diff --git a/overlays/cross.nix b/overlays/cross.nix
index ee1475485..0e8c14ce5 100644
--- a/overlays/cross.nix
+++ b/overlays/cross.nix
@@ -670,27 +670,58 @@ in with final; {
   #   });
   # });
 
-  signal-desktop = prev.signal-desktop.overrideAttrs (upstream: {
-    buildPhase = lib.replaceStrings
-      ["-c.electronDist"]
-      ["${lib.optionalString stdenv.hostPlatform.isAarch64 "--arm64 "}-c.electronDist"]
-      upstream.buildPhase
-    ;
-    # fixup the app.asar to not hold a ref to any build-time tools
-    nativeBuildInputs = upstream.nativeBuildInputs ++ [
-      final.asar
-      final.removeReferencesTo
-    ];
-    preFixup = (upstream.preFixup or "") + ''
-      # the asar includes both runtime and build-time files (e.g. build scripts):
-      # it's impractical to properly split out the node files which aren't needed at runtime,
-      # but we can patch them to not refer to the build tools to reduce closure size and to make potential packaging/cross-compilation bugs more obvious.
-      asar extract $out/share/signal-desktop/app.asar asar-unpacked
-      rm $out/share/signal-desktop/app.asar
-      find asar-unpacked/node_modules -type f -executable -exec remove-references-to -t ${buildPackages.nodejs_22} -t ${buildPackages.bashNonInteractive} '{}' \;
-      asar pack asar-unpacked $out/share/signal-desktop/app.asar
-    '';
-  });
+  # signal-desktop = prev.signal-desktop.overrideAttrs (upstream: {
+  #   # 2025/07/06: upstreaming is blocked on:
+  #   # - <https://github.com/NixOS/nixpkgs/pull/422938>
+  #   # - <https://github.com/NixOS/nixpkgs/pull/423089>
+  #   # - ibusMinimal (fixed in staging)
+  #   # see nixpkgs branch `pr-npm-patch-shebangs` (abandoned):
+  #   # pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh (or pnpm.configHook)
+  #   # calls patchShebangs on the node_modules/ directory, which causes us to take a ref to the build nodejs, needlessly.
+  #   # postUnpack = ''
+  #   #   eval real_"$(declare -f patchShebangs)"
+  #   #   patchShebangs() {
+  #   #     if [[ -z "''${dontMockPatchShebangs-}" ]]; then
+  #   #       echo "MOCKING patchShebangs"
+  #   #     else
+  #   #       echo "NOT MOCKING patchShebangs"
+  #   #       real_patchShebangs "$@"
+  #   #     fi
+  #   #   }
+  #   # '';
+  #   # # only mock this for unpack/config phase; fixup can patchShebangsAuto
+  #   # preBuild = ''
+  #   #   export dontMockPatchShebangs=1
+  #   # '';
+  #   buildPhase = lib.replaceStrings
+  #     # ["-c.electronDist"]
+  #     # ["${lib.optionalString stdenv.hostPlatform.isAarch64 "--arm64 "}-c.electronDist"]
+  #       # ["--config.linux.target.arch=arm64 -c.electronDist"]
+  #     ["--dir"]
+  #     # [''"--config.$npm_config_platform.target.target=dir" "--config.$npm_config_platform.target.arch=$npm_config_arch"'']
+  #     ["--linux dir:arm64"]
+  #     # ["--dir:arm64"]
+  #     # ["--dir --arm64"]
+  #     upstream.buildPhase
+  #   ;
+  #   # preBuild = ''
+  #   #   export ELECTRON_ARCH=$npm_config_arch
+  #   # '';
+  #   # # fixup the app.asar to not hold a ref to any build-time tools
+  #   # nativeBuildInputs = upstream.nativeBuildInputs ++ [
+  #   #   final.asar
+  #   #   final.removeReferencesTo
+  #   # ];
+  #   # preFixup = (upstream.preFixup or "") + ''
+  #   #   # the asar includes both runtime and build-time files (e.g. build scripts):
+  #   #   # it's impractical to properly split out the node files which aren't needed at runtime,
+  #   #   # but we can patch them to not refer to the build tools to reduce closure size and to make potential packaging/cross-compilation bugs more obvious.
+  #   #   asar extract $out/share/signal-desktop/app.asar asar-unpacked
+  #   #   rm $out/share/signal-desktop/app.asar
+  #   #   find asar-unpacked/node_modules -type f -executable -exec remove-references-to -t ${buildPackages.nodejs_22} -t ${buildPackages.bashNonInteractive} '{}' \;
+  #   #   asar pack asar-unpacked $out/share/signal-desktop/app.asar
+  #   # '';
+  # });
 
   # 2025/05/01: upstreaming is blocked on glycin-loaders
   snapshot = prev.snapshot.override {
diff --git a/pkgs/by-name/nixpkgs-bootstrap/patches.nix b/pkgs/by-name/nixpkgs-bootstrap/patches.nix
index 620a3ebf5..a4f9a2a31 100644
--- a/pkgs/by-name/nixpkgs-bootstrap/patches.nix
+++ b/pkgs/by-name/nixpkgs-bootstrap/patches.nix
@@ -1,3 +1,4 @@
+# track PRs on their way to master: <https://nixpk.gs/pr-tracker.htm>
 { fetchpatch2 }:
 let
   fetchpatch' = {
@@ -72,23 +73,16 @@ in
     hash = "sha256-G9oUnE7dUmNQRu8kJSlEkgyVuQMgCGBRd6TYSCzifzg=";
   })
 
-  # TODO(2025-07-05): upstream!
   (fetchpatch' {
-    name = "signal-desktop.webrtc: fix cross compilation";
-    saneCommit = "33979df35a34c75a7ff5b304ec752b5c1c0ebaac";
-    hash = "sha256-S/C0of6q270j/vTEy04to3Ze6NUgIW6rJG39RAtIir4=";
+    name = "treewide: populate arch and platform for more node packages";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/422938";
+    hash = "sha256-lN99K0k9dCUBFXc99XB97cZSVDu5A74pHL40vw9cobY=";
   })
 
   (fetchpatch' {
-    name = "signal-desktop.libsignal-node: fix cross compilation";
-    saneCommit = "99e8523a1787a93139303c03ee8ae9ff860962d6";
-    hash = "sha256-cBfM330yTRL1fJ9q6c26zgCa1FhLHe0cQv83s/Mc0AA=";
-  })
-
-  (fetchpatch' {
-    name = "signal-desktop.signal-sqlcipher: fix cross compilation";
-    saneCommit = "5be6dd7f27937efc3da67848408573229ff8f817";
-    hash = "sha256-IgZ8UkbeUJ1sskF9yG4FJNF2qJC32QSCXPRogK3IK/Y=";
+    name = "signal-desktop: fix cross compilation";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/423089";
+    hash = "sha256-/EgQLlNOqy1ZG4AXfPLYQpBty5ZQifG7RWTYxMbL1OA=";
   })
 
   # (fetchpatch' {