diff --git a/README.md b/README.md
index 96b4d0033b..dc3d0f06ee 100644
--- a/README.md
+++ b/README.md
@@ -41,12 +41,12 @@ automatically download and build an appropriate toolchain as part of the build
 process, so you don't need to worry about setting up a
 cross-compiler. Cross-compiling from a x86-64 host is officially supported.
 
-The machine your building on will need Python 2.7, GCC 8.4 (or later), and
+The machine your building on will need Python 3, GCC 8.4 (or later), and
 a handful of other packages (see below).
 
 ### Dependencies for *64-bit* Ubuntu/Debian systems
 
-1. Install Ubuntu 22.04 or Debian 12 (x86_64 or ppc64le).
+1. Install Ubuntu 26.04 or Debian 13 (x86_64 or ppc64le).
 2. Enable Universe (Ubuntu only):
 
         sudo apt-get install software-properties-common
@@ -54,21 +54,21 @@ a handful of other packages (see below).
 3. Install the packages necessary for the build:
 
         sudo apt-get install cscope universal-ctags libz-dev libexpat-dev \
-          python2 python-is-python3 language-pack-en texinfo gawk cpio xxd \
+          python3 python-is-python3 language-pack-en texinfo gawk cpio xxd \
           build-essential g++ git bison flex unzip \
           libssl-dev libxml-simple-perl libxml-sax-perl libxml-parser-perl libxml2-dev libxml2-utils xsltproc \
           wget bc rsync
 
 ### Dependencies for *64-bit* Fedora systems
 
-1. Install Fedora 33 (x86_64 or ppc64le).
+1. Install Fedora 44 (x86_64 or ppc64le).
 2. Install the packages necessary for the build:
 
         sudo dnf install gcc-c++ flex bison git ctags cscope expat-devel patch \
           zlib-devel zlib-static texinfo "perl(bigint)" "perl(XML::Simple)" \
           "perl(YAML)" "perl(XML::SAX)" "perl(Fatal)" "perl(Thread::Queue)" \
           "perl(Env)" "perl(XML::LibXML)" "perl(Digest::SHA1)" "perl(ExtUtils::MakeMaker)" \
-          "perl(FindBin)" "perl(English)" "perl(Time::localtime)" "perl(open)" \
+          "perl(FindBin)" "perl(English)" "perl(Time::localtime)" "perl(open)" "perl(IPC::Cmd)" "perl(Time::Piece)" \
           libxml2-devel which wget unzip tar cpio python bzip2 bc findutils ncurses-devel \
-          openssl-devel make libxslt vim-common lzo-devel python2 rsync hostname
+          openssl-devel make libxslt vim-common lzo-devel python3 rsync hostname
 
diff --git a/buildroot b/buildroot
index a872efdc28..3fd3e2f94b 160000
--- a/buildroot
+++ b/buildroot
@@ -1 +1 @@
-Subproject commit a872efdc28b2ef527ba329f54f4f1b17a6e7e9eb
+Subproject commit 3fd3e2f94b571b5edf05872a0fbb3a2ba51dc96a
diff --git a/openpower/package/hcode/Config.in b/openpower/package/hcode/Config.in
index 24c61aab98..7715afd485 100644
--- a/openpower/package/hcode/Config.in
+++ b/openpower/package/hcode/Config.in
@@ -33,7 +33,7 @@ config BR2_HCODE_CUSTOM_VERSION_VALUE
 
 config BR2_HCODE_VERSION
 	string
-	default "hw091323a.opmst" if BR2_HCODE_LATEST_VERSION
+	default "888cb36253c3c4a0770b6481e570960481a13e50" if BR2_HCODE_LATEST_VERSION
 	default BR2_HCODE_CUSTOM_VERSION_VALUE \
 		if BR2_HCODE_CUSTOM_VERSION
 
diff --git a/openpower/package/occ/occ.mk b/openpower/package/occ/occ.mk
index 61bce5b41b..8ec12c0e62 100644
--- a/openpower/package/occ/occ.mk
+++ b/openpower/package/occ/occ.mk
@@ -31,13 +31,26 @@ OCC_TARGET_CROSS = $(TARGET_CROSS)
 OCC_DEPENDENCIES += host-binutils
 endif
 
+# OCC's host-side build tools (ppetracepp, ppe2fsp, imageHdrScript, ffdcparser,
+# ...) are old pre-C23 / K&R C that GCC >= 14 rejects by default (implicit int,
+# and "bool" being a keyword in C23). Provide a host gcc/g++ wrapper that relaxes
+# the standard for these tools only; target code is built via CROSS_PREFIX and is
+# unaffected. The flags are harmless on older host compilers (e.g. Fedora 33).
+define OCC_HOSTCC_WRAP
+	mkdir -p $(@D)/.hostcc
+	printf '#!/bin/sh\nexec /usr/bin/gcc -std=gnu17 -fpermissive "$$@"\n' > $(@D)/.hostcc/gcc
+	printf '#!/bin/sh\nexec /usr/bin/g++ -fpermissive "$$@"\n' > $(@D)/.hostcc/g++
+	chmod +x $(@D)/.hostcc/gcc $(@D)/.hostcc/g++
+endef
+
 define OCC_BUILD_CMDS
+	$(OCC_HOSTCC_WRAP)
 	if [ "$(BR2_OCC_GPU_BIN_BUILD)" == "y"  ]; then \
 	    cd $(@D)/src && \
-            make PPE_TOOL_PATH=$(PPE42_GCC_BIN) OCC_OP_BUILD=1 CROSS_PREFIX=$(OCC_TARGET_CROSS) LD_LIBRARY_PATH=$(HOST_DIR)/usr/lib GPE1_BIN_IMAGE_PATH=$(STAGING_DIR)/hostboot_binaries/ OPOCC_GPU_SUPPORT=1 all; \
+            PATH="$(@D)/.hostcc:$$PATH" make PPE_TOOL_PATH=$(PPE42_GCC_BIN) OCC_OP_BUILD=1 CROSS_PREFIX=$(OCC_TARGET_CROSS) LD_LIBRARY_PATH=$(HOST_DIR)/usr/lib GPE1_BIN_IMAGE_PATH=$(STAGING_DIR)/hostboot_binaries/ OPOCC_GPU_SUPPORT=1 all; \
 	else \
             cd $(@D)/src && \
-            make PPE_TOOL_PATH=$(PPE42_GCC_BIN) OCC_OP_BUILD=1 CROSS_PREFIX=$(OCC_TARGET_CROSS) LD_LIBRARY_PATH=$(HOST_DIR)/usr/lib all; \
+            PATH="$(@D)/.hostcc:$$PATH" make PPE_TOOL_PATH=$(PPE42_GCC_BIN) OCC_OP_BUILD=1 CROSS_PREFIX=$(OCC_TARGET_CROSS) LD_LIBRARY_PATH=$(HOST_DIR)/usr/lib all; \
 	fi;
 endef
 OCC_BUILD_CMDS ?= $(OCC_BUILD_CMDS_P9)
diff --git a/openpower/package/openpower-pnor/0002-openpower-pnor-use-python3.patch b/openpower/package/openpower-pnor/0002-openpower-pnor-use-python3.patch
new file mode 100644
index 0000000000..0d4a7fd66c
--- /dev/null
+++ b/openpower/package/openpower-pnor/0002-openpower-pnor-use-python3.patch
@@ -0,0 +1,18 @@
+openpower-pnor: use python3 to run sbeOpDistribute.py
+
+python2 is unavailable on modern host distros; sbeOpDistribute.py is
+python3-compatible, so invoke it with python3 during image assembly.
+
+Signed-off-by: Trung Le <trung.le@ruby-journal.com>
+
+--- a/update_image.pl
++++ b/update_image.pl
+@@ -278,7 +278,7 @@
+ if ($release eq "p9") {
+     my $hw_ref_image = $wink_binary_filename;
+     $hw_ref_image =~ s/.hdr.bin.ecc//;
+-    run_command("python2 $sbe_binary_dir/sbeOpDistribute.py --install --buildSbePart $hb_image_dir/buildSbePart.pl --hw_ref_image $hcode_dir/$hw_ref_image.bin --sbe_binary_filename $sbe_binary_filename --scratch_dir $scratch_dir --sbe_binary_dir $sbe_binary_dir");
++    run_command("python3 $sbe_binary_dir/sbeOpDistribute.py --install --buildSbePart $hb_image_dir/buildSbePart.pl --hw_ref_image $hcode_dir/$hw_ref_image.bin --sbe_binary_filename $sbe_binary_filename --scratch_dir $scratch_dir --sbe_binary_dir $sbe_binary_dir");
+ }
+ else {
+     run_command("cp $hb_binary_dir/$sbe_binary_filename $scratch_dir/");
diff --git a/openpower/package/sbe/0001-sbe-use-python3-for-build-scripts.patch b/openpower/package/sbe/0001-sbe-use-python3-for-build-scripts.patch
new file mode 100644
index 0000000000..2f2f080a5b
--- /dev/null
+++ b/openpower/package/sbe/0001-sbe-use-python3-for-build-scripts.patch
@@ -0,0 +1,60 @@
+sbe: use python3 for build scripts
+
+GCC/host distros no longer ship python2. The SBE build invokes python2
+for buildInfo.py / securityRegListGen.py and via #!/usr/bin/python2
+shebangs; these scripts are python3-compatible, so call python3.
+
+Signed-off-by: Trung Le <trung.le@ruby-journal.com>
+
+--- a/src/build/Makefile
++++ b/src/build/Makefile
+@@ -244,7 +244,7 @@
+ 
+ # Create build Info file
+ buildInfo:
+-	python2 buildInfo.py $(GENFILES_DIR)
++	python3 buildInfo.py $(GENFILES_DIR)
+ 
+ buildtag:
+ 	./updateBuildTag.py $(P9_XIP_TOOL) $(IMG_DIR) $(IMAGE_NAME)
+@@ -321,7 +321,7 @@
+ 
+ # generate whitelist and blacklist security algorithm
+ security: $(OBJDIR)
+-	python2 $(SECURITY_SRC_DIR)/securityRegListGen.py -f $(SECURITY_LIST) -o $(GENFILES_DIR)
++	python3 $(SECURITY_SRC_DIR)/securityRegListGen.py -f $(SECURITY_LIST) -o $(GENFILES_DIR)
+ 
+ # Build hwp_error_info.H.  If the script fails then print the contents of
+ # the header and then delete whatever garbage the script left to force it to
+--- a/src/build/buildInfo.py
++++ b/src/build/buildInfo.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python2
++#!/usr/bin/python3
+ # IBM_PROLOG_BEGIN_TAG
+ # This is an automatically generated prolog.
+ #
+--- a/src/build/parsAndCutElf.py
++++ b/src/build/parsAndCutElf.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python2
++#!/usr/bin/python3
+ # IBM_PROLOG_BEGIN_TAG
+ # This is an automatically generated prolog.
+ #
+--- a/src/build/updateBuildTag.py
++++ b/src/build/updateBuildTag.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python2
++#!/usr/bin/python3
+ # IBM_PROLOG_BEGIN_TAG
+ # This is an automatically generated prolog.
+ #
+--- a/src/boot/sbeCompression.py
++++ b/src/boot/sbeCompression.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python2
++#!/usr/bin/python3
+ # IBM_PROLOG_BEGIN_TAG
+ # This is an automatically generated prolog.
+ #
diff --git a/openpower/package/sbe/sbe.mk b/openpower/package/sbe/sbe.mk
index e95dbe515e..0db7c514ec 100644
--- a/openpower/package/sbe/sbe.mk
+++ b/openpower/package/sbe/sbe.mk
@@ -22,7 +22,7 @@ endef
 
 define SBE_INSTALL_IMAGES_CMDS
 	$(INSTALL) -D $(@D)/images/p9_ipl_build  $(HOST_DIR)/usr/bin/
-	python2 $(@D)/src/build/sbeOpDistribute.py --sbe_binary_dir=$(STAGING_DIR)/sbe_binaries --img_dir=$(@D)/images --sbe_binary_filename $(BR2_HOSTBOOT_BINARY_SBE_FILENAME)
+	python3 $(@D)/src/build/sbeOpDistribute.py --sbe_binary_dir=$(STAGING_DIR)/sbe_binaries --img_dir=$(@D)/images --sbe_binary_filename $(BR2_HOSTBOOT_BINARY_SBE_FILENAME)
 	cp $(@D)/src/build/sbeOpDistribute.py $(STAGING_DIR)/sbe_binaries/
 endef
 
diff --git a/openpower/package/skiboot/0001-Makefile-link-with-z-notext-for-binutils-2.39.patch b/openpower/package/skiboot/0001-Makefile-link-with-z-notext-for-binutils-2.39.patch
new file mode 100644
index 0000000000..46b74287fa
--- /dev/null
+++ b/openpower/package/skiboot/0001-Makefile-link-with-z-notext-for-binutils-2.39.patch
@@ -0,0 +1,26 @@
+skiboot: link final elf with -z notext for newer binutils
+
+skiboot is a self-relocating PIE and processes its own relocations at
+boot, so it legitimately contains text relocations. binutils >= 2.39
+promotes "read-only segment has dynamic relocations" from a warning to a
+hard error by default (e.g. binutils 2.46 on Fedora 44 / Ubuntu 26.04,
+2.44 on Debian 13), breaking the final link. Pass -z notext to allow it.
+
+Upstream: https://github.com/open-power/skiboot (Makefile.main)
+Signed-off-by: Trung Le <trung.le@ruby-journal.com>
+
+diff --git a/Makefile.main b/Makefile.main
+index a06d79fe..22a9cdee 100644
+--- a/Makefile.main
++++ b/Makefile.main
+@@ -197,6 +197,10 @@ LDFLAGS_FINAL = -m elf64lppc --no-multi-toc -N --build-id=none --whole-archive
+ LDFLAGS_FINAL += -static -nostdlib -pie -Ttext-segment=$(LD_TEXT) --oformat=elf64-powerpc
+ LDFLAGS_FINAL += --orphan-handling=warn
+ LDFLAGS_FINAL += $(call try-ldflag,$(LD),--no-warn-rwx-segments)
++# skiboot is a self-relocating PIE and processes its own relocations at boot,
++# so it legitimately has text relocations. binutils >= 2.39 turns "read-only
++# segment has dynamic relocations" into a hard error by default; allow it.
++LDFLAGS_FINAL += $(call try-ldflag,$(LD),-z notext)
+ 
+ LDRFLAGS=-melf64ppc
+ # Debug stuff