diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index dc4ba67d60f0..49dd9fa25350 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,5 +1,5 @@
 {
-  "image": "ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e",
+  "image": "ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896",
   "remoteUser": "ubuntu",
   "privileged": true,
   "runArgs": [
diff --git a/.github/workflows-source/ci-main.yml b/.github/workflows-source/ci-main.yml
index a6cf829243ab..a104d92c6873 100644
--- a/.github/workflows-source/ci-main.yml
+++ b/.github/workflows-source/ci-main.yml
@@ -34,7 +34,7 @@ env:
 
 anchors:
   image: &image
-    image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+    image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
   dind-large-setup: &dind-large-setup
     runs-on:
       labels: dind-large
@@ -233,7 +233,7 @@ jobs:
         with:
           upload-artifacts: ${{ needs.config.outputs.release_build && needs.config.outputs.full_macos_build }}
           BAZEL_COMMAND: ${{ steps.cfg.outputs.build-command }}
-          BAZEL_TARGETS: //rs/... //:upload-artifacts
+          BAZEL_TARGETS: //...
           CLOUD_CREDENTIALS_CONTENT: ${{ secrets.CLOUD_CREDENTIALS_CONTENT }}
           GPG_PASSPHRASE: ''
       - name: Purge Bazel Output
diff --git a/.github/workflows-source/ci-pr-only.yml b/.github/workflows-source/ci-pr-only.yml
index ef79437618c6..5e11039d9e1d 100644
--- a/.github/workflows-source/ci-pr-only.yml
+++ b/.github/workflows-source/ci-pr-only.yml
@@ -17,7 +17,7 @@ env:
 
 anchors:
   image: &image
-    image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+    image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
   dind-small-setup: &dind-small-setup
     timeout-minutes: 30
     runs-on:
@@ -109,7 +109,7 @@ jobs:
     runs-on:
       labels: dind-small
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:994bfcba2fa5efbb52c515bb01e6e8a5828878d6528603e7133fb195bd2a6c89
       options: >-
         -e NODE_NAME
     if: ${{ github.event_name != 'merge_group' }}
diff --git a/.github/workflows-source/release-testing.yml b/.github/workflows-source/release-testing.yml
index 9ae4cd1094a6..c9e021b27856 100644
--- a/.github/workflows-source/release-testing.yml
+++ b/.github/workflows-source/release-testing.yml
@@ -25,7 +25,7 @@ env:
 
 anchors:
   image: &image
-    image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+    image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
   dind-large-setup: &dind-large-setup
     runs-on:
       group: zh1
diff --git a/.github/workflows-source/schedule-daily.yml b/.github/workflows-source/schedule-daily.yml
index c5005055b0ac..dc433feccb20 100644
--- a/.github/workflows-source/schedule-daily.yml
+++ b/.github/workflows-source/schedule-daily.yml
@@ -14,7 +14,7 @@ env:
 
 anchors:
   image: &image
-    image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+    image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
   dind-large-setup: &dind-large-setup
     runs-on:
       group: zh1
diff --git a/.github/workflows-source/schedule-hourly.yml b/.github/workflows-source/schedule-hourly.yml
index 88c60a95adc9..7096113cccb0 100644
--- a/.github/workflows-source/schedule-hourly.yml
+++ b/.github/workflows-source/schedule-hourly.yml
@@ -14,7 +14,7 @@ env:
 
 anchors:
   image: &image
-    image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+    image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
   dind-large-setup: &dind-large-setup
     runs-on:
       labels: dind-large
diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
index 4b1aec89d29b..d658c00818fc 100644
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@@ -106,7 +106,7 @@ jobs:
     name: Bazel Test All
     needs: [config]
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 90
@@ -206,7 +206,7 @@ jobs:
         with:
           upload-artifacts: ${{ needs.config.outputs.release_build && needs.config.outputs.full_macos_build }}
           BAZEL_COMMAND: ${{ steps.cfg.outputs.build-command }}
-          BAZEL_TARGETS: //rs/... //:upload-artifacts
+          BAZEL_TARGETS: //...
           CLOUD_CREDENTIALS_CONTENT: ${{ secrets.CLOUD_CREDENTIALS_CONTENT }}
           GPG_PASSPHRASE: ''
       - name: Purge Bazel Output
@@ -249,7 +249,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 90
@@ -270,7 +270,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 90
@@ -291,7 +291,7 @@ jobs:
     runs-on:
       labels: dind-small
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
     timeout-minutes: 30
     steps:
       - name: Checkout
@@ -322,7 +322,7 @@ jobs:
     needs: [config]
     name: Build IC
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 90
@@ -403,7 +403,7 @@ jobs:
     runs-on:
       labels: dind-small
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
     timeout-minutes: 30
     steps:
       - name: Checkout
@@ -438,7 +438,7 @@ jobs:
     runs-on:
       labels: dind-small
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
     timeout-minutes: 30
     steps:
       - name: Checkout
diff --git a/.github/workflows/ci-pr-only.yml b/.github/workflows/ci-pr-only.yml
index 85db322d9bad..8c9c989f90f6 100644
--- a/.github/workflows/ci-pr-only.yml
+++ b/.github/workflows/ci-pr-only.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME
     if: ${{ github.event_name != 'merge_group' }}
@@ -50,7 +50,7 @@ jobs:
     runs-on:
       labels: dind-small
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME
     if: ${{ github.event_name != 'merge_group' }}
@@ -93,7 +93,7 @@ jobs:
     runs-on:
       labels: dind-small
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:994bfcba2fa5efbb52c515bb01e6e8a5828878d6528603e7133fb195bd2a6c89
       options: >-
         -e NODE_NAME
     if: ${{ github.event_name != 'merge_group' }}
@@ -128,7 +128,7 @@ jobs:
     runs-on:
       labels: dind-small
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME
     if: ${{ github.event_name != 'merge_group' }}
@@ -189,7 +189,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME
     if: contains(github.event.pull_request.labels.*.name, 'CI_COVERAGE')
diff --git a/.github/workflows/pocket-ic-tests-windows.yml b/.github/workflows/pocket-ic-tests-windows.yml
index d70f628b512b..61de00b511fb 100644
--- a/.github/workflows/pocket-ic-tests-windows.yml
+++ b/.github/workflows/pocket-ic-tests-windows.yml
@@ -17,7 +17,7 @@ jobs:
   bazel-build-pocket-ic:
     name: Bazel Build PocketIC
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:994bfcba2fa5efbb52c515bb01e6e8a5828878d6528603e7133fb195bd2a6c89
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 90
diff --git a/.github/workflows/rate-limits-backend-release.yml b/.github/workflows/rate-limits-backend-release.yml
index 09aaf8300a17..b6f87f429f7c 100644
--- a/.github/workflows/rate-limits-backend-release.yml
+++ b/.github/workflows/rate-limits-backend-release.yml
@@ -33,7 +33,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache -v /var/sysimage:/var/sysimage -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info
 
diff --git a/.github/workflows/release-testing.yml b/.github/workflows/release-testing.yml
index 859d43fc4738..06365ee72fd0 100644
--- a/.github/workflows/release-testing.yml
+++ b/.github/workflows/release-testing.yml
@@ -29,7 +29,7 @@ jobs:
       group: zh1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 180 # 3 hours
@@ -51,7 +51,7 @@ jobs:
       group: zh1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 180 # 3 hours
@@ -73,7 +73,7 @@ jobs:
       group: zh1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 90
@@ -95,7 +95,7 @@ jobs:
       group: zh1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 60
@@ -137,7 +137,7 @@ jobs:
       group: zh1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 180 # 3 hours
@@ -165,7 +165,7 @@ jobs:
       group: zh1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 180 # 3 hours
diff --git a/.github/workflows/rosetta-release.yml b/.github/workflows/rosetta-release.yml
index 4c5a9cb38214..8fb2651b69d9 100644
--- a/.github/workflows/rosetta-release.yml
+++ b/.github/workflows/rosetta-release.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
     steps:
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/.github/workflows/salt-sharing-canister-release.yml b/.github/workflows/salt-sharing-canister-release.yml
index 1018dc66c1d7..845e156e0abd 100644
--- a/.github/workflows/salt-sharing-canister-release.yml
+++ b/.github/workflows/salt-sharing-canister-release.yml
@@ -33,7 +33,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache -v /var/sysimage:/var/sysimage -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info
 
diff --git a/.github/workflows/schedule-daily.yml b/.github/workflows/schedule-daily.yml
index 354c5714fc7f..8eba417153a9 100644
--- a/.github/workflows/schedule-daily.yml
+++ b/.github/workflows/schedule-daily.yml
@@ -13,7 +13,7 @@ jobs:
   bazel-test-bare-metal:
     name: Bazel Test Bare Metal
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 120
@@ -62,7 +62,7 @@ jobs:
       group: zh1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 720 # 12 hours
@@ -83,7 +83,7 @@ jobs:
       group: zh1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 20
@@ -104,7 +104,7 @@ jobs:
       group: zh1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 480
@@ -139,7 +139,7 @@ jobs:
       group: zh1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 60
@@ -191,7 +191,7 @@ jobs:
       group: zh1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 120
diff --git a/.github/workflows/schedule-hourly.yml b/.github/workflows/schedule-hourly.yml
index 126f59442c37..037e46231ecd 100644
--- a/.github/workflows/schedule-hourly.yml
+++ b/.github/workflows/schedule-hourly.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 120
@@ -35,7 +35,7 @@ jobs:
   bazel-system-test-hourly:
     name: Bazel System Tests Hourly
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 120
@@ -58,7 +58,7 @@ jobs:
   bazel-run-fuzzers-hourly:
     name: Bazel Run Fuzzers Hourly
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 120
diff --git a/.github/workflows/schedule-rust-bench.yml b/.github/workflows/schedule-rust-bench.yml
index b41e725ac12f..efe04b7f37d9 100644
--- a/.github/workflows/schedule-rust-bench.yml
+++ b/.github/workflows/schedule-rust-bench.yml
@@ -25,7 +25,7 @@ jobs:
       # see linux-x86-64 runner group
       labels: rust-benchmarks
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       # running on bare metal machine using ubuntu user
       options: --user ubuntu -v /cache:/cache
     timeout-minutes: 720 # 12 hours
diff --git a/.github/workflows/schedule-weekly.yml b/.github/workflows/schedule-weekly.yml
index 82c6e7b8741e..6f8a5c195987 100644
--- a/.github/workflows/schedule-weekly.yml
+++ b/.github/workflows/schedule-weekly.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME
         -v /cache:/cache
diff --git a/.github/workflows/system-tests-k8s.yml b/.github/workflows/system-tests-k8s.yml
index 4254e566bbf4..802b2b8ec540 100644
--- a/.github/workflows/system-tests-k8s.yml
+++ b/.github/workflows/system-tests-k8s.yml
@@ -50,7 +50,7 @@ jobs:
       group: ln1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME -e KUBECONFIG
         --privileged --cgroupns host
@@ -106,7 +106,7 @@ jobs:
       group: ln1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME -e KUBECONFIG --privileged --cgroupns host -v /cache:/cache
     timeout-minutes: 150
diff --git a/.github/workflows/update-mainnet-revisions.yaml b/.github/workflows/update-mainnet-revisions.yaml
index 39a9becd3f3e..f701e4ecd0d5 100644
--- a/.github/workflows/update-mainnet-revisions.yaml
+++ b/.github/workflows/update-mainnet-revisions.yaml
@@ -40,7 +40,7 @@ jobs:
       labels: dind-small
     environment: CREATE_PR
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:797497ee4e9e5f06466eafa85cf8882ad9522d4fe27e9d97bfccee98e346065e
+      image: ghcr.io/dfinity/ic-build@sha256:efe6edcd9a9e169843a02f91af98b29514c00cda858ad6612cda28b231b80896
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /cache:/cache -v /var/sysimage:/var/sysimage -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info
     steps:
diff --git a/Cargo.Bazel.Fuzzing.json.lock b/Cargo.Bazel.Fuzzing.json.lock
index 94b4abb8d976..2916e37994ba 100644
--- a/Cargo.Bazel.Fuzzing.json.lock
+++ b/Cargo.Bazel.Fuzzing.json.lock
@@ -1,5 +1,5 @@
 {
-  "checksum": "fe491b00db50f2e4e298fd67fb26c2f45ae7d9644aaed62a538b21e9cb6071a2",
+  "checksum": "1666c88599572f034c9a5dbad33793ff664b87a418f1ae6b6a7937f466551fe3",
   "crates": {
     "abnf 0.12.0": {
       "name": "abnf",
diff --git a/Cargo.Bazel.json.lock b/Cargo.Bazel.json.lock
index 5840cba13902..6817eb4f4206 100644
--- a/Cargo.Bazel.json.lock
+++ b/Cargo.Bazel.json.lock
@@ -1,5 +1,5 @@
 {
-  "checksum": "2a7e3bf92c0b0f1f54f8c9332ecc2357a5c1e4e1b89a0512bb0b22a66b2f240a",
+  "checksum": "0204e2d538f5c1e7ad274285d7b3ec8751cc59ad162fcd7b31dbfc75ccae4354",
   "crates": {
     "abnf 0.12.0": {
       "name": "abnf",
diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel
index 787f7e3ca0ab..6bf2a9ba4bf9 100644
--- a/WORKSPACE.bazel
+++ b/WORKSPACE.bazel
@@ -135,7 +135,7 @@ rust_register_toolchains(
     # The nightly version is required to compile fuzz tests from Bazel.
     # The version below is chosen so that it is in sync with the non-nightly version.
     versions = [
-        "1.86.0",
+        "1.85.1",
         # Use the nightly version from the day before the branch.
         "nightly/2025-03-08",
     ],
diff --git a/ci/container/TAG b/ci/container/TAG
index d6834c440e00..2dc90b5edbe7 100644
--- a/ci/container/TAG
+++ b/ci/container/TAG
@@ -1 +1 @@
-b0af592b06662401f438b8c9a84bf68cdb1a28ab8a534717a43cf00447e62df9
+3426fa29677ab9de5778c28c093194f9a45946bfaa7b910d0fc0bfa893e2a13a
diff --git a/rs/ethereum/ledger-suite-orchestrator/BUILD.bazel b/rs/ethereum/ledger-suite-orchestrator/BUILD.bazel
index b66d0c055d10..1395e61ecf8d 100644
--- a/rs/ethereum/ledger-suite-orchestrator/BUILD.bazel
+++ b/rs/ethereum/ledger-suite-orchestrator/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@rules_rust//cargo:defs.bzl", "cargo_build_script")
 load("@rules_rust//rust:defs.bzl", "rust_doc", "rust_library", "rust_test")
 load("//bazel:canisters.bzl", "rust_canister")
 load("//bazel:defs.bzl", "rust_ic_test")
@@ -100,6 +101,15 @@ rust_test(
     ],
 )
 
+cargo_build_script(
+    name = "build_script",
+    srcs = ["build.rs"],
+    build_script_env = {
+        "IN_BAZEL": "1",
+    },
+    data = ["templates/dashboard.html"],
+)
+
 [
     rust_canister(
         name = "ledger_suite_orchestrator_canister" + name_suffix,
@@ -109,9 +119,6 @@ rust_test(
             "src/dashboard/tests.rs",
             "src/main.rs",
         ],
-        compile_data = [
-            "templates/dashboard.html",
-        ],
         crate_name = "ic_ledger_suite_orchestrator_canister" + name_suffix,
         opt = "z",
         proc_macro_deps = [
@@ -120,6 +127,7 @@ rust_test(
         service_file = "ledger_suite_orchestrator.did",
         deps = [
             # Keep sorted.
+            ":build_script",
             ":ledger_suite_orchestrator" + name_suffix,
             "//packages/ic-http-types",
             "@crate_index//:askama",
diff --git a/rs/ethereum/ledger-suite-orchestrator/build.rs b/rs/ethereum/ledger-suite-orchestrator/build.rs
index 38d18608105b..c74676be9eae 100644
--- a/rs/ethereum/ledger-suite-orchestrator/build.rs
+++ b/rs/ethereum/ledger-suite-orchestrator/build.rs
@@ -1,29 +1,68 @@
 use std::env::{self};
+use std::fs::File;
+use std::io::Write;
 use std::path::PathBuf;
 
 fn main() {
-    let cargo_manifest_dir = PathBuf::from(env::var_os("CARGO_MANIFEST_DIR").unwrap());
-    let compile_time_env_variables = [
-        "LEDGER_CANISTER_WASM_PATH",
-        "INDEX_CANISTER_WASM_PATH",
-        "LEDGER_ARCHIVE_NODE_CANISTER_WASM_PATH",
-    ];
-    for env_var in compile_time_env_variables {
-        let archive_path = match env::var_os(env_var) {
-            Some(wasm_path) => PathBuf::from(wasm_path),
-            None => cargo_manifest_dir
-                // This is a hack.
-                // Cargo is called on CI via ci/src/rust_lint/lint.sh.
-                // The included WASMS binary for ledger, index and archive canisters are built by BAZEL tasks
-                // which would need here to be somehow spawned by Cargo. To avoid this, we just use a wasm binary that
-                // happens to be already checked-in in the repo.
-                .join("../../ledger_suite/icrc1/wasm/ic-icrc1-archive.wasm.gz")
-                .canonicalize()
-                .expect("failed to canonicalize a path"),
-        };
+    if env::var_os("IN_BAZEL").is_none() {
+        let cargo_manifest_dir = PathBuf::from(env::var_os("CARGO_MANIFEST_DIR").unwrap());
+        let compile_time_env_variables = [
+            "LEDGER_CANISTER_WASM_PATH",
+            "INDEX_CANISTER_WASM_PATH",
+            "LEDGER_ARCHIVE_NODE_CANISTER_WASM_PATH",
+        ];
+        for env_var in compile_time_env_variables {
+            let archive_path = match env::var_os(env_var) {
+                Some(wasm_path) => PathBuf::from(wasm_path),
+                None => cargo_manifest_dir
+                    // This is a hack.
+                    // Cargo is called on CI via ci/src/rust_lint/lint.sh.
+                    // The included WASMS binary for ledger, index and archive canisters are built by BAZEL tasks
+                    // which would need here to be somehow spawned by Cargo. To avoid this, we just use a wasm binary that
+                    // happens to be already checked-in in the repo.
+                    .join("../../ledger_suite/icrc1/wasm/ic-icrc1-archive.wasm.gz")
+                    .canonicalize()
+                    .expect("failed to canonicalize a path"),
+            };
 
-        println!("cargo:rerun-if-changed={}", archive_path.display());
-        println!("cargo:rerun-if-env-changed={}", env_var);
-        println!("cargo:rustc-env={}={}", env_var, archive_path.display());
+            println!("cargo:rerun-if-changed={}", archive_path.display());
+            println!("cargo:rerun-if-env-changed={}", env_var);
+            println!("cargo:rustc-env={}={}", env_var, archive_path.display());
+        }
     }
+
+    // Build reproducibility. askama adds a include_bytes! call when it's generating
+    // a template impl so that rustc will recompile the module when the file changes
+    // on disk. See https://github.com/djc/askama/blob/180696053833147a61b3348646a953e7d92ae582/askama_shared/src/generator.rs#L141
+    // The stringified output of every proc-macro is added to the metadata hash for
+    // a crate. That output includes the full filepath to include_bytes!. It may be
+    // different on two machines, if they use different tempdir paths for the build.
+    // The metadata hash is an input to generated symbol names.
+    // So using the askama proc-macro could result in slightly different symbols.
+    // However, if we include the html source directly in the output, no
+    // inconsistency is introduced.
+    //
+    // This should really be fixed in askama. See:
+    // https://github.com/askama-rs/askama/issues/461
+    println!("cargo:rerun-if-changed=templates/dashboard.html");
+    let mut f = File::create(
+        PathBuf::from(std::env::var("OUT_DIR").unwrap()).join("dashboard_template.rs"),
+    )
+    .unwrap();
+    f.write_all(
+        format!(
+            r#"
+#[derive(Template)]
+#[template(escape = "html", source = {:?}, ext = "html")]
+pub struct DashboardTemplate {{
+    managed_canisters: BTreeMap<Erc20Token, CanistersDashboardData>,
+    other_canisters: BTreeMap<String, Vec<CanisterDashboardData>>,
+    wasm_store: Vec<DashboardStoredWasm>,
+}}
+    "#,
+            std::fs::read_to_string("templates/dashboard.html").unwrap()
+        )
+        .as_bytes(),
+    )
+    .unwrap();
 }
diff --git a/rs/ethereum/ledger-suite-orchestrator/src/dashboard/mod.rs b/rs/ethereum/ledger-suite-orchestrator/src/dashboard/mod.rs
index 6a2bd3fc7b21..e89f3cf9f136 100644
--- a/rs/ethereum/ledger-suite-orchestrator/src/dashboard/mod.rs
+++ b/rs/ethereum/ledger-suite-orchestrator/src/dashboard/mod.rs
@@ -43,13 +43,8 @@ mod filters {
     }
 }
 
-#[derive(Template)]
-#[template(path = "dashboard.html")]
-pub struct DashboardTemplate {
-    managed_canisters: BTreeMap<Erc20Token, CanistersDashboardData>,
-    other_canisters: BTreeMap<String, Vec<CanisterDashboardData>>,
-    wasm_store: Vec<DashboardStoredWasm>,
-}
+// See build-canister.rs
+include!(concat!(env!("OUT_DIR"), "/dashboard_template.rs"));
 
 #[derive(Clone, PartialEq, Debug, Default)]
 pub struct CanistersDashboardData {
diff --git a/rs/nns/governance/canbench/canbench_results.yml b/rs/nns/governance/canbench/canbench_results.yml
index c1635a563742..1a785370cdcf 100644
--- a/rs/nns/governance/canbench/canbench_results.yml
+++ b/rs/nns/governance/canbench/canbench_results.yml
@@ -1,153 +1,153 @@
 benches:
   add_neuron_active_maximum_stable:
     total:
-      instructions: 61309494
+      instructions: 59096802
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   add_neuron_active_typical_stable:
     total:
-      instructions: 4393708
+      instructions: 4241546
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   add_neuron_inactive_maximum:
     total:
-      instructions: 61309607
+      instructions: 59096915
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   add_neuron_inactive_typical:
     total:
-      instructions: 4393821
+      instructions: 4241659
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   cascading_vote_stable_everything:
     total:
-      instructions: 110859509
+      instructions: 106436328
       heap_increase: 0
       stable_memory_increase: 128
     scopes: {}
   centralized_following_all_stable:
     total:
-      instructions: 42074044
+      instructions: 41239824
       heap_increase: 0
       stable_memory_increase: 128
     scopes: {}
   compute_ballots_for_new_proposal_with_stable_neurons:
     total:
-      instructions: 1883927
+      instructions: 1811743
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   distribute_rewards_with_stable_neurons:
     total:
-      instructions: 2721444
+      instructions: 2719796
       heap_increase: 0
       stable_memory_increase: 256
     scopes: {}
   draw_maturity_from_neurons_fund_stable:
     total:
-      instructions: 7528856
+      instructions: 7371310
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   list_active_neurons_fund_neurons_stable:
     total:
-      instructions: 2251535
+      instructions: 2208279
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   list_neurons_by_subaccount_stable:
     total:
-      instructions: 66200934
+      instructions: 65094430
       heap_increase: 3
       stable_memory_increase: 0
     scopes: {}
   list_neurons_stable:
     total:
-      instructions: 67580812
+      instructions: 66350224
       heap_increase: 4
       stable_memory_increase: 0
     scopes: {}
   list_proposals:
     total:
-      instructions: 76293
+      instructions: 76392
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   list_ready_to_spawn_neuron_ids_stable:
     total:
-      instructions: 37354868
+      instructions: 36704609
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   neuron_data_validation_stable:
     total:
-      instructions: 203542322
+      instructions: 205253203
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   neuron_metrics_calculation_stable:
     total:
-      instructions: 2722495
+      instructions: 2694578
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   range_neurons_performance:
     total:
-      instructions: 55103800
+      instructions: 54272730
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   single_vote_all_stable:
     total:
-      instructions: 271542
+      instructions: 273775
       heap_increase: 0
       stable_memory_increase: 128
     scopes: {}
   unstake_maturity_of_dissolved_neurons_stable:
     total:
-      instructions: 64537233
+      instructions: 63266688
       heap_increase: 0
       stable_memory_increase: 0
     scopes:
       list_neuron_ids:
-        instructions: 38800841
+        instructions: 38052515
         heap_increase: 0
         stable_memory_increase: 0
       unstake_maturity:
-        instructions: 25734595
+        instructions: 25212382
         heap_increase: 0
         stable_memory_increase: 0
   update_recent_ballots_stable_memory:
     total:
-      instructions: 142807
+      instructions: 139815
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   with_neuron_mut_all_sections_maximum_stable:
     total:
-      instructions: 4414320
+      instructions: 4347082
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   with_neuron_mut_all_sections_typical_stable:
     total:
-      instructions: 855091
+      instructions: 833750
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   with_neuron_mut_main_section_maximum_stable:
     total:
-      instructions: 2440787
+      instructions: 2408666
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
   with_neuron_mut_main_section_typical_stable:
     total:
-      instructions: 410417
+      instructions: 401301
       heap_increase: 0
       stable_memory_increase: 0
     scopes: {}
diff --git a/rs/pocket_ic_server/BUILD.bazel b/rs/pocket_ic_server/BUILD.bazel
index 821171c23112..a396ba5b1b80 100644
--- a/rs/pocket_ic_server/BUILD.bazel
+++ b/rs/pocket_ic_server/BUILD.bazel
@@ -211,11 +211,6 @@ rust_test(
         "requires-network",
         "test_macos",
     ],
-    # We temporarily disable the test on x86_64-darwin because the hyper HTTP client runs into issues on that platform.
-    target_compatible_with = select({
-        "@platforms//os:osx": ["@platforms//cpu:arm64"],
-        "//conditions:default": [],
-    }),
     deps = TEST_DEPENDENCIES,
 )
 
@@ -273,10 +268,5 @@ rust_test(
         "requires-network",
         "test_macos",
     ],
-    # We temporarily disable the test on x86_64-darwin because the hyper HTTP client runs into issues on that platform.
-    target_compatible_with = select({
-        "@platforms//os:osx": ["@platforms//cpu:arm64"],
-        "//conditions:default": [],
-    }),
     deps = TEST_DEPENDENCIES,
 )
diff --git a/rs/sns/init/src/lib.rs b/rs/sns/init/src/lib.rs
index 260a8ff3f1bf..412ae5db4af9 100644
--- a/rs/sns/init/src/lib.rs
+++ b/rs/sns/init/src/lib.rs
@@ -917,7 +917,6 @@ impl SnsInitPayload {
         self.join_validation_results(&validation_fns)
     }
 
-    #[allow(clippy::manual_ok_err)]
     fn join_validation_results(
         &self,
         validation_fns: &[Result<(), String>],
diff --git a/rs/tests/driver/src/driver/constants.rs b/rs/tests/driver/src/driver/constants.rs
index 592ce878850d..6765130f1308 100644
--- a/rs/tests/driver/src/driver/constants.rs
+++ b/rs/tests/driver/src/driver/constants.rs
@@ -1,6 +1,5 @@
 use std::time::Duration;
 
-#[allow(clippy::doc_overindented_list_items)]
 /// New directory structure:
 ///
 /// - dependencies/
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 57a2a3be179d..d9ccfb3fccb8 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,5 +1,5 @@
 [toolchain]
-channel = "1.86.0"
+channel = "1.85.1"
 targets = ["wasm32-unknown-unknown"]
 profile = "default"
 components = ["rls"]