diff --git a/hosts/common/programs/assorted.nix b/hosts/common/programs/assorted.nix
index dfc3354b5..08639ecb2 100644
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -457,12 +457,6 @@ in
 
     "cacert.unbundled".sandbox.enable = false;  #< data only
 
-    cargo.persist.byStore.plaintext = [ ".cargo" ];
-    # probably this sandboxing is too restrictive; i'm sandboxing it for rust-analyzer / neovim LSP
-    cargo.sandbox.whitelistPwd = true;
-    cargo.sandbox.net = "all";
-    cargo.sandbox.extraHomePaths = [ "dev" "ref" ];
-
     clang = {};
 
     clang-tools.sandbox.whitelistPwd = true;
diff --git a/hosts/common/programs/cargo.nix b/hosts/common/programs/cargo.nix
new file mode 100644
index 000000000..0715313ab
--- /dev/null
+++ b/hosts/common/programs/cargo.nix
@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  sane.programs.cargo = {
+    #v XXX(2025-02-23): normal `cargo` fails to build for cross (temporarily?). use prebuilt instead.
+    # NOT easy to debug/fix. git bisect pins this between ceba2c6c3b (good) and 62a28e5a3d (bad)
+    packageUnwrapped = pkgs.rust.packages.prebuilt.cargo;
+    persist.byStore.plaintext = [ ".cargo" ];
+    # probably this sandboxing is too restrictive; i'm sandboxing it for rust-analyzer / neovim LSP
+    sandbox.whitelistPwd = true;
+    sandbox.net = "all";
+    sandbox.extraHomePaths = [ "dev" "ref" ];
+  };
+}
diff --git a/hosts/common/programs/default.nix b/hosts/common/programs/default.nix
index c3af49da8..6ced133c3 100644
--- a/hosts/common/programs/default.nix
+++ b/hosts/common/programs/default.nix
@@ -27,6 +27,7 @@
     ./cantata.nix
     ./capsh.nix
     ./captree.nix
+    ./cargo.nix
     ./catt.nix
     ./celeste64.nix
     ./chatty.nix
diff --git a/hosts/common/programs/kdenlive.nix b/hosts/common/programs/kdenlive.nix
index f93beba3f..1a39ef89c 100644
--- a/hosts/common/programs/kdenlive.nix
+++ b/hosts/common/programs/kdenlive.nix
@@ -3,7 +3,7 @@
   sane.programs.kdenlive = {
     buildCost = 1;
 
-    packageUnwrapped = pkgs.kdenlive.overrideAttrs (base: {
+    packageUnwrapped = pkgs.kdePackages.kdenlive.overrideAttrs (base: {
       qtWrapperArgs = base.qtWrapperArgs ++ [
         "--set QP_QPA_PLATFORM wayland"
       ];
diff --git a/overlays/cross.nix b/overlays/cross.nix
index a76e0133e..410542205 100644
--- a/overlays/cross.nix
+++ b/overlays/cross.nix
@@ -470,6 +470,14 @@ in with final; {
 
   lemoa = prev.lemoa.override { cargo = crossCargo; };
 
+  libqmi = prev.libqmi.overrideAttrs (upstream: {
+    # gtk-doc fails (even with mesonEmulatorHook present)
+    outputs = lib.remove "devdoc" upstream.outputs;
+    mesonFlags = (lib.remove "-Dgtk_doc=true" upstream.mesonFlags) ++ [
+      "-Dgtk_doc=false"
+    ];
+  });
+
   # libsForQt5 = prev.libsForQt5.overrideScope (self: super: {
   #   phonon = super.phonon.overrideAttrs (orig: {
   #     # fixes "ECM (required version >= 5.60), Extra CMake Modules"
@@ -490,9 +498,9 @@ in with final; {
 
   # 2024/11/19: upstreaming is unblocked
   mepo = (prev.mepo.override {
-    # nixpkgs mepo correctly puts `zig_0_12.hook` in nativeBuildInputs,
+    # nixpkgs mepo correctly puts `zig_0_13.hook` in nativeBuildInputs,
     # but for some reason that tries to use the host zig instead of the build zig.
-    zig_0_12 = buildPackages.zig_0_12;
+    zig_0_13 = buildPackages.zig_0_13;
   }).overrideAttrs (upstream: {
     dontUseZigCheck = true;
     nativeBuildInputs = upstream.nativeBuildInputs ++ [
diff --git a/pkgs/by-name/megapixels-next/package.nix b/pkgs/by-name/megapixels-next/package.nix
index 695c8bd33..99d7d65e4 100644
--- a/pkgs/by-name/megapixels-next/package.nix
+++ b/pkgs/by-name/megapixels-next/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "megapixels-next";
-  version = "2.0.0-alpha1-unstable-2025-02-11";
+  version = "2.0.0-alpha1-unstable-2025-02-17";
 
   src = fetchFromGitLab {
     owner = "megapixels-org";
     repo = "Megapixels";
-    rev = "2f2929800b005820a21da8f3e7cc4ba0fe51fe1d";
-    hash = "sha256-ehPq1UwhYv4ncAhnVjDMgGT255ZdliMw6nMzYE5qWnM=";
+    rev = "9acea2849d3a3539edccb24fc837a3b966f911f1";
+    hash = "sha256-W64iZLcTW7M4YQpnHWbzMYky7ZqNuprvVnHiFsnF92I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/nixpkgs-bootstrap/master.nix b/pkgs/by-name/nixpkgs-bootstrap/master.nix
index 76ec7b854..fb1c1321e 100644
--- a/pkgs/by-name/nixpkgs-bootstrap/master.nix
+++ b/pkgs/by-name/nixpkgs-bootstrap/master.nix
@@ -8,8 +8,8 @@
   mkNixpkgs ? import ./mkNixpkgs.nix {}
 }:
 mkNixpkgs {
-  rev = "49bae9aaddd584d28321f729e166903fb81ad23c";
-  sha256 = "sha256-mIY+RwUDvtVN1/6g0CbJKqlG3jhwR9ttX1Q3h9C0cw8=";
-  version = "0-unstable-2025-02-17";
+  rev = "81aebb632a8eca2ee473f0b8b5bdb325a19827ec";
+  sha256 = "sha256-E7H7k02MO8RDnIT+gWndWgNDm9opUK0aFXvjpfCaq3w=";
+  version = "0-unstable-2025-02-22";
   branch = "master";
 }
diff --git a/pkgs/by-name/nixpkgs-bootstrap/patches.nix b/pkgs/by-name/nixpkgs-bootstrap/patches.nix
index 2376d848d..ac13ceaa9 100644
--- a/pkgs/by-name/nixpkgs-bootstrap/patches.nix
+++ b/pkgs/by-name/nixpkgs-bootstrap/patches.nix
@@ -46,13 +46,13 @@ in
   #   hash = "sha256-jW66W1V3upZMfbjuoruY3OGNJfEewx7DW/Z4vAhMEXw=";
   # })
 
-  (fetchpatch' {
-    # patch should be safe to remove; keeping it here to track the upstreaming status
-    name = "nixos/gitea: don't configure the database if `createDatabase == false`";
-    prUrl = "https://github.com/NixOS/nixpkgs/pull/268849";
-    # saneCommit = "92662a9920cf8b70ad8a061591dc37146123bde3";
-    hash = "sha256-Bmy1xqqmHqJVpleKWOssF+6SUpKOIm6hIGQsW6+hUTg=";
-  })
+  # (fetchpatch' {
+  #   # patch should be safe to remove; keeping it here to track the upstreaming status
+  #   name = "nixos/gitea: don't configure the database if `createDatabase == false`";
+  #   prUrl = "https://github.com/NixOS/nixpkgs/pull/268849";
+  #   # saneCommit = "92662a9920cf8b70ad8a061591dc37146123bde3";
+  #   hash = "sha256-Bmy1xqqmHqJVpleKWOssF+6SUpKOIm6hIGQsW6+hUTg=";
+  # })
 
   # (fetchpatch' {
   #   # TODO: send to upstream nixpkgs once tested (branch: lappy: pr-stepmania-wrapper)