diff --git a/ansible/files/nginx.service.j2 b/ansible/files/nginx.service.j2
deleted file mode 100644
index a43c3df609..0000000000
--- a/ansible/files/nginx.service.j2
+++ /dev/null
@@ -1,25 +0,0 @@
-[Unit]
-Description=nginx server
-After=postgrest.service gotrue.service adminapi.service
-Wants=postgrest.service gotrue.service adminapi.service
-
-StartLimitIntervalSec=0
-StartLimitBurst=0
-
-[Service]
-Type=forking
-ExecStart=/usr/local/nginx/sbin/nginx -c /etc/nginx/nginx.conf
-ExecReload=/usr/local/nginx/sbin/nginx -s reload -c /etc/nginx/nginx.conf
-ExecStop=/usr/local/nginx/sbin/nginx -s quit
-User=nginx
-Slice=services.slice
-Restart=always
-RestartSec=3
-LimitNOFILE=100000
-
-# Via systemd we grant the process a set of privileges to bind to 80/443
-# See http://archive.vn/36zJU
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-
-[Install]
-WantedBy=multi-user.target
diff --git a/ansible/files/permission_check.py b/ansible/files/permission_check.py
index 5e17ebaa24..c286bd388f 100644
--- a/ansible/files/permission_check.py
+++ b/ansible/files/permission_check.py
@@ -69,7 +69,6 @@
     "gotrue": [{"groupname": "gotrue", "username": "gotrue"}],
     "envoy": [{"groupname": "envoy", "username": "envoy"}],
     "kong": [{"groupname": "kong", "username": "kong"}],
-    "nginx": [{"groupname": "nginx", "username": "nginx"}],
     "vector": [
         {"groupname": "adm", "username": "vector"},
         {"groupname": "postgres", "username": "vector"},
@@ -376,7 +375,6 @@ def main():
         "gotrue",
         "envoy",
         "kong",
-        "nginx",
         "vector",
         "adminapi",
         "postgrest",
diff --git a/ansible/playbook.yml b/ansible/playbook.yml
index 1a2543244a..613c4a99da 100644
--- a/ansible/playbook.yml
+++ b/ansible/playbook.yml
@@ -78,12 +78,6 @@
       tags:
         - install-supabase-internal
 
-    - name: Install nginx
-      when: not stage2
-      import_tasks: tasks/setup-nginx.yml
-      tags:
-        - install-supabase-internal
-
     - name: Install Supabase specific content
       when: not stage2
       import_tasks: tasks/setup-supabase-internal.yml
@@ -167,9 +161,6 @@
         update_cache: yes
         cache_valid_time: 3600
 
-    - name: Clean out build dependencies
-      import_tasks: tasks/clean-build-dependencies.yml
-
     - name: Run migrations
       when: stage2
       import_tasks: tasks/setup-migrations.yml
diff --git a/ansible/tasks/clean-build-dependencies.yml b/ansible/tasks/clean-build-dependencies.yml
deleted file mode 100644
index 567398f5fb..0000000000
--- a/ansible/tasks/clean-build-dependencies.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-- name: Remove build dependencies
-  ansible.builtin.apt:
-    autoremove: true
-    pkg:
-      - bison
-      - build-essential
-      - clang-11
-      - cmake
-      - cpp
-      - flex
-      - g++
-      - g++-10
-      - g++-9
-      - gcc-10
-      - make
-      - manpages
-      - manpages-dev
-      - ninja-build
-      - patch
-      - python2
-    state: 'absent'
diff --git a/ansible/tasks/internal/supautils.yml b/ansible/tasks/internal/supautils.yml
deleted file mode 100644
index 0e0d7de284..0000000000
--- a/ansible/tasks/internal/supautils.yml
+++ /dev/null
@@ -1,81 +0,0 @@
-# supautils
-- name: supautils - download & install dependencies
-  apt:
-    pkg:
-      - build-essential
-      - clang-11
-    update_cache: yes
-    cache_valid_time: 3600
-
-- name: supautils - download latest release
-  get_url:
-    url: "https://github.com/supabase/supautils/archive/refs/tags/v{{ supautils_release }}.tar.gz"
-    checksum: "{{ supautils_release_checksum }}"
-    dest: /tmp/supautils-{{ supautils_release }}.tar.gz
-    timeout: 60
-  register: download_result
-  until: download_result is succeeded
-  retries: 3
-  delay: 2
-
-- name: supautils - unpack archive
-  unarchive:
-    remote_src: yes
-    src: /tmp/supautils-{{ supautils_release }}.tar.gz
-    dest: /tmp
-  become: yes
-
-- name: supautils - build
-  make:
-    chdir: /tmp/supautils-{{ supautils_release }}
-  become: yes
-
-- name: supautils - install
-  make:
-    chdir: /tmp/supautils-{{ supautils_release }}
-    target: install
-  become: yes
-
-- name: supautils - add supautils to session_preload_libraries
-  become: yes
-  replace:
-    path: /etc/postgresql/postgresql.conf
-    regexp: "#session_preload_libraries = ''"
-    replace: session_preload_libraries = 'supautils'
-
-- name: supautils - write custom supautils.conf
-  template:
-    src: "files/postgresql_config/supautils.conf.j2"
-    dest: /etc/postgresql-custom/supautils.conf
-    mode: 0664
-    owner: postgres
-    group: postgres
-
-- name: supautils - copy extension custom scripts
-  copy:
-    src: files/postgresql_extension_custom_scripts/
-    dest: /etc/postgresql-custom/extension-custom-scripts
-  become: yes
-
-- name: supautils - chown extension custom scripts
-  file:
-    mode: 0775
-    owner: postgres
-    group: postgres
-    path: /etc/postgresql-custom/extension-custom-scripts
-    recurse: yes
-  become: yes
-
-- name: supautils - include /etc/postgresql-custom/supautils.conf in postgresql.conf
-  become: yes
-  replace:
-    path: /etc/postgresql/postgresql.conf
-    regexp: "#include = '/etc/postgresql-custom/supautils.conf'"
-    replace: "include = '/etc/postgresql-custom/supautils.conf'"
-
-- name: supautils - remove build dependencies
-  apt:
-    pkg:
-      - build-essential
-      - clang-11
-    state: absent
diff --git a/ansible/tasks/setup-nginx.yml b/ansible/tasks/setup-nginx.yml
deleted file mode 100644
index 5bf23dbdf4..0000000000
--- a/ansible/tasks/setup-nginx.yml
+++ /dev/null
@@ -1,85 +0,0 @@
-- name: nginx - system user
-  ansible.builtin.user:
-    name: 'nginx'
-    state: 'present'
-
-# Kong installation steps from http://archive.vn/3HRQx
-- name: nginx - system dependencies
-  ansible.builtin.apt:
-    pkg:
-      - libpcre3-dev
-      - libssl-dev
-      - openssl
-      - zlib1g-dev
-
-- name: nginx - download source
-  ansible.builtin.get_url:
-    url: "{{ nginx_artifacts['url'] }}"
-    checksum: "{{ nginx_artifacts['checksum'] }}"
-    dest: '/tmp/nginx-{{ nginx_release }}.tar.gz'
-  register: download_result
-  until: download_result is succeeded
-  retries: 3
-  delay: 2
-
-- name: nginx - unpack archive
-  ansible.builtin.unarchive:
-    dest: '/tmp'
-    remote_src: true
-    src: "/tmp/nginx-{{ nginx_release }}.tar.gz"
-
-- name: nginx - configure
-  ansible.builtin.command:
-    argv:
-      - ./configure 
-      - --prefix=/usr/local/nginx 
-      - --conf-path=/etc/nginx/nginx.conf 
-      - --with-http_ssl_module 
-      - --with-http_realip_module 
-      - --with-threads
-  args:
-    chdir: "/tmp/nginx-{{ nginx_release }}"
-  become: true
-
-- name: nginx - build and install
-  community.general.make:
-    chdir: "/tmp/nginx-{{ nginx_release }}"
-    jobs: "{{ parallel_jobs | default(omit) }}"
-    target: "{{ make_target }}"
-  become: true
-  loop:
-    - 'build'
-    - 'install'
-  loop_control:
-    loop_var: 'make_target'
-
-- name: nginx - hand over ownership of /etc/nginx and /usr/local/nginx to user nginx
-  ansible.builtin.file:
-    owner: 'nginx'
-    path: "{{ nginx_dir_item }}"
-    recurse: true
-  loop:
-    - /etc/nginx
-    - /usr/local/nginx
-  loop_control:
-    loop_var: 'nginx_dir_item'
-
-# [warn] ulimit is currently set to "1024". For better performance set it to at least
-# "4096" using "ulimit -n"
-- name: nginx - bump up ulimit
-  community.general.pam_limits:
-    domain: 'nginx'
-    limit_item: 'nofile'
-    limit_type: 'soft'
-    value: '4096'
-
-- name: nginx - create service file
-  ansible.builtin.template:
-    dest: '/etc/systemd/system/nginx.service'
-    src: 'files/nginx.service.j2'
-
-# Keep it dormant for the timebeing
-
-# - name: nginx - reload systemd
-#   systemd:
-#     daemon_reload: yes
diff --git a/ansible/tasks/setup-pgbouncer.yml b/ansible/tasks/setup-pgbouncer.yml
index 2a1b94d5c8..daeeb35d05 100644
--- a/ansible/tasks/setup-pgbouncer.yml
+++ b/ansible/tasks/setup-pgbouncer.yml
@@ -1,52 +1,4 @@
 # PgBouncer
-- name: PgBouncer - download & install dependencies
-  ansible.builtin.apt:
-    pkg:
-      - build-essential
-      - libevent-dev
-      - libssl-dev
-      - libsystemd-dev
-      - pkg-config
-      - pandoc
-      - python3
-    update_cache: true
-
-- name: PgBouncer - download latest release
-  ansible.builtin.get_url:
-    url: "{{ pgbouncer_artifacts['url'] }}"
-    checksum: "{{ pgbouncer_artifacts['checksum'] }}"
-    dest: "/tmp/pgbouncer-{{ pgbouncer_release }}.tar.gz"
-    timeout: 60
-  register: download_result
-  until: download_result is succeeded
-  retries: 3
-  delay: 2
-
-- name: PgBouncer - unpack archive
-  ansible.builtin.unarchive:
-    dest: '/tmp'
-    remote_src: true
-    src: "/tmp/pgbouncer-{{ pgbouncer_release }}.tar.gz"
-  become: true
-
-- name: PgBouncer - configure
-  ansible.builtin.command:
-    cmd: './configure --prefix=/usr/local --with-systemd'
-  args:
-    chdir: "/tmp/pgbouncer-{{ pgbouncer_release }}"
-  become: true
-
-- name: PgBouncer - build and install
-  community.general.make:
-    chdir: "/tmp/pgbouncer-{{ pgbouncer_release }}"
-    target: "{{ pgbouncer_make_item }}"
-  become: true
-  loop:
-    - 'all'
-    - 'install'
-  loop_control:
-    loop_var: 'pgbouncer_make_item'
-
 - name: Create pgbouncer user
   ansible.builtin.user:
     comment: 'PgBouncer user'
@@ -55,6 +7,21 @@
     shell: '/usr/sbin/nolign'
     state: 'present'
 
+- name: Install PgBouncer from nix binary cache
+  when: stage2
+  ansible.builtin.shell:
+    cmd: sudo -u pgbouncer bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#pgbouncer"
+  become: true
+
+- name: Link PgBouncer into /usr/local/bin
+  when: stage2
+  ansible.builtin.file:
+    dest: '/usr/local/bin/pgbouncer'
+    force: true
+    src: '/home/pgbouncer/.nix-profile/bin/pgbouncer'
+    state: 'link'
+  become: true
+
 - name: Create PgBouncer directories if they do not exist
   ansible.builtin.file:
     group: 'pgbouncer'
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 930129c95e..fd7b13364c 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -118,14 +118,6 @@ gotrue_artifacts:
   arm64:
     url: "https://github.com/supabase/gotrue/releases/download/v{{ gotrue_release }}/auth-v{{ gotrue_release }}-arm64.tar.gz"
     checksum: sha256:547b80c455f2bbf01a624d0e3bc98c31237ca479d4aa0d236d40678370e34a69
-nginx_release: 1.22.0
-nginx_artifacts:
-  url: "https://nginx.org/download/nginx-{{ nginx_release }}.tar.gz"
-  checksum: sha256:b33d569a6f11a01433a57ce17e83935e953ad4dc77cdd4d40f896c88ac26eb53
-pgbouncer_release: 1.25.1
-pgbouncer_artifacts:
-  url: "https://www.pgbouncer.org/downloads/files/{{ pgbouncer_release }}/pgbouncer-{{ pgbouncer_release }}.tar.gz"
-  checksum: sha256:6e566ae92fe3ef7f6a1b9e26d6049f7d7ca39c40e29e7b38f6d5500ae15d8465
 postgrest_release: "14.17" # keep this as an *explicit* string, otherwise gets treated as yaml float which will likely only lead to tears
 postgrest_artifacts:
   amd64:
diff --git a/audit-specs/baselines/ami-build/group.yml b/audit-specs/baselines/ami-build/group.yml
index 7622810841..f10c44f7ca 100644
--- a/audit-specs/baselines/ami-build/group.yml
+++ b/audit-specs/baselines/ami-build/group.yml
@@ -39,8 +39,6 @@ group:
     exists: true
   envoy:
     exists: true
-  nginx:
-    exists: true
   vector:
     exists: true
   supabase-admin-agent:
diff --git a/audit-specs/baselines/ami-build/user.yml b/audit-specs/baselines/ami-build/user.yml
index e764be6268..3210e47f4a 100644
--- a/audit-specs/baselines/ami-build/user.yml
+++ b/audit-specs/baselines/ami-build/user.yml
@@ -43,9 +43,6 @@ user:
   envoy:
     exists: true
     home: /home/envoy
-  nginx:
-    exists: true
-    home: /home/nginx
   vector:
     exists: true
     home: /var/lib/vector
diff --git a/audit-specs/baselines/baseline.yml b/audit-specs/baselines/baseline.yml
index 395366c1da..5f3979a2ce 100644
--- a/audit-specs/baselines/baseline.yml
+++ b/audit-specs/baselines/baseline.yml
@@ -4471,96 +4471,6 @@ file:
     owner: "1006"
     group: "0"
     filetype: file
-  /etc/nginx/fastcgi.conf:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/fastcgi.conf.default:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/fastcgi_params:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/fastcgi_params.default:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/koi-utf:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/koi-win:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/mime.types:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/mime.types.default:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/nginx.conf:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/nginx.conf.default:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/scgi_params:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/scgi_params.default:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/uwsgi_params:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/uwsgi_params.default:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/win-utf:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
   /etc/nix/nix.conf:
     exists: true
     mode: "0644"
@@ -5509,12 +5419,6 @@ file:
     owner: "0"
     group: "0"
     filetype: file
-  /etc/systemd/system/nginx.service:
-    exists: true
-    mode: "0644"
-    owner: "0"
-    group: "0"
-    filetype: file
   /etc/systemd/system/pg_egress_collect.service:
     exists: true
     mode: "0644"
@@ -5971,24 +5875,6 @@ file:
     owner: "1004"
     group: "1008"
     filetype: file
-  /home/nginx/.bash_logout:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "1009"
-    filetype: file
-  /home/nginx/.bashrc:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "1009"
-    filetype: file
-  /home/nginx/.profile:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "1009"
-    filetype: file
   /home/pgbouncer/.bash_logout:
     exists: true
     mode: "0644"
@@ -62029,24 +61915,6 @@ file:
     owner: "0"
     group: "0"
     filetype: directory
-  /usr/local/nginx/html/50x.html:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /usr/local/nginx/html/index.html:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /usr/local/nginx/sbin/nginx:
-    exists: true
-    mode: "0755"
-    owner: "1005"
-    group: "0"
-    filetype: file
   /usr/local/openresty/COPYRIGHT:
     exists: true
     mode: "0664"
@@ -91043,9 +90911,6 @@ group:
   news:
     exists: true
     gid: 9
-  nginx:
-    exists: true
-    gid: 1009
   nixbld:
     exists: true
     gid: 30000
@@ -95914,12 +95779,6 @@ user:
     gid: 9
     home: /var/spool/news
     shell: /usr/sbin/nologin
-  nginx:
-    exists: true
-    uid: 1005
-    gid: 1009
-    home: /home/nginx
-    shell: /bin/sh
   nixbld1:
     exists: true
     uid: 30001
diff --git a/audit-specs/baselines/prod-deployed/files-etc-deployed.yml b/audit-specs/baselines/prod-deployed/files-etc-deployed.yml
index 4d44861f31..66fd6c1002 100644
--- a/audit-specs/baselines/prod-deployed/files-etc-deployed.yml
+++ b/audit-specs/baselines/prod-deployed/files-etc-deployed.yml
@@ -1,5 +1,5 @@
 # File baseline: etc
-# Generated from baseline.yml - 735 files
+# Generated from baseline.yml - 720 files
 file:
   /etc/.pwd.lock:
     exists: true
@@ -3385,96 +3385,6 @@ file:
     group: '0'
     mode: '0644'
     owner: '0'
-  /etc/nginx/fastcgi.conf:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/fastcgi.conf.default:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/fastcgi_params:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/fastcgi_params.default:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/koi-utf:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/koi-win:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/mime.types:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/mime.types.default:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/nginx.conf:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/nginx.conf.default:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/scgi_params:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/scgi_params.default:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/uwsgi_params:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/uwsgi_params.default:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/win-utf:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
   /etc/nix/nix.conf:
     exists: true
     filetype: file
diff --git a/audit-specs/baselines/prod-deployed/files-home-deployed.yml b/audit-specs/baselines/prod-deployed/files-home-deployed.yml
index af3d0e6764..a9c67dcf6d 100644
--- a/audit-specs/baselines/prod-deployed/files-home-deployed.yml
+++ b/audit-specs/baselines/prod-deployed/files-home-deployed.yml
@@ -1,5 +1,5 @@
 # File baseline: home
-# Generated from baseline.yml - 38 files
+# Generated from baseline.yml - 35 files
 file:
   /home/adminapi/.bash_logout:
     exists: true
@@ -79,24 +79,6 @@ file:
     group: '1008'
     mode: '0644'
     owner: '1004'
-  /home/nginx/.bash_logout:
-    exists: true
-    filetype: file
-    group: '1009'
-    mode: '0644'
-    owner: '1005'
-  /home/nginx/.bashrc:
-    exists: true
-    filetype: file
-    group: '1009'
-    mode: '0644'
-    owner: '1005'
-  /home/nginx/.profile:
-    exists: true
-    filetype: file
-    group: '1009'
-    mode: '0644'
-    owner: '1005'
   /home/pgbouncer/.bash_logout:
     exists: true
     filetype: file
diff --git a/audit-specs/baselines/prod-deployed/files-systemd-deployed.yml b/audit-specs/baselines/prod-deployed/files-systemd-deployed.yml
index a01cc5f045..011a3f931c 100644
--- a/audit-specs/baselines/prod-deployed/files-systemd-deployed.yml
+++ b/audit-specs/baselines/prod-deployed/files-systemd-deployed.yml
@@ -1,5 +1,5 @@
 # File baseline: systemd
-# Generated from baseline.yml - 34 files
+# Generated from baseline.yml - 33 files
 file:
   /etc/systemd/journald.conf:
     exists: true
@@ -97,12 +97,6 @@ file:
     group: '0'
     mode: '0644'
     owner: '0'
-  /etc/systemd/system/nginx.service:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '0'
   /etc/systemd/system/pg_egress_collect.service:
     exists: true
     filetype: file
diff --git a/audit-specs/baselines/prod-deployed/files-usr-local-deployed.yml b/audit-specs/baselines/prod-deployed/files-usr-local-deployed.yml
index 7ea65bc700..f7f8ae3e27 100644
--- a/audit-specs/baselines/prod-deployed/files-usr-local-deployed.yml
+++ b/audit-specs/baselines/prod-deployed/files-usr-local-deployed.yml
@@ -1,5 +1,5 @@
 # File baseline: usr-local
-# Generated from baseline.yml - 7956 files
+# Generated from baseline.yml - 7953 files
 file:
   /usr/local/aws-cli/v2/2.23.11/dist/_awscrt.abi3.so:
     exists: true
@@ -45817,24 +45817,6 @@ file:
     group: '0'
     mode: '0755'
     owner: '0'
-  /usr/local/nginx/html/50x.html:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /usr/local/nginx/html/index.html:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /usr/local/nginx/sbin/nginx:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0755'
-    owner: '1005'
   /usr/local/openresty/COPYRIGHT:
     exists: true
     filetype: file
diff --git a/audit-specs/baselines/prod-deployed/group-deployed.yml b/audit-specs/baselines/prod-deployed/group-deployed.yml
index 6ad5a910e3..d9d2cae2b6 100644
--- a/audit-specs/baselines/prod-deployed/group-deployed.yml
+++ b/audit-specs/baselines/prod-deployed/group-deployed.yml
@@ -1,5 +1,5 @@
 # Group baseline
-# Generated from baseline.yml - 70 items
+# Generated from baseline.yml - 69 items
 group:
   _ssh:
     exists: true
@@ -94,9 +94,6 @@ group:
   news:
     exists: true
     gid: 9
-  nginx:
-    exists: true
-    gid: 1009
   nixbld:
     exists: true
     gid: 30000
diff --git a/audit-specs/baselines/prod-deployed/user-deployed.yml b/audit-specs/baselines/prod-deployed/user-deployed.yml
index 9ae9fffec8..183aa23c42 100644
--- a/audit-specs/baselines/prod-deployed/user-deployed.yml
+++ b/audit-specs/baselines/prod-deployed/user-deployed.yml
@@ -1,5 +1,5 @@
 # User baseline
-# Generated from baseline.yml - 72 items
+# Generated from baseline.yml - 71 items
 user:
   _apt:
     exists: true
@@ -109,12 +109,6 @@ user:
     home: /var/spool/news
     shell: /usr/sbin/nologin
     uid: 9
-  nginx:
-    exists: true
-    gid: 1009
-    home: /home/nginx
-    shell: /bin/sh
-    uid: 1005
   nixbld1:
     exists: true
     gid: 30000
diff --git a/ebssurrogate/scripts/chroot-bootstrap-nix.sh b/ebssurrogate/scripts/chroot-bootstrap-nix.sh
index f1f94551c1..140f6802dd 100755
--- a/ebssurrogate/scripts/chroot-bootstrap-nix.sh
+++ b/ebssurrogate/scripts/chroot-bootstrap-nix.sh
@@ -194,6 +194,7 @@ function update_install_packages {
 	# because their post-install scripts try to access EC2 metadata service
 	# which doesn't work in a chroot and causes long hangs
 	if ! apt_install_with_fallback install -y \
+		bzip2 \
 		sudo \
 		wget \
 		cloud-init \
diff --git a/flake.lock b/flake.lock
index 3a0c359bee..9c6ea52a9e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -196,7 +196,9 @@
           "flake-parts"
         ],
         "nix": "nix",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
         "treefmt-nix": [
           "treefmt-nix"
         ]
@@ -237,15 +239,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 315532800,
-        "narHash": "sha256-vhAtaRMIQiEghARviANBmSnhGz9Qf2IQJ+nQgsDXnVs=",
-        "rev": "c12c63cd6c5eb34c7b4c3076c6a99e00fcab86ec",
+        "lastModified": 1767379071,
+        "narHash": "sha256-3xDI4xtzovwqE/eAxCwmXxUqBg6Yoam2L1u0IwRNhW4=",
+        "rev": "fb7944c166a3b630f177938e478f0378e64ce108",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-25.11pre877036.c12c63cd6c5e/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre921484.fb7944c166a3/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://nixos.org/channels/nixpkgs-unstable/nixexprs.tar.xz"
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
       }
     },
     "nixpkgs-lib": {
@@ -263,35 +265,6 @@
         "type": "github"
       }
     },
-    "nixpkgs-oldstable": {
-      "locked": {
-        "lastModified": 1712666087,
-        "narHash": "sha256-WwjUkWsjlU8iUImbivlYxNyMB1L5YVqE8QotQdL9jWc=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a76c4553d7e741e17f289224eda135423de0491d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a76c4553d7e741e17f289224eda135423de0491d",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1767379071,
-        "narHash": "sha256-3xDI4xtzovwqE/eAxCwmXxUqBg6Yoam2L1u0IwRNhW4=",
-        "rev": "fb7944c166a3b630f177938e478f0378e64ce108",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre921484.fb7944c166a3/nixexprs.tar.xz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
-      }
-    },
     "root": {
       "inputs": {
         "devshell": "devshell",
@@ -303,8 +276,7 @@
         "nix-editor": "nix-editor",
         "nix-eval-jobs": "nix-eval-jobs",
         "nix2container": "nix2container",
-        "nixpkgs": "nixpkgs_2",
-        "nixpkgs-oldstable": "nixpkgs-oldstable",
+        "nixpkgs": "nixpkgs",
         "rust-overlay": "rust-overlay",
         "treefmt-nix": "treefmt-nix"
       }
diff --git a/flake.nix b/flake.nix
index 828a384e95..3ca64d0bd0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -19,13 +19,11 @@
     nix-editor.inputs.utils.follows = "flake-utils";
     nix-editor.url = "github:snowfallorg/nix-editor";
     nix-eval-jobs.inputs.flake-parts.follows = "flake-parts";
+    nix-eval-jobs.inputs.nixpkgs.follows = "nixpkgs";
     nix-eval-jobs.inputs.treefmt-nix.follows = "treefmt-nix";
     nix-eval-jobs.url = "github:nix-community/nix-eval-jobs";
     nix2container.inputs.nixpkgs.follows = "nixpkgs";
     nix2container.url = "github:nlewo/nix2container";
-    # Pin to a specific nixpkgs version that has compatible v8 and curl versions
-    # for extensions that require older package versions
-    nixpkgs-oldstable.url = "github:NixOS/nixpkgs/a76c4553d7e741e17f289224eda135423de0491d";
     nixpkgs.url = "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz";
     rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
     rust-overlay.url = "github:oxalica/rust-overlay";
diff --git a/nix/nixpkgs.nix b/nix/nixpkgs.nix
index 34ba4bd604..af2db7efeb 100644
--- a/nix/nixpkgs.nix
+++ b/nix/nixpkgs.nix
@@ -5,24 +5,34 @@
     {
       _module.args.pkgs = import inputs.nixpkgs {
         inherit system;
-        config.allowUnfree = true;
-        permittedInsecurePackages = [ "v8-9.7.106.18" ];
+        config = {
+          allowUnfree = true;
+          permittedInsecurePackages = [ "v8-9.7.106.18" ];
+        };
         overlays = [
           (import inputs.rust-overlay)
           self.overlays.default
-          (
-            let
-              # Provide older versions of packages required by some extensions
-              oldstable = import inputs.nixpkgs-oldstable {
-                inherit system;
-                config.allowUnfree = true;
+          (final: prev: {
+            curl_8_6 = prev.curl.overrideAttrs (old: rec {
+              version = "8.6.0";
+              src = prev.fetchurl {
+                urls = [
+                  "https://curl.haxx.se/download/curl-${version}.tar.xz"
+                  "https://github.com/curl/curl/releases/download/curl-${
+                    builtins.replaceStrings [ "." ] [ "_" ] version
+                  }/curl-${version}.tar.xz"
+                ];
+                hash = "sha256-PM1V2Rr5UWU534BiX4GMc03G8uz5utozx2dl6ZEh2xU=";
               };
-            in
-            _final: _prev: {
-              curl_8_6 = oldstable.curl;
-              v8_oldstable = oldstable.v8;
-            }
-          )
+              configureFlags = builtins.filter (
+                flag: !builtins.elem flag [
+                  "--with-nghttp3"
+                  "--with-ngtcp2"
+                ]
+              ) old.configureFlags;
+            });
+            v8_oldstable = prev.callPackage ./packages/v8-oldstable { };
+          })
           inputs.devshell.overlays.default
         ];
       };
diff --git a/nix/packages/v8-oldstable/darwin.patch b/nix/packages/v8-oldstable/darwin.patch
new file mode 100644
index 0000000000..629d5e4dc3
--- /dev/null
+++ b/nix/packages/v8-oldstable/darwin.patch
@@ -0,0 +1,22 @@
+diff --git a/toolchain/gcc_toolchain.gni b/toolchain/gcc_toolchain.gni
+index 80e2a362a..df138c87b 100644
+--- a/build/toolchain/gcc_toolchain.gni
++++ b/build/toolchain/gcc_toolchain.gni
+@@ -355,6 +355,8 @@ template("gcc_toolchain") {
+         # AIX does not support either -D (deterministic output) or response
+         # files.
+         command = "$ar -X64 {{arflags}} -r -c -s {{output}} {{inputs}}"
++      } else if (current_os == "mac") {
++        command = "$ar {{arflags}} -r -c -s {{output}} {{inputs}}"
+       } else {
+         rspfile = "{{output}}.rsp"
+         rspfile_content = "{{inputs}}"
+@@ -546,7 +548,7 @@ template("gcc_toolchain") {
+ 
+       start_group_flag = ""
+       end_group_flag = ""
+-      if (current_os != "aix") {
++      if (current_os != "aix" && current_os != "mac") {
+         # the "--start-group .. --end-group" feature isn't available on the aix ld.
+         start_group_flag = "-Wl,--start-group"
+         end_group_flag = "-Wl,--end-group "
diff --git a/nix/packages/v8-oldstable/default.nix b/nix/packages/v8-oldstable/default.nix
new file mode 100644
index 0000000000..b4bd15e034
--- /dev/null
+++ b/nix/packages/v8-oldstable/default.nix
@@ -0,0 +1,233 @@
+{
+  stdenv,
+  lib,
+  fetchgit,
+  gn,
+  ninja,
+  python3,
+  glib,
+  pkg-config,
+  icu,
+  xcbuild,
+  fetchpatch,
+  llvmPackages,
+  symlinkJoin,
+}:
+
+# Copied from nixpkgs revision f311b2493888dbf499e769c8015de9b40e4d590d.
+
+let
+  version = "9.7.106.18";
+  v8Src = fetchgit {
+    url = "https://chromium.googlesource.com/v8/v8";
+    rev = version;
+    sha256 = "0cb3w733w1xn6zq9dsr43nx6llcg9hrmb2dkxairarj9c0igpzyh";
+  };
+
+  git_url = "https://chromium.googlesource.com";
+
+  # This data is from the DEPS file in the root of a V8 checkout.
+  deps = {
+    "base/trace_event/common" = fetchgit {
+      url = "${git_url}/chromium/src/base/trace_event/common.git";
+      rev = "7f36dbc19d31e2aad895c60261ca8f726442bfbb";
+      sha256 = "01b2fhbxznqbakxv42ivrzg6w8l7i9yrd9nf72d6p5xx9dm993j4";
+    };
+    "build" = fetchgit {
+      url = "${git_url}/chromium/src/build.git";
+      rev = "cf325916d58a194a935c26a56fcf6b525d1e2bf4";
+      sha256 = "1ix4h1cpx9bvgln8590xh7lllhsd9w1hd5k9l1gx5yxxrmywd3s4";
+    };
+    "third_party/googletest/src" = fetchgit {
+      url = "${git_url}/external/github.com/google/googletest.git";
+      rev = "16f637fbf4ffc3f7a01fa4eceb7906634565242f";
+      sha256 = "11012k3c3mxzdwcw2iparr9lrckafpyhqzclsj26hmfbgbdi0rrh";
+    };
+    "third_party/icu" = fetchgit {
+      url = "${git_url}/chromium/deps/icu.git";
+      rev = "eedbaf76e49d28465d9119b10c30b82906e606ff";
+      sha256 = "0mppvx7wf9zlqjsfaa1cf06brh1fjb6nmiib0lhbb9hd55mqjdjj";
+    };
+    "third_party/zlib" = fetchgit {
+      url = "${git_url}/chromium/src/third_party/zlib.git";
+      rev = "6da1d53b97c89b07e47714d88cab61f1ce003c68";
+      sha256 = "0v7ylmbwfwv6w6wp29qdf77kjjnfr2xzin08n0v1yvbhs01h5ppy";
+    };
+    "third_party/jinja2" = fetchgit {
+      url = "${git_url}/chromium/src/third_party/jinja2.git";
+      rev = "ee69aa00ee8536f61db6a451f3858745cf587de6";
+      sha256 = "1fsnd5h0gisfp8bdsfd81kk5v4mkqf8z368c7qlm1qcwc4ri4x7a";
+    };
+    "third_party/markupsafe" = fetchgit {
+      url = "${git_url}/chromium/src/third_party/markupsafe.git";
+      rev = "1b882ef6372b58bfd55a3285f37ed801be9137cd";
+      sha256 = "1jnjidbh03lhfaawimkjxbprmsgz4snr0jl06630dyd41zkdw5kr";
+    };
+  };
+
+  # See `gn_version` in DEPS.
+  gnSrc = fetchgit {
+    url = "https://gn.googlesource.com/gn";
+    rev = "8926696a4186279489cc2b8d768533e61bba73d7";
+    sha256 = "1084lnyb0a1khbgjvak05fcx6jy973wqvsf77n0alxjys18sg2yk";
+  };
+
+  myGn = gn.overrideAttrs (oldAttrs: {
+    version = "for-v8";
+    src = gnSrc;
+    configurePhase = ''
+      runHook preConfigure
+
+      python build/gen.py --no-last-commit-position
+      cat > out/last_commit_position.h << EOF
+      #ifndef OUT_LAST_COMMIT_POSITION_H_
+      #define OUT_LAST_COMMIT_POSITION_H_
+
+      #define LAST_COMMIT_POSITION_NUM 1942
+      #define LAST_COMMIT_POSITION "1942 (8926696)"
+
+      #endif  // OUT_LAST_COMMIT_POSITION_H_
+      EOF
+
+      runHook postConfigure
+    '';
+  });
+in
+stdenv.mkDerivation rec {
+  pname = "v8";
+  inherit version;
+
+  doCheck = true;
+
+  patches = [
+    ./darwin.patch
+
+    # gcc-13 build fix for mixxign <cstdint> includes
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://chromium.googlesource.com/v8/v8/+/c2792e58035fcbaa16d0cb70998852fbeb5df4cc^!?format=TEXT";
+      decode = "base64 -d";
+      hash = "sha256-hoPAkSaCmzXflPFXaKUwVPLECMpt6N6/8m8mBSTAHbU=";
+    })
+  ];
+
+  src = v8Src;
+
+  postUnpack = ''
+    ${lib.concatStringsSep "\n" (
+      lib.mapAttrsToList (n: v: ''
+        mkdir -p $sourceRoot/${n}
+        cp -r ${v}/* $sourceRoot/${n}
+      '') deps
+    )}
+    chmod u+w -R .
+  '';
+
+  postPatch = ''
+    ${lib.optionalString stdenv.hostPlatform.isAarch64 ''
+      substituteInPlace build/toolchain/linux/BUILD.gn \
+        --replace 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
+    ''}
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace build/config/compiler/compiler.gni \
+        --replace 'strip_absolute_paths_from_debug_symbols = true' \
+                  'strip_absolute_paths_from_debug_symbols = false'
+      substituteInPlace build/config/compiler/BUILD.gn \
+        --replace 'current_toolchain == host_toolchain || !use_xcode_clang' \
+                  'false'
+    ''}
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace build/config/compiler/BUILD.gn \
+        --replace "-Wl,-fatal_warnings" ""
+    ''}
+    touch build/config/gclient_args.gni
+    sed '1i#include <utility>' -i src/heap/cppgc/prefinalizer-handler.h # gcc12
+  '';
+
+  llvmCcAndBintools = symlinkJoin {
+    name = "llvmCcAndBintools";
+    paths = [
+      stdenv.cc
+      llvmPackages.llvm
+    ];
+  };
+
+  gnFlags = [
+    "use_custom_libcxx=false"
+    "is_clang=${lib.boolToString stdenv.cc.isClang}"
+    "use_sysroot=false"
+    # "use_system_icu=true"
+    "clang_use_chrome_plugins=false"
+    "is_component_build=false"
+    "v8_use_external_startup_data=false"
+    "v8_monolithic=true"
+    "is_debug=true"
+    "is_official_build=false"
+    "treat_warnings_as_errors=false"
+    "v8_enable_i18n_support=true"
+    "use_gold=false"
+    # ''custom_toolchain="//build/toolchain/linux/unbundle:default"''
+    ''host_toolchain="//build/toolchain/linux/unbundle:default"''
+    ''v8_snapshot_toolchain="//build/toolchain/linux/unbundle:default"''
+  ]
+  ++ lib.optional stdenv.cc.isClang ''clang_base_path="${llvmCcAndBintools}"''
+  ++ lib.optional stdenv.hostPlatform.isDarwin "use_lld=false";
+
+  env.NIX_CFLAGS_COMPILE = toString (
+    [ "-O2" ] ++ lib.optionals stdenv.cc.isClang [ "-Wno-error=enum-constexpr-conversion" ]
+  );
+  FORCE_MAC_SDK_MIN = stdenv.hostPlatform.sdkVer or "10.12";
+
+  nativeBuildInputs = [
+    myGn
+    ninja
+    pkg-config
+    python3
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    xcbuild
+    llvmPackages.llvm
+    python3.pkgs.setuptools
+  ];
+  buildInputs = [
+    glib
+    icu
+  ];
+
+  ninjaFlags = [
+    ":d8"
+    "v8_monolith"
+  ];
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    install -D d8 $out/bin/d8
+    install -D -m644 obj/libv8_monolith.a $out/lib/libv8.a
+    install -D -m644 icudtl.dat $out/share/v8/icudtl.dat
+    ln -s libv8.a $out/lib/libv8_monolith.a
+    cp -r ../../include $out
+
+    mkdir -p $out/lib/pkgconfig
+    cat > $out/lib/pkgconfig/v8.pc << EOF
+    Name: v8
+    Description: V8 JavaScript Engine
+    Version: ${version}
+    Libs: -L$out/lib -lv8 -pthread
+    Cflags: -I$out/include
+    EOF
+  '';
+
+  meta = with lib; {
+    homepage = "https://v8.dev/";
+    description = "Google's open source JavaScript engine";
+    mainProgram = "d8";
+    maintainers = with maintainers; [
+      proglodyte
+      matthewbauer
+    ];
+    platforms = platforms.unix;
+    license = licenses.bsd3;
+    knownVulnerabilities = [ "Severely outdated with multiple publicly known vulnerabilities" ];
+  };
+}