diff --git a/.github/buildomat/jobs/deploy.sh b/.github/buildomat/jobs/deploy.sh
index d8065e058c3..7a3ac17b054 100755
--- a/.github/buildomat/jobs/deploy.sh
+++ b/.github/buildomat/jobs/deploy.sh
@@ -2,7 +2,7 @@
 #:
 #: name = "helios / deploy"
 #: variety = "basic"
-#: target = "lab-2.0-opte-0.39"
+#: target = "lab-2.0-opte-0.40"
 #: output_rules = [
 #:  "%/var/svc/log/oxide-*.log*",
 #:  "%/zone/oxz_*/root/var/svc/log/oxide-*.log*",
diff --git a/Cargo.lock b/Cargo.lock
index f2132326374..4a5e5f14acb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2524,7 +2524,7 @@ dependencies = [
 [[package]]
 name = "ddm-admin-client"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/maghemite?rev=b603c9f3dccefcf1d3e941c04505ff6bdd1826b6#b603c9f3dccefcf1d3e941c04505ff6bdd1826b6"
+source = "git+https://github.com/oxidecomputer/maghemite?rev=7696ee48d5ee29a917dea459e281fe2e8ff20513#7696ee48d5ee29a917dea459e281fe2e8ff20513"
 dependencies = [
  "oxnet",
  "progenitor 0.13.0",
@@ -5281,7 +5281,7 @@ dependencies = [
 [[package]]
 name = "illumos-sys-hdrs"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/opte?rev=e547d07b08c3f3d6c821c9eb7a958adcffce6e56#e547d07b08c3f3d6c821c9eb7a958adcffce6e56"
+source = "git+https://github.com/oxidecomputer/opte?rev=bae0440c199b3908c12903a9532854936353433b#bae0440c199b3908c12903a9532854936353433b"
 dependencies = [
  "bitflags 2.11.0",
 ]
@@ -5964,7 +5964,7 @@ dependencies = [
 [[package]]
 name = "kstat-macro"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/opte?rev=e547d07b08c3f3d6c821c9eb7a958adcffce6e56#e547d07b08c3f3d6c821c9eb7a958adcffce6e56"
+source = "git+https://github.com/oxidecomputer/opte?rev=bae0440c199b3908c12903a9532854936353433b#bae0440c199b3908c12903a9532854936353433b"
 dependencies = [
  "quote",
  "syn 2.0.117",
@@ -6501,7 +6501,7 @@ dependencies = [
 [[package]]
 name = "mg-admin-client"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/maghemite?rev=b603c9f3dccefcf1d3e941c04505ff6bdd1826b6#b603c9f3dccefcf1d3e941c04505ff6bdd1826b6"
+source = "git+https://github.com/oxidecomputer/maghemite?rev=7696ee48d5ee29a917dea459e281fe2e8ff20513#7696ee48d5ee29a917dea459e281fe2e8ff20513"
 dependencies = [
  "chrono",
  "colored 3.1.1",
@@ -9571,7 +9571,7 @@ dependencies = [
 [[package]]
 name = "opte"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/opte?rev=e547d07b08c3f3d6c821c9eb7a958adcffce6e56#e547d07b08c3f3d6c821c9eb7a958adcffce6e56"
+source = "git+https://github.com/oxidecomputer/opte?rev=bae0440c199b3908c12903a9532854936353433b#bae0440c199b3908c12903a9532854936353433b"
 dependencies = [
  "bitflags 2.11.0",
  "dyn-clone",
@@ -9590,7 +9590,7 @@ dependencies = [
 [[package]]
 name = "opte-api"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/opte?rev=e547d07b08c3f3d6c821c9eb7a958adcffce6e56#e547d07b08c3f3d6c821c9eb7a958adcffce6e56"
+source = "git+https://github.com/oxidecomputer/opte?rev=bae0440c199b3908c12903a9532854936353433b#bae0440c199b3908c12903a9532854936353433b"
 dependencies = [
  "illumos-sys-hdrs",
  "ingot",
@@ -9603,7 +9603,7 @@ dependencies = [
 [[package]]
 name = "opte-ioctl"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/opte?rev=e547d07b08c3f3d6c821c9eb7a958adcffce6e56#e547d07b08c3f3d6c821c9eb7a958adcffce6e56"
+source = "git+https://github.com/oxidecomputer/opte?rev=bae0440c199b3908c12903a9532854936353433b#bae0440c199b3908c12903a9532854936353433b"
 dependencies = [
  "libc",
  "libnet",
@@ -9700,7 +9700,7 @@ dependencies = [
 [[package]]
 name = "oxide-vpc"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/opte?rev=e547d07b08c3f3d6c821c9eb7a958adcffce6e56#e547d07b08c3f3d6c821c9eb7a958adcffce6e56"
+source = "git+https://github.com/oxidecomputer/opte?rev=bae0440c199b3908c12903a9532854936353433b#bae0440c199b3908c12903a9532854936353433b"
 dependencies = [
  "cfg-if",
  "illumos-sys-hdrs",
@@ -11753,7 +11753,7 @@ dependencies = [
 [[package]]
 name = "rdb-types"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/maghemite?rev=b603c9f3dccefcf1d3e941c04505ff6bdd1826b6#b603c9f3dccefcf1d3e941c04505ff6bdd1826b6"
+source = "git+https://github.com/oxidecomputer/maghemite?rev=7696ee48d5ee29a917dea459e281fe2e8ff20513#7696ee48d5ee29a917dea459e281fe2e8ff20513"
 dependencies = [
  "oxnet",
  "schemars 0.8.22",
diff --git a/Cargo.toml b/Cargo.toml
index cce9ffd022f..c92c34a64ea 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -599,8 +599,8 @@ ntp-admin-api = { path = "ntp-admin/api" }
 ntp-admin-client = { path = "clients/ntp-admin-client" }
 ntp-admin-types = { path = "ntp-admin/types" }
 ntp-admin-types-versions = { path = "ntp-admin/types/versions" }
-mg-admin-client = { git = "https://github.com/oxidecomputer/maghemite", rev = "b603c9f3dccefcf1d3e941c04505ff6bdd1826b6" }
-ddm-admin-client = { git = "https://github.com/oxidecomputer/maghemite", rev = "b603c9f3dccefcf1d3e941c04505ff6bdd1826b6" }
+mg-admin-client = { git = "https://github.com/oxidecomputer/maghemite", rev = "7696ee48d5ee29a917dea459e281fe2e8ff20513" }
+ddm-admin-client = { git = "https://github.com/oxidecomputer/maghemite", rev = "7696ee48d5ee29a917dea459e281fe2e8ff20513" }
 multimap = "0.10.1"
 nexus-auth = { path = "nexus/auth" }
 nexus-background-task-interface = { path = "nexus/background-task-interface" }
@@ -662,7 +662,7 @@ omicron-workspace-hack = "0.1.0"
 omicron-zone-package = "0.12.2"
 oxide-client = { path = "clients/oxide-client" }
 oxide-tokio-rt = "0.1.4"
-oxide-vpc = { git = "https://github.com/oxidecomputer/opte", rev = "e547d07b08c3f3d6c821c9eb7a958adcffce6e56", features = [ "api", "std" ] }
+oxide-vpc = { git = "https://github.com/oxidecomputer/opte", rev = "bae0440c199b3908c12903a9532854936353433b", features = [ "api", "std" ] }
 oxlog = { path = "dev-tools/oxlog" }
 oxnet = "0.1.4"
 once_cell = "1.21.3"
@@ -671,7 +671,7 @@ openapiv3 = "2.2.0"
 # must match samael's crate!
 openssl = "0.10"
 openssl-sys = "0.9"
-opte-ioctl = { git = "https://github.com/oxidecomputer/opte", rev = "e547d07b08c3f3d6c821c9eb7a958adcffce6e56" }
+opte-ioctl = { git = "https://github.com/oxidecomputer/opte", rev = "bae0440c199b3908c12903a9532854936353433b" }
 oso = "0.27"
 owo-colors = "4.2.2"
 oximeter = { path = "oximeter/oximeter" }
@@ -737,7 +737,7 @@ rats-corim = { git = "https://github.com/oxidecomputer/rats-corim.git", rev = "f
 raw-cpuid = { git = "https://github.com/oxidecomputer/rust-cpuid.git", rev = "a4cf01df76f35430ff5d39dc2fe470bcb953503b" }
 rayon = "1.10"
 rcgen = "0.12.1"
-rdb-types = { git = "https://github.com/oxidecomputer/maghemite", rev = "b603c9f3dccefcf1d3e941c04505ff6bdd1826b6" }
+rdb-types = { git = "https://github.com/oxidecomputer/maghemite", rev = "7696ee48d5ee29a917dea459e281fe2e8ff20513" }
 reconfigurator-cli = { path = "dev-tools/reconfigurator-cli" }
 reedline = "0.40.0"
 ref-cast = "1.0"
diff --git a/nexus/src/app/background/tasks/sync_switch_configuration.rs b/nexus/src/app/background/tasks/sync_switch_configuration.rs
index 8b55c17fe76..ba76de44053 100644
--- a/nexus/src/app/background/tasks/sync_switch_configuration.rs
+++ b/nexus/src/app/background/tasks/sync_switch_configuration.rs
@@ -836,6 +836,8 @@ impl BackgroundTask for SwitchPortSettingsManager {
                                     }),
                                     deterministic_collision_resolution: false,
                                     idle_hold_jitter: None,
+                                    src_port: None,
+                                    src_addr: None,
                                 };
 
                                 // update the stored vec if it exists, create a new on if it doesn't exist
@@ -885,6 +887,8 @@ impl BackgroundTask for SwitchPortSettingsManager {
                                     deterministic_collision_resolution: false,
                                     idle_hold_jitter: None,
                                     router_lifetime: router_lifetime.as_u16(),
+                                    src_port: None,
+                                    src_addr: None,
                                 };
 
                                 // update the stored vec if it exists, create a new on if it doesn't exist
@@ -984,7 +988,7 @@ impl BackgroundTask for SwitchPortSettingsManager {
                         error!(log, "error while applying bgp configuration"; "error" => ?e);
                     }
 
-                    if let Err(e) = client.update_rib_bestpath_fanout(fanout).await {
+                    if let Err(e) = client.update_bestpath_fanout(fanout).await {
                         error!(log, "error while updating bestpath fanout"; "error" => ?e);
                     }
                 }
diff --git a/nexus/src/app/bgp.rs b/nexus/src/app/bgp.rs
index 6c0a3fc1f51..53cc41996c5 100644
--- a/nexus/src/app/bgp.rs
+++ b/nexus/src/app/bgp.rs
@@ -121,7 +121,7 @@ impl super::Nexus {
 
             for r in &router_info {
                 let asn = r.asn;
-                let peers = match client.get_neighbors_v4(asn).await {
+                let peers = match client.get_neighbors(asn).await {
                     Ok(result) => result.into_inner(),
                     Err(e) => {
                         error!(
@@ -183,7 +183,7 @@ impl super::Nexus {
                     peer: None,
                 };
 
-                let exported = match client.get_exported_v3(&selector).await {
+                let exported = match client.get_exported(&selector).await {
                     Ok(result) => result.into_inner(),
                     Err(e) => {
                         error!(
@@ -237,7 +237,7 @@ impl super::Nexus {
             ))
         })? {
             let history = match client
-                .message_history_v3(&MessageHistoryRequest {
+                .message_history(&MessageHistoryRequest {
                     asn: sel.asn,
                     direction: None,
                     peer: None,
@@ -280,7 +280,7 @@ impl super::Nexus {
             ))
         })? {
             let mut imported: Vec<networking::BgpImported> = Vec::new();
-            match client.get_rib_imported_v2(None, None).await {
+            match client.get_rib_imported(None, None).await {
                 Ok(result) => {
                     for (prefix, paths) in result.into_inner().iter() {
                         let ipnet = match prefix.parse() {
diff --git a/package-manifest.toml b/package-manifest.toml
index dac20755197..564629f50a4 100644
--- a/package-manifest.toml
+++ b/package-manifest.toml
@@ -683,10 +683,10 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "b603c9f3dccefcf1d3e941c04505ff6bdd1826b6"
+source.commit = "7696ee48d5ee29a917dea459e281fe2e8ff20513"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/mg-ddm-gz.sha256.txt
-source.sha256 = "506862636920f5e9ebf0b931e77baafcec7460faa77770e94fcb18fd1e1ca194"
+source.sha256 = "ce52b9094adf0ed567bd3ed1e3ac48ac1c983cc7859adacf4f392e415a1189ad"
 output.type = "tarball"
 
 [package.mg-ddm]
@@ -699,10 +699,10 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "b603c9f3dccefcf1d3e941c04505ff6bdd1826b6"
+source.commit = "7696ee48d5ee29a917dea459e281fe2e8ff20513"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/mg-ddm.sha256.txt
-source.sha256 = "01cf23b6fee8643263ff7e435c8f58f47976f22a48343ab0b04b417eff6a40cd"
+source.sha256 = "23950a4e73a07fa7f087ba3312e4bc5a8981fd9ebad54af2350baaa86ad6bbf3"
 output.type = "zone"
 output.intermediate_only = true
 
@@ -714,10 +714,10 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "b603c9f3dccefcf1d3e941c04505ff6bdd1826b6"
+source.commit = "7696ee48d5ee29a917dea459e281fe2e8ff20513"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/mgd.sha256.txt
-source.sha256 = "c5a642abf324cc3a4c3539996825b21ce6b3ffa193ce646dbc9185754a20f599"
+source.sha256 = "301d31ca481e4822f69484feacca31dd08a7c4aae87d96641d384bda3178d2f3"
 output.type = "zone"
 output.intermediate_only = true
 
diff --git a/sled-agent/src/bootstrap/early_networking.rs b/sled-agent/src/bootstrap/early_networking.rs
index f990c98ab59..217a7c2e4b5 100644
--- a/sled-agent/src/bootstrap/early_networking.rs
+++ b/sled-agent/src/bootstrap/early_networking.rs
@@ -601,6 +601,8 @@ impl<'a> EarlyNetworkSetup<'a> {
                             }),
                             deterministic_collision_resolution: false,
                             idle_hold_jitter: None,
+                            src_addr: None,
+                            src_port: None,
                         };
                         match bgp_peer_configs.get_mut(&port.port) {
                             Some(peers) => {
@@ -653,6 +655,8 @@ impl<'a> EarlyNetworkSetup<'a> {
                             deterministic_collision_resolution: false,
                             idle_hold_jitter: None,
                             router_lifetime: router_lifetime.as_u16(),
+                            src_addr: None,
+                            src_port: None,
                         };
                         match bgp_unnumbered_peer_configs.get_mut(&port.port) {
                             Some(peers) => {
@@ -713,7 +717,7 @@ impl<'a> EarlyNetworkSetup<'a> {
                     );
                 }
 
-                if let Err(e) = mgd.update_rib_bestpath_fanout(&fanout).await {
+                if let Err(e) = mgd.update_bestpath_fanout(&fanout).await {
                     error!(
                         self.log,
                         "error while updating bestpath fanout";
diff --git a/tools/maghemite_ddm_openapi_version b/tools/maghemite_ddm_openapi_version
index cac9570a113..060b3a13efb 100644
--- a/tools/maghemite_ddm_openapi_version
+++ b/tools/maghemite_ddm_openapi_version
@@ -1 +1 @@
-COMMIT="b603c9f3dccefcf1d3e941c04505ff6bdd1826b6"
+COMMIT="7696ee48d5ee29a917dea459e281fe2e8ff20513"
diff --git a/tools/maghemite_mg_openapi_version b/tools/maghemite_mg_openapi_version
index cac9570a113..060b3a13efb 100644
--- a/tools/maghemite_mg_openapi_version
+++ b/tools/maghemite_mg_openapi_version
@@ -1 +1 @@
-COMMIT="b603c9f3dccefcf1d3e941c04505ff6bdd1826b6"
+COMMIT="7696ee48d5ee29a917dea459e281fe2e8ff20513"
diff --git a/tools/maghemite_mgd_checksums b/tools/maghemite_mgd_checksums
index 87e1781ba0b..470facaa671 100644
--- a/tools/maghemite_mgd_checksums
+++ b/tools/maghemite_mgd_checksums
@@ -1,2 +1,2 @@
-CIDL_SHA256="c5a642abf324cc3a4c3539996825b21ce6b3ffa193ce646dbc9185754a20f599"
-MGD_LINUX_SHA256="83d9bac919524341a845b7e376349fababbe47fa3335f953fda6bbf85e6030ee"
\ No newline at end of file
+CIDL_SHA256="301d31ca481e4822f69484feacca31dd08a7c4aae87d96641d384bda3178d2f3"
+MGD_LINUX_SHA256="95f9759a5fde2784d148c81df2218d29adde1d27fb72d5dbcf534de6450f0f7c"
\ No newline at end of file
diff --git a/tools/opte_version b/tools/opte_version
index 1742d1585d6..b5e2a22fa51 100644
--- a/tools/opte_version
+++ b/tools/opte_version
@@ -1 +1 @@
-0.39.455
+0.40.474