diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 88a3ca33..f8068325 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 2026-10-24: fix build failures for NixOS swan
+
+- **Nextcloud**: Upstream NixOS removed `services.nextcloud.config.adminpassFile` and `services.nextcloud.config.adminuser`. Removed `adminpassFile` from `services.nextcloud.config`, updated `services.prometheus.exporters.nextcloud` to reference `config.secrets.nextcloud.dest` directly as `passwordFile` and set `username = "root"`, and added ordering dependencies on `nextcloud-secret` for `prometheus-nextcloud-exporter.service`.
+- **Bazarr**: Replaced obsolete `services.bazarr.listenPort` with `services.bazarr.settings.general.port` in Caddy reverse proxy upstream (`arr.nix`) and Grafana dashboard matcher (`grafana.nix`).
+- **pyopenjtalk-plus**: Added `overlays/pyopenjtalk-plus.nix` disabling `test_run_njd_from_mecab_invalid_input_should_not_break_next_call`, which fails under Python 3.14 due to an exact string match assertion on the `TypeError` message ("Expected str, got int" vs expected "must be str").
+- **calibre**: Added `overlays/calibre.nix` setting `doInstallCheck = false`, bypassing upstream failure in `test_speech_dispatcher` caused by `speechd-minimal` omitting Python bindings in nixpkgs.
+
+
 ## 2026-10-17: removed post-TUI lag tooling
 
 - With the root cause fixed (starship notifications, below), removed the `lag-triage` module: `lag-triage`, `unlag`, `lag-sample`, `term-probe`, the PTY repro script, the flight recorder filter and the Ctrl-b `heal-autosuggest` binding. Also deleted its `power-user.nix` enable and `~/.local/state/lag-triage`.
diff --git a/overlays/calibre.nix b/overlays/calibre.nix
new file mode 100644
index 00000000..8645791c
--- /dev/null
+++ b/overlays/calibre.nix
@@ -0,0 +1,8 @@
+# Calibre's installCheckPhase runs test_speech_dispatcher, which imports
+# `speechd.client.SSIPClient`. Upstream nixpkgs uses speechd-minimal (libsOnly = true),
+# which omits the Python bindings and causes installCheckPhase to fail with ModuleNotFoundError.
+_inputs: _final: prev: {
+  calibre = prev.calibre.overrideAttrs (_old: {
+    doInstallCheck = false;
+  });
+}
diff --git a/overlays/pyopenjtalk-plus.nix b/overlays/pyopenjtalk-plus.nix
new file mode 100644
index 00000000..c7da22fa
--- /dev/null
+++ b/overlays/pyopenjtalk-plus.nix
@@ -0,0 +1,14 @@
+# Upstream pyopenjtalk-plus has a test (test_run_njd_from_mecab_invalid_input_should_not_break_next_call)
+# that asserts the exact TypeError exception string "must be str", which changed to "Expected str, got int"
+# under Python 3.14 / Cython.
+_inputs: _final: prev: {
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyfinal: pyprev: {
+      pyopenjtalk-plus = pyprev.pyopenjtalk-plus.overridePythonAttrs (old: {
+        disabledTests = (old.disabledTests or [ ]) ++ [
+          "test_run_njd_from_mecab_invalid_input_should_not_break_next_call"
+        ];
+      });
+    })
+  ];
+}
diff --git a/platforms/nixos/modules/nmasur/presets/services/arr/arr.nix b/platforms/nixos/modules/nmasur/presets/services/arr/arr.nix
index 0546fac7..41da9d88 100644
--- a/platforms/nixos/modules/nmasur/presets/services/arr/arr.nix
+++ b/platforms/nixos/modules/nmasur/presets/services/arr/arr.nix
@@ -203,7 +203,7 @@ in
             upstreams = [
               {
                 # Bazarr only dynamically sets the port, not the host
-                dial = "localhost:${builtins.toString config.services.bazarr.listenPort}";
+                dial = "localhost:${builtins.toString config.services.bazarr.settings.general.port}";
               }
             ];
           }
diff --git a/platforms/nixos/modules/nmasur/presets/services/grafana/grafana.nix b/platforms/nixos/modules/nmasur/presets/services/grafana/grafana.nix
index 234d60b1..c7f3c0f5 100644
--- a/platforms/nixos/modules/nmasur/presets/services/grafana/grafana.nix
+++ b/platforms/nixos/modules/nmasur/presets/services/grafana/grafana.nix
@@ -837,7 +837,7 @@ in
                           {
                             matcher = {
                               id = "byName";
-                              options = "localhost:${builtins.toString config.services.bazarr.listenPort}";
+                              options = "localhost:${builtins.toString config.services.bazarr.settings.general.port}";
                             };
                             properties = [
                               {
diff --git a/platforms/nixos/modules/nmasur/presets/services/nextcloud/nextcloud.nix b/platforms/nixos/modules/nmasur/presets/services/nextcloud/nextcloud.nix
index b79505bc..c1bcad63 100644
--- a/platforms/nixos/modules/nmasur/presets/services/nextcloud/nextcloud.nix
+++ b/platforms/nixos/modules/nmasur/presets/services/nextcloud/nextcloud.nix
@@ -25,7 +25,6 @@ in
       hostName = "localhost";
       maxUploadSize = "50G";
       config = {
-        adminpassFile = config.secrets.nextcloud.dest;
         dbtype = "pgsql"; # Enables postgresql
       };
       settings = {
@@ -209,8 +208,14 @@ in
       permissions = "0440";
     };
     systemd.services.nextcloud-secret = {
-      requiredBy = [ "nextcloud-setup.service" ];
-      before = [ "nextcloud-setup.service" ];
+      requiredBy = [
+        "nextcloud-setup.service"
+        "prometheus-nextcloud-exporter.service"
+      ];
+      before = [
+        "nextcloud-setup.service"
+        "prometheus-nextcloud-exporter.service"
+      ];
     };
 
     secrets.nextcloud-oidc-secret = {
@@ -249,9 +254,9 @@ in
     networking.hosts."127.0.0.1" = [ hostnames.content ];
     services.prometheus.exporters.nextcloud = {
       enable = true;
-      username = config.services.nextcloud.config.adminuser;
+      username = "root";
       url = "https://${hostnames.content}";
-      passwordFile = config.services.nextcloud.config.adminpassFile;
+      passwordFile = config.secrets.nextcloud.dest;
     };
     nmasur.presets.services.prometheus-exporters.scrapeTargets = [
       "127.0.0.1:${builtins.toString config.services.prometheus.exporters.nextcloud.port}"