diff --git a/Dockerfile.dapper b/Dockerfile.dapper
index de2f5401..7e83f1c4 100644
--- a/Dockerfile.dapper
+++ b/Dockerfile.dapper
@@ -4,10 +4,10 @@ FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea264
 ENV DEBIAN_FRONTEND=noninteractive
 ARG GO_VERSION=1.27.0
 ARG GO_SHA256=675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685
-ARG UBUNTU_SNAPSHOT=20260825T000000Z
+ARG UBUNTU_SNAPSHOT=20260909T000000Z
 
 ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 \
-    https://snapshot.ubuntu.com/ubuntu/20260825T000000Z/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb \
+    https://snapshot.ubuntu.com/ubuntu/20260909T000000Z/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb \
     /tmp/ca-certificates.deb
 ENV GOPATH=/go
 ENV GOROOT=/usr/local/go
@@ -31,6 +31,7 @@ RUN set -eux; \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         build-essential \
+        linux-libc-dev=7.0.0-31.31 \
         curl \
         git \
         tar \
diff --git a/README.md b/README.md
index 8b5aa5ce..ba415579 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 
 ## Project status
 
-This is a reviewed migration candidate based on the preserved upstream `v0.39.4` boundary. Existing Ubuntu 26.04, Go 1.27.0, dependency, driver checksum, jailer, and test maintenance is retained. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files. Driver publication and production deployment remain disabled while the complete Server release is assembled.
+The current reviewed compatibility release is `v0.39.7`, based on the preserved upstream `v0.39.4` boundary and consumed by PastureStack Server `v1.6.410`. Existing Ubuntu 26.04, Go 1.27.0, dependency, driver checksum, jailer, and test maintenance is retained. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files.
 
 ## Configuration
 
@@ -26,7 +26,7 @@ make package
 
 Dependencies are locked by `go.mod` and `go.sum`, and builds use the checked-in `vendor/` tree without network access. The machine RPC layer follows the maintained GitLab Docker Machine fork at `v0.16.2-gitlab.52`; only the packages used by Host Provisioner are shipped. The Rancher 1.6 event and API clients are retained as explicit compatibility modules under `third_party/`, so their frozen protocol surface is reviewable without treating abandoned upstream repositories as live package sources.
 
-The build container does not receive the host Docker socket. For the reviewed Server release, build with `VERSION_OVERRIDE=v0.39.5` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic Release asset `host-provisioner-0.39.5-linux-amd64.tar.xz`. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads that asset from its versioned GitHub Release and verifies its SHA-256 digest before installation. Users do not need to host a package mirror.
+The build container does not receive the host Docker socket. For the reviewed Server release, build with `VERSION_OVERRIDE=v0.39.7` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic Release asset `host-provisioner-0.39.7-linux-amd64.tar.xz`. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads that asset from its versioned GitHub Release and verifies its SHA-256 digest before installation. Users do not need to host a package mirror.
 
 See [COMPATIBILITY.md](COMPATIBILITY.md), [SECURITY.md](SECURITY.md), and [ORIGIN.md](ORIGIN.md).