diff --git a/README.md b/README.md
index 725c8e5..4e0a8ea 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,7 @@ nix run git+https://code.m3ta.dev/m3tam3re/nixpkgs#zellij-ps
 | ------------------ | ------------------------------------- |
 | `code2prompt`      | Convert code to prompts               |
 | `hyprpaper-random` | Random wallpaper setter for Hyprpaper |
+| `kestractl`        | CLI for the Kestra workflow orchestration platform |
 | `launch-webapp`    | Launch web applications               |
 | `mem0`             | AI memory assistant with vector storage |
 | `msty-studio`      | Msty Studio application               |
diff --git a/docs/README.md b/docs/README.md
index 824e2a7..2a754aa 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -30,6 +30,7 @@ Documentation for all custom packages:
 
 - [code2prompt](./packages/code2prompt.md) - Convert code to prompts
 - [hyprpaper-random](./packages/hyprpaper-random.md) - Random wallpaper setter for Hyprpaper
+- [kestractl](./packages/kestractl.md) - CLI for the Kestra workflow orchestration platform
 - [launch-webapp](./packages/launch-webapp.md) - Launch web applications
 - [mem0](./packages/mem0.md) - AI memory assistant with vector storage
 - [msty-studio](./packages/msty-studio.md) - Msty Studio application
diff --git a/flake.lock b/flake.lock
index b561cb2..37a8ab5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -39,16 +39,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1773072574,
-        "narHash": "sha256-smGIc6lYWSjfmGAikoYpP7GbB6mWacrPWrRtp/+HJ3E=",
+        "lastModified": 1773628428,
+        "narHash": "sha256-JUlFfILzcUCME3mOxdxDbcCXphNVEfVGIKhwAwtJPl8=",
         "owner": "anomalyco",
         "repo": "opencode",
-        "rev": "c6262f9d4002d86a1f1795c306aa329d45361d12",
+        "rev": "4ee426ba549131c4903a71dfb6259200467aca81",
         "type": "github"
       },
       "original": {
         "owner": "anomalyco",
-        "ref": "v1.2.24",
+        "ref": "v1.2.27",
         "repo": "opencode",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 241db17..406c27a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,7 +7,7 @@
 
     # opencode needs newer bun from master
     opencode = {
-      url = "github:anomalyco/opencode/v1.2.24";
+      url = "github:anomalyco/opencode/v1.2.27";
       inputs.nixpkgs.follows = "nixpkgs-master";
     };
 
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 4109419..b631e4c 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -12,12 +12,12 @@
   launch-webapp = pkgs.callPackage ./launch-webapp {};
   mem0 = pkgs.callPackage ./mem0 {};
   msty-studio = pkgs.callPackage ./msty-studio {};
-  notesmd-cli = pkgs.callPackage ./notesmd-cli {};
   n8n = pkgs.callPackage ./n8n {};
   pomodoro-timer = pkgs.callPackage ./pomodoro-timer {};
   rofi-project-opener = pkgs.callPackage ./rofi-project-opener {};
   stt-ptt = pkgs.callPackage ./stt-ptt {};
   tuxedo-backlight = pkgs.callPackage ./tuxedo-backlight {};
+  kestractl = pkgs.callPackage ./kestractl {};
   zellij-ps = pkgs.callPackage ./zellij-ps {};
 
   # Imported from flake inputs
diff --git a/pkgs/kestractl/default.nix b/pkgs/kestractl/default.nix
new file mode 100644
index 0000000..d3e46d7
--- /dev/null
+++ b/pkgs/kestractl/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+}: let
+  sources = lib.importJSON ./sources.json;
+  source = sources.sources.${stdenv.hostPlatform.system};
+in
+  stdenv.mkDerivation {
+    pname = "kestractl";
+    version = sources.version;
+
+    src = fetchurl {
+      inherit (source) url hash;
+    };
+
+    nativeBuildInputs = [autoPatchelfHook];
+
+    unpackPhase = ''
+      tar -xzf $src
+    '';
+
+    installPhase = ''
+      install -Dm755 kestractl $out/bin/kestractl
+    '';
+
+    passthru.updateScript = ./update.sh;
+
+    meta = with lib; {
+      description = "CLI for the Kestra workflow orchestration platform";
+      homepage = "https://github.com/kestra-io/kestractl";
+      license = licenses.asl20;
+      platforms = attrNames sources.sources;
+      mainProgram = "kestractl";
+    };
+  }
diff --git a/pkgs/kestractl/sources.json b/pkgs/kestractl/sources.json
new file mode 100644
index 0000000..771d005
--- /dev/null
+++ b/pkgs/kestractl/sources.json
@@ -0,0 +1,13 @@
+{
+  "version": "1.0.0",
+  "sources": {
+    "x86_64-linux": {
+      "url": "https://github.com/kestra-io/kestractl/releases/download/1.0.0/kestractl_1.0.0_linux_amd64.tar.gz",
+      "hash": "sha256-lX6A+2DJdA5otXZLbBGZSUQUdh7CoHmLoy6GJ/AvUJE="
+    },
+    "aarch64-linux": {
+      "url": "https://github.com/kestra-io/kestractl/releases/download/1.0.0/kestractl_1.0.0_linux_arm64.tar.gz",
+      "hash": "sha256-6ashiuDQ6fv5nkFGM7giSUCmHR44QRlDCSD9rPzq1Ac="
+    }
+  }
+}
diff --git a/pkgs/kestractl/update.sh b/pkgs/kestractl/update.sh
new file mode 100755
index 0000000..85f4280
--- /dev/null
+++ b/pkgs/kestractl/update.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Update kestractl sources.json with the latest release from GitHub.
+# Usage: ./update.sh
+# Called automatically by: nix-update --update-script kestractl
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SOURCES_FILE="$SCRIPT_DIR/sources.json"
+
+# Map Nix system -> GitHub release asset name fragment
+declare -A SYSTEMS=(
+  ["x86_64-linux"]="linux_amd64"
+  ["aarch64-linux"]="linux_arm64"
+)
+
+echo "Fetching latest kestractl release..."
+LATEST=$(curl -fsSL "https://api.github.com/repos/kestra-io/kestractl/releases/latest")
+VERSION=$(echo "$LATEST" | jq -r '.tag_name')
+echo "Latest version: $VERSION"
+
+CURRENT_VERSION=$(jq -r '.version' "$SOURCES_FILE")
+if [[ "$VERSION" == "$CURRENT_VERSION" ]]; then
+  echo "Already at latest version $VERSION, nothing to do."
+  exit 0
+fi
+
+NEW_SOURCES="{}"
+
+for NIX_SYSTEM in "${!SYSTEMS[@]}"; do
+  ASSET_FRAG="${SYSTEMS[$NIX_SYSTEM]}"
+  URL="https://github.com/kestra-io/kestractl/releases/download/${VERSION}/kestractl_${VERSION}_${ASSET_FRAG}.tar.gz"
+
+  echo "Fetching hash for $NIX_SYSTEM ($URL)..."
+  HASH=$(nix-prefetch-url --type sha256 "$URL" 2>/dev/null)
+  SRI=$(nix hash to-sri --type sha256 "$HASH")
+
+  NEW_SOURCES=$(echo "$NEW_SOURCES" | jq \
+    --arg sys "$NIX_SYSTEM" \
+    --arg url "$URL" \
+    --arg hash "$SRI" \
+    '. + {($sys): {url: $url, hash: $hash}}')
+done
+
+jq -n \
+  --arg version "$VERSION" \
+  --argjson sources "$NEW_SOURCES" \
+  '{"version": $version, "sources": $sources}' \
+  > "$SOURCES_FILE"
+
+echo "Updated $SOURCES_FILE to $VERSION"
diff --git a/pkgs/n8n/default.nix b/pkgs/n8n/default.nix
index 3eb8242..91b1bc2 100644
--- a/pkgs/n8n/default.nix
+++ b/pkgs/n8n/default.nix
@@ -16,24 +16,29 @@
   libpq,
   makeWrapper,
 }: let
-  python = python3.withPackages (ps: with ps; [websockets]);
+  python = python3.withPackages (
+    ps:
+      with ps; [
+        websockets
+      ]
+  );
 in
   stdenv.mkDerivation (finalAttrs: {
     pname = "n8n";
-    version = "2.9.4";
+    version = "2.11.4";
 
     src = fetchFromGitHub {
       owner = "n8n-io";
       repo = "n8n";
       tag = "n8n@${finalAttrs.version}";
-      hash = "sha256-XXQPZHtY66gOQ+nYH+Q1IjbR+SRZ9g06sgBy2x8gGh4=";
+      hash = "sha256-mhfVipTAoHCY1BPSV5Ge1iQpa/LaUCw2aiI3KFkW0CI=";
     };
 
     pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
       pnpm = pnpm_10;
       fetcherVersion = 3;
-      hash = "sha256-TU7HIShYj20QtdcthP0nQdubYl0bdy+XM3CoX5Rvhzk=";
+      hash = "sha256-fWE/uJTs7lawbVu7iDSrpufqFaOkzFc5jjTD8u3Drok=";
     };
 
     nativeBuildInputs =
@@ -44,9 +49,17 @@ in
         node-gyp # required to build sqlite3 bindings
         makeWrapper
       ]
-      ++ lib.optional stdenv.hostPlatform.isDarwin [cctools xcbuild];
+      ++ lib.optional stdenv.hostPlatform.isDarwin [
+        cctools
+        xcbuild
+      ];
 
-    buildInputs = [nodejs libkrb5 libmongocrypt libpq];
+    buildInputs = [
+      nodejs
+      libkrb5
+      libmongocrypt
+      libpq
+    ];
 
     buildPhase = ''
       runHook preBuild
@@ -55,6 +68,12 @@ in
       node-gyp rebuild
       popd
 
+      # isolated-vm is a native addon required by n8n-nodes-base (Merge node SQL sandbox)
+      # since n8n 2.11.x; must be compiled before pnpm build runs generate-metadata
+      pushd node_modules/isolated-vm
+      node-gyp rebuild
+      popd
+
       # TODO: use deploy after resolved https://github.com/pnpm/pnpm/issues/5315
       pnpm build --filter=n8n
 
@@ -119,7 +138,12 @@ in
       '';
       homepage = "https://n8n.io";
       changelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${finalAttrs.version}";
-      maintainers = with lib.maintainers; [gepbird AdrienLemaire sweenu];
+      maintainers = with lib.maintainers; [
+        gepbird
+        AdrienLemaire
+        sweenu
+        wrbbz
+      ];
       license = lib.licenses.sustainableUse;
       mainProgram = "n8n";
       platforms = lib.platforms.unix;
diff --git a/pkgs/notesmd-cli/default.nix b/pkgs/notesmd-cli/default.nix
deleted file mode 100644
index ecb7a21..0000000
--- a/pkgs/notesmd-cli/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  nix-update-script,
-}:
-buildGoModule (finalAttrs: {
-  pname = "notesmd-cli";
-  version = "0.3.2";
-
-  src = fetchFromGitHub {
-    owner = "Yakitrak";
-    repo = "notesmd-cli";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-/yewtA5eJ4hxwZ4bBx8Pef+/TSY6Hfv15AAB9lxsW+4=";
-  };
-
-  vendorHash = null;
-
-  ldflags = ["-s" "-w"];
-
-  passthru.updateScript = nix-update-script {};
-
-  meta = {
-    description = "Obsidian CLI (Community) - Interact with Obsidian in the terminal";
-    homepage = "https://github.com/Yakitrak/notesmd-cli";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.unix;
-    mainProgram = "notesmd-cli";
-  };
-})