diff --git a/.github/scripts/conan/generate_matrix.py b/.github/scripts/conan/generate_matrix.py
index 7d0b30f28..90beec2a6 100755
--- a/.github/scripts/conan/generate_matrix.py
+++ b/.github/scripts/conan/generate_matrix.py
@@ -3,7 +3,7 @@ import itertools
 import json
 
 LINUX_OS = ["heavy", "heavy-arm64"]
-LINUX_CONTAINERS = ['{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }']
+LINUX_CONTAINERS = ['{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }']
 LINUX_COMPILERS = ["gcc", "clang"]
 
 MACOS_OS = ["macos-26-apple-clang-21"]
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ce919f3c3..fd20ef40c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -47,7 +47,7 @@ jobs:
         os: [heavy]
         compiler: [gcc, clang]
         build_type: [Release, Debug]
-        container: ['{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }']
+        container: ['{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }']
 
         include:
           - os: macos-26-apple-clang-21
@@ -73,7 +73,7 @@ jobs:
     uses: ./.github/workflows/reusable-build.yml
     with:
       runs_on: heavy
-      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
       compiler: gcc
       build_type: Debug
       download_ccache: true
@@ -90,7 +90,7 @@ jobs:
     needs: build-and-test
     runs-on: heavy
     container:
-      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/check-libxrpl.yml b/.github/workflows/check-libxrpl.yml
index b7bbfb27e..3d86e15a3 100644
--- a/.github/workflows/check-libxrpl.yml
+++ b/.github/workflows/check-libxrpl.yml
@@ -21,7 +21,7 @@ jobs:
     name: Build Clio / `libXRPL ${{ github.event.client_payload.version }}`
     runs-on: heavy
     container:
-      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
@@ -76,7 +76,7 @@ jobs:
     needs: build
     runs-on: heavy
     container:
-      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
 
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
diff --git a/.github/workflows/clang-tidy.yml b/.github/workflows/clang-tidy.yml
index 8ed00db90..12120a2ec 100644
--- a/.github/workflows/clang-tidy.yml
+++ b/.github/workflows/clang-tidy.yml
@@ -52,7 +52,7 @@ jobs:
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: heavy
     container:
-      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
 
     permissions:
       contents: write
@@ -63,7 +63,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 909ad0b81..8ce347dc4 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -30,7 +30,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
 
     steps:
       - name: Checkout
@@ -39,7 +39,7 @@ jobs:
           lfs: true
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 9bb8b4176..7ead3b746 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -53,16 +53,16 @@ jobs:
           - os: heavy
             compiler: gcc
             build_type: Release
-            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
           - os: heavy
             compiler: gcc
             build_type: Debug
-            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
           - os: heavy
             compiler: gcc
             sanitizers: undefinedbehavior
             build_type: Release
-            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
 
     uses: ./.github/workflows/reusable-build-test.yml
     with:
@@ -85,7 +85,7 @@ jobs:
     uses: ./.github/workflows/reusable-build.yml
     with:
       runs_on: heavy
-      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
       compiler: gcc
       build_type: Release
       download_ccache: false
@@ -107,7 +107,7 @@ jobs:
         include:
           - os: heavy
             compiler: clang
-            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
           - os: macos-26-apple-clang-21
             compiler: apple-clang
             container: ""
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 8d38d514d..a479307cf 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@f1952595d212e86169935135efc66294b4574131
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
     with:
       runs_on: heavy
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-3e54e7d" }'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2bffe1896..20f193a27 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,7 +39,7 @@ jobs:
           - os: heavy
             compiler: gcc
             build_type: Release
-            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
 
     uses: ./.github/workflows/reusable-build-test.yml
     with:
@@ -60,7 +60,7 @@ jobs:
     uses: ./.github/workflows/reusable-build.yml
     with:
       runs_on: heavy
-      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
       compiler: gcc
       build_type: Release
       download_ccache: false
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index afd8adb98..803f46dfa 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -96,7 +96,7 @@ jobs:
           fetch-depth: 0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: ${{ inputs.download_ccache }}
 
diff --git a/.github/workflows/reusable-publish-package.yml b/.github/workflows/reusable-publish-package.yml
index 8143fb955..324c53c35 100644
--- a/.github/workflows/reusable-publish-package.yml
+++ b/.github/workflows/reusable-publish-package.yml
@@ -29,7 +29,7 @@ jobs:
     name: Publish debian package
     runs-on: heavy
     container:
-      image: ghcr.io/xrplf/xrpld/packaging-debian:sha-b6a8995
+      image: ghcr.io/xrplf/xrpld/packaging-debian:sha-3e54e7d
 
     permissions:
       contents: read
diff --git a/.github/workflows/reusable-release.yml b/.github/workflows/reusable-release.yml
index 62a879157..d5ad7a1a7 100644
--- a/.github/workflows/reusable-release.yml
+++ b/.github/workflows/reusable-release.yml
@@ -46,7 +46,7 @@ jobs:
   release:
     runs-on: heavy
     container:
-      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     env:
       GH_REPO: ${{ github.repository }}
       GH_TOKEN: ${{ github.token }}
@@ -60,7 +60,7 @@ jobs:
           fetch-depth: 0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
diff --git a/.github/workflows/sanitizers.yml b/.github/workflows/sanitizers.yml
index 937756789..c51ff9d95 100644
--- a/.github/workflows/sanitizers.yml
+++ b/.github/workflows/sanitizers.yml
@@ -42,7 +42,7 @@ jobs:
     uses: ./.github/workflows/reusable-build-test.yml
     with:
       runs_on: heavy
-      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
       download_ccache: false
       upload_ccache: false
       compiler: ${{ matrix.compiler }}
diff --git a/.github/workflows/upload-conan-deps.yml b/.github/workflows/upload-conan-deps.yml
index d4e70325b..c49ff4720 100644
--- a/.github/workflows/upload-conan-deps.yml
+++ b/.github/workflows/upload-conan-deps.yml
@@ -75,7 +75,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
diff --git a/conan/init.sh b/conan/init.sh
index 107285424..287ee8300 100755
--- a/conan/init.sh
+++ b/conan/init.sh
@@ -1,25 +1,21 @@
-#!/bin/bash
+#!/usr/bin/env bash
+# Install our Conan configuration, profiles and the xrplf remote into CONAN_HOME.
+# Safe to re-run; never deletes the Conan home.
 
-set -ex
+set -euo pipefail
 
-CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
-PROFILES_SRC_DIR="$CURRENT_DIR/profiles"
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+CONAN_DIR="$(conan config home)"
 
-CONAN_DIR="${CONAN_HOME:-$HOME/.conan2}"
-PROFILES_DIR="$CONAN_DIR/profiles"
-
-rm -rf "$CONAN_DIR"
+echo "Installing Conan configuration into ${CONAN_DIR}"
+conan config install "${SCRIPT_DIR}/global.conf"
+conan config install "${SCRIPT_DIR}/profiles" -tf "${CONAN_DIR}/profiles"
+# This script manages these files, so make them read-only - Conan does not
+# preserve the source mode. Only the files: the directories must stay writable
+# for `conan config install` to replace them.
+chmod a-w "${CONAN_DIR}/global.conf"
+find "${CONAN_DIR}/profiles" -type f -exec chmod a-w {} +
 
+echo "Adding the xrplf Conan remote"
+# --index 0: our patched recipes must win over Conan Center.
 conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
-
-cp "$CURRENT_DIR/global.conf" "$CONAN_DIR/global.conf"
-
-mkdir -p "$PROFILES_DIR"
-
-# The compiler is selected via the `CC`/`CXX` environment variables (see
-# `.github/actions/set-compiler-env`) and the sanitizers via the `SANITIZERS`
-# environment variable. Builds always use the `ci` profile, which includes
-# `sanitizers` and `default`.
-cp "$PROFILES_SRC_DIR/default" "$PROFILES_DIR/default"
-cp "$PROFILES_SRC_DIR/ci" "$PROFILES_DIR/ci"
-cp "$PROFILES_SRC_DIR/sanitizers" "$PROFILES_DIR/sanitizers"
diff --git a/conan/profiles/default b/conan/profiles/default
index ae6e23c3c..1b7eaff98 100644
--- a/conan/profiles/default
+++ b/conan/profiles/default
@@ -1,9 +1,13 @@
 {% set os = detect_api.detect_os() %}
 {% set arch = detect_api.detect_arch() %}
 {% set compiler, version, compiler_exe = detect_api.detect_default_compiler() %}
-{% set compiler_version = version %}
-{% if os == "Linux" %}
 {% set compiler_version = detect_api.default_compiler_version(compiler, version) %}
+{% if os == "Macos" %}
+{# Minimum macOS the dependencies target. #}
+{# Without this, Conan builds each dependency against the (possibly newer) host SDK, so the #}
+{# dependency objects target a newer macOS than the binary and the linker warns. #}
+{# Keep at or below CMAKE_OSX_DEPLOYMENT_TARGET in CMakeLists.txt. #}
+{% set min_macos_version = "15.0" %}
 {% endif %}
 
 [settings]
@@ -18,10 +22,39 @@ compiler.runtime=static
 {% else %}
 compiler.libcxx={{ detect_api.detect_libcxx(compiler, version, compiler_exe) }}
 {% endif %}
+{% if os == "Macos" %}
+os.version={{ min_macos_version }}
+{% endif %}
 
 [conf]
+{# The Boost recipe builds with b2, which doesn't use Conan's toolchain files. #}
+{# Instead it hand-rolls the compiler for user-config.jam, #}
+{# and its fallback probes a version-suffixed binary (e.g. `g++-15`) before plain `g++`. #}
+{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-15` suffix), #}
+{# so on a host that also has a system `g++-15` the probe escapes Nix #}
+{# and picks the system compiler, which is mismatched with the Nix libraries #}
+{# and breaks the build (e.g. Boost.Stacktrace link checks fail). #}
+{# Pinning the executables here short-circuits that probe so Boost (and the rest of the toolchain) #}
+{# resolve the same compiler. #}
+{# Not part of the package ID, so binaries stay shareable. #}
+{% if os != "Windows" %}
+{% set cc_exe  = {"gcc": "gcc",  "clang": "clang",   "apple-clang": "clang"}.get(compiler) %}
+{% set cxx_exe = {"gcc": "g++",  "clang": "clang++", "apple-clang": "clang++"}.get(compiler) %}
+tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
+{% endif %}
+
 {# By default, Conan tries to reuse binaries built with different cppstd versions. #}
 {# We want to avoid that to improve reproduceability, so we add the cppstd version to the package ID. #}
 {# More info: https://docs.conan.io/2/reference/extensions/binary_compatibility.html #}
 user.package:cppstd_version=23
 tools.info.package_id:confs+=["user.package:cppstd_version"]
+
+{% if os == "Macos" %}
+[buildenv]
+{# os.version adds -mmacosx-version-min to compiler command lines, #}
+{# but Boost.Context's b2 assembly (.S) rule ignores it, #}
+{# so those objects keep the host SDK version and still warn at link time. #}
+{# clang's assembler honors this env var regardless, pinning them. #}
+{# Scoped to boost/* since it is the only gap. #}
+boost/*:MACOSX_DEPLOYMENT_TARGET={{ min_macos_version }}
+{% endif %}
diff --git a/docker/develop/compose.yaml b/docker/develop/compose.yaml
index e1b80722f..b3dc529c5 100644
--- a/docker/develop/compose.yaml
+++ b/docker/develop/compose.yaml
@@ -1,6 +1,6 @@
 services:
   clio_develop:
-    image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+    image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     volumes:
       - clio_develop_conan_data:/root/.conan2/p
       - clio_develop_ccache:/root/.ccache
diff --git a/docs/build-clio.md b/docs/build-clio.md
index cfaa79f7e..0ab26398b 100644
--- a/docs/build-clio.md
+++ b/docs/build-clio.md
@@ -175,7 +175,7 @@ Open the `index.html` file in your browser to see the documentation pages.
 It is also possible to build Clio using [Docker](https://www.docker.com/) if you don't want to install all the dependencies on your machine.
 
 ```sh
-docker run -it ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+docker run -it ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
 git clone https://github.com/XRPLF/clio
 cd clio
 ```