diff --git a/containers/jug/dev.Dockerfile b/containers/jug/dev.Dockerfile
index 5c143f1840ff6e1ccbc9982d2ce97392f6c6c52c..f53a9d3fd3b8bed68d871db67438327cebe2ed9d 100644
--- a/containers/jug/dev.Dockerfile
+++ b/containers/jug/dev.Dockerfile
@@ -384,6 +384,16 @@ USER 0
 WORKDIR /
 SHELL ["/opt/local/bin/eic-shell"]
 
+## rucio config (unprivileged read-only account)
+COPY <<EOF /opt/rucio/etc/rucio.cfg
+[client]
+rucio_host = https://rucio-server.jlab.org:443
+auth_host = https://rucio-server.jlab.org:443
+auth_type = userpass
+username = eicread
+password = eicread
+EOF
+
 ## eic-news
 COPY --chmod=0755 eic-news /opt/local/bin/eic-news
 RUN echo "test -f $HOME/.eic-news && source /opt/local/bin/eic-news" > /etc/profile.d/z13_eic-news.sh 
diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index 0681ae25ed40f21355e08409168c3371cbc5897f..f700933359d65b4b514b5aefa0bed67553804553 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -40,6 +40,7 @@ spack:
   - gdb
   - geant4 +opengl
   - gfal2
+  - gfal2-util
   - graphviz
   - hepmc3
   - hepmcmerger
@@ -72,6 +73,7 @@ spack:
   - py-boto3
   - py-dask
   - py-deepdiff
+  - py-eic-rucio-policy-package
   - py-epic-capybara
   - py-hepunits
   - py-hist
diff --git a/spack.sh b/spack.sh
index 5f5b74e45bbf14c5be30b6b509bbcdddb5effde4..5aa4a2d836aedb8e9fe371837ad9f4e8eb05edc7 100644
--- a/spack.sh
+++ b/spack.sh
@@ -11,6 +11,7 @@ read -r -d '' SPACK_CHERRYPICKS <<- \
 09f75ee426a2e05e0543570821582480ff823ba5
 b90ac6441cfdf6425cb59551e7b0538899b69527
 8e7641e584563c4859cbef992cd534e75ffd8142
+c50ac5ac25619bdf0b3e75884a893a73e5713e05
 ---
 ## Optional hash table with comma-separated file list
 read -r -d '' SPACK_CHERRYPICKS_FILES <<- \
@@ -21,3 +22,4 @@ read -r -d '' SPACK_CHERRYPICKS_FILES <<- \
 ## 09f75ee426a2e05e0543570821582480ff823ba5: setup-env.sh: if exe contains qemu, use /proc/$$/comm instead
 ## b90ac6441cfdf6425cb59551e7b0538899b69527: celeritas: remove ancient versions and add CUDA package dependency
 ## 8e7641e584563c4859cbef992cd534e75ffd8142: onnx: set CMAKE_CXX_STANDARD to abseil-cpp cxxstd value
+## c50ac5ac25619bdf0b3e75884a893a73e5713e05: py-gfal2-python: new package to fix gfal2-util