chore: update nixpkgs

diff --git a/core/embed/supply-chain/imports.lock b/core/embed/supply-chain/imports.lock
index e052d015..1c06ecb4 100644
--- a/core/embed/supply-chain/imports.lock
+++ b/core/embed/supply-chain/imports.lock
@@ -177,7 +177,7 @@ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_p
 who = "Lukasz Anforowicz <lukasza@chromium.org>"
 criteria = "safe-to-deploy"
 delta = "1.14.0 -> 1.15.0"
-notes = "The delta in `lib.rs` only tweaks doc comments and `#[cfg(feature = \"std\")]`."
+notes = 'The delta in `lib.rs` only tweaks doc comments and `#[cfg(feature = "std")]`.'
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
 
 [[audits.google.audits.equivalent]]
@@ -278,8 +278,8 @@ who = "Lukasz Anforowicz <lukasza@chromium.org>"
 criteria = "safe-to-deploy"
 version = "1.0.78"
 notes = """
-Grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits
-(except for a benign \"fs\" hit in a doc comment)
+Grepped for "crypt", "cipher", "fs", "net" - there were no hits
+(except for a benign "fs" hit in a doc comment)
 
 Notes from the `unsafe` review can be found in https://crrev.com/c/5385745.
 """
@@ -391,8 +391,8 @@ who = "Lukasz Anforowicz <lukasza@chromium.org>"
 criteria = "safe-to-deploy"
 version = "1.0.35"
 notes = """
-Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits
-(except for benign \"net\" hit in tests and \"fs\" hit in README.md)
+Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits
+(except for benign "net" hit in tests and "fs" hit in README.md)
 """
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
 
@@ -568,7 +568,7 @@ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_p
 who = "Lukasz Anforowicz <lukasza@chromium.org>"
 criteria = "safe-to-deploy"
 version = "1.0.197"
-notes = "Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits"
+notes = 'Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits'
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
 
 [[audits.google.audits.serde_derive]]
@@ -587,7 +587,7 @@ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_p
 who = "Lukasz Anforowicz <lukasza@chromium.org>"
 criteria = "safe-to-deploy"
 delta = "1.0.202 -> 1.0.203"
-notes = "Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits"
+notes = 'Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits'
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
 
 [[audits.google.audits.serde_derive]]
diff --git a/core/src/apps/management/recovery_device/layout.py b/core/src/apps/management/recovery_device/layout.py
index edfb99d3..4df2a440 100644
--- a/core/src/apps/management/recovery_device/layout.py
+++ b/core/src/apps/management/recovery_device/layout.py
@@ -295,8 +295,6 @@ if not utils.USE_N4W1:
 else:
 
     if TYPE_CHECKING:
-        from trezor.messages import BackupMethod
-
         from .recover import Slip39State
 
     async def choose_handler(method: BackupMethod | None) -> type[RecoveryHandler]:
diff --git a/python/src/trezorlib/_internal/firmware_headers.py b/python/src/trezorlib/_internal/firmware_headers.py
index 93721ad5..24b3eb4d 100644
--- a/python/src/trezorlib/_internal/firmware_headers.py
+++ b/python/src/trezorlib/_internal/firmware_headers.py
@@ -516,9 +516,7 @@ class BootloaderV2Image(firmware.BootableImage):
             raise ValueError("Sigmask specifies more public keys than provided.")
 
         # Verify ed25519 signatures
-        if mask.bit_count() != len(  # type: ignore [Cannot access attribute] # bit_count() is not available with Python 3.9
-            self.unauth.ec_signatures
-        ):
+        if mask.bit_count() != len(self.unauth.ec_signatures):
             raise ValueError("Sigmask does not specify valid number of ed25519 keys.")
 
         sig_idx = 0
@@ -533,9 +531,7 @@ class BootloaderV2Image(firmware.BootableImage):
             sig_idx += 1
 
         # Verify slh-dsa signatures
-        if mask.bit_count() != len(  # type: ignore [Cannot access attribute] # bit_count() is not available with Python 3.9
-            self.unauth.slh_signatures
-        ):
+        if mask.bit_count() != len(self.unauth.slh_signatures):
             raise ValueError("Sigmask does not specify valid number of slh-dsa keys.")
 
         sig_idx = 0
diff --git a/python/src/trezorlib/firmware/__init__.py b/python/src/trezorlib/firmware/__init__.py
index 67222b58..b866d161 100644
--- a/python/src/trezorlib/firmware/__init__.py
+++ b/python/src/trezorlib/firmware/__init__.py
@@ -45,11 +45,9 @@ if True:
 if t.TYPE_CHECKING:
     from ..client import Session
 
-    T = t.TypeVar("T", bound="FirmwareType")
-
     class FirmwareType(Protocol):
         @classmethod
-        def parse(cls: type[T], data: bytes) -> T: ...
+        def parse(cls, data: bytes) -> FirmwareType: ...
 
         def verify(self, dev_keys: bool = False) -> None: ...
 
diff --git a/shell.nix b/shell.nix
index 9f21676b..c0aca672 100644
--- a/shell.nix
+++ b/shell.nix
@@ -12,10 +12,10 @@ let
   });
   # define this variable and devTools if you want nrf{util,connect}
   acceptJlink = builtins.getEnv "TREZOR_FIRMWARE_ACCEPT_JLINK_LICENSE" == "yes";
-  # the last successful build of nixpkgs-unstable as of 2026-03-16
+  # the last successful build of nixpkgs-unstable as of 2026-07-17
   nixpkgs = import (builtins.fetchTarball {
-    url = "https://github.com/NixOS/nixpkgs/archive/a07d4ce6bee67d7c838a8a5796e75dff9caa21ef.tar.gz";
-    sha256 = "0f6zni3jn6ji5icwbidbpmcgxdal2qnjszp7ragdcy0857hvq3c5";
+    url = "https://github.com/NixOS/nixpkgs/archive/59682e0069f0ed0a452e2179a7f4c1f247027b9e.tar.gz";
+    sha256 = "136vd5g72cq5xgwnxzcwwjdl16wgi4as7dyfjj6dp59fh0fvxj67";
   }) {
     config = {
       allowUnfree = acceptJlink;