diff --git a/ops/nixos/bvm-ipfs/default.nix b/ops/nixos/bvm-ipfs/default.nix
index bfe30dcadd..b476cb5f4d 100644
--- a/ops/nixos/bvm-ipfs/default.nix
+++ b/ops/nixos/bvm-ipfs/default.nix
@@ -38,7 +38,7 @@
   services.kubo = {
     enable = true;
     dataDir = "/store/ipfs";
-    extraConfig = {
+    settings = {
       Experimental.FilestoreEnabled = true;
       Addresses = let
         internalv4 = ["127.0.0.1" "10.100.0.203" config.my.ip.tailscale];
diff --git a/ops/nixos/clouvider-fra01/default.nix b/ops/nixos/clouvider-fra01/default.nix
index ae6686c6c8..3fe4d4821a 100644
--- a/ops/nixos/clouvider-fra01/default.nix
+++ b/ops/nixos/clouvider-fra01/default.nix
@@ -166,7 +166,7 @@ in {
 
   services.kubo = {
     enable = true;
-    extraConfig = {
+    settings = {
       Discovery.MDNS.Enabled = false;
       Swarm.DisableNatPortMap = true;
       Experimental.FilestoreEnabled = true;
diff --git a/ops/nixos/totoro/default.nix b/ops/nixos/totoro/default.nix
index 6efed72746..38842e0a95 100644
--- a/ops/nixos/totoro/default.nix
+++ b/ops/nixos/totoro/default.nix
@@ -437,16 +437,12 @@ in {
   };
   services.grafana = {
     enable = true;
-    addr = "0.0.0.0";
-    port = 3000;
-    domain = "grafana.int.lukegb.com";
-    rootUrl = "https://grafana.int.lukegb.com/";
 
-    extraOptions = let
-      convertName = name: lib.toUpper (builtins.replaceStrings ["." "-"] ["_" "_"] name);
-      convertOptionSection = sectionName: lib.mapAttrsToList (name: value: { name = "${convertName sectionName}_${convertName name}"; inherit value; });
-      convertOptions = opts: builtins.listToAttrs (builtins.concatLists (lib.mapAttrsToList convertOptionSection opts));
-    in convertOptions {
+    settings = {
+      server.root_url = "https://grafana.int.lukegb.com/";
+      server.http_addr = "0.0.0.0";
+      server.http_port = 3000;
+      server.domain = "grafana.int.lukegb.com";
       "auth.proxy" = {
         enabled = "true";
         header_name = "X-Pomerium-Claim-Email";
@@ -477,7 +473,7 @@ in {
   services.kubo = {
     enable = true;
     dataDir = "/store/ipfs";
-    extraConfig = {
+    settings = {
       Experimental.FilestoreEnabled = true;
     };
   };
diff --git a/third_party/nixpkgs/nixos/modules/services/network-filesystems/kubo.nix b/third_party/nixpkgs/nixos/modules/services/network-filesystems/kubo.nix
index 51e1282db4..2964ff6fb6 100644
--- a/third_party/nixpkgs/nixos/modules/services/network-filesystems/kubo.nix
+++ b/third_party/nixpkgs/nixos/modules/services/network-filesystems/kubo.nix
@@ -45,6 +45,11 @@ let
     then "[${s 1}]:${s 3}"
     else null; # not valid for listen datagram, skip
 
+  multiaddrsFunc = f: addrsRaw: if builtins.isString addrsRaw then let out = f addrsRaw; in lib.optional (out != null) out else lib.filter (x: x != null) (map f addrsRaw);
+
+  multiaddrsToListenStream = multiaddrsFunc multiaddrToListenStream;
+  multiaddrsToListenDatagram = multiaddrsFunc multiaddrToListenDatagram;
+
 in
 {
 
@@ -137,19 +142,19 @@ in
 
           options = {
             Addresses.API = mkOption {
-              type = types.str;
+              type = types.oneOf [ types.str (types.listOf types.str) ];
               default = "/ip4/127.0.0.1/tcp/5001";
               description = lib.mdDoc "Where Kubo exposes its API to";
             };
 
             Addresses.Gateway = mkOption {
-              type = types.str;
+              type = types.oneOf [ types.str (types.listOf types.str) ];
               default = "/ip4/127.0.0.1/tcp/8080";
               description = lib.mdDoc "Where the IPFS Gateway can be reached";
             };
 
             Addresses.Swarm = mkOption {
-              type = types.listOf types.str;
+              type = types.oneOf [ types.str (types.listOf types.str) ];
               default = [
                 "/ip4/0.0.0.0/tcp/4001"
                 "/ip6/::/tcp/4001"
@@ -294,14 +299,14 @@ in
       socketConfig = {
         ListenStream =
           let
-            fromCfg = multiaddrToListenStream cfg.settings.Addresses.Gateway;
+            fromCfg = multiaddrsToListenStream cfg.settings.Addresses.Gateway;
           in
-          [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
+          [ "" ] ++ fromCfg;
         ListenDatagram =
           let
-            fromCfg = multiaddrToListenDatagram cfg.settings.Addresses.Gateway;
+            fromCfg = multiaddrsToListenDatagram cfg.settings.Addresses.Gateway;
           in
-          [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
+          [ "" ] ++ fromCfg;
       };
     };
 
@@ -311,9 +316,9 @@ in
       # in the multiaddr.
       socketConfig.ListenStream =
         let
-          fromCfg = multiaddrToListenStream cfg.settings.Addresses.API;
+          fromCfg = multiaddrsToListenStream cfg.settings.Addresses.API;
         in
-        [ "" "%t/ipfs.sock" ] ++ lib.optional (fromCfg != null) fromCfg;
+        [ "" "%t/ipfs.sock" ] ++ fromCfg;
     };
   };
 
diff --git a/third_party/nixpkgs/patches/kubo-multiaddr.patch b/third_party/nixpkgs/patches/kubo-multiaddr.patch
new file mode 100644
index 0000000000..180912bcef
--- /dev/null
+++ b/third_party/nixpkgs/patches/kubo-multiaddr.patch
@@ -0,0 +1,69 @@
+diff --git a/nixos/modules/services/network-filesystems/kubo.nix b/nixos/modules/services/network-filesystems/kubo.nix
+--- a/nixos/modules/services/network-filesystems/kubo.nix
++++ b/nixos/modules/services/network-filesystems/kubo.nix
+@@ -45,6 +45,11 @@ let
+     then "[${s 1}]:${s 3}"
+     else null; # not valid for listen datagram, skip
+ 
++  multiaddrsFunc = f: addrsRaw: if builtins.isString addrsRaw then let out = f addrsRaw; in lib.optional (out != null) out else lib.filter (x: x != null) (map f addrsRaw);
++
++  multiaddrsToListenStream = multiaddrsFunc multiaddrToListenStream;
++  multiaddrsToListenDatagram = multiaddrsFunc multiaddrToListenDatagram;
++
+ in
+ {
+ 
+@@ -137,19 +142,19 @@ in
+ 
+           options = {
+             Addresses.API = mkOption {
+-              type = types.str;
++              type = types.oneOf [ types.str (types.listOf types.str) ];
+               default = "/ip4/127.0.0.1/tcp/5001";
+               description = lib.mdDoc "Where Kubo exposes its API to";
+             };
+ 
+             Addresses.Gateway = mkOption {
+-              type = types.str;
++              type = types.oneOf [ types.str (types.listOf types.str) ];
+               default = "/ip4/127.0.0.1/tcp/8080";
+               description = lib.mdDoc "Where the IPFS Gateway can be reached";
+             };
+ 
+             Addresses.Swarm = mkOption {
+-              type = types.listOf types.str;
++              type = types.oneOf [ types.str (types.listOf types.str) ];
+               default = [
+                 "/ip4/0.0.0.0/tcp/4001"
+                 "/ip6/::/tcp/4001"
+@@ -294,14 +299,14 @@ in
+       socketConfig = {
+         ListenStream =
+           let
+-            fromCfg = multiaddrToListenStream cfg.settings.Addresses.Gateway;
++            fromCfg = multiaddrsToListenStream cfg.settings.Addresses.Gateway;
+           in
+-          [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
++          [ "" ] ++ fromCfg;
+         ListenDatagram =
+           let
+-            fromCfg = multiaddrToListenDatagram cfg.settings.Addresses.Gateway;
++            fromCfg = multiaddrsToListenDatagram cfg.settings.Addresses.Gateway;
+           in
+-          [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
++          [ "" ] ++ fromCfg;
+       };
+     };
+ 
+@@ -311,9 +316,9 @@ in
+       # in the multiaddr.
+       socketConfig.ListenStream =
+         let
+-          fromCfg = multiaddrToListenStream cfg.settings.Addresses.API;
++          fromCfg = multiaddrsToListenStream cfg.settings.Addresses.API;
+         in
+-        [ "" "%t/ipfs.sock" ] ++ lib.optional (fromCfg != null) fromCfg;
++        [ "" "%t/ipfs.sock" ] ++ fromCfg;
+     };
+   };
+ 
diff --git a/third_party/nixpkgs/patches/series b/third_party/nixpkgs/patches/series
index e69de29bb2..f9f8fb3946 100644
--- a/third_party/nixpkgs/patches/series
+++ b/third_party/nixpkgs/patches/series
@@ -0,0 +1 @@
+kubo-multiaddr.patch