diff --git a/overlays/neovim.nix b/overlays/neovim.nix
index f5c1f27..0f71f9f 100644
--- a/overlays/neovim.nix
+++ b/overlays/neovim.nix
@@ -3,7 +3,7 @@
   neovim-unwrapped ? pkgs.neovim-unwrapped,
 }:
 neovim-unwrapped.overrideAttrs (old: rec {
-  version = "0.12.4";
+  version = "0.12.5";
   patches = builtins.filter (
     patch: !pkgs.lib.hasInfix "-CVE-" (baseNameOf (toString patch))
   ) old.patches;
@@ -11,6 +11,6 @@ neovim-unwrapped.overrideAttrs (old: rec {
     owner = "neovim";
     repo = "neovim";
     tag = "v${version}";
-    hash = "sha256-KSLFsrnoEOV712cnUtA8s4EoISp+ON36jslKxSvDthQ=";
+    hash = "sha256-dpu2kncpm+2k+XR7qOEi4KeEy9a1E6X7kjf3s4AbcSo=";
   };
 })
diff --git a/overlays/nixery.nix b/overlays/nixery.nix
index 8d7d0b0..04666a2 100644
--- a/overlays/nixery.nix
+++ b/overlays/nixery.nix
@@ -1,12 +1,12 @@
 final: prev:
 
 let
-  rev = "324aebb6550ab78c2bbe6e36ec50acf9c020a844";
+  rev = "d9ed93ea5b7fb851d6a8986d33d3bfb18d951e43";
 
   src = prev.fetchgit {
     url = "https://code.tvl.fyi/depot.git:/tools/nixery.git";
     inherit rev;
-    hash = "sha256-5BiKdN5VRxQEvHopG+aMDD5FW1Q0UouPabFjBsMe1gQ=";
+    hash = "sha256-thoHZH799u2DiqP566T6ZeOZP1EssLRo9xjfbr6e8b4=";
   };
 
   depotStub = {
diff --git a/overlays/scripts/update-plex b/overlays/scripts/update-plex
index d27caf1..fe0c8af 100755
--- a/overlays/scripts/update-plex
+++ b/overlays/scripts/update-plex
@@ -18,7 +18,7 @@ echo URL: $url
 
 echo Prefetching hash...
 sha256=`{nix-prefetch-url --type sha256 $url}
-hash=`{nix hash to-sri --type sha256 $sha256 | sed 's/^sha256-//'}
+hash=`{nix hash to-sri --type sha256 $sha256}
 echo Hash: $hash
 
 current_version=`{grep -oP '^        version = "\K[^"]+(?=";)' $services}
@@ -29,9 +29,29 @@ if (~ $current_version $version) {
 	exit 0
 }
 
-sed -i \
-	-e 's|version = "'$current_version'";|version = "'$version'";|' \
-	-e 's|sha256 = "'$current_hash'";|sha256 = "'$hash'";|' \
-	$services
+tmp=$services^'.tmp'
+
+# Only rewrite lines between the plex override block's markers, so other
+# packages with version/sha256 lines are left untouched.
+awk -v new_version=$version -v new_hash=$hash -f /dev/stdin $services > $tmp <<'awk'
+	/package = unstable\.plex\.override \{/ { in_plex = 1 }
+
+	in_plex && /^        version = "/ {
+		sub(/"[^"]+"/, "\"" new_version "\"")
+		print
+		next
+	}
+
+	in_plex && /^          sha256 = "/ {
+		sub(/"[^"]+"/, "\"" new_hash "\"")
+		in_plex = 0
+		print
+		next
+	}
+
+	{ print }
+awk
+
+mv $tmp $services
 
 echo Updated Plex override: $current_version '->' $version