diff --git a/pkgs/development/python-modules/azure-keyvault-keys/default.nix b/pkgs/development/python-modules/azure-keyvault-keys/default.nix
index 7c2bef4a0844..79b13b55ea91 100644
--- a/pkgs/development/python-modules/azure-keyvault-keys/default.nix
+++ b/pkgs/development/python-modules/azure-keyvault-keys/default.nix
@@ -1,45 +1,41 @@
-{ lib
-, buildPythonPackage
-, pythonOlder
-, fetchPypi
-, aiohttp
-, azure-common
-, azure-core
-, cryptography
-, msrest
-, pytestCheckHook
+{
+  lib,
+  azure-common,
+  azure-core,
+  buildPythonPackage,
+  cryptography,
+  fetchPypi,
+  isodate,
+  pythonOlder,
+  setuptools,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "azure-keyvault-keys";
-  version = "4.8.0";
-  format = "setuptools";
+  version = "4.9.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    extension = "zip";
-    hash = "sha256-bAuy94MgKjSj5ex0hm5iEuWRrHEk8DuWadGwm2giS8Q=";
+    hash = "sha256-CGMtzW7OKGVyBOmiVq1kNp/isOOF7UM0n5MvAH2J93Q=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     azure-common
     azure-core
-    msrest
     cryptography
+    isodate
+    typing-extensions
   ];
 
-  nativeCheckInputs = [
-    aiohttp
-    pytestCheckHook
-  ];
+  pythonNamespaces = [ "azure.keyvault" ];
 
-  pythonNamespaces = [
-    "azure.keyvault"
-  ];
-
-  # requires relative paths to utilities in the mono-repo
+  # Tests require relative paths to utilities in the mono-repo
   doCheck = false;
 
   pythonImportsCheck = [
@@ -52,7 +48,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Microsoft Azure Key Vault Keys Client Library for Python";
-    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    homepage = "https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/tree/azure-keyvault-keys_${version}/sdk/keyvault/azure-keyvault-keys";
     license = licenses.mit;
     maintainers = with maintainers; [ jonringer ];
   };
diff --git a/pkgs/development/python-modules/betterproto/default.nix b/pkgs/development/python-modules/betterproto/default.nix
index e1d9f75a9a90..c3a823169d46 100644
--- a/pkgs/development/python-modules/betterproto/default.nix
+++ b/pkgs/development/python-modules/betterproto/default.nix
@@ -1,21 +1,22 @@
-{ buildPythonPackage
-, fetchFromGitHub
-, lib
-, pythonOlder
-, poetry-core
-, grpclib
-, python-dateutil
-, black
-, jinja2
-, isort
-, python
-, pydantic
-, pytestCheckHook
-, pytest-asyncio
-, pytest-mock
-, typing-extensions
-, tomlkit
-, grpcio-tools
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  pythonOlder,
+  poetry-core,
+  grpclib,
+  python-dateutil,
+  black,
+  jinja2,
+  isort,
+  python,
+  pydantic,
+  pytestCheckHook,
+  pytest-asyncio,
+  pytest-mock,
+  typing-extensions,
+  tomlkit,
+  grpcio-tools,
 }:
 
 buildPythonPackage rec {
@@ -32,11 +33,9 @@ buildPythonPackage rec {
     hash = "sha256-ZuVq4WERXsRFUPNNTNp/eisWX1MyI7UtwqEI8X93wYI=";
   };
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     grpclib
     python-dateutil
     typing-extensions
@@ -57,9 +56,7 @@ buildPythonPackage rec {
     tomlkit
   ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
-  pythonImportsCheck = [
-    "betterproto"
-  ];
+  pythonImportsCheck = [ "betterproto" ];
 
   # The tests require the generation of code before execution. This requires
   # the protoc-gen-python_betterproto script from the package to be on PATH.
@@ -76,6 +73,8 @@ buildPythonPackage rec {
 
   disabledTests = [
     "test_pydantic_no_value"
+    # Test is flaky
+    "test_binary_compatibility"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/ed25519/default.nix b/pkgs/development/python-modules/ed25519/default.nix
index 745c2c38cd0d..80e405313cbc 100644
--- a/pkgs/development/python-modules/ed25519/default.nix
+++ b/pkgs/development/python-modules/ed25519/default.nix
@@ -1,22 +1,45 @@
-{ lib, fetchPypi, buildPythonPackage, pythonAtLeast }:
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch,
+  pythonOlder,
+  setuptools,
+  versioneer,
+}:
 
 buildPythonPackage rec {
   pname = "ed25519";
   version = "1.5";
-  format = "setuptools";
+  pyproject = true;
 
-  # last commit in 2019, various compat issues with 3.12
-  disabled = pythonAtLeast "3.12";
+  disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0n1k83ww0pr4q6z0h7p8hvy21hcgb96jvgllfbwhvvyf37h3w182";
+  src = fetchFromGitHub {
+    owner = "warner";
+    repo = "python-ed25519";
+    rev = "refs/tags/${version}";
+    hash = "sha256-AwnhB5UGycQliNndbqd0JlI4vKSehCSy0qHv2EiB+jA=";
   };
 
+  postPatch = ''
+    rm versioneer.py
+  '';
+
+  build-system = [
+    setuptools
+    versioneer
+  ];
+
+  pythonImportsCheck = [
+    "ed25519"
+  ];
+
   meta = with lib; {
     description = "Ed25519 public-key signatures";
     mainProgram = "edsig";
     homepage = "https://github.com/warner/python-ed25519";
+    changelog = "https://github.com/warner/python-ed25519/blob/${version}/NEWS";
     license = licenses.mit;
     maintainers = with maintainers; [ np ];
   };
diff --git a/pkgs/development/python-modules/grpclib/default.nix b/pkgs/development/python-modules/grpclib/default.nix
index be31ef9c78c0..d88500f6a296 100644
--- a/pkgs/development/python-modules/grpclib/default.nix
+++ b/pkgs/development/python-modules/grpclib/default.nix
@@ -1,33 +1,36 @@
-{ buildPythonPackage
-, fetchFromGitHub
-, lib
-, pythonOlder
-, h2
-, multidict
-, pytestCheckHook
-, pytest-asyncio
-, async-timeout
-, faker
-, googleapis-common-protos
-, certifi
+{
+  lib,
+  async-timeout,
+  buildPythonPackage,
+  certifi,
+  faker,
+  fetchFromGitHub,
+  googleapis-common-protos,
+  h2,
+  multidict,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:
-let
+
+buildPythonPackage rec {
   pname = "grpclib";
-  version = "0.4.4";
-  format = "setuptools";
-in
-buildPythonPackage {
-  inherit pname version;
+  version = "0.4.7";
+  pyproject = true;
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "vmagamedov";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-bCLyBfsNdIGdpz9l/r2iYIQ5TitKmsctekeOthIkXhw=";
+    repo = "grpclib";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-5221hVjD0TynCsTdruiUZkTsb7uOi49tZ8M/YqdWreE=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     h2
     multidict
   ];
@@ -46,6 +49,7 @@ buildPythonPackage {
   meta = with lib; {
     description = "Pure-Python gRPC implementation for asyncio";
     homepage = "https://github.com/vmagamedov/grpclib";
+    changelog = "https://github.com/vmagamedov/grpclib/blob/v${version}/docs/changelog/index.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ nikstur ];
   };
diff --git a/pkgs/development/python-modules/nats-py/default.nix b/pkgs/development/python-modules/nats-py/default.nix
index 93cb33f9fd07..7102d87286bb 100644
--- a/pkgs/development/python-modules/nats-py/default.nix
+++ b/pkgs/development/python-modules/nats-py/default.nix
@@ -1,15 +1,16 @@
-{ lib
-, stdenv
-, aiohttp
-, buildPythonPackage
-, ed25519
-, fetchFromGitHub
-, nats-server
-, nkeys
-, pytestCheckHook
-, pythonOlder
-, setuptools
-, uvloop
+{
+  lib,
+  stdenv,
+  aiohttp,
+  buildPythonPackage,
+  ed25519,
+  fetchFromGitHub,
+  nats-server,
+  nkeys,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  uvloop,
 }:
 
 buildPythonPackage rec {
@@ -26,21 +27,13 @@ buildPythonPackage rec {
     hash = "sha256-5lvdt1JbOmdts0CYU00bSmv0LsMQsOe//yUgyevBULE=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
-    ed25519
-  ];
+  dependencies = [ ed25519 ];
 
   passthru.optional-dependencies = {
-    aiohttp = [
-      aiohttp
-    ];
-    nkeys = [
-      nkeys
-    ];
+    aiohttp = [ aiohttp ];
+    nkeys = [ nkeys ];
     # fast_parse = [
     #   fast-mail-parser
     # ];
@@ -52,20 +45,24 @@ buildPythonPackage rec {
     uvloop
   ];
 
-  disabledTests = [
-    # AssertionError: assert 5 == 0
-    "test_pull_subscribe_limits"
-    "test_fetch_n"
-    "test_subscribe_no_echo"
-    "test_stream_management"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "test_subscribe_iterate_next_msg"
-    "test_buf_size_force_flush_timeout"
-  ];
+  disabledTests =
+    [
+      # AssertionError: assert 5 == 0
+      "test_pull_subscribe_limits"
+      "test_fetch_n"
+      "test_subscribe_no_echo"
+      "test_stream_management"
+      # Tests fail on hydra, often Time-out
+      "test_subscribe_iterate_next_msg"
+      "test_ordered_consumer_larger_streams"
+      "test_object_file_basics"
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      "test_subscribe_iterate_next_msg"
+      "test_buf_size_force_flush_timeout"
+    ];
 
-  pythonImportsCheck = [
-    "nats"
-  ];
+  pythonImportsCheck = [ "nats" ];
 
   meta = with lib; {
     description = "Python client for NATS.io";
diff --git a/pkgs/development/python-modules/securesystemslib/default.nix b/pkgs/development/python-modules/securesystemslib/default.nix
index ccc89a290035..21cff0dc498e 100644
--- a/pkgs/development/python-modules/securesystemslib/default.nix
+++ b/pkgs/development/python-modules/securesystemslib/default.nix
@@ -1,19 +1,20 @@
-{ lib
-, asn1crypto
-, azure-identity
-, azure-keyvault-keys
-, boto3
-, botocore
-, buildPythonPackage
-, cryptography
-, ed25519
-, fetchFromGitHub
-, google-cloud-kms
-, hatchling
-, pynacl
-, pyspx
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  asn1crypto,
+  azure-identity,
+  azure-keyvault-keys,
+  boto3,
+  botocore,
+  buildPythonPackage,
+  cryptography,
+  ed25519,
+  fetchFromGitHub,
+  google-cloud-kms,
+  hatchling,
+  pynacl,
+  pyspx,
+  pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
@@ -32,17 +33,13 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "hatchling==1.18.0" "hatchling"
+      --replace-fail "hatchling==1.18.0" "hatchling"
   '';
 
-  nativeBuildInputs = [
-    hatchling
-  ];
+  nativeBuildInputs = [ hatchling ];
 
   passthru.optional-dependencies = {
-    PySPX = [
-      pyspx
-    ];
+    PySPX = [ pyspx ];
     awskms = [
       boto3
       botocore
@@ -53,9 +50,7 @@ buildPythonPackage rec {
       azure-keyvault-keys
       cryptography
     ];
-    crypto = [
-      cryptography
-    ];
+    crypto = [ cryptography ];
     gcpkms = [
       cryptography
       google-cloud-kms
@@ -63,11 +58,9 @@ buildPythonPackage rec {
     hsm = [
       asn1crypto
       cryptography
-    #   pykcs11
-    ];
-    pynacl = [
-      pynacl
+      #   pykcs11
     ];
+    pynacl = [ pynacl ];
     # Circular dependency
     # sigstore = [
     #   sigstore
@@ -79,9 +72,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
-  pythonImportsCheck = [
-    "securesystemslib"
-  ];
+  pythonImportsCheck = [ "securesystemslib" ];
 
   disabledTestPaths = [
     # pykcs11 is not available
@@ -98,4 +89,3 @@ buildPythonPackage rec {
     maintainers = with maintainers; [ fab ];
   };
 }
-
diff --git a/pkgs/development/python-modules/sigstore-rekor-types/default.nix b/pkgs/development/python-modules/sigstore-rekor-types/default.nix
index b7d96f9ed10e..7498a29ee104 100644
--- a/pkgs/development/python-modules/sigstore-rekor-types/default.nix
+++ b/pkgs/development/python-modules/sigstore-rekor-types/default.nix
@@ -1,14 +1,15 @@
-{ lib
-, pythonOlder
-, pydantic
-, flit-core
-, fetchFromGitHub
-, buildPythonPackage
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  flit-core,
+  pydantic,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "sigstore-rekor-types";
-  version = "0.0.12";
+  version = "0.0.11";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,16 +18,12 @@ buildPythonPackage rec {
     owner = "trailofbits";
     repo = "sigstore-rekor-types";
     rev = "refs/tags/v${version}";
-    hash = "sha256-B6u2YbtZtgjYJoWL2DfgP7LL20onNaaTTFbC6JIA4bE=";
+    hash = "sha256-oOFdRiDp9USc3A+aaPExprEO2i/RERNahiyi2kVpkns=";
   };
 
-  nativeBuildInputs = [
-    flit-core
-  ];
+  build-system = [ flit-core ];
 
-  propagatedBuildInputs = [
-    pydantic
-  ] ++ pydantic.optional-dependencies.email;
+  dependencies = [ pydantic ] ++ pydantic.optional-dependencies.email;
 
   # Module has no tests
   doCheck = false;
diff --git a/pkgs/development/python-modules/sigstore/default.nix b/pkgs/development/python-modules/sigstore/default.nix
index 144b1daac21c..804e2fb69d89 100644
--- a/pkgs/development/python-modules/sigstore/default.nix
+++ b/pkgs/development/python-modules/sigstore/default.nix
@@ -1,28 +1,29 @@
-{ lib
-, appdirs
-, buildPythonPackage
-, cryptography
-, fetchFromGitHub
-, flit-core
-, id
-, importlib-resources
-, pretend
-, pydantic
-, pyjwt
-, pyopenssl
-, pytestCheckHook
-, requests
-, rich
-, securesystemslib
-, sigstore-protobuf-specs
-, sigstore-rekor-types
-, tuf
-, pythonOlder
+{
+  lib,
+  appdirs,
+  buildPythonPackage,
+  cryptography,
+  fetchFromGitHub,
+  flit-core,
+  id,
+  importlib-resources,
+  pretend,
+  pydantic,
+  pyjwt,
+  pyopenssl,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  rich,
+  securesystemslib,
+  sigstore-protobuf-specs,
+  sigstore-rekor-types,
+  tuf,
 }:
 
 buildPythonPackage rec {
   pname = "sigstore-python";
-  version = "2.1.0";
+  version = "2.1.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -31,14 +32,12 @@ buildPythonPackage rec {
     owner = "sigstore";
     repo = "sigstore-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WH6Pme8ZbfW5xqBT056eVJ3HZP1D/lAULtyN6k0uMaA=";
+    hash = "sha256-lqmrM4r1yPVCcvWNC9CKYMyryuIyliI2Y+TAYgAwA1Y=";
   };
 
-  nativeBuildInputs = [
-    flit-core
-  ];
+  build-system = [ flit-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     appdirs
     cryptography
     id
@@ -63,9 +62,7 @@ buildPythonPackage rec {
     export HOME=$(mktemp -d)
   '';
 
-  pythonImportsCheck = [
-    "sigstore"
-  ];
+  pythonImportsCheck = [ "sigstore" ];
 
   disabledTests = [
     # Tests require network access
@@ -82,10 +79,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "A codesigning tool for Python packages";
-    mainProgram = "sigstore";
     homepage = "https://github.com/sigstore/sigstore-python";
     changelog = "https://github.com/sigstore/sigstore-python/blob/${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
+    mainProgram = "sigstore";
   };
 }