diff --git a/config/common/default.nix b/config/common/default.nix
index 459289f..c8930ec 100644
--- a/config/common/default.nix
+++ b/config/common/default.nix
@@ -41,6 +41,7 @@
   security.acme = {
     defaults.email = "acme@grzb.de";
     acceptTerms = true;
+    preliminarySelfsigned = true;
   };
 
   # Print the ed25519 public ssh host key to console when booting
diff --git a/config/hosts/mastodon/mastodon.nix b/config/hosts/mastodon/mastodon.nix
index c1c839b..bae9b17 100644
--- a/config/hosts/mastodon/mastodon.nix
+++ b/config/hosts/mastodon/mastodon.nix
@@ -2,8 +2,8 @@
 let
   tangerineUI = pkgs.fetchgit {
     url = "https://github.com/nileane/TangerineUI-for-Mastodon.git";
-    rev = "v2.4.4";
-    hash = "sha256-58xiS2yzv4z24IULJQWpkqV1Op6e+U6SFd1XjpAB6Go=";
+    rev = "v2.4.3";
+    hash = "sha256-OThT3fp676RMfYY3ehzM4DnAlJOqdPoYIHpoBbN/RHQ=";
   };
   mastodonModern = pkgs.fetchgit {
     url = "https://git.gay/freeplay/Mastodon-Modern.git";
@@ -16,14 +16,14 @@ let
   };
   mastodonNekoverseOverlay = final: prev: {
     mastodon = (prev.mastodon.override rec {
-      version = "4.4.3";
+      version = "4.4.1";
       srcOverride = final.applyPatches {
         src = pkgs.stdenv.mkDerivation {
           name = "mastodonWithThemes";
           src = pkgs.fetchgit {
             url = "https://github.com/mastodon/mastodon.git";
             rev = "v${version}";
-            sha256 = "sha256-HFvsf8uNP5TV6vPaIkWKnuOKExQhgvrhyRWf3OCqIDk=";
+            sha256 = "sha256-hu6AmR0CvI3lVixJ2UmWY3KAlWbqYULCQAjRGJcuIhc=";
           };
           # mastodon ships with broken symlinks, disable the check for that for now
           dontCheckForBrokenSymlinks = true;
diff --git a/config/hosts/matrix/configuration.nix b/config/hosts/matrix/configuration.nix
index a52998c..9ffa4c6 100644
--- a/config/hosts/matrix/configuration.nix
+++ b/config/hosts/matrix/configuration.nix
@@ -9,7 +9,7 @@
     hostName = "matrix";
     firewall = {
       enable = true;
-      allowedTCPPorts = [ 80 8443 8448 9000 ];
+      allowedTCPPorts = [ 80 8443 8448 ];
     };
   };
 
diff --git a/config/hosts/matrix/matrix-synapse.nix b/config/hosts/matrix/matrix-synapse.nix
index 371eb95..82b82e1 100644
--- a/config/hosts/matrix/matrix-synapse.nix
+++ b/config/hosts/matrix/matrix-synapse.nix
@@ -3,40 +3,26 @@
   services.matrix-synapse = {
     enable = true;
     settings = {
-      listeners = [
-        {
-          port = 8008;
-          bind_addresses = [
-            "::1"
-            "127.0.0.1"
-          ];
-          type = "http";
-          tls = false;
-          x_forwarded = true;
-          resources = [
-            {
-              compress = true;
-              names = [ "client" ];
-            }
-            {
-              compress = false;
-              names = [ "federation" ];
-            }
-          ];
-        }
-        {
-          port = 9000;
-          type = "http";
-          tls = false;
-          bind_addresses = [
-            "0.0.0.0"
-          ];
-          resources = [{
-            names = [ "metrics" ];
+      listeners = [{
+        port = 8008;
+        bind_addresses = [
+          "::1"
+          "127.0.0.1"
+        ];
+        type = "http";
+        tls = false;
+        x_forwarded = true;
+        resources = [
+          {
+            compress = true;
+            names = [ "client" ];
+          }
+          {
             compress = false;
-          }];
-        }
-      ];
+            names = [ "federation" ];
+          }
+        ];
+      }];
       server_name = "nekover.se";
       public_baseurl = "https://matrix.nekover.se";
       database = {
@@ -54,7 +40,6 @@
       signing_key_path = "/secrets/matrix-homeserver-signing-key.secret";
       admin_contact = "mailto:admin@nekover.se";
       web_client_location = "https://element.nekover.se";
-      enable_metrics = true;
       turn_uris = [
         "turns:turn.nekover.se?transport=udp"
         "turns:turn.nekover.se?transport=tcp"
diff --git a/config/hosts/metrics/nginx.nix b/config/hosts/metrics/nginx.nix
index 9e31454..aefb0b5 100644
--- a/config/hosts/metrics/nginx.nix
+++ b/config/hosts/metrics/nginx.nix
@@ -22,6 +22,25 @@
           proxyWebsockets = true;
         };
       };
+      "alertmanager.grzb.de"= {
+        forceSSL = true;
+        enableACME = true;
+        listen = [
+          {
+            addr = "0.0.0.0";
+            port = 80;
+          }
+          {
+            addr = "0.0.0.0";
+            port = 443;
+            ssl = true;
+          }
+        ];
+        locations."/" = {
+          proxyPass = "http://${config.services.prometheus.alertmanager.listenAddress}:${builtins.toString config.services.prometheus.alertmanager.port}";
+          proxyWebsockets = true;
+        };
+      };
     };
   };
 }
diff --git a/config/hosts/metrics/prometheus.nix b/config/hosts/metrics/prometheus.nix
index 0163c43..236fb58 100644
--- a/config/hosts/metrics/prometheus.nix
+++ b/config/hosts/metrics/prometheus.nix
@@ -1,16 +1,8 @@
-{ hosts, pkgs, ... }:
-let
-  # https://github.com/element-hq/synapse/tree/master/contrib/prometheus/
-  synapseRules = pkgs.fetchurl {
-    url = "https://raw.githubusercontent.com/element-hq/synapse/refs/heads/master/contrib/prometheus/synapse-v2.rules";
-    hash = "sha256-WldlBdCMzul49OlFhJMsrx4MYFakHTa36Y9HnV22EwI=";
-  };
-in
+{ hosts, ... }:
 {
   services.prometheus = {
     enable = true;
     retentionTime = "90d";
-    ruleFiles = [ synapseRules ];
     scrapeConfigs = [
       {
         job_name = "node";
@@ -23,14 +15,6 @@ in
           };
         }) (builtins.attrNames hosts);
       }
-      {
-        job_name = "synapse";
-        scrape_interval = "15s";
-        metrics_path = "/_synapse/metrics";
-        static_configs = [{
-          targets = [ "matrix.vs.grzb.de:9000" ];
-        }];
-      }
     ];
   };
 }
diff --git a/config/hosts/web-public-2/virtualHosts/element.nekover.se.nix b/config/hosts/web-public-2/virtualHosts/element.nekover.se.nix
index 433da35..0cdedaf 100644
--- a/config/hosts/web-public-2/virtualHosts/element.nekover.se.nix
+++ b/config/hosts/web-public-2/virtualHosts/element.nekover.se.nix
@@ -1,9 +1,9 @@
 { pkgs, ... }:
 let
-  elementWebVersion = "1.11.109";
+  elementWebVersion = "1.11.106";
   element-web = pkgs.fetchzip {
     url = "https://github.com/vector-im/element-web/releases/download/v${elementWebVersion}/element-v${elementWebVersion}.tar.gz";
-    sha256 = "sha256-eKPClYJxUhCJznI1+dv9w2h0CoSKgZsBZCsuM3KH5ag=";
+    sha256 = "sha256-5E6za7G7Olia5VzOnBjYMeGJ2Xifqx+vDmCFgNLaRZo=";
   };
   elementWebSecurityHeaders = ''
   	# Configuration best practices
diff --git a/flake.lock b/flake.lock
index 525502b..443432b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -118,11 +118,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1755678965,
-        "narHash": "sha256-zyEsoxHTMIbyYWpc4n+jiKwZ9TcIE4DPotdxAe2Jrso=",
+        "lastModified": 1754951463,
+        "narHash": "sha256-QokKO2Ofo4hW5XvcMdZ89XEPAyFo6vqz7yCD5fx9wFw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0ee3848fea3e9c7dadf47cf1e89f8c13878e9f6f",
+        "rev": "216c1318892aa8236e38dcbc6dfd976f5eff4e48",
         "type": "github"
       },
       "original": {
@@ -150,11 +150,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1755716446,
-        "narHash": "sha256-AdVENrXoFws0sENT2Sz9SMavbqVJnATmCODuqJ7GcSs=",
+        "lastModified": 1754986950,
+        "narHash": "sha256-8sbLVtESf/0gBp522Bz7TSvgulzTOFx9/wG92tBM4GE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b0eccfbc0168243438e8a6747fcdfb1bb796a3f7",
+        "rev": "cfa72d41e8b342aea82ee6ae28ecfc2293ac599b",
         "type": "github"
       },
       "original": {
@@ -166,11 +166,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1755672759,
-        "narHash": "sha256-YO9q05I+vi6zrHpxeBcDnQYKX7TS4T3SxPXYd6N00XA=",
+        "lastModified": 1754975461,
+        "narHash": "sha256-F/EzILKOWZ4UvCbj655MLAf2EfjbhFbz1iKrxaJxmuk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "25bf5c5df47ae79b24fbae8d0d3f6480dadde3ed",
+        "rev": "cca779286a4dfd33a04d11954829dfeca0904b79",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
         "nixpkgs-25_05": "nixpkgs-25_05"
       },
       "locked": {
-        "lastModified": 1755110674,
-        "narHash": "sha256-PigqTAGkdBYXVFWsJnqcirrLeFqRFN4PFigLA8FzxeI=",
+        "lastModified": 1747965231,
+        "narHash": "sha256-BW3ktviEhfCN/z3+kEyzpDKAI8qFTwO7+S0NVA0C90o=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "f5936247dbdb8501221978562ab0b302dd75456c",
+        "rev": "53007af63fade28853408370c4c600a63dd97f41",
         "type": "gitlab"
       },
       "original": {