diff --git a/flake.lock b/flake.lock
index fb23715..4789329 100644
--- a/flake.lock
+++ b/flake.lock
@@ -74,11 +74,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772699110,
-        "narHash": "sha256-jkyo/9fZVB3F/PHk3fVK1ImxJBZ71DCOYZvAz4R4v4E=",
+        "lastModified": 1773506317,
+        "narHash": "sha256-qWKbLUJpavIpvOdX1fhHYm0WGerytFHRoh9lVck6Bh0=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "42affa9d33750ac0a0a89761644af20d8d03e6ee",
+        "rev": "878ec37d6a8f52c6c801d0e2a2ad554c75b9353c",
         "type": "github"
       },
       "original": {
@@ -126,16 +126,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751274312,
-        "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
+        "lastModified": 1773524153,
+        "narHash": "sha256-Jms57zzlFf64ayKzzBWSE2SGvJmK+NGt8Gli71d9kmY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
+        "rev": "e9f278faa1d0c2fc835bd331d4666b59b505a410",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 6639b67..ca5d07c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "Skyworks infrastructure";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
 
     disko = {
       url = "github:nix-community/disko";
diff --git a/hosts/skydick/datapool.nix b/hosts/skydick/datapool.nix
index 1e8a4c7..0c8e032 100644
--- a/hosts/skydick/datapool.nix
+++ b/hosts/skydick/datapool.nix
@@ -176,6 +176,44 @@
 { config, pkgs, ... }:
 
 {
+  # Build sambaFull with Spotlight/tracker support.
+  # Fixes for tinysparql 3.x (tracker-sparql-3.0) compatibility:
+  #   (1) waf only checks tracker-sparql-{2.0..0.14} — add 3.0
+  #   (2) tracker 2.x API (get_async/get_finish) removed in 3.x — replace
+  #       with bus_new_async/bus_new_finish connecting to localsearch miner
+  #   (3) disable tevent_glib_tracker test (uses same removed API, test-only)
+  #   (4) add icu for Unicode normalisation required by Spotlight
+  nixpkgs.overlays = [
+    (final: prev: {
+      sambaFull = prev.sambaFull.overrideAttrs (old: {
+        buildInputs = old.buildInputs ++ [
+          final.tinysparql.dev
+          final.glib.dev
+          final.icu.dev
+        ];
+        postPatch = (old.postPatch or "") + ''
+          substituteInPlace source3/wscript \
+            --replace-fail "tracker_versions = ['2.0', '1.0', '0.16', '0.14']" \
+                           "tracker_versions = ['3.0', '2.0', '1.0', '0.16', '0.14']"
+
+          # Patch rpcd_mdssvc to use tinysparql 3.x bus API
+          substituteInPlace source3/rpc_server/mdssvc/mdssvc_tracker.c \
+            --replace-fail \
+              'tracker_sparql_connection_get_finish(res, &error)' \
+              'tracker_sparql_connection_bus_new_finish(res, &error)' \
+            --replace-fail \
+              'tracker_sparql_connection_get_async(ctx->gcancellable,' \
+              'tracker_sparql_connection_bus_new_async("org.freedesktop.Tracker3.Miner.Files", NULL, NULL, ctx->gcancellable,'
+
+          # Disable test binary that also uses removed API (not installed)
+          substituteInPlace source3/wscript_build \
+            --replace-fail "enabled=bld.CONFIG_SET('HAVE_TRACKER') and bld.CONFIG_SET('WITH_TEVENT_GLIB_GLUE')" \
+                           "enabled=False"
+        '';
+      });
+    })
+  ];
+
   # Keep a fixed local GID for on-disk ownership and the qbittorrent service
   # account. Shared-user membership policy is carried by the matching LDAP
   # posixGroup cn=storage,ou=posix_groups,dc=skyw,dc=top.
@@ -345,6 +383,16 @@
         "server min protocol" = "SMB2_10";
 
         "load printers" = "no";
+        "vfs objects" = "catia fruit streams_xattr recycle";
+        "fruit:metadata" = "stream";
+        "fruit:nfs_aces" = "no";
+        "recycle:repository" = ".recycle/%U";
+        "recycle:keeptree" = "yes";
+        "recycle:versions" = "yes";
+        "recycle:touch" = "yes";
+        "recycle:maxsize" = "0";
+        "spotlight" = "yes";
+        "spotlight backend" = "tracker";
       };
 
       # Shared datasets
@@ -363,6 +411,7 @@
         browseable = "yes";
         "read only" = "yes";
         "valid users" = "@storage";
+        "vfs objects" = "catia fruit streams_xattr";
       };
 
       # Per-user homes — Samba auto-creates \\SKYDICK\<user> from this template
@@ -388,10 +437,31 @@
         "fruit:time machine" = "yes";
         "fruit:time machine max size" = "3T";
         "fruit:metadata" = "stream";
+        "fruit:model" = "TimeCapsule";
+        "spotlight" = "no";
       };
     };
   };
 
+  # Tracker/localsearch for Samba Spotlight search
+  environment.systemPackages = with pkgs; [ tinysparql localsearch ];
+
+  systemd.services.localsearch-index = {
+    description = "Localsearch file indexer for Samba Spotlight";
+    wants = [ "samba-smbd.service" ];
+    after = [ "samba-smbd.service" "local-fs.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      ${pkgs.localsearch}/bin/localsearch index --add /srv/public
+      ${pkgs.localsearch}/bin/localsearch index --add /srv/media/library
+      ${pkgs.localsearch}/bin/localsearch index --add /srv/users/ldx/files
+    '';
+  };
+
   services.samba-wsdd = {
     enable = true;
     openFirewall = false;
diff --git a/hosts/skydick/default.nix b/hosts/skydick/default.nix
index 58c044d..cda9c9d 100644
--- a/hosts/skydick/default.nix
+++ b/hosts/skydick/default.nix
@@ -259,7 +259,7 @@
   environment.systemPackages = with pkgs; [
     # ZFS & storage
     zfs
-    targetcli
+    targetcli-fb
     sg3_utils
     sdparm
     nvme-cli
@@ -271,7 +271,7 @@
     smartmontools
     lm_sensors
     sysstat
-    dstat
+    dool
 
     # Network
     iperf3