diff --git a/.cargo/config.toml b/.cargo/config.toml
index 5cafed729..ccaba00e2 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -1,13 +1,10 @@
 [env]
-COMPILE_ENV = { value = "compile-env", relative = true, force = false }
-PATH = { value = "compile-env/bin", relative = true, force = true }
-LIBCLANG_PATH = { value = "compile-env/lib", relative = true, force = true }
-PKG_CONFIG_PATH = { value = "compile-env/sysroot/x86_64-unknown-linux-gnu/release/lib/pkgconfig", relative = true, force = true }
+DATAPLANE_SYSROOT = { value = "sysroot", relative = true, force = false }
+C_INCLUDE_PATH = { value = "sysroot/include", relative = true, force = false }
+LIBRARY_PATH = { value = "sysroot/lib", relative = true, force = false }
+GW_CRD_PATH = { value = "devroot/src/gateway/config/crd/bases", relative = true, force = false }
+PKG_CONFIG_PATH = { value = "sysroot/lib/pkgconfig", relative = true, force = false }
+LIBCLANG_PATH = { value = "devroot/lib", relative = true, force = false }
 
 [build]
-target = "x86_64-unknown-linux-gnu"
-rustc = "compile-env/bin/rustc"
-rustflags = ["--cfg", "tokio_unstable"]
-
-[target.x86_64-unknown-linux-gnu]
-runner = ["scripts/test-runner.sh"]
+rustflags = ["--cfg=tokio_unstable"]
diff --git a/.envrc b/.envrc
index 41bfc8c5d..44f9d5363 100644
--- a/.envrc
+++ b/.envrc
@@ -1,46 +1,2 @@
-export PROJECT_DIR="$(pwd)"
-
-if [ -h "${PROJECT_DIR}/compile-env" ] || [ -d "${PROJECT_DIR}/compile-env" ]; then
-    export PATH="${PROJECT_DIR}/compile-env/bin:$PATH"
-    export LIBCLANG_PATH="${PROJECT_DIR}/compile-env/bin"
-    export COMPILE_ENV="${PROJECT_DIR}/compile-env"
-else
-    >&2 echo "no compile environment found"
-    exit 0
-fi
-
-export NEXTEST_EXPERIMENTAL_LIBTEST_JSON=1
-
-CRT="-C target-feature=-crt-static"
-DEBUG="-C debuginfo=full -C split-debuginfo=off -C dwarf-version=5"
-LINKER="-C linker=${COMPILE_ENV}/bin/clang -C link-arg=--ld-path=${COMPILE_ENV}/bin/ld.lld"
-RELRO="-C relro-level=full"
-TARGET_CPU="-C target-cpu=x86-64-v3"
-
-RUSTFLAGS="${CRT} ${DEBUG} ${LINKER} ${RELRO} ${TARGET_CPU}"
-
-OPTIMIZE="-C opt-level=3 -C linker-plugin-lto -C lto=thin -C embed-bitcode=yes -C codegen-units=1"
-
-case ${PROFILE:-DEBUG} in
-    fuzz|FUZZ)
-        COVERAGE="-C instrument-coverage"
-        DEBUG_ASSERTIONS="-C debug-assertions=on"
-        OVERFLOW_CHECK="-C overflow-checks=on"
-        RUSTFLAGS="${RUSTFLAGS} ${COVERAGE} ${DEBUG_ASSERTIONS} ${OVERFLOW_CHECK}"
-        ;;
-    release|RELEASE)
-        RUSTFLAGS="${RUSTFLAGS} ${OPTIMIZE}"
-        ;;
-    debug|DEBUG)
-        DEBUG_ASSERTIONS="-C debug-assertions=on"
-        OPTIMIZE="-C opt-level=0"
-        OVERFLOW_CHECK="-C overflow-checks=on"
-        RUSTFLAGS="${RUSTFLAGS} ${OPTIMIZE} ${DEBUG_ASSERTIONS} ${OVERFLOW_CHECK}"
-        ;;
-    *)
-        >&2 echo "unknown profile"
-        exit 1
-        ;;
-esac
-
-export RUSTFLAGS
+export RUSTC_BOOTSTRAP=1
+export PATH=$(pwd)/devroot/bin:$PATH
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index c339afc1f..c56db97e1 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -104,41 +104,46 @@ jobs:
           echo "version=v0-${commit_sha::9}" >> "$GITHUB_OUTPUT"
           echo "ref=${commit_sha}" >> "$GITHUB_OUTPUT"
 
-  check:
-    env:
-      CACHE_REGISTRY: "run.h.hhdev.io:30000"
-      UPSTREAM_REGISTRY: "ghcr.io"
+  build:
+    name: "${{matrix.nix-target}}/${{matrix.build.name}}"
+    runs-on: lab
     needs:
-      - check_changes
       - version
-    if: "${{ needs.check_changes.outputs.devfiles == 'true' || (startsWith(github.event.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/v')) && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}"
     permissions:
       checks: "write"
       pull-requests: "write"
       contents: "read"
       packages: "write"
       id-token: "write"
+    env:
+      CACHE_REGISTRY: "run.h.hhdev.io:30000"
+      UPSTREAM_REGISTRY: "ghcr.io"
+      USER: "runner"
     strategy:
       fail-fast: false
       matrix:
-        profile:
-          - name: "debug"
-            sterile: ""
+        nix-target:
+          - tests.all
+          - dataplane-tar
+        build:
           - name: "debug"
-            sterile: "sterile"
+            profile: "debug"
+            sanitize: ""
+            instrument: "none"
           - name: "release"
-            sterile: "sterile"
-          - name: "fuzz"
-            sterile: "sterile"
-          #- name: "release"
-          #  sterile: ""
-          #- name: "fuzz"
-          #  sterile: ""
+            profile: "release"
+            sanitize: "" # TODO: enable safe-stack,cfi when possible
+            instrument: "none"
+          - name: "sanitize/address"
+            profile: "debug" # TODO: should be fuzz, but build time explodes for unknown reasons
+            sanitize: "address"
+            instrument: "none" # TODO: should be coverage, but build time explodes for unknown reasons
+          - name: "sanitize/thread"
+            profile: "fuzz"
+            sanitize: "thread"
+            instrument: "none" # TODO: should be coverage, but build time explodes for unknown reasons
         debug_justfile:
           - "${{ inputs.debug_justfile || false }}"
-    name: "${{matrix.profile.name}} ${{matrix.profile.sterile}}"
-    runs-on: "lab"
-    timeout-minutes: 45
     steps:
       - name: "login to ghcr.io"
         uses: "docker/login-action@v3"
@@ -167,234 +172,36 @@ jobs:
           persist-credentials: "false"
           fetch-depth: "0"
 
-      - name: "install just"
-        run: |
-          # this keeps our GH actions logs from getting messed up with color codes
-          echo 'deb [trusted=yes] https://apt.gabe565.com /' | sudo tee /etc/apt/sources.list.d/gabe565.list
-          sudo apt-get update
-          sudo apt-get install --yes --no-install-recommends just
-
-      - name: "set up build environment"
-        run: |
-          REQUIRED_HUGEPAGES=512
-          HUGEPAGES_PATH=/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages
-          OVERCOMMIT_HUGEPAGES_PATH=/sys/kernel/mm/hugepages/hugepages-2048kB/nr_overcommit_hugepages
-          docker run --privileged --rm busybox:latest sh -c "echo $((6 * REQUIRED_HUGEPAGES)) > $OVERCOMMIT_HUGEPAGES_PATH"
-          docker run --privileged --rm busybox:latest sh -c "echo $((2 * REQUIRED_HUGEPAGES)) > $HUGEPAGES_PATH"
-          docker pull "${{env.UPSTREAM_REGISTRY}}/githedgehog/testn/n-vm:v0.0.9"
-          just --yes \
-            debug_justfile="${{matrix.debug_justfile}}" \
-            profile=${{matrix.profile.name}} \
-            dpdp_sys_registry="${{env.CACHE_REGISTRY}}" \
-            refresh-compile-env
-          just --yes debug_justfile="${{matrix.debug_justfile}}" fake-nix
-
-      - name: "cargo deny check"
-        run: |
-          just \
-            debug_justfile="${{matrix.debug_justfile}}" \
-            profile=${{matrix.profile.name}} \
-            dpdp_sys_registry="${{env.CACHE_REGISTRY}}" \
-            ${{matrix.profile.sterile}} cargo deny check
-
-      - name: "push container"
-        if: ${{ matrix.profile.sterile == 'sterile' && (matrix.profile.name == 'release' || matrix.profile.name == 'debug') }}
-        run: |
-          just \
-            debug_justfile="${{matrix.debug_justfile}}" \
-            profile=${{matrix.profile.name}} \
-            dpdp_sys_registry="${{env.UPSTREAM_REGISTRY}}" \
-            target=x86_64-unknown-linux-gnu \
-            version=${{ needs.version.outputs.version }}-${{ matrix.profile.name }} \
-            oci_repo="ghcr.io" \
-            push
-
-      - name: "print container image name"
-        if: ${{ matrix.profile.sterile == 'sterile' && (matrix.profile.name == 'release' || matrix.profile.name == 'debug') }}
-        run: |
-          just \
-            debug_justfile="${{matrix.debug_justfile}}" \
-            profile=${{matrix.profile.name}} \
-            target=x86_64-unknown-linux-gnu \
-            version=${{ needs.version.outputs.version }}-${{ matrix.profile.name }} \
-            oci_repo="ghcr.io" \
-            print-container-tags
-
-      - name: "Check for uncommitted changes"
-        run: |
-          git diff --exit-code
-          if [ $? -ne 0 ]; then
-            echo "::error::Uncommitted changes detected:"
-            git diff
-            exit 1
-          fi
-          echo "No uncommitted changes found"
-
-      - name: "Check for untracked files"
-        run: |
-          if [ -n "$(git ls-files --others --exclude-standard)" ]; then
-            echo "::error::Untracked files detected:"
-            git ls-files --others --exclude-standard
-            exit 1
-          fi
-          echo "No untracked files found"
-
-      - id: "test"
-        name: "test"
-        run: |
-          set -euo pipefail
-          mkdir --parent ./target/nextest
-          # Run tests. The resulting results.json is not a full JSON object but
-          # a list of JSON objects, one per line.
-          if [ ${{ matrix.profile.name }} = "fuzz" ]; then
-            echo "::notice::Running fuzz tests"
-            just \
-              debug_justfile="${{matrix.debug_justfile}}" \
-              profile=${{matrix.profile.name}} \
-              target=x86_64-unknown-linux-gnu \
-              dpdp_sys_registry="${{env.CACHE_REGISTRY}}" \
-              ${{matrix.profile.sterile}} coverage \
-                --status-level=none \
-                --final-status-level=skip \
-                --message-format=libtest-json-plus > ./results.json
-          else
-            echo "::notice::Running regular tests"
-            just \
-              debug_justfile="${{matrix.debug_justfile}}" \
-              profile=${{matrix.profile.name}} \
-              target=x86_64-unknown-linux-gnu \
-              dpdp_sys_registry="${{env.CACHE_REGISTRY}}" \
-              ${{matrix.profile.sterile}} cargo nextest run \
-                --cargo-profile=${{matrix.profile.name}} \
-                --status-level=none \
-                --final-status-level=skip \
-                --message-format=libtest-json-plus \
-                > ./results.json
-            echo "::notice::Running Shuttle tests"
-            # We need to rebuild using the shuttle feature. To avoid running
-            # all tests a second time, we filter to run only tests with pattern
-            # "shuttle" in their name (test function name, file name, or module
-            # name).
-            #
-            # IF YOUR SHUTTLE TESTS DO NOT HAVE "shuttle" IN THEIR NAME, THEY
-            # WILL NOT RUN.
-            just \
-              debug_justfile="${{matrix.debug_justfile}}" \
-              profile=${{matrix.profile.name}} \
-              target=x86_64-unknown-linux-gnu \
-              dpdp_sys_registry="${{env.CACHE_REGISTRY}}" \
-              ${{matrix.profile.sterile}} cargo nextest run \
-                --cargo-profile=${{matrix.profile.name}} \
-                --status-level=none \
-                --final-status-level=none \
-                --message-format=libtest-json-plus \
-                --features shuttle \
-                shuttle \
-                >> ./results.json
-          fi
-          # look for any flakes (flakes have a #\\d+ match in their name field)
-          jq \
-            --raw-output \
-            --slurp '.[] | select(.type == "test" and (.name | test(".*#\\d+"))) | ( .name | split("#") ) |
-                     [.[0], (.[1] | tonumber)] | @csv
-          ' ./results.json > ./target/nextest/flakes.csv
-          if [ -s ./target/nextest/flakes.csv ]; then
-            {
-              echo "FLAKY_TESTS<<EOF"
-              echo -e "### :warning: Flaky tests (${{matrix.profile.name}} - ${{matrix.profile.sterile}})\n";
-              echo "| test | retries |"
-              echo "|------|---------|"
-              just cargo csview --style=markdown --no-headers --body-align=left ./target/nextest/flakes.csv;
-              echo "EOF"
-            } >> "${GITHUB_ENV}"
-          fi
-          rm results.json
-
-      - name: "upload test results to codecov"
-        if: ${{ always() }}
-        uses: "codecov/codecov-action@v5"
+      - name: "Install nix"
+        uses: cachix/install-nix-action@v31
         with:
-          fail_ci_if_error: true
-          files: ./target/nextest/default/junit.xml
-          report_type: "test_results"
-          disable_search: "true"
-          use_oidc: "true"
-          verbose: true
-          flags: "${{matrix.profile.name}}-${{ matrix.profile.sterile || 'developer' }}"
-
-      - name: "upload codecov analysis"
-        if: ${{ matrix.profile.name == 'fuzz' }}
-        uses: "codecov/codecov-action@v5"
-        with:
-          fail_ci_if_error: true
-          files: ./target/nextest/coverage/codecov.json
-          report_type: "coverage"
-          disable_search: "true"
-          use_oidc: "true"
-          verbose: true
-          flags: "${{matrix.profile.name}}-${{ matrix.profile.sterile || 'developer' }}"
-
-      - name: "clean up coverage data"
-        run: |
-          rm -f codecov codecov.SHA256SUM codecov.SHA256SUM.sig
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+          nix_path: nixpkgs=channel:nixpkgs-unstable
 
-      - uses: "marocchino/sticky-pull-request-comment@v2"
-        if: ${{ always() }}
+      - uses: "cachix/cachix-action@v14"
         with:
-          header: "flakes_${{matrix.profile.name}}_${{matrix.profile.sterile}}"
-          ignore_empty: "true"
-          message: |
-            ${{ env.FLAKY_TESTS }}
-
-      - name: "publish test report"
-        uses: "mikepenz/action-junit-report@v6"
-        if: "${{ always() }}"
-        with:
-          annotate_notice: "false"
-          annotate_only: "false"
-          check_annotations: "true"
-          check_retries: "false"
-          comment: "false"
-          detailed_summary: "true"
-          fail_on_failure: "false"
-          fail_on_parse_error: "true"
-          flaky_summary: "true"
-          include_empty_in_summary: "true"
-          include_passed: "true"
-          include_time_in_summary: "true"
-          report_paths: "target/nextest/default/*junit.xml"
-          require_passed_tests: "true"
-          require_tests: "true"
-          simplified_summary: "true"
-          truncate_stack_traces: "false"
-          group_reports: "true"
-          check_name: "test-report-${{matrix.profile.name}}-sterile:${{matrix.profile.sterile == 'sterile'}}"
-          skip_success_summary: "false"
-          job_summary: "true"
-          verbose_summary: "false"
-
-      - id: "clippy"
-        name: "run clippy"
-        run: |
-          just debug_justfile="${{matrix.debug_justfile}}" profile=${{matrix.profile.name}} \
-            ${{matrix.profile.sterile}} cargo clippy --all-targets --all-features -- -D warnings
+          name: "githedgehog"
+          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
 
-      - id: "docs"
-        name: "run rustdoc"
+      - name: "build packages"
         run: |
-          RUSTDOCFLAGS="-D warnings" just \
-            debug_justfile="${{matrix.debug_justfile}}" \
-            profile=${{matrix.profile.name}} \
-            target=x86_64-unknown-linux-gnu \
-            ${{matrix.profile.sterile}} cargo doc --no-deps
-
-      - name: "run doctests"
-        run: |
-          just \
-            debug_justfile="${{matrix.debug_justfile}}" \
-            profile=${{matrix.profile.name}} \
-            target=x86_64-unknown-linux-gnu \
-            ${{matrix.profile.sterile}} cargo test --doc
+          nix build \
+            --file default.nix \
+            --argstr profile "${{matrix.build.profile}}" \
+            --argstr sanitize "${{matrix.build.sanitize}}" \
+            --argstr instrumentation "${{matrix.build.instrument}}" \
+            --out-link "${{matrix.nix-target}}" \
+            --print-build-logs \
+            ${{matrix.nix-target}}
+          if [ "${{matrix.nix-target}}" = "tests.all" ]; then
+            nix-shell --run \
+              "cargo nextest run --archive-file ${{matrix.nix-target}}/*.tar.zst --workspace-remap $(pwd)"
+          elif [ "${{matrix.nix-target}}" = "dataplane-tar" ]; then
+            image="$(docker import dataplane-tar)"
+            nix-shell --run \
+              "skopeo copy --src-daemon-host=unix:///run/docker/docker.sock docker-daemon:${image} oci-archive:image.tar"
+          fi
 
       - name: "Setup tmate session for debug"
         if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
@@ -406,7 +213,7 @@ jobs:
   vlab:
     if: "${{ needs.check_changes.outputs.devfiles == 'true' || (startsWith(github.event.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/v')) && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}"
     needs:
-      - check
+      - build
       - version
 
     name: "${{ matrix.hybrid && 'h' || 'v' }}-${{ matrix.upgradefrom && 'up' || '' }}${{ matrix.upgradefrom }}${{ matrix.upgradefrom && '-' || '' }}${{ matrix.mesh && 'mesh-' || '' }}${{ matrix.gateway && 'gw-' || '' }}${{ matrix.includeonie && 'onie-' || '' }}${{ matrix.buildmode }}-${{ matrix.vpcmode }}"
@@ -488,7 +295,7 @@ jobs:
     name: "Summary"
     runs-on: "ubuntu-latest"
     needs:
-      - check
+      - build
       - vlab
     # Run always, except when the "check" job was skipped.
     #
@@ -517,7 +324,7 @@ jobs:
     runs-on: lab
     if: startsWith(github.event.ref, 'refs/tags/v') && github.event_name == 'push'
     needs:
-      - check
+      - build
       - vlab
 
     permissions:
@@ -559,7 +366,7 @@ jobs:
           docker pull "${{env.UPSTREAM_REGISTRY}}/githedgehog/testn/n-vm:v0.0.9"
           just --yes \
             debug_justfile="${{matrix.debug_justfile}}" \
-            profile=${{matrix.profile.name}} \
+            profile=${{matrix.profile}} \
             dpdp_sys_registry="${{env.CACHE_REGISTRY}}" \
             refresh-compile-env
           just --yes debug_justfile="${{matrix.debug_justfile}}" fake-nix
diff --git a/.github/workflows/dev.yml.old b/.github/workflows/dev.yml.old
new file mode 100644
index 000000000..90486fb92
--- /dev/null
+++ b/.github/workflows/dev.yml.old
@@ -0,0 +1,617 @@
+# The primary point of this workflow is to ensure that the developer experience is good.
+# We take a very vanilla ubuntu image, install all necessary dependencies via "normal" means,
+# and then run the build and test steps as described in the README.md file.
+
+# The artifacts produced by these builds are not intended to be used for anything other than
+# ensuring that the developer experience is good.
+
+# Production artifacts are produced in a sterile environment (in another CI workflow).
+
+name: "dev.yml"
+
+on:
+  pull_request: {}
+  push:
+    branches:
+      - "main"
+    tags:
+      - "v*"
+  merge_group:
+    types: ["checks_requested"]
+  workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: "boolean"
+        description: "Run with tmate enabled"
+        required: false
+        default: false
+      debug_justfile:
+        type: "boolean"
+        description: "enable to see debug statements from just recipes"
+        required: false
+        default: false
+      skip_vlab_tests:
+        type: "boolean"
+        description: "Skip VLAB tests (they run by default)"
+        required: false
+        default: false
+      run_hlab_tests:
+        type: "boolean"
+        description: "Run hybrid HLAB tests"
+        required: false
+        default: false
+      enable_release_tests:
+        type: "boolean"
+        description: "Enable release tests for VLAB/HLAB tests"
+        required: false
+        default: false
+
+concurrency:
+  group: "${{ github.workflow }}:${{ github.event.pull_request.number || github.event.after || github.event.merge_group && github.run_id }}"
+  cancel-in-progress: true
+
+permissions:
+  contents: "read"
+  packages: "write"
+  id-token: "write"
+
+jobs:
+  check_changes:
+    name: "Deduce required tests from code changes"
+    permissions:
+      contents: "read"
+      pull-requests: "read"
+    runs-on: "ubuntu-latest"
+    outputs:
+      devfiles: "${{ steps.changes.outputs.devfiles }}"
+    steps:
+      - name: "Checkout"
+        if: "${{ !github.event.pull_request }}"
+        uses: "actions/checkout@v6"
+        with:
+          persist-credentials: "false"
+          fetch-depth: "0"
+      - name: "Check code changes"
+        uses: "dorny/paths-filter@v3"
+        id: "changes"
+        with:
+          filters: |
+            devfiles:
+              - '!(README.md|LICENSE|.gitattributes|.gitignore|.github/**)'
+              - '.github/workflows/dev.yml'
+
+  version:
+    runs-on: lab
+
+    permissions:
+      contents: read
+
+    outputs:
+      version: "${{ steps.version-gen.outputs.version }}"
+      ref: "${{ steps.version-gen.outputs.ref }}"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Generate temp artifacts version
+        id: version-gen
+        env:
+          commit_sha: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          echo "version=v0-${commit_sha::9}" >> "$GITHUB_OUTPUT"
+          echo "ref=${commit_sha}" >> "$GITHUB_OUTPUT"
+
+  check:
+    env:
+      CACHE_REGISTRY: "run.h.hhdev.io:30000"
+      UPSTREAM_REGISTRY: "ghcr.io"
+    needs:
+      - check_changes
+      - version
+    if: "${{ needs.check_changes.outputs.devfiles == 'true' || (startsWith(github.event.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/v')) && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}"
+    permissions:
+      checks: "write"
+      pull-requests: "write"
+      contents: "read"
+      packages: "write"
+      id-token: "write"
+    strategy:
+      fail-fast: false
+      matrix:
+        profile:
+          - name: "debug"
+            sterile: ""
+          - name: "debug"
+            sterile: "sterile"
+          - name: "release"
+            sterile: "sterile"
+          - name: "fuzz"
+            sterile: "sterile"
+          #- name: "release"
+          #  sterile: ""
+          #- name: "fuzz"
+          #  sterile: ""
+        debug_justfile:
+          - "${{ inputs.debug_justfile || false }}"
+    name: "${{matrix.profile.name}} ${{matrix.profile.sterile}}"
+    runs-on: "lab"
+    timeout-minutes: 45
+    steps:
+      - name: "login to ghcr.io"
+        uses: "docker/login-action@v3"
+        with:
+          registry: "${{ env.UPSTREAM_REGISTRY }}"
+          username: "${{ github.actor }}"
+          password: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: "login to image cache"
+        uses: "docker/login-action@v3"
+        with:
+          registry: "${{ env.CACHE_REGISTRY }}"
+          username: "${{ secrets.LAB_REGISTRY_USERNAME }}"
+          password: "${{ secrets.LAB_REGISTRY_TOKEN }}"
+
+      # it's temporarily needed to install skopeo
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+          cache: true
+
+      - name: "Checkout"
+        uses: "actions/checkout@v6"
+        with:
+          persist-credentials: "false"
+          fetch-depth: "0"
+
+      - name: "install just"
+        run: |
+          # this keeps our GH actions logs from getting messed up with color codes
+          echo 'deb [trusted=yes] https://apt.gabe565.com /' | sudo tee /etc/apt/sources.list.d/gabe565.list
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends just
+
+      - name: "set up build environment"
+        run: |
+          REQUIRED_HUGEPAGES=512
+          HUGEPAGES_PATH=/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages
+          OVERCOMMIT_HUGEPAGES_PATH=/sys/kernel/mm/hugepages/hugepages-2048kB/nr_overcommit_hugepages
+          docker run --privileged --rm busybox:latest sh -c "echo $((6 * REQUIRED_HUGEPAGES)) > $OVERCOMMIT_HUGEPAGES_PATH"
+          docker run --privileged --rm busybox:latest sh -c "echo $((2 * REQUIRED_HUGEPAGES)) > $HUGEPAGES_PATH"
+          docker pull "${{env.UPSTREAM_REGISTRY}}/githedgehog/testn/n-vm:v0.0.9"
+          just --yes \
+            debug_justfile="${{matrix.debug_justfile}}" \
+            profile=${{matrix.profile.name}} \
+            dpdp_sys_registry="${{env.CACHE_REGISTRY}}" \
+            refresh-compile-env
+          just --yes debug_justfile="${{matrix.debug_justfile}}" fake-nix
+
+      - name: "cargo deny check"
+        run: |
+          just \
+            debug_justfile="${{matrix.debug_justfile}}" \
+            profile=${{matrix.profile.name}} \
+            dpdp_sys_registry="${{env.CACHE_REGISTRY}}" \
+            ${{matrix.profile.sterile}} cargo deny check
+
+      - name: "push container"
+        if: ${{ matrix.profile.sterile == 'sterile' && (matrix.profile.name == 'release' || matrix.profile.name == 'debug') }}
+        run: |
+          just \
+            debug_justfile="${{matrix.debug_justfile}}" \
+            profile=${{matrix.profile.name}} \
+            dpdp_sys_registry="${{env.UPSTREAM_REGISTRY}}" \
+            target=x86_64-unknown-linux-gnu \
+            version=${{ needs.version.outputs.version }}-${{ matrix.profile.name }} \
+            oci_repo="ghcr.io" \
+            push
+
+      - name: "print container image name"
+        if: ${{ matrix.profile.sterile == 'sterile' && (matrix.profile.name == 'release' || matrix.profile.name == 'debug') }}
+        run: |
+          just \
+            debug_justfile="${{matrix.debug_justfile}}" \
+            profile=${{matrix.profile.name}} \
+            target=x86_64-unknown-linux-gnu \
+            version=${{ needs.version.outputs.version }}-${{ matrix.profile.name }} \
+            oci_repo="ghcr.io" \
+            print-container-tags
+
+      - name: "Check for uncommitted changes"
+        run: |
+          git diff --exit-code
+          if [ $? -ne 0 ]; then
+            echo "::error::Uncommitted changes detected:"
+            git diff
+            exit 1
+          fi
+          echo "No uncommitted changes found"
+
+      - name: "Check for untracked files"
+        run: |
+          if [ -n "$(git ls-files --others --exclude-standard)" ]; then
+            echo "::error::Untracked files detected:"
+            git ls-files --others --exclude-standard
+            exit 1
+          fi
+          echo "No untracked files found"
+
+      - id: "test"
+        name: "test"
+        run: |
+          set -euo pipefail
+          mkdir --parent ./target/nextest
+          # Run tests. The resulting results.json is not a full JSON object but
+          # a list of JSON objects, one per line.
+          if [ ${{ matrix.profile.name }} = "fuzz" ]; then
+            echo "::notice::Running fuzz tests"
+            just \
+              debug_justfile="${{matrix.debug_justfile}}" \
+              profile=${{matrix.profile.name}} \
+              target=x86_64-unknown-linux-gnu \
+              dpdp_sys_registry="${{env.CACHE_REGISTRY}}" \
+              ${{matrix.profile.sterile}} coverage \
+                --status-level=none \
+                --final-status-level=skip \
+                --message-format=libtest-json-plus > ./results.json
+          else
+            echo "::notice::Running regular tests"
+            just \
+              debug_justfile="${{matrix.debug_justfile}}" \
+              profile=${{matrix.profile.name}} \
+              target=x86_64-unknown-linux-gnu \
+              dpdp_sys_registry="${{env.CACHE_REGISTRY}}" \
+              ${{matrix.profile.sterile}} cargo nextest run \
+                --cargo-profile=${{matrix.profile.name}} \
+                --status-level=none \
+                --final-status-level=skip \
+                --message-format=libtest-json-plus \
+                > ./results.json
+            echo "::notice::Running Shuttle tests"
+            # We need to rebuild using the shuttle feature. To avoid running
+            # all tests a second time, we filter to run only tests with pattern
+            # "shuttle" in their name (test function name, file name, or module
+            # name).
+            #
+            # IF YOUR SHUTTLE TESTS DO NOT HAVE "shuttle" IN THEIR NAME, THEY
+            # WILL NOT RUN.
+            just \
+              debug_justfile="${{matrix.debug_justfile}}" \
+              profile=${{matrix.profile.name}} \
+              target=x86_64-unknown-linux-gnu \
+              dpdp_sys_registry="${{env.CACHE_REGISTRY}}" \
+              ${{matrix.profile.sterile}} cargo nextest run \
+                --cargo-profile=${{matrix.profile.name}} \
+                --status-level=none \
+                --final-status-level=none \
+                --message-format=libtest-json-plus \
+                --features shuttle \
+                shuttle \
+                >> ./results.json
+          fi
+          # look for any flakes (flakes have a #\\d+ match in their name field)
+          jq \
+            --raw-output \
+            --slurp '.[] | select(.type == "test" and (.name | test(".*#\\d+"))) | ( .name | split("#") ) |
+                     [.[0], (.[1] | tonumber)] | @csv
+          ' ./results.json > ./target/nextest/flakes.csv
+          if [ -s ./target/nextest/flakes.csv ]; then
+            {
+              echo "FLAKY_TESTS<<EOF"
+              echo -e "### :warning: Flaky tests (${{matrix.profile.name}} - ${{matrix.profile.sterile}})\n";
+              echo "| test | retries |"
+              echo "|------|---------|"
+              just cargo csview --style=markdown --no-headers --body-align=left ./target/nextest/flakes.csv;
+              echo "EOF"
+            } >> "${GITHUB_ENV}"
+          fi
+          rm results.json
+
+      - name: "upload test results to codecov"
+        if: ${{ always() }}
+        uses: "codecov/codecov-action@v5"
+        with:
+          fail_ci_if_error: true
+          files: ./target/nextest/default/junit.xml
+          report_type: "test_results"
+          disable_search: "true"
+          use_oidc: "true"
+          verbose: true
+          flags: "${{matrix.profile.name}}-${{ matrix.profile.sterile || 'developer' }}"
+
+      - name: "upload codecov analysis"
+        if: ${{ matrix.profile.name == 'fuzz' }}
+        uses: "codecov/codecov-action@v5"
+        with:
+          fail_ci_if_error: true
+          files: ./target/nextest/coverage/codecov.json
+          report_type: "coverage"
+          disable_search: "true"
+          use_oidc: "true"
+          verbose: true
+          flags: "${{matrix.profile.name}}-${{ matrix.profile.sterile || 'developer' }}"
+
+      - name: "clean up coverage data"
+        run: |
+          rm -f codecov codecov.SHA256SUM codecov.SHA256SUM.sig
+
+      - uses: "marocchino/sticky-pull-request-comment@v2"
+        if: ${{ always() }}
+        with:
+          header: "flakes_${{matrix.profile.name}}_${{matrix.profile.sterile}}"
+          ignore_empty: "true"
+          message: |
+            ${{ env.FLAKY_TESTS }}
+
+      - name: "publish test report"
+        uses: "mikepenz/action-junit-report@v6"
+        if: "${{ always() }}"
+        with:
+          annotate_notice: "false"
+          annotate_only: "false"
+          check_annotations: "true"
+          check_retries: "false"
+          comment: "false"
+          detailed_summary: "true"
+          fail_on_failure: "false"
+          fail_on_parse_error: "true"
+          flaky_summary: "true"
+          include_empty_in_summary: "true"
+          include_passed: "true"
+          include_time_in_summary: "true"
+          report_paths: "target/nextest/default/*junit.xml"
+          require_passed_tests: "true"
+          require_tests: "true"
+          simplified_summary: "true"
+          truncate_stack_traces: "false"
+          group_reports: "true"
+          check_name: "test-report-${{matrix.profile.name}}-sterile:${{matrix.profile.sterile == 'sterile'}}"
+          skip_success_summary: "false"
+          job_summary: "true"
+          verbose_summary: "false"
+
+      - id: "clippy"
+        name: "run clippy"
+        run: |
+          just debug_justfile="${{matrix.debug_justfile}}" profile=${{matrix.profile.name}} \
+            ${{matrix.profile.sterile}} cargo clippy --all-targets --all-features -- -D warnings
+
+      - id: "docs"
+        name: "run rustdoc"
+        run: |
+          RUSTDOCFLAGS="-D warnings" just \
+            debug_justfile="${{matrix.debug_justfile}}" \
+            profile=${{matrix.profile.name}} \
+            target=x86_64-unknown-linux-gnu \
+            ${{matrix.profile.sterile}} cargo doc --no-deps
+
+      - name: "run doctests"
+        run: |
+          just \
+            debug_justfile="${{matrix.debug_justfile}}" \
+            profile=${{matrix.profile.name}} \
+            target=x86_64-unknown-linux-gnu \
+            ${{matrix.profile.sterile}} cargo test --doc
+
+      - name: "Setup tmate session for debug"
+        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+        uses: "mxschmitt/action-tmate@v3"
+        timeout-minutes: 60
+        with:
+          limit-access-to-actor: true
+
+  vlab:
+    if: "${{ needs.check_changes.outputs.devfiles == 'true' || (startsWith(github.event.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/v')) && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}"
+    needs:
+      - check
+      - version
+
+    name: "${{ matrix.hybrid && 'h' || 'v' }}-${{ matrix.upgradefrom && 'up' || '' }}${{ matrix.upgradefrom }}${{ matrix.upgradefrom && '-' || '' }}${{ matrix.mesh && 'mesh-' || '' }}${{ matrix.gateway && 'gw-' || '' }}${{ matrix.includeonie && 'onie-' || '' }}${{ matrix.buildmode }}-${{ matrix.vpcmode }}"
+
+    uses: githedgehog/fabricator/.github/workflows/run-vlab.yaml@master
+    with:
+      # ci:+hlab is required to enable hybrid lab tests on PR
+      # ci:-vlab disables virtual lab tests on PR
+      # ci:-upgrade disables upgrade tests on PR
+      # hlab is disabled for main and merge_queue till we have gateway tests for it
+      skip: >-
+        ${{
+          github.event_name == 'pull_request'
+          && (
+            matrix.hybrid && !contains(github.event.pull_request.labels.*.name, 'ci:+hlab')
+            || !matrix.hybrid && contains(github.event.pull_request.labels.*.name, 'ci:-vlab')
+            || matrix.upgradefrom != '' && contains(github.event.pull_request.labels.*.name, 'ci:-upgrade')
+          )
+
+          || github.event_name == 'workflow_dispatch'
+          && (
+            matrix.hybrid && inputs.run_hlab_tests != true
+            || !matrix.hybrid && inputs.skip_vlab_tests == true
+          )
+
+          || (github.event_name == 'push' || github.event_name == 'merge_group')
+          && matrix.hybrid
+        }}
+      fabricatorref: master
+      prebuild: "just bump dataplane ${{ needs.version.outputs.version }}-release"
+      fabricmode: ${{ matrix.fabricmode }}
+      gateway: ${{ matrix.gateway }}
+      gateway_agentless: true
+      includeonie: ${{ matrix.includeonie }}
+      buildmode: ${{ matrix.buildmode }}
+      vpcmode: ${{ matrix.vpcmode }}
+      releasetest: ${{ contains(github.event.pull_request.labels.*.name, 'ci:+release') || inputs.enable_release_tests == true }}
+      hybrid: ${{ matrix.hybrid }}
+      upgradefrom: ${{ matrix.upgradefrom }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        fabricmode:
+          - spine-leaf
+        gateway:
+          - true
+        includeonie:
+          - false
+        buildmode:
+          - iso
+        vpcmode:
+          - l2vni
+        hybrid:
+          - false
+        upgradefrom:
+          - ""
+          - "25.05"
+        include:
+          # gateway l3vni
+          - fabricmode: spine-leaf
+            gateway: true
+            includeonie: false
+            buildmode: iso
+            vpcmode: l3vni
+            hybrid: false
+            upgradefrom: ""
+
+          # hlab gateway l2vni
+          - fabricmode: spine-leaf
+            gateway: true
+            includeonie: false
+            buildmode: iso
+            vpcmode: l2vni
+            hybrid: true
+            upgradefrom: ""
+
+  summary:
+    name: "Summary"
+    runs-on: "ubuntu-latest"
+    needs:
+      - check
+      - vlab
+    # Run always, except when the "check" job was skipped.
+    #
+    # When the check job is skipped, summary will be marked as skipped, and
+    # it's OK for CI (it's not a failure).
+    # Why don't we do the same for check jobs? Because their names depend on
+    # matrix values, and if we skip them the names won't be generated and
+    # GitHub won't be able to find skipped jobs for required status checks.
+    if: ${{ always() }}
+    steps:
+      - name: "Flag any check matrix failures"
+        if: ${{ needs.check.result != 'success' && needs.check.result != 'skipped' }}
+        run: |
+          echo '::error:: Some check job(s) failed'
+          exit 1
+      - name: "Flag any vlab matrix failures"
+        if: ${{ needs.vlab.result != 'success' && needs.vlab.result != 'skipped' }}
+        run: |
+          echo '::error:: Some vlab job(s) failed'
+          exit 1
+
+  publish:
+    env:
+      CACHE_REGISTRY: "run.h.hhdev.io:30000"
+      UPSTREAM_REGISTRY: "ghcr.io"
+    runs-on: lab
+    if: startsWith(github.event.ref, 'refs/tags/v') && github.event_name == 'push'
+    needs:
+      - check
+      - vlab
+
+    permissions:
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: stable
+          cache: true
+
+      - name: Login to ghcr.io
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: "login to image cache"
+        uses: "docker/login-action@v3"
+        with:
+          registry: "${{ env.CACHE_REGISTRY }}"
+          username: "${{ secrets.LAB_REGISTRY_USERNAME }}"
+          password: "${{ secrets.LAB_REGISTRY_TOKEN }}"
+
+      - name: "set up build environment"
+        run: |
+          REQUIRED_HUGEPAGES=512
+          HUGEPAGES_PATH=/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages
+          OVERCOMMIT_HUGEPAGES_PATH=/sys/kernel/mm/hugepages/hugepages-2048kB/nr_overcommit_hugepages
+          docker run --privileged --rm busybox:latest sh -c "echo $((6 * REQUIRED_HUGEPAGES)) > $OVERCOMMIT_HUGEPAGES_PATH"
+          docker run --privileged --rm busybox:latest sh -c "echo $((2 * REQUIRED_HUGEPAGES)) > $HUGEPAGES_PATH"
+          docker pull "${{env.UPSTREAM_REGISTRY}}/githedgehog/testn/n-vm:v0.0.9"
+          just --yes \
+            debug_justfile="${{matrix.debug_justfile}}" \
+            profile=${{matrix.profile.name}} \
+            dpdp_sys_registry="${{env.CACHE_REGISTRY}}" \
+            refresh-compile-env
+          just --yes debug_justfile="${{matrix.debug_justfile}}" fake-nix
+
+      - name: "push container"
+        run: |
+          just \
+            debug_justfile="${{matrix.debug_justfile}}" \
+            profile=release \
+            dpdp_sys_registry="${{env.UPSTREAM_REGISTRY}}" \
+            target=x86_64-unknown-linux-gnu \
+            oci_repo="ghcr.io" \
+            push
+
+      # Bump dataplane in the fabricator repository
+
+      - name: Checkout fabricator repository
+        uses: actions/checkout@v6
+        with:
+          repository: githedgehog/fabricator
+          path: fab-repo
+          persist-credentials: false
+
+      - name: Bump dataplane in fabricator
+        working-directory: fab-repo
+        run: |
+          sed -i "s/^\tDataplaneVersion.*/\tDataplaneVersion=meta.Version(\"${{ github.ref_name }}\")/" pkg/fab/versions.go
+          go fmt pkg/fab/versions.go
+
+      - name: Generate token for the fabricator repository
+        uses: actions/create-github-app-token@v2
+        id: fab-app-token
+        with:
+          app-id: ${{ secrets.FAB_APP_ID }}
+          private-key: ${{ secrets.FAB_PRIVATE_KEY }}
+          repositories: |
+            fabricator
+
+      - name: Create Pull Request for fabricator
+        uses: peter-evans/create-pull-request@v8
+        id: fab-pr
+        with:
+          token: ${{ steps.fab-app-token.outputs.token }}
+          path: fab-repo
+          branch: pr/auto/dataplane-bump
+          commit-message: |
+            bump: dataplane to ${{ github.ref_name }}
+
+            This is an automated commit created by GitHub Actions workflow,
+            in the dataplane repository.
+          signoff: true
+          title: "bump: dataplane to ${{ github.ref_name }}"
+          body: |
+            This is an automated Pull Request created by GitHub Actions workflow,
+            in the dataplane repository.
diff --git a/Cargo.lock b/Cargo.lock
index ba5226617..14160a51c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -117,7 +117,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -128,7 +128,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -242,9 +242,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.37.0"
+version = "0.37.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c34dda4df7017c8db52132f0f8a2e0f8161649d15723ed63fc00c82d0f2081a"
+checksum = "b092fe214090261288111db7a2b2c2118e5a7f30dc2569f1732c4069a6840549"
 dependencies = [
  "cc",
  "cmake",
@@ -413,7 +413,6 @@ version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
 dependencies = [
- "arbitrary",
  "serde_core",
 ]
 
@@ -753,9 +752,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.57"
+version = "4.5.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6899ea499e3fb9305a65d5ebf6e3d2248c5fab291f300ad0a704fbe142eae31a"
+checksum = "63be97961acde393029492ce0be7a1af7e323e6bae9511ebfac33751be5e6806"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -763,9 +762,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.57"
+version = "4.5.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b12c8b680195a62a8364d16b8447b01b6c2c8f9aaf68bee653be34d4245e238"
+checksum = "7f13174bda5dfd69d7e947827e5af4b0f2f94a4a3ee92912fba07a66150f21e2"
 dependencies = [
  "anstream",
  "anstyle",
@@ -787,9 +786,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.7.7"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3e64b0cc0439b12df2fa678eae89a1c56a529fd067a9115f7827f1fffd22b32"
+checksum = "3a822ea5bc7590f9d40f1ba12c0dc3c2760f3482c6984db1573ad11031420831"
 
 [[package]]
 name = "clipboard-win"
@@ -869,7 +868,7 @@ version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1030,12 +1029,12 @@ dependencies = [
 
 [[package]]
 name = "ctrlc"
-version = "3.5.1"
+version = "3.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73736a89c4aff73035ba2ed2e565061954da00d4970fc9ac25dcc85a2a20d790"
+checksum = "e0b1fab2ae45819af2d0731d60f2afe17227ebb1a1538a236da84c93e9a60162"
 dependencies = [
  "dispatch2",
- "nix 0.30.1",
+ "nix 0.31.1",
  "windows-sys 0.61.2",
 ]
 
@@ -1237,7 +1236,6 @@ dependencies = [
  "bincode2",
  "clap",
  "colored",
- "dataplane-dpdk-sysroot-helper",
  "log",
  "rustyline",
  "serde",
@@ -1428,7 +1426,7 @@ dependencies = [
  "dataplane-rekon",
  "derive_builder 0.20.2",
  "futures",
- "libc 1.0.0-alpha.2",
+ "libc 1.0.0-alpha.3",
  "multi_index_map",
  "nix 0.31.1",
  "rtnetlink",
@@ -1444,11 +1442,11 @@ name = "dataplane-k8s-intf"
 version = "0.11.0"
 dependencies = [
  "bolero",
+ "dataplane-dpdk-sysroot-helper",
  "dataplane-hardware",
  "dataplane-lpm",
  "dataplane-net",
  "dataplane-tracectl",
- "dotenvy",
  "futures",
  "k8s-openapi",
  "kube",
@@ -1462,7 +1460,6 @@ dependencies = [
  "thiserror 2.0.18",
  "tokio",
  "tracing",
- "ureq",
 ]
 
 [[package]]
@@ -1534,6 +1531,7 @@ dependencies = [
  "ipnet",
  "linkme",
  "multi_index_map",
+ "n-vm",
  "netdev",
  "pretty_assertions",
  "rtnetlink",
@@ -1541,6 +1539,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tokio",
  "tracing",
+ "tracing-subscriber",
  "tracing-test",
 ]
 
@@ -1683,7 +1682,6 @@ dependencies = [
 name = "dataplane-sysfs"
 version = "0.11.0"
 dependencies = [
- "dataplane-dpdk-sysroot-helper",
  "n-vm",
  "nix 0.31.1",
  "procfs",
@@ -1759,9 +1757,9 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.5.5"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ececcb659e7ba858fb4f10388c250a7252eb0a27373f1a72b8748afdd248e587"
+checksum = "cc3dc5ad92c2e2d1c193bbbbdf2ea477cb81331de4f3103f267ca18368b988c4"
 dependencies = [
  "powerfmt",
  "serde_core",
@@ -1923,12 +1921,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "dotenvy"
-version = "0.15.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
-
 [[package]]
 name = "downcast-rs"
 version = "2.0.2"
@@ -2048,7 +2040,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc 0.2.180",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2140,16 +2132,6 @@ dependencies = [
  "syn 2.0.114",
 ]
 
-[[package]]
-name = "flate2"
-version = "1.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
-dependencies = [
- "crc32fast",
- "miniz_oxide",
-]
-
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -3172,9 +3154,9 @@ checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
 
 [[package]]
 name = "libc"
-version = "1.0.0-alpha.2"
+version = "1.0.0-alpha.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85272f924988b0557659867ecbb172a88990b2c5175bebd38c44956e7c74e701"
+checksum = "e136bfa874086c78f34d6eba98c423fefe464ce57f38164d16893ba8ed358e70"
 
 [[package]]
 name = "libflate"
@@ -3438,7 +3420,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
 dependencies = [
  "adler2",
- "simd-adler32",
 ]
 
 [[package]]
@@ -3561,9 +3542,9 @@ dependencies = [
 
 [[package]]
 name = "netgauze-bgp-pkt"
-version = "0.9.0"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e5346319fbafd33d00fd6d0ae097a0ff1e04539e4cc18caef9b85535a895528"
+checksum = "976c96f06769f989f41c99f11c06165cfb6b5d9fe0d6fee18d5369804186a590"
 dependencies = [
  "byteorder",
  "ipnet",
@@ -3573,15 +3554,14 @@ dependencies = [
  "netgauze-serde-macros",
  "nom",
  "serde",
- "strum",
  "strum_macros",
 ]
 
 [[package]]
 name = "netgauze-bmp-pkt"
-version = "0.9.0"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02378a916cd905ab71aefd43c360b492381fcba65264729bbd7ec9b88b0de77c"
+checksum = "e559ed37796b9d4116a2eb8f6b4bb64ddc143e6e9b30461838248f569badd51b"
 dependencies = [
  "bitflags 2.10.0",
  "byteorder",
@@ -3596,37 +3576,34 @@ dependencies = [
  "netgauze-serde-macros",
  "nom",
  "serde",
- "strum",
  "strum_macros",
  "tokio-util",
 ]
 
 [[package]]
 name = "netgauze-iana"
-version = "0.9.0"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55e02528df8650e15ce0008b4734dbf0d1c7df8a1c2b0d1acf3589e82033cb28"
+checksum = "d927104bf8eb4c0c4fa62f6089da2ae76cbb6632fa29c712494bf6b00ceeec05"
 dependencies = [
  "serde",
- "serde_json",
- "strum",
  "strum_macros",
 ]
 
 [[package]]
 name = "netgauze-locate"
-version = "0.9.0"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d641872e534269c3fffe64edbac86914b6f7afff989a1f5114ce05da8698cccc"
+checksum = "ef7b2913ed285eb74b86fde33a6e69525009008f694777b1d892853c17012366"
 dependencies = [
  "nom",
 ]
 
 [[package]]
 name = "netgauze-parse-utils"
-version = "0.9.0"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45cfd05f7bb1cce8937a3d2e56c3766571c13335e7c8e6459697ca2bbbe224e6"
+checksum = "d1d87bded02d6ee3d949886f38fe3170df3ea60366c96e69617476532ade293c"
 dependencies = [
  "netgauze-locate",
  "nom",
@@ -3635,9 +3612,9 @@ dependencies = [
 
 [[package]]
 name = "netgauze-serde-macros"
-version = "0.9.0"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ff4b7ebc443b5fac9280a8a5a1861769e4bad33b7255a4c15a5aee901389d68"
+checksum = "f3c71c31f7611ff298060ea8d1e4f0f3e90390a15ea4d8be52b299253cf2731e"
 dependencies = [
  "quote",
  "syn 2.0.114",
@@ -3813,7 +3790,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4716,9 +4693,9 @@ dependencies = [
 
 [[package]]
 name = "rkyv"
-version = "0.8.14"
+version = "0.8.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "360b333c61ae24e5af3ae7c8660bd6b21ccd8200dbbc5d33c2454421e85b9c69"
+checksum = "1a30e631b7f4a03dee9056b8ef6982e8ba371dd5bedb74d3ec86df4499132c70"
 dependencies = [
  "bytecheck",
  "bytes",
@@ -4735,9 +4712,9 @@ dependencies = [
 
 [[package]]
 name = "rkyv_derive"
-version = "0.8.14"
+version = "0.8.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c02f8cdd12b307ab69fe0acf4cd2249c7460eb89dce64a0febadf934ebb6a9e"
+checksum = "8100bb34c0a1d0f907143db3149e6b4eea3c33b9ee8b189720168e818303986f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4804,7 +4781,7 @@ dependencies = [
  "errno",
  "libc 0.2.180",
  "linux-raw-sys 0.11.0",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4816,7 +4793,6 @@ dependencies = [
  "aws-lc-rs",
  "log",
  "once_cell",
- "ring",
  "rustls-pki-types",
  "rustls-webpki",
  "subtle",
@@ -5240,12 +5216,6 @@ dependencies = [
  "libc 0.2.180",
 ]
 
-[[package]]
-name = "simd-adler32"
-version = "0.3.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
-
 [[package]]
 name = "simdutf8"
 version = "0.1.5"
@@ -5468,15 +5438,15 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
 [[package]]
 name = "tempfile"
-version = "3.24.0"
+version = "3.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c"
+checksum = "0136791f7c95b1f6dd99f9cc786b91bb81c3800b639b3478e561ddb7be95e5f1"
 dependencies = [
  "fastrand 2.3.0",
- "getrandom 0.3.4",
+ "getrandom 0.4.1",
  "once_cell",
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5633,6 +5603,7 @@ dependencies = [
  "bytes",
  "libc 0.2.180",
  "mio",
+ "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
  "socket2",
@@ -5989,35 +5960,6 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
-[[package]]
-name = "ureq"
-version = "3.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdc97a28575b85cfedf2a7e7d3cc64b3e11bd8ac766666318003abbacc7a21fc"
-dependencies = [
- "base64 0.22.1",
- "flate2",
- "log",
- "percent-encoding",
- "rustls",
- "rustls-pki-types",
- "ureq-proto",
- "utf-8",
- "webpki-roots",
-]
-
-[[package]]
-name = "ureq-proto"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d81f9efa9df032be5934a46a068815a10a042b494b6a58cb0a1a97bb5467ed6f"
-dependencies = [
- "base64 0.22.1",
- "http 1.4.0",
- "httparse",
- "log",
-]
-
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -6031,12 +5973,6 @@ dependencies = [
  "serde_derive",
 ]
 
-[[package]]
-name = "utf-8"
-version = "0.7.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
-
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -6247,15 +6183,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "webpki-roots"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cfaf3c063993ff62e73cb4311efde4db1efb31ab78a3e5c457939ad5cc0bed"
-dependencies = [
- "rustls-pki-types",
-]
-
 [[package]]
 name = "winapi"
 version = "0.3.9"
diff --git a/cli/Cargo.toml b/cli/Cargo.toml
index 533308327..06df70ee1 100644
--- a/cli/Cargo.toml
+++ b/cli/Cargo.toml
@@ -22,6 +22,5 @@ thiserror = { workspace = true }
 
 [build-dependencies]
 # internal
-dpdk-sysroot-helper = { workspace = true }
 
 # external
diff --git a/cli/build.rs b/cli/build.rs
deleted file mode 100644
index 52f5b0197..000000000
--- a/cli/build.rs
+++ /dev/null
@@ -1,8 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Copyright Open Network Fabric Authors
-
-fn main() {
-    let sysroot = dpdk_sysroot_helper::get_sysroot();
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
-    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
-}
diff --git a/dataplane/Cargo.toml b/dataplane/Cargo.toml
index dcd605dec..70d8807e8 100644
--- a/dataplane/Cargo.toml
+++ b/dataplane/Cargo.toml
@@ -5,6 +5,10 @@ license.workspace = true
 publish.workspace = true
 version.workspace = true
 
+[features]
+default = ["dpdk"]
+dpdk = ["dep:dpdk", "dep:dpdk-sysroot-helper"]
+
 [dependencies]
 afpacket = { workspace = true, features = ["async-tokio"] }
 args = { workspace = true }
@@ -14,7 +18,7 @@ axum-server = { workspace = true }
 concurrency = { workspace = true }
 config = { workspace = true }
 ctrlc = { workspace = true, features = ["termination"] }
-dpdk = { workspace = true }
+dpdk = { workspace = true, optional = true }
 dyn-iter = { workspace = true }
 flow-entry = { workspace = true }
 flow-filter = { workspace = true }
@@ -61,6 +65,6 @@ tracing-subscriber = { workspace = true }
 
 [build-dependencies]
 # internal
-dpdk-sysroot-helper = { workspace = true }
+dpdk-sysroot-helper = { workspace = true, optional = true }
 
 # external
diff --git a/dataplane/build.rs b/dataplane/build.rs
index 52f5b0197..78e28dd9f 100644
--- a/dataplane/build.rs
+++ b/dataplane/build.rs
@@ -2,7 +2,6 @@
 // Copyright Open Network Fabric Authors
 
 fn main() {
-    let sysroot = dpdk_sysroot_helper::get_sysroot();
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
-    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
+    #[cfg(feature = "dpdk")]
+    dpdk_sysroot_helper::use_sysroot();
 }
diff --git a/dataplane/src/drivers/dpdk.rs b/dataplane/src/drivers/dpdk.rs
index f5f9b2a57..0f1903220 100644
--- a/dataplane/src/drivers/dpdk.rs
+++ b/dataplane/src/drivers/dpdk.rs
@@ -3,6 +3,7 @@
 
 //! DPDK dataplane driver
 
+#![cfg(feature = "dpdk")]
 #![allow(unused)]
 
 use dpdk::dev::{Dev, TxOffloadConfig};
diff --git a/default.nix b/default.nix
index a0c5dcd84..e7d9ca3fc 100644
--- a/default.nix
+++ b/default.nix
@@ -29,6 +29,7 @@ let
     {
       "debug" = "dev";
       "release" = "release";
+      "fuzz" = "fuzz";
     }
     .${profile};
   overlays = import ./nix/overlays {
@@ -54,6 +55,15 @@ let
         overlays.dataplane
       ];
     }).pkgsCross.${platform'.info.nixarch};
+  frr-pkgs =
+    (import sources.nixpkgs {
+      overlays = [
+        overlays.rust
+        overlays.llvm
+        overlays.dataplane
+        overlays.frr
+      ];
+    }).pkgsCross.${platform'.info.nixarch};
   sysroot = pkgs.pkgsHostHost.symlinkJoin {
     name = "sysroot";
     paths = with pkgs.pkgsHostHost; [
@@ -118,6 +128,7 @@ let
       npins
       pkg-config
       rust-toolchain
+      skopeo
     ]);
   };
   devenv = pkgs.mkShell {
@@ -147,7 +158,7 @@ let
   };
   target = pkgs.stdenv'.targetPlatform.rust.rustcTarget;
   is-cross-compile = dev-pkgs.stdenv.hostPlatform.rust.rustcTarget != target;
-  cc = if is-cross-compile then "${target}-clang" else "clang";
+  cxx = if is-cross-compile then "${target}-clang++" else "clang++";
   strip = if is-cross-compile then "${target}-strip" else "strip";
   objcopy = if is-cross-compile then "${target}-objcopy" else "objcopy";
   package-list = builtins.fromJSON (
@@ -168,18 +179,9 @@ let
   cargo-cmd-prefix = [
     "-Zunstable-options"
     "-Zbuild-std=compiler_builtins,core,alloc,std,panic_unwind,panic_abort,sysroot,unwind"
+    "-Zbuild-std-features=backtrace,panic-unwind,mem,compiler-builtins-mem"
     "--target=${target}"
-  ]
-  ++ (
-    if builtins.elem "thread" sanitizers then
-      [
-        "-Zbuild-std-features=backtrace,panic-unwind,mem,compiler-builtins-mem"
-      ]
-    else
-      [
-        "-Zbuild-std-features=backtrace,panic-unwind,mem,compiler-builtins-mem,llvm-libunwind"
-      ]
-  );
+  ];
   invoke =
     {
       builder,
@@ -232,8 +234,9 @@ let
           RUSTFLAGS = builtins.concatStringsSep " " (
             profile'.RUSTFLAGS
             ++ [
-              "-Clinker=${pkgs.pkgsBuildHost.llvmPackages'.clang}/bin/${cc}"
+              "-Clinker=${pkgs.pkgsBuildHost.llvmPackages'.clang}/bin/${cxx}"
               "-Clink-arg=--ld-path=${pkgs.pkgsBuildHost.llvmPackages'.lld}/bin/ld.lld"
+              "-Clink-arg=-Wl,--as-needed,--gc-sections"
               "-Clink-arg=-L${sysroot}/lib"
               # NOTE: this is basically a trick to make our source code available to debuggers.
               # Normally remap-path-prefix takes the form --remap-path-prefix=FROM=TO where FROM and TO are directories.
@@ -248,15 +251,6 @@ let
               # gdb/lldbserver container should allow us to actually debug binaries deployed to test machines.
               "--remap-path-prefix==${src}"
             ]
-            ++ (
-              if ((builtins.elem "thread" sanitizers) || (builtins.elem "safe-stack" sanitizers)) then
-                [
-                  # "-Zexternal-clangrt"
-                  # "-Clink-arg=--rtlib=compiler-rt"
-                ]
-              else
-                [ ]
-            )
           );
         };
       }
@@ -320,9 +314,12 @@ let
 
   test-builder =
     {
-      pname ? null,
+      package ? null,
       cargoArtifacts ? null,
     }:
+    let
+      pname = if package != null then package else "all";
+    in
     pkgs.callPackage invoke {
       builder = craneLib.mkCargoDerivation;
       args = {
@@ -336,19 +333,22 @@ let
             "--archive-file"
             "$out/${pname}.tar.zst"
             "--cargo-profile=${cargo-profile}"
-            "--package=${pname}"
           ]
+          ++ (if package != null then [ "--package=${pname}" ] else [ ])
           ++ cargo-cmd-prefix
         );
       };
     };
 
-  tests = builtins.mapAttrs (
-    dir: pname:
-    test-builder {
-      inherit pname;
-    }
-  ) package-list;
+  tests = {
+    all = test-builder { };
+    pkg = builtins.mapAttrs (
+      dir: package:
+      test-builder {
+        inherit package;
+      }
+    ) package-list;
+  };
 
   clippy-builder =
     {
@@ -382,8 +382,8 @@ let
     }
   ) package-list;
 
-  dataplane-tar = pkgs.stdenv'.mkDerivation {
-    pname = "dataplane-tar";
+  min-tar = pkgs.stdenv'.mkDerivation {
+    pname = "min-tar";
     inherit version;
     dontUnpack = true;
     src = null;
@@ -393,12 +393,8 @@ let
       in
       ''
         tmp="$(mktemp -d)"
-        mkdir -p "$tmp/"{bin,lib,var,etc,run/dataplane,run/frr/hh,run/netns}
+        mkdir -p "$tmp/"{bin,lib,var,etc,run/dataplane,run/frr/hh,run/netns,home,tmp}
         ln -s /run "$tmp/var/run"
-        cp --dereference "${workspace.dataplane}/bin/dataplane" "$tmp/bin"
-        cp --dereference "${workspace.cli}/bin/cli" "$tmp/bin"
-        cp --dereference "${workspace.init}/bin/dataplane-init" "$tmp/bin"
-        ln -s cli "$tmp/bin/sh"
         for f in "${pkgs.pkgsHostHost.dockerTools.fakeNss}/etc/"* ; do
           cp --archive "$(readlink -e "$f")" "$tmp/etc/$(basename "$f")"
         done
@@ -418,8 +414,8 @@ let
           --group=0 \
           \
           `# anybody editing the files shipped in the container image is up to no good, block all of that.` \
-          `# More, we expressly forbid setuid / setgid anything.  May as well toss in the sticky bit as well.` \
-          --mode='u-sw,go=' \
+          `# More, we expressly forbid setuid / setgid anything.` \
+          --mode='ugo-sw' \
           \
           `# acls / setcap / selinux isn't going to be reliably copied into the image; skip to make more reproducible` \
           --no-acls \
@@ -463,19 +459,111 @@ let
           \
           . \
           ${pkgs.pkgsHostHost.libc.out} \
-          ${if builtins.elem "thread" sanitizers then pkgs.pkgsHostHost.glibc.libgcc or "" else ""} \
+          ${pkgs.pkgsHostHost.glibc.libgcc} \
       '';
 
   };
 
+  dataplane-tar = pkgs.stdenv'.mkDerivation {
+    pname = "dataplane-tar";
+    inherit version;
+    dontUnpack = true;
+    src = null;
+    buildPhase = ''
+      tmp="$(mktemp -d)"
+      tar xf "${min-tar}" -C "$tmp"
+      chown -R $(id -u):$(id -g) $tmp
+      chmod +w $tmp/bin
+      cp --dereference "${workspace.dataplane}/bin/dataplane" "$tmp/bin"
+      cp --dereference "${workspace.cli}/bin/cli" "$tmp/bin"
+      cp --dereference "${workspace.init}/bin/dataplane-init" "$tmp/bin"
+      ln -s cli "$tmp/bin/sh"
+      cd "$tmp"
+      # we take some care to make the tar file reproducible here
+      tar \
+        --create \
+        --file "$out" \
+        --sort=name \
+        --clamp-mtime \
+        --mtime=0 \
+        --format=posix \
+        --numeric-owner \
+        --owner=0 \
+        --group=0 \
+        --mode='ugo-sw' \
+        --no-acls \
+        --no-xattrs \
+        --no-selinux \
+        --verbose \
+        .
+    '';
+
+  };
+
+  containers.libc = pkgs.dockerTools.buildLayeredImage {
+    name = "dataplane-debugger";
+    tag = "latest";
+    contents = pkgs.buildEnv {
+      name = "dataplane-debugger-env";
+      pathsToLink = [
+        "/bin"
+        "/etc"
+        "/var"
+        "/lib"
+      ];
+      paths = [
+        pkgs.pkgsBuildHost.gdb
+        pkgs.pkgsBuildHost.rr
+        pkgs.pkgsBuildHost.coreutils
+        pkgs.pkgsBuildHost.bashInteractive
+        pkgs.pkgsBuildHost.iproute2
+        pkgs.pkgsBuildHost.ethtool
+
+        pkgs.pkgsHostHost.libc.debug
+        workspace.cli.debug
+        workspace.dataplane.debug
+        workspace.init.debug
+      ];
+    };
+  };
+
+  containers.dataplane-debugger = pkgs.dockerTools.buildLayeredImage {
+    name = "dataplane-debugger";
+    tag = "latest";
+    contents = pkgs.buildEnv {
+      name = "dataplane-debugger-env";
+      pathsToLink = [
+        "/bin"
+        "/etc"
+        "/var"
+        "/lib"
+      ];
+      paths = [
+        pkgs.pkgsBuildHost.gdb
+        pkgs.pkgsBuildHost.rr
+        pkgs.pkgsBuildHost.coreutils
+        pkgs.pkgsBuildHost.bashInteractive
+        pkgs.pkgsBuildHost.iproute2
+        pkgs.pkgsBuildHost.ethtool
+
+        pkgs.pkgsHostHost.libc.debug
+        workspace.cli.debug
+        workspace.dataplane.debug
+        workspace.init.debug
+      ];
+    };
+  };
+
 in
 {
   inherit
     clippy
+    containers
     dataplane-tar
     dev-pkgs
-    devroot
     devenv
+    devroot
+    min-tar
     package-list
     pkgs
     sources
diff --git a/dpdk-sys/build.rs b/dpdk-sys/build.rs
index 556af520a..e0c5a219c 100644
--- a/dpdk-sys/build.rs
+++ b/dpdk-sys/build.rs
@@ -20,7 +20,8 @@ impl ParseCallbacks for Cb {
     }
 }
 
-fn bind(path: &Path, sysroot: &str) {
+fn bind(path: &Path) {
+    let sysroot = dpdk_sysroot_helper::get_sysroot();
     let out_path = PathBuf::from(env::var("OUT_DIR").unwrap());
     let static_fn_path = out_path.join("generated.h");
     bindgen::Builder::default()
@@ -47,7 +48,6 @@ fn bind(path: &Path, sysroot: &str) {
         .default_enum_style(bindgen::EnumVariation::ModuleConsts)
         .blocklist_item("rte_atomic.*")
         .allowlist_item("rte.*")
-        .allowlist_item("wrte_.*")
         .allowlist_item("RTE.*")
         .blocklist_item("__*")
         .clang_macro_fallback()
@@ -68,15 +68,9 @@ fn bind(path: &Path, sysroot: &str) {
 }
 
 fn main() {
+    dpdk_sysroot_helper::use_sysroot();
     let out_path = PathBuf::from(env::var("OUT_DIR").unwrap());
-    let sysroot = dpdk_sysroot_helper::get_sysroot();
-
-    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
 
-    // NOTE: DPDK absolutely requires whole-archive in the linking command.
-    // While I find this very questionable, it is what it is.
-    // It is just more work for the LTO later on I suppose ¯\_(ツ)_/¯
     let depends = [
         "dpdk_wrapper",
         "rte_net_virtio",
@@ -100,6 +94,7 @@ fn main() {
         "rte_rcu",
         "rte_ring",
         "rte_eal",
+        "rte_argparse",
         "rte_kvargs",
         "rte_telemetry",
         "rte_log",
@@ -109,6 +104,7 @@ fn main() {
         "efa",
         "hns",
         "mana",
+        "ionic",
         "bnxt_re-rdmav59",
         "cxgb4-rdmav59",
         "erdma-rdmav59",
@@ -126,12 +122,11 @@ fn main() {
         "numa",
     ];
 
-    for dep in &depends {
+    // NOTE: DPDK absolutely requires whole-archive in the linking command.
+    // While I find this very questionable, it is what it is.
+    // It is just more work for the LTO later on I suppose ¯\_(ツ)_/¯
+    for dep in depends {
         println!("cargo:rustc-link-lib=static:+whole-archive,+bundle={dep}");
     }
-    let rerun_if_changed = ["build.rs", "../scripts/dpdk-sys.env"];
-    for file in &rerun_if_changed {
-        println!("cargo:rerun-if-changed={file}");
-    }
-    bind(&out_path, sysroot.as_str());
+    bind(&out_path);
 }
diff --git a/dpdk-sysroot-helper/src/lib.rs b/dpdk-sysroot-helper/src/lib.rs
index 8c5b81f37..337267a7e 100644
--- a/dpdk-sysroot-helper/src/lib.rs
+++ b/dpdk-sysroot-helper/src/lib.rs
@@ -29,27 +29,22 @@ pub fn get_target_name() -> String {
         .to_string()
 }
 
-#[must_use]
-pub fn get_project_root() -> String {
-    env::var("CARGO_MANIFEST_DIR").expect("CARGO_MANIFEST_DIR not set")
-}
-
-#[must_use]
-pub fn get_compile_env() -> String {
-    env::var("COMPILE_ENV").expect("COMPILE_ENV not set")
-}
-
 #[must_use]
 pub fn get_sysroot() -> String {
-    let compile_env = env::var("COMPILE_ENV").expect("COMPILE_ENV not set");
-    let sysroot_env = format!("{compile_env}/sysroot");
-    let target = get_target_name();
-    let profile = get_profile_name();
-    let expected_sysroot = format!("{sysroot_env}/{target}/{profile}");
-    let expected_sysroot_path = Path::new(&expected_sysroot);
-    if expected_sysroot_path.exists() {
-        expected_sysroot
+    let sysroot_env = env::var("DATAPLANE_SYSROOT").expect("DATAPLANE_SYSROOT not set");
+    let sysroot_path = Path::new(&sysroot_env);
+    if sysroot_path.exists() {
+        sysroot_env
     } else {
-        panic!("sysroot not found at {expected_sysroot}")
+        panic!("sysroot not found at {sysroot_env}")
+    }
+}
+
+pub fn use_sysroot() {
+    let sysroot = get_sysroot();
+    println!("cargo:rustc-link-search=all={sysroot}/lib");
+    let rerun_if_changed = ["build.rs", sysroot.as_str()];
+    for file in rerun_if_changed {
+        println!("cargo:rerun-if-changed={file}");
     }
 }
diff --git a/dpdk/build.rs b/dpdk/build.rs
index 52f5b0197..236576084 100644
--- a/dpdk/build.rs
+++ b/dpdk/build.rs
@@ -2,7 +2,5 @@
 // Copyright Open Network Fabric Authors
 
 fn main() {
-    let sysroot = dpdk_sysroot_helper::get_sysroot();
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
-    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
+    dpdk_sysroot_helper::use_sysroot();
 }
diff --git a/dpdk/src/lcore.rs b/dpdk/src/lcore.rs
index 7c35c7b97..12a4dbc48 100644
--- a/dpdk/src/lcore.rs
+++ b/dpdk/src/lcore.rs
@@ -237,7 +237,7 @@ impl LCoreId {
 
     #[tracing::instrument(level = "trace")]
     pub fn current() -> LCoreId {
-        LCoreId(unsafe { dpdk_sys::rte_lcore_id_w() })
+        LCoreId(unsafe { dpdk_sys::rte_lcore_id() })
     }
 
     #[tracing::instrument(level = "trace")]
diff --git a/hardware/build.rs b/hardware/build.rs
index 52f5b0197..236576084 100644
--- a/hardware/build.rs
+++ b/hardware/build.rs
@@ -2,7 +2,5 @@
 // Copyright Open Network Fabric Authors
 
 fn main() {
-    let sysroot = dpdk_sysroot_helper::get_sysroot();
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
-    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
+    dpdk_sysroot_helper::use_sysroot();
 }
diff --git a/hardware/src/os/mod.rs b/hardware/src/os/mod.rs
index b9b13fe8d..75c136926 100644
--- a/hardware/src/os/mod.rs
+++ b/hardware/src/os/mod.rs
@@ -2,7 +2,7 @@
 // Copyright Open Network Fabric Authors
 
 #![doc = include_str!("README.md")]
-#![allow(clippy::doc_markdown)] // abbreviations were trigging spurious backtick lints
+#![allow(clippy::doc_markdown)] // abbreviations were triggering spurious backtick lints
 
 /// Type of operating system device.
 ///
diff --git a/init/Cargo.toml b/init/Cargo.toml
index 0b8f2a8ac..cfea1672a 100644
--- a/init/Cargo.toml
+++ b/init/Cargo.toml
@@ -5,6 +5,10 @@ license.workspace = true
 publish.workspace = true
 version.workspace = true
 
+[features]
+default = ["sysroot"]
+sysroot = ["dep:dpdk-sysroot-helper"]
+
 [dependencies]
 # internal
 hardware = { workspace = true, features = ["serde", "scan"] }
@@ -27,6 +31,6 @@ tracing-subscriber = { workspace = true, features = ["fmt"] }
 
 [build-dependencies]
 # internal
-dpdk-sysroot-helper = { workspace = true }
+dpdk-sysroot-helper = { workspace = true, optional = true }
 
 # external
diff --git a/init/build.rs b/init/build.rs
index 52f5b0197..1fc109eb8 100644
--- a/init/build.rs
+++ b/init/build.rs
@@ -2,7 +2,6 @@
 // Copyright Open Network Fabric Authors
 
 fn main() {
-    let sysroot = dpdk_sysroot_helper::get_sysroot();
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
-    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
+    #[cfg(feature = "sysroot")]
+    dpdk_sysroot_helper::use_sysroot();
 }
diff --git a/justfile b/justfile
index b0630fd74..fc236eb42 100644
--- a/justfile
+++ b/justfile
@@ -77,9 +77,6 @@ _dataplane_base_container := if _image_profile == "release" { _libc_container }
 
 # Warn if the compile-env image is deprecated (or missing)
 
-[private]
-_compile_env_check := if shell('docker image list --format "{{.Repository}}:{{.Tag}}" | grep -x "' + _compile_env_container + '" || true') == '' { shell('printf "\n/!\\ Latest compile-env not found, try \"just refresh-compile-env\"\n\n" >&2') } else { '' }
-
 # Docker settings
 
 [private]
@@ -554,3 +551,7 @@ bump_minor_version:
     echo "New version: ${NEW_VERSION}"
     sed -i "s/^version = \".*\"/version = \"${NEW_VERSION}\"/" Cargo.toml
     just cargo update -w
+
+[script]
+shell:
+   nix-shell
diff --git a/k8s-intf/Cargo.toml b/k8s-intf/Cargo.toml
index 87325a162..51836cddb 100644
--- a/k8s-intf/Cargo.toml
+++ b/k8s-intf/Cargo.toml
@@ -38,5 +38,4 @@ lpm = { workspace = true, features = [] }
 net = { workspace = true, features = ["bolero", "test_buffer"] }
 
 [build-dependencies]
-dotenvy = { workspace = true, features = [] }
-ureq = { workspace = true, features = ["rustls", "gzip"] }
+dpdk-sysroot-helper = { workspace = true }
diff --git a/k8s-intf/build.rs b/k8s-intf/build.rs
index 039653f21..26a3513d7 100644
--- a/k8s-intf/build.rs
+++ b/k8s-intf/build.rs
@@ -1,91 +1,10 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright Open Network Fabric Authors
 
-use std::env;
 use std::fs;
+use std::io::Read;
 use std::path::PathBuf;
 
-fn workspace_root() -> PathBuf {
-    PathBuf::from(env::var("CARGO_MANIFEST_DIR").expect("CARGO_MANIFEST_DIR not set"))
-        .ancestors()
-        .nth(1)
-        .expect("Workspace root not found")
-        .to_path_buf()
-}
-
-fn env_file_name() -> PathBuf {
-    workspace_root().join("scripts").join("k8s-crd.env")
-}
-
-#[derive(Default)]
-struct EnvConfig {
-    version: Option<String>,
-    url: Option<String>,
-    local_path: Option<String>,
-}
-
-fn read_env_config() -> EnvConfig {
-    let env_file_path = env_file_name();
-    let env_file =
-        dotenvy::from_path_iter(env_file_path).expect("Failed to read scripts/k8s-crd.env");
-
-    let mut config = EnvConfig::default();
-    env_file.filter_map(Result::ok).for_each(|(key, value)| {
-        match key.as_str() {
-            "K8S_GATEWAY_AGENT_REF" => {
-                if !value.is_empty() {
-                    config.version = Some(value);
-                }
-            }
-            "K8S_GATEWAY_AGENT_CRD_URL" => {
-                if !value.is_empty() {
-                    config.url = Some(value);
-                }
-            }
-            "K8S_GATEWAY_AGENT_CRD_PATH" => {
-                if !value.is_empty() {
-                    config.local_path = Some(value);
-                }
-            }
-            _ => { /* ignore undeclared variables */ }
-        }
-    });
-
-    // don't set version if we'll build from local crd spec
-    if config.local_path.is_some() {
-        config.version.take();
-    }
-
-    config
-}
-
-fn fetch_crd(url: &str) -> String {
-    println!("cargo:note=Fetching CRD from: {url}");
-    ureq::get(url)
-        .call()
-        .expect("Failed to fetch agent CRD from url")
-        .body_mut()
-        .read_to_string()
-        .expect("Failed to read response body")
-}
-
-fn fetch_crd_from_file(path: &str) -> String {
-    println!("cargo:note=Fetching CRD from file at {path}");
-    match fs::read_to_string(path) {
-        Ok(crd) => crd,
-        Err(e) => panic!("Failed to read CRD from {path}: {e}"),
-    }
-}
-
-const LICENSE_PREAMBLE: &str = "// SPDX-License-Identifier: Apache-2.0
-// Copyright Open Network Fabric Authors
-
-";
-
-fn fixup_signed_types(raw: String) -> String {
-    raw.replace("i64", "u64").replace("i32", "u32")
-}
-
 /// Fixup the types in the generated Rust code
 ///
 /// This is gross, but needed.  OpenAPI v3 does not have any unsigned types
@@ -94,31 +13,26 @@ fn fixup_signed_types(raw: String) -> String {
 ///
 /// By rewriting the types, serde_json used by kube-rs should parse the
 /// json correctly.
+///
+/// TODO: replace this with a proc macro as the text replacement is likely fragile
 fn fixup_types(raw: String) -> String {
-    let raw = fixup_signed_types(raw);
     raw.replace("asn: Option<i32>", "asn: Option<u32>")
-        .replace("workers: Option<u64>", "workers: Option<u8>") // Gateway Go code says this is a u8
+        // This should get both vtep_mtu and plain mtu
+        .replace("mtu: Option<i32>", "mtu: Option<u32>")
+        .replace("vni: Option<i32>", "vni: Option<u32>")
+        .replace("workers: Option<i64>", "workers: Option<u8>") // Gateway Go code says this is a u8
         .replace(
             "idle_timeout: Option<String>",
             "idle_timeout: Option<kube_core::duration::Duration>",
         )
-        .replace(
-            "last_applied_gen: Option<u64>",
-            "last_applied_gen: Option<i64>",
-        )
-    // fixme: we should consider to use u64 for generation Ids?
-}
-
-fn gen_version_const(version: &Option<String>) -> String {
-    let version = version
-        .as_ref()
-        .map(|v| format!("Some(\"{v}\")"))
-        .unwrap_or("None".to_string());
-
-    format!("pub const GW_API_VERSION: Option<&str> = {version};\n\n")
+        .replace("b: Option<i64>", "b: Option<u64>")
+        .replace("d: Option<i64>", "d: Option<u64>")
+        .replace("p: Option<i64>", "p: Option<u64>")
+        .replace("priority: Option<i32>", "priority: Option<u32>")
+        .replace("priority: i32", "priority: u32")
 }
 
-fn generate_rust_for_crd(crd_content: &str, version: &Option<String>) -> String {
+fn generate_rust_for_crd(crd_content: &str) -> String {
     // Run kopium with stdin input
     let mut child = std::process::Command::new("kopium")
         .args(["-D", "PartialEq", "-Af", "-"])
@@ -147,14 +61,13 @@ fn generate_rust_for_crd(crd_content: &str, version: &Option<String>) -> String
 
     let raw = String::from_utf8(output.stdout).expect("Failed to convert kopium output to string");
 
-    LICENSE_PREAMBLE.to_string() + gen_version_const(version).as_str() + &fixup_types(raw)
+    fixup_types(raw)
 }
 
-const GENERATED_OUTPUT_DIR: &str = "src/generated";
-const KOPIUM_OUTPUT_FILE: &str = "gateway_agent_crd.rs";
+const KOPIUM_OUTPUT_FILE: &str = "generated.rs";
 
 fn kopium_output_path() -> PathBuf {
-    PathBuf::from(GENERATED_OUTPUT_DIR).join(KOPIUM_OUTPUT_FILE)
+    PathBuf::from(std::env::var("OUT_DIR").unwrap()).join(KOPIUM_OUTPUT_FILE)
 }
 
 fn code_needs_regen(new_code: &str) -> bool {
@@ -171,45 +84,50 @@ fn code_needs_regen(new_code: &str) -> bool {
     true
 }
 
-fn rerun() {
-    println!("cargo:rerun-if-changed={}", env_file_name().display());
-}
-
 fn main() {
-    rerun();
-
-    // get config from env file
-    let config = read_env_config();
-
-    // get CRD spec from local path or URL
-    let crd_spec = if let Some(agent_crd_file) = config.local_path {
-        fetch_crd_from_file(&agent_crd_file)
-    } else if let Some(agent_crd_url) = config.url {
-        fetch_crd(&agent_crd_url)
-    } else {
-        panic!("No CRD path or URL is set in env file");
+    let agent_crd_contents = {
+        let agent_crd_path =
+            PathBuf::from(std::env::var("GW_CRD_PATH").expect("GW_CRD_PATH var unset"))
+                .join("gwint.githedgehog.com_gatewayagents.yaml");
+        let mut agent_crd_file = std::fs::OpenOptions::new()
+            .read(true)
+            .write(false)
+            .open(&agent_crd_path)
+            .unwrap_or_else(|e| {
+                panic!(
+                    "failed to open {path}: {e}",
+                    path = agent_crd_path.to_str().expect("non unicode crd path")
+                )
+            });
+        let mut contents = String::with_capacity(
+            agent_crd_file
+                .metadata()
+                .expect("unable to get crd metadata")
+                .len() as usize,
+        );
+        agent_crd_file
+            .read_to_string(&mut contents)
+            .unwrap_or_else(|e| panic!("unable to read crd data into string: {e}"));
+        contents
     };
+    let agent_generated_code = generate_rust_for_crd(&agent_crd_contents);
 
-    // CRD spec can't be empty
-    if crd_spec.is_empty() {
-        panic!("Empty CRD specification");
-    }
-
-    // generate rust types from the read crd_spec
-    let agent_generated_code = generate_rust_for_crd(&crd_spec, &config.version);
     if !code_needs_regen(&agent_generated_code) {
         println!("cargo:note=No changes to code generated from CRD");
         return;
     }
 
-    // Write the generated code
-    let output_dir = PathBuf::from(GENERATED_OUTPUT_DIR);
-    fs::create_dir_all(&output_dir).expect("Failed to create output directory");
-
     let output_file = kopium_output_path();
     fs::write(&output_file, agent_generated_code)
         .expect("Failed to write generated agent CRD code");
 
+    let sysroot = dpdk_sysroot_helper::get_sysroot();
+
+    let rerun_if_changed = ["build.rs", sysroot.as_str()];
+    for file in rerun_if_changed {
+        println!("cargo:rerun-if-changed={file}");
+    }
+
     println!(
         "cargo:note=Generated gateway agent CRD types written to {:?}",
         output_file
diff --git a/mgmt/Cargo.toml b/mgmt/Cargo.toml
index 6acefda0d..df54c616d 100644
--- a/mgmt/Cargo.toml
+++ b/mgmt/Cargo.toml
@@ -57,6 +57,7 @@ fixin = { workspace = true }
 id = { workspace = true, features = ["bolero"] }
 interface-manager = { workspace = true, features = ["bolero"] }
 lpm = { workspace = true, features = ["testing"] }
+n-vm = { workspace = true }
 net = { workspace = true, features = ["bolero"] }
 pipeline = { workspace = true }
 routing = { workspace = true, features = ["testing"] }
@@ -66,3 +67,4 @@ test-utils = { workspace = true }
 bolero = { workspace = true, default-features = false, features = ["alloc"] }
 ipnet = { workspace = true }
 pretty_assertions = { workspace = true, features = ["std"] }
+tracing-subscriber = { workspace = true }
diff --git a/mgmt/src/tests/mgmt.rs b/mgmt/src/tests/mgmt.rs
index dbbab1834..8981c1cb9 100644
--- a/mgmt/src/tests/mgmt.rs
+++ b/mgmt/src/tests/mgmt.rs
@@ -4,24 +4,17 @@
 #[cfg(test)]
 #[allow(dead_code)]
 pub mod test {
-    use caps::Capability::CAP_NET_ADMIN;
     use config::external::communities::PriorityCommunityTable;
     use config::external::gwgroup::GwGroup;
     use config::external::gwgroup::GwGroupMember;
     use config::external::gwgroup::GwGroupTable;
 
-    use flow_filter::FlowFilterTableWriter;
     use lpm::prefix::Prefix;
-    use nat::stateful::NatAllocatorWriter;
-    use nat::stateless::NatTablesWriter;
     use net::eth::mac::Mac;
     use net::interface::Mtu;
     use std::net::IpAddr;
     use std::net::Ipv4Addr;
     use std::str::FromStr;
-    use test_utils::with_caps;
-    use tracectl::get_trace_ctl;
-    use tracing::error;
     use tracing_test::traced_test;
 
     use config::external::ExternalConfigBuilder;
@@ -45,17 +38,6 @@ pub mod test {
     use routing::Render;
 
     use crate::processor::confbuild::internal::build_internal_config;
-    use crate::processor::proc::{ConfigProcessor, ConfigProcessorParams};
-    use routing::{Router, RouterParamsBuilder};
-    use tracing::debug;
-
-    use stats::VpcMapName;
-    use stats::VpcStatsStore;
-    use vpcmap::map::VpcMapWriter;
-
-    use concurrency::sync::Arc;
-    use config::internal::status::DataplaneStatus;
-    use tokio::sync::RwLock;
 
     /* OVERLAY config sample builders */
     fn sample_vpc_table() -> VpcTable {
@@ -388,8 +370,10 @@ pub mod test {
         println!("{rendered}");
     }
 
+    /// Test disabled during vm test runner refactor
+    #[cfg(false)]
+    #[n_vm::in_vm]
     #[tokio::test]
-    #[fixin::wrap(with_caps([CAP_NET_ADMIN]))]
     async fn test_sample_config() {
         get_trace_ctl()
             .setup_from_string("cpi=debug,mgmt=debug,routing=debug")
diff --git a/mgmt/tests/reconcile.rs b/mgmt/tests/reconcile.rs
index 24c5f1d72..a48288f73 100644
--- a/mgmt/tests/reconcile.rs
+++ b/mgmt/tests/reconcile.rs
@@ -25,6 +25,7 @@ use test_utils::with_caps;
 use tracing::info;
 use tracing_test::traced_test;
 
+#[n_vm::in_vm]
 #[test]
 #[wrap(with_caps([Capability::CAP_NET_ADMIN]))]
 #[traced_test]
diff --git a/net/src/buffer/test_buffer.rs b/net/src/buffer/test_buffer.rs
index 1b6829a06..f50ba01b6 100644
--- a/net/src/buffer/test_buffer.rs
+++ b/net/src/buffer/test_buffer.rs
@@ -14,16 +14,14 @@ use crate::buffer::{
 };
 use tracing::trace;
 
-// only included for doc ref
-#[cfg(doc)]
-use crate::buffer::PacketBuffer;
-
 // Caution: do not implement Clone for `TestBuffer`.
 // Clone would significantly deviate from the actual mechanics of a DPDK mbuf.
 /// Toy data structure which implements [`PacketBuffer`]
 ///
 /// The core function of this structure is to facilitate testing by "faking" many useful properties
 /// of a real DPDK mbuf (without the need to spin up a full EAL).
+///
+/// [`PacketBuffer`]: crate::buffer::PacketBuffer
 #[derive(Debug, Clone)]
 pub struct TestBuffer {
     buffer: Vec<u8>,
diff --git a/nix/overlays/dataplane-dev.nix b/nix/overlays/dataplane-dev.nix
index e548ef9e8..dd957a603 100644
--- a/nix/overlays/dataplane-dev.nix
+++ b/nix/overlays/dataplane-dev.nix
@@ -7,7 +7,7 @@
 final: prev:
 let
   override-packages = {
-    stdenv = final.llvmPackages.stdenv;
+    stdenv = final.llvmPackages'.stdenv;
     rustPlatform = final.rustPlatform'-dev;
   };
 in
@@ -34,4 +34,16 @@ in
       executable = false;
       destination = "/src/gateway/${p}";
     };
+
+  gdb' = prev.gdb.overrideAttrs (orig: {
+    CFLAGS = "-Os -flto";
+    CXXFLAGS = "-Os -flto";
+    LDFLAGS = "-flto -Wl,--as-needed,--gc-sections -static-libstdc++ -static-libgcc";
+    buildInputs = (orig.buildInputs or [ ]);
+    configureFlags = (orig.configureFlags or [ ]) ++ [
+      "--enable-static"
+      "--disable-inprocess-agent"
+      "--disable-source-highlight" # breaks static compile
+    ];
+  });
 }
diff --git a/nix/overlays/dataplane.nix b/nix/overlays/dataplane.nix
index 45be4326f..41fb03ecf 100644
--- a/nix/overlays/dataplane.nix
+++ b/nix/overlays/dataplane.nix
@@ -3,6 +3,8 @@
 {
   sources,
   sanitizers,
+  platform,
+  profile,
   ...
 }:
 final: prev:
@@ -193,7 +195,13 @@ in
   # Also, while this library has a respectable security track record, this is also a very strong candidate for
   # cfi, safe-stack, and cf-protection.
   fancy.dpdk = dataplane-dep (
-    final.callPackage ../pkgs/dpdk (final.fancy // { src = sources.dpdk; })
+    final.callPackage ../pkgs/dpdk (
+      final.fancy
+      // {
+        inherit platform profile;
+        src = sources.dpdk;
+      }
+    )
   );
 
   # DPDK is largely composed of static-inline functions.
@@ -212,7 +220,7 @@ in
     }
   );
 
-  fancy.libunwind = (dataplane-dep final.llvmPackages.libunwind).override { enableShared = false; };
+  fancy.libunwind = (dataplane-dep final.llvmPackages'.libunwind).override { enableShared = false; };
 
   # TODO: consistent packages, min deps
   fancy.hwloc =
@@ -222,7 +230,7 @@ in
       cudaPackages = null;
       enableCuda = false;
       expat = null;
-      libX11 = null;
+      libx11 = null;
       ncurses = null;
       x11Support = false;
     }).overrideAttrs
@@ -238,7 +246,5 @@ in
       });
 
   # This isn't directly required by dataplane,
-  fancy.perftest = dataplane-dep (
-    final.callPackage ../pkgs/perftest final.fancy // { src = sources.perftest; }
-  );
+  fancy.perftest = dataplane-dep (final.callPackage ../pkgs/perftest { src = sources.perftest; });
 }
diff --git a/nix/overlays/default.nix b/nix/overlays/default.nix
index 19045bb38..4ead96840 100644
--- a/nix/overlays/default.nix
+++ b/nix/overlays/default.nix
@@ -2,13 +2,12 @@
 # Copyright Open Network Fabric Authors
 inputs@{
   sources,
-  platform,
-  profile,
-  sanitizers,
   ...
 }:
 {
+  rust = import sources.rust-overlay;
   llvm = import ./llvm.nix inputs; # requires rust
   dataplane-dev = import ./dataplane-dev.nix inputs; # requires llvm
   dataplane = import ./dataplane.nix inputs; # requires llvm
+  frr = import ./frr.nix inputs; # requires dataplane
 }
diff --git a/nix/overlays/frr.nix b/nix/overlays/frr.nix
new file mode 100644
index 000000000..61a408c68
--- /dev/null
+++ b/nix/overlays/frr.nix
@@ -0,0 +1,159 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright Open Network Fabric Authors
+{
+  sources,
+  sanitizers,
+  platform,
+  profile,
+  ...
+}:
+final: prev:
+let
+  dep = pkg: pkg.override { stdenv = final.stdenv'; };
+  frr-build =
+    frrSrc:
+    (dep (
+      final.callPackage ../pkgs/frr (
+        final.fancy
+        // {
+          stdenv = final.stdenv';
+          inherit frrSrc;
+        }
+      )
+    )).overrideAttrs
+      (orig: {
+        LDFLAGS =
+          (orig.LDFLAGS or "")
+          + " -L${final.fancy.libxcrypt}/lib -lcrypt "
+          + " -L${final.fancy.pcre2}/lib -lpcre2-8 "
+          + " -L${final.fancy.xxHash}/lib -lxxhash ";
+        configureFlags = orig.configureFlags ++ [
+          "--enable-shared"
+          "--enable-static"
+          "--enable-static-bin"
+        ];
+      });
+in
+{
+  fancy = prev.fancy // {
+    xxHash = (dep prev.xxHash).overrideAttrs (orig: {
+      cmakeFlags = (orig.cmakeFlags or [ ]) ++ [
+        "-DBUILD_SHARED_LIBS=OFF"
+        "-DXXH_STATIC_LINKING_ONLY=ON"
+      ];
+    });
+    libyang = (
+      (prev.libyang.override {
+        stdenv = final.stdenv';
+        pcre2 = final.fancy.pcre2;
+        xxHash = final.fancy.xxHash;
+      }).overrideAttrs
+        (orig: {
+          cmakeFlags = (orig.cmakeFlags or [ ]) ++ [ "-DBUILD_SHARED_LIBS=OFF" ];
+          propagatedBuildInputs = [
+            final.fancy.pcre2
+            final.fancy.xxHash
+          ];
+        })
+    );
+    libcap = (
+      (prev.libcap.override {
+        stdenv = final.stdenv';
+        usePam = false;
+        withGo = false;
+      }).overrideAttrs
+        (orig: {
+          doCheck = false; # tests require privileges
+          separateDebugInfo = false;
+          CFLAGS = "-ffat-lto-objects -fsplit-lto-unit";
+          makeFlags = [
+            "lib=lib"
+            "PAM_CAP=no"
+            "CC:=clang"
+            "SHARED=no"
+            "LIBCSTATIC=no"
+            "GOLANG=no"
+          ];
+          configureFlags = (orig.configureFlags or [ ]) ++ [ "--enable-static" ];
+          postInstall = orig.postInstall + ''
+            # extant postInstall removes .a files for no reason
+            cp ./libcap/*.a $lib/lib;
+          '';
+        })
+    );
+    json_c = (
+      (dep prev.json_c).overrideAttrs (orig: {
+        cmakeFlags = (orig.cmakeFlags or [ ]) ++ [
+          "-DENABLE_STATIC=1"
+        ];
+        postInstall = (orig.postInstall or "") + ''
+          mkdir -p $dev/lib
+          $RANLIB libjson-c.a;
+          cp libjson-c.a $out/lib;
+        '';
+      })
+    );
+    rtrlib = dep (
+      prev.rtrlib.overrideAttrs (orig: {
+        cmakeFlags = (orig.cmakeFlags or [ ]) ++ [ "-DENABLE_STATIC=1" ];
+      })
+    );
+    abseil-cpp = dep prev.abseil-cpp;
+    zlib = (
+      prev.zlib.override {
+        stdenv = final.stdenv';
+        static = true;
+        shared = false;
+      }
+    );
+    pcre2 = dep (
+      prev.pcre2.overrideAttrs (orig: {
+        configureFlags = (orig.configureFlags or [ ]) ++ [
+          "--enable-static"
+          "--disable-shared"
+        ];
+      })
+    );
+    ncurses = (
+      prev.ncurses.override {
+        stdenv = final.stdenv';
+        enableStatic = true;
+        withCxx = false;
+      }
+    );
+    readline = (
+      prev.readline.override {
+        stdenv = final.stdenv';
+        ncurses = final.fancy.ncurses;
+      }
+    );
+    libxcrypt = (dep prev.libxcrypt).overrideAttrs (orig: {
+      configureFlags = (orig.configureFlags or [ ]) ++ [
+        "--enable-static"
+        "--disable-shared"
+      ];
+    });
+    libgccjit =
+      (prev.libgccjit.override {
+        # TODO: debug issue preventing clang build
+        # stdenv = final.stdenv';
+        libxcrypt = final.fancy.libxcrypt;
+      }).overrideAttrs
+        (orig: {
+          configureFlags = (orig.configureFlags or [ ]) ++ [
+            "--enable-static"
+            "--disable-shared"
+          ];
+        });
+    c-ares = dep (
+      prev.c-ares.overrideAttrs (orig: {
+        cmakeFlags = (orig.cmakeFlags or [ ]) ++ [
+          "-DCARES_SHARED=OFF"
+          "-DCARES_STATIC=ON"
+        ];
+      })
+    );
+    frr.host = frr-build sources.frr;
+    frr.dataplane = frr-build sources.frr-dp;
+  };
+}
diff --git a/nix/overlays/llvm.nix b/nix/overlays/llvm.nix
index a48cd4267..b82dde347 100644
--- a/nix/overlays/llvm.nix
+++ b/nix/overlays/llvm.nix
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright Open Network Fabric Authors
 {
+  sources,
   platform,
   profile,
   ...
@@ -14,25 +15,45 @@ let
       with builtins; (mapAttrs (var: val: (toString (orig.${var} or "")) + " " + (toString val)) new)
     );
   adapt = final.stdenvAdapters;
-  bintools = final.pkgsBuildHost.llvmPackages.bintools;
-  lld = final.pkgsBuildHost.llvmPackages.lld;
+  bintools = final.pkgsBuildHost.llvmPackages'.bintools;
+  lld = final.pkgsBuildHost.llvmPackages'.lld;
   added-to-env = helpers.addToEnv platform.override.stdenv.env profile;
   stdenv' = adapt.addAttrsToDerivation (orig: {
     doCheck = false;
-    separateDebugInfo = true;
+    # separateDebugInfo = true;
     env = helpers.addToEnv added-to-env (orig.env or { });
     nativeBuildInputs = (orig.nativeBuildInputs or [ ]) ++ [
       bintools
       lld
     ];
-  }) final.llvmPackages.stdenv;
+  }) final.llvmPackages'.stdenv;
   # note: rust-bin comes from oxa's overlay, not nixpkgs.  This overlay only works if you have a rust overlay as well.
-  rust-toolchain = prev.rust-bin.fromRustupToolchainFile ../../rust-toolchain.toml;
-  rustPlatform' = prev.makeRustPlatform {
+  rust-toolchain = final.rust-bin.fromRustupToolchain {
+    channel = sources.rust.version;
+    components = [
+      "rustc"
+      "cargo"
+      "rust-std"
+      "rust-docs"
+      "rustfmt"
+      "clippy"
+      "rust-analyzer"
+      "rust-src"
+    ];
+    targets = [
+      platform.info.target
+    ];
+  };
+  rustPlatform' = final.makeRustPlatform {
     stdenv = stdenv';
     cargo = rust-toolchain;
     rustc = rust-toolchain;
   };
+  rustPlatform'-dev = final.makeRustPlatform {
+    stdenv = final.llvmPackages'.stdenv;
+    cargo = rust-toolchain;
+    rustc = rust-toolchain;
+  };
   # It is essential that we always use the same version of llvm that our rustc is backed by.
   # To minimize maintenance burden, we explicitly compute the version of LLVM we need by asking rustc
   # which version it is using.
@@ -40,11 +61,11 @@ let
   # every time rust updates.
   # Unfortunately, this is also IFD, so it slows down the nix build a bit :shrug:
   llvm-version = builtins.readFile (
-    prev.runCommand "llvm-version-for-our-rustc"
+    final.runCommand "llvm-version-for-our-rustc"
       {
         RUSTC = "${rust-toolchain.out}/bin/rustc";
-        GREP = "${prev.pkgsBuildHost.gnugrep}/bin/grep";
-        SED = "${prev.pkgsBuildHost.gnused}/bin/sed";
+        GREP = "${final.pkgsBuildHost.gnugrep}/bin/grep";
+        SED = "${final.pkgsBuildHost.gnused}/bin/sed";
       }
       ''
         $RUSTC --version --verbose | \
@@ -54,6 +75,11 @@ let
   );
 in
 {
-  inherit rust-toolchain rustPlatform' stdenv';
+  inherit
+    rust-toolchain
+    rustPlatform'
+    rustPlatform'-dev
+    stdenv'
+    ;
   llvmPackages' = prev."llvmPackages_${llvm-version}";
 }
diff --git a/nix/pkgs/dpdk/default.nix b/nix/pkgs/dpdk/default.nix
index 8e41adf26..68f0837c5 100644
--- a/nix/pkgs/dpdk/default.nix
+++ b/nix/pkgs/dpdk/default.nix
@@ -12,17 +12,11 @@
   rdma-core,
   libnl,
   python3,
-  build-params ? {
-    lto = "true";
-    build-type = "release"; # "debug" | "release"
-    platform = "bluefield3";
-  },
   writeText,
 
   platform,
   ...
 }:
-
 stdenv.mkDerivation {
   pname = "dpdk";
   version = src.branch;
@@ -270,19 +264,19 @@ stdenv.mkDerivation {
         cpu = '${cpu}'
         endian = '${endian}'
         [properties]
-        platform = '${build-params.platform}'
+        platform = '${platform.name}'
         libc = '${libc-vendor}'
       '';
     in
-    with build-params;
     [
-      "--buildtype=${build-type}"
-      "-Dauto_features=disabled"
-      "-Db_colorout=never"
-      "-Db_lto=${lto}"
+      "--buildtype=release"
+      "-Db_lto=true"
       "-Db_lundef=false"
       "-Db_pgo=off"
       "-Db_pie=true"
+      "-Dauto_features=disabled"
+      "-Db_colorout=never"
+      "-Db_lundef=false" # normally I would enable undef symbol checks, but it breaks sanitizer builds
       "-Dbackend=ninja"
       "-Ddefault_library=static"
       "-Denable_docs=false"
@@ -290,14 +284,13 @@ stdenv.mkDerivation {
       "-Dmax_numa_nodes=${toString platform.numa.max-nodes}"
       "-Dtests=false" # Running DPDK tests in CI is usually silly
       "-Duse_hpet=false"
-      "-Ddebug=false"
       ''-Ddisable_drivers=${lib.concatStringsSep "," disabledDrivers}''
       ''-Denable_drivers=${lib.concatStringsSep "," enabledDrivers}''
       ''-Denable_libs=${lib.concatStringsSep "," enabledLibs}''
       ''-Ddisable_apps=*''
       ''-Ddisable_libs=${lib.concatStringsSep "," disabledLibs}''
     ]
-    ++ (if isCrossCompile then [ ''--cross-file=${cross-file}'' ] else [ ]);
+    ++ (if isCrossCompile then [ "--cross-file=${cross-file}" ] else [ ]);
 
   outputs = [
     "dev"
diff --git a/nix/pkgs/frr/clippy-helper.nix b/nix/pkgs/frr/clippy-helper.nix
new file mode 100644
index 000000000..384523730
--- /dev/null
+++ b/nix/pkgs/frr/clippy-helper.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  frrSrc,
+
+  # build time
+  autoreconfHook,
+  flex,
+  bison,
+  pkg-config,
+  elfutils,
+  perl,
+  python3Minimal,
+
+}:
+
+stdenv.mkDerivation {
+  pname = "frr-clippy-helper";
+  version = frrSrc.branch;
+  src = frrSrc.outPath;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    bison
+    flex
+    perl
+    pkg-config
+  ];
+
+  buildInputs = [
+    python3Minimal
+  ]
+  ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
+    elfutils
+  ];
+
+  configureFlags = [
+    "--enable-clippy-only"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp lib/clippy $out/bin
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://frrouting.org/";
+    description = "FRR routing daemon suite: CLI helper tool clippy";
+    longDescription = ''
+      This small tool is used to support generating CLI code for FRR. It is split out here,
+      to support cross-compiling, because it needs to be compiled with the build system toolchain
+      and not the target host one.
+    '';
+    license = with licenses; [
+      gpl2Plus
+      lgpl21Plus
+    ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/nix/pkgs/frr/default.nix b/nix/pkgs/frr/default.nix
new file mode 100644
index 000000000..660416e56
--- /dev/null
+++ b/nix/pkgs/frr/default.nix
@@ -0,0 +1,219 @@
+{
+  frrSrc,
+  lib,
+  stdenv,
+
+  # build time
+  autoreconfHook,
+  bison,
+  buildPackages,
+  flex,
+  perl,
+  pkg-config,
+  python3Minimal,
+
+  c-ares,
+  elfutils,
+  json_c,
+  libcap,
+  libxcrypt,
+  libyang,
+  pcre2,
+  readline,
+  rtrlib,
+  # xz,
+  libgccjit,
+
+  # tests
+  nixosTests,
+
+  # other general options besides snmp support
+  numMultipath ? 8,
+
+  # routing daemon options
+  bgpdSupport ? true,
+  bfddSupport ? true,
+  staticdSupport ? true,
+  ospfdSupport ? false,
+  isisdSupport ? false,
+
+  babeldSupport ? false,
+  eigrpdSupport ? false,
+  fabricdSupport ? false,
+  ldpdSupport ? false,
+  nhrpdSupport ? false,
+  ospf6dSupport ? false,
+  pathdSupport ? false,
+  pbrdSupport ? false,
+  pim6dSupport ? false,
+  pimdSupport ? false,
+  ripdSupport ? false,
+  ripngdSupport ? false,
+  sharpdSupport ? false,
+  vrrpdSupport ? false,
+
+  # BGP options
+  bgpAnnounce ? true,
+  bgpBmp ? true,
+  bgpVnc ? false,
+  bgpRpki ? false,
+
+  # OSPF options
+  ospfApi ? false,
+
+  vtysh-extensions ? false,
+
+  ...
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "frr";
+  version = frrSrc.branch;
+  dontPatchShebangs = false;
+  dontFixup = false;
+  dontPatchElf = false;
+
+  outputs = [
+    "out"
+    "build"
+  ];
+
+  src = frrSrc.outPath;
+
+  # Without the std explicitly set, we may run into abseil-cpp
+  # compilation errors.
+  CXXFLAGS = "-std=gnu++23";
+
+  nativeBuildInputs = [
+    autoreconfHook
+    bison
+    elfutils
+    flex
+    perl
+    pkg-config
+    python3Minimal
+  ];
+
+  buildInputs = [
+    c-ares
+    json_c
+    libcap
+    libgccjit
+    libxcrypt
+    libyang
+    pcre2
+    python3Minimal
+    readline
+  ]
+  ++ lib.optionals bgpRpki [ rtrlib ];
+
+  # cross-compiling: clippy is compiled with the build host toolchain, split it out to ease
+  # navigation in dependency hell
+  clippy-helper = buildPackages.callPackage ./clippy-helper.nix {
+    inherit frrSrc;
+  };
+
+  configureFlags = [
+    "--enable-python-runtime"
+    "--enable-fpm=netlink" # try to disable later
+    "--with-moduledir=/lib/frr/modules"
+    # rpath causes confusion in module linking where bmp gets linked to /build (which is broken).
+    # dontPatchElf and dontFixup are both set to false, so nix will adjust to rpath correctly for us after
+    # the initial linking step.
+    "--enable-rpath=no"
+
+    "--enable-configfile-mask=0640"
+    "--enable-logfile-mask=0640"
+    "--enable-user=frr"
+    "--enable-group=frr"
+    "--enable-vty-group=frrvty"
+
+    "--enable-config-rollbacks=no"
+    "--disable-doc"
+    "--disable-doc-html"
+    "--enable-grpc=no"
+    "--enable-protobuf=no"
+    "--enable-scripting=no"
+    "--enable-sysrepo=no"
+    "--enable-zeromq=no"
+
+    "--with-libpam=no"
+
+    "--disable-silent-rules"
+    "--enable-configfile-mask=0640"
+    "--enable-logfile-mask=0640"
+    "--enable-multipath=${toString numMultipath}"
+    "--localstatedir=/run/frr"
+    "--includedir=/include"
+    "--sbindir=/libexec/frr"
+    "--bindir=/bin"
+    "--libdir=/lib"
+    "--prefix=/frr"
+    "--sysconfdir=/etc"
+    "--with-clippy=${finalAttrs.clippy-helper}/bin/clippy"
+    # general options
+    "--enable-irdp=no"
+    "--enable-mgmtd=yes"
+    "--enable-rtadv=yes"
+    "--enable-watchfrr=yes"
+
+    "--enable-shared"
+    "--enable-static"
+    "--enable-static-bin"
+
+    # routing protocols
+    (lib.strings.enableFeature babeldSupport "babeld")
+    (lib.strings.enableFeature bfddSupport "bfdd")
+    (lib.strings.enableFeature bgpdSupport "bgpd")
+    (lib.strings.enableFeature eigrpdSupport "eigrpd")
+    (lib.strings.enableFeature fabricdSupport "fabricd")
+    (lib.strings.enableFeature isisdSupport "isisd")
+    (lib.strings.enableFeature ldpdSupport "ldpd")
+    (lib.strings.enableFeature nhrpdSupport "nhrpd")
+    (lib.strings.enableFeature ospf6dSupport "ospf6d")
+    (lib.strings.enableFeature ospfdSupport "ospfd")
+    (lib.strings.enableFeature pathdSupport "pathd")
+    (lib.strings.enableFeature pbrdSupport "pbrd")
+    (lib.strings.enableFeature pim6dSupport "pim6d")
+    (lib.strings.enableFeature pimdSupport "pimd")
+    (lib.strings.enableFeature ripdSupport "ripd")
+    (lib.strings.enableFeature ripngdSupport "ripngd")
+    (lib.strings.enableFeature sharpdSupport "sharpd")
+    (lib.strings.enableFeature staticdSupport "staticd")
+    (lib.strings.enableFeature vrrpdSupport "vrrpd")
+    # BGP options
+    (lib.strings.enableFeature bgpAnnounce "bgp-announce")
+    (lib.strings.enableFeature bgpBmp "bgp-bmp")
+    (lib.strings.enableFeature bgpRpki "rpki")
+    (lib.strings.enableFeature bgpVnc "bgp-vnc")
+    # OSPF options
+    (lib.strings.enableFeature ospfApi "ospfapi")
+    # Cumulus options
+    "--enable-cumulus=no"
+    "--disable-cumulus"
+  ];
+
+  patches = [
+    ./patches/yang-hack.patch
+    ./patches/xrelifo.py.fix.patch
+  ]
+  ++ lib.optionals vtysh-extensions [
+    ./patches/vtysh-extensions.h.patch
+  ];
+
+  buildPhase = ''
+    make "-j$(nproc)";
+  '';
+
+  installPhase = ''
+    make DESTDIR=$out install;
+    mkdir -p $build/src/
+    cp -r . $build/src/frr
+  '';
+
+  doCheck = false;
+
+  enableParallelBuilding = true;
+
+  passthru.tests = { inherit (nixosTests) frr; };
+})
diff --git a/nix/pkgs/frr/patches/xrelifo.py.fix.patch b/nix/pkgs/frr/patches/xrelifo.py.fix.patch
new file mode 100644
index 000000000..9cd75c208
--- /dev/null
+++ b/nix/pkgs/frr/patches/xrelifo.py.fix.patch
@@ -0,0 +1,22 @@
+Index: python/xrelfo.py
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/python/xrelfo.py b/python/xrelfo.py
+--- a/python/xrelfo.py	(revision Staged)
++++ b/python/xrelfo.py	(date 1745108075027)
+@@ -479,13 +479,9 @@
+         try:
+             xrelfo.load_file(fn)
+         except:
+-            errors += 1
+             sys.stderr.write("while processing %s:\n" % (fn))
+             traceback.print_exc()
+
+-    if xrelfo.note_warn and args.Werror:
+-        errors += 1
+-
+     for option in dir(args):
+         if option.startswith("W") and option != "Werror":
+             checks = sorted(xrelfo.check(args))
diff --git a/nix/pkgs/frr/patches/yang-hack.patch b/nix/pkgs/frr/patches/yang-hack.patch
new file mode 100644
index 000000000..d875cad45
--- /dev/null
+++ b/nix/pkgs/frr/patches/yang-hack.patch
@@ -0,0 +1,17 @@
+Index: configure.ac
+IDEA additional info:
+Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
+<+>UTF-8
+===================================================================
+diff --git a/configure.ac b/configure.ac
+--- a/configure.ac	(revision Staged)
++++ b/configure.ac	(date 1745108464300)
+@@ -2091,8 +2091,6 @@
+   ])
+ ], [[#include <libyang/libyang.h>]])
+
+-AC_CHECK_LIB([yang],[lyd_find_xpath3],[],[AC_MSG_ERROR([m4_normalize([
+-libyang missing lyd_find_xpath3])])])
+ dnl -- don't add lyd_new_list3 to this list unless bug is fixed upstream
+ dnl -- https://github.com/CESNET/libyang/issues/2149
+ AC_CHECK_FUNCS([ly_strerrcode ly_strvecode lyd_trim_xpath])
diff --git a/nix/platforms.nix b/nix/platforms.nix
index b6b54310c..9d8fc92c7 100644
--- a/nix/platforms.nix
+++ b/nix/platforms.nix
@@ -82,6 +82,16 @@ lib.fix (
   final:
   platforms.${platform}
   // {
+    # NOTE: sadly, bluefield2 compiles with the name bluefield in DPDK (for some DPDK specific reason).
+    # That said, we generate the correct cross compile file for bluefield2 (unlike the soc defn
+    # in the dpdk meson.build file, which only goes half way and picks armv8-a instead of 8.2-a, or, better yet
+    # cortex-a72, which is the actual CPU of bluefield 2).
+    # We don't currently expect to meaningfully support BF2, but it is a handy test target for the build tooling.
+    name =
+      {
+        bluefield2 = "bluefield";
+      }
+      .${platform} or platform;
     info =
       {
         x86_64 = {
diff --git a/nix/profiles.nix b/nix/profiles.nix
index 98af3083c..a1eb2766a 100644
--- a/nix/profiles.nix
+++ b/nix/profiles.nix
@@ -27,6 +27,7 @@ let
     "-Cdebuginfo=full"
     "-Cdwarf-version=5"
     "-Csymbol-mangling-version=v0"
+    "-Clink-arg=-Wl,--as-needed,--gc-sections" # FRR builds don't like this, but rust does fine
   ]
   ++ (map (flag: "-Clink-arg=${flag}") common.NIX_CFLAGS_LINK);
   optimize-for.debug.NIX_CFLAGS_COMPILE = [
@@ -50,8 +51,6 @@ let
   ];
   optimize-for.performance.NIX_CFLAGS_LINK = optimize-for.performance.NIX_CXXFLAGS_COMPILE ++ [
     "-Wl,--lto-whole-program-visibility"
-    "-Wl,--gc-sections"
-    "-Wl,--as-needed"
   ];
   optimize-for.performance.RUSTFLAGS = [
     "-Clinker-plugin-lto"
@@ -63,14 +62,14 @@ let
     "-fstack-clash-protection"
     # we always want pic/pie and GOT offsets should be computed at compile time whenever possible
     "-Wl,-z,relro,-z,now"
-    # "-fcf-protection=full" # requires extra testing before we enable
+    "-fcf-protection=full" # requires extra testing before we enable
   ];
   secure.NIX_CXXFLAGS_COMPILE = secure.NIX_CFLAGS_COMPILE;
   # handing the CFLAGS back to clang/lld is basically required for -fsanitize
   secure.NIX_CFLAGS_LINK = secure.NIX_CFLAGS_COMPILE;
   secure.RUSTFLAGS = [
     "-Crelro-level=full"
-    # "-Zcf-protection=full"
+    "-Zcf-protection=full"
   ]
   ++ (map (flag: "-Clink-arg=${flag}") secure.NIX_CFLAGS_LINK);
   march.x86_64.NIX_CFLAGS_COMPILE = [
@@ -215,7 +214,7 @@ let
     builtins.foldl' (
       acc: element: acc // (builtins.mapAttrs (var: val: (acc.${var} or [ ]) ++ val) element)
     ) { } features;
-  profile-map = {
+  profile-map = rec {
     debug = combine-profiles [
       common
       optimize-for.debug
@@ -225,6 +224,7 @@ let
       optimize-for.performance
       secure
     ];
+    fuzz = release;
   };
 in
 combine-profiles (
diff --git a/npins/sources.json b/npins/sources.json
index 1913f4ea6..6c162945f 100644
--- a/npins/sources.json
+++ b/npins/sources.json
@@ -11,10 +11,10 @@
       "version_upper_bound": null,
       "release_prefix": null,
       "submodules": false,
-      "version": "v0.23.0",
-      "revision": "61594d90dab41c2f3cd336baf0a8fcd6c37e0408",
-      "url": "https://api.github.com/repos/ipetkov/crane/tarball/refs/tags/v0.23.0",
-      "hash": "sha256-VFkNyxHxkqGp8gf8kfFMW1j6XeBy609kv6TE9uF/0Js="
+      "version": "v0.23.1",
+      "revision": "fe2df77bce0b8c492a09e34d281f0fb62d1bea43",
+      "url": "https://api.github.com/repos/ipetkov/crane/tarball/refs/tags/v0.23.1",
+      "hash": "sha256-aIlv7FRXF9q70DNJPI237dEDAznSKaXmL5lfK/Id/bI="
     },
     "dpdk": {
       "type": "Git",
@@ -38,9 +38,9 @@
       },
       "branch": "stable/10.5",
       "submodules": false,
-      "revision": "e00528362e9bd6abfe772496db955b4b138d192f",
-      "url": "https://github.com/FRRouting/frr/archive/e00528362e9bd6abfe772496db955b4b138d192f.tar.gz",
-      "hash": "sha256-o6PW5PINy/E5Ou/raat8NswWfxNzAA8Wurv8h/3isEE="
+      "revision": "2152ffef605fe0b7787f762c236f7ea7013f9545",
+      "url": "https://github.com/FRRouting/frr/archive/2152ffef605fe0b7787f762c236f7ea7013f9545.tar.gz",
+      "hash": "sha256-qvYv6osjx9ckYAlFj8gSSval3qkwfHIK2X6PFh0CTkY="
     },
     "frr-dp": {
       "type": "Git",
@@ -66,10 +66,10 @@
       "version_upper_bound": null,
       "release_prefix": null,
       "submodules": false,
-      "version": "v0.38.0",
-      "revision": "039d7d2c7785e47197399c046ad668f958b3091e",
-      "url": "https://api.github.com/repos/githedgehog/gateway/tarball/refs/tags/v0.38.0",
-      "hash": "sha256-3c1OfNRjZNTAHUHUlwnAVUvb12No+XIpeW0UBtto2Tk=",
+      "version": "v0.41.0",
+      "revision": "38ee84275c8f8659ab18976914781c728e64bac2",
+      "url": "https://api.github.com/repos/githedgehog/gateway/tarball/refs/tags/v0.41.0",
+      "hash": "sha256-beZDnd8JDTkT2Hb0BHLDOtrrcCwntbnNwMLH3qk8Gxk=",
       "frozen": true
     },
     "kopium": {
@@ -91,8 +91,8 @@
     "nixpkgs": {
       "type": "Channel",
       "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre934390.48698d12cc10/nixexprs.tar.xz",
-      "hash": "sha256-YpOjLmOGokqTiFjxFu0ioMpMbxHGP6CckfgmqV5OAck="
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre946843.ac055f38c798/nixexprs.tar.xz",
+      "hash": "sha256-erxy9meNKMaKpKQpl8KfhZsVY4EtR4eaHT94jY98Ty0="
     },
     "perftest": {
       "type": "Git",
@@ -131,10 +131,10 @@
       "version_upper_bound": null,
       "release_prefix": null,
       "submodules": false,
-      "version": "1.93.0",
-      "revision": "539f0812230e3e8b7b42bab0ec4317ae3750f568",
-      "url": "https://api.github.com/repos/rust-lang/rust/tarball/refs/tags/1.93.0",
-      "hash": "sha256-Rx4bJh2mjGRhwltKSlh+3c2rWdydazpKR1DuXehxt7k="
+      "version": "1.93.1",
+      "revision": "c302ead9bf59a71b35f3c28350574335b075808b",
+      "url": "https://api.github.com/repos/rust-lang/rust/tarball/refs/tags/1.93.1",
+      "hash": "sha256-p7Q+Do6SkO8UBgjwozsVzTMnD6Jv59dI1HsbYOnCj3E="
     },
     "rust-overlay": {
       "type": "Git",
@@ -145,9 +145,9 @@
       },
       "branch": "master",
       "submodules": false,
-      "revision": "e9bcd12156a577ac4e47d131c14dc0293cc9c8c2",
-      "url": "https://github.com/oxalica/rust-overlay/archive/e9bcd12156a577ac4e47d131c14dc0293cc9c8c2.tar.gz",
-      "hash": "sha256-YNzh46h8fby49yOIB40lNoQ9ucVoXe1bHVwkZ4AwGe0="
+      "revision": "755d3669699a7c62aef35af187d75dc2728cfd85",
+      "url": "https://github.com/oxalica/rust-overlay/archive/755d3669699a7c62aef35af187d75dc2728cfd85.tar.gz",
+      "hash": "sha256-wieWskQxZLPlNXX06JEB0bMoS/ZYQ89xBzF0RL9lyLs="
     }
   },
   "version": 7
diff --git a/routing/Cargo.toml b/routing/Cargo.toml
index 1b4d5d975..0c9c64d79 100644
--- a/routing/Cargo.toml
+++ b/routing/Cargo.toml
@@ -37,7 +37,7 @@ netgauze-bgp-pkt = { workspace = true }
 netgauze-bmp-pkt = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 thiserror = { workspace = true }
-tokio = { workspace = true, features = ["fs", "io-util", "macros", "rt", "sync", "rt", "sync", "net", "macros"] }
+tokio = { workspace = true, features = ["fs", "io-util", "sync", "rt", "net", "macros"] }
 tokio-util = { workspace = true, features = ["codec"] }
 tracing = { workspace = true }
 
@@ -51,4 +51,5 @@ concurrency = { workspace = true }
 lpm = { workspace = true, features = ["testing"] }
 net = { workspace = true, features = ["test_buffer"] }
 rand = { workspace = true, default-features = false, features = ["thread_rng"] }
+tokio = { workspace = true, features = ["full"] }
 tracing-test = { workspace = true, features = [] }
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
deleted file mode 100644
index 63ed2cf8b..000000000
--- a/rust-toolchain.toml
+++ /dev/null
@@ -1,27 +0,0 @@
-[toolchain]
-# NOTE: you can and should manually update this on new rust releases
-channel = "1.93.0"
-
-components = [
-  "rustc",
-  "cargo",
-  "rust-std",
-  "rust-docs",
-  "rustfmt",
-  "clippy",
-  "rust-analyzer",
-  "rust-src",
-
-  ## disabled components ##
-  # "rust-mingw", # not relevant to us
-  # "llvm-tools", # we already have a full llvm in the npins, no need for another
-  # "miri", # not yet functional for us
-  # "rustc-codegen-cranelift-preview" # not relevant to us
-]
-
-targets = [
-  "x86_64-unknown-linux-gnu",
-  "x86_64-unknown-linux-musl",
-  "aarch64-unknown-linux-gnu",
-  "aarch64-unknown-linux-musl"
-]
diff --git a/scripts/doc/custom-header.html b/scripts/doc/custom-header.html
index 70b19946a..daf152fd4 100644
--- a/scripts/doc/custom-header.html
+++ b/scripts/doc/custom-header.html
@@ -49,15 +49,15 @@
     };
 </script>
 
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.27/dist/katex.min.css" integrity="sha384-Pu5+C18nP5dwykLJOhd2U4Xen7rjScHN/qusop27hdd2drI+lL5KvX7YntvT8yew" crossorigin="anonymous" />
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.28/dist/katex.min.css" integrity="sha384-Wsr4Nh3yrvMf2KCebJchRJoVo1gTU6kcP05uRSh5NV3sj9+a8IomuJoQzf3sMq4T" crossorigin="anonymous" />
 
 <!-- The loading of KaTeX is deferred to speed up page rendering -->
-<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.27/dist/katex.min.js" integrity="sha384-2B8pfmZZ6JlVoScJm/5hQfNS2TI/6hPqDZInzzPc8oHpN5SgeNOf4LzREO6p5YtZ" crossorigin="anonymous"></script>
+<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.28/dist/katex.min.js" integrity="sha384-+W9OcrYK2/bD7BmUAk+xeFAyKp0QjyRQUCxeU31dfyTt/FrPsUgaBTLLkVf33qWt" crossorigin="anonymous"></script>
 
 <!-- To automatically render math in text elements, include the auto-render extension: -->
 <script
     defer
-    src="https://cdn.jsdelivr.net/npm/katex@0.16.27/dist/contrib/auto-render.min.js"
+    src="https://cdn.jsdelivr.net/npm/katex@0.16.28/dist/contrib/auto-render.min.js"
     integrity="sha384-hCXGrW6PitJEwbkoStFjeJxv+fSOOQKOPbJxSfM6G5sWZjAyWhXiTIIAmQqnlLlh"
     crossorigin="anonymous"
     onload="katexStuff();"
diff --git a/scripts/installl-real-nix.sh b/scripts/installl-real-nix.sh
new file mode 100644
index 000000000..3a70751a5
--- /dev/null
+++ b/scripts/installl-real-nix.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+if [ -L /nix ]; then
+  echo "fake nix detected, removing"
+  rm /nix
+  echo "installing real nix"
+  sh <(curl --proto '=https' --tlsv1.2 -sSf -L https://nixos.org/nix/install) --no-daemon
+elif  [ -d /nix ]; then
+  echo "real nix detected, nothing to do"
+elif [ -a /nix ]; then
+  echo "/nix exists but is neither directory no symlink, unsure what is happening"
+  exit 99
+else
+  echo "installing real nix"
+  sh <(curl --proto '=https' --tlsv1.2 -sSf -L https://nixos.org/nix/install) --no-daemon
+fi
diff --git a/scripts/rust.env b/scripts/rust.env
index 823c85e94..9e9644e4e 100644
--- a/scripts/rust.env
+++ b/scripts/rust.env
@@ -1,24 +1,5 @@
 RUSTC_BOOTSTRAP=1
-NEXTEST_EXPERIMENTAL_LIBTEST_JSON=1
-LINKER="-C linker=./compile-env/bin/clang -C link-arg=--ld-path=./compile-env/bin/ld.lld"
-RELRO="-C relro-level=full"
-CRT_STATIC="-C target-feature=+crt-static"
-CRT_DYNAMIC="-C target-feature=-crt-static"
-DEBUG="-C debuginfo=full -C split-debuginfo=off -C dwarf-version=5 -Z embed-source"
-DEBUG_ASSERTIONS_ON="-C debug-assertions=on"
-DEBUG_ASSERTIONS_OFF="-C debug-assertions=off"
-OVERFLOW_CHECK_ON="-C overflow-checks=on"
-OVERFLOW_CHECK_OFF="-C overflow-checks=off"
-LTO="-C linker-plugin-lto -C lto=thin -C embed-bitcode=yes -C codegen-units=1"
-COVERAGE="-C instrument-coverage"
-OPTIMIZE_OFF="${DEBUG_ASSERTIONS_ON} ${OVERFLOW_CHECK_ON}"
-OPTIMIZE_ON="-C opt-level=3 ${LTO} ${DEBUG_ASSERTIONS_OFF} ${OVERFLOW_CHECK_OFF}"
-OPTIMIZE_FUZZ="-C opt-level=3 ${LTO} ${DEBUG_ASSERTIONS_ON} ${OVERFLOW_CHECK_ON}"
-TARGET_CPU_DEBUG="-C target-cpu=generic"
-TARGET_CPU_RELEASE="-C target-cpu=x86-64-v3"
-TOKIO_UNSTABLE="--cfg tokio_unstable"
 
-COMMON="${LINKER} ${RELRO} ${DEBUG}"
-RUSTFLAGS_DEBUG="${COMMON} ${OPTIMIZE_OFF} ${TARGET_CPU_DEBUG} ${CRT_DYNAMIC} ${TOKIO_UNSTABLE}"
-RUSTFLAGS_RELEASE="${COMMON} ${OPTIMIZE_ON} ${TARGET_CPU_RELEASE} ${CRT_DYNAMIC} ${TOKIO_UNSTABLE}"
-RUSTFLAGS_FUZZ="${COMMON} ${OPTIMIZE_FUZZ} ${TARGET_CPU_RELEASE} ${CRT_DYNAMIC} ${TOKIO_UNSTABLE}"
+RUSTFLAGS_DEBUG=""
+RUSTFLAGS_RELEASE=""
+RUSTFLAGS_FUZZ=""
diff --git a/scripts/test-runner.sh b/scripts/test-runner.sh
deleted file mode 100755
index 96a1a640c..000000000
--- a/scripts/test-runner.sh
+++ /dev/null
@@ -1,195 +0,0 @@
-#!/bin/bash
-
-# SPDX-License-Identifier: Apache-2.0
-# Copyright Open Network Fabric Authors
-
-# Cargo automatically runs this script for every unit test (this applies to nextest as well).
-# The script has two main responsibilities:
-#
-# 1. It runs `setcap` on the _test binary_ to elevate the test's _permitted_ capabilities.
-#    This action _does not_ cause the tests to run with these capabilities active by default.
-#    That would involve setting the _effective_ capabilities for the test binary (which we don't do).
-#    Instead, assigning the _permitted_ capabilities allows the use of the `caps` crate to allow us to request elevated
-#    permissions for specific sections of test code.
-#
-#    The purpose of these elevated privileges is to allow the tests to create and destroy virtual network interfaces and
-#    network namespaces (as is required for integration testing).
-#
-# 2. It bind mounts the (setcap modified) test binary, the project directory, and a few other files into a (read-only)
-#    docker container (which executes the test).  This docker container contains _only_ libc and libgcc_s (to better
-#    simulate our deployment environment and discourage faulty assumptions about what will be available at runtime).
-#
-#    The purpose of this container is to
-#    * minimize the damage a faulty test might do
-#    * make sure that we aren't relying on resources only available on the developer's machine in the tests (test like
-#      we are in prod).
-#
-# Hopefully, this process also requires us to carefully think about what parts of our code require which privileges (and
-# to document these requirements carefully).  I'm lookin' at you, future me :)
-
-set -euo pipefail
-
-
-get_docker_sock() {
-  declare -r DOCKER_HOST="${DOCKER_HOST:-unix:///var/run/docker.sock}"
-  declare -r without_unix="${DOCKER_HOST##unix://}"
-  if [ -S "${without_unix}" ]; then
-    printf -- '%s' "${without_unix}"
-  elif [ -S /run/docker/docker.sock ]; then
-    printf -- '%s' "/run/docker/docker.sock"
-  elif [ -S /var/run/docker.sock ]; then
-    printf -- '%s' "/var/run/docker.sock"
-  fi
-}
-
-# compute the location of the directory which contains this file.
-declare script_dir
-script_dir="$(readlink -e "$(dirname "${0}")")"
-declare -r script_dir
-
-# compute the location of the directory which contains this project.
-declare project_dir
-project_dir="$(readlink -e "${script_dir}/..")"
-declare -r project_dir
-
-# NOTE: Cargo dispatches this script.
-# Therefore, the PATH variable is set in config.toml to point to our compile-env; not the systems normal PATH.
-# We can't meaningfully ship sudo in the compile-env (for a lot of reasons).
-# It is there, but it won't have the 0 uid owner or its setuid bit set, so it can't work.
-# Even if we fixed that, /etc/sudoers et al. wouldn't be reliably configured.
-# Thus, we need to look it up on the "normal" PATH.  We don't have the official "normal" PATH available, so we check
-# the usual suspects to find sudo.
-declare SUDO
-SUDO="$(PATH="/run/wrappers/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin:${PATH}" which sudo)"
-declare -r SUDO
-
-# Start with a basic check: we have no reason to assign caps to files we don't own or can't execute.
-check_if_reasonable() {
-  declare -r prog="${1}"
-
-  if [ ! -x "${prog}" ]; then
-    >&2 echo "ERROR: ${prog} is not executable"
-    return 1
-  fi
-
-  if [ ! -O "${prog}" ]; then
-    >&2 echo "ERROR: ${prog} is not owned by $(whoami), refusing to edit capabilities"
-    return 1
-  fi
-
-  if [ ! -G "${prog}" ]; then
-    >&2 echo "ERROR: ${prog} is not owned by $(whoami) effective user group, refusing to edit capabilities"
-    return 1
-  fi
-}
-
-
-# some IDEs (e.g., rust-rover) use a helper to run tests / debug sessions.
-# in such cases, the test exe is actually $2 ($1 shouldn't have any special privileges in that case)
-declare test_exe
-if [ -x "${2:-}" ]; then
-  test_exe="${2}"
-else
-  test_exe="${1}"
-fi
-declare -r test_exe
-check_if_reasonable "${test_exe}"
-
-# Pull the current version of the sysroot from the env.
-# This lets us pick the correct libc container.
-source "${script_dir}/dpdk-sys.env"
-
-declare -ra WRAPPED_TEST_SUITES=(
-  "dataplane-interface-manager"
-  "dataplane-mgmt"
-)
-
-declare -i SHOULD_WRAP=0
-declare test_suite
-for test_suite in "${WRAPPED_TEST_SUITES[@]}"; do
-  if [ "${CARGO_PKG_NAME-CARGO_PKG_NAME_NOT_SET}" == "${test_suite}" ]; then
-    SHOULD_WRAP=1
-    break
-  fi
-done
-declare -ri SHOULD_WRAP
-
-# This is the list of capabilities to add to the test binary.
-# Note: do not add =e or =i to this setcap command!  We don't want privileged execution by default.
-# Note: if you adjust this list, then you also need to adjust the symmetric list given to the docker run command.
-declare -r CAPS='cap_net_admin,cap_net_raw,cap_sys_admin,cap_sys_rawio=p'
-
-if [ "${TEST_TYPE:-""}" = "FUZZ" ]; then
-  # In this branch we are running full fuzz tests.
-  # These tests are only run from a just command which has already wrapped this script in a docker container.
-
-  # In the case of the full fuzz tests, libstdc++.so.6 will be linked into the test binary because libfuzzer is an LLVM
-  # project (LLVM is a C++ codebase).
-  # Unfortunately, the combination of bolero's RUSTFLAGS and the nix fenix rust overlay _do not_ set the rpath for
-  # libstdc++.so.6.
-  # As a result, a naive attempt to execute the test binary in the compile-env will result in a file not found error
-  # when the dynamic linker is unable to find libstdc++.so.6.
-  # Fortunately, this is relatively easy to fix; we need to patch the test binary to make sure it resolves to the
-  # exact libstdc++.so.6 file which it was liked against.
-  # If the compile-env is correct, then `/lib/libstdc++.so.6` will always be a symlink to the `/nix` store which
-  # contains the correct dynamic library.
-  patchelf --replace-needed libstdc++.so.6 "$(readlink -e /lib/libstdc++.so.6)" "${test_exe}"
-  # note: we don't need ${SUDO} here (i.e., we can resolve sudo via the $PATH) because this branch only ever happens
-  # when this script is being executed in the compile-env; the compile-env is the only place environment able to execute
-  # the full fuzz tests.
-  sudo setcap "${CAPS}" "${test_exe}"
-  exec "${@}"
-elif [ "${SHOULD_WRAP}" -eq 0 ]; then
-  # In this branch
-  # 1. we are not doing a full fuzz test run,
-  # 2. and we are not running a test which requires a container wrapper.
-  # As a consequence, we should never need to call setcap on the test binary.
-  # We can just run it directly and be done.
-  exec "${@}"
-fi
-
-# If we reached this point then we aren't using the full fuzz test setup.
-# Instead, we are trying to run semi-privileged tests in a libc-container.
-# We still need to add capabilities to the test binary, but in this case we need to make sure we are using the
-# host system's sudo binary.
-"${SUDO}" setcap "${CAPS}" "${test_exe}"
-
-# Now we can run the docker container
-#
-# Notes about this command:
-# * Note that we mount everything we can as read-only
-# * --ipc=host and --pid=host are to allow debuggers to connect to the tests more easily.
-# * We mount $1 in case it is an IDE's helper runner.
-#   If not, then no harm has been done as $1 will be mounted by the project_dir mount anyway.
-# * We drop all caps and then add back just the caps we know we need.
-#   This allows those capabilities into our ambient+inheritable set, letting us elevate to them as needed.
-#   Critically, it _does not_ give us these capabilities by default (i.e., they aren't in our effective set) because
-#   the above setcap command has enumerated exactly what our defaults should be.
-# * If you adjust the list of --cap-add arguments, then you need to adjust the CAPS env var as well.
-docker run \
-  --rm \
-  --interactive \
-  --mount "type=bind,source=$(readlink -e "${1}"),target=$(readlink -e "${1}"),readonly=true,bind-propagation=rprivate" \
-  --mount "type=bind,source=${project_dir},target=${project_dir},readonly=true,bind-propagation=rprivate" \
-  --mount "type=bind,source=${project_dir}/target,target=${project_dir}/target,readonly=false,bind-propagation=rprivate" \
-  --mount "type=bind,source=$(get_docker_sock),target=$(get_docker_sock),readonly=false,bind-propagation=rprivate" \
-  --mount "type=bind,source=/dev/net/tun,target=/dev/net/tun,readonly=false,bind-propagation=rprivate" \
-  --tmpfs "/run/netns:noexec,nosuid,uid=$(id -u),gid=$(id -g)" \
-  --tmpfs "/var/run/netns:noexec,nosuid,uid=$(id -u),gid=$(id -g)" \
-  --tmpfs "/tmp:nodev,noexec,nosuid,uid=$(id -u),gid=$(id -g)" \
-  --user="$(id -u):$(id -g)" \
-  --group-add="$(getent group docker | cut -d: -f3)" \
-  --env LLVM_PROFILE_FILE="${LLVM_PROFILE_FILE:-""}" \
-  --env CARGO_LLVM_COV="${CARGO_LLVM_COV:-0}" \
-  --env CARGO_LLVM_COV_TARGET_DIR="${project_dir}/target" \
-  --workdir="${project_dir}" \
-  --env DOCKER_HOST="unix://$(get_docker_sock)" \
-  --net=none \
-  --cap-drop ALL \
-  --cap-add NET_ADMIN \
-  --cap-add NET_RAW \
-  --cap-add SYS_ADMIN \
-  --cap-add SYS_RAWIO \
-  --read-only \
-  "ghcr.io/githedgehog/dpdk-sys/libc-env:${DPDK_SYS_COMMIT}.${LIBC_ENV_PROFILE:-release}" \
-  "${@}"
diff --git a/scripts/todo.sh b/scripts/todo.sh
new file mode 100755
index 000000000..55be78dd3
--- /dev/null
+++ b/scripts/todo.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+# This script must be run from within a nix shell
+
+# Step 1: check npins
+
+npins verify
+
+# Step 2: build sys and devroot
+
+nix --extra-experimental-features nix-command build -f default.nix devroot --out-link devroot --max-jobs 4
+nix --extra-experimental-features nix-command build -f default.nix sysroot --out-link sysroot --max-jobs 4
+
+# Step 3: build test env (min-tar)
+
+mkdir -p results
+nix --extra-experimental-features nix-command build -f default.nix min-tar --out-link results/min.tar
+# docker import results/min.tar min:release
+
+# Step 4: build dataplane image
+nix --extra-experimental-features nix-command build -f default.nix dataplane-tar --out-link results/dataplane.tar
+# docker import results/dataplane.tar dataplane:debug
+
+# Step 5: cargo build
+
+cargo build
+
+# Step 6: cargo nextest run
+
+cargo nextest run
+
+# Step 7: cargo test run
+
+cargo test
+
+# Step 7: build and run test archive
+
+nix --extra-experimental-features nix-command build -f default.nix tests.all --out-link results/tests.all
+cargo nextest run --archive-file results/tests.all/*.tar.zst --workspace-remap "$(pwd)"
+
+# Step 8: build individual tests archives
+
+nix --extra-experimental-features nix-command build -f default.nix tests.pkg --out-link results/tests.pkg --max-jobs 4
+for pkg in results/tests.pkg/*/*.tar.zst; do
+  # (one test is xfail)
+  cargo nextest run --archive-file "${pkg}" --workspace-remap "$(pwd)" || true
+done
diff --git a/scripts/update-doc-headers.sh b/scripts/update-doc-headers.sh
index 32565ccdc..3398f0361 100755
--- a/scripts/update-doc-headers.sh
+++ b/scripts/update-doc-headers.sh
@@ -5,7 +5,7 @@
 set -euxo pipefail
 
 declare -r MERMAID_VERSION="11.12.2"
-declare -r KATEX_VERSION="0.16.27"
+declare -r KATEX_VERSION="0.16.28"
 
 declare -rx MERMAID_JS_URL="https://cdn.jsdelivr.net/npm/mermaid@${MERMAID_VERSION}/dist/mermaid.min.js"
 declare -rx KATEX_JS_URL="https://cdn.jsdelivr.net/npm/katex@${KATEX_VERSION}/dist/katex.min.js"
diff --git a/shell.nix b/shell.nix
index 112c4b8a4..10acdf45e 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,17 +1,3 @@
-{
-  pkgs ? import <nixpkgs> { },
-}:
-(pkgs.buildFHSEnv {
-  name = "dataplane-shell";
-  targetPkgs =
-    pkgs:
-    (with pkgs; [
-      # dev tools
-      bash
-      direnv
-      just
-      nil
-      nixd
-      wget
-    ]);
-}).env
+# SPDX-License-Identifier: Apache-2.0
+# Copyright Open Network Fabric Authors
+inputs@{...}:(import ./default.nix inputs).devenv
diff --git a/sysfs/Cargo.toml b/sysfs/Cargo.toml
index 0ad73dde9..4c73687c4 100644
--- a/sysfs/Cargo.toml
+++ b/sysfs/Cargo.toml
@@ -22,6 +22,5 @@ n-vm = { workspace = true }
 
 [build-dependencies]
 # internal
-dpdk-sysroot-helper = { workspace = true }
 
 # external
diff --git a/sysfs/build.rs b/sysfs/build.rs
deleted file mode 100644
index 52f5b0197..000000000
--- a/sysfs/build.rs
+++ /dev/null
@@ -1,8 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Copyright Open Network Fabric Authors
-
-fn main() {
-    let sysroot = dpdk_sysroot_helper::get_sysroot();
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
-    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
-}