diff --git a/deps/botan/default.nix b/deps/botan/default.nix
deleted file mode 100644
index 2b5cae02e..000000000
--- a/deps/botan/default.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  pkgs
-}:
-let
-  cpuFlag = if pkgs.stdenv.system == "i686-linux" then "x86_32" else "x86_64";
-in
-pkgs.botan2.overrideAttrs (oldAttrs: {
-
-  postInstall = (oldAttrs.postInstall or "") + ''
-    ln -sr "$out/include/botan-2/botan" "$out/include"
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    make -j $NIX_BUILD_CORES
-
-    runHook postBuild
-  '';
-})
diff --git a/deps/botan/WIP.md b/deps/botan2/WIP.md
similarity index 100%
rename from deps/botan/WIP.md
rename to deps/botan2/WIP.md
diff --git a/deps/botan2/default.nix b/deps/botan2/default.nix
new file mode 100644
index 000000000..cc10cc0cf
--- /dev/null
+++ b/deps/botan2/default.nix
@@ -0,0 +1,32 @@
+{
+  pkgs
+}:
+let
+  cpuFlag = if pkgs.stdenv.system == "i686-linux" then "x86_32" else "x86_64";
+
+  self = pkgs.botan2;
+
+  dev = pkgs.libs.getDev self;
+  lib = pkgs.libs.getLib self;
+in
+  self.overrideAttrs (oldAttrs: {
+
+    postInstall = (oldAttrs.postInstall or "") + ''
+      ln -sr "$out/include/botan-2/botan" "$out/include"
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+
+      make -j $NIX_BUILD_CORES
+
+      runHook postBuild
+    '';
+  })
+
+  passthru = (oldAttrs.passthru or {}) // {
+    include_root = "${dev}/include";
+    include = "${dev}/include/botan-2";  # include/botan2/botan/*.h
+    lib = "${lib}/lib";
+  };
+})
diff --git a/deps/http-parser/default.nix b/deps/http-parser/default.nix
index 45e3e7aa7..895f10d3d 100644
--- a/deps/http-parser/default.nix
+++ b/deps/http-parser/default.nix
@@ -7,17 +7,28 @@ let
   # TODO: Upstream doesn't use that subdir though, so better fix IncludeOS
   # sources.
   #
-  # Uses a more recent version of nixpkgs to get support for static builds
+  # Uses a more recent version of nixpkgs to get support for static builds  # TODO: verify if still obsolete
   nixpkgsHttpfix = builtins.fetchTarball {
       url = "https://github.com/NixOS/nixpkgs/archive/33f464b661f939689aa56af6b6e27b504c5afb93.tar.gz";
       sha256 = "15bdlccjg14qa7lwkcc7pikvi386ig108ca62hbxfas5wyw1fr62";
   };
   pkgsHttpfix = import nixpkgsHttpfix { crossSystem = { config = stdenv.targetPlatform.config; }; };
+  pkgs = pkgsHttpfix.pkgsStatic;
+
+  self = pkgs.http-parser;
+
+  dev = pkgs.lib.getDev self;
+  lib = pkgs.lib.getLib self;
 in
-  pkgsHttpfix.pkgsStatic.http-parser.overrideAttrs (oldAttrs: {
+  self.overrideAttrs (oldAttrs: {
     inherit stdenv;
     postInstall = (oldAttrs.postInstall or "") + ''
       mkdir "$out/include/http-parser"
       ln -sr "$out/include/http_parser.h" "$out/include/http-parser"
     '';
+    passthru = (oldAttrs.passthru or {}) // {
+      include_root = "${dev}/include";
+      include = "${dev}/include";  # TODO: consider subdir?
+      lib = "${self}/lib";
+    };
   })
diff --git a/deps/lest/default.nix b/deps/lest/default.nix
index 37ad42d8d..185a05b4a 100644
--- a/deps/lest/default.nix
+++ b/deps/lest/default.nix
@@ -2,27 +2,38 @@
   pkgs,
   stdenv
 }:
-stdenv.mkDerivation rec {
-  pname = "lest";
-  version = "1.36.0";
+let
+  self = stdenv.mkDerivation rec {
+    pname = "lest";
+    version = "1.36.0";
 
-  meta = {
-    description = "A tiny C++11 test framework – lest errors escape testing.";
-    homepage = "https://github.com/martinmoene/lest";
-    license = pkgs.lib.licenses.boost;
-  };
+    meta = {
+      description = "A tiny C++11 test framework – lest errors escape testing.";
+      homepage = "https://github.com/martinmoene/lest";
+      license = pkgs.lib.licenses.boost;
+    };
 
-  src = fetchGit {
-    url = "https://github.com/martinmoene/lest.git";
-    ref = "refs/tags/v${version}";
-    rev = "57197f32f2c7d3f3d3664a9010d3ff181a40f6ca";
-  };
+    src = fetchGit {
+      url = "https://github.com/martinmoene/lest.git";
+      ref = "refs/tags/v${version}";
+      rev = "57197f32f2c7d3f3d3664a9010d3ff181a40f6ca";
+    };
 
-  cmakeBuildType = "Debug";
+    cmakeBuildType = "Debug";
 
-  postBuild = ''
-      mkdir -p "$out/include"
-      cp -r include "$out/"
-    '';
+    postBuild = ''
+        mkdir -p "$out/include"
+        cp -r include "$out/"
+      '';
+  };
 
-}
+  dev = pkgs.lib.getDev self;
+  lib = pkgs.lib.getLib self;
+in
+  self.overrideAttrs (prev: {
+    passthru = (prev.passthru or {}) // {
+      include_root = "${dev}/include";
+      include = "${dev}/include/lest";
+      # lib = "${self}";  # TODO: consider precompiling
+    };
+  })
diff --git a/deps/libfdt/CMakeLists.txt b/deps/libfdt/CMakeLists.txt
deleted file mode 100644
index d54f7ad32..000000000
--- a/deps/libfdt/CMakeLists.txt
+++ /dev/null
@@ -1,29 +0,0 @@
-cmake_minimum_required(VERSION 3.31.6)
-
-project(libfdt)
-
-set(SRC_S
-  dtc/libfdt/fdt.c
-  dtc/libfdt/fdt_ro.c
-  dtc/libfdt/fdt_wip.c
-  dtc/libfdt/fdt_sw.c
-  dtc/libfdt/fdt_rw.c
-  dtc/libfdt/fdt_strerror.c
-  dtc/libfdt/fdt_empty_tree.c
-  dtc/libfdt/fdt_addresses.c
-  dtc/libfdt/fdt_overlay.c
-)
-
-set(HEADERS
-  dtc/libfdt/fdt.h
-  dtc/libfdt/libfdt.h
-  dtc/libfdt/libfdt_env.h
-)
-
-include_directories(dtc/libfdt)
-
-add_library(fdt STATIC ${SRC_S})
-
-INSTALL(TARGETS fdt DESTINATION "lib")
-
-INSTALL(FILES ${HEADERS} DESTINATION "include")
diff --git a/deps/libfdt/clang-no-suggest-attr-format.patch b/deps/libfdt/clang-no-suggest-attr-format.patch
new file mode 100644
index 000000000..e063104c1
--- /dev/null
+++ b/deps/libfdt/clang-no-suggest-attr-format.patch
@@ -0,0 +1,16 @@
+diff --git a/Makefile b/Makefile
+index f1f0ab3..edbcb4a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -20,7 +20,10 @@ ASSUME_MASK ?= 0
+ CPPFLAGS = -I libfdt -I . -DFDT_ASSUME_MASK=$(ASSUME_MASK)
+ WARNINGS = -Wall -Wpointer-arith -Wcast-qual -Wnested-externs -Wsign-compare \
+ 	-Wstrict-prototypes -Wmissing-prototypes -Wredundant-decls -Wshadow \
+-	-Wsuggest-attribute=format -Wwrite-strings
++	-Wwrite-strings
++ifeq ($(findstring gcc,$(notdir $(CC))),gcc)
++WARNINGS += -Wsuggest-attribute=format
++endif
+ CFLAGS = -g -Os $(SHAREDLIB_CFLAGS) -Werror $(WARNINGS) $(EXTRA_CFLAGS)
+
+ BISON = bison
diff --git a/deps/libfdt/default.nix b/deps/libfdt/default.nix
new file mode 100644
index 000000000..4614fb11b
--- /dev/null
+++ b/deps/libfdt/default.nix
@@ -0,0 +1,48 @@
+{
+  pkgs,
+  stdenv
+}:
+
+let
+  self = stdenv.mkDerivation rec {
+    pname = "libfdt";
+    version = "1.7.2";
+    src = pkgs.fetchzip {
+      url = "https://mirrors.edge.kernel.org/pub/software/utils/dtc/dtc-${version}.tar.xz";
+      hash = "sha256-KZCzrvdWd6zfQHppjyp4XzqNCfH2UnuRneu+BNIRVAY=";
+    };
+    meta.license = pkgs.lib.licenses.bsd2;
+
+    nativeBuildInputs = with pkgs.buildPackages; [
+      pkg-config flex bison
+    ];
+    outputs = [ "out" "dev" ];
+
+    patches = [
+      ./clang-no-suggest-attr-format.patch  # TODO: upstream
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+      make -j"$NIX_BUILD_CORES" libfdt/libfdt.a
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      install -D -m644 -t "$out/lib/" libfdt/libfdt.a
+      install -D -m644 -t "$dev/include/fdt" libfdt/*.h
+      runHook postInstall
+    '';
+  };
+
+  dev = pkgs.lib.getDev self;
+in
+  self.overrideAttrs (prev: {
+    passthru = {
+      include_root = "${dev}/include";
+      include      = "${dev}/include/fdt";
+      lib          = "${self}/lib";
+    };
+  })
+
diff --git a/deps/libfmt/default.nix b/deps/libfmt/default.nix
index 2bf00f857..f186fcb55 100644
--- a/deps/libfmt/default.nix
+++ b/deps/libfmt/default.nix
@@ -6,7 +6,7 @@
   cmake ? pkgs.cmake
 }:
 let
-  libfmt = stdenv.mkDerivation rec {
+  self = stdenv.mkDerivation rec {
     pname = "fmt";
     version = "12.0.0";
 
@@ -28,8 +28,11 @@ let
       "-DFMT_INSTALL=ON"
     ];
   };
+
+  dev = pkgs.lib.getDev self;
+  lib = pkgs.lib.getLib self;
 in
-  libfmt // {
-    include = "${libfmt}/include";
-    lib = "${libfmt}/lib";
+  self // {
+    include = "${self}/include";
+    lib = "${self}/lib";
   }
diff --git a/deps/musl-unpatched/default.nix b/deps/musl-unpatched/default.nix
index 9fbb4e2de..cc8ca7092 100644
--- a/deps/musl-unpatched/default.nix
+++ b/deps/musl-unpatched/default.nix
@@ -3,35 +3,42 @@ stdenv
 , pkgs
 , linuxHeaders ? null
 }:
-stdenv.mkDerivation rec {
-  pname = "musl-unpatched";
-  version = "1.2.5";
+let
+  self = stdenv.mkDerivation rec {
+    pname = "musl-unpatched";
+    version = "1.2.5";
 
-  src = fetchGit {
-    url = "git://git.musl-libc.org/musl";
-    rev = "0784374d561435f7c787a555aeab8ede699ed298";
-  };
+    src = fetchGit {
+      url = "git://git.musl-libc.org/musl";
+      rev = "0784374d561435f7c787a555aeab8ede699ed298";
+    };
 
-  enableParallelBuilding = true;
+    enableParallelBuilding = true;
 
-  configurePhase = ''
-    echo "Configuring with musl's configure script"
-    echo "Target platform is ${stdenv.targetPlatform.config}"
-    ./configure --prefix=$out --with-malloc=oldmalloc --disable-shared --enable-debug CROSS_COMPILE=${stdenv.targetPlatform.config}-
-  '';
+    configurePhase = ''
+      echo "Configuring with musl's configure script"
+      echo "Target platform is ${stdenv.targetPlatform.config}"
+      ./configure --prefix=$out --with-malloc=oldmalloc --disable-shared --enable-debug CROSS_COMPILE=${stdenv.targetPlatform.config}-
+    '';
 
-  # Copy linux headers - taken from upstream nixpkgs musl, needed for libcxx to build
-  postInstall = ''
-    (cd $out/include && ln -s $(ls -d ${linuxHeaders}/include/* | grep -v "scsi$") .)
-  '';
+    # Copy linux headers - taken from upstream nixpkgs musl, needed for libcxx to build
+    postInstall = ''
+      (cd $out/include && ln -s $(ls -d ${linuxHeaders}/include/* | grep -v "scsi$") .)
+    '';
 
-  CFLAGS = "-Wno-error=int-conversion -nostdinc";
+    CFLAGS = "-Wno-error=int-conversion -nostdinc";
 
-  passthru.linuxHeaders = linuxHeaders;
+    passthru.linuxHeaders = linuxHeaders;
 
-  meta = {
-    description = "musl - Linux based libc (unpatched)";
-    homepage = "https://www.musl-libc.org/";
-    license = pkgs.lib.licenses.mit;
+    meta = {
+      description = "musl - Linux based libc (unpatched)";
+      homepage = "https://www.musl-libc.org/";
+      license = pkgs.lib.licenses.mit;
+    };
   };
-}
+
+  dev = pkgs.lib.getDev self;
+  lib = pkgs.lib.getLib self;
+in
+  self.overrideAttrs (oldAttrs: {
+  })
diff --git a/deps/musl/default.nix b/deps/musl/default.nix
index c3070d334..a2ea8adad 100644
--- a/deps/musl/default.nix
+++ b/deps/musl/default.nix
@@ -3,45 +3,52 @@ stdenv
 , pkgs
 , linuxHeaders ? null
 }:
-stdenv.mkDerivation rec {
-  pname = "musl-includeos";
-  version = "1.2.5";
+let
+  self = stdenv.mkDerivation rec {
+    pname = "musl-includeos";
+    version = "1.2.5";
 
-  src = fetchGit {
-    url = "git://git.musl-libc.org/musl";
-    rev = "0784374d561435f7c787a555aeab8ede699ed298";
-  };
+    src = fetchGit {
+      url = "git://git.musl-libc.org/musl";
+      rev = "0784374d561435f7c787a555aeab8ede699ed298";
+    };
 
-  enableParallelBuilding = true;
+    enableParallelBuilding = true;
 
-  patches = [
-    ./patches/musl.patch
-    ./patches/endian.patch
-  ];
+    patches = [
+      ./patches/musl.patch
+      ./patches/endian.patch
+    ];
 
-  passthru.linuxHeaders = linuxHeaders;
+    passthru.linuxHeaders = linuxHeaders;
 
-  postUnpack = ''
-    echo "Replacing musl's syscall headers with IncludeOS syscalls"
+    postUnpack = ''
+      echo "Replacing musl's syscall headers with IncludeOS syscalls"
 
-    cp ${./patches/includeos_syscalls.h} $sourceRoot/src/internal/includeos_syscalls.h
-    cp ${./patches/syscall.h} $sourceRoot/src/internal/syscall.h
+      cp ${./patches/includeos_syscalls.h} $sourceRoot/src/internal/includeos_syscalls.h
+      cp ${./patches/syscall.h} $sourceRoot/src/internal/syscall.h
 
-    rm $sourceRoot/arch/x86_64/syscall_arch.h
-    rm $sourceRoot/arch/i386/syscall_arch.h
-  '';
+      rm $sourceRoot/arch/x86_64/syscall_arch.h
+      rm $sourceRoot/arch/i386/syscall_arch.h
+    '';
 
- configurePhase = ''
-    echo "Configuring with musl's configure script"
-    echo "Target platform is ${stdenv.targetPlatform.config}"
-    ./configure --prefix=$out --disable-shared --enable-debug --with-malloc=oldmalloc CROSS_COMPILE=${stdenv.targetPlatform.config}-
-  '';
+   configurePhase = ''
+      echo "Configuring with musl's configure script"
+      echo "Target platform is ${stdenv.targetPlatform.config}"
+      ./configure --prefix=$out --disable-shared --enable-debug --with-malloc=oldmalloc CROSS_COMPILE=${stdenv.targetPlatform.config}-
+    '';
 
-  CFLAGS = "-Wno-error=int-conversion -nostdinc";
+    CFLAGS = "-Wno-error=int-conversion -nostdinc";
 
-  meta = {
-    description = "musl - Linux based libc, built with IncludeOS linux-like syscalls";
-    homepage = "https://www.musl-libc.org/";
-    license = pkgs.lib.licenses.mit;
+    meta = {
+      description = "musl - Linux based libc, built with IncludeOS linux-like syscalls";
+      homepage = "https://www.musl-libc.org/";
+      license = pkgs.lib.licenses.mit;
+    };
   };
-}
+
+  dev = pkgs.lib.getDev self;
+  lib = pkgs.lib.getLib self;
+in
+  self.overrideAttrs (oldAttrs: {
+  })
diff --git a/deps/s2n-tls/default.nix b/deps/s2n-tls/default.nix
new file mode 100644
index 000000000..ca545d883
--- /dev/null
+++ b/deps/s2n-tls/default.nix
@@ -0,0 +1,65 @@
+# This build is dynamic
+{
+  pkgs,
+  stdenv
+}:
+let
+  self = stdenv.mkDerivation rec {
+    pname = "s2n-tls";
+    # ./conanfile.py lists 0.8, but there are not tags in the repo with version < 0.9.0
+    version = "0.9.0";
+
+    src = pkgs.fetchzip {
+      url = "https://github.com/aws/s2n-tls/archive/v${version}.tar.gz";
+      sha256 = "18qjqc2jrpiwdpzqxl6hl1cq0nfmqk8qas0ijpwr0g606av0aqm9";  # v0.9.0
+      # hash = "sha256-aJRw1a/XJivNZS3NkZ4U6nC12+wY/aoNv33mbAzNl0k=";  # v1.5.27
+    };
+
+    patches = [ ./fix-strict-prototypes.patch ];
+
+    buildInputs = [
+      pkgs.pkgsStatic.openssl
+    ];
+
+    # ld: cannot find -lgcc_eh: No such file or directory
+    # ld: have you installed the static version of the gcc_eh library ?
+    buildPhase = ''
+      runHook preBuild
+
+      make bin
+
+      runHook postBuild
+    '';
+
+    # Upstream Makefile has no install target
+    # FIXME: looks like it does now: https://github.com/aws/s2n-tls/blame/73720795dbc37d295592f427e8c225cfafef39a0/Makefile#L106
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p "$out/include"
+      cp api/s2n.h "$out/include"
+
+      mkdir -p "$out/lib"
+      cp lib/libs2n.a lib/libs2n.so "$out/lib"
+
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "An implementation of the TLS/SSL protocols";
+      homepage = "https://github.com/aws/s2n-tls";
+      license = pkgs.lib.licenses.asl20;
+    };
+  };
+
+  dev = pkgs.lib.getDev self;
+  lib = pkgs.lib.getLib self;
+in
+  self.overrideAttrs (oldAttrs: {
+    # TODO: verify the {include, lib} paths. commented are Gentoo artifacts
+    passthru = (prev.passthru or {}) // {
+      include_root = "${dev}/include"; # /usr/include/s2n.h
+      include = "${dev}/include/s2n";  # /usr/include/s2n/unstable/*.h
+      lib = "${self}/lib";  # /usr/lib64 on Gentoo...
+    };
+  })
diff --git a/deps/s2n-tls/fix-strict-prototypes.patch b/deps/s2n-tls/fix-strict-prototypes.patch
new file mode 100644
index 000000000..ccc9a4b6c
--- /dev/null
+++ b/deps/s2n-tls/fix-strict-prototypes.patch
@@ -0,0 +1,142 @@
+diff --git a/crypto/s2n_aead_cipher_aes_gcm.c b/crypto/s2n_aead_cipher_aes_gcm.c
+index 36820ab20..1c12eb4ed 100644
+--- a/crypto/s2n_aead_cipher_aes_gcm.c
++++ b/crypto/s2n_aead_cipher_aes_gcm.c
+@@ -23,12 +23,12 @@
+ #include "utils/s2n_safety.h"
+ #include "utils/s2n_blob.h"
+ 
+-static uint8_t s2n_aead_cipher_aes128_gcm_available()
++static uint8_t s2n_aead_cipher_aes128_gcm_available(void)
+ {
+     return (EVP_aes_128_gcm() ? 1 : 0);
+ }
+ 
+-static uint8_t s2n_aead_cipher_aes256_gcm_available()
++static uint8_t s2n_aead_cipher_aes256_gcm_available(void)
+ {
+     return (EVP_aes_256_gcm() ? 1 : 0);
+ }
+diff --git a/crypto/s2n_cbc_cipher_3des.c b/crypto/s2n_cbc_cipher_3des.c
+index 0a9aae2ed..3e7cc3227 100644
+--- a/crypto/s2n_cbc_cipher_3des.c
++++ b/crypto/s2n_cbc_cipher_3des.c
+@@ -23,7 +23,7 @@
+ #include "utils/s2n_safety.h"
+ #include "utils/s2n_blob.h"
+ 
+-static uint8_t s2n_cbc_cipher_3des_available()
++static uint8_t s2n_cbc_cipher_3des_available(void)
+ {
+     return (EVP_des_ede3_cbc() ? 1 : 0);
+ }
+diff --git a/crypto/s2n_cbc_cipher_aes.c b/crypto/s2n_cbc_cipher_aes.c
+index a504fd103..8818a5f8d 100644
+--- a/crypto/s2n_cbc_cipher_aes.c
++++ b/crypto/s2n_cbc_cipher_aes.c
+@@ -23,12 +23,12 @@
+ #include "utils/s2n_safety.h"
+ #include "utils/s2n_blob.h"
+ 
+-static uint8_t s2n_cbc_cipher_aes128_available()
++static uint8_t s2n_cbc_cipher_aes128_available(void)
+ {
+     return (EVP_aes_128_cbc() ? 1 : 0);
+ }
+ 
+-static uint8_t s2n_cbc_cipher_aes256_available()
++static uint8_t s2n_cbc_cipher_aes256_available(void)
+ {
+     return (EVP_aes_256_cbc() ? 1 : 0);
+ }
+diff --git a/crypto/s2n_stream_cipher_null.c b/crypto/s2n_stream_cipher_null.c
+index 2d2093ca4..5ff3ea6be 100644
+--- a/crypto/s2n_stream_cipher_null.c
++++ b/crypto/s2n_stream_cipher_null.c
+@@ -20,7 +20,7 @@
+ #include "utils/s2n_safety.h"
+ #include "utils/s2n_blob.h"
+ 
+-static uint8_t s2n_stream_cipher_null_available()
++static uint8_t s2n_stream_cipher_null_available(void)
+ {
+     return 1;
+ }
+diff --git a/crypto/s2n_stream_cipher_rc4.c b/crypto/s2n_stream_cipher_rc4.c
+index bf94aad7a..8abd3223f 100644
+--- a/crypto/s2n_stream_cipher_rc4.c
++++ b/crypto/s2n_stream_cipher_rc4.c
+@@ -21,7 +21,7 @@
+ #include "utils/s2n_safety.h"
+ #include "utils/s2n_blob.h"
+ 
+-static uint8_t s2n_stream_cipher_rc4_available()
++static uint8_t s2n_stream_cipher_rc4_available(void)
+ {
+     return (EVP_rc4() ? 1 : 0);
+ }
+diff --git a/utils/s2n_map.c b/utils/s2n_map.c
+index b76d44057..4d4d78272 100644
+--- a/utils/s2n_map.c
++++ b/utils/s2n_map.c
+@@ -81,7 +81,7 @@ static int s2n_map_embiggen(struct s2n_map *map, uint32_t capacity)
+     return 0;
+ }
+ 
+-struct s2n_map *s2n_map_new()
++struct s2n_map *s2n_map_new(void)
+ {
+     struct s2n_blob mem = {0};
+     struct s2n_map *map;
+diff --git a/utils/s2n_map.h b/utils/s2n_map.h
+index abea548f1..25a5a4bab 100644
+--- a/utils/s2n_map.h
++++ b/utils/s2n_map.h
+@@ -22,7 +22,7 @@
+ 
+ struct s2n_map;
+ 
+-extern struct s2n_map *s2n_map_new();
++extern struct s2n_map *s2n_map_new(void);
+ extern int s2n_map_add(struct s2n_map *map, struct s2n_blob *key, struct s2n_blob *value);
+ extern int s2n_map_put(struct s2n_map *map, struct s2n_blob *key, struct s2n_blob *value);
+ extern int s2n_map_complete(struct s2n_map *map);
+diff --git a/utils/s2n_random.c b/utils/s2n_random.c
+index 6066d1564..4a2100ac7 100644
+--- a/utils/s2n_random.c
++++ b/utils/s2n_random.c
+@@ -313,7 +313,7 @@ int s2n_set_private_drbg_for_test(struct s2n_drbg drbg)
+ }
+ 
+ 
+-int s2n_cpu_supports_rdrand()
++int s2n_cpu_supports_rdrand(void)
+ {
+ #if ((defined(__x86_64__) || defined(__i386__)) && (defined(__clang__) || S2N_GCC_VERSION_AT_LEAST(4,3,0)))
+     uint32_t eax, ebx, ecx, edx;
+diff --git a/utils/s2n_safety.c b/utils/s2n_safety.c
+index 7e110b75f..90339d926 100644
+--- a/utils/s2n_safety.c
++++ b/utils/s2n_safety.c
+@@ -29,7 +29,7 @@
+  * Returns:
+  *  The process ID of the current process
+  */
+-pid_t s2n_actual_getpid()
++pid_t s2n_actual_getpid(void)
+ {
+ #if defined(__GNUC__) && defined(SYS_getpid)
+     /* http://yarchive.net/comp/linux/getpid_caching.html */
+diff --git a/utils/s2n_safety.h b/utils/s2n_safety.h
+index 5768f86f8..5f9fad752 100644
+--- a/utils/s2n_safety.h
++++ b/utils/s2n_safety.h
+@@ -108,7 +108,7 @@ static inline void* trace_memcpy_check(void *restrict to, const void *restrict f
+  * Returns:
+  *  The process ID of the current process
+  */
+-extern pid_t s2n_actual_getpid();
++extern pid_t s2n_actual_getpid(void);
+ 
+ /* Returns 1 if a and b are equal, in constant time */
+ extern int s2n_constant_time_equals(const uint8_t * a, const uint8_t * b, uint32_t len);
diff --git a/deps/s2n/default.nix b/deps/s2n/default.nix
deleted file mode 100644
index a4ea517b5..000000000
--- a/deps/s2n/default.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-# This build is dynamic
-{
-  pkgs,
-  stdenv
-}:
-stdenv.mkDerivation rec {
-  pname = "s2n-tls";
-  # ./conanfile.py lists 0.8, but there are not tags in the repo with version < 0.9.0
-  version = "0.9.0";
-
-  src = pkgs.fetchzip {
-    url = "https://github.com/aws/s2n-tls/archive/v${version}.tar.gz";
-    sha256 = "18qjqc2jrpiwdpzqxl6hl1cq0nfmqk8qas0ijpwr0g606av0aqm9";
-  };
-
-  buildInputs = [
-    pkgs.pkgsStatic.openssl
-  ];
-
-  # the default 'all' target depends on tests which are broken (see below)
-  buildPhase = ''
-    runHook preBuild
-
-    make bin
-
-    runHook postBuild
-  '';
-
-  # TODO: tests fail:
-  # make -C unit
-  # make[2]: Entering directory '/build/source/tests/unit'
-  # Running s2n_3des_test.c                                    ... FAILED test 1
-  # !((conn = s2n_connection_new(S2N_SERVER)) == (((void *)0))) is not true  (s2n_3des_test.c line 44)
-  # Error Message: 'error calling mlock (Did you run prlimit?)'
-  #  Debug String: 'Error encountered in s2n_mem.c line 103'
-  # make[2]: *** [Makefile:44: s2n_3des_test] Error 1
-  doCheck = false;
-
-  # Upstream Makefile has no install target
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p "$out/include"
-    cp api/s2n.h "$out/include"
-
-    mkdir -p "$out/lib"
-    cp lib/libs2n.a lib/libs2n.so "$out/lib"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "An implementation of the TLS/SSL protocols";
-    homepage = "https://github.com/aws/s2n-tls";
-    license = pkgs.lib.licenses.asl20;
-  };
-}
diff --git a/deps/uzlib/default.nix b/deps/uzlib/default.nix
index d1c39e88f..4da7be7ca 100644
--- a/deps/uzlib/default.nix
+++ b/deps/uzlib/default.nix
@@ -2,60 +2,72 @@
   pkgs,
   stdenv
 }:
+let
+  self = stdenv.mkDerivation rec {
+    pname = "uzlib";
 
-stdenv.mkDerivation rec {
-  pname = "uzlib";
+    # TODO: update?
+    # Latest version, seems incompatible with IncludeOS.
+    #version = "2.9.5";
+    #
+    #src = fetchzip {
+    #  url = "https://github.com/pfalcon/uzlib/archive/v${version}.tar.gz";
+    #  sha256 = "01l5y3rwa9935bqlrgww71zr83mbdinq69xzk2gfk96adgjvrl7k";
+    #};
 
-  # Latest version, seems incompatible with IncludeOS.
-  #version = "2.9.5";
-  #
-  #src = fetchzip {
-  #  url = "https://github.com/pfalcon/uzlib/archive/v${version}.tar.gz";
-  #  sha256 = "01l5y3rwa9935bqlrgww71zr83mbdinq69xzk2gfk96adgjvrl7k";
-  #};
+    # same version as listed in ./conanfile.py
+    version = "2.1.1";
 
-  # same version as listed in ./conanfile.py
-  version = "2.1.1";
+    src = pkgs.fetchzip {
+      url = "https://github.com/pfalcon/uzlib/archive/v${version}.tar.gz";
+      sha256 = "1bdbfkxq648blh6v7lvvy1dhrykmib1kzpgjh1fb5zhzq5xib9b2";
+    };
 
-  src = pkgs.fetchzip {
-    url = "https://github.com/pfalcon/uzlib/archive/v${version}.tar.gz";
-    sha256 = "1bdbfkxq648blh6v7lvvy1dhrykmib1kzpgjh1fb5zhzq5xib9b2";
-  };
+    # v2.1.1 has no top-level Makefile
+    buildPhase = ''
+      make -C src -f makefile.elf
+    '';
+
+    postPatch = ''
+      echo 'Replacing gcc with $(CC) in makefile.elf'
+      sed 's/gcc/$(CC)/g' -i ./src/makefile.elf
+      sed 's/ar /$(AR) /g' -i ./src/makefile.elf
+      sed 's/ranlib /$(RANLIB) /g' -i ./src/makefile.elf
+    '';
+
+    # Upstream doesn't have an install target (not even in the latest version)
+    installPhase = ''
+      runHook preInstall
+
+      #ls -lR
 
-  # v2.1.1 has no top-level Makefile
-  buildPhase = ''
-    make -C src -f makefile.elf
-  '';
-
-  postPatch = ''
-    echo 'Replacing gcc with $(CC) in makefile.elf'
-    sed 's/gcc/$(CC)/g' -i ./src/makefile.elf
-    sed 's/ar /$(AR) /g' -i ./src/makefile.elf
-    sed 's/ranlib /$(RANLIB) /g' -i ./src/makefile.elf
-  '';
-
-  # Upstream doesn't have an install target (not even in the latest version)
-  installPhase = ''
-    runHook preInstall
-
-    #ls -lR
-
-    mkdir -p "$out/include"
-    cp src/tinf.h "$out/include"
-    #cp src/tinf_compat.h "$out/include"  # doesn't exist in v2.1.1
-    #cp src/uzlib.h "$out/include"  # doesn't exist in v2.1.1
-    cp src/defl_static.h "$out/include"
-    #cp src/uzlib_conf.h "$out/include"  # doesn't exist in v2.1.1
-
-    mkdir -p "$out/lib"
-    cp lib/libtinf.a "$out/lib"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Radically unbloated DEFLATE/zlib/gzip compression/decompression library";
-    homepage = "https://github.com/pfalcon/uzlib";
-    license = pkgs.lib.licenses.zlib;
+      mkdir -p "$out/include"
+      cp src/tinf.h "$out/include"
+      #cp src/tinf_compat.h "$out/include"  # doesn't exist in v2.1.1
+      #cp src/uzlib.h "$out/include"  # doesn't exist in v2.1.1
+      cp src/defl_static.h "$out/include"
+      #cp src/uzlib_conf.h "$out/include"  # doesn't exist in v2.1.1
+
+      mkdir -p "$out/lib"
+      cp lib/libtinf.a "$out/lib"
+
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "Radically unbloated DEFLATE/zlib/gzip compression/decompression library";
+      homepage = "https://github.com/pfalcon/uzlib";
+      license = pkgs.lib.licenses.zlib;
+    };
   };
-}
+
+  dev = pkgs.lib.getDev self;
+  lib = pkgs.lib.getLib self;
+in
+  self.overrideAttrs (prev: {
+    passthru = (prev.passthru or {}) // {
+      include_root = "${dev}/include";
+      include = "${dev}/include";  # TODO: consider subdir?
+      lib = "${self}/lib";
+    };
+  })
diff --git a/develop.nix b/develop.nix
index 74f59ac39..748314f7c 100644
--- a/develop.nix
+++ b/develop.nix
@@ -72,6 +72,22 @@ includeos.pkgs.mkShell.override { inherit (includeos) stdenv; } rec {
       -D ARCH=${arch} \
       -D CMAKE_MODULE_PATH=${includeos}/cmake
 
+    # TODO: missing s2n-tls (postponed in overlay.nix)
+    DEP_INCLUDE_PATH="$(
+      for d in \
+        "$IOS_SRC/test/lest_util" \
+        "${includeos.botan2.include}" \
+        "${includeos.http-parser.include}" \
+        "${includeos.lest.include}" \
+        "${includeos.libfdt.include}" \
+        "${includeos.uzlib.include}" \
+        "${includeos.pkgs.rapidjson}/include" \
+        "${includeos.pkgs.openssl}/include"
+      do
+        printf ' -I %s' "$d"
+      done
+    )"
+
     # procuced by CMake
     CCDB="${buildpath}/compile_commands.json"
 
@@ -83,20 +99,20 @@ includeos.pkgs.mkShell.override { inherit (includeos) stdenv; } rec {
     jq \
       --arg libcxx "${includeos.libraries.libcxx.include}" \
       --arg libc "${includeos.libraries.libc}"             \
-      --arg libfmt "${includeos.passthru.libfmt.include}"  \
       --arg localsrc "${toString ./.}"                     \
+      --arg extra "$DEP_INCLUDE_PATH"                      \
       '
       map(.command |= ( .
           + " -isystem \($libcxx)"
           + " -isystem \($libc)/include"
-          + " -I \($libfmt)"
+          + " \($extra)"
           | gsub("(?<a>-I)(?<b>/lib/LiveUpdate/include)"; .a + $localsrc + .b)
       ))
     ' "$CCDB" > "$tmp" && mv "$tmp" "$CCDB"
 
 
       # most clangd configurations and editors will look in ./build/, but this just makes it easier to find for some niche edge cases
-      ln -sfn "${buildpath}/compile_commands.json" "$IOS_SRC/compile_commands.json"
+      # ln -sfn "${buildpath}/compile_commands.json" "$IOS_SRC/compile_commands.json"
   '';
 }
 
diff --git a/overlay.nix b/overlay.nix
index 94b2d34ba..9fa451bf8 100644
--- a/overlay.nix
+++ b/overlay.nix
@@ -87,11 +87,12 @@ final: prev: {
     inherit suppressTargetWarningHook;
 
     # Deps
-    botan2 = self.callPackage ./deps/botan/default.nix { };
+    botan2 = self.callPackage ./deps/botan2/default.nix { };
     libfmt = self.callPackage ./deps/libfmt/default.nix { };
+    s2n-tls = self.callPackage ./deps/s2n-tls/default.nix { };
     http-parser = self.callPackage ./deps/http-parser/default.nix { };
-    s2n-tls = self.callPackage ./deps/s2n/default.nix { };
     uzlib = self.callPackage ./deps/uzlib/default.nix { };
+    libfdt = self.callPackage ./deps/libfdt/default.nix { };
 
     vmbuild = self.callPackage ./vmbuild.nix { };
 
@@ -159,12 +160,13 @@ final: prev: {
         ++ prev.lib.optionals withCcache [self.ccacheWrapper ccacheNoticeHook];
 
       buildInputs = [
-        self.libfmt
-        self.botan2
-        self.http-parser
         prev.pkgsStatic.openssl
         prev.pkgsStatic.rapidjson
-        #self.s2n-tls          👈 This is postponed until we can fix the s2n build.
+        self.botan2
+        self.http-parser
+        self.libfmt
+      # self.s2n-tls          👈 This is postponed until we can fix the s2n build.
+        self.libfdt
         self.uzlib
         self.vmbuild
       ];
@@ -205,12 +207,18 @@ final: prev: {
       passthru.pkgs = prev.pkgs; # this is for convenience for other packages that depend on includeos
 
       passthru = {
-        inherit (self) uzlib;
-        inherit (self) http-parser;
         inherit (self) botan2;
-        inherit (self) libfmt;
-        #inherit (self) s2n-tls;
         inherit (self) cmake;
+        inherit (self) http-parser;
+<<<<<<< HEAD
+        inherit (self) libfmt;
+      # inherit (self) s2n-tls;
+||||||| parent of c0f128940 (enable libfdt dependency)
+=======
+        inherit (self) libfdt;
+        # inherit (self) s2n-tls;
+>>>>>>> c0f128940 (enable libfdt dependency)
+        inherit (self) uzlib;
         inherit (self) vmbuild;
       };