diff --git a/meta-webserver/recipes-webadmin/netdata/netdata/0002-Do-not-hardcode-systemd-unit-directories.patch b/meta-webserver/recipes-webadmin/netdata/netdata/0002-Do-not-hardcode-systemd-unit-directories.patch
index 15668c121b..43024ccd49 100644
--- a/meta-webserver/recipes-webadmin/netdata/netdata/0002-Do-not-hardcode-systemd-unit-directories.patch
+++ b/meta-webserver/recipes-webadmin/netdata/netdata/0002-Do-not-hardcode-systemd-unit-directories.patch
@@ -3,38 +3,30 @@ From: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
 Date: Tue, 1 Oct 2024 17:01:33 +0200
 Subject: [PATCH] Do not hardcode systemd unit directories
 
-Refreshed for netdata v2.10.4 (context shifted; same intent preserved).
+Refreshed for netdata v2.12.3: upstream now routes all systemd unit
+installs through NETDATA_SYSTEMD_UNIT_DEST, so override that variable
+instead of each DESTINATION.
 
 Upstream-Status: Inappropriate [oe-core specific]
 Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
 ---
- CMakeLists.txt | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
+ CMakeLists.txt | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
 
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index d6dafd9..530298e 100644
+index 1cd0e75..510dacf 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -3642,7 +3642,7 @@ if(BUILD_FOR_PACKAGING)
-         install(FILES
-                 ${CMAKE_BINARY_DIR}/system/systemd/netdata.service
-                 COMPONENT netdata
--                DESTINATION lib/systemd/system)
-+                DESTINATION $ENV{systemd_system_unitdir})
-         install(FILES
-                 ${CMAKE_BINARY_DIR}/system/systemd/sysusers/netdata.conf
-                 COMPONENT user
-@@ -3739,11 +3739,11 @@ if(NOT OS_WINDOWS)
-     install(FILES
-             ${CMAKE_BINARY_DIR}/system/systemd/netdata-updater.service
-             COMPONENT netdata
--            DESTINATION lib/systemd/system)
-+            DESTINATION $ENV{systemd_system_unitdir})
-     install(FILES
-             system/systemd/netdata-updater.timer
-             COMPONENT netdata
--            DESTINATION lib/systemd/system)
-+            DESTINATION $ENV{systemd_system_unitdir})
-   endif()
- endif()
+@@ -4352,11 +4352,7 @@ install(FILES
  
+ # RPM distros ship systemd units in %{_unitdir} (/usr/lib/systemd/system);
+ # the DEB layout (and the historical default) uses /lib/systemd/system.
+-if(NETDATA_PACKAGING_FORMAT STREQUAL "rpm")
+-        set(NETDATA_SYSTEMD_UNIT_DEST "usr/lib/systemd/system")
+-else()
+-        set(NETDATA_SYSTEMD_UNIT_DEST "lib/systemd/system")
+-endif()
++set(NETDATA_SYSTEMD_UNIT_DEST "$ENV{systemd_system_unitdir}")
+ 
+ # The spec packages the systemd-235-compatible unit variant on EL 7 and
+ # Amazon Linux 2.
diff --git a/meta-webserver/recipes-webadmin/netdata/netdata/0005-build-allow-using-a-local-SQLite-source-tree.patch b/meta-webserver/recipes-webadmin/netdata/netdata/0005-build-allow-using-a-local-SQLite-source-tree.patch
new file mode 100644
index 0000000000..0199b2d3d6
--- /dev/null
+++ b/meta-webserver/recipes-webadmin/netdata/netdata/0005-build-allow-using-a-local-SQLite-source-tree.patch
@@ -0,0 +1,85 @@
+From 09e668b36a7e79a09c331857f994874d2714cfbc Mon Sep 17 00:00:00 2001
+From: vkalintiris <vasilis@netdata.cloud>
+Date: Thu, 8 Oct 2026 19:47:44 +0300
+Subject: [PATCH] cmake: allow SQLite offline builds
+
+The bundled SQLite build uses ExternalProject_Add() to download its
+source tarball at build time from a URL hardcoded to
+https://www.sqlite.org in the CMake file.
+
+This breaks the netdata recipe in meta-openembedded/meta-webserver,
+because Yocto and OpenEmbedded builds require all sources to be
+fetched before the build starts and do not allow network access
+during it.
+
+Add NETDATA_SQLITE_SOURCE_DIR, pointing to an already-unpacked
+SQLite source tree, which replaces the download step.
+
+This is the SQLite part of upstream commit 09e668b build:
+restructure the CMake build system (#23589). The full commit does
+not apply to 2.12.x, so the cache variable that upstream declares
+in the new NetdataOptions.cmake module is declared in
+NetdataSQLite.cmake here.
+
+Fixes:
+
+--- LOG END ---
+error: downloading 'https://www.sqlite.org/2026/sqlite-src-3530400.zip' failed
+status_code: 6
+status_string: "Could not resolve hostname"
+log:
+--- LOG BEGIN ---
+getaddrinfo(3) failed for www.sqlite.org:443
+
+Upstream-Status: Backport [https://github.com/netdata/netdata/commit/09e668b36a7e79a09c331857f994874d2714cfbc]
+Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
+---
+ packaging/cmake/Modules/NetdataSQLite.cmake | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/packaging/cmake/Modules/NetdataSQLite.cmake b/packaging/cmake/Modules/NetdataSQLite.cmake
+--- a/packaging/cmake/Modules/NetdataSQLite.cmake
++++ b/packaging/cmake/Modules/NetdataSQLite.cmake
+@@ -3,10 +3,10 @@
+ #
+ # Handle bundling of SQLite.
+ #
+-# This fetches the SQLite source tree (via tarball or git clone),
+-# generates the amalgamation at build time (with --enable-update-limit
+-# so the parser supports UPDATE/DELETE ... LIMIT), then compiles it as
+-# a separate static library that links into libnetdata.
++# This fetches the SQLite source tree (via tarball, git clone, or a local
++# source directory), generates the amalgamation at build time (with
++# --enable-update-limit so the parser supports UPDATE/DELETE ... LIMIT), then
++# compiles it as a separate static library that links into libnetdata.
+ 
+ include(ExternalProject)
+ 
+@@ -19,6 +19,12 @@ set(SQLITE_GIT_SHA "b09c88c14082339b66c7b7158d609a771e64ca69") # tag is: version
+ 
+ option(SQLITE_USE_GIT "Fetch SQLite sources via git clone instead of tarball" OFF)
+ 
++# STRING rather than PATH on purpose: CACHE PATH resolves a relative value
++# against the invocation directory. Takes precedence over SQLITE_USE_GIT.
++set(NETDATA_SQLITE_SOURCE_DIR "" CACHE STRING
++    "Path to an unpacked SQLite source tree to use instead of downloading one")
++mark_as_advanced(NETDATA_SQLITE_SOURCE_DIR SQLITE_USE_GIT)
++
+ function(netdata_bundle_sqlite3)
+         message(STATUS "Preparing SQLite ${SQLITE_VERSION}")
+ 
+@@ -28,7 +34,13 @@ function(netdata_bundle_sqlite3)
+ 
+         file(MAKE_DIRECTORY "${sqlite_OUTPUT_DIR}")
+ 
+-        if(SQLITE_USE_GIT)
++        if(NETDATA_SQLITE_SOURCE_DIR)
++                # Offline builds: an already-unpacked SQLite source tree replaces
++                # the download step entirely (#23510).
++                message(STATUS "Using local SQLite sources: ${NETDATA_SQLITE_SOURCE_DIR}")
++                set(sqlite_SOURCE_DIR "${NETDATA_SQLITE_SOURCE_DIR}")
++                set(SQLITE_FETCH_ARGS "")
++        elseif(SQLITE_USE_GIT)
+                 message(STATUS "Fetching SQLite via git clone")
+                 set(SQLITE_FETCH_ARGS
+                         GIT_REPOSITORY https://github.com/sqlite/sqlite.git
diff --git a/meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb b/meta-webserver/recipes-webadmin/netdata/netdata_2.12.3.bb
similarity index 91%
rename from meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb
rename to meta-webserver/recipes-webadmin/netdata/netdata_2.12.3.bb
index 9df846cec9..5083673a68 100644
--- a/meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb
+++ b/meta-webserver/recipes-webadmin/netdata/netdata_2.12.3.bb
@@ -25,11 +25,21 @@ SRC_URI = "\
     file://0002-Do-not-hardcode-systemd-unit-directories.patch \
     file://0003-Do-not-record-the-configure-command-line-in-the-binar.patch \
     file://0004-libsensors-do-not-emit-line-directives-in-generated-s.patch \
+    file://0005-build-allow-using-a-local-SQLite-source-tree.patch \
     file://netdata.conf \
     file://netdata-volatiles.conf \
     ${@bb.utils.contains('PACKAGECONFIG', 'go', 'file://go.d.conf', '', d)} \
+    https://www.sqlite.org/${SQLITE_YEAR}/sqlite-src-${SQLITE_VERSION_NUMBER}.zip;name=sqlite \
     "
-SRC_URI[sha256sum] = "d1ae949863925d626b1d42a53000bcca2c239718e0b0ddc6a3f3f5029b21cdfe"
+SRC_URI[sha256sum] = "6eb14deed1d7611c8f8969b2954432e91e631b2e45f762421873044561d80dd9"
+
+# netdata bundles its own SQLite and CMake's ExternalProject would
+# download it during do_compile. Fetch and unpack it with bitbake
+# instead and point CMake at the local source tree.
+# Must match packaging/cmake/Modules/NetdataSQLite.cmake.
+SQLITE_YEAR = "2026"
+SQLITE_VERSION_NUMBER = "3530400"
+SRC_URI[sqlite.sha256sum] = "d18fa15aec74d8c17e1463f861095adc01b5ad190256acb4f91d22f0368d232b"
 
 UPSTREAM_CHECK_URI = "https://github.com/${BPN}/${BPN}/tags"
 UPSTREAM_CHECK_REGEX = "${BPN}/releases/tag/v(?P<pver>(?!1\.99)\d+(?:\.\d+)*)"
@@ -100,6 +110,7 @@ EXTRA_OECMAKE += "-DENABLE_PLUGIN_EBPF=OFF \
                   -DENABLE_PLUGIN_SCRIPTS=OFF \
                   -DENABLE_ML=OFF \
                   -DENABLE_LIBBACKTRACE=OFF \
+                  -DNETDATA_SQLITE_SOURCE_DIR=${UNPACKDIR}/sqlite-src-${SQLITE_VERSION_NUMBER} \
                   -DProtobuf_PROTOC_EXECUTABLE=${STAGING_BINDIR_NATIVE}/protoc \
                   -DBUILD_FOR_PACKAGING=${@bb.utils.contains('DISTRO_FEATURES','systemd','ON','OFF',d)} \
                   -DENABLE_PLUGIN_SYSTEMD_UNITS=${@bb.utils.contains('DISTRO_FEATURES','systemd','ON','OFF',d)} \
