diff --git a/modules/vendor/nix-bitcoin/btcpayserver.nix b/modules/vendor/nix-bitcoin/btcpayserver.nix
index 9f4c4e3..4e640b3 100644
--- a/modules/vendor/nix-bitcoin/btcpayserver.nix
+++ b/modules/vendor/nix-bitcoin/btcpayserver.nix
@@ -121,7 +121,9 @@ in {
       };
       listenWhitelisted = true;
     };
-    services.clightning.enable = mkIf (cfg.btcpayserver.lightningBackend == "clightning") true;
+    # vendored fix: only enable clightning if module exists (nixpkgs unstable may have renamed/removed it)
+    # Sovran uses lnd only, so this is never true in practice
+    services.clightning.enable = mkIf (cfg.btcpayserver.lightningBackend == "clightning" && config.services ? clightning) true;
     services.lnd = mkIf (cfg.btcpayserver.lightningBackend == "lnd") {
       enable = true;
       macaroons.btcpayserver = {
@@ -129,7 +131,8 @@ in {
         permissions = ''{"entity":"info","action":"read"},{"entity":"onchain","action":"read"},{"entity":"offchain","action":"read"},{"entity":"address","action":"read"},{"entity":"message","action":"read"},{"entity":"peers","action":"read"},{"entity":"signer","action":"read"},{"entity":"invoices","action":"read"},{"entity":"invoices","action":"write"},{"entity":"address","action":"write"}'';
       };
     };
-    services.liquidd = mkIf cfg.btcpayserver.lbtc {
+    # vendored fix: liquidd may not exist in nixpkgs with this name
+    services.liquidd = mkIf (cfg.btcpayserver.lbtc && config.services ? liquidd) {
       enable = true;
       listenWhitelisted = true;
     };
@@ -213,7 +216,7 @@ in {
       '' + optionalString (cfg.btcpayserver.rootpath != null) ''
         rootpath=${cfg.btcpayserver.rootpath}
       '' + optionalString (cfg.btcpayserver.lightningBackend == "clightning") ''
-        btclightning=type=clightning;server=unix:///${cfg.clightning.dataDir}/${bitcoind.makeNetworkName "bitcoin" "regtest"}/lightning-rpc
+        btclightning=type=clightning;server=unix:///${config.services.clightning.dataDir or "/var/lib/clightning"}/${bitcoind.makeNetworkName "bitcoin" "regtest"}/lightning-rpc
       '' + optionalString (cfg.btcpayserver.lightningBackend == "lnd")
         (
           "btclightning=type=lnd-rest;" +
@@ -263,7 +266,7 @@ in {
       isSystemUser = true;
       group = cfg.btcpayserver.group;
       extraGroups = [ cfg.nbxplorer.group ]
-                    ++ optional (cfg.btcpayserver.lightningBackend == "clightning") cfg.clightning.user;
+                    ++ optional (cfg.btcpayserver.lightningBackend == "clightning" && config.services ? clightning) (config.services.clightning.user or "clightning");
       home = cfg.btcpayserver.dataDir;
     };
     users.groups.${cfg.btcpayserver.group} = {};
diff --git a/modules/vendor/nix-bitcoin/enable-tor.nix b/modules/vendor/nix-bitcoin/enable-tor.nix
index 47766f2..a3ccb6f 100644
--- a/modules/vendor/nix-bitcoin/enable-tor.nix
+++ b/modules/vendor/nix-bitcoin/enable-tor.nix
@@ -19,14 +19,14 @@ in {
     # and restrict all connections to Tor
     #
     bitcoind = defaultEnableTorProxy;
-    clightning = defaultEnableTorProxy;
+    # clightning = defaultEnableTorProxy; # vendored: not needed (Sovran uses lnd)
     lnd = defaultEnableTorProxy;
-    lightning-loop = defaultEnableTorProxy;
-    liquidd = defaultEnableTorProxy;
+    # lightning-loop = defaultEnableTorProxy; # vendored: not used
+    # liquidd = defaultEnableTorProxy; # vendored: not used
     # TODO-EXTERNAL:
     # disable Tor enforcement until btcpayserver can fetch rates over Tor
     # btcpayserver = defaultEnableTorProxy;
-    lightning-pool = defaultEnableTorProxy;
+    # lightning-pool = defaultEnableTorProxy; # vendored: not used
     mempool = defaultEnableTorProxy;
 
     # These services don't make outgoing connections
@@ -34,21 +34,21 @@ in {
     # but we restrict them to Tor just to be safe.
     #
     electrs = defaultEnforceTor;
-    fulcrum = defaultEnforceTor;
+    # fulcrum = defaultEnforceTor; # vendored: not used
     nbxplorer = defaultEnforceTor;
     rtl = defaultEnforceTor;
-    joinmarket = defaultEnforceTor;
-    joinmarket-ob-watcher = defaultEnforceTor;
-    clightning-rest = defaultEnforceTor;
+    # joinmarket = defaultEnforceTor; # vendored: not used
+    # joinmarket-ob-watcher = defaultEnforceTor; # vendored: not used
+    # clightning-rest = defaultEnforceTor; # vendored: not used
   };
 
   # Add onion services for incoming connections
   nix-bitcoin.onionServices = {
     bitcoind.enable = defaultTrue;
-    liquidd.enable = defaultTrue;
+    # liquidd.enable = defaultTrue; # stub
     electrs.enable = defaultTrue;
-    fulcrum.enable = defaultTrue;
-    joinmarket-ob-watcher.enable = defaultTrue;
+    # fulcrum.enable = defaultTrue; # stub
+    # joinmarket-ob-watcher.enable = defaultTrue; # stub
     rtl.enable = defaultTrue;
   };
 }
diff --git a/modules/vendor/nix-bitcoin/lnd.nix b/modules/vendor/nix-bitcoin/lnd.nix
index cfd77db..7f2212f 100644
--- a/modules/vendor/nix-bitcoin/lnd.nix
+++ b/modules/vendor/nix-bitcoin/lnd.nix
@@ -194,8 +194,8 @@ in {
     assertions = [
       { assertion =
           !(config.services ? clightning)
-          || !config.services.clightning.enable
-          || config.services.clightning.port != cfg.port;
+          || !(config.services.clightning.enable or false)
+          || (config.services.clightning.port or 9735) != cfg.port;
         message = ''
           LND and clightning can't both bind to lightning port 9735. Either
           disable LND/clightning or change services.clightning.port or
diff --git a/modules/vendor/nix-bitcoin/mempool.nix b/modules/vendor/nix-bitcoin/mempool.nix
index ce357b2..503dfd3 100644
--- a/modules/vendor/nix-bitcoin/mempool.nix
+++ b/modules/vendor/nix-bitcoin/mempool.nix
@@ -241,7 +241,8 @@ in {
   config = mkIf cfg.enable {
     services.bitcoind.txindex = true;
     services.electrs.enable = mkIf (cfg.electrumServer == "electrs" ) true;
-    services.fulcrum.enable = mkIf (cfg.electrumServer == "fulcrum" ) true;
+    # vendored fix: fulcrum may not exist
+    services.fulcrum.enable = mkIf (cfg.electrumServer == "fulcrum" && config.services ? fulcrum) true;
     services.mysql = {
       enable = true;
       package = pkgs.mariadb;
diff --git a/modules/vendor/nix-bitcoin/modules.nix b/modules/vendor/nix-bitcoin/modules.nix
index 4abeb46..e6ea15b 100644
--- a/modules/vendor/nix-bitcoin/modules.nix
+++ b/modules/vendor/nix-bitcoin/modules.nix
@@ -3,8 +3,10 @@
 # Only services actually used by Sovran are kept (6 services vs 20+ upstream)
 # - backups.nix removed: Sovran uses rsnapshot to Second_Drive (configuration.nix)
 # - netns-isolation.nix is now a stub (requires false for nwc-wallets)
+# - stubs.nix provides options for services referenced but not in nixpkgs unstable 2026-08
 {
   imports = [
+    ./stubs.nix
     ./nix-bitcoin.nix
     ./secrets/secrets.nix
     ./operator.nix
diff --git a/modules/vendor/nix-bitcoin/rtl.nix b/modules/vendor/nix-bitcoin/rtl.nix
index 31ef138..0249bf6 100644
--- a/modules/vendor/nix-bitcoin/rtl.nix
+++ b/modules/vendor/nix-bitcoin/rtl.nix
@@ -177,7 +177,8 @@ in {
 
     services.lnd.enable = mkIf cfg.nodes.lnd.enable true;
     services.lightning-loop.enable = mkIf lndLoopEnabled true;
-    services.clightning = mkIf cfg.nodes.clightning.enable {
+    # vendored fix: clightning may not exist in this nixpkgs
+    services.clightning = mkIf (cfg.nodes.clightning.enable && config.services ? clightning) {
       enable = true;
       plugins.clnrest.enable = true;
     };
diff --git a/modules/vendor/nix-bitcoin/stubs.nix b/modules/vendor/nix-bitcoin/stubs.nix
new file mode 100644
index 0000000..bc1c279
--- /dev/null
+++ b/modules/vendor/nix-bitcoin/stubs.nix
@@ -0,0 +1,50 @@
+{ config, lib, ... }:
+with lib;
+{
+  # Stubs for services that vendored nix-bitcoin modules reference
+  # but are not provided by nixpkgs/nixos-unstable 2026-08-08.
+  # Sovran never enables these — they just need to exist so evaluation doesn't throw
+  # "option does not exist".
+
+  options.services.clightning = mkOption { type = types.attrs; default = {}; description = "stub"; };
+  options.services.clightning.enable = mkOption { type = types.bool; default = false; };
+  options.services.clightning.port = mkOption { type = types.port; default = 9735; };
+  options.services.clightning.dataDir = mkOption { type = types.path; default = "/var/lib/clightning"; };
+  options.services.clightning.user = mkOption { type = types.str; default = "clightning"; };
+  options.services.clightning.group = mkOption { type = types.str; default = "clightning"; };
+  options.services.clightning.address = mkOption { type = types.str; default = "127.0.0.1"; };
+  options.services.clightning.rpc = mkOption { type = types.attrs; default = {}; };
+  options.services.clightning.networkDir = mkOption { type = types.path; default = "/var/lib/clightning/bitcoin"; };
+  options.services.clightning.plugins = mkOption { type = types.attrs; default = {}; };
+  options.services.clightning.plugins.clnrest = mkOption { type = types.attrs; default = {}; };
+  options.services.clightning.plugins.clnrest.enable = mkOption { type = types.bool; default = false; };
+  options.services.clightning.plugins.clnrest.address = mkOption { type = types.str; default = "127.0.0.1"; };
+  options.services.clightning.plugins.clnrest.port = mkOption { type = types.port; default = 3010; };
+
+  options.services.clightning-rest = mkOption { type = types.attrs; default = {}; };
+  options.services.clightning-rest.enable = mkOption { type = types.bool; default = false; };
+
+  options.services.liquidd = mkOption { type = types.attrs; default = {}; };
+  options.services.liquidd.enable = mkOption { type = types.bool; default = false; };
+  options.services.liquidd.dataDir = mkOption { type = types.path; default = "/var/lib/liquidd"; };
+  options.services.liquidd.address = mkOption { type = types.str; default = "127.0.0.1"; };
+  options.services.liquidd.port = mkOption { type = types.port; default = 7041; };
+  options.services.liquidd.rpc = mkOption { type = types.attrs; default = {}; };
+  options.services.liquidd.rpc.address = mkOption { type = types.str; default = "127.0.0.1"; };
+  options.services.liquidd.rpc.port = mkOption { type = types.port; default = 7040; };
+  options.services.liquidd.rpcuser = mkOption { type = types.str; default = "liquiddrpc"; };
+  options.services.liquidd.whitelistedPort = mkOption { type = types.port; default = 7042; };
+  options.services.liquidd.group = mkOption { type = types.str; default = "liquidd"; };
+
+  options.services.fulcrum = mkOption { type = types.attrs; default = {}; };
+  options.services.fulcrum.enable = mkOption { type = types.bool; default = false; };
+
+  options.services.lightning-loop = mkOption { type = types.attrs; default = {}; };
+  options.services.lightning-loop.enable = mkOption { type = types.bool; default = false; };
+  options.services.lightning-pool = mkOption { type = types.attrs; default = {}; };
+  options.services.lightning-pool.enable = mkOption { type = types.bool; default = false; };
+  options.services.joinmarket = mkOption { type = types.attrs; default = {}; };
+  options.services.joinmarket.enable = mkOption { type = types.bool; default = false; };
+  options.services.joinmarket-ob-watcher = mkOption { type = types.attrs; default = {}; };
+  options.services.joinmarket-ob-watcher.enable = mkOption { type = types.bool; default = false; };
+}