diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 747765727379..24bac689d7be 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -310,6 +310,14 @@
 - The method to safely handle secrets in the `networking.wireless` module has been changed to benefit from a [new feature](https://w1.fi/cgit/hostap/commit/?id=e680a51e94a33591f61edb210926bcb71217a21a) of wpa_supplicant.
   The syntax to refer to secrets has changed slightly and the option `networking.wireless.environmentFile` has been replaced by `networking.wireless.secretsFile`; see the description of the latter for how to upgrade.
 
+- NetBox was updated to `>= 4.1.0`.
+  Have a look at the breaking changes
+  of the [4.0 release](https://github.com/netbox-community/netbox/releases/tag/v4.0.0)
+  and the [4.1 release](https://github.com/netbox-community/netbox/releases/tag/v4.1.0),
+  make the required changes to your database, if needed,
+  then upgrade by setting `services.netbox.package = pkgs.netbox_4_1;`
+  in your configuration.
+
 - `services.cgit` now runs as the cgit user by default instead of root.
   This change requires granting access to the repositories to this user or
   setting the appropriate one through `services.cgit.some-instance.user`.
diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix
index 7bcbde2a018e..524d1f4b9fa6 100644
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@@ -75,21 +75,17 @@ in {
     package = lib.mkOption {
       type = lib.types.package;
       default =
-        if lib.versionAtLeast config.system.stateVersion "24.05"
+        if lib.versionAtLeast config.system.stateVersion "24.11"
+        then pkgs.netbox_4_1
+        else if lib.versionAtLeast config.system.stateVersion "24.05"
         then pkgs.netbox_3_7
-        else if lib.versionAtLeast config.system.stateVersion "23.11"
-        then pkgs.netbox_3_6
-        else if lib.versionAtLeast config.system.stateVersion "23.05"
-        then pkgs.netbox_3_5
-        else pkgs.netbox_3_3;
+        else pkgs.netbox_3_6;
       defaultText = lib.literalExpression ''
-        if lib.versionAtLeast config.system.stateVersion "24.05"
+        if lib.versionAtLeast config.system.stateVersion "24.11"
+        then pkgs.netbox_4_1
+        else if lib.versionAtLeast config.system.stateVersion "24.05"
         then pkgs.netbox_3_7
-        else if lib.versionAtLeast config.system.stateVersion "23.11"
-        then pkgs.netbox_3_6
-        else if lib.versionAtLeast config.system.stateVersion "23.05"
-        then pkgs.netbox_3_5
-        else pkgs.netbox_3_3;
+        else pkgs.netbox_3_6;
       '';
       description = ''
         NetBox package to use.
diff --git a/nixos/tests/web-apps/netbox-upgrade.nix b/nixos/tests/web-apps/netbox-upgrade.nix
index 4c554e7ae613..b43313bc8a77 100644
--- a/nixos/tests/web-apps/netbox-upgrade.nix
+++ b/nixos/tests/web-apps/netbox-upgrade.nix
@@ -1,6 +1,6 @@
 import ../make-test-python.nix ({ lib, pkgs, ... }: let
-  oldNetbox = pkgs.netbox_3_6;
-  newNetbox = pkgs.netbox_3_7;
+  oldNetbox = pkgs.netbox_3_7;
+  newNetbox = pkgs.netbox_4_1;
 in {
   name = "netbox-upgrade";
 
@@ -58,8 +58,10 @@ in {
           return header.split()[1]
 
       def check_api_version(version):
+          # Returns 403 with NetBox >= 4.0,
+          # but we still get the API version in the headers
           headers = machine.succeed(
-            "curl -sSfL http://localhost/api/ --head -H 'Content-Type: application/json'"
+            "curl -sSL http://localhost/api/ --head -H 'Content-Type: application/json'"
           )
           assert api_version(headers) == version
 
diff --git a/pkgs/servers/web-apps/netbox/default.nix b/pkgs/servers/web-apps/netbox/default.nix
index 1459ee23920c..fbd0e6e56d33 100644
--- a/pkgs/servers/web-apps/netbox/default.nix
+++ b/pkgs/servers/web-apps/netbox/default.nix
@@ -3,8 +3,6 @@ let
   generic = import ./generic.nix;
 in
 lib.fix (self: {
-  netbox = self.netbox_3_7;
-
   netbox_3_6 = callPackage generic {
     version = "3.6.9";
     hash = "sha256-R/hcBKrylW3GnEy10DkrLVr8YJtsSCvCP9H9LhafO9I=";
@@ -12,10 +10,7 @@ lib.fix (self: {
       # Allow setting the STATIC_ROOT from within the configuration and setting a custom redis URL
       ./config.patch
     ];
-    tests = {
-      netbox = nixosTests.netbox_3_6;
-      inherit (nixosTests) netbox-upgrade;
-    };
+    tests.netbox = nixosTests.netbox_3_6;
 
     maintainers = with lib.maintainers; [ minijackson n0emis raitobezarius ];
     eol = true;
@@ -28,11 +23,9 @@ lib.fix (self: {
       # Allow setting the STATIC_ROOT from within the configuration and setting a custom redis URL
       ./config.patch
     ];
-    tests = {
-      netbox = nixosTests.netbox_3_7;
-      inherit (nixosTests) netbox-upgrade;
-    };
+    tests.netbox = nixosTests.netbox_3_7;
 
     maintainers = with lib.maintainers; [ minijackson n0emis raitobezarius ];
+    eol = true;
   };
 })
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6449b5d2e024..baeeea0f8e8a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10275,7 +10275,10 @@ with pkgs;
   netbootxyz-efi = callPackage ../tools/misc/netbootxyz-efi { };
 
   inherit (callPackage ../servers/web-apps/netbox { })
-    netbox netbox_3_6 netbox_3_7;
+    netbox_3_6 netbox_3_7;
+
+  # Not in aliases because it wouldn't get picked up by callPackage
+  netbox = netbox_4_1;
 
   netbox2netshot = callPackage ../tools/admin/netbox2netshot { };