diff --git a/Dockerfile b/Dockerfile
index a7e266e6..57df1080 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,13 +2,25 @@
 
 # Stage 1: Build the binary
 
-FROM rust:slim-bullseye as builder
+FROM rust:slim-bookworm AS builder
 
 WORKDIR /app
 
 COPY --link . /app
 
-RUN for i in 1 2 3; do apt-get update && apt-get install --fix-missing -y cmake curl clang git pkg-config libssl-dev libdw-dev libpq-dev lld && break || sleep 10; done
+RUN apt-get update \
+    && apt-get install --no-install-recommends --fix-missing -y \
+        cmake \
+        curl \
+        clang \
+        make \
+        git \
+        pkg-config \
+        libssl-dev \
+        libdw-dev \
+        libpq-dev \
+        lld \
+    && rm -rf /var/lib/apt/lists/*
 ENV CARGO_NET_GIT_FETCH_WITH_CLI true
 # TODO: Fix this with real processors.
 RUN cargo build --locked --release -p processor && ls -lah target/release/
@@ -24,19 +36,19 @@ ENV GIT_SHA ${GIT_SHA}
 
 # Stage 2: Create the final image
 
-FROM debian:bullseye-slim
+FROM debian:bookworm-slim
 
 COPY --from=builder /usr/local/bin/processor /usr/local/bin
 
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update && apt-get install --no-install-recommends --fix-missing -y \
-        libssl1.1 \
+        libssl3 \
         ca-certificates \
         net-tools \
         tcpdump \
         iproute2 \
-        netcat \
+        netcat-openbsd \
         libdw-dev \
         libpq-dev \
         curl
diff --git a/Dockerfile.address-reputation-api b/Dockerfile.address-reputation-api
index 5be4c111..488d8ed5 100644
--- a/Dockerfile.address-reputation-api
+++ b/Dockerfile.address-reputation-api
@@ -2,13 +2,25 @@
 
 # Stage 1: Build the binary
 
-FROM rust:slim-bullseye as builder
+FROM rust:slim-bookworm AS builder
 
 WORKDIR /app
 
 COPY --link . /app
 
-RUN for i in 1 2 3; do apt-get update && apt-get install --fix-missing -y cmake curl clang git pkg-config libssl-dev libdw-dev libpq-dev lld && break || sleep 10; done
+RUN apt-get update \
+    && apt-get install --no-install-recommends --fix-missing -y \
+        cmake \
+        curl \
+        clang \
+        make \
+        git \
+        pkg-config \
+        libssl-dev \
+        libdw-dev \
+        libpq-dev \
+        lld \
+    && rm -rf /var/lib/apt/lists/*
 ENV CARGO_NET_GIT_FETCH_WITH_CLI true
 RUN cargo build --locked --release -p address-reputation-api && ls -lah target/release/
 RUN cp target/release/address-reputation-api /usr/local/bin
@@ -23,19 +35,19 @@ ENV GIT_SHA ${GIT_SHA}
 
 # Stage 2: Create the final image
 
-FROM debian:bullseye-slim
+FROM debian:bookworm-slim
 
 COPY --from=builder /usr/local/bin/address-reputation-api /usr/local/bin
 
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update && apt-get install --no-install-recommends --fix-missing -y \
-        libssl1.1 \
+        libssl3 \
         ca-certificates \
         net-tools \
         tcpdump \
         iproute2 \
-        netcat \
+        netcat-openbsd \
         libdw-dev \
         libpq-dev \
         curl
diff --git a/processor/src/processors/default/models/table_items.rs b/processor/src/processors/default/models/table_items.rs
index 7df1e320..02bbe3d5 100644
--- a/processor/src/processors/default/models/table_items.rs
+++ b/processor/src/processors/default/models/table_items.rs
@@ -197,7 +197,10 @@ pub struct TableMetadata {
 impl TableMetadata {
     pub fn from_write_table_item(table_item: &WriteTableItem) -> Self {
         Self {
-            handle: table_item.handle.to_string(),
+            // Proto table handles are not always 64-char padded. table_items /
+            // current_table_items already standardize; keep this PK in the same
+            // form so joins on handle succeed.
+            handle: standardize_address(&table_item.handle.to_string()),
             key_type: table_item.data.as_ref().unwrap().key_type.clone(),
             value_type: table_item.data.as_ref().unwrap().value_type.clone(),
         }
@@ -315,3 +318,47 @@ impl From<TableMetadata> for PostgresTableMetadata {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use aptos_indexer_processor_sdk::aptos_protos::transaction::v1::{
+        WriteTableData, WriteTableItem,
+    };
+
+    fn write_table_item(handle: &str) -> WriteTableItem {
+        WriteTableItem {
+            handle: handle.to_string(),
+            key: "0x1".to_string(),
+            data: Some(WriteTableData {
+                key: "\"1\"".to_string(),
+                key_type: "u64".to_string(),
+                value: "\"2\"".to_string(),
+                value_type: "u64".to_string(),
+            }),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn table_metadata_handle_matches_standardized_table_item_handle() {
+        let raw_handle = "0xabc";
+        assert_ne!(
+            standardize_address(raw_handle),
+            raw_handle,
+            "precondition: proto table handles can be shorter than 64 hex chars"
+        );
+
+        let item = write_table_item(raw_handle);
+        let (table_item, current) =
+            TableItem::from_write_table_item(&item, 0, 1, 1, chrono::NaiveDateTime::default());
+        let metadata = TableMetadata::from_write_table_item(&item);
+
+        let expected = standardize_address(raw_handle);
+        assert_eq!(table_item.table_handle, expected);
+        assert_eq!(current.table_handle, expected);
+        assert_eq!(metadata.handle, expected);
+        assert_eq!(metadata.key_type, "u64");
+        assert_eq!(metadata.value_type, "u64");
+    }
+}
diff --git a/scripts/rust_lint.sh b/scripts/rust_lint.sh
index 261c1aa9..32a48f2b 100755
--- a/scripts/rust_lint.sh
+++ b/scripts/rust_lint.sh
@@ -25,7 +25,10 @@ fi
 set -e
 set -x
 
-cargo +nightly xclippy
+# Run clippy on the pinned STABLE toolchain (from rust-toolchain.toml), NOT
+# nightly. Latest nightly makes Infallible an alias of !, which breaks
+# allocative (impl Allocative for both). Stable clippy matches the build toolchain.
+cargo xclippy
 
 # We require the nightly build of cargo fmt
 # to provide stricter rust formatting.