diff --git a/ci/shell.nix b/ci/shell.nix
index c2fd9e34ea..20b2446c2d 100644
--- a/ci/shell.nix
+++ b/ci/shell.nix
@@ -3,18 +3,18 @@
  }:
 
 let
-  # the last commit from master as of 2022-08-02
+  # the last commit from master as of 2023-04-14
   rustOverlay = import (builtins.fetchTarball {
-    url = "https://github.com/oxalica/rust-overlay/archive/b38c1683594aeefa5c3c4dde115401f059146be6.tar.gz";
-    sha256 = "0rk4i42cys2v7k2ir57x5qa8dc37nrs432cdpbr4cddskgvyi8ky";
+    url = "https://github.com/oxalica/rust-overlay/archive/db7bf4a2dd295adeeaa809d36387098926a15487.tar.gz";
+    sha256 = "0gk6kag09w8lyn9was8dpjgslxw5p81bx04379m9v6ky09kw482d";
   });
-  # the last successful build of nixpkgs-unstable as of 2022-06-20
+  # the last successful build of nixpkgs-unstable as of 2023-04-14
   nixpkgs = import (builtins.fetchTarball {
-    url = "https://github.com/NixOS/nixpkgs/archive/e0a42267f73ea52adc061a64650fddc59906fc99.tar.gz";
-    sha256 = "0r1dsj51x2rm016xwvdnkm94v517jb1rpn4rk63k6krc4d0n3kh9";
+    url = "https://github.com/NixOS/nixpkgs/archive/c58e6fbf258df1572b535ac1868ec42faf7675dd.tar.gz";
+    sha256 = "18pna0yinvdprhhcmhyanlgrmgf81nwpc0j2z9fy9mc8cqkx3937";
   }) { overlays = [ rustOverlay ]; };
   # commit before python36 was removed
-  python36nixpkgs = import (builtins.fetchTarball {
+  oldPythonNixpkgs = import (builtins.fetchTarball {
     url = "https://github.com/NixOS/nixpkgs/archive/b9126f77f553974c90ab65520eff6655415fc5f4.tar.gz";
     sha256 = "02s3qkb6kz3ndyx7rfndjbvp4vlwiqc42fxypn3g6jnc0v5jyz95";
   }) { };
@@ -28,8 +28,19 @@ let
     ${nixpkgs.patchelf}/bin/patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$out"
     chmod -w $out
   '';
+  # do not expose rust's gcc: https://github.com/oxalica/rust-overlay/issues/70
+  # Create a wrapper that only exposes $pkg/bin. This prevents pulling in
+  # development deps, packages to a nix-shell. This is especially important
+  # when packages are combined from different nixpkgs versions.
+  mkBinOnlyWrapper = pkg:
+    nixpkgs.runCommand "${pkg.pname}-${pkg.version}-bin" { inherit (pkg) meta; } ''
+      mkdir -p "$out/bin"
+      for bin in "${nixpkgs.lib.getBin pkg}/bin/"*; do
+          ln -s "$bin" "$out/bin/"
+      done
+    '';
   # NOTE: don't forget to update Minimum Supported Rust Version in docs/core/build/emulator.md
-  rustProfiles = nixpkgs.rust-bin.nightly."2022-08-02";
+  rustProfiles = nixpkgs.rust-bin.nightly."2023-04-14";
   rustNightly = rustProfiles.minimal.override {
     targets = [
       "thumbv7em-none-eabihf" # TT
@@ -42,17 +53,6 @@ let
   llvmPackages = nixpkgs.llvmPackages_13;
   # see pyright/README.md for update procedure
   pyright = nixpkgs.callPackage ./pyright {};
-  # HWI tests need https://github.com/bitcoin/bitcoin/pull/22558
-  # remove this once nixpkgs version contains this patch
-  bitcoind = (nixpkgs.bitcoind.overrideAttrs (attrs: {
-    version = attrs.version + "-taproot-psbt";
-    src = nixpkgs.fetchFromGitHub {
-      owner = "achow101";
-      repo = "bitcoin";
-      rev = "b704884935766748cf533577c1babacfb6d4b5a5"; # taproot-psbt
-      sha256 = "sha256-gz/knimKY1pkpsp1YmYHPMCbeiSxKGSOGJOSEgFbptE=";
-    };
-  }));
 in
 with nixpkgs;
 stdenvNoCC.mkDerivation ({
@@ -61,12 +61,12 @@ stdenvNoCC.mkDerivation ({
     bitcoind
     # install other python versions for tox testing
     # NOTE: running e.g. "python3" in the shell runs the first version in the following list,
-    #       and poetry uses the default version (currently 3.9)
-    python39
+    #       and poetry uses the default version (currently 3.10)
     python310
+    python39
     python38
-    python37
-    python36nixpkgs.python36
+    oldPythonNixpkgs.python37
+    oldPythonNixpkgs.python36
   ] ++ [
     SDL2
     SDL2_image
@@ -74,6 +74,7 @@ stdenvNoCC.mkDerivation ({
     check
     curl  # for connect tests
     editorconfig-checker
+    gcc11
     gcc-arm-embedded
     git
     gitAndTools.git-subrepo
@@ -86,9 +87,9 @@ stdenvNoCC.mkDerivation ({
     openssl
     pkgconfig
     poetry
-    protobuf
+    protobuf3_19
     pyright
-    rustNightly
+    (mkBinOnlyWrapper rustNightly)
     wget
     zlib
     moreutils
diff --git a/ci/test.yml b/ci/test.yml
index 60abe3fd5f..9ee413c697 100644
--- a/ci/test.yml
+++ b/ci/test.yml
@@ -149,7 +149,8 @@ core monero test:
   variables:
     TREZOR_PROFILING: 1
   script:
-    - $NIX_SHELL --arg fullDeps true --run "poetry run make -C core test_emu_monero | ts -s"
+    # see `python test` job for _PYTHON_SYSCONFIGDATA_NAME explanation
+    - $NIX_SHELL --arg fullDeps true --run "unset _PYTHON_SYSCONFIGDATA_NAME && poetry run make -C core test_emu_monero | ts -s"
     - mv core/src/.coverage core/.coverage.test_emu_monero
   artifacts:
     name: "$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
diff --git a/docs/ci/jobs.md b/docs/ci/jobs.md
index 566937bf8c..884fc68607 100644
--- a/docs/ci/jobs.md
+++ b/docs/ci/jobs.md
@@ -158,63 +158,63 @@ Device tests excluding altcoins, only for BTC.
 ### [core monero test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L144)
 Monero tests.
 
-### [core monero asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L163)
+### [core monero asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L164)
 
-### [core u2f test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L185)
+### [core u2f test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L186)
 Tests for U2F and HID.
 
-### [core u2f asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L204)
+### [core u2f asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L205)
 
-### [core fido2 test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L222)
+### [core fido2 test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L223)
 FIDO2 device tests.
 
-### [core fido2 asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L245)
+### [core fido2 asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L246)
 
-### [core click test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L265)
+### [core click test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L266)
 Click tests - UI.
 See [docs/tests/click-tests](../tests/click-tests.md) for more info.
 
-### [core click asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L294)
+### [core click asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L295)
 
-### [core upgrade test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L315)
+### [core upgrade test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L316)
 Upgrade tests.
 See [docs/tests/upgrade-tests](../tests/upgrade-tests.md) for more info.
 
-### [core upgrade asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L334)
+### [core upgrade asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L335)
 
-### [core persistence test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L356)
+### [core persistence test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L357)
 Persistence tests - UI.
 
-### [core persistence asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L385)
+### [core persistence asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L386)
 
-### [core hwi test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L403)
+### [core hwi test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L404)
 
-### [crypto test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L421)
+### [crypto test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L422)
 
-### [legacy device test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L453)
+### [legacy device test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L454)
 Legacy device test - UI.
 
-### [legacy asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L480)
+### [legacy asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L481)
 
-### [legacy btconly test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L492)
+### [legacy btconly test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L493)
 
-### [legacy btconly asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L512)
+### [legacy btconly asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L513)
 
-### [legacy upgrade test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L527)
+### [legacy upgrade test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L528)
 
-### [legacy upgrade asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L546)
+### [legacy upgrade asan test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L547)
 
-### [legacy hwi test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L567)
+### [legacy hwi test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L568)
 
-### [python test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L586)
+### [python test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L587)
 
-### [python support test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L605)
+### [python support test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L606)
 
-### [storage test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L615)
+### [storage test](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L616)
 
-### [core unix memory profiler](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L639)
+### [core unix memory profiler](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L640)
 
-### [connect test core](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L663)
+### [connect test core](https://github.com/trezor/trezor-firmware/blob/master/ci/test.yml#L664)
 
 ---
 ## TEST-HW stage - [test-hw.yml](https://github.com/trezor/trezor-firmware/blob/master/ci/test-hw.yml)
diff --git a/tests/download_emulators.sh b/tests/download_emulators.sh
index a205193eaf..11744e7344 100755
--- a/tests/download_emulators.sh
+++ b/tests/download_emulators.sh
@@ -21,4 +21,4 @@ chmod u+x emulators/trezor-emu-*
 
 cd ..
 # are we in Nix(OS)?
-command -v nix-shell >/dev/null && nix-shell --run "autoPatchelf tests/emulators"
+command -v nix-shell >/dev/null && nix-shell --run 'NIX_BINTOOLS=$NIX_BINTOOLS_FOR_TARGET autoPatchelf tests/emulators'