diff --git a/.lycheeignore b/.lycheeignore
index 163c3419baa7..d6c9c0416a99 100644
--- a/.lycheeignore
+++ b/.lycheeignore
@@ -11,6 +11,9 @@
 # Private repos referenced in docs (404 to unauthenticated lychee)
 ^https://github\.com/ai-dynamo/pi-dynamo-provider
 
+# GitHub stargazers page 404s to unauthenticated lychee; loads fine in a browser.
+^https://github\.com/ai-dynamo/dynamo/stargazers
+
 # Redirects to networking-docs.nvidia.com which refuses connections from
 # GitHub runners (network/firewall). The page loads from a normal browser.
 ^https://docs\.nvidia\.com/networking/display/cokan10/network\+operator
diff --git a/container/context.yaml b/container/context.yaml
index 974d57d07662..f4c7f4c5fd1d 100644
--- a/container/context.yaml
+++ b/container/context.yaml
@@ -77,7 +77,7 @@ vllm:
     runtime_image_tag: v0.23.0
     # baseline_sbom: not yet captured for cpu — runtime build runs without subtraction
   flashinf_ref: v0.6.8.post1
-  vllm_omni_ref: "v0.21.0rc1"
+  vllm_omni_ref: "v0.23.0rc1"
   nixl_ref: v1.1.0
   max_jobs: "10"
   enable_media_ffmpeg: "false"
diff --git a/container/deps/vllm/install_vllm_omni.sh b/container/deps/vllm/install_vllm_omni.sh
index 929e9a4821cd..527a25fe7c25 100755
--- a/container/deps/vllm/install_vllm_omni.sh
+++ b/container/deps/vllm/install_vllm_omni.sh
@@ -48,3 +48,44 @@ else
     --constraints "${PROTECTED_CONSTRAINTS}" \
     "vllm-omni==${VLLM_OMNI_VERSION}"
 fi
+
+# Cherry-pick vllm-project/vllm-omni#4568 onto the released wheel.
+#
+# vLLM-Omni globally monkeypatches vllm.v1.request.Request with its OmniRequest
+# subclass at import time, and the test suite imports vllm_omni for collection,
+# so this applies to every vLLM worker in the image -- not just omni modes. In
+# the released v0.23.0rc1, OmniRequest.__init__ still declares `*args` after its
+# named parameters, so vLLM 0.23's positional Request(...) construction misbinds
+# the arguments and EngineCore initialization fails for all vLLM workers. The fix
+# moves `*args` to the front and forwards cleanly. Drop this once a vllm-omni
+# release includes the change.
+# https://github.com/vllm-project/vllm-omni/commit/17cf60a63d240608653c4532084a4c00d6f02216
+VLLM_OMNI_CHERRY_PICK_COMMIT="17cf60a63d240608653c4532084a4c00d6f02216"
+
+omni_site="$(python3 -c 'import importlib.util, os; print(os.path.dirname(os.path.dirname(importlib.util.find_spec("vllm_omni").origin)))')"
+full_patch="$(mktemp /tmp/vllm-omni-commit.XXXXXX.patch)"
+cherry_pick_patch="$(mktemp /tmp/vllm-omni-cherry-pick.XXXXXX.patch)"
+
+curl -fsSL \
+  "https://github.com/vllm-project/vllm-omni/commit/${VLLM_OMNI_CHERRY_PICK_COMMIT}.patch" \
+  -o "${full_patch}"
+# Keep only the vllm_omni/request.py hunk; the commit's new test file is not part
+# of the installed wheel.
+awk '/^diff --git a\/vllm_omni\/request.py/{f=1} f' "${full_patch}" > "${cherry_pick_patch}"
+
+if [ ! -s "${cherry_pick_patch}" ]; then
+  echo "ERROR: could not extract request.py hunk from vllm-omni commit ${VLLM_OMNI_CHERRY_PICK_COMMIT}" >&2
+  exit 1
+fi
+
+if patch -p1 -d "${omni_site}" --forward --dry-run < "${cherry_pick_patch}" >/dev/null 2>&1; then
+  patch -p1 -d "${omni_site}" --forward < "${cherry_pick_patch}"
+  echo "Applied vllm-omni cherry-pick ${VLLM_OMNI_CHERRY_PICK_COMMIT}"
+elif patch -p1 -d "${omni_site}" --reverse --dry-run < "${cherry_pick_patch}" >/dev/null 2>&1; then
+  echo "vllm-omni cherry-pick ${VLLM_OMNI_CHERRY_PICK_COMMIT} already present; skipping"
+else
+  echo "ERROR: vllm-omni cherry-pick ${VLLM_OMNI_CHERRY_PICK_COMMIT} does not apply cleanly to the installed package" >&2
+  exit 1
+fi
+
+rm -f "${full_patch}" "${cherry_pick_patch}"
diff --git a/container/deps/vllm/protected_packages.txt b/container/deps/vllm/protected_packages.txt
index be3421a328f8..4a8af72d55b6 100644
--- a/container/deps/vllm/protected_packages.txt
+++ b/container/deps/vllm/protected_packages.txt
@@ -10,7 +10,7 @@ triton
 vllm
 transformers
 tokenizers
-# vLLM-Omni (v0.21.0rc1) may require a newer safetensors than the upstream
+# vLLM-Omni (v0.23.0rc1) may require a newer safetensors than the upstream
 # vLLM 0.23.0 image ships, so safetensors is intentionally left unfrozen here.
 # safetensors
 msgspec