diff --git a/.cargo/config.toml b/.cargo/config.toml
index 74b272a9..344995e9 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -1,7 +1,5 @@
 [env]
 COMPILE_ENV = { value = "compile-env", relative = true, force = false }
-SYSROOT = { value = "compile-env/sysroot", relative = true, force = false }
-
 PATH = { value = "compile-env/bin", relative = true, force = true }
 LD_LIBRARY_PATH = { value = "compile-env/lib", relative = true, force = true }
 LIBCLANG_PATH = { value = "compile-env/lib", relative = true, force = true }
diff --git a/.github/workflows/build-and-deploy-docs.yml b/.github/workflows/build-and-deploy-docs.yml
index 3325847b..4e42d578 100644
--- a/.github/workflows/build-and-deploy-docs.yml
+++ b/.github/workflows/build-and-deploy-docs.yml
@@ -1,6 +1,11 @@
 name: Build and deploy docs
 
 on:
+  workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: "Run the build with tmate debugging enabled"
   pull_request: { }
   push:
     branches:
@@ -20,8 +25,7 @@ permissions:
 jobs:
   check_changes:
     name: "Deduce required tests from code changes"
-    runs-on:
-      - "lab"
+    runs-on: "ubuntu-latest"
     outputs:
       docs: "${{ steps.changes.outputs.docs }}"
     steps:
@@ -46,10 +50,6 @@ jobs:
               - 'design-docs/**'
               - 'nix/**'
               - '.github/workflows/build-and-deploy-docs.yml'
-      - uses: cargo-bins/cargo-binstall@main
-      - run: cargo binstall --no-confirm just
-      - run: cargo binstall --no-confirm cargo-deny
-      - run: just cargo deny check
 
   build:
     name: "Build and deploy documentation"
@@ -121,3 +121,10 @@ jobs:
           NETLIFY_AUTH_TOKEN: "${{ secrets.NETLIFY_AUTH_TOKEN }}"
           NETLIFY_SITE_ID: "${{ secrets.NETLIFY_SITE_ID }}"
         timeout-minutes: 5
+
+      - name: Setup tmate session for debug
+        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+        uses: mxschmitt/action-tmate@v3
+        timeout-minutes: 60
+        with:
+          limit-access-to-actor: true
diff --git a/.github/workflows/check-developer-experience.yml b/.github/workflows/check-developer-experience.yml
index 4035a477..6e897ef3 100644
--- a/.github/workflows/check-developer-experience.yml
+++ b/.github/workflows/check-developer-experience.yml
@@ -42,8 +42,7 @@ jobs:
         just:
           - version: 1.36.0
     continue-on-error: ${{ matrix.rust.optional }}
-    runs-on:
-      - lab
+    runs-on: "ubuntu-latest"
     timeout-minutes: 45
     steps:
       - name: login to ghcr.io
@@ -97,32 +96,33 @@ jobs:
           just debug=true rust=${{matrix.rust.toolchain}} profile=dev target=x86_64-unknown-linux-musl report
         continue-on-error: ${{ matrix.rust.optional }}
 
-      - run: just cargo +${{matrix.rust.toolchain}} build --locked --profile=release --target=x86_64-unknown-linux-gnu
-        continue-on-error: ${{ matrix.rust.optional }}
-      - name: "tests: rust ${{ matrix.rust.toolchain }} profile=release target=x86_64-unknown-linux-gnu"
-        run: |
-          export GITHUB_STEP_SUMMARY
-          just debug=true rust=${{matrix.rust.toolchain}} profile=release target=x86_64-unknown-linux-gnu test
-          just debug=true rust=${{matrix.rust.toolchain}} profile=release target=x86_64-unknown-linux-gnu report
-        continue-on-error: ${{ matrix.rust.optional }}
+      # - run: just cargo +${{matrix.rust.toolchain}} build --locked --profile=release --target=x86_64-unknown-linux-gnu
+      #   continue-on-error: ${{ matrix.rust.optional }}
+      # - name: "tests: rust ${{ matrix.rust.toolchain }} profile=release target=x86_64-unknown-linux-gnu"
+      #   run: |
+      #     export GITHUB_STEP_SUMMARY
+      #     just debug=true rust=${{matrix.rust.toolchain}} profile=release target=x86_64-unknown-linux-gnu test
+      #     just debug=true rust=${{matrix.rust.toolchain}} profile=release target=x86_64-unknown-linux-gnu report
+      #   continue-on-error: ${{ matrix.rust.optional }}
 
-      - run: just cargo +${{matrix.rust.toolchain}} build --locked --profile=release --target=x86_64-unknown-linux-musl
-        continue-on-error: ${{ matrix.rust.optional }}
-      - name: "tests: rust ${{ matrix.rust.toolchain }} profile=release target=x86_64-unknown-linux-musl"
-        run: |
-          export GITHUB_STEP_SUMMARY
-          just debug=true rust=${{matrix.rust.toolchain}} profile=release target=x86_64-unknown-linux-musl test
-          just debug=true rust=${{matrix.rust.toolchain}} profile=release target=x86_64-unknown-linux-musl report
-        continue-on-error: ${{ matrix.rust.optional }}
+      # - run: just cargo +${{matrix.rust.toolchain}} build --locked --profile=release --target=x86_64-unknown-linux-musl
+      #   continue-on-error: ${{ matrix.rust.optional }}
+      # - name: "tests: rust ${{ matrix.rust.toolchain }} profile=release target=x86_64-unknown-linux-musl"
+      #   run: |
+      #     export GITHUB_STEP_SUMMARY
+      #     just debug=true rust=${{matrix.rust.toolchain}} profile=release target=x86_64-unknown-linux-musl test
+      #     just debug=true rust=${{matrix.rust.toolchain}} profile=release target=x86_64-unknown-linux-musl report
+      #   continue-on-error: ${{ matrix.rust.optional }}
 
       - uses: actions/upload-artifact@v4
         if: ${{ always() }}
         with:
           name: "test-results-${{ matrix.rust.toolchain  }}"
           path: target/nextest/
-#      - name: Setup tmate session for debug
-#        if: ${{ failure() }}
-#        uses: mxschmitt/action-tmate@v3
-#        timeout-minutes: 30
-#        with:
-#          limit-access-to-actor: true
+
+      - name: Setup tmate session for debug
+        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+        uses: mxschmitt/action-tmate@v3
+        timeout-minutes: 30
+        with:
+          limit-access-to-actor: true
diff --git a/.github/workflows/sterile-build-and-test.yml b/.github/workflows/sterile-build-and-test.yml
index 630a7a83..9692ddfe 100644
--- a/.github/workflows/sterile-build-and-test.yml
+++ b/.github/workflows/sterile-build-and-test.yml
@@ -26,8 +26,7 @@ permissions:
 
 jobs:
   test:
-    runs-on:
-      - lab
+    runs-on: "ubuntu-latest"
     strategy:
       fail-fast: false
       matrix:
@@ -35,7 +34,7 @@ jobs:
           - main
         rust:
           - stable
-          - nightly
+          # - nightly
     steps:
       - name: login to ghcr.io
         uses: docker/login-action@v3
@@ -43,10 +42,26 @@ jobs:
           registry: ghcr.io
           username: "${{ github.actor }}"
           password: "${{ secrets.GITHUB_TOKEN }}"
+
+      - uses: cargo-bins/cargo-binstall@main
+
       - name: install just
-        uses: extractions/setup-just@v2
-        with:
-          just-version: ${{env.just}}
+        run: cargo binstall --no-confirm just
+
+      - name: install openssl and libssl-dev (needed for markdown-test-report)
+        if: ${{ always() }}
+        run: |
+          sudo apt-get update
+          sudo apt-get --yes --no-install-recommends install \
+            colorized-logs \
+            libssl-dev \
+            openssl \
+            pkg-config
+
+      - name: install markdown-test-report
+        if: ${{ always() }}
+        run: cargo binstall --no-confirm markdown-test-report
+
       - name: Checkout
         uses: actions/checkout@v4
 
@@ -62,39 +77,27 @@ jobs:
           just rust="${{matrix.rust}}" profile=dev target=x86_64-unknown-linux-musl sterile test
           mkdir dev.musl
           cp -a ./target/nextest dev.musl
-      - name: release/gnu sterile test
-        run: |
-          export GITHUB_STEP_SUMMARY
-          just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-gnu sterile test
-          mkdir release.gnu
-          cp -a ./target/nextest release.gnu
-      - name: release/musl sterile test
-        run: |
-          export GITHUB_STEP_SUMMARY
-          just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-musl sterile test
-          mkdir release.musl
-          cp -a ./target/nextest release.musl
+      #- name: release/gnu sterile test
+      #  run: |
+      #    export GITHUB_STEP_SUMMARY
+      #    just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-gnu sterile test
+      #    mkdir release.gnu
+      #    cp -a ./target/nextest release.gnu
+      #- name: release/musl sterile test
+      #  run: |
+      #    export GITHUB_STEP_SUMMARY
+      #    just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-musl sterile test
+      #    mkdir release.musl
+      #    cp -a ./target/nextest release.musl
 
       # NOTE: we don't even install rust till the sterile tests are done (lowers contamination risk)
       - name: install rust
         uses: dtolnay/rust-toolchain@stable
+        if: ${{ always() }}
         with:
           toolchain: ${{ matrix.rust }}
           targets: x86_64-unknown-linux-gnu,x86_64-unknown-linux-musl
 
-      - uses: cargo-bins/cargo-binstall@main
-
-      - name: install openssl and libssl-dev (needed for markdown-test-report)
-        run: |
-          sudo apt-get update
-          sudo apt-get --yes --no-install-recommends install \
-            colorized-logs \
-            libssl-dev \
-            openssl \
-            pkg-config
-      - name: install markdown-test-report
-        run: cargo binstall --no-confirm markdown-test-report
-
       - name: dev/gnu report
         run: |
           export GITHUB_STEP_SUMMARY
@@ -109,19 +112,19 @@ jobs:
           just rust="${{matrix.rust}}" profile=dev target=x86_64-unknown-linux-musl report
         if: ${{ always() }}
 
-      - name: release/gnu report
-        run: |
-          export GITHUB_STEP_SUMMARY
-          export CARGO_TARGET_DIR=release.gnu
-          just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-gnu report
-        if: ${{ always() }}
+      #- name: release/gnu report
+      #  run: |
+      #    export GITHUB_STEP_SUMMARY
+      #    export CARGO_TARGET_DIR=release.gnu
+      #    just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-gnu report
+      #  if: ${{ always() }}
 
-      - name: release/musl report
-        run: |
-          export GITHUB_STEP_SUMMARY
-          export CARGO_TARGET_DIR=release.musl
-          just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-musl report
-        if: ${{ always() }}
+      #- name: release/musl report
+      #  run: |
+      #    export GITHUB_STEP_SUMMARY
+      #    export CARGO_TARGET_DIR=release.musl
+      #    just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-musl report
+      #  if: ${{ always() }}
 
       - uses: actions/upload-artifact@v4
         if: ${{ always() }}
@@ -137,8 +140,7 @@ jobs:
           limit-access-to-actor: true
 
   push:
-    runs-on:
-      - lab
+    runs-on: "ubuntu-latest"
     strategy:
       fail-fast: false
       matrix:
@@ -146,7 +148,7 @@ jobs:
           - main
         rust:
           - stable
-          - nightly
+          # - nightly
     steps:
       - name: login to ghcr.io
         uses: docker/login-action@v3
@@ -172,11 +174,12 @@ jobs:
       # we want to avoid pushing any container which fails our carg-deny checks
       - run: just cargo deny check
       - run: just rust="${{matrix.rust}}" profile=debug target=x86_64-unknown-linux-gnu push-container
-      - run: just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-gnu push-container
+      # - run: just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-gnu push-container
       - run: just rust="${{matrix.rust}}" profile=debug target=x86_64-unknown-linux-musl push-container
-      - run: just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-musl push-container
+      # - run: just rust="${{matrix.rust}}" profile=release target=x86_64-unknown-linux-musl push-container
+
       - name: Setup tmate session for debug
-        if: ${{ failure() }}
+        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
         uses: mxschmitt/action-tmate@v3
         timeout-minutes: 30
         with:
diff --git a/.github/workflows/update-versions.yml b/.github/workflows/update-versions.yml
index efd4e236..91196aeb 100644
--- a/.github/workflows/update-versions.yml
+++ b/.github/workflows/update-versions.yml
@@ -11,6 +11,12 @@
 name: Update Version
 on:
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: "Run with tmate enabled"
+        required: false
+        default: false
   schedule:
     # Check for updates at 3:18am every day.
     # I avoid midnight because everyone uses midnight and
@@ -58,3 +64,10 @@ jobs:
           commit-message: 'bump dpdk-sys'
           sign-commits: 'true'
           body: 'bump dpdk-sys'
+
+      - name: Setup tmate session for debug
+        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+        uses: mxschmitt/action-tmate@v3
+        timeout-minutes: 60
+        with:
+          limit-access-to-actor: true
diff --git a/Cargo.lock b/Cargo.lock
index cfcad348..3e4457fb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -34,15 +34,15 @@ checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
 
 [[package]]
 name = "anstyle"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8365de52b16c035ff4fcafe0092ba9390540e3e352870ac09933bebcaa2c8c56"
+checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
 
 [[package]]
 name = "anyhow"
-version = "1.0.91"
+version = "1.0.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c042108f3ed77fd83760a5fd79b53be043192bb3b9dba91d8c574c0ada7850c8"
+checksum = "74f37166d7d48a0284b99dd824694c26119c700b53bf0d1540cdb147dbdaaf13"
 
 [[package]]
 name = "arrayvec"
@@ -88,7 +88,7 @@ dependencies = [
  "regex",
  "rustc-hash",
  "shlex",
- "syn 2.0.85",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -208,9 +208,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.1.31"
+version = "1.1.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2e7962b54006dcfcc61cb72735f4d89bb97061dd6a7ed882ec6b8ee53714c6f"
+checksum = "67b9470d453346108f93a59222a9a1a5724db32d0a4727b7ab7ace4b4d822dc9"
 dependencies = [
  "shlex",
 ]
@@ -459,9 +459,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.15.0"
+version = "0.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e087f84d4f86bf4b218b927129862374b72199ae7d8657835f1e89000eea4fb"
+checksum = "3a9bfc1af68b1726ea47d3d5109de126281def866b33970e10fbab11b5dafab3"
 
 [[package]]
 name = "hermit-abi"
@@ -671,7 +671,7 @@ dependencies = [
  "phf_shared",
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -739,7 +739,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "64d1ec885c64d0457d564db4ec299b2dae3f9c02808b8ad9c3a089c591b18033"
 dependencies = [
  "proc-macro2",
- "syn 2.0.85",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -906,7 +906,7 @@ checksum = "de523f781f095e28fa605cdce0f8307e451cc0fd14e2eb4cd2e98a355b147766"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -961,9 +961,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.85"
+version = "2.0.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5023162dfcd14ef8f32034d8bcd4cc5ddc61ef7a247c024a33e24e1f24d21b56"
+checksum = "25aa4ce346d03a6dcd68dd8b4010bcb74e54e62c90c573f394c46eae99aba32d"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1046,7 +1046,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.87",
 ]
 
 [[package]]
@@ -1134,7 +1134,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.87",
  "wasm-bindgen-shared",
 ]
 
@@ -1156,7 +1156,7 @@ checksum = "26c6ab57572f7a24a4985830b120de1594465e5d500f24afe89e16b4e833ef68"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.87",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -1317,5 +1317,5 @@ checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.85",
+ "syn 2.0.87",
 ]
diff --git a/design-docs/src/mdbook/book.toml b/design-docs/src/mdbook/book.toml
index 56359f4f..fef0f441 100644
--- a/design-docs/src/mdbook/book.toml
+++ b/design-docs/src/mdbook/book.toml
@@ -6,7 +6,8 @@ src = "src"
 title = "Hedgehog Dataplane Design Notes"
 
 [preprocessor.plantuml]
-plantuml-cmd = "plantuml"
+#plantuml-cmd = "/lib/openjdk/bin/java -jar /lib/plantuml.jar"
+plantuml-cmd = "/bin/plantuml"
 after = ["links"]
 use-data-uris = false
 
diff --git a/dpdk-sysroot-helper/src/lib.rs b/dpdk-sysroot-helper/src/lib.rs
index 91515643..236c0475 100644
--- a/dpdk-sysroot-helper/src/lib.rs
+++ b/dpdk-sysroot-helper/src/lib.rs
@@ -33,7 +33,8 @@ pub fn get_compile_env() -> String {
 }
 
 pub fn get_sysroot() -> String {
-    let sysroot_env = env::var("SYSROOT").expect("sysroot env not set");
+    let compile_env = env::var("COMPILE_ENV").expect("COMPILE_ENV not set");
+    let sysroot_env = format!("{compile_env}/sysroot");
     let target = get_target_name();
     let profile = get_profile_name();
     let expected_sysroot = format!("{sysroot_env}/{target}/{profile}");
diff --git a/justfile b/justfile
index 14486acf..9735a98d 100644
--- a/justfile
+++ b/justfile
@@ -38,8 +38,7 @@ profile := "dev"
 _container_repo := "ghcr.io/githedgehog/dataplane"
 rust := "stable"
 _dpdk_sys_container_repo := "ghcr.io/githedgehog/dpdk-sys"
-_env_branch := "main"
-_dpdk_sys_container_tag := _env_branch + "-rust-" + rust + "-" + dpdk_sys_commit
+_dpdk_sys_container_tag := dpdk_sys_commit + "-rust-" + rust
 _dev_env_container := _dpdk_sys_container_repo + "/dev-env:" + _dpdk_sys_container_tag
 _doc_env_container := _dpdk_sys_container_repo + "/doc-env:" + _dpdk_sys_container_tag
 _compile_env_container := _dpdk_sys_container_repo + "/compile-env:" + _dpdk_sys_container_tag
@@ -479,7 +478,6 @@ mdbook *args="build":
     cd ./design-docs/src/mdbook
     docker run \
       --rm \
-      -it \
       --init \
       --volume "$(pwd):$(pwd)" \
       --user "$(id -u):$(id -g)" \
diff --git a/scratch/Cargo.toml b/scratch/Cargo.toml
index 5119fd47..f8fd9794 100644
--- a/scratch/Cargo.toml
+++ b/scratch/Cargo.toml
@@ -8,11 +8,10 @@ publish = false
 dpdk-sys = { path = "../dpdk-sys" }
 dpdk = { path = "../dpdk" }
 
+rand = { version = "0.8.5" }
 thiserror = { workspace = true }
 tracing = { workspace = true, features = ["attributes"] }
 tracing-subscriber = { workspace = true }
 
-rand = { version = "0.8" }
-
 [build-dependencies]
 dpdk-sysroot-helper = { path = "../dpdk-sysroot-helper" }
diff --git a/scratch/build.rs b/scratch/build.rs
index 7a28a907..c18a3acb 100644
--- a/scratch/build.rs
+++ b/scratch/build.rs
@@ -5,6 +5,6 @@ fn main() {
     rerun_if_changed.iter().for_each(|file| {
         println!("cargo:rerun-if-changed={file}");
     });
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
+    println!("cargo:rustc-link-search=native={sysroot}/lib");
     println!("cargo:rustc-link-arg=--sysroot={sysroot}");
 }
diff --git a/scripts/dpdk-sys.env b/scripts/dpdk-sys.env
index b38aa5a8..79a0ed77 100644
--- a/scripts/dpdk-sys.env
+++ b/scripts/dpdk-sys.env
@@ -1,2 +1,2 @@
 DPDK_SYS_BRANCH="main"
-DPDK_SYS_COMMIT="02d235e5f259dd591401911b3336f72dea4c824a"
+DPDK_SYS_COMMIT="2617aafa043cdfb9faee3a1db33eb01b3d938c03"