diff --git a/resources_servers/ifbench/app.py b/resources_servers/ifbench/app.py
index 0f7ec3ee66..e4491fc743 100644
--- a/resources_servers/ifbench/app.py
+++ b/resources_servers/ifbench/app.py
@@ -16,6 +16,12 @@
 import logging
 from typing import List, Literal
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
 from fastapi import FastAPI
 
 from nemo_gym.base_resources_server import (
diff --git a/resources_servers/ifbench/tests/conftest.py b/resources_servers/ifbench/tests/conftest.py
index 31a16678d7..0489e44952 100644
--- a/resources_servers/ifbench/tests/conftest.py
+++ b/resources_servers/ifbench/tests/conftest.py
@@ -13,6 +13,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. This must happen here
+# (before ensure_ifbench() calls _ensure_nltk_data() → import nltk) so that the
+# punkt download inside _ensure_nltk_data() is not silently blocked.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
+
 from resources_servers.ifbench.setup_ifbench import ensure_ifbench
 
 
diff --git a/resources_servers/iheval/app.py b/resources_servers/iheval/app.py
index f263b1b795..3926dddce3 100644
--- a/resources_servers/iheval/app.py
+++ b/resources_servers/iheval/app.py
@@ -82,6 +82,12 @@
 from pathlib import Path
 from typing import Any, Dict, List, Literal, Optional, Tuple
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
 from fastapi import FastAPI
 from pydantic import ConfigDict
 
diff --git a/resources_servers/iheval/requirements.txt b/resources_servers/iheval/requirements.txt
index 97c86a453e..da918ec38f 100644
--- a/resources_servers/iheval/requirements.txt
+++ b/resources_servers/iheval/requirements.txt
@@ -4,4 +4,4 @@ rouge-score>=0.1.2
 # Rule-following: vendored IFEval checkers (ifeval/) depend on these.
 immutabledict>=2.0
 langdetect>=1.0.9
-nltk>=3.9
+nltk>=3.10.0
diff --git a/resources_servers/instruction_following/app.py b/resources_servers/instruction_following/app.py
index cd5441c155..1a2549e925 100644
--- a/resources_servers/instruction_following/app.py
+++ b/resources_servers/instruction_following/app.py
@@ -14,6 +14,12 @@
 # limitations under the License.
 from typing import Any, Dict, List
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
 from fastapi import FastAPI
 from pydantic import model_validator
 from verifiable_instructions import instructions_registry
diff --git a/resources_servers/rolemrc/app.py b/resources_servers/rolemrc/app.py
index d93dfc5baf..8a010a2f0c 100644
--- a/resources_servers/rolemrc/app.py
+++ b/resources_servers/rolemrc/app.py
@@ -42,6 +42,12 @@
 from functools import lru_cache
 from typing import Any, Callable, Dict, List, Literal, Optional, Tuple
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
 from fastapi import FastAPI
 from pydantic import ConfigDict, PrivateAttr
 
diff --git a/resources_servers/rolemrc/requirements.txt b/resources_servers/rolemrc/requirements.txt
index 83640a94ec..5f52b9ab53 100644
--- a/resources_servers/rolemrc/requirements.txt
+++ b/resources_servers/rolemrc/requirements.txt
@@ -2,7 +2,7 @@
 # Reference-metric scoring (reference mode).
 rouge-score>=0.1.2
 sacrebleu>=2.4
-nltk>=3.9
+nltk>=3.10.0
 # BERTScore is on by default in reference mode; pulls a roberta-large checkpoint
 # on first use. Drop these three deps (and set include_bertscore=false) for a
 # lightweight ROUGE/BLEU/METEOR-only install. matplotlib + pillow are declared
diff --git a/resources_servers/toolsandbox/app.py b/resources_servers/toolsandbox/app.py
index 44596e2660..a6b59a9648 100644
--- a/resources_servers/toolsandbox/app.py
+++ b/resources_servers/toolsandbox/app.py
@@ -55,7 +55,13 @@
 import uuid
 from typing import Any, Dict, List, Optional, Tuple
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
 import polars as pl
+import regex  # noqa: F401
 from fastapi import FastAPI, Request
 from openai import NOT_GIVEN
 from openai.types.chat import ChatCompletion