diff --git a/nixos/modules/services/admin/pgadmin.nix b/nixos/modules/services/admin/pgadmin.nix
index ceb5655dc562..20b6b6670d9c 100644
--- a/nixos/modules/services/admin/pgadmin.nix
+++ b/nixos/modules/services/admin/pgadmin.nix
@@ -168,7 +168,7 @@ in
           echo "$PW"
           # Retype password:
           echo "$PW"
-        ) | ${cfg.package}/bin/pgadmin4-setup
+        ) | ${cfg.package}/bin/pgadmin4-cli setup-db
       '';
 
       restartTriggers = [
diff --git a/nixos/tests/pgadmin4.nix b/nixos/tests/pgadmin4.nix
index 407e4592ef5f..b726a3eb3b94 100644
--- a/nixos/tests/pgadmin4.nix
+++ b/nixos/tests/pgadmin4.nix
@@ -55,6 +55,11 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
       machine.wait_until_succeeds("curl -sS localhost:5051/login | grep \"<title>pgAdmin 4</title>\" > /dev/null")
       # check for missing support files (css, js etc). Should catch not-generated files during build. See e.g. https://github.com/NixOS/nixpkgs/pull/229184
       machine.succeed("wget -nv --level=1 --spider --recursive localhost:5051/login")
+      # test idempotenceny
+      machine.systemctl("restart pgadmin.service")
+      machine.wait_for_unit("pgadmin")
+      machine.wait_until_succeeds("curl -sS localhost:5051")
+      machine.wait_until_succeeds("curl -sS localhost:5051/login | grep \"<title>pgAdmin 4</title>\" > /dev/null")
 
     # pgadmin4 module saves the configuration to /etc/pgadmin/config_system.py
     # pgadmin4-desktopmode tries to read that as well. This normally fails with a PermissionError, as the config file
diff --git a/pkgs/development/python-modules/flask-security-too/default.nix b/pkgs/development/python-modules/flask-security-too/default.nix
index b8f375dbcf09..9fab0385e463 100644
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@@ -3,7 +3,7 @@
 , fetchPypi
 , pythonOlder
 , setuptools
-, pydantic
+, fetchpatch
 
 # extras: babel
 , babel
@@ -59,6 +59,16 @@ buildPythonPackage rec {
     hash = "sha256-we2TquU28qP/ir4eE67J0Nlft/8IL8w7Ny3ypSE5cNk=";
   };
 
+  patches = [
+    # https://github.com/Flask-Middleware/flask-security/pull/901
+    (fetchpatch {
+      name = "fixes-for-py_webauthn-2.0.patch";
+      url = "https://github.com/Flask-Middleware/flask-security/commit/5725f7021343567ec0b25c890e859f4e84c93ba6.patch";
+      hash = "sha256-4EgwT4zRj0mh4ZaoZFz7H5KeiZ9zs+BY4siYm8DwMfU=";
+      excludes = [ "CHANGES.rst" ];
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
   ];
@@ -128,7 +138,5 @@ buildPythonPackage rec {
     description = "Simple security for Flask apps (fork)";
     license = licenses.mit;
     maintainers = with maintainers; [ gador ];
-    # https://github.com/Flask-Middleware/flask-security/pull/851
-    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/webauthn/default.nix b/pkgs/development/python-modules/webauthn/default.nix
index 257649a9db0f..ad28892290ee 100644
--- a/pkgs/development/python-modules/webauthn/default.nix
+++ b/pkgs/development/python-modules/webauthn/default.nix
@@ -4,29 +4,27 @@
 , asn1crypto
 , cbor2
 , pythonOlder
-, pydantic
 , pyopenssl
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "webauthn";
-  version = "1.11.1";
+  version = "2.0.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "duo-labs";
     repo = "py_webauthn";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+pp21rtwavtjj6ahG091xsJpsYOH3zpqU3xH2/YFXqY=";
+    hash = "sha256-StqoSrzErV13/OUpSWbI+6N5tSFPEpvnmQcDiZMaXPI=";
   };
 
   propagatedBuildInputs = [
     asn1crypto
     cbor2
-    pydantic
     pyopenssl
   ];
 
diff --git a/pkgs/tools/admin/pgadmin/default.nix b/pkgs/tools/admin/pgadmin/default.nix
index 0a7f90dd662a..d6f3b7551f9a 100644
--- a/pkgs/tools/admin/pgadmin/default.nix
+++ b/pkgs/tools/admin/pgadmin/default.nix
@@ -14,14 +14,14 @@
 
 let
   pname = "pgadmin";
-  version = "8.1";
-  yarnHash = "sha256-KAiY5TX2O8mxP7PjIJstYEzCBbqDgT+CpEhreuAGW/U=";
+  version = "8.2";
+  yarnHash = "sha256-uMSgpkYoLD32VYDAkjywC9bZjm7UKA0hhwVNc/toEbA=";
 
   src = fetchFromGitHub {
     owner = "pgadmin-org";
     repo = "pgadmin4";
     rev = "REL-${lib.versions.major version}_${lib.versions.minor version}";
-    hash = "sha256-zzS/fydNOXpIWdyLtWQhY+hVpneca+3wD88DmZEkS8s=";
+    hash = "sha256-RfpZXy265kwpMsWUBDVfbL/0eX0By79I4VNkG8zwVOs=";
   };
 
   # keep the scope, as it is used throughout the derivation and tests
@@ -181,6 +181,8 @@ pythonPackages.buildPythonApplication rec {
     google-auth-oauthlib
     google-api-python-client
     keyring
+    typer
+    rich
   ];
 
   passthru.tests = {
diff --git a/pkgs/tools/admin/pgadmin/expose-setup.py.patch b/pkgs/tools/admin/pgadmin/expose-setup.py.patch
index ac68eabd411d..67e588c5be83 100644
--- a/pkgs/tools/admin/pgadmin/expose-setup.py.patch
+++ b/pkgs/tools/admin/pgadmin/expose-setup.py.patch
@@ -1,64 +1,16 @@
- pkg/pip/setup_pip.py |  5 ++++-
- web/setup.py         | 14 ++++++++------
- 2 files changed, 12 insertions(+), 7 deletions(-)
-
 diff --git a/pkg/pip/setup_pip.py b/pkg/pip/setup_pip.py
-index 5592d1b04..131eaa1ed 100644
+index c65795b10..e56b6a6f3 100644
 --- a/pkg/pip/setup_pip.py
 +++ b/pkg/pip/setup_pip.py
-@@ -95,7 +95,10 @@ setup(
-     },
- 
+@@ -101,7 +101,7 @@ setup(
+
      entry_points={
--        'console_scripts': ['pgadmin4=pgadmin4.pgAdmin4:main'],
-+        'console_scripts': [
-+            'pgadmin4=pgadmin4.pgAdmin4:main',
-+            'pgadmin4-setup=pgadmin4.setup:main'
-+        ],
+         'console_scripts': ['pgadmin4=pgadmin4.pgAdmin4:main',
+-                            'pgadmin4-cli=pgadmin4.setup:main'],
++                            'pgadmin4-cli=pgadmin4.setup:app'],
      },
- 
+
  )
-diff --git a/web/setup.py b/web/setup.py
-index 2204ffb..d5fda9f 100644
---- a/web/setup.py
-+++ b/web/setup.py
-@@ -14,7 +14,6 @@ import argparse
- import os
- import sys
- import builtins
--import config
-
- # Grab the SERVER_MODE if it's been set by the runtime
- if 'SERVER_MODE' in globals():
-@@ -91,6 +90,9 @@ def load_servers(args):
- def setup_db(app):
-     """Setup the configuration database."""
-
-+    # here we need an additional import, since the call to setup_db changed
-+    # https://redmine.postgresql.org/projects/pgadmin4/repository/2/revisions/3a69d50458f57d19948b867aec55c55d635a36e5/diff/web/setup.py
-+    import config
-     create_app_data_directory(config)
-
-     print("pgAdmin 4 - Application Initialisation")
-@@ -139,8 +141,9 @@ def clear_servers():
-         clear_database_servers(load_user, True)
-
-
--if __name__ == '__main__':
-+def main():
-     # Configuration settings
-+    import config
-     parser = argparse.ArgumentParser(description='Setup the pgAdmin config DB')
-
-     exp_group = parser.add_argument_group('Dump server config')
-@@ -191,3 +194,6 @@ if __name__ == '__main__':
-     else:
-         app = create_app()
-         setup_db(app)
-+
-+if __name__ == '__main__':
-+    main()
-
 diff --git a/web/pgadmin/model/__init__.py b/web/pgadmin/model/__init__.py
 index 4c36dd1..a492365 100644
 --- a/web/pgadmin/model/__init__.py
diff --git a/pkgs/tools/admin/pgadmin/yarn.lock b/pkgs/tools/admin/pgadmin/yarn.lock
index abf896fa9891..cf3e188e8674 100644
--- a/pkgs/tools/admin/pgadmin/yarn.lock
+++ b/pkgs/tools/admin/pgadmin/yarn.lock
@@ -12716,3 +12716,8 @@ zustand@^4.4.1:
   resolved "https://github.com/pgadmin-org/react-data-grid.git#200d2f5e02de694e3e9ffbe177c279bc40240fb8"
   dependencies:
     "clsx" "^1.1.1"
+"react-data-grid@https://github.com/pgadmin-org/react-data-grid.git#200d2f5e02de694e3e9ffbe177c279bc40240fb8":
+  version "7.0.0-beta.14"
+  resolved "https://github.com/pgadmin-org/react-data-grid.git#200d2f5e02de694e3e9ffbe177c279bc40240fb8"
+  dependencies:
+    "clsx" "^1.1.1"