diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 7518e3993820..a42bfb502d3c 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -127,8 +127,9 @@ buildStdenv.mkDerivation ({
   inherit src unpackPhase meta;
 
   patches = [
-    ./env_var_for_system_dir.patch
   ] ++
+  lib.optional (lib.versionOlder ffversion "86") ./env_var_for_system_dir-ff85.patch ++
+  lib.optional (lib.versionAtLeast ffversion "86") ./env_var_for_system_dir-ff86.patch ++
   lib.optional (lib.versionOlder ffversion "83") ./no-buildconfig-ffx76.patch ++
   lib.optional (lib.versionAtLeast ffversion "84") ./no-buildconfig-ffx84.patch ++
   lib.optional (ltoSupport && lib.versionOlder ffversion "84") ./lto-dependentlibs-generation-ffx83.patch ++
diff --git a/pkgs/applications/networking/browsers/firefox/env_var_for_system_dir.patch b/pkgs/applications/networking/browsers/firefox/env_var_for_system_dir-ff85.patch
similarity index 100%
rename from pkgs/applications/networking/browsers/firefox/env_var_for_system_dir.patch
rename to pkgs/applications/networking/browsers/firefox/env_var_for_system_dir-ff85.patch
diff --git a/pkgs/applications/networking/browsers/firefox/env_var_for_system_dir-ff86.patch b/pkgs/applications/networking/browsers/firefox/env_var_for_system_dir-ff86.patch
new file mode 100644
index 000000000000..f7a9cb773455
--- /dev/null
+++ b/pkgs/applications/networking/browsers/firefox/env_var_for_system_dir-ff86.patch
@@ -0,0 +1,21 @@
+diff -r 22fc47c968f2 toolkit/xre/nsXREDirProvider.cpp
+--- a/toolkit/xre/nsXREDirProvider.cpp	Mon Dec 14 15:09:17 2020 +0000
++++ b/toolkit/xre/nsXREDirProvider.cpp	Tue Feb 23 23:38:56 2021 +0100
+@@ -11,6 +11,7 @@
+ 
+ #include "jsapi.h"
+ #include "xpcpublic.h"
++#include "prenv.h"
+ 
+ #include "nsIAppStartup.h"
+ #include "nsIFile.h"
+@@ -305,7 +306,8 @@
+       "/usr/lib/mozilla"_ns
+ #    endif
+       ;
+-  rv = NS_NewNativeLocalFile(dirname, false, getter_AddRefs(localDir));
++  const char* pathVar = PR_GetEnv("MOZ_SYSTEM_DIR");
++  rv = NS_NewNativeLocalFile((pathVar && *pathVar) ? nsDependentCString(pathVar) : reinterpret_cast<const nsCString&>(dirname), false, getter_AddRefs(localDir));
+ #  endif
+ 
+   if (NS_SUCCEEDED(rv)) {
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index 86d91d21e3c9..925374d38e8b 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    ffversion = "85.0.2";
+    ffversion = "86.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "2m46li5ni1m4xv42h99rn2hhhv2mqy229wihmzxmgvws1rh2h11yf6x2a07akkjrsp2dmwxmmkhmf9dhakgj9i55z5qqi99azyx07df";
+      sha512 = "e613cdcadfd71a01800a72c08c590032605ca8a8a0ba93326ffba93c2819f629fd620c23d00ca1274b203adc20acfe5d7913fee240ff14819fb1377ed08b1214";
     };
 
     meta = {
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 7b02e3497f0a..81a51c7beaea 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -18,7 +18,7 @@ let
   #       It will rebuild itself using the version of this package (NSS) and if
   #       an update is required do the required changes to the expression.
   #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
-  version = "3.60";
+  version = "3.62";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -27,7 +27,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "0ggyj3ax3kal65sl1vl4nfhx2s08blg4dg8iwlxcax5qb9bxbaw4";
+    sha256 = "0y2ld90bncjjggrn64c7g7mq9i03z6dc3r2kz978snz2xiydzml6";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/tools/rust/cbindgen/default.nix b/pkgs/development/tools/rust/cbindgen/default.nix
index 508090553375..da552600cdc2 100644
--- a/pkgs/development/tools/rust/cbindgen/default.nix
+++ b/pkgs/development/tools/rust/cbindgen/default.nix
@@ -1,23 +1,32 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, Security }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, python3Packages, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-cbindgen";
-  version = "0.15.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "eqrion";
     repo = "cbindgen";
     rev = "v${version}";
-    sha256 = "19bwllrajks286wl4zc5axgh4m9qqxdnc5024c30hyk0xnjffd0c";
+    sha256 = "1w9gf6fl1ncm2zlh0p29lislfsd35zd1mhns2mrxl2n734zavaqf";
   };
 
-  cargoSha256 = "1lzzckzcgj496chbfd6lhwxcangv0krx8m5k2jwffnb9mfgac7hx";
+  cargoSha256 = "12jw1m842gzy0ma4drgmwk1jac663vysllfpl9cglr039j1sfsx2";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
+  checkInputs = [
+    python3Packages.cython
+  ];
+
   checkFlags = [
+    # Disable tests that require rust unstable features
     # https://github.com/eqrion/cbindgen/issues/338
     "--skip test_expand"
+    "--skip test_bitfield"
+    "--skip lib_default_uses_debug_build"
+    "--skip lib_explicit_debug_build"
+    "--skip lib_explicit_release_build"
   ];
 
   meta = with lib; {