To enable it, install `pkgconfig` and the Boehm garbage collector, and pass the option `-Dlibexpr:gc=enabled` to `meson setup`.
+
+  - The `boost` library of version 1.87.0 or higher.
+    It can be obtained from the official web site <https://www.boost.org/>.
+
+  - The `editline` library of version 1.14.0 or higher.
+    It can be obtained from the its repository <https://github.com/troglobit/editline>.
+
+  - The `libsodium` library for verifying cryptographic signatures of contents fetched from binary caches.
+    It can be obtained from the official web site <https://libsodium.org>.
+
+  - Recent versions of Bison and Flex to build the parser.
+    (This is because Nix needs C++ template support in Bison and reentrancy support in Flex.)
+
+  - The `libseccomp` is used to provide syscall filtering on Linux.
+    This is an optional dependency and can be disabled passing a `-Dlibstore:seccomp-sandboxing=disabled` option to the `meson setup` command
+    (Not recommended unless your system doesn't support `libseccomp`).
+    To get the library, visit <https://github.com/seccomp/libseccomp>.
+
+  - On 64-bit x86 machines only, `libcpuid` library is used to determine which microarchitecture levels are supported
     (e.g., as whether to have `x86_64-v2-linux` among additional system types).
-    The library is available from its homepage
-    <http://libcpuid.sourceforge.net>.
-    This is an optional dependency and can be disabled
-    by providing a `--disable-cpuid` to the `configure` script.
-
-  - Unless `./configure --disable-unit-tests` is specified, GoogleTest (GTest) and
-    RapidCheck are required, which are available at
-    <https://google.github.io/googletest/> and
-    <https://github.com/emil-e/rapidcheck> respectively.
+    The library is available from its homepage <http://libcpuid.sourceforge.net>.
+    This is an optional dependency and can be disabled by providing a `-Dlibutil:cpuid=disabled` option to `meson setup` script.
+
+  - Unless `meson setup build -Dunit-tests=false` is specified, GoogleTest (GTest) and RapidCheck are required, which are available at
+    <https://google.github.io/googletest/> and <https://github.com/emil-e/rapidcheck> respectively.
diff --git a/doc/manual/source/introduction.md b/doc/manual/source/introduction.md
index 85de7982c917..4df3a37e70b9 100644
--- a/doc/manual/source/introduction.md
+++ b/doc/manual/source/introduction.md
@@ -10,7 +10,7 @@ as
 
     /nix/store/q06x3jll2yfzckz2bzqak089p43ixkkq-firefox-33.1/
 
-where `b6gvzjyb2pg0…` is a unique identifier for the package that
+where `q06x3jll2yfz…` is a unique identifier for the package that
 captures all its dependencies (it’s a cryptographic hash of the
 package’s build dependency graph).  This enables many powerful
 features.
@@ -49,7 +49,7 @@ builds correctly on your system, this is because you specified the
 dependency explicitly. This takes care of the build-time dependencies.
 
 Once a package is built, runtime dependencies are found by scanning
-binaries for the hash parts of Nix store paths (such as `r8vvq9kq…`).
+binaries for the [hash parts](@docroot@/store/store-path.md#digest) of Nix store paths (such as `r8vvq9kq…`).
 This sounds risky, but it works extremely well.
 
 ## Multi-user support
@@ -174,7 +174,7 @@ the package:
 
 ## Portability
 
-Nix runs on Linux and macOS.
+Nix runs on Linux, macOS and FreeBSD.
 
 ## NixOS
 
diff --git a/doc/manual/source/language/advanced-attributes.md b/doc/manual/source/language/advanced-attributes.md
index 67612029c8a4..cc2743dc5ca9 100644
--- a/doc/manual/source/language/advanced-attributes.md
+++ b/doc/manual/source/language/advanced-attributes.md
@@ -337,8 +337,8 @@ Here is more information on the `output*` attributes, and what values they may b
 
     This will specify the output hash of the single output of a [fixed-output derivation].
 
-    The `outputHash` attribute must be a string containing the hash in either hexadecimal or "nix32" encoding, or following the format for integrity metadata as defined by [SRI](https://www.w3.org/TR/SRI/).
-    The ["nix32" encoding](@docroot@/protocols/nix32.md) is Nix's variant of base-32 encoding.
+    The `outputHash` attribute must be a string containing the hash in either hexadecimal or "nix32" encoding, or following the format for integrity metadata as defined by [SRI](@docroot@/glossary.md#gloss-sri).
+    The ["nix32" encoding](@docroot@/protocols/nix32.md) is Nix's variant of Base32 encoding.
 
     > **Note**
     >
diff --git a/doc/manual/source/language/builtins-prefix.md b/doc/manual/source/language/builtins-prefix.md
index 8dd929be3601..ed78366b094a 100644
--- a/doc/manual/source/language/builtins-prefix.md
+++ b/doc/manual/source/language/builtins-prefix.md
@@ -28,6 +28,25 @@ Some built-ins are also exposed directly in the global scope:
 - [`toString`](#builtins-toString)
 - [`true`](#builtins-true)
 
+<!-- This tip (use `lib` instead) is a "layer violation", but serves an important social role. -->
+
+> **Tip**
+>
+> **Should I use `builtins` or `lib`?**
+>
+> The built-ins are designed to be a stable interface that expressions can depend on over time,
+> so that, for instance, old Nixpkgs versions continue to evaluate reproducibly.
+>
+> On the flip side, this means they have accumulated a few quirks that Nix is unable to change,
+> but a library like Nixpkgs `lib` *can* improve, replace or deprecate those behaviors,
+> because its sources are pinned where reproducibility matters.
+>
+> So while it is not wrong to use `builtins` directly,
+> for instance in small Nixpkgs-independent projects,
+> you will have a better experience using a library like `lib` as your primary source of functions,
+> as it hides problematic functions, fixes up others,
+> and helps you improve your code by means of future deprecations, which are still sufficiently rare.
+
 <dl>
   <dt id="builtins-derivation"><a href="#builtins-derivation"><code>derivation <var>attrs</var></code></a></dt>
   <dd><p><var>derivation</var> is described in
diff --git a/doc/manual/source/language/derivations.md b/doc/manual/source/language/derivations.md
index 2403183fc2d2..50aa525acbf4 100644
--- a/doc/manual/source/language/derivations.md
+++ b/doc/manual/source/language/derivations.md
@@ -165,7 +165,7 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
   >
   > for an Autoconf-style package.
 
-  The name of an output is combined with the name of the derivation to create the name part of the output's store path, unless it is `out`, in which case just the name of the derivation is used.
+  The name of an output is combined with the name of the derivation to create the [name part](@docroot@/store/store-path.md#name) of the output's store path, unless it is `out`, in which case just the name of the derivation is used.
 
   > **Example**
   >
diff --git a/doc/manual/source/meson.build b/doc/manual/source/meson.build
index 294d57ad9f9c..115783c6b24a 100644
--- a/doc/manual/source/meson.build
+++ b/doc/manual/source/meson.build
@@ -8,10 +8,10 @@ summary_rl_next = custom_target(
     'pipefail',
     '-c',
     '''
-      if [ -e "@INPUT@" ]; then
+      if [ '@0@' = 'false' ]; then
         echo '  - [Upcoming release](release-notes/rl-next.md)'
       fi
-    ''',
+    '''.format(official_release),
   ],
   input : [
     rl_next_generated,
diff --git a/doc/manual/source/package-management/binary-cache-substituter.md b/doc/manual/source/package-management/binary-cache-substituter.md
index e6a772213d6d..bc2cdfb27ab2 100644
--- a/doc/manual/source/package-management/binary-cache-substituter.md
+++ b/doc/manual/source/package-management/binary-cache-substituter.md
@@ -19,7 +19,7 @@ whatever port you like:
 $ nix-serve -p 8080
 ```
 
-To check whether it works, try fetching the [`nix-cache-info`](@docroot@/protocols/nix-cache-info.md) file on the client:
+To check whether it works, try fetching the [`nix-cache-info`](@docroot@/protocols/binary-cache/nix-cache-info.md) file on the client:
 
 ```console
 $ curl http://avalon:8080/nix-cache-info
@@ -28,7 +28,7 @@ WantMassQuery: 1
 Priority: 30
 ```
 
-When writing to a binary cache (e.g., with [`nix copy`](@docroot@/command-ref/new-cli/nix3-copy.md)), Nix creates [`nix-cache-info`](@docroot@/protocols/nix-cache-info.md) automatically if it doesn't exist.
+When writing to a binary cache (e.g., with [`nix copy`](@docroot@/command-ref/new-cli/nix3-copy.md)), Nix creates [`nix-cache-info`](@docroot@/protocols/binary-cache/nix-cache-info.md) automatically if it doesn't exist.
 
 On the client side, you can tell Nix to use your binary cache using
 `--substituters`, e.g.:
diff --git a/doc/manual/source/package-management/profiles.md b/doc/manual/source/package-management/profiles.md
index 1d9e672a8def..53cf5061f834 100644
--- a/doc/manual/source/package-management/profiles.md
+++ b/doc/manual/source/package-management/profiles.md
@@ -11,8 +11,7 @@ in a directory
 another version might be stored in
 `/nix/store/5mq2jcn36ldlmh93yj1n8s9c95pj7c5s-subversion-1.1.2`. The long
 strings prefixed to the directory names are cryptographic hashes (to be
-precise, 160-bit truncations of SHA-256 hashes encoded in a base-32
-notation) of *all* inputs involved in building the package — sources,
+precise, 160-bit truncations of SHA-256 hashes encoded in [Nix32](@docroot@/protocols/nix32.md)) of *all* inputs involved in building the package — sources,
 dependencies, compiler flags, and so on. So if two packages differ in
 any way, they end up in different locations in the file system, so they
 don’t interfere with each other. Here is what a part of a typical Nix
diff --git a/doc/manual/source/protocols/binary-cache/index.md b/doc/manual/source/protocols/binary-cache/index.md
new file mode 100644
index 000000000000..d86d307ad9ee
--- /dev/null
+++ b/doc/manual/source/protocols/binary-cache/index.md
@@ -0,0 +1,19 @@
+# Binary Cache
+
+The binary cache format is an interface designed for exposing a store over HTTP.
+
+A binary cache consists of:
+
+- A [`nix-cache-info`](./nix-cache-info.md) file at the root with remote-side configuration.
+- For each [store object](@docroot@/store/store-object.md):
+  - A [`.narinfo`](./narinfo.md) file containing the object's [metadata](@docroot@/store/store-object.md#metadata) and a (usually relative) URL to the corresponding compressed NAR.
+  - A possibly-compressed [Nix Archive](@docroot@/store/file-system-object/content-address.md#serial-nix-archive) containing the store object's file system data.
+- For every entry in the [build trace](@docroot@/store/build-trace.md), a JSON file at `build-trace-v2/<drvBaseName>/<outputName>.doi`:
+  - the path encodes the [key](@docroot@/protocols/json/build-trace-entry.md#key)
+  - the contents are the [value](@docroot@/protocols/json/build-trace-entry.md#value).
+
+The following [store types](@docroot@/store/types/index.md) use the binary cache format:
+
+- [HTTP Binary Cache Store](@docroot@/store/types/http-binary-cache-store.md) — served over HTTP(S)
+- [Local Binary Cache Store](@docroot@/store/types/local-binary-cache-store.md) — stored on the file system
+- [S3 Binary Cache Store](@docroot@/store/types/s3-binary-cache-store.md) — stored in an AWS S3 bucket
diff --git a/doc/manual/source/protocols/binary-cache/narinfo.md b/doc/manual/source/protocols/binary-cache/narinfo.md
new file mode 100644
index 000000000000..e2e2efac0eeb
--- /dev/null
+++ b/doc/manual/source/protocols/binary-cache/narinfo.md
@@ -0,0 +1,42 @@
+# `.narinfo` Format
+
+A `.narinfo` file contains the [metadata of a store object](@docroot@/store/store-object.md#metadata) in the [binary cache](@docroot@/protocols/binary-cache/index.md) format.
+It is a simple line-oriented format where each line is a `Key: Value` pair.
+Some keys (e.g. `Sig`) may appear multiple times.
+
+The file is named `<hash>.narinfo`, where `<hash>` is the [hash part](@docroot@/store/store-path.md#digest) of the store object's [store path](@docroot@/store/store-path.md).
+
+The fields correspond to those documented in the [store object info](@docroot@/protocols/json/store-object-info.md) JSON format:
+
+| `.narinfo` field | JSON field | Differences |
+|---|---|---|
+| `StorePath` | [`path`](@docroot@/protocols/json/store-object-info.md#oneOf_i2_path) | Full [store path](@docroot@/store/store-path.md) rather than [store path base name](@docroot@/store/store-path.md#base-name) |
+| `URL` | [`url`](@docroot@/protocols/json/store-object-info.md#oneOf_i2_url) | |
+| `Compression` | [`compression`](@docroot@/protocols/json/store-object-info.md#oneOf_i2_compression) | Defaults to `bzip2` if omitted |
+| `FileHash` | [`downloadHash`](@docroot@/protocols/json/store-object-info.md#oneOf_i2_downloadHash) | String-encoded hash rather than structured |
+| `FileSize` | [`downloadSize`](@docroot@/protocols/json/store-object-info.md#oneOf_i2_downloadSize) | |
+| `NarHash` | [`narHash`](@docroot@/protocols/json/store-object-info.md#oneOf_i2_narHash) | String-encoded hash rather than structured |
+| `NarSize` | [`narSize`](@docroot@/protocols/json/store-object-info.md#oneOf_i2_narSize) | |
+| `References` | [`references`](@docroot@/protocols/json/store-object-info.md#oneOf_i2_references) | Space-separated [store path base names](@docroot@/store/store-path.md#base-name) rather than a JSON array |
+| `Deriver` | [`deriver`](@docroot@/protocols/json/store-object-info.md#oneOf_i2_deriver) | [Store path base name](@docroot@/store/store-path.md#base-name); `unknown-deriver` instead of `null` |
+| `Sig` | [`signatures`](@docroot@/protocols/json/store-object-info.md#oneOf_i2_signatures) | May appear multiple times rather than using an array |
+| `CA` | [`ca`](@docroot@/protocols/json/store-object-info.md#oneOf_i2_ca) | String-encoded [content address](@docroot@/store/store-object/content-address.md) rather than structured |
+
+## Example
+
+<!-- TODO make this include a test file instead of being manually written once we have one -->
+
+```
+StorePath: /nix/store/n5wkd9frr45pa74if5gpz9j7mifg27fh-foo
+URL: nar/1w1fff338fvdw53sqgamddn1b2xgds473pv6y13gizdbqjv4i5p3.nar.xz?sha256=1w1fff338fvdw53sqgamddn1b2xgds473pv6y13gizdbqjv4i5p3
+Compression: xz
+FileHash: sha256:09ymwqf5i9q7d4dm7x4pjjcqqj0qrcp5lnznbh42gfsci5hcbqqm
+FileSize: 4029176
+NarHash: sha256:09ymwqf5i9q7d4dm7x4pjjcqqj0qrcp5lnznbh42gfsci5hcbqqm
+NarSize: 34878
+References: g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar n5wkd9frr45pa74if5gpz9j7mifg27fh-foo
+Deriver: g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv
+Sig: asdf:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
+Sig: qwer:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
+CA: fixed:r:sha256:1lr187v6dck1rjh2j6svpikcfz53wyl3qrlcbb405zlh13x0khhh
+```
diff --git a/doc/manual/source/protocols/nix-cache-info.md b/doc/manual/source/protocols/binary-cache/nix-cache-info.md
similarity index 90%
rename from doc/manual/source/protocols/nix-cache-info.md
rename to doc/manual/source/protocols/binary-cache/nix-cache-info.md
index e8351e1cebe8..3859b2a10ac4 100644
--- a/doc/manual/source/protocols/nix-cache-info.md
+++ b/doc/manual/source/protocols/binary-cache/nix-cache-info.md
@@ -1,6 +1,6 @@
-# Nix Cache Info Format
+# `nix-cache-info` Format
 
-The `nix-cache-info` file is a metadata file at the root of a [binary cache](@docroot@/package-management/binary-cache-substituter.md) (e.g., `https://cache.example.com/nix-cache-info`).
+The `nix-cache-info` file is a metadata file at the root of a [binary cache](@docroot@/protocols/binary-cache/index.md) (e.g., `https://cache.example.com/nix-cache-info`).
 
 MIME type: `text/x-nix-cache-info`
 
diff --git a/doc/manual/source/protocols/derivation-aterm.md b/doc/manual/source/protocols/derivation-aterm.md
index 523678e663e3..778614eb1602 100644
--- a/doc/manual/source/protocols/derivation-aterm.md
+++ b/doc/manual/source/protocols/derivation-aterm.md
@@ -26,7 +26,7 @@ Derivations are serialised in one of the following formats:
 
 When derivation is encoded to a [store object] we make the following choices:
 
-- The store path name is the derivation name with `.drv` suffixed at the end
+- The store path [name](@docroot@/store/store-path.md#name) is the derivation name with `.drv` suffixed at the end
 
   Indeed, the ATerm format above does *not* contain the name of the derivation, on the assumption that a store path will also be provided out-of-band.
 
diff --git a/doc/manual/source/protocols/json/schema/build-trace-entry-v3.yaml b/doc/manual/source/protocols/json/schema/build-trace-entry-v3.yaml
index c3a27d2a6e0b..2e825af6fb8a 100644
--- a/doc/manual/source/protocols/json/schema/build-trace-entry-v3.yaml
+++ b/doc/manual/source/protocols/json/schema/build-trace-entry-v3.yaml
@@ -4,7 +4,7 @@ title: Build Trace Entry
 description: |
   A record of a successful build outcome for a specific derivation output.
 
-  This schema describes the JSON representation of a [build trace entry](@docroot@/store/build-trace.md).
+  This schema describes the JSON representation of an [entry](@docroot@/store/build-trace.md#entry) in a [build trace](@docroot@/store/build-trace.md).
 
   > **Warning**
   >
@@ -39,8 +39,8 @@ additionalProperties: false
   key:
     title: Build Trace Key
     description: |
-      A [build trace entry](@docroot@/store/build-trace.md) is a key-value pair.
-      This is the "key" part, refering to a derivation and output.
+      A [build trace entry](@docroot@/store/build-trace.md#entry) is a key-value pair.
+      This is the "key" part, referring to a derivation and output.
     type: object
     required:
       - drvPath
@@ -61,7 +61,7 @@ additionalProperties: false
   value:
     title: Build Trace Value
     description: |
-      A [build trace entry](@docroot@/store/build-trace.md) is a key-value pair.
+      A [build trace entry](@docroot@/store/build-trace.md#entry) is a key-value pair.
       This is the "value" part, describing an output.
     type: object
     required:
diff --git a/doc/manual/source/protocols/json/schema/store-object-info-v3.yaml b/doc/manual/source/protocols/json/schema/store-object-info-v3.yaml
index e0be716ef781..e0c1ffef134f 100644
--- a/doc/manual/source/protocols/json/schema/store-object-info-v3.yaml
+++ b/doc/manual/source/protocols/json/schema/store-object-info-v3.yaml
@@ -109,7 +109,7 @@ $defs:
         type: string
         title: Store Directory
         description: |
-          The [store directory](@docroot@/store/store-path.md#store-directory) this store object belongs to (e.g. `/nix/store`).
+          The [path to the store directory](@docroot@/store/store-path.md#store-directory-path) this store object belongs within (e.g. `/nix/store`).
     additionalProperties: false
 
   impure:
diff --git a/doc/manual/source/protocols/json/schema/store-path-v1.yaml b/doc/manual/source/protocols/json/schema/store-path-v1.yaml
index f1f58c2bf1ac..b1251c7426e9 100644
--- a/doc/manual/source/protocols/json/schema/store-path-v1.yaml
+++ b/doc/manual/source/protocols/json/schema/store-path-v1.yaml
@@ -24,7 +24,7 @@ description: |
 
   The format follows this pattern: `${digest}-${name}`
 
-  - **hash**: Digest rendered in [Nix32](@docroot@/protocols/nix32.md), a variant of base-32 (20 hash bytes become 32 ASCII characters)
+  - **hash**: Digest rendered in [Nix32](@docroot@/protocols/nix32.md) (20 hash bytes become 32 ASCII characters)
   - **name**: The package name and optional version/suffix information
 
 type: string
diff --git a/doc/manual/source/protocols/nix32.md b/doc/manual/source/protocols/nix32.md
index 72afe893ea24..d8da1e9952cf 100644
--- a/doc/manual/source/protocols/nix32.md
+++ b/doc/manual/source/protocols/nix32.md
@@ -1,6 +1,6 @@
 # Nix32 Encoding
 
-Nix32 is Nix's variant of base-32 encoding, used for [store path digests](@docroot@/protocols/store-path.md), hash output via [`nix hash`](@docroot@/command-ref/new-cli/nix3-hash.md), and the [`outputHash`](@docroot@/language/advanced-attributes.md#adv-attr-outputHash) derivation attribute.
+Nix32 is Nix's variant of [Base32](https://en.wikipedia.org/wiki/Base32) encoding, used for [store path digests](@docroot@/protocols/store-path.md), hash output via [`nix hash`](@docroot@/command-ref/new-cli/nix3-hash.md), and the [`outputHash`](@docroot@/language/advanced-attributes.md#adv-attr-outputHash) derivation attribute.
 
 ## Alphabet
 
diff --git a/doc/manual/source/protocols/store-path.md b/doc/manual/source/protocols/store-path.md
index 1aa79615d1c8..bdce19d1d62c 100644
--- a/doc/manual/source/protocols/store-path.md
+++ b/doc/manual/source/protocols/store-path.md
@@ -18,11 +18,9 @@ where
 
 - `name` = the name of the store object.
 
-- `store-dir` = the [store directory](@docroot@/store/store-path.md#store-directory)
+- `store-dir` = the [path of the store directory](@docroot@/store/store-path.md#store-directory-path)
 
-- `digest` = base-32 representation of the compressed to 160 bits [SHA-256] hash of `fingerprint`.
-
-  Nix uses a custom base-32 encoding called [Nix32](@docroot@/protocols/nix32.md).
+- `digest` = [Nix32](@docroot@/protocols/nix32.md) representation of the compressed to 160 bits [SHA-256] hash of `fingerprint`.
 
   For the definition of the hash compression algorithm, please refer to section 5.1 of the [Nix thesis](https://edolstra.github.io/pubs/phd-thesis.pdf).
 
diff --git a/doc/manual/source/release-notes/rl-2.23.md b/doc/manual/source/release-notes/rl-2.23.md
index b358a0fdc3c3..92e5f4599440 100644
--- a/doc/manual/source/release-notes/rl-2.23.md
+++ b/doc/manual/source/release-notes/rl-2.23.md
@@ -14,7 +14,7 @@
 
 - Modify `nix derivation {add,show}` JSON format [#9866](https://github.com/NixOS/nix/issues/9866) [#10722](https://github.com/NixOS/nix/pull/10722)
 
-  The JSON format for derivations has been slightly revised to better conform to our [JSON guidelines](@docroot@/development/json-guideline.md).
+  The JSON format for derivations has been slightly revised to better conform to our [data modeling guidelines](@docroot@/development/data-modeling.md).
   In particular, the hash algorithm and content addressing method of content-addressed derivation outputs are now separated into two fields `hashAlgo` and `method`,
   rather than one field with an arcane `:`-separated format.
 
@@ -89,7 +89,7 @@
   This makes records of this sort more self-describing, and easier to consume programmatically.
 
   We will follow this design principle going forward;
-  the [JSON guidelines](@docroot@/development/json-guideline.md) in the contributing section have been updated accordingly.
+  the [data modeling guidelines](@docroot@/development/data-modeling.md) in the contributing section have been updated accordingly.
 
 - Large path warnings [#10661](https://github.com/NixOS/nix/pull/10661)
 
diff --git a/doc/manual/source/release-notes/rl-2.30.md b/doc/manual/source/release-notes/rl-2.30.md
index 34d3e5bab4c6..5a65ed99af29 100644
--- a/doc/manual/source/release-notes/rl-2.30.md
+++ b/doc/manual/source/release-notes/rl-2.30.md
@@ -13,7 +13,7 @@
 - Deprecate manually making structured attrs using the `__json` attribute [#13220](https://github.com/NixOS/nix/pull/13220)
 
   The proper way to create a derivation using [structured attrs] in the Nix language is by using `__structuredAttrs = true` with [`builtins.derivation`].
-  However, by exploiting how structured attrs are implementated, it has also been possible to create them by setting the `__json` environment variable to a serialized JSON string.
+  However, by exploiting how structured attrs are implemented, it has also been possible to create them by setting the `__json` environment variable to a serialized JSON string.
   This sneaky alternative method is now deprecated, and may be disallowed in future versions of Nix.
 
   [structured attrs]: @docroot@/language/advanced-attributes.md#adv-attr-structuredAttrs
diff --git a/doc/manual/source/release-notes/rl-2.32.md b/doc/manual/source/release-notes/rl-2.32.md
index 5d90da0c9ebd..c59ecd6c2456 100644
--- a/doc/manual/source/release-notes/rl-2.32.md
+++ b/doc/manual/source/release-notes/rl-2.32.md
@@ -8,7 +8,7 @@
 
 - Derivation JSON format now uses store path basenames only [#13570](https://github.com/NixOS/nix/issues/13570) [#13980](https://github.com/NixOS/nix/pull/13980)
 
-  Experience with many JSON frameworks (e.g. nlohmann/json in C++, Serde in Rust, and Aeson in Haskell) has shown that the use of the store directory in JSON formats is an impediment to systematic JSON formats, because it requires the serializer/deserializer to take an extra paramater (the store directory).
+  Experience with many JSON frameworks (e.g. nlohmann/json in C++, Serde in Rust, and Aeson in Haskell) has shown that the use of the store directory in JSON formats is an impediment to systematic JSON formats, because it requires the serializer/deserializer to take an extra parameter (the store directory).
 
   We ultimately want to rectify this issue with all JSON formats to the extent allowed by our stability promises. To start with, we are changing the JSON format for derivations because the `nix derivation` commands are — in addition to being formally unstable — less widely used than other unstable commands.
 
diff --git a/doc/manual/source/release-notes/rl-2.33.md b/doc/manual/source/release-notes/rl-2.33.md
index bed697029389..1ad0cf3f0564 100644
--- a/doc/manual/source/release-notes/rl-2.33.md
+++ b/doc/manual/source/release-notes/rl-2.33.md
@@ -135,7 +135,7 @@ This is the legacy format, preserved for backwards compatibility:
 
 ### Version 2 (`--json-format 2`)
 
-The new structured format follows the [JSON guidelines](@docroot@/development/json-guideline.md) with the following changes:
+The new structured format follows the [data modeling guidelines](@docroot@/development/data-modeling.md) with the following changes:
 
 - **Nested structure with top-level metadata**:
 
@@ -149,9 +149,9 @@ The new structured format follows the [JSON guidelines](@docroot@/development/js
   }
   ```
 
-  The map from store path base names to store object info is nested under the `info` field.
+  The map from [store path base names](@docroot@/store/store-path.md#base-name) to store object info is nested under the `info` field.
 
-- **Store path base names instead of full paths**:
+- **[Store path base names](@docroot@/store/store-path.md#base-name) instead of full paths**:
 
   Map keys and references use store path base names (e.g., `"abc...-foo"`) instead of full absolute store paths.
   Combined with `storeDir`, the full path can be reconstructed.
diff --git a/doc/manual/source/release-notes/rl-2.34.md b/doc/manual/source/release-notes/rl-2.34.md
index 335e88ee89a9..473f351907c3 100644
--- a/doc/manual/source/release-notes/rl-2.34.md
+++ b/doc/manual/source/release-notes/rl-2.34.md
@@ -119,7 +119,7 @@
   New command [`nix store roots-daemon`](@docroot@/command-ref/new-cli/nix3-store-roots-daemon.md) runs a daemon that serves garbage collector roots over a Unix domain socket.
   It enables the garbage collector to discover runtime roots when the main Nix daemon doesn't have `CAP_SYS_PTRACE` capability and therefore cannot scan `/proc`.
 
-  The garbage collector can be configured to use this daemon via the [`use-roots-daemon`](@docroot@/store/types/local-store.md#store-experimental-option-use-roots-daemon) store setting.
+  The garbage collector can be configured to use this daemon via the [`use-roots-daemon`](@docroot@/store/types/local-store.md#store-local-store-use-roots-daemon) store setting.
 
   This feature requires the [`local-overlay-store` experimental feature](@docroot@/development/experimental-features.md#xp-feature-local-overlay-store).
 
diff --git a/doc/manual/source/release-notes/rl-2.35.md b/doc/manual/source/release-notes/rl-2.35.md
new file mode 100644
index 000000000000..a712b6385627
--- /dev/null
+++ b/doc/manual/source/release-notes/rl-2.35.md
@@ -0,0 +1,414 @@
+# Release 2.35.0 (2026-06-22)
+
+## Highlights
+
+- Sources are copied to the store more lazily [#3121](https://github.com/NixOS/nix/issues/3121) [#15711](https://github.com/NixOS/nix/pull/15711) [#15920](https://github.com/NixOS/nix/pull/15920)
+
+  Historically, flakes source trees have been eagerly fetched to and evaluated from the Nix store to ensure deterministic and hermetic evaluation, even if the resulting store object is not used as a derivation input. This made the implementation simpler, yet made flakes unusable in large repositories and performed unnecessary writes to the store on each change to the source tree.
+
+  Since Nix 2.32, all I/O (excluding `path:` and `hg+:`-style inputs) for reading sources during evaluation has been funneled to their original filesystem location (or to the `~/.cache/nix/tarball-cache-v2` bare git repository for tarball-based inputs). However, the source tree was still fetched to the store -- primarily for computing the resulting content-addressed store path. In most cases, (such as importing the `nixpkgs` package set) this is not necessary.
+
+  Touching (and hashing the NAR serialisation of) the whole source tree is unavoidable, since:
+
+  - In case of flake inputs, `narHash` integrity must be checked eagerly.
+  - The `outPath` attribute of a flake must be known in advance, and for backwards compatibility must be a content-addressed store path string with [constant string context](@docroot@/language/string-context.md#string-context-constant) representing the flake source tree.
+
+  Even within the constraints imposed by backwards compatibility requirements, there are several improvements that are achievable. To reduce the number of copies performed, Nix now hashes the input without copying first, assuming that the `.outPath` will not end up in a derivation attribute and thus would never have to be actually fetched to the store. This comes at the slight cost of doing more work in case the assumption is wrong, but results in less work in typical use cases. The evaluator continues to behave as if the copy was performed:
+
+  - Flakes are still evaluated from the store, from the evaluator's point of view.
+  - `toString ./.` continues to produce a content-addressed store path string without context.
+  - Path resolution crossing trees located in the filesystem and in Nix's view of it (with "virtual" overlays on top) continues to work. For example, the flake source tree can contain a relative symlink pointing outside its corresponding store object (though such usage is discouraged and makes further improvements to laziness intractable).
+  - Reading files from the flake's `outPath` continues to work. For example, such code is well-formed and is not considered [IFD](@docroot@/language/import-from-derivation.md):
+
+  ```nix
+  builtins.readFile ( /. + (builtins.unsafeDiscardStringContext self.outPath) + "/flake.nix" )
+  ```
+
+  Similar treatment has been applied to `builtins.fetchTarball`, which no longer eagerly copies paths to the store.
+  `builtins.storePath` now also short-circuits on "lazy-ish" store paths and doesn't substitute unless necessary.
+
+  This change is expected to significantly reduce disk usage required for typical evaluations and results in ~2x speedup for fetching and unpacking a nixpkgs tarball (either via `fetchTree`/flakes or via `fetchTarball`).
+
+- Support FreeBSD `libjail` based sandboxing, add `x86_64-freebsd` to installer [#9968](https://github.com/NixOS/nix/pull/9968) [#13281](https://github.com/NixOS/nix/pull/13281) [#15673](https://github.com/NixOS/nix/pull/15673)
+
+  The FreeBSD build of Nix now supports build sandboxing via FreeBSD jails and is enabled by default.
+  A FreeBSD build has been added to the traditional installer script. The beta rust-based installer is not yet supported.
+  FreeBSD support is not as well-tested as Linux or macOS, but is fully capable of building packages and performing other tasks expected of Nix on Linux.
+
+## Improvements
+
+- HTTP/3 (QUIC) support [#15961](https://github.com/NixOS/nix/pull/15961)
+
+  Nix can now fetch from binary caches and other HTTP(S) sources over HTTP/3 (QUIC), controlled by a new [`http3`](@docroot@/command-ref/conf-file.md#conf-http3) setting (disabled by default).
+  When enabled, Nix requests HTTP/3 and transparently falls back to HTTP/2 or HTTP/1.1 for servers that do not advertise QUIC.
+  The setting only takes effect when linked against a `libcurl` built with HTTP/3 support, otherwise it is ignored and Nix keeps using HTTP/2 without warning or error.
+
+  Enable it with:
+
+  ```
+  nix.conf: http3 = true
+  CLI:      --http3
+  ```
+
+  Or disable with:
+
+  ```
+  nix.conf: http3 = false
+  CLI:      --no-http3
+  ```
+
+- Link mimalloc for faster evaluation [#15596](https://github.com/NixOS/nix/pull/15596)
+
+  The `nix` binary now links [mimalloc](https://github.com/microsoft/mimalloc) by default, replacing glibc's malloc for all non-GC allocations.
+  This yields a **5–12% wall-clock improvement** on evaluation workloads, ranging from `nix-instantiate hello` to `nix-env -qa` and full NixOS configurations.
+  The allocator can be disabled at build time with `-Dmimalloc=disabled`.
+
+- The `revCount` attribute of the Git fetchers is now lazily computed and passed-through as-is when explicitly specified [#15772](https://github.com/NixOS/nix/pull/15772) [#14596](https://github.com/NixOS/nix/pull/14596)
+
+  `revCount` and `lastModified` attributes passed to the Git fetcher are no longer eagerly validated when explicitly specified.
+
+  When not explicitly specified, `revCount` is now also a thunk value and not computed eagerly. This delays this (potentially) expensive computation until the value is actually required.
+
+- Configurable file-transfer retry backoff with full jitter and `Retry-After` support [#15023](https://github.com/NixOS/nix/issues/15023) [#15419](https://github.com/NixOS/nix/issues/15419) [#15449](https://github.com/NixOS/nix/pull/15449)
+
+  File transfer retries (downloads and uploads) now use AWS-style "full jitter" exponential backoff, treat HTTP 503 as rate-limited (same longer delay as 429),
+  and honor the `Retry-After` response header.
+
+  Retry timing is configurable via new `nix.conf` settings:
+
+  - [`filetransfer-retry-delay`](@docroot@/command-ref/conf-file.md#conf-filetransfer-retry-delay): base delay for transient errors
+  - [`filetransfer-retry-delay-rate-limited`](@docroot@/command-ref/conf-file.md#conf-filetransfer-retry-delay-rate-limited): base delay for 429/503
+  - [`filetransfer-retry-max-delay`](@docroot@/command-ref/conf-file.md#conf-filetransfer-retry-max-delay): per-attempt delay ceiling
+  - [`filetransfer-retry-jitter`](@docroot@/command-ref/conf-file.md#conf-filetransfer-retry-jitter): enable full jitter
+
+  The existing `download-attempts` setting has been renamed to [`filetransfer-retry-attempts`](@docroot@/command-ref/conf-file.md#conf-filetransfer-retry-attempts) to reflect that it applies to uploads as well as downloads.
+  The old name remains as an alias for backwards compatibility.
+
+  Per-substituter overrides are available as store reference parameters ([`retry-delay`](@docroot@/store/types/http-binary-cache-store.md#store-http-binary-cache-store-retry-delay), [`retry-delay-rate-limited`](@docroot@/store/types/http-binary-cache-store.md#store-http-binary-cache-store-retry-delay-rate-limited), [`retry-max-delay`](@docroot@/store/types/http-binary-cache-store.md#store-http-binary-cache-store-retry-max-delay), [`retry-attempts`](@docroot@/store/types/http-binary-cache-store.md#store-http-binary-cache-store-retry-attempts)), e.g. `s3://my-cache?retry-attempts=8`.
+
+- Improve daemon socket path logic for chroot stores [#15190](https://github.com/NixOS/nix/pull/15190)
+
+  The default daemon socket path now uses the per-store [`state`](@docroot@/store/types/local-store.md#store-local-store-state) directory whenever one is defined, rather than always using the global [`NIX_STATE_DIR`](@docroot@/command-ref/env-common.md#env-NIX_STATE_DIR).
+  This means [local chroot stores](@docroot@/store/types/local-store.md#chroot) each get their own socket path automatically.
+
+  Example:
+
+  ```bash
+  nix-daemon --store /foo/bar
+  ```
+
+  will now use a socket at:
+  ```
+  /foo/bar/nix/var/nix/daemon-socket/socket
+  ```
+  instead of
+  ```
+  $NIX_STATE_DIR/daemon-socket/socket
+  ```
+
+  Users who wish to serve or connect to a chroot store at the old location will have to force the socket location:
+
+  - When serving (running a daemon), use the new [`--socket-path`](@docroot@/command-ref/new-cli/nix3-daemon.md#opt-socket-path) flag:
+
+    ```bash
+    nix daemon --socket-path "$NIX_STATE_DIR/daemon-socket/socket"
+    ```
+
+  - When connecting as a client, put the path in the [store URL](@docroot@/store/types/local-daemon-store.md):
+
+    ```
+    unix://$NIX_STATE_DIR/daemon-socket/socket
+    ```
+
+- Linux sandbox: also block `listxattr` syscalls [#15743](https://github.com/NixOS/nix/pull/15743)
+
+  The Linux sandbox now also returns `ENOTSUP` for `listxattr`, `llistxattr` and `flistxattr`, matching the existing treatment of `getxattr`/`setxattr`/`removexattr`.
+  This prevents host xattrs (e.g. `security.selinux`) from leaking into builds and fixes tools such as `mkfs.ubifs` that probe xattr support via `listxattr`.
+
+- Support SCP-like URLs in fetchGit and type = "git" flake inputs [#14852](https://github.com/NixOS/nix/issues/14852) [#14867](https://github.com/NixOS/nix/issues/14867) [#14863](https://github.com/NixOS/nix/pull/14863)
+
+  Nix now (once again) recognizes [SCP-like syntax for Git URLs](https://git-scm.com/docs/git-clone#_git_urls). This partially
+  restores compatibility with Nix 2.3 for `fetchGit`. The following syntax is once again supported:
+
+  ```nix
+  builtins.fetchGit "host:/absolute/path/to/repo"
+  ```
+
+  Nix also passes through the tilde (for home directories) verbatim:
+
+  ```nix
+  builtins.fetchGit "host:~/relative/to/home"
+  ```
+
+  IPv6 addresses also supported when bracketed:
+
+  ```nix
+  builtins.fetchGit "user@[::1]:~/relative/to/home"
+  ```
+
+  `builtins.fetchTree` also supports this syntax now:
+
+  ```nix
+  builtins.fetchTree { type = "git"; url = "host:/path/to/repo"; }
+  ```
+
+- `nix flake check` now supports `--print-out-paths` [#13470](https://github.com/NixOS/nix/issues/13470) [#15476](https://github.com/NixOS/nix/pull/15476) and `--out-link` [#13470](https://github.com/NixOS/nix/issues/13470) [#15476](https://github.com/NixOS/nix/pull/15476) defaulting to not creating out links if the flag is not specified.
+
+- Added `--skip-alive` (and `--skip-live` alias for compatibility with Lix users) option to `nix store delete` for collecting garbage within a closure [#7239](https://github.com/NixOS/nix/issues/7239) [#15236](https://github.com/NixOS/nix/pull/15236) [#15727](https://github.com/NixOS/nix/pull/15727)
+
+  `nix store delete --recursive --skip-alive` can be used to collect garbage within a closure, in which case it will only collect the dead paths that are part of the closure of its arguments.
+  The additional option `--also-referrers` is added to support this mode, which allows referrers of paths in the closure to also be deleted.
+
+- `builtins.getFlake` now supports path values [#15290](https://github.com/NixOS/nix/pull/15290)
+
+  `builtins.getFlake` now accepts path values in addition to flakerefs. This improves the usability of relative flakes, allowing you to write `builtins.getFlake ./subflake`.
+  This change does not allow specifying paths that are not already in the store (though they do not have valid store objects, i.e. this will not force a copy if the flake has only been hashed -- and not copied to the store). This may change in a future release.
+
+- `nix-profile.fish` and `nix-profile-daemon.fish` now use `$NIX_LINK` for computing the value of `NIX_PROFILE` instead of `$HOME/.nix-profile` [#14293](https://github.com/NixOS/nix/pull/14293)
+
+- `nix` binary now exports symbols from C bindings [#15696](https://github.com/NixOS/nix/pull/15696)
+
+  This allows Nix plugins written against the C API to look up symbols dynamically without linking to corresponding `libnix*c.so` libraries.
+
+- The computed Git LFS endpoint URLs have been fixed to follow the spec [#15891](https://github.com/NixOS/nix/pull/15891) and memory usage of LFS fetches has been decreased [#15912](https://github.com/NixOS/nix/pull/15912)
+
+- We now verify that fetched Git LFS objects have the same OID as requested [#15845](https://github.com/NixOS/nix/pull/15845)
+
+- Primop documentation now includes time complexity information [#14554](https://github.com/NixOS/nix/pull/14554)
+
+- Improved documentation on store paths and derivation building [#14699](https://github.com/NixOS/nix/pull/14699)
+
+- The [build hook](@docroot@/command-ref/conf-file.md#conf-build-hook) is now killed with `SIGTERM` instead of `SIGKILL` [#15105](https://github.com/NixOS/nix/pull/15105)
+
+- Download/upload logs strip `userinfo` URL components [#15715](https://github.com/NixOS/nix/pull/15715)
+
+## Content-addressed derivations changes
+
+  The experimental content-addressed (CA) derivation feature has undergone a significant change to how build traces (formerly called "realisations") are identified.
+  This changes the binary cache endpoints for realisations and the daemon/nix-serve protocol (gated behind a daemon protocol feature flag).
+
+- Realisations keyed by store path instead of hash modulo [#11897](https://github.com/NixOS/nix/issues/11897) [#12464](https://github.com/NixOS/nix/pull/12464)
+
+  Previously, a build trace entry (realisation) was keyed by the hash modulo of the derivation. In simpler terms, derivations transitively depending on distinct fixed-output derivations with the same `outPath` would share a realisation.
+
+  Now, build trace entries are keyed by the regular derivation store path (`.drvPath`) plus the output name. For example, instead of:
+
+  ```
+  sha256:ba7816bf8f01...!out
+  ```
+
+  The key is now:
+
+  ```
+  /nix/store/abc...-foo.drv^out
+  ```
+
+- Removed support for "deep" realisations [#15289](https://github.com/NixOS/nix/pull/15289)
+
+  Previously the build trace (set of "realisations") contained entries for both unresolved and [resolved](@docroot@/store/resolution.md) derivations.
+  Now, it contains entries exclusively for resolved derivations.
+  For now, unresolved derivations will be resolved from these underlying build trace entries.
+  This is slower, but has the benefit of making build trace entries stateless and self-describing --- making sharing realisations easier between stores.
+
+  This change necessitates changes to the binary cache format:
+
+  - The directory for build traces moved from `realisations/` to `build-trace-v2/`.
+  - File paths changed from `realisations/<hash>!<output>.doi` to `build-trace-v2/<drvName>/<outputName>.doi`.
+  - The JSON format of build trace entries is now split into `key` and `value` objects:
+    ```json
+    {
+      "key": {
+        "drvPath": "abc...-foo.drv",
+        "outputName": "out"
+      },
+      "value": {
+        "outPath": "xyz...-foo",
+        "signatures": [{ "keyName": "cache.example.com-1", "sig": "..." }]
+      }
+    }
+    ```
+    Previously, these were flat objects with a string `id` field like `"sha256:...!out"`.
+  - The deprecated `dependentRealisations` field has been removed.
+
+  The build trace entries stored in the local SQLite database no longer have any foreign key references to store objects.
+  This is because the build trace entries for resolved derivations that may have been deleted need to be preserved, otherwise the outputs of other unresolved derivations will be effectively forgotten.
+  GC for the build trace is not yet implemented due to the lack of a clear default policy.
+
+- Structured signature for realisations and `path-info` [#15009](https://github.com/NixOS/nix/pull/15009)
+
+  [Signatures](@docroot@/protocols/json/signature.md) in JSON formats are now represented as structured objects with `keyName` and `sig` fields, rather than colon-separated strings.
+  `nix path-info --json --json-format 3` opts into the new version for this command.
+  JSON parsing accepts both the old string format and new structured format for backwards compatibility.
+
+  This format is also used for the build trace entries in binary caches.
+
+- `nix realisation` command has been renamed to `nix store build-trace` [#16000](https://github.com/NixOS/nix/pull/16000) [#15948](https://github.com/NixOS/nix/pull/15948)
+
+## Build performance improvements
+
+- Make post-build-hook asynchronous [#15406](https://github.com/NixOS/nix/issues/15406) [#15451](https://github.com/NixOS/nix/pull/15451)
+
+  The [`post-build-hook`](@docroot@/command-ref/conf-file.md#conf-post-build-hook) now runs asynchronously, without blocking the build event loop.
+  Dependent builds are not started until the hook finishes, but multiple hook instances are now launched concurrently -- up to the [`max-jobs`](@docroot@/command-ref/conf-file.md#conf-max-jobs) limit.
+
+- zstd compression now emits multi-frame output and uses less memory [#15550](https://github.com/NixOS/nix/pull/15550)
+
+  zstd-compressed NARs are now written as a sequence of independent 16 MiB frames instead of a single large frame.
+  This lays the groundwork for parallel decompression in a future release without requiring caches to be repopulated, and significantly lowers peak memory use during compression
+  (e.g. from ~600 MiB to ~100 MiB for a 1 GiB store path).
+
+  The output remains standard zstd and is decoded unchanged by existing Nix binaries and the `zstd` CLI; compression ratio is effectively unchanged.
+
+  Per-frame compression now uses up to 4 worker threads. For zstd this is the new default: the [`parallel-compression`](@docroot@/store/types/http-binary-cache-store.md#store-http-binary-cache-store-parallel-compression) store setting defaults to `true` when `compression=zstd` (it remains `false` for other compression algorithms like `xz`).
+  Set `?parallel-compression=false` to opt out.
+
+- More parallelism for binary cache uploads [#15957](https://github.com/NixOS/nix/pull/15957)
+
+  Uploads of NARs now start without waiting for all references to be uploaded.
+  Also, NARs are now uploaded in order of descending (decompressed) NAR size.
+  The closure invariant is still maintained by copying `.narinfo` in a topologically sorted order.
+
+- The derivation build scheduler memory usage reduction and performance improvements [#15611](https://github.com/NixOS/nix/pull/15611) [#15695](https://github.com/NixOS/nix/pull/15695)
+
+  Memory usage of the derivation build scheduler has been improved to allow more state sharing.
+  Inefficiencies leading to quadratic complexity of scheduling build/substitution jobs have been addressed.
+  Scheduling resources are allocated more sparingly and freed earlier to reduce peak consumption.
+
+  These improvements amount to ~2-8x less `nix-daemon` memory usage for typical workloads and more in larger derivation graphs, not accounting for short-lived allocations used during substitution.
+
+  Notably, the current architecture of the build scheduler gets proportionally slower on Linux with larger heaps as derivation "builder" processes are `fork`-ed directly from the Nix process, which blocks the builder event loop for the duration of the `fork`. Thus, smaller heap of `nix-daemon` translates into faster build startups.
+
+- Concurrent path substitutions and eval-time fetches of the same inputs now run only once [#15555](https://github.com/NixOS/nix/pull/15555) [#15644](https://github.com/NixOS/nix/pull/15644)
+
+  This avoids redundant work in case multiple Nix processes try to substitute/download the same resource concurrently.
+
+- `.narinfo` lookups in binary caches are more concurrent
+
+  Querying the existence and path metadata in binary caches is now more asynchronous. Operations like `nix path-info` on large closures are faster and more efficient.
+  The build scheduler event loop now doesn't block on `.narinfo` queries, which improves performance with passthru binary caches.
+
+## Bug fixes
+
+- Fix hash collision between store paths with self-references and their zeroed-out equivalents [#15837](https://github.com/NixOS/nix/issues/15837) [#15931](https://github.com/NixOS/nix/pull/15931)
+
+  When computing the hash of a NAR with self-references, Nix zeroes out the self-references but also hashes their positions.
+  The latter was accidentally lost in Nix 2.17.0, which meant a NAR with self-references could hash to the same store path as an otherwise-identical NAR in which some of the self-references had been zeroed out.
+
+  This release restores hashing the positions of self-references.
+  As a consequence, content-addressed store paths derived from self-referential NARs will differ from those produced by Nix 2.17 through 2.34.
+  This affects users of the experimental `ca-derivations` features, as well as users of `nix store make-content-addressed`.
+
+- C API: Fix `EvalState` pointer passed to primop callbacks [#15300](https://github.com/NixOS/nix/pull/15300) [#15383](https://github.com/NixOS/nix/pull/15383)
+
+  The `EvalState *` passed to C API primop callbacks was incorrectly pointing to the internal `nix::EvalState` rather than the C API wrapper struct.
+  This caused a segfault when the callback used the pointer with C API functions such as `nix_alloc_value()`.
+  The same issue affected `printValueAsJSON` and `printValueAsXML` callbacks on external values.
+
+- GitHub fetcher now validates URL parameters [#15304](https://github.com/NixOS/nix/issues/15304) [#15331](https://github.com/NixOS/nix/pull/15331)
+
+  The `github:` fetcher now validates URL parameters, and will error if an invalid parameter like `tag` is provided.
+
+- Fixed a bug where keep-outputs and keep-derivations can interfere with delete commands [#15776](https://github.com/NixOS/nix/pull/15776)
+
+  Setting [`keep-derivations`](@docroot@/command-ref/conf-file.md#conf-keep-derivations) to `true` and trying to delete a derivation with realised outputs would previously fail.
+  Same with [`keep-outputs`](@docroot@/command-ref/conf-file.md#conf-keep-outputs) and trying to delete an output that still has derivers.
+  These options no longer affect the deletion commands, and are now documented as such.
+
+- S3 substituters fall back to the URL's region for STS WebIdentity auth [#15594](https://github.com/NixOS/nix/pull/15594)
+
+  When authenticating to an S3 binary cache via STS WebIdentity (EKS IRSA, GitHub Actions OIDC), Nix now uses the `?region=` parameter from the S3 URL as a fallback for the STS endpoint region if neither `AWS_REGION` nor `AWS_DEFAULT_REGION` is set.
+  Previously, IRSA setups that exported `AWS_WEB_IDENTITY_TOKEN_FILE` and `AWS_ROLE_ARN` but no region would fail with a misleading "IMDS provider" error.
+
+- S3: restore STS WebIdentity and ECS container credential providers [#15507](https://github.com/NixOS/nix/pull/15507)
+
+  Nix 2.33 replaced the S3 backend's `aws-sdk-cpp` credential chain with a custom chain built on `aws-c-auth`.
+  That chain omitted two providers, breaking S3 binary cache access in container workloads:
+
+  - **STS WebIdentity** (`AWS_WEB_IDENTITY_TOKEN_FILE`, `AWS_ROLE_ARN`, `AWS_ROLE_SESSION_NAME`) -- used by EKS IRSA, GitHub Actions OIDC, and any `sts:AssumeRoleWithWebIdentity` federation.
+  - **ECS container metadata** (`AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`, `AWS_CONTAINER_CREDENTIALS_FULL_URI`) -- used by ECS tasks and EKS Pod Identity.
+
+  The typical symptom was a misleading IMDS error (`Valid credentials could not be sourced by the IMDS provider`), because IMDS is the last provider tried after the correct one was skipped.
+
+  Both providers are now part of the chain, ordered to match the pre-2.33 behaviour.
+  As in both the old and new AWS SDK default chains, ECS and IMDS are mutually exclusive: when container credential environment variables are set, IMDS is skipped.
+
+- HTTP 401 and 407 responses from binary caches are no longer treated as missing files [#15877](https://github.com/NixOS/nix/pull/15877)
+
+  Nix no longer treats `Unauthorized` and `Proxy Authentication Required` HTTP codes as an indication of a missing file. This used to be the case because AWS S3 returns 403 `Forbidden` for missing objects in unlistable buckets. 401/407 were accidentally included and this workaround is now tightly scoped to 403 responses.
+
+- Fixed `nixbld` gid in `/etc/group` in the Linux build sandbox when user namespaces are not supported [#15131](https://github.com/NixOS/nix/pull/15131)
+
+- Store garbage collection is now more robust [#15992](https://github.com/NixOS/nix/pull/15992) [#15720](https://github.com/NixOS/nix/pull/15720) [#15616](https://github.com/NixOS/nix/pull/15616)
+
+- Fixed deadlock for hash-mismatching fixed-output derivations [#15874](https://github.com/NixOS/nix/pull/15874)
+
+- `nix-copy-closure` no longer ignores `--include-outputs` flag [#15896](https://github.com/NixOS/nix/pull/15896)
+
+- Fixes to `recursive-nix` experimental feature
+
+  Prior to this release, internal datastructures used to implement this feature were not used in a thread-safe manner.
+  Threads handling daemon connections are now reaped promptly, fixing resource leaks.
+
+## Contributors
+
+This release was made possible by the following 59 contributors:
+
+- Michael Wang [**(@zwang20)**](https://github.com/zwang20)
+- Amaan Qureshi [**(@amaanq)**](https://github.com/amaanq)
+- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
+- Reuben Gardos Reid [**(@ReubenJ)**](https://github.com/ReubenJ)
+- StepBroBD [**(@stepbrobd)**](https://github.com/stepbrobd)
+- dram [**(@dramforever)**](https://github.com/dramforever)
+- Tom [**(@thunze)**](https://github.com/thunze)
+- Sergei Trofimovich [**(@trofi)**](https://github.com/trofi)
+- Robert Hensing [**(@roberth)**](https://github.com/roberth)
+- steveoliphant [**(@steveoliphant)**](https://github.com/steveoliphant)
+- espes [**(@espes)**](https://github.com/espes)
+- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
+- Artemis Tosini [**(@artemist)**](https://github.com/artemist)
+- sander [**(@sandydoo)**](https://github.com/sandydoo)
+- Erik Jensen [**(@rkjnsn)**](https://github.com/rkjnsn)
+- Cameron Will [**(@cwill747)**](https://github.com/cwill747)
+- Maciej Krüger [**(@mkg20001)**](https://github.com/mkg20001)
+- Dror Speiser [**(@drorspei)**](https://github.com/drorspei)
+- Eveeifyeve [**(@Eveeifyeve)**](https://github.com/Eveeifyeve)
+- Audrey Dutcher [**(@rhelmot)**](https://github.com/rhelmot)
+- Lisanna Dettwyler [**(@lisanna-dettwyler)**](https://github.com/lisanna-dettwyler)
+- TyIsI [**(@TyIsI)**](https://github.com/TyIsI)
+- Adam Kliś [**(@BonusPlay)**](https://github.com/BonusPlay)
+- Domen Kožar [**(@domenkozar)**](https://github.com/domenkozar)
+- Taeer Bar-Yam [**(@Radvendii)**](https://github.com/Radvendii)
+- ryota2357 [**(@ryota2357)**](https://github.com/ryota2357)
+- LIN, Jian [**(@jian-lin)**](https://github.com/jian-lin)
+- znmz [**(@znmz)**](https://github.com/znmz)
+- Felix Stupp [**(@Zocker1999NET)**](https://github.com/Zocker1999NET)
+- Johannes Kirschbauer [**(@hsjobeki)**](https://github.com/hsjobeki)
+- Antonio Nuno Monteiro [**(@anmonteiro)**](https://github.com/anmonteiro)
+- tomberek [**(@tomberek)**](https://github.com/tomberek)
+- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
+- adisbladis [**(@adisbladis)**](https://github.com/adisbladis)
+- Luna Nova [**(@LunNova)**](https://github.com/LunNova)
+- Riccardo Mazzarini [**(@noib3)**](https://github.com/noib3)
+- Bouke van der Bijl [**(@bouk)**](https://github.com/bouk)
+- Dario [**(@dve00)**](https://github.com/dve00)
+- Michael Hoang [**(@Enzime)**](https://github.com/Enzime)
+- Paul Sbarra [**(@tones111)**](https://github.com/tones111)
+- edef [**(@edef1c)**](https://github.com/edef1c)
+- Adam Dinwoodie [**(@me-and)**](https://github.com/me-and)
+- Brian McKenna [**(@puffnfresh)**](https://github.com/puffnfresh)
+- Jeremy Fleischman [**(@jfly)**](https://github.com/jfly)
+- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
+- Alex Ionescu [**(@aionescu)**](https://github.com/aionescu)
+- Tristan Ross [**(@RossComputerGuy)**](https://github.com/RossComputerGuy)
+- Bernardo Meurer [**(@lovesegfault)**](https://github.com/lovesegfault)
+- Pierre Penninckx [**(@ibizaman)**](https://github.com/ibizaman)
+- Leonard Sheng Sheng Lee [**(@sheeeng)**](https://github.com/sheeeng)
+- rszyma [**(@rszyma)**](https://github.com/rszyma)
+- Ryan Hendrickson [**(@rhendric)**](https://github.com/rhendric)
+- Lennart Kolmodin [**(@kolmodin)**](https://github.com/kolmodin)
+- zowoq [**(@zowoq)**](https://github.com/zowoq)
+- Peter Collingbourne [**(@pcc)**](https://github.com/pcc)
+- Simon Žlender [**(@szlend)**](https://github.com/szlend)
+- Lily Foster [**(@lilyinstarlight)**](https://github.com/lilyinstarlight)
+- randomizedcoder [**(@randomizedcoder)**](https://github.com/randomizedcoder)
+- Krish Jaiswal
diff --git a/doc/manual/source/store/build-trace.md b/doc/manual/source/store/build-trace.md
index a879d37d208d..cb9cb3099680 100644
--- a/doc/manual/source/store/build-trace.md
+++ b/doc/manual/source/store/build-trace.md
@@ -8,7 +8,7 @@
 
 The *build trace* is a [memoization table](https://en.wikipedia.org/wiki/Memoization) for builds.
 It maps the inputs of builds to the outputs of builds.
-Concretely, that means it maps [derivations][derivation] to maps of [output] names to [store objects][store object].
+Each *[entry]{#entry}* in the build trace maps a [derivation][derivation] to a map of [output] names to [store objects][store object].
 
 In general the derivations used as a key should be [*resolved*](./resolution.md).
 A build trace with all-resolved-derivation keys is also called a *base build trace* for extra clarity.
diff --git a/doc/manual/source/store/building.md b/doc/manual/source/store/building.md
index 32e800129342..a97ffcd29cef 100644
--- a/doc/manual/source/store/building.md
+++ b/doc/manual/source/store/building.md
@@ -1,101 +1,277 @@
 # Building
 
-## Normalizing derivation inputs
+As discussed in the [main page on derivations](./derivation/index.md):
 
-- Each input must be [realised] prior to building the derivation in question.
+> A derivation is a specification for running an executable on precisely defined input to produce one or more [store objects][store object].
+
+This page describes *building* a derivation, which is to say following the instructions in the derivation to actually run the executable.
+Some elements of derivations are self-explanatory.
+For example, the arguments specified in the derivation really are the arguments passed to the executable.
+In other cases, however, there is additional common steps performed by Nix for all derivations --- mostly for setting up the build environment and collecting the built outputs.
+
+The chief design consideration for the building process is *determinism*.
+Conventional operating systems are typically not designed with determinism in mind.
+But determinism is needed to make Nix's build caching a transparent abstraction.
+
+> **Explanation**
+>
+> For example, no one wants to slightly modify a derivation, and then find that it no longer builds for an unrelated reason, because the original derivation *also* doesn't build anymore, but the cache hit on the original derivation was hiding this.
+> We want builds that succeed once to continue succeeding, to encourage fearless modification of old build recipes.
+> Determinism is what enables things that once worked to keep working.
+
+The life cycle of a build can be broken down into 3 parts:
+
+1. Spawn the builder process with the proper environment, including the correct process arguments, environment variables, and file system state.
+
+2. Wait for the builder process to exit and collect its exit status.
+   Exit code 0 means success; anything else is a build failure.
+   (Strictly speaking, Nix detects process exit by waiting for the standard output and error streams to close.
+   If a builder explicitly closes these streams without exiting, Nix will kill it, and deem the build a failure.
+   Processes should therefore exit *without* explicitly closing those standard streams, and let the exiting of the process close them implicitly.)
+
+   Nix also logs the standard output and error of the process, but this is just for human convenience and does not influence the behavior of the system.
+   (Builder processes have no idea what the consumer of their standard output and error does with the pseudo-terminal master, only that they are indeed consumed so buffers do not fill up etc. and writes to each output standard stream will continue to succeed.
+   In practice, Nix will store the log in `/nix/var/log/nix`)
+
+3. Processing the outputs.
+
+   Traditionally, this happens only after the builder has exited: the builder process should have left behind files for each output the derivation is supposed to produce, and those files are processed to turn them into bona fide store objects.
+   Alternatively, the builder may send messages to Nix while it's running, creating filesystem objects and linking them to an output name.
+   This allows outputs to be processed concurrently during the build, allows outputs to depend on other newly created store objects, and also resolves some tricky issues with content-addressing and output-to-output references.
+   If the processing succeeds, the resulting store objects are associated with the derivation as (the results of) a successful build.
+
+Step (3) is done by Nix, either externally to the build (in the traditional case, operating on the inert data left behind after the builder has exited or been killed) or concurrently with it (in the IPC case).
+Step (1) however is best described not from Nix's perspective, but from the build process's perspective.
+
+> **Explanation**
+>
+> Ultimately, what matters for determinism is what the build process can observe: what resources (files, networking, etc.) it can see, what syscalls succeed or fail, etc.
+> Nix can achieve this through many different sandboxing strategies (namespaces, VMs, chroots, ...), but the process shouldn't be able to tell them apart.
+> We therefore specify building from the process's perspective, not Nix's perspective, to focus on *what*, not *how*.
+
+## What derivations can be built
+
+Actually only some derivations are ready to be built.
+In particular, only [*resolved*](./resolution.md) derivations can be built.
+That is to say, a derivation that depends on other derivations is not ready yet to be built, because some of those other derivations might not have yet been built.
+If the other derivations are indeed all built, we can witness this fact by resolving the derivation, and converting all the derivation's input references into plain store paths.
+
+> **Note**
+>
+> Note that [input-addressing](derivation/outputs/input-address.md) derivations are improperly resolved.
+> As discussed on the linked page, the current input-addressing algorithm does not respect resolution-equivalence of derivations (\\(\\sim_\mathrm{Drv}\\)).
+> That means that if Nix properly resolved an input-addressed derivation, the resolved derivation would have different input addresses, violating expectations.
+> Nix therefore improperly resolves the derivation, keeping its original input-addressed output paths, creating an invalid derivation that is both resolved and instructed to create the outputs at the originally expected paths.
+
+## Environment of the builder process
+
+This section describes how the [`builder`](./derivation/index.md#builder) is executed.
+
+> **Implementation detail**
+>
+> Nix prevents multiple [Nix instances][Nix instance] from performing the same build at the same time, for example by acquiring exclusive file locks.
+
+### File system
+
+The builder should have access to a limited file system where only certain objects are available.
+The most important exposed files are the inputs (other store objects) of the (resolved) derivation.
+Additionally, some other files are exposed.
+
+#### Store inputs
+
+The builder will be run against a file system in which the [store directory][store directory path] contains the [closure] of the inputs.
+In particular, consider a store that just contains this closure.
+That store is exposed to the file system according to the rules specified in the [Exposing Store Objects in OS File Systems](./store-path.md#exposing) documentation.
+This precisely defines the file system layout of the store that should be visible to the builder process.
+
+> **Note**
+>
+> Historically, Nix exposed *at least* the following store contents to the builder, but also arbitrarily other store objects, due to limitations around operating systems' file system virtualization capabilities, and wanting to avoid copying or moving files.
+> It still can do this in so-called *unsandboxed* builds.
+>
+> Such builds should be considered discouraged, but one that works less badly against non-mischievous derivations than might be expected.
+> This is because store paths are relatively unpredictable, so a well-behaved program is unlikely to stumble upon a store object it wasn't supposed to know about.
+>
+> As operating systems developed better file system primitives, the need for disabling sandboxing has lessened greatly over the years, and this trend should continue into the future.
+
+The outputs are expected to be created in that store directory as if they were valid store objects.
+(They are just files during builder execution, but during [processing outputs](#processing-outputs) they will be turned into proper store objects.)
+The [environment variables](#env-vars) for each output indicate where the builder should write them;
+Nix ensures that those paths do not yet exist when the builder is run.
+
+> **Note**
+>
+> In sandboxed builds, ensuring that the outputs do not exist in the store directory is trivial.
+> In unsandboxed builds, it is harder in general.
+> In the worst case, the derivation is in fact rewritten so different output paths are used instead, and then the outputs are rewritten back to the intended output paths after.
+> In the content-addressing case rewriting would be needed either way, but in the input-addressing case, this is a significant degradation, as the point of input addressing is to avoid rewrites by knowing output paths in advance.
 
 [realised]: @docroot@/glossary.md#gloss-realise
+[closure]: @docroot@/glossary.md#gloss-closure
+[store directory path]: ./store-path.md#store-directory-path
+
+### Other file system state
+
+- The current working directory of the builder process will be a fresh temporary directory.
+  It is initially empty when the process starts except for a few input files:
 
-- Once this is done, the derivation is *normalized*, replacing each input deriving path with its store path, which we now know from realising the input.
+  - If [`__structuredAttrs`](@docroot@/language/advanced-attributes.md#adv-attr-structuredAttrs) is enabled: `.attrs.json` (the derivation attributes as JSON) and `.attrs.sh` (a Bash-compatible rendering of the same).
+    The environment variables `NIX_ATTRS_JSON_FILE` and `NIX_ATTRS_SH_FILE` point to these files, respectively.
 
-## Builder Execution {#builder-execution}
+  - If [`passAsFile`](@docroot@/language/advanced-attributes.md#adv-attr-passAsFile) is used (only without `__structuredAttrs`): for each attribute name listed, a file `.attr-<hash>` where `<hash>` is the [Nix32](@docroot@/protocols/nix32.md)-encoded SHA-256 hash of the attribute name.
+    The environment variable `<name>Path` points to the file containing the attribute's value.
 
-The [`builder`](./derivation/index.md#builder) is executed as follows:
+  In sandboxed builds, this directory is at a deterministic path inside the sandbox (controlled by the [`sandbox-build-dir`](@docroot@/command-ref/conf-file.md#conf-sandbox-build-dir) setting, default `/build`).
+  See also the per-store [`build-dir`](@docroot@/store/types/local-store.md#store-local-store-build-dir) setting for the host-side location.
 
-- A temporary directory is created where the build will take place. The
-  current directory is changed to this directory.
+- Basic device nodes for essential operations (null device, random number generation, standard streams as a pseudo terminal)
 
-  See the per-store [`build-dir`](@docroot@/store/types/local-store.md#store-local-store-build-dir) setting for more information.
+  (A pseudo terminal would not be strictly necessary since the standard streams are passively logging, not there to facilitate interaction.
+  But it is still useful to entice programs to do nicer logging with e.g. colors etc.)
 
-- The environment is cleared and set to the derivation attributes, as
-  specified above.
+- On Linux: Process information via `/proc`
 
-- In addition, the following variables are set:
+- Minimal user and group identity information
 
-  - `NIX_BUILD_TOP` contains the path of the temporary directory for
-    this build.
+- A loopback-only network configuration with hostname set to `localhost`
 
-  - Also, `TMPDIR`, `TEMPDIR`, `TMP`, `TEMP` are set to point to the
-    temporary directory. This is to prevent the builder from
-    accidentally writing temporary files anywhere else. Doing so
-    might cause interference by other processes.
+> **Note**
+>
+> Fixed-output derivations have access to additional operating system state to facilitate communication with the outside world, such as network name resolution and TLS certificate verification.
+> This is necessary because these derivations are allowed to access the network, unlike regular derivations which are fully sandboxed.
 
-  - `PATH` is set to `/path-not-set` to prevent shells from
-    initialising it to their built-in default value.
+### Environment variables {#env-vars}
 
-  - `HOME` is set to `/homeless-shelter` to prevent programs from
-    using `/etc/passwd` or the like to find the user's home
-    directory, which could cause impurity. Usually, when `HOME` is
-    set, it is used as the location of the home directory, even if
-    it points to a non-existent path.
+The environment is cleared and set to the derivation attributes, as
+specified above.
 
-  - `NIX_STORE` is set to the path of the top-level Nix store
-    directory (typically, `/nix/store`).
+For most derivations types this must contain at least:
 
-  - `NIX_ATTRS_JSON_FILE` & `NIX_ATTRS_SH_FILE` if `__structuredAttrs`
-    is set to `true` for the derivation. A detailed explanation of this
-    behavior can be found in the
-    [section about structured attrs](@docroot@/language/advanced-attributes.md#adv-attr-structuredAttrs).
+- For each output declared in `outputs`, the corresponding environment variable is set to point to the intended path in the Nix store for that output.
+  Each output path is a concatenation of the cryptographic hash of all build inputs, the `name` attribute and the output name.
+  (The output name is omitted if it's `out`.)
 
-  - For each output declared in `outputs`, the corresponding
-    environment variable is set to point to the intended path in the
-    Nix store for that output. Each output path is a concatenation
-    of the cryptographic hash of all build inputs, the `name`
-    attribute and the output name. (The output name is omitted if
-    it’s `out`.)
+In addition, the following variables are set:
 
-- If an output path already exists, it is removed. Also, locks are
-  acquired to prevent multiple [Nix instances][Nix instance] from performing the same
-  build at the same time.
+- `NIX_BUILD_TOP` contains the path of the temporary directory for this build.
 
-- A log of the combined standard output and error is written to
-  `/nix/var/log/nix`.
+- Also, `TMPDIR`, `TEMPDIR`, `TMP`, `TEMP` are set to point to the temporary directory.
+  This is to prevent the builder from accidentally writing temporary files anywhere else.
+  Doing so might cause interference by other processes.
 
-- The builder is executed with the arguments specified by the
-  attribute `args`. If it exits with exit code 0, it is considered to
-  have succeeded.
+- `PATH` is set to `/path-not-set` to prevent shells from initialising it to their built-in default value.
 
-- The temporary directory is removed (unless the `-K` option was
-  specified).
+- `HOME` is set to `/homeless-shelter`.
+   (Without sandboxing, this discourages programs from using `/etc/passwd` or the like to find the user's home directory, which could cause impurity.)
+   Usually, when `HOME` is set, it is used as the location of the home directory, even if it points to a non-existent path.
+
+- `NIX_STORE` is set to the path of the top-level Nix [store directory path] (typically, `/nix/store`).
+
+- `NIX_ATTRS_JSON_FILE` & `NIX_ATTRS_SH_FILE` if `__structuredAttrs` is set to `true` for the derivation.
+  A detailed explanation of this behavior can be found in the [section about structured attrs](@docroot@/language/advanced-attributes.md#adv-attr-structuredAttrs).
+
+### Arguments
+
+The builder is passed the arguments specified by the derivation attribute `args`.
 
 ## Processing outputs
 
-If the builder exited successfully, the following steps happen in order to turn the output directories left behind by the builder into proper store objects:
+There are two methods for processing outputs.
+But first, let us cover the requirements common to both methods.
 
-- **Normalize the file permissions**
+Regardless of which method is used, each output must be turned into a valid store object.
+This involves two steps:
 
-  Nix sets the last-modified timestamp on all files
-  in the build result to 1 (00:00:01 1/1/1970 UTC), sets the group to
-  the default group, and sets the mode of the file to 0444 or 0555
-  (i.e., read-only, with execute permission enabled if the file was
-  originally executable). Any possible `setuid` and `setgid`
-  bits are cleared.
+- **Normalize the file permissions**
 
-  > **Note**
-  >
-  > Setuid and setgid programs are not currently supported by Nix.
-  > This is because the Nix archives used in deployment have no concept of ownership information,
-  > and because it makes the build result dependent on the user performing the build.
+  The files must conform to the model described in the [Exposing in OS file systems](./file-system-object/os-file-system.md) section.
+  For example, timestamps and permissions are canonicalised.
 
 - **Calculate the references**
 
-  Nix scans each output path for
-  references to input paths by looking for the hash parts of the input
-  paths. Since these are potential runtime dependencies, Nix registers
-  them as dependencies of the output paths.
+  Nix scans each output path for [references] to input store objects by looking for the [digest][store path digest] of each input.
+  (The name part and the [store directory path] are ignored when scanning; an input's hash part that is neither followed by a `-` nor proceeded by a `/` still scans as a reference.)
+  Since these are potential runtime dependencies, Nix will register them as references of the output store object they occur in.
+
+### Traditional (post-build) processing
+
+With the traditional method, the builder process on exit should have left behind files for each output the derivation is supposed to produce.
+The files must be processed to turn them into bona fide store objects.
+If the processing succeeds, those store objects are associated with the derivation as (the results of) a successful build.
+
+Nix also scans for references from one output to another in the same way, because outputs are allowed to refer to each other.
+The outputs' references must form a [directed acyclic graph](@docroot@/glossary.md#gloss-directed-acyclic-graph).
+(This is not a special restriction for outputs; it is true for the references of all store objects in general.)
+
+In the case of derivations with output paths that are fixed in advance (i.e. [input-addressing] derivations, or [fixed content-addressing] derivations), the actual final store path to each output is used during the build if possible.
+For [floating content-addressing] derivations, however, the final store path is not known in advance by definition.
+Scratch store paths must therefore be used instead.
+Scanning will use those scratch paths, but then any output-to-be that contains such a scanned scratch path must be rewritten to instead use the final (content-addressed) path of the output in question.
+
+In addition to output-to-output references, rewriting is also needed to support self-references in the content-addressing case.
+An output may contain its own store path digest, which is a self-reference.
+Hash functions which are secure cannot allow the easy calculation of the quasi-fixed points needed to support self-references "natively", so instead we replace all would-be self-references with a sentinel value, and then rewrite the sentinel value to be the final store path digest.
+Superficially, this post-hashing rewriting breaks the content address, but as the self-references are easily identified, the rewriting can be inverted to yield the original hashed data, allowing verifying the content address after all.
+
+At this point, the file system data is in the proper form, and the valid acyclic reference data for each output is also calculated, so the outputs are added to the store as proper store objects.
+Additionally, those store objects (at least in the case that they are [content-addressed][content-addressing]) can be associated with the derivation in the [build trace] in the record for a successful build.
+
+> **Implementation detail**
+>
+> Nix will normally clean up and remove the temporary build directory after every build, successful or unsuccessful.
+> The builder doesn't know whether Nix does or not, however, as it will have exited before the build directory is cleaned up, and it will not see any old build directory if (after a failed build) it is run again.
+> The [`--keep-failed`](@docroot@/command-ref/opt-common.md#opt-keep-failed) option can be specified to keep the build directory in the case of a failing build.
+
+### Concurrent processing via IPC
+
+With this method, the builder communicates with Nix during the build using inter-process communication (IPC).
+
+> **Implementation detail**
+>
+> The current implementation, `builder-rpc-v0`, exposes its interface over a limited form of the Nix daemon socket.
+> Builders may use it either with their own implementation of the Nix protocol, or with the `nix store add` and `nix store submit-output` commands.
+>
+> Derivations with `builder-rpc-v0` in their set of [`requiredSystemFeatures`](@docroot@/language/advanced-attributes.md#adv-attr-requiredSystemFeatures)
+> will not receive output paths in their environment, and are expected to submit all outputs with the aforementioned commands or protocol.
+
+Instead of leaving files behind for Nix to process after exit, the builder explicitly requests the daemon create store objects one at a time, then sends commands assigning output names to the just-created store objects.
+
+Scanning for references proceeds as usual for each store object creation request, but the set of potential references to be scanned is greater: it includes both all inputs (as before) and also all previously-added store objects.
+This means, if output `bar` is supposed to reference output `foo`, `foo` should be created first, and `bar` second.
+
+All store objects being created are content-addressed (there is no support for input-addressed outputs with the IPC approach).
+When a store object is created, its content address store path will be calculated by Nix and then returned in the IPC response message.
+The builder then knows what store path to use in subsequent store objects in order for reference scanning to pick them up.
+
+This overall approach has several advantages:
+
+- **No Nix-side rewriting**
+
+  For content-addressed outputs, the builder is responsible for adding outputs in reference order, using the store paths from earlier adds in later ones.
+  This avoids the fragile rewriting that would otherwise be needed to fix up output-to-output references described above.
+  The builder, unlike Nix itself, is free to leverage domain-specific knowledge to do a better job. For example it can
+
+  - uncompress, rewrite, and then recompress man pages, to not miss references hidden by compression.
+
+  - make sure to rewrite data that is to be signed, like Apple binaries, before signing that data, so as not to invalidate any signatures by mistake.
+
+- **Pipelining**
 
-  Nix also scans for references to other outputs' paths in the same way, because outputs are allowed to refer to each other.
-  If the outputs' references to each other form a cycle, this is an error, because the references of store objects much be acyclic.
+  Downstream builds that only need some outputs (e.g., a "dev" or "headers" output) can start without waiting for all outputs to be ready.
+  Nix doesn't yet implement this, but it could and should.
 
+The major *disadvantage* of this approach is that it doesn't yet support self-references.
+Unlike acyclic output-to-output references, self-references fundamentally do require rewriting.
+The output-to-output case was only a challenge in the traditional case because all the outputs were submitted simultaneously, whereas the self-reference case is fundamentally challenging because of what it means for a hash function to be secure, as described above.
+Neither batched (traditional) nor serial (IPC) submission of outputs can avoid this fundamental property of secure hash functions.
+We could add support for such rewriting just for self-references, as is done for the traditional post-build processing, but we haven't yet done so as the very point of the IPC approach is to free Nix from any obligation to rewrite black-box data in unsound ways.
 
+[references]: ./store-object.md#references
+[store path digest]: ./store-path.md#digest
+[store object]: ./store-object.md
 [Nix instance]: @docroot@/glossary.md#gloss-nix-instance
+[content-addressing]: ./derivation/outputs/content-address.md
+[input-addressing]: ./derivation/outputs/input-address.md
+[fixed content-addressing]: ./derivation/outputs/content-address.md#fixed
+[floating content-addressing]: ./derivation/outputs/content-address.md#floating
+[build trace]: ./build-trace.md
diff --git a/doc/manual/source/store/derivation/outputs/index.md b/doc/manual/source/store/derivation/outputs/index.md
index ca2ce6665b04..9b46405cdf58 100644
--- a/doc/manual/source/store/derivation/outputs/index.md
+++ b/doc/manual/source/store/derivation/outputs/index.md
@@ -9,7 +9,7 @@ The outputs specification is a map, from names to specifications for individual
 
 ## Output Names {#outputs}
 
-Output names can be any string which is also a valid [store path](@docroot@/store/store-path.md) name.
+Output names can be any string which is also a valid [store path name](@docroot@/store/store-path.md#name).
 The name mapped to each output specification is not actually the name of the output.
 In the general case, the output store object has name `derivationName + "-" + outputSpecName`, not any other metadata about it.
 However, an output spec named "out" describes and output store object whose name is just the derivation name.
diff --git a/doc/manual/source/store/derivation/outputs/input-address.md b/doc/manual/source/store/derivation/outputs/input-address.md
index 3fd20f17d724..6df9b94961e8 100644
--- a/doc/manual/source/store/derivation/outputs/input-address.md
+++ b/doc/manual/source/store/derivation/outputs/input-address.md
@@ -16,7 +16,7 @@ Concretely, this would cause a "mass rebuild" whenever any fetching detail chang
 To solve this problem, we compute output hashes differently, so that certain output hashes become identical.
 We call this concept quotient hashing, in reference to quotient types or sets.
 
-So how do we compute the hash part of the output paths of an input-addressed derivation?
+So how do we compute the [hash part](@docroot@/store/store-path.md#digest) of the output paths of an input-addressed derivation?
 This is done by the function `hashQuotientDerivation`, shown below.
 
 First, a word on inputs.
diff --git a/doc/manual/source/store/file-system-object.md b/doc/manual/source/store/file-system-object.md
index 60cb3e572063..2ffad5f0ec94 100644
--- a/doc/manual/source/store/file-system-object.md
+++ b/doc/manual/source/store/file-system-object.md
@@ -19,7 +19,7 @@ Every file system object is one of the following:
    In general, Nix does not assign any semantics to symbolic links.
    Certain operations however, may make additional assumptions and attempt to use the target to find another file system object.
 
-   > See [the Wikpedia article on symbolic links](https://en.m.wikipedia.org/wiki/Symbolic_link) for background information if you are unfamiliar with this Unix concept.
+   > See [the Wikipedia article on symbolic links](https://en.m.wikipedia.org/wiki/Symbolic_link) for background information if you are unfamiliar with this Unix concept.
 
 File system objects and their children form a tree.
 A bare file or symlink can be a root file system object.
diff --git a/doc/manual/source/store/file-system-object/os-file-system.md b/doc/manual/source/store/file-system-object/os-file-system.md
new file mode 100644
index 000000000000..6ce21f7788c9
--- /dev/null
+++ b/doc/manual/source/store/file-system-object/os-file-system.md
@@ -0,0 +1,40 @@
+# Exposing File System Objects in real operating system file systems
+
+Nix's [file system object] data model is minimal.
+All the various other bits and pieces of real world filesystem interfaces, such as [extended file attributes](https://en.wikipedia.org/wiki/Extended_file_attributes), are specifically ignored to reduce our interface surface and the reproducibility issues associated with a larger interface.
+In the view of Nix's developers, the types of simple, fine-grained batch jobs (typically, building software) that Nix specializes in simply don't benefit enough from that extra complexity for it to be worth the costs of supporting it.
+
+But to actually be used by software, file system objects need to be made available through the operating system's file system.
+This is sometimes called "mounting" or "exposing" the file system object, though do note it may or may not be implemented with what the operating system calls "mounting".
+
+[file system object]: ../file-system-object.md
+
+## Metadata normalization
+
+File systems typically contain other metadata that is outside Nix's data model.
+To avoid this other metadata being a side channel and source of nondeterminism, Nix is careful to normalize to fixed values.
+For example, on Unix, the following metadata normalization occurs:
+
+- The creation and last modification timestamps on all files are set to Unix Epoch 1s (00:00:01 1/1/1970 UTC)
+
+- The group is set to the [default group](@docroot@/command-ref/conf-file.md#conf-build-users-group)
+
+- The Unix mode of the file to 0444 or 0555 (i.e., read-only, with execute permission enabled if the file was originally executable).
+
+- Any possible `setuid` and `setgid` bits are cleared.
+
+  > **Note**
+  >
+  > `setuid` and `setgid` programs are not currently supported by Nix.
+  > These special file system permissions are in general a security footgun, and with data owned by different users in different stores, it would especially be a hazard when copying store objects between stores.
+  >
+  > This restriction has not proved to be onerous in practice.
+  > For example, NixOS uses so called setuid-wrappers which are outside the store.
+
+> **Explanation**
+>
+> As discussed before, Nix essentially shares its file system object data model with other tools like Git.
+> But those tools tend to ignore this metadata in both directions --- when reading files, like Nix, but when writing files, timestamps are set organically, and the user is free to set other special permissions (`setuid`, `setgid`, sticky, etc.) however they like.
+> Normalizing, and not just ignoring, this metadata is therefore what distinguishes Nix from these other tools more than the file system object data model itself.
+>
+> Nix's approach is motivated by deterministic building. Whereas Git can assume that humans running commands will simply ignore timestamps etc. as appropriate, understanding they are local and ephemeral, Nix aims to run software that was not necessarily designed with Nix in mind, and is unaware of whatever sandboxing/virtualization is in place.
diff --git a/doc/manual/source/store/index.md b/doc/manual/source/store/index.md
index f1e8f1402988..d063fc4fdc05 100644
--- a/doc/manual/source/store/index.md
+++ b/doc/manual/source/store/index.md
@@ -2,4 +2,33 @@
 
 The *Nix store* is an abstraction to store immutable file system data (such as software packages) that can have dependencies on other such data.
 
-There are [multiple types of Nix stores](./types/index.md) with different capabilities, such as the default one on the [local filesystem](./types/local-store.md) (`/nix/store`) or [binary caches](./types/http-binary-cache-store.md).
+Concretely, albeit using concepts that are only defined in the rest of the chapter, a store consists of:
+
+- A set of [store objects][store object], the immutable file system data.
+
+  This can also be looked at as a map from [store paths][store path] to store objects.
+
+- A set of [derivations][derivation], instructions for building store objects.
+
+  This can also be looked at as a map from [store paths][store path] to derivations.
+  Since store paths to derivations always end in `.drv`, and store paths to other store objects never do, the two maps can also be combined into one.
+  Derivations can also be encoded as store objects too.
+
+- A [build trace], a record of which derivations have been built and what they produced.
+
+  > **Warning**
+  >
+  > The concept of a build trace is currently
+  > [**experimental**](@docroot@/development/experimental-features.md#xp-feature-ca-derivations)
+  > and subject to change.
+
+There are [multiple types of Nix stores][store type] with different capabilities, such as the default one on the [local file system][local store] (`/nix/store`) or [binary caches][binary cache].
+
+[store object]: ./store-object.md
+[store path]: ./store-path.md
+[derivation]: ./derivation/index.md
+[build trace]: ./build-trace.md
+
+[store type]: ./types/index.md
+[local store]: ./types/local-store.md
+[binary cache]: ./types/http-binary-cache-store.md
diff --git a/doc/manual/source/store/store-object.md b/doc/manual/source/store/store-object.md
index 170d6246cfe7..eb84ab84370d 100644
--- a/doc/manual/source/store/store-object.md
+++ b/doc/manual/source/store/store-object.md
@@ -66,3 +66,9 @@ A store can only contain a store object if it also contains all the store object
 >
 > The "closure property" isn't meant to prohibit, for example, [lazy loading](https://en.wikipedia.org/wiki/Lazy_loading) of store objects.
 > However, the "closure property" and immutability in conjunction imply that any such lazy loading ought to be deterministic.
+
+### Store Object Metadata {#metadata}
+
+[Store implementations](@docroot@/store/types/index.md) currently associate more information than described above with a store object.
+Quite arguably some of this information doesn't belong here, because it conflates concerns.
+For details see the [store object info](@docroot@/protocols/json/store-object-info.md) JSON format or the [narinfo](@docroot@/protocols/binary-cache/narinfo.md) format.
diff --git a/doc/manual/source/store/store-object/content-address.md b/doc/manual/source/store/store-object/content-address.md
index 94d94ec6d4ae..282b7545a231 100644
--- a/doc/manual/source/store/store-object/content-address.md
+++ b/doc/manual/source/store/store-object/content-address.md
@@ -9,7 +9,7 @@ In particular, the content-addressing scheme will ensure that the digest of the
 
 - file system object graph (the root one and its children, if it has any)
 - references
-- [store directory](../store-path.md#store-directory)
+- [store directory path](../store-path.md#store-directory-path)
 - name
 
 of the store object, and not any other information, which would not be an intrinsic property of that store object.
diff --git a/doc/manual/source/store/store-path.md b/doc/manual/source/store/store-path.md
index 04bdfec004c2..43037f7baac6 100644
--- a/doc/manual/source/store/store-path.md
+++ b/doc/manual/source/store/store-path.md
@@ -1,72 +1,136 @@
-# Store Path
+# Store Path and Store Directory
 
-> **Example**
->
-> `/nix/store/jf6gn2dzna4nmsfbdxsd7kwhsk6gnnlr-git-2.38.1`
->
-> A rendered store path
+Nix's [store object] and [file system object] data models are minimal and abstract.
+But to actually be used by software, store objects need to be made available through the operating system's file system.
+
+This is done by exposing all the store objects in a single *[store directory][store directory path]*.
+Every entry in that directory is a *[store path base name]* pointing to a store object.
+Store objects exposed in this way can then be referenced by *[store paths][store path]*.
+
+[store object]: ./store-object.md
+[file system object]: ./file-system-object.md
+[store path]: #store-path
+[store path base name]: #base-name
+[store directory path]: #store-directory-path
+
+## Store Path Base Name {#base-name}
 
-Nix implements references to [store objects](./store-object.md) as *store paths*.
+Nix implements references to store objects as *store path base names*.
 
-Think of a store path as an [opaque], [unique identifier]:
-The only way to obtain store path is by adding or building store objects.
-A store path will always reference exactly one store object.
+Think of a store path base name as an [opaque], [unique identifier]:
+The only way to obtain a store path base name is by adding or building store objects.
+A store path base name will always reference exactly one store object.
 
 [opaque]: https://en.m.wikipedia.org/wiki/Opaque_data_type
 [unique identifier]: https://en.m.wikipedia.org/wiki/Unique_identifier
 
-Store paths are pairs of
+Store path base names are pairs of
 
-- A 20-byte digest for identification
-- A symbolic name for people to read
+- A 20-byte [digest]{#digest} for identification
+- A symbolic [name]{#name} for people to read
 
 > **Example**
 >
 > - Digest: `q06x3jll2yfzckz2bzqak089p43ixkkq`
 > - Name:   `firefox-33.1`
 
-To make store objects accessible to operating system processes, stores have to expose store objects through the file system.
+A store path base name is rendered to a string as the concatenation of
 
-A store path is rendered to a file system path as the concatenation of
-
-- [Store directory](#store-directory) (typically `/nix/store`)
-- Path separator (`/`)
-- Digest rendered in [Nix32](@docroot@/protocols/nix32.md), a variant of base-32 (20 hash bytes become 32 ASCII characters)
+- Digest rendered in [Nix32], a variant of [Base32] (20 hash bytes become 32 ASCII characters)
 - Hyphen (`-`)
 - Name
 
 > **Example**
 >
 > ```
->   /nix/store/q06x3jll2yfzckz2bzqak089p43ixkkq-firefox-33.1
->   |--------| |------------------------------| |----------|
-> store directory            digest                 name
+> q06x3jll2yfzckz2bzqak089p43ixkkq-firefox-33.1
+> |------------------------------| |----------|
+>               digest                 name
 > ```
 
-Exactly how the digest is calculated depends on the type of store path.
+[Nix32]: @docroot@/protocols/nix32.md
+[Base32]: https://en.wikipedia.org/wiki/Base32
+
+Exactly how the digest is calculated depends on the type of store object being referenced.
 Store path digests are *supposed* to be opaque, and so for most operations, it is not necessary to know the details.
 That said, the manual has a full [specification of store path digests](@docroot@/protocols/store-path.md).
 
-## Store Directory
-
-Every [Nix store](./index.md) has a store directory.
+## Store Directory Path
 
-Not every store can be accessed through the file system.
-But if the store has a file system representation, the store directory contains the store’s [file system objects], which can be addressed by [store paths](#store-path).
+Every [Nix store] has a store directory path.
+This is an absolute, lexically canonical (not containing any `..`, `.`, or similar) path which points to the directory where all store objects are to be found.
 
-[file system objects]: ./file-system-object.md
-
-This means a store path is not just derived from the referenced store object itself, but depends on the store that the store object is in.
+[Nix store]: ./index.md
 
 > **Note**
 >
 > The store directory defaults to `/nix/store`, but is in principle arbitrary.
 
-It is important which store a given store object belongs to:
+## Store Path
+
+A store path is the pair of a store directory path and a [store path base name].
+It is rendered to a file system path as the concatenation of
+
+- [Store directory path] (typically `/nix/store`)
+- Path separator (`/`)
+- The [store path base name]
+
+> **Example**
+>
+> ```
+>   /nix/store/q06x3jll2yfzckz2bzqak089p43ixkkq-firefox-33.1
+>   |--------| |------------------------------| |----------|
+> store directory            digest                 name
+> ```
+
+When we have fixed a given store, or given store directory path (that all the stores in use share), the abstract syntax for store paths and the abstract syntax for store path base names coincide: the store directory path is known from context, so only the other two fields vary from one store path to the next.
+
+## Exposing Store Objects in OS File Systems {#exposing}
+
+Not every store can be accessed through the file system.
+But if the store has a file system representation, the following should be true:
+
+- The store directory path is canonical: no prefix of the path (i.e. path of the first *n* path segments) points to a symlink.
+  In other words, the store directory can be looked up from the store directory path without following any symlinks.
+  (This condition is a separate condition in addition to the "lexical canonicity" described above, which is a property of just the path itself.
+  This (regular) "canonicity" is a property about the path and the filesystem it navigates jointly.)
+
+  > **Note**
+  >
+  > The [`allow-symlinked-store`](@docroot@/command-ref/conf-file.md#conf-allow-symlinked-store) setting can be used to relax this requirement.
+
+- The store directory path in fact points to a directory.
+
+- The store directory contains, for every store object in the store, the [file system object] of that store object at the (rendered) [store path base name].
+  The permissions and other metadata for these files in the store directory is in the normal form described in [Exposing in OS file systems](./file-system-object/os-file-system.md).
+
+The above properties mean that the following file accesses will work.
+Suppose we have a store available on the file system per the above rules, and `b6gvzjyb2pg0kjfwrjmg1vfhh54ad73z-firefox-33.1` is the store path base name of a store object in that store.
+
+- Suppose that the store directory (path) is `/foo/bar`.
+  Then, `/foo/bar/b6gvzjyb2pg0kjfwrjmg1vfhh54ad73z-firefox-33.1` exists and is the file system object of that store object.
+
+- Suppose that we don't know what the store directory path of the store is, but we do have a capability `storeDir` to the store directory on the file system.
+  (This would be a "file descriptor" on Unix, or a "file handle" on Windows.)
+  Then (using the Unix notation for this):
+  ```
+  openat(storeDir, "b6gvzjyb2pg0kjfwrjmg1vfhh54ad73z-firefox-33.1", O_NOFOLLOW)
+  ```
+  will succeed (so long as the file system object is not a symlink), and the yielded capability will point to the file system object of that store object.
+
+  (The behavior for symlinks is harder to specify because of limitations in POSIX.)
+
+## Relocating store objects
+
+The inclusion of the store directory path in the full rendered store path means that the full rendered store path is not just derived from the referenced store object itself, but depends on the store that the store object is in.
+(And actually, all of the currently-supported ways of computing the digest of a store path also depend on the store directory path, as described in the [specification of store path digests](@docroot@/protocols/store-path.md).
+So this is also true even just for store path base names, in general.)
+
+It is therefore important to consider which store a given store object belongs to:
 Files in the store object can contain store paths, and processes may read these paths.
 Nix can only guarantee referential integrity if store paths do not cross store boundaries.
 
-Therefore one can only copy store objects to a different store if
+One can only copy store objects to a different store if
 
 - The source and target stores' directories match
 
diff --git a/doc/manual/source/store/types/index.md.in b/doc/manual/source/store/types/index.md.in
index 75274d3a5097..fbdcf0111f59 100644
--- a/doc/manual/source/store/types/index.md.in
+++ b/doc/manual/source/store/types/index.md.in
@@ -37,7 +37,7 @@ store as follows:
 * Otherwise, if `/nix/var/nix/daemon-socket/socket` exists, [connect
   to the Nix daemon listening on that socket](./local-daemon-store.md).
 
-* Otherwise, on Linux only, use the [local chroot store](./local-store.md#chroot)
+* Otherwise, on Linux only, use the [local chroot store](@docroot@/store/types/local-store.md#chroot)
   `~/.local/share/nix/root`, which will be created automatically if it
   does not exist.
 
diff --git a/doc/manual/theme/head.hbs b/doc/manual/theme/head.hbs
index e514a99777f7..40bfef7d2f8f 100644
--- a/doc/manual/theme/head.hbs
+++ b/doc/manual/theme/head.hbs
@@ -11,5 +11,5 @@ MathJax = {
   }
 };
 </script>
-<!-- Load a newer versino of MathJax than mdbook does by default, and which in particular has working relative paths for the "bussproofs" extension. -->
+<!-- Load a newer version of MathJax than mdbook does by default, and which in particular has working relative paths for the "bussproofs" extension. -->
 <script async src="https://cdnjs.cloudflare.com/ajax/libs/mathjax/3.0.1/es5/tex-mml-chtml.js"></script>
diff --git a/flake.lock b/flake.lock
index 4c0bf91927a4..7dcbdd60af35 100644
--- a/flake.lock
+++ b/flake.lock
@@ -23,11 +23,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -39,20 +39,16 @@
     "git-hooks-nix": {
       "inputs": {
         "flake-compat": [],
-        "gitignore": [],
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1734279981,
-        "narHash": "sha256-NdaCraHPp8iYMWzdXAt5Nv6sA3MUzlCiGiR586TCwo0=",
+        "lastModified": 1783008725,
+        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "aa9f40c906904ebd83da78e7f328cd8aeaeae785",
+        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
         "type": "github"
       },
       "original": {
@@ -63,15 +59,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771903837,
-        "narHash": "sha256-jEA8WggGKtMFeNeCKq3NK8cLEjJmG6/RLUElYYbBZ0E=",
-        "rev": "e764fc9a405871f1f6ca3d1394fb422e0a0c3951",
+        "lastModified": 1783148766,
+        "narHash": "sha256-H9+N+GFtsbVC8ZniHliChM7ndizxtqVZs6bnGOLM3WQ=",
+        "rev": "a50de1b7d8a586adc18d2395c19de7d6058e6030",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.11/nixos-25.11.6495.e764fc9a4058/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.4193.a50de1b7d8a5/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz"
+        "url": "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz"
       }
     },
     "nixpkgs-23-11": {
diff --git a/flake.nix b/flake.nix
index 89cbe93cff7f..62944b794957 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,7 +1,7 @@
 {
   description = "The purely functional package manager";
 
-  inputs.nixpkgs.url = "https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz";
+  inputs.nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
 
   inputs.nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2";
   inputs.nixpkgs-23-11.url = "github:NixOS/nixpkgs/a62e6edd6d5e1fa0329b8653c801147986f8d446";
@@ -16,10 +16,8 @@
   # work around https://github.com/NixOS/nix/issues/7730
   inputs.flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";
   inputs.git-hooks-nix.inputs.nixpkgs.follows = "nixpkgs";
-  inputs.git-hooks-nix.inputs.nixpkgs-stable.follows = "nixpkgs";
   # work around 7730 and https://github.com/NixOS/nix/issues/7807
   inputs.git-hooks-nix.inputs.flake-compat.follows = "";
-  inputs.git-hooks-nix.inputs.gitignore.follows = "";
 
   outputs =
     inputs@{
@@ -114,7 +112,7 @@
                       config = crossSystem;
                     }
                     // lib.optionalAttrs (crossSystem == "x86_64-w64-mingw32") {
-                      emulator = pkgs: "${pkgs.buildPackages.wineWow64Packages.stable_11}/bin/wine";
+                      emulator = pkgs: "${pkgs.buildPackages.wineWow64Packages.stable}/bin/wine";
                     };
                 overlays = [
                   (overlayFor (pkgs: pkgs.${stdenv}))
@@ -328,12 +326,6 @@
         // (lib.optionalAttrs (builtins.elem system linux64BitSystems)) {
           dockerImage = self.hydraJobs.dockerImage.${system};
         }
-        // (lib.optionalAttrs (!(builtins.elem system linux32BitSystems))) {
-          # Some perl dependencies are broken on i686-linux.
-          # Since the support is only best-effort there, disable the perl
-          # bindings
-          perlBindings = self.hydraJobs.perlBindings.${system};
-        }
         # Add "passthru" tests
         //
           flatMapAttrs
@@ -422,10 +414,6 @@
                 supportsCross = false;
               };
 
-              "nix-perl-bindings" = {
-                supportsCross = false;
-              };
-
               "nix-clang-tidy-plugin" = {
                 supportsCross = false;
               };
@@ -466,6 +454,9 @@
                 )
               )
             )
+        // lib.optionalAttrs (self.hydraJobs.rustInstaller ? ${system}) {
+          rustInstaller = self.hydraJobs.rustInstaller.${system};
+        }
         // lib.optionalAttrs (builtins.elem system linux64BitSystems) {
           dockerImage =
             let
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index f742a7440023..5978d997b6f8 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -37,30 +37,17 @@
               fi
             ''}";
           };
-          meson-format =
-            let
-              meson = pkgs.meson.overrideAttrs {
-                doCheck = false;
-                doInstallCheck = false;
-                patches = [
-                  (pkgs.fetchpatch {
-                    url = "https://github.com/mesonbuild/meson/commit/38d29b4dd19698d5cad7b599add2a69b243fd88a.patch";
-                    hash = "sha256-PgPBvGtCISKn1qQQhzBW5XfknUe91i5XGGBcaUK4yeE=";
-                  })
-                ];
-              };
-            in
-            {
-              enable = true;
-              files = "(meson.build|meson.options)$";
-              entry = "${pkgs.writeScript "format-meson" ''
-                #!${pkgs.runtimeShell}
-                for file in "$@"; do
-                  ${lib.getExe meson} format -ic ${../meson.format} "$file"
-                done
-              ''}";
-            };
-          nixfmt-rfc-style = {
+          meson-format = {
+            enable = true;
+            files = "(meson.build|meson.options)$";
+            entry = "${pkgs.writeScript "format-meson" ''
+              #!${pkgs.runtimeShell}
+              for file in "$@"; do
+                ${lib.getExe pkgs.meson} format -ic ${../meson.format} "$file"
+              done
+            ''}";
+          };
+          nixfmt = {
             enable = true;
             excludes = [
               # Invalid
diff --git a/maintainers/release-process.md b/maintainers/release-process.md
index f8b6b6bec572..aff0088a0d93 100644
--- a/maintainers/release-process.md
+++ b/maintainers/release-process.md
@@ -81,27 +81,33 @@ release:
   $ git push --set-upstream origin $VERSION-maintenance
   ```
 
-* Create a jobset for the release branch on Hydra as follows:
-
-  * Go to the jobset of the previous release
-  (e.g. https://hydra.nixos.org/jobset/nix/maintenance-2.11).
-
-  * Select `Actions -> Clone this jobset`.
-
-  * Set identifier to `maintenance-$VERSION`.
-
-  * Set description to `$VERSION release branch`.
-
-  * Set flake URL to `github:NixOS/nix/$VERSION-maintenance`.
-
-  * Hit `Create jobset`.
-
-* Wait for the new jobset to evaluate and build. If impatient, go to
-  the evaluation and select `Actions -> Bump builds to front of
-  queue`.
-
-* When the jobset evaluation has succeeded building, take note of the
-  evaluation ID (e.g. `1780832` in
+* Create two jobsets for the release branch on Hydra:
+
+  `maintenance-$VERSION` runs the full `hydraJobs` CI matrix.
+  `maintenance-$VERSION-release` builds only the artifacts consumed by
+  `upload-release`, so a release can be cut without waiting on the full
+  matrix. The `-release` suffix keeps the pair adjacent in Hydra's
+  alphabetical jobset list and lets scripts derive one name from the
+  other.
+
+  * Clone the previous `maintenance-*` jobset, set identifier
+    `maintenance-$VERSION`, description `$VERSION release branch`, flake
+    URL `github:NixOS/nix/$VERSION-maintenance`.
+
+  * Clone the previous `maintenance-*-release` jobset (or create a new
+    **legacy** jobset), set identifier `maintenance-$VERSION-release`,
+    description `$VERSION release artifacts`, Nix expression
+    `packaging/release-jobs.nix` in input `src`, and add input `src` of
+    type *Git checkout* pointing at
+    `https://github.com/NixOS/nix $VERSION-maintenance`.
+
+* Wait for the `maintenance-$VERSION-release` jobset to evaluate and
+  build. If impatient, go to the evaluation and select `Actions -> Bump
+  builds to front of queue`. The aggregate job `release` turns green
+  once every required artifact is available.
+
+* When the release jobset evaluation has succeeded building, take note of
+  the evaluation ID (e.g. `1780832` in
   `https://hydra.nixos.org/eval/1780832`).
 
 * Tag the release:
@@ -174,8 +180,9 @@ release:
   $ git push
   ```
 
-* Wait for the desired evaluation of the maintenance jobset to finish
-  building.
+* Wait for the desired evaluation of the `maintenance-XX.YY-release`
+  jobset to finish building (the `release` aggregate job is the gating
+  signal).
 
 * Tag the release
 
diff --git a/maintainers/upload-release.pl b/maintainers/upload-release.pl
index 06678553e712..b618bd900d4e 100755
--- a/maintainers/upload-release.pl
+++ b/maintainers/upload-release.pl
@@ -64,7 +64,13 @@ sub fetch {
 #print Dumper($evalInfo);
 my $flakeUrl = $evalInfo->{flake};
 my $flakeInfo = decode_json(`nix flake metadata --json "$flakeUrl"` or die) if $flakeUrl;
-my $nixRev = ($flakeInfo ? $flakeInfo->{revision} : $evalInfo->{jobsetevalinputs}->{nix}->{revision}) or die;
+# Flake jobsets (`maintenance-X.Y`) expose the rev via the flake URL.
+# The release-artifacts jobset (`maintenance-X.Y-release`) is a legacy
+# jobset whose checkout is passed in as input `src`.
+my $nixRev = ($flakeInfo
+              ? $flakeInfo->{revision}
+              : $evalInfo->{jobsetevalinputs}->{src}->{revision}
+                // $evalInfo->{jobsetevalinputs}->{nix}->{revision}) or die;
 
 my $buildInfo = decode_json(fetch("$evalUrl/job/build.nix-everything.x86_64-linux", 'application/json'));
 #print Dumper($buildInfo);
diff --git a/meson.build b/meson.build
index bef2e6221a53..c01297fb5477 100644
--- a/meson.build
+++ b/meson.build
@@ -1,15 +1,12 @@
-# This is just a stub project to include all the others as subprojects
-# for development shell purposes
+# This is just a top-level project to include all the others as subprojects
+# for development shell purposes (when building via Nix) or for distro packaging purposes.
 
 project(
-  'nix-dev-shell',
+  'Nix',
   'cpp',
   version : files('.version'),
   subproject_dir : 'src',
-  default_options : [
-    'localstatedir=/nix/var',
-  ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
 )
 
 # Internal Libraries
@@ -21,6 +18,14 @@ subproject('libflake')
 subproject('libmain')
 subproject('libcmd')
 
+# External C wrapper libraries
+subproject('libutil-c')
+subproject('libstore-c')
+subproject('libfetchers-c')
+subproject('libexpr-c')
+subproject('libflake-c')
+subproject('libmain-c')
+
 # Executables
 subproject('nix')
 
@@ -37,21 +42,6 @@ if get_option('doc-gen')
   endif
 endif
 
-# External C wrapper libraries
-subproject('libutil-c')
-subproject('libstore-c')
-subproject('libfetchers-c')
-subproject('libexpr-c')
-subproject('libflake-c')
-subproject('libmain-c')
-
-asan_enabled = 'address' in get_option('b_sanitize')
-
-# Language Bindings
-if get_option('bindings') and not meson.is_cross_build() and not asan_enabled
-  subproject('perl')
-endif
-
 # Testing
 if get_option('unit-tests')
   subproject('libutil-test-support')
@@ -63,7 +53,11 @@ if get_option('unit-tests')
   subproject('libexpr-tests')
   subproject('libflake-tests')
 endif
-subproject('nix-functional-tests')
+
+if get_option('functional-tests')
+  subproject('nix-functional-tests')
+endif
+
 if get_option('json-schema-checks')
   subproject('json-schema-checks')
 endif
diff --git a/meson.options b/meson.options
index a306a84252ea..2e0d873fae08 100644
--- a/meson.options
+++ b/meson.options
@@ -15,10 +15,10 @@ option(
 )
 
 option(
-  'bindings',
+  'functional-tests',
   type : 'boolean',
   value : true,
-  description : 'Build language bindings (e.g. Perl)',
+  description : 'Build functional (E2E) tests',
 )
 
 option(
diff --git a/nix-meson-build-support/common/asan-options/asan-options.cc b/nix-meson-build-support/common/asan-options/asan-options.cc
index c9782fea03b5..62db7ddd20e0 100644
--- a/nix-meson-build-support/common/asan-options/asan-options.cc
+++ b/nix-meson-build-support/common/asan-options/asan-options.cc
@@ -1,4 +1,17 @@
-extern "C" [[gnu::retain, gnu::weak]] const char * __asan_default_options()
+#if defined(__has_attribute)
+#  if __has_attribute(no_profile_instrument_function)
+#    define NIX_NO_PROFILE_INSTRUMENT_FUNCTION __attribute__((no_profile_instrument_function))
+#  endif
+#endif
+
+#ifndef NIX_NO_PROFILE_INSTRUMENT_FUNCTION
+#  define NIX_NO_PROFILE_INSTRUMENT_FUNCTION
+#endif
+
+// This ASan hook is linked into many instrumented binaries and libraries. Do
+// not emit coverage counters for it because repeated weak definitions of the
+// hook can produce profile data that llvm-profdata treats as corrupted.
+extern "C" [[gnu::retain, gnu::weak]] NIX_NO_PROFILE_INSTRUMENT_FUNCTION const char * __asan_default_options()
 {
     // We leak a bunch of memory knowingly on purpose. It's not worthwhile to
     // diagnose that memory being leaked for now.
diff --git a/nix-meson-build-support/common/asan-options/meson.build b/nix-meson-build-support/common/asan-options/meson.build
index 56e6a6a56a7f..80527b5a9884 100644
--- a/nix-meson-build-support/common/asan-options/meson.build
+++ b/nix-meson-build-support/common/asan-options/meson.build
@@ -1,7 +1,7 @@
 # Clang gets grumpy about missing libasan symbols if -shared-libasan is not
 # passed when building shared libs, at least on Linux
 if cxx.get_id() == 'clang' and ('address' in get_option('b_sanitize') or 'undefined' in get_option(
-    'b_sanitize',
+  'b_sanitize',
 ))
   add_project_link_arguments('-shared-libasan', language : 'cpp')
 endif
diff --git a/nix-meson-build-support/common/clang-tidy/.clang-tidy b/nix-meson-build-support/common/clang-tidy/.clang-tidy
index f8394f4fabd4..24f02a1fd943 100644
--- a/nix-meson-build-support/common/clang-tidy/.clang-tidy
+++ b/nix-meson-build-support/common/clang-tidy/.clang-tidy
@@ -41,8 +41,6 @@ Checks:
   - -bugprone-unused-local-non-trivial-variable
   # 2 warnings - returning const& from parameter
   - -bugprone-return-const-ref-from-parameter
-  # 1 warning - unsafe C functions (e.g., getenv)
-  - -bugprone-unsafe-functions
   # 1 warning - signed char misuse
   - -bugprone-signed-char-misuse
   # 1 warning - calling parent virtual instead of override
@@ -53,11 +51,6 @@ Checks:
   - -bugprone-macro-parentheses
   # 1 warning - increment/decrement in conditions
   - -bugprone-inc-dec-in-conditions
-  # 2 warnings - std::move on forwarding reference (auto&&) in ranges lambdas
-  - -bugprone-move-forwarding-reference
-  # 2 warnings - coroutine pattern: co_await await(std::move(waitees)) then reuse.
-  # Relies on moved-from containers being empty (holds for libstdc++/libc++).
-  - -bugprone-use-after-move
   # 2 warnings - sorts Value* by ->string_view(), not by pointer value (false positive)
   - -bugprone-nondeterministic-pointer-iteration-order
   # 9 warnings - intentional std::bit_cast/memcpy on Value* arrays (evaluator hot path)
@@ -70,7 +63,7 @@ Checks:
   # template; fires when T=unsigned char but that instantiation is correct.
   - -bugprone-unintended-char-ostream-output
   #
-  # Non-bugprone checks (also disabled to pass on current codebase):
+  # Non-bugprone checks (some disabled to pass on current codebase):
   #
   # 4 warnings - exceptions not derived from std::exception
   # All thrown exceptions must derive from std::exception
@@ -79,7 +72,15 @@ Checks:
   # - cppcoreguidelines-pro-type-cstyle-cast
   # 11 warnings - coroutine lambdas with captures (intentional pattern in async goal/store code)
   # - cppcoreguidelines-avoid-capturing-lambda-coroutines
-  # Custom nix checks (when added)
+  - performance-noexcept-swap
+  - performance-noexcept-move-constructor
+  - performance-noexcept-destructor
+  - performance-use-std-move
+  - misc-throw-by-value-catch-by-reference
+  - cppcoreguidelines-missing-std-forward
+  - android-cloexec-open
+  - android-cloexec-pipe2
+  # Custom nix checks
   - nix-*
 
 CheckOptions:
@@ -90,3 +91,10 @@ CheckOptions:
   bugprone-reserved-identifier.AllowedIdentifiers: '__asan_default_options;__wrap___assert_fail;_SingleDerivedPathRaw;_DerivedPathRaw;_SingleBuiltPathRaw;_BuiltPathRaw'
   # Allow explicitly discarding return values with (void) cast
   bugprone-unused-return-value.AllowCastToVoid: true
+  bugprone-unsafe-functions.ReportDefaultFunctions: false
+  # Repurpose bugprone-unsafe-functions to lint functions that we'd want to wrap.
+  bugprone-unsafe-functions.CustomFunctions: >
+    ::std::filesystem::create_directories, nix::createDirs, "Use nix::createDirs (it wraps exceptions)";
+    ::std::filesystem::remove_all, nix::deletePath, "Use nix::deletePath (remove_all is not TOCTOU safe)";
+
+ExtraArgs: ["-Werror=unnecessary-virtual-specifier"]
diff --git a/nix-meson-build-support/common/clang-tidy/build_required_targets.py b/nix-meson-build-support/common/clang-tidy/build_required_targets.py
index d55acd74a21e..24e4f290c607 100755
--- a/nix-meson-build-support/common/clang-tidy/build_required_targets.py
+++ b/nix-meson-build-support/common/clang-tidy/build_required_targets.py
@@ -53,8 +53,6 @@ def main():
         + [t for t in custom_commands if t.endswith(".gen.inc")]
         # Flex/Bison generated parsers
         + [t for t in custom_commands if t.endswith("-tab.cc")]
-        # Perl XS generated bindings
-        + [t for t in custom_commands if t.endswith(".cc") and "perl" in t.lower()]
     )
     ninja_build(args.build_root, targets)
 
diff --git a/nix-meson-build-support/common/clang-tidy/clean_compdb.py b/nix-meson-build-support/common/clang-tidy/clean_compdb.py
index 659667209ac3..8087b0bf9b6e 100755
--- a/nix-meson-build-support/common/clang-tidy/clean_compdb.py
+++ b/nix-meson-build-support/common/clang-tidy/clean_compdb.py
@@ -48,9 +48,6 @@ def cmdfilter(item: dict) -> bool:
         # Filter out Flex/Bison generated parsers (generated code)
         if file.endswith("-tab.cc"):
             return False
-        # Filter out Perl XS generated bindings (generated code)
-        if "/perl/" in file and file.endswith(".cc"):
-            return False
         return True
 
     return [chomp(x) for x in compdb if cmdfilter(x)]
diff --git a/nix-meson-build-support/common/meson.build b/nix-meson-build-support/common/meson.build
index edb40635f298..e9964bce2ac1 100644
--- a/nix-meson-build-support/common/meson.build
+++ b/nix-meson-build-support/common/meson.build
@@ -14,7 +14,7 @@ if host_machine.system() == 'cygwin'
   )
 endif
 
-add_project_arguments(
+warning_flags = [
   '-Wdeprecated-copy',
   '-Werror=suggest-override',
   '-Werror=switch',
@@ -26,21 +26,43 @@ add_project_arguments(
   '-Werror=non-virtual-dtor',
   '-Wignored-qualifiers',
   '-Wimplicit-fallthrough',
+  # Clang complains about #embed even though it's now standard in C23. In C++ it's an extension, but meh.
+  '-Wno-c23-extensions',
   '-Wno-deprecated-declarations',
+  '-Wno-interference-size', # Used for C++ ABI only. We don't provide any guarantees about different march tunings.
+  '-Wno-subobject-linkage', # GCC doesn't like unity builds.
+  # Catch brace elision bugs: when WorkerProto::Version changed from `unsigned int`
+  # to `struct { unsigned int major; uint8_t minor; }`, `.version = 16` silently
+  # became `.version = {16, 0}` instead of failing, breaking protocol compatibility
+  # in a subtle way
+  '-Werror=c99-designator',
+]
+
+if meson.project_name() in [
+  'nix-util',
+  'nix-store',
+  'nix-util-c',
+  'nix-store-c',
+  'nix-expr',
+  'nix-expr-c',
+]
+  # Catch vtables with vague linkage. All vtables must have a "key" function to make
+  # sure they are emitted as strong symbols (as required by Itanium ABI). This is needed
+  # in certain cases of dynamic linking, where weak symbols are not always coalesced. Otherwise
+  # typeinfo symbols get duplicated and dynamic_cast/exception handling ends up broken on Darwin's
+  # libc++.
+  # Search for 'virtual void anchor' in the repo to see how this is done.
+  warning_flags += [ '-Werror=weak-vtables' ]
+endif
+
+add_project_arguments(
+  cxx.get_supported_arguments(warning_flags),
   language : 'cpp',
 )
 
 # GCC doesn't benefit much from precompiled headers.
 do_pch = cxx.get_id() == 'clang'
 
-if cxx.get_id() == 'gcc'
-  add_project_arguments(
-    '-Wno-interference-size', # Used for C++ ABI only. We don't provide any guarantees about different march tunings.
-    '-Wno-subobject-linkage', # GCC doesn't like unity builds.
-    language : 'cpp',
-  )
-endif
-
 # This is a clang-only option for improving build times.
 # It forces the instantiation of templates in the PCH itself and
 # not every translation unit it's included in.
@@ -50,11 +72,6 @@ endif
 # instantiations in libutil and libstore.
 if cxx.get_id() == 'clang'
   add_project_arguments('-fpch-instantiate-templates', language : 'cpp')
-  # Catch brace elision bugs: when WorkerProto::Version changed from `unsigned int`
-  # to `struct { unsigned int major; uint8_t minor; }`, `.version = 16` silently
-  # became `.version = {16, 0}` instead of failing, breaking protocol compatibility
-  # in a subtle way
-  add_project_arguments('-Werror=c99-designator', language : 'cpp')
 endif
 
 # Detect if we're using libstdc++ (GCC's standard library)
diff --git a/nix-meson-build-support/export/meson.build b/nix-meson-build-support/export/meson.build
index 62a27bd48c37..d5cb39661d06 100644
--- a/nix-meson-build-support/export/meson.build
+++ b/nix-meson-build-support/export/meson.build
@@ -11,12 +11,34 @@ endforeach
 requires_public += deps_public
 
 extra_pkg_config_variables = get_variable('extra_pkg_config_variables', {})
+fs = import('fs')
+plugin_c_api_enabled = get_variable('plugin_c_api_enabled', false)
+
+if plugin_c_api_enabled
+  this_libraries = get_variable('this_libraries')
+  this_library = this_libraries.get_shared_lib()
+  this_static_library = this_libraries.get_static_lib()
+else
+  this_library = get_variable('this_library')
+endif
 
 extra_cflags = []
 if not meson.project_name().endswith('-c')
   extra_cflags += [ '-std=c++23' ]
 endif
 
+whole_archive_dep_name = meson.project_name() + '-whole-archive'
+installed_whole_archive_link_arg = ''
+if plugin_c_api_enabled and host_machine.system() == 'darwin'
+  installed_whole_archive_link_arg = '-Wl,-force_load,${libdir}/' + fs.name(
+    this_static_library.full_path(),
+  )
+elif plugin_c_api_enabled and not host_machine.system().startswith('windows')
+  installed_whole_archive_link_arg = '-Wl,--whole-archive,${libdir}/' + fs.name(
+    this_static_library.full_path(),
+  ) + ',--no-whole-archive'
+endif
+
 import('pkgconfig').generate(
   this_library,
   filebase : meson.project_name(),
@@ -29,6 +51,19 @@ import('pkgconfig').generate(
   variables : extra_pkg_config_variables,
 )
 
+if installed_whole_archive_link_arg != ''
+  import('pkgconfig').generate(
+    filebase : whole_archive_dep_name,
+    name : 'Nix whole-archive static dependency',
+    description : 'Force-load static Nix C API archive into the host executable',
+    extra_cflags : extra_cflags,
+    requires : requires_public,
+    requires_private : requires_private,
+    libraries : [ installed_whole_archive_link_arg ],
+    variables : extra_pkg_config_variables,
+  )
+endif
+
 meson.override_dependency(
   meson.project_name(),
   declare_dependency(
@@ -39,3 +74,16 @@ meson.override_dependency(
     variables : extra_pkg_config_variables,
   ),
 )
+
+if installed_whole_archive_link_arg != ''
+  meson.override_dependency(
+    whole_archive_dep_name,
+    declare_dependency(
+      include_directories : include_dirs,
+      link_whole : [ this_static_library ],
+      compile_args : [ '-std=c++23' ],
+      dependencies : deps_public_subproject + deps_public,
+      variables : extra_pkg_config_variables,
+    ),
+  )
+endif
diff --git a/packaging/aws-c-io-s2n-darwin.patch b/packaging/aws-c-io-s2n-darwin.patch
new file mode 100644
index 000000000000..e3d9bf084e08
--- /dev/null
+++ b/packaging/aws-c-io-s2n-darwin.patch
@@ -0,0 +1,26 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 403bbf6..f095c4d 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -100,6 +100,9 @@ elseif (APPLE)
+             "source/posix/*.c"
+             "source/darwin/*.c"
+             )
++    # nix#15857: use s2n TLS, not fork-unsafe Apple SecureTransport
++    list(REMOVE_ITEM AWS_IO_OS_SRC "${CMAKE_CURRENT_SOURCE_DIR}/source/darwin/secure_transport_tls_channel_handler.c")
++    set(USE_S2N ON)
+ 
+     find_library(SECURITY_LIB Security)
+     find_library(NETWORK_LIB Network)
+diff --git a/cmake/aws-c-io-config.cmake b/cmake/aws-c-io-config.cmake
+index 156e032..d6b222d 100644
+--- a/cmake/aws-c-io-config.cmake
++++ b/cmake/aws-c-io-config.cmake
+@@ -1,6 +1,6 @@
+ include(CMakeFindDependencyMacro)
+ 
+-if (UNIX AND NOT APPLE AND NOT BYO_CRYPTO)
++if (UNIX AND NOT BYO_CRYPTO)
+     find_dependency(s2n)
+ endif()
+ 
diff --git a/packaging/components.nix b/packaging/components.nix
index 112791c27d38..57bb08c4aca8 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -139,8 +139,6 @@ let
             !(stdenv.hostPlatform.isWindows || stdenv.hostPlatform.isCygwin)
             # build failure
             && !stdenv.hostPlatform.isStatic
-            # LTO breaks exception handling on x86-64-darwin.
-            && stdenv.system != "x86_64-darwin"
           )
           ''
             case "$mesonBuildType" in
@@ -331,6 +329,11 @@ in
   */
   withUnityBuild = true;
 
+  /**
+    Whether to embed the public C API into nix-cli so plugins can resolve those symbols from the executable.
+  */
+  withPluginCAPI = !(stdenv.hostPlatform.isWindows || stdenv.hostPlatform.isStatic);
+
   /**
     A user-provided extension function to apply to each component derivation.
   */
@@ -479,7 +482,9 @@ in
   /**
     The Nix command line interface. Note that this does not include its tests, whereas `nix-everything` does.
   */
-  nix-cli = callPackage ../src/nix/package.nix { version = fineVersion; };
+  nix-cli = callPackage ../src/nix/package.nix {
+    version = fineVersion;
+  };
 
   nix-functional-tests = callPackage ../tests/functional/package.nix {
     version = fineVersion;
@@ -512,8 +517,6 @@ in
   */
   nix-json-schema-checks = callPackage ../src/json-schema-checks/package.nix { };
 
-  nix-perl-bindings = callPackage ../src/perl/package.nix { };
-
   # The clang-tidy plugin is a build-time tool loaded into clang-tidy itself,
   # so it must be built with a clang stdenv for ABI compatibility with the
   # clang-tidy binary from the same llvmPackages set, regardless of the
diff --git a/packaging/dependencies.nix b/packaging/dependencies.nix
index b44f6ae46c80..f8f64abf3968 100644
--- a/packaging/dependencies.nix
+++ b/packaging/dependencies.nix
@@ -17,16 +17,16 @@ scope: {
   inherit stdenv;
 
   mimalloc =
-    if lib.versionAtLeast pkgs.mimalloc.version "3.3.0" then
+    if lib.versionAtLeast pkgs.mimalloc.version "3.3.2" then
       pkgs.mimalloc
     else
       pkgs.mimalloc.overrideAttrs rec {
-        version = "3.3.0";
+        version = "3.3.2";
         src = pkgs.fetchFromGitHub {
           owner = "microsoft";
           repo = "mimalloc";
           tag = "v${version}";
-          hash = "sha256-xy9gPihw3xvhnd6BrCYfMnnRp5dPSodynKRToYwxuzg=";
+          hash = "sha256-GZ37qQVDe9jgMb4Coe5oKvgaLTspZDlSkS5rdy1MfUU=";
         };
       };
 
@@ -44,24 +44,78 @@ scope: {
         NIX_CFLAGS_COMPILE = "-DINITIAL_MARK_STACK_SIZE=1048576";
       });
 
-  curl =
-    (pkgs.curl.override {
-      http3Support = !pkgs.stdenv.hostPlatform.isWindows;
-      # Make sure we enable all the dependencies for Content-Encoding/Transfer-Encoding decompression.
-      zstdSupport = true;
-      brotliSupport = true;
-      zlibSupport = true;
-    }).overrideAttrs
-      {
-        # TODO: Fix in nixpkgs. Static build with brotli is marked as broken, but it's not the case.
-        # Remove once https://github.com/NixOS/nixpkgs/pull/494111 lands in the 25.11 channel.
-        meta.broken = false;
-      };
+  curl = pkgs.curl.override {
+    http3Support = !pkgs.stdenv.hostPlatform.isWindows;
+    # Make sure we enable all the dependencies for Content-Encoding/Transfer-Encoding decompression.
+    zstdSupport = true;
+    brotliSupport = true;
+    zlibSupport = true;
+  };
 
   libblake3 = pkgs.libblake3.override {
-    useTBB = !(stdenv.hostPlatform.isWindows || stdenv.hostPlatform.isStatic);
+    useTBB =
+      !(
+        stdenv.hostPlatform.isWindows
+        || stdenv.hostPlatform.isStatic
+        # Some tbb tests fail with libc++.
+        || (stdenv.cc.libcxx != null && stdenv.cc.libcxx.isLLVM)
+      );
   };
 
+  # Force the s2n TLS backend in aws-c-io on macOS; Apple SecureTransport is not
+  # fork-safe and crashes daemon workers (NixOS/nix#15857). Override it across
+  # the whole aws-c-* stack so one aws-c-io is shared.
+  aws-crt-cpp =
+    if !stdenv.hostPlatform.isDarwin then
+      pkgs.aws-crt-cpp
+    else
+      let
+        aws-c-io = pkgs.aws-c-io.overrideAttrs (old: {
+          patches = (old.patches or [ ]) ++ [ ./aws-c-io-s2n-darwin.patch ];
+        });
+        aws-c-http = pkgs.aws-c-http.override { inherit aws-c-io; };
+        aws-c-auth = pkgs.aws-c-auth.override { inherit aws-c-io aws-c-http; };
+        aws-c-event-stream = pkgs.aws-c-event-stream.override { inherit aws-c-io; };
+        aws-c-mqtt = pkgs.aws-c-mqtt.override { inherit aws-c-io aws-c-http; };
+        aws-c-s3 = pkgs.aws-c-s3.override { inherit aws-c-io aws-c-http aws-c-auth; };
+      in
+      pkgs.aws-crt-cpp.override {
+        inherit
+          aws-c-io
+          aws-c-http
+          aws-c-auth
+          aws-c-event-stream
+          aws-c-mqtt
+          aws-c-s3
+          ;
+      };
+
+  sqlite =
+    if !stdenv.hostPlatform.isWindows then
+      pkgs.sqlite
+    else
+      pkgs.sqlite.overrideAttrs (prevAttrs: {
+        nativeBuildInputs = lib.filter (x: !(x.pname == "tcl")) prevAttrs.nativeBuildInputs or [ ];
+        configureFlags = (lib.filter (x: !(lib.hasPrefix "--with-tcl" x)) prevAttrs.configureFlags) ++ [
+          "--disable-tcl"
+        ];
+      });
+
+  libgit2 =
+    if lib.versionAtLeast pkgs.libgit2.version "1.9.4" then
+      pkgs.libgit2
+    else
+      # Grab newer libgit2.
+      pkgs.libgit2.overrideAttrs rec {
+        version = "1.9.4";
+        src = pkgs.fetchFromGitHub {
+          owner = "libgit2";
+          repo = "libgit2";
+          tag = "v${version}";
+          hash = "sha256-ZKUiz3pdFE2SKxh53X2oyr7hs32Njj5YVA0OXDXz7h0=";
+        };
+      };
+
   # TODO Hack until https://github.com/NixOS/nixpkgs/issues/45462 is fixed.
   boost =
     (pkgs.boost.override {
@@ -72,6 +126,9 @@ scope: {
         "--with-iostreams"
         "--with-url"
       ];
+      patches = [
+        ./patches/0001-Fix-uncaught_exceptions-not-accounting-for-forced_un.patch
+      ];
       enableIcu = false;
     }).overrideAttrs
       (old: {
diff --git a/packaging/dev-shell.nix b/packaging/dev-shell.nix
index a29d65cb2a8d..d18e77c52f12 100644
--- a/packaging/dev-shell.nix
+++ b/packaging/dev-shell.nix
@@ -127,7 +127,6 @@ nixComponents.callPackage (
           rest = builtins.substring 2 (builtins.stringLength flag) flag;
         in
         "-D${prefix}:${rest}";
-      havePerl = stdenv.buildPlatform == stdenv.hostPlatform && stdenv.hostPlatform.isUnix;
       ignoreCrossFile = flags: builtins.filter (flag: !(lib.strings.hasInfix "cross-file" flag)) flags;
 
       availableComponents = lib.filterAttrs (
@@ -170,12 +169,7 @@ nixComponents.callPackage (
         # perhaps other things that are primarily for overriding and not the shell.
         config = {
           # Default getComponents
-          getComponents =
-            c:
-            builtins.removeAttrs c (
-              lib.optionals (!havePerl) [ "nix-perl-bindings" ]
-              ++ lib.optionals (!buildCanExecuteHost) [ "nix-manual" ]
-            );
+          getComponents = c: builtins.removeAttrs c (lib.optionals (!buildCanExecuteHost) [ "nix-manual" ]);
         };
 
         /**
@@ -211,7 +205,6 @@ nixComponents.callPackage (
             "nix-fetchers-tests"
             "nix-flake-tests"
             "nix-functional-tests"
-            "nix-perl-bindings"
           ] (_: null)) c
         );
       };
@@ -287,11 +280,14 @@ nixComponents.callPackage (
       ++ map (transformFlag "libutil") (ignoreCrossFile nixComponents.nix-util.mesonFlags)
       ++ map (transformFlag "libstore") (ignoreCrossFile nixComponents.nix-store.mesonFlags)
       ++ map (transformFlag "libfetchers") (ignoreCrossFile nixComponents.nix-fetchers.mesonFlags)
-      ++ lib.optionals havePerl (
-        map (transformFlag "perl") (ignoreCrossFile nixComponents.nix-perl-bindings.mesonFlags)
-      )
       ++ map (transformFlag "libexpr") (ignoreCrossFile nixComponents.nix-expr.mesonFlags)
       ++ map (transformFlag "libcmd") (ignoreCrossFile nixComponents.nix-cmd.mesonFlags)
+      ++ map (transformFlag "libutil-c") (ignoreCrossFile nixComponents.nix-util-c.mesonFlags)
+      ++ map (transformFlag "libstore-c") (ignoreCrossFile nixComponents.nix-store-c.mesonFlags)
+      ++ map (transformFlag "libfetchers-c") (ignoreCrossFile nixComponents.nix-fetchers-c.mesonFlags)
+      ++ map (transformFlag "libexpr-c") (ignoreCrossFile nixComponents.nix-expr-c.mesonFlags)
+      ++ map (transformFlag "libflake-c") (ignoreCrossFile nixComponents.nix-flake-c.mesonFlags)
+      ++ map (transformFlag "libmain-c") (ignoreCrossFile nixComponents.nix-main-c.mesonFlags)
       ++ map (transformFlag "nix") (ignoreCrossFile nixComponents.nix-cli.mesonFlags);
 
       nativeBuildInputs =
@@ -320,7 +316,7 @@ nixComponents.callPackage (
               pkgs.buildPackages.gnused
               modular.pre-commit.settings.package
               (pkgs.writeScriptBin "pre-commit-hooks-install" modular.pre-commit.settings.installationScript)
-              pkgs.buildPackages.nixfmt-rfc-style
+              pkgs.buildPackages.nixfmt
               pkgs.buildPackages.shellcheck
               pkgs.buildPackages.include-what-you-use
             ]
@@ -328,7 +324,7 @@ nixComponents.callPackage (
             ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform) (
               lib.hiPrio pkgs.buildPackages.clang-tools
             )
-            ++ lib.optional stdenv.hostPlatform.isLinux pkgs.buildPackages.mold-wrapped;
+            ++ lib.optional stdenv.hostPlatform.isLinux pkgs.buildPackages.mold;
         in
         # FIXME: separateDebugInfo = false doesn't actually prevent -Wa,--compress-debug-sections
         # from making its way into NIX_CFLAGS_COMPILE.
@@ -345,8 +341,7 @@ nixComponents.callPackage (
         lib.optional stdenv.hostPlatform.isUnix pkgs.gbenchmark
         ++ dedupByString (v: "${v}") (
           lib.filter (x: !isInternal x) (lib.lists.concatMap (c: c.buildInputs) activeComponents)
-        )
-        ++ lib.optional havePerl pkgs.perl;
+        );
 
       propagatedBuildInputs = dedupByString (v: "${v}") (
         lib.filter (x: !isInternal x) (lib.lists.concatMap (c: c.propagatedBuildInputs) activeComponents)
diff --git a/packaging/everything.nix b/packaging/everything.nix
index 751d861c9e80..74629d684036 100644
--- a/packaging/everything.nix
+++ b/packaging/everything.nix
@@ -41,8 +41,6 @@
   nix-internal-api-docs,
   nix-external-api-docs,
 
-  nix-perl-bindings,
-
   testers,
 
   patchedSrc ? null,
@@ -65,16 +63,7 @@ let
       nix-main-c
       nix-cmd
       ;
-  }
-  //
-    lib.optionalAttrs
-      (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
-      {
-        # Currently fails in static build
-        inherit
-          nix-perl-bindings
-          ;
-      };
+  };
 
   devdoc = buildEnv {
     name = "nix-${nix-cli.version}-devdoc";
@@ -116,7 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
   dontBuild = true;
 
   /**
-    `doCheck` controles whether tests are added as build gate for the combined package.
+    `doCheck` controls whether tests are added as build gate for the combined package.
     This includes both the unit tests and the functional tests, but not the
     integration tests that run in CI (the flake's `hydraJobs` and some of the `checks`).
   */
@@ -144,13 +133,6 @@ stdenv.mkDerivation (finalAttrs: {
     lib.optionals (stdenv.hostPlatform.isLinux && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
       [
         nix-util-tests.tests.run-without-new-syscalls
-      ]
-  ++
-    lib.optionals (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
-      [
-        # Perl currently fails in static build
-        # TODO: Split out tests into a separate derivation?
-        nix-perl-bindings
       ];
 
   nativeBuildInputs = [
diff --git a/packaging/hydra.nix b/packaging/hydra.nix
index 8f7e13c1f2ef..e30b62eb578d 100644
--- a/packaging/hydra.nix
+++ b/packaging/hydra.nix
@@ -33,7 +33,6 @@ let
   forAllPackages = forAllPackages' { };
   forAllPackages' =
     {
-      enableBindings ? false,
       enableDocs ? false, # already have separate attrs for these
     }:
     lib.genAttrs (
@@ -66,9 +65,6 @@ let
         "nix-json-schema-checks"
         "nix-clang-tidy-plugin"
       ]
-      ++ lib.optionals enableBindings [
-        "nix-perl-bindings"
-      ]
       ++ lib.optionals enableDocs [
         "nix-manual"
         "nix-manual-manpages-only"
@@ -85,7 +81,6 @@ rec {
     let
       arbitrarySystem = "x86_64-linux";
       listedPkgs = forAllPackages' {
-        enableBindings = true;
         enableDocs = true;
       } (_: null);
       actualPkgs = lib.concatMapAttrs (
@@ -176,8 +171,6 @@ rec {
             # Build without unity to catch include issues.
             withUnityBuild = false;
             nix-expr = super.nix-expr.override { enableGC = false; };
-            # Unclear how to make Perl bindings work with a dynamically linked ASAN.
-            nix-perl-bindings = null;
           }
         )
       );
@@ -201,8 +194,6 @@ rec {
         pkgs.nixComponents2.overrideScope (
           self: super: {
             withTSan = true;
-            # Dies at startup.
-            nix-perl-bindings = null;
             # TSan has issues with fork and threads.
             nix-functional-tests = super.nix-functional-tests.overrideAttrs { doCheck = false; };
           }
@@ -218,6 +209,8 @@ rec {
       tidyScope = pkgs.nixComponents2.overrideScope (
         self: super: {
           withClangTidy = true;
+          # clang-tidy doesn't seem to like unity builds.
+          withUnityBuild = false;
           # nix-everything is built via callPackage (not the layer system), so
           # enableClangTidyLayer's doCheck=false doesn't reach it. Set it here
           # so checkInputs (the *-tests.tests.run derivations) aren't pulled in.
@@ -254,9 +247,6 @@ rec {
       ) (forAllSystems (system: components.${system}.${pkgName}))
     );
 
-  # Perl bindings for various platforms.
-  perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nixComponents2.nix-perl-bindings);
-
   # Binary tarball for various platforms, containing a Nix store
   # with the closure of 'nix' package, and the second half of
   # the installation script.
@@ -296,6 +286,32 @@ rec {
     }
   );
 
+  # `NixOS/nix-installer` with this revision's Nix closure embedded.
+  rustInstaller =
+    lib.genAttrs
+      (
+        linux64BitSystems
+        ++ [
+          "x86_64-darwin"
+          "aarch64-darwin"
+        ]
+      )
+      (
+        system:
+        let
+          pkgs = nixpkgsFor.${system}.native;
+          # Embed the native (glibc) Nix even though the Linux installer
+          # binary is static/musl.
+          tarball = pkgs.callPackage ./rust-installer/tarball.nix {
+            nix = pkgs.nixComponents2.nix-everything;
+          };
+          builder = if pkgs.stdenv.hostPlatform.isLinux then pkgs.pkgsStatic else pkgs;
+        in
+        builder.callPackage ./rust-installer {
+          inherit tarball;
+        }
+      );
+
   # docker image with Nix inside
   dockerImage = lib.genAttrs linux64BitSystems (system: self.packages.${system}.dockerImage);
 
diff --git a/packaging/patches/0001-Fix-uncaught_exceptions-not-accounting-for-forced_un.patch b/packaging/patches/0001-Fix-uncaught_exceptions-not-accounting-for-forced_un.patch
new file mode 100644
index 000000000000..7ec13724c40b
--- /dev/null
+++ b/packaging/patches/0001-Fix-uncaught_exceptions-not-accounting-for-forced_un.patch
@@ -0,0 +1,102 @@
+From 5883212311535a0046031d74d1568ae173c1e35b Mon Sep 17 00:00:00 2001
+From: Sergei Zimmerman <sergei@zimmerman.foo>
+Date: Tue, 21 Jul 2026 21:15:51 +0000
+Subject: [PATCH] Fix uncaught_exceptions() not accounting for forced_unwind
+
+Unwound fibers would see std::uncaught_exceptions() == 0, while a
+forced_unwind exception is in "flight". This goes against the contract
+of std::uncaught_exceptions() that scope guards rely upon. Failing
+to report the correct number of uncaught exceptions (especially
+misreporting zero) will lead to scope guards to misbehave badly and skip
+running cleanup code which branches on whether the destructor is called
+during stack unwinding or not.
+
+This is because the "throw" would happen before the destructor is run on
+the fiber stack being switched to, but the increment would be clobbered
+by the destructor of manage_exception_state.
+
+I'm not sure what the contract of run ontop_fcontext is wrt to whether
+the the caller provided function can throw or not, but in my best
+understanding the forced_unwind mechanism is mostly internal and so is
+throwing from ontop_fcontext in the switched-to fiber. Thus, I've kept
+the catch block scoped to detail::forced_unwind.
+---
+ include/boost/context/fiber_fcontext.hpp | 37 +++++++++++++++++-------
+ test/test_fiber.cpp                      | 24 +++++++++++++++
+ 2 files changed, 51 insertions(+), 10 deletions(-)
+
+diff --git a/include/boost/context/fiber_fcontext.hpp b/include/boost/context/fiber_fcontext.hpp
+index 543ba6c..38476c9 100644
+--- a/boost/context/fiber_fcontext.hpp
++++ b/boost/context/fiber_fcontext.hpp
+@@ -70,7 +70,9 @@ namespace context {
+ namespace detail {
+ 
+ // manage_exception_state is a dummy struct unless we have specific support
+-struct manage_exception_state {};
++struct manage_exception_state {
++    void from_forced_unwind() noexcept {}
++};
+ 
+ } // namespace detail
+ } // namespace context
+@@ -90,6 +92,11 @@ public:
+     manage_exception_state() {
+         exception_state_ = *__cxa_get_globals();
+     }
++    // Hack to account for the forced_unwind exception thrown in fiber_unwind
++    // that's run ontop before the destructor.
++    void from_forced_unwind() noexcept {
++        exception_state_.uncaughtExceptions += 1;
++    }
+     ~manage_exception_state() {
+         *__cxa_get_globals() = exception_state_;
+     }
+@@ -376,13 +383,18 @@ public:
+         BOOST_ASSERT( nullptr != fctx_);
+         detail::manage_exception_state exstate;
+         boost::ignore_unused(exstate);
+-        return { detail::jump_fcontext(
++        try {
++            return { detail::jump_fcontext(
+ #if defined(BOOST_NO_CXX14_STD_EXCHANGE)
+-                    detail::exchange( fctx_, nullptr),
++                        detail::exchange( fctx_, nullptr),
+ #else
+-                    std::exchange( fctx_, nullptr),
++                        std::exchange( fctx_, nullptr),
+ #endif
+-                    nullptr).fctx };
++                        nullptr).fctx };
++        } catch ( detail::forced_unwind const& ) {
++            exstate.from_forced_unwind();
++            throw;
++        }
+     }
+ 
+     template< typename Fn >
+@@ -391,14 +403,19 @@ public:
+         detail::manage_exception_state exstate;
+         boost::ignore_unused(exstate);
+         auto p = std::forward< Fn >( fn);
+-        return { detail::ontop_fcontext(
++        try {
++            return { detail::ontop_fcontext(
+ #if defined(BOOST_NO_CXX14_STD_EXCHANGE)
+-                    detail::exchange( fctx_, nullptr),
++                        detail::exchange( fctx_, nullptr),
+ #else
+-                    std::exchange( fctx_, nullptr),
++                        std::exchange( fctx_, nullptr),
+ #endif
+-                    & p,
+-                    detail::fiber_ontop< fiber, decltype(p) >).fctx };
++                        & p,
++                        detail::fiber_ontop< fiber, decltype(p) >).fctx };
++        } catch ( detail::forced_unwind const& ) {
++            exstate.from_forced_unwind();
++            throw;
++        }
+     }
+ 
+     explicit operator bool() const noexcept {
diff --git a/packaging/release-jobs.nix b/packaging/release-jobs.nix
new file mode 100644
index 000000000000..28ee0cb4e00b
--- /dev/null
+++ b/packaging/release-jobs.nix
@@ -0,0 +1,83 @@
+# Hydra jobset containing only the artifacts consumed by
+# `maintainers/upload-release.pl`, so a release can be cut without
+# waiting on the full `hydraJobs` CI matrix.
+#
+# Evaluated as a legacy (non-flake) jobset because Hydra hard-codes flake
+# jobsets to `outputs.hydraJobs`; we re-enter the flake via
+# `builtins.getFlake` so derivations stay identical to the flake jobset
+# and share builds through the binary cache.
+#
+# Hydra jobset configuration:
+#   Identifier:      maintenance-<X.Y>-release
+#   Type:            Legacy
+#   Nix expression:  packaging/release-jobs.nix in input `src`
+#   Inputs:
+#     src  (Git checkout)  https://github.com/NixOS/nix <branch>
+{
+  src ? {
+    outPath = ./..;
+  },
+}:
+let
+  # Fetch by GitHub ref rather than the bare store path Hydra hands us,
+  # so `rev`/`lastModified` (and thus the version suffix) match the flake
+  # jobset and derivations are shared.
+  flake = builtins.getFlake (
+    if src ? rev then
+      "github:NixOS/nix/${src.rev}"
+    else
+      # Local evaluation / testing.
+      builtins.unsafeDiscardStringContext (toString src)
+  );
+  inherit (flake) hydraJobs;
+  inherit (flake.inputs.nixpkgs) lib;
+
+  jobs = {
+    # `nix-everything` per system: provides the store paths for
+    # `fallback-paths.nix` and (on x86_64-linux) the rendered manual via
+    # its `doc` output.
+    build.nix-everything = hydraJobs.build.nix-everything;
+    buildCross.nix-everything = {
+      # Only the cross targets that end up in `fallback-paths.nix`.
+      inherit (hydraJobs.buildCross.nix-everything)
+        riscv64-unknown-linux-gnu
+        x86_64-unknown-freebsd
+        ;
+    };
+
+    inherit (hydraJobs)
+      manual
+      binaryTarball
+      binaryTarballCross
+      installerScript
+      installerScriptForGHA
+      rustInstaller
+      dockerImage
+      ;
+
+    # Aggregate gating job: green ⇒ every artifact the upload script
+    # needs is available.  `upload-release` can wait on this single job
+    # instead of the whole evaluation.  Constituents are referenced by
+    # job *name* so that an evaluation failure in one of them does not
+    # take down the aggregate's own evaluation.
+    release = flake.inputs.nixpkgs.legacyPackages.x86_64-linux.releaseTools.aggregate {
+      name = "nix-release-${flake.packages.x86_64-linux.nix-everything.version}";
+      meta.description = "Artifacts required for a Nix release";
+      constituents =
+        let
+          collectJobNames =
+            prefix: x:
+            if lib.isDerivation x then
+              [ prefix ]
+            else if lib.isAttrs x then
+              lib.concatLists (
+                lib.mapAttrsToList (n: collectJobNames (if prefix == "" then n else "${prefix}.${n}")) x
+              )
+            else
+              [ ];
+        in
+        collectJobNames "" (builtins.removeAttrs jobs [ "release" ]);
+    };
+  };
+in
+jobs
diff --git a/packaging/rust-installer/default.nix b/packaging/rust-installer/default.nix
new file mode 100644
index 000000000000..98aec45e9e53
--- /dev/null
+++ b/packaging/rust-installer/default.nix
@@ -0,0 +1,88 @@
+# `NixOS/nix-installer` built with *this* Nix closure embedded, so
+# Hydra/CI can dogfood the Rust installer without the (removed)
+# `--nix-package-url` knob.
+{
+  lib,
+  stdenv,
+  buildPackages,
+  runCommand,
+  rustPlatform,
+  fetchFromGitHub,
+  tarball,
+}:
+
+let
+  installerVersion = "2.34.6";
+  src = fetchFromGitHub {
+    owner = "NixOS";
+    repo = "nix-installer";
+    tag = installerVersion;
+    hash = "sha256-aTaz8EtHexvke7tGr5MfeKy9g7AraIAFN+dPApm+fds=";
+  };
+
+  # Bare binary: no Nix closure yet.  Appended below via `pack`, so the
+  # (expensive) Rust compile is independent of the embedded Nix and
+  # stays cacheable across Nix revisions.
+  bare = rustPlatform.buildRustPackage {
+    pname = "nix-installer-bare";
+    version = installerVersion;
+
+    inherit src;
+
+    cargoHash = "sha256-/mNXkeZVuYsqd0TiUa7bzSP4xpKh0Fqga9EpasPbrzU=";
+
+    doCheck = false;
+
+    env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      # Drop the unused libiconv dylib the darwin stdenv injects; the
+      # binary must run before `/nix/store` exists.
+      NIX_LDFLAGS = "-dead_strip_dylibs";
+    };
+
+    postInstall = ''
+      install -m755 nix-installer.sh $out/bin/nix-installer.sh
+    '';
+  };
+in
+
+runCommand "nix-installer-${tarball.passthru.nixVersion}"
+  {
+    nativeBuildInputs = [
+      buildPackages.python3
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      buildPackages.darwin.sigtool
+      buildPackages.darwin.cctools
+    ];
+
+    # The appended payload contains store-path strings on purpose; don't
+    # let the reference scanner pull the whole Nix closure into this
+    # derivation's runtime closure.
+    __structuredAttrs = true;
+    unsafeDiscardReferences.out = true;
+
+    passthru = { inherit bare; };
+
+    meta = {
+      description = "Rust-based Nix installer with an embedded Nix ${tarball.passthru.nixVersion}";
+      homepage = "https://github.com/NixOS/nix-installer";
+      license = lib.licenses.lgpl21Only;
+      mainProgram = "nix-installer";
+    };
+  }
+  ''
+    mkdir -p $out/bin $out/nix-support
+
+    python3 ${src}/scripts/pack \
+      --input ${bare}/bin/nix-installer \
+      --tarball ${tarball}/nix.tar.zst \
+      --nix-store-path ${tarball.passthru.nixStorePath} \
+      --cacert-store-path ${tarball.passthru.cacertStorePath} \
+      --nix-version ${tarball.passthru.nixVersion} \
+      --output $out/bin/nix-installer
+
+    install -m755 ${bare}/bin/nix-installer.sh $out/bin/nix-installer.sh
+
+    echo "file binary-dist $out/bin/nix-installer" >> $out/nix-support/hydra-build-products
+    echo "file binary-dist $out/bin/nix-installer.sh" >> $out/nix-support/hydra-build-products
+  ''
diff --git a/packaging/rust-installer/tarball.nix b/packaging/rust-installer/tarball.nix
new file mode 100644
index 000000000000..4f236e0215bb
--- /dev/null
+++ b/packaging/rust-installer/tarball.nix
@@ -0,0 +1,50 @@
+# Zstd-compressed Nix closure in the layout expected by
+# `NixOS/nix-installer` (`include_bytes!` at build time).
+{
+  lib,
+  stdenv,
+  runCommand,
+  buildPackages,
+  zstd,
+  nix,
+  cacert,
+}:
+
+let
+  installerClosureInfo = buildPackages.closureInfo {
+    rootPaths = [
+      nix
+      cacert
+    ];
+  };
+in
+
+runCommand "nix-installer-tarball-${nix.version}"
+  {
+    nativeBuildInputs = [ zstd ];
+
+    passthru = {
+      nixStorePath = nix.outPath;
+      cacertStorePath = cacert.outPath;
+      nixVersion = nix.version;
+    };
+  }
+  ''
+    mkdir -p $out
+
+    dir=nix-${nix.version}-${stdenv.hostPlatform.system}
+
+    cp ${installerClosureInfo}/registration $TMPDIR/reginfo
+
+    tar cf - \
+      --sort=name \
+      --owner=0 --group=0 --mode=u+rw,uga+r \
+      --mtime='1970-01-01' \
+      --absolute-names \
+      --hard-dereference \
+      --transform "s,$TMPDIR/reginfo,$dir/.reginfo," \
+      --transform "s,$NIX_STORE,$dir/store,S" \
+      $TMPDIR/reginfo \
+      $(cat ${installerClosureInfo}/store-paths) \
+      | zstd -19 -T1 -o $out/nix.tar.zst
+  ''
diff --git a/scripts/create-darwin-volume.sh b/scripts/create-darwin-volume.sh
index 7a61764d4f33..538a5e74d5ee 100755
--- a/scripts/create-darwin-volume.sh
+++ b/scripts/create-darwin-volume.sh
@@ -832,8 +832,8 @@ EOF
         # TODO: should probably alert the user if this is disabled?
         _sudo "to launch the Nix volume mounter" \
             launchctl bootstrap system "$NIX_VOLUME_MOUNTD_DEST" || true
-        # TODO: confirm whether kickstart is necessesary?
-        # I feel a little superstitous, but it can guard
+        # TODO: confirm whether kickstart is necessary?
+        # I feel a little superstitious, but it can guard
         # against multiple problems (doesn't start, old
         # version still running for some reason...)
         _sudo "to launch the Nix volume mounter" \
diff --git a/scripts/install-multi-user.sh b/scripts/install-multi-user.sh
index d4ea88b5ea6c..ae6625e1bc41 100644
--- a/scripts/install-multi-user.sh
+++ b/scripts/install-multi-user.sh
@@ -270,7 +270,7 @@ _diff() {
         printf -v CHANGED_GROUP_FORMAT "%b" "${GREEN}%>${RED}%<${ESC}"
         diff --changed-group-format="$CHANGED_GROUP_FORMAT" "$@"
     else
-    # simple colorized diff comatible w/ pre `--color` versions
+    # simple colorized diff compatible w/ pre `--color` versions
         diff --unchanged-group-format="$_UNCHANGED_GRP_FMT" --old-line-format="$_OLD_LINE_FMT" --new-line-format="$_NEW_LINE_FMT" --unchanged-line-format="  %L" "$@"
     fi
 }
@@ -961,7 +961,7 @@ configure_shell_profile() {
 cert_in_store() {
     # in a subshell
     # - change into the cert-file dir
-    # - get the phyiscal pwd
+    # - get the physical pwd
     # and test if this path is in the Nix store
     [[ "$(cd -- "$(dirname "$NIX_SSL_CERT_FILE")" && exec pwd -P)" == "$NIX_ROOT/store/"* ]]
 }
diff --git a/scripts/install-nix-from-tarball.sh b/scripts/install-nix-from-tarball.sh
index f17e4c2af3b9..73f389b6ff16 100644
--- a/scripts/install-nix-from-tarball.sh
+++ b/scripts/install-nix-from-tarball.sh
@@ -28,14 +28,15 @@ fi
 
 OS="$(uname -s)"
 
-# macOS support for 10.12.6 or higher
+# Since nixpkgs 25.11 the minimum deployment target is macOS 14.0
 if [ "$OS" = "Darwin" ]; then
+    # shellcheck disable=SC2034
     IFS='.' read -r macos_major macos_minor macos_patch << EOF
 $(sw_vers -productVersion)
 EOF
-    if [ "$macos_major" -lt 10 ] || { [ "$macos_major" -eq 10 ] && [ "$macos_minor" -lt 12 ]; } || { [ "$macos_minor" -eq 12 ] && [ "$macos_patch" -lt 6 ]; }; then
+    if [ "$macos_major" -lt 14 ]; then
         # patch may not be present; command substitution for simplicity
-        echo "$0: macOS $(sw_vers -productVersion) is not supported, upgrade to 10.12.6 or higher"
+        echo "$0: macOS $(sw_vers -productVersion) is not supported, upgrade to 14.0 or higher"
         exit 1
     fi
 fi
diff --git a/scripts/nix-profile-daemon.fish.in b/scripts/nix-profile-daemon.fish.in
index 1a20dffd2459..93cb3c45a55b 100644
--- a/scripts/nix-profile-daemon.fish.in
+++ b/scripts/nix-profile-daemon.fish.in
@@ -53,7 +53,7 @@ end
 
 # Set up environment.
 # This part should be kept in sync with nixpkgs:nixos/modules/programs/environment.nix
-set --export NIX_PROFILES "@localstatedir@/nix/profiles/default $HOME/.nix-profile"
+set --export NIX_PROFILES "@localstatedir@/nix/profiles/default $NIX_LINK"
 
 # Populate bash completions, .desktop files, etc
 if test -z "$XDG_DATA_DIRS"
diff --git a/scripts/nix-profile.fish.in b/scripts/nix-profile.fish.in
index abf716cec6fc..201a56438950 100644
--- a/scripts/nix-profile.fish.in
+++ b/scripts/nix-profile.fish.in
@@ -58,7 +58,7 @@ end
 
 # Set up environment.
 # This part should be kept in sync with nixpkgs:nixos/modules/programs/environment.nix
-set --export NIX_PROFILES "@localstatedir@/nix/profiles/default $HOME/.nix-profile"
+set --export NIX_PROFILES "@localstatedir@/nix/profiles/default $NIX_LINK"
 
 # Populate bash completions, .desktop files, etc
 if test -z "$XDG_DATA_DIRS"
diff --git a/src/clang-tidy-plugin/meson.build b/src/clang-tidy-plugin/meson.build
index 60cfd1514912..150e8aafcc3e 100644
--- a/src/clang-tidy-plugin/meson.build
+++ b/src/clang-tidy-plugin/meson.build
@@ -6,7 +6,7 @@ project(
     'cpp_std=c++23',
     'warning_level=2',
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -20,6 +20,7 @@ llvm_dep = dependency('LLVM', version : '>= 16', required : true)
 
 sources = files(
   'nix-clang-tidy-checks.cc',
+  'nix-using-namespace.cc',
 )
 
 # Build as a shared module (plugin) that can be loaded by clang-tidy --load
diff --git a/src/clang-tidy-plugin/nix-clang-tidy-checks.cc b/src/clang-tidy-plugin/nix-clang-tidy-checks.cc
index 64ec63c2d319..bf69e7f1154f 100644
--- a/src/clang-tidy-plugin/nix-clang-tidy-checks.cc
+++ b/src/clang-tidy-plugin/nix-clang-tidy-checks.cc
@@ -13,22 +13,19 @@
 #include <clang-tidy/ClangTidyModule.h>
 #include <clang-tidy/ClangTidyModuleRegistry.h>
 
-namespace nix::clang_tidy {
+#include "nix-using-namespace.hh"
 
-using namespace clang;
-using namespace clang::tidy;
+namespace nix::clang_tidy {
 
-class NixClangTidyChecks : public ClangTidyModule
+class NixClangTidyChecks : public clang::tidy::ClangTidyModule
 {
 public:
-    void addCheckFactories([[maybe_unused]] ClangTidyCheckFactories & CheckFactories) override
+    void addCheckFactories([[maybe_unused]] clang::tidy::ClangTidyCheckFactories & CheckFactories) override
     {
-        // Custom checks will be registered here.
-        // Example:
-        // CheckFactories.registerCheck<MyCustomCheck>("nix-my-custom-check");
+        CheckFactories.registerCheck<UsingNamespaceInNamespaceScopeCheck>("nix-using-namespace");
     }
 };
 
-static ClangTidyModuleRegistry::Add<NixClangTidyChecks> X("nix-module", "Adds Nix-specific checks");
+static clang::tidy::ClangTidyModuleRegistry::Add<NixClangTidyChecks> X("nix-module", "Adds Nix-specific checks");
 
 } // namespace nix::clang_tidy
diff --git a/src/clang-tidy-plugin/nix-using-namespace.cc b/src/clang-tidy-plugin/nix-using-namespace.cc
new file mode 100644
index 000000000000..69e1fdf73a84
--- /dev/null
+++ b/src/clang-tidy-plugin/nix-using-namespace.cc
@@ -0,0 +1,26 @@
+#include "nix-using-namespace.hh"
+
+#include <clang/ASTMatchers/ASTMatchFinder.h>
+#include <clang/ASTMatchers/ASTMatchers.h>
+
+namespace nix::clang_tidy {
+
+void UsingNamespaceInNamespaceScopeCheck::registerMatchers(clang::ast_matchers::MatchFinder * Finder)
+{
+    Finder->addMatcher(clang::ast_matchers::usingDirectiveDecl().bind("usingNamespace"), this);
+}
+
+void UsingNamespaceInNamespaceScopeCheck::check(const clang::ast_matchers::MatchFinder::MatchResult & Result)
+{
+    const auto * U = Result.Nodes.getNodeAs<clang::UsingDirectiveDecl>("usingNamespace");
+    const clang::SourceLocation Loc = U->getBeginLoc();
+    if (U->isImplicit() || !Loc.isValid() || U->getParentFunctionOrMethod())
+        return;
+
+    diag(
+        Loc,
+        "do not use using namespace directive in namespace scopes - keep those local to functions or explicitly qualify names."
+        "This is to reduce namespace pollution with unity builds.");
+}
+
+} // namespace nix::clang_tidy
diff --git a/src/clang-tidy-plugin/nix-using-namespace.hh b/src/clang-tidy-plugin/nix-using-namespace.hh
new file mode 100644
index 000000000000..48cc3ebcb5f2
--- /dev/null
+++ b/src/clang-tidy-plugin/nix-using-namespace.hh
@@ -0,0 +1,36 @@
+#pragma once
+
+#include <clang-tidy/ClangTidyCheck.h>
+
+namespace nix::clang_tidy {
+
+/**
+ * Check that forbids instances on `using namespace ...;` in a namespace
+ * scope.
+ *
+ * This is because we rely on unity builds in certain situations (faster
+ * non-incremental builds, static initialiser issues), and the common pattern of
+ * doing `using namespace` in a translation unit is a big footgun.
+ *
+ * Based on `google-build-using-namespace`, modulo that `using namespace` in a
+ * non-namespace scope is fine (like in a function).
+ */
+class UsingNamespaceInNamespaceScopeCheck : public clang::tidy::ClangTidyCheck
+{
+public:
+    UsingNamespaceInNamespaceScopeCheck(llvm::StringRef Name, clang::tidy::ClangTidyContext * Context)
+        : ClangTidyCheck(Name, Context)
+    {
+    }
+
+    bool isLanguageVersionSupported(const clang::LangOptions & LangOpts) const override
+    {
+        return LangOpts.CPlusPlus;
+    }
+
+    void registerMatchers(clang::ast_matchers::MatchFinder * Finder) override;
+
+    void check(const clang::ast_matchers::MatchFinder::MatchResult & Result) override;
+};
+
+} // namespace nix::clang_tidy
diff --git a/src/external-api-docs/meson.build b/src/external-api-docs/meson.build
index 1903b36e589b..d96da3863e6f 100644
--- a/src/external-api-docs/meson.build
+++ b/src/external-api-docs/meson.build
@@ -1,7 +1,7 @@
 project(
   'nix-external-api-docs',
   version : files('.version'),
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
diff --git a/src/internal-api-docs/meson.build b/src/internal-api-docs/meson.build
index 844cb262ee38..3976e4c3f81a 100644
--- a/src/internal-api-docs/meson.build
+++ b/src/internal-api-docs/meson.build
@@ -1,7 +1,7 @@
 project(
   'nix-internal-api-docs',
   version : files('.version'),
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
diff --git a/src/json-schema-checks/meson.build b/src/json-schema-checks/meson.build
index 8a0bde04b8ed..66dc9b758a44 100644
--- a/src/json-schema-checks/meson.build
+++ b/src/json-schema-checks/meson.build
@@ -6,7 +6,7 @@
 project(
   'nix-json-schema-checks',
   version : files('.version'),
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
diff --git a/src/libcmd/built-path.cc b/src/libcmd/built-path.cc
index 2c52678105f4..dd8d8a0f7e36 100644
--- a/src/libcmd/built-path.cc
+++ b/src/libcmd/built-path.cc
@@ -1,4 +1,5 @@
 #include "nix/cmd/built-path.hh"
+#include "nix/store/build-result.hh"
 #include "nix/store/derivations.hh"
 #include "nix/store/store-api.hh"
 #include "nix/store/outputs-query.hh"
@@ -124,4 +125,50 @@ RealisedPath::Set BuiltPath::toRealisedPaths(Store & store) const
     return res;
 }
 
+SingleBuiltPath getBuiltPath(ref<Store> evalStore, ref<Store> store, const SingleDerivedPath & b)
+{
+    return std::visit(
+        overloaded{
+            [&](const SingleDerivedPath::Opaque & bo) -> SingleBuiltPath { return SingleBuiltPath::Opaque{bo.path}; },
+            [&](const SingleDerivedPath::Built & bfd) -> SingleBuiltPath {
+                auto drvPath = getBuiltPath(evalStore, store, *bfd.drvPath);
+                // Resolving this instead of `bfd` will yield the same result, but avoid duplicative work.
+                SingleDerivedPath::Built truncatedBfd{
+                    .drvPath = makeConstantStorePathRef(drvPath.outPath()),
+                    .output = bfd.output,
+                };
+                auto outputPath = resolveDerivedPath(*store, truncatedBfd, &*evalStore);
+                return SingleBuiltPath::Built{
+                    .drvPath = make_ref<SingleBuiltPath>(std::move(drvPath)),
+                    .output = {bfd.output, outputPath},
+                };
+            },
+        },
+        b.raw());
+}
+
+BuiltPath toBuiltPath(KeyedBuildResult & result, ref<Store> evalStore, ref<Store> store)
+{
+    auto success = result.tryGetSuccess();
+    assert(success);
+    return std::visit(
+        overloaded{
+            [&](const DerivedPath::Built & bfd) {
+                std::map<std::string, StorePath> outputs;
+                for (auto & [outputName, realisation] : success->builtOutputs)
+                    outputs.emplace(outputName, realisation.outPath);
+                BuiltPath bp = BuiltPath::Built{
+                    .drvPath = make_ref<SingleBuiltPath>(getBuiltPath(evalStore, store, *bfd.drvPath)),
+                    .outputs = outputs,
+                };
+                return bp;
+            },
+            [&](const DerivedPath::Opaque & bo) {
+                BuiltPath bp = BuiltPath::Opaque{bo.path};
+                return bp;
+            },
+        },
+        result.path.raw());
+}
+
 } // namespace nix
diff --git a/src/libcmd/command.cc b/src/libcmd/command.cc
index d57b76411328..821c9e0565cd 100644
--- a/src/libcmd/command.cc
+++ b/src/libcmd/command.cc
@@ -440,9 +440,34 @@ void createOutLinks(const std::filesystem::path & outLink, const BuiltPaths & bu
 
 void MixOutLinkBase::createOutLinksMaybe(const std::vector<BuiltPathWithResult> & buildables, ref<Store> & store)
 {
-    if (outLink != "")
+    createOutLinksMaybe(toBuiltPaths(buildables), store);
+}
+
+void MixOutLinkBase::createOutLinksMaybe(const BuiltPaths & paths, ref<Store> & store)
+{
+    if (outLink)
         if (auto store2 = store.dynamic_pointer_cast<LocalFSStore>())
-            createOutLinks(outLink, toBuiltPaths(buildables), *store2);
+            createOutLinks(*outLink, paths, *store2);
+}
+
+void MixPrintOutPaths::printOutPathsMaybe(const BuiltPaths & paths, ref<Store> store)
+{
+    if (!printOutputPaths)
+        return;
+
+    logger->stop();
+    for (auto & path : paths) {
+        std::visit(
+            overloaded{
+                [&](const BuiltPath::Opaque & bo) { logger->cout(store->printStorePath(bo.path)); },
+                [&](const BuiltPath::Built & bfd) {
+                    for (auto & output : bfd.outputs) {
+                        logger->cout(store->printStorePath(output.second));
+                    }
+                },
+            },
+            path);
+    }
 }
 
 } // namespace nix
diff --git a/src/libcmd/common-eval-args.cc b/src/libcmd/common-eval-args.cc
index 984bed34882e..f60c49d5e682 100644
--- a/src/libcmd/common-eval-args.cc
+++ b/src/libcmd/common-eval-args.cc
@@ -150,7 +150,7 @@ MixEvalArgs::MixEvalArgs()
     });
 }
 
-Bindings * MixEvalArgs::getAutoArgs(EvalState & state)
+const Bindings * MixEvalArgs::getAutoArgs(EvalState & state)
 {
     auto res = state.buildBindings(autoArgs.size());
     for (auto & [name, arg] : autoArgs) {
diff --git a/src/libcmd/include/nix/cmd/built-path.hh b/src/libcmd/include/nix/cmd/built-path.hh
index d41529e5ac4f..34761ee02dc8 100644
--- a/src/libcmd/include/nix/cmd/built-path.hh
+++ b/src/libcmd/include/nix/cmd/built-path.hh
@@ -105,4 +105,10 @@ struct BuiltPath : _BuiltPathRaw
 
 typedef std::vector<BuiltPath> BuiltPaths;
 
+SingleBuiltPath getBuiltPath(ref<Store> evalStore, ref<Store> store, const SingleDerivedPath & b);
+
+struct KeyedBuildResult;
+
+BuiltPath toBuiltPath(KeyedBuildResult & result, ref<Store> evalStore, ref<Store> store);
+
 } // namespace nix
diff --git a/src/libcmd/include/nix/cmd/command.hh b/src/libcmd/include/nix/cmd/command.hh
index fc67a60b5b8a..92fd032de0cd 100644
--- a/src/libcmd/include/nix/cmd/command.hh
+++ b/src/libcmd/include/nix/cmd/command.hh
@@ -407,13 +407,16 @@ void createOutLinks(const std::filesystem::path & outLink, const BuiltPaths & bu
 struct MixOutLinkBase : virtual Args
 {
     /** Prefix for any output symlinks. Empty means do not write an output symlink. */
-    std::filesystem::path outLink;
+    std::optional<std::filesystem::path> outLink = std::nullopt;
 
-    MixOutLinkBase(const std::string & defaultOutLink)
+    MixOutLinkBase(const std::optional<std::filesystem::path> & defaultOutLink)
         : outLink(defaultOutLink)
     {
     }
 
+    /** underlying function */
+    void createOutLinksMaybe(const BuiltPaths & paths, ref<Store> & store);
+    /** smaller wrapper for convenience (historically this was the only one) */
     void createOutLinksMaybe(const std::vector<BuiltPathWithResult> & buildables, ref<Store> & store);
 };
 
@@ -435,9 +438,25 @@ struct MixOutLinkByDefault : MixOutLinkBase, virtual Args
         addFlag({
             .longName = "no-link",
             .description = "Do not create symlinks to the build results.",
-            .handler = {&outLink, std::filesystem::path{}},
+            .handler = {[&] { outLink = std::nullopt; }},
         });
     }
 };
 
+struct MixPrintOutPaths : virtual Args
+{
+    bool printOutputPaths = false;
+
+    MixPrintOutPaths()
+    {
+        addFlag({
+            .longName = "print-out-paths",
+            .description = "Print the resulting output paths",
+            .handler = {&printOutputPaths, true},
+        });
+    }
+
+    void printOutPathsMaybe(const BuiltPaths & paths, ref<Store> store);
+};
+
 } // namespace nix
diff --git a/src/libcmd/include/nix/cmd/common-eval-args.hh b/src/libcmd/include/nix/cmd/common-eval-args.hh
index 14897158ae6d..c265c834fb61 100644
--- a/src/libcmd/include/nix/cmd/common-eval-args.hh
+++ b/src/libcmd/include/nix/cmd/common-eval-args.hh
@@ -52,7 +52,7 @@ struct MixEvalArgs : virtual Args, virtual MixRepair
 
     MixEvalArgs();
 
-    Bindings * getAutoArgs(EvalState & state);
+    const Bindings * getAutoArgs(EvalState & state);
 
     LookupPath lookupPath;
 
diff --git a/src/libcmd/include/nix/cmd/markdown.hh b/src/libcmd/include/nix/cmd/markdown.hh
index 95a59c2aa7b9..716b87b87eef 100644
--- a/src/libcmd/include/nix/cmd/markdown.hh
+++ b/src/libcmd/include/nix/cmd/markdown.hh
@@ -1,6 +1,7 @@
 #pragma once
 ///@file
 
+#include <string>
 #include <string_view>
 
 namespace nix {
diff --git a/src/libcmd/include/nix/cmd/repl-interacter.hh b/src/libcmd/include/nix/cmd/repl-interacter.hh
index 7cba481059c9..9b9a03c3e423 100644
--- a/src/libcmd/include/nix/cmd/repl-interacter.hh
+++ b/src/libcmd/include/nix/cmd/repl-interacter.hh
@@ -1,8 +1,10 @@
 #pragma once
 /// @file
 
+#include "nix/util/file-descriptor.hh"
 #include "nix/util/finally.hh"
 #include "nix/util/fun.hh"
+#include "nix/util/terminal.hh"
 #include "nix/util/types.hh"
 #include <filesystem>
 #include <functional>
@@ -39,6 +41,8 @@ public:
 class ReadlineLikeInteracter : public virtual ReplInteracter
 {
     std::filesystem::path historyFile;
+    bool isInteractive = nix::isTTY(getStandardInput());
+
 public:
     ReadlineLikeInteracter(std::filesystem::path historyFile)
         : historyFile(std::move(historyFile))
diff --git a/src/libcmd/include/nix/cmd/repl.hh b/src/libcmd/include/nix/cmd/repl.hh
index 81c7b8df5a2d..5966a56a9574 100644
--- a/src/libcmd/include/nix/cmd/repl.hh
+++ b/src/libcmd/include/nix/cmd/repl.hh
@@ -9,7 +9,7 @@ namespace nix {
 struct AbstractNixRepl
 {
     ref<EvalState> state;
-    Bindings * autoArgs;
+    const Bindings * autoArgs;
 
     AbstractNixRepl(ref<EvalState> state)
         : state(state)
diff --git a/src/libcmd/include/nix/cmd/unix-socket-server.hh b/src/libcmd/include/nix/cmd/unix-socket-server.hh
index 7a0d9fa79317..e01475104b5a 100644
--- a/src/libcmd/include/nix/cmd/unix-socket-server.hh
+++ b/src/libcmd/include/nix/cmd/unix-socket-server.hh
@@ -55,6 +55,13 @@ struct ServeUnixSocketOptions
     mode_t socketMode = 0666;
 
 #ifndef _WIN32
+    /**
+     * Name of the socket for socket activation, as included in `LISTEN_FDNAMES`
+     * Ordinarily the name of the socket unit, e.g. `nix-daemon.socket`
+     * If this field is empty, no name filtering will be performed.
+     */
+    std::string activationName = "";
+
     /**
      * Additional file descriptor to poll. Useful for doing a self-pipe trick
      * https://cr.yp.to/docs/selfpipe.html.
@@ -68,6 +75,8 @@ struct ServeUnixSocketOptions
 #endif
 };
 
+MakeError(AbortServeSocket, BaseError);
+
 /**
  * Run a server loop that accepts connections and calls the handler for each.
  *
@@ -83,6 +92,7 @@ struct ServeUnixSocketOptions
  *
  * This function never returns normally. It runs until interrupted
  * (e.g., via SIGINT), at which point it throws `Interrupted`.
+ * Can be explicitly exited by throwing AbortServeSocket.
  *
  * @param options Configuration for the server.
  * @param handler Callback invoked for each accepted connection.
diff --git a/src/libcmd/installable-attr-path.cc b/src/libcmd/installable-attr-path.cc
index aa5da2e56646..d2d696c5cb8d 100644
--- a/src/libcmd/installable-attr-path.cc
+++ b/src/libcmd/installable-attr-path.cc
@@ -43,7 +43,7 @@ DerivedPathsWithInfo InstallableAttrPath::toDerivedPaths()
         return {*derivedPathWithInfo};
     }
 
-    Bindings & autoArgs = *cmd.getAutoArgs(*state);
+    const Bindings & autoArgs = *cmd.getAutoArgs(*state);
 
     PackageInfos packageInfos;
     getDerivations(*state, *v, "", autoArgs, packageInfos, false);
diff --git a/src/libcmd/installable-flake.cc b/src/libcmd/installable-flake.cc
index 1ef34a1ce014..5517f2d9741e 100644
--- a/src/libcmd/installable-flake.cc
+++ b/src/libcmd/installable-flake.cc
@@ -6,6 +6,7 @@
 #include "nix/cmd/common-eval-args.hh"
 #include "nix/expr/eval-inline.hh"
 #include "nix/expr/eval.hh"
+#include "nix/expr/eval-error.hh"
 #include "nix/flake/flake.hh"
 #include "nix/expr/eval-cache.hh"
 
@@ -159,11 +160,16 @@ std::vector<ref<eval_cache::AttrCursor>> InstallableFlake::getCursors(EvalState
     for (auto & attrPath : attrPaths) {
         debug("trying flake output attribute '%s'", attrPath);
 
-        auto attr = root->findAlongAttrPath(AttrPath::parse(state, attrPath));
-        if (attr) {
-            res.push_back(ref(*attr));
-        } else {
-            suggestions += attr.getSuggestions();
+        try {
+            auto attr = root->findAlongAttrPath(AttrPath::parse(state, attrPath));
+            if (attr) {
+                res.push_back(ref(*attr));
+            } else {
+                suggestions += attr.getSuggestions();
+            }
+        } catch (TypeError & e) {
+            debug("error resolving attribute '%s': %s", attrPath, e.msg());
+            // Continue to next attribute path
         }
     }
 
diff --git a/src/libcmd/installable-value.cc b/src/libcmd/installable-value.cc
index 3a167af3db49..92811c1d01da 100644
--- a/src/libcmd/installable-value.cc
+++ b/src/libcmd/installable-value.cc
@@ -54,8 +54,11 @@ InstallableValue::trySinglePathToDerivedPaths(Value & v, const PosIdx pos, std::
     }
 
     else if (v.type() == nString) {
+        auto path = state->coerceToSingleDerivedPath(pos, v, errorCtx);
+        if (auto o = std::get_if<SingleDerivedPath::Opaque>(&path.raw()))
+            state->ensureLazyPathCopied(o->path);
         return {{
-            .path = DerivedPath::fromSingle(state->coerceToSingleDerivedPath(pos, v, errorCtx)),
+            .path = DerivedPath::fromSingle(path),
             .info = make_ref<ExtraPathInfo>(),
         }};
     }
diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index a25971ad7f89..6c0de1d8966a 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -1,3 +1,4 @@
+#include "nix/cmd/built-path.hh"
 #include "nix/store/globals.hh"
 #include "nix/cmd/installables.hh"
 #include "nix/cmd/installable-derived-path.hh"
@@ -14,6 +15,7 @@
 #include "nix/expr/eval.hh"
 #include "nix/expr/eval-settings.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/build.hh"
 #include "nix/main/shared.hh"
 #include "nix/flake/flake.hh"
 #include "nix/expr/eval-cache.hh"
@@ -535,28 +537,6 @@ ref<Installable> SourceExprCommand::parseInstallable(ref<Store> store, const std
     return installables.front();
 }
 
-static SingleBuiltPath getBuiltPath(ref<Store> evalStore, ref<Store> store, const SingleDerivedPath & b)
-{
-    return std::visit(
-        overloaded{
-            [&](const SingleDerivedPath::Opaque & bo) -> SingleBuiltPath { return SingleBuiltPath::Opaque{bo.path}; },
-            [&](const SingleDerivedPath::Built & bfd) -> SingleBuiltPath {
-                auto drvPath = getBuiltPath(evalStore, store, *bfd.drvPath);
-                // Resolving this instead of `bfd` will yield the same result, but avoid duplicative work.
-                SingleDerivedPath::Built truncatedBfd{
-                    .drvPath = makeConstantStorePathRef(drvPath.outPath()),
-                    .output = bfd.output,
-                };
-                auto outputPath = resolveDerivedPath(*store, truncatedBfd, &*evalStore);
-                return SingleBuiltPath::Built{
-                    .drvPath = make_ref<SingleBuiltPath>(std::move(drvPath)),
-                    .output = {bfd.output, outputPath},
-                };
-            },
-        },
-        b.raw());
-}
-
 std::vector<BuiltPathWithResult> Installable::build(
     ref<Store> evalStore, ref<Store> store, Realise mode, const Installables & installables, BuildMode bMode)
 {
@@ -652,36 +632,18 @@ std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> Installable::build
         if (settings.printMissing)
             printMissing(store, pathsToBuild, lvlInfo);
 
-        auto buildResults = store->buildPathsWithResults(pathsToBuild, bMode, evalStore);
+        auto buildResults = store->getBuilder(evalStore)->buildPathsWithResults(pathsToBuild, bMode);
         throwBuildErrors(buildResults, *store);
         for (auto & buildResult : buildResults) {
-            // If we didn't throw, they must all be sucesses
-            auto & success = std::get<nix::BuildResult::Success>(buildResult.inner);
             for (auto & aux : backmap[buildResult.path]) {
-                std::visit(
-                    overloaded{
-                        [&](const DerivedPath::Built & bfd) {
-                            std::map<std::string, StorePath> outputs;
-                            for (auto & [outputName, realisation] : success.builtOutputs)
-                                outputs.emplace(outputName, realisation.outPath);
-                            res.push_back(
-                                {aux.installable,
-                                 {.path =
-                                      BuiltPath::Built{
-                                          .drvPath =
-                                              make_ref<SingleBuiltPath>(getBuiltPath(evalStore, store, *bfd.drvPath)),
-                                          .outputs = outputs,
-                                      },
-                                  .info = aux.info,
-                                  .result = buildResult}});
-                        },
-                        [&](const DerivedPath::Opaque & bo) {
-                            res.push_back(
-                                {aux.installable,
-                                 {.path = BuiltPath::Opaque{bo.path}, .info = aux.info, .result = buildResult}});
-                        },
+                res.push_back({
+                    aux.installable,
+                    BuiltPathWithResult{
+                        .path = toBuiltPath(buildResult, evalStore, store),
+                        .info = aux.info,
+                        .result = buildResult,
                     },
-                    buildResult.path.raw());
+                });
             }
         }
 
diff --git a/src/libcmd/meson.build b/src/libcmd/meson.build
index d970a8e4b066..9638b491f2c4 100644
--- a/src/libcmd/meson.build
+++ b/src/libcmd/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
diff --git a/src/libcmd/repl-interacter.cc b/src/libcmd/repl-interacter.cc
index 81240af7f547..5f2417dc1331 100644
--- a/src/libcmd/repl-interacter.cc
+++ b/src/libcmd/repl-interacter.cc
@@ -203,8 +203,25 @@ bool ReadlineLikeInteracter::getLine(std::string & input, ReplPromptType promptT
 
     setupSignals();
 #endif
-    char * s = readline(promptForType(promptType));
-    Finally doFree([&]() { free(s); });
+
+    /* Buffer for the non-interactive input. */
+    std::string buffer;
+    const char * s = nullptr;
+    char * rl = nullptr;
+
+    /* Use plain std::getline for non-interactive mode, which we also use for
+       testing purposes. readline/editline seem to disagree too much about how
+       to handle final prompts etc., so it's easier to bypass those. The tests
+       are mostly about testing the core repl logic, not input handling. */
+    if (isInteractive) {
+        rl = ::readline(promptForType(promptType));
+        s = rl;
+    } else {
+        s = std::getline(std::cin, buffer) ? buffer.c_str() : nullptr;
+    }
+
+    Finally doFree([&]() { ::free(rl); });
+
 #ifndef _WIN32 // TODO use more signals.hh for this
     restoreSignals();
 #endif
@@ -215,15 +232,12 @@ bool ReadlineLikeInteracter::getLine(std::string & input, ReplPromptType promptT
         return true;
     }
 
-    // editline doesn't echo the input to the output when non-interactive, unlike readline
-    // this results in a different behavior when running tests. The echoing is
-    // quite useful for reading the test output, so we add it here.
+    /* Echo the prompt into the output if run in non-interactive mode, somewhat
+       for the purposes of characterisation tests. */
     if (auto e = getEnv("_NIX_TEST_REPL_ECHO"); s && e && *e == "1") {
-#if !USE_READLINE
         // This is probably not right for multi-line input, but we don't use that
         // in the characterisation tests, so it's fine.
         std::cout << promptForType(promptType) << s << std::endl;
-#endif
     }
 
     if (!s)
diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index 777fc33256ca..ed35988368d8 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -26,6 +26,7 @@
 #include "nix/util/finally.hh"
 #include "nix/cmd/markdown.hh"
 #include "nix/store/local-fs-store.hh"
+#include "nix/store/build.hh"
 #include "nix/expr/print.hh"
 #include "nix/util/ref.hh"
 #include "nix/expr/value.hh"
@@ -161,7 +162,24 @@ static std::ostream & showDebugTrace(std::ostream & out, const PosTable & positi
     return out;
 }
 
-MakeError(IncompleteReplExpr, ParseError);
+/**
+ * Thrown when the REPL's own input is incomplete (e.g. unclosed multi-line
+ * string or open parenthesis). The mainLoop catches this to prompt for
+ * continuation lines instead of showing an error.
+ *
+ * Only parseString and parseReplBindings may throw this. Evaluation can also
+ * produce "unexpected end of file" ParseErrors (e.g. `import ./broken.nix`),
+ * but those must be reported as errors, not trigger continuation. The
+ * exception subtype is what distinguishes the two cases.
+ */
+MakeError(IncompleteReplExpr, Error);
+
+static bool isIncompleteInput(const ParseError & e)
+{
+    return e.msg().find("unexpected end of file") != std::string::npos;
+}
+
+void IncompleteReplExpr::anchor() {}
 
 static bool isFirstRepl = true;
 
@@ -531,7 +549,7 @@ ProcessLineResult NixRepl::processLine(std::string line)
         std::string drvPathRaw = state->store->printStorePath(drvPath);
 
         if (command == ":b" || command == ":bl") {
-            state->store->buildPaths({
+            state->store->getBuilder()->buildPaths({
                 DerivedPath::Built{
                     .drvPath = makeConstantStorePathRef(drvPath),
                     .outputs = OutputsSpec::All{},
@@ -660,11 +678,7 @@ ProcessLineResult NixRepl::processLine(std::string line)
 
     else {
         // Try parsing as bindings first (handles `x = 1`, `inherit ...`, etc.)
-        ExprAttrs * bindings = nullptr;
-        try {
-            bindings = parseReplBindings(line);
-        } catch (ParseError &) {
-        }
+        ExprAttrs * bindings = parseReplBindings(line);
 
         if (bindings) {
             Env * inheritEnv = bindings->inheritFromExprs ? bindings->buildInheritFromEnv(*state, *env) : nullptr;
@@ -688,12 +702,13 @@ ProcessLineResult NixRepl::processLine(std::string line)
 
 void NixRepl::loadFile(const std::filesystem::path & path)
 {
-    loadedFiles.remove(path);
-    loadedFiles.push_back(path);
     Value v, v2;
     state->evalFile(lookupFileArg(*state, path.string()), v);
     state->autoCallFunction(*autoArgs, v, v2);
     addAttrsToScope(v2);
+    // Remember for :reload only on success.
+    loadedFiles.remove(path);
+    loadedFiles.push_back(path);
 }
 
 void NixRepl::loadFlake(const std::string & flakeRefS)
@@ -701,9 +716,6 @@ void NixRepl::loadFlake(const std::string & flakeRefS)
     if (flakeRefS.empty())
         throw Error("cannot use ':load-flake' without a path specified. (Use '.' for the current working directory.)");
 
-    loadedFlakes.remove(flakeRefS);
-    loadedFlakes.push_back(flakeRefS);
-
     std::filesystem::path cwd;
     try {
         cwd = std::filesystem::current_path();
@@ -730,6 +742,10 @@ void NixRepl::loadFlake(const std::string & flakeRefS)
             }),
         v);
     addAttrsToScope(v);
+
+    // Remember for :reload only on success.
+    loadedFlakes.remove(flakeRefS);
+    loadedFlakes.push_back(flakeRefS);
 }
 
 void NixRepl::initEnv()
@@ -772,28 +788,44 @@ void NixRepl::reloadFilesAndFlakes()
 
 void NixRepl::loadFiles()
 {
-    decltype(loadedFiles) old = loadedFiles;
-    loadedFiles.clear();
+    // loadFile() rebuilds loadedFiles; keep failed entries and continue.
+    decltype(loadedFiles) old;
+    std::swap(old, loadedFiles);
 
     for (auto & i : old) {
         notice("Loading %1%...", PathFmt(i));
-        loadFile(i);
+        try {
+            loadFile(i);
+        } catch (Error & e) {
+            loadedFiles.push_back(i);
+            printMsg(lvlError, e.msg());
+        }
     }
 
     for (auto & [i, what] : getValues()) {
         notice("Loading installable '%1%'...", what);
-        addAttrsToScope(*i);
+        try {
+            addAttrsToScope(*i);
+        } catch (Error & e) {
+            printMsg(lvlError, e.msg());
+        }
     }
 }
 
 void NixRepl::loadFlakes()
 {
-    Strings old = loadedFlakes;
-    loadedFlakes.clear();
+    // See loadFiles().
+    Strings old;
+    std::swap(old, loadedFlakes);
 
     for (auto & i : old) {
         notice("Loading flake '%1%'...", i);
-        loadFlake(i);
+        try {
+            loadFlake(i);
+        } catch (Error & e) {
+            loadedFlakes.push_back(i);
+            printMsg(lvlError, e.msg());
+        }
     }
 }
 
@@ -854,12 +886,9 @@ Expr * NixRepl::parseString(std::string s)
     try {
         return state->parseExprFromString(std::move(s), state->rootPath("."), staticEnv);
     } catch (ParseError & e) {
-        if (e.msg().find("unexpected end of file") != std::string::npos)
-            // For parse errors on incomplete input, we continue waiting for the next line of
-            // input without clearing the input so far.
+        if (isIncompleteInput(e))
             throw IncompleteReplExpr(e.msg());
-        else
-            throw;
+        throw;
     }
 }
 
@@ -868,20 +897,20 @@ ExprAttrs * NixRepl::parseReplBindings(std::string s)
     auto basePath = state->rootPath(".");
 
     // Try parsing as bindings
-    std::exception_ptr bindingsError;
     try {
         return state->parseReplBindings(s, basePath, staticEnv);
     } catch (ParseError &) {
-        bindingsError = std::current_exception();
     }
 
     // Try with semicolon appended (for `inherit foo` shorthand)
     // Use original source (s) for error messages, not s + ";"
     try {
         return state->parseReplBindings(s + ";", s, basePath, staticEnv);
-    } catch (ParseError &) {
-        // Semicolon retry failed; rethrow the original bindings error
-        std::rethrow_exception(bindingsError);
+    } catch (ParseError & e) {
+        if (isIncompleteInput(e))
+            throw IncompleteReplExpr(e.msg());
+        // Semicolon retry also failed; not valid binding syntax.
+        return nullptr;
     }
 }
 
diff --git a/src/libcmd/unix/unix-socket-server.cc b/src/libcmd/unix/unix-socket-server.cc
index 5d1fba462207..d5fbe0cc70aa 100644
--- a/src/libcmd/unix/unix-socket-server.cc
+++ b/src/libcmd/unix/unix-socket-server.cc
@@ -5,6 +5,7 @@
 #include "nix/util/file-system.hh"
 #include "nix/util/logging.hh"
 #include "nix/util/signals.hh"
+#include "nix/util/strings.hh"
 #include "nix/util/unix-domain-socket.hh"
 #include "nix/util/util.hh"
 
@@ -20,6 +21,8 @@
 
 namespace nix::unix {
 
+void AbortServeSocket::anchor() {}
+
 PeerInfo getPeerInfo(Descriptor remote)
 {
     PeerInfo peer;
@@ -65,9 +68,16 @@ PeerInfo getPeerInfo(Descriptor remote)
     if (listenFds) {
         if (getEnv("LISTEN_PID") != std::to_string(getpid()))
             throw Error("unexpected systemd environment variables");
+
+        auto fdNames = tokenizeString<std::vector<std::string>>(getEnv("LISTEN_FDNAMES").value_or(""), ":");
         auto count = string2Int<unsigned int>(*listenFds);
         assert(count);
         for (unsigned int i = 0; i < count; ++i) {
+            // Not all implementations of LISTEN_FDS will implement names,
+            // listen anyway if we do not have enough names
+            if (i < fdNames.size() && options.activationName != "" && fdNames[i] != options.activationName)
+                continue;
+
             AutoCloseFD fdSocket(SD_LISTEN_FDS_START + i);
             closeOnExec(fdSocket.get());
             listeningSockets.push_back(std::move(fdSocket));
@@ -122,6 +132,9 @@ PeerInfo getPeerInfo(Descriptor remote)
                 handler(std::move(remote), [&]() { listeningSockets.clear(); });
             }
 
+        } catch (AbortServeSocket &) {
+            /* Explicitly aborted, bail out. */
+            throw;
         } catch (Error & error) {
             auto ei = error.info();
             // FIXME: add to trace?
diff --git a/src/libexpr-c/meson.build b/src/libexpr-c/meson.build
index c47704ce4112..fb3a17ff2998 100644
--- a/src/libexpr-c/meson.build
+++ b/src/libexpr-c/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -30,6 +30,7 @@ subdir('nix-meson-build-support/subprojects')
 subdir('nix-meson-build-support/common')
 
 sources = files(
+  'nix_api_eval.cc',
   'nix_api_expr.cc',
   'nix_api_external.cc',
   'nix_api_value.cc',
@@ -47,16 +48,33 @@ headers = files(
 subdir('nix-meson-build-support/export-all-symbols')
 subdir('nix-meson-build-support/windows-version')
 
-this_library = library(
-  'nixexprc',
-  sources,
-  soversion : nix_soversion,
-  dependencies : deps_public + deps_private + deps_other,
-  include_directories : include_dirs,
-  link_args : linker_export_flags,
-  prelink : true, # For C++ static initializers
-  install : true,
-)
+# For linking -c bindings into the cli for plugins.
+build_both_libraries = get_option('plugin-c-api')
+
+library_kwargs = {
+  'soversion' : nix_soversion,
+  'dependencies' : deps_public + deps_private + deps_other,
+  'include_directories' : include_dirs,
+  'link_args' : linker_export_flags,
+  'install' : true,
+}
+
+if build_both_libraries
+  this_libraries = both_libraries(
+    'nixexprc',
+    sources,
+    kwargs : library_kwargs,
+    override_options : [ 'b_lto=false' ],
+  )
+else
+  this_library = library(
+    'nixexprc',
+    sources,
+    kwargs : library_kwargs,
+  )
+endif
+
+plugin_c_api_enabled = build_both_libraries
 
 install_headers(headers, preserve_path : true)
 
diff --git a/src/libexpr-c/meson.options b/src/libexpr-c/meson.options
new file mode 100644
index 000000000000..a8b0c4df0401
--- /dev/null
+++ b/src/libexpr-c/meson.options
@@ -0,0 +1,8 @@
+# vim: filetype=meson
+
+option(
+  'plugin-c-api',
+  type : 'boolean',
+  value : false,
+  yield : true,
+)
diff --git a/src/libexpr-c/nix_api_eval.cc b/src/libexpr-c/nix_api_eval.cc
new file mode 100644
index 000000000000..4c7e2e08fc35
--- /dev/null
+++ b/src/libexpr-c/nix_api_eval.cc
@@ -0,0 +1,55 @@
+#include "nix/expr/eval.hh"
+#include "nix/expr/get-drvs.hh"
+
+#include "nix_api_expr.h"
+#include "nix_api_expr_internal.h"
+#include "nix_api_store.h"
+#include "nix_api_store_internal.h"
+#include "nix_api_util.h"
+#include "nix_api_util_internal.h"
+
+static const nix::Bindings & get_bindings_or_empty(nix::EvalState & state, nix_value * autoArgs)
+{
+    if (!autoArgs) {
+        return nix::Bindings::emptyBindings;
+    }
+    auto & v = check_value_in(autoArgs);
+    state.forceAttrs(v, nix::noPos, "while evaluating automatic function arguments");
+    return *v.attrs();
+}
+
+extern "C" {
+
+StorePath *
+nix_get_derivation(nix_c_context * context, EvalState * state, nix_value * value, bool ignoreAssertionFailures)
+{
+    if (context)
+        context->last_err_code = NIX_OK;
+    try {
+        auto & v = check_value_in(value);
+        auto maybePkg = nix::getDerivation(state->state, v, ignoreAssertionFailures);
+        if (!maybePkg) {
+            return nullptr;
+        }
+        nix::StorePath sp = maybePkg->requireDrvPath();
+        return new StorePath{std::move(sp)};
+    }
+    NIXC_CATCH_ERRS_NULL
+}
+
+nix_err nix_value_auto_call_function(
+    nix_c_context * context, EvalState * state, nix_value * auto_args, nix_value * fn_val, nix_value * result)
+{
+    if (context)
+        context->last_err_code = NIX_OK;
+    try {
+        auto & fn = check_value_in(fn_val);
+        auto & res = check_value_not_null(result);
+
+        auto & b = get_bindings_or_empty(state->state, auto_args);
+        state->state.autoCallFunction(b, fn, res);
+    }
+    NIXC_CATCH_ERRS
+}
+
+} // extern "C"
diff --git a/src/libexpr-c/nix_api_expr.cc b/src/libexpr-c/nix_api_expr.cc
index 97680ac6bfe7..2387ee8c38c2 100644
--- a/src/libexpr-c/nix_api_expr.cc
+++ b/src/libexpr-c/nix_api_expr.cc
@@ -19,27 +19,6 @@
 #  include <boost/unordered/concurrent_flat_map.hpp>
 #endif
 
-/**
- * @brief Allocate and initialize using self-reference
- *
- * This allows a brace initializer to reference the object being constructed.
- *
- * @warning Use with care, as the pointer points to an object that is not fully constructed yet.
- *
- * @tparam T Type to allocate
- * @tparam F A function type for `init`, taking a T* and returning the initializer for T
- * @param init Function that takes a T* and returns the initializer for T
- * @return Pointer to allocated and initialized object
- */
-template<typename T, typename F>
-static T * unsafe_new_with_self(F && init)
-{
-    // Allocate
-    void * p = ::operator new(sizeof(T), static_cast<std::align_val_t>(alignof(T)));
-    // Initialize with placement new
-    return new (p) T(init(static_cast<T *>(p)));
-}
-
 extern "C" {
 
 nix_err nix_libexpr_init(nix_c_context * context)
@@ -129,23 +108,20 @@ nix_eval_state_builder * nix_eval_state_builder_new(nix_c_context * context, Sto
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        return unsafe_new_with_self<nix_eval_state_builder>([&](auto * self) {
-            return nix_eval_state_builder{
-                .store = nix::ref<nix::Store>(store->ptr),
-                .settings = nix::EvalSettings{/* &bool */ self->readOnlyMode},
-                .fetchSettings = nix::fetchers::Settings{},
-                .readOnlyMode = true,
-            };
-        });
+        auto readOnly = nix::make_ref<bool>(true);
+        return new nix_eval_state_builder{
+            .store = nix::ref<nix::Store>(store->ptr),
+            .settings = nix::EvalSettings{/* &bool */ *readOnly},
+            .fetchSettings = nix::fetchers::Settings{},
+            .readOnlyMode = readOnly,
+        };
     }
     NIXC_CATCH_ERRS_NULL
 }
 
 void nix_eval_state_builder_free(nix_eval_state_builder * builder)
 {
-    if (builder)
-        builder->~nix_eval_state_builder();
-    operator delete(builder, static_cast<std::align_val_t>(alignof(nix_eval_state_builder)));
+    delete builder;
 }
 
 nix_err nix_eval_state_builder_load(nix_c_context * context, nix_eval_state_builder * builder)
@@ -154,7 +130,7 @@ nix_err nix_eval_state_builder_load(nix_c_context * context, nix_eval_state_buil
         context->last_err_code = NIX_OK;
     try {
         // TODO: load in one go?
-        builder->settings.readOnlyMode = nix::settings.readOnlyMode;
+        builder->settings.readOnlyMode = &nix::settings.readOnlyMode;
         loadConfFile(builder->settings);
         loadConfFile(builder->fetchSettings);
     }
diff --git a/src/libexpr-c/nix_api_expr.h b/src/libexpr-c/nix_api_expr.h
index 3623ee076f6f..0326e7becf4a 100644
--- a/src/libexpr-c/nix_api_expr.h
+++ b/src/libexpr-c/nix_api_expr.h
@@ -342,6 +342,69 @@ void nix_gc_register_finalizer(void * obj, void * cd, void (*finalizer)(void * o
 
 /** @} */ // doxygen group GC
 
+/** @defgroup libexpr_eval Evaluation
+ * @ingroup libexpr
+ * @brief Higher-level evaluation helpers
+ * @{
+ */
+
+/**
+ * @brief Determine whether a Nix value is a derivation and, if so, return its
+ *        store derivation path.
+ *
+ * Forces @p value and inspects it. The value is considered a derivation when it
+ * is an attribute set whose `type` attribute is the string `"derivation"`; in
+ * that case its `drvPath` attribute is parsed and returned. Otherwise NULL is
+ * returned without recording an error.
+ *
+ * Only the derivation path is returned. Other metadata (`name`, `system`,
+ * outputs, `meta`, ...) lives on @p value itself and can be read with the
+ * attribute-set accessors such as nix_get_attr_byname() and nix_get_string().
+ *
+ * @param[out] context Optional, stores error information. On a NULL return,
+ *  inspect the error code via nix_err_code() to tell the two NULL cases apart:
+ *  NIX_OK means @p value is simply not a derivation, any other code means
+ *  inspection failed. See @ref errors.
+ * @param[in] state The evaluation state.
+ * @param[in] value The value to inspect. It is forced by this call.
+ * @param[in] ignoreAssertionFailures If true, an assertion failure raised while
+ *  forcing @p value is treated as "not a derivation" (NULL is returned without
+ *  an error) rather than being reported as an error.
+ * @return A newly allocated StorePath holding the derivation path, or NULL.
+ *  Free a non-NULL result with nix_store_path_free().
+ */
+StorePath *
+nix_get_derivation(nix_c_context * context, EvalState * state, nix_value * value, bool ignoreAssertionFailures);
+
+/**
+ * @brief Call a function, drawing its arguments from an attribute set.
+ *
+ * Forces @p fn_val and writes the application result into @p result. The result
+ * is not forced; call nix_value_force() to evaluate it before inspecting the
+ * final value.
+ *
+ * - If @p fn_val is a function that takes a set of named arguments
+ *   (e.g. `{ a, b ? 1 }: ...`), it is called with an attribute set assembled
+ *   from @p auto_args: each named argument is taken from @p auto_args when
+ *   present; an argument absent from @p auto_args falls back to its default;
+ *   an argument that is both absent and has no default is an error.
+ * - Otherwise @p fn_val is copied into @p result unchanged. This includes any
+ *   non-function value as well as a function that takes a single unnamed
+ *   argument (e.g. `x: ...`), since there are no named arguments to supply.
+ *
+ * @param[out] context Optional, stores error information
+ * @param[in] state The evaluation state.
+ * @param[in] auto_args Attribute set value supplying the named arguments, or
+ *  NULL to supply none.
+ * @param[in] fn_val The value to call.
+ * @param[out] result Pre-allocated nix_value that receives the result.
+ * @return NIX_OK if the call was successful, an error code otherwise.
+ */
+nix_err nix_value_auto_call_function(
+    nix_c_context * context, EvalState * state, nix_value * auto_args, nix_value * fn_val, nix_value * result);
+
+/** @} */ // doxygen group libexpr_eval
+
 // cffi end
 #ifdef __cplusplus
 }
diff --git a/src/libexpr-c/nix_api_expr_internal.h b/src/libexpr-c/nix_api_expr_internal.h
index b38aeaf7b498..16b32bfa4602 100644
--- a/src/libexpr-c/nix_api_expr_internal.h
+++ b/src/libexpr-c/nix_api_expr_internal.h
@@ -2,6 +2,7 @@
 #define NIX_API_EXPR_INTERNAL_H
 
 #include <memory>
+#include <stdexcept>
 
 #include "nix/fetchers/fetch-settings.hh"
 #include "nix/expr/eval.hh"
@@ -18,8 +19,7 @@ struct nix_eval_state_builder
     nix::EvalSettings settings;
     nix::fetchers::Settings fetchSettings;
     nix::LookupPath lookupPath;
-    // TODO: make an EvalSettings setting own this instead?
-    bool readOnlyMode;
+    nix::ref<bool> readOnlyMode;
 };
 
 struct EvalState
@@ -75,4 +75,35 @@ struct nix_realised_string
 
 } // extern "C"
 
+// Shared helpers for validating nix_value [in] parameters across libexpr-c translation units.
+inline const nix::Value & check_value_not_null(const nix_value * value)
+{
+    if (!value || !value->value)
+        throw std::runtime_error("nix_value is null");
+    return *value->value;
+}
+
+inline nix::Value & check_value_not_null(nix_value * value)
+{
+    if (!value || !value->value)
+        throw std::runtime_error("nix_value is null");
+    return *value->value;
+}
+
+inline const nix::Value & check_value_in(const nix_value * value)
+{
+    auto & v = check_value_not_null(value);
+    if (!v.isValid())
+        throw std::runtime_error("Uninitialized nix_value");
+    return v;
+}
+
+inline nix::Value & check_value_in(nix_value * value)
+{
+    auto & v = check_value_not_null(value);
+    if (!v.isValid())
+        throw std::runtime_error("Uninitialized nix_value");
+    return v;
+}
+
 #endif // NIX_API_EXPR_INTERNAL_H
diff --git a/src/libexpr-c/nix_api_external.cc b/src/libexpr-c/nix_api_external.cc
index 98b68d9f6b49..cf2fa2117273 100644
--- a/src/libexpr-c/nix_api_external.cc
+++ b/src/libexpr-c/nix_api_external.cc
@@ -41,6 +41,8 @@ nix_err nix_external_add_string_context(nix_c_context * context, nix_string_cont
 
 } // extern "C"
 
+namespace {
+
 class NixCExternalValue : public nix::ExternalValueBase
 {
     NixCExternalValueDesc & desc;
@@ -166,6 +168,8 @@ class NixCExternalValue : public nix::ExternalValueBase
     virtual ~NixCExternalValue() override {};
 };
 
+} // namespace
+
 extern "C" {
 
 ExternalValue * nix_create_external_value(nix_c_context * context, NixCExternalValueDesc * desc, void * v)
diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index 3cb5705898c4..eaa5c2e1d535 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -12,41 +12,6 @@
 #include "nix_api_store_internal.h"
 #include "nix_api_value.h"
 
-// Internal helper functions to check [in] and [out] `Value *` parameters
-static const nix::Value & check_value_not_null(const nix_value * value)
-{
-    if (!value) {
-        throw std::runtime_error("nix_value is null");
-    }
-    return *value->value;
-}
-
-static nix::Value & check_value_not_null(nix_value * value)
-{
-    if (!value) {
-        throw std::runtime_error("nix_value is null");
-    }
-    return *value->value;
-}
-
-static const nix::Value & check_value_in(const nix_value * value)
-{
-    auto & v = check_value_not_null(value);
-    if (!v.isValid()) {
-        throw std::runtime_error("Uninitialized nix_value");
-    }
-    return v;
-}
-
-static nix::Value & check_value_in(nix_value * value)
-{
-    auto & v = check_value_not_null(value);
-    if (!v.isValid()) {
-        throw std::runtime_error("Uninitialized nix_value");
-    }
-    return v;
-}
-
 static nix::Value & check_value_out(nix_value * value)
 {
     auto & v = check_value_not_null(value);
@@ -335,7 +300,7 @@ ExternalValue * nix_get_external(nix_c_context * context, nix_value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_out(value);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nExternal);
         return (ExternalValue *) v.external();
     }
diff --git a/src/libexpr-c/package.nix b/src/libexpr-c/package.nix
index 694fbc1fe789..9a7a46c1663d 100644
--- a/src/libexpr-c/package.nix
+++ b/src/libexpr-c/package.nix
@@ -8,6 +8,7 @@
   # Configuration Options
 
   version,
+  withPluginCAPI,
 }:
 
 let
@@ -25,7 +26,7 @@ mkMesonLibrary (finalAttrs: {
     ../../.version
     ./.version
     ./meson.build
-    # ./meson.options
+    ./meson.options
     (fileset.fileFilter (file: file.hasExt "cc") ./.)
     (fileset.fileFilter (file: file.hasExt "hh") ./.)
     (fileset.fileFilter (file: file.hasExt "h") ./.)
@@ -37,6 +38,7 @@ mkMesonLibrary (finalAttrs: {
   ];
 
   mesonFlags = [
+    (lib.mesonBool "plugin-c-api" withPluginCAPI)
   ];
 
   meta = {
diff --git a/src/libexpr-test-support/meson.build b/src/libexpr-test-support/meson.build
index df28661b7e78..4a87bb4545fd 100644
--- a/src/libexpr-test-support/meson.build
+++ b/src/libexpr-test-support/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
diff --git a/src/libexpr-test-support/tests/value/context.cc b/src/libexpr-test-support/tests/value/context.cc
index ca7996acc16e..2483b3ea811b 100644
--- a/src/libexpr-test-support/tests/value/context.cc
+++ b/src/libexpr-test-support/tests/value/context.cc
@@ -1,15 +1,13 @@
-#ifdef __APPLE__
-#  include <exception> // Needed by rapidcheck on Darwin
-#endif
+#include <exception> // IWYU pragma: keep (Needed by rapidcheck on Darwin and FreeBSD)
 #include <rapidcheck.h>
 
 #include "nix/expr/tests/value/context.hh"
 
 namespace rc {
-using namespace nix;
 
-Gen<NixStringContextElem::DrvDeep> Arbitrary<NixStringContextElem::DrvDeep>::arbitrary()
+Gen<nix::NixStringContextElem::DrvDeep> Arbitrary<nix::NixStringContextElem::DrvDeep>::arbitrary()
 {
+    using namespace nix;
     return gen::map(gen::arbitrary<StorePath>(), [](StorePath drvPath) {
         return NixStringContextElem::DrvDeep{
             .drvPath = drvPath,
@@ -17,8 +15,9 @@ Gen<NixStringContextElem::DrvDeep> Arbitrary<NixStringContextElem::DrvDeep>::arb
     });
 }
 
-Gen<NixStringContextElem> Arbitrary<NixStringContextElem>::arbitrary()
+Gen<nix::NixStringContextElem> Arbitrary<nix::NixStringContextElem>::arbitrary()
 {
+    using namespace nix;
     return gen::mapcat(
         gen::inRange<uint8_t>(0, std::variant_size_v<NixStringContextElem::Raw>),
         [](uint8_t n) -> Gen<NixStringContextElem> {
diff --git a/src/libexpr-tests/derived-path.cc b/src/libexpr-tests/derived-path.cc
index c685f6a094a8..3997280ee79e 100644
--- a/src/libexpr-tests/derived-path.cc
+++ b/src/libexpr-tests/derived-path.cc
@@ -1,8 +1,6 @@
 #include <nlohmann/json.hpp>
 #include <gtest/gtest.h>
-#ifdef __APPLE__
-#  include <exception> // Needed by rapidcheck on Darwin
-#endif
+#include <exception> // IWYU pragma: keep (Needed by rapidcheck on Darwin and FreeBSD)
 #include <rapidcheck/gtest.h>
 
 #include "nix/store/tests/derived-path.hh"
@@ -20,8 +18,6 @@ class DerivedPathExpressionTest : public LibExprTest
 // See https://github.com/emil-e/rapidcheck/blob/master/doc/gtest.md#rc_gtest_fixture_propfixture-name-args
 TEST_F(DerivedPathExpressionTest, force_init) {}
 
-#ifndef COVERAGE
-
 RC_GTEST_FIXTURE_PROP(DerivedPathExpressionTest, prop_opaque_path_round_trip, (const SingleDerivedPath::Opaque & o))
 {
     auto * v = state.allocValue();
@@ -63,6 +59,4 @@ RC_GTEST_FIXTURE_PROP(
     RC_ASSERT(SingleDerivedPath{b} == d);
 }
 
-#endif
-
 } /* namespace nix */
diff --git a/src/libexpr-tests/error_traces.cc b/src/libexpr-tests/error_traces.cc
index e722cc48499a..918ea71807e2 100644
--- a/src/libexpr-tests/error_traces.cc
+++ b/src/libexpr-tests/error_traces.cc
@@ -5,14 +5,14 @@
 
 namespace nix {
 
-using namespace testing;
-
 // Testing eval of PrimOp's
 class ErrorTraceTest : public LibExprTest
 {};
 
 TEST_F(ErrorTraceTest, TraceBuilder)
 {
+    using namespace testing;
+
     ASSERT_THROW(state.error<EvalError>("puppy").debugThrow(), EvalError);
 
     ASSERT_THROW(state.error<EvalError>("puppy").withTrace(noPos, "doggy").debugThrow(), EvalError);
@@ -54,1270 +54,4 @@ TEST_F(ErrorTraceTest, NestedThrows)
     }
 }
 
-#define ASSERT_TRACE1(args, type, message)                                                                         \
-    ASSERT_THROW(                                                                                                  \
-        std::string expr(args); std::string name = expr.substr(0, expr.find(" ")); try {                           \
-            Value v = eval("builtins." args);                                                                      \
-            state.forceValueDeep(v);                                                                               \
-        } catch (BaseError & e) {                                                                                  \
-            ASSERT_EQ(PrintToString(e.info().msg), PrintToString(message));                                        \
-            ASSERT_EQ(e.info().traces.size(), 1u) << "while testing " args << std::endl << e.what();               \
-            auto trace = e.info().traces.rbegin();                                                                 \
-            ASSERT_EQ(PrintToString(trace->hint), PrintToString(HintFmt("while calling the '%s' builtin", name))); \
-            throw;                                                                                                 \
-        },                                                                                                         \
-                                                                                   type)
-
-#define ASSERT_TRACE2(args, type, message, context)                                                                \
-    ASSERT_THROW(                                                                                                  \
-        std::string expr(args); std::string name = expr.substr(0, expr.find(" ")); try {                           \
-            Value v = eval("builtins." args);                                                                      \
-            state.forceValueDeep(v);                                                                               \
-        } catch (BaseError & e) {                                                                                  \
-            ASSERT_EQ(PrintToString(e.info().msg), PrintToString(message));                                        \
-            ASSERT_EQ(e.info().traces.size(), 2u) << "while testing " args << std::endl << e.what();               \
-            auto trace = e.info().traces.rbegin();                                                                 \
-            ASSERT_EQ(PrintToString(trace->hint), PrintToString(context));                                         \
-            ++trace;                                                                                               \
-            ASSERT_EQ(PrintToString(trace->hint), PrintToString(HintFmt("while calling the '%s' builtin", name))); \
-            throw;                                                                                                 \
-        },                                                                                                         \
-                                                                                   type)
-
-#define ASSERT_TRACE3(args, type, message, context1, context2)                                                     \
-    ASSERT_THROW(                                                                                                  \
-        std::string expr(args); std::string name = expr.substr(0, expr.find(" ")); try {                           \
-            Value v = eval("builtins." args);                                                                      \
-            state.forceValueDeep(v);                                                                               \
-        } catch (BaseError & e) {                                                                                  \
-            ASSERT_EQ(PrintToString(e.info().msg), PrintToString(message));                                        \
-            ASSERT_EQ(e.info().traces.size(), 3u) << "while testing " args << std::endl << e.what();               \
-            auto trace = e.info().traces.rbegin();                                                                 \
-            ASSERT_EQ(PrintToString(trace->hint), PrintToString(context1));                                        \
-            ++trace;                                                                                               \
-            ASSERT_EQ(PrintToString(trace->hint), PrintToString(context2));                                        \
-            ++trace;                                                                                               \
-            ASSERT_EQ(PrintToString(trace->hint), PrintToString(HintFmt("while calling the '%s' builtin", name))); \
-            throw;                                                                                                 \
-        },                                                                                                         \
-                                                                                   type)
-
-#define ASSERT_TRACE4(args, type, message, context1, context2, context3)                                           \
-    ASSERT_THROW(                                                                                                  \
-        std::string expr(args); std::string name = expr.substr(0, expr.find(" ")); try {                           \
-            Value v = eval("builtins." args);                                                                      \
-            state.forceValueDeep(v);                                                                               \
-        } catch (BaseError & e) {                                                                                  \
-            ASSERT_EQ(PrintToString(e.info().msg), PrintToString(message));                                        \
-            ASSERT_EQ(e.info().traces.size(), 4u) << "while testing " args << std::endl << e.what();               \
-            auto trace = e.info().traces.rbegin();                                                                 \
-            ASSERT_EQ(PrintToString(trace->hint), PrintToString(context1));                                        \
-            ++trace;                                                                                               \
-            ASSERT_EQ(PrintToString(trace->hint), PrintToString(context2));                                        \
-            ++trace;                                                                                               \
-            ASSERT_EQ(PrintToString(trace->hint), PrintToString(context3));                                        \
-            ++trace;                                                                                               \
-            ASSERT_EQ(PrintToString(trace->hint), PrintToString(HintFmt("while calling the '%s' builtin", name))); \
-            throw;                                                                                                 \
-        },                                                                                                         \
-                                                                                   type)
-
-// We assume that expr starts with "builtins.derivationStrict { name =",
-// otherwise the name attribute position (1, 29) would be invalid.
-#define DERIVATION_TRACE_HINTFMT(name)             \
-    HintFmt(                                       \
-        "while evaluating derivation '%s'\n"       \
-        "  whose name attribute is located at %s", \
-        name,                                      \
-        Pos(1, 29, Pos::String{.source = make_ref<std::string>(expr)}))
-
-// To keep things simple, we also assume that derivation name is "foo".
-#define ASSERT_DERIVATION_TRACE1(args, type, message) \
-    ASSERT_TRACE2(args, type, message, DERIVATION_TRACE_HINTFMT("foo"))
-#define ASSERT_DERIVATION_TRACE2(args, type, message, context) \
-    ASSERT_TRACE3(args, type, message, context, DERIVATION_TRACE_HINTFMT("foo"))
-#define ASSERT_DERIVATION_TRACE3(args, type, message, context1, context2) \
-    ASSERT_TRACE4(args, type, message, context1, context2, DERIVATION_TRACE_HINTFMT("foo"))
-
-TEST_F(ErrorTraceTest, replaceStrings)
-{
-    ASSERT_TRACE2(
-        "replaceStrings 0 0 {}",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "0" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.replaceStrings"));
-
-    ASSERT_TRACE2(
-        "replaceStrings [] 0 {}",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "0" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.replaceStrings"));
-
-    ASSERT_TRACE1(
-        "replaceStrings [ 0 ] [] {}",
-        EvalError,
-        HintFmt("'from' and 'to' arguments passed to builtins.replaceStrings have different lengths"));
-
-    ASSERT_TRACE2(
-        "replaceStrings [ 1 ] [ \"new\" ] {}",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating one of the strings to replace passed to builtins.replaceStrings"));
-
-    ASSERT_TRACE2(
-        "replaceStrings [ \"oo\" ] [ true ] \"foo\"",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
-        HintFmt("while evaluating one of the replacement strings passed to builtins.replaceStrings"));
-
-    ASSERT_TRACE2(
-        "replaceStrings [ \"old\" ] [ \"new\" ] {}",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
-        HintFmt("while evaluating the third argument passed to builtins.replaceStrings"));
-}
-
-TEST_F(ErrorTraceTest, scopedImport) {}
-
-TEST_F(ErrorTraceTest, import) {}
-
-TEST_F(ErrorTraceTest, typeOf) {}
-
-TEST_F(ErrorTraceTest, isNull) {}
-
-TEST_F(ErrorTraceTest, isFunction) {}
-
-TEST_F(ErrorTraceTest, isInt) {}
-
-TEST_F(ErrorTraceTest, isFloat) {}
-
-TEST_F(ErrorTraceTest, isString) {}
-
-TEST_F(ErrorTraceTest, isBool) {}
-
-TEST_F(ErrorTraceTest, isPath) {}
-
-TEST_F(ErrorTraceTest, break) {}
-
-TEST_F(ErrorTraceTest, abort) {}
-
-TEST_F(ErrorTraceTest, throw) {}
-
-TEST_F(ErrorTraceTest, addErrorContext) {}
-
-TEST_F(ErrorTraceTest, ceil)
-{
-    ASSERT_TRACE2(
-        "ceil \"foo\"",
-        TypeError,
-        HintFmt("expected a float but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.ceil"));
-}
-
-TEST_F(ErrorTraceTest, floor)
-{
-    ASSERT_TRACE2(
-        "floor \"foo\"",
-        TypeError,
-        HintFmt("expected a float but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.floor"));
-}
-
-TEST_F(ErrorTraceTest, tryEval) {}
-
-TEST_F(ErrorTraceTest, getEnv)
-{
-    ASSERT_TRACE2(
-        "getEnv [ ]",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the first argument passed to builtins.getEnv"));
-}
-
-TEST_F(ErrorTraceTest, seq) {}
-
-TEST_F(ErrorTraceTest, deepSeq) {}
-
-TEST_F(ErrorTraceTest, trace) {}
-
-TEST_F(ErrorTraceTest, placeholder)
-{
-    ASSERT_TRACE2(
-        "placeholder []",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the first argument passed to builtins.placeholder"));
-}
-
-TEST_F(ErrorTraceTest, toPath)
-{
-    ASSERT_TRACE2(
-        "toPath []",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the first argument passed to builtins.toPath"));
-
-    ASSERT_TRACE2(
-        "toPath \"foo\"",
-        EvalError,
-        HintFmt("string '%s' doesn't represent an absolute path", "foo"),
-        HintFmt("while evaluating the first argument passed to builtins.toPath"));
-}
-
-TEST_F(ErrorTraceTest, storePath)
-{
-    ASSERT_TRACE2(
-        "storePath true",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to 'builtins.storePath'"));
-}
-
-TEST_F(ErrorTraceTest, pathExists)
-{
-    ASSERT_TRACE2(
-        "pathExists []",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while realising the context of a path"));
-
-    ASSERT_TRACE2(
-        "pathExists \"zorglub\"",
-        EvalError,
-        HintFmt("string '%s' doesn't represent an absolute path", "zorglub"),
-        HintFmt("while realising the context of a path"));
-}
-
-TEST_F(ErrorTraceTest, baseNameOf)
-{
-    ASSERT_TRACE2(
-        "baseNameOf []",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the first argument passed to builtins.baseNameOf"));
-}
-
-TEST_F(ErrorTraceTest, dirOf) {}
-
-TEST_F(ErrorTraceTest, readFile) {}
-
-TEST_F(ErrorTraceTest, findFile) {}
-
-TEST_F(ErrorTraceTest, hashFile) {}
-
-TEST_F(ErrorTraceTest, readDir) {}
-
-TEST_F(ErrorTraceTest, toXML) {}
-
-TEST_F(ErrorTraceTest, toJSON) {}
-
-TEST_F(ErrorTraceTest, fromJSON) {}
-
-TEST_F(ErrorTraceTest, toFile) {}
-
-TEST_F(ErrorTraceTest, filterSource)
-{
-    ASSERT_TRACE2(
-        "filterSource [] []",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the second argument (the path to filter) passed to 'builtins.filterSource'"));
-
-    ASSERT_TRACE2(
-        "filterSource [] \"foo\"",
-        EvalError,
-        HintFmt("string '%s' doesn't represent an absolute path", "foo"),
-        HintFmt("while evaluating the second argument (the path to filter) passed to 'builtins.filterSource'"));
-
-    ASSERT_TRACE2(
-        "filterSource [] ./.",
-        TypeError,
-        HintFmt("expected a function but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the first argument passed to builtins.filterSource"));
-
-    // Unsupported by store "dummy"
-
-    // ASSERT_TRACE2("filterSource (_: 1) ./.",
-    //               TypeError,
-    //               HintFmt("attempt to call something which is not a function but %s", "an integer"),
-    //               HintFmt("while adding path '/home/layus/projects/nix'"));
-
-    // ASSERT_TRACE2("filterSource (_: _: 1) ./.",
-    //               TypeError,
-    //               HintFmt("expected a Boolean but found %s: %s", "an integer", "1"),
-    //               HintFmt("while evaluating the return value of the path filter function"));
-}
-
-TEST_F(ErrorTraceTest, path) {}
-
-TEST_F(ErrorTraceTest, attrNames)
-{
-    ASSERT_TRACE2(
-        "attrNames []",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the argument passed to builtins.attrNames"));
-}
-
-TEST_F(ErrorTraceTest, attrValues)
-{
-    ASSERT_TRACE2(
-        "attrValues []",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the argument passed to builtins.attrValues"));
-}
-
-TEST_F(ErrorTraceTest, getAttr)
-{
-    ASSERT_TRACE2(
-        "getAttr [] []",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the first argument passed to builtins.getAttr"));
-
-    ASSERT_TRACE2(
-        "getAttr \"foo\" []",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the second argument passed to builtins.getAttr"));
-
-    ASSERT_TRACE2(
-        "getAttr \"foo\" {}",
-        TypeError,
-        HintFmt("attribute '%s' missing", "foo"),
-        HintFmt("in the attribute set under consideration"));
-}
-
-TEST_F(ErrorTraceTest, unsafeGetAttrPos) {}
-
-TEST_F(ErrorTraceTest, hasAttr)
-{
-    ASSERT_TRACE2(
-        "hasAttr [] []",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the first argument passed to builtins.hasAttr"));
-
-    ASSERT_TRACE2(
-        "hasAttr \"foo\" []",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the second argument passed to builtins.hasAttr"));
-}
-
-TEST_F(ErrorTraceTest, isAttrs) {}
-
-TEST_F(ErrorTraceTest, removeAttrs)
-{
-    ASSERT_TRACE2(
-        "removeAttrs \"\" \"\"",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.removeAttrs"));
-
-    ASSERT_TRACE2(
-        "removeAttrs \"\" [ 1 ]",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.removeAttrs"));
-
-    ASSERT_TRACE2(
-        "removeAttrs \"\" [ \"1\" ]",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.removeAttrs"));
-}
-
-TEST_F(ErrorTraceTest, listToAttrs)
-{
-    ASSERT_TRACE2(
-        "listToAttrs 1",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the argument passed to builtins.listToAttrs"));
-
-    ASSERT_TRACE2(
-        "listToAttrs [ 1 ]",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating an element of the list passed to builtins.listToAttrs"));
-
-    ASSERT_TRACE2(
-        "listToAttrs [ {} ]",
-        TypeError,
-        HintFmt("attribute '%s' missing", "name"),
-        HintFmt("in a {name=...; value=...;} pair"));
-
-    ASSERT_TRACE2(
-        "listToAttrs [ { name = 1; } ]",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the `name` attribute of an element of the list passed to builtins.listToAttrs"));
-
-    ASSERT_TRACE2(
-        "listToAttrs [ { name = \"foo\"; } ]",
-        TypeError,
-        HintFmt("attribute '%s' missing", "value"),
-        HintFmt("in a {name=...; value=...;} pair"));
-}
-
-TEST_F(ErrorTraceTest, intersectAttrs)
-{
-    ASSERT_TRACE2(
-        "intersectAttrs [] []",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the first argument passed to builtins.intersectAttrs"));
-
-    ASSERT_TRACE2(
-        "intersectAttrs {} []",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the second argument passed to builtins.intersectAttrs"));
-}
-
-TEST_F(ErrorTraceTest, catAttrs)
-{
-    ASSERT_TRACE2(
-        "catAttrs [] {}",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the first argument passed to builtins.catAttrs"));
-
-    ASSERT_TRACE2(
-        "catAttrs \"foo\" {}",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a set", Uncolored("{ }")),
-        HintFmt("while evaluating the second argument passed to builtins.catAttrs"));
-
-    ASSERT_TRACE2(
-        "catAttrs \"foo\" [ 1 ]",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating an element in the list passed as second argument to builtins.catAttrs"));
-
-    ASSERT_TRACE2(
-        "catAttrs \"foo\" [ { foo = 1; } 1 { bar = 5;} ]",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating an element in the list passed as second argument to builtins.catAttrs"));
-}
-
-TEST_F(ErrorTraceTest, functionArgs)
-{
-    ASSERT_TRACE1("functionArgs {}", TypeError, HintFmt("'functionArgs' requires a function"));
-}
-
-TEST_F(ErrorTraceTest, mapAttrs)
-{
-    ASSERT_TRACE2(
-        "mapAttrs [] []",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the second argument passed to builtins.mapAttrs"));
-
-    // XXX: deferred
-    // ASSERT_TRACE2("mapAttrs \"\" { foo.bar = 1; }",
-    //               TypeError,
-    //               HintFmt("attempt to call something which is not a function but %s", "a string"),
-    //               HintFmt("while evaluating the attribute 'foo'"));
-
-    // ASSERT_TRACE2("mapAttrs (x: x + \"1\") { foo.bar = 1; }",
-    //               TypeError,
-    //               HintFmt("attempt to call something which is not a function but %s", "a string"),
-    //               HintFmt("while evaluating the attribute 'foo'"));
-
-    // ASSERT_TRACE2("mapAttrs (x: y: x + 1) { foo.bar = 1; }",
-    //               TypeError,
-    //               HintFmt("cannot coerce %s to a string", "an integer"),
-    //               HintFmt("while evaluating a path segment"));
-}
-
-TEST_F(ErrorTraceTest, zipAttrsWith)
-{
-    ASSERT_TRACE2(
-        "zipAttrsWith [] [ 1 ]",
-        TypeError,
-        HintFmt("expected a function but found %s: %s", "a list", Uncolored("[ ]")),
-        HintFmt("while evaluating the first argument passed to builtins.zipAttrsWith"));
-
-    ASSERT_TRACE2(
-        "zipAttrsWith (_: 1) [ 1 ]",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating a value of the list passed as second argument to builtins.zipAttrsWith"));
-
-    // XXX: How to properly tell that the function takes two arguments ?
-    // The same question also applies to sort, and maybe others.
-    // Due to laziness, we only create a thunk, and it fails later on.
-    // ASSERT_TRACE2("zipAttrsWith (_: 1) [ { foo = 1; } ]",
-    //               TypeError,
-    //               HintFmt("attempt to call something which is not a function but %s", "an integer"),
-    //               HintFmt("while evaluating the attribute 'foo'"));
-
-    // XXX: Also deferred deeply
-    // ASSERT_TRACE2("zipAttrsWith (a: b: a + b) [ { foo = 1; } { foo = 2; } ]",
-    //               TypeError,
-    //               HintFmt("cannot coerce %s to a string", "a list"),
-    //               HintFmt("while evaluating a path segment"));
-}
-
-TEST_F(ErrorTraceTest, isList) {}
-
-TEST_F(ErrorTraceTest, elemAt)
-{
-    ASSERT_TRACE2(
-        "elemAt \"foo\" (-1)",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to 'builtins.elemAt'"));
-
-    ASSERT_TRACE1(
-        "elemAt [] (-1)", Error, HintFmt("'builtins.elemAt' called with index %d on a list of size %d", -1, 0));
-
-    ASSERT_TRACE1(
-        "elemAt [\"foo\"] 3", Error, HintFmt("'builtins.elemAt' called with index %d on a list of size %d", 3, 1));
-}
-
-TEST_F(ErrorTraceTest, head)
-{
-    ASSERT_TRACE2(
-        "head 1",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to 'builtins.head'"));
-
-    ASSERT_TRACE1("head []", Error, HintFmt("'builtins.head' called on an empty list"));
-}
-
-TEST_F(ErrorTraceTest, tail)
-{
-    ASSERT_TRACE2(
-        "tail 1",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to 'builtins.tail'"));
-
-    ASSERT_TRACE1("tail []", Error, HintFmt("'builtins.tail' called on an empty list"));
-}
-
-TEST_F(ErrorTraceTest, map)
-{
-    ASSERT_TRACE2(
-        "map 1 \"foo\"",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.map"));
-
-    ASSERT_TRACE2(
-        "map 1 [ 1 ]",
-        TypeError,
-        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.map"));
-}
-
-TEST_F(ErrorTraceTest, filter)
-{
-    ASSERT_TRACE2(
-        "filter 1 \"foo\"",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.filter"));
-
-    ASSERT_TRACE2(
-        "filter 1 [ \"foo\" ]",
-        TypeError,
-        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.filter"));
-
-    ASSERT_TRACE2(
-        "filter (_: 5) [ \"foo\" ]",
-        TypeError,
-        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "5" ANSI_NORMAL)),
-        HintFmt("while evaluating the return value of the filtering function passed to builtins.filter"));
-}
-
-TEST_F(ErrorTraceTest, elem)
-{
-    ASSERT_TRACE2(
-        "elem 1 \"foo\"",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.elem"));
-}
-
-TEST_F(ErrorTraceTest, concatLists)
-{
-    ASSERT_TRACE2(
-        "concatLists 1",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.concatLists"));
-
-    ASSERT_TRACE2(
-        "concatLists [ 1 ]",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating a value of the list passed to builtins.concatLists"));
-
-    ASSERT_TRACE2(
-        "concatLists [ [1] \"foo\" ]",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating a value of the list passed to builtins.concatLists"));
-}
-
-TEST_F(ErrorTraceTest, length)
-{
-    ASSERT_TRACE2(
-        "length 1",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.length"));
-
-    ASSERT_TRACE2(
-        "length \"foo\"",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.length"));
-}
-
-TEST_F(ErrorTraceTest, foldlPrime)
-{
-    ASSERT_TRACE2(
-        "foldl' 1 \"foo\" true",
-        TypeError,
-        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.foldlStrict"));
-
-    ASSERT_TRACE2(
-        "foldl' (_: 1) \"foo\" true",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
-        HintFmt("while evaluating the third argument passed to builtins.foldlStrict"));
-
-    ASSERT_TRACE1(
-        "foldl' (_: 1) \"foo\" [ true ]",
-        TypeError,
-        HintFmt(
-            "attempt to call something which is not a function but %s: %s",
-            "an integer",
-            Uncolored(ANSI_CYAN "1" ANSI_NORMAL)));
-
-    ASSERT_TRACE2(
-        "foldl' (a: b: a && b) \"foo\" [ true ]",
-        TypeError,
-        HintFmt("expected a Boolean but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("in the left operand of the AND (&&) operator"));
-}
-
-TEST_F(ErrorTraceTest, any)
-{
-    ASSERT_TRACE2(
-        "any 1 \"foo\"",
-        TypeError,
-        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.any"));
-
-    ASSERT_TRACE2(
-        "any (_: 1) \"foo\"",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.any"));
-
-    ASSERT_TRACE2(
-        "any (_: 1) [ \"foo\" ]",
-        TypeError,
-        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the return value of the function passed to builtins.any"));
-}
-
-TEST_F(ErrorTraceTest, all)
-{
-    ASSERT_TRACE2(
-        "all 1 \"foo\"",
-        TypeError,
-        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.all"));
-
-    ASSERT_TRACE2(
-        "all (_: 1) \"foo\"",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.all"));
-
-    ASSERT_TRACE2(
-        "all (_: 1) [ \"foo\" ]",
-        TypeError,
-        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the return value of the function passed to builtins.all"));
-}
-
-TEST_F(ErrorTraceTest, genList)
-{
-    ASSERT_TRACE2(
-        "genList 1 \"foo\"",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.genList"));
-
-    ASSERT_TRACE2(
-        "genList 1 2",
-        TypeError,
-        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.genList"));
-
-    // XXX: deferred
-    // ASSERT_TRACE2("genList (x: x + \"foo\") 2 #TODO",
-    //               TypeError,
-    //               HintFmt("cannot add %s to an integer", "a string"),
-    //               HintFmt("while evaluating anonymous lambda"));
-
-    ASSERT_TRACE1("genList false (-3)", EvalError, HintFmt("cannot create list of size %d", -3));
-}
-
-TEST_F(ErrorTraceTest, sort)
-{
-    ASSERT_TRACE2(
-        "sort 1 \"foo\"",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.sort"));
-
-    ASSERT_TRACE2(
-        "sort 1 [ \"foo\" ]",
-        TypeError,
-        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.sort"));
-
-    ASSERT_TRACE1(
-        "sort (_: 1) [ \"foo\" \"bar\" ]",
-        TypeError,
-        HintFmt(
-            "attempt to call something which is not a function but %s: %s",
-            "an integer",
-            Uncolored(ANSI_CYAN "1" ANSI_NORMAL)));
-
-    ASSERT_TRACE2(
-        "sort (_: _: 1) [ \"foo\" \"bar\" ]",
-        TypeError,
-        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the return value of the sorting function passed to builtins.sort"));
-
-    // XXX: Trace too deep, need better asserts
-    // ASSERT_TRACE1("sort (a: b: a <= b) [ \"foo\" {} ] # TODO",
-    //               TypeError,
-    //               HintFmt("cannot compare %s with %s", "a string", "a set"));
-
-    // ASSERT_TRACE1("sort (a: b: a <= b) [ {} {} ] # TODO",
-    //               TypeError,
-    //               HintFmt("cannot compare %s with %s; values of that type are incomparable", "a set", "a set"));
-}
-
-TEST_F(ErrorTraceTest, partition)
-{
-    ASSERT_TRACE2(
-        "partition 1 \"foo\"",
-        TypeError,
-        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.partition"));
-
-    ASSERT_TRACE2(
-        "partition (_: 1) \"foo\"",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.partition"));
-
-    ASSERT_TRACE2(
-        "partition (_: 1) [ \"foo\" ]",
-        TypeError,
-        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the return value of the partition function passed to builtins.partition"));
-}
-
-TEST_F(ErrorTraceTest, groupBy)
-{
-    ASSERT_TRACE2(
-        "groupBy 1 \"foo\"",
-        TypeError,
-        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.groupBy"));
-
-    ASSERT_TRACE2(
-        "groupBy (_: 1) \"foo\"",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.groupBy"));
-
-    ASSERT_TRACE2(
-        "groupBy (x: x) [ \"foo\" \"bar\" 1 ]",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the return value of the grouping function passed to builtins.groupBy"));
-}
-
-TEST_F(ErrorTraceTest, concatMap)
-{
-    ASSERT_TRACE2(
-        "concatMap 1 \"foo\"",
-        TypeError,
-        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.concatMap"));
-
-    ASSERT_TRACE2(
-        "concatMap (x: 1) \"foo\"",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.concatMap"));
-
-    ASSERT_TRACE2(
-        "concatMap (x: 1) [ \"foo\" ] # TODO",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the return value of the function passed to builtins.concatMap"));
-
-    ASSERT_TRACE2(
-        "concatMap (x: \"foo\") [ 1 2 ] # TODO",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the return value of the function passed to builtins.concatMap"));
-}
-
-TEST_F(ErrorTraceTest, add)
-{
-    ASSERT_TRACE2(
-        "add \"foo\" 1",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument of the addition"));
-
-    ASSERT_TRACE2(
-        "add 1 \"foo\"",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument of the addition"));
-}
-
-TEST_F(ErrorTraceTest, sub)
-{
-    ASSERT_TRACE2(
-        "sub \"foo\" 1",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument of the subtraction"));
-
-    ASSERT_TRACE2(
-        "sub 1 \"foo\"",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument of the subtraction"));
-}
-
-TEST_F(ErrorTraceTest, mul)
-{
-    ASSERT_TRACE2(
-        "mul \"foo\" 1",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument of the multiplication"));
-
-    ASSERT_TRACE2(
-        "mul 1 \"foo\"",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument of the multiplication"));
-}
-
-TEST_F(ErrorTraceTest, div)
-{
-    ASSERT_TRACE2(
-        "div \"foo\" 1 # TODO: an integer was expected -> a number",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the first operand of the division"));
-
-    ASSERT_TRACE2(
-        "div 1 \"foo\"",
-        TypeError,
-        HintFmt("expected a float but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second operand of the division"));
-
-    ASSERT_TRACE1("div \"foo\" 0", EvalError, HintFmt("division by zero"));
-}
-
-TEST_F(ErrorTraceTest, bitAnd)
-{
-    ASSERT_TRACE2(
-        "bitAnd 1.1 2",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "1.1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.bitAnd"));
-
-    ASSERT_TRACE2(
-        "bitAnd 1 2.2",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "2.2" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.bitAnd"));
-}
-
-TEST_F(ErrorTraceTest, bitOr)
-{
-    ASSERT_TRACE2(
-        "bitOr 1.1 2",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "1.1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.bitOr"));
-
-    ASSERT_TRACE2(
-        "bitOr 1 2.2",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "2.2" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.bitOr"));
-}
-
-TEST_F(ErrorTraceTest, bitXor)
-{
-    ASSERT_TRACE2(
-        "bitXor 1.1 2",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "1.1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.bitXor"));
-
-    ASSERT_TRACE2(
-        "bitXor 1 2.2",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "2.2" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument passed to builtins.bitXor"));
-}
-
-TEST_F(ErrorTraceTest, lessThan)
-{
-    ASSERT_TRACE1(
-        "lessThan 1 \"foo\"",
-        EvalError,
-        HintFmt(
-            "cannot compare %s with %s; values are %s and %s",
-            "an integer",
-            "a string",
-            Uncolored(ANSI_CYAN "1" ANSI_NORMAL),
-            Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)));
-
-    ASSERT_TRACE1(
-        "lessThan {} {}",
-        EvalError,
-        HintFmt(
-            "cannot compare %s with %s; values of that type are incomparable (values are %s and %s)",
-            "a set",
-            "a set",
-            Uncolored("{ }"),
-            Uncolored("{ }")));
-
-    ASSERT_TRACE2(
-        "lessThan [ 1 2 ] [ \"foo\" ]",
-        EvalError,
-        HintFmt(
-            "cannot compare %s with %s; values are %s and %s",
-            "an integer",
-            "a string",
-            Uncolored(ANSI_CYAN "1" ANSI_NORMAL),
-            Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while comparing two list elements"));
-}
-
-TEST_F(ErrorTraceTest, toString)
-{
-    ASSERT_TRACE2(
-        "toString { a = 1; }",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: %s", "a set", Uncolored("{ a = " ANSI_CYAN "1" ANSI_NORMAL "; }")),
-        HintFmt("while evaluating the first argument passed to builtins.toString"));
-}
-
-TEST_F(ErrorTraceTest, substring)
-{
-    ASSERT_TRACE2(
-        "substring {} \"foo\" true",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a set", Uncolored("{ }")),
-        HintFmt("while evaluating the first argument (the start offset) passed to builtins.substring"));
-
-    ASSERT_TRACE2(
-        "substring 3 \"foo\" true",
-        TypeError,
-        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-        HintFmt("while evaluating the second argument (the substring length) passed to builtins.substring"));
-
-    ASSERT_TRACE2(
-        "substring 0 3 {}",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: %s", "a set", Uncolored("{ }")),
-        HintFmt("while evaluating the third argument (the string) passed to builtins.substring"));
-
-    ASSERT_TRACE1("substring (-3) 3 \"sometext\"", EvalError, HintFmt("negative start position in 'substring'"));
-}
-
-TEST_F(ErrorTraceTest, stringLength)
-{
-    ASSERT_TRACE2(
-        "stringLength {} # TODO: context is missing ???",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: %s", "a set", Uncolored("{ }")),
-        HintFmt("while evaluating the argument passed to builtins.stringLength"));
-}
-
-TEST_F(ErrorTraceTest, hashString)
-{
-    ASSERT_TRACE2(
-        "hashString 1 {}",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.hashString"));
-
-    ASSERT_TRACE1(
-        "hashString \"foo\" \"content\"",
-        UsageError,
-        HintFmt("unknown hash algorithm '%s', expect 'blake3', 'md5', 'sha1', 'sha256', or 'sha512'", "foo"));
-
-    ASSERT_TRACE2(
-        "hashString \"sha256\" {}",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
-        HintFmt("while evaluating the second argument passed to builtins.hashString"));
-}
-
-TEST_F(ErrorTraceTest, match)
-{
-    ASSERT_TRACE2(
-        "match 1 {}",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.match"));
-
-    ASSERT_TRACE2(
-        "match \"foo\" {}",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
-        HintFmt("while evaluating the second argument passed to builtins.match"));
-
-    ASSERT_TRACE1("match \"(.*\" \"\"", EvalError, HintFmt("invalid regular expression '%s'", "(.*"));
-}
-
-TEST_F(ErrorTraceTest, split)
-{
-    ASSERT_TRACE2(
-        "split 1 {}",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.split"));
-
-    ASSERT_TRACE2(
-        "split \"foo\" {}",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
-        HintFmt("while evaluating the second argument passed to builtins.split"));
-
-    ASSERT_TRACE1("split \"f(o*o\" \"1foo2\"", EvalError, HintFmt("invalid regular expression '%s'", "f(o*o"));
-}
-
-TEST_F(ErrorTraceTest, concatStringsSep)
-{
-    ASSERT_TRACE2(
-        "concatStringsSep 1 {}",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument (the separator string) passed to builtins.concatStringsSep"));
-
-    ASSERT_TRACE2(
-        "concatStringsSep \"foo\" {}",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a set", Uncolored("{ }")),
-        HintFmt(
-            "while evaluating the second argument (the list of strings to concat) passed to builtins.concatStringsSep"));
-
-    ASSERT_TRACE2(
-        "concatStringsSep \"foo\" [ 1 2 {} ] # TODO: coerce to string is buggy",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating one element of the list of strings to concat passed to builtins.concatStringsSep"));
-}
-
-TEST_F(ErrorTraceTest, parseDrvName)
-{
-    ASSERT_TRACE2(
-        "parseDrvName 1",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.parseDrvName"));
-}
-
-TEST_F(ErrorTraceTest, compareVersions)
-{
-    ASSERT_TRACE2(
-        "compareVersions 1 {}",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.compareVersions"));
-
-    ASSERT_TRACE2(
-        "compareVersions \"abd\" {}",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
-        HintFmt("while evaluating the second argument passed to builtins.compareVersions"));
-}
-
-TEST_F(ErrorTraceTest, splitVersion)
-{
-    ASSERT_TRACE2(
-        "splitVersion 1",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the first argument passed to builtins.splitVersion"));
-}
-
-TEST_F(ErrorTraceTest, traceVerbose) {}
-
-TEST_F(ErrorTraceTest, derivationStrict)
-{
-    ASSERT_TRACE2(
-        "derivationStrict \"\"",
-        TypeError,
-        HintFmt("expected a set but found %s: %s", "a string", "\"\""),
-        HintFmt("while evaluating the argument passed to builtins.derivationStrict"));
-
-    ASSERT_TRACE2(
-        "derivationStrict {}",
-        TypeError,
-        HintFmt("attribute '%s' missing", "name"),
-        HintFmt("in the attrset passed as argument to builtins.derivationStrict"));
-
-    ASSERT_TRACE3(
-        "derivationStrict { name = 1; }",
-        TypeError,
-        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-        HintFmt("while evaluating the `name` attribute passed to builtins.derivationStrict"),
-        HintFmt("while evaluating the derivation attribute 'name'"));
-
-    ASSERT_DERIVATION_TRACE1(
-        "derivationStrict { name = \"foo\"; }", EvalError, HintFmt("required attribute 'builder' missing"));
-
-    ASSERT_DERIVATION_TRACE2(
-        "derivationStrict { name = \"foo\"; builder = 1; __structuredAttrs = 15; }",
-        TypeError,
-        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "15" ANSI_NORMAL)),
-        HintFmt("while evaluating the `__structuredAttrs` attribute passed to builtins.derivationStrict"));
-
-    ASSERT_DERIVATION_TRACE2(
-        "derivationStrict { name = \"foo\"; builder = 1; __ignoreNulls = 15; }",
-        TypeError,
-        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "15" ANSI_NORMAL)),
-        HintFmt("while evaluating the `__ignoreNulls` attribute passed to builtins.derivationStrict"));
-
-    ASSERT_DERIVATION_TRACE2(
-        "derivationStrict { name = \"foo\"; builder = 1; outputHashMode = 15; }",
-        EvalError,
-        HintFmt("invalid value '%s' for 'outputHashMode' attribute", "15"),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputHashMode", "foo"));
-
-    ASSERT_DERIVATION_TRACE2(
-        "derivationStrict { name = \"foo\"; builder = 1; outputHashMode = \"custom\"; }",
-        EvalError,
-        HintFmt("invalid value '%s' for 'outputHashMode' attribute", "custom"),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputHashMode", "foo"));
-
-    ASSERT_DERIVATION_TRACE3(
-        "derivationStrict { name = \"foo\"; builder = 1; system = {}; }",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: { }", "a set"),
-        HintFmt(""),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "system", "foo"));
-
-    ASSERT_DERIVATION_TRACE3(
-        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = {}; }",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: { }", "a set"),
-        HintFmt(""),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
-
-    ASSERT_DERIVATION_TRACE2(
-        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"drvPath\"; }",
-        EvalError,
-        HintFmt("invalid derivation output name 'drvPath'"),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
-
-    ASSERT_DERIVATION_TRACE3(
-        "derivationStrict { name = \"foo\"; outputs = \"out\"; __structuredAttrs = true; }",
-        EvalError,
-        HintFmt("expected a list but found %s: %s", "a string", "\"out\""),
-        HintFmt(""),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
-
-    ASSERT_DERIVATION_TRACE2(
-        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = []; }",
-        EvalError,
-        HintFmt("derivation cannot have an empty set of outputs"),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
-
-    ASSERT_DERIVATION_TRACE2(
-        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = [ \"drvPath\" ]; }",
-        EvalError,
-        HintFmt("invalid derivation output name 'drvPath'"),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
-
-    ASSERT_DERIVATION_TRACE2(
-        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = [ \"out\" \"out\" ]; }",
-        EvalError,
-        HintFmt("duplicate derivation output '%s'", "out"),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
-
-    ASSERT_DERIVATION_TRACE3(
-        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __contentAddressed = \"true\"; }",
-        TypeError,
-        HintFmt("expected a Boolean but found %s: %s", "a string", "\"true\""),
-        HintFmt(""),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "__contentAddressed", "foo"));
-
-    ASSERT_DERIVATION_TRACE3(
-        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __impure = \"true\"; }",
-        TypeError,
-        HintFmt("expected a Boolean but found %s: %s", "a string", "\"true\""),
-        HintFmt(""),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "__impure", "foo"));
-
-    ASSERT_DERIVATION_TRACE3(
-        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __impure = \"true\"; }",
-        TypeError,
-        HintFmt("expected a Boolean but found %s: %s", "a string", "\"true\""),
-        HintFmt(""),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "__impure", "foo"));
-
-    ASSERT_DERIVATION_TRACE3(
-        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = \"foo\"; }",
-        TypeError,
-        HintFmt("expected a list but found %s: %s", "a string", "\"foo\""),
-        HintFmt(""),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "args", "foo"));
-
-    ASSERT_DERIVATION_TRACE3(
-        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = [ {} ]; }",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: { }", "a set"),
-        HintFmt("while evaluating an element of the argument list"),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "args", "foo"));
-
-    ASSERT_DERIVATION_TRACE3(
-        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = [ \"a\" {} ]; }",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: { }", "a set"),
-        HintFmt("while evaluating an element of the argument list"),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "args", "foo"));
-
-    ASSERT_DERIVATION_TRACE3(
-        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; FOO = {}; }",
-        TypeError,
-        HintFmt("cannot coerce %s to a string: { }", "a set"),
-        HintFmt(""),
-        HintFmt("while evaluating attribute '%s' of derivation '%s'", "FOO", "foo"));
-}
-
 } /* namespace nix */
diff --git a/src/libexpr-tests/lazy-fetcher-attr.cc b/src/libexpr-tests/lazy-fetcher-attr.cc
new file mode 100644
index 000000000000..4c36424ecb55
--- /dev/null
+++ b/src/libexpr-tests/lazy-fetcher-attr.cc
@@ -0,0 +1,100 @@
+#include <gtest/gtest.h>
+
+#include "nix/expr/fetch-tree.hh"
+#include "nix/expr/tests/libexpr.hh"
+#include "nix/fetchers/attrs.hh"
+#include "nix/fetchers/fetchers.hh"
+#include "nix/store/path.hh"
+
+namespace nix {
+
+class LazyFetcherAttrTest : public LibExprTest
+{
+protected:
+    StorePath dummyPath()
+    {
+        return StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-test"};
+    }
+};
+
+TEST_F(LazyFetcherAttrTest, nonLazyAttrProducesImmediateValue)
+{
+    fetchers::Input input;
+    input.attrs.insert_or_assign("type", std::string("git"));
+    input.attrs.insert_or_assign("revCount", uint64_t(5));
+
+    Value v;
+    emitTreeAttrs(state, dummyPath(), input, v, false, false);
+    state.forceValue(v, noPos);
+
+    auto * rcAttr = v.attrs()->get(state.symbols.create("revCount"));
+    ASSERT_NE(rcAttr, nullptr);
+    state.forceValue(*rcAttr->value, noPos);
+    EXPECT_EQ(rcAttr->value->integer().value, 5);
+}
+
+TEST_F(LazyFetcherAttrTest, lazyAttrProducesThunk)
+{
+    int calls = 0;
+    fetchers::Input input;
+    input.attrs.insert_or_assign("type", std::string("git"));
+    input.attrs.insert_or_assign(
+        "revCount",
+        fetchers::LazyAttr(
+            make_ref<fetchers::LazyAttrComputation>(
+                fetchers::LazyAttrComputation{.compute = [&calls]() -> fetchers::ResolvedAttr {
+                    calls++;
+                    return uint64_t(42);
+                }})));
+
+    Value v;
+    emitTreeAttrs(state, dummyPath(), input, v, false, false);
+    state.forceValue(v, noPos);
+
+    auto * rcAttr = v.attrs()->get(state.symbols.create("revCount"));
+    ASSERT_NE(rcAttr, nullptr);
+
+    // Not yet forced, so the lazy function should not have been called
+    EXPECT_EQ(calls, 0);
+
+    // Force the thunk
+    state.forceValue(*rcAttr->value, noPos);
+    EXPECT_EQ(rcAttr->value->integer().value, 42);
+    EXPECT_EQ(calls, 1);
+}
+
+TEST_F(LazyFetcherAttrTest, lazyFunctionOnlyCalledOnAccess)
+{
+    int calls = 0;
+    fetchers::Input input;
+    input.attrs.insert_or_assign("type", std::string("git"));
+    input.attrs.insert_or_assign("lastModified", uint64_t(1000));
+    input.attrs.insert_or_assign(
+        "revCount",
+        fetchers::LazyAttr(
+            make_ref<fetchers::LazyAttrComputation>(
+                fetchers::LazyAttrComputation{.compute = [&calls]() -> fetchers::ResolvedAttr {
+                    calls++;
+                    return uint64_t(99);
+                }})));
+
+    Value v;
+    emitTreeAttrs(state, dummyPath(), input, v, false, false);
+    state.forceValue(v, noPos);
+
+    // Access lastModified, so should not trigger lazy revCount
+    auto * lmAttr = v.attrs()->get(state.symbols.create("lastModified"));
+    ASSERT_NE(lmAttr, nullptr);
+    state.forceValue(*lmAttr->value, noPos);
+    EXPECT_EQ(lmAttr->value->integer().value, 1000);
+    EXPECT_EQ(calls, 0);
+
+    // Now access revCount
+    auto * rcAttr = v.attrs()->get(state.symbols.create("revCount"));
+    ASSERT_NE(rcAttr, nullptr);
+    state.forceValue(*rcAttr->value, noPos);
+    EXPECT_EQ(rcAttr->value->integer().value, 99);
+    EXPECT_EQ(calls, 1);
+}
+
+} // namespace nix
diff --git a/src/libexpr-tests/meson.build b/src/libexpr-tests/meson.build
index 0b0a01c20654..0927ee24b2b2 100644
--- a/src/libexpr-tests/meson.build
+++ b/src/libexpr-tests/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -51,7 +51,9 @@ sources = files(
   'error_traces.cc',
   'eval.cc',
   'json.cc',
+  'lazy-fetcher-attr.cc',
   'main.cc',
+  'nix_api_eval.cc',
   'nix_api_expr.cc',
   'nix_api_external.cc',
   'nix_api_value.cc',
diff --git a/src/libexpr-tests/nix_api_eval.cc b/src/libexpr-tests/nix_api_eval.cc
new file mode 100644
index 000000000000..9d2117678735
--- /dev/null
+++ b/src/libexpr-tests/nix_api_eval.cc
@@ -0,0 +1,259 @@
+#include "nix_api_store.h"
+#include "nix_api_util.h"
+#include "nix_api_expr.h"
+#include "nix_api_value.h"
+
+#include "nix/expr/tests/nix_api_expr.hh"
+#include "nix/util/tests/string_callback.hh"
+#include "nix/util/tests/gmock-matchers.hh"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+namespace nixC {
+
+// nix_get_derivation
+
+TEST_F(nix_api_expr_test, nix_get_derivation_returns_drv_path)
+{
+    auto expr = R"(derivation { name = "myname"; builder = "mybuilder"; system = "mysystem"; })";
+    nix_expr_eval_from_string(ctx, state, expr, ".", value);
+    assert_ctx_ok();
+
+    StorePath * drvPath = nix_get_derivation(ctx, state, value, false);
+    assert_ctx_ok();
+    ASSERT_NE(nullptr, drvPath);
+
+    std::string name;
+    nix_store_path_name(drvPath, OBSERVE_STRING(name));
+    EXPECT_THAT(name, ::testing::HasSubstr("myname"));
+    EXPECT_THAT(name, ::testing::EndsWith(".drv"));
+
+    nix_store_path_free(drvPath);
+}
+
+TEST_F(nix_api_expr_test, nix_get_derivation_non_derivation_returns_null_without_error)
+{
+    nix_expr_eval_from_string(ctx, state, "{ a = 1; }", ".", value);
+    assert_ctx_ok();
+
+    StorePath * drvPath = nix_get_derivation(ctx, state, value, false);
+    // Not a derivation: NULL with no error recorded, so the caller can tell
+    // this apart from a genuine failure.
+    ASSERT_EQ(nullptr, drvPath);
+    ASSERT_EQ(NIX_OK, nix_err_code(ctx));
+}
+
+TEST_F(nix_api_expr_test, nix_get_derivation_non_attrset_returns_null_without_error)
+{
+    nix_expr_eval_from_string(ctx, state, "42", ".", value);
+    assert_ctx_ok();
+
+    StorePath * drvPath = nix_get_derivation(ctx, state, value, false);
+    ASSERT_EQ(nullptr, drvPath);
+    ASSERT_EQ(NIX_OK, nix_err_code(ctx));
+}
+
+TEST_F(nix_api_expr_test, nix_get_derivation_null_value_is_error)
+{
+    StorePath * drvPath = nix_get_derivation(ctx, state, nullptr, false);
+    ASSERT_EQ(nullptr, drvPath);
+    ASSERT_NE(NIX_OK, nix_err_code(ctx));
+}
+
+// A derivation-shaped attribute set whose `name` throws an assertion only when
+// forced. The outer set is already WHNF, so nix_get_derivation is what triggers
+// the failure (while reading the name), exercising the assertion handling.
+static constexpr const char * ASSERTING_DRV = R"({ type = "derivation"; name = assert false; "myname"; })";
+
+TEST_F(nix_api_expr_test, nix_get_derivation_assertion_ignored)
+{
+    nix_expr_eval_from_string(ctx, state, ASSERTING_DRV, ".", value);
+    assert_ctx_ok();
+
+    // With ignoreAssertionFailures = true the assertion is swallowed and the
+    // value is reported as "not a derivation": NULL with no error.
+    StorePath * drvPath = nix_get_derivation(ctx, state, value, true);
+    ASSERT_EQ(nullptr, drvPath);
+    ASSERT_EQ(NIX_OK, nix_err_code(ctx));
+}
+
+TEST_F(nix_api_expr_test, nix_get_derivation_assertion_propagated)
+{
+    nix_expr_eval_from_string(ctx, state, ASSERTING_DRV, ".", value);
+    assert_ctx_ok();
+
+    // With ignoreAssertionFailures = false the assertion surfaces as an error.
+    StorePath * drvPath = nix_get_derivation(ctx, state, value, false);
+    ASSERT_EQ(nullptr, drvPath);
+    ASSERT_EQ(NIX_ERR_NIX_ERROR, nix_err_code(ctx));
+    ASSERT_THAT(nix_err_msg(nullptr, ctx, nullptr), ::testing::HasSubstr("assert"));
+}
+
+// nix_value_auto_call_function
+
+TEST_F(nix_api_expr_test, nix_value_auto_call_function_supplies_args)
+{
+    nix_expr_eval_from_string(ctx, state, "{ a, b }: a + b", ".", value);
+    assert_ctx_ok();
+
+    nix_value * args = nix_alloc_value(ctx, state);
+    nix_expr_eval_from_string(ctx, state, "{ a = 1; b = 2; }", ".", args);
+    assert_ctx_ok();
+
+    nix_value * result = nix_alloc_value(ctx, state);
+    nix_value_auto_call_function(ctx, state, args, value, result);
+    assert_ctx_ok();
+
+    ASSERT_EQ(3, nix_get_int(ctx, result));
+
+    nix_gc_decref(ctx, args);
+    nix_gc_decref(ctx, result);
+}
+
+TEST_F(nix_api_expr_test, nix_value_auto_call_function_uses_defaults)
+{
+    nix_expr_eval_from_string(ctx, state, "{ a, b ? 10 }: a + b", ".", value);
+    assert_ctx_ok();
+
+    nix_value * args = nix_alloc_value(ctx, state);
+    nix_expr_eval_from_string(ctx, state, "{ a = 5; }", ".", args);
+    assert_ctx_ok();
+
+    nix_value * result = nix_alloc_value(ctx, state);
+    nix_value_auto_call_function(ctx, state, args, value, result);
+    assert_ctx_ok();
+
+    ASSERT_EQ(15, nix_get_int(ctx, result));
+
+    nix_gc_decref(ctx, args);
+    nix_gc_decref(ctx, result);
+}
+
+TEST_F(nix_api_expr_test, nix_value_auto_call_function_forces_auto_args)
+{
+    nix_expr_eval_from_string(ctx, state, "{ a }: a + 1", ".", value);
+    assert_ctx_ok();
+
+    nix_value * identity = nix_alloc_value(ctx, state);
+    nix_expr_eval_from_string(ctx, state, "x: x", ".", identity);
+    assert_ctx_ok();
+
+    nix_value * attrs = nix_alloc_value(ctx, state);
+    nix_expr_eval_from_string(ctx, state, "{ a = 4; }", ".", attrs);
+    assert_ctx_ok();
+
+    nix_value * args = nix_alloc_value(ctx, state);
+    nix_init_apply(ctx, args, identity, attrs);
+    assert_ctx_ok();
+
+    nix_value * result = nix_alloc_value(ctx, state);
+    nix_value_auto_call_function(ctx, state, args, value, result);
+    assert_ctx_ok();
+
+    ASSERT_EQ(5, nix_get_int(ctx, result));
+
+    nix_gc_decref(ctx, identity);
+    nix_gc_decref(ctx, attrs);
+    nix_gc_decref(ctx, args);
+    nix_gc_decref(ctx, result);
+}
+
+TEST_F(nix_api_expr_test, nix_value_auto_call_function_non_attr_auto_args_is_error)
+{
+    nix_expr_eval_from_string(ctx, state, "{ a ? 7 }: a", ".", value);
+    assert_ctx_ok();
+
+    nix_value * args = nix_alloc_value(ctx, state);
+    nix_init_int(ctx, args, 42);
+    assert_ctx_ok();
+
+    nix_value * result = nix_alloc_value(ctx, state);
+    nix_value_auto_call_function(ctx, state, args, value, result);
+    ASSERT_EQ(NIX_ERR_NIX_ERROR, nix_err_code(ctx));
+    ASSERT_THAT(nix_err_msg(nullptr, ctx, nullptr), ::nix::testing::HasSubstrIgnoreANSIMatcher("expected a set"));
+
+    nix_gc_decref(ctx, args);
+    nix_gc_decref(ctx, result);
+}
+
+TEST_F(nix_api_expr_test, nix_value_auto_call_function_null_args_uses_defaults)
+{
+    nix_expr_eval_from_string(ctx, state, "{ a ? 7 }: a", ".", value);
+    assert_ctx_ok();
+
+    nix_value * result = nix_alloc_value(ctx, state);
+    // NULL auto_args supplies no arguments; every formal must then have a
+    // default.
+    nix_value_auto_call_function(ctx, state, nullptr, value, result);
+    assert_ctx_ok();
+
+    ASSERT_EQ(7, nix_get_int(ctx, result));
+
+    nix_gc_decref(ctx, result);
+}
+
+TEST_F(nix_api_expr_test, nix_value_auto_call_function_missing_arg_is_error)
+{
+    nix_expr_eval_from_string(ctx, state, "{ a, b }: a + b", ".", value);
+    assert_ctx_ok();
+
+    nix_value * args = nix_alloc_value(ctx, state);
+    nix_expr_eval_from_string(ctx, state, "{ a = 1; }", ".", args);
+    assert_ctx_ok();
+
+    nix_value * result = nix_alloc_value(ctx, state);
+    // 'b' has neither a supplied value nor a default. The argument name in the
+    // message is colorized, so use the ANSI-stripping matcher to assert on it.
+    nix_value_auto_call_function(ctx, state, args, value, result);
+    ASSERT_EQ(NIX_ERR_NIX_ERROR, nix_err_code(ctx));
+    ASSERT_THAT(
+        nix_err_msg(nullptr, ctx, nullptr),
+        ::nix::testing::HasSubstrIgnoreANSIMatcher(
+            "cannot evaluate a function that has an argument without a value ('b')"));
+
+    nix_gc_decref(ctx, args);
+    nix_gc_decref(ctx, result);
+}
+
+TEST_F(nix_api_expr_test, nix_value_auto_call_function_non_function_passthrough)
+{
+    nix_expr_eval_from_string(ctx, state, "42", ".", value);
+    assert_ctx_ok();
+
+    nix_value * result = nix_alloc_value(ctx, state);
+    // A non-function value is returned unchanged.
+    nix_value_auto_call_function(ctx, state, nullptr, value, result);
+    assert_ctx_ok();
+
+    ASSERT_EQ(42, nix_get_int(ctx, result));
+
+    nix_gc_decref(ctx, result);
+}
+
+TEST_F(nix_api_expr_test, nix_value_auto_call_function_single_arg_lambda_passthrough)
+{
+    nix_expr_eval_from_string(ctx, state, "x: x + 1", ".", value);
+    assert_ctx_ok();
+
+    nix_value * result = nix_alloc_value(ctx, state);
+    // A function taking a single unnamed argument has no named arguments to
+    // fill, so it is returned unchanged rather than being called.
+    nix_value_auto_call_function(ctx, state, nullptr, value, result);
+    assert_ctx_ok();
+
+    ASSERT_EQ(NIX_TYPE_FUNCTION, nix_get_type(ctx, result));
+
+    nix_gc_decref(ctx, result);
+}
+
+TEST_F(nix_api_expr_test, nix_value_auto_call_function_null_fn_is_error)
+{
+    nix_value * result = nix_alloc_value(ctx, state);
+    nix_value_auto_call_function(ctx, state, nullptr, nullptr, result);
+    ASSERT_NE(NIX_OK, nix_err_code(ctx));
+
+    nix_gc_decref(ctx, result);
+}
+
+} // namespace nixC
diff --git a/src/libexpr-tests/nix_api_expr.cc b/src/libexpr-tests/nix_api_expr.cc
index c3a3f2dd53b1..8362e6850892 100644
--- a/src/libexpr-tests/nix_api_expr.cc
+++ b/src/libexpr-tests/nix_api_expr.cc
@@ -20,8 +20,8 @@ TEST_F(nix_api_expr_test, nix_eval_state_lookup_path)
     auto delTmpDir = std::make_unique<nix::AutoDelete>(tmpDir, true);
     auto nixpkgs = tmpDir / "pkgs";
     auto nixos = tmpDir / "cfg";
-    std::filesystem::create_directories(nixpkgs);
-    std::filesystem::create_directories(nixos);
+    nix::createDirs(nixpkgs);
+    nix::createDirs(nixos);
 
     std::string nixpkgsEntry = "nixpkgs=" + nixpkgs.string();
     std::string nixosEntry = "nixos-config=" + nixos.string();
diff --git a/src/libexpr-tests/nix_api_external.cc b/src/libexpr-tests/nix_api_external.cc
index e17a52c31dfc..408fbaa83d73 100644
--- a/src/libexpr-tests/nix_api_external.cc
+++ b/src/libexpr-tests/nix_api_external.cc
@@ -104,4 +104,34 @@ TEST_F(nix_api_expr_test, nix_external_printValueAsJSON_can_use_state)
     nix_gc_decref(ctx, toJsonFn);
 }
 
+TEST_F(nix_api_expr_test, nix_get_external_roundtrip)
+{
+    int content = 42;
+    NixCExternalValueDesc desc{};
+    ExternalValue * ext = nix_create_external_value(ctx, &desc, &content);
+    assert_ctx_ok();
+    ASSERT_NE(nullptr, ext);
+
+    nix_init_external(ctx, value, ext);
+    assert_ctx_ok();
+
+    nix_value_force(ctx, state, value);
+    assert_ctx_ok();
+
+    ExternalValue * retrieved = nix_get_external(ctx, value);
+    assert_ctx_ok();
+    ASSERT_NE(nullptr, retrieved);
+
+    void * content_ptr = nix_get_external_value_content(ctx, retrieved);
+    assert_ctx_ok();
+    ASSERT_EQ(&content, content_ptr);
+
+    nix_gc_decref(ctx, ext);
+}
+
+TEST_F(nix_api_expr_test, nix_get_external_value_content_null)
+{
+    ASSERT_EQ(nullptr, nix_get_external_value_content(ctx, nullptr));
+}
+
 } // namespace nixC
diff --git a/src/libexpr-tests/nix_api_value.cc b/src/libexpr-tests/nix_api_value.cc
index 01d15744a750..d7f685205ca3 100644
--- a/src/libexpr-tests/nix_api_value.cc
+++ b/src/libexpr-tests/nix_api_value.cc
@@ -119,6 +119,14 @@ TEST_F(nix_api_expr_test, nix_value_set_get_path)
     ASSERT_EQ(NIX_TYPE_PATH, nix_get_type(ctx, value));
 }
 
+TEST_F(nix_api_expr_test, nix_get_external_invalid)
+{
+    ASSERT_EQ(nullptr, nix_get_external(ctx, nullptr));
+    assert_ctx_err();
+    ASSERT_EQ(nullptr, nix_get_external(ctx, value));
+    assert_ctx_err();
+}
+
 TEST_F(nix_api_expr_test, nix_build_and_init_list_invalid)
 {
     ASSERT_EQ(nullptr, nix_get_list_byidx(ctx, nullptr, state, 0));
diff --git a/src/libexpr-tests/primops.cc b/src/libexpr-tests/primops.cc
index fc4f6c0702aa..fef732e1e3f5 100644
--- a/src/libexpr-tests/primops.cc
+++ b/src/libexpr-tests/primops.cc
@@ -4,47 +4,10 @@
 #include "nix/expr/eval-settings.hh"
 #include "nix/util/memory-source-accessor.hh"
 
+#include "nix/util/tests/capture-logging.hh"
 #include "nix/expr/tests/libexpr.hh"
 
 namespace nix {
-class CaptureLogger : public Logger
-{
-    std::ostringstream oss;
-
-public:
-    CaptureLogger() {}
-
-    std::string get() const
-    {
-        return oss.str();
-    }
-
-    void log(Verbosity lvl, std::string_view s) override
-    {
-        oss << s << std::endl;
-    }
-
-    void logEI(const ErrorInfo & ei) override
-    {
-        showErrorInfo(oss, ei, loggerSettings.showTrace.get());
-    }
-};
-
-class CaptureLogging
-{
-    std::unique_ptr<Logger> oldLogger;
-public:
-    CaptureLogging()
-    {
-        oldLogger = std::move(logger);
-        logger = std::make_unique<CaptureLogger>();
-    }
-
-    ~CaptureLogging()
-    {
-        logger = std::move(oldLogger);
-    }
-};
 
 // Testing eval of PrimOp's
 class PrimOpTest : public LibExprTest
@@ -141,11 +104,10 @@ TEST_F(PrimOpTest, deepSeq)
 
 TEST_F(PrimOpTest, trace)
 {
-    CaptureLogging l;
+    testing::CaptureLogging l;
     auto v = eval("builtins.trace \"test string 123\" 123");
     ASSERT_THAT(v, IsIntEq(123));
-    auto text = (dynamic_cast<CaptureLogger *>(logger.get()))->get();
-    ASSERT_NE(text.find("test string 123"), std::string::npos);
+    ASSERT_THAT(l.get(), ::testing::HasSubstr("test string 123"));
 }
 
 TEST_F(PrimOpTest, placeholder)
diff --git a/src/libexpr-tests/value/context.cc b/src/libexpr-tests/value/context.cc
index 544f03f3f2e3..c2c5cd3e8bbc 100644
--- a/src/libexpr-tests/value/context.cc
+++ b/src/libexpr-tests/value/context.cc
@@ -120,8 +120,6 @@ TEST(NixStringContextElemTest, built_built_xp)
         NixStringContextElem::parse("!foo!bar!g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-x.drv"), MissingExperimentalFeature);
 }
 
-#ifndef COVERAGE
-
 RC_GTEST_PROP(NixStringContextElemTest, prop_round_rip, (const NixStringContextElem & o))
 {
     ExperimentalFeatureSettings xpSettings;
@@ -129,6 +127,4 @@ RC_GTEST_PROP(NixStringContextElemTest, prop_round_rip, (const NixStringContextE
     RC_ASSERT(o == NixStringContextElem::parse(o.to_string(), xpSettings));
 }
 
-#endif
-
 } // namespace nix
diff --git a/src/libexpr-tests/value/print.cc b/src/libexpr-tests/value/print.cc
index 654a50b0ae0b..0082b6eac75e 100644
--- a/src/libexpr-tests/value/print.cc
+++ b/src/libexpr-tests/value/print.cc
@@ -6,8 +6,6 @@
 
 namespace nix {
 
-using namespace testing;
-
 struct ValuePrintingTests : LibExprTest
 {
     template<class... A>
diff --git a/src/libexpr/attr-path.cc b/src/libexpr/attr-path.cc
index c57b90112886..d512baa92493 100644
--- a/src/libexpr/attr-path.cc
+++ b/src/libexpr/attr-path.cc
@@ -5,6 +5,10 @@
 
 namespace nix {
 
+void AttrPathNotFound::anchor() {}
+
+void NoPositionInfo::anchor() {}
+
 static Strings parseAttrPath(std::string_view s)
 {
     Strings res;
@@ -51,7 +55,7 @@ std::vector<SymbolStr> AttrPath::resolve(EvalState & state) const
 }
 
 std::pair<Value *, PosIdx>
-findAlongAttrPath(EvalState & state, const std::string & attrPath, Bindings & autoArgs, Value & vIn)
+findAlongAttrPath(EvalState & state, const std::string & attrPath, const Bindings & autoArgs, Value & vIn)
 {
     Strings tokens = parseAttrPath(attrPath);
 
diff --git a/src/libexpr/attr-set.cc b/src/libexpr/attr-set.cc
index 92b67f6ad25e..08412c7be9ca 100644
--- a/src/libexpr/attr-set.cc
+++ b/src/libexpr/attr-set.cc
@@ -5,7 +5,7 @@
 
 namespace nix {
 
-Bindings Bindings::emptyBindings;
+const constinit Bindings Bindings::emptyBindings;
 
 /* Allocate a new array of attributes for an attribute set with a specific
    capacity. The space is implicitly reserved after the Bindings
@@ -13,7 +13,8 @@ Bindings Bindings::emptyBindings;
 Bindings * EvalMemory::allocBindings(size_t capacity)
 {
     if (capacity == 0)
-        return &Bindings::emptyBindings;
+        /* Swear that we are not going to modify this. */
+        return const_cast<Bindings *>(&Bindings::emptyBindings);
     if (capacity > std::numeric_limits<Bindings::size_type>::max())
         throw Error("attribute set of size %d is too big", capacity);
     stats.nrAttrsets++;
diff --git a/src/libexpr/eval-cache.cc b/src/libexpr/eval-cache.cc
index a419530c6dd8..7422cd095bc6 100644
--- a/src/libexpr/eval-cache.cc
+++ b/src/libexpr/eval-cache.cc
@@ -10,6 +10,8 @@
 
 namespace nix::eval_cache {
 
+void CachedEvalError::anchor() {}
+
 CachedEvalError::CachedEvalError(ref<AttrCursor> cursor, Symbol attr)
     : CloneableError(cursor->root->state, "cached failure of attribute '%s'", cursor->getAttrPathStr(attr))
     , cursor(cursor)
@@ -106,7 +108,7 @@ struct AttrDb
     }
 
     template<typename F>
-    AttrId doSQLite(F && fun)
+    AttrId doSQLite(const F & fun)
     {
         if (failed)
             return 0;
@@ -124,13 +126,23 @@ struct AttrDb
         return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::FullAttrs) (0, false).exec();
+            state->insertAttribute.use()
+                .apply(key.first)
+                .apply(symbols[key.second])
+                .apply(AttrType::FullAttrs)
+                .apply(0, false)
+                .exec();
 
             AttrId rowId = state->db.getLastInsertedRowId();
             assert(rowId);
 
             for (auto & attr : attrs)
-                state->insertAttribute.use()(rowId)(symbols[attr])(AttrType::Placeholder) (0, false).exec();
+                state->insertAttribute.use()
+                    .apply(rowId)
+                    .apply(symbols[attr])
+                    .apply(AttrType::Placeholder)
+                    .apply(0, false)
+                    .exec();
 
             return rowId;
         });
@@ -150,10 +162,20 @@ struct AttrDb
                     ctx.append(elem->view());
                     first = false;
                 }
-                state->insertAttributeWithContext.use()(key.first)(symbols[key.second])(AttrType::String) (s) (ctx)
+                state->insertAttributeWithContext.use()
+                    .apply(key.first)
+                    .apply(symbols[key.second])
+                    .apply(AttrType::String)
+                    .apply(s)
+                    .apply(ctx)
                     .exec();
             } else {
-                state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::String) (s).exec();
+                state->insertAttribute.use()
+                    .apply(key.first)
+                    .apply(symbols[key.second])
+                    .apply(AttrType::String)
+                    .apply(s)
+                    .exec();
             }
 
             return state->db.getLastInsertedRowId();
@@ -165,7 +187,12 @@ struct AttrDb
         return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::Bool) (b ? 1 : 0).exec();
+            state->insertAttribute.use()
+                .apply(key.first)
+                .apply(symbols[key.second])
+                .apply(AttrType::Bool)
+                .apply(b ? 1 : 0)
+                .exec();
 
             return state->db.getLastInsertedRowId();
         });
@@ -176,7 +203,12 @@ struct AttrDb
         return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::Int) (n).exec();
+            state->insertAttribute.use()
+                .apply(key.first)
+                .apply(symbols[key.second])
+                .apply(AttrType::Int)
+                .apply(n)
+                .exec();
 
             return state->db.getLastInsertedRowId();
         });
@@ -187,9 +219,11 @@ struct AttrDb
         return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute
-                .use()(key.first)(symbols[key.second])(
-                    AttrType::ListOfStrings) (dropEmptyInitThenConcatStringsSep("\t", l))
+            state->insertAttribute.use()
+                .apply(key.first)
+                .apply(symbols[key.second])
+                .apply(AttrType::ListOfStrings)
+                .apply(dropEmptyInitThenConcatStringsSep("\t", l))
                 .exec();
 
             return state->db.getLastInsertedRowId();
@@ -201,7 +235,12 @@ struct AttrDb
         return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::Placeholder) (0, false).exec();
+            state->insertAttribute.use()
+                .apply(key.first)
+                .apply(symbols[key.second])
+                .apply(AttrType::Placeholder)
+                .apply(0, false)
+                .exec();
 
             return state->db.getLastInsertedRowId();
         });
@@ -212,7 +251,12 @@ struct AttrDb
         return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::Missing) (0, false).exec();
+            state->insertAttribute.use()
+                .apply(key.first)
+                .apply(symbols[key.second])
+                .apply(AttrType::Missing)
+                .apply(0, false)
+                .exec();
 
             return state->db.getLastInsertedRowId();
         });
@@ -223,7 +267,12 @@ struct AttrDb
         return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::Misc) (0, false).exec();
+            state->insertAttribute.use()
+                .apply(key.first)
+                .apply(symbols[key.second])
+                .apply(AttrType::Misc)
+                .apply(0, false)
+                .exec();
 
             return state->db.getLastInsertedRowId();
         });
@@ -234,7 +283,12 @@ struct AttrDb
         return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::Failed) (0, false).exec();
+            state->insertAttribute.use()
+                .apply(key.first)
+                .apply(symbols[key.second])
+                .apply(AttrType::Failed)
+                .apply(0, false)
+                .exec();
 
             return state->db.getLastInsertedRowId();
         });
@@ -244,7 +298,7 @@ struct AttrDb
     {
         auto state(_state->lock());
 
-        auto queryAttribute(state->queryAttribute.use()(key.first)(symbols[key.second]));
+        auto queryAttribute(state->queryAttribute.use().apply(key.first).apply(symbols[key.second]));
         if (!queryAttribute.next())
             return {};
 
@@ -257,7 +311,7 @@ struct AttrDb
         case AttrType::FullAttrs: {
             // FIXME: expensive, should separate this out.
             std::vector<Symbol> attrs;
-            auto queryAttributes(state->queryAttributes.use()(rowId));
+            auto queryAttributes(state->queryAttributes.use().apply(rowId));
             while (queryAttributes.next())
                 attrs.emplace_back(symbols.create(queryAttributes.getStr(0)));
             return {{rowId, attrs}};
@@ -563,6 +617,7 @@ string_t AttrCursor::getStringWithContext()
                             [&](const NixStringContextElem::Opaque & o) -> const StorePath & { return o.path; },
                         },
                         c.raw);
+                    root->state.store->addTempRoot(path);
                     if (!root->state.store->isValidPath(path)) {
                         valid = false;
                         break;
diff --git a/src/libexpr/eval-error.cc b/src/libexpr/eval-error.cc
index 45cb1e409dd1..ba72b05e98a6 100644
--- a/src/libexpr/eval-error.cc
+++ b/src/libexpr/eval-error.cc
@@ -1,11 +1,12 @@
 #include "nix/expr/eval-error.hh"
 #include "nix/expr/eval.hh"
 #include "nix/expr/value.hh"
+#include "nix/store/store-api.hh"
 
 namespace nix {
 
 InvalidPathError::InvalidPathError(EvalState & state, const StorePath & path)
-    : CloneableError(state, "path '%s' is not valid", path.to_string())
+    : CloneableError(state, "path '%s' is not valid", state.store->printStorePath(path))
     , path{path}
 {
 }
@@ -96,7 +97,7 @@ void EvalErrorBuilder<T>::debugThrow()
     auto error = std::move(this->error);
     delete this;
 
-    throw error;
+    throw std::move(error);
 }
 
 template<class T>
@@ -122,4 +123,32 @@ template class EvalErrorBuilder<InvalidPathError>;
 template class EvalErrorBuilder<IFDError>;
 template class EvalErrorBuilder<RecoverableEvalError>;
 
+void EvalBaseError::anchor() {}
+
+void ParseError::anchor() {}
+
+void EvalError::anchor() {}
+
+void AssertionError::anchor() {}
+
+void ThrownError::anchor() {}
+
+void Abort::anchor() {}
+
+void TypeError::anchor() {}
+
+void UndefinedVarError::anchor() {}
+
+void MissingArgumentError::anchor() {}
+
+void InfiniteRecursionError::anchor() {}
+
+void StackOverflowError::anchor() {}
+
+void InvalidPathError::anchor() {}
+
+void IFDError::anchor() {}
+
+void RecoverableEvalError::anchor() {}
+
 } // namespace nix
diff --git a/src/libexpr/eval-gc.cc b/src/libexpr/eval-gc.cc
index 9344b0405b17..5bdcd7984644 100644
--- a/src/libexpr/eval-gc.cc
+++ b/src/libexpr/eval-gc.cc
@@ -74,6 +74,21 @@ static inline void initGCReal()
 
     GC_set_oom_fn(oomHandler);
 
+    /* Funnel boehm warnings into debug logs. */
+    GC_set_warn_proc([](char * msg, GC_word word) noexcept {
+        std::array<char, 4096> buffer{};
+        auto res = snprintf(buffer.data(), buffer.size(), msg, word);
+        /* Ignore garbage. */
+        if (res < 0)
+            return;
+
+        try {
+            debug("%s", chomp(std::string_view(buffer.data(), std::min<size_t>(res, buffer.size() - 1))));
+        } catch (...) {
+            /* Swallow all errors. */
+        }
+    });
+
     /* Set the initial heap size to something fairly big (25% of
        physical RAM, up to a maximum of 384 MiB) so that in most cases
        we don't need to garbage collect at all.  (Collection has a
diff --git a/src/libexpr/eval-settings.cc b/src/libexpr/eval-settings.cc
index 5cf0ae04304e..c438ff6c9fb9 100644
--- a/src/libexpr/eval-settings.cc
+++ b/src/libexpr/eval-settings.cc
@@ -7,6 +7,8 @@
 
 namespace nix {
 
+void EvalSettings::anchor() {}
+
 void DeprecatedWarnSetting::assign(const bool & v)
 {
     value = v;
@@ -70,7 +72,7 @@ Strings EvalSettings::parseNixPath(const std::string & s)
 }
 
 EvalSettings::EvalSettings(bool & readOnlyMode, EvalSettings::LookupPathHooks lookupPathHooks)
-    : readOnlyMode{readOnlyMode}
+    : readOnlyMode{&readOnlyMode}
     , lookupPathHooks{lookupPathHooks}
 {
     auto var = getEnv("NIX_ABORT_ON_WARN");
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 1d66b8ead1c9..7c92649b68e3 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -6,6 +6,7 @@
 #include "nix/expr/symbol-table.hh"
 #include "nix/expr/value.hh"
 #include "nix/util/exit.hh"
+#include "nix/util/signals.hh"
 #include "nix/util/types.hh"
 #include "nix/util/util.hh"
 #include "nix/util/environment-variables.hh"
@@ -277,6 +278,8 @@ EvalState::EvalState(
            mounted fetchTree. */
         auto accessor = settings.pureEval ? storeFS.cast<SourceAccessor>()
                                           : makeUnionSourceAccessor({getFSSourceAccessor(), storeFS});
+        /* Cache positive lstat/readlink results to speed up resolveSymlinks. */
+        accessor = makeCachingSourceAccessor(accessor);
 
         /* Apply access control if needed. */
         if (settings.restrictEval || settings.pureEval)
@@ -293,15 +296,20 @@ EvalState::EvalState(
     , internalFS(make_ref<MemorySourceAccessor>())
     , derivationInternal{internalFS->addFile(
           CanonPath("derivation-internal.nix"),
-#include "primops/derivation.nix.gen.hh"
-          )}
+          {
+#embed "primops/derivation.nix"
+          })}
+    , importedDrvToDerivation{internalFS->addFile(
+          CanonPath("imported-drv-to-derivation.nix"),
+          {
+#embed "imported-drv-to-derivation.nix"
+          })}
     , store(store)
     , buildStore(buildStore ? buildStore : store)
     , inputCache(fetchers::InputCache::create())
     , debugRepl(nullptr)
     , debugStop(false)
     , trylevel(0)
-    , srcToStore(make_ref<decltype(srcToStore)::element_type>())
     , importResolutionCache(make_ref<decltype(importResolutionCache)::element_type>())
     , fileEvalCache(make_ref<decltype(fileEvalCache)::element_type>())
     , positionToDocComment(make_ref<decltype(positionToDocComment)::element_type>())
@@ -357,8 +365,9 @@ EvalState::EvalState(
 
     corepkgsFS->addFile(
         CanonPath("fetchurl.nix"),
-#include "fetchurl.nix.gen.hh"
-    );
+        {
+#embed "fetchurl.nix"
+        });
 
     createBaseEnv(settings);
 
@@ -661,27 +670,34 @@ std::optional<EvalState::Doc> EvalState::getDoc(Value & v)
     return {};
 }
 
+static StaticEnv::Vars lexicographicOrder(const SymbolTable & st, StaticEnv::Vars vars)
+{
+    std::ranges::sort(vars, [&st](const auto & lhs, const auto & rhs) {
+        return std::string_view(st[lhs.first]) < std::string_view(st[rhs.first]);
+    });
+    return vars;
+}
+
 // just for the current level of StaticEnv, not the whole chain.
-void printStaticEnvBindings(const SymbolTable & st, const StaticEnv & se)
+static void printStaticEnvBindings(const SymbolTable & st, const StaticEnv & se)
 {
     std::cout << ANSI_MAGENTA;
-    for (auto & i : se.vars)
-        std::cout << st[i.first] << " ";
+    for (auto & [name, displacement] : lexicographicOrder(st, se.vars))
+        std::cout << st[name] << " ";
     std::cout << ANSI_NORMAL;
     std::cout << std::endl;
 }
 
 // just for the current level of Env, not the whole chain.
-void printWithBindings(const SymbolTable & st, const Env & env)
+static void printWithBindings(const SymbolTable & st, const Env & env)
 {
     if (!env.values[0]->isThunk()) {
         std::cout << "with: ";
         std::cout << ANSI_MAGENTA;
-        auto j = env.values[0]->attrs()->begin();
-        while (j != env.values[0]->attrs()->end()) {
-            std::cout << st[j->name] << " ";
-            ++j;
-        }
+        auto * bindings = env.values[0]->attrs();
+        /* TODO: Don't print the whole attribute set, since it can be quite large. */
+        for (const Attr * attr : bindings->lexicographicOrder(st))
+            std::cout << st[attr->name] << " ";
         std::cout << ANSI_NORMAL;
         std::cout << std::endl;
     }
@@ -702,7 +718,7 @@ void printEnvBindings(const SymbolTable & st, const StaticEnv & se, const Env &
         std::cout << ANSI_MAGENTA;
         // for the top level, don't print the double underscore ones;
         // they are in builtins.
-        for (auto & i : se.vars)
+        for (auto & i : lexicographicOrder(st, se.vars))
             if (!hasPrefix(st[i.first], "__"))
                 std::cout << st[i.first] << " ";
         std::cout << ANSI_NORMAL;
@@ -1086,6 +1102,8 @@ Value * ExprPath::maybeThunk(EvalState & state, Env & env)
     return &v;
 }
 
+namespace {
+
 /**
  * A helper `Expr` class to lets us parse and evaluate Nix expressions
  * from a thunk, ensuring that every file is parsed/evaluated only
@@ -1129,6 +1147,8 @@ struct ExprParseFile : Expr, gc
     }
 };
 
+} // namespace
+
 void EvalState::evalFile(const SourcePath & path, Value & v, bool mustBeTrivial)
 {
     auto resolvedPath = getConcurrent(*importResolutionCache, path);
@@ -1171,7 +1191,8 @@ void EvalState::resetFileCache()
     importResolutionCache->clear();
     fileEvalCache->clear();
     inputCache->clear();
-    positions.clear();
+    lookupPathResolved->clear();
+    rootFS->invalidateCache();
 }
 
 void EvalState::eval(Expr * e, Value & v)
@@ -1341,7 +1362,11 @@ void ExprAttrs::eval(EvalState & state, Env & env, Value & v)
         sort = true;
     }
 
-    bindings.bindings->pos = pos;
+    /* FIXME: Currently we can't track the positions of empty bindings. A way
+       to fix this is to store the position in the Value storage with more
+       clever bitpacking (we have spare 32 bits in the Bindings * variant). */
+    if (bindings.bindings != &Bindings::emptyBindings)
+        bindings.bindings->pos = pos;
 
     v.mkAttrs(sort ? bindings.finish() : bindings.alreadySorted());
 }
@@ -2208,6 +2233,8 @@ void EvalState::handleEvalExceptionForThunk(Env * env, Expr * expr, Value & v, c
     Value * recovery = nullptr;
     try {
         std::rethrow_exception(e);
+    } catch (const Interrupted & e) {
+        recovery = allocValue();
     } catch (const RecoverableEvalError & e) {
         recovery = allocValue();
     } catch (...) {
@@ -2225,6 +2252,8 @@ void EvalState::handleEvalExceptionForApp(Value & v, const Value & savedApp)
     Value * recovery = nullptr;
     try {
         std::rethrow_exception(e);
+    } catch (const Interrupted & e) {
+        recovery = allocValue();
     } catch (const RecoverableEvalError & e) {
         recovery = allocValue();
     } catch (...) {
@@ -2576,23 +2605,16 @@ StorePath EvalState::copyPathToStore(NixStringContext & context, const SourcePat
     if (nix::isDerivation(path.path.abs()))
         error<EvalError>("file names are not allowed to end in '%1%'", drvExtension).debugThrow();
 
-    auto dstPathCached = getConcurrent(*srcToStore, path);
-
-    auto dstPath = dstPathCached ? *dstPathCached : [&]() {
-        auto dstPath = fetchToStore(
-            fetchSettings,
-            *store,
-            path.resolveSymlinks(SymlinkResolution::Ancestors),
-            settings.readOnlyMode ? FetchMode::DryRun : FetchMode::Copy,
-            path.baseName(),
-            ContentAddressMethod::Raw::NixArchive,
-            nullptr,
-            repair);
-        allowPath(dstPath);
-        srcToStore->try_emplace(path, dstPath);
-        printMsg(lvlChatty, "copied source '%1%' -> '%2%'", path, store->printStorePath(dstPath));
-        return dstPath;
-    }();
+    auto dstPath = fetchToStore(
+        fetchSettings,
+        *store,
+        path.resolveSymlinks(SymlinkResolution::Ancestors),
+        settings.isReadOnly() ? FetchMode::DryRun : FetchMode::Copy,
+        path.baseName(),
+        ContentAddressMethod::Raw::NixArchive,
+        nullptr,
+        repair);
+    allowPath(dstPath);
 
     context.insert(NixStringContextElem::Opaque{.path = dstPath});
     return dstPath;
@@ -3266,14 +3288,28 @@ SourcePath EvalState::findFile(const LookupPath & lookupPath, const std::string_
             continue;
         auto r = *rOpt;
 
-        auto res = (r / CanonPath(suffix)).resolveSymlinks();
-        if (res.pathExists())
+        auto suffixPath = CanonPath(suffix);
+        if (auto cachedRes = getConcurrent(*rOpt->resolvedPaths, suffixPath)) {
+            if (*cachedRes)
+                return **cachedRes;
+            else
+                // Cached negative lookup.
+                continue;
+        }
+
+        auto res = (r.path / suffixPath).resolveSymlinks();
+        if (res.pathExists()) {
+            r.resolvedPaths->emplace(suffixPath, res);
             return res;
+        }
 
         // Backward compatibility hack: throw an exception if access
         // to this path is not allowed.
         if (auto accessor = res.accessor.dynamic_pointer_cast<FilteringSourceAccessor>())
             accessor->checkAccess(res.path);
+
+        // Cache negative lookups too.
+        r.resolvedPaths->emplace(suffixPath, std::nullopt);
     }
 
     if (hasPrefix(path, "nix/"))
@@ -3287,17 +3323,22 @@ SourcePath EvalState::findFile(const LookupPath & lookupPath, const std::string_
         .debugThrow();
 }
 
-std::optional<SourcePath> EvalState::resolveLookupPathPath(const LookupPath::Path & value0, bool initAccessControl)
+std::shared_ptr<EvalState::LookupPathResolvedState>
+EvalState::resolveLookupPathPath(const LookupPath::Path & value0, bool initAccessControl)
 {
     auto & value = value0.s;
     if (auto cached = getConcurrent(*lookupPathResolved, value))
         return *cached;
 
-    auto finish = [&](std::optional<SourcePath> res) {
-        if (res)
-            debug("resolved search path element '%s' to '%s'", value, *res);
-        else
+    auto finish = [&](std::optional<SourcePath> maybePath) {
+        std::shared_ptr<LookupPathResolvedState> res;
+        if (maybePath) {
+            debug("resolved search path element '%s' to '%s'", value, *maybePath);
+            res = std::make_shared<LookupPathResolvedState>(
+                *maybePath, make_ref<decltype(LookupPathResolvedState::resolvedPaths)::element_type>());
+        } else {
             debug("failed to resolve search path element '%s'", value);
+        }
         lookupPathResolved->emplace(std::string(value), res);
         return res;
     };
@@ -3442,7 +3483,7 @@ void forceNoNullByte(std::string_view s, std::function<Pos()> pos)
         if (pos) {
             error.atPos(pos());
         }
-        throw error;
+        throw std::move(error);
     }
 }
 
diff --git a/src/libexpr/get-drvs.cc b/src/libexpr/get-drvs.cc
index 693b1946ee46..6416713f7b3d 100644
--- a/src/libexpr/get-drvs.cc
+++ b/src/libexpr/get-drvs.cc
@@ -162,14 +162,14 @@ PackageInfo::Outputs PackageInfo::queryOutputs(bool withPaths, bool onlyOutputsT
         auto errMsg = Error("this derivation has bad 'meta.outputsToInstall'");
         /* ^ this shows during `nix-env -i` right under the bad derivation */
         if (!outTI->isList())
-            throw errMsg;
+            throw std::move(errMsg);
         Outputs result;
         for (auto elem : outTI->listView()) {
             if (elem->type() != nString)
-                throw errMsg;
+                throw std::move(errMsg);
             auto out = outputs.find(elem->string_view());
             if (out == outputs.end())
-                throw errMsg;
+                throw std::move(errMsg);
             result.insert(*out);
         }
         return result;
@@ -393,7 +393,7 @@ static void getDerivations(
     EvalState & state,
     Value & vIn,
     const std::string & pathPrefix,
-    Bindings & autoArgs,
+    const Bindings & autoArgs,
     PackageInfos & drvs,
     Done & done,
     bool ignoreAssertionFailures)
@@ -464,7 +464,7 @@ void getDerivations(
     EvalState & state,
     Value & v,
     const std::string & pathPrefix,
-    Bindings & autoArgs,
+    const Bindings & autoArgs,
     PackageInfos & drvs,
     bool ignoreAssertionFailures)
 {
diff --git a/src/libexpr/include/nix/expr/attr-path.hh b/src/libexpr/include/nix/expr/attr-path.hh
index fd48705b8b7b..ab765ec1b1a2 100644
--- a/src/libexpr/include/nix/expr/attr-path.hh
+++ b/src/libexpr/include/nix/expr/attr-path.hh
@@ -12,7 +12,7 @@ MakeError(AttrPathNotFound, Error);
 MakeError(NoPositionInfo, Error);
 
 std::pair<Value *, PosIdx>
-findAlongAttrPath(EvalState & state, const std::string & attrPath, Bindings & autoArgs, Value & vIn);
+findAlongAttrPath(EvalState & state, const std::string & attrPath, const Bindings & autoArgs, Value & vIn);
 
 /**
  * Heuristic to find the filename and lineno or a nix value.
diff --git a/src/libexpr/include/nix/expr/attr-set.hh b/src/libexpr/include/nix/expr/attr-set.hh
index 4d3821feda97..38d654282a79 100644
--- a/src/libexpr/include/nix/expr/attr-set.hh
+++ b/src/libexpr/include/nix/expr/attr-set.hh
@@ -29,11 +29,15 @@ struct Attr
     Symbol name;
     PosIdx pos;
     Value * value = nullptr;
+
     Attr(Symbol name, Value * value, PosIdx pos = noPos)
         : name(name)
         , pos(pos)
-        , value(value) {};
-    Attr() {};
+        , value(value)
+    {
+    }
+
+    constexpr Attr() {}
 
     auto operator<=>(const Attr & a) const
     {
@@ -70,7 +74,7 @@ public:
      * An instance of bindings objects with 0 attributes.
      * This object must never be modified.
      */
-    static Bindings emptyBindings;
+    static const constinit Bindings emptyBindings;
 
 private:
     /**
@@ -101,7 +105,7 @@ private:
      */
     Attr attrs[0];
 
-    Bindings() = default;
+    constexpr Bindings() = default;
     Bindings(const Bindings &) = delete;
     Bindings(Bindings &&) = delete;
     Bindings & operator=(const Bindings &) = delete;
@@ -550,14 +554,14 @@ public:
 
     Value & alloc(std::string_view name, PosIdx pos = noPos);
 
-    Bindings * finish()
+    const Bindings * finish()
     {
         bindings->sort();
         finishSizeIfNecessary();
         return bindings;
     }
 
-    Bindings * alreadySorted()
+    const Bindings * alreadySorted()
     {
         finishSizeIfNecessary();
         return bindings;
diff --git a/src/libexpr/include/nix/expr/diagnose.hh b/src/libexpr/include/nix/expr/diagnose.hh
index 68c8f6543f59..4a360970ba21 100644
--- a/src/libexpr/include/nix/expr/diagnose.hh
+++ b/src/libexpr/include/nix/expr/diagnose.hh
@@ -44,7 +44,7 @@ NIX_DECLARE_CONFIG_SERIALISER(Diagnose)
  * @throws The error returned by mkError if level is `Fatal` and mkError returns a value
  */
 template<typename F>
-void diagnose(const Setting<Diagnose> & setting, F && mkError)
+void diagnose(const Setting<Diagnose> & setting, const F & mkError)
 {
     auto withError = [&](bool fatal, auto && handler) {
         auto maybeError = mkError(fatal);
@@ -64,7 +64,7 @@ void diagnose(const Setting<Diagnose> & setting, F && mkError)
         withError(false, [](auto && error) { logWarning(error.info()); });
         return;
     case Diagnose::Fatal:
-        withError(true, [](auto && error) { throw std::move(error); });
+        withError(true, [](auto && error) { throw std::forward<decltype(error)>(error); });
         return;
     }
 }
diff --git a/src/libexpr/include/nix/expr/eval-cache.hh b/src/libexpr/include/nix/expr/eval-cache.hh
index d2ead2bb4614..0feb7d5649ff 100644
--- a/src/libexpr/include/nix/expr/eval-cache.hh
+++ b/src/libexpr/include/nix/expr/eval-cache.hh
@@ -16,6 +16,9 @@ class AttrCursor;
 
 struct CachedEvalError : CloneableError<CachedEvalError, EvalError>
 {
+private:
+    void anchor() override;
+public:
     const ref<AttrCursor> cursor;
     const Symbol attr;
 
diff --git a/src/libexpr/include/nix/expr/eval-error.hh b/src/libexpr/include/nix/expr/eval-error.hh
index 68aa7b0643a2..8dce750e073c 100644
--- a/src/libexpr/include/nix/expr/eval-error.hh
+++ b/src/libexpr/include/nix/expr/eval-error.hh
@@ -23,6 +23,9 @@ class EvalBaseError : public CloneableError<EvalBaseError, Error>
 {
     template<class T>
     friend class EvalErrorBuilder;
+
+    void anchor() override;
+
 public:
     EvalState & state;
 
@@ -61,8 +64,11 @@ MakeError(InfiniteRecursionError, EvalError);
  * Inherits from EvalBaseError (not EvalError) because resource exhaustion
  * should not be cached.
  */
-struct StackOverflowError : public CloneableError<StackOverflowError, EvalBaseError>
+class StackOverflowError : public CloneableError<StackOverflowError, EvalBaseError>
 {
+    void anchor() override;
+
+public:
     StackOverflowError(EvalState & state)
         : CloneableError(state, "stack overflow; max-call-depth exceeded")
     {
@@ -79,8 +85,10 @@ MakeError(IFDError, EvalBaseError);
  */
 MakeError(RecoverableEvalError, EvalBaseError);
 
-struct InvalidPathError : public CloneableError<InvalidPathError, EvalError>
+class InvalidPathError : public CloneableError<InvalidPathError, EvalError>
 {
+    void anchor() override;
+
 public:
     StorePath path;
 
diff --git a/src/libexpr/include/nix/expr/eval-settings.hh b/src/libexpr/include/nix/expr/eval-settings.hh
index d9dba95370b1..33ae8509970f 100644
--- a/src/libexpr/include/nix/expr/eval-settings.hh
+++ b/src/libexpr/include/nix/expr/eval-settings.hh
@@ -43,6 +43,10 @@ public:
 
 struct EvalSettings : Config
 {
+private:
+    void anchor() override;
+
+public:
     /**
      * Function used to interpret look path entries of a given scheme.
      *
@@ -71,7 +75,14 @@ struct EvalSettings : Config
 
     EvalSettings(bool & readOnlyMode, LookupPathHooks lookupPathHooks = {});
 
-    bool & readOnlyMode;
+    /* FIXME: This really shouldn't be public. The C API should have non-global settings instead. */
+    bool * readOnlyMode = nullptr;
+
+    bool isReadOnly() const
+    {
+        assert(readOnlyMode);
+        return *readOnlyMode;
+    }
 
     static Strings getDefaultNixPath();
 
@@ -191,6 +202,10 @@ struct EvalSettings : Config
             - [`builtins.currentTime`](@docroot@/language/builtins.md#builtins-currentTime)
             - [`builtins.nixPath`](@docroot@/language/builtins.md#builtins-nixPath)
             - [`builtins.storePath`](@docroot@/language/builtins.md#builtins-storePath)
+
+          As a result, every fetch must be a []{#pure-fetch}*pure fetch* — one that references immutable content:
+          [`fetchTree`](@docroot@/language/builtins.md#builtins-fetchTree) and [`fetchGit`](@docroot@/language/builtins.md#builtins-fetchGit) require a locked revision, and [`fetchTarball`](@docroot@/language/builtins.md#builtins-fetchTarball) and [`fetchurl`](@docroot@/language/builtins.md#builtins-fetchurl) require a `sha256` hash.
+          A mutable reference, such as a Git branch or tag without a revision, is rejected, since its result could otherwise change over time.
         )"};
 
     Setting<bool> traceImportFromDerivation{
diff --git a/src/libexpr/include/nix/expr/eval.hh b/src/libexpr/include/nix/expr/eval.hh
index 89e2d5099da2..86abb3c8f2ae 100644
--- a/src/libexpr/include/nix/expr/eval.hh
+++ b/src/libexpr/include/nix/expr/eval.hh
@@ -226,7 +226,7 @@ struct StaticEvalSymbols
         line, column, functor, toString, right, wrong, structuredAttrs, json, allowedReferences, allowedRequisites,
         disallowedReferences, disallowedRequisites, maxSize, maxClosureSize, builder, args, contentAddressed, impure,
         outputHash, outputHashAlgo, outputHashMode, recurseForDerivations, description, self, epsilon, startSet,
-        operator_, key, path, prefix, outputSpecified;
+        operator_, key, path, prefix, outputSpecified, requiredSystemFeatures;
 
     Expr::AstSymbols exprSymbols;
 
@@ -279,6 +279,7 @@ struct StaticEvalSymbols
             .path = alloc.create("path"),
             .prefix = alloc.create("prefix"),
             .outputSpecified = alloc.create("outputSpecified"),
+            .requiredSystemFeatures = alloc.create("requiredSystemFeatures"),
             .exprSymbols = {
                 .sub = alloc.create("__sub"),
                 .lessThan = alloc.create("__lessThan"),
@@ -396,6 +397,7 @@ public:
     const ref<MemorySourceAccessor> internalFS;
 
     const SourcePath derivationInternal;
+    const SourcePath importedDrvToDerivation;
 
     /**
      * Store used to materialise .drv files.
@@ -407,8 +409,6 @@ public:
      */
     const ref<Store> buildStore;
 
-    RootValue vImportedDrvToDerivation = nullptr;
-
     const ref<fetchers::InputCache> inputCache;
 
     /**
@@ -460,10 +460,6 @@ public:
 
 private:
 
-    /* Cache for calls to addToStore(); maps source paths to the store
-       paths. */
-    const ref<boost::concurrent_flat_map<SourcePath, StorePath>> srcToStore;
-
     /**
      * A cache that maps paths to "resolved" paths for importing Nix
      * expressions, i.e. `/foo` to `/foo/default.nix`.
@@ -489,7 +485,15 @@ private:
 
     LookupPath lookupPath;
 
-    const ref<boost::concurrent_flat_map<std::string, std::optional<SourcePath>, StringViewHash, std::equal_to<>>>
+    struct LookupPathResolvedState
+    {
+        SourcePath path;
+        const ref<boost::concurrent_flat_map<CanonPath, std::optional<SourcePath>>> resolvedPaths;
+    };
+
+    const ref<
+        boost::
+            concurrent_flat_map<std::string, std::shared_ptr<LookupPathResolvedState>, StringViewHash, std::equal_to<>>>
         lookupPathResolved;
 
     /**
@@ -626,9 +630,10 @@ public:
      *
      * If the specified search path element is a URI, download it.
      *
-     * If it is not found, return `std::nullopt`.
+     * If it is not found, return `nullptr`.
      */
-    std::optional<SourcePath> resolveLookupPathPath(const LookupPath::Path & elem, bool initAccessControl = false);
+    std::shared_ptr<LookupPathResolvedState>
+    resolveLookupPathPath(const LookupPath::Path & elem, bool initAccessControl = false);
 
     /**
      * Evaluate an expression to normal form
@@ -729,6 +734,26 @@ public:
     std::optional<std::string> tryAttrsToString(
         const PosIdx pos, Value & v, NixStringContext & context, bool coerceMore = false, bool copyToStore = true);
 
+    enum class CopyLazyPaths : bool {
+        PreserveLazy = false,
+        Copy = true,
+    };
+
+    /**
+     * For efficiency reasons, some store paths (as seen by the evaluator) in
+     * the storeFS at their content-addressed locations don't get copied to the
+     * store eagerly. This saves on needless I/O and possibly IPC if all the
+     * evaluator does is just evaluate nix expressions from those locations.
+     * This function copies such store objects to the store if they aren't already valid.
+     */
+    void ensureLazyPathCopied(const StorePath & path);
+
+    /**
+     * Ensure that all NixStringContextElem::Opaque context elements get fetched
+     * to the store.
+     */
+    void ensureLazyPathsCopied(const NixStringContext & context);
+
     /**
      * String coercion.
      *
@@ -1035,9 +1060,14 @@ public:
 
     /**
      * Coerce `v` to a path and realise it, i.e. build anything in the value's string context using `realiseContext()`.
+     * @param copyLazyPaths When encountering a lazy path (i.e. a string with Opaque context that's also "mounted" on
+     * the storeFS), fetch the store path to the store.
      */
     SourcePath realisePath(
-        const PosIdx pos, Value & v, std::optional<SymlinkResolution> resolveSymlinks = SymlinkResolution::Full);
+        const PosIdx pos,
+        Value & v,
+        std::optional<SymlinkResolution> resolveSymlinks = SymlinkResolution::Full,
+        CopyLazyPaths copyLazyPaths = CopyLazyPaths::PreserveLazy);
 
     /**
      * Realise the given string with context, and return the string with outputs instead of downstream output
diff --git a/src/libexpr/include/nix/expr/fetch-tree.hh b/src/libexpr/include/nix/expr/fetch-tree.hh
new file mode 100644
index 000000000000..3eb8a01c0c5f
--- /dev/null
+++ b/src/libexpr/include/nix/expr/fetch-tree.hh
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "nix/expr/eval.hh"
+
+namespace nix {
+
+/**
+ * Convert a libfetchers `Input` to libexpr `Value`.
+ */
+void emitTreeAttrs(
+    EvalState & state,
+    const StorePath & storePath,
+    const fetchers::Input & input,
+    Value & v,
+    bool emptyRevFallback = false,
+    bool forceDirty = false);
+
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/get-drvs.hh b/src/libexpr/include/nix/expr/get-drvs.hh
index 4beccabe2ad3..8e25c25e1aa7 100644
--- a/src/libexpr/include/nix/expr/get-drvs.hh
+++ b/src/libexpr/include/nix/expr/get-drvs.hh
@@ -112,7 +112,7 @@ void getDerivations(
     EvalState & state,
     Value & v,
     const std::string & pathPrefix,
-    Bindings & autoArgs,
+    const Bindings & autoArgs,
     PackageInfos & drvs,
     bool ignoreAssertionFailures);
 
diff --git a/src/libexpr/include/nix/expr/meson.build b/src/libexpr/include/nix/expr/meson.build
index 4213476fe73a..7334b42f8f17 100644
--- a/src/libexpr/include/nix/expr/meson.build
+++ b/src/libexpr/include/nix/expr/meson.build
@@ -20,6 +20,7 @@ headers = [ config_pub_h ] + files(
   'eval-profiler.hh',
   'eval-settings.hh',
   'eval.hh',
+  'fetch-tree.hh',
   'function-trace.hh',
   'gc-small-vector.hh',
   'get-drvs.hh',
diff --git a/src/libexpr/include/nix/expr/nixexpr.hh b/src/libexpr/include/nix/expr/nixexpr.hh
index 07fbed403c2f..b13c00ad541e 100644
--- a/src/libexpr/include/nix/expr/nixexpr.hh
+++ b/src/libexpr/include/nix/expr/nixexpr.hh
@@ -557,7 +557,7 @@ public:
                 std::numeric_limits<decltype(nFormals)>::max());
             if (pos)
                 err.atPos(positions[pos]);
-            throw err;
+            throw std::move(err);
         }
         std::uninitialized_copy_n(formals.formals.begin(), nFormals, formalsStart);
     };
diff --git a/src/libexpr/include/nix/expr/parser-state.hh b/src/libexpr/include/nix/expr/parser-state.hh
index f9bd06589e42..2482d53ea041 100644
--- a/src/libexpr/include/nix/expr/parser-state.hh
+++ b/src/libexpr/include/nix/expr/parser-state.hh
@@ -89,7 +89,7 @@ public:
      * @see https://github.com/NixOS/nix/issues/14642
      */
     template<class F>
-    void visit(F && f)
+    void visit(const F & f)
     {
         std::visit(
             overloaded{
diff --git a/src/libexpr/include/nix/expr/print-ambiguous.hh b/src/libexpr/include/nix/expr/print-ambiguous.hh
index 7e44a6b66ebc..07fcc337e355 100644
--- a/src/libexpr/include/nix/expr/print-ambiguous.hh
+++ b/src/libexpr/include/nix/expr/print-ambiguous.hh
@@ -17,6 +17,12 @@ class EvalState;
  *
  * See: https://github.com/NixOS/nix/issues/9730
  */
-void printAmbiguous(EvalState & state, Value & v, std::ostream & str, std::set<const void *> * seen, size_t depth = 0);
+void printAmbiguous(
+    EvalState & state,
+    Value & v,
+    std::ostream & str,
+    std::set<const void *> * seen,
+    NixStringContext * context = nullptr,
+    size_t depth = 0);
 
 } // namespace nix
diff --git a/src/libexpr/include/nix/expr/print.hh b/src/libexpr/include/nix/expr/print.hh
index 229f7159d15a..8e6d0f9bf09a 100644
--- a/src/libexpr/include/nix/expr/print.hh
+++ b/src/libexpr/include/nix/expr/print.hh
@@ -10,6 +10,7 @@
 #include <iostream>
 
 #include "nix/util/fmt.hh"
+#include "nix/expr/value/context.hh"
 #include "nix/expr/print-options.hh"
 
 namespace nix {
@@ -64,7 +65,12 @@ bool isReservedKeyword(const std::string_view str);
  */
 std::ostream & printIdentifier(std::ostream & o, std::string_view s);
 
-void printValue(EvalState & state, std::ostream & str, Value & v, PrintOptions options = PrintOptions{});
+void printValue(
+    EvalState & state,
+    std::ostream & str,
+    Value & v,
+    PrintOptions options = PrintOptions{},
+    NixStringContext * context = nullptr);
 
 /**
  * A partially-applied form of `printValue` which can be formatted using `<<`
@@ -77,12 +83,15 @@ private:
     EvalState & state;
     Value & value;
     PrintOptions options;
+    NixStringContext * context;
 
 public:
-    ValuePrinter(EvalState & state, Value & value, PrintOptions options = PrintOptions{})
+    ValuePrinter(
+        EvalState & state, Value & value, PrintOptions options = PrintOptions{}, NixStringContext * context = nullptr)
         : state(state)
         , value(value)
         , options(options)
+        , context(context)
     {
     }
 };
diff --git a/src/libexpr/include/nix/expr/value.hh b/src/libexpr/include/nix/expr/value.hh
index b2d0f9295ed5..e1c7725624f5 100644
--- a/src/libexpr/include/nix/expr/value.hh
+++ b/src/libexpr/include/nix/expr/value.hh
@@ -432,9 +432,35 @@ struct ValueBase
         Value * const * elems;
     };
 
-    struct Failed : gc_cleanup
+    /**
+     * Wrapper that stores a std::exception_ptr on the GC heap with a finaliser
+     * that runs the exception_ptr destructor (which is refcounted internally).
+     * This is not a part of the Failed structure to avoid cycles with finalisers,
+     * which Boehm warns about.
+     */
+    struct ExceptionRef : gc_cleanup
     {
+        ExceptionRef(std::exception_ptr ex)
+            : ex(std::move(ex))
+        {
+            assert(this->ex);
+        }
+
+        ExceptionRef(ExceptionRef &&) = delete;
+        ExceptionRef(const ExceptionRef &) = delete;
+        ExceptionRef & operator=(ExceptionRef &&) = delete;
+        ExceptionRef & operator=(const ExceptionRef &) = delete;
+
+        /* To appease -Wweak-vtables. */
+        virtual ~ExceptionRef();
+
         std::exception_ptr ex;
+    };
+
+    struct Failed : gc
+    {
+        ExceptionRef * exRef;
+
         /**
          * Optional value for recovering `RecoverableEvalError`
          * Must be set iff `ex` is an instance of `RecoverableEvalError`.
@@ -442,16 +468,15 @@ struct ValueBase
         Value * recoveryValue;
 
         Failed(std::exception_ptr ex, Value * recoveryValue)
-            : ex(ex)
+            : exRef(new /* ExceptionRef : gc_cleanup */ ExceptionRef(ex))
             , recoveryValue(recoveryValue)
         {
-            assert(this->ex);
         }
 
         [[noreturn]] void rethrow() const
         {
             try {
-                std::rethrow_exception(ex);
+                std::rethrow_exception(exRef->ex);
             } catch (BaseError & e) {
                 /* Rethrow the copy of the exception - not the original one.
                    Stack tracing mechanisms rely on being able to modify the exceptions
@@ -480,7 +505,7 @@ struct PayloadTypeToInternalType
     MACRO(ValueBase::StringWithContext, string, tString)            \
     MACRO(ValueBase::Path, path, tPath)                             \
     MACRO(ValueBase::Null, null_, tNull)                            \
-    MACRO(Bindings *, attrs, tAttrs)                                \
+    MACRO(const Bindings *, attrs, tAttrs)                          \
     MACRO(ValueBase::List, bigList, tListN)                         \
     MACRO(ValueBase::SmallList, smallList, tListSmall)              \
     MACRO(ValueBase::ClosureThunk, thunk, tThunk)                   \
@@ -875,7 +900,7 @@ protected:
         primOp = std::bit_cast<PrimOp *>(payload[1]);
     }
 
-    void getStorage(Bindings *& attrs) const noexcept
+    void getStorage(const Bindings *& attrs) const noexcept
     {
         Payload payload = loadPayload();
         attrs = std::bit_cast<Bindings *>(payload[1]);
@@ -938,7 +963,7 @@ protected:
         setSingleDWordPayload<tPrimOp>(std::bit_cast<PackedPointer>(primOp));
     }
 
-    void setStorage(Bindings * bindings) noexcept
+    void setStorage(const Bindings * bindings) noexcept
     {
         setSingleDWordPayload<tAttrs>(std::bit_cast<PackedPointer>(bindings));
     }
@@ -1336,7 +1361,7 @@ public:
         setStorage(Null{});
     }
 
-    inline void mkAttrs(Bindings * a) noexcept
+    inline void mkAttrs(const Bindings * a) noexcept
     {
         setStorage(a);
     }
@@ -1462,7 +1487,7 @@ public:
 
     const Bindings * attrs() const noexcept
     {
-        return getStorage<Bindings *>();
+        return getStorage<const Bindings *>();
     }
 
     const PrimOp * primOp() const noexcept
diff --git a/src/libexpr/include/nix/expr/value/context.hh b/src/libexpr/include/nix/expr/value/context.hh
index 31f03addf2a0..8fc948622768 100644
--- a/src/libexpr/include/nix/expr/value/context.hh
+++ b/src/libexpr/include/nix/expr/value/context.hh
@@ -11,6 +11,8 @@ namespace nix {
 
 class BadNixStringContextElem final : public CloneableError<BadNixStringContextElem, Error>
 {
+    void anchor() override;
+
 public:
     std::string_view raw;
 
diff --git a/src/libexpr/json-to-value.cc b/src/libexpr/json-to-value.cc
index 08393435b48c..d218a0beaefc 100644
--- a/src/libexpr/json-to-value.cc
+++ b/src/libexpr/json-to-value.cc
@@ -9,6 +9,8 @@ using json = nlohmann::json;
 
 namespace nix {
 
+namespace {
+
 // for more information, refer to
 // https://github.com/nlohmann/json/blob/master/include/nlohmann/detail/input/json_sax.hpp
 class JSONSax : nlohmann::json_sax<json>
@@ -200,6 +202,8 @@ class JSONSax : nlohmann::json_sax<json>
     }
 };
 
+} // namespace
+
 void parseJSON(EvalState & state, const std::string_view & s_, Value & v)
 {
     JSONSax parser(state, v);
@@ -208,4 +212,6 @@ void parseJSON(EvalState & state, const std::string_view & s_, Value & v)
         throw JSONParseError("Invalid JSON Value");
 }
 
+void JSONParseError::anchor() {}
+
 } // namespace nix
diff --git a/src/libexpr/lexer-helpers.cc b/src/libexpr/lexer-helpers.cc
index 59f6f6f70dfd..085ac7df4698 100644
--- a/src/libexpr/lexer-helpers.cc
+++ b/src/libexpr/lexer-helpers.cc
@@ -26,3 +26,5 @@ void nix::lexer::internal::adjustLoc(yyscan_t yyscanner, Parser::location_type *
     loc->beginOffset = loc->endOffset;
     loc->endOffset += len;
 }
+
+nix::Parser::~Parser() {}
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
index 510b6d696e3b..6016fa81a79e 100644
--- a/src/libexpr/meson.build
+++ b/src/libexpr/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -144,16 +144,6 @@ lexer_tab = custom_target(
   install_dir : get_option('includedir') / 'nix',
 )
 
-subdir('nix-meson-build-support/generate-header')
-
-generated_headers = []
-foreach header : [
-  'imported-drv-to-derivation.nix',
-  'fetchurl.nix',
-]
-  generated_headers += gen_header.process(header)
-endforeach
-
 sources = files(
   'attr-path.cc',
   'attr-set.cc',
@@ -240,7 +230,6 @@ this_library = library(
   config_priv_h,
   parser_tab[1],
   lexer_tab[1],
-  generated_headers,
   soversion : nix_soversion,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
diff --git a/src/libexpr/parser-scanner-decls.hh b/src/libexpr/parser-scanner-decls.hh
index e4e06188334c..1bec23837b99 100644
--- a/src/libexpr/parser-scanner-decls.hh
+++ b/src/libexpr/parser-scanner-decls.hh
@@ -11,7 +11,9 @@ namespace nix {
 
 class Parser : public parser::BisonParser
 {
+public:
     using BisonParser::BisonParser;
+    ~Parser() override;
 };
 
 } // namespace nix
diff --git a/src/libexpr/paths.cc b/src/libexpr/paths.cc
index ca303208173e..4ceab2b4dbfe 100644
--- a/src/libexpr/paths.cc
+++ b/src/libexpr/paths.cc
@@ -22,10 +22,55 @@ SourcePath EvalState::storePath(const StorePath & path)
     return {rootFS, CanonPath{store->printStorePath(path)}};
 }
 
+void EvalState::ensureLazyPathCopied(const StorePath & path)
+{
+    if (settings.isReadOnly())
+        return;
+
+    auto mount = storeFS->getMount(CanonPath(store->printStorePath(path)));
+    if (!mount)
+        return;
+
+    /* TODO: We could memoise this in-memory if necessary. */
+    auto storePath = fetchToStore(
+        fetchSettings,
+        *store,
+        SourcePath{ref(mount)},
+        /* Force a copy. mountInput does a dryRun to just calculate the storePath and narHash. */
+        FetchMode::Copy,
+        path.name());
+
+    /* This can happen if the source gets modified by another process while we are evaluaing
+       from it. Alternatively, the caching might be unsound and fetcher cache is poisoned somehow.
+       See https://github.com/NixOS/nix/issues/14317. */
+    if (storePath != path) {
+        throw Error(
+            (unsigned int) 102,
+            "store path ('%1%') was hashed to avoid a full copy at first, but upon reading it again, the contents have changed ('%2%'), so we can not proceed. Make sure files do not change during evaluation",
+            store->printStorePath(path),
+            store->printStorePath(storePath));
+    }
+}
+
+void EvalState::ensureLazyPathsCopied(const NixStringContext & context)
+{
+    for (const auto & c : context)
+        if (auto * o = std::get_if<NixStringContextElem::Opaque>(&c.raw))
+            /* TODO: This could be done in parallel. */
+            ensureLazyPathCopied(o->path);
+}
+
 StorePath
 EvalState::mountInput(fetchers::Input & input, const fetchers::Input & originalInput, ref<SourceAccessor> accessor)
 {
-    auto [storePath, narHash] = fetchToStore2(fetchSettings, *store, accessor, FetchMode::Copy, input.getName());
+    /* To mount the input, dryRun is sufficient. We still compute the narHash (to check for mismatches) and the store
+       path to figure out where to mount it. TODO: This could be relaxed in the future by making outPath and narHash
+       lazier. Good code that doesn't do `toString ./.` or otherwise inspects the outPath string and only uses it for
+       doing relative imports does not even require computing the store path. That is a big invasive change though and
+       would require having a special "LazyStorePathString" thunk. narHash also doesn't need to be computed eagerly in
+       case it's not actually specified (like during local development with a dirty tree) - in that case narHash could
+       also become a lazy app/thunk that shares the state with the storePath delayed computation. */
+    auto [storePath, narHash] = fetchToStore2(fetchSettings, *store, accessor, FetchMode::DryRun, input.getName());
 
     allowPath(storePath); // FIXME: should just whitelist the entire virtual store
 
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 4b7680be1ff6..8e01ce73639d 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -10,6 +10,10 @@
 #include "nix/store/names.hh"
 #include "nix/store/path-references.hh"
 #include "nix/store/store-api.hh"
+#include "nix/util/configuration.hh"
+#include "nix/util/mounted-source-accessor.hh"
+#include "nix/store/build.hh"
+#include "nix/util/strings.hh"
 #include "nix/util/util.hh"
 #include "nix/util/os-string.hh"
 #include "nix/util/processes.hh"
@@ -63,7 +67,7 @@ std::string EvalState::realiseString(Value & s, StorePathSet * storePathsOutMayb
     nix::NixStringContext stringContext;
     auto rawStr = coerceToString(pos, s, stringContext, "while realising a string").toOwned();
     auto rewrites = realiseContext(stringContext, storePathsOutMaybe, isIFD);
-
+    ensureLazyPathsCopied(stringContext);
     return nix::rewriteStrings(rawStr, rewrites);
 }
 
@@ -88,7 +92,11 @@ StringMap EvalState::realiseContext(const NixStringContext & context, StorePathS
                     ensureValid(b.drvPath->getBaseStorePath());
                 },
                 [&](const NixStringContextElem::Opaque & o) {
-                    ensureValid(o.path);
+                    /* If the path happens to be mounted on the storeFS, that means it's lazy path string and would get
+                       copied to the store on-demand (when referenced in a derivation). The string is equal to final
+                       store path where the store object would end up (the path is hashed before mounting). */
+                    if (!storeFS->getMount(CanonPath(store->printStorePath(o.path))))
+                        ensureValid(o.path);
                     if (maybePathsOut)
                         maybePathsOut->emplace(o.path);
                 },
@@ -121,7 +129,7 @@ StringMap EvalState::realiseContext(const NixStringContext & context, StorePathS
     buildReqs.reserve(drvs.size());
     for (auto & d : drvs)
         buildReqs.emplace_back(DerivedPath{d});
-    buildStore->buildPaths(buildReqs, bmNormal, store);
+    buildStore->getBuilder(store)->buildPaths(buildReqs, bmNormal);
 
     StorePathSet outputsToCopyAndAllow;
 
@@ -158,7 +166,8 @@ StringMap EvalState::realiseContext(const NixStringContext & context, StorePathS
     return res;
 }
 
-SourcePath EvalState::realisePath(const PosIdx pos, Value & v, std::optional<SymlinkResolution> resolveSymlinks)
+SourcePath EvalState::realisePath(
+    const PosIdx pos, Value & v, std::optional<SymlinkResolution> resolveSymlinks, CopyLazyPaths copyLazyPaths)
 {
     NixStringContext context;
 
@@ -167,6 +176,8 @@ SourcePath EvalState::realisePath(const PosIdx pos, Value & v, std::optional<Sym
     try {
         if (!context.empty() && path.accessor == rootFS) {
             auto rewrites = realiseContext(context);
+            if (copyLazyPaths == CopyLazyPaths::Copy)
+                ensureLazyPathsCopied(context);
             path = {path.accessor, CanonPath(rewriteStrings(path.path.abs(), rewrites))};
         }
         return resolveSymlinks ? path.resolveSymlinks(*resolveSymlinks) : path;
@@ -239,19 +250,11 @@ void derivationToValue(
     auto w = state.allocValue();
     w->mkAttrs(attrs);
 
-    if (!state.vImportedDrvToDerivation) {
-        state.vImportedDrvToDerivation = allocRootValue(state.allocValue());
-        state.eval(
-            state.parseExprFromString(
-#include "imported-drv-to-derivation.nix.gen.hh"
-                , state.rootPath(CanonPath::root)),
-            **state.vImportedDrvToDerivation);
-    }
+    auto vImportedDrvToDerivation = state.allocValue();
+    state.evalFile(state.importedDrvToDerivation, *vImportedDrvToDerivation); // has caching
 
-    state.forceFunction(
-        **state.vImportedDrvToDerivation, pos, "while evaluating imported-drv-to-derivation.nix.gen.hh");
-    v.mkApp(*state.vImportedDrvToDerivation, w);
-    state.forceAttrs(v, pos, "while calling imported-drv-to-derivation.nix.gen.hh");
+    v.mkApp(vImportedDrvToDerivation, w);
+    state.forceAttrs(v, pos, "while calling imported-drv-to-derivation.nix");
 }
 
 /**
@@ -441,10 +444,11 @@ static RegisterPrimOp primop_import(
 /* !!! Should we pass the Pos or the file name too? */
 extern "C" typedef void (*ValueInitializer)(EvalState & state, Value & v);
 
-/* Load a ValueInitializer from a DSO and return whatever it initializes */
+/* Load a ValueInitializer from a DSO and return whatever it initializes. FIXME: This doesn't
+   work with chroot stores. */
 void prim_importNative(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    auto path = state.realisePath(pos, *args[0]);
+    auto path = state.realisePath(pos, *args[0], SymlinkResolution::Full, EvalState::CopyLazyPaths::Copy);
 
     std::string sym(
         state.forceStringNoCtx(*args[1], pos, "while evaluating the second argument passed to builtins.importNative"));
@@ -471,7 +475,7 @@ void prim_importNative(EvalState & state, const PosIdx pos, Value ** args, Value
     /* We don't dlclose because v may be a primop referencing a function in the shared object file */
 }
 
-/* Execute a program and parse its output */
+/* Execute a program and parse its output. FIXME: This doesn't work with chroot stores. */
 void prim_exec(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceList(*args[0], pos, "while evaluating the first argument passed to builtins.exec");
@@ -509,6 +513,7 @@ void prim_exec(EvalState & state, const PosIdx pos, Value ** args, Value & v)
             .debugThrow();
     }
 
+    state.ensureLazyPathsCopied(context);
     auto output = runProgram(program, true, toOsStrings(std::move(commandArgs)));
     Expr * parsed;
     try {
@@ -694,7 +699,7 @@ static RegisterPrimOp primop_isPath({
 });
 
 template<typename Callable>
-static inline void withExceptionContext(Trace trace, Callable && func)
+static inline void withExceptionContext(Trace trace, const Callable & func)
 {
     try {
         func();
@@ -976,6 +981,7 @@ static RegisterPrimOp primop_break(
          }
 
          // Return the value we were passed.
+         state.forceValue(*args[0], pos);
          v = *args[0];
      }});
 
@@ -1037,7 +1043,35 @@ static void prim_addErrorContext(EvalState & state, const PosIdx pos, Value ** a
 static RegisterPrimOp primop_addErrorContext(
     PrimOp{
         .name = "__addErrorContext",
+        .args = {"context", "value"},
         .arity = 2,
+        .doc = R"(
+            Evaluate *context*, which can be coerced to a string,
+            and append it to any error or stack traces displayed while evaluating *value*.
+            Then return *value*.
+
+            This function is useful for providing helpful context in complex Nix expressions
+            when the evaluation of *value* fails.
+            The additional context is applied when evaluating *value* itself fails,
+            not when attributes or elements of *value* are evaluated.
+
+            For example, the module system from nixpkgs uses this to show
+            the relevant information about the options that were evaluating
+            when an error occurs.
+
+            ```nix-repl
+            nix-repl> addErrorContext "while evaluating foo" (throw "bar")
+            error:
+                   … while evaluating foo
+
+                   … while calling the 'throw' builtin
+                     at «string»:1:56:
+                        1| with builtins; addErrorContext "while evaluating foo" (throw "bar")
+                         |                                                        ^
+
+                   error: bar
+            ```
+        )",
         // The normal trace item is redundant
         .addTrace = false,
         .impl = prim_addErrorContext,
@@ -1483,13 +1517,15 @@ static void derivationStrictInternal(EvalState & state, std::string_view drvName
             "passed to builtins.derivationStrict");
 
     /* Build the derivation expression by processing the attributes. */
-    Derivation drv;
-    drv.name = drvName;
+    Derivation drv{
+        .name = std::string{drvName},
+    };
 
     NixStringContext context;
 
     bool contentAddressed = false;
     bool isImpure = false;
+    bool isSubmittingOutputs = false;
     std::optional<std::string> outputHash;
     std::optional<HashAlgorithm> outputHashAlgo;
     std::optional<ContentAddressMethod> ingestionMethod;
@@ -1503,6 +1539,17 @@ static void derivationStrictInternal(EvalState & state, std::string_view drvName
         auto key = state.symbols[i->name];
         vomit("processing attribute '%1%'", key);
 
+        // Like `warn`, but with the position of the attribute and the derivation name as an added trace.
+        auto warnAttr = [&](HintFmt msg) {
+            ErrorInfo info{
+                .level = lvlWarn,
+                .msg = std::move(msg),
+                .pos = state.positions[i->pos],
+            };
+            info.traces.push_back(Trace{.hint = HintFmt{"while evaluating derivation '%1%'", drvName}});
+            logWarning(info);
+        };
+
         auto handleHashMode = [&](const std::string_view s) {
             if (s == "recursive") {
                 // back compat, new name is "nar"
@@ -1612,40 +1659,36 @@ static void derivationStrictInternal(EvalState & state, std::string_view drvName
                         handleOutputs(ss);
                         break;
                     }
+                    case EvalState::s.requiredSystemFeatures.getId(): {
+                        /* Only parsed to detect `builder-rpc-v0`; skip
+                           entirely unless the experimental feature is
+                           enabled. */
+                        if (!experimentalFeatureSettings.isEnabled(Xp::DynamicDerivations))
+                            break;
+                        state.forceList(*i->value, pos, context_below);
+                        for (auto elem : i->value->listView()) {
+                            auto name = state.forceString(*elem, context, pos, context_below);
+                            if (name == drvFeatureBuilderRpcV0) {
+                                isSubmittingOutputs = true;
+                                break;
+                            }
+                        }
+                        break;
+                    }
                     default:
                         break;
                     }
 
                     switch (i->name.getId()) {
                     case EvalState::s.allowedReferences.getId():
-                        warn(
-                            "In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'allowedReferences'; use 'outputChecks.<output>.allowedReferences' instead",
-                            drvName);
-                        break;
                     case EvalState::s.allowedRequisites.getId():
-                        warn(
-                            "In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'allowedRequisites'; use 'outputChecks.<output>.allowedRequisites' instead",
-                            drvName);
-                        break;
                     case EvalState::s.disallowedReferences.getId():
-                        warn(
-                            "In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'disallowedReferences'; use 'outputChecks.<output>.disallowedReferences' instead",
-                            drvName);
-                        break;
                     case EvalState::s.disallowedRequisites.getId():
-                        warn(
-                            "In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'disallowedRequisites'; use 'outputChecks.<output>.disallowedRequisites' instead",
-                            drvName);
-                        break;
                     case EvalState::s.maxSize.getId():
-                        warn(
-                            "In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'maxSize'; use 'outputChecks.<output>.maxSize' instead",
-                            drvName);
-                        break;
                     case EvalState::s.maxClosureSize.getId():
-                        warn(
-                            "In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'maxClosureSize'; use 'outputChecks.<output>.maxClosureSize' instead",
-                            drvName);
+                        warnAttr(HintFmt(
+                            "'structuredAttrs' disables the effect of the derivation attribute '%1%'; use 'outputChecks.<output>.%1%' instead",
+                            key));
                         break;
                     default:
                         break;
@@ -1653,10 +1696,18 @@ static void derivationStrictInternal(EvalState & state, std::string_view drvName
 
                 } else {
                     auto s = state.coerceToString(pos, *i->value, context, context_below, true).toOwned();
+
+                    /* Re-interpret the attribute's value as a list of
+                       strings.
+
+                       We may wish to warn here better future-compat
+                       later, e.g. requiring that it be a list of
+                       strings without spaces to begin with. */
+                    auto forceStringList = [&] { return tokenizeString<Strings>(s); };
+
                     if (i->name == state.s.json) {
-                        warn(
-                            "In derivation '%s': setting structured attributes via '__json' is deprecated, and may be disallowed in future versions of Nix. Set '__structuredAttrs = true' instead.",
-                            drvName);
+                        warnAttr(HintFmt(
+                            "setting structured attributes via '__json' is deprecated, and may be disallowed in future versions of Nix. Set '__structuredAttrs = true' instead."));
                         drv.structuredAttrs = StructuredAttrs::parse(s);
                     } else {
                         drv.env.emplace(key, s);
@@ -1677,8 +1728,22 @@ static void derivationStrictInternal(EvalState & state, std::string_view drvName
                             handleHashMode(s);
                             break;
                         case EvalState::s.outputs.getId():
-                            handleOutputs(tokenizeString<Strings>(s));
+                            handleOutputs(forceStringList());
+                            break;
+                        case EvalState::s.requiredSystemFeatures.getId(): {
+                            /* Only parsed to detect `builder-rpc-v0`; skip
+                               entirely unless the experimental feature is
+                               enabled. */
+                            if (!experimentalFeatureSettings.isEnabled(Xp::DynamicDerivations))
+                                break;
+                            for (auto & name : forceStringList()) {
+                                if (name == drvFeatureBuilderRpcV0) {
+                                    isSubmittingOutputs = true;
+                                    break;
+                                }
+                            }
                             break;
+                        }
                         default:
                             break;
                         }
@@ -1717,16 +1782,19 @@ static void derivationStrictInternal(EvalState & state, std::string_view drvName
                     StorePathSet refs;
                     state.store->computeFSClosure(d.drvPath, refs);
                     for (auto & j : refs) {
-                        drv.inputSrcs.insert(j);
+                        drv.inputs.srcs.insert(j);
                         if (j.isDerivation()) {
-                            drv.inputDrvs.map[j].value = state.store->readDerivation(j).outputNames();
+                            drv.inputs.drvs.map[j].value = state.store->readDerivation(j).outputNames();
                         }
                     }
                 },
                 [&](const NixStringContextElem::Built & b) {
-                    drv.inputDrvs.ensureSlot(*b.drvPath).value.insert(b.output);
+                    drv.inputs.drvs.ensureSlot(*b.drvPath).value.insert(b.output);
+                },
+                [&](const NixStringContextElem::Opaque & o) {
+                    state.ensureLazyPathCopied(o.path);
+                    drv.inputs.srcs.insert(o.path);
                 },
-                [&](const NixStringContextElem::Opaque & o) { drv.inputSrcs.insert(o.path); },
             },
             c.raw);
     }
@@ -1772,7 +1840,8 @@ static void derivationStrictInternal(EvalState & state, std::string_view drvName
                 },
         };
 
-        drv.env["out"] = state.store->printStorePath(dof.path(*state.store, drvName, "out"));
+        if (!isSubmittingOutputs)
+            drv.env["out"] = state.store->printStorePath(dof.path(*state.store, drvName, "out"));
         drv.outputs.insert_or_assign("out", std::move(dof));
     }
 
@@ -1784,7 +1853,8 @@ static void derivationStrictInternal(EvalState & state, std::string_view drvName
         auto method = ingestionMethod.value_or(ContentAddressMethod::Raw::NixArchive);
 
         for (auto & i : outputs) {
-            drv.env[i] = hashPlaceholder(i);
+            if (!isSubmittingOutputs)
+                drv.env[i] = hashPlaceholder(i);
             if (isImpure)
                 drv.outputs.insert_or_assign(
                     i,
@@ -1927,21 +1997,21 @@ static void prim_storePath(EvalState & state, const PosIdx pos, Value ** args, V
             .debugThrow();
 
     NixStringContext context;
-    auto path =
-        state.coerceToPath(pos, *args[0], context, "while evaluating the first argument passed to 'builtins.storePath'")
-            .path;
+    SourcePath sourcePath = state.coerceToPath(
+        pos, *args[0], context, "while evaluating the first argument passed to 'builtins.storePath'");
+
     /* Resolve symlinks in ‘path’, unless ‘path’ itself is a symlink
        directly in the store.  The latter condition is necessary so
        e.g. nix-push does the right thing. */
-    if (!state.store->isStorePath(path.abs()))
-        path = CanonPath(canonPath(path.abs(), true).string());
-    if (!state.store->isInStore(path.abs()))
-        state.error<EvalError>("path '%1%' is not in the Nix store", path).atPos(pos).debugThrow();
-    auto path2 = state.store->toStorePath(path.abs()).first;
-    if (!settings.readOnlyMode)
-        state.store->ensurePath(path2);
-    context.insert(NixStringContextElem::Opaque{.path = path2});
-    v.mkString(path.abs(), context, state.mem);
+    if (!state.store->isStorePath(sourcePath.path.abs()))
+        sourcePath = sourcePath.resolveSymlinks(SymlinkResolution::Full);
+    if (!state.store->isInStore(sourcePath.path.abs()))
+        state.error<EvalError>("path '%1%' is not in the Nix store", sourcePath).atPos(pos).debugThrow();
+    auto storePath = state.store->toStorePath(sourcePath.path.abs()).first;
+    if (!state.storeFS->getMount(CanonPath(state.store->printStorePath(storePath))) && !settings.readOnlyMode)
+        state.store->getBuilder()->ensurePath(storePath);
+    context.insert(NixStringContextElem::Opaque{.path = storePath});
+    v.mkString(sourcePath.path.abs(), context, state.mem);
 }
 
 static RegisterPrimOp primop_storePath({
@@ -2666,9 +2736,10 @@ static void prim_toFile(EvalState & state, const PosIdx pos, Value ** args, Valu
     StorePathSet refs;
 
     for (auto c : context) {
-        if (auto p = std::get_if<NixStringContextElem::Opaque>(&c.raw))
+        if (auto p = std::get_if<NixStringContextElem::Opaque>(&c.raw)) {
+            state.ensureLazyPathCopied(p->path);
             refs.insert(p->path);
-        else
+        } else
             state
                 .error<EvalError>(
                     "files created by %1% may not reference derivations, but %2% references %3%",
@@ -3051,11 +3122,7 @@ static RegisterPrimOp primop_attrNames({
       alphabetically sorted list. For instance, `builtins.attrNames { y
       = 1; x = "foo"; }` evaluates to `[ "x" "y" ]`.
 
-      # Time Complexity
-
-      - O(n log n), where:
-
-      n = number of attributes in the set
+      Has `O(n log n)` time complexity, where `n` is number of attributes in the *set*.
     )",
     .impl = prim_attrNames,
 });
@@ -3089,11 +3156,7 @@ static RegisterPrimOp primop_attrValues({
       Return the values of the attributes in the set *set* in the order
       corresponding to the sorted attribute names.
 
-      # Time Complexity
-
-      - O(n log n), where:
-
-      n = number of attributes in the set
+      Has `O(n log n)` time complexity, where `n` is number of attributes in the *set*.
     )",
     .impl = prim_attrValues,
 });
@@ -3120,9 +3183,7 @@ static RegisterPrimOp primop_getAttr({
       the `.` operator, since *s* is an expression rather than an
       identifier.
 
-      # Time Complexity
-
-      O(log n) where n = number of attributes in the set
+      Has `O(log n)` time complexity, where `n` is number of attributes in the *set*.
     )",
     .impl = prim_getAttr,
 });
@@ -3212,9 +3273,7 @@ static RegisterPrimOp primop_hasAttr({
       `false` otherwise. This is a dynamic version of the `?` operator,
       since *s* is an expression rather than an identifier.
 
-      # Time Complexity
-
-      O(log n) where n = number of attributes in the set
+      Has `O(log n)` time complexity, where `n` is number of attributes in the *set*.
     )",
     .impl = prim_hasAttr,
 });
@@ -3275,12 +3334,7 @@ static RegisterPrimOp primop_removeAttrs({
 
       evaluates to `{ y = 2; }`.
 
-      # Time Complexity
-
-      O(n + k log k) where:
-
-      n = number of attributes in input set
-      k = number of attribute names to remove
+      Has `O(n + k log k)` time complexity, where `n` is number of attributes in the *set* and `k` is the size of *list*.
     )",
     .impl = prim_removeAttrs,
 });
@@ -3369,9 +3423,7 @@ static RegisterPrimOp primop_listToAttrs({
       { foo = 123; bar = 456; }
       ```
 
-      # Time Complexity
-
-      O(n log n) where n = number of list elements
+      Has `O(n log n)` time complexity, where `n` is size of the list.
     )",
     .impl = prim_listToAttrs,
 });
@@ -3448,12 +3500,7 @@ static RegisterPrimOp primop_intersectAttrs({
       Return a set consisting of the attributes in the set *e2* which have the
       same name as some attribute in *e1*.
 
-      # Time Complexity
-
-      O(n * log m) where:
-
-      n = number of attributes in the smaller set
-      m = number of attributes in the larger set
+      Has `O(n log m)` time complexity, where `n` and `m` are the sizes of the smallest and largest set respectively.
     )",
     .impl = prim_intersectAttrs,
 });
@@ -3494,12 +3541,7 @@ static RegisterPrimOp primop_catAttrs({
 
       evaluates to `[1 2]`.
 
-      # Time Complexity
-
-      O(n * log m) where:
-
-      n = list length
-      m = number of attributes per set
+      Has `O(n)` time complexity, where `n` is the size of the *list*.
     )",
     .impl = prim_catAttrs,
 });
@@ -3544,9 +3586,7 @@ static RegisterPrimOp primop_functionArgs({
       the function. Plain lambdas are not included, e.g. `functionArgs (x:
       ...) = { }`.
 
-      # Time Complexity
-
-      O(n) where n = number of formal arguments
+      Has constant time complexity.
     )",
     .impl = prim_functionArgs,
 });
@@ -3580,13 +3620,9 @@ static RegisterPrimOp primop_mapAttrs({
 
       evaluates to `{ a = 10; b = 20; }`.
 
-      # Time Complexity
-
-      O(n) where:
-
-      n = number of attributes
-
-      Calls to `f` are performed afterwards, when needed.
+      Has `O(n)` time complexity, where `n` is the size of the *attrset*.
+      Note that no calls to *f* are performed by the builtin.
+      The function *f* is called on demand when a resulting attribute value is evaluated.
     )",
     .impl = prim_mapAttrs,
 });
@@ -3675,12 +3711,7 @@ static RegisterPrimOp primop_zipAttrsWith({
       }
       ```
 
-      # Time Complexity
-
-      O(N * log k) where:
-
-      N = total attributes across all sets
-      k = number of unique keys across all sets
+      Has `O(n log n)` time complexity, where `n` is the number of attributes across all sets.
     )",
     .impl = prim_zipAttrsWith,
 });
@@ -3748,9 +3779,7 @@ static RegisterPrimOp primop_head({
       isn’t a list or is an empty list. You can test whether a list is
       empty by comparing it with `[]`.
 
-      # Time Complexity
-
-      O(1)
+      Has constant time complexity.
     )",
     .impl = prim_head,
 });
@@ -3782,10 +3811,6 @@ static RegisterPrimOp primop_tail({
       > This function should generally be avoided since it's inefficient:
       > unlike Haskell's `tail`, it takes O(n) time, so recursing over a
       > list by repeatedly calling `tail` takes O(n^2) time.
-
-      # Time Complexity
-
-      O(n) where n = list length (copies n-1 elements)
     )",
     .impl = prim_tail,
 });
@@ -3821,13 +3846,9 @@ static RegisterPrimOp primop_map({
 
       evaluates to `[ "foobar" "foobla" "fooabc" ]`.
 
-      # Time Complexity
-
-      O(n) where:
-
-      n = list length
-
-      Calls to `f` are performed afterwards when needed.
+      Has `O(n)` time complexity, where `n` is the size of the *list*.
+      Note that no calls to *f* are performed by the builtin, but *f* itself is evaluated and its type is checked eagerly.
+      The function *f* is called on demand when a resulting list element is evaluated.
     )",
     .impl = prim_map,
 });
@@ -3877,13 +3898,7 @@ static RegisterPrimOp primop_filter({
     .doc = R"(
       Return a list consisting of the elements of *list* for which the
       function *f* returns `true`.
-
-      # Time Complexity
-
-      O(n * T_f) (eager; predicate is forced) where:
-
-      n = list length
-      T_f = predicate evaluation time
+      Has linear time complexity in the size of the input *list*.
     )",
     .impl = prim_filter,
 });
@@ -3907,15 +3922,7 @@ static RegisterPrimOp primop_elem({
     .doc = R"(
       Return `true` if a value equal to *x* occurs in the list *xs*, and
       `false` otherwise.
-
-      # Time Complexity
-
-      O(n * T) (worst case) where:
-
-      n = list length
-      T = time to compare two elements
-
-      returns early if the elements is found
+      Short-circuits and does not evaluate elements that occur in the list after the first match.
     )",
     .impl = prim_elem,
 });
@@ -3933,12 +3940,6 @@ static RegisterPrimOp primop_concatLists({
     .args = {"lists"},
     .doc = R"(
       Concatenate a list of lists into a single list.
-
-      # Time Complexity
-
-      O(N) where:
-
-      N = total number of elements across all lists
     )",
     .impl = prim_concatLists,
 });
@@ -3955,10 +3956,6 @@ static RegisterPrimOp primop_length({
     .args = {"e"},
     .doc = R"(
       Return the length of the list *e*.
-
-      # Time Complexity
-
-      O(1)
     )",
     .impl = prim_length,
 });
@@ -3991,24 +3988,40 @@ static RegisterPrimOp primop_foldlStrict({
     .args = {"op", "nul", "list"},
     .doc = R"(
       Reduce a list by applying a binary operator, from left to right,
-      e.g. `foldl' op nul [x0 x1 x2 ...] = op (op (op nul x0) x1) x2)
-      ...`.
+      e.g.
+      ```nix
+      foldl' op nul [ x0 x1 x2 ]
+        =
+          let
+            strictly = f: a: builtins.seq a (f a);
+            y0 = op nul x0;
+            y1 = strictly op y0 x1;
+            y2 = strictly op y1 x2;
+          in
+            y2
+
+        # and, ignoring strictness/laziness
+        ==
+          op (op (op nul x0) x1) x2
+      ```
 
       For example, `foldl' (acc: elem: acc + elem) 0 [1 2 3]` evaluates
       to `6` and `foldl' (acc: elem: { "${elem}" = elem; } // acc) {}
       ["a" "b"]` evaluates to `{ a = "a"; b = "b"; }`.
 
       The first argument of `op` is the accumulator whereas the second
-      argument is the current element being processed. The return value
-      of each application of `op` is evaluated immediately, even for
-      intermediate values.
+      argument is the current element being processed.
 
-      # Time Complexity
+      The return value of each application of `op` is evaluated immediately,
+      even for intermediate values.
+      This way, `foldl'` can operate in constant stack space, allowing it to operate on large lists,
+      regardless of [max-call-depth](@docroot@/command-ref/conf-file.md#conf-max-call-depth).
 
-      O(n * T_op) where:
+      Conventionally, a fold function without the `'` ("prime") preserves laziness,
+      but lacks these benefits.
+      See also [Nixpkgs `lib.foldl`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.lists.foldl).
 
-      n = list length
-      T_op = `op` call evaluation time
+      Has linear time complexity in the size of the list.
     )",
     .impl = prim_foldlStrict,
 });
@@ -4047,15 +4060,7 @@ static RegisterPrimOp primop_any({
     .doc = R"(
       Return `true` if the function *pred* returns `true` for at least one
       element of *list*, and `false` otherwise.
-
-      # Time Complexity
-
-      O(n * T_pred) where:
-
-      - n = `list` length
-      - T_pred = `pred` call evaluation time
-
-      returns early when `pred` returns `true`
+      Short-circuits and does not evaluate elements that appear later in the list if `pred` evaluates to `true`.
     )",
     .impl = prim_any,
 });
@@ -4071,15 +4076,7 @@ static RegisterPrimOp primop_all({
     .doc = R"(
       Return `true` if the function *pred* returns `true` for all elements
       of *list*, and `false` otherwise.
-
-      # Time Complexity
-
-      O(n * T_f) where:
-
-      - n = list length
-      - T_f = predicate evaluation time
-
-      returns early when `pred` returns `false`
+      Short-circuits and does not evaluate elements that appear later in the list if `pred` evaluates to `false`.
     )",
     .impl = prim_all,
 });
@@ -4119,16 +4116,7 @@ static RegisterPrimOp primop_genList({
 
       returns the list `[ 0 1 4 9 16 ]`.
 
-      # Time Complexity
-
-      Complexity of `genList generator n`: O(n)
-
-      Complexity of `deepSeq (genList generator n)`: O(n * T_f)
-
-      where:
-
-      n = requested length
-      T_f = `generator` call evaluation time
+      Has linear time complexity.
     )",
     .impl = prim_genList,
 });
@@ -4240,15 +4228,8 @@ static RegisterPrimOp primop_sort({
       If the *comparator* violates any of these properties, then `builtins.sort`
       reorders elements in an unspecified manner.
 
-      # Time Complexity
-
-      O(n log n * T_cmp), where:
-
-      n = `list` length
-      T_cmp = `comparator` call evaluation time
-
-      Uses an adaptive sort that exploits existing sorted runs in the input,
-      down to O(n * T_cmp) when the list is already sorted.
+      Runs in `O(n log n)` time on average, where `n` is the size of the *list*.
+      Uses an adaptive sort that exploits existing sorted runs in the input, down to `O(n)` when the list is already sorted.
     )",
     .impl = prim_sort,
 });
@@ -4311,12 +4292,7 @@ static RegisterPrimOp primop_partition({
       { right = [ 23 42 ]; wrong = [ 1 9 3 ]; }
       ```
 
-      # Time Complexity
-
-      O(n * T_pred) where:
-
-      n = list length
-      T_pred = `pred` call evaluation time
+      Runs in linear time in the size of the *list*.
     )",
     .impl = prim_partition,
 });
@@ -4371,13 +4347,7 @@ static RegisterPrimOp primop_groupBy({
       { b = [ "bar" "baz" ]; f = [ "foo" ]; }
       ```
 
-      # Time Complexity
-
-      O(N * T_f + N * log k) where:
-
-      N = number of `list` elements
-      T_f = `f` call evaluation time
-      k = number of unique groups
+      Has `O(n log n)` time complexity, where `n` is the size of the input *list*.
     )",
     .impl = prim_groupBy,
 });
@@ -4420,14 +4390,6 @@ static RegisterPrimOp primop_concatMap({
     .doc = R"(
       This function is equivalent to `builtins.concatLists (map f list)`
       but is more efficient.
-
-      # Time Complexity
-
-      O(k * T_f + N) where:
-
-      k = length of input list
-      T_f = time to call `f` on an element
-      N = total number of elements returned by `f` calls
     )",
     .impl = prim_concatMap,
 });
@@ -5131,13 +5093,6 @@ static RegisterPrimOp primop_concatStringsSep({
       Concatenate a list of strings with a separator between each
       element, e.g. `concatStringsSep "/" ["usr" "local" "bin"] ==
       "usr/local/bin"`.
-
-      # Time Complexity
-
-      O(n + m) (amortized) where:
-
-      n = number of list elements
-      m = total length of output string
     )",
     .impl = prim_concatStringsSep,
 });
@@ -5223,13 +5178,7 @@ static RegisterPrimOp primop_replaceStrings({
 
       evaluates to `"fabir"`.
 
-      # Time Complexity
-
-      O(n * k * c) (worst case) where:
-
-      n = length of input string
-      k = number of replacement patterns
-      c = average length of patterns in 'from' list
+      Has `O(n k)` time complexity, where `n` is the length of *s* and `k` is the number of replacements.
     )",
     .impl = prim_replaceStrings,
 });
diff --git a/src/libexpr/primops/context.cc b/src/libexpr/primops/context.cc
index d5d5de0b9aaf..7eef9daa2560 100644
--- a/src/libexpr/primops/context.cc
+++ b/src/libexpr/primops/context.cc
@@ -2,6 +2,7 @@
 #include "nix/expr/eval-inline.hh"
 #include "nix/store/derivations.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/build.hh"
 #include "nix/store/globals.hh"
 
 namespace nix {
@@ -272,7 +273,7 @@ static void prim_appendContext(EvalState & state, const PosIdx pos, Value ** arg
             state.error<EvalError>("context key '%s' is not a store path", name).atPos(i.pos).debugThrow();
         auto namePath = state.store->parseStorePath(name);
         if (!settings.readOnlyMode)
-            state.store->ensurePath(namePath);
+            state.store->getBuilder()->ensurePath(namePath);
         state.forceAttrs(*i.value, i.pos, "while evaluating the value of a string context");
 
         if (auto attr = i.value->attrs()->get(sPath)) {
diff --git a/src/libexpr/primops/derivation.nix b/src/libexpr/primops/derivation.nix
index dbb8c2186889..1d17c24ef11a 100644
--- a/src/libexpr/primops/derivation.nix
+++ b/src/libexpr/primops/derivation.nix
@@ -1,5 +1,5 @@
-# This is the implementation of the ‘derivation’ builtin function.
-# It's actually a wrapper around the ‘derivationStrict’ primop.
+# This is the implementation of the `derivation` builtin function.
+# It's actually a wrapper around the `derivationStrict` primop.
 # Note that the following comment will be shown in :doc in the repl, but not in the manual.
 
 /**
@@ -46,7 +46,7 @@ let
   outputToAttrListElement = outputName: {
     name = outputName;
     value = commonAttrs // {
-      outPath = builtins.getAttr outputName strict;
+      outPath = strict.${outputName};
       drvPath = strict.drvPath;
       type = "derivation";
       inherit outputName;
diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index db182ab499b2..fe3873c101b4 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -23,6 +23,8 @@ static void runFetchClosureWithRewrite(
     const std::optional<StorePath> & toPathMaybe,
     Value & v)
 {
+    if (toPathMaybe)
+        state.store->addTempRoot(*toPathMaybe);
 
     // establish toPath or throw
 
@@ -74,6 +76,7 @@ static void runFetchClosureWithRewrite(
 static void runFetchClosureWithContentAddressedPath(
     EvalState & state, const PosIdx pos, Store & fromStore, const StorePath & fromPath, Value & v)
 {
+    state.store->addTempRoot(fromPath);
 
     if (!state.store->isValidPath(fromPath))
         copyClosure(fromStore, *state.store, RealisedPath::Set{fromPath});
@@ -103,6 +106,7 @@ static void runFetchClosureWithContentAddressedPath(
 static void runFetchClosureWithInputAddressedPath(
     EvalState & state, const PosIdx pos, Store & fromStore, const StorePath & fromPath, Value & v)
 {
+    state.store->addTempRoot(fromPath);
 
     if (!state.store->isValidPath(fromPath))
         copyClosure(fromStore, *state.store, RealisedPath::Set{fromPath});
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index afd61e90fbb5..6ffcf91ed30a 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -1,8 +1,11 @@
+#include "nix/expr/value.hh"
 #include "nix/fetchers/attrs.hh"
 #include "nix/expr/primops.hh"
 #include "nix/expr/eval-inline.hh"
 #include "nix/expr/eval-settings.hh"
+#include "nix/expr/fetch-tree.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/build.hh"
 #include "nix/fetchers/fetchers.hh"
 #include "nix/store/filetransfer.hh"
 #include "nix/fetchers/registry.hh"
@@ -19,6 +22,101 @@
 
 namespace nix {
 
+/**
+ * Adapter for putting libfetchers data into a thunk closure.
+ * Used as the argument to prim_forceLazyFetcherAttr in a lazy apply thunk.
+ */
+class LazyFetcherAttr : public ExternalValueBase, public gc_cleanup
+{
+private:
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
+    fetchers::LazyAttr lazy;
+
+public:
+    LazyFetcherAttr(fetchers::LazyAttr lazy)
+        : lazy(std::move(lazy))
+    {
+    }
+
+    fetchers::ResolvedAttr force()
+    {
+        return lazy->compute();
+    }
+
+protected:
+    std::ostream & print(std::ostream & str) const override
+    {
+        unreachable();
+    }
+
+public:
+    std::string showType() const override
+    {
+        unreachable();
+    }
+
+    std::string typeOf() const override
+    {
+        unreachable();
+    }
+};
+
+void LazyFetcherAttr::anchor() {}
+
+/**
+ * Initialize a `Value` from a resolved fetcher attribute.
+ */
+static void resolvedAttrToValue(EvalState & state, Value & v, const fetchers::ResolvedAttr & resolved)
+{
+    std::visit(
+        overloaded{
+            [&](const std::string & s) { v.mkString(s, state.mem); },
+            [&](uint64_t n) { v.mkInt(n); },
+            [&](const Explicit<bool> & b) { v.mkBool(b.t); },
+        },
+        resolved);
+}
+
+/**
+ * internal primop: Force a LazyFetcherAttr external value.
+ */
+static void prim_forceLazyFetcherAttr(EvalState & state, const PosIdx pos, Value ** args, Value & v)
+{
+    Value & arg = *args[0];
+
+    state.forceValue(arg, pos);
+    // We only construct this primop with LazyFetcherAttr preapplied.
+    assert(arg.type() == nExternal);
+    auto * ext = dynamic_cast<LazyFetcherAttr *>(args[0]->external());
+    assert(ext);
+
+    resolvedAttrToValue(state, v, ext->force());
+}
+
+/**
+ * Emit a lazy thunk for a LazyAttr: mkApp(primop, externalValue).
+ */
+static void emitLazyAttrThunk(EvalState & state, const fetchers::LazyAttr & lazyAttr, Value & dest)
+{
+    // not user-callable (unregistered, internal)
+    static PrimOp forcePrimOp{
+        .name = "__forceLazyFetcherAttr",
+        .arity = 1,
+        .impl = prim_forceLazyFetcherAttr,
+        .internal = true,
+    };
+
+    auto * vExt = state.allocValue();
+    vExt->mkExternal(new LazyFetcherAttr(lazyAttr));
+
+    auto * vPrimOp = state.allocValue();
+    vPrimOp->mkPrimOp(&forcePrimOp);
+
+    dest.mkApp(vPrimOp, vExt);
+}
+
 void emitTreeAttrs(
     EvalState & state,
     const StorePath & storePath,
@@ -51,7 +149,9 @@ void emitTreeAttrs(
             attrs.alloc("shortRev").mkString(emptyHash.gitShortRev(), state.mem);
         }
 
-        if (auto revCount = input.getRevCount())
+        if (auto revCount = maybeGetLazyAttr(input.attrs, "revCount"))
+            emitLazyAttrThunk(state, *revCount, attrs.alloc("revCount"));
+        else if (auto revCount = input.getRevCount())
             attrs.alloc("revCount").mkInt(*revCount);
         else if (emptyRevFallback)
             attrs.alloc("revCount").mkInt(0);
@@ -463,7 +563,7 @@ static void fetch(
 
         // Try to get the path from the local store or substituters
         try {
-            state.store->ensurePath(expectedPath);
+            state.store->getBuilder()->ensurePath(expectedPath);
             debug("using substituted/cached path '%s' for '%s'", state.store->printStorePath(expectedPath), *url);
             state.allowAndSetStorePathString(expectedPath, v);
             return;
@@ -476,35 +576,39 @@ static void fetch(
         }
     }
 
-    // Download the file/tarball if substitution failed or no hash was provided
-    auto storePath = unpack ? fetchToStore(
-                                  state.fetchSettings,
-                                  *state.store,
-                                  fetchers::downloadTarball(*state.store, state.fetchSettings, *url),
-                                  FetchMode::Copy,
-                                  name)
-                            : fetchers::downloadFile(*state.store, state.fetchSettings, *url, name).storePath;
-
-    if (expectedHash) {
-        auto hash = unpack ? state.store->queryPathInfo(storePath)->narHash
-                           : hashPath(
-                                 {state.store->requireStoreObjectAccessor(storePath)},
-                                 FileSerialisationMethod::Flat,
-                                 HashAlgorithm::SHA256)
-                                 .hash;
-        if (hash != *expectedHash) {
-            state
-                .error<EvalError>(
-                    "hash mismatch in file downloaded from '%s':\n  specified: %s\n  got:       %s",
-                    *url,
-                    expectedHash->to_string(HashFormat::Nix32, true),
-                    hash.to_string(HashFormat::Nix32, true))
-                .withExitStatus(102)
-                .debugThrow();
+    if (unpack) {
+        auto attrs = fetchers::Attrs{
+            {"type", "tarball"},
+            {"url", *url},
+            {"name", name},
+        };
+        if (expectedHash)
+            attrs.emplace("narHash", expectedHash->to_string(HashFormat::SRI, true));
+        auto input = fetchers::Input::fromAttrs(state.fetchSettings, std::move(attrs));
+        auto cachedInput =
+            state.inputCache->getAccessor(state.fetchSettings, *state.store, input, fetchers::UseRegistries::No);
+        auto storePath = state.mountInput(cachedInput.lockedInput, input, cachedInput.accessor);
+        state.mkStorePathString(storePath, v);
+    } else {
+        auto storePath = fetchers::downloadFile(*state.store, state.fetchSettings, *url, name).storePath;
+        if (expectedHash) {
+            auto hash = hashPath(
+                            {state.store->requireStoreObjectAccessor(storePath)},
+                            FileSerialisationMethod::Flat,
+                            HashAlgorithm::SHA256)
+                            .hash;
+            if (hash != *expectedHash)
+                state
+                    .error<EvalError>(
+                        "hash mismatch in file downloaded from '%s':\n  specified: %s\n  got:       %s",
+                        *url,
+                        expectedHash->to_string(HashFormat::Nix32, true),
+                        hash.to_string(HashFormat::Nix32, true))
+                    .withExitStatus(102)
+                    .debugThrow();
         }
+        state.allowAndSetStorePathString(storePath, v);
     }
-
-    state.allowAndSetStorePathString(storePath, v);
 }
 
 static void prim_fetchurl(EvalState & state, const PosIdx pos, Value ** args, Value & v)
diff --git a/src/libexpr/primops/meson.build b/src/libexpr/primops/meson.build
index b8abc6409af9..c49755970525 100644
--- a/src/libexpr/primops/meson.build
+++ b/src/libexpr/primops/meson.build
@@ -1,8 +1,3 @@
-generated_headers += gen_header.process(
-  'derivation.nix',
-  preserve_path_from : meson.project_source_root(),
-)
-
 sources += files(
   'context.cc',
   'fetchClosure.cc',
diff --git a/src/libexpr/print-ambiguous.cc b/src/libexpr/print-ambiguous.cc
index ed91cad85a47..b0a5224f26e6 100644
--- a/src/libexpr/print-ambiguous.cc
+++ b/src/libexpr/print-ambiguous.cc
@@ -7,7 +7,13 @@
 namespace nix {
 
 // See: https://github.com/NixOS/nix/issues/9730
-void printAmbiguous(EvalState & state, Value & v, std::ostream & str, std::set<const void *> * seen, size_t depth)
+void printAmbiguous(
+    EvalState & state,
+    Value & v,
+    std::ostream & str,
+    std::set<const void *> * seen,
+    NixStringContext * context,
+    size_t depth)
 {
     checkInterrupt();
 
@@ -22,6 +28,8 @@ void printAmbiguous(EvalState & state, Value & v, std::ostream & str, std::set<c
         break;
     case nString:
         printLiteralString(str, v.string_view());
+        if (context)
+            copyContext(v, *context);
         break;
     case nPath:
         str << v.path().to_string(); // !!! escaping?
@@ -36,7 +44,7 @@ void printAmbiguous(EvalState & state, Value & v, std::ostream & str, std::set<c
             str << "{ ";
             for (auto & i : v.attrs()->lexicographicOrder(state.symbols)) {
                 str << state.symbols[i->name] << " = ";
-                printAmbiguous(state, *i->value, str, seen, depth + 1);
+                printAmbiguous(state, *i->value, str, seen, context, depth + 1);
                 str << "; ";
             }
             str << "}";
@@ -52,7 +60,7 @@ void printAmbiguous(EvalState & state, Value & v, std::ostream & str, std::set<c
             str << "[ ";
             for (auto v2 : v.listView()) {
                 if (v2)
-                    printAmbiguous(state, *v2, str, seen, depth + 1);
+                    printAmbiguous(state, *v2, str, seen, context, depth + 1);
                 else
                     str << "(nullptr)";
                 str << " ";
diff --git a/src/libexpr/print.cc b/src/libexpr/print.cc
index f2f62a636982..0c95ae60c5b6 100644
--- a/src/libexpr/print.cc
+++ b/src/libexpr/print.cc
@@ -162,6 +162,7 @@ class Printer
     std::ostream & output;
     EvalState & state;
     PrintOptions options;
+    NixStringContext * context;
     std::optional<ValuesSeen> seen;
     size_t totalAttrsPrinted = 0;
     size_t totalListItemsPrinted = 0;
@@ -577,9 +578,12 @@ class Printer
                 printBool(v);
                 break;
 
-            case nString:
+            case nString: {
                 printString(v);
+                if (context)
+                    copyContext(v, *context);
                 break;
+            }
 
             case nPath:
                 printPath(v);
@@ -632,10 +636,11 @@ class Printer
     }
 
 public:
-    Printer(std::ostream & output, EvalState & state, PrintOptions options)
+    Printer(std::ostream & output, EvalState & state, PrintOptions options, NixStringContext * context)
         : output(output)
         , state(state)
         , options(options)
+        , context(context)
     {
     }
 
@@ -656,14 +661,14 @@ class Printer
     }
 };
 
-void printValue(EvalState & state, std::ostream & output, Value & v, PrintOptions options)
+void printValue(EvalState & state, std::ostream & output, Value & v, PrintOptions options, NixStringContext * context)
 {
-    Printer(output, state, options).print(v);
+    Printer(output, state, options, context).print(v);
 }
 
 std::ostream & operator<<(std::ostream & output, const ValuePrinter & printer)
 {
-    printValue(printer.state, output, printer.value, printer.options);
+    printValue(printer.state, output, printer.value, printer.options, printer.context);
     return output;
 }
 
diff --git a/src/libexpr/value-to-json.cc b/src/libexpr/value-to-json.cc
index 8d48a48391cc..c844cd143032 100644
--- a/src/libexpr/value-to-json.cc
+++ b/src/libexpr/value-to-json.cc
@@ -104,6 +104,8 @@ json printValueAsJSON(
     return out;
 }
 
+void JSONSerializationError::anchor() {}
+
 void printValueAsJSON(
     EvalState & state,
     bool strict,
diff --git a/src/libexpr/value.cc b/src/libexpr/value.cc
index 8dbb277750ba..bfdee3cded9a 100644
--- a/src/libexpr/value.cc
+++ b/src/libexpr/value.cc
@@ -8,6 +8,8 @@
 
 namespace nix {
 
+Value::ExceptionRef::~ExceptionRef() {}
+
 Value Value::vEmptyList = []() {
     Value res;
     res.setStorage(List{.size = 0, .elems = nullptr});
diff --git a/src/libexpr/value/context.cc b/src/libexpr/value/context.cc
index 60ba5352077d..c61e1681c473 100644
--- a/src/libexpr/value/context.cc
+++ b/src/libexpr/value/context.cc
@@ -4,6 +4,8 @@
 
 namespace nix {
 
+void BadNixStringContextElem::anchor() {}
+
 NixStringContextElem NixStringContextElem::parse(std::string_view s0, const ExperimentalFeatureSettings & xpSettings)
 {
     std::string_view s = s0;
diff --git a/src/libfetchers-c/meson.build b/src/libfetchers-c/meson.build
index db415d9173e7..c55f4c8b1bda 100644
--- a/src/libfetchers-c/meson.build
+++ b/src/libfetchers-c/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -50,16 +50,33 @@ headers += files('nix_api_fetchers.h')
 subdir('nix-meson-build-support/export-all-symbols')
 subdir('nix-meson-build-support/windows-version')
 
-this_library = library(
-  'nixfetchersc',
-  sources,
-  soversion : nix_soversion,
-  dependencies : deps_public + deps_private + deps_other,
-  include_directories : include_dirs,
-  link_args : linker_export_flags,
-  prelink : true, # For C++ static initializers
-  install : true,
-)
+# For linking -c bindings into the cli for plugins.
+build_both_libraries = get_option('plugin-c-api')
+
+library_kwargs = {
+  'soversion' : nix_soversion,
+  'dependencies' : deps_public + deps_private + deps_other,
+  'include_directories' : include_dirs,
+  'link_args' : linker_export_flags,
+  'install' : true,
+}
+
+if build_both_libraries
+  this_libraries = both_libraries(
+    'nixfetchersc',
+    sources,
+    kwargs : library_kwargs,
+    override_options : [ 'b_lto=false' ],
+  )
+else
+  this_library = library(
+    'nixfetchersc',
+    sources,
+    kwargs : library_kwargs,
+  )
+endif
+
+plugin_c_api_enabled = build_both_libraries
 
 install_headers(headers, preserve_path : true)
 
diff --git a/src/libfetchers-c/meson.options b/src/libfetchers-c/meson.options
new file mode 100644
index 000000000000..a8b0c4df0401
--- /dev/null
+++ b/src/libfetchers-c/meson.options
@@ -0,0 +1,8 @@
+# vim: filetype=meson
+
+option(
+  'plugin-c-api',
+  type : 'boolean',
+  value : false,
+  yield : true,
+)
diff --git a/src/libfetchers-c/nix_api_fetchers.cc b/src/libfetchers-c/nix_api_fetchers.cc
index 7fefedb0c70f..2b3dd56631c5 100644
--- a/src/libfetchers-c/nix_api_fetchers.cc
+++ b/src/libfetchers-c/nix_api_fetchers.cc
@@ -7,7 +7,7 @@ extern "C" {
 nix_fetchers_settings * nix_fetchers_settings_new(nix_c_context * context)
 {
     try {
-        auto fetchersSettings = nix::make_ref<nix::fetchers::Settings>(nix::fetchers::Settings{});
+        auto fetchersSettings = nix::make_ref<nix::fetchers::Settings>();
         return new nix_fetchers_settings{
             .settings = fetchersSettings,
         };
diff --git a/src/libfetchers-c/package.nix b/src/libfetchers-c/package.nix
index 9a601d70417c..f490c91e7cb2 100644
--- a/src/libfetchers-c/package.nix
+++ b/src/libfetchers-c/package.nix
@@ -10,6 +10,7 @@
   # Configuration Options
 
   version,
+  withPluginCAPI,
 }:
 
 let
@@ -27,7 +28,7 @@ mkMesonLibrary (finalAttrs: {
     ../../.version
     ./.version
     ./meson.build
-    # ./meson.options
+    ./meson.options
     (fileset.fileFilter (file: file.hasExt "cc") ./.)
     (fileset.fileFilter (file: file.hasExt "hh") ./.)
     (fileset.fileFilter (file: file.hasExt "h") ./.)
@@ -41,6 +42,7 @@ mkMesonLibrary (finalAttrs: {
   ];
 
   mesonFlags = [
+    (lib.mesonBool "plugin-c-api" withPluginCAPI)
   ];
 
   meta = {
diff --git a/src/libfetchers-tests/attrs.cc b/src/libfetchers-tests/attrs.cc
new file mode 100644
index 000000000000..4d0cbbb9ef74
--- /dev/null
+++ b/src/libfetchers-tests/attrs.cc
@@ -0,0 +1,75 @@
+#include <gtest/gtest.h>
+
+#include "nix/fetchers/attrs.hh"
+
+#include <nlohmann/json.hpp>
+
+namespace nix::fetchers {
+
+TEST(LazyAttr, resolveToInt)
+{
+    Attrs attrs;
+    attrs.insert_or_assign(
+        "count", LazyAttr(make_ref<LazyAttrComputation>(LazyAttrComputation{.compute = []() -> ResolvedAttr {
+            return uint64_t(42);
+        }})));
+    EXPECT_EQ(maybeGetIntAttr(attrs, "count"), 42);
+}
+
+TEST(LazyAttr, resolveToString)
+{
+    Attrs attrs;
+    attrs.insert_or_assign(
+        "name", LazyAttr(make_ref<LazyAttrComputation>(LazyAttrComputation{.compute = []() -> ResolvedAttr {
+            return std::string("hello");
+        }})));
+    EXPECT_EQ(maybeGetStrAttr(attrs, "name"), "hello");
+}
+
+TEST(LazyAttr, resolveToBool)
+{
+    Attrs attrs;
+    attrs.insert_or_assign(
+        "flag", LazyAttr(make_ref<LazyAttrComputation>(LazyAttrComputation{.compute = []() -> ResolvedAttr {
+            return Explicit<bool>{true};
+        }})));
+    EXPECT_EQ(maybeGetBoolAttr(attrs, "flag"), true);
+}
+
+TEST(LazyAttr, attrsToJSONForcesLazy)
+{
+    Attrs attrs;
+    attrs.insert_or_assign(
+        "x", LazyAttr(make_ref<LazyAttrComputation>(LazyAttrComputation{.compute = []() -> ResolvedAttr {
+            return uint64_t(99);
+        }})));
+    auto json = attrsToJSON(attrs);
+    EXPECT_EQ(json["x"], 99);
+}
+
+TEST(LazyAttr, attrsToQueryForcesLazy)
+{
+    Attrs attrs;
+    attrs.insert_or_assign(
+        "v", LazyAttr(make_ref<LazyAttrComputation>(LazyAttrComputation{.compute = []() -> ResolvedAttr {
+            return std::string("val");
+        }})));
+    auto query = attrsToQuery(attrs);
+    EXPECT_EQ(query.at("v"), "val");
+}
+
+TEST(LazyAttr, notCalledUntilForced)
+{
+    int calls = 0;
+    Attrs attrs;
+    attrs.insert_or_assign(
+        "lazy", LazyAttr(make_ref<LazyAttrComputation>(LazyAttrComputation{.compute = [&calls]() -> ResolvedAttr {
+            calls++;
+            return uint64_t(1);
+        }})));
+    EXPECT_EQ(calls, 0);
+    maybeGetIntAttr(attrs, "lazy");
+    EXPECT_EQ(calls, 1);
+}
+
+} // namespace nix::fetchers
diff --git a/src/libfetchers-tests/git-lfs-fetch.cc b/src/libfetchers-tests/git-lfs-fetch.cc
new file mode 100644
index 000000000000..d01a43151df5
--- /dev/null
+++ b/src/libfetchers-tests/git-lfs-fetch.cc
@@ -0,0 +1,28 @@
+#include "nix/fetchers/git-lfs-fetch.hh"
+#include "nix/util/url.hh"
+
+#include <gtest/gtest.h>
+
+namespace nix::lfs {
+
+struct GitLFSParameterizedTestFixture : public ::testing::TestWithParam<std::pair<std::string, std::string>>
+{};
+
+TEST_P(GitLFSParameterizedTestFixture, get_lfs_api)
+{
+    auto & [input, expected] = GetParam();
+    ASSERT_EQ(getLfsApi(parseURL(input)).endpoint, expected);
+};
+
+INSTANTIATE_TEST_SUITE_P(
+    GitLFSTests,
+    GitLFSParameterizedTestFixture,
+    ::testing::Values(
+        std::pair{"https://git-server.com/foo/bar", "https://git-server.com/foo/bar.git/info/lfs"},
+        std::pair{"https://git-server.com/foo/bar.git", "https://git-server.com/foo/bar.git/info/lfs"},
+        std::pair{"https://git-server.com", "https://git-server.com/.git/info/lfs"},
+        std::pair{"https://git-server.com/", "https://git-server.com/.git/info/lfs"},
+        std::pair{"https://git-server.com//", "https://git-server.com//.git/info/lfs"},
+        std::pair{"https://git-server.com/foo/bar/", "https://git-server.com/foo/bar.git/info/lfs"}));
+
+} // namespace nix::lfs
diff --git a/src/libfetchers-tests/git-utils.cc b/src/libfetchers-tests/git-utils.cc
index 580769936d41..c1b357e12a0a 100644
--- a/src/libfetchers-tests/git-utils.cc
+++ b/src/libfetchers-tests/git-utils.cc
@@ -1,5 +1,7 @@
 #include "nix/fetchers/git-utils.hh"
 #include "nix/util/file-system.hh"
+#include "nix/util/tests/gmock-matchers.hh"
+
 #include <gmock/gmock.h>
 #include <git2/global.h>
 #include <git2/repository.h>
@@ -19,7 +21,7 @@ namespace nix::fetchers {
 class GitUtilsTest : public ::testing::Test
 {
     // We use a single repository for all tests.
-    std::unique_ptr<AutoDelete> delTmpDir;
+    AutoDelete delTmpDir;
 
 protected:
     std::filesystem::path tmpDir;
@@ -27,27 +29,19 @@ class GitUtilsTest : public ::testing::Test
 public:
     void SetUp() override
     {
-        tmpDir = createTempDir();
-        delTmpDir = std::make_unique<AutoDelete>(tmpDir, true);
-
-        // Create the repo with libgit2
-        git_libgit2_init();
-        git_repository * repo = nullptr;
-        auto r = git_repository_init(&repo, tmpDir.string().c_str(), 0);
-        ASSERT_EQ(r, 0);
-        git_repository_free(repo);
+        tmpDir = createTempDir() / "test-git-repo";
+        GitRepo::openRepo(tmpDir, {.create = true});
+        delTmpDir = AutoDelete(tmpDir, true);
     }
 
     void TearDown() override
     {
-        // Destroy the AutoDelete, triggering removal
-        // not AutoDelete::reset(), which would cancel the deletion.
-        delTmpDir.reset();
+        delTmpDir.deletePath();
     }
 
     ref<GitRepo> openRepo()
     {
-        return GitRepo::openRepo(tmpDir, {.create = true});
+        return GitRepo::openRepo(tmpDir, {.create = false});
     }
 
     std::string getRepoName() const
@@ -92,13 +86,24 @@ TEST_F(GitUtilsTest, sink_basic)
 
     auto result = repo->dereferenceSingletonDirectory(sink->flush());
     auto accessor = repo->getAccessor(result, {}, getRepoName());
-    auto entries = accessor->readDirectory(CanonPath::root);
-    ASSERT_EQ(entries.size(), 5u);
-    ASSERT_EQ(accessor->readFile(CanonPath("hello")), "hello world");
-    ASSERT_EQ(accessor->readFile(CanonPath("bye")), "thanks for all the fish");
-    ASSERT_EQ(accessor->readLink(CanonPath("bye-link")), "bye");
-    ASSERT_EQ(accessor->readDirectory(CanonPath("empty")).size(), 0u);
-    ASSERT_EQ(accessor->readFile(CanonPath("links/foo")), "hello world");
+
+    ASSERT_THAT(
+        accessor,
+        testing::HasDirectory(
+            CanonPath::root,
+            std::set<std::string>{
+                "hello",
+                "bye",
+                "bye-link",
+                "empty",
+                "links",
+            }));
+
+    ASSERT_THAT(accessor, testing::HasContents(CanonPath("hello"), "hello world"));
+    ASSERT_THAT(accessor, testing::HasContents(CanonPath("bye"), "thanks for all the fish"));
+    ASSERT_THAT(accessor, testing::HasSymlink(CanonPath("bye-link"), "bye"));
+    ASSERT_THAT(accessor, testing::HasDirectory(CanonPath("empty"), std::set<std::string>{}));
+    ASSERT_THAT(accessor, testing::HasContents(CanonPath("links/foo"), "hello world"));
 };
 
 TEST_F(GitUtilsTest, sink_hardlink)
@@ -117,12 +122,197 @@ TEST_F(GitUtilsTest, sink_hardlink)
         sink->flush();
         FAIL() << "Expected an exception";
     } catch (const nix::Error & e) {
-        ASSERT_THAT(e.msg(), testing::HasSubstr("does not exist"));
-        ASSERT_THAT(e.msg(), testing::HasSubstr("/hello"));
-        ASSERT_THAT(e.msg(), testing::HasSubstr("foo-1.1/link"));
+        ASSERT_THAT(e.msg(), ::testing::HasSubstr("does not exist"));
+        ASSERT_THAT(e.msg(), ::testing::HasSubstr("/hello"));
+        ASSERT_THAT(e.msg(), ::testing::HasSubstr("foo-1.1/link"));
     }
 };
 
+TEST_F(GitUtilsTest, sink_no_parent_dir)
+{
+    ASSERT_THAT(
+        [&]() {
+            auto repo = openRepo();
+            auto sink = repo->getFileSystemObjectSink();
+
+            sink->createDirectory(CanonPath::root);
+
+            sink->createRegularFile(CanonPath("foo"), [](CreateRegularFileSink & fileSink) {
+                writeString(fileSink, "test", /*executable=*/false);
+            });
+
+            sink->createRegularFile(CanonPath("foo/bar"), [](CreateRegularFileSink & fileSink) {
+                writeString(fileSink, "boom", /*executable=*/false);
+            });
+
+            sink->flush();
+        },
+        ::testing::ThrowsMessage<Error>(testing::HasSubstrIgnoreANSIMatcher("parent of 'foo/bar' is not a directory")));
+}
+
+TEST_F(GitUtilsTest, sink_no_parent_dir_symlink)
+{
+    ASSERT_THAT(
+        [&]() {
+            auto repo = openRepo();
+            auto sink = repo->getFileSystemObjectSink();
+
+            sink->createDirectory(CanonPath::root);
+
+            sink->createRegularFile(CanonPath("foo"), [](CreateRegularFileSink & fileSink) {
+                writeString(fileSink, "test", /*executable=*/false);
+            });
+
+            sink->createSymlink(CanonPath("foo/bar"), "target");
+
+            sink->flush();
+        },
+        ::testing::ThrowsMessage<Error>(testing::HasSubstrIgnoreANSIMatcher("parent of 'foo/bar' is not a directory")));
+}
+
+TEST_F(GitUtilsTest, sink_no_parent_dir_hardlink)
+{
+    ASSERT_THAT(
+        [&]() {
+            auto repo = openRepo();
+            auto sink = repo->getFileSystemObjectSink();
+
+            sink->createDirectory(CanonPath::root);
+
+            sink->createRegularFile(CanonPath("foo"), [](CreateRegularFileSink & fileSink) {
+                writeString(fileSink, "test", /*executable=*/false);
+            });
+
+            sink->createHardlink(CanonPath("foo/bar"), CanonPath("foo"));
+
+            sink->flush();
+        },
+        ::testing::ThrowsMessage<Error>(testing::HasSubstrIgnoreANSIMatcher("parent of 'foo/bar' is not a directory")));
+}
+
+TEST_F(GitUtilsTest, sink_replacing_empty_directory)
+{
+    auto repo = openRepo();
+    auto sink = repo->getFileSystemObjectSink();
+
+    sink->createDirectory(CanonPath::root);
+    sink->createDirectory(CanonPath("foo"));
+    sink->createDirectory(CanonPath("foo/bar"));
+    /* Under tarball unpacking semantics, creating the same directories
+       (implicitly or explicitly) is fine. */
+    sink->createDirectory(CanonPath("foo/bar"));
+    sink->createDirectory(CanonPath("foo"));
+
+    sink->createRegularFile(CanonPath("foo/bar"), [](CreateRegularFileSink & fileSink) {
+        writeString(fileSink, "test", /*executable=*/false);
+    });
+
+    auto accessor = repo->getAccessor(sink->flush(), {}, getRepoName());
+
+    ASSERT_THAT(accessor, testing::HasDirectory(CanonPath("foo"), std::set<std::string>{"bar"}));
+    ASSERT_THAT(accessor, testing::HasContents(CanonPath("foo/bar"), "test"));
+}
+
+TEST_F(GitUtilsTest, sink_replacing_non_empty_directory)
+{
+    ASSERT_THAT(
+        [&]() {
+            auto repo = openRepo();
+            auto sink = repo->getFileSystemObjectSink();
+
+            sink->createDirectory(CanonPath::root);
+            sink->createDirectory(CanonPath("foo"));
+            sink->createDirectory(CanonPath("foo/bar"));
+
+            /* This fails. libarchive (and other tarball unpackers) doesn't recursive unlink existing non-empty
+               directories.
+               https://github.com/libarchive/libarchive/blob/761652401fe35fca9744607a0cf0009afbf04f42/libarchive/archive_write_disk_posix.c#L3411-L3417
+             */
+
+            sink->createRegularFile(CanonPath("foo"), [](CreateRegularFileSink & fileSink) {
+                writeString(fileSink, "test", /*executable=*/false);
+            });
+
+            sink->flush();
+        },
+        ::testing::ThrowsMessage<Error>(
+            testing::HasSubstrIgnoreANSIMatcher("cannot create 'foo', conflicting non-empty directory")));
+}
+
+TEST_F(GitUtilsTest, sink_hardlink_to_directory)
+{
+    ASSERT_THAT(
+        [&]() {
+            auto repo = openRepo();
+            auto sink = repo->getFileSystemObjectSink();
+
+            sink->createDirectory(CanonPath::root);
+            sink->createDirectory(CanonPath("foo"));
+            sink->createHardlink(CanonPath("bar"), CanonPath("foo"));
+
+            sink->flush();
+        },
+        ::testing::ThrowsMessage<Error>(
+            testing::HasSubstrIgnoreANSIMatcher("cannot create a hard link to a directory")));
+}
+
+TEST_F(GitUtilsTest, sink_hardlink_to_directory_root)
+{
+    auto repo = openRepo();
+    auto sink = repo->getFileSystemObjectSink();
+
+    sink->createDirectory(CanonPath::root);
+    sink->createDirectory(CanonPath("foo"));
+    sink->createHardlink(CanonPath("bar"), CanonPath::root);
+
+    auto accessor = repo->getAccessor(sink->flush(), {}, getRepoName());
+
+    /* FIXME: Why does it behave this way? This seems like a bug. */
+    ASSERT_THAT(
+        accessor,
+        testing::HasDirectory(
+            CanonPath::root,
+            std::set<std::string>{
+                "foo",
+            }));
+}
+
+TEST_F(GitUtilsTest, sink_hardlink_to_self)
+{
+    /* Here we are more strict than libarchive, which only warns on cyclic hardlinks.
+       https://github.com/libarchive/libarchive/blob/761652401fe35fca9744607a0cf0009afbf04f42/libarchive/archive_write_disk_posix.c#L632-L641
+     */
+    ASSERT_THAT(
+        [&]() {
+            auto repo = openRepo();
+            auto sink = repo->getFileSystemObjectSink();
+
+            sink->createDirectory(CanonPath::root);
+            sink->createHardlink(CanonPath("foo"), CanonPath("foo"));
+
+            sink->flush();
+        },
+        ::testing::ThrowsMessage<Error>(testing::HasSubstrIgnoreANSIMatcher("/foo")));
+}
+
+TEST_F(GitUtilsTest, sink_non_directory_root)
+{
+    /* FIXME: Allow non-directory roots. GitFileSystemObjectSink is too tarball-brained. */
+    ASSERT_THAT(
+        [&]() {
+            auto repo = openRepo();
+            auto sink = repo->getFileSystemObjectSink();
+
+            sink->createRegularFile(CanonPath::root, [](CreateRegularFileSink & fileSink) {
+                writeString(fileSink, "test", /*executable=*/false);
+            });
+
+            sink->flush();
+        },
+        ::testing::ThrowsMessage<Error>(
+            testing::HasSubstrIgnoreANSIMatcher("cannot create a file at the root of the git repository")));
+}
+
 TEST_F(GitUtilsTest, peel_reference)
 {
     // Create a commit in the repo
diff --git a/src/libfetchers-tests/meson.build b/src/libfetchers-tests/meson.build
index ba9774e956b9..7123df54ebbe 100644
--- a/src/libfetchers-tests/meson.build
+++ b/src/libfetchers-tests/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -33,6 +33,9 @@ deps_private += rapidcheck
 gtest = dependency('gtest', main : true)
 deps_private += gtest
 
+gmock = dependency('gmock')
+deps_private += gmock
+
 libgit2 = dependency('libgit2')
 deps_private += libgit2
 
@@ -40,6 +43,8 @@ subdir('nix-meson-build-support/common')
 
 sources = files(
   'access-tokens.cc',
+  'attrs.cc',
+  'git-lfs-fetch.cc',
   'git-utils.cc',
   'git.cc',
   'input.cc',
diff --git a/src/libfetchers/attrs.cc b/src/libfetchers/attrs.cc
index cc9e72af460d..f3ecc3a87bc0 100644
--- a/src/libfetchers/attrs.cc
+++ b/src/libfetchers/attrs.cc
@@ -4,6 +4,18 @@
 
 namespace nix::fetchers {
 
+ResolvedAttr forceAttr(const Attr & attr)
+{
+    return std::visit(
+        overloaded{
+            [](const LazyAttr & lazy) -> ResolvedAttr { return lazy->compute(); },
+            [](const std::string & v) -> ResolvedAttr { return v; },
+            [](uint64_t v) -> ResolvedAttr { return v; },
+            [](const Explicit<bool> & v) -> ResolvedAttr { return v; },
+        },
+        attr);
+}
+
 Attrs jsonToAttrs(const nlohmann::json & json)
 {
     Attrs attrs;
@@ -26,11 +38,12 @@ nlohmann::json attrsToJSON(const Attrs & attrs)
 {
     nlohmann::json json;
     for (auto & attr : attrs) {
-        if (auto v = std::get_if<uint64_t>(&attr.second)) {
+        auto resolved = forceAttr(attr.second);
+        if (auto v = std::get_if<uint64_t>(&resolved)) {
             json[attr.first] = *v;
-        } else if (auto v = std::get_if<std::string>(&attr.second)) {
+        } else if (auto v = std::get_if<std::string>(&resolved)) {
             json[attr.first] = *v;
-        } else if (auto v = std::get_if<Explicit<bool>>(&attr.second)) {
+        } else if (auto v = std::get_if<Explicit<bool>>(&resolved)) {
             json[attr.first] = v->t;
         } else
             unreachable();
@@ -38,12 +51,23 @@ nlohmann::json attrsToJSON(const Attrs & attrs)
     return json;
 }
 
+std::optional<LazyAttr> maybeGetLazyAttr(const Attrs & attrs, const std::string & name)
+{
+    auto i = attrs.find(name);
+    if (i == attrs.end())
+        return {};
+    if (auto v = std::get_if<LazyAttr>(&i->second))
+        return *v;
+    return {};
+}
+
 std::optional<std::string> maybeGetStrAttr(const Attrs & attrs, const std::string & name)
 {
     auto i = attrs.find(name);
     if (i == attrs.end())
         return {};
-    if (auto v = std::get_if<std::string>(&i->second))
+    auto resolved = forceAttr(i->second);
+    if (auto v = std::get_if<std::string>(&resolved))
         return *v;
     throw Error("input attribute '%s' is not a string %s", name, attrsToJSON(attrs).dump());
 }
@@ -61,7 +85,8 @@ std::optional<uint64_t> maybeGetIntAttr(const Attrs & attrs, const std::string &
     auto i = attrs.find(name);
     if (i == attrs.end())
         return {};
-    if (auto v = std::get_if<uint64_t>(&i->second))
+    auto resolved = forceAttr(i->second);
+    if (auto v = std::get_if<uint64_t>(&resolved))
         return *v;
     throw Error("input attribute '%s' is not an integer", name);
 }
@@ -79,7 +104,8 @@ std::optional<bool> maybeGetBoolAttr(const Attrs & attrs, const std::string & na
     auto i = attrs.find(name);
     if (i == attrs.end())
         return {};
-    if (auto v = std::get_if<Explicit<bool>>(&i->second))
+    auto resolved = forceAttr(i->second);
+    if (auto v = std::get_if<Explicit<bool>>(&resolved))
         return v->t;
     throw Error("input attribute '%s' is not a Boolean", name);
 }
@@ -96,11 +122,12 @@ StringMap attrsToQuery(const Attrs & attrs)
 {
     StringMap query;
     for (auto & attr : attrs) {
-        if (auto v = std::get_if<uint64_t>(&attr.second)) {
+        auto resolved = forceAttr(attr.second);
+        if (auto v = std::get_if<uint64_t>(&resolved)) {
             query.insert_or_assign(attr.first, fmt("%d", *v));
-        } else if (auto v = std::get_if<std::string>(&attr.second)) {
+        } else if (auto v = std::get_if<std::string>(&resolved)) {
             query.insert_or_assign(attr.first, *v);
-        } else if (auto v = std::get_if<Explicit<bool>>(&attr.second)) {
+        } else if (auto v = std::get_if<Explicit<bool>>(&resolved)) {
             query.insert_or_assign(attr.first, v->t ? "1" : "0");
         } else
             unreachable();
diff --git a/src/libfetchers/cache.cc b/src/libfetchers/cache.cc
index cf60e29a8e15..390180080145 100644
--- a/src/libfetchers/cache.cc
+++ b/src/libfetchers/cache.cc
@@ -26,6 +26,8 @@ create table if not exists Cache (
 
 struct CacheImpl : Cache
 {
+    void anchor() override;
+
     struct State
     {
         SQLite db;
@@ -60,7 +62,11 @@ struct CacheImpl : Cache
     void upsert(const Key & key, const Attrs & value) override
     {
         _state.lock()
-            ->upsert.use()(key.first)(attrsToJSON(key.second).dump())(attrsToJSON(value).dump())(time(nullptr))
+            ->upsert.use()
+            .apply(key.first)
+            .apply(attrsToJSON(key.second).dump())
+            .apply(attrsToJSON(value).dump())
+            .apply(time(nullptr))
             .exec();
     }
 
@@ -87,7 +93,7 @@ struct CacheImpl : Cache
 
         auto keyJSON = attrsToJSON(key.second).dump();
 
-        auto stmt(state->lookup.use()(key.first)(keyJSON));
+        auto stmt(state->lookup.use().apply(key.first).apply(keyJSON));
         if (!stmt.next()) {
             debug("did not find cache entry for '%s:%s'", key.first, keyJSON);
             return {};
@@ -156,6 +162,10 @@ struct CacheImpl : Cache
     }
 };
 
+void Cache::anchor() {}
+
+void CacheImpl::anchor() {}
+
 ref<Cache> Settings::getCache() const
 {
     auto cache(_cache.lock());
diff --git a/src/libfetchers/fetch-settings.cc b/src/libfetchers/fetch-settings.cc
index f92b94a0b3bd..8839a0fde4f0 100644
--- a/src/libfetchers/fetch-settings.cc
+++ b/src/libfetchers/fetch-settings.cc
@@ -4,4 +4,6 @@ namespace nix::fetchers {
 
 Settings::Settings() {}
 
+void Settings::anchor() {}
+
 } // namespace nix::fetchers
diff --git a/src/libfetchers/fetch-to-store.cc b/src/libfetchers/fetch-to-store.cc
index 3af2d4c83e88..085c97da7d01 100644
--- a/src/libfetchers/fetch-to-store.cc
+++ b/src/libfetchers/fetch-to-store.cc
@@ -3,8 +3,23 @@
 #include "nix/fetchers/fetch-settings.hh"
 #include "nix/util/environment-variables.hh"
 
+#include <boost/unordered/concurrent_flat_map.hpp>
+
 namespace nix {
 
+struct SrcToStore
+{
+    boost::concurrent_flat_map<
+        std::tuple<SourcePath, ContentAddressMethod::Raw, std::string>,
+        std::tuple<StorePath, Hash, FetchMode>>
+        cache;
+};
+
+ref<SrcToStore> fetchers::Settings::createSrcToStore()
+{
+    return make_ref<SrcToStore>();
+}
+
 fetchers::Cache::Key
 makeSourcePathToHashCacheKey(std::string_view fingerprint, ContentAddressMethod method, const CanonPath & path)
 {
@@ -36,6 +51,14 @@ std::pair<StorePath, Hash> fetchToStore2(
     PathFilter * filter,
     RepairFlag repair)
 {
+    auto srcToStoreKey = std::make_tuple(path, method.raw, std::string(name));
+
+    if (!filter) {
+        auto dstPathCached = getConcurrent(settings.srcToStore->cache, srcToStoreKey);
+        if (dstPathCached && (mode == FetchMode::DryRun || std::get<2>(*dstPathCached) == FetchMode::Copy))
+            return std::make_pair(std::get<0>(*dstPathCached), std::get<1>(*dstPathCached));
+    }
+
     std::optional<fetchers::Cache::Key> cacheKey;
 
     auto [subpath, fingerprint] = filter ? std::pair<CanonPath, std::optional<std::string>>{path.path, std::nullopt}
@@ -59,6 +82,7 @@ std::pair<StorePath, Hash> fetchToStore2(
                     path,
                     store.printStorePath(storePath),
                     hash.to_string(HashFormat::SRI, true));
+                settings.srcToStore->cache.insert_or_assign(srcToStoreKey, std::make_tuple(storePath, hash, mode));
                 return {storePath, hash};
             }
             debug("source path '%s' not in store", path);
@@ -67,7 +91,6 @@ std::pair<StorePath, Hash> fetchToStore2(
         static auto barf = getEnv("_NIX_TEST_BARF_ON_UNCACHEABLE").value_or("") == "1";
         if (barf && !filter)
             throw Error("source path '%s' is uncacheable (filter=%d)", path, (bool) filter);
-        // FIXME: could still provide in-memory caching keyed on `SourcePath`.
         debug("source path '%s' is uncacheable", path);
     }
 
@@ -82,6 +105,7 @@ std::pair<StorePath, Hash> fetchToStore2(
     auto [storePath, hash] =
         mode == FetchMode::DryRun
             ? [&]() {
+                  // FIXME: we may have already computed this above.
                   auto [storePath, hash] =
                       store.computeStorePath(name, path, method, HashAlgorithm::SHA256, {}, filter2);
                   debug(
@@ -102,8 +126,9 @@ std::pair<StorePath, Hash> fetchToStore2(
                           throw Error("path '%s' lacks a CA field", store.printStorePath(storePath));
                       info->ca->hash;
                   });
-                  debug(
-                      "copied '%s' to '%s' (hash '%s')",
+                  printMsg(
+                      lvlChatty,
+                      "copied source '%s' -> '%s' (hash '%s')",
                       path,
                       store.printStorePath(storePath),
                       hash.to_string(HashFormat::SRI, true));
@@ -113,6 +138,9 @@ std::pair<StorePath, Hash> fetchToStore2(
     if (cacheKey)
         settings.getCache()->upsert(*cacheKey, {{"hash", hash.to_string(HashFormat::SRI, true)}});
 
+    if (!filter)
+        settings.srcToStore->cache.insert_or_assign(srcToStoreKey, std::make_tuple(storePath, hash, mode));
+
     return {storePath, hash};
 }
 
diff --git a/src/libfetchers/fetchers.cc b/src/libfetchers/fetchers.cc
index fb87f9b94506..4d6826cce439 100644
--- a/src/libfetchers/fetchers.cc
+++ b/src/libfetchers/fetchers.cc
@@ -1,13 +1,18 @@
 #include "nix/fetchers/fetchers.hh"
 #include "nix/store/store-api.hh"
 #include "nix/util/fs-sink.hh"
+#include "nix/store/build.hh"
 #include "nix/util/source-path.hh"
 #include "nix/fetchers/fetch-to-store.hh"
 #include "nix/util/json-utils.hh"
 #include "nix/fetchers/fetch-settings.hh"
 #include "nix/fetchers/fetch-to-store.hh"
 #include "nix/util/url.hh"
+#include "nix/util/users.hh"
+#include "nix/store/pathlocks.hh"
+#include "nix/util/environment-variables.hh"
 
+#include <thread>
 #include <nlohmann/json.hpp>
 
 namespace nix::fetchers {
@@ -121,6 +126,9 @@ std::optional<std::string> Input::getFingerprint(Store & store) const
 
     auto fingerprint = scheme->getFingerprint(store, *this);
 
+    if (fingerprint)
+        fingerprint = std::string(scheme->schemeName()) + ":" + *fingerprint;
+
     cachedFingerprint = fingerprint;
 
     return fingerprint;
@@ -163,8 +171,7 @@ bool Input::isFinal() const
 
 std::optional<std::filesystem::path> Input::isRelative() const
 {
-    assert(scheme);
-    return scheme->isRelative(*this);
+    return scheme ? scheme->isRelative(*this) : std::nullopt;
 }
 
 Attrs Input::toAttrs() const
@@ -316,7 +323,9 @@ std::pair<ref<SourceAccessor>, Input> Input::getAccessorUnchecked(const Settings
         try {
             auto storePath = computeStorePath(store);
 
-            store.ensurePath(storePath);
+            store.addTempRoot(storePath);
+
+            store.getBuilder()->ensurePath(storePath);
 
             debug("using substituted/cached input '%s' in '%s'", to_string(), store.printStorePath(storePath));
 
@@ -342,6 +351,21 @@ std::pair<ref<SourceAccessor>, Input> Input::getAccessorUnchecked(const Settings
         }
     }
 
+    /* Acquire a path lock on this input. Note that fetching the same input in parallel is supposed to be safe (it's up
+     * to the fetchers to guarantee this), so this is merely intended to avoid work duplication. Note that we don't need
+     * this when substituting the input. */
+    auto lockFilePath =
+        getCacheDir() / "fetcher-locks"
+        / hashString(HashAlgorithm::SHA256, attrsToJSON(toAttrs()).dump()).to_string(HashFormat::Base16, false);
+    createDirs(lockFilePath.parent_path());
+    PathLocks lock(
+        {lockFilePath.string()}, fmt("waiting for another Nix process to finish fetching input '%s'...", to_string()));
+    lock.setDeletion(true);
+
+    static auto inTest = getEnv("_NIX_TEST_CONCURRENT_FETCHES") == "1";
+    if (inTest)
+        std::this_thread::sleep_for(std::chrono::seconds(1));
+
     auto [accessor, result] = scheme->getAccessor(settings, store, *this);
 
     if (!accessor->fingerprint)
@@ -361,19 +385,20 @@ Input Input::applyOverrides(std::optional<std::string> ref, std::optional<Hash>
 
 void Input::clone(const Settings & settings, Store & store, const std::filesystem::path & destDir) const
 {
-    assert(scheme);
+    if (!scheme)
+        throw Error("cannot clone unsupported input '%s'", attrsToJSON(attrs));
     scheme->clone(settings, store, *this, destDir);
 }
 
 std::optional<std::filesystem::path> Input::getSourcePath() const
 {
-    assert(scheme);
-    return scheme->getSourcePath(*this);
+    return scheme ? scheme->getSourcePath(*this) : std::nullopt;
 }
 
 void Input::putFile(const CanonPath & path, std::string_view contents, std::optional<std::string> commitMsg) const
 {
-    assert(scheme);
+    if (!scheme)
+        throw Error("unsupported input '%s' does not support modifying file '%s'", attrsToJSON(attrs), path);
     return scheme->putFile(*this, path, contents, commitMsg);
 }
 
@@ -504,12 +529,11 @@ std::string publicKeys_to_string(const std::vector<PublicKey> & publicKeys)
 
 namespace nlohmann {
 
-using namespace nix;
-
 #ifndef DOXYGEN_SKIP
 
-fetchers::PublicKey adl_serializer<fetchers::PublicKey>::from_json(const json & json)
+nix::fetchers::PublicKey adl_serializer<nix::fetchers::PublicKey>::from_json(const json & json)
 {
+    using namespace nix;
     fetchers::PublicKey res = {};
     auto & obj = getObject(json);
     if (auto * type = optionalValueAt(obj, "type"))
@@ -520,7 +544,7 @@ fetchers::PublicKey adl_serializer<fetchers::PublicKey>::from_json(const json &
     return res;
 }
 
-void adl_serializer<fetchers::PublicKey>::to_json(json & json, const fetchers::PublicKey & p)
+void adl_serializer<nix::fetchers::PublicKey>::to_json(json & json, const nix::fetchers::PublicKey & p)
 {
     json["type"] = p.type;
     json["key"] = p.key;
diff --git a/src/libfetchers/filtering-source-accessor.cc b/src/libfetchers/filtering-source-accessor.cc
index 6fe7d2504ec3..ceb6457d473d 100644
--- a/src/libfetchers/filtering-source-accessor.cc
+++ b/src/libfetchers/filtering-source-accessor.cc
@@ -62,11 +62,6 @@ std::pair<CanonPath, std::optional<std::string>> FilteringSourceAccessor::getFin
     return next->getFingerprint(prefix / path);
 }
 
-void FilteringSourceAccessor::invalidateCache(const CanonPath & path)
-{
-    next->invalidateCache(prefix / path);
-}
-
 void FilteringSourceAccessor::checkAccess(const CanonPath & path)
 {
     if (!isAllowed(path))
@@ -75,6 +70,9 @@ void FilteringSourceAccessor::checkAccess(const CanonPath & path)
 
 struct AllowListSourceAccessorImpl : AllowListSourceAccessor
 {
+private:
+    void anchor() override {};
+public:
     SharedSync<std::set<CanonPath>> allowedPrefixes;
     boost::concurrent_flat_set<CanonPath> allowedPaths;
 
diff --git a/src/libfetchers/git-lfs-fetch.cc b/src/libfetchers/git-lfs-fetch.cc
index 9d2fb928d603..c80732a0c21f 100644
--- a/src/libfetchers/git-lfs-fetch.cc
+++ b/src/libfetchers/git-lfs-fetch.cc
@@ -1,12 +1,15 @@
 #include "nix/fetchers/git-lfs-fetch.hh"
 #include "nix/fetchers/git-utils.hh"
 #include "nix/store/filetransfer.hh"
+#include "nix/util/file-descriptor.hh"
+#include "nix/util/file-system.hh"
 #include "nix/util/os-string.hh"
 #include "nix/util/processes.hh"
 #include "nix/util/url.hh"
 #include "nix/util/users.hh"
 #include "nix/util/util.hh"
 #include "nix/util/hash.hh"
+#include "nix/util/json-utils.hh"
 #include "nix/store/ssh.hh"
 #include "nix/util/deleter.hh"
 
@@ -22,9 +25,7 @@ namespace nix::lfs {
 static void downloadToSink(
     const std::string & url,
     const std::optional<std::string> & authHeader,
-    // FIXME: passing a StringSink is superfluous, we may as well
-    // return a string. Or use an abstract Sink for streaming.
-    StringSink & sink,
+    Sink & sink,
     std::string sha256Expected,
     size_t sizeExpected)
 {
@@ -33,29 +34,25 @@ static void downloadToSink(
     if (authHeader.has_value())
         headers.push_back({"Authorization", *authHeader});
     request.headers = headers;
-    getFileTransfer()->download(std::move(request), sink);
 
-    auto sizeActual = sink.s.length();
-    if (sizeExpected != sizeActual)
-        throw Error("size mismatch while fetching %s: expected %d but got %d", url, sizeExpected, sizeActual);
+    HashSink hashSink(HashAlgorithm::SHA256);
+    TeeSink teeSink(hashSink, sink);
 
-    auto sha256Actual = hashString(HashAlgorithm::SHA256, sink.s).to_string(HashFormat::Base16, false);
+    getFileTransfer()->download(std::move(request), teeSink);
+
+    auto hashResult = hashSink.finish();
+
+    if (sizeExpected != hashResult.numBytesDigested)
+        throw Error(
+            "size mismatch while fetching %s: expected %d but got %d", url, sizeExpected, hashResult.numBytesDigested);
+
+    auto sha256Actual = hashResult.hash.to_string(HashFormat::Base16, false);
     if (sha256Actual != sha256Expected)
         throw Error(
             "hash mismatch while fetching %s: expected sha256:%s but got sha256:%s", url, sha256Expected, sha256Actual);
 }
 
-namespace {
-
-struct LfsApiInfo
-{
-    std::string endpoint;
-    std::optional<std::string> authHeader;
-};
-
-} // namespace
-
-static LfsApiInfo getLfsApi(const ParsedURL & url)
+LfsApiInfo getLfsApi(ParsedURL url)
 {
     assert(url.authority.has_value());
     if (url.scheme == "ssh") {
@@ -95,7 +92,41 @@ static LfsApiInfo getLfsApi(const ParsedURL & url)
         return {queryResp.at("href").get<std::string>(), authIt->get<std::string>()};
     }
 
-    return {url.to_string() + "/info/lfs", std::nullopt};
+    /**
+     * Try to mimic what git-lfs will do to plain remotes
+     * https://github.com/git-lfs/git-lfs/blob/main/docs/api/server-discovery.md
+     *
+     * Try to be smarter with remotes ending in a /, like
+     * `https://github.com/NixOS/nix/`. This should be
+     * `https://github.com/NixOS/nix.git/info/lfs`, not
+     * `https://github.com/NixOS/nix/.git/info/lfs`
+     */
+    bool hasDotGit = false;
+    for (auto it = url.path.rbegin(); it != url.path.rend(); ++it) {
+        if (it->empty())
+            continue;
+        if (!it->ends_with(".git"))
+            *it += ".git";
+        hasDotGit = true;
+        break;
+    }
+    if (!hasDotGit) {
+        if (url.path.size() > 1) // e.g. {"", ""} (single trailing slash)
+            url.path.back() = ".git";
+        else if (url.path.size() == 1) // {""}
+            url.path.push_back(".git");
+        else { // {}
+            url.path.push_back("");
+            url.path.push_back(".git");
+        }
+    }
+    if (url.path.back().empty())
+        url.path.back() = "info";
+    else
+        url.path.push_back("info");
+    url.path.push_back("lfs");
+
+    return {url.to_string(), std::nullopt};
 }
 
 typedef std::unique_ptr<git_config, Deleter<git_config_free>> GitConfig;
@@ -254,7 +285,7 @@ std::vector<nlohmann::json> Fetch::fetchUrls(const std::vector<Pointer> & pointe
 void Fetch::fetch(
     const std::string & content,
     const CanonPath & pointerFilePath,
-    StringSink & sink,
+    Sink & sink,
     std::function<void(uint64_t)> sizeCallback) const
 {
     debug("trying to fetch '%s' using git-lfs", pointerFilePath);
@@ -278,9 +309,13 @@ void Fetch::fetch(
     std::string key = hashString(HashAlgorithm::SHA256, pointerFilePath.rel()).to_string(HashFormat::Base16, false)
                       + "/" + pointer->oid;
     auto cachePath = cacheDir / key;
-    if (pathExists(cachePath)) {
+    AutoCloseFD cacheFile(openFileReadonly(cachePath, FinalSymlink::DontFollow));
+    if (cacheFile) {
         debug("using cache entry %s -> %s", key, PathFmt(cachePath));
-        sink(readFile(cachePath));
+        FdSource cacheSource(cacheFile.get());
+        auto size = getFileSize(cacheFile.get());
+        sizeCallback(size);
+        cacheSource.drainInto(sink, size);
         return;
     }
     debug("did not find cache entry for %s", key);
@@ -291,7 +326,8 @@ void Fetch::fetch(
 
     const auto obj = objUrls[0];
     try {
-        std::string sha256 = obj.at("oid"); // oid is also the sha256
+        // Use the committed pointer's oid/size for integrity, not server's claim
+        std::string sha256 = pointer->oid;
         std::string ourl = obj.at("actions").at("download").at("href");
         auto authHeader = [&]() -> std::optional<std::string> {
             const auto & download = obj.at("actions").at("download");
@@ -303,14 +339,37 @@ void Fetch::fetch(
                 return std::nullopt;
             return std::string(*authIt);
         }();
-        const uint64_t size = obj.at("size");
-        sizeCallback(size);
-        downloadToSink(ourl, authHeader, sink, sha256, size);
+        const uint64_t size = pointer->size;
+
+        auto objOid = getString(valueAt(getObject(obj), "oid"));
+        auto objSize = getUnsigned(valueAt(getObject(obj), "size"));
+        if (objOid != pointer->oid || objSize != pointer->size) {
+            throw Error(
+                "LFS server returned mismatched oid/size for '%s' (got oid=%s size=%d, expected oid=%s size=%d)",
+                pointerFilePath,
+                objOid,
+                objSize,
+                pointer->oid,
+                pointer->size);
+        }
 
         debug("creating cache entry %s -> %s", key, PathFmt(cachePath));
+
         if (!pathExists(cachePath.parent_path()))
             createDirs(cachePath.parent_path());
-        writeFile(cachePath, sink.s);
+        auto [tempFile, tempPath] = createTempFile(cachePath.parent_path(), {});
+        AutoDelete tempDeleter(tempPath);
+        FdSink tempSink(tempFile.get());
+        downloadToSink(ourl, authHeader, tempSink, sha256, size);
+        tempSink.flush();
+
+        std::filesystem::rename(tempPath, cachePath);
+        tempDeleter.cancel();
+
+        FdSource cacheSource(tempFile.get());
+        cacheSource.restart();
+        sizeCallback(size);
+        cacheSource.drainInto(sink, size);
 
         debug("%s fetched with git-lfs", pointerFilePath);
     } catch (const nlohmann::json::out_of_range & e) {
diff --git a/src/libfetchers/git-utils.cc b/src/libfetchers/git-utils.cc
index 6bc474395af8..ac46028cbe0a 100644
--- a/src/libfetchers/git-utils.cc
+++ b/src/libfetchers/git-utils.cc
@@ -45,6 +45,7 @@
 #include <iostream>
 #include <regex>
 #include <ranges>
+#include <future>
 
 namespace std {
 
@@ -74,6 +75,8 @@ namespace nix {
 
 struct GitSourceAccessor;
 
+namespace {
+
 struct GitError final : public CloneableError<GitError, Error>
 {
     template<typename... Ts>
@@ -97,6 +100,34 @@ struct GitError final : public CloneableError<GitError, Error>
     }
 };
 
+struct GitIndexerSink final : public BufferedSink
+{
+    git_indexer * indexer;
+    git_indexer_progress stats{};
+
+    GitIndexerSink(git_indexer * indexer)
+        : BufferedSink(1 * 1024 * 1024)
+        , indexer(indexer)
+    {
+        assert(indexer);
+    }
+
+    GitIndexerSink(GitIndexerSink &&) = delete;
+    GitIndexerSink(const GitIndexerSink &) = delete;
+    GitIndexerSink & operator=(GitIndexerSink &&) = delete;
+    GitIndexerSink & operator=(const GitIndexerSink &) = delete;
+    ~GitIndexerSink() = default;
+
+    void writeUnbuffered(std::string_view data) override
+    {
+        checkInterrupt();
+        if (git_indexer_append(indexer, data.data(), data.size(), &stats))
+            throw GitError("appending to git packfile index");
+    }
+};
+
+} // namespace
+
 typedef std::unique_ptr<git_repository, Deleter<git_repository_free>> Repository;
 typedef std::unique_ptr<git_tree_entry, Deleter<git_tree_entry_free>> TreeEntry;
 typedef std::unique_ptr<git_tree, Deleter<git_tree_free>> Tree;
@@ -226,7 +257,7 @@ static git_packbuilder_progress PACKBUILDER_PROGRESS_CHECK_INTERRUPT = &packBuil
 
 static void initRepoAtomically(std::filesystem::path & path, GitRepo::Options options)
 {
-    if (pathExists(path.string()))
+    if (pathExists(path))
         return;
 
     if (!options.create)
@@ -333,46 +364,67 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
 
     void flush() override
     {
+        std::size_t objectCount;
+        if (git_mempack_object_count(&objectCount, mempackBackend))
+            throw GitError("querying the number of objects in a git memory packer backend");
+
+        if (!objectCount)
+            /* Nothing to do. */
+            return;
+
         checkInterrupt();
 
-        git_buf buf = GIT_BUF_INIT;
-        Finally _disposeBuf{[&] { git_buf_dispose(&buf); }};
         PackBuilder packBuilder;
         PackBuilderContext packBuilderContext;
-        git_packbuilder_new(Setter(packBuilder), *this);
-        git_packbuilder_set_callbacks(packBuilder.get(), PACKBUILDER_PROGRESS_CHECK_INTERRUPT, &packBuilderContext);
+        if (git_packbuilder_new(Setter(packBuilder), *this))
+            throw GitError("creating git pack builder");
+
+        if (git_packbuilder_set_callbacks(packBuilder.get(), PACKBUILDER_PROGRESS_CHECK_INTERRUPT, &packBuilderContext))
+            throw GitError("setting git pack builder callbacks");
+
         git_packbuilder_set_threads(packBuilder.get(), 0 /* autodetect */);
 
         packBuilderContext.handleException(
             "preparing packfile", git_mempack_write_thin_pack(mempackBackend, packBuilder.get()));
         checkInterrupt();
-        packBuilderContext.handleException("writing packfile", git_packbuilder_write_buf(&buf, packBuilder.get()));
-        checkInterrupt();
 
-        std::string repo_path = std::string(git_repository_path(repo.get()));
-        while (!repo_path.empty() && repo_path.back() == '/')
-            repo_path.pop_back();
-        std::string pack_dir_path = repo_path + "/objects/pack";
+        auto packFilesPath = std::filesystem::path(git_repository_path(repo.get())) / "objects/pack";
 
-        // TODO (performance): could the indexing be done in a separate thread?
-        //                     we'd need a more streaming variation of
-        //                     git_packbuilder_write_buf, or incur the cost of
-        //                     copying parts of the buffer to a separate thread.
-        //                     (synchronously on the git_packbuilder_write_buf thread)
         Indexer indexer;
-        git_indexer_progress stats;
-        if (git_indexer_new(Setter(indexer), pack_dir_path.c_str(), 0, nullptr, nullptr))
+        if (git_indexer_new(Setter(indexer), packFilesPath.c_str(), 0, nullptr, nullptr))
             throw GitError("creating git packfile indexer");
 
-        // TODO: provide index callback for checkInterrupt() termination
-        //       though this is about an order of magnitude faster than the packbuilder
-        //       expect up to 1 sec latency due to uninterruptible git_indexer_append.
-        constexpr size_t chunkSize = 128 * 1024;
-        for (size_t offset = 0; offset < buf.size; offset += chunkSize) {
-            if (git_indexer_append(indexer.get(), buf.ptr + offset, std::min(chunkSize, buf.size - offset), &stats))
-                throw GitError("appending to git packfile index");
-            checkInterrupt();
-        }
+        struct State
+        {
+            Indexer & indexer;
+            PackBuilderContext & packBuilderContext;
+            GitIndexerSink sink{indexer.get()};
+        };
+
+        State state{
+            .indexer = indexer,
+            .packBuilderContext = packBuilderContext,
+        };
+
+        packBuilderContext.handleException(
+            "writing packfile",
+            git_packbuilder_foreach(
+                packBuilder.get(),
+                [](void * buf, size_t size, void * payload) -> int {
+                    auto & state = *static_cast<State *>(payload);
+                    try {
+                        state.sink(std::string_view(static_cast<const char *>(buf), size));
+                    } catch (...) {
+                        state.packBuilderContext.exception = std::current_exception();
+                        return GIT_EUSER;
+                    }
+                    return GIT_OK;
+                },
+                &state));
+
+        state.sink.flush();
+
+        auto & stats = state.sink.stats;
 
         if (git_indexer_commit(indexer.get(), &stats))
             throw GitError("committing git packfile index");
@@ -380,6 +432,12 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
         if (git_mempack_reset(mempackBackend))
             throw GitError("resetting git mempack backend");
 
+        debug(
+            "committed index and pack file to pack-%s.{idx,pack}, objects = %d, deltas = %d",
+            git_indexer_name(indexer.get()),
+            stats.total_objects,
+            stats.total_deltas);
+
         checkInterrupt();
     }
 
@@ -389,7 +447,6 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
      */
     Pool<GitRepoImpl> getPool()
     {
-        // TODO: as an optimization, it would be nice to include `this` in the pool.
         return Pool<GitRepoImpl>(std::numeric_limits<size_t>::max(), [this]() -> ref<GitRepoImpl> {
             auto repo = make_ref<GitRepoImpl>(path, options);
 
@@ -570,7 +627,7 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
 
         /* Get submodule info. */
         auto modulesFile = path / ".gitmodules";
-        if (pathExists(modulesFile.string()))
+        if (pathExists(modulesFile))
             info.submodules = parseSubmodules(modulesFile);
 
         return info;
@@ -782,8 +839,11 @@ ref<GitRepo> GitRepo::openRepo(const std::filesystem::path & path, GitRepo::Opti
  * Raw git tree input accessor.
  */
 
-struct GitSourceAccessor : SourceAccessor
+struct GitSourceAccessor final : SourceAccessor
 {
+private:
+    void anchor() override {};
+public:
     struct State
     {
         ref<GitRepoImpl> repo;
@@ -812,20 +872,16 @@ struct GitSourceAccessor : SourceAccessor
 
         if (state->lfsFetch) {
             if (state->lfsFetch->shouldFetch(path)) {
-                StringSink s;
                 try {
                     // FIXME: do we need to hold the state lock while
                     // doing this?
                     auto contents =
                         std::string((const char *) git_blob_rawcontent(blob.get()), git_blob_rawsize(blob.get()));
-                    state->lfsFetch->fetch(contents, path, s, [&s](uint64_t size) { s.s.reserve(size); });
+                    state->lfsFetch->fetch(contents, path, sink, sizeCallback);
                 } catch (Error & e) {
                     e.addTrace({}, "while smudging git-lfs file '%s'", path);
                     throw;
                 }
-                sizeCallback(s.s.size());
-                StringSource source{s.s};
-                source.drainInto(sink);
                 return;
             }
         }
@@ -1060,8 +1116,11 @@ struct GitSourceAccessor : SourceAccessor
     }
 };
 
-struct GitExportIgnoreSourceAccessor : CachingFilteringSourceAccessor
+struct GitExportIgnoreSourceAccessor final : CachingFilteringSourceAccessor
 {
+private:
+    void anchor() override {};
+public:
     ref<GitRepoImpl> repo;
     std::optional<Hash> rev;
 
@@ -1120,7 +1179,11 @@ struct GitExportIgnoreSourceAccessor : CachingFilteringSourceAccessor
     }
 };
 
-struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
+void GitFileSystemObjectSink::anchor() {}
+
+namespace {
+
+struct GitFileSystemObjectSinkImpl final : GitFileSystemObjectSink
 {
     ref<GitRepoImpl> repo;
 
@@ -1130,6 +1193,13 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
 
     ThreadPool workers{concurrency};
 
+    /**
+     * If repo has a non-null packBackend, this has a copy of the refresh function
+     * from the backend virtual table. This is needed to restore it after we've flushed
+     * the sink. We modify it to avoid unnecessary I/O on non-existent oids.
+     */
+    decltype(::git_odb_backend::refresh) packfileOdbRefresh = nullptr;
+
     /** Total file contents in flight. */
     std::atomic<size_t> totalBufSize{0};
 
@@ -1139,13 +1209,22 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
         : repo(repo)
         , repoPool(repo->getPool())
     {
+        if (auto * backend = repo->packBackend)
+            packfileOdbRefresh = std::exchange(backend->refresh, nullptr);
     }
 
+    GitFileSystemObjectSinkImpl(GitFileSystemObjectSinkImpl &&) = delete;
+    GitFileSystemObjectSinkImpl(const GitFileSystemObjectSinkImpl &) = delete;
+    GitFileSystemObjectSinkImpl & operator=(GitFileSystemObjectSinkImpl &&) = delete;
+    GitFileSystemObjectSinkImpl & operator=(const GitFileSystemObjectSinkImpl &) = delete;
+
     ~GitFileSystemObjectSinkImpl()
     {
         // Make sure the worker threads are destroyed before any state
         // they're referring to.
         workers.shutdown();
+        if (auto * backend = repo->packBackend; backend && packfileOdbRefresh)
+            backend->refresh = packfileOdbRefresh;
     }
 
     struct Child;
@@ -1153,7 +1232,7 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
     /// A directory to be written as a Git tree.
     struct Directory
     {
-        std::map<std::string, Child> children;
+        std::map<std::string, Child, std::less<>> children;
         std::optional<git_oid> oid;
 
         Child & lookup(const CanonPath & path)
@@ -1162,7 +1241,7 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
             auto parent = path.parent();
             auto cur = this;
             for (auto & name : *parent) {
-                auto i = cur->children.find(std::string(name));
+                auto i = cur->children.find(name);
                 if (i == cur->children.end())
                     throw Error("path '%s' does not exist", path);
                 auto dir = std::get_if<Directory>(&i->second.file);
@@ -1171,51 +1250,78 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
                 cur = dir;
             }
 
-            auto i = cur->children.find(std::string(*path.baseName()));
+            auto i = cur->children.find(*path.baseName());
             if (i == cur->children.end())
                 throw Error("path '%s' does not exist", path);
             return i->second;
         }
     };
 
-    size_t nextId = 0; // for Child.id
+    /* FIXME: Most of this logic is independent from git. Come up with a tree sink interface
+       and an adapter for a ExtendedFileSystemObjectSink that implements the tarball unpacking
+       semantics (i.e. overwriting of entries). Also deduplicate with MemorySourceAccessor. */
 
     struct Child
     {
         git_filemode_t mode;
-        std::variant<Directory, git_oid> file;
+        std::variant<Directory, git_oid, std::shared_future<git_oid>> file;
 
-        /// Sequential numbering of the file in the tarball. This is
-        /// used to make sure we only import the latest version of a
-        /// path.
-        size_t id{0};
-    };
-
-    struct State
-    {
-        Directory root;
+        const git_oid & getOid() const &
+        {
+            return std::visit(
+                overloaded{
+                    [](const Directory & dir) -> const git_oid & { return dir.oid.value(); },
+                    [](const git_oid & oid) -> const git_oid & { return oid; },
+                    [](const std::shared_future<git_oid> & oid) -> const git_oid & { return oid.get(); },
+                },
+                file);
+        }
     };
 
-    Sync<State> _state;
+    Directory root;
 
-    void addNode(State & state, const CanonPath & path, Child && child)
+    void addNode(const CanonPath & path, Child && child)
     {
-        assert(!path.isRoot());
+        if (path.isRoot())
+            throw Error("cannot create a file at the root of the git repository");
+
         auto parent = path.parent();
+        assert(parent);
 
-        Directory * cur = &state.root;
+        Directory * cur = &root;
 
         for (auto & i : *parent) {
             auto child = std::get_if<Directory>(
                 &cur->children.emplace(std::string(i), Child{GIT_FILEMODE_TREE, {Directory()}}).first->second.file);
-            assert(child);
+            if (!child)
+                throw Error("parent of '%1%' is not a directory", path.rel());
             cur = child;
         }
 
         std::string name(*path.baseName());
+        auto prev = cur->children.find(name);
+
+        if (prev == cur->children.end()) {
+            cur->children.insert_or_assign(std::move(name), std::move(child));
+            return;
+        }
+
+        /* Overwriting part of the tree. We'd like to behave somewhat
+           similarly to libarchive without ARCHIVE_EXTRACT_NO_OVERWRITE. */
+        const auto & prevChild = prev->second;
+
+        /* libarchive tries to unlink an entry, which only succeeds on empty
+           trees - so behave the same way. Everything else is fair game. */
+        if (const auto * maybePrevDir = std::get_if<Directory>(&prevChild.file)) {
+            /* "Replacing" directory with a directory is always a-ok. */
+            if (std::holds_alternative<Directory>(child.file))
+                return;
+
+            if (!maybePrevDir->children.empty())
+                throw Error("cannot create '%1%', conflicting non-empty directory", path.rel());
+        }
 
-        if (auto prev = cur->children.find(name); prev == cur->children.end() || prev->second.id < child.id)
-            cur->children.insert_or_assign(name, std::move(child));
+        cur->children.insert_or_assign(std::move(name), std::move(child));
     }
 
     void createRegularFile(const CanonPath & path, fun<void(CreateRegularFileSink &)> func) override
@@ -1286,8 +1392,6 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
 
         func(*crf);
 
-        auto id = nextId++;
-
         if (crf->stream) {
             /* Finish the slow path by creating the blob object synchronously.
                Call .release(), since git_blob_create_from_stream_commit
@@ -1295,48 +1399,52 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
             git_oid oid;
             if (git_blob_create_from_stream_commit(&oid, crf->stream.release()))
                 throw GitError("creating a blob object for '%s'", path);
-            addNode(
-                *_state.lock(),
-                crf->path,
-                Child{crf->executable ? GIT_FILEMODE_BLOB_EXECUTABLE : GIT_FILEMODE_BLOB, oid, id});
+            addNode(crf->path, Child{crf->executable ? GIT_FILEMODE_BLOB_EXECUTABLE : GIT_FILEMODE_BLOB, oid});
             return;
         }
 
-        /* Fast path: create the blob object in a separate thread. */
-        workers.enqueue([this, crf{std::move(crf)}, id]() {
-            auto repo(repoPool.get());
-
-            git_oid oid;
-            if (git_blob_create_from_buffer(&oid, *repo, crf->contents.data(), crf->contents.size()))
-                throw GitError("creating a blob object for '%s' from in-memory buffer", crf->path);
-
-            addNode(
-                *_state.lock(),
-                crf->path,
-                Child{crf->executable ? GIT_FILEMODE_BLOB_EXECUTABLE : GIT_FILEMODE_BLOB, oid, id});
-        });
+        std::promise<git_oid> promise;
+        addNode(
+            crf->path,
+            Child{
+                crf->executable ? GIT_FILEMODE_BLOB_EXECUTABLE : GIT_FILEMODE_BLOB,
+                promise.get_future(),
+            });
+
+        /* Fast path: create the blob object in a separate thread.
+           FIXME: Ugly, make ThreadPool use std::move_only_function. */
+        workers.enqueue(
+            [this, crf{std::move(crf)}, promise = make_ref<decltype(promise)>(std::move(promise))]() mutable {
+                auto repo(repoPool.get());
+
+                git_oid oid;
+                if (git_blob_create_from_buffer(&oid, *repo, crf->contents.data(), crf->contents.size()))
+                    throw GitError("creating a blob object for '%s' from in-memory buffer", crf->path);
+
+                /* We don't generally bother with exceptions because those will
+                   be propagated by the thread pool during .process(). */
+                promise->set_value(oid);
+            });
     }
 
     void createDirectory(const CanonPath & path) override
     {
         if (path.isRoot())
             return;
-        auto state(_state.lock());
-        addNode(*state, path, {GIT_FILEMODE_TREE, Directory()});
+        addNode(path, {GIT_FILEMODE_TREE, Directory()});
     }
 
     void createSymlink(const CanonPath & path, const std::string & target) override
     {
-        workers.enqueue([this, path, target]() {
-            auto repo(repoPool.get());
-
-            git_oid oid;
-            if (git_blob_create_from_buffer(&oid, *repo, target.c_str(), target.size()))
-                throw GitError("creating a blob object for tarball symlink member '%s'", path);
-
-            auto state(_state.lock());
-            addNode(*state, path, Child{GIT_FILEMODE_LINK, oid});
-        });
+        /* Symlinks are written to the this repo instance, the mempack backend
+           for which includes the trees. This way we flush both symlinks and
+           trees to the same packfile. Doing this synchronously isn't expensive
+           because symlinks are tiny, so hashing them is cheap. */
+        git_oid oid;
+        if (git_blob_create_from_buffer(&oid, *repo, requireCString(target), target.size()))
+            throw GitError("creating a blob object for tarball symlink member '%s'", path);
+
+        addNode(path, Child{GIT_FILEMODE_LINK, oid});
     }
 
     std::map<CanonPath, CanonPath> hardLinks;
@@ -1352,16 +1460,14 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
 
         /* Create hard links. */
         {
-            auto state(_state.lock());
             for (auto & [path, target] : hardLinks) {
                 if (target.isRoot())
                     continue;
                 try {
-                    auto child = state->root.lookup(target);
-                    auto oid = std::get_if<git_oid>(&child.file);
-                    if (!oid)
+                    const auto & child = root.lookup(target);
+                    if (std::holds_alternative<Directory>(child.file))
                         throw Error("cannot create a hard link to a directory");
-                    addNode(*state, path, {child.mode, *oid});
+                    addNode(path, {child.mode, child.getOid()});
                 } catch (Error & e) {
                     e.addTrace(nullptr, "while creating a hard link from '%s' to '%s'", path, target);
                     throw;
@@ -1375,30 +1481,34 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
             ThreadPool workers{repos.size()};
             for (auto & repo : repos)
                 workers.enqueue([repo]() { repo->flush(); });
+            workers.enqueue([repo = repo]() { repo->flush(); });
             workers.process();
         }
 
+        if (auto * backend = repo->packBackend)
+            /* We are done writing blobs. Need to refresh to get the objects written by other threads. */
+            packfileOdbRefresh(backend);
+
         // Write the Git trees to disk. Would be nice to have this multithreaded too, but that's hard because a tree
         // can't refer to an object that hasn't been written yet. Also it doesn't make a big difference for performance.
-        auto repo(repoPool.get());
 
-        [&](this const auto & visit, Directory & node) -> void {
+        [&, &repo = *repo](this const auto & visit, Directory & node) -> void {
             checkInterrupt();
 
             // Write the child directories.
             for (auto & child : node.children)
                 if (auto dir = std::get_if<Directory>(&child.second.file))
+                    /* TODO: Limit recursion depth? */
                     visit(*dir);
 
             // Write this directory.
             git_treebuilder * b;
-            if (git_treebuilder_new(&b, *repo, nullptr))
+            if (git_treebuilder_new(&b, repo, nullptr))
                 throw GitError("creating a tree builder");
             TreeBuilder builder(b);
 
-            for (auto & [name, child] : node.children) {
-                auto oid_p = std::get_if<git_oid>(&child.file);
-                auto oid = oid_p ? *oid_p : std::get<Directory>(child.file).oid.value();
+            for (const auto & [name, child] : node.children) {
+                const auto & oid = child.getOid();
                 if (git_treebuilder_insert(nullptr, builder.get(), name.c_str(), &oid, child.mode))
                     throw GitError("adding a file to a tree builder");
             }
@@ -1407,14 +1517,19 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
             if (git_treebuilder_write(&oid, builder.get()))
                 throw GitError("creating a tree object");
             node.oid = oid;
-        }(_state.lock()->root);
+        }(root);
 
         repo->flush();
 
-        return toHash(_state.lock()->root.oid.value());
+        if (auto * backend = repo->packBackend)
+            backend->refresh = std::exchange(packfileOdbRefresh, nullptr);
+
+        return toHash(root.oid.value());
     }
 };
 
+} // namespace
+
 ref<GitSourceAccessor> GitRepoImpl::getRawAccessor(const Hash & rev, const GitAccessorOptions & options)
 {
     auto self = ref<GitRepoImpl>(shared_from_this());
@@ -1437,13 +1552,15 @@ ref<SourceAccessor> GitRepoImpl::getAccessor(
     const WorkdirInfo & wd, const GitAccessorOptions & options, MakeNotAllowedError makeNotAllowedError)
 {
     auto self = ref<GitRepoImpl>(shared_from_this());
-    ref<SourceAccessor> fileAccessor = AllowListSourceAccessor::create(
-                                           makeFSSourceAccessor(path),
-                                           /*allowedPrefixes=*/wd.files,
-                                           // Always allow access to the root, but not its children.
-                                           /*allowedPaths=*/{CanonPath::root},
-                                           std::move(makeNotAllowedError))
-                                           .cast<SourceAccessor>();
+    ref<SourceAccessor> fileAccessor =
+        AllowListSourceAccessor::create(
+            // Follow the final symlink to the repo. Older nix versions used to do this (maybe somewhat accidentally).
+            makeFSSourceAccessor(path, /*trackLastModified=*/false, FinalSymlink::Follow),
+            /*allowedPrefixes=*/wd.files,
+            // Always allow access to the root, but not its children.
+            /*allowedPaths=*/{CanonPath::root},
+            std::move(makeNotAllowedError))
+            .cast<SourceAccessor>();
     if (options.exportIgnore)
         fileAccessor = make_ref<GitExportIgnoreSourceAccessor>(self, fileAccessor, std::nullopt);
     return fileAccessor;
@@ -1467,6 +1584,7 @@ std::vector<std::tuple<GitRepoImpl::Submodule, Hash>> GitRepoImpl::getSubmodules
     auto configS = accessor->readFile(modulesFile);
 
     auto [fdTemp, pathTemp] = createTempFile("nix-git-submodules");
+    AutoDelete delTemp(pathTemp, /*recursive=*/false);
     try {
         writeFull(fdTemp.get(), configS);
     } catch (SystemError & e) {
@@ -1485,6 +1603,7 @@ std::vector<std::tuple<GitRepoImpl::Submodule, Hash>> GitRepoImpl::getSubmodules
             result.push_back({std::move(submodule), *rev});
     }
 
+    delTemp.deletePath();
     return result;
 }
 
@@ -1502,9 +1621,11 @@ ref<GitRepo> Settings::getTarballCache() const
 
 } // namespace fetchers
 
+static Sync<std::map<std::filesystem::path, GitRepo::WorkdirInfo>> workdirInfoCache_;
+
 GitRepo::WorkdirInfo GitRepo::getCachedWorkdirInfo(const std::filesystem::path & path)
 {
-    static Sync<std::map<std::filesystem::path, WorkdirInfo>> _cache;
+    auto & _cache = workdirInfoCache_;
     {
         auto cache(_cache.lock());
         auto i = cache->find(path);
@@ -1516,6 +1637,11 @@ GitRepo::WorkdirInfo GitRepo::getCachedWorkdirInfo(const std::filesystem::path &
     return workdirInfo;
 }
 
+void GitRepo::invalidateWorkdirInfoCache()
+{
+    workdirInfoCache_.lock()->clear();
+}
+
 bool isLegalRefName(const std::string & refName)
 {
     initLibGit2();
diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index 3941c3425660..f0d19945be10 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -13,6 +13,7 @@
 #include "nix/fetchers/fetch-settings.hh"
 #include "nix/util/json-utils.hh"
 #include "nix/util/archive.hh"
+#include "nix/util/memo.hh"
 #include "nix/util/mounted-source-accessor.hh"
 
 #include <sys/time.h>
@@ -21,8 +22,6 @@
 #  include <sys/wait.h>
 #endif
 
-using namespace std::string_literals;
-
 namespace nix::fetchers {
 
 namespace {
@@ -163,6 +162,13 @@ std::vector<PublicKey> getPublicKeys(const Attrs & attrs)
 
 static const Hash nullRev{HashAlgorithm::SHA1};
 
+static LazyAttr makeLazyAttr(fun<ResolvedAttr()> compute)
+{
+    return make_ref<LazyAttrComputation>(LazyAttrComputation{
+        .compute = memo<ResolvedAttr>(std::move(compute)),
+    });
+}
+
 struct GitInputScheme : InputScheme
 {
     std::optional<Input> inputFromURL(const Settings & settings, const ParsedURL & url, bool requireTree) const override
@@ -723,14 +729,12 @@ struct GitInputScheme : InputScheme
     }
 
     uint64_t getRevCount(
-        const Settings & settings,
-        const RepoInfo & repoInfo,
-        const std::filesystem::path & repoDir,
-        const Hash & rev) const
+        ref<Cache> cache, const RepoInfo & repoInfo, const std::filesystem::path & repoDir, const Hash & rev) const
     {
-        Cache::Key key{"gitRevCount", {{"rev", rev.gitRev()}}};
+        if (GitRepo::openRepo(repoDir, {})->isShallow())
+            throw Error("'%s' is a shallow Git repository, so 'revCount' is not available", repoInfo.locationToArg());
 
-        auto cache = settings.getCache();
+        Cache::Key key{"gitRevCount", {{"rev", rev.gitRev()}}};
 
         if (auto revCountAttrs = cache->lookup(key))
             return getIntAttr(*revCountAttrs, "revCount");
@@ -745,6 +749,18 @@ struct GitInputScheme : InputScheme
         return revCount;
     }
 
+    LazyAttr lazyRevCount(
+        const Settings & settings,
+        const RepoInfo & repoInfo,
+        const std::filesystem::path & repoDir,
+        const Hash & rev) const
+    {
+        auto cache = settings.getCache();
+        return makeLazyAttr([this, cache, repoInfo, repoDir, rev]() -> ResolvedAttr {
+            return getRevCount(cache, repoInfo, repoDir, rev);
+        });
+    }
+
     std::string getDefaultRef(const Settings & settings, const RepoInfo & repoInfo, bool shallow) const
     {
         auto head = std::visit(
@@ -768,7 +784,7 @@ struct GitInputScheme : InputScheme
                     "\n"
                     "To make it visible to Nix, run:\n"
                     "\n"
-                    "git -C %2% add \"%1%\"",
+                    "git -C %2% add -N \"%1%\"",
                     path.rel(),
                     PathFmt(repoPath));
             else
@@ -815,7 +831,7 @@ struct GitInputScheme : InputScheme
             repoDir = cacheDir;
             repoInfo.gitDir = ".";
 
-            std::filesystem::create_directories(cacheDir.parent_path());
+            createDirs(cacheDir.parent_path());
             PathLocks cacheDirLock({cacheDir.string()});
 
             auto repo = GitRepo::openRepo(cacheDir, {.create = true, .bare = true});
@@ -891,13 +907,6 @@ struct GitInputScheme : InputScheme
 
         auto repo = GitRepo::openRepo(repoDir, {});
 
-        auto isShallow = repo->isShallow();
-
-        if (isShallow && !getShallowAttr(input))
-            throw Error(
-                "'%s' is a shallow Git repository, but shallow repositories are only allowed when `shallow = true;` is specified",
-                repoInfo.locationToArg());
-
         // FIXME: check whether rev is an ancestor of ref?
 
         auto rev = *input.getRev();
@@ -911,7 +920,7 @@ struct GitInputScheme : InputScheme
         if (!getShallowAttr(input)) {
             /* Like lastModified, skip revCount if supplied by the caller. */
             if (!input.attrs.contains("revCount"))
-                input.attrs.insert_or_assign("revCount", getRevCount(settings, repoInfo, repoDir, rev));
+                input.attrs.insert_or_assign("revCount", lazyRevCount(settings, repoInfo, repoDir, rev));
         }
 
         printTalkative("using revision %s of repo '%s'", rev.gitRev(), repoInfo.locationToArg());
@@ -1033,8 +1042,11 @@ struct GitInputScheme : InputScheme
 
             input.attrs.insert_or_assign("rev", rev.gitRev());
             if (!getShallowAttr(input)) {
-                input.attrs.insert_or_assign(
-                    "revCount", rev == nullRev ? 0 : getRevCount(settings, repoInfo, repoPath, rev));
+                if (rev == nullRev) {
+                    input.attrs.insert_or_assign("revCount", uint64_t(0));
+                } else {
+                    input.attrs.insert_or_assign("revCount", lazyRevCount(settings, repoInfo, repoPath, rev));
+                }
             }
 
             verifyCommit(input, repo);
@@ -1098,7 +1110,7 @@ struct GitInputScheme : InputScheme
                 for (auto & file : repoInfo.workdirInfo.dirtyFiles) {
                     writeString("modified:", hashSink);
                     writeString(file.abs(), hashSink);
-                    dumpPath((*repoPath / file.rel()).string(), hashSink);
+                    dumpPath(*repoPath / file.rel(), hashSink);
                 }
                 for (auto & file : repoInfo.workdirInfo.deletedFiles) {
                     writeString("deleted:", hashSink);
diff --git a/src/libfetchers/include/nix/fetchers/attrs.hh b/src/libfetchers/include/nix/fetchers/attrs.hh
index 8a21b8ddbf69..8eede58086e5 100644
--- a/src/libfetchers/include/nix/fetchers/attrs.hh
+++ b/src/libfetchers/include/nix/fetchers/attrs.hh
@@ -3,6 +3,8 @@
 
 #include "nix/util/types.hh"
 #include "nix/util/hash.hh"
+#include "nix/util/ref.hh"
+#include "nix/util/fun.hh"
 
 #include <variant>
 
@@ -12,7 +14,24 @@
 
 namespace nix::fetchers {
 
-typedef std::variant<std::string, uint64_t, Explicit<bool>> Attr;
+/**
+ * The resolved (non-lazy) subset of attribute value types.
+ */
+using ResolvedAttr = std::variant<std::string, uint64_t, Explicit<bool>>;
+
+/**
+ * A deferred attribute computation.  Wrapping in `ref<>` gives
+ * pointer-identity equality/ordering, which is correct: two lazy
+ * attrs are equal iff they are the same computation.
+ */
+struct LazyAttrComputation
+{
+    fun<ResolvedAttr()> compute;
+};
+
+using LazyAttr = ref<LazyAttrComputation>;
+
+using Attr = std::variant<std::string, uint64_t, Explicit<bool>, LazyAttr>;
 
 /**
  * An `Attrs` can be thought of a JSON object restricted or simplified
@@ -21,6 +40,16 @@ typedef std::variant<std::string, uint64_t, Explicit<bool>> Attr;
  */
 typedef std::map<std::string, Attr> Attrs;
 
+/**
+ * Force a potentially lazy attribute to its resolved value.
+ */
+ResolvedAttr forceAttr(const Attr & attr);
+
+/**
+ * Retrieve an attr, but only if it's a LazyAttr.
+ */
+std::optional<LazyAttr> maybeGetLazyAttr(const Attrs & attrs, const std::string & name);
+
 Attrs jsonToAttrs(const nlohmann::json & json);
 
 nlohmann::json attrsToJSON(const Attrs & attrs);
diff --git a/src/libfetchers/include/nix/fetchers/cache.hh b/src/libfetchers/include/nix/fetchers/cache.hh
index 7219635ec07d..df2aa8b7de4d 100644
--- a/src/libfetchers/include/nix/fetchers/cache.hh
+++ b/src/libfetchers/include/nix/fetchers/cache.hh
@@ -12,6 +12,11 @@ namespace nix::fetchers {
  */
 struct Cache
 {
+private:
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
+public:
     virtual ~Cache() {}
 
     /**
diff --git a/src/libfetchers/include/nix/fetchers/fetch-settings.hh b/src/libfetchers/include/nix/fetchers/fetch-settings.hh
index 2ab215a685ff..bb9a67d068d4 100644
--- a/src/libfetchers/include/nix/fetchers/fetch-settings.hh
+++ b/src/libfetchers/include/nix/fetchers/fetch-settings.hh
@@ -14,8 +14,9 @@
 namespace nix {
 
 struct GitRepo;
+struct SrcToStore;
 
-}
+} // namespace nix
 
 namespace nix::fetchers {
 
@@ -152,7 +153,18 @@ struct Settings : public Config
 
     ref<GitRepo> getTarballCache() const;
 
+    /**
+     * In-memory cache for calls to fetchToStore(); maps source paths to their store
+     * paths / hashes.
+     */
+    static ref<SrcToStore> createSrcToStore();
+
+    const ref<SrcToStore> srcToStore = createSrcToStore();
+
+
 private:
+    void anchor() override;
+
     mutable Sync<std::shared_ptr<Cache>> _cache;
 };
 
diff --git a/src/libfetchers/include/nix/fetchers/fetchers.hh b/src/libfetchers/include/nix/fetchers/fetchers.hh
index 180d10e9dbbf..f65bbac73d4f 100644
--- a/src/libfetchers/include/nix/fetchers/fetchers.hh
+++ b/src/libfetchers/include/nix/fetchers/fetchers.hh
@@ -296,4 +296,4 @@ std::string publicKeys_to_string(const std::vector<PublicKey> &);
 
 } // namespace nix::fetchers
 
-JSON_IMPL(fetchers::PublicKey)
+JSON_IMPL(nix::fetchers::PublicKey)
diff --git a/src/libfetchers/include/nix/fetchers/filtering-source-accessor.hh b/src/libfetchers/include/nix/fetchers/filtering-source-accessor.hh
index 13272719fe3d..c5c1ce282b30 100644
--- a/src/libfetchers/include/nix/fetchers/filtering-source-accessor.hh
+++ b/src/libfetchers/include/nix/fetchers/filtering-source-accessor.hh
@@ -53,7 +53,10 @@ struct FilteringSourceAccessor : SourceAccessor
 
     std::pair<CanonPath, std::optional<std::string>> getFingerprint(const CanonPath & path) override;
 
-    void invalidateCache(const CanonPath & path) override;
+    void invalidateCache() override
+    {
+        next->invalidateCache();
+    }
 
     /**
      * Call `makeNotAllowedError` to throw a `RestrictedPathError`
diff --git a/src/libfetchers/include/nix/fetchers/git-lfs-fetch.hh b/src/libfetchers/include/nix/fetchers/git-lfs-fetch.hh
index b59da391a056..444e0a648f14 100644
--- a/src/libfetchers/include/nix/fetchers/git-lfs-fetch.hh
+++ b/src/libfetchers/include/nix/fetchers/git-lfs-fetch.hh
@@ -38,9 +38,17 @@ struct Fetch
     void fetch(
         const std::string & content,
         const CanonPath & pointerFilePath,
-        StringSink & sink,
+        Sink & sink,
         std::function<void(uint64_t)> sizeCallback) const;
     std::vector<nlohmann::json> fetchUrls(const std::vector<Pointer> & pointers) const;
 };
 
+struct LfsApiInfo
+{
+    std::string endpoint;
+    std::optional<std::string> authHeader;
+};
+
+LfsApiInfo getLfsApi(ParsedURL url);
+
 } // namespace nix::lfs
diff --git a/src/libfetchers/include/nix/fetchers/git-utils.hh b/src/libfetchers/include/nix/fetchers/git-utils.hh
index 725fbf398410..f34f3bfde1b9 100644
--- a/src/libfetchers/include/nix/fetchers/git-utils.hh
+++ b/src/libfetchers/include/nix/fetchers/git-utils.hh
@@ -16,6 +16,10 @@ struct Settings;
  */
 struct GitFileSystemObjectSink : ExtendedFileSystemObjectSink
 {
+private:
+    void anchor() override;
+
+public:
     /**
      * Flush builder and return a final Git hash.
      */
@@ -88,6 +92,9 @@ struct GitRepo
 
     static WorkdirInfo getCachedWorkdirInfo(const std::filesystem::path & path);
 
+    /* Drop all entries from the getCachedWorkdirInfo() cache. */
+    static void invalidateWorkdirInfoCache();
+
     /* Get the ref that HEAD points to. */
     virtual std::optional<std::string> getWorkdirRef() = 0;
 
diff --git a/src/libfetchers/input-cache.cc b/src/libfetchers/input-cache.cc
index 85a611355e2f..3fe96d8503bc 100644
--- a/src/libfetchers/input-cache.cc
+++ b/src/libfetchers/input-cache.cc
@@ -1,4 +1,5 @@
 #include "nix/fetchers/input-cache.hh"
+#include "nix/fetchers/git-utils.hh"
 #include "nix/fetchers/registry.hh"
 #include "nix/util/sync.hh"
 
@@ -65,6 +66,10 @@ struct InputCacheImpl : InputCache
     void clear() override
     {
         cache_.lock()->clear();
+        /* The workdir info cache has the same "per evaluation" lifetime
+           as the input cache, so flush it here as well so that e.g.
+           `:reload` in `nix repl` picks up changes in git work trees. */
+        GitRepo::invalidateWorkdirInfoCache();
     }
 };
 
diff --git a/src/libfetchers/mercurial.cc b/src/libfetchers/mercurial.cc
index af5c94c1b494..6a4d239a03cf 100644
--- a/src/libfetchers/mercurial.cc
+++ b/src/libfetchers/mercurial.cc
@@ -14,8 +14,6 @@
 #include <sys/time.h>
 #include <variant>
 
-using namespace std::string_literals;
-
 namespace nix::fetchers {
 
 static RunOptions hgOptions(OsStrings args)
@@ -227,6 +225,8 @@ struct MercurialInputScheme : InputScheme
 
                 input.attrs.insert_or_assign("ref", chomp(runHg({OS_STR("branch"), OS_STR("-R"), localPath.native()})));
 
+                using namespace std::string_literals;
+
                 auto files = tokenizeString<StringSet>(
                     runHg({
                         OS_STR("status"),
@@ -240,26 +240,25 @@ struct MercurialInputScheme : InputScheme
                     }),
                     "\0"s);
 
-                auto actualPath = absPath(localPath);
+                /* FIXME: Check that the access to this path is allowed. */
+                auto accessor = makeFSSourceAccessor(absPath(localPath));
 
                 PathFilter filter = [&](const std::string & p) -> bool {
-                    assert(hasPrefix(p, actualPath.string()));
-                    std::string file(p, actualPath.string().size() + 1);
-
-                    auto st = lstat(p);
+                    auto cp = CanonPath(p);
+                    auto st = accessor->lstat(cp);
 
-                    if (S_ISDIR(st.st_mode)) {
-                        auto prefix = file + "/";
+                    if (st.type == SourceAccessor::tDirectory) {
+                        auto prefix = cp.rel() + "/";
                         auto i = files.lower_bound(prefix);
                         return i != files.end() && hasPrefix(*i, prefix);
                     }
 
-                    return files.count(file);
+                    return files.count(cp.rel());
                 };
 
                 return store.addToStore(
                     input.getName(),
-                    {getFSSourceAccessor(), CanonPath(actualPath.string())},
+                    {accessor, CanonPath::root},
                     ContentAddressMethod::Raw::NixArchive,
                     HashAlgorithm::SHA256,
                     {},
@@ -381,7 +380,7 @@ struct MercurialInputScheme : InputScheme
 
         deletePath(tmpDir / ".hg_archival.txt");
 
-        auto storePath = store.addToStore(name, {getFSSourceAccessor(), CanonPath(tmpDir.string())});
+        auto storePath = store.addToStore(name, {makeFSSourceAccessor(tmpDir), CanonPath::root});
 
         Attrs infoAttrs({
             {"revCount", (uint64_t) revCount},
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
index d34dd4f434d1..ed52e565279d 100644
--- a/src/libfetchers/meson.build
+++ b/src/libfetchers/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
diff --git a/src/libflake-c/meson.build b/src/libflake-c/meson.build
index fddb39bdf96b..4fef3ea0018a 100644
--- a/src/libflake-c/meson.build
+++ b/src/libflake-c/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -50,16 +50,33 @@ headers += files('nix_api_flake.h')
 subdir('nix-meson-build-support/export-all-symbols')
 subdir('nix-meson-build-support/windows-version')
 
-this_library = library(
-  'nixflakec',
-  sources,
-  soversion : nix_soversion,
-  dependencies : deps_public + deps_private + deps_other,
-  include_directories : include_dirs,
-  link_args : linker_export_flags,
-  prelink : true, # For C++ static initializers
-  install : true,
-)
+# For linking -c bindings into the cli for plugins.
+build_both_libraries = get_option('plugin-c-api')
+
+library_kwargs = {
+  'soversion' : nix_soversion,
+  'dependencies' : deps_public + deps_private + deps_other,
+  'include_directories' : include_dirs,
+  'link_args' : linker_export_flags,
+  'install' : true,
+}
+
+if build_both_libraries
+  this_libraries = both_libraries(
+    'nixflakec',
+    sources,
+    kwargs : library_kwargs,
+    override_options : [ 'b_lto=false' ],
+  )
+else
+  this_library = library(
+    'nixflakec',
+    sources,
+    kwargs : library_kwargs,
+  )
+endif
+
+plugin_c_api_enabled = build_both_libraries
 
 install_headers(headers, preserve_path : true)
 
diff --git a/src/libflake-c/meson.options b/src/libflake-c/meson.options
new file mode 100644
index 000000000000..a8b0c4df0401
--- /dev/null
+++ b/src/libflake-c/meson.options
@@ -0,0 +1,8 @@
+# vim: filetype=meson
+
+option(
+  'plugin-c-api',
+  type : 'boolean',
+  value : false,
+  yield : true,
+)
diff --git a/src/libflake-c/package.nix b/src/libflake-c/package.nix
index 8c6883d9cf95..e64179c72d1e 100644
--- a/src/libflake-c/package.nix
+++ b/src/libflake-c/package.nix
@@ -10,6 +10,7 @@
   # Configuration Options
 
   version,
+  withPluginCAPI,
 }:
 
 let
@@ -27,7 +28,7 @@ mkMesonLibrary (finalAttrs: {
     ../../.version
     ./.version
     ./meson.build
-    # ./meson.options
+    ./meson.options
     (fileset.fileFilter (file: file.hasExt "cc") ./.)
     (fileset.fileFilter (file: file.hasExt "hh") ./.)
     (fileset.fileFilter (file: file.hasExt "h") ./.)
@@ -41,6 +42,7 @@ mkMesonLibrary (finalAttrs: {
   ];
 
   mesonFlags = [
+    (lib.mesonBool "plugin-c-api" withPluginCAPI)
   ];
 
   meta = {
diff --git a/src/libflake-tests/meson.build b/src/libflake-tests/meson.build
index 3512be10bce9..00b592195c2c 100644
--- a/src/libflake-tests/meson.build
+++ b/src/libflake-tests/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
diff --git a/src/libflake/flake-primops.cc b/src/libflake/flake-primops.cc
index 3ad66611726b..5ee587c3e051 100644
--- a/src/libflake/flake-primops.cc
+++ b/src/libflake/flake-primops.cc
@@ -19,10 +19,12 @@
 #include "nix/fetchers/fetchers.hh"
 #include "nix/util/error.hh"
 #include "nix/util/experimental-features.hh"
+#include "nix/util/mounted-source-accessor.hh"
 #include "nix/util/pos-idx.hh"
 #include "nix/util/pos-table.hh"
 #include "nix/util/types.hh"
 #include "nix/util/util.hh"
+#include "nix/store/store-api.hh"
 
 namespace nix::flake::primops {
 
@@ -42,7 +44,6 @@ PrimOp getFlake(const Settings & settings)
             auto path = state.realisePath(pos, *args[0]);
             callFlake(state, lockFlake(settings, state, path, lockFlags), v);
         } else {
-            NixStringContext context;
             std::string flakeRefS(
                 state.forceStringNoCtx(*args[0], pos, "while evaluating the argument passed to builtins.getFlake"));
 
@@ -53,6 +54,21 @@ PrimOp getFlake(const Settings & settings)
                     flakeRefS,
                     state.positions[pos]);
 
+            /* Backwards compatibility: since flakes used to be copied to the store eagerly, some users
+               relied on being able to do builtins.getFlake on a flakeref with discarded string context.
+               So if a flake input has a physical source path that is inside the store, first try to look it up in the
+               storeFS. */
+            if (auto sourcePath = flakeRef.input.getSourcePath();
+                flakeRef.input.getType() == "path" && sourcePath && state.store->isInStore(sourcePath->string())) {
+                auto [storePath, subPath] = state.store->toStorePath(sourcePath->string());
+                if (auto mount = state.storeFS->getMount(CanonPath(state.store->printStorePath(storePath)))) {
+                    auto path = state.storePath(storePath) / CanonPath(subPath);
+                    if (!flakeRef.subdir.empty())
+                        path = path / flakeRef.subdir;
+                    return callFlake(state, lockFlake(settings, state, path, lockFlags), v);
+                }
+            }
+
             callFlake(state, lockFlake(settings, state, flakeRef, lockFlags), v);
         }
     };
@@ -89,12 +105,13 @@ static void prim_parseFlakeRef(EvalState & state, const PosIdx pos, Value ** arg
     for (const auto & [key, value] : attrs) {
         auto s = state.symbols.create(key);
         auto & vv = binds.alloc(s);
+        auto resolved = forceAttr(value);
         std::visit(
             overloaded{
                 [&vv, &state](const std::string & value) { vv.mkString(value, state.mem); },
                 [&vv](const uint64_t & value) { vv.mkInt(value); },
                 [&vv](const Explicit<bool> & value) { vv.mkBool(value.t); }},
-            value);
+            resolved);
     }
     v.mkAttrs(binds);
 }
diff --git a/src/libflake/flake.cc b/src/libflake/flake.cc
index deb1c16b71e9..4f22353c751a 100644
--- a/src/libflake/flake.cc
+++ b/src/libflake/flake.cc
@@ -38,6 +38,7 @@
 #include "nix/fetchers/input-cache.hh"
 #include "nix/expr/attr-set.hh"
 #include "nix/expr/eval-error.hh"
+#include "nix/expr/fetch-tree.hh"
 #include "nix/expr/nixexpr.hh"
 #include "nix/expr/symbol-table.hh"
 #include "nix/expr/value.hh"
@@ -391,14 +392,9 @@ static Flake getFlake(
         lockedRef = FlakeRef(std::move(cachedInput2.lockedInput), newLockedRef.subdir);
     }
 
+    auto rootDir = state.storePath(state.mountInput(lockedRef.input, originalRef.input, cachedInput.accessor));
     // Re-parse flake.nix from the store.
-    return readFlake(
-        state,
-        originalRef,
-        resolvedRef,
-        lockedRef,
-        state.storePath(state.mountInput(lockedRef.input, originalRef.input, cachedInput.accessor)),
-        lockRootAttrPath);
+    return readFlake(state, originalRef, resolvedRef, lockedRef, rootDir, lockRootAttrPath);
 }
 
 Flake getFlake(EvalState & state, const FlakeRef & originalRef, fetchers::UseRegistries useRegistries)
@@ -868,8 +864,6 @@ LockedFlake lockFlake(
                                 CanonPath((topRef.subdir == "" ? "" : topRef.subdir + "/") + "flake.lock"),
                                 newLockFileS,
                                 commitMessage);
-
-                            flake.lockFilePath().invalidateCache();
                         }
 
                         /* Rewriting the lockfile changed the top-level
@@ -922,8 +916,9 @@ static ref<SourceAccessor> makeInternalFS()
     internalFS->setPathDisplay("«flakes-internal»", "");
     internalFS->addFile(
         CanonPath("call-flake.nix"),
-#include "call-flake.nix.gen.hh" // IWYU pragma: keep
-    );
+        {
+#embed "call-flake.nix"
+        });
     return internalFS;
 }
 
@@ -995,11 +990,24 @@ std::optional<Fingerprint> LockedFlake::getFingerprint(Store & store, const fetc
 
     *fingerprint += fmt(";%s;%s", flake.lockedRef.subdir, lockFile);
 
-    /* Include revCount and lastModified because they're not
-       necessarily implied by the content fingerprint (e.g. for
-       tarball flakes) but can influence the evaluation result. */
-    if (auto revCount = flake.lockedRef.input.getRevCount())
-        *fingerprint += fmt(";revCount=%d", *revCount);
+    if (auto revCount = get(flake.lockedRef.input.attrs, "revCount")) {
+        if (std::get_if<fetchers::LazyAttr>(revCount)) {
+            /* A lazy revCount is computed by the fetcher, so its
+               value is functionally determined by `rev`. We only
+               need to record its presence, not force its value.
+
+               This means a lazy and a concrete revCount that would
+               resolve to the same value produce different
+               fingerprints, sacrificing some cache hits to avoid
+               the cost of forcing. */
+            *fingerprint += ";hasRevCount";
+        } else if (auto n = flake.lockedRef.input.getRevCount()) {
+            /* A concrete revCount comes from a lockfile or explicit
+               user input. The fetcher passes it through as-is, so
+               it can affect evaluation and must be fingerprinted. */
+            *fingerprint += fmt(";revCount=%d", *n);
+        }
+    }
     if (auto lastModified = flake.lockedRef.input.getLastModified())
         *fingerprint += fmt(";lastModified=%d", *lastModified);
 
diff --git a/src/libflake/include/nix/flake/flake.hh b/src/libflake/include/nix/flake/flake.hh
index fd52dbebac5d..aa063a08e396 100644
--- a/src/libflake/include/nix/flake/flake.hh
+++ b/src/libflake/include/nix/flake/flake.hh
@@ -233,14 +233,6 @@ ref<eval_cache::EvalCache> openEvalCache(EvalState & state, ref<const LockedFlak
 
 } // namespace flake
 
-void emitTreeAttrs(
-    EvalState & state,
-    const StorePath & storePath,
-    const fetchers::Input & input,
-    Value & v,
-    bool emptyRevFallback = false,
-    bool forceDirty = false);
-
 /**
  * An internal builtin similar to `fetchTree`, except that it
  * always treats the input as final (i.e. no attributes can be
diff --git a/src/libflake/meson.build b/src/libflake/meson.build
index 58916ecd9ab2..c044bca7b46b 100644
--- a/src/libflake/meson.build
+++ b/src/libflake/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -32,13 +32,6 @@ subdir('nix-meson-build-support/common')
 
 subdir('nix-meson-build-support/generate-header')
 
-generated_headers = []
-foreach header : [
-  'call-flake.nix',
-]
-  generated_headers += gen_header.process(header)
-endforeach
-
 sources = files(
   'config.cc',
   'flake-primops.cc',
@@ -57,7 +50,6 @@ subdir('nix-meson-build-support/windows-version')
 this_library = library(
   'nixflake',
   sources,
-  generated_headers,
   soversion : nix_soversion,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
diff --git a/src/libmain-c/meson.build b/src/libmain-c/meson.build
index 36332fdb70a1..998151142fda 100644
--- a/src/libmain-c/meson.build
+++ b/src/libmain-c/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -42,16 +42,33 @@ headers = files(
 subdir('nix-meson-build-support/export-all-symbols')
 subdir('nix-meson-build-support/windows-version')
 
-this_library = library(
-  'nixmainc',
-  sources,
-  soversion : nix_soversion,
-  dependencies : deps_public + deps_private + deps_other,
-  include_directories : include_dirs,
-  link_args : linker_export_flags,
-  prelink : true, # For C++ static initializers
-  install : true,
-)
+# For linking -c bindings into the cli for plugins.
+build_both_libraries = get_option('plugin-c-api')
+
+library_kwargs = {
+  'soversion' : nix_soversion,
+  'dependencies' : deps_public + deps_private + deps_other,
+  'include_directories' : include_dirs,
+  'link_args' : linker_export_flags,
+  'install' : true,
+}
+
+if build_both_libraries
+  this_libraries = both_libraries(
+    'nixmainc',
+    sources,
+    kwargs : library_kwargs,
+    override_options : [ 'b_lto=false' ],
+  )
+else
+  this_library = library(
+    'nixmainc',
+    sources,
+    kwargs : library_kwargs,
+  )
+endif
+
+plugin_c_api_enabled = build_both_libraries
 
 install_headers(headers, preserve_path : true)
 
diff --git a/src/libmain-c/meson.options b/src/libmain-c/meson.options
new file mode 100644
index 000000000000..a8b0c4df0401
--- /dev/null
+++ b/src/libmain-c/meson.options
@@ -0,0 +1,8 @@
+# vim: filetype=meson
+
+option(
+  'plugin-c-api',
+  type : 'boolean',
+  value : false,
+  yield : true,
+)
diff --git a/src/libmain-c/package.nix b/src/libmain-c/package.nix
index f019a917d360..5f86df5ea577 100644
--- a/src/libmain-c/package.nix
+++ b/src/libmain-c/package.nix
@@ -10,6 +10,7 @@
   # Configuration Options
 
   version,
+  withPluginCAPI,
 }:
 
 let
@@ -27,7 +28,7 @@ mkMesonLibrary (finalAttrs: {
     ../../.version
     ./.version
     ./meson.build
-    # ./meson.options
+    ./meson.options
     (fileset.fileFilter (file: file.hasExt "cc") ./.)
     (fileset.fileFilter (file: file.hasExt "hh") ./.)
     (fileset.fileFilter (file: file.hasExt "h") ./.)
@@ -41,6 +42,7 @@ mkMesonLibrary (finalAttrs: {
   ];
 
   mesonFlags = [
+    (lib.mesonBool "plugin-c-api" withPluginCAPI)
   ];
 
   meta = {
diff --git a/src/libmain/include/nix/main/common-args.hh b/src/libmain/include/nix/main/common-args.hh
index d67fc2ad0c47..b20df3a99ec9 100644
--- a/src/libmain/include/nix/main/common-args.hh
+++ b/src/libmain/include/nix/main/common-args.hh
@@ -81,8 +81,8 @@ struct MixPrintJSON : virtual Args
      * This is a template to avoid accidental coercions from `string` to `json` in the caller,
      * to avoid mistakenly passing an already serialized JSON to this function.
      *
-     * It is not recommended to print a JSON string - see the JSON guidelines
-     * about extensibility, https://nix.dev/manual/nix/development/development/json-guideline.html -
+     * It is not recommended to print a JSON string - see the data modeling guidelines
+     * about extensibility, https://nix.dev/manual/nix/development/development/data-modeling.html -
      * but you _can_ print a sole JSON string by explicitly coercing it to
      * `nlohmann::json` first.
      */
diff --git a/src/libmain/include/nix/main/shared.hh b/src/libmain/include/nix/main/shared.hh
index f9e771205ba2..7b0e7a54d4e0 100644
--- a/src/libmain/include/nix/main/shared.hh
+++ b/src/libmain/include/nix/main/shared.hh
@@ -26,7 +26,7 @@ void parseCmdLine(
     const Strings & args,
     fun<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg);
 
-void printVersion(const std::string & programName);
+[[noreturn]] void printVersion(const std::string & programName);
 
 /**
  * Ugh.  No better place to put this.
diff --git a/src/libmain/loggers.cc b/src/libmain/loggers.cc
index a3e75c535dd0..a1c3768f2b15 100644
--- a/src/libmain/loggers.cc
+++ b/src/libmain/loggers.cc
@@ -50,7 +50,8 @@ void setLogFormat(const std::string & logFormatStr)
 void setLogFormat(const LogFormat & logFormat)
 {
     defaultLogFormat = logFormat;
-    logger = makeDefaultLogger();
+    logger->stop();
+    logger = makeDefaultLogger().release();
 }
 
 } // namespace nix
diff --git a/src/libmain/meson.build b/src/libmain/meson.build
index 2ac59924e592..0084643bdaad 100644
--- a/src/libmain/meson.build
+++ b/src/libmain/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
diff --git a/src/libmain/progress-bar.cc b/src/libmain/progress-bar.cc
index a8044a240d51..512ba4faad67 100644
--- a/src/libmain/progress-bar.cc
+++ b/src/libmain/progress-bar.cc
@@ -2,8 +2,10 @@
 #include "nix/util/terminal.hh"
 #include "nix/util/sync.hh"
 #include "nix/util/signals.hh"
-#include "nix/store/store-api.hh"
+#include "nix/store/path.hh"
+#include "nix/util/file-system.hh"
 #include "nix/store/names.hh"
+#include "nix/util/util.hh"
 
 #include <map>
 #include <thread>
@@ -13,17 +15,19 @@
 
 namespace nix {
 
+namespace {
+
 static std::string_view getS(const std::vector<Logger::Field> & fields, size_t n)
 {
-    assert(n < fields.size());
-    assert(fields[n].type == Logger::Field::tString);
+    if (n >= fields.size() || fields[n].type != Logger::Field::tString)
+        throw Error("could not get expected log field of type 'string' at index %d", n);
     return fields[n].s;
 }
 
 static uint64_t getI(const std::vector<Logger::Field> & fields, size_t n)
 {
-    assert(n < fields.size());
-    assert(fields[n].type == Logger::Field::tInt);
+    if (n >= fields.size() || fields[n].type != Logger::Field::tInt)
+        throw Error("could not get expected log field of type 'int' at index %d", n);
     return fields[n].i;
 }
 
@@ -34,10 +38,17 @@ static std::string_view storePathToName(std::string_view path)
     return i == std::string::npos ? base.substr(0, 0) : base.substr(i + 1);
 }
 
-class ProgressBar : public Logger
+static std::string_view storePathToNameWithoutDrvSuffix(std::string_view path)
 {
-private:
+    auto res = storePathToName(path);
+    if (hasSuffix(res, drvExtension))
+        res.remove_suffix(drvExtension.size());
+    return res;
+}
 
+class ProgressBar final : public Logger
+{
+private:
     struct ActInfo
     {
         std::string s, lastLine, phase;
@@ -96,6 +107,18 @@ class ProgressBar : public Logger
 
     std::unique_ptr<InterruptCallback> interruptCallback;
 
+    void hideCursorIfNeeded() const
+    {
+        if (isTTY)
+            writeToStderr("\e[?25l");
+    }
+
+    void unhideCursorIfNeeded() const
+    {
+        if (isTTY)
+            writeToStderr("\e[?25h");
+    }
+
 public:
 
     ProgressBar(bool isTTY)
@@ -105,6 +128,7 @@ class ProgressBar : public Logger
             redraw("\rshutting down\e[K");
         }))
     {
+        hideCursorIfNeeded();
         state_.lock()->active = isTTY;
         updateThread = std::thread([&]() {
             auto state(state_.lock());
@@ -131,6 +155,7 @@ class ProgressBar : public Logger
             if (state->active) {
                 state->active = false;
                 clearProgressDisplay();
+                unhideCursorIfNeeded();
                 updateCV.notify_one();
                 quitCV.notify_one();
             }
@@ -148,8 +173,10 @@ class ProgressBar : public Logger
             return;
         }
 
-        if (state->active)
+        if (state->active) {
             clearProgressDisplay();
+            unhideCursorIfNeeded();
+        }
     }
 
     void resume() override
@@ -162,8 +189,10 @@ class ProgressBar : public Logger
             state->suspensions--;
         }
         if (state->suspensions == 0) {
-            if (state->active)
+            if (state->active) {
                 clearProgressDisplay();
+                hideCursorIfNeeded();
+            }
             state->haveUpdate = true;
             updateCV.notify_one();
         }
@@ -223,9 +252,7 @@ class ProgressBar : public Logger
         state->activitiesByType[type].its.emplace(act, i);
 
         if (type == actBuild) {
-            std::string name(storePathToName(getS(fields, 0)));
-            if (hasSuffix(name, ".drv"))
-                name = name.substr(0, name.size() - 4);
+            auto name = storePathToNameWithoutDrvSuffix(getS(fields, 0));
             i->s = fmt("building " ANSI_BOLD "%s" ANSI_NORMAL, name);
             auto machineName = getS(fields, 1);
             if (machineName != "")
@@ -250,9 +277,7 @@ class ProgressBar : public Logger
         }
 
         if (type == actPostBuildHook) {
-            auto name = storePathToName(getS(fields, 0));
-            if (hasSuffix(name, ".drv"))
-                name = name.substr(0, name.size() - 4);
+            auto name = storePathToNameWithoutDrvSuffix(getS(fields, 0));
             i->s = fmt("post-build " ANSI_BOLD "%s" ANSI_NORMAL, name);
             i->name = DrvName(name).name;
         }
@@ -674,7 +699,9 @@ class ProgressBar : public Logger
             return {};
         invalidateRedrawCache();
         std::cerr << fmt("\r\e[K%s ", msg);
+        unhideCursorIfNeeded();
         auto s = trim(readLine(getStandardInput(), true));
+        hideCursorIfNeeded();
         if (s.size() != 1)
             return {};
         draw(*state);
@@ -687,6 +714,8 @@ class ProgressBar : public Logger
     }
 };
 
+} // namespace
+
 std::unique_ptr<Logger> makeProgressBar()
 {
     return std::make_unique<ProgressBar>(isTTY());
diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index c57f71cc2689..f1d419af5ed1 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -66,8 +66,7 @@ void printMissing(ref<Store> store, const MissingPaths & missing, Verbosity lvl)
         else
             printMsg(lvl, "these %d derivations will be built:", missing.willBuild.size());
         auto sorted = store->topoSortPaths(missing.willBuild);
-        reverse(sorted.begin(), sorted.end());
-        for (auto & i : sorted)
+        for (auto & i : sorted | std::views::reverse)
             printMsg(lvl, "  %s", store->printStorePath(i));
     }
 
diff --git a/src/libstore-c/meson.build b/src/libstore-c/meson.build
index c81235bf16d4..600de4d2ea61 100644
--- a/src/libstore-c/meson.build
+++ b/src/libstore-c/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -45,16 +45,33 @@ headers += files('nix_api_store_internal.h')
 subdir('nix-meson-build-support/export-all-symbols')
 subdir('nix-meson-build-support/windows-version')
 
-this_library = library(
-  'nixstorec',
-  sources,
-  soversion : nix_soversion,
-  dependencies : deps_public + deps_private + deps_other,
-  include_directories : include_dirs,
-  link_args : linker_export_flags,
-  prelink : true, # For C++ static initializers
-  install : true,
-)
+# For linking -c bindings into the cli for plugins.
+build_both_libraries = get_option('plugin-c-api')
+
+library_kwargs = {
+  'soversion' : nix_soversion,
+  'dependencies' : deps_public + deps_private + deps_other,
+  'include_directories' : include_dirs,
+  'link_args' : linker_export_flags,
+  'install' : true,
+}
+
+if build_both_libraries
+  this_libraries = both_libraries(
+    'nixstorec',
+    sources,
+    kwargs : library_kwargs,
+    override_options : [ 'b_lto=false' ],
+  )
+else
+  this_library = library(
+    'nixstorec',
+    sources,
+    kwargs : library_kwargs,
+  )
+endif
+
+plugin_c_api_enabled = build_both_libraries
 
 install_headers(headers, preserve_path : true)
 
diff --git a/src/libstore-c/meson.options b/src/libstore-c/meson.options
new file mode 100644
index 000000000000..a8b0c4df0401
--- /dev/null
+++ b/src/libstore-c/meson.options
@@ -0,0 +1,8 @@
+# vim: filetype=meson
+
+option(
+  'plugin-c-api',
+  type : 'boolean',
+  value : false,
+  yield : true,
+)
diff --git a/src/libstore-c/nix_api_store.cc b/src/libstore-c/nix_api_store.cc
index fbb3c418566c..bce1cdd22b22 100644
--- a/src/libstore-c/nix_api_store.cc
+++ b/src/libstore-c/nix_api_store.cc
@@ -8,6 +8,7 @@
 
 #include "nix/store/path.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/build.hh"
 #include "nix/store/store-open.hh"
 #include "nix/store/store-reference.hh"
 #include "nix/store/build-result.hh"
@@ -178,7 +179,7 @@ nix_err nix_store_realise(
             .drvPath = nix::makeConstantStorePathRef(path->path), .outputs = nix::OutputsSpec::All{}}};
 
         const auto nixStore = store->ptr;
-        auto results = nixStore->buildPathsWithResults(paths, nix::bmNormal, nixStore);
+        auto results = nixStore->getBuilder(nixStore)->buildPathsWithResults(paths, nix::bmNormal);
 
         assert(results.size() == 1);
 
diff --git a/src/libstore-c/package.nix b/src/libstore-c/package.nix
index fde17c78e017..822acb00fc70 100644
--- a/src/libstore-c/package.nix
+++ b/src/libstore-c/package.nix
@@ -8,6 +8,7 @@
   # Configuration Options
 
   version,
+  withPluginCAPI,
 }:
 
 let
@@ -25,7 +26,7 @@ mkMesonLibrary (finalAttrs: {
     ../../.version
     ./.version
     ./meson.build
-    # ./meson.options
+    ./meson.options
     (fileset.fileFilter (file: file.hasExt "cc") ./.)
     (fileset.fileFilter (file: file.hasExt "hh") ./.)
     (fileset.fileFilter (file: file.hasExt "h") ./.)
@@ -37,6 +38,7 @@ mkMesonLibrary (finalAttrs: {
   ];
 
   mesonFlags = [
+    (lib.mesonBool "plugin-c-api" withPluginCAPI)
   ];
 
   meta = {
diff --git a/src/libstore-test-support/derived-path.cc b/src/libstore-test-support/derived-path.cc
index ee8018c3268f..8440a74df912 100644
--- a/src/libstore-test-support/derived-path.cc
+++ b/src/libstore-test-support/derived-path.cc
@@ -1,16 +1,13 @@
-
-#ifdef __APPLE__
-#  include <exception> // Needed by rapidcheck on Darwin
-#endif
+#include <exception> // IWYU pragma: keep (Needed by rapidcheck on Darwin and FreeBSD)
 #include <rapidcheck.h>
 
 #include "nix/store/tests/derived-path.hh"
 
 namespace rc {
-using namespace nix;
 
-Gen<SingleDerivedPath::Opaque> Arbitrary<SingleDerivedPath::Opaque>::arbitrary()
+Gen<nix::SingleDerivedPath::Opaque> Arbitrary<nix::SingleDerivedPath::Opaque>::arbitrary()
 {
+    using namespace nix;
     return gen::map(gen::arbitrary<StorePath>(), [](StorePath path) {
         return DerivedPath::Opaque{
             .path = path,
@@ -18,8 +15,9 @@ Gen<SingleDerivedPath::Opaque> Arbitrary<SingleDerivedPath::Opaque>::arbitrary()
     });
 }
 
-Gen<SingleDerivedPath::Built> Arbitrary<SingleDerivedPath::Built>::arbitrary()
+Gen<nix::SingleDerivedPath::Built> Arbitrary<nix::SingleDerivedPath::Built>::arbitrary()
 {
+    using namespace nix;
     return gen::mapcat(gen::arbitrary<SingleDerivedPath>(), [](SingleDerivedPath drvPath) {
         return gen::map(gen::arbitrary<StorePathName>(), [drvPath](StorePathName outputPath) {
             return SingleDerivedPath::Built{
@@ -30,8 +28,9 @@ Gen<SingleDerivedPath::Built> Arbitrary<SingleDerivedPath::Built>::arbitrary()
     });
 }
 
-Gen<DerivedPath::Built> Arbitrary<DerivedPath::Built>::arbitrary()
+Gen<nix::DerivedPath::Built> Arbitrary<nix::DerivedPath::Built>::arbitrary()
 {
+    using namespace nix;
     return gen::mapcat(gen::arbitrary<SingleDerivedPath>(), [](SingleDerivedPath drvPath) {
         return gen::map(gen::arbitrary<OutputsSpec>(), [drvPath](OutputsSpec outputs) {
             return DerivedPath::Built{
@@ -42,8 +41,9 @@ Gen<DerivedPath::Built> Arbitrary<DerivedPath::Built>::arbitrary()
     });
 }
 
-Gen<SingleDerivedPath> Arbitrary<SingleDerivedPath>::arbitrary()
+Gen<nix::SingleDerivedPath> Arbitrary<nix::SingleDerivedPath>::arbitrary()
 {
+    using namespace nix;
     return gen::mapcat(gen::inRange<uint8_t>(0, std::variant_size_v<SingleDerivedPath::Raw>), [](uint8_t n) {
         switch (n) {
         case 0:
@@ -56,8 +56,9 @@ Gen<SingleDerivedPath> Arbitrary<SingleDerivedPath>::arbitrary()
     });
 }
 
-Gen<DerivedPath> Arbitrary<DerivedPath>::arbitrary()
+Gen<nix::DerivedPath> Arbitrary<nix::DerivedPath>::arbitrary()
 {
+    using namespace nix;
     return gen::mapcat(gen::inRange<uint8_t>(0, std::variant_size_v<DerivedPath::Raw>), [](uint8_t n) {
         switch (n) {
         case 0:
diff --git a/src/libstore-test-support/include/nix/store/tests/nix_api_store.hh b/src/libstore-test-support/include/nix/store/tests/nix_api_store.hh
index 15df329cb2b1..df48a7469ea8 100644
--- a/src/libstore-test-support/include/nix/store/tests/nix_api_store.hh
+++ b/src/libstore-test-support/include/nix/store/tests/nix_api_store.hh
@@ -22,13 +22,10 @@ public:
     };
 
     ~nix_api_store_test_base() override
-    {
-        if (exists(std::filesystem::path{nixDir})) {
-            for (auto & path : std::filesystem::recursive_directory_iterator(nixDir)) {
-                std::filesystem::permissions(path, std::filesystem::perms::owner_all);
-            }
-            std::filesystem::remove_all(nixDir);
-        }
+    try {
+        nix::deletePath(nixDir);
+    } catch (...) {
+        nix::ignoreExceptionInDestructor();
     }
 
     std::string nixDir;
diff --git a/src/libstore-test-support/include/nix/store/tests/outputs-spec.hh b/src/libstore-test-support/include/nix/store/tests/outputs-spec.hh
index a30f83770257..6cdb0a60ef96 100644
--- a/src/libstore-test-support/include/nix/store/tests/outputs-spec.hh
+++ b/src/libstore-test-support/include/nix/store/tests/outputs-spec.hh
@@ -1,7 +1,7 @@
 #pragma once
 ///@file
 
-#include <exception> // Needed by rapidcheck on Darwin
+#include <exception> // IWYU pragma: keep (Needed by rapidcheck on Darwin and FreeBSD)
 #include <rapidcheck/gen/Arbitrary.h>
 
 #include "nix/store/outputs-spec.hh"
diff --git a/src/libstore-test-support/meson.build b/src/libstore-test-support/meson.build
index 4d904cb1d06a..ca451db4abce 100644
--- a/src/libstore-test-support/meson.build
+++ b/src/libstore-test-support/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
diff --git a/src/libstore-test-support/path.cc b/src/libstore-test-support/path.cc
index 98a255ccc026..ce14f469c7f1 100644
--- a/src/libstore-test-support/path.cc
+++ b/src/libstore-test-support/path.cc
@@ -1,6 +1,4 @@
-#ifdef __APPLE__
-#  include <exception> // Needed by rapidcheck on Darwin
-#endif
+#include <exception> // IWYU pragma: keep (Needed by rapidcheck on Darwin and FreeBSD)
 
 #include <rapidcheck/gen/Arbitrary.h>
 #include <rapidcheck.h>
@@ -57,7 +55,7 @@ Gen<nix::StorePathName> Arbitrary<nix::StorePathName>::arbitrary()
         }));
 }
 
-Gen<StorePath> Arbitrary<nix::StorePath>::arbitrary()
+Gen<nix::StorePath> Arbitrary<nix::StorePath>::arbitrary()
 {
     return gen::construct<nix::StorePath>(
         gen::arbitrary<nix::Hash>(),
diff --git a/src/libstore-tests/build-result.cc b/src/libstore-tests/build-result.cc
index a1d8ddee6412..9215b99e041f 100644
--- a/src/libstore-tests/build-result.cc
+++ b/src/libstore-tests/build-result.cc
@@ -36,8 +36,6 @@ TEST_P(BuildResultJsonTest, to_json)
     writeJsonTest(name, value);
 }
 
-using namespace std::literals::chrono_literals;
-
 INSTANTIATE_TEST_SUITE_P(
     BuildResultJSON,
     BuildResultJsonTest,
@@ -89,8 +87,8 @@ INSTANTIATE_TEST_SUITE_P(
                 .timesBuilt = 3,
                 .startTime = 30,
                 .stopTime = 50,
-                .cpuUser = std::chrono::microseconds(500s),
-                .cpuSystem = std::chrono::microseconds(604s),
+                .cpuUser = std::chrono::seconds(500),
+                .cpuSystem = std::chrono::seconds(604),
             },
         }));
 
diff --git a/src/libstore-tests/derivation-advanced-attrs.cc b/src/libstore-tests/derivation-advanced-attrs.cc
index bb7ad28f3d78..5a20c4f91539 100644
--- a/src/libstore-tests/derivation-advanced-attrs.cc
+++ b/src/libstore-tests/derivation-advanced-attrs.cc
@@ -12,8 +12,6 @@
 
 namespace nix {
 
-using namespace nlohmann;
-
 class DerivationAdvancedAttrsTest : public JsonCharacterizationTest<Derivation>, public LibStoreTest
 {
 protected:
@@ -39,7 +37,7 @@ class DerivationAdvancedAttrsTest : public JsonCharacterizationTest<Derivation>,
         this->readTest(fileName, [&](auto encoded) {
             auto got = parseDerivation(*this->store, std::move(encoded), "foo", this->mockXpSettings);
             auto options = derivationOptionsFromStructuredAttrs(
-                *this->store, got.inputDrvs, got.env, get(got.structuredAttrs), true, this->mockXpSettings);
+                *this->store, got.inputs.drvs, got.env, get(got.structuredAttrs), true, this->mockXpSettings);
             EXPECT_EQ(options.getRequiredSystemFeatures(got), expectedFeatures);
         });
     }
@@ -55,7 +53,7 @@ class DerivationAdvancedAttrsTest : public JsonCharacterizationTest<Derivation>,
         this->readTest(fileName, [&](auto encoded) {
             auto got = parseDerivation(*this->store, std::move(encoded), "foo", this->mockXpSettings);
             auto options = derivationOptionsFromStructuredAttrs(
-                *this->store, got.inputDrvs, got.env, get(got.structuredAttrs), true, this->mockXpSettings);
+                *this->store, got.inputs.drvs, got.env, get(got.structuredAttrs), true, this->mockXpSettings);
 
             EXPECT_EQ(options, expected);
             EXPECT_EQ(options.getRequiredSystemFeatures(got), expectedSystemFeatures);
@@ -83,6 +81,7 @@ TYPED_TEST_SUITE(DerivationAdvancedAttrsBothTest, BothFixtures);
 #define TEST_ATERM_JSON(STEM, NAME)                                                                      \
     TYPED_TEST(DerivationAdvancedAttrsBothTest, Derivation_##STEM##_from_json)                           \
     {                                                                                                    \
+        using namespace nlohmann;                                                                        \
         this->readTest(NAME ".json", [&](const auto & encoded_) {                                        \
             auto encoded = json::parse(encoded_);                                                        \
             /* Use DRV file instead of C++ literal as source of truth. */                                \
@@ -95,6 +94,7 @@ TYPED_TEST_SUITE(DerivationAdvancedAttrsBothTest, BothFixtures);
                                                                                                          \
     TYPED_TEST(DerivationAdvancedAttrsBothTest, Derivation_##STEM##_to_json)                             \
     {                                                                                                    \
+        using namespace nlohmann;                                                                        \
         this->writeTest(                                                                                 \
             NAME ".json",                                                                                \
             [&]() -> json {                                                                              \
@@ -108,6 +108,7 @@ TYPED_TEST_SUITE(DerivationAdvancedAttrsBothTest, BothFixtures);
                                                                                                          \
     TYPED_TEST(DerivationAdvancedAttrsBothTest, Derivation_##STEM##_from_aterm)                          \
     {                                                                                                    \
+        using namespace nlohmann;                                                                        \
         this->readTest(NAME ".drv", [&](auto encoded) {                                                  \
             /* Use JSON file instead of C++ literal as source of truth. */                               \
             auto j = json::parse(readFile(this->goldenMaster(NAME ".json")));                            \
@@ -184,7 +185,7 @@ TYPED_TEST(DerivationAdvancedAttrsBothTest, advancedAttributes_defaults)
         auto got = parseDerivation(*this->store, std::move(encoded), "foo", this->mockXpSettings);
 
         auto options = derivationOptionsFromStructuredAttrs(
-            *this->store, got.inputDrvs, got.env, get(got.structuredAttrs), true, this->mockXpSettings);
+            *this->store, got.inputs.drvs, got.env, get(got.structuredAttrs), true, this->mockXpSettings);
 
         EXPECT_TRUE(!got.structuredAttrs);
 
@@ -228,7 +229,7 @@ TYPED_TEST(DerivationAdvancedAttrsBothTest, advancedAttributes)
         auto got = parseDerivation(*this->store, std::move(encoded), "foo", this->mockXpSettings);
 
         auto options = derivationOptionsFromStructuredAttrs(
-            *this->store, got.inputDrvs, got.env, get(got.structuredAttrs), true, this->mockXpSettings);
+            *this->store, got.inputs.drvs, got.env, get(got.structuredAttrs), true, this->mockXpSettings);
 
         EXPECT_TRUE(!got.structuredAttrs);
 
@@ -324,7 +325,7 @@ TYPED_TEST(DerivationAdvancedAttrsBothTest, advancedAttributes_structuredAttrs_d
         auto got = parseDerivation(*this->store, std::move(encoded), "foo", this->mockXpSettings);
 
         auto options = derivationOptionsFromStructuredAttrs(
-            *this->store, got.inputDrvs, got.env, get(got.structuredAttrs), true, this->mockXpSettings);
+            *this->store, got.inputs.drvs, got.env, get(got.structuredAttrs), true, this->mockXpSettings);
 
         EXPECT_TRUE(got.structuredAttrs);
 
@@ -373,7 +374,7 @@ TYPED_TEST(DerivationAdvancedAttrsBothTest, advancedAttributes_structuredAttrs)
         auto got = parseDerivation(*this->store, std::move(encoded), "foo", this->mockXpSettings);
 
         auto options = derivationOptionsFromStructuredAttrs(
-            *this->store, got.inputDrvs, got.env, get(got.structuredAttrs), true, this->mockXpSettings);
+            *this->store, got.inputs.drvs, got.env, get(got.structuredAttrs), true, this->mockXpSettings);
 
         EXPECT_TRUE(got.structuredAttrs);
 
diff --git a/src/libstore-tests/derivation/external-formats.cc b/src/libstore-tests/derivation/external-formats.cc
index 6fee675e9849..412d192ced62 100644
--- a/src/libstore-tests/derivation/external-formats.cc
+++ b/src/libstore-tests/derivation/external-formats.cc
@@ -15,6 +15,14 @@ TEST_F(DerivationTest, BadATerm_version)
         parseDerivation(*store, readFile(goldenMaster("bad-version.drv")), "whatever", mockXpSettings), FormatError);
 }
 
+TEST_F(DerivationTest, UnterminatedString)
+{
+    ASSERT_THROW(
+        parseDerivation(
+            *store, "Derive([(\"out\",\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo", "bar", mockXpSettings),
+        FormatError);
+}
+
 TEST_F(DynDerivationTest, BadATerm_oldVersionDynDeps)
 {
     ASSERT_THROW(
@@ -66,11 +74,10 @@ INSTANTIATE_TEST_SUITE_P(
         std::pair{
             "caFixedNAR",
             DerivationOutput{DerivationOutput::CAFixed{
-                .ca =
-                    {
-                        .method = ContentAddressMethod::Raw::NixArchive,
-                        .hash = Hash::parseAnyPrefixed("sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8="),
-                    },
+                .ca{
+                    .method = ContentAddressMethod::Raw::NixArchive,
+                    .hash = Hash::parseAnyPrefixed("sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8="),
+                },
             }},
         },
         std::pair{
@@ -177,41 +184,36 @@ struct DerivationJsonAtermTest : DerivationTest,
 
 MAKE_TEST_P(DerivationJsonAtermTest);
 
-INSTANTIATE_TEST_SUITE_P(DerivationJSONATerm, DerivationJsonAtermTest, ::testing::Values([]() {
-                             Derivation drv;
-                             drv.name = "simple-derivation";
-                             drv.inputSrcs = {
-                                 StorePath("c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-dep1"),
-                             };
-                             drv.inputDrvs = {
-                                 .map =
-                                     {
-                                         {
-                                             StorePath("c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-dep2.drv"),
-                                             {
-                                                 .value =
-                                                     {
-                                                         "cat",
-                                                         "dog",
-                                                     },
-                                             },
-                                         },
-                                     },
-                             };
-                             drv.platform = "wasm-sel4";
-                             drv.builder = "foo";
-                             drv.args = {
-                                 "bar",
-                                 "baz",
-                             };
-                             drv.env = StringPairs{
-                                 {
-                                     "BIG_BAD",
-                                     "WOLF",
-                                 },
-                             };
-                             return drv;
-                         }()));
+INSTANTIATE_TEST_SUITE_P(
+    DerivationJSONATerm,
+    DerivationJsonAtermTest,
+    ::testing::Values(
+        Derivation{
+            .outputs = {},
+            .inputs{
+                .srcs{
+                    StorePath{"c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-dep1"},
+                },
+                .drvs{.map{
+                    {
+                        StorePath{"c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-dep2.drv"},
+                        {
+                            .value{
+                                "cat",
+                                "dog",
+                            },
+                        },
+                    },
+                }},
+            },
+            .platform = "wasm-sel4",
+            .builder = "foo",
+            .args = {"bar", "baz"},
+            .env{
+                {"BIG_BAD", "WOLF"},
+            },
+            .name = "simple-derivation",
+        }));
 
 struct DynDerivationJsonAtermTest : DynDerivationTest,
                                     JsonCharacterizationTest<Derivation>,
@@ -222,60 +224,36 @@ MAKE_TEST_P(DynDerivationJsonAtermTest);
 
 Derivation makeDynDepDerivation()
 {
-    Derivation drv;
-    drv.name = "dyn-dep-derivation";
-    drv.inputSrcs = {
-        StorePath{"c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-dep1"},
-    };
-    drv.inputDrvs = {
-        .map =
-            {
+    return Derivation{
+        .outputs = {},
+        .inputs{
+            .srcs{
+                StorePath{"c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-dep1"},
+            },
+            .drvs{.map{
                 {
                     StorePath{"c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-dep2.drv"},
                     DerivedPathMap<StringSet>::ChildNode{
-                        .value =
-                            {
-                                "cat",
-                                "dog",
-                            },
-                        .childMap =
-                            {
-                                {
-                                    "cat",
-                                    DerivedPathMap<StringSet>::ChildNode{
-                                        .value =
-                                            {
-                                                "kitten",
-                                            },
-                                    },
-                                },
-                                {
-                                    "goose",
-                                    DerivedPathMap<StringSet>::ChildNode{
-                                        .value =
-                                            {
-                                                "gosling",
-                                            },
-                                    },
-                                },
-                            },
+                        .value{
+                            "cat",
+                            "dog",
+                        },
+                        .childMap{
+                            {"cat", DerivedPathMap<StringSet>::ChildNode{.value = {"kitten"}}},
+                            {"goose", DerivedPathMap<StringSet>::ChildNode{.value = {"gosling"}}},
+                        },
                     },
                 },
-            },
-    };
-    drv.platform = "wasm-sel4";
-    drv.builder = "foo";
-    drv.args = {
-        "bar",
-        "baz",
-    };
-    drv.env = StringPairs{
-        {
-            "BIG_BAD",
-            "WOLF",
+            }},
+        },
+        .platform = "wasm-sel4",
+        .builder = "foo",
+        .args = {"bar", "baz"},
+        .env{
+            {"BIG_BAD", "WOLF"},
         },
+        .name = "dyn-dep-derivation",
     };
-    return drv;
 }
 
 INSTANTIATE_TEST_SUITE_P(DynDerivationJSONATerm, DynDerivationJsonAtermTest, ::testing::Values(makeDynDepDerivation()));
diff --git a/src/libstore-tests/derivation/invariants.cc b/src/libstore-tests/derivation/invariants.cc
index e825655d66f4..eea26b78e99a 100644
--- a/src/libstore-tests/derivation/invariants.cc
+++ b/src/libstore-tests/derivation/invariants.cc
@@ -29,21 +29,21 @@ class FillInOutputPathsTest : public LibStoreTest, public JsonCharacterizationTe
      */
     StorePath makeCAFloatingDependency(std::string_view name)
     {
-        Derivation depDrv;
-        depDrv.name = name;
-        depDrv.platform = "x86_64-linux";
-        depDrv.builder = "/bin/sh";
-        depDrv.outputs = {
-            {
-                "out",
-                // will ensure that downstream is deferred
-                DerivationOutput{DerivationOutput::CAFloating{
-                    .method = ContentAddressMethod::Raw::NixArchive,
-                    .hashAlgo = HashAlgorithm::SHA256,
-                }},
+        Derivation depDrv{
+            .outputs{
+                {
+                    "out",
+                    DerivationOutput{DerivationOutput::CAFloating{
+                        .method = ContentAddressMethod::Raw::NixArchive,
+                        .hashAlgo = HashAlgorithm::SHA256,
+                    }},
+                },
             },
+            .platform = "x86_64-linux",
+            .builder = "/bin/sh",
+            .env = {{"out", ""}},
+            .name = std::string{name},
         };
-        depDrv.env = {{"out", ""}};
 
         // Fill in the dependency derivation's output paths
         depDrv.fillInOutputPaths(*store);
@@ -64,14 +64,13 @@ TEST_F(FillInOutputPathsTest, fillsDeferredOutputs_emptyStringEnvVar)
     using nlohmann::json;
 
     // Before: Derivation with deferred output
-    Derivation drv;
-    drv.name = "filled-in-deferred-empty-env-var";
-    drv.platform = "x86_64-linux";
-    drv.builder = "/bin/sh";
-    drv.outputs = {
-        {"out", DerivationOutput{DerivationOutput::Deferred{}}},
+    Derivation drv{
+        .outputs = {{"out", DerivationOutput{DerivationOutput::Deferred{}}}},
+        .platform = "x86_64-linux",
+        .builder = "/bin/sh",
+        .env = {{"__doc", "Fill in deferred output with empty env var"}, {"out", ""}},
+        .name = "filled-in-deferred-empty-env-var",
     };
-    drv.env = {{"__doc", "Fill in deferred output with empty env var"}, {"out", ""}};
 
     // Serialize before state
     checkpointJson("filled-in-deferred-empty-env-var-pre", drv);
@@ -95,15 +94,12 @@ TEST_F(FillInOutputPathsTest, fillsDeferredOutputs_empty_string_var)
     using nlohmann::json;
 
     // Before: Derivation with deferred output
-    Derivation drv;
-    drv.name = "filled-in-deferred-no-env-var";
-    drv.platform = "x86_64-linux";
-    drv.builder = "/bin/sh";
-    drv.outputs = {
-        {"out", DerivationOutput{DerivationOutput::Deferred{}}},
-    };
-    drv.env = {
-        {"__doc", "Fill in deferred with missing env var"},
+    Derivation drv{
+        .outputs = {{"out", DerivationOutput{DerivationOutput::Deferred{}}}},
+        .platform = "x86_64-linux",
+        .builder = "/bin/sh",
+        .env = {{"__doc", "Fill in deferred with missing env var"}},
+        .name = "filled-in-deferred-no-env-var",
     };
 
     // Serialize before state
@@ -127,16 +123,12 @@ TEST_F(FillInOutputPathsTest, preservesInputAddressedOutputs)
 {
     auto expectedPath = StorePath{"w4bk7hpyxzgy2gx8fsa8f952435pll3i-filled-in-already"};
 
-    Derivation drv;
-    drv.name = "filled-in-already";
-    drv.platform = "x86_64-linux";
-    drv.builder = "/bin/sh";
-    drv.outputs = {
-        {"out", DerivationOutput{DerivationOutput::InputAddressed{.path = expectedPath}}},
-    };
-    drv.env = {
-        {"__doc", "Correct path stays unchanged"},
-        {"out", store->printStorePath(expectedPath)},
+    Derivation drv{
+        .outputs = {{"out", DerivationOutput{DerivationOutput::InputAddressed{.path = expectedPath}}}},
+        .platform = "x86_64-linux",
+        .builder = "/bin/sh",
+        .env = {{"__doc", "Correct path stays unchanged"}, {"out", store->printStorePath(expectedPath)}},
+        .name = "filled-in-already",
     };
 
     // Serialize before state
@@ -154,16 +146,12 @@ TEST_F(FillInOutputPathsTest, throwsOnIncorrectInputAddressedPath)
 {
     auto wrongPath = StorePath{"c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-wrong-name"};
 
-    Derivation drv;
-    drv.name = "bad-path";
-    drv.platform = "x86_64-linux";
-    drv.builder = "/bin/sh";
-    drv.outputs = {
-        {"out", DerivationOutput{DerivationOutput::InputAddressed{.path = wrongPath}}},
-    };
-    drv.env = {
-        {"__doc", "Wrong InputAddressed path throws error"},
-        {"out", store->printStorePath(wrongPath)},
+    Derivation drv{
+        .outputs = {{"out", DerivationOutput{DerivationOutput::InputAddressed{.path = wrongPath}}}},
+        .platform = "x86_64-linux",
+        .builder = "/bin/sh",
+        .env = {{"__doc", "Wrong InputAddressed path throws error"}, {"out", store->printStorePath(wrongPath)}},
+        .name = "bad-path",
     };
 
     // Serialize before state
@@ -177,16 +165,12 @@ TEST_F(FillInOutputPathsTest, throwsOnIncorrectEnvVar)
 {
     auto wrongPath = StorePath{"c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-wrong-name"};
 
-    Derivation drv;
-    drv.name = "bad-env-var";
-    drv.platform = "x86_64-linux";
-    drv.builder = "/bin/sh";
-    drv.outputs = {
-        {"out", DerivationOutput{DerivationOutput::Deferred{}}},
-    };
-    drv.env = {
-        {"__doc", "Wrong env var value throws error"},
-        {"out", store->printStorePath(wrongPath)},
+    Derivation drv{
+        .outputs = {{"out", DerivationOutput{DerivationOutput::Deferred{}}}},
+        .platform = "x86_64-linux",
+        .builder = "/bin/sh",
+        .env = {{"__doc", "Wrong env var value throws error"}, {"out", store->printStorePath(wrongPath)}},
+        .name = "bad-env-var",
     };
 
     // Serialize before state
@@ -204,19 +188,14 @@ TEST_F(FillInOutputPathsTest, preservesDeferredWithInputDrvs)
     auto depDrvPath = makeCAFloatingDependency("dependency");
 
     // Create a derivation that depends on the dependency
-    Derivation drv;
-    drv.name = "depends-on-drv";
-    drv.platform = "x86_64-linux";
-    drv.builder = "/bin/sh";
-    drv.outputs = {
-        {"out", DerivationOutput{DerivationOutput::Deferred{}}},
-    };
-    drv.env = {
-        {"__doc", "Deferred stays deferred with CA dependencies"},
-        {"out", ""},
+    Derivation drv{
+        .outputs = {{"out", DerivationOutput{DerivationOutput::Deferred{}}}},
+        .inputs = {.drvs = {.map = {{depDrvPath, {.value = {"out"}}}}}},
+        .platform = "x86_64-linux",
+        .builder = "/bin/sh",
+        .env = {{"__doc", "Deferred stays deferred with CA dependencies"}, {"out", ""}},
+        .name = "depends-on-drv",
     };
-    // Add the real input derivation dependency
-    drv.inputDrvs = {.map = {{depDrvPath, {.value = {"out"}}}}};
 
     // Serialize before state
     checkpointJson("depends-on-drv-pre", drv);
@@ -240,19 +219,14 @@ TEST_F(FillInOutputPathsTest, throwsOnPatWhenShouldBeDeffered)
     auto wrongPath = StorePath{"c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-wrong-name"};
 
     // Create a derivation that depends on the dependency
-    Derivation drv;
-    drv.name = "depends-on-drv";
-    drv.platform = "x86_64-linux";
-    drv.builder = "/bin/sh";
-    drv.outputs = {
-        {"out", DerivationOutput{DerivationOutput::InputAddressed{.path = wrongPath}}},
-    };
-    drv.env = {
-        {"__doc", "InputAddressed throws when should be deferred"},
-        {"out", ""},
+    Derivation drv{
+        .outputs = {{"out", DerivationOutput{DerivationOutput::InputAddressed{.path = wrongPath}}}},
+        .inputs = {.drvs = {.map = {{depDrvPath, {.value = {"out"}}}}}},
+        .platform = "x86_64-linux",
+        .builder = "/bin/sh",
+        .env = {{"__doc", "InputAddressed throws when should be deferred"}, {"out", ""}},
+        .name = "depends-on-drv",
     };
-    // Add the real input derivation dependency
-    drv.inputDrvs = {.map = {{depDrvPath, {.value = {"out"}}}}};
 
     // Serialize before state
     checkpointJson("bad-depends-on-drv-pre", drv);
diff --git a/src/libstore-tests/derivations.cc b/src/libstore-tests/derivations.cc
index 60b86f571205..03a67a8795f5 100644
--- a/src/libstore-tests/derivations.cc
+++ b/src/libstore-tests/derivations.cc
@@ -128,13 +128,13 @@ TEST_F(TryResolveTest, noInputs)
     resolveExpect(
         "no-inputs",
         [&] {
-            Derivation drv;
-            drv.name = "no-inputs";
-            drv.platform = "x86_64-linux";
-            drv.builder = "/bin/bash";
-            drv.outputs = {{"out", caFloatingOutput()}};
-            drv.env = {{"FOO", "bar"}};
-            return drv;
+            return Derivation{
+                .outputs = {{"out", caFloatingOutput()}},
+                .platform = "x86_64-linux",
+                .builder = "/bin/bash",
+                .env = {{"FOO", "bar"}},
+                .name = "no-inputs",
+            };
         }(),
         {},
         [&] {
@@ -168,28 +168,28 @@ TEST_F(TryResolveTest, withInputs)
 
     resolveExpect(
         "with-inputs",
-        [&] {
-            Derivation drv;
-            drv.name = "with-inputs";
-            drv.platform = "x86_64-linux";
-            drv.builder = "/bin/bash";
-            drv.outputs = multiOutputs;
-            drv.inputDrvs = {
-                .map = {
+        Derivation{
+            .outputs = multiOutputs,
+            .inputs{
+                .drvs{.map{
                     {dep1DrvPath, {.value = {"out", "dev"}}},
                     {dep2DrvPath, {.value = {"out"}}},
-                }};
-            drv.env = {
-                {"DEP1_OUT", "prefix-" + placeholder1Out + "-suffix"},
-                {"DEP1_DEV", placeholder1Dev},
-                {"DEP2", placeholder2Out},
-            };
-            drv.structuredAttrs = StructuredAttrs{{
+                }},
+            },
+            .platform = "x86_64-linux",
+            .builder = "/bin/bash",
+            .env =
+                {
+                    {"DEP1_OUT", "prefix-" + placeholder1Out + "-suffix"},
+                    {"DEP1_DEV", placeholder1Dev},
+                    {"DEP2", placeholder2Out},
+                },
+            .structuredAttrs = StructuredAttrs{{
                 {"dep1out", placeholder1Out},
                 {"nested", nlohmann::json::object({{"dep2", "before " + placeholder2Out + " after"}})},
-            }};
-            return drv;
-        }(),
+            }},
+            .name = "with-inputs",
+        },
         {.dict{
             {
                 SingleDerivedPath::Built{
@@ -219,7 +219,7 @@ TEST_F(TryResolveTest, withInputs)
             expected.platform = "x86_64-linux";
             expected.builder = "/bin/bash";
             expected.outputs = multiOutputs;
-            expected.inputSrcs = {dep1OutPath, dep1DevPath, dep2OutPath};
+            expected.inputs = {dep1OutPath, dep1DevPath, dep2OutPath};
             expected.env = {
                 {"DEP1_OUT", "prefix-" + store->printStorePath(dep1OutPath) + "-suffix"},
                 {"DEP1_DEV", store->printStorePath(dep1DevPath)},
@@ -238,12 +238,13 @@ TEST_F(TryResolveTest, resolutionFailure)
 {
     StorePath depDrvPath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-dep.drv"};
 
-    Derivation drv;
-    drv.name = "resolution-failure";
-    drv.platform = "x86_64-linux";
-    drv.builder = "/bin/bash";
-    drv.outputs = {{"out", caFloatingOutput()}};
-    drv.inputDrvs = {.map = {{depDrvPath, {.value = {"out"}}}}};
+    Derivation drv{
+        .outputs = {{"out", caFloatingOutput()}},
+        .inputs = {.drvs = {.map = {{depDrvPath, {.value = {"out"}}}}}},
+        .platform = "x86_64-linux",
+        .builder = "/bin/bash",
+        .name = "resolution-failure",
+    };
 
     BuildTrace buildTrace;
 
@@ -273,7 +274,7 @@ void TryResolveTest::exportRefGraphSubpathTest(
 
     nix::checkpointJson(*this, std::string{stem} + "-before", drv);
 
-    auto options = derivationOptionsFromStructuredAttrs(*store, drv.inputDrvs, drv.env, parsed, true);
+    auto options = derivationOptionsFromStructuredAttrs(*store, drv.inputs.drvs, drv.env, parsed, true);
 
     nix::checkpointJson(*this, std::string{stem} + "-before-options", options);
 
@@ -328,14 +329,13 @@ TEST_F(TryResolveTest, exportReferencesGraphPlaceholderSubpath)
     StorePath depDrvPath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-dep.drv"};
     auto placeholder = DownstreamPlaceholder::unknownCaOutput(depDrvPath, "out").render();
 
-    Derivation drv;
-    drv.name = "export-ref-subpath";
-    drv.platform = "x86_64-linux";
-    drv.builder = "/bin/bash";
-    drv.outputs = {{"out", caFloatingOutput()}};
-    drv.inputDrvs = {.map = {{depDrvPath, {.value = {"out"}}}}};
-    drv.env = {
-        {"exportReferencesGraph", "refs " + placeholder + "/foo"},
+    Derivation drv{
+        .outputs = {{"out", caFloatingOutput()}},
+        .inputs = {.drvs = {.map = {{depDrvPath, {.value = {"out"}}}}}},
+        .platform = "x86_64-linux",
+        .builder = "/bin/bash",
+        .env = {{"exportReferencesGraph", "refs " + placeholder + "/foo"}},
+        .name = "export-ref-subpath",
     };
 
     exportRefGraphSubpathTest("export-ref-subpath", drv, nullptr);
@@ -346,15 +346,20 @@ TEST_F(TryResolveTest, exportReferencesGraphPlaceholderSubpath_structuredAttrs)
     StorePath depDrvPath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-dep.drv"};
     auto placeholder = DownstreamPlaceholder::unknownCaOutput(depDrvPath, "out").render();
 
-    Derivation drv;
-    drv.name = "export-ref-subpath-sa";
-    drv.platform = "x86_64-linux";
-    drv.builder = "/bin/bash";
-    drv.outputs = {{"out", caFloatingOutput()}};
-    drv.inputDrvs = {.map = {{depDrvPath, {.value = {"out"}}}}};
-    drv.structuredAttrs = StructuredAttrs{{
-        {"exportReferencesGraph", nlohmann::json::object({{"refs", nlohmann::json::array({placeholder + "/foo"})}})},
-    }};
+    Derivation drv{
+        .outputs = {{"out", caFloatingOutput()}},
+        .inputs = {.drvs = {.map = {{depDrvPath, {.value = {"out"}}}}}},
+        .platform = "x86_64-linux",
+        .builder = "/bin/bash",
+        .structuredAttrs = StructuredAttrs{{
+            {
+                "exportReferencesGraph",
+                nlohmann::json::object({{"refs", nlohmann::json::array({placeholder + "/foo"})}}),
+            },
+        }},
+        .name = "export-ref-subpath-sa",
+    };
+    // env depends on structuredAttrs, so set it after construction
     drv.env = {
         {std::string{StructuredAttrs::envVarName}, nlohmann::json(drv.structuredAttrs->structuredAttrs).dump()},
     };
diff --git a/src/libstore-tests/derived-path.cc b/src/libstore-tests/derived-path.cc
index 541d729e030c..46297c9a30db 100644
--- a/src/libstore-tests/derived-path.cc
+++ b/src/libstore-tests/derived-path.cc
@@ -92,8 +92,6 @@ TEST_F(DerivedPathTest, built_built_xp)
         MissingExperimentalFeature);
 }
 
-#ifndef COVERAGE
-
 /* TODO: Disabled due to the following error:
 
        path '00000000000000000000000000000000-0^0' is not a valid store path:
@@ -113,8 +111,6 @@ RC_GTEST_FIXTURE_PROP(DerivedPathTest, prop_round_rip, (const DerivedPath & o))
     RC_ASSERT(o == DerivedPath::parse(*store, o.to_string(*store), xpSettings));
 }
 
-#endif
-
 /* ----------------------------------------------------------------------------
  * JSON
  * --------------------------------------------------------------------------*/
diff --git a/src/libstore-tests/dummy-store.cc b/src/libstore-tests/dummy-store.cc
index 4626fc31f28d..6c2625d5306a 100644
--- a/src/libstore-tests/dummy-store.cc
+++ b/src/libstore-tests/dummy-store.cc
@@ -158,9 +158,7 @@ INSTANTIATE_TEST_SUITE_P(DummyStoreJSON, DummyStoreJsonTest, [] {
             "one-derivation",
             [&] {
                 auto store = writeCfg->openDummyStore();
-                Derivation drv;
-                drv.name = "foo";
-                store->writeDerivation(drv);
+                store->writeDerivation(Derivation{.name = "foo"});
                 return store;
             }(),
         },
diff --git a/src/libstore-tests/filetransfer-request.cc b/src/libstore-tests/filetransfer-request.cc
new file mode 100644
index 000000000000..b89bb7ed0bc1
--- /dev/null
+++ b/src/libstore-tests/filetransfer-request.cc
@@ -0,0 +1,19 @@
+#include <gtest/gtest.h>
+
+#include "nix/store/filetransfer.hh"
+
+namespace nix {
+
+TEST(FileTransferRequest, displayUriStripsUserinfo)
+{
+    FileTransferRequest req(VerbatimURL{std::string{"https://alice:s3cr3t@example.org:8443/path/file.toml?x=1"}});
+    // uri itself is untouched (used for CURLOPT_URL, result.urls, cache keys).
+    EXPECT_EQ(req.uri.to_string(), "https://alice:s3cr3t@example.org:8443/path/file.toml?x=1");
+    // displayUri() drops the userinfo for diagnostics.
+    EXPECT_EQ(req.displayUri(), "https://example.org:8443/path/file.toml?x=1");
+
+    FileTransferRequest plain(VerbatimURL{std::string{"https://example.org/file"}});
+    EXPECT_EQ(plain.displayUri(), "https://example.org/file");
+}
+
+} // namespace nix
diff --git a/src/libstore-tests/http-binary-cache-store.cc b/src/libstore-tests/http-binary-cache-store.cc
index 74f3b93cd3df..93d279d53a1f 100644
--- a/src/libstore-tests/http-binary-cache-store.cc
+++ b/src/libstore-tests/http-binary-cache-store.cc
@@ -57,13 +57,10 @@ TEST(HttpBinaryCacheStore, constructConfigWithParamsAndUrlWithParams)
 using testing::HttpsBinaryCacheStoreMtlsTest;
 using testing::HttpsBinaryCacheStoreTest;
 
-using namespace std::string_view_literals;
-using namespace std::string_literals;
-
 TEST_F(HttpsBinaryCacheStoreTest, queryPathInfo)
 {
     auto store = openStore(makeConfig());
-    StringSource dump{"test"sv};
+    StringSource dump{std::string_view("test")};
     auto path = localCacheStore->addToStoreFromDump(dump, "test-name", FileSerialisationMethod::Flat);
     EXPECT_NO_THROW(store->queryPathInfo(path));
 }
@@ -74,7 +71,7 @@ TEST_F(HttpsBinaryCacheStoreMtlsTest, queryPathInfo)
     config->tlsCert = clientCert;
     config->tlsKey = clientKey;
     auto store = openStore(config);
-    StringSource dump{"test"sv};
+    StringSource dump{std::string_view("test")};
     auto path = localCacheStore->addToStoreFromDump(dump, "test-name", FileSerialisationMethod::Flat);
     EXPECT_NO_THROW(store->queryPathInfo(path));
 }
@@ -104,7 +101,7 @@ TEST_F(HttpsBinaryCacheStoreMtlsTest, rejectsWrongClientCert)
 
 TEST_F(HttpsBinaryCacheStoreMtlsTest, doesNotSendCertOnRedirectToDifferentAuthority)
 {
-    StringSource dump{"test"sv};
+    StringSource dump{std::string_view("test")};
     auto path = localCacheStore->addToStoreFromDump(dump, "test-name", FileSerialisationMethod::Flat);
 
     for (auto & entry : DirectoryIterator{cacheDir})
diff --git a/src/libstore-tests/meson.build b/src/libstore-tests/meson.build
index a126a87aca8b..a7353f1ec7dd 100644
--- a/src/libstore-tests/meson.build
+++ b/src/libstore-tests/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -64,6 +64,7 @@ sources = files(
   'derived-path.cc',
   'downstream-placeholder.cc',
   'dummy-store.cc',
+  'filetransfer-request.cc',
   'filetransfer-retry.cc',
   'http-binary-cache-store.cc',
   'legacy-ssh-store.cc',
@@ -76,6 +77,7 @@ sources = files(
   'nar-info-disk-cache.cc',
   'nar-info.cc',
   'nix_api_store.cc',
+  'outputs-query.cc',
   'outputs-spec.cc',
   'path-info.cc',
   'path.cc',
diff --git a/src/libstore-tests/nar-info-disk-cache.cc b/src/libstore-tests/nar-info-disk-cache.cc
index aebefc775675..7612250c661d 100644
--- a/src/libstore-tests/nar-info-disk-cache.cc
+++ b/src/libstore-tests/nar-info-disk-cache.cc
@@ -30,15 +30,16 @@ TEST(NarInfoDiskCacheImpl, create_and_read)
 
         // Set up "background noise" and check that different caches receive different ids
         {
-            auto bc1 = cache->createCache("https://bar", "/nix/storedir", wantMassQuery, prio);
-            auto bc2 = cache->createCache("https://xyz", "/nix/storedir", false, 12);
+            auto bc1 =
+                cache->createCache("https://bar", "/nix/storedir", {.wantMassQuery = wantMassQuery, .priority = prio});
+            auto bc2 = cache->createCache("https://xyz", "/nix/storedir", {.priority = 12});
             ASSERT_NE(bc1, bc2);
             barId = bc1;
         }
 
         // Check that the fields are saved and returned correctly. This does not test
         // the select statement yet, because of in-memory caching.
-        savedId = cache->createCache("http://foo", "/nix/storedir", wantMassQuery, prio);
+        savedId = cache->createCache("http://foo", "/nix/storedir", {.wantMassQuery = wantMassQuery, .priority = prio});
         ;
         {
             auto r = cache->upToDateCacheExists("http://foo");
@@ -84,7 +85,7 @@ TEST(NarInfoDiskCacheImpl, create_and_read)
         }
 
         // "Update", same data, check that the id number is reused
-        cache2->createCache("http://foo", "/nix/storedir", wantMassQuery, prio);
+        cache2->createCache("http://foo", "/nix/storedir", {.wantMassQuery = wantMassQuery, .priority = prio});
 
         {
             auto r = cache2->upToDateCacheExists("http://foo");
@@ -107,7 +108,8 @@ TEST(NarInfoDiskCacheImpl, create_and_read)
             auto r0 = cache2->upToDateCacheExists("https://bar");
             ASSERT_FALSE(r0);
 
-            cache2->createCache("https://bar", "/nix/storedir", !wantMassQuery, prio + 10);
+            cache2->createCache(
+                "https://bar", "/nix/storedir", {.wantMassQuery = !wantMassQuery, .priority = prio + 10});
             auto r = cache2->upToDateCacheExists("https://bar");
             ASSERT_EQ(r->wantMassQuery, !wantMassQuery);
             ASSERT_EQ(r->priority, prio + 10);
diff --git a/src/libstore-tests/nar-info.cc b/src/libstore-tests/nar-info.cc
index 21a1d63a7e94..63e5908d8818 100644
--- a/src/libstore-tests/nar-info.cc
+++ b/src/libstore-tests/nar-info.cc
@@ -75,7 +75,7 @@ static NarInfo makeNarInfo(const Store & store, bool includeImpureInfo)
         };
 
         info.url = "nar/1w1fff338fvdw53sqgamddn1b2xgds473pv6y13gizdbqjv4i5p3.nar.xz";
-        info.compression = "xz";
+        info.compression = CompressionAlgo::xz;
         info.fileHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc=");
         info.fileSize = 4029176;
     }
diff --git a/src/libstore-tests/nix_api_store.cc b/src/libstore-tests/nix_api_store.cc
index 60626869a919..0162684daf4b 100644
--- a/src/libstore-tests/nix_api_store.cc
+++ b/src/libstore-tests/nix_api_store.cc
@@ -77,8 +77,8 @@ TEST_F(nix_api_store_test, ReturnsValidStorePath)
 {
     StorePath * result = nix_store_parse_path(ctx, store, (nixStoreDir + PATH_SUFFIX).c_str());
     ASSERT_NE(result, nullptr);
-    ASSERT_STREQ("name", result->path.name().data());
-    ASSERT_STREQ(PATH_SUFFIX.substr(1).c_str(), result->path.to_string().data());
+    ASSERT_EQ("name", result->path.name());
+    ASSERT_EQ(PATH_SUFFIX.substr(1), result->path.to_string());
     nix_store_path_free(result);
 }
 
diff --git a/src/libstore-tests/outputs-query.cc b/src/libstore-tests/outputs-query.cc
new file mode 100644
index 000000000000..356df632b8da
--- /dev/null
+++ b/src/libstore-tests/outputs-query.cc
@@ -0,0 +1,114 @@
+// Regression tests for the functions in outputs-query.cc
+//
+// See https://github.com/NixOS/nix/issues/15713
+
+#include <gtest/gtest.h>
+
+#include "nix/store/outputs-query.hh"
+#include "nix/store/derivations.hh"
+#include "nix/store/dummy-store-impl.hh"
+#include "nix/store/realisation.hh"
+#include "nix/store/tests/libstore.hh"
+
+namespace nix {
+
+class OutputsQueryTest : public ::testing::Test
+{
+public:
+    static void SetUpTestSuite()
+    {
+        initLibStore(false);
+    }
+
+protected:
+    EnableExperimentalFeature caFeature{"ca-derivations"};
+
+    ref<DummyStore> store = [] {
+        auto cfg = make_ref<DummyStoreConfig>(StoreReference::Params{});
+        cfg->readOnly = false;
+        return cfg->openDummyStore();
+    }();
+
+    static DerivationOutput caFloatingOutput()
+    {
+        return DerivationOutput{DerivationOutput::CAFloating{
+            .method = ContentAddressMethod::Raw::NixArchive,
+            .hashAlgo = HashAlgorithm::SHA256,
+        }};
+    }
+
+    /**
+     * Build a simple floating CA derivation with a given name and no input
+     * derivations.
+     */
+    Derivation makeLeafDrv(std::string name)
+    {
+        return Derivation{
+            .outputs = {{"out", caFloatingOutput()}},
+            .platform = "x86_64-linux",
+            .builder = "/bin/sh",
+            .name = std::move(name),
+        };
+    }
+};
+
+/**
+ * Regression test for https://github.com/NixOS/nix/issues/15713
+ *
+ * In a Fibonacci-style chain of floating CA derivations, the resolution
+ * algorithm used to call queryRealisation O(Fib(N)) times.
+ * This test verifies that memoization reduces this to O(N).
+ */
+TEST_F(OutputsQueryTest, fibonacciChainQueryCount)
+{
+    constexpr static size_t N = 10;
+    std::vector<StorePath> drvPaths;
+
+    // d0, d1: leaf derivations
+    for (int i = 0; i < 2; ++i) {
+        drvPaths.push_back(store->writeDerivation(makeLeafDrv("d" + std::to_string(i))));
+    }
+
+    // d_i depends on d_{i-1} and d_{i-2}
+    for (size_t i = 2; i <= N; ++i) {
+        Derivation drv = makeLeafDrv("d" + std::to_string(i));
+        drv.inputs.drvs.map[drvPaths[i - 1]].value.insert("out");
+        drv.inputs.drvs.map[drvPaths[i - 2]].value.insert("out");
+        drvPaths.push_back(store->writeDerivation(drv));
+    }
+
+    // Tracker for queryRealisation calls.
+    std::map<StorePath, int> callCounts;
+    std::map<StorePath, StorePath> outPaths;
+
+    QueryRealisationFun queryRealisation = [&](const DrvOutput & id) -> std::shared_ptr<const UnkeyedRealisation> {
+        assert(id.outputName == "out");
+        callCounts[id.drvPath]++;
+
+        // Memoize mock output paths.
+        auto it = outPaths.find(id.drvPath);
+        if (it == outPaths.end()) {
+            auto hash = hashString(HashAlgorithm::SHA1, "mock-output-" + std::to_string(outPaths.size()));
+            it = outPaths.emplace(id.drvPath, StorePath(hash, "out")).first;
+        }
+
+        return std::make_shared<UnkeyedRealisation>(UnkeyedRealisation{.outPath = it->second});
+    };
+
+    auto result = deepQueryPartialDerivationOutput(*store, drvPaths[N], "out", nullptr, queryRealisation);
+
+    ASSERT_TRUE(result);
+
+    int totalCalls = 0;
+    for (auto & [path, count] : callCounts) {
+        totalCalls += count;
+        if (count > 1)
+            ADD_FAILURE() << "Derivation at " << store->printStorePath(path) << " was queried " << count
+                          << " times (expected 1)";
+    }
+
+    // With full memoization (ResolveCache + RealisationCache), each derivation should be queried exactly once.
+    EXPECT_EQ(totalCalls, N + 1) << "queryRealisation called " << totalCalls << " times; expected exactly " << (N + 1);
+}
+
+} // namespace nix
diff --git a/src/libstore-tests/outputs-spec.cc b/src/libstore-tests/outputs-spec.cc
index d791709ac258..ae0bb1789b2b 100644
--- a/src/libstore-tests/outputs-spec.cc
+++ b/src/libstore-tests/outputs-spec.cc
@@ -268,13 +268,9 @@ INSTANTIATE_TEST_SUITE_P(
 
 #undef TEST_JSON
 
-#ifndef COVERAGE
-
 RC_GTEST_PROP(OutputsSpec, prop_round_rip, (const OutputsSpec & o))
 {
     RC_ASSERT(o == OutputsSpec::parse(o.to_string()));
 }
 
-#endif
-
 } // namespace nix
diff --git a/src/libstore-tests/path.cc b/src/libstore-tests/path.cc
index eb860a34dab1..65755b7f9645 100644
--- a/src/libstore-tests/path.cc
+++ b/src/libstore-tests/path.cc
@@ -86,8 +86,6 @@ TEST_DO_PARSE(triple_dot, "...")
 
 #undef TEST_DO_PARSE
 
-#ifndef COVERAGE
-
 RC_GTEST_FIXTURE_PROP(StorePathTest, prop_regex_accept, (const StorePath & p))
 {
     RC_ASSERT(std::regex_match(std::string{p.name()}, nameRegex));
@@ -141,8 +139,6 @@ RC_GTEST_FIXTURE_PROP(StorePathTest, prop_check_regex_eq_parse, ())
     RC_ASSERT(parsed == std::regex_match(std::string{name}, nameRegex));
 }
 
-#endif
-
 /* ----------------------------------------------------------------------------
  * JSON
  * --------------------------------------------------------------------------*/
diff --git a/src/libstore-tests/references.cc b/src/libstore-tests/references.cc
index f2c6fb51e5ca..69b89b1460ee 100644
--- a/src/libstore-tests/references.cc
+++ b/src/libstore-tests/references.cc
@@ -4,6 +4,9 @@
 
 #include <gtest/gtest.h>
 
+#include <random>
+#include <set>
+
 namespace nix {
 
 struct RewriteParams
@@ -43,6 +46,100 @@ INSTANTIATE_TEST_CASE_P(
         RewriteParams{"foooo", "bazoo", {{"fou", "bar"}, {"foo", "baz"}}},
         RewriteParams{"foooo", "foooo", {}}));
 
+TEST(references, rewritingSinkChunking)
+{
+    std::mt19937 rng(42);
+
+    /* Build a set of rewrites. Keys are random [a-z] strings of random
+       length in [8, 32]; values are same-length [A-Z] strings so a
+       replacement never produces a new match for any key. We also skip
+       any key that would be a substring of (or have as a substring) an
+       existing key, so that inserting one key into the input cannot also
+       produce a match for a different key. */
+    StringMap rewrites;
+    std::vector<std::string> keys;
+    {
+        std::uniform_int_distribution<int> lowerDist('a', 'z');
+        std::uniform_int_distribution<int> upperDist('A', 'Z');
+        std::uniform_int_distribution<size_t> lenDist(8, 32);
+
+        while (rewrites.size() < 8) {
+            std::string from(lenDist(rng), '\0');
+            for (auto & c : from)
+                c = lowerDist(rng);
+            if (rewrites.count(from))
+                continue;
+            bool overlap = false;
+            for (auto & other : keys)
+                if (from.find(other) != std::string::npos || other.find(from) != std::string::npos) {
+                    overlap = true;
+                    break;
+                }
+            if (overlap)
+                continue;
+            std::string to(from.size(), '\0');
+            for (auto & c : to)
+                c = upperDist(rng);
+            rewrites[from] = to;
+            keys.push_back(from);
+        }
+    }
+
+    /* Build a ~1 MB input mixing rewrite keys with [0-9] digits. Always
+       emit at least one digit between two consecutive keys so adjacency
+       cannot create spurious matches at key boundaries. Compute the
+       expected output string and matches vector at the same time. */
+    std::string input;
+    std::string expectedOutput;
+    std::set<uint64_t> expectedMatches;
+    input.reserve(1'000'000);
+    expectedOutput.reserve(1'000'000);
+    {
+        std::uniform_int_distribution<int> digitDist('0', '9');
+        std::uniform_int_distribution<size_t> keyDist(0, keys.size() - 1);
+        std::bernoulli_distribution useKeyDist(0.2);
+        bool justInsertedKey = false;
+
+        while (input.size() < 1'000'000) {
+            if (useKeyDist(rng) && !justInsertedKey) {
+                const auto & from = keys[keyDist(rng)];
+                expectedMatches.insert(input.size());
+                expectedOutput += rewrites.at(from);
+                input += from;
+                justInsertedKey = true;
+            } else {
+                char d = static_cast<char>(digitDist(rng));
+                input.push_back(d);
+                expectedOutput.push_back(d);
+                justInsertedKey = false;
+            }
+        }
+    }
+
+    StringSink singleOut;
+    RewritingSink singleSink(rewrites, singleOut);
+    singleSink(input);
+    singleSink.flush();
+
+    StringSink chunkedOut;
+    RewritingSink chunkedSink(rewrites, chunkedOut);
+    {
+        std::uniform_int_distribution<size_t> chunkDist(1, 128);
+        std::string_view remaining(input);
+        while (!remaining.empty()) {
+            auto n = std::min(chunkDist(rng), remaining.size());
+            chunkedSink(remaining.substr(0, n));
+            remaining = remaining.substr(n);
+        }
+    }
+    chunkedSink.flush();
+
+    ASSERT_EQ(singleOut.s, expectedOutput);
+    ASSERT_EQ(chunkedOut.s, expectedOutput);
+    ASSERT_EQ(singleSink.matches, expectedMatches);
+    ASSERT_EQ(chunkedSink.matches, expectedMatches);
+}
+
 TEST(references, scan)
 {
     std::string hash1 = "dc04vv14dak1c1r48qa0m23vr9jy8sm0";
diff --git a/src/libstore-tests/register-valid-paths-bench.cc b/src/libstore-tests/register-valid-paths-bench.cc
index 51bcb29aa903..5126f243a5b2 100644
--- a/src/libstore-tests/register-valid-paths-bench.cc
+++ b/src/libstore-tests/register-valid-paths-bench.cc
@@ -22,7 +22,7 @@ static void BM_RegisterValidPathsDerivations(benchmark::State & state)
 
         auto tmpRoot = createTempDir();
         auto realStoreDir = tmpRoot / "nix/store";
-        std::filesystem::create_directories(realStoreDir);
+        createDirs(realStoreDir);
 
         std::shared_ptr<Store> store = openStore(fmt("local?root=%s", tmpRoot.string()));
         auto localStore = std::dynamic_pointer_cast<LocalStore>(store);
@@ -34,12 +34,13 @@ static void BM_RegisterValidPathsDerivations(benchmark::State & state)
             std::string drvName = fmt("register-valid-paths-bench-%d", i);
             auto drvPath = StorePath::random(drvName + ".drv");
 
-            Derivation drv;
-            drv.name = drvName;
-            drv.outputs.emplace("out", DerivationOutput{DerivationOutput::Deferred{}});
-            drv.platform = "x86_64-linux";
-            drv.builder = "foo";
-            drv.env["out"] = "";
+            Derivation drv{
+                .outputs = {{"out", DerivationOutput{DerivationOutput::Deferred{}}}},
+                .platform = "x86_64-linux",
+                .builder = "foo",
+                .env = {{"out", ""}},
+                .name = drvName,
+            };
             drv.fillInOutputPaths(*localStore);
 
             auto drvContents = drv.unparse(*localStore, /*maskOutputs=*/false);
@@ -66,7 +67,7 @@ static void BM_RegisterValidPathsDerivations(benchmark::State & state)
         state.PauseTiming();
         localStore.reset();
         store.reset();
-        std::filesystem::remove_all(tmpRoot);
+        deletePath(tmpRoot);
         state.ResumeTiming();
     }
 
diff --git a/src/libstore-tests/worker-substitution.cc b/src/libstore-tests/worker-substitution.cc
index 3534d44d0d8f..29a7e3a8320d 100644
--- a/src/libstore-tests/worker-substitution.cc
+++ b/src/libstore-tests/worker-substitution.cc
@@ -179,16 +179,17 @@ TEST_F(WorkerSubstitutionTest, floatingDerivationOutput)
     EnableExperimentalFeature enableCA{"ca-derivations"};
 
     // Create a CA floating output derivation
-    Derivation drv;
-    drv.name = "test-ca-drv";
-    drv.outputs = {
-        {
-            "out",
-            DerivationOutput{DerivationOutput::CAFloating{
-                .method = ContentAddressMethod::Raw::NixArchive,
-                .hashAlgo = HashAlgorithm::SHA256,
-            }},
+    Derivation drv{
+        .outputs{
+            {
+                "out",
+                DerivationOutput{DerivationOutput::CAFloating{
+                    .method = ContentAddressMethod::Raw::NixArchive,
+                    .hashAlgo = HashAlgorithm::SHA256,
+                }},
+            },
         },
+        .name = "test-ca-drv",
     };
 
     // Write the derivation to the destination store
@@ -317,19 +318,20 @@ TEST_F(WorkerSubstitutionTest, floatingDerivationOutputWithDepDrv)
         });
 
     // Create the root CA floating derivation that depends on depDrv
-    Derivation rootDrv;
-    rootDrv.name = "root-drv";
-    rootDrv.outputs = {
-        {
-            "out",
-            DerivationOutput{DerivationOutput::CAFloating{
-                .method = ContentAddressMethod::Raw::NixArchive,
-                .hashAlgo = HashAlgorithm::SHA256,
-            }},
+    Derivation rootDrv{
+        .outputs{
+            {
+                "out",
+                DerivationOutput{DerivationOutput::CAFloating{
+                    .method = ContentAddressMethod::Raw::NixArchive,
+                    .hashAlgo = HashAlgorithm::SHA256,
+                }},
+            },
         },
+        // Add the dependency derivation as an input
+        .inputs = {.drvs = {.map = {{depDrvPath, {.value = {"out"}}}}}},
+        .name = "root-drv",
     };
-    // Add the dependency derivation as an input
-    rootDrv.inputDrvs = {.map = {{depDrvPath, {.value = {"out"}}}}};
 
     // Write the root derivation to the destination store
     auto rootDrvPath = dummyStore->writeDerivation(rootDrv);
@@ -345,7 +347,7 @@ TEST_F(WorkerSubstitutionTest, floatingDerivationOutputWithDepDrv)
     ASSERT_TRUE(resolvedRootDrv);
 
     // Write the resolved derivation to the substituter
-    auto resolvedRootDrvPath = substituter->writeDerivation(Derivation{*resolvedRootDrv});
+    auto resolvedRootDrvPath = substituter->writeDerivation(resolvedRootDrv->unresolve());
 
     // Snapshot the destination store before
     checkpointJson("issue-11928/store-before", dummyStore);
diff --git a/src/libstore-tests/write-derivation.cc b/src/libstore-tests/write-derivation.cc
index 43060cb697b8..65b475387b54 100644
--- a/src/libstore-tests/write-derivation.cc
+++ b/src/libstore-tests/write-derivation.cc
@@ -31,15 +31,13 @@ class WriteDerivationTest : public LibStoreTest
 
 TEST_F(WriteDerivationTest, addToStoreFromDumpCalledOnce)
 {
-    auto drv = []() {
-        Derivation drv;
-        drv.name = "simple-derivation";
-        drv.platform = "system";
-        drv.builder = "foo";
-        drv.args = {"bar", "baz"};
-        drv.env = StringPairs{{"BIG_BAD", "WOLF"}};
-        return drv;
-    }();
+    Derivation drv{
+        .platform = "system",
+        .builder = "foo",
+        .args = {"bar", "baz"},
+        .env = {{"BIG_BAD", "WOLF"}},
+        .name = "simple-derivation",
+    };
 
     auto path1 = store->writeDerivation(drv, NoRepair);
     config->readOnly = true;
diff --git a/src/libstore/aws-creds.cc b/src/libstore/aws-creds.cc
index f755717eb531..e4a909a4a554 100644
--- a/src/libstore/aws-creds.cc
+++ b/src/libstore/aws-creds.cc
@@ -28,12 +28,16 @@
 
 namespace nix {
 
+void AwsAuthError::anchor() {}
+
 AwsAuthError::AwsAuthError(int errorCode)
     : CloneableError("AWS authentication error: '%s' (%d)", aws_error_str(errorCode), errorCode)
     , errorCode(errorCode)
 {
 }
 
+AwsCredentialProvider::~AwsCredentialProvider() {}
+
 namespace {
 
 /**
@@ -284,8 +288,6 @@ static AwsCredentials getCredentialsFromProvider(std::shared_ptr<Aws::Crt::Auth:
     return fut.get(); // This will throw if set_exception was called
 }
 
-} // anonymous namespace
-
 class AwsCredentialProviderImpl : public AwsCredentialProvider
 {
 public:
@@ -451,6 +453,8 @@ AwsCredentials AwsCredentialProviderImpl::getCredentialsRaw(const std::string &
     return getCredentialsFromProvider(provider);
 }
 
+} // anonymous namespace
+
 ref<AwsCredentialProvider> makeAwsCredentialsProvider()
 {
     return make_ref<AwsCredentialProviderImpl>();
diff --git a/src/libstore/binary-cache-store.cc b/src/libstore/binary-cache-store.cc
index 64fe33536bbd..5294ee7a0330 100644
--- a/src/libstore/binary-cache-store.cc
+++ b/src/libstore/binary-cache-store.cc
@@ -12,16 +12,24 @@
 #include "nix/util/callback.hh"
 #include "nix/util/signals.hh"
 #include "nix/util/archive.hh"
+#include "nix/util/util.hh"
 
 #include <chrono>
 #include <future>
 #include <regex>
 #include <sstream>
+#include <variant>
 
 #include <nlohmann/json.hpp>
 
 namespace nix {
 
+void BinaryCacheStoreConfig::anchor() {}
+
+void BinaryCacheStore::anchor() {}
+
+void NoSuchBinaryCacheFile::anchor() {}
+
 BinaryCacheStore::BinaryCacheStore(Config & config)
     : config{config}
 {
@@ -134,8 +142,7 @@ void BinaryCacheStore::writeNarInfo(ref<NarInfo> narInfo)
             std::shared_ptr<NarInfo>(narInfo));
 }
 
-ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
-    Source & narSource, RepairFlag repair, CheckSigsFlag checkSigs, fun<ValidPathInfo(HashResult)> mkInfo)
+ref<NarInfo> BinaryCacheStore::uploadData(Source & narSource, RepairFlag repair, fun<ValidPathInfo(HashResult)> mkInfo)
 {
     auto fdTemp = createAnonymousTempFile();
 
@@ -165,7 +172,7 @@ ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
 
     auto info = mkInfo(narHashSink.finish());
     auto narInfo = make_ref<NarInfo>(info);
-    narInfo->compression = config.compression.to_string(); // FIXME: Make NarInfo use CompressionAlgo
+    narInfo->compression = config.compression;
     auto [fileHash, fileSize] = fileHashSink.finish();
     narInfo->fileHash = fileHash;
     narInfo->fileSize = fileSize;
@@ -187,19 +194,6 @@ ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
         ((1.0 - (double) fileSize / info.narSize) * 100.0),
         duration);
 
-    /* Verify that all references are valid. This may do some .narinfo
-       reads, but typically they'll already be cached. */
-    for (auto & ref : info.references)
-        try {
-            if (ref != info.path)
-                queryPathInfo(ref);
-        } catch (InvalidPath &) {
-            throw Error(
-                "cannot add '%s' to the binary cache because the reference '%s' is not valid",
-                printStorePath(info.path),
-                printStorePath(ref));
-        }
-
     /* Optionally write a JSON file containing a listing of the
        contents of the NAR. */
     if (config.writeNARListing) {
@@ -280,24 +274,45 @@ ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
     stats.narWriteCompressedBytes += fileSize;
     stats.narWriteCompressionTimeMs += duration;
 
+    return narInfo;
+}
+
+void BinaryCacheStore::uploadNarInfo(ref<NarInfo> narInfo)
+{
+    /* Verify that all references are valid. This may do some .narinfo
+       reads, but typically they'll already be cached. */
+    for (auto & ref : narInfo->references)
+        try {
+            if (ref != narInfo->path)
+                queryPathInfo(ref);
+        } catch (InvalidPath &) {
+            throw Error(
+                "cannot add '%s' to the binary cache because the reference '%s' is not valid",
+                printStorePath(narInfo->path),
+                printStorePath(ref));
+        }
+
     narInfo->sign(*this, signers);
 
     /* Atomically write the NAR info file.*/
     writeNarInfo(narInfo);
 
     stats.narInfoWrite++;
+}
 
+ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
+    Source & narSource, RepairFlag repair, CheckSigsFlag checkSigs, fun<ValidPathInfo(HashResult)> mkInfo)
+{
+    auto narInfo = uploadData(narSource, repair, std::move(mkInfo));
+    uploadNarInfo(narInfo);
     return narInfo;
 }
 
 void BinaryCacheStore::addToStore(
     const ValidPathInfo & info, Source & narSource, RepairFlag repair, CheckSigsFlag checkSigs)
 {
-    if (!repair && isValidPath(info.path)) {
-        // FIXME: copyNAR -> null sink
-        narSource.drain();
+    if (!repair && isValidPath(info.path))
         return;
-    }
 
     addToStoreCommon(narSource, repair, checkSigs, {[&](HashResult nar) {
                          /* FIXME reinstate these, once we can correctly do hash modulo sink as
@@ -308,6 +323,137 @@ void BinaryCacheStore::addToStore(
                      }});
 }
 
+void BinaryCacheStore::addMultipleToStore(
+    PathsSource && pathsToCopy, Activity & act, RepairFlag repair, CheckSigsFlag checkSigs)
+{
+    /* Index the paths to copy by store path so the graph nodes below
+       can look up each path's info (NAR size, references) and source. */
+    std::map<StorePath, std::pair<ValidPathInfo, std::unique_ptr<Source>> *> infosMap;
+    uint64_t bytesExpected = 0;
+    for (auto & item : pathsToCopy) {
+        bytesExpected += item.first.narSize;
+        infosMap.insert_or_assign(item.first.path, &item);
+    }
+    act.setExpected(actCopyPath, bytesExpected);
+
+    std::atomic<size_t> nrDone{0};
+    std::atomic<uint64_t> nrRunning{0};
+    auto showProgress = [&, nrTotal = pathsToCopy.size()]() { act.progress(nrDone, nrTotal, nrRunning); };
+
+    /* The NarInfos produced by uploading the NARs, to be consumed when
+       writing the .narinfo files. Populated by the `UploadNar` nodes
+       and read by the corresponding `UploadNarInfo` nodes. */
+    Sync<std::map<StorePath, ref<NarInfo>>> narInfos_;
+
+    /* The work graph has two kinds of nodes: uploading the NAR for a
+       path (which has no dependencies, since NARs are independent of
+       each other), and uploading the .narinfo for a path (which depends
+       on the corresponding NAR upload and on the .narinfo uploads of all
+       the path's references). Processing the latter in topological order
+       maintains the closure invariant: whenever a .narinfo exists, the
+       .narinfo files of all its references exist as well. */
+    struct UploadNar
+    {
+        StorePath path;
+        uint64_t narSize;
+
+        /* Order NAR uploads by descending size so that the largest
+           (and typically slowest) NARs are started first. */
+        bool operator<(const UploadNar & other) const
+        {
+            return narSize != other.narSize ? narSize > other.narSize : path < other.path;
+        }
+    };
+
+    struct UploadNarInfo
+    {
+        StorePath path;
+
+        bool operator<(const UploadNarInfo & other) const
+        {
+            return path < other.path;
+        }
+    };
+
+    /* `std::variant`'s `operator<` orders by alternative index first, so
+       all `UploadNar` nodes sort (and thus get enqueued) before any
+       `UploadNarInfo` node.
+       TODO: uploading the debug info and NAR listings could be turned into separate graph nodes as well.
+       */
+    using Node = std::variant<UploadNar, UploadNarInfo>;
+
+    std::set<Node> nodes;
+    for (auto & [path, item] : infosMap) {
+        nodes.insert(UploadNar{path, item->first.narSize});
+        nodes.insert(UploadNarInfo{path});
+    }
+
+    processGraph<Node>(
+        nodes,
+
+        [&](const Node & node) -> std::set<Node> {
+            return std::visit(
+                overloaded{
+                    [&](const UploadNar &) -> std::set<Node> {
+                        /* NAR uploads have no dependencies. */
+                        return {};
+                    },
+                    [&](const UploadNarInfo & n) -> std::set<Node> {
+                        std::set<Node> edges;
+                        auto & info = infosMap.at(n.path)->first;
+                        /* Wait for our own NAR to be uploaded ... */
+                        edges.insert(UploadNar{n.path, info.narSize});
+                        /* ... and for the .narinfo files of all
+                           references that are part of this copy (other
+                           references are already valid in the store). */
+                        for (auto & ref : info.references) {
+                            if (ref != n.path && infosMap.count(ref))
+                                edges.insert(UploadNarInfo{ref});
+                        }
+                        return edges;
+                    },
+                },
+                node);
+        },
+
+        [&](const Node & node) {
+            checkInterrupt();
+            std::visit(
+                overloaded{
+                    [&](const UploadNar & n) {
+                        auto & [info, source_] = *infosMap.at(n.path);
+
+                        /* Make sure the Source object is destroyed when
+                           we're done, e.g. to release the connection
+                           lock held by LegacySSHStore::narFromPath(). */
+                        auto source = std::move(source_);
+
+                        if (repair || !isValidPath(info.path)) {
+                            MaintainCount<decltype(nrRunning)> mc(nrRunning);
+                            showProgress();
+                            auto narInfo = uploadData(*source, repair, [&](HashResult nar) {
+                                auto info2 = info;
+                                info2.ultimate = false;
+                                return info2;
+                            });
+                            narInfos_.lock()->insert_or_assign(info.path, narInfo);
+                        }
+
+                        nrDone++;
+                        showProgress();
+                    },
+                    [&](const UploadNarInfo & n) {
+                        auto & info = infosMap.at(n.path)->first;
+                        if (!repair && isValidPath(info.path))
+                            return;
+                        auto narInfo = narInfos_.lock()->at(n.path);
+                        uploadNarInfo(narInfo);
+                    },
+                },
+                node);
+        });
+}
+
 StorePath BinaryCacheStore::addToStoreFromDump(
     Source & dump,
     std::string_view name,
@@ -419,7 +565,13 @@ void BinaryCacheStore::narFromPath(const StorePath & storePath, Sink & sink)
             stats.narReadBytes += narSize;
         }};
 
-    auto decompressor = makeDecompressionSink(info->compression, uncompressedSink);
+    /* makeDecompressionSink used to treat empty strings as "none". It seems
+       impossible that it would actually end up here with an empty string though
+       (since an empty `Compression: ' is treated as bzip2 when parsed from a
+       .narinfo file and the narinfo disk cache wouldn't handle empty strings).
+       TODO: Revisit this and convert to an assert probably or even made
+       compression a non-optional field. */
+    auto decompressor = makeDecompressionSink(info->compression.value_or(CompressionAlgo::none), uncompressedSink);
 
     try {
         getFile(info->url, *decompressor);
diff --git a/src/libstore/build-result.cc b/src/libstore/build-result.cc
index f01911bcd002..7dd6954f607c 100644
--- a/src/libstore/build-result.cc
+++ b/src/libstore/build-result.cc
@@ -4,6 +4,8 @@
 
 namespace nix {
 
+void BuildError::anchor() {}
+
 void ExitStatusFlags::updateFromStatus(BuildResult::Failure::Status status)
 {
 // Allow selecting a subset of enum values
@@ -20,7 +22,7 @@ void ExitStatusFlags::updateFromStatus(BuildResult::Failure::Status status)
         checkMismatch = true;
         break;
     case BuildResult::Failure::PermanentFailure:
-    // Also considered a permenant failure, it seems
+    // Also considered a permanent failure, it seems
     case BuildResult::Failure::InputRejected:
         permanentFailure = true;
         break;
@@ -143,10 +145,10 @@ std::strong_ordering BuildError::operator<=>(const BuildError & other) const noe
 
 namespace nlohmann {
 
-using namespace nix;
-
-void adl_serializer<BuildResult>::to_json(json & res, const BuildResult & br)
+void adl_serializer<nix::BuildResult>::to_json(json & res, const nix::BuildResult & br)
 {
+    using namespace nix;
+
     res = json::object();
 
     // Common fields
@@ -179,8 +181,10 @@ void adl_serializer<BuildResult>::to_json(json & res, const BuildResult & br)
         br.inner);
 }
 
-BuildResult adl_serializer<BuildResult>::from_json(const json & _json)
+nix::BuildResult adl_serializer<nix::BuildResult>::from_json(const json & _json)
 {
+    using namespace nix;
+
     auto & json = getObject(_json);
 
     BuildResult br;
@@ -217,8 +221,10 @@ BuildResult adl_serializer<BuildResult>::from_json(const json & _json)
     return br;
 }
 
-KeyedBuildResult adl_serializer<KeyedBuildResult>::from_json(const json & json0)
+nix::KeyedBuildResult adl_serializer<nix::KeyedBuildResult>::from_json(const json & json0)
 {
+    using namespace nix;
+
     auto json = getObject(json0);
 
     return KeyedBuildResult{
@@ -227,8 +233,9 @@ KeyedBuildResult adl_serializer<KeyedBuildResult>::from_json(const json & json0)
     };
 }
 
-void adl_serializer<KeyedBuildResult>::to_json(json & json, const KeyedBuildResult & kbr)
+void adl_serializer<nix::KeyedBuildResult>::to_json(json & json, const nix::KeyedBuildResult & kbr)
 {
+    using namespace nix;
     adl_serializer<BuildResult>::to_json(json, kbr);
     json["path"] = kbr.path;
 }
diff --git a/src/libstore/build/build-log.cc b/src/libstore/build/build-log.cc
index a8fb64fc68bf..920affe12afe 100644
--- a/src/libstore/build/build-log.cc
+++ b/src/libstore/build/build-log.cc
@@ -10,9 +10,16 @@ BuildLog::BuildLog(size_t maxTailLines, std::unique_ptr<Activity> act)
 
 void BuildLog::operator()(std::string_view data)
 {
-    for (auto c : data)
+    for (auto c : data) {
+        /* Only let a '\r' reset the column if it isn't followed by '\n', so
+           "\r\n" acts as a line terminator; defer a char to handle split chunks. */
+        if (pendingCR) {
+            pendingCR = false;
+            if (c != '\n')
+                currentLogLinePos = 0;
+        }
         if (c == '\r')
-            currentLogLinePos = 0;
+            pendingCR = true;
         else if (c == '\n')
             flushLine();
         else {
@@ -20,6 +27,7 @@ void BuildLog::operator()(std::string_view data)
                 currentLogLine.resize(currentLogLinePos + 1);
             currentLogLine[currentLogLinePos++] = c;
         }
+    }
 }
 
 void BuildLog::flush()
diff --git a/src/libstore/build/derivation-builder.cc b/src/libstore/build/derivation-builder.cc
index 39ac40175f71..a38f7b2bc029 100644
--- a/src/libstore/build/derivation-builder.cc
+++ b/src/libstore/build/derivation-builder.cc
@@ -3,10 +3,9 @@
 
 namespace nlohmann {
 
-using namespace nix;
-
-ExternalBuilder adl_serializer<ExternalBuilder>::from_json(const json & json)
+nix::ExternalBuilder adl_serializer<nix::ExternalBuilder>::from_json(const json & json)
 {
+    using namespace nix;
     auto obj = getObject(json);
     return {
         .systems = valueAt(obj, "systems"),
@@ -15,7 +14,7 @@ ExternalBuilder adl_serializer<ExternalBuilder>::from_json(const json & json)
     };
 }
 
-void adl_serializer<ExternalBuilder>::to_json(json & json, const ExternalBuilder & eb)
+void adl_serializer<nix::ExternalBuilder>::to_json(json & json, const nix::ExternalBuilder & eb)
 {
     json = {
         {"systems", eb.systems},
@@ -25,3 +24,13 @@ void adl_serializer<ExternalBuilder>::to_json(json & json, const ExternalBuilder
 }
 
 } // namespace nlohmann
+
+namespace nix {
+
+void BuilderFailureError::anchor() {}
+
+void DerivationBuilder::anchor() {}
+
+DerivationBuilderCallbacks::~DerivationBuilderCallbacks() {}
+
+} // namespace nix
diff --git a/src/libstore/build/derivation-building-goal.cc b/src/libstore/build/derivation-building-goal.cc
index 57a4017e8e24..e239dff8e203 100644
--- a/src/libstore/build/derivation-building-goal.cc
+++ b/src/libstore/build/derivation-building-goal.cc
@@ -1,5 +1,7 @@
 #include "nix/store/build/derivation-building-goal.hh"
 #include "nix/store/build/derivation-env-desugar.hh"
+#include "nix/store/restricted-store.hh"
+#include "nix/store/daemon.hh"
 #ifndef _WIN32 // TODO enable build hook on Windows
 #  include "nix/store/build/hook-instance.hh"
 #  include "nix/store/build/derivation-builder.hh"
@@ -30,8 +32,8 @@
 namespace nix {
 
 DerivationBuildingGoal::DerivationBuildingGoal(
-    const StorePath & drvPath, ref<const Derivation> drv, Worker & worker, BuildMode buildMode, bool storeDerivation)
-    : Goal(worker, gaveUpOnSubstitution(storeDerivation))
+    const StorePath & drvPath, ref<const BasicDerivation> drv, Worker & worker, BuildMode buildMode)
+    : Goal(worker, gaveUpOnSubstitution())
     , drvPath(drvPath)
     , drv{std::move(drv)}
     , buildMode(buildMode)
@@ -51,7 +53,8 @@ std::string DerivationBuildingGoal::key()
     return "dd$" + std::string(drvPath.name()) + "$" + worker.store.printStorePath(drvPath);
 }
 
-std::string showKnownOutputs(const StoreDirConfig & store, const Derivation & drv)
+template<typename InputsType>
+std::string showKnownOutputs(const StoreDirConfig & store, const DerivationT<InputsType> & drv)
 {
     std::string msg;
     StorePathSet expectedOutputPaths;
@@ -66,6 +69,11 @@ std::string showKnownOutputs(const StoreDirConfig & store, const Derivation & dr
     return msg;
 }
 
+template std::string showKnownOutputs(const StoreDirConfig & store, const DerivationT<FullInputs> & drv);
+template std::string showKnownOutputs(const StoreDirConfig & store, const DerivationT<StorePathSet> & drv);
+
+namespace {
+
 struct LogSink : Sink
 {
     Activity & act;
@@ -102,6 +110,8 @@ struct LogSink : Sink
     }
 };
 
+} // namespace
+
 struct PostBuildHookState
 {
     const std::string hook;
@@ -140,7 +150,7 @@ static std::unique_ptr<PostBuildHookState> runPostBuildHook(
 
 /* At least one of the output paths could not be
    produced using a substitute.  So we have to build instead. */
-Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution(bool storeDerivation)
+Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution()
 {
     Goals waitees;
 
@@ -151,13 +161,13 @@ Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution(bool storeDerivation)
        are (resolved) derivation outputs in a resolved derivation. */
     if (&worker.evalStore != &worker.store) {
         RealisedPath::Set inputSrcs;
-        for (auto & i : drv->inputSrcs)
+        for (auto & i : drv->inputs)
             if (worker.evalStore.isValidPath(i))
                 inputSrcs.insert(i);
         copyClosure(worker.evalStore, worker.store, inputSrcs);
     }
 
-    for (auto & i : drv->inputSrcs) {
+    for (auto & i : drv->inputs) {
         if (worker.store.isValidPath(i))
             continue;
         if (!worker.settings.useSubstitutes)
@@ -188,47 +198,8 @@ Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution(bool storeDerivation)
 
     /* Determine the full set of input paths. */
 
-    if (storeDerivation) {
-        assert(drv->inputDrvs.map.empty());
-        /* Store the resolved derivation, as part of the record of
-           what we're actually building */
-        worker.store.writeDerivation(*drv);
-    }
-
     StorePathSet inputPaths;
-
-    {
-        /* If we get this far, we know no dynamic drvs inputs */
-
-        for (auto & [depDrvPath, depNode] : drv->inputDrvs.map) {
-            for (auto & outputName : depNode.value) {
-                /* Don't need to worry about `inputGoals`, because
-                   impure derivations are always resolved above. Can
-                   just use DB. This case only happens in the (older)
-                   input addressed and fixed output derivation cases. */
-                auto outMap = [&] {
-                    for (auto * drvStore : {&worker.evalStore, &worker.store})
-                        if (drvStore->isValidPath(depDrvPath))
-                            return deepQueryDerivationOutputMap(worker.store, depDrvPath, drvStore);
-                    assert(false);
-                }();
-
-                auto outMapPath = outMap.find(outputName);
-                if (outMapPath == outMap.end()) {
-                    throw Error(
-                        "derivation '%s' requires non-existent output '%s' from input derivation '%s'",
-                        worker.store.printStorePath(drvPath),
-                        outputName,
-                        worker.store.printStorePath(depDrvPath));
-                }
-
-                worker.store.computeFSClosure(outMapPath->second, inputPaths);
-            }
-        }
-    }
-
-    /* Second, the input sources. */
-    worker.store.computeFSClosure(drv->inputSrcs, inputPaths);
+    worker.store.computeFSClosure(drv->inputs, inputPaths);
 
     debug("added input paths %s", concatMapStringsSep(", ", inputPaths, [&](auto & p) {
               return "'" + worker.store.printStorePath(p) + "'";
@@ -333,35 +304,12 @@ static BuildError reject(const LocalBuildRejection & rejection, std::string_view
 Goal::Co DerivationBuildingGoal::tryToBuild(StorePathSet inputPaths)
 {
     auto drvOptions = [&] {
-        DerivationOptions<SingleDerivedPath> temp;
         try {
-            temp =
-                derivationOptionsFromStructuredAttrs(worker.store, drv->inputDrvs, drv->env, get(drv->structuredAttrs));
+            return derivationOptionsFromStructuredAttrs(worker.store, drv->env, get(drv->structuredAttrs));
         } catch (Error & e) {
             e.addTrace({}, "while parsing derivation '%s'", worker.store.printStorePath(drvPath));
             throw;
         }
-
-        auto res = tryResolve(
-            temp,
-            [&](ref<const SingleDerivedPath> drvPath, const std::string & outputName) -> std::optional<StorePath> {
-                try {
-                    return resolveDerivedPath(
-                        worker.store, SingleDerivedPath::Built{drvPath, outputName}, &worker.evalStore);
-                } catch (Error &) {
-                    return std::nullopt;
-                }
-            });
-
-        /* The derivation must have all of its inputs gotten this point,
-           so the resolution will surely succeed.
-
-           (Actually, we shouldn't even enter this goal until we have a
-           resolved derivation, or derivation with only input addressed
-           transitive inputs, so this should be a no-opt anyways.)
-         */
-        assert(res);
-        return *res;
     }();
 
     std::map<std::string, InitialOutput> initialOutputs;
@@ -651,12 +599,14 @@ Goal::Co DerivationBuildingGoal::buildWithHook(
        destroyed (e.g., during failure cascades). */
     hook->onKillChild = [this]() { worker.childTerminated(this, JobCategory::Build); };
 
-    try {
-        hook->machineName = readLine(hook->fromHook.readSide.get());
-    } catch (Error & e) {
-        e.addTrace({}, "while reading the machine name from the build hook");
-        throw;
-    }
+    std::string machineName = [&hook]() {
+        try {
+            return readLine(hook->fromHook.readSide.get());
+        } catch (Error & e) {
+            e.addTrace({}, "while reading the machine name from the build hook");
+            throw;
+        }
+    }();
 
     CommonProto::WriteConn conn{hook->sink};
 
@@ -695,16 +645,12 @@ Goal::Co DerivationBuildingGoal::buildWithHook(
             : buildMode == bmCheck ? "checking outputs of '%s'"
                                    : "building '%s'",
             worker.store.printStorePath(drvPath));
-    msg += fmt(" on '%s'", hook->machineName);
+    msg += fmt(" on '%s'", machineName);
 
     std::unique_ptr<BuildLog> buildLog = std::make_unique<BuildLog>(
         worker.settings.logLines,
         std::make_unique<Activity>(
-            *logger,
-            lvlInfo,
-            actBuild,
-            msg,
-            Logger::Fields{worker.store.printStorePath(drvPath), hook->machineName, 1, 1}));
+            *logger, lvlInfo, actBuild, msg, Logger::Fields{worker.store.printStorePath(drvPath), machineName, 1, 1}));
     mcRunningBuilds = std::make_unique<MaintainCount<uint64_t>>(worker.runningBuilds);
     worker.updateProgress();
 
@@ -764,9 +710,9 @@ Goal::Co DerivationBuildingGoal::buildWithHook(
         } else if (std::get_if<ChildEOF>(&event)) {
             buildLog->flush();
             break;
-        } else if (auto * timeout = std::get_if<TimedOut>(&event)) {
+        } else if (auto * timeout = std::get_if<std::unique_ptr<TimedOut>>(&event)) {
             hook.reset();
-            co_return doneFailure(std::move(*timeout));
+            co_return doneFailure(std::move(**timeout));
         }
     }
 
@@ -938,6 +884,26 @@ Goal::Co DerivationBuildingGoal::buildLocally(
                 {
                     closeLogFileFn();
                 }
+
+                void processDaemonConnection(
+                    ref<Store> store,
+                    FdSource && from,
+                    FdSink && to,
+                    RestrictionContext & context,
+                    daemon::RecursiveFlag recursiveFlag) override
+                {
+                    /**
+                     * TODO: We create a fresh Worker here because the
+                     * parent Worker is blocked waiting for the current
+                     * build to finish, so we can't reuse it from a
+                     * daemon thread. Ideally we should reuse the same
+                     * Worker to share scheduling state.
+                     */
+                    Worker freshWorker{goal.worker.store, goal.worker.evalStore};
+                    auto builder = makeRestrictedBuilder(freshWorker, context);
+                    daemon::processConnection(
+                        store, std::move(from), std::move(to), NotTrusted, recursiveFlag, builder.get_ptr());
+                }
             };
 
             decltype(DerivationBuilderParams::defaultPathsInChroot) defaultPathsInChroot =
@@ -986,12 +952,12 @@ Goal::Co DerivationBuildingGoal::buildLocally(
             builder = localBuildCap.externalBuilder
                           ? makeExternalDerivationBuilder(
                                 localBuildCap.localStore,
-                                std::make_unique<DerivationBuildingGoalCallbacks>(*this, openLogFile, closeLogFile),
+                                std::make_shared<DerivationBuildingGoalCallbacks>(*this, openLogFile, closeLogFile),
                                 std::move(params),
                                 *localBuildCap.externalBuilder)
                           : makeDerivationBuilder(
                                 localBuildCap.localStore,
-                                std::make_unique<DerivationBuildingGoalCallbacks>(*this, openLogFile, closeLogFile),
+                                std::make_shared<DerivationBuildingGoalCallbacks>(*this, openLogFile, closeLogFile),
                                 std::move(params));
         }
 
@@ -1035,9 +1001,9 @@ Goal::Co DerivationBuildingGoal::buildLocally(
         } else if (std::get_if<ChildEOF>(&event)) {
             buildLog->flush();
             break;
-        } else if (auto * timeout = std::get_if<TimedOut>(&event)) {
+        } else if (auto * timeout = std::get_if<std::unique_ptr<TimedOut>>(&event)) {
             builder->killChild();
-            co_return doneFailure(std::move(*timeout));
+            co_return doneFailure(std::move(**timeout));
         }
     }
 
@@ -1121,7 +1087,6 @@ static std::unique_ptr<PostBuildHookState> runPostBuildHook(
     hookEnvironment.emplace(OS_STR("NIX_CONFIG"), string_to_os_string(globalConfig.toKeyValue()));
 
     ProcessOptions processOptions;
-    processOptions.allowVfork = false;
 
     state->pid = startProcess(
         [&] {
diff --git a/src/libstore/build/derivation-check.cc b/src/libstore/build/derivation-check.cc
index dffbbc3beb26..d1562e811c7e 100644
--- a/src/libstore/build/derivation-check.cc
+++ b/src/libstore/build/derivation-check.cc
@@ -1,16 +1,88 @@
 #include <queue>
 
+#include "nix/store/derivations.hh"
 #include "nix/store/store-api.hh"
 #include "nix/store/build-result.hh"
+#include "nix/util/hash.hh"
 
 #include "derivation-check.hh"
 
 namespace nix {
 
+void checkCAOutput(
+    StoreDirConfig & store,
+    const StorePath & drvPath,
+    const DerivationOutput & outputSpec,
+    const ValidPathInfo & info,
+    const std::string & outputName)
+{
+    std::visit(
+        overloaded{
+            [&](const DerivationOutput::CAFixed & dof) {
+                auto & wanted = dof.ca.hash;
+
+                /* Check wanted hash */
+                assert(info.ca);
+                auto & got = info.ca->hash;
+                if (wanted != got) {
+                    throw BuildError(
+                        BuildResult::Failure::HashMismatch,
+                        "hash mismatch in fixed-output derivation '%s':\n  specified: %s\n     got:    %s",
+                        store.printStorePath(drvPath),
+                        wanted.to_string(HashFormat::SRI, true),
+                        got.to_string(HashFormat::SRI, true));
+                }
+                if (!info.references.empty()) {
+                    auto numViolations = info.references.size();
+                    throw BuildError(
+                        BuildResult::Failure::HashMismatch,
+                        "fixed-output derivations must not reference store paths: '%s' references %d distinct paths, e.g. '%s'",
+                        store.printStorePath(drvPath),
+                        numViolations,
+                        store.printStorePath(*info.references.begin()));
+                }
+            },
+            [&](const DerivationOutput::CAFloating & dof) {
+                if (!info.ca.has_value()) {
+                    throw BuildError(
+                        BuildResult::Failure::OutputRejected,
+                        "floating content-addressing derivation '%s' output '%s' (at '%s') was not content-addressed",
+                        store.printStorePath(drvPath),
+                        outputName,
+                        store.printStorePath(info.path));
+                }
+                if (info.ca->method != dof.method) {
+                    throw BuildError(
+                        BuildResult::Failure::OutputRejected,
+                        "content-addressing derivation '%s' output '%s' (at '%s') was hashed with method '%s', expected '%s'",
+                        store.printStorePath(drvPath),
+                        outputName,
+                        store.printStorePath(info.path),
+                        info.ca->method.render(),
+                        dof.method.render());
+                }
+                if (info.ca->hash.algo != dof.hashAlgo) {
+                    throw BuildError(
+                        BuildResult::Failure::OutputRejected,
+                        "content-addressing derivation '%s' output '%s' (at '%s') was hashed with algorithm '%s', expected '%s'",
+                        store.printStorePath(drvPath),
+                        outputName,
+                        store.printStorePath(info.path),
+                        printHashAlgo(info.ca->hash.algo),
+                        printHashAlgo(dof.hashAlgo));
+                }
+            },
+            [&](const DerivationOutput::Deferred & _) {},
+            [&](const DerivationOutput::Impure & _) {},
+            [&](const DerivationOutput::InputAddressed & _) {},
+        },
+        outputSpec.raw);
+}
+
 void checkOutputs(
     Store & store,
     const StorePath & drvPath,
-    const decltype(Derivation::outputs) & drvOutputs,
+    const BasicDerivation & drv,
     const decltype(DerivationOptions<StorePath>::outputChecks) & outputChecks,
     const std::map<std::string, ValidPathInfo> & outputs)
 {
@@ -24,36 +96,29 @@ void checkOutputs(
         const std::string & outputName = pair.first;
         const auto & info = pair.second;
 
-        auto * outputSpec = get(drvOutputs, outputName);
-        assert(outputSpec);
-
-        if (const auto * dof = std::get_if<DerivationOutput::CAFixed>(&outputSpec->raw)) {
-            auto & wanted = dof->ca.hash;
+        auto * outputSpec = get(drv.outputs, outputName);
+        if (!outputSpec) {
+            throw BuildError(
+                BuildResult::Failure::OutputRejected,
+                "builder for '%s' submitted unknown output '%s' (Valid outputs are [%s])",
+                store.printStorePath(drvPath),
+                outputName,
+                concatMapStringsSep(", ", outputs, [](auto & o) { return o.first; }));
+        }
 
-            /* Check wanted hash */
-            assert(info.ca);
-            auto & got = info.ca->hash;
-            if (wanted != got) {
-                /* Throw an error after registering the path as
-                   valid. */
-                throw BuildError(
-                    BuildResult::Failure::HashMismatch,
-                    "hash mismatch in fixed-output derivation '%s':\n  specified: %s\n     got:    %s",
-                    store.printStorePath(drvPath),
-                    wanted.to_string(HashFormat::SRI, true),
-                    got.to_string(HashFormat::SRI, true));
-            }
-            if (!info.references.empty()) {
-                auto numViolations = info.references.size();
-                throw BuildError(
-                    BuildResult::Failure::HashMismatch,
-                    "fixed-output derivations must not reference store paths: '%s' references %d distinct paths, e.g. '%s'",
-                    store.printStorePath(drvPath),
-                    numViolations,
-                    store.printStorePath(*info.references.begin()));
-            }
+        if (outputPathName(drv.name, outputName) != info.path.name()) {
+            throw BuildError(
+                BuildResult::Failure::OutputRejected,
+                "derivation '%s' output '%s' (at '%s') was named '%s', expected '%s'",
+                store.printStorePath(drvPath),
+                outputName,
+                store.printStorePath(info.path),
+                info.path.name(),
+                outputPathName(drv.name, outputName));
         }
 
+        checkCAOutput(store, drvPath, *outputSpec, info, outputName);
+
         /* Compute the closure and closure size of some output. This
            is slightly tricky because some of its references (namely
            other outputs) may not be valid yet. */
@@ -118,8 +183,6 @@ void checkOutputs(
                                 if (auto output = get(outputs, refOutputName))
                                     spec.insert(output->path);
                                 else {
-                                    std::string outputsListing =
-                                        concatMapStringsSep(", ", outputs, [](auto & o) { return o.first; });
                                     throw BuildError(
                                         BuildResult::Failure::OutputRejected,
                                         "derivation '%s' output check for '%s' contains output name '%s',"
@@ -128,7 +191,7 @@ void checkOutputs(
                                         store.printStorePath(drvPath),
                                         outputName,
                                         refOutputName,
-                                        outputsListing);
+                                        concatMapStringsSep(", ", outputs, [](auto & o) { return o.first; }));
                                 }
                             }},
                         i);
diff --git a/src/libstore/build/derivation-check.hh b/src/libstore/build/derivation-check.hh
index 01e6c5d56383..5c8c75da172d 100644
--- a/src/libstore/build/derivation-check.hh
+++ b/src/libstore/build/derivation-check.hh
@@ -7,6 +7,18 @@
 
 namespace nix {
 
+/**
+ * If outputSpec is a CAFixed or CAFloating output, check that the actual output described in
+ * info meets the requirements for a CA output.
+ * Do nothing if outputSpec is not a CAFixed or CAFloating output.
+ */
+void checkCAOutput(
+    StoreDirConfig & store,
+    const StorePath & drvPath,
+    const DerivationOutput & outputSpec,
+    const ValidPathInfo & info,
+    const std::string & outputName);
+
 /**
  * Check that outputs meets the requirements specified by the
  * 'outputChecks' attribute (or the legacy
@@ -20,7 +32,7 @@ namespace nix {
 void checkOutputs(
     Store & store,
     const StorePath & drvPath,
-    const decltype(Derivation::outputs) & drvOutputs,
+    const BasicDerivation & drv,
     const decltype(DerivationOptions<StorePath>::outputChecks) & drvOptions,
     const std::map<std::string, ValidPathInfo> & outputs);
 
diff --git a/src/libstore/build/derivation-env-desugar.cc b/src/libstore/build/derivation-env-desugar.cc
index 75b62c116502..ff19472d0122 100644
--- a/src/libstore/build/derivation-env-desugar.cc
+++ b/src/libstore/build/derivation-env-desugar.cc
@@ -19,7 +19,7 @@ std::string & DesugaredEnv::atFileEnvPair(std::string_view name, std::string fil
 
 DesugaredEnv DesugaredEnv::create(
     Store & store,
-    const Derivation & drv,
+    const BasicDerivation & drv,
     const DerivationOptions<StorePath> & drvOptions,
     const StorePathSet & inputPaths)
 {
diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 6e2d3223b10f..19281191cc7f 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -52,7 +52,7 @@ Goal::Co DerivationGoal::haveDerivation(bool storeDerivation)
     auto drvOptions = [&]() -> DerivationOptions<SingleDerivedPath> {
         try {
             return derivationOptionsFromStructuredAttrs(
-                worker.store, drv->inputDrvs, drv->env, get(drv->structuredAttrs));
+                worker.store, drv->inputs.drvs, drv->env, get(drv->structuredAttrs));
         } catch (Error & e) {
             e.addTrace({}, "while parsing derivation '%s'", worker.store.printStorePath(drvPath));
             throw;
@@ -92,6 +92,8 @@ Goal::Co DerivationGoal::haveDerivation(bool storeDerivation)
                 co_await await(std::move(waitees));
 
                 if (nrFailed == 0) {
+                    // optimization depending on moved containers being empty afterwards
+                    // NOLINTNEXTLINE(bugprone-use-after-move)
                     waitees.insert(upcast_goal(worker.makePathSubstitutionGoal(g->outputInfo->outPath)));
                     co_await await(std::move(waitees));
 
@@ -111,6 +113,8 @@ Goal::Co DerivationGoal::haveDerivation(bool storeDerivation)
             }
         }
 
+        // optimization depending on moved containers being empty afterwards
+        // NOLINTNEXTLINE(bugprone-use-after-move)
         co_await await(std::move(waitees));
 
         trace("all outputs substituted (maybe)");
@@ -144,13 +148,15 @@ Goal::Co DerivationGoal::haveDerivation(bool storeDerivation)
                 worker.store.printStorePath(drvPath));
     }
 
-    auto resolutionGoal = worker.makeDerivationResolutionGoal(drvPath, *drv, buildMode);
-    {
-        Goals waitees{resolutionGoal};
-        co_await await(std::move(waitees));
-    }
+    auto resolutionGoal = worker.makeDerivationResolutionGoal(drvPath, drv, buildMode);
+    /* We'll handle the error below. */
+    resolutionGoal->preserveFailure = true;
+    co_await await({resolutionGoal});
+
     if (nrFailed != 0) {
-        co_return doneFailure({BuildResult::Failure::DependencyFailed, "Build failed due to failed dependency"});
+        auto * failure = resolutionGoal->buildResult.tryGetFailure();
+        assert(failure);
+        co_return doneFailure(*failure);
     }
 
     if (resolutionGoal->resolvedDrv) {
@@ -158,7 +164,7 @@ Goal::Co DerivationGoal::haveDerivation(bool storeDerivation)
 
         auto resolvedDrvGoal = worker.makeDerivationGoal(
             pathResolved,
-            make_ref<const Derivation>(drvResolved),
+            make_ref<const Derivation>(drvResolved.unresolve()),
             wantedOutput,
             buildMode,
             /*storeDerivation=*/true);
@@ -219,18 +225,64 @@ Goal::Co DerivationGoal::haveDerivation(bool storeDerivation)
             assert(false);
     }
 
+    /* We don't need it any more and don't want to hold on to it while suspended. */
+    resolutionGoal.reset();
+
     /* Give up on substitution for the output we want, actually build this derivation */
 
-    auto g = worker.makeDerivationBuildingGoal(drvPath, drv, buildMode, storeDerivation);
+    /* Project down to the `BasicDerivation` the builder consumes,
+       adding the outputs of the input derivations to the input
+       sources. */
+    auto resolvedDrv = make_ref<const BasicDerivation>(drv->mapInputs([&](const FullInputs & inputs) {
+        auto srcs = inputs.srcs;
+        for (auto & [depDrvPath, depNode] : inputs.drvs.map) {
+            for (auto & outputName : depNode.value) {
+                /* Don't need to worry about `inputGoals`, because
+                   impure derivations are always resolved above. Can
+                   just use DB. This case only happens in the (older)
+                   input addressed and fixed output derivation cases. */
+                auto outMap = [&] {
+                    for (auto * drvStore : {&worker.evalStore, &worker.store})
+                        if (drvStore->isValidPath(depDrvPath))
+                            return deepQueryDerivationOutputMap(worker.store, depDrvPath, drvStore);
+                    assert(false);
+                }();
+                auto outMapPath = outMap.find(outputName);
+                if (outMapPath == outMap.end()) {
+                    throw Error(
+                        "derivation '%s' requires non-existent output '%s' from input derivation '%s'",
+                        worker.store.printStorePath(drvPath),
+                        outputName,
+                        worker.store.printStorePath(depDrvPath));
+                }
+                srcs.insert(outMapPath->second);
+            }
+        }
+        return srcs;
+    }));
+
+    if (storeDerivation) {
+        assert(drv->inputs.drvs.map.empty());
+        /* `writeDerivation` checks the derivation's references are valid,
+           so the eval store's sources must be copied over first. */
+        if (&worker.evalStore != &worker.store) {
+            RealisedPath::Set inputSrcs;
+            for (auto & i : resolvedDrv->inputs)
+                if (worker.evalStore.isValidPath(i))
+                    inputSrcs.insert(i);
+            copyClosure(worker.evalStore, worker.store, inputSrcs);
+        }
+        /* Store the resolved derivation, as part of the record of
+           what we're actually building */
+        worker.store.writeDerivation(resolvedDrv->unresolve());
+    }
+
+    auto g = worker.makeDerivationBuildingGoal(drvPath, resolvedDrv, buildMode);
 
     /* We will finish with it ourselves, as if we were the derivational goal. */
     g->preserveFailure = true;
 
-    {
-        Goals waitees;
-        waitees.insert(g);
-        co_await await(std::move(waitees));
-    }
+    co_await await({g});
 
     trace("outer build done");
 
diff --git a/src/libstore/build/derivation-resolution-goal.cc b/src/libstore/build/derivation-resolution-goal.cc
index 81c698e18563..eac55a2e8f3f 100644
--- a/src/libstore/build/derivation-resolution-goal.cc
+++ b/src/libstore/build/derivation-resolution-goal.cc
@@ -7,10 +7,10 @@
 namespace nix {
 
 DerivationResolutionGoal::DerivationResolutionGoal(
-    const StorePath & drvPath, const Derivation & drv, Worker & worker, BuildMode buildMode)
+    const StorePath & drvPath, ref<const Derivation> drv, Worker & worker, BuildMode buildMode)
     : Goal(worker, resolveDerivation())
     , drvPath(drvPath)
-    , drv{std::make_unique<Derivation>(drv)}
+    , drv(std::move(drv))
     , buildMode{buildMode}
 {
     name = fmt("resolving derivation '%s'", worker.store.printStorePath(drvPath));
@@ -22,60 +22,49 @@ std::string DerivationResolutionGoal::key()
     return "dc$" + std::string(drvPath.name()) + "$" + worker.store.printStorePath(drvPath);
 }
 
-/**
- * Used for `inputGoals` local variable below
- */
-struct value_comparison
-{
-    template<typename T>
-    bool operator()(const ref<T> & lhs, const ref<T> & rhs) const
-    {
-        return *lhs < *rhs;
-    }
-};
-
 Goal::Co DerivationResolutionGoal::resolveDerivation()
 {
     Goals waitees;
 
-    std::map<ref<const SingleDerivedPath>, GoalPtr, value_comparison> inputGoals;
-
-    {
-        std::function<void(ref<const SingleDerivedPath>, const DerivedPathMap<StringSet>::ChildNode &)>
-            addWaiteeDerivedPath;
-
-        addWaiteeDerivedPath = [&](ref<const SingleDerivedPath> inputDrv,
-                                   const DerivedPathMap<StringSet>::ChildNode & inputNode) {
-            if (!inputNode.value.empty()) {
-                auto g = worker.makeGoal(
-                    DerivedPath::Built{
-                        .drvPath = inputDrv,
-                        .outputs = inputNode.value,
-                    },
-                    buildMode == bmRepair ? bmRepair : bmNormal);
-                inputGoals.insert_or_assign(inputDrv, g);
-                waitees.insert(std::move(g));
-            }
-            for (const auto & [outputName, childNode] : inputNode.childMap)
-                addWaiteeDerivedPath(
-                    make_ref<SingleDerivedPath>(SingleDerivedPath::Built{inputDrv, outputName}), childNode);
-        };
-
-        for (const auto & [inputDrvPath, inputNode] : drv->inputDrvs.map) {
-            /* Ensure that pure, non-fixed-output derivations don't
-               depend on impure derivations. */
-            if (experimentalFeatureSettings.isEnabled(Xp::ImpureDerivations) && !drv->type().isImpure()
-                && !drv->type().isFixed()) {
-                auto inputDrv = worker.evalStore.readDerivation(inputDrvPath);
-                if (inputDrv.type().isImpure())
-                    throw Error(
-                        "pure derivation '%s' depends on impure derivation '%s'",
-                        worker.store.printStorePath(drvPath),
-                        worker.store.printStorePath(inputDrvPath));
-            }
-
-            addWaiteeDerivedPath(makeConstantStorePathRef(inputDrvPath), inputNode);
+    using ValueComparison = decltype([]<typename T>(const ref<T> & lhs, const ref<T> & rhs) {
+        /* Compare the values, not the pointers themselves. */
+        return *lhs < *rhs;
+    });
+
+    std::map<ref<const SingleDerivedPath>, GoalPtr, ValueComparison> inputGoals;
+
+    auto addWaiteeDerivedPath = [&worker = worker, buildMode = buildMode, &waitees, &inputGoals](
+                                    this const auto & self,
+                                    ref<const SingleDerivedPath> inputDrv,
+                                    const DerivedPathMap<StringSet>::ChildNode & inputNode) -> void {
+        if (!inputNode.value.empty()) {
+            auto g = worker.makeGoal(
+                DerivedPath::Built{
+                    .drvPath = inputDrv,
+                    .outputs = inputNode.value,
+                },
+                buildMode == bmRepair ? bmRepair : bmNormal);
+            inputGoals.insert_or_assign(inputDrv, g);
+            waitees.insert(std::move(g));
         }
+        for (const auto & [outputName, childNode] : inputNode.childMap)
+            self(make_ref<SingleDerivedPath>(SingleDerivedPath::Built{inputDrv, outputName}), childNode);
+    };
+
+    for (const auto & [inputDrvPath, inputNode] : drv->inputs.drvs.map) {
+        /* Ensure that pure, non-fixed-output derivations don't
+           depend on impure derivations. */
+        if (experimentalFeatureSettings.isEnabled(Xp::ImpureDerivations) && !drv->type().isImpure()
+            && !drv->type().isFixed()) {
+            auto inputDrv = worker.evalStore.readDerivation(inputDrvPath);
+            if (inputDrv.type().isImpure())
+                throw Error(
+                    "pure derivation '%s' depends on impure derivation '%s'",
+                    worker.store.printStorePath(drvPath),
+                    worker.store.printStorePath(inputDrvPath));
+        }
+
+        addWaiteeDerivedPath(makeConstantStorePathRef(inputDrvPath), inputNode);
     }
 
     co_await await(std::move(waitees));
@@ -144,7 +133,7 @@ Goal::Co DerivationResolutionGoal::resolveDerivation()
             }
             assert(attempt);
 
-            auto pathResolved = computeStorePath(worker.store, Derivation{*attempt});
+            auto pathResolved = computeStorePath(worker.store, attempt->unresolve());
 
             auto msg =
                 fmt("resolved derivation: '%s' -> '%s'",
diff --git a/src/libstore/build/derivation-trampoline-goal.cc b/src/libstore/build/derivation-trampoline-goal.cc
index edf8d1e86ebc..14864ed052f8 100644
--- a/src/libstore/build/derivation-trampoline-goal.cc
+++ b/src/libstore/build/derivation-trampoline-goal.cc
@@ -2,6 +2,9 @@
 #include "nix/store/build/worker.hh"
 #include "nix/store/derivations.hh"
 
+#include <ranges>
+#include <algorithm>
+
 namespace nix {
 
 DerivationTrampolineGoal::DerivationTrampolineGoal(
@@ -144,11 +147,14 @@ Goal::Co DerivationTrampolineGoal::haveDerivation(StorePath drvPath, Derivation
         },
         wantedOutputs.raw);
 
+    /* Must have at least one wanted output. This is assumed below. */
+    assert(!resolvedWantedOutputs.empty());
+
     Goals concreteDrvGoals;
 
     /* Build this step! */
 
-    auto sharedDrv = make_ref<Derivation>(std::move(drv));
+    auto sharedDrv = make_ref<const Derivation>(std::move(drv));
 
     for (auto & output : resolvedWantedOutputs) {
         auto g = upcast_goal(worker.makeDerivationGoal(drvPath, sharedDrv, output, buildMode, false));
@@ -157,20 +163,71 @@ Goal::Co DerivationTrampolineGoal::haveDerivation(StorePath drvPath, Derivation
         concreteDrvGoals.insert(std::move(g));
     }
 
-    // Copy on purpose
-    co_await await(Goals(concreteDrvGoals));
+    co_await await(concreteDrvGoals);
 
     trace("outer build done");
 
-    auto & g = *concreteDrvGoals.begin();
-    buildResult = g->buildResult;
-    if (auto * successP = buildResult.tryGetSuccess())
-        for (auto & g2 : concreteDrvGoals)
-            if (auto * successP2 = g2->buildResult.tryGetSuccess())
-                for (auto && [x, y] : successP2->builtOutputs)
-                    successP->builtOutputs.insert_or_assign(x, y);
+    if (nrFailed != 0) {
+        auto gi = std::ranges::find_if(concreteDrvGoals, [](const GoalPtr & goal) -> bool {
+            auto exitCode = goal->exitCode;
+            /* Note that without --keep-going waitees might be cancelled before
+               we are woken up. */
+            return exitCode != ecBusy && exitCode != ecSuccess;
+        });
+
+        const Goal * g = gi->get();
+        assert(gi != concreteDrvGoals.end() && "expected a failing goal");
+        auto exitCode = g->exitCode;
+        const auto * failure = g->buildResult.tryGetFailure();
+        assert(failure && "failing goal does not report a failed build result");
+
+        /* Report the exit status of *some* failing goal. This might not be strictly
+           correct, since multiple subgoals can fail independently, but this should be
+           a good enough heuristic without --keep-going. */
+        co_return doneFailure(exitCode, *failure);
+    }
+
+    SingleDrvOutputs outputs;
+
+    auto successes = std::views::transform(concreteDrvGoals, [](const GoalPtr & a) -> const BuildResult::Success & {
+        auto * success = a->buildResult.tryGetSuccess();
+        assert(success && "goal succeeded, but some waitees do not report a successful status");
+        return *success;
+    });
+
+    for (const auto & success : successes)
+        std::ranges::copy(success.builtOutputs, std::inserter(outputs, outputs.end()));
+
+    auto statuses = successes | std::views::transform(&BuildResult::Success::status);
+
+    /* Aggregate the status code. If some outputs we already valid, but we had
+       to build/substitute the other ones, report it as the smallest common
+       denominator. */
+    auto compareSuccesses = [](auto a, auto b) {
+        /* This is technically an identity mapping of the underlying values, but
+           it would be worse to rely on the enum ordering here. */
+        auto toPriority = [](auto st) {
+            using enum BuildResult::Success::Status;
+            switch (st) {
+            case Built:
+                return 0;
+            case Substituted:
+                return 1;
+            case AlreadyValid:
+                return 2;
+            case ResolvesToAlreadyValid:
+                return 3;
+            default:
+                unreachable();
+            }
+        };
+        return toPriority(a) < toPriority(b);
+    };
 
-    co_return amDone(g->exitCode);
+    co_return doneSuccess({
+        .status = std::ranges::min(statuses, compareSuccesses),
+        .builtOutputs = std::move(outputs),
+    });
 }
 
 } // namespace nix
diff --git a/src/libstore/build/entry-points.cc b/src/libstore/build/entry-points.cc
index 5b97966847b8..bf919e443e6b 100644
--- a/src/libstore/build/entry-points.cc
+++ b/src/libstore/build/entry-points.cc
@@ -1,20 +1,63 @@
 #include "nix/store/derivations.hh"
 #include "nix/store/build/worker.hh"
+#include "nix/store/worker-settings.hh"
 #include "nix/store/build/substitution-goal.hh"
 #include "nix/store/build/derivation-trampoline-goal.hh"
+#include "nix/store/store-open.hh"
 #include "nix/util/strings.hh"
+#include <memory>
 
 namespace nix {
 
-void Store::buildPaths(const std::vector<DerivedPath> & reqs, BuildMode buildMode, std::shared_ptr<Store> evalStore)
+void LocalBuilder::buildPaths(const std::vector<DerivedPath> & reqs, BuildMode buildMode)
 {
-    Worker worker(*this, evalStore ? *evalStore : *this);
+    getWorker()->buildPaths(reqs, buildMode);
+}
+
+std::vector<KeyedBuildResult>
+LocalBuilder::buildPathsWithResults(const std::vector<DerivedPath> & reqs, BuildMode buildMode)
+{
+    return getWorker()->buildPathsWithResults(reqs, buildMode);
+}
+
+BuildResult LocalBuilder::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode)
+{
+    return getWorker()->buildDerivation(drvPath, drv, buildMode);
+}
+
+BuildResult LocalBuilder::buildDerivation(
+    const StorePath & drvPath, const BasicDerivation & drv, const StorePathSet & inputs, BuildMode buildMode)
+{
+    return getWorker()->buildDerivation(drvPath, drv, inputs, buildMode);
+}
+
+std::vector<KeyedBuildResult> LocalBuilder::buildPathsWithResults(
+    const std::vector<DerivedPath> & reqs, const StorePathSet & inputs, BuildMode buildMode)
+{
+    return getWorker()->buildPathsWithResults(reqs, inputs, buildMode);
+}
+
+void LocalBuilder::ensurePath(const StorePath & path)
+{
+    /* If the path is already valid, we're done. */
+    if (store->isValidPath(path))
+        return;
+
+    getWorker()->ensurePath(path);
+}
 
+void LocalBuilder::repairPath(const StorePath & path)
+{
+    getWorker()->repairPath(path);
+}
+
+void Worker::buildPaths(const std::vector<DerivedPath> & reqs, BuildMode buildMode)
+{
     Goals goals;
     for (auto & br : reqs)
-        goals.insert(worker.makeGoal(br, buildMode));
+        goals.insert(makeGoal(br, buildMode));
 
-    worker.run(goals);
+    run(goals);
 
     StringSet failed;
     BuildResult::Failure * failure = nullptr;
@@ -27,38 +70,35 @@ void Store::buildPaths(const std::vector<DerivedPath> & reqs, BuildMode buildMod
         }
         if (i->exitCode != Goal::ecSuccess) {
             if (auto i2 = dynamic_cast<DerivationTrampolineGoal *>(i.get()))
-                failed.insert(i2->drvReq->to_string(*this));
+                failed.insert(i2->drvReq->to_string(store));
             else if (auto i2 = dynamic_cast<PathSubstitutionGoal *>(i.get()))
-                failed.insert(printStorePath(i2->storePath));
+                failed.insert(store.printStorePath(i2->storePath));
         }
     }
 
     if (failed.size() == 1 && failure) {
-        failure->withExitStatus(worker.exitStatusFlags.failingExitStatus());
+        failure->withExitStatus(exitStatusFlags.failingExitStatus());
         throw *failure;
     } else if (!failed.empty()) {
-        auto exitStatus = worker.exitStatusFlags.failingExitStatus();
+        auto exitStatus = exitStatusFlags.failingExitStatus();
         if (failure)
             logError(failure->info());
         throw Error(exitStatus, "build of %s failed", concatStringsSep(", ", quoteStrings(failed)));
     }
 }
 
-std::vector<KeyedBuildResult> Store::buildPathsWithResults(
-    const std::vector<DerivedPath> & reqs, BuildMode buildMode, std::shared_ptr<Store> evalStore)
+std::vector<KeyedBuildResult> Worker::buildPathsWithResults(const std::vector<DerivedPath> & reqs, BuildMode buildMode)
 {
-    Worker worker(*this, evalStore ? *evalStore : *this);
-
     Goals goals;
     std::vector<std::pair<const DerivedPath &, GoalPtr>> state;
 
     for (const auto & req : reqs) {
-        auto goal = worker.makeGoal(req, buildMode);
+        auto goal = makeGoal(req, buildMode);
         goals.insert(goal);
         state.push_back({req, goal});
     }
 
-    worker.run(goals);
+    run(goals);
 
     std::vector<KeyedBuildResult> results;
     results.reserve(state.size());
@@ -79,13 +119,12 @@ std::vector<KeyedBuildResult> Store::buildPathsWithResults(
     return results;
 }
 
-BuildResult Store::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode)
+BuildResult Worker::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode)
 {
-    Worker worker(*this, *this);
-    auto goal = worker.makeDerivationTrampolineGoal(drvPath, OutputsSpec::All{}, drv, buildMode);
+    auto goal = makeDerivationTrampolineGoal(drvPath, OutputsSpec::All{}, drv.unresolve(), buildMode);
 
     try {
-        worker.run(Goals{goal});
+        run(Goals{goal});
         return goal->buildResult;
     } catch (Error & e) {
         return BuildResult{
@@ -96,49 +135,65 @@ BuildResult Store::buildDerivation(const StorePath & drvPath, const BasicDerivat
     };
 }
 
-void Store::ensurePath(const StorePath & path)
+BuildResult Worker::buildDerivation(
+    const StorePath & drvPath, const BasicDerivation & drv, const StorePathSet & inputs, BuildMode buildMode)
+{
+    auto substitute = settings.buildersUseSubstitutes ? Substitute : NoSubstitute;
+    auto srcStore = openStore();
+    copyPaths(*srcStore, store, inputs, NoRepair, NoCheckSigs, substitute);
+    return buildDerivation(drvPath, drv, buildMode);
+}
+
+std::vector<KeyedBuildResult>
+Worker::buildPathsWithResults(const std::vector<DerivedPath> & reqs, const StorePathSet & inputs, BuildMode buildMode)
+{
+    auto substitute = settings.buildersUseSubstitutes ? Substitute : NoSubstitute;
+    auto srcStore = openStore();
+    copyPaths(*srcStore, store, inputs, NoRepair, NoCheckSigs, substitute);
+    return buildPathsWithResults(reqs, buildMode);
+}
+
+void Worker::ensurePath(const StorePath & path)
 {
     /* If the path is already valid, we're done. */
-    if (isValidPath(path))
+    if (store.isValidPath(path))
         return;
 
-    Worker worker(*this, *this);
-    GoalPtr goal = worker.makePathSubstitutionGoal(path);
+    GoalPtr goal = makePathSubstitutionGoal(path);
     Goals goals = {goal};
 
-    worker.run(goals);
+    run(goals);
 
     if (goal->exitCode != Goal::ecSuccess) {
-        auto exitStatus = worker.exitStatusFlags.failingExitStatus();
+        auto exitStatus = exitStatusFlags.failingExitStatus();
         goal->buildResult.tryThrowBuildError(exitStatus);
-        throw Error(exitStatus, "path '%s' does not exist and cannot be created", printStorePath(path));
+        throw Error(exitStatus, "path '%s' does not exist and cannot be created", store.printStorePath(path));
     }
 }
 
-void Store::repairPath(const StorePath & path)
+void Worker::repairPath(const StorePath & path)
 {
-    Worker worker(*this, *this);
-    GoalPtr goal = worker.makePathSubstitutionGoal(path, Repair);
+    GoalPtr goal = makePathSubstitutionGoal(path, Repair);
     Goals goals = {goal};
 
-    worker.run(goals);
+    run(goals);
 
     if (goal->exitCode != Goal::ecSuccess) {
         /* Since substituting the path didn't work, if we have a valid
            deriver, then rebuild the deriver. */
-        auto info = queryPathInfo(path);
-        if (info->deriver && isValidPath(*info->deriver)) {
+        auto info = store.queryPathInfo(path);
+        if (info->deriver && store.isValidPath(*info->deriver)) {
             goals.clear();
-            goals.insert(worker.makeGoal(
+            goals.insert(makeGoal(
                 DerivedPath::Built{
                     .drvPath = makeConstantStorePathRef(*info->deriver),
                     // FIXME: Should just build the specific output we need.
                     .outputs = OutputsSpec::All{},
                 },
                 bmRepair));
-            worker.run(goals);
+            run(goals);
         } else
-            throw Error(worker.exitStatusFlags.failingExitStatus(), "cannot repair path '%s'", printStorePath(path));
+            throw Error(exitStatusFlags.failingExitStatus(), "cannot repair path '%s'", store.printStorePath(path));
     }
 }
 
diff --git a/src/libstore/build/goal.cc b/src/libstore/build/goal.cc
index 946314afe140..5b1be405d246 100644
--- a/src/libstore/build/goal.cc
+++ b/src/libstore/build/goal.cc
@@ -4,24 +4,29 @@
 
 namespace nix {
 
+void WorkerSettings::anchor() {}
+
 TimedOut::TimedOut(time_t maxDuration)
     : CloneableError(BuildResult::Failure::TimedOut, "timed out after %1% seconds", maxDuration)
     , maxDuration(maxDuration)
 {
 }
 
+void TimedOut::anchor() {}
+
+void Goal::anchor() {}
+
 using Co = nix::Goal::Co;
 using promise_type = nix::Goal::promise_type;
-using ChildEvents = decltype(promise_type::childEvents);
 
-void ChildEvents::pushChildEvent(ChildOutput event)
+void Goal::ChildEvents::pushChildEvent(ChildOutput event)
 {
     if (childTimeout)
         return; // Already timed out, ignore
     childOutputs.push(std::move(event));
 }
 
-void ChildEvents::pushChildEvent(ChildEOF event)
+void Goal::ChildEvents::pushChildEvent(ChildEOF event)
 {
     if (childTimeout)
         return; // Already timed out, ignore
@@ -29,20 +34,20 @@ void ChildEvents::pushChildEvent(ChildEOF event)
     childEOF = std::move(event);
 }
 
-void ChildEvents::pushChildEvent(TimedOut event)
+void Goal::ChildEvents::pushChildEvent(TimedOut event)
 {
     // Timeout is immediate - flush pending events
     childOutputs = {};
     childEOF.reset();
-    childTimeout = std::move(event);
+    childTimeout = std::make_unique<TimedOut>(std::move(event));
 }
 
-bool ChildEvents::hasChildEvent() const
+bool Goal::ChildEvents::hasChildEvent() const
 {
     return !childOutputs.empty() || childEOF || childTimeout;
 }
 
-Goal::ChildEvent ChildEvents::popChildEvent()
+Goal::ChildEvent Goal::ChildEvents::popChildEvent()
 {
     if (!childOutputs.empty()) {
         auto event = std::move(childOutputs.front());
@@ -52,23 +57,28 @@ Goal::ChildEvent ChildEvents::popChildEvent()
     if (childEOF)
         return *std::exchange(childEOF, std::nullopt);
     if (childTimeout)
-        return *std::exchange(childTimeout, std::nullopt);
+        return std::exchange(childTimeout, nullptr);
     unreachable();
 }
 
 using handle_type = nix::Goal::handle_type;
 using Suspend = nix::Goal::Suspend;
 
-Co::Co(Co && rhs)
+Co::Co(Co && rhs) noexcept
 {
     this->handle = rhs.handle;
     rhs.handle = nullptr;
 }
 
-void Co::operator=(Co && rhs)
+Co & Co::operator=(Co && rhs) noexcept
 {
-    this->handle = rhs.handle;
+    if (handle) {
+        handle.promise().alive = false;
+        handle.destroy();
+    }
+    handle = rhs.handle;
     rhs.handle = nullptr;
+    return *this;
 }
 
 Co::~Co()
@@ -273,22 +283,19 @@ void Goal::work()
 
 void Goal::handleChildOutput(Descriptor fd, std::string_view data)
 {
-    assert(top_co);
-    top_co->handle.promise().childEvents.pushChildEvent(ChildOutput{fd, std::string{data}});
+    childEvents.pushChildEvent(ChildOutput{fd, std::string{data}});
     worker.wakeUp(shared_from_this());
 }
 
 void Goal::handleEOF(Descriptor fd)
 {
-    assert(top_co);
-    top_co->handle.promise().childEvents.pushChildEvent(ChildEOF{fd});
+    childEvents.pushChildEvent(ChildEOF{fd});
     worker.wakeUp(shared_from_this());
 }
 
 void Goal::timedOut(TimedOut && ex)
 {
-    assert(top_co);
-    top_co->handle.promise().childEvents.pushChildEvent(std::move(ex));
+    childEvents.pushChildEvent(std::move(ex));
     worker.wakeUp(shared_from_this());
 }
 
diff --git a/src/libstore/build/substitution-goal.cc b/src/libstore/build/substitution-goal.cc
index 4cb42975fe29..90273493e288 100644
--- a/src/libstore/build/substitution-goal.cc
+++ b/src/libstore/build/substitution-goal.cc
@@ -146,7 +146,7 @@ Goal::Co PathSubstitutionGoal::init()
     }
     if (lastStoresException.has_value()) {
         if (!worker.settings.tryFallback) {
-            throw *lastStoresException;
+            throw std::move(*lastStoresException);
         } else
             logError(lastStoresException->info());
     }
diff --git a/src/libstore/build/worker.cc b/src/libstore/build/worker.cc
index 0c63beb4dd1e..2556a26f8593 100644
--- a/src/libstore/build/worker.cc
+++ b/src/libstore/build/worker.cc
@@ -61,7 +61,7 @@ std::shared_ptr<G> Worker::initGoalIfNeeded(std::weak_ptr<G> & goal_weak, Args &
     if (auto goal = goal_weak.lock())
         return goal;
 
-    auto goal = std::make_shared<G>(args...);
+    auto goal = std::make_shared<G>(std::forward<Args>(args)...);
     goal_weak = goal;
     wakeUp(goal);
     return goal;
@@ -104,16 +104,15 @@ std::shared_ptr<DerivationGoal> Worker::makeDerivationGoal(
 }
 
 std::shared_ptr<DerivationResolutionGoal>
-Worker::makeDerivationResolutionGoal(const StorePath & drvPath, const Derivation & drv, BuildMode buildMode)
+Worker::makeDerivationResolutionGoal(const StorePath & drvPath, ref<const Derivation> drv, BuildMode buildMode)
 {
     return initGoalIfNeeded(derivationResolutionGoals[drvPath], drvPath, drv, *this, buildMode);
 }
 
-std::shared_ptr<DerivationBuildingGoal> Worker::makeDerivationBuildingGoal(
-    const StorePath & drvPath, ref<const Derivation> drv, BuildMode buildMode, bool storeDerivation)
+std::shared_ptr<DerivationBuildingGoal>
+Worker::makeDerivationBuildingGoal(const StorePath & drvPath, ref<const BasicDerivation> drv, BuildMode buildMode)
 {
-    return initGoalIfNeeded(
-        derivationBuildingGoals[drvPath], drvPath, std::move(drv), *this, buildMode, storeDerivation);
+    return initGoalIfNeeded(derivationBuildingGoals[drvPath], drvPath, std::move(drv), *this, buildMode);
 }
 
 std::shared_ptr<PathSubstitutionGoal>
@@ -295,28 +294,11 @@ void Worker::waitForCompletion(GoalPtr goal)
 
 void Worker::run(const Goals & _topGoals)
 {
-    std::vector<nix::DerivedPath> topPaths;
-
-    for (auto & i : _topGoals) {
-        topGoals.insert(i);
-        if (auto goal = dynamic_cast<DerivationTrampolineGoal *>(i.get())) {
-            topPaths.push_back(
-                DerivedPath::Built{
-                    .drvPath = goal->drvReq,
-                    .outputs = goal->wantedOutputs,
-                });
-        } else if (auto goal = dynamic_cast<PathSubstitutionGoal *>(i.get())) {
-            topPaths.push_back(DerivedPath::Opaque{goal->storePath});
-        }
-    }
-
-    /* Call queryMissing() to efficiently query substitutes. */
-    store.queryMissing(topPaths);
-
     debug("entered goal loop");
+    for (std::shared_ptr<Goal> goal : _topGoals)
+        topGoals.insert(std::move(goal));
 
     while (1) {
-
         checkInterrupt();
 
         // TODO GC interface?
diff --git a/src/libstore/builtins/buildenv.cc b/src/libstore/builtins/buildenv.cc
index 3dd66be2ccae..2ad98fa92741 100644
--- a/src/libstore/builtins/buildenv.cc
+++ b/src/libstore/builtins/buildenv.cc
@@ -10,6 +10,8 @@
 
 namespace nix {
 
+void BuildEnvFileConflictError::anchor() {}
+
 RegisterBuiltinBuilder::BuiltinBuilders & RegisterBuiltinBuilder::builtinBuilders()
 {
     static RegisterBuiltinBuilder::BuiltinBuilders builders;
diff --git a/src/libstore/builtins/fetchurl.cc b/src/libstore/builtins/fetchurl.cc
index d412adbb621f..fd38b5a4afd8 100644
--- a/src/libstore/builtins/fetchurl.cc
+++ b/src/libstore/builtins/fetchurl.cc
@@ -54,7 +54,8 @@ static void builtinFetchurl(const BuiltinBuilderContext & ctx)
             }
 #endif
 
-            auto decompressor = makeDecompressionSink(unpack && hasSuffix(mainUrl, ".xz") ? "xz" : "none", sink);
+            auto decompressor = makeDecompressionSink(
+                unpack && hasSuffix(mainUrl, ".xz") ? CompressionAlgo::xz : CompressionAlgo::none, sink);
             fileTransfer->download(std::move(request), *decompressor);
             decompressor->finish();
         });
diff --git a/src/libstore/common-ssh-store-config.cc b/src/libstore/common-ssh-store-config.cc
index ee1d3bf8acde..db3677151416 100644
--- a/src/libstore/common-ssh-store-config.cc
+++ b/src/libstore/common-ssh-store-config.cc
@@ -9,6 +9,8 @@ CommonSSHStoreConfig::CommonSSHStoreConfig(const ParsedURL::Authority & authorit
 {
 }
 
+void CommonSSHStoreConfig::anchor() {}
+
 SSHMaster CommonSSHStoreConfig::createSSHMaster(bool useMaster, Descriptor logFD) const
 {
     return {
diff --git a/src/libstore/content-address.cc b/src/libstore/content-address.cc
index 497c2c5b47c1..fd8807d6d035 100644
--- a/src/libstore/content-address.cc
+++ b/src/libstore/content-address.cc
@@ -1,5 +1,6 @@
 #include "nix/util/args.hh"
 #include "nix/store/content-address.hh"
+#include "nix/util/file-content-address.hh"
 #include "nix/util/split.hh"
 #include "nix/util/json-utils.hh"
 
@@ -133,6 +134,20 @@ FileIngestionMethod ContentAddressMethod::getFileIngestionMethod() const
     }
 }
 
+FileSerialisationMethod ContentAddressMethod::getFileSerialisationMethod() const
+{
+    switch (raw) {
+    case ContentAddressMethod::Raw::Flat:
+    case ContentAddressMethod::Raw::Text:
+        return FileSerialisationMethod::Flat;
+    case ContentAddressMethod::Raw::NixArchive:
+    case ContentAddressMethod::Raw::Git:
+        return FileSerialisationMethod::NixArchive;
+    default:
+        assert(false);
+    }
+}
+
 std::string ContentAddress::render() const
 {
     return renderPrefixModern(method) + this->hash.to_string(HashFormat::Nix32, true);
@@ -304,20 +319,19 @@ Hash ContentAddressWithReferences::getHash() const
 
 namespace nlohmann {
 
-using namespace nix;
-
-ContentAddressMethod adl_serializer<ContentAddressMethod>::from_json(const json & json)
+nix::ContentAddressMethod adl_serializer<nix::ContentAddressMethod>::from_json(const json & json)
 {
-    return ContentAddressMethod::parse(getString(json));
+    return nix::ContentAddressMethod::parse(nix::getString(json));
 }
 
-void adl_serializer<ContentAddressMethod>::to_json(json & json, const ContentAddressMethod & m)
+void adl_serializer<nix::ContentAddressMethod>::to_json(json & json, const nix::ContentAddressMethod & m)
 {
     json = m.render();
 }
 
-ContentAddress adl_serializer<ContentAddress>::from_json(const json & json)
+nix::ContentAddress adl_serializer<nix::ContentAddress>::from_json(const json & json)
 {
+    using namespace nix;
     auto obj = getObject(json);
     return {
         .method = adl_serializer<ContentAddressMethod>::from_json(valueAt(obj, "method")),
@@ -325,7 +339,7 @@ ContentAddress adl_serializer<ContentAddress>::from_json(const json & json)
     };
 }
 
-void adl_serializer<ContentAddress>::to_json(json & json, const ContentAddress & ca)
+void adl_serializer<nix::ContentAddress>::to_json(json & json, const nix::ContentAddress & ca)
 {
     json = {
         {"method", ca.method},
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 52e1c121c3e7..f8c5815a29af 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -1,8 +1,11 @@
 #include "nix/store/daemon.hh"
+#include "nix/util/configuration.hh"
+#include "nix/util/file-content-address.hh"
 #include "nix/util/signals.hh"
 #include "nix/store/worker-protocol.hh"
 #include "nix/store/worker-protocol-connection.hh"
 #include "nix/store/worker-protocol-impl.hh"
+#include "nix/store/build.hh"
 #include "nix/store/store-api.hh"
 #include "nix/store/store-cast.hh"
 #include "nix/store/filetransfer.hh"
@@ -42,6 +45,8 @@ Sink & operator<<(Sink & sink, const Logger::Fields & fields)
     return sink;
 }
 
+namespace {
+
 /* Logger that forwards log messages to the client, *if* we're in a
    state where the protocol allows it (i.e., when canSendStderr is
    true). */
@@ -179,22 +184,6 @@ struct TunnelLogger : public Logger
     }
 };
 
-struct TunnelSink : Sink
-{
-    Sink & to;
-
-    TunnelSink(Sink & to)
-        : to(to)
-    {
-    }
-
-    void operator()(std::string_view data) override
-    {
-        to << STDERR_WRITE;
-        writeString(data, to);
-    }
-};
-
 struct TunnelSource : BufferedSource
 {
     Source & from;
@@ -217,6 +206,8 @@ struct TunnelSource : BufferedSource
     }
 };
 
+} // namespace
+
 struct ClientSettings
 {
     bool keepFailed;
@@ -318,11 +309,42 @@ static void performOp(
     TrustedFlag trusted,
     RecursiveFlag recursive,
     WorkerProto::BasicServerConnection & conn,
-    WorkerProto::Op op)
+    WorkerProto::Op op,
+    Builder & builder)
 {
     WorkerProto::ReadConn rconn(conn);
     WorkerProto::WriteConn wconn(conn);
 
+    if (recursive == daemon::RecursiveFlag::RecursiveSubmitted) {
+        // Limit valid calls to reduce opportunities for nonreproducability in builds
+        // Since this is an allowlist, it's easiest to put it at the top before the switch
+        static constexpr std::array validOperations = {
+            // All the types of "Add" should be allowed
+            WorkerProto::Op::AddToStore,
+            WorkerProto::Op::AddMultipleToStore,
+            WorkerProto::Op::AddToStoreNar,
+            WorkerProto::Op::AddToStoreScanning,
+            // SubmitOutput is designed specifically for this use case
+            WorkerProto::Op::SubmitOutput,
+            // Used by nix cli, should never change actual outputs
+            WorkerProto::Op::AddTempRoot,
+            // Used by nix cli, restricted store will prevent it from seeing derivations it shouldn't
+            WorkerProto::Op::IsValidPath,
+        };
+        if (std::ranges::find(validOperations, op) == validOperations.end()) {
+            throw Error("Operation %d not allowed inside derivation", op);
+        }
+    } else {
+        // Operations designed only for the experimental builder-rpc-v0 should never be exposed outside
+        // derivaitons that use it.
+        // AddToStoreScanning is still acceptable in ordinary recursive derivations, though.
+        // Throw the same error we do when using an unknown operation.
+        if (op == WorkerProto::Op::SubmitOutput
+            || (op == WorkerProto::Op::AddToStoreScanning && recursive == daemon::RecursiveFlag::NotRecursive)) {
+            throw Error("invalid operation %1%", op);
+        }
+    }
+
     switch (op) {
 
     case WorkerProto::Op::IsValidPath: {
@@ -565,7 +587,7 @@ static void performOp(
         if (mode == bmRepair && !trusted)
             throw Error("repairing is not allowed because you are not in 'trusted-users'");
         logger->startWork();
-        store->buildPaths(drvs, mode);
+        builder.buildPaths(drvs, mode);
         logger->stopWork();
         conn.to << 1;
         break;
@@ -584,7 +606,7 @@ static void performOp(
             throw Error("repairing is not allowed because you are not in 'trusted-users'");
 
         logger->startWork();
-        auto results = store->buildPathsWithResults(drvs, mode);
+        auto results = builder.buildPathsWithResults(drvs, mode);
         logger->stopWork();
 
         WorkerProto::write(*store, wconn, results);
@@ -658,12 +680,10 @@ static void performOp(
                paths. */
             assert(drvType.isCA());
 
-            Derivation drv2;
-            static_cast<BasicDerivation &>(drv2) = drv;
-            drvPath = store->writeDerivation(Derivation{drv2});
+            drvPath = store->writeDerivation(drv.unresolve());
         }
 
-        auto res = store->buildDerivation(drvPath, drv, buildMode);
+        auto res = builder.buildDerivation(drvPath, drv, buildMode);
         logger->stopWork();
         WorkerProto::write(*store, wconn, res);
         break;
@@ -672,7 +692,7 @@ static void performOp(
     case WorkerProto::Op::EnsurePath: {
         auto path = WorkerProto::Serialise<StorePath>::read(*store, rconn);
         logger->startWork();
-        store->ensurePath(path);
+        builder.ensurePath(path);
         logger->stopWork();
         conn.to << 1;
         break;
@@ -746,14 +766,17 @@ static void performOp(
     case WorkerProto::Op::CollectGarbage: {
         GCOptions options;
         options.action = WorkerProto::Serialise<GCOptions::GCAction>::read(*store, rconn);
-        if (rconn.version.features.contains(WorkerProto::featureDeleteDeadSpecific)) {
+        if (rconn.version.features.contains(WorkerProto::featureDeleteDeadSpecificReferrers)) {
             options.pathsToDelete = WorkerProto::Serialise<GCOptions::GCPaths>::read(*store, rconn);
         } else {
             auto paths = WorkerProto::Serialise<StorePathSet>::read(*store, rconn);
             if (options.action != GCAction::gcDeleteSpecific && paths.empty())
                 options.pathsToDelete = GCOptions::WholeStore{};
             else
-                options.pathsToDelete = paths;
+                options.pathsToDelete = GCOptions::SpecificPaths{
+                    .paths = paths,
+                    .deleteReferrers = false,
+                };
         }
         conn.from >> options.ignoreLiveness >> options.maxFreed;
         // obsolete fields
@@ -761,8 +784,9 @@ static void performOp(
         readInt(conn.from);
         readInt(conn.from);
 
-        if (options.action == GCAction::gcDeleteDead && std::holds_alternative<StorePathSet>(options.pathsToDelete)
-            && !conn.protoVersion.features.contains(WorkerProto::featureDeleteDeadSpecific)) {
+        if (options.action == GCAction::gcDeleteDead
+            && std::holds_alternative<GCOptions::SpecificPaths>(options.pathsToDelete)
+            && !conn.protoVersion.features.contains(WorkerProto::featureDeleteDeadSpecificReferrers)) {
             throw Error(
                 "Garbage collecting specific paths requested but it is not supported by the negotiated protocol");
         }
@@ -809,7 +833,7 @@ static void performOp(
 
         // FIXME: use some setting in recursive mode. Will need to use
         // non-global variables.
-        if (!recursive)
+        if (recursive == RecursiveFlag::NotRecursive)
             clientSettings.apply(trusted);
 
         logger->stopWork();
@@ -1022,15 +1046,70 @@ static void performOp(
         break;
     }
 
+    case WorkerProto::Op::AddToStoreScanning: {
+        auto name = readString(conn.from);
+        auto camStr = readString(conn.from);
+
+        experimentalFeatureSettings.require(Xp::DynamicDerivations);
+
+        if (!conn.protoVersion.features.contains(WorkerProto::featureAddToStoreScanning))
+            throw Error("Adding to store with scanning was requested, but not supported in negotiated protocol");
+
+        if (recursive == daemon::RecursiveFlag::NotRecursive)
+            throw Error(
+                "AddToStoreScanning only valid within derivation with `builder-rpc-v0` or `recursive-nix` feature");
+
+        auto & submitStore = require<SubmitStore>(*store);
+
+        logger->startWork();
+        auto pathInfo = [&]() {
+            // NB: FramedSource must be out of scope before logger->stopWork();
+            // FIXME: this means that if there is an error
+            // half-way through, the client will keep sending
+            // data, since we haven't sent it the error yet.
+            auto [contentAddressMethod, hashAlgo] = ContentAddressMethod::parseWithAlgo(camStr);
+            FramedSource source(conn.from);
+            FileSerialisationMethod dumpMethod = contentAddressMethod.getFileSerialisationMethod();
+            return submitStore.addToStoreScanning(source, name, dumpMethod, contentAddressMethod, hashAlgo);
+        }();
+        logger->stopWork();
+
+        WorkerProto::Serialise<ValidPathInfo>::write(*store, wconn, *pathInfo);
+        break;
+    }
+
+    case WorkerProto::Op::SubmitOutput: {
+        experimentalFeatureSettings.require(Xp::DynamicDerivations);
+        if (recursive != daemon::RecursiveFlag::RecursiveSubmitted)
+            throw Error("SubmitOutput only valid within derivation with `builder-rpc-v0` feature");
+
+        auto path = WorkerProto::Serialise<SingleDerivedPath>::read(*store, rconn);
+        auto output = WorkerProto::Serialise<OutputName>::read(*store, rconn);
+
+        auto & submitStore = require<SubmitStore>(*store);
+
+        logger->startWork();
+        submitStore.submitOutput(path, output);
+        logger->stopWork();
+        conn.to << 1;
+        break;
+    }
+
     default:
         throw Error("invalid operation %1%", op);
     }
 }
 
-void processConnection(ref<Store> store, FdSource && from, FdSink && to, TrustedFlag trusted, RecursiveFlag recursive)
+void processConnection(
+    ref<Store> store,
+    FdSource && from,
+    FdSink && to,
+    TrustedFlag trusted,
+    RecursiveFlag recursive,
+    std::shared_ptr<Builder> builder)
 {
 #ifndef _WIN32 // TODO need graceful async exit support on Windows?
-    auto monitor = !recursive ? std::make_unique<MonitorFdHup>(from.fd) : nullptr;
+    auto monitor = (recursive == RecursiveFlag::NotRecursive) ? std::make_unique<MonitorFdHup>(from.fd) : nullptr;
     (void) monitor; // suppress warning
     ReceiveInterrupts receiveInterrupts;
 
@@ -1045,9 +1124,24 @@ void processConnection(ref<Store> store, FdSource && from, FdSink && to, Trusted
     });
 #endif
 
+    if (!builder)
+        builder = store->getBuilder();
+
     /* Exchange the greeting. */
+    WorkerProto::Version localVersion;
+
+    if (recursive == RecursiveFlag::RecursiveSubmitted) {
+        localVersion = WorkerProto::builderRpcV0;
+    } else if (recursive == RecursiveFlag::Recursive) {
+        localVersion = WorkerProto::latest;
+        localVersion.features.insert(std::string{WorkerProto::featureDisableSetOptions});
+        localVersion.features.insert(std::string{WorkerProto::featureAddToStoreScanning});
+    } else {
+        localVersion = WorkerProto::latest;
+    }
+
     WorkerProto::BasicServerConnection conn;
-    conn.protoVersion = WorkerProto::BasicServerConnection::handshake(to, from, WorkerProto::latest);
+    conn.protoVersion = WorkerProto::BasicServerConnection::handshake(to, from, localVersion);
 
     if (conn.protoVersion.number < WorkerProto::minimum.number)
         throw Error("the Nix client version is too old");
@@ -1055,14 +1149,11 @@ void processConnection(ref<Store> store, FdSource && from, FdSink && to, Trusted
     conn.to = std::move(to);
     conn.from = std::move(from);
 
-    auto tunnelLogger_ = std::make_unique<TunnelLogger>(conn.to, conn.protoVersion);
-    auto tunnelLogger = tunnelLogger_.get();
-    std::unique_ptr<Logger> prevLogger_;
-    auto prevLogger = logger.get();
+    auto tunnelLogger = new TunnelLogger(conn.to, conn.protoVersion);
+    auto prevLogger = logger;
     // FIXME
-    if (!recursive) {
-        prevLogger_ = std::move(logger);
-        logger = std::move(tunnelLogger_);
+    if (recursive == RecursiveFlag::NotRecursive) {
+        logger = tunnelLogger;
         applyJSONLogger();
     }
 
@@ -1108,7 +1199,7 @@ void processConnection(ref<Store> store, FdSource && from, FdSink && to, Trusted
             debug("performing daemon worker op: %d", op);
 
             try {
-                performOp(tunnelLogger, store, trusted, recursive, conn, op);
+                performOp(tunnelLogger, store, trusted, recursive, conn, op, *builder);
             } catch (Error & e) {
                 /* If we're not in a state where we can send replies, then
                    something went wrong processing the input of the
diff --git a/src/libstore/darwin/build/darwin-derivation-builder.cc b/src/libstore/darwin/build/darwin-derivation-builder.cc
new file mode 100644
index 000000000000..2e05f5858963
--- /dev/null
+++ b/src/libstore/darwin/build/darwin-derivation-builder.cc
@@ -0,0 +1,313 @@
+#include "derivation-builder-impl.hh"
+#include "darwin-derivation-builder.hh"
+
+#include <spawn.h>
+#include <sys/sysctl.h>
+#include <sandbox.h>
+#include <sys/ipc.h>
+#include <sys/shm.h>
+#include <sys/msg.h>
+#include <sys/sem.h>
+
+/* This definition is undocumented but depended upon by all major browsers. */
+extern "C" int
+sandbox_init_with_parameters(const char * profile, uint64_t flags, const char * const parameters[], char ** errorbuf);
+
+/* Darwin IPC structures and constants */
+#define IPCS_MAGIC 0x00000001
+#define IPCS_SHM_ITER 0x00000002
+#define IPCS_SEM_ITER 0x00000020
+#define IPCS_MSG_ITER 0x00000200
+#define IPCS_SHM_SYSCTL "kern.sysv.ipcs.shm"
+#define IPCS_MSG_SYSCTL "kern.sysv.ipcs.msg"
+#define IPCS_SEM_SYSCTL "kern.sysv.ipcs.sem"
+
+struct IpcsCommand
+{
+    uint32_t ipcs_magic;
+    uint32_t ipcs_op;
+    uint32_t ipcs_cursor;
+    uint32_t ipcs_datalen;
+    void * ipcs_data;
+};
+
+namespace nix {
+
+void DarwinDerivationBuilder::prepareSandbox()
+{
+    pathsInChroot = getPathsInSandbox();
+}
+
+void DarwinDerivationBuilder::setUser()
+{
+    DerivationBuilderImpl::setUser();
+
+    /* This has to appear before import statements. */
+    std::string sandboxProfile = "(version 1)\n";
+
+    if (useSandbox) {
+
+        /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */
+        StringSet ancestry;
+
+        /* We build the ancestry before adding all inputPaths to the store because we know they'll
+           all have the same parents (the store), and there might be lots of inputs. This isn't
+           particularly efficient... I doubt it'll be a bottleneck in practice */
+        for (auto & i : pathsInChroot) {
+            std::filesystem::path cur = i.first;
+            while (cur != "/") {
+                cur = cur.parent_path();
+                ancestry.insert(cur.native());
+            }
+        }
+
+        /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost
+           path component this time, since it's typically /nix/store and we care about that. */
+        std::filesystem::path cur = store.storeDir;
+        while (cur != "/") {
+            ancestry.insert(cur.native());
+            cur = cur.parent_path();
+        }
+
+        /* Add all our input paths to the chroot */
+        for (auto & i : inputPaths) {
+            auto p = store.printStorePath(i);
+            pathsInChroot.insert_or_assign(p, ChrootPath{.source = p});
+        }
+
+        /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be
+         * configurable */
+        if (store.config->getLocalSettings().darwinLogSandboxViolations) {
+            sandboxProfile += "(deny default)\n";
+        } else {
+            sandboxProfile += "(deny default (with no-log))\n";
+        }
+
+        sandboxProfile +=
+#include "sandbox-defaults.sb"
+            ;
+
+        if (!derivationType.isSandboxed())
+            sandboxProfile +=
+#include "sandbox-network.sb"
+                ;
+
+        /* Add the output paths we'll use at build-time to the chroot */
+        sandboxProfile += "(allow file-read* file-write* process-exec\n";
+        for (auto & [_, path] : scratchOutputs)
+            sandboxProfile += fmt("\t(subpath \"%s\")\n", store.printStorePath(path));
+
+        sandboxProfile += ")\n";
+
+        /* Our inputs (transitive dependencies and any impurities computed above)
+           without file-write* allowed, access() incorrectly returns EPERM */
+        sandboxProfile += "(allow file-read* file-write* process-exec\n";
+
+        // We create multiple allow lists, to avoid exceeding a limit in the darwin sandbox interpreter.
+        // See https://github.com/NixOS/nix/issues/4119
+        // We split our allow groups approximately at half the actual limit, 1 << 16
+        const size_t breakpoint = sandboxProfile.length() + (1 << 14);
+        for (auto & i : pathsInChroot) {
+
+            if (sandboxProfile.length() >= breakpoint) {
+                debug("Sandbox break: %d %d", sandboxProfile.length(), breakpoint);
+                sandboxProfile += ")\n(allow file-read* file-write* process-exec\n";
+            }
+
+            if (i.first != i.second.source)
+                throw Error(
+                    "can't map %1% to %2%: mismatched impure paths not supported on Darwin",
+                    PathFmt(i.first),
+                    PathFmt(i.second.source));
+
+            std::string path = i.first;
+            auto optSt = maybeLstat(path.c_str());
+            if (!optSt) {
+                if (i.second.optional)
+                    continue;
+                throw SysError("getting attributes of required path '%s", path);
+            }
+            if (S_ISDIR(optSt->st_mode))
+                sandboxProfile += fmt("\t(subpath \"%s\")\n", path);
+            else
+                sandboxProfile += fmt("\t(literal \"%s\")\n", path);
+        }
+        sandboxProfile += ")\n";
+
+        /* Allow file-read* on full directory hierarchy to self. Allows realpath() */
+        sandboxProfile += "(allow file-read*\n";
+        for (auto & i : ancestry) {
+            sandboxProfile += fmt("\t(literal \"%s\")\n", i);
+        }
+        sandboxProfile += ")\n";
+
+        sandboxProfile += drvOptions.additionalSandboxProfile;
+    } else
+        sandboxProfile +=
+#include "sandbox-minimal.sb"
+            ;
+
+    debug("Generated sandbox profile:");
+    debug(sandboxProfile);
+
+    /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different
+       mechanisms to find temporary directories, so we want to open up a broader place for them to put their files,
+       if needed. */
+    std::filesystem::path globalTmpDir = canonPath(defaultTempDir().native(), true);
+
+    /* They don't like trailing slashes on subpath directives */
+    std::string globalTmpDirStr = globalTmpDir.native();
+    while (!globalTmpDirStr.empty() && globalTmpDirStr.back() == '/')
+        globalTmpDirStr.pop_back();
+
+    if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {
+        Strings sandboxArgs;
+        sandboxArgs.push_back("_NIX_BUILD_TOP");
+        sandboxArgs.push_back(tmpDir.native());
+        sandboxArgs.push_back("_GLOBAL_TMP_DIR");
+        sandboxArgs.push_back(globalTmpDirStr);
+        if (drvOptions.allowLocalNetworking) {
+            sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");
+            sandboxArgs.push_back("1");
+        }
+        char * sandbox_errbuf = nullptr;
+        if (sandbox_init_with_parameters(
+                sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) {
+            writeFull(
+                STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)"));
+            _exit(1);
+        }
+    }
+}
+
+void DarwinDerivationBuilder::execBuilder(const Strings & args, const Strings & envStrs)
+{
+    posix_spawnattr_t attrp;
+
+    if (posix_spawnattr_init(&attrp))
+        throw SysError("failed to initialize builder");
+
+    if (posix_spawnattr_setflags(&attrp, POSIX_SPAWN_SETEXEC))
+        throw SysError("failed to initialize builder");
+
+    if (drv.platform == "aarch64-darwin") {
+        // Unset kern.curproc_arch_affinity so we can escape Rosetta
+        int affinity = 0;
+        sysctlbyname("kern.curproc_arch_affinity", NULL, NULL, &affinity, sizeof(affinity));
+
+        cpu_type_t cpu = CPU_TYPE_ARM64;
+        posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL);
+    } else if (drv.platform == "x86_64-darwin") {
+        cpu_type_t cpu = CPU_TYPE_X86_64;
+        posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL);
+    }
+
+    posix_spawn(
+        NULL, drv.builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());
+}
+
+void DarwinDerivationBuilder::cleanupSysVIPCForUser(uid_t uid)
+{
+    struct IpcsCommand ic;
+    size_t ic_size = sizeof(ic);
+    // IPC ids to cleanup
+    std::vector<int> shm_ids, msg_ids, sem_ids;
+
+    {
+        struct shmid_ds shm_ds;
+        ic.ipcs_magic = IPCS_MAGIC;
+        ic.ipcs_op = IPCS_SHM_ITER;
+        ic.ipcs_cursor = 0;
+        ic.ipcs_data = &shm_ds;
+        ic.ipcs_datalen = sizeof(shm_ds);
+
+        while (true) {
+            memset(&shm_ds, 0, sizeof(shm_ds));
+
+            if (sysctlbyname(IPCS_SHM_SYSCTL, &ic, &ic_size, &ic, ic_size) != 0) {
+                break;
+            }
+
+            if (shm_ds.shm_perm.uid == uid) {
+                int shmid = shmget(shm_ds.shm_perm._key, 0, 0);
+                if (shmid != -1) {
+                    shm_ids.push_back(shmid);
+                }
+            }
+        }
+    }
+
+    for (auto id : shm_ids) {
+        if (shmctl(id, IPC_RMID, NULL) == 0)
+            debug("removed shared memory segment with shmid %d", id);
+    }
+
+    {
+        struct msqid_ds msg_ds;
+        ic.ipcs_magic = IPCS_MAGIC;
+        ic.ipcs_op = IPCS_MSG_ITER;
+        ic.ipcs_cursor = 0;
+        ic.ipcs_data = &msg_ds;
+        ic.ipcs_datalen = sizeof(msg_ds);
+
+        while (true) {
+            memset(&msg_ds, 0, sizeof(msg_ds));
+
+            if (sysctlbyname(IPCS_MSG_SYSCTL, &ic, &ic_size, &ic, ic_size) != 0) {
+                break;
+            }
+
+            if (msg_ds.msg_perm.uid == uid) {
+                int msgid = msgget(msg_ds.msg_perm._key, 0);
+                if (msgid != -1) {
+                    msg_ids.push_back(msgid);
+                }
+            }
+        }
+    }
+
+    for (auto id : msg_ids) {
+        if (msgctl(id, IPC_RMID, NULL) == 0)
+            debug("removed message queue with msgid %d", id);
+    }
+
+    {
+        struct semid_ds sem_ds;
+        ic.ipcs_magic = IPCS_MAGIC;
+        ic.ipcs_op = IPCS_SEM_ITER;
+        ic.ipcs_cursor = 0;
+        ic.ipcs_data = &sem_ds;
+        ic.ipcs_datalen = sizeof(sem_ds);
+
+        while (true) {
+            memset(&sem_ds, 0, sizeof(sem_ds));
+
+            if (sysctlbyname(IPCS_SEM_SYSCTL, &ic, &ic_size, &ic, ic_size) != 0) {
+                break;
+            }
+
+            if (sem_ds.sem_perm.uid == uid) {
+                int semid = semget(sem_ds.sem_perm._key, 0, 0);
+                if (semid != -1) {
+                    sem_ids.push_back(semid);
+                }
+            }
+        }
+    }
+
+    for (auto id : sem_ids) {
+        if (semctl(id, 0, IPC_RMID) == 0)
+            debug("removed semaphore with semid %d", id);
+    }
+}
+
+void DarwinDerivationBuilder::killSandbox(bool getStats)
+{
+    DerivationBuilderImpl::killSandbox(getStats);
+    if (buildUser) {
+        auto uid = buildUser->getUID();
+        cleanupSysVIPCForUser(uid);
+    }
+}
+
+} // namespace nix
diff --git a/src/libstore/darwin/build/darwin-derivation-builder.hh b/src/libstore/darwin/build/darwin-derivation-builder.hh
new file mode 100644
index 000000000000..260339c5c577
--- /dev/null
+++ b/src/libstore/darwin/build/darwin-derivation-builder.hh
@@ -0,0 +1,47 @@
+#pragma once
+
+#include "derivation-builder-impl.hh"
+
+namespace nix {
+
+struct DarwinDerivationBuilder : DerivationBuilderImpl
+{
+    PathsInChroot pathsInChroot;
+
+    /**
+     * Whether full sandboxing is enabled. Note that macOS builds
+     * always have *some* sandboxing (see sandbox-minimal.sb).
+     */
+    bool useSandbox;
+
+    DarwinDerivationBuilder(
+        LocalStore & store,
+        std::shared_ptr<DerivationBuilderCallbacks> miscMethods,
+        DerivationBuilderParams params,
+        bool useSandbox)
+        : DerivationBuilderImpl(store, miscMethods, std::move(params))
+        , useSandbox(useSandbox)
+    {
+    }
+
+    void prepareSandbox() override;
+
+    void setUser() override;
+
+    void execBuilder(const Strings & args, const Strings & envStrs) override;
+
+    /**
+     * Cleans up all System V IPC objects owned by the specified user.
+     *
+     * On Darwin, IPC objects (shared memory segments, message queues, and semaphore)
+     * can persist after the build user's processes are killed, since there are no IPC namespaces
+     * like on Linux. This can exhaust kernel IPC limits over time.
+     *
+     * Uses sysctl to enumerate and remove all IPC objects owned by the given UID.
+     */
+    void cleanupSysVIPCForUser(uid_t uid);
+
+    void killSandbox(bool getStats) override;
+};
+
+} // namespace nix
diff --git a/src/libstore/unix/build/sandbox-defaults.sb b/src/libstore/darwin/build/sandbox-defaults.sb
similarity index 100%
rename from src/libstore/unix/build/sandbox-defaults.sb
rename to src/libstore/darwin/build/sandbox-defaults.sb
diff --git a/src/libstore/unix/build/sandbox-minimal.sb b/src/libstore/darwin/build/sandbox-minimal.sb
similarity index 100%
rename from src/libstore/unix/build/sandbox-minimal.sb
rename to src/libstore/darwin/build/sandbox-minimal.sb
diff --git a/src/libstore/unix/build/sandbox-network.sb b/src/libstore/darwin/build/sandbox-network.sb
similarity index 100%
rename from src/libstore/unix/build/sandbox-network.sb
rename to src/libstore/darwin/build/sandbox-network.sb
diff --git a/src/libstore/darwin/meson.build b/src/libstore/darwin/meson.build
new file mode 100644
index 000000000000..72d94baac2be
--- /dev/null
+++ b/src/libstore/darwin/meson.build
@@ -0,0 +1,3 @@
+include_dirs += [ include_directories('build') ]
+
+sources += files('build/darwin-derivation-builder.cc')
diff --git a/src/libstore/derivation-options.cc b/src/libstore/derivation-options.cc
index b3d4261b5464..36cf9116c833 100644
--- a/src/libstore/derivation-options.cc
+++ b/src/libstore/derivation-options.cc
@@ -358,7 +358,8 @@ DerivationOptions<SingleDerivedPath> derivationOptionsFromStructuredAttrs(
 }
 
 template<typename Input>
-StringSet DerivationOptions<Input>::getRequiredSystemFeatures(const BasicDerivation & drv) const
+template<typename Inputs>
+StringSet DerivationOptions<Input>::getRequiredSystemFeatures(const DerivationT<Inputs> & drv) const
 {
     // FIXME: cache this?
     StringSet res;
@@ -376,11 +377,20 @@ bool DerivationOptions<Input>::substitutesAllowed(const WorkerSettings & workerS
 }
 
 template<typename Input>
-bool DerivationOptions<Input>::useUidRange(const BasicDerivation & drv) const
+template<typename Inputs>
+bool DerivationOptions<Input>::useUidRange(const DerivationT<Inputs> & drv) const
 {
     return getRequiredSystemFeatures(drv).count("uid-range");
 }
 
+// Explicit instantiations for member function templates
+template StringSet DerivationOptions<StorePath>::getRequiredSystemFeatures(const BasicDerivation &) const;
+template StringSet DerivationOptions<StorePath>::getRequiredSystemFeatures(const Derivation &) const;
+template StringSet DerivationOptions<SingleDerivedPath>::getRequiredSystemFeatures(const Derivation &) const;
+
+template bool DerivationOptions<StorePath>::useUidRange(const BasicDerivation &) const;
+template bool DerivationOptions<SingleDerivedPath>::useUidRange(const Derivation &) const;
+
 std::optional<DerivationOptions<StorePath>> tryResolve(
     const DerivationOptions<SingleDerivedPath> & drvOptions,
     fun<std::optional<StorePath>(ref<const SingleDerivedPath> drvPath, const std::string & outputName)>
@@ -536,11 +546,11 @@ template struct DerivationOptions<SingleDerivedPath>;
 
 namespace nlohmann {
 
-using namespace nix;
-
 template<typename Inputs>
-static DerivationOptions<Inputs> derivationOptionsFromJson(const nlohmann::json & json_)
+static nix::DerivationOptions<Inputs> derivationOptionsFromJson(const nlohmann::json & json_)
 {
+    using namespace nix;
+
     auto & json = getObject(json_);
 
     return {
@@ -576,8 +586,10 @@ static DerivationOptions<Inputs> derivationOptionsFromJson(const nlohmann::json
 }
 
 template<typename Inputs>
-static void derivationOptionsToJson(nlohmann::json & json, const DerivationOptions<Inputs> & o)
+static void derivationOptionsToJson(nlohmann::json & json, const nix::DerivationOptions<Inputs> & o)
 {
+    using namespace nix;
+
     json["outputChecks"] = std::visit(
         overloaded{
             [&](const OutputChecks<Inputs> & checks) {
@@ -609,8 +621,10 @@ static void derivationOptionsToJson(nlohmann::json & json, const DerivationOptio
 }
 
 template<typename Inputs>
-static OutputChecks<Inputs> outputChecksFromJson(const nlohmann::json & json_)
+static nix::OutputChecks<Inputs> outputChecksFromJson(const nlohmann::json & json_)
 {
+    using namespace nix;
+
     auto & json = getObject(json_);
 
     return {
@@ -625,7 +639,7 @@ static OutputChecks<Inputs> outputChecksFromJson(const nlohmann::json & json_)
 }
 
 template<typename Inputs>
-static void outputChecksToJson(nlohmann::json & json, const OutputChecks<Inputs> & c)
+static void outputChecksToJson(nlohmann::json & json, const nix::OutputChecks<Inputs> & c)
 {
     json["ignoreSelfRefs"] = c.ignoreSelfRefs;
     json["maxSize"] = c.maxSize;
@@ -636,45 +650,51 @@ static void outputChecksToJson(nlohmann::json & json, const OutputChecks<Inputs>
     json["disallowedRequisites"] = c.disallowedRequisites;
 }
 
-DerivationOptions<SingleDerivedPath> adl_serializer<DerivationOptions<SingleDerivedPath>>::from_json(const json & json_)
+nix::DerivationOptions<nix::SingleDerivedPath>
+adl_serializer<nix::DerivationOptions<nix::SingleDerivedPath>>::from_json(const json & json_)
 {
-    return derivationOptionsFromJson<SingleDerivedPath>(json_);
+    return derivationOptionsFromJson<nix::SingleDerivedPath>(json_);
 }
 
-void adl_serializer<DerivationOptions<SingleDerivedPath>>::to_json(
-    json & json, const DerivationOptions<SingleDerivedPath> & o)
+void adl_serializer<nix::DerivationOptions<nix::SingleDerivedPath>>::to_json(
+    json & json, const nix::DerivationOptions<nix::SingleDerivedPath> & o)
 {
-    derivationOptionsToJson<SingleDerivedPath>(json, o);
+    derivationOptionsToJson<nix::SingleDerivedPath>(json, o);
 }
 
-DerivationOptions<StorePath> adl_serializer<DerivationOptions<StorePath>>::from_json(const json & json_)
+nix::DerivationOptions<nix::StorePath>
+adl_serializer<nix::DerivationOptions<nix::StorePath>>::from_json(const json & json_)
 {
-    return derivationOptionsFromJson<StorePath>(json_);
+    return derivationOptionsFromJson<nix::StorePath>(json_);
 }
 
-void adl_serializer<DerivationOptions<StorePath>>::to_json(json & json, const DerivationOptions<StorePath> & o)
+void adl_serializer<nix::DerivationOptions<nix::StorePath>>::to_json(
+    json & json, const nix::DerivationOptions<nix::StorePath> & o)
 {
-    derivationOptionsToJson<StorePath>(json, o);
+    derivationOptionsToJson<nix::StorePath>(json, o);
 }
 
-OutputChecks<SingleDerivedPath> adl_serializer<OutputChecks<SingleDerivedPath>>::from_json(const json & json_)
+nix::OutputChecks<nix::SingleDerivedPath>
+adl_serializer<nix::OutputChecks<nix::SingleDerivedPath>>::from_json(const json & json_)
 {
-    return outputChecksFromJson<SingleDerivedPath>(json_);
+    return outputChecksFromJson<nix::SingleDerivedPath>(json_);
 }
 
-void adl_serializer<OutputChecks<SingleDerivedPath>>::to_json(json & json, const OutputChecks<SingleDerivedPath> & c)
+void adl_serializer<nix::OutputChecks<nix::SingleDerivedPath>>::to_json(
+    json & json, const nix::OutputChecks<nix::SingleDerivedPath> & c)
 {
-    outputChecksToJson<SingleDerivedPath>(json, c);
+    outputChecksToJson<nix::SingleDerivedPath>(json, c);
 }
 
-OutputChecks<StorePath> adl_serializer<OutputChecks<StorePath>>::from_json(const json & json_)
+nix::OutputChecks<nix::StorePath> adl_serializer<nix::OutputChecks<nix::StorePath>>::from_json(const json & json_)
 {
-    return outputChecksFromJson<StorePath>(json_);
+    return outputChecksFromJson<nix::StorePath>(json_);
 }
 
-void adl_serializer<OutputChecks<StorePath>>::to_json(json & json, const OutputChecks<StorePath> & c)
+void adl_serializer<nix::OutputChecks<nix::StorePath>>::to_json(
+    json & json, const nix::OutputChecks<nix::StorePath> & c)
 {
-    outputChecksToJson<StorePath>(json, c);
+    outputChecksToJson<nix::StorePath>(json, c);
 }
 
 } // namespace nlohmann
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index 8475532bca33..dd7d69585c6d 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -15,8 +15,6 @@
 
 namespace nix {
 
-using namespace std::literals::string_view_literals;
-
 std::optional<StorePath>
 DerivationOutput::path(const StoreDirConfig & store, std::string_view drvName, OutputNameView outputName) const
 {
@@ -99,15 +97,26 @@ bool DerivationType::isImpure() const
         raw);
 }
 
-bool BasicDerivation::isBuiltin() const
+bool isBuiltin(const BasicDerivation & drv)
+{
+    return drv.builder.substr(0, 8) == "builtin:";
+}
+
+template<typename InputsType>
+bool DerivationT<InputsType>::isBuiltin() const
 {
     return builder.substr(0, 8) == "builtin:";
 }
 
+// Forward declaration of specialization
+template<>
+std::string DerivationT<FullInputs>::unparse(
+    const StoreDirConfig & store, bool maskOutputs, DerivedPathMap<StringSet>::ChildNode::Map * actualInputs) const;
+
 static auto infoForDerivation(const StoreDirConfig & store, const Derivation & drv)
 {
-    auto references = drv.inputSrcs;
-    for (auto & i : drv.inputDrvs.map)
+    auto references = drv.inputs.srcs;
+    for (auto & i : drv.inputs.drvs.map)
         references.insert(i.first);
     /* Note that the outputs of a derivation are *not* references
        (that can be missing (of course) and should not necessarily be
@@ -223,6 +232,7 @@ static BackedStringView parseString(StringViewStream & str)
     size_t start = 0;
     size_t end = str.remaining.size();
     const auto data = str.remaining.data();
+    bool foundClose = false;
     while (start < end) {
         auto idx = str.remaining.find('"', start);
         if (idx == std::string_view::npos) {
@@ -233,10 +243,13 @@ static BackedStringView parseString(StringViewStream & str)
             ;
         if ((idx - pos) % 2 == 0) { // even number of backslashes
             end = idx;
+            foundClose = true;
             break;
         }
         start = idx + 1;
     }
+    if (!foundClose)
+        throw FormatError("unterminated string in derivation");
 
     start = 0;
     const auto content = str.remaining.substr(start, end);
@@ -308,6 +321,8 @@ static DerivationOutput parseDerivationOutput(
     std::string_view hashS,
     const ExperimentalFeatureSettings & xpSettings)
 {
+    using namespace std::literals::string_view_literals;
+
     if (!hashAlgoStr.empty()) {
         ContentAddressMethod method = ContentAddressMethod::parsePrefix(hashAlgoStr);
         if (method == ContentAddressMethod::Raw::Text)
@@ -387,6 +402,8 @@ enum struct DerivationATermVersion {
 static DerivedPathMap<StringSet>::ChildNode
 parseDerivedPathMapNode(const StoreDirConfig & store, StringViewStream & str, DerivationATermVersion version)
 {
+    using namespace std::literals::string_view_literals;
+
     DerivedPathMap<StringSet>::ChildNode node;
 
     auto parseNonDynamic = [&]() { node.value = parseStrings(str, false); };
@@ -432,8 +449,11 @@ Derivation parseDerivation(
     std::string_view name,
     const ExperimentalFeatureSettings & xpSettings)
 {
-    Derivation drv;
-    drv.name = name;
+    using namespace std::literals::string_view_literals;
+
+    Derivation drv{
+        .name = std::string{name},
+    };
 
     StringViewStream str{s};
     expect(str, 'D');
@@ -477,13 +497,13 @@ Derivation parseDerivation(
         expect(str, '(');
         auto drvPath = parsePath(str);
         expect(str, ',');
-        drv.inputDrvs.map.insert_or_assign(
+        drv.inputs.drvs.map.insert_or_assign(
             store.parseStorePath(*drvPath), parseDerivedPathMapNode(store, str, version));
         expect(str, ')');
     }
 
     expect(str, ',');
-    drv.inputSrcs = store.parseStorePathSet(parseStrings(str, true));
+    drv.inputs.srcs = store.parseStorePathSet(parseStrings(str, true));
     expect(str, ',');
     drv.platform = parseString(str).toOwned();
     expect(str, ',');
@@ -592,6 +612,8 @@ static void printUnquotedStrings(std::string & res, ForwardIterator i, ForwardIt
 static void unparseDerivedPathMapNode(
     const StoreDirConfig & store, std::string & s, const DerivedPathMap<StringSet>::ChildNode & node)
 {
+    using namespace std::literals::string_view_literals;
+
     s += ',';
     if (node.childMap.empty()) {
         printUnquotedStrings(s, node.value.begin(), node.value.end());
@@ -626,15 +648,18 @@ static void unparseDerivedPathMapNode(
 static bool hasDynamicDrvDep(const Derivation & drv)
 {
     return std::find_if(
-               drv.inputDrvs.map.begin(),
-               drv.inputDrvs.map.end(),
+               drv.inputs.drvs.map.begin(),
+               drv.inputs.drvs.map.end(),
                [](auto & kv) { return !kv.second.childMap.empty(); })
-           != drv.inputDrvs.map.end();
+           != drv.inputs.drvs.map.end();
 }
 
-std::string Derivation::unparse(
+template<>
+std::string DerivationT<FullInputs>::unparse(
     const StoreDirConfig & store, bool maskOutputs, DerivedPathMap<StringSet>::ChildNode::Map * actualInputs) const
 {
+    using namespace std::literals::string_view_literals;
+
     std::string s;
     s.reserve(65536);
 
@@ -720,7 +745,7 @@ std::string Derivation::unparse(
             s += ')';
         }
     } else {
-        for (auto & [drvPath, childMap] : inputDrvs.map) {
+        for (auto & [drvPath, childMap] : inputs.drvs.map) {
             if (first)
                 first = false;
             else
@@ -733,7 +758,7 @@ std::string Derivation::unparse(
     }
 
     s += "],"sv;
-    auto paths = store.printStorePathSet(inputSrcs); // FIXME: slow
+    auto paths = store.printStorePathSet(inputs.srcs); // FIXME: slow
     printUnquotedStrings(s, paths.begin(), paths.end());
 
     s += ',';
@@ -782,6 +807,8 @@ bool isDerivation(std::string_view fileName)
 
 std::string outputPathName(std::string_view drvName, OutputNameView outputName)
 {
+    using namespace std::literals::string_view_literals;
+
     std::string res{drvName};
     if (outputName != "out"sv) {
         res += '-';
@@ -790,8 +817,11 @@ std::string outputPathName(std::string_view drvName, OutputNameView outputName)
     return res;
 }
 
-DerivationType BasicDerivation::type() const
+template<typename InputsType>
+DerivationType DerivationT<InputsType>::type() const
 {
+    using namespace std::literals::string_view_literals;
+
     std::optional<HashAlgorithm> floatingHashAlgo;
     std::optional<DerivationType> ty;
 
@@ -925,7 +955,7 @@ DrvHashModulo hashDerivationModulo(Store & store, const Derivation & drv, bool m
     /* For other derivations, replace the inputs paths with recursive
        calls to this function. */
     DerivedPathMap<StringSet>::ChildNode::Map inputs2;
-    for (auto & [drvPath, node] : drv.inputDrvs.map) {
+    for (auto & [drvPath, node] : drv.inputs.drvs.map) {
         /* Need to build and resolve dynamic derivations first */
         if (!node.childMap.empty()) {
             return DrvHashModulo::DeferredDrv{};
@@ -973,7 +1003,8 @@ static DerivationOutput readDerivationOutput(Source & in, const StoreDirConfig &
     return parseDerivationOutput(store, pathS, hashAlgo, hash, experimentalFeatureSettings);
 }
 
-StringSet BasicDerivation::outputNames() const
+template<typename InputsType>
+StringSet DerivationT<InputsType>::outputNames() const
 {
     StringSet names;
     for (auto & i : outputs)
@@ -981,7 +1012,8 @@ StringSet BasicDerivation::outputNames() const
     return names;
 }
 
-DerivationOutputsAndOptPaths BasicDerivation::outputsAndOptPaths(const StoreDirConfig & store) const
+template<typename InputsType>
+DerivationOutputsAndOptPaths DerivationT<InputsType>::outputsAndOptPaths(const StoreDirConfig & store) const
 {
     DerivationOutputsAndOptPaths outsAndOptPaths;
     for (auto & [outputName, output] : outputs)
@@ -990,7 +1022,8 @@ DerivationOutputsAndOptPaths BasicDerivation::outputsAndOptPaths(const StoreDirC
     return outsAndOptPaths;
 }
 
-std::string_view BasicDerivation::nameFromPath(const StorePath & drvPath)
+template<typename InputsType>
+std::string_view DerivationT<InputsType>::nameFromPath(const StorePath & drvPath)
 {
     drvPath.requireDerivation();
     auto nameWithSuffix = drvPath.name();
@@ -1010,7 +1043,7 @@ Source & readDerivation(Source & in, const StoreDirConfig & store, BasicDerivati
         drv.outputs.emplace(std::move(name), std::move(output));
     }
 
-    drv.inputSrcs = CommonProto::Serialise<StorePathSet>::read(store, CommonProto::ReadConn{.from = in});
+    drv.inputs = CommonProto::Serialise<StorePathSet>::read(store, CommonProto::ReadConn{.from = in});
     in >> drv.platform >> drv.builder;
     drv.args = readStrings<Strings>(in);
 
@@ -1054,7 +1087,7 @@ void writeDerivation(Sink & out, const StoreDirConfig & store, const BasicDeriva
             },
             i.second.raw);
     }
-    CommonProto::write(store, CommonProto::WriteConn{.to = out}, drv.inputSrcs);
+    CommonProto::write(store, CommonProto::WriteConn{.to = out}, drv.inputs);
     out << drv.platform << drv.builder << drv.args;
 
     auto writeEnv = [&](const StringPairs atermEnv) {
@@ -1081,7 +1114,8 @@ std::string hashPlaceholder(const OutputNameView outputName)
                  .to_string(HashFormat::Nix32, false);
 }
 
-void BasicDerivation::applyRewrites(const StringMap & rewrites)
+template<typename InputsType>
+void DerivationT<InputsType>::applyRewrites(const StringMap & rewrites)
 {
     if (rewrites.empty())
         return;
@@ -1111,10 +1145,17 @@ void BasicDerivation::applyRewrites(const StringMap & rewrites)
     }
 }
 
+template<>
+Derivation DerivationT<StorePathSet>::unresolve() const
+{
+    return mapInputs([](const StorePathSet & inputs) -> FullInputs { return {.srcs = inputs, .drvs = {}}; });
+}
+
+template<>
 bool Derivation::shouldResolve() const
 {
     /* No input drvs means nothing to resolve. */
-    if (inputDrvs.map.empty())
+    if (inputs.drvs.map.empty())
         return false;
 
     auto drvType = type();
@@ -1139,22 +1180,13 @@ bool Derivation::shouldResolve() const
 
     /* Also need to resolve if any inputs are outputs of dynamic derivations. */
     bool hasDynamicInputs = std::ranges::any_of(
-        inputDrvs.map.begin(), inputDrvs.map.end(), [](auto & pair) { return !pair.second.childMap.empty(); });
+        inputs.drvs.map.begin(), inputs.drvs.map.end(), [](auto & pair) { return !pair.second.childMap.empty(); });
 
     return typeNeedsResolve || hasDynamicInputs;
 }
 
-std::optional<BasicDerivation> Derivation::tryResolve(Store & store, Store * evalStore) const
-{
-    return tryResolve(
-        store, [&](ref<const SingleDerivedPath> drvPath, const std::string & outputName) -> std::optional<StorePath> {
-            try {
-                return resolveDerivedPath(store, SingleDerivedPath::Built{drvPath, outputName}, evalStore);
-            } catch (Error &) {
-                return std::nullopt;
-            }
-        });
-}
+template<bool fillIn>
+static void processDerivationOutputPaths(Store & store, auto && drv, std::string_view drvName);
 
 static bool tryResolveInput(
     const StoreDirConfig & store,
@@ -1201,20 +1233,49 @@ static bool tryResolveInput(
     return true;
 }
 
-std::optional<BasicDerivation> Derivation::tryResolve(
+// Forward declaration of specialization
+template<>
+std::optional<BasicDerivation> DerivationT<FullInputs>::tryResolve(
+    Store & store,
+    fun<std::optional<StorePath>(ref<const SingleDerivedPath> drvPath, const std::string & outputName)>
+        queryResolutionChain) const;
+
+template<>
+std::optional<BasicDerivation> DerivationT<FullInputs>::tryResolve(Store & store, Store * evalStore) const
+{
+    return tryResolve(
+        store, [&](ref<const SingleDerivedPath> drvPath, const std::string & outputName) -> std::optional<StorePath> {
+            try {
+                return resolveDerivedPath(store, SingleDerivedPath::Built{drvPath, outputName}, evalStore);
+            } catch (Error &) {
+                return std::nullopt;
+            }
+        });
+}
+
+template<>
+std::optional<BasicDerivation> DerivationT<FullInputs>::tryResolve(
     Store & store,
     fun<std::optional<StorePath>(ref<const SingleDerivedPath> drvPath, const std::string & outputName)>
         queryResolutionChain) const
 {
-    BasicDerivation resolved{*this};
+    BasicDerivation resolved{
+        .outputs = outputs,
+        .inputs = inputs.srcs,
+        .platform = platform,
+        .builder = builder,
+        .args = args,
+        .env = env,
+        .structuredAttrs = structuredAttrs,
+        .name = name,
+    };
 
-    // Input paths that we'll want to rewrite in the derivation
     StringMap inputRewrites;
 
-    for (auto & [inputDrv, inputNode] : inputDrvs.map)
+    for (auto & [inputDrv, inputNode] : inputs.drvs.map)
         if (!tryResolveInput(
                 store,
-                resolved.inputSrcs,
+                resolved.inputs,
                 inputRewrites,
                 nullptr,
                 make_ref<const SingleDerivedPath>(SingleDerivedPath::Opaque{inputDrv}),
@@ -1224,11 +1285,9 @@ std::optional<BasicDerivation> Derivation::tryResolve(
 
     resolved.applyRewrites(inputRewrites);
 
-    Derivation resolved2{std::move(resolved)};
-
-    resolved2.fillInOutputPaths(store);
+    processDerivationOutputPaths<true>(store, resolved, resolved.name);
 
-    return resolved2;
+    return resolved;
 }
 
 /**
@@ -1260,7 +1319,11 @@ static void processDerivationOutputPaths(Store & store, auto && drv, std::string
     auto hashModulo = [&]() -> const auto & {
         if (!hashModulo_) {
             // somewhat expensive so we do lazily
-            hashModulo_ = hashDerivationModulo(store, drv, true);
+            if constexpr (std::is_same_v<std::decay_t<decltype(drv)>, Derivation>) {
+                hashModulo_ = hashDerivationModulo(store, drv, true);
+            } else {
+                hashModulo_ = hashDerivationModulo(store, drv.unresolve(), true);
+            }
         }
         return *hashModulo_;
     };
@@ -1377,7 +1440,8 @@ static void processDerivationOutputPaths(Store & store, auto && drv, std::string
     drv.type();
 }
 
-void Derivation::checkInvariants(Store & store, const StorePath & drvPath) const
+template<typename InputsType>
+void DerivationT<InputsType>::checkInvariants(Store & store, const StorePath & drvPath) const
 {
     assert(drvPath.isDerivation());
     std::string drvName(drvPath.name());
@@ -1395,16 +1459,25 @@ void Derivation::checkInvariants(Store & store, const StorePath & drvPath) const
     }
 }
 
+template<>
+void BasicDerivation::checkInvariants(Store & store) const
+{
+    processDerivationOutputPaths<false>(store, *this, name);
+}
+
+template<>
 void Derivation::checkInvariants(Store & store) const
 {
     processDerivationOutputPaths<false>(store, *this, name);
 }
 
+template<>
 void Derivation::fillInOutputPaths(Store & store)
 {
     processDerivationOutputPaths<true>(store, *this, name);
 }
 
+template<>
 Derivation Derivation::parseJsonAndValidate(Store & store, const nlohmann::json & json)
 {
     auto drv = static_cast<Derivation>(json);
@@ -1423,14 +1496,17 @@ Derivation Derivation::parseJsonAndValidate(Store & store, const nlohmann::json
 
 const Hash impureOutputHash = hashString(HashAlgorithm::SHA256, "impure");
 
+// Explicit template instantiations
+template struct DerivationT<StorePathSet>;
+template struct DerivationT<FullInputs>;
+
 } // namespace nix
 
 namespace nlohmann {
 
-using namespace nix;
-
-void adl_serializer<DerivationOutput>::to_json(json & res, const DerivationOutput & o)
+void adl_serializer<nix::DerivationOutput>::to_json(json & res, const nix::DerivationOutput & o)
 {
+    using namespace nix;
     res = nlohmann::json::object();
     std::visit(
         overloaded{
@@ -1458,9 +1534,10 @@ void adl_serializer<DerivationOutput>::to_json(json & res, const DerivationOutpu
         o.raw);
 }
 
-DerivationOutput
-adl_serializer<DerivationOutput>::from_json(const json & _json, const ExperimentalFeatureSettings & xpSettings)
+nix::DerivationOutput adl_serializer<nix::DerivationOutput>::from_json(
+    const json & _json, const nix::ExperimentalFeatureSettings & xpSettings)
 {
+    using namespace nix;
     std::set<std::string_view> keys;
     auto & json = getObject(_json);
 
@@ -1524,15 +1601,42 @@ adl_serializer<DerivationOutput>::from_json(const json & _json, const Experiment
     }
 }
 
-static void inputSrcsToJson(json & res, const StorePathSet & inputSrcs)
+static void inputsToJson(json & res, const nix::StorePathSet & inputs)
 {
     res = nlohmann::json::array();
-    for (auto & input : inputSrcs)
+    for (auto & input : inputs)
         res.emplace_back(input);
 }
 
-static void basicDerivationToJson(json & res, const BasicDerivation & d)
+static void inputsToJson(json & res, const nix::FullInputs & inputs)
 {
+    using namespace nix;
+    res = nlohmann::json::object();
+
+    inputsToJson(res["srcs"], inputs.srcs);
+
+    auto doInput = [&](this const auto & doInput, const auto & inputNode) -> nlohmann::json {
+        auto value = nlohmann::json::object();
+        value["outputs"] = inputNode.value;
+        {
+            auto next = nlohmann::json::object();
+            for (auto & [outputId, childNode] : inputNode.childMap)
+                next[outputId] = doInput(childNode);
+            value["dynamicOutputs"] = std::move(next);
+        }
+        return value;
+    };
+
+    auto & inputDrvsObj = res["drvs"];
+    inputDrvsObj = nlohmann::json::object();
+    for (auto & [inputDrv, inputNode] : inputs.drvs.map)
+        inputDrvsObj[inputDrv.to_string()] = doInput(inputNode);
+}
+
+template<typename Inputs>
+void adl_serializer<nix::DerivationT<Inputs>>::to_json(json & res, const nix::DerivationT<Inputs> & d)
+{
+    using namespace nix;
     res = nlohmann::json::object();
 
     res["name"] = d.name;
@@ -1545,6 +1649,8 @@ static void basicDerivationToJson(json & res, const BasicDerivation & d)
             outputsObj[outputName] = output;
     }
 
+    inputsToJson(res["inputs"], d.inputs);
+
     res["system"] = d.platform;
     res["builder"] = d.builder;
     res["args"] = d.args;
@@ -1554,148 +1660,119 @@ static void basicDerivationToJson(json & res, const BasicDerivation & d)
         res["structuredAttrs"] = d.structuredAttrs->structuredAttrs;
 }
 
-void adl_serializer<BasicDerivation>::to_json(json & res, const BasicDerivation & d)
-{
-    basicDerivationToJson(res, d);
-
-    inputSrcsToJson(res["inputs"], d.inputSrcs);
-}
+template<typename Inputs>
+static Inputs inputsFromJson(const json & inputsJson, const nix::ExperimentalFeatureSettings & xpSettings);
 
-void adl_serializer<Derivation>::to_json(json & res, const Derivation & d)
+template<>
+nix::StorePathSet inputsFromJson<nix::StorePathSet>(const json & inputsJson, const nix::ExperimentalFeatureSettings &)
 {
-    basicDerivationToJson(res, d);
-
-    {
-        auto & inputsObj = res["inputs"];
-        inputsObj = nlohmann::json::object();
-
-        inputSrcsToJson(inputsObj["srcs"], d.inputSrcs);
-
-        auto doInput = [&](this const auto & doInput, const auto & inputNode) -> nlohmann::json {
-            auto value = nlohmann::json::object();
-            value["outputs"] = inputNode.value;
-            {
-                auto next = nlohmann::json::object();
-                for (auto & [outputId, childNode] : inputNode.childMap)
-                    next[outputId] = doInput(childNode);
-                value["dynamicOutputs"] = std::move(next);
-            }
-            return value;
-        };
-
-        auto & inputDrvsObj = inputsObj["drvs"];
-        inputDrvsObj = nlohmann::json::object();
-        for (auto & [inputDrv, inputNode] : d.inputDrvs.map)
-            inputDrvsObj[inputDrv.to_string()] = doInput(inputNode);
-    }
-}
-
-static void inputSrcsFromJson(const json & inputSrcsJson, StorePathSet & inputSrcs)
-{
-    auto arr = getArray(inputSrcsJson);
-    for (auto & input : arr)
+    using namespace nix;
+    StorePathSet inputSrcs;
+    for (auto & input : getArray(inputsJson))
         inputSrcs.insert(input);
+    return inputSrcs;
 }
 
-static void basicDerivationFromJson(
-    const json::object_t & json, BasicDerivation & res, const ExperimentalFeatureSettings & xpSettings)
+template<>
+nix::FullInputs
+inputsFromJson<nix::FullInputs>(const json & inputsJson, const nix::ExperimentalFeatureSettings & xpSettings)
 {
-    res.name = getString(valueAt(json, "name"));
+    using namespace nix;
 
-    {
-        auto version = getUnsigned(valueAt(json, "version"));
-        if (valueAt(json, "version") != expectedJsonVersionDerivation)
-            throw Error(
-                "Unsupported derivation JSON format version %d, only format version %d is currently supported.",
-                version,
-                expectedJsonVersionDerivation);
-    }
+    auto inputsObj = getObject(inputsJson);
+    FullInputs inputs;
 
     try {
-        auto outputs = getObject(valueAt(json, "outputs"));
-        for (auto & [outputName, output] : outputs) {
-            res.outputs.insert_or_assign(outputName, adl_serializer<DerivationOutput>::from_json(output, xpSettings));
-        }
+        for (auto & input : getArray(valueAt(inputsObj, "srcs")))
+            inputs.srcs.insert(input);
     } catch (Error & e) {
-        e.addTrace({}, "while reading key 'outputs'");
+        e.addTrace({}, "while reading key 'srcs'");
         throw;
     }
 
-    res.platform = getString(valueAt(json, "system"));
-    res.builder = getString(valueAt(json, "builder"));
-    res.args = getStringList(valueAt(json, "args"));
-
-    auto envJson = valueAt(json, "env");
     try {
-        res.env = getStringMap(envJson);
+        auto doInput = [&](this const auto & doInput, const auto & _json) -> DerivedPathMap<StringSet>::ChildNode {
+            auto & json = getObject(_json);
+            DerivedPathMap<StringSet>::ChildNode node;
+            node.value = getStringSet(valueAt(json, "outputs"));
+            for (auto & [outputId, childNode] : getObject(valueAt(json, "dynamicOutputs"))) {
+                xpSettings.require(
+                    Xp::DynamicDerivations, [&] { return fmt("dynamic output '%s' in JSON", outputId); });
+                node.childMap[outputId] = doInput(childNode);
+            }
+            return node;
+        };
+        for (auto & [inputDrvPath, inputOutputs] : getObject(valueAt(inputsObj, "drvs")))
+            inputs.drvs.map[StorePath{inputDrvPath}] = doInput(inputOutputs);
     } catch (Error & e) {
-        e.addTrace({}, "while reading key 'env'");
+        e.addTrace({}, "while reading key 'drvs'");
         throw;
     }
 
-    if (auto structuredAttrs = get(json, "structuredAttrs"))
-        res.structuredAttrs = StructuredAttrs{*structuredAttrs};
+    return inputs;
 }
 
-BasicDerivation
-adl_serializer<BasicDerivation>::from_json(const json & _json, const ExperimentalFeatureSettings & xpSettings)
+template<typename Inputs>
+nix::DerivationT<Inputs> adl_serializer<nix::DerivationT<Inputs>>::from_json(
+    const json & _json, const nix::ExperimentalFeatureSettings & xpSettings)
 {
-    BasicDerivation res;
-    auto & json = getObject(_json);
-    basicDerivationFromJson(json, res, xpSettings);
-
-    try {
-        inputSrcsFromJson(valueAt(json, "inputs"), res.inputSrcs);
-    } catch (Error & e) {
-        e.addTrace({}, "while reading key 'inputs'");
-        throw;
-    }
-
-    return res;
-}
+    using namespace nix;
 
-Derivation adl_serializer<Derivation>::from_json(const json & _json, const ExperimentalFeatureSettings & xpSettings)
-{
-    Derivation res;
     auto & json = getObject(_json);
-    basicDerivationFromJson(json, res, xpSettings);
-
-    try {
-        auto inputsObj = getObject(valueAt(json, "inputs"));
-
-        try {
-            inputSrcsFromJson(valueAt(inputsObj, "srcs"), res.inputSrcs);
-        } catch (Error & e) {
-            e.addTrace({}, "while reading key 'srcs'");
-            throw;
-        }
-
-        try {
-            auto doInput = [&](this const auto & doInput, const auto & _json) -> DerivedPathMap<StringSet>::ChildNode {
-                auto & json = getObject(_json);
-                DerivedPathMap<StringSet>::ChildNode node;
-                node.value = getStringSet(valueAt(json, "outputs"));
-                auto drvs = getObject(valueAt(json, "dynamicOutputs"));
-                for (auto & [outputId, childNode] : drvs) {
-                    xpSettings.require(
-                        Xp::DynamicDerivations, [&] { return fmt("dynamic output '%s' in JSON", outputId); });
-                    node.childMap[outputId] = doInput(childNode);
-                }
-                return node;
-            };
-            auto drvs = getObject(valueAt(inputsObj, "drvs"));
-            for (auto & [inputDrvPath, inputOutputs] : drvs)
-                res.inputDrvs.map[StorePath{inputDrvPath}] = doInput(inputOutputs);
-        } catch (Error & e) {
-            e.addTrace({}, "while reading key 'drvs'");
-            throw;
-        }
-    } catch (Error & e) {
-        e.addTrace({}, "while reading key 'inputs'");
-        throw;
+    {
+        auto version = getUnsigned(valueAt(json, "version"));
+        if (version != expectedJsonVersionDerivation)
+            throw Error(
+                "Unsupported derivation JSON format version %d, only format version %d is currently supported.",
+                version,
+                expectedJsonVersionDerivation);
     }
 
-    return res;
+    return DerivationT<Inputs>{
+        .outputs =
+            [&] {
+                DerivationOutputs outputs;
+                try {
+                    for (auto & [outputName, output] : getObject(valueAt(json, "outputs")))
+                        outputs.insert_or_assign(
+                            outputName, adl_serializer<DerivationOutput>::from_json(output, xpSettings));
+                } catch (Error & e) {
+                    e.addTrace({}, "while reading key 'outputs'");
+                    throw;
+                }
+                return outputs;
+            }(),
+        .inputs =
+            [&] {
+                try {
+                    return inputsFromJson<Inputs>(valueAt(json, "inputs"), xpSettings);
+                } catch (Error & e) {
+                    e.addTrace({}, "while reading key 'inputs'");
+                    throw;
+                }
+            }(),
+        .platform = getString(valueAt(json, "system")),
+        .builder = getString(valueAt(json, "builder")),
+        .args = getStringList(valueAt(json, "args")),
+        .env =
+            [&] {
+                try {
+                    return getStringMap(valueAt(json, "env"));
+                } catch (Error & e) {
+                    e.addTrace({}, "while reading key 'env'");
+                    throw;
+                }
+            }(),
+        .structuredAttrs = [&]() -> std::optional<StructuredAttrs> {
+            if (auto structuredAttrs = get(json, "structuredAttrs"))
+                return StructuredAttrs{*structuredAttrs};
+            return std::nullopt;
+        }(),
+        .name = getString(valueAt(json, "name")),
+    };
 }
 
+template struct adl_serializer<nix::BasicDerivation>;
+template struct adl_serializer<nix::Derivation>;
+
 } // namespace nlohmann
diff --git a/src/libstore/derived-path.cc b/src/libstore/derived-path.cc
index 131674aa5595..0aa7c4d34c35 100644
--- a/src/libstore/derived-path.cc
+++ b/src/libstore/derived-path.cc
@@ -224,17 +224,17 @@ const StorePath & DerivedPath::getBaseStorePath() const
 
 namespace nlohmann {
 
-void adl_serializer<SingleDerivedPath::Opaque>::to_json(json & json, const SingleDerivedPath::Opaque & o)
+void adl_serializer<nix::SingleDerivedPath::Opaque>::to_json(json & json, const nix::SingleDerivedPath::Opaque & o)
 {
     json = o.path;
 }
 
-SingleDerivedPath::Opaque adl_serializer<SingleDerivedPath::Opaque>::from_json(const json & json)
+nix::SingleDerivedPath::Opaque adl_serializer<nix::SingleDerivedPath::Opaque>::from_json(const json & json)
 {
-    return SingleDerivedPath::Opaque{json};
+    return {json};
 }
 
-void adl_serializer<SingleDerivedPath::Built>::to_json(json & json, const SingleDerivedPath::Built & sdpb)
+void adl_serializer<nix::SingleDerivedPath::Built>::to_json(json & json, const nix::SingleDerivedPath::Built & sdpb)
 {
     json = {
         {"drvPath", *sdpb.drvPath},
@@ -242,7 +242,7 @@ void adl_serializer<SingleDerivedPath::Built>::to_json(json & json, const Single
     };
 }
 
-void adl_serializer<DerivedPath::Built>::to_json(json & json, const DerivedPath::Built & dbp)
+void adl_serializer<nix::DerivedPath::Built>::to_json(json & json, const nix::DerivedPath::Built & dbp)
 {
     json = {
         {"drvPath", *dbp.drvPath},
@@ -250,9 +250,10 @@ void adl_serializer<DerivedPath::Built>::to_json(json & json, const DerivedPath:
     };
 }
 
-SingleDerivedPath::Built
-adl_serializer<SingleDerivedPath::Built>::from_json(const json & json0, const ExperimentalFeatureSettings & xpSettings)
+nix::SingleDerivedPath::Built adl_serializer<nix::SingleDerivedPath::Built>::from_json(
+    const json & json0, const nix::ExperimentalFeatureSettings & xpSettings)
 {
+    using namespace nix;
     auto & json = getObject(json0);
     auto drvPath = make_ref<SingleDerivedPath>(static_cast<SingleDerivedPath>(valueAt(json, "drvPath")));
     drvRequireExperiment(*drvPath, xpSettings);
@@ -262,9 +263,10 @@ adl_serializer<SingleDerivedPath::Built>::from_json(const json & json0, const Ex
     };
 }
 
-DerivedPath::Built
-adl_serializer<DerivedPath::Built>::from_json(const json & json0, const ExperimentalFeatureSettings & xpSettings)
+nix::DerivedPath::Built adl_serializer<nix::DerivedPath::Built>::from_json(
+    const json & json0, const nix::ExperimentalFeatureSettings & xpSettings)
 {
+    using namespace nix;
     auto & json = getObject(json0);
     auto drvPath = make_ref<SingleDerivedPath>(static_cast<SingleDerivedPath>(valueAt(json, "drvPath")));
     drvRequireExperiment(*drvPath, xpSettings);
@@ -274,31 +276,32 @@ adl_serializer<DerivedPath::Built>::from_json(const json & json0, const Experime
     };
 }
 
-void adl_serializer<SingleDerivedPath>::to_json(json & json, const SingleDerivedPath & sdp)
+void adl_serializer<nix::SingleDerivedPath>::to_json(json & json, const nix::SingleDerivedPath & sdp)
 {
     std::visit([&](const auto & buildable) { json = buildable; }, sdp.raw());
 }
 
-void adl_serializer<DerivedPath>::to_json(json & json, const DerivedPath & sdp)
+void adl_serializer<nix::DerivedPath>::to_json(json & json, const nix::DerivedPath & sdp)
 {
     std::visit([&](const auto & buildable) { json = buildable; }, sdp.raw());
 }
 
-SingleDerivedPath
-adl_serializer<SingleDerivedPath>::from_json(const json & json, const ExperimentalFeatureSettings & xpSettings)
+nix::SingleDerivedPath adl_serializer<nix::SingleDerivedPath>::from_json(
+    const json & json, const nix::ExperimentalFeatureSettings & xpSettings)
 {
     if (json.is_string())
-        return static_cast<SingleDerivedPath::Opaque>(json);
+        return static_cast<nix::SingleDerivedPath::Opaque>(json);
     else
-        return adl_serializer<SingleDerivedPath::Built>::from_json(json, xpSettings);
+        return adl_serializer<nix::SingleDerivedPath::Built>::from_json(json, xpSettings);
 }
 
-DerivedPath adl_serializer<DerivedPath>::from_json(const json & json, const ExperimentalFeatureSettings & xpSettings)
+nix::DerivedPath
+adl_serializer<nix::DerivedPath>::from_json(const json & json, const nix::ExperimentalFeatureSettings & xpSettings)
 {
     if (json.is_string())
-        return static_cast<DerivedPath::Opaque>(json);
+        return static_cast<nix::DerivedPath::Opaque>(json);
     else
-        return adl_serializer<DerivedPath::Built>::from_json(json, xpSettings);
+        return adl_serializer<nix::DerivedPath::Built>::from_json(json, xpSettings);
 }
 
 } // namespace nlohmann
diff --git a/src/libstore/downstream-placeholder.cc b/src/libstore/downstream-placeholder.cc
index 73ed2b74a7b6..4a73e9daf3ed 100644
--- a/src/libstore/downstream-placeholder.cc
+++ b/src/libstore/downstream-placeholder.cc
@@ -53,11 +53,11 @@ DownstreamPlaceholder DownstreamPlaceholder::fromSingleDerivedPathBuilt(
 
 namespace nlohmann {
 
-using namespace nix;
-
 template<typename Item>
-DrvRef<Item> adl_serializer<DrvRef<Item>>::from_json(const json & json)
+nix::DrvRef<Item> adl_serializer<nix::DrvRef<Item>>::from_json(const json & json)
 {
+    using namespace nix;
+
     // OutputName case: { "drvPath": "self", "output": <output> }
     if (json.type() == nlohmann::json::value_t::object) {
         auto & obj = getObject(json);
@@ -74,8 +74,10 @@ DrvRef<Item> adl_serializer<DrvRef<Item>>::from_json(const json & json)
 }
 
 template<typename Item>
-void adl_serializer<DrvRef<Item>>::to_json(json & json, const DrvRef<Item> & ref)
+void adl_serializer<nix::DrvRef<Item>>::to_json(json & json, const nix::DrvRef<Item> & ref)
 {
+    using namespace nix;
+
     std::visit(
         overloaded{
             [&](const OutputName & outputName) {
@@ -88,7 +90,7 @@ void adl_serializer<DrvRef<Item>>::to_json(json & json, const DrvRef<Item> & ref
         ref);
 }
 
-template struct adl_serializer<nix::DrvRef<StorePath>>;
-template struct adl_serializer<nix::DrvRef<SingleDerivedPath>>;
+template struct adl_serializer<nix::DrvRef<nix::StorePath>>;
+template struct adl_serializer<nix::DrvRef<nix::SingleDerivedPath>>;
 
 } // namespace nlohmann
diff --git a/src/libstore/dummy-store.cc b/src/libstore/dummy-store.cc
index 052ec9b1283e..d03b7f6fdb72 100644
--- a/src/libstore/dummy-store.cc
+++ b/src/libstore/dummy-store.cc
@@ -10,6 +10,10 @@
 
 namespace nix {
 
+void DummyStoreConfig::anchor() {}
+
+void DummyStore::anchor() {}
+
 std::string DummyStoreConfig::doc()
 {
     return
@@ -31,6 +35,8 @@ namespace {
 
 class WholeStoreViewAccessor : public SourceAccessor
 {
+    void anchor() override {};
+
     using BaseName = std::string;
 
     /**
@@ -63,6 +69,8 @@ class WholeStoreViewAccessor : public SourceAccessor
         });
 
         if (!res)
+            /* The accessor is truly empty, i.e. without any file at root so
+               any subsequent operation with it will fail. */
             res = &emptyAccessor;
 
         return callback(*res, path);
@@ -101,6 +109,7 @@ class WholeStoreViewAccessor : public SourceAccessor
 
     DirEntries readDirectory(const CanonPath & path) override
     {
+        /* FIXME: Special-case the root directory to read the whole store, not just an empty root. */
         return callWithAccessorForPath(
             path, [](SourceAccessor & accessor, const CanonPath & path) { return accessor.readDirectory(path); });
     }
@@ -126,6 +135,10 @@ bool DummyStoreConfig::getReadOnly() const
 
 struct DummyStoreImpl : DummyStore
 {
+private:
+    void anchor() override;
+
+public:
     using Config = DummyStoreConfig;
 
     /**
@@ -378,6 +391,8 @@ struct DummyStoreImpl : DummyStore
     }
 };
 
+void DummyStoreImpl::anchor() {}
+
 ref<DummyStore> DummyStore::Config::openDummyStore() const
 {
     return make_ref<DummyStoreImpl>(ref{shared_from_this()});
@@ -389,10 +404,9 @@ static RegisterStoreImplementation<DummyStore::Config> regDummyStore;
 
 namespace nlohmann {
 
-using namespace nix;
-
-DummyStore::PathInfoAndContents adl_serializer<DummyStore::PathInfoAndContents>::from_json(const json & json)
+nix::DummyStore::PathInfoAndContents adl_serializer<nix::DummyStore::PathInfoAndContents>::from_json(const json & json)
 {
+    using namespace nix;
     auto & obj = getObject(json);
     return DummyStore::PathInfoAndContents{
         .info = valueAt(obj, "info"),
@@ -400,7 +414,8 @@ DummyStore::PathInfoAndContents adl_serializer<DummyStore::PathInfoAndContents>:
     };
 }
 
-void adl_serializer<DummyStore::PathInfoAndContents>::to_json(json & json, const DummyStore::PathInfoAndContents & val)
+void adl_serializer<nix::DummyStore::PathInfoAndContents>::to_json(
+    json & json, const nix::DummyStore::PathInfoAndContents & val)
 {
     json = {
         {"info", val.info},
@@ -408,8 +423,9 @@ void adl_serializer<DummyStore::PathInfoAndContents>::to_json(json & json, const
     };
 }
 
-ref<DummyStoreConfig> adl_serializer<ref<DummyStore::Config>>::from_json(const json & json)
+nix::ref<nix::DummyStoreConfig> adl_serializer<nix::ref<nix::DummyStore::Config>>::from_json(const json & json)
 {
+    using namespace nix;
     auto & obj = getObject(json);
     auto cfg = make_ref<DummyStore::Config>(DummyStore::Config::Params{});
     cfg->storeDir_.set(getString(valueAt(obj, "store")));
@@ -417,15 +433,16 @@ ref<DummyStoreConfig> adl_serializer<ref<DummyStore::Config>>::from_json(const j
     return cfg;
 }
 
-void adl_serializer<DummyStoreConfig>::to_json(json & json, const DummyStoreConfig & val)
+void adl_serializer<nix::DummyStoreConfig>::to_json(json & json, const nix::DummyStoreConfig & val)
 {
     json = {
         {"store", val.storeDir},
     };
 }
 
-ref<DummyStore> adl_serializer<ref<DummyStore>>::from_json(const json & json)
+nix::ref<nix::DummyStore> adl_serializer<nix::ref<nix::DummyStore>>::from_json(const json & json)
 {
+    using namespace nix;
     auto & obj = getObject(json);
     ref<DummyStore> res = adl_serializer<ref<DummyStoreConfig>>::from_json(valueAt(obj, "config"))->openDummyStore();
     for (auto & [k, v] : getObject(valueAt(obj, "contents")))
@@ -442,8 +459,9 @@ ref<DummyStore> adl_serializer<ref<DummyStore>>::from_json(const json & json)
     return res;
 }
 
-void adl_serializer<DummyStore>::to_json(json & json, const DummyStore & val)
+void adl_serializer<nix::DummyStore>::to_json(json & json, const nix::DummyStore & val)
 {
+    using namespace nix;
     json = {
         {"config", *val.config},
         {"contents",
diff --git a/src/libstore/export-import.cc b/src/libstore/export-import.cc
index b1c61626c8c7..c0b76158a822 100644
--- a/src/libstore/export-import.cc
+++ b/src/libstore/export-import.cc
@@ -37,9 +37,8 @@ static void exportPath(Store & store, const StorePath & path, Sink & sink)
 void exportPaths(Store & store, const StorePathSet & paths, Sink & sink)
 {
     auto sorted = store.topoSortPaths(paths);
-    std::reverse(sorted.begin(), sorted.end());
 
-    for (auto & path : sorted) {
+    for (auto & path : sorted | std::views::reverse) {
         sink << 1;
         exportPath(store, path, sink);
     }
diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc
index 85bc650dc8d4..6e9f2256eaa0 100644
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@@ -23,6 +23,7 @@
 #include <curl/curl.h>
 
 #include <algorithm>
+#include <array>
 #include <cstring>
 #include <queue>
 #include <random>
@@ -96,6 +97,8 @@ std::optional<std::filesystem::path> FileTransferSettings::getDefaultSSLCertFile
     return std::nullopt;
 }
 
+void FileTransferSettings::anchor() {}
+
 FileTransferSettings::FileTransferSettings()
 {
     std::optional<AbsolutePath> sslOverride =
@@ -113,6 +116,8 @@ FileTransferSettings fileTransferSettings;
 
 static GlobalConfig::Register rFileTransferSettings(&fileTransferSettings);
 
+FileTransfer::~FileTransfer() {}
+
 namespace {
 
 using curlSList = std::unique_ptr<::curl_slist, decltype([](::curl_slist * list) { ::curl_slist_free_all(list); })>;
@@ -129,12 +134,21 @@ struct curlMultiError final : CloneableError<curlMultiError, Error>
     }
 };
 
+/* Check if the linked libcurl was built with HTTP3 support. */
+bool curlSupportsHttp3()
+{
+    const auto * info = ::curl_version_info(CURLVERSION_NOW);
+    return info && (info->features & CURL_VERSION_HTTP3);
+}
+
 } // namespace
 
 struct curlFileTransfer : public FileTransfer
 {
     const FileTransferSettings & settings;
 
+    const bool http3Supported = curlSupportsHttp3();
+
     curlMulti curlm;
 
     std::random_device rd;
@@ -280,8 +294,7 @@ struct curlFileTransfer : public FileTransfer
             }
             try {
                 if (!done && enqueued)
-                    fail(FileTransferError(
-                        Interrupted, {}, "%s of '%s' was interrupted", Uncolored(request.noun()), request.uri));
+                    failInterruptedOrCancelled();
             } catch (...) {
                 ignoreExceptionInDestructor();
             }
@@ -297,7 +310,7 @@ struct curlFileTransfer : public FileTransfer
                 /* Already descriptive enough. */
             } catch (nix::Error & e) {
                 /* Add more context to the error message. */
-                e.addTrace({}, "during %s of '%s'", Uncolored(request.noun()), request.uri.to_string());
+                e.addTrace({}, "during %s of '%s'", Uncolored(request.noun()), request.displayUri());
             } catch (...) {
                 /* Can't add more context to the error. */
             }
@@ -310,6 +323,18 @@ struct curlFileTransfer : public FileTransfer
             failEx(std::make_exception_ptr(std::forward<T>(e)));
         }
 
+        void failInterruptedOrCancelled()
+        {
+            HintFmt fmt("%s of '%s' was interrupted", Uncolored(request.noun()), request.displayUri());
+
+            /* Technically, we don't really have per-transfer cancellation currently,
+               but it's nice to distinguish between the two in the future. */
+            if (getInterrupted())
+                fail(nix::Interrupted(std::move(fmt)));
+            else
+                fail(nix::Cancelled(std::move(fmt)));
+        }
+
         LambdaSink finalSink;
         std::optional<StringSink> errorSink;
 
@@ -361,7 +386,7 @@ struct curlFileTransfer : public FileTransfer
         try {
             size_t realSize = size * nmemb;
             std::string line((char *) contents, realSize);
-            printMsg(lvlVomit, "got header for '%s': %s", request.uri, trim(line));
+            printMsg(lvlVomit, "got header for '%s': %s", request.displayUri(), trim(line));
 
             static std::regex statusLine("HTTP/[^ ]+ +[0-9]+(.*)", std::regex::extended | std::regex::icase);
             if (std::smatch match; std::regex_match(line, match, statusLine)) {
@@ -450,8 +475,8 @@ struct curlFileTransfer : public FileTransfer
                     *logger,
                     lvlTalkative,
                     actFileTransfer,
-                    fmt("%s '%s'", request.verb(/*continuous=*/true), request.uri),
-                    Logger::Fields{request.uri.to_string()},
+                    fmt("%s '%s'", request.verb(/*continuous=*/true), request.displayUri()),
+                    Logger::Fields{request.displayUri()},
                     request.parentAct);
                 // Reset the start time to when we actually started the download.
                 startTime = std::chrono::steady_clock::now();
@@ -590,7 +615,10 @@ struct curlFileTransfer : public FileTransfer
                                                                 : ""))
                     .c_str());
             curl_easy_setopt(req, CURLOPT_PIPEWAIT, 1);
-            if (fileTransfer.settings.enableHttp2)
+            /* Enable HTTP3 only on user config and linked libcurl have support, o.w. fall back. */
+            if (fileTransfer.settings.enableHttp3 && fileTransfer.http3Supported)
+                curl_easy_setopt(req, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_3);
+            else if (fileTransfer.settings.enableHttp2)
                 curl_easy_setopt(req, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
             else
                 curl_easy_setopt(req, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
@@ -651,6 +679,14 @@ struct curlFileTransfer : public FileTransfer
 #endif
             curl_easy_setopt(req, CURLOPT_CONNECTTIMEOUT, fileTransfer.settings.connectTimeout.get());
 
+            /* Enable TCP keepalive to detect dead connections and server closures.
+               Probes every 30s to catch network failures and idle timeouts early. */
+            curl_easy_setopt(req, CURLOPT_TCP_KEEPALIVE, 1L);
+            curl_easy_setopt(req, CURLOPT_TCP_KEEPIDLE, 30L);
+            curl_easy_setopt(req, CURLOPT_TCP_KEEPINTVL, 30L);
+            /* Don't reuse idle connections older than 90s. */
+            curl_easy_setopt(req, CURLOPT_MAXAGE_CONN, 90L);
+
             curl_easy_setopt(req, CURLOPT_LOW_SPEED_LIMIT, 1L);
             curl_easy_setopt(req, CURLOPT_LOW_SPEED_TIME, fileTransfer.settings.stalledDownloadTimeout.get());
 
@@ -716,7 +752,7 @@ struct curlFileTransfer : public FileTransfer
             debug(
                 "finished %s of '%s'; curl status = %d, HTTP status = %d, body = %d bytes, duration = %.2f s",
                 Uncolored(request.noun()),
-                request.uri,
+                request.displayUri(),
                 code,
                 httpStatus,
                 result.bodySize,
@@ -752,14 +788,47 @@ struct curlFileTransfer : public FileTransfer
                 // We treat most errors as transient, but won't retry when hopeless
                 Error err = Transient;
 
-                if (httpStatus == HttpStatus::NotFound || httpStatus == HttpStatus::Gone
+                // S3 returns certain retryable errors as HTTP 400/500/503 with XML error codes.
+                // These take precedence over the generic HTTP status handling below.
+                // Only parse the response body on status codes where S3 XML errors can appear.
+                static constexpr std::array<std::string_view, 12> s3RetryableErrors{{
+                    "IncompleteBody",       // HTTP 400 - network issue
+                    "InternalError",        // HTTP 500 - S3 internal failure
+                    "InternalFailure",      // HTTP 500 - alias for InternalError
+                    "InternalServerError",  // HTTP 500 - alias for InternalError
+                    "RequestExpired",       // HTTP 400 - clock skew / slow upload
+                    "RequestTimeout",       // HTTP 400 - stale connection reuse
+                    "RequestTimeTooSkewed", // HTTP 403 - clock drift
+                    "RequestThrottled",     // HTTP 400 - throttling variant
+                    "SlowDown",             // HTTP 503 - throttling
+                    "ServiceUnavailable",   // HTTP 503 - temporary unavailability
+                    "Throttling",           // HTTP 400 - throttling variant
+                    "ThrottledException",   // HTTP 400 - throttling variant
+                }};
+                // S3 error responses have the form <Error><Code>...</Code>...</Error>.
+                // Require the <Error> root to avoid matching unrelated XML with a <Code> element.
+                static std::regex s3ErrorCodeRegex("<Error>[^]*<Code>([^<]+)</Code>");
+                std::smatch s3Match;
+                bool isS3XmlStatus = httpStatus == 400 || httpStatus == 403 || httpStatus == 500 || httpStatus == 503;
+                auto s3ErrorCode =
+                    (isS3XmlStatus && errorSink && std::regex_search(errorSink->s, s3Match, s3ErrorCodeRegex))
+                        ? s3Match[1].str()
+                        : "";
+
+                if (std::find(s3RetryableErrors.begin(), s3RetryableErrors.end(), s3ErrorCode)
+                    != s3RetryableErrors.end()) {
+                    debug("S3 error '%s', will retry", s3ErrorCode);
+                } else if (
+                    httpStatus == HttpStatus::NotFound || httpStatus == HttpStatus::Gone
                     || code == CURLE_FILE_COULDNT_READ_FILE) {
                     // The file is definitely not there
                     err = NotFound;
-                } else if (
-                    httpStatus == HttpStatus::Unauthorized || httpStatus == HttpStatus::Forbidden
-                    || httpStatus == HttpStatus::ProxyAuthRequired) {
-                    // Don't retry on authentication/authorization failures
+                } else if (httpStatus == HttpStatus::Unauthorized || httpStatus == HttpStatus::ProxyAuthRequired) {
+                    err = Unauthorized;
+                } else if (httpStatus == HttpStatus::Forbidden) {
+                    // Don't retry on authentication/authorization failures.
+                    // Note: the only reason we treat this differently from 401/407 is S3 returns 403 if a file doesn't
+                    // exist and the bucket is unlistable.
                     err = Forbidden;
                 } else if (
                     httpStatus >= 400 && httpStatus < 500 && httpStatus != HttpStatus::RequestTimeout
@@ -810,19 +879,20 @@ struct curlFileTransfer : public FileTransfer
                 std::optional<std::string> response;
                 if (errorSink)
                     response = std::move(errorSink->s);
-                auto exc = code == CURLE_ABORTED_BY_CALLBACK && getInterrupted() ? FileTransferError(
-                                                                                       Interrupted,
-                                                                                       std::move(response),
-                                                                                       "%s of '%s' was interrupted",
-                                                                                       Uncolored(request.noun()),
-                                                                                       request.uri)
-                           : httpStatus != 0
+
+                /* TODO: Also support per-transfer cancellations. */
+                if (code == CURLE_ABORTED_BY_CALLBACK && getInterrupted()) {
+                    failInterruptedOrCancelled();
+                    return;
+                }
+
+                auto exc = httpStatus != 0
                                ? FileTransferError(
                                      err,
                                      std::move(response),
                                      "unable to %s '%s': HTTP error %d%s",
                                      Uncolored(request.verb()),
-                                     request.uri,
+                                     request.displayUri(),
                                      httpStatus,
                                      code == CURLE_OK ? "" : fmt(" (curl error: %s)", curl_easy_strerror(code)))
                                : FileTransferError(
@@ -830,7 +900,7 @@ struct curlFileTransfer : public FileTransfer
                                      std::move(response),
                                      "unable to %s '%s': %s (%d) %s",
                                      Uncolored(request.verb()),
-                                     request.uri,
+                                     request.displayUri(),
                                      curl_easy_strerror(code),
                                      code,
                                      errbuf);
@@ -927,6 +997,8 @@ struct curlFileTransfer : public FileTransfer
     private:
         bool quitting = false;
     public:
+        bool work = false;
+
         void quit()
         {
             quitting = true;
@@ -969,25 +1041,19 @@ struct curlFileTransfer : public FileTransfer
         workerThread = std::thread([&]() { workerThreadEntry(); });
     }
 
-    ~curlFileTransfer()
-    {
-        try {
-            stopWorkerThread();
-        } catch (...) {
-            ignoreExceptionInDestructor();
-        }
-        workerThread.join();
-    }
+    ~curlFileTransfer() override;
 
     void stopWorkerThread()
     {
         /* Signal the worker thread to exit. */
-        state_.lock()->quit();
-        wakeupMulti();
+        auto state(state_.lock());
+        state->quit();
+        wakeupMulti(*state);
     }
 
-    void wakeupMulti()
+    void wakeupMulti(State & state)
     {
+        state.work = true;
         if (auto ec = ::curl_multi_wakeup(curlm.get()))
             throw curlMultiError(ec);
     }
@@ -1037,25 +1103,12 @@ struct curlFileTransfer : public FileTransfer
                 }
             }
 
-            /* Wait for activity, including wakeup events. */
-            long maxSleepTimeMs = items.empty() ? 10000 : 100;
-            auto sleepTimeMs = nextWakeup != std::chrono::steady_clock::time_point()
-                                   ? std::max(
-                                         0,
-                                         (int) std::chrono::duration_cast<std::chrono::milliseconds>(
-                                             nextWakeup - std::chrono::steady_clock::now())
-                                             .count())
-                                   : maxSleepTimeMs;
-
-            int numfds = 0;
-            mc = curl_multi_poll(curlm.get(), nullptr, 0, sleepTimeMs, &numfds);
-            if (mc != CURLM_OK)
-                throw curlMultiError(mc);
-
             nextWakeup = std::chrono::steady_clock::time_point();
 
             std::vector<std::shared_ptr<TransferItem>> incoming;
+            std::vector<std::weak_ptr<Item>> unpause;
             auto now = std::chrono::steady_clock::now();
+            bool haveWork;
 
             {
                 auto state(state_.lock());
@@ -1077,25 +1130,23 @@ struct curlFileTransfer : public FileTransfer
                         break;
                     }
                 }
+                unpause = std::exchange(state->unpause, {});
                 quit = state->isQuitting();
+                haveWork = std::exchange(state->work, false);
             }
 
             for (auto & item : incoming) {
-                debug("starting %s of '%s'", Uncolored(item->request.noun()), item->request.uri);
+                debug("starting %s of '%s'", Uncolored(item->request.noun()), item->request.displayUri());
                 item->init();
                 curl_multi_add_handle(curlm.get(), item->req);
                 item->active = true;
                 items[item->req] = item;
             }
 
-            /* NOTE: Unpausing may invoke callbacks to flush all buffers. */
-            auto unpause = [&]() {
-                auto state(state_.lock());
-                auto res = state->unpause;
-                state->unpause.clear();
-                return res;
-            }();
+            if (quit)
+                break;
 
+            /* NOTE: Unpausing may invoke callbacks to flush all buffers. */
             for (auto & item : unpause) {
                 /* The transfer might have completed (failed) between it getting
                    enqueued for unpause and by the time the worker thread picked
@@ -1105,6 +1156,26 @@ struct curlFileTransfer : public FileTransfer
                     continue;
                 static_cast<TransferItem &>(*ptr).unpause();
             }
+
+            /* Wait for activity, including wakeup events. */
+            long maxSleepTimeMs = items.empty() ? 10000 : 100;
+            auto sleepTimeMs = nextWakeup != std::chrono::steady_clock::time_point()
+                                   ? std::max(
+                                         0,
+                                         (int) std::chrono::duration_cast<std::chrono::milliseconds>(
+                                             nextWakeup - std::chrono::steady_clock::now())
+                                             .count())
+                                   : maxSleepTimeMs;
+
+            /* Since https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23 (8.21),
+               curl_multi_perform seems to swallow queued up events ¯\_(ツ)_/¯. */
+            if (haveWork)
+                sleepTimeMs = 0;
+
+            int numfds = 0;
+            mc = curl_multi_poll(curlm.get(), nullptr, 0, sleepTimeMs, &numfds);
+            if (mc != CURLM_OK)
+                throw curlMultiError(mc);
         }
 
         debug("download thread shutting down");
@@ -1133,7 +1204,7 @@ struct curlFileTransfer : public FileTransfer
     {
         if (item->request.data && item->request.uri.scheme() != "http" && item->request.uri.scheme() != "https"
             && item->request.uri.scheme() != "s3")
-            throw nix::Error("uploading to '%s' is not supported", item->request.uri.to_string());
+            throw nix::Error("uploading to '%s' is not supported", item->request.displayUri());
 
         {
             auto state(state_.lock());
@@ -1141,9 +1212,9 @@ struct curlFileTransfer : public FileTransfer
                 throw nix::Error("cannot enqueue download request because the download thread is shutting down");
             state->incoming.push(item);
             item->enqueued = true; /* Now any exceptions should be reported via the callback. */
+            wakeupMulti(*state);
         }
 
-        wakeupMulti();
         return ItemHandle(item.get_ptr());
     }
 
@@ -1163,7 +1234,7 @@ struct curlFileTransfer : public FileTransfer
     {
         auto state(state_.lock());
         state->unpause.push_back(std::move(item));
-        wakeupMulti();
+        wakeupMulti(*state);
     }
 
     void unpauseTransfer(ItemHandle handle) override
@@ -1174,19 +1245,31 @@ struct curlFileTransfer : public FileTransfer
     }
 };
 
+curlFileTransfer::~curlFileTransfer()
+{
+    try {
+        stopWorkerThread();
+    } catch (...) {
+        ignoreExceptionInDestructor();
+    }
+    workerThread.join();
+}
+
 ref<curlFileTransfer> makeCurlFileTransfer(const FileTransferSettings & settings = fileTransferSettings)
 {
     return make_ref<curlFileTransfer>(settings);
 }
 
+static auto * const _fileTransfer = new Sync<std::shared_ptr<curlFileTransfer>>;
+
 ref<FileTransfer> getFileTransfer()
 {
-    static ref<curlFileTransfer> fileTransfer = makeCurlFileTransfer();
+    auto fileTransfer(_fileTransfer->lock());
 
-    if (fileTransfer->state_.lock()->isQuitting())
-        fileTransfer = makeCurlFileTransfer();
+    if (!*fileTransfer || (*fileTransfer)->state_.lock()->isQuitting())
+        *fileTransfer = makeCurlFileTransfer().get_ptr();
 
-    return fileTransfer;
+    return ref<FileTransfer>(*fileTransfer);
 }
 
 ref<FileTransfer> makeFileTransfer(const FileTransferSettings & settings)
@@ -1194,6 +1277,20 @@ ref<FileTransfer> makeFileTransfer(const FileTransferSettings & settings)
     return makeCurlFileTransfer(settings);
 }
 
+std::string FileTransferRequest::displayUri() const
+{
+    try {
+        auto parsed = uri.parsed();
+        if (parsed.authority && parsed.authority->user) {
+            parsed.authority->user.reset();
+            parsed.authority->password.reset();
+            return parsed.to_string();
+        }
+    } catch (BadURL &) {
+    }
+    return uri.to_string();
+}
+
 void FileTransferRequest::setupForS3()
 {
     auto parsedS3 = ParsedS3URL::parse(uri.parsed());
@@ -1270,7 +1367,7 @@ void FileTransfer::download(
         bool paused = false;
         std::exception_ptr exc;
         std::string data;
-        std::condition_variable avail, request;
+        std::condition_variable avail;
     };
 
     auto _state = std::make_shared<Sync<State>>();
@@ -1280,10 +1377,9 @@ void FileTransfer::download(
     Finally finally([&]() {
         auto state(_state->lock());
         state->quit = true;
-        state->request.notify_one();
     });
 
-    request.dataCallback = [_state, uri = request.uri.to_string()](std::string_view data) -> PauseTransfer {
+    request.dataCallback = [_state, uri = request.displayUri()](std::string_view data) -> PauseTransfer {
         auto state(_state->lock());
 
         if (state->quit)
@@ -1326,7 +1422,6 @@ void FileTransfer::download(
                 state->exc = std::current_exception();
             }
             state->avail.notify_one();
-            state->request.notify_one();
         }});
 
     while (true) {
@@ -1360,8 +1455,6 @@ void FileTransfer::download(
             chunk = std::move(state->data);
             /* Reset state->data after the move, since we check data.empty() */
             state->data = "";
-
-            state->request.notify_one();
         }
 
         /* Flush the data to the sink and wake up the download thread
@@ -1372,6 +1465,8 @@ void FileTransfer::download(
     }
 }
 
+void FileTransferError::anchor() {}
+
 template<typename... Args>
 FileTransferError::FileTransferError(
     FileTransfer::Error error, std::optional<std::string> response, const Args &... args)
diff --git a/src/libstore/freebsd/build/chroot-freebsd-derivation-builder.hh b/src/libstore/freebsd/build/chroot-freebsd-derivation-builder.hh
new file mode 100644
index 000000000000..7ff6d1fb4615
--- /dev/null
+++ b/src/libstore/freebsd/build/chroot-freebsd-derivation-builder.hh
@@ -0,0 +1,33 @@
+#pragma once
+
+#include "chroot-derivation-builder.hh"
+#include "freebsd-derivation-builder.hh"
+
+#include "nix/util/freebsd-jail.hh"
+
+namespace nix {
+
+struct ChrootFreeBSDDerivationBuilder : ChrootDerivationBuilder, FreeBSDDerivationBuilder
+{
+    std::shared_ptr<AutoRemoveJail> autoDelJail = std::make_shared<AutoRemoveJail>();
+
+    ChrootFreeBSDDerivationBuilder(
+        LocalStore & store, std::shared_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
+        : DerivationBuilderImpl{store, miscMethods, params}
+        , ChrootDerivationBuilder{store, miscMethods, params}
+        , FreeBSDDerivationBuilder{store, miscMethods, params}
+    {
+    }
+
+    virtual void cleanupBuild(bool force) override;
+
+    void prepareSandbox() override;
+
+    void startChild() override;
+
+    void enterChroot() override;
+
+    void addDependencyImpl(const StorePath & path) override;
+};
+
+} // namespace nix
diff --git a/src/libstore/freebsd/build/freebsd-derivation-builder.cc b/src/libstore/freebsd/build/freebsd-derivation-builder.cc
new file mode 100644
index 000000000000..68ccdafa1ae5
--- /dev/null
+++ b/src/libstore/freebsd/build/freebsd-derivation-builder.cc
@@ -0,0 +1,484 @@
+#include "derivation-builder-impl.hh"
+#include "freebsd-derivation-builder.hh"
+#include "chroot-derivation-builder.hh"
+#include "chroot-freebsd-derivation-builder.hh"
+
+#include "nix/util/freebsd-jail.hh"
+#include "nix/util/util.hh"
+#include "nix/store/filetransfer.hh"
+
+#include <stdlib.h>
+#include <string.h>
+
+#include <db.h>
+#include <pwd.h>
+#include <sys/mount.h>
+#include <netlink/netlink_snl.h>
+#include <netlink/netlink_snl_route.h>
+#include <net/if.h>
+#include <sys/param.h>
+#include <sys/jail.h>
+#include <sys/sockio.h>
+#include <jail.h>
+
+namespace nix {
+
+FreeBSDDerivationBuilder::~FreeBSDDerivationBuilder() {}
+
+namespace {
+
+struct PasswordEntry
+{
+    std::string name;
+    uid_t uid;
+    gid_t gid;
+    std::string description;
+    std::filesystem::path home;
+    std::filesystem::path shell;
+};
+
+using UniqueDB = std::unique_ptr<::DB, decltype([](::DB * db) {
+                                     if (db)
+                                         (db->close)(db);
+                                 })>;
+
+// Database open flags from FreeBSD, in case they're necessary for compatibility
+static constexpr HASHINFO dbFlags = {
+    .bsize = 4096,
+    .ffactor = 32,
+    .nelem = 256,
+    .cachesize = 2 * 1024 * 1024,
+    .hash = nullptr,
+    .lorder = BIG_ENDIAN,
+};
+
+// Password database version
+// Version 4 has been current since 2003
+static const uint8_t dbVersion = 4;
+
+static void serializeString(std::vector<uint8_t> & buf, std::string const & str)
+{
+    buf.insert(buf.end(), str.begin(), str.end());
+    buf.push_back(0);
+}
+
+static void serializeInt(std::vector<uint8_t> & buf, uint32_t num)
+{
+    // Always big endian
+    buf.push_back((num >> 24) & 0xff);
+    buf.push_back((num >> 16) & 0xff);
+    buf.push_back((num >> 8) & 0xff);
+    buf.push_back((num >> 0) & 0xff);
+}
+
+static std::vector<uint8_t> byNameKey(std::string const & name)
+{
+    std::vector<uint8_t> buf{_PW_VERSIONED(_PW_KEYBYNAME, dbVersion)};
+    buf.reserve(1 + name.size());
+    // We can't use serializeString since that's null terminated
+    buf.insert(buf.end(), name.begin(), name.end());
+
+    return buf;
+}
+
+static std::vector<uint8_t> byNumKey(uint32_t num)
+{
+    std::vector<uint8_t> buf{_PW_VERSIONED(_PW_KEYBYNUM, dbVersion)};
+    serializeInt(buf, num);
+
+    return buf;
+}
+
+static std::vector<uint8_t> byUidKey(uid_t uid)
+{
+    std::vector<uint8_t> buf{_PW_VERSIONED(_PW_KEYBYUID, dbVersion)};
+    serializeInt(buf, uid);
+
+    return buf;
+}
+
+static void createPasswordFiles(std::filesystem::path & chrootRootDir, std::vector<PasswordEntry> & users)
+{
+    auto db =
+        UniqueDB(::dbopen((chrootRootDir / "etc/pwd.db").c_str(), O_CREAT | O_RDWR | O_EXCL, 0644, DB_HASH, &dbFlags));
+
+    if (!db)
+        throw SysError("could not create password database");
+
+    auto dbInsert = [&db](std::vector<uint8_t> keyBuf, std::vector<uint8_t> & valueBuf) {
+        DBT key = {keyBuf.data(), keyBuf.size()};
+        DBT value = {valueBuf.data(), valueBuf.size()};
+
+        if ((db->put)(db.get(), &key, &value, R_NOOVERWRITE) == -1) {
+            throw SysError("could not write to password database");
+        }
+    };
+
+    // Annoyingly DBT doesn't have const pointers so we need this whole shuffle
+    std::string versionKeyStr(_PWD_VERSION_KEY);
+    std::vector<uint8_t> versionKey(versionKeyStr.begin(), versionKeyStr.end());
+    std::vector<uint8_t> versionValue{dbVersion};
+    dbInsert(versionKey, versionValue);
+
+    for (const auto & [i, user] : enumerate(users)) {
+        // flags for non-empty fields
+        uint32_t fields = _PWF_NAME | _PWF_PASSWD | _PWF_UID | _PWF_GID | _PWF_GECOS | _PWF_DIR | _PWF_SHELL;
+
+        std::vector<uint8_t> buf;
+        serializeString(buf, user.name);
+        // pw_password is always "*" in the insecure database
+        serializeString(buf, std::string("*"));
+        serializeInt(buf, user.uid);
+        serializeInt(buf, user.gid);
+        // pw_change = 0 means no requirement to change password
+        serializeInt(buf, 0);
+        // pw_class is empty since we don't make a class database
+        serializeString(buf, std::string(""));
+        serializeString(buf, user.description);
+        serializeString(buf, user.home);
+        serializeString(buf, user.shell);
+        // pw_expire = 0 means password does not expire
+        serializeInt(buf, 0);
+        serializeInt(buf, fields);
+
+        dbInsert(byNameKey(user.name), buf);
+        // _PW_KEYBYNUM is 1-indexed
+        dbInsert(byNumKey(i + 1), buf);
+        dbInsert(byUidKey(user.uid), buf);
+    }
+
+    // FreeBSD libc doesn't use /etc/passwd, but some software might
+    std::string passwdContent;
+    for (const auto & user : users) {
+        passwdContent.append(
+            fmt("%s:*:%d:%d:%s:%s:%s\n",
+                user.name,
+                user.uid,
+                user.gid,
+                user.description,
+                user.home.native(),
+                user.shell.native()));
+    }
+
+    writeFile(chrootRootDir / "etc/passwd", passwdContent);
+
+    // No need to make /etc/master.passwd or /etc/spwd.db,
+    // our build user wouldn't be able to read them anyway
+}
+
+} // namespace
+
+template<size_t N>
+struct iovec iovFromMutableBuffer(std::array<char, N> & array)
+{
+    return {
+        .iov_base = static_cast<void *>(array.data()),
+        .iov_len = N,
+    };
+}
+
+template<size_t N>
+struct iovec iovFromStaticSizedString(const char (&array)[N])
+{
+    return {
+        .iov_base = const_cast<void *>(static_cast<const void *>(array)),
+        .iov_len = N,
+    };
+}
+
+struct iovec iovFromDynamicSizeString(const std::string & s)
+{
+    return {
+        .iov_base = const_cast<void *>(static_cast<const void *>(s.c_str())),
+        .iov_len = s.length() + 1,
+    };
+}
+
+void ChrootFreeBSDDerivationBuilder::cleanupBuild(bool force)
+{
+    autoDelJail->remove();
+    ChrootDerivationBuilder::cleanupBuild(force);
+}
+
+void ChrootFreeBSDDerivationBuilder::prepareSandbox()
+{
+    ChrootDerivationBuilder::prepareSandbox();
+
+    std::vector<PasswordEntry> users{
+        {
+            .name = "root",
+            .uid = 0,
+            .gid = 0,
+            .description = "Nix build user",
+            .home = store.config->getLocalSettings().sandboxBuildDir,
+            .shell = "/noshell",
+        },
+        {
+            .name = "nixbld",
+            .uid = buildUser->getUID(),
+            .gid = sandboxGid(),
+            .description = "Nix build user",
+            .home = store.config->getLocalSettings().sandboxBuildDir,
+            .shell = "/noshell",
+        },
+        {
+            .name = "nobody",
+            .uid = 65534,
+            .gid = 65534,
+            .description = "Nobody",
+            .home = "/",
+            .shell = "/noshell",
+        },
+    };
+
+    createPasswordFiles(chrootRootDir, users);
+
+    // FreeBSD doesn't have a group database, just write a text file
+    writeFile(
+        chrootRootDir / "etc/group",
+        fmt("root:x:0:\n"
+            "nixbld:!:%1%:\n"
+            "nogroup:x:65534:\n",
+            sandboxGid()));
+
+    // Linux waits until after entering the child to start mounting so it doesn't
+    // pollute the root mount namespace.
+    // FreeBSD doesn't have mount namespaces, so there's no reason to wait.
+
+    auto devpath = chrootRootDir / "dev";
+    createDir(devpath, 0555);
+    createDir(chrootRootDir / "bin", 0555);
+
+    std::array<char, 255> errmsg{};
+    std::array<::iovec, 8> iov = {
+        iovFromStaticSizedString("fstype"),
+        iovFromStaticSizedString("devfs"),
+        iovFromStaticSizedString("fspath"),
+        iovFromDynamicSizeString(devpath.native()),
+        iovFromStaticSizedString("ruleset"),
+        iovFromStaticSizedString("4"),
+        iovFromStaticSizedString("errmsg"),
+        iovFromMutableBuffer(errmsg),
+    };
+
+    if (nmount(iov.data(), iov.size(), 0) < 0)
+        throw SysError("failed to mount jail /dev: %1%", std::string_view(errmsg.data()));
+
+    autoDelJail->childrenMounts.emplace_back(devpath);
+
+    for (const auto & [target, chrootPath] : pathsInChroot) {
+        std::filesystem::path path = chrootRootDir / target.relative_path();
+
+        auto maybeSt = maybeLstat(chrootPath.source);
+        if (!maybeSt) {
+            if (chrootPath.optional)
+                continue; /* Skip mounting this path. */
+            else
+                throw SysError("getting attributes of path %1%", PathFmt(chrootPath.source));
+        }
+
+        /* Mount points must exist and be the right type. */
+        if (S_ISDIR(maybeSt->st_mode)) {
+            createDirs(path);
+        } else if (S_ISLNK(maybeSt->st_mode)) {
+            createDirs(path.parent_path());
+            copyFile(chrootPath.source, path, /*andDelete=*/false, /*contents=*/false);
+            continue;
+        } else {
+            createDirs(path.parent_path());
+            writeFile(path, "");
+        }
+
+        std::array<::iovec, 8> iov = {
+            iovFromStaticSizedString("fstype"),
+            iovFromStaticSizedString("nullfs"),
+            iovFromStaticSizedString("fspath"),
+            iovFromDynamicSizeString(path.native()),
+            iovFromStaticSizedString("target"),
+            iovFromDynamicSizeString(chrootPath.source.native()),
+            iovFromStaticSizedString("errmsg"),
+            iovFromMutableBuffer(errmsg),
+        };
+
+        debug("setting up a nullfs mount from %1% to %2%", PathFmt(chrootPath.source), PathFmt(path));
+
+        int flags = 0;
+        if (store.isInStore(target.native()))
+            /* While we are at it, enforce invariants about store paths. Anything located at the "logical" store
+               location must be readonly (file permission canonicalisation enforces this on the host filesystem).
+               Also the store must never contain setuid binaries for the same reason. This is just defense-in-depth. */
+            flags = MNT_RDONLY | MNT_NOSUID;
+
+        if (nmount(iov.data(), iov.size(), flags) < 0)
+            throw SysError("failed to mount nullfs for %1%: %2%", PathFmt(path), std::string_view(errmsg.data()));
+
+        autoDelJail->childrenMounts.emplace_back(path);
+    }
+
+    /* Fixed-output derivations typically need to access the
+       network, so give them access to /etc/resolv.conf and so
+       on. */
+    if (!derivationType.isSandboxed()) {
+        // Only use nss functions to resolve hosts and
+        // services. Don’t use it for anything else that may
+        // be configured for this system. This limits the
+        // potential impurities introduced in fixed-outputs.
+        writeFile(chrootRootDir / "etc/nsswitch.conf", "hosts: files dns\nservices: files\n");
+
+        /* N.B. it is realistic that these paths might not exist. It
+           happens when testing Nix building fixed-output derivations
+           within a pure derivation. */
+        for (std::filesystem::path path : {"/etc/resolv.conf", "/etc/services", "/etc/hosts"}) {
+            if (pathExists(path)) {
+                // This means if your network config changes during a FOD build,
+                // the DNS in the sandbox will be wrong. However, this is pretty unlikely
+                // to actually be a problem, because FODs are generally pretty fast,
+                // and machines with often-changing network configurations probably
+                // want to run resolved or some other local resolver anyway.
+                //
+                // There's also just no simple way to do this correctly, you have to manually
+                // inotify watch the files for changes on the outside and update the sandbox
+                // while the build is running (or at least that's what Flatpak does).
+                //
+                // I also just generally feel icky about modifying sandbox state under a build,
+                // even though it really shouldn't be a big deal. -K900
+                copyFile(path, chrootRootDir / path.relative_path(), false, true);
+            }
+        }
+
+        if (fileTransferSettings.caFile.get() && pathExists(fileTransferSettings.caFile.get().value())) {
+            // For the same reasons as above, copy the CA certificates file too.
+            // It should be even less likely to change during the build than resolv.conf.
+            createDirs(chrootRootDir / "etc/ssl/certs");
+            copyFile(
+                fileTransferSettings.caFile.get().value(),
+                chrootRootDir / "etc/ssl/certs/ca-certificates.crt",
+                false,
+                true);
+        }
+    }
+}
+
+void ChrootFreeBSDDerivationBuilder::startChild()
+{
+    int jid;
+
+    RunChildArgs args{
+#if NIX_WITH_AWS_AUTH
+        .awsCredentials = preResolveAwsCredentials(),
+#endif
+    };
+
+    if (derivationType.isSandboxed()) {
+        jid = jail_setv(
+            JAIL_CREATE,
+            "persist",
+            "true",
+            "path",
+            chrootRootDir.c_str(),
+            "host.hostname",
+            "localhost",
+            // TODO: Make our own ruleset
+            "vnet",
+            "new",
+            nullptr);
+        if (jid < 0) {
+            throw SysError("failed to create jail (isolated network): %1%", jail_errmsg);
+        }
+        autoDelJail->jid = jid;
+
+        // Everything from here to the end of the block is setting up the network
+        // code adapted from freebsd/sbin/ifconfig/af_inet.c, in_exec_nl
+        Pid helper = startProcess([&]() {
+            unix::closeExtraFDs();
+            enterChroot();
+
+            struct snl_state ss = {};
+            if (!snl_init(&ss, NETLINK_ROUTE)) {
+                throw SysError("Failed to init netlink connection");
+            }
+
+            struct snl_writer nw = {};
+            snl_init_writer(&ss, &nw);
+            struct nlmsghdr * hdr = snl_create_msg_request(&nw, NL_RTM_NEWADDR);
+            struct ifaddrmsg * ifahdr = snl_reserve_msg_object(&nw, struct ifaddrmsg);
+
+            ifahdr->ifa_family = AF_INET;
+            ifahdr->ifa_prefixlen = 8;
+            ifahdr->ifa_index = if_nametoindex("lo0");
+            snl_add_msg_attr_ip4(&nw, IFA_LOCAL, (const struct in_addr *) "\x7f\x00\x00\x01");
+
+            int off = snl_add_msg_attr_nested(&nw, IFA_FREEBSD);
+            snl_add_msg_attr_u32(&nw, IFAF_FLAGS, IFF_LOOPBACK | IFF_UP);
+            snl_end_attr_nested(&nw, off);
+
+            if (!(hdr = snl_finalize_msg(&nw)) || !snl_send_message(&ss, hdr)) {
+                snl_free(&ss);
+                throw SysError("failed to sendoff netlink message");
+            }
+
+            struct snl_errmsg_data e = {};
+            snl_read_reply_code(&ss, hdr->nlmsg_seq, &e);
+            if (e.error_str != nullptr) {
+                snl_free(&ss);
+                throw SysError("failed to configure loopback interface: %1%", e.error_str);
+            }
+            snl_free(&ss);
+            _exit(0);
+        });
+
+        /* TODO: Capture the error from the helper? */
+        if (auto status = helper.wait(); !statusOk(status)) {
+            throw Error("failed to configure loopback address: %s", statusToString(status));
+        }
+    } else {
+        jid = jail_setv(
+            JAIL_CREATE,
+            "persist",
+            "true",
+            // 4 is the most restrictive devfs ruleset that meets our needs
+            // which is found in the default installation. Trying to add
+            // another one is a huge pain...
+            "devfs_ruleset",
+            "4",
+            "path",
+            chrootRootDir.c_str(),
+            "host.hostname",
+            "localhost",
+            "ip4",
+            "inherit",
+            "ip6",
+            "inherit",
+            "allow.raw_sockets",
+            "true",
+            nullptr);
+        if (jid < 0) {
+            throw SysError("failed to create jail (networked): %1%", jail_errmsg);
+        }
+        autoDelJail->jid = jid;
+    }
+
+    pid = startProcess([&]() {
+        openSlave();
+        runChild(args);
+    });
+}
+
+void ChrootFreeBSDDerivationBuilder::enterChroot()
+{
+    /* Close all other file descriptors. This must happen before
+       jail_attach for FreeBSD. */
+    unix::closeExtraFDs();
+
+    if (jail_attach(autoDelJail->jid) < 0) {
+        throw SysError("failed to attach to jail");
+    }
+}
+
+void ChrootFreeBSDDerivationBuilder::addDependencyImpl(const StorePath & path)
+{
+    throw UnimplementedError(
+        "adding store path '%s' to the sandbox is not implemented (recursive-nix)", store.printStorePath(path));
+}
+
+} // namespace nix
diff --git a/src/libstore/freebsd/build/freebsd-derivation-builder.hh b/src/libstore/freebsd/build/freebsd-derivation-builder.hh
new file mode 100644
index 000000000000..ce607db3982c
--- /dev/null
+++ b/src/libstore/freebsd/build/freebsd-derivation-builder.hh
@@ -0,0 +1,19 @@
+#pragma once
+
+#include "derivation-builder-impl.hh"
+
+namespace nix {
+
+struct FreeBSDDerivationBuilder : virtual DerivationBuilderImpl
+{
+    using DerivationBuilderImpl::DerivationBuilderImpl;
+
+    FreeBSDDerivationBuilder(FreeBSDDerivationBuilder &&) = delete;
+    FreeBSDDerivationBuilder(const FreeBSDDerivationBuilder &) = delete;
+    FreeBSDDerivationBuilder & operator=(FreeBSDDerivationBuilder &&) = delete;
+    FreeBSDDerivationBuilder & operator=(const FreeBSDDerivationBuilder &) = delete;
+    /* To appease Wweak-vtables. */
+    ~FreeBSDDerivationBuilder() override;
+};
+
+} // namespace nix
diff --git a/src/libstore/freebsd/meson.build b/src/libstore/freebsd/meson.build
new file mode 100644
index 000000000000..bac3949b965f
--- /dev/null
+++ b/src/libstore/freebsd/meson.build
@@ -0,0 +1,3 @@
+include_dirs += [ include_directories('build') ]
+
+sources += files('build/freebsd-derivation-builder.cc')
diff --git a/src/libstore/gc.cc b/src/libstore/gc.cc
index 835d06864671..8e997c8e2471 100644
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@@ -37,6 +37,10 @@
 
 namespace nix {
 
+void LocalSettings::anchor() {}
+
+void GCSettings::anchor() {}
+
 static std::string gcSocketPath = "gc-socket/socket";
 static std::string gcRootsDir = "gcroots";
 
@@ -170,8 +174,6 @@ void LocalStore::findTempRoots(Roots & tempRoots, bool censor)
         }
         auto path = i.path();
 
-        pid_t pid = std::stoi(name);
-
         debug("reading temporary root file %1%", PathFmt(path));
         AutoCloseFD fd(toDescriptor(open(
             path.string().c_str(),
@@ -206,7 +208,7 @@ void LocalStore::findTempRoots(Roots & tempRoots, bool censor)
         while ((end = contents.find((char) 0, pos)) != std::string::npos) {
             auto root = std::string_view(contents).substr(pos, end - pos);
             debug("got temporary root '%s'", root);
-            tempRoots[parseStorePath(root)].emplace(censor ? censored : fmt("{temp:%d}", pid));
+            tempRoots[parseStorePath(root)].emplace(censor ? censored : fmt("{temp:%s}", name));
             pos = end + 1;
         }
     }
@@ -357,14 +359,15 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
     const auto & gcSettings = config->getLocalSettings().getGCSettings();
 
     bool shouldDelete = options.action == GCOptions::gcDeleteDead || options.action == GCOptions::gcDeleteSpecific;
-    bool keepOutputs = gcSettings.keepOutputs;
-    bool keepDerivations = gcSettings.keepDerivations;
 
     boost::unordered_flat_set<StorePath, std::hash<StorePath>> roots, dead, alive;
 
     /* Return early if nothing to delete */
-    if (std::holds_alternative<StorePathSet>(options.pathsToDelete)
-        && std::get<StorePathSet>(options.pathsToDelete).empty())
+    if (std::visit(
+            overloaded{
+                [](const GCOptions::SpecificPaths & pathsToDelete) { return pathsToDelete.paths.empty(); },
+                [](const GCOptions::WholeStore & _) { return false; }},
+            options.pathsToDelete))
         return;
 
     struct Shared
@@ -382,15 +385,6 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
 
     std::condition_variable wakeup;
 
-    /* Using `--ignore-liveness' with `--delete' can have unintended
-       consequences if `keep-outputs' or `keep-derivations' are true
-       (the garbage collector will recurse into deleting the outputs
-       or derivers, respectively).  So disable them. */
-    if (options.action == GCOptions::gcDeleteSpecific && options.ignoreLiveness) {
-        keepOutputs = false;
-        keepDerivations = false;
-    }
-
     if (shouldDelete)
         deletePath(reservedPath);
 
@@ -601,6 +595,33 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
                 todo.push(path);
         };
 
+        auto markAlive = [&](const StorePath & p) {
+            alive.insert(p);
+            try {
+                StorePathSet closure;
+                bool includeOutputs = false;
+                bool includeDerivers = false;
+                std::visit(
+                    overloaded{
+                        [&](const GCOptions::WholeStore &) {
+                            includeOutputs = gcSettings.keepOutputs;
+                            includeDerivers = gcSettings.keepDerivations;
+                        },
+                        [](const GCOptions::SpecificPaths &) {},
+                    },
+                    options.pathsToDelete);
+                computeFSClosure(
+                    p,
+                    closure,
+                    /* flipDirection */ false,
+                    includeOutputs,
+                    includeDerivers);
+                for (auto & c : closure)
+                    alive.insert(c);
+            } catch (InvalidPath &) {
+            }
+        };
+
         enqueue(start);
 
         while (auto path = pop(todo)) {
@@ -608,49 +629,48 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
 
             /* Bail out if we've previously discovered that this path
                is alive. */
-            if (alive.count(*path)) {
+            if (alive.contains(*path)) {
+                debug("cannot delete '%s' because '%s' is alive", printStorePath(start), printStorePath(*path));
                 alive.insert(start);
                 return;
             }
 
             /* If we've previously deleted this path, we don't have to
                handle it again. */
-            if (dead.count(*path))
+            if (dead.contains(*path))
                 continue;
 
-            auto markAlive = [&]() {
-                alive.insert(*path);
-                alive.insert(start);
-                try {
-                    StorePathSet closure;
-                    computeFSClosure(
-                        *path,
-                        closure,
-                        /* flipDirection */ false,
-                        keepOutputs,
-                        keepDerivations);
-                    for (auto & p : closure)
-                        alive.insert(p);
-                } catch (InvalidPath &) {
-                }
-            };
-
             /* If this is a root, bail out. */
-            if (roots.count(*path)) {
+            if (roots.contains(*path)) {
                 debug("cannot delete '%s' because it's a root", printStorePath(*path));
-                return markAlive();
+                alive.insert(start);
+                return markAlive(*path);
             }
 
-            if (std::holds_alternative<StorePathSet>(options.pathsToDelete)
-                && !std::get<StorePathSet>(options.pathsToDelete).contains(*path))
+            if (std::visit(
+                    overloaded{
+                        [&](const GCOptions::SpecificPaths & pathsToDelete) {
+                            if (!pathsToDelete.deleteReferrers && !pathsToDelete.paths.contains(*path)) {
+                                debug(
+                                    "cannot delete '%s' because '%s' is not in the specified paths to delete",
+                                    printStorePath(start),
+                                    printStorePath(*path));
+                                return true;
+                            }
+                            return false;
+                        },
+                        [](const GCOptions::WholeStore & _) { return false; },
+                    },
+                    options.pathsToDelete))
                 return;
 
             {
                 auto hashPart = path->hashPart();
                 auto shared(_shared.lock());
-                if (shared->tempRoots.count(hashPart)) {
+                if (shared->tempRoots.contains(hashPart)) {
                     debug("cannot delete '%s' because it's a temporary root", printStorePath(*path));
-                    return markAlive();
+                    alive.insert(start);
+                    return markAlive(*path);
                 }
                 shared->pending = hashPart;
             }
@@ -668,27 +688,60 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
                 for (auto & p : i->second)
                     enqueue(p);
 
-                /* If keep-derivations is set and this is a
-                   derivation, then visit the derivation outputs. */
-                if (keepDerivations && path->isDerivation()) {
-                    for (auto & [name, maybeOutPath] : queryPartialDerivationOutputMap(*path))
-                        if (maybeOutPath && isValidPath(*maybeOutPath)
-                            && queryPathInfo(*maybeOutPath)->deriver == *path)
-                            enqueue(*maybeOutPath);
-                }
-
-                /* If keep-outputs is set, then visit the derivers. */
-                if (keepOutputs) {
-                    auto derivers = queryValidDerivers(*path);
-                    for (auto & i : derivers)
-                        enqueue(i);
-                }
+                std::visit(
+                    overloaded{
+                        [&](const GCOptions::WholeStore &) {
+                            /* If keep-derivations is set and this is a derivation, then we only want to delete this
+                             * derivation if we can also delete all its outputs, so visit the derivation outputs. */
+                            if (gcSettings.keepDerivations && path->isDerivation())
+                                for (auto & [name, maybeOutPath] : queryPartialDerivationOutputMap(*path))
+                                    if (maybeOutPath && isValidPath(*maybeOutPath)
+                                        && queryPathInfo(*maybeOutPath)->deriver == path)
+                                        enqueue(*maybeOutPath);
+
+                            /* If keep-outputs is set, we only want to delete this path if we
+                             * can also delete its derivers, so visit the derivers. */
+                            if (gcSettings.keepOutputs) {
+                                auto derivers = queryValidDerivers(*path);
+                                for (auto & i : derivers)
+                                    enqueue(i);
+                            }
+                        },
+                        [](const GCOptions::SpecificPaths &) {},
+                    },
+                    options.pathsToDelete);
             }
         }
         for (auto & path : topoSortPaths(visited)) {
             if (!dead.insert(path).second)
                 continue;
             if (shouldDelete) {
+                /* Re-check tempRoots before deleting and set pending
+                   to synchronise with addTempRoot. Between the BFS
+                   and this deletion loop, new temproots may have been
+                   added via the GC socket by a concurrent process
+                   (e.g. an evaluator calling addTempRoot). The BFS
+                   only checks tempRoots when it first visits a path,
+                   but the "pending" mechanism only blocks the socket
+                   handler for the single path currently being visited,
+                   not for paths already queued for deletion. */
+                {
+                    auto hashPart = std::string(path.hashPart());
+                    auto shared(_shared.lock());
+                    if (shared->tempRoots.contains(hashPart)) {
+                        debug(
+                            "not deleting '%s' because it became a temporary root after initial scan",
+                            printStorePath(path));
+                        markAlive(path);
+                        continue;
+                    }
+                    shared->pending = hashPart;
+                }
+                Finally resetPending([&]() {
+                    auto shared(_shared.lock());
+                    shared->pending.reset();
+                    wakeup.notify_all();
+                });
                 try {
                     invalidatePathChecked(path);
                     deleteFromStore(path.to_string(), true);
@@ -706,28 +759,30 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
         /* Either delete all garbage paths, or just the specified paths. */
         std::visit(
             overloaded{
-                [&](const StorePathSet & paths) {
-                    for (auto & i : paths) {
-                        switch (options.action) {
-                        case GCOptions::gcDeleteDead:
-                            printInfo("deleting garbage within specified paths...");
-                            break;
-                        case GCOptions::gcDeleteSpecific:
-                            printInfo("deleting specified paths...");
-                            break;
-                        case GCOptions::gcReturnDead:
-                        case GCOptions::gcReturnLive:
-                            printInfo("determining live/dead paths...");
-                        }
+                [&](const GCOptions::SpecificPaths & pathsToDelete) {
+                    switch (options.action) {
+                    case GCOptions::gcDeleteDead:
+                        printInfo("deleting garbage within specified paths...");
+                        break;
+                    case GCOptions::gcDeleteSpecific:
+                        printInfo("deleting specified paths...");
+                        break;
+                    case GCOptions::gcReturnDead:
+                    case GCOptions::gcReturnLive:
+                        printInfo("determining live/dead paths...");
+                    }
 
+                    for (auto & i : pathsToDelete.paths) {
                         maybeDeleteReferrersClosure(i);
 
-                        if (options.action == GCOptions::gcDeleteSpecific && !dead.count(i))
+                        if (options.action == GCOptions::gcDeleteSpecific && !dead.contains(i))
                             throw Error(
                                 "Cannot delete path '%1%' since it is still alive. "
                                 "To find out why, use: "
                                 "nix-store --query --roots and nix-store --query --referrers",
                                 printStorePath(i));
+                        else if (!dead.contains(i))
+                            debug("cannot delete '%s' because it's still alive", printStorePath(i));
                     }
                 },
                 [&](const GCOptions::WholeStore & _) {
@@ -883,12 +938,17 @@ void LocalStore::autoGC(bool sync)
         if (avail > state->availAfterGC * 0.97)
             return;
 
+        /* Note: since gcRunning is false here, any previous GC thread has exited / is exiting so the join() should be
+         * almost instantenous. */
+        if (state->gcThread.joinable())
+            state->gcThread.join();
+
         state->gcRunning = true;
 
         std::promise<void> promise;
         future = state->gcFuture = promise.get_future().share();
 
-        std::thread([promise{std::move(promise)}, this, avail, getAvail, &gcSettings]() mutable {
+        state->gcThread = std::thread([promise{std::move(promise)}, this, avail, getAvail, &gcSettings]() mutable {
             try {
 
                 /* Wake up any threads waiting for the auto-GC to finish. */
@@ -915,7 +975,7 @@ void LocalStore::autoGC(bool sync)
                 // future, but we don't really care. (what??)
                 ignoreExceptionInDestructor();
             }
-        }).detach();
+        });
     }
 
 sync:
diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc
index 8beb68aa8e33..0bbd4b9f09cd 100644
--- a/src/libstore/globals.cc
+++ b/src/libstore/globals.cc
@@ -4,6 +4,7 @@
 #include "nix/util/config-global.hh"
 #include "nix/util/current-process.hh"
 #include "nix/util/executable-path.hh"
+#include "nix/util/file-system.hh"
 #include "nix/util/args.hh"
 #include "nix/util/abstract-setting-to-json.hh"
 #include "nix/util/compute-levels.hh"
@@ -44,6 +45,14 @@
 
 namespace nix {
 
+void Settings::anchor() {}
+
+void NarInfoDiskCacheSettings::anchor() {}
+
+void LogFileSettings::anchor() {}
+
+void AutoAllocateUidSettings::anchor() {}
+
 Settings settings;
 
 static GlobalConfig::Register rSettings(&settings);
@@ -246,11 +255,11 @@ StringSet Settings::getDefaultExtraPlatforms()
     // machines. Note that we can’t force processes from executing
     // x86_64 in aarch64 environments or vice versa since they can
     // always exec with their own binary preferences.
+    //
+    // The runtime file exists iff Rosetta 2 is installed; checking it avoids
+    // spawning a subprocess during static initialization of `settings`.
     if (std::string{NIX_LOCAL_SYSTEM} == "aarch64-darwin"
-        && runProgram(
-               RunOptions{.program = "arch", .args = {"-arch", "x86_64", "/usr/bin/true"}, .mergeStderrToStdout = true})
-                   .first
-               == 0)
+        && pathExists("/Library/Apple/usr/libexec/oah/libRosettaRuntime"))
         extraPlatforms.insert("x86_64-darwin");
 #endif
 
@@ -270,7 +279,7 @@ bool Settings::isWSL1()
 #endif
 }
 
-const ExternalBuilder * LocalSettings::findExternalDerivationBuilderIfSupported(const Derivation & drv)
+const ExternalBuilder * LocalSettings::findExternalDerivationBuilderIfSupported(const BasicDerivation & drv)
 {
     if (auto it = std::ranges::find_if(
             externalBuilders.get(), [&](const auto & handler) { return handler.systems.contains(drv.platform); });
diff --git a/src/libstore/http-binary-cache-store.cc b/src/libstore/http-binary-cache-store.cc
index ff5a89f135bb..d881e696b756 100644
--- a/src/libstore/http-binary-cache-store.cc
+++ b/src/libstore/http-binary-cache-store.cc
@@ -14,6 +14,8 @@ namespace nix {
 
 MakeError(UploadToHTTP, Error);
 
+void UploadToHTTP::anchor() {}
+
 StringSet HttpBinaryCacheStoreConfig::uriSchemes()
 {
     static bool forceHttp = getEnv("_NIX_FORCE_HTTP") == "1";
@@ -23,6 +25,10 @@ StringSet HttpBinaryCacheStoreConfig::uriSchemes()
     return ret;
 }
 
+void HttpBinaryCacheStoreConfig::anchor() {}
+
+void HttpBinaryCacheStore::anchor() {}
+
 HttpBinaryCacheStoreConfig::HttpBinaryCacheStoreConfig(ParsedURL _cacheUri, const Params & params)
     : StoreConfig(params, FilePathType::Unix)
     , BinaryCacheStoreConfig(params)
@@ -78,7 +84,8 @@ void HttpBinaryCacheStore::init()
         } catch (UploadToHTTP &) {
             throw Error("'%s' does not appear to be a binary cache", config->cacheUri.to_string());
         }
-        diskCache->createCache(cacheKey, config->storeDir, config->wantMassQuery, config->priority);
+        diskCache->createCache(
+            cacheKey, config->storeDir, {.wantMassQuery = config->wantMassQuery, .priority = config->priority});
     }
 }
 
@@ -214,7 +221,7 @@ void HttpBinaryCacheStore::upsertFile(
     } catch (FileTransferError & e) {
         UploadToHTTP err(e.message());
         err.addTrace({}, "while uploading to HTTP binary cache at '%s'", config->cacheUri.to_string());
-        throw err;
+        throw std::move(err);
     }
 }
 
diff --git a/src/libstore/http-binary-cache-store.md b/src/libstore/http-binary-cache-store.md
index 20c26d0c2caf..03dd350ec518 100644
--- a/src/libstore/http-binary-cache-store.md
+++ b/src/libstore/http-binary-cache-store.md
@@ -2,7 +2,7 @@ R"(
 
 **Store URL format**: `http://...`, `https://...`
 
-This store allows a binary cache to be accessed via the HTTP
+This store allows a [binary cache](@docroot@/protocols/binary-cache/index.md) to be accessed via the HTTP
 protocol.
 
 )"
diff --git a/src/libstore/include/nix/store/aws-creds.hh b/src/libstore/include/nix/store/aws-creds.hh
index 0751757cb015..3fa747069935 100644
--- a/src/libstore/include/nix/store/aws-creds.hh
+++ b/src/libstore/include/nix/store/aws-creds.hh
@@ -36,6 +36,10 @@ struct AwsCredentials
 
 class AwsAuthError final : public CloneableError<AwsAuthError, Error>
 {
+private:
+    void anchor() override;
+
+public:
     std::optional<int> errorCode;
 
 public:
@@ -70,7 +74,7 @@ public:
         }
     }
 
-    virtual ~AwsCredentialProvider() {}
+    virtual ~AwsCredentialProvider();
 };
 
 /**
diff --git a/src/libstore/include/nix/store/binary-cache-store.hh b/src/libstore/include/nix/store/binary-cache-store.hh
index 7871ad03c884..0cc5d1f3ff3f 100644
--- a/src/libstore/include/nix/store/binary-cache-store.hh
+++ b/src/libstore/include/nix/store/binary-cache-store.hh
@@ -16,6 +16,10 @@ class RemoteFSAccessor;
 
 struct BinaryCacheStoreConfig : virtual StoreConfig
 {
+private:
+    void anchor() override;
+
+public:
     BinaryCacheStoreConfig(const Params & params)
         : StoreConfig(params, FilePathType::Unix)
     {
@@ -92,6 +96,8 @@ struct alignas(8) /* Work around ASAN failures on i686-linux. */
     Config & config;
 
 private:
+    void anchor() override;
+
     std::vector<std::unique_ptr<Signer>> signers;
 
 protected:
@@ -177,6 +183,23 @@ private:
 
     void writeNarInfo(ref<NarInfo> narInfo);
 
+    /**
+     * Upload the NAR for a path and everything else *except* the
+     * `.narinfo` file (i.e. the compressed NAR, an optional NAR
+     * listing, and optional debuginfo links), and construct the
+     * corresponding `NarInfo`. The returned `NarInfo` is neither signed
+     * nor published yet; call `uploadNarInfo()` to do that.
+     */
+    ref<NarInfo> uploadData(Source & narSource, RepairFlag repair, fun<ValidPathInfo(HashResult)> mkInfo);
+
+    /**
+     * Sign and publish the `.narinfo` file for a path whose NAR has
+     * already been uploaded by `uploadData()`. This is what establishes
+     * the closure invariant, so all of the path's references must
+     * already be valid in the store.
+     */
+    void uploadNarInfo(ref<NarInfo> narInfo);
+
     ref<const ValidPathInfo> addToStoreCommon(
         Source & narSource, RepairFlag repair, CheckSigsFlag checkSigs, fun<ValidPathInfo(HashResult)> mkInfo);
 
@@ -197,6 +220,9 @@ public:
     void
     addToStore(const ValidPathInfo & info, Source & narSource, RepairFlag repair, CheckSigsFlag checkSigs) override;
 
+    void
+    addMultipleToStore(PathsSource && pathsToCopy, Activity & act, RepairFlag repair, CheckSigsFlag checkSigs) override;
+
     StorePath addToStoreFromDump(
         Source & dump,
         std::string_view name,
diff --git a/src/libstore/include/nix/store/build-result.hh b/src/libstore/include/nix/store/build-result.hh
index c664e6e5b6f7..808fcc829eda 100644
--- a/src/libstore/include/nix/store/build-result.hh
+++ b/src/libstore/include/nix/store/build-result.hh
@@ -58,8 +58,11 @@ enum struct BuildResultFailureStatus : uint8_t {
  * This is both an exception type (inherits from Error) and serves as
  * the failure variant in BuildResult::inner.
  */
-struct BuildError : public CloneableError<BuildError, Error>
+class BuildError : public CloneableError<BuildError, Error>
 {
+    void anchor() override;
+
+public:
     using Status = BuildResultFailureStatus;
     using enum Status;
 
diff --git a/src/libstore/include/nix/store/build.hh b/src/libstore/include/nix/store/build.hh
new file mode 100644
index 000000000000..2c7bb1211804
--- /dev/null
+++ b/src/libstore/include/nix/store/build.hh
@@ -0,0 +1,129 @@
+#pragma once
+///@file
+
+#include "nix/store/store-api.hh"
+
+namespace nix {
+
+/**
+ * Abstract interface for the build scheduler entry points.
+ *
+ * `Worker` implements this for local scheduling, including local builds.
+ * Remote stores provide a `Builder` via `Store::getBuilder()`.
+ *
+ * Thread safety should be guaranteed across these methods.
+ */
+struct Builder
+{
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
+
+    /**
+     * For each path, if it's a derivation, build it.  Building a
+     * derivation means ensuring that the output paths are valid.  If
+     * they are already valid, this is a no-op.  Otherwise, validity
+     * can be reached in two ways.  First, if the output paths is
+     * substitutable, then build the path that way.  Second, the
+     * output paths can be created by running the builder, after
+     * recursively building any sub-derivations. For inputs that are
+     * not derivations, substitute them.
+     */
+    virtual void buildPaths(const std::vector<DerivedPath> & reqs, BuildMode buildMode = bmNormal) = 0;
+
+    /**
+     * Like buildPaths(), but return a vector of \ref BuildResult
+     * BuildResults corresponding to each element in paths. Note that in
+     * case of a build/substitution error, this function won't throw an
+     * exception, but return a BuildResult containing an error message.
+     */
+    virtual std::vector<KeyedBuildResult>
+    buildPathsWithResults(const std::vector<DerivedPath> & reqs, BuildMode buildMode = bmNormal) = 0;
+
+    /**
+     * Build a single non-materialized derivation (i.e. not from an
+     * on-disk .drv file).
+     *
+     * @param drvPath This is used to deduplicate worker goals so it is
+     * imperative that is correct. That said, it doesn't literally need
+     * to be store path that would be calculated from writing this
+     * derivation to the store: it is OK if it instead is that of a
+     * Derivation which would resolve to this (by taking the outputs of
+     * it's input derivations and adding them as input sources) such
+     * that the build time referenceable-paths are the same.
+     *
+     * In the input-addressed case, we usually *do* use an "original"
+     * unresolved derivations's path, as that is what will be used in the
+     * buildPaths case. Also, the input-addressed output paths are verified
+     * only by that contents of that specific unresolved derivation, so it is
+     * nice to keep that information around so if the original derivation is
+     * ever obtained later, it can be verified whether the trusted user in fact
+     * used the proper output path.
+     *
+     * In the content-addressed case, we want to always use the resolved
+     * drv path calculated from the provided derivation. This serves two
+     * purposes:
+     *
+     *   - It keeps the operation trustless, by ruling out a maliciously
+     *     invalid drv path corresponding to a non-resolution-equivalent
+     *     derivation.
+     *
+     *   - For the floating case in particular, it ensures that the derivation
+     *     to output mapping respects the resolution equivalence relation, so
+     *     one cannot choose different resolution-equivalent derivations to
+     *     subvert dependency coherence (i.e. the property that one doesn't end
+     *     up with multiple different versions of dependencies without
+     *     explicitly choosing to allow it).
+     */
+    virtual BuildResult
+    buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode = bmNormal) = 0;
+
+    /**
+     * Like the other buildDerivation(), but additionally copies a set of
+     * input paths into the builder's store before the build is run.
+     *
+     * This lets the caller ship the build inputs together with the build
+     * request, rather than as a separate prior `copyPaths()`. Whether the
+     * inputs are fetched via substitution or copied directly is governed by
+     * the `builders-use-substitutes` setting.
+     *
+     * @param inputs The store paths to make available in the builder's
+     * store before building. For a remote builder these are copied across
+     * the connection; for the local `Worker` they are copied from the eval
+     * store.
+     */
+    virtual BuildResult buildDerivation(
+        const StorePath & drvPath,
+        const BasicDerivation & drv,
+        const StorePathSet & inputs,
+        BuildMode buildMode = bmNormal) = 0;
+
+    /**
+     * Like the other buildPathsWithResults(), but additionally copies a set
+     * of input paths into the builder's store before building.
+     *
+     * @param inputs The store paths to make available in the builder's
+     * store before building, copied subject to the
+     * `builders-use-substitutes` setting (see the buildDerivation() overload
+     * above).
+     */
+    virtual std::vector<KeyedBuildResult> buildPathsWithResults(
+        const std::vector<DerivedPath> & reqs, const StorePathSet & inputs, BuildMode buildMode = bmNormal) = 0;
+
+    /**
+     * Ensure that a path is valid.  If it is not currently valid, it
+     * may be made valid by running a substitute (if defined for the
+     * path).
+     */
+    virtual void ensurePath(const StorePath & path) = 0;
+
+    /**
+     * Repair the contents of the given path by redownloading it using
+     * a substituter (if available).
+     */
+    virtual void repairPath(const StorePath & path) = 0;
+
+    virtual ~Builder() = default;
+};
+
+} // namespace nix
diff --git a/src/libstore/include/nix/store/build/build-log.hh b/src/libstore/include/nix/store/build/build-log.hh
index cdc9125734d1..5dbdf2ba8680 100644
--- a/src/libstore/include/nix/store/build/build-log.hh
+++ b/src/libstore/include/nix/store/build/build-log.hh
@@ -31,6 +31,8 @@ private:
     std::string currentLogLine;
     size_t currentLogLinePos = 0; // to handle carriage return
 
+    bool pendingCR = false; // defer '\r' so "\r\n" is treated as a line terminator
+
     void flushLine();
 
 public:
diff --git a/src/libstore/include/nix/store/build/derivation-builder.hh b/src/libstore/include/nix/store/build/derivation-builder.hh
index bff249f78154..088644a3eb32 100644
--- a/src/libstore/include/nix/store/build/derivation-builder.hh
+++ b/src/libstore/include/nix/store/build/derivation-builder.hh
@@ -5,6 +5,7 @@
 #include <nlohmann/json_fwd.hpp>
 
 #include "nix/store/build-result.hh"
+#include "nix/store/daemon.hh"
 #include "nix/store/derivation-options.hh"
 #include "nix/store/build/derivation-building-misc.hh"
 #include "nix/store/derivations.hh"
@@ -16,12 +17,27 @@
 
 namespace nix {
 
+/**
+ * Rethrow the current exception as a subclass of `Error`.
+ */
+void rethrowExceptionAsError();
+
+/**
+ * Send the current exception to the parent in the format expected by
+ * `DerivationBuilderImpl::processSandboxSetupMessages()`.
+ */
+void handleChildException(bool sendException);
+
 /**
  * Denotes a build failure that stemmed from the builder exiting with a
  * failing exist status.
  */
 struct BuilderFailureError final : CloneableError<BuilderFailureError, BuildError>
 {
+private:
+    void anchor() override;
+
+public:
     int builderStatus;
 
     std::string extraMsgAfter;
@@ -109,7 +125,7 @@ struct DerivationBuilderParams
  */
 struct DerivationBuilderCallbacks
 {
-    virtual ~DerivationBuilderCallbacks() = default;
+    virtual ~DerivationBuilderCallbacks();
 
     /**
      * Open a log file and a pipe to it.
@@ -125,6 +141,17 @@ struct DerivationBuilderCallbacks
      * @todo this should be reworked
      */
     virtual void childTerminated() = 0;
+
+    /**
+     * Process a recursive Nix daemon connection, using a builder
+     * that enforces the restrictions of the given context.
+     */
+    virtual void processDaemonConnection(
+        ref<Store> store,
+        FdSource && from,
+        FdSink && to,
+        RestrictionContext & context,
+        daemon::RecursiveFlag recursiveFlag) = 0;
 };
 
 /**
@@ -140,6 +167,10 @@ struct DerivationBuilderCallbacks
  */
 struct DerivationBuilder : RestrictionContext
 {
+private:
+    void anchor() override;
+
+public:
     DerivationBuilder() = default;
     virtual ~DerivationBuilder() = default;
 
@@ -215,7 +246,7 @@ using DerivationBuilderUnique = std::unique_ptr<DerivationBuilder, DerivationBui
 
 #ifndef _WIN32 // TODO enable `DerivationBuilder` on Windows
 DerivationBuilderUnique makeDerivationBuilder(
-    LocalStore & store, std::unique_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params);
+    LocalStore & store, std::shared_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params);
 
 /**
  * @param handler Must be chosen such that it supports the given
@@ -223,7 +254,7 @@ DerivationBuilderUnique makeDerivationBuilder(
  */
 DerivationBuilderUnique makeExternalDerivationBuilder(
     LocalStore & store,
-    std::unique_ptr<DerivationBuilderCallbacks> miscMethods,
+    std::shared_ptr<DerivationBuilderCallbacks> miscMethods,
     DerivationBuilderParams params,
     const ExternalBuilder & handler);
 #endif
diff --git a/src/libstore/include/nix/store/build/derivation-building-goal.hh b/src/libstore/include/nix/store/build/derivation-building-goal.hh
index 6a17f73eeb51..08b3fa80d4b2 100644
--- a/src/libstore/include/nix/store/build/derivation-building-goal.hh
+++ b/src/libstore/include/nix/store/build/derivation-building-goal.hh
@@ -34,20 +34,11 @@ struct DerivationBuildingGoal : public Goal
     friend class Worker;
 
     /**
-     * @param storeDerivation Whether to store the derivation in
-     * `worker.store`. This is useful for newly-resolved derivations. In this
-     * case, the derivation was not created a priori, e.g. purely (or close
-     * enough) from evaluation of the Nix language, but also depends on the
-     * exact content produced by upstream builds. It is strongly advised to
-     * have a permanent record of such a resolved derivation in order to
-     * faithfully reconstruct the build history.
+     * @param drv The derivation to build, with the outputs of its input
+     * derivations already added to its input sources.
      */
     DerivationBuildingGoal(
-        const StorePath & drvPath,
-        ref<const Derivation> drv,
-        Worker & worker,
-        BuildMode buildMode,
-        bool storeDerivation);
+        const StorePath & drvPath, ref<const BasicDerivation> drv, Worker & worker, BuildMode buildMode);
     ~DerivationBuildingGoal();
 
 private:
@@ -56,9 +47,9 @@ private:
     const StorePath drvPath;
 
     /**
-     * The derivation stored at drvPath.
+     * The derivation to build.
      */
-    const ref<const Derivation> drv;
+    const ref<const BasicDerivation> drv;
 
     /**
      * The remainder is state held during the build.
@@ -79,7 +70,7 @@ private:
     /**
      * The states.
      */
-    Co gaveUpOnSubstitution(bool storeDerivation);
+    Co gaveUpOnSubstitution();
     Co tryToBuild(StorePathSet inputPaths);
     Co buildWithHook(
         StorePathSet inputPaths,
diff --git a/src/libstore/include/nix/store/build/derivation-building-misc.hh b/src/libstore/include/nix/store/build/derivation-building-misc.hh
index 8d6892839c76..dfdc25d0ed1a 100644
--- a/src/libstore/include/nix/store/build/derivation-building-misc.hh
+++ b/src/libstore/include/nix/store/build/derivation-building-misc.hh
@@ -9,7 +9,11 @@
 namespace nix {
 
 class Store;
-struct Derivation;
+
+template<typename Inputs>
+struct DerivationT;
+struct FullInputs;
+using Derivation = DerivationT<FullInputs>;
 
 /**
  * Unless we are repairing, we don't both to test validity and just assume it,
@@ -51,6 +55,7 @@ struct InitialOutput
 /**
  * Format the known outputs of a derivation for use in error messages.
  */
-std::string showKnownOutputs(const StoreDirConfig & store, const Derivation & drv);
+template<typename InputsType>
+std::string showKnownOutputs(const StoreDirConfig & store, const DerivationT<InputsType> & drv);
 
 } // namespace nix
diff --git a/src/libstore/include/nix/store/build/derivation-env-desugar.hh b/src/libstore/include/nix/store/build/derivation-env-desugar.hh
index a10ec9fa8736..ce65c7cbe8cf 100644
--- a/src/libstore/include/nix/store/build/derivation-env-desugar.hh
+++ b/src/libstore/include/nix/store/build/derivation-env-desugar.hh
@@ -7,7 +7,13 @@
 namespace nix {
 
 class Store;
-struct Derivation;
+
+template<typename Inputs>
+struct DerivationT;
+struct FullInputs;
+using Derivation = DerivationT<FullInputs>;
+using BasicDerivation = DerivationT<StorePathSet>;
+
 template<typename Input>
 struct DerivationOptions;
 
@@ -79,7 +85,7 @@ struct DesugaredEnv
      */
     static DesugaredEnv create(
         Store & store,
-        const Derivation & drv,
+        const BasicDerivation & drv,
         const DerivationOptions<StorePath> & drvOptions,
         const StorePathSet & inputPaths);
 };
diff --git a/src/libstore/include/nix/store/build/derivation-resolution-goal.hh b/src/libstore/include/nix/store/build/derivation-resolution-goal.hh
index 843e4031aa7e..972558e9706f 100644
--- a/src/libstore/include/nix/store/build/derivation-resolution-goal.hh
+++ b/src/libstore/include/nix/store/build/derivation-resolution-goal.hh
@@ -37,7 +37,8 @@ struct DerivationResolutionGoal : public Goal
 {
     friend class Worker;
 
-    DerivationResolutionGoal(const StorePath & drvPath, const Derivation & drv, Worker & worker, BuildMode buildMode);
+    DerivationResolutionGoal(
+        const StorePath & drvPath, ref<const Derivation> drv, Worker & worker, BuildMode buildMode);
 
     /**
      * If the derivation needed to be resolved, this is resulting
@@ -55,7 +56,7 @@ private:
     /**
      * The derivation stored at drvPath.
      */
-    std::unique_ptr<Derivation> drv;
+    ref<const Derivation> drv;
 
     /**
      * The remainder is state held during the build.
diff --git a/src/libstore/include/nix/store/build/goal.hh b/src/libstore/include/nix/store/build/goal.hh
index 0b7367ff7e02..f0861ddb4794 100644
--- a/src/libstore/include/nix/store/build/goal.hh
+++ b/src/libstore/include/nix/store/build/goal.hh
@@ -10,8 +10,11 @@
 
 namespace nix {
 
-struct TimedOut final : CloneableError<TimedOut, BuildError>
+class TimedOut final : public CloneableError<TimedOut, BuildError>
 {
+    void anchor() override;
+
+public:
     time_t maxDuration;
 
     TimedOut(time_t maxDuration);
@@ -75,6 +78,47 @@ enum struct JobCategory {
 struct Goal : public std::enable_shared_from_this<Goal>
 {
 private:
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
+public:
+    /**
+     * Event types for child process communication, delivered via coroutines.
+     */
+    struct ChildOutput
+    {
+        Descriptor fd;
+        std::string data;
+    };
+
+    struct ChildEOF
+    {
+        Descriptor fd;
+    };
+
+    using ChildEvent = std::variant<ChildOutput, ChildEOF, std::unique_ptr<TimedOut>>;
+
+private:
+    class ChildEvents
+    {
+        /**
+         * Structured queue of child events:
+         * - outputs: stream of data from child
+         * - eof: optional end-of-stream marker
+         * - timeout: optional timeout that flushes/overrides other events
+         */
+        std::queue<ChildOutput> childOutputs;
+        std::optional<ChildEOF> childEOF;
+        std::unique_ptr<TimedOut> childTimeout;
+
+    public:
+        void pushChildEvent(ChildOutput event);
+        void pushChildEvent(ChildEOF event);
+        void pushChildEvent(TimedOut event);
+        bool hasChildEvent() const;
+        ChildEvent popChildEvent();
+    };
+
     /**
      * Goals that this goal is waiting for.
      */
@@ -85,6 +129,8 @@ private:
      */
     std::optional<std::string> cachedKey;
 
+    ChildEvents childEvents;
+
 public:
     typedef enum { ecBusy, ecSuccess, ecFailed, ecNoSubstituters } ExitCode;
 
@@ -152,22 +198,6 @@ public:
         friend Goal;
     };
 
-    /**
-     * Event types for child process communication, delivered via coroutines.
-     */
-    struct ChildOutput
-    {
-        Descriptor fd;
-        std::string data;
-    };
-
-    struct ChildEOF
-    {
-        Descriptor fd;
-    };
-
-    using ChildEvent = std::variant<ChildOutput, ChildEOF, TimedOut>;
-
     /**
      * Tag type for `co_await`-ing child events.
      * Returns a `ChildEvent` when resumed.
@@ -233,8 +263,10 @@ public:
 
         explicit Co(handle_type handle)
             : handle(handle) {};
-        void operator=(Co &&);
-        Co(Co && rhs);
+        Co & operator=(Co &&) noexcept;
+        Co(Co && rhs) noexcept;
+        Co & operator=(const Co &) = delete;
+        Co(const Co & rhs) = delete;
         ~Co();
 
         bool await_ready()
@@ -319,28 +351,6 @@ public:
          */
         bool alive = true;
 
-        class
-        {
-            /**
-             * Structured queue of child events:
-             * - outputs: stream of data from child
-             * - eof: optional end-of-stream marker
-             * - timeout: optional timeout that flushes/overrides other events
-             */
-            std::queue<ChildOutput> childOutputs;
-            std::optional<ChildEOF> childEOF;
-            std::optional<TimedOut> childTimeout;
-
-        public:
-
-            void pushChildEvent(ChildOutput event);
-            void pushChildEvent(ChildEOF event);
-            void pushChildEvent(TimedOut event);
-            bool hasChildEvent() const;
-            ChildEvent popChildEvent();
-
-        } childEvents;
-
         /**
          * The awaiter used by @ref final_suspend.
          */
@@ -448,7 +458,7 @@ public:
 
             bool await_ready()
             {
-                assert(!promise.childEvents.hasChildEvent());
+                assert(!promise.goal->childEvents.hasChildEvent());
                 return false;
             }
 
@@ -476,7 +486,7 @@ public:
 
             bool await_ready()
             {
-                return handle && handle.promise().childEvents.hasChildEvent();
+                return handle && handle.promise().goal->childEvents.hasChildEvent();
             }
 
             void await_suspend(handle_type h)
@@ -487,7 +497,7 @@ public:
             ChildEvent await_resume()
             {
                 assert(handle);
-                return handle.promise().childEvents.popChildEvent();
+                return handle.promise().goal->childEvents.popChildEvent();
             }
         };
 
diff --git a/src/libstore/include/nix/store/build/worker.hh b/src/libstore/include/nix/store/build/worker.hh
index 4c836986811f..bf1726f32b90 100644
--- a/src/libstore/include/nix/store/build/worker.hh
+++ b/src/libstore/include/nix/store/build/worker.hh
@@ -3,6 +3,7 @@
 
 #include "nix/util/types.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/build.hh"
 #include "nix/store/derived-path-map.hh"
 #include "nix/store/build/goal.hh"
 #include "nix/store/build-result.hh"
@@ -67,10 +68,51 @@ struct Child
 struct HookInstance;
 #endif
 
+/**
+ * Owns a worker. Optimization around ensurePath to prevent a Worker from
+ * being constructed when it's not needed.
+ */
+class LocalBuilder : public Builder
+{
+public:
+    LocalBuilder(ref<Store> store, ref<Store> evalStore)
+        : store(store)
+        , evalStore(evalStore) {};
+
+    /* Builder interface — see `Builder` for documentation. */
+
+    void buildPaths(const std::vector<DerivedPath> & reqs, BuildMode buildMode) override;
+    std::vector<KeyedBuildResult>
+    buildPathsWithResults(const std::vector<DerivedPath> & reqs, BuildMode buildMode) override;
+    BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode) override;
+    BuildResult buildDerivation(
+        const StorePath & drvPath,
+        const BasicDerivation & drv,
+        const StorePathSet & inputs,
+        BuildMode buildMode) override;
+    std::vector<KeyedBuildResult> buildPathsWithResults(
+        const std::vector<DerivedPath> & reqs, const StorePathSet & inputs, BuildMode buildMode) override;
+    void ensurePath(const StorePath & path) override;
+    void repairPath(const StorePath & path) override;
+
+private:
+    /**
+     * Intentionally construct a new worker for each operation, to avoid
+     * reusing a worker between calls, allowing for thread safety.
+     */
+    inline std::shared_ptr<Worker> getWorker()
+    {
+        return std::make_shared<Worker>(*store, *evalStore);
+    }
+
+    ref<Store> store;
+    ref<Store> evalStore;
+};
+
 /**
  * Coordinates one or more realisations and their interdependencies.
  */
-class Worker
+class Worker : public Builder
 {
 private:
 
@@ -199,6 +241,7 @@ public:
 
     Store & store;
     Store & evalStore;
+
     const WorkerSettings & settings;
 
     /**
@@ -265,13 +308,13 @@ public:
      * @ref DerivationResolutionGoal "derivation resolution goal"
      */
     std::shared_ptr<DerivationResolutionGoal>
-    makeDerivationResolutionGoal(const StorePath & drvPath, const Derivation & drv, BuildMode buildMode);
+    makeDerivationResolutionGoal(const StorePath & drvPath, ref<const Derivation> drv, BuildMode buildMode);
 
     /**
      * @ref DerivationBuildingGoal "derivation building goal"
      */
-    std::shared_ptr<DerivationBuildingGoal> makeDerivationBuildingGoal(
-        const StorePath & drvPath, ref<const Derivation> drv, BuildMode buildMode, bool storeDerivation);
+    std::shared_ptr<DerivationBuildingGoal>
+    makeDerivationBuildingGoal(const StorePath & drvPath, ref<const BasicDerivation> drv, BuildMode buildMode);
 
     /**
      * @ref PathSubstitutionGoal "substitution goal"
@@ -388,6 +431,22 @@ public:
         act.setExpected(actFileTransfer, expectedDownloadSize + doneDownloadSize);
         act.setExpected(actCopyPath, expectedNarSize + doneNarSize);
     }
+
+    /* Builder interface — see `Builder` for documentation. */
+
+    void buildPaths(const std::vector<DerivedPath> & reqs, BuildMode buildMode) override;
+    std::vector<KeyedBuildResult>
+    buildPathsWithResults(const std::vector<DerivedPath> & reqs, BuildMode buildMode) override;
+    BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode) override;
+    BuildResult buildDerivation(
+        const StorePath & drvPath,
+        const BasicDerivation & drv,
+        const StorePathSet & inputs,
+        BuildMode buildMode) override;
+    std::vector<KeyedBuildResult> buildPathsWithResults(
+        const std::vector<DerivedPath> & reqs, const StorePathSet & inputs, BuildMode buildMode) override;
+    void ensurePath(const StorePath & path) override;
+    void repairPath(const StorePath & path) override;
 };
 
 } // namespace nix
diff --git a/src/libstore/include/nix/store/builtins/buildenv.hh b/src/libstore/include/nix/store/builtins/buildenv.hh
index a0f0b3f24b99..b528871b2801 100644
--- a/src/libstore/include/nix/store/builtins/buildenv.hh
+++ b/src/libstore/include/nix/store/builtins/buildenv.hh
@@ -25,6 +25,9 @@ struct Package
 
 class BuildEnvFileConflictError final : public CloneableError<BuildEnvFileConflictError, Error>
 {
+private:
+    void anchor() override;
+
 public:
     const std::filesystem::path fileA;
     const std::filesystem::path fileB;
diff --git a/src/libstore/include/nix/store/common-ssh-store-config.hh b/src/libstore/include/nix/store/common-ssh-store-config.hh
index 1e90c94afcbe..b622e82e26bf 100644
--- a/src/libstore/include/nix/store/common-ssh-store-config.hh
+++ b/src/libstore/include/nix/store/common-ssh-store-config.hh
@@ -10,6 +10,10 @@ class SSHMaster;
 
 struct CommonSSHStoreConfig : virtual StoreConfig
 {
+private:
+    void anchor() override;
+
+public:
     CommonSSHStoreConfig(const Params & params)
         : StoreConfig(params, FilePathType::Unix)
     {
diff --git a/src/libstore/include/nix/store/content-address.hh b/src/libstore/include/nix/store/content-address.hh
index 41ccc69aeb3f..ce700bd1ac0d 100644
--- a/src/libstore/include/nix/store/content-address.hh
+++ b/src/libstore/include/nix/store/content-address.hh
@@ -131,6 +131,15 @@ struct ContentAddressMethod
      * for hashing file systeme objects.
      */
     FileIngestionMethod getFileIngestionMethod() const;
+
+    /**
+     * The FileSerialisationMethod that is recommended for this content addressing method.
+     * In some circumstances, other methods are also valid.
+     * Note that `Git` is mapped to `NixArchive`, even though it could represent a single file.
+     * There is no support for flat serialisation of merkle objects; and even if there were,
+     * it would be unable to represent executable files.
+     */
+    FileSerialisationMethod getFileSerialisationMethod() const;
 };
 
 /*
diff --git a/src/libstore/include/nix/store/daemon.hh b/src/libstore/include/nix/store/daemon.hh
index 4d550696e877..a0a0d63e30b0 100644
--- a/src/libstore/include/nix/store/daemon.hh
+++ b/src/libstore/include/nix/store/daemon.hh
@@ -4,10 +4,26 @@
 #include "nix/util/serialise.hh"
 #include "nix/store/store-api.hh"
 
-namespace nix::daemon {
+namespace nix {
 
-enum RecursiveFlag : bool { NotRecursive = false, Recursive = true };
+struct Builder;
 
-void processConnection(ref<Store> store, FdSource && from, FdSink && to, TrustedFlag trusted, RecursiveFlag recursive);
+namespace daemon {
 
-} // namespace nix::daemon
+enum struct RecursiveFlag {
+    NotRecursive = 0,
+    Recursive = 1,
+    RecursiveSubmitted = 2,
+};
+
+void processConnection(
+    ref<Store> store,
+    FdSource && from,
+    FdSink && to,
+    TrustedFlag trusted,
+    RecursiveFlag recursive,
+    std::shared_ptr<Builder> builder = nullptr);
+
+} // namespace daemon
+
+} // namespace nix
diff --git a/src/libstore/include/nix/store/derivation-options.hh b/src/libstore/include/nix/store/derivation-options.hh
index e29f660c4848..0931b41143f7 100644
--- a/src/libstore/include/nix/store/derivation-options.hh
+++ b/src/libstore/include/nix/store/derivation-options.hh
@@ -13,8 +13,15 @@
 
 namespace nix {
 
+class Store;
+
 struct StoreDirConfig;
-struct BasicDerivation;
+
+template<typename Inputs>
+struct DerivationT;
+struct FullInputs;
+using BasicDerivation = DerivationT<StorePathSet>;
+
 struct StructuredAttrs;
 
 template<typename V>
@@ -180,14 +187,16 @@ struct DerivationOptions
      * the future we'll flip things around so a `BasicDerivation` has
      * `DerivationOptions` instead.
      */
-    StringSet getRequiredSystemFeatures(const BasicDerivation & drv) const;
+    template<typename Inputs>
+    StringSet getRequiredSystemFeatures(const DerivationT<Inputs> & drv) const;
 
     bool substitutesAllowed(const WorkerSettings & workerSettings) const;
 
     /**
      * @param drv See note on `getRequiredSystemFeatures`
      */
-    bool useUidRange(const BasicDerivation & drv) const;
+    template<typename Inputs>
+    bool useUidRange(const DerivationT<Inputs> & drv) const;
 };
 
 extern template struct DerivationOptions<StorePath>;
diff --git a/src/libstore/include/nix/store/derivations.hh b/src/libstore/include/nix/store/derivations.hh
index 4cfc79acbe15..bfb20846ac34 100644
--- a/src/libstore/include/nix/store/derivations.hh
+++ b/src/libstore/include/nix/store/derivations.hh
@@ -16,6 +16,11 @@
 
 namespace nix {
 
+/**
+ * String to include in requiredSystemFeatures to enable builder-rpc-v0
+ */
+static constexpr std::string_view drvFeatureBuilderRpcV0 = "builder-rpc-v0";
+
 struct StoreDirConfig;
 
 /* Abstract syntax of derivations. */
@@ -152,6 +157,23 @@ typedef std::map<std::string, std::pair<DerivationOutput, std::optional<StorePat
  */
 typedef std::map<StorePath, StringSet> DerivationInputs;
 
+/**
+ * Inputs for full Derivation - both source and derivation inputs
+ */
+struct FullInputs
+{
+    /**
+     * inputs that are sources
+     */
+    StorePathSet srcs;
+    /**
+     * inputs that are sub-derivations
+     */
+    DerivedPathMap<std::set<OutputName, std::less<>>> drvs;
+
+    bool operator==(const FullInputs &) const = default;
+};
+
 struct DerivationType
 {
     /**
@@ -263,16 +285,20 @@ struct DerivationType
     bool hasKnownOutputPaths() const;
 };
 
-struct BasicDerivation
+template<typename Inputs>
+struct DerivationT;
+
+using BasicDerivation = DerivationT<StorePathSet>;
+using Derivation = DerivationT<FullInputs>;
+
+template<typename Inputs>
+struct DerivationT
 {
     /**
      * keyed on symbolic IDs
      */
     DerivationOutputs outputs;
-    /**
-     * inputs that are sources
-     */
-    StorePathSet inputSrcs;
+    Inputs inputs;
     std::string platform;
     /**
      * Probably should be an absolute path in the path format that `platform` uses
@@ -287,12 +313,7 @@ struct BasicDerivation
 
     std::string name;
 
-    BasicDerivation() = default;
-    BasicDerivation(BasicDerivation &&) = default;
-    BasicDerivation(const BasicDerivation &) = default;
-    BasicDerivation & operator=(BasicDerivation &&) = default;
-    BasicDerivation & operator=(const BasicDerivation &) = default;
-    virtual ~BasicDerivation() {};
+    bool operator==(const DerivationT &) const = default;
 
     bool isBuiltin() const;
 
@@ -321,27 +342,14 @@ struct BasicDerivation
      */
     void applyRewrites(const StringMap & rewrites);
 
-    bool operator==(const BasicDerivation &) const = default;
-    // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
-    // auto operator <=> (const BasicDerivation &) const = default;
-};
-
-class Store;
-
-struct Derivation : BasicDerivation
-{
-    /**
-     * inputs that are sub-derivations
-     */
-    DerivedPathMap<std::set<OutputName, std::less<>>> inputDrvs;
-
     /**
-     * Print a derivation.
+     * Print a derivation (only meaningful for full Derivation).
      */
     std::string unparse(
         const StoreDirConfig & store,
         bool maskOutputs,
-        DerivedPathMap<StringSet>::ChildNode::Map * actualInputs = nullptr) const;
+        DerivedPathMap<StringSet>::ChildNode::Map * actualInputs = nullptr) const
+        requires std::is_same_v<Inputs, FullInputs>;
 
     /**
      * Determine whether this derivation should be resolved before building.
@@ -354,7 +362,8 @@ struct Derivation : BasicDerivation
      * - Impure derivations always need resolution
      * - Any input derivations have outputs from dynamic derivations
      */
-    bool shouldResolve() const;
+    bool shouldResolve() const
+        requires std::is_same_v<Inputs, FullInputs>;
 
     /**
      * Return the underlying basic derivation but with these changes:
@@ -365,7 +374,8 @@ struct Derivation : BasicDerivation
      * 2. Input placeholders are replaced with realized input store
      *    paths.
      */
-    std::optional<BasicDerivation> tryResolve(Store & store, Store * evalStore = nullptr) const;
+    std::optional<BasicDerivation> tryResolve(Store & store, Store * evalStore = nullptr) const
+        requires std::is_same_v<Inputs, FullInputs>;
 
     /**
      * Like the above, but instead of querying the Nix database for
@@ -375,7 +385,34 @@ struct Derivation : BasicDerivation
     std::optional<BasicDerivation> tryResolve(
         Store & store,
         fun<std::optional<StorePath>(ref<const SingleDerivedPath> drvPath, const std::string & outputName)>
-            queryResolutionChain) const;
+            queryResolutionChain) const
+        requires std::is_same_v<Inputs, FullInputs>;
+
+    /**
+     * Convert a BasicDerivation to a full Derivation.
+     * The resulting Derivation has empty inputDrvs since BasicDerivation
+     * is already resolved.
+     */
+    Derivation unresolve() const
+        requires std::is_same_v<Inputs, StorePathSet>;
+
+    /**
+     * Return a derivation identical to this one, but with the inputs transformed by `f`.
+     */
+    template<typename F>
+    DerivationT<std::invoke_result_t<F, const Inputs &>> mapInputs(F f) const
+    {
+        return {
+            .outputs = outputs,
+            .inputs = f(inputs),
+            .platform = platform,
+            .builder = builder,
+            .args = args,
+            .env = env,
+            .structuredAttrs = structuredAttrs,
+            .name = name,
+        };
+    }
 
     /**
      * Check that the derivation is valid and does not present any
@@ -424,19 +461,8 @@ struct Derivation : BasicDerivation
      * @param store The store to use for path computation
      * @param drvName The derivation name (without .drv extension)
      */
-    void fillInOutputPaths(Store & store);
-
-    Derivation() = default;
-
-    Derivation(const BasicDerivation & bd)
-        : BasicDerivation(bd)
-    {
-    }
-
-    Derivation(BasicDerivation && bd)
-        : BasicDerivation(std::move(bd))
-    {
-    }
+    void fillInOutputPaths(Store & store)
+        requires std::is_same_v<Inputs, FullInputs>;
 
     /**
      * Parse a derivation from JSON, and also perform various
@@ -459,15 +485,35 @@ struct Derivation : BasicDerivation
      * @return A validated derivation with output paths filled in
      * @throws Error if parsing fails, output paths can't be computed, or validation fails
      */
-    static Derivation parseJsonAndValidate(Store & store, const nlohmann::json & json);
-
-    bool operator==(const Derivation &) const = default;
-    // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
-    // auto operator <=> (const Derivation &) const = default;
+    static Derivation parseJsonAndValidate(Store & store, const nlohmann::json & json)
+        requires std::is_same_v<Inputs, FullInputs>;
 };
 
 class Store;
 
+template<>
+std::string DerivationT<FullInputs>::unparse(
+    const StoreDirConfig & store, bool maskOutputs, DerivedPathMap<StringSet>::ChildNode::Map * actualInputs) const;
+template<>
+bool DerivationT<FullInputs>::shouldResolve() const;
+template<>
+std::optional<BasicDerivation> DerivationT<FullInputs>::tryResolve(Store & store, Store * evalStore) const;
+template<>
+std::optional<BasicDerivation> DerivationT<FullInputs>::tryResolve(
+    Store & store,
+    fun<std::optional<StorePath>(ref<const SingleDerivedPath> drvPath, const std::string & outputName)>
+        queryResolutionChain) const;
+template<>
+void DerivationT<FullInputs>::fillInOutputPaths(Store & store);
+template<>
+Derivation DerivationT<FullInputs>::parseJsonAndValidate(Store & store, const nlohmann::json & json);
+template<>
+Derivation DerivationT<StorePathSet>::unresolve() const;
+template<>
+void DerivationT<StorePathSet>::checkInvariants(Store & store) const;
+template<>
+void DerivationT<FullInputs>::checkInvariants(Store & store) const;
+
 /**
  * Compute the store path that would be used for a derivation without writing it.
  *
@@ -620,5 +666,8 @@ constexpr unsigned expectedJsonVersionDerivation = 4;
 } // namespace nix
 
 JSON_IMPL_WITH_XP_FEATURES(nix::DerivationOutput)
-JSON_IMPL_WITH_XP_FEATURES(nix::BasicDerivation)
-JSON_IMPL_WITH_XP_FEATURES(nix::Derivation)
+
+namespace nlohmann {
+template<typename Inputs>
+JSON_IMPL_WITH_XP_FEATURES_INNER(nix::DerivationT<Inputs>);
+} // namespace nlohmann
diff --git a/src/libstore/include/nix/store/downstream-placeholder.hh b/src/libstore/include/nix/store/downstream-placeholder.hh
index ba3e9faeff70..6fe252bf938d 100644
--- a/src/libstore/include/nix/store/downstream-placeholder.hh
+++ b/src/libstore/include/nix/store/downstream-placeholder.hh
@@ -37,7 +37,7 @@ using DrvRef = std::variant<OutputName, Input>;
  * We use them with `Derivation`: the `render()` method is called to
  * render an opaque string which can be used in the derivation, and the
  * resolving logic can substitute those strings for store paths when
- * resolving `Derivation.inputDrvs` to `BasicDerivation.inputSrcs`.
+ * resolving `Derivation.inputs.drvs` to `BasicDerivation.inputs.srcs`.
  */
 class DownstreamPlaceholder
 {
diff --git a/src/libstore/include/nix/store/dummy-store-impl.hh b/src/libstore/include/nix/store/dummy-store-impl.hh
index 8fdeeb362515..bec77a6bee68 100644
--- a/src/libstore/include/nix/store/dummy-store-impl.hh
+++ b/src/libstore/include/nix/store/dummy-store-impl.hh
@@ -15,6 +15,10 @@ struct MemorySourceAccessor;
  */
 struct DummyStore : virtual Store
 {
+private:
+    void anchor() override;
+
+public:
     using Config = DummyStoreConfig;
 
     ref<const Config> config;
diff --git a/src/libstore/include/nix/store/dummy-store.hh b/src/libstore/include/nix/store/dummy-store.hh
index f76fb3d5c2b0..c8a212c75603 100644
--- a/src/libstore/include/nix/store/dummy-store.hh
+++ b/src/libstore/include/nix/store/dummy-store.hh
@@ -12,6 +12,10 @@ struct DummyStore;
 
 struct DummyStoreConfig : public std::enable_shared_from_this<DummyStoreConfig>, virtual StoreConfig
 {
+private:
+    void anchor() override;
+
+public:
     DummyStoreConfig(const Params & params)
         : StoreConfig(params, FilePathType::Unix)
     {
diff --git a/src/libstore/include/nix/store/filetransfer.hh b/src/libstore/include/nix/store/filetransfer.hh
index a423249e6634..774a4e1403b3 100644
--- a/src/libstore/include/nix/store/filetransfer.hh
+++ b/src/libstore/include/nix/store/filetransfer.hh
@@ -23,16 +23,29 @@ namespace nix {
 
 const std::filesystem::path & nixConfDir();
 
-struct FileTransferSettings : Config
+class FileTransferSettings : public Config
 {
-private:
     static std::optional<std::filesystem::path> getDefaultSSLCertFile();
 
+    void anchor() override;
+
 public:
     FileTransferSettings();
 
     Setting<bool> enableHttp2{this, true, "http2", "Whether to enable HTTP/2 support."};
 
+    Setting<bool> enableHttp3{
+        this,
+        false,
+        "http3",
+        R"(
+          Whether to try enabling HTTP/3 (QUIC).
+          When enabled, Nix requests HTTP/3 and transparently falls back
+          to HTTP/2 or HTTP/1.1 for servers that do not support it.
+          This option has no effect unless the `nix` binary is linked
+          against a libcurl built with HTTP/3 (QUIC) support.
+        )"};
+
     Setting<std::string> userAgentSuffix{
         this, "", "user-agent-suffix", "String appended to the user agent in HTTP requests."};
 
@@ -307,6 +320,14 @@ struct FileTransferRequest
     {
     }
 
+    /**
+     * `uri` with any userinfo (`user:password@`) stripped, for use in
+     * progress, warning and error messages so credentials embedded in
+     * the URL don't leak into logs. Returns `uri` verbatim if it can't
+     * be parsed.
+     */
+    std::string displayUri() const;
+
     /**
      * Returns the method description for logging purposes.
      */
@@ -410,7 +431,7 @@ public:
         }
     };
 
-    virtual ~FileTransfer() {}
+    virtual ~FileTransfer();
 
     /**
      * Enqueue a data transfer request, returning a future to the result of
@@ -449,7 +470,7 @@ public:
     void
     download(FileTransferRequest && request, Sink & sink, std::function<void(FileTransferResult)> resultCallback = {});
 
-    enum Error { NotFound, Forbidden, Misc, Transient, Interrupted };
+    enum Error { NotFound, Unauthorized, Forbidden, Misc, Transient };
 };
 
 /**
@@ -469,6 +490,9 @@ ref<FileTransfer> makeFileTransfer(const FileTransferSettings & settings = fileT
 
 class FileTransferError final : public CloneableError<FileTransferError, Error>
 {
+private:
+    void anchor() override;
+
 public:
     FileTransfer::Error error;
     /// intentionally optional
diff --git a/src/libstore/include/nix/store/gc-store.hh b/src/libstore/include/nix/store/gc-store.hh
index 5e23f2052472..d7637374157f 100644
--- a/src/libstore/include/nix/store/gc-store.hh
+++ b/src/libstore/include/nix/store/gc-store.hh
@@ -42,6 +42,16 @@ struct GCOptions
     struct WholeStore
     {};
 
+    struct SpecificPaths
+    {
+        StorePathSet paths;
+
+        /**
+         * Allow dead referrers of candidate paths to also be deleted.
+         */
+        bool deleteReferrers = false;
+    };
+
     GCAction action{gcDeleteDead};
 
     /**
@@ -55,7 +65,7 @@ struct GCOptions
     /**
      * The paths from which to delete.
      */
-    using GCPaths = std::variant<WholeStore, StorePathSet>;
+    using GCPaths = std::variant<WholeStore, SpecificPaths>;
     GCPaths pathsToDelete;
 
     /**
@@ -106,6 +116,10 @@ struct GCResults
  */
 struct GcStore : public virtual Store
 {
+private:
+    void anchor() override;
+
+public:
     inline static std::string operationName = "Garbage collection";
 
     /**
@@ -121,6 +135,13 @@ struct GcStore : public virtual Store
      * Perform a garbage collection.
      */
     virtual void collectGarbage(const GCOptions & options, GCResults & results) = 0;
+
+    /**
+     * Delete build trace entries (realisations) from the store's database.
+     *
+     * The entries are specified by their key (the build trace is a map).
+     */
+    virtual void deleteBuildTraces(const std::set<DrvOutput> & keys) = 0;
 };
 
 } // namespace nix
diff --git a/src/libstore/include/nix/store/globals.hh b/src/libstore/include/nix/store/globals.hh
index becab079198f..34eab7f88469 100644
--- a/src/libstore/include/nix/store/globals.hh
+++ b/src/libstore/include/nix/store/globals.hh
@@ -19,6 +19,10 @@ struct ProfileDirsOptions;
 
 struct LogFileSettings : public virtual Config
 {
+private:
+    void anchor() override;
+
+public:
     Setting<bool> keepLog{
         this,
         true,
@@ -45,6 +49,10 @@ struct LogFileSettings : public virtual Config
 
 struct NarInfoDiskCacheSettings : public virtual Config
 {
+private:
+    void anchor() override;
+
+public:
     Setting<unsigned int> ttlNegative{
         this,
         3600,
@@ -96,6 +104,9 @@ class Settings : public virtual Config,
                  private WorkerSettings,
                  private NarInfoDiskCacheSettings
 {
+private:
+    void anchor() override;
+public:
     StringSet getDefaultSystemFeatures();
 
     StringSet getDefaultExtraPlatforms();
diff --git a/src/libstore/include/nix/store/http-binary-cache-store.hh b/src/libstore/include/nix/store/http-binary-cache-store.hh
index 748daec646b9..12465261caef 100644
--- a/src/libstore/include/nix/store/http-binary-cache-store.hh
+++ b/src/libstore/include/nix/store/http-binary-cache-store.hh
@@ -14,6 +14,10 @@ struct HttpBinaryCacheStoreConfig : std::enable_shared_from_this<HttpBinaryCache
                                     virtual Store::Config,
                                     BinaryCacheStoreConfig
 {
+private:
+    void anchor() override;
+
+public:
     HttpBinaryCacheStoreConfig(const Params & params)
         : StoreConfig(params, FilePathType::Unix)
         , BinaryCacheStoreConfig(params)
@@ -88,6 +92,8 @@ struct HttpBinaryCacheStoreConfig : std::enable_shared_from_this<HttpBinaryCache
 
 class HttpBinaryCacheStore : public virtual BinaryCacheStore
 {
+    void anchor() override;
+
     struct State
     {
         bool enabled = true;
diff --git a/src/libstore/include/nix/store/indirect-root-store.hh b/src/libstore/include/nix/store/indirect-root-store.hh
index d477a320aa79..2f6a0fdb1ad2 100644
--- a/src/libstore/include/nix/store/indirect-root-store.hh
+++ b/src/libstore/include/nix/store/indirect-root-store.hh
@@ -38,6 +38,10 @@ namespace nix {
  */
 struct IndirectRootStore : public virtual LocalFSStore
 {
+private:
+    void anchor() override;
+
+public:
     inline static std::string operationName = "Indirect GC roots registration";
 
     /**
diff --git a/src/libstore/include/nix/store/legacy-ssh-store.hh b/src/libstore/include/nix/store/legacy-ssh-store.hh
index 03a7608995e0..7efbdf1545df 100644
--- a/src/libstore/include/nix/store/legacy-ssh-store.hh
+++ b/src/libstore/include/nix/store/legacy-ssh-store.hh
@@ -2,7 +2,6 @@
 ///@file
 
 #include "nix/store/common-ssh-store-config.hh"
-#include "nix/store/store-api.hh"
 #include "nix/store/ssh.hh"
 #include "nix/util/callback.hh"
 #include "nix/util/pool.hh"
@@ -12,6 +11,10 @@ namespace nix {
 
 struct LegacySSHStoreConfig : std::enable_shared_from_this<LegacySSHStoreConfig>, virtual CommonSSHStoreConfig
 {
+private:
+    void anchor() override;
+
+public:
     LegacySSHStoreConfig(const Params & params)
         : StoreConfig(params, FilePathType::Unix)
         , CommonSSHStoreConfig(params)
@@ -63,6 +66,10 @@ struct LegacySSHStoreConfig : std::enable_shared_from_this<LegacySSHStoreConfig>
 
 struct LegacySSHStore : public virtual Store
 {
+private:
+    void anchor() override;
+
+public:
     using Config = LegacySSHStoreConfig;
 
     ref<const Config> config;
@@ -132,24 +139,7 @@ struct LegacySSHStore : public virtual Store
 
 public:
 
-    BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode) override;
-
-    /**
-     * Note, the returned function must only be called once, or we'll
-     * try to read from the connection twice.
-     *
-     * @todo Use C++23 `std::move_only_function`.
-     */
-    fun<BuildResult()> buildDerivationAsync(
-        const StorePath & drvPath, const BasicDerivation & drv, const ServeProto::BuildOptions & options);
-
-    void buildPaths(
-        const std::vector<DerivedPath> & drvPaths, BuildMode buildMode, std::shared_ptr<Store> evalStore) override;
-
-    void ensurePath(const StorePath & path) override
-    {
-        unsupported("ensurePath");
-    }
+    ref<Builder> getBuilder(std::shared_ptr<Store> evalStore) override;
 
     ref<SourceAccessor> getFSAccessor(bool requireValidPath) override
     {
@@ -161,19 +151,6 @@ public:
         unsupported("getFSAccessor");
     }
 
-    /**
-     * The default instance would schedule the work on the client side, but
-     * for consistency with `buildPaths` and `buildDerivation` it should happen
-     * on the remote side.
-     *
-     * We make this fail for now so we can add implement this properly later
-     * without it being a breaking change.
-     */
-    void repairPath(const StorePath & path) override
-    {
-        unsupported("repairPath");
-    }
-
     void computeFSClosure(
         const StorePathSet & paths,
         StorePathSet & out,
@@ -224,6 +201,8 @@ public:
         // not supported
         return {};
     }
+
+    friend struct LegacySSHBuilder;
 };
 
 } // namespace nix
diff --git a/src/libstore/include/nix/store/local-binary-cache-store.hh b/src/libstore/include/nix/store/local-binary-cache-store.hh
index 69a4bac1c8a9..181b33e4bdf8 100644
--- a/src/libstore/include/nix/store/local-binary-cache-store.hh
+++ b/src/libstore/include/nix/store/local-binary-cache-store.hh
@@ -9,6 +9,10 @@ struct LocalBinaryCacheStoreConfig : std::enable_shared_from_this<LocalBinaryCac
                                      virtual Store::Config,
                                      BinaryCacheStoreConfig
 {
+private:
+    void anchor() override;
+
+public:
     LocalBinaryCacheStoreConfig(const Params & params)
         : StoreConfig(params, FilePathType::Unix)
         , BinaryCacheStoreConfig(params)
diff --git a/src/libstore/include/nix/store/local-fs-store.hh b/src/libstore/include/nix/store/local-fs-store.hh
index a5c0af34f7f5..99952471a790 100644
--- a/src/libstore/include/nix/store/local-fs-store.hh
+++ b/src/libstore/include/nix/store/local-fs-store.hh
@@ -10,6 +10,8 @@ namespace nix {
 struct LocalFSStoreConfig : virtual StoreConfig
 {
 private:
+    void anchor() override;
+
     static Setting<std::optional<AbsolutePath>>
     makeRootDirSetting(LocalFSStoreConfig & self, std::optional<AbsolutePath> defaultValue)
     {
@@ -45,7 +47,7 @@ public:
         R"(
           Directory where Nix stores state.
 
-          Defaults to [`NIX_STATE_DIR`](@docroot@/command-ref/env-common.md#env-NIX_STATE_DIR) when [`root`](#store-setting-root) is not set.
+          Defaults to [`NIX_STATE_DIR`](@docroot@/command-ref/env-common.md#env-NIX_STATE_DIR) when [`root`](#@store-slug@-root) is not set.
         )",
     };
 
@@ -56,7 +58,7 @@ public:
         R"(
           Directory where Nix stores log files.
 
-          Defaults to [`NIX_LOG_DIR`](@docroot@/command-ref/env-common.md#env-NIX_LOG_DIR) when [`root`](#store-setting-root) is not set.
+          Defaults to [`NIX_LOG_DIR`](@docroot@/command-ref/env-common.md#env-NIX_LOG_DIR) when [`root`](#@store-slug@-root) is not set.
         )",
     };
 
@@ -67,7 +69,7 @@ public:
         R"(
           Physical path of the Nix store.
 
-          Defaults to [`store`](#store-setting-store) when [`root`](#store-setting-root) is not set.
+          Defaults to [`store`](#@store-slug@-store) when [`root`](#@store-slug@-root) is not set.
         )",
     };
 
@@ -87,6 +89,10 @@ struct alignas(8) /* Work around ASAN failures on i686-linux. */
                    virtual GcStore,
                    virtual LogStore
 {
+private:
+    void anchor() override;
+
+public:
     using Config = LocalFSStoreConfig;
 
     const Config & config;
diff --git a/src/libstore/include/nix/store/local-overlay-store.hh b/src/libstore/include/nix/store/local-overlay-store.hh
index dfb1fb184a55..10b04937c3aa 100644
--- a/src/libstore/include/nix/store/local-overlay-store.hh
+++ b/src/libstore/include/nix/store/local-overlay-store.hh
@@ -7,6 +7,10 @@ namespace nix {
  */
 struct LocalOverlayStoreConfig : virtual LocalStoreConfig
 {
+private:
+    void anchor() override;
+
+public:
     LocalOverlayStoreConfig(const StringMap & params)
         : LocalOverlayStoreConfig("", params)
     {
@@ -119,6 +123,8 @@ struct LocalOverlayStore : virtual LocalStore
     LocalOverlayStore(ref<const Config>);
 
 private:
+    void anchor() override;
+
     /**
      * The store beneath us.
      *
diff --git a/src/libstore/include/nix/store/local-settings.hh b/src/libstore/include/nix/store/local-settings.hh
index 4fe28818d2b8..46186fd6ae1b 100644
--- a/src/libstore/include/nix/store/local-settings.hh
+++ b/src/libstore/include/nix/store/local-settings.hh
@@ -39,6 +39,10 @@ void BaseSetting<PathsInChroot>::appendOrSet(PathsInChroot newValue, bool append
 
 struct GCSettings : public virtual Config
 {
+private:
+    void anchor() override;
+
+public:
     Setting<off_t> reservedSize{
         this,
         8 * 1024 * 1024,
@@ -61,6 +65,9 @@ struct GCSettings : public virtual Config
           collector still deletes store paths that are used only at build
           time (e.g., the C compiler, or source tarballs downloaded from the
           network). To prevent it from doing so, set this option to `true`.
+
+          This option only applies to garbage collection of the whole store
+          and does not affect deleting explicit paths.
         )",
         {"gc-keep-outputs"},
     };
@@ -80,6 +87,9 @@ struct GCSettings : public virtual Config
           store path was built), so by default this option is on. Turn it off
           to save a bit of disk space (or a lot if `keep-outputs` is also
           turned on).
+
+          This option only applies to garbage collection of the whole store
+          and does not affect deleting explicit paths.
         )",
         {"gc-keep-derivations"},
     };
@@ -128,6 +138,10 @@ const uint32_t maxIdsPerBuild =
 
 struct AutoAllocateUidSettings : public virtual Config
 {
+private:
+    void anchor() override;
+
+public:
     Setting<uint32_t> startId{
         this,
 #ifdef __linux__
@@ -163,6 +177,10 @@ struct AutoAllocateUidSettings : public virtual Config
  */
 struct LocalSettings : public virtual Config, public GCSettings, public AutoAllocateUidSettings
 {
+private:
+    void anchor() override;
+
+public:
     /**
      * Get the GC settings.
      */
@@ -190,7 +208,7 @@ struct LocalSettings : public virtual Config, public GCSettings, public AutoAllo
         0,
         "cores",
         R"(
-          Sets the value of the `NIX_BUILD_CORES` environment variable in the [invocation of the `builder` executable](@docroot@/store/building.md#builder-execution) of a derivation.
+          Sets the value of the `NIX_BUILD_CORES` environment variable in the [invocation of the `builder` executable](@docroot@/store/building.md#env-vars) of a derivation.
           The `builder` executable can use this variable to control its own maximum amount of parallelism.
 
           <!--
@@ -718,7 +736,7 @@ public:
      * Finds the first external derivation builder that supports this
      * derivation, or else returns a null pointer.
      */
-    const ExternalBuilder * findExternalDerivationBuilderIfSupported(const Derivation & drv);
+    const ExternalBuilder * findExternalDerivationBuilderIfSupported(const BasicDerivation & drv);
 };
 
 template<>
diff --git a/src/libstore/include/nix/store/local-store.hh b/src/libstore/include/nix/store/local-store.hh
index bf3437e95771..cbd4cc0c2dfb 100644
--- a/src/libstore/include/nix/store/local-store.hh
+++ b/src/libstore/include/nix/store/local-store.hh
@@ -35,8 +35,9 @@ struct LocalSettings;
 
 struct LocalBuildStoreConfig : virtual LocalFSStoreConfig
 {
-
 private:
+    void anchor() override;
+
     /**
       Input for computing the build directory. See `getBuildDir()`.
      */
@@ -89,6 +90,7 @@ struct LocalStoreConfig : std::enable_shared_from_this<LocalStoreConfig>,
     LocalStoreConfig(const std::filesystem::path & path, const Params & params);
 
 private:
+    void anchor() override;
 
     /**
      * An indirection so that we don't need to refer to global settings
@@ -145,7 +147,7 @@ public:
           Whether to request garbage collector roots from an external daemon.
 
           When enabled, the garbage collector connects to a Unix domain socket
-          at [`<state-dir>`](@docroot@/store/types/local-store.md#store-option-state)`/gc-roots-socket/socket` to discover additional roots
+          at [`<state-dir>`](@docroot@/store/types/local-store.md#store-local-store-state)`/gc-roots-socket/socket` to discover additional roots
           that should not be collected. This is useful when the Nix daemon runs
           without root privileges and cannot scan `/proc` for runtime roots.
 
@@ -175,8 +177,12 @@ public:
     StoreReference getReference() const override;
 };
 
+MakeError(PathInUse, Error);
+
 class LocalStore : public virtual IndirectRootStore, public virtual GcStore
 {
+    void anchor() override;
+
 public:
 
     using Config = LocalStoreConfig;
@@ -212,6 +218,7 @@ private:
          */
         bool gcRunning = false;
         std::shared_future<void> gcFuture;
+        std::thread gcThread;
 
         /**
          * How much disk space was available after the previous
@@ -297,6 +304,19 @@ public:
         const StorePathSet & references,
         RepairFlag repair) override;
 
+    // Designed to be used from RestrictedStore,
+    // allows filtering the references while scanning.
+    // Not an entirely separate function in order to reduce duplication
+    StorePath addToStoreFromDump(
+        Source & dump,
+        std::string_view name,
+        FileSerialisationMethod dumpMethod,
+        ContentAddressMethod hashMethod,
+        HashAlgorithm hashAlgo,
+        const StorePathSet & references,
+        RepairFlag repair,
+        bool filterReferences);
+
     void addTempRoot(const StorePath & path) override;
 
 private:
@@ -340,6 +360,8 @@ public:
 
     void collectGarbage(const GCOptions & options, GCResults & results) override;
 
+    void deleteBuildTraces(const std::set<DrvOutput> & keys) override;
+
     /**
      * Called by `collectGarbage` to trace in reverse.
      *
@@ -466,7 +488,12 @@ private:
 
     void openDB(State & state, bool create);
 
-    void upgradeDBSchema(State & state);
+    /**
+     * Perform or check if a database schema upgrade is needed.
+     * @param dryRun only check if an upgrade is needed.
+     * @return true if an upgrade is needed or was performed, false otherwise.
+     */
+    bool upgradeDBSchema(State & state, bool dryRun);
 
     void makeStoreWritable();
 
diff --git a/src/libstore/include/nix/store/log-store.hh b/src/libstore/include/nix/store/log-store.hh
index 2d81d02b10cc..e0acd9a04f62 100644
--- a/src/libstore/include/nix/store/log-store.hh
+++ b/src/libstore/include/nix/store/log-store.hh
@@ -7,6 +7,10 @@ namespace nix {
 
 struct LogStore : public virtual Store
 {
+private:
+    void anchor() override;
+
+public:
     inline static std::string operationName = "Build log storage and retrieval";
 
     /**
diff --git a/src/libstore/include/nix/store/machines.hh b/src/libstore/include/nix/store/machines.hh
index a3e9353c80fa..50d5350838b0 100644
--- a/src/libstore/include/nix/store/machines.hh
+++ b/src/libstore/include/nix/store/machines.hh
@@ -16,6 +16,13 @@ struct Machine
 {
 
     const StoreReference storeUri;
+    /**
+     * @TODO this information should eventually just exist to update an
+     * underlying setting on `Store::Config`, just as the feature information
+     * updates `Store::Config::systemType`. The only wrinkle is whether the
+     * makes sense for separate local stores to have distinct systems, when they
+     * are all the current OS, just different part of the file system.
+     */
     const StringSet systemTypes;
     const std::optional<std::filesystem::path> sshKey;
     const unsigned int maxJobs;
diff --git a/src/libstore/include/nix/store/meson.build b/src/libstore/include/nix/store/meson.build
index 3ccf0adc2fa1..fb4f0658b47a 100644
--- a/src/libstore/include/nix/store/meson.build
+++ b/src/libstore/include/nix/store/meson.build
@@ -13,6 +13,7 @@ headers = [ config_pub_h ] + files(
   'aws-creds.hh',
   'binary-cache-store.hh',
   'build-result.hh',
+  'build.hh',
   'build/build-log.hh',
   'build/derivation-builder.hh',
   'build/derivation-building-goal.hh',
@@ -93,6 +94,7 @@ headers = [ config_pub_h ] + files(
   'store-open.hh',
   'store-reference.hh',
   'store-registration.hh',
+  'submit-store.hh',
   'uds-remote-store.hh',
   'worker-protocol-connection.hh',
   'worker-protocol-impl.hh',
diff --git a/src/libstore/include/nix/store/nar-info-disk-cache.hh b/src/libstore/include/nix/store/nar-info-disk-cache.hh
index a30c5a553b96..f7bfcd035a23 100644
--- a/src/libstore/include/nix/store/nar-info-disk-cache.hh
+++ b/src/libstore/include/nix/store/nar-info-disk-cache.hh
@@ -12,6 +12,11 @@ struct NarInfoDiskCacheSettings;
 
 struct NarInfoDiskCache
 {
+private:
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
+public:
     using Settings = NarInfoDiskCacheSettings;
 
     const Settings & settings;
@@ -25,16 +30,19 @@ struct NarInfoDiskCache
 
     virtual ~NarInfoDiskCache() {}
 
-    virtual int
-    createCache(const std::string & uri, const std::string & storeDir, bool wantMassQuery, int priority) = 0;
-
     struct CacheInfo
     {
-        int id;
-        bool wantMassQuery;
-        int priority;
+        int id = 0;
+        bool wantMassQuery = false;
+        int priority = 0;
     };
 
+    /**
+     * Create or update the cached nix-cache-info for the binary cache at `uri`.
+     * Note that `info.id` is ignored. This function returns the id of the cache entry.
+     */
+    virtual int createCache(const std::string & uri, const std::string & storeDir, const CacheInfo & info) = 0;
+
     virtual std::optional<CacheInfo> upToDateCacheExists(const std::string & uri) = 0;
 
     virtual std::pair<Outcome, std::shared_ptr<NarInfo>>
diff --git a/src/libstore/include/nix/store/nar-info.hh b/src/libstore/include/nix/store/nar-info.hh
index 7403dc1d4452..7e55de9ba5d3 100644
--- a/src/libstore/include/nix/store/nar-info.hh
+++ b/src/libstore/include/nix/store/nar-info.hh
@@ -13,7 +13,7 @@ struct StoreDirConfig;
 struct UnkeyedNarInfo : virtual UnkeyedValidPathInfo
 {
     std::string url;
-    std::string compression; // FIXME: Use CompressionAlgo
+    std::optional<CompressionAlgo> compression;
     std::optional<Hash> fileHash;
     uint64_t fileSize = 0;
 
@@ -36,6 +36,10 @@ struct UnkeyedNarInfo : virtual UnkeyedValidPathInfo
  */
 struct NarInfo : ValidPathInfo, UnkeyedNarInfo
 {
+private:
+    void anchor() override;
+
+public:
     NarInfo() = delete;
 
     NarInfo(ValidPathInfo info)
diff --git a/src/libstore/include/nix/store/outputs-query.hh b/src/libstore/include/nix/store/outputs-query.hh
index 62a2524ddb60..0129688acd2a 100644
--- a/src/libstore/include/nix/store/outputs-query.hh
+++ b/src/libstore/include/nix/store/outputs-query.hh
@@ -19,7 +19,7 @@ using QueryRealisationFun = std::function<std::shared_ptr<const UnkeyedRealisati
 void queryPartialDerivationOutputMapCA(
     Store & store,
     const StorePath & drvPath,
-    const BasicDerivation & drv,
+    const Derivation & drv,
     std::map<std::string, std::optional<StorePath>> & outputs,
     QueryRealisationFun queryRealisation = {});
 
diff --git a/src/libstore/include/nix/store/outputs-spec.hh b/src/libstore/include/nix/store/outputs-spec.hh
index 5482c0e24bde..11613d7c84cf 100644
--- a/src/libstore/include/nix/store/outputs-spec.hh
+++ b/src/libstore/include/nix/store/outputs-spec.hh
@@ -140,5 +140,5 @@ struct ExtendedOutputsSpec
 
 } // namespace nix
 
-JSON_IMPL(OutputsSpec)
-JSON_IMPL(ExtendedOutputsSpec)
+JSON_IMPL(nix::OutputsSpec)
+JSON_IMPL(nix::ExtendedOutputsSpec)
diff --git a/src/libstore/include/nix/store/path-info.hh b/src/libstore/include/nix/store/path-info.hh
index c94a0d0936f0..0dd19b81ecf1 100644
--- a/src/libstore/include/nix/store/path-info.hh
+++ b/src/libstore/include/nix/store/path-info.hh
@@ -90,14 +90,6 @@ struct UnkeyedValidPathInfo
      */
     uint64_t narSize = 0;
 
-    /**
-     * internal use only: SQL primary key for on-disk store objects with
-     * `LocalStore`.
-     *
-     * @todo Remove, layer violation
-     */
-    uint64_t id = 0;
-
     /**
      * Whether the path is ultimately trusted, that is, it's a
      * derivation output that was built locally.
@@ -156,6 +148,11 @@ struct UnkeyedValidPathInfo
     virtual nlohmann::json
     toJSON(const StoreDirConfig * store, bool includeImpureInfo, PathInfoJsonFormat format) const;
     static UnkeyedValidPathInfo fromJSON(const StoreDirConfig * store, const nlohmann::json & json);
+
+private:
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
 };
 
 struct ValidPathInfo : virtual UnkeyedValidPathInfo
@@ -222,6 +219,9 @@ struct ValidPathInfo : virtual UnkeyedValidPathInfo
 
     static ValidPathInfo
     makeFromCA(const StoreDirConfig & store, std::string_view name, ContentAddressWithReferences && ca, Hash narHash);
+
+private:
+    void anchor() override;
 };
 
 static_assert(std::is_move_assignable_v<ValidPathInfo>);
diff --git a/src/libstore/include/nix/store/path-references.hh b/src/libstore/include/nix/store/path-references.hh
index 2aa656adbef7..14e725cdc7bf 100644
--- a/src/libstore/include/nix/store/path-references.hh
+++ b/src/libstore/include/nix/store/path-references.hh
@@ -18,6 +18,8 @@ class PathRefScanSink : public RefScanSink
 
     PathRefScanSink(StringSet && hashes, std::map<std::string, StorePath> && backMap);
 
+    void anchor() override;
+
 public:
 
     static PathRefScanSink fromPaths(const StorePathSet & refs);
diff --git a/src/libstore/include/nix/store/posix-fs-canonicalise.hh b/src/libstore/include/nix/store/posix-fs-canonicalise.hh
index 8a8b0eca309a..ffa0efb5b3ca 100644
--- a/src/libstore/include/nix/store/posix-fs-canonicalise.hh
+++ b/src/libstore/include/nix/store/posix-fs-canonicalise.hh
@@ -69,6 +69,4 @@ void canonicalisePathMetaData(const std::filesystem::path & path, CanonicalizePa
 
 void canonicaliseTimestampAndPermissions(const std::filesystem::path & path);
 
-MakeError(PathInUse, Error);
-
 } // namespace nix
diff --git a/src/libstore/include/nix/store/realisation.hh b/src/libstore/include/nix/store/realisation.hh
index 33159b6dc848..007222f2e98a 100644
--- a/src/libstore/include/nix/store/realisation.hh
+++ b/src/libstore/include/nix/store/realisation.hh
@@ -4,6 +4,7 @@
 #include <variant>
 
 #include "nix/util/hash.hh"
+#include "nix/util/std-hash.hh"
 #include "nix/store/path.hh"
 #include "nix/store/derived-path.hh"
 #include <nlohmann/json_fwd.hpp>
@@ -162,6 +163,8 @@ struct RealisedPath
 
 class MissingRealisation final : public CloneableError<MissingRealisation, Error>
 {
+    void anchor() override;
+
 public:
     MissingRealisation(const StoreDirConfig & store, DrvOutput & outputId)
         : MissingRealisation(store, outputId.drvPath, outputId.outputName)
@@ -178,6 +181,26 @@ public:
 
 } // namespace nix
 
+template<>
+struct std::hash<nix::DrvOutput>
+{
+    std::size_t operator()(const nix::DrvOutput & id) const noexcept
+    {
+        std::size_t h = 0;
+        nix::hash_combine(h, id.drvPath, id.outputName);
+        return h;
+    }
+};
+
+namespace nix {
+
+inline std::size_t hash_value(const DrvOutput & id)
+{
+    return std::hash<DrvOutput>{}(id);
+}
+
+} // namespace nix
+
 JSON_IMPL(nix::DrvOutput)
 JSON_IMPL(nix::UnkeyedRealisation)
 JSON_IMPL(nix::Realisation)
diff --git a/src/libstore/include/nix/store/references.hh b/src/libstore/include/nix/store/references.hh
index 1d5648075d4c..ff44fe540d42 100644
--- a/src/libstore/include/nix/store/references.hh
+++ b/src/libstore/include/nix/store/references.hh
@@ -12,6 +12,8 @@ class RefScanSink : public Sink
 
     std::string tail;
 
+    void anchor() override;
+
 public:
 
     RefScanSink(StringSet && hashes)
@@ -29,13 +31,17 @@ public:
 
 struct RewritingSink : Sink
 {
+private:
+    void anchor() override;
+
+public:
     const StringMap rewrites;
     std::string::size_type maxRewriteSize;
     std::string prev;
     Sink & nextSink;
     uint64_t pos = 0;
 
-    std::vector<uint64_t> matches;
+    std::set<uint64_t> matches;
 
     RewritingSink(const std::string & from, const std::string & to, Sink & nextSink);
     RewritingSink(const StringMap & rewrites, Sink & nextSink);
@@ -47,6 +53,10 @@ struct RewritingSink : Sink
 
 struct HashModuloSink : AbstractHashSink
 {
+private:
+    void anchor() override;
+
+public:
     HashSink hashSink;
     RewritingSink rewritingSink;
 
diff --git a/src/libstore/include/nix/store/remote-fs-accessor.hh b/src/libstore/include/nix/store/remote-fs-accessor.hh
index 9a84e1e97891..26fae0d63dd2 100644
--- a/src/libstore/include/nix/store/remote-fs-accessor.hh
+++ b/src/libstore/include/nix/store/remote-fs-accessor.hh
@@ -10,6 +10,8 @@ namespace nix {
 
 class RemoteFSAccessor : public SourceAccessor
 {
+    void anchor() override;
+
     ref<Store> store;
 
     /**
@@ -31,6 +33,8 @@ public:
 
     /**
      * @return nullptr if the store does not contain any object at that path.
+     *
+     * @todo This actually doesn't return nullptr, but throws on invalid paths.
      */
     std::shared_ptr<SourceAccessor> accessObject(const StorePath & path);
 
diff --git a/src/libstore/include/nix/store/remote-store-connection.hh b/src/libstore/include/nix/store/remote-store-connection.hh
index 16a90c3f66fe..34e7a027892e 100644
--- a/src/libstore/include/nix/store/remote-store-connection.hh
+++ b/src/libstore/include/nix/store/remote-store-connection.hh
@@ -17,6 +17,12 @@ namespace nix {
  */
 struct RemoteStore::Connection : WorkerProto::BasicClientConnection, WorkerProto::ClientHandshakeInfo
 {
+private:
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
+
+public:
     /**
      * Time this connection was established.
      */
diff --git a/src/libstore/include/nix/store/remote-store.hh b/src/libstore/include/nix/store/remote-store.hh
index 57beb9135f7a..1879786e2011 100644
--- a/src/libstore/include/nix/store/remote-store.hh
+++ b/src/libstore/include/nix/store/remote-store.hh
@@ -6,6 +6,7 @@
 #include <string>
 
 #include "nix/store/store-api.hh"
+#include "nix/store/submit-store.hh"
 #include "nix/util/sync.hh"
 #include "nix/util/file-descriptor.hh"
 #include "nix/store/gc-store.hh"
@@ -23,6 +24,10 @@ class RemoteFSAccessor;
 
 struct RemoteStoreConfig : virtual StoreConfig
 {
+private:
+    void anchor() override;
+
+public:
     RemoteStoreConfig(const Params & params, FilePathType pathType)
         : StoreConfig(params, pathType)
     {
@@ -42,8 +47,12 @@ struct RemoteStoreConfig : virtual StoreConfig
  * \todo RemoteStore is a misnomer - should be something like
  * DaemonStore.
  */
-struct RemoteStore : public virtual Store, public virtual GcStore, public virtual LogStore
+struct RemoteStore : public virtual Store, public virtual GcStore, public virtual LogStore, public virtual SubmitStore
 {
+private:
+    void anchor() override;
+
+public:
     using Config = RemoteStoreConfig;
 
     const Config & config;
@@ -105,18 +114,19 @@ struct RemoteStore : public virtual Store, public virtual GcStore, public virtua
 
     void registerDrvOutput(const Realisation & info) override;
 
-    void queryRealisationUncached(
-        const DrvOutput &, Callback<std::shared_ptr<const UnkeyedRealisation>> callback) noexcept override;
-
-    void
-    buildPaths(const std::vector<DerivedPath> & paths, BuildMode buildMode, std::shared_ptr<Store> evalStore) override;
+    void submitOutput(const SingleDerivedPath & path, const OutputName & output) override;
 
-    std::vector<KeyedBuildResult> buildPathsWithResults(
-        const std::vector<DerivedPath> & paths, BuildMode buildMode, std::shared_ptr<Store> evalStore) override;
+    ref<const ValidPathInfo> addToStoreScanning(
+        Source & dump,
+        std::string_view name,
+        FileSerialisationMethod dumpMethod,
+        ContentAddressMethod hashMethod,
+        HashAlgorithm hashAlgo) override;
 
-    BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode) override;
+    void queryRealisationUncached(
+        const DrvOutput &, Callback<std::shared_ptr<const UnkeyedRealisation>> callback) noexcept override;
 
-    void ensurePath(const StorePath & path) override;
+    ref<Builder> getBuilder(std::shared_ptr<Store> evalStore) override;
 
     void addTempRoot(const StorePath & path) override;
 
@@ -124,23 +134,16 @@ struct RemoteStore : public virtual Store, public virtual GcStore, public virtua
 
     void collectGarbage(const GCOptions & options, GCResults & results) override;
 
+    void deleteBuildTraces(const std::set<DrvOutput> & keys) override
+    {
+        // TODO support this in the protocol someday
+        unsupported("deleteBuildTraces");
+    };
+
     void optimiseStore() override;
 
     bool verifyStore(bool checkContents, RepairFlag repair) override;
 
-    /**
-     * The default instance would schedule the work on the client side, but
-     * for consistency with `buildPaths` and `buildDerivation` it should happen
-     * on the remote side.
-     *
-     * We make this fail for now so we can add implement this properly later
-     * without it being a breaking change.
-     */
-    void repairPath(const StorePath & path) override
-    {
-        unsupported("repairPath");
-    }
-
     void addSignatures(const StorePath & storePath, const std::set<Signature> & sigs) override;
 
     MissingPaths queryMissing(const std::vector<DerivedPath> & targets) override;
@@ -208,7 +211,7 @@ private:
      */
     Sync<std::set<Descriptor>> connectionFds;
 
-    void copyDrvsFromEvalStore(const std::vector<DerivedPath> & paths, std::shared_ptr<Store> evalStore);
+    friend struct RemoteBuilder;
 };
 
 } // namespace nix
diff --git a/src/libstore/include/nix/store/restricted-store.hh b/src/libstore/include/nix/store/restricted-store.hh
index ca4e0b8536a7..92d7725a1fa3 100644
--- a/src/libstore/include/nix/store/restricted-store.hh
+++ b/src/libstore/include/nix/store/restricted-store.hh
@@ -2,11 +2,16 @@
 ///@file
 
 #include "nix/store/store-api.hh"
+#include "nix/util/sync.hh"
+
+#include <future>
 
 namespace nix {
 
+struct Builder;
 class LocalStore;
 struct LocalStoreConfig;
+class Worker;
 
 /**
  * A restricted store has a pointer to one of these, which manages the
@@ -23,20 +28,31 @@ struct LocalStoreConfig;
  */
 struct RestrictionContext
 {
+private:
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
+
+public:
     /**
      * Paths that are already allowed to begin with
      */
     virtual const StorePathSet & originalPaths() = 0;
 
-    /**
-     * Paths that were added via recursive Nix calls.
-     */
-    StorePathSet addedPaths;
+    struct State
+    {
+        /**
+         * Paths that were added via recursive Nix calls.
+         */
+        std::map<StorePath, std::shared_future<void>> addedPaths;
 
-    /**
-     * Realisations that were added via recursive Nix calls.
-     */
-    std::set<DrvOutput> addedDrvOutputs;
+        /**
+         * Realisations that were added via recursive Nix calls.
+         */
+        std::set<DrvOutput> addedDrvOutputs;
+    };
+
+    Sync<State> state_;
 
     /**
      * Recursive Nix calls are only allowed to build or realize paths
@@ -48,6 +64,18 @@ struct RestrictionContext
     virtual bool isAllowed(const DrvOutput & id) = 0;
     bool isAllowed(const DerivedPath & id);
 
+    /**
+     * Whether mounting dependencies inside the sandbox should happen,
+     * or if it should be entirely skipped.
+     */
+    virtual bool shouldModifySandbox() = 0;
+
+    /**
+     * Register a store path to an output name
+     * For builder-rpc-v0
+     */
+    virtual void submitOutput(const SingleDerivedPath & path, const OutputName & output) = 0;
+
     /**
      * Add 'path' to the set of paths that may be referenced by the
      * outputs, and make it appear in the sandbox.
@@ -56,7 +84,34 @@ struct RestrictionContext
     {
         if (isAllowed(path))
             return;
-        addDependencyImpl(path);
+
+        std::promise<void> promise;
+
+        auto [future, shouldAdd] = [&]() -> std::pair<std::shared_future<void>, bool> {
+            auto state(state_.lock());
+            if (auto iter = state->addedPaths.find(path); iter != state->addedPaths.end()) {
+                return {iter->second, false};
+            }
+            auto [iter2, _] = state->addedPaths.emplace(path, promise.get_future().share());
+            return {iter2->second, true};
+        }();
+
+        /* Another daemon worker thread already started adding the dependency. Just wait for it
+           to complete. */
+        if (!shouldAdd) {
+            future.get();
+            return;
+        }
+
+        try {
+            if (shouldModifySandbox())
+                addDependencyImpl(path);
+            promise.set_value();
+        } catch (...) {
+            /* Notify all other waiters that we are done. */
+            promise.set_exception(std::current_exception());
+            throw;
+        }
     }
 
     virtual ~RestrictionContext() = default;
@@ -76,4 +131,10 @@ protected:
  */
 ref<Store> makeRestrictedStore(ref<LocalStoreConfig> config, ref<LocalStore> next, RestrictionContext & context);
 
+/**
+ * Create a builder that wraps an inner builder, adding restriction
+ * checks and dependency tracking for recursive Nix builds.
+ */
+ref<Builder> makeRestrictedBuilder(Worker & inner, RestrictionContext & context);
+
 } // namespace nix
diff --git a/src/libstore/include/nix/store/sqlite.hh b/src/libstore/include/nix/store/sqlite.hh
index 789e82174627..d11515b29618 100644
--- a/src/libstore/include/nix/store/sqlite.hh
+++ b/src/libstore/include/nix/store/sqlite.hh
@@ -121,9 +121,9 @@ struct SQLiteStmt
         /**
          * Bind the next parameter.
          */
-        Use & operator()(std::string_view value, bool notNull = true);
-        Use & operator()(const unsigned char * data, size_t len, bool notNull = true);
-        Use & operator()(int64_t value, bool notNull = true);
+        Use & apply(std::string_view value, bool notNull = true);
+        Use & apply(const unsigned char * data, size_t len, bool notNull = true);
+        Use & apply(int64_t value, bool notNull = true);
         Use & bind(); // null
 
         int step();
@@ -166,12 +166,15 @@ struct SQLiteTxn
     ~SQLiteTxn();
 };
 
-struct SQLiteError : CloneableError<SQLiteError, Error>
+class SQLiteError : public CloneableError<SQLiteError, Error>
 {
     std::string path;
     std::string errMsg;
     int errNo, extendedErrNo, offset;
 
+    void anchor() override;
+
+public:
     template<typename... Args>
     [[noreturn]] static void throw_(sqlite3 * db, const std::string & fs, const Args &... args)
     {
@@ -207,7 +210,7 @@ void handleSQLiteBusy(const SQLiteBusy & e, time_t & nextWarning);
  * database is busy.
  */
 template<typename T, typename F>
-T retrySQLite(F && fun)
+T retrySQLite(const F & fun)
 {
     time_t nextWarning = time(nullptr) + 1;
 
diff --git a/src/libstore/include/nix/store/ssh-store.hh b/src/libstore/include/nix/store/ssh-store.hh
index 4ab88ca74cb7..324e85eb60f4 100644
--- a/src/libstore/include/nix/store/ssh-store.hh
+++ b/src/libstore/include/nix/store/ssh-store.hh
@@ -12,6 +12,10 @@ struct SSHStoreConfig : std::enable_shared_from_this<SSHStoreConfig>,
                         virtual RemoteStoreConfig,
                         virtual CommonSSHStoreConfig
 {
+private:
+    void anchor() override;
+
+public:
     SSHStoreConfig(const Params & params)
         : StoreConfig(params, FilePathType::Unix)
         , RemoteStoreConfig(params, FilePathType::Unix)
@@ -43,6 +47,10 @@ struct SSHStoreConfig : std::enable_shared_from_this<SSHStoreConfig>,
 
 struct MountedSSHStoreConfig : virtual SSHStoreConfig, virtual LocalFSStoreConfig
 {
+private:
+    void anchor() override;
+
+public:
     MountedSSHStoreConfig(StringMap params);
     MountedSSHStoreConfig(const ParsedURL::Authority & authority, StringMap params);
 
diff --git a/src/libstore/include/nix/store/store-api.hh b/src/libstore/include/nix/store/store-api.hh
index 97251eaee9c2..404944b834a2 100644
--- a/src/libstore/include/nix/store/store-api.hh
+++ b/src/libstore/include/nix/store/store-api.hh
@@ -1,6 +1,7 @@
 #pragma once
 ///@file
 
+#include "nix/store/outputs-spec.hh"
 #include "nix/store/path.hh"
 #include "nix/store/derived-path.hh"
 #include "nix/util/hash.hh"
@@ -36,8 +37,11 @@ struct Realisation;
 struct RealisedPath;
 struct DrvOutput;
 
-struct BasicDerivation;
-struct Derivation;
+template<typename Inputs>
+struct DerivationT;
+struct FullInputs;
+using BasicDerivation = DerivationT<StorePathSet>;
+using Derivation = DerivationT<FullInputs>;
 
 struct SourceAccessor;
 struct NarInfoDiskCache;
@@ -57,6 +61,8 @@ enum TrustedFlag : bool { NotTrusted = false, Trusted = true };
 struct BuildResult;
 struct KeyedBuildResult;
 
+struct Builder;
+
 typedef std::map<StorePath, std::optional<ContentAddress>> StorePathCAMap;
 
 /**
@@ -78,6 +84,9 @@ struct MissingPaths
  */
 struct StoreConfigBase : Config
 {
+private:
+    void anchor() override;
+
 protected:
 
     /**
@@ -229,6 +238,10 @@ public:
  */
 struct StoreConfig : public StoreConfigBase, public StoreDirConfig
 {
+private:
+    void anchor() override;
+
+public:
     using Params = StoreReference::Params;
 
     StoreConfig(const Params & params, FilePathType pathType);
@@ -380,6 +393,10 @@ struct StoreConfig : public StoreConfigBase, public StoreDirConfig
  */
 class Store : public std::enable_shared_from_this<Store>, public StoreDirConfig
 {
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor() = 0;
+
 public:
 
     using Config = StoreConfig;
@@ -444,6 +461,15 @@ public:
 
     virtual ~Store() {}
 
+    /**
+     * Get a `Builder` for this store.
+     *
+     * @param evalStore If provided and different from this store,
+     * derivation files will be copied from the eval store to this
+     * store before building.
+     */
+    virtual ref<Builder> getBuilder(std::shared_ptr<Store> evalStore = nullptr);
+
     /**
      * Follow symlinks until we end up with a path in the Nix store.
      */
@@ -470,6 +496,8 @@ public:
      * If requested, substitute missing paths. This
      * implements nix-copy-closure's --use-substitutes
      * flag.
+     *
+     * @TODO suspicious to have a Store method that uses `getBuilder`.
      */
     void substitutePaths(const StorePathSet & paths);
 
@@ -733,79 +761,49 @@ public:
     virtual void narFromPath(const StorePath & path, Sink & sink);
 
     /**
-     * For each path, if it's a derivation, build it.  Building a
-     * derivation means ensuring that the output paths are valid.  If
-     * they are already valid, this is a no-op.  Otherwise, validity
-     * can be reached in two ways.  First, if the output paths is
-     * substitutable, then build the path that way.  Second, the
-     * output paths can be created by running the builder, after
-     * recursively building any sub-derivations. For inputs that are
-     * not derivations, substitute them.
-     */
-    virtual void buildPaths(
-        const std::vector<DerivedPath> & paths,
-        BuildMode buildMode = bmNormal,
-        std::shared_ptr<Store> evalStore = nullptr);
-
-    /**
-     * Like buildPaths(), but return a vector of \ref BuildResult
-     * BuildResults corresponding to each element in paths. Note that in
-     * case of a build/substitution error, this function won't throw an
-     * exception, but return a BuildResult containing an error message.
-     */
-    virtual std::vector<KeyedBuildResult> buildPathsWithResults(
-        const std::vector<DerivedPath> & paths,
-        BuildMode buildMode = bmNormal,
-        std::shared_ptr<Store> evalStore = nullptr);
-
-    /**
-     * Build a single non-materialized derivation (i.e. not from an
-     * on-disk .drv file).
+     * Add a store path as a temporary root of the garbage collector.
+     * The root disappears as soon as we exit.
+     * Before exiting, if you want to avoid the path being GC'ed, you either have to make it a permanent root using
+     * `LocalFSStore::addPermRoot()`, or make sure it's reachable from a permanent root (e.g. by adding it as a
+     * reference of a reachable path).
      *
-     * @param drvPath This is used to deduplicate worker goals so it is
-     * imperative that is correct. That said, it doesn't literally need
-     * to be store path that would be calculated from writing this
-     * derivation to the store: it is OK if it instead is that of a
-     * Derivation which would resolve to this (by taking the outputs of
-     * it's input derivations and adding them as input sources) such
-     * that the build time referenceable-paths are the same.
+     * To avoid races, you should call either this function or `LocalFSStore::addPermRoot()` *before* creating and using
+     * a store path, e.g.
      *
-     * In the input-addressed case, we usually *do* use an "original"
-     * unresolved derivations's path, as that is what will be used in the
-     * buildPaths case. Also, the input-addressed output paths are verified
-     * only by that contents of that specific unresolved derivation, so it is
-     * nice to keep that information around so if the original derivation is
-     * ever obtained later, it can be verified whether the trusted user in fact
-     * used the proper output path.
+     * ```c++
+     * auto path = store.computeStorePath(...);
+     * store->addTempRoot(path);
+     * if (!store->isValidPath(path))
+     *     store->addToStore(...);
+     * ```
      *
-     * In the content-addressed case, we want to always use the resolved
-     * drv path calculated from the provided derivation. This serves two
-     * purposes:
+     * By contrast, registering a root just before *using* a path is not sufficient to prevent GC races. For
+     * instance, don't do this:
      *
-     *   - It keeps the operation trustless, by ruling out a maliciously
-     *     invalid drv path corresponding to a non-resolution-equivalent
-     *     derivation.
+     * ```c++
+     * store->addTempRoot(path);
+     * auto drv = store->readDerivation(path);
+     * ```
+     *
+     * since the path may be GC'ed just before the call to `addTempRoot()`.
+     *
+     * Note that `addToStore()` implicitly calls `addTempRoot()`, so you don't need to call it yourself if you're
+     * calling `addToStore()` unconditionally.
+     *
+     * It is generally the responsibility of the caller of Nix APIs and CLI tools to ensure that paths are reachable by
+     * the garbage collector. For example, `buildPath(drvPath)` does not need to register *drvPath* as a GC root, since
+     * that's the responsibility of the caller, and it would be too late for `buildPath()` to do so anyway. Thus, this
+     * can race:
+     * ```console
+     * drv=$(nix-instantiate foo.nix)
+     * nix-store -r $drv
+     * ```
+     * whereas this is safe:
+     * ```console
+     * nix-instantiate foo.nix --add-root ./drv
+     * nix-store -r ./drv
+     * ```
      *
-     *   - For the floating case in particular, it ensures that the derivation
-     *     to output mapping respects the resolution equivalence relation, so
-     *     one cannot choose different resolution-equivalent derivations to
-     *     subvert dependency coherence (i.e. the property that one doesn't end
-     *     up with multiple different versions of dependencies without
-     *     explicitly choosing to allow it).
-     */
-    virtual BuildResult
-    buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode = bmNormal);
-
-    /**
-     * Ensure that a path is valid.  If it is not currently valid, it
-     * may be made valid by running a substitute (if defined for the
-     * path).
-     */
-    virtual void ensurePath(const StorePath & path);
-
-    /**
-     * Add a store path as a temporary root of the garbage collector.
-     * The root disappears as soon as we exit.
      */
     virtual void addTempRoot(const StorePath & path)
     {
@@ -868,12 +866,6 @@ public:
         return ref<SourceAccessor>{accessor};
     }
 
-    /**
-     * Repair the contents of the given path by redownloading it using
-     * a substituter (if available).
-     */
-    virtual void repairPath(const StorePath & path);
-
     /**
      * Add signatures to the specified store path. The signatures are
      * not verified.
@@ -896,6 +888,8 @@ public:
     /**
      * Read a derivation, after ensuring its existence through
      * ensurePath().
+     *
+     * @TODO suspicious to have a Store method that uses `getBuilder`.
      */
     Derivation derivationFromPath(const StorePath & drvPath);
 
@@ -1088,7 +1082,8 @@ void copyClosure(
     const std::set<RealisedPath> & paths,
     RepairFlag repair = NoRepair,
     CheckSigsFlag checkSigs = CheckSigs,
-    SubstituteFlag substitute = NoSubstitute);
+    SubstituteFlag substitute = NoSubstitute,
+    bool includeOutputs = false);
 
 void copyClosure(
     Store & srcStore,
@@ -1096,7 +1091,8 @@ void copyClosure(
     const StorePathSet & paths,
     RepairFlag repair = NoRepair,
     CheckSigsFlag checkSigs = CheckSigs,
-    SubstituteFlag substitute = NoSubstitute);
+    SubstituteFlag substitute = NoSubstitute,
+    bool includeOutputs = false);
 
 /**
  * Remove the temporary roots file for this process.  Any temporary
@@ -1115,7 +1111,7 @@ OutputPathMap resolveDerivedPath(Store &, const DerivedPath::Built &, Store * ev
 std::optional<ValidPathInfo>
 decodeValidPathInfo(const Store & store, std::istream & str, std::optional<HashResult> hashGiven = std::nullopt);
 
-const ContentAddress * getDerivationCA(const BasicDerivation & drv);
+const ContentAddress * getDerivationCA(const Derivation & drv);
 
 template<>
 struct json_avoids_null<TrustedFlag> : std::true_type
diff --git a/src/libstore/include/nix/store/store-reference.hh b/src/libstore/include/nix/store/store-reference.hh
index 5beeb0c070af..3689009fc1bc 100644
--- a/src/libstore/include/nix/store/store-reference.hh
+++ b/src/libstore/include/nix/store/store-reference.hh
@@ -135,4 +135,4 @@ NIX_DECLARE_CONFIG_SERIALISER(std::set<StoreReference>)
 
 } // namespace nix
 
-JSON_IMPL(StoreReference)
+JSON_IMPL(nix::StoreReference)
diff --git a/src/libstore/include/nix/store/submit-store.hh b/src/libstore/include/nix/store/submit-store.hh
new file mode 100644
index 000000000000..df3d60878561
--- /dev/null
+++ b/src/libstore/include/nix/store/submit-store.hh
@@ -0,0 +1,37 @@
+#pragma once
+///@file
+
+#include "nix/store/store-api.hh"
+
+namespace nix {
+
+struct SubmitStore : public virtual Store
+{
+private:
+    void anchor() override;
+
+public:
+    inline static std::string operationName = "Submit outputs for a currently running derivation";
+
+    /**
+     * Submit an output for the current derivation.
+     * Only makes sense when running within a recursive-nix derivation
+     */
+    virtual void submitOutput(const SingleDerivedPath & path, const OutputName & output) = 0;
+
+    /**
+     * Add to store, scanning references.
+     * Only within a recursive-nix derivation, as there would otherwise be no known
+     * set of valid store paths
+     */
+    virtual ref<const ValidPathInfo> addToStoreScanning(
+        Source & dump,
+        std::string_view name,
+        FileSerialisationMethod dumpMethod = FileSerialisationMethod::NixArchive,
+        ContentAddressMethod hashMethod = ContentAddressMethod::Raw::NixArchive,
+        HashAlgorithm hashAlgo = HashAlgorithm::SHA256) = 0;
+
+    static SubmitStore & require(Store & store);
+};
+
+} // namespace nix
diff --git a/src/libstore/include/nix/store/uds-remote-store.hh b/src/libstore/include/nix/store/uds-remote-store.hh
index 43931c628af8..8359f8fdf45b 100644
--- a/src/libstore/include/nix/store/uds-remote-store.hh
+++ b/src/libstore/include/nix/store/uds-remote-store.hh
@@ -27,6 +27,10 @@ struct UDSRemoteStoreConfig : std::enable_shared_from_this<UDSRemoteStoreConfig>
                               virtual LocalFSStoreConfig,
                               virtual RemoteStoreConfig
 {
+private:
+    void anchor() override;
+
+public:
     UDSRemoteStoreConfig(const std::filesystem::path & path, const Params & params);
 
     UDSRemoteStoreConfig(const Params & params);
@@ -57,6 +61,10 @@ struct UDSRemoteStoreConfig : std::enable_shared_from_this<UDSRemoteStoreConfig>
 
 struct UDSRemoteStore : virtual IndirectRootStore, virtual RemoteStore
 {
+private:
+    void anchor() override;
+
+public:
     using Config = UDSRemoteStoreConfig;
 
     ref<const Config> config;
diff --git a/src/libstore/include/nix/store/worker-protocol.hh b/src/libstore/include/nix/store/worker-protocol.hh
index ea1cbb502d7a..67c7395d599f 100644
--- a/src/libstore/include/nix/store/worker-protocol.hh
+++ b/src/libstore/include/nix/store/worker-protocol.hh
@@ -119,6 +119,12 @@ struct WorkerProto
 
     static const Version minimum;
 
+    /**
+     * Static version for the `builder-rpc-v0` feature.
+     * Should never change, as any modification would be derivation-visible.
+     */
+    static const Version builderRpcV0;
+
     /**
      * Feature for transmitting `UnkeyedRealisation` and `DrvOutput`
      * using drvPath (store path) instead of the old hash-based JSON format.
@@ -126,9 +132,24 @@ struct WorkerProto
     static constexpr std::string_view featureRealisationWithPath = "realisation-with-path-not-hash";
 
     /**
-     * Feature for garbage collecting a specific set of paths.
+     * Feature for garbage collecting a specific set of paths and deleting referrers.
+     */
+    static constexpr std::string_view featureDeleteDeadSpecificReferrers = "delete-dead-specific-referrers";
+
+    /**
+     * Feature for disabling SetOptions, which is a no-op in recursive-nix
+     */
+    static constexpr std::string_view featureDisableSetOptions = "disable-set-options";
+
+    /**
+     * Feature for enabling the `AddToStoreScanning` operation
+     */
+    static constexpr std::string_view featureAddToStoreScanning = "add-to-store-scanning";
+
+    /**
+     * Feature for enabling the `SubmitOutput` operation
      */
-    static constexpr std::string_view featureDeleteDeadSpecific = "delete-dead-specific";
+    static constexpr std::string_view featureSubmitOutput = "submit-output";
 
     /**
      * A unidirectional read connection, to be used by the read half of the
@@ -251,6 +272,11 @@ enum struct WorkerProto::Op : uint64_t {
     AddBuildLog = 45,
     BuildPathsWithResults = 46,
     AddPermRoot = 47,
+    // QueryActiveBuilds = 48, // reserved for https://github.com/NixOS/nix/pull/15979
+    // AddTempRoots = 49, // reserved for https://github.com/NixOS/nix/pull/16113
+    // QueryPathInfos = 50, // reserved for https://github.com/DeterminateSystems/nix-src/pull/539
+    SubmitOutput = 1000, // Only used within derivations with feature
+    AddToStoreScanning = 1001,
 };
 
 struct WorkerProto::ClientHandshakeInfo
@@ -320,6 +346,8 @@ inline std::ostream & operator<<(std::ostream & s, WorkerProto::Op op)
 template<>
 DECLARE_WORKER_SERIALISER(DerivedPath);
 template<>
+DECLARE_WORKER_SERIALISER(SingleDerivedPath);
+template<>
 DECLARE_WORKER_SERIALISER(BuildResult);
 template<>
 DECLARE_WORKER_SERIALISER(KeyedBuildResult);
@@ -345,6 +373,10 @@ template<>
 DECLARE_WORKER_SERIALISER(std::optional<std::chrono::microseconds>);
 template<>
 DECLARE_WORKER_SERIALISER(WorkerProto::ClientHandshakeInfo);
+
+template<>
+DECLARE_WORKER_SERIALISER(GCOptions::SpecificPaths);
+
 template<>
 DECLARE_WORKER_SERIALISER(GCOptions::GCPaths);
 
diff --git a/src/libstore/include/nix/store/worker-settings.hh b/src/libstore/include/nix/store/worker-settings.hh
index 13fa0261d8d0..d78ca420f776 100644
--- a/src/libstore/include/nix/store/worker-settings.hh
+++ b/src/libstore/include/nix/store/worker-settings.hh
@@ -25,6 +25,9 @@ struct MaxBuildJobsSetting : public BaseSetting<unsigned int>
 
 struct WorkerSettings : public virtual Config
 {
+private:
+    void anchor() override;
+
 protected:
     WorkerSettings() = default;
 
@@ -182,7 +185,7 @@ public:
           4. The maximum number of builds that Nix executes in parallel on the machine.
              Typically this should be equal to the number of CPU cores.
 
-          5. The “speed factor”, indicating the relative speed of the machine as a positive integer.
+          5. The “speed factor”, indicating the relative speed of the machine as a positive integer or decimal number.
              If there are multiple machines of the right type, Nix prefers the fastest, taking load into account.
 
           6. A comma-separated list of supported [system features](#conf-system-features).
diff --git a/src/libstore/indirect-root-store.cc b/src/libstore/indirect-root-store.cc
index 7384456e286d..b203afb63dcb 100644
--- a/src/libstore/indirect-root-store.cc
+++ b/src/libstore/indirect-root-store.cc
@@ -2,6 +2,8 @@
 
 namespace nix {
 
+void IndirectRootStore::anchor() {}
+
 void IndirectRootStore::makeSymlink(const std::filesystem::path & link, const std::filesystem::path & target)
 {
     /* Create directories up to `gcRoot'. */
diff --git a/src/libstore/legacy-ssh-store.cc b/src/libstore/legacy-ssh-store.cc
index a00914c4493d..5b46732cbda3 100644
--- a/src/libstore/legacy-ssh-store.cc
+++ b/src/libstore/legacy-ssh-store.cc
@@ -9,21 +9,94 @@
 #include "nix/store/serve-protocol-impl.hh"
 #include "nix/store/build-result.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/store-open.hh"
 #include "nix/store/path-with-outputs.hh"
 #include "nix/store/ssh.hh"
 #include "nix/store/derivations.hh"
+#include "nix/store/build.hh"
 #include "nix/util/callback.hh"
 #include "nix/store/store-registration.hh"
 #include "nix/store/globals.hh"
 
 namespace nix {
 
+struct LegacySSHBuilder : Builder
+{
+    ref<LegacySSHStore> store;
+
+    LegacySSHBuilder(ref<LegacySSHStore> store)
+        : store(store)
+    {
+    }
+
+private:
+
+    [[noreturn]] void unsupported(const std::string & op)
+    {
+        throw Unsupported("operation '%s' is not supported by store '%s'", op, store->config->getHumanReadableURI());
+    }
+
+    std::variant<BuildResultSuccessStatus, BuildError>
+    buildPathsRaw(const std::vector<DerivedPath> & reqs, BuildMode buildMode);
+
+public:
+
+    void buildPaths(const std::vector<DerivedPath> & reqs, BuildMode buildMode) override;
+
+    std::vector<KeyedBuildResult>
+    buildPathsWithResults(const std::vector<DerivedPath> & reqs, BuildMode buildMode) override;
+
+    BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode) override;
+
+    BuildResult buildDerivation(
+        const StorePath & drvPath,
+        const BasicDerivation & drv,
+        const StorePathSet & inputs,
+        BuildMode buildMode) override
+    {
+        auto substitute = settings.getWorkerSettings().buildersUseSubstitutes ? Substitute : NoSubstitute;
+        auto srcStore = openStore();
+        copyPaths(*srcStore, *store, inputs, NoRepair, NoCheckSigs, substitute);
+        return buildDerivation(drvPath, drv, buildMode);
+    }
+
+    std::vector<KeyedBuildResult> buildPathsWithResults(
+        const std::vector<DerivedPath> & reqs, const StorePathSet & inputs, BuildMode buildMode) override
+    {
+        auto substitute = settings.getWorkerSettings().buildersUseSubstitutes ? Substitute : NoSubstitute;
+        auto srcStore = openStore();
+        copyPaths(*srcStore, *store, inputs, NoRepair, NoCheckSigs, substitute);
+        return buildPathsWithResults(reqs, buildMode);
+    }
+
+    /**
+     * Note, the returned function must only be called once, or we'll
+     * try to read from the connection twice.
+     *
+     * @todo Use C++23 `std::move_only_function`.
+     */
+    fun<BuildResult()> buildDerivationAsync(
+        const StorePath & drvPath, const BasicDerivation & drv, const ServeProto::BuildOptions & options);
+
+    void ensurePath(const StorePath & path) override
+    {
+        unsupported("ensurePath");
+    }
+
+    void repairPath(const StorePath & path) override
+    {
+        unsupported("repairPath");
+    }
+};
+
 LegacySSHStoreConfig::LegacySSHStoreConfig(const ParsedURL::Authority & authority, const Params & params)
     : StoreConfig(params, FilePathType::Unix)
     , CommonSSHStoreConfig(authority, params)
 {
 }
 
+void LegacySSHStoreConfig::anchor() {}
+
 std::string LegacySSHStoreConfig::doc()
 {
     return
@@ -37,6 +110,8 @@ struct LegacySSHStore::Connection : public ServeProto::BasicClientConnection
     bool good = true;
 };
 
+void LegacySSHStore::anchor() {}
+
 LegacySSHStore::LegacySSHStore(ref<const Config> config)
     : Store{*config}
     , config{config}
@@ -192,32 +267,30 @@ static ServeProto::BuildOptions buildSettings()
     };
 }
 
-BuildResult LegacySSHStore::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode)
+BuildResult
+LegacySSHBuilder::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode)
 {
-    auto conn(connections->get());
+    auto conn(store->connections->get());
 
-    conn->putBuildDerivationRequest(*this, drvPath, drv, buildSettings());
+    conn->putBuildDerivationRequest(*store, drvPath, drv, buildSettings());
 
-    return conn->getBuildDerivationResponse(*this);
+    return conn->getBuildDerivationResponse(*store);
 }
 
-fun<BuildResult()> LegacySSHStore::buildDerivationAsync(
+fun<BuildResult()> LegacySSHBuilder::buildDerivationAsync(
     const StorePath & drvPath, const BasicDerivation & drv, const ServeProto::BuildOptions & options)
 {
     // Until we have C++23 std::move_only_function
-    auto conn = std::make_shared<Pool<Connection>::Handle>(connections->get());
-    (*conn)->putBuildDerivationRequest(*this, drvPath, drv, options);
+    auto conn = std::make_shared<Pool<LegacySSHStore::Connection>::Handle>(store->connections->get());
+    (*conn)->putBuildDerivationRequest(*store, drvPath, drv, options);
 
-    return [this, conn]() -> BuildResult { return (*conn)->getBuildDerivationResponse(*this); };
+    return [store = this->store, conn]() -> BuildResult { return (*conn)->getBuildDerivationResponse(*store); };
 }
 
-void LegacySSHStore::buildPaths(
-    const std::vector<DerivedPath> & drvPaths, BuildMode buildMode, std::shared_ptr<Store> evalStore)
+std::variant<BuildResultSuccessStatus, BuildError>
+LegacySSHBuilder::buildPathsRaw(const std::vector<DerivedPath> & drvPaths, BuildMode buildMode)
 {
-    if (evalStore && evalStore.get() != this)
-        throw Error("building on an SSH store is incompatible with '--eval-store'");
-
-    auto conn(connections->get());
+    auto conn(store->connections->get());
 
     conn->to << ServeProto::Command::BuildPaths;
     Strings ss;
@@ -225,11 +298,11 @@ void LegacySSHStore::buildPaths(
         auto sOrDrvPath = StorePathWithOutputs::tryFromDerivedPath(p);
         std::visit(
             overloaded{
-                [&](const StorePathWithOutputs & s) { ss.push_back(s.to_string(*this)); },
+                [&](const StorePathWithOutputs & s) { ss.push_back(s.to_string(*store)); },
                 [&](const StorePath & drvPath) {
                     throw Error(
                         "wanted to fetch '%s' but the legacy ssh protocol doesn't support merely substituting drv files via the build paths command. It would build them instead. Try using ssh-ng://",
-                        printStorePath(drvPath));
+                        store->printStorePath(drvPath));
                 },
                 [&](std::monostate) {
                     throw Error(
@@ -240,16 +313,108 @@ void LegacySSHStore::buildPaths(
     }
     conn->to << ss;
 
-    ServeProto::write(*this, *conn, buildSettings());
+    ServeProto::write(*store, *conn, buildSettings());
 
     conn->to.flush();
 
-    auto status = CommonProto::Serialise<BuildResultStatus>::read(*this, {conn->from});
-    if (auto * failure = std::get_if<BuildResultFailureStatus>(&status)) {
-        std::string errorMsg;
-        conn->from >> errorMsg;
-        throw BuildError(*failure, std::move(errorMsg));
+    auto status = CommonProto::Serialise<BuildResultStatus>::read(*store, {conn->from});
+    return std::visit(
+        overloaded{
+            [&](BuildResultSuccessStatus s) -> std::variant<BuildResultSuccessStatus, BuildError> { return s; },
+            [&](BuildResultFailureStatus s) -> std::variant<BuildResultSuccessStatus, BuildError> {
+                std::string errorMsg;
+                conn->from >> errorMsg;
+                return BuildError{s, std::move(errorMsg)};
+            },
+        },
+        status);
+}
+
+void LegacySSHBuilder::buildPaths(const std::vector<DerivedPath> & drvPaths, BuildMode buildMode)
+{
+    auto status = buildPathsRaw(drvPaths, buildMode);
+    if (auto * failure = std::get_if<BuildError>(&status))
+        throw *failure;
+}
+
+std::vector<KeyedBuildResult>
+LegacySSHBuilder::buildPathsWithResults(const std::vector<DerivedPath> & reqs, BuildMode buildMode)
+{
+    auto status = buildPathsRaw(reqs, buildMode);
+
+    std::vector<KeyedBuildResult> results;
+
+    // N.B. This logic is inspired by the fallback old protocol code in
+    // `RemoteBuilder::buildPathsWithResults`, which handles a very
+    // similar problem.
+    for (auto & req : reqs) {
+        std::visit(
+            overloaded{
+                [&](const DerivedPath::Opaque & bo) {
+                    results.push_back(
+                        KeyedBuildResult{
+                            {.inner = std::visit(
+                                 overloaded{
+                                     [](const BuildResultSuccessStatus & s) -> decltype(BuildResult::inner) {
+                                         return BuildResult::Success{.status = s};
+                                     },
+                                     [](const BuildError & e) -> decltype(BuildResult::inner) { return e; },
+                                 },
+                                 status)},
+                            /* .path = */ req,
+                        });
+                },
+                [&](const DerivedPath::Built & bfd) {
+                    if (auto * failure = std::get_if<BuildError>(&status)) {
+                        results.push_back(
+                            KeyedBuildResult{
+                                {.inner = *failure},
+                                /* .path = */ req,
+                            });
+                        return;
+                    }
+
+                    BuildResult::Success success{
+                        .status = std::get<BuildResultSuccessStatus>(status),
+                    };
+
+                    auto drvPath = resolveDerivedPath(*store, *bfd.drvPath);
+                    auto built = resolveDerivedPath(*store, bfd);
+                    for (auto & [output, outputPath] : built) {
+                        auto outputId = DrvOutput{drvPath, output};
+                        if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations)) {
+                            auto realisation = store->queryRealisation(outputId);
+                            if (!realisation)
+                                throw MissingRealisation(*store, outputId);
+                            success.builtOutputs.emplace(output, *realisation);
+                        } else {
+                            success.builtOutputs.emplace(
+                                output,
+                                UnkeyedRealisation{
+                                    .outPath = outputPath,
+                                });
+                        }
+                    }
+
+                    results.push_back(
+                        KeyedBuildResult{
+                            {.inner = std::move(success)},
+                            /* .path = */ req,
+                        });
+                },
+            },
+            req.raw());
     }
+
+    return results;
+}
+
+ref<Builder> LegacySSHStore::getBuilder(std::shared_ptr<Store> evalStore)
+{
+    if (evalStore && evalStore.get() != this)
+        throw Error("building on an SSH store is incompatible with '--eval-store'");
+    return make_ref<LegacySSHBuilder>(
+        ref<LegacySSHStore>(std::dynamic_pointer_cast<LegacySSHStore>(shared_from_this())));
 }
 
 void LegacySSHStore::computeFSClosure(
diff --git a/src/libstore/linux/build/chroot-linux-derivation-builder.hh b/src/libstore/linux/build/chroot-linux-derivation-builder.hh
new file mode 100644
index 000000000000..bee6e4659758
--- /dev/null
+++ b/src/libstore/linux/build/chroot-linux-derivation-builder.hh
@@ -0,0 +1,64 @@
+#pragma once
+
+#include "chroot-derivation-builder.hh"
+#include "linux-derivation-builder.hh"
+
+namespace nix {
+
+struct ChrootLinuxDerivationBuilder : ChrootDerivationBuilder, LinuxDerivationBuilder
+{
+    /**
+     * Pipe for synchronising updates to the builder namespaces.
+     */
+    Pipe userNamespaceSync;
+
+    /**
+     * The mount namespace and user namespace of the builder, used to add additional
+     * paths to the sandbox as a result of recursive Nix calls.
+     */
+    AutoCloseFD sandboxMountNamespace;
+    AutoCloseFD sandboxUserNamespace;
+
+    /**
+     * On Linux, whether we're doing the build in its own user
+     * namespace.
+     */
+    bool usingUserNamespace = true;
+
+    /**
+     * The cgroup of the builder, if any.
+     */
+    std::optional<std::filesystem::path> cgroup;
+
+    ChrootLinuxDerivationBuilder(
+        LocalStore & store, std::shared_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
+        : DerivationBuilderImpl{store, miscMethods, params}
+        , ChrootDerivationBuilder{store, miscMethods, params}
+        , LinuxDerivationBuilder{store, miscMethods, params}
+    {
+    }
+
+    uid_t sandboxUid();
+
+    gid_t sandboxGid() override;
+
+    std::unique_ptr<UserLock> getBuildUser() override;
+
+    void prepareUser() override;
+
+    void prepareSandbox() override;
+
+    void startChild() override;
+
+    void enterChroot() override;
+
+    void setUser() override;
+
+    SingleDrvOutputs unprepareBuild() override;
+
+    void killSandbox(bool getStats) override;
+
+    void addDependencyImpl(const StorePath & path) override;
+};
+
+} // namespace nix
diff --git a/src/libstore/linux/build/linux-derivation-builder.cc b/src/libstore/linux/build/linux-derivation-builder.cc
new file mode 100644
index 000000000000..525b3ffa1632
--- /dev/null
+++ b/src/libstore/linux/build/linux-derivation-builder.cc
@@ -0,0 +1,988 @@
+#include "linux-derivation-builder.hh"
+#include "derivation-builder-impl.hh"
+#include "chroot-derivation-builder.hh"
+#include "chroot-linux-derivation-builder.hh"
+
+#include "store-config-private.hh"
+
+#include "nix/store/globals.hh"
+#include "nix/store/personality.hh"
+#include "nix/store/filetransfer.hh"
+#include "nix/util/cgroup.hh"
+#include "nix/util/linux-namespaces.hh"
+#include "nix/util/file-system-at.hh"
+#include "nix/util/logging.hh"
+#include "nix/util/serialise.hh"
+#include "linux/fchmodat2-compat.hh"
+
+#include <algorithm>
+#include <string_view>
+#include <cstdint>
+#include <atomic>
+
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <net/if.h>
+#include <netinet/ip.h>
+#include <sys/mman.h>
+#include <sched.h>
+#include <sys/param.h>
+#include <sys/mount.h>
+#include <sys/syscall.h>
+#include <sys/prctl.h>
+#include <grp.h>
+
+#if HAVE_SECCOMP
+#  include <seccomp.h>
+#endif
+
+#define pivot_root(new_root, put_old) (syscall(SYS_pivot_root, new_root, put_old))
+
+/* Polyfill for musl that doesn't have the syscall wrappers. */
+
+#if !HAVE_OPEN_TREE
+
+#  ifndef OPEN_TREE_CLONE
+#    define OPEN_TREE_CLONE 1
+#  endif
+
+#  ifndef OPEN_TREE_CLOEXEC
+#    define OPEN_TREE_CLOEXEC O_CLOEXEC
+#  endif
+
+static int open_tree(int dirfd, const char * filename, unsigned int flags)
+{
+    return ::syscall(__NR_open_tree, dirfd, filename, flags);
+}
+
+#endif
+
+#if !HAVE_MOVE_MOUNT
+
+#  ifndef MOVE_MOUNT_F_EMPTY_PATH
+#    define MOVE_MOUNT_F_EMPTY_PATH 0x00000004
+#  endif
+
+#  ifndef MOVE_MOUNT_T_EMPTY_PATH
+#    define MOVE_MOUNT_T_EMPTY_PATH 0x00000040
+#  endif
+
+static int move_mount(int sourceDirFd, const char * source, int destDirFd, const char * dest, unsigned int flags)
+{
+    return ::syscall(__NR_move_mount, sourceDirFd, source, destDirFd, dest, flags);
+}
+
+#endif
+
+namespace nix {
+
+void setupSeccomp(const LocalSettings & localSettings)
+{
+    if (!localSettings.filterSyscalls)
+        return;
+
+#if HAVE_SECCOMP
+    scmp_filter_ctx ctx;
+
+    if (!(ctx = seccomp_init(SCMP_ACT_ALLOW)))
+        throw SysError("unable to initialize seccomp mode 2");
+
+    Finally cleanup([&]() { seccomp_release(ctx); });
+
+    constexpr std::string_view nativeSystem = NIX_LOCAL_SYSTEM;
+
+    if (nativeSystem == "x86_64-linux" && seccomp_arch_add(ctx, SCMP_ARCH_X86) != 0)
+        throw SysError("unable to add 32-bit seccomp architecture");
+
+    if (nativeSystem == "x86_64-linux" && seccomp_arch_add(ctx, SCMP_ARCH_X32) != 0)
+        throw SysError("unable to add X32 seccomp architecture");
+
+    if (nativeSystem == "aarch64-linux" && seccomp_arch_add(ctx, SCMP_ARCH_ARM) != 0)
+        printError(
+            "unable to add ARM seccomp architecture; this may result in spurious build failures if running 32-bit ARM processes");
+
+    if (nativeSystem == "mips64-linux" && seccomp_arch_add(ctx, SCMP_ARCH_MIPS) != 0)
+        printError("unable to add mips seccomp architecture");
+
+    if (nativeSystem == "mips64-linux" && seccomp_arch_add(ctx, SCMP_ARCH_MIPS64N32) != 0)
+        printError("unable to add mips64-*abin32 seccomp architecture");
+
+    if (nativeSystem == "mips64el-linux" && seccomp_arch_add(ctx, SCMP_ARCH_MIPSEL) != 0)
+        printError("unable to add mipsel seccomp architecture");
+
+    if (nativeSystem == "mips64el-linux" && seccomp_arch_add(ctx, SCMP_ARCH_MIPSEL64N32) != 0)
+        printError("unable to add mips64el-*abin32 seccomp architecture");
+
+    /* Prevent builders from creating setuid/setgid binaries. */
+    for (int perm : {S_ISUID, S_ISGID}) {
+        if (seccomp_rule_add(
+                ctx,
+                SCMP_ACT_ERRNO(EPERM),
+                SCMP_SYS(chmod),
+                1,
+                SCMP_A1(SCMP_CMP_MASKED_EQ, (scmp_datum_t) perm, (scmp_datum_t) perm))
+            != 0)
+            throw SysError("unable to add seccomp rule");
+
+        if (seccomp_rule_add(
+                ctx,
+                SCMP_ACT_ERRNO(EPERM),
+                SCMP_SYS(fchmod),
+                1,
+                SCMP_A1(SCMP_CMP_MASKED_EQ, (scmp_datum_t) perm, (scmp_datum_t) perm))
+            != 0)
+            throw SysError("unable to add seccomp rule");
+
+        if (seccomp_rule_add(
+                ctx,
+                SCMP_ACT_ERRNO(EPERM),
+                SCMP_SYS(fchmodat),
+                1,
+                SCMP_A2(SCMP_CMP_MASKED_EQ, (scmp_datum_t) perm, (scmp_datum_t) perm))
+            != 0)
+            throw SysError("unable to add seccomp rule");
+
+        if (seccomp_rule_add(
+                ctx,
+                SCMP_ACT_ERRNO(EPERM),
+                NIX_SYSCALL_FCHMODAT2,
+                1,
+                SCMP_A2(SCMP_CMP_MASKED_EQ, (scmp_datum_t) perm, (scmp_datum_t) perm))
+            != 0)
+            throw SysError("unable to add seccomp rule");
+    }
+
+    /* Prevent builders from using EAs or ACLs. Not all filesystems
+       support these, and they're not allowed in the Nix store because
+       they're not representable in the NAR serialisation. */
+    if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(listxattr), 0) != 0
+        || seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(llistxattr), 0) != 0
+        || seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(flistxattr), 0) != 0
+        || seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(getxattr), 0) != 0
+        || seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(lgetxattr), 0) != 0
+        || seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(fgetxattr), 0) != 0
+        || seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(setxattr), 0) != 0
+        || seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(lsetxattr), 0) != 0
+        || seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(fsetxattr), 0) != 0)
+        throw SysError("unable to add seccomp rule");
+
+    if (seccomp_attr_set(ctx, SCMP_FLTATR_CTL_NNP, localSettings.allowNewPrivileges ? 0 : 1) != 0)
+        throw SysError("unable to set 'no new privileges' seccomp attribute");
+
+    if (seccomp_load(ctx) != 0)
+        throw SysError("unable to load seccomp BPF program");
+#else
+    throw Error(
+        "seccomp is not supported on this platform; "
+        "you can bypass this error by setting the option 'filter-syscalls' to false, but note that untrusted builds can then create setuid binaries!");
+#endif
+}
+
+#if DO_LANDLOCK
+
+/* We are using LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET on best-effort basis. There are no glibc wrappers for now. */
+
+static int landlockCreateRuleset(const ::landlock_ruleset_attr * attr, std::size_t size, std::uint32_t flags)
+{
+    return ::syscall(__NR_landlock_create_ruleset, attr, size, flags);
+}
+
+static int landlockRestrictSelf(Descriptor rulesetFd, std::uint32_t flags)
+{
+    return ::syscall(__NR_landlock_restrict_self, rulesetFd, flags);
+}
+
+static int getLandlockAbiVersion()
+{
+    int abiVersion = landlockCreateRuleset(nullptr, 0, LANDLOCK_CREATE_RULESET_VERSION);
+    return abiVersion;
+}
+
+static void setupLandlock()
+{
+    bool landlockSupportsScopeAbstractUnixSocket = []() {
+        int abiVersion = getLandlockAbiVersion();
+        if (abiVersion >= 6)
+            /* All good, we can use LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET. See
+               https://docs.kernel.org/userspace-api/landlock.html#abstract-unix-socket-abi-6 */
+            return true;
+
+        if (abiVersion == -1) {
+            debug("landlock is not available");
+            return false;
+        }
+
+        debug("landlock version %d does not support LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET", abiVersion);
+        return false;
+    }();
+
+    /* Bail out early if landlock is not enabled or LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET wouldn't work.
+       TODO: Consider adding more landlock rules for filesystem access as defense-in-depth on top. */
+    if (!landlockSupportsScopeAbstractUnixSocket)
+        return;
+
+    ::landlock_ruleset_attr attr = {
+        /* This prevents multiple FODs from communicating with each other
+           via abstract sockets. Note that cooperating processes outside the
+           sandbox can still connect to an abstract socket created by the FOD. To
+           mitigate that issue entirely we'd still need network namespaces. */
+        .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET,
+    };
+
+    /* This better not fail - if the kernel reports a new enough ABI version we
+       should treat any errors as fatal from now on. */
+    AutoCloseFD rulesetFd = landlockCreateRuleset(&attr, sizeof(attr), 0);
+    if (!rulesetFd)
+        throw SysError("failed to create a landlock ruleset");
+
+    if (landlockRestrictSelf(rulesetFd.get(), 0) == -1)
+        throw SysError("failed to apply landlock");
+
+    debug("applied landlock sandboxing");
+}
+
+#endif
+
+static void doBind(
+    const std::filesystem::path & source,
+    Descriptor chrootRootDirFd,
+    const std::filesystem::path & target,
+    const std::filesystem::path & chrootRootDirPath,
+    bool optional = false)
+{
+    /* `target` denotes a relative path inside the chroot directory. All operations happen
+        relative to chrootRootDirFd. Bail out if the path is not what we expect. */
+    if (target.empty() || target.is_absolute())
+        throw Error("invalid path to bind mount in the chroot: %s", PathFmt(target));
+
+    /* Sanity check against insane setups. This would never be passed in
+       sandbox paths for dependencies, but the user might specify it in
+       extra-sandbox-paths. */
+    if (const auto filename = target.filename().native(); filename == "." || filename == "..")
+        throw Error("sandbox path to bind mount in the chroot has an invalid filename: %s", PathFmt(target));
+
+    debug("bind mounting %1% to %2%", PathFmt(source), PathFmt(chrootRootDirPath / target));
+
+    auto fallbackBindMount = [&](Descriptor sourceFd, Descriptor destFd) {
+        auto selfProcSourcePath = std::filesystem::path("/proc/self/fd") / std::to_string(sourceFd);
+        auto selfProcDestPath = std::filesystem::path("/proc/self/fd") / std::to_string(destFd);
+
+        if (mount(selfProcSourcePath.c_str(), selfProcDestPath.c_str(), "", MS_BIND | MS_REC, 0) == -1)
+            throw SysError(
+                "bind mount from %1% (%3%) to %2% (%4%) failed",
+                PathFmt(source),
+                PathFmt(chrootRootDirPath / target),
+                PathFmt(selfProcSourcePath),
+                PathFmt(selfProcDestPath));
+    };
+
+    auto bindMount = [&](Descriptor sourceFd, Descriptor destFd) {
+        static std::atomic_flag openTreeUnsupported{};
+        if (openTreeUnsupported.test())
+            return fallbackBindMount(sourceFd, destFd);
+
+        AutoCloseFD treeFd =
+            ::open_tree(sourceFd, "", OPEN_TREE_CLONE | AT_RECURSIVE | OPEN_TREE_CLOEXEC | AT_EMPTY_PATH);
+
+        if (!treeFd) {
+            if (errno != ENOSYS)
+                throw SysError("opening bind mount source %1%", PathFmt(source));
+
+            /* Cache and try the old fallback via procfs. */
+            openTreeUnsupported.test_and_set();
+            return fallbackBindMount(sourceFd, destFd);
+        }
+
+        if (::move_mount(treeFd.get(), "", destFd, "", MOVE_MOUNT_T_EMPTY_PATH | MOVE_MOUNT_F_EMPTY_PATH) == -1)
+            throw SysError("bind mount from %1% to %2% failed", PathFmt(source), PathFmt(chrootRootDirPath / target));
+    };
+
+    /* TODO: Replace the sucky implementation of createDirs and use that instead. */
+    auto createDirsAndOpen =
+        [&](const std::filesystem::path & path) -> std::tuple<AutoCloseFD, Descriptor, bool /*isRoot*/> {
+        Descriptor parentFd = chrootRootDirFd;
+        AutoCloseFD maybeParentFdOwned;
+        /* How many directories deep we are. */
+        unsigned nestedDirCount = 0;
+
+        for (const auto & p : path) {
+            /* Trailing `/`, we don't care. It might matter for symlink resolution, so better skip it.
+               Also skip `.` as a no-op. */
+            if (p.native().empty() || p.native() == ".")
+                continue;
+
+            /* TODO: Add additional validation in config parsing in case the
+               user specified a borked `extra-sandbox-paths`. Maybe we should just
+               reject `..` components completely? */
+            if (p.native() == "..") {
+                if (nestedDirCount == 0)
+                    throw Error("sandbox path %s escapes the chroot", PathFmt(path));
+                --nestedDirCount;
+            } else {
+                ++nestedDirCount;
+            }
+
+            assert(!p.native().starts_with("/")); /* Already check that the path is relative, can't happen. */
+
+            /* No symlinks shall be followed. */
+            AutoCloseFD nextComponent = ::openat(parentFd, p.c_str(), O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+            if (!nextComponent) {
+                if (errno != ENOENT) /* We might have to create it if it doesn't exist. */
+                    throw SysError("creating directory component %s in the sandbox path %s", PathFmt(p), PathFmt(path));
+
+                /* Let the umask restrict the permissions. TODO: Do we want
+                   this? We don't handle EEXIST here because that would mean
+                   somebody is already racing us. Fail closed. */
+                if (::mkdirat(parentFd, p.c_str(), 0777) == -1)
+                    throw SysError("creating directory component %s in the sandbox path %s", PathFmt(p), PathFmt(path));
+
+                /* Try again after creating the directory. Should succeed. */
+                nextComponent = ::openat(parentFd, p.c_str(), O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+                if (!nextComponent) /* Something is terribly wrong, bail out. */
+                    throw SysError("creating directory component %s in the sandbox path %s", PathFmt(p), PathFmt(path));
+            }
+
+            /* Proceed to the next iteration. */
+            maybeParentFdOwned = std::move(nextComponent);
+            parentFd = maybeParentFdOwned.get();
+        }
+
+        return {std::move(maybeParentFdOwned), parentFd, nestedDirCount == 0};
+    };
+
+    AutoCloseFD sourceFd = ::open(source.c_str(), O_PATH | O_NOFOLLOW | O_CLOEXEC);
+
+    /* Skip non-existent files source paths if .optional is set. */
+    if (!sourceFd) {
+        if (optional && (errno == ENOENT || errno == ENOTDIR))
+            return;
+        else
+            throw SysError("getting attributes of path %1%", PathFmt(source));
+    }
+
+    auto st = nix::fstat(sourceFd.get());
+
+    if (S_ISDIR(st.st_mode)) {
+        auto [maybeDirFdOwned, dirFd, isRoot] = createDirsAndOpen(target);
+        /* We must always open a fresh directory - i.e. the path must not resolve to chrootRootDir itself. */
+        if (isRoot || !maybeDirFdOwned)
+            throw Error("sandbox path %s escapes the chroot", PathFmt(chrootRootDirPath / target));
+        assert(maybeDirFdOwned.get() == dirFd); /* See the comment above. */
+        bindMount(sourceFd.get(), dirFd);
+    } else if (S_ISLNK(st.st_mode)) {
+        /* Symlinks can't be bind-mounted, so copy the contents.
+           The kernel implies AT_EMPTY_PATH for readlinkat
+           since https://github.com/torvalds/linux/commit/65cfc6722361 (v2.6.39).
+           See also: https://github.com/cyphar/libpathrs/issues/18 */
+        auto symlinkTarget = readLinkAt(sourceFd.get(), CanonPath::root);
+        auto filename = target.filename();
+        auto [maybeParentFdOwned, parentFd, isRoot] = createDirsAndOpen(target.parent_path());
+        if (::symlinkat(symlinkTarget.data(), parentFd, filename.c_str()) == -1)
+            throw SysError("creating symlink %s", PathFmt(chrootRootDirPath / target));
+        /* Copy the write/access time from the source symlink. */
+        const std::array<::timespec, 2> times = {st.st_atim, st.st_mtim};
+        if (::utimensat(parentFd, filename.c_str(), times.data(), AT_SYMLINK_NOFOLLOW) == -1)
+            throw SysError("changing write time of %s", PathFmt(chrootRootDirPath / target));
+    } else {
+        auto [maybeParentFdOwned, parentFd, isRoot] = createDirsAndOpen(target.parent_path());
+        /* Strictly speaking, O_NOFOLLOW is redundant because O_CREAT | O_EXCL would never follow links anyway. */
+        AutoCloseFD destFd =
+            ::openat(parentFd, target.filename().c_str(), O_CREAT | O_EXCL | O_WRONLY | O_NOFOLLOW | O_CLOEXEC, 0666);
+        if (!destFd)
+            throw SysError("creating regular file %s", PathFmt(chrootRootDirPath / target));
+        bindMount(sourceFd.get(), destFd.get());
+    }
+}
+
+static const std::filesystem::path procPath = "/proc";
+
+void LinuxDerivationBuilder::enterChroot()
+{
+    auto & localSettings = store.config->getLocalSettings();
+
+    /* Set the NO_NEW_PRIVS before doing seccomp/landlock setup.
+       landlock_restrict_self requires either NO_NEW_PRIVS or CAP_SYS_ADMIN.
+       With user namespaces we do get CAP_SYS_ADMIN. */
+    if (!localSettings.allowNewPrivileges)
+        if (::prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
+            throw SysError("failed to set PR_SET_NO_NEW_PRIVS");
+
+    setupSeccomp(localSettings);
+
+#if DO_LANDLOCK
+    try {
+        setupLandlock();
+    } catch (SysError & e) {
+        if (e.errNo != EPERM)
+            throw;
+        /* If allowNewPrivileges is true and we don't have CAP_SYS_ADMIN
+           this code path might be hit. */
+        warn("setting up landlock: %s", e.message());
+    }
+#endif
+
+    linux::setPersonality({
+        .system = drv.platform,
+        .impersonateLinux26 = localSettings.impersonateLinux26,
+    });
+}
+
+uid_t ChrootLinuxDerivationBuilder::sandboxUid()
+{
+    return usingUserNamespace ? (!buildUser || buildUser->getUIDCount() == 1 ? 1000 : 0) : buildUser->getUID();
+}
+
+gid_t ChrootLinuxDerivationBuilder::sandboxGid()
+{
+    return usingUserNamespace ? (!buildUser || buildUser->getUIDCount() == 1 ? 100 : 0)
+                              : ChrootDerivationBuilder::sandboxGid();
+}
+
+std::unique_ptr<UserLock> ChrootLinuxDerivationBuilder::getBuildUser()
+{
+    return acquireUserLock(
+        settings.nixStateDir, store.config->getLocalSettings(), drvOptions.useUidRange(drv) ? 65536 : 1, true);
+}
+
+void ChrootLinuxDerivationBuilder::prepareUser()
+{
+    if ((buildUser && buildUser->getUIDCount() != 1) || store.config->getLocalSettings().useCgroups) {
+        experimentalFeatureSettings.require(Xp::Cgroups);
+
+        /* If we're running from the daemon, then this will return the
+           root cgroup of the service. Otherwise, it will return the
+           current cgroup. */
+        auto cgroupFS = linux::getCgroupFS();
+        if (!cgroupFS)
+            throw Error("cannot determine the cgroups file system");
+        auto rootCgroupPath = *cgroupFS / linux::getRootCgroup().rel();
+        if (!pathExists(rootCgroupPath))
+            throw Error("expected cgroup directory %s", PathFmt(rootCgroupPath));
+
+        static std::atomic<unsigned int> counter{0};
+
+        cgroup = rootCgroupPath
+                 / (buildUser ? fmt("nix-build-uid-%d", buildUser->getUID())
+                              : fmt("nix-build-pid-%d-%d", getpid(), counter++));
+
+        debug("using cgroup %s", PathFmt(*cgroup));
+
+        /* When using a build user, record the cgroup we used for that
+           user so that if we got interrupted previously, we can kill
+           any left-over cgroup first. */
+        if (buildUser) {
+            auto cgroupsDir = std::filesystem::path{settings.nixStateDir} / "cgroups";
+            createDirs(cgroupsDir);
+
+            auto cgroupFile = cgroupsDir / std::to_string(buildUser->getUID());
+
+            if (pathExists(cgroupFile)) {
+                auto prevCgroup = readFile(cgroupFile);
+                linux::destroyCgroup(prevCgroup);
+            }
+
+            writeFile(cgroupFile, cgroup->native());
+        }
+    }
+
+    // Kill any processes left in the cgroup or build user.
+    DerivationBuilderImpl::prepareUser();
+}
+
+void ChrootLinuxDerivationBuilder::prepareSandbox()
+{
+    ChrootDerivationBuilder::prepareSandbox();
+
+    if (cgroup) {
+        if (mkdir(cgroup->c_str(), 0755) != 0)
+            throw SysError("creating cgroup %s", PathFmt(*cgroup));
+        chownToBuilder(*cgroup);
+        chownToBuilder(*cgroup / "cgroup.procs");
+        chownToBuilder(*cgroup / "cgroup.threads");
+        // chownToBuilder(*cgroup / "cgroup.subtree_control");
+    }
+}
+
+void ChrootLinuxDerivationBuilder::startChild()
+{
+    RunChildArgs args{
+#if NIX_WITH_AWS_AUTH
+        .awsCredentials = preResolveAwsCredentials(),
+#endif
+    };
+
+    /* Set up private namespaces for the build:
+
+        - The PID namespace causes the build to start as PID 1.
+          Processes outside of the chroot are not visible to those
+          on the inside, but processes inside the chroot are
+          visible from the outside (though with different PIDs).
+
+        - The private mount namespace ensures that all the bind
+          mounts we do will only show up in this process and its
+          children, and will disappear automatically when we're
+          done.
+
+        - The private network namespace ensures that the builder
+          cannot talk to the outside world (or vice versa).  It
+          only has a private loopback interface. (Fixed-output
+          derivations are not run in a private network namespace
+          to allow functions like fetchurl to work.)
+
+        - The IPC namespace prevents the builder from communicating
+          with outside processes using SysV IPC mechanisms (shared
+          memory, message queues, semaphores).  It also ensures
+          that all IPC objects are destroyed when the builder
+          exits.
+
+        - The UTS namespace ensures that builders see a hostname of
+          localhost rather than the actual hostname.
+
+       We use a helper process to do the clone() to work around
+       clone() being broken in multi-threaded programs due to
+       at-fork handlers not being run. Note that we use
+       CLONE_PARENT to ensure that the real builder is parented to
+       us.
+    */
+
+    userNamespaceSync.create();
+
+    usingUserNamespace = userNamespacesSupported();
+
+    Pipe sendPid;
+    sendPid.create();
+
+    Pid helper = startProcess([&]() {
+        sendPid.readSide.close();
+
+        /* We need to open the slave early, before
+           CLONE_NEWUSER. Otherwise we get EPERM when running as
+           root. */
+        openSlave();
+
+        try {
+            /* Drop additional groups here because we can't do it
+               after we've created the new user namespace. */
+            if (setgroups(0, 0) == -1) {
+                if (errno != EPERM)
+                    throw SysError("setgroups failed");
+                if (store.config->getLocalSettings().requireDropSupplementaryGroups)
+                    throw Error(
+                        "setgroups failed. Set the require-drop-supplementary-groups option to false to skip this step.");
+            }
+
+            ProcessOptions options;
+            options.cloneFlags = CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | CLONE_NEWUTS | CLONE_PARENT | SIGCHLD;
+            if (derivationType.isSandboxed())
+                options.cloneFlags |= CLONE_NEWNET;
+            if (usingUserNamespace)
+                options.cloneFlags |= CLONE_NEWUSER;
+
+            pid_t child = startProcess([this, args = std::move(args)]() { runChild(std::move(args)); }, options);
+
+            writeFull(sendPid.writeSide.get(), fmt("%d\n", child));
+            _exit(0);
+        } catch (...) {
+            handleChildException(true);
+            _exit(1);
+        }
+    });
+
+    sendPid.writeSide.close();
+
+    if (auto status = helper.wait(); !statusOk(status)) {
+        processSandboxSetupMessages();
+        // Only reached if the child process didn't send an exception.
+        throw Error("unable to start build process: %s", statusToString(status));
+    }
+
+    userNamespaceSync.readSide = -1;
+
+    /* Make sure that we write *something* to the child in case of
+       an exception. Note that merely closing
+       `userNamespaceSync.writeSide` doesn't work in
+       multi-threaded Nix, since several child processes may have
+       inherited `writeSide` (and O_CLOEXEC doesn't help because
+       the children may not do an execve). */
+    bool userNamespaceSyncDone = false;
+    Finally cleanup([&]() {
+        try {
+            if (!userNamespaceSyncDone)
+                writeFull(userNamespaceSync.writeSide.get(), "0\n");
+        } catch (...) {
+        }
+        userNamespaceSync.writeSide = -1;
+    });
+
+    FdSource sendPidSource(sendPid.readSide.get());
+    auto ss = tokenizeString<std::vector<std::string>>(sendPidSource.readLine());
+    assert(ss.size() == 1);
+    pid = string2Int<pid_t>(ss[0]).value();
+    auto thisProcPath = procPath / std::to_string(static_cast<pid_t>(pid));
+
+    if (usingUserNamespace) {
+        /* Set the UID/GID mapping of the builder's user namespace
+           such that the sandbox user maps to the build user, or to
+           the calling user (if build users are disabled). */
+        uid_t hostUid = buildUser ? buildUser->getUID() : getuid();
+        uid_t hostGid = buildUser ? buildUser->getGID() : getgid();
+        uid_t nrIds = buildUser ? buildUser->getUIDCount() : 1;
+
+        writeFile(thisProcPath / "uid_map", fmt("%d %d %d", sandboxUid(), hostUid, nrIds));
+
+        if (!buildUser || buildUser->getUIDCount() == 1)
+            writeFile(thisProcPath / "setgroups", "deny");
+
+        writeFile(thisProcPath / "gid_map", fmt("%d %d %d", sandboxGid(), hostGid, nrIds));
+    } else {
+        debug("note: not using a user namespace");
+        if (!buildUser)
+            throw Error(
+                "cannot perform a sandboxed build because user namespaces are not enabled; check /proc/sys/user/max_user_namespaces");
+    }
+
+    /* Now that we know the sandbox uid/gid, we can write
+       /etc/passwd and /etc/group. */
+    writeFile(
+        chrootRootDir / "etc" / "passwd",
+        fmt("root:x:0:0:Nix build user:%3%:/noshell\n"
+            "nixbld:x:%1%:%2%:Nix build user:%3%:/noshell\n"
+            "nobody:x:65534:65534:Nobody:/:/noshell\n",
+            sandboxUid(),
+            sandboxGid(),
+            store.config->getLocalSettings().sandboxBuildDir.get().native()));
+
+    writeFile(
+        chrootRootDir / "etc" / "group",
+        fmt("root:x:0:\n"
+            "nixbld:!:%1%:\n"
+            "nogroup:x:65534:\n",
+            sandboxGid()));
+
+    /* Save the mount- and user namespace of the child. We have to do this
+     * *before* the child does a chroot. */
+    auto sandboxPath = thisProcPath / "ns";
+    sandboxMountNamespace = open((sandboxPath / "mnt").c_str(), O_RDONLY | O_CLOEXEC);
+    if (sandboxMountNamespace.get() == -1)
+        throw SysError("getting sandbox mount namespace");
+
+    if (usingUserNamespace) {
+        sandboxUserNamespace = open((sandboxPath / "user").c_str(), O_RDONLY | O_CLOEXEC);
+        if (sandboxUserNamespace.get() == -1)
+            throw SysError("getting sandbox user namespace");
+    }
+
+    /* Move the child into its own cgroup. */
+    if (cgroup)
+        writeFile(*cgroup / "cgroup.procs", fmt("%d", (pid_t) pid));
+
+    /* Signal the builder that we've updated its user namespace. */
+    writeFull(userNamespaceSync.writeSide.get(), "1\n");
+    userNamespaceSyncDone = true;
+}
+
+void ChrootLinuxDerivationBuilder::enterChroot()
+{
+    userNamespaceSync.writeSide = -1;
+
+    if (readLine(userNamespaceSync.readSide.get()) != "1")
+        throw Error("user namespace initialisation failed");
+
+    userNamespaceSync.readSide = -1;
+
+    if (derivationType.isSandboxed()) {
+
+        /* Initialise the loopback interface. */
+        AutoCloseFD fd(socket(PF_INET, SOCK_DGRAM, IPPROTO_IP));
+        if (!fd)
+            throw SysError("cannot open IP socket");
+
+        using namespace std::string_view_literals;
+        struct ifreq ifr = {};
+        std::ranges::copy("lo"sv, ifr.ifr_name);
+        ifr.ifr_flags = IFF_UP | IFF_LOOPBACK | IFF_RUNNING;
+        if (ioctl(fd.get(), SIOCSIFFLAGS, &ifr) == -1)
+            throw SysError("cannot set loopback interface flags");
+    }
+
+    /* Set the hostname etc. to fixed values. */
+    char hostname[] = "localhost";
+    if (sethostname(hostname, sizeof(hostname)) == -1)
+        throw SysError("cannot set host name");
+    char domainname[] = "(none)"; // kernel default
+    if (setdomainname(domainname, sizeof(domainname)) == -1)
+        throw SysError("cannot set domain name");
+
+    /* Make all filesystems private.  This is necessary
+       because subtrees may have been mounted as "shared"
+       (MS_SHARED).  (Systemd does this, for instance.)  Even
+       though we have a private mount namespace, mounting
+       filesystems on top of a shared subtree still propagates
+       outside of the namespace.  Making a subtree private is
+       local to the namespace, though, so setting MS_PRIVATE
+       does not affect the outside world. */
+    if (mount(0, "/", 0, MS_PRIVATE | MS_REC, 0) == -1)
+        throw SysError("unable to make '/' private");
+
+    /* Bind-mount chroot directory to itself, to treat it as a
+       different filesystem from /, as needed for pivot_root. */
+    if (mount(chrootRootDir.c_str(), chrootRootDir.c_str(), 0, MS_BIND, 0) == -1)
+        throw SysError("unable to bind mount %1%", PathFmt(chrootRootDir));
+
+    /* Bind-mount the sandbox's Nix store onto itself so that
+       we can mark it as a "shared" subtree, allowing bind
+       mounts made in *this* mount namespace to be propagated
+       into the child namespace created by the
+       unshare(CLONE_NEWNS) call below.
+
+       Marking chrootRootDir as MS_SHARED causes pivot_root()
+       to fail with EINVAL. Don't know why. */
+    std::filesystem::path chrootStoreDir = chrootRootDir / std::filesystem::path(store.storeDir).relative_path();
+
+    if (mount(chrootStoreDir.c_str(), chrootStoreDir.c_str(), 0, MS_BIND, 0) == -1)
+        throw SysError("unable to bind mount the Nix store at %1%", PathFmt(chrootStoreDir));
+
+    if (mount(0, chrootStoreDir.c_str(), 0, MS_SHARED, 0) == -1)
+        throw SysError("unable to make %s shared", PathFmt(chrootStoreDir));
+
+    /* Set up a nearly empty /dev, unless the user asked to
+       bind-mount the host /dev. */
+    Strings ss;
+    if (pathsInChroot.find("/dev") == pathsInChroot.end()) {
+        createDirs(chrootRootDir / "dev" / "shm");
+        createDirs(chrootRootDir / "dev" / "pts");
+        ss.push_back("/dev/full");
+        if (systemFeatures.count("kvm")) {
+            if (pathExists("/dev/kvm")) {
+                ss.push_back("/dev/kvm");
+            } else {
+                warn(
+                    "KVM is enabled in system-features but /dev/kvm is not available. "
+                    "QEMU builds may fall back to slow emulation. "
+                    "Consider removing 'kvm' from system-features in nix.conf if KVM is not supported on this system.");
+            }
+        }
+        ss.push_back("/dev/null");
+        ss.push_back("/dev/random");
+        ss.push_back("/dev/tty");
+        ss.push_back("/dev/urandom");
+        ss.push_back("/dev/zero");
+        createSymlink("/proc/self/fd", chrootRootDir / "dev" / "fd");
+        createSymlink("/proc/self/fd/0", chrootRootDir / "dev" / "stdin");
+        createSymlink("/proc/self/fd/1", chrootRootDir / "dev" / "stdout");
+        createSymlink("/proc/self/fd/2", chrootRootDir / "dev" / "stderr");
+    }
+
+    /* Fixed-output derivations typically need to access the
+       network, so give them access to /etc/resolv.conf and so
+       on. */
+    if (!derivationType.isSandboxed()) {
+        // Only use nss functions to resolve hosts and
+        // services. Don’t use it for anything else that may
+        // be configured for this system. This limits the
+        // potential impurities introduced in fixed-outputs.
+        writeFile(chrootRootDir / "etc" / "nsswitch.conf", "hosts: files dns\nservices: files\n");
+
+        /* N.B. it is realistic that these paths might not exist. It
+           happens when testing Nix building fixed-output derivations
+           within a pure derivation. */
+        for (auto & path : {"/etc/resolv.conf", "/etc/services", "/etc/hosts"})
+            if (pathExists(path))
+                ss.push_back(path);
+
+        if (auto & caFile = fileTransferSettings.caFile.get()) {
+            if (pathExists(*caFile))
+                pathsInChroot.try_emplace(
+                    "/etc/ssl/certs/ca-certificates.crt", canonPath(caFile->native(), true), true);
+        }
+    }
+
+    for (auto & i : ss) {
+        // For backwards-compatibility, resolve all the symlinks in the
+        // chroot paths.
+        auto canonicalPath = canonPath(i, true);
+        pathsInChroot.emplace(i, canonicalPath);
+    }
+
+    /* We really do have to reopen the dirfd in the child, otherwise move_mount dies with EINVAL. */
+    AutoCloseFD chrootRootDirFd = openDirectory(chrootRootDir, FinalSymlink::DontFollow);
+    if (!chrootRootDirFd)
+        throw SysError("opening directory %s", PathFmt(chrootRootDir));
+
+    /* Bind-mount all the directories from the "host"
+       filesystem that we want in the chroot
+       environment. */
+    for (auto & i : pathsInChroot) {
+        if (i.second.source == "/proc")
+            continue; // backwards compatibility
+#if HAVE_EMBEDDED_SANDBOX_SHELL
+        if (i.second.source == "__embedded_sandbox_shell__") {
+            static constexpr unsigned char sh[] = {
+#  embed EMBEDDED_SANDBOX_SHELL_PATH
+            };
+            auto dst = chrootRootDir / i.first.relative_path();
+            createDirs(dst.parent_path());
+            writeFile(dst, std::string_view((const char *) sh, sizeof(sh)));
+            chmod(dst, 0555);
+        } else
+#endif
+        {
+            doBind(i.second.source, chrootRootDirFd.get(), i.first.relative_path(), chrootRootDir, i.second.optional);
+        }
+    }
+
+    /* Bind a new instance of procfs on /proc. */
+    createDirs(chrootRootDir / "proc");
+    if (mount("none", (chrootRootDir / "proc").c_str(), "proc", 0, 0) == -1)
+        throw SysError("mounting /proc");
+
+    /* Mount sysfs on /sys. */
+    if (buildUser && buildUser->getUIDCount() != 1) {
+        createDirs(chrootRootDir / "sys");
+        if (mount("none", (chrootRootDir / "sys").c_str(), "sysfs", 0, 0) == -1)
+            throw SysError("mounting /sys");
+    }
+
+    /* Mount a new tmpfs on /dev/shm to ensure that whatever
+       the builder puts in /dev/shm is cleaned up automatically. */
+    if (pathExists("/dev/shm")
+        && mount(
+               "none",
+               (chrootRootDir / "dev" / "shm").c_str(),
+               "tmpfs",
+               0,
+               fmt("size=%s", store.config->getLocalSettings().sandboxShmSize).c_str())
+               == -1)
+        throw SysError("mounting /dev/shm");
+
+    /* Mount a new devpts on /dev/pts.  Note that this
+       requires the kernel to be compiled with
+       CONFIG_DEVPTS_MULTIPLE_INSTANCES=y (which is the case
+       if /dev/ptx/ptmx exists). */
+    if (pathExists("/dev/pts/ptmx") && !pathExists(chrootRootDir / "dev" / "ptmx")
+        && !pathsInChroot.count("/dev/pts")) {
+        if (mount("none", (chrootRootDir / "dev" / "pts").c_str(), "devpts", 0, "newinstance,mode=0620") == 0) {
+            createSymlink("/dev/pts/ptmx", chrootRootDir / "dev" / "ptmx");
+
+            /* Make sure /dev/pts/ptmx is world-writable.  With some
+                Linux versions, it is created with permissions 0.  */
+            chmod(chrootRootDir / "dev" / "pts" / "ptmx", 0666);
+        } else {
+            if (errno != EINVAL)
+                throw SysError("mounting /dev/pts");
+            doBind("/dev/pts", chrootRootDirFd.get(), "dev/pts", chrootRootDir);
+            doBind("/dev/ptmx", chrootRootDirFd.get(), "dev/ptmx", chrootRootDir);
+        }
+    }
+
+    /* Make /etc unwritable */
+    if (!drvOptions.useUidRange(drv))
+        chmod(chrootRootDir / "etc", 0555);
+
+    /* Unshare this mount namespace. This is necessary because
+       pivot_root() below changes the root of the mount
+       namespace. This means that the call to setns() in
+       addDependency() would hide the host's filesystem,
+       making it impossible to bind-mount paths from the host
+       Nix store into the sandbox. Therefore, we save the
+       pre-pivot_root namespace in
+       sandboxMountNamespace. Since we made /nix/store a
+       shared subtree above, this allows addDependency() to
+       make paths appear in the sandbox. */
+    if (unshare(CLONE_NEWNS) == -1)
+        throw SysError("unsharing mount namespace");
+
+    /* Unshare the cgroup namespace. This means
+       /proc/self/cgroup will show the child's cgroup as '/'
+       rather than whatever it is in the parent. */
+    if (cgroup && unshare(CLONE_NEWCGROUP) == -1)
+        throw SysError("unsharing cgroup namespace");
+
+    /* Do the chroot(). */
+    if (chdir(chrootRootDir.c_str()) == -1)
+        throw SysError("cannot change directory to %1%", PathFmt(chrootRootDir));
+
+    if (mkdir("real-root", 0500) == -1)
+        throw SysError("cannot create real-root directory");
+
+    if (pivot_root(".", "real-root") == -1)
+        throw SysError("cannot pivot old root directory onto %1%", PathFmt(chrootRootDir / "real-root"));
+
+    if (chroot(".") == -1)
+        throw SysError("cannot change root directory to %1%", PathFmt(chrootRootDir));
+
+    if (umount2("real-root", MNT_DETACH) == -1)
+        throw SysError("cannot unmount real root filesystem");
+
+    if (rmdir("real-root") == -1)
+        throw SysError("cannot remove real-root directory");
+
+    LinuxDerivationBuilder::enterChroot();
+}
+
+void ChrootLinuxDerivationBuilder::setUser()
+{
+    preserveDeathSignal([this]() {
+        /* Switch to the sandbox uid/gid in the user namespace,
+           which corresponds to the build user or calling user in
+           the parent namespace. */
+        if (setgid(sandboxGid()) == -1)
+            throw SysError("setgid failed");
+        if (setuid(sandboxUid()) == -1)
+            throw SysError("setuid failed");
+    });
+}
+
+SingleDrvOutputs ChrootLinuxDerivationBuilder::unprepareBuild()
+{
+    sandboxMountNamespace = -1;
+    sandboxUserNamespace = -1;
+
+    return DerivationBuilderImpl::unprepareBuild();
+}
+
+void ChrootLinuxDerivationBuilder::killSandbox(bool getStats)
+{
+    if (cgroup) {
+        auto stats = linux::destroyCgroup(*cgroup);
+        if (getStats) {
+            buildResult.cpuUser = stats.cpuUser;
+            buildResult.cpuSystem = stats.cpuSystem;
+        }
+        return;
+    }
+
+    DerivationBuilderImpl::killSandbox(getStats);
+}
+
+void ChrootLinuxDerivationBuilder::addDependencyImpl(const StorePath & path)
+{
+    auto [source, targetRelPath] = ChrootDerivationBuilder::addDependencyPrep(path);
+    assert(targetRelPath.is_relative()); /* The path is relative to the chroot. */
+
+    /* Bind-mount the path into the sandbox. This requires
+       entering its mount namespace, which is not possible
+       in multithreaded programs. So we do this in a
+       child process.*/
+    Pid child(startProcess([&]() {
+        if (usingUserNamespace && (setns(sandboxUserNamespace.get(), CLONE_NEWUSER) == -1))
+            throw SysError("entering sandbox user namespace");
+
+        if (setns(sandboxMountNamespace.get(), CLONE_NEWNS) == -1)
+            throw SysError("entering sandbox mount namespace");
+
+        /* We really do have to reopen the dirfd in the child, otherwise move_mount dies with EINVAL. */
+        AutoCloseFD chrootRootDirFd = openDirectory(chrootRootDir, FinalSymlink::DontFollow);
+        if (!chrootRootDirFd)
+            throw SysError("opening directory %s", PathFmt(chrootRootDir));
+        doBind(source, chrootRootDirFd.get(), targetRelPath, chrootRootDir);
+
+        _exit(0);
+    }));
+
+    int status = child.wait();
+    if (!statusOk(status))
+        throw Error("could not add path '%s' to sandbox: %s", store.printStorePath(path), statusToString(status));
+}
+
+} // namespace nix
diff --git a/src/libstore/linux/build/linux-derivation-builder.hh b/src/libstore/linux/build/linux-derivation-builder.hh
new file mode 100644
index 000000000000..42fa61925b2b
--- /dev/null
+++ b/src/libstore/linux/build/linux-derivation-builder.hh
@@ -0,0 +1,31 @@
+#pragma once
+
+#include "derivation-builder-impl.hh"
+
+#include "nix/store/personality.hh"
+#include "store-config-private.hh"
+
+#include <sys/prctl.h>
+
+#if HAVE_LANDLOCK
+#  include <linux/landlock.h>
+#endif
+
+#if HAVE_LANDLOCK && defined(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET)
+#  define DO_LANDLOCK 1
+#else
+#  define DO_LANDLOCK 0
+#endif
+
+namespace nix {
+
+void setupSeccomp(const LocalSettings & localSettings);
+
+struct LinuxDerivationBuilder : virtual DerivationBuilderImpl
+{
+    using DerivationBuilderImpl::DerivationBuilderImpl;
+
+    void enterChroot() override;
+};
+
+} // namespace nix
diff --git a/src/libstore/linux/meson.build b/src/libstore/linux/meson.build
index 6fc193cf8989..69885a9f8baf 100644
--- a/src/libstore/linux/meson.build
+++ b/src/libstore/linux/meson.build
@@ -1,4 +1,7 @@
+include_dirs += [ include_directories('build') ]
+
 sources += files(
+  'build/linux-derivation-builder.cc',
   'personality.cc',
 )
 
diff --git a/src/libstore/local-binary-cache-store.cc b/src/libstore/local-binary-cache-store.cc
index 60298efdbbfd..4d79f613e4a5 100644
--- a/src/libstore/local-binary-cache-store.cc
+++ b/src/libstore/local-binary-cache-store.cc
@@ -52,6 +52,10 @@ StoreReference LocalBinaryCacheStoreConfig::getReference() const
 
 struct LocalBinaryCacheStore : virtual BinaryCacheStore
 {
+private:
+    void anchor() override;
+
+public:
     using Config = LocalBinaryCacheStoreConfig;
 
     ref<Config> config;
@@ -139,6 +143,10 @@ StringSet LocalBinaryCacheStoreConfig::uriSchemes()
         return {"file"};
 }
 
+void LocalBinaryCacheStoreConfig::anchor() {}
+
+void LocalBinaryCacheStore::anchor() {}
+
 ref<Store> LocalBinaryCacheStoreConfig::openStore() const
 {
     auto store = make_ref<LocalBinaryCacheStore>(
diff --git a/src/libstore/local-binary-cache-store.md b/src/libstore/local-binary-cache-store.md
index 93fddc840538..d3f32bcc0bd1 100644
--- a/src/libstore/local-binary-cache-store.md
+++ b/src/libstore/local-binary-cache-store.md
@@ -2,7 +2,7 @@ R"(
 
 **Store URL format**: `file://`*path*
 
-This store allows reading and writing a binary cache stored in *path*
+This store allows reading and writing a [binary cache](@docroot@/protocols/binary-cache/index.md) stored in *path*
 in the local filesystem. If *path* does not exist, it will be created.
 
 For example, the following builds or downloads `nixpkgs#hello` into
diff --git a/src/libstore/local-fs-store.cc b/src/libstore/local-fs-store.cc
index 9f5864ee4425..a6fd24bf34e6 100644
--- a/src/libstore/local-fs-store.cc
+++ b/src/libstore/local-fs-store.cc
@@ -1,4 +1,3 @@
-#include "nix/util/posix-source-accessor.hh"
 #include "nix/store/store-api.hh"
 #include "nix/store/local-fs-store.hh"
 #include "nix/util/compression.hh"
@@ -6,6 +5,10 @@
 
 namespace nix {
 
+void LocalFSStoreConfig::anchor() {}
+
+void LocalFSStore::anchor() {}
+
 LocalFSStoreConfig::LocalFSStoreConfig(const std::filesystem::path & rootDir, const Params & params)
     : StoreConfig(params, FilePathType::Native)
     /* Default `?root` from `rootDir` if non set
@@ -27,26 +30,70 @@ LocalFSStore::LocalFSStore(const Config & config)
 {
 }
 
-struct LocalStoreAccessor : PosixSourceAccessor
+namespace {
+
+struct LocalStoreAccessor : SourceAccessor
 {
+private:
+    void anchor() override {};
+
+public:
+    ref<SourceAccessor> accessor;
     ref<LocalFSStore> store;
     bool requireValidPath;
 
     LocalStoreAccessor(ref<LocalFSStore> store, bool requireValidPath)
-        : PosixSourceAccessor(std::filesystem::path{store->config.realStoreDir.get()})
+        : accessor(makeFSSourceAccessor(std::filesystem::path{store->config.realStoreDir.get()}))
         , store(store)
         , requireValidPath(requireValidPath)
     {
     }
 
-    void requireStoreObject(const CanonPath & path)
+    void requireStoreObject(const StorePath & storePath)
     {
-        auto [storePath, rest] = store->toStorePath(store->storeDir + path.abs());
         if (requireValidPath && !store->isValidPath(storePath))
             throw InvalidPath("path '%1%' is not a valid store path", store->printStorePath(storePath));
     }
 
+    static StorePath getStoreObjectPath(const CanonPath & path)
+    {
+        /* See special handling of isRoot() in maybeLstat. */
+        if (path.isRoot())
+            throw BadStorePath("path '%1%' is not a valid store path", path);
+        return StorePath(*path.begin());
+    }
+
+    static std::optional<StorePath> maybeGetStoreObjectPath(const CanonPath & path)
+    try {
+        return getStoreObjectPath(path);
+    } catch (BadStorePath &) {
+        /* FIXME: Stop using exceptions for control flow. */
+        return std::nullopt;
+    }
+
+    void requireStoreObject(const CanonPath & path)
+    {
+        requireStoreObject(getStoreObjectPath(path));
+    }
+
     std::optional<Stat> maybeLstat(const CanonPath & path) override
+    {
+        /* Also allow `path` to point to the entire store, which is
+           needed for resolving symlinks. */
+        if (path.isRoot())
+            return Stat{.type = tDirectory};
+
+        /* Querying existence should not fail for things like
+           `/nix/store/foo.nix`. The store cannot contain such files (unless
+           some weird impurities sneak in, but that's UB from nix's PoV). */
+        auto maybeStorePath = maybeGetStoreObjectPath(path);
+        if (!maybeStorePath)
+            return std::nullopt;
+        requireStoreObject(*maybeStorePath);
+        return accessor->maybeLstat(path);
+    }
+
+    Stat lstat(const CanonPath & path) override
     {
         /* Also allow `path` to point to the entire store, which is
            needed for resolving symlinks. */
@@ -54,28 +101,58 @@ struct LocalStoreAccessor : PosixSourceAccessor
             return Stat{.type = tDirectory};
 
         requireStoreObject(path);
-        return PosixSourceAccessor::maybeLstat(path);
+        return accessor->lstat(path);
     }
 
     DirEntries readDirectory(const CanonPath & path) override
     {
         requireStoreObject(path);
-        return PosixSourceAccessor::readDirectory(path);
+        return accessor->readDirectory(path);
+    }
+
+    void readDirectory(
+        const CanonPath & dirPath,
+        std::function<void(SourceAccessor & subdirAccessor, const CanonPath & subdirRelPath)> callback) override
+    {
+        requireStoreObject(dirPath);
+        return accessor->readDirectory(dirPath, std::move(callback));
     }
 
     void readFile(const CanonPath & path, Sink & sink, fun<void(uint64_t)> sizeCallback) override
     {
         requireStoreObject(path);
-        return PosixSourceAccessor::readFile(path, sink, sizeCallback);
+        return accessor->readFile(path, sink, sizeCallback);
     }
 
     std::string readLink(const CanonPath & path) override
     {
         requireStoreObject(path);
-        return PosixSourceAccessor::readLink(path);
+        return accessor->readLink(path);
+    }
+
+    std::string showPath(const CanonPath & path) override
+    {
+        return accessor->showPath(path);
+    }
+
+    std::optional<std::filesystem::path> getPhysicalPath(const CanonPath & path) override
+    {
+        return accessor->getPhysicalPath(path);
+    }
+
+    std::pair<CanonPath, std::optional<std::string>> getFingerprint(const CanonPath & path) override
+    {
+        return accessor->getFingerprint(path);
+    }
+
+    std::optional<time_t> getLastModified() override
+    {
+        return accessor->getLastModified();
     }
 };
 
+} // namespace
+
 ref<SourceAccessor> LocalFSStore::getFSAccessor(bool requireValidPath)
 {
     return make_ref<LocalStoreAccessor>(
@@ -96,7 +173,7 @@ std::shared_ptr<SourceAccessor> LocalFSStore::getFSAccessor(const StorePath & pa
         if (!pathExists(absPath))
             return nullptr;
     }
-    return std::make_shared<PosixSourceAccessor>(std::move(absPath));
+    return makeFSSourceAccessor(std::move(absPath));
 }
 
 const std::filesystem::path LocalFSStore::drvsLogDir = "drvs";
@@ -117,7 +194,7 @@ std::optional<std::string> LocalFSStore::getBuildLogExact(const StorePath & path
 
         else if (pathExists(logBz2Path)) {
             try {
-                return decompress("bzip2", readFile(logBz2Path));
+                return decompress(CompressionAlgo::bzip2, readFile(logBz2Path));
             } catch (Error &) {
             }
         }
diff --git a/src/libstore/local-overlay-store.cc b/src/libstore/local-overlay-store.cc
index afbd47b5bd60..c0fee83d7d18 100644
--- a/src/libstore/local-overlay-store.cc
+++ b/src/libstore/local-overlay-store.cc
@@ -10,6 +10,10 @@
 
 namespace nix {
 
+void LocalOverlayStoreConfig::anchor() {}
+
+void LocalOverlayStore::anchor() {}
+
 std::string LocalOverlayStoreConfig::doc()
 {
     return
@@ -262,7 +266,7 @@ LocalStore::VerificationResult LocalOverlayStore::verifyAllValidPaths(RepairFlag
     StorePathSet done;
 
     auto existsInStoreDir = [&](const StorePath & storePath) {
-        return pathExists((config->realStoreDir.get() / storePath.to_string()).string());
+        return pathExists(config->realStoreDir.get() / storePath.to_string());
     };
 
     bool errors = false;
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index b0c41c35ce65..9aebfe8de615 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -1,5 +1,7 @@
 #include "nix/store/local-store.hh"
+#include "nix/store/build.hh"
 #include "nix/store/globals.hh"
+#include "nix/store/path-references.hh"
 #include "nix/util/git.hh"
 #include "nix/util/archive.hh"
 #include "nix/store/pathlocks.hh"
@@ -13,7 +15,7 @@
 #include "nix/util/compression.hh"
 #include "nix/util/signals.hh"
 #include "nix/store/posix-fs-canonicalise.hh"
-#include "nix/util/posix-source-accessor.hh"
+#include "nix/util/source-accessor.hh"
 #include "nix/store/keys.hh"
 #include "nix/util/users.hh"
 #include "nix/store/store-registration.hh"
@@ -31,15 +33,14 @@
 #include <fcntl.h>
 #include <stdio.h>
 #include <time.h>
+#include <variant>
 
 #ifndef _WIN32
 #  include <grp.h>
 #endif
 
 #ifdef __linux__
-#  include <sched.h>
-#  include <sys/statvfs.h>
-#  include <sys/mount.h>
+#  include "nix/util/linux-namespaces.hh"
 #endif
 
 #ifdef __CYGWIN__
@@ -56,6 +57,14 @@
 
 namespace nix {
 
+void LocalStoreConfig::anchor() {}
+
+void LocalBuildStoreConfig::anchor() {}
+
+void LocalStore::anchor() {}
+
+void GcStore::anchor() {}
+
 LocalStoreConfig::LocalStoreConfig(const std::filesystem::path & path, const Params & params)
     : StoreConfig(params, FilePathType::Native)
     , LocalFSStoreConfig(path, params)
@@ -106,6 +115,7 @@ struct LocalStore::State::Stmts
     SQLiteStmt AddDerivationOutput;
     SQLiteStmt RegisterRealisedOutput;
     SQLiteStmt UpdateRealisedOutput;
+    SQLiteStmt DeleteRealisedOutputByName;
     SQLiteStmt QueryValidDerivers;
     SQLiteStmt QueryDerivationOutputs;
     SQLiteStmt QueryRealisedOutput;
@@ -210,7 +220,7 @@ LocalStore::LocalStore(ref<const Config> config)
 #if HAVE_POSIX_FALLOCATE
             res = posix_fallocate(fd.get(), 0, gcSettings.reservedSize);
 #endif
-            if (res == -1) {
+            if (res != 0) {
                 writeFull(fd.get(), std::string(gcSettings.reservedSize, 'X'));
                 [[gnu::unused]] auto res2 =
 
@@ -258,6 +268,17 @@ LocalStore::LocalStore(ref<const Config> config)
                            : "database schema needs migrating, but this cannot be done in read-only mode");
     }
 
+    auto acquireWriteLock = [&]() {
+        if (!lockFile(globalLock.get(), ltWrite, false)) {
+            printInfo("waiting for exclusive access to the Nix store...");
+            // We have acquired a shared lock; release it to prevent deadlocks.
+            // This can happen if someone else is trying to promote their read
+            // lock into a write lock.
+            lockFile(globalLock.get(), ltNone, false);
+            lockFile(globalLock.get(), ltWrite, true);
+        }
+    };
+
     if (curSchema > nixSchemaVersion)
         throw Error("current Nix store schema is version %1%, but I only support %2%", curSchema, nixSchemaVersion);
 
@@ -280,12 +301,7 @@ LocalStore::LocalStore(ref<const Config> config)
                 "which is no longer supported. To convert to the new format,\n"
                 "please upgrade Nix to version 1.11 first.");
 
-        if (!lockFile(globalLock.get(), ltWrite, false)) {
-            printInfo("waiting for exclusive access to the Nix store...");
-            lockFile(
-                globalLock.get(), ltNone, false); // We have acquired a shared lock; release it to prevent deadlocks
-            lockFile(globalLock.get(), ltWrite, true);
-        }
+        acquireWriteLock();
 
         /* Get the schema version again, because another process may
            have performed the upgrade already. */
@@ -318,13 +334,21 @@ LocalStore::LocalStore(ref<const Config> config)
 
         writeFile(schemaPath, fmt("%1%", nixSchemaVersion), 0666, FsSync::Yes);
 
+        // Downgrade to a read lock and hold to prevent other processes from
+        // upgrading the schema while we're using the store
         lockFile(globalLock.get(), ltRead, true);
     }
 
     else
         openDB(*state, false);
 
-    upgradeDBSchema(*state);
+    if (!config->readOnly && upgradeDBSchema(*state, true)) {
+        acquireWriteLock();
+        upgradeDBSchema(*state, false);
+        // Downgrade to a read lock and hold to prevent other processes from
+        // upgrading the schema while we're using the store
+        lockFile(globalLock.get(), ltRead, true);
+    }
 
     /* Prepare SQL statements. */
     state->stmts->RegisterValidPath.create(
@@ -369,6 +393,15 @@ LocalStore::LocalStore(ref<const Config> config)
                     outputName = ?
                 ;
             )");
+        state->stmts->DeleteRealisedOutputByName.create(
+            state->db,
+            R"(
+                delete from BuildTraceV3
+                where
+                    drvPath = ? and
+                    outputName = ?
+                ;
+            )");
         state->stmts->QueryRealisedOutput.create(
             state->db,
             R"(
@@ -382,17 +415,7 @@ LocalStore::LocalStore(ref<const Config> config)
 AutoCloseFD LocalStore::openGCLock()
 {
     auto fnGCLock = config->stateDir.get() / "gc.lock";
-    auto fdGCLock = open(
-        fnGCLock.string().c_str(),
-        O_RDWR | O_CREAT
-#ifndef _WIN32
-            | O_CLOEXEC
-#endif
-        ,
-        0600);
-    if (!fdGCLock)
-        throw SysError("opening global GC lock %1%", PathFmt(fnGCLock));
-    return toDescriptor(fdGCLock);
+    return openLockFile(fnGCLock, /*create=*/true);
 }
 
 void LocalStore::deleteStorePath(const std::filesystem::path & path, uint64_t & bytesFreed, bool isKnownPath)
@@ -432,6 +455,12 @@ LocalStore::~LocalStore()
         future.get();
     }
 
+    {
+        auto state(_state->lock());
+        if (state->gcThread.joinable())
+            state->gcThread.join();
+    }
+
     try {
         auto fdTempRoots(_fdTempRoots.lock());
         if (*fdTempRoots) {
@@ -556,16 +585,30 @@ void LocalStore::openDB(State & state, bool create)
 
     /* Initialise the database schema, if necessary. */
     if (create) {
-        static const char schema[] =
-#include "schema.sql.gen.hh"
-            ;
-        db.exec(schema);
+        db.exec({
+#embed "schema.sql"
+        });
     }
 }
 
-void LocalStore::upgradeDBSchema(State & state)
+bool LocalStore::upgradeDBSchema(State & state, bool dryRun)
 {
-    state.db.exec("create table if not exists SchemaMigrations (migration text primary key not null);");
+    bool ret = false;
+
+    {
+        SQLiteStmt queryHasSchemaMigrations;
+        queryHasSchemaMigrations.create(
+            state.db, "SELECT 1 FROM sqlite_master WHERE type='table' AND name='SchemaMigrations';");
+        auto useQueryHasSchemaMigrations(queryHasSchemaMigrations.use());
+        if (!useQueryHasSchemaMigrations.next()) {
+            if (dryRun)
+                return true;
+            else {
+                state.db.exec("create table SchemaMigrations (migration text primary key not null);");
+                ret = true;
+            }
+        }
+    }
 
     StringSet schemaMigrations;
 
@@ -577,8 +620,16 @@ void LocalStore::upgradeDBSchema(State & state)
             schemaMigrations.insert(useQuerySchemaMigrations.getStr(0));
     }
 
-    auto doUpgrade = [&](const std::string & migrationName, const std::string & stmt) {
-        if (schemaMigrations.contains(migrationName))
+    auto needsMigration = [&](const std::string & migrationName) -> bool {
+        return !schemaMigrations.contains(migrationName);
+    };
+
+    auto maybeUpgrade = [&](const std::string & migrationName, const std::string & stmt) {
+        if (!needsMigration(migrationName))
+            return;
+
+        ret = true;
+        if (dryRun)
             return;
 
         debug("executing Nix database schema migration '%s'...", migrationName);
@@ -590,13 +641,17 @@ void LocalStore::upgradeDBSchema(State & state)
         schemaMigrations.insert(migrationName);
     };
 
-    if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations))
-        doUpgrade(
+    if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations)) {
+        maybeUpgrade(
             "20251017-ca-derivations",
-#include "ca-specific-schema.sql.gen.hh"
-        );
+            {
+#embed "ca-specific-schema.sql"
+            });
+    }
 
-    doUpgrade("20260309-drop-redundant-indexreferrer", "drop index if exists IndexReferrer");
+    maybeUpgrade("20260309-drop-redundant-indexreferrer", "drop index if exists IndexReferrer");
+
+    return ret;
 }
 
 /* To improve purity, users may want to make the Nix store a read-only
@@ -606,37 +661,7 @@ void LocalStore::makeStoreWritable()
 #ifdef __linux__
     if (!isRootUser())
         return;
-    /* Check if /nix/store is on a read-only mount. */
-    struct statvfs stat;
-    if (statvfs(config->realStoreDir.get().c_str(), &stat) != 0)
-        throw SysError("getting info about the Nix store mount point");
-
-    if (stat.f_flag & ST_RDONLY) {
-        /* In a user namespace, mount flags like `nodev` and `nosuid` are
-           locked and dropping them causes `EPERM`, so here we translate each
-           `statvfs` flag to the corresponding `mount` flag individually. */
-        unsigned long flags = MS_REMOUNT | MS_BIND;
-        if (stat.f_flag & ST_NODEV)
-            flags |= MS_NODEV;
-        if (stat.f_flag & ST_NOSUID)
-            flags |= MS_NOSUID;
-        if (stat.f_flag & ST_NOEXEC)
-            flags |= MS_NOEXEC;
-        if (stat.f_flag & ST_NOATIME)
-            flags |= MS_NOATIME;
-        if (stat.f_flag & ST_NODIRATIME)
-            flags |= MS_NODIRATIME;
-        if (stat.f_flag & ST_RELATIME)
-            flags |= MS_RELATIME;
-        if (stat.f_flag & ST_SYNCHRONOUS)
-            flags |= MS_SYNCHRONOUS;
-#  ifdef ST_NOSYMFOLLOW
-        if (stat.f_flag & ST_NOSYMFOLLOW)
-            flags |= MS_NOSYMFOLLOW;
-#  endif
-        if (mount(0, config->realStoreDir.get().c_str(), "none", flags, 0) == -1)
-            throw SysError("remounting %s writable", PathFmt(config->realStoreDir.get()));
-    }
+    remountReadOnlyWritable(config->realStoreDir.get());
 #endif
 }
 
@@ -659,9 +684,10 @@ void LocalStore::registerDrvOutput(const Realisation & info)
             if (info.isCompatibleWith(*oldR)) {
                 auto combinedSignatures = oldR->signatures;
                 combinedSignatures.insert(info.signatures.begin(), info.signatures.end());
-                state->stmts->UpdateRealisedOutput
-                    .use()(concatStringsSep(" ", Signature::toStrings(combinedSignatures)))(
-                        info.id.drvPath.to_string())(info.id.outputName)
+                state->stmts->UpdateRealisedOutput.use()
+                    .apply(concatStringsSep(" ", Signature::toStrings(combinedSignatures)))
+                    .apply(info.id.drvPath.to_string())
+                    .apply(info.id.outputName)
                     .exec();
             } else {
                 throw Error(
@@ -674,19 +700,35 @@ void LocalStore::registerDrvOutput(const Realisation & info)
                     printStorePath(info.outPath));
             }
         } else {
-            state->stmts->RegisterRealisedOutput
-                .use()(info.id.drvPath.to_string())(info.id.outputName)(printStorePath(info.outPath))(
-                    concatStringsSep(" ", Signature::toStrings(info.signatures)))
+            state->stmts->RegisterRealisedOutput.use()
+                .apply(info.id.drvPath.to_string())
+                .apply(info.id.outputName)
+                .apply(printStorePath(info.outPath))
+                .apply(concatStringsSep(" ", Signature::toStrings(info.signatures)))
                 .exec();
         }
     });
 }
 
+void LocalStore::deleteBuildTraces(const std::set<DrvOutput> & keys)
+{
+    experimentalFeatureSettings.require(Xp::CaDerivations);
+    retrySQLite<void>([&]() {
+        auto state(_state->lock());
+        SQLiteTxn txn(state->db);
+        for (const auto & key : keys) {
+            state->stmts->DeleteRealisedOutputByName.use().apply(key.drvPath.to_string()).apply(key.outputName).exec();
+        }
+        txn.commit();
+    });
+}
+
 void LocalStore::cacheDrvOutputMapping(
     State & state, const uint64_t deriver, const std::string & outputName, const StorePath & output)
 {
-    retrySQLite<void>(
-        [&]() { state.stmts->AddDerivationOutput.use()(deriver)(outputName) (printStorePath(output)).exec(); });
+    retrySQLite<void>([&]() {
+        state.stmts->AddDerivationOutput.use().apply(deriver).apply(outputName).apply(printStorePath(output)).exec();
+    });
 }
 
 uint64_t LocalStore::addValidPath(State & state, const ValidPathInfo & info)
@@ -696,13 +738,15 @@ uint64_t LocalStore::addValidPath(State & state, const ValidPathInfo & info)
             "cannot add path '%s' to the Nix store because it claims to be content-addressed but isn't",
             printStorePath(info.path));
 
-    state.stmts->RegisterValidPath
-        .use()(printStorePath(info.path))(info.narHash.to_string(HashFormat::Base16, true))(
-            info.registrationTime == 0 ? time(nullptr) : info.registrationTime)(
-            info.deriver ? printStorePath(*info.deriver) : "",
-            (bool) info.deriver)(info.narSize, info.narSize != 0)(info.ultimate ? 1 : 0, info.ultimate)(
-            concatStringsSep(" ", Signature::toStrings(info.sigs)),
-            !info.sigs.empty())(renderContentAddress(info.ca), (bool) info.ca)
+    state.stmts->RegisterValidPath.use()
+        .apply(printStorePath(info.path))
+        .apply(info.narHash.to_string(HashFormat::Base16, true))
+        .apply(info.registrationTime == 0 ? time(nullptr) : info.registrationTime)
+        .apply(info.deriver ? printStorePath(*info.deriver) : "", (bool) info.deriver)
+        .apply(info.narSize, info.narSize != 0)
+        .apply(info.ultimate ? 1 : 0, info.ultimate)
+        .apply(concatStringsSep(" ", Signature::toStrings(info.sigs)), !info.sigs.empty())
+        .apply(renderContentAddress(info.ca), (bool) info.ca)
         .exec();
     uint64_t id = state.db.getLastInsertedRowId();
 
@@ -749,7 +793,7 @@ void LocalStore::queryPathInfoUncached(
 std::shared_ptr<const ValidPathInfo> LocalStore::queryPathInfoInternal(State & state, const StorePath & path)
 {
     /* Get the path info. */
-    auto useQueryPathInfo(state.stmts->QueryPathInfo.use()(printStorePath(path)));
+    auto useQueryPathInfo(state.stmts->QueryPathInfo.use().apply(printStorePath(path)));
 
     if (!useQueryPathInfo.next())
         return std::shared_ptr<ValidPathInfo>();
@@ -765,8 +809,6 @@ std::shared_ptr<const ValidPathInfo> LocalStore::queryPathInfoInternal(State & s
 
     auto info = std::make_shared<ValidPathInfo>(path, UnkeyedValidPathInfo(*this, narHash));
 
-    info->id = id;
-
     info->registrationTime = useQueryPathInfo.getInt(2);
 
     auto s = (const char *) sqlite3_column_text(state.stmts->QueryPathInfo, 3);
@@ -787,7 +829,7 @@ std::shared_ptr<const ValidPathInfo> LocalStore::queryPathInfoInternal(State & s
         info->ca = ContentAddress::parseOpt(s);
 
     /* Get the references. */
-    auto useQueryReferences(state.stmts->QueryReferences.use()(info->id));
+    auto useQueryReferences(state.stmts->QueryReferences.use().apply(id));
 
     while (useQueryReferences.next())
         info->references.insert(parseStorePath(useQueryReferences.getStr(0)));
@@ -798,17 +840,19 @@ std::shared_ptr<const ValidPathInfo> LocalStore::queryPathInfoInternal(State & s
 /* Update path info in the database. */
 void LocalStore::updatePathInfo(State & state, const ValidPathInfo & info)
 {
-    state.stmts->UpdatePathInfo
-        .use()(info.narSize, info.narSize != 0)(info.narHash.to_string(HashFormat::Base16, true))(
-            info.ultimate ? 1 : 0,
-            info.ultimate)(concatStringsSep(" ", Signature::toStrings(info.sigs)), !info.sigs.empty())(
-            renderContentAddress(info.ca), (bool) info.ca)(printStorePath(info.path))
+    state.stmts->UpdatePathInfo.use()
+        .apply(info.narSize, info.narSize != 0)
+        .apply(info.narHash.to_string(HashFormat::Base16, true))
+        .apply(info.ultimate ? 1 : 0, info.ultimate)
+        .apply(concatStringsSep(" ", Signature::toStrings(info.sigs)), !info.sigs.empty())
+        .apply(renderContentAddress(info.ca), (bool) info.ca)
+        .apply(printStorePath(info.path))
         .exec();
 }
 
 uint64_t LocalStore::queryValidPathId(State & state, const StorePath & path)
 {
-    auto use(state.stmts->QueryPathInfo.use()(printStorePath(path)));
+    auto use(state.stmts->QueryPathInfo.use().apply(printStorePath(path)));
     if (!use.next())
         throw InvalidPath("path '%s' is not valid", printStorePath(path));
     return use.getInt(0);
@@ -816,7 +860,7 @@ uint64_t LocalStore::queryValidPathId(State & state, const StorePath & path)
 
 bool LocalStore::isValidPath_(State & state, const StorePath & path)
 {
-    return state.stmts->QueryPathInfo.use()(printStorePath(path)).next();
+    return state.stmts->QueryPathInfo.use().apply(printStorePath(path)).next();
 }
 
 bool LocalStore::isValidPathUncached(const StorePath & path)
@@ -847,7 +891,7 @@ StorePathSet LocalStore::queryAllValidPaths()
 
 void LocalStore::queryReferrers(State & state, const StorePath & path, StorePathSet & referrers)
 {
-    auto useQueryReferrers(state.stmts->QueryReferrers.use()(printStorePath(path)));
+    auto useQueryReferrers(state.stmts->QueryReferrers.use().apply(printStorePath(path)));
 
     while (useQueryReferrers.next())
         referrers.insert(parseStorePath(useQueryReferrers.getStr(0)));
@@ -863,7 +907,7 @@ StorePathSet LocalStore::queryValidDerivers(const StorePath & path)
     return retrySQLite<StorePathSet>([&]() {
         auto state(_state->lock());
 
-        auto useQueryValidDerivers(state->stmts->QueryValidDerivers.use()(printStorePath(path)));
+        auto useQueryValidDerivers(state->stmts->QueryValidDerivers.use().apply(printStorePath(path)));
 
         StorePathSet derivers;
         while (useQueryValidDerivers.next())
@@ -881,7 +925,7 @@ LocalStore::queryStaticPartialDerivationOutputMap(const StorePath & path)
         std::map<std::string, std::optional<StorePath>> outputs;
         uint64_t drvId;
         drvId = queryValidPathId(*state, path);
-        auto use(state->stmts->QueryDerivationOutputs.use()(drvId));
+        auto use(state->stmts->QueryDerivationOutputs.use().apply(drvId));
         while (use.next())
             outputs.insert_or_assign(use.getStr(0), parseStorePath(use.getStr(1)));
 
@@ -920,7 +964,7 @@ std::optional<StorePath> LocalStore::queryPathFromHashPart(const std::string & h
     return retrySQLite<std::optional<StorePath>>([&]() -> std::optional<StorePath> {
         auto state(_state->lock());
 
-        auto useQueryPathFromHashPart(state->stmts->QueryPathFromHashPart.use()(prefix));
+        auto useQueryPathFromHashPart(state->stmts->QueryPathFromHashPart.use().apply(prefix));
 
         if (!useQueryPathFromHashPart.next())
             return {};
@@ -966,7 +1010,7 @@ void LocalStore::registerValidPaths(const ValidPathInfos & infos)
         for (auto & [_, i] : infos) {
             auto referrer = queryValidPathId(*state, i.path);
             for (auto & j : i.references)
-                state->stmts->AddReference.use()(referrer)(queryValidPathId(*state, j)).exec();
+                state->stmts->AddReference.use().apply(referrer).apply(queryValidPathId(*state, j)).exec();
         }
 
         /* Do a topological sort of the paths.  This will throw an
@@ -1000,12 +1044,12 @@ void LocalStore::invalidatePath(State & state, const StorePath & path)
 {
     debug("invalidating path '%s'", printStorePath(path));
 
-    state.stmts->InvalidatePath.use()(printStorePath(path)).exec();
+    state.stmts->InvalidatePath.use().apply(printStorePath(path)).exec();
 
     /* Note that the foreign key constraints on the Refs table take
        care of deleting the references entries for `path'. */
 
-    pathInfoCache->lock()->erase(path);
+    invalidatePathInfoCacheFor(path);
 }
 
 const PublicKeys & LocalStore::getPublicKeys()
@@ -1041,17 +1085,18 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source, RepairF
             auto realPath = toRealPath(info.path);
 
             /* Lock the output path.  But don't lock if we're being called
-            from a build hook (whose parent process already acquired a
-            lock on this path). */
+               from a build hook (whose parent process already acquired a
+               lock on this path). */
             if (!locksHeld.count(printStorePath(info.path)))
                 outputLock.lockPaths({realPath});
 
-            if (repair || !isValidPath(info.path)) {
+            /* The path may have been created by another process in the meantime, so check again. */
+            if (repair || !isValidPathUncached(info.path)) {
 
                 deletePath(realPath);
 
                 /* While restoring the path from the NAR, compute the hash
-                of the NAR. */
+                   of the NAR. */
                 HashSink hashSink(HashAlgorithm::SHA256);
 
                 TeeSource wrapperSource{source, hashSink};
@@ -1077,8 +1122,7 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source, RepairF
                 if (info.ca) {
                     auto & specified = *info.ca;
                     auto actualHash = ({
-                        auto accessor = getFSAccessor(false);
-                        CanonPath path{info.path.to_string()};
+                        SourcePath sourcePath = requireStoreObjectAccessor(info.path, /*requireValidPath=*/false);
                         Hash h{HashAlgorithm::SHA256}; // throwaway def to appease C++
                         auto fim = specified.method.getFileIngestionMethod();
                         switch (fim) {
@@ -1088,12 +1132,12 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source, RepairF
                                 specified.hash.algo,
                                 std::string{info.path.hashPart()},
                             };
-                            dumpPath({accessor, path}, caSink, (FileSerialisationMethod) fim);
+                            dumpPath(sourcePath, caSink, (FileSerialisationMethod) fim);
                             h = caSink.finish().hash;
                             break;
                         }
                         case FileIngestionMethod::Git:
-                            h = git::dumpHash(specified.hash.algo, {accessor, path}).hash;
+                            h = git::dumpHash(specified.hash.algo, sourcePath).hash;
                             break;
                         }
                         ContentAddress{
@@ -1122,14 +1166,13 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source, RepairF
                 }
 
                 registerValidPath(info);
-            }
+            } else
+                // We may have a negative cache entry for this path, so get rid of it.
+                invalidatePathInfoCacheFor(info.path);
 
             outputLock.setDeletion(true);
         }
     }
-
-    // In case `cleanup` ignored an `Interrupted` exception
-    checkInterrupt();
 }
 
 StorePath LocalStore::addToStoreFromDump(
@@ -1140,10 +1183,30 @@ StorePath LocalStore::addToStoreFromDump(
     HashAlgorithm hashAlgo,
     const StorePathSet & references,
     RepairFlag repair)
+{
+    return addToStoreFromDump(source0, name, dumpMethod, hashMethod, hashAlgo, references, repair, false);
+}
+
+StorePath LocalStore::addToStoreFromDump(
+    Source & source0,
+    std::string_view name,
+    FileSerialisationMethod dumpMethod,
+    ContentAddressMethod hashMethod,
+    HashAlgorithm hashAlgo,
+    const StorePathSet & originalReferences,
+    RepairFlag repair,
+    bool filterReferences)
 {
     /* For computing the store path. */
-    auto hashSink = std::make_unique<HashSink>(hashAlgo);
-    TeeSource source{source0, *hashSink};
+    auto hashSink = std::make_shared<HashSink>(hashAlgo);
+    std::shared_ptr<Sink> sink = hashSink;
+    std::optional<PathRefScanSink> refSink = std::nullopt;
+    if (filterReferences) {
+        // Only scan if we really need to, since it's slower.
+        refSink = PathRefScanSink::fromPaths(originalReferences);
+        sink = std::make_shared<TeeSink>(*hashSink, *refSink);
+    }
+    TeeSource source{source0, *sink};
     const LocalSettings & localSettings = config->getLocalSettings();
 
     /* Read the source path into memory, but only if it's up to
@@ -1196,8 +1259,9 @@ StorePath LocalStore::addToStoreFromDump(
     bool methodsMatch = static_cast<FileIngestionMethod>(dumpMethod) == hashMethod.getFileIngestionMethod();
 
     /* If the methods don't match, our streaming hash of the dump is the
-       wrong sort, and we need to rehash. */
-    bool inMemoryAndDontNeedRestore = inMemory && methodsMatch;
+       wrong sort, and we need to rehash.
+       References are also in store path, if scanning we will need to move */
+    bool inMemoryAndDontNeedRestore = inMemory && methodsMatch && !filterReferences;
 
     if (!inMemoryAndDontNeedRestore) {
         /* Drain what we pulled so far, and then keep on pulling */
@@ -1208,7 +1272,7 @@ StorePath LocalStore::addToStoreFromDump(
         delTempDir = std::make_unique<AutoDelete>(tempDir);
         tempPath = tempDir / "x";
 
-        restorePath(tempPath.string(), bothSource, dumpMethod, localSettings.fsyncStorePaths);
+        restorePath(tempPath, bothSource, dumpMethod, localSettings.fsyncStorePaths);
 
         dumpBuffer.reset();
         dump = {};
@@ -1216,6 +1280,13 @@ StorePath LocalStore::addToStoreFromDump(
 
     auto [dumpHash, size] = hashSink->finish();
 
+    StorePathSet references;
+    if (refSink.has_value()) {
+        references = refSink->getResultPaths();
+    } else {
+        references = originalReferences;
+    }
+
     auto desc = ContentAddressWithReferences::fromParts(
         hashMethod,
         methodsMatch ? dumpHash
@@ -1239,7 +1310,8 @@ StorePath LocalStore::addToStoreFromDump(
 
         PathLocks outputLock({realPath});
 
-        if (repair || !isValidPath(dstPath)) {
+        /* The path may have been created by another process in the meantime, so check again. */
+        if (repair || !isValidPathUncached(dstPath)) {
 
             deletePath(realPath);
 
@@ -1261,7 +1333,7 @@ StorePath LocalStore::addToStoreFromDump(
                 }
             } else {
                 /* Move the temporary path we restored above. */
-                moveFile(tempPath.string(), realPath);
+                moveFile(tempPath, realPath);
             }
 
             /* For computing the nar hash. In recursive SHA-256 mode, this
@@ -1286,7 +1358,9 @@ StorePath LocalStore::addToStoreFromDump(
             auto info = ValidPathInfo::makeFromCA(*this, name, std::move(desc), narHash.hash);
             info.narSize = narHash.numBytesDigested;
             registerValidPath(info);
-        }
+        } else
+            // We may have a negative cache entry for this path, so get rid of it.
+            invalidatePathInfoCacheFor(dstPath);
 
         outputLock.setDeletion(true);
     }
@@ -1312,10 +1386,12 @@ std::pair<std::filesystem::path, AutoCloseFD> LocalStore::createTempDirInStore()
             continue;
         }
         lockedByUs = lockFile(tmpDirFd.get(), ltWrite, true);
-    } while (!pathExists(tmpDirFn.string()) || !lockedByUs);
+    } while (!pathExists(tmpDirFn) || !lockedByUs);
     return {tmpDirFn, std::move(tmpDirFd)};
 }
 
+void PathInUse::anchor() {}
+
 void LocalStore::invalidatePathChecked(const StorePath & path)
 {
     retrySQLite<void>([&]() {
@@ -1366,7 +1442,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
                 printError(
                     "link %s was modified! expected hash %s, got '%s'", PathFmt(link.path()), name.string(), hash);
                 if (repair) {
-                    std::filesystem::remove(link.path());
+                    unlinkIfExists(link.path());
                     printInfo("removed link %s", PathFmt(link.path()));
                 } else {
                     errors = true;
@@ -1398,7 +1474,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
                         info->narHash.to_string(HashFormat::Nix32, true),
                         current.hash.to_string(HashFormat::Nix32, true));
                     if (repair)
-                        repairPath(i);
+                        getBuilder()->repairPath(i);
                     else
                         errors = true;
                 } else {
@@ -1512,7 +1588,7 @@ void LocalStore::verifyPath(
             printError("path '%s' disappeared, but it still has valid referrers!", pathS);
             if (repair)
                 try {
-                    repairPath(path);
+                    getBuilder()->repairPath(path);
                 } catch (Error & e) {
                     logWarning(e.info());
                     errors = true;
@@ -1562,7 +1638,8 @@ void LocalStore::addSignatures(const StorePath & storePath, const std::set<Signa
 std::optional<std::pair<int64_t, UnkeyedRealisation>>
 LocalStore::queryRealisationCore_(LocalStore::State & state, const DrvOutput & id)
 {
-    auto useQueryRealisedOutput(state.stmts->QueryRealisedOutput.use()(id.drvPath.to_string())(id.outputName));
+    auto useQueryRealisedOutput(
+        state.stmts->QueryRealisedOutput.use().apply(id.drvPath.to_string()).apply(id.outputName));
     if (!useQueryRealisedOutput.next())
         return std::nullopt;
     auto realisationDbId = useQueryRealisedOutput.getInt(0);
diff --git a/src/libstore/log-store.cc b/src/libstore/log-store.cc
index fd03bb30ea02..23e6563991d4 100644
--- a/src/libstore/log-store.cc
+++ b/src/libstore/log-store.cc
@@ -2,6 +2,8 @@
 
 namespace nix {
 
+void LogStore::anchor() {}
+
 std::optional<std::string> LogStore::getBuildLog(const StorePath & path)
 {
     auto maybePath = getBuildDerivationPath(path);
diff --git a/src/libstore/make-content-addressed.cc b/src/libstore/make-content-addressed.cc
index 4a7b21c3b12a..a6170eafd0f0 100644
--- a/src/libstore/make-content-addressed.cc
+++ b/src/libstore/make-content-addressed.cc
@@ -10,11 +10,9 @@ std::map<StorePath, StorePath> makeContentAddressed(Store & srcStore, Store & ds
 
     auto paths = srcStore.topoSortPaths(closure);
 
-    std::reverse(paths.begin(), paths.end());
-
     std::map<StorePath, StorePath> remappings;
 
-    for (auto & path : paths) {
+    for (auto & path : paths | std::views::reverse) {
         auto pathS = srcStore.printStorePath(path);
         auto oldInfo = srcStore.queryPathInfo(path);
         std::string oldHashPart(path.hashPart());
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index 753c786876ab..3830e63947a5 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -9,7 +9,7 @@ project(
     'errorlogs=true', # Please print logs for tests that fail
     'localstatedir=/nix/var',
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -29,8 +29,7 @@ subdir('nix-meson-build-support/default-system-cpu')
 configdata_pub.set_quoted(
   'NIX_LOCAL_SYSTEM',
   nix_system_cpu + '-' + host_machine.system(),
-  description : 'This is the system name Nix expects for local running instance of Nix.\n\n'
-    + 'See the "system" setting for additional details',
+  description : 'This is the system name Nix expects for local running instance of Nix.\n\n' + 'See the "system" setting for additional details',
 )
 
 deps_private_maybe_subproject = []
@@ -72,6 +71,8 @@ configdata_priv.set('CAN_LINK_SYMLINK', can_link_symlink.to_int())
 check_funcs = [
   'posix_fallocate',
   'statvfs',
+  'open_tree',
+  'move_mount',
 ]
 foreach funcspec : check_funcs
   define_name = 'HAVE_' + funcspec.underscorify().to_upper()
@@ -84,9 +85,11 @@ if host_machine.system() == 'linux'
   configdata_priv.set('HAVE_LANDLOCK', has_landlock.to_int())
 endif
 
-has_acl_support = cxx.has_header('sys/xattr.h') \
-  and cxx.has_function('llistxattr') \
-  and cxx.has_function('lremovexattr')
+has_acl_support = cxx.has_header('sys/xattr.h') and cxx.has_function(
+  'llistxattr',
+) and cxx.has_function(
+  'lremovexattr',
+)
 # Used in public header. Affects ABI!
 configdata_pub.set(
   'NIX_SUPPORT_ACL',
@@ -173,40 +176,15 @@ endif
 
 configdata_pub.set('NIX_WITH_AWS_AUTH', s3_aws_auth.enabled().to_int())
 
-subdir('nix-meson-build-support/generate-header')
-
-generated_headers = []
-foreach header : [
-  'schema.sql',
-  'ca-specific-schema.sql',
-]
-  generated_headers += gen_header.process(header)
-endforeach
-
 busybox = find_program(get_option('sandbox-shell'), required : false)
 
-configdata_priv.set(
-  'HAVE_EMBEDDED_SANDBOX_SHELL',
-  get_option('embedded-sandbox-shell').to_int(),
-)
-
 if get_option('embedded-sandbox-shell')
   configdata_priv.set_quoted('SANDBOX_SHELL', '__embedded_sandbox_shell__')
+  configdata_priv.set_quoted('EMBEDDED_SANDBOX_SHELL_PATH', busybox.full_path())
+  configdata_priv.set('HAVE_EMBEDDED_SANDBOX_SHELL', 1)
 elif busybox.found()
   configdata_priv.set_quoted('SANDBOX_SHELL', busybox.full_path())
-endif
-
-if get_option('embedded-sandbox-shell')
-  hexdump = find_program('hexdump', native : true)
-  embedded_sandbox_shell_gen = custom_target(
-    'embedded-sandbox-shell.gen.hh',
-    command : [ hexdump, '-v', '-e', '1/1 "0x%x," "\n"' ],
-    input : busybox.full_path(),
-    output : 'embedded-sandbox-shell.gen.hh',
-    capture : true,
-    feed : true,
-  )
-  generated_headers += embedded_sandbox_shell_gen
+  configdata_priv.set('HAVE_EMBEDDED_SANDBOX_SHELL', 0)
 endif
 
 fs = import('fs')
@@ -220,15 +198,14 @@ path_opts = [
   'libdir',
   'includedir',
   'libexecdir',
+  'localstatedir',
   # Homecooked Nix directories.
   'store-dir',
-  'localstatedir',
   'log-dir',
 ]
 # For your grepping pleasure, this loop sets the following variables that aren't mentioned
 # literally above:
 # store_dir
-# localstatedir
 # log_dir
 # profile_dir
 foreach optname : path_opts
@@ -354,6 +331,7 @@ sources = files(
   'store-dir-config.cc',
   'store-reference.cc',
   'store-registration.cc',
+  'submit-store.cc',
   'uds-remote-store.cc',
   'worker-protocol-connection.cc',
   'worker-protocol.cc',
@@ -370,6 +348,14 @@ if host_machine.system() == 'linux'
   subdir('linux')
 endif
 
+if host_machine.system() == 'freebsd'
+  subdir('freebsd')
+endif
+
+if host_machine.system() == 'darwin'
+  subdir('darwin')
+endif
+
 if host_machine.system() == 'windows'
   subdir('windows')
 else
@@ -381,7 +367,6 @@ subdir('nix-meson-build-support/windows-version')
 
 this_library = library(
   'nixstore',
-  generated_headers,
   sources,
   config_priv_h,
   soversion : nix_soversion,
@@ -399,13 +384,7 @@ libraries_private = []
 
 extra_pkg_config_variables = {
   'storedir' : get_option('store-dir'),
+  'localstatedir' : get_option('localstatedir'),
 }
 
-# Working around https://github.com/mesonbuild/meson/issues/13584
-if host_machine.system() != 'darwin'
-  extra_pkg_config_variables += {
-    'localstatedir' : get_option('localstatedir'),
-  }
-endif
-
 subdir('nix-meson-build-support/export')
diff --git a/src/libstore/misc.cc b/src/libstore/misc.cc
index 51708a2cbce4..02ba90ec17b6 100644
--- a/src/libstore/misc.cc
+++ b/src/libstore/misc.cc
@@ -75,7 +75,7 @@ void Store::computeFSClosure(
     computeFSClosure(paths, paths_, flipDirection, includeOutputs, includeDerivers);
 }
 
-const ContentAddress * getDerivationCA(const BasicDerivation & drv)
+const ContentAddress * getDerivationCA(const Derivation & drv)
 {
     auto out = drv.outputs.find("out");
     if (out == drv.outputs.end())
@@ -149,7 +149,7 @@ querySubstitutablePathInfosAsync(Store & store, const StorePathCAMap & paths, Su
         }
         if (lastStoresException.has_value()) {
             if (!settings.getWorkerSettings().tryFallback) {
-                throw *lastStoresException;
+                throw std::move(*lastStoresException);
             } else
                 logError(lastStoresException->info());
         }
@@ -184,7 +184,7 @@ MissingPaths Store::queryMissing(const std::vector<DerivedPath> & targets)
 
     auto mustBuildDrv = [&](const StorePath & drvPath, const Derivation & drv, std::set<DerivedPath> & edges) {
         res.willBuild.insert(drvPath);
-        for (const auto & [inputDrv, inputNode] : drv.inputDrvs.map)
+        for (const auto & [inputDrv, inputNode] : drv.inputs.drvs.map)
             collectDerivedPaths(edges, makeConstantStorePathRef(inputDrv), inputNode);
     };
 
@@ -231,7 +231,7 @@ MissingPaths Store::queryMissing(const std::vector<DerivedPath> & targets)
                         // FIXME: this is a lot of work just to get the value
                         // of `allowSubstitutes`.
                         drvOptions = derivationOptionsFromStructuredAttrs(
-                            *this, drv->inputDrvs, drv->env, get(drv->structuredAttrs));
+                            *this, drv->inputs.drvs, drv->env, get(drv->structuredAttrs));
                     } catch (Error & e) {
                         e.addTrace({}, "while parsing derivation '%s'", printStorePath(drvPath));
                         throw;
@@ -412,45 +412,17 @@ StorePath resolveDerivedPath(Store & store, const SingleDerivedPath & req, Store
         req.raw());
 }
 
-OutputPathMap resolveDerivedPath(Store & store, const DerivedPath::Built & bfd)
-{
-    auto drvPath = resolveDerivedPath(store, *bfd.drvPath);
-    auto outputMap = deepQueryDerivationOutputMap(store, drvPath);
-    auto outputsLeft = std::visit(
-        overloaded{
-            [&](const OutputsSpec::All &) { return StringSet{}; },
-            [&](const OutputsSpec::Names & names) { return static_cast<StringSet>(names); },
-        },
-        bfd.outputs.raw);
-    for (auto iter = outputMap.begin(); iter != outputMap.end();) {
-        auto & outputName = iter->first;
-        if (bfd.outputs.contains(outputName)) {
-            outputsLeft.erase(outputName);
-            ++iter;
-        } else {
-            iter = outputMap.erase(iter);
-        }
-    }
-    if (!outputsLeft.empty())
-        throw Error(
-            "derivation '%s' does not have an outputs %s",
-            store.printStorePath(drvPath),
-            concatStringsSep(", ", quoteStrings(std::get<OutputsSpec::Names>(bfd.outputs.raw))));
-    return outputMap;
-}
-
 } // namespace nix
 
 namespace nlohmann {
 
-using namespace nix;
-
-TrustedFlag adl_serializer<TrustedFlag>::from_json(const json & json)
+nix::TrustedFlag adl_serializer<nix::TrustedFlag>::from_json(const json & json)
 {
+    using namespace nix;
     return getBoolean(json) ? TrustedFlag::Trusted : TrustedFlag::NotTrusted;
 }
 
-void adl_serializer<TrustedFlag>::to_json(json & json, const TrustedFlag & trustedFlag)
+void adl_serializer<nix::TrustedFlag>::to_json(json & json, const nix::TrustedFlag & trustedFlag)
 {
     json = static_cast<bool>(trustedFlag);
 }
diff --git a/src/libstore/nar-info-disk-cache.cc b/src/libstore/nar-info-disk-cache.cc
index 632b31ce0934..6554bd7bf2e4 100644
--- a/src/libstore/nar-info-disk-cache.cc
+++ b/src/libstore/nar-info-disk-cache.cc
@@ -66,15 +66,16 @@ create table if not exists LastPurge (
 
 struct NarInfoDiskCacheImpl : NarInfoDiskCache
 {
+private:
+    void anchor() override;
+public:
     /* How often to purge expired entries from the cache. */
     const int purgeInterval = 24 * 3600;
 
     struct Cache
     {
-        int id;
         std::string storeDir;
-        bool wantMassQuery;
-        int priority;
+        CacheInfo info;
     };
 
     struct State
@@ -160,14 +161,15 @@ struct NarInfoDiskCacheImpl : NarInfoDiskCache
                     .use()
                     // Use a minimum TTL to prevent --refresh from
                     // nuking the entire disk cache.
-                    (now - std::max(settings.ttlNegative.get(), 3600U))(
-                        now - std::max(settings.ttlPositive.get(), 30 * 24 * 3600U))
+                    .apply(now - std::max(settings.ttlNegative.get(), 3600U))
+                    .apply(now - std::max(settings.ttlPositive.get(), 30 * 24 * 3600U))
                     .exec();
 
                 debug("deleted %d entries from the NAR info disk cache", sqlite3_changes(state->db));
 
                 SQLiteStmt(state->db, "insert or replace into LastPurge(dummy, value) values ('', ?)")
-                    .use()(now)
+                    .use()
+                    .apply(now)
                     .exec();
             }
         });
@@ -191,22 +193,23 @@ struct NarInfoDiskCacheImpl : NarInfoDiskCache
                the the subtraction would promote time_t to unsigned if time_t is
                32 bit. */
             auto timestamp = static_cast<int64_t>(time(nullptr)) - static_cast<int64_t>(settings.ttlMeta.get());
-            auto queryCache(state.queryCache.use()(uri)(timestamp));
+            auto queryCache(state.queryCache.use().apply(uri).apply(timestamp));
             if (!queryCache.next())
                 return std::nullopt;
             auto cache = Cache{
-                .id = (int) queryCache.getInt(0),
                 .storeDir = queryCache.getStr(1),
-                .wantMassQuery = queryCache.getInt(2) != 0,
-                .priority = (int) queryCache.getInt(3),
-            };
+                .info = {
+                    .id = (int) queryCache.getInt(0),
+                    .wantMassQuery = queryCache.getInt(2) != 0,
+                    .priority = (int) queryCache.getInt(3),
+                }};
             state.caches.emplace(uri, cache);
         }
         return getCache(state, uri);
     }
 
 public:
-    int createCache(const std::string & uri, const std::string & storeDir, bool wantMassQuery, int priority) override
+    int createCache(const std::string & uri, const std::string & storeDir, const CacheInfo & info) override
     {
         return retrySQLite<int>([&]() {
             auto state(_state.lock());
@@ -217,27 +220,27 @@ struct NarInfoDiskCacheImpl : NarInfoDiskCache
             auto cache(queryCacheRaw(*state, uri));
 
             if (cache)
-                return cache->id;
+                return cache->info.id;
 
-            Cache ret{
-                .id = -1, // set below
-                .storeDir = storeDir,
-                .wantMassQuery = wantMassQuery,
-                .priority = priority,
-            };
+            Cache ret{.storeDir = storeDir, .info = info};
 
             {
-                auto r(state->insertCache.use()(uri)(time(nullptr))(storeDir) (wantMassQuery) (priority));
+                auto r(state->insertCache.use()
+                           .apply(uri)
+                           .apply(time(nullptr))
+                           .apply(storeDir)
+                           .apply(info.wantMassQuery)
+                           .apply(info.priority));
                 if (!r.next()) {
                     unreachable();
                 }
-                ret.id = (int) r.getInt(0);
+                ret.info.id = (int) r.getInt(0);
             }
 
             state->caches[uri] = ret;
 
             txn.commit();
-            return ret.id;
+            return ret.info.id;
         });
     }
 
@@ -248,7 +251,7 @@ struct NarInfoDiskCacheImpl : NarInfoDiskCache
             auto cache(queryCacheRaw(*state, uri));
             if (!cache)
                 return std::nullopt;
-            return CacheInfo{.id = cache->id, .wantMassQuery = cache->wantMassQuery, .priority = cache->priority};
+            return cache->info;
         });
     }
 
@@ -263,8 +266,11 @@ struct NarInfoDiskCacheImpl : NarInfoDiskCache
 
                 auto now = time(nullptr);
 
-                auto queryNAR(
-                    state->queryNAR.use()(cache.id)(hashPart) (now - settings.ttlNegative)(now - settings.ttlPositive));
+                auto queryNAR(state->queryNAR.use()
+                                  .apply(cache.info.id)
+                                  .apply(hashPart)
+                                  .apply(now - settings.ttlNegative)
+                                  .apply(now - settings.ttlPositive));
 
                 if (!queryNAR.next())
                     return {oUnknown, 0};
@@ -276,7 +282,7 @@ struct NarInfoDiskCacheImpl : NarInfoDiskCache
                 auto narInfo = make_ref<NarInfo>(
                     cache.storeDir, StorePath(hashPart + "-" + namePart), Hash::parseAnyPrefixed(queryNAR.getStr(6)));
                 narInfo->url = queryNAR.getStr(2);
-                narInfo->compression = queryNAR.getStr(3);
+                narInfo->compression = parseCompressionAlgo(queryNAR.getStr(3));
                 if (!queryNAR.isNull(4))
                     narInfo->fileHash = Hash::parseAnyPrefixed(queryNAR.getStr(4));
                 narInfo->fileSize = queryNAR.getInt(5);
@@ -304,8 +310,12 @@ struct NarInfoDiskCacheImpl : NarInfoDiskCache
 
                 auto now = time(nullptr);
 
-                auto queryRealisation(state->queryRealisation.use()(cache.id)(id.drvPath.to_string())(id.outputName)(
-                    now - settings.ttlNegative)(now - settings.ttlPositive));
+                auto queryRealisation(state->queryRealisation.use()
+                                          .apply(cache.info.id)
+                                          .apply(id.drvPath.to_string())
+                                          .apply(id.outputName)
+                                          .apply(now - settings.ttlNegative)
+                                          .apply(now - settings.ttlPositive));
 
                 if (!queryRealisation.next())
                     return {oUnknown, nullptr};
@@ -344,20 +354,31 @@ struct NarInfoDiskCacheImpl : NarInfoDiskCache
 
                 // assert(hashPart == storePathToHash(info->path));
 
-                state->insertNAR
-                    .use()(cache.id)(hashPart) (std::string(info->path.name()))(
-                        narInfo ? narInfo->url : "", narInfo != 0)(narInfo ? narInfo->compression : "", narInfo != 0)(
+                state->insertNAR.use()
+                    .apply(cache.info.id)
+                    .apply(hashPart)
+                    .apply(std::string(info->path.name()))
+                    .apply(narInfo ? narInfo->url : "", narInfo != 0)
+                    .apply(
+                        /* TODO: Revisit the whole conditional on nullopt compression. This shouldn't happen. .narinfo
+                           parsing treats empty strings as bzip2 while other code treats it as "none"... */
+                        narInfo && narInfo->compression ? showCompressionAlgo(*narInfo->compression) : "",
+                        narInfo != 0)
+                    .apply(
                         narInfo && narInfo->fileHash ? narInfo->fileHash->to_string(HashFormat::Nix32, true) : "",
-                        narInfo && narInfo->fileHash)(
-                        narInfo ? narInfo->fileSize : 0, narInfo != 0 && narInfo->fileSize)(info->narHash.to_string(
-                        HashFormat::Nix32, true))(info->narSize)(concatStringsSep(" ", info->shortRefs()))(
-                        info->deriver ? std::string(info->deriver->to_string()) : "",
-                        (bool) info->deriver)(concatStringsSep(" ", Signature::toStrings(info->sigs)))(
-                        renderContentAddress(info->ca))(time(nullptr))
+                        narInfo && narInfo->fileHash)
+                    .apply(narInfo ? narInfo->fileSize : 0, narInfo != 0 && narInfo->fileSize)
+                    .apply(info->narHash.to_string(HashFormat::Nix32, true))
+                    .apply(info->narSize)
+                    .apply(concatStringsSep(" ", info->shortRefs()))
+                    .apply(info->deriver ? std::string(info->deriver->to_string()) : "", (bool) info->deriver)
+                    .apply(concatStringsSep(" ", Signature::toStrings(info->sigs)))
+                    .apply(renderContentAddress(info->ca))
+                    .apply(time(nullptr))
                     .exec();
 
             } else {
-                state->insertMissingNAR.use()(cache.id)(hashPart) (time(nullptr)).exec();
+                state->insertMissingNAR.use().apply(cache.info.id).apply(hashPart).apply(time(nullptr)).exec();
             }
         });
     }
@@ -369,10 +390,13 @@ struct NarInfoDiskCacheImpl : NarInfoDiskCache
 
             auto & cache(getCache(*state, uri));
 
-            state->insertRealisation
-                .use()(cache.id)(realisation.id.drvPath.to_string())(realisation.id.outputName)(
-                    realisation.outPath.to_string())(static_cast<nlohmann::json>(realisation.signatures).dump())(
-                    time(nullptr))
+            state->insertRealisation.use()
+                .apply(cache.info.id)
+                .apply(realisation.id.drvPath.to_string())
+                .apply(realisation.id.outputName)
+                .apply(realisation.outPath.to_string())
+                .apply(static_cast<nlohmann::json>(realisation.signatures).dump())
+                .apply(time(nullptr))
                 .exec();
         });
     }
@@ -383,12 +407,20 @@ struct NarInfoDiskCacheImpl : NarInfoDiskCache
             auto state(_state.lock());
 
             auto & cache(getCache(*state, uri));
-            state->insertMissingRealisation.use()(cache.id)(id.drvPath.to_string())(id.outputName)(time(nullptr))
+            state->insertMissingRealisation.use()
+                .apply(cache.info.id)
+                .apply(id.drvPath.to_string())
+                .apply(id.outputName)
+                .apply(time(nullptr))
                 .exec();
         });
     }
 };
 
+void NarInfoDiskCache::anchor() {}
+
+void NarInfoDiskCacheImpl::anchor() {}
+
 ref<NarInfoDiskCache> NarInfoDiskCache::get(const Settings & settings, SQLiteSettings sqliteSettings)
 {
     static ref<NarInfoDiskCache> cache = make_ref<NarInfoDiskCacheImpl>(settings, sqliteSettings);
diff --git a/src/libstore/nar-info.cc b/src/libstore/nar-info.cc
index 028302963e5c..0c350138bb01 100644
--- a/src/libstore/nar-info.cc
+++ b/src/libstore/nar-info.cc
@@ -5,6 +5,8 @@
 
 namespace nix {
 
+void NarInfo::anchor() {}
+
 NarInfo::NarInfo(const StoreDirConfig & store, const std::string & s, const std::string & whence)
     : UnkeyedValidPathInfo(store, Hash::dummy)                                          // FIXME: hack
     , ValidPathInfo(StorePath::dummy, static_cast<const UnkeyedValidPathInfo &>(*this)) // FIXME: hack
@@ -51,7 +53,12 @@ NarInfo::NarInfo(const StoreDirConfig & store, const std::string & s, const std:
         } else if (name == "URL")
             url = value;
         else if (name == "Compression")
-            compression = value;
+            try {
+                /* XXX: Empty strings used to fall back to the bzip2 normalisation below. Is this intentional? */
+                compression = value.empty() ? CompressionAlgo::bzip2 : parseCompressionAlgo(value);
+            } catch (UnknownCompressionMethod & e) {
+                throw corrupt("invalid Compression");
+            }
         else if (name == "FileHash")
             fileHash = parseHashField(value);
         else if (name == "FileSize") {
@@ -89,8 +96,8 @@ NarInfo::NarInfo(const StoreDirConfig & store, const std::string & s, const std:
         line += 1;
     }
 
-    if (compression == "")
-        compression = "bzip2";
+    if (!compression)
+        compression = CompressionAlgo::bzip2;
 
     if (!havePath || !haveNarHash || url.empty() || narSize == 0) {
         line = 0; // don't include line information in the error
@@ -108,8 +115,8 @@ std::string NarInfo::to_string(const StoreDirConfig & store) const
     std::string res;
     res += "StorePath: " + store.printStorePath(path) + "\n";
     res += "URL: " + url + "\n";
-    assert(compression != "");
-    res += "Compression: " + compression + "\n";
+    assert(compression);
+    res += "Compression: " + showCompressionAlgo(*compression) + "\n";
     if (fileHash) {
         assert(fileHash->algo == HashAlgorithm::SHA256);
         res += "FileHash: " + fileHash->to_string(HashFormat::Nix32, true) + "\n";
@@ -144,8 +151,10 @@ UnkeyedNarInfo::toJSON(const StoreDirConfig * store, bool includeImpureInfo, Pat
     if (includeImpureInfo) {
         if (!url.empty())
             jsonObject["url"] = url;
-        if (!compression.empty())
-            jsonObject["compression"] = compression;
+        /* XXX: Why is this conditional??? Empty `Compression: ' fields in .narinfo have always
+           been treated as bzip2. */
+        if (compression)
+            jsonObject["compression"] = showCompressionAlgo(*compression);
         if (fileHash) {
             if (format == PathInfoJsonFormat::V1)
                 jsonObject["downloadHash"] = fileHash->to_string(HashFormat::SRI, true);
@@ -172,8 +181,9 @@ UnkeyedNarInfo UnkeyedNarInfo::fromJSON(const StoreDirConfig * store, const nloh
     if (auto * url = get(obj, "url"))
         res.url = getString(*url);
 
+    /* XXX: Why is this conditional??? */
     if (auto * compression = get(obj, "compression"))
-        res.compression = getString(*compression);
+        res.compression = parseCompressionAlgo(getString(*compression));
 
     if (auto * downloadHash = get(obj, "downloadHash")) {
         if (format == PathInfoJsonFormat::V1)
@@ -192,16 +202,14 @@ UnkeyedNarInfo UnkeyedNarInfo::fromJSON(const StoreDirConfig * store, const nloh
 
 namespace nlohmann {
 
-using namespace nix;
-
-UnkeyedNarInfo adl_serializer<UnkeyedNarInfo>::from_json(const json & json)
+nix::UnkeyedNarInfo adl_serializer<nix::UnkeyedNarInfo>::from_json(const json & json)
 {
-    return UnkeyedNarInfo::fromJSON(nullptr, json);
+    return nix::UnkeyedNarInfo::fromJSON(nullptr, json);
 }
 
-void adl_serializer<UnkeyedNarInfo>::to_json(json & json, const UnkeyedNarInfo & c)
+void adl_serializer<nix::UnkeyedNarInfo>::to_json(json & json, const nix::UnkeyedNarInfo & c)
 {
-    json = c.toJSON(nullptr, true, PathInfoJsonFormat::V2);
+    json = c.toJSON(nullptr, true, nix::PathInfoJsonFormat::V2);
 }
 
 } // namespace nlohmann
diff --git a/src/libstore/optimise-store.cc b/src/libstore/optimise-store.cc
index 220e37fe9efe..fa19b08d6ece 100644
--- a/src/libstore/optimise-store.cc
+++ b/src/libstore/optimise-store.cc
@@ -2,11 +2,15 @@
 #include "nix/store/local-settings.hh"
 #include "nix/util/signals.hh"
 #include "nix/store/posix-fs-canonicalise.hh"
-#include "nix/util/posix-source-accessor.hh"
+#include "nix/util/source-accessor.hh"
 #include "nix/util/file-system.hh"
 
 #include <cstdlib>
 #include <cstring>
+#ifdef __APPLE__
+#  include <regex>
+#endif
+
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
@@ -153,20 +157,14 @@ void LocalStore::optimisePath_(
        Also note that if `path' is a symlink, then we're hashing the
        contents of the symlink (i.e. the result of readlink()), not
        the contents of the target (which may not even exist). */
-    Hash hash = ({
-        hashPath(
-            {make_ref<PosixSourceAccessor>(), CanonPath(path.string())},
-            FileSerialisationMethod::NixArchive,
-            HashAlgorithm::SHA256)
-            .hash;
-    });
+    Hash hash = hashPath(makeFSSourceAccessor(path), FileSerialisationMethod::NixArchive, HashAlgorithm::SHA256).hash;
     debug("%s has hash '%s'", PathFmt(path), hash.to_string(HashFormat::Nix32, true));
 
     /* Check if this is a known hash. */
     std::filesystem::path linkPath = std::filesystem::path{linksDir} / hash.to_string(HashFormat::Nix32, false);
 
     /* Maybe delete the link, if it has been corrupted. */
-    if (std::filesystem::exists(std::filesystem::symlink_status(linkPath))) {
+    if (pathExists(linkPath)) {
         auto stLink = lstat(linkPath);
         if (st.st_size != stLink.st_size || (repair && hash != ({
                                                            hashPath(
@@ -180,11 +178,11 @@ void LocalStore::optimisePath_(
             warn(
                 "There may be more corrupted paths."
                 "\nYou should run `nix-store --verify --check-contents --repair` to fix them all");
-            std::filesystem::remove(linkPath);
+            unlinkIfExists(linkPath);
         }
     }
 
-    if (!std::filesystem::exists(std::filesystem::symlink_status(linkPath))) {
+    if (!pathExists(linkPath)) {
         /* Nope, create a hard link in the links directory. */
         try {
             std::filesystem::create_hard_link(path, linkPath);
@@ -212,9 +210,15 @@ void LocalStore::optimisePath_(
 
     /* Yes!  We've seen a file with the same contents.  Replace the
        current file with a hard link to that file. */
-    auto stLink = lstat(linkPath);
+    auto stLink = maybeLstat(linkPath);
 
-    if (st.st_ino == stLink.st_ino) {
+    /* A concurrent garbage collection may have removed the link in the
+       links directory between the existence check above and now. Skip
+       optimising this path; a later pass will dedup it. */
+    if (!stLink)
+        return;
+
+    if (st.st_ino == stLink->st_ino) {
         debug("%1% is already linked to %2%", PathFmt(path), PathFmt(linkPath));
         return;
     }
@@ -247,6 +251,12 @@ void LocalStore::optimisePath_(
                 printInfo("%1% has maximum number of links", PathFmt(linkPath));
             return;
         }
+        if (e.code() == std::errc::no_such_file_or_directory) {
+            /* A concurrent garbage collection removed the link in the
+               links directory. Skip optimising this path; a later pass
+               will dedup it. */
+            return;
+        }
         throw SystemError(e.code(), "creating hard link from %1% to %2%", PathFmt(linkPath), PathFmt(tempLink));
     }
 
diff --git a/src/libstore/outputs-query.cc b/src/libstore/outputs-query.cc
index 531bcc85521e..5d34596482f3 100644
--- a/src/libstore/outputs-query.cc
+++ b/src/libstore/outputs-query.cc
@@ -3,8 +3,34 @@
 #include "nix/store/realisation.hh"
 #include "nix/util/util.hh"
 
+#include <boost/unordered/unordered_flat_map.hpp>
+
 namespace nix {
 
+namespace {
+
+/**
+ * Cache mapping an unresolved drv path to its resolved (Derivation, StorePath)
+ * pair. Shared across a single top-level resolution call to prevent exponential
+ * re-traversal of the closure when many derivations share the same dependencies.
+ */
+using ResolveCache = boost::unordered_flat_map<StorePath, std::pair<Derivation, StorePath>>;
+
+/**
+ * Cache mapping a resolved derivation output to its realisation output path.
+ */
+using RealisationCache = boost::unordered_flat_map<DrvOutput, std::optional<StorePath>>;
+
+/* Forward declaration so resolveSingleDerivedPath can call it. */
+static std::optional<StorePath> deepQueryPartialDerivationOutputImpl(
+    Store & store,
+    const StorePath & drvPath,
+    const std::string & outputName,
+    Store * evalStore_,
+    QueryRealisationFun & queryRealisation,
+    ResolveCache & cache,
+    RealisationCache & resCache);
+
 /**
  * Resolve a `SingleDerivedPath` to a concrete store path.
  *
@@ -15,29 +41,50 @@ namespace nix {
  * @param queryRealisation must already be initialized (not empty)
  */
 static std::optional<StorePath> resolveSingleDerivedPath(
-    Store & store, const SingleDerivedPath & path, Store * evalStore_, QueryRealisationFun & queryRealisation)
+    Store & store,
+    const SingleDerivedPath & path,
+    Store * evalStore_,
+    QueryRealisationFun & queryRealisation,
+    ResolveCache & cache,
+    RealisationCache & resCache)
 {
     return std::visit(
         overloaded{
             [](const SingleDerivedPath::Opaque & opaque) -> std::optional<StorePath> { return opaque.path; },
             [&](const SingleDerivedPath::Built & built) -> std::optional<StorePath> {
-                auto innerPath = resolveSingleDerivedPath(store, *built.drvPath, evalStore_, queryRealisation);
+                auto innerPath =
+                    resolveSingleDerivedPath(store, *built.drvPath, evalStore_, queryRealisation, cache, resCache);
                 if (!innerPath)
                     return std::nullopt;
-                return deepQueryPartialDerivationOutput(store, *innerPath, built.output, evalStore_, queryRealisation);
+                return deepQueryPartialDerivationOutputImpl(
+                    store, *innerPath, built.output, evalStore_, queryRealisation, cache, resCache);
             },
         },
         path.raw());
 }
 
 /**
- * Resolve a derivation and compute its store path.
+ * Resolve a derivation and compute its store path, with memoization.
+ *
+ * Results are stored in `cache` (keyed on the unresolved `drvPath`) so that
+ * each derivation in the closure is resolved at most once per top-level call,
+ * preventing the exponential re-traversal that would otherwise occur for
+ * content-addressed derivation closures.
  *
  * @param queryRealisation must already be initialized (not empty)
  */
-static std::pair<Derivation, StorePath>
-resolveDerivation(Store & store, const StorePath & drvPath, Store * evalStore_, QueryRealisationFun & queryRealisation)
+static std::pair<Derivation, StorePath> resolveDerivation(
+    Store & store,
+    const StorePath & drvPath,
+    Store * evalStore_,
+    QueryRealisationFun & queryRealisation,
+    ResolveCache & cache,
+    RealisationCache & resCache)
 {
+    auto it = cache.find(drvPath);
+    if (it != cache.end())
+        return it->second;
+
     auto & evalStore = evalStore_ ? *evalStore_ : store;
 
     Derivation drv = evalStore.readInvalidDerivation(drvPath);
@@ -50,40 +97,102 @@ resolveDerivation(Store & store, const StorePath & drvPath, Store * evalStore_,
             store,
             [&](ref<const SingleDerivedPath> depDrvPath,
                 const std::string & depOutputName) -> std::optional<StorePath> {
-                auto concreteDrvPath = resolveSingleDerivedPath(store, *depDrvPath, evalStore_, queryRealisation);
+                auto concreteDrvPath =
+                    resolveSingleDerivedPath(store, *depDrvPath, evalStore_, queryRealisation, cache, resCache);
                 if (!concreteDrvPath)
                     return std::nullopt;
-                return deepQueryPartialDerivationOutput(
-                    store, *concreteDrvPath, depOutputName, evalStore_, queryRealisation);
+                return deepQueryPartialDerivationOutputImpl(
+                    store, *concreteDrvPath, depOutputName, evalStore_, queryRealisation, cache, resCache);
             });
         if (resolvedDrv)
-            drv = Derivation{*resolvedDrv};
+            drv = resolvedDrv->unresolve();
     }
 
     auto resolvedDrvPath = computeStorePath(store, drv);
-    return {std::move(drv), std::move(resolvedDrvPath)};
+    auto result = std::make_pair(drv, resolvedDrvPath);
+    cache.emplace(drvPath, result);
+    return result;
 }
 
 void queryPartialDerivationOutputMapCA(
     Store & store,
     const StorePath & drvPath,
-    const BasicDerivation & drv,
+    const Derivation & drv,
     std::map<std::string, std::optional<StorePath>> & outputs,
-    QueryRealisationFun queryRealisation)
+    QueryRealisationFun queryRealisation,
+    RealisationCache & resCache)
 {
     if (!queryRealisation)
         queryRealisation = [&store](const DrvOutput & o) { return store.queryRealisation(o); };
 
     for (auto & [outputName, _] : drv.outputs) {
-        auto realisation = queryRealisation(DrvOutput{drvPath, outputName});
-        if (realisation) {
-            outputs.insert_or_assign(outputName, realisation->outPath);
+        DrvOutput id{drvPath, outputName};
+        auto it = resCache.find(id);
+        if (it != resCache.end()) {
+            outputs.insert_or_assign(outputName, it->second);
+            continue;
+        }
+
+        auto realisation = queryRealisation(id);
+        std::optional<StorePath> outPath = realisation ? std::optional{realisation->outPath} : std::nullopt;
+        resCache.emplace(id, outPath);
+
+        if (outPath) {
+            outputs.insert_or_assign(outputName, *outPath);
         } else {
             outputs.insert({outputName, std::nullopt});
         }
     }
 }
 
+/**
+ * Internal implementation of deepQueryPartialDerivationOutput that accepts a
+ * shared ResolveCache and RealisationCache, allowing memoization across recursive calls.
+ */
+static std::optional<StorePath> deepQueryPartialDerivationOutputImpl(
+    Store & store,
+    const StorePath & drvPath,
+    const std::string & outputName,
+    Store * evalStore_,
+    QueryRealisationFun & queryRealisation,
+    ResolveCache & cache,
+    RealisationCache & resCache)
+{
+    auto & evalStore = evalStore_ ? *evalStore_ : store;
+
+    auto staticResult = evalStore.queryStaticPartialDerivationOutput(drvPath, outputName);
+    if (staticResult || !experimentalFeatureSettings.isEnabled(Xp::CaDerivations))
+        return staticResult;
+
+    auto [drv, resolvedDrvPath] = resolveDerivation(store, drvPath, evalStore_, queryRealisation, cache, resCache);
+
+    if (drv.outputs.count(outputName) == 0)
+        throw Error("derivation '%s' does not have an output named '%s'", store.printStorePath(drvPath), outputName);
+
+    DrvOutput id{resolvedDrvPath, outputName};
+    auto it = resCache.find(id);
+    if (it != resCache.end())
+        return it->second;
+
+    auto realisation = queryRealisation(id);
+    std::optional<StorePath> outPath = realisation ? std::optional{realisation->outPath} : std::nullopt;
+    resCache.emplace(id, outPath);
+    return outPath;
+}
+
+} // namespace
+
+void queryPartialDerivationOutputMapCA(
+    Store & store,
+    const StorePath & drvPath,
+    const Derivation & drv,
+    std::map<std::string, std::optional<StorePath>> & outputs,
+    QueryRealisationFun queryRealisation)
+{
+    RealisationCache resCache;
+    queryPartialDerivationOutputMapCA(store, drvPath, drv, outputs, queryRealisation, resCache);
+}
+
 std::map<std::string, std::optional<StorePath>> deepQueryPartialDerivationOutputMap(
     Store & store, const StorePath & drvPath, Store * evalStore_, QueryRealisationFun queryRealisation)
 {
@@ -97,8 +206,10 @@ std::map<std::string, std::optional<StorePath>> deepQueryPartialDerivationOutput
     if (!experimentalFeatureSettings.isEnabled(Xp::CaDerivations))
         return outputs;
 
-    auto [drv, resolvedDrvPath] = resolveDerivation(store, drvPath, evalStore_, queryRealisation);
-    queryPartialDerivationOutputMapCA(store, resolvedDrvPath, drv, outputs, queryRealisation);
+    ResolveCache cache;
+    RealisationCache resCache;
+    auto [drv, resolvedDrvPath] = resolveDerivation(store, drvPath, evalStore_, queryRealisation, cache, resCache);
+    queryPartialDerivationOutputMapCA(store, resolvedDrvPath, drv, outputs, queryRealisation, resCache);
 
     return outputs;
 }
@@ -123,22 +234,13 @@ std::optional<StorePath> deepQueryPartialDerivationOutput(
     Store * evalStore_,
     QueryRealisationFun queryRealisation)
 {
-    auto & evalStore = evalStore_ ? *evalStore_ : store;
-
     if (!queryRealisation)
         queryRealisation = [&store](const DrvOutput & o) { return store.queryRealisation(o); };
 
-    auto staticResult = evalStore.queryStaticPartialDerivationOutput(drvPath, outputName);
-    if (staticResult || !experimentalFeatureSettings.isEnabled(Xp::CaDerivations))
-        return staticResult;
-
-    auto [drv, resolvedDrvPath] = resolveDerivation(store, drvPath, evalStore_, queryRealisation);
-
-    if (drv.outputs.count(outputName) == 0)
-        throw Error("derivation '%s' does not have an output named '%s'", store.printStorePath(drvPath), outputName);
-
-    auto realisation = queryRealisation(DrvOutput{resolvedDrvPath, outputName});
-    return realisation ? std::optional{realisation->outPath} : std::nullopt;
+    ResolveCache cache;
+    RealisationCache resCache;
+    return deepQueryPartialDerivationOutputImpl(
+        store, drvPath, outputName, evalStore_, queryRealisation, cache, resCache);
 }
 
 } // namespace nix
diff --git a/src/libstore/outputs-spec.cc b/src/libstore/outputs-spec.cc
index 622df5fc3447..9f0f3c421a37 100644
--- a/src/libstore/outputs-spec.cc
+++ b/src/libstore/outputs-spec.cc
@@ -133,21 +133,21 @@ bool OutputsSpec::isSubsetOf(const OutputsSpec & that) const
 
 namespace nlohmann {
 
-using namespace nix;
-
 #ifndef DOXYGEN_SKIP
 
-OutputsSpec adl_serializer<OutputsSpec>::from_json(const json & json)
+nix::OutputsSpec adl_serializer<nix::OutputsSpec>::from_json(const json & json)
 {
-    auto names = json.get<StringSet>();
+    using namespace nix;
+    auto names = json.get<nix::StringSet>();
     if (names == StringSet({"*"}))
         return OutputsSpec::All{};
     else
         return OutputsSpec::Names{std::move(names)};
 }
 
-void adl_serializer<OutputsSpec>::to_json(json & json, const OutputsSpec & t)
+void adl_serializer<nix::OutputsSpec>::to_json(json & json, const nix::OutputsSpec & t)
 {
+    using namespace nix;
     std::visit(
         overloaded{
             [&](const OutputsSpec::All &) { json = std::vector<std::string>({"*"}); },
@@ -156,8 +156,9 @@ void adl_serializer<OutputsSpec>::to_json(json & json, const OutputsSpec & t)
         t.raw);
 }
 
-ExtendedOutputsSpec adl_serializer<ExtendedOutputsSpec>::from_json(const json & json)
+nix::ExtendedOutputsSpec adl_serializer<nix::ExtendedOutputsSpec>::from_json(const json & json)
 {
+    using namespace nix;
     if (json.is_null())
         return ExtendedOutputsSpec::Default{};
     else {
@@ -165,8 +166,9 @@ ExtendedOutputsSpec adl_serializer<ExtendedOutputsSpec>::from_json(const json &
     }
 }
 
-void adl_serializer<ExtendedOutputsSpec>::to_json(json & json, const ExtendedOutputsSpec & t)
+void adl_serializer<nix::ExtendedOutputsSpec>::to_json(json & json, const nix::ExtendedOutputsSpec & t)
 {
+    using namespace nix;
     std::visit(
         overloaded{
             [&](const ExtendedOutputsSpec::Default &) { json = nullptr; },
diff --git a/src/libstore/package.nix b/src/libstore/package.nix
index 4fa2abaa722b..69f79153ee15 100644
--- a/src/libstore/package.nix
+++ b/src/libstore/package.nix
@@ -59,6 +59,8 @@ mkMesonLibrary (finalAttrs: {
     ./include/nix/store/meson.build
     ./linux/meson.build
     ./linux/include/nix/store/meson.build
+    ./darwin/meson.build
+    ./freebsd/meson.build
     ./unix/meson.build
     ./unix/include/nix/store/meson.build
     ./windows/meson.build
diff --git a/src/libstore/path-info.cc b/src/libstore/path-info.cc
index 1ffd4d52fbd8..a5c7314868d4 100644
--- a/src/libstore/path-info.cc
+++ b/src/libstore/path-info.cc
@@ -8,6 +8,10 @@
 
 namespace nix {
 
+void UnkeyedValidPathInfo::anchor() {}
+
+void ValidPathInfo::anchor() {}
+
 PathInfoJsonFormat parsePathInfoJsonFormat(uint64_t version)
 {
     switch (version) {
@@ -302,30 +306,29 @@ UnkeyedValidPathInfo UnkeyedValidPathInfo::fromJSON(const StoreDirConfig * store
 
 namespace nlohmann {
 
-using namespace nix;
-
-PathInfoJsonFormat adl_serializer<PathInfoJsonFormat>::from_json(const json & json)
+nix::PathInfoJsonFormat adl_serializer<nix::PathInfoJsonFormat>::from_json(const json & json)
 {
-    return parsePathInfoJsonFormat(getUnsigned(json));
+    return nix::parsePathInfoJsonFormat(nix::getUnsigned(json));
 }
 
-void adl_serializer<PathInfoJsonFormat>::to_json(json & json, const PathInfoJsonFormat & format)
+void adl_serializer<nix::PathInfoJsonFormat>::to_json(json & json, const nix::PathInfoJsonFormat & format)
 {
     json = static_cast<int>(format);
 }
 
-UnkeyedValidPathInfo adl_serializer<UnkeyedValidPathInfo>::from_json(const json & json)
+nix::UnkeyedValidPathInfo adl_serializer<nix::UnkeyedValidPathInfo>::from_json(const json & json)
 {
-    return UnkeyedValidPathInfo::fromJSON(nullptr, json);
+    return nix::UnkeyedValidPathInfo::fromJSON(nullptr, json);
 }
 
-void adl_serializer<UnkeyedValidPathInfo>::to_json(json & json, const UnkeyedValidPathInfo & c)
+void adl_serializer<nix::UnkeyedValidPathInfo>::to_json(json & json, const nix::UnkeyedValidPathInfo & c)
 {
-    json = c.toJSON(nullptr, true, PathInfoJsonFormat::V3);
+    json = c.toJSON(nullptr, true, nix::PathInfoJsonFormat::V3);
 }
 
-ValidPathInfo adl_serializer<ValidPathInfo>::from_json(const json & json0)
+nix::ValidPathInfo adl_serializer<nix::ValidPathInfo>::from_json(const json & json0)
 {
+    using namespace nix;
     auto json = getObject(json0);
 
     return ValidPathInfo{
@@ -334,8 +337,9 @@ ValidPathInfo adl_serializer<ValidPathInfo>::from_json(const json & json0)
     };
 }
 
-void adl_serializer<ValidPathInfo>::to_json(json & json, const ValidPathInfo & v)
+void adl_serializer<nix::ValidPathInfo>::to_json(json & json, const nix::ValidPathInfo & v)
 {
+    using namespace nix;
     adl_serializer<UnkeyedValidPathInfo>::to_json(json, v);
     json["path"] = v.path;
 }
diff --git a/src/libstore/path-references.cc b/src/libstore/path-references.cc
index 78b64a210176..20fd1e935228 100644
--- a/src/libstore/path-references.cc
+++ b/src/libstore/path-references.cc
@@ -9,6 +9,8 @@
 
 namespace nix {
 
+void PathRefScanSink::anchor() {}
+
 PathRefScanSink::PathRefScanSink(StringSet && hashes, std::map<std::string, StorePath> && backMap)
     : RefScanSink(std::move(hashes))
     , backMap(std::move(backMap))
diff --git a/src/libstore/path.cc b/src/libstore/path.cc
index fa430ce94d7a..a3e1597b686c 100644
--- a/src/libstore/path.cc
+++ b/src/libstore/path.cc
@@ -5,6 +5,10 @@
 
 namespace nix {
 
+void BadStorePathName::anchor() {}
+
+void BadStorePath::anchor() {}
+
 void checkName(std::string_view name)
 {
     if (name.empty())
@@ -81,14 +85,12 @@ StorePath StorePath::random(std::string_view name)
 
 namespace nlohmann {
 
-using namespace nix;
-
-StorePath adl_serializer<StorePath>::from_json(const json & json)
+nix::StorePath adl_serializer<nix::StorePath>::from_json(const json & json)
 {
-    return StorePath{getString(json)};
+    return nix::StorePath{nix::getString(json)};
 }
 
-void adl_serializer<StorePath>::to_json(json & json, const StorePath & storePath)
+void adl_serializer<nix::StorePath>::to_json(json & json, const nix::StorePath & storePath)
 {
     json = storePath.to_string();
 }
diff --git a/src/libstore/profiles.cc b/src/libstore/profiles.cc
index 519c2abc9805..d015548e5e65 100644
--- a/src/libstore/profiles.cc
+++ b/src/libstore/profiles.cc
@@ -95,19 +95,10 @@ std::filesystem::path createGeneration(LocalFSStore & store, std::filesystem::pa
     return generation;
 }
 
-static void removeFile(const std::filesystem::path & path)
-{
-    try {
-        std::filesystem::remove(path);
-    } catch (std::filesystem::filesystem_error & e) {
-        throw SystemError(e.code(), "removing file %1%", PathFmt(path));
-    }
-}
-
 void deleteGeneration(const std::filesystem::path & profile, GenerationNumber gen)
 {
     std::filesystem::path generation = makeName(profile, gen);
-    removeFile(generation);
+    unlinkIfExists(generation);
 }
 
 /**
diff --git a/src/libstore/realisation.cc b/src/libstore/realisation.cc
index 121346b9b609..36de83a9bf82 100644
--- a/src/libstore/realisation.cc
+++ b/src/libstore/realisation.cc
@@ -8,6 +8,10 @@ namespace nix {
 
 MakeError(InvalidDerivationOutputId, Error);
 
+void InvalidDerivationOutputId::anchor() {}
+
+void MissingRealisation::anchor() {}
+
 DrvOutput DrvOutput::parse(const StoreDirConfig & store, std::string_view s)
 {
     size_t n = s.rfind('^');
@@ -93,10 +97,9 @@ MissingRealisation::MissingRealisation(
 
 namespace nlohmann {
 
-using namespace nix;
-
-DrvOutput adl_serializer<DrvOutput>::from_json(const json & json)
+nix::DrvOutput adl_serializer<nix::DrvOutput>::from_json(const json & json)
 {
+    using namespace nix;
     auto obj = getObject(json);
 
     return {
@@ -105,7 +108,7 @@ DrvOutput adl_serializer<DrvOutput>::from_json(const json & json)
     };
 }
 
-void adl_serializer<DrvOutput>::to_json(json & json, const DrvOutput & drvOutput)
+void adl_serializer<nix::DrvOutput>::to_json(json & json, const nix::DrvOutput & drvOutput)
 {
     json = {
         {"drvPath", drvOutput.drvPath},
@@ -113,8 +116,9 @@ void adl_serializer<DrvOutput>::to_json(json & json, const DrvOutput & drvOutput
     };
 }
 
-UnkeyedRealisation adl_serializer<UnkeyedRealisation>::from_json(const json & json0)
+nix::UnkeyedRealisation adl_serializer<nix::UnkeyedRealisation>::from_json(const json & json0)
 {
+    using namespace nix;
     auto json = getObject(json0);
 
     return UnkeyedRealisation{
@@ -127,7 +131,7 @@ UnkeyedRealisation adl_serializer<UnkeyedRealisation>::from_json(const json & js
     };
 }
 
-void adl_serializer<UnkeyedRealisation>::to_json(json & json, const UnkeyedRealisation & r)
+void adl_serializer<nix::UnkeyedRealisation>::to_json(json & json, const nix::UnkeyedRealisation & r)
 {
     json = {
         {"outPath", r.outPath},
@@ -135,8 +139,9 @@ void adl_serializer<UnkeyedRealisation>::to_json(json & json, const UnkeyedReali
     };
 }
 
-Realisation adl_serializer<Realisation>::from_json(const json & json)
+nix::Realisation adl_serializer<nix::Realisation>::from_json(const json & json)
 {
+    using namespace nix;
     auto obj = getObject(json);
 
     return {
@@ -145,11 +150,11 @@ Realisation adl_serializer<Realisation>::from_json(const json & json)
     };
 }
 
-void adl_serializer<Realisation>::to_json(json & json, const Realisation & r)
+void adl_serializer<nix::Realisation>::to_json(json & json, const nix::Realisation & r)
 {
     json = {
         {"key", r.id},
-        {"value", static_cast<const UnkeyedRealisation &>(r)},
+        {"value", static_cast<const nix::UnkeyedRealisation &>(r)},
     };
 }
 
diff --git a/src/libstore/references.cc b/src/libstore/references.cc
index 4bc15a71de9d..f73b4d3062aa 100644
--- a/src/libstore/references.cc
+++ b/src/libstore/references.cc
@@ -8,6 +8,12 @@
 
 namespace nix {
 
+void RefScanSink::anchor() {}
+
+void HashModuloSink::anchor() {}
+
+void RewritingSink::anchor() {}
+
 static constexpr auto refLength = StorePath::HashLen;
 
 static void search(std::string_view s, StringSet & hashes, StringSet & seen)
@@ -72,7 +78,7 @@ void RewritingSink::operator()(std::string_view data)
     std::string s(prev);
     s.append(data);
 
-    s = rewriteStrings(s, rewrites);
+    s = rewriteStrings(s, rewrites, &matches, pos);
 
     prev = s.size() < maxRewriteSize ? s
            : maxRewriteSize == 0     ? ""
@@ -97,6 +103,7 @@ void RewritingSink::flush()
 
 HashModuloSink::HashModuloSink(HashAlgorithm ha, const std::string & modulus)
     : hashSink(ha)
+    // Zero out self-references (the "modulus").
     , rewritingSink(modulus, std::string(modulus.size(), 0), hashSink)
 {
 }
diff --git a/src/libstore/remote-fs-accessor.cc b/src/libstore/remote-fs-accessor.cc
index 31356a506a09..acf6a4680de4 100644
--- a/src/libstore/remote-fs-accessor.cc
+++ b/src/libstore/remote-fs-accessor.cc
@@ -2,6 +2,8 @@
 
 namespace nix {
 
+void RemoteFSAccessor::anchor() {}
+
 RemoteFSAccessor::RemoteFSAccessor(ref<Store> store, bool requireValidPath, std::optional<AbsolutePath> cacheDir)
     : store(store)
     , narCache(cacheDir)
@@ -37,6 +39,8 @@ std::optional<SourceAccessor::Stat> RemoteFSAccessor::maybeLstat(const CanonPath
 {
     if (path.isRoot())
         return Stat{.type = tDirectory};
+    /* FIXME: Correctly handle invalid names (return nullopt) and don't fail on
+       non-existent paths. */
     auto res = fetch(path);
     return res.first->maybeLstat(res.second);
 }
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index 2def1bf87aa7..e94ff774a63a 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -1,5 +1,8 @@
+#include "nix/store/build.hh"
 #include "nix/store/path.hh"
 #include "nix/store/store-api.hh"
+#include "nix/util/file-content-address.hh"
+#include "nix/store/store-open.hh"
 #include "nix/util/serialise.hh"
 #include "nix/util/util.hh"
 #include "nix/store/path-with-outputs.hh"
@@ -30,6 +33,8 @@
 
 namespace nix {
 
+void RemoteStoreConfig::anchor() {}
+
 /* TODO: Separate these store types into different files, give them better names */
 RemoteStore::RemoteStore(const Config & config)
     : Store{config}
@@ -59,6 +64,8 @@ RemoteStore::RemoteStore(const Config & config)
 {
 }
 
+void RemoteStore::anchor() {}
+
 ref<RemoteStore::Connection> RemoteStore::openConnectionWrapper()
 {
     if (failed) {
@@ -85,7 +92,15 @@ void RemoteStore::initConnection(Connection & conn)
         StringSink saved;
         TeeSource tee(conn.from, saved);
         try {
-            conn.protoVersion = WorkerProto::BasicClientConnection::handshake(conn.to, tee, WorkerProto::latest);
+            // The following features aren't in the `latest` constant because it is
+            // shared with the daemon, which only adds the features under certain conditions.
+            // Adding is easier than removing.
+            auto localVersion = WorkerProto::latest;
+            localVersion.features.insert(std::string{WorkerProto::featureDisableSetOptions});
+            localVersion.features.insert(std::string{WorkerProto::featureAddToStoreScanning});
+            localVersion.features.insert(std::string{WorkerProto::featureSubmitOutput});
+
+            conn.protoVersion = WorkerProto::BasicClientConnection::handshake(conn.to, tee, localVersion);
             if (conn.protoVersion.number < WorkerProto::minimum.number)
                 throw Error("the Nix daemon version is too old");
         } catch (SerialisationError & e) {
@@ -111,7 +126,8 @@ void RemoteStore::initConnection(Connection & conn)
         throw Error("cannot open connection to remote store '%s': %s", config.getHumanReadableURI(), e.what());
     }
 
-    setOptions(conn);
+    if (!conn.protoVersion.features.contains(WorkerProto::featureDisableSetOptions))
+        setOptions(conn);
 }
 
 void RemoteStore::setOptions(Connection & conn)
@@ -412,22 +428,7 @@ StorePath RemoteStore::addToStoreFromDump(
     const StorePathSet & references,
     RepairFlag repair)
 {
-    FileSerialisationMethod fsm;
-    switch (hashMethod.getFileIngestionMethod()) {
-    case FileIngestionMethod::Flat:
-        fsm = FileSerialisationMethod::Flat;
-        break;
-    case FileIngestionMethod::NixArchive:
-        fsm = FileSerialisationMethod::NixArchive;
-        break;
-    case FileIngestionMethod::Git:
-        // Use NAR; Git is not a serialization method
-        fsm = FileSerialisationMethod::NixArchive;
-        break;
-    default:
-        assert(false);
-    }
-    if (fsm != dumpMethod)
+    if (hashMethod.getFileSerialisationMethod() != dumpMethod)
         unsupported("RemoteStore::addToStoreFromDump doesn't support this `dumpMethod` `hashMethod` combination");
     auto storePath = addCAToStore(dump, name, hashMethod, hashAlgo, references, repair)->path;
     invalidatePathInfoCacheFor(storePath);
@@ -460,7 +461,7 @@ void RemoteStore::addToStore(const ValidPathInfo & info, Source & source, Repair
 void RemoteStore::addMultipleToStore(
     PathsSource && pathsToCopy, Activity & act, RepairFlag repair, CheckSigsFlag checkSigs)
 {
-    if (getConnection()->protoVersion < WorkerProto::Version{.number = {1, 32}}) {
+    if (getConnection()->protoVersion.number < WorkerProto::Version::Number{1, 32}) {
         Store::addMultipleToStore(std::move(pathsToCopy), act, repair, checkSigs);
         return;
     }
@@ -507,6 +508,46 @@ void RemoteStore::registerDrvOutput(const Realisation & info)
     conn.processStderr();
 }
 
+void RemoteStore::submitOutput(const SingleDerivedPath & path, const OutputName & output)
+{
+    auto conn(getConnection());
+    if (!conn->protoVersion.features.contains(WorkerProto::featureSubmitOutput))
+        throw Error(
+            "the daemon does not support SubmitOutput, perhaps this is not in a derivation with the `builder-rpc-v0` feature?");
+
+    conn->to << WorkerProto::Op::SubmitOutput;
+    WorkerProto::Serialise<SingleDerivedPath>::write(*this, *conn, path);
+    conn->to << output;
+    conn.processStderr();
+    readInt(conn->from);
+}
+
+ref<const ValidPathInfo> RemoteStore::addToStoreScanning(
+    Source & dump,
+    std::string_view name,
+    FileSerialisationMethod dumpMethod,
+    ContentAddressMethod hashMethod,
+    HashAlgorithm hashAlgo)
+{
+    if (hashMethod.getFileSerialisationMethod() != dumpMethod)
+        unsupported("RemoteStore::addToStoreScanning doesn't support this `dumpMethod` `hashMethod` combination");
+
+    auto conn(getConnection());
+    if (!conn->protoVersion.features.contains(WorkerProto::featureAddToStoreScanning))
+        throw Error("the daemon does not support AddToStoreScanning, perhaps this is not in a recursive-nix builder?");
+
+    conn->to << WorkerProto::Op::AddToStoreScanning << name << hashMethod.renderWithAlgo(hashAlgo);
+
+    // The dump source may invoke the store, so we need to make some room.
+    connections->incCapacity();
+    {
+        Finally cleanup([&]() { connections->decCapacity(); });
+        conn.withFramedSink([&](Sink & sink) { dump.drainInto(sink); });
+    }
+
+    return make_ref<ValidPathInfo>(WorkerProto::Serialise<ValidPathInfo>::read(*this, *conn));
+}
+
 void RemoteStore::queryRealisationUncached(
     const DrvOutput & id, Callback<std::shared_ptr<const UnkeyedRealisation>> callback) noexcept
 {
@@ -535,60 +576,104 @@ void RemoteStore::queryRealisationUncached(
     }
 }
 
-void RemoteStore::copyDrvsFromEvalStore(const std::vector<DerivedPath> & paths, std::shared_ptr<Store> evalStore)
+struct RemoteBuilder : Builder
+{
+    ref<RemoteStore> store;
+    std::shared_ptr<Store> evalStore;
+
+    RemoteBuilder(ref<RemoteStore> store, std::shared_ptr<Store> evalStore)
+        : store(store)
+        , evalStore(std::move(evalStore))
+    {
+    }
+
+private:
+
+    void copyDrvsFromEvalStore(const std::vector<DerivedPath> & paths);
+
+public:
+
+    void buildPaths(const std::vector<DerivedPath> & drvPaths, BuildMode buildMode) override;
+
+    std::vector<KeyedBuildResult>
+    buildPathsWithResults(const std::vector<DerivedPath> & paths, BuildMode buildMode) override;
+
+    BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode) override;
+
+    BuildResult buildDerivation(
+        const StorePath & drvPath,
+        const BasicDerivation & drv,
+        const StorePathSet & inputs,
+        BuildMode buildMode) override;
+
+    std::vector<KeyedBuildResult> buildPathsWithResults(
+        const std::vector<DerivedPath> & reqs, const StorePathSet & inputs, BuildMode buildMode) override;
+
+    void ensurePath(const StorePath & path) override;
+
+    /**
+     * The default instance would schedule the work on the client side, but
+     * for consistency with `buildPaths` and `buildDerivation` it should happen
+     * on the remote side.
+     *
+     * We make this fail for now so we can add implement this properly later
+     * without it being a breaking change.
+     */
+    void repairPath(const StorePath & path) override;
+};
+
+void RemoteBuilder::copyDrvsFromEvalStore(const std::vector<DerivedPath> & paths)
 {
-    if (evalStore && evalStore.get() != this) {
+    if (evalStore && evalStore.get() != &*store) {
         /* The remote doesn't have a way to access evalStore, so copy
            the .drvs. */
-        RealisedPath::Set drvPaths2;
+        RealisedPath::Set drvPaths;
         for (const auto & i : paths) {
             std::visit(
                 overloaded{
                     [&](const DerivedPath::Opaque & bp) {
                         // Do nothing, path is hopefully there already
                     },
-                    [&](const DerivedPath::Built & bp) { drvPaths2.insert(bp.drvPath->getBaseStorePath()); },
+                    [&](const DerivedPath::Built & bp) { drvPaths.insert(bp.drvPath->getBaseStorePath()); },
                 },
                 i.raw());
         }
-        copyClosure(*evalStore, *this, drvPaths2);
+        copyClosure(*evalStore, *store, drvPaths);
     }
 }
 
-void RemoteStore::buildPaths(
-    const std::vector<DerivedPath> & drvPaths, BuildMode buildMode, std::shared_ptr<Store> evalStore)
+void RemoteBuilder::buildPaths(const std::vector<DerivedPath> & drvPaths, BuildMode buildMode)
 {
-    copyDrvsFromEvalStore(drvPaths, evalStore);
-
-    auto conn(getConnection());
+    copyDrvsFromEvalStore(drvPaths);
+    auto conn(store->getConnection());
     conn->to << WorkerProto::Op::BuildPaths;
-    WorkerProto::write(*this, *conn, drvPaths);
+    WorkerProto::write(*store, *conn, drvPaths);
     conn->to << buildMode;
     conn.processStderr();
     readInt(conn->from);
 }
 
-std::vector<KeyedBuildResult> RemoteStore::buildPathsWithResults(
-    const std::vector<DerivedPath> & paths, BuildMode buildMode, std::shared_ptr<Store> evalStore)
+std::vector<KeyedBuildResult>
+RemoteBuilder::buildPathsWithResults(const std::vector<DerivedPath> & paths, BuildMode buildMode)
 {
-    copyDrvsFromEvalStore(paths, evalStore);
+    copyDrvsFromEvalStore(paths);
 
-    std::optional<ConnectionHandle> conn_(getConnection());
+    std::optional<RemoteStore::ConnectionHandle> conn_(store->getConnection());
     auto & conn = *conn_;
 
     if (conn->protoVersion >= WorkerProto::Version{.number = {1, 34}}) {
         conn->to << WorkerProto::Op::BuildPathsWithResults;
-        WorkerProto::write(*this, *conn, paths);
+        WorkerProto::write(*store, *conn, paths);
         conn->to << buildMode;
         conn.processStderr();
-        return WorkerProto::Serialise<std::vector<KeyedBuildResult>>::read(*this, *conn);
+        return WorkerProto::Serialise<std::vector<KeyedBuildResult>>::read(*store, *conn);
     } else {
         // Avoid deadlock.
         conn_.reset();
 
         // Note: this throws an exception if a build/substitution
         // fails, but meh.
-        buildPaths(paths, buildMode, evalStore);
+        buildPaths(paths, buildMode);
 
         std::vector<KeyedBuildResult> results;
 
@@ -610,14 +695,14 @@ std::vector<KeyedBuildResult> RemoteStore::buildPathsWithResults(
                         };
 
                         OutputPathMap outputs;
-                        auto drvPath = resolveDerivedPath(*evalStore, *bfd.drvPath);
-                        auto built = resolveDerivedPath(*this, bfd, &*evalStore);
+                        auto drvPath = resolveDerivedPath(*store, *bfd.drvPath);
+                        auto built = resolveDerivedPath(*store, bfd);
                         for (auto & [output, outputPath] : built) {
                             auto outputId = DrvOutput{drvPath, output};
                             if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations)) {
-                                auto realisation = queryRealisation(outputId);
+                                auto realisation = store->queryRealisation(outputId);
                                 if (!realisation)
-                                    throw MissingRealisation(*this, outputId);
+                                    throw MissingRealisation(*store, outputId);
                                 success.builtOutputs.emplace(output, *realisation);
                             } else {
                                 success.builtOutputs.emplace(
@@ -641,23 +726,52 @@ std::vector<KeyedBuildResult> RemoteStore::buildPathsWithResults(
     }
 }
 
-BuildResult RemoteStore::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode)
+BuildResult RemoteBuilder::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode)
 {
-    auto conn(getConnection());
-    conn->putBuildDerivationRequest(*this, &conn.daemonException, drvPath, drv, buildMode);
+    auto conn(store->getConnection());
+    conn->putBuildDerivationRequest(*store, &conn.daemonException, drvPath, drv, buildMode);
     conn.processStderr();
-    return WorkerProto::Serialise<BuildResult>::read(*this, *conn);
+    return WorkerProto::Serialise<BuildResult>::read(*store, *conn);
 }
 
-void RemoteStore::ensurePath(const StorePath & path)
+BuildResult RemoteBuilder::buildDerivation(
+    const StorePath & drvPath, const BasicDerivation & drv, const StorePathSet & inputs, BuildMode buildMode)
 {
-    auto conn(getConnection());
+    auto substitute = settings.getWorkerSettings().buildersUseSubstitutes ? Substitute : NoSubstitute;
+    auto srcStore = openStore();
+    copyPaths(*srcStore, *store, inputs, NoRepair, NoCheckSigs, substitute);
+    return buildDerivation(drvPath, drv, buildMode);
+}
+
+std::vector<KeyedBuildResult> RemoteBuilder::buildPathsWithResults(
+    const std::vector<DerivedPath> & reqs, const StorePathSet & inputs, BuildMode buildMode)
+{
+    auto substitute = settings.getWorkerSettings().buildersUseSubstitutes ? Substitute : NoSubstitute;
+    auto srcStore = openStore();
+    copyPaths(*srcStore, *store, inputs, NoRepair, NoCheckSigs, substitute);
+    return buildPathsWithResults(reqs, buildMode);
+}
+
+void RemoteBuilder::ensurePath(const StorePath & path)
+{
+    auto conn(store->getConnection());
     conn->to << WorkerProto::Op::EnsurePath;
-    WorkerProto::write(*this, *conn, path);
+    WorkerProto::write(*store, *conn, path);
     conn.processStderr();
     readInt(conn->from);
 }
 
+void RemoteBuilder::repairPath(const StorePath & path)
+{
+    throw Unsupported("operation 'repairPath' is not supported by store '%s'", store->config.getHumanReadableURI());
+}
+
+ref<Builder> RemoteStore::getBuilder(std::shared_ptr<Store> evalStore)
+{
+    return make_ref<RemoteBuilder>(
+        ref<RemoteStore>(std::dynamic_pointer_cast<RemoteStore>(shared_from_this())), std::move(evalStore));
+}
+
 void RemoteStore::addTempRoot(const StorePath & path)
 {
     auto conn(getConnection());
@@ -682,18 +796,23 @@ void RemoteStore::collectGarbage(const GCOptions & options, GCResults & results)
 {
     auto conn(getConnection());
 
-    if (conn->protoVersion.features.contains(WorkerProto::featureDeleteDeadSpecific)) {
+    bool supportsDeleteSpecificReferrers =
+        conn->protoVersion.features.contains(WorkerProto::featureDeleteDeadSpecificReferrers);
+
+    if (supportsDeleteSpecificReferrers) {
         conn->to << WorkerProto::Op::CollectGarbage;
         WorkerProto::write(*this, *conn, options.action);
         WorkerProto::write(*this, *conn, options.pathsToDelete);
     } else {
         auto paths = std::visit(
             overloaded{
-                [&](const StorePathSet & paths) {
+                [&](const GCOptions::SpecificPaths & paths) {
                     if (options.action != GCOptions::gcDeleteSpecific)
                         throw Error(
                             "Your daemon version is too old to support garbage collecting a specific set of paths");
-                    return paths;
+                    if (paths.deleteReferrers)
+                        throw Error("Your daemon version is too old to support deleting referrers.");
+                    return paths.paths;
                 },
                 [](const GCOptions::WholeStore & _) { return StorePathSet{}; },
             },
@@ -702,6 +821,7 @@ void RemoteStore::collectGarbage(const GCOptions & options, GCResults & results)
         WorkerProto::write(*this, *conn, options.action);
         WorkerProto::write(*this, *conn, paths);
     }
+
     conn->to << options.ignoreLiveness
              << options.maxFreed
              /* removed options */
diff --git a/src/libstore/restricted-store.cc b/src/libstore/restricted-store.cc
index 8001d43ec8d8..53ab790d9499 100644
--- a/src/libstore/restricted-store.cc
+++ b/src/libstore/restricted-store.cc
@@ -1,8 +1,13 @@
 #include "nix/store/restricted-store.hh"
+#include "nix/store/build.hh"
 #include "nix/store/build-result.hh"
+#include "nix/store/submit-store.hh"
+#include "nix/store/build/worker.hh"
 #include "nix/util/callback.hh"
 #include "nix/store/realisation.hh"
 #include "nix/store/local-store.hh"
+#include "nix/util/error.hh"
+#include "nix/util/repair-flag.hh"
 
 namespace nix {
 
@@ -26,6 +31,8 @@ static StorePath pathPartOfReq(const DerivedPath & req)
         req.raw());
 }
 
+void RestrictionContext::anchor() {}
+
 bool RestrictionContext::isAllowed(const DerivedPath & req)
 {
     return isAllowed(pathPartOfReq(req));
@@ -36,8 +43,12 @@ bool RestrictionContext::isAllowed(const DerivedPath & req)
  * paths that are in the input closures of the build or were added via
  * recursive Nix calls.
  */
-struct RestrictedStore : public virtual IndirectRootStore, public virtual GcStore
+struct RestrictedStore : public virtual IndirectRootStore, public virtual GcStore, public virtual SubmitStore
 {
+private:
+    void anchor() override;
+
+public:
     ref<const LocalStore::Config> config;
 
     ref<LocalStore> next;
@@ -102,26 +113,19 @@ struct RestrictedStore : public virtual IndirectRootStore, public virtual GcStor
 
     void narFromPath(const StorePath & path, Sink & sink) override;
 
-    void ensurePath(const StorePath & path) override;
-
     void registerDrvOutput(const Realisation & info) override;
 
-    void queryRealisationUncached(
-        const DrvOutput & id, Callback<std::shared_ptr<const UnkeyedRealisation>> callback) noexcept override;
-
-    void
-    buildPaths(const std::vector<DerivedPath> & paths, BuildMode buildMode, std::shared_ptr<Store> evalStore) override;
+    void submitOutput(const SingleDerivedPath & path, const OutputName & output) override;
 
-    std::vector<KeyedBuildResult> buildPathsWithResults(
-        const std::vector<DerivedPath> & paths,
-        BuildMode buildMode = bmNormal,
-        std::shared_ptr<Store> evalStore = nullptr) override;
+    ref<const ValidPathInfo> addToStoreScanning(
+        Source & dump,
+        std::string_view name,
+        FileSerialisationMethod dumpMethod,
+        ContentAddressMethod hashMethod,
+        HashAlgorithm hashAlgo) override;
 
-    BuildResult
-    buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode = bmNormal) override
-    {
-        unsupported("buildDerivation");
-    }
+    void queryRealisationUncached(
+        const DrvOutput & id, Callback<std::shared_ptr<const UnkeyedRealisation>> callback) noexcept override;
 
     void addTempRoot(const StorePath & path) override {}
 
@@ -134,6 +138,8 @@ struct RestrictedStore : public virtual IndirectRootStore, public virtual GcStor
 
     void collectGarbage(const GCOptions & options, GCResults & results) override {}
 
+    void deleteBuildTraces(const std::set<DrvOutput> & keys) override {}
+
     void addSignatures(const StorePath & storePath, const std::set<Signature> & sigs) override
     {
         unsupported("addSignatures");
@@ -155,6 +161,49 @@ struct RestrictedStore : public virtual IndirectRootStore, public virtual GcStor
     {
         return NotTrusted;
     }
+
+    ref<Builder> getBuilder(std::shared_ptr<Store> evalStore) override
+    {
+        unreachable();
+    }
+};
+
+void RestrictedStore::anchor() {}
+
+/**
+ * A builder that wraps an inner builder, adding restriction checks
+ * and dependency tracking for recursive Nix builds.
+ */
+struct RestrictedBuilder : Builder
+{
+    Worker & inner;
+    RestrictionContext & goal;
+
+    RestrictedBuilder(Worker & inner, RestrictionContext & goal)
+        : inner(inner)
+        , goal(goal)
+    {
+    }
+
+    void buildPaths(const std::vector<DerivedPath> & paths, BuildMode buildMode) override;
+
+    std::vector<KeyedBuildResult>
+    buildPathsWithResults(const std::vector<DerivedPath> & paths, BuildMode buildMode) override;
+
+    BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode) override;
+
+    BuildResult buildDerivation(
+        const StorePath & drvPath,
+        const BasicDerivation & drv,
+        const StorePathSet & inputs,
+        BuildMode buildMode) override;
+
+    std::vector<KeyedBuildResult> buildPathsWithResults(
+        const std::vector<DerivedPath> & reqs, const StorePathSet & inputs, BuildMode buildMode) override;
+
+    void ensurePath(const StorePath & path) override;
+
+    void repairPath(const StorePath & path) override;
 };
 
 ref<Store> makeRestrictedStore(ref<LocalStore::Config> config, ref<LocalStore> next, RestrictionContext & context)
@@ -167,8 +216,11 @@ StorePathSet RestrictedStore::queryAllValidPaths()
     StorePathSet paths;
     for (auto & p : goal.originalPaths())
         paths.insert(p);
-    for (auto & p : goal.addedPaths)
-        paths.insert(p);
+    for (auto & [p, future] : goal.state_.lock()->addedPaths) {
+        /* Only report the paths that have finished materialising in the sandbox. */
+        if (future.wait_for(std::chrono::seconds(0)) == std::future_status::ready)
+            paths.insert(p);
+    }
     return paths;
 }
 
@@ -229,10 +281,10 @@ void RestrictedStore::narFromPath(const StorePath & path, Sink & sink)
     Store::narFromPath(path, sink);
 }
 
-void RestrictedStore::ensurePath(const StorePath & path)
+void RestrictedBuilder::ensurePath(const StorePath & path)
 {
     if (!goal.isAllowed(path))
-        throw InvalidPath("cannot substitute unknown path '%s' in recursive Nix", printStorePath(path));
+        throw InvalidPath("cannot substitute unknown path '%s' in recursive Nix", inner.store.printStorePath(path));
     /* Nothing to be done; 'path' must already be valid. */
 }
 
@@ -243,46 +295,63 @@ void RestrictedStore::registerDrvOutput(const Realisation & info)
     throw Error("registerDrvOutput");
 }
 
+void RestrictedStore::submitOutput(const SingleDerivedPath & path, const OutputName & output)
+{
+    goal.submitOutput(path, output);
+}
+
+ref<const ValidPathInfo> RestrictedStore::addToStoreScanning(
+    Source & dump,
+    std::string_view name,
+    FileSerialisationMethod dumpMethod,
+    ContentAddressMethod hashMethod,
+    HashAlgorithm hashAlgo)
+{
+    auto path = next->addToStoreFromDump(
+        dump, name, dumpMethod, hashMethod, hashAlgo, queryAllValidPaths(), RepairFlag::NoRepair, true);
+    goal.addDependency(path);
+    return queryPathInfo(path);
+}
+
 void RestrictedStore::queryRealisationUncached(
     const DrvOutput & id, Callback<std::shared_ptr<const UnkeyedRealisation>> callback) noexcept
 // XXX: This should probably be allowed if the realisation corresponds to
 // an allowed derivation
 {
-    if (!goal.isAllowed(id))
+    if (!goal.isAllowed(id)) {
         callback(nullptr);
+        return;
+    }
     next->queryRealisation(id, std::move(callback));
 }
 
-void RestrictedStore::buildPaths(
-    const std::vector<DerivedPath> & paths, BuildMode buildMode, std::shared_ptr<Store> evalStore)
+void RestrictedBuilder::buildPaths(const std::vector<DerivedPath> & paths, BuildMode buildMode)
 {
-    for (auto & result : buildPathsWithResults(paths, buildMode, evalStore))
+    for (auto & result : buildPathsWithResults(paths, buildMode))
         result.tryThrowBuildError();
 }
 
-std::vector<KeyedBuildResult> RestrictedStore::buildPathsWithResults(
-    const std::vector<DerivedPath> & paths, BuildMode buildMode, std::shared_ptr<Store> evalStore)
+std::vector<KeyedBuildResult>
+RestrictedBuilder::buildPathsWithResults(const std::vector<DerivedPath> & paths, BuildMode buildMode)
 {
-    assert(!evalStore);
-
     if (buildMode != bmNormal)
         throw Error("unsupported build mode");
 
-    StorePathSet newPaths;
-    std::set<Realisation> newRealisations;
-
     for (auto & req : paths) {
         if (!goal.isAllowed(req))
-            throw InvalidPath("cannot build '%s' in recursive Nix because path is unknown", req.to_string(*next));
+            throw InvalidPath("cannot build '%s' in recursive Nix because path is unknown", req.to_string(inner.store));
     }
 
-    auto results = next->buildPathsWithResults(paths, buildMode);
+    auto results = inner.buildPathsWithResults(paths, buildMode);
+
+    StorePathSet newPaths;
+    std::set<Realisation> newRealisations;
 
     for (auto & result : results) {
         if (auto * successP = result.tryGetSuccess()) {
-            if (auto * pathBuilt = std::get_if<DerivedPathBuilt>(&result.path)) {
+            if (auto * pathBuilt = std::get_if<DerivedPath::Built>(&result.path)) {
                 // TODO ugly extra IO
-                auto drvPath = resolveDerivedPath(*next, *pathBuilt->drvPath);
+                auto drvPath = resolveDerivedPath(inner.store, *pathBuilt->drvPath);
                 for (auto & [outputName, output] : successP->builtOutputs) {
                     newPaths.insert(output.outPath);
                     newRealisations.insert(
@@ -297,11 +366,15 @@ std::vector<KeyedBuildResult> RestrictedStore::buildPathsWithResults(
     }
 
     StorePathSet closure;
-    next->computeFSClosure(newPaths, closure);
+    inner.store.computeFSClosure(newPaths, closure);
     for (auto & path : closure)
         goal.addDependency(path);
-    for (auto & real : newRealisations)
-        goal.addedDrvOutputs.insert(real.id);
+
+    {
+        auto state(goal.state_.lock());
+        for (auto & real : newRealisations)
+            state->addedDrvOutputs.insert(real.id);
+    }
 
     return results;
 }
@@ -329,4 +402,32 @@ MissingPaths RestrictedStore::queryMissing(const std::vector<DerivedPath> & targ
     return res;
 }
 
+ref<Builder> makeRestrictedBuilder(Worker & inner, RestrictionContext & context)
+{
+    return make_ref<RestrictedBuilder>(inner, context);
+}
+
+BuildResult
+RestrictedBuilder::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode)
+{
+    throw Unsupported("buildDerivation");
+}
+
+BuildResult RestrictedBuilder::buildDerivation(
+    const StorePath & drvPath, const BasicDerivation & drv, const StorePathSet & inputs, BuildMode buildMode)
+{
+    throw Unsupported("buildDerivation (with inputs)");
+}
+
+std::vector<KeyedBuildResult> RestrictedBuilder::buildPathsWithResults(
+    const std::vector<DerivedPath> & reqs, const StorePathSet & inputs, BuildMode buildMode)
+{
+    throw Unsupported("buildPathsWithResults (with inputs)");
+}
+
+void RestrictedBuilder::repairPath(const StorePath & path)
+{
+    throw Unsupported("repairPath");
+}
+
 } // namespace nix
diff --git a/src/libstore/s3-binary-cache-store.cc b/src/libstore/s3-binary-cache-store.cc
index 733157524176..7910357e0b18 100644
--- a/src/libstore/s3-binary-cache-store.cc
+++ b/src/libstore/s3-binary-cache-store.cc
@@ -17,6 +17,8 @@ namespace nix {
 
 MakeError(UploadToS3, Error);
 
+void UploadToS3::anchor() {}
+
 static constexpr uint64_t AWS_MIN_PART_SIZE = 5 * 1024 * 1024;           // 5MiB
 static constexpr uint64_t AWS_MAX_PART_SIZE = 5ULL * 1024 * 1024 * 1024; // 5GiB
 static constexpr uint64_t AWS_MAX_PART_COUNT = 10000;
@@ -173,7 +175,7 @@ void S3BinaryCacheStore::upsertFile(
     } catch (FileTransferError & e) {
         UploadToS3 err(e.message());
         err.addTrace({}, "while uploading to S3 binary cache at '%s'", config->cacheUri.to_string());
-        throw err;
+        throw std::move(err);
     }
 }
 
@@ -322,7 +324,7 @@ std::string S3BinaryCacheStore::createMultipartUpload(
         std::move(headers->begin(), headers->end(), std::back_inserter(req.headers));
     }
 
-    auto result = getFileTransfer()->enqueueFileTransfer(req).get();
+    auto result = fileTransfer->enqueueFileTransfer(req).get();
 
     std::regex uploadIdRegex("<UploadId>([^<]+)</UploadId>");
     std::smatch match;
@@ -353,7 +355,7 @@ S3BinaryCacheStore::uploadPart(std::string_view key, std::string_view uploadId,
     req.data = {payload};
     req.mimeType = "application/octet-stream";
 
-    auto result = getFileTransfer()->enqueueFileTransfer(req).get();
+    auto result = fileTransfer->enqueueFileTransfer(req).get();
 
     if (result.etag.empty()) {
         throw Error("S3 UploadPart response missing ETag for part %d", partNumber);
@@ -374,7 +376,7 @@ void S3BinaryCacheStore::abortMultipartUpload(std::string_view key, std::string_
         req.uri = VerbatimURL(url);
         req.method = HttpMethod::Delete;
 
-        getFileTransfer()->enqueueFileTransfer(req).get();
+        fileTransfer->enqueueFileTransfer(req).get();
     } catch (...) {
         ignoreExceptionInDestructor();
     }
@@ -407,7 +409,7 @@ void S3BinaryCacheStore::completeMultipartUpload(
     req.data = {payload};
     req.mimeType = "text/xml";
 
-    getFileTransfer()->enqueueFileTransfer(req).get();
+    fileTransfer->enqueueFileTransfer(req).get();
 
     debug("S3 multipart upload completed: %d parts uploaded for '%s'", partEtags.size(), key);
 }
diff --git a/src/libstore/s3-binary-cache-store.md b/src/libstore/s3-binary-cache-store.md
index 0b0c26919298..71cb866d59f2 100644
--- a/src/libstore/s3-binary-cache-store.md
+++ b/src/libstore/s3-binary-cache-store.md
@@ -2,7 +2,7 @@ R"(
 
 **Store URL format**: `s3://`*bucket-name*
 
-This store allows reading and writing a binary cache stored in an AWS S3 (or S3-compatible service) bucket.
+This store allows reading and writing a [binary cache](@docroot@/protocols/binary-cache/index.md) stored in an AWS S3 (or S3-compatible service) bucket.
 This store shares many idioms with the [HTTP Binary Cache Store](@docroot@/store/types/http-binary-cache-store.md).
 
 For AWS S3, the binary cache URL for a bucket named `example-nix-cache` will be exactly <s3://example-nix-cache>.
diff --git a/src/libstore/s3-url.cc b/src/libstore/s3-url.cc
index d1530ceb0daa..38d51ff5ac8b 100644
--- a/src/libstore/s3-url.cc
+++ b/src/libstore/s3-url.cc
@@ -11,10 +11,10 @@
 #include <ranges>
 #include <string_view>
 
-using namespace std::string_view_literals;
-
 namespace nix {
 
+void InvalidS3AddressingStyle::anchor() {}
+
 S3AddressingStyle parseS3AddressingStyle(std::string_view style)
 {
     if (style == "auto")
@@ -41,6 +41,8 @@ std::string_view showS3AddressingStyle(S3AddressingStyle style)
 
 ParsedS3URL ParsedS3URL::parse(const ParsedURL & parsed)
 try {
+    using namespace std::string_view_literals;
+
     if (parsed.scheme != "s3"sv)
         throw BadURL("URI scheme '%s' is not 's3'", parsed.scheme);
 
diff --git a/src/libstore/sqlite.cc b/src/libstore/sqlite.cc
index 3fd1f798ea74..5bd3a4975c72 100644
--- a/src/libstore/sqlite.cc
+++ b/src/libstore/sqlite.cc
@@ -33,6 +33,10 @@ SQLiteError::SQLiteError(
         path ? path : "(in-memory)");
 }
 
+void SQLiteError::anchor() {}
+
+void SQLiteBusy::anchor() {}
+
 [[noreturn]] void SQLiteError::throw_(sqlite3 * db, HintFmt && hf)
 {
     int err = sqlite3_errcode(db);
@@ -47,7 +51,7 @@ SQLiteError::SQLiteError(
         exp.err.msg = HintFmt(
             err == SQLITE_PROTOCOL ? "SQLite database '%s' is busy (SQLITE_PROTOCOL)" : "SQLite database '%s' is busy",
             path ? path : "(in-memory)");
-        throw exp;
+        throw std::move(exp);
     } else
         throw SQLiteError(path, errMsg, err, exterr, offset, std::move(hf));
 }
@@ -174,17 +178,17 @@ SQLiteStmt::Use::~Use()
     sqlite3_reset(stmt);
 }
 
-SQLiteStmt::Use & SQLiteStmt::Use::operator()(std::string_view value, bool notNull)
+SQLiteStmt::Use & SQLiteStmt::Use::apply(std::string_view value, bool notNull)
 {
     if (notNull) {
-        if (sqlite3_bind_text(stmt, curArg++, value.data(), -1, SQLITE_TRANSIENT) != SQLITE_OK)
+        if (sqlite3_bind_text(stmt, curArg++, value.data(), value.size(), SQLITE_TRANSIENT) != SQLITE_OK)
             SQLiteError::throw_(stmt.db, "binding argument");
     } else
         bind();
     return *this;
 }
 
-SQLiteStmt::Use & SQLiteStmt::Use::operator()(const unsigned char * data, size_t len, bool notNull)
+SQLiteStmt::Use & SQLiteStmt::Use::apply(const unsigned char * data, size_t len, bool notNull)
 {
     if (notNull) {
         if (sqlite3_bind_blob(stmt, curArg++, data, len, SQLITE_TRANSIENT) != SQLITE_OK)
@@ -194,7 +198,7 @@ SQLiteStmt::Use & SQLiteStmt::Use::operator()(const unsigned char * data, size_t
     return *this;
 }
 
-SQLiteStmt::Use & SQLiteStmt::Use::operator()(int64_t value, bool notNull)
+SQLiteStmt::Use & SQLiteStmt::Use::apply(int64_t value, bool notNull)
 {
     if (notNull) {
         if (sqlite3_bind_int64(stmt, curArg++, value) != SQLITE_OK)
@@ -235,6 +239,7 @@ bool SQLiteStmt::Use::next()
 std::string SQLiteStmt::Use::getStr(int col)
 {
     auto s = (const char *) sqlite3_column_text(stmt, col);
+    // FIXME: Don't crash on nulls?
     assert(s);
     return s;
 }
diff --git a/src/libstore/ssh-store.cc b/src/libstore/ssh-store.cc
index 945271b1a929..4ecf2780e7b2 100644
--- a/src/libstore/ssh-store.cc
+++ b/src/libstore/ssh-store.cc
@@ -17,6 +17,10 @@ SSHStoreConfig::SSHStoreConfig(const ParsedURL::Authority & authority, const Par
 {
 }
 
+void SSHStoreConfig::anchor() {}
+
+void MountedSSHStoreConfig::anchor() {}
+
 std::string SSHStoreConfig::doc()
 {
     return
@@ -39,6 +43,10 @@ StoreReference SSHStoreConfig::getReference() const
 struct alignas(8) /* Work around ASAN failures on i686-linux. */
     SSHStore : virtual RemoteStore
 {
+private:
+    void anchor() override;
+
+public:
     using Config = SSHStoreConfig;
 
     ref<const Config> config;
@@ -63,6 +71,10 @@ struct alignas(8) /* Work around ASAN failures on i686-linux. */
 
     struct Connection : RemoteStore::Connection
     {
+    private:
+        void anchor() override;
+
+    public:
         std::unique_ptr<SSHMaster::Connection> sshConn;
 
         void closeWrite() override
@@ -87,6 +99,12 @@ struct alignas(8) /* Work around ASAN failures on i686-linux. */
     };
 };
 
+void RemoteStore::Connection::anchor() {}
+
+void SSHStore::Connection::anchor() {}
+
+void SSHStore::anchor() {}
+
 MountedSSHStoreConfig::MountedSSHStoreConfig(StringMap params)
     : StoreConfig(params, FilePathType::Native)
     , RemoteStoreConfig(params, FilePathType::Native)
@@ -128,6 +146,10 @@ std::string MountedSSHStoreConfig::doc()
  */
 struct MountedSSHStore : virtual SSHStore, virtual LocalFSStore
 {
+private:
+    void anchor() override;
+
+public:
     using Config = MountedSSHStoreConfig;
 
     MountedSSHStore(ref<const Config> config)
@@ -187,6 +209,8 @@ struct MountedSSHStore : virtual SSHStore, virtual LocalFSStore
     }
 };
 
+void MountedSSHStore::anchor() {}
+
 ref<Store> SSHStore::Config::openStore() const
 {
     return make_ref<SSHStore>(ref{shared_from_this()});
diff --git a/src/libstore/ssh.cc b/src/libstore/ssh.cc
index 30ed7397cba7..3cd3e82a23f4 100644
--- a/src/libstore/ssh.cc
+++ b/src/libstore/ssh.cc
@@ -20,6 +20,7 @@ static std::string parsePublicHostKey(std::string_view host, std::string_view ss
 
 class InvalidSSHAuthority final : public CloneableError<InvalidSSHAuthority, Error>
 {
+    void anchor() override;
 public:
     InvalidSSHAuthority(const ParsedURL::Authority & authority, std::string_view reason)
         : CloneableError("invalid SSH authority: '%s': %s", authority.to_string(), reason)
@@ -27,6 +28,8 @@ class InvalidSSHAuthority final : public CloneableError<InvalidSSHAuthority, Err
     }
 };
 
+void InvalidSSHAuthority::anchor() {}
+
 /**
  * Checks if the hostname/username are valid for use with ssh.
  *
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 3f367b19a16c..133d84087abc 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -1,3 +1,4 @@
+#include "nix/store/build/worker.hh"
 #include "nix/util/logging.hh"
 #include "nix/util/signature/local-keys.hh"
 #include "nix/util/source-accessor.hh"
@@ -6,6 +7,7 @@
 #include "nix/store/realisation.hh"
 #include "nix/store/derivations.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/build.hh"
 #include "nix/store/store-open.hh"
 #include "nix/store/outputs-query.hh"
 #include "nix/util/util.hh"
@@ -14,7 +16,7 @@
 #include "nix/util/archive.hh"
 #include "nix/util/callback.hh"
 #include "nix/util/git.hh"
-#include "nix/util/posix-source-accessor.hh"
+#include "nix/util/source-accessor.hh"
 #include "nix/util/signals.hh"
 #include "nix/util/environment-variables.hh"
 #include "nix/util/file-system.hh"
@@ -32,6 +34,22 @@ using json = nlohmann::json;
 
 namespace nix {
 
+void StoreConfig::anchor() {}
+
+void InvalidPath::anchor() {}
+
+void Unsupported::anchor() {}
+
+void SubstituteGone::anchor() {}
+
+void SubstituterDisabled::anchor() {}
+
+void InvalidStoreReference::anchor() {}
+
+void StoreConfigBase::anchor() {}
+
+void Builder::anchor() {}
+
 static std::string canonStoreDir(std::string path)
 {
     if (path.empty() || path[0] != '/')
@@ -55,21 +73,19 @@ StoreConfigBase::StoreDirSetting::StoreDirSetting(Config * options, FilePathType
 
               switch (pathType) {
               case FilePathType::Unix:
-                  return canonStoreDir(
-                      envOverrides.transform([](auto && s) { return os_string_to_string(std::move(s)); })
-                          .value_or(NIX_STORE_DIR));
+                  return canonStoreDir(envOverrides.transform([](const auto & s) { return os_string_to_string(s); })
+                                           .value_or(NIX_STORE_DIR));
 
               case FilePathType::Native:
-                  return canonStoreDir(
-                      envOverrides.transform([](auto && s) { return std::filesystem::path(std::move(s)); })
-                          .or_else([]() -> std::optional<std::filesystem::path> {
+                  return canonStoreDir(envOverrides.transform([](const auto & s) { return std::filesystem::path(s); })
+                                           .or_else([]() -> std::optional<std::filesystem::path> {
 #ifdef _WIN32
-                              return windows::known_folders::getProgramData() / "nix" / "store";
+                                               return windows::known_folders::getProgramData() / "nix" / "store";
 #else
-                              return std::filesystem::path{NIX_STORE_DIR};
+                                               return std::filesystem::path{NIX_STORE_DIR};
 #endif
-                          })
-                          .value());
+                                           })
+                                           .value());
               }
               assert(false);
           }(),
@@ -130,6 +146,13 @@ std::pair<StorePath, CanonPath> StoreDirConfig::toStorePath(std::string_view pat
         return {parseStorePath(path.substr(0, slash)), CanonPath{path.substr(slash)}};
 }
 
+ref<Builder> Store::getBuilder(std::shared_ptr<Store> evalStore)
+{
+    auto store = ref<Store>(shared_from_this());
+    auto evalStoreRef = evalStore ? ref<Store>(std::move(evalStore)) : store;
+    return make_ref<LocalBuilder>(store, evalStoreRef);
+}
+
 std::filesystem::path Store::followLinksToStore(std::string_view _path) const
 {
     auto path = absPath(std::string(_path));
@@ -373,8 +396,13 @@ StringSet Store::Config::getDefaultSystemFeatures()
     if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations))
         res.insert("ca-derivations");
 
-    if (experimentalFeatureSettings.isEnabled(Xp::RecursiveNix))
+    if (experimentalFeatureSettings.isEnabled(Xp::RecursiveNix)) {
         res.insert("recursive-nix");
+    }
+
+    if (experimentalFeatureSettings.isEnabled(Xp::DynamicDerivations)) {
+        res.insert(std::string{drvFeatureBuilderRpcV0});
+    }
 
     return res;
 }
@@ -722,7 +750,7 @@ void Store::substitutePaths(const StorePathSet & paths)
             std::vector<DerivedPath> subs;
             for (auto & p : missing.willSubstitute)
                 subs.emplace_back(DerivedPath::Opaque{p});
-            buildPaths(subs);
+            getBuilder()->buildPaths(subs, bmNormal);
         } catch (Error & e) {
             logWarning(e.info());
         }
@@ -1015,7 +1043,6 @@ std::map<StorePath, StorePath> copyPaths(
     // In the general case, `addMultipleToStore` requires a sorted list of
     // store paths to add, so sort them right now
     auto sortedMissing = srcStore.topoSortPaths(missing);
-    std::reverse(sortedMissing.begin(), sortedMissing.end());
 
     std::map<StorePath, StorePath> pathsMap;
     for (auto & path : storePaths)
@@ -1041,7 +1068,7 @@ std::map<StorePath, StorePath> copyPaths(
         return storePathForDst;
     };
 
-    for (auto & missingPath : sortedMissing) {
+    for (auto & missingPath : sortedMissing | std::views::reverse) {
         auto info = srcStore.queryPathInfo(missingPath);
 
         auto storePathForDst = computeStorePathForDst(*info);
@@ -1087,7 +1114,8 @@ void copyClosure(
     const RealisedPath::Set & paths,
     RepairFlag repair,
     CheckSigsFlag checkSigs,
-    SubstituteFlag substitute)
+    SubstituteFlag substitute,
+    bool includeOutputs)
 {
     if (&srcStore == &dstStore)
         return;
@@ -1098,7 +1126,7 @@ void copyClosure(
     }
 
     StorePathSet closure1;
-    srcStore.computeFSClosure(closure0, closure1);
+    srcStore.computeFSClosure(closure0, closure1, false, includeOutputs);
 
     RealisedPath::Set closure = paths;
     for (auto && path : closure1)
@@ -1113,13 +1141,14 @@ void copyClosure(
     const StorePathSet & storePaths,
     RepairFlag repair,
     CheckSigsFlag checkSigs,
-    SubstituteFlag substitute)
+    SubstituteFlag substitute,
+    bool includeOutputs)
 {
     if (&srcStore == &dstStore)
         return;
 
     StorePathSet closure;
-    srcStore.computeFSClosure(storePaths, closure);
+    srcStore.computeFSClosure(storePaths, closure, false, includeOutputs);
     copyPaths(srcStore, dstStore, closure, repair, checkSigs, substitute);
 }
 
@@ -1163,7 +1192,7 @@ decodeValidPathInfo(const Store & store, std::istream & str, std::optional<HashR
 
 Derivation Store::derivationFromPath(const StorePath & drvPath)
 {
-    ensurePath(drvPath);
+    getBuilder()->ensurePath(drvPath);
     return readDerivation(drvPath);
 }
 
@@ -1206,7 +1235,7 @@ std::optional<StorePath> Store::getBuildDerivationPath(const StorePath & path)
         // resolved derivation, so we need to get it first
         auto resolvedDrv = drv.tryResolve(*this);
         if (resolvedDrv)
-            return nix::computeStorePath(*this, Derivation{*resolvedDrv});
+            return nix::computeStorePath(*this, resolvedDrv->unresolve());
     }
 
     return path;
diff --git a/src/libstore/store-dir-config.cc b/src/libstore/store-dir-config.cc
index 61f82029d79f..962a3830f166 100644
--- a/src/libstore/store-dir-config.cc
+++ b/src/libstore/store-dir-config.cc
@@ -8,6 +8,8 @@ namespace nix {
 
 StorePath StoreDirConfig::parseStorePath(std::string_view path) const
 {
+    if (path.empty())
+        throw BadStorePath("empty path is not a valid store path");
     // On Windows, `/nix/store` is not a canonical path. More broadly it
     // is unclear whether this function should be using the native
     // notion of a canonical path at all. For example, it makes to
diff --git a/src/libstore/store-reference.cc b/src/libstore/store-reference.cc
index 8f72a3d33081..029d8294cb19 100644
--- a/src/libstore/store-reference.cc
+++ b/src/libstore/store-reference.cc
@@ -189,14 +189,12 @@ std::pair<std::string, StoreReference::Params> splitUriAndParams(const std::stri
 
 namespace nlohmann {
 
-using namespace nix;
-
-StoreReference adl_serializer<StoreReference>::from_json(const json & json)
+nix::StoreReference adl_serializer<nix::StoreReference>::from_json(const json & json)
 {
-    return StoreReference::parse(json.get<std::string>());
+    return nix::StoreReference::parse(json.get<std::string>()); // FIXME: getString
 }
 
-void adl_serializer<StoreReference>::to_json(json & json, const StoreReference & ref)
+void adl_serializer<nix::StoreReference>::to_json(json & json, const nix::StoreReference & ref)
 {
     json = ref.render();
 }
diff --git a/src/libstore/submit-store.cc b/src/libstore/submit-store.cc
new file mode 100644
index 000000000000..16e6feb848df
--- /dev/null
+++ b/src/libstore/submit-store.cc
@@ -0,0 +1,7 @@
+#include "nix/store/submit-store.hh"
+
+namespace nix {
+
+void SubmitStore::anchor() {}
+
+} // namespace nix
diff --git a/src/libstore/uds-remote-store.cc b/src/libstore/uds-remote-store.cc
index e0b2d68ec37c..c4137df7c6aa 100644
--- a/src/libstore/uds-remote-store.cc
+++ b/src/libstore/uds-remote-store.cc
@@ -26,6 +26,10 @@ std::filesystem::path getDaemonSocketPath(const Store::Config & config)
         .value_or(config.getStateDir() / "daemon-socket" / "socket");
 }
 
+void UDSRemoteStoreConfig::anchor() {}
+
+void UDSRemoteStore::anchor() {}
+
 UDSRemoteStoreConfig::UDSRemoteStoreConfig(const std::filesystem::path & path, const StoreReference::Params & params)
     : Store::Config{params, FilePathType::Native}
     , LocalFSStore::Config{params}
diff --git a/src/libstore/uds-remote-store.md b/src/libstore/uds-remote-store.md
index 8238834e2483..3c40559c0c3d 100644
--- a/src/libstore/uds-remote-store.md
+++ b/src/libstore/uds-remote-store.md
@@ -10,7 +10,7 @@ the socket path is determined as follows:
 
 1. The [`NIX_DAEMON_SOCKET_PATH`] environment variable, if set.
 
-2. Otherwise, `daemon-socket/socket` within the [`state`](#store-setting-state) directory.
+2. Otherwise, `daemon-socket/socket` within the [`state`](#store-local-daemon-store-state) directory.
 
 [`NIX_DAEMON_SOCKET_PATH`]: @docroot@/command-ref/env-common.md#env-NIX_DAEMON_SOCKET_PATH
 
diff --git a/src/libstore/unix/build/child.cc b/src/libstore/unix/build/child.cc
index 3a704e6edf2c..d6625846ca52 100644
--- a/src/libstore/unix/build/child.cc
+++ b/src/libstore/unix/build/child.cc
@@ -9,7 +9,7 @@ namespace nix {
 
 void commonChildInit()
 {
-    logger = makeSimpleLogger();
+    logger = makeSimpleLogger().release();
 
     const static std::string pathNullDevice = "/dev/null";
     restoreProcessContext(false);
@@ -26,7 +26,7 @@ void commonChildInit()
         throw SysError("cannot dup stderr into stdout");
 
     /* Reroute stdin to /dev/null. */
-    int fdDevNull = open(pathNullDevice.c_str(), O_RDWR);
+    int fdDevNull = open(pathNullDevice.c_str(), O_RDWR | O_CLOEXEC);
     if (fdDevNull == -1)
         throw SysError("cannot open '%1%'", pathNullDevice);
     if (dup2(fdDevNull, STDIN_FILENO) == -1)
diff --git a/src/libstore/unix/build/chroot-derivation-builder.cc b/src/libstore/unix/build/chroot-derivation-builder.cc
index d10d98245a11..0186fc54fa03 100644
--- a/src/libstore/unix/build/chroot-derivation-builder.cc
+++ b/src/libstore/unix/build/chroot-derivation-builder.cc
@@ -1,154 +1,125 @@
-#if defined(__linux__) || defined(__FreeBSD__)
-
-#  include "chroot.hh"
+#include "chroot-derivation-builder.hh"
 
 namespace nix {
 
-struct ChrootDerivationBuilder : virtual DerivationBuilderImpl
-{
-    ChrootDerivationBuilder(
-        LocalStore & store, std::unique_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
-        : DerivationBuilderImpl{store, std::move(miscMethods), std::move(params)}
-    {
-    }
-
-    /**
-     * The chroot root directory.
-     */
-    std::filesystem::path chrootRootDir;
+void ChrootDerivationBuilder::anchor() {}
 
-    /**
-     * RAII cleanup for the chroot directory.
-     */
-    std::optional<AutoDelete> autoDelChroot;
+void ChrootDerivationBuilder::setBuildTmpDir()
+{
+    /* If sandboxing is enabled, put the actual TMPDIR underneath
+       an inaccessible root-owned directory, to prevent outside
+       access.
+
+       On macOS, we don't use an actual chroot, so this isn't
+       possible. Any mitigation along these lines would have to be
+       done directly in the sandbox profile. */
+    tmpDir = topTmpDir / "build";
+    createDir(tmpDir, 0700);
+}
+
+std::filesystem::path ChrootDerivationBuilder::tmpDirInSandbox()
+{
+    /* In a sandbox, for determinism, always use the same temporary
+       directory. */
+    return store.config->getLocalSettings().sandboxBuildDir.get();
+}
 
-    PathsInChroot pathsInChroot;
+gid_t ChrootDerivationBuilder::sandboxGid()
+{
+    return buildUser->getGID();
+}
 
-    bool needsHashRewrite() override
-    {
-        return false;
+void ChrootDerivationBuilder::prepareSandbox()
+{
+    // Set up chroot parameters
+    BuildChrootParams params{
+        .chrootParentDir = store.toRealPath(drvPath) + ".chroot",
+        .useUidRange = drvOptions.useUidRange(drv),
+        .isSandboxed = derivationType.isSandboxed(),
+        .buildUser = buildUser.get(),
+        .storeDir = store.storeDir,
+        .chownToBuilder = [this](const std::filesystem::path & path) { this->chownToBuilder(path); },
+    };
+
+    // Create the chroot
+    auto [rootDir, cleanup] = setupBuildChroot(params);
+    chrootRootDir = std::move(rootDir);
+    autoDelChroot.emplace(std::move(cleanup));
+
+    // Start with the default sandbox paths
+    pathsInChroot = getPathsInSandbox();
+
+    for (auto & i : inputPaths) {
+        auto p = store.printStorePath(i);
+        pathsInChroot.insert_or_assign(p, ChrootPath{.source = store.toRealPath(i)});
     }
 
-    void setBuildTmpDir() override
-    {
-        /* If sandboxing is enabled, put the actual TMPDIR underneath
-           an inaccessible root-owned directory, to prevent outside
-           access.
-
-           On macOS, we don't use an actual chroot, so this isn't
-           possible. Any mitigation along these lines would have to be
-           done directly in the sandbox profile. */
-        tmpDir = topTmpDir / "build";
-        createDir(tmpDir, 0700);
+    /* If we're repairing, checking or rebuilding part of a
+       multiple-outputs derivation, it's possible that we're
+       rebuilding a path that is in settings.sandbox-paths
+       (typically the dependencies of /bin/sh).  Throw them
+       out. */
+    for (auto & i : drv.outputsAndOptPaths(store)) {
+        /* If the name isn't known a priori (i.e. floating
+           content-addressing derivation), the temporary location we use
+           should be fresh.  Freshness means it is impossible that the path
+           is already in the sandbox, so we don't need to worry about
+           removing it.  */
+        if (i.second.second)
+            pathsInChroot.erase(store.printStorePath(*i.second.second));
     }
+}
 
-    std::filesystem::path tmpDirInSandbox() override
-    {
-        /* In a sandbox, for determinism, always use the same temporary
-           directory. */
-        return store.config->getLocalSettings().sandboxBuildDir.get();
-    }
+Strings ChrootDerivationBuilder::getPreBuildHookArgs()
+{
+    assert(!chrootRootDir.empty());
+    return Strings({store.printStorePath(drvPath), chrootRootDir.native()});
+}
 
-    virtual gid_t sandboxGid()
-    {
-        return buildUser->getGID();
-    }
+std::filesystem::path ChrootDerivationBuilder::realPathInHost(const std::filesystem::path & p)
+{
+    // FIXME: why the needsHashRewrite() conditional?
+    return !needsHashRewrite() ? chrootRootDir / p.relative_path()
+                               : std::filesystem::path(store.toRealPath(store.parseStorePath(p.native())));
+}
 
-    void prepareSandbox() override
-    {
-        // Set up chroot parameters
-        BuildChrootParams params{
-            .chrootParentDir = store.toRealPath(drvPath) + ".chroot",
-            .useUidRange = drvOptions.useUidRange(drv),
-            .isSandboxed = derivationType.isSandboxed(),
-            .buildUser = buildUser.get(),
-            .storeDir = store.storeDir,
-            .chownToBuilder = [this](const std::filesystem::path & path) { this->chownToBuilder(path); },
-        };
-
-        // Create the chroot
-        auto [rootDir, cleanup] = setupBuildChroot(params);
-        chrootRootDir = std::move(rootDir);
-        autoDelChroot.emplace(std::move(cleanup));
-
-        // Start with the default sandbox paths
-        pathsInChroot = getPathsInSandbox();
-
-        for (auto & i : inputPaths) {
-            auto p = store.printStorePath(i);
-            pathsInChroot.insert_or_assign(p, ChrootPath{.source = store.toRealPath(i)});
+void ChrootDerivationBuilder::cleanupBuild(bool force)
+{
+    DerivationBuilderImpl::cleanupBuild(force);
+
+    /* Move paths out of the chroot for easier debugging of
+       build failures. */
+    if (!force && buildMode == bmNormal)
+        for (auto & [_, status] : initialOutputs) {
+            if (!status.known)
+                continue;
+            if (buildMode != bmCheck && status.known->isValid())
+                continue;
+            std::filesystem::path p = store.toRealPath(status.known->path);
+            std::filesystem::path chrootPath = chrootRootDir / p.relative_path();
+            if (pathExists(chrootPath))
+                std::filesystem::rename(chrootPath, p);
         }
 
-        /* If we're repairing, checking or rebuilding part of a
-           multiple-outputs derivation, it's possible that we're
-           rebuilding a path that is in settings.sandbox-paths
-           (typically the dependencies of /bin/sh).  Throw them
-           out. */
-        for (auto & i : drv.outputsAndOptPaths(store)) {
-            /* If the name isn't known a priori (i.e. floating
-               content-addressing derivation), the temporary location we use
-               should be fresh.  Freshness means it is impossible that the path
-               is already in the sandbox, so we don't need to worry about
-               removing it.  */
-            if (i.second.second)
-                pathsInChroot.erase(store.printStorePath(*i.second.second));
-        }
-    }
+    autoDelChroot.reset(); /* this runs the destructor */
+}
 
-    Strings getPreBuildHookArgs() override
-    {
-        assert(!chrootRootDir.empty());
-        return Strings({store.printStorePath(drvPath), chrootRootDir.native()});
-    }
+std::pair<std::filesystem::path, std::filesystem::path>
+ChrootDerivationBuilder::addDependencyPrep(const StorePath & path)
+{
+    debug("materialising '%s' in the sandbox", store.printStorePath(path));
 
-    std::filesystem::path realPathInHost(const std::filesystem::path & p) override
-    {
-        // FIXME: why the needsHashRewrite() conditional?
-        return !needsHashRewrite() ? chrootRootDir / p.relative_path()
-                                   : std::filesystem::path(store.toRealPath(store.parseStorePath(p.native())));
-    }
+    std::filesystem::path source = store.toRealPath(path);
+    auto targetRelPath = std::filesystem::path(store.printStorePath(path)).relative_path();
+    std::filesystem::path target = chrootRootDir / targetRelPath;
 
-    void cleanupBuild(bool force) override
-    {
-        DerivationBuilderImpl::cleanupBuild(force);
-
-        /* Move paths out of the chroot for easier debugging of
-           build failures. */
-        if (!force && buildMode == bmNormal)
-            for (auto & [_, status] : initialOutputs) {
-                if (!status.known)
-                    continue;
-                if (buildMode != bmCheck && status.known->isValid())
-                    continue;
-                std::filesystem::path p = store.toRealPath(status.known->path);
-                std::filesystem::path chrootPath = chrootRootDir / p.relative_path();
-                if (pathExists(chrootPath))
-                    std::filesystem::rename(chrootPath, p);
-            }
-
-        autoDelChroot.reset(); /* this runs the destructor */
+    if (pathExists(target)) {
+        // There is a similar debug message in doBind, so only run it in this block to not have double messages.
+        debug("bind-mounting %s -> %s", PathFmt(target), PathFmt(source));
+        throw Error("store path '%s' already exists in the sandbox", store.printStorePath(path));
     }
 
-    std::pair<std::filesystem::path, std::filesystem::path> addDependencyPrep(const StorePath & path)
-    {
-        DerivationBuilderImpl::addDependencyImpl(path);
-
-        debug("materialising '%s' in the sandbox", store.printStorePath(path));
-
-        std::filesystem::path source = store.toRealPath(path);
-        std::filesystem::path target =
-            chrootRootDir / std::filesystem::path(store.printStorePath(path)).relative_path();
-
-        if (pathExists(target)) {
-            // There is a similar debug message in doBind, so only run it in this block to not have double messages.
-            debug("bind-mounting %s -> %s", PathFmt(target), PathFmt(source));
-            throw Error("store path '%s' already exists in the sandbox", store.printStorePath(path));
-        }
-
-        return {source, target};
-    }
-};
+    return {source, targetRelPath};
+}
 
 } // namespace nix
-
-#endif
diff --git a/src/libstore/unix/build/chroot-derivation-builder.hh b/src/libstore/unix/build/chroot-derivation-builder.hh
new file mode 100644
index 000000000000..62bf5c967c40
--- /dev/null
+++ b/src/libstore/unix/build/chroot-derivation-builder.hh
@@ -0,0 +1,53 @@
+#pragma once
+
+#include "derivation-builder-impl.hh"
+#include "chroot.hh"
+
+namespace nix {
+
+struct ChrootDerivationBuilder : virtual DerivationBuilderImpl
+{
+private:
+    void anchor() override;
+public:
+    ChrootDerivationBuilder(
+        LocalStore & store, std::shared_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
+        : DerivationBuilderImpl{store, std::move(miscMethods), std::move(params)}
+    {
+    }
+
+    /**
+     * The chroot root directory.
+     */
+    std::filesystem::path chrootRootDir;
+
+    /**
+     * RAII cleanup for the chroot directory.
+     */
+    std::optional<AutoDelete> autoDelChroot;
+
+    PathsInChroot pathsInChroot;
+
+    inline bool needsHashRewrite() override
+    {
+        return false;
+    }
+
+    void setBuildTmpDir() override;
+
+    std::filesystem::path tmpDirInSandbox() override;
+
+    virtual gid_t sandboxGid();
+
+    void prepareSandbox() override;
+
+    Strings getPreBuildHookArgs() override;
+
+    std::filesystem::path realPathInHost(const std::filesystem::path & p) override;
+
+    void cleanupBuild(bool force) override;
+
+    std::pair<std::filesystem::path, std::filesystem::path> addDependencyPrep(const StorePath & path);
+};
+
+} // namespace nix
diff --git a/src/libstore/unix/build/darwin-derivation-builder.cc b/src/libstore/unix/build/darwin-derivation-builder.cc
deleted file mode 100644
index e9999d455b30..000000000000
--- a/src/libstore/unix/build/darwin-derivation-builder.cc
+++ /dev/null
@@ -1,347 +0,0 @@
-#ifdef __APPLE__
-
-#  include <spawn.h>
-#  include <sys/sysctl.h>
-#  include <sandbox.h>
-#  include <sys/ipc.h>
-#  include <sys/shm.h>
-#  include <sys/msg.h>
-#  include <sys/sem.h>
-
-/* This definition is undocumented but depended upon by all major browsers. */
-extern "C" int
-sandbox_init_with_parameters(const char * profile, uint64_t flags, const char * const parameters[], char ** errorbuf);
-
-/* Darwin IPC structures and constants */
-#  define IPCS_MAGIC 0x00000001
-#  define IPCS_SHM_ITER 0x00000002
-#  define IPCS_SEM_ITER 0x00000020
-#  define IPCS_MSG_ITER 0x00000200
-#  define IPCS_SHM_SYSCTL "kern.sysv.ipcs.shm"
-#  define IPCS_MSG_SYSCTL "kern.sysv.ipcs.msg"
-#  define IPCS_SEM_SYSCTL "kern.sysv.ipcs.sem"
-
-struct IpcsCommand
-{
-    uint32_t ipcs_magic;
-    uint32_t ipcs_op;
-    uint32_t ipcs_cursor;
-    uint32_t ipcs_datalen;
-    void * ipcs_data;
-};
-
-namespace nix {
-
-struct DarwinDerivationBuilder : DerivationBuilderImpl
-{
-    PathsInChroot pathsInChroot;
-
-    /**
-     * Whether full sandboxing is enabled. Note that macOS builds
-     * always have *some* sandboxing (see sandbox-minimal.sb).
-     */
-    bool useSandbox;
-
-    DarwinDerivationBuilder(
-        LocalStore & store,
-        std::unique_ptr<DerivationBuilderCallbacks> miscMethods,
-        DerivationBuilderParams params,
-        bool useSandbox)
-        : DerivationBuilderImpl(store, std::move(miscMethods), std::move(params))
-        , useSandbox(useSandbox)
-    {
-    }
-
-    void prepareSandbox() override
-    {
-        pathsInChroot = getPathsInSandbox();
-    }
-
-    void setUser() override
-    {
-        DerivationBuilderImpl::setUser();
-
-        /* This has to appear before import statements. */
-        std::string sandboxProfile = "(version 1)\n";
-
-        if (useSandbox) {
-
-            /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */
-            StringSet ancestry;
-
-            /* We build the ancestry before adding all inputPaths to the store because we know they'll
-               all have the same parents (the store), and there might be lots of inputs. This isn't
-               particularly efficient... I doubt it'll be a bottleneck in practice */
-            for (auto & i : pathsInChroot) {
-                std::filesystem::path cur = i.first;
-                while (cur != "/") {
-                    cur = cur.parent_path();
-                    ancestry.insert(cur.native());
-                }
-            }
-
-            /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost
-               path component this time, since it's typically /nix/store and we care about that. */
-            std::filesystem::path cur = store.storeDir;
-            while (cur != "/") {
-                ancestry.insert(cur.native());
-                cur = cur.parent_path();
-            }
-
-            /* Add all our input paths to the chroot */
-            for (auto & i : inputPaths) {
-                auto p = store.printStorePath(i);
-                pathsInChroot.insert_or_assign(p, ChrootPath{.source = p});
-            }
-
-            /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be
-             * configurable */
-            if (store.config->getLocalSettings().darwinLogSandboxViolations) {
-                sandboxProfile += "(deny default)\n";
-            } else {
-                sandboxProfile += "(deny default (with no-log))\n";
-            }
-
-            sandboxProfile +=
-#  include "sandbox-defaults.sb"
-                ;
-
-            if (!derivationType.isSandboxed())
-                sandboxProfile +=
-#  include "sandbox-network.sb"
-                    ;
-
-            /* Add the output paths we'll use at build-time to the chroot */
-            sandboxProfile += "(allow file-read* file-write* process-exec\n";
-            for (auto & [_, path] : scratchOutputs)
-                sandboxProfile += fmt("\t(subpath \"%s\")\n", store.printStorePath(path));
-
-            sandboxProfile += ")\n";
-
-            /* Our inputs (transitive dependencies and any impurities computed above)
-
-               without file-write* allowed, access() incorrectly returns EPERM
-             */
-            sandboxProfile += "(allow file-read* file-write* process-exec\n";
-
-            // We create multiple allow lists, to avoid exceeding a limit in the darwin sandbox interpreter.
-            // See https://github.com/NixOS/nix/issues/4119
-            // We split our allow groups approximately at half the actual limit, 1 << 16
-            const size_t breakpoint = sandboxProfile.length() + (1 << 14);
-            for (auto & i : pathsInChroot) {
-
-                if (sandboxProfile.length() >= breakpoint) {
-                    debug("Sandbox break: %d %d", sandboxProfile.length(), breakpoint);
-                    sandboxProfile += ")\n(allow file-read* file-write* process-exec\n";
-                }
-
-                if (i.first != i.second.source)
-                    throw Error(
-                        "can't map %1% to %2%: mismatched impure paths not supported on Darwin",
-                        PathFmt(i.first),
-                        PathFmt(i.second.source));
-
-                std::string path = i.first;
-                auto optSt = maybeLstat(path.c_str());
-                if (!optSt) {
-                    if (i.second.optional)
-                        continue;
-                    throw SysError("getting attributes of required path '%s", path);
-                }
-                if (S_ISDIR(optSt->st_mode))
-                    sandboxProfile += fmt("\t(subpath \"%s\")\n", path);
-                else
-                    sandboxProfile += fmt("\t(literal \"%s\")\n", path);
-            }
-            sandboxProfile += ")\n";
-
-            /* Allow file-read* on full directory hierarchy to self. Allows realpath() */
-            sandboxProfile += "(allow file-read*\n";
-            for (auto & i : ancestry) {
-                sandboxProfile += fmt("\t(literal \"%s\")\n", i);
-            }
-            sandboxProfile += ")\n";
-
-            sandboxProfile += drvOptions.additionalSandboxProfile;
-        } else
-            sandboxProfile +=
-#  include "sandbox-minimal.sb"
-                ;
-
-        debug("Generated sandbox profile:");
-        debug(sandboxProfile);
-
-        /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different
-           mechanisms to find temporary directories, so we want to open up a broader place for them to put their files,
-           if needed. */
-        std::filesystem::path globalTmpDir = canonPath(defaultTempDir().native(), true);
-
-        /* They don't like trailing slashes on subpath directives */
-        std::string globalTmpDirStr = globalTmpDir.native();
-        while (!globalTmpDirStr.empty() && globalTmpDirStr.back() == '/')
-            globalTmpDirStr.pop_back();
-
-        if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {
-            Strings sandboxArgs;
-            sandboxArgs.push_back("_NIX_BUILD_TOP");
-            sandboxArgs.push_back(tmpDir.native());
-            sandboxArgs.push_back("_GLOBAL_TMP_DIR");
-            sandboxArgs.push_back(globalTmpDirStr);
-            if (drvOptions.allowLocalNetworking) {
-                sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");
-                sandboxArgs.push_back("1");
-            }
-            char * sandbox_errbuf = nullptr;
-            if (sandbox_init_with_parameters(
-                    sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) {
-                writeFull(
-                    STDERR_FILENO,
-                    fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)"));
-                _exit(1);
-            }
-        }
-    }
-
-    void execBuilder(const Strings & args, const Strings & envStrs) override
-    {
-        posix_spawnattr_t attrp;
-
-        if (posix_spawnattr_init(&attrp))
-            throw SysError("failed to initialize builder");
-
-        if (posix_spawnattr_setflags(&attrp, POSIX_SPAWN_SETEXEC))
-            throw SysError("failed to initialize builder");
-
-        if (drv.platform == "aarch64-darwin") {
-            // Unset kern.curproc_arch_affinity so we can escape Rosetta
-            int affinity = 0;
-            sysctlbyname("kern.curproc_arch_affinity", NULL, NULL, &affinity, sizeof(affinity));
-
-            cpu_type_t cpu = CPU_TYPE_ARM64;
-            posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL);
-        } else if (drv.platform == "x86_64-darwin") {
-            cpu_type_t cpu = CPU_TYPE_X86_64;
-            posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL);
-        }
-
-        posix_spawn(
-            NULL, drv.builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());
-    }
-
-    /**
-     * Cleans up all System V IPC objects owned by the specified user.
-     *
-     * On Darwin, IPC objects (shared memory segments, message queues, and semaphore)
-     * can persist after the build user's processes are killed, since there are no IPC namespaces
-     * like on Linux. This can exhaust kernel IPC limits over time.
-     *
-     * Uses sysctl to enumerate and remove all IPC objects owned by the given UID.
-     */
-    void cleanupSysVIPCForUser(uid_t uid)
-    {
-        struct IpcsCommand ic;
-        size_t ic_size = sizeof(ic);
-        // IPC ids to cleanup
-        std::vector<int> shm_ids, msg_ids, sem_ids;
-
-        {
-            struct shmid_ds shm_ds;
-            ic.ipcs_magic = IPCS_MAGIC;
-            ic.ipcs_op = IPCS_SHM_ITER;
-            ic.ipcs_cursor = 0;
-            ic.ipcs_data = &shm_ds;
-            ic.ipcs_datalen = sizeof(shm_ds);
-
-            while (true) {
-                memset(&shm_ds, 0, sizeof(shm_ds));
-
-                if (sysctlbyname(IPCS_SHM_SYSCTL, &ic, &ic_size, &ic, ic_size) != 0) {
-                    break;
-                }
-
-                if (shm_ds.shm_perm.uid == uid) {
-                    int shmid = shmget(shm_ds.shm_perm._key, 0, 0);
-                    if (shmid != -1) {
-                        shm_ids.push_back(shmid);
-                    }
-                }
-            }
-        }
-
-        for (auto id : shm_ids) {
-            if (shmctl(id, IPC_RMID, NULL) == 0)
-                debug("removed shared memory segment with shmid %d", id);
-        }
-
-        {
-            struct msqid_ds msg_ds;
-            ic.ipcs_magic = IPCS_MAGIC;
-            ic.ipcs_op = IPCS_MSG_ITER;
-            ic.ipcs_cursor = 0;
-            ic.ipcs_data = &msg_ds;
-            ic.ipcs_datalen = sizeof(msg_ds);
-
-            while (true) {
-                memset(&msg_ds, 0, sizeof(msg_ds));
-
-                if (sysctlbyname(IPCS_MSG_SYSCTL, &ic, &ic_size, &ic, ic_size) != 0) {
-                    break;
-                }
-
-                if (msg_ds.msg_perm.uid == uid) {
-                    int msgid = msgget(msg_ds.msg_perm._key, 0);
-                    if (msgid != -1) {
-                        msg_ids.push_back(msgid);
-                    }
-                }
-            }
-        }
-
-        for (auto id : msg_ids) {
-            if (msgctl(id, IPC_RMID, NULL) == 0)
-                debug("removed message queue with msgid %d", id);
-        }
-
-        {
-            struct semid_ds sem_ds;
-            ic.ipcs_magic = IPCS_MAGIC;
-            ic.ipcs_op = IPCS_SEM_ITER;
-            ic.ipcs_cursor = 0;
-            ic.ipcs_data = &sem_ds;
-            ic.ipcs_datalen = sizeof(sem_ds);
-
-            while (true) {
-                memset(&sem_ds, 0, sizeof(sem_ds));
-
-                if (sysctlbyname(IPCS_SEM_SYSCTL, &ic, &ic_size, &ic, ic_size) != 0) {
-                    break;
-                }
-
-                if (sem_ds.sem_perm.uid == uid) {
-                    int semid = semget(sem_ds.sem_perm._key, 0, 0);
-                    if (semid != -1) {
-                        sem_ids.push_back(semid);
-                    }
-                }
-            }
-        }
-
-        for (auto id : sem_ids) {
-            if (semctl(id, 0, IPC_RMID) == 0)
-                debug("removed semaphore with semid %d", id);
-        }
-    }
-
-    void killSandbox(bool getStats) override
-    {
-        DerivationBuilderImpl::killSandbox(getStats);
-        if (buildUser) {
-            auto uid = buildUser->getUID();
-            cleanupSysVIPCForUser(uid);
-        }
-    }
-};
-
-} // namespace nix
-
-#endif
diff --git a/src/libstore/unix/build/derivation-builder-impl.hh b/src/libstore/unix/build/derivation-builder-impl.hh
new file mode 100644
index 000000000000..b21587692f9c
--- /dev/null
+++ b/src/libstore/unix/build/derivation-builder-impl.hh
@@ -0,0 +1,451 @@
+#pragma once
+
+#include "nix/store/aws-creds.hh"
+#include "nix/store/build/derivation-builder.hh"
+#include "nix/store/globals.hh"
+#include "nix/store/local-store.hh"
+#include "nix/store/user-lock.hh"
+
+namespace nix {
+
+/**
+ * This class represents the state for building locally.
+ *
+ * @todo Ideally, it would not be a class, but a single function.
+ * However, besides the main entry point, there are a few more methods
+ * which are externally called, and need to be gotten rid of. There are
+ * also some virtual methods (either directly here or inherited from
+ * `DerivationBuilderCallbacks`, a stop-gap) that represent outgoing
+ * rather than incoming call edges that either should be removed, or
+ * become (higher order) function parameters.
+ */
+// FIXME: rename this to UnixDerivationBuilder or something like that.
+class DerivationBuilderImpl : public DerivationBuilder, public DerivationBuilderParams
+{
+private:
+    void anchor() override;
+
+protected:
+
+    /**
+     * The process ID of the builder.
+     */
+    Pid pid;
+
+    LocalStore & store;
+
+    const LocalSettings & localSettings = store.config->getLocalSettings();
+
+    std::shared_ptr<DerivationBuilderCallbacks> miscMethods;
+
+public:
+
+    DerivationBuilderImpl(
+        LocalStore & store, std::shared_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
+        : DerivationBuilderParams{std::move(params)}
+        , store{store}
+        , miscMethods{miscMethods}
+        , derivationType{drv.type()}
+    {
+    }
+
+    /**
+     * Cleanup code to run when destroying any DerivationBuilderImpl implementation.
+     */
+    void cleanupOnDestruction() noexcept
+    {
+        /* Careful: we should never ever throw an exception from a
+           noexcept function. */
+        try {
+            killChild();
+        } catch (...) {
+            ignoreExceptionInDestructor();
+        }
+        try {
+            stopDaemon();
+        } catch (...) {
+            ignoreExceptionInDestructor();
+        }
+        try {
+            cleanupBuild(false);
+        } catch (...) {
+            ignoreExceptionInDestructor();
+        }
+    }
+
+protected:
+
+    /**
+     * User selected for running the builder.
+     */
+    std::unique_ptr<UserLock> buildUser;
+
+    /**
+     * The temporary directory used for the build.
+     */
+    std::filesystem::path tmpDir;
+
+    /**
+     * The top-level temporary directory. `tmpDir` is either equal to
+     * or a child of this directory.
+     */
+    std::filesystem::path topTmpDir;
+
+    /**
+     * The file descriptor of the temporary directory.
+     */
+    AutoCloseFD tmpDirFd;
+
+    /**
+     * The sort of derivation we are building.
+     *
+     * Just a cached value, computed from `drv`.
+     */
+    const DerivationType derivationType;
+
+    typedef StringMap Environment;
+    Environment env;
+
+    /**
+     * Hash rewriting.
+     */
+    StringMap inputRewrites, outputRewrites;
+    typedef std::map<StorePath, StorePath> RedirectedOutputs;
+    RedirectedOutputs redirectedOutputs;
+
+    /**
+     * The output paths used during the build.
+     *
+     * - Input-addressed derivations or fixed content-addressed outputs are
+     *   sometimes built when some of their outputs already exist, and can not
+     *   be hidden via sandboxing. We use temporary locations instead and
+     *   rewrite after the build. Otherwise the regular predetermined paths are
+     *   put here.
+     *
+     * - Floating content-addressing derivations do not know their final build
+     *   output paths until the outputs are hashed, so random locations are
+     *   used, and then renamed. The randomness helps guard against hidden
+     *   self-references.
+     */
+    OutputPathMap scratchOutputs;
+
+    /**
+     * Whether or not derivation is using outputs submitted via recursive-nix
+     */
+    bool usingSubmitted;
+    /**
+     * Output paths from the `SubmitOutput` store command
+     */
+    Sync<OutputPathMap> submittedOutputs;
+
+    const static std::filesystem::path homeDir;
+
+    /**
+     * The recursive Nix daemon socket.
+     */
+    AutoCloseFD daemonSocket;
+
+    /**
+     * The daemon main thread.
+     */
+    std::thread daemonThread;
+
+    struct DaemonWorkerState
+    {
+        std::thread thread;
+        ref<std::atomic_flag> done;
+    };
+
+    /**
+     * The daemon worker threads.
+     */
+    std::list<DaemonWorkerState> daemonWorkerThreads;
+
+    const StorePathSet & originalPaths() override
+    {
+        return inputPaths;
+    }
+
+    bool isAllowed(const StorePath & path) override
+    {
+        if (inputPaths.count(path))
+            return true;
+        auto state(state_.lock());
+        auto iter = state->addedPaths.find(path);
+        if (iter == state->addedPaths.end())
+            return false;
+        return iter->second.wait_for(std::chrono::seconds(0)) == std::future_status::ready;
+    }
+
+    bool isAllowed(const DrvOutput & id) override
+    {
+        return state_.lock()->addedDrvOutputs.count(id);
+    }
+
+    bool isAllowed(const DerivedPath & req);
+
+    bool shouldModifySandbox() override
+    {
+        return !usingSubmitted;
+    }
+
+    void submitOutput(const SingleDerivedPath & path, const OutputName & output) override
+    {
+        auto submittedOutputs(this->submittedOutputs.lock());
+
+        auto * opaque = std::get_if<SingleDerivedPath::Opaque>(&path.raw());
+        if (!opaque)
+            throw Error(
+                "Attempted to submit Built path '%s' for output '%s'.\n"
+                " Only Opaque paths are supported, see https://github.com/NixOS/nix/issues/12727",
+                path.to_string(store),
+                output);
+
+        if (submittedOutputs->contains(output))
+            throw Error(
+                "Attempted to submit duplicate output '%s' (old '%s', new '%s')",
+                output,
+                store.printStorePath(*get(*submittedOutputs, output)),
+                store.printStorePath(opaque->path));
+
+        submittedOutputs->insert_or_assign(output, opaque->path);
+    };
+
+    friend struct RestrictedStore;
+
+    /**
+     * Whether we need to perform hash rewriting if there are valid output paths.
+     */
+    virtual bool needsHashRewrite()
+    {
+        return true;
+    }
+
+public:
+
+    std::optional<Descriptor> startBuild() override;
+
+    SingleDrvOutputs unprepareBuild() override;
+
+protected:
+
+    /**
+     * Acquire a build user lock. Return nullptr if no lock is available.
+     */
+    virtual std::unique_ptr<UserLock> getBuildUser()
+    {
+        return acquireUserLock(settings.nixStateDir, localSettings, 1, false);
+    }
+
+    /**
+     * Return the paths that should be made available in the sandbox.
+     * This includes:
+     *
+     * * The paths specified by the `sandbox-paths` setting, and their closure in the Nix store.
+     * * The contents of the `__impureHostDeps` derivation attribute, if the sandbox is in relaxed mode.
+     * * The paths returned by the `pre-build-hook`.
+     * * The paths in the input closure of the derivation.
+     */
+    PathsInChroot getPathsInSandbox();
+
+    virtual void setBuildTmpDir()
+    {
+        tmpDir = topTmpDir;
+    }
+
+    /**
+     * Return the path of the temporary directory in the sandbox.
+     */
+    virtual std::filesystem::path tmpDirInSandbox()
+    {
+        assert(!topTmpDir.empty());
+        return topTmpDir;
+    }
+
+    /**
+     * Ensure that there are no processes running that conflict with
+     * `buildUser`.
+     */
+    virtual void prepareUser()
+    {
+        killSandbox(false);
+    }
+
+    /**
+     * Called by prepareBuild() to do any setup in the parent to
+     * prepare for a sandboxed build.
+     */
+    virtual void prepareSandbox();
+
+    virtual Strings getPreBuildHookArgs()
+    {
+        return Strings({store.printStorePath(drvPath)});
+    }
+
+    virtual std::filesystem::path realPathInHost(const std::filesystem::path & p)
+    {
+        return store.toRealPath(store.parseStorePath(p.native()));
+    }
+
+    /**
+     * Open the slave side of the pseudoterminal and use it as stderr.
+     */
+    void openSlave();
+
+    /**
+     * Called by prepareBuild() to start the child process for the
+     * build. Must set `pid`. The child must call runChild().
+     */
+    virtual void startChild();
+
+#if NIX_WITH_AWS_AUTH
+    /**
+     * Pre-resolve AWS credentials for S3 URLs in builtin:fetchurl.
+     * This should be called before forking to ensure credentials are available in child.
+     * Returns the credentials if successfully resolved, or std::nullopt otherwise.
+     */
+    std::optional<AwsCredentials> preResolveAwsCredentials();
+#endif
+
+private:
+
+    /**
+     * Fill in the environment for the builder.
+     */
+    void initEnv();
+
+protected:
+
+    /**
+     * Process messages send by the sandbox initialization.
+     */
+    void processSandboxSetupMessages();
+
+private:
+
+    /**
+     * Start an in-process nix daemon thread for recursive-nix.
+     */
+    void startDaemon();
+
+    /**
+     * Stop the in-process nix daemon thread.
+     * @see startDaemon
+     */
+    void stopDaemon();
+
+protected:
+
+    void addDependencyImpl(const StorePath & path) override;
+
+    /**
+     * Make a file owned by the builder.
+     *
+     * SAFETY: this function is prone to TOCTOU as it receives a path and not a descriptor.
+     * It's only safe to call in a child of a directory only visible to the owner.
+     */
+    void chownToBuilder(const std::filesystem::path & path);
+
+    /**
+     * Make a file owned by the builder addressed by its file descriptor.
+     *
+     * @param path Only used for error messages.
+     */
+    void chownToBuilder(int fd, const std::filesystem::path & path);
+
+    /**
+     * Create a file in `tmpDir` owned by the builder.
+     *
+     * @param Name must not contain more than one path segment and none of them must be `..`, `.`
+     * Otherwise this function throws an Error.
+     */
+    void writeBuilderFile(const std::string & name, std::string_view contents);
+
+    /**
+     * Arguments passed to runChild().
+     */
+    struct RunChildArgs
+    {
+#if NIX_WITH_AWS_AUTH
+        std::optional<AwsCredentials> awsCredentials;
+#endif
+    };
+
+    /**
+     * Run the builder's process.
+     */
+    void runChild(RunChildArgs args);
+
+    /**
+     * Move the current process into the chroot, if any. Called early
+     * by runChild().
+     */
+    virtual void enterChroot() {}
+
+    /**
+     * Change the current process's uid/gid to the build user, if
+     * any. Called by runChild().
+     */
+    virtual void setUser();
+
+    /**
+     * Execute the derivation builder process. Called by runChild() as
+     * its final step. Should not return unless there is an error.
+     */
+    virtual void execBuilder(const Strings & args, const Strings & envStrs);
+
+private:
+
+    /**
+     * Check that the derivation outputs all exist and register them
+     * as valid.
+     */
+    SingleDrvOutputs registerOutputs();
+
+    /**
+     * Check that the derivation outputs submitted by recursive-nix exist
+     * and attach them to the derivation
+     */
+    SingleDrvOutputs checkSubmittedOutputs();
+protected:
+
+    /**
+     * Delete the temporary directory, if we have one.
+     *
+     * @param force We know the build succeeded, so don't attempt to
+     * preserve anything for debugging.
+     */
+    virtual void cleanupBuild(bool force);
+
+    /**
+     * Kill any processes running under the build user UID or in the
+     * cgroup of the build.
+     */
+    virtual void killSandbox(bool getStats);
+
+public:
+
+    bool killChild() override;
+
+private:
+
+    bool decideWhetherDiskFull();
+
+    /**
+     * Create alternative path calculated from but distinct from the
+     * input, so we can avoid overwriting outputs (or other store paths)
+     * that already exist.
+     */
+    StorePath makeFallbackPath(const StorePath & path);
+
+    /**
+     * Make a path to another based on the output name along with the
+     * derivation hash.
+     *
+     * @todo Add option to randomize, so we can audit whether our
+     * rewrites caught everything
+     */
+    StorePath makeFallbackPath(OutputNameView outputName);
+};
+
+} // namespace nix
diff --git a/src/libstore/unix/build/derivation-builder.cc b/src/libstore/unix/build/derivation-builder.cc
index 85aa98c7ae87..d3e8133c0bfe 100644
--- a/src/libstore/unix/build/derivation-builder.cc
+++ b/src/libstore/unix/build/derivation-builder.cc
@@ -1,4 +1,5 @@
 #include "nix/store/build/derivation-builder.hh"
+#include "nix/util/configuration.hh"
 #include "nix/util/file-system-at.hh"
 #include "nix/util/file-system.hh"
 #include "nix/store/local-store.hh"
@@ -8,12 +9,11 @@
 #include "nix/util/util.hh"
 #include "nix/util/archive.hh"
 #include "nix/util/git.hh"
-#include "nix/store/daemon.hh"
 #include "nix/util/topo-sort.hh"
 #include "nix/store/build/child.hh"
 #include "nix/util/unix-domain-socket.hh"
 #include "nix/store/posix-fs-canonicalise.hh"
-#include "nix/util/posix-source-accessor.hh"
+#include "nix/util/source-accessor.hh"
 #include "nix/store/restricted-store.hh"
 #include "nix/store/user-lock.hh"
 #include "nix/store/globals.hh"
@@ -30,6 +30,7 @@
 #include <sys/socket.h>
 #ifdef __linux__
 #  include <sys/prctl.h>
+#  include "nix/util/linux-namespaces.hh"
 #endif
 
 #include "store-config-private.hh"
@@ -41,6 +42,8 @@
 #include <pwd.h>
 #include <grp.h>
 #include <iostream>
+#include <list>
+#include <atomic>
 
 #include "nix/util/strings.hh"
 #include "nix/util/signals.hh"
@@ -48,6 +51,20 @@
 #include "store-config-private.hh"
 #include "build/derivation-check.hh"
 
+#include "derivation-builder-impl.hh"
+
+#ifdef __linux__
+#  include "chroot-linux-derivation-builder.hh"
+#endif
+
+#ifdef __FreeBSD__
+#  include "chroot-freebsd-derivation-builder.hh"
+#endif
+
+#ifdef __APPLE__
+#  include "darwin-derivation-builder.hh"
+#endif
+
 #if NIX_WITH_AWS_AUTH
 #  include "nix/store/aws-creds.hh"
 #  include "nix/store/s3-url.hh"
@@ -56,8 +73,11 @@
 
 namespace nix {
 
-struct NotDeterministic final : CloneableError<NotDeterministic, BuildError>
+class NotDeterministic final : public CloneableError<NotDeterministic, BuildError>
 {
+    void anchor() override;
+
+public:
     NotDeterministic(auto &&... args)
         : CloneableError(BuildResult::Failure::NotDeterministic, args...)
     {
@@ -65,6 +85,8 @@ struct NotDeterministic final : CloneableError<NotDeterministic, BuildError>
     }
 };
 
+void NotDeterministic::anchor() {}
+
 void preserveDeathSignal(fun<void()> setCredentials)
 {
 #ifdef __linux__
@@ -96,390 +118,6 @@ void preserveDeathSignal(fun<void()> setCredentials)
 #endif
 }
 
-/**
- * This class represents the state for building locally.
- *
- * @todo Ideally, it would not be a class, but a single function.
- * However, besides the main entry point, there are a few more methods
- * which are externally called, and need to be gotten rid of. There are
- * also some virtual methods (either directly here or inherited from
- * `DerivationBuilderCallbacks`, a stop-gap) that represent outgoing
- * rather than incoming call edges that either should be removed, or
- * become (higher order) function parameters.
- */
-// FIXME: rename this to UnixDerivationBuilder or something like that.
-class DerivationBuilderImpl : public DerivationBuilder, public DerivationBuilderParams
-{
-protected:
-
-    /**
-     * The process ID of the builder.
-     */
-    Pid pid;
-
-    LocalStore & store;
-
-    const LocalSettings & localSettings = store.config->getLocalSettings();
-
-    std::unique_ptr<DerivationBuilderCallbacks> miscMethods;
-
-public:
-
-    DerivationBuilderImpl(
-        LocalStore & store, std::unique_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
-        : DerivationBuilderParams{std::move(params)}
-        , store{store}
-        , miscMethods{std::move(miscMethods)}
-        , derivationType{drv.type()}
-    {
-    }
-
-    /**
-     * Cleanup code to run when destroying any DerivationBuilderImpl implementation.
-     */
-    void cleanupOnDestruction() noexcept
-    {
-        /* Careful: we should never ever throw an exception from a
-           noexcept function. */
-        try {
-            killChild();
-        } catch (...) {
-            ignoreExceptionInDestructor();
-        }
-        try {
-            stopDaemon();
-        } catch (...) {
-            ignoreExceptionInDestructor();
-        }
-        try {
-            cleanupBuild(false);
-        } catch (...) {
-            ignoreExceptionInDestructor();
-        }
-    }
-
-protected:
-
-    /**
-     * User selected for running the builder.
-     */
-    std::unique_ptr<UserLock> buildUser;
-
-    /**
-     * The temporary directory used for the build.
-     */
-    std::filesystem::path tmpDir;
-
-    /**
-     * The top-level temporary directory. `tmpDir` is either equal to
-     * or a child of this directory.
-     */
-    std::filesystem::path topTmpDir;
-
-    /**
-     * The file descriptor of the temporary directory.
-     */
-    AutoCloseFD tmpDirFd;
-
-    /**
-     * The sort of derivation we are building.
-     *
-     * Just a cached value, computed from `drv`.
-     */
-    const DerivationType derivationType;
-
-    typedef StringMap Environment;
-    Environment env;
-
-    /**
-     * Hash rewriting.
-     */
-    StringMap inputRewrites, outputRewrites;
-    typedef std::map<StorePath, StorePath> RedirectedOutputs;
-    RedirectedOutputs redirectedOutputs;
-
-    /**
-     * The output paths used during the build.
-     *
-     * - Input-addressed derivations or fixed content-addressed outputs are
-     *   sometimes built when some of their outputs already exist, and can not
-     *   be hidden via sandboxing. We use temporary locations instead and
-     *   rewrite after the build. Otherwise the regular predetermined paths are
-     *   put here.
-     *
-     * - Floating content-addressing derivations do not know their final build
-     *   output paths until the outputs are hashed, so random locations are
-     *   used, and then renamed. The randomness helps guard against hidden
-     *   self-references.
-     */
-    OutputPathMap scratchOutputs;
-
-    const static std::filesystem::path homeDir;
-
-    /**
-     * The recursive Nix daemon socket.
-     */
-    AutoCloseFD daemonSocket;
-
-    /**
-     * The daemon main thread.
-     */
-    std::thread daemonThread;
-
-    /**
-     * The daemon worker threads.
-     */
-    std::vector<std::thread> daemonWorkerThreads;
-
-    const StorePathSet & originalPaths() override
-    {
-        return inputPaths;
-    }
-
-    bool isAllowed(const StorePath & path) override
-    {
-        return inputPaths.count(path) || addedPaths.count(path);
-    }
-
-    bool isAllowed(const DrvOutput & id) override
-    {
-        return addedDrvOutputs.count(id);
-    }
-
-    bool isAllowed(const DerivedPath & req);
-
-    friend struct RestrictedStore;
-
-    /**
-     * Whether we need to perform hash rewriting if there are valid output paths.
-     */
-    virtual bool needsHashRewrite()
-    {
-        return true;
-    }
-
-public:
-
-    std::optional<Descriptor> startBuild() override;
-
-    SingleDrvOutputs unprepareBuild() override;
-
-protected:
-
-    /**
-     * Acquire a build user lock. Return nullptr if no lock is available.
-     */
-    virtual std::unique_ptr<UserLock> getBuildUser()
-    {
-        return acquireUserLock(settings.nixStateDir, localSettings, 1, false);
-    }
-
-    /**
-     * Return the paths that should be made available in the sandbox.
-     * This includes:
-     *
-     * * The paths specified by the `sandbox-paths` setting, and their closure in the Nix store.
-     * * The contents of the `__impureHostDeps` derivation attribute, if the sandbox is in relaxed mode.
-     * * The paths returned by the `pre-build-hook`.
-     * * The paths in the input closure of the derivation.
-     */
-    PathsInChroot getPathsInSandbox();
-
-    virtual void setBuildTmpDir()
-    {
-        tmpDir = topTmpDir;
-    }
-
-    /**
-     * Return the path of the temporary directory in the sandbox.
-     */
-    virtual std::filesystem::path tmpDirInSandbox()
-    {
-        assert(!topTmpDir.empty());
-        return topTmpDir;
-    }
-
-    /**
-     * Ensure that there are no processes running that conflict with
-     * `buildUser`.
-     */
-    virtual void prepareUser()
-    {
-        killSandbox(false);
-    }
-
-    /**
-     * Called by prepareBuild() to do any setup in the parent to
-     * prepare for a sandboxed build.
-     */
-    virtual void prepareSandbox();
-
-    virtual Strings getPreBuildHookArgs()
-    {
-        return Strings({store.printStorePath(drvPath)});
-    }
-
-    virtual std::filesystem::path realPathInHost(const std::filesystem::path & p)
-    {
-        return store.toRealPath(store.parseStorePath(p.native()));
-    }
-
-    /**
-     * Open the slave side of the pseudoterminal and use it as stderr.
-     */
-    void openSlave();
-
-    /**
-     * Called by prepareBuild() to start the child process for the
-     * build. Must set `pid`. The child must call runChild().
-     */
-    virtual void startChild();
-
-#if NIX_WITH_AWS_AUTH
-    /**
-     * Pre-resolve AWS credentials for S3 URLs in builtin:fetchurl.
-     * This should be called before forking to ensure credentials are available in child.
-     * Returns the credentials if successfully resolved, or std::nullopt otherwise.
-     */
-    std::optional<AwsCredentials> preResolveAwsCredentials();
-#endif
-
-private:
-
-    /**
-     * Fill in the environment for the builder.
-     */
-    void initEnv();
-
-protected:
-
-    /**
-     * Process messages send by the sandbox initialization.
-     */
-    void processSandboxSetupMessages();
-
-private:
-
-    /**
-     * Start an in-process nix daemon thread for recursive-nix.
-     */
-    void startDaemon();
-
-    /**
-     * Stop the in-process nix daemon thread.
-     * @see startDaemon
-     */
-    void stopDaemon();
-
-protected:
-
-    void addDependencyImpl(const StorePath & path) override;
-
-    /**
-     * Make a file owned by the builder.
-     *
-     * SAFETY: this function is prone to TOCTOU as it receives a path and not a descriptor.
-     * It's only safe to call in a child of a directory only visible to the owner.
-     */
-    void chownToBuilder(const std::filesystem::path & path);
-
-    /**
-     * Make a file owned by the builder addressed by its file descriptor.
-     *
-     * @param path Only used for error messages.
-     */
-    void chownToBuilder(int fd, const std::filesystem::path & path);
-
-    /**
-     * Create a file in `tmpDir` owned by the builder.
-     *
-     * @param Name must not contain more than one path segment and none of them must be `..`, `.`
-     * Otherwise this function throws an Error.
-     */
-    void writeBuilderFile(const std::string & name, std::string_view contents);
-
-    /**
-     * Arguments passed to runChild().
-     */
-    struct RunChildArgs
-    {
-#if NIX_WITH_AWS_AUTH
-        std::optional<AwsCredentials> awsCredentials;
-#endif
-    };
-
-    /**
-     * Run the builder's process.
-     */
-    void runChild(RunChildArgs args);
-
-    /**
-     * Move the current process into the chroot, if any. Called early
-     * by runChild().
-     */
-    virtual void enterChroot() {}
-
-    /**
-     * Change the current process's uid/gid to the build user, if
-     * any. Called by runChild().
-     */
-    virtual void setUser();
-
-    /**
-     * Execute the derivation builder process. Called by runChild() as
-     * its final step. Should not return unless there is an error.
-     */
-    virtual void execBuilder(const Strings & args, const Strings & envStrs);
-
-private:
-
-    /**
-     * Check that the derivation outputs all exist and register them
-     * as valid.
-     */
-    SingleDrvOutputs registerOutputs();
-
-protected:
-
-    /**
-     * Delete the temporary directory, if we have one.
-     *
-     * @param force We know the build succeeded, so don't attempt to
-     * preserve anything for debugging.
-     */
-    virtual void cleanupBuild(bool force);
-
-    /**
-     * Kill any processes running under the build user UID or in the
-     * cgroup of the build.
-     */
-    virtual void killSandbox(bool getStats);
-
-public:
-
-    bool killChild() override;
-
-private:
-
-    bool decideWhetherDiskFull();
-
-    /**
-     * Create alternative path calculated from but distinct from the
-     * input, so we can avoid overwriting outputs (or other store paths)
-     * that already exist.
-     */
-    StorePath makeFallbackPath(const StorePath & path);
-
-    /**
-     * Make a path to another based on the output name along with the
-     * derivation hash.
-     *
-     * @todo Add option to randomize, so we can audit whether our
-     * rewrites caught everything
-     */
-    StorePath makeFallbackPath(OutputNameView outputName);
-};
-
 static void handleDiffHook(
     const std::filesystem::path & diffHook,
     uid_t uid,
@@ -499,8 +137,7 @@ static void handleDiffHook(
                 .gid = gid,
                 .chdir = "/"});
         if (!statusOk(diffRes.first))
-            throw ExecError(
-                diffRes.first, "diff-hook program %s %2%", PathFmt(diffHook), statusToString(diffRes.first));
+            throw ExecError(diffRes.first, "diff-hook program %s %s", PathFmt(diffHook), statusToString(diffRes.first));
 
         if (diffRes.second != "")
             printError(chomp(diffRes.second));
@@ -512,6 +149,8 @@ static void handleDiffHook(
     }
 }
 
+void DerivationBuilderImpl::anchor() {}
+
 const std::filesystem::path DerivationBuilderImpl::homeDir = "/homeless-shelter";
 
 void DerivationBuilderImpl::killSandbox(bool getStats)
@@ -572,7 +211,7 @@ SingleDrvOutputs DerivationBuilderImpl::unprepareBuild()
        root. */
     killSandbox(true);
 
-    /* Terminate the recursive Nix daemon. */
+    /* Terminate the recursive Nix daemons. */
     stopDaemon();
 
     if (buildResult.cpuUser && buildResult.cpuSystem) {
@@ -600,9 +239,14 @@ SingleDrvOutputs DerivationBuilderImpl::unprepareBuild()
         };
     }
 
-    /* Compute the FS closure of the outputs and register them as
-       being valid. */
-    auto builtOutputs = registerOutputs();
+    SingleDrvOutputs builtOutputs;
+    if (usingSubmitted) {
+        builtOutputs = checkSubmittedOutputs();
+    } else {
+        /* Compute the FS closure of the outputs and register them as
+           being valid. */
+        builtOutputs = registerOutputs();
+    }
 
     cleanupBuild(true);
 
@@ -686,10 +330,7 @@ bool DerivationBuilderImpl::decideWhetherDiskFull()
     return diskFull;
 }
 
-/**
- * Rethrow the current exception as a subclass of `Error`.
- */
-static void rethrowExceptionAsError()
+void rethrowExceptionAsError()
 {
     try {
         throw;
@@ -702,11 +343,7 @@ static void rethrowExceptionAsError()
     }
 }
 
-/**
- * Send the current exception to the parent in the format expected by
- * `DerivationBuilderImpl::processSandboxSetupMessages()`.
- */
-static void handleChildException(bool sendException)
+void handleChildException(bool sendException)
 {
     try {
         rethrowExceptionAsError();
@@ -837,7 +474,15 @@ std::optional<Descriptor> DerivationBuilderImpl::startBuild()
 
     /* Fire up a Nix daemon to process recursive Nix calls from the
        builder. */
-    if (drvOptions.getRequiredSystemFeatures(drv).count("recursive-nix"))
+    auto requiredFeatures = drvOptions.getRequiredSystemFeatures(drv);
+
+    usingSubmitted = requiredFeatures.count(drvFeatureBuilderRpcV0);
+
+    if (usingSubmitted && !drv.type().isCA()) {
+        throw Error("The builder-rpc-v0 feature may only be used with content-addressing derivations");
+    }
+
+    if (usingSubmitted || requiredFeatures.count("recursive-nix"))
         startDaemon();
 
     /* Run the builder. */
@@ -968,7 +613,7 @@ void DerivationBuilderImpl::openSlave()
 {
     std::string slaveName = getPtsName(builderOut.get());
 
-    AutoCloseFD builderOut = open(slaveName.c_str(), O_RDWR | O_NOCTTY);
+    AutoCloseFD builderOut = open(slaveName.c_str(), O_RDWR | O_NOCTTY | O_CLOEXEC);
     if (!builderOut)
         throw SysError("opening pseudoterminal slave");
 
@@ -1034,12 +679,12 @@ void DerivationBuilderImpl::processSandboxSetupMessages()
             try {
                 return readLine(builderOut.get());
             } catch (Error & e) {
-                auto status = pid.wait();
+                auto status = pid != -1 ? pid.wait() : 0;
                 e.addTrace(
                     {},
                     "while waiting for the build environment for '%s' to initialize (%s, previous messages: %s)",
                     store.printStorePath(drvPath),
-                    statusToString(status),
+                    status ? statusToString(status) : "no status",
                     concatStringsSep("|", msgs));
                 throw;
             }
@@ -1050,7 +695,7 @@ void DerivationBuilderImpl::processSandboxSetupMessages()
             FdSource source(builderOut.get());
             auto ex = readError(source);
             ex.addTrace({}, "while setting up the build environment");
-            throw ex;
+            throw std::move(ex);
         }
         debug("sandbox setup: " + msg);
         msgs.push_back(std::move(msg));
@@ -1152,7 +797,11 @@ void DerivationBuilderImpl::initEnv()
 
 void DerivationBuilderImpl::startDaemon()
 {
-    experimentalFeatureSettings.require(Xp::RecursiveNix);
+    if (usingSubmitted) {
+        experimentalFeatureSettings.require(Xp::DynamicDerivations);
+    } else {
+        experimentalFeatureSettings.require(Xp::RecursiveNix);
+    }
 
     auto store = makeRestrictedStore(
         [&] {
@@ -1165,7 +814,7 @@ void DerivationBuilderImpl::startDaemon()
         ref<LocalStore>(std::dynamic_pointer_cast<LocalStore>(this->store.shared_from_this())),
         *this);
 
-    addedPaths.clear();
+    state_.lock()->addedPaths.clear();
 
     auto socketName = ".nix-socket";
     std::filesystem::path socketPath = tmpDir / socketName;
@@ -1175,7 +824,14 @@ void DerivationBuilderImpl::startDaemon()
 
     chownToBuilder(socketPath);
 
-    daemonThread = std::thread([this, store]() {
+    daemon::RecursiveFlag recursiveFlag;
+    if (usingSubmitted) {
+        recursiveFlag = daemon::RecursiveFlag::RecursiveSubmitted;
+    } else {
+        recursiveFlag = daemon::RecursiveFlag::Recursive;
+    }
+
+    daemonThread = std::thread([this, store, recursiveFlag]() {
         while (true) {
 
             /* Accept a connection. */
@@ -1195,19 +851,41 @@ void DerivationBuilderImpl::startDaemon()
 
             debug("received daemon connection");
 
-            auto workerThread = std::thread([store, remote{std::move(remote)}]() {
+            auto doneFlag = make_ref<std::atomic_flag>();
+
+            auto workerThread = std::thread([this, doneFlag, store, remote{std::move(remote)}, recursiveFlag]() {
                 try {
-                    daemon::processConnection(
-                        store, FdSource(remote.get()), FdSink(remote.get()), NotTrusted, daemon::Recursive);
+                    miscMethods->processDaemonConnection(
+                        store, FdSource(remote.get()), FdSink(remote.get()), *this, recursiveFlag);
                     debug("terminated daemon connection");
                 } catch (const Interrupted &) {
                     debug("interrupted daemon connection");
-                } catch (SystemError &) {
+                } catch (...) {
+                    /* Swallow all exceptions to avoid crashing the the process (exceptions that escape from the thread
+                     * trigger std::terminate()). */
                     ignoreExceptionExceptInterrupt();
                 }
+
+                doneFlag->test_and_set(std::memory_order_relaxed);
             });
 
-            daemonWorkerThreads.push_back(std::move(workerThread));
+            daemonWorkerThreads.push_back(
+                DaemonWorkerState{
+                    .thread = std::move(workerThread),
+                    .done = std::move(doneFlag),
+                });
+
+            /* Prune threads eagerly to free up resources. Ideally we'd also limit the number of concurrent workers. */
+            for (auto it = daemonWorkerThreads.begin(), end = daemonWorkerThreads.end(); it != end;) {
+                auto & state = *it;
+                auto & thread = state.thread;
+                if (state.done->test(std::memory_order_relaxed) && thread.joinable()) {
+                    thread.join();
+                    it = daemonWorkerThreads.erase(it);
+                } else {
+                    ++it;
+                }
+            }
         }
 
         debug("daemon shutting down");
@@ -1236,9 +914,7 @@ void DerivationBuilderImpl::stopDaemon()
     if (daemonThread.joinable())
         daemonThread.join();
 
-    // FIXME: should prune worker threads more quickly.
-    // FIXME: shutdown the client socket to speed up worker termination.
-    for (auto & thread : daemonWorkerThreads)
+    for (auto & [thread, doneFlag] : daemonWorkerThreads)
         thread.join();
     daemonWorkerThreads.clear();
 
@@ -1246,10 +922,7 @@ void DerivationBuilderImpl::stopDaemon()
     daemonSocket.close();
 }
 
-void DerivationBuilderImpl::addDependencyImpl(const StorePath & path)
-{
-    addedPaths.insert(path);
-}
+void DerivationBuilderImpl::addDependencyImpl(const StorePath & path) {}
 
 void DerivationBuilderImpl::chownToBuilder(const std::filesystem::path & path)
 {
@@ -1345,7 +1018,7 @@ void DerivationBuilderImpl::runChild(RunChildArgs args)
         /* If this is a builtin builder, call it now. This should not return. */
         if (drv.isBuiltin()) {
             try {
-                logger = makeJSONLogger(getStandardError());
+                logger = makeJSONLogger(getStandardError()).release();
 
                 for (auto & e : drv.outputs)
                     ctx.outputs.insert_or_assign(e.first, store.printStorePath(scratchOutputs.at(e.first)));
@@ -1434,7 +1107,7 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
         referenceablePaths.insert(p);
     for (auto & i : scratchOutputs)
         referenceablePaths.insert(i.second);
-    for (auto & p : addedPaths)
+    for (auto & [p, _] : state_.lock()->addedPaths)
         referenceablePaths.insert(p);
 
     /* Check whether the output paths were created, and make all
@@ -1587,11 +1260,9 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
             [](auto & sorted) { return sorted; }},
         topoSortResult);
 
-    std::reverse(sortedOutputNames.begin(), sortedOutputNames.end());
-
     OutputPathMap finalOutputs;
 
-    for (auto & outputName : sortedOutputNames) {
+    for (auto & outputName : sortedOutputNames | std::views::reverse) {
         auto output = get(drv.outputs, outputName);
         auto scratchPath = get(scratchOutputs, outputName);
         assert(output && scratchPath);
@@ -1642,7 +1313,12 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
                     dumpPath(actualPath, rsink);
                     rsink.flush();
                 });
-                std::filesystem::path tmpPath = actualPath.native() + ".tmp";
+                /* Put the temporary copy in a directory inaccessible to the builder.
+                   actualPath might point inside the build chroot, which is controlled
+                   by the derivation builder. */
+                auto [rewriteTempDir, rewriteTempDirFd] = store.createTempDirInStore();
+                AutoDelete delRewriteTempDir(rewriteTempDir);
+                std::filesystem::path tmpPath = rewriteTempDir / "x";
                 restorePath(tmpPath, *source);
                 deletePath(actualPath);
                 movePath(tmpPath, actualPath);
@@ -1713,12 +1389,11 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
                     HashModuloSink caSink{outputHash.hashAlgo, oldHashPart};
                     auto fim = outputHash.method.getFileIngestionMethod();
                     dumpPath(
-                        {getFSSourceAccessor(), CanonPath(actualPath.native())}, caSink, (FileSerialisationMethod) fim);
+                        {makeFSSourceAccessor(actualPath), CanonPath::root}, caSink, (FileSerialisationMethod) fim);
                     return caSink.finish().hash;
                 }
                 case FileIngestionMethod::Git: {
-                    return git::dumpHash(outputHash.hashAlgo, {getFSSourceAccessor(), CanonPath(actualPath.native())})
-                        .hash;
+                    return git::dumpHash(outputHash.hashAlgo, {makeFSSourceAccessor(actualPath), CanonPath::root}).hash;
                 }
                 }
                 assert(false);
@@ -1740,7 +1415,7 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
 
             {
                 HashResult narHashAndSize = hashPath(
-                    {getFSSourceAccessor(), CanonPath(actualPath.native())},
+                    {makeFSSourceAccessor(actualPath), CanonPath::root},
                     FileSerialisationMethod::NixArchive,
                     HashAlgorithm::SHA256);
                 newInfo0.narHash = narHashAndSize.hash;
@@ -1762,8 +1437,10 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
                any stale writable file descriptors. Copy through the
                serialisation/deserialisation. TODO: Use copyRecursive here and
                make use of reflinking. */
-            auto source = sinkToSource([&](Sink & nextSink) { dumpPath(actualPath, nextSink); });
-            restorePath(tmpOutput, *source, store.config->getLocalSettings().fsyncStorePaths);
+            auto pathAccessor = makeFSSourceAccessor(actualPath);
+            RestoreSink restoreSink{store.config->getLocalSettings().fsyncStorePaths};
+            restoreSink.dstPath = tmpOutput;
+            copyRecursive(*pathAccessor, CanonPath::root, restoreSink, CanonPath::root);
             /* This makes it slightly harder to make sense of the control flow. The rule
                of thumb is that actualPath points to the current location of the stuff
                that we'll end up registering. */
@@ -1783,7 +1460,7 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
                             std::string{scratchPath->hashPart()}, std::string{requiredFinalPath.hashPart()});
                     rewriteOutput(outputRewrites);
                     HashResult narHashAndSize = hashPath(
-                        {getFSSourceAccessor(), CanonPath(actualPath.native())},
+                        {makeFSSourceAccessor(actualPath), CanonPath::root},
                         FileSerialisationMethod::NixArchive,
                         HashAlgorithm::SHA256);
                     ValidPathInfo newInfo0{requiredFinalPath, {store, narHashAndSize.hash}};
@@ -1850,7 +1527,23 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
         auto optFixedPath = output->path(store, drv.name, outputName);
         if (!optFixedPath || store.printStorePath(*optFixedPath) != finalDestPath) {
             assert(newInfo.ca);
-            dynamicOutputLock.lockPaths({store.toRealPath(newInfo.path)});
+
+            /* Don't wait on lock for the hash-mismatching fixed-output
+               derivation case, to avoid a deadlock in the case where a build
+               with the correct hash is in progress. */
+            bool locked = dynamicOutputLock.lockPaths({store.toRealPath(newInfo.path)}, "", !optFixedPath);
+
+            /* If we can't lock the correct path, clean up and bail now. */
+            if (!locked) {
+                debug(
+                    "failed to lock correct output path of %s, namely %s, not moving output",
+                    store.printStorePath(drvPath),
+                    PathFmt(store.toRealPath(newInfo.path)));
+                deletePath(actualPath);
+                /* Trigger the hash-mismatch error. */
+                checkCAOutput(store, drvPath, *output, newInfo, outputName);
+                unreachable();
+            }
         }
 
         /* Move files, if needed */
@@ -1959,7 +1652,7 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
 
     /* Apply output checks. This includes checking of the wanted vs got
        hash of fixed-outputs. */
-    checkOutputs(store, drvPath, drv.outputs, drvOptions.outputChecks, infos);
+    checkOutputs(store, drvPath, drv, drvOptions.outputChecks, infos);
 
     if (buildMode == bmCheck) {
         return {};
@@ -2005,6 +1698,62 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
     return builtOutputs;
 }
 
+SingleDrvOutputs DerivationBuilderImpl::checkSubmittedOutputs()
+{
+    // Submitted outputs from the recursive nix daemon
+    // It's fine to lock here since all other threads with the reference have been shut down.
+    auto submittedOutputs(this->submittedOutputs.lock());
+
+    SingleDrvOutputs builtOutputs;
+
+    std::map<std::string, ValidPathInfo> infos;
+
+    for (auto & [outputName, outputPath] : *submittedOutputs) {
+        infos.emplace(outputName, *store.queryPathInfo(outputPath));
+    }
+
+    // checkOutputs only performs checks that make sense for both submitting and non-submitting derivations,
+    // more verification steps needed afterward
+    checkOutputs(store, drvPath, drv, drvOptions.outputChecks, infos);
+
+    for (auto & [outputName, output] : drv.outputs) {
+        // For some reason cannot be moved to checkOutputs, needs debugging
+        if (!submittedOutputs->contains(outputName)) {
+            throw BuildError(
+                BuildResult::Failure::OutputRejected,
+                "builder for '%s' failed to submit output path for '%s'",
+                store.printStorePath(drvPath),
+                outputName);
+        }
+
+        // We should have already checked that the derivation is content-addressing in startBuild
+        // and that the outputs of a content-addressing derivation is content-addressed in checkOutputs.
+        // Add an assert here just in case, but it should never trigger.
+        assert(
+            std::get_if<DerivationOutput::CAFloating>(&output.raw)
+            || std::get_if<DerivationOutput::CAFixed>(&output.raw));
+
+        // No need to sign CA outputs, only the realisation matters
+        auto realisation = Realisation{
+            {
+                .outPath = *get(*submittedOutputs, outputName),
+            },
+            DrvOutput{
+                .drvPath = drvPath,
+                .outputName = outputName,
+            },
+        };
+
+        store.signRealisation(realisation);
+        store.registerDrvOutput(realisation);
+        builtOutputs.emplace(outputName, realisation);
+
+        // TODO: handle --check
+    }
+
+    return builtOutputs;
+}
+
 void DerivationBuilderImpl::cleanupBuild(bool force)
 {
     if (force) {
@@ -2064,13 +1813,6 @@ StorePath DerivationBuilderImpl::makeFallbackPath(const StorePath & path)
 
 } // namespace nix
 
-// FIXME: do this properly
-#include "chroot-derivation-builder.cc"
-#include "linux-derivation-builder.cc"
-#include "freebsd-derivation-builder.cc"
-#include "darwin-derivation-builder.cc"
-#include "external-derivation-builder.cc"
-
 namespace nix {
 
 void DerivationBuilderDeleter::operator()(DerivationBuilder * builder) noexcept
@@ -2087,7 +1829,7 @@ void DerivationBuilderDeleter::operator()(DerivationBuilder * builder) noexcept
 }
 
 std::unique_ptr<DerivationBuilder, DerivationBuilderDeleter> makeDerivationBuilder(
-    LocalStore & store, std::unique_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
+    LocalStore & store, std::shared_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
 {
     bool useSandbox = false;
     const LocalSettings & localSettings = store.config->getLocalSettings();
@@ -2138,25 +1880,22 @@ std::unique_ptr<DerivationBuilder, DerivationBuilderDeleter> makeDerivationBuild
         throw Error("feature 'uid-range' is only supported in sandboxed builds");
 
 #ifdef __APPLE__
-    return DerivationBuilderUnique(
-        new DarwinDerivationBuilder(store, std::move(miscMethods), std::move(params), useSandbox));
+    return DerivationBuilderUnique(new DarwinDerivationBuilder(store, miscMethods, std::move(params), useSandbox));
 #elif defined(__linux__)
     if (useSandbox)
-        return DerivationBuilderUnique(
-            new ChrootLinuxDerivationBuilder(store, std::move(miscMethods), std::move(params)));
+        return DerivationBuilderUnique(new ChrootLinuxDerivationBuilder(store, miscMethods, std::move(params)));
 
-    return DerivationBuilderUnique(new LinuxDerivationBuilder(store, std::move(miscMethods), std::move(params)));
+    return DerivationBuilderUnique(new LinuxDerivationBuilder(store, miscMethods, std::move(params)));
 #elif defined(__FreeBSD__)
     if (useSandbox)
-        return DerivationBuilderUnique(
-            new ChrootFreeBSDDerivationBuilder(store, std::move(miscMethods), std::move(params)));
+        return DerivationBuilderUnique(new ChrootFreeBSDDerivationBuilder(store, miscMethods, std::move(params)));
 
-    return DerivationBuilderUnique(new FreeBSDDerivationBuilder(store, std::move(miscMethods), std::move(params)));
+    return DerivationBuilderUnique(new FreeBSDDerivationBuilder(store, miscMethods, std::move(params)));
 #else
     if (useSandbox)
         throw Error("sandboxing builds is not supported on this platform");
 
-    return DerivationBuilderUnique(new DerivationBuilderImpl(store, std::move(miscMethods), std::move(params)));
+    return DerivationBuilderUnique(new DerivationBuilderImpl(store, miscMethods, std::move(params)));
 #endif
 }
 
diff --git a/src/libstore/unix/build/external-derivation-builder.cc b/src/libstore/unix/build/external-derivation-builder.cc
index 96301af1d906..01002accdc07 100644
--- a/src/libstore/unix/build/external-derivation-builder.cc
+++ b/src/libstore/unix/build/external-derivation-builder.cc
@@ -1,15 +1,20 @@
+#include "derivation-builder-impl.hh"
+#include "nix/store/build/child.hh"
+
 namespace nix {
 
+namespace {
+
 struct ExternalDerivationBuilder : DerivationBuilderImpl
 {
     ExternalBuilder externalBuilder;
 
     ExternalDerivationBuilder(
         LocalStore & store,
-        std::unique_ptr<DerivationBuilderCallbacks> miscMethods,
+        std::shared_ptr<DerivationBuilderCallbacks> miscMethods,
         DerivationBuilderParams params,
         ExternalBuilder externalBuilder)
-        : DerivationBuilderImpl(store, std::move(miscMethods), std::move(params))
+        : DerivationBuilderImpl(store, miscMethods, std::move(params))
         , externalBuilder(std::move(externalBuilder))
     {
         experimentalFeatureSettings.require(Xp::ExternalBuilders);
@@ -106,14 +111,15 @@ struct ExternalDerivationBuilder : DerivationBuilderImpl
     }
 };
 
+} // namespace
+
 DerivationBuilderUnique makeExternalDerivationBuilder(
     LocalStore & store,
-    std::unique_ptr<DerivationBuilderCallbacks> miscMethods,
+    std::shared_ptr<DerivationBuilderCallbacks> miscMethods,
     DerivationBuilderParams params,
     const ExternalBuilder & handler)
 {
-    return DerivationBuilderUnique(
-        new ExternalDerivationBuilder(store, std::move(miscMethods), std::move(params), handler));
+    return DerivationBuilderUnique(new ExternalDerivationBuilder(store, miscMethods, std::move(params), handler));
 }
 
 } // namespace nix
diff --git a/src/libstore/unix/build/freebsd-derivation-builder.cc b/src/libstore/unix/build/freebsd-derivation-builder.cc
deleted file mode 100644
index 58cb2e25bc9c..000000000000
--- a/src/libstore/unix/build/freebsd-derivation-builder.cc
+++ /dev/null
@@ -1,499 +0,0 @@
-#ifdef __FreeBSD__
-
-#  include "nix/util/freebsd-jail.hh"
-#  include "nix/util/util.hh"
-
-#  include <stdlib.h>
-#  include <string.h>
-
-#  include <db.h>
-#  include <pwd.h>
-#  include <sys/mount.h>
-#  include <netlink/netlink_snl.h>
-#  include <netlink/netlink_snl_route.h>
-#  include <net/if.h>
-#  include <sys/param.h>
-#  include <sys/jail.h>
-#  include <sys/sockio.h>
-#  include <jail.h>
-
-namespace nix {
-
-namespace {
-
-struct PasswordEntry
-{
-    std::string name;
-    uid_t uid;
-    gid_t gid;
-    std::string description;
-    std::filesystem::path home;
-    std::filesystem::path shell;
-};
-
-using UniqueDB = std::unique_ptr<::DB, decltype([](::DB * db) {
-                                     if (db)
-                                         (db->close)(db);
-                                 })>;
-
-// Database open flags from FreeBSD, in case they're necessary for compatibility
-static constexpr HASHINFO dbFlags = {
-    .bsize = 4096,
-    .ffactor = 32,
-    .nelem = 256,
-    .cachesize = 2 * 1024 * 1024,
-    .hash = nullptr,
-    .lorder = BIG_ENDIAN,
-};
-
-// Password database version
-// Version 4 has been current since 2003
-static const uint8_t dbVersion = 4;
-
-static void serializeString(std::vector<uint8_t> & buf, std::string const & str)
-{
-    buf.insert(buf.end(), str.begin(), str.end());
-    buf.push_back(0);
-}
-
-static void serializeInt(std::vector<uint8_t> & buf, uint32_t num)
-{
-    // Always big endian
-    buf.push_back((num >> 24) & 0xff);
-    buf.push_back((num >> 16) & 0xff);
-    buf.push_back((num >> 8) & 0xff);
-    buf.push_back((num >> 0) & 0xff);
-}
-
-static std::vector<uint8_t> byNameKey(std::string const & name)
-{
-    std::vector<uint8_t> buf{_PW_VERSIONED(_PW_KEYBYNAME, dbVersion)};
-    buf.reserve(1 + name.size());
-    // We can't use serializeString since that's null terminated
-    buf.insert(buf.end(), name.begin(), name.end());
-
-    return buf;
-}
-
-static std::vector<uint8_t> byNumKey(uint32_t num)
-{
-    std::vector<uint8_t> buf{_PW_VERSIONED(_PW_KEYBYNUM, dbVersion)};
-    serializeInt(buf, num);
-
-    return buf;
-}
-
-static std::vector<uint8_t> byUidKey(uid_t uid)
-{
-    std::vector<uint8_t> buf{_PW_VERSIONED(_PW_KEYBYUID, dbVersion)};
-    serializeInt(buf, uid);
-
-    return buf;
-}
-
-static void createPasswordFiles(std::filesystem::path & chrootRootDir, std::vector<PasswordEntry> & users)
-{
-    auto db =
-        UniqueDB(::dbopen((chrootRootDir / "etc/pwd.db").c_str(), O_CREAT | O_RDWR | O_EXCL, 0644, DB_HASH, &dbFlags));
-
-    if (!db)
-        throw SysError("could not create password database");
-
-    auto dbInsert = [&db](std::vector<uint8_t> keyBuf, std::vector<uint8_t> & valueBuf) {
-        DBT key = {keyBuf.data(), keyBuf.size()};
-        DBT value = {valueBuf.data(), valueBuf.size()};
-
-        if ((db->put)(db.get(), &key, &value, R_NOOVERWRITE) == -1) {
-            throw SysError("could not write to password database");
-        }
-    };
-
-    // Annoyingly DBT doesn't have const pointers so we need this whole shuffle
-    std::string versionKeyStr(_PWD_VERSION_KEY);
-    std::vector<uint8_t> versionKey(versionKeyStr.begin(), versionKeyStr.end());
-    std::vector<uint8_t> versionValue{dbVersion};
-    dbInsert(versionKey, versionValue);
-
-    for (const auto & [i, user] : enumerate(users)) {
-        // flags for non-empty fields
-        uint32_t fields = _PWF_NAME | _PWF_PASSWD | _PWF_UID | _PWF_GID | _PWF_GECOS | _PWF_DIR | _PWF_SHELL;
-
-        std::vector<uint8_t> buf;
-        serializeString(buf, user.name);
-        // pw_password is always "*" in the insecure database
-        serializeString(buf, std::string("*"));
-        serializeInt(buf, user.uid);
-        serializeInt(buf, user.gid);
-        // pw_change = 0 means no requirement to change password
-        serializeInt(buf, 0);
-        // pw_class is empty since we don't make a class database
-        serializeString(buf, std::string(""));
-        serializeString(buf, user.description);
-        serializeString(buf, user.home);
-        serializeString(buf, user.shell);
-        // pw_expire = 0 means password does not expire
-        serializeInt(buf, 0);
-        serializeInt(buf, fields);
-
-        dbInsert(byNameKey(user.name), buf);
-        // _PW_KEYBYNUM is 1-indexed
-        dbInsert(byNumKey(i + 1), buf);
-        dbInsert(byUidKey(user.uid), buf);
-    }
-
-    // FreeBSD libc doesn't use /etc/passwd, but some software might
-    std::string passwdContent;
-    for (const auto & user : users) {
-        passwdContent.append(
-            fmt("%s:*:%d:%d:%s:%s:%s\n",
-                user.name,
-                user.uid,
-                user.gid,
-                user.description,
-                user.home.native(),
-                user.shell.native()));
-    }
-
-    writeFile(chrootRootDir / "etc/passwd", passwdContent);
-
-    // No need to make /etc/master.passwd or /etc/spwd.db,
-    // our build user wouldn't be able to read them anyway
-}
-
-} // namespace
-
-struct FreeBSDDerivationBuilder : virtual DerivationBuilderImpl
-{
-    using DerivationBuilderImpl::DerivationBuilderImpl;
-};
-
-template<size_t N>
-struct iovec iovFromMutableBuffer(std::array<char, N> & array)
-{
-    return {
-        .iov_base = static_cast<void *>(array.data()),
-        .iov_len = N,
-    };
-}
-
-template<size_t N>
-struct iovec iovFromStaticSizedString(const char (&array)[N])
-{
-    return {
-        .iov_base = const_cast<void *>(static_cast<const void *>(array)),
-        .iov_len = N,
-    };
-}
-
-struct iovec iovFromDynamicSizeString(const std::string & s)
-{
-    return {
-        .iov_base = const_cast<void *>(static_cast<const void *>(s.c_str())),
-        .iov_len = s.length() + 1,
-    };
-}
-
-struct ChrootFreeBSDDerivationBuilder : ChrootDerivationBuilder, FreeBSDDerivationBuilder
-{
-    std::shared_ptr<AutoRemoveJail> autoDelJail = std::make_shared<AutoRemoveJail>();
-
-    ChrootFreeBSDDerivationBuilder(
-        LocalStore & store, std::unique_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
-        : DerivationBuilderImpl{store, std::move(miscMethods), std::move(params)}
-        , ChrootDerivationBuilder{store, std::move(miscMethods), std::move(params)}
-        , FreeBSDDerivationBuilder{store, std::move(miscMethods), std::move(params)}
-    {
-    }
-
-    virtual void cleanupBuild(bool force) override
-    {
-        autoDelJail->remove();
-        ChrootDerivationBuilder::cleanupBuild(force);
-    }
-
-    void prepareSandbox() override
-    {
-        ChrootDerivationBuilder::prepareSandbox();
-
-        std::vector<PasswordEntry> users{
-            {
-                .name = "root",
-                .uid = 0,
-                .gid = 0,
-                .description = "Nix build user",
-                .home = store.config->getLocalSettings().sandboxBuildDir,
-                .shell = "/noshell",
-            },
-            {
-                .name = "nixbld",
-                .uid = buildUser->getUID(),
-                .gid = sandboxGid(),
-                .description = "Nix build user",
-                .home = store.config->getLocalSettings().sandboxBuildDir,
-                .shell = "/noshell",
-            },
-            {
-                .name = "nobody",
-                .uid = 65534,
-                .gid = 65534,
-                .description = "Nobody",
-                .home = "/",
-                .shell = "/noshell",
-            },
-        };
-
-        createPasswordFiles(chrootRootDir, users);
-
-        // FreeBSD doesn't have a group database, just write a text file
-        writeFile(
-            chrootRootDir / "etc/group",
-            fmt("root:x:0:\n"
-                "nixbld:!:%1%:\n"
-                "nogroup:x:65534:\n",
-                sandboxGid()));
-
-        // Linux waits until after entering the child to start mounting so it doesn't
-        // pollute the root mount namespace.
-        // FreeBSD doesn't have mount namespaces, so there's no reason to wait.
-
-        auto devpath = chrootRootDir / "dev";
-        createDir(devpath, 0555);
-        createDir(chrootRootDir / "bin", 0555);
-
-        std::array<char, 255> errmsg{};
-        std::array<::iovec, 8> iov = {
-            iovFromStaticSizedString("fstype"),
-            iovFromStaticSizedString("devfs"),
-            iovFromStaticSizedString("fspath"),
-            iovFromDynamicSizeString(devpath.native()),
-            iovFromStaticSizedString("ruleset"),
-            iovFromStaticSizedString("4"),
-            iovFromStaticSizedString("errmsg"),
-            iovFromMutableBuffer(errmsg),
-        };
-
-        if (nmount(iov.data(), iov.size(), 0) < 0)
-            throw SysError("failed to mount jail /dev: %1%", std::string_view(errmsg.data()));
-
-        autoDelJail->childrenMounts.emplace_back(devpath);
-
-        for (const auto & [target, chrootPath] : pathsInChroot) {
-            std::filesystem::path path = chrootRootDir / target.relative_path();
-
-            auto maybeSt = maybeLstat(chrootPath.source);
-            if (!maybeSt) {
-                if (chrootPath.optional)
-                    continue; /* Skip mounting this path. */
-                else
-                    throw SysError("getting attributes of path %1%", PathFmt(chrootPath.source));
-            }
-
-            /* Mount points must exist and be the right type. */
-            if (S_ISDIR(maybeSt->st_mode)) {
-                createDirs(path);
-            } else if (S_ISLNK(maybeSt->st_mode)) {
-                createDirs(path.parent_path());
-                copyFile(chrootPath.source, path, /*andDelete=*/false, /*contents=*/false);
-                continue;
-            } else {
-                createDirs(path.parent_path());
-                writeFile(path, "");
-            }
-
-            std::array<::iovec, 8> iov = {
-                iovFromStaticSizedString("fstype"),
-                iovFromStaticSizedString("nullfs"),
-                iovFromStaticSizedString("fspath"),
-                iovFromDynamicSizeString(path.native()),
-                iovFromStaticSizedString("target"),
-                iovFromDynamicSizeString(chrootPath.source.native()),
-                iovFromStaticSizedString("errmsg"),
-                iovFromMutableBuffer(errmsg),
-            };
-
-            debug("setting up a nullfs mount from %1% to %2%", PathFmt(chrootPath.source), PathFmt(path));
-
-            int flags = 0;
-            if (store.isInStore(target.native()))
-                /* While we are at it, enforce invariants about store paths. Anything located at the "logical" store
-                   location must be readonly (file permission canonicalisation enforces this on the host filesystem).
-                   Also the store must never contain setuid binaries for the same reason. This is just defense-in-depth.
-                 */
-                flags = MNT_RDONLY | MNT_NOSUID;
-
-            if (nmount(iov.data(), iov.size(), flags) < 0)
-                throw SysError("failed to mount nullfs for %1%: %2%", PathFmt(path), std::string_view(errmsg.data()));
-
-            autoDelJail->childrenMounts.emplace_back(path);
-        }
-
-        /* Fixed-output derivations typically need to access the
-           network, so give them access to /etc/resolv.conf and so
-           on. */
-        if (!derivationType.isSandboxed()) {
-            // Only use nss functions to resolve hosts and
-            // services. Don’t use it for anything else that may
-            // be configured for this system. This limits the
-            // potential impurities introduced in fixed-outputs.
-            writeFile(chrootRootDir / "etc/nsswitch.conf", "hosts: files dns\nservices: files\n");
-
-            /* N.B. it is realistic that these paths might not exist. It
-               happens when testing Nix building fixed-output derivations
-               within a pure derivation. */
-            for (std::filesystem::path path : {"/etc/resolv.conf", "/etc/services", "/etc/hosts"}) {
-                if (pathExists(path)) {
-                    // This means if your network config changes during a FOD build,
-                    // the DNS in the sandbox will be wrong. However, this is pretty unlikely
-                    // to actually be a problem, because FODs are generally pretty fast,
-                    // and machines with often-changing network configurations probably
-                    // want to run resolved or some other local resolver anyway.
-                    //
-                    // There's also just no simple way to do this correctly, you have to manually
-                    // inotify watch the files for changes on the outside and update the sandbox
-                    // while the build is running (or at least that's what Flatpak does).
-                    //
-                    // I also just generally feel icky about modifying sandbox state under a build,
-                    // even though it really shouldn't be a big deal. -K900
-                    copyFile(path, chrootRootDir / path.relative_path(), false, true);
-                }
-            }
-
-            if (fileTransferSettings.caFile.get() && pathExists(fileTransferSettings.caFile.get().value())) {
-                // For the same reasons as above, copy the CA certificates file too.
-                // It should be even less likely to change during the build than resolv.conf.
-                createDirs(chrootRootDir / "etc/ssl/certs");
-                copyFile(
-                    fileTransferSettings.caFile.get().value(),
-                    chrootRootDir / "etc/ssl/certs/ca-certificates.crt",
-                    false,
-                    true);
-            }
-        }
-    }
-
-    void startChild() override
-    {
-        int jid;
-
-        RunChildArgs args{
-#  if NIX_WITH_AWS_AUTH
-            .awsCredentials = preResolveAwsCredentials(),
-#  endif
-        };
-
-        if (derivationType.isSandboxed()) {
-            jid = jail_setv(
-                JAIL_CREATE,
-                "persist",
-                "true",
-                "path",
-                chrootRootDir.c_str(),
-                "host.hostname",
-                "localhost",
-                // TODO: Make our own ruleset
-                "vnet",
-                "new",
-                nullptr);
-            if (jid < 0) {
-                throw SysError("failed to create jail (isolated network): %1%", jail_errmsg);
-            }
-            autoDelJail->jid = jid;
-
-            // Everything from here to the end of the block is setting up the network
-            // code adapted from freebsd/sbin/ifconfig/af_inet.c, in_exec_nl
-            Pid helper = startProcess([&]() {
-                unix::closeExtraFDs();
-                enterChroot();
-
-                struct snl_state ss = {};
-                if (!snl_init(&ss, NETLINK_ROUTE)) {
-                    throw SysError("Failed to init netlink connection");
-                }
-
-                struct snl_writer nw = {};
-                snl_init_writer(&ss, &nw);
-                struct nlmsghdr * hdr = snl_create_msg_request(&nw, NL_RTM_NEWADDR);
-                struct ifaddrmsg * ifahdr = snl_reserve_msg_object(&nw, struct ifaddrmsg);
-
-                ifahdr->ifa_family = AF_INET;
-                ifahdr->ifa_prefixlen = 8;
-                ifahdr->ifa_index = if_nametoindex("lo0");
-                snl_add_msg_attr_ip4(&nw, IFA_LOCAL, (const struct in_addr *) "\x7f\x00\x00\x01");
-
-                int off = snl_add_msg_attr_nested(&nw, IFA_FREEBSD);
-                snl_add_msg_attr_u32(&nw, IFAF_FLAGS, IFF_LOOPBACK | IFF_UP);
-                snl_end_attr_nested(&nw, off);
-
-                if (!(hdr = snl_finalize_msg(&nw)) || !snl_send_message(&ss, hdr)) {
-                    snl_free(&ss);
-                    throw SysError("failed to sendoff netlink message");
-                }
-
-                struct snl_errmsg_data e = {};
-                snl_read_reply_code(&ss, hdr->nlmsg_seq, &e);
-                if (e.error_str != nullptr) {
-                    snl_free(&ss);
-                    throw SysError("failed to configure loopback interface: %1%", e.error_str);
-                }
-                snl_free(&ss);
-                _exit(0);
-            });
-
-            /* TODO: Capture the error from the helper? */
-            if (auto status = helper.wait(); !statusOk(status)) {
-                throw Error("failed to configure loopback address: %s", statusToString(status));
-            }
-        } else {
-            jid = jail_setv(
-                JAIL_CREATE,
-                "persist",
-                "true",
-                // 4 is the most restrictive devfs ruleset that meets our needs
-                // which is found in the default installation. Trying to add
-                // another one is a huge pain...
-                "devfs_ruleset",
-                "4",
-                "path",
-                chrootRootDir.c_str(),
-                "host.hostname",
-                "localhost",
-                "ip4",
-                "inherit",
-                "ip6",
-                "inherit",
-                "allow.raw_sockets",
-                "true",
-                nullptr);
-            if (jid < 0) {
-                throw SysError("failed to create jail (networked): %1%", jail_errmsg);
-            }
-            autoDelJail->jid = jid;
-        }
-
-        pid = startProcess([&]() {
-            openSlave();
-            runChild(args);
-        });
-    }
-
-    void enterChroot() override
-    {
-        /* Close all other file descriptors. This must happen before
-           jail_attach for FreeBSD. */
-        unix::closeExtraFDs();
-
-        if (jail_attach(autoDelJail->jid) < 0) {
-            throw SysError("failed to attach to jail");
-        }
-    }
-
-    void addDependency(const StorePath & path)
-    {
-        throw UnimplementedError(
-            "adding store path '%s' to the sandbox is not implemented (recursive-nix)", store.printStorePath(path));
-    }
-};
-
-} // namespace nix
-
-#endif
diff --git a/src/libstore/unix/build/hook-instance.cc b/src/libstore/unix/build/hook-instance.cc
index 64c541e3a9f9..be68f3044331 100644
--- a/src/libstore/unix/build/hook-instance.cc
+++ b/src/libstore/unix/build/hook-instance.cc
@@ -4,8 +4,6 @@
 #include "nix/util/strings.hh"
 #include "nix/util/executable-path.hh"
 
-using namespace std::chrono_literals;
-
 namespace nix {
 
 HookInstance::HookInstance(const Strings & _buildHook)
@@ -72,6 +70,8 @@ HookInstance::HookInstance(const Strings & _buildHook)
         throw SysError("executing %s", PathFmt(buildHook));
     });
 
+    using namespace std::chrono_literals;
+
     /* Give custom build hooks the chance to cleanup. */
     pid.setKillSignal(SIGTERM);
     pid.setKillTimeout(500ms);
diff --git a/src/libstore/unix/build/linux-derivation-builder.cc b/src/libstore/unix/build/linux-derivation-builder.cc
deleted file mode 100644
index 0bc32a91e648..000000000000
--- a/src/libstore/unix/build/linux-derivation-builder.cc
+++ /dev/null
@@ -1,867 +0,0 @@
-#ifdef __linux__
-
-#  include "store-config-private.hh"
-
-#  include "nix/store/globals.hh"
-#  include "nix/store/personality.hh"
-#  include "nix/store/filetransfer.hh"
-#  include "nix/util/cgroup.hh"
-#  include "nix/util/linux-namespaces.hh"
-#  include "nix/util/logging.hh"
-#  include "nix/util/serialise.hh"
-#  include "linux/fchmodat2-compat.hh"
-
-#  include <algorithm>
-#  include <string_view>
-#  include <cstdint>
-
-#  include <sys/ioctl.h>
-#  include <net/if.h>
-#  include <netinet/ip.h>
-#  include <sys/mman.h>
-#  include <sched.h>
-#  include <sys/param.h>
-#  include <sys/mount.h>
-#  include <sys/syscall.h>
-#  include <sys/prctl.h>
-
-#  if HAVE_SECCOMP
-#    include <seccomp.h>
-#  endif
-
-#  if HAVE_LANDLOCK
-#    include <linux/landlock.h>
-#  endif
-
-#  define pivot_root(new_root, put_old) (syscall(SYS_pivot_root, new_root, put_old))
-
-namespace nix {
-
-static void setupSeccomp(const LocalSettings & localSettings)
-{
-    if (!localSettings.filterSyscalls)
-        return;
-
-#  if HAVE_SECCOMP
-    scmp_filter_ctx ctx;
-
-    if (!(ctx = seccomp_init(SCMP_ACT_ALLOW)))
-        throw SysError("unable to initialize seccomp mode 2");
-
-    Finally cleanup([&]() { seccomp_release(ctx); });
-
-    constexpr std::string_view nativeSystem = NIX_LOCAL_SYSTEM;
-
-    if (nativeSystem == "x86_64-linux" && seccomp_arch_add(ctx, SCMP_ARCH_X86) != 0)
-        throw SysError("unable to add 32-bit seccomp architecture");
-
-    if (nativeSystem == "x86_64-linux" && seccomp_arch_add(ctx, SCMP_ARCH_X32) != 0)
-        throw SysError("unable to add X32 seccomp architecture");
-
-    if (nativeSystem == "aarch64-linux" && seccomp_arch_add(ctx, SCMP_ARCH_ARM) != 0)
-        printError(
-            "unable to add ARM seccomp architecture; this may result in spurious build failures if running 32-bit ARM processes");
-
-    if (nativeSystem == "mips64-linux" && seccomp_arch_add(ctx, SCMP_ARCH_MIPS) != 0)
-        printError("unable to add mips seccomp architecture");
-
-    if (nativeSystem == "mips64-linux" && seccomp_arch_add(ctx, SCMP_ARCH_MIPS64N32) != 0)
-        printError("unable to add mips64-*abin32 seccomp architecture");
-
-    if (nativeSystem == "mips64el-linux" && seccomp_arch_add(ctx, SCMP_ARCH_MIPSEL) != 0)
-        printError("unable to add mipsel seccomp architecture");
-
-    if (nativeSystem == "mips64el-linux" && seccomp_arch_add(ctx, SCMP_ARCH_MIPSEL64N32) != 0)
-        printError("unable to add mips64el-*abin32 seccomp architecture");
-
-    /* Prevent builders from creating setuid/setgid binaries. */
-    for (int perm : {S_ISUID, S_ISGID}) {
-        if (seccomp_rule_add(
-                ctx,
-                SCMP_ACT_ERRNO(EPERM),
-                SCMP_SYS(chmod),
-                1,
-                SCMP_A1(SCMP_CMP_MASKED_EQ, (scmp_datum_t) perm, (scmp_datum_t) perm))
-            != 0)
-            throw SysError("unable to add seccomp rule");
-
-        if (seccomp_rule_add(
-                ctx,
-                SCMP_ACT_ERRNO(EPERM),
-                SCMP_SYS(fchmod),
-                1,
-                SCMP_A1(SCMP_CMP_MASKED_EQ, (scmp_datum_t) perm, (scmp_datum_t) perm))
-            != 0)
-            throw SysError("unable to add seccomp rule");
-
-        if (seccomp_rule_add(
-                ctx,
-                SCMP_ACT_ERRNO(EPERM),
-                SCMP_SYS(fchmodat),
-                1,
-                SCMP_A2(SCMP_CMP_MASKED_EQ, (scmp_datum_t) perm, (scmp_datum_t) perm))
-            != 0)
-            throw SysError("unable to add seccomp rule");
-
-        if (seccomp_rule_add(
-                ctx,
-                SCMP_ACT_ERRNO(EPERM),
-                NIX_SYSCALL_FCHMODAT2,
-                1,
-                SCMP_A2(SCMP_CMP_MASKED_EQ, (scmp_datum_t) perm, (scmp_datum_t) perm))
-            != 0)
-            throw SysError("unable to add seccomp rule");
-    }
-
-    /* Prevent builders from using EAs or ACLs. Not all filesystems
-       support these, and they're not allowed in the Nix store because
-       they're not representable in the NAR serialisation. */
-    if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(getxattr), 0) != 0
-        || seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(lgetxattr), 0) != 0
-        || seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(fgetxattr), 0) != 0
-        || seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(setxattr), 0) != 0
-        || seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(lsetxattr), 0) != 0
-        || seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(fsetxattr), 0) != 0)
-        throw SysError("unable to add seccomp rule");
-
-    if (seccomp_attr_set(ctx, SCMP_FLTATR_CTL_NNP, localSettings.allowNewPrivileges ? 0 : 1) != 0)
-        throw SysError("unable to set 'no new privileges' seccomp attribute");
-
-    if (seccomp_load(ctx) != 0)
-        throw SysError("unable to load seccomp BPF program");
-#  else
-    throw Error(
-        "seccomp is not supported on this platform; "
-        "you can bypass this error by setting the option 'filter-syscalls' to false, but note that untrusted builds can then create setuid binaries!");
-#  endif
-}
-
-#  if HAVE_LANDLOCK && defined(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET)
-
-#    define DO_LANDLOCK 1
-
-/* We are using LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET on best-effort basis. There are no glibc wrappers for now. */
-
-static int landlockCreateRuleset(const ::landlock_ruleset_attr * attr, std::size_t size, std::uint32_t flags)
-{
-    return ::syscall(__NR_landlock_create_ruleset, attr, size, flags);
-}
-
-static int landlockRestrictSelf(Descriptor rulesetFd, std::uint32_t flags)
-{
-    return ::syscall(__NR_landlock_restrict_self, rulesetFd, flags);
-}
-
-static int getLandlockAbiVersion()
-{
-    int abiVersion = landlockCreateRuleset(nullptr, 0, LANDLOCK_CREATE_RULESET_VERSION);
-    return abiVersion;
-}
-
-static void setupLandlock()
-{
-    bool landlockSupportsScopeAbstractUnixSocket = []() {
-        int abiVersion = getLandlockAbiVersion();
-        if (abiVersion >= 6)
-            /* All good, we can use LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET. See
-               https://docs.kernel.org/userspace-api/landlock.html#abstract-unix-socket-abi-6 */
-            return true;
-
-        if (abiVersion == -1) {
-            debug("landlock is not available");
-            return false;
-        }
-
-        debug("landlock version %d does not support LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET", abiVersion);
-        return false;
-    }();
-
-    /* Bail out early if landlock is not enabled or LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET wouldn't work.
-       TODO: Consider adding more landlock rules for filesystem access as defense-in-depth on top. */
-    if (!landlockSupportsScopeAbstractUnixSocket)
-        return;
-
-    ::landlock_ruleset_attr attr = {
-        /* This prevents multiple FODs from communicating with each other
-           via abstract sockets. Note that cooperating processes outside the
-           sandbox can still connect to an abstract socket created by the FOD. To
-           mitigate that issue entirely we'd still need network namespaces. */
-        .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET,
-    };
-
-    /* This better not fail - if the kernel reports a new enough ABI version we
-       should treat any errors as fatal from now on. */
-    AutoCloseFD rulesetFd = landlockCreateRuleset(&attr, sizeof(attr), 0);
-    if (!rulesetFd)
-        throw SysError("failed to create a landlock ruleset");
-
-    if (landlockRestrictSelf(rulesetFd.get(), 0) == -1)
-        throw SysError("failed to apply landlock");
-
-    debug("applied landlock sandboxing");
-}
-
-#  else
-
-#    define DO_LANDLOCK 0
-
-#  endif
-
-static void doBind(const std::filesystem::path & source, const std::filesystem::path & target, bool optional = false)
-{
-    debug("bind mounting %1% to %2%", PathFmt(source), PathFmt(target));
-
-    auto bindMount = [&]() {
-        if (mount(source.c_str(), target.c_str(), "", MS_BIND | MS_REC, 0) == -1)
-            throw SysError("bind mount from %1% to %2% failed", PathFmt(source), PathFmt(target));
-    };
-
-    auto maybeSt = maybeLstat(source);
-    if (!maybeSt) {
-        if (optional)
-            return;
-        else
-            throw SysError("getting attributes of path %1%", PathFmt(source));
-    }
-    auto st = *maybeSt;
-
-    if (S_ISDIR(st.st_mode)) {
-        createDirs(target);
-        bindMount();
-    } else if (S_ISLNK(st.st_mode)) {
-        // Symlinks can (apparently) not be bind-mounted, so just copy it
-        createDirs(target.parent_path());
-        copyFile(source, target, false);
-    } else {
-        createDirs(target.parent_path());
-        writeFile(target, "");
-        bindMount();
-    }
-}
-
-struct LinuxDerivationBuilder : virtual DerivationBuilderImpl
-{
-    using DerivationBuilderImpl::DerivationBuilderImpl;
-
-    void enterChroot() override
-    {
-        auto & localSettings = store.config->getLocalSettings();
-
-        /* Set the NO_NEW_PRIVS before doing seccomp/landlock setup.
-           landlock_restrict_self requires either NO_NEW_PRIVS or CAP_SYS_ADMIN.
-           With user namespaces we do get CAP_SYS_ADMIN. */
-        if (!localSettings.allowNewPrivileges)
-            if (::prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
-                throw SysError("failed to set PR_SET_NO_NEW_PRIVS");
-
-        setupSeccomp(localSettings);
-
-#  if DO_LANDLOCK
-        try {
-            setupLandlock();
-        } catch (SysError & e) {
-            if (e.errNo != EPERM)
-                throw;
-            /* If allowNewPrivileges is true and we don't have CAP_SYS_ADMIN
-               this code path might be hit. */
-            warn("setting up landlock: %s", e.message());
-        }
-#  endif
-
-        linux::setPersonality({
-            .system = drv.platform,
-            .impersonateLinux26 = localSettings.impersonateLinux26,
-        });
-    }
-};
-
-static const std::filesystem::path procPath = "/proc";
-
-struct ChrootLinuxDerivationBuilder : ChrootDerivationBuilder, LinuxDerivationBuilder
-{
-    /**
-     * Pipe for synchronising updates to the builder namespaces.
-     */
-    Pipe userNamespaceSync;
-
-    /**
-     * The mount namespace and user namespace of the builder, used to add additional
-     * paths to the sandbox as a result of recursive Nix calls.
-     */
-    AutoCloseFD sandboxMountNamespace;
-    AutoCloseFD sandboxUserNamespace;
-
-    /**
-     * On Linux, whether we're doing the build in its own user
-     * namespace.
-     */
-    bool usingUserNamespace = true;
-
-    /**
-     * The cgroup of the builder, if any.
-     */
-    std::optional<std::filesystem::path> cgroup;
-
-    ChrootLinuxDerivationBuilder(
-        LocalStore & store, std::unique_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
-        : DerivationBuilderImpl{store, std::move(miscMethods), std::move(params)}
-        , ChrootDerivationBuilder{store, std::move(miscMethods), std::move(params)}
-        , LinuxDerivationBuilder{store, std::move(miscMethods), std::move(params)}
-    {
-    }
-
-    uid_t sandboxUid()
-    {
-        return usingUserNamespace ? (!buildUser || buildUser->getUIDCount() == 1 ? 1000 : 0) : buildUser->getUID();
-    }
-
-    gid_t sandboxGid() override
-    {
-        return usingUserNamespace ? (!buildUser || buildUser->getUIDCount() == 1 ? 100 : 0)
-                                  : ChrootDerivationBuilder::sandboxGid();
-    }
-
-    std::unique_ptr<UserLock> getBuildUser() override
-    {
-        return acquireUserLock(
-            settings.nixStateDir, store.config->getLocalSettings(), drvOptions.useUidRange(drv) ? 65536 : 1, true);
-    }
-
-    void prepareUser() override
-    {
-        if ((buildUser && buildUser->getUIDCount() != 1) || store.config->getLocalSettings().useCgroups) {
-            experimentalFeatureSettings.require(Xp::Cgroups);
-
-            /* If we're running from the daemon, then this will return the
-               root cgroup of the service. Otherwise, it will return the
-               current cgroup. */
-            auto cgroupFS = linux::getCgroupFS();
-            if (!cgroupFS)
-                throw Error("cannot determine the cgroups file system");
-            auto rootCgroupPath = *cgroupFS / linux::getRootCgroup().rel();
-            if (!pathExists(rootCgroupPath))
-                throw Error("expected cgroup directory %s", PathFmt(rootCgroupPath));
-
-            static std::atomic<unsigned int> counter{0};
-
-            cgroup = rootCgroupPath
-                     / (buildUser ? fmt("nix-build-uid-%d", buildUser->getUID())
-                                  : fmt("nix-build-pid-%d-%d", getpid(), counter++));
-
-            debug("using cgroup %s", PathFmt(*cgroup));
-
-            /* When using a build user, record the cgroup we used for that
-               user so that if we got interrupted previously, we can kill
-               any left-over cgroup first. */
-            if (buildUser) {
-                auto cgroupsDir = std::filesystem::path{settings.nixStateDir} / "cgroups";
-                createDirs(cgroupsDir);
-
-                auto cgroupFile = cgroupsDir / std::to_string(buildUser->getUID());
-
-                if (pathExists(cgroupFile)) {
-                    auto prevCgroup = readFile(cgroupFile);
-                    linux::destroyCgroup(prevCgroup);
-                }
-
-                writeFile(cgroupFile, cgroup->native());
-            }
-        }
-
-        // Kill any processes left in the cgroup or build user.
-        DerivationBuilderImpl::prepareUser();
-    }
-
-    void prepareSandbox() override
-    {
-        ChrootDerivationBuilder::prepareSandbox();
-
-        if (cgroup) {
-            if (mkdir(cgroup->c_str(), 0755) != 0)
-                throw SysError("creating cgroup %s", PathFmt(*cgroup));
-            chownToBuilder(*cgroup);
-            chownToBuilder(*cgroup / "cgroup.procs");
-            chownToBuilder(*cgroup / "cgroup.threads");
-            // chownToBuilder(*cgroup / "cgroup.subtree_control");
-        }
-    }
-
-    void startChild() override
-    {
-        RunChildArgs args{
-#  if NIX_WITH_AWS_AUTH
-            .awsCredentials = preResolveAwsCredentials(),
-#  endif
-        };
-
-        /* Set up private namespaces for the build:
-
-           - The PID namespace causes the build to start as PID 1.
-             Processes outside of the chroot are not visible to those
-             on the inside, but processes inside the chroot are
-             visible from the outside (though with different PIDs).
-
-           - The private mount namespace ensures that all the bind
-             mounts we do will only show up in this process and its
-             children, and will disappear automatically when we're
-             done.
-
-           - The private network namespace ensures that the builder
-             cannot talk to the outside world (or vice versa).  It
-             only has a private loopback interface. (Fixed-output
-             derivations are not run in a private network namespace
-             to allow functions like fetchurl to work.)
-
-           - The IPC namespace prevents the builder from communicating
-             with outside processes using SysV IPC mechanisms (shared
-             memory, message queues, semaphores).  It also ensures
-             that all IPC objects are destroyed when the builder
-             exits.
-
-           - The UTS namespace ensures that builders see a hostname of
-             localhost rather than the actual hostname.
-
-           We use a helper process to do the clone() to work around
-           clone() being broken in multi-threaded programs due to
-           at-fork handlers not being run. Note that we use
-           CLONE_PARENT to ensure that the real builder is parented to
-           us.
-        */
-
-        userNamespaceSync.create();
-
-        usingUserNamespace = userNamespacesSupported();
-
-        Pipe sendPid;
-        sendPid.create();
-
-        Pid helper = startProcess([&]() {
-            sendPid.readSide.close();
-
-            /* We need to open the slave early, before
-               CLONE_NEWUSER. Otherwise we get EPERM when running as
-               root. */
-            openSlave();
-
-            try {
-                /* Drop additional groups here because we can't do it
-                   after we've created the new user namespace. */
-                if (setgroups(0, 0) == -1) {
-                    if (errno != EPERM)
-                        throw SysError("setgroups failed");
-                    if (store.config->getLocalSettings().requireDropSupplementaryGroups)
-                        throw Error(
-                            "setgroups failed. Set the require-drop-supplementary-groups option to false to skip this step.");
-                }
-
-                ProcessOptions options;
-                options.cloneFlags = CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | CLONE_NEWUTS | CLONE_PARENT | SIGCHLD;
-                if (derivationType.isSandboxed())
-                    options.cloneFlags |= CLONE_NEWNET;
-                if (usingUserNamespace)
-                    options.cloneFlags |= CLONE_NEWUSER;
-
-                pid_t child = startProcess([this, args = std::move(args)]() { runChild(std::move(args)); }, options);
-
-                writeFull(sendPid.writeSide.get(), fmt("%d\n", child));
-                _exit(0);
-            } catch (...) {
-                handleChildException(true);
-                _exit(1);
-            }
-        });
-
-        sendPid.writeSide.close();
-
-        if (auto status = helper.wait(); !statusOk(status)) {
-            processSandboxSetupMessages();
-            // Only reached if the child process didn't send an exception.
-            throw Error("unable to start build process: %s", statusToString(status));
-        }
-
-        userNamespaceSync.readSide = -1;
-
-        /* Make sure that we write *something* to the child in case of
-           an exception. Note that merely closing
-           `userNamespaceSync.writeSide` doesn't work in
-           multi-threaded Nix, since several child processes may have
-           inherited `writeSide` (and O_CLOEXEC doesn't help because
-           the children may not do an execve). */
-        bool userNamespaceSyncDone = false;
-        Finally cleanup([&]() {
-            try {
-                if (!userNamespaceSyncDone)
-                    writeFull(userNamespaceSync.writeSide.get(), "0\n");
-            } catch (...) {
-            }
-            userNamespaceSync.writeSide = -1;
-        });
-
-        FdSource sendPidSource(sendPid.readSide.get());
-        auto ss = tokenizeString<std::vector<std::string>>(sendPidSource.readLine());
-        assert(ss.size() == 1);
-        pid = string2Int<pid_t>(ss[0]).value();
-        auto thisProcPath = procPath / std::to_string(static_cast<pid_t>(pid));
-
-        if (usingUserNamespace) {
-            /* Set the UID/GID mapping of the builder's user namespace
-               such that the sandbox user maps to the build user, or to
-               the calling user (if build users are disabled). */
-            uid_t hostUid = buildUser ? buildUser->getUID() : getuid();
-            uid_t hostGid = buildUser ? buildUser->getGID() : getgid();
-            uid_t nrIds = buildUser ? buildUser->getUIDCount() : 1;
-
-            writeFile(thisProcPath / "uid_map", fmt("%d %d %d", sandboxUid(), hostUid, nrIds));
-
-            if (!buildUser || buildUser->getUIDCount() == 1)
-                writeFile(thisProcPath / "setgroups", "deny");
-
-            writeFile(thisProcPath / "gid_map", fmt("%d %d %d", sandboxGid(), hostGid, nrIds));
-        } else {
-            debug("note: not using a user namespace");
-            if (!buildUser)
-                throw Error(
-                    "cannot perform a sandboxed build because user namespaces are not enabled; check /proc/sys/user/max_user_namespaces");
-        }
-
-        /* Now that we know the sandbox uid/gid, we can write
-           /etc/passwd and /etc/group. */
-        writeFile(
-            chrootRootDir / "etc" / "passwd",
-            fmt("root:x:0:0:Nix build user:%3%:/noshell\n"
-                "nixbld:x:%1%:%2%:Nix build user:%3%:/noshell\n"
-                "nobody:x:65534:65534:Nobody:/:/noshell\n",
-                sandboxUid(),
-                sandboxGid(),
-                store.config->getLocalSettings().sandboxBuildDir.get().native()));
-
-        writeFile(
-            chrootRootDir / "etc" / "group",
-            fmt("root:x:0:\n"
-                "nixbld:!:%1%:\n"
-                "nogroup:x:65534:\n",
-                sandboxGid()));
-
-        /* Save the mount- and user namespace of the child. We have to do this
-         *before* the child does a chroot. */
-        auto sandboxPath = thisProcPath / "ns";
-        sandboxMountNamespace = open((sandboxPath / "mnt").c_str(), O_RDONLY);
-        if (sandboxMountNamespace.get() == -1)
-            throw SysError("getting sandbox mount namespace");
-
-        if (usingUserNamespace) {
-            sandboxUserNamespace = open((sandboxPath / "user").c_str(), O_RDONLY);
-            if (sandboxUserNamespace.get() == -1)
-                throw SysError("getting sandbox user namespace");
-        }
-
-        /* Move the child into its own cgroup. */
-        if (cgroup)
-            writeFile(*cgroup / "cgroup.procs", fmt("%d", (pid_t) pid));
-
-        /* Signal the builder that we've updated its user namespace. */
-        writeFull(userNamespaceSync.writeSide.get(), "1\n");
-        userNamespaceSyncDone = true;
-    }
-
-    void enterChroot() override
-    {
-        userNamespaceSync.writeSide = -1;
-
-        if (readLine(userNamespaceSync.readSide.get()) != "1")
-            throw Error("user namespace initialisation failed");
-
-        userNamespaceSync.readSide = -1;
-
-        if (derivationType.isSandboxed()) {
-
-            /* Initialise the loopback interface. */
-            AutoCloseFD fd(socket(PF_INET, SOCK_DGRAM, IPPROTO_IP));
-            if (!fd)
-                throw SysError("cannot open IP socket");
-
-            using namespace std::string_view_literals;
-            struct ifreq ifr = {};
-            std::ranges::copy("lo"sv, ifr.ifr_name);
-            ifr.ifr_flags = IFF_UP | IFF_LOOPBACK | IFF_RUNNING;
-            if (ioctl(fd.get(), SIOCSIFFLAGS, &ifr) == -1)
-                throw SysError("cannot set loopback interface flags");
-        }
-
-        /* Set the hostname etc. to fixed values. */
-        char hostname[] = "localhost";
-        if (sethostname(hostname, sizeof(hostname)) == -1)
-            throw SysError("cannot set host name");
-        char domainname[] = "(none)"; // kernel default
-        if (setdomainname(domainname, sizeof(domainname)) == -1)
-            throw SysError("cannot set domain name");
-
-        /* Make all filesystems private.  This is necessary
-           because subtrees may have been mounted as "shared"
-           (MS_SHARED).  (Systemd does this, for instance.)  Even
-           though we have a private mount namespace, mounting
-           filesystems on top of a shared subtree still propagates
-           outside of the namespace.  Making a subtree private is
-           local to the namespace, though, so setting MS_PRIVATE
-           does not affect the outside world. */
-        if (mount(0, "/", 0, MS_PRIVATE | MS_REC, 0) == -1)
-            throw SysError("unable to make '/' private");
-
-        /* Bind-mount chroot directory to itself, to treat it as a
-           different filesystem from /, as needed for pivot_root. */
-        if (mount(chrootRootDir.c_str(), chrootRootDir.c_str(), 0, MS_BIND, 0) == -1)
-            throw SysError("unable to bind mount %1%", PathFmt(chrootRootDir));
-
-        /* Bind-mount the sandbox's Nix store onto itself so that
-           we can mark it as a "shared" subtree, allowing bind
-           mounts made in *this* mount namespace to be propagated
-           into the child namespace created by the
-           unshare(CLONE_NEWNS) call below.
-
-           Marking chrootRootDir as MS_SHARED causes pivot_root()
-           to fail with EINVAL. Don't know why. */
-        std::filesystem::path chrootStoreDir = chrootRootDir / std::filesystem::path(store.storeDir).relative_path();
-
-        if (mount(chrootStoreDir.c_str(), chrootStoreDir.c_str(), 0, MS_BIND, 0) == -1)
-            throw SysError("unable to bind mount the Nix store at %1%", PathFmt(chrootStoreDir));
-
-        if (mount(0, chrootStoreDir.c_str(), 0, MS_SHARED, 0) == -1)
-            throw SysError("unable to make %s shared", PathFmt(chrootStoreDir));
-
-        /* Set up a nearly empty /dev, unless the user asked to
-           bind-mount the host /dev. */
-        Strings ss;
-        if (pathsInChroot.find("/dev") == pathsInChroot.end()) {
-            createDirs(chrootRootDir / "dev" / "shm");
-            createDirs(chrootRootDir / "dev" / "pts");
-            ss.push_back("/dev/full");
-            if (systemFeatures.count("kvm")) {
-                if (pathExists("/dev/kvm")) {
-                    ss.push_back("/dev/kvm");
-                } else {
-                    warn(
-                        "KVM is enabled in system-features but /dev/kvm is not available. "
-                        "QEMU builds may fall back to slow emulation. "
-                        "Consider removing 'kvm' from system-features in nix.conf if KVM is not supported on this system.");
-                }
-            }
-            ss.push_back("/dev/null");
-            ss.push_back("/dev/random");
-            ss.push_back("/dev/tty");
-            ss.push_back("/dev/urandom");
-            ss.push_back("/dev/zero");
-            createSymlink("/proc/self/fd", chrootRootDir / "dev" / "fd");
-            createSymlink("/proc/self/fd/0", chrootRootDir / "dev" / "stdin");
-            createSymlink("/proc/self/fd/1", chrootRootDir / "dev" / "stdout");
-            createSymlink("/proc/self/fd/2", chrootRootDir / "dev" / "stderr");
-        }
-
-        /* Fixed-output derivations typically need to access the
-           network, so give them access to /etc/resolv.conf and so
-           on. */
-        if (!derivationType.isSandboxed()) {
-            // Only use nss functions to resolve hosts and
-            // services. Don’t use it for anything else that may
-            // be configured for this system. This limits the
-            // potential impurities introduced in fixed-outputs.
-            writeFile(chrootRootDir / "etc" / "nsswitch.conf", "hosts: files dns\nservices: files\n");
-
-            /* N.B. it is realistic that these paths might not exist. It
-               happens when testing Nix building fixed-output derivations
-               within a pure derivation. */
-            for (auto & path : {"/etc/resolv.conf", "/etc/services", "/etc/hosts"})
-                if (pathExists(path))
-                    ss.push_back(path);
-
-            if (auto & caFile = fileTransferSettings.caFile.get()) {
-                if (pathExists(*caFile))
-                    pathsInChroot.try_emplace(
-                        "/etc/ssl/certs/ca-certificates.crt", canonPath(caFile->native(), true), true);
-            }
-        }
-
-        for (auto & i : ss) {
-            // For backwards-compatibility, resolve all the symlinks in the
-            // chroot paths.
-            auto canonicalPath = canonPath(i, true);
-            pathsInChroot.emplace(i, canonicalPath);
-        }
-
-        /* Bind-mount all the directories from the "host"
-           filesystem that we want in the chroot
-           environment. */
-        for (auto & i : pathsInChroot) {
-            if (i.second.source == "/proc")
-                continue; // backwards compatibility
-
-#  if HAVE_EMBEDDED_SANDBOX_SHELL
-            if (i.second.source == "__embedded_sandbox_shell__") {
-                static unsigned char sh[] = {
-#    include "embedded-sandbox-shell.gen.hh"
-                };
-                auto dst = chrootRootDir / i.first.relative_path();
-                createDirs(dst.parent_path());
-                writeFile(dst, std::string_view((const char *) sh, sizeof(sh)));
-                chmod(dst, 0555);
-            } else
-#  endif
-            {
-                doBind(i.second.source, chrootRootDir / i.first.relative_path(), i.second.optional);
-            }
-        }
-
-        /* Bind a new instance of procfs on /proc. */
-        createDirs(chrootRootDir / "proc");
-        if (mount("none", (chrootRootDir / "proc").c_str(), "proc", 0, 0) == -1)
-            throw SysError("mounting /proc");
-
-        /* Mount sysfs on /sys. */
-        if (buildUser && buildUser->getUIDCount() != 1) {
-            createDirs(chrootRootDir / "sys");
-            if (mount("none", (chrootRootDir / "sys").c_str(), "sysfs", 0, 0) == -1)
-                throw SysError("mounting /sys");
-        }
-
-        /* Mount a new tmpfs on /dev/shm to ensure that whatever
-           the builder puts in /dev/shm is cleaned up automatically. */
-        if (pathExists("/dev/shm")
-            && mount(
-                   "none",
-                   (chrootRootDir / "dev" / "shm").c_str(),
-                   "tmpfs",
-                   0,
-                   fmt("size=%s", store.config->getLocalSettings().sandboxShmSize).c_str())
-                   == -1)
-            throw SysError("mounting /dev/shm");
-
-        /* Mount a new devpts on /dev/pts.  Note that this
-           requires the kernel to be compiled with
-           CONFIG_DEVPTS_MULTIPLE_INSTANCES=y (which is the case
-           if /dev/ptx/ptmx exists). */
-        if (pathExists("/dev/pts/ptmx") && !pathExists(chrootRootDir / "dev" / "ptmx")
-            && !pathsInChroot.count("/dev/pts")) {
-            if (mount("none", (chrootRootDir / "dev" / "pts").c_str(), "devpts", 0, "newinstance,mode=0620") == 0) {
-                createSymlink("/dev/pts/ptmx", chrootRootDir / "dev" / "ptmx");
-
-                /* Make sure /dev/pts/ptmx is world-writable.  With some
-                   Linux versions, it is created with permissions 0.  */
-                chmod(chrootRootDir / "dev" / "pts" / "ptmx", 0666);
-            } else {
-                if (errno != EINVAL)
-                    throw SysError("mounting /dev/pts");
-                doBind("/dev/pts", chrootRootDir / "dev" / "pts");
-                doBind("/dev/ptmx", chrootRootDir / "dev" / "ptmx");
-            }
-        }
-
-        /* Make /etc unwritable */
-        if (!drvOptions.useUidRange(drv))
-            chmod(chrootRootDir / "etc", 0555);
-
-        /* Unshare this mount namespace. This is necessary because
-           pivot_root() below changes the root of the mount
-           namespace. This means that the call to setns() in
-           addDependency() would hide the host's filesystem,
-           making it impossible to bind-mount paths from the host
-           Nix store into the sandbox. Therefore, we save the
-           pre-pivot_root namespace in
-           sandboxMountNamespace. Since we made /nix/store a
-           shared subtree above, this allows addDependency() to
-           make paths appear in the sandbox. */
-        if (unshare(CLONE_NEWNS) == -1)
-            throw SysError("unsharing mount namespace");
-
-        /* Unshare the cgroup namespace. This means
-           /proc/self/cgroup will show the child's cgroup as '/'
-           rather than whatever it is in the parent. */
-        if (cgroup && unshare(CLONE_NEWCGROUP) == -1)
-            throw SysError("unsharing cgroup namespace");
-
-        /* Do the chroot(). */
-        if (chdir(chrootRootDir.c_str()) == -1)
-            throw SysError("cannot change directory to %1%", PathFmt(chrootRootDir));
-
-        if (mkdir("real-root", 0500) == -1)
-            throw SysError("cannot create real-root directory");
-
-        if (pivot_root(".", "real-root") == -1)
-            throw SysError("cannot pivot old root directory onto %1%", PathFmt(chrootRootDir / "real-root"));
-
-        if (chroot(".") == -1)
-            throw SysError("cannot change root directory to %1%", PathFmt(chrootRootDir));
-
-        if (umount2("real-root", MNT_DETACH) == -1)
-            throw SysError("cannot unmount real root filesystem");
-
-        if (rmdir("real-root") == -1)
-            throw SysError("cannot remove real-root directory");
-
-        LinuxDerivationBuilder::enterChroot();
-    }
-
-    void setUser() override
-    {
-        preserveDeathSignal([this]() {
-            /* Switch to the sandbox uid/gid in the user namespace,
-               which corresponds to the build user or calling user in
-               the parent namespace. */
-            if (setgid(sandboxGid()) == -1)
-                throw SysError("setgid failed");
-            if (setuid(sandboxUid()) == -1)
-                throw SysError("setuid failed");
-        });
-    }
-
-    SingleDrvOutputs unprepareBuild() override
-    {
-        sandboxMountNamespace = -1;
-        sandboxUserNamespace = -1;
-
-        return DerivationBuilderImpl::unprepareBuild();
-    }
-
-    void killSandbox(bool getStats) override
-    {
-        if (cgroup) {
-            auto stats = linux::destroyCgroup(*cgroup);
-            if (getStats) {
-                buildResult.cpuUser = stats.cpuUser;
-                buildResult.cpuSystem = stats.cpuSystem;
-            }
-            return;
-        }
-
-        DerivationBuilderImpl::killSandbox(getStats);
-    }
-
-    void addDependencyImpl(const StorePath & path) override
-    {
-        auto [source, target] = ChrootDerivationBuilder::addDependencyPrep(path);
-
-        /* Bind-mount the path into the sandbox. This requires
-           entering its mount namespace, which is not possible
-           in multithreaded programs. So we do this in a
-           child process.*/
-        Pid child(startProcess([&]() {
-            if (usingUserNamespace && (setns(sandboxUserNamespace.get(), CLONE_NEWUSER) == -1))
-                throw SysError("entering sandbox user namespace");
-
-            if (setns(sandboxMountNamespace.get(), CLONE_NEWNS) == -1)
-                throw SysError("entering sandbox mount namespace");
-
-            doBind(source, target);
-
-            _exit(0);
-        }));
-
-        int status = child.wait();
-        if (!statusOk(status))
-            throw Error("could not add path '%s' to sandbox: %s", store.printStorePath(path), statusToString(status));
-    }
-};
-
-} // namespace nix
-
-#  undef DO_LANDLOCK
-
-#endif
diff --git a/src/libstore/unix/include/nix/store/build/hook-instance.hh b/src/libstore/unix/include/nix/store/build/hook-instance.hh
index e53a791d71fc..b3c9fd91385c 100644
--- a/src/libstore/unix/include/nix/store/build/hook-instance.hh
+++ b/src/libstore/unix/include/nix/store/build/hook-instance.hh
@@ -39,15 +39,6 @@ struct HookInstance
      */
     Pid pid;
 
-    /**
-     * The remote machine on which we're building.
-     *
-     * @Invariant When the hook instance is owned by the `Worker`, this
-     * is the empty string. When it is owned by a `Goal`, this should be
-     * set.
-     */
-    std::string machineName;
-
     FdSink sink;
 
     std::map<ActivityId, Activity> activities;
diff --git a/src/libstore/unix/include/nix/store/user-lock.hh b/src/libstore/unix/include/nix/store/user-lock.hh
index 0c10906f59a8..45d072847a2d 100644
--- a/src/libstore/unix/include/nix/store/user-lock.hh
+++ b/src/libstore/unix/include/nix/store/user-lock.hh
@@ -12,7 +12,7 @@ struct LocalSettings;
 
 struct UserLock
 {
-    virtual ~UserLock() {}
+    virtual ~UserLock();
 
     /**
      * Get the first and last UID.
diff --git a/src/libstore/unix/meson.build b/src/libstore/unix/meson.build
index bb374820eafc..b7a4f566a593 100644
--- a/src/libstore/unix/meson.build
+++ b/src/libstore/unix/meson.build
@@ -2,9 +2,18 @@ sources += files(
   'build/child.cc',
   'build/chroot.cc',
   'build/derivation-builder.cc',
+  'build/external-derivation-builder.cc',
   'build/hook-instance.cc',
   'pathlocks.cc',
   'user-lock.cc',
 )
 
+include_dirs += [ include_directories('build') ]
+
+if (target_machine.system() == 'linux' or target_machine.system() == 'freebsd')
+  sources += files(
+    'build/chroot-derivation-builder.cc',
+  )
+endif
+
 subdir('include/nix/store')
diff --git a/src/libstore/unix/user-lock.cc b/src/libstore/unix/user-lock.cc
index d5a959be2e5f..bbdd882b9a3e 100644
--- a/src/libstore/unix/user-lock.cc
+++ b/src/libstore/unix/user-lock.cc
@@ -11,6 +11,8 @@
 
 namespace nix {
 
+UserLock::~UserLock() {}
+
 #ifdef __linux__
 
 static std::vector<gid_t> get_group_list(const char * username, gid_t group_id)
@@ -35,6 +37,8 @@ static std::vector<gid_t> get_group_list(const char * username, gid_t group_id)
 }
 #endif
 
+namespace {
+
 struct SimpleUserLock : UserLock
 {
     AutoCloseFD fdUserLock;
@@ -214,6 +218,8 @@ struct AutoUserLock : UserLock
     }
 };
 
+} // namespace
+
 std::unique_ptr<UserLock> acquireUserLock(
     const std::filesystem::path & stateDir, const LocalSettings & localSettings, uid_t nrIds, bool useUserNamespace)
 {
diff --git a/src/libstore/worker-protocol.cc b/src/libstore/worker-protocol.cc
index 31373a128f96..5eaae231a50d 100644
--- a/src/libstore/worker-protocol.cc
+++ b/src/libstore/worker-protocol.cc
@@ -25,10 +25,8 @@ const WorkerProto::Version WorkerProto::latest = {
         },
     .features =
         {
-            std::string{
-                WorkerProto::featureRealisationWithPath,
-            },
-            std::string{WorkerProto::featureDeleteDeadSpecific},
+            std::string{WorkerProto::featureRealisationWithPath},
+            std::string{WorkerProto::featureDeleteDeadSpecificReferrers},
         },
 };
 
@@ -40,6 +38,21 @@ const WorkerProto::Version WorkerProto::minimum = {
         },
 };
 
+const WorkerProto::Version WorkerProto::builderRpcV0 = {
+    .number =
+        {
+            .major = 1,
+            .minor = 38,
+        },
+    .features =
+        {
+            std::string{WorkerProto::featureRealisationWithPath},
+            std::string{WorkerProto::featureDisableSetOptions},
+            std::string{WorkerProto::featureAddToStoreScanning},
+            std::string{WorkerProto::featureSubmitOutput},
+        },
+};
+
 std::partial_ordering WorkerProto::Version::operator<=>(const WorkerProto::Version & other) const
 {
     auto numCmp = number <=> other.number;
@@ -227,6 +240,45 @@ void WorkerProto::Serialise<DerivedPath>::write(
     }
 }
 
+SingleDerivedPath
+WorkerProto::Serialise<SingleDerivedPath>::read(const StoreDirConfig & store, WorkerProto::ReadConn conn)
+{
+    auto tag = readNum<uint8_t>(conn.from);
+    switch (tag) {
+    case 0:
+        return SingleDerivedPath::Opaque{
+            .path = WorkerProto::Serialise<StorePath>::read(store, conn),
+        };
+    case 1: {
+        auto drvPath = make_ref<SingleDerivedPath>(WorkerProto::Serialise<SingleDerivedPath>::read(store, conn));
+        return SingleDerivedPath::Built{
+            .drvPath = std::move(drvPath),
+            .output = readString(conn.from),
+        };
+    }
+    default:
+        throw Error("Invalid tag %d for single derived path", tag);
+    }
+}
+
+void WorkerProto::Serialise<SingleDerivedPath>::write(
+    const StoreDirConfig & store, WorkerProto::WriteConn conn, const SingleDerivedPath & req)
+{
+    std::visit(
+        overloaded{
+            [&](const SingleDerivedPath::Opaque & o) {
+                conn.to << uint8_t{0};
+                WorkerProto::write(store, conn, o.path);
+            },
+            [&](const SingleDerivedPath::Built & b) {
+                conn.to << uint8_t{1};
+                WorkerProto::write(store, conn, *b.drvPath);
+                conn.to << b.output;
+            },
+        },
+        req.raw());
+}
+
 KeyedBuildResult
 WorkerProto::Serialise<KeyedBuildResult>::read(const StoreDirConfig & store, WorkerProto::ReadConn conn)
 {
@@ -533,13 +585,29 @@ void WorkerProto::Serialise<Realisation>::write(const StoreDirConfig & store, Wr
     WorkerProto::write(store, conn, static_cast<const UnkeyedRealisation &>(info));
 }
 
+GCOptions::SpecificPaths
+WorkerProto::Serialise<GCOptions::SpecificPaths>::read(const StoreDirConfig & store, ReadConn conn)
+{
+    GCOptions::SpecificPaths paths;
+    paths.paths = WorkerProto::Serialise<StorePathSet>::read(store, conn);
+    conn.from >> paths.deleteReferrers;
+    return paths;
+}
+
+void WorkerProto::Serialise<GCOptions::SpecificPaths>::write(
+    const StoreDirConfig & store, WriteConn conn, const GCOptions::SpecificPaths & paths)
+{
+    WorkerProto::write(store, conn, paths.paths);
+    conn.to << paths.deleteReferrers;
+}
+
 GCOptions::GCPaths WorkerProto::Serialise<GCOptions::GCPaths>::read(const StoreDirConfig & store, ReadConn conn)
 {
     uint8_t wholeStore;
     conn.from >> wholeStore;
     switch (wholeStore) {
     case 0:
-        return WorkerProto::Serialise<StorePathSet>::read(store, conn);
+        return WorkerProto::Serialise<GCOptions::SpecificPaths>::read(store, conn);
     case 1:
         return GCOptions::WholeStore{};
     default:
@@ -552,7 +620,7 @@ void WorkerProto::Serialise<GCOptions::GCPaths>::write(
 {
     std::visit(
         overloaded{
-            [&](const StorePathSet paths) {
+            [&](const GCOptions::SpecificPaths paths) {
                 conn.to << uint8_t{0};
                 WorkerProto::write(store, conn, paths);
             },
diff --git a/src/libutil-c/meson.build b/src/libutil-c/meson.build
index 1806dbb6f9a0..595a51e3cc7e 100644
--- a/src/libutil-c/meson.build
+++ b/src/libutil-c/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -49,17 +49,35 @@ headers += files('nix_api_util_internal.h')
 subdir('nix-meson-build-support/export-all-symbols')
 subdir('nix-meson-build-support/windows-version')
 
-this_library = library(
-  'nixutilc',
-  sources,
-  config_priv_h,
-  soversion : nix_soversion,
-  dependencies : deps_public + deps_private + deps_other,
-  include_directories : include_dirs,
-  link_args : linker_export_flags,
-  prelink : true, # For C++ static initializers
-  install : true,
-)
+# For linking -c bindings into the cli for plugins.
+build_both_libraries = get_option('plugin-c-api')
+
+library_kwargs = {
+  'soversion' : nix_soversion,
+  'dependencies' : deps_public + deps_private + deps_other,
+  'include_directories' : include_dirs,
+  'link_args' : linker_export_flags,
+  'install' : true,
+}
+
+if build_both_libraries
+  this_libraries = both_libraries(
+    'nixutilc',
+    sources,
+    config_priv_h,
+    kwargs : library_kwargs,
+    override_options : [ 'b_lto=false' ],
+  )
+else
+  this_library = library(
+    'nixutilc',
+    sources,
+    config_priv_h,
+    kwargs : library_kwargs,
+  )
+endif
+
+plugin_c_api_enabled = build_both_libraries
 
 install_headers(headers, preserve_path : true)
 
diff --git a/src/libutil-c/meson.options b/src/libutil-c/meson.options
index 04422feaf189..a8b0c4df0401 100644
--- a/src/libutil-c/meson.options
+++ b/src/libutil-c/meson.options
@@ -1 +1,8 @@
 # vim: filetype=meson
+
+option(
+  'plugin-c-api',
+  type : 'boolean',
+  value : false,
+  yield : true,
+)
diff --git a/src/libutil-c/nix_api_util.h b/src/libutil-c/nix_api_util.h
index 66ea17522213..b48d9166d4be 100644
--- a/src/libutil-c/nix_api_util.h
+++ b/src/libutil-c/nix_api_util.h
@@ -163,6 +163,7 @@ typedef struct nix_c_context nix_c_context;
  * @brief Called to get the value of a string owned by Nix.
  *
  * The `start` data is borrowed and the function must not assume that the buffer persists after it returns.
+ * @warning Don't assume that the string is NUL-terminated.
  *
  * @param[in] start the string to copy.
  * @param[in] n the string length.
diff --git a/src/libutil-c/package.nix b/src/libutil-c/package.nix
index f26f57775d4f..019fb85d6c2b 100644
--- a/src/libutil-c/package.nix
+++ b/src/libutil-c/package.nix
@@ -7,6 +7,7 @@
   # Configuration Options
 
   version,
+  withPluginCAPI,
 }:
 
 let
@@ -35,6 +36,7 @@ mkMesonLibrary (finalAttrs: {
   ];
 
   mesonFlags = [
+    (lib.mesonBool "plugin-c-api" withPluginCAPI)
   ];
 
   meta = {
diff --git a/src/libutil-test-support/hash.cc b/src/libutil-test-support/hash.cc
index d9c7a0f74798..965097bf5295 100644
--- a/src/libutil-test-support/hash.cc
+++ b/src/libutil-test-support/hash.cc
@@ -1,6 +1,4 @@
-#ifdef __APPLE__
-#  include <exception> // Needed by rapidcheck on Darwin
-#endif
+#include <exception> // IWYU pragma: keep (Needed by rapidcheck on Darwin and FreeBSD)
 #include <rapidcheck.h>
 
 #include "nix/util/hash.hh"
@@ -9,10 +7,9 @@
 
 namespace rc {
 
-using namespace nix;
-
-Gen<Hash> Arbitrary<Hash>::arbitrary()
+Gen<nix::Hash> Arbitrary<nix::Hash>::arbitrary()
 {
+    using namespace nix;
     Hash prototype(HashAlgorithm::SHA1);
     return gen::apply(
         [](const std::vector<uint8_t> & v) {
diff --git a/src/libutil-test-support/include/nix/util/tests/capture-logging.hh b/src/libutil-test-support/include/nix/util/tests/capture-logging.hh
new file mode 100644
index 000000000000..758fdd524ead
--- /dev/null
+++ b/src/libutil-test-support/include/nix/util/tests/capture-logging.hh
@@ -0,0 +1,61 @@
+#pragma once
+
+#include "nix/util/logging.hh"
+
+#include <sstream>
+
+namespace nix::testing {
+
+class CaptureLogger : public Logger
+{
+    std::ostringstream oss;
+
+public:
+    CaptureLogger() {}
+
+    std::string get() const
+    {
+        return oss.str();
+    }
+
+    void log(Verbosity lvl, std::string_view s) override
+    {
+        oss << s << std::endl;
+    }
+
+    void logEI(const ErrorInfo & ei) override
+    {
+        showErrorInfo(oss, ei, loggerSettings.showTrace.get());
+    }
+};
+
+class CaptureLogging
+{
+    std::unique_ptr<CaptureLogger> logger;
+    Logger * oldLogger;
+
+public:
+    CaptureLogging()
+    {
+        oldLogger = nix::logger;
+        logger = std::make_unique<CaptureLogger>();
+        nix::logger = logger.get();
+    }
+
+    std::string get() const
+    {
+        return logger->get();
+    }
+
+    CaptureLogging(CaptureLogging &&) = delete;
+    CaptureLogging(const CaptureLogging &) = delete;
+    CaptureLogging & operator=(CaptureLogging &&) = delete;
+    CaptureLogging & operator=(const CaptureLogging &) = delete;
+
+    ~CaptureLogging()
+    {
+        nix::logger = oldLogger;
+    }
+};
+
+} // namespace nix::testing
diff --git a/src/libutil-test-support/include/nix/util/tests/characterization.hh b/src/libutil-test-support/include/nix/util/tests/characterization.hh
index 6dd5f38866db..154573b5e507 100644
--- a/src/libutil-test-support/include/nix/util/tests/characterization.hh
+++ b/src/libutil-test-support/include/nix/util/tests/characterization.hh
@@ -60,7 +60,7 @@ struct CharacterizationTest : virtual ::testing::Test
         auto got = test();
 
         if (testAccept()) {
-            std::filesystem::create_directories(file.parent_path());
+            createDirs(file.parent_path());
             writeFile2(file, got);
             GTEST_SKIP() << "Updating golden master " << file;
         } else {
diff --git a/src/libutil-test-support/include/nix/util/tests/gmock-matchers.hh b/src/libutil-test-support/include/nix/util/tests/gmock-matchers.hh
index e48faca7c68e..f440e8169587 100644
--- a/src/libutil-test-support/include/nix/util/tests/gmock-matchers.hh
+++ b/src/libutil-test-support/include/nix/util/tests/gmock-matchers.hh
@@ -2,6 +2,7 @@
 ///@file
 
 #include "nix/util/error.hh"
+#include "nix/util/source-accessor.hh"
 #include "nix/util/terminal.hh"
 #include <gmock/gmock.h>
 
@@ -66,4 +67,64 @@ inline auto ThrowsSysError(int expected)
     return ::testing::Throws<SysError>(::testing::Field(&SysError::errNo, expected));
 }
 
+MATCHER_P2(HasContents, path, expected, "")
+{
+    auto stat = arg->maybeLstat(path);
+    if (!stat) {
+        *result_listener << arg->showPath(path) << " does not exist";
+        return false;
+    }
+    if (stat->type != SourceAccessor::tRegular) {
+        *result_listener << arg->showPath(path) << " is not a regular file";
+        return false;
+    }
+    auto actual = arg->readFile(path);
+    if (actual != expected) {
+        *result_listener << arg->showPath(path) << " has contents " << ::testing::PrintToString(actual);
+        return false;
+    }
+    return true;
+}
+
+MATCHER_P2(HasSymlink, path, target, "")
+{
+    auto stat = arg->maybeLstat(path);
+    if (!stat) {
+        *result_listener << arg->showPath(path) << " does not exist";
+        return false;
+    }
+    if (stat->type != SourceAccessor::tSymlink) {
+        *result_listener << arg->showPath(path) << " is not a symlink";
+        return false;
+    }
+    auto actual = arg->readLink(path);
+    if (actual != target) {
+        *result_listener << arg->showPath(path) << " points to " << ::testing::PrintToString(actual);
+        return false;
+    }
+    return true;
+}
+
+MATCHER_P2(HasDirectory, path, dirents, "")
+{
+    auto stat = arg->maybeLstat(path);
+    if (!stat) {
+        *result_listener << arg->showPath(path) << " does not exist";
+        return false;
+    }
+    if (stat->type != SourceAccessor::tDirectory) {
+        *result_listener << arg->showPath(path) << " is not a directory";
+        return false;
+    }
+    auto actual = arg->readDirectory(path);
+    std::set<std::string> actualKeys, expectedKeys(dirents.begin(), dirents.end());
+    for (auto & [k, _] : actual)
+        actualKeys.insert(k);
+    if (actualKeys != expectedKeys) {
+        *result_listener << arg->showPath(path) << " has entries " << ::testing::PrintToString(actualKeys);
+        return false;
+    }
+    return true;
+}
+
 } // namespace nix::testing
diff --git a/src/libutil-test-support/include/nix/util/tests/hash.hh b/src/libutil-test-support/include/nix/util/tests/hash.hh
index ee676f3eb210..d3efb5c3cd41 100644
--- a/src/libutil-test-support/include/nix/util/tests/hash.hh
+++ b/src/libutil-test-support/include/nix/util/tests/hash.hh
@@ -7,12 +7,10 @@
 
 namespace rc {
 
-using namespace nix;
-
 template<>
-struct Arbitrary<Hash>
+struct Arbitrary<nix::Hash>
 {
-    static Gen<Hash> arbitrary();
+    static Gen<nix::Hash> arbitrary();
 };
 
 } // namespace rc
diff --git a/src/libutil-test-support/include/nix/util/tests/json-characterization.hh b/src/libutil-test-support/include/nix/util/tests/json-characterization.hh
index 9bd4d7fbf109..75eba2b06a1d 100644
--- a/src/libutil-test-support/include/nix/util/tests/json-characterization.hh
+++ b/src/libutil-test-support/include/nix/util/tests/json-characterization.hh
@@ -73,7 +73,7 @@ void checkpointJson(CharacterizationTest & test, std::string_view testStem, cons
     json gotJson = static_cast<json>(got);
 
     if (testAccept()) {
-        std::filesystem::create_directories(file.parent_path());
+        createDirs(file.parent_path());
         writeFile(file, gotJson.dump(2) + "\n");
         ADD_FAILURE() << "Updating golden master " << file;
     } else {
@@ -98,7 +98,7 @@ void checkpointJson(CharacterizationTest & test, std::string_view testStem, cons
     json gotJson = static_cast<json>(*got);
 
     if (testAccept()) {
-        std::filesystem::create_directories(file.parent_path());
+        createDirs(file.parent_path());
         writeFile(file, gotJson.dump(2) + "\n");
         ADD_FAILURE() << "Updating golden master " << file;
     } else {
diff --git a/src/libutil-test-support/include/nix/util/tests/meson.build b/src/libutil-test-support/include/nix/util/tests/meson.build
index 9f09183f33f9..b084c9f5ad4b 100644
--- a/src/libutil-test-support/include/nix/util/tests/meson.build
+++ b/src/libutil-test-support/include/nix/util/tests/meson.build
@@ -3,6 +3,7 @@
 include_dirs = [ include_directories('../../..') ]
 
 headers = files(
+  'capture-logging.hh',
   'characterization.hh',
   'gmock-matchers.hh',
   'gtest-with-params.hh',
diff --git a/src/libutil-test-support/meson.build b/src/libutil-test-support/meson.build
index 64231107eb6b..7299cd65c328 100644
--- a/src/libutil-test-support/meson.build
+++ b/src/libutil-test-support/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
diff --git a/src/libutil-test-support/string_callback.cc b/src/libutil-test-support/string_callback.cc
index b64389e4adbd..70ff7ca7f4ef 100644
--- a/src/libutil-test-support/string_callback.cc
+++ b/src/libutil-test-support/string_callback.cc
@@ -5,7 +5,7 @@ namespace nix::testing {
 void observe_string_cb(const char * start, unsigned int n, void * user_data)
 {
     auto user_data_casted = reinterpret_cast<std::string *>(user_data);
-    *user_data_casted = std::string(start);
+    *user_data_casted = std::string(start, n);
 }
 
 } // namespace nix::testing
diff --git a/src/libutil-tests/args.cc b/src/libutil-tests/args.cc
index f2af485bf434..cccb304be710 100644
--- a/src/libutil-tests/args.cc
+++ b/src/libutil-tests/args.cc
@@ -105,8 +105,6 @@ TEST(parseShebangContent, increasingQuotes)
     ASSERT_EQ(*i++, "```");
 }
 
-#ifndef COVERAGE
-
 // quick and dirty
 static inline std::string escape(std::string_view s_)
 {
@@ -164,6 +162,4 @@ RC_GTEST_PROP(parseShebangContent, prop_round_trip_two, (const std::string & one
     RC_ASSERT(*i++ == two);
 }
 
-#endif
-
 } // namespace nix
diff --git a/src/libutil-tests/checked-arithmetic.cc b/src/libutil-tests/checked-arithmetic.cc
index cc88d353932c..e0447b68e382 100644
--- a/src/libutil-tests/checked-arithmetic.cc
+++ b/src/libutil-tests/checked-arithmetic.cc
@@ -11,8 +11,6 @@
 
 namespace rc {
 
-using namespace nix;
-
 template<std::integral T>
 struct Arbitrary<nix::checked::Checked<T>>
 {
diff --git a/src/libutil-tests/closure.cc b/src/libutil-tests/closure.cc
index 19df3e18f0c1..43b20823f252 100644
--- a/src/libutil-tests/closure.cc
+++ b/src/libutil-tests/closure.cc
@@ -3,9 +3,7 @@
 
 namespace nix {
 
-using namespace std;
-
-map<string, set<string>> testGraph = {
+std::map<std::string, std::set<std::string>> testGraph = {
     {"A", {"B", "C", "G"}},
     {"B", {"A"}}, // Loops back to A
     {"C", {"F"}}, // Indirect reference
@@ -17,9 +15,9 @@ map<string, set<string>> testGraph = {
 
 TEST(closure, correctClosure)
 {
-    set<string> aClosure;
-    set<string> expectedClosure = {"A", "B", "C", "F", "G"};
-    computeClosure<string>(
+    std::set<std::string> aClosure;
+    std::set<std::string> expectedClosure = {"A", "B", "C", "F", "G"};
+    computeClosure<std::string>(
         {"A"}, aClosure, [&](const std::string & currentNode) -> asio::awaitable<std::set<std::string>> {
             co_return testGraph[currentNode];
         });
@@ -32,10 +30,10 @@ TEST(closure, properlyHandlesDirectExceptions)
     struct TestExn
     {};
 
-    set<string> aClosure;
+    std::set<std::string> aClosure;
     std::size_t callCount = 0;
     EXPECT_THROW(
-        computeClosure<string>(
+        computeClosure<std::string>(
             {"A", "B"},
             aClosure,
             [&](const std::string &) -> asio::awaitable<std::set<std::string>> {
diff --git a/src/libutil-tests/compression.cc b/src/libutil-tests/compression.cc
index f1575a67c54a..60d2cd29ed35 100644
--- a/src/libutil-tests/compression.cc
+++ b/src/libutil-tests/compression.cc
@@ -15,67 +15,72 @@ TEST(compress, noneMethodDoesNothingToTheInput)
     ASSERT_EQ(o, "this-is-a-test");
 }
 
-TEST(decompress, decompressNoneCompressed)
+struct CompressionDecompressionTest : ::testing::WithParamInterface<CompressionAlgo>, public ::testing::Test
 {
-    auto method = "none";
-    auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-    auto o = decompress(method, str);
-
-    ASSERT_EQ(o, str);
-}
+    static constexpr std::string_view dummyInput = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
+};
 
-TEST(decompress, decompressEmptyCompressed)
+TEST_P(CompressionDecompressionTest, roundtrip)
 {
-    // Empty-method decompression used e.g. by S3 store
-    // (Content-Encoding == "").
-    auto method = "";
-    auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-    auto o = decompress(method, str);
-
-    ASSERT_EQ(o, str);
+    auto o = decompress(GetParam(), compress(GetParam(), dummyInput));
+    ASSERT_EQ(o, dummyInput);
 }
 
-TEST(decompress, decompressXzCompressed)
+TEST_P(CompressionDecompressionTest, empty)
 {
-    auto method = "xz";
-    auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-    auto o = decompress(method, compress(CompressionAlgo::xz, str));
-
-    ASSERT_EQ(o, str);
+    auto compressed = compress(GetParam(), "");
+    if (GetParam() != CompressionAlgo::none) {
+        ASSERT_FALSE(compressed.empty());
+    }
+    auto o = decompress(GetParam(), compressed);
+    ASSERT_EQ(o, "");
 }
 
-TEST(decompress, decompressBzip2Compressed)
+TEST_P(CompressionDecompressionTest, invalidDecompression)
 {
-    auto method = "bzip2";
-    auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-    auto o = decompress(method, compress(CompressionAlgo::bzip2, str));
+    if (GetParam() == CompressionAlgo::none)
+        GTEST_SKIP();
 
-    ASSERT_EQ(o, str);
+    ASSERT_THROW(
+        decompress(GetParam(), "this is a string that does not qualify as valid compressed data"), CompressionError);
 }
 
-TEST(decompress, decompressBrCompressed)
+TEST_P(CompressionDecompressionTest, roundtripsWithSourceAndSink)
 {
-    auto method = "br";
-    auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-    auto o = decompress(method, compress(CompressionAlgo::brotli, str));
+    StringSink strSink;
+    auto decompressionSink = makeDecompressionSink(CompressionAlgo::bzip2, strSink);
+    auto sink = makeCompressionSink(CompressionAlgo::bzip2, *decompressionSink);
 
-    ASSERT_EQ(o, str);
+    (*sink)(dummyInput);
+    sink->finish();
+    decompressionSink->finish();
+
+    ASSERT_EQ(strSink.s.c_str(), dummyInput);
 }
 
-TEST(decompress, decompressZstdCompressed)
+INSTANTIATE_TEST_SUITE_P(
+    CompressionDecompression,
+    CompressionDecompressionTest,
+    ::testing::Values(
+        CompressionAlgo::none,
+        CompressionAlgo::xz,
+        CompressionAlgo::bzip2,
+        CompressionAlgo::brotli,
+        CompressionAlgo::zstd),
+    [](const ::testing::TestParamInfo<CompressionAlgo> & info) { return showCompressionAlgo(info.param); });
+
+TEST(decompress, decompressNoneCompressed)
 {
-    auto method = "zstd";
     auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-    auto o = decompress(method, compress(CompressionAlgo::zstd, str));
+    auto o = decompress(CompressionAlgo::none, str);
 
     ASSERT_EQ(o, str);
 }
 
 TEST(decompress, decompressZstdCompressedParallel)
 {
-    auto method = "zstd";
     auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-    auto o = decompress(method, compress(CompressionAlgo::zstd, str, true));
+    auto o = decompress(CompressionAlgo::zstd, compress(CompressionAlgo::zstd, str, true));
 
     ASSERT_EQ(o, str);
 }
@@ -88,28 +93,18 @@ TEST(decompress, decompressZstdMultiFrameLargeInput)
     for (size_t i = 0; i < str.size(); i += 997)
         str[i] = 'y'; // add some variation
     auto compressed = compress(CompressionAlgo::zstd, str);
-    auto o = decompress("zstd", compressed);
+    auto o = decompress(CompressionAlgo::zstd, compressed);
 
     ASSERT_EQ(o, str);
 }
 
-TEST(compress, zstdEmptyInput)
-{
-    auto compressed = compress(CompressionAlgo::zstd, "");
-    // Empty input should still emit a valid (empty-content) zstd
-    // frame so it round-trips through the decompressor.
-    ASSERT_FALSE(compressed.empty());
-    auto o = decompress("zstd", compressed);
-    ASSERT_EQ(o, "");
-}
-
 TEST(compress, zstdExactFrameBoundary)
 {
     // Input exactly equal to the 16 MiB frame boundary should not
     // emit a trailing zero-content frame.
     std::string str(16 * 1024 * 1024, 'z');
     auto compressed = compress(CompressionAlgo::zstd, str);
-    auto o = decompress("zstd", compressed);
+    auto o = decompress(CompressionAlgo::zstd, compressed);
     ASSERT_EQ(o, str);
 
     // Verify there is exactly one frame by checking that
@@ -119,14 +114,6 @@ TEST(compress, zstdExactFrameBoundary)
     ASSERT_EQ(frameSize, compressed.size());
 }
 
-TEST(decompress, decompressInvalidInputThrowsCompressionError)
-{
-    auto method = "bzip2";
-    auto str = "this is a string that does not qualify as valid bzip2 data";
-
-    ASSERT_THROW(decompress(method, str), CompressionError);
-}
-
 /* ----------------------------------------------------------------------------
  * compression sinks
  * --------------------------------------------------------------------------*/
@@ -142,18 +129,4 @@ TEST(makeCompressionSink, noneSinkDoesNothingToInput)
     ASSERT_STREQ(strSink.s.c_str(), inputString);
 }
 
-TEST(makeCompressionSink, compressAndDecompress)
-{
-    StringSink strSink;
-    auto inputString = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-    auto decompressionSink = makeDecompressionSink("bzip2", strSink);
-    auto sink = makeCompressionSink(CompressionAlgo::bzip2, *decompressionSink);
-
-    (*sink)(inputString);
-    sink->finish();
-    decompressionSink->finish();
-
-    ASSERT_STREQ(strSink.s.c_str(), inputString);
-}
-
 } // namespace nix
diff --git a/src/libutil-tests/config.cc b/src/libutil-tests/config.cc
index b9eec0c4175f..d7b024ead170 100644
--- a/src/libutil-tests/config.cc
+++ b/src/libutil-tests/config.cc
@@ -325,4 +325,12 @@ TEST(Config, applyConfigInvalidThrows)
     ASSERT_THROW(config.applyConfig("value == key"), UsageError);
     ASSERT_THROW(config.applyConfig("value "), UsageError);
 }
+
+TEST(Config, toKeyValue)
+{
+    Config config;
+    Setting<std::string> foo{&config, "default", "name-of-the-setting", "description", {"alias-of-the-setting"}};
+    ASSERT_EQ(config.toKeyValue(), "name-of-the-setting = default\n");
+}
+
 } // namespace nix
diff --git a/src/libutil-tests/data/nar-listing/deep.json b/src/libutil-tests/data/nar-listing/deep.json
index a7ed47c4c030..f58974f66e40 100644
--- a/src/libutil-tests/data/nar-listing/deep.json
+++ b/src/libutil-tests/data/nar-listing/deep.json
@@ -15,6 +15,7 @@
       "type": "directory"
     },
     "foo": {
+      "executable": false,
       "size": 15,
       "type": "regular"
     }
diff --git a/src/libutil-tests/file-descriptor.cc b/src/libutil-tests/file-descriptor.cc
index 808bb31d8e99..c385d2960f01 100644
--- a/src/libutil-tests/file-descriptor.cc
+++ b/src/libutil-tests/file-descriptor.cc
@@ -130,7 +130,7 @@ TEST(ReadLine, TreatsEioAsEof)
     ASSERT_EQ(unlockpt(master), 0);
 
     // Open and immediately close the slave to trigger EIO on the master.
-    int slave = open(ptsname(master), O_RDWR | O_NOCTTY);
+    int slave = open(ptsname(master), O_RDWR | O_NOCTTY | O_CLOEXEC);
     ASSERT_NE(slave, -1);
     close(slave);
 
@@ -153,7 +153,7 @@ TEST(ReadLine, PartialLineBeforeEio)
     ASSERT_EQ(grantpt(master), 0);
     ASSERT_EQ(unlockpt(master), 0);
 
-    int slave = open(ptsname(master), O_RDWR | O_NOCTTY);
+    int slave = open(ptsname(master), O_RDWR | O_NOCTTY | O_CLOEXEC);
     ASSERT_NE(slave, -1);
 
     // Write a partial line (no terminator) from the slave, then close it.
diff --git a/src/libutil-tests/file-system.cc b/src/libutil-tests/file-system.cc
index 995b75814f01..c89cd221d199 100644
--- a/src/libutil-tests/file-system.cc
+++ b/src/libutil-tests/file-system.cc
@@ -5,8 +5,6 @@
 #include <gtest/gtest.h>
 #include <rapidcheck/gtest.h>
 
-using namespace std::string_view_literals;
-
 #ifdef _WIN32
 #  define FS_SEP L"\\"
 #  define FS_ROOT_NO_TRAILING_SLASH L"C:" // Need a mounted one, C drive is likely
@@ -111,10 +109,12 @@ TEST(canonPath, removesDots2)
 
 TEST(canonPath, requiresAbsolutePath)
 {
+    using namespace std::string_view_literals;
+
     ASSERT_ANY_THROW(canonPath("."sv));
     ASSERT_ANY_THROW(canonPath(".."sv));
     ASSERT_ANY_THROW(canonPath("../"sv));
-    ASSERT_DEATH({ canonPath(""sv); }, "!path.empty\\(\\)");
+    ASSERT_ANY_THROW(canonPath(""sv));
 }
 
 /* ----------------------------------------------------------------------------
@@ -256,20 +256,6 @@ TEST(pathExists, bogusPathDoesNotExist)
     ASSERT_FALSE(pathExists("/schnitzel/darmstadt/pommes"));
 }
 
-/* ----------------------------------------------------------------------------
- * makeParentCanonical
- * --------------------------------------------------------------------------*/
-
-TEST(makeParentCanonical, noParent)
-{
-    ASSERT_EQ(makeParentCanonical("file"), absPath(std::filesystem::path("file")));
-}
-
-TEST(makeParentCanonical, root)
-{
-    ASSERT_EQ(makeParentCanonical(FS_ROOT), FS_ROOT_NO_TRAILING_SLASH);
-}
-
 /* ----------------------------------------------------------------------------
  * chmodIfNeeded
  * --------------------------------------------------------------------------*/
diff --git a/src/libutil-tests/hash.cc b/src/libutil-tests/hash.cc
index 51924f47f969..06081f1f98f3 100644
--- a/src/libutil-tests/hash.cc
+++ b/src/libutil-tests/hash.cc
@@ -6,6 +6,8 @@
 
 namespace nix {
 
+namespace {
+
 class HashTest : public virtual CharacterizationTest
 {
     std::filesystem::path unitTestData = getUnitTestData() / "hash";
@@ -266,4 +268,6 @@ INSTANTIATE_TEST_SUITE_P(BLAKE3HashJSON, BLAKE3HashJsonTest, ([] {
                                  });
                          }()));
 
+} // namespace
+
 } // namespace nix
diff --git a/src/libutil-tests/hilite.cc b/src/libutil-tests/hilite.cc
index 6436ad6840ef..b4999d42f43a 100644
--- a/src/libutil-tests/hilite.cc
+++ b/src/libutil-tests/hilite.cc
@@ -7,22 +7,22 @@ namespace nix {
 
 TEST(hiliteMatches, noHighlight)
 {
-    ASSERT_STREQ(hiliteMatches("Hello, world!", std::vector<std::smatch>(), "(", ")").c_str(), "Hello, world!");
+    ASSERT_STREQ(hiliteMatches("Hello, world!", std::vector<boost::smatch>(), "(", ")").c_str(), "Hello, world!");
 }
 
 TEST(hiliteMatches, simpleHighlight)
 {
     std::string str = "Hello, world!";
-    std::regex re = std::regex("world");
-    auto matches = std::vector(std::sregex_iterator(str.begin(), str.end(), re), std::sregex_iterator());
+    boost::regex re = boost::regex("world");
+    auto matches = std::vector(boost::sregex_iterator(str.begin(), str.end(), re), boost::sregex_iterator());
     ASSERT_STREQ(hiliteMatches(str, matches, "(", ")").c_str(), "Hello, (world)!");
 }
 
 TEST(hiliteMatches, multipleMatches)
 {
     std::string str = "Hello, world, world, world, world, world, world, Hello!";
-    std::regex re = std::regex("world");
-    auto matches = std::vector(std::sregex_iterator(str.begin(), str.end(), re), std::sregex_iterator());
+    boost::regex re = boost::regex("world");
+    auto matches = std::vector(boost::sregex_iterator(str.begin(), str.end(), re), boost::sregex_iterator());
     ASSERT_STREQ(
         hiliteMatches(str, matches, "(", ")").c_str(),
         "Hello, (world), (world), (world), (world), (world), (world), Hello!");
@@ -31,10 +31,10 @@ TEST(hiliteMatches, multipleMatches)
 TEST(hiliteMatches, overlappingMatches)
 {
     std::string str = "world, Hello, world, Hello, world, Hello, world, Hello, world!";
-    std::regex re = std::regex("Hello, world");
-    std::regex re2 = std::regex("world, Hello");
-    auto v = std::vector(std::sregex_iterator(str.begin(), str.end(), re), std::sregex_iterator());
-    for (auto it = std::sregex_iterator(str.begin(), str.end(), re2); it != std::sregex_iterator(); ++it) {
+    boost::regex re = boost::regex("Hello, world");
+    boost::regex re2 = boost::regex("world, Hello");
+    auto v = std::vector(boost::sregex_iterator(str.begin(), str.end(), re), boost::sregex_iterator());
+    for (auto it = boost::sregex_iterator(str.begin(), str.end(), re2); it != boost::sregex_iterator(); ++it) {
         v.push_back(*it);
     }
     ASSERT_STREQ(
@@ -45,14 +45,14 @@ TEST(hiliteMatches, complexOverlappingMatches)
 {
     std::string str = "legacyPackages.x86_64-linux.git-crypt";
     std::vector regexes = {
-        std::regex("t-cry"),
-        std::regex("ux\\.git-cry"),
-        std::regex("git-c"),
-        std::regex("pt"),
+        boost::regex("t-cry"),
+        boost::regex("ux\\.git-cry"),
+        boost::regex("git-c"),
+        boost::regex("pt"),
     };
-    std::vector<std::smatch> matches;
+    std::vector<boost::smatch> matches;
     for (const auto & regex : regexes) {
-        for (auto it = std::sregex_iterator(str.begin(), str.end(), regex); it != std::sregex_iterator(); ++it) {
+        for (auto it = boost::sregex_iterator(str.begin(), str.end(), regex); it != boost::sregex_iterator(); ++it) {
             matches.push_back(*it);
         }
     }
diff --git a/src/libutil-tests/local-keys.cc b/src/libutil-tests/local-keys.cc
new file mode 100644
index 000000000000..665200550cc3
--- /dev/null
+++ b/src/libutil-tests/local-keys.cc
@@ -0,0 +1,64 @@
+#include "nix/util/signature/local-keys.hh"
+#include "nix/util/base-n.hh"
+
+#include <gtest/gtest.h>
+
+namespace nix {
+
+TEST(local_keys, signAndVerify)
+{
+    auto sk = SecretKey::generate("test-key-1");
+    auto pk = sk.toPublicKey();
+
+    auto sig = sk.signDetached("hello world");
+    auto sig2 = sk.signDetached("hello world");
+    ASSERT_EQ(sig, sig2); // checks idempotence of signing
+
+    ASSERT_EQ(sig.keyName, "test-key-1");
+    ASSERT_TRUE(pk.verifyDetached("hello world", sig));
+
+    auto sk2 = SecretKey(sk.to_string());
+    ASSERT_EQ(sk2.name, sk.name);
+    ASSERT_EQ(sk2.key, sk.key);
+
+    auto pk2 = PublicKey(pk.to_string());
+    ASSERT_EQ(pk2.name, pk.name);
+    ASSERT_EQ(pk2.key, pk.key);
+}
+
+TEST(local_keys, rfc8032TestVector)
+{
+    // Test vector from RFC-8032, section 7.1.
+    auto seed = base16::decode(
+        "833fe62409237b9d62ec77587520911e"
+        "9a759cec1d19755b7da901b96dca3d42");
+    auto pubKeyBytes = base16::decode(
+        "ec172b93ad5e563bf4932c70e1245034"
+        "c35467ef2efd4d64ebf819683467e2bf");
+    auto message = base16::decode(
+        "ddaf35a193617abacc417349ae204131"
+        "12e6fa4e89a97ea20a9eeee64b55d39a"
+        "2192992a274fc1a836ba3c23a3feebbd"
+        "454d4423643ce80e2a9ac94fa54ca49f");
+    auto expectedSig = base16::decode(
+        "dc2a4459e7369633a52b1bf277839a00"
+        "201009a3efbf3ecb69bea2186c26b589"
+        "09351fc9ac90b3ecfdfbc7c66431e030"
+        "3dca179c138ac17ad9bef1177331a704");
+
+    // libsodium's 64-byte secret key format is: seed (32) || public key (32).
+    auto skBytes = seed + pubKeyBytes;
+    auto skString = "test:" + base64::encode(std::as_bytes(std::span<const char>{skBytes.data(), skBytes.size()}));
+
+    auto sk = SecretKey(skString);
+    auto sig = sk.signDetached(message);
+
+    ASSERT_EQ(sig.keyName, "test");
+    ASSERT_EQ(sig.sig, expectedSig);
+
+    auto pk = sk.toPublicKey();
+    ASSERT_EQ(pk.key, pubKeyBytes);
+    ASSERT_TRUE(pk.verifyDetached(message, sig));
+}
+
+} // namespace nix
diff --git a/src/libutil-tests/memo.cc b/src/libutil-tests/memo.cc
new file mode 100644
index 000000000000..76be65260953
--- /dev/null
+++ b/src/libutil-tests/memo.cc
@@ -0,0 +1,46 @@
+#include <gtest/gtest.h>
+#include <string>
+
+#include "nix/util/memo.hh"
+
+namespace nix {
+
+TEST(memo, computesOnce)
+{
+    int calls = 0;
+    fun<int()> f = memo<int>([&calls]() -> int {
+        calls++;
+        return 42;
+    });
+    EXPECT_EQ(f(), 42);
+    EXPECT_EQ(f(), 42);
+    EXPECT_EQ(f(), 42);
+    EXPECT_EQ(calls, 1);
+}
+
+TEST(memo, copiesShareCache)
+{
+    int calls = 0;
+    fun<int()> f = memo<int>([&calls]() -> int {
+        calls++;
+        return 7;
+    });
+    auto g = f;
+    EXPECT_EQ(f(), 7);
+    EXPECT_EQ(g(), 7);
+    EXPECT_EQ(calls, 1);
+}
+
+TEST(memo, worksWithString)
+{
+    int calls = 0;
+    fun<std::string()> f = memo<std::string>([&calls]() -> std::string {
+        calls++;
+        return "hello";
+    });
+    EXPECT_EQ(f(), "hello");
+    EXPECT_EQ(f(), "hello");
+    EXPECT_EQ(calls, 1);
+}
+
+} // namespace nix
diff --git a/src/libutil-tests/memory-source-accessor.cc b/src/libutil-tests/memory-source-accessor.cc
index e80bfaeb9adb..bcdc70522b69 100644
--- a/src/libutil-tests/memory-source-accessor.cc
+++ b/src/libutil-tests/memory-source-accessor.cc
@@ -11,7 +11,6 @@ namespace nix {
 
 namespace memory_source_accessor {
 
-using namespace std::literals;
 using File = MemorySourceAccessor::File;
 
 ref<MemorySourceAccessor> exampleSimple()
@@ -26,6 +25,7 @@ ref<MemorySourceAccessor> exampleSimple()
 
 ref<MemorySourceAccessor> exampleComplex()
 {
+    using namespace std::literals;
     auto files = make_ref<MemorySourceAccessor>();
     files->root = File::Directory{
         .entries{
diff --git a/src/libutil-tests/meson.build b/src/libutil-tests/meson.build
index 6a86504ded42..1a5b24761fce 100644
--- a/src/libutil-tests/meson.build
+++ b/src/libutil-tests/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -77,8 +77,10 @@ sources = files(
   'hash.cc',
   'hilite.cc',
   'json-utils.cc',
+  'local-keys.cc',
   'logging.cc',
   'lru-cache.cc',
+  'memo.cc',
   'memory-source-accessor.cc',
   'monitorfdhup.cc',
   'nar-listing.cc',
diff --git a/src/libutil-tests/serialise.cc b/src/libutil-tests/serialise.cc
index 13b285e2b44d..40424c6853a6 100644
--- a/src/libutil-tests/serialise.cc
+++ b/src/libutil-tests/serialise.cc
@@ -1,5 +1,7 @@
 #include "nix/util/serialise.hh"
+#include "nix/util/config.hh"
 
+#include <boost/context/detail/exception.hpp>
 #include <gtest/gtest.h>
 
 namespace nix {
@@ -22,4 +24,58 @@ TEST(readNum, negativeValuesSerialiseWellDefined)
     EXPECT_EQ(readNum<uint64_t>(*makeNumSource(int16_t(-1))), std::numeric_limits<uint64_t>::max());
 }
 
+TEST(readPadding, works)
+{
+    for (unsigned i = 0; i < 8; ++i)
+        EXPECT_NO_THROW(readPadding(i, *makeNumSource(0)));
+
+    for (unsigned len = 1; len < 8; ++len) {
+        EXPECT_THROW(readPadding(len, *makeNumSource(~uint64_t(0))), SerialisationError);
+        unsigned padLen = 8 - len;
+        for (unsigned byte = 0; byte < padLen; ++byte) {
+            uint64_t val = uint64_t{1} << (8 * byte);
+            EXPECT_THROW(readPadding(len, *makeNumSource(val)), SerialisationError);
+        }
+    }
+}
+
+// The following test catches the bug only under fcontext backend,
+// but Boost.Coroutine2 stack switching when abandoning confuses the
+// hell out of ASan. The workaround to getting ASan working isn't
+// immediately useful because it works only with ucontext implementation.
+// https://www.boost.org/doc/libs/1_89_0/libs/coroutine2/doc/html/coroutine2/stack/sanitizers.html
+#if !NIX_ASAN_ENABLED
+
+TEST(sourceToSink, forcedUnwindUcaughtExceptions)
+{
+    int uncaughtExceptions = 42;
+    bool caught = false;
+
+    auto sink = sourceToSink([&](Source & source) {
+        auto recordUncaughtExceptions = Finally([&]() { uncaughtExceptions = std::uncaught_exceptions(); });
+        try {
+            StringSink s;
+            source.drainInto(s, 8);
+            source.drainInto(s, 8);
+        } catch (const boost::context::detail::forced_unwind &) {
+            caught = true;
+            throw;
+        }
+    });
+
+    *sink << 42;
+
+    // Abandon the coroutine. This will trigger it to unwind with boost::context::detail::forced_unwind.
+    sink.reset();
+
+    ASSERT_TRUE(caught);
+    // This is a test for boost.context regression fixed by https://github.com/boostorg/context/pull/337.
+    // Without the fix std::uncaught_exceptions() *misreports* 0 while there's stack unwinding in progress.
+    // The issue only surfaces with libstdc++ and fcontext when boost.context
+    // uses fiber-specific exception states and messes with __cxa_get_globals().
+    ASSERT_EQ(uncaughtExceptions, 1);
+}
+
+#endif
+
 } // namespace nix
diff --git a/src/libutil-tests/source-accessor.cc b/src/libutil-tests/source-accessor.cc
index 1ee2c44cc6fc..fd281eb27f54 100644
--- a/src/libutil-tests/source-accessor.cc
+++ b/src/libutil-tests/source-accessor.cc
@@ -1,6 +1,7 @@
 #include "nix/util/fs-sink.hh"
 #include "nix/util/file-system.hh"
 #include "nix/util/processes.hh"
+#include "nix/util/tests/gmock-matchers.hh"
 
 #include <gtest/gtest.h>
 #include <gmock/gmock.h>
@@ -8,66 +9,6 @@
 
 namespace nix {
 
-MATCHER_P2(HasContents, path, expected, "")
-{
-    auto stat = arg->maybeLstat(path);
-    if (!stat) {
-        *result_listener << arg->showPath(path) << " does not exist";
-        return false;
-    }
-    if (stat->type != SourceAccessor::tRegular) {
-        *result_listener << arg->showPath(path) << " is not a regular file";
-        return false;
-    }
-    auto actual = arg->readFile(path);
-    if (actual != expected) {
-        *result_listener << arg->showPath(path) << " has contents " << ::testing::PrintToString(actual);
-        return false;
-    }
-    return true;
-}
-
-MATCHER_P2(HasSymlink, path, target, "")
-{
-    auto stat = arg->maybeLstat(path);
-    if (!stat) {
-        *result_listener << arg->showPath(path) << " does not exist";
-        return false;
-    }
-    if (stat->type != SourceAccessor::tSymlink) {
-        *result_listener << arg->showPath(path) << " is not a symlink";
-        return false;
-    }
-    auto actual = arg->readLink(path);
-    if (actual != target) {
-        *result_listener << arg->showPath(path) << " points to " << ::testing::PrintToString(actual);
-        return false;
-    }
-    return true;
-}
-
-MATCHER_P2(HasDirectory, path, dirents, "")
-{
-    auto stat = arg->maybeLstat(path);
-    if (!stat) {
-        *result_listener << arg->showPath(path) << " does not exist";
-        return false;
-    }
-    if (stat->type != SourceAccessor::tDirectory) {
-        *result_listener << arg->showPath(path) << " is not a directory";
-        return false;
-    }
-    auto actual = arg->readDirectory(path);
-    std::set<std::string> actualKeys, expectedKeys(dirents.begin(), dirents.end());
-    for (auto & [k, _] : actual)
-        actualKeys.insert(k);
-    if (actualKeys != expectedKeys) {
-        *result_listener << arg->showPath(path) << " has entries " << ::testing::PrintToString(actualKeys);
-        return false;
-    }
-    return true;
-}
-
 class FSSourceAccessorTest : public ::testing::Test
 {
 protected:
@@ -105,17 +46,19 @@ TEST_F(FSSourceAccessorTest, works)
         sink.createSymlink(CanonPath("a/dirlink"), "../subdir");
     }
 
-    EXPECT_THAT(makeFSSourceAccessor(tmpDir / "file1"), HasContents(CanonPath::root, "content1"));
-    EXPECT_THAT(makeFSSourceAccessor(tmpDir / "rootlink"), HasSymlink(CanonPath::root, "target"));
+    EXPECT_THAT(makeFSSourceAccessor(tmpDir / "file1"), testing::HasContents(CanonPath::root, "content1"));
+    EXPECT_THAT(makeFSSourceAccessor(tmpDir / "rootlink"), testing::HasSymlink(CanonPath::root, "target"));
     EXPECT_THAT(
         makeFSSourceAccessor(tmpDir),
-        HasDirectory(CanonPath::root, std::set<std::string>{"file1", "subdir", "rootlink", "a"}));
-    EXPECT_THAT(makeFSSourceAccessor(tmpDir / "subdir"), HasDirectory(CanonPath::root, std::set<std::string>{"file2"}));
+        testing::HasDirectory(CanonPath::root, std::set<std::string>{"file1", "subdir", "rootlink", "a"}));
+    EXPECT_THAT(
+        makeFSSourceAccessor(tmpDir / "subdir"),
+        testing::HasDirectory(CanonPath::root, std::set<std::string>{"file2"}));
 
     {
         auto accessor = makeFSSourceAccessor(tmpDir);
-        EXPECT_THAT(accessor, HasContents(CanonPath("file1"), "content1"));
-        EXPECT_THAT(accessor, HasContents(CanonPath("subdir/file2"), "content2"));
+        EXPECT_THAT(accessor, testing::HasContents(CanonPath("file1"), "content1"));
+        EXPECT_THAT(accessor, testing::HasContents(CanonPath("subdir/file2"), "content2"));
 
         EXPECT_TRUE(accessor->pathExists(CanonPath("file1")));
         EXPECT_FALSE(accessor->pathExists(CanonPath("nonexistent")));
@@ -138,6 +81,32 @@ TEST_F(FSSourceAccessorTest, works)
     }
 }
 
+TEST_F(FSSourceAccessorTest, invalidateCacheDropsStaleDirFds)
+{
+#ifdef _WIN32
+    GTEST_SKIP() << "fd-based accessor is Unix-only";
+#endif
+    auto accessor = makeFSSourceAccessor(tmpDir);
+
+    createDirs(tmpDir / "a" / "b");
+    writeFile(tmpDir / "a" / "b" / "f", "old");
+
+    EXPECT_TRUE(accessor->pathExists(CanonPath("a/b/f")));
+
+    deletePath(tmpDir / "a" / "b");
+    createDirs(tmpDir / "a" / "b");
+    writeFile(tmpDir / "a" / "b" / "g", "new");
+    createSymlink("g", tmpDir / "a" / "b" / "l");
+
+    accessor->invalidateCache();
+
+    EXPECT_FALSE(accessor->pathExists(CanonPath("a/b/f")));
+    EXPECT_TRUE(accessor->pathExists(CanonPath("a/b/g")));
+    EXPECT_THAT(accessor, testing::HasContents(CanonPath("a/b/g"), "new"));
+    EXPECT_THAT(accessor, testing::HasDirectory(CanonPath("a/b"), (std::set<std::string>{"g", "l"})));
+    EXPECT_THAT(accessor, testing::HasSymlink(CanonPath("a/b/l"), "g"));
+}
+
 /* ----------------------------------------------------------------------------
  * RestoreSink non-directory at root (no dirFd)
  * --------------------------------------------------------------------------*/
@@ -152,7 +121,7 @@ TEST_F(FSSourceAccessorTest, RestoreSinkRegularFileAtRoot)
         sink.createRegularFile(CanonPath::root, [](CreateRegularFileSink & crf) { crf("root content"); });
     }
 
-    EXPECT_THAT(makeFSSourceAccessor(filePath), HasContents(CanonPath::root, "root content"));
+    EXPECT_THAT(makeFSSourceAccessor(filePath), testing::HasContents(CanonPath::root, "root content"));
 }
 
 TEST_F(FSSourceAccessorTest, RestoreSinkSymlinkAtRoot)
@@ -168,7 +137,7 @@ TEST_F(FSSourceAccessorTest, RestoreSinkSymlinkAtRoot)
         sink.createSymlink(CanonPath::root, "symlink_target");
     }
 
-    EXPECT_THAT(makeFSSourceAccessor(linkPath), HasSymlink(CanonPath::root, "symlink_target"));
+    EXPECT_THAT(makeFSSourceAccessor(linkPath), testing::HasSymlink(CanonPath::root, "symlink_target"));
 }
 
 } // namespace nix
diff --git a/src/libutil-tests/unix/file-system-at.cc b/src/libutil-tests/unix/file-system-at.cc
index 09e427a26faf..e453a80d325b 100644
--- a/src/libutil-tests/unix/file-system-at.cc
+++ b/src/libutil-tests/unix/file-system-at.cc
@@ -42,8 +42,6 @@ TEST(fchmodatTryNoFollow, works)
     auto dirFd = openDirectory(tmpDir, FinalSymlink::Follow);
     ASSERT_TRUE(dirFd);
 
-    struct ::stat st;
-
     using nix::testing::ThrowsSysError;
 
     /* Check that symlinks are not followed and targets are not changed.
@@ -82,22 +80,18 @@ TEST(fchmodatTryNoFollow, works)
     };
 
     expectSymlinkChmod("filelink", 0777);
-    ASSERT_EQ(stat((tmpDir / "file").c_str(), &st), 0);
-    EXPECT_EQ(st.st_mode & 0777, 0644);
+    ASSERT_EQ(stat(tmpDir / "file").st_mode & 0777, 0644);
 
     expectSymlinkChmod("dirlink", 0777);
-    ASSERT_EQ(stat((tmpDir / "dir").c_str(), &st), 0);
-    EXPECT_EQ(st.st_mode & 0777, 0755);
+    ASSERT_EQ(stat(tmpDir / "dir").st_mode & 0777, 0755);
 
     /* Check fchmodatTryNoFollow works on regular files and directories. */
 
     EXPECT_NO_THROW(fchmodatTryNoFollow(dirFd.get(), CanonPath("file"), 0600));
-    ASSERT_EQ(stat((tmpDir / "file").c_str(), &st), 0);
-    EXPECT_EQ(st.st_mode & 0777, 0600);
+    ASSERT_EQ(stat(tmpDir / "file").st_mode & 0777, 0600);
 
     EXPECT_NO_THROW(fchmodatTryNoFollow(dirFd.get(), CanonPath("dir"), 0700));
-    ASSERT_EQ(stat((tmpDir / "dir").c_str(), &st), 0);
-    EXPECT_EQ(st.st_mode & 0777, 0700);
+    ASSERT_EQ(stat(tmpDir / "dir").st_mode & 0777, 0700);
 
     EXPECT_THAT([&] { fchmodatTryNoFollow(dirFd.get(), CanonPath("nonexistent"), 0600); }, ThrowsSysError(ENOENT));
 }
diff --git a/src/libutil-tests/unix/unix-domain-socket.cc b/src/libutil-tests/unix/unix-domain-socket.cc
index 439d3188ac2d..b5050e564585 100644
--- a/src/libutil-tests/unix/unix-domain-socket.cc
+++ b/src/libutil-tests/unix/unix-domain-socket.cc
@@ -6,6 +6,7 @@
 
 #include <algorithm>
 #include <sys/socket.h>
+#include <sys/wait.h>
 
 namespace nix {
 
diff --git a/src/libutil-tests/url.cc b/src/libutil-tests/url.cc
index 042572b6fe40..491a3a4f41f3 100644
--- a/src/libutil-tests/url.cc
+++ b/src/libutil-tests/url.cc
@@ -1,9 +1,12 @@
 #include "nix/util/url.hh"
+#include "nix/util/tests/capture-logging.hh"
 #include "nix/util/tests/gmock-matchers.hh"
+
 #include <gtest/gtest.h>
 #include <gmock/gmock.h>
 
 #include <ranges>
+#include <optional>
 
 namespace nix {
 
@@ -25,7 +28,19 @@ std::ostream & operator<<(std::ostream & os, const FixGitURLParam & param)
 }
 
 class FixGitURLTestSuite : public ::testing::TestWithParam<FixGitURLParam>
-{};
+{
+    std::optional<testing::CaptureLogging> captureLogging;
+
+    void SetUp() override
+    {
+        captureLogging.emplace();
+    }
+
+    void TearDown() override
+    {
+        captureLogging.reset();
+    }
+};
 
 INSTANTIATE_TEST_SUITE_P(
     FixGitURLs,
@@ -366,7 +381,7 @@ TEST_P(FixGitURLTestSuite, parsedNormalized)
     EXPECT_EQ(actual.to_string(), p.expected);
 }
 
-TEST(FixGitURLTestSuite, rejectFileURLWithAuthority)
+TEST_F(FixGitURLTestSuite, rejectFileURLWithAuthority)
 {
     /* From the underlying `parseURL` validations. */
     EXPECT_THAT(
@@ -375,7 +390,7 @@ TEST(FixGitURLTestSuite, rejectFileURLWithAuthority)
             testing::HasSubstrIgnoreANSIMatcher("file:// URL 'file://var/repos/x' has unexpected authority 'var'")));
 }
 
-TEST(FixGitURLTestSuite, rejectRelativePath)
+TEST_F(FixGitURLTestSuite, rejectRelativePath)
 {
     /* From the underlying `parseURL` validations. */
     EXPECT_THAT(
@@ -383,7 +398,7 @@ TEST(FixGitURLTestSuite, rejectRelativePath)
         ::testing::ThrowsMessage<BadURL>(testing::HasSubstrIgnoreANSIMatcher("doesn't have a scheme")));
 }
 
-TEST(FixGitURLTestSuite, rejectEmptyPathGitScp)
+TEST_F(FixGitURLTestSuite, rejectEmptyPathGitScp)
 {
     /* Reject SCP-style URLs with no path component. */
     EXPECT_THAT(
@@ -392,7 +407,7 @@ TEST(FixGitURLTestSuite, rejectEmptyPathGitScp)
             testing::HasSubstrIgnoreANSIMatcher("SCP-style Git URL 'host:' has an empty path")));
 }
 
-TEST(FixGitURLTestSuite, rejectMalformedBracketedURLs)
+TEST_F(FixGitURLTestSuite, rejectMalformedBracketedURLs)
 {
     /* Brackets not in host position go through the colon-based path,
        consistent with git (which also finds the first colon). These
@@ -418,7 +433,7 @@ TEST(FixGitURLTestSuite, rejectMalformedBracketedURLs)
     EXPECT_EQ(parsed3.authority->user, "user:");
 }
 
-TEST(FixGitURLTestSuite, mismatchedBrackets)
+TEST_F(FixGitURLTestSuite, mismatchedBrackets)
 {
     /* Missing `]`: git's `host_end()` falls back to `end = host` and
        finds the first `:` as separator. We do the same — fall through
@@ -454,7 +469,7 @@ TEST(FixGitURLTestSuite, mismatchedBrackets)
         ::testing::ThrowsMessage<BadURL>(testing::HasSubstrIgnoreANSIMatcher("is not a valid IPv6 address")));
 }
 
-TEST(FixGitURLTestSuite, slashBeforeColonIsNotScp)
+TEST_F(FixGitURLTestSuite, slashBeforeColonIsNotScp)
 {
     /* A slash before the first colon means it's not SCP — consistent
        with git's `url_is_local_not_ssh()`. */
@@ -463,7 +478,7 @@ TEST(FixGitURLTestSuite, slashBeforeColonIsNotScp)
         ::testing::ThrowsMessage<BadURL>(testing::HasSubstrIgnoreANSIMatcher("doesn't have a scheme")));
 }
 
-TEST(FixGitURLTestSuite, noColonIsNotScp)
+TEST_F(FixGitURLTestSuite, noColonIsNotScp)
 {
     /* No `:` at all means not SCP — consistent with git's
        `url_is_local_not_ssh()` in `connect.c`.
@@ -479,7 +494,7 @@ TEST(FixGitURLTestSuite, noColonIsNotScp)
         ::testing::ThrowsMessage<BadURL>(testing::HasSubstrIgnoreANSIMatcher("is not a valid URL")));
 }
 
-TEST(FixGitURLTestSuite, gitBugDiscardedCharsBetweenBracketAndColon)
+TEST_F(FixGitURLTestSuite, gitBugDiscardedCharsBetweenBracketAndColon)
 {
     /* Git's `host_end()` returns `end` past `]`, then `strchr(end, ':')`
        finds `:` anywhere after — silently discarding characters between
diff --git a/src/libutil-tests/util.cc b/src/libutil-tests/util.cc
index 031dd7a444af..679f4eec73cc 100644
--- a/src/libutil-tests/util.cc
+++ b/src/libutil-tests/util.cc
@@ -377,4 +377,44 @@ TEST(getOr, getFromContainer)
     ASSERT_EQ(getOr(s, "one", "nope"), expected);
 }
 
+/* ----------------------------------------------------------------------------
+ * markLast
+ * --------------------------------------------------------------------------*/
+
+TEST(markLast, empty)
+{
+    std::vector<int> v;
+    std::vector<std::pair<bool, int>> result;
+    for (auto [last, x] : markLast(v))
+        result.emplace_back(last, x);
+    ASSERT_TRUE(result.empty());
+}
+
+TEST(markLast, singleElement)
+{
+    std::vector<int> v{42};
+    std::vector<std::pair<bool, int>> result;
+    for (auto [last, x] : markLast(v))
+        result.emplace_back(last, x);
+    ASSERT_EQ(result, (std::vector<std::pair<bool, int>>{{true, 42}}));
+}
+
+TEST(markLast, multipleElements)
+{
+    std::vector<int> v{10, 20, 30};
+    std::vector<std::pair<bool, int>> result;
+    for (auto [last, x] : markLast(v))
+        result.emplace_back(last, x);
+    ASSERT_EQ(result, (std::vector<std::pair<bool, int>>{{false, 10}, {false, 20}, {true, 30}}));
+}
+
+TEST(markLast, mutateThroughReference)
+{
+    std::vector<int> v{1, 2, 3};
+    for (auto && [last, x] : markLast(v))
+        if (last)
+            x = 99;
+    ASSERT_EQ(v, (std::vector<int>{1, 2, 99}));
+}
+
 } // namespace nix
diff --git a/src/libutil/archive.cc b/src/libutil/archive.cc
index f704acdf78b4..56172bf32b9a 100644
--- a/src/libutil/archive.cc
+++ b/src/libutil/archive.cc
@@ -6,7 +6,7 @@
 #include "nix/util/archive.hh"
 #include "nix/util/alignment.hh"
 #include "nix/util/config-global.hh"
-#include "nix/util/posix-source-accessor.hh"
+#include "nix/util/source-accessor.hh"
 #include "nix/util/source-path.hh"
 #include "nix/util/file-system.hh"
 #include "nix/util/signals.hh"
@@ -15,6 +15,10 @@ namespace nix {
 
 struct ArchiveSettings : Config
 {
+private:
+    void anchor() override;
+public:
+
     Setting<bool> useCaseHack{
         this,
 #ifdef __APPLE__
@@ -30,14 +34,19 @@ static ArchiveSettings archiveSettings;
 
 static GlobalConfig::Register rArchiveSettings(&archiveSettings);
 
+/* Maximum directory nesting depth for dumpPath()/parseDump(). Bounds
+   stack usage so deep trees cannot overflow the (possibly coroutine)
+   stack these run on. */
+static constexpr size_t narMaxDepth = 64;
+
 PathFilter defaultPathFilter = [](const std::string &) { return true; };
 
 void SourceAccessor::dumpPath(const CanonPath & path, Sink & sink, PathFilter & filter)
 {
-    auto dumpContents = [&](const CanonPath & path) {
+    auto dumpContents = [&sink](SourceAccessor & accessor, const CanonPath & path) {
         sink << "contents";
         std::optional<uint64_t> size;
-        readFile(path, sink, [&](uint64_t _size) {
+        accessor.readFile(path, sink, [&](uint64_t _size) {
             size = _size;
             sink << _size;
         });
@@ -47,10 +56,18 @@ void SourceAccessor::dumpPath(const CanonPath & path, Sink & sink, PathFilter &
 
     sink << narVersionMagic1;
 
-    [&, &this_(*this)](this const auto & dump, const CanonPath & path) -> void {
+    [&sink, &filter, &dumpContents](
+        this const auto & dump,
+        SourceAccessor & accessor,
+        const CanonPath & path,
+        const CanonPath & filterPath,
+        size_t depth) -> void {
         checkInterrupt();
 
-        auto st = this_.lstat(path);
+        if (depth >= narMaxDepth)
+            throw Error("path '%s' exceeds maximum NAR directory depth of %d", accessor.showPath(path), narMaxDepth);
+
+        auto st = accessor.lstat(path);
 
         sink << "(";
 
@@ -58,7 +75,7 @@ void SourceAccessor::dumpPath(const CanonPath & path, Sink & sink, PathFilter &
             sink << "type" << "regular";
             if (st.isExecutable)
                 sink << "executable" << "";
-            dumpContents(path);
+            dumpContents(accessor, path);
         }
 
         else if (st.type == tDirectory) {
@@ -67,7 +84,7 @@ void SourceAccessor::dumpPath(const CanonPath & path, Sink & sink, PathFilter &
             /* If we're on a case-insensitive system like macOS, undo
                the case hack applied by restorePath(). */
             StringMap unhacked;
-            for (auto & i : this_.readDirectory(path))
+            for (auto & i : accessor.readDirectory(path))
                 if (archiveSettings.useCaseHack) {
                     std::string name(i.first);
                     size_t pos = i.first.find(caseHackSuffix);
@@ -81,34 +98,39 @@ void SourceAccessor::dumpPath(const CanonPath & path, Sink & sink, PathFilter &
                 } else
                     unhacked.emplace(i.first, i.first);
 
-            for (auto & i : unhacked)
-                if (filter((path / i.first).abs())) {
-                    sink << "entry" << "(" << "name" << i.first << "node";
-                    dump(path / i.second);
-                    sink << ")";
-                }
+            accessor.readDirectory(path, [&](SourceAccessor & subdirAccessor, const CanonPath & subdirRelPath) {
+                for (auto & i : unhacked)
+                    if (filter((filterPath / i.first).abs())) {
+                        sink << "entry" << "(" << "name" << i.first << "node";
+                        dump(subdirAccessor, subdirRelPath / i.second, filterPath / i.second, depth + 1);
+                        sink << ")";
+                    }
+            });
         }
 
         else if (st.type == tSymlink)
-            sink << "type" << "symlink" << "target" << this_.readLink(path);
+            sink << "type" << "symlink" << "target" << accessor.readLink(path);
 
         else
             throw Error("file '%s' has an unsupported type", path);
 
         sink << ")";
-    }(path);
+    }(*this, path, path, 0);
 }
 
+void ArchiveSettings::anchor() {}
+
 time_t dumpPathAndGetMtime(const std::filesystem::path & path, Sink & sink, PathFilter & filter)
 {
-    auto path2 = PosixSourceAccessor::createAtRoot(path, /*trackLastModified=*/true);
+    SourcePath path2 = makeFSSourceAccessor(absPath(path), /*trackLastModified=*/true);
     path2.dumpPath(sink, filter);
     return path2.accessor->getLastModified().value();
 }
 
 void dumpPath(const std::filesystem::path & path, Sink & sink, PathFilter & filter)
 {
-    dumpPathAndGetMtime(path, sink, filter);
+    SourcePath path2 = makeFSSourceAccessor(absPath(path), /*trackLastModified=*/false);
+    path2.dumpPath(sink, filter);
 }
 
 void dumpString(std::string_view s, Sink & sink)
@@ -129,7 +151,14 @@ static void parseContents(CreateRegularFileSink & sink, Source & source)
     sink.preallocateContents(size);
 
     if (sink.skipContents) {
-        source.skip(alignUp(size, 8));
+        uint64_t left = alignUp(size, 8);
+        /* Source::skip takes a size_t, which might be narrower on 32 bit systems, so
+           be careful around truncations. */
+        while (left) {
+            size_t toSkip = std::min<uint64_t>(left, std::numeric_limits<size_t>::max());
+            source.skip(toSkip);
+            left -= toSkip;
+        }
         return;
     }
 
@@ -146,35 +175,47 @@ struct CaseInsensitiveCompare
     }
 };
 
-static void parse(FileSystemObjectSink & sink, Source & source, const CanonPath & path)
+static void parse(FileSystemObjectSink & sink, Source & source, const CanonPath & path, size_t depth)
 {
-    auto getString = [&]() {
+    if (depth >= narMaxDepth)
+        throw badArchive("NAR directory nesting exceeds maximum depth of %d", narMaxDepth);
+
+    /* NAR keywords are all <= 10 bytes; a little slack keeps error
+       messages useful for short garbage without allowing large
+       allocations. */
+    constexpr size_t narMaxTag = 32;
+    /* Format-defined bounds, intentionally independent of host
+       NAME_MAX/PATH_MAX. */
+    constexpr size_t narMaxName = 255;
+    constexpr size_t narMaxTarget = 4095;
+
+    auto getString = [&](size_t max) {
         checkInterrupt();
-        return readString(source);
+        return readString(source, max);
     };
 
     auto expectTag = [&](std::string_view expected) {
-        auto tag = getString();
+        auto tag = getString(narMaxTag);
         if (tag != expected)
-            throw badArchive("expected tag '%s', got '%s'", expected, tag.substr(0, 1024));
+            throw badArchive("expected tag '%s', got '%s'", expected, tag);
     };
 
     expectTag("(");
 
     expectTag("type");
 
-    auto type = getString();
+    auto type = getString(narMaxTag);
 
     if (type == "regular") {
         sink.createRegularFile(path, [&](auto & crf) {
-            auto tag = getString();
+            auto tag = getString(narMaxTag);
 
             if (tag == "executable") {
-                auto s2 = getString();
+                auto s2 = getString(0);
                 if (s2 != "")
                     throw badArchive("executable marker has non-empty value");
                 crf.isExecutable();
-                tag = getString();
+                tag = getString(narMaxTag);
             }
 
             if (tag != "contents")
@@ -193,7 +234,7 @@ static void parse(FileSystemObjectSink & sink, Source & source, const CanonPath
             std::string prevName;
 
             while (1) {
-                auto tag = getString();
+                auto tag = getString(narMaxTag);
 
                 if (tag == ")")
                     break;
@@ -205,7 +246,7 @@ static void parse(FileSystemObjectSink & sink, Source & source, const CanonPath
 
                 expectTag("name");
 
-                auto name = getString();
+                auto name = getString(narMaxName);
                 if (name.empty() || name == "." || name == ".." || name.find('/') != std::string::npos
                     || name.find((char) 0) != std::string::npos)
                     throw badArchive("NAR contains invalid file name '%1%'", name);
@@ -230,7 +271,7 @@ static void parse(FileSystemObjectSink & sink, Source & source, const CanonPath
 
                 expectTag("node");
 
-                parse(dirSink, source, relDirPath / name);
+                parse(dirSink, source, relDirPath / name, depth + 1);
 
                 expectTag(")");
             }
@@ -240,7 +281,9 @@ static void parse(FileSystemObjectSink & sink, Source & source, const CanonPath
     else if (type == "symlink") {
         expectTag("target");
 
-        auto target = getString();
+        auto target = getString(narMaxTarget);
+        if (target.empty() || target.find((char) 0) != std::string::npos)
+            throw badArchive("NAR contains invalid symlink target");
         sink.createSymlink(path, target);
 
         expectTag(")");
@@ -261,7 +304,7 @@ void parseDump(FileSystemObjectSink & sink, Source & source)
     }
     if (version != narVersionMagic1)
         throw badArchive("input doesn't look like a Nix archive");
-    parse(sink, source, CanonPath::root);
+    parse(sink, source, CanonPath::root, 0);
 }
 
 void restorePath(const std::filesystem::path & path, Source & source, bool startFsync)
diff --git a/src/libutil/args.cc b/src/libutil/args.cc
index 0fa356f68907..4a85a08cb26e 100644
--- a/src/libutil/args.cc
+++ b/src/libutil/args.cc
@@ -14,6 +14,8 @@
 
 namespace nix {
 
+void AddCompletions::anchor() {}
+
 void Args::addFlag(Flag && flag_)
 {
     auto flag = std::make_shared<Flag>(std::move(flag_));
diff --git a/src/libutil/base-n.cc b/src/libutil/base-n.cc
index 4c9726ad2e5e..d5553a87e262 100644
--- a/src/libutil/base-n.cc
+++ b/src/libutil/base-n.cc
@@ -4,8 +4,6 @@
 #include "nix/util/util.hh"
 #include "nix/util/base-n.hh"
 
-using namespace std::literals;
-
 namespace nix {
 
 constexpr static const std::array<char, 16> base16Chars = "0123456789abcdef"_arrayNoNull;
diff --git a/src/libutil/bump-memory-resource.cc b/src/libutil/bump-memory-resource.cc
index c892b1652d80..938bd2b84e1b 100644
--- a/src/libutil/bump-memory-resource.cc
+++ b/src/libutil/bump-memory-resource.cc
@@ -1,4 +1,6 @@
 #include "nix/util/bump-memory-resource.hh"
+#include "nix/util/environment-variables.hh"
+#include "nix/util/error.hh"
 #include "nix/util/file-system.hh"
 #include "nix/util/alignment.hh"
 #include "nix/util/logging.hh"
@@ -57,7 +59,7 @@ static bool canOvercommit(std::size_t reserveSize)
 
 #endif // _WIN32
 
-BumpMemoryResource::BumpMemoryResource(std::size_t reserveSize, std::pmr::memory_resource * upstream)
+BumpMemoryResource::BumpMemoryResource(std::size_t reserveSize, std::pmr::memory_resource * upstream, bool dontDump)
     : upstreamResource(upstream)
 {
 #ifndef _WIN32
@@ -83,6 +85,12 @@ BumpMemoryResource::BumpMemoryResource(std::size_t reserveSize, std::pmr::memory
 
     base = p;
     capacity = reserveSize;
+
+#  ifdef MADV_DONTDUMP
+    static const bool dumpEverything = getEnv("_NIX_CORE_DUMP_EVERYTHING").value_or("0") == "1";
+    if (!dumpEverything && dontDump && ::madvise(p, reserveSize, MADV_DONTDUMP))
+        throw SysError("calling madvise");
+#  endif
 #endif
 }
 
diff --git a/src/libutil/caching-source-accessor.cc b/src/libutil/caching-source-accessor.cc
new file mode 100644
index 000000000000..13efc1b8bdf3
--- /dev/null
+++ b/src/libutil/caching-source-accessor.cc
@@ -0,0 +1,108 @@
+#include "nix/util/source-accessor.hh"
+
+#include <boost/unordered/concurrent_flat_map.hpp>
+
+namespace nix {
+
+namespace {
+
+class CachingSourceAccessor : public SourceAccessor
+{
+    ref<SourceAccessor> next;
+
+    boost::concurrent_flat_map<CanonPath, Stat> lstatCache;
+    boost::concurrent_flat_map<CanonPath, std::string> readLinkCache;
+
+    void anchor() override {};
+
+public:
+    CachingSourceAccessor(ref<SourceAccessor> next_)
+        : next(std::move(next_))
+    {
+        displayPrefix.clear();
+    }
+
+    void readFile(const CanonPath & path, Sink & sink, fun<void(uint64_t)> sizeCallback) override
+    {
+        next->readFile(path, sink, sizeCallback);
+    }
+
+    std::optional<Stat> maybeLstat(const CanonPath & path) override
+    {
+        if (auto res = getConcurrent(lstatCache, path))
+            return *res;
+
+        auto st = next->maybeLstat(path);
+        if (!st)
+            return std::nullopt;
+
+        /* Never evict, the evaluator better keep positive lookups cached. */
+        lstatCache.emplace(path, *st);
+        return st;
+    }
+
+    Stat lstat(const CanonPath & path) override
+    {
+        if (auto res = getConcurrent(lstatCache, path))
+            return *res;
+
+        auto st = next->lstat(path);
+        /* Never evict, the evaluator better keep positive lookups cached. */
+        lstatCache.emplace(path, st);
+        return st;
+    }
+
+    DirEntries readDirectory(const CanonPath & path) override
+    {
+        return next->readDirectory(path);
+    }
+
+    void readDirectory(
+        const CanonPath & dirPath,
+        std::function<void(SourceAccessor & subdirAccessor, const CanonPath & subdirRelPath)> callback) override
+    {
+        return next->readDirectory(dirPath, std::move(callback));
+    }
+
+    std::string readLink(const CanonPath & path) override
+    {
+        if (auto res = getConcurrent(readLinkCache, path))
+            return *res;
+
+        auto target = next->readLink(path);
+        /* Never evict, the evaluator better keep positive lookups cached. */
+        readLinkCache.emplace(path, target);
+        return target;
+    }
+
+    std::string showPath(const CanonPath & path) override
+    {
+        return next->showPath(path);
+    }
+
+    void invalidateCache() override
+    {
+        lstatCache.clear();
+        readLinkCache.clear();
+        next->invalidateCache();
+    }
+
+    std::optional<std::filesystem::path> getPhysicalPath(const CanonPath & path) override
+    {
+        return next->getPhysicalPath(path);
+    }
+
+    std::pair<CanonPath, std::optional<std::string>> getFingerprint(const CanonPath & path) override
+    {
+        return next->getFingerprint(path);
+    }
+};
+
+} // namespace
+
+ref<SourceAccessor> makeCachingSourceAccessor(ref<SourceAccessor> next)
+{
+    return make_ref<CachingSourceAccessor>(std::move(next));
+}
+
+} // namespace nix
diff --git a/src/libutil/canon-path.cc b/src/libutil/canon-path.cc
index e62abdf31964..a90206ee1753 100644
--- a/src/libutil/canon-path.cc
+++ b/src/libutil/canon-path.cc
@@ -7,6 +7,8 @@
 
 namespace nix {
 
+void BadCanonPath::anchor() {}
+
 const CanonPath CanonPath::root = CanonPath("/");
 
 static std::string absPathPure(std::string_view path)
diff --git a/src/libutil/checked-arithmetic.cc b/src/libutil/checked-arithmetic.cc
new file mode 100644
index 000000000000..99810d03e7ea
--- /dev/null
+++ b/src/libutil/checked-arithmetic.cc
@@ -0,0 +1,7 @@
+#include "nix/util/checked-arithmetic.hh"
+
+namespace nix::checked {
+
+DivideByZero::~DivideByZero() {}
+
+} // namespace nix::checked
diff --git a/src/libutil/compression-algo.cc b/src/libutil/compression-algo.cc
index dab53b124f13..a10118a830db 100644
--- a/src/libutil/compression-algo.cc
+++ b/src/libutil/compression-algo.cc
@@ -6,6 +6,8 @@
 
 namespace nix {
 
+void UnknownCompressionMethod::anchor() {}
+
 CompressionAlgo parseCompressionAlgo(std::string_view method, bool suggestions)
 {
 #define NIX_COMPRESSION_ALGO_FROM_STRING(name, value) {name, CompressionAlgo::value},
diff --git a/src/libutil/compression.cc b/src/libutil/compression.cc
index 24539a46335e..f8b977a81c66 100644
--- a/src/libutil/compression.cc
+++ b/src/libutil/compression.cc
@@ -17,8 +17,14 @@
 
 namespace nix {
 
+void CompressionError::anchor() {}
+
+void CompressionSink::anchor() {}
+
 static const int COMPRESSION_LEVEL_DEFAULT = -1;
 
+namespace {
+
 // Don't feed brotli too much at once.
 struct ChunkedCompressionSink : CompressionSink
 {
@@ -39,13 +45,13 @@ struct ChunkedCompressionSink : CompressionSink
 
 struct ArchiveDecompressionSource : Source
 {
-    std::unique_ptr<TarArchive> archive = 0;
+    std::unique_ptr<TarArchive> archive;
     Source & src;
-    std::optional<std::string> compressionMethod;
+    CompressionAlgo compressionMethod;
 
-    ArchiveDecompressionSource(Source & src, std::optional<std::string> compressionMethod = std::nullopt)
+    ArchiveDecompressionSource(Source & src, CompressionAlgo compressionMethod)
         : src(src)
-        , compressionMethod(std::move(compressionMethod))
+        , compressionMethod(compressionMethod)
     {
     }
 
@@ -55,8 +61,8 @@ struct ArchiveDecompressionSource : Source
     {
         struct archive_entry * ae;
         if (!archive) {
-            archive = std::make_unique<TarArchive>(src, /*raw*/ true, compressionMethod);
-            this->archive->check(archive_read_next_header(this->archive->archive, &ae), "failed to read header (%s)");
+            archive = std::make_unique<TarArchive>(src, /*raw=*/true, compressionMethod);
+            archive->check(archive_read_next_header(this->archive->archive, &ae), "failed to read header (%s)");
             if (archive_filter_count(this->archive->archive) < 2) {
                 throw CompressionError("input compression not recognized");
             }
@@ -246,7 +252,9 @@ struct BrotliDecompressionSink : ChunkedCompressionSink
     }
 };
 
-std::string decompress(const std::string & method, std::string_view in)
+} // namespace
+
+std::string decompress(CompressionAlgo method, std::string_view in)
 {
     StringSink ssink;
     auto sink = makeDecompressionSink(method, ssink);
@@ -255,11 +263,11 @@ std::string decompress(const std::string & method, std::string_view in)
     return std::move(ssink.s);
 }
 
-std::unique_ptr<FinishSink> makeDecompressionSink(const std::string & method, Sink & nextSink)
+std::unique_ptr<FinishSink> makeDecompressionSink(CompressionAlgo method, Sink & nextSink)
 {
-    if (method == "none" || method == "" || method == "identity")
+    if (method == CompressionAlgo::none)
         return std::make_unique<NoneSink>(nextSink);
-    else if (method == "br")
+    else if (method == CompressionAlgo::brotli)
         return std::make_unique<BrotliDecompressionSink>(nextSink);
     else
         return sourceToSink([method, &nextSink](Source & source) {
@@ -268,6 +276,8 @@ std::unique_ptr<FinishSink> makeDecompressionSink(const std::string & method, Si
         });
 }
 
+namespace {
+
 struct BrotliCompressionSink : ChunkedCompressionSink
 {
     Sink & nextSink;
@@ -443,6 +453,8 @@ struct ZstdMultiFrameCompressionSink : CompressionSink
     }
 };
 
+} // namespace
+
 ref<CompressionSink> makeCompressionSink(CompressionAlgo method, Sink & nextSink, const bool parallel, int level)
 {
     switch (method) {
diff --git a/src/libutil/config-global.cc b/src/libutil/config-global.cc
index b63b4aaa1bbe..c60d0e4ebc64 100644
--- a/src/libutil/config-global.cc
+++ b/src/libutil/config-global.cc
@@ -4,6 +4,8 @@
 
 namespace nix {
 
+void GlobalConfig::anchor() {}
+
 GlobalConfig::ConfigRegistrations & GlobalConfig::configRegistrations()
 {
     static GlobalConfig::ConfigRegistrations configRegistrations;
diff --git a/src/libutil/configuration.cc b/src/libutil/configuration.cc
index 297d4221f18e..b84867885098 100644
--- a/src/libutil/configuration.cc
+++ b/src/libutil/configuration.cc
@@ -14,6 +14,12 @@
 
 namespace nix {
 
+void Config::anchor() {}
+
+void AbstractConfig::anchor() {}
+
+Setting<AbsolutePath>::~Setting() {}
+
 Config::Config(StringMap initials)
     : AbstractConfig(std::move(initials))
 {
@@ -210,7 +216,7 @@ std::string Config::toKeyValue()
 {
     std::string res;
     for (const auto & s : _settings)
-        if (s.second.isAlias)
+        if (!s.second.isAlias)
             res += fmt("%s = %s\n", s.first, s.second.setting->to_string());
     return res;
 }
@@ -550,6 +556,8 @@ template class BaseSetting<AbsolutePath>;
 template class BaseSetting<std::optional<AbsolutePath>>;
 template class BaseSetting<std::optional<std::string>>;
 
+void ExperimentalFeatureSettings::anchor() {}
+
 bool ExperimentalFeatureSettings::isEnabled(const ExperimentalFeature & feature) const
 {
     auto & f = experimentalFeatures.get();
diff --git a/src/libutil/current-process.cc b/src/libutil/current-process.cc
index acb6e52dd733..a235d6b58bcf 100644
--- a/src/libutil/current-process.cc
+++ b/src/libutil/current-process.cc
@@ -8,6 +8,10 @@
 #include "nix/util/environment-variables.hh"
 #include <math.h>
 
+#ifndef _WIN32
+#  include "unix/current-process-private.hh"
+#endif
+
 #ifdef __APPLE__
 #  include <mach-o/dyld.h>
 #endif
@@ -55,44 +59,6 @@ unsigned int getMaxCPU()
 
 //////////////////////////////////////////////////////////////////////
 
-#ifndef _WIN32
-size_t savedStackSize = 0;
-
-void ensureStackSizeAtLeast(size_t stackSize)
-{
-    struct rlimit limit;
-    if (getrlimit(RLIMIT_STACK, &limit) == 0 && static_cast<size_t>(limit.rlim_cur) < stackSize) {
-        savedStackSize = limit.rlim_cur;
-        if (limit.rlim_max < static_cast<rlim_t>(stackSize)) {
-            if (getEnv("_NIX_TEST_NO_ENVIRONMENT_WARNINGS") != "1") {
-                logger->log(
-                    lvlWarn,
-                    HintFmt(
-                        "Stack size hard limit is %1%, which is less than the desired %2%. If possible, increase the hard limit, e.g. with 'ulimit -Hs %3%'.",
-                        limit.rlim_max,
-                        stackSize,
-                        stackSize / 1024)
-                        .str());
-            }
-        }
-        auto requestedSize = std::min(static_cast<rlim_t>(stackSize), limit.rlim_max);
-        limit.rlim_cur = requestedSize;
-        if (setrlimit(RLIMIT_STACK, &limit) != 0) {
-            logger->log(
-                lvlError,
-                HintFmt(
-                    "Failed to increase stack size from %1% to %2% (desired: %3%, maximum allowed: %4%): %5%",
-                    savedStackSize,
-                    requestedSize,
-                    stackSize,
-                    limit.rlim_max,
-                    std::strerror(errno))
-                    .str());
-        }
-    }
-}
-#endif
-
 void restoreProcessContext(bool restoreMounts)
 {
 #ifndef _WIN32
@@ -105,10 +71,10 @@ void restoreProcessContext(bool restoreMounts)
     }
 
 #ifndef _WIN32
-    if (savedStackSize) {
+    if (unix::savedStackSize) {
         struct rlimit limit;
         if (getrlimit(RLIMIT_STACK, &limit) == 0) {
-            limit.rlim_cur = savedStackSize;
+            limit.rlim_cur = unix::savedStackSize;
             setrlimit(RLIMIT_STACK, &limit);
         }
     }
diff --git a/src/libutil/error.cc b/src/libutil/error.cc
index f43df1de5209..182621b66ac3 100644
--- a/src/libutil/error.cc
+++ b/src/libutil/error.cc
@@ -14,6 +14,18 @@
 
 namespace nix {
 
+void BaseError::anchor() {}
+
+void Error::anchor() {}
+
+void UsageError::anchor() {}
+
+void UnimplementedError::anchor() {}
+
+void SystemError::anchor() {}
+
+void SysError::anchor() {}
+
 void BaseError::addTrace(std::shared_ptr<const Pos> && e, HintFmt hint, TracePrint print)
 {
     err.traces.push_front(Trace{.pos = std::move(e), .hint = hint, .print = print});
diff --git a/src/libutil/executable-path.cc b/src/libutil/executable-path.cc
index 4da0999715ea..9c5c64e47d3e 100644
--- a/src/libutil/executable-path.cc
+++ b/src/libutil/executable-path.cc
@@ -5,6 +5,8 @@
 
 namespace nix {
 
+void ExecutableLookupError::anchor() {}
+
 constexpr static const OsStringView path_var_separator{
     &ExecutablePath::separator,
     1,
diff --git a/src/libutil/experimental-features.cc b/src/libutil/experimental-features.cc
index 5ce11836b0ba..04a6ef38afc9 100644
--- a/src/libutil/experimental-features.cc
+++ b/src/libutil/experimental-features.cc
@@ -15,6 +15,8 @@ struct ExperimentalFeatureDetails
     std::string_view trackingUrl;
 };
 
+void MissingExperimentalFeature::anchor() {}
+
 /**
  * If two different PRs both add an experimental feature, and we just
  * used a number for this, we *woudln't* get merge conflict and the
diff --git a/src/libutil/file-descriptor.cc b/src/libutil/file-descriptor.cc
index acd273ca79d9..469220d4c650 100644
--- a/src/libutil/file-descriptor.cc
+++ b/src/libutil/file-descriptor.cc
@@ -15,6 +15,8 @@
 
 namespace nix {
 
+void EndOfFile::anchor() {}
+
 namespace {
 
 enum class PollDirection { In, Out };
@@ -237,6 +239,7 @@ AutoCloseFD::AutoCloseFD(AutoCloseFD && that) noexcept
     that.fd = INVALID_DESCRIPTOR;
 }
 
+// NOLINTNEXTLINE(performance-noexcept-move-constructor) - technically can throw
 AutoCloseFD & AutoCloseFD::operator=(AutoCloseFD && that)
 {
     close();
@@ -254,7 +257,7 @@ AutoCloseFD::~AutoCloseFD()
     }
 }
 
-Descriptor AutoCloseFD::get() const
+Descriptor AutoCloseFD::get() const noexcept
 {
     return fd;
 }
@@ -285,12 +288,12 @@ void AutoCloseFD::startFsync() const
 #endif
 }
 
-AutoCloseFD::operator bool() const
+AutoCloseFD::operator bool() const noexcept
 {
     return fd != INVALID_DESCRIPTOR;
 }
 
-Descriptor AutoCloseFD::release()
+Descriptor AutoCloseFD::release() noexcept
 {
     Descriptor oldFD = fd;
     fd = INVALID_DESCRIPTOR;
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index b7e504e13a05..6432e7d52e5b 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -95,7 +95,8 @@ absPath(const std::filesystem::path & path0, const std::filesystem::path * dir,
 
 std::filesystem::path canonPath(const std::filesystem::path & path, bool resolveSymlinks)
 {
-    assert(!path.empty());
+    if (path.empty())
+        throw Error("cannot canonicalise an empty path");
 
     if (!path.is_absolute())
         throw Error("not an absolute path: %s", PathFmt(path));
@@ -393,7 +394,7 @@ void createDir(const std::filesystem::path & path, mode_t mode)
 void createDirs(const std::filesystem::path & path)
 {
     try {
-        std::filesystem::create_directories(path);
+        std::filesystem::create_directories(path); // NOLINT(bugprone-unsafe-functions)
     } catch (std::filesystem::filesystem_error & e) {
         throw SystemError(e.code(), "creating directory %1%", PathFmt(path));
     }
@@ -514,10 +515,11 @@ AutoCloseFD createAnonymousTempFile()
     return fd;
 }
 
-std::pair<AutoCloseFD, std::filesystem::path> createTempFile(const std::filesystem::path & prefix)
+std::pair<AutoCloseFD, std::filesystem::path>
+createTempFile(const std::filesystem::path & root, const std::filesystem::path & prefix)
 {
     assert(!prefix.is_absolute());
-    auto tmpl = (defaultTempDir() / (prefix.string() + ".XXXXXX")).string();
+    auto tmpl = (root / (prefix.string() + ".XXXXXX")).string();
     // FIXME: use O_TMPFILE.
     // `mkstemp` modifies the string to contain the actual filename.
     AutoCloseFD fd = toDescriptor(mkstemp(tmpl.data()));
@@ -530,6 +532,11 @@ std::pair<AutoCloseFD, std::filesystem::path> createTempFile(const std::filesyst
     return {std::move(fd), std::filesystem::path(std::move(tmpl))};
 }
 
+std::pair<AutoCloseFD, std::filesystem::path> createTempFile(const std::filesystem::path & prefix)
+{
+    return createTempFile(defaultTempDir(), prefix);
+}
+
 std::filesystem::path makeTempPath(const std::filesystem::path & root, const std::string & suffix)
 {
     // start the counter at a random value to minimize issues with preexisting temp paths
@@ -660,21 +667,6 @@ bool isExecutableFileAmbient(const std::filesystem::path & exe)
                   == 0;
 }
 
-std::filesystem::path makeParentCanonical(const std::filesystem::path & rawPath)
-{
-    std::filesystem::path path(absPath(rawPath));
-    try {
-        auto parent = path.parent_path();
-        if (parent == path) {
-            // `path` is a root directory => trivially canonical
-            return parent;
-        }
-        return std::filesystem::canonical(parent) / path.filename();
-    } catch (std::filesystem::filesystem_error & e) {
-        throw SystemError(e.code(), "canonicalising parent path of %1%", PathFmt(path));
-    }
-}
-
 void chmod(const std::filesystem::path & path, mode_t mode)
 {
     if (
@@ -694,6 +686,14 @@ void chmod(const std::filesystem::path & path, mode_t mode)
 #  define UNLINK_PROC ::unlink
 #endif
 
+void unlinkIfExists(const std::filesystem::path & path)
+{
+    if (UNLINK_PROC(path.c_str()) == -1) {
+        if (errno != ENOENT)
+            throw SysError("removing %s", PathFmt(path));
+    }
+}
+
 void unlink(const std::filesystem::path & path)
 {
     if (UNLINK_PROC(path.c_str()) == -1)
diff --git a/src/libutil/fs-sink.cc b/src/libutil/fs-sink.cc
index e41d153e92db..c95265e63703 100644
--- a/src/libutil/fs-sink.cc
+++ b/src/libutil/fs-sink.cc
@@ -14,6 +14,18 @@
 
 namespace nix {
 
+void FileSystemObjectSink::anchor() {}
+
+void ExtendedFileSystemObjectSink::anchor() {}
+
+void NullFileSystemObjectSink::anchor() {}
+
+void RegularFileSink::anchor() {}
+
+void RestoreSink::anchor() {}
+
+void CreateRegularFileSink::anchor() {}
+
 void copyRecursive(SourceAccessor & accessor, const CanonPath & from, FileSystemObjectSink & sink, const CanonPath & to)
 {
     auto stat = accessor.lstat(from);
@@ -34,10 +46,12 @@ void copyRecursive(SourceAccessor & accessor, const CanonPath & from, FileSystem
     }
 
     case SourceAccessor::tDirectory: {
-        sink.createDirectory(to, [&](FileSystemObjectSink & dirSink, const CanonPath & relDirPath) {
-            for (auto & [name, _] : accessor.readDirectory(from)) {
-                copyRecursive(accessor, from / name, dirSink, relDirPath / name);
-            }
+        sink.createDirectory(to, [&](FileSystemObjectSink & dirSink, const CanonPath & relDirPathTo) {
+            accessor.readDirectory(from, [&](SourceAccessor & subdirAccessor, const CanonPath & relDirPathFrom) {
+                for (auto & [name, _] : subdirAccessor.readDirectory(relDirPathFrom)) {
+                    copyRecursive(subdirAccessor, relDirPathFrom / name, dirSink, relDirPathTo / name);
+                }
+            });
         });
         break;
     }
@@ -52,6 +66,8 @@ void copyRecursive(SourceAccessor & accessor, const CanonPath & from, FileSystem
     }
 }
 
+namespace {
+
 struct RestoreSinkSettings : Config
 {
     Setting<bool> preallocateContents{
@@ -62,6 +78,8 @@ static RestoreSinkSettings restoreSinkSettings;
 
 static GlobalConfig::Register r1(&restoreSinkSettings);
 
+} // namespace
+
 static std::filesystem::path append(const std::filesystem::path & src, const CanonPath & path)
 {
     auto dst = src;
@@ -194,6 +212,8 @@ struct RestoreRegularFile : CreateRegularFileSink, FdSink
     {
     }
 
+    void anchor() override;
+
     ~RestoreRegularFile()
     {
         /* Flush the sink before FdSink destructor has a chance to run and we've
@@ -218,6 +238,8 @@ struct RestoreRegularFile : CreateRegularFileSink, FdSink
     void preallocateContents(uint64_t size) override;
 };
 
+void RestoreRegularFile::anchor() {}
+
 void RestoreSink::createRegularFile(const CanonPath & path, fun<void(CreateRegularFileSink &)> func)
 {
     auto crf = RestoreRegularFile(
@@ -265,6 +287,9 @@ void RestoreRegularFile::preallocateContents(uint64_t len)
 
 #if HAVE_POSIX_FALLOCATE
     if (len) {
+        if (len > std::numeric_limits<off_t>::max())
+            throw Error("cannot preallocate contents for a file because it's too large");
+
         errno = posix_fallocate(fd.get(), 0, len);
         /* Note that EINVAL may indicate that the underlying
            filesystem doesn't support preallocation (e.g. on
diff --git a/src/libutil/git.cc b/src/libutil/git.cc
index 96c6dd28791d..5cc1150aed7a 100644
--- a/src/libutil/git.cc
+++ b/src/libutil/git.cc
@@ -12,9 +12,6 @@
 
 namespace nix::git {
 
-using namespace nix;
-using namespace std::string_literals;
-
 std::optional<Mode> decodeMode(RawMode m)
 {
     switch (m) {
@@ -230,6 +227,7 @@ void restore(FileSystemObjectSink & sink, Source & source, HashAlgorithm hashAlg
 
 void dumpBlobPrefix(uint64_t size, Sink & sink, const ExperimentalFeatureSettings & xpSettings)
 {
+    using namespace std::string_literals;
     xpSettings.require(Xp::GitHashing);
     auto s = fmt("blob %d\0"s, std::to_string(size));
     sink(s);
@@ -237,6 +235,7 @@ void dumpBlobPrefix(uint64_t size, Sink & sink, const ExperimentalFeatureSetting
 
 void dumpTree(const Tree & entries, Sink & sink, const ExperimentalFeatureSettings & xpSettings)
 {
+    using namespace std::string_literals;
     xpSettings.require(Xp::GitHashing);
 
     std::string v1;
diff --git a/src/libutil/hash.cc b/src/libutil/hash.cc
index 2832de73c9f2..a50b1bd3d9e2 100644
--- a/src/libutil/hash.cc
+++ b/src/libutil/hash.cc
@@ -21,6 +21,12 @@
 
 namespace nix {
 
+void BadHash::anchor() {}
+
+void AbstractHashSink::anchor() {}
+
+void HashSink::anchor() {}
+
 const StringSet hashAlgorithms = {"blake3", "md5", "sha1", "sha256", "sha512"};
 
 const StringSet hashFormats = {"base64", "nix32", "base16", "sri"};
@@ -513,17 +519,15 @@ std::string_view printHashAlgo(HashAlgorithm ha)
 
 namespace nlohmann {
 
-using namespace nix;
-
-Hash adl_serializer<Hash>::from_json(const json & json, const ExperimentalFeatureSettings & xpSettings)
+nix::Hash adl_serializer<nix::Hash>::from_json(const json & json, const nix::ExperimentalFeatureSettings & xpSettings)
 {
-    auto & s = getString(json);
-    return Hash::parseSRI(s, xpSettings);
+    auto & s = nix::getString(json);
+    return nix::Hash::parseSRI(s, xpSettings);
 }
 
-void adl_serializer<Hash>::to_json(json & json, const Hash & hash)
+void adl_serializer<nix::Hash>::to_json(json & json, const nix::Hash & hash)
 {
-    json = hash.to_string(HashFormat::SRI, true);
+    json = hash.to_string(nix::HashFormat::SRI, true);
 }
 
 } // namespace nlohmann
diff --git a/src/libutil/hilite.cc b/src/libutil/hilite.cc
index 8b7e3ff23687..113dae553db2 100644
--- a/src/libutil/hilite.cc
+++ b/src/libutil/hilite.cc
@@ -3,7 +3,7 @@
 namespace nix {
 
 std::string
-hiliteMatches(std::string_view s, std::vector<std::smatch> matches, std::string_view prefix, std::string_view postfix)
+hiliteMatches(std::string_view s, std::vector<boost::smatch> matches, std::string_view prefix, std::string_view postfix)
 {
     // Avoid extra work on zero matches
     if (matches.size() == 0)
diff --git a/src/libutil/include/nix/util/args.hh b/src/libutil/include/nix/util/args.hh
index 2d4a81cafcd3..42ccb960525d 100644
--- a/src/libutil/include/nix/util/args.hh
+++ b/src/libutil/include/nix/util/args.hh
@@ -462,6 +462,9 @@ struct Completion
  */
 class AddCompletions
 {
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
 public:
 
     /**
diff --git a/src/libutil/include/nix/util/async.hh b/src/libutil/include/nix/util/async.hh
index 7abd446f7347..952cdb5610f8 100644
--- a/src/libutil/include/nix/util/async.hh
+++ b/src/libutil/include/nix/util/async.hh
@@ -88,21 +88,25 @@ asio::awaitable<T> callbackToAwaitable(F && initiate)
 }
 
 template<typename Range, typename F>
-asio::awaitable<void> forEachAsync(Range && range, F && f)
+asio::awaitable<void> forEachAsync(Range && range, const F & f)
 {
     /* This code only runs on a strand - we don't do multithreaded executors, so
        no need for synchronisation. */
     auto pending = std::ranges::size(range);
     if (pending == 0)
         co_return;
+    else if (pending == 1)
+        co_return co_await f(*range.begin());
 
     auto executor = co_await asio::this_coro::executor;
     std::exception_ptr err;
 
+    /* TODO: Handle cancellation on first error. Not very useful for now since we
+       do all-or-nothing cancellation typically. */
     co_await asio::async_initiate<decltype(asio::use_awaitable), void(std::exception_ptr)>(
         [&](auto handler) {
             auto h = std::make_shared<decltype(handler)>(std::move(handler));
-            for (auto && elt : range) {
+            for (auto && elt : std::forward<Range>(range)) {
                 asio::co_spawn(executor, f(elt), [executor, h, &err, &pending](std::exception_ptr ex) {
                     if (ex && !err)
                         err = ex;
diff --git a/src/libutil/include/nix/util/bump-memory-resource.hh b/src/libutil/include/nix/util/bump-memory-resource.hh
index 15b160f35fe8..9ae6be048588 100644
--- a/src/libutil/include/nix/util/bump-memory-resource.hh
+++ b/src/libutil/include/nix/util/bump-memory-resource.hh
@@ -39,7 +39,8 @@ public:
 
     explicit BumpMemoryResource(
         std::size_t reserveSize = defaultReserveSize,
-        std::pmr::memory_resource * upstream = std::pmr::new_delete_resource());
+        std::pmr::memory_resource * upstream = std::pmr::new_delete_resource(),
+        bool dontDump = true);
 
     BumpMemoryResource(BumpMemoryResource &&) = delete;
     BumpMemoryResource(const BumpMemoryResource &) = delete;
diff --git a/src/libutil/include/nix/util/checked-arithmetic.hh b/src/libutil/include/nix/util/checked-arithmetic.hh
index 48679622c003..84154103bea4 100644
--- a/src/libutil/include/nix/util/checked-arithmetic.hh
+++ b/src/libutil/include/nix/util/checked-arithmetic.hh
@@ -16,7 +16,15 @@
 namespace nix::checked {
 
 class DivideByZero : std::exception
-{};
+{
+public:
+    DivideByZero() = default;
+    DivideByZero(DivideByZero &&) = default;
+    DivideByZero(const DivideByZero &) = default;
+    DivideByZero & operator=(DivideByZero &&) = default;
+    DivideByZero & operator=(const DivideByZero &) = default;
+    virtual ~DivideByZero();
+};
 
 /**
  * Numeric value enforcing checked arithmetic. Performing mathematical operations on such values will return a Result
diff --git a/src/libutil/include/nix/util/closure.hh b/src/libutil/include/nix/util/closure.hh
index 586acfff7e70..5078a02d0795 100644
--- a/src/libutil/include/nix/util/closure.hh
+++ b/src/libutil/include/nix/util/closure.hh
@@ -26,7 +26,7 @@ template<typename T>
 using GetEdgesAsync = fun<asio::awaitable<std::set<T>>(const T & elt)>;
 
 template<typename T, typename CompletionToken>
-auto computeClosure(std::set<T> startElts, std::set<T> & res, GetEdgesAsync<T> getEdges, CompletionToken && token)
+auto computeClosure(std::set<T> startElts, std::set<T> & res, GetEdgesAsync<T> getEdges, CompletionToken token)
 {
     auto initiator = [&res, startElts = std::move(startElts), getEdges = std::move(getEdges)](auto handler) {
         auto executor = asio::make_strand(asio::get_associated_executor(handler));
diff --git a/src/libutil/include/nix/util/compression.hh b/src/libutil/include/nix/util/compression.hh
index ec03509caef3..343b886761a7 100644
--- a/src/libutil/include/nix/util/compression.hh
+++ b/src/libutil/include/nix/util/compression.hh
@@ -10,16 +10,19 @@
 
 namespace nix {
 
-struct CompressionSink : BufferedSink, FinishSink
+class CompressionSink : public BufferedSink, public FinishSink
 {
+    void anchor() override;
+
+public:
     using BufferedSink::operator();
     using BufferedSink::writeUnbuffered;
     using FinishSink::finish;
 };
 
-std::string decompress(const std::string & method, std::string_view in);
+std::string decompress(CompressionAlgo method, std::string_view in);
 
-std::unique_ptr<FinishSink> makeDecompressionSink(const std::string & method, Sink & nextSink);
+std::unique_ptr<FinishSink> makeDecompressionSink(CompressionAlgo method, Sink & nextSink);
 
 std::string compress(CompressionAlgo method, std::string_view in, const bool parallel = false, int level = -1);
 
diff --git a/src/libutil/include/nix/util/config-global.hh b/src/libutil/include/nix/util/config-global.hh
index 5074351e046d..a0d662388620 100644
--- a/src/libutil/include/nix/util/config-global.hh
+++ b/src/libutil/include/nix/util/config-global.hh
@@ -5,8 +5,11 @@
 
 namespace nix {
 
-struct GlobalConfig : public AbstractConfig
+class GlobalConfig : public AbstractConfig
 {
+    void anchor() override;
+
+public:
     typedef std::vector<Config *> ConfigRegistrations;
 
     static ConfigRegistrations & configRegistrations();
diff --git a/src/libutil/include/nix/util/configuration.hh b/src/libutil/include/nix/util/configuration.hh
index 19d678601b1e..dc6d8a811b39 100644
--- a/src/libutil/include/nix/util/configuration.hh
+++ b/src/libutil/include/nix/util/configuration.hh
@@ -52,6 +52,11 @@ class AbstractSetting;
 
 class AbstractConfig
 {
+private:
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
+
 protected:
     StringMap unknownSettings;
 
@@ -141,6 +146,8 @@ class Config : public AbstractConfig
 {
     friend class AbstractSetting;
 
+    void anchor() override;
+
 public:
 
     struct SettingData
@@ -510,6 +517,9 @@ public:
         options->addSetting(this);
     }
 
+    /* To appease -Wweak-vtables. */
+    ~Setting() override;
+
     void operator=(const AbsolutePath & v)
     {
         this->assign(v);
@@ -540,7 +550,10 @@ void BaseSetting<std::set<std::filesystem::path>>::appendOrSet(std::set<std::fil
 
 struct ExperimentalFeatureSettings : Config
 {
+private:
+    void anchor() override;
 
+public:
     Setting<std::set<ExperimentalFeature>> experimentalFeatures{
         this,
         {},
@@ -578,7 +591,7 @@ struct ExperimentalFeatureSettings : Config
      */
     template<typename GetReason>
         requires std::invocable<GetReason> && std::convertible_to<std::invoke_result_t<GetReason>, std::string>
-    void require(const ExperimentalFeature & feature, GetReason && getReason) const
+    void require(const ExperimentalFeature & feature, const GetReason & getReason) const
     {
         if (isEnabled(feature))
             return;
diff --git a/src/libutil/include/nix/util/error.hh b/src/libutil/include/nix/util/error.hh
index b01c18e58da4..686ca708656b 100644
--- a/src/libutil/include/nix/util/error.hh
+++ b/src/libutil/include/nix/util/error.hh
@@ -111,6 +111,10 @@ std::ostream & showErrorInfo(std::ostream & out, const ErrorInfo & einfo, bool s
  */
 class BaseError : public std::exception
 {
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
+
 protected:
     mutable ErrorInfo err;
 
@@ -126,7 +130,7 @@ protected:
 public:
     BaseError(const BaseError &) = default;
     BaseError & operator=(const BaseError &) = default;
-    BaseError & operator=(BaseError &&) = default;
+    BaseError & operator=(BaseError &&) noexcept = default;
 
     template<typename... Args>
     BaseError(unsigned int status, Args &&... args)
@@ -268,6 +272,7 @@ public:
 #define MakeError(newClass, superClass)                             \
     class newClass : public CloneableError<newClass, superClass>    \
     {                                                               \
+        void anchor() override;                                     \
     public:                                                         \
         using CloneableError<newClass, superClass>::CloneableError; \
     }
@@ -286,6 +291,8 @@ class SystemError : public CloneableError<SystemError, Error>
     std::error_code errorCode;
     std::string errorDetails;
 
+    void anchor() override;
+
 protected:
 
     /**
@@ -377,6 +384,8 @@ public:
  */
 class SysError final : public CloneableError<SysError, SystemError>
 {
+    void anchor() override;
+
 public:
     int errNo;
 
@@ -499,6 +508,8 @@ namespace windows {
  */
 class WinError : public CloneableError<WinError, SystemError>
 {
+    void anchor() override;
+
 public:
     DWORD lastError;
 
diff --git a/src/libutil/include/nix/util/experimental-features.hh b/src/libutil/include/nix/util/experimental-features.hh
index 1a97f269144d..057a3b0064ed 100644
--- a/src/libutil/include/nix/util/experimental-features.hh
+++ b/src/libutil/include/nix/util/experimental-features.hh
@@ -81,6 +81,8 @@ std::set<ExperimentalFeature> parseFeatures(const StringSet &);
  */
 class MissingExperimentalFeature final : public CloneableError<MissingExperimentalFeature, Error>
 {
+    void anchor() override;
+
 public:
     /**
      * The experimental feature that was required but not enabled.
diff --git a/src/libutil/include/nix/util/file-descriptor.hh b/src/libutil/include/nix/util/file-descriptor.hh
index f92e737fcda5..53faa7acd8c7 100644
--- a/src/libutil/include/nix/util/file-descriptor.hh
+++ b/src/libutil/include/nix/util/file-descriptor.hh
@@ -262,10 +262,11 @@ public:
     AutoCloseFD(AutoCloseFD && fd) noexcept;
     ~AutoCloseFD();
     AutoCloseFD & operator=(const AutoCloseFD & fd) = delete;
+    // NOLINTNEXTLINE(performance-noexcept-move-constructor) - technically can throw because of close()
     AutoCloseFD & operator=(AutoCloseFD && fd);
-    Descriptor get() const;
-    explicit operator bool() const;
-    Descriptor release();
+    Descriptor get() const noexcept;
+    explicit operator bool() const noexcept;
+    Descriptor release() noexcept;
     void close();
 
     /**
diff --git a/src/libutil/include/nix/util/file-system-at.hh b/src/libutil/include/nix/util/file-system-at.hh
index 0f4678461ca0..800097a98f77 100644
--- a/src/libutil/include/nix/util/file-system-at.hh
+++ b/src/libutil/include/nix/util/file-system-at.hh
@@ -22,6 +22,12 @@
 #ifdef _WIN32
 #  define WIN32_LEAN_AND_MEAN
 #  include <windows.h>
+#elif defined(__FreeBSD__)
+// FreeBSD openat(..., AT_NOFOLLOW) on a symlink returns
+// `EMLINK`, not the posix-specified `ELOOP`.
+#  define NIX_ERR_OPEN_SYMLINK EMLINK
+#else
+#  define NIX_ERR_OPEN_SYMLINK ELOOP
 #endif
 
 namespace nix {
@@ -65,6 +71,7 @@ PosixStat fstatat(Descriptor dirFd, const std::filesystem::path & path);
 
 /**
  * Read a symlink relative to a directory file descriptor.
+ * On Linux, this also supports reading from O_PATH descriptors with CanonPath::root.
  *
  * @throws SystemError on any I/O errors.
  * @throws Interrupted if interrupted.
@@ -90,6 +97,8 @@ OsString readLinkAt(Descriptor dirFd, const CanonPath & path);
  * @param flags (Unix) `O_*` flags (must not include `O_NOFOLLOW`)
  * @param mode (Unix) Mode for `O_{CREAT,TMPFILE}`
  *
+ * @param dirFdCallback Callback invoked that gets the ownership of an intermediate directory fd.
+ *
  * @pre `path.isRoot()` is false
  *
  * @throws SymlinkNotAllowed if an interior path component is a
@@ -118,12 +127,12 @@ AutoCloseFD openFileEnsureBeneathNoSymlinks(
 #ifdef _WIN32
     ACCESS_MASK desiredAccess,
     ULONG createOptions,
-    ULONG createDisposition = FILE_OPEN
+    ULONG createDisposition = FILE_OPEN,
 #else
     int flags,
-    mode_t mode = 0
+    mode_t mode = 0,
 #endif
-);
+    std::function<void(AutoCloseFD dirFd, CanonPath relPath)> dirFdCallback = nullptr);
 
 #ifdef __linux__
 namespace linux {
diff --git a/src/libutil/include/nix/util/file-system.hh b/src/libutil/include/nix/util/file-system.hh
index f977e089bfef..3174b0cea854 100644
--- a/src/libutil/include/nix/util/file-system.hh
+++ b/src/libutil/include/nix/util/file-system.hh
@@ -159,23 +159,6 @@ std::optional<PosixStat> maybeStat(const std::filesystem::path & path);
  */
 bool pathExists(const std::filesystem::path & path);
 
-/**
- * Canonicalize a path except for the last component.
- *
- * This is useful for getting the canonical location of a symlink.
- *
- * Consider the case where `foo/l` is a symlink. `canonical("foo/l")` will
- * resolve the symlink `l` to its target.
- * `makeParentCanonical("foo/l")` will not resolve the symlink `l` to its target,
- * but does ensure that the returned parent part of the path, `foo` is resolved
- * to `canonical("foo")`, and can therefore be retrieved without traversing any
- * symlinks.
- *
- * If a relative path is passed, it will be made absolute, so that the parent
- * can always be canonicalized.
- */
-std::filesystem::path makeParentCanonical(const std::filesystem::path & path);
-
 /**
  * A version of pathExists that returns false on a permission error.
  * Useful for inferring default paths across directories that might not
@@ -451,6 +434,12 @@ createTempDir(const std::filesystem::path & tmpRoot = "", const std::string & pr
  */
 AutoCloseFD createAnonymousTempFile();
 
+/**
+ * Create a temporary file at a root, returning a file handle and its path.
+ */
+std::pair<AutoCloseFD, std::filesystem::path>
+createTempFile(const std::filesystem::path & root, const std::filesystem::path & prefix);
+
 /**
  * Create a temporary file, returning a file handle and its path.
  */
@@ -531,6 +520,13 @@ void chown(const std::filesystem::path & path, uid_t owner, gid_t group);
  */
 void unlink(const std::filesystem::path & path);
 
+/**
+ * Remove a file, throwing an exception on error. ENOENT is ignored.
+ *
+ * @param path Path to the file to remove.
+ */
+void unlinkIfExists(const std::filesystem::path & path);
+
 /**
  * Try to remove a file, ignoring errors.
  *
diff --git a/src/libutil/include/nix/util/fs-sink.hh b/src/libutil/include/nix/util/fs-sink.hh
index 495a4bab995c..98a6742f6c74 100644
--- a/src/libutil/include/nix/util/fs-sink.hh
+++ b/src/libutil/include/nix/util/fs-sink.hh
@@ -14,6 +14,10 @@ namespace nix {
  */
 struct CreateRegularFileSink : virtual Sink
 {
+private:
+    void anchor() override;
+
+public:
     /**
      * If set to true, the sink will not be called with the contents
      * of the file. `preallocateContents()` will still be called to
@@ -32,6 +36,12 @@ struct CreateRegularFileSink : virtual Sink
 
 struct FileSystemObjectSink
 {
+private:
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
+
+public:
     virtual ~FileSystemObjectSink() = default;
 
     virtual void createDirectory(const CanonPath & path) = 0;
@@ -68,6 +78,10 @@ struct FileSystemObjectSink
  */
 struct ExtendedFileSystemObjectSink : virtual FileSystemObjectSink
 {
+private:
+    void anchor() override;
+
+public:
     /**
      * Create a hard link. The target must be the path of a previously
      * encountered file relative to the root of the FSO.
@@ -86,6 +100,10 @@ void copyRecursive(
  */
 struct NullFileSystemObjectSink : FileSystemObjectSink
 {
+private:
+    void anchor() override;
+
+public:
     void createDirectory(const CanonPath & path) override {}
 
     void createSymlink(const CanonPath & path, const std::string & target) override {}
@@ -98,6 +116,10 @@ struct NullFileSystemObjectSink : FileSystemObjectSink
  */
 struct RestoreSink : FileSystemObjectSink
 {
+private:
+    void anchor() override;
+
+public:
     std::filesystem::path dstPath;
     /**
      * File descriptor for the directory located at dstPath. Used for *at
@@ -132,6 +154,10 @@ struct RestoreSink : FileSystemObjectSink
  */
 struct RegularFileSink : FileSystemObjectSink
 {
+private:
+    void anchor() override;
+
+public:
     bool regular = true;
     Sink & sink;
 
@@ -142,11 +168,13 @@ struct RegularFileSink : FileSystemObjectSink
 
     void createDirectory(const CanonPath & path) override
     {
+        /* FIXME: Throw an error here. */
         regular = false;
     }
 
     void createSymlink(const CanonPath & path, const std::string & target) override
     {
+        /* FIXME: Throw an error here. */
         regular = false;
     }
 
diff --git a/src/libutil/include/nix/util/fun.hh b/src/libutil/include/nix/util/fun.hh
index c480ffe71711..59a7cc87939c 100644
--- a/src/libutil/include/nix/util/fun.hh
+++ b/src/libutil/include/nix/util/fun.hh
@@ -1,6 +1,5 @@
 #pragma once
 ///@file
-// Tests in: src/libutil-tests/fun.cc
 
 #include <functional>
 #include <stdexcept>
diff --git a/src/libutil/include/nix/util/hash.hh b/src/libutil/include/nix/util/hash.hh
index cc2ea34b99fe..0ea54c802b16 100644
--- a/src/libutil/include/nix/util/hash.hh
+++ b/src/libutil/include/nix/util/hash.hh
@@ -216,6 +216,9 @@ std::string_view printHashAlgo(HashAlgorithm ha);
 
 struct AbstractHashSink : virtual Sink
 {
+private:
+    void anchor() override;
+public:
     virtual HashResult finish() = 0;
 };
 
@@ -226,6 +229,8 @@ private:
     Hash::Ctx * ctx;
     uint64_t bytes;
 
+    void anchor() override;
+
 public:
     HashSink(HashAlgorithm ha);
     HashSink(const HashSink & h);
@@ -260,4 +265,4 @@ inline std::size_t hash_value(const Hash & hash)
 
 } // namespace nix
 
-JSON_IMPL_WITH_XP_FEATURES(Hash)
+JSON_IMPL_WITH_XP_FEATURES(nix::Hash)
diff --git a/src/libutil/include/nix/util/hilite.hh b/src/libutil/include/nix/util/hilite.hh
index ee9985f39b2a..b86a12488166 100644
--- a/src/libutil/include/nix/util/hilite.hh
+++ b/src/libutil/include/nix/util/hilite.hh
@@ -1,7 +1,7 @@
 #pragma once
 ///@file
 
-#include <regex>
+#include <boost/regex.hpp>
 #include <vector>
 #include <string>
 
@@ -14,7 +14,7 @@ namespace nix {
  * If some matches overlap, then their union will be wrapped rather
  * than the individual matches.
  */
-std::string
-hiliteMatches(std::string_view s, std::vector<std::smatch> matches, std::string_view prefix, std::string_view postfix);
+std::string hiliteMatches(
+    std::string_view s, std::vector<boost::smatch> matches, std::string_view prefix, std::string_view postfix);
 
 } // namespace nix
diff --git a/src/libutil/include/nix/util/json-impls.hh b/src/libutil/include/nix/util/json-impls.hh
index 26a94472f25e..05c299cd535e 100644
--- a/src/libutil/include/nix/util/json-impls.hh
+++ b/src/libutil/include/nix/util/json-impls.hh
@@ -27,19 +27,21 @@
 
 #define JSON_IMPL(TYPE)    \
     namespace nlohmann {   \
-    using namespace nix;   \
     template<>             \
     JSON_IMPL_INNER(TYPE); \
     }
 
-#define JSON_IMPL_WITH_XP_FEATURES(TYPE)                                                                            \
-    namespace nlohmann {                                                                                            \
-    using namespace nix;                                                                                            \
-    template<>                                                                                                      \
-    struct adl_serializer<TYPE>                                                                                     \
-    {                                                                                                               \
-        static TYPE                                                                                                 \
-        from_json(const json & json, const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings); \
-        static void to_json(json & json, const TYPE & t);                                                           \
-    };                                                                                                              \
+#define JSON_IMPL_WITH_XP_FEATURES_INNER(TYPE)                                                       \
+    struct adl_serializer<TYPE>                                                                      \
+    {                                                                                                \
+        static TYPE from_json(                                                                       \
+            const json & json,                                                                       \
+            const nix::ExperimentalFeatureSettings & xpSettings = nix::experimentalFeatureSettings); \
+        static void to_json(json & json, const TYPE & t);                                            \
+    }
+
+#define JSON_IMPL_WITH_XP_FEATURES(TYPE)    \
+    namespace nlohmann {                    \
+    template<>                              \
+    JSON_IMPL_WITH_XP_FEATURES_INNER(TYPE); \
     }
diff --git a/src/libutil/include/nix/util/logging.hh b/src/libutil/include/nix/util/logging.hh
index 6f559b796c8e..dc69edde40bc 100644
--- a/src/libutil/include/nix/util/logging.hh
+++ b/src/libutil/include/nix/util/logging.hh
@@ -44,8 +44,11 @@ typedef enum {
 
 typedef uint64_t ActivityId;
 
-struct LoggerSettings : Config
+class LoggerSettings : public Config
 {
+    void anchor() override;
+
+public:
     Setting<bool> showTrace{
         this,
         false,
@@ -105,7 +108,7 @@ public:
 
     typedef std::vector<Field> Fields;
 
-    virtual ~Logger() {}
+    virtual ~Logger();
 
     virtual void stop() {};
 
@@ -255,7 +258,7 @@ struct PushActivity
     }
 };
 
-extern std::unique_ptr<Logger> logger;
+extern Logger * logger;
 
 std::unique_ptr<Logger> makeSimpleLogger(bool printBuildLogs = true);
 
diff --git a/src/libutil/include/nix/util/memo.hh b/src/libutil/include/nix/util/memo.hh
new file mode 100644
index 000000000000..ba09bac6eb75
--- /dev/null
+++ b/src/libutil/include/nix/util/memo.hh
@@ -0,0 +1,40 @@
+#pragma once
+///@file
+
+#include "nix/util/fun.hh"
+
+#include <memory>
+#include <mutex>
+#include <optional>
+
+namespace nix {
+
+/**
+ * Memoize a `fun<T()>`.
+ *
+ * Copies of the returned `fun` share the same cache.
+ * Thread-safe.
+ */
+template<typename T>
+fun<T()> memo(fun<T()> f)
+{
+    struct State
+    {
+        fun<T()> compute;
+        std::once_flag flag;
+        std::optional<T> cached;
+
+        explicit State(fun<T()> compute)
+            : compute(std::move(compute))
+        {
+        }
+    };
+
+    auto state = std::shared_ptr<State>(new State(std::move(f)));
+    return [state]() -> T {
+        std::call_once(state->flag, [&]() { state->cached.emplace(state->compute()); });
+        return *state->cached;
+    };
+}
+
+} // namespace nix
diff --git a/src/libutil/include/nix/util/memory-source-accessor.hh b/src/libutil/include/nix/util/memory-source-accessor.hh
index 154fc2560d89..8a946b36d3cf 100644
--- a/src/libutil/include/nix/util/memory-source-accessor.hh
+++ b/src/libutil/include/nix/util/memory-source-accessor.hh
@@ -108,6 +108,10 @@ VariantT<RegularContents, recur>::operator<=>(const VariantT<RegularContents, re
  */
 struct MemorySourceAccessor : virtual SourceAccessor
 {
+private:
+    void anchor() override;
+
+public:
     using File = fso::VariantT<std::string, true>;
 
     std::optional<File> root;
@@ -140,6 +144,10 @@ struct MemorySourceAccessor : virtual SourceAccessor
      */
     File * open(const CanonPath & path, std::optional<File> create);
 
+    /**
+     * @brief Insert a new regular file into with the specified @p contents.
+     * @todo Have a way to insert "borrowed" std::string_view without copying.
+     */
     SourcePath addFile(CanonPath path, std::string && contents);
 };
 
@@ -148,6 +156,10 @@ struct MemorySourceAccessor : virtual SourceAccessor
  */
 struct MemorySink : FileSystemObjectSink
 {
+private:
+    void anchor() override;
+
+public:
     MemorySourceAccessor & dst;
 
     MemorySink(MemorySourceAccessor & dst)
@@ -186,29 +198,27 @@ struct json_avoids_null<MemorySourceAccessor> : std::true_type
 
 namespace nlohmann {
 
-using namespace nix;
-
-#define ARG fso::Regular<RegularContents>
+#define ARG nix::fso::Regular<RegularContents>
 template<typename RegularContents>
 JSON_IMPL_INNER(ARG);
 #undef ARG
 
-#define ARG fso::DirectoryT<Child>
+#define ARG nix::fso::DirectoryT<Child>
 template<typename Child>
 JSON_IMPL_INNER(ARG);
 #undef ARG
 
 template<>
-JSON_IMPL_INNER(fso::Symlink);
+JSON_IMPL_INNER(nix::fso::Symlink);
 
 template<>
-JSON_IMPL_INNER(fso::Opaque);
+JSON_IMPL_INNER(nix::fso::Opaque);
 
-#define ARG fso::VariantT<RegularContents, recur>
+#define ARG nix::fso::VariantT<RegularContents, recur>
 template<typename RegularContents, bool recur>
 JSON_IMPL_INNER(ARG);
 #undef ARG
 
 } // namespace nlohmann
 
-JSON_IMPL(MemorySourceAccessor)
+JSON_IMPL(nix::MemorySourceAccessor)
diff --git a/src/libutil/include/nix/util/meson.build b/src/libutil/include/nix/util/meson.build
index 0f7a40df7a8c..4350be5a8bf6 100644
--- a/src/libutil/include/nix/util/meson.build
+++ b/src/libutil/include/nix/util/meson.build
@@ -60,6 +60,7 @@ headers = [ config_pub_h ] + files(
   'json-utils.hh',
   'logging.hh',
   'lru-cache.hh',
+  'memo.hh',
   'memory-source-accessor.hh',
   'mounted-source-accessor.hh',
   'muxable-pipe.hh',
@@ -71,7 +72,6 @@ headers = [ config_pub_h ] + files(
   'pos-idx.hh',
   'pos-table.hh',
   'position.hh',
-  'posix-source-accessor.hh',
   'processes.hh',
   'ref.hh',
   'regex-combinators.hh',
diff --git a/src/libutil/include/nix/util/mounted-source-accessor.hh b/src/libutil/include/nix/util/mounted-source-accessor.hh
index 518ae4f0959f..bc626bdf4a36 100644
--- a/src/libutil/include/nix/util/mounted-source-accessor.hh
+++ b/src/libutil/include/nix/util/mounted-source-accessor.hh
@@ -13,6 +13,8 @@ struct MountedSourceAccessor : SourceAccessor
      * there is no such mount point.
      */
     virtual std::shared_ptr<SourceAccessor> getMount(CanonPath mountPoint) = 0;
+
+    ~MountedSourceAccessor() override;
 };
 
 ref<MountedSourceAccessor> makeMountedSourceAccessor(std::map<CanonPath, ref<SourceAccessor>> mounts);
diff --git a/src/libutil/include/nix/util/nar-accessor.hh b/src/libutil/include/nix/util/nar-accessor.hh
index e7a6cfb2bc55..bed978ad98b5 100644
--- a/src/libutil/include/nix/util/nar-accessor.hh
+++ b/src/libutil/include/nix/util/nar-accessor.hh
@@ -20,6 +20,8 @@ struct NarAccessor : SourceAccessor
      * Get the NAR listing structure.
      */
     virtual const NarListing & getListing() const = 0;
+
+    ~NarAccessor() override;
 };
 
 /**
diff --git a/src/libutil/include/nix/util/os-string.hh b/src/libutil/include/nix/util/os-string.hh
index af686a62cb82..6279885666bb 100644
--- a/src/libutil/include/nix/util/os-string.hh
+++ b/src/libutil/include/nix/util/os-string.hh
@@ -7,6 +7,8 @@
 #include <string>
 #include <string_view>
 
+#include "nix/util/strings.hh"
+
 namespace nix {
 
 /**
diff --git a/src/libutil/include/nix/util/pos-idx.hh b/src/libutil/include/nix/util/pos-idx.hh
index 8e668176c619..299f703d98af 100644
--- a/src/libutil/include/nix/util/pos-idx.hh
+++ b/src/libutil/include/nix/util/pos-idx.hh
@@ -15,13 +15,13 @@ class PosIdx
 private:
     uint32_t id;
 
-    explicit PosIdx(uint32_t id)
+    constexpr explicit PosIdx(uint32_t id)
         : id(id)
     {
     }
 
 public:
-    PosIdx()
+    constexpr PosIdx()
         : id(0)
     {
     }
diff --git a/src/libutil/include/nix/util/posix-source-accessor.hh b/src/libutil/include/nix/util/posix-source-accessor.hh
deleted file mode 100644
index d93b68e0afea..000000000000
--- a/src/libutil/include/nix/util/posix-source-accessor.hh
+++ /dev/null
@@ -1,123 +0,0 @@
-#pragma once
-
-#include "nix/util/source-accessor.hh"
-
-namespace nix {
-
-struct SourcePath;
-
-namespace detail {
-
-/**
- * Common base helper class for deduplicating common code paths for tracking mtime.
- */
-class PosixSourceAccessorBase : virtual public SourceAccessor
-{
-protected:
-    const bool trackLastModified = false;
-
-    /**
-     * The most recent mtime seen by lstat(). This is a hack to
-     * support dumpPathAndGetMtime(). Should remove this eventually.
-     */
-    time_t mtime = 0;
-
-    void maybeUpdateMtime(time_t seenMTime)
-    {
-        /* The contract is that trackLastModified implies that the caller uses the accessor
-           from a single thread. Thus this is not a CAS loop. */
-        if (trackLastModified)
-            mtime = std::max(mtime, seenMTime);
-    }
-
-    PosixSourceAccessorBase(bool trackLastModified)
-        : trackLastModified(trackLastModified)
-    {
-    }
-
-    virtual std::optional<time_t> getLastModified() override
-    {
-        if (trackLastModified)
-            return mtime;
-        return std::nullopt;
-    }
-};
-
-} // namespace detail
-
-/**
- * A source accessor that uses the Unix filesystem.
- */
-class PosixSourceAccessor : public detail::PosixSourceAccessorBase
-{
-    /**
-     * Optional root path to prefix all operations into the native file
-     * system. This allows prepending funny things like `C:\` that
-     * `CanonPath` intentionally doesn't support.
-     */
-    const std::filesystem::path root;
-
-public:
-
-    PosixSourceAccessor();
-    PosixSourceAccessor(std::filesystem::path && root, bool trackLastModified = false);
-
-    void readFile(const CanonPath & path, Sink & sink, fun<void(uint64_t)> sizeCallback) override;
-
-    using SourceAccessor::readFile;
-
-    bool pathExists(const CanonPath & path) override;
-
-    std::optional<Stat> maybeLstat(const CanonPath & path) override;
-
-    DirEntries readDirectory(const CanonPath & path) override;
-
-    std::string readLink(const CanonPath & path) override;
-
-    std::optional<std::filesystem::path> getPhysicalPath(const CanonPath & path) override;
-
-    /**
-     * Create a `PosixSourceAccessor` and `SourcePath` corresponding to
-     * some native path.
-     *
-     * @param Whether the accessor should return a non-null getLastModified.
-     * When true the accessor must be used only by a single thread.
-     *
-     * The `PosixSourceAccessor` is rooted as far up the tree as
-     * possible, (e.g. on Windows it could scoped to a drive like
-     * `C:\`). This allows more `..` parent accessing to work.
-     *
-     * @note When `path` is trusted user input, canonicalize it using
-     * `std::filesystem::canonical`, `makeParentCanonical`, `std::filesystem::weakly_canonical`, etc,
-     * as appropriate for the use case. At least weak canonicalization is
-     * required for the `SourcePath` to do anything useful at the location it
-     * points to.
-     *
-     * @note A canonicalizing behavior is not built in `createAtRoot` so that
-     * callers do not accidentally introduce symlink-related security vulnerabilities.
-     * Furthermore, `createAtRoot` does not know whether the file pointed to by
-     * `path` should be resolved if it is itself a symlink. In other words,
-     * `createAtRoot` can not decide between aforementioned `canonical`, `makeParentCanonical`, etc. for its callers.
-     *
-     * See
-     * [`std::filesystem::path::root_path`](https://en.cppreference.com/w/cpp/filesystem/path/root_path)
-     * and
-     * [`std::filesystem::path::relative_path`](https://en.cppreference.com/w/cpp/filesystem/path/relative_path).
-     */
-    static SourcePath createAtRoot(const std::filesystem::path & path, bool trackLastModified = false);
-
-    void invalidateCache(const CanonPath & path) override;
-
-private:
-
-    /**
-     * Throw an error if `path` or any of its ancestors are symlinks.
-     */
-    void assertNoSymlinks(CanonPath path);
-
-    std::optional<PosixStat> cachedLstat(const CanonPath & path);
-
-    std::filesystem::path makeAbsPath(const CanonPath & path);
-};
-
-} // namespace nix
diff --git a/src/libutil/include/nix/util/processes.hh b/src/libutil/include/nix/util/processes.hh
index 4db35f7e8afe..e1deafeda123 100644
--- a/src/libutil/include/nix/util/processes.hh
+++ b/src/libutil/include/nix/util/processes.hh
@@ -97,7 +97,6 @@ struct ProcessOptions
     std::string errorPrefix = "";
     bool dieWithParent = true;
     bool runExitHandlers = false;
-    bool allowVfork = false;
     /**
      * use clone() with the specified flags (Linux only)
      */
@@ -141,6 +140,8 @@ void runProgram2(const RunOptions & options);
 
 class ExecError final : public CloneableError<ExecError, Error>
 {
+    void anchor() override;
+
 public:
     int status;
 
diff --git a/src/libutil/include/nix/util/ref.hh b/src/libutil/include/nix/util/ref.hh
index dce0845994d8..150ba0e78bff 100644
--- a/src/libutil/include/nix/util/ref.hh
+++ b/src/libutil/include/nix/util/ref.hh
@@ -24,6 +24,12 @@ public:
     {
     }
 
+    bad_ref_cast(bad_ref_cast &&) = default;
+    bad_ref_cast(const bad_ref_cast &) = default;
+    bad_ref_cast & operator=(bad_ref_cast &&) = default;
+    bad_ref_cast & operator=(const bad_ref_cast &) = default;
+    ~bad_ref_cast() override;
+
     const char * what() const noexcept override
     {
         return msg.c_str();
diff --git a/src/libutil/include/nix/util/serialise.hh b/src/libutil/include/nix/util/serialise.hh
index 761a0fe6ed88..67d8d3afb946 100644
--- a/src/libutil/include/nix/util/serialise.hh
+++ b/src/libutil/include/nix/util/serialise.hh
@@ -20,6 +20,13 @@ namespace nix {
  */
 struct Sink
 {
+private:
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
+
+public:
+
     virtual ~Sink() {}
 
     virtual void operator()(std::string_view data) = 0;
@@ -33,13 +40,19 @@ struct Sink
 /**
  * Just throws away data.
  */
-struct NullSink : Sink
+class NullSink : public Sink
 {
+    void anchor() override;
+
+public:
     void operator()(std::string_view data) override {}
 };
 
-struct FinishSink : virtual Sink
+class FinishSink : public virtual Sink
 {
+    void anchor() override;
+
+public:
     virtual void finish() = 0;
 };
 
@@ -47,8 +60,11 @@ struct FinishSink : virtual Sink
  * A buffered abstract sink. Warning: a BufferedSink should not be
  * used from multiple threads concurrently.
  */
-struct BufferedSink : virtual Sink
+class BufferedSink : public virtual Sink
 {
+    void anchor() override;
+
+public:
     size_t bufSize, bufPos;
     std::unique_ptr<char[]> buffer;
 
@@ -73,6 +89,12 @@ protected:
  */
 struct Source
 {
+private:
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
+
+public:
     virtual ~Source() {}
 
     /**
@@ -118,8 +140,11 @@ struct Source
  * A buffered abstract source. Warning: a BufferedSource should not be
  * used from multiple threads concurrently.
  */
-struct BufferedSource : virtual Source
+class BufferedSource : public virtual Source
 {
+    void anchor() override;
+
+public:
     size_t bufSize, bufPosIn, bufPosOut;
     std::unique_ptr<char[]> buffer;
 
@@ -150,8 +175,11 @@ protected:
 /**
  * Source type that can be restarted.
  */
-struct RestartableSource : virtual Source
+class RestartableSource : public virtual Source
 {
+    void anchor() override;
+
+public:
     virtual void restart() = 0;
 };
 
@@ -160,6 +188,10 @@ struct RestartableSource : virtual Source
  */
 struct FdSink : BufferedSink
 {
+private:
+    void anchor() override;
+
+public:
     Descriptor fd;
     size_t written = 0;
 
@@ -177,6 +209,7 @@ struct FdSink : BufferedSink
     FdSink(const FdSink &) = delete;
     FdSink & operator=(const FdSink &) = delete;
 
+    // NOLINTNEXTLINE(performance-noexcept-move-constructor) - can throw
     FdSink & operator=(FdSink && s)
     {
         flush();
@@ -201,6 +234,10 @@ private:
  */
 struct FdSource : BufferedSource, RestartableSource
 {
+private:
+    void anchor() override;
+
+public:
     Descriptor fd;
     size_t read = 0;
     BackedStringView endOfFileError{"unexpected end-of-file"};
@@ -242,8 +279,11 @@ private:
 /**
  * A sink that writes data to a string.
  */
-struct StringSink : Sink
+class StringSink : public Sink
 {
+    void anchor() override;
+
+public:
     std::string s;
 
     StringSink() {}
@@ -261,11 +301,15 @@ struct StringSink : Sink
 /**
  * A source that reads data from a string.
  */
-struct StringSource : RestartableSource
+class StringSource : public RestartableSource
 {
+    void anchor() override;
+
     /* Put behind a shared_ptr to make sure that copies and moves don't invalidate pointers
        into a small string buffer. */
-    std::shared_ptr<std::string> sOwned;
+    std::shared_ptr<const std::string> sOwned;
+
+public:
     std::string_view s;
     size_t pos;
 
@@ -301,8 +345,11 @@ struct StringSource : RestartableSource
 /**
  * A sink that writes all incoming data to two other sinks.
  */
-struct TeeSink : Sink
+class TeeSink : public Sink
 {
+    void anchor() override;
+
+public:
     Sink &sink1, &sink2;
 
     TeeSink(Sink & sink1, Sink & sink2)
@@ -321,8 +368,11 @@ struct TeeSink : Sink
 /**
  * Adapter class of a Source that saves all data read to a sink.
  */
-struct TeeSource : Source
+class TeeSource : public Source
 {
+    void anchor() override;
+
+public:
     Source & orig;
     Sink & sink;
 
@@ -343,8 +393,11 @@ struct TeeSource : Source
 /**
  * A reader that consumes the original Source until 'size'.
  */
-struct SizedSource : Source
+class SizedSource : public Source
 {
+    void anchor() override;
+
+public:
     Source & orig;
     size_t remain;
 
@@ -380,24 +433,14 @@ struct SizedSource : Source
     }
 };
 
-/**
- * A sink that that just counts the number of bytes given to it
- */
-struct LengthSink : Sink
-{
-    uint64_t length = 0;
-
-    void operator()(std::string_view data) override
-    {
-        length += data.size();
-    }
-};
-
 /**
  * A wrapper source that counts the number of bytes read from it.
  */
-struct LengthSource : Source
+class LengthSource : public Source
 {
+    void anchor() override;
+
+public:
     Source & next;
 
     LengthSource(Source & next)
@@ -418,8 +461,11 @@ struct LengthSource : Source
 /**
  * Convert a function into a sink.
  */
-struct LambdaSink : Sink
+class LambdaSink : public Sink
 {
+    void anchor() override;
+
+public:
     typedef fun<void(std::string_view data)> data_t;
     typedef fun<void()> cleanup_t;
 
@@ -452,8 +498,11 @@ struct LambdaSink : Sink
 /**
  * Convert a function into a source.
  */
-struct LambdaSource : Source
+class LambdaSource : public Source
 {
+    void anchor() override;
+
+public:
     typedef fun<size_t(char *, size_t)> lambda_t;
 
     lambda_t lambda;
@@ -473,8 +522,11 @@ struct LambdaSource : Source
  * Chain two sources together so after the first is exhausted, the second is
  * used
  */
-struct ChainSource : Source
+class ChainSource : public Source
 {
+    void anchor() override;
+
+public:
     Source &source1, &source2;
     bool useSecond = false;
 
@@ -566,6 +618,10 @@ inline uint64_t readLongLong(Source & source)
     return readNum<uint64_t>(source);
 }
 
+/**
+ * Read padding bytes to align `len` up to a multiple of 8. Throws
+ * SerialisationError if any padding byte is non-zero.
+ */
 void readPadding(size_t len, Source & source);
 size_t readString(char * buf, size_t max, Source & source);
 std::string readString(Source & source, size_t max = std::numeric_limits<size_t>::max());
@@ -590,31 +646,6 @@ Source & operator>>(Source & in, bool & b)
 
 Error readError(Source & source);
 
-/**
- * An adapter that converts a std::basic_istream into a source.
- */
-struct StreamToSourceAdapter : Source
-{
-    std::shared_ptr<std::basic_istream<char>> istream;
-
-    StreamToSourceAdapter(std::shared_ptr<std::basic_istream<char>> istream)
-        : istream(istream)
-    {
-    }
-
-    size_t read(char * data, size_t len) override
-    {
-        if (!istream->read(data, len)) {
-            if (istream->eof()) {
-                if (istream->gcount() == 0)
-                    throw EndOfFile("end of file");
-            } else
-                throw Error("I/O error in StreamToSourceAdapter");
-        }
-        return istream->gcount();
-    }
-};
-
 /**
  * A source that reads a distinct format of concatenated chunks back into its
  * logical form, in order to guarantee a known state to the original stream,
@@ -623,13 +654,16 @@ struct StreamToSourceAdapter : Source
  * Use with FramedSink, which also allows the logical stream to be terminated
  * in the event of an exception.
  */
-struct FramedSource : Source
+class FramedSource : public Source
 {
     Source & from;
     bool eof = false;
     std::vector<char> pending;
     size_t pos = 0;
 
+    void anchor() override;
+
+public:
     FramedSource(Source & from)
         : from(from)
     {
@@ -648,8 +682,8 @@ struct FramedSource : Source
                     auto n = readInt(from);
                     if (!n)
                         break;
-                    std::vector<char> data(n);
-                    from(data.data(), n);
+                    pending.resize(n);
+                    from(pending.data(), n);
                 }
             }
         } catch (...) {
@@ -668,11 +702,12 @@ struct FramedSource : Source
                 eof = true;
                 return 0;
             }
-            pending = std::vector<char>(len);
+            pending.resize(len);
             pos = 0;
             from(pending.data(), len);
         }
 
+        assert(pending.size() > pos); /* Sanity check. */
         auto n = std::min(len, pending.size() - pos);
         memcpy(data, pending.data() + pos, n);
         pos += n;
@@ -686,11 +721,14 @@ struct FramedSource : Source
  * The `checkError` function can be used to terminate the stream when you
  * detect that an error has occurred. It does so by throwing an exception.
  */
-struct FramedSink : nix::BufferedSink
+class FramedSink : public nix::BufferedSink
 {
     BufferedSink & to;
     fun<void()> checkError;
 
+    void anchor() override;
+
+public:
     FramedSink(BufferedSink & to, fun<void()> && checkError)
         : to(to)
         , checkError(checkError)
@@ -725,11 +763,14 @@ struct FramedSink : nix::BufferedSink
 /**
  * A wrapper source that ensures that at least a specified number of bytes are read from the underlying source.
  */
-struct EnsureRead : Source
+class EnsureRead : public Source
 {
     Source & source;
     uint64_t bytesRead = 0, bytesExpected;
 
+    void anchor() override;
+
+public:
     EnsureRead(Source & source, uint64_t bytesExpected)
         : source(source)
         , bytesExpected(bytesExpected)
diff --git a/src/libutil/include/nix/util/signals.hh b/src/libutil/include/nix/util/signals.hh
index c7b9d4e1324a..5124ebaccafd 100644
--- a/src/libutil/include/nix/util/signals.hh
+++ b/src/libutil/include/nix/util/signals.hh
@@ -43,10 +43,11 @@ inline void checkInterrupt();
  * @note Never will happen on Windows
  */
 MakeError(Interrupted, BaseError);
+MakeError(Cancelled, BaseError);
 
 struct InterruptCallback
 {
-    virtual ~InterruptCallback() {};
+    virtual ~InterruptCallback();
 };
 
 /**
diff --git a/src/libutil/include/nix/util/signature/signer.hh b/src/libutil/include/nix/util/signature/signer.hh
index d03dbe975466..ebeedc87a765 100644
--- a/src/libutil/include/nix/util/signature/signer.hh
+++ b/src/libutil/include/nix/util/signature/signer.hh
@@ -18,6 +18,12 @@ namespace nix {
  */
 struct Signer
 {
+private:
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+       dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor();
+
+public:
     virtual ~Signer() = default;
 
     /**
diff --git a/src/libutil/include/nix/util/sort.hh b/src/libutil/include/nix/util/sort.hh
index 2a4eb6e7c98e..77a3ea59a50d 100644
--- a/src/libutil/include/nix/util/sort.hh
+++ b/src/libutil/include/nix/util/sort.hh
@@ -123,7 +123,7 @@ void insertionsort(Iter begin, Iter end, Comparator comp = {})
  * to the specified comparator.
  */
 template<std::forward_iterator Iter, typename Comparator = std::less<std::iter_value_t<Iter>>>
-Iter strictlyDecreasingPrefix(Iter begin, Iter end, Comparator && comp = {})
+Iter strictlyDecreasingPrefix(Iter begin, Iter end, const Comparator & comp = {})
 {
     if (begin == end)
         return begin;
@@ -138,7 +138,7 @@ Iter strictlyDecreasingPrefix(Iter begin, Iter end, Comparator && comp = {})
  * to the specified comparator.
  */
 template<std::bidirectional_iterator Iter, typename Comparator = std::less<std::iter_value_t<Iter>>>
-Iter strictlyDecreasingSuffix(Iter begin, Iter end, Comparator && comp = {})
+Iter strictlyDecreasingSuffix(Iter begin, Iter end, const Comparator & comp = {})
 {
     if (begin == end)
         return end;
@@ -153,9 +153,9 @@ Iter strictlyDecreasingSuffix(Iter begin, Iter end, Comparator && comp = {})
  * to the specified comparator.
  */
 template<std::bidirectional_iterator Iter, typename Comparator = std::less<std::iter_value_t<Iter>>>
-Iter weaklyIncreasingPrefix(Iter begin, Iter end, Comparator && comp = {})
+Iter weaklyIncreasingPrefix(Iter begin, Iter end, const Comparator & comp = {})
 {
-    return strictlyDecreasingPrefix(begin, end, std::not_fn(std::forward<Comparator>(comp)));
+    return strictlyDecreasingPrefix(begin, end, std::not_fn(comp));
 }
 
 /**
@@ -163,9 +163,9 @@ Iter weaklyIncreasingPrefix(Iter begin, Iter end, Comparator && comp = {})
  * to the specified comparator.
  */
 template<std::bidirectional_iterator Iter, typename Comparator = std::less<std::iter_value_t<Iter>>>
-Iter weaklyIncreasingSuffix(Iter begin, Iter end, Comparator && comp = {})
+Iter weaklyIncreasingSuffix(Iter begin, Iter end, const Comparator & comp = {})
 {
-    return strictlyDecreasingSuffix(begin, end, std::not_fn(std::forward<Comparator>(comp)));
+    return strictlyDecreasingSuffix(begin, end, std::not_fn(comp));
 }
 
 /**
diff --git a/src/libutil/include/nix/util/source-accessor.hh b/src/libutil/include/nix/util/source-accessor.hh
index c458cf8b5c35..cc904a720d2f 100644
--- a/src/libutil/include/nix/util/source-accessor.hh
+++ b/src/libutil/include/nix/util/source-accessor.hh
@@ -45,6 +45,11 @@ MakeError(NotARegularFile, SourceAccessorError);
  */
 struct SourceAccessor : std::enable_shared_from_this<SourceAccessor>
 {
+private:
+    /* VTable anchor to avoid weak linkage of the vtable - it breaks
+     * dynamic_cast across shared libraries on Darwin. */
+    virtual void anchor() = 0;
+public:
     const size_t number;
 
     std::string displayPrefix, displaySuffix;
@@ -76,8 +81,16 @@ struct SourceAccessor : std::enable_shared_from_this<SourceAccessor>
      * @note subclasses of `SourceAccessor` need to implement at least
      * one of the `readFile()` variants.
      */
-    virtual void readFile(const CanonPath & path, Sink & sink, fun<void(uint64_t)> sizeCallback = [](uint64_t size) {});
+    virtual void
+    readFile(const CanonPath & path, Sink & sink, fun<void(uint64_t)> sizeCallback = [](uint64_t size) {}) = 0;
 
+    /**
+     * @brief Check whether a file exists at @p path.
+     *
+     * @todo Consider making this non-virtual, since the evaluator uses
+     * maybeLstat as an indication that a file exists always (for positive
+     * caching purposes).
+     */
     virtual bool pathExists(const CanonPath & path);
 
     enum Type {
@@ -138,6 +151,22 @@ struct SourceAccessor : std::enable_shared_from_this<SourceAccessor>
      */
     virtual DirEntries readDirectory(const CanonPath & path) = 0;
 
+    /**
+     * Variation of readDirectory that receives a SourceAccessor possibly scoped to \ref dirPath.
+     * Primary meant for recursive traversal functions that would benefit from *at-style syscalls
+     * relative to a particular directory.
+     *
+     * @note Like `readFile`, this method should *not* follow symlinks.
+     * @param callback Caller-provided function invoked with a maximally deeply scoped SourceAccessor and the path that
+     * would have to be prepended to each path relative to dirPath to access a particular file with it.
+     */
+    virtual void readDirectory(
+        const CanonPath & dirPath,
+        std::function<void(SourceAccessor & subdirAccessor, const CanonPath & subdirRelPath)> callback)
+    {
+        callback(*this, dirPath);
+    }
+
     virtual std::string readLink(const CanonPath & path) = 0;
 
     virtual void dumpPath(const CanonPath & path, Sink & sink, PathFilter & filter = defaultPathFilter);
@@ -215,9 +244,10 @@ struct SourceAccessor : std::enable_shared_from_this<SourceAccessor>
     }
 
     /**
-     * Invalidate any cached value the accessor may have for the specified path.
+     * Drop any cached state that could go stale across external filesystem
+     * mutation (e.g. cached directory fds).
      */
-    virtual void invalidateCache(const CanonPath & path) {}
+    virtual void invalidateCache() {}
 };
 
 /**
@@ -231,8 +261,11 @@ ref<SourceAccessor> makeEmptySourceAccessor();
  */
 MakeError(RestrictedPathError, Error);
 
-struct SymlinkNotAllowed final : public CloneableError<SymlinkNotAllowed, Error>
+class SymlinkNotAllowed final : public CloneableError<SymlinkNotAllowed, Error>
 {
+    void anchor() override;
+
+public:
     CanonPath path;
 
     SymlinkNotAllowed(CanonPath path)
@@ -262,7 +295,8 @@ ref<SourceAccessor> getFSSourceAccessor();
  *
  * Symlinks in parents of `root` are resolved. Final symlink is not.
  */
-ref<SourceAccessor> makeFSSourceAccessor(std::filesystem::path root, bool trackLastModified = false);
+ref<SourceAccessor> makeFSSourceAccessor(
+    std::filesystem::path root, bool trackLastModified = false, FinalSymlink finalSymlink = FinalSymlink::DontFollow);
 
 /**
  * Construct an accessor that presents a "union" view of a vector of
@@ -270,4 +304,10 @@ ref<SourceAccessor> makeFSSourceAccessor(std::filesystem::path root, bool trackL
  */
 ref<SourceAccessor> makeUnionSourceAccessor(std::vector<ref<SourceAccessor>> && accessors);
 
+/**
+ * Make a wrapper source accessor that caches positive lookup results.
+ * Useful for the evaluator which already assumes a mostly immutable view of the filesystem.
+ */
+ref<SourceAccessor> makeCachingSourceAccessor(ref<SourceAccessor> next);
+
 } // namespace nix
diff --git a/src/libutil/include/nix/util/source-path.hh b/src/libutil/include/nix/util/source-path.hh
index 24932e4cddbe..f15b44fdd437 100644
--- a/src/libutil/include/nix/util/source-path.hh
+++ b/src/libutil/include/nix/util/source-path.hh
@@ -114,11 +114,6 @@ struct SourcePath
         return {accessor, accessor->resolveSymlinks(path, mode)};
     }
 
-    void invalidateCache() const
-    {
-        accessor->invalidateCache(path);
-    }
-
     friend class std::hash<nix::SourcePath>;
 };
 
diff --git a/src/libutil/include/nix/util/tarfile.hh b/src/libutil/include/nix/util/tarfile.hh
index 324c7c8a8a99..68eaa0823dda 100644
--- a/src/libutil/include/nix/util/tarfile.hh
+++ b/src/libutil/include/nix/util/tarfile.hh
@@ -1,6 +1,7 @@
 #pragma once
 ///@file
 
+#include "nix/util/compression-algo.hh"
 #include "nix/util/serialise.hh"
 #include "nix/util/fs-sink.hh"
 #include <archive.h>
@@ -13,7 +14,7 @@ struct TarArchive
     Source * source;
     std::vector<unsigned char> buffer;
 
-    void check(int err, const std::string & reason = "failed to extract archive (%s)");
+    void check(int err, const std::string & reason = "failed to extract archive (%s)", bool warningsAreFatal = true);
 
     explicit TarArchive(const std::filesystem::path & path);
 
@@ -21,8 +22,8 @@ struct TarArchive
     /// @param source - Input byte stream.
     /// @param raw - Whether to enable raw file support. For more info look in docs:
     /// https://manpages.debian.org/stretch/libarchive-dev/archive_read_format.3.en.html
-    /// @param compression_method - Primary compression method to use. std::nullopt means 'all'.
-    TarArchive(Source & source, bool raw = false, std::optional<std::string> compression_method = std::nullopt);
+    /// @param compressionMethod - Primary compression method to use. std::nullopt means 'all'.
+    TarArchive(Source & source, bool raw = false, std::optional<CompressionAlgo> compressionMethod = std::nullopt);
 
     /// Disable copy constructor. Explicitly default move assignment/constructor.
     TarArchive(const TarArchive &) = delete;
@@ -35,8 +36,6 @@ struct TarArchive
     ~TarArchive();
 };
 
-int getArchiveFilterCodeByName(const std::string & method);
-
 void unpackTarfile(const std::filesystem::path & tarFile, const std::filesystem::path & destDir);
 
 time_t unpackTarfileToSink(TarArchive & archive, ExtendedFileSystemObjectSink & parseSink);
diff --git a/src/libutil/include/nix/util/topo-sort.hh b/src/libutil/include/nix/util/topo-sort.hh
index 6218b66a5023..12031e071535 100644
--- a/src/libutil/include/nix/util/topo-sort.hh
+++ b/src/libutil/include/nix/util/topo-sort.hh
@@ -20,7 +20,7 @@ using TopoSortResult = std::variant<std::vector<T>, Cycle<T>>;
 
 template<typename T, typename Compare, std::invocable<const T &> F>
     requires std::same_as<std::remove_cvref_t<std::invoke_result_t<F, const T &>>, std::set<T, Compare>>
-TopoSortResult<T> topoSort(std::set<T, Compare> items, F && getChildren)
+TopoSortResult<T> topoSort(std::set<T, Compare> items, const F & getChildren)
 {
     std::vector<T> sorted;
     decltype(items) visited, parents;
diff --git a/src/libutil/include/nix/util/util.hh b/src/libutil/include/nix/util/util.hh
index 144c83cc0c9f..021da6484d49 100644
--- a/src/libutil/include/nix/util/util.hh
+++ b/src/libutil/include/nix/util/util.hh
@@ -9,6 +9,7 @@
 #include <filesystem>
 #include <functional>
 #include <map>
+#include <set>
 #include <sstream>
 #include <bit>
 #include <optional>
@@ -31,7 +32,7 @@ template<class... Parts>
 auto concatStrings(Parts &&... parts)
     -> std::enable_if_t<(... && std::is_convertible_v<Parts, std::string_view>), std::string>
 {
-    std::string_view views[sizeof...(parts)] = {parts...};
+    std::string_view views[sizeof...(parts)] = {std::forward<Parts>(parts)...};
     return concatStringsSep({}, views);
 }
 
@@ -83,7 +84,12 @@ std::string trim(std::string_view s, std::string_view whitespace = " \n\r\t");
  */
 std::string replaceStrings(std::string s, std::string_view from, std::string_view to);
 
-std::string rewriteStrings(std::string s, const StringMap & rewrites);
+/**
+ * Replace all occurrences of the keys in `rewrites` with their corresponding values. Optionally returns the positions
+ * of the matches in `matches`.
+ */
+std::string rewriteStrings(
+    std::string s, const StringMap & rewrites, std::set<uint64_t> * matches = nullptr, uint64_t offsetShift = 0);
 
 /**
  * Parse a string into an integer.
@@ -423,6 +429,20 @@ constexpr auto enumerate(R && range)
     return std::views::zip(std::views::iota(size_t{0}), std::forward<R>(range));
 }
 
+/**
+ * An iterator adapter that enumerates the elements of a range,
+ * pairing each element with a boolean indicating whether it is the
+ * last element.
+ */
+template<std::ranges::viewable_range R>
+    requires std::ranges::sized_range<R>
+constexpr auto markLast(R && range)
+{
+    auto n = std::ranges::size(range);
+    return std::views::zip(
+        std::views::iota(size_t{1}) | std::views::transform([n](size_t i) { return i == n; }), std::forward<R>(range));
+}
+
 /**
  * C++17 std::visit boilerplate
  */
diff --git a/src/libutil/linux/include/nix/util/linux-namespaces.hh b/src/libutil/linux/include/nix/util/linux-namespaces.hh
index 8f7ffa8df48d..0b6bef7bcabb 100644
--- a/src/libutil/linux/include/nix/util/linux-namespaces.hh
+++ b/src/libutil/linux/include/nix/util/linux-namespaces.hh
@@ -1,21 +1,27 @@
 #pragma once
 ///@file
 
-#include <optional>
-
-#include "nix/util/types.hh"
+#include <filesystem>
 
 namespace nix {
 
 /**
- * Save the current mount namespace. Ignored if called more than
- * once.
+ * Save the parent mount namespace and enter a private one via
+ * `unshare(CLONE_NEWNS)`.
+ */
+void tryEnterPrivateMountNamespace();
+
+/**
+ * Remount `path` writable if its mount is read-only, leaving
+ * already-writable mounts untouched. This throws if we aren't in a
+ * private mount namespace, since remounting would leak into the
+ * host mount table.
  */
-void saveMountNamespace();
+void remountReadOnlyWritable(const std::filesystem::path & path);
 
 /**
- * Restore the mount namespace saved by saveMountNamespace(). Ignored
- * if saveMountNamespace() was never called.
+ * Restore the parent mount namespace saved when we entered a private
+ * one. Ignored if `tryEnterPrivateMountNamespace()` never succeeded.
  */
 void restoreMountNamespace();
 
diff --git a/src/libutil/linux/linux-namespaces-private.hh b/src/libutil/linux/linux-namespaces-private.hh
new file mode 100644
index 000000000000..001a8417901c
--- /dev/null
+++ b/src/libutil/linux/linux-namespaces-private.hh
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "nix/util/file-descriptor.hh"
+
+namespace nix {
+
+extern AutoCloseFD fdSavedMountNamespace;
+extern AutoCloseFD fdSavedRoot;
+extern bool havePrivateMountNs;
+
+} // namespace nix
diff --git a/src/libutil/linux/linux-namespaces.cc b/src/libutil/linux/linux-namespaces.cc
index 9c96c5bcb768..6d77d1d58bab 100644
--- a/src/libutil/linux/linux-namespaces.cc
+++ b/src/libutil/linux/linux-namespaces.cc
@@ -3,10 +3,13 @@
 #include "nix/util/file-system.hh"
 #include "nix/util/processes.hh"
 
+#include "linux-namespaces-private.hh"
+
 #include <mutex>
 #include <sys/resource.h>
 
 #include <sys/mount.h>
+#include <sys/statvfs.h>
 
 namespace nix {
 
@@ -88,27 +91,87 @@ bool mountAndPidNamespacesSupported()
 
 //////////////////////////////////////////////////////////////////////
 
-static AutoCloseFD fdSavedMountNamespace;
-static AutoCloseFD fdSavedRoot;
+AutoCloseFD fdSavedMountNamespace;
+AutoCloseFD fdSavedRoot;
+bool havePrivateMountNs = false;
 
-void saveMountNamespace()
+/* Save the current mount namespace so restoreMountNamespace() can return
+   to it later. Ignored if called more than once. */
+static void saveMountNamespace()
 {
     static std::once_flag done;
     std::call_once(done, []() {
-        fdSavedMountNamespace = open("/proc/self/ns/mnt", O_RDONLY);
+        fdSavedMountNamespace = open("/proc/self/ns/mnt", O_RDONLY | O_CLOEXEC);
         if (!fdSavedMountNamespace)
             throw SysError("saving parent mount namespace");
 
-        fdSavedRoot = open("/proc/self/root", O_RDONLY);
+        fdSavedRoot = open("/proc/self/root", O_RDONLY | O_CLOEXEC);
     });
 }
 
+void tryEnterPrivateMountNamespace()
+{
+    try {
+        saveMountNamespace();
+        if (unshare(CLONE_NEWNS) == -1)
+            throw SysError("setting up a private mount namespace");
+        havePrivateMountNs = true;
+    } catch (Error & e) {
+        debug("failed to set up a private mount namespace: %s", e.message());
+    }
+}
+
+void remountReadOnlyWritable(const std::filesystem::path & path)
+{
+    struct statvfs stat;
+    if (statvfs(path.c_str(), &stat) != 0)
+        throw SysError("getting mount info for %s", PathFmt(path));
+
+    if (!(stat.f_flag & ST_RDONLY))
+        return;
+
+    if (!havePrivateMountNs)
+        throw Error(
+            "cannot remount %s writable: not in a private mount namespace, "
+            "so the remount would affect the host mount table. "
+            "This usually happens inside containers or user namespaces where unshare(CLONE_NEWNS) is not permitted",
+            PathFmt(path));
+
+    /* In a user namespace, mount flags like `nodev` and `nosuid` are
+       locked and dropping them causes `EPERM`, so here we translate each
+       `statvfs` flag to the corresponding `mount` flag individually. */
+    unsigned long flags = MS_REMOUNT | MS_BIND;
+    if (stat.f_flag & ST_NODEV)
+        flags |= MS_NODEV;
+    if (stat.f_flag & ST_NOSUID)
+        flags |= MS_NOSUID;
+    if (stat.f_flag & ST_NOEXEC)
+        flags |= MS_NOEXEC;
+    if (stat.f_flag & ST_NOATIME)
+        flags |= MS_NOATIME;
+    if (stat.f_flag & ST_NODIRATIME)
+        flags |= MS_NODIRATIME;
+    if (stat.f_flag & ST_RELATIME)
+        flags |= MS_RELATIME;
+    if (stat.f_flag & ST_SYNCHRONOUS)
+        flags |= MS_SYNCHRONOUS;
+#ifdef ST_NOSYMFOLLOW
+    if (stat.f_flag & ST_NOSYMFOLLOW)
+        flags |= MS_NOSYMFOLLOW;
+#endif
+    if (mount(0, path.c_str(), "none", flags, 0) == -1)
+        throw SysError("remounting %s writable", PathFmt(path));
+}
+
 void restoreMountNamespace()
 {
+    if (!havePrivateMountNs)
+        return;
+
     try {
         auto savedCwd = std::filesystem::current_path();
 
-        if (fdSavedMountNamespace && setns(fdSavedMountNamespace.get(), CLONE_NEWNS) == -1)
+        if (setns(fdSavedMountNamespace.get(), CLONE_NEWNS) == -1)
             throw SysError("restoring parent mount namespace");
 
         if (fdSavedRoot) {
diff --git a/src/libutil/linux/meson.build b/src/libutil/linux/meson.build
index b8053a5bb037..3f48646d2216 100644
--- a/src/libutil/linux/meson.build
+++ b/src/libutil/linux/meson.build
@@ -1,6 +1,7 @@
 sources += files(
   'cgroup.cc',
   'linux-namespaces.cc',
+  'processes.cc',
 )
 
 subdir('include/nix/util')
diff --git a/src/libutil/linux/processes.cc b/src/libutil/linux/processes.cc
new file mode 100644
index 000000000000..6b99553372cb
--- /dev/null
+++ b/src/libutil/linux/processes.cc
@@ -0,0 +1,328 @@
+#include "nix/util/processes.hh"
+#include "nix/util/current-process.hh"
+#include "nix/util/file-descriptor.hh"
+#include "nix/util/environment-variables.hh"
+#include "nix/util/signals.hh"
+#include "nix/util/util.hh"
+#include "nix/util/serialise.hh"
+
+#include "linux/linux-namespaces-private.hh"
+#include "unix/signals-private.hh"
+#include "unix/current-process-private.hh"
+#include "util-unix-config-private.hh"
+
+#include <cstring>
+#include <cerrno>
+
+#include <sys/resource.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/syscall.h>
+#include <sys/prctl.h>
+#include <grp.h>
+#include <unistd.h>
+#include <limits.h>
+#include <sched.h>
+
+extern char ** environ __attribute__((weak));
+
+namespace nix {
+
+namespace {
+
+/* This structure intentionally doesn't have any fancy classes from C++ like
+   std::optional, because I don't trust those. Only plain pointers or integral
+   types. */
+struct ExecChildParams
+{
+    const char * program;
+    const char * chdir;
+    char * const * environment;
+    char * const * args;
+    bool mergeStderrToStdout;
+    bool lookupPath;
+    Descriptor stdoutFd;
+    Descriptor errorPipe;
+    bool setGid;
+    gid_t gid;
+    bool setUid;
+    uid_t uid;
+    bool dieWithParent;
+};
+
+/*
+ * This code is supposed to run in the child right after vfork(). We never
+ * return from this function through normal means, but rather always _exit() or
+ * execv[e] from it.
+ *
+ * We shouldn't allow any exceptions to escape and shouldn't allocate any memory,
+ * or in general do anything that's not async-signal-safe.
+ *
+ * There's a slight wrinkle in that in a multithreaded program on Linux, only
+ * the thread calling vfork() is suspended while other threads of the parent
+ * continue running.
+ *
+ * This also presents a problem with signals, since those will also arrive in
+ * the child, which shares the address space. Thankfully, we don't have many
+ * signal handlers that would be negatively affected by this, so we punt on
+ * the issue.
+ *
+ * Another thing worth mentioning is that apparently, WSL and QEMU userspace
+ * emulation both implement vfork() as plain fork() so the regular footguns of
+ * fork() apply.
+ *
+ * Don't call any functions defined in other translations units from here!
+ * (for auditability purposes and avoiding accidentally calling something you
+ * shouldn't).
+ *
+ * Even calling libc functions is quite sketchy in general because of lazy
+ * binding with dynamic linking. Whatever the libc is doing in the dynamic
+ * linker is likely to not really be safe with vfork().
+ *
+ * Luckily, nixpkgs now builds with eager binding (-z now) so our builds won't
+ * be affected. TODO: Just build libutil with -z now too, instead of relying on
+ * hardening defaults.
+ */
+[[gnu::noinline, noreturn]] static void doExecChild(const ExecChildParams & params) noexcept
+{
+    auto die = [&params] [[noreturn]] (int err, const char * msg) {
+        [[maybe_unused]] ssize_t ret; /* Swallow all errors. */
+        ret = ::write(params.errorPipe, reinterpret_cast<const char *>(&err), sizeof(err));
+        ret = ::write(params.errorPipe, msg, ::strlen(msg));
+        ::_exit(1);
+    };
+
+    auto dieWithErrno = [&die] [[noreturn]] (const char * msg) { die(errno, msg); };
+
+    /* TODO: Do something with stdin if we don't want to keep it? */
+
+    if (params.stdoutFd != INVALID_DESCRIPTOR && ::dup2(params.stdoutFd, STDOUT_FILENO) == -1)
+        dieWithErrno("dupping stdout");
+
+    if (params.mergeStderrToStdout && ::dup2(STDOUT_FILENO, STDERR_FILENO) == -1)
+        dieWithErrno("cannot dup stdout into stderr");
+
+    if (params.chdir && ::chdir(params.chdir) == -1)
+        dieWithErrno("chdir failed");
+
+    /* Restore saved process context. Much like nix::restoreProcessContext, but inlined
+       and without any possibility of throwing exceptions. */
+
+    if (havePrivateMountNs) {
+        char savedCwd[PATH_MAX];
+
+        /* On Linux, it seems like cwd can't ever be larger than PATH_MAX (as
+           restricted by the syscall itself). Once again, intentionally not
+           calling into libc. */
+        if (::syscall(SYS_getcwd, savedCwd, sizeof(savedCwd)) == -1)
+            dieWithErrno("getcwd failed");
+
+        if (::setns(fdSavedMountNamespace.get(), CLONE_NEWNS) == -1)
+            dieWithErrno("restoring parent mount namespace");
+
+        if (fdSavedRoot) {
+            if (::fchdir(fdSavedRoot.get()))
+                dieWithErrno("chdir into saved root");
+
+            if (::chroot("."))
+                dieWithErrno("chroot into saved root");
+        }
+
+        if (::chdir(savedCwd) == -1)
+            dieWithErrno("restoring cwd");
+    }
+
+    /* Important! Calling syscalls directly and not libc functions because of a
+       discrepancy in POSIX specification (i.e. POSIX setgid/setuid has to apply
+       to all threads, while the syscall only applies to a task).
+       A huge footgun is apparently the fact that glibc defines SYS_setgid to the 16 bit
+       version of the syscall, while musl "fixes it up" to use the 32 bit version.
+       The end result is that we have to make sure to use the right one still. */
+
+#ifdef SYS_setuid32
+#  define NIX_SYS_setuid SYS_setuid32
+#  define NIX_SYS_setgid SYS_setgid32
+#  define NIX_SYS_setgroups SYS_setgroups32
+#else
+#  define NIX_SYS_setuid SYS_setuid
+#  define NIX_SYS_setgid SYS_setgid
+#  define NIX_SYS_setgroups SYS_setgroups
+#endif
+
+    if (params.setGid && ::syscall(NIX_SYS_setgid, params.gid) == -1)
+        dieWithErrno("setgid failed");
+
+    /* Drop all other groups if we're setgid. */
+    if (params.setGid && ::syscall(NIX_SYS_setgroups, 0, 0) == -1)
+        dieWithErrno("setgroups failed");
+
+    if (params.setUid && ::syscall(NIX_SYS_setuid, params.uid) == -1)
+        dieWithErrno("setuid failed");
+
+    /* Technically slightly racy, we might want to do something like what
+       preserveDeathSignal does. */
+    if (params.dieWithParent && prctl(PR_SET_PDEATHSIG, SIGKILL) == -1)
+        dieWithErrno("setting death signal");
+
+#undef NIX_SYS_setuid
+#undef NIX_SYS_setgid
+#undef NIX_SYS_setgroups
+
+    if (unix::savedStackSize) {
+        struct ::rlimit limit;
+        if (::getrlimit(RLIMIT_STACK, &limit) == 0) {
+            limit.rlim_cur = unix::savedStackSize;
+            ::setrlimit(RLIMIT_STACK, &limit);
+            /* TODO: Why do we ignore all errors here? */
+        }
+    }
+
+    /* Like unix::restoreSignals(), but safe to do in a vfork child. */
+    if (unix::savedSignalMaskIsSet && sigprocmask(SIG_SETMASK, &unix::savedSignalMask, nullptr) == -1)
+        dieWithErrno("restoring signals");
+
+    /* TODO: Close leaked file descriptors? The best way is with close_range(). */
+
+    if (params.lookupPath)
+        /* Nonstandard, but both musl and glibc have it and it doesn't
+           seem to do anything weird or allocate memory, so it should
+           be fine-ish? The use of execvp has some footguns though (see
+           https://github.com/NixOS/nix/pull/9494) and maybe we should get rid
+           of it entirely and do executable path resolution in the parent.
+           The hacky ENOEXEC handling also doesn't seem to exist in musl.
+
+           This does path lookup in the global environment of the parent, and
+           not in the params.environment like it's done in runProgram2 for other
+           unixes (arguably a bugfix)!
+
+           Don't accidentally call nix::execvpe! */
+        ::execvpe(params.program, params.args, params.environment);
+    else
+        ::execve(params.program, params.args, params.environment);
+
+    dieWithErrno("could not exec program");
+}
+
+[[gnu::noinline]] static pid_t startExecChildInVFork(const ExecChildParams & params) noexcept
+{
+    pid_t pid = ::vfork();
+
+    /* In the unlikely scenario that vfork() fails we return -1 here too. */
+    if (pid != 0)
+        return pid;
+
+    /* Now run the actual child. */
+    doExecChild(params);
+}
+
+/* TODO: This can be factored out if this becomes useful for other platforms? */
+static Strings prepareEnvironmentStrings(const StringMap & environment)
+{
+    Strings env;
+    for (auto & [name, value] : environment) {
+        std::string var;
+        var.reserve(name.size() + value.size() + 1);
+        var += name;
+        var += "=";
+        var += value;
+        env.push_back(std::move(var));
+    }
+    return env;
+}
+
+} // namespace
+
+/* TODO: Factor this out into a `launchProgram` that returns a pid. That would be
+   much more useful in more places. */
+void runProgram2(const RunOptions & options)
+{
+    checkInterrupt();
+
+    /* Create a pipe. */
+    Pipe out;
+    if (options.standardOut)
+        out.create();
+
+    /* Pipe that the child reports errors through. */
+    Pipe childErrorPipe;
+    childErrorPipe.create();
+
+    /* Prepare arguments and environment for the child. */
+    Strings args_(options.args);
+    args_.push_front(options.program.native());
+    const Strings env_ = options.environment ? prepareEnvironmentStrings(*options.environment) : Strings{};
+    const auto env = stringsToCharPtrs(env_);
+    const auto args = stringsToCharPtrs(args_);
+
+    const ExecChildParams params = {
+        .program = options.program.c_str(),
+        .chdir = options.chdir ? options.chdir->c_str() : nullptr,
+        .environment = options.environment ? env.data() : environ,
+        .args = args.data(),
+        .mergeStderrToStdout = options.mergeStderrToStdout,
+        .lookupPath = options.lookupPath,
+        .stdoutFd = options.standardOut ? out.writeSide.get() : INVALID_DESCRIPTOR,
+        .errorPipe = childErrorPipe.writeSide.get(),
+        .setGid = options.gid.has_value(),
+        /* The default is not used, but a bit sketchy to leave zero initialised so "nobody". */
+        .gid = options.gid.value_or(65534),
+        .setUid = options.uid.has_value(),
+        /* The default is not used, but a bit sketchy to leave zero initialised so "nobody". */
+        .uid = options.uid.value_or(65534),
+        .dieWithParent = true, /* TODO: Maybe we might want to expose this in RunOptions? */
+    };
+
+    auto suspension = logger->suspendIf(options.isInteractive);
+
+    const auto savedErrno = errno;
+
+    /* Fork. */
+    Pid pid = startExecChildInVFork(params);
+
+    /* errno is also shared with the child, so it can trample it. Restoring it
+       doesn't necessarily matter much though. */
+    const auto forkErrno = errno;
+    errno = savedErrno;
+
+    if (pid == -1)
+        throw SysError(forkErrno, "unable to vfork");
+
+    out.writeSide.close();
+    childErrorPipe.writeSide.close();
+
+    StringSink childErrorSink;
+    drainFD(childErrorPipe.readSide.get(), childErrorSink);
+
+    /* We don't write anything to the pipe on success. */
+    if (const auto & errorContent = childErrorSink.s; errorContent.size()) {
+        int status = pid.wait();
+
+        auto execErr = ExecError(status, "could not start program %1%", PathFmt(options.program));
+
+        /* The child returned garbage through the error pipe. I think it's
+           pretty unlikely that this will happen, but maybe a signal arriving
+           could result in ::write failing with EINTR. It's unclear to me
+           whether that that can happen with writes under PIPE_BUF? */
+        if (errorContent.size() >= sizeof(int)) {
+            auto intBytes = errorContent.substr(0, sizeof(int));
+            int errNo;
+            std::memcpy(&errNo, intBytes.data(), sizeof(errNo));
+            auto errMsg = errorContent.substr(sizeof(int));
+            /* It's a bit strange, but the interface of runProgram2 reports
+               spawn helper errors as ExecError. */
+            execErr.addTrace({}, HintFmt("spawn helper process failed: %1%: %2%", errMsg, ::strerror(errNo)));
+        }
+
+        throw std::move(execErr);
+    }
+
+    if (options.standardOut)
+        drainFD(out.readSide.get(), *options.standardOut);
+
+    /* Wait for the child to finish. */
+    int status = pid.wait();
+    if (status)
+        throw ExecError(status, "program %1% %2%", PathFmt(options.program), statusToString(status));
+}
+
+} // namespace nix
diff --git a/src/libutil/logging.cc b/src/libutil/logging.cc
index 58c78df34986..02e238e5712d 100644
--- a/src/libutil/logging.cc
+++ b/src/libutil/logging.cc
@@ -14,6 +14,8 @@
 
 namespace nix {
 
+void LoggerSettings::anchor() {}
+
 LoggerSettings loggerSettings;
 
 static GlobalConfig::Register rLoggerSettings(&loggerSettings);
@@ -30,7 +32,13 @@ void setCurActivity(const ActivityId activityId)
     curActivity = activityId;
 }
 
-std::unique_ptr<Logger> logger = makeSimpleLogger(true);
+/**
+ * This is a raw pointer to allow it to leak.
+ * Avoids races in activity teardown.
+ */
+Logger * logger = makeSimpleLogger(true).release();
+
+Logger::~Logger() {}
 
 void Logger::warn(const std::string & msg)
 {
@@ -57,6 +65,8 @@ std::optional<Logger::Suspension> Logger::suspendIf(bool cond)
     return {};
 }
 
+namespace {
+
 class SimpleLogger : public Logger
 {
 public:
@@ -146,6 +156,8 @@ class SimpleLogger : public Logger
     }
 };
 
+} // namespace
+
 Verbosity verbosity = lvlInfo;
 
 static void writeFullLogging(Descriptor fd, std::string_view s)
@@ -209,6 +221,8 @@ void to_json(nlohmann::json & json, std::shared_ptr<const Pos> pos)
     }
 }
 
+namespace {
+
 struct JSONLogger : Logger
 {
     Descriptor fd;
@@ -341,6 +355,8 @@ struct JSONLogger : Logger
     }
 };
 
+} // namespace
+
 std::unique_ptr<Logger> makeJSONLogger(Descriptor fd, bool includeNixPrefix)
 {
     return std::make_unique<JSONLogger>(fd, includeNixPrefix);
@@ -359,9 +375,15 @@ std::unique_ptr<Logger> makeJSONLogger(const std::filesystem::path & path, bool
         }
     };
 
-    AutoCloseFD fd = std::filesystem::is_socket(path)
-                         ? connect(path)
-                         : toDescriptor(open(path.string().c_str(), O_CREAT | O_APPEND | O_WRONLY, 0644));
+    AutoCloseFD fd = std::filesystem::is_socket(path) ? connect(path)
+                                                      : toDescriptor(open(
+                                                            path.string().c_str(),
+                                                            O_CREAT | O_APPEND | O_WRONLY
+#ifndef _WIN32
+                                                                | O_CLOEXEC
+#endif
+                                                            ,
+                                                            0644));
     if (!fd)
         throw SysError("opening log file %1%", PathFmt(path));
 
@@ -375,7 +397,7 @@ void applyJSONLogger()
             std::vector<std::unique_ptr<Logger>> loggers;
             loggers.push_back(makeJSONLogger(*opt, false));
             try {
-                logger = makeTeeLogger(std::move(logger), std::move(loggers));
+                logger = makeTeeLogger(std::unique_ptr<Logger>(logger), std::move(loggers)).release();
             } catch (...) {
                 // `logger` is now gone so give up.
                 abort();
diff --git a/src/libutil/memory-source-accessor.cc b/src/libutil/memory-source-accessor.cc
index 6657291bb041..ba2816fc0f2d 100644
--- a/src/libutil/memory-source-accessor.cc
+++ b/src/libutil/memory-source-accessor.cc
@@ -4,6 +4,10 @@
 
 namespace nix {
 
+void MemorySink::anchor() {}
+
+void MemorySourceAccessor::anchor() {}
+
 MemorySourceAccessor::File * MemorySourceAccessor::open(const CanonPath & path, std::optional<File> create)
 {
     bool hasRoot = root.has_value();
@@ -234,6 +238,8 @@ void CreateMemoryRegularFile::isExecutable()
 
 void CreateMemoryRegularFile::preallocateContents(uint64_t len)
 {
+    if (len > std::numeric_limits<decltype(regularFile.contents)::size_type>::max())
+        throw Error("cannot preallocate contents for a file that is too large to fit in memory");
     regularFile.contents.reserve(len);
 }
 
diff --git a/src/libutil/memory-source-accessor/json.cc b/src/libutil/memory-source-accessor/json.cc
index 84fbb71bb2ef..e9908035bdb8 100644
--- a/src/libutil/memory-source-accessor/json.cc
+++ b/src/libutil/memory-source-accessor/json.cc
@@ -6,22 +6,22 @@
 
 namespace nlohmann {
 
-using namespace nix;
-
 // fso::Regular<RegularContents>
 template<>
-MemorySourceAccessor::File::Regular adl_serializer<MemorySourceAccessor::File::Regular>::from_json(const json & json)
+nix::MemorySourceAccessor::File::Regular
+adl_serializer<nix::MemorySourceAccessor::File::Regular>::from_json(const json & json)
 {
+    using namespace nix;
     auto & obj = getObject(json);
-    return MemorySourceAccessor::File::Regular{
+    return {
         .executable = getBoolean(valueAt(obj, "executable")),
         .contents = getString(valueAt(obj, "contents")),
     };
 }
 
 template<>
-void adl_serializer<MemorySourceAccessor::File::Regular>::to_json(
-    json & json, const MemorySourceAccessor::File::Regular & r)
+void adl_serializer<nix::MemorySourceAccessor::File::Regular>::to_json(
+    json & json, const nix::MemorySourceAccessor::File::Regular & r)
 {
     json = {
         {"executable", r.executable},
@@ -30,8 +30,9 @@ void adl_serializer<MemorySourceAccessor::File::Regular>::to_json(
 }
 
 template<>
-NarListing::Regular adl_serializer<NarListing::Regular>::from_json(const json & json)
+nix::NarListing::Regular adl_serializer<nix::NarListing::Regular>::from_json(const json & json)
 {
+    using namespace nix;
     auto & obj = getObject(json);
     auto * execPtr = optionalValueAt(obj, "executable");
     auto * sizePtr = optionalValueAt(obj, "size");
@@ -47,41 +48,42 @@ NarListing::Regular adl_serializer<NarListing::Regular>::from_json(const json &
 }
 
 template<>
-void adl_serializer<NarListing::Regular>::to_json(json & j, const NarListing::Regular & r)
+void adl_serializer<nix::NarListing::Regular>::to_json(json & j, const nix::NarListing::Regular & r)
 {
     if (r.contents.fileSize)
         j["size"] = *r.contents.fileSize;
-    if (r.executable)
-        j["executable"] = true;
+    j["executable"] = r.executable;
     if (r.contents.narOffset)
         j["narOffset"] = *r.contents.narOffset;
 }
 
 template<typename Child>
-void adl_serializer<fso::DirectoryT<Child>>::to_json(json & j, const fso::DirectoryT<Child> & d)
+void adl_serializer<nix::fso::DirectoryT<Child>>::to_json(json & j, const nix::fso::DirectoryT<Child> & d)
 {
     j["entries"] = d.entries;
 }
 
 template<typename Child>
-fso::DirectoryT<Child> adl_serializer<fso::DirectoryT<Child>>::from_json(const json & json)
+nix::fso::DirectoryT<Child> adl_serializer<nix::fso::DirectoryT<Child>>::from_json(const json & json)
 {
+    using namespace nix;
     auto & obj = getObject(json);
-    return fso::DirectoryT<Child>{
+    return {
         .entries = valueAt(obj, "entries"),
     };
 }
 
 // fso::Symlink
-fso::Symlink adl_serializer<fso::Symlink>::from_json(const json & json)
+nix::fso::Symlink adl_serializer<nix::fso::Symlink>::from_json(const json & json)
 {
+    using namespace nix;
     auto & obj = getObject(json);
-    return fso::Symlink{
+    return {
         .target = getString(valueAt(obj, "target")),
     };
 }
 
-void adl_serializer<fso::Symlink>::to_json(json & json, const fso::Symlink & s)
+void adl_serializer<nix::fso::Symlink>::to_json(json & json, const nix::fso::Symlink & s)
 {
     json = {
         {"target", s.target},
@@ -89,21 +91,22 @@ void adl_serializer<fso::Symlink>::to_json(json & json, const fso::Symlink & s)
 }
 
 // fso::Opaque
-fso::Opaque adl_serializer<fso::Opaque>::from_json(const json &)
+nix::fso::Opaque adl_serializer<nix::fso::Opaque>::from_json(const json &)
 {
-    return fso::Opaque{};
+    return {};
 }
 
-void adl_serializer<fso::Opaque>::to_json(json & j, const fso::Opaque &)
+void adl_serializer<nix::fso::Opaque>::to_json(json & j, const nix::fso::Opaque &)
 {
     j = nlohmann::json::object();
 }
 
 // fso::VariantT<RegularContents, recur> - generic implementation
 template<typename RegularContents, bool recur>
-void adl_serializer<fso::VariantT<RegularContents, recur>>::to_json(
-    json & j, const fso::VariantT<RegularContents, recur> & val)
+void adl_serializer<nix::fso::VariantT<RegularContents, recur>>::to_json(
+    json & j, const nix::fso::VariantT<RegularContents, recur> & val)
 {
+    using namespace nix;
     using Variant = fso::VariantT<RegularContents, recur>;
     j = nlohmann::json::object();
     std::visit(
@@ -125,9 +128,10 @@ void adl_serializer<fso::VariantT<RegularContents, recur>>::to_json(
 }
 
 template<typename RegularContents, bool recur>
-fso::VariantT<RegularContents, recur>
-adl_serializer<fso::VariantT<RegularContents, recur>>::from_json(const json & json)
+nix::fso::VariantT<RegularContents, recur>
+adl_serializer<nix::fso::VariantT<RegularContents, recur>>::from_json(const json & json)
 {
+    using namespace nix;
     using Variant = fso::VariantT<RegularContents, recur>;
     auto & obj = getObject(json);
     auto type = getString(valueAt(obj, "type"));
@@ -142,19 +146,19 @@ adl_serializer<fso::VariantT<RegularContents, recur>>::from_json(const json & js
 }
 
 // Explicit instantiations for VariantT types we use
-template struct adl_serializer<MemorySourceAccessor::File>;
-template struct adl_serializer<NarListing>;
-template struct adl_serializer<ShallowNarListing>;
+template struct adl_serializer<nix::MemorySourceAccessor::File>;
+template struct adl_serializer<nix::NarListing>;
+template struct adl_serializer<nix::ShallowNarListing>;
 
 // MemorySourceAccessor
-MemorySourceAccessor adl_serializer<MemorySourceAccessor>::from_json(const json & json)
+nix::MemorySourceAccessor adl_serializer<nix::MemorySourceAccessor>::from_json(const json & json)
 {
-    MemorySourceAccessor res;
+    nix::MemorySourceAccessor res;
     res.root = json;
     return res;
 }
 
-void adl_serializer<MemorySourceAccessor>::to_json(json & json, const MemorySourceAccessor & val)
+void adl_serializer<nix::MemorySourceAccessor>::to_json(json & json, const nix::MemorySourceAccessor & val)
 {
     json = val.root;
 }
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index 50ade6688726..b61403b51c4f 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -8,7 +8,7 @@ project(
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
@@ -44,6 +44,12 @@ configdata_pub.set(
   description : 'Whether nix has been built with UBSan enabled',
 )
 
+configdata_pub.set(
+  'NIX_ASAN_ENABLED',
+  ('address' in get_option('b_sanitize')).to_int(),
+  description : 'Whether nix has been built with ASan enabled',
+)
+
 subdir('nix-meson-build-support/libatomic')
 
 if host_machine.system() == 'windows'
@@ -136,7 +142,9 @@ sources = [ config_priv_h ] + files(
   'base-n.cc',
   'base-nix-32.cc',
   'bump-memory-resource.cc',
+  'caching-source-accessor.cc',
   'canon-path.cc',
+  'checked-arithmetic.cc',
   'compression-algo.cc',
   'compression-settings.cc',
   'compression.cc',
diff --git a/src/libutil/mounted-source-accessor.cc b/src/libutil/mounted-source-accessor.cc
index aab95f775b77..68e01ea6659f 100644
--- a/src/libutil/mounted-source-accessor.cc
+++ b/src/libutil/mounted-source-accessor.cc
@@ -4,8 +4,14 @@
 
 namespace nix {
 
+namespace {
+
 struct MountedSourceAccessorImpl : MountedSourceAccessor
 {
+private:
+    void anchor() override {};
+
+public:
     boost::concurrent_flat_map<CanonPath, ref<SourceAccessor>> mounts;
 
     MountedSourceAccessorImpl(std::map<CanonPath, ref<SourceAccessor>> _mounts)
@@ -73,6 +79,11 @@ struct MountedSourceAccessorImpl : MountedSourceAccessor
         }
     }
 
+    void invalidateCache() override
+    {
+        mounts.visit_all([](auto & kv) { kv.second->invalidateCache(); });
+    }
+
     std::optional<std::filesystem::path> getPhysicalPath(const CanonPath & path) override
     {
         auto [accessor, subpath] = resolve(path);
@@ -99,14 +110,12 @@ struct MountedSourceAccessorImpl : MountedSourceAccessor
         auto [accessor, subpath] = resolve(path);
         return accessor->getFingerprint(subpath);
     }
-
-    void invalidateCache(const CanonPath & path) override
-    {
-        auto [accessor, subpath] = resolve(path);
-        accessor->invalidateCache(subpath);
-    }
 };
 
+} // namespace
+
+MountedSourceAccessor::~MountedSourceAccessor() {}
+
 ref<MountedSourceAccessor> makeMountedSourceAccessor(std::map<CanonPath, ref<SourceAccessor>> mounts)
 {
     return make_ref<MountedSourceAccessorImpl>(std::move(mounts));
diff --git a/src/libutil/nar-accessor.cc b/src/libutil/nar-accessor.cc
index f27d1390f915..e3c6a4f97d8d 100644
--- a/src/libutil/nar-accessor.cc
+++ b/src/libutil/nar-accessor.cc
@@ -4,8 +4,14 @@
 
 namespace nix {
 
+namespace {
+
 struct NarAccessorImpl : NarAccessor
 {
+private:
+    void anchor() override {};
+
+public:
     NarListing root;
 
     std::function<void(uint64_t, uint64_t, Sink &)> getNarBytes;
@@ -135,6 +141,10 @@ struct NarAccessorImpl : NarAccessor
     }
 };
 
+} // namespace
+
+NarAccessor::~NarAccessor() {}
+
 ref<NarAccessor> makeNarAccessor(std::string && nar)
 {
     return make_ref<NarAccessorImpl>(std::move(nar));
diff --git a/src/libutil/posix-source-accessor.cc b/src/libutil/posix-source-accessor.cc
index 609855281389..55fa6342f451 100644
--- a/src/libutil/posix-source-accessor.cc
+++ b/src/libutil/posix-source-accessor.cc
@@ -1,11 +1,18 @@
-#include "nix/util/posix-source-accessor.hh"
+#include "nix/util/source-accessor.hh"
 #include "nix/util/file-system-at.hh"
+#include "nix/util/lru-cache.hh"
+#include "nix/util/sync.hh"
 #include "nix/util/memory-source-accessor.hh"
-#include "nix/util/source-path.hh"
 #include "nix/util/signals.hh"
 
 #include <boost/unordered/concurrent_flat_map.hpp>
 
+#include <atomic>
+
+#ifndef _WIN32
+#  include <sys/resource.h>
+#endif
+
 namespace nix {
 
 static SourceAccessor::Stat sourceAccessorStatFromPosixStat(const PosixStat & st)
@@ -31,8 +38,56 @@ static SourceAccessor::Stat sourceAccessorStatFromPosixStat(const PosixStat & st
 
 namespace {
 
-class PosixFileSourceAccessor : public detail::PosixSourceAccessorBase
+/**
+ * Common base helper class for deduplicating common code paths for tracking mtime.
+ */
+class PosixSourceAccessorBase : virtual public SourceAccessor
+{
+private:
+    void anchor() override;
+
+protected:
+    const bool trackLastModified = false;
+
+    /**
+     * The most recent mtime seen by lstat(). This is a hack to
+     * support dumpPathAndGetMtime(). Should remove this eventually.
+     */
+    std::atomic<time_t> mtime = 0;
+
+    void maybeUpdateMtime(time_t seenMTime)
+    {
+        if (trackLastModified) {
+            /* Don't have https://en.cppreference.com/cpp/atomic/atomic/fetch_max yet, thus a CAS loop. */
+            time_t oldValue = mtime.load(std::memory_order_relaxed);
+            while (oldValue < seenMTime && !mtime.compare_exchange_weak(oldValue, seenMTime, std::memory_order_relaxed))
+                ;
+        }
+    }
+
+    PosixSourceAccessorBase(bool trackLastModified)
+        : trackLastModified(trackLastModified)
+    {
+    }
+
+    virtual std::optional<time_t> getLastModified() override
+    {
+        if (trackLastModified)
+            return mtime;
+        return std::nullopt;
+    }
+};
+
+void PosixSourceAccessorBase::anchor() {}
+
+#ifndef _WIN32
+
+class PosixDirectorySourceAccessor;
+
+class PosixFileSourceAccessor : public PosixSourceAccessorBase
 {
+    friend class PosixDirectorySourceAccessor;
+
     AutoCloseFD fd;
     std::filesystem::path fsPath;
     /**
@@ -122,9 +177,471 @@ std::string PosixFileSourceAccessor::readLink(const CanonPath & path)
     throw NotASymlink("path '%1%' is not a symlink", showPath(path));
 }
 
-} // namespace
+static unsigned getGlobalDirFdCacheLimit()
+{
+    ::rlimit lim{};
+    if (::getrlimit(RLIMIT_NOFILE, &lim) == -1)
+        throw SysError("querying RLIMIT_NOFILE");
+    /* Some sane upper bound in case we have a huge rlimit. */
+    return std::min<rlim_t>(4096, lim.rlim_cur / 8);
+}
+
+class PosixDirectorySourceAccessor : public PosixSourceAccessorBase
+{
+public:
+    static unsigned getGlobalFdLimit()
+    {
+        static auto res = getGlobalDirFdCacheLimit();
+        return res;
+    }
+
+    static void registerAccessor(ref<PosixDirectorySourceAccessor> accessor)
+    {
+        auto reg = globalDirFdCacheRegistry.lock();
+        std::erase_if(*reg, [](auto & maybeAccessor) { return maybeAccessor.expired(); });
+        reg->push_back(accessor.get_ptr());
+    }
+
+private:
+    AutoCloseFD dirFd;
+    std::filesystem::path fsPath;
+
+    std::shared_ptr<Sync<LRUCache<CanonPath, ref<AutoCloseFD>>>> dirFdCache;
+
+    static inline std::atomic<unsigned> globalDirFdCount = 0;
+
+    static inline Sync<std::list<std::weak_ptr<PosixDirectorySourceAccessor>>> globalDirFdCacheRegistry;
+
+    static void maybeEvictFromGlobalCaches()
+    {
+        if (globalDirFdCount.load(std::memory_order_relaxed) < getGlobalFdLimit())
+            return;
+
+        auto registry(globalDirFdCacheRegistry.lock());
+        for (auto it = registry->begin(); it != registry->end();) {
+            if (globalDirFdCount.load(std::memory_order_relaxed) < getGlobalFdLimit())
+                break;
+
+            auto accessor = it->lock();
+            if (!accessor) {
+                it = registry->erase(it);
+                continue;
+            }
+
+            /* TODO: Would be nicer if we could evict a portion of the utilised
+               cache to avoid cold-start issues. Should be fine for now. */
+            if (accessor->dirFdCache) {
+                auto cache = accessor->dirFdCache->lock();
+                globalDirFdCount.fetch_sub(cache->size(), std::memory_order_relaxed);
+                cache->clear();
+            }
+
+            ++it;
+        }
+    }
+
+    void insertIntoDirFdCache(const CanonPath & key, ref<AutoCloseFD> fd)
+    {
+        assert(dirFdCache);
+        auto cache = dirFdCache->lock();
+        auto before = cache->size();
+        cache->upsert(key, std::move(fd));
+        globalDirFdCount.fetch_add(cache->size() - before, std::memory_order_relaxed);
+    }
+
+    /**
+     * Helper for opening the parent directory used for other FD-relative operations down the line.
+     * Also caches the resulting dirFd. Throws FileNotFound if some intermediate directory or the parent
+     * doesn't exist.
+     */
+    std::pair<Descriptor, std::shared_ptr<AutoCloseFD>> openParentAndUpsert(const CanonPath & path, bool ignoreMissing);
+
+    /**
+     * Get the parent directory of path. The second pair element might be an owning file descriptor
+     * if path.parent().isRoot() is false.
+     */
+    std::pair<Descriptor, std::shared_ptr<AutoCloseFD>> openParent(const CanonPath & path);
+
+    std::function<void(AutoCloseFD, CanonPath)> makeDirFdCallback();
+
+    AutoCloseFD openSubdirectory(const CanonPath & path);
+
+public:
+    PosixDirectorySourceAccessor(
+        AutoCloseFD fd, std::filesystem::path path, bool trackLastModified, unsigned dirFdCacheSize)
+        : PosixSourceAccessorBase(trackLastModified)
+        , dirFd(std::move(fd))
+        , fsPath(std::move(path))
+    {
+        assert(fsPath.is_absolute()); /* Only used for error messages, but still nice to enforce this invariant. */
+        setPathDisplay(fsPath.generic_string());
+
+        if (dirFdCacheSize)
+            dirFdCache = std::make_shared<Sync<LRUCache<CanonPath, ref<AutoCloseFD>>>>(dirFdCacheSize);
+    }
+
+    PosixDirectorySourceAccessor(PosixDirectorySourceAccessor &&) = delete;
+    PosixDirectorySourceAccessor(const PosixDirectorySourceAccessor &) = delete;
+    PosixDirectorySourceAccessor & operator=(PosixDirectorySourceAccessor &&) = delete;
+    PosixDirectorySourceAccessor & operator=(const PosixDirectorySourceAccessor &) = delete;
+
+    ~PosixDirectorySourceAccessor()
+    {
+        invalidateCache();
+    }
+
+    void invalidateCache() override
+    {
+        if (dirFdCache) {
+            auto cache = dirFdCache->lock();
+            globalDirFdCount.fetch_sub(cache->size(), std::memory_order_relaxed);
+            cache->clear();
+        }
+    }
 
-PosixSourceAccessor::PosixSourceAccessor(std::filesystem::path && argRoot, bool trackLastModified)
+    void readFile(const CanonPath & path, Sink & sink, fun<void(uint64_t)> sizeCallback) override;
+
+    std::optional<Stat> maybeLstat(const CanonPath & path) override;
+
+    DirEntries readDirectory(const CanonPath & path) override;
+
+    void readDirectory(
+        const CanonPath & dirPath,
+        std::function<void(SourceAccessor & subdirAccessor, const CanonPath & subdirRelPath)> callback) override;
+
+    std::string readLink(const CanonPath & path) override;
+
+    std::optional<std::filesystem::path> getPhysicalPath(const CanonPath & path) override
+    {
+        if (path.isRoot())
+            return fsPath;
+        return std::filesystem::path(fsPath) / path.rel(); /* RHS *must* be a relative path. */
+    }
+
+    std::string showPath(const CanonPath & path) override
+    {
+        if (path.isRoot())
+            return displayPrefix; /* No trailing slash. */
+        if (displayPrefix.ends_with('/'))
+            return displayPrefix + path.rel();
+        return displayPrefix + path.abs();
+    }
+};
+
+std::function<void(AutoCloseFD, CanonPath)> PosixDirectorySourceAccessor::makeDirFdCallback()
+{
+    if (!dirFdCache)
+        return nullptr;
+
+    return [this](AutoCloseFD fd, CanonPath key) {
+        assert(fd);
+        insertIntoDirFdCache(std::move(key), make_ref<AutoCloseFD>(std::move(fd)));
+    };
+}
+
+std::pair<Descriptor, std::shared_ptr<AutoCloseFD>> PosixDirectorySourceAccessor::openParent(const CanonPath & path)
+{
+    assert(!path.isRoot());
+    auto parent = path.parent().value();
+    if (parent.isRoot())
+        return {dirFd.get(), nullptr};
+
+    maybeEvictFromGlobalCaches();
+
+    std::shared_ptr<AutoCloseFD> intermediateParentFd;
+    CanonPath anchor = CanonPath::root;
+
+    if (dirFdCache) {
+        auto cache = dirFdCache->lock();
+        auto p = parent;
+        while (true) {
+            if (auto intermediateDirFdHit = cache->get(p)) {
+                if (p == parent)
+                    return {(*intermediateDirFdHit)->get(), *intermediateDirFdHit};
+                intermediateParentFd = intermediateDirFdHit->get_ptr();
+                anchor = p;
+                break;
+            }
+            if (p.isRoot())
+                break;
+            p.pop();
+        }
+    }
+
+    Descriptor startFd = intermediateParentFd ? intermediateParentFd->get() : dirFd.get();
+    CanonPath relPath = intermediateParentFd ? parent.removePrefix(anchor) : parent;
+
+    std::function<void(AutoCloseFD, CanonPath)> cb;
+    if (auto base = makeDirFdCallback()) {
+        if (intermediateParentFd) {
+            cb = [base = std::move(base), prefix = anchor](AutoCloseFD fd, CanonPath relKey) {
+                base(std::move(fd), prefix / relKey);
+            };
+        } else {
+            cb = std::move(base);
+        }
+    }
+
+    try {
+        AutoCloseFD parentFdOwning = openFileEnsureBeneathNoSymlinks(
+            startFd,
+            relPath,
+#  ifdef O_PATH
+            /* As to not require read permissions on the directory. */
+            O_PATH |
+#  else
+            /* Sadly this will require read permissison for path resolution,
+               but without O_PATH that's unavoidable. */
+            O_RDONLY |
+#  endif
+                O_DIRECTORY | O_CLOEXEC,
+            0,
+            std::move(cb));
+        return {parentFdOwning.get(), make_ref<AutoCloseFD>(std::move(parentFdOwning))};
+    } catch (SymlinkNotAllowed & e) {
+        /* Need to fixup the error message to include the actual path relative to the (possibly) cached fd. */
+        throw SymlinkNotAllowed(anchor / e.path, "path '%s' (or its ancestor) is a symlink", showPath(anchor / e.path));
+    }
+}
+
+std::pair<Descriptor, std::shared_ptr<AutoCloseFD>>
+PosixDirectorySourceAccessor::openParentAndUpsert(const CanonPath & path, bool ignoreMissing)
+{
+    auto [parentFd, parentFdOwning] = openParent(path);
+    if (parentFd == INVALID_DESCRIPTOR) {
+        if (errno == ENOENT || errno == ENOTDIR) /* Intermediate component might not exist. */ {
+            if (ignoreMissing)
+                return {INVALID_DESCRIPTOR, {}};
+            else
+                throw FileNotFound("path '%s' does not exist", showPath(path));
+        }
+        throw SysError("opening directory '%1%'", showPath(path.parent().value()));
+    }
+
+    if (dirFdCache && parentFdOwning) {
+        assert(*parentFdOwning);
+        insertIntoDirFdCache(path.parent().value(), ref<AutoCloseFD>(parentFdOwning));
+    }
+
+    return {parentFd, parentFdOwning};
+}
+
+std::optional<SourceAccessor::Stat> PosixDirectorySourceAccessor::maybeLstat(const CanonPath & path)
+{
+    PosixStat st;
+
+    if (path.isRoot()) {
+        /* Must never fail - we already have the file descriptor for the directory. */
+        st = nix::fstat(dirFd.get());
+    } else {
+        auto [parentFd, parentFdOwning] = openParentAndUpsert(path, /*ignoreMissing=*/true);
+        if (parentFd == INVALID_DESCRIPTOR)
+            return std::nullopt;
+
+        /* We know that CanonPath returns a NUL-terminated string_view, so the use of ->data() here is safe. */
+        if (::fstatat(parentFd, path.baseName()->data(), &st, AT_SYMLINK_NOFOLLOW) == -1) {
+            if (errno == ENOENT)
+                return std::nullopt;
+            throw SysError("getting status of '%1%'", showPath(path));
+        }
+    }
+
+    maybeUpdateMtime(st.st_mtime);
+    return sourceAccessorStatFromPosixStat(st);
+}
+
+void PosixDirectorySourceAccessor::readFile(const CanonPath & path, Sink & sink, fun<void(uint64_t)> sizeCallback)
+{
+    if (path.isRoot())
+        throw NotARegularFile("'%s' is not a regular file", showPath(path));
+
+    /* TODO: We can do better when we have openat2. */
+    auto [parentFd, parentFdOwning] = openParentAndUpsert(path, /*ignoreMissing=*/false);
+    AutoCloseFD fileFd;
+
+    try {
+        fileFd = openFileEnsureBeneathNoSymlinks(parentFd, path.baseName().value(), O_RDONLY | O_CLOEXEC);
+    } catch (SymlinkNotAllowed & e) {
+        auto parent = path.parent().value();
+        throw SymlinkNotAllowed(parent / e.path, "path '%s' is a symlink", showPath(parent / e.path));
+    }
+
+    if (!fileFd) {
+        if (errno == ENOENT)
+            throw FileNotFound("file '%s' does not exist", showPath(path));
+        throw SysError("opening '%s'", showPath(path));
+    }
+
+    auto st = nix::fstat(fileFd.get());
+    if (!S_ISREG(st.st_mode))
+        throw NotARegularFile("file '%s' is not a regular file", showPath(path));
+    PosixFileSourceAccessor fileAccessor(std::move(fileFd), fsPath / path.rel(), trackLastModified, st);
+    maybeUpdateMtime(st.st_mtime);
+    fileAccessor.readFile(CanonPath::root, sink, sizeCallback);
+}
+
+AutoCloseFD PosixDirectorySourceAccessor::openSubdirectory(const CanonPath & path)
+{
+    AutoCloseFD dirFdOwning;
+
+    if (path.isRoot()) {
+        /* Get a fresh file descriptor for thread-safety. */
+        dirFdOwning = ::openat(dirFd.get(), ".", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
+        if (!dirFdOwning)
+            throw SysError("opening directory '%s'", showPath(path));
+    } else {
+        /* TODO: We can do better when we have openat2. */
+        auto [parentFd, parentFdOwning] = openParentAndUpsert(path, /*ignoreMissing=*/false);
+
+        try {
+            dirFdOwning =
+                openFileEnsureBeneathNoSymlinks(parentFd, path.baseName().value(), O_DIRECTORY | O_RDONLY | O_CLOEXEC);
+        } catch (SymlinkNotAllowed & e) {
+            auto parent = path.parent().value();
+            throw SymlinkNotAllowed(parent / e.path, "path '%s' is a symlink", showPath(parent / e.path));
+        }
+
+        if (!dirFdOwning) {
+            if (errno == ENOTDIR)
+                throw NotADirectory("'%s' is not a directory", showPath(path));
+            throw SysError("opening directory '%s'", showPath(path));
+        }
+    }
+
+    return dirFdOwning;
+}
+
+SourceAccessor::DirEntries PosixDirectorySourceAccessor::readDirectory(const CanonPath & path)
+try {
+    AutoCloseFD dirFdOwning = openSubdirectory(path);
+    AutoCloseDir dir(::fdopendir(dirFdOwning.get()));
+    if (!dir)
+        throw SysError("reading directory '%s'", showPath(path));
+    dirFdOwning.release();
+
+    DirEntries entries;
+    const ::dirent * dirent = nullptr;
+
+    while (errno = 0, dirent = ::readdir(dir.get())) {
+        checkInterrupt();
+        std::string_view name(dirent->d_name);
+        if (name == "." || name == "..")
+            continue;
+
+        std::optional<Type> type;
+        switch (dirent->d_type) {
+        case DT_REG:
+            type = tRegular;
+            break;
+        case DT_DIR:
+            type = tDirectory;
+            break;
+        case DT_LNK:
+            type = tSymlink;
+            break;
+        case DT_CHR:
+            type = tChar;
+            break;
+        case DT_BLK:
+            type = tBlock;
+            break;
+        case DT_FIFO:
+            type = tFifo;
+            break;
+        case DT_SOCK:
+            type = tSocket;
+            break;
+        default:
+            type = std::nullopt;
+            break;
+        }
+        entries.emplace(name, type);
+    }
+
+    if (errno)
+        throw SysError("reading directory '%1%'", showPath(path));
+
+    return entries;
+} catch (SymlinkNotAllowed & e) {
+    throw SymlinkNotAllowed(e.path, "path '%s' is a symlink", showPath(e.path));
+}
+
+void PosixDirectorySourceAccessor::readDirectory(
+    const CanonPath & dirPath,
+    std::function<void(SourceAccessor & subdirAccessor, const CanonPath & subdirRelPath)> callback)
+{
+    auto fd = openSubdirectory(dirPath);
+    PosixDirectorySourceAccessor accessor{
+        std::move(fd), fsPath / dirPath.rel(), trackLastModified, /*dirFdCacheSize=*/0};
+    callback(accessor, CanonPath::root);
+    PosixSourceAccessorBase::maybeUpdateMtime(accessor.mtime);
+}
+
+std::string PosixDirectorySourceAccessor::readLink(const CanonPath & path)
+try {
+    if (path.isRoot())
+        throw NotASymlink("file '%s' is not a symlink", showPath(path));
+
+    auto [parentFd, parentFdOwning] = openParentAndUpsert(path, /*ignoreMissing=*/false);
+
+    try {
+        return readLinkAt(parentFd, CanonPath(path.baseName().value()));
+    } catch (SysError & e) {
+        if (e.errNo == EINVAL)
+            throw NotASymlink("file '%s' is not a symlink", showPath(path));
+        throw;
+    }
+} catch (SymlinkNotAllowed & e) {
+    throw SymlinkNotAllowed(e.path, "path '%s' is a symlink", showPath(e.path));
+}
+
+#else
+
+/**
+ * A source accessor that uses the Windows filesystem.
+ * @todo Should be moved into a separate file.
+ */
+class WindowsSourceAccessor : public PosixSourceAccessorBase
+{
+    /**
+     * Optional root path to prefix all operations into the native file
+     * system. This allows prepending funny things like `C:\` that
+     * `CanonPath` intentionally doesn't support.
+     */
+    const std::filesystem::path root;
+
+public:
+
+    WindowsSourceAccessor();
+    WindowsSourceAccessor(std::filesystem::path && root, bool trackLastModified = false);
+
+    void readFile(const CanonPath & path, Sink & sink, fun<void(uint64_t)> sizeCallback) override;
+
+    using SourceAccessor::readFile;
+
+    bool pathExists(const CanonPath & path) override;
+
+    std::optional<Stat> maybeLstat(const CanonPath & path) override;
+
+    DirEntries readDirectory(const CanonPath & path) override;
+
+    std::string readLink(const CanonPath & path) override;
+
+    std::optional<std::filesystem::path> getPhysicalPath(const CanonPath & path) override;
+
+private:
+
+    /**
+     * Throw an error if `path` or any of its ancestors are symlinks.
+     */
+    void assertNoSymlinks(CanonPath path);
+
+    std::optional<PosixStat> cachedLstat(const CanonPath & path);
+
+    std::filesystem::path makeAbsPath(const CanonPath & path);
+};
+
+WindowsSourceAccessor::WindowsSourceAccessor(std::filesystem::path && argRoot, bool trackLastModified)
     : PosixSourceAccessorBase(trackLastModified)
     , root(std::move(argRoot))
 {
@@ -132,21 +649,12 @@ PosixSourceAccessor::PosixSourceAccessor(std::filesystem::path && argRoot, bool
     displayPrefix = root.string();
 }
 
-PosixSourceAccessor::PosixSourceAccessor()
-    : PosixSourceAccessor(std::filesystem::path{})
-{
-}
-
-SourcePath PosixSourceAccessor::createAtRoot(const std::filesystem::path & path, bool trackLastModified)
+WindowsSourceAccessor::WindowsSourceAccessor()
+    : WindowsSourceAccessor(std::filesystem::path{})
 {
-    std::filesystem::path path2 = absPath(path);
-    return {
-        make_ref<PosixSourceAccessor>(path2.root_path(), trackLastModified),
-        CanonPath{path2.relative_path().string()},
-    };
 }
 
-std::filesystem::path PosixSourceAccessor::makeAbsPath(const CanonPath & path)
+std::filesystem::path WindowsSourceAccessor::makeAbsPath(const CanonPath & path)
 {
     return root.empty()    ? (std::filesystem::path{path.abs()})
            : path.isRoot() ? /* Don't append a slash for the root of the accessor, since
@@ -156,19 +664,13 @@ std::filesystem::path PosixSourceAccessor::makeAbsPath(const CanonPath & path)
                            : root / path.rel();
 }
 
-void PosixSourceAccessor::readFile(const CanonPath & path, Sink & sink, fun<void(uint64_t)> sizeCallback)
+void WindowsSourceAccessor::readFile(const CanonPath & path, Sink & sink, fun<void(uint64_t)> sizeCallback)
 {
     assertNoSymlinks(path);
 
     auto ap = makeAbsPath(path);
 
-    AutoCloseFD fd = toDescriptor(open(
-        ap.string().c_str(),
-        O_RDONLY
-#ifndef _WIN32
-            | O_NOFOLLOW | O_CLOEXEC
-#endif
-        ));
+    AutoCloseFD fd = toDescriptor(open(ap.string().c_str(), O_RDONLY));
     if (!fd)
         throw SysError("opening file '%1%'", ap.string());
 
@@ -182,7 +684,7 @@ void PosixSourceAccessor::readFile(const CanonPath & path, Sink & sink, fun<void
     source.drainInto(sink, size);
 }
 
-bool PosixSourceAccessor::pathExists(const CanonPath & path)
+bool WindowsSourceAccessor::pathExists(const CanonPath & path)
 {
     if (auto parent = path.parent())
         assertNoSymlinks(*parent);
@@ -192,7 +694,7 @@ bool PosixSourceAccessor::pathExists(const CanonPath & path)
 using Cache = boost::concurrent_flat_map<std::string, std::optional<PosixStat>>;
 static Cache cache;
 
-std::optional<PosixStat> PosixSourceAccessor::cachedLstat(const CanonPath & path)
+std::optional<PosixStat> WindowsSourceAccessor::cachedLstat(const CanonPath & path)
 {
     // Note: we convert std::filesystem::path to std::string because the
     // former is not hashable on libc++.
@@ -210,12 +712,7 @@ std::optional<PosixStat> PosixSourceAccessor::cachedLstat(const CanonPath & path
     return st;
 }
 
-void PosixSourceAccessor::invalidateCache(const CanonPath & path)
-{
-    cache.erase(makeAbsPath(path).string());
-}
-
-std::optional<SourceAccessor::Stat> PosixSourceAccessor::maybeLstat(const CanonPath & path)
+std::optional<SourceAccessor::Stat> WindowsSourceAccessor::maybeLstat(const CanonPath & path)
 {
     if (auto parent = path.parent())
         assertNoSymlinks(*parent);
@@ -227,7 +724,7 @@ std::optional<SourceAccessor::Stat> PosixSourceAccessor::maybeLstat(const CanonP
     return sourceAccessorStatFromPosixStat(*st);
 }
 
-SourceAccessor::DirEntries PosixSourceAccessor::readDirectory(const CanonPath & path)
+SourceAccessor::DirEntries WindowsSourceAccessor::readDirectory(const CanonPath & path)
 {
     assertNoSymlinks(path);
     DirEntries res;
@@ -279,19 +776,19 @@ SourceAccessor::DirEntries PosixSourceAccessor::readDirectory(const CanonPath &
     return res;
 }
 
-std::string PosixSourceAccessor::readLink(const CanonPath & path)
+std::string WindowsSourceAccessor::readLink(const CanonPath & path)
 {
     if (auto parent = path.parent())
         assertNoSymlinks(*parent);
     return nix::readLink(makeAbsPath(path)).string();
 }
 
-std::optional<std::filesystem::path> PosixSourceAccessor::getPhysicalPath(const CanonPath & path)
+std::optional<std::filesystem::path> WindowsSourceAccessor::getPhysicalPath(const CanonPath & path)
 {
     return makeAbsPath(path);
 }
 
-void PosixSourceAccessor::assertNoSymlinks(CanonPath path)
+void WindowsSourceAccessor::assertNoSymlinks(CanonPath path)
 {
     while (!path.isRoot()) {
         auto st = cachedLstat(path);
@@ -301,20 +798,24 @@ void PosixSourceAccessor::assertNoSymlinks(CanonPath path)
     }
 }
 
+#endif
+
+} // namespace
+
 ref<SourceAccessor> getFSSourceAccessor()
 {
-    static auto rootFS = make_ref<PosixSourceAccessor>();
+    static auto rootFS = makeFSSourceAccessor("/", /*trackLastModified=*/false);
     return rootFS;
 }
 
-ref<SourceAccessor> makeFSSourceAccessor(std::filesystem::path root, bool trackLastModified)
+ref<SourceAccessor> makeFSSourceAccessor(std::filesystem::path root, bool trackLastModified, FinalSymlink finalSymlink)
 {
 #ifndef _WIN32
     assert(root.is_absolute());
-    AutoCloseFD fd = openFileReadonly(root, FinalSymlink::DontFollow);
+    AutoCloseFD fd = openFileReadonly(root, finalSymlink);
 
     if (!fd) {
-        if (errno != ELOOP)
+        if (finalSymlink == FinalSymlink::Follow || errno != NIX_ERR_OPEN_SYMLINK)
             throw NativeSysError("opening file %1%", PathFmt(root));
 
         /* A helper class that holds the symlink destination in memory. */
@@ -383,10 +884,18 @@ ref<SourceAccessor> makeFSSourceAccessor(std::filesystem::path root, bool trackL
     if (S_ISREG(st.st_mode))
         return make_ref<PosixFileSourceAccessor>(std::move(fd), std::move(root), trackLastModified, st);
 
-    /* TODO: Use the file descriptor for fd-relative operations on the directory. */
-#endif
+    else if (S_ISDIR(st.st_mode)) {
+        auto res = make_ref<PosixDirectorySourceAccessor>(
+            std::move(fd), std::move(root), trackLastModified, PosixDirectorySourceAccessor::getGlobalFdLimit() / 8);
+        PosixDirectorySourceAccessor::registerAccessor(res);
+        return res;
+    }
 
-    return make_ref<PosixSourceAccessor>(std::move(root), trackLastModified);
+    else
+        throw Error("file %1% has an unsupported type", PathFmt(root));
+#else
+    return make_ref<WindowsSourceAccessor>(std::move(root), trackLastModified);
+#endif
 }
 
 } // namespace nix
diff --git a/src/libutil/processes.cc b/src/libutil/processes.cc
index d36feb19a5c4..0211557034cf 100644
--- a/src/libutil/processes.cc
+++ b/src/libutil/processes.cc
@@ -3,6 +3,8 @@
 
 namespace nix {
 
+void ExecError::anchor() {}
+
 Pid & Pid::operator=(Pid && other) noexcept
 {
     swap(*this, other);
diff --git a/src/libutil/serialise.cc b/src/libutil/serialise.cc
index 6c77c15fe584..eb1209843179 100644
--- a/src/libutil/serialise.cc
+++ b/src/libutil/serialise.cc
@@ -10,6 +10,7 @@
 #include <memory>
 
 #include <boost/coroutine2/coroutine.hpp>
+#include <boost/coroutine2/protected_fixedsize_stack.hpp>
 
 #ifdef _WIN32
 #  include <fileapi.h>
@@ -19,6 +20,50 @@
 
 namespace nix {
 
+void SerialisationError::anchor() {}
+
+void Sink::anchor() {}
+
+void BufferedSink::anchor() {}
+
+void FdSink::anchor() {}
+
+void StringSink::anchor() {}
+
+void TeeSink::anchor() {}
+
+void FinishSink::anchor() {}
+
+void LambdaSink::anchor() {}
+
+void NullSink::anchor() {}
+
+void FramedSink::anchor() {}
+
+void Source::anchor() {}
+
+void BufferedSource::anchor() {}
+
+void RestartableSource::anchor() {}
+
+void FdSource::anchor() {}
+
+void TeeSource::anchor() {}
+
+void StringSource::anchor() {}
+
+void LambdaSource::anchor() {}
+
+void FramedSource::anchor() {}
+
+void LengthSource::anchor() {}
+
+void EnsureRead::anchor() {}
+
+void ChainSource::anchor() {}
+
+void SizedSource::anchor() {}
+
 void BufferedSink::operator()(std::string_view data)
 {
     if (!buffer)
@@ -27,14 +72,14 @@ void BufferedSink::operator()(std::string_view data)
     while (!data.empty()) {
         /* Optimisation: bypass the buffer if the data exceeds the
            buffer size. */
-        if (bufPos + data.size() >= bufSize) {
+        if (data.size() >= bufSize - bufPos) {
             flush();
             writeUnbuffered(data);
             break;
         }
         /* Otherwise, copy the bytes to the buffer.  Flush the buffer
            when it's full. */
-        size_t n = bufPos + data.size() > bufSize ? bufSize - bufPos : data.size();
+        size_t n = data.size() > bufSize - bufPos ? bufSize - bufPos : data.size();
         memcpy(buffer.get() + bufPos, data.data(), n);
         data.remove_prefix(n);
         bufPos += n;
@@ -224,6 +269,9 @@ bool FdSource::hasData()
         return true;
 
     while (true) {
+#ifdef _WIN32
+        /* Windows' fd_set is a bounded handle array, so FD_SET can't
+           overflow; on Unix use poll() since fd may exceed FD_SETSIZE. */
         fd_set fds;
         FD_ZERO(&fds);
         Socket sock = toSocket(fd);
@@ -240,6 +288,20 @@ bool FdSource::hasData()
             throw SysError("polling file descriptor");
         }
         return FD_ISSET(sock, &fds);
+#else
+        struct pollfd pfd;
+        pfd.fd = fd;
+        pfd.events = POLLIN;
+        pfd.revents = 0;
+
+        auto n = poll(&pfd, 1, 0);
+        if (n < 0) {
+            if (errno == EINTR)
+                continue;
+            throw SysError("polling file descriptor");
+        }
+        return n > 0 && (pfd.revents & (POLLIN | POLLHUP | POLLERR)) != 0;
+#endif
     }
 }
 
@@ -269,6 +331,8 @@ void FdSource::skip(size_t len)
 #ifndef _WIN32
     /* If we can, seek forward in the file to skip the rest. */
     if (isSeekable && len) {
+        if (len > static_cast<size_t>(std::numeric_limits<off_t>::max()))
+            throw Error("cannot skip %d bytes: exceeds maximum file offset", len);
         if (lseek(fd, len, SEEK_CUR) == -1) {
             if (errno == ESPIPE)
                 isSeekable = false;
@@ -305,6 +369,13 @@ void StringSource::skip(size_t len)
     pos += len;
 }
 
+/* 512KiB is a conservative estimate for deeply nested NARs, which are limited
+   to 64 levels. We also tend to allocate rather large buffers on the stack, so
+   we should leave plenty of headroom. Note that no evaluation is supposed to
+   happen on sourceToSink/sinkToSource coroutine stacks (for Boehm GC reasons),
+   which requires much more stack space. */
+static constexpr size_t defaultCoroutineStackSize = 512 * 1024;
+
 std::unique_ptr<FinishSink> sourceToSink(fun<void(Source &)> reader)
 {
     struct SourceToSink : FinishSink
@@ -328,20 +399,22 @@ std::unique_ptr<FinishSink> sourceToSink(fun<void(Source &)> reader)
             cur = in;
 
             if (!coro) {
-                coro = coro_t::push_type([&](coro_t::pull_type & yield) {
-                    LambdaSource source([&](char * out, size_t out_len) {
-                        if (cur.empty()) {
-                            yield();
-                            if (yield.get())
-                                throw EndOfFile("coroutine has finished");
-                        }
-
-                        size_t n = cur.copy(out, out_len);
-                        cur.remove_prefix(n);
-                        return n;
+                coro = coro_t::push_type(
+                    boost::coroutines2::protected_fixedsize_stack(defaultCoroutineStackSize),
+                    [&](coro_t::pull_type & yield) {
+                        LambdaSource source([&](char * out, size_t out_len) {
+                            if (cur.empty()) {
+                                yield();
+                                if (yield.get())
+                                    throw EndOfFile("coroutine has finished");
+                            }
+
+                            size_t n = cur.copy(out, out_len);
+                            cur.remove_prefix(n);
+                            return n;
+                        });
+                        reader(source);
                     });
-                    reader(source);
-                });
             }
 
             if (!*coro) {
@@ -385,14 +458,32 @@ std::unique_ptr<Source> sinkToSource(fun<void(Sink &)> writer, fun<void()> eof)
         {
             bool hasCoro = coro.has_value();
             if (!hasCoro) {
-                coro = coro_t::pull_type([&](coro_t::push_type & yield) {
-                    LambdaSink sink([&](std::string_view data) {
-                        if (!data.empty()) {
-                            yield(data);
-                        }
+                coro = coro_t::pull_type(
+                    boost::coroutines2::protected_fixedsize_stack(defaultCoroutineStackSize),
+                    [&](coro_t::push_type & yield) {
+                        /* Feed the consumer in chunks, instead of on each write
+                           to avoid excessive context switching. parseDump does
+                           lots of small writes to the sink, which we should
+                           accumulate. */
+                        struct CoroBufferedSink : BufferedSink
+                        {
+                            coro_t::push_type & yield;
+
+                            void writeUnbuffered(std::string_view data) override
+                            {
+                                yield(data);
+                            }
+
+                            CoroBufferedSink(coro_t::push_type & yield)
+                                : yield(yield)
+                            {
+                            }
+                        };
+
+                        CoroBufferedSink sink(yield);
+                        writer(sink);
+                        sink.flush();
                     });
-                    writer(sink);
-                });
             }
 
             if (cur.empty()) {
@@ -486,12 +577,11 @@ Sink & operator<<(Sink & sink, const Error & ex)
 void readPadding(size_t len, Source & source)
 {
     if (len % 8) {
-        char zero[8];
+        uint64_t zero = 0;
         size_t n = 8 - (len % 8);
-        source(zero, n);
-        for (unsigned int i = 0; i < n; i++)
-            if (zero[i])
-                throw SerialisationError("non-zero padding");
+        source(reinterpret_cast<char *>(&zero), n);
+        if (zero)
+            throw SerialisationError("non-zero padding");
     }
 }
 
@@ -538,7 +628,8 @@ template StringSet readStrings(Source & source);
 Error readError(Source & source)
 {
     auto type = readString(source);
-    assert(type == "Error");
+    if (type != "Error")
+        throw SerialisationError("unexpected error type '%s'", type);
     auto level = (Verbosity) readInt(source);
     [[maybe_unused]] auto name = readString(source); // removed
     auto msg = readString(source);
@@ -547,11 +638,13 @@ Error readError(Source & source)
         .msg = HintFmt(msg),
     };
     auto havePos = readNum<size_t>(source);
-    assert(havePos == 0);
+    if (havePos != 0)
+        throw SerialisationError("deserializing error positions is not supported");
     auto nrTraces = readNum<size_t>(source);
     for (size_t i = 0; i < nrTraces; ++i) {
         havePos = readNum<size_t>(source);
-        assert(havePos == 0);
+        if (havePos != 0)
+            throw SerialisationError("deserializing error positions is not supported");
         info.traces.push_back(Trace{.hint = HintFmt(readString(source))});
     }
     return Error(std::move(info));
diff --git a/src/libutil/signature/local-keys.cc b/src/libutil/signature/local-keys.cc
index 8afa3eb728f2..74b183b7e52a 100644
--- a/src/libutil/signature/local-keys.cc
+++ b/src/libutil/signature/local-keys.cc
@@ -176,16 +176,17 @@ bool verifyDetached(std::string_view data, const Signature & sig, const PublicKe
 } // namespace nix
 
 namespace nlohmann {
-void adl_serializer<Signature>::to_json(json & j, const Signature & s)
+void adl_serializer<nix::Signature>::to_json(json & j, const nix::Signature & s)
 {
     j = {
         {"keyName", s.keyName},
-        {"sig", base64::encode(std::as_bytes(std::span<const char>{s.sig}))},
+        {"sig", nix::base64::encode(std::as_bytes(std::span<const char>{s.sig}))},
     };
 }
 
-Signature adl_serializer<Signature>::from_json(const json & j)
+nix::Signature adl_serializer<nix::Signature>::from_json(const json & j)
 {
+    using namespace nix;
     if (j.is_string())
         return Signature::parse(getString(j));
     auto obj = getObject(j);
diff --git a/src/libutil/signature/signer.cc b/src/libutil/signature/signer.cc
index 9294b2a1802d..bb9bbad04f05 100644
--- a/src/libutil/signature/signer.cc
+++ b/src/libutil/signature/signer.cc
@@ -4,6 +4,8 @@
 
 namespace nix {
 
+void Signer::anchor() {}
+
 LocalSigner::LocalSigner(SecretKey && privateKey)
     : privateKey(privateKey)
     , publicKey(privateKey.toPublicKey())
diff --git a/src/libutil/source-accessor.cc b/src/libutil/source-accessor.cc
index 4d8ef053d93d..a7cc160a6dc5 100644
--- a/src/libutil/source-accessor.cc
+++ b/src/libutil/source-accessor.cc
@@ -3,6 +3,20 @@
 
 namespace nix {
 
+void SourceAccessorError::anchor() {}
+
+void FileNotFound::anchor() {}
+
+void NotASymlink::anchor() {}
+
+void NotADirectory::anchor() {}
+
+void NotARegularFile::anchor() {}
+
+void RestrictedPathError::anchor() {}
+
+void SymlinkNotAllowed::anchor() {}
+
 static std::atomic<size_t> nextNumber{0};
 
 bool SourceAccessor::Stat::isNotNARSerialisable()
@@ -57,13 +71,6 @@ std::string SourceAccessor::readFile(const CanonPath & path)
     return std::move(sink.s);
 }
 
-void SourceAccessor::readFile(const CanonPath & path, Sink & sink, fun<void(uint64_t)> sizeCallback)
-{
-    auto s = readFile(path);
-    sizeCallback(s.size());
-    sink(s);
-}
-
 Hash SourceAccessor::hashPath(const CanonPath & path, PathFilter & filter, HashAlgorithm ha)
 {
     HashSink sink(ha);
diff --git a/src/libutil/tarfile.cc b/src/libutil/tarfile.cc
index eea03766375c..7149d73a5fbd 100644
--- a/src/libutil/tarfile.cc
+++ b/src/libutil/tarfile.cc
@@ -5,6 +5,7 @@
 #include "nix/util/serialise.hh"
 #include "nix/util/tarfile.hh"
 #include "nix/util/file-system.hh"
+#include "nix/util/os-string.hh"
 
 namespace nix {
 
@@ -35,38 +36,19 @@ int callback_close(struct archive *, void * self)
     return ARCHIVE_OK;
 }
 
-void checkLibArchive(archive * archive, int err, const std::string & reason)
+constexpr auto defaultBufferSize = std::size_t{65536};
+} // namespace
+
+void TarArchive::check(int err, const std::string & reason, bool warningsAreFatal)
 {
     if (err == ARCHIVE_EOF)
         throw EndOfFile("reached end of archive");
+    else if (err == ARCHIVE_WARN && !warningsAreFatal)
+        warn(reason, archive_error_string(archive));
     else if (err != ARCHIVE_OK)
         throw Error(reason, archive_error_string(archive));
 }
 
-constexpr auto defaultBufferSize = std::size_t{65536};
-} // namespace
-
-void TarArchive::check(int err, const std::string & reason)
-{
-    checkLibArchive(archive, err, reason);
-}
-
-/// @brief Get filter_code from its name.
-///
-/// libarchive does not provide a convenience function like archive_write_add_filter_by_name but for reading.
-/// Instead it's necessary to use this kludge to convert method -> code and
-/// then use archive_read_support_filter_by_code. Arguably this is better than
-/// hand-rolling the equivalent function that is better implemented in libarchive.
-int getArchiveFilterCodeByName(const std::string & method)
-{
-    auto * ar = archive_write_new();
-    auto cleanup = Finally{[&ar]() { checkLibArchive(ar, archive_write_close(ar), "failed to close archive: %s"); }};
-    auto err = archive_write_add_filter_by_name(ar, method.c_str());
-    checkLibArchive(ar, err, "failed to get libarchive filter by name: %s");
-    auto code = archive_filter_code(ar, 0);
-    return code;
-}
-
 static void enableSupportedFormats(struct archive * archive)
 {
     archive_read_support_format_tar(archive);
@@ -78,15 +60,56 @@ static void enableSupportedFormats(struct archive * archive)
     archive_read_support_format_empty(archive);
 }
 
-TarArchive::TarArchive(Source & source, bool raw, std::optional<std::string> compression_method)
+static int compressionAlgoToFilterCode(CompressionAlgo algo)
+{
+    switch (algo) {
+    case CompressionAlgo::none:
+        return ARCHIVE_FILTER_NONE;
+    case CompressionAlgo::bzip2:
+        return ARCHIVE_FILTER_BZIP2;
+    case CompressionAlgo::compress:
+        return ARCHIVE_FILTER_COMPRESS;
+    case CompressionAlgo::grzip:
+        return ARCHIVE_FILTER_GRZIP;
+    case CompressionAlgo::gzip:
+        return ARCHIVE_FILTER_GZIP;
+    case CompressionAlgo::lrzip:
+        return ARCHIVE_FILTER_LRZIP;
+    case CompressionAlgo::lz4:
+        return ARCHIVE_FILTER_LZ4;
+    case CompressionAlgo::lzip:
+        return ARCHIVE_FILTER_LZIP;
+    case CompressionAlgo::lzma:
+        return ARCHIVE_FILTER_LZMA;
+    case CompressionAlgo::lzop:
+        return ARCHIVE_FILTER_LZOP;
+    case CompressionAlgo::xz:
+        return ARCHIVE_FILTER_XZ;
+    case CompressionAlgo::zstd:
+        return ARCHIVE_FILTER_ZSTD;
+    /* Brotli is handled separately and it shouldn't end up in this code. */
+    case CompressionAlgo::brotli:
+    default:
+        unreachable();
+    }
+}
+
+TarArchive::TarArchive(Source & source, bool raw, std::optional<CompressionAlgo> compressionMethod)
     : archive{archive_read_new()}
     , source{&source}
     , buffer(defaultBufferSize)
 {
-    if (!compression_method) {
+    if (!compressionMethod) {
+        /* Can't fail and always returns ARCHIVE_OK. Doesn't warn if some filters
+           would require calling an external program. */
         archive_read_support_filter_all(archive);
     } else {
-        archive_read_support_filter_by_code(archive, getArchiveFilterCodeByName(*compression_method));
+        int compressionCode = compressionAlgoToFilterCode(*compressionMethod);
+        /* Will warn if enabling some algorithm requires calling an external program. */
+        check(
+            archive_read_support_filter_by_code(archive, compressionCode),
+            "enabling libarchive decompression filter (%s)",
+            /*warningsAreFatal=*/false);
     }
 
     if (!raw)
@@ -123,6 +146,12 @@ TarArchive::~TarArchive()
         archive_read_free(this->archive);
 }
 
+#ifndef _WIN32
+#  define NIX_LIBARCHIVE_NATIVE_PATH_FUNC(func) func
+#else
+#  define NIX_LIBARCHIVE_NATIVE_PATH_FUNC(func) func##_w
+#endif
+
 static void extract_archive(TarArchive & archive, const std::filesystem::path & destDir)
 {
     int flags = ARCHIVE_EXTRACT_TIME | ARCHIVE_EXTRACT_SECURE_SYMLINKS | ARCHIVE_EXTRACT_SECURE_NODOTDOT;
@@ -132,24 +161,34 @@ static void extract_archive(TarArchive & archive, const std::filesystem::path &
         int r = archive_read_next_header(archive.archive, &entry);
         if (r == ARCHIVE_EOF)
             break;
-        auto name = archive_entry_pathname(entry);
-        if (!name)
-            throw Error("cannot get archive member name: %s", archive_error_string(archive.archive));
-        if (r == ARCHIVE_WARN)
-            warn("getting archive member '%1%': %2%", name, archive_error_string(archive.archive));
-        else
-            archive.check(r);
 
-        archive_entry_copy_pathname(entry, (destDir / name).string().c_str());
+        const auto relPath = [&]() -> std::filesystem::path {
+            /* Some archives might lack a pathname https://github.com/libarchive/libarchive/issues/2089. */
+            auto * name = NIX_LIBARCHIVE_NATIVE_PATH_FUNC(archive_entry_pathname)(entry);
+            if (!name)
+                throw Error("cannot get archive member name: %s", archive_error_string(archive.archive));
+            if (r == ARCHIVE_WARN)
+                warn(
+                    "getting archive member '%1%': %2%",
+                    os_string_to_string(OsStringView(name)),
+                    archive_error_string(archive.archive));
+            else
+                archive.check(r);
+
+            return std::filesystem::path(name).relative_path();
+        }();
+
+        NIX_LIBARCHIVE_NATIVE_PATH_FUNC(archive_entry_copy_pathname)(entry, (destDir / relPath).c_str());
 
         // sources can and do contain dirs with no rx bits
         if (archive_entry_filetype(entry) == AE_IFDIR && (archive_entry_mode(entry) & 0500) != 0500)
             archive_entry_set_mode(entry, archive_entry_mode(entry) | 0500);
 
         // Patch hardlink path
-        const char * original_hardlink = archive_entry_hardlink(entry);
-        if (original_hardlink) {
-            archive_entry_copy_hardlink(entry, (destDir / original_hardlink).string().c_str());
+        const auto * originalHardlink = NIX_LIBARCHIVE_NATIVE_PATH_FUNC(archive_entry_hardlink)(entry);
+        if (originalHardlink) {
+            auto hardlinkPath = std::filesystem::path(originalHardlink).relative_path();
+            NIX_LIBARCHIVE_NATIVE_PATH_FUNC(archive_entry_copy_hardlink)(entry, (destDir / hardlinkPath).c_str());
         }
 
         archive.check(archive_read_extract(archive.archive, entry, flags));
@@ -158,6 +197,8 @@ static void extract_archive(TarArchive & archive, const std::filesystem::path &
     archive.close();
 }
 
+#undef NIX_LIBARCHIVE_NATIVE_PATH_FUNC
+
 void unpackTarfile(const std::filesystem::path & tarFile, const std::filesystem::path & destDir)
 {
     auto archive = TarArchive(tarFile);
@@ -210,7 +251,7 @@ time_t unpackTarfileToSink(TarArchive & archive, ExtendedFileSystemObjectSink &
                 while (true) {
                     auto n = archive_read_data(archive.archive, buf.data(), buf.size());
                     if (n < 0)
-                        checkLibArchive(archive.archive, n, "cannot read file from tarball: %s");
+                        archive.check(n, "cannot read file from tarball: %s");
                     if (n == 0)
                         break;
                     crf(std::string_view{
diff --git a/src/libutil/tee-logger.cc b/src/libutil/tee-logger.cc
index 8433168a5a82..8e27714e3f40 100644
--- a/src/libutil/tee-logger.cc
+++ b/src/libutil/tee-logger.cc
@@ -2,10 +2,13 @@
 
 namespace nix {
 
-struct TeeLogger : Logger
+namespace {
+
+class TeeLogger final : public Logger
 {
     std::vector<std::unique_ptr<Logger>> loggers;
 
+public:
     TeeLogger(std::vector<std::unique_ptr<Logger>> && loggers)
         : loggers(std::move(loggers))
     {
@@ -94,6 +97,8 @@ struct TeeLogger : Logger
     }
 };
 
+} // namespace
+
 std::unique_ptr<Logger>
 makeTeeLogger(std::unique_ptr<Logger> mainLogger, std::vector<std::unique_ptr<Logger>> && extraLoggers)
 {
diff --git a/src/libutil/thread-pool.cc b/src/libutil/thread-pool.cc
index 9a0a14b1323d..868923694219 100644
--- a/src/libutil/thread-pool.cc
+++ b/src/libutil/thread-pool.cc
@@ -4,6 +4,8 @@
 
 namespace nix {
 
+void ThreadPoolShutDown::anchor() {}
+
 ThreadPool::ThreadPool(size_t _maxThreads)
     : maxThreads(_maxThreads)
 {
diff --git a/src/libutil/union-source-accessor.cc b/src/libutil/union-source-accessor.cc
index de50c75e3733..dd68a2d8838d 100644
--- a/src/libutil/union-source-accessor.cc
+++ b/src/libutil/union-source-accessor.cc
@@ -2,8 +2,14 @@
 
 namespace nix {
 
+namespace {
+
 struct UnionSourceAccessor : SourceAccessor
 {
+private:
+    void anchor() override {};
+
+public:
     std::vector<ref<SourceAccessor>> accessors;
 
     UnionSourceAccessor(std::vector<ref<SourceAccessor>> _accessors)
@@ -69,6 +75,12 @@ struct UnionSourceAccessor : SourceAccessor
         return SourceAccessor::showPath(path);
     }
 
+    void invalidateCache() override
+    {
+        for (auto & accessor : accessors)
+            accessor->invalidateCache();
+    }
+
     std::optional<std::filesystem::path> getPhysicalPath(const CanonPath & path) override
     {
         for (auto & accessor : accessors) {
@@ -90,14 +102,10 @@ struct UnionSourceAccessor : SourceAccessor
         }
         return {path, std::nullopt};
     }
-
-    void invalidateCache(const CanonPath & path) override
-    {
-        for (auto & accessor : accessors)
-            accessor->invalidateCache(path);
-    }
 };
 
+} // namespace
+
 ref<SourceAccessor> makeUnionSourceAccessor(std::vector<ref<SourceAccessor>> && accessors)
 {
     return make_ref<UnionSourceAccessor>(std::move(accessors));
diff --git a/src/libutil/unix/current-process-private.hh b/src/libutil/unix/current-process-private.hh
new file mode 100644
index 000000000000..c5ff790c130f
--- /dev/null
+++ b/src/libutil/unix/current-process-private.hh
@@ -0,0 +1,11 @@
+#pragma once
+
+#include <cstddef>
+
+namespace nix {
+namespace unix {
+
+extern size_t savedStackSize;
+
+} // namespace unix
+} // namespace nix
diff --git a/src/libutil/unix/current-process.cc b/src/libutil/unix/current-process.cc
index eaa2424abcd9..3f0c8180356d 100644
--- a/src/libutil/unix/current-process.cc
+++ b/src/libutil/unix/current-process.cc
@@ -1,5 +1,10 @@
 #include "nix/util/current-process.hh"
+#include "nix/util/environment-variables.hh"
 #include "nix/util/error.hh"
+#include "nix/util/logging.hh"
+
+#include "unix/current-process-private.hh"
+
 #include <cmath>
 
 #include <sys/resource.h>
@@ -20,4 +25,40 @@ std::chrono::microseconds getCpuUserTime()
     return seconds + microseconds;
 }
 
+size_t unix::savedStackSize = 0;
+
+void ensureStackSizeAtLeast(size_t stackSize)
+{
+    struct rlimit limit;
+    if (getrlimit(RLIMIT_STACK, &limit) == 0 && static_cast<size_t>(limit.rlim_cur) < stackSize) {
+        unix::savedStackSize = limit.rlim_cur;
+        if (limit.rlim_max < static_cast<rlim_t>(stackSize)) {
+            if (getEnv("_NIX_TEST_NO_ENVIRONMENT_WARNINGS") != "1") {
+                logger->log(
+                    lvlWarn,
+                    HintFmt(
+                        "Stack size hard limit is %1%, which is less than the desired %2%. If possible, increase the hard limit, e.g. with 'ulimit -Hs %3%'.",
+                        limit.rlim_max,
+                        stackSize,
+                        stackSize / 1024)
+                        .str());
+            }
+        }
+        auto requestedSize = std::min(static_cast<rlim_t>(stackSize), limit.rlim_max);
+        limit.rlim_cur = requestedSize;
+        if (setrlimit(RLIMIT_STACK, &limit) != 0) {
+            logger->log(
+                lvlError,
+                HintFmt(
+                    "Failed to increase stack size from %1% to %2% (desired: %3%, maximum allowed: %4%): %5%",
+                    unix::savedStackSize,
+                    requestedSize,
+                    stackSize,
+                    limit.rlim_max,
+                    std::strerror(errno))
+                    .str());
+        }
+    }
+}
+
 } // namespace nix
diff --git a/src/libutil/unix/file-system-at.cc b/src/libutil/unix/file-system-at.cc
index 762a245ded04..18046ff124d1 100644
--- a/src/libutil/unix/file-system-at.cc
+++ b/src/libutil/unix/file-system-at.cc
@@ -140,20 +140,27 @@ void unix::fchmodatTryNoFollow(Descriptor dirFd, const CanonPath & path, mode_t
     }
 }
 
-static AutoCloseFD
-openFileEnsureBeneathNoSymlinksIterative(Descriptor dirFd, const CanonPath & path, int flags, mode_t mode)
+static AutoCloseFD openFileEnsureBeneathNoSymlinksIterative(
+    Descriptor dirFd,
+    const CanonPath & path,
+    int flags,
+    mode_t mode,
+    std::function<void(AutoCloseFD dirFd, CanonPath relPath)> dirFdCallback)
 {
     AutoCloseFD parentFd;
     auto nrComponents = std::ranges::distance(path);
     assert(nrComponents >= 1);
     auto components = std::views::take(path, nrComponents - 1); /* Everything but last component */
     auto getParentFd = [&]() { return parentFd ? parentFd.get() : dirFd; };
+    auto currentRelPath = CanonPath::root;
 
     /* This rather convoluted loop is necessary to avoid TOCTOU when validating that
        no inner path component is a symlink. */
     for (auto it = components.begin(); it != components.end(); ++it) {
         auto component = std::string(*it);                        /* Copy into a string to make NUL terminated. */
         assert(component != ".." && !component.starts_with('/')); /* In case invariant is broken somehow.. */
+        auto prevRelPath = currentRelPath;
+        currentRelPath = currentRelPath / *it;
 
         AutoCloseFD parentFd2 = ::openat(
             getParentFd(), /* First iteration uses dirFd. */
@@ -181,13 +188,16 @@ openFileEnsureBeneathNoSymlinksIterative(Descriptor dirFd, const CanonPath & pat
                 if (auto st = maybeFstatat(getParentFd(), component); st && S_ISLNK(st->st_mode))
                     throw SymlinkNotAllowed(path2);
                 errno = ENOTDIR; /* Restore the errno. */
-            } else if (errno == ELOOP) {
+            } else if (errno == NIX_ERR_OPEN_SYMLINK) {
                 throw SymlinkNotAllowed(path2);
             }
 
             return AutoCloseFD{};
         }
 
+        if (dirFdCallback && parentFd)
+            dirFdCallback(std::move(parentFd), std::move(prevRelPath));
+
         parentFd = std::move(parentFd2);
     }
 
@@ -195,7 +205,7 @@ openFileEnsureBeneathNoSymlinksIterative(Descriptor dirFd, const CanonPath & pat
     AutoCloseFD res = ::openat(getParentFd(), lastComponent.c_str(), flags | O_NOFOLLOW, mode);
 
     if (!res) {
-        if (errno == ELOOP)
+        if (errno == NIX_ERR_OPEN_SYMLINK)
             throw SymlinkNotAllowed(path);
         /* `O_DIRECTORY | O_NOFOLLOW` on a trailing symlink returns
            `ENOTDIR` rather than `ELOOP`. Post-check via `fstatat` to
@@ -221,7 +231,12 @@ openFileEnsureBeneathNoSymlinksIterative(Descriptor dirFd, const CanonPath & pat
     return res;
 }
 
-AutoCloseFD openFileEnsureBeneathNoSymlinks(Descriptor dirFd, const CanonPath & path, int flags, mode_t mode)
+AutoCloseFD openFileEnsureBeneathNoSymlinks(
+    Descriptor dirFd,
+    const CanonPath & path,
+    int flags,
+    mode_t mode,
+    std::function<void(AutoCloseFD dirFd, CanonPath relPath)> dirFdCallback)
 {
     /* Just in case the invariant is somehow broken. */
     assert(!path.rel().starts_with('/'));
@@ -257,18 +272,17 @@ AutoCloseFD openFileEnsureBeneathNoSymlinks(Descriptor dirFd, const CanonPath &
 
     if (auto maybeFd = linux::openat2(
             dirFd, path.rel_c_str(), flagsAdj, static_cast<uint64_t>(mode), RESOLVE_BENEATH | RESOLVE_NO_SYMLINKS)) {
-        if (!*maybeFd && errno == ELOOP)
+        if (!*maybeFd && errno == NIX_ERR_OPEN_SYMLINK)
             throw SymlinkNotAllowed(path);
         return std::move(*maybeFd);
     }
 #endif
 
-    return openFileEnsureBeneathNoSymlinksIterative(dirFd, path, flags, mode);
+    return openFileEnsureBeneathNoSymlinksIterative(dirFd, path, flags, mode, std::move(dirFdCallback));
 }
 
 OsString readLinkAt(Descriptor dirFd, const CanonPath & path)
 {
-    assert(!path.isRoot());
     assert(!path.rel().starts_with('/')); /* Just in case the invariant is somehow broken. */
     std::vector<char> buf;
     for (ssize_t bufSize = PATH_MAX / 4; true; bufSize += bufSize / 2) {
diff --git a/src/libutil/unix/file-system.cc b/src/libutil/unix/file-system.cc
index 9181f4466e1b..f9417bb7e9d4 100644
--- a/src/libutil/unix/file-system.cc
+++ b/src/libutil/unix/file-system.cc
@@ -211,7 +211,7 @@ static void _deletePath(
                 throw;
             }
 
-        int fd = openat(parentfd, name.rel_c_str(), O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
+        int fd = openat(parentfd, name.rel_c_str(), O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
         if (fd == -1)
             throw SysError("opening directory %1%", PathFmt(path));
         AutoCloseDir dir(fdopendir(fd));
diff --git a/src/libutil/unix/processes.cc b/src/libutil/unix/processes.cc
index ef37aee22602..3544aae365bb 100644
--- a/src/libutil/unix/processes.cc
+++ b/src/libutil/unix/processes.cc
@@ -14,7 +14,6 @@
 #include <future>
 #include <iostream>
 #include <atomic>
-using namespace std::chrono_literals;
 
 #include <grp.h>
 #include <sys/types.h>
@@ -50,11 +49,13 @@ Pid::Pid(pid_t pid)
 }
 
 Pid::~Pid()
-try {
-    if (pid != -1)
-        kill(/*allowInterrupts=*/false);
-} catch (...) {
-    ignoreExceptionInDestructor();
+{
+    try {
+        if (pid != -1)
+            kill(/*allowInterrupts=*/false);
+    } catch (...) {
+        ignoreExceptionInDestructor();
+    }
 }
 
 void Pid::operator=(pid_t pid)
@@ -78,6 +79,8 @@ int Pid::kill(bool allowInterrupts)
 
     std::atomic<bool> killed = false;
 
+    using namespace std::chrono_literals;
+
     if (killTimeout > 0ms && killSignal != SIGKILL)
         killThread = std::thread([&]() {
             auto elapsed = 0ms;
@@ -205,17 +208,9 @@ void killUser(uid_t uid)
 
 using ChildWrapperFunction = fun<void()>;
 
-/* Wrapper around vfork to prevent the child process from clobbering
-   the caller's stack frame in the parent. */
-static pid_t doFork(bool allowVfork, ChildWrapperFunction & fun) __attribute__((noinline));
-
-static pid_t doFork(bool allowVfork, ChildWrapperFunction & fun)
+static pid_t doFork(ChildWrapperFunction & fun)
 {
-#ifdef __linux__
-    pid_t pid = allowVfork ? vfork() : fork();
-#else
     pid_t pid = fork();
-#endif
     if (pid != 0)
         return pid;
     fun();
@@ -233,17 +228,14 @@ static int childEntry(void * arg)
 
 pid_t startProcess(fun<void()> processMain, const ProcessOptions & options)
 {
-    auto newLogger = makeSimpleLogger();
+    auto newLogger = makeSimpleLogger().release();
     ChildWrapperFunction wrapper = [&] {
-        if (!options.allowVfork) {
-            /* Set a simple logger, while releasing (not destroying)
-               the parent logger. We don't want to run the parent
-               logger's destructor since that will crash (e.g. when
-               ~ProgressBar() tries to join a thread that doesn't
-               exist. */
-            logger.release();
-            logger = std::move(newLogger);
-        }
+        /* Set a simple logger, while leaking (not destroying)
+           the parent logger. We don't want to run the parent
+           logger's destructor since that will crash (e.g. when
+           ~ProgressBar() tries to join a thread that doesn't
+           exist. */
+        logger = newLogger;
         try {
 #ifdef __linux__
             if (options.dieWithParent && prctl(PR_SET_PDEATHSIG, SIGKILL) == -1)
@@ -283,7 +275,7 @@ pid_t startProcess(fun<void()> processMain, const ProcessOptions & options)
         throw Error("clone flags are only supported on Linux");
 #endif
     } else
-        pid = doFork(options.allowVfork, wrapper);
+        pid = doFork(wrapper);
 
     if (pid == -1)
         throw SysError("unable to fork");
@@ -307,6 +299,8 @@ std::string runProgram(std::filesystem::path program, bool lookupPath, const OsS
     return res.second;
 }
 
+#ifndef __linux__
+
 void runProgram2(const RunOptions & options)
 {
     checkInterrupt();
@@ -317,10 +311,6 @@ void runProgram2(const RunOptions & options)
         out.create();
 
     ProcessOptions processOptions;
-    // vfork implies that the environment of the main process and the fork will
-    // be shared (technically this is undefined, but in practice that's the
-    // case), so we can't use it if we alter the environment
-    processOptions.allowVfork = !options.environment;
 
     auto suspension = logger->suspendIf(options.isInteractive);
 
@@ -372,6 +362,8 @@ void runProgram2(const RunOptions & options)
         throw ExecError(status, "program %1% %2%", PathFmt(options.program), statusToString(status));
 }
 
+#endif // __linux__
+
 //////////////////////////////////////////////////////////////////////
 
 std::string statusToString(int status)
diff --git a/src/libutil/unix/signals-private.hh b/src/libutil/unix/signals-private.hh
new file mode 100644
index 000000000000..ef2b5cc16f8e
--- /dev/null
+++ b/src/libutil/unix/signals-private.hh
@@ -0,0 +1,12 @@
+#pragma once
+
+#include <signal.h>
+
+namespace nix {
+namespace unix {
+
+extern sigset_t savedSignalMask;
+extern bool savedSignalMaskIsSet;
+
+} // namespace unix
+} // namespace nix
diff --git a/src/libutil/unix/signals.cc b/src/libutil/unix/signals.cc
index 7e425ab09018..3a63276fc771 100644
--- a/src/libutil/unix/signals.cc
+++ b/src/libutil/unix/signals.cc
@@ -5,10 +5,16 @@
 #include "nix/util/sync.hh"
 #include "nix/util/terminal.hh"
 
+#include "unix/signals-private.hh"
+
 #include <thread>
 
 namespace nix {
 
+void Interrupted::anchor() {}
+
+void Cancelled::anchor() {}
+
 std::atomic<bool> unix::_isInterrupted = false;
 
 thread_local std::function<bool()> unix::interruptCheck;
@@ -41,6 +47,8 @@ struct InterruptCallbacks
     std::map<Token, fun<void()>> callbacks;
 };
 
+InterruptCallback::~InterruptCallback() {}
+
 /* Required to avoid static initialization order fiasco. This allows global
    objects to safely register callbacks. */
 static Sync<InterruptCallbacks> & getInterruptCallbacks()
@@ -95,8 +103,8 @@ void unix::triggerInterrupt()
     }
 }
 
-static sigset_t savedSignalMask;
-static bool savedSignalMaskIsSet = false;
+sigset_t unix::savedSignalMask;
+bool unix::savedSignalMaskIsSet = false;
 
 void unix::saveSignalMask()
 {
@@ -145,6 +153,8 @@ void unix::restoreSignals()
         throw SysError("restoring signals");
 }
 
+namespace {
+
 /* RAII helper to automatically deregister a callback. */
 struct InterruptCallbackImpl : InterruptCallback
 {
@@ -167,6 +177,8 @@ struct InterruptCallbackImpl : InterruptCallback
     }
 };
 
+} // namespace
+
 std::unique_ptr<InterruptCallback> createInterruptCallback(fun<void()> callback)
 {
     auto interruptCallbacks(getInterruptCallbacks().lock());
diff --git a/src/libutil/url.cc b/src/libutil/url.cc
index 5e2072afd485..c09c9e09180b 100644
--- a/src/libutil/url.cc
+++ b/src/libutil/url.cc
@@ -12,6 +12,8 @@
 
 namespace nix {
 
+void BadURL::anchor() {}
+
 std::regex refRegex(refRegexS, std::regex::ECMAScript);
 std::regex revRegex(revRegexS, std::regex::ECMAScript);
 
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 8ed058d76112..e6b2fffa25fa 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1,4 +1,5 @@
 #include "nix/util/util.hh"
+#include "nix/util/ref.hh"
 #include "nix/util/fmt.hh"
 #include "nix/util/signals.hh"
 
@@ -15,6 +16,10 @@
 
 namespace nix {
 
+void FormatError::anchor() {}
+
+bad_ref_cast::~bad_ref_cast() {}
+
 void initLibUtil()
 {
     // Check that exception handling works. Exception handling has been observed
@@ -80,14 +85,18 @@ std::string replaceStrings(std::string res, std::string_view from, std::string_v
     return res;
 }
 
-std::string rewriteStrings(std::string s, const StringMap & rewrites)
+std::string
+rewriteStrings(std::string s, const StringMap & rewrites, std::set<uint64_t> * matches, uint64_t offsetShift)
 {
     for (auto & i : rewrites) {
         if (i.first == i.second)
             continue;
         size_t j = 0;
-        while ((j = s.find(i.first, j)) != s.npos)
+        while ((j = s.find(i.first, j)) != s.npos) {
+            if (matches)
+                matches->insert(j + offsetShift);
             s.replace(j, i.first.size(), i.second);
+        }
     }
     return s;
 }
@@ -240,6 +249,10 @@ void ignoreExceptionExceptInterrupt(Verbosity lvl)
         throw;
     } catch (const Interrupted & e) {
         throw;
+    } catch (const Cancelled & e) {
+        /* Morally the same as Interrupted, just not triggered by a user but some other
+           cancellation. */
+        throw;
     } catch (Error & e) {
         printMsg(lvl, ANSI_RED "error (ignored):" ANSI_NORMAL " %s", e.info().msg);
     } catch (std::exception & e) {
diff --git a/src/libutil/windows/file-system-at.cc b/src/libutil/windows/file-system-at.cc
index 668bd7eb402f..54248f2a36ca 100644
--- a/src/libutil/windows/file-system-at.cc
+++ b/src/libutil/windows/file-system-at.cc
@@ -229,7 +229,13 @@ PosixStat fstat(Descriptor fd)
 }
 
 AutoCloseFD openFileEnsureBeneathNoSymlinks(
-    Descriptor dirFd, const CanonPath & path, ACCESS_MASK desiredAccess, ULONG createOptions, ULONG createDisposition)
+    Descriptor dirFd,
+    const CanonPath & path,
+    ACCESS_MASK desiredAccess,
+    ULONG createOptions,
+    ULONG createDisposition,
+    /* FIXME: Actually call this callback. */
+    [[maybe_unused]] std::function<void(AutoCloseFD dirFd, CanonPath relPath)> dirFdCallback)
 {
     assert(!path.isRoot());
     assert(!path.rel().starts_with('/')); /* Just in case the invariant is somehow broken. */
diff --git a/src/libutil/windows/file-system.cc b/src/libutil/windows/file-system.cc
index 98d41a9caa25..2ac2f74f80c1 100644
--- a/src/libutil/windows/file-system.cc
+++ b/src/libutil/windows/file-system.cc
@@ -77,7 +77,7 @@ std::filesystem::path defaultTempDir()
 void deletePath(const std::filesystem::path & path)
 {
     std::error_code ec;
-    std::filesystem::remove_all(path, ec);
+    std::filesystem::remove_all(path, ec); // NOLINT(bugprone-unsafe-functions)
     if (ec && ec != std::errc::no_such_file_or_directory)
         throw SysError(ec.default_error_condition().value(), "recursively deleting %1%", PathFmt(path));
 }
diff --git a/src/libutil/windows/meson.build b/src/libutil/windows/meson.build
index 9aa61e61514f..9f38836b8553 100644
--- a/src/libutil/windows/meson.build
+++ b/src/libutil/windows/meson.build
@@ -9,6 +9,7 @@ sources += files(
   'muxable-pipe.cc',
   'os-string.cc',
   'processes.cc',
+  'signals.cc',
   'users.cc',
   'windows-async-pipe.cc',
   'windows-environment.cc',
diff --git a/src/libutil/windows/signals.cc b/src/libutil/windows/signals.cc
new file mode 100644
index 000000000000..40fe5eeb63c4
--- /dev/null
+++ b/src/libutil/windows/signals.cc
@@ -0,0 +1,9 @@
+#include "nix/util/signals.hh"
+
+namespace nix {
+
+void Interrupted::anchor() {}
+
+void Cancelled::anchor() {}
+
+} // namespace nix
diff --git a/src/libutil/windows/windows-error.cc b/src/libutil/windows/windows-error.cc
index 85fcc1c1e50b..2872a0c957b7 100644
--- a/src/libutil/windows/windows-error.cc
+++ b/src/libutil/windows/windows-error.cc
@@ -6,6 +6,8 @@
 
 namespace nix::windows {
 
+void windows::WinError::anchor() {}
+
 std::string WinError::renderError(DWORD lastError)
 {
     LPSTR errorText = NULL;
diff --git a/src/nix/add-to-store.cc b/src/nix/add-to-store.cc
index 4f0fe722f197..fecbc242ef5e 100644
--- a/src/nix/add-to-store.cc
+++ b/src/nix/add-to-store.cc
@@ -1,7 +1,10 @@
 #include "nix/cmd/command.hh"
 #include "nix/main/common-args.hh"
 #include "nix/store/store-api.hh"
-#include "nix/util/posix-source-accessor.hh"
+#include "nix/util/source-accessor.hh"
+#include "nix/store/store-cast.hh"
+#include "nix/store/submit-store.hh"
+#include "nix/util/file-system.hh"
 #include "nix/cmd/misc-store-flags.hh"
 
 namespace nix {
@@ -12,6 +15,7 @@ struct CmdAddToStore : MixDryRun, StoreCommand
     std::optional<std::string> namePart;
     ContentAddressMethod caMethod = ContentAddressMethod::Raw::NixArchive;
     HashAlgorithm hashAlgo = HashAlgorithm::SHA256;
+    bool scan = false;
 
     CmdAddToStore()
     {
@@ -29,18 +33,49 @@ struct CmdAddToStore : MixDryRun, StoreCommand
         addFlag(flag::contentAddressMethod(&caMethod));
 
         addFlag(flag::hashAlgo(&hashAlgo));
+
+        addFlag({
+            .longName = "scan",
+            .description = "Scan for references. Only works within a `recursive-nix` derivation builder.",
+            .handler = {&scan, true},
+        });
     }
 
     void run(ref<Store> store) override
     {
+        // Although this would be convenient, if we are scanning then we are connecting to a daemon.
+        // A dry-run scan would require either daemon-support for scanning a path for references
+        // or listing referenceable paths, both of which come with downsides.
+        if (dryRun && scan)
+            throw UsageError("Cannot dry-run while scanning");
+
         if (!namePart)
             namePart = path.filename().string();
 
-        auto sourcePath = PosixSourceAccessor::createAtRoot(makeParentCanonical(path));
-
-        auto storePath = dryRun ? store->computeStorePath(*namePart, sourcePath, caMethod, hashAlgo, {}).first
-                                : store->addToStoreSlow(*namePart, sourcePath, caMethod, hashAlgo, {}).path;
-
+        auto sourcePath = makeFSSourceAccessor(absPath(path));
+
+        auto storePath = ([&]() {
+            if (scan) {
+                auto & submitStore = require<SubmitStore>(*store);
+
+                auto serialisationMethod = caMethod.getFileSerialisationMethod();
+
+                std::optional<StorePath> storePath;
+                auto sink = sourceToSink([&](Source & source) {
+                    auto info =
+                        submitStore.addToStoreScanning(source, *namePart, serialisationMethod, caMethod, hashAlgo);
+                    storePath = info->path;
+                });
+                dumpPath(sourcePath, *sink, serialisationMethod, defaultPathFilter);
+                sink->finish();
+
+                return storePath.value();
+            } else if (dryRun) {
+                return store->computeStorePath(*namePart, sourcePath, caMethod, hashAlgo, {}).first;
+            } else {
+                return store->addToStoreSlow(*namePart, sourcePath, caMethod, hashAlgo, {}).path;
+            }
+        })();
         logger->cout("%s", store->printStorePath(storePath));
     }
 };
@@ -49,7 +84,7 @@ struct CmdAdd : CmdAddToStore
 {
     std::string description() override
     {
-        return "Add a file or directory to the Nix store";
+        return "add a file or directory to the Nix store";
     }
 
     std::string doc() override
diff --git a/src/nix/app.cc b/src/nix/app.cc
index 634db04f3fe1..167ffd8d86f8 100644
--- a/src/nix/app.cc
+++ b/src/nix/app.cc
@@ -95,6 +95,8 @@ UnresolvedApp InstallableValue::toApp(EvalState & state)
                     c.raw));
         }
 
+        state.ensureLazyPathsCopied(context);
+
         return UnresolvedApp{App{
             .context = std::move(context2),
             .program = program,
diff --git a/src/nix/build-remote/build-remote.cc b/src/nix/build-remote/build-remote.cc
index e5ebf948d7e2..8c52d2556973 100644
--- a/src/nix/build-remote/build-remote.cc
+++ b/src/nix/build-remote/build-remote.cc
@@ -21,6 +21,7 @@
 #include "nix/util/strings.hh"
 #include "nix/store/derivations.hh"
 #include "nix/store/local-store.hh"
+#include "nix/store/build.hh"
 #include "nix/cmd/legacy.hh"
 #include "nix/util/experimental-features.hh"
 #include "nix/store/globals.hh"
@@ -70,7 +71,7 @@ static int main_build_remote(int argc, char ** argv)
         if (pthread_sigmask(SIG_UNBLOCK, &set, nullptr))
             throw SysError("unblocking SIGTERM");
 
-        logger = makeJSONLogger(getStandardError());
+        logger = makeJSONLogger(getStandardError()).release();
 
         /* Ensure we don't get any SSH passphrase or host key popups. */
         unsetenv("DISPLAY");
@@ -300,15 +301,10 @@ static int main_build_remote(int argc, char ** argv)
             signal(SIGALRM, old);
         }
 
-        auto substitute = settings.getWorkerSettings().buildersUseSubstitutes ? Substitute : NoSubstitute;
-
-        {
-            Activity act(*logger, lvlTalkative, actUnknown, fmt("copying dependencies to '%s'", storeUri));
-            copyPaths(*store, *sshStore, store->parseStorePathSet(inputs), NoRepair, NoCheckSigs, substitute);
-        }
-
         uploadLock = -1;
 
+        auto inputPaths = store->parseStorePathSet(inputs);
+
         auto drv = store->readDerivation(*drvPath);
 
         std::optional<BuildResult> optResult;
@@ -327,18 +323,26 @@ static int main_build_remote(int argc, char ** argv)
         // This condition mirrors that: that code enforces the "rules" outlined there;
         // we do the best we can given those "rules".
         if (trustedOrLegacy || drv.type().isCA()) {
-            // Hijack the inputs paths of the derivation to include all
-            // the paths that come from the `inputDrvs` set. We don’t do
-            // that for the derivations whose `inputDrvs` is empty
-            // because:
-            //
-            // 1. It’s not needed
-            //
-            // 2. Changing the `inputSrcs` set changes the associated
-            //    output ids, which break CA derivations
-            if (!drv.inputDrvs.map.empty())
-                drv.inputSrcs = store->parseStorePathSet(inputs);
-            optResult = sshStore->buildDerivation(*drvPath, static_cast<const BasicDerivation &>(drv));
+            BasicDerivation resolvedDrv{
+                .outputs = drv.outputs,
+                // Hijack the inputs paths of the derivation to include
+                // all the paths that come from the `inputDrvs` set. We
+                // don’t do that for the derivations whose `inputDrvs`
+                // is empty because:
+                //
+                // 1. It’s not needed
+                //
+                // 2. Changing the `inputSrcs` set changes the
+                //    associated output ids, which break CA derivations
+                .inputs = drv.inputs.drvs.map.empty() ? drv.inputs.srcs : inputPaths,
+                .platform = drv.platform,
+                .builder = drv.builder,
+                .args = drv.args,
+                .env = drv.env,
+                .structuredAttrs = drv.structuredAttrs,
+                .name = drv.name,
+            };
+            optResult = sshStore->getBuilder()->buildDerivation(*drvPath, resolvedDrv, inputPaths);
             auto & result = *optResult;
             if (auto * failureP = result.tryGetFailure()) {
                 if (settings.keepFailed) {
@@ -352,11 +356,14 @@ static int main_build_remote(int argc, char ** argv)
                     "build of '%s' on '%s' failed: %s", store->printStorePath(*drvPath), storeUri, failureP->message());
             }
         } else {
-            copyClosure(*store, *sshStore, StorePathSet{*drvPath}, NoRepair, NoCheckSigs, substitute);
-            auto res = sshStore->buildPathsWithResults({DerivedPath::Built{
-                .drvPath = makeConstantStorePathRef(*drvPath),
-                .outputs = OutputsSpec::All{},
-            }});
+            auto inputPathsWithDrv = inputPaths;
+            store->computeFSClosure(*drvPath, inputPathsWithDrv);
+            auto res = sshStore->getBuilder()->buildPathsWithResults(
+                {DerivedPath::Built{
+                    .drvPath = makeConstantStorePathRef(*drvPath),
+                    .outputs = OutputsSpec::All{},
+                }},
+                inputPathsWithDrv);
             // One path to build should produce exactly one build result
             assert(res.size() == 1);
             optResult = std::move(res[0]);
diff --git a/src/nix/realisation.cc b/src/nix/build-trace.cc
similarity index 50%
rename from src/nix/realisation.cc
rename to src/nix/build-trace.cc
index 129f06f6c5de..00f22b78ee41 100644
--- a/src/nix/realisation.cc
+++ b/src/nix/build-trace.cc
@@ -1,41 +1,49 @@
 #include "nix/cmd/command.hh"
 #include "nix/main/common-args.hh"
+#include "nix/store/gc-store.hh"
+#include "nix/store/store-cast.hh"
 
 #include <nlohmann/json.hpp>
+#include <ranges>
 
 namespace nix {
 
-struct CmdRealisation : NixMultiCommand
+struct CmdBuildTrace : NixMultiCommand
 {
-    CmdRealisation()
-        : NixMultiCommand("realisation", RegisterCommand::getCommandsFor({"realisation"}))
+    CmdBuildTrace()
+        : NixMultiCommand("build-trace", RegisterCommand::getCommandsFor({"store", "build-trace"}))
     {
     }
 
     std::string description() override
     {
-        return "manipulate a Nix realisation";
+        return "manipulate a Nix build trace";
     }
 
     Category category() override
     {
         return catUtility;
     }
+
+    std::optional<ExperimentalFeature> experimentalFeature() override
+    {
+        return Xp::CaDerivations;
+    }
 };
 
-static auto rCmdRealisation = registerCommand<CmdRealisation>("realisation");
+static auto rCmdBuildTrace = registerCommand2<CmdBuildTrace>({"store", "build-trace"});
 
-struct CmdRealisationInfo : BuiltPathsCommand, MixJSON
+struct CmdBuildTraceInfo : BuiltPathsCommand, MixJSON
 {
     std::string description() override
     {
-        return "query information about one or several realisations";
+        return "query information about one or several build traces";
     }
 
     std::string doc() override
     {
         return
-#include "realisation/info.md"
+#include "build-trace/info.md"
             ;
     }
 
@@ -46,7 +54,6 @@ struct CmdRealisationInfo : BuiltPathsCommand, MixJSON
 
     void run(ref<Store> store, BuiltPaths && paths, BuiltPaths && rootPaths) override
     {
-        experimentalFeatureSettings.require(Xp::CaDerivations);
         RealisedPath::Set realisations;
 
         for (auto & builtPath : paths) {
@@ -77,6 +84,48 @@ struct CmdRealisationInfo : BuiltPathsCommand, MixJSON
     }
 };
 
-static auto rCmdRealisationInfo = registerCommand2<CmdRealisationInfo>({"realisation", "info"});
+static auto rCmdBuildTraceInfo = registerCommand2<CmdBuildTraceInfo>({"store", "build-trace", "info"});
+
+struct CmdBuildTraceDelete : virtual StoreCommand
+{
+    std::vector<std::string> ids;
+
+    CmdBuildTraceDelete()
+    {
+        expectArgs({
+            .label = "id",
+            .handler = {&ids},
+        });
+    }
+
+    std::string description() override
+    {
+        return "delete build traces from the store";
+    }
+
+    std::string doc() override
+    {
+        return
+#include "build-trace/delete.md"
+            ;
+    }
+
+    Category category() override
+    {
+        return catSecondary;
+    }
+
+    void run(ref<Store> store) override
+    {
+        auto & gcStore = require<GcStore>(*store);
+
+        auto keys = ids | std::views::transform([&](std::string_view s) { return DrvOutput::parse(*store, s); })
+                    | std::ranges::to<std::set>();
+
+        gcStore.deleteBuildTraces(keys);
+    }
+};
+
+static auto rCmdBuildTraceDelete = registerCommand2<CmdBuildTraceDelete>({"store", "build-trace", "delete"});
 
 } // namespace nix
diff --git a/src/nix/build-trace/delete.md b/src/nix/build-trace/delete.md
new file mode 100644
index 000000000000..6200a06daa80
--- /dev/null
+++ b/src/nix/build-trace/delete.md
@@ -0,0 +1,14 @@
+R"MdBoundary(
+# Description
+
+Delete build traces from the store.
+
+# Examples
+
+Delete a build trace by its ID:
+
+```console
+$ nix store build-trace delete /nix/store/wfyy9qiwph8zxk68g4p71nrxi0k59x5y-python3-minimal-3.13.12.drv^debug
+```
+
+)MdBoundary"
diff --git a/src/nix/realisation/info.md b/src/nix/build-trace/info.md
similarity index 56%
rename from src/nix/realisation/info.md
rename to src/nix/build-trace/info.md
index 8aa986516f73..aa05721976c4 100644
--- a/src/nix/realisation/info.md
+++ b/src/nix/build-trace/info.md
@@ -1,14 +1,14 @@
 R"MdBoundary(
 # Description
 
-Display some information about the given realisation
+Display some information about the given build trace
 
 # Examples
 
-Show some information about the realisation of the `hello` package:
+Show some information about the build trace of the `hello` package:
 
 ```console
-$ nix realisation info nixpkgs#hello --json
+$ nix store build-trace info nixpkgs#hello --json
 [{"id":"sha256:3d382378a00588e064ee30be96dd0fa7e7df7cf3fbcace85a0e7b7dada1eef25!out","outPath":"fd3m7xawvrqcg98kgz5hc2vk3x9q0lh7-hello"}]
 ```
 
diff --git a/src/nix/build.cc b/src/nix/build.cc
index 4677f325fbf9..435872b60326 100644
--- a/src/nix/build.cc
+++ b/src/nix/build.cc
@@ -1,4 +1,5 @@
 #include "nix/cmd/command.hh"
+#include "nix/cmd/installables.hh"
 #include "nix/main/common-args.hh"
 #include "nix/main/shared.hh"
 #include "nix/store/store-api.hh"
@@ -105,19 +106,12 @@ builtPathsWithResultToJSON(const std::vector<BuiltPathWithResult> & buildables,
     return res;
 }
 
-struct CmdBuild : InstallablesCommand, MixOutLinkByDefault, MixDryRun, MixJSON, MixProfile
+struct CmdBuild : InstallablesCommand, MixOutLinkByDefault, MixDryRun, MixJSON, MixProfile, MixPrintOutPaths
 {
-    bool printOutputPaths = false;
     BuildMode buildMode = bmNormal;
 
     CmdBuild()
     {
-        addFlag({
-            .longName = "print-out-paths",
-            .description = "Print the resulting output paths",
-            .handler = {&printOutputPaths, true},
-        });
-
         addFlag({
             .longName = "rebuild",
             .description = "Rebuild an already built package and compare the result to the existing store paths.",
@@ -160,23 +154,11 @@ struct CmdBuild : InstallablesCommand, MixOutLinkByDefault, MixDryRun, MixJSON,
         if (json)
             logger->cout("%s", builtPathsWithResultToJSON(buildables, *store).dump());
 
-        createOutLinksMaybe(buildables, store);
-
-        if (printOutputPaths) {
-            logger->stop();
-            for (auto & buildable : buildables) {
-                std::visit(
-                    overloaded{
-                        [&](const BuiltPath::Opaque & bo) { logger->cout(store->printStorePath(bo.path)); },
-                        [&](const BuiltPath::Built & bfd) {
-                            for (auto & output : bfd.outputs) {
-                                logger->cout(store->printStorePath(output.second));
-                            }
-                        },
-                    },
-                    buildable.path.raw());
-            }
-        }
+        auto builtPaths = toBuiltPaths(buildables);
+
+        createOutLinksMaybe(builtPaths, store);
+
+        printOutPathsMaybe(builtPaths, store);
 
         BuiltPaths buildables2;
         for (auto & b : buildables)
diff --git a/src/nix/bundle.cc b/src/nix/bundle.cc
index 4808a2fc716f..80dfeebb99a1 100644
--- a/src/nix/bundle.cc
+++ b/src/nix/bundle.cc
@@ -2,6 +2,7 @@
 #include "nix/cmd/command-installable-value.hh"
 #include "nix/main/shared.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/build.hh"
 #include "nix/store/local-fs-store.hh"
 #include "nix/expr/eval-inline.hh"
 #include "nix/store/globals.hh"
@@ -111,7 +112,7 @@ struct CmdBundle : InstallableValueCommand
 
         auto outPath = evalState->coerceToStorePath(attr2->pos, *attr2->value, context2, "");
 
-        store->buildPaths({
+        store->getBuilder()->buildPaths({
             DerivedPath::Built{
                 .drvPath = makeConstantStorePathRef(drvPath),
                 .outputs = OutputsSpec::All{},
diff --git a/src/nix/cat.cc b/src/nix/cat.cc
index a68285efba4b..c6a018adca22 100644
--- a/src/nix/cat.cc
+++ b/src/nix/cat.cc
@@ -92,6 +92,8 @@ struct CmdCatNar : StoreCommand, MixCat
                 struct : CreateRegularFileSink, FdSink
                 {
                     void isExecutable() override {}
+
+                    void anchor() override {}
                 } crfSink;
 
                 crfSink.fd = INVALID_DESCRIPTOR;
diff --git a/src/nix/derivation-add.cc b/src/nix/derivation-add.cc
index def1d7158c92..132e4a8d31ae 100644
--- a/src/nix/derivation-add.cc
+++ b/src/nix/derivation-add.cc
@@ -15,7 +15,7 @@ struct CmdAddDerivation : MixDryRun, StoreCommand
 {
     std::string description() override
     {
-        return "Add a store derivation";
+        return "add a store derivation";
     }
 
     std::string doc() override
diff --git a/src/nix/derivation.cc b/src/nix/derivation.cc
index 98f41d77361f..c894a3ae4d2a 100644
--- a/src/nix/derivation.cc
+++ b/src/nix/derivation.cc
@@ -11,7 +11,7 @@ struct CmdDerivation : NixMultiCommand
 
     std::string description() override
     {
-        return "Work with derivations, Nix's notion of a build plan.";
+        return "work with derivations";
     }
 
     Category category() override
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index 50b248bcb884..169c050e89e2 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -5,6 +5,7 @@
 #include "nix/main/common-args.hh"
 #include "nix/main/shared.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/build.hh"
 #include "nix/store/globals.hh"
 #include "nix/store/outputs-spec.hh"
 #include "nix/store/outputs-query.hh"
@@ -219,9 +220,9 @@ struct BuildEnvironment
     }
 };
 
-const static std::string getEnvSh =
-#include "get-env.sh.gen.hh"
-    ;
+static constexpr char getEnvSh[] = {
+#embed "get-env.sh"
+};
 
 /**
  * Given an existing derivation, return the shell environment as
@@ -239,7 +240,7 @@ static StorePath getDerivationEnvironment(ref<Store> store, ref<Store> evalStore
         throw Error("'nix develop' only works on derivations that use 'bash' as their builder");
 
     auto getEnvShPath = ({
-        StringSource source{getEnvSh};
+        StringSource source{std::string_view(getEnvSh, sizeof(getEnvSh))};
         evalStore->addToStoreFromDump(
             source,
             "get-env.sh",
@@ -267,7 +268,7 @@ static StorePath getDerivationEnvironment(ref<Store> store, ref<Store> evalStore
        'buildDerivation', but that's privileged. */
     drv.name += "-env";
     drv.env.emplace("name", drv.name);
-    drv.inputSrcs.insert(std::move(getEnvShPath));
+    drv.inputs.srcs.insert(std::move(getEnvShPath));
     for (auto & [outputName, output] : drv.outputs) {
         std::visit(
             overloaded{
@@ -290,21 +291,19 @@ static StorePath getDerivationEnvironment(ref<Store> store, ref<Store> evalStore
     auto shellDrvPath = evalStore->writeDerivation(drv);
 
     /* Build the derivation. */
-    store->buildPaths(
+    store->getBuilder(evalStore)->buildPaths(
         {DerivedPath::Built{
             .drvPath = makeConstantStorePathRef(shellDrvPath),
             .outputs = OutputsSpec::All{},
         }},
-        bmNormal,
-        evalStore);
+        bmNormal);
 
     // `get-env.sh` will write its JSON output to an arbitrary output
     // path, so return the first non-empty output path.
-    for (auto & [_0, optPath] : deepQueryPartialDerivationOutputMap(*evalStore, shellDrvPath)) {
-        assert(optPath);
-        auto accessor = evalStore->requireStoreObjectAccessor(*optPath);
+    for (auto & [_0, path] : deepQueryDerivationOutputMap(*evalStore, shellDrvPath)) {
+        auto accessor = evalStore->requireStoreObjectAccessor(path);
         if (auto st = accessor->maybeLstat(CanonPath::root); st && st->fileSize.value_or(0))
-            return *optPath;
+            return path;
     }
 
     throw Error("get-env.sh failed to produce an environment");
@@ -605,7 +604,13 @@ struct CmdDevelop : Common, MixEnvironment
             // FIXME: foundMakefile is set by buildPhase, need to get
             // rid of that.
             script += fmt("foundMakefile=1\n");
-            script += fmt("runHook %1%Phase\n", *phase);
+            script +=
+                fmt("if declare -f runPhase >/dev/null; then\n"
+                    "  runPhase %1%Phase\n"
+                    "else\n"
+                    "  runHook %1%Phase\n"
+                    "fi\n",
+                    *phase);
         }
 
         else if (!command.empty()) {
diff --git a/src/nix/dump-path.cc b/src/nix/dump-path.cc
index 25129487786b..f21374c62337 100644
--- a/src/nix/dump-path.cc
+++ b/src/nix/dump-path.cc
@@ -61,7 +61,7 @@ struct CmdDumpPath2 : Command
     void run() override
     {
         auto sink = getNarSink();
-        dumpPath(path.string(), sink);
+        dumpPath(path, sink);
         sink.flush();
     }
 };
diff --git a/src/nix/eval.cc b/src/nix/eval.cc
index ed6fe41be655..6b8c0ba12234 100644
--- a/src/nix/eval.cc
+++ b/src/nix/eval.cc
@@ -83,10 +83,10 @@ struct CmdEval : MixJSON, InstallableValueCommand, MixReadOnlyOption
 
             [&](this const auto & recurse, Value & v, const PosIdx pos, const std::filesystem::path & path) -> void {
                 state->forceValue(v, pos);
-                if (v.type() == nString)
-                    // FIXME: disallow strings with contexts?
+                if (v.type() == nString) {
+                    copyContext(v, context);
                     writeFile(path, v.string_view());
-                else if (v.type() == nAttrs) {
+                } else if (v.type() == nAttrs) {
                     [[maybe_unused]] bool directoryCreated = std::filesystem::create_directory(path);
                     // Directory should not already exist
                     assert(directoryCreated);
@@ -110,9 +110,8 @@ struct CmdEval : MixJSON, InstallableValueCommand, MixReadOnlyOption
 
         else if (raw) {
             logger->stop();
-            writeFull(
-                getStandardOutput(),
-                *state->coerceToString(noPos, *v, context, "while generating the eval command output"));
+            auto string = state->coerceToString(noPos, *v, context, "while generating the eval command output");
+            writeFull(getStandardOutput(), *string);
         }
 
         else if (json) {
@@ -120,8 +119,11 @@ struct CmdEval : MixJSON, InstallableValueCommand, MixReadOnlyOption
         }
 
         else {
-            logger->cout("%s", ValuePrinter(*state, *v, PrintOptions{.force = true, .derivationPaths = true}));
+            ValuePrinter printer(*state, *v, PrintOptions{.force = true, .derivationPaths = true}, &context);
+            logger->cout("%s", printer);
         }
+
+        state->ensureLazyPathsCopied(context);
     }
 };
 
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 42de78453451..c0dd33822058 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -1,3 +1,4 @@
+#include "nix/cmd/command.hh"
 #include "nix/cmd/common-eval-args.hh"
 #include "nix/main/common-args.hh"
 #include "nix/main/shared.hh"
@@ -5,8 +6,10 @@
 #include "nix/expr/eval-inline.hh"
 #include "nix/expr/eval-settings.hh"
 #include "nix/expr/get-drvs.hh"
+#include "nix/store/derived-path.hh"
 #include "nix/util/os-string.hh"
 #include "nix/util/signals.hh"
+#include "nix/util/mounted-source-accessor.hh"
 #include "nix/store/store-open.hh"
 #include "nix/store/derivations.hh"
 #include "nix/store/outputs-spec.hh"
@@ -19,6 +22,7 @@
 #include "nix/util/users.hh"
 #include "nix/fetchers/fetch-to-store.hh"
 #include "nix/store/local-fs-store.hh"
+#include "nix/store/build.hh"
 #include "nix/store/globals.hh"
 
 #include <filesystem>
@@ -215,8 +219,10 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
         auto lockedFlake = lockFlake();
         auto & flake = lockedFlake.flake;
 
-        // Currently, all flakes are in the Nix store via the rootFS accessor.
-        auto storePath = store->printStorePath(store->toStorePath(flake.path.path.abs()).first);
+        /* Flakes do not get copied to the store, but are instead mounted at
+           their expected store paths in storeFS. Querying metadata does not
+           force copying to the store, as one would expect. */
+        auto storePath = store->toStorePath(flake.path.path.abs()).first;
 
         if (json) {
             nlohmann::json j;
@@ -238,7 +244,7 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
                 j["revCount"] = *revCount;
             if (auto lastModified = flake.lockedRef.input.getLastModified())
                 j["lastModified"] = *lastModified;
-            j["path"] = storePath;
+            j["path"] = store->printStorePath(storePath);
             j["locks"] = lockedFlake.lockFile.toJSON().first;
             if (auto fingerprint = lockedFlake.getFingerprint(*store, fetchSettings))
                 j["fingerprint"] = fingerprint->to_string(HashFormat::Base16, false);
@@ -249,7 +255,7 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
                 logger->cout(ANSI_BOLD "Locked URL:" ANSI_NORMAL "    %s", flake.lockedRef.to_string());
             if (flake.description)
                 logger->cout(ANSI_BOLD "Description:" ANSI_NORMAL "   %s", *flake.description);
-            logger->cout(ANSI_BOLD "Path:" ANSI_NORMAL "          %s", storePath);
+            logger->cout(ANSI_BOLD "Path:" ANSI_NORMAL "          %s", store->printStorePath(storePath));
             if (auto rev = flake.lockedRef.input.getRev())
                 logger->cout(ANSI_BOLD "Revision:" ANSI_NORMAL "      %s", rev->to_string(HashFormat::Base16, false));
             if (auto dirtyRev = fetchers::maybeGetStrAttr(flake.lockedRef.toAttrs(), "dirtyRev"))
@@ -270,9 +276,7 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
             std::set<ref<flake::Node>> visited{lockedFlake.lockFile.root};
 
             [&](this const auto & recurse, const flake::Node & node, const std::string & prefix) -> void {
-                for (const auto & [i, input] : enumerate(node.inputs)) {
-                    bool last = i + 1 == node.inputs.size();
-
+                for (const auto & [last, input] : markLast(node.inputs)) {
                     if (auto lockedNode = std::get_if<0>(&input.second)) {
                         std::string lastModifiedStr = "";
                         if (auto lastModified = (*lockedNode)->lockedRef.input.getLastModified())
@@ -310,12 +314,13 @@ struct CmdFlakeInfo : CmdFlakeMetadata
     }
 };
 
-struct CmdFlakeCheck : FlakeCommand
+struct CmdFlakeCheck : FlakeCommand, MixPrintOutPaths, MixOutLinkBase
 {
     bool build = true;
     bool checkAllSystems = false;
 
     CmdFlakeCheck()
+        : MixOutLinkBase(std::nullopt)
     {
         addFlag({
             .longName = "no-build",
@@ -327,6 +332,15 @@ struct CmdFlakeCheck : FlakeCommand
             .description = "Check the outputs for all systems.",
             .handler = {&checkAllSystems, true},
         });
+        addFlag({
+            .longName = "out-link",
+            .shortName = 'o',
+            .description =
+                "Use *path* as prefix for the symlinks to the check results. By default, no out links are created.",
+            .labels = {"path"},
+            .handler = {&outLink},
+            .completer = completePath,
+        });
     }
 
     std::string description() override
@@ -517,7 +531,7 @@ struct CmdFlakeCheck : FlakeCommand
         auto checkNixOSConfiguration = [&](const std::string & attrPath, Value & v, const PosIdx pos) {
             try {
                 Activity act(*logger, lvlInfo, actUnknown, fmt("checking NixOS configuration '%s'", attrPath));
-                Bindings & bindings = Bindings::emptyBindings;
+                const Bindings & bindings = Bindings::emptyBindings;
                 auto vToplevel = findAlongAttrPath(*state, "config.system.build.toplevel", bindings, v).first;
                 state->forceValue(*vToplevel, pos);
                 if (!state->isDerivation(*vToplevel))
@@ -783,6 +797,7 @@ struct CmdFlakeCheck : FlakeCommand
             });
         }
 
+        std::vector<KeyedBuildResult> results;
         if (build && !attrPathsByDrv.empty()) {
             auto keys = std::views::keys(attrPathsByDrv);
             std::vector<DerivedPath> drvPaths(keys.begin(), keys.end());
@@ -809,7 +824,8 @@ struct CmdFlakeCheck : FlakeCommand
             }
 
             Activity act(*logger, lvlInfo, actUnknown, fmt("running %d flake checks", toBuild.size()));
-            auto results = store->buildPathsWithResults(toBuild);
+            // once we get rid of the temporary hack above, this tenary operator will also go away
+            results = store->getBuilder()->buildPathsWithResults((printOutputPaths || outLink) ? drvPaths : toBuild);
 
             // Report build failures with attribute paths
             for (auto & result : results) {
@@ -843,6 +859,14 @@ struct CmdFlakeCheck : FlakeCommand
                 "Use '--all-systems' to check all.",
                 concatStringsSep(", ", omittedSystems));
         };
+
+        auto builtPaths =
+            results | std::views::transform([&](auto & result) { return toBuiltPath(result, getEvalStore(), store); })
+            | std::ranges::to<BuiltPaths>();
+
+        printOutPathsMaybe(builtPaths, store);
+
+        createOutLinksMaybe(builtPaths, store);
     };
 };
 
@@ -1090,29 +1114,34 @@ struct CmdFlakeArchive : FlakeCommand, MixJSON, MixDryRun, MixNoCheckSigs
 
         StorePathSet sources;
 
-        auto storePath = store->toStorePath(flake.flake.path.path.abs()).first;
+        auto getStorePath = [&](const FlakeRef & lockedRef) {
+            return dryRun ? lockedRef.input.computeStorePath(*store)
+                          : std::get<StorePath>(lockedRef.input.fetchToStore(fetchSettings, *store));
+        };
+
+        auto storePath = getStorePath(flake.flake.lockedRef);
 
         sources.insert(storePath);
 
         // FIXME: use graph output, handle cycles.
-        std::function<nlohmann::json(const flake::Node & node)> traverse;
-        traverse = [&](const flake::Node & node) {
+        auto traverse = [&store, json = json, &sources, &getStorePath](
+                            this const auto & self, const flake::Node & node) -> nlohmann::json {
             nlohmann::json jsonObj2 = json ? nlohmann::json::object() : nlohmann::json(nullptr);
             for (auto & [inputName, input] : node.inputs) {
                 if (auto inputNode = std::get_if<0>(&input)) {
                     std::optional<StorePath> storePath;
-                    if (!(*inputNode)->lockedRef.input.isRelative()) {
-                        storePath = dryRun ? (*inputNode)->lockedRef.input.computeStorePath(*store)
-                                           : (*inputNode)->lockedRef.input.fetchToStore(fetchSettings, *store).first;
+                    const auto & lockedRef = (*inputNode)->lockedRef;
+                    if (!lockedRef.input.isRelative()) {
+                        storePath = getStorePath(lockedRef);
                         sources.insert(*storePath);
                     }
                     if (json) {
                         auto & jsonObj3 = jsonObj2[inputName];
                         if (storePath)
                             jsonObj3["path"] = store->printStorePath(*storePath);
-                        jsonObj3["inputs"] = traverse(**inputNode);
+                        jsonObj3["inputs"] = self(**inputNode);
                     } else
-                        traverse(**inputNode);
+                        self(**inputNode);
                 }
             }
             return jsonObj2;
@@ -1240,7 +1269,7 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
 
             auto attrPathS = attrPath.resolve(*state);
 
-            Activity act(*logger, lvlInfo, actUnknown, fmt("evaluating '%s'", attrPath.to_string(*state)));
+            Activity act(*logger, lvlTalkative, actUnknown, fmt("evaluating '%s'", attrPath.to_string(*state)));
 
             try {
                 auto recurse = [&]() {
@@ -1252,9 +1281,8 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
                             attrs.push_back(attr);
                     }
 
-                    for (const auto & [i, attr] : enumerate(attrs)) {
+                    for (const auto & [last, attr] : markLast(attrs)) {
                         const auto & attrName = state->symbols[attr];
-                        bool last = i + 1 == attrs.size();
                         auto visitor2 = visitor.getAttr(attrName);
                         auto attrPath2(attrPath);
                         attrPath2.push_back(attr);
diff --git a/src/nix/flake.md b/src/nix/flake.md
index 88d0e1be58a0..a54568e774c0 100644
--- a/src/nix/flake.md
+++ b/src/nix/flake.md
@@ -140,7 +140,7 @@ The following generic flake reference attributes are supported:
 
 * `narHash`: The hash of the
   [Nix Archive (NAR) serialisation][Nix Archive]
-  (in SRI format) of the
+  (in [SRI](@docroot@/glossary.md#gloss-sri) format) of the
   contents of the flake. This is useful for flake types such as
   tarballs that lack a unique content identifier such as a Git commit
   hash.
@@ -455,7 +455,7 @@ The following attributes are supported in `flake.nix`:
   * `lastModified`: The commit time of the revision `rev` as an integer
     denoting the number of seconds since 1970.
 
-  * `narHash`: The SHA-256 (in SRI format) of the
+  * `narHash`: The SHA-256 (in [SRI](@docroot@/glossary.md#gloss-sri) format) of the
     [Nix Archive (NAR) serialisation][Nix Archive]
     NAR serialization of the flake's source tree.
 
diff --git a/src/nix/hash-convert.md b/src/nix/hash-convert.md
index dcebda74a3e4..179e510fcc2a 100644
--- a/src/nix/hash-convert.md
+++ b/src/nix/hash-convert.md
@@ -2,14 +2,14 @@ R""(
 
 # Examples
 
-* Convert a hash to `nix32` (a base-32 encoding with a Nix-specific character set).
+* Convert a hash to [`nix32`](@docroot@/protocols/nix32.md) (Nix's variant of [Base32](https://en.wikipedia.org/wiki/Base32) encoding).
 
   ```console
   $ nix hash convert --hash-algo sha1 --to nix32 800d59cfcd3c05e900cb4e214be48f6b886a08df
   vw46m23bizj4n8afrc0fj19wrp7mj3c0
   ```
 
-* Convert a hash to [the `sri` format](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) that includes an algorithm specification:
+* Convert a hash to [the `sri` format](@docroot@/glossary.md#gloss-sri) that includes an algorithm specification:
 
   ```console
   # nix hash convert --hash-algo sha1 800d59cfcd3c05e900cb4e214be48f6b886a08df
diff --git a/src/nix/hash.cc b/src/nix/hash.cc
index 90f44fdecd26..ecd238b7ec2a 100644
--- a/src/nix/hash.cc
+++ b/src/nix/hash.cc
@@ -4,7 +4,7 @@
 #include "nix/main/shared.hh"
 #include "nix/store/references.hh"
 #include "nix/util/git.hh"
-#include "nix/util/posix-source-accessor.hh"
+#include "nix/util/source-accessor.hh"
 #include "nix/cmd/misc-store-flags.hh"
 #include "man-pages.hh"
 #include "nix/util/fun.hh"
@@ -84,9 +84,7 @@ struct CmdHashBase : Command
                     return std::make_unique<HashSink>(hashAlgo);
             };
 
-            auto makeSourcePath = [&]() -> SourcePath {
-                return PosixSourceAccessor::createAtRoot(makeParentCanonical(path));
-            };
+            auto makeSourcePath = [&]() -> SourcePath { return makeFSSourceAccessor(absPath(path)); };
 
             Hash h{HashAlgorithm::SHA256}; // throwaway def to appease C++
             switch (mode) {
diff --git a/src/nix/key-generate-secret.md b/src/nix/key-generate-secret.md
index 609b1abccb90..2b8459da592f 100644
--- a/src/nix/key-generate-secret.md
+++ b/src/nix/key-generate-secret.md
@@ -39,7 +39,7 @@ to revoke a key).
 # Format
 
 Both secret and public keys are represented as the key name followed
-by a base-64 encoding of the Ed25519 key data, e.g.
+by a [Base64](https://en.wikipedia.org/wiki/Base64) encoding of the Ed25519 key data, e.g.
 
 ```
 cache.example.org-0:E7lAO+MsPwTFfPXsdPtW8GKui/5ho4KQHVcAGnX+Tti1V4dUxoVoqLyWJ4YESuZJwQ67GVIksDt47og+tPVUZw==
diff --git a/src/nix/log.md b/src/nix/log.md
index 9d526bb420ce..16a9f4b1aed9 100644
--- a/src/nix/log.md
+++ b/src/nix/log.md
@@ -26,14 +26,10 @@ This command prints the log of a previous build of the [*installable*](./nix.md#
 
 Nix looks for build logs in two places:
 
-* In the directory `/nix/var/log/nix/drvs`, which contains logs for
-  locally built derivations.
-
-* In the binary caches listed in the `substituters` setting. Logs
-  should be named `<cache>/log/<base-name-of-store-path>`, where
-  `store-path` is a derivation,
-  e.g. `https://cache.nixos.org/log/dvmig8jgrdapvbyxb1rprckdmdqx08kv-hello-2.10.drv`.
-  For non-derivation store paths, Nix will first try to determine the
-  deriver by fetching the `.narinfo` file for this store path.
+* In the directory `/nix/var/log/nix/drvs`, which contains logs for locally built derivations.
+
+* In the binary caches listed in the `substituters` setting.
+  Logs should be named `<cache>/log/<store-path-base-name>`, where `<store-path-base-name>` is the [store path base name](@docroot@/store/store-path.md#base-name) of a derivation, e.g. `https://cache.nixos.org/log/dvmig8jgrdapvbyxb1rprckdmdqx08kv-hello-2.10.drv`.
+  For non-derivation store paths, Nix will first try to determine the deriver from the [store object metadata](@docroot@/store/store-object.md#metadata).
 
 )""
diff --git a/src/nix/main.cc b/src/nix/main.cc
index 541f79622e5c..af465572c4a2 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -161,6 +161,7 @@ struct NixArgs : virtual MultiCommand, virtual MixCommonArgs, virtual RootArgs
             {"make-content-addressable", {AliasStatus::Deprecated, {"store", "make-content-addressed"}}},
             {"optimise-store", {AliasStatus::Deprecated, {"store", "optimise"}}},
             {"ping-store", {AliasStatus::Deprecated, {"store", "info"}}},
+            {"realisation", {AliasStatus::Deprecated, {"store", "build-trace"}}},
             {"sign-paths", {AliasStatus::Deprecated, {"store", "sign"}}},
             {"shell", {AliasStatus::AcceptedShorthand, {"env", "shell"}}},
             {"show-derivation", {AliasStatus::Deprecated, {"derivation", "show"}}},
@@ -256,24 +257,29 @@ static void showHelp(std::vector<std::string> subcommand, NixArgs & toplevel)
     auto vGenerateManpage = state.allocValue();
     state.eval(
         state.parseExprFromString(
-#include "generate-manpage.nix.gen.hh"
-            , state.rootPath(CanonPath::root)),
+            {
+#embed "doc/manual/generate-manpage.nix"
+            },
+            state.rootPath(CanonPath::root)),
         *vGenerateManpage);
 
     state.corepkgsFS->addFile(
         CanonPath("utils.nix"),
-#include "utils.nix.gen.hh"
-    );
+        {
+#embed "doc/manual/utils.nix"
+        });
 
     state.corepkgsFS->addFile(
         CanonPath("/generate-settings.nix"),
-#include "generate-settings.nix.gen.hh"
-    );
+        {
+#embed "doc/manual/generate-settings.nix"
+        });
 
     state.corepkgsFS->addFile(
         CanonPath("/generate-store-info.nix"),
-#include "generate-store-info.nix.gen.hh"
-    );
+        {
+#embed "doc/manual/generate-store-info.nix"
+        });
 
     auto vDump = state.allocValue();
     vDump->mkString(toplevel.dumpCli(), state.mem);
@@ -347,9 +353,9 @@ struct CmdHelpStores : Command
 
     std::string doc() override
     {
-        return
-#include "help-stores.md.gen.hh"
-            ;
+        return {
+#embed "help-stores.md"
+        };
     }
 
     Category category() override
@@ -397,17 +403,12 @@ void mainWrapped(int argc, char ** argv)
     flakeSettings.configureEvalSettings(evalSettings);
 
 #ifdef __linux__
-    if (isRootUser()) {
-        try {
-            saveMountNamespace();
-            if (unshare(CLONE_NEWNS) == -1)
-                throw SysError("setting up a private mount namespace");
-        } catch (Error & e) {
-            warn("failed to set up a private mount namespace: %s", e.msg());
-        }
-    }
+    if (isRootUser())
+        tryEnterPrivateMountNamespace();
 #endif
 
+    Finally f([] { logger->stop(); });
+
     programPath = argv[0];
     auto programName = std::string(baseNameOf(programPath));
     auto extensionPos = programName.find_last_of(".");
@@ -548,7 +549,13 @@ void mainWrapped(int argc, char ** argv)
     if (!args.command)
         throw UsageError("no subcommand specified");
 
-    experimentalFeatureSettings.require(args.command->second->experimentalFeature());
+    {
+        MultiCommand * command = &args;
+        while (command && command->command) {
+            experimentalFeatureSettings.require(command->command->second->experimentalFeature());
+            command = dynamic_cast<MultiCommand *>(&*command->command->second);
+        }
+    }
 
     if (args.useNet && !haveInternet()) {
         warn("you don't have Internet access; disabling some network-dependent features");
diff --git a/src/nix/meson.build b/src/nix/meson.build
index 3327b846c9c4..b4a28c7ab7e5 100644
--- a/src/nix/meson.build
+++ b/src/nix/meson.build
@@ -7,7 +7,6 @@ project(
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
-    'localstatedir=/nix/var',
   ],
   meson_version : '>= 1.4',
   license : 'LGPL-2.1-or-later',
@@ -31,6 +30,18 @@ deps_private_maybe_subproject = [
 deps_public_maybe_subproject = []
 subdir('nix-meson-build-support/subprojects')
 
+deps_plugin_c_apis = []
+if get_option('plugin-c-api')
+  deps_plugin_c_apis = [
+    dependency('nix-util-c-whole-archive'),
+    dependency('nix-store-c-whole-archive'),
+    dependency('nix-fetchers-c-whole-archive'),
+    dependency('nix-expr-c-whole-archive'),
+    dependency('nix-flake-c-whole-archive'),
+    dependency('nix-main-c-whole-archive'),
+  ]
+endif
+
 mimalloc = dependency('mimalloc', required : get_option('mimalloc'))
 if mimalloc.found()
   deps_private += mimalloc
@@ -66,6 +77,7 @@ subdir('nix-meson-build-support/generate-header')
 nix_sources = [ config_priv_h ] + files(
   'add-to-store.cc',
   'app.cc',
+  'build-trace.cc',
   'build.cc',
   'bundle.cc',
   'cat.cc',
@@ -97,7 +109,6 @@ nix_sources = [ config_priv_h ] + files(
   'path-info.cc',
   'prefetch.cc',
   'profile.cc',
-  'realisation.cc',
   'registry.cc',
   'repl.cc',
   'run.cc',
@@ -109,6 +120,7 @@ nix_sources = [ config_priv_h ] + files(
   'store-gc.cc',
   'store-info.cc',
   'store-repair.cc',
+  'store-submit-output.cc',
   'store.cc',
   'upgrade-nix.cc',
   'verify.cc',
@@ -123,13 +135,9 @@ if host_machine.system() != 'windows'
 endif
 
 nix_sources += [
-  gen_header.process('doc/manual/generate-manpage.nix'),
-  gen_header.process('doc/manual/generate-settings.nix'),
-  gen_header.process('doc/manual/generate-store-info.nix'),
-  gen_header.process('doc/manual/utils.nix'),
-  gen_header.process('get-env.sh'),
+  # TODO: Get rid of this for good. It's used in profile.md with
+  # string literal concatenation.
   gen_header.process('profiles.md'),
-  gen_header.process('help-stores.md'),
 ]
 
 # The rest of the subdirectories aren't separate components,
@@ -190,9 +198,10 @@ include_dirs = [ include_directories('.') ]
 this_exe = executable(
   meson.project_name(),
   sources,
-  dependencies : deps_private_subproject + deps_private + deps_other,
+  dependencies : deps_private_subproject + deps_private + deps_other + deps_plugin_c_apis,
   include_directories : include_dirs,
   link_args : linker_export_flags,
+  export_dynamic : get_option('plugin-c-api'),
   install : true,
   cpp_pch : do_pch ? [ 'pch/precompiled-headers.hh' ] : [],
 )
@@ -262,11 +271,7 @@ custom_target(
 # TODO(Ericson3214): Doesn't yet work
 #meson.override_find_program(linkname, t)
 
-localstatedir = nix_store.get_variable(
-  'localstatedir',
-  default_value : get_option('localstatedir'),
-)
-assert(localstatedir == get_option('localstatedir'))
+localstatedir = nix_store.get_variable('localstatedir')
 store_dir = nix_store.get_variable('storedir')
 subdir('scripts')
 subdir('misc')
diff --git a/src/nix/meson.options b/src/nix/meson.options
index ae391bfd8a7b..76c940d299cc 100644
--- a/src/nix/meson.options
+++ b/src/nix/meson.options
@@ -14,3 +14,10 @@ option(
   value : 'auto',
   description : 'Link against mimalloc to override the default memory allocator',
 )
+
+option(
+  'plugin-c-api',
+  type : 'boolean',
+  value : false,
+  description : 'Embed the public C API into nix so plugins can resolve those symbols from the executable',
+)
diff --git a/src/nix/nix-build/nix-build.cc b/src/nix/nix-build/nix-build.cc
index e68e775e024f..f359f7d9ae1e 100644
--- a/src/nix/nix-build/nix-build.cc
+++ b/src/nix/nix-build/nix-build.cc
@@ -28,11 +28,10 @@
 #include "nix/util/users.hh"
 #include "nix/cmd/network-proxy.hh"
 #include "nix/cmd/compatibility-settings.hh"
+#include "nix/store/build.hh"
 #include "nix/util/fun.hh"
 #include "man-pages.hh"
 
-using namespace std::string_literals;
-
 extern char ** environ __attribute__((weak));
 
 namespace nix {
@@ -451,7 +450,7 @@ static void main_nix_build(int argc, char ** argv)
             printMissing(ref<Store>(store), paths);
 
         if (!dryRun)
-            store->buildPaths(paths, buildMode, evalStore);
+            store->getBuilder(evalStore)->buildPaths(paths, buildMode);
     };
 
     if (isNixShell) {
@@ -512,7 +511,7 @@ static void main_nix_build(int argc, char ** argv)
         };
 
         // Build or fetch all dependencies of the derivation.
-        for (const auto & [inputDrv0, inputNode] : drv.inputDrvs.map) {
+        for (const auto & [inputDrv0, inputNode] : drv.inputs.drvs.map) {
             // To get around lambda capturing restrictions in the
             // standard.
             const auto & inputDrv = inputDrv0;
@@ -523,7 +522,7 @@ static void main_nix_build(int argc, char ** argv)
                 pathsToCopy.insert(inputDrv);
             }
         }
-        for (const auto & src : drv.inputSrcs) {
+        for (const auto & src : drv.inputs.srcs) {
             pathsToBuild.emplace_back(DerivedPath::Opaque{src});
             pathsToCopy.insert(src);
         }
@@ -534,14 +533,19 @@ static void main_nix_build(int argc, char ** argv)
             return;
 
         if (shellDrv) {
+            // Only "out" needs to be realized here, so query partially rather than requiring every output.
             auto shellDrvOutputs = deepQueryPartialDerivationOutputMap(*store, shellDrv.value(), &*evalStore);
-            shell = store->printStorePath(shellDrvOutputs.at("out").value()) + "/bin/bash";
+            auto & outPath = shellDrvOutputs.at("out");
+            if (!outPath)
+                throw MissingRealisation(*store, shellDrv.value(), "out");
+            shell = store->printStorePath(*outPath) + "/bin/bash";
         }
 
         if (drv.shouldResolve()) {
             auto resolvedDrv = drv.tryResolve(*store);
-            assert(resolvedDrv && "Successfully resolved the derivation");
-            drv = *resolvedDrv;
+            if (!resolvedDrv)
+                throw Error("failed to resolve derivation '%s'", store->printStorePath(packageInfo.requireDrvPath()));
+            drv = resolvedDrv->unresolve();
         }
 
         // Set the environment.
@@ -590,16 +594,24 @@ static void main_nix_build(int argc, char ** argv)
 
             fun<void(const StorePath &, const DerivedPathMap<StringSet>::ChildNode &)> accumInputClosure =
                 [&](const StorePath & inputDrv, const DerivedPathMap<StringSet>::ChildNode & inputNode) {
+                    // Only the depended-on outputs need realizing, so query partially rather than requiring every
+                    // output.
                     auto outputs = deepQueryPartialDerivationOutputMap(*store, inputDrv, &*evalStore);
                     for (auto & i : inputNode.value) {
-                        auto o = outputs.at(i);
+                        auto & o = outputs.at(i);
+                        if (!o)
+                            throw MissingRealisation(*store, inputDrv, i);
                         store->computeFSClosure(*o, inputs);
                     }
-                    for (const auto & [outputName, childNode] : inputNode.childMap)
-                        accumInputClosure(*outputs.at(outputName), childNode);
+                    for (const auto & [outputName, childNode] : inputNode.childMap) {
+                        auto & o = outputs.at(outputName);
+                        if (!o)
+                            throw MissingRealisation(*store, inputDrv, outputName);
+                        accumInputClosure(*o, childNode);
+                    }
                 };
 
-            for (const auto & [inputDrv, inputNode] : drv.inputDrvs.map)
+            for (const auto & [inputDrv, inputNode] : drv.inputs.drvs.map)
                 accumInputClosure(inputDrv, inputNode);
 
             auto json = drv.structuredAttrs->prepareStructuredAttrs(*store, drvOptions, inputs, drv.outputs);
@@ -623,6 +635,9 @@ static void main_nix_build(int argc, char ** argv)
         auto rcfile = (tmpDir.path() / "rc").string();
         auto tz = getEnv("TZ");
         auto tzExport = tz ? "export TZ=" + escapeShellArgAlways(*tz) + "; " : "";
+
+        using namespace std::string_literals;
+
         std::string rc = fmt(
                 (R"(_nix_shell_clean_tmpdir() { command rm -rf %1%; };)"s
                   "trap _nix_shell_clean_tmpdir EXIT; "
@@ -726,7 +741,8 @@ static void main_nix_build(int argc, char ** argv)
                 drvPrefix += fmt("-%d", counter + 1);
 
             auto outPath = deepQueryPartialDerivationOutput(*store, drvPath, outputName, &*evalStore);
-            assert(outPath);
+            if (!outPath)
+                throw MissingRealisation(*store, drvPath, outputName);
             auto outputPath = *outPath;
 
             if (auto store2 = store.dynamic_pointer_cast<LocalFSStore>()) {
diff --git a/src/nix/nix-copy-closure/nix-copy-closure.cc b/src/nix/nix-copy-closure/nix-copy-closure.cc
index 0c939df659ae..db797a745c6c 100644
--- a/src/nix/nix-copy-closure/nix-copy-closure.cc
+++ b/src/nix/nix-copy-closure/nix-copy-closure.cc
@@ -62,7 +62,7 @@ static int main_nix_copy_closure(int argc, char ** argv)
         for (auto & path : storePaths)
             storePaths2.insert(from->followLinksToStorePath(path));
 
-        copyClosure(*from, *to, storePaths2, NoRepair, NoCheckSigs, useSubstitutes);
+        copyClosure(*from, *to, storePaths2, NoRepair, NoCheckSigs, useSubstitutes, includeOutputs);
 
         return 0;
     }
diff --git a/src/nix/nix-env/nix-env.cc b/src/nix/nix-env/nix-env.cc
index abe04d96341c..671fa46f45f5 100644
--- a/src/nix/nix-env/nix-env.cc
+++ b/src/nix/nix-env/nix-env.cc
@@ -12,6 +12,7 @@
 #include "nix/store/path-with-outputs.hh"
 #include "nix/main/shared.hh"
 #include "nix/store/store-open.hh"
+#include "nix/store/build.hh"
 #include "nix/store/local-fs-store.hh"
 #include "user-env.hh"
 #include "nix/expr/value-to-json.hh"
@@ -76,7 +77,7 @@ struct InstallSourceInfo
     std::shared_ptr<SourcePath> nixExprPath; /* for srcNixExprDrvs, srcNixExprs */
     std::filesystem::path profile;           /* for srcProfile */
     std::string systemFilter;                /* for srcNixExprDrvs */
-    Bindings * autoArgs;
+    const Bindings * autoArgs;
 };
 
 struct Globals
@@ -207,7 +208,7 @@ static void loadDerivations(
     EvalState & state,
     const SourcePath & nixExprPath,
     std::string systemFilter,
-    Bindings & autoArgs,
+    const Bindings & autoArgs,
     const std::string & pathPrefix,
     PackageInfos & elems)
 {
@@ -793,7 +794,7 @@ static void opSet(Globals & globals, Strings opFlags, Strings opArgs)
     printMissing(globals.state->store, paths);
     if (globals.dryRun)
         return;
-    globals.state->store->buildPaths(paths, globals.state->repair ? bmRepair : bmNormal);
+    globals.state->store->getBuilder()->buildPaths(paths, globals.state->repair ? bmRepair : bmNormal);
 
     debug("switching to new user environment");
     auto generation = createGeneration(*store2, globals.profile, drv.queryOutPath());
@@ -1391,7 +1392,7 @@ static void opDeleteGenerations(Globals & globals, Strings opFlags, Strings opAr
     }
 }
 
-static void opVersion(Globals & globals, Strings opFlags, Strings opArgs)
+[[noreturn]] static void opVersion(Globals & globals, Strings opFlags, Strings opArgs)
 {
     printVersion("nix-env");
 }
@@ -1508,23 +1509,25 @@ static int main_nix_env(int argc, char ** argv)
         if (!op)
             throw UsageError("no operation specified");
 
-        auto store = openStore();
+        if (op != opVersion) {
+            auto store = openStore();
 
-        globals.state =
-            std::shared_ptr<EvalState>(new EvalState(myArgs.lookupPath, store, fetchSettings, evalSettings));
-        globals.state->repair = myArgs.repair;
+            globals.state =
+                std::shared_ptr<EvalState>(new EvalState(myArgs.lookupPath, store, fetchSettings, evalSettings));
+            globals.state->repair = myArgs.repair;
 
-        globals.instSource.nixExprPath = std::make_shared<SourcePath>(
-            file != "" ? lookupFileArg(*globals.state, file)
-                       : globals.state->rootPath(CanonPath(nixExprPath.string())));
+            globals.instSource.nixExprPath = std::make_shared<SourcePath>(
+                file != "" ? lookupFileArg(*globals.state, file)
+                           : globals.state->rootPath(CanonPath(nixExprPath.string())));
 
-        globals.instSource.autoArgs = myArgs.getAutoArgs(*globals.state);
+            globals.instSource.autoArgs = myArgs.getAutoArgs(*globals.state);
 
-        if (globals.profile == "")
-            globals.profile = getEnv("NIX_PROFILE").value_or("");
+            if (globals.profile == "")
+                globals.profile = getEnv("NIX_PROFILE").value_or("");
 
-        if (globals.profile == "")
-            globals.profile = getDefaultProfile(settings.getProfileDirsOptions()).string();
+            if (globals.profile == "")
+                globals.profile = getDefaultProfile(settings.getProfileDirsOptions()).string();
+        }
 
         op(globals, std::move(opFlags), std::move(opArgs));
 
diff --git a/src/nix/nix-env/user-env.cc b/src/nix/nix-env/user-env.cc
index cb74a36d0d4c..5dbcd93dfa38 100644
--- a/src/nix/nix-env/user-env.cc
+++ b/src/nix/nix-env/user-env.cc
@@ -1,6 +1,7 @@
 #include "user-env.hh"
 #include "nix/store/derivations.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/build.hh"
 #include "nix/store/path-with-outputs.hh"
 #include "nix/store/local-fs-store.hh"
 #include "nix/main/shared.hh"
@@ -23,7 +24,7 @@ PackageInfos queryInstalled(EvalState & state, const std::filesystem::path & use
     if (pathExists(manifestFile)) {
         Value v;
         state.evalFile(state.rootPath(CanonPath(manifestFile.string())).resolveSymlinks(), v);
-        Bindings & bindings = Bindings::emptyBindings;
+        const Bindings & bindings = Bindings::emptyBindings;
         getDerivations(state, v, "", bindings, elems, false);
     }
     return elems;
@@ -44,7 +45,7 @@ bool createUserEnv(
             drvsToBuild.push_back({*drvPath});
 
     debug("building user environment dependencies");
-    state.store->buildPaths(toDerivedPaths(drvsToBuild), state.repair ? bmRepair : bmNormal);
+    state.store->getBuilder()->buildPaths(toDerivedPaths(drvsToBuild), state.repair ? bmRepair : bmNormal);
 
     /* Construct the whole top level derivation. */
     StorePathSet references;
@@ -79,7 +80,7 @@ bool createUserEnv(
             /* This is only necessary when installing store paths, e.g.,
                `nix-env -i /nix/store/abcd...-foo'. */
             state.store->addTempRoot(*j.second);
-            state.store->ensurePath(*j.second);
+            state.store->getBuilder()->ensurePath(*j.second);
 
             references.insert(*j.second);
         }
@@ -154,7 +155,7 @@ bool createUserEnv(
     debug("building user environment");
     std::vector<StorePathWithOutputs> topLevelDrvs;
     topLevelDrvs.push_back({topLevelDrv});
-    state.store->buildPaths(toDerivedPaths(topLevelDrvs), state.repair ? bmRepair : bmNormal);
+    state.store->getBuilder()->buildPaths(toDerivedPaths(topLevelDrvs), state.repair ? bmRepair : bmNormal);
 
     /* Switch the current user environment to the output path. */
     auto store2 = state.store.dynamic_pointer_cast<LocalFSStore>();
diff --git a/src/nix/nix-instantiate/nix-instantiate.cc b/src/nix/nix-instantiate/nix-instantiate.cc
index 27a11767b004..b180472c1275 100644
--- a/src/nix/nix-instantiate/nix-instantiate.cc
+++ b/src/nix/nix-instantiate/nix-instantiate.cc
@@ -27,7 +27,7 @@ void processExpr(
     const Strings & attrPaths,
     bool parseOnly,
     bool strict,
-    Bindings & autoArgs,
+    const Bindings & autoArgs,
     bool evalOnly,
     OutputKind output,
     bool location,
@@ -66,7 +66,7 @@ void processExpr(
                 if (strict)
                     state.forceValueDeep(vRes);
                 std::set<const void *> seen;
-                printAmbiguous(state, vRes, std::cout, &seen);
+                printAmbiguous(state, vRes, std::cout, &seen, &context);
                 std::cout << std::endl;
             }
         } else {
@@ -94,6 +94,8 @@ void processExpr(
                 std::cout << fmt("%s%s\n", drvPathS, (outputName != "out" ? "!" + outputName : ""));
             }
         }
+
+        state.ensureLazyPathsCopied(context);
     }
 }
 
@@ -170,7 +172,7 @@ static int main_nix_instantiate(int argc, char ** argv)
         auto state = std::make_shared<EvalState>(myArgs.lookupPath, evalStore, fetchSettings, evalSettings, store);
         state->repair = myArgs.repair;
 
-        Bindings & autoArgs = *myArgs.getAutoArgs(*state);
+        const Bindings & autoArgs = *myArgs.getAutoArgs(*state);
 
         if (attrPaths.empty())
             attrPaths = {""};
diff --git a/src/nix/nix-store/nix-store.cc b/src/nix/nix-store/nix-store.cc
index c21625e0409c..3ccec3241597 100644
--- a/src/nix/nix-store/nix-store.cc
+++ b/src/nix/nix-store/nix-store.cc
@@ -13,7 +13,7 @@
 #include "nix/main/shared.hh"
 #include "graphml.hh"
 #include "nix/cmd/legacy.hh"
-#include "nix/util/posix-source-accessor.hh"
+#include "nix/util/source-accessor.hh"
 #include "nix/store/globals.hh"
 #include "nix/store/path-with-outputs.hh"
 #include "nix/store/export-import.hh"
@@ -21,6 +21,7 @@
 #include "nix/store/posix-fs-canonicalise.hh"
 #include "nix/util/error.hh"
 #include "nix/store/gc-store.hh"
+#include "nix/store/build.hh"
 
 #include "man-pages.hh"
 
@@ -40,7 +41,7 @@
 
 namespace nix_store {
 
-using namespace nix;
+using namespace nix; // NOLINT(nix-using-namespace)
 
 typedef void (*Operation)(Strings opFlags, Strings opArgs);
 
@@ -76,7 +77,7 @@ static std::set<std::filesystem::path> realisePath(StorePathWithOutputs path, bo
 
     if (path.path.isDerivation()) {
         if (build)
-            store->buildPaths({path.toDerivedPath()});
+            store->getBuilder()->buildPaths({path.toDerivedPath()});
         auto outputPaths = deepQueryDerivationOutputMap(*store, path.path);
         Derivation drv = store->derivationFromPath(path.path);
         rootNr++;
@@ -113,7 +114,7 @@ static std::set<std::filesystem::path> realisePath(StorePathWithOutputs path, bo
 
     else {
         if (build)
-            store->ensurePath(path.path);
+            store->getBuilder()->ensurePath(path.path);
         else if (!store->isValidPath(path.path))
             throw Error("path '%s' does not exist and cannot be created", store->printStorePath(path.path));
         if (store2) {
@@ -173,7 +174,7 @@ static void opRealise(Strings opFlags, Strings opArgs)
         return;
 
     /* Build all paths at the same time to exploit parallelism. */
-    store->buildPaths(toDerivedPaths(paths), buildMode);
+    store->getBuilder()->buildPaths(toDerivedPaths(paths), buildMode);
 
     if (!ignoreUnknown)
         for (auto & i : paths) {
@@ -191,7 +192,7 @@ static void opAdd(Strings opFlags, Strings opArgs)
         throw UsageError("unknown flag");
 
     for (auto & i : opArgs) {
-        auto sourcePath = PosixSourceAccessor::createAtRoot(makeParentCanonical(i));
+        auto sourcePath = makeFSSourceAccessor(absPath(i));
         std::cout << fmt("%s\n", store->printStorePath(store->addToStore(std::string(baseNameOf(i)), sourcePath)));
     }
 }
@@ -215,7 +216,7 @@ static void opAddFixed(Strings opFlags, Strings opArgs)
     opArgs.pop_front();
 
     for (auto & i : opArgs) {
-        auto sourcePath = PosixSourceAccessor::createAtRoot(makeParentCanonical(i));
+        auto sourcePath = makeFSSourceAccessor(absPath(i));
         std::cout << fmt(
             "%s\n", store->printStorePath(store->addToStoreSlow(baseNameOf(i), sourcePath, method, hashAlgo).path));
     }
@@ -291,12 +292,9 @@ printTree(const StorePath & path, const std::string & firstPad, const std::strin
        input of B, then A is printed first.  This has the effect of
        flattening the tree, preventing deeply nested structures.  */
     auto sorted = store->topoSortPaths(info->references);
-    reverse(sorted.begin(), sorted.end());
 
-    for (const auto & [n, i] : enumerate(sorted)) {
-        bool last = n + 1 == sorted.size();
+    for (const auto & [last, i] : markLast(sorted | std::views::reverse))
         printTree(i, tailPad + (last ? treeLast : treeConn), tailPad + (last ? treeNull : treeLine), done);
-    }
 }
 
 /* Perform various sorts of queries. */
@@ -573,6 +571,7 @@ static void opDumpDB(Strings opFlags, Strings opArgs)
 
 static void registerValidity(bool reregister, bool hashGiven, bool canonicalise)
 {
+    auto localStore = ensureLocalStore();
     ValidPathInfos infos;
 
     while (1) {
@@ -590,7 +589,7 @@ static void registerValidity(bool reregister, bool hashGiven, bool canonicalise)
             /* !!! races */
             if (canonicalise)
                 canonicalisePathMetaData(
-                    store->printStorePath(info->path),
+                    localStore->toRealPath(info->path),
                     {NIX_WHEN_SUPPORT_ACLS(settings.getLocalSettings().ignoredAcls)});
             if (!hashGiven) {
                 HashResult hash = hashPath(
@@ -604,7 +603,7 @@ static void registerValidity(bool reregister, bool hashGiven, bool canonicalise)
         }
     }
 
-    ensureLocalStore()->registerValidPaths(infos);
+    localStore->registerValidPaths(infos);
 }
 
 static void opLoadDB(Strings opFlags, Strings opArgs)
@@ -727,7 +726,9 @@ static void opDelete(Strings opFlags, Strings opArgs)
     StorePathSet paths;
     for (auto & i : opArgs)
         paths.insert(store->followLinksToStorePath(i));
-    options.pathsToDelete = std::move(paths);
+    options.pathsToDelete = GCOptions::SpecificPaths{
+        .paths = std::move(paths),
+    };
 
     auto & gcStore = require<GcStore>(*store);
 
@@ -862,7 +863,7 @@ static void opRepairPath(Strings opFlags, Strings opArgs)
         throw UsageError("no flags expected");
 
     for (auto & i : opArgs)
-        store->repairPath(store->followLinksToStorePath(i));
+        store->getBuilder()->repairPath(store->followLinksToStorePath(i));
 }
 
 /* Optimise the disk space usage of the Nix store by hard-linking
@@ -1009,7 +1010,7 @@ static void opServe(Strings opFlags, Strings opArgs)
 #ifndef _WIN32 // TODO figure out if Windows needs something similar
                 MonitorFdHup monitor(in.fd);
 #endif
-                store->buildPaths(toDerivedPaths(paths));
+                store->getBuilder()->buildPaths(toDerivedPaths(paths));
                 out << 0;
             } catch (Error & e) {
                 assert(e.info().status);
@@ -1032,7 +1033,7 @@ static void opServe(Strings opFlags, Strings opArgs)
 #ifndef _WIN32 // TODO figure out if Windows needs something similar
             MonitorFdHup monitor(in.fd);
 #endif
-            auto status = store->buildDerivation(drvPath, drv);
+            auto status = store->getBuilder()->buildDerivation(drvPath, drv);
 
             ServeProto::write(*store, wconn, status);
             break;
diff --git a/src/nix/package.nix b/src/nix/package.nix
index 68d1e379ab47..b48ce53c6a71 100644
--- a/src/nix/package.nix
+++ b/src/nix/package.nix
@@ -8,6 +8,13 @@
   nix-main,
   nix-cmd,
 
+  nix-expr-c,
+  nix-fetchers-c,
+  nix-flake-c,
+  nix-main-c,
+  nix-store-c,
+  nix-util-c,
+
   mimalloc,
 
   # Configuration Options
@@ -17,7 +24,13 @@
   # Whether to link against mimalloc for malloc override.
   # Significantly improves evaluation performance on allocation-heavy
   # workloads (~10-15% on large evaluations).
-  withMimalloc ? !stdenv.hostPlatform.isWindows,
+  # mimalloc is disabled on FreeBSD due to a crash in nixpkgs 25.11.
+  # Once the nixpkgs flake is updated, mimalloc can be enabled again.
+  withMimalloc ? !stdenv.hostPlatform.isWindows && !stdenv.hostPlatform.isFreeBSD,
+
+  # Whether to embed the public C API into the `nix` executable so plugins can
+  # resolve those symbols without linking Nix libraries directly.
+  withPluginCApi ? !stdenv.hostPlatform.isWindows && !stdenv.hostPlatform.isStatic,
 }:
 
 let
@@ -77,10 +90,19 @@ mkMesonExecutable (finalAttrs: {
     nix-main
     nix-cmd
   ]
+  ++ lib.optionals withPluginCApi [
+    nix-expr-c
+    nix-fetchers-c
+    nix-flake-c
+    nix-main-c
+    nix-store-c
+    nix-util-c
+  ]
   ++ lib.optional withMimalloc mimalloc;
 
   mesonFlags = [
     (lib.mesonEnable "mimalloc" withMimalloc)
+    (lib.mesonBool "plugin-c-api" withPluginCApi)
   ];
 
   postInstall = lib.optionalString stdenv.hostPlatform.isStatic ''
@@ -88,6 +110,10 @@ mkMesonExecutable (finalAttrs: {
     echo "file binary-dist $out/bin/nix" >> $out/nix-support/hydra-build-products
   '';
 
+  passthru = {
+    exportsPluginCApi = withPluginCApi;
+  };
+
   meta = {
     mainProgram = "nix";
     platforms = lib.platforms.unix ++ lib.platforms.windows;
diff --git a/src/nix/path-info.cc b/src/nix/path-info.cc
index 5be20f66da7f..b6c3ef2c385d 100644
--- a/src/nix/path-info.cc
+++ b/src/nix/path-info.cc
@@ -143,7 +143,11 @@ struct CmdPathInfo : StorePathsCommand, MixJSON
         addFlag({
             .longName = "json-format",
             .description =
-                "JSON format version to use (1 or 2). Version 1 uses string hashes and full store paths. Version 2 uses structured hashes and store path base names. This flag will be required in a future release.",
+                "JSON format version of [store object info](@docroot@/protocols/json/store-object-info.md) to use (1, 2, or 3).\n"
+                "Version 1 uses string hashes and full store paths.\n"
+                "Version 2 uses structured hashes and [store path base names](@docroot@/store/store-path.md#base-name).\n"
+                "Version 3 uses structured signatures.\n"
+                "This flag will be required in a future release.",
             .labels = {"version"},
             .handler = {[this](std::string s) {
                 jsonFormat = parsePathInfoJsonFormat(string2IntWithUnitPrefix<uint64_t>(s));
diff --git a/src/nix/path-info.md b/src/nix/path-info.md
index bd4a9311cf91..bbf674b7557e 100644
--- a/src/nix/path-info.md
+++ b/src/nix/path-info.md
@@ -82,9 +82,8 @@ R""(
 This command shows information about the store paths produced by
 [*installables*](./nix.md#installables), or about all paths in the store if you pass `--all`.
 
-By default, this command only prints the store paths. You can get
-additional information by passing flags such as `--closure-size`,
-`--size`, `--sigs` or `--json`.
+By default, this command only prints the store paths.
+You can get additional information by passing flags such as `--closure-size`, `--size`, `--sigs` or `--json`.
 
 > **Warning**
 >
diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index 7457931d6fc9..bceb8c3bb3db 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -8,7 +8,7 @@
 #include "nix/expr/attr-path.hh"
 #include "nix/expr/eval-inline.hh"
 #include "nix/cmd/legacy.hh"
-#include "nix/util/posix-source-accessor.hh"
+#include "nix/util/source-accessor.hh"
 #include "nix/cmd/misc-store-flags.hh"
 #include "nix/util/environment-variables.hh"
 #include "nix/util/url.hh"
@@ -205,7 +205,7 @@ static int main_nix_prefetch_url(int argc, char ** argv)
         auto store = openStore();
         auto state = std::make_shared<EvalState>(myArgs.lookupPath, store, fetchSettings, evalSettings);
 
-        Bindings & autoArgs = *myArgs.getAutoArgs(*state);
+        const Bindings & autoArgs = *myArgs.getAutoArgs(*state);
 
         /* If -A is given, get the URL from the specified Nix
            expression. */
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index c85c406aa518..e63d0150c08e 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -125,7 +125,7 @@ struct ProfileManifest
         auto manifestPath = profile / "manifest.json";
 
         if (std::filesystem::exists(manifestPath)) {
-            auto json = nlohmann::json::parse(readFile(manifestPath.string()));
+            auto json = nlohmann::json::parse(readFile(manifestPath));
 
             auto version = json.value("version", 0);
             std::string sUrl;
@@ -248,13 +248,13 @@ struct ProfileManifest
             }
         }
 
-        buildProfile(tempDir.string(), std::move(pkgs));
+        buildProfile(tempDir, std::move(pkgs));
 
         writeFile(tempDir / "manifest.json", toJSON(*store).dump());
 
         /* Add the symlink tree to the store. */
         StringSink sink;
-        dumpPath(tempDir.string(), sink);
+        dumpPath(tempDir, sink);
 
         auto narHash = hashString(HashAlgorithm::SHA256, sink.s);
 
diff --git a/src/nix/search.cc b/src/nix/search.cc
index c4b37b8a7149..90646d43a888 100644
--- a/src/nix/search.cc
+++ b/src/nix/search.cc
@@ -11,7 +11,7 @@
 #include "nix/util/hilite.hh"
 #include "nix/util/strings-inline.hh"
 
-#include <regex>
+#include <boost/regex.hpp>
 #include <nlohmann/json.hpp>
 
 #include "nix/util/strings.hh"
@@ -70,16 +70,16 @@ struct CmdSearch : InstallableValueCommand, MixJSON
             throw UsageError(
                 "Must provide at least one regex! To match all packages, use '%s'.", "nix search <installable> ^");
 
-        std::vector<std::regex> regexes;
-        std::vector<std::regex> excludeRegexes;
+        std::vector<boost::regex> regexes;
+        std::vector<boost::regex> excludeRegexes;
         regexes.reserve(res.size());
         excludeRegexes.reserve(excludeRes.size());
 
         for (auto & re : res)
-            regexes.push_back(std::regex(re, std::regex::extended | std::regex::icase));
+            regexes.push_back(boost::regex(re, boost::regex::extended | boost::regex::icase));
 
         for (auto & re : excludeRes)
-            excludeRegexes.emplace_back(re, std::regex::extended | std::regex::icase);
+            excludeRegexes.emplace_back(re, boost::regex::extended | boost::regex::icase);
 
         auto state = getEvalState();
 
@@ -95,7 +95,7 @@ struct CmdSearch : InstallableValueCommand, MixJSON
             auto attrPathS = state->symbols.resolve({attrPath});
             auto attrPathStr = attrPath.to_string(*state);
 
-            Activity act(*logger, lvlInfo, actUnknown, fmt("evaluating '%s'", attrPathStr));
+            Activity act(*logger, lvlTalkative, actUnknown, fmt("evaluating '%s'", attrPathStr));
             try {
                 auto recurse = [&]() {
                     for (const auto & attr : cursor.getAttrs()) {
@@ -114,30 +114,31 @@ struct CmdSearch : InstallableValueCommand, MixJSON
                     auto description = aDescription ? aDescription->getString() : "";
                     std::replace(description.begin(), description.end(), '\n', ' ');
 
-                    std::vector<std::smatch> attrPathMatches;
-                    std::vector<std::smatch> descriptionMatches;
-                    std::vector<std::smatch> nameMatches;
+                    std::vector<boost::smatch> attrPathMatches;
+                    std::vector<boost::smatch> descriptionMatches;
+                    std::vector<boost::smatch> nameMatches;
                     bool found = false;
 
                     for (auto & regex : excludeRegexes) {
-                        if (std::regex_search(attrPathStr, regex) || std::regex_search(name.name, regex)
-                            || std::regex_search(description, regex))
+                        if (boost::regex_search(attrPathStr, regex) || boost::regex_search(name.name, regex)
+                            || boost::regex_search(description, regex))
                             return;
                     }
 
                     for (auto & regex : regexes) {
                         found = false;
-                        auto addAll = [&found](std::sregex_iterator it, std::vector<std::smatch> & vec) {
-                            const auto end = std::sregex_iterator();
+                        auto addAll = [&found](boost::sregex_iterator it, std::vector<boost::smatch> & vec) {
+                            const auto end = boost::sregex_iterator();
                             while (it != end) {
                                 vec.push_back(*it++);
                                 found = true;
                             }
                         };
 
-                        addAll(std::sregex_iterator(attrPathStr.begin(), attrPathStr.end(), regex), attrPathMatches);
-                        addAll(std::sregex_iterator(name.name.begin(), name.name.end(), regex), nameMatches);
-                        addAll(std::sregex_iterator(description.begin(), description.end(), regex), descriptionMatches);
+                        addAll(boost::sregex_iterator(attrPathStr.begin(), attrPathStr.end(), regex), attrPathMatches);
+                        addAll(boost::sregex_iterator(name.name.begin(), name.name.end(), regex), nameMatches);
+                        addAll(
+                            boost::sregex_iterator(description.begin(), description.end(), regex), descriptionMatches);
 
                         if (!found)
                             break;
diff --git a/src/nix/store-delete.cc b/src/nix/store-delete.cc
index 5eef2d1ad235..c2f649ff568e 100644
--- a/src/nix/store-delete.cc
+++ b/src/nix/store-delete.cc
@@ -9,6 +9,7 @@ namespace nix {
 struct CmdStoreDelete : StorePathsCommand
 {
     GCOptions options{.action = GCOptions::gcDeleteSpecific};
+    bool deleteReferrers = false;
 
     CmdStoreDelete()
     {
@@ -20,10 +21,17 @@ struct CmdStoreDelete : StorePathsCommand
 
         addFlag({
             .longName = "skip-alive",
+            .aliases = {"skip-live"},
             .description =
                 "Do not emit errors when attempting to delete something that is still alive, useful with --recursive.",
             .handler = {&options.action, GCOptions::gcDeleteDead},
         });
+
+        addFlag({
+            .longName = "also-referrers",
+            .description = "Also allow deletion of any referrers of the specified paths.",
+            .handler = {&deleteReferrers, true},
+        });
     }
 
     std::string description() override
@@ -45,7 +53,10 @@ struct CmdStoreDelete : StorePathsCommand
         StorePathSet paths;
         for (auto & path : storePaths)
             paths.insert(path);
-        options.pathsToDelete = std::move(paths);
+        options.pathsToDelete = GCOptions::SpecificPaths{
+            .paths = std::move(paths),
+            .deleteReferrers = deleteReferrers,
+        };
 
         GCResults results;
         Finally printer([&] { printFreed(false, results); });
diff --git a/src/nix/store-delete.md b/src/nix/store-delete.md
index 026dccd0f19a..9b6fd9701d3e 100644
--- a/src/nix/store-delete.md
+++ b/src/nix/store-delete.md
@@ -8,6 +8,18 @@ R""(
   # nix store delete /nix/store/fdhrijyv3670djsgprx596nn89iwlj2s-hello-2.10
   ```
 
+* Garbage collect a closure:
+
+  ```console
+  # nix store delete --recursive --skip-alive nixpkgs#hello
+  ```
+
+* Garbage collect a closure including dead referrers of the closure:
+
+  ```console
+  # nix store delete --recursive --skip-alive --also-referrers nixpkgs#hello
+  ```
+
 # Description
 
 This command deletes the store paths specified by [*installables*](./nix.md#installables),
diff --git a/src/nix/store-repair.cc b/src/nix/store-repair.cc
index a6eee6dfbf2c..6c91d1959ac1 100644
--- a/src/nix/store-repair.cc
+++ b/src/nix/store-repair.cc
@@ -1,5 +1,6 @@
 #include "nix/cmd/command.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/build.hh"
 
 namespace nix {
 
@@ -20,7 +21,7 @@ struct CmdStoreRepair : StorePathsCommand
     void run(ref<Store> store, StorePaths && storePaths) override
     {
         for (auto & path : storePaths)
-            store->repairPath(path);
+            store->getBuilder()->repairPath(path);
     }
 };
 
diff --git a/src/nix/store-submit-output.cc b/src/nix/store-submit-output.cc
new file mode 100644
index 000000000000..c23c5d688da7
--- /dev/null
+++ b/src/nix/store-submit-output.cc
@@ -0,0 +1,46 @@
+#include "nix/cmd/command.hh"
+#include "nix/store/store-api.hh"
+#include "nix/store/store-cast.hh"
+#include "nix/store/submit-store.hh"
+
+namespace nix {
+
+struct CmdSubmitOutput : StoreCommand
+{
+    std::string path;
+    OutputName output;
+
+    CmdSubmitOutput()
+    {
+        expectArg("path", &path);
+        expectArg("output", &output);
+    }
+
+    std::string description() override
+    {
+        return "submit a store object as one of the outputs of the derivation currently being built";
+    }
+
+    std::string doc() override
+    {
+        return
+#include "store-submit-output.md"
+            ;
+    }
+
+    std::optional<ExperimentalFeature> experimentalFeature() override
+    {
+        return Xp::DynamicDerivations;
+    }
+
+    void run(ref<Store> store) override
+    {
+        auto & submitStore = require<SubmitStore>(*store);
+        auto path = SingleDerivedPath::parse(*store, this->path);
+        submitStore.submitOutput(path, output);
+    }
+};
+
+static auto rCmdSubmitOutput = registerCommand2<CmdSubmitOutput>({"store", "submit-output"});
+
+} // namespace nix
diff --git a/src/nix/store-submit-output.md b/src/nix/store-submit-output.md
new file mode 100644
index 000000000000..17b73686d257
--- /dev/null
+++ b/src/nix/store-submit-output.md
@@ -0,0 +1,20 @@
+R""(
+
+# Examples
+
+* To submit a given [store object] as the output named `out`:
+
+  ```console
+  # nix store submit-output /nix/store/h6zs50y2662apmnbcnhnbxll76lv02yy-hello-2.12.3 out
+  ```
+
+# Description
+
+`nix store submit-output` registers a [store object] as an output of the currently-running derivation.
+
+It only functions when running inside a content-addressing derivation with the `builder-rpc-v0`
+system feature, which provides a limited daemon socket to the builder.
+Execution in any other environment will fail.
+
+[store object]: @docroot@/store/store-object.md
+)""
diff --git a/src/nix/unix/daemon.cc b/src/nix/unix/daemon.cc
index 05e47f79c36b..c60ba8472f18 100644
--- a/src/nix/unix/daemon.cc
+++ b/src/nix/unix/daemon.cc
@@ -280,20 +280,52 @@ static void daemonLoop(
     }
 #endif
 
+    /* Check for anything that might be a crash. Too many crashes aren't
+       supposed to happen and we should limit the amount if someone is
+       intentionally triggering those as an ASLR bypass attempt (each forked
+       daemon worker has the same address space layout as we do). TODO: Ideally
+       we'd re-exec the daemon worker so that it gets a fresh address space
+       for each connection. Alternatively, we could make the daemon socket use
+       Accept=yes systemd.socket(5). */
+    unsigned crashCount = 0;
+
+    /* For now we are just limiting the number of crashes experienced by this
+       daemon instance. systemd (e.g.) would restart us, which would get us
+       a fresh address space layout - which is exactly what we want in case
+       someone is intentionally crashing the daemon to brute-force ASLR. */
+    static constexpr unsigned crashLimit = 64;
+
     try {
         unix::serveUnixSocket(
             {
                 .socketPath = std::move(socketPath),
                 .socketMode = 0666,
+                .activationName = "nix-daemon.socket",
                 .auxiliaryFd = sigChldPipe.pipe.readSide.get(),
                 .onAuxiliaryFdPollin =
-                    []() {
+                    [&crashCount]() {
                         sigChldPipe.drain();
                         /* Reap all dead children. */
                         pid_t pid = -1;
                         int status;
-                        while (pid = ::waitpid(/*pid (any child process)=*/-1, &status, WNOHANG), pid > 0)
+                        while (pid = ::waitpid(/*pid (any child process)=*/-1, &status, WNOHANG), pid > 0) {
                             printInfo("reaped child process %1%, status = %2%", pid, statusToString(status));
+
+                            if (!WIFSIGNALED(status))
+                                continue;
+
+                            int sig = WTERMSIG(status);
+                            for (auto i : {SIGILL, SIGSEGV, SIGBUS, SIGABRT, SIGSYS, SIGFPE}) {
+                                if (sig == i) {
+                                    printInfo("daemon worker %1% crashed", pid);
+                                    ++crashCount;
+                                    break;
+                                }
+                            }
+
+                            if (crashCount >= crashLimit)
+                                throw unix::AbortServeSocket("too many daemon worker crashes (%1%)", crashLimit);
+                        }
                     },
             },
             [&](AutoCloseFD remote, std::function<void()> closeListeners) {
@@ -322,7 +354,6 @@ static void daemonLoop(
                 options.errorPrefix = "unexpected Nix daemon error: ";
                 options.dieWithParent = false;
                 options.runExitHandlers = true;
-                options.allowVfork = false;
                 startProcess(
                     [&, storeConfig, closeListeners = std::move(closeListeners)]() {
                         closeListeners();
@@ -343,7 +374,8 @@ static void daemonLoop(
                         // Handle the connection.
                         auto store = storeConfig->openStore();
                         store->init();
-                        processConnection(store, FdSource(remote.get()), FdSink(remote.get()), trusted, NotRecursive);
+                        processConnection(
+                            store, FdSource(remote.get()), FdSink(remote.get()), trusted, RecursiveFlag::NotRecursive);
 
                         exit(0);
                     },
@@ -405,7 +437,8 @@ static void forwardStdioConnection(RemoteStore & store)
  */
 static void processStdioConnection(ref<Store> store, TrustedFlag trustClient)
 {
-    processConnection(store, FdSource(STDIN_FILENO), FdSink(STDOUT_FILENO), trustClient, daemon::NotRecursive);
+    processConnection(
+        store, FdSource(STDIN_FILENO), FdSink(STDOUT_FILENO), trustClient, daemon::RecursiveFlag::NotRecursive);
 }
 
 /**
diff --git a/src/nix/unix/store-roots-daemon.cc b/src/nix/unix/store-roots-daemon.cc
index 85b0a67a9156..b803c8cea6cf 100644
--- a/src/nix/unix/store-roots-daemon.cc
+++ b/src/nix/unix/store-roots-daemon.cc
@@ -44,6 +44,7 @@ struct CmdRootsDaemon : StoreConfigCommand
             {
                 .socketPath = gcSocketPath,
                 .socketMode = 0666,
+                .activationName = "nix-roots-daemon.socket",
             },
             [&](AutoCloseFD remote, std::function<void()> closeListeners) {
                 std::thread([&, remote = std::move(remote)]() mutable {
diff --git a/src/nix/unix/store-roots-daemon.md b/src/nix/unix/store-roots-daemon.md
index 5f4f778ed4d7..c8040fa912ef 100644
--- a/src/nix/unix/store-roots-daemon.md
+++ b/src/nix/unix/store-roots-daemon.md
@@ -14,10 +14,10 @@ This command runs a daemon that serves garbage collector roots from a Unix domai
 It is not required in all Nix installations, but is useful when the main Nix daemon
 is not running as root and therefore cannot find runtime roots by scanning `/proc`.
 
-When the garbage collector runs with [`use-roots-daemon`](@docroot@/store/types/local-store.md#store-experimental-option-use-roots-daemon)
+When the garbage collector runs with [`use-roots-daemon`](@docroot@/store/types/local-store.md#store-local-store-use-roots-daemon)
 enabled, it connects to this daemon to discover additional roots that should not be collected.
 
-The daemon listens on [`<state-dir>`](@docroot@/store/types/local-store.md#store-option-state)`/gc-roots-socket/socket` (typically `/nix/var/nix/gc-roots-socket/socket`).
+The daemon listens on [`<state-dir>`](@docroot@/store/types/local-store.md#store-local-store-state)`/gc-roots-socket/socket` (typically `/nix/var/nix/gc-roots-socket/socket`).
 
 # Protocol
 
@@ -42,5 +42,5 @@ Therefore, restricting this daemon to only accept the Nix daemon as a client is,
 
 # Systemd socket activation
 
-`nix store roots-daemon` supports systemd socket-based activation, [just like `nix-daemon`](@docroot@/command-ref/nix-daemon.md#systemd-socket-activation).
+`nix store roots-daemon` supports systemd socket-based activation, [just like `nix daemon`](@docroot@/command-ref/new-cli/nix3-daemon.md#systemd-socket-activation).
 )""
diff --git a/src/nix/upgrade-nix.cc b/src/nix/upgrade-nix.cc
index 3136f4d5fd15..35b9771ef09a 100644
--- a/src/nix/upgrade-nix.cc
+++ b/src/nix/upgrade-nix.cc
@@ -3,6 +3,7 @@
 #include "nix/cmd/command.hh"
 #include "nix/main/common-args.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/build.hh"
 #include "nix/store/filetransfer.hh"
 #include "nix/expr/eval.hh"
 #include "nix/expr/eval-settings.hh"
@@ -113,7 +114,7 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand
 
         {
             Activity act(*logger, lvlInfo, actUnknown, fmt("downloading '%s'...", store->printStorePath(storePath)));
-            store->ensurePath(storePath);
+            store->getBuilder()->ensurePath(storePath);
         }
 
         {
@@ -201,7 +202,7 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand
         auto state = std::make_shared<EvalState>(LookupPath{}, store, fetchSettings, evalSettings);
         auto v = state->allocValue();
         state->eval(state->parseExprFromString(res.data, state->rootPath(CanonPath("/no-such-path"))), *v);
-        Bindings & bindings = Bindings::emptyBindings;
+        const Bindings & bindings = Bindings::emptyBindings;
         auto v2 = findAlongAttrPath(*state, settings.thisSystem, bindings, *v).first;
 
         return store->parseStorePath(
diff --git a/src/nix/why-depends.cc b/src/nix/why-depends.cc
index d953b022f39f..3d0d488c03b2 100644
--- a/src/nix/why-depends.cc
+++ b/src/nix/why-depends.cc
@@ -256,10 +256,10 @@ struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
                 });
             }
 
-            for (auto & ref : refs) {
+            for (const auto & [isLast, ref] : markLast(refs)) {
                 std::string hash(ref.second->path.hashPart());
 
-                bool last = all ? ref == *refs.rbegin() : true;
+                bool last = all ? isLast : true;
 
                 for (auto & hit : hits[hash]) {
                     bool first = hit == *hits[hash].begin();
diff --git a/src/nix/why-depends.md b/src/nix/why-depends.md
index ac8adeb7e858..9b661aa3166a 100644
--- a/src/nix/why-depends.md
+++ b/src/nix/why-depends.md
@@ -55,7 +55,7 @@ Nix automatically determines potential runtime dependencies between
 store paths by scanning for the *hash parts* of store paths. For
 instance, if there exists a store path
 `/nix/store/q9mknq836i0kblq8g1hm9f3cv9qda0r9-glibc-2.31`, and a file
-inside another store path contains the string `9df65igw…`, then the
+inside another store path contains the string `q9mknq83…`, then the
 latter store path *refers* to the former, and thus might need it at
 runtime. Nix always maintains the existence of the transitive closure
 of a store path under the references relationship; it is therefore not
diff --git a/src/nswrapper/meson.build b/src/nswrapper/meson.build
index 77b96d677e72..1d1ccc6b21c3 100644
--- a/src/nswrapper/meson.build
+++ b/src/nswrapper/meson.build
@@ -7,9 +7,8 @@ project(
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
-    'localstatedir=/nix/var',
   ],
-  meson_version : '>= 1.1',
+  meson_version : '>= 1.8',
   license : 'LGPL-2.1-or-later',
 )
 
diff --git a/src/perl/.version b/src/perl/.version
deleted file mode 120000
index b7badcd0cc85..000000000000
--- a/src/perl/.version
+++ /dev/null
@@ -1 +0,0 @@
-../../.version
\ No newline at end of file
diff --git a/src/perl/.yath.rc.in b/src/perl/.yath.rc.in
deleted file mode 100644
index e6f5f93ecdd1..000000000000
--- a/src/perl/.yath.rc.in
+++ /dev/null
@@ -1,2 +0,0 @@
-[test]
--I=rel(@lib_dir@)
diff --git a/src/perl/MANIFEST b/src/perl/MANIFEST
deleted file mode 100644
index 08897647c978..000000000000
--- a/src/perl/MANIFEST
+++ /dev/null
@@ -1,7 +0,0 @@
-Changes
-Makefile.PL
-MANIFEST
-Nix.xs
-README
-t/Nix.t
-lib/Nix.pm
diff --git a/src/perl/lib/Nix/Config.pm.in b/src/perl/lib/Nix/Config.pm.in
deleted file mode 100644
index ad51cff3b28b..000000000000
--- a/src/perl/lib/Nix/Config.pm.in
+++ /dev/null
@@ -1,24 +0,0 @@
-package Nix::Config;
-
-use MIME::Base64;
-use Nix::Store;
-
-$version = "@PACKAGE_VERSION@";
-
-$storeDir = Nix::Store::getStoreDir;
-
-%config = ();
-
-sub readConfig {
-    my $config = "$confDir/nix.conf";
-    return unless -f $config;
-
-    open CONFIG, "<$config" or die "cannot open '$config'";
-    while (<CONFIG>) {
-        /^\s*([\w\-\.]+)\s*=\s*(.*)$/ or next;
-        $config{$1} = $2;
-    }
-    close CONFIG;
-}
-
-return 1;
diff --git a/src/perl/lib/Nix/CopyClosure.pm b/src/perl/lib/Nix/CopyClosure.pm
deleted file mode 100644
index 902ee1a1bc9f..000000000000
--- a/src/perl/lib/Nix/CopyClosure.pm
+++ /dev/null
@@ -1,61 +0,0 @@
-package Nix::CopyClosure;
-
-use utf8;
-use strict;
-use Nix::Config;
-use Nix::Store;
-use Nix::SSH;
-use List::Util qw(sum);
-use IPC::Open2;
-
-
-sub copyToOpen {
-    my ($from, $to, $sshHost, $storePaths, $includeOutputs, $dryRun, $useSubstitutes) = @_;
-
-    $useSubstitutes = 0 if $dryRun || !defined $useSubstitutes;
-
-    # Get the closure of this path.
-    my @closure = reverse(topoSortPaths(computeFSClosure(0, $includeOutputs,
-        map { followLinksToStorePath $_ } @{$storePaths})));
-
-    # Send the "query valid paths" command with the "lock" option
-    # enabled. This prevents a race where the remote host
-    # garbage-collect paths that are already there. Optionally, ask
-    # the remote host to substitute missing paths.
-    syswrite($to, pack("L<x4L<x4L<x4", 1, 1, $useSubstitutes)) or die;
-    writeStrings(\@closure, $to);
-
-    # Get back the set of paths that are already valid on the remote host.
-    my %present;
-    $present{$_} = 1 foreach readStrings($from);
-
-    my @missing = grep { !$present{$_} } @closure;
-    return if !@missing;
-
-    my $missingSize = 0;
-    $missingSize += (queryPathInfo($_, 1))[3] foreach @missing;
-
-    printf STDERR "copying %d missing paths (%.2f MiB) to '$sshHost'...\n",
-        scalar(@missing), $missingSize / (1024**2);
-    return if $dryRun;
-
-    # Send the "import paths" command.
-    syswrite($to, pack("L<x4", 4)) or die;
-    exportPaths(fileno($to), @missing);
-    readInt($from) == 1 or die "remote machine '$sshHost' failed to import closure\n";
-}
-
-
-sub copyTo {
-    my ($sshHost, $storePaths, $includeOutputs, $dryRun, $useSubstitutes) = @_;
-
-    # Connect to the remote host.
-    my ($from, $to) = connectToRemoteNix($sshHost, []);
-
-    copyToOpen($from, $to, $sshHost, $storePaths, $includeOutputs, $dryRun, $useSubstitutes);
-
-    close $to;
-}
-
-
-1;
diff --git a/src/perl/lib/Nix/Manifest.pm b/src/perl/lib/Nix/Manifest.pm
deleted file mode 100644
index 6438398e1766..000000000000
--- a/src/perl/lib/Nix/Manifest.pm
+++ /dev/null
@@ -1,325 +0,0 @@
-package Nix::Manifest;
-
-use utf8;
-use strict;
-use DBI;
-use DBD::SQLite;
-use Cwd;
-use File::stat;
-use File::Path;
-use Fcntl ':flock';
-use MIME::Base64;
-use Nix::Config;
-use Nix::Store;
-
-our @ISA = qw(Exporter);
-our @EXPORT = qw(readManifest writeManifest addPatch parseNARInfo fingerprintPath);
-
-
-sub addNAR {
-    my ($narFiles, $storePath, $info) = @_;
-
-    $$narFiles{$storePath} = []
-        unless defined $$narFiles{$storePath};
-
-    my $narFileList = $$narFiles{$storePath};
-
-    my $found = 0;
-    foreach my $narFile (@{$narFileList}) {
-        $found = 1 if $narFile->{url} eq $info->{url};
-    }
-
-    push @{$narFileList}, $info if !$found;
-}
-
-
-sub addPatch {
-    my ($patches, $storePath, $patch) = @_;
-
-    $$patches{$storePath} = []
-        unless defined $$patches{$storePath};
-
-    my $patchList = $$patches{$storePath};
-
-    my $found = 0;
-    foreach my $patch2 (@{$patchList}) {
-        $found = 1 if
-            $patch2->{url} eq $patch->{url} &&
-            $patch2->{basePath} eq $patch->{basePath};
-    }
-
-    push @{$patchList}, $patch if !$found;
-
-    return !$found;
-}
-
-
-sub readManifest_ {
-    my ($manifest, $addNAR, $addPatch) = @_;
-
-    # Decompress the manifest if necessary.
-    if ($manifest =~ /\.bz2$/) {
-        open MANIFEST, "$Nix::Config::bzip2 -d < $manifest |"
-            or die "cannot decompress '$manifest': $!";
-    } else {
-        open MANIFEST, "<$manifest"
-            or die "cannot open '$manifest': $!";
-    }
-
-    my $inside = 0;
-    my $type;
-
-    my $manifestVersion = 2;
-
-    my ($storePath, $url, $hash, $size, $basePath, $baseHash, $patchType);
-    my ($narHash, $narSize, $references, $deriver, $copyFrom, $system, $compressionType);
-
-    while (<MANIFEST>) {
-        chomp;
-        s/\#.*$//g;
-        next if (/^$/);
-
-        if (!$inside) {
-
-            if (/^\s*(\w*)\s*\{$/) {
-                $type = $1;
-                $type = "narfile" if $type eq "";
-                $inside = 1;
-                undef $storePath;
-                undef $url;
-                undef $hash;
-                undef $size;
-                undef $narHash;
-                undef $narSize;
-                undef $basePath;
-                undef $baseHash;
-                undef $patchType;
-                undef $system;
-                $references = "";
-                $deriver = "";
-                $compressionType = "bzip2";
-            }
-
-        } else {
-
-            if (/^\}$/) {
-                $inside = 0;
-
-                if ($type eq "narfile") {
-                    &$addNAR($storePath,
-                        { url => $url, hash => $hash, size => $size
-                        , narHash => $narHash, narSize => $narSize
-                        , references => $references
-                        , deriver => $deriver
-                        , system => $system
-                        , compressionType => $compressionType
-                        });
-                }
-
-                elsif ($type eq "patch") {
-                    &$addPatch($storePath,
-                        { url => $url, hash => $hash, size => $size
-                        , basePath => $basePath, baseHash => $baseHash
-                        , narHash => $narHash, narSize => $narSize
-                        , patchType => $patchType
-                        });
-                }
-
-            }
-
-            elsif (/^\s*StorePath:\s*(\/\S+)\s*$/) { $storePath = $1; }
-            elsif (/^\s*CopyFrom:\s*(\/\S+)\s*$/) { $copyFrom = $1; }
-            elsif (/^\s*Hash:\s*(\S+)\s*$/) { $hash = $1; }
-            elsif (/^\s*URL:\s*(\S+)\s*$/) { $url = $1; }
-            elsif (/^\s*Compression:\s*(\S+)\s*$/) { $compressionType = $1; }
-            elsif (/^\s*Size:\s*(\d+)\s*$/) { $size = $1; }
-            elsif (/^\s*BasePath:\s*(\/\S+)\s*$/) { $basePath = $1; }
-            elsif (/^\s*BaseHash:\s*(\S+)\s*$/) { $baseHash = $1; }
-            elsif (/^\s*Type:\s*(\S+)\s*$/) { $patchType = $1; }
-            elsif (/^\s*NarHash:\s*(\S+)\s*$/) { $narHash = $1; }
-            elsif (/^\s*NarSize:\s*(\d+)\s*$/) { $narSize = $1; }
-            elsif (/^\s*References:\s*(.*)\s*$/) { $references = $1; }
-            elsif (/^\s*Deriver:\s*(\S+)\s*$/) { $deriver = $1; }
-            elsif (/^\s*ManifestVersion:\s*(\d+)\s*$/) { $manifestVersion = $1; }
-            elsif (/^\s*System:\s*(\S+)\s*$/) { $system = $1; }
-
-            # Compatibility;
-            elsif (/^\s*NarURL:\s*(\S+)\s*$/) { $url = $1; }
-            elsif (/^\s*MD5:\s*(\S+)\s*$/) { $hash = "md5:$1"; }
-
-        }
-    }
-
-    close MANIFEST;
-
-    return $manifestVersion;
-}
-
-
-sub readManifest {
-    my ($manifest, $narFiles, $patches) = @_;
-    readManifest_($manifest,
-        sub { addNAR($narFiles, @_); },
-        sub { addPatch($patches, @_); } );
-}
-
-
-sub writeManifest {
-    my ($manifest, $narFiles, $patches, $noCompress) = @_;
-
-    open MANIFEST, ">$manifest.tmp"; # !!! check exclusive
-
-    print MANIFEST "version {\n";
-    print MANIFEST "  ManifestVersion: 3\n";
-    print MANIFEST "}\n";
-
-    foreach my $storePath (sort (keys %{$narFiles})) {
-        my $narFileList = $$narFiles{$storePath};
-        foreach my $narFile (@{$narFileList}) {
-            print MANIFEST "{\n";
-            print MANIFEST "  StorePath: $storePath\n";
-            print MANIFEST "  NarURL: $narFile->{url}\n";
-            print MANIFEST "  Compression: $narFile->{compressionType}\n";
-            print MANIFEST "  Hash: $narFile->{hash}\n" if defined $narFile->{hash};
-            print MANIFEST "  Size: $narFile->{size}\n" if defined $narFile->{size};
-            print MANIFEST "  NarHash: $narFile->{narHash}\n";
-            print MANIFEST "  NarSize: $narFile->{narSize}\n" if $narFile->{narSize};
-            print MANIFEST "  References: $narFile->{references}\n"
-                if defined $narFile->{references} && $narFile->{references} ne "";
-            print MANIFEST "  Deriver: $narFile->{deriver}\n"
-                if defined $narFile->{deriver} && $narFile->{deriver} ne "";
-            print MANIFEST "  System: $narFile->{system}\n" if defined $narFile->{system};
-            print MANIFEST "}\n";
-        }
-    }
-
-    foreach my $storePath (sort (keys %{$patches})) {
-        my $patchList = $$patches{$storePath};
-        foreach my $patch (@{$patchList}) {
-            print MANIFEST "patch {\n";
-            print MANIFEST "  StorePath: $storePath\n";
-            print MANIFEST "  NarURL: $patch->{url}\n";
-            print MANIFEST "  Hash: $patch->{hash}\n";
-            print MANIFEST "  Size: $patch->{size}\n";
-            print MANIFEST "  NarHash: $patch->{narHash}\n";
-            print MANIFEST "  NarSize: $patch->{narSize}\n" if $patch->{narSize};
-            print MANIFEST "  BasePath: $patch->{basePath}\n";
-            print MANIFEST "  BaseHash: $patch->{baseHash}\n";
-            print MANIFEST "  Type: $patch->{patchType}\n";
-            print MANIFEST "}\n";
-        }
-    }
-
-
-    close MANIFEST;
-
-    rename("$manifest.tmp", $manifest)
-        or die "cannot rename $manifest.tmp: $!";
-
-
-    # Create a bzipped manifest.
-    unless (defined $noCompress) {
-        system("$Nix::Config::bzip2 < $manifest > $manifest.bz2.tmp") == 0
-            or die "cannot compress manifest";
-
-        rename("$manifest.bz2.tmp", "$manifest.bz2")
-            or die "cannot rename $manifest.bz2.tmp: $!";
-    }
-}
-
-
-# Return a fingerprint of a store path to be used in binary cache
-# signatures. It contains the store path, the base-32 SHA-256 hash of
-# the contents of the path, and the references.
-sub fingerprintPath {
-    my ($storePath, $narHash, $narSize, $references) = @_;
-    die if substr($storePath, 0, length($Nix::Config::storeDir)) ne $Nix::Config::storeDir;
-    die if substr($narHash, 0, 7) ne "sha256:";
-    # Convert hash from base-16 to base-32, if necessary.
-    $narHash = "sha256:" . convertHash("sha256", substr($narHash, 7), 1)
-        if length($narHash) == 71;
-    die if length($narHash) != 59;
-    foreach my $ref (@{$references}) {
-        die if substr($ref, 0, length($Nix::Config::storeDir)) ne $Nix::Config::storeDir;
-    }
-    return "1;" . $storePath . ";" . $narHash . ";" . $narSize . ";" . join(",", @{$references});
-}
-
-
-# Parse a NAR info file.
-sub parseNARInfo {
-    my ($storePath, $content, $requireValidSig, $location) = @_;
-
-    my ($storePath2, $url, $fileHash, $fileSize, $narHash, $narSize, $deriver, $system, $sig);
-    my $compression = "bzip2";
-    my @refs;
-
-    foreach my $line (split "\n", $content) {
-        return undef unless $line =~ /^(.*): (.*)$/;
-        if ($1 eq "StorePath") { $storePath2 = $2; }
-        elsif ($1 eq "URL") { $url = $2; }
-        elsif ($1 eq "Compression") { $compression = $2; }
-        elsif ($1 eq "FileHash") { $fileHash = $2; }
-        elsif ($1 eq "FileSize") { $fileSize = int($2); }
-        elsif ($1 eq "NarHash") { $narHash = $2; }
-        elsif ($1 eq "NarSize") { $narSize = int($2); }
-        elsif ($1 eq "References") { @refs = split / /, $2; }
-        elsif ($1 eq "Deriver") { $deriver = $2; }
-        elsif ($1 eq "System") { $system = $2; }
-        elsif ($1 eq "Sig") { $sig = $2; }
-    }
-
-    return undef if $storePath ne $storePath2 || !defined $url || !defined $narHash;
-
-    my $res =
-        { url => $url
-        , compression => $compression
-        , fileHash => $fileHash
-        , fileSize => $fileSize
-        , narHash => $narHash
-        , narSize => $narSize
-        , refs => [ @refs ]
-        , deriver => $deriver
-        , system => $system
-        };
-
-    if ($requireValidSig) {
-        # FIXME: might be useful to support multiple signatures per .narinfo.
-
-        if (!defined $sig) {
-            warn "NAR info file '$location' lacks a signature; ignoring\n";
-            return undef;
-        }
-        my ($keyName, $sig64) = split ":", $sig;
-        return undef unless defined $keyName && defined $sig64;
-
-        my $publicKey = $Nix::Config::binaryCachePublicKeys{$keyName};
-        if (!defined $publicKey) {
-            warn "NAR info file '$location' is signed by unknown key '$keyName'; ignoring\n";
-            return undef;
-        }
-
-        my $fingerprint;
-        eval {
-            $fingerprint = fingerprintPath(
-                $storePath, $narHash, $narSize,
-                [ map { "$Nix::Config::storeDir/$_" } @refs ]);
-        };
-        if ($@) {
-            warn "cannot compute fingerprint of '$location'; ignoring\n";
-            return undef;
-        }
-
-        if (!checkSignature($publicKey, decode_base64($sig64), $fingerprint)) {
-            warn "NAR info file '$location' has an incorrect signature; ignoring\n";
-            return undef;
-        }
-
-        $res->{signedBy} = $keyName;
-    }
-
-    return $res;
-}
-
-
-return 1;
diff --git a/src/perl/lib/Nix/SSH.pm b/src/perl/lib/Nix/SSH.pm
deleted file mode 100644
index 490ba0ea991e..000000000000
--- a/src/perl/lib/Nix/SSH.pm
+++ /dev/null
@@ -1,110 +0,0 @@
-package Nix::SSH;
-
-use utf8;
-use strict;
-use File::Temp qw(tempdir);
-use IPC::Open2;
-
-our @ISA = qw(Exporter);
-our @EXPORT = qw(
-  @globalSshOpts
-  readN readInt readString readStrings
-  writeInt writeString writeStrings
-  connectToRemoteNix
-);
-
-
-our @globalSshOpts = split ' ', ($ENV{"NIX_SSHOPTS"} or "");
-
-
-sub readN {
-    my ($bytes, $from) = @_;
-    my $res = "";
-    while ($bytes > 0) {
-        my $s;
-        my $n = sysread($from, $s, $bytes);
-        die "I/O error reading from remote side\n" if !defined $n;
-        die "got EOF while expecting $bytes bytes from remote side\n" if !$n;
-        $bytes -= $n;
-        $res .= $s;
-    }
-    return $res;
-}
-
-
-sub readInt {
-    my ($from) = @_;
-    return unpack("L<x4", readN(8, $from));
-}
-
-
-sub readString {
-    my ($from) = @_;
-    my $len = readInt($from);
-    my $s = readN($len, $from);
-    readN(8 - $len % 8, $from) if $len % 8; # skip padding
-    return $s;
-}
-
-
-sub readStrings {
-    my ($from) = @_;
-    my $n = readInt($from);
-    my @res;
-    push @res, readString($from) while $n--;
-    return @res;
-}
-
-
-sub writeInt {
-    my ($n, $to) = @_;
-    syswrite($to, pack("L<x4", $n)) or die;
-}
-
-
-sub writeString {
-    my ($s, $to) = @_;
-    my $len = length $s;
-    my $req .= pack("L<x4", $len);
-    $req .= $s;
-    $req .= "\000" x (8 - $len % 8) if $len % 8;
-    syswrite($to, $req) or die;
-}
-
-
-sub writeStrings {
-    my ($ss, $to) = @_;
-    writeInt(scalar(@{$ss}), $to);
-    writeString($_, $to) foreach @{$ss};
-}
-
-
-sub connectToRemoteNix {
-    my ($sshHost, $sshOpts, $extraFlags) = @_;
-
-    $extraFlags ||= "";
-
-    # Start ‘nix-store --serve’ on the remote host.
-    my ($from, $to);
-    # FIXME: don't start a shell, start ssh directly.
-    my $pid = open2($from, $to, "exec ssh -x -a $sshHost @globalSshOpts @{$sshOpts} nix-store --serve --write $extraFlags");
-
-    # Do the handshake.
-    my $magic;
-    eval {
-        my $SERVE_MAGIC_1 = 0x390c9deb; # FIXME
-        my $clientVersion = 0x200;
-        syswrite($to, pack("L<x4L<x4", $SERVE_MAGIC_1, $clientVersion)) or die;
-        $magic = readInt($from);
-    };
-    die "unable to connect to '$sshHost'\n" if $@;
-    die "did not get valid handshake from remote host\n" if $magic  != 0x5452eecb;
-
-    my $serverVersion = readInt($from);
-    die "unsupported server version\n" if $serverVersion < 0x200 || $serverVersion >= 0x300;
-
-    return ($from, $to, $pid);
-}
-
-
-1;
diff --git a/src/perl/lib/Nix/Store.pm b/src/perl/lib/Nix/Store.pm
deleted file mode 100644
index f2ae7e88f81d..000000000000
--- a/src/perl/lib/Nix/Store.pm
+++ /dev/null
@@ -1,45 +0,0 @@
-package Nix::Store;
-
-use strict;
-use warnings;
-
-require Exporter;
-
-our @ISA = qw(Exporter);
-
-our %EXPORT_TAGS = ( 'all' => [ qw( ) ] );
-
-our @EXPORT_OK = ( @{ $EXPORT_TAGS{'all'} } );
-
-our @EXPORT = qw(
-    StoreWrapper
-    StoreWrapper::new
-    StoreWrapper::isValidPath StoreWrapper::queryReferences StoreWrapper::queryPathInfo StoreWrapper::queryDeriver StoreWrapper::queryPathHash
-    StoreWrapper::queryPathFromHashPart
-    StoreWrapper::topoSortPaths StoreWrapper::computeFSClosure followLinksToStorePath StoreWrapper::exportPaths StoreWrapper::importPaths
-    StoreWrapper::addToStore StoreWrapper::makeFixedOutputPath
-    StoreWrapper::derivationFromPath
-    StoreWrapper::addTempRoot
-    StoreWrapper::queryRawRealisation
-
-    hashPath hashFile hashString convertHash
-    signString checkSignature
-    getStoreDir
-    setVerbosity
-);
-
-our $VERSION = '0.15';
-
-sub backtick {
-    open(RES, "-|", @_) or die;
-    local $/;
-    my $res = <RES> || "";
-    close RES or die;
-    return $res;
-}
-
-require XSLoader;
-XSLoader::load('Nix::Store', $VERSION);
-
-1;
-__END__
diff --git a/src/perl/lib/Nix/Store.xs b/src/perl/lib/Nix/Store.xs
deleted file mode 100644
index b0f70be3a9e8..000000000000
--- a/src/perl/lib/Nix/Store.xs
+++ /dev/null
@@ -1,430 +0,0 @@
-#include "EXTERN.h"
-#include "perl.h"
-#include "XSUB.h"
-
-/* Prevent a clash between some Perl and libstdc++ macros. */
-#undef do_open
-#undef do_close
-
-#include "nix/store/derivations.hh"
-#include "nix/store/realisation.hh"
-#include "nix/store/globals.hh"
-#include "nix/store/store-open.hh"
-#include "nix/util/posix-source-accessor.hh"
-#include "nix/store/export-import.hh"
-
-#include <sodium.h>
-#include <nlohmann/json.hpp>
-
-using namespace nix;
-
-static bool libStoreInitialized = false;
-
-struct StoreWrapper {
-    ref<Store> store;
-};
-
-MODULE = Nix::Store PACKAGE = Nix::Store
-PROTOTYPES: ENABLE
-
-TYPEMAP: <<HERE
-StoreWrapper *      O_OBJECT
-
-OUTPUT
-O_OBJECT
-    sv_setref_pv( $arg, CLASS, (void*)$var );
-
-INPUT
-O_OBJECT
-    if ( sv_isobject($arg) && (SvTYPE(SvRV($arg)) == SVt_PVMG) ) {
-        $var = ($type)SvIV((SV*)SvRV( $arg ));
-    }
-    else {
-        warn( \"${Package}::$func_name() -- \"
-		\"$var not a blessed SV reference\");
-        XSRETURN_UNDEF;
-    }
-HERE
-
-#undef dNOOP // Hack to work around "error: declaration of 'Perl___notused' has a different language linkage" error message on clang.
-#define dNOOP
-
-void
-StoreWrapper::DESTROY()
-
-StoreWrapper *
-StoreWrapper::new(char * s = nullptr)
-    CODE:
-        static std::shared_ptr<Store> _store;
-        try {
-            if (!libStoreInitialized) {
-                initLibStore();
-                libStoreInitialized = true;
-            }
-            if (items == 1) {
-                _store = openStore();
-                RETVAL = new StoreWrapper {
-                    .store = ref<Store>{_store}
-                };
-            } else {
-                RETVAL = new StoreWrapper {
-                    .store = openStore(s)
-                };
-            }
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-    OUTPUT:
-        RETVAL
-
-
-void init()
-    CODE:
-        if (!libStoreInitialized) {
-            initLibStore();
-            libStoreInitialized = true;
-        }
-
-
-void setVerbosity(int level)
-    CODE:
-        verbosity = (Verbosity) level;
-
-
-int
-StoreWrapper::isValidPath(char * path)
-    CODE:
-        try {
-            RETVAL = THIS->store->isValidPath(THIS->store->parseStorePath(path));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-    OUTPUT:
-        RETVAL
-
-
-SV *
-StoreWrapper::queryReferences(char * path)
-    PPCODE:
-        try {
-            for (auto & i : THIS->store->queryPathInfo(THIS->store->parseStorePath(path))->references)
-                XPUSHs(sv_2mortal(newSVpv(THIS->store->printStorePath(i).c_str(), 0)));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV *
-StoreWrapper::queryPathHash(char * path)
-    PPCODE:
-        try {
-            auto s = THIS->store->queryPathInfo(THIS->store->parseStorePath(path))->narHash.to_string(HashFormat::Nix32, true);
-            XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV *
-StoreWrapper::queryDeriver(char * path)
-    PPCODE:
-        try {
-            auto info = THIS->store->queryPathInfo(THIS->store->parseStorePath(path));
-            if (!info->deriver) XSRETURN_UNDEF;
-            XPUSHs(sv_2mortal(newSVpv(THIS->store->printStorePath(*info->deriver).c_str(), 0)));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV *
-StoreWrapper::queryPathInfo(char * path, int base32)
-    PPCODE:
-        try {
-            auto info = THIS->store->queryPathInfo(THIS->store->parseStorePath(path));
-            if (!info->deriver)
-                XPUSHs(&PL_sv_undef);
-            else
-                XPUSHs(sv_2mortal(newSVpv(THIS->store->printStorePath(*info->deriver).c_str(), 0)));
-            auto s = info->narHash.to_string(base32 ? HashFormat::Nix32 : HashFormat::Base16, true);
-            XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
-            mXPUSHi(info->registrationTime);
-            mXPUSHi(info->narSize);
-            AV * refs = newAV();
-            for (auto & i : info->references)
-                av_push(refs, newSVpv(THIS->store->printStorePath(i).c_str(), 0));
-            XPUSHs(sv_2mortal(newRV((SV *) refs)));
-            AV * sigs = newAV();
-            for (auto & i : info->sigs)
-                av_push(sigs, newSVpv(i.to_string().c_str(), 0));
-            XPUSHs(sv_2mortal(newRV((SV *) sigs)));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-SV *
-StoreWrapper::queryRawRealisation(char * drvPath, char * outputName)
-    PPCODE:
-      try {
-        auto realisation = THIS->store->queryRealisation(DrvOutput{
-            .drvPath = THIS->store->parseStorePath(drvPath),
-            .outputName = outputName,
-        });
-        if (realisation)
-            XPUSHs(sv_2mortal(newSVpv(static_cast<nlohmann::json>(*realisation).dump().c_str(), 0)));
-        else
-            XPUSHs(sv_2mortal(newSVpv("", 0)));
-      } catch (Error & e) {
-        croak("%s", e.what());
-      }
-
-
-SV *
-StoreWrapper::queryPathFromHashPart(char * hashPart)
-    PPCODE:
-        try {
-            auto path = THIS->store->queryPathFromHashPart(hashPart);
-            XPUSHs(sv_2mortal(newSVpv(path ? THIS->store->printStorePath(*path).c_str() : "", 0)));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV *
-StoreWrapper::computeFSClosure(int flipDirection, int includeOutputs, ...)
-    PPCODE:
-        try {
-            StorePathSet paths;
-            for (int n = 3; n < items; ++n)
-                THIS->store->computeFSClosure(THIS->store->parseStorePath(SvPV_nolen(ST(n))), paths, flipDirection, includeOutputs);
-            for (auto & i : paths)
-                XPUSHs(sv_2mortal(newSVpv(THIS->store->printStorePath(i).c_str(), 0)));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV *
-StoreWrapper::topoSortPaths(...)
-    PPCODE:
-        try {
-            StorePathSet paths;
-            for (int n = 1; n < items; ++n) paths.insert(THIS->store->parseStorePath(SvPV_nolen(ST(n))));
-            auto sorted = THIS->store->topoSortPaths(paths);
-            for (auto & i : sorted)
-                XPUSHs(sv_2mortal(newSVpv(THIS->store->printStorePath(i).c_str(), 0)));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV *
-StoreWrapper::followLinksToStorePath(char * path)
-    CODE:
-        try {
-            RETVAL = newSVpv(THIS->store->printStorePath(THIS->store->followLinksToStorePath(path)).c_str(), 0);
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-    OUTPUT:
-        RETVAL
-
-
-void
-StoreWrapper::exportPaths(int fd, ...)
-    PPCODE:
-        try {
-            StorePathSet paths;
-            for (int n = 2; n < items; ++n) paths.insert(THIS->store->parseStorePath(SvPV_nolen(ST(n))));
-            FdSink sink(fd);
-            exportPaths(*THIS->store, paths, sink);
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-void
-StoreWrapper::importPaths(int fd, int dontCheckSigs)
-    PPCODE:
-        try {
-            FdSource source(fd);
-            importPaths(*THIS->store, source, dontCheckSigs ? NoCheckSigs : CheckSigs);
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV *
-hashPath(char * algo, int base32, char * path)
-    PPCODE:
-        try {
-            Hash h = hashPath(
-                PosixSourceAccessor::createAtRoot(path),
-                FileIngestionMethod::NixArchive, parseHashAlgo(algo)).first;
-            auto s = h.to_string(base32 ? HashFormat::Nix32 : HashFormat::Base16, false);
-            XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV * hashFile(char * algo, int base32, char * path)
-    PPCODE:
-        try {
-            Hash h = hashFile(parseHashAlgo(algo), path);
-            auto s = h.to_string(base32 ? HashFormat::Nix32 : HashFormat::Base16, false);
-            XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV * hashString(char * algo, int base32, char * s)
-    PPCODE:
-        try {
-            Hash h = hashString(parseHashAlgo(algo), s);
-            auto s = h.to_string(base32 ? HashFormat::Nix32 : HashFormat::Base16, false);
-            XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV * convertHash(char * algo, char * s, int toBase32)
-    PPCODE:
-        try {
-            auto h = Hash::parseAny(s, parseHashAlgo(algo));
-            auto s = h.to_string(toBase32 ? HashFormat::Nix32 : HashFormat::Base16, false);
-            XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV * signString(char * secretKey_, char * msg)
-    PPCODE:
-        try {
-            auto sig = SecretKey(secretKey_).signDetached(msg).to_string();
-            XPUSHs(sv_2mortal(newSVpv(sig.c_str(), sig.size())));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-int checkSignature(SV * publicKey_, SV * sig_, char * msg)
-    CODE:
-        try {
-            STRLEN publicKeyLen;
-            unsigned char * publicKey = (unsigned char *) SvPV(publicKey_, publicKeyLen);
-            if (publicKeyLen != crypto_sign_PUBLICKEYBYTES)
-                throw Error("public key is not valid");
-
-            STRLEN sigLen;
-            unsigned char * sig = (unsigned char *) SvPV(sig_, sigLen);
-            if (sigLen != crypto_sign_BYTES)
-                throw Error("signature is not valid");
-
-            RETVAL = crypto_sign_verify_detached(sig, (unsigned char *) msg, strlen(msg), publicKey) == 0;
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-    OUTPUT:
-        RETVAL
-
-
-SV *
-StoreWrapper::addToStore(char * srcPath, int recursive, char * algo)
-    PPCODE:
-        try {
-            auto method = recursive ? ContentAddressMethod::Raw::NixArchive : ContentAddressMethod::Raw::Flat;
-            auto path = THIS->store->addToStore(
-                std::string(baseNameOf(srcPath)),
-                PosixSourceAccessor::createAtRoot(srcPath),
-                method, parseHashAlgo(algo));
-            XPUSHs(sv_2mortal(newSVpv(THIS->store->printStorePath(path).c_str(), 0)));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV *
-StoreWrapper::makeFixedOutputPath(int recursive, char * algo, char * hash, char * name)
-    PPCODE:
-        try {
-            auto h = Hash::parseAny(hash, parseHashAlgo(algo));
-            auto method = recursive ? FileIngestionMethod::NixArchive : FileIngestionMethod::Flat;
-            auto path = THIS->store->makeFixedOutputPath(name, FixedOutputInfo {
-                .method = method,
-                .hash = h,
-                .references = {},
-            });
-            XPUSHs(sv_2mortal(newSVpv(THIS->store->printStorePath(path).c_str(), 0)));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV *
-StoreWrapper::derivationFromPath(char * drvPath)
-    PREINIT:
-        HV *hash;
-    CODE:
-        try {
-            Derivation drv = THIS->store->derivationFromPath(THIS->store->parseStorePath(drvPath));
-            hash = newHV();
-
-            HV * outputs = newHV();
-            for (auto & i : drv.outputsAndOptPaths(*THIS->store)) {
-                hv_store(
-                    outputs, i.first.c_str(), i.first.size(),
-                    !i.second.second
-                        ? newSV(0) /* null value */
-                        : newSVpv(THIS->store->printStorePath(*i.second.second).c_str(), 0),
-                    0);
-            }
-            hv_stores(hash, "outputs", newRV((SV *) outputs));
-
-            AV * inputDrvs = newAV();
-            for (auto & i : drv.inputDrvs.map)
-                av_push(inputDrvs, newSVpv(THIS->store->printStorePath(i.first).c_str(), 0)); // !!! ignores i->second
-            hv_stores(hash, "inputDrvs", newRV((SV *) inputDrvs));
-
-            AV * inputSrcs = newAV();
-            for (auto & i : drv.inputSrcs)
-                av_push(inputSrcs, newSVpv(THIS->store->printStorePath(i).c_str(), 0));
-            hv_stores(hash, "inputSrcs", newRV((SV *) inputSrcs));
-
-            hv_stores(hash, "platform", newSVpv(drv.platform.c_str(), 0));
-            hv_stores(hash, "builder", newSVpv(drv.builder.c_str(), 0));
-
-            AV * args = newAV();
-            for (auto & i : drv.args)
-                av_push(args, newSVpv(i.c_str(), 0));
-            hv_stores(hash, "args", newRV((SV *) args));
-
-            HV * env = newHV();
-            for (auto & i : drv.env)
-                hv_store(env, i.first.c_str(), i.first.size(), newSVpv(i.second.c_str(), 0), 0);
-            hv_stores(hash, "env", newRV((SV *) env));
-
-            RETVAL = newRV_noinc((SV *)hash);
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-    OUTPUT:
-        RETVAL
-
-
-void
-StoreWrapper::addTempRoot(char * storePath)
-    PPCODE:
-        try {
-            THIS->store->addTempRoot(THIS->store->parseStorePath(storePath));
-        } catch (Error & e) {
-            croak("%s", e.what());
-        }
-
-
-SV * getStoreDir()
-    PPCODE:
-        XPUSHs(sv_2mortal(newSVpv(resolveStoreConfig(StoreReference{settings.storeUri.get()})->storeDir.c_str(), 0)));
diff --git a/src/perl/lib/Nix/Utils.pm b/src/perl/lib/Nix/Utils.pm
deleted file mode 100644
index 44955a70698c..000000000000
--- a/src/perl/lib/Nix/Utils.pm
+++ /dev/null
@@ -1,47 +0,0 @@
-package Nix::Utils;
-
-use utf8;
-use File::Temp qw(tempdir);
-
-our @ISA = qw(Exporter);
-our @EXPORT = qw(checkURL uniq writeFile readFile mkTempDir);
-
-$urlRE = "(?: [a-zA-Z][a-zA-Z0-9\+\-\.]*\:[a-zA-Z0-9\%\/\?\:\@\&\=\+\$\,\-\_\.\!\~\*]+ )";
-
-sub checkURL {
-    my ($url) = @_;
-    die "invalid URL '$url'\n" unless $url =~ /^ $urlRE $ /x;
-}
-
-sub uniq {
-    my %seen;
-    my @res;
-    foreach my $name (@_) {
-        next if $seen{$name};
-        $seen{$name} = 1;
-        push @res, $name;
-    }
-    return @res;
-}
-
-sub writeFile {
-    my ($fn, $s) = @_;
-    open TMP, ">$fn" or die "cannot create file '$fn': $!";
-    print TMP "$s" or die;
-    close TMP or die;
-}
-
-sub readFile {
-    local $/ = undef;
-    my ($fn) = @_;
-    open TMP, "<$fn" or die "cannot open file '$fn': $!";
-    my $s = <TMP>;
-    close TMP or die;
-    return $s;
-}
-
-sub mkTempDir {
-    my ($name) = @_;
-    return tempdir("$name.XXXXXX", CLEANUP => 1, DIR => $ENV{"TMPDIR"} // $ENV{"XDG_RUNTIME_DIR"} // "/tmp")
-        || die "cannot create a temporary directory";
-}
diff --git a/src/perl/lib/Nix/meson.build b/src/perl/lib/Nix/meson.build
deleted file mode 100644
index dd5560e21cc5..000000000000
--- a/src/perl/lib/Nix/meson.build
+++ /dev/null
@@ -1,61 +0,0 @@
-# Nix-Perl Scripts
-#============================================================================
-
-
-
-# Sources
-#-------------------------------------------------
-
-nix_perl_store_xs = files('Store.xs')
-
-nix_perl_scripts = files(
-  'CopyClosure.pm',
-  'Manifest.pm',
-  'SSH.pm',
-  'Store.pm',
-  'Utils.pm',
-)
-
-nix_perl_scripts_copy_tgts = []
-foreach f : nix_perl_scripts
-  nix_perl_scripts_copy_tgts += fs.copyfile(f)
-endforeach
-
-
-# Targets
-#---------------------------------------------------
-
-nix_perl_scripts += configure_file(
-  output : 'Config.pm',
-  input : 'Config.pm.in',
-  configuration : nix_perl_conf,
-)
-
-nix_perl_store_cc = custom_target(
-  'Store.cc',
-  output : 'Store.cc',
-  input : nix_perl_store_xs,
-  command : [ xsubpp, '@INPUT@', '-output', '@OUTPUT@' ],
-)
-
-# Build Nix::Store Library
-#-------------------------------------------------
-nix_perl_store_lib = library(
-  'Store',
-  sources : nix_perl_store_cc,
-  name_prefix : '',
-  prelink : true, # For C++ static initializers
-  install : true,
-  install_mode : 'rwxr-xr-x',
-  install_dir : join_paths(nix_perl_install_dir, 'auto', 'Nix', 'Store'),
-  dependencies : nix_perl_store_dep_list,
-)
-
-
-# Install Scripts
-#---------------------------------------------------
-install_data(
-  nix_perl_scripts,
-  install_mode : 'rw-r--r--',
-  install_dir : join_paths(nix_perl_install_dir, 'Nix'),
-)
diff --git a/src/perl/meson.build b/src/perl/meson.build
deleted file mode 100644
index 59f2a66b8386..000000000000
--- a/src/perl/meson.build
+++ /dev/null
@@ -1,196 +0,0 @@
-# Nix-Perl Meson build
-#============================================================================
-
-
-# init project
-#============================================================================
-project(
-  'nix-perl',
-  'cpp',
-  version : files('.version'),
-  meson_version : '>= 1.1',
-  license : 'LGPL-2.1-or-later',
-)
-
-# setup env
-#-------------------------------------------------
-fs = import('fs')
-cpp = meson.get_compiler('cpp')
-nix_perl_conf = configuration_data()
-nix_perl_conf.set('PACKAGE_VERSION', meson.project_version())
-
-
-# set error arguments
-#-------------------------------------------------
-error_args = [
-  '-Wdeprecated-copy',
-  '-Wdeprecated-declarations',
-  '-Werror=suggest-override',
-  '-Werror=unused-result',
-  '-Wignored-qualifiers',
-  '-Wno-duplicate-decl-specifier',
-  '-Wno-literal-suffix',
-  '-Wno-missing-field-initializers',
-  '-Wno-non-virtual-dtor',
-  '-Wno-pedantic',
-  '-Wno-pointer-bool-conversion',
-  '-Wno-reserved-user-defined-literal',
-  '-Wno-unknown-warning-option',
-  '-Wno-unused-parameter',
-  '-Wno-unused-variable',
-  '-Wno-variadic-macros',
-]
-
-add_project_arguments(
-  cpp.get_supported_arguments(error_args),
-  language : 'cpp',
-)
-
-
-# set install directories
-#-------------------------------------------------
-prefix = get_option('prefix')
-libdir = join_paths(prefix, get_option('libdir'))
-
-# Dependencies
-#============================================================================
-
-# Required Programs
-#-------------------------------------------------
-find_program('xz')
-xsubpp = find_program('xsubpp')
-perl = find_program('perl')
-find_program('curl')
-yath = find_program('yath', required : false)
-
-# Required Libraries
-#-------------------------------------------------
-bzip2_dep = dependency('bzip2', required : false)
-if not bzip2_dep.found()
-  bzip2_dep = cpp.find_library('bz2')
-  if not bzip2_dep.found()
-    error('No "bzip2" pkg-config or "bz2" library found')
-  endif
-endif
-curl_dep = dependency('libcurl')
-libsodium_dep = dependency('libsodium')
-
-nix_store_dep = dependency('nix-store')
-
-
-# Finding Perl Headers is a pain. as they do not have
-# pkgconfig available, are not in a standard location,
-# and are installed into a version folder. Use the
-# Perl binary to give hints about perl include dir.
-#
-# Note that until we have a better solution for this, cross-compiling
-# the perl bindings does not appear to be possible.
-#-------------------------------------------------
-perl_archname = run_command(
-  perl,
-  '-e',
-  'use Config; print $Config{archname};',
-  check : true,
-).stdout()
-perl_version = run_command(
-  perl,
-  '-e',
-  'use Config; print $Config{version};',
-  check : true,
-).stdout()
-perl_archlibexp = run_command(
-  perl,
-  '-e',
-  'use Config; print $Config{archlibexp};',
-  check : true,
-).stdout()
-perl_site_libdir = run_command(
-  perl,
-  '-e',
-  'use Config; print $Config{installsitearch};',
-  check : true,
-).stdout()
-nix_perl_install_dir = join_paths(
-  libdir,
-  'perl5',
-  'site_perl',
-  perl_version,
-  perl_archname,
-)
-
-
-# print perl hints for logs
-#-------------------------------------------------
-message('Perl archname: @0@'.format(perl_archname))
-message('Perl version: @0@'.format(perl_version))
-message('Perl archlibexp: @0@'.format(perl_archlibexp))
-message('Perl install site: @0@'.format(perl_site_libdir))
-message('Assumed Nix-Perl install dir: @0@'.format(nix_perl_install_dir))
-
-# Now find perl modules
-#-------------------------------------------------
-perl_check_dbi = run_command(
-  perl,
-  '-e',
-  'use DBI; use DBD::SQLite;',
-  '-I@0@'.format(get_option('dbi_path')),
-  '-I@0@'.format(get_option('dbd_sqlite_path')),
-  check : true,
-)
-
-if perl_check_dbi.returncode() == 2
-  error('The Perl modules DBI and/or DBD::SQLite are missing.')
-else
-  message('Found Perl Modules: DBI, DBD::SQLite.')
-endif
-
-
-
-# declare perl dependency
-#-------------------------------------------------
-perl_dep = declare_dependency(
-  dependencies : cpp.find_library(
-    'perl',
-    has_headers : [
-      join_paths(perl_archlibexp, 'CORE', 'perl.h'),
-      join_paths(perl_archlibexp, 'CORE', 'EXTERN.h'),
-    ],
-    dirs : [
-      join_paths(perl_archlibexp, 'CORE'),
-    ],
-  ),
-  include_directories : join_paths(perl_archlibexp, 'CORE'),
-)
-
-# declare dependencies
-#-------------------------------------------------
-nix_perl_store_dep_list = [
-  perl_dep,
-  bzip2_dep,
-  curl_dep,
-  libsodium_dep,
-  nix_store_dep,
-]
-
-# # build
-# #-------------------------------------------------
-lib_dir = join_paths('lib', 'Nix')
-subdir(lib_dir)
-
-if get_option('tests').enabled()
-  yath_rc_conf = configuration_data()
-  yath_rc_conf.set('lib_dir', lib_dir)
-  configure_file(
-    output : '.yath.rc',
-    input : '.yath.rc.in',
-    configuration : yath_rc_conf,
-  )
-  subdir('t')
-  test(
-    'nix-perl-test',
-    yath,
-    args : [ 'test' ],
-    workdir : meson.current_build_dir(),
-    depends : [ nix_perl_store_lib ] + nix_perl_tests_copy_tgts + nix_perl_scripts_copy_tgts,
-  )
-endif
diff --git a/src/perl/meson.options b/src/perl/meson.options
deleted file mode 100644
index 03ddf57f1481..000000000000
--- a/src/perl/meson.options
+++ /dev/null
@@ -1,30 +0,0 @@
-# Nix-Perl build options
-#============================================================================
-
-
-# compiler args
-#============================================================================
-
-option(
-  'tests',
-  type : 'feature',
-  value : 'disabled',
-  description : 'run nix-perl tests',
-)
-
-
-# Location of Perl Modules
-#============================================================================
-option(
-  'dbi_path',
-  type : 'string',
-  value : '/usr',
-  description : 'path to perl::dbi',
-)
-
-option(
-  'dbd_sqlite_path',
-  type : 'string',
-  value : '/usr',
-  description : 'path to perl::dbd-SQLite',
-)
diff --git a/src/perl/package.nix b/src/perl/package.nix
deleted file mode 100644
index e25b2996c83c..000000000000
--- a/src/perl/package.nix
+++ /dev/null
@@ -1,82 +0,0 @@
-{
-  lib,
-  stdenv,
-  mkMesonDerivation,
-  pkg-config,
-  perl,
-  perlPackages,
-  nix-store,
-  version,
-  curl,
-  bzip2,
-  libsodium,
-}:
-
-let
-  inherit (lib) fileset;
-in
-
-perl.pkgs.toPerlModule (
-  mkMesonDerivation (finalAttrs: {
-    pname = "nix-perl";
-    inherit version;
-
-    workDir = ./.;
-    fileset = fileset.unions (
-      [
-        ./.version
-        ../../.version
-        ./MANIFEST
-        ./lib
-        ./meson.build
-        ./meson.options
-      ]
-      ++ lib.optionals finalAttrs.finalPackage.doCheck [
-        ./.yath.rc.in
-        ./t
-      ]
-    );
-
-    nativeBuildInputs = [
-      pkg-config
-      perl
-      curl
-    ];
-
-    buildInputs = [
-      nix-store
-      bzip2
-      libsodium
-      perlPackages.DBI
-      perlPackages.DBDSQLite
-    ];
-
-    # `perlPackages.Test2Harness` is marked broken for Darwin
-    doCheck = !stdenv.isDarwin;
-
-    nativeCheckInputs = [
-      perlPackages.Test2Harness
-    ];
-
-    preConfigure =
-      # "Inline" .version so its not a symlink, and includes the suffix
-      ''
-        chmod u+w .version
-        echo ${finalAttrs.version} > .version
-      '';
-
-    mesonFlags = [
-      (lib.mesonEnable "tests" finalAttrs.finalPackage.doCheck)
-    ];
-
-    mesonCheckFlags = [
-      "--print-errorlogs"
-    ];
-
-    strictDeps = false;
-
-    meta = {
-      platforms = lib.platforms.unix;
-    };
-  })
-)
diff --git a/src/perl/t/init.t b/src/perl/t/init.t
deleted file mode 100644
index 80197e013766..000000000000
--- a/src/perl/t/init.t
+++ /dev/null
@@ -1,13 +0,0 @@
-use strict;
-use warnings;
-use Test2::V0;
-
-use Nix::Store;
-
-my $s = new Nix::Store("dummy://");
-
-my $res = $s->isValidPath("/nix/store/g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar");
-
-ok(!$res, "should not have path");
-
-done_testing;
diff --git a/src/perl/t/meson.build b/src/perl/t/meson.build
deleted file mode 100644
index f95bee2ffc37..000000000000
--- a/src/perl/t/meson.build
+++ /dev/null
@@ -1,15 +0,0 @@
-# Nix-Perl Tests
-#============================================================================
-
-
-# src
-#---------------------------------------------------
-
-nix_perl_tests = files(
-  'init.t',
-)
-
-nix_perl_tests_copy_tgts = []
-foreach f : nix_perl_tests
-  nix_perl_tests_copy_tgts += fs.copyfile(f)
-endforeach
diff --git a/tests/filetransfer-retry-backoff/test_retry_backoff.py b/tests/filetransfer-retry-backoff/test_retry_backoff.py
index 605f593f2190..ce8140d908b3 100644
--- a/tests/filetransfer-retry-backoff/test_retry_backoff.py
+++ b/tests/filetransfer-retry-backoff/test_retry_backoff.py
@@ -16,6 +16,8 @@
 PORT = 0  # set after server starts
 fail_count = 0
 retry_after = "1"
+fail_status = 503
+fail_body = b""
 lock = threading.Lock()
 
 
@@ -27,9 +29,15 @@ def do_GET(self):
             if n > 0:
                 fail_count = n - 1
         if n > 0:
-            self.send_response(503)
-            self.send_header("Retry-After", retry_after)
+            self.send_response(fail_status)
+            if fail_status == 503:
+                self.send_header("Retry-After", retry_after)
+            if fail_body:
+                self.send_header("Content-Type", "application/xml")
+                self.send_header("Content-Length", str(len(fail_body)))
             self.end_headers()
+            if fail_body:
+                self.wfile.write(fail_body)
             return
         self.send_response(200)
         self.send_header("Content-Type", "text/plain")
@@ -41,11 +49,19 @@ def log_message(self, *_args):
         pass
 
 
-def set_failures(n: int, ra: int = 1) -> None:
-    global fail_count, retry_after
+def s3_error_xml(code: str, message: str = "test") -> bytes:
+    return (f'<?xml version="1.0" encoding="UTF-8"?>'
+            f'<Error><Code>{code}</Code>'
+            f'<Message>{message}</Message></Error>').encode()
+
+
+def set_failures(n: int, ra: int = 1, status: int = 503, body: bytes = b"") -> None:
+    global fail_count, retry_after, fail_status, fail_body
     with lock:
         fail_count = n
         retry_after = str(ra)
+        fail_status = status
+        fail_body = body
 
 
 def fetch(extra_opts: str = "") -> tuple[int, str, list[int]]:
@@ -71,6 +87,7 @@ def main() -> None:
         test_retry_exhaustion()
         test_raised_retry_attempts()
         test_download_attempts_alias()
+        test_s3_xml_error_retried()
     finally:
         httpd.shutdown()
 
@@ -136,5 +153,17 @@ def test_download_attempts_alias():
     assert len(delays) == 1, f"Expected 1 retry, got {len(delays)}: {out}"
 
 
+def test_s3_xml_error_retried():
+    """HTTP 400 with S3 RequestTimeout XML error body is retried."""
+    set_failures(2, ra=0, status=400, body=s3_error_xml("RequestTimeout"))
+    rc, out, delays = fetch(
+        "--option filetransfer-retry-attempts 4 "
+        "--option filetransfer-retry-delay-rate-limited 50"
+    )
+    assert rc == 0, f"Expected success: {out}"
+    assert len(delays) == 2, f"Expected 2 retries, got {len(delays)}: {out}"
+
+
+
 if __name__ == "__main__":
     main()
diff --git a/tests/functional/absolute-path-literals.sh b/tests/functional/absolute-path-literals.sh
index 8cb31ffa4666..ec4d9e35cac2 100755
--- a/tests/functional/absolute-path-literals.sh
+++ b/tests/functional/absolute-path-literals.sh
@@ -5,8 +5,6 @@ source common.sh
 # Tests for absolute path literals that require NIX_CONFIG or grepQuietInverse.
 # Basic warn/fatal/default behavior tests are in lang/eval-*-abs-path-*.nix
 
-clearStoreIfPossible
-
 # Test: Setting via NIX_CONFIG
 NIX_CONFIG='lint-absolute-path-literals = warn' nix eval --expr '/tmp/bar' 2>"$TEST_ROOT"/stderr
 grepQuiet "absolute path literals are not portable" "$TEST_ROOT/stderr"
diff --git a/tests/functional/add-scanning.nix b/tests/functional/add-scanning.nix
new file mode 100644
index 000000000000..b5e8d13cdca4
--- /dev/null
+++ b/tests/functional/add-scanning.nix
@@ -0,0 +1,38 @@
+with import ./config.nix;
+
+let
+  dependency = mkDerivation {
+    name = "dependency";
+    buildCommand = ''
+      mkdir $out
+      echo "this is a dependency" > $out/foo
+    '';
+  };
+in
+mkDerivation {
+  name = "add-scanning";
+
+  requiredSystemFeatures = [ "recursive-nix" ];
+
+  buildCommand = ''
+    set -euo pipefail
+
+    PATH=${builtins.getEnv "EXTRA_PATH"}:$PATH
+    export NIX_CONFIG='extra-experimental-features = nix-command'
+
+    mkdir mao
+    echo "miao" > mao/foo
+    echo "${dependency}" > mao/reference
+    mao="$(nix store add --scan ./mao)"
+
+    mkdir felis
+    echo "miau" > felis/foo
+    echo "$mao" > felis/reference
+    felis="$(nix store add --scan -n reference ./felis)"
+
+    nix-store -qR "$felis" | grep "$mao"
+    nix-store -qR "$felis" | grep "${dependency}"
+
+    nix-store -qR "$felis" > "$out"
+  '';
+}
diff --git a/tests/functional/add-scanning.sh b/tests/functional/add-scanning.sh
new file mode 100755
index 000000000000..04e06731031e
--- /dev/null
+++ b/tests/functional/add-scanning.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+TODO_NixOS
+
+requireDaemonNewerThan "2.36.0pre20260716"
+
+enableFeatures 'recursive-nix dynamic-derivations'
+restartDaemon
+
+# grep is overridden with a function in this shell, is not in a new subshell
+EXTRA_PATH=$(dirname "$(type -p nix)"):$(dirname "$(sh -c 'type -p grep')")
+export EXTRA_PATH
+
+nix build -L --file ./add-scanning.nix --no-link
diff --git a/tests/functional/bash-profile.sh b/tests/functional/bash-profile.sh
index 4228d4a20e58..04b969413c11 100755
--- a/tests/functional/bash-profile.sh
+++ b/tests/functional/bash-profile.sh
@@ -5,7 +5,5 @@ source common.sh
 sed -e "s|@localstatedir@|$TEST_ROOT/profile-var|g" -e "s|@coreutils@|$coreutils|g" < ../../scripts/nix-profile.sh.in > "$TEST_ROOT"/nix-profile.sh
 
 user=$(whoami)
-rm -rf "$TEST_HOME" "$TEST_ROOT/profile-var"
-mkdir -p "$TEST_HOME"
 USER=$user $SHELL -e -c ". $TEST_ROOT/nix-profile.sh; set"
 USER=$user $SHELL -e -c ". $TEST_ROOT/nix-profile.sh" # test idempotency
diff --git a/tests/functional/binary-cache-build-remote.sh b/tests/functional/binary-cache-build-remote.sh
index 5046d0064de5..38fa2c20cb11 100755
--- a/tests/functional/binary-cache-build-remote.sh
+++ b/tests/functional/binary-cache-build-remote.sh
@@ -4,9 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStoreIfPossible
-clearCacheCache
-
 # Fails without remote builders
 (! nix-build --store "file://$cacheDir" dependencies.nix)
 
diff --git a/tests/functional/binary-cache-compression.sh b/tests/functional/binary-cache-compression.sh
new file mode 100644
index 000000000000..50a8fc335141
--- /dev/null
+++ b/tests/functional/binary-cache-compression.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+TODO_NixOS # Requires clearing the store
+
+# This is the full list that might be supported if libarchive were to be
+# compiled with the appropriate dependencies. Only a subset of those has been
+# actually supported historically in nix-built nix.
+declare -A compressionAlgoToExtension=(
+    [none]=''
+    [br]='.br'
+    [bzip2]='.bz2'
+    [compress]=''
+    [grzip]=''
+    [gzip]=''
+    [lrzip]=''
+    [lz4]='.lz4'
+    [lzip]='.lzip'
+    [lzma]=''
+    [lzop]=''
+    [xz]='.xz'
+    [zstd]='.zst'
+)
+
+for algo in "${!compressionAlgoToExtension[@]}"; do
+    clearBinaryCache
+
+    cacheURI="file://$cacheDir?compression=$algo"
+    outPath=$(nix-build dependencies.nix --no-out-link)
+
+    case $algo in
+    # Nix fails when libarchive would require shelling out to an external
+    # program to support compression with a given algorithm. Don't bother
+    # failing for algorithms that aren't usually linked into libarchive in
+    # nixpkgs. Brotli/Zstd is supported directly.
+    "none" | "br" | "bzip2" | "lzma" | "xz" | "zstd" | "gzip")
+        isRequired=1
+        ;;
+    *)
+        isRequired=0
+        ;;
+    esac
+
+    set +e
+    copyOut=$(nix copy --to "$cacheURI" "$outPath" 2>&1)
+    copyCode=$?
+    set -e
+
+    if ((copyCode == 0)); then
+        HASH=$(nix hash path "$outPath")
+
+        clearStore
+        clearCacheCache
+        rm -f "$TEST_ROOT"/{profile,result}
+
+        nix copy --from "$cacheURI" "$outPath" --no-check-sigs --profile "$TEST_ROOT/profile" --out-link "$TEST_ROOT/result"
+
+        [[ -e $TEST_ROOT/profile ]]
+        [[ -e $TEST_ROOT/result ]]
+
+        HASH2=$(nix hash path "$outPath")
+
+        [[ $HASH == "$HASH2" ]]
+
+        if ls "$cacheDir/nar/"*"${compressionAlgoToExtension[$algo]}" &>/dev/null; then
+            echo "files do exist"
+        else
+            fail "nars do not exist"
+        fi
+    else
+        if ((isRequired == 1)); then
+            fail "'$algo' compression algorithm doesn't seem to be supported"
+        else
+            echo "$copyOut" | grepQuiet "initialize compression"
+            echo "non-mandatory compression algorithm '$algo' doesn't seem to be supported in libarchive"
+        fi
+    fi
+done
diff --git a/tests/functional/binary-cache.sh b/tests/functional/binary-cache.sh
index 68263459337e..1dea9878b988 100755
--- a/tests/functional/binary-cache.sh
+++ b/tests/functional/binary-cache.sh
@@ -7,13 +7,12 @@ TODO_NixOS
 needLocalStore "'--no-require-sigs' can’t be used with the daemon"
 
 # We can produce drvs directly into the binary cache
-clearStore
-clearCacheCache
 nix-instantiate --store "file://$cacheDir" dependencies.nix
 
-# Create the binary cache.
 clearStore
-clearCache
+clearBinaryCache
+
+# Create the binary cache.
 outPath=$(nix-build dependencies.nix --no-out-link)
 depPath=$(nix-build dependencies.nix -A input0_drv --no-out-link)
 
@@ -44,7 +43,7 @@ cacheDir2="$TEST_ROOT/binary+cache"
 nix copy --to "file://$cacheDir2" "$outPath" && [[ -d "$cacheDir2" ]]
 
 basicDownloadTests() {
-    # No uploading tests bcause upload with force HTTP doesn't work.
+    # No uploading tests because upload with force HTTP doesn't work.
 
     # By default, a binary cache doesn't support "nix-env -qas", but does
     # support installation.
@@ -183,7 +182,7 @@ grepQuiet "building.*input-2" "$TEST_ROOT/log"
 
 
 # Create a signed binary cache.
-clearCache
+clearBinaryCache
 clearCacheCache
 
 nix key generate-secret --key-name test.nixos.org-1 > "$TEST_ROOT/sk1"
@@ -259,7 +258,7 @@ rm -rfv "$cacheDir/nar"
 
 
 # Test NAR listing generation.
-clearCache
+clearBinaryCache
 
 
 # preserve quotes variables in the single-quoted string
@@ -276,11 +275,31 @@ nix copy --to "file://$cacheDir"?write-nar-listing=1 "$outPath"
 
 diff -u \
     <(jq -S < "$cacheDir/$(basename "$outPath" | cut -c1-32).ls") \
-    <(echo '{"version":1,"root":{"type":"directory","entries":{"bar":{"type":"regular","size":4,"narOffset":232},"link":{"type":"symlink","target":"xyzzy"}}}}' | jq -S)
+    <(jq -S <<'EOF'
+{
+  "version": 1,
+  "root": {
+    "type": "directory",
+    "entries": {
+      "bar": {
+        "type": "regular",
+        "executable": false,
+        "size": 4,
+        "narOffset": 232
+      },
+      "link": {
+        "type": "symlink",
+        "target": "xyzzy"
+      }
+    }
+  }
+}
+EOF
+    )
 
 
 # Test debug info index generation.
-clearCache
+clearBinaryCache
 
 # preserve quotes variables in the single-quoted string
 # shellcheck disable=SC2016
diff --git a/tests/functional/brotli.sh b/tests/functional/brotli.sh
deleted file mode 100755
index 327eab4a5547..000000000000
--- a/tests/functional/brotli.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-
-source common.sh
-
-TODO_NixOS
-
-clearStore
-clearCache
-
-cacheURI="file://$cacheDir?compression=br"
-
-outPath=$(nix-build dependencies.nix --no-out-link)
-
-nix copy --to "$cacheURI" "$outPath"
-
-HASH=$(nix hash path "$outPath")
-
-clearStore
-clearCacheCache
-
-nix copy --from "$cacheURI" "$outPath" --no-check-sigs
-
-HASH2=$(nix hash path "$outPath")
-
-[[ $HASH == "$HASH2" ]]
diff --git a/tests/functional/build-cores.sh b/tests/functional/build-cores.sh
index a226774c6a79..4094b1de7117 100755
--- a/tests/functional/build-cores.sh
+++ b/tests/functional/build-cores.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 echo "Testing build-cores configuration behavior..."
 
 # Test 1: When build-cores is set to a non-zero value, NIX_BUILD_CORES should have that value
diff --git a/tests/functional/build-delete.sh b/tests/functional/build-delete.sh
index 66b14fd14384..e7c2e607499b 100755
--- a/tests/functional/build-delete.sh
+++ b/tests/functional/build-delete.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 # https://github.com/NixOS/nix/issues/6572
 issue_6572_independent_outputs() {
     nix build -f multiple-outputs.nix --json independent --no-link > "$TEST_ROOT"/independent.json
@@ -44,7 +42,7 @@ issue_6572_dependent_outputs() {
 
     # Make sure that 'nix build' tracks input-outputs correctly when a single output is already present.
     if [[ -n "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
-        # Resolved derivations interferre with the deletion
+        # Resolved derivations interfere with the deletion
         nix-store --delete "${NIX_STORE_DIR}"/*.drv
     fi
     nix-store --delete "$(jq -r <"$TEST_ROOT"/a.json .[0].outputs.second)"
diff --git a/tests/functional/build-dry.sh b/tests/functional/build-dry.sh
index cff0f9a49fe0..212131702d40 100755
--- a/tests/functional/build-dry.sh
+++ b/tests/functional/build-dry.sh
@@ -8,14 +8,10 @@ TODO_NixOS
 # Check that --dry-run isn't confused with read-only mode
 # https://github.com/NixOS/nix/issues/1795
 
-clearStore
-clearCache
-
 # Ensure this builds successfully first
 nix build --no-link -f dependencies.nix
 
 clearStore
-clearCache
 
 # Try --dry-run using old command first
 nix-build --no-out-link dependencies.nix --dry-run 2>&1 | grep "will be built"
@@ -23,7 +19,6 @@ nix-build --no-out-link dependencies.nix --dry-run 2>&1 | grep "will be built"
 nix build -f dependencies.nix --dry-run 2>&1 | grep "will be built"
 
 clearStore
-clearCache
 
 # Try --dry-run using new command first
 nix build -f dependencies.nix --dry-run 2>&1 | grep "will be built"
@@ -34,7 +29,6 @@ nix-build --no-out-link dependencies.nix --dry-run 2>&1 | grep "will be built"
 # Check --dry-run doesn't create links with --dry-run
 # https://github.com/NixOS/nix/issues/1849
 clearStore
-clearCache
 
 RESULT=$TEST_ROOT/result-link
 rm -f "$RESULT"
@@ -54,7 +48,6 @@ nix build -f dependencies.nix -o "$RESULT"
 ###################################################
 # Check the JSON output
 clearStore
-clearCache
 
 RES=$(nix build -f dependencies.nix --dry-run --json)
 
diff --git a/tests/functional/build.sh b/tests/functional/build.sh
index 0e76f949f55d..f3c1dabb3c0b 100755
--- a/tests/functional/build.sh
+++ b/tests/functional/build.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 # Make sure that 'nix build' returns all outputs by default.
 nix build -f multiple-outputs.nix --json a b --no-link | jq --exit-status '
   (.[0] |
@@ -53,7 +51,7 @@ nix build -f multiple-outputs.nix --json nothing-to-install --no-link | jq --exi
     (.outputs | keys == ["out"]))
 '
 
-# But not when it's overriden.
+# But not when it's overridden.
 nix build -f multiple-outputs.nix --json e^a_a --no-link
 nix build -f multiple-outputs.nix --json e^a_a --no-link | jq --exit-status '
   (.[0] |
@@ -67,7 +65,7 @@ nix build -f multiple-outputs.nix --json 'e^*' --no-link | jq --exit-status '
     (.outputs | keys == ["a_a", "b", "c"]))
 '
 
-# test buidling from non-drv attr path
+# test building from non-drv attr path
 
 nix build -f multiple-outputs.nix --json 'e.a_a.outPath' --no-link | jq --exit-status '
   (.[0] |
@@ -191,13 +189,9 @@ test "$status" = 1
 # Precise number of errors depends on daemon version / goal refactorings
 (( "$(<<<"$out" grep -cE '^error:')" >= 2 ))
 
-if isDaemonNewer "2.31"; then
-    <<<"$out" grepQuiet -E "error: Cannot build '.*-x4\\.drv'"
-    <<<"$out" grepQuiet -E "Reason: 1 dependency failed."
-elif isDaemonNewer "2.29pre"; then
+if isDaemonNewer "2.29pre"; then
     <<<"$out" grepQuiet -E "error: Cannot build '.*-x4\\.drv'"
     <<<"$out" grepQuiet -E "Reason: 1 dependency failed."
-    <<<"$out" grepQuiet -E "Build failed due to failed dependency"
 else
     <<<"$out" grepQuiet -E "error: 1 dependencies of derivation '.*-x4\\.drv' failed to build"
 fi
diff --git a/tests/functional/ca-old-daemon.sh b/tests/functional/ca-old-daemon.sh
new file mode 100644
index 000000000000..a37ec3331680
--- /dev/null
+++ b/tests/functional/ca-old-daemon.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# A daemon too old to report content-addressed realisations should not crash `nix-build`
+
+source common.sh
+
+TODO_NixOS
+
+enableFeatures "ca-derivations"
+export NIX_TESTS_CA_BY_DEFAULT=1
+restartDaemon
+
+if isDaemonNewer "2.35.0pre20260303"; then
+    nix-build dependencies.nix --no-out-link
+else
+    expectStderr 1 nix-build dependencies.nix --no-out-link |
+        grepQuiet "cannot operate on output"
+fi
diff --git a/tests/functional/ca/build-cache.sh b/tests/functional/ca/build-cache.sh
index 5a00e08fb1bb..6baf2fa6c970 100644
--- a/tests/functional/ca/build-cache.sh
+++ b/tests/functional/ca/build-cache.sh
@@ -37,7 +37,7 @@ copyAttr () {
 
 testRemoteCacheFor () {
     local derivationPath=$1
-    clearCache
+    clearBinaryCache
     copyAttr "$derivationPath" 1
     clearStore
     # Check nothing gets built.
diff --git a/tests/functional/ca/build-trace-delete.sh b/tests/functional/ca/build-trace-delete.sh
new file mode 100644
index 000000000000..54caaca01a03
--- /dev/null
+++ b/tests/functional/ca/build-trace-delete.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+set -x
+
+needLocalStore "command 'nix store build-trace delete' can’t be used with the daemon"
+
+clearStore
+
+singleOutput=$(nix-instantiate ./nondeterministic-ns.nix -A singleOut)
+multiOutput=$(nix-instantiate ./nondeterministic-ns.nix -A multiOut)
+
+# First build
+singleOutPath=$(nix-build ./nondeterministic-ns.nix -A singleOut --no-out-link)
+nix-store --delete "$singleOutPath"
+# We should still have the build trace/realisation in the database, so second build will fail
+expect 1 nix-build ./nondeterministic-ns.nix -A singleOut --no-out-link
+# Deleting the build trace/realisation should fix it though
+nix store build-trace delete "$singleOutput"^out
+nix-build ./nondeterministic-ns.nix -A singleOut --no-out-link
+
+# Multi-output first
+nix-build ./nondeterministic-ns.nix -A multiOut --no-out-link
+multiOutPath=$(nix store build-trace info "$multiOutput"^out --json | jq -r '.[] | .opaquePath | select(.)')
+multiLibPath=$(nix store build-trace info "$multiOutput"^lib --json | jq -r '.[] | .opaquePath | select(.)')
+
+# We should be able to delete multiple build traces/realisations at once
+nix-store --delete "$multiOutPath" "$multiLibPath"
+nix store build-trace delete "$multiOutput"^out "$multiOutput"^lib
+
+# out and lib should be deleted, but dev should not
+expect 1 nix store build-trace info "$multiOutput"^out
+expect 1 nix store build-trace info "$multiOutput"^lib
+nix store build-trace info "$multiOutput"^dev
diff --git a/tests/functional/ca/common.sh b/tests/functional/ca/common.sh
index 10298d9d87dd..0e1736e91327 100644
--- a/tests/functional/ca/common.sh
+++ b/tests/functional/ca/common.sh
@@ -2,7 +2,7 @@
 source ../common.sh
 
 # Need backend to support revamped CA
-requireDaemonNewerThan "2.34.0pre20251217"
+requireDaemonNewerThan "2.35.0pre20260303"
 
 enableFeatures "ca-derivations"
 
diff --git a/tests/functional/ca/concurrent-builds.sh b/tests/functional/ca/concurrent-builds.sh
index b442619e2615..cc38c0e44d23 100755
--- a/tests/functional/ca/concurrent-builds.sh
+++ b/tests/functional/ca/concurrent-builds.sh
@@ -9,8 +9,6 @@ buggyNeedLocalStore "For some reason, this deadlocks with the daemon"
 
 export NIX_TESTS_CA_BY_DEFAULT=1
 
-clearStore
-
 for i in {0..5}; do
     nix build --no-link --file ./racy.nix &
 done
diff --git a/tests/functional/ca/config.nix b/tests/functional/ca/config.nix
index 451fbae4fdea..f8f2939a82f4 100644
--- a/tests/functional/ca/config.nix
+++ b/tests/functional/ca/config.nix
@@ -1,2 +1,2 @@
 # Shim to get generated file
-import "${builtins.getEnv "_NIX_TEST_BUILD_DIR"}/ca/config.nix"
+import "${builtins.getEnv "TEST_ROOT"}/config.nix"
diff --git a/tests/functional/ca/config.nix.in b/tests/functional/ca/config.nix.in
deleted file mode 120000
index af24ddb30b01..000000000000
--- a/tests/functional/ca/config.nix.in
+++ /dev/null
@@ -1 +0,0 @@
-../config.nix.in
\ No newline at end of file
diff --git a/tests/functional/ca/duplicate-realisation-in-closure.sh b/tests/functional/ca/duplicate-realisation-in-closure.sh
index 032fb6164d10..792893f078da 100644
--- a/tests/functional/ca/duplicate-realisation-in-closure.sh
+++ b/tests/functional/ca/duplicate-realisation-in-closure.sh
@@ -4,11 +4,7 @@ source common.sh
 
 requireDaemonNewerThan "2.4pre20210625"
 
-export REMOTE_STORE_DIR="$TEST_ROOT/remote_store"
-export REMOTE_STORE="file://$REMOTE_STORE_DIR"
-
-rm -rf "$REMOTE_STORE_DIR"
-clearStore
+export REMOTE_STORE="file://$cacheDir"
 
 # Build dep1 and push that to the binary cache.
 # This entails building (and pushing) current-time.
diff --git a/tests/functional/ca/issue-13247.sh b/tests/functional/ca/issue-13247.sh
index 29bc2f912014..ab8644b759dc 100755
--- a/tests/functional/ca/issue-13247.sh
+++ b/tests/functional/ca/issue-13247.sh
@@ -6,8 +6,6 @@ export NIX_TESTS_CA_BY_DEFAULT=1
 
 source common.sh
 
-clearStoreIfPossible
-
 set -x
 
 # Build derivation (both outputs)
diff --git a/tests/functional/ca/meson.build b/tests/functional/ca/meson.build
index b1912fd869d6..2625388e4eb3 100644
--- a/tests/functional/ca/meson.build
+++ b/tests/functional/ca/meson.build
@@ -1,15 +1,10 @@
-configure_file(
-  input : 'config.nix.in',
-  output : 'config.nix',
-  configuration : test_confdata,
-)
-
 suites += {
   'name' : 'ca',
   'deps' : [],
   'tests' : [
     'build-cache.sh',
     'build-delete.sh',
+    'build-trace-delete.sh',
     'build-with-garbage-path.sh',
     'build.sh',
     'concurrent-builds.sh',
diff --git a/tests/functional/ca/nix-copy.sh b/tests/functional/ca/nix-copy.sh
index f77b00030342..7689af1ab780 100755
--- a/tests/functional/ca/nix-copy.sh
+++ b/tests/functional/ca/nix-copy.sh
@@ -2,8 +2,7 @@
 
 source common.sh
 
-export REMOTE_STORE_DIR="$TEST_ROOT/remote_store"
-export REMOTE_STORE="file://$REMOTE_STORE_DIR"
+export REMOTE_STORE="file://$cacheDir"
 
 ensureCorrectlyCopied () {
     attrPath="$1"
@@ -12,7 +11,7 @@ ensureCorrectlyCopied () {
 
 testOneCopy () {
     clearStore
-    rm -rf "$REMOTE_STORE_DIR"
+    clearBinaryCache
 
     attrPath="$1"
     nix copy --to "$REMOTE_STORE" "$attrPath" --file ./content-addressed.nix
diff --git a/tests/functional/ca/nix-run.sh b/tests/functional/ca/nix-run.sh
index e6638cc91b6a..046c36450e5e 100755
--- a/tests/functional/ca/nix-run.sh
+++ b/tests/functional/ca/nix-run.sh
@@ -2,8 +2,10 @@
 
 source common.sh
 
+: "${config_nix?}"
+
 flakeDir="$TEST_HOME/flake"
 mkdir -p "${flakeDir}"
-cp flake.nix "${_NIX_TEST_BUILD_DIR}/ca/config.nix" content-addressed.nix "${flakeDir}"
+cp flake.nix "$config_nix" content-addressed.nix "${flakeDir}"
 
 nix run --no-write-lock-file "path:${flakeDir}#runnable"
diff --git a/tests/functional/ca/nondeterministic-ns.nix b/tests/functional/ca/nondeterministic-ns.nix
new file mode 100644
index 000000000000..899db8cb5ca0
--- /dev/null
+++ b/tests/functional/ca/nondeterministic-ns.nix
@@ -0,0 +1,44 @@
+with import ./config.nix;
+
+let
+  mkCADerivation =
+    args:
+    mkDerivation (
+      {
+        __contentAddressed = true;
+        outputHashMode = "recursive";
+        outputHashAlgo = "sha256";
+      }
+      // args
+    );
+in
+
+{
+  singleOut = mkCADerivation {
+    name = "time-single-out";
+    buildCommand = ''
+      mkdir $out
+      date +%s.%N > $out/current-time
+    '';
+  };
+
+  multiOut = mkCADerivation {
+    name = "time-multi-out";
+    outputs = [
+      "out"
+      "lib"
+      "dev"
+    ];
+    buildCommand = ''
+      mkdir $out
+      date +%s.%N > $out/current-time
+      echo out > $out/foo
+      mkdir $lib
+      date +%s.%N > $lib/current-time
+      echo lib > $lib/foo
+      mkdir $dev
+      date +%s.%N > $lib/current-time
+      echo dev > $dev/foo
+    '';
+  };
+}
diff --git a/tests/functional/ca/signatures.sh b/tests/functional/ca/signatures.sh
index f69a205d203f..a0cb007c0e13 100644
--- a/tests/functional/ca/signatures.sh
+++ b/tests/functional/ca/signatures.sh
@@ -2,14 +2,10 @@
 
 source common.sh
 
-clearStore
-clearCache
-
 nix-store --generate-binary-cache-key cache1.example.org "$TEST_ROOT/sk1" "$TEST_ROOT/pk1"
 pk1=$(cat "$TEST_ROOT/pk1")
 
-export REMOTE_STORE_DIR="$TEST_ROOT/remote_store"
-export REMOTE_STORE="file://$REMOTE_STORE_DIR"
+export REMOTE_STORE="file://$cacheDir"
 
 ensureCorrectlyCopied () {
     attrPath="$1"
@@ -18,7 +14,7 @@ ensureCorrectlyCopied () {
 
 testOneCopy () {
     clearStore
-    rm -rf "$REMOTE_STORE_DIR"
+    clearBinaryCache
 
     attrPath="$1"
     nix copy -vvvv --to "$REMOTE_STORE" "$attrPath" --file ./content-addressed.nix \
diff --git a/tests/functional/ca/substitute.sh b/tests/functional/ca/substitute.sh
index 533df8b412fe..a10f5997a25e 100644
--- a/tests/functional/ca/substitute.sh
+++ b/tests/functional/ca/substitute.sh
@@ -7,10 +7,7 @@ source common.sh
 # shellcheck disable=SC1111
 needLocalStore "“--no-require-sigs” can’t be used with the daemon"
 
-rm -rf "$TEST_ROOT/binary_cache"
-
-export REMOTE_STORE_DIR=$TEST_ROOT/binary_cache
-export REMOTE_STORE=file://$REMOTE_STORE_DIR
+export REMOTE_STORE="file://$cacheDir"
 
 buildDrvs () {
     nix build --file ./content-addressed.nix -L --no-link "$@"
@@ -26,9 +23,10 @@ clearStore
 # this. Force the use of small-step resolutions only to allow not
 # mentioning it explicitly again. (#11896, #11928).
 buildDrvs --substitute --substituters "$REMOTE_STORE" --no-require-sigs -j0 transitivelyDependentCA dependentCA
-# Check that the thing we’ve just substituted has its realisation stored
-nix realisation info --file ./content-addressed.nix transitivelyDependentCA
+# Check that the thing we’ve just substituted has its build trace stored
+nix store build-trace info --file ./content-addressed.nix transitivelyDependentCA
 # Check that its dependencies have it too
+# Use the old command to make sure that the alias works
 nix realisation info --file ./content-addressed.nix dependentCA
 # nix realisation info --file ./content-addressed.nix rootCA --outputs out
 
@@ -48,5 +46,5 @@ buildDrvs --substitute --substituters "$REMOTE_STORE" --no-require-sigs -j0
 # Try rebuilding, but remove the realisations from the remote cache to force
 # using the cachecache
 clearStore
-rm -r "$REMOTE_STORE_DIR"/build-trace-v2/*
+rm -r "$cacheDir"/build-trace-v2/*
 buildDrvs --substitute --substituters "$REMOTE_STORE" --no-require-sigs -j0
diff --git a/tests/functional/characterisation-test-infra.sh b/tests/functional/characterisation-test-infra.sh
index fecae29e8091..42454094a873 100755
--- a/tests/functional/characterisation-test-infra.sh
+++ b/tests/functional/characterisation-test-infra.sh
@@ -3,7 +3,7 @@
 # Test the function for lang.sh
 source common.sh
 
-source characterisation/framework.sh
+source common/characterisation/framework.sh
 
 # We are testing this, so don't want outside world to affect us.
 unset _NIX_TEST_ACCEPT
@@ -19,14 +19,14 @@ cp "$TEST_ROOT/got" "$TEST_ROOT/expected"
   (( "$badDiff" == 0 ))
 )
 
-# matches empty, non-existant file is the same as empty file
+# matches empty, non-existent file is the same as empty file
 echo -n > "$TEST_ROOT/got"
 (
   diffAndAcceptInner test "$TEST_ROOT/got" "$TEST_ROOT/does-not-exist"
   (( "$badDiff" == 0 ))
 )
 
-# doesn't matches non-empty, non-existant file is the same as empty file
+# doesn't matches non-empty, non-existent file is the same as empty file
 echo Hi! > "$TEST_ROOT/got"
 (
   diffAndAcceptInner test "$TEST_ROOT/got" "$TEST_ROOT/does-not-exist"
@@ -64,7 +64,7 @@ echo Bye! > "$TEST_ROOT/expected"
   (( "$badDiff" == 0 ))
 )
 
-# _NIX_TEST_ACCEPT matches empty, non-existant file not created
+# _NIX_TEST_ACCEPT matches empty, non-existent file not created
 echo -n > "$TEST_ROOT/got"
 (
   _NIX_TEST_ACCEPT=1 diffAndAcceptInner test "$TEST_ROOT/got" "$TEST_ROOT/does-not-exists"
diff --git a/tests/functional/check-refs.sh b/tests/functional/check-refs.sh
index 16bcac1582eb..9ca6ca5c47d7 100755
--- a/tests/functional/check-refs.sh
+++ b/tests/functional/check-refs.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-
 RESULT=$TEST_ROOT/result
 
 dep=$(nix-build -o "$RESULT" check-refs.nix -A dep)
diff --git a/tests/functional/check-reqs.sh b/tests/functional/check-reqs.sh
index 34eb133db228..a32a66288f8e 100755
--- a/tests/functional/check-reqs.sh
+++ b/tests/functional/check-reqs.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 RESULT=$TEST_ROOT/result
 
 nix-build -o "$RESULT" check-reqs.nix -A test1
diff --git a/tests/functional/check.sh b/tests/functional/check.sh
index 260506138723..06743d27f86e 100755
--- a/tests/functional/check.sh
+++ b/tests/functional/check.sh
@@ -17,8 +17,6 @@ checkBuildId=$(date +%s%N)
 
 TODO_NixOS
 
-clearStore
-
 nix-build dependencies.nix --no-out-link
 nix-build dependencies.nix --no-out-link --check
 
diff --git a/tests/functional/chroot-store.sh b/tests/functional/chroot-store.sh
index cbb80c8710ad..d0f41ee87218 100755
--- a/tests/functional/chroot-store.sh
+++ b/tests/functional/chroot-store.sh
@@ -60,6 +60,15 @@ PATH7=$(nix path-info --store "local://$TEST_ROOT/x%2Bchroot" "$CORRECT_PATH")
 # Path gets decoded.
 [[ ! -d "$TEST_ROOT/x%2Bchroot" ]]
 
+# Regression test: `nix-store --register-validity` against a chroot store must
+# canonicalise the real (chroot-prefixed) path, not the logical store path
+# (which does not exist on the host filesystem).
+regPath=$NIX_STORE_DIR/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-reg
+touch "$TEST_ROOT/x/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-reg"
+[[ ! -e "$regPath" ]]
+(echo "$regPath" && echo && echo 0) | nix-store --store "local?root=$TEST_ROOT/x" --register-validity
+nix-store --store "$TEST_ROOT/x" --check-validity "$regPath"
+
 # Ensure store info trusted works with local store
 nix --store "$TEST_ROOT/x" store info --json | jq -e '.trusted'
 
diff --git a/tests/functional/cli-characterisation.sh b/tests/functional/cli-characterisation.sh
index a795b14e25e4..a789bb09ec7f 100644
--- a/tests/functional/cli-characterisation.sh
+++ b/tests/functional/cli-characterisation.sh
@@ -8,7 +8,7 @@
 
 source common.sh
 
-source characterisation/framework.sh
+source common/characterisation/framework.sh
 
 set +x
 
@@ -30,13 +30,11 @@ normalize() {
 
 diffAndAccept() {
     local testName="$1"
-    local got="cli-characterisation/$testName.$2"
+    local got="$TEST_ROOT/$testName.$2"
     local expected="cli-characterisation/$testName.$3"
     diffAndAcceptInner "$testName" "$got" "$expected"
 }
 
-clearProfiles
-
 # Each test case has a descriptor: cli-characterisation/<name>.cmd
 # containing: <expected-exit-code> <command...>
 #
@@ -53,10 +51,10 @@ for cmdFile in cli-characterisation/*.cmd; do
     if
         # shellcheck disable=SC2086 # word splitting of cmd is intended
         expect "$expectedExit" $cmd \
-            1> "cli-characterisation/$testName.out" \
-            2> "cli-characterisation/$testName.err"
+            1> "$TEST_ROOT/$testName.out" \
+            2> "$TEST_ROOT/$testName.err"
     then
-        normalize "cli-characterisation/$testName.out" "cli-characterisation/$testName.err"
+        normalize "$TEST_ROOT/$testName.out" "$TEST_ROOT/$testName.err"
         diffAndAccept "$testName" out out.exp
         diffAndAccept "$testName" err err.exp
     else
@@ -74,10 +72,10 @@ testName=nix-build-multi-output
 echo "testing $testName"
 if
     expect 1 nix-build "$drvPath!out,bin" \
-        1> "cli-characterisation/$testName.out" \
-        2> "cli-characterisation/$testName.err"
+        1> "$TEST_ROOT/$testName.out" \
+        2> "$TEST_ROOT/$testName.err"
 then
-    normalize "cli-characterisation/$testName.out" "cli-characterisation/$testName.err"
+    normalize "$TEST_ROOT/$testName.out" "$TEST_ROOT/$testName.err"
     diffAndAccept "$testName" out out.exp
     diffAndAccept "$testName" err err.exp
 else
@@ -90,10 +88,10 @@ testName=nix-build-bad-output
 echo "testing $testName"
 if
     expect 1 nix-build "$drvPath!nonexistent" \
-        1> "cli-characterisation/$testName.out" \
-        2> "cli-characterisation/$testName.err"
+        1> "$TEST_ROOT/$testName.out" \
+        2> "$TEST_ROOT/$testName.err"
 then
-    normalize "cli-characterisation/$testName.out" "cli-characterisation/$testName.err"
+    normalize "$TEST_ROOT/$testName.out" "$TEST_ROOT/$testName.err"
     diffAndAccept "$testName" out out.exp
     diffAndAccept "$testName" err err.exp
 else
diff --git a/tests/functional/characterisation/empty b/tests/functional/common/characterisation/empty
similarity index 100%
rename from tests/functional/characterisation/empty
rename to tests/functional/common/characterisation/empty
diff --git a/tests/functional/characterisation/framework.sh b/tests/functional/common/characterisation/framework.sh
similarity index 97%
rename from tests/functional/characterisation/framework.sh
rename to tests/functional/common/characterisation/framework.sh
index 6490d4ff5dde..fdb4fb2fdc46 100644
--- a/tests/functional/characterisation/framework.sh
+++ b/tests/functional/common/characterisation/framework.sh
@@ -16,7 +16,7 @@ function diffAndAcceptInner() {
     if test -e "$expected"; then
         local -r expectedOrEmpty="$expected"
     else
-        local -r expectedOrEmpty=characterisation/empty
+        local -r expectedOrEmpty=common/characterisation/empty
     fi
 
     # Diff so we get a nice message
diff --git a/tests/functional/common/functions.sh b/tests/functional/common/functions.sh
index 771bbca785bc..dd1850137191 100644
--- a/tests/functional/common/functions.sh
+++ b/tests/functional/common/functions.sh
@@ -54,7 +54,7 @@ doClearStore() {
     clearProfiles
 }
 
-clearCache() {
+clearBinaryCache() {
     rm -rf "${cacheDir?}"
 }
 
@@ -101,7 +101,7 @@ killDaemon() {
       die "killDaemon: not supported when testing on NixOS. Is it really needed? If so add conditionals; e.g. if ! isTestOnNixOS; then ..."
     fi
 
-    # Don't fail trying to stop a non-existant daemon twice.
+    # Don't fail trying to stop a non-existent daemon twice.
     if [[ "${_NIX_TEST_DAEMON_PID-}" == '' ]]; then
         return
     fi
@@ -238,12 +238,15 @@ enableFeatures() {
 }
 
 onError() {
-    set +x
-    echo "$0: test failed at:" >&2
-    for ((i = 1; i < ${#BASH_SOURCE[@]}; i++)); do
-        if [[ -z ${BASH_SOURCE[i]} ]]; then break; fi
-        echo "  ${FUNCNAME[i]} in ${BASH_SOURCE[i]}:${BASH_LINENO[i-1]}" >&2
-    done
+    # Don't print the message if set +e has been explicitly set.
+    if [[ $- == *e* ]]; then
+        set +x
+        echo "$0: test failed at:" >&2
+        for ((i = 1; i < ${#BASH_SOURCE[@]}; i++)); do
+            if [[ -z ${BASH_SOURCE[i]} ]]; then break; fi
+            echo "  ${FUNCNAME[i]} in ${BASH_SOURCE[i]}:${BASH_LINENO[i-1]}" >&2
+        done
+    fi
 }
 
 # Prints an error message prefix referring to the last call into this file.
diff --git a/tests/functional/common/init.sh b/tests/functional/common/init.sh
index 66b44c76f696..5aa71c0b62bf 100755
--- a/tests/functional/common/init.sh
+++ b/tests/functional/common/init.sh
@@ -1,7 +1,7 @@
 # shellcheck shell=bash
 
 # for shellcheck
-: "${test_nix_conf_dir?}" "${test_nix_conf?}"
+: "${test_nix_conf_dir?}" "${test_nix_conf?}" "${config_nix?}"
 
 if isTestOnNixOS; then
 
@@ -69,3 +69,8 @@ nix-store --init
 test -e "$NIX_STATE_DIR"/db/db.sqlite
 
 fi # !isTestOnNixOS
+
+# Salt the test-specific config.nix file a bit to improve test isolation with a
+# shared store.
+echo "# config.nix for test $TEST_SUITE_NAME / $TEST_NAME" > "$config_nix"
+cat "${_NIX_TEST_BUILD_DIR}/config.nix" >> "$config_nix"
diff --git a/tests/functional/common/vars.sh b/tests/functional/common/vars.sh
index a6b83ae4e3cf..06dca295b309 100644
--- a/tests/functional/common/vars.sh
+++ b/tests/functional/common/vars.sh
@@ -82,6 +82,6 @@ fi
 # Very common, shorthand helps
 # Used in other files
 # shellcheck disable=SC2034
-config_nix="${_NIX_TEST_BUILD_DIR}/config.nix"
+config_nix="${TEST_ROOT}/config.nix"
 
 fi # COMMON_VARS_SH_SOURCED
diff --git a/tests/functional/compression-levels.sh b/tests/functional/compression-levels.sh
index 399265f9c91d..e18b6c1d5e65 100755
--- a/tests/functional/compression-levels.sh
+++ b/tests/functional/compression-levels.sh
@@ -2,9 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-clearCache
-
 outPath=$(nix-build dependencies.nix --no-out-link)
 
 cacheURI="file://$cacheDir?compression=xz&compression-level=0"
@@ -13,7 +10,7 @@ nix copy --to "$cacheURI" "$outPath"
 
 FILESIZES=$(cat "${cacheDir}"/*.narinfo | awk '/FileSize: /{sum+=$2}END{print sum}')
 
-clearCache
+clearBinaryCache
 
 cacheURI="file://$cacheDir?compression=xz&compression-level=5"
 
diff --git a/tests/functional/config.nix b/tests/functional/config.nix
index 5d1cb74eca45..f8f2939a82f4 100644
--- a/tests/functional/config.nix
+++ b/tests/functional/config.nix
@@ -1,2 +1,2 @@
 # Shim to get generated file
-import "${builtins.getEnv "_NIX_TEST_BUILD_DIR"}/config.nix"
+import "${builtins.getEnv "TEST_ROOT"}/config.nix"
diff --git a/tests/functional/config.nix.in b/tests/functional/config.nix.in
index 95ba86ad8fef..8a284ade9e81 100644
--- a/tests/functional/config.nix.in
+++ b/tests/functional/config.nix.in
@@ -16,9 +16,14 @@ rec {
 
   shared = builtins.getEnv "_NIX_TEST_SHARED";
 
+  # Fingerprint the test to improve test isolation with a shared store.
+  # Test setup sprinkles some salt on the template, so we end with with
+  # different derivations for distinct tests.
+  testSalt = builtins.hashFile "sha256" __curPos.file;
+
   mkDerivation = args:
     derivation ({
-      inherit system;
+      inherit system testSalt;
       builder = shell;
       args = ["-e" args.builder or (builtins.toFile "builder-${args.name}.sh" ''
         if [ -e "$NIX_ATTRS_SH_FILE" ]; then source $NIX_ATTRS_SH_FILE; fi;
diff --git a/tests/functional/config.sh b/tests/functional/config.sh
index c1d47454e555..3bd06c3b8b2b 100755
--- a/tests/functional/config.sh
+++ b/tests/functional/config.sh
@@ -2,10 +2,6 @@
 
 source common.sh
 
-# Isolate the home for this test.
-# Other tests (e.g. flake registry tests) could be writing to $HOME in parallel.
-export HOME=$TEST_ROOT/userhome
-
 # Test that using XDG_CONFIG_HOME works
 # Assert the config folder didn't exist initially.
 [ ! -e "$HOME/.config" ]
diff --git a/tests/functional/debugger.sh b/tests/functional/debugger.sh
deleted file mode 100755
index b96b7e5d3f7a..000000000000
--- a/tests/functional/debugger.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-source common.sh
-
-clearStoreIfPossible
-
-# regression #9932
-echo ":env" | expect 1 nix eval --debugger --expr '(_: throw "oh snap") 42'
-echo ":env" | expect 1 nix eval --debugger --expr '
-  let x.a = 1; in
-  with x;
-  (_: builtins.seq x.a (throw "oh snap")) x.a
-' >debugger-test-out
-grep -P 'with: .*a' debugger-test-out
-grep -P 'static: .*x' debugger-test-out
diff --git a/tests/functional/delete-no-keep.sh b/tests/functional/delete-no-keep.sh
new file mode 100755
index 000000000000..8ac64fd44493
--- /dev/null
+++ b/tests/functional/delete-no-keep.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+TODO_NixOS
+
+deleteNoKeep() {
+    keep="$1"
+
+    clearStore
+    drvPath=$(nix-instantiate simple.nix)
+    outPath=$(nix build -f simple.nix --no-link --print-out-paths)
+
+    {
+        echo "keep-outputs = false"
+        echo "keep-derivations = false"
+        echo "keep-$keep = true"
+    } >> "$test_nix_conf"
+
+    if [[ "$keep" = "outputs" ]]; then
+        nix store delete "$outPath"
+        [[ ! -e "$outPath" ]] || fail "$outPath should have been deleted"
+    else
+        nix store delete "$drvPath"
+        [[ ! -e "$drvPath" ]] || fail "$drvPath should have been deleted"
+    fi
+}
+
+if isDaemonNewer "2.35pre"; then
+    deleteNoKeep outputs
+    deleteNoKeep derivations
+fi
diff --git a/tests/functional/dependencies.nix b/tests/functional/dependencies.nix
index 570ea7431356..e1f4aa3697ec 100644
--- a/tests/functional/dependencies.nix
+++ b/tests/functional/dependencies.nix
@@ -28,11 +28,11 @@ let
     name = "fod-input";
     buildCommand = ''
       echo ${hashInvalidator}
-      echo FOD > $out
+      echo -n fod-input-${testSalt} > $out
     '';
     outputHashMode = "flat";
     outputHashAlgo = "sha256";
-    outputHash = "1dq9p0hnm1y75q2x40fws5887bq1r840hzdxak0a9djbwvx0b16d";
+    outputHash = "${builtins.hashString "sha256" "fod-input-${testSalt}"}";
   };
 
 in
diff --git a/tests/functional/dependencies.sh b/tests/functional/dependencies.sh
index 68c0d3f2e0c5..59983b0cb2d9 100755
--- a/tests/functional/dependencies.sh
+++ b/tests/functional/dependencies.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 drvPath=$(nix-instantiate dependencies.nix)
 
 echo "derivation is $drvPath"
@@ -65,8 +63,6 @@ drvPath2=$(nix-instantiate dependencies.nix --argstr hashInvalidator yay)
 # now --valid-derivers returns both
 test "$(nix-store -q --valid-derivers "$outPath" | sort)" = "$(sort <<< "$drvPath"$'\n'"$drvPath2")"
 
-TODO_NixOS # The following --delete fails, because it seems to be still alive. This might be caused by a different test using the same path. We should try make the derivations unique, e.g. naming after tests, and adding a timestamp that's constant for that test script run.
-
 # check that nix-store --valid-derivers only returns existing drv
 nix-store --delete "$drvPath"
 test "$(nix-store -q --valid-derivers "$outPath")" = "$drvPath2"
diff --git a/tests/functional/dependencies2.nix b/tests/functional/dependencies2.nix
new file mode 100644
index 000000000000..6300f0ac41fe
--- /dev/null
+++ b/tests/functional/dependencies2.nix
@@ -0,0 +1,39 @@
+with import ./config.nix;
+
+let
+
+  input0 = mkDerivation {
+    name = "dependencies-input-0";
+    buildCommand = "mkdir $out; echo foo > $out/bar";
+  };
+
+  input1 = mkDerivation {
+    name = "dependencies-input-1";
+    buildCommand = "mkdir $out; echo FOO > $out/foo";
+  };
+
+  input2 = mkDerivation {
+    name = "dependencies-input-2";
+    buildCommand = ''
+      mkdir $out
+      echo BAR > $out/bar
+      echo ${input0} > $out/input0
+      echo "$out" > $out2
+    '';
+    outputs = [
+      "out"
+      "out2"
+    ];
+  };
+
+in
+mkDerivation {
+  name = "dependencies-top";
+  builder = ./dependencies.builder0.sh + "/FOOBAR/../.";
+  input1 = input1 + "/.";
+  input2 = "${input2}/.";
+  input1_drv = input1;
+  input2_drv = input2;
+  input0_drv = input0;
+  meta.description = "Random test package";
+}
diff --git a/tests/functional/derivation-advanced-attributes.sh b/tests/functional/derivation-advanced-attributes.sh
index a7530e11c675..f65946f35469 100755
--- a/tests/functional/derivation-advanced-attributes.sh
+++ b/tests/functional/derivation-advanced-attributes.sh
@@ -5,7 +5,7 @@ source common/paths.sh
 
 set -eu -o pipefail
 
-source characterisation/framework.sh
+source common/characterisation/framework.sh
 
 badDiff=0
 badExitCode=0
diff --git a/tests/functional/dump-db.sh b/tests/functional/dump-db.sh
index 70d79e9fbfa6..7149dcb1afff 100755
--- a/tests/functional/dump-db.sh
+++ b/tests/functional/dump-db.sh
@@ -6,8 +6,6 @@ TODO_NixOS
 
 needLocalStore "--dump-db requires a local store"
 
-clearStore
-
 nix-build dependencies.nix -o "$TEST_ROOT"/result
 deps="$(nix-store -qR "$TEST_ROOT"/result)"
 
diff --git a/tests/functional/dyn-drv/config.nix b/tests/functional/dyn-drv/config.nix
index 8ec2c67eacfc..f8f2939a82f4 100644
--- a/tests/functional/dyn-drv/config.nix
+++ b/tests/functional/dyn-drv/config.nix
@@ -1,2 +1,2 @@
 # Shim to get generated file
-import "${builtins.getEnv "_NIX_TEST_BUILD_DIR"}/dyn-drv/config.nix"
+import "${builtins.getEnv "TEST_ROOT"}/config.nix"
diff --git a/tests/functional/dyn-drv/config.nix.in b/tests/functional/dyn-drv/config.nix.in
deleted file mode 120000
index af24ddb30b01..000000000000
--- a/tests/functional/dyn-drv/config.nix.in
+++ /dev/null
@@ -1 +0,0 @@
-../config.nix.in
\ No newline at end of file
diff --git a/tests/functional/dyn-drv/dep-built-drv-submitted.sh b/tests/functional/dyn-drv/dep-built-drv-submitted.sh
new file mode 100644
index 000000000000..41add90e0404
--- /dev/null
+++ b/tests/functional/dyn-drv/dep-built-drv-submitted.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+# builder-rpc-v0
+requireDaemonNewerThan "2.35pre20260507"
+
+TODO_NixOS # can't enable a sandbox feature easily
+
+enableFeatures 'ca-derivations'
+restartDaemon
+
+NIX_BIN_DIR="$(dirname "$(type -p nix)")"
+export NIX_BIN_DIR
+
+nix build -L --file ./non-trivial-submitted.nix unstructured --no-link
+nix build -L --file ./non-trivial-submitted.nix structured --no-link
diff --git a/tests/functional/dyn-drv/eval-outputOf.sh b/tests/functional/dyn-drv/eval-outputOf.sh
index 3681bd098899..13f7e7ba4c7e 100644
--- a/tests/functional/dyn-drv/eval-outputOf.sh
+++ b/tests/functional/dyn-drv/eval-outputOf.sh
@@ -34,7 +34,7 @@ testStaticHello () {
              (assert a == b; null))'
 }
 
-# Test with a regular old input-addresed derivation
+# Test with a regular old input-addressed derivation
 #
 # `builtins.outputOf` works without ca-derivations and doesn't create a
 # placeholder but just returns the output path.
diff --git a/tests/functional/dyn-drv/meson.build b/tests/functional/dyn-drv/meson.build
index 78950a954a5b..22dda3bcb0e9 100644
--- a/tests/functional/dyn-drv/meson.build
+++ b/tests/functional/dyn-drv/meson.build
@@ -1,9 +1,3 @@
-configure_file(
-  input : 'config.nix.in',
-  output : 'config.nix',
-  configuration : test_confdata,
-)
-
 suites += {
   'name' : 'dyn-drv',
   'deps' : [],
@@ -16,6 +10,9 @@ suites += {
     'dep-built-drv.sh',
     'old-daemon-error-hack.sh',
     'dep-built-drv-2.sh',
+    'dep-built-drv-submitted.sh',
+    'submit-failure.sh',
+    'submit-reference.sh',
   ],
   'workdir' : meson.current_source_dir(),
 }
diff --git a/tests/functional/dyn-drv/non-trivial-submitted.nix b/tests/functional/dyn-drv/non-trivial-submitted.nix
new file mode 100644
index 000000000000..c26c45c7e107
--- /dev/null
+++ b/tests/functional/dyn-drv/non-trivial-submitted.nix
@@ -0,0 +1,93 @@
+with import ./config.nix;
+
+let
+  baseAttrs = {
+    name = "build-e.drv";
+
+    requiredSystemFeatures = [ "builder-rpc-v0" ];
+
+    buildCommand = ''
+      set -e
+      set -u
+
+      if [[ ! -z "''${out+set}" ]]; then
+        echo "out variable set in builder-rpc-v0 derivation"
+        exit 1
+      fi
+
+      PATH=${builtins.getEnv "NIX_BIN_DIR"}:$PATH
+
+      export NIX_CONFIG='extra-experimental-features = nix-command ca-derivations dynamic-derivations'
+
+      declare -A deps=(
+        [a]=""
+        [b]="a"
+        [c]="a"
+        [d]="b c"
+        [e]="b c d"
+      )
+
+      # Cannot just literally include this, or Nix will think it is the
+      # *outer* derivation that's trying to refer to itself, and
+      # substitute the string too soon.
+      placeholder=$(nix eval --raw --expr 'builtins.placeholder "out"')
+
+      declare -A drvs=()
+      for word in a b c d e; do
+        inputDrvs=""
+        for dep in ''${deps[$word]}; do
+          if [[ "$inputDrvs" != "" ]]; then
+            inputDrvs+=","
+          fi
+          read -r -d "" line <<EOF || true
+          "''${drvs[$dep]}": {
+            "outputs": ["out"],
+            "dynamicOutputs": {}
+          }
+      EOF
+          inputDrvs+="$line"
+        done
+        read -r -d "" json <<EOF || true
+        {
+          "args": ["-c", "set -xeu; echo \"word env vav $word is \$$word\" >> \"\$out\""],
+          "builder": "${shell}",
+          "env": {
+            "out": "$placeholder",
+            "$word": "hello, from $word!",
+            "PATH": ${builtins.toJSON path}
+          },
+          "inputs": {
+            "drvs": {
+              $inputDrvs
+            },
+            "srcs": []
+          },
+          "name": "build-$word",
+          "outputs": {
+            "out": {
+              "method": "nar",
+              "hashAlgo": "sha256"
+            }
+          },
+          "system": "${system}",
+          "version": 4
+        }
+      EOF
+        drvPath=$(echo "$json" | nix derivation add)
+        storeDir=$(dirname "$drvPath")
+        drvs[$word]="$(basename "$drvPath")"
+      done
+      nix store submit-output "''${storeDir}/''${drvs[e]}" out
+    '';
+
+    __contentAddressed = true;
+    outputHashMode = "text";
+    outputHashAlgo = "sha256";
+  };
+
+  buildDynamic = attrs: builtins.outputOf (mkDerivation attrs).outPath "out";
+in
+{
+  unstructured = buildDynamic baseAttrs;
+  structured = buildDynamic (baseAttrs // { __structuredAttrs = true; });
+}
diff --git a/tests/functional/dyn-drv/recursive-mod-json.sh b/tests/functional/dyn-drv/recursive-mod-json.sh
index 01e8f16e956d..ce544d36d691 100644
--- a/tests/functional/dyn-drv/recursive-mod-json.sh
+++ b/tests/functional/dyn-drv/recursive-mod-json.sh
@@ -9,10 +9,6 @@ export NIX_TESTS_CA_BY_DEFAULT=1
 enableFeatures 'recursive-nix'
 restartDaemon
 
-clearStore
-
-rm -f "$TEST_ROOT"/result
-
 EXTRA_PATH=$(dirname "$(type -p nix)"):$(dirname "$(type -p jq)")
 export EXTRA_PATH
 
diff --git a/tests/functional/dyn-drv/submit-failure.nix b/tests/functional/dyn-drv/submit-failure.nix
new file mode 100644
index 000000000000..d0c4e8566016
--- /dev/null
+++ b/tests/functional/dyn-drv/submit-failure.nix
@@ -0,0 +1,45 @@
+with import ./config.nix;
+
+let
+  buildSubmitting =
+    name: command:
+    mkDerivation {
+      inherit name;
+
+      requiredSystemFeatures = [ "builder-rpc-v0" ];
+
+      buildCommand = ''
+        set -e
+        set -u
+
+        PATH=${builtins.getEnv "NIX_BIN_DIR"}:$PATH
+        export NIX_CONFIG='extra-experimental-features = nix-command ca-derivations dynamic-derivations'
+
+        ${command}
+      '';
+
+      __contentAddressed = true;
+      outputHashMode = "nar";
+      outputHashAlgo = "sha256";
+
+    };
+in
+{
+  duplicate = buildSubmitting "duplicate" ''
+    mkdir a
+    echo "miao" > a/gatto
+    a="$(nix store add -n duplicate ./a)"
+    nix store submit-output "$a" out
+
+    mkdir b
+    echo "miau" > b/katze
+    b="$(nix store add -n duplicate ./b)"
+    nix store submit-output "$b" out
+  '';
+  noSubmit = buildSubmitting "no-submit" ''
+    mkdir a
+    echo "nyaa" > a/neko
+    a="$(nix store add -n no-submit ./a)"
+    # Don't run the required `nix store submit-output`
+  '';
+}
diff --git a/tests/functional/dyn-drv/submit-failure.sh b/tests/functional/dyn-drv/submit-failure.sh
new file mode 100755
index 000000000000..5b370be155ae
--- /dev/null
+++ b/tests/functional/dyn-drv/submit-failure.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+# builder-rpc-v0
+requireDaemonNewerThan "2.35pre20260507"
+
+TODO_NixOS
+
+enableFeatures 'dynamic-derivations ca-derivations'
+restartDaemon
+
+NIX_BIN_DIR="$(dirname "$(type -p nix)")"
+export NIX_BIN_DIR
+
+expectStderr 1 nix build -L --file ./submit-failure.nix noSubmit --no-link | grepQuiet "failed to submit output"
+expectStderr 1 nix build -L --file ./submit-failure.nix duplicate --no-link | grepQuiet "submit duplicate output"
diff --git a/tests/functional/dyn-drv/submit-reference.nix b/tests/functional/dyn-drv/submit-reference.nix
new file mode 100644
index 000000000000..dd4d4ab2d2f5
--- /dev/null
+++ b/tests/functional/dyn-drv/submit-reference.nix
@@ -0,0 +1,45 @@
+with import ./config.nix;
+
+let
+  buildSubmitting =
+    name: command:
+    mkDerivation {
+      inherit name;
+
+      requiredSystemFeatures = [ "builder-rpc-v0" ];
+
+      buildCommand = ''
+        set -e
+        set -u
+
+        PATH=${builtins.getEnv "NIX_BIN_DIR"}:$PATH
+        export NIX_CONFIG='extra-experimental-features = nix-command ca-derivations dynamic-derivations'
+
+        ${command}
+      '';
+
+      __contentAddressed = true;
+      outputHashMode = "nar";
+      outputHashAlgo = "sha256";
+    };
+
+  dependency = buildSubmitting "dependency" ''
+    mkdir dependency
+    echo "this is a dependency" > dependency/foo
+    out="$(nix store add --scan ./dependency)"
+    nix store submit-output "$out" out
+  '';
+in
+buildSubmitting "reference" ''
+  mkdir mao
+  echo "miao" > mao/foo
+  echo "${dependency}" > mao/reference
+  mao="$(nix store add --scan ./mao)"
+
+  mkdir felis
+  echo "miau" > felis/foo
+  echo "$mao" > felis/reference
+  felis="$(nix store add --scan -n reference ./felis)"
+
+  nix store submit-output "$felis" out
+''
diff --git a/tests/functional/dyn-drv/submit-reference.sh b/tests/functional/dyn-drv/submit-reference.sh
new file mode 100755
index 000000000000..d1774f2d44ca
--- /dev/null
+++ b/tests/functional/dyn-drv/submit-reference.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+listReferences() {
+    nix path-info "$1" --json --json-format 2 | \
+        jq -r '.info[].references | sort | .[]'
+}
+
+# builder-rpc-v0
+requireDaemonNewerThan "2.35pre20260507"
+
+TODO_NixOS
+
+enableFeatures 'dynamic-derivations ca-derivations'
+restartDaemon
+
+NIX_BIN_DIR="$(dirname "$(type -p nix)")"
+export NIX_BIN_DIR
+
+outPath="$(nix build -L --file ./submit-reference.nix --no-link --print-out-paths)"
+
+mapfile -t rootRefs < <(listReferences "${outPath}")
+if [[ ${#rootRefs[@]} -ne 1 ]]; then
+    echo "Incorrect references for root output" >&2
+    exit 1
+fi
+
+echo "${rootRefs[0]}" | grep -- "-mao$"
+
+mapfile -t secondRefs < <(listReferences "$NIX_STORE_DIR/${rootRefs[0]}")
+if [[ ${#secondRefs[@]} -ne 1 ]]; then
+    echo "Incorrect references for other output" >&2
+    exit 1
+fi
+
+echo "${secondRefs[0]}" | grep -- "-dependency$"
diff --git a/tests/functional/eval-store.sh b/tests/functional/eval-store.sh
index 9f4b3b03646e..d32c905165a8 100755
--- a/tests/functional/eval-store.sh
+++ b/tests/functional/eval-store.sh
@@ -11,9 +11,6 @@ needLocalStore "“--eval-store” doesn't achieve much with the daemon"
 
 eval_store=$TEST_ROOT/eval-store
 
-clearStore
-rm -rf "$eval_store"
-
 nix build -f dependencies.nix --eval-store "$eval_store" -o "$TEST_ROOT/result"
 [[ -e $TEST_ROOT/result/foobar ]]
 if [[ -z "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
diff --git a/tests/functional/eval.sh b/tests/functional/eval.sh
index 586c413c961c..39cad2b82901 100755
--- a/tests/functional/eval.sh
+++ b/tests/functional/eval.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 testStdinHeredoc=$(nix eval -f - <<EOF
 {
   bar = 3 + 1;
diff --git a/tests/functional/export-graph.sh b/tests/functional/export-graph.sh
index 0490b580d1bd..f5257cef0194 100755
--- a/tests/functional/export-graph.sh
+++ b/tests/functional/export-graph.sh
@@ -4,9 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-clearProfiles
-
 checkRef() {
     nix-store -q --references "$TEST_ROOT"/result | grepQuiet "$1"'$' || fail "missing reference $1"
 }
diff --git a/tests/functional/export.sh b/tests/functional/export.sh
index 53bbdd9ac39e..9294395cee83 100755
--- a/tests/functional/export.sh
+++ b/tests/functional/export.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-
 outPath=$(nix-build dependencies.nix --no-out-link)
 
 nix-store --export "$outPath" > "$TEST_ROOT"/exp
diff --git a/tests/functional/fetchClosure.sh b/tests/functional/fetchClosure.sh
index 85a83d192259..162bb7974bad 100755
--- a/tests/functional/fetchClosure.sh
+++ b/tests/functional/fetchClosure.sh
@@ -6,14 +6,11 @@ enableFeatures "fetch-closure"
 
 TODO_NixOS
 
-clearStore
-clearCacheCache
-
 # Old daemons don't properly zero out the self-references when
-# calculating the CA hashes, so this breaks `nix store
+# calculating the CA hashes and take their positions into account, so this breaks `nix store
 # make-content-addressed` which expects the client and the daemon to
-# compute the same hash
-requireDaemonNewerThan "2.16.0pre20230524"
+# compute the same hash.
+requireDaemonNewerThan "2.35"
 
 # Initialize binary cache.
 nonCaPath=$(nix build --json --file ./dependencies.nix --no-link | jq -r .[].outputs.out)
diff --git a/tests/functional/fetchGit.sh b/tests/functional/fetchGit.sh
index 2992020f16a8..7255b5d7532b 100755
--- a/tests/functional/fetchGit.sh
+++ b/tests/functional/fetchGit.sh
@@ -4,16 +4,12 @@ source common.sh
 
 requireGit
 
-clearStoreIfPossible
-
 # Intentionally not in a canonical form
 # See https://github.com/NixOS/nix/issues/6195
 repo=$TEST_ROOT/./git
 
 export _NIX_FORCE_HTTP=1
 
-rm -rf "${repo}"-tmp "$TEST_HOME"/.cache/nix "$TEST_ROOT"/worktree "$TEST_ROOT"/minimal
-
 createGitRepo "$repo"
 
 echo utrecht > "$repo"/hello
@@ -35,7 +31,7 @@ nix-instantiate --eval -E "builtins.readFile ((builtins.fetchGit \"file://$TEST_
 
 # Fetch a worktree.
 unset _NIX_FORCE_HTTP
-expectStderr 0 nix eval -vvvv --impure --raw --expr "(builtins.fetchGit \"file://$TEST_ROOT/worktree\").outPath" | grepQuiet "copying '$TEST_ROOT/worktree/' to the store"
+expectStderr 0 nix eval -vvvv --impure --raw --expr "(builtins.fetchGit \"file://$TEST_ROOT/worktree\").outPath" | grepQuiet "copying '$TEST_ROOT/worktree' to the store"
 path0=$(nix eval --impure --raw --expr "(builtins.fetchGit \"file://$TEST_ROOT/worktree\").outPath")
 path0_=$(nix eval --impure --raw --expr "(builtins.fetchTree { type = \"git\"; url = \"file://$TEST_ROOT/worktree\"; }).outPath")
 [[ $path0 = "$path0_" ]]
diff --git a/tests/functional/fetchGitRefs.sh b/tests/functional/fetchGitRefs.sh
index 9c7fb323eb7e..25aebf9c7fcd 100755
--- a/tests/functional/fetchGitRefs.sh
+++ b/tests/functional/fetchGitRefs.sh
@@ -4,12 +4,8 @@ source common.sh
 
 requireGit
 
-clearStoreIfPossible
-
 repo="$TEST_ROOT/git"
 
-rm -rf "${repo}-tmp" "$TEST_HOME/.cache/nix"
-
 createGitRepo "$repo"
 
 echo utrecht > "$repo/hello"
diff --git a/tests/functional/fetchGitShallow.sh b/tests/functional/fetchGitShallow.sh
index 6b91d60cd9e3..0da36ee9bac9 100644
--- a/tests/functional/fetchGitShallow.sh
+++ b/tests/functional/fetchGitShallow.sh
@@ -29,9 +29,11 @@ git -C "$TEST_ROOT/shallow-parent" commit -m "Branch commit"
 # Make a shallow clone (depth=1)
 git clone --depth 1 "file://$TEST_ROOT/shallow-parent" "$TEST_ROOT/shallow-clone"
 
-# Test 1: Fetching a shallow repo shouldn't work by default, because we can't
-# return a revCount.
-(! nix eval --impure --raw --expr "(builtins.fetchGit { url = \"$TEST_ROOT/shallow-clone\"; ref = \"dev\"; }).outPath")
+# Test 1: Fetching a shallow repo succeeds for outPath because revCount is lazy.
+path1=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = \"$TEST_ROOT/shallow-clone\"; ref = \"dev\"; }).outPath")
+[[ -d "$path1" ]]
+# But accessing revCount on a shallow clone fails.
+(! nix eval --impure --expr "(builtins.fetchGit { url = \"$TEST_ROOT/shallow-clone\"; ref = \"dev\"; }).revCount" 2>/dev/null)
 
 # Test 2: But you can request a shallow clone, which won't return a revCount.
 path=$(nix eval --impure --raw --expr "(builtins.fetchTree { type = \"git\"; url = \"file://$TEST_ROOT/shallow-clone\"; ref = \"dev\"; shallow = true; }).outPath")
@@ -63,3 +65,32 @@ fi
 # Verify that we can shallow fetch the worktree
 git -C "$TEST_ROOT/shallow-worktree" rev-list --count HEAD >/dev/null
 nix eval --impure --raw --expr "(builtins.fetchGit { url = \"file://$TEST_ROOT/shallow-worktree\"; shallow = true; }).rev"
+
+# Test 5: nix build --dry-run on a shallow clone must not force revCount.
+# The flake fingerprint must not eagerly evaluate revCount, because that
+# would fail (or produce wrong results) on shallow clones.
+# Nor should it generate a complete lock file that serializes the root node.
+# We remove the parent repo to ensure that a future improvement that
+# tries to fetch missing history can't paper over the issue.
+createGitRepo "$TEST_ROOT/shallow-build-parent"
+echo "" > "$TEST_ROOT/shallow-build-parent/file.txt"
+git -C "$TEST_ROOT/shallow-build-parent" add file.txt
+git -C "$TEST_ROOT/shallow-build-parent" commit -m "first"
+cat > "$TEST_ROOT/shallow-build-parent/flake.nix" <<EOF
+{
+  outputs = { self }: {
+    packages.$system.default =
+      derivation {
+        name = "test";
+        system = "$system";
+        builder = "/bin/sh";
+        args = [ "-c" "echo ok > \\\$out" ];
+      };
+  };
+}
+EOF
+git -C "$TEST_ROOT/shallow-build-parent" add flake.nix
+git -C "$TEST_ROOT/shallow-build-parent" commit -m "add flake"
+git clone --depth 1 "file://$TEST_ROOT/shallow-build-parent" "$TEST_ROOT/shallow-build-clone"
+rm -rf "$TEST_ROOT/shallow-build-parent"
+nix build --dry-run "git+file://$TEST_ROOT/shallow-build-clone"
diff --git a/tests/functional/fetchGitSubmodules.sh b/tests/functional/fetchGitSubmodules.sh
index 7839fef0d7e8..ac77020d8472 100755
--- a/tests/functional/fetchGitSubmodules.sh
+++ b/tests/functional/fetchGitSubmodules.sh
@@ -2,17 +2,11 @@
 
 source common.sh
 
-set -u
-
 requireGit
 
-clearStoreIfPossible
-
 rootRepo=$TEST_ROOT/gitSubmodulesRoot
 subRepo=$TEST_ROOT/gitSubmodulesSub
 
-rm -rf "${rootRepo}" "${subRepo}" "$TEST_HOME"/.cache/nix
-
 # Submodules can't be fetched locally by default, which can cause
 # information leakage vulnerabilities, but for these tests our
 # submodule is intentionally local and it's all trusted, so we
diff --git a/tests/functional/fetchGitVerification.sh b/tests/functional/fetchGitVerification.sh
index 3b5f9b866b9a..1a6fac51ce04 100755
--- a/tests/functional/fetchGitVerification.sh
+++ b/tests/functional/fetchGitVerification.sh
@@ -7,8 +7,6 @@ requireGit
 
 enableFeatures "verified-fetches"
 
-clearStoreIfPossible
-
 repo="$TEST_ROOT/git"
 
 # generate signing keys
diff --git a/tests/functional/fetchMercurial.sh b/tests/functional/fetchMercurial.sh
index c965936002b3..2835758cc36b 100755
--- a/tests/functional/fetchMercurial.sh
+++ b/tests/functional/fetchMercurial.sh
@@ -6,14 +6,10 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-
 # Intentionally not in a canonical form
 # See https://github.com/NixOS/nix/issues/6195
 repo=$TEST_ROOT/./hg
 
-rm -rf "$repo" "${repo}"-tmp "$TEST_HOME"/.cache/nix
-
 hg init "$repo"
 {
     echo '[ui]'
diff --git a/tests/functional/fetchTree-file.sh b/tests/functional/fetchTree-file.sh
index 66be928c7b6b..869b5099a2e0 100755
--- a/tests/functional/fetchTree-file.sh
+++ b/tests/functional/fetchTree-file.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-
 cd "$TEST_ROOT"
 
 test_fetch_file () {
@@ -76,12 +74,12 @@ EOF
     # For backwards compatibility, flake inputs that correspond to the
     # old 'tarball' fetcher should still have their type set to 'tarball'
     assert (nodes.tarball_default_unpack.locked.type == "tarball");
-    # Unless explicitely specified, the 'unpack' parameter shouldn’t appear here
+    # Unless explicitly specified, the 'unpack' parameter shouldn’t appear here
     # because that would break older Nix versions
     assert (!nodes.tarball_default_unpack.locked ? unpack);
     assert (nodes.tarball_default_unpack.locked.narHash == "$input_directory_hash");
 
-    # Explicitely passing the unpack parameter should enforce the desired behavior
+    # Explicitly passing the unpack parameter should enforce the desired behavior
     assert (nodes.no_ext_explicit_unpack.locked.narHash == nodes.tarball_default_unpack.locked.narHash);
     assert (nodes.tarball_explicit_no_unpack.locked.narHash == nodes.no_ext_default_no_unpack.locked.narHash);
 
diff --git a/tests/functional/fetchurl.sh b/tests/functional/fetchurl.sh
index c25ac321668a..452ac043a5b3 100755
--- a/tests/functional/fetchurl.sh
+++ b/tests/functional/fetchurl.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-
 # Test fetching a flat file.
 hash=$(nix-hash --flat --type sha256 ./fetchurl.sh)
 
diff --git a/tests/functional/filter-source.sh b/tests/functional/filter-source.sh
index b32f5b59d524..acfc551fa44a 100755
--- a/tests/functional/filter-source.sh
+++ b/tests/functional/filter-source.sh
@@ -2,14 +2,8 @@
 
 source common.sh
 
-rm -rf "$TEST_ROOT/filterin"
-mkdir "$TEST_ROOT/filterin"
-mkdir "$TEST_ROOT/filterin/foo"
-touch "$TEST_ROOT/filterin/foo/bar"
-touch "$TEST_ROOT/filterin/xyzzy"
-touch "$TEST_ROOT/filterin/b"
-touch "$TEST_ROOT/filterin/bak"
-touch "$TEST_ROOT"/filterin/bla.c.bak
+mkdir -p "$TEST_ROOT/filterin/foo"
+touch "$TEST_ROOT"/filterin/{foo/bar,xyzzy,b,bak,bla.c.bak}
 ln -s xyzzy "$TEST_ROOT/filterin/link"
 
 checkFilter() {
diff --git a/tests/functional/fixed-slow-vs-bad.nix b/tests/functional/fixed-slow-vs-bad.nix
new file mode 100644
index 000000000000..38357e9fccd0
--- /dev/null
+++ b/tests/functional/fixed-slow-vs-bad.nix
@@ -0,0 +1,35 @@
+with import ./config.nix;
+
+{
+  slow = mkDerivation {
+    name = "fixed";
+    outputHashMode = "flat";
+    outputHashAlgo = "sha256";
+    outputHash = builtins.hashString "sha256" "fixed";
+
+    buildCommand = ''
+      echo "slow: Started" >&2
+      if [[ -p /sync-fifo/fifo ]]; then
+        echo slow-ready > /sync-fifo/fifo
+      else
+        echo "slow: No sync fifo, continuing" >&2
+      fi
+      echo "slow: Entering infinite loop" >&2
+      while true ; do echo -n .; done
+    '';
+  };
+
+  bad = mkDerivation {
+    name = "fixed";
+    outputHashMode = "flat";
+    outputHashAlgo = "sha256";
+    outputHash = builtins.hashString "sha256" "wrong";
+
+    buildCommand = ''
+      echo "bad: Waiting for sync" >&2
+      cat /sync-fifo/fifo || echo "bad: No sync fifo, continuing" >&2
+      echo -n fixed > $out
+      echo "bad: Done" >&2
+    '';
+  };
+}
diff --git a/tests/functional/fixed-slow-vs-bad.sh b/tests/functional/fixed-slow-vs-bad.sh
new file mode 100755
index 000000000000..0ec6ff735c43
--- /dev/null
+++ b/tests/functional/fixed-slow-vs-bad.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+requireSandboxSupport
+
+# Requires bug fix for daemon
+requireDaemonNewerThan "2.35.0pre20260518"
+
+# See https://github.com/NixOS/nix/issues/15846
+#
+# `slow` is a fixed-output derivation that never finishes (which simulates a
+# slow derivation that loses the race), and `bad` is a fixed-output derivation
+# whose *correct* store path is the same as `slow`'s *declared output*. A
+# deadlock used to happen when:
+#
+# - `slow` locks the output path (A)
+# - `bad` completes
+# - `bad` locks the same output path as `slow` (B)
+# - (Never gets to happen: the output of `bad` is moved to the store path)
+#
+# In this case, we should let (B) fail and just don't try to move the output of
+# `bad`. This does mean that the output of `bad` is gone (if we don't pass
+# `--keep-going`), but the situation still makes sense since it can be explained
+# as `slow` being cancelled.
+
+sandboxArgs=()
+
+# Sandboxing is not required, but it makes the deadlock more likely to happen.
+if canUseSandbox; then
+  sandboxArgs+=(--option sandbox true)
+  sandboxArgs+=(--option sandbox-build-dir /build-non-standard)
+
+  # When using a separate test store, we need sandbox-paths to access
+  # the system store. See the same check in build.sh.
+  if ! isTestOnNixOS; then
+      sandboxArgs+=(--option extra-sandbox-paths "/nix/store")
+  fi
+
+  fifoDir="$TEST_ROOT/sync-fifo"
+  mkdir -p "$fifoDir"
+  mkfifo "$fifoDir/fifo"
+  chmod a+rw "$fifoDir/fifo"
+  sandboxArgs+=(--option extra-sandbox-paths "/sync-fifo=$TEST_ROOT/sync-fifo")
+fi
+
+expectStderr 1 nix build -L --max-jobs 2 "${sandboxArgs[@]}" -f fixed-slow-vs-bad.nix slow bad \
+  | grepQuiet "hash mismatch in fixed-output derivation"
diff --git a/tests/functional/fixed.sh b/tests/functional/fixed.sh
index 9d769a578a72..6065622b66ba 100755
--- a/tests/functional/fixed.sh
+++ b/tests/functional/fixed.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-
 path=$(nix-store -q "$(nix-instantiate fixed.nix -A good.0)")
 
 echo 'testing bad...'
diff --git a/tests/functional/flakes/check.sh b/tests/functional/flakes/check.sh
index cb4e3eebafc2..385341bd09c2 100755
--- a/tests/functional/flakes/check.sh
+++ b/tests/functional/flakes/check.sh
@@ -156,6 +156,17 @@ cp "${config_nix}" "$flakeDir/"
 
 expectStderr 0 nix flake check "$flakeDir" | grepQuiet 'running 1 flake check'
 
+# Test that `nix flake check --print-out-paths` produces the same out path as `nix build --print-out-paths`
+outPath=$(nix flake check "$flakeDir" --print-out-paths)
+outPathBuild=$(nix build "${flakeDir}#checks.$system.foo" --print-out-paths --no-link)
+[[ "$outPath" = "$outPathBuild" ]] || fail "out paths from flake check and build don't match"
+
+# Test out links
+! test -e result || fail "unexpected out link result found"
+nix flake check "$flakeDir" --out-link result
+test -e result || fail "out link result not found"
+rm result
+
 cat > "$flakeDir"/flake.nix <<EOF
 {
   outputs = { self }: {
diff --git a/tests/functional/flakes/develop.sh b/tests/functional/flakes/develop.sh
index 0248adf49eaf..2b4ae328b0c6 100755
--- a/tests/functional/flakes/develop.sh
+++ b/tests/functional/flakes/develop.sh
@@ -4,9 +4,6 @@ source ../common.sh
 
 TODO_NixOS
 
-clearStore
-rm -rf "$TEST_HOME/.cache" "$TEST_HOME/.config" "$TEST_HOME/.local"
-
 # Create flake under test.
 cp ../shell-hello.nix "$config_nix" "$TEST_HOME/"
 cat <<EOF >"$TEST_HOME/flake.nix"
@@ -66,7 +63,7 @@ echo "\$ENVVAR"
 EOF
 )" ]]
 
-# Test wether `--keep-env-var` keeps the environment variable.
+# Test whether `--keep-env-var` keeps the environment variable.
 (
   expect='BAR'
   got="$(FOO='BAR' nix develop --ignore-env --keep-env-var FOO --no-write-lock-file .#hello <<EOF
@@ -76,7 +73,7 @@ EOF
   [[ "$got" == "$expect" ]]
 )
 
-# Test wether duplicate `--keep-env-var` keeps the environment variable.
+# Test whether duplicate `--keep-env-var` keeps the environment variable.
 (
   expect='BAR'
   got="$(FOO='BAR' nix develop --ignore-env --keep-env-var FOO --keep-env-var FOO --no-write-lock-file .#hello <<EOF
@@ -86,7 +83,7 @@ EOF
   [[ "$got" == "$expect" ]]
 )
 
-# Test wether `--set-env-var` sets the environment variable.
+# Test whether `--set-env-var` sets the environment variable.
 (
   expect='BAR'
   got="$(nix develop --ignore-env --set-env-var FOO 'BAR' --no-write-lock-file .#hello <<EOF
@@ -125,11 +122,11 @@ expectStderr 1 nix develop --keep-env-var FOO .#hello |
 expectStderr 1 nix develop --ignore-env --unset-env-var FOO .#hello |
   grepQuiet "error: --unset-env-var does not make sense with --ignore-env"
 
-# Test wether multiple occurances of `--set-env-var` throws.
+# Test whether multiple occurrences of `--set-env-var` throws.
 expectStderr 1 nix develop --set-env-var FOO 'BAR' --set-env-var FOO 'BLA' --no-write-lock-file .#hello |
   grepQuiet "error: Duplicate definition of environment variable 'FOO' with '--set-env-var' is ambiguous"
 
-# Test wether similar `--unset-env-var` and `--set-env-var` throws.
+# Test whether similar `--unset-env-var` and `--set-env-var` throws.
 expectStderr 1 nix develop --set-env-var FOO 'BAR' --unset-env-var FOO --no-write-lock-file .#hello |
   grepQuiet "error: Cannot unset environment variable 'FOO' that is set with '--set-env-var'"
 
diff --git a/tests/functional/flakes/edit.sh b/tests/functional/flakes/edit.sh
index 0d926c28745d..2758c397ec88 100755
--- a/tests/functional/flakes/edit.sh
+++ b/tests/functional/flakes/edit.sh
@@ -9,4 +9,3 @@ nix edit "$flake1Dir#" | grepQuiet simple.builder.sh
 tar --exclude=".git*" -czf "$TEST_ROOT"/flake1Dir.tar.gz -C "$(dirname "$flake1Dir")" "$(basename "$flake1Dir")"
 # Test that editing a file from a tarball flake works and the file is readonly.
 nix edit "file://$TEST_ROOT/flake1Dir.tar.gz" | grepQuiet simple.builder.sh
-EDITOR='test ! -w' nix edit "file://$TEST_ROOT/flake1Dir.tar.gz"
diff --git a/tests/functional/flakes/flake-in-submodule.sh b/tests/functional/flakes/flake-in-submodule.sh
index e0794f014c0d..50c680d1220d 100755
--- a/tests/functional/flakes/flake-in-submodule.sh
+++ b/tests/functional/flakes/flake-in-submodule.sh
@@ -17,8 +17,6 @@ requireGit
 
 TODO_NixOS
 
-clearStore
-
 # Submodules can't be fetched locally by default.
 # See fetchGitSubmodules.sh
 export GIT_CONFIG_COUNT=1
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index 8d95f61240bd..948289a40fef 100755
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -6,9 +6,6 @@ TODO_NixOS
 
 requireGit
 
-clearStore
-rm -rf "$TEST_HOME"/.cache "$TEST_HOME"/.config
-
 createFlake1
 createFlake2
 
@@ -69,7 +66,6 @@ nix flake metadata "$flake1Dir" | grepQuiet 'URL:.*flake1.*'
 # Test 'nix flake metadata --json'.
 json=$(nix flake metadata flake1 --json | jq .)
 [[ $(echo "$json" | jq -r .description) = 'Bla bla' ]]
-[[ -d $(echo "$json" | jq -r .path) ]]
 [[ $(echo "$json" | jq -r .lastModified) = $(git -C "$flake1Dir" log -n1 --format=%ct) ]]
 hash1=$(echo "$json" | jq -r .revision)
 [[ -n $(echo "$json" | jq -r .fingerprint) ]]
diff --git a/tests/functional/flakes/follow-paths.sh b/tests/functional/flakes/follow-paths.sh
index f658a0847f7a..39e87348f140 100755
--- a/tests/functional/flakes/follow-paths.sh
+++ b/tests/functional/flakes/follow-paths.sh
@@ -131,7 +131,7 @@ EOF
 git -C "$flakeFollowsA" add flake.nix
 
 expect 1 nix flake lock "$flakeFollowsA" 2>&1 | grep '/flakeB.*is forbidden in pure evaluation mode'
-expect 1 nix flake lock --impure "$flakeFollowsA" 2>&1 | grep "'flakeB' is too short to be a valid store path"
+expect 1 nix flake lock --impure "$flakeFollowsA" 2>&1 | grep '/flakeB.*does not exist'
 
 # Test relative non-flake inputs.
 cat > "$flakeFollowsA"/flake.nix <<EOF
@@ -153,7 +153,7 @@ nix flake lock "$flakeFollowsA"
 
 [[ $(nix eval --json "$flakeFollowsA"#e) = 123 ]]
 
-# Non-existant follows should print a warning.
+# Non-existent follows should print a warning.
 cat >"$flakeFollowsA"/flake.nix <<EOF
 {
     description = "Flake A";
diff --git a/tests/functional/flakes/meson.build b/tests/functional/flakes/meson.build
index 829ec3d74aed..16660f6d015b 100644
--- a/tests/functional/flakes/meson.build
+++ b/tests/functional/flakes/meson.build
@@ -35,6 +35,7 @@ suites += {
     'old-lockfiles.sh',
     'trace-ifd.sh',
     'get-flake.sh',
+    'type-error-fallback.sh',
   ],
   'workdir' : meson.current_source_dir(),
 }
diff --git a/tests/functional/flakes/relative-paths.sh b/tests/functional/flakes/relative-paths.sh
index 323e97ba9cc0..cd6442e5c67b 100644
--- a/tests/functional/flakes/relative-paths.sh
+++ b/tests/functional/flakes/relative-paths.sh
@@ -9,7 +9,6 @@ subflake0="$rootFlake/sub0"
 subflake1="$rootFlake/sub1"
 subflake2="$rootFlake/sub2"
 
-rm -rf "$rootFlake"
 mkdir -p "$rootFlake" "$subflake0" "$subflake1" "$subflake2"
 
 cat > "$rootFlake/flake.nix" <<EOF
@@ -65,7 +64,7 @@ git -C "$rootFlake" add flake.nix sub2/flake.nix
 
 [[ $(nix eval "$subflake2#y") = 15 ]]
 
-# Make sure that this still works after commiting the lock file.
+# Make sure that this still works after committing the lock file.
 git -C "$rootFlake" add sub2/flake.lock
 [[ $(nix eval "$subflake2#y") = 15 ]]
 
diff --git a/tests/functional/flakes/run.sh b/tests/functional/flakes/run.sh
index 1de6f2844180..d3e4549dc5cf 100755
--- a/tests/functional/flakes/run.sh
+++ b/tests/functional/flakes/run.sh
@@ -4,9 +4,6 @@ source ../common.sh
 
 TODO_NixOS
 
-clearStore
-rm -rf "$TEST_HOME"/.cache "$TEST_HOME"/.config "$TEST_HOME"/.local
-
 cp ../shell-hello.nix "${config_nix}" "$TEST_HOME"
 cd "$TEST_HOME"
 
diff --git a/tests/functional/flakes/search-root.sh b/tests/functional/flakes/search-root.sh
index 1ee29fac4b53..e058bf2b72ae 100755
--- a/tests/functional/flakes/search-root.sh
+++ b/tests/functional/flakes/search-root.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 writeSimpleFlake "$TEST_HOME"
 cd "$TEST_HOME"
 mkdir -p foo/subdir
diff --git a/tests/functional/flakes/type-error-fallback.sh b/tests/functional/flakes/type-error-fallback.sh
new file mode 100755
index 000000000000..cb77834d0e5f
--- /dev/null
+++ b/tests/functional/flakes/type-error-fallback.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+source ./common.sh
+
+# Test that attribute path resolution correctly handles TypeError fallback
+# when packages.*.foo is a string but legacyPackages.*.foo is an attrset
+
+flakeDir=$TEST_ROOT/type-error-fallback
+
+mkdir -p "$flakeDir"
+cat > "$flakeDir"/flake.nix <<EOF
+{
+    outputs = { self }: {
+        # packages.*.hello is a string (not a path, just a string value)
+        packages.$system.hello = "packages-hello";
+
+        # legacyPackages.*.hello is an attrset with .out
+        legacyPackages.$system.hello = {
+            type = "derivation";
+            out = "legacyPackages-hello-out";
+            outputName = "out";
+        };
+    };
+}
+EOF
+
+# Test 1: #hello should pick packages (the string)
+result=$(nix eval --impure --raw "$flakeDir#hello")
+[[ "$result" == "packages-hello" ]]
+
+# Test 2: #hello.out should fallback to legacyPackages after TypeError
+# (because packages.hello is a string, not an attrset with .out)
+result=$(nix eval --impure --raw "$flakeDir#hello.out")
+[[ "$result" == "legacyPackages-hello-out" ]]
+
+# Test 3: Explicitly accessing packages.*.hello.out should fail
+# (when directly specified, no fallback happens)
+expect 1 nix eval --impure "$flakeDir#packages.$system.hello.out" 2>&1 | \
+    grepQuiet "does not provide attribute"
+
+# Test 4: Explicitly accessing legacyPackages.*.hello.out should succeed
+result=$(nix eval --impure --raw "$flakeDir#legacyPackages.$system.hello.out")
+[[ "$result" == "legacyPackages-hello-out" ]]
diff --git a/tests/functional/formatter.sh b/tests/functional/formatter.sh
index 03b31708d670..444973e752d3 100755
--- a/tests/functional/formatter.sh
+++ b/tests/functional/formatter.sh
@@ -4,9 +4,6 @@ source common.sh
 
 TODO_NixOS # Provide a `shell` variable. Try not to `export` it, perhaps.
 
-clearStoreIfPossible
-rm -rf "$TEST_HOME"/.cache "$TEST_HOME"/.config "$TEST_HOME"/.local
-
 cp ./simple.nix ./simple.builder.sh ./formatter.simple.sh "${config_nix}" "$TEST_HOME"
 
 cd "$TEST_HOME"
diff --git a/tests/functional/gc-auto.sh b/tests/functional/gc-auto.sh
index ea877f27f1fb..3743afb20b68 100755
--- a/tests/functional/gc-auto.sh
+++ b/tests/functional/gc-auto.sh
@@ -7,8 +7,6 @@ needLocalStore "“min-free” and “max-free” are daemon options"
 
 TODO_NixOS
 
-clearStore
-
 # shellcheck disable=SC2034
 garbage1=$(nix store add-path --name garbage1 ./nar-access.sh)
 # shellcheck disable=SC2034
diff --git a/tests/functional/gc-closure.sh b/tests/functional/gc-closure.sh
index 03e2a0fc25d6..ee91667cd21f 100755
--- a/tests/functional/gc-closure.sh
+++ b/tests/functional/gc-closure.sh
@@ -5,25 +5,43 @@ source common.sh
 TODO_NixOS
 
 nix_gc_closure() {
+    ensureNoDeleteReferrer="${1}"
+    extraArg="${2:-""}"
     clearStore
-    nix build -f dependencies.nix input0_drv --out-link "$TEST_ROOT/gc-root"
+    nix build -f dependencies2.nix input0_drv --out-link "$TEST_ROOT/gc-root"
     input0=$(realpath "$TEST_ROOT/gc-root")
-    input1=$(nix build -f dependencies.nix input1_drv --no-link --print-out-paths)
-    input2=$(nix build -f dependencies.nix input2_drv --no-link --print-out-paths)
-    top=$(nix build -f dependencies.nix --no-link --print-out-paths)
-    somthing_else=$(nix store add-path ./dependencies.nix)
+    input1=$(nix build -f dependencies2.nix input1_drv --no-link --print-out-paths)
+    input2=$(nix build -f dependencies2.nix input2_drv --no-link --print-out-paths)
+    input2_out=$(printf "%s" "$input2" | head -n1)
+    input2_out2=$(printf "%s" "$input2" | tail -n1)
+    top=$(nix build -f dependencies2.nix --no-link --print-out-paths)
+    something_else=$(nix store add-path ./dependencies2.nix)
 
     if isDaemonNewer "2.35pre"; then
+        if [[ "$extraArg" != "--also-referrers" ]] && ! "$ensureNoDeleteReferrer"; then
+            nix store delete "$input2_out2"
+        fi
         # Check that nix store delete --recursive --skip-alive is best-effort (doesn't fail when some paths in the closure are alive)
-        nix store delete --recursive --skip-alive "$top"
+        # shellcheck disable=SC2086 # we want $extraArg to expand to nothing if unset
+        nix store delete --recursive --skip-alive $extraArg "$top"
         [[ ! -e "$top" ]] || fail "top should have been deleted"
         [[ -e "$input0" ]] || fail "input0 is a gc root, shouldn't have been deleted"
-        [[ ! -e "$input2" ]] || fail "input2 is not a gc root and is part of top's closure, it should have been deleted"
         [[ -e "$input1" ]] || fail "input1 is not in the closure of top, it shouldn't have been deleted"
-        [[ -e "$somthing_else" ]] || fail "somthing_else is not in the closure of top, it shouldn't have been deleted"
+        [[ -e "$something_else" ]] || fail "something_else is not in the closure of top, it shouldn't have been deleted"
+        if [[ "$extraArg" = "--also-referrers" ]]; then
+            [[ ! -e "$input2_out" ]] || fail "input2_out is part of top's closure and we can delete dead referrers, it should have been deleted"
+        elif "$ensureNoDeleteReferrer"; then
+            [[ -e "$input2_out" ]] || fail "input2_out is part of top's closure but we can't delete dead referrers, it shouldn't have been deleted"
+        else
+            [[ ! -e "$input2_out" ]] || fail "input2_out is not a gc root, is part of top's closure, and has no referrers, it should have been deleted"
+        fi
+    elif [[ "$extraArg" = "--also-referrers" ]]; then
+        expectStderr 1 nix store delete --recursive --also-referrers "$top" | grepQuiet "Your daemon version is too old to support deleting referrers"
     else
         expectStderr 1 nix store delete --recursive --skip-alive "$top" | grepQuiet "Your daemon version is too old to support garbage collecting a specific set of paths"
     fi
 }
 
-nix_gc_closure
+nix_gc_closure false
+nix_gc_closure true
+nix_gc_closure false --also-referrers
diff --git a/tests/functional/gc-concurrent.sh b/tests/functional/gc-concurrent.sh
index dcfcea3e960b..196d2f510611 100755
--- a/tests/functional/gc-concurrent.sh
+++ b/tests/functional/gc-concurrent.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-
 lockFifo1=$TEST_ROOT/test1.fifo
 mkfifo "$lockFifo1"
 
diff --git a/tests/functional/gc-non-blocking.sh b/tests/functional/gc-non-blocking.sh
index a85b8e5db416..4ed0a9fa1268 100755
--- a/tests/functional/gc-non-blocking.sh
+++ b/tests/functional/gc-non-blocking.sh
@@ -8,8 +8,6 @@ TODO_NixOS
 
 needLocalStore "the GC test needs a synchronisation point"
 
-clearStore
-
 # This FIFO is read just after the global GC lock has been acquired,
 # but before the root server is started.
 fifo1=$TEST_ROOT/test2.fifo
diff --git a/tests/functional/gc.sh b/tests/functional/gc.sh
index c58f47021f84..aa20c5a0339f 100755
--- a/tests/functional/gc.sh
+++ b/tests/functional/gc.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-
 drvPath=$(nix-instantiate dependencies.nix)
 outPath=$(nix-store -rvv "$drvPath")
 
diff --git a/tests/functional/git-hashing/common.sh b/tests/functional/git-hashing/common.sh
index 2d41c0ff8b74..cbefe93bc33a 100644
--- a/tests/functional/git-hashing/common.sh
+++ b/tests/functional/git-hashing/common.sh
@@ -4,9 +4,6 @@ source ../common.sh
 
 TODO_NixOS # Need to enable git hashing feature and make sure test is ok for store we don't clear
 
-clearStore
-clearCache
-
 # Need backend to support git-hashing too
 requireDaemonNewerThan "2.19"
 
diff --git a/tests/functional/git/meson.build b/tests/functional/git/meson.build
index af6882698b2c..73c4bc782871 100644
--- a/tests/functional/git/meson.build
+++ b/tests/functional/git/meson.build
@@ -1,6 +1,9 @@
 suites += {
   'name' : 'git',
   'deps' : [],
-  'tests' : [ 'packed-refs-no-cache.sh' ],
+  'tests' : [
+    'packed-refs-no-cache.sh',
+    'symlinked-repo.sh',
+  ],
   'workdir' : meson.current_source_dir(),
 }
diff --git a/tests/functional/git/packed-refs-no-cache.sh b/tests/functional/git/packed-refs-no-cache.sh
index 74ff9da67f52..33ffd5fa33e9 100644
--- a/tests/functional/git/packed-refs-no-cache.sh
+++ b/tests/functional/git/packed-refs-no-cache.sh
@@ -15,8 +15,6 @@ source ../common.sh
 
 requireGit
 
-clearStoreIfPossible
-
 # Intentionally not in a canonical form
 # See https://github.com/NixOS/nix/issues/6195
 repo=$TEST_ROOT/./git
diff --git a/tests/functional/git/symlinked-repo.sh b/tests/functional/git/symlinked-repo.sh
new file mode 100644
index 000000000000..e30b0b3c0d8f
--- /dev/null
+++ b/tests/functional/git/symlinked-repo.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+source ../common.sh
+
+requireGit
+
+repo=$TEST_ROOT/repo
+link=$TEST_ROOT/link
+
+createGitRepo "$repo"
+ln -s "$repo" "$link"
+
+# Dereferencing final symlink component should work and follow it to the directory.
+# Also test various cases of symlink trickery in case that ever changes.
+for path in {repo,link}{,/,/.} {repo,link}/.././repo{,/,/.}; do
+    [ "$(nix-instantiate --eval --expr "builtins.readFileType (builtins.fetchTree \"git+file://$TEST_ROOT/$path\").outPath")" == '"directory"' ]
+done
diff --git a/tests/functional/hash-path.sh b/tests/functional/hash-path.sh
index 4894ae391469..f6aa9ca05c3a 100755
--- a/tests/functional/hash-path.sh
+++ b/tests/functional/hash-path.sh
@@ -73,7 +73,6 @@ try2 () {
     fi
 }
 
-rm -rf "$TEST_ROOT/hash-path"
 mkdir "$TEST_ROOT/hash-path"
 echo "Hello World" > "$TEST_ROOT/hash-path/hello"
 
diff --git a/tests/functional/import-from-derivation.sh b/tests/functional/import-from-derivation.sh
index 2970a830ee72..b46b14969f1d 100755
--- a/tests/functional/import-from-derivation.sh
+++ b/tests/functional/import-from-derivation.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStoreIfPossible
-
 export NIX_PATH=config="${config_nix}"
 
 if nix-instantiate --readonly-mode ./import-from-derivation.nix -A result; then
diff --git a/tests/functional/impure-derivations.sh b/tests/functional/impure-derivations.sh
index 6fc25bf90608..2c15e628dd42 100755
--- a/tests/functional/impure-derivations.sh
+++ b/tests/functional/impure-derivations.sh
@@ -9,8 +9,6 @@ TODO_NixOS
 enableFeatures "ca-derivations impure-derivations"
 restartDaemon
 
-clearStoreIfPossible
-
 # Basic test of impure derivations: building one a second time should not use the previous result.
 printf 0 > "$TEST_ROOT"/counter
 
diff --git a/tests/functional/impure-env.sh b/tests/functional/impure-env.sh
index ca32c1030016..6199c26f8f65 100755
--- a/tests/functional/impure-env.sh
+++ b/tests/functional/impure-env.sh
@@ -17,7 +17,6 @@ varTest() {
     clearStore
 }
 
-clearStore
 startDaemon
 
 varTest env_name value --impure-env env_name=value
diff --git a/tests/functional/json.sh b/tests/functional/json.sh
index 49992e0d9324..157395e11373 100644
--- a/tests/functional/json.sh
+++ b/tests/functional/json.sh
@@ -51,7 +51,7 @@ if type script &>/dev/null; then
     if [[ $acceptsCommandFlag -eq 0 ]]; then
       script -e -q /dev/null "$@"
     else
-      script -e -q /dev/null -c "$(shellEscapeArray "$@")"
+      script -e -q -c "$(shellEscapeArray "$@")" /dev/null
     fi
   }
   runScript nix eval --json --expr "{ a.b.c = true; }" > "$TEST_HOME/actual.json"
diff --git a/tests/functional/lang-gc.sh b/tests/functional/lang-gc.sh
index 1746fa4c151f..c925a585daf5 100644
--- a/tests/functional/lang-gc.sh
+++ b/tests/functional/lang-gc.sh
@@ -7,9 +7,7 @@
 
 source common.sh
 
-set -o pipefail
-
-skipTest "Too memory instensive for CI. Attempt to reduce memory usage was unsuccessful, because it made detection of the bug unreliable."
+skipTest "Too memory intensive for CI. Attempt to reduce memory usage was unsuccessful, because it made detection of the bug unreliable."
 
 # Regression test for #11141. The stack pointer corrector assigned the base
 # instead of the top (which resides at the low end of the stack). Sounds confusing?
diff --git a/tests/functional/lang.sh b/tests/functional/lang.sh
index 63264ec22770..71067035df1d 100755
--- a/tests/functional/lang.sh
+++ b/tests/functional/lang.sh
@@ -2,20 +2,18 @@
 
 source common.sh
 
-set -o pipefail
-
-source characterisation/framework.sh
+source common/characterisation/framework.sh
 
 # specialize function a bit
 function diffAndAccept() {
     local -r testName="$1"
-    local -r got="lang/$testName.$2"
+    local -r got="$TEST_ROOT/$testName.$2"
     local -r expected="lang/$testName.$3"
     diffAndAcceptInner "$testName" "$got" "$expected"
 }
 
 export TEST_VAR=foo # for eval-okay-getenv.nix
-export NIX_REMOTE=dummy://
+export NIX_REMOTE=dummy:// # FIXME: Run with multiple store types and without readonly mode
 export NIX_STORE_DIR=/nix/store
 
 nix-instantiate --eval -E 'builtins.trace "Hello" 123' 2>&1 | grepQuiet Hello
@@ -60,7 +58,7 @@ postprocess() {
             # just exposes us to the complexity of not having /usr/bin/env in
             # the sandbox. So let's just hardcode bash for now.
             set -x;
-            bash "lang/$1.postprocess" "lang/$1"
+            bash "lang/$1.postprocess" "$TEST_ROOT/$1"
         )
     fi
 }
@@ -68,7 +66,7 @@ postprocess() {
 for i in lang/parse-fail-*.nix; do
     echo "parsing $i (should fail)";
     i=$(basename "$i" .nix)
-    if expectStderr 1 nix-instantiate --parse - < "lang/$i.nix" > "lang/$i.err"
+    if expectStderr 1 nix-instantiate --parse - < "lang/$i.nix" > "$TEST_ROOT/$i.err"
     then
         postprocess "$i"
         diffAndAccept "$i" err err.exp
@@ -83,10 +81,10 @@ for i in lang/parse-okay-*.nix; do
     i=$(basename "$i" .nix)
     if
         expect 0 nix-instantiate --parse - < "lang/$i.nix" \
-            1> "lang/$i.out" \
-            2> "lang/$i.err"
+            1> "$TEST_ROOT/$i.out" \
+            2> "$TEST_ROOT/$i.err"
     then
-        sed "s!$(pwd)!/pwd!g" "lang/$i.out" "lang/$i.err"
+        sed "s!$(pwd)!/pwd!g" "$TEST_ROOT/$i.out" "$TEST_ROOT/$i.err"
         postprocess "$i"
         diffAndAccept "$i" out exp
         diffAndAccept "$i" err err.exp
@@ -110,7 +108,7 @@ for i in lang/eval-fail-*.nix; do
     if
         # shellcheck disable=SC2086 # word splitting of flags is intended
         expectStderr 1 nix-instantiate $flags "lang/$i.nix" \
-            | sed "s!$(pwd)!/pwd!g" > "lang/$i.err"
+            | sed "s!$(pwd)!/pwd!g" > "$TEST_ROOT/$i.err"
     then
         postprocess "$i"
         diffAndAccept "$i" err err.exp
@@ -126,7 +124,7 @@ for i in lang/eval-okay-*.nix; do
 
     if test -e "lang/$i.exp.xml"; then
         if expect 0 nix-instantiate --eval --xml --no-location --strict \
-                "lang/$i.nix" > "lang/$i.out.xml"
+                "lang/$i.nix" > "$TEST_ROOT/$i.out.xml"
         then
             postprocess "$i"
             diffAndAccept "$i" out.xml exp.xml
@@ -145,10 +143,10 @@ for i in lang/eval-okay-*.nix; do
                 NIX_PATH=lang/dir3:lang/dir4 \
                 HOME=/fake-home \
                 nix-instantiate "${flags[@]}" --eval --strict "lang/$i.nix" \
-                1> "lang/$i.out" \
-                2> "lang/$i.err"
+                1> "$TEST_ROOT/$i.out" \
+                2> "$TEST_ROOT/$i.err"
         then
-            sed -i "s!$(pwd)!/pwd!g" "lang/$i.out" "lang/$i.err"
+            sed -i "s!$(pwd)!/pwd!g" "$TEST_ROOT/$i.out" "$TEST_ROOT/$i.err"
             postprocess "$i"
             diffAndAccept "$i" out exp
             diffAndAccept "$i" err err.exp
diff --git a/tests/functional/lang/eval-fail-add-1.err.exp b/tests/functional/lang/eval-fail-add-1.err.exp
new file mode 100644
index 000000000000..4a72eba125e7
--- /dev/null
+++ b/tests/functional/lang/eval-fail-add-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'add' builtin
+         at /pwd/lang/eval-fail-add-1.nix:1:1:
+            1| builtins.add "foo" 1
+             | ^
+            2|
+
+       … while evaluating the first argument of the addition
+
+       error: expected an integer but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-add-1.nix b/tests/functional/lang/eval-fail-add-1.nix
new file mode 100644
index 000000000000..4a59d94e68af
--- /dev/null
+++ b/tests/functional/lang/eval-fail-add-1.nix
@@ -0,0 +1 @@
+builtins.add "foo" 1
diff --git a/tests/functional/lang/eval-fail-add-2.err.exp b/tests/functional/lang/eval-fail-add-2.err.exp
new file mode 100644
index 000000000000..429636348d27
--- /dev/null
+++ b/tests/functional/lang/eval-fail-add-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'add' builtin
+         at /pwd/lang/eval-fail-add-2.nix:1:1:
+            1| builtins.add 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument of the addition
+
+       error: expected an integer but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-add-2.nix b/tests/functional/lang/eval-fail-add-2.nix
new file mode 100644
index 000000000000..1b785aba2700
--- /dev/null
+++ b/tests/functional/lang/eval-fail-add-2.nix
@@ -0,0 +1 @@
+builtins.add 1 "foo"
diff --git a/tests/functional/lang/eval-fail-all-1.err.exp b/tests/functional/lang/eval-fail-all-1.err.exp
new file mode 100644
index 000000000000..95e8735f8ca5
--- /dev/null
+++ b/tests/functional/lang/eval-fail-all-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'all' builtin
+         at /pwd/lang/eval-fail-all-1.nix:1:1:
+            1| builtins.all 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.all
+
+       error: expected a function but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-all-1.nix b/tests/functional/lang/eval-fail-all-1.nix
new file mode 100644
index 000000000000..c1ae6ff5e18c
--- /dev/null
+++ b/tests/functional/lang/eval-fail-all-1.nix
@@ -0,0 +1 @@
+builtins.all 1 "foo"
diff --git a/tests/functional/lang/eval-fail-all-2.err.exp b/tests/functional/lang/eval-fail-all-2.err.exp
new file mode 100644
index 000000000000..584543f5e85e
--- /dev/null
+++ b/tests/functional/lang/eval-fail-all-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'all' builtin
+         at /pwd/lang/eval-fail-all-2.nix:1:1:
+            1| builtins.all (_: 1) "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.all
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-all-2.nix b/tests/functional/lang/eval-fail-all-2.nix
new file mode 100644
index 000000000000..b8ec8c87125c
--- /dev/null
+++ b/tests/functional/lang/eval-fail-all-2.nix
@@ -0,0 +1 @@
+builtins.all (_: 1) "foo"
diff --git a/tests/functional/lang/eval-fail-all-3.err.exp b/tests/functional/lang/eval-fail-all-3.err.exp
new file mode 100644
index 000000000000..692cebe3c214
--- /dev/null
+++ b/tests/functional/lang/eval-fail-all-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'all' builtin
+         at /pwd/lang/eval-fail-all-3.nix:1:1:
+            1| builtins.all (_: 1) [ "foo" ]
+             | ^
+            2|
+
+       … while evaluating the return value of the function passed to builtins.all
+
+       error: expected a Boolean but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-all-3.nix b/tests/functional/lang/eval-fail-all-3.nix
new file mode 100644
index 000000000000..68f6ce6567e5
--- /dev/null
+++ b/tests/functional/lang/eval-fail-all-3.nix
@@ -0,0 +1 @@
+builtins.all (_: 1) [ "foo" ]
diff --git a/tests/functional/lang/eval-fail-any-1.err.exp b/tests/functional/lang/eval-fail-any-1.err.exp
new file mode 100644
index 000000000000..2d81dae42547
--- /dev/null
+++ b/tests/functional/lang/eval-fail-any-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'any' builtin
+         at /pwd/lang/eval-fail-any-1.nix:1:1:
+            1| builtins.any 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.any
+
+       error: expected a function but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-any-1.nix b/tests/functional/lang/eval-fail-any-1.nix
new file mode 100644
index 000000000000..aa59791b73fe
--- /dev/null
+++ b/tests/functional/lang/eval-fail-any-1.nix
@@ -0,0 +1 @@
+builtins.any 1 "foo"
diff --git a/tests/functional/lang/eval-fail-any-2.err.exp b/tests/functional/lang/eval-fail-any-2.err.exp
new file mode 100644
index 000000000000..a03a9e7c34e8
--- /dev/null
+++ b/tests/functional/lang/eval-fail-any-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'any' builtin
+         at /pwd/lang/eval-fail-any-2.nix:1:1:
+            1| builtins.any (_: 1) "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.any
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-any-2.nix b/tests/functional/lang/eval-fail-any-2.nix
new file mode 100644
index 000000000000..64a5d3acc801
--- /dev/null
+++ b/tests/functional/lang/eval-fail-any-2.nix
@@ -0,0 +1 @@
+builtins.any (_: 1) "foo"
diff --git a/tests/functional/lang/eval-fail-any-3.err.exp b/tests/functional/lang/eval-fail-any-3.err.exp
new file mode 100644
index 000000000000..b06d27abdf65
--- /dev/null
+++ b/tests/functional/lang/eval-fail-any-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'any' builtin
+         at /pwd/lang/eval-fail-any-3.nix:1:1:
+            1| builtins.any (_: 1) [ "foo" ]
+             | ^
+            2|
+
+       … while evaluating the return value of the function passed to builtins.any
+
+       error: expected a Boolean but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-any-3.nix b/tests/functional/lang/eval-fail-any-3.nix
new file mode 100644
index 000000000000..906d08252aa8
--- /dev/null
+++ b/tests/functional/lang/eval-fail-any-3.nix
@@ -0,0 +1 @@
+builtins.any (_: 1) [ "foo" ]
diff --git a/tests/functional/lang/eval-fail-attrNames-1.err.exp b/tests/functional/lang/eval-fail-attrNames-1.err.exp
new file mode 100644
index 000000000000..46f71a49102d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-attrNames-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'attrNames' builtin
+         at /pwd/lang/eval-fail-attrNames-1.nix:1:1:
+            1| builtins.attrNames [ ]
+             | ^
+            2|
+
+       … while evaluating the argument passed to builtins.attrNames
+
+       error: expected a set but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-attrNames-1.nix b/tests/functional/lang/eval-fail-attrNames-1.nix
new file mode 100644
index 000000000000..38f68e4d67b1
--- /dev/null
+++ b/tests/functional/lang/eval-fail-attrNames-1.nix
@@ -0,0 +1 @@
+builtins.attrNames [ ]
diff --git a/tests/functional/lang/eval-fail-attrValues-1.err.exp b/tests/functional/lang/eval-fail-attrValues-1.err.exp
new file mode 100644
index 000000000000..c7018784f1b3
--- /dev/null
+++ b/tests/functional/lang/eval-fail-attrValues-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'attrValues' builtin
+         at /pwd/lang/eval-fail-attrValues-1.nix:1:1:
+            1| builtins.attrValues [ ]
+             | ^
+            2|
+
+       … while evaluating the argument passed to builtins.attrValues
+
+       error: expected a set but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-attrValues-1.nix b/tests/functional/lang/eval-fail-attrValues-1.nix
new file mode 100644
index 000000000000..c3154854c78f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-attrValues-1.nix
@@ -0,0 +1 @@
+builtins.attrValues [ ]
diff --git a/tests/functional/lang/eval-fail-baseNameOf-1.err.exp b/tests/functional/lang/eval-fail-baseNameOf-1.err.exp
new file mode 100644
index 000000000000..4116a1a06391
--- /dev/null
+++ b/tests/functional/lang/eval-fail-baseNameOf-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'baseNameOf' builtin
+         at /pwd/lang/eval-fail-baseNameOf-1.nix:1:1:
+            1| builtins.baseNameOf [ ]
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.baseNameOf
+
+       error: cannot coerce a list to a string: [ ]
diff --git a/tests/functional/lang/eval-fail-baseNameOf-1.nix b/tests/functional/lang/eval-fail-baseNameOf-1.nix
new file mode 100644
index 000000000000..3099c87f5714
--- /dev/null
+++ b/tests/functional/lang/eval-fail-baseNameOf-1.nix
@@ -0,0 +1 @@
+builtins.baseNameOf [ ]
diff --git a/tests/functional/lang/eval-fail-bitAnd-1.err.exp b/tests/functional/lang/eval-fail-bitAnd-1.err.exp
new file mode 100644
index 000000000000..04ae5c85400b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-bitAnd-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'bitAnd' builtin
+         at /pwd/lang/eval-fail-bitAnd-1.nix:1:1:
+            1| builtins.bitAnd 1.1 2
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.bitAnd
+
+       error: expected an integer but found a float: 1.1
diff --git a/tests/functional/lang/eval-fail-bitAnd-1.nix b/tests/functional/lang/eval-fail-bitAnd-1.nix
new file mode 100644
index 000000000000..24c5d60bdd02
--- /dev/null
+++ b/tests/functional/lang/eval-fail-bitAnd-1.nix
@@ -0,0 +1 @@
+builtins.bitAnd 1.1 2
diff --git a/tests/functional/lang/eval-fail-bitAnd-2.err.exp b/tests/functional/lang/eval-fail-bitAnd-2.err.exp
new file mode 100644
index 000000000000..f845462f1262
--- /dev/null
+++ b/tests/functional/lang/eval-fail-bitAnd-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'bitAnd' builtin
+         at /pwd/lang/eval-fail-bitAnd-2.nix:1:1:
+            1| builtins.bitAnd 1 2.2
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.bitAnd
+
+       error: expected an integer but found a float: 2.2
diff --git a/tests/functional/lang/eval-fail-bitAnd-2.nix b/tests/functional/lang/eval-fail-bitAnd-2.nix
new file mode 100644
index 000000000000..12ea1451f582
--- /dev/null
+++ b/tests/functional/lang/eval-fail-bitAnd-2.nix
@@ -0,0 +1 @@
+builtins.bitAnd 1 2.2
diff --git a/tests/functional/lang/eval-fail-bitOr-1.err.exp b/tests/functional/lang/eval-fail-bitOr-1.err.exp
new file mode 100644
index 000000000000..38b498da4697
--- /dev/null
+++ b/tests/functional/lang/eval-fail-bitOr-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'bitOr' builtin
+         at /pwd/lang/eval-fail-bitOr-1.nix:1:1:
+            1| builtins.bitOr 1.1 2
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.bitOr
+
+       error: expected an integer but found a float: 1.1
diff --git a/tests/functional/lang/eval-fail-bitOr-1.nix b/tests/functional/lang/eval-fail-bitOr-1.nix
new file mode 100644
index 000000000000..2eab4871ca65
--- /dev/null
+++ b/tests/functional/lang/eval-fail-bitOr-1.nix
@@ -0,0 +1 @@
+builtins.bitOr 1.1 2
diff --git a/tests/functional/lang/eval-fail-bitOr-2.err.exp b/tests/functional/lang/eval-fail-bitOr-2.err.exp
new file mode 100644
index 000000000000..a1ca655add7a
--- /dev/null
+++ b/tests/functional/lang/eval-fail-bitOr-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'bitOr' builtin
+         at /pwd/lang/eval-fail-bitOr-2.nix:1:1:
+            1| builtins.bitOr 1 2.2
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.bitOr
+
+       error: expected an integer but found a float: 2.2
diff --git a/tests/functional/lang/eval-fail-bitOr-2.nix b/tests/functional/lang/eval-fail-bitOr-2.nix
new file mode 100644
index 000000000000..f66e3a3635ab
--- /dev/null
+++ b/tests/functional/lang/eval-fail-bitOr-2.nix
@@ -0,0 +1 @@
+builtins.bitOr 1 2.2
diff --git a/tests/functional/lang/eval-fail-bitXor-1.err.exp b/tests/functional/lang/eval-fail-bitXor-1.err.exp
new file mode 100644
index 000000000000..f051ef622069
--- /dev/null
+++ b/tests/functional/lang/eval-fail-bitXor-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'bitXor' builtin
+         at /pwd/lang/eval-fail-bitXor-1.nix:1:1:
+            1| builtins.bitXor 1.1 2
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.bitXor
+
+       error: expected an integer but found a float: 1.1
diff --git a/tests/functional/lang/eval-fail-bitXor-1.nix b/tests/functional/lang/eval-fail-bitXor-1.nix
new file mode 100644
index 000000000000..c1b0f1b4e82d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-bitXor-1.nix
@@ -0,0 +1 @@
+builtins.bitXor 1.1 2
diff --git a/tests/functional/lang/eval-fail-bitXor-2.err.exp b/tests/functional/lang/eval-fail-bitXor-2.err.exp
new file mode 100644
index 000000000000..3b5ab1317ab0
--- /dev/null
+++ b/tests/functional/lang/eval-fail-bitXor-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'bitXor' builtin
+         at /pwd/lang/eval-fail-bitXor-2.nix:1:1:
+            1| builtins.bitXor 1 2.2
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.bitXor
+
+       error: expected an integer but found a float: 2.2
diff --git a/tests/functional/lang/eval-fail-bitXor-2.nix b/tests/functional/lang/eval-fail-bitXor-2.nix
new file mode 100644
index 000000000000..b9f7ad9c2890
--- /dev/null
+++ b/tests/functional/lang/eval-fail-bitXor-2.nix
@@ -0,0 +1 @@
+builtins.bitXor 1 2.2
diff --git a/tests/functional/lang/eval-fail-catAttrs-1.err.exp b/tests/functional/lang/eval-fail-catAttrs-1.err.exp
new file mode 100644
index 000000000000..e669dc39a6e8
--- /dev/null
+++ b/tests/functional/lang/eval-fail-catAttrs-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'catAttrs' builtin
+         at /pwd/lang/eval-fail-catAttrs-1.nix:1:1:
+            1| builtins.catAttrs [ ] { }
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.catAttrs
+
+       error: expected a string but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-catAttrs-1.nix b/tests/functional/lang/eval-fail-catAttrs-1.nix
new file mode 100644
index 000000000000..97d06f5b63be
--- /dev/null
+++ b/tests/functional/lang/eval-fail-catAttrs-1.nix
@@ -0,0 +1 @@
+builtins.catAttrs [ ] { }
diff --git a/tests/functional/lang/eval-fail-catAttrs-2.err.exp b/tests/functional/lang/eval-fail-catAttrs-2.err.exp
new file mode 100644
index 000000000000..2f6c1425d6a6
--- /dev/null
+++ b/tests/functional/lang/eval-fail-catAttrs-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'catAttrs' builtin
+         at /pwd/lang/eval-fail-catAttrs-2.nix:1:1:
+            1| builtins.catAttrs "foo" { }
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.catAttrs
+
+       error: expected a list but found a set: { }
diff --git a/tests/functional/lang/eval-fail-catAttrs-2.nix b/tests/functional/lang/eval-fail-catAttrs-2.nix
new file mode 100644
index 000000000000..caf616b20b84
--- /dev/null
+++ b/tests/functional/lang/eval-fail-catAttrs-2.nix
@@ -0,0 +1 @@
+builtins.catAttrs "foo" { }
diff --git a/tests/functional/lang/eval-fail-catAttrs-3.err.exp b/tests/functional/lang/eval-fail-catAttrs-3.err.exp
new file mode 100644
index 000000000000..2643d37f9e96
--- /dev/null
+++ b/tests/functional/lang/eval-fail-catAttrs-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'catAttrs' builtin
+         at /pwd/lang/eval-fail-catAttrs-3.nix:1:1:
+            1| builtins.catAttrs "foo" [ 1 ]
+             | ^
+            2|
+
+       … while evaluating an element in the list passed as second argument to builtins.catAttrs
+
+       error: expected a set but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-catAttrs-3.nix b/tests/functional/lang/eval-fail-catAttrs-3.nix
new file mode 100644
index 000000000000..82595b94ed0f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-catAttrs-3.nix
@@ -0,0 +1 @@
+builtins.catAttrs "foo" [ 1 ]
diff --git a/tests/functional/lang/eval-fail-catAttrs-4.err.exp b/tests/functional/lang/eval-fail-catAttrs-4.err.exp
new file mode 100644
index 000000000000..ffd5fcec7c0b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-catAttrs-4.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'catAttrs' builtin
+         at /pwd/lang/eval-fail-catAttrs-4.nix:1:1:
+            1| builtins.catAttrs "foo" [
+             | ^
+            2|   { foo = 1; }
+
+       … while evaluating an element in the list passed as second argument to builtins.catAttrs
+
+       error: expected a set but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-catAttrs-4.nix b/tests/functional/lang/eval-fail-catAttrs-4.nix
new file mode 100644
index 000000000000..1f294a693c6a
--- /dev/null
+++ b/tests/functional/lang/eval-fail-catAttrs-4.nix
@@ -0,0 +1,5 @@
+builtins.catAttrs "foo" [
+  { foo = 1; }
+  1
+  { bar = 5; }
+]
diff --git a/tests/functional/lang/eval-fail-ceil-1.err.exp b/tests/functional/lang/eval-fail-ceil-1.err.exp
new file mode 100644
index 000000000000..96d8b1df7a8e
--- /dev/null
+++ b/tests/functional/lang/eval-fail-ceil-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'ceil' builtin
+         at /pwd/lang/eval-fail-ceil-1.nix:1:1:
+            1| builtins.ceil "foo"
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.ceil
+
+       error: expected a float but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-ceil-1.nix b/tests/functional/lang/eval-fail-ceil-1.nix
new file mode 100644
index 000000000000..0ea67754c358
--- /dev/null
+++ b/tests/functional/lang/eval-fail-ceil-1.nix
@@ -0,0 +1 @@
+builtins.ceil "foo"
diff --git a/tests/functional/lang/eval-fail-compareVersions-1.err.exp b/tests/functional/lang/eval-fail-compareVersions-1.err.exp
new file mode 100644
index 000000000000..8632cf237e1b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-compareVersions-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'compareVersions' builtin
+         at /pwd/lang/eval-fail-compareVersions-1.nix:1:1:
+            1| builtins.compareVersions 1 { }
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.compareVersions
+
+       error: expected a string but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-compareVersions-1.nix b/tests/functional/lang/eval-fail-compareVersions-1.nix
new file mode 100644
index 000000000000..f408381cf4c5
--- /dev/null
+++ b/tests/functional/lang/eval-fail-compareVersions-1.nix
@@ -0,0 +1 @@
+builtins.compareVersions 1 { }
diff --git a/tests/functional/lang/eval-fail-compareVersions-2.err.exp b/tests/functional/lang/eval-fail-compareVersions-2.err.exp
new file mode 100644
index 000000000000..bcd246460f2f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-compareVersions-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'compareVersions' builtin
+         at /pwd/lang/eval-fail-compareVersions-2.nix:1:1:
+            1| builtins.compareVersions "abd" { }
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.compareVersions
+
+       error: expected a string but found a set: { }
diff --git a/tests/functional/lang/eval-fail-compareVersions-2.nix b/tests/functional/lang/eval-fail-compareVersions-2.nix
new file mode 100644
index 000000000000..49c9f0a8874e
--- /dev/null
+++ b/tests/functional/lang/eval-fail-compareVersions-2.nix
@@ -0,0 +1 @@
+builtins.compareVersions "abd" { }
diff --git a/tests/functional/lang/eval-fail-concatLists-1.err.exp b/tests/functional/lang/eval-fail-concatLists-1.err.exp
new file mode 100644
index 000000000000..15193daae1ca
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatLists-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'concatLists' builtin
+         at /pwd/lang/eval-fail-concatLists-1.nix:1:1:
+            1| builtins.concatLists 1
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.concatLists
+
+       error: expected a list but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-concatLists-1.nix b/tests/functional/lang/eval-fail-concatLists-1.nix
new file mode 100644
index 000000000000..97e171cb6fa4
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatLists-1.nix
@@ -0,0 +1 @@
+builtins.concatLists 1
diff --git a/tests/functional/lang/eval-fail-concatLists-2.err.exp b/tests/functional/lang/eval-fail-concatLists-2.err.exp
new file mode 100644
index 000000000000..35fbc09bfe35
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatLists-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'concatLists' builtin
+         at /pwd/lang/eval-fail-concatLists-2.nix:1:1:
+            1| builtins.concatLists [ 1 ]
+             | ^
+            2|
+
+       … while evaluating a value of the list passed to builtins.concatLists
+
+       error: expected a list but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-concatLists-2.nix b/tests/functional/lang/eval-fail-concatLists-2.nix
new file mode 100644
index 000000000000..0ad98a8eb4ac
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatLists-2.nix
@@ -0,0 +1 @@
+builtins.concatLists [ 1 ]
diff --git a/tests/functional/lang/eval-fail-concatLists-3.err.exp b/tests/functional/lang/eval-fail-concatLists-3.err.exp
new file mode 100644
index 000000000000..d762eb55bdaa
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatLists-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'concatLists' builtin
+         at /pwd/lang/eval-fail-concatLists-3.nix:1:1:
+            1| builtins.concatLists [
+             | ^
+            2|   [ 1 ]
+
+       … while evaluating a value of the list passed to builtins.concatLists
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-concatLists-3.nix b/tests/functional/lang/eval-fail-concatLists-3.nix
new file mode 100644
index 000000000000..2366f314e1b7
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatLists-3.nix
@@ -0,0 +1,4 @@
+builtins.concatLists [
+  [ 1 ]
+  "foo"
+]
diff --git a/tests/functional/lang/eval-fail-concatMap-1.err.exp b/tests/functional/lang/eval-fail-concatMap-1.err.exp
new file mode 100644
index 000000000000..e43c160a38e2
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatMap-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'concatMap' builtin
+         at /pwd/lang/eval-fail-concatMap-1.nix:1:1:
+            1| builtins.concatMap 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.concatMap
+
+       error: expected a function but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-concatMap-1.nix b/tests/functional/lang/eval-fail-concatMap-1.nix
new file mode 100644
index 000000000000..68c9c3560f6a
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatMap-1.nix
@@ -0,0 +1 @@
+builtins.concatMap 1 "foo"
diff --git a/tests/functional/lang/eval-fail-concatMap-2.err.exp b/tests/functional/lang/eval-fail-concatMap-2.err.exp
new file mode 100644
index 000000000000..52c51fd0157b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatMap-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'concatMap' builtin
+         at /pwd/lang/eval-fail-concatMap-2.nix:1:1:
+            1| builtins.concatMap (x: 1) "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.concatMap
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-concatMap-2.nix b/tests/functional/lang/eval-fail-concatMap-2.nix
new file mode 100644
index 000000000000..b98860470caa
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatMap-2.nix
@@ -0,0 +1 @@
+builtins.concatMap (x: 1) "foo"
diff --git a/tests/functional/lang/eval-fail-concatMap-3.err.exp b/tests/functional/lang/eval-fail-concatMap-3.err.exp
new file mode 100644
index 000000000000..21d13118f0cd
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatMap-3.err.exp
@@ -0,0 +1,14 @@
+error:
+       … while calling the 'concatMap' builtin
+         at /pwd/lang/eval-fail-concatMap-3.nix:1:1:
+            1| builtins.concatMap (x: 1) [ "foo" ]
+             | ^
+            2|
+
+       … while evaluating the return value of the function passed to builtins.concatMap
+         at /pwd/lang/eval-fail-concatMap-3.nix:1:21:
+            1| builtins.concatMap (x: 1) [ "foo" ]
+             |                     ^
+            2|
+
+       error: expected a list but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-concatMap-3.nix b/tests/functional/lang/eval-fail-concatMap-3.nix
new file mode 100644
index 000000000000..f4a519060358
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatMap-3.nix
@@ -0,0 +1 @@
+builtins.concatMap (x: 1) [ "foo" ]
diff --git a/tests/functional/lang/eval-fail-concatMap-4.err.exp b/tests/functional/lang/eval-fail-concatMap-4.err.exp
new file mode 100644
index 000000000000..1b8e865fd3a1
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatMap-4.err.exp
@@ -0,0 +1,14 @@
+error:
+       … while calling the 'concatMap' builtin
+         at /pwd/lang/eval-fail-concatMap-4.nix:1:1:
+            1| builtins.concatMap (x: "foo") [
+             | ^
+            2|   1
+
+       … while evaluating the return value of the function passed to builtins.concatMap
+         at /pwd/lang/eval-fail-concatMap-4.nix:1:21:
+            1| builtins.concatMap (x: "foo") [
+             |                     ^
+            2|   1
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-concatMap-4.nix b/tests/functional/lang/eval-fail-concatMap-4.nix
new file mode 100644
index 000000000000..0f678005bced
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatMap-4.nix
@@ -0,0 +1,4 @@
+builtins.concatMap (x: "foo") [
+  1
+  2
+]
diff --git a/tests/functional/lang/eval-fail-concatStringsSep-1.err.exp b/tests/functional/lang/eval-fail-concatStringsSep-1.err.exp
new file mode 100644
index 000000000000..4b40db46d681
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatStringsSep-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'concatStringsSep' builtin
+         at /pwd/lang/eval-fail-concatStringsSep-1.nix:1:1:
+            1| builtins.concatStringsSep 1 { }
+             | ^
+            2|
+
+       … while evaluating the first argument (the separator string) passed to builtins.concatStringsSep
+
+       error: expected a string but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-concatStringsSep-1.nix b/tests/functional/lang/eval-fail-concatStringsSep-1.nix
new file mode 100644
index 000000000000..0c10cea34630
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatStringsSep-1.nix
@@ -0,0 +1 @@
+builtins.concatStringsSep 1 { }
diff --git a/tests/functional/lang/eval-fail-concatStringsSep-2.err.exp b/tests/functional/lang/eval-fail-concatStringsSep-2.err.exp
new file mode 100644
index 000000000000..9cc806f4955f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatStringsSep-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'concatStringsSep' builtin
+         at /pwd/lang/eval-fail-concatStringsSep-2.nix:1:1:
+            1| builtins.concatStringsSep "foo" { }
+             | ^
+            2|
+
+       … while evaluating the second argument (the list of strings to concat) passed to builtins.concatStringsSep
+
+       error: expected a list but found a set: { }
diff --git a/tests/functional/lang/eval-fail-concatStringsSep-2.nix b/tests/functional/lang/eval-fail-concatStringsSep-2.nix
new file mode 100644
index 000000000000..ae6a5f1984d4
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatStringsSep-2.nix
@@ -0,0 +1 @@
+builtins.concatStringsSep "foo" { }
diff --git a/tests/functional/lang/eval-fail-concatStringsSep-3.err.exp b/tests/functional/lang/eval-fail-concatStringsSep-3.err.exp
new file mode 100644
index 000000000000..5c098d471e72
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatStringsSep-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'concatStringsSep' builtin
+         at /pwd/lang/eval-fail-concatStringsSep-3.nix:1:1:
+            1| builtins.concatStringsSep "foo" [
+             | ^
+            2|   1
+
+       … while evaluating one element of the list of strings to concat passed to builtins.concatStringsSep
+
+       error: cannot coerce an integer to a string: 1
diff --git a/tests/functional/lang/eval-fail-concatStringsSep-3.nix b/tests/functional/lang/eval-fail-concatStringsSep-3.nix
new file mode 100644
index 000000000000..f51ae1c7ddc5
--- /dev/null
+++ b/tests/functional/lang/eval-fail-concatStringsSep-3.nix
@@ -0,0 +1,5 @@
+builtins.concatStringsSep "foo" [
+  1
+  2
+  { }
+]
diff --git a/tests/functional/lang/eval-fail-derivation-name.err.exp b/tests/functional/lang/eval-fail-derivation-name.err.exp
index ba5ff2d002ab..76d0575195ba 100644
--- a/tests/functional/lang/eval-fail-derivation-name.err.exp
+++ b/tests/functional/lang/eval-fail-derivation-name.err.exp
@@ -2,17 +2,10 @@ error:
        … while evaluating the attribute 'outPath'
          at «nix-internal»/derivation-internal.nix:<number>:<number>:
      <number>|     value = commonAttrs // {
-     <number>|       outPath = builtins.getAttr outputName strict;
+     <number>|       outPath = strict.${outputName};
              |       ^
      <number>|       drvPath = strict.drvPath;
 
-       … while calling the 'getAttr' builtin
-         at «nix-internal»/derivation-internal.nix:<number>:<number>:
-     <number>|     value = commonAttrs // {
-     <number>|       outPath = builtins.getAttr outputName strict;
-             |                 ^
-     <number>|       drvPath = strict.drvPath;
-
        … while calling the 'derivationStrict' builtin
          at «nix-internal»/derivation-internal.nix:<number>:<number>:
      <number>|
diff --git a/tests/functional/lang/eval-fail-derivation-structuredAttrs-stack-overflow.err.exp b/tests/functional/lang/eval-fail-derivation-structuredAttrs-stack-overflow.err.exp
index c61eab0aa422..91b7f11e1489 100644
--- a/tests/functional/lang/eval-fail-derivation-structuredAttrs-stack-overflow.err.exp
+++ b/tests/functional/lang/eval-fail-derivation-structuredAttrs-stack-overflow.err.exp
@@ -1,24 +1,17 @@
 error:
        … while evaluating the attribute 'outPath'
-         at «nix-internal»/derivation-internal.nix:50:7:
-           49|     value = commonAttrs // {
-           50|       outPath = builtins.getAttr outputName strict;
+         at «nix-internal»/derivation-internal.nix:49:7:
+           48|     value = commonAttrs // {
+           49|       outPath = strict.${outputName};
              |       ^
-           51|       drvPath = strict.drvPath;
-
-       … while calling the 'getAttr' builtin
-         at «nix-internal»/derivation-internal.nix:50:17:
-           49|     value = commonAttrs // {
-           50|       outPath = builtins.getAttr outputName strict;
-             |                 ^
-           51|       drvPath = strict.drvPath;
+           50|       drvPath = strict.drvPath;
 
        … while calling the 'derivationStrict' builtin
-         at «nix-internal»/derivation-internal.nix:37:12:
-           36|
-           37|   strict = derivationStrict drvAttrs;
+         at «nix-internal»/derivation-internal.nix:36:12:
+           35|
+           36|   strict = derivationStrict drvAttrs;
              |            ^
-           38|
+           37|
 
        … while evaluating derivation 'test'
          whose name attribute is located at /pwd/lang/eval-fail-derivation-structuredAttrs-stack-overflow.nix:5:3
@@ -37,7 +30,7 @@ error:
              |                                                                       ^
            13|     in
 
-       (9994 duplicate frames omitted)
+       (9995 duplicate frames omitted)
 
        … while evaluating attribute 'head'
          at /pwd/lang/eval-fail-derivation-structuredAttrs-stack-overflow.nix:12:66:
diff --git a/tests/functional/lang/eval-fail-derivationStrict-1.err.exp b/tests/functional/lang/eval-fail-derivationStrict-1.err.exp
new file mode 100644
index 000000000000..468c789e8db4
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-1.nix:1:1:
+            1| builtins.derivationStrict ""
+             | ^
+            2|
+
+       … while evaluating the argument passed to builtins.derivationStrict
+
+       error: expected a set but found a string: ""
diff --git a/tests/functional/lang/eval-fail-derivationStrict-1.nix b/tests/functional/lang/eval-fail-derivationStrict-1.nix
new file mode 100644
index 000000000000..948230469d98
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-1.nix
@@ -0,0 +1 @@
+builtins.derivationStrict ""
diff --git a/tests/functional/lang/eval-fail-derivationStrict-10.err.exp b/tests/functional/lang/eval-fail-derivationStrict-10.err.exp
new file mode 100644
index 000000000000..21eca42fad06
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-10.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-10.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-10.nix:2:3
+
+       … while evaluating attribute 'outputs' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-10.nix:5:3:
+            4|   system = 1;
+            5|   outputs = { };
+             |   ^
+            6| }
+
+       error: cannot coerce a set to a string: { }
diff --git a/tests/functional/lang/eval-fail-derivationStrict-10.nix b/tests/functional/lang/eval-fail-derivationStrict-10.nix
new file mode 100644
index 000000000000..410f48a46537
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-10.nix
@@ -0,0 +1,6 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  system = 1;
+  outputs = { };
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-11.err.exp b/tests/functional/lang/eval-fail-derivationStrict-11.err.exp
new file mode 100644
index 000000000000..b0fe664e5202
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-11.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-11.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-11.nix:2:3
+
+       … while evaluating attribute 'outputs' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-11.nix:5:3:
+            4|   system = 1;
+            5|   outputs = "drvPath";
+             |   ^
+            6| }
+
+       error: invalid derivation output name 'drvPath'
diff --git a/tests/functional/lang/eval-fail-derivationStrict-11.nix b/tests/functional/lang/eval-fail-derivationStrict-11.nix
new file mode 100644
index 000000000000..60947b6e2ee6
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-11.nix
@@ -0,0 +1,6 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  system = 1;
+  outputs = "drvPath";
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-12.err.exp b/tests/functional/lang/eval-fail-derivationStrict-12.err.exp
new file mode 100644
index 000000000000..adfc0064bfb7
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-12.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-12.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-12.nix:2:3
+
+       … while evaluating attribute 'outputs' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-12.nix:3:3:
+            2|   name = "foo";
+            3|   outputs = "out";
+             |   ^
+            4|   __structuredAttrs = true;
+
+       error: expected a list but found a string: "out"
diff --git a/tests/functional/lang/eval-fail-derivationStrict-12.nix b/tests/functional/lang/eval-fail-derivationStrict-12.nix
new file mode 100644
index 000000000000..516b8ba39ace
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-12.nix
@@ -0,0 +1,5 @@
+builtins.derivationStrict {
+  name = "foo";
+  outputs = "out";
+  __structuredAttrs = true;
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-13.err.exp b/tests/functional/lang/eval-fail-derivationStrict-13.err.exp
new file mode 100644
index 000000000000..8a313333d58f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-13.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-13.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-13.nix:2:3
+
+       … while evaluating attribute 'outputs' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-13.nix:5:3:
+            4|   system = 1;
+            5|   outputs = [ ];
+             |   ^
+            6| }
+
+       error: derivation cannot have an empty set of outputs
diff --git a/tests/functional/lang/eval-fail-derivationStrict-13.nix b/tests/functional/lang/eval-fail-derivationStrict-13.nix
new file mode 100644
index 000000000000..9a104d2253fd
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-13.nix
@@ -0,0 +1,6 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  system = 1;
+  outputs = [ ];
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-14.err.exp b/tests/functional/lang/eval-fail-derivationStrict-14.err.exp
new file mode 100644
index 000000000000..fb0c5423c4dc
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-14.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-14.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-14.nix:2:3
+
+       … while evaluating attribute 'outputs' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-14.nix:5:3:
+            4|   system = 1;
+            5|   outputs = [ "drvPath" ];
+             |   ^
+            6| }
+
+       error: invalid derivation output name 'drvPath'
diff --git a/tests/functional/lang/eval-fail-derivationStrict-14.nix b/tests/functional/lang/eval-fail-derivationStrict-14.nix
new file mode 100644
index 000000000000..4d286d34c725
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-14.nix
@@ -0,0 +1,6 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  system = 1;
+  outputs = [ "drvPath" ];
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-15.err.exp b/tests/functional/lang/eval-fail-derivationStrict-15.err.exp
new file mode 100644
index 000000000000..8df047069136
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-15.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-15.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-15.nix:2:3
+
+       … while evaluating attribute 'outputs' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-15.nix:5:3:
+            4|   system = 1;
+            5|   outputs = [
+             |   ^
+            6|     "out"
+
+       error: duplicate derivation output 'out'
diff --git a/tests/functional/lang/eval-fail-derivationStrict-15.nix b/tests/functional/lang/eval-fail-derivationStrict-15.nix
new file mode 100644
index 000000000000..96e5a9de404b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-15.nix
@@ -0,0 +1,9 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  system = 1;
+  outputs = [
+    "out"
+    "out"
+  ];
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-16.err.exp b/tests/functional/lang/eval-fail-derivationStrict-16.err.exp
new file mode 100644
index 000000000000..c969aa30d0d3
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-16.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-16.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-16.nix:2:3
+
+       … while evaluating attribute '__contentAddressed' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-16.nix:6:3:
+            5|   outputs = "out";
+            6|   __contentAddressed = "true";
+             |   ^
+            7| }
+
+       error: expected a Boolean but found a string: "true"
diff --git a/tests/functional/lang/eval-fail-derivationStrict-16.nix b/tests/functional/lang/eval-fail-derivationStrict-16.nix
new file mode 100644
index 000000000000..554ad09df1a2
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-16.nix
@@ -0,0 +1,7 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  system = 1;
+  outputs = "out";
+  __contentAddressed = "true";
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-17.err.exp b/tests/functional/lang/eval-fail-derivationStrict-17.err.exp
new file mode 100644
index 000000000000..ed7558c4cbab
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-17.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-17.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-17.nix:2:3
+
+       … while evaluating attribute '__impure' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-17.nix:6:3:
+            5|   outputs = "out";
+            6|   __impure = "true";
+             |   ^
+            7| }
+
+       error: expected a Boolean but found a string: "true"
diff --git a/tests/functional/lang/eval-fail-derivationStrict-17.nix b/tests/functional/lang/eval-fail-derivationStrict-17.nix
new file mode 100644
index 000000000000..4a357ba12d7f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-17.nix
@@ -0,0 +1,7 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  system = 1;
+  outputs = "out";
+  __impure = "true";
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-19.err.exp b/tests/functional/lang/eval-fail-derivationStrict-19.err.exp
new file mode 100644
index 000000000000..4861b1cd3abd
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-19.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-19.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-19.nix:2:3
+
+       … while evaluating attribute 'args' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-19.nix:6:3:
+            5|   outputs = "out";
+            6|   args = "foo";
+             |   ^
+            7| }
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-derivationStrict-19.nix b/tests/functional/lang/eval-fail-derivationStrict-19.nix
new file mode 100644
index 000000000000..912be12c5708
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-19.nix
@@ -0,0 +1,7 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  system = 1;
+  outputs = "out";
+  args = "foo";
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-2.err.exp b/tests/functional/lang/eval-fail-derivationStrict-2.err.exp
new file mode 100644
index 000000000000..7ba9fc825595
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-2.nix:1:1:
+            1| builtins.derivationStrict { }
+             | ^
+            2|
+
+       … in the attrset passed as argument to builtins.derivationStrict
+
+       error: attribute 'name' missing
diff --git a/tests/functional/lang/eval-fail-derivationStrict-2.nix b/tests/functional/lang/eval-fail-derivationStrict-2.nix
new file mode 100644
index 000000000000..70a07b36d2d5
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-2.nix
@@ -0,0 +1 @@
+builtins.derivationStrict { }
diff --git a/tests/functional/lang/eval-fail-derivationStrict-20.err.exp b/tests/functional/lang/eval-fail-derivationStrict-20.err.exp
new file mode 100644
index 000000000000..df1805bef681
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-20.err.exp
@@ -0,0 +1,20 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-20.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-20.nix:2:3
+
+       … while evaluating attribute 'args' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-20.nix:6:3:
+            5|   outputs = "out";
+            6|   args = [ { } ];
+             |   ^
+            7| }
+
+       … while evaluating an element of the argument list
+
+       error: cannot coerce a set to a string: { }
diff --git a/tests/functional/lang/eval-fail-derivationStrict-20.nix b/tests/functional/lang/eval-fail-derivationStrict-20.nix
new file mode 100644
index 000000000000..17bc3a26c906
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-20.nix
@@ -0,0 +1,7 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  system = 1;
+  outputs = "out";
+  args = [ { } ];
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-21.err.exp b/tests/functional/lang/eval-fail-derivationStrict-21.err.exp
new file mode 100644
index 000000000000..0a6384a77957
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-21.err.exp
@@ -0,0 +1,20 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-21.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-21.nix:2:3
+
+       … while evaluating attribute 'args' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-21.nix:6:3:
+            5|   outputs = "out";
+            6|   args = [
+             |   ^
+            7|     "a"
+
+       … while evaluating an element of the argument list
+
+       error: cannot coerce a set to a string: { }
diff --git a/tests/functional/lang/eval-fail-derivationStrict-21.nix b/tests/functional/lang/eval-fail-derivationStrict-21.nix
new file mode 100644
index 000000000000..7846874194c3
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-21.nix
@@ -0,0 +1,10 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  system = 1;
+  outputs = "out";
+  args = [
+    "a"
+    { }
+  ];
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-22.err.exp b/tests/functional/lang/eval-fail-derivationStrict-22.err.exp
new file mode 100644
index 000000000000..91a44ce1e425
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-22.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-22.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-22.nix:2:3
+
+       … while evaluating attribute 'FOO' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-22.nix:6:3:
+            5|   outputs = "out";
+            6|   FOO = { };
+             |   ^
+            7| }
+
+       error: cannot coerce a set to a string: { }
diff --git a/tests/functional/lang/eval-fail-derivationStrict-22.nix b/tests/functional/lang/eval-fail-derivationStrict-22.nix
new file mode 100644
index 000000000000..7b3b7c824855
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-22.nix
@@ -0,0 +1,7 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  system = 1;
+  outputs = "out";
+  FOO = { };
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-3.err.exp b/tests/functional/lang/eval-fail-derivationStrict-3.err.exp
new file mode 100644
index 000000000000..f8c301a97793
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-3.err.exp
@@ -0,0 +1,16 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-3.nix:1:1:
+            1| builtins.derivationStrict { name = 1; }
+             | ^
+            2|
+
+       … while evaluating the derivation attribute 'name'
+         at /pwd/lang/eval-fail-derivationStrict-3.nix:1:29:
+            1| builtins.derivationStrict { name = 1; }
+             |                             ^
+            2|
+
+       … while evaluating the `name` attribute passed to builtins.derivationStrict
+
+       error: expected a string but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-derivationStrict-3.nix b/tests/functional/lang/eval-fail-derivationStrict-3.nix
new file mode 100644
index 000000000000..a18edebd8701
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-3.nix
@@ -0,0 +1 @@
+builtins.derivationStrict { name = 1; }
diff --git a/tests/functional/lang/eval-fail-derivationStrict-4.err.exp b/tests/functional/lang/eval-fail-derivationStrict-4.err.exp
new file mode 100644
index 000000000000..b598f0f11ccd
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-4.err.exp
@@ -0,0 +1,11 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-4.nix:1:1:
+            1| builtins.derivationStrict { name = "foo"; }
+             | ^
+            2|
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-4.nix:1:29
+
+       error: required attribute 'builder' missing
diff --git a/tests/functional/lang/eval-fail-derivationStrict-4.nix b/tests/functional/lang/eval-fail-derivationStrict-4.nix
new file mode 100644
index 000000000000..f13692bc5e10
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-4.nix
@@ -0,0 +1 @@
+builtins.derivationStrict { name = "foo"; }
diff --git a/tests/functional/lang/eval-fail-derivationStrict-5.err.exp b/tests/functional/lang/eval-fail-derivationStrict-5.err.exp
new file mode 100644
index 000000000000..930fda3a95c9
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-5.err.exp
@@ -0,0 +1,13 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-5.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-5.nix:2:3
+
+       … while evaluating the `__structuredAttrs` attribute passed to builtins.derivationStrict
+
+       error: expected a Boolean but found an integer: 15
diff --git a/tests/functional/lang/eval-fail-derivationStrict-5.nix b/tests/functional/lang/eval-fail-derivationStrict-5.nix
new file mode 100644
index 000000000000..e74a8caf45c4
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-5.nix
@@ -0,0 +1,5 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  __structuredAttrs = 15;
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-6.err.exp b/tests/functional/lang/eval-fail-derivationStrict-6.err.exp
new file mode 100644
index 000000000000..323db3b37949
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-6.err.exp
@@ -0,0 +1,13 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-6.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-6.nix:2:3
+
+       … while evaluating the `__ignoreNulls` attribute passed to builtins.derivationStrict
+
+       error: expected a Boolean but found an integer: 15
diff --git a/tests/functional/lang/eval-fail-derivationStrict-6.nix b/tests/functional/lang/eval-fail-derivationStrict-6.nix
new file mode 100644
index 000000000000..feda92b00d13
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-6.nix
@@ -0,0 +1,5 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  __ignoreNulls = 15;
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-7.err.exp b/tests/functional/lang/eval-fail-derivationStrict-7.err.exp
new file mode 100644
index 000000000000..78ddd1573982
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-7.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-7.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-7.nix:2:3
+
+       … while evaluating attribute 'outputHashMode' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-7.nix:4:3:
+            3|   builder = 1;
+            4|   outputHashMode = 15;
+             |   ^
+            5| }
+
+       error: invalid value '15' for 'outputHashMode' attribute
diff --git a/tests/functional/lang/eval-fail-derivationStrict-7.nix b/tests/functional/lang/eval-fail-derivationStrict-7.nix
new file mode 100644
index 000000000000..1ffdb6fdbe99
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-7.nix
@@ -0,0 +1,5 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  outputHashMode = 15;
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-8.err.exp b/tests/functional/lang/eval-fail-derivationStrict-8.err.exp
new file mode 100644
index 000000000000..ba4e0109c62d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-8.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-8.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-8.nix:2:3
+
+       … while evaluating attribute 'outputHashMode' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-8.nix:4:3:
+            3|   builder = 1;
+            4|   outputHashMode = "custom";
+             |   ^
+            5| }
+
+       error: invalid value 'custom' for 'outputHashMode' attribute
diff --git a/tests/functional/lang/eval-fail-derivationStrict-8.nix b/tests/functional/lang/eval-fail-derivationStrict-8.nix
new file mode 100644
index 000000000000..38243416fdda
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-8.nix
@@ -0,0 +1,5 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  outputHashMode = "custom";
+}
diff --git a/tests/functional/lang/eval-fail-derivationStrict-9.err.exp b/tests/functional/lang/eval-fail-derivationStrict-9.err.exp
new file mode 100644
index 000000000000..6bfbbc65b867
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-9.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'derivationStrict' builtin
+         at /pwd/lang/eval-fail-derivationStrict-9.nix:1:1:
+            1| builtins.derivationStrict {
+             | ^
+            2|   name = "foo";
+
+       … while evaluating derivation 'foo'
+         whose name attribute is located at /pwd/lang/eval-fail-derivationStrict-9.nix:2:3
+
+       … while evaluating attribute 'system' of derivation 'foo'
+         at /pwd/lang/eval-fail-derivationStrict-9.nix:4:3:
+            3|   builder = 1;
+            4|   system = { };
+             |   ^
+            5| }
+
+       error: cannot coerce a set to a string: { }
diff --git a/tests/functional/lang/eval-fail-derivationStrict-9.nix b/tests/functional/lang/eval-fail-derivationStrict-9.nix
new file mode 100644
index 000000000000..a3a567a14ce3
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivationStrict-9.nix
@@ -0,0 +1,5 @@
+builtins.derivationStrict {
+  name = "foo";
+  builder = 1;
+  system = { };
+}
diff --git a/tests/functional/lang/eval-fail-div-1.err.exp b/tests/functional/lang/eval-fail-div-1.err.exp
new file mode 100644
index 000000000000..286e1f79c3c5
--- /dev/null
+++ b/tests/functional/lang/eval-fail-div-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'div' builtin
+         at /pwd/lang/eval-fail-div-1.nix:1:1:
+            1| builtins.div "foo" 1
+             | ^
+            2|
+
+       … while evaluating the first operand of the division
+
+       error: expected an integer but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-div-1.nix b/tests/functional/lang/eval-fail-div-1.nix
new file mode 100644
index 000000000000..c6edce369753
--- /dev/null
+++ b/tests/functional/lang/eval-fail-div-1.nix
@@ -0,0 +1 @@
+builtins.div "foo" 1
diff --git a/tests/functional/lang/eval-fail-div-2.err.exp b/tests/functional/lang/eval-fail-div-2.err.exp
new file mode 100644
index 000000000000..20e6e710c096
--- /dev/null
+++ b/tests/functional/lang/eval-fail-div-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'div' builtin
+         at /pwd/lang/eval-fail-div-2.nix:1:1:
+            1| builtins.div 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the second operand of the division
+
+       error: expected a float but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-div-2.nix b/tests/functional/lang/eval-fail-div-2.nix
new file mode 100644
index 000000000000..71d9947719eb
--- /dev/null
+++ b/tests/functional/lang/eval-fail-div-2.nix
@@ -0,0 +1 @@
+builtins.div 1 "foo"
diff --git a/tests/functional/lang/eval-fail-div-3.err.exp b/tests/functional/lang/eval-fail-div-3.err.exp
new file mode 100644
index 000000000000..6d263c956ae4
--- /dev/null
+++ b/tests/functional/lang/eval-fail-div-3.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'div' builtin
+         at /pwd/lang/eval-fail-div-3.nix:1:1:
+            1| builtins.div "foo" 0
+             | ^
+            2|
+
+       error: division by zero
diff --git a/tests/functional/lang/eval-fail-div-3.nix b/tests/functional/lang/eval-fail-div-3.nix
new file mode 100644
index 000000000000..11c606baac7c
--- /dev/null
+++ b/tests/functional/lang/eval-fail-div-3.nix
@@ -0,0 +1 @@
+builtins.div "foo" 0
diff --git a/tests/functional/lang/eval-fail-elem-1.err.exp b/tests/functional/lang/eval-fail-elem-1.err.exp
new file mode 100644
index 000000000000..cd0a2281414a
--- /dev/null
+++ b/tests/functional/lang/eval-fail-elem-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'elem' builtin
+         at /pwd/lang/eval-fail-elem-1.nix:1:1:
+            1| builtins.elem 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.elem
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-elem-1.nix b/tests/functional/lang/eval-fail-elem-1.nix
new file mode 100644
index 000000000000..eecc965cb438
--- /dev/null
+++ b/tests/functional/lang/eval-fail-elem-1.nix
@@ -0,0 +1 @@
+builtins.elem 1 "foo"
diff --git a/tests/functional/lang/eval-fail-elemAt-1.err.exp b/tests/functional/lang/eval-fail-elemAt-1.err.exp
new file mode 100644
index 000000000000..3ea5b0aef0b5
--- /dev/null
+++ b/tests/functional/lang/eval-fail-elemAt-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'elemAt' builtin
+         at /pwd/lang/eval-fail-elemAt-1.nix:1:1:
+            1| builtins.elemAt "foo" (-1)
+             | ^
+            2|
+
+       … while evaluating the first argument passed to 'builtins.elemAt'
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-elemAt-1.nix b/tests/functional/lang/eval-fail-elemAt-1.nix
new file mode 100644
index 000000000000..27de601ebac2
--- /dev/null
+++ b/tests/functional/lang/eval-fail-elemAt-1.nix
@@ -0,0 +1 @@
+builtins.elemAt "foo" (-1)
diff --git a/tests/functional/lang/eval-fail-elemAt-2.err.exp b/tests/functional/lang/eval-fail-elemAt-2.err.exp
new file mode 100644
index 000000000000..6d746c7739e5
--- /dev/null
+++ b/tests/functional/lang/eval-fail-elemAt-2.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'elemAt' builtin
+         at /pwd/lang/eval-fail-elemAt-2.nix:1:1:
+            1| builtins.elemAt [ ] (-1)
+             | ^
+            2|
+
+       error: 'builtins.elemAt' called with index -1 on a list of size 0
diff --git a/tests/functional/lang/eval-fail-elemAt-2.nix b/tests/functional/lang/eval-fail-elemAt-2.nix
new file mode 100644
index 000000000000..cf48f089f2fe
--- /dev/null
+++ b/tests/functional/lang/eval-fail-elemAt-2.nix
@@ -0,0 +1 @@
+builtins.elemAt [ ] (-1)
diff --git a/tests/functional/lang/eval-fail-elemAt-3.err.exp b/tests/functional/lang/eval-fail-elemAt-3.err.exp
new file mode 100644
index 000000000000..1f34afb45871
--- /dev/null
+++ b/tests/functional/lang/eval-fail-elemAt-3.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'elemAt' builtin
+         at /pwd/lang/eval-fail-elemAt-3.nix:1:1:
+            1| builtins.elemAt [ "foo" ] 3
+             | ^
+            2|
+
+       error: 'builtins.elemAt' called with index 3 on a list of size 1
diff --git a/tests/functional/lang/eval-fail-elemAt-3.nix b/tests/functional/lang/eval-fail-elemAt-3.nix
new file mode 100644
index 000000000000..8493015def6e
--- /dev/null
+++ b/tests/functional/lang/eval-fail-elemAt-3.nix
@@ -0,0 +1 @@
+builtins.elemAt [ "foo" ] 3
diff --git a/tests/functional/lang/eval-fail-filter-1.err.exp b/tests/functional/lang/eval-fail-filter-1.err.exp
new file mode 100644
index 000000000000..d3c55d9f651e
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filter-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'filter' builtin
+         at /pwd/lang/eval-fail-filter-1.nix:1:1:
+            1| builtins.filter 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.filter
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-filter-1.nix b/tests/functional/lang/eval-fail-filter-1.nix
new file mode 100644
index 000000000000..37b379f87d50
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filter-1.nix
@@ -0,0 +1 @@
+builtins.filter 1 "foo"
diff --git a/tests/functional/lang/eval-fail-filter-2.err.exp b/tests/functional/lang/eval-fail-filter-2.err.exp
new file mode 100644
index 000000000000..5e5d0ecc5a79
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filter-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'filter' builtin
+         at /pwd/lang/eval-fail-filter-2.nix:1:1:
+            1| builtins.filter 1 [ "foo" ]
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.filter
+
+       error: expected a function but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-filter-2.nix b/tests/functional/lang/eval-fail-filter-2.nix
new file mode 100644
index 000000000000..177adfa82c1d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filter-2.nix
@@ -0,0 +1 @@
+builtins.filter 1 [ "foo" ]
diff --git a/tests/functional/lang/eval-fail-filter-3.err.exp b/tests/functional/lang/eval-fail-filter-3.err.exp
new file mode 100644
index 000000000000..ba5a87e27567
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filter-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'filter' builtin
+         at /pwd/lang/eval-fail-filter-3.nix:1:1:
+            1| builtins.filter (_: 5) [ "foo" ]
+             | ^
+            2|
+
+       … while evaluating the return value of the filtering function passed to builtins.filter
+
+       error: expected a Boolean but found an integer: 5
diff --git a/tests/functional/lang/eval-fail-filter-3.nix b/tests/functional/lang/eval-fail-filter-3.nix
new file mode 100644
index 000000000000..c262f25bf6c5
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filter-3.nix
@@ -0,0 +1 @@
+builtins.filter (_: 5) [ "foo" ]
diff --git a/tests/functional/lang/eval-fail-filterSource-1.err.exp b/tests/functional/lang/eval-fail-filterSource-1.err.exp
new file mode 100644
index 000000000000..cf2d153f0deb
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filterSource-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'filterSource' builtin
+         at /pwd/lang/eval-fail-filterSource-1.nix:1:1:
+            1| builtins.filterSource [ ] [ ]
+             | ^
+            2|
+
+       … while evaluating the second argument (the path to filter) passed to 'builtins.filterSource'
+
+       error: cannot coerce a list to a string: [ ]
diff --git a/tests/functional/lang/eval-fail-filterSource-1.nix b/tests/functional/lang/eval-fail-filterSource-1.nix
new file mode 100644
index 000000000000..5833e0de595e
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filterSource-1.nix
@@ -0,0 +1 @@
+builtins.filterSource [ ] [ ]
diff --git a/tests/functional/lang/eval-fail-filterSource-2.err.exp b/tests/functional/lang/eval-fail-filterSource-2.err.exp
new file mode 100644
index 000000000000..e3302f032f9d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filterSource-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'filterSource' builtin
+         at /pwd/lang/eval-fail-filterSource-2.nix:1:1:
+            1| builtins.filterSource [ ] "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument (the path to filter) passed to 'builtins.filterSource'
+
+       error: string 'foo' doesn't represent an absolute path
diff --git a/tests/functional/lang/eval-fail-filterSource-2.nix b/tests/functional/lang/eval-fail-filterSource-2.nix
new file mode 100644
index 000000000000..5fc0b68cb0d5
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filterSource-2.nix
@@ -0,0 +1 @@
+builtins.filterSource [ ] "foo"
diff --git a/tests/functional/lang/eval-fail-filterSource-3.err.exp b/tests/functional/lang/eval-fail-filterSource-3.err.exp
new file mode 100644
index 000000000000..5750f8198c63
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filterSource-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'filterSource' builtin
+         at /pwd/lang/eval-fail-filterSource-3.nix:1:1:
+            1| builtins.filterSource [ ] ./.
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.filterSource
+
+       error: expected a function but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-filterSource-3.nix b/tests/functional/lang/eval-fail-filterSource-3.nix
new file mode 100644
index 000000000000..6c4124aadb38
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filterSource-3.nix
@@ -0,0 +1 @@
+builtins.filterSource [ ] ./.
diff --git a/tests/functional/lang/eval-fail-filterSource-4.err.exp b/tests/functional/lang/eval-fail-filterSource-4.err.exp
new file mode 100644
index 000000000000..4318616ee8fb
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filterSource-4.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'filterSource' builtin
+         at /pwd/lang/eval-fail-filterSource-4.nix:1:1:
+            1| builtins.filterSource (_: 1) ./.
+             | ^
+            2|
+
+       … while adding path '/pwd/lang'
+
+       error: attempt to call something which is not a function but an integer: 1
diff --git a/tests/functional/lang/eval-fail-filterSource-4.nix b/tests/functional/lang/eval-fail-filterSource-4.nix
new file mode 100644
index 000000000000..28a729c614b6
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filterSource-4.nix
@@ -0,0 +1 @@
+builtins.filterSource (_: 1) ./.
diff --git a/tests/functional/lang/eval-fail-filterSource-5.err.exp b/tests/functional/lang/eval-fail-filterSource-5.err.exp
new file mode 100644
index 000000000000..fe017b2efb8d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filterSource-5.err.exp
@@ -0,0 +1,12 @@
+error:
+       … while calling the 'filterSource' builtin
+         at /pwd/lang/eval-fail-filterSource-5.nix:1:1:
+            1| builtins.filterSource (_: _: 1) ./.
+             | ^
+            2|
+
+       … while adding path '/pwd/lang'
+
+       … while evaluating the return value of the path filter function
+
+       error: expected a Boolean but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-filterSource-5.nix b/tests/functional/lang/eval-fail-filterSource-5.nix
new file mode 100644
index 000000000000..dbb0decee0ee
--- /dev/null
+++ b/tests/functional/lang/eval-fail-filterSource-5.nix
@@ -0,0 +1 @@
+builtins.filterSource (_: _: 1) ./.
diff --git a/tests/functional/lang/eval-fail-floor-1.err.exp b/tests/functional/lang/eval-fail-floor-1.err.exp
new file mode 100644
index 000000000000..2e5fb0aae3db
--- /dev/null
+++ b/tests/functional/lang/eval-fail-floor-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'floor' builtin
+         at /pwd/lang/eval-fail-floor-1.nix:1:1:
+            1| builtins.floor "foo"
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.floor
+
+       error: expected a float but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-floor-1.nix b/tests/functional/lang/eval-fail-floor-1.nix
new file mode 100644
index 000000000000..1d4e1dcf5b7c
--- /dev/null
+++ b/tests/functional/lang/eval-fail-floor-1.nix
@@ -0,0 +1 @@
+builtins.floor "foo"
diff --git a/tests/functional/lang/eval-fail-foldlPrime-1.err.exp b/tests/functional/lang/eval-fail-foldlPrime-1.err.exp
new file mode 100644
index 000000000000..45540098ea4d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-foldlPrime-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'foldl'' builtin
+         at /pwd/lang/eval-fail-foldlPrime-1.nix:1:1:
+            1| builtins.foldl' 1 "foo" true
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.foldlStrict
+
+       error: expected a function but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-foldlPrime-1.nix b/tests/functional/lang/eval-fail-foldlPrime-1.nix
new file mode 100644
index 000000000000..e7790d4191a6
--- /dev/null
+++ b/tests/functional/lang/eval-fail-foldlPrime-1.nix
@@ -0,0 +1 @@
+builtins.foldl' 1 "foo" true
diff --git a/tests/functional/lang/eval-fail-foldlPrime-2.err.exp b/tests/functional/lang/eval-fail-foldlPrime-2.err.exp
new file mode 100644
index 000000000000..7597793eb28b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-foldlPrime-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'foldl'' builtin
+         at /pwd/lang/eval-fail-foldlPrime-2.nix:1:1:
+            1| builtins.foldl' (_: 1) "foo" true
+             | ^
+            2|
+
+       … while evaluating the third argument passed to builtins.foldlStrict
+
+       error: expected a list but found a Boolean: true
diff --git a/tests/functional/lang/eval-fail-foldlPrime-2.nix b/tests/functional/lang/eval-fail-foldlPrime-2.nix
new file mode 100644
index 000000000000..9599f33cd22b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-foldlPrime-2.nix
@@ -0,0 +1 @@
+builtins.foldl' (_: 1) "foo" true
diff --git a/tests/functional/lang/eval-fail-foldlPrime-3.err.exp b/tests/functional/lang/eval-fail-foldlPrime-3.err.exp
new file mode 100644
index 000000000000..8ba0a3dfb819
--- /dev/null
+++ b/tests/functional/lang/eval-fail-foldlPrime-3.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'foldl'' builtin
+         at /pwd/lang/eval-fail-foldlPrime-3.nix:1:1:
+            1| builtins.foldl' (_: 1) "foo" [ true ]
+             | ^
+            2|
+
+       error: attempt to call something which is not a function but an integer: 1
diff --git a/tests/functional/lang/eval-fail-foldlPrime-3.nix b/tests/functional/lang/eval-fail-foldlPrime-3.nix
new file mode 100644
index 000000000000..6e570d9c70b1
--- /dev/null
+++ b/tests/functional/lang/eval-fail-foldlPrime-3.nix
@@ -0,0 +1 @@
+builtins.foldl' (_: 1) "foo" [ true ]
diff --git a/tests/functional/lang/eval-fail-foldlPrime-4.err.exp b/tests/functional/lang/eval-fail-foldlPrime-4.err.exp
new file mode 100644
index 000000000000..9ead5b3929e0
--- /dev/null
+++ b/tests/functional/lang/eval-fail-foldlPrime-4.err.exp
@@ -0,0 +1,24 @@
+error:
+       … while calling the 'foldl'' builtin
+         at /pwd/lang/eval-fail-foldlPrime-4.nix:1:1:
+            1| builtins.foldl' (a: b: a && b) "foo" [ true ]
+             | ^
+            2|
+
+       … while calling anonymous lambda
+         at /pwd/lang/eval-fail-foldlPrime-4.nix:1:21:
+            1| builtins.foldl' (a: b: a && b) "foo" [ true ]
+             |                     ^
+            2|
+
+       … in the left operand of the AND (&&) operator
+         at /pwd/lang/eval-fail-foldlPrime-4.nix:1:26:
+            1| builtins.foldl' (a: b: a && b) "foo" [ true ]
+             |                          ^
+            2|
+
+       error: expected a Boolean but found a string: "foo"
+       at /pwd/lang/eval-fail-foldlPrime-4.nix:1:26:
+            1| builtins.foldl' (a: b: a && b) "foo" [ true ]
+             |                          ^
+            2|
diff --git a/tests/functional/lang/eval-fail-foldlPrime-4.nix b/tests/functional/lang/eval-fail-foldlPrime-4.nix
new file mode 100644
index 000000000000..c34df35dd147
--- /dev/null
+++ b/tests/functional/lang/eval-fail-foldlPrime-4.nix
@@ -0,0 +1 @@
+builtins.foldl' (a: b: a && b) "foo" [ true ]
diff --git a/tests/functional/lang/eval-fail-functionArgs-1.err.exp b/tests/functional/lang/eval-fail-functionArgs-1.err.exp
new file mode 100644
index 000000000000..4f15c0655d92
--- /dev/null
+++ b/tests/functional/lang/eval-fail-functionArgs-1.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'functionArgs' builtin
+         at /pwd/lang/eval-fail-functionArgs-1.nix:1:1:
+            1| builtins.functionArgs { }
+             | ^
+            2|
+
+       error: 'functionArgs' requires a function
diff --git a/tests/functional/lang/eval-fail-functionArgs-1.nix b/tests/functional/lang/eval-fail-functionArgs-1.nix
new file mode 100644
index 000000000000..151e9fa976d6
--- /dev/null
+++ b/tests/functional/lang/eval-fail-functionArgs-1.nix
@@ -0,0 +1 @@
+builtins.functionArgs { }
diff --git a/tests/functional/lang/eval-fail-genList-1.err.exp b/tests/functional/lang/eval-fail-genList-1.err.exp
new file mode 100644
index 000000000000..deea7e7ead79
--- /dev/null
+++ b/tests/functional/lang/eval-fail-genList-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'genList' builtin
+         at /pwd/lang/eval-fail-genList-1.nix:1:1:
+            1| builtins.genList 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.genList
+
+       error: expected an integer but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-genList-1.nix b/tests/functional/lang/eval-fail-genList-1.nix
new file mode 100644
index 000000000000..276147c1d369
--- /dev/null
+++ b/tests/functional/lang/eval-fail-genList-1.nix
@@ -0,0 +1 @@
+builtins.genList 1 "foo"
diff --git a/tests/functional/lang/eval-fail-genList-2.err.exp b/tests/functional/lang/eval-fail-genList-2.err.exp
new file mode 100644
index 000000000000..dbbab7d525d8
--- /dev/null
+++ b/tests/functional/lang/eval-fail-genList-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'genList' builtin
+         at /pwd/lang/eval-fail-genList-2.nix:1:1:
+            1| builtins.genList 1 2
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.genList
+
+       error: expected a function but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-genList-2.nix b/tests/functional/lang/eval-fail-genList-2.nix
new file mode 100644
index 000000000000..0f5bb6a3b668
--- /dev/null
+++ b/tests/functional/lang/eval-fail-genList-2.nix
@@ -0,0 +1 @@
+builtins.genList 1 2
diff --git a/tests/functional/lang/eval-fail-genList-3.err.exp b/tests/functional/lang/eval-fail-genList-3.err.exp
new file mode 100644
index 000000000000..62878d88eb5c
--- /dev/null
+++ b/tests/functional/lang/eval-fail-genList-3.err.exp
@@ -0,0 +1,20 @@
+error:
+       … while evaluating list element at index 0
+
+       … from call site
+         at /pwd/lang/eval-fail-genList-3.nix:1:19:
+            1| builtins.genList (x: x + "foo") 2
+             |                   ^
+            2|
+
+       … while calling anonymous lambda
+         at /pwd/lang/eval-fail-genList-3.nix:1:19:
+            1| builtins.genList (x: x + "foo") 2
+             |                   ^
+            2|
+
+       error: cannot add a string to an integer
+       at /pwd/lang/eval-fail-genList-3.nix:1:26:
+            1| builtins.genList (x: x + "foo") 2
+             |                          ^
+            2|
diff --git a/tests/functional/lang/eval-fail-genList-3.nix b/tests/functional/lang/eval-fail-genList-3.nix
new file mode 100644
index 000000000000..82b8b30bc1a2
--- /dev/null
+++ b/tests/functional/lang/eval-fail-genList-3.nix
@@ -0,0 +1 @@
+builtins.genList (x: x + "foo") 2
diff --git a/tests/functional/lang/eval-fail-genList-4.err.exp b/tests/functional/lang/eval-fail-genList-4.err.exp
new file mode 100644
index 000000000000..a60ffe6d775b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-genList-4.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'genList' builtin
+         at /pwd/lang/eval-fail-genList-4.nix:1:1:
+            1| builtins.genList false (-3)
+             | ^
+            2|
+
+       error: cannot create list of size -3
diff --git a/tests/functional/lang/eval-fail-genList-4.nix b/tests/functional/lang/eval-fail-genList-4.nix
new file mode 100644
index 000000000000..b4f4ee6188a1
--- /dev/null
+++ b/tests/functional/lang/eval-fail-genList-4.nix
@@ -0,0 +1 @@
+builtins.genList false (-3)
diff --git a/tests/functional/lang/eval-fail-getAttr-1.err.exp b/tests/functional/lang/eval-fail-getAttr-1.err.exp
new file mode 100644
index 000000000000..d2ff63a710ad
--- /dev/null
+++ b/tests/functional/lang/eval-fail-getAttr-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'getAttr' builtin
+         at /pwd/lang/eval-fail-getAttr-1.nix:1:1:
+            1| builtins.getAttr [ ] [ ]
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.getAttr
+
+       error: expected a string but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-getAttr-1.nix b/tests/functional/lang/eval-fail-getAttr-1.nix
new file mode 100644
index 000000000000..80b92f45dec9
--- /dev/null
+++ b/tests/functional/lang/eval-fail-getAttr-1.nix
@@ -0,0 +1 @@
+builtins.getAttr [ ] [ ]
diff --git a/tests/functional/lang/eval-fail-getAttr-2.err.exp b/tests/functional/lang/eval-fail-getAttr-2.err.exp
new file mode 100644
index 000000000000..e4a8afe799ed
--- /dev/null
+++ b/tests/functional/lang/eval-fail-getAttr-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'getAttr' builtin
+         at /pwd/lang/eval-fail-getAttr-2.nix:1:1:
+            1| builtins.getAttr "foo" [ ]
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.getAttr
+
+       error: expected a set but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-getAttr-2.nix b/tests/functional/lang/eval-fail-getAttr-2.nix
new file mode 100644
index 000000000000..6d836c033255
--- /dev/null
+++ b/tests/functional/lang/eval-fail-getAttr-2.nix
@@ -0,0 +1 @@
+builtins.getAttr "foo" [ ]
diff --git a/tests/functional/lang/eval-fail-getAttr-3.err.exp b/tests/functional/lang/eval-fail-getAttr-3.err.exp
new file mode 100644
index 000000000000..e3a3dab0589b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-getAttr-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'getAttr' builtin
+         at /pwd/lang/eval-fail-getAttr-3.nix:1:1:
+            1| builtins.getAttr "foo" { }
+             | ^
+            2|
+
+       … in the attribute set under consideration
+
+       error: attribute 'foo' missing
diff --git a/tests/functional/lang/eval-fail-getAttr-3.nix b/tests/functional/lang/eval-fail-getAttr-3.nix
new file mode 100644
index 000000000000..248a616bf33d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-getAttr-3.nix
@@ -0,0 +1 @@
+builtins.getAttr "foo" { }
diff --git a/tests/functional/lang/eval-fail-getEnv-1.err.exp b/tests/functional/lang/eval-fail-getEnv-1.err.exp
new file mode 100644
index 000000000000..92db4e5e4270
--- /dev/null
+++ b/tests/functional/lang/eval-fail-getEnv-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'getEnv' builtin
+         at /pwd/lang/eval-fail-getEnv-1.nix:1:1:
+            1| builtins.getEnv [ ]
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.getEnv
+
+       error: expected a string but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-getEnv-1.nix b/tests/functional/lang/eval-fail-getEnv-1.nix
new file mode 100644
index 000000000000..5e7cb3ea1b02
--- /dev/null
+++ b/tests/functional/lang/eval-fail-getEnv-1.nix
@@ -0,0 +1 @@
+builtins.getEnv [ ]
diff --git a/tests/functional/lang/eval-fail-groupBy-1.err.exp b/tests/functional/lang/eval-fail-groupBy-1.err.exp
new file mode 100644
index 000000000000..02d0415b2bd9
--- /dev/null
+++ b/tests/functional/lang/eval-fail-groupBy-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'groupBy' builtin
+         at /pwd/lang/eval-fail-groupBy-1.nix:1:1:
+            1| builtins.groupBy 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.groupBy
+
+       error: expected a function but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-groupBy-1.nix b/tests/functional/lang/eval-fail-groupBy-1.nix
new file mode 100644
index 000000000000..8fb41ada1352
--- /dev/null
+++ b/tests/functional/lang/eval-fail-groupBy-1.nix
@@ -0,0 +1 @@
+builtins.groupBy 1 "foo"
diff --git a/tests/functional/lang/eval-fail-groupBy-2.err.exp b/tests/functional/lang/eval-fail-groupBy-2.err.exp
new file mode 100644
index 000000000000..4a9b7b6daad1
--- /dev/null
+++ b/tests/functional/lang/eval-fail-groupBy-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'groupBy' builtin
+         at /pwd/lang/eval-fail-groupBy-2.nix:1:1:
+            1| builtins.groupBy (_: 1) "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.groupBy
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-groupBy-2.nix b/tests/functional/lang/eval-fail-groupBy-2.nix
new file mode 100644
index 000000000000..fe91a7bae88d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-groupBy-2.nix
@@ -0,0 +1 @@
+builtins.groupBy (_: 1) "foo"
diff --git a/tests/functional/lang/eval-fail-groupBy-3.err.exp b/tests/functional/lang/eval-fail-groupBy-3.err.exp
new file mode 100644
index 000000000000..4adc418338ed
--- /dev/null
+++ b/tests/functional/lang/eval-fail-groupBy-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'groupBy' builtin
+         at /pwd/lang/eval-fail-groupBy-3.nix:1:1:
+            1| builtins.groupBy (x: x) [
+             | ^
+            2|   "foo"
+
+       … while evaluating the return value of the grouping function passed to builtins.groupBy
+
+       error: expected a string but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-groupBy-3.nix b/tests/functional/lang/eval-fail-groupBy-3.nix
new file mode 100644
index 000000000000..a4165783d99e
--- /dev/null
+++ b/tests/functional/lang/eval-fail-groupBy-3.nix
@@ -0,0 +1,5 @@
+builtins.groupBy (x: x) [
+  "foo"
+  "bar"
+  1
+]
diff --git a/tests/functional/lang/eval-fail-hasAttr-1.err.exp b/tests/functional/lang/eval-fail-hasAttr-1.err.exp
new file mode 100644
index 000000000000..b44ae1c0c77d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-hasAttr-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'hasAttr' builtin
+         at /pwd/lang/eval-fail-hasAttr-1.nix:1:1:
+            1| builtins.hasAttr [ ] [ ]
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.hasAttr
+
+       error: expected a string but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-hasAttr-1.nix b/tests/functional/lang/eval-fail-hasAttr-1.nix
new file mode 100644
index 000000000000..8bdfbaaa7112
--- /dev/null
+++ b/tests/functional/lang/eval-fail-hasAttr-1.nix
@@ -0,0 +1 @@
+builtins.hasAttr [ ] [ ]
diff --git a/tests/functional/lang/eval-fail-hasAttr-2.err.exp b/tests/functional/lang/eval-fail-hasAttr-2.err.exp
new file mode 100644
index 000000000000..cd52370acf4b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-hasAttr-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'hasAttr' builtin
+         at /pwd/lang/eval-fail-hasAttr-2.nix:1:1:
+            1| builtins.hasAttr "foo" [ ]
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.hasAttr
+
+       error: expected a set but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-hasAttr-2.nix b/tests/functional/lang/eval-fail-hasAttr-2.nix
new file mode 100644
index 000000000000..d49909c76389
--- /dev/null
+++ b/tests/functional/lang/eval-fail-hasAttr-2.nix
@@ -0,0 +1 @@
+builtins.hasAttr "foo" [ ]
diff --git a/tests/functional/lang/eval-fail-hashString-1.err.exp b/tests/functional/lang/eval-fail-hashString-1.err.exp
new file mode 100644
index 000000000000..ecce1a5d846f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-hashString-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'hashString' builtin
+         at /pwd/lang/eval-fail-hashString-1.nix:1:1:
+            1| builtins.hashString 1 { }
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.hashString
+
+       error: expected a string but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-hashString-1.nix b/tests/functional/lang/eval-fail-hashString-1.nix
new file mode 100644
index 000000000000..bbca23d43f7f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-hashString-1.nix
@@ -0,0 +1 @@
+builtins.hashString 1 { }
diff --git a/tests/functional/lang/eval-fail-hashString-2.err.exp b/tests/functional/lang/eval-fail-hashString-2.err.exp
new file mode 100644
index 000000000000..edbf5e23ff78
--- /dev/null
+++ b/tests/functional/lang/eval-fail-hashString-2.err.exp
@@ -0,0 +1,9 @@
+error:
+       … while calling the 'hashString' builtin
+         at /pwd/lang/eval-fail-hashString-2.nix:1:1:
+            1| builtins.hashString "foo" "content"
+             | ^
+            2|
+
+       error: unknown hash algorithm 'foo', expect 'blake3', 'md5', 'sha1', 'sha256', or 'sha512'
+Try 'nix-instantiate --help' for more information.
diff --git a/tests/functional/lang/eval-fail-hashString-2.nix b/tests/functional/lang/eval-fail-hashString-2.nix
new file mode 100644
index 000000000000..9439b8b41d55
--- /dev/null
+++ b/tests/functional/lang/eval-fail-hashString-2.nix
@@ -0,0 +1 @@
+builtins.hashString "foo" "content"
diff --git a/tests/functional/lang/eval-fail-hashString-3.err.exp b/tests/functional/lang/eval-fail-hashString-3.err.exp
new file mode 100644
index 000000000000..2126b0062572
--- /dev/null
+++ b/tests/functional/lang/eval-fail-hashString-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'hashString' builtin
+         at /pwd/lang/eval-fail-hashString-3.nix:1:1:
+            1| builtins.hashString "sha256" { }
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.hashString
+
+       error: expected a string but found a set: { }
diff --git a/tests/functional/lang/eval-fail-hashString-3.nix b/tests/functional/lang/eval-fail-hashString-3.nix
new file mode 100644
index 000000000000..50b960c8d38c
--- /dev/null
+++ b/tests/functional/lang/eval-fail-hashString-3.nix
@@ -0,0 +1 @@
+builtins.hashString "sha256" { }
diff --git a/tests/functional/lang/eval-fail-head-1.err.exp b/tests/functional/lang/eval-fail-head-1.err.exp
new file mode 100644
index 000000000000..3fcbbe29b68c
--- /dev/null
+++ b/tests/functional/lang/eval-fail-head-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'head' builtin
+         at /pwd/lang/eval-fail-head-1.nix:1:1:
+            1| builtins.head 1
+             | ^
+            2|
+
+       … while evaluating the first argument passed to 'builtins.head'
+
+       error: expected a list but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-head-1.nix b/tests/functional/lang/eval-fail-head-1.nix
new file mode 100644
index 000000000000..11aa7248706e
--- /dev/null
+++ b/tests/functional/lang/eval-fail-head-1.nix
@@ -0,0 +1 @@
+builtins.head 1
diff --git a/tests/functional/lang/eval-fail-head-2.err.exp b/tests/functional/lang/eval-fail-head-2.err.exp
new file mode 100644
index 000000000000..68cecc8fa1d0
--- /dev/null
+++ b/tests/functional/lang/eval-fail-head-2.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'head' builtin
+         at /pwd/lang/eval-fail-head-2.nix:1:1:
+            1| builtins.head [ ]
+             | ^
+            2|
+
+       error: 'builtins.head' called on an empty list
diff --git a/tests/functional/lang/eval-fail-head-2.nix b/tests/functional/lang/eval-fail-head-2.nix
new file mode 100644
index 000000000000..c7a77da4e20e
--- /dev/null
+++ b/tests/functional/lang/eval-fail-head-2.nix
@@ -0,0 +1 @@
+builtins.head [ ]
diff --git a/tests/functional/lang/eval-fail-intersectAttrs-1.err.exp b/tests/functional/lang/eval-fail-intersectAttrs-1.err.exp
new file mode 100644
index 000000000000..098084a3f4f8
--- /dev/null
+++ b/tests/functional/lang/eval-fail-intersectAttrs-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'intersectAttrs' builtin
+         at /pwd/lang/eval-fail-intersectAttrs-1.nix:1:1:
+            1| builtins.intersectAttrs [ ] [ ]
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.intersectAttrs
+
+       error: expected a set but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-intersectAttrs-1.nix b/tests/functional/lang/eval-fail-intersectAttrs-1.nix
new file mode 100644
index 000000000000..5a8c133163d6
--- /dev/null
+++ b/tests/functional/lang/eval-fail-intersectAttrs-1.nix
@@ -0,0 +1 @@
+builtins.intersectAttrs [ ] [ ]
diff --git a/tests/functional/lang/eval-fail-intersectAttrs-2.err.exp b/tests/functional/lang/eval-fail-intersectAttrs-2.err.exp
new file mode 100644
index 000000000000..663df4f6147e
--- /dev/null
+++ b/tests/functional/lang/eval-fail-intersectAttrs-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'intersectAttrs' builtin
+         at /pwd/lang/eval-fail-intersectAttrs-2.nix:1:1:
+            1| builtins.intersectAttrs { } [ ]
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.intersectAttrs
+
+       error: expected a set but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-intersectAttrs-2.nix b/tests/functional/lang/eval-fail-intersectAttrs-2.nix
new file mode 100644
index 000000000000..413ce5d58b3a
--- /dev/null
+++ b/tests/functional/lang/eval-fail-intersectAttrs-2.nix
@@ -0,0 +1 @@
+builtins.intersectAttrs { } [ ]
diff --git a/tests/functional/lang/eval-fail-length-1.err.exp b/tests/functional/lang/eval-fail-length-1.err.exp
new file mode 100644
index 000000000000..7161a2fbf26f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-length-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'length' builtin
+         at /pwd/lang/eval-fail-length-1.nix:1:1:
+            1| builtins.length 1
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.length
+
+       error: expected a list but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-length-1.nix b/tests/functional/lang/eval-fail-length-1.nix
new file mode 100644
index 000000000000..972eb72c7697
--- /dev/null
+++ b/tests/functional/lang/eval-fail-length-1.nix
@@ -0,0 +1 @@
+builtins.length 1
diff --git a/tests/functional/lang/eval-fail-length-2.err.exp b/tests/functional/lang/eval-fail-length-2.err.exp
new file mode 100644
index 000000000000..8bd66a9a701a
--- /dev/null
+++ b/tests/functional/lang/eval-fail-length-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'length' builtin
+         at /pwd/lang/eval-fail-length-2.nix:1:1:
+            1| builtins.length "foo"
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.length
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-length-2.nix b/tests/functional/lang/eval-fail-length-2.nix
new file mode 100644
index 000000000000..a42e1034ab07
--- /dev/null
+++ b/tests/functional/lang/eval-fail-length-2.nix
@@ -0,0 +1 @@
+builtins.length "foo"
diff --git a/tests/functional/lang/eval-fail-lessThan-1.err.exp b/tests/functional/lang/eval-fail-lessThan-1.err.exp
new file mode 100644
index 000000000000..09ec5d8ffdbe
--- /dev/null
+++ b/tests/functional/lang/eval-fail-lessThan-1.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'lessThan' builtin
+         at /pwd/lang/eval-fail-lessThan-1.nix:1:1:
+            1| builtins.lessThan 1 "foo"
+             | ^
+            2|
+
+       error: cannot compare an integer with a string; values are 1 and "foo"
diff --git a/tests/functional/lang/eval-fail-lessThan-1.nix b/tests/functional/lang/eval-fail-lessThan-1.nix
new file mode 100644
index 000000000000..10cd489674ad
--- /dev/null
+++ b/tests/functional/lang/eval-fail-lessThan-1.nix
@@ -0,0 +1 @@
+builtins.lessThan 1 "foo"
diff --git a/tests/functional/lang/eval-fail-lessThan-2.err.exp b/tests/functional/lang/eval-fail-lessThan-2.err.exp
new file mode 100644
index 000000000000..6a8a183fa74e
--- /dev/null
+++ b/tests/functional/lang/eval-fail-lessThan-2.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'lessThan' builtin
+         at /pwd/lang/eval-fail-lessThan-2.nix:1:1:
+            1| builtins.lessThan { } { }
+             | ^
+            2|
+
+       error: cannot compare a set with a set; values of that type are incomparable (values are { } and { })
diff --git a/tests/functional/lang/eval-fail-lessThan-2.nix b/tests/functional/lang/eval-fail-lessThan-2.nix
new file mode 100644
index 000000000000..a20eca6bba14
--- /dev/null
+++ b/tests/functional/lang/eval-fail-lessThan-2.nix
@@ -0,0 +1 @@
+builtins.lessThan { } { }
diff --git a/tests/functional/lang/eval-fail-lessThan-3.err.exp b/tests/functional/lang/eval-fail-lessThan-3.err.exp
new file mode 100644
index 000000000000..4a66625c00cd
--- /dev/null
+++ b/tests/functional/lang/eval-fail-lessThan-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'lessThan' builtin
+         at /pwd/lang/eval-fail-lessThan-3.nix:1:1:
+            1| builtins.lessThan [ 1 2 ] [ "foo" ]
+             | ^
+            2|
+
+       … while comparing two list elements
+
+       error: cannot compare an integer with a string; values are 1 and "foo"
diff --git a/tests/functional/lang/eval-fail-lessThan-3.nix b/tests/functional/lang/eval-fail-lessThan-3.nix
new file mode 100644
index 000000000000..bdea0fef172c
--- /dev/null
+++ b/tests/functional/lang/eval-fail-lessThan-3.nix
@@ -0,0 +1 @@
+builtins.lessThan [ 1 2 ] [ "foo" ]
diff --git a/tests/functional/lang/eval-fail-listToAttrs-1.err.exp b/tests/functional/lang/eval-fail-listToAttrs-1.err.exp
new file mode 100644
index 000000000000..ce2ef38c8b52
--- /dev/null
+++ b/tests/functional/lang/eval-fail-listToAttrs-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'listToAttrs' builtin
+         at /pwd/lang/eval-fail-listToAttrs-1.nix:1:1:
+            1| builtins.listToAttrs 1
+             | ^
+            2|
+
+       … while evaluating the argument passed to builtins.listToAttrs
+
+       error: expected a list but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-listToAttrs-1.nix b/tests/functional/lang/eval-fail-listToAttrs-1.nix
new file mode 100644
index 000000000000..260f136e51ca
--- /dev/null
+++ b/tests/functional/lang/eval-fail-listToAttrs-1.nix
@@ -0,0 +1 @@
+builtins.listToAttrs 1
diff --git a/tests/functional/lang/eval-fail-listToAttrs-2.err.exp b/tests/functional/lang/eval-fail-listToAttrs-2.err.exp
new file mode 100644
index 000000000000..9809d216a253
--- /dev/null
+++ b/tests/functional/lang/eval-fail-listToAttrs-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'listToAttrs' builtin
+         at /pwd/lang/eval-fail-listToAttrs-2.nix:1:1:
+            1| builtins.listToAttrs [ 1 ]
+             | ^
+            2|
+
+       … while evaluating an element of the list passed to builtins.listToAttrs
+
+       error: expected a set but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-listToAttrs-2.nix b/tests/functional/lang/eval-fail-listToAttrs-2.nix
new file mode 100644
index 000000000000..2db54c3c7b52
--- /dev/null
+++ b/tests/functional/lang/eval-fail-listToAttrs-2.nix
@@ -0,0 +1 @@
+builtins.listToAttrs [ 1 ]
diff --git a/tests/functional/lang/eval-fail-listToAttrs-3.err.exp b/tests/functional/lang/eval-fail-listToAttrs-3.err.exp
new file mode 100644
index 000000000000..5c4886c1745f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-listToAttrs-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'listToAttrs' builtin
+         at /pwd/lang/eval-fail-listToAttrs-3.nix:1:1:
+            1| builtins.listToAttrs [ { } ]
+             | ^
+            2|
+
+       … in a {name=...; value=...;} pair
+
+       error: attribute 'name' missing
diff --git a/tests/functional/lang/eval-fail-listToAttrs-3.nix b/tests/functional/lang/eval-fail-listToAttrs-3.nix
new file mode 100644
index 000000000000..ce5b11798153
--- /dev/null
+++ b/tests/functional/lang/eval-fail-listToAttrs-3.nix
@@ -0,0 +1 @@
+builtins.listToAttrs [ { } ]
diff --git a/tests/functional/lang/eval-fail-listToAttrs-4.err.exp b/tests/functional/lang/eval-fail-listToAttrs-4.err.exp
new file mode 100644
index 000000000000..cb284ad2cd38
--- /dev/null
+++ b/tests/functional/lang/eval-fail-listToAttrs-4.err.exp
@@ -0,0 +1,18 @@
+error:
+       … while calling the 'listToAttrs' builtin
+         at /pwd/lang/eval-fail-listToAttrs-4.nix:1:1:
+            1| builtins.listToAttrs [ { name = 1; } ]
+             | ^
+            2|
+
+       … while evaluating the `name` attribute of an element of the list passed to builtins.listToAttrs
+         at /pwd/lang/eval-fail-listToAttrs-4.nix:1:26:
+            1| builtins.listToAttrs [ { name = 1; } ]
+             |                          ^
+            2|
+
+       error: expected a string but found an integer: 1
+       at /pwd/lang/eval-fail-listToAttrs-4.nix:1:26:
+            1| builtins.listToAttrs [ { name = 1; } ]
+             |                          ^
+            2|
diff --git a/tests/functional/lang/eval-fail-listToAttrs-4.nix b/tests/functional/lang/eval-fail-listToAttrs-4.nix
new file mode 100644
index 000000000000..a4bc7fd11c67
--- /dev/null
+++ b/tests/functional/lang/eval-fail-listToAttrs-4.nix
@@ -0,0 +1 @@
+builtins.listToAttrs [ { name = 1; } ]
diff --git a/tests/functional/lang/eval-fail-listToAttrs-5.err.exp b/tests/functional/lang/eval-fail-listToAttrs-5.err.exp
new file mode 100644
index 000000000000..a03834b49a37
--- /dev/null
+++ b/tests/functional/lang/eval-fail-listToAttrs-5.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'listToAttrs' builtin
+         at /pwd/lang/eval-fail-listToAttrs-5.nix:1:1:
+            1| builtins.listToAttrs [ { name = "foo"; } ]
+             | ^
+            2|
+
+       … in a {name=...; value=...;} pair
+
+       error: attribute 'value' missing
diff --git a/tests/functional/lang/eval-fail-listToAttrs-5.nix b/tests/functional/lang/eval-fail-listToAttrs-5.nix
new file mode 100644
index 000000000000..7cca5d0c7258
--- /dev/null
+++ b/tests/functional/lang/eval-fail-listToAttrs-5.nix
@@ -0,0 +1 @@
+builtins.listToAttrs [ { name = "foo"; } ]
diff --git a/tests/functional/lang/eval-fail-map-1.err.exp b/tests/functional/lang/eval-fail-map-1.err.exp
new file mode 100644
index 000000000000..65c0d5d3abdf
--- /dev/null
+++ b/tests/functional/lang/eval-fail-map-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'map' builtin
+         at /pwd/lang/eval-fail-map-1.nix:1:1:
+            1| builtins.map 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.map
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-map-1.nix b/tests/functional/lang/eval-fail-map-1.nix
new file mode 100644
index 000000000000..65f5cf8a67b2
--- /dev/null
+++ b/tests/functional/lang/eval-fail-map-1.nix
@@ -0,0 +1 @@
+builtins.map 1 "foo"
diff --git a/tests/functional/lang/eval-fail-map-2.err.exp b/tests/functional/lang/eval-fail-map-2.err.exp
new file mode 100644
index 000000000000..cf9a3f636753
--- /dev/null
+++ b/tests/functional/lang/eval-fail-map-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'map' builtin
+         at /pwd/lang/eval-fail-map-2.nix:1:1:
+            1| builtins.map 1 [ 1 ]
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.map
+
+       error: expected a function but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-map-2.nix b/tests/functional/lang/eval-fail-map-2.nix
new file mode 100644
index 000000000000..16100c0a7905
--- /dev/null
+++ b/tests/functional/lang/eval-fail-map-2.nix
@@ -0,0 +1 @@
+builtins.map 1 [ 1 ]
diff --git a/tests/functional/lang/eval-fail-mapAttrs-1.err.exp b/tests/functional/lang/eval-fail-mapAttrs-1.err.exp
new file mode 100644
index 000000000000..9a10bb92f841
--- /dev/null
+++ b/tests/functional/lang/eval-fail-mapAttrs-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'mapAttrs' builtin
+         at /pwd/lang/eval-fail-mapAttrs-1.nix:1:1:
+            1| builtins.mapAttrs [ ] [ ]
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.mapAttrs
+
+       error: expected a set but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-mapAttrs-1.nix b/tests/functional/lang/eval-fail-mapAttrs-1.nix
new file mode 100644
index 000000000000..c913e838d81a
--- /dev/null
+++ b/tests/functional/lang/eval-fail-mapAttrs-1.nix
@@ -0,0 +1 @@
+builtins.mapAttrs [ ] [ ]
diff --git a/tests/functional/lang/eval-fail-mapAttrs-2.err.exp b/tests/functional/lang/eval-fail-mapAttrs-2.err.exp
new file mode 100644
index 000000000000..9cc2b5495a58
--- /dev/null
+++ b/tests/functional/lang/eval-fail-mapAttrs-2.err.exp
@@ -0,0 +1,4 @@
+error:
+       … while evaluating the attribute 'foo'
+
+       error: attempt to call something which is not a function but a string: ""
diff --git a/tests/functional/lang/eval-fail-mapAttrs-2.nix b/tests/functional/lang/eval-fail-mapAttrs-2.nix
new file mode 100644
index 000000000000..b58ed8c3a660
--- /dev/null
+++ b/tests/functional/lang/eval-fail-mapAttrs-2.nix
@@ -0,0 +1 @@
+builtins.mapAttrs "" { foo.bar = 1; }
diff --git a/tests/functional/lang/eval-fail-mapAttrs-3.err.exp b/tests/functional/lang/eval-fail-mapAttrs-3.err.exp
new file mode 100644
index 000000000000..f4c48ee9a48f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-mapAttrs-3.err.exp
@@ -0,0 +1,4 @@
+error:
+       … while evaluating the attribute 'foo'
+
+       error: attempt to call something which is not a function but a string: "foo1"
diff --git a/tests/functional/lang/eval-fail-mapAttrs-3.nix b/tests/functional/lang/eval-fail-mapAttrs-3.nix
new file mode 100644
index 000000000000..6fc4de8251cd
--- /dev/null
+++ b/tests/functional/lang/eval-fail-mapAttrs-3.nix
@@ -0,0 +1 @@
+builtins.mapAttrs (x: x + "1") { foo.bar = 1; }
diff --git a/tests/functional/lang/eval-fail-mapAttrs-4.err.exp b/tests/functional/lang/eval-fail-mapAttrs-4.err.exp
new file mode 100644
index 000000000000..bd18ceeac946
--- /dev/null
+++ b/tests/functional/lang/eval-fail-mapAttrs-4.err.exp
@@ -0,0 +1,16 @@
+error:
+       … while evaluating the attribute 'foo'
+
+       … while calling anonymous lambda
+         at /pwd/lang/eval-fail-mapAttrs-4.nix:1:23:
+            1| builtins.mapAttrs (x: y: x + 1) { foo.bar = 1; }
+             |                       ^
+            2|
+
+       … while evaluating a path segment
+         at /pwd/lang/eval-fail-mapAttrs-4.nix:1:30:
+            1| builtins.mapAttrs (x: y: x + 1) { foo.bar = 1; }
+             |                              ^
+            2|
+
+       error: cannot coerce an integer to a string: 1
diff --git a/tests/functional/lang/eval-fail-mapAttrs-4.nix b/tests/functional/lang/eval-fail-mapAttrs-4.nix
new file mode 100644
index 000000000000..2ad09b602434
--- /dev/null
+++ b/tests/functional/lang/eval-fail-mapAttrs-4.nix
@@ -0,0 +1 @@
+builtins.mapAttrs (x: y: x + 1) { foo.bar = 1; }
diff --git a/tests/functional/lang/eval-fail-match-1.err.exp b/tests/functional/lang/eval-fail-match-1.err.exp
new file mode 100644
index 000000000000..2f757a6834c2
--- /dev/null
+++ b/tests/functional/lang/eval-fail-match-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'match' builtin
+         at /pwd/lang/eval-fail-match-1.nix:1:1:
+            1| builtins.match 1 { }
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.match
+
+       error: expected a string but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-match-1.nix b/tests/functional/lang/eval-fail-match-1.nix
new file mode 100644
index 000000000000..3eb26c017c53
--- /dev/null
+++ b/tests/functional/lang/eval-fail-match-1.nix
@@ -0,0 +1 @@
+builtins.match 1 { }
diff --git a/tests/functional/lang/eval-fail-match-2.err.exp b/tests/functional/lang/eval-fail-match-2.err.exp
new file mode 100644
index 000000000000..e415f5ccd3e1
--- /dev/null
+++ b/tests/functional/lang/eval-fail-match-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'match' builtin
+         at /pwd/lang/eval-fail-match-2.nix:1:1:
+            1| builtins.match "foo" { }
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.match
+
+       error: expected a string but found a set: { }
diff --git a/tests/functional/lang/eval-fail-match-2.nix b/tests/functional/lang/eval-fail-match-2.nix
new file mode 100644
index 000000000000..35eb16cfbf2d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-match-2.nix
@@ -0,0 +1 @@
+builtins.match "foo" { }
diff --git a/tests/functional/lang/eval-fail-match-3.err.exp b/tests/functional/lang/eval-fail-match-3.err.exp
new file mode 100644
index 000000000000..d69577bd7163
--- /dev/null
+++ b/tests/functional/lang/eval-fail-match-3.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'match' builtin
+         at /pwd/lang/eval-fail-match-3.nix:1:1:
+            1| builtins.match "(.*" ""
+             | ^
+            2|
+
+       error: invalid regular expression '(.*'
diff --git a/tests/functional/lang/eval-fail-match-3.nix b/tests/functional/lang/eval-fail-match-3.nix
new file mode 100644
index 000000000000..8115807f9220
--- /dev/null
+++ b/tests/functional/lang/eval-fail-match-3.nix
@@ -0,0 +1 @@
+builtins.match "(.*" ""
diff --git a/tests/functional/lang/eval-fail-mul-1.err.exp b/tests/functional/lang/eval-fail-mul-1.err.exp
new file mode 100644
index 000000000000..c03284987c9f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-mul-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'mul' builtin
+         at /pwd/lang/eval-fail-mul-1.nix:1:1:
+            1| builtins.mul "foo" 1
+             | ^
+            2|
+
+       … while evaluating the first argument of the multiplication
+
+       error: expected an integer but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-mul-1.nix b/tests/functional/lang/eval-fail-mul-1.nix
new file mode 100644
index 000000000000..a16333824671
--- /dev/null
+++ b/tests/functional/lang/eval-fail-mul-1.nix
@@ -0,0 +1 @@
+builtins.mul "foo" 1
diff --git a/tests/functional/lang/eval-fail-mul-2.err.exp b/tests/functional/lang/eval-fail-mul-2.err.exp
new file mode 100644
index 000000000000..16744abe7310
--- /dev/null
+++ b/tests/functional/lang/eval-fail-mul-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'mul' builtin
+         at /pwd/lang/eval-fail-mul-2.nix:1:1:
+            1| builtins.mul 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument of the multiplication
+
+       error: expected an integer but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-mul-2.nix b/tests/functional/lang/eval-fail-mul-2.nix
new file mode 100644
index 000000000000..57e2ef6925f0
--- /dev/null
+++ b/tests/functional/lang/eval-fail-mul-2.nix
@@ -0,0 +1 @@
+builtins.mul 1 "foo"
diff --git a/tests/functional/lang/eval-fail-parseDrvName-1.err.exp b/tests/functional/lang/eval-fail-parseDrvName-1.err.exp
new file mode 100644
index 000000000000..e5fbc2b6ec84
--- /dev/null
+++ b/tests/functional/lang/eval-fail-parseDrvName-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'parseDrvName' builtin
+         at /pwd/lang/eval-fail-parseDrvName-1.nix:1:1:
+            1| builtins.parseDrvName 1
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.parseDrvName
+
+       error: expected a string but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-parseDrvName-1.nix b/tests/functional/lang/eval-fail-parseDrvName-1.nix
new file mode 100644
index 000000000000..f524d500f5fc
--- /dev/null
+++ b/tests/functional/lang/eval-fail-parseDrvName-1.nix
@@ -0,0 +1 @@
+builtins.parseDrvName 1
diff --git a/tests/functional/lang/eval-fail-partition-1.err.exp b/tests/functional/lang/eval-fail-partition-1.err.exp
new file mode 100644
index 000000000000..d989969bd552
--- /dev/null
+++ b/tests/functional/lang/eval-fail-partition-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'partition' builtin
+         at /pwd/lang/eval-fail-partition-1.nix:1:1:
+            1| builtins.partition 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.partition
+
+       error: expected a function but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-partition-1.nix b/tests/functional/lang/eval-fail-partition-1.nix
new file mode 100644
index 000000000000..0452d11101d0
--- /dev/null
+++ b/tests/functional/lang/eval-fail-partition-1.nix
@@ -0,0 +1 @@
+builtins.partition 1 "foo"
diff --git a/tests/functional/lang/eval-fail-partition-2.err.exp b/tests/functional/lang/eval-fail-partition-2.err.exp
new file mode 100644
index 000000000000..e3fef6848fcf
--- /dev/null
+++ b/tests/functional/lang/eval-fail-partition-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'partition' builtin
+         at /pwd/lang/eval-fail-partition-2.nix:1:1:
+            1| builtins.partition (_: 1) "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.partition
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-partition-2.nix b/tests/functional/lang/eval-fail-partition-2.nix
new file mode 100644
index 000000000000..1a7219c5f3d4
--- /dev/null
+++ b/tests/functional/lang/eval-fail-partition-2.nix
@@ -0,0 +1 @@
+builtins.partition (_: 1) "foo"
diff --git a/tests/functional/lang/eval-fail-partition-3.err.exp b/tests/functional/lang/eval-fail-partition-3.err.exp
new file mode 100644
index 000000000000..a1257c7a6b1c
--- /dev/null
+++ b/tests/functional/lang/eval-fail-partition-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'partition' builtin
+         at /pwd/lang/eval-fail-partition-3.nix:1:1:
+            1| builtins.partition (_: 1) [ "foo" ]
+             | ^
+            2|
+
+       … while evaluating the return value of the partition function passed to builtins.partition
+
+       error: expected a Boolean but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-partition-3.nix b/tests/functional/lang/eval-fail-partition-3.nix
new file mode 100644
index 000000000000..07aa480fc18d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-partition-3.nix
@@ -0,0 +1 @@
+builtins.partition (_: 1) [ "foo" ]
diff --git a/tests/functional/lang/eval-fail-pathExists-1.err.exp b/tests/functional/lang/eval-fail-pathExists-1.err.exp
new file mode 100644
index 000000000000..3349247966fd
--- /dev/null
+++ b/tests/functional/lang/eval-fail-pathExists-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'pathExists' builtin
+         at /pwd/lang/eval-fail-pathExists-1.nix:1:1:
+            1| builtins.pathExists [ ]
+             | ^
+            2|
+
+       … while realising the context of a path
+
+       error: cannot coerce a list to a string: [ ]
diff --git a/tests/functional/lang/eval-fail-pathExists-1.nix b/tests/functional/lang/eval-fail-pathExists-1.nix
new file mode 100644
index 000000000000..83bda9afca95
--- /dev/null
+++ b/tests/functional/lang/eval-fail-pathExists-1.nix
@@ -0,0 +1 @@
+builtins.pathExists [ ]
diff --git a/tests/functional/lang/eval-fail-pathExists-2.err.exp b/tests/functional/lang/eval-fail-pathExists-2.err.exp
new file mode 100644
index 000000000000..184e47238d82
--- /dev/null
+++ b/tests/functional/lang/eval-fail-pathExists-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'pathExists' builtin
+         at /pwd/lang/eval-fail-pathExists-2.nix:1:1:
+            1| builtins.pathExists "zorglub"
+             | ^
+            2|
+
+       … while realising the context of a path
+
+       error: string 'zorglub' doesn't represent an absolute path
diff --git a/tests/functional/lang/eval-fail-pathExists-2.nix b/tests/functional/lang/eval-fail-pathExists-2.nix
new file mode 100644
index 000000000000..da594ca602b5
--- /dev/null
+++ b/tests/functional/lang/eval-fail-pathExists-2.nix
@@ -0,0 +1 @@
+builtins.pathExists "zorglub"
diff --git a/tests/functional/lang/eval-fail-placeholder-1.err.exp b/tests/functional/lang/eval-fail-placeholder-1.err.exp
new file mode 100644
index 000000000000..436095448054
--- /dev/null
+++ b/tests/functional/lang/eval-fail-placeholder-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'placeholder' builtin
+         at /pwd/lang/eval-fail-placeholder-1.nix:1:1:
+            1| builtins.placeholder [ ]
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.placeholder
+
+       error: expected a string but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-placeholder-1.nix b/tests/functional/lang/eval-fail-placeholder-1.nix
new file mode 100644
index 000000000000..ecc934a5e357
--- /dev/null
+++ b/tests/functional/lang/eval-fail-placeholder-1.nix
@@ -0,0 +1 @@
+builtins.placeholder [ ]
diff --git a/tests/functional/lang/eval-fail-readDir-not-a-directory-1.err.exp b/tests/functional/lang/eval-fail-readDir-not-a-directory-1.err.exp
index f94a7ed74521..7db863b03d53 100644
--- a/tests/functional/lang/eval-fail-readDir-not-a-directory-1.err.exp
+++ b/tests/functional/lang/eval-fail-readDir-not-a-directory-1.err.exp
@@ -13,4 +13,4 @@ error:
              |                 ^
             3| }
 
-       error: cannot read directory "/pwd/lang/readDir/bar": Not a directory
+       error: '/pwd/lang/readDir/bar' is not a directory
diff --git a/tests/functional/lang/eval-fail-readDir-not-a-directory-2.err.exp b/tests/functional/lang/eval-fail-readDir-not-a-directory-2.err.exp
index f5e6775545a4..20bbc3072e42 100644
--- a/tests/functional/lang/eval-fail-readDir-not-a-directory-2.err.exp
+++ b/tests/functional/lang/eval-fail-readDir-not-a-directory-2.err.exp
@@ -13,4 +13,4 @@ error:
              |                          ^
             3| }
 
-       error: cannot read directory "/pwd/lang/readDir/foo/git-hates-directories": Not a directory
+       error: '/pwd/lang/readDir/foo/git-hates-directories' is not a directory
diff --git a/tests/functional/lang/eval-fail-removeAttrs-1.err.exp b/tests/functional/lang/eval-fail-removeAttrs-1.err.exp
new file mode 100644
index 000000000000..ddfde967f164
--- /dev/null
+++ b/tests/functional/lang/eval-fail-removeAttrs-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'removeAttrs' builtin
+         at /pwd/lang/eval-fail-removeAttrs-1.nix:1:1:
+            1| builtins.removeAttrs "" ""
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.removeAttrs
+
+       error: expected a set but found a string: ""
diff --git a/tests/functional/lang/eval-fail-removeAttrs-1.nix b/tests/functional/lang/eval-fail-removeAttrs-1.nix
new file mode 100644
index 000000000000..83fe63003c9d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-removeAttrs-1.nix
@@ -0,0 +1 @@
+builtins.removeAttrs "" ""
diff --git a/tests/functional/lang/eval-fail-removeAttrs-2.err.exp b/tests/functional/lang/eval-fail-removeAttrs-2.err.exp
new file mode 100644
index 000000000000..ab668aaea0e4
--- /dev/null
+++ b/tests/functional/lang/eval-fail-removeAttrs-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'removeAttrs' builtin
+         at /pwd/lang/eval-fail-removeAttrs-2.nix:1:1:
+            1| builtins.removeAttrs "" [ 1 ]
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.removeAttrs
+
+       error: expected a set but found a string: ""
diff --git a/tests/functional/lang/eval-fail-removeAttrs-2.nix b/tests/functional/lang/eval-fail-removeAttrs-2.nix
new file mode 100644
index 000000000000..ecedf26cf975
--- /dev/null
+++ b/tests/functional/lang/eval-fail-removeAttrs-2.nix
@@ -0,0 +1 @@
+builtins.removeAttrs "" [ 1 ]
diff --git a/tests/functional/lang/eval-fail-removeAttrs-3.err.exp b/tests/functional/lang/eval-fail-removeAttrs-3.err.exp
new file mode 100644
index 000000000000..1937cd1be86d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-removeAttrs-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'removeAttrs' builtin
+         at /pwd/lang/eval-fail-removeAttrs-3.nix:1:1:
+            1| builtins.removeAttrs "" [ "1" ]
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.removeAttrs
+
+       error: expected a set but found a string: ""
diff --git a/tests/functional/lang/eval-fail-removeAttrs-3.nix b/tests/functional/lang/eval-fail-removeAttrs-3.nix
new file mode 100644
index 000000000000..4bc9e02394b7
--- /dev/null
+++ b/tests/functional/lang/eval-fail-removeAttrs-3.nix
@@ -0,0 +1 @@
+builtins.removeAttrs "" [ "1" ]
diff --git a/tests/functional/lang/eval-fail-replaceStrings-1.err.exp b/tests/functional/lang/eval-fail-replaceStrings-1.err.exp
new file mode 100644
index 000000000000..b0bc7c758c73
--- /dev/null
+++ b/tests/functional/lang/eval-fail-replaceStrings-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'replaceStrings' builtin
+         at /pwd/lang/eval-fail-replaceStrings-1.nix:1:1:
+            1| builtins.replaceStrings 0 0 { }
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.replaceStrings
+
+       error: expected a list but found an integer: 0
diff --git a/tests/functional/lang/eval-fail-replaceStrings-1.nix b/tests/functional/lang/eval-fail-replaceStrings-1.nix
new file mode 100644
index 000000000000..7e9edc28d26f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-replaceStrings-1.nix
@@ -0,0 +1 @@
+builtins.replaceStrings 0 0 { }
diff --git a/tests/functional/lang/eval-fail-replaceStrings-2.err.exp b/tests/functional/lang/eval-fail-replaceStrings-2.err.exp
new file mode 100644
index 000000000000..ee289eded6f1
--- /dev/null
+++ b/tests/functional/lang/eval-fail-replaceStrings-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'replaceStrings' builtin
+         at /pwd/lang/eval-fail-replaceStrings-2.nix:1:1:
+            1| builtins.replaceStrings [ ] 0 { }
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.replaceStrings
+
+       error: expected a list but found an integer: 0
diff --git a/tests/functional/lang/eval-fail-replaceStrings-2.nix b/tests/functional/lang/eval-fail-replaceStrings-2.nix
new file mode 100644
index 000000000000..57311720207f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-replaceStrings-2.nix
@@ -0,0 +1 @@
+builtins.replaceStrings [ ] 0 { }
diff --git a/tests/functional/lang/eval-fail-replaceStrings-3.err.exp b/tests/functional/lang/eval-fail-replaceStrings-3.err.exp
new file mode 100644
index 000000000000..3e71cfa75c9a
--- /dev/null
+++ b/tests/functional/lang/eval-fail-replaceStrings-3.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'replaceStrings' builtin
+         at /pwd/lang/eval-fail-replaceStrings-3.nix:1:1:
+            1| builtins.replaceStrings [ 0 ] [ ] { }
+             | ^
+            2|
+
+       error: 'from' and 'to' arguments passed to builtins.replaceStrings have different lengths
diff --git a/tests/functional/lang/eval-fail-replaceStrings-3.nix b/tests/functional/lang/eval-fail-replaceStrings-3.nix
new file mode 100644
index 000000000000..c7cdac4a9665
--- /dev/null
+++ b/tests/functional/lang/eval-fail-replaceStrings-3.nix
@@ -0,0 +1 @@
+builtins.replaceStrings [ 0 ] [ ] { }
diff --git a/tests/functional/lang/eval-fail-replaceStrings-4.err.exp b/tests/functional/lang/eval-fail-replaceStrings-4.err.exp
new file mode 100644
index 000000000000..f4e834090531
--- /dev/null
+++ b/tests/functional/lang/eval-fail-replaceStrings-4.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'replaceStrings' builtin
+         at /pwd/lang/eval-fail-replaceStrings-4.nix:1:1:
+            1| builtins.replaceStrings [ 1 ] [ "new" ] { }
+             | ^
+            2|
+
+       … while evaluating one of the strings to replace passed to builtins.replaceStrings
+
+       error: expected a string but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-replaceStrings-4.nix b/tests/functional/lang/eval-fail-replaceStrings-4.nix
new file mode 100644
index 000000000000..cc700ea54a50
--- /dev/null
+++ b/tests/functional/lang/eval-fail-replaceStrings-4.nix
@@ -0,0 +1 @@
+builtins.replaceStrings [ 1 ] [ "new" ] { }
diff --git a/tests/functional/lang/eval-fail-replaceStrings-5.err.exp b/tests/functional/lang/eval-fail-replaceStrings-5.err.exp
new file mode 100644
index 000000000000..75e2b5e8b345
--- /dev/null
+++ b/tests/functional/lang/eval-fail-replaceStrings-5.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'replaceStrings' builtin
+         at /pwd/lang/eval-fail-replaceStrings-5.nix:1:1:
+            1| builtins.replaceStrings [ "oo" ] [ true ] "foo"
+             | ^
+            2|
+
+       … while evaluating one of the replacement strings passed to builtins.replaceStrings
+
+       error: expected a string but found a Boolean: true
diff --git a/tests/functional/lang/eval-fail-replaceStrings-5.nix b/tests/functional/lang/eval-fail-replaceStrings-5.nix
new file mode 100644
index 000000000000..40010d845e40
--- /dev/null
+++ b/tests/functional/lang/eval-fail-replaceStrings-5.nix
@@ -0,0 +1 @@
+builtins.replaceStrings [ "oo" ] [ true ] "foo"
diff --git a/tests/functional/lang/eval-fail-replaceStrings-6.err.exp b/tests/functional/lang/eval-fail-replaceStrings-6.err.exp
new file mode 100644
index 000000000000..5ced1affaf21
--- /dev/null
+++ b/tests/functional/lang/eval-fail-replaceStrings-6.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'replaceStrings' builtin
+         at /pwd/lang/eval-fail-replaceStrings-6.nix:1:1:
+            1| builtins.replaceStrings [ "old" ] [ "new" ] { }
+             | ^
+            2|
+
+       … while evaluating the third argument passed to builtins.replaceStrings
+
+       error: expected a string but found a set: { }
diff --git a/tests/functional/lang/eval-fail-replaceStrings-6.nix b/tests/functional/lang/eval-fail-replaceStrings-6.nix
new file mode 100644
index 000000000000..2953b4888bef
--- /dev/null
+++ b/tests/functional/lang/eval-fail-replaceStrings-6.nix
@@ -0,0 +1 @@
+builtins.replaceStrings [ "old" ] [ "new" ] { }
diff --git a/tests/functional/lang/eval-fail-sort-1.err.exp b/tests/functional/lang/eval-fail-sort-1.err.exp
new file mode 100644
index 000000000000..2797d344d6aa
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sort-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'sort' builtin
+         at /pwd/lang/eval-fail-sort-1.nix:1:1:
+            1| builtins.sort 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.sort
+
+       error: expected a list but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-sort-1.nix b/tests/functional/lang/eval-fail-sort-1.nix
new file mode 100644
index 000000000000..12d3a102872d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sort-1.nix
@@ -0,0 +1 @@
+builtins.sort 1 "foo"
diff --git a/tests/functional/lang/eval-fail-sort-2.err.exp b/tests/functional/lang/eval-fail-sort-2.err.exp
new file mode 100644
index 000000000000..462ade0e447b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sort-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'sort' builtin
+         at /pwd/lang/eval-fail-sort-2.nix:1:1:
+            1| builtins.sort 1 [ "foo" ]
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.sort
+
+       error: expected a function but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-sort-2.nix b/tests/functional/lang/eval-fail-sort-2.nix
new file mode 100644
index 000000000000..27ffb1d3633c
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sort-2.nix
@@ -0,0 +1 @@
+builtins.sort 1 [ "foo" ]
diff --git a/tests/functional/lang/eval-fail-sort-3.err.exp b/tests/functional/lang/eval-fail-sort-3.err.exp
new file mode 100644
index 000000000000..0d86a7f4d1a3
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sort-3.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'sort' builtin
+         at /pwd/lang/eval-fail-sort-3.nix:1:1:
+            1| builtins.sort (_: 1) [
+             | ^
+            2|   "foo"
+
+       error: attempt to call something which is not a function but an integer: 1
diff --git a/tests/functional/lang/eval-fail-sort-3.nix b/tests/functional/lang/eval-fail-sort-3.nix
new file mode 100644
index 000000000000..1fcd434d07f8
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sort-3.nix
@@ -0,0 +1,4 @@
+builtins.sort (_: 1) [
+  "foo"
+  "bar"
+]
diff --git a/tests/functional/lang/eval-fail-sort-4.err.exp b/tests/functional/lang/eval-fail-sort-4.err.exp
new file mode 100644
index 000000000000..517eefeb5c98
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sort-4.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'sort' builtin
+         at /pwd/lang/eval-fail-sort-4.nix:1:1:
+            1| builtins.sort (_: _: 1) [
+             | ^
+            2|   "foo"
+
+       … while evaluating the return value of the sorting function passed to builtins.sort
+
+       error: expected a Boolean but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-sort-4.nix b/tests/functional/lang/eval-fail-sort-4.nix
new file mode 100644
index 000000000000..89868de9abb7
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sort-4.nix
@@ -0,0 +1,4 @@
+builtins.sort (_: _: 1) [
+  "foo"
+  "bar"
+]
diff --git a/tests/functional/lang/eval-fail-sort-5.err.exp b/tests/functional/lang/eval-fail-sort-5.err.exp
new file mode 100644
index 000000000000..f4c66dbd466c
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sort-5.err.exp
@@ -0,0 +1,26 @@
+error:
+       … while calling the 'sort' builtin
+         at /pwd/lang/eval-fail-sort-5.nix:1:1:
+            1| builtins.sort (a: b: a <= b) [
+             | ^
+            2|   "foo"
+
+       … while calling anonymous lambda
+         at /pwd/lang/eval-fail-sort-5.nix:1:19:
+            1| builtins.sort (a: b: a <= b) [
+             |                   ^
+            2|   "foo"
+
+       … in the argument of the not operator
+         at /pwd/lang/eval-fail-sort-5.nix:1:24:
+            1| builtins.sort (a: b: a <= b) [
+             |                        ^
+            2|   "foo"
+
+       … while calling the 'lessThan' builtin
+         at /pwd/lang/eval-fail-sort-5.nix:1:24:
+            1| builtins.sort (a: b: a <= b) [
+             |                        ^
+            2|   "foo"
+
+       error: cannot compare a string with a set; values are "foo" and { }
diff --git a/tests/functional/lang/eval-fail-sort-5.nix b/tests/functional/lang/eval-fail-sort-5.nix
new file mode 100644
index 000000000000..bd50e0b325da
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sort-5.nix
@@ -0,0 +1,4 @@
+builtins.sort (a: b: a <= b) [
+  "foo"
+  { }
+]
diff --git a/tests/functional/lang/eval-fail-sort-6.err.exp b/tests/functional/lang/eval-fail-sort-6.err.exp
new file mode 100644
index 000000000000..302a27f2361b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sort-6.err.exp
@@ -0,0 +1,26 @@
+error:
+       … while calling the 'sort' builtin
+         at /pwd/lang/eval-fail-sort-6.nix:1:1:
+            1| builtins.sort (a: b: a <= b) [
+             | ^
+            2|   { }
+
+       … while calling anonymous lambda
+         at /pwd/lang/eval-fail-sort-6.nix:1:19:
+            1| builtins.sort (a: b: a <= b) [
+             |                   ^
+            2|   { }
+
+       … in the argument of the not operator
+         at /pwd/lang/eval-fail-sort-6.nix:1:24:
+            1| builtins.sort (a: b: a <= b) [
+             |                        ^
+            2|   { }
+
+       … while calling the 'lessThan' builtin
+         at /pwd/lang/eval-fail-sort-6.nix:1:24:
+            1| builtins.sort (a: b: a <= b) [
+             |                        ^
+            2|   { }
+
+       error: cannot compare a set with a set; values of that type are incomparable (values are { } and { })
diff --git a/tests/functional/lang/eval-fail-sort-6.nix b/tests/functional/lang/eval-fail-sort-6.nix
new file mode 100644
index 000000000000..3c527596d82c
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sort-6.nix
@@ -0,0 +1,4 @@
+builtins.sort (a: b: a <= b) [
+  { }
+  { }
+]
diff --git a/tests/functional/lang/eval-fail-split-1.err.exp b/tests/functional/lang/eval-fail-split-1.err.exp
new file mode 100644
index 000000000000..c8ac7085741c
--- /dev/null
+++ b/tests/functional/lang/eval-fail-split-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'split' builtin
+         at /pwd/lang/eval-fail-split-1.nix:1:1:
+            1| builtins.split 1 { }
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.split
+
+       error: expected a string but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-split-1.nix b/tests/functional/lang/eval-fail-split-1.nix
new file mode 100644
index 000000000000..ad702a1a3a80
--- /dev/null
+++ b/tests/functional/lang/eval-fail-split-1.nix
@@ -0,0 +1 @@
+builtins.split 1 { }
diff --git a/tests/functional/lang/eval-fail-split-2.err.exp b/tests/functional/lang/eval-fail-split-2.err.exp
new file mode 100644
index 000000000000..a912771d0639
--- /dev/null
+++ b/tests/functional/lang/eval-fail-split-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'split' builtin
+         at /pwd/lang/eval-fail-split-2.nix:1:1:
+            1| builtins.split "foo" { }
+             | ^
+            2|
+
+       … while evaluating the second argument passed to builtins.split
+
+       error: expected a string but found a set: { }
diff --git a/tests/functional/lang/eval-fail-split-2.nix b/tests/functional/lang/eval-fail-split-2.nix
new file mode 100644
index 000000000000..43489c5374e2
--- /dev/null
+++ b/tests/functional/lang/eval-fail-split-2.nix
@@ -0,0 +1 @@
+builtins.split "foo" { }
diff --git a/tests/functional/lang/eval-fail-split-3.err.exp b/tests/functional/lang/eval-fail-split-3.err.exp
new file mode 100644
index 000000000000..a7cfd394188b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-split-3.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'split' builtin
+         at /pwd/lang/eval-fail-split-3.nix:1:1:
+            1| builtins.split "f(o*o" "1foo2"
+             | ^
+            2|
+
+       error: invalid regular expression 'f(o*o'
diff --git a/tests/functional/lang/eval-fail-split-3.nix b/tests/functional/lang/eval-fail-split-3.nix
new file mode 100644
index 000000000000..f45294e93050
--- /dev/null
+++ b/tests/functional/lang/eval-fail-split-3.nix
@@ -0,0 +1 @@
+builtins.split "f(o*o" "1foo2"
diff --git a/tests/functional/lang/eval-fail-splitVersion-1.err.exp b/tests/functional/lang/eval-fail-splitVersion-1.err.exp
new file mode 100644
index 000000000000..f7eb7614d89d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-splitVersion-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'splitVersion' builtin
+         at /pwd/lang/eval-fail-splitVersion-1.nix:1:1:
+            1| builtins.splitVersion 1
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.splitVersion
+
+       error: expected a string but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-splitVersion-1.nix b/tests/functional/lang/eval-fail-splitVersion-1.nix
new file mode 100644
index 000000000000..43941d1b6640
--- /dev/null
+++ b/tests/functional/lang/eval-fail-splitVersion-1.nix
@@ -0,0 +1 @@
+builtins.splitVersion 1
diff --git a/tests/functional/lang/eval-fail-storePath-1.err.exp b/tests/functional/lang/eval-fail-storePath-1.err.exp
new file mode 100644
index 000000000000..711ed13ed8ce
--- /dev/null
+++ b/tests/functional/lang/eval-fail-storePath-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'storePath' builtin
+         at /pwd/lang/eval-fail-storePath-1.nix:1:1:
+            1| builtins.storePath true
+             | ^
+            2|
+
+       … while evaluating the first argument passed to 'builtins.storePath'
+
+       error: cannot coerce a Boolean to a string: true
diff --git a/tests/functional/lang/eval-fail-storePath-1.nix b/tests/functional/lang/eval-fail-storePath-1.nix
new file mode 100644
index 000000000000..d4ce341022d0
--- /dev/null
+++ b/tests/functional/lang/eval-fail-storePath-1.nix
@@ -0,0 +1 @@
+builtins.storePath true
diff --git a/tests/functional/lang/eval-fail-stringLength-1.err.exp b/tests/functional/lang/eval-fail-stringLength-1.err.exp
new file mode 100644
index 000000000000..37d63fd493c2
--- /dev/null
+++ b/tests/functional/lang/eval-fail-stringLength-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'stringLength' builtin
+         at /pwd/lang/eval-fail-stringLength-1.nix:1:1:
+            1| builtins.stringLength { }
+             | ^
+            2|
+
+       … while evaluating the argument passed to builtins.stringLength
+
+       error: cannot coerce a set to a string: { }
diff --git a/tests/functional/lang/eval-fail-stringLength-1.nix b/tests/functional/lang/eval-fail-stringLength-1.nix
new file mode 100644
index 000000000000..0a5ba6d8a842
--- /dev/null
+++ b/tests/functional/lang/eval-fail-stringLength-1.nix
@@ -0,0 +1 @@
+builtins.stringLength { }
diff --git a/tests/functional/lang/eval-fail-sub-1.err.exp b/tests/functional/lang/eval-fail-sub-1.err.exp
new file mode 100644
index 000000000000..769bf252bbb8
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sub-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'sub' builtin
+         at /pwd/lang/eval-fail-sub-1.nix:1:1:
+            1| builtins.sub "foo" 1
+             | ^
+            2|
+
+       … while evaluating the first argument of the subtraction
+
+       error: expected an integer but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-sub-1.nix b/tests/functional/lang/eval-fail-sub-1.nix
new file mode 100644
index 000000000000..cbff4ca1ed72
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sub-1.nix
@@ -0,0 +1 @@
+builtins.sub "foo" 1
diff --git a/tests/functional/lang/eval-fail-sub-2.err.exp b/tests/functional/lang/eval-fail-sub-2.err.exp
new file mode 100644
index 000000000000..ee5ed4618a53
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sub-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'sub' builtin
+         at /pwd/lang/eval-fail-sub-2.nix:1:1:
+            1| builtins.sub 1 "foo"
+             | ^
+            2|
+
+       … while evaluating the second argument of the subtraction
+
+       error: expected an integer but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-sub-2.nix b/tests/functional/lang/eval-fail-sub-2.nix
new file mode 100644
index 000000000000..4a3cfc6e0254
--- /dev/null
+++ b/tests/functional/lang/eval-fail-sub-2.nix
@@ -0,0 +1 @@
+builtins.sub 1 "foo"
diff --git a/tests/functional/lang/eval-fail-substring-1.err.exp b/tests/functional/lang/eval-fail-substring-1.err.exp
new file mode 100644
index 000000000000..84e61c17c075
--- /dev/null
+++ b/tests/functional/lang/eval-fail-substring-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'substring' builtin
+         at /pwd/lang/eval-fail-substring-1.nix:1:1:
+            1| builtins.substring { } "foo" true
+             | ^
+            2|
+
+       … while evaluating the first argument (the start offset) passed to builtins.substring
+
+       error: expected an integer but found a set: { }
diff --git a/tests/functional/lang/eval-fail-substring-1.nix b/tests/functional/lang/eval-fail-substring-1.nix
new file mode 100644
index 000000000000..c12228550bf8
--- /dev/null
+++ b/tests/functional/lang/eval-fail-substring-1.nix
@@ -0,0 +1 @@
+builtins.substring { } "foo" true
diff --git a/tests/functional/lang/eval-fail-substring-2.err.exp b/tests/functional/lang/eval-fail-substring-2.err.exp
new file mode 100644
index 000000000000..641fde5a83dc
--- /dev/null
+++ b/tests/functional/lang/eval-fail-substring-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'substring' builtin
+         at /pwd/lang/eval-fail-substring-2.nix:1:1:
+            1| builtins.substring 3 "foo" true
+             | ^
+            2|
+
+       … while evaluating the second argument (the substring length) passed to builtins.substring
+
+       error: expected an integer but found a string: "foo"
diff --git a/tests/functional/lang/eval-fail-substring-2.nix b/tests/functional/lang/eval-fail-substring-2.nix
new file mode 100644
index 000000000000..358b0d083506
--- /dev/null
+++ b/tests/functional/lang/eval-fail-substring-2.nix
@@ -0,0 +1 @@
+builtins.substring 3 "foo" true
diff --git a/tests/functional/lang/eval-fail-substring-3.err.exp b/tests/functional/lang/eval-fail-substring-3.err.exp
new file mode 100644
index 000000000000..67b12cab2709
--- /dev/null
+++ b/tests/functional/lang/eval-fail-substring-3.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'substring' builtin
+         at /pwd/lang/eval-fail-substring-3.nix:1:1:
+            1| builtins.substring 0 3 { }
+             | ^
+            2|
+
+       … while evaluating the third argument (the string) passed to builtins.substring
+
+       error: cannot coerce a set to a string: { }
diff --git a/tests/functional/lang/eval-fail-substring-3.nix b/tests/functional/lang/eval-fail-substring-3.nix
new file mode 100644
index 000000000000..f52921e48103
--- /dev/null
+++ b/tests/functional/lang/eval-fail-substring-3.nix
@@ -0,0 +1 @@
+builtins.substring 0 3 { }
diff --git a/tests/functional/lang/eval-fail-substring-4.err.exp b/tests/functional/lang/eval-fail-substring-4.err.exp
new file mode 100644
index 000000000000..cdaa11b20227
--- /dev/null
+++ b/tests/functional/lang/eval-fail-substring-4.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'substring' builtin
+         at /pwd/lang/eval-fail-substring-4.nix:1:1:
+            1| builtins.substring (-3) 3 "sometext"
+             | ^
+            2|
+
+       error: negative start position in 'substring'
diff --git a/tests/functional/lang/eval-fail-substring-4.nix b/tests/functional/lang/eval-fail-substring-4.nix
new file mode 100644
index 000000000000..82813b2c5838
--- /dev/null
+++ b/tests/functional/lang/eval-fail-substring-4.nix
@@ -0,0 +1 @@
+builtins.substring (-3) 3 "sometext"
diff --git a/tests/functional/lang/eval-fail-tail-1.err.exp b/tests/functional/lang/eval-fail-tail-1.err.exp
new file mode 100644
index 000000000000..2473767896ff
--- /dev/null
+++ b/tests/functional/lang/eval-fail-tail-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'tail' builtin
+         at /pwd/lang/eval-fail-tail-1.nix:1:1:
+            1| builtins.tail 1
+             | ^
+            2|
+
+       … while evaluating the first argument passed to 'builtins.tail'
+
+       error: expected a list but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-tail-1.nix b/tests/functional/lang/eval-fail-tail-1.nix
new file mode 100644
index 000000000000..229ab7c8d7a1
--- /dev/null
+++ b/tests/functional/lang/eval-fail-tail-1.nix
@@ -0,0 +1 @@
+builtins.tail 1
diff --git a/tests/functional/lang/eval-fail-tail-2.err.exp b/tests/functional/lang/eval-fail-tail-2.err.exp
new file mode 100644
index 000000000000..63abbf2cba3d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-tail-2.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'tail' builtin
+         at /pwd/lang/eval-fail-tail-2.nix:1:1:
+            1| builtins.tail [ ]
+             | ^
+            2|
+
+       error: 'builtins.tail' called on an empty list
diff --git a/tests/functional/lang/eval-fail-tail-2.nix b/tests/functional/lang/eval-fail-tail-2.nix
new file mode 100644
index 000000000000..3bd318d1c33f
--- /dev/null
+++ b/tests/functional/lang/eval-fail-tail-2.nix
@@ -0,0 +1 @@
+builtins.tail [ ]
diff --git a/tests/functional/lang/eval-fail-toPath-1.err.exp b/tests/functional/lang/eval-fail-toPath-1.err.exp
new file mode 100644
index 000000000000..6e977c6a2bab
--- /dev/null
+++ b/tests/functional/lang/eval-fail-toPath-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'toPath' builtin
+         at /pwd/lang/eval-fail-toPath-1.nix:1:1:
+            1| builtins.toPath [ ]
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.toPath
+
+       error: cannot coerce a list to a string: [ ]
diff --git a/tests/functional/lang/eval-fail-toPath-1.nix b/tests/functional/lang/eval-fail-toPath-1.nix
new file mode 100644
index 000000000000..cd96c880b803
--- /dev/null
+++ b/tests/functional/lang/eval-fail-toPath-1.nix
@@ -0,0 +1 @@
+builtins.toPath [ ]
diff --git a/tests/functional/lang/eval-fail-toPath-2.err.exp b/tests/functional/lang/eval-fail-toPath-2.err.exp
new file mode 100644
index 000000000000..f7d421b76d8d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-toPath-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'toPath' builtin
+         at /pwd/lang/eval-fail-toPath-2.nix:1:1:
+            1| builtins.toPath "foo"
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.toPath
+
+       error: string 'foo' doesn't represent an absolute path
diff --git a/tests/functional/lang/eval-fail-toPath-2.nix b/tests/functional/lang/eval-fail-toPath-2.nix
new file mode 100644
index 000000000000..4bcb7fc14778
--- /dev/null
+++ b/tests/functional/lang/eval-fail-toPath-2.nix
@@ -0,0 +1 @@
+builtins.toPath "foo"
diff --git a/tests/functional/lang/eval-fail-toString-1.err.exp b/tests/functional/lang/eval-fail-toString-1.err.exp
new file mode 100644
index 000000000000..d73b9ad84c50
--- /dev/null
+++ b/tests/functional/lang/eval-fail-toString-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'toString' builtin
+         at /pwd/lang/eval-fail-toString-1.nix:1:1:
+            1| builtins.toString { a = 1; }
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.toString
+
+       error: cannot coerce a set to a string: { a = 1; }
diff --git a/tests/functional/lang/eval-fail-toString-1.nix b/tests/functional/lang/eval-fail-toString-1.nix
new file mode 100644
index 000000000000..e4b2d8d7955b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-toString-1.nix
@@ -0,0 +1 @@
+builtins.toString { a = 1; }
diff --git a/tests/functional/lang/eval-fail-zipAttrsWith-1.err.exp b/tests/functional/lang/eval-fail-zipAttrsWith-1.err.exp
new file mode 100644
index 000000000000..7aced51b97d0
--- /dev/null
+++ b/tests/functional/lang/eval-fail-zipAttrsWith-1.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'zipAttrsWith' builtin
+         at /pwd/lang/eval-fail-zipAttrsWith-1.nix:1:1:
+            1| builtins.zipAttrsWith [ ] [ 1 ]
+             | ^
+            2|
+
+       … while evaluating the first argument passed to builtins.zipAttrsWith
+
+       error: expected a function but found a list: [ ]
diff --git a/tests/functional/lang/eval-fail-zipAttrsWith-1.nix b/tests/functional/lang/eval-fail-zipAttrsWith-1.nix
new file mode 100644
index 000000000000..1f44609cd2ae
--- /dev/null
+++ b/tests/functional/lang/eval-fail-zipAttrsWith-1.nix
@@ -0,0 +1 @@
+builtins.zipAttrsWith [ ] [ 1 ]
diff --git a/tests/functional/lang/eval-fail-zipAttrsWith-2.err.exp b/tests/functional/lang/eval-fail-zipAttrsWith-2.err.exp
new file mode 100644
index 000000000000..0a27e2d0195e
--- /dev/null
+++ b/tests/functional/lang/eval-fail-zipAttrsWith-2.err.exp
@@ -0,0 +1,10 @@
+error:
+       … while calling the 'zipAttrsWith' builtin
+         at /pwd/lang/eval-fail-zipAttrsWith-2.nix:1:1:
+            1| builtins.zipAttrsWith (_: 1) [ 1 ]
+             | ^
+            2|
+
+       … while evaluating a value of the list passed as second argument to builtins.zipAttrsWith
+
+       error: expected a set but found an integer: 1
diff --git a/tests/functional/lang/eval-fail-zipAttrsWith-2.nix b/tests/functional/lang/eval-fail-zipAttrsWith-2.nix
new file mode 100644
index 000000000000..331da91a535b
--- /dev/null
+++ b/tests/functional/lang/eval-fail-zipAttrsWith-2.nix
@@ -0,0 +1 @@
+builtins.zipAttrsWith (_: 1) [ 1 ]
diff --git a/tests/functional/lang/eval-fail-zipAttrsWith-3.err.exp b/tests/functional/lang/eval-fail-zipAttrsWith-3.err.exp
new file mode 100644
index 000000000000..780643b9df28
--- /dev/null
+++ b/tests/functional/lang/eval-fail-zipAttrsWith-3.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while evaluating the attribute 'foo'
+
+       error: attempt to call something which is not a function but an integer: 1
+       at /pwd/lang/eval-fail-zipAttrsWith-3.nix:1:24:
+            1| builtins.zipAttrsWith (_: 1) [ { foo = 1; } ]
+             |                        ^
+            2|
diff --git a/tests/functional/lang/eval-fail-zipAttrsWith-3.nix b/tests/functional/lang/eval-fail-zipAttrsWith-3.nix
new file mode 100644
index 000000000000..6ac25c011010
--- /dev/null
+++ b/tests/functional/lang/eval-fail-zipAttrsWith-3.nix
@@ -0,0 +1 @@
+builtins.zipAttrsWith (_: 1) [ { foo = 1; } ]
diff --git a/tests/functional/lang/eval-fail-zipAttrsWith-4.err.exp b/tests/functional/lang/eval-fail-zipAttrsWith-4.err.exp
new file mode 100644
index 000000000000..034d84254198
--- /dev/null
+++ b/tests/functional/lang/eval-fail-zipAttrsWith-4.err.exp
@@ -0,0 +1,22 @@
+error:
+       … while evaluating the attribute 'foo'
+
+       … from call site
+         at /pwd/lang/eval-fail-zipAttrsWith-4.nix:1:24:
+            1| builtins.zipAttrsWith (a: b: a + b) [
+             |                        ^
+            2|   { foo = 1; }
+
+       … while calling anonymous lambda
+         at /pwd/lang/eval-fail-zipAttrsWith-4.nix:1:27:
+            1| builtins.zipAttrsWith (a: b: a + b) [
+             |                           ^
+            2|   { foo = 1; }
+
+       … while evaluating a path segment
+         at /pwd/lang/eval-fail-zipAttrsWith-4.nix:1:34:
+            1| builtins.zipAttrsWith (a: b: a + b) [
+             |                                  ^
+            2|   { foo = 1; }
+
+       error: cannot coerce a list to a string: [ 1 2 ]
diff --git a/tests/functional/lang/eval-fail-zipAttrsWith-4.nix b/tests/functional/lang/eval-fail-zipAttrsWith-4.nix
new file mode 100644
index 000000000000..dbe63d0b564d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-zipAttrsWith-4.nix
@@ -0,0 +1,4 @@
+builtins.zipAttrsWith (a: b: a + b) [
+  { foo = 1; }
+  { foo = 2; }
+]
diff --git a/tests/functional/lang/eval-okay-break.exp b/tests/functional/lang/eval-okay-break.exp
new file mode 100644
index 000000000000..00750edc07d6
--- /dev/null
+++ b/tests/functional/lang/eval-okay-break.exp
@@ -0,0 +1 @@
+3
diff --git a/tests/functional/lang/eval-okay-break.nix b/tests/functional/lang/eval-okay-break.nix
new file mode 100644
index 000000000000..fa9c3a0f11b4
--- /dev/null
+++ b/tests/functional/lang/eval-okay-break.nix
@@ -0,0 +1 @@
+builtins.break (1 + 2)
diff --git a/tests/functional/lang/eval-okay-derivation-legacy.err.exp b/tests/functional/lang/eval-okay-derivation-legacy.err.exp
index 94f0854dd2c9..fb0817fd5483 100644
--- a/tests/functional/lang/eval-okay-derivation-legacy.err.exp
+++ b/tests/functional/lang/eval-okay-derivation-legacy.err.exp
@@ -1,6 +1,54 @@
-warning: In a derivation named 'eval-okay-derivation-legacy', 'structuredAttrs' disables the effect of the derivation attribute 'allowedReferences'; use 'outputChecks.<output>.allowedReferences' instead
-warning: In a derivation named 'eval-okay-derivation-legacy', 'structuredAttrs' disables the effect of the derivation attribute 'allowedRequisites'; use 'outputChecks.<output>.allowedRequisites' instead
-warning: In a derivation named 'eval-okay-derivation-legacy', 'structuredAttrs' disables the effect of the derivation attribute 'disallowedReferences'; use 'outputChecks.<output>.disallowedReferences' instead
-warning: In a derivation named 'eval-okay-derivation-legacy', 'structuredAttrs' disables the effect of the derivation attribute 'disallowedRequisites'; use 'outputChecks.<output>.disallowedRequisites' instead
-warning: In a derivation named 'eval-okay-derivation-legacy', 'structuredAttrs' disables the effect of the derivation attribute 'maxClosureSize'; use 'outputChecks.<output>.maxClosureSize' instead
-warning: In a derivation named 'eval-okay-derivation-legacy', 'structuredAttrs' disables the effect of the derivation attribute 'maxSize'; use 'outputChecks.<output>.maxSize' instead
+warning:
+         … while evaluating derivation 'eval-okay-derivation-legacy'
+
+         warning: 'structuredAttrs' disables the effect of the derivation attribute 'allowedReferences'; use 'outputChecks.<output>.allowedReferences' instead
+         at /pwd/lang/eval-okay-derivation-legacy.nix:6:3:
+              5|   __structuredAttrs = true;
+              6|   allowedReferences = [ ];
+               |   ^
+              7|   disallowedReferences = [ ];
+warning:
+         … while evaluating derivation 'eval-okay-derivation-legacy'
+
+         warning: 'structuredAttrs' disables the effect of the derivation attribute 'allowedRequisites'; use 'outputChecks.<output>.allowedRequisites' instead
+         at /pwd/lang/eval-okay-derivation-legacy.nix:8:3:
+              7|   disallowedReferences = [ ];
+              8|   allowedRequisites = [ ];
+               |   ^
+              9|   disallowedRequisites = [ ];
+warning:
+         … while evaluating derivation 'eval-okay-derivation-legacy'
+
+         warning: 'structuredAttrs' disables the effect of the derivation attribute 'disallowedReferences'; use 'outputChecks.<output>.disallowedReferences' instead
+         at /pwd/lang/eval-okay-derivation-legacy.nix:7:3:
+              6|   allowedReferences = [ ];
+              7|   disallowedReferences = [ ];
+               |   ^
+              8|   allowedRequisites = [ ];
+warning:
+         … while evaluating derivation 'eval-okay-derivation-legacy'
+
+         warning: 'structuredAttrs' disables the effect of the derivation attribute 'disallowedRequisites'; use 'outputChecks.<output>.disallowedRequisites' instead
+         at /pwd/lang/eval-okay-derivation-legacy.nix:9:3:
+              8|   allowedRequisites = [ ];
+              9|   disallowedRequisites = [ ];
+               |   ^
+             10|   maxSize = 1234;
+warning:
+         … while evaluating derivation 'eval-okay-derivation-legacy'
+
+         warning: 'structuredAttrs' disables the effect of the derivation attribute 'maxClosureSize'; use 'outputChecks.<output>.maxClosureSize' instead
+         at /pwd/lang/eval-okay-derivation-legacy.nix:11:3:
+             10|   maxSize = 1234;
+             11|   maxClosureSize = 12345;
+               |   ^
+             12| }).out
+warning:
+         … while evaluating derivation 'eval-okay-derivation-legacy'
+
+         warning: 'structuredAttrs' disables the effect of the derivation attribute 'maxSize'; use 'outputChecks.<output>.maxSize' instead
+         at /pwd/lang/eval-okay-derivation-legacy.nix:10:3:
+              9|   disallowedRequisites = [ ];
+             10|   maxSize = 1234;
+               |   ^
+             11|   maxClosureSize = 12345;
diff --git a/tests/functional/lang/eval-okay-pathexists.nix b/tests/functional/lang/eval-okay-pathexists.nix
index 022b22feae53..a5a3875da173 100644
--- a/tests/functional/lang/eval-okay-pathexists.nix
+++ b/tests/functional/lang/eval-okay-pathexists.nix
@@ -32,3 +32,6 @@ builtins.pathExists (./lib.nix)
 && builtins.pathExists ./symlink-resolution/foo/overlays/overlay.nix
 && builtins.pathExists ./symlink-resolution/broken
 && builtins.pathExists (builtins.toString ./symlink-resolution/foo/overlays + "/.")
+&& builtins.pathExists "${builtins.storeDir}"
+&& !builtins.pathExists "${builtins.storeDir}/foo"
+&& !builtins.pathExists "${builtins.storeDir}/foo/bar"
diff --git a/tests/functional/linux-sandbox.sh b/tests/functional/linux-sandbox.sh
index c3ddf6ce65f7..d2c64df2f300 100755
--- a/tests/functional/linux-sandbox.sh
+++ b/tests/functional/linux-sandbox.sh
@@ -6,8 +6,6 @@ needLocalStore "the sandbox only runs on the builder side, so it makes no sense
 
 TODO_NixOS
 
-clearStore
-
 requireSandboxSupport
 requiresUnprivilegedUserNamespaces
 
@@ -19,9 +17,6 @@ if [[ ! $SHELL =~ /nix/store ]]; then skipTest "Shell is not from Nix store"; fi
 # An alias to automatically bind-mount the $SHELL on nix-build invocations
 nix-sandbox-build () { nix-build --no-out-link --sandbox-paths /nix/store "$@"; }
 
-chmod -R u+w "$TEST_ROOT"/store0 || true
-rm -rf "$TEST_ROOT"/store0
-
 export NIX_STORE_DIR=/my/store
 export NIX_REMOTE=$TEST_ROOT/store0
 
@@ -41,7 +36,7 @@ nix-sandbox-build dependencies.nix --check
 # Test that sandboxed builds with --check and -K can move .check directory to store
 nix-sandbox-build check.nix -A nondeterministic
 
-# `100 + 4` means non-determinstic, see doc/manual/source/command-ref/status-build-failure.md
+# `100 + 4` means non-deterministic, see doc/manual/source/command-ref/status-build-failure.md
 expectStderr 104 nix-sandbox-build check.nix -A nondeterministic --check -K > "$TEST_ROOT"/log
 grepQuietInverse 'error: renaming' "$TEST_ROOT"/log
 grepQuiet 'may not be deterministic' "$TEST_ROOT"/log
@@ -96,3 +91,58 @@ nix-sandbox-build symlink-derivation.nix -A test_sandbox_paths \
     --option extra-sandbox-paths "/dir=$TEST_ROOT" \
     --option extra-sandbox-paths "/symlinkDir=$symlinkDir" \
     --option extra-sandbox-paths "/symlink=$symlinkcert"
+
+invalidLeafPaths=(
+    "/foo/.."
+    "/foo/."
+    "/.."
+    "/."
+)
+
+for badPath in "${invalidLeafPaths[@]}"; do
+    expectStderr 1 nix-sandbox-build simple-failing.nix --option extra-sandbox-paths "$badPath=$cert" |
+        grepQuiet "invalid filename"
+done
+
+badPaths=(
+    "/../escape"
+    "/foo/../../escape"
+    "//foo///.//../../escape"
+    "/./../escape"
+    "///.//./../escape//"
+    "/a/b/../../../escape"
+)
+
+sources=(
+    "$cert"
+    "$symlinkcert"
+    "$symlinkDir"
+    "$TEST_ROOT"
+)
+
+for badPath in "${badPaths[@]}"; do
+    for source in "${sources[@]}"; do
+        expectStderr 1 nix-sandbox-build simple-failing.nix --option extra-sandbox-paths "$badPath=$source" |
+            grepQuiet "escapes the chroot"
+    done
+done
+
+# Trailing slash in the destination should fail for non-directory files.
+expectStderr 1 nix-sandbox-build simple-failing.nix --option extra-sandbox-paths "/a/=$cert" | grepQuiet "error: creating regular file.*: No such file or directory"
+expectStderr 1 nix-sandbox-build simple-failing.nix --option extra-sandbox-paths "/a/=$symlinkcert" | grepQuiet "error: creating symlink.*: No such file or directory"
+
+# Escaping to chroot directory.
+expectStderr 1 nix-sandbox-build simple-failing.nix --option extra-sandbox-paths "/foo/../=$cert" | grepQuiet "error: creating regular file.*: No such file or directory"
+
+# Can't overmount the chroot.
+expectStderr 1 nix-sandbox-build simple-failing.nix --option extra-sandbox-paths "/foo/../=$TEST_ROOT" | grepQuiet "error: .*escapes the chroot"
+
+# The build should fail, not the mounting.
+expectStderr 100 nix-sandbox-build simple-failing.nix --option extra-sandbox-paths "/a/=$TEST_ROOT"
+expectStderr 100 nix-sandbox-build simple-failing.nix --option extra-sandbox-paths "/a/=$TEST_ROOT/"
+
+nix-sandbox-build symlink-derivation.nix -A test_sandbox_paths \
+    --option extra-sandbox-paths "/./file=$cert" \
+    --option extra-sandbox-paths "//dir/=$TEST_ROOT/" \
+    --option extra-sandbox-paths "///./symlinkDir=$symlinkDir" \
+    --option extra-sandbox-paths "/symlink=$symlinkcert"
diff --git a/tests/functional/logging.sh b/tests/functional/logging.sh
index 600fce43e940..b932752458a2 100755
--- a/tests/functional/logging.sh
+++ b/tests/functional/logging.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-
 path=$(nix-build dependencies.nix --no-out-link)
 
 # Test nix-store -l.
@@ -19,11 +17,11 @@ nix-build dependencies.nix --no-out-link --compress-build-log
 [ "$(nix-store -l "$path")" = FOO ]
 
 # test whether empty logs work fine with `nix log`.
-builder="$(realpath "$(mktemp)")"
+builder=$TEST_ROOT/builder
 echo -e "#!/bin/sh\nmkdir \$out" > "$builder"
 outp="$(nix-build -E \
     'with import '"${config_nix}"'; mkDerivation { name = "fnord"; builder = '"$builder"'; }' \
-    --out-link "$(mktemp -d)/result")"
+    --out-link "$TEST_ROOT/result")"
 
 test -d "$outp"
 
diff --git a/tests/functional/make-content-addressed.nix b/tests/functional/make-content-addressed.nix
new file mode 100644
index 000000000000..599ad7b0990f
--- /dev/null
+++ b/tests/functional/make-content-addressed.nix
@@ -0,0 +1,25 @@
+{ zeroSelfReference }:
+
+with import ./config.nix;
+
+mkDerivation {
+  name = "foo";
+  buildCommand = ''
+    mkdir $out
+    ${
+      if zeroSelfReference then
+        ''
+          {
+            printf "hello $NIX_STORE/"
+            head -c 32 /dev/zero
+            printf -- '-foo\n'
+          } > $out/self-ref
+        ''
+      else
+        ''
+          echo "hello $out" > $out/self-ref
+        ''
+    }
+      echo "hello $out" > $out/always-self-ref
+  '';
+}
diff --git a/tests/functional/make-content-addressed.sh b/tests/functional/make-content-addressed.sh
new file mode 100644
index 000000000000..72493555183a
--- /dev/null
+++ b/tests/functional/make-content-addressed.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+requireDaemonNewerThan "2.35"
+
+TODO_NixOS
+
+enableFeatures "ca-derivations"
+
+restartDaemon
+
+# Build a floating output with a self-reference.
+outPath1=$(nix build --print-out-paths --no-link --impure --file ./make-content-addressed.nix --arg zeroSelfReference false)
+
+# Make it content-addressed.
+outPathCA=$(nix store make-content-addressed --json "$outPath1" | jq -r '.rewrites | map(.) | .[]')
+[[ $outPath1 != "$outPathCA" ]]
+
+# Check that the result is content-addressed.
+nix path-info --json --json-format 2 "$outPathCA" | jq -e 'all(.info[].ca.method; . == "nar")'
+
+# Verify the CA-rewritten path.
+nix store verify "$outPathCA"
+
+# Building the same derivation but as a CA derivation should produce the same store path.
+outPathCA2=$(NIX_TESTS_CA_BY_DEFAULT=1 nix build --print-out-paths --no-link --impure --file ./make-content-addressed.nix --arg zeroSelfReference false)
+[[ $outPathCA == "$outPathCA2" ]]
+
+# Build the same derivation except that one self-reference is zeroed out.
+outPathZero=$(nix build --print-out-paths --no-link --impure --file ./make-content-addressed.nix --arg zeroSelfReference true)
+
+# Make it content-addressed as well.
+outPathZeroCA=$(nix store make-content-addressed --json "$outPathZero" | jq -r '.rewrites | map(.) | .[]')
+
+# The resulting paths should be different, since HashModuloSink hashes the positions of self-references.
+# https://github.com/NixOS/nix/issues/15837
+[[ $outPathCA != "$outPathZeroCA" ]]
+
+outPathZeroCA2=$(NIX_TESTS_CA_BY_DEFAULT=1 nix build --print-out-paths --no-link --impure --file ./make-content-addressed.nix --arg zeroSelfReference true)
+[[ $outPathZeroCA == "$outPathZeroCA2" ]]
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index e2668c716ed8..af1c7b9eaca7 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -51,134 +51,138 @@ suites = [
     'name' : 'main',
     'deps' : [],
     'tests' : [
-      'test-infra.sh',
-      'gc.sh',
-      'nix-collect-garbage-d.sh',
-      'remote-store.sh',
-      'legacy-ssh-store.sh',
-      'lang.sh',
-      'lang-gc.sh',
-      'characterisation-test-infra.sh',
-      'experimental-features.sh',
-      'fetchMercurial.sh',
-      'gc-auto.sh',
-      'user-envs.sh',
-      'user-envs-migration.sh',
-      'cli-characterisation.sh',
+      'absolute-path-literals.sh',
+      'add.sh',
+      'add-scanning.sh',
+      'bash-profile.sh',
+      'binary-cache-build-remote.sh',
+      'binary-cache-compression.sh',
       'binary-cache.sh',
-      'multiple-outputs.sh',
-      'nix-build.sh',
-      'gc-concurrent.sh',
-      'repair.sh',
-      'fixed.sh',
-      'export-graph.sh',
-      'timeout.sh',
-      'fetchGitRefs.sh',
-      'gc-runtime.sh',
-      'tarball.sh',
-      'fetchGit.sh',
-      'fetchGitShallow.sh',
-      'fetchurl.sh',
-      'fetchPath.sh',
-      'fetchTree-file.sh',
-      'simple.sh',
-      'referrers.sh',
-      'optimise-store.sh',
-      'substitute-with-invalid-ca.sh',
-      'signing.sh',
-      'hash-convert.sh',
-      'hash-path.sh',
-      'gc-non-blocking.sh',
-      'gc-closure.sh',
-      'check.sh',
-      'nix-shell.sh',
-      'check-refs.sh',
-      'build-remote-input-addressed.sh',
-      'secure-drv-outputs.sh',
-      'restricted.sh',
-      'fetchGitSubmodules.sh',
-      'fetchGitVerification.sh',
-      'readfile-context.sh',
-      'nix-channel.sh',
-      'recursive.sh',
-      'dependencies.sh',
-      'check-reqs.sh',
+      'build-cores.sh',
+      'build-delete.sh',
+      'build-dry.sh',
       'build-remote-content-addressed-fixed.sh',
       'build-remote-content-addressed-floating.sh',
+      'build-remote-input-addressed.sh',
+      'build-remote-trustless-should-fail-0.sh',
       'build-remote-trustless-should-pass-0.sh',
       'build-remote-trustless-should-pass-1.sh',
       'build-remote-trustless-should-pass-2.sh',
       'build-remote-trustless-should-pass-3.sh',
-      'build-remote-trustless-should-fail-0.sh',
       'build-remote-with-mounted-ssh-ng.sh',
-      'nar-access.sh',
-      'impure-eval.sh',
-      'pure-eval.sh',
+      'build.sh',
+      'ca-old-daemon.sh',
+      'characterisation-test-infra.sh',
+      'check-refs.sh',
+      'check-reqs.sh',
+      'check.sh',
+      'chroot-store.sh',
+      'cli-characterisation.sh',
+      'completions.sh',
+      'compression-levels.sh',
+      'config.sh',
+      'db-migration.sh',
+      'delete-no-keep.sh',
+      'dependencies.sh',
+      'derivation-advanced-attributes.sh',
+      'derivation-json.sh',
+      'dump-db.sh',
+      'eval-store.sh',
       'eval.sh',
-      'short-path-literals.sh',
-      'absolute-path-literals.sh',
-      'no-url-literals.sh',
-      'repl.sh',
-      'binary-cache-build-remote.sh',
-      'search.sh',
-      'logging.sh',
+      'experimental-features.sh',
+      'export-graph.sh',
       'export.sh',
-      'config.sh',
-      'add.sh',
-      'chroot-store.sh',
+      'external-builders.sh',
+      'extra-sandbox-profile.sh',
+      'fetchClosure.sh',
+      'fetchGit.sh',
+      'fetchGitRefs.sh',
+      'fetchGitShallow.sh',
+      'fetchGitSubmodules.sh',
+      'fetchGitVerification.sh',
+      'fetchMercurial.sh',
+      'fetchPath.sh',
+      'fetchTree-file.sh',
+      'fetchurl.sh',
       'filter-source.sh',
-      'misc.sh',
-      'dump-db.sh',
-      'linux-sandbox.sh',
-      'supplementary-groups.sh',
-      'build-dry.sh',
-      'structured-attrs.sh',
-      'shell.sh',
-      'brotli.sh',
-      'zstd.sh',
-      'compression-levels.sh',
-      'nix-copy-ssh.sh',
-      'nix-copy-ssh-ng.sh',
-      'post-hook.sh',
-      'function-trace.sh',
-      'formatter.sh',
+      'fixed-slow-vs-bad.sh',
+      'fixed.sh',
       'flamegraph-profiler.sh',
-      'eval-store.sh',
-      'why-depends.sh',
-      'derivation-json.sh',
-      'derivation-advanced-attributes.sh',
+      'formatter.sh',
+      'function-trace.sh',
+      'gc-auto.sh',
+      'gc-closure.sh',
+      'gc-concurrent.sh',
+      'gc-non-blocking.sh',
+      'gc-runtime.sh',
+      'gc.sh',
+      'hash-convert.sh',
+      'hash-path.sh',
+      'help.sh',
       'import-from-derivation.sh',
-      'nix_path.sh',
+      'impure-derivations.sh',
+      'impure-env.sh',
+      'impure-eval.sh',
+      'json.sh',
+      'lang-gc.sh',
+      'lang.sh',
+      'legacy-ssh-store.sh',
+      'linux-sandbox.sh',
+      'logging.sh',
+      'make-content-addressed.sh',
+      'misc.sh',
+      'multiple-outputs-substitute-failure.sh',
+      'multiple-outputs.sh',
+      'nar-access.sh',
       'nars.sh',
-      'placeholders.sh',
-      'ssh-relay.sh',
-      'build.sh',
-      'build-cores.sh',
-      'build-delete.sh',
+      'nested-sandboxing.sh',
+      'nix-build.sh',
+      'nix-channel.sh',
+      'nix-collect-garbage-d.sh',
+      'nix-copy-ssh-ng.sh',
+      'nix-copy-ssh.sh',
+      'nix-profile.sh',
+      'nix-shell.sh',
+      'nix_path.sh',
+      'no-url-literals.sh',
+      'optimise-store.sh',
       'output-normalization.sh',
-      'selfref-gc.sh',
-      'db-migration.sh',
-      'bash-profile.sh',
       'pass-as-file.sh',
-      'nix-profile.sh',
-      'suggestions.sh',
-      'store-info.sh',
-      'store-print-env.sh',
-      'fetchClosure.sh',
-      'completions.sh',
-      'impure-derivations.sh',
       'path-from-hash-part.sh',
       'path-info.sh',
-      'json.sh',
-      'toString-path.sh',
+      'placeholders.sh',
+      'post-hook.sh',
+      'pure-eval.sh',
       'read-only-store.sh',
-      'nested-sandboxing.sh',
-      'impure-env.sh',
-      'debugger.sh',
-      'extra-sandbox-profile.sh',
-      'help.sh',
+      'readfile-context.sh',
+      'recursive.sh',
+      'referrers.sh',
+      'remote-store.sh',
+      'repair.sh',
+      'repl.sh',
+      'restricted.sh',
+      'search.sh',
+      'secure-drv-outputs.sh',
+      'selfref-gc.sh',
+      'shell.sh',
+      'short-path-literals.sh',
+      'signing.sh',
+      'simple.sh',
+      'ssh-relay.sh',
+      'store-info.sh',
+      'store-print-env.sh',
+      'structured-attrs.sh',
+      'substitute-with-invalid-ca.sh',
+      'suggestions.sh',
+      'supplementary-groups.sh',
       'symlinks.sh',
-      'external-builders.sh',
+      'tarball.sh',
+      'test-infra.sh',
+      'timeout.sh',
+      'toString-path.sh',
+      'user-envs-migration.sh',
+      'user-envs.sh',
+      'why-depends.sh',
     ],
     'workdir' : meson.current_source_dir(),
   },
@@ -206,11 +210,15 @@ nix_expr = dependency('nix-expr', required : false)
 if nix_expr.found() and get_option('default_library') != 'static'
   add_languages('cpp')
   subdir('plugins')
+  plugin_test_deps = [ libplugintest ]
+  if get_option('plugin-c-api') and not host_machine.system().startswith(
+    'windows',
+  )
+    plugin_test_deps += [ libplugintest_dlsym ]
+  endif
   suites += {
     'name' : 'plugins',
-    'deps' : [
-      libplugintest,
-    ],
+    'deps' : plugin_test_deps,
     'tests' : [
       'plugins.sh',
     ],
diff --git a/tests/functional/meson.options b/tests/functional/meson.options
new file mode 100644
index 000000000000..1965af61a8c6
--- /dev/null
+++ b/tests/functional/meson.options
@@ -0,0 +1,6 @@
+option(
+  'plugin-c-api',
+  type : 'boolean',
+  value : false,
+  description : 'Build plugin tests that expect the nix executable to export the public C API',
+)
diff --git a/tests/functional/multiple-outputs-substitute-failure.sh b/tests/functional/multiple-outputs-substitute-failure.sh
new file mode 100755
index 000000000000..fd4a7ec50b15
--- /dev/null
+++ b/tests/functional/multiple-outputs-substitute-failure.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+# See https://github.com/NixOS/nix/issues/15916
+
+source common.sh
+
+TODO_NixOS # Requires substituting from a local binary cache, enable when we sign paths in NixOS tests
+needLocalStore "'--no-require-sigs' can’t be used with the daemon"
+
+BINARY_CACHE=file://$cacheDir
+
+readarray -t outPaths < <(nix build -f multiple-outputs.nix 'independent^*' --no-link --print-out-paths)
+[[ ${#outPaths[@]} -eq 2 ]]
+nix copy --to "$BINARY_CACHE" "${outPaths[@]}"
+for p in "${outPaths[@]}"; do
+    [[ $p == *-second ]] && secondOut=$p
+done
+
+# Corrupt the second output, so that the substitution partially succeeds.
+secondNarInfoFile="$cacheDir/$(basename "$secondOut" | cut -c1-32).narinfo"
+sed -i 's|^NarHash:.*|NarHash: sha256:0000000000000000000000000000000000000000000000000000|' "$secondNarInfoFile"
+
+clearStore
+clearCacheCache
+
+# Note that using "^*" matters here. We want all wanted outputs for the same goal.
+expect 1 nix build -j 0 -f multiple-outputs.nix "independent^*" --no-link \
+    --substituters "$BINARY_CACHE" --no-require-sigs --substitute 2>&1 | grepQuiet "hash mismatch"
diff --git a/tests/functional/multiple-outputs.sh b/tests/functional/multiple-outputs.sh
index f703fb02be63..0c7e922a0915 100755
--- a/tests/functional/multiple-outputs.sh
+++ b/tests/functional/multiple-outputs.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStoreIfPossible
-
 rm -f "$TEST_ROOT"/result*
 
 # Placeholder strings are opaque, so cannot do this check for floating
@@ -96,6 +94,13 @@ if nix-build multiple-outputs.nix -A cyclic --no-out-link; then
     exit 1
 fi
 
+# TODO inspect why this doesn't work with floating content-addressing
+# derivations.
+if [[ -z "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
+    expect 1 nix build -f multiple-outputs.nix invalid-output-name-1 2>&1 | grep 'contains illegal character'
+    expect 1 nix build -f multiple-outputs.nix invalid-output-name-2 2>&1 | grep 'contains illegal character'
+fi
+
 # Do a GC. This should leave an empty store.
 echo "collecting garbage..."
 rm "$TEST_ROOT"/result*
@@ -103,10 +108,3 @@ nix-store --gc --keep-derivations --keep-outputs
 nix-store --gc --print-roots
 rm -rf "$NIX_STORE_DIR"/.links
 rmdir "$NIX_STORE_DIR"
-
-# TODO inspect why this doesn't work with floating content-addressing
-# derivations.
-if [[ -z "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
-    expect 1 nix build -f multiple-outputs.nix invalid-output-name-1 2>&1 | grep 'contains illegal character'
-    expect 1 nix build -f multiple-outputs.nix invalid-output-name-2 2>&1 | grep 'contains illegal character'
-fi
diff --git a/tests/functional/nar-access.sh b/tests/functional/nar-access.sh
index cd419b4eefc8..f15a56d68867 100755
--- a/tests/functional/nar-access.sh
+++ b/tests/functional/nar-access.sh
@@ -37,24 +37,120 @@ cp -r "$storePath" "$invalidPath"
 expect 1 nix store cat "$invalidPath/foo/baz"
 
 # Test --json.
+
+# Shallow listing of root (no --recursive)
 diff -u \
     <(nix nar ls --json "$narFile" / | jq -S) \
-    <(echo '{"type":"directory","entries":{"foo":{},"foo-x":{},"qux":{},"zyx":{}}}' | jq -S)
+    <(jq -S <<'EOF'
+{
+  "type": "directory",
+  "entries": {
+    "foo": {},
+    "foo-x": {},
+    "qux": {},
+    "zyx": {}
+  }
+}
+EOF
+    )
+
+# Recursive listing of /foo from NAR (includes narOffset)
 diff -u \
     <(nix nar ls --json -R "$narFile" /foo | jq -S) \
-    <(echo '{"type":"directory","entries":{"bar":{"type":"regular","size":0,"narOffset":368},"baz":{"type":"regular","size":0,"narOffset":552},"data":{"type":"regular","size":58,"narOffset":736}}}' | jq -S)
+    <(jq -S <<'EOF'
+{
+  "type": "directory",
+  "entries": {
+    "bar": {
+      "type": "regular",
+      "executable": false,
+      "size": 0,
+      "narOffset": 368
+    },
+    "baz": {
+      "type": "regular",
+      "executable": false,
+      "size": 0,
+      "narOffset": 552
+    },
+    "data": {
+      "type": "regular",
+      "executable": false,
+      "size": 58,
+      "narOffset": 736
+    }
+  }
+}
+EOF
+    )
+
+# Single file from NAR
 diff -u \
     <(nix nar ls --json -R "$narFile" /foo/bar | jq -S) \
-    <(echo '{"type":"regular","size":0,"narOffset":368}' | jq -S)
+    <(jq -S <<'EOF'
+{
+  "type": "regular",
+  "executable": false,
+  "size": 0,
+  "narOffset": 368
+}
+EOF
+    )
+
+# Shallow listing from store
 diff -u \
     <(nix store ls --json "$storePath" | jq -S) \
-    <(echo '{"type":"directory","entries":{"foo":{},"foo-x":{},"qux":{},"zyx":{}}}' | jq -S)
+    <(jq -S <<'EOF'
+{
+  "type": "directory",
+  "entries": {
+    "foo": {},
+    "foo-x": {},
+    "qux": {},
+    "zyx": {}
+  }
+}
+EOF
+    )
+
+# Recursive listing from store (no narOffset)
 diff -u \
     <(nix store ls --json -R "$storePath/foo" | jq -S) \
-    <(echo '{"type":"directory","entries":{"bar":{"type":"regular","size":0},"baz":{"type":"regular","size":0},"data":{"type":"regular","size":58}}}' | jq -S)
+    <(jq -S <<'EOF'
+{
+  "type": "directory",
+  "entries": {
+    "bar": {
+      "type": "regular",
+      "executable": false,
+      "size": 0
+    },
+    "baz": {
+      "type": "regular",
+      "executable": false,
+      "size": 0
+    },
+    "data": {
+      "type": "regular",
+      "executable": false,
+      "size": 58
+    }
+  }
+}
+EOF
+    )
+
+# Single file from store
 diff -u \
-    <(nix store ls --json -R "$storePath/foo/bar"| jq -S) \
-    <(echo '{"type":"regular","size":0}' | jq -S)
+    <(nix store ls --json -R "$storePath/foo/bar" | jq -S) \
+    <(jq -S <<'EOF'
+{
+  "type": "regular",
+  "executable": false,
+  "size": 0
+}
+EOF
+    )
 
 # Test missing files.
 expect 1 nix store ls --json -R "$storePath/xyzzy" 2>&1 | grep 'does not exist'
diff --git a/tests/functional/nars.sh b/tests/functional/nars.sh
index 02ee66a14de2..331821326487 100755
--- a/tests/functional/nars.sh
+++ b/tests/functional/nars.sh
@@ -2,12 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
-
 # Check that NARs with duplicate directory entries are rejected.
-rm -rf "$TEST_ROOT/out"
 expectStderr 1 nix-store --restore "$TEST_ROOT/out" < duplicate.nar | grepQuiet "NAR directory is not sorted"
 
 # Check that nix-store --restore fails if the output already exists.
diff --git a/tests/functional/nested-sandboxing/runner.nix b/tests/functional/nested-sandboxing/runner.nix
index cc193844d93c..33eb5cc89105 100644
--- a/tests/functional/nested-sandboxing/runner.nix
+++ b/tests/functional/nested-sandboxing/runner.nix
@@ -6,6 +6,8 @@ mkDerivation {
   name = "nested-sandboxing";
   busybox = builtins.getEnv "busybox";
   EXTRA_SANDBOX = builtins.getEnv "EXTRA_SANDBOX";
+  TEST_SUITE_NAME = builtins.getEnv "TEST_SUITE_NAME";
+  TEST_NAME = builtins.getEnv "TEST_NAME";
   buildCommand = ''
     set -x
     set -eu -o pipefail
diff --git a/tests/functional/nix-build.sh b/tests/functional/nix-build.sh
index 33973c628524..03cae39784a6 100755
--- a/tests/functional/nix-build.sh
+++ b/tests/functional/nix-build.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStoreIfPossible
-
 outPath=$(nix-build dependencies.nix -o "$TEST_ROOT"/result)
 test "$(cat "$TEST_ROOT"/result/foobar)" = FOOBAR
 
diff --git a/tests/functional/nix-collect-garbage-d.sh b/tests/functional/nix-collect-garbage-d.sh
index 44de90711a41..ed12ff4d0452 100755
--- a/tests/functional/nix-collect-garbage-d.sh
+++ b/tests/functional/nix-collect-garbage-d.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-
 ## Test `nix-collect-garbage -d`
 
 # TODO make `nix-env` doesn't work with CA derivations, and make
diff --git a/tests/functional/nix-copy-ssh-common.sh b/tests/functional/nix-copy-ssh-common.sh
index 8154585af5c2..9e1d30bcf255 100644
--- a/tests/functional/nix-copy-ssh-common.sh
+++ b/tests/functional/nix-copy-ssh-common.sh
@@ -5,9 +5,6 @@ shift
 
 TODO_NixOS
 
-clearStore
-clearCache
-
 mkdir -p "$TEST_ROOT"/stores
 
 # Create path to copy back and forth
diff --git a/tests/functional/nix-copy-ssh-ng.sh b/tests/functional/nix-copy-ssh-ng.sh
index 1af6c4fb069d..af7e1f4fe413 100755
--- a/tests/functional/nix-copy-ssh-ng.sh
+++ b/tests/functional/nix-copy-ssh-ng.sh
@@ -6,9 +6,6 @@ source nix-copy-ssh-common.sh "ssh-ng"
 
 TODO_NixOS
 
-clearStore
-clearRemoteStore
-
 outPath=$(nix-build --no-out-link dependencies.nix)
 
 nix store info --store "$remoteStore"
diff --git a/tests/functional/nix-profile.sh b/tests/functional/nix-profile.sh
index 7fdebe3559ac..556754a5338f 100755
--- a/tests/functional/nix-profile.sh
+++ b/tests/functional/nix-profile.sh
@@ -4,9 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-clearProfiles
-
 enableFeatures "ca-derivations"
 restartDaemon
 
@@ -225,6 +222,7 @@ diff -u <(
     nix --offline profile install "$flake2Dir" 2>&1 1> /dev/null \
         | grep -vE "^warning: " \
         | grep -vE "^error \(ignored\): " \
+        | grep -vE "^waiting for " \
         || true
 ) <(cat << EOF
 error: An existing package already provides the following file:
diff --git a/tests/functional/nix-shell.sh b/tests/functional/nix-shell.sh
index 263679347680..b17707e5d1e2 100755
--- a/tests/functional/nix-shell.sh
+++ b/tests/functional/nix-shell.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 if [[ -n ${NIX_TESTS_CA_BY_DEFAULT:-} ]]; then
     shellDotNix="$PWD/ca-shell.nix"
 else
@@ -35,7 +33,7 @@ output=$(nix-shell --pure --keep SELECTED_IMPURE_VAR "$shellDotNix" -A shellDrv
 [ "$output" = " - foo - bar - baz" ]
 
 # test NIX_BUILD_TOP
-testTmpDir=$(pwd)/nix-shell
+testTmpDir=$TEST_ROOT/tmp-dir
 mkdir -p "$testTmpDir"
 # shellcheck disable=SC2016
 output=$(TMPDIR="$testTmpDir" nix-shell --pure "$shellDotNix" -A shellDrv --run 'echo $NIX_BUILD_TOP')
@@ -88,7 +86,7 @@ sed -e "s|@ENV_PROG@|$(type -P env)|" shell.shebang.expr > "$TEST_ROOT"/shell.sh
 chmod a+rx "$TEST_ROOT"/shell.shebang.expr
 # Should fail due to expressions using relative path
  "$TEST_ROOT"/shell.shebang.expr bar && exit 1
-cp shell.nix "${config_nix}" "$TEST_ROOT"
+cp shell.nix "$TEST_ROOT"
 # Should succeed
 echo "cwd: $PWD"
 output=$("$TEST_ROOT"/shell.shebang.expr bar)
@@ -245,8 +243,6 @@ diff "$TEST_ROOT"/dev-env{,2}.json
 # Run tests involving `source <(nix print-dev-env)` in subshells to avoid modifying the current
 # environment.
 
-set -u
-
 # Ensure `source <(nix print-dev-env)` modifies the environment.
 (
     path=$PATH
diff --git a/tests/functional/optimise-store.sh b/tests/functional/optimise-store.sh
index 332a308c2088..a2b2d95aec09 100755
--- a/tests/functional/optimise-store.sh
+++ b/tests/functional/optimise-store.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 # shellcheck disable=SC2016
 outPath1=$(echo 'with import '"${config_nix}"'; mkDerivation { name = "foo1"; builder = builtins.toFile "builder" "mkdir $out; echo hello > $out/foo"; }' | nix-build - --no-out-link --auto-optimise-store)
 # shellcheck disable=SC2016
diff --git a/tests/functional/package.nix b/tests/functional/package.nix
index b3b314a50d70..cf5eea94f432 100644
--- a/tests/functional/package.nix
+++ b/tests/functional/package.nix
@@ -89,6 +89,10 @@ mkMesonDerivation (
       "--print-errorlogs"
     ];
 
+    mesonFlags = [
+      (lib.mesonBool "plugin-c-api" nix-cli.exportsPluginCApi)
+    ];
+
     doCheck = true;
 
     installPhase = ''
diff --git a/tests/functional/parallel.sh b/tests/functional/parallel.sh
index 4d0bf0f1be0c..73983fd22f06 100644
--- a/tests/functional/parallel.sh
+++ b/tests/functional/parallel.sh
@@ -7,10 +7,6 @@ echo "testing nix-build -j..."
 
 TODO_NixOS
 
-clearStore
-
-rm -f "$_NIX_TEST_SHARED".cur "$_NIX_TEST_SHARED".max
-
 outPath=$(nix-build -j10000 parallel.nix --no-out-link)
 
 echo "output path is $outPath"
diff --git a/tests/functional/pass-as-file.sh b/tests/functional/pass-as-file.sh
index 68f68b8cf1f0..faa1b601545c 100755
--- a/tests/functional/pass-as-file.sh
+++ b/tests/functional/pass-as-file.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 # shellcheck disable=SC2034
 outPath=$(nix-build --no-out-link -E "
 with import ${config_nix};
diff --git a/tests/functional/placeholders.sh b/tests/functional/placeholders.sh
index 5791d8006aeb..f06986ae26aa 100755
--- a/tests/functional/placeholders.sh
+++ b/tests/functional/placeholders.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 # shellcheck disable=SC2016
 nix-build --no-out-link -E '
   with import '"${config_nix}"';
diff --git a/tests/functional/plugins.sh b/tests/functional/plugins.sh
index b685a887814f..948ff1f77eb2 100755
--- a/tests/functional/plugins.sh
+++ b/tests/functional/plugins.sh
@@ -2,11 +2,26 @@
 
 source common.sh
 
-for ext in so dylib; do
-    plugin="${_NIX_TEST_BUILD_DIR}/plugins/libplugintest.$ext"
-    [[ -f "$plugin" ]] && break
-done
+findPlugin() {
+    local name="$1"
+
+    for ext in so dylib; do
+        local plugin="${_NIX_TEST_BUILD_DIR}/plugins/${name}.$ext"
+        if [[ -f "$plugin" ]]; then
+            printf '%s\n' "$plugin"
+            return 0
+        fi
+    done
+
+    return 1
+}
+
+plugin=$(findPlugin libplugintest)
 
 res=$(nix --option setting-set true --option plugin-files "$plugin" eval --expr builtins.anotherNull)
 
 [ "$res"x = "nullx" ]
+
+if plugin_dlsym=$(findPlugin libplugintest_dlsym); then
+    nix --option plugin-files "$plugin_dlsym" eval --expr 0 >/dev/null
+fi
diff --git a/tests/functional/plugins/meson.build b/tests/functional/plugins/meson.build
index ae66e3036ac3..4efc9b2a7e8f 100644
--- a/tests/functional/plugins/meson.build
+++ b/tests/functional/plugins/meson.build
@@ -1,3 +1,6 @@
+cpp = meson.get_compiler('cpp')
+dl_dep = cpp.find_library('dl', required : false)
+
 libplugintest = shared_module(
   'plugintest',
   'plugintest.cc',
@@ -6,3 +9,12 @@ libplugintest = shared_module(
   ],
   build_by_default : false,
 )
+
+if get_option('plugin-c-api') and not host_machine.system().startswith('windows')
+  libplugintest_dlsym = shared_module(
+    'plugintest_dlsym',
+    'plugintest_dlsym.cc',
+    dependencies : [ dl_dep ],
+    build_by_default : false,
+  )
+endif
diff --git a/tests/functional/plugins/plugintest_dlsym.cc b/tests/functional/plugins/plugintest_dlsym.cc
new file mode 100644
index 000000000000..1ad3527ad9ae
--- /dev/null
+++ b/tests/functional/plugins/plugintest_dlsym.cc
@@ -0,0 +1,50 @@
+#include <dlfcn.h>
+
+#include <cstdio>
+#include <cstdlib>
+
+namespace {
+
+void requireSymbol(void * handle, const char * symbol)
+{
+    // Clear any stale loader error. Without this, the dlerror() call below
+    // could return the error from the previous call to dlsym() if the next
+    // call to dlsym() returns a null pointer without setting an error.
+    (void) dlerror();
+
+    if (dlsym(handle, symbol))
+        return;
+
+    std::fprintf(stderr, "missing C API symbol %s", symbol);
+    if (auto * error = dlerror())
+        std::fprintf(stderr, ": %s", error);
+    std::fprintf(stderr, "\n");
+    std::abort();
+}
+
+} // namespace
+
+extern "C" void nix_plugin_entry()
+{
+    void * handle = dlopen(nullptr, RTLD_LAZY);
+    if (!handle) {
+        std::fprintf(stderr, "failed to access main executable symbols");
+        if (auto * error = dlerror())
+            std::fprintf(stderr, ": %s", error);
+        std::fprintf(stderr, "\n");
+        std::abort();
+    }
+
+    const char * symbols[] = {
+        "nix_libutil_init",
+        "nix_libstore_init",
+        "nix_fetchers_settings_new",
+        "nix_libexpr_init",
+        "nix_flake_settings_new",
+        "nix_init_plugins",
+    };
+
+    for (auto * symbol : symbols) {
+        requireSymbol(handle, symbol);
+    }
+}
diff --git a/tests/functional/post-hook.sh b/tests/functional/post-hook.sh
index b16d8ab8471d..5758317a26e5 100755
--- a/tests/functional/post-hook.sh
+++ b/tests/functional/post-hook.sh
@@ -4,11 +4,7 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-
-rm -f "$TEST_ROOT"/result
-
-export REMOTE_STORE=file:$TEST_ROOT/remote_store
+export REMOTE_STORE="file://$cacheDir"
 echo 'require-sigs = false' >> "$test_nix_conf"
 
 restartDaemon
diff --git a/tests/functional/pure-eval.sh b/tests/functional/pure-eval.sh
index 4af4bc0d244e..63a97eea4abc 100755
--- a/tests/functional/pure-eval.sh
+++ b/tests/functional/pure-eval.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 nix eval --expr 'assert 1 + 2 == 3; true'
 
 [[ $(nix eval --impure --expr 'builtins.readFile ./pure-eval.sh') =~ clearStore ]]
diff --git a/tests/functional/read-only-store.sh b/tests/functional/read-only-store.sh
index 8ccca2192af3..8bcf42cfc41d 100755
--- a/tests/functional/read-only-store.sh
+++ b/tests/functional/read-only-store.sh
@@ -4,7 +4,7 @@ source common.sh
 
 enableFeatures "read-only-local-store"
 
-needLocalStore "cannot open store read-only when daemon has already opened it writeable"
+needLocalStore "cannot open store read-only when daemon has already opened it writable"
 
 TODO_NixOS
 
diff --git a/tests/functional/readfile-context.sh b/tests/functional/readfile-context.sh
index effe483dc6ec..eb58356389ff 100755
--- a/tests/functional/readfile-context.sh
+++ b/tests/functional/readfile-context.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS # NixOS doesn't provide $NIX_STATE_DIR (and shouldn't)
 
-clearStore
-
 outPath=$(nix-build --no-out-link readfile-context.nix)
 
 # Set a GC root.
diff --git a/tests/functional/recursive.sh b/tests/functional/recursive.sh
index 9115aa77583d..605c6c5bb0eb 100755
--- a/tests/functional/recursive.sh
+++ b/tests/functional/recursive.sh
@@ -7,10 +7,6 @@ TODO_NixOS # can't enable a sandbox feature easily
 enableFeatures 'recursive-nix'
 restartDaemon
 
-clearStore
-
-rm -f "$TEST_ROOT"/result
-
 unreachable=$(nix store add-path ./recursive.sh)
 export unreachable
 
diff --git a/tests/functional/referrers.sh b/tests/functional/referrers.sh
index ae6b39ae115e..b36db4236806 100755
--- a/tests/functional/referrers.sh
+++ b/tests/functional/referrers.sh
@@ -6,8 +6,6 @@ needLocalStore "uses some low-level store manipulations that aren’t available
 
 TODO_NixOS
 
-clearStore
-
 max=500
 
 reference=$NIX_STORE_DIR/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-bla
diff --git a/tests/functional/remote-store.sh b/tests/functional/remote-store.sh
index f125ae137597..51711fdf01e0 100755
--- a/tests/functional/remote-store.sh
+++ b/tests/functional/remote-store.sh
@@ -4,8 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-
 # Ensure "fake ssh" remote store works just as legacy fake ssh would.
 nix --store ssh-ng://localhost?remote-store="$TEST_ROOT"/other-store doctor
 
diff --git a/tests/functional/repair.sh b/tests/functional/repair.sh
index a90bdcfd5b40..45949d04c744 100755
--- a/tests/functional/repair.sh
+++ b/tests/functional/repair.sh
@@ -6,8 +6,6 @@ needLocalStore "--repair needs a local store"
 
 TODO_NixOS
 
-clearStore
-
 path=$(nix-build dependencies.nix -o "$TEST_ROOT"/result)
 path2=$(nix-store -qR "$path" | grep input-2)
 
@@ -51,7 +49,7 @@ fi
 
 # Corrupt a path that has a substitute and check whether nix-store
 # --verify can fix it.
-clearCache
+clearBinaryCache
 
 nix copy --to file://"$cacheDir" "$path"
 
diff --git a/tests/functional/repl.sh b/tests/functional/repl.sh
index 9fc803d092e0..f3e9975a802d 100755
--- a/tests/functional/repl.sh
+++ b/tests/functional/repl.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 source common.sh
-source characterisation/framework.sh
+source common/characterisation/framework.sh
 
 testDir="$PWD"
 cd "$TEST_ROOT"
@@ -120,83 +120,6 @@ testReplResponseNoRegex () {
     testReplResponseGeneral --fixed-strings "$@"
 }
 
-# :a uses the newest version of a symbol
-#
-# shellcheck disable=SC2016
-testReplResponse '
-:a { a = "1"; }
-:a { a = "2"; }
-"result: ${a}"
-' "result: 2"
-
-# check dollar escaping https://github.com/NixOS/nix/issues/4909
-# note the escaped \,
-#    \\
-# because the second argument is a regex
-#
-# shellcheck disable=SC2016
-testReplResponseNoRegex '
-"$" + "{hi}"
-' '"\${hi}"'
-
-# Test inherit statement support (issue #15053)
-testReplResponseNoRegex '
-a = { b = 1; c = 2; }
-inherit (a) b
-b
-' '1'
-
-# inherit multiple attributes
-testReplResponseNoRegex '
-a = { x = 10; y = 20; }
-inherit (a) x y
-x + y
-' '30'
-
-# inherit from current scope
-testReplResponseNoRegex '
-foo = 42
-inherit foo
-foo
-' '42'
-
-# inherit with semicolon (also works)
-testReplResponseNoRegex '
-a = { z = 99; }
-inherit (a) z;
-z
-' '99'
-
-# multiple bindings on one line
-testReplResponseNoRegex '
-a = 1; b = 2;
-a + b
-' '3'
-
-# nested attribute path
-testReplResponseNoRegex '
-a.b.c = 1;
-a.b
-' '{ c = 1; }'
-
-# mixed bindings: inherit and assignment
-testReplResponseNoRegex '
-x = { p = 10; }
-inherit (x) p; q = 20;
-p + q
-' '30'
-
-# inherit error shows position (without spurious semicolon from retry)
-testReplResponse '
-a = { x = 1; }
-inherit (a) y
-y
-' "error: attribute 'y' missing
-.*at .string.:1:13:
-.*inherit (a) y
-.* \\^
-.*Did you mean x"
-
 testReplResponse '
 drvPath
 ' '".*-simple.drv"' \
@@ -222,33 +145,7 @@ foo + baz
 ' "3" \
     ./flake ./flake\#bar --experimental-features 'flakes'
 
-testReplResponse $'
-:a { a = 1; b = 2; longerName = 3; "with spaces" = 4; }
-' 'Added 4 variables.
-a, b, longerName, "with spaces"
-'
-
-cat <<EOF > attribute-set.nix
-{
-    a = 1;
-    b = 2;
-    longerName = 3;
-    "with spaces" = 4;
-}
-EOF
-testReplResponse '
-:l ./attribute-set.nix
-' 'Added 4 variables.
-a, b, longerName, "with spaces"
-'
-
-testReplResponseNoRegex $'
-:a builtins.foldl\' (x: y: x // y) {} (map (x: { ${builtins.toString x} = x; }) (builtins.genList (x: x) 23))
-' 'Added 23 variables.
-"0", "1", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "2", "20", "21", "22", "3", "4", "5", "6"
-... and 3 more; view with :ll'
-
-# Test the `:reload` mechansim with flakes:
+# Test the `:reload` mechanism with flakes:
 # - Eval `./flake#changingThing`
 # - Modify the flake
 # - Re-eval it
@@ -281,99 +178,47 @@ exec 3>&- # Close fifo
 wait $repl_pid # Wait for process to finish
 grep -q "afterChange" repl_output
 
-# Test recursive printing and formatting
-# Normal output should print attributes in lexicographical order non-recursively
-testReplResponseNoRegex '
-{ a = { b = 2; }; l = [ 1 2 3 ]; s = "string"; n = 1234; x = rec { y = { z = { inherit y; }; }; }; }
-' \
-'{
-  a = { ... };
-  l = [ ... ];
-  n = 1234;
-  s = "string";
-  x = { ... };
-}
-'
-
-# Same for lists, but order is preserved
-testReplResponseNoRegex '
-[ 42 1 "thingy" ({ a = 1; }) ([ 1 2 3 ]) ]
-' \
-'[
-  42
-  1
-  "thingy"
-  { ... }
-  [ ... ]
-]
-'
-
-# Same for let expressions
-testReplResponseNoRegex '
-let x = { y = { a = 1; }; inherit x; }; in x
-' \
-'{
-  x = «repeated»;
-  y = { ... };
-}
-'
-
-# The :p command should recursively print sets, but prevent infinite recursion
-testReplResponseNoRegex '
-:p { a = { b = 2; }; s = "string"; n = 1234; x = rec { y = { z = { inherit y; }; }; }; }
-' \
-'{
-  a = { b = 2; };
-  n = 1234;
-  s = "string";
-  x = {
-    y = {
-      z = {
-        y = «repeated»;
-      };
-    };
-  };
-}
-'
-
-# Same for lists
-testReplResponseNoRegex '
-:p [ 42 1 "thingy" (rec { a = 1; b = { inherit a; inherit b; }; }) ([ 1 2 3 ]) ]
-' \
-'[
-  42
-  1
-  "thingy"
-  {
-    a = 1;
-    b = {
-      a = 1;
-      b = «repeated»;
-    };
-  }
-  [
-    1
-    2
-    3
-  ]
-]
-'
-
-# Same for let expressions
-testReplResponseNoRegex '
-:p let x = { y = { a = 1; }; inherit x; }; in x
-' \
-'{
-  x = «repeated»;
-  y = { a = 1; };
-}
-'
+# Regression: `:reload` on a flake loaded from a *git* work tree must pick up
+# uncommitted changes. Guards against the per-process workdir-info cache
+# pinning the tree to the rev seen on first load.
+if [[ $(type -p git) ]]; then
+    createGitRepo gitflake
+    cat > gitflake/flake.nix <<EOF
+{ outputs = { self }: { changingThing = "beforeChange"; }; }
+EOF
+    git -C gitflake add flake.nix
+    git -C gitflake commit -m init
+
+    rm -f repl_fifo repl_output
+    mkfifo repl_fifo
+    touch repl_output
+    nix repl ./gitflake --experimental-features 'flakes' < repl_fifo >> repl_output 2>&1 &
+    repl_pid=$!
+    exec 3>repl_fifo
+    echo "changingThing" >&3
+    for _ in $(seq 1 1000); do
+        grep -q "beforeChange" repl_output && break
+        sleep 0.1
+    done
+    grep -q "beforeChange" repl_output || fail "git flake didn't load"
+    sed -i 's/beforeChange/afterChange/' gitflake/flake.nix
+    echo ":reload" >&3
+    echo "changingThing" >&3
+    echo "exit" >&3
+    exec 3>&-
+    wait $repl_pid
+    grep -q "afterChange" repl_output || fail ":reload didn't pick up git work tree change"
+fi
 
+# Regression: a failed `:lf` must not be remembered for `:reload`,
+# and an error in one loaded file must not drop later ones from the reload list.
 testReplResponseNoRegex '
-:ll
-' \
-'error: nothing has been loaded yet
-'
+:lf ./does-not-exist-flake
+:lf ./flake
+:r
+foo
+' '1' \
+    --experimental-features 'flakes'
 
 # Don't prompt for more input when getting unexpected EOF in imported files.
 testReplResponse "
@@ -407,8 +252,7 @@ stripFinalPrompt() {
     -e 's/[ \n]*$/\n/'
 }
 
-runRepl () {
-
+filterReplOutput () {
   # That is right, we are also filtering out the testdir _without underscores_.
   # This is crazy, but without it, GHA will fail to run the tests, showing paths
   # _with_ underscores in the set -x log, but _without_ underscores in the
@@ -417,10 +261,7 @@ runRepl () {
   local testDirNoUnderscores
   testDirNoUnderscores="${testDir//_/}"
 
-  _NIX_TEST_RAW_MARKDOWN=1 \
-  _NIX_TEST_REPL_ECHO=1 \
-  nix repl "$@" 2>&1 \
-    | stripColors \
+  stripColors \
     | tr -d '\0' \
     | stripEmptyLinesBeforePrompt \
     | stripFinalPrompt \
@@ -428,12 +269,22 @@ runRepl () {
       -e "s@$testDir@/path/to/tests/functional@g" \
       -e "s@$testDirNoUnderscores@/path/to/tests/functional@g" \
       -e "s@$nixVersion@<nix version>@g" \
-      -e "/Added [0-9]* variables/{s@ [0-9]* @ <number omitted> @;n;d}" \
-      -e '/\.\.\. and [0-9]* more; view with :ll/d' \
     | grep -vF $'warning: you don\'t have Internet access; disabling some network-dependent features' \
     ;
 }
 
+runRepl () {
+    _NIX_TEST_RAW_MARKDOWN=1 \
+    _NIX_TEST_REPL_ECHO=1 \
+    nix repl "$@" 2>&1 | filterReplOutput
+}
+
+runDebugRepl () {
+    _NIX_TEST_RAW_MARKDOWN=1 \
+    _NIX_TEST_REPL_ECHO=1 \
+    nix eval --file "$1" --debugger "${@:2}" 2>&1 | filterReplOutput
+}
+
 for test in $(cd "$testDir/repl"; echo *.in); do
     test="$(basename "$test" .in)"
     in="$testDir/repl/$test.in"
@@ -444,10 +295,39 @@ for test in $(cd "$testDir/repl"; echo *.in); do
       read -r -a flags < "$testDir/repl/$test.flags"
     fi
 
-    (cd "$testDir/repl"; set +x; runRepl "${flags[@]}" 2>&1) < "$in" > "$actual" || {
-        echo "FAIL: $test (exit code $?)" >&2
-        badExitCode=1
-    }
+    # Allow putting comments (lines starting with `# COM:`) in the test for
+    # documentation purposes. Regular comments are not skipped, since those are
+    # also interpreted by the repl.
+    inputWithoutComments=$(grep -Ev '^[[:space:]]*#[[:space:]]*COM:' "$in")
+
+    if [ -f "$testDir/repl/$test.in.debugexpr.nix" ]; then
+        if [[ "$test" =~ debugger-fail-.* ]]; then
+            expectedFail=1
+        elif [[ "$test" =~ debugger-okay-.* ]]; then
+            expectedFail=0
+        else
+            die "unexpected debugger test name: '$test', should be either debugger-okay-* or debugger-fail-*"
+        fi
+
+        set +e
+        (cd "$testDir/repl"; set +x; echo "$inputWithoutComments" | runDebugRepl "$testDir/repl/$test.in.debugexpr.nix" "${flags[@]}" 2>&1) > "$actual"
+        debuggerTestCode=$?
+        set -e
+
+        if ((expectedFail == 0 && debuggerTestCode != 0)); then
+            echo "test failed: $test (exit code $debuggerTestCode)" >&2
+            badExitCode=1
+        elif ((expectedFail == 1 && debuggerTestCode == 0)); then
+            echo "test failed: $test unexpectedly succeeded" >&2
+            badExitCode=1
+        fi
+    else
+        (cd "$testDir/repl"; set +x; echo "$inputWithoutComments" | runRepl "${flags[@]}" 2>&1) > "$actual" || {
+            echo "test failed: $test (exit code $?)" >&2
+            badExitCode=1
+        }
+    fi
+
     diffAndAcceptInner "$test" "$actual" "$expected"
 done
 
diff --git a/tests/functional/repl/add-lots-of-variables.expected b/tests/functional/repl/add-lots-of-variables.expected
new file mode 100644
index 000000000000..4ba282263b47
--- /dev/null
+++ b/tests/functional/repl/add-lots-of-variables.expected
@@ -0,0 +1,32 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> :a builtins.foldl' (x: y: x // y) {} (map (x: { ${builtins.toString x} = x; }) (builtins.genList (x: x) 23))
+Added 23 variables.
+"0", "1", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "2", "20", "21", "22", "3", "4", "5", "6"
+... and 3 more; view with :ll
+
+nix-repl> :ll
+0
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18
+19
+20
+21
+22
diff --git a/tests/functional/repl/add-lots-of-variables.in b/tests/functional/repl/add-lots-of-variables.in
new file mode 100644
index 000000000000..77796389dfdd
--- /dev/null
+++ b/tests/functional/repl/add-lots-of-variables.in
@@ -0,0 +1,2 @@
+:a builtins.foldl' (x: y: x // y) {} (map (x: { ${builtins.toString x} = x; }) (builtins.genList (x: x) 23))
+:ll
diff --git a/tests/functional/repl/add-overwritten-symbol-env.expected b/tests/functional/repl/add-overwritten-symbol-env.expected
new file mode 100644
index 000000000000..026b7cceb602
--- /dev/null
+++ b/tests/functional/repl/add-overwritten-symbol-env.expected
@@ -0,0 +1,13 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> :a { a = "1"; }
+Added 1 variables.
+a
+
+nix-repl> :a { a = "2"; }
+Added 1 variables.
+a
+
+nix-repl> "result: ${a}"
+"result: 2"
diff --git a/tests/functional/repl/add-overwritten-symbol-env.in b/tests/functional/repl/add-overwritten-symbol-env.in
new file mode 100644
index 000000000000..dbbf4967728d
--- /dev/null
+++ b/tests/functional/repl/add-overwritten-symbol-env.in
@@ -0,0 +1,4 @@
+# COM: :a uses the newest version of a symbol
+:a { a = "1"; }
+:a { a = "2"; }
+"result: ${a}"
diff --git a/tests/functional/repl/add-variable-with-spaces.expected b/tests/functional/repl/add-variable-with-spaces.expected
new file mode 100644
index 000000000000..dff5a0cbd2be
--- /dev/null
+++ b/tests/functional/repl/add-variable-with-spaces.expected
@@ -0,0 +1,12 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> :a { a = 1; b = 2; longerName = 3; "with spaces" = 4; }
+Added 4 variables.
+a, b, longerName, "with spaces"
+
+nix-repl> :reload
+
+nix-repl> :l ./attribute-set.nix
+Added 4 variables.
+a, b, longerName, "with spaces"
diff --git a/tests/functional/repl/add-variable-with-spaces.in b/tests/functional/repl/add-variable-with-spaces.in
new file mode 100644
index 000000000000..763a61901248
--- /dev/null
+++ b/tests/functional/repl/add-variable-with-spaces.in
@@ -0,0 +1,3 @@
+:a { a = 1; b = 2; longerName = 3; "with spaces" = 4; }
+:reload
+:l ./attribute-set.nix
diff --git a/tests/functional/repl/attribute-set.nix b/tests/functional/repl/attribute-set.nix
new file mode 100644
index 000000000000..7b2e71badd48
--- /dev/null
+++ b/tests/functional/repl/attribute-set.nix
@@ -0,0 +1,6 @@
+{
+  a = 1;
+  b = 2;
+  longerName = 3;
+  "with spaces" = 4;
+}
diff --git a/tests/functional/repl/debugger-fail-throw-env-1.expected b/tests/functional/repl/debugger-fail-throw-env-1.expected
new file mode 100644
index 000000000000..921395b8f928
--- /dev/null
+++ b/tests/functional/repl/debugger-fail-throw-env-1.expected
@@ -0,0 +1,35 @@
+error: oh snap
+
+Nix <nix version> debugger
+Type :? for help.
+
+nix-repl> :env
+Env level 0
+static: _ 
+
+Env level 1
+abort baseNameOf break builtins derivation derivationStrict dirOf false fetchGit fetchMercurial fetchTarball fetchTree fromTOML import isNull map null placeholder removeAttrs scopedImport throw toString true 
+
+nix-repl> :quit
+error:
+       … while evaluating the file '/path/to/tests/functional/repl/debugger-fail-throw-env-1.in.debugexpr.nix':
+
+       … from call site
+         at /path/to/tests/functional/repl/debugger-fail-throw-env-1.in.debugexpr.nix:1:1:
+            1| (_: throw "oh snap") 42
+             | ^
+            2|
+
+       … while calling anonymous lambda
+         at /path/to/tests/functional/repl/debugger-fail-throw-env-1.in.debugexpr.nix:1:2:
+            1| (_: throw "oh snap") 42
+             |  ^
+            2|
+
+       … while calling the 'throw' builtin
+         at /path/to/tests/functional/repl/debugger-fail-throw-env-1.in.debugexpr.nix:1:5:
+            1| (_: throw "oh snap") 42
+             |     ^
+            2|
+
+       error: oh snap
diff --git a/tests/functional/repl/debugger-fail-throw-env-1.in b/tests/functional/repl/debugger-fail-throw-env-1.in
new file mode 100644
index 000000000000..583e88fa86b5
--- /dev/null
+++ b/tests/functional/repl/debugger-fail-throw-env-1.in
@@ -0,0 +1,2 @@
+:env
+:quit
diff --git a/tests/functional/repl/debugger-fail-throw-env-1.in.debugexpr.nix b/tests/functional/repl/debugger-fail-throw-env-1.in.debugexpr.nix
new file mode 100644
index 000000000000..891728769749
--- /dev/null
+++ b/tests/functional/repl/debugger-fail-throw-env-1.in.debugexpr.nix
@@ -0,0 +1 @@
+(_: throw "oh snap") 42
diff --git a/tests/functional/repl/debugger-fail-throw-env-2.expected b/tests/functional/repl/debugger-fail-throw-env-2.expected
new file mode 100644
index 000000000000..3eb47bdf53aa
--- /dev/null
+++ b/tests/functional/repl/debugger-fail-throw-env-2.expected
@@ -0,0 +1,98 @@
+error: oh snap
+
+Nix <nix version> debugger
+Type :? for help.
+
+nix-repl> :env
+Env level 0
+static: _ 
+
+Env level 1
+static: 
+with: a 
+
+Env level 2
+static: x 
+
+Env level 3
+abort baseNameOf break builtins derivation derivationStrict dirOf false fetchGit fetchMercurial fetchTarball fetchTree fromTOML import isNull map null placeholder removeAttrs scopedImport throw toString true 
+
+nix-repl> :bt
+
+0: error: oh snap
+/path/to/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix:5:23
+
+     4| with x;
+     5| (_: builtins.seq x.a (throw "oh snap")) x.a
+      |                       ^
+     6| 
+
+1: while calling a function
+/path/to/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix:5:23
+
+     4| with x;
+     5| (_: builtins.seq x.a (throw "oh snap")) x.a
+      |                       ^
+     6| 
+
+2: while calling a function
+/path/to/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix:5:5
+
+     4| with x;
+     5| (_: builtins.seq x.a (throw "oh snap")) x.a
+      |     ^
+     6| 
+
+3: while calling anonymous lambda
+/path/to/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix:5:2
+
+     4| with x;
+     5| (_: builtins.seq x.a (throw "oh snap")) x.a
+      |  ^
+     6| 
+
+4: while calling a function
+/path/to/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix:5:1
+
+     4| with x;
+     5| (_: builtins.seq x.a (throw "oh snap")) x.a
+      | ^
+     6| 
+
+5: while evaluating a 'let' expression
+
+6: while evaluating the file '/path/to/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix':
+
+
+error:
+       … while evaluating the file '/path/to/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix':
+
+       … from call site
+         at /path/to/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix:5:1:
+            4| with x;
+            5| (_: builtins.seq x.a (throw "oh snap")) x.a
+             | ^
+            6|
+
+       … while calling anonymous lambda
+         at /path/to/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix:5:2:
+            4| with x;
+            5| (_: builtins.seq x.a (throw "oh snap")) x.a
+             |  ^
+            6|
+
+       … while calling the 'seq' builtin
+         at /path/to/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix:5:5:
+            4| with x;
+            5| (_: builtins.seq x.a (throw "oh snap")) x.a
+             |     ^
+            6|
+
+       … while calling the 'throw' builtin
+         at /path/to/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix:5:23:
+            4| with x;
+            5| (_: builtins.seq x.a (throw "oh snap")) x.a
+             |                       ^
+            6|
+
+       error: oh snap
diff --git a/tests/functional/repl/debugger-fail-throw-env-2.in b/tests/functional/repl/debugger-fail-throw-env-2.in
new file mode 100644
index 000000000000..abc5d843f2b6
--- /dev/null
+++ b/tests/functional/repl/debugger-fail-throw-env-2.in
@@ -0,0 +1,2 @@
+:env
+:bt
diff --git a/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix b/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix
new file mode 100644
index 000000000000..b1af43f241f2
--- /dev/null
+++ b/tests/functional/repl/debugger-fail-throw-env-2.in.debugexpr.nix
@@ -0,0 +1,5 @@
+let
+  x.a = 1;
+in
+with x;
+(_: builtins.seq x.a (throw "oh snap")) x.a
diff --git a/tests/functional/repl/debugger-okay-break.expected b/tests/functional/repl/debugger-okay-break.expected
new file mode 100644
index 000000000000..0cec2398a75e
--- /dev/null
+++ b/tests/functional/repl/debugger-okay-break.expected
@@ -0,0 +1,45 @@
+info: breakpoint reached
+
+Nix <nix version> debugger
+Type :? for help.
+
+nix-repl> :bt
+
+0: error: breakpoint reached
+
+1: while calling a function
+/path/to/tests/functional/repl/debugger-okay-break.in.debugexpr.nix:5:1
+
+     4| in
+     5| builtins.break othervar
+      | ^
+     6| 
+
+2: while evaluating a 'let' expression
+
+3: while evaluating the file '/path/to/tests/functional/repl/debugger-okay-break.in.debugexpr.nix':
+
+nix-repl> :backtrace
+
+0: error: breakpoint reached
+
+1: while calling a function
+/path/to/tests/functional/repl/debugger-okay-break.in.debugexpr.nix:5:1
+
+     4| in
+     5| builtins.break othervar
+      | ^
+     6| 
+
+2: while evaluating a 'let' expression
+
+3: while evaluating the file '/path/to/tests/functional/repl/debugger-okay-break.in.debugexpr.nix':
+
+nix-repl> :p somevar
+hello
+
+nix-repl> :p othervar
+42
+
+nix-repl> :c
+42
diff --git a/tests/functional/repl/debugger-okay-break.in b/tests/functional/repl/debugger-okay-break.in
new file mode 100644
index 000000000000..3991074aaed6
--- /dev/null
+++ b/tests/functional/repl/debugger-okay-break.in
@@ -0,0 +1,5 @@
+:bt
+:backtrace
+:p somevar
+:p othervar
+:c
diff --git a/tests/functional/repl/debugger-okay-break.in.debugexpr.nix b/tests/functional/repl/debugger-okay-break.in.debugexpr.nix
new file mode 100644
index 000000000000..c861ce4894c0
--- /dev/null
+++ b/tests/functional/repl/debugger-okay-break.in.debugexpr.nix
@@ -0,0 +1,5 @@
+let
+  somevar = "hello";
+  othervar = 42;
+in
+builtins.break othervar
diff --git a/tests/functional/repl/debugger-okay-ignore-try.expected b/tests/functional/repl/debugger-okay-ignore-try.expected
new file mode 100644
index 000000000000..7d4e72fdaeab
--- /dev/null
+++ b/tests/functional/repl/debugger-okay-ignore-try.expected
@@ -0,0 +1,128 @@
+info: breakpoint reached
+
+Nix <nix version> debugger
+Type :? for help.
+
+nix-repl> :bt
+
+0: error: breakpoint reached
+
+1: while calling a function
+/path/to/tests/functional/repl/debugger-okay-ignore-try.in.debugexpr.nix:6:13
+
+     5| let
+     6|   bricked = break tried;
+      |             ^
+     7| in
+
+2: while evaluating a 'let' expression
+
+3: while evaluating a 'let' expression
+
+4: while evaluating the file '/path/to/tests/functional/repl/debugger-okay-ignore-try.in.debugexpr.nix':
+
+nix-repl> :st 3
+
+3: while evaluating a 'let' expression
+
+Env level 0
+static: someFailingExpr tried 
+
+Env level 1
+abort baseNameOf break builtins derivation derivationStrict dirOf false fetchGit fetchMercurial fetchTarball fetchTree fromTOML import isNull map null placeholder removeAttrs scopedImport throw toString true 
+
+nix-repl> :p bricked
+error: undefined variable 'bricked'
+       at «string»:1:1:
+            1| bricked
+             | ^
+
+nix-repl> :p tried
+{
+  success = false;
+  value = false;
+}
+
+nix-repl> :st 2
+
+2: while evaluating a 'let' expression
+
+Env level 0
+static: bricked 
+
+Env level 1
+static: someFailingExpr tried 
+
+Env level 2
+abort baseNameOf break builtins derivation derivationStrict dirOf false fetchGit fetchMercurial fetchTarball fetchTree fromTOML import isNull map null placeholder removeAttrs scopedImport throw toString true 
+
+nix-repl> :p bricked
+error: infinite recursion encountered
+       at «string»:1:1:
+            1| bricked
+             | ^
+
+nix-repl> :p tried
+{
+  success = false;
+  value = false;
+}
+
+nix-repl> :st 1
+
+1: while calling a function
+/path/to/tests/functional/repl/debugger-okay-ignore-try.in.debugexpr.nix:6:13
+
+     5| let
+     6|   bricked = break tried;
+      |             ^
+     7| in
+
+Env level 0
+static: bricked 
+
+Env level 1
+static: someFailingExpr tried 
+
+Env level 2
+abort baseNameOf break builtins derivation derivationStrict dirOf false fetchGit fetchMercurial fetchTarball fetchTree fromTOML import isNull map null placeholder removeAttrs scopedImport throw toString true 
+
+nix-repl> :p bricked
+error: infinite recursion encountered
+       at «string»:1:1:
+            1| bricked
+             | ^
+
+nix-repl> :p tried
+{
+  success = false;
+  value = false;
+}
+
+nix-repl> :st 0
+
+0: error: breakpoint reached
+
+Env level 0
+static: bricked 
+
+Env level 1
+static: someFailingExpr tried 
+
+Env level 2
+abort baseNameOf break builtins derivation derivationStrict dirOf false fetchGit fetchMercurial fetchTarball fetchTree fromTOML import isNull map null placeholder removeAttrs scopedImport throw toString true 
+
+nix-repl> :p bricked
+error: infinite recursion encountered
+       at «string»:1:1:
+            1| bricked
+             | ^
+
+nix-repl> :p tried
+{
+  success = false;
+  value = false;
+}
+
+nix-repl> :c
+{ success = false; value = false; }
diff --git a/tests/functional/repl/debugger-okay-ignore-try.flags b/tests/functional/repl/debugger-okay-ignore-try.flags
new file mode 100644
index 000000000000..cb4987d80962
--- /dev/null
+++ b/tests/functional/repl/debugger-okay-ignore-try.flags
@@ -0,0 +1 @@
+--ignore-try
diff --git a/tests/functional/repl/debugger-okay-ignore-try.in b/tests/functional/repl/debugger-okay-ignore-try.in
new file mode 100644
index 000000000000..a3666caf5fbf
--- /dev/null
+++ b/tests/functional/repl/debugger-okay-ignore-try.in
@@ -0,0 +1,14 @@
+:bt
+:st 3
+:p bricked
+:p tried
+:st 2
+:p bricked
+:p tried
+:st 1
+:p bricked
+:p tried
+:st 0
+:p bricked
+:p tried
+:c
diff --git a/tests/functional/repl/debugger-okay-ignore-try.in.debugexpr.nix b/tests/functional/repl/debugger-okay-ignore-try.in.debugexpr.nix
new file mode 100644
index 000000000000..5321fb328930
--- /dev/null
+++ b/tests/functional/repl/debugger-okay-ignore-try.in.debugexpr.nix
@@ -0,0 +1,8 @@
+let
+  someFailingExpr = throw "fail";
+  tried = (builtins.tryEval someFailingExpr);
+in
+let
+  bricked = break tried;
+in
+bricked
diff --git a/tests/functional/repl/debugger-okay-on-warn.expected b/tests/functional/repl/debugger-okay-on-warn.expected
new file mode 100644
index 000000000000..53fb13112522
--- /dev/null
+++ b/tests/functional/repl/debugger-okay-on-warn.expected
@@ -0,0 +1,20 @@
+evaluation warning: this is a warning hello
+Nix <nix version> debugger
+Type :? for help.
+
+nix-repl> :p fails
+error:
+       … while calling the 'throw' builtin
+         at /path/to/tests/functional/repl/debugger-okay-on-warn.in.debugexpr.nix:3:11:
+            2|   msg = "hello";
+            3|   fails = throw (toString 1);
+             |           ^
+            4|   succeeds = 1;
+
+       error: 1
+
+nix-repl> :p succeeds
+1
+
+nix-repl> :s
+1
diff --git a/tests/functional/repl/debugger-okay-on-warn.flags b/tests/functional/repl/debugger-okay-on-warn.flags
new file mode 100644
index 000000000000..64d88c3e39e6
--- /dev/null
+++ b/tests/functional/repl/debugger-okay-on-warn.flags
@@ -0,0 +1 @@
+--debugger-on-warn
diff --git a/tests/functional/repl/debugger-okay-on-warn.in b/tests/functional/repl/debugger-okay-on-warn.in
new file mode 100644
index 000000000000..2781e35c5244
--- /dev/null
+++ b/tests/functional/repl/debugger-okay-on-warn.in
@@ -0,0 +1,3 @@
+:p fails
+:p succeeds
+:s
diff --git a/tests/functional/repl/debugger-okay-on-warn.in.debugexpr.nix b/tests/functional/repl/debugger-okay-on-warn.in.debugexpr.nix
new file mode 100644
index 000000000000..1073200b7889
--- /dev/null
+++ b/tests/functional/repl/debugger-okay-on-warn.in.debugexpr.nix
@@ -0,0 +1,6 @@
+with {
+  msg = "hello";
+  fails = throw (toString 1);
+  succeeds = 1;
+};
+builtins.warn "this is a warning ${msg}" succeeds
diff --git a/tests/functional/repl/doc-comment-curried-args.expected b/tests/functional/repl/doc-comment-curried-args.expected
index d2a5bf328535..29ca40cee2cc 100644
--- a/tests/functional/repl/doc-comment-curried-args.expected
+++ b/tests/functional/repl/doc-comment-curried-args.expected
@@ -2,7 +2,8 @@ Nix <nix version>
 Type :? for help.
 
 nix-repl> :l doc-comments.nix
-Added <number omitted> variables.
+Added 13 variables.
+compact, constant, curriedArgs, documentedFormals, floatedIn, lib, measurement, multiply, nonStrict, strict, strictPost, strictPre, unambiguous
 
 nix-repl> :doc curriedArgs
 Function `curriedArgs`\
diff --git a/tests/functional/repl/doc-comment-formals.expected b/tests/functional/repl/doc-comment-formals.expected
index 357cf9986808..65fbc2bd5d80 100644
--- a/tests/functional/repl/doc-comment-formals.expected
+++ b/tests/functional/repl/doc-comment-formals.expected
@@ -2,7 +2,8 @@ Nix <nix version>
 Type :? for help.
 
 nix-repl> :l doc-comments.nix
-Added <number omitted> variables.
+Added 13 variables.
+compact, constant, curriedArgs, documentedFormals, floatedIn, lib, measurement, multiply, nonStrict, strict, strictPost, strictPre, unambiguous
 
 nix-repl> "Note that this is not yet complete"
 "Note that this is not yet complete"
diff --git a/tests/functional/repl/doc-compact.expected b/tests/functional/repl/doc-compact.expected
index 276de2e60b59..9fcf6169a5fc 100644
--- a/tests/functional/repl/doc-compact.expected
+++ b/tests/functional/repl/doc-compact.expected
@@ -2,7 +2,8 @@ Nix <nix version>
 Type :? for help.
 
 nix-repl> :l doc-comments.nix
-Added <number omitted> variables.
+Added 13 variables.
+compact, constant, curriedArgs, documentedFormals, floatedIn, lib, measurement, multiply, nonStrict, strict, strictPost, strictPre, unambiguous
 
 nix-repl> :doc compact
 Function `compact`\
diff --git a/tests/functional/repl/doc-constant.expected b/tests/functional/repl/doc-constant.expected
index a68188b25abf..bda53bbfa660 100644
--- a/tests/functional/repl/doc-constant.expected
+++ b/tests/functional/repl/doc-constant.expected
@@ -2,7 +2,8 @@ Nix <nix version>
 Type :? for help.
 
 nix-repl> :l doc-comments.nix
-Added <number omitted> variables.
+Added 13 variables.
+compact, constant, curriedArgs, documentedFormals, floatedIn, lib, measurement, multiply, nonStrict, strict, strictPost, strictPre, unambiguous
 
 nix-repl> :doc constant
 error: value does not have documentation
diff --git a/tests/functional/repl/doc-floatedIn.expected b/tests/functional/repl/doc-floatedIn.expected
index 3bf1c40715b1..e01f8868ee7b 100644
--- a/tests/functional/repl/doc-floatedIn.expected
+++ b/tests/functional/repl/doc-floatedIn.expected
@@ -2,7 +2,8 @@ Nix <nix version>
 Type :? for help.
 
 nix-repl> :l doc-comments.nix
-Added <number omitted> variables.
+Added 13 variables.
+compact, constant, curriedArgs, documentedFormals, floatedIn, lib, measurement, multiply, nonStrict, strict, strictPost, strictPre, unambiguous
 
 nix-repl> :doc floatedIn
 Function `floatedIn`\
diff --git a/tests/functional/repl/doc-functor.expected b/tests/functional/repl/doc-functor.expected
index 8b86fe913448..e5984098c344 100644
--- a/tests/functional/repl/doc-functor.expected
+++ b/tests/functional/repl/doc-functor.expected
@@ -2,7 +2,8 @@ Nix <nix version>
 Type :? for help.
 
 nix-repl> :l doc-functor.nix
-Added <number omitted> variables.
+Added 13 variables.
+diverging, doubler, helper, helper2, helper3, lib, makeOverridable, makeVeryOverridable, multiplier, multiply, recursive, recursive2, square
 
 nix-repl> :doc multiplier
 Function `__functor`\
diff --git a/tests/functional/repl/doc-lambda-flavors.expected b/tests/functional/repl/doc-lambda-flavors.expected
index 437c09d2b319..676ef73135dd 100644
--- a/tests/functional/repl/doc-lambda-flavors.expected
+++ b/tests/functional/repl/doc-lambda-flavors.expected
@@ -2,7 +2,8 @@ Nix <nix version>
 Type :? for help.
 
 nix-repl> :l doc-comments.nix
-Added <number omitted> variables.
+Added 13 variables.
+compact, constant, curriedArgs, documentedFormals, floatedIn, lib, measurement, multiply, nonStrict, strict, strictPost, strictPre, unambiguous
 
 nix-repl> :doc nonStrict
 Function `nonStrict`\
diff --git a/tests/functional/repl/doc-measurement.expected b/tests/functional/repl/doc-measurement.expected
index 862697613be6..ef176cea883f 100644
--- a/tests/functional/repl/doc-measurement.expected
+++ b/tests/functional/repl/doc-measurement.expected
@@ -2,7 +2,8 @@ Nix <nix version>
 Type :? for help.
 
 nix-repl> :l doc-comments.nix
-Added <number omitted> variables.
+Added 13 variables.
+compact, constant, curriedArgs, documentedFormals, floatedIn, lib, measurement, multiply, nonStrict, strict, strictPost, strictPre, unambiguous
 
 nix-repl> :doc measurement
 Function `measurement`\
diff --git a/tests/functional/repl/doc-multiply.expected b/tests/functional/repl/doc-multiply.expected
index 21523e24c818..c2024b094918 100644
--- a/tests/functional/repl/doc-multiply.expected
+++ b/tests/functional/repl/doc-multiply.expected
@@ -2,7 +2,8 @@ Nix <nix version>
 Type :? for help.
 
 nix-repl> :l doc-comments.nix
-Added <number omitted> variables.
+Added 13 variables.
+compact, constant, curriedArgs, documentedFormals, floatedIn, lib, measurement, multiply, nonStrict, strict, strictPost, strictPre, unambiguous
 
 nix-repl> :doc multiply
 Function `multiply`\
diff --git a/tests/functional/repl/doc-unambiguous.expected b/tests/functional/repl/doc-unambiguous.expected
index 32ca9aef22ae..d2a452ba7bf3 100644
--- a/tests/functional/repl/doc-unambiguous.expected
+++ b/tests/functional/repl/doc-unambiguous.expected
@@ -2,7 +2,8 @@ Nix <nix version>
 Type :? for help.
 
 nix-repl> :l doc-comments.nix
-Added <number omitted> variables.
+Added 13 variables.
+compact, constant, curriedArgs, documentedFormals, floatedIn, lib, measurement, multiply, nonStrict, strict, strictPost, strictPre, unambiguous
 
 nix-repl> :doc unambiguous
 Function `unambiguous`\
diff --git a/tests/functional/repl/dollar-escaping.expected b/tests/functional/repl/dollar-escaping.expected
new file mode 100644
index 000000000000..6e9d237f9162
--- /dev/null
+++ b/tests/functional/repl/dollar-escaping.expected
@@ -0,0 +1,5 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> "$" + "{hi}"
+"\${hi}"
diff --git a/tests/functional/repl/dollar-escaping.in b/tests/functional/repl/dollar-escaping.in
new file mode 100644
index 000000000000..39734f24b864
--- /dev/null
+++ b/tests/functional/repl/dollar-escaping.in
@@ -0,0 +1,2 @@
+# COM: Check dollar escaping https://github.com/NixOS/nix/issues/4909
+"$" + "{hi}"
diff --git a/tests/functional/repl/file-a.nix b/tests/functional/repl/file-a.nix
new file mode 100644
index 000000000000..f113eebfd9b9
--- /dev/null
+++ b/tests/functional/repl/file-a.nix
@@ -0,0 +1 @@
+{ fromA = 1; }
diff --git a/tests/functional/repl/file-b.nix b/tests/functional/repl/file-b.nix
new file mode 100644
index 000000000000..7416216c9f51
--- /dev/null
+++ b/tests/functional/repl/file-b.nix
@@ -0,0 +1,8 @@
+{
+  fromBFails = throw "b";
+  fromB = 2;
+  /**
+    Some documentation.
+  */
+  funcFromB = x: x;
+}
diff --git a/tests/functional/repl/inherit-and-assignment.expected b/tests/functional/repl/inherit-and-assignment.expected
new file mode 100644
index 000000000000..43ad52b5ef88
--- /dev/null
+++ b/tests/functional/repl/inherit-and-assignment.expected
@@ -0,0 +1,9 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> x = { p = 10; }
+
+nix-repl> inherit (x) p; q = 20;
+
+nix-repl> p + q
+30
diff --git a/tests/functional/repl/inherit-and-assignment.in b/tests/functional/repl/inherit-and-assignment.in
new file mode 100644
index 000000000000..583b9096b5e8
--- /dev/null
+++ b/tests/functional/repl/inherit-and-assignment.in
@@ -0,0 +1,4 @@
+# COM: mixed bindings: inherit and assignment
+x = { p = 10; }
+inherit (x) p; q = 20;
+p + q
diff --git a/tests/functional/repl/inherit-current-scope.expected b/tests/functional/repl/inherit-current-scope.expected
new file mode 100644
index 000000000000..d2b2f39d224a
--- /dev/null
+++ b/tests/functional/repl/inherit-current-scope.expected
@@ -0,0 +1,9 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> foo = 42
+
+nix-repl> inherit foo
+
+nix-repl> foo
+42
diff --git a/tests/functional/repl/inherit-current-scope.in b/tests/functional/repl/inherit-current-scope.in
new file mode 100644
index 000000000000..d7eb0047afb2
--- /dev/null
+++ b/tests/functional/repl/inherit-current-scope.in
@@ -0,0 +1,4 @@
+# COM: inherit from current scope
+foo = 42
+inherit foo
+foo
diff --git a/tests/functional/repl/inherit-missing-shows-pos.expected b/tests/functional/repl/inherit-missing-shows-pos.expected
new file mode 100644
index 000000000000..dc02de2070f1
--- /dev/null
+++ b/tests/functional/repl/inherit-missing-shows-pos.expected
@@ -0,0 +1,13 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> a = { x = 1; }
+
+nix-repl> inherit (a) y
+
+nix-repl> y
+error: attribute 'y' missing
+       at «string»:1:13:
+            1| inherit (a) y
+             |             ^
+       Did you mean x?
diff --git a/tests/functional/repl/inherit-missing-shows-pos.in b/tests/functional/repl/inherit-missing-shows-pos.in
new file mode 100644
index 000000000000..057b2e816e92
--- /dev/null
+++ b/tests/functional/repl/inherit-missing-shows-pos.in
@@ -0,0 +1,4 @@
+# COM: inherit error shows position (without spurious semicolon from retry)
+a = { x = 1; }
+inherit (a) y
+y
diff --git a/tests/functional/repl/inherit-multiple-attrs.expected b/tests/functional/repl/inherit-multiple-attrs.expected
new file mode 100644
index 000000000000..e60df510a3cf
--- /dev/null
+++ b/tests/functional/repl/inherit-multiple-attrs.expected
@@ -0,0 +1,9 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> a = { x = 10; y = 20; }
+
+nix-repl> inherit (a) x y
+
+nix-repl> x + y
+30
diff --git a/tests/functional/repl/inherit-multiple-attrs.in b/tests/functional/repl/inherit-multiple-attrs.in
new file mode 100644
index 000000000000..0da0815b2d15
--- /dev/null
+++ b/tests/functional/repl/inherit-multiple-attrs.in
@@ -0,0 +1,4 @@
+# COM: inherit multiple attributes
+a = { x = 10; y = 20; }
+inherit (a) x y
+x + y
diff --git a/tests/functional/repl/inherit-with-semicolon.expected b/tests/functional/repl/inherit-with-semicolon.expected
new file mode 100644
index 000000000000..37d4020104d5
--- /dev/null
+++ b/tests/functional/repl/inherit-with-semicolon.expected
@@ -0,0 +1,9 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> a = { z = 99; }
+
+nix-repl> inherit (a) z;
+
+nix-repl> z
+99
diff --git a/tests/functional/repl/inherit-with-semicolon.in b/tests/functional/repl/inherit-with-semicolon.in
new file mode 100644
index 000000000000..d7a4972a2b3f
--- /dev/null
+++ b/tests/functional/repl/inherit-with-semicolon.in
@@ -0,0 +1,4 @@
+# COM: inherit with semicolon
+a = { z = 99; }
+inherit (a) z;
+z
diff --git a/tests/functional/repl/inherit.expected b/tests/functional/repl/inherit.expected
new file mode 100644
index 000000000000..9fde67b8cf46
--- /dev/null
+++ b/tests/functional/repl/inherit.expected
@@ -0,0 +1,9 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> a = { b = 1; c = 2; }
+
+nix-repl> inherit (a) b
+
+nix-repl> b
+1
diff --git a/tests/functional/repl/inherit.in b/tests/functional/repl/inherit.in
new file mode 100644
index 000000000000..804bbbec17a8
--- /dev/null
+++ b/tests/functional/repl/inherit.in
@@ -0,0 +1,4 @@
+# COM: Test inherit statement support (issue #15053)
+a = { b = 1; c = 2; }
+inherit (a) b
+b
diff --git a/tests/functional/repl/list-loaded-nothing-loaded.expected b/tests/functional/repl/list-loaded-nothing-loaded.expected
new file mode 100644
index 000000000000..1f9f97c984d2
--- /dev/null
+++ b/tests/functional/repl/list-loaded-nothing-loaded.expected
@@ -0,0 +1,5 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> :ll
+error: nothing has been loaded yet
diff --git a/tests/functional/repl/list-loaded-nothing-loaded.in b/tests/functional/repl/list-loaded-nothing-loaded.in
new file mode 100644
index 000000000000..f47ea2c888f9
--- /dev/null
+++ b/tests/functional/repl/list-loaded-nothing-loaded.in
@@ -0,0 +1 @@
+:ll
diff --git a/tests/functional/repl/load-and-reload.expected b/tests/functional/repl/load-and-reload.expected
new file mode 100644
index 000000000000..7f953e28613a
--- /dev/null
+++ b/tests/functional/repl/load-and-reload.expected
@@ -0,0 +1,42 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> :l file-b.nix
+Added 3 variables.
+fromB, fromBFails, funcFromB
+
+nix-repl> :l ./does-not-exist.nix
+error: path '/path/to/tests/functional/repl/does-not-exist.nix' does not exist
+
+nix-repl> :p fromBFails
+error:
+       … while calling the 'throw' builtin
+         at /path/to/tests/functional/repl/file-b.nix:2:16:
+            1| {
+            2|   fromBFails = throw "b";
+             |                ^
+            3|   fromB = 2;
+
+       error: b
+
+nix-repl> :doc funcFromB
+Function `funcFromB`\
+  … defined at /path/to/tests/functional/repl/file-b.nix:7:15
+
+
+Some documentation.
+
+nix-repl> :l file-a.nix
+Added 1 variables.
+fromA
+
+nix-repl> :r
+Loading "file-b.nix"...
+Added 3 variables.
+fromB, fromBFails, funcFromB
+Loading "file-a.nix"...
+Added 1 variables.
+fromA
+
+nix-repl> fromA + fromB
+3
diff --git a/tests/functional/repl/load-and-reload.in b/tests/functional/repl/load-and-reload.in
new file mode 100644
index 000000000000..a8b94a265bf2
--- /dev/null
+++ b/tests/functional/repl/load-and-reload.in
@@ -0,0 +1,7 @@
+:l file-b.nix
+:l ./does-not-exist.nix
+:p fromBFails
+:doc funcFromB
+:l file-a.nix
+:r
+fromA + fromB
diff --git a/tests/functional/repl/multiline-string-binding.expected b/tests/functional/repl/multiline-string-binding.expected
new file mode 100644
index 000000000000..eb029b217978
--- /dev/null
+++ b/tests/functional/repl/multiline-string-binding.expected
@@ -0,0 +1,9 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> x = ''
+        >   hello
+        > ''
+
+nix-repl> x
+"hello\n"
diff --git a/tests/functional/repl/multiline-string-binding.in b/tests/functional/repl/multiline-string-binding.in
new file mode 100644
index 000000000000..514a2ab4b282
--- /dev/null
+++ b/tests/functional/repl/multiline-string-binding.in
@@ -0,0 +1,5 @@
+# COM: Multi-line string in binding should trigger continuation (issue #15801)
+x = ''
+  hello
+''
+x
diff --git a/tests/functional/repl/multiline-string-function-binding.expected b/tests/functional/repl/multiline-string-function-binding.expected
new file mode 100644
index 000000000000..511ddd94a383
--- /dev/null
+++ b/tests/functional/repl/multiline-string-function-binding.expected
@@ -0,0 +1,11 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> f = x: x
+
+nix-repl> y = f ''
+        >   world
+        > ''
+
+nix-repl> y
+"world\n"
diff --git a/tests/functional/repl/multiline-string-function-binding.in b/tests/functional/repl/multiline-string-function-binding.in
new file mode 100644
index 000000000000..c1f15899deaf
--- /dev/null
+++ b/tests/functional/repl/multiline-string-function-binding.in
@@ -0,0 +1,6 @@
+# COM: Multi-line string in function call binding (issue #15801)
+f = x: x
+y = f ''
+  world
+''
+y
diff --git a/tests/functional/repl/multiple-bindings-same-line.expected b/tests/functional/repl/multiple-bindings-same-line.expected
new file mode 100644
index 000000000000..77062af5fe63
--- /dev/null
+++ b/tests/functional/repl/multiple-bindings-same-line.expected
@@ -0,0 +1,7 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> a = 1; b = 2;
+
+nix-repl> a + b
+3
diff --git a/tests/functional/repl/multiple-bindings-same-line.in b/tests/functional/repl/multiple-bindings-same-line.in
new file mode 100644
index 000000000000..6dd1d62a0e43
--- /dev/null
+++ b/tests/functional/repl/multiple-bindings-same-line.in
@@ -0,0 +1,3 @@
+# COM: multiple bindings on one line
+a = 1; b = 2;
+a + b
diff --git a/tests/functional/repl/nested-attr-path.expected b/tests/functional/repl/nested-attr-path.expected
new file mode 100644
index 000000000000..59164fede4b9
--- /dev/null
+++ b/tests/functional/repl/nested-attr-path.expected
@@ -0,0 +1,7 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> a.b.c = 1;
+
+nix-repl> a.b
+{ c = 1; }
diff --git a/tests/functional/repl/nested-attr-path.in b/tests/functional/repl/nested-attr-path.in
new file mode 100644
index 000000000000..4862c3c34bf4
--- /dev/null
+++ b/tests/functional/repl/nested-attr-path.in
@@ -0,0 +1,3 @@
+# COM: nested attribute path
+a.b.c = 1;
+a.b
diff --git a/tests/functional/repl/pretty-print-idempotent.expected b/tests/functional/repl/pretty-print-idempotent.expected
index 311855dae363..83ce76435783 100644
--- a/tests/functional/repl/pretty-print-idempotent.expected
+++ b/tests/functional/repl/pretty-print-idempotent.expected
@@ -2,7 +2,8 @@ Nix <nix version>
 Type :? for help.
 
 nix-repl> :l pretty-print-idempotent.nix
-Added <number omitted> variables.
+Added 4 variables.
+oneDeep, oneDeepList, twoDeep, twoDeepList
 
 nix-repl> oneDeep
 { homepage = "https://example.com"; }
diff --git a/tests/functional/repl/printing.expected b/tests/functional/repl/printing.expected
new file mode 100644
index 000000000000..f111939eb5b3
--- /dev/null
+++ b/tests/functional/repl/printing.expected
@@ -0,0 +1,59 @@
+Nix <nix version>
+Type :? for help.
+
+nix-repl> { a = { b = 2; }; l = [ 1 2 3 ]; s = "string"; n = 1234; x = rec { y = { z = { inherit y; }; }; }; }
+{
+  a = { ... };
+  l = [ ... ];
+  n = 1234;
+  s = "string";
+  x = { ... };
+}
+
+nix-repl> [ 42 1 "thingy" ({ a = 1; }) ([ 1 2 3 ]) ]
+[
+  42
+  1
+  "thingy"
+  { ... }
+  [ ... ]
+]
+
+nix-repl> let x = { y = { a = 1; }; inherit x; }; in x
+{
+  x = «repeated»;
+  y = { ... };
+}
+
+nix-repl> :p { a = { b = 2; }; s = "string"; n = 1234; x = rec { y = { z = { inherit y; }; }; }; }
+{
+  a = { b = 2; };
+  n = 1234;
+  s = "string";
+  x = {
+    y = {
+      z = {
+        y = «repeated»;
+      };
+    };
+  };
+}
+
+nix-repl> :p [ 42 1 "thingy" (rec { a = 1; b = { inherit a; inherit b; }; }) ([ 1 2 3 ]) ]
+[
+  42
+  1
+  "thingy"
+  {
+    a = 1;
+    b = {
+      a = 1;
+      b = «repeated»;
+    };
+  }
+  [
+    1
+    2
+    3
+  ]
+]
diff --git a/tests/functional/repl/printing.in b/tests/functional/repl/printing.in
new file mode 100644
index 000000000000..f3ca2cc88fcc
--- /dev/null
+++ b/tests/functional/repl/printing.in
@@ -0,0 +1,11 @@
+# COM: Test recursive printing and formatting
+# COM: Normal output should print attributes in lexicographical order non-recursively
+{ a = { b = 2; }; l = [ 1 2 3 ]; s = "string"; n = 1234; x = rec { y = { z = { inherit y; }; }; }; }
+# COM: Same for lists, but order is preserved
+[ 42 1 "thingy" ({ a = 1; }) ([ 1 2 3 ]) ]
+# COM: Same for let expressions
+let x = { y = { a = 1; }; inherit x; }; in x
+# COM: The :p command should recursively print sets, but prevent infinite recursion
+:p { a = { b = 2; }; s = "string"; n = 1234; x = rec { y = { z = { inherit y; }; }; }; }
+# COM: Same for lists
+:p [ 42 1 "thingy" (rec { a = 1; b = { inherit a; inherit b; }; }) ([ 1 2 3 ]) ]
diff --git a/tests/functional/restricted.sh b/tests/functional/restricted.sh
index 9c2b860a9e2d..602a56631f17 100755
--- a/tests/functional/restricted.sh
+++ b/tests/functional/restricted.sh
@@ -2,11 +2,9 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 nix-instantiate --restrict-eval --eval -E '1 + 2'
 (! nix-instantiate --eval --restrict-eval ./restricted.nix)
-TMPFILE=$(mktemp); echo '1 + 2' >"$TMPFILE"; (! nix-instantiate --eval --restrict-eval "$TMPFILE"); rm "$TMPFILE"
+TMPFILE=$(mktemp -p "$TEST_ROOT"); echo '1 + 2' >"$TMPFILE"; (! nix-instantiate --eval --restrict-eval "$TMPFILE");
 
 mkdir -p "$TEST_ROOT/nix"
 cp ./simple.nix "$TEST_ROOT/nix"
@@ -62,8 +60,8 @@ expectStderr 1 nix-instantiate --restrict-eval --eval -E "let __nixPath = [ { pr
 [[ $(nix-instantiate --restrict-eval --eval -E "let __nixPath = [ { prefix = \"foo\"; path = $TEST_ROOT/tunnel.d; } ]; in builtins.readDir <foo/tunnel>" -I "$TEST_ROOT"/tunnel.d) == '{ "tunnel.d" = "directory"; }' ]]
 
 # Check whether we can leak symlink information through directory traversal.
-traverseDir="${_NIX_TEST_SOURCE_DIR}/restricted-traverse-me"
-ln -sfn "${_NIX_TEST_SOURCE_DIR}/restricted-secret" "${_NIX_TEST_SOURCE_DIR}/restricted-innocent"
+traverseDir="$TEST_ROOT/restricted-traverse-me"
+ln -sfn "$TEST_ROOT/restricted-secret" "$TEST_ROOT/restricted-innocent"
 mkdir -p "$traverseDir"
 # shellcheck disable=SC2001
 goUp="..$(echo "$traverseDir" | sed -e 's,[^/]\+,..,g')"
diff --git a/tests/functional/search.sh b/tests/functional/search.sh
index 3fadecd02dd1..ffcbebf3edf7 100755
--- a/tests/functional/search.sh
+++ b/tests/functional/search.sh
@@ -2,9 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-clearCache
-
 (( $(nix search -f search.nix '' hello | wc -l) > 0 ))
 
 # Check descriptions are searched
diff --git a/tests/functional/secure-drv-outputs.sh b/tests/functional/secure-drv-outputs.sh
index 876d3c817e79..b661c3b189b8 100755
--- a/tests/functional/secure-drv-outputs.sh
+++ b/tests/functional/secure-drv-outputs.sh
@@ -8,8 +8,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-
 startDaemon
 
 # Determine the output path of the "good" derivation.
diff --git a/tests/functional/selfref-gc.sh b/tests/functional/selfref-gc.sh
index de202a09dd0e..6866f31e1a81 100755
--- a/tests/functional/selfref-gc.sh
+++ b/tests/functional/selfref-gc.sh
@@ -4,8 +4,6 @@ source common.sh
 
 requireDaemonNewerThan "2.6.0pre20211215"
 
-clearStoreIfPossible
-
 # shellcheck disable=SC2016
 nix-build --no-out-link -E '
   with import '"${config_nix}"';
diff --git a/tests/functional/shell.sh b/tests/functional/shell.sh
index 9769c90d1223..fdfc6661fdac 100755
--- a/tests/functional/shell.sh
+++ b/tests/functional/shell.sh
@@ -4,9 +4,6 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
-clearCache
-
 # nix shell is an alias for nix env shell. We'll use the shorter form in the rest of the test.
 nix env shell -f shell-hello.nix hello -c hello | grep 'Hello World'
 
diff --git a/tests/functional/signing.sh b/tests/functional/signing.sh
index bfa21fcff76b..dfc6c9892bc2 100755
--- a/tests/functional/signing.sh
+++ b/tests/functional/signing.sh
@@ -2,9 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-clearCache
-
 nix-store --generate-binary-cache-key cache1.example.org "$TEST_ROOT"/sk1 "$TEST_ROOT"/pk1
 pk1=$(cat "$TEST_ROOT"/pk1)
 nix-store --generate-binary-cache-key cache2.example.org "$TEST_ROOT"/sk2 "$TEST_ROOT"/pk2
diff --git a/tests/functional/simple.sh b/tests/functional/simple.sh
index f6507d74182a..b7e8911930a4 100755
--- a/tests/functional/simple.sh
+++ b/tests/functional/simple.sh
@@ -20,7 +20,7 @@ text=$(cat "$outPath/hello")
 TODO_NixOS
 
 # Directed delete: $outPath is not reachable from a root, so it should
-# be deleteable.
+# be deletable.
 nix-store --delete "$outPath"
 [[ ! -e $outPath/hello ]]
 
diff --git a/tests/functional/store-print-env.sh b/tests/functional/store-print-env.sh
index 894dc2e3ac9d..182e3acef7aa 100755
--- a/tests/functional/store-print-env.sh
+++ b/tests/functional/store-print-env.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 # Regression test for nix-store --print-env argument escaping
 # This tests that arguments in _args are properly escaped as a single string
 # rather than double-escaped which could lead to command injection
diff --git a/tests/functional/structured-attrs.sh b/tests/functional/structured-attrs.sh
index 321cb6107992..5ba7547a1042 100755
--- a/tests/functional/structured-attrs.sh
+++ b/tests/functional/structured-attrs.sh
@@ -5,10 +5,6 @@ source common.sh
 # https://github.com/NixOS/nix/pull/14189
 requireDaemonNewerThan "2.33"
 
-clearStoreIfPossible
-
-rm -f "$TEST_ROOT"/result
-
 nix-build structured-attrs.nix -A all -o "$TEST_ROOT"/result
 
 [[ $(cat "$TEST_ROOT"/result/foo) = bar ]]
@@ -26,7 +22,7 @@ TODO_NixOS # following line fails.
 
 # `nix develop` is a slightly special way of dealing with environment vars, it parses
 # these from a shell-file exported from a derivation. This is to test especially `outputs`
-# (which is an associative array in thsi case) being fine.
+# (which is an associative array in this case) being fine.
 # shellcheck disable=SC2016
 nix develop -f structured-attrs-shell.nix -c bash -c 'test -n "$out"'
 
@@ -45,21 +41,23 @@ test "$(<<<"$jsonOut" jq '.variables.outputs.value.out' -r)" = "$(<<<"$jsonOut"
 hackyExpr='derivation { name = "a"; system = "foo"; builder = "/bin/sh"; __json = builtins.toJSON { a = 1; }; }'
 
 # Check for deprecation message
-expectStderr 0 nix-instantiate --expr "$hackyExpr" --eval --strict | grepQuiet "In derivation 'a': setting structured attributes via '__json' is deprecated, and may be disallowed in future versions of Nix. Set '__structuredAttrs = true' instead."
+expectStderr 0 nix-instantiate --expr "$hackyExpr" --eval --strict | grepQuiet "setting structured attributes via '__json' is deprecated, and may be disallowed in future versions of Nix. Set '__structuredAttrs = true' instead."
 
 # Check it works with the expected structured attrs
 hacky=$(nix-instantiate --expr "$hackyExpr")
 nix derivation show "$hacky" | jq --exit-status '.derivations."'"$(basename "$hacky")"'".structuredAttrs | . == {"a": 1}'
 
-# Test warning for non-object exportReferencesGraph in structured attrs
-# shellcheck disable=SC2016
-expectStderr 0 nix-build --no-out-link --expr '
-  with import ./config.nix;
-  mkDerivation {
-    name = "export-graph-non-object";
-    __structuredAttrs = true;
-    exportReferencesGraph = [ "foo" "bar" ];
-    builder = "/bin/sh";
-    args = ["-c" "echo foo > ${builtins.placeholder "out"}"];
-  }
-' | grepQuiet "warning:.*exportReferencesGraph.*not a JSON object"
+if isDaemonNewer "2.34pre"; then
+    # Test warning for non-object exportReferencesGraph in structured attrs
+    # shellcheck disable=SC2016
+    expectStderr 0 nix-build --no-out-link --expr '
+    with import ./config.nix;
+    mkDerivation {
+        name = "export-graph-non-object";
+        __structuredAttrs = true;
+        exportReferencesGraph = [ "foo" "bar" ];
+        builder = "/bin/sh";
+        args = ["-c" "echo foo > ${builtins.placeholder "out"}"];
+    }
+    ' | grepQuiet "warning:.*exportReferencesGraph.*not a JSON object"
+fi
diff --git a/tests/functional/suggestions.sh b/tests/functional/suggestions.sh
index fbca93da8590..857daefb388c 100755
--- a/tests/functional/suggestions.sh
+++ b/tests/functional/suggestions.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 cd "$TEST_HOME"
 
 cat <<EOF > flake.nix
@@ -30,7 +28,7 @@ EOF
 # Probable typo in the requested attribute path. Suggest some close possibilities
 NIX_BUILD_STDERR_WITH_SUGGESTIONS=$(! nix build .\#fob 2>&1 1>/dev/null)
 [[ "$NIX_BUILD_STDERR_WITH_SUGGESTIONS" =~ "Did you mean one of fo1, fo2, foo or fooo?" ]] || \
-    fail "The nix build stderr should suggest the three closest possiblities"
+    fail "The nix build stderr should suggest the three closest possibilities"
 
 # None of the possible attributes is close to `bar`, so shouldn’t suggest anything
 NIX_BUILD_STDERR_WITH_NO_CLOSE_SUGGESTION=$(! nix build .\#bar 2>&1 1>/dev/null)
@@ -39,8 +37,8 @@ NIX_BUILD_STDERR_WITH_NO_CLOSE_SUGGESTION=$(! nix build .\#bar 2>&1 1>/dev/null)
 
 NIX_EVAL_STDERR_WITH_SUGGESTIONS=$(! nix build --impure --expr '(builtins.getFlake (builtins.toPath ./.)).packages.'"$system"'.fob' 2>&1 1>/dev/null)
 [[ "$NIX_EVAL_STDERR_WITH_SUGGESTIONS" =~ "Did you mean one of fo1, fo2, foo or fooo?" ]] || \
-    fail "The evaluator should suggest the three closest possiblities"
+    fail "The evaluator should suggest the three closest possibilities"
 
 NIX_EVAL_STDERR_WITH_SUGGESTIONS=$(! nix build --impure --expr '({ foo }: foo) { foo = 1; fob = 2; }' 2>&1 1>/dev/null)
 [[ "$NIX_EVAL_STDERR_WITH_SUGGESTIONS" =~ "Did you mean foo?" ]] || \
-    fail "The evaluator should suggest the three closest possiblities"
+    fail "The evaluator should suggest the three closest possibilities"
diff --git a/tests/functional/tarball.sh b/tests/functional/tarball.sh
index e7d9b96fda33..cfb6c674665d 100755
--- a/tests/functional/tarball.sh
+++ b/tests/functional/tarball.sh
@@ -2,12 +2,7 @@
 
 source common.sh
 
-clearStoreIfPossible
-
-rm -rf "$TEST_HOME"
-
 tarroot=$TEST_ROOT/tarball
-rm -rf "$tarroot"
 mkdir -p "$tarroot"
 cp dependencies.nix "$tarroot/default.nix"
 cp "${config_nix}" dependencies.builder*.sh "$tarroot/"
@@ -83,7 +78,6 @@ json=$(nix flake prefetch --json "tarball+file://$(pwd)/tree.tar.gz" --out-link
 [[ $(cat "$TEST_ROOT/result/fnord") = bar ]]
 
 # Test a tarball that has multiple top-level directories.
-rm -rf "$TEST_ROOT/tar_root"
 mkdir -p "$TEST_ROOT/tar_root" "$TEST_ROOT/tar_root/foo" "$TEST_ROOT/tar_root/bar"
 tar cvf "$TEST_ROOT/tar.tar" -C "$TEST_ROOT/tar_root" .
 path="$(nix flake prefetch --json "tarball+file://$TEST_ROOT/tar.tar" | jq -r .storePath)"
@@ -116,3 +110,17 @@ path="$(nix flake prefetch --refresh --json "tarball+file://$TEST_ROOT/tar.tar"
 # Test that unpacking an empty file does not segfault (see https://github.com/NixOS/nix/issues/15116).
 touch "$TEST_ROOT/empty"
 expectStderr 1 nix store prefetch-file --unpack "file://$TEST_ROOT/empty" | grepQuiet "archive.*is empty"
+
+# Test that concurrent invocations of Nix will fetch the tarball only once.
+rm -rf "$TEST_HOME/.cache"
+store="$TEST_ROOT/prefetch-store"
+nix-store --store "$store" --init # needed because concurrent creation of the store can give SQLite errors
+_NIX_TEST_CONCURRENT_FETCHES=1 _NIX_FORCE_HTTP=1 nix flake prefetch --store "$store" -v "tarball+file://$TEST_ROOT/tar.tar" 2> "$TEST_ROOT/log1" &
+pid1="$!"
+_NIX_TEST_CONCURRENT_FETCHES=1 _NIX_FORCE_HTTP=1 nix flake prefetch --store "$store" -v "tarball+file://$TEST_ROOT/tar.tar" 2> "$TEST_ROOT/log2" &
+pid2="$!"
+wait "$pid1"
+wait "$pid2"
+[[ $(cat "$TEST_ROOT/log1" "$TEST_ROOT/log2" | grep -c "Download.*to") -eq 2 ]]
+[[ $(cat "$TEST_ROOT/log1" "$TEST_ROOT/log2" | grep -c "downloading.*tar.tar") -eq 1 ]]
+[[ $(cat "$TEST_ROOT/log1" "$TEST_ROOT/log2" | grep -c "waiting for another Nix process to finish fetching input") -eq 1 ]]
diff --git a/tests/functional/test-libstoreconsumer/main.cc b/tests/functional/test-libstoreconsumer/main.cc
index cab02d799d79..9ba21306ab5e 100644
--- a/tests/functional/test-libstoreconsumer/main.cc
+++ b/tests/functional/test-libstoreconsumer/main.cc
@@ -1,5 +1,6 @@
 #include "nix/store/globals.hh"
 #include "nix/store/store-open.hh"
+#include "nix/store/build.hh"
 #include "nix/store/build-result.hh"
 #include <iostream>
 
@@ -24,7 +25,7 @@ int main(int argc, char ** argv)
         std::vector<DerivedPath> paths{DerivedPath::Built{
             .drvPath = makeConstantStorePathRef(store->parseStorePath(drvPath)), .outputs = OutputsSpec::Names{"out"}}};
 
-        const auto results = store->buildPathsWithResults(paths, bmNormal, store);
+        const auto results = store->getBuilder()->buildPathsWithResults(paths, bmNormal);
 
         for (const auto & result : results) {
             if (auto * successP = result.tryGetSuccess()) {
diff --git a/tests/functional/user-envs-migration.sh b/tests/functional/user-envs-migration.sh
index 46337cdda55c..cfd9cb2f8ebd 100755
--- a/tests/functional/user-envs-migration.sh
+++ b/tests/functional/user-envs-migration.sh
@@ -15,10 +15,6 @@ unset NIX_REMOTE
 
 TODO_NixOS
 
-clearStore
-clearProfiles
-rm -rf ~/.nix-profile
-
 # Fill the environment using the older Nix
 PATH_WITH_NEW_NIX="$PATH"
 export PATH="$NIX_DAEMON_PACKAGE/bin:$PATH"
diff --git a/tests/functional/why-depends.sh b/tests/functional/why-depends.sh
index fe9ff9a62269..0a256d911d1c 100755
--- a/tests/functional/why-depends.sh
+++ b/tests/functional/why-depends.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-clearStoreIfPossible
-
 cp ./dependencies.nix ./dependencies.builder0.sh "${config_nix}" "$TEST_HOME"
 
 cd "$TEST_HOME"
diff --git a/tests/functional/zstd.sh b/tests/functional/zstd.sh
deleted file mode 100755
index 226d5eb6813c..000000000000
--- a/tests/functional/zstd.sh
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/usr/bin/env bash
-
-source common.sh
-
-TODO_NixOS
-
-clearStore
-clearCache
-
-cacheURI="file://$cacheDir?compression=zstd"
-
-outPath=$(nix-build dependencies.nix --no-out-link)
-
-nix copy --to "$cacheURI" "$outPath"
-
-HASH=$(nix hash path "$outPath")
-
-clearStore
-clearCacheCache
-
-nix copy --from "$cacheURI" "$outPath" --no-check-sigs --profile "$TEST_ROOT/profile" --out-link "$TEST_ROOT/result"
-
-[[ -e $TEST_ROOT/profile ]]
-[[ -e $TEST_ROOT/result ]]
-
-if ls "$cacheDir/nar/"*.zst &> /dev/null; then
-    echo "files do exist"
-else
-    echo "nars do not exist"
-    exit 1
-fi
-
-HASH2=$(nix hash path "$outPath")
-
-[[ "$HASH" = "$HASH2" ]]
diff --git a/tests/nixos/ca-fd-leak/sender.c b/tests/nixos/ca-fd-leak/sender.c
index 639b88900228..f9fdd9405a52 100644
--- a/tests/nixos/ca-fd-leak/sender.c
+++ b/tests/nixos/ca-fd-leak/sender.c
@@ -62,6 +62,6 @@ int main(int argc, char ** argv)
     int buf;
 
     // Wait for the server to close the socket, implying that it has
-    // received the commmand.
+    // received the command.
     recv(sock, (void *) &buf, sizeof(int), 0);
 }
diff --git a/tests/nixos/containers/systemd-nspawn.nix b/tests/nixos/containers/systemd-nspawn.nix
index 4516f4e1394c..b3e680f04e8a 100644
--- a/tests/nixos/containers/systemd-nspawn.nix
+++ b/tests/nixos/containers/systemd-nspawn.nix
@@ -56,6 +56,8 @@ runCommand "test"
     mkdir -p $root $root/etc
 
     export > $root/.env
+    # Somehow systemd silently dies without this directory.
+    mkdir $root/usr
 
     # Make /run a tmpfs to shut up a systemd warning.
     mkdir /run
diff --git a/tests/nixos/fetch-git/test-cases/lfs/default.nix b/tests/nixos/fetch-git/test-cases/lfs/default.nix
index 289c3770911b..09b6fe44ffbd 100644
--- a/tests/nixos/fetch-git/test-cases/lfs/default.nix
+++ b/tests/nixos/fetch-git/test-cases/lfs/default.nix
@@ -172,7 +172,7 @@
         f"did not set lfs, yet lfs-enrolled file is {file_size_default}b (>= 1KiB), probably bad default value"
 
     with subtest("Use as flake input"):
-      # May seem reduntant, but this has minor differences compared to raw
+      # May seem redundant, but this has minor differences compared to raw
       # fetchGit which caused failures before
       with TemporaryDirectory() as tempdir:
         client.succeed(f"mkdir -p {tempdir}")
diff --git a/tests/nixos/fetchers-substitute.nix b/tests/nixos/fetchers-substitute.nix
index 7abadd43af64..0959512e1db6 100644
--- a/tests/nixos/fetchers-substitute.nix
+++ b/tests/nixos/fetchers-substitute.nix
@@ -1,26 +1,9 @@
-{ nixComponents, ... }:
 {
   name = "fetchers-substitute";
 
   nodes.substituter =
     { pkgs, ... }:
     {
-      # nix-serve is broken while cross-compiling in nixpkgs 25.11. It's been
-      # fixed since, but while we're pinning 25.11 we use this workaround.
-      nixpkgs.overlays = [
-        (final: prev: {
-          nix-serve =
-            final.lib.warnIf (final.lib.versions.majorMinor final.lib.version != "25.11")
-              "remove the hack in fetchers-substitute.nix when updating nixpkgs from 25.11"
-              (
-                prev.nix-serve.override {
-                  nix = prev.nix // {
-                    libs.nix-perl-bindings = nixComponents.nix-perl-bindings;
-                  };
-                }
-              );
-        })
-      ];
       virtualisation.writableStore = true;
 
       nix.settings.extra-experimental-features = [
@@ -28,21 +11,18 @@
         "fetch-tree"
       ];
 
-      networking.firewall.allowedTCPPorts = [ 5000 ];
+      networking.firewall.allowedTCPPorts = [ 80 ];
+
+      systemd.tmpfiles.rules = [ "d /var/cache/binary-cache 0755 root root -" ];
 
-      services.nix-serve = {
+      services.nginx = {
         enable = true;
-        secretKeyFile =
-          let
-            key = pkgs.writeTextFile {
-              name = "secret-key";
-              text = ''
-                substituter:SerxxAca5NEsYY0DwVo+subokk+OoHcD9m6JwuctzHgSQVfGHe6nCc+NReDjV3QdFYPMGix4FMg0+K/TM1B3aA==
-              '';
-            };
-          in
-          "${key}";
+        virtualHosts."substituter".root = "/var/cache/binary-cache";
       };
+
+      environment.etc."nix/secret-key".text = ''
+        substituter:SerxxAca5NEsYY0DwVo+subokk+OoHcD9m6JwuctzHgSQVfGHe6nCc+NReDjV3QdFYPMGix4FMg0+K/TM1B3aA==
+      '';
     };
 
   nodes.importer =
@@ -55,13 +35,12 @@
           "nix-command"
           "fetch-tree"
         ];
-        substituters = lib.mkForce [ "http://substituter:5000" ];
+        substituters = lib.mkForce [ "http://substituter" ];
         trusted-public-keys = lib.mkForce [ "substituter:EkFXxh3upwnPjUXg41d0HRWDzBoseBTINPiv0zNQd2g=" ];
       };
     };
 
-  testScript =
-    { nodes }: # python
+  testScript = # python
     ''
       import json
       import os
@@ -69,11 +48,11 @@
       start_all()
 
       substituter.wait_for_unit("multi-user.target")
+      importer.wait_for_unit("multi-user.target")
 
-      ##########################################
-      # Test 1: builtins.fetchurl with substitution
-      ##########################################
+      binary_cache = "file:///var/cache/binary-cache?secret-key=/etc/nix/secret-key"
 
+      # builtins.fetchurl is substituted
       missing_file = "/only-on-substituter.txt"
 
       substituter.succeed(f"echo 'this should only exist on the substituter' > {missing_file}")
@@ -91,11 +70,8 @@
 
       file_store_path = json.loads(file_store_path_json)
 
-      substituter.succeed(f"nix store sign --key-file ${nodes.substituter.services.nix-serve.secretKeyFile} {file_store_path}")
-
-      importer.wait_for_unit("multi-user.target")
+      substituter.succeed(f"nix copy --to '{binary_cache}' {file_store_path}")
 
-      print("Testing fetchurl with substitution...")
       importer.succeed(f"""
         nix-instantiate -vvvvv --eval --json --read-write-mode --expr '
           builtins.fetchurl {{
@@ -104,26 +80,19 @@
           }}
         '
       """)
-      print("✓ fetchurl substitution works!")
-
-      ##########################################
-      # Test 2: builtins.fetchTarball with substitution
-      ##########################################
 
+      # builtins.fetchTarball is substituted
       missing_tarball = "/only-on-substituter.tar.gz"
 
-      # Create a directory with some content
       substituter.succeed("""
         mkdir -p /tmp/test-tarball
         echo 'Hello from tarball!' > /tmp/test-tarball/hello.txt
         echo 'Another file' > /tmp/test-tarball/file2.txt
       """)
-
-      # Create a tarball
       substituter.succeed(f"tar czf {missing_tarball} -C /tmp test-tarball")
 
-      # For fetchTarball, we need to first fetch it without hash to get the store path,
-      # then compute the NAR hash of that path
+      # Fetch once without a hash to learn the store path, then derive the
+      # hashes the importer needs.
       tarball_store_path_json = substituter.succeed(f"""
         nix-instantiate --eval --json --read-write-mode --expr '
           builtins.fetchTarball {{
@@ -134,22 +103,14 @@
 
       tarball_store_path = json.loads(tarball_store_path_json)
 
-      # Get the NAR hash of the unpacked tarball in SRI format
       path_info_json = substituter.succeed(f"nix path-info --json-format 2 --json {tarball_store_path}").strip()
       path_info_dict = json.loads(path_info_json)["info"]
-      # narHash is already in SRI format
       tarball_hash_sri = path_info_dict[os.path.basename(tarball_store_path)]["narHash"]
-      print(f"Tarball NAR hash (SRI): {tarball_hash_sri}")
 
-      # Also get the old format hash for fetchTarball (which uses sha256 parameter)
       tarball_hash = substituter.succeed(f"nix-store --query --hash {tarball_store_path}").strip()
 
-      # Sign the tarball's store path
-      substituter.succeed(f"nix store sign --recursive --key-file ${nodes.substituter.services.nix-serve.secretKeyFile} {tarball_store_path}")
+      substituter.succeed(f"nix copy --to '{binary_cache}' {tarball_store_path}")
 
-      # Now try to fetch the same tarball on the importer
-      # The file doesn't exist locally, so it should be substituted
-      print("Testing fetchTarball with substitution...")
       result = importer.succeed(f"""
         nix-instantiate -vvvvv --eval --json --read-write-mode --expr '
           builtins.fetchTarball {{
@@ -160,23 +121,14 @@
       """)
 
       result_path = json.loads(result)
-      print(f"✓ fetchTarball substitution works! Result: {result_path}")
 
-      # Verify the content is correct
-      # fetchTarball strips the top-level directory if there's only one
       content = importer.succeed(f"cat {result_path}/hello.txt").strip()
       assert content == "Hello from tarball!", f"Content mismatch: {content}"
-      print("✓ fetchTarball content verified!")
-
-      ##########################################
-      # Test 3: Verify fetchTree does NOT substitute (preserves metadata)
-      ##########################################
-
-      print("Testing that fetchTree without __final does NOT use substitution...")
 
-      # fetchTree with just narHash (not __final) should try to download, which will fail
-      # since the file doesn't exist on the importer
-      exit_code = importer.fail(f"""
+      # fetchTree does NOT substitute non-final inputs: without __final it
+      # must perform the real fetch (to preserve metadata like lastModified),
+      # so it fails since the file only exists on the substituter.
+      output = importer.fail(f"""
         nix-instantiate --eval --json --read-write-mode --expr '
           builtins.fetchTree {{
             type = "tarball";
@@ -186,9 +138,6 @@
         ' 2>&1
       """)
 
-      # Should fail with "does not exist" since it tries to download instead of substituting
-      assert "does not exist" in exit_code or "Couldn't open file" in exit_code, f"Expected download failure, got: {exit_code}"
-      print("✓ fetchTree correctly does NOT substitute non-final inputs!")
-      print("  (This preserves metadata like lastModified from the actual fetch)")
+      assert "does not exist" in output or "Couldn't open file" in output, f"Expected download failure, got: {output}"
     '';
 }
diff --git a/tests/nixos/fetchurl.nix b/tests/nixos/fetchurl.nix
index e8663debbcd4..b3e744424e3c 100644
--- a/tests/nixos/fetchurl.nix
+++ b/tests/nixos/fetchurl.nix
@@ -54,6 +54,14 @@ in
               echo 'foobar' > "$out/index.html"
             '';
           };
+
+          virtualHosts."auth" = {
+            basicAuth.alice = "s3cr3t";
+            root = pkgs.runCommand "nginx-root" { } ''
+              mkdir "$out"
+              echo 'authed' > "$out/index.html"
+            '';
+          };
         };
 
         security.pki.certificateFiles = [ "${goodCert}/cert.pem" ];
@@ -61,6 +69,7 @@ in
         networking.hosts."127.0.0.1" = [
           "good"
           "bad"
+          "auth"
         ];
 
         virtualisation.writableStore = true;
@@ -89,5 +98,16 @@ in
 
     # Fetching from a server with a trusted cert should work via environment variable override.
     machine.succeed("NIX_SSL_CERT_FILE=/tmp/cafile.pem nix build --no-substitute --expr 'import <nix/fetchurl.nix> { url = \"https://bad/index.html\"; hash = \"sha256-rsBwZF/lPuOzdjBZN2E08FjMM3JHyXit0Xi2zN+wAZ8=\"; }'")
+
+    # builtins.fetchurl should authenticate using userinfo from the URL.
+    out = machine.succeed("nix eval --raw --impure --no-substitute --expr 'builtins.readFile (builtins.fetchurl { url = \"http://alice:s3cr3t@auth/index.html\"; sha256 = \"sha256-67y3HalfTt2zfgMt7BwU5vkaGWcelFlR4jryIkA1dTo=\"; })'")
+    assert out == "authed\n", out
+
+    # On failure the transport-layer diagnostic must show the stripped URL,
+    # not the userinfo. (The eval trace still echoes the source expression;
+    # that is the user's own input, not a leak.)
+    err = machine.fail("nix eval --raw --impure --no-substitute --option tarball-ttl 0 --expr 'builtins.fetchurl { url = \"http://alice:wrong-secret@auth/index.html\"; sha256 = \"sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\"; }' 2>&1")
+    print(err)
+    assert "unable to download 'http://auth/index.html'" in err, err
   '';
 }
diff --git a/tests/nixos/functional/common.nix b/tests/nixos/functional/common.nix
index 57f0bbc6a1c5..d4f02489c2ed 100644
--- a/tests/nixos/functional/common.nix
+++ b/tests/nixos/functional/common.nix
@@ -55,7 +55,9 @@
 
               meson setup nix/tests/functional build
               cd build
-              meson test -j1 --print-errorlogs
+              # Meson uses tqdm progress bar when stdout is a tty, which ends
+              # up being garbled in the nixos test logs.
+              meson test -j1 --print-errorlogs | cat
             '';
           };
         in
diff --git a/tests/nixos/functional/symlinked-home.nix b/tests/nixos/functional/symlinked-home.nix
index 900543d0cfee..09780339da73 100644
--- a/tests/nixos/functional/symlinked-home.nix
+++ b/tests/nixos/functional/symlinked-home.nix
@@ -1,9 +1,11 @@
 /**
   This test runs the functional tests on a NixOS system where the home directory
-  is symlinked to another location.
+  is symlinked to another location that also happens to reside in parent directory
+  that we don't have read permissions for (only execute).
 
   The purpose of this test is to find cases where Nix uses low-level operations
-  that don't support symlinks on paths that include them.
+  that don't support symlinks on paths that include them or requires excessive
+  permissions for path resolution.
 
   It is not a substitute for more intricate, use case-specific tests, but helps
   catch common issues.
@@ -27,8 +29,12 @@
       machine.succeed("""
         (
           set -x
-          mv /home/alice /home/alice.real
-          ln -s alice.real /home/alice
+          mkdir -p /home/alice.parent
+          chown alice:users /home/alice.parent
+          # Make the parent unreadable for good measure
+          chmod 0110 /home/alice.parent
+          mv /home/alice /home/alice.parent/alice.real
+          ln -s alice.parent/alice.real /home/alice
         ) 1>&2
       """)
     machine.succeed("""
diff --git a/tests/nixos/functional/unprivileged-daemon.nix b/tests/nixos/functional/unprivileged-daemon.nix
index ac99c2881d46..9ea987101390 100644
--- a/tests/nixos/functional/unprivileged-daemon.nix
+++ b/tests/nixos/functional/unprivileged-daemon.nix
@@ -28,6 +28,12 @@
         ];
       };
 
+      # FIXME: Remove when https://github.com/NixOS/nixpkgs/pull/526816 is merged.
+      systemd.services.register-nix-paths.serviceConfig = {
+        User = config.nix.daemonUser;
+        Group = config.nix.daemonGroup;
+      };
+
       # The store setting `ignore-gc-delete-failure` isn't set by default,
       # but is needed since the daemon won't own the entire store.
       systemd.services.nix-daemon.environment.NIX_REMOTE =
diff --git a/tests/nixos/nix-copy-closure.nix b/tests/nixos/nix-copy-closure.nix
index d24930de0609..5fa886360129 100644
--- a/tests/nixos/nix-copy-closure.nix
+++ b/tests/nixos/nix-copy-closure.nix
@@ -14,6 +14,7 @@ let
   pkgB = pkgs.wget;
   pkgC = pkgs.hello;
   pkgD = pkgs.tmux;
+  pkgE = pkgs.tree;
 
 in
 {
@@ -32,6 +33,7 @@ in
         virtualisation.additionalPaths = [
           pkgA
           pkgD.drvPath
+          pkgE.drvPath
         ];
         nix.settings.substituters = lib.mkForce [ ];
       };
@@ -41,16 +43,19 @@ in
       {
         services.openssh.enable = true;
         virtualisation.writableStore = true;
+        # Including pkgC.drvPath (versus just pkgC) so common build deps
+        # are already in the store, limiting what the --include-outputs test
+        # needs to copy.
         virtualisation.additionalPaths = [
           pkgB
-          pkgC
+          pkgC.drvPath
         ];
       };
   };
 
   testScript =
     { nodes }:
-    ''
+    /* python */ ''
       # fmt: off
       import subprocess
 
@@ -85,18 +90,18 @@ in
 
       # Copy the closure of package C via the SSH substituter.
       client.fail("nix-store -r ${pkgC}")
+      client.succeed("nix-store --substituters ssh://root@server?trusted=1 -r ${pkgC} >&2")
+      client.succeed("nix-store --check-validity ${pkgC}")
 
-      # Copy the derivation of package D's derivation from the client to the server.
+      # Copy the derivation of package D from the client to the server.
       server.fail("nix-store --check-validity ${pkgD.drvPath}")
       client.succeed("nix-copy-closure --to server --gzip ${pkgD.drvPath} >&2")
       server.succeed("nix-store --check-validity ${pkgD.drvPath}")
+      server.fail("nix-store --check-validity ${pkgD}")
 
-      # FIXME
-      # client.succeed(
-      #   "nix-store --option use-ssh-substituter true"
-      #   " --option ssh-substituter-hosts root\@server"
-      #   " -r ${pkgC} >&2"
-      # )
-      # client.succeed("nix-store --check-validity ${pkgC}")
+      # Copy the derivation and outputs of package E from client to server.
+      server.fail("nix-store --check-validity ${pkgE}")
+      client.succeed("nix-copy-closure --to server --gzip --include-outputs ${pkgE.drvPath} >&2")
+      server.succeed("nix-store --check-validity ${pkgE}")
     '';
 }
diff --git a/tests/nixos/nix-docker.nix b/tests/nixos/nix-docker.nix
index f1c218585a6e..123c6ceebf87 100644
--- a/tests/nixos/nix-docker.nix
+++ b/tests/nixos/nix-docker.nix
@@ -46,7 +46,7 @@ in
           pkgs.stdenv
           pkgs.hello
         ];
-        services.harmonia.enable = true;
+        services.harmonia.cache.enable = true;
         networking.firewall.allowedTCPPorts = [ 5000 ];
       };
   };
@@ -54,7 +54,7 @@ in
   testScript =
     { nodes }:
     ''
-      cache.wait_for_unit("harmonia.service")
+      cache.wait_for_unit("harmonia.socket")
       cache.wait_for_unit("network-addresses-eth1.service")
 
       machine.succeed("mkdir -p /etc/containers")
diff --git a/tests/nixos/s3-binary-cache-store.nix b/tests/nixos/s3-binary-cache-store.nix
index b2a86643d1e0..ce3cd9764bbc 100644
--- a/tests/nixos/s3-binary-cache-store.nix
+++ b/tests/nixos/s3-binary-cache-store.nix
@@ -36,7 +36,14 @@ in
           pkgC
           pkgs.coreutils
         ];
-        environment.systemPackages = [ pkgs.minio-client ];
+        environment.systemPackages = [
+          (pkgs.minio-client.overrideAttrs (o: {
+            meta = o.meta // {
+              # TODO: Switch to garage.
+              knownVulnerabilities = [ ];
+            };
+          }))
+        ];
         nix.nixPath = [ "nixpkgs=${pkgs.path}" ];
         nix.extraOptions = ''
           experimental-features = nix-command
@@ -50,6 +57,12 @@ in
             MINIO_ROOT_PASSWORD=${secretKey}
             MINIO_DOMAIN=minio.local
           '';
+          package = pkgs.minio.overrideAttrs (o: {
+            meta = o.meta // {
+              # TODO: Switch to garage.
+              knownVulnerabilities = [ ];
+            };
+          });
         };
         networking.firewall.allowedTCPPorts = [ 9000 ];
         # Static hosts for virtual-hosted-style S3 tests.
diff --git a/tests/nixos/store-remount.nix b/tests/nixos/store-remount.nix
index 09f76dab797e..351630c35f42 100644
--- a/tests/nixos/store-remount.nix
+++ b/tests/nixos/store-remount.nix
@@ -36,7 +36,7 @@
 
       # Set up a minimal container root (which needs its own db to avoid
       # UID-mapping issues on the host db).
-      machine.succeed("mkdir -p /tmp/container/{nix/store,nix/var/nix/db,tmp,etc,proc,sys}")
+      machine.succeed("mkdir -p /tmp/container/{nix/store,nix/var/nix/db,tmp,etc,proc,sys,usr}")
       machine.succeed("echo 'root:x:0:0:root:/root:/bin/sh' > /tmp/container/etc/passwd")
       machine.succeed("echo 'root:x:0:' > /tmp/container/etc/group")