diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 59f574d63f849e49bc81a03d83ba96a51b175c6e..bedfe18c6e75547a6290ae82a4f2dc636e251742 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,12 +4,12 @@ variables:
   ## Application versions used for the main release 
   ## note: nightly builds will always use the master/main branch
   JUGGLER_VERSION: "v9.3.0"
-  EICRECON_VERSION: "v0.6.4"
+  EICRECON_VERSION: "v1.0.0"
 
   ## Spack organization and repository, e.g. spack/spack
   SPACK_ORGREPO: "spack/spack"
   ## Spack github version, e.g. v0.18.1 or commit hash
-  SPACK_VERSION: "v0.19.1"
+  SPACK_VERSION: "v0.19.2"
   ## Space-separated list of spack cherry-picks
   SPACK_CHERRYPICKS: >
     b5ef5c2eb5145020f9de1bcb964626ce6ac2d02e
@@ -21,7 +21,11 @@ variables:
     2f057d729da61e8c12828df44377f0a93fed820f
     39a1f1462b0abf12dfaccd33f84142c852c4b56e
     4b12d015e1c316b4837e02ae37e2c69a8a647180
+    f83d47442dade012b1019840181b8dd459fd8edd
     7f1467e795b1cab8b4855e019910c509896ea0e1
+    ebc24b7063ba9a8eb43b4424aac5143cf958d76f
+    a47ebe57841f13239e881ed69eab4949b1d98c32
+    ab999d5af90f1bff644b5134bb370b2716e1bcf0
     62da76cb5dca4d52c43bee06230cca6a5882f05d
     cc2ae9f270befa554ba8b09c68e89bb8248ea650
     ae98d2ba2fcefa9d027e2d6ccc6e7558a32e7228
@@ -46,7 +50,11 @@ variables:
   ## 2f057d729da61e8c12828df44377f0a93fed820f: py-scipy: add v1.9
   ## 39a1f1462b0abf12dfaccd33f84142c852c4b56e: SIP build system: fix "python not defined in builder"
   ## 4b12d015e1c316b4837e02ae37e2c69a8a647180: py-jinja2-cli: new package
+  ## f83d47442dade012b1019840181b8dd459fd8edd: dd4hep: depends_on root +x +opengl when +utilityapps
   ## 7f1467e795b1cab8b4855e019910c509896ea0e1: dd4hep: new version 1.24, depends_on podio@0.16:
+  ## ebc24b7063ba9a8eb43b4424aac5143cf958d76f: dd4hep: extend conflict on CMake
+  ## a47ebe57841f13239e881ed69eab4949b1d98c32: dd4hep: new versions 1.25, 1.25.1
+  ## ab999d5af90f1bff644b5134bb370b2716e1bcf0: dd4hep: depends_on root +webgui when +ddeve ^root @6.28:
   ## 62da76cb5dca4d52c43bee06230cca6a5882f05d: directives: depends_on should not admit anonymous specs
   ## cc2ae9f270befa554ba8b09c68e89bb8248ea650: Add a "maintainer" directive
   ## ae98d2ba2fcefa9d027e2d6ccc6e7558a32e7228: Support packages for using scitokens on OSG
@@ -197,12 +205,17 @@ version:
 .build:
   rules:
     - when: on_success
-  resource_group: ${CI_COMMIT_REF_NAME}
+  resource_group: ${CI_COMMIT_REF_NAME}-${VERSION}
   tags:
     - docker-new
   before_script:
     - !reference [default, before_script]
-    - docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
+    - mount binfmt_misc -t binfmt_misc /proc/sys/fs/binfmt_misc ;
+      for arch in aarch64 ; do
+        if ! grep --quiet enabled /proc/sys/fs/binfmt_misc/qemu-$arch ; then
+          docker run --rm --privileged multiarch/qemu-user-static --persistent yes ;
+        fi ;
+      done
     - docker buildx create --name builder --driver docker-container --bootstrap --use
 
 ## Images:
@@ -376,10 +389,10 @@ jug_xl:nightly:
                      ${CI_PUSH:+-t ${CI_REGISTRY}/${CI_PROJECT_PATH}/${BUILD_IMAGE}:${NIGHTLY_TAG}}
                      ${DH_PUSH:+-t ${DH_REGISTRY}/${DH_REGISTRY_USER}/${BUILD_IMAGE}:${NIGHTLY_TAG}}
                      ${GH_PUSH:+-t ${GH_REGISTRY}/${GH_REGISTRY_USER}/${BUILD_IMAGE}:${NIGHTLY_TAG}}
-                   }
-                   ${PUSH_NIGHTLY_WITH_DATE:+
-                     ${DH_PUSH:+-t ${DH_REGISTRY}/${DH_REGISTRY_USER}/${NIGHTLY_TAG}-$(date +%Y-%m-%d)}
-                     ${GH_PUSH:+-t ${GH_REGISTRY}/${GH_REGISTRY_USER}/${NIGHTLY_TAG}-$(date +%Y-%m-%d)}
+                     ${PUSH_NIGHTLY_WITH_DATE:+
+                       ${DH_PUSH:+-t ${DH_REGISTRY}/${DH_REGISTRY_USER}/${NIGHTLY_TAG}-$(date +%Y-%m-%d)}
+                       ${GH_PUSH:+-t ${GH_REGISTRY}/${GH_REGISTRY_USER}/${NIGHTLY_TAG}-$(date +%Y-%m-%d)}
+                     }
                    }
                    -f containers/jug/xl.Dockerfile
                    --platform ${PLATFORM}
@@ -427,7 +440,6 @@ jug_xl:feature:
 .singularity:
   stage: deploy
   interruptible: true
-  resource_group: ${CI_COMMIT_REF_NAME}
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
       when: never
@@ -471,25 +483,6 @@ jug_xl:singularity:nightly:
     - mkdir build
     - singularity pull build/${BUILD_IMAGE}.sif docker://${CI_REGISTRY_IMAGE}/${BUILD_IMAGE}:${NIGHTLY_TAG}
 
-## trigger juggler rebuild on nightly schedule to ensure both images remain in sync
-juggler:main:
-  stage: deploy
-  rules:
-    - if: '$NIGHTLY != "0" && $CI_COMMIT_BRANCH == "master"'
-      when: on_success
-    - when: never
-  needs:
-    - version
-    - jug_xl:nightly
-  variables:
-    TRIGGERED_BY_NIGHTLY: 1
-    JUGGLER_VERSION: main
-    DETECTOR_VERSION: master
-    IP6_VERSION: master
-  trigger:
-    project: EIC/juggler
-  allow_failure: true
-
 benchmarks:reconstruction:
   stage: benchmarks
   rules:
@@ -504,7 +497,6 @@ benchmarks:reconstruction:
   trigger:
     project: EIC/benchmarks/reconstruction_benchmarks
     strategy: depend
-  ## for now allow failure, as we need to update those pipelines
   allow_failure: false
   
 benchmarks:physics:
@@ -515,7 +507,7 @@ benchmarks:physics:
     - version
     - jug_xl:default
   variables:
-    RECO: "juggler"
+    RECO: "eicrecon"
     BENCHMARKS_TAG: "$INTERNAL_TAG"
     BENCHMARKS_CONTAINER: "jug_xl"
     BENCHMARKS_REGISTRY: "$CI_REGISTRY_IMAGE"
diff --git a/containers/jug/dev.Dockerfile b/containers/jug/dev.Dockerfile
index 62ea3c87ca33b0601dca2cd6432769d28945f372..98008cf0012b141bc3af1e9397df002f36582bc8 100644
--- a/containers/jug/dev.Dockerfile
+++ b/containers/jug/dev.Dockerfile
@@ -59,7 +59,7 @@ RUN declare -A arch=(                                                   \
 ## Setup spack buildcache mirrors, including an internal
 ## spack mirror using the docker build cache, and
 ## a backup mirror on the internal B010 network
-RUN --mount=type=cache,target=/var/cache/spack-mirror,sharing=locked    \
+RUN --mount=type=cache,target=/var/cache/spack-mirror                   \
     export PATH=$PATH:$SPACK_ROOT/bin                                   \
  && spack mirror add docker /var/cache/spack-mirror                     \
  && spack buildcache update-index -d /var/cache/spack-mirror            \
@@ -68,7 +68,7 @@ RUN --mount=type=cache,target=/var/cache/spack-mirror,sharing=locked    \
 ## Setup eic-spack buildcache mirrors (FIXME: leaks credentials into layer)
 ARG S3_ACCESS_KEY=""
 ARG S3_SECRET_KEY=""
-RUN --mount=type=cache,target=/var/cache/spack-mirror,sharing=locked    \
+RUN --mount=type=cache,target=/var/cache/spack-mirror                   \
     export PATH=$PATH:$SPACK_ROOT/bin                                   \
  && if [ -n "${S3_ACCESS_KEY}" ] ; then                                 \
     spack mirror add --scope site                                       \
diff --git a/spack-environment/dev/spack.yaml b/spack-environment/dev/spack.yaml
index 949e92139396ad03d50f90aca8970043f775a034..00153bf1101274768e62093483e24bd1376377d6 100644
--- a/spack-environment/dev/spack.yaml
+++ b/spack-environment/dev/spack.yaml
@@ -15,7 +15,7 @@ spack:
     - cppcoro@git.10bbcdbf2be3ad3aa56febcf4c7662d771460a99
     - dawn@3_91a
     - dawncut@1_54a
-    - dd4hep@1.24 +ddg4 +ddcad -frames +hepmc3 +lcio
+    - dd4hep@1.25.1 +ddg4 +ddcad +hepmc3 +lcio
     - edm4eic@1.2.2 cxxstd=17
     - edm4hep@0.7 cxxstd=17
     - eic-smear@1.1.10