diff --git a/devenv/Containerfile.c10s b/devenv/Containerfile.c10s
index 2a2ff70..e66fee2 100644
--- a/devenv/Containerfile.c10s
+++ b/devenv/Containerfile.c10s
@@ -34,7 +34,7 @@ RUN uvversion=$uvversion /run/src/install-uv.sh
 
 FROM base as rust
 # renovate: datasource=custom.rust-nightly depName=rust-nightly versioning=rust-release-channel
-ARG rust_nightly=nightly-2026-04-19
+ARG rust_nightly=nightly-2026-04-26
 COPY install-rust.sh /run/src/
 RUN rust_nightly=$rust_nightly /run/src/install-rust.sh
 
diff --git a/devenv/Containerfile.debian b/devenv/Containerfile.debian
index 5f3be73..b0cffd1 100644
--- a/devenv/Containerfile.debian
+++ b/devenv/Containerfile.debian
@@ -37,7 +37,7 @@ RUN uvversion=$uvversion /run/src/install-uv.sh
 
 FROM base AS rust
 # renovate: datasource=custom.rust-nightly depName=rust-nightly versioning=rust-release-channel
-ARG rust_nightly=nightly-2026-04-19
+ARG rust_nightly=nightly-2026-04-26
 COPY install-rust.sh /run/src/
 RUN rust_nightly=$rust_nightly /run/src/install-rust.sh
 
diff --git a/devenv/Containerfile.ubuntu b/devenv/Containerfile.ubuntu
index 08caa46..11488f8 100644
--- a/devenv/Containerfile.ubuntu
+++ b/devenv/Containerfile.ubuntu
@@ -1,6 +1,6 @@
 # These aren't packages, just low-dependency binaries dropped in /usr/local/bin
 # so we can fetch them independently in a separate build.
-ARG base=docker.io/library/ubuntu:24.04
+ARG base=docker.io/library/ubuntu:26.04
 FROM $base AS base
 # Life is too short to care about dash
 RUN ln -sfr /bin/bash /bin/sh
@@ -49,7 +49,7 @@ RUN uvversion=$uvversion /run/src/install-uv.sh
 
 FROM base AS rust
 # renovate: datasource=custom.rust-nightly depName=rust-nightly versioning=rust-release-channel
-ARG rust_nightly=nightly-2026-04-19
+ARG rust_nightly=nightly-2026-04-26
 COPY install-rust.sh /run/src/
 RUN rust_nightly=$rust_nightly /run/src/install-rust.sh
 
@@ -71,6 +71,11 @@ set -xeuo pipefail
 # skopeo is currently older in plucky for some reason hence --allow-downgrades
 /bin/time -f '%E %C' apt -y install --allow-downgrades crun/plucky podman/plucky skopeo/plucky just
 grep -hEve '^#' packages-common.txt packages-ubuntu.txt | /bin/time -f '%E %C' xargs apt -y install
+# qemu-kvm is a virtual package on Ubuntu 26.04 with multiple providers; select by arch
+case $(dpkg --print-architecture) in
+  amd64) apt -y install qemu-system-x86 ;;
+  arm64) apt -y install qemu-system-arm ;;
+esac
 grep -vEe '^#' build-deps-ubuntu.txt | /bin/time -f '%E %C' xargs apt -y build-dep
 apt clean && rm -rf /var/lib/apt/lists/*
 EORUN
diff --git a/devenv/packages-c10s.txt b/devenv/packages-c10s.txt
index e082b13..ce50e6c 100644
--- a/devenv/packages-c10s.txt
+++ b/devenv/packages-c10s.txt
@@ -8,6 +8,7 @@ libvirt-devel
 ostree-devel
 
 # Runtime virt
+qemu-kvm
 xorriso
 qemu-img
 libvirt-daemon-kvm
diff --git a/devenv/packages-common.txt b/devenv/packages-common.txt
index 6c82022..56d66e9 100644
--- a/devenv/packages-common.txt
+++ b/devenv/packages-common.txt
@@ -26,7 +26,6 @@ pkg-config
 go-md2man
 
 # Runtime virt (common packages)
-qemu-kvm
 virtiofsd
 
 # TUI editors
diff --git a/devenv/packages-debian.txt b/devenv/packages-debian.txt
index 472b3b6..7c6fe38 100644
--- a/devenv/packages-debian.txt
+++ b/devenv/packages-debian.txt
@@ -11,6 +11,7 @@ libostree-dev
 python3-dev
 
 # Runtime virt
+qemu-kvm
 genisoimage
 qemu-utils
 libvirt-daemon-system
diff --git a/devenv/tool-versions.txt b/devenv/tool-versions.txt
index 266354a..618875d 100644
--- a/devenv/tool-versions.txt
+++ b/devenv/tool-versions.txt
@@ -5,7 +5,7 @@
 # renovate: datasource=github-releases depName=bootc-dev/bcvk
 bcvk@v0.14.0
 # renovate: datasource=github-releases depName=ossf/scorecard
-scorecard@v5.4.0
+scorecard@v5.5.0
 # renovate: datasource=github-releases depName=nushell/nushell
 nushell@0.112.2
 # renovate: datasource=github-releases depName=jj-vcs/jj
@@ -13,4 +13,4 @@ jj@0.40.0
 # renovate: datasource=github-releases depName=nextest-rs/nextest
 cargo-nextest@0.9.133
 # renovate: datasource=github-releases depName=block/goose
-goose@v1.31.0
+goose@v1.32.0