diff --git a/common/default.nix b/common/default.nix
index da46b63..635b8ba 100644
--- a/common/default.nix
+++ b/common/default.nix
@@ -42,7 +42,7 @@ in
 
   # Some programs need SUID wrappers, can be configured further or are
   # started in user sessions.
-  programs.bash.enableCompletion = true;
+  programs.bash.completion.enable = true;
   programs.wireshark = {
     enable = true;
     package = pkgs.wireshark;
@@ -53,6 +53,11 @@ in
   programs.mtr.enable = true;
   # programs.gnupg.agent = { enable = true; enableSSHSupport = true; };
 
+  programs.ausweisapp = {
+    enable = true;
+    openFirewall = true;
+  };
+
   # List services that you want to enable:
 
   # Enable the OpenSSH daemon.
diff --git a/common/nix-settings.nix b/common/nix-settings.nix
index a83f77e..caa16f9 100644
--- a/common/nix-settings.nix
+++ b/common/nix-settings.nix
@@ -26,7 +26,6 @@ in
     experimental-features = [
       "nix-command"
       "flakes"
-      "repl-flake"
     ];
     # use all cores for building
     cores = 0;
diff --git a/flake.lock b/flake.lock
index b6617ed..662ca8a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,16 +117,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1726989464,
-        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
+        "lastModified": 1733050161,
+        "narHash": "sha256-lYnT+EYE47f5yY3KS/Kd4pJ6CO9fhCqumkYYkQ3TK20=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
+        "rev": "62d536255879be574ebfe9b87c4ac194febf47c5",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.05",
+        "ref": "release-24.11",
         "repo": "home-manager",
         "type": "github"
       }
@@ -179,11 +179,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1731454423,
-        "narHash": "sha256-TtwvgFxUa0wyptLhQbKaixgNW1UXf3+TDqfX3Kp63oM=",
+        "lastModified": 1732603785,
+        "narHash": "sha256-AEjWTJwOmSnVYsSJCojKgoguGfFfwel6z/6ud6UFMU8=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "6c71c49e2448e51ad830ed211024e6d0edc50116",
+        "rev": "6ab87b7c84d4ee873e937108c4ff80c015a40c7a",
         "type": "github"
       },
       "original": {
@@ -194,11 +194,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1731332224,
-        "narHash": "sha256-0ctfVp27ingWtY7dbP5+QpSQ98HaOZleU0teyHQUAw0=",
+        "lastModified": 1733066523,
+        "narHash": "sha256-aQorWITXZu7b095UwnpUvcGt9dNJie/GO9r4hZfe2sU=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "184687ae1a3139faa4746168baf071f60d0310c8",
+        "rev": "fe01780d356d70fd119a19277bff71d3e78dad00",
         "type": "github"
       },
       "original": {
@@ -210,11 +210,11 @@
     },
     "nixos-unstable": {
       "locked": {
-        "lastModified": 1731319897,
-        "narHash": "sha256-PbABj4tnbWFMfBp6OcUK5iGy1QY+/Z96ZcLpooIbuEI=",
+        "lastModified": 1732837521,
+        "narHash": "sha256-jNRNr49UiuIwaarqijgdTR2qLPifxsVhlJrKzQ8XUIE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "dc460ec76cbff0e66e269457d7b728432263166c",
+        "rev": "970e93b9f82e2a0f3675757eb0bfc73297cc6370",
         "type": "github"
       },
       "original": {
@@ -258,27 +258,27 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1731386116,
-        "narHash": "sha256-lKA770aUmjPHdTaJWnP3yQ9OI1TigenUqVC3wweqZuI=",
+        "lastModified": 1732981179,
+        "narHash": "sha256-F7thesZPvAMSwjRu0K8uFshTk3ZZSNAsXTIFvXBT+34=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "689fed12a013f56d4c4d3f612489634267d86529",
+        "rev": "62c435d93bf046a5396f3016472e8f7c8e2aed65",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.05",
+        "ref": "nixos-24.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nur": {
       "locked": {
-        "lastModified": 1731350327,
-        "narHash": "sha256-FQg83gsyB++oVNPg6QP9enTlYxG9d5K5wcdc8jE5tTk=",
+        "lastModified": 1733077621,
+        "narHash": "sha256-Zo1md8M9LzlfFIrM7/wfEtm/4TbiObWmTckJ7yrgiJw=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "4d77b647a89d6405bfd2a6a2fecf613a3520683b",
+        "rev": "2b3136c2f2b55f97424a6ffe5926e811e14b3c71",
         "type": "github"
       },
       "original": {
@@ -394,11 +394,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1729613947,
-        "narHash": "sha256-XGOvuIPW1XRfPgHtGYXd5MAmJzZtOuwlfKDgxX5KT3s=",
+        "lastModified": 1730321837,
+        "narHash": "sha256-vK+a09qq19QNu2MlLcvN4qcRctJbqWkX7ahgPZ/+maI=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "aac86347fb5063960eccb19493e0cadcdb4205ca",
+        "rev": "746901bb8dba96d154b66492a29f5db0693dbfcc",
         "type": "github"
       },
       "original": {
@@ -412,11 +412,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1726560853,
-        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 796a574..0fac46e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,11 +2,11 @@
   description = "NixOS system flake";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
     nixos-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
     home-manager = {
-      url = "github:nix-community/home-manager/release-24.05";
+      url = "github:nix-community/home-manager/release-24.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     lanzaboote = {
@@ -100,7 +100,7 @@
         { pkgs, ... }:
         {
           projectRootFile = "flake.nix";
-          programs.nixfmt-rfc-style.enable = true;
+          programs.nixfmt.enable = true;
         };
     in
     {
diff --git a/home/modules/packages.nix b/home/modules/packages.nix
index af65012..a164d91 100644
--- a/home/modules/packages.nix
+++ b/home/modules/packages.nix
@@ -41,7 +41,7 @@ let
       musescore
       tenacity
       soundkonverter
-      config.nur.repos.fooker.studio-link
+      #config.nur.repos.fooker.studio-link
     ];
 
   cliApps =
@@ -91,7 +91,7 @@ let
 
   nixHelpers = [
     nixpkgs-review
-    unstable.nixfmt-rfc-style
+    nixfmt-rfc-style
     nix-top
     statix
   ];
@@ -163,7 +163,7 @@ let
     hunspellDicts.en-gb-ise
     seafile-client
     alacritty
-    libreoffice-qt # fresh with KDE integration
+    libreoffice-qt6 # still with KDE integration
     backintime-common
     anki
     signal-desktop
@@ -179,7 +179,7 @@ let
     yate
     # split and merge PDFs in a GUI
     pdfarranger
-    #qbittorrent # currently insecure
+    qbittorrent
     #(pkgs.pidgin-with-plugins.override {
     #    plugins = [ pkgs.pidginotr ];})
 
@@ -193,12 +193,14 @@ let
   ];
 
   kdeTools =
-    [ okteta ]
+    [
+      okteta
+      plasma5Packages.kdeconnect-kde
+    ]
     ++ (with kdePackages; [
       okular
       gwenview
       yakuake
-      kdeconnect
       dolphin
       spectacle
       kate
diff --git a/home/workmac.nix b/home/workmac.nix
index 5aab318..724f64f 100644
--- a/home/workmac.nix
+++ b/home/workmac.nix
@@ -23,7 +23,7 @@ in
 
   home.packages = [
     wireshark # on NixOS systems enabled via system config
-    _1password
+    _1password-cli
     # also TODO: color schemes nix-darwin
   ];
 
diff --git a/hosts/framenix/default.nix b/hosts/framenix/default.nix
index 688dd48..86cb501 100644
--- a/hosts/framenix/default.nix
+++ b/hosts/framenix/default.nix
@@ -20,9 +20,6 @@ in
 
   networking.hostName = "framenix"; # Define your hostname.
 
-  # use newer linux-firmware from unstable
-  hardware.firmware = lib.mkBefore [ unstable.linux-firmware ];
-
   # override tmpdir for daemon
   systemd.services.nix-daemon.environment.TMPDIR = "/var/tmp";