diff --git a/morph/lib/bootstrap-configuration.nix b/morph/lib/bootstrap-configuration.nix
index f59385d1fd0ec21997d21c16be5ed5e937611acc..650c4d9c6e8567dfac75a4dfefc6df032f6a43a1 100644
--- a/morph/lib/bootstrap-configuration.nix
+++ b/morph/lib/bootstrap-configuration.nix
@@ -87,7 +87,6 @@ in
   # Configure the bootloader how we like.
   boot.loader.timeout = 10;
   boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
   boot.loader.grub.device = "/dev/disk/by-id/${grubDeviceID}";
 
   # Let me in to do subsequent configuration.  This makes the machine wide
diff --git a/nixos/modules/100tb.nix b/nixos/modules/100tb.nix
index 12bb4b35b4c24acd28bfb9a5909809e0f9a8fdd0..997e82e18404a663bb7900e67b60859a27f653ef 100644
--- a/nixos/modules/100tb.nix
+++ b/nixos/modules/100tb.nix
@@ -103,7 +103,6 @@ in {
   # harder to deploy in the bootstrap environment.
   config =
   { boot.loader.grub.enable = true;
-    boot.loader.grub.version = 2;
     boot.loader.grub.device = if cfg.grubDeviceID == "nodev"  then "nodev" else "/dev/disk/by-id/${cfg.grubDeviceID}";
     boot.loader.timeout = 10;
     networking.firewall.enable = false;
diff --git a/nixos/modules/monitoring/exporters/node.nix b/nixos/modules/monitoring/exporters/node.nix
index 4a9e41b5c840852323aaf952859e79b4c878a870..f48c70a1aca88cdfd43f37201b7c42b1807ed3b2 100644
--- a/nixos/modules/monitoring/exporters/node.nix
+++ b/nixos/modules/monitoring/exporters/node.nix
@@ -69,7 +69,7 @@ in {
     ] ++ (
       optionals (config.services.nfs.server.enable) [ "nfsd" ]
     ) ++ (
-      optionals ("" != config.boot.initrd.services.swraid.mdadmConf) [ "mdadm" ]
+      optionals ("" != config.boot.swraid.mdadmConf) [ "mdadm" ]
     ) ++ (
       optionals ({} != config.networking.bonds) [ "bonding" ]
     ) ++ (
diff --git a/nixos/modules/ssh.nix b/nixos/modules/ssh.nix
index 90fd34b002c607965038a574334fb0fc370d146c..8e0424506f1cb2bf3367fb895a74ebde36e99897 100644
--- a/nixos/modules/ssh.nix
+++ b/nixos/modules/ssh.nix
@@ -26,8 +26,8 @@
       enable = true;
 
       # We only allow key-based authentication.
-      kbdInteractiveAuthentication = false;
-      passwordAuthentication = false;
+      settings.KbdInteractiveAuthentication = false;
+      settings.PasswordAuthentication = false;
 
       extraConfig = ''
         # Possibly this is superfluous considering we don't allow
diff --git a/nixpkgs.json b/nixpkgs.json
index 7d6b1b16db91130000cbb0fff566d9f147178b69..ba0ac988eff8de6113851f8cff29f88e4fa60354 100644
--- a/nixpkgs.json
+++ b/nixpkgs.json
@@ -1,5 +1,5 @@
 {
   "name": "source",
-  "url": "https://releases.nixos.org/nixos/23.05/nixos-23.05.4738.41de143fda10/nixexprs.tar.xz",
-  "sha256": "0bqq6l4c0k62g6a1npk9gbzf8j373859gvb7kxnpq5p5175mzw6d"
+  "url": "https://releases.nixos.org/nixos/23.11/nixos-23.11.2962.b8dd8be3c790/nixexprs.tar.xz",
+  "sha256": "053dwx7smszz3a0khbm6zvf9pvy5xz1ifdk9jx6gz5cmwjab0gmp"
 }
\ No newline at end of file
diff --git a/tools/update-nixpkgs b/tools/update-nixpkgs
index 7ed06e2c99bd17d7c2ce1a3197add8f73d7a9769..f20acdb1fefbd63ee8a9255d9eae633f2b998b1f 100755
--- a/tools/update-nixpkgs
+++ b/tools/update-nixpkgs
@@ -10,7 +10,7 @@ from ps_tools import get_url_hash
 # We pass this to builtins.fetchTarball which only supports sha256
 HASH_TYPE = "sha256"
 
-DEFAULT_CHANNEL = "nixos-23.05"
+DEFAULT_CHANNEL = "nixos-23.11"
 CHANNEL_URL_TEMPLATE = "https://channels.nixos.org/{channel}/nixexprs.tar.xz"