diff --git a/flake.lock b/flake.lock
index 9c34947..37b4e24 100644
--- a/flake.lock
+++ b/flake.lock
@@ -160,16 +160,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1718208800,
-        "narHash": "sha256-US1tAChvPxT52RV8GksWZS415tTS7PV42KTc2PNDBmc=",
+        "lastModified": 1716361217,
+        "narHash": "sha256-mzZDr00WUiUXVm1ujBVv6A0qRd8okaITyUp4ezYRgc4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "cc54fb41d13736e92229c21627ea4f22199fee6b",
+        "rev": "46397778ef1f73414b03ed553a3368f0e7e33c2f",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.05",
+        "ref": "nixos-23.11",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 08eba14..422d82c 100755
--- a/flake.nix
+++ b/flake.nix
@@ -1,6 +1,6 @@
 {
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
diff --git a/hosts/tomate/configuration.nix b/hosts/tomate/configuration.nix
index 8058b04..7ac0b3a 100644
--- a/hosts/tomate/configuration.nix
+++ b/hosts/tomate/configuration.nix
@@ -50,13 +50,13 @@
   services.xserver.enable = true;
 
   # Enable the KDE Plasma Desktop Environment.
-  services.displayManager.sddm.enable = true;
+  services.xserver.displayManager.sddm.enable = true;
   services.xserver.desktopManager.plasma5.enable = true;
 
   # Configure keymap in X11
   services.xserver = {
-    xkb.layout = "de";
-    xkb.variant = "";
+    layout = "de";
+    xkbVariant = "";
   };
 
   # Configure console keymap
@@ -90,7 +90,7 @@
 
   services.avahi = {
     enable = true;
-    nssmdns4 = true;
+    nssmdns = true;
     openFirewall = true;
     publish = {
       enable = true;
diff --git a/modules/core/bacula.nix b/modules/core/bacula.nix
index 15e309c..ea93477 100644
--- a/modules/core/bacula.nix
+++ b/modules/core/bacula.nix
@@ -26,10 +26,7 @@
       mailcommand = "${pkgs.bacula}/bin/bsmtp -f \"Bacula <bacula@${config.networking.domain}>\" -s \"Bacula report" %r"
       mail = root+backup = all, !skipped
     '';
-    director."abel-dir" = {
-      password = "@${config.sops.secrets."bacula/password".path}";
-      tls.enable = false;
-    };
+    director."abel-dir".password = "@${config.sops.secrets."bacula/password".path}";
   };
   environment.etc."bacula/bconsole.conf".text = ''
     Director {
diff --git a/modules/core/base.nix b/modules/core/base.nix
index 507c8f6..5f4e7b7 100755
--- a/modules/core/base.nix
+++ b/modules/core/base.nix
@@ -1,5 +1,6 @@
 { pkgs, config, ... }: {
   nix = {
+    package = pkgs.nixUnstable; # or versioned attributes like nix_2_4
     extraOptions = ''
       experimental-features = nix-command flakes
     '';
diff --git a/modules/mail/dovecot2.nix b/modules/mail/dovecot2.nix
index 02a0034..e4668a1 100644
--- a/modules/mail/dovecot2.nix
+++ b/modules/mail/dovecot2.nix
@@ -100,7 +100,7 @@ in
     # set to satisfy the sieveScripts check, will be overridden by userdb lookups anyways
     mailUser = "vmail";
     mailGroup = "vmail";
-    sieve.scripts = {
+    sieveScripts = {
       before = pkgs.writeText "spam.sieve" ''
         require "fileinto";
 
diff --git a/modules/nextcloud.nix b/modules/nextcloud.nix
index 6e515d1..6ab4a25 100644
--- a/modules/nextcloud.nix
+++ b/modules/nextcloud.nix
@@ -30,7 +30,7 @@ in
       database.createLocally = true;
 
       # enable HEIC image preview
-      settings.enabledPreviewProviders = [
+      extraOptions.enabledPreviewProviders = [
         "OC\\Preview\\BMP"
         "OC\\Preview\\GIF"
         "OC\\Preview\\JPEG"
diff --git a/modules/web/ese.nix b/modules/web/ese.nix
index 93fc356..e3a78ca 100644
--- a/modules/web/ese.nix
+++ b/modules/web/ese.nix
@@ -5,7 +5,7 @@ let
 in
 {
   sops.secrets."directus_env" = { };
-  environment.systemPackages = [ pkgs.nodejs_22 ];
+  environment.systemPackages = [ pkgs.nodejs_21 ];
   virtualisation.oci-containers = {
     containers.directus-ese = {
       image = "directus/directus:latest";
@@ -21,13 +21,13 @@ in
         "DB_DATABASE" = "directus_ese";
         "DB_USER" = "directus_ese";
         "PUBLIC_URL" = "https://directus-ese.ifsr.de";
-        "AUTH_PROVIDERS" = "keycloak";
+        "AUTH_PROVIDERS"="keycloak";
         "AUTH_KEYCLOAK_DRIVER" = "openid";
         "AUTH_KEYCLOAK_CLIENT_ID" = "directus-ese";
         "AUTH_KEYCLOAK_ISSUER_URL" = "https://sso.ifsr.de/realms/internal/.well-known/openid-configuration";
         "AUTH_KEYCLOAK_IDENTIFIER_KEY" = "email";
-        "AUTH_KEYCLOAK_ALLOW_PUBLIC_REGISTRATION" = "true";
-        "AUTH_KEYCLOAK_DEFAULT_ROLE_ID" = "a6b7a1b6-a6fa-442c-87fd-e37c2a16424b";
+        "AUTH_KEYCLOAK_ALLOW_PUBLIC_REGISTRATION"="true";
+        "AUTH_KEYCLOAK_DEFAULT_ROLE_ID"="a6b7a1b6-a6fa-442c-87fd-e37c2a16424b";
       };
       environmentFiles = [
         config.sops.secrets."directus_env".path