diff --git a/.ci/run-container-ci b/.ci/run-container-ci
index 8fd5f0e62..14f5dd320 100755
--- a/.ci/run-container-ci
+++ b/.ci/run-container-ci
@@ -25,7 +25,7 @@
 set -e
 set -x
 
-CONTAINER=shiftcrypto/firmware_v2:41
+CONTAINER=shiftcrypto/firmware_v2:42
 
 if [ "$1" == "pull" ] ; then
 	docker pull "$CONTAINER"
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 21f9435b5..8f6ee69b7 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -224,7 +224,7 @@ configure_file(src/bootloader/bootloader_version.h.in src/bootloader/bootloader_
 string(APPEND CMAKE_C_FLAGS " -std=c11 -pipe")
 if(CMAKE_CROSSCOMPILING)
   set(CMAKE_C_FLAGS "\
-    ${CMAKE_C_FLAGS} -mcpu=cortex-m4 -mthumb -mlong-calls \
+    ${CMAKE_C_FLAGS} -mcpu=cortex-m4 -mthumb -mlong-calls -mno-unaligned-access \
     -mfloat-abi=softfp -mfpu=fpv4-sp-d16 -fomit-frame-pointer -D__SAMD51J20A__ \
     "
   )
@@ -328,10 +328,12 @@ string(APPEND CMAKE_C_FLAGS " -Wno-cast-function-type")
 
 # Hardening
 string(APPEND CMAKE_C_FLAGS " -fstack-protector-all")
-
-# Disallow duplicate definitions, which is the default since GCC
-# 10. It was not default in gcc-arm-none-eabi-8-2018-q4.
-string(APPEND CMAKE_C_FLAGS " -fno-common")
+if(CMAKE_CROSSCOMPILING)
+  # Path to empty dummy libssp and libssp_shared. '-llibssp -llibssp_shared' is automatically added
+  # with '-fstack-protector-all', but we don't need them as we have our own custom
+  # `__stack_chk_fail`. See https://wiki.osdev.org/Stack_Smashing_Protector.
+  set(CMAKE_C_LINK_FLAGS "${CMAKE_C_LINK_FLAGS} -L${CMAKE_CURRENT_SOURCE_DIR}/external/lib/ssp")
+endif()
 
 # For `struct timespec` and `strdup`
 set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -D_XOPEN_SOURCE=600")
diff --git a/Dockerfile b/Dockerfile
index 83c41a8ac..e3973ccac 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,7 @@
 FROM ubuntu:22.04
 ENV DEBIAN_FRONTEND noninteractive
 
-RUN apt-get update && apt-get upgrade -y && apt-get install -y wget nano rsync curl gnupg2 jq unzip bzip2
+RUN apt-get update && apt-get upgrade -y && apt-get install -y wget nano rsync curl gnupg2 jq unzip bzip2 xz-utils
 
 # for clang-*-15, see https://apt.llvm.org/
 RUN echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-18 main" >> /etc/apt/sources.list && \
@@ -27,12 +27,11 @@ RUN echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-18 main" >> /etc/a
 # Install gcc8-arm-none-eabi
 RUN mkdir ~/Downloads &&\
     cd ~/Downloads &&\
-    wget -O gcc.tar.bz2 https://developer.arm.com/-/media/Files/downloads/gnu-rm/8-2018q4/gcc-arm-none-eabi-8-2018-q4-major-linux.tar.bz2?revision=d830f9dd-cd4f-406d-8672-cca9210dd220?product=GNU%20Arm%20Embedded%20Toolchain,64-bit,,Linux,8-2018-q4-major &&\
-    echo "fb31fbdfe08406ece43eef5df623c0b2deb8b53e405e2c878300f7a1f303ee52 gcc.tar.bz2" | sha256sum -c &&\
+    wget -O gcc.tar.xz https://developer.arm.com/-/media/Files/downloads/gnu/13.3.rel1/binrel/arm-gnu-toolchain-13.3.rel1-x86_64-arm-none-eabi.tar.xz &&\
+    echo "95c011cee430e64dd6087c75c800f04b9c49832cc1000127a92a97f9c8d83af4 gcc.tar.xz" | sha256sum -c &&\
     cd ~/Downloads &&\
-    tar -xjvf gcc.tar.bz2 &&\
-    rm -f gcc.tar.bz2 &&\
-    cd ~/Downloads && rsync -a gcc-arm-none-eabi-8-2018-q4-major/ /usr/local/
+    tar -xJvf gcc.tar.xz -C /usr/local --strip-components=1 &&\
+    rm -f gcc.tar.xz
 
 # Tools for building
 RUN apt-get update && apt-get install -y \
diff --git a/external/asf4-drivers/hal/utils/include/utils_assert.h b/external/asf4-drivers/hal/utils/include/utils_assert.h
index 2d4bfc1ef..348b06583 100644
--- a/external/asf4-drivers/hal/utils/include/utils_assert.h
+++ b/external/asf4-drivers/hal/utils/include/utils_assert.h
@@ -44,6 +44,8 @@
 #ifndef _ASSERT_H_INCLUDED
 #define _ASSERT_H_INCLUDED
 
+#undef assert
+
 #ifdef __cplusplus
 extern "C" {
 #endif