diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index f4c904ff670c88c..777e3b28f20072f 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -112,12 +112,11 @@ let
 
   environment = lib.mkMerge [
     {
+      INCUS_EDK2_PATH = ovmf;
       INCUS_LXC_TEMPLATE_CONFIG = "${pkgs.lxcfs}/share/lxc/config";
       INCUS_USBIDS_PATH = "${pkgs.hwdata}/share/hwdata/usb.ids";
       PATH = lib.mkForce serverBinPath;
     }
-    (lib.mkIf (lib.versionOlder cfg.package.version "6.3.0") { INCUS_OVMF_PATH = ovmf; })
-    (lib.mkIf (lib.versionAtLeast cfg.package.version "6.3.0") { INCUS_EDK2_PATH = ovmf; })
     (lib.mkIf (cfg.ui.enable) { "INCUS_UI" = cfg.ui.package; })
   ];
 
diff --git a/pkgs/by-name/in/incus/generic.nix b/pkgs/by-name/in/incus/generic.nix
index 7ffdc1c83ec4cf0..4216710c028098a 100644
--- a/pkgs/by-name/in/incus/generic.nix
+++ b/pkgs/by-name/in/incus/generic.nix
@@ -128,8 +128,8 @@ buildGoModule rec {
 
     ui = callPackage ./ui.nix { };
 
-    updateScript = writeScript "ovs-update.nu" ''
-      ${./update.nu} ${updateScriptArgs}
+    updateScript = writeScript "ovs-update.py" ''
+      ${./update.py} ${updateScriptArgs}
     '';
   };
 
diff --git a/pkgs/by-name/in/incus/lts.nix b/pkgs/by-name/in/incus/lts.nix
index ec0a38efb4662fe..98fe4f2e7c5de9e 100644
--- a/pkgs/by-name/in/incus/lts.nix
+++ b/pkgs/by-name/in/incus/lts.nix
@@ -1,13 +1,12 @@
 import ./generic.nix {
-  hash = "sha256-8GgzMiXn/78HkMuJ49cQA9BEQVAzPbG7jOxTScByR6Q=";
-  version = "6.0.1";
-  vendorHash = "sha256-dFg3LSG/ao73ODWcPDq5s9xUjuHabCMOB2AtngNCrlA=";
+  hash = "sha256-roPBHqy5toYF0X9mATl6QYb5GGlgPoGZYOC9vKpca88=";
+  version = "6.0.2";
+  vendorHash = "sha256-TP1NaUpsHF54mWQDcHS4uabfRJWu3k51ANNPdA4k1Go=";
   patches = [
     # qemu 9.1 compat, remove when added to LTS
     ./572afb06f66f83ca95efa1b9386fceeaa1c9e11b.patch
-    ./58eeb4eeee8a9e7f9fa9c62443d00f0ec6797078.patch
     ./0c37b7e3ec65b4d0e166e2127d9f1835320165b8.patch
   ];
   lts = true;
-  updateScriptArgs = "--lts=true --regex '6.0.*'";
+  updateScriptArgs = "--lts --regex '6.0.*'";
 }
diff --git a/pkgs/by-name/in/incus/update.nu b/pkgs/by-name/in/incus/update.nu
deleted file mode 100755
index 754da9b59abfc62..000000000000000
--- a/pkgs/by-name/in/incus/update.nu
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i nu -p nushell common-updater-scripts gnused
-
-def main [--lts = false, --regex: string] {
-  let attr = $"incus(if $lts {"-lts"})"
-  let file = $"(pwd)/pkgs/by-name/in/incus/(if $lts { "lts" } else { "package" }).nix"
-
-  let tags = list-git-tags --url=https://github.com/lxc/incus | lines | sort --natural | str replace v ''
-  let latest_tag = if $regex == null { $tags } else { $tags | find --regex $regex } | last
-  let current_version = nix eval --raw -f default.nix $"($attr).version" | str trim
-
-  if $latest_tag != $current_version {
-    print $"Updating: new ($latest_tag) != old ($current_version)"
-    update-source-version $attr $latest_tag $"--file=($file)"
-
-    let oldVendorHash = nix-instantiate . --eval --strict -A $"($attr).goModules.drvAttrs.outputHash" --json | from json
-    let checkBuild = do { nix-build -A $"($attr).goModules" } | complete
-    let vendorHash = $checkBuild.stderr | lines | str trim | find --regex 'got:[[:space:]]*sha256' | split row ' ' | last
-
-    if $vendorHash != null {
-      open $file | str replace $oldVendorHash $vendorHash | save --force $file
-    } else {
-      print $checkBuild.stderr
-      exit 1
-    }
-  }
-
-  {"lts?": $lts, before: $current_version, after: $latest_tag}
-}
diff --git a/pkgs/by-name/in/incus/update.py b/pkgs/by-name/in/incus/update.py
new file mode 100755
index 000000000000000..1db118a596f916f
--- /dev/null
+++ b/pkgs/by-name/in/incus/update.py
@@ -0,0 +1,87 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python -p python3 python3Packages.looseversion common-updater-scripts nurl
+
+import argparse
+import json
+import os
+import re
+from looseversion import LooseVersion
+from subprocess import run
+
+parser = argparse.ArgumentParser()
+parser.add_argument("--lts", action="store_true")
+parser.add_argument("--regex")
+args = parser.parse_args()
+
+nixpkgs_path = os.environ["PWD"]
+
+attr = "incus"
+file = f"pkgs/by-name/in/incus/package.nix"
+if args.lts:
+    attr = "incus-lts"
+    file = f"pkgs/by-name/in/incus/lts.nix"
+
+tags = (
+    run(["list-git-tags", "--url=https://github.com/lxc/incus"], capture_output=True)
+    .stdout.decode("utf-8")
+    .splitlines()
+)
+tags = [t.lstrip("v") for t in tags]
+
+latest_version = "0"
+for tag in tags:
+    if args.regex != None and not re.match(args.regex, tag):
+        continue
+
+    if LooseVersion(tag) > LooseVersion(latest_version):
+        latest_version = tag
+
+current_version = (
+    run(
+        ["nix", "eval", "--raw", "-f", "default.nix", f"{attr}.version"],
+        capture_output=True,
+    )
+    .stdout.decode("utf-8")
+    .strip()
+)
+
+if LooseVersion(latest_version) <= LooseVersion(current_version):
+    print("No update available")
+    exit(0)
+
+print(f"Found new version {latest_version} > {current_version}")
+
+run(["update-source-version", attr, latest_version, f"--file={file}"])
+
+current_vendor_hash = (
+    run(
+        [
+            "nix-instantiate",
+            ".",
+            "--eval",
+            "--strict",
+            "-A",
+            f"{attr}.goModules.drvAttrs.outputHash",
+            "--json",
+        ],
+        capture_output=True,
+    )
+    .stdout.decode("utf-8")
+    .strip()
+    .strip('"')
+)
+
+latest_vendor_hash = (
+    run(
+        ["nurl", "--expr", f"(import {nixpkgs_path} {{}}).{attr}.goModules"],
+        capture_output=True,
+    )
+    .stdout.decode("utf-8")
+    .strip()
+)
+
+with open(file, "r+") as f:
+    file_content = f.read()
+    file_content = re.sub(current_vendor_hash, latest_vendor_hash, file_content)
+    f.seek(0)
+    f.write(file_content)
diff --git a/pkgs/by-name/lx/lxc/package.nix b/pkgs/by-name/lx/lxc/package.nix
index 409e550109f2317..3f00ccb82b523b4 100644
--- a/pkgs/by-name/lx/lxc/package.nix
+++ b/pkgs/by-name/lx/lxc/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lxc";
-  version = "6.0.1";
+  version = "6.0.2";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "lxc";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-fJMNdMXlV1z9q1pMDh046tNmLDuK6zh6uPahTWzWMvc=";
+    hash = "sha256-qc60oSs2KahQJpSmhrctXpV2Zumv7EvlnGFaOCSCX/E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/lx/lxcfs/package.nix b/pkgs/by-name/lx/lxcfs/package.nix
index b7ade8381c05e1d..7b7516ba72c67ce 100644
--- a/pkgs/by-name/lx/lxcfs/package.nix
+++ b/pkgs/by-name/lx/lxcfs/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lxcfs";
-  version = "6.0.1";
+  version = "6.0.2";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "lxcfs";
     rev = "v${version}";
-    hash = "sha256-kJ9QaNI8v03E0//UyU6fsav1YGOlKGMxsbE8Pr1Dtic=";
+    hash = "sha256-5r1X/yUXTMC/2dNhpI+BVYeClIydefg2lurCGt7iA8Y=";
   };
 
   patches = [