diff --git a/nixos/modules/config/pulseaudio.nix b/nixos/modules/config/pulseaudio.nix
index 3fd882789af..e16a021ec20 100644
--- a/nixos/modules/config/pulseaudio.nix
+++ b/nixos/modules/config/pulseaudio.nix
@@ -144,8 +144,8 @@ in {
 
       package = mkOption {
         type = types.package;
-        default = pulseaudioLight;
-        defaultText = "pkgs.pulseaudioLight";
+        default = pkgs.pulseaudio;
+        defaultText = "pkgs.pulseaudio";
         example = literalExample "pkgs.pulseaudioFull";
         description = ''
           The PulseAudio derivation to use.  This can be used to enable
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 0290eff22fb..ddec21b5f6e 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -120,8 +120,8 @@ let
 
       shell = mkOption {
         type = types.either types.shellPackage types.path;
-        default = pkgs.nologin;
-        defaultText = "pkgs.nologin";
+        default = pkgs.shadow;
+        defaultText = "pkgs.shadow";
         example = literalExample "pkgs.bashInteractive";
         description = ''
           The path to the user's shell. Can use shell derivations,
diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix
index 87409db4320..3d002bc2232 100644
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -104,7 +104,7 @@ in {
 
   config = mkIf cfg.enable {
 
-    environment.systemPackages = with pkgs; [ libvirt netcat-openbsd cfg.qemuPackage ];
+    environment.systemPackages = with pkgs; [ libvirt libressl.nc cfg.qemuPackage ];
 
     boot.kernelModules = [ "tun" ];
 
diff --git a/nixos/tests/common/letsencrypt/default.nix b/nixos/tests/common/letsencrypt/default.nix
index 4b841a03cc4..73aac51a012 100644
--- a/nixos/tests/common/letsencrypt/default.nix
+++ b/nixos/tests/common/letsencrypt/default.nix
@@ -304,7 +304,7 @@ let
         serviceConfig.Type = "oneshot";
         serviceConfig.RemainAfterExit = true;
         script = let
-          netcat = "${pkgs.netcat-openbsd}/bin/nc";
+          netcat = "${pkgs.libressl.nc}/bin/nc";
           portCheck = "${netcat} -z 127.0.0.1 ${toString attrs.waitForPort}";
         in "while ! ${portCheck}; do :; done";
       };
@@ -435,7 +435,7 @@ in {
         serviceConfig.RemainAfterExit = true;
         script = let
           ports = lib.range 8000 8005 ++ lib.singleton 80;
-          netcat = "${pkgs.netcat-openbsd}/bin/nc";
+          netcat = "${pkgs.libressl.nc}/bin/nc";
           mkPortCheck = port: "${netcat} -z 127.0.0.1 ${toString port}";
           checks = "(${lib.concatMapStringsSep " && " mkPortCheck ports})";
         in "while ! ${checks}; do :; done";