diff --git a/Cargo.lock b/Cargo.lock
index e76aed1376c..2f033d89997 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1773,7 +1773,7 @@ dependencies = [
 [[package]]
 name = "common"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/dendrite?rev=ab30fa91227fd478bfe0e023310ca83dec0bc22b#ab30fa91227fd478bfe0e023310ca83dec0bc22b"
+source = "git+https://github.com/oxidecomputer/dendrite?rev=21fbf39f63b25567b25aeadf0d9a73a01c842512#21fbf39f63b25567b25aeadf0d9a73a01c842512"
 dependencies = [
  "anyhow",
  "chrono",
@@ -2481,7 +2481,7 @@ dependencies = [
 [[package]]
 name = "ddm-admin-client"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/maghemite?rev=205b3ccf75b527ac7a565285fdcc0c78f4fcee95#205b3ccf75b527ac7a565285fdcc0c78f4fcee95"
+source = "git+https://github.com/oxidecomputer/maghemite?rev=3877aa0467fe275806f07ff4f7e92efa43e6fa6d#3877aa0467fe275806f07ff4f7e92efa43e6fa6d"
 dependencies = [
  "oxnet",
  "progenitor 0.11.2",
@@ -3007,11 +3007,11 @@ dependencies = [
 [[package]]
 name = "dpd-client"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/dendrite?rev=ab30fa91227fd478bfe0e023310ca83dec0bc22b#ab30fa91227fd478bfe0e023310ca83dec0bc22b"
+source = "git+https://github.com/oxidecomputer/dendrite?rev=21fbf39f63b25567b25aeadf0d9a73a01c842512#21fbf39f63b25567b25aeadf0d9a73a01c842512"
 dependencies = [
  "async-trait",
  "chrono",
- "common 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=ab30fa91227fd478bfe0e023310ca83dec0bc22b)",
+ "common 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=21fbf39f63b25567b25aeadf0d9a73a01c842512)",
  "crc8",
  "futures",
  "http",
@@ -5129,7 +5129,7 @@ dependencies = [
 [[package]]
 name = "illumos-sys-hdrs"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/opte?rev=795a1e0aeefb7a2c6fe4139779fdf66930d09b80#795a1e0aeefb7a2c6fe4139779fdf66930d09b80"
+source = "git+https://github.com/oxidecomputer/opte?rev=a1ed0960673b6ca2e6b68835537f53cc86110a77#a1ed0960673b6ca2e6b68835537f53cc86110a77"
 dependencies = [
  "bitflags 2.9.4",
 ]
@@ -5781,7 +5781,7 @@ dependencies = [
 [[package]]
 name = "kstat-macro"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/opte?rev=795a1e0aeefb7a2c6fe4139779fdf66930d09b80#795a1e0aeefb7a2c6fe4139779fdf66930d09b80"
+source = "git+https://github.com/oxidecomputer/opte?rev=a1ed0960673b6ca2e6b68835537f53cc86110a77#a1ed0960673b6ca2e6b68835537f53cc86110a77"
 dependencies = [
  "quote",
  "syn 2.0.111",
@@ -6363,7 +6363,7 @@ dependencies = [
 [[package]]
 name = "mg-admin-client"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/maghemite?rev=205b3ccf75b527ac7a565285fdcc0c78f4fcee95#205b3ccf75b527ac7a565285fdcc0c78f4fcee95"
+source = "git+https://github.com/oxidecomputer/maghemite?rev=3877aa0467fe275806f07ff4f7e92efa43e6fa6d#3877aa0467fe275806f07ff4f7e92efa43e6fa6d"
 dependencies = [
  "chrono",
  "colored 3.0.0",
@@ -7457,7 +7457,7 @@ dependencies = [
  "crucible-agent-client",
  "dns-server",
  "dns-service-client",
- "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=ab30fa91227fd478bfe0e023310ca83dec0bc22b)",
+ "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=21fbf39f63b25567b25aeadf0d9a73a01c842512)",
  "dropshot",
  "futures",
  "gateway-messages",
@@ -8345,7 +8345,7 @@ dependencies = [
  "display-error-chain",
  "dns-server",
  "dns-service-client",
- "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=ab30fa91227fd478bfe0e023310ca83dec0bc22b)",
+ "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=21fbf39f63b25567b25aeadf0d9a73a01c842512)",
  "dropshot",
  "ereport-types",
  "expectorate",
@@ -8828,7 +8828,7 @@ dependencies = [
  "display-error-chain",
  "dns-server",
  "dns-service-client",
- "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=ab30fa91227fd478bfe0e023310ca83dec0bc22b)",
+ "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=21fbf39f63b25567b25aeadf0d9a73a01c842512)",
  "dropshot",
  "expectorate",
  "flate2",
@@ -9282,7 +9282,7 @@ dependencies = [
 [[package]]
 name = "opte"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/opte?rev=795a1e0aeefb7a2c6fe4139779fdf66930d09b80#795a1e0aeefb7a2c6fe4139779fdf66930d09b80"
+source = "git+https://github.com/oxidecomputer/opte?rev=a1ed0960673b6ca2e6b68835537f53cc86110a77#a1ed0960673b6ca2e6b68835537f53cc86110a77"
 dependencies = [
  "bitflags 2.9.4",
  "dyn-clone",
@@ -9301,7 +9301,7 @@ dependencies = [
 [[package]]
 name = "opte-api"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/opte?rev=795a1e0aeefb7a2c6fe4139779fdf66930d09b80#795a1e0aeefb7a2c6fe4139779fdf66930d09b80"
+source = "git+https://github.com/oxidecomputer/opte?rev=a1ed0960673b6ca2e6b68835537f53cc86110a77#a1ed0960673b6ca2e6b68835537f53cc86110a77"
 dependencies = [
  "illumos-sys-hdrs",
  "ingot",
@@ -9314,7 +9314,7 @@ dependencies = [
 [[package]]
 name = "opte-ioctl"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/opte?rev=795a1e0aeefb7a2c6fe4139779fdf66930d09b80#795a1e0aeefb7a2c6fe4139779fdf66930d09b80"
+source = "git+https://github.com/oxidecomputer/opte?rev=a1ed0960673b6ca2e6b68835537f53cc86110a77#a1ed0960673b6ca2e6b68835537f53cc86110a77"
 dependencies = [
  "libc",
  "libnet",
@@ -9416,7 +9416,7 @@ dependencies = [
 [[package]]
 name = "oxide-vpc"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/opte?rev=795a1e0aeefb7a2c6fe4139779fdf66930d09b80#795a1e0aeefb7a2c6fe4139779fdf66930d09b80"
+source = "git+https://github.com/oxidecomputer/opte?rev=a1ed0960673b6ca2e6b68835537f53cc86110a77#a1ed0960673b6ca2e6b68835537f53cc86110a77"
 dependencies = [
  "cfg-if",
  "illumos-sys-hdrs",
@@ -11441,7 +11441,7 @@ dependencies = [
 [[package]]
 name = "rdb-types"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/maghemite?rev=205b3ccf75b527ac7a565285fdcc0c78f4fcee95#205b3ccf75b527ac7a565285fdcc0c78f4fcee95"
+source = "git+https://github.com/oxidecomputer/maghemite?rev=3877aa0467fe275806f07ff4f7e92efa43e6fa6d#3877aa0467fe275806f07ff4f7e92efa43e6fa6d"
 dependencies = [
  "oxnet",
  "schemars 0.8.22",
@@ -11582,18 +11582,18 @@ dependencies = [
 
 [[package]]
 name = "ref-cast"
-version = "1.0.24"
+version = "1.0.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a0ae411dbe946a674d89546582cea4ba2bb8defac896622d6496f14c23ba5cf"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
 dependencies = [
  "ref-cast-impl",
 ]
 
 [[package]]
 name = "ref-cast-impl"
-version = "1.0.24"
+version = "1.0.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1165225c21bff1f3bbce98f5a1f889949bc902d3575308cc7b0de30b4f6d27c7"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -16261,7 +16261,7 @@ name = "wicket-common"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=ab30fa91227fd478bfe0e023310ca83dec0bc22b)",
+ "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=21fbf39f63b25567b25aeadf0d9a73a01c842512)",
  "dropshot",
  "gateway-client",
  "gateway-types",
@@ -16321,7 +16321,7 @@ dependencies = [
  "clap",
  "debug-ignore",
  "display-error-chain",
- "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=ab30fa91227fd478bfe0e023310ca83dec0bc22b)",
+ "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=21fbf39f63b25567b25aeadf0d9a73a01c842512)",
  "dropshot",
  "either",
  "expectorate",
diff --git a/Cargo.toml b/Cargo.toml
index 72dc0a7c2ab..0e58e9dd14f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -462,7 +462,7 @@ digest = "0.10.7"
 dns-server = { path = "dns-server" }
 dns-server-api = { path = "dns-server-api" }
 dns-service-client = { path = "clients/dns-service-client" }
-dpd-client = { git = "https://github.com/oxidecomputer/dendrite", rev = "ab30fa91227fd478bfe0e023310ca83dec0bc22b" }
+dpd-client = { git = "https://github.com/oxidecomputer/dendrite", rev = "21fbf39f63b25567b25aeadf0d9a73a01c842512" }
 dropshot = { version = "0.16.6", features = [ "usdt-probes" ] }
 dropshot-api-manager = "0.2.4"
 dropshot-api-manager-types = "0.2.4"
@@ -566,8 +566,8 @@ ntp-admin-api = { path = "ntp-admin/api" }
 ntp-admin-client = { path = "clients/ntp-admin-client" }
 ntp-admin-types = { path = "ntp-admin/types" }
 ntp-admin-types-versions = { path = "ntp-admin/types/versions" }
-mg-admin-client = { git = "https://github.com/oxidecomputer/maghemite", rev = "205b3ccf75b527ac7a565285fdcc0c78f4fcee95" }
-ddm-admin-client = { git = "https://github.com/oxidecomputer/maghemite", rev = "205b3ccf75b527ac7a565285fdcc0c78f4fcee95" }
+mg-admin-client = { git = "https://github.com/oxidecomputer/maghemite", rev = "3877aa0467fe275806f07ff4f7e92efa43e6fa6d" }
+ddm-admin-client = { git = "https://github.com/oxidecomputer/maghemite", rev = "3877aa0467fe275806f07ff4f7e92efa43e6fa6d" }
 multimap = "0.10.1"
 nexus-auth = { path = "nexus/auth" }
 nexus-background-task-interface = { path = "nexus/background-task-interface" }
@@ -626,7 +626,7 @@ omicron-workspace-hack = "0.1.0"
 omicron-zone-package = "0.12.2"
 oxide-client = { path = "clients/oxide-client" }
 oxide-tokio-rt = "0.1.2"
-oxide-vpc = { git = "https://github.com/oxidecomputer/opte", rev = "795a1e0aeefb7a2c6fe4139779fdf66930d09b80", features = [ "api", "std" ] }
+oxide-vpc = { git = "https://github.com/oxidecomputer/opte", rev = "a1ed0960673b6ca2e6b68835537f53cc86110a77", features = [ "api", "std" ] }
 oxlog = { path = "dev-tools/oxlog" }
 oxnet = "0.1.3"
 once_cell = "1.21.3"
@@ -635,7 +635,7 @@ openapiv3 = "2.2.0"
 # must match samael's crate!
 openssl = "0.10"
 openssl-sys = "0.9"
-opte-ioctl = { git = "https://github.com/oxidecomputer/opte", rev = "795a1e0aeefb7a2c6fe4139779fdf66930d09b80" }
+opte-ioctl = { git = "https://github.com/oxidecomputer/opte", rev = "a1ed0960673b6ca2e6b68835537f53cc86110a77" }
 oso = "0.27"
 owo-colors = "4.2.2"
 oximeter = { path = "oximeter/oximeter" }
@@ -697,7 +697,7 @@ rats-corim = { git = "https://github.com/oxidecomputer/rats-corim.git", rev = "f
 raw-cpuid = { git = "https://github.com/oxidecomputer/rust-cpuid.git", rev = "a4cf01df76f35430ff5d39dc2fe470bcb953503b" }
 rayon = "1.10"
 rcgen = "0.12.1"
-rdb-types = { git = "https://github.com/oxidecomputer/maghemite", rev = "205b3ccf75b527ac7a565285fdcc0c78f4fcee95" }
+rdb-types = { git = "https://github.com/oxidecomputer/maghemite", rev = "3877aa0467fe275806f07ff4f7e92efa43e6fa6d" }
 reconfigurator-cli = { path = "dev-tools/reconfigurator-cli" }
 reedline = "0.40.0"
 ref-cast = "1.0"
diff --git a/illumos-utils/src/running_zone.rs b/illumos-utils/src/running_zone.rs
index 532086b9b80..63553f93d59 100644
--- a/illumos-utils/src/running_zone.rs
+++ b/illumos-utils/src/running_zone.rs
@@ -353,30 +353,30 @@ impl RunningZone {
         Ok(network)
     }
 
-    // TODO-completeness: Handle dual-stack OPTE ports here. This works for
-    // either IPv4 or IPv6 addresses, but not both.
-    // See https://github.com/oxidecomputer/omicron/issues/9247.
     pub async fn ensure_address_for_port(
         &self,
         name: &str,
         port_idx: usize,
-    ) -> Result<IpNetwork, EnsureAddressError> {
+    ) -> Result<(), EnsureAddressError> {
         info!(self.inner.log, "Ensuring address for OPTE port");
+
         let port = self.opte_ports().nth(port_idx).ok_or_else(|| {
             EnsureAddressError::MissingOptePort {
                 zone: self.inner.name.clone(),
                 port_idx,
             }
         })?;
-        let addrobj = AddrObject::new(port.name(), name).map_err(|err| {
-            EnsureAddressError::AddrObject {
-                request: AddressRequest::Dhcp,
-                zone: self.inner.name.clone(),
-                err,
-            }
-        })?;
         let zone = Some(self.inner.name.as_ref());
         if let Some(gateway) = port.gateway().ipv4_addr() {
+            let v4_name = format!("{}4", name);
+            let addrobj =
+                AddrObject::new(port.name(), &v4_name).map_err(|err| {
+                    EnsureAddressError::AddrObject {
+                        request: AddressRequest::Dhcp,
+                        zone: self.inner.name.clone(),
+                        err,
+                    }
+                })?;
             let addr =
                 Zones::ensure_address(zone, &addrobj, AddressRequest::Dhcp)
                     .await?;
@@ -403,8 +403,17 @@ impl RunningZone {
                 "default",
                 &gateway_ip,
             ])?;
-            Ok(addr)
-        } else {
+        }
+        if port.gateway().ipv6_addr().is_some() {
+            let v6_name = format!("{}6", name);
+            let addrobj =
+                AddrObject::new(port.name(), &v6_name).map_err(|err| {
+                    EnsureAddressError::AddrObject {
+                        request: AddressRequest::Dhcp,
+                        zone: self.inner.name.clone(),
+                        err,
+                    }
+                })?;
             // If the port is using IPv6 addressing we still want it to use
             // DHCP(v6) which requires first creating a link-local address.
             Zones::ensure_has_link_local_v6_address(zone, &addrobj)
@@ -430,15 +439,13 @@ impl RunningZone {
                             )
                         })?;
 
-                    // Ipv6Addr::is_unicast_link_local is sadly not stable
-                    let is_ll =
-                        |ip: Ipv6Addr| (ip.segments()[0] & 0xffc0) == 0xfe80;
-
                     // Look for a non link-local addr
                     addrs
                         .into_iter()
                         .find(|addr| match addr {
-                            IpNetwork::V6(ip) => !is_ll(ip.ip()),
+                            IpNetwork::V6(ip) => {
+                                !ip.ip().is_unicast_link_local()
+                            }
                             _ => false,
                         })
                         .ok_or_else(|| {
@@ -458,8 +465,9 @@ impl RunningZone {
                     );
                 },
             )
-            .await
+            .await?;
         }
+        Ok(())
     }
 
     pub fn add_default_route(
diff --git a/nexus/db-queries/src/db/datastore/address_lot.rs b/nexus/db-queries/src/db/datastore/address_lot.rs
index 8ac999eb53e..98d351c8701 100644
--- a/nexus/db-queries/src/db/datastore/address_lot.rs
+++ b/nexus/db-queries/src/db/datastore/address_lot.rs
@@ -95,22 +95,6 @@ impl DataStore {
                 let found_blocks: Vec<AddressLotBlock> =
                     block_dsl::address_lot_block
                         .filter(block_dsl::address_lot_id.eq(db_lot.id()))
-                        .filter(
-                            block_dsl::first_address.eq_any(
-                                desired_blocks
-                                    .iter()
-                                    .map(|b| b.first_address)
-                                    .collect::<Vec<_>>(),
-                            ),
-                        )
-                        .filter(
-                            block_dsl::last_address.eq_any(
-                                desired_blocks
-                                    .iter()
-                                    .map(|b| b.last_address)
-                                    .collect::<Vec<_>>(),
-                            ),
-                        )
                         .get_results_async(&conn)
                         .await?;
 
@@ -118,7 +102,7 @@ impl DataStore {
 
                 // If the block is found in the database, use the found block.
                 // If the block is not found in the database, insert it.
-                for desired_block in desired_blocks {
+                for desired_block in &desired_blocks {
                     let block = match found_blocks.iter().find(|db_b| {
                         db_b.first_address == desired_block.first_address
                             && db_b.last_address == desired_block.last_address
@@ -126,7 +110,7 @@ impl DataStore {
                         Some(block) => block.clone(),
                         None => {
                             diesel::insert_into(block_dsl::address_lot_block)
-                                .values(desired_block)
+                                .values(desired_block.clone())
                                 .returning(AddressLotBlock::as_returning())
                                 .get_results_async(&conn)
                                 .await?[0]
@@ -136,6 +120,21 @@ impl DataStore {
                     blocks.push(block);
                 }
 
+                // If the block is found in the database, but not desired,
+                // remove it.
+                for found_block in &found_blocks {
+                    if !desired_blocks.iter().any(|x| {
+                        x.first_address == found_block.first_address
+                            && x.last_address == found_block.last_address
+                    }) {
+                        diesel::delete(block_dsl::address_lot_block)
+                            .filter(block_dsl::address_lot_id.eq(db_lot.id()))
+                            .filter(block_dsl::id.eq(found_block.id))
+                            .execute_async(&conn)
+                            .await?;
+                    }
+                }
+
                 Ok(AddressLotCreateResult { lot: db_lot, blocks })
             })
             .await
diff --git a/nexus/external-api/src/lib.rs b/nexus/external-api/src/lib.rs
index 03751e73a9a..bc2f3ed96c0 100644
--- a/nexus/external-api/src/lib.rs
+++ b/nexus/external-api/src/lib.rs
@@ -1696,7 +1696,7 @@ pub trait NexusExternalApi {
 
     /// Create instance
     #[endpoint {
-        operation_id = "disk_create",
+        operation_id = "instance_create",
         method = POST,
         path = "/v1/instances",
         tags = ["instances"],
diff --git a/nexus/internal-api/src/lib.rs b/nexus/internal-api/src/lib.rs
index b0d31947025..a211aa868d6 100644
--- a/nexus/internal-api/src/lib.rs
+++ b/nexus/internal-api/src/lib.rs
@@ -237,6 +237,13 @@ pub trait NexusInternalApi {
 
     /// Fetch NAT ChangeSet
     ///
+    /// NOTE: This is no longer just IPv4, it includes IPv6. However, this API
+    /// cannot have forward-incompatable changes (e.g. clients running against
+    /// new API definitions need to be able to talk to older server still) so
+    /// we cannot add a generic nat_changeset API endpoint which would only be
+    /// backwards compatiable. So for the time being we are stuck with this
+    /// misleading name.
+    ///
     /// Caller provides their generation as `from_gen`, along with a query
     /// parameter for the page size (`limit`). Endpoint will return changes
     /// that have occured since the caller's generation number up to the latest
diff --git a/nexus/src/app/background/tasks/nat_cleanup.rs b/nexus/src/app/background/tasks/nat_cleanup.rs
index 9efe1c7506b..5f6d3754c1d 100644
--- a/nexus/src/app/background/tasks/nat_cleanup.rs
+++ b/nexus/src/app/background/tasks/nat_cleanup.rs
@@ -92,7 +92,7 @@ impl BackgroundTask for Ipv4NatGarbageCollector {
             }
 
             for client in dpd_clients.values() {
-                let response = client.ipv4_nat_generation().await;
+                let response = client.nat_generation().await;
                 match response {
                     Ok(r#gen) => min_gen = std::cmp::min(min_gen, *r#gen),
                     Err(error) => {
diff --git a/nexus/src/app/background/tasks/sync_service_zone_nat.rs b/nexus/src/app/background/tasks/sync_service_zone_nat.rs
index 3483d439c20..9c70fa4ce31 100644
--- a/nexus/src/app/background/tasks/sync_service_zone_nat.rs
+++ b/nexus/src/app/background/tasks/sync_service_zone_nat.rs
@@ -275,7 +275,7 @@ impl BackgroundTask for ServiceZoneNatTracker {
                 };
 
                 for (_location, client) in dpd_clients {
-                    if let Err(e) = client.ipv4_nat_trigger_update().await {
+                    if let Err(e) = client.nat_trigger_update().await {
                         error!(
                             &log,
                             "failed to trigger dpd rpw workflow";
diff --git a/nexus/src/app/instance_network.rs b/nexus/src/app/instance_network.rs
index ab5f1d066d1..1a34605ab6e 100644
--- a/nexus/src/app/instance_network.rs
+++ b/nexus/src/app/instance_network.rs
@@ -510,7 +510,7 @@ pub(crate) async fn probe_ensure_dpd_config(
     // Notify dendrite that there are changes for it to reconcile.
     // In the event of a failure to notify dendrite, we'll log an error
     // and rely on dendrite's RPW timer to catch it up.
-    if let Err(e) = dpd_client.ipv4_nat_trigger_update().await {
+    if let Err(e) = dpd_client.nat_trigger_update().await {
         error!(log, "failed to notify dendrite of nat updates"; "error" => ?e);
     };
 
@@ -642,7 +642,7 @@ pub(crate) async fn probe_delete_dpd_config(
         // Notify dendrite that there are changes for it to reconcile.
         // In the event of a failure to notify dendrite, we'll log an error
         // and rely on dendrite's RPW timer to catch it up.
-        if let Err(e) = dpd_client.ipv4_nat_trigger_update().await {
+        if let Err(e) = dpd_client.nat_trigger_update().await {
             error!(log, "failed to notify dendrite of nat updates"; "error" => ?e);
         };
     }
@@ -762,7 +762,7 @@ async fn notify_dendrite_nat_state(
         // Notify dendrite that there are changes for it to reconcile.
         // In the event of a failure to notify dendrite, we'll log an error
         // and rely on dendrite's RPW timer to catch it up.
-        if let Err(e) = dpd_client.ipv4_nat_trigger_update().await {
+        if let Err(e) = dpd_client.nat_trigger_update().await {
             error!(log, "failed to notify dendrite of nat updates"; "error" => ?e);
         };
     }
diff --git a/nexus/src/internal_api/http_entrypoints.rs b/nexus/src/internal_api/http_entrypoints.rs
index 774ff419def..ece90cf28f5 100644
--- a/nexus/src/internal_api/http_entrypoints.rs
+++ b/nexus/src/internal_api/http_entrypoints.rs
@@ -16,6 +16,7 @@ use dropshot::Query;
 use dropshot::RequestContext;
 use dropshot::ResultsPage;
 use dropshot::TypedBody;
+use nexus_internal_api::ProbeInfo;
 use nexus_internal_api::*;
 use nexus_types::internal_api::params::SledAgentInfo;
 use nexus_types::internal_api::params::SwitchPutRequest;
@@ -409,8 +410,6 @@ impl NexusInternalApi for NexusInternalApiImpl {
             .await
     }
 
-    // NAT RPW internal APIs
-
     async fn ipv4_nat_changeset(
         rqctx: RequestContext<Self::Context>,
         path_params: Path<RpwNatPathParam>,
diff --git a/nexus/tests/integration_tests/address_lots.rs b/nexus/tests/integration_tests/address_lots.rs
index 5637e0ab48d..3a52825f3b4 100644
--- a/nexus/tests/integration_tests/address_lots.rs
+++ b/nexus/tests/integration_tests/address_lots.rs
@@ -39,7 +39,7 @@ async fn test_address_lot_basic_crud(ctx: &ControlPlaneTestContext) {
     assert_eq!(lots.len(), 1, "Expected one lot");
 
     // Create a lot
-    let params = AddressLotCreate {
+    let mut params = AddressLotCreate {
         identity: IdentityMetadataCreateParams {
             name: "parkinglot".parse().unwrap(),
             description: "an address parking lot".into(),
@@ -124,6 +124,39 @@ async fn test_address_lot_basic_crud(ctx: &ControlPlaneTestContext) {
 
     assert_eq!(blist.len(), 1, "Expected 1 address lot block");
     assert_eq!(blist[0], blocks[0]);
+
+    // add a block to a lot
+    params.blocks.push(AddressLotBlockCreate {
+        first_address: "fd00:203:113::10".parse().unwrap(),
+        last_address: "fd00:203:113::20".parse().unwrap(),
+    });
+    let response: AddressLotCreateResponse = NexusRequest::objects_post(
+        client,
+        "/v1/system/networking/address-lot",
+        &params,
+    )
+    .authn_as(AuthnMode::PrivilegedUser)
+    .execute()
+    .await
+    .unwrap()
+    .parsed_body()
+    .unwrap();
+    assert_eq!(response.blocks.len(), params.blocks.len());
+
+    // remove block from lot
+    params.blocks.pop();
+    let response: AddressLotCreateResponse = NexusRequest::objects_post(
+        client,
+        "/v1/system/networking/address-lot",
+        &params,
+    )
+    .authn_as(AuthnMode::PrivilegedUser)
+    .execute()
+    .await
+    .unwrap()
+    .parsed_body()
+    .unwrap();
+    assert_eq!(response.blocks.len(), params.blocks.len());
 }
 
 #[nexus_test]
diff --git a/package-manifest.toml b/package-manifest.toml
index 81556853f23..3ed704cbd92 100644
--- a/package-manifest.toml
+++ b/package-manifest.toml
@@ -654,10 +654,10 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "205b3ccf75b527ac7a565285fdcc0c78f4fcee95"
+source.commit = "3877aa0467fe275806f07ff4f7e92efa43e6fa6d"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/mg-ddm-gz.sha256.txt
-source.sha256 = "fa122dfaf77b1c060f19ca0e044f57044342c8c2b444595ca156ac8885852ebe"
+source.sha256 = "c317e4bd2958324a6de2b5eba3380cd3b4071617676684213eb6ddbd33087118"
 output.type = "tarball"
 
 [package.mg-ddm]
@@ -670,10 +670,10 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "205b3ccf75b527ac7a565285fdcc0c78f4fcee95"
+source.commit = "3877aa0467fe275806f07ff4f7e92efa43e6fa6d"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/mg-ddm.sha256.txt
-source.sha256 = "14c8f3f77149c5aa217f56b57585eb1bcffc507d04910e84fc87c033cbe0ef39"
+source.sha256 = "e74b8bd7bc8384dec558a5afafc624c67e9704a2a976f5cb75664f62d969bd97"
 output.type = "zone"
 output.intermediate_only = true
 
@@ -685,10 +685,10 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "205b3ccf75b527ac7a565285fdcc0c78f4fcee95"
+source.commit = "3877aa0467fe275806f07ff4f7e92efa43e6fa6d"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/mgd.sha256.txt
-source.sha256 = "53576d28cae4304db61367d687580e9b96da23e647898b9034fdfa1603376b0c"
+source.sha256 = "c32c66f81c2a6b9149d97c83153327e7d6897c53e047ae425291bd622d8559ec"
 output.type = "zone"
 output.intermediate_only = true
 
@@ -736,8 +736,8 @@ only_for_targets.image = "standard"
 # the other `source.*` keys.
 source.type = "prebuilt"
 source.repo = "dendrite"
-source.commit = "ab30fa91227fd478bfe0e023310ca83dec0bc22b"
-source.sha256 = "a5361a24136fbf4d61ce73063c4e69dca08c4a017cf1aa469c41b62a2e86f280"
+source.commit = "21fbf39f63b25567b25aeadf0d9a73a01c842512"
+source.sha256 = "5fdf1716837b30cad74815d853339694233bdd57ed660890d6dc3dec5b9faa5d"
 output.type = "zone"
 output.intermediate_only = true
 
@@ -763,8 +763,8 @@ only_for_targets.image = "standard"
 # the other `source.*` keys.
 source.type = "prebuilt"
 source.repo = "dendrite"
-source.commit = "ab30fa91227fd478bfe0e023310ca83dec0bc22b"
-source.sha256 = "cca55b7a4995034e4217bddcf97230e18538089162ef413db5e30466b9e2ef8e"
+source.commit = "21fbf39f63b25567b25aeadf0d9a73a01c842512"
+source.sha256 = "4c2169695baa344cf031b7445246a32debaa53fc8a0bb8ad0e5ca51d2a6d1acb"
 output.type = "zone"
 output.intermediate_only = true
 
@@ -783,8 +783,8 @@ only_for_targets.image = "standard"
 # the other `source.*` keys.
 source.type = "prebuilt"
 source.repo = "dendrite"
-source.commit = "ab30fa91227fd478bfe0e023310ca83dec0bc22b"
-source.sha256 = "272c5b9e927f6c271afb9b9e54a21d14ed0d7d9d319a17c22187fa86a17197ea"
+source.commit = "21fbf39f63b25567b25aeadf0d9a73a01c842512"
+source.sha256 = "2ba8711482b4f96ada44ee5b1ac5543a693d5d7b62ae502357d019d95677e55b"
 output.type = "zone"
 output.intermediate_only = true
 
diff --git a/tools/dendrite_stub_checksums b/tools/dendrite_stub_checksums
index be676840875..d49c44a5ce3 100644
--- a/tools/dendrite_stub_checksums
+++ b/tools/dendrite_stub_checksums
@@ -1,3 +1,3 @@
-CIDL_SHA256_ILLUMOS="a5361a24136fbf4d61ce73063c4e69dca08c4a017cf1aa469c41b62a2e86f280"
-CIDL_SHA256_LINUX_DPD="6c914499455477d0e4f9b30c2c2522363b2b8ee8bc11f9ca0b316a0f1b6bc0f2"
-CIDL_SHA256_LINUX_SWADM="a178107fe8dfca66eed4190563d9ae563763d62dfcc1f411f4eca1d4330d9c64"
+CIDL_SHA256_ILLUMOS="5fdf1716837b30cad74815d853339694233bdd57ed660890d6dc3dec5b9faa5d"
+CIDL_SHA256_LINUX_DPD="b04cd77fb06b88be84d7dd7200af25876cd17227f4eadce92c4d50694d7e78f5"
+CIDL_SHA256_LINUX_SWADM="173e694c14d812bb7200f63496dc4f4189ce571a41286707cb106ea33144568c"
diff --git a/tools/dendrite_version b/tools/dendrite_version
index a7526dabf5f..d5ee005e7ca 100644
--- a/tools/dendrite_version
+++ b/tools/dendrite_version
@@ -1 +1 @@
-COMMIT="ab30fa91227fd478bfe0e023310ca83dec0bc22b"
+COMMIT="21fbf39f63b25567b25aeadf0d9a73a01c842512"
diff --git a/tools/maghemite_ddm_openapi_version b/tools/maghemite_ddm_openapi_version
index 65569a7a3ab..9e65032fcf7 100644
--- a/tools/maghemite_ddm_openapi_version
+++ b/tools/maghemite_ddm_openapi_version
@@ -1 +1 @@
-COMMIT="205b3ccf75b527ac7a565285fdcc0c78f4fcee95"
+COMMIT="3877aa0467fe275806f07ff4f7e92efa43e6fa6d"
diff --git a/tools/maghemite_mg_openapi_version b/tools/maghemite_mg_openapi_version
index 65569a7a3ab..9e65032fcf7 100644
--- a/tools/maghemite_mg_openapi_version
+++ b/tools/maghemite_mg_openapi_version
@@ -1 +1 @@
-COMMIT="205b3ccf75b527ac7a565285fdcc0c78f4fcee95"
+COMMIT="3877aa0467fe275806f07ff4f7e92efa43e6fa6d"
diff --git a/tools/maghemite_mgd_checksums b/tools/maghemite_mgd_checksums
index 12228122372..04be9e0172e 100644
--- a/tools/maghemite_mgd_checksums
+++ b/tools/maghemite_mgd_checksums
@@ -1,2 +1,2 @@
-CIDL_SHA256="53576d28cae4304db61367d687580e9b96da23e647898b9034fdfa1603376b0c"
-MGD_LINUX_SHA256="118a3bac35064cd231dfd123a3d6c7aa308fdf099b4ba045dcdfac6fbb4aae92"
\ No newline at end of file
+CIDL_SHA256="c32c66f81c2a6b9149d97c83153327e7d6897c53e047ae425291bd622d8559ec"
+MGD_LINUX_SHA256="c158e06e62ad58dd23c2ab6009b9b6002185c758ed1d972c7243e915cce447e1"
diff --git a/tools/opte_version_override b/tools/opte_version_override
index 8d57f7ae9f4..cf3b7e676eb 100644
--- a/tools/opte_version_override
+++ b/tools/opte_version_override
@@ -2,4 +2,4 @@
 
 # only set this if you want to override the version of opte/xde installed by the
 # install_opte.sh script
-OPTE_COMMIT=""
+OPTE_COMMIT="a1ed0960673b6ca2e6b68835537f53cc86110a77"