diff --git a/ports/bde/apple-clang-sized-deallocation.patch b/ports/bde/apple-clang-sized-deallocation.patch
new file mode 100644
index 00000000000000..02441f68373de5
--- /dev/null
+++ b/ports/bde/apple-clang-sized-deallocation.patch
@@ -0,0 +1,18 @@
+diff --git a/groups/bsl/bsls/bsls_compilerfeatures.cpp b/groups/bsl/bsls/bsls_compilerfeatures.cpp
+index 40d367d..f3b5c46 100644
+--- a/groups/bsl/bsls/bsls_compilerfeatures.cpp
++++ b/groups/bsl/bsls/bsls_compilerfeatures.cpp
+@@ -450,9 +450,11 @@ BSLS_IDENT("$Id$ $CSID$")
+ // removing the enforcement from here.
+ # if !defined(BSLS_PLATFORM_CMP_CLANG) \
+            || BSLS_PLATFORM_CMP_VERSION >= 190000
+-#   ifndef __cpp_sized_deallocation
++#   if !defined(__apple_build_version__) && \
++       !defined(__cpp_sized_deallocation)
+ #     error __cpp_sized_deallocation is not defined
+-#   elif __cpp_sized_deallocation < 201309L
++#   elif !defined(__apple_build_version__) && \
++         __cpp_sized_deallocation < 201309L
+ #     error __cpp_sized_deallocation does not suport C++17
+ #   endif
+ #   ifndef __cpp_template_template_args
diff --git a/ports/bde/portfile.cmake b/ports/bde/portfile.cmake
index 89c2141b3b71bb..bb3dec9b3b75f8 100644
--- a/ports/bde/portfile.cmake
+++ b/ports/bde/portfile.cmake
@@ -28,6 +28,7 @@ vcpkg_from_github(
     PATCHES
         fix-bdlar-target.patch
         use-vcpkg-pcre2.patch
+        apple-clang-sized-deallocation.patch
 )
 
 vcpkg_cmake_configure(
diff --git a/ports/bde/vcpkg.json b/ports/bde/vcpkg.json
index 2fb4ad615d545e..d1807deeed121a 100644
--- a/ports/bde/vcpkg.json
+++ b/ports/bde/vcpkg.json
@@ -2,6 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg-tool/main/docs/vcpkg.schema.json",
   "name": "bde",
   "version": "4.38.0.0",
+  "port-version": 1,
   "description": "Basic Development Environment - a set of foundational C++ libraries used at Bloomberg.",
   "homepage": "https://github.com/bloomberg/bde",
   "documentation": "https://bloomberg.github.io/bde/",
diff --git a/ports/cyrus-sasl/portfile.cmake b/ports/cyrus-sasl/portfile.cmake
index 8ae1ef085c363d..b1d42fbf3f2f6c 100644
--- a/ports/cyrus-sasl/portfile.cmake
+++ b/ports/cyrus-sasl/portfile.cmake
@@ -93,6 +93,7 @@ else()
             --with-dblib=lmdb
             --with-gss_impl=mit
             --disable-macos-framework
+            ac_cv_prog_cc_c23=no
     )
     vcpkg_make_install()
 endif()
diff --git a/ports/cyrus-sasl/vcpkg.json b/ports/cyrus-sasl/vcpkg.json
index 0b1c23df00e412..702ece3db88888 100644
--- a/ports/cyrus-sasl/vcpkg.json
+++ b/ports/cyrus-sasl/vcpkg.json
@@ -1,7 +1,7 @@
 {
   "name": "cyrus-sasl",
   "version": "2.1.28",
-  "port-version": 4,
+  "port-version": 5,
   "description": "Cyrus SASL is an implementation of SASL that makes it easy for application developers to integrate authentication mechanisms into their application in a generic way.",
   "homepage": "https://github.com/cyrusimap/cyrus-sasl",
   "license": null,
diff --git a/ports/glpk/fix-c23-bool.patch b/ports/glpk/fix-c23-bool.patch
new file mode 100644
index 00000000000000..fb189d70e70eec
--- /dev/null
+++ b/ports/glpk/fix-c23-bool.patch
@@ -0,0 +1,17 @@
+diff --git a/src/minisat/minisat.h b/src/minisat/minisat.h
+index 2733e8d..00841f0 100644
+--- a/src/minisat/minisat.h
++++ b/src/minisat/minisat.h
+@@ -34,10 +34,12 @@
+ /*====================================================================*/
+ /* Simple types: */
+ 
++#if !defined(__STDC_VERSION__) || __STDC_VERSION__ < 202311L
+ typedef int bool;
+ 
+ #define true  1
+ #define false 0
++#endif
+ 
+ typedef int  lit;
+ #if 0 /* by mao */
diff --git a/ports/glpk/portfile.cmake b/ports/glpk/portfile.cmake
index 9fd4a88230e554..853cfd9f1d67af 100644
--- a/ports/glpk/portfile.cmake
+++ b/ports/glpk/portfile.cmake
@@ -12,9 +12,10 @@ vcpkg_extract_source_archive(
     ARCHIVE "${DISTFILE}"
     PATCHES
         configure.ac.patch
+        fix-c23-bool.patch
 )
 
-vcpkg_list(SET CONFIGURE_OPTIONS)
+vcpkg_list(SET CONFIGURE_OPTIONS ac_cv_prog_cc_c23=no)
 if("dl" IN_LIST FEATURES)
     vcpkg_list(APPEND CONFIGURE_OPTIONS --enable-dl=dlfcn "LIBS=-ldl \$LIBS")
 else()
diff --git a/ports/glpk/vcpkg.json b/ports/glpk/vcpkg.json
index 58e820d435eb21..5ca8f32bc8c6fe 100644
--- a/ports/glpk/vcpkg.json
+++ b/ports/glpk/vcpkg.json
@@ -2,7 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg-tool/main/docs/vcpkg.schema.json",
   "name": "glpk",
   "version": "5.0",
-  "port-version": 3,
+  "port-version": 5,
   "maintainers": "Fabio A. Correa Duran",
   "description": [
     "The GNU Linear Programming Kit (GLPK) solves large-scale linear programming (LP), mixed integer programming (MIP), and related problems.",
diff --git a/ports/highs/portfile.cmake b/ports/highs/portfile.cmake
index fa7bfb247220bd..6e4da6dd10bed3 100644
--- a/ports/highs/portfile.cmake
+++ b/ports/highs/portfile.cmake
@@ -4,6 +4,8 @@ vcpkg_from_github(
     REF "v1.14.0"
     SHA512 d4c2d09bf41384a58a04528ffaac223eee40dea4a1cadaea369791f6e8d1aa61ff3fce57e7c97cb5f4bef0f1305681066e8ef7483f4471770295f95b9ec337f7
     HEAD_REF master
+    PATCHES
+        respect-user-selected-compiler.patch
 )
 
 vcpkg_cmake_configure(
diff --git a/ports/highs/respect-user-selected-compiler.patch b/ports/highs/respect-user-selected-compiler.patch
new file mode 100644
index 00000000000000..0e2f5d13536af7
--- /dev/null
+++ b/ports/highs/respect-user-selected-compiler.patch
@@ -0,0 +1,20 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 1dc3a98..5427d1e 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -6,15 +6,6 @@
+ # policies up to CMake 3.27
+ cmake_minimum_required(VERSION 3.15...3.27)
+ 
+-# set preference for clang compiler and intel compiler over gcc and other compilers
+-include(Platform/${CMAKE_SYSTEM_NAME}-Determine-C OPTIONAL)
+-include(Platform/${CMAKE_SYSTEM_NAME}-C OPTIONAL)
+-set(CMAKE_C_COMPILER_NAMES clang gcc icx cc ${CMAKE_C_COMPILER_NAMES})
+-
+-include(Platform/${CMAKE_SYSTEM_NAME}-Determine-CXX OPTIONAL)
+-include(Platform/${CMAKE_SYSTEM_NAME}-CXX OPTIONAL)
+-set(CMAKE_CXX_COMPILER_NAMES clang++ g++ icpx c++ ${CMAKE_CXX_COMPILER_NAMES})
+-
+ list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake")
+ 
+ include(set-version)
diff --git a/ports/highs/vcpkg.json b/ports/highs/vcpkg.json
index 08a1f4851c1ae1..66e76929ad290a 100644
--- a/ports/highs/vcpkg.json
+++ b/ports/highs/vcpkg.json
@@ -1,6 +1,7 @@
 {
   "name": "highs",
   "version": "1.14.0",
+  "port-version": 1,
   "description": "High performance library to solve linear, mixed-integer, and convex quadratic optimization problems.",
   "homepage": "https://highs.dev",
   "license": "MIT",
diff --git a/ports/krb5/autoconf-2.72.patch b/ports/krb5/autoconf-2.72.patch
new file mode 100644
index 00000000000000..98fa8342167f03
--- /dev/null
+++ b/ports/krb5/autoconf-2.72.patch
@@ -0,0 +1,12 @@
+diff --git a/src/configure.ac b/src/configure.ac
+index 4325fae..2865a26 100644
+--- a/src/configure.ac
++++ b/src/configure.ac
+@@ -1,4 +1,6 @@
+-K5_AC_INIT([aclocal.m4])
++AC_INIT(Kerberos 5, K5_VERSION, K5_BUGADDR, krb5)
++AC_CONFIG_SRCDIR([aclocal.m4])
++build_dynobj=no
+ 
+ # If $runstatedir isn't set by autoconf (<2.70), set it manually.
+ if test x"$runstatedir" = x; then
diff --git a/ports/krb5/portfile.cmake b/ports/krb5/portfile.cmake
index f789718ad19a5e..7383685d8184f4 100644
--- a/ports/krb5/portfile.cmake
+++ b/ports/krb5/portfile.cmake
@@ -7,6 +7,7 @@ vcpkg_from_github(
     PATCHES
         static-deps.diff
         define-des-zeroblock.diff
+        autoconf-2.72.patch
 )
 
 if (VCPKG_TARGET_IS_WINDOWS AND NOT VCPKG_TARGET_IS_MINGW)
diff --git a/ports/krb5/vcpkg.json b/ports/krb5/vcpkg.json
index 74988fefeee8db..051011392ca1ad 100644
--- a/ports/krb5/vcpkg.json
+++ b/ports/krb5/vcpkg.json
@@ -2,7 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg-tool/main/docs/vcpkg.schema.json",
   "name": "krb5",
   "version": "1.22.2",
-  "port-version": 1,
+  "port-version": 2,
   "description": [
     "Kerberos is a network authentication protocol.",
     "It is designed to provide strong authentication for client/server applications by using secret-key cryptography.",
diff --git a/ports/libtar/fix-c23-prototypes.patch b/ports/libtar/fix-c23-prototypes.patch
new file mode 100644
index 00000000000000..d6c357fbd0fd4e
--- /dev/null
+++ b/ports/libtar/fix-c23-prototypes.patch
@@ -0,0 +1,28 @@
+diff --git a/compat/basename.c b/compat/basename.c
+index 2ac1e13..7b0384a 100644
+--- a/compat/basename.c
++++ b/compat/basename.c
+@@ -36,8 +36,7 @@ static char rcsid[] = "$OpenBSD: basename.c,v 1.4 1999/05/30 17:10:30 espie Exp
+ #include <sys/param.h>
+ 
+ char *
+-openbsd_basename(path)
+-	const char *path;
++openbsd_basename(const char *path)
+ {
+ 	static char bname[MAXPATHLEN];
+ 	register const char *endp, *startp;
+diff --git a/compat/dirname.c b/compat/dirname.c
+index 986db4a..b51f6a4 100644
+--- a/compat/dirname.c
++++ b/compat/dirname.c
+@@ -36,8 +36,7 @@ static char rcsid[] = "$OpenBSD: dirname.c,v 1.4 1999/05/30 17:10:30 espie Exp $
+ #include <sys/param.h>
+ 
+ char *
+-openbsd_dirname(path)
+-	const char *path;
++openbsd_dirname(const char *path)
+ {
+ 	static char bname[MAXPATHLEN];
+ 	register const char *endp;
diff --git a/ports/libtar/fix-cross-install-strip.patch b/ports/libtar/fix-cross-install-strip.patch
new file mode 100644
index 00000000000000..86ed801b277b34
--- /dev/null
+++ b/ports/libtar/fix-cross-install-strip.patch
@@ -0,0 +1,13 @@
+diff --git a/libtar/Makefile.in b/libtar/Makefile.in
+index c7f066d..876d08e 100644
+--- a/libtar/Makefile.in
++++ b/libtar/Makefile.in
+@@ -19,7 +19,7 @@ SHELL           = @SHELL@
+ 
+ ### Installation programs and flags
+ INSTALL		= @INSTALL@
+-INSTALL_PROGRAM	= @INSTALL_PROGRAM@ -s
++INSTALL_PROGRAM	= @INSTALL_PROGRAM@
+ INSTALL_DATA	= @INSTALL_DATA@
+ LN_S		= @LN_S@
+ MKDIR		= @MKDIR@
diff --git a/ports/libtar/portfile.cmake b/ports/libtar/portfile.cmake
index cf344c37a0219f..65914c53212302 100644
--- a/ports/libtar/portfile.cmake
+++ b/ports/libtar/portfile.cmake
@@ -4,7 +4,13 @@ vcpkg_download_distfile(ARCHIVE
     SHA512 907d98ea2bd2e2a43604243fc7fd6c252aa02c3fdd79e21f2a784adf821cb18107e6e23a25ad0c64329fbe84e859da5c807272759a8bcd85a37b929c80af4a13
 )
 
-vcpkg_extract_source_archive(SOURCE_PATH ARCHIVE "${ARCHIVE}")
+vcpkg_extract_source_archive(
+    SOURCE_PATH
+    ARCHIVE "${ARCHIVE}"
+    PATCHES
+        fix-c23-prototypes.patch
+        fix-cross-install-strip.patch
+)
 
 vcpkg_configure_make(
     SOURCE_PATH "${SOURCE_PATH}"
diff --git a/ports/libtar/vcpkg.json b/ports/libtar/vcpkg.json
index 8b797b35b5e1d1..da82e71ff24867 100644
--- a/ports/libtar/vcpkg.json
+++ b/ports/libtar/vcpkg.json
@@ -1,7 +1,7 @@
 {
   "name": "libtar",
   "version": "1.2.20",
-  "port-version": 1,
+  "port-version": 3,
   "description": "libtar - C library for manipulating tar files",
   "homepage": "https://repo.or.cz/libtar.git",
   "supports": "!windows"
diff --git a/ports/nettle/fix-c23-prototypes.patch b/ports/nettle/fix-c23-prototypes.patch
new file mode 100644
index 00000000000000..0fc0e5be7c2d02
--- /dev/null
+++ b/ports/nettle/fix-c23-prototypes.patch
@@ -0,0 +1,26 @@
+diff --git a/getopt.c b/getopt.c
+index 9d29de7..5b89302 100644
+--- a/getopt.c
++++ b/getopt.c
+@@ -136,7 +136,7 @@ static struct _getopt_data getopt_data;
+    whose names are inconsistent.  */
+ 
+ #ifndef getenv
+-extern char *getenv ();
++extern char *getenv (const char *);
+ #endif
+ 
+ #endif /* not __GNU_LIBRARY__ */
+diff --git a/getopt.h b/getopt.h
+index da1a01f..801ced5 100644
+--- a/getopt.h
++++ b/getopt.h
+@@ -166,7 +166,7 @@ extern int __posix_getopt (int ___argc, char *const *___argv,
+ #  endif
+ # endif
+ #else /* not __GNU_LIBRARY__ */
+-extern int getopt ();
++extern int getopt (int, char *const *, const char *);
+ #endif /* __GNU_LIBRARY__ */
+ 
+ #ifndef __need_getopt
diff --git a/ports/nettle/portfile.cmake b/ports/nettle/portfile.cmake
index 26ff533b3d48ee..fcecc39d310208 100644
--- a/ports/nettle/portfile.cmake
+++ b/ports/nettle/portfile.cmake
@@ -12,6 +12,7 @@ vcpkg_from_gitlab(
         host-tools.patch
         ccas.patch
         msvc-support.patch
+        fix-c23-prototypes.patch
 )
 
 vcpkg_cmake_get_vars(cmake_vars_file)
diff --git a/ports/nettle/vcpkg.json b/ports/nettle/vcpkg.json
index 4ae4e73f8013ce..f857469261aae2 100644
--- a/ports/nettle/vcpkg.json
+++ b/ports/nettle/vcpkg.json
@@ -1,7 +1,7 @@
 {
   "name": "nettle",
   "version": "3.10",
-  "port-version": 1,
+  "port-version": 2,
   "description": "Nettle is a low-level cryptographic library that is designed to fit easily in more or less any context: In crypto toolkits for object-oriented languages (C++, Python, Pike, ...), in applications like LSH or GNUPG, or even in kernel space.",
   "homepage": "https://git.lysator.liu.se/nettle/nettle",
   "license": null,
diff --git a/ports/qt5-location/fix-boost-mpl-constant-expression.patch b/ports/qt5-location/fix-boost-mpl-constant-expression.patch
new file mode 100644
index 00000000000000..c0f621b9d04643
--- /dev/null
+++ b/ports/qt5-location/fix-boost-mpl-constant-expression.patch
@@ -0,0 +1,14 @@
+diff --git a/src/3rdparty/mapbox-gl-native/deps/boost/1.65.1/include/boost/mpl/aux_/integral_wrapper.hpp b/src/3rdparty/mapbox-gl-native/deps/boost/1.65.1/include/boost/mpl/aux_/integral_wrapper.hpp
+index 6bc05f7..f4e9acb 100644
+--- a/src/3rdparty/mapbox-gl-native/deps/boost/1.65.1/include/boost/mpl/aux_/integral_wrapper.hpp
++++ b/src/3rdparty/mapbox-gl-native/deps/boost/1.65.1/include/boost/mpl/aux_/integral_wrapper.hpp
+@@ -56,7 +56,8 @@ struct AUX_WRAPPER_NAME
+ // have to #ifdef here: some compilers don't like the 'N + 1' form (MSVC),
+ // while some other don't like 'value + 1' (Borland), and some don't like
+ // either
+-#if BOOST_WORKAROUND(__EDG_VERSION__, <= 243)
++#if BOOST_WORKAROUND(__EDG_VERSION__, <= 243) \
++    || __cplusplus >= 201103L
+  private:
+     BOOST_STATIC_CONSTANT(AUX_WRAPPER_VALUE_TYPE, next_value = BOOST_MPL_AUX_STATIC_CAST(AUX_WRAPPER_VALUE_TYPE, (N + 1)));
+     BOOST_STATIC_CONSTANT(AUX_WRAPPER_VALUE_TYPE, prior_value = BOOST_MPL_AUX_STATIC_CAST(AUX_WRAPPER_VALUE_TYPE, (N - 1)));
diff --git a/ports/qt5-location/portfile.cmake b/ports/qt5-location/portfile.cmake
index a708f81ed72813..92a7eaae75754b 100644
--- a/ports/qt5-location/portfile.cmake
+++ b/ports/qt5-location/portfile.cmake
@@ -1,3 +1,10 @@
 message(STATUS "${PORT} has a spurious failure in which it is unable to create a parent directory! Just retry.")
 include(${CURRENT_INSTALLED_DIR}/share/qt5/qt_port_functions.cmake)
-qt_submodule_installation(PATCHES missing-include.patch disable-enum-warning.patch add-stdint.diff add-float-cast.diff)
+qt_submodule_installation(
+    PATCHES
+        missing-include.patch
+        disable-enum-warning.patch
+        add-stdint.diff
+        add-float-cast.diff
+        fix-boost-mpl-constant-expression.patch
+)
diff --git a/ports/qt5-location/vcpkg.json b/ports/qt5-location/vcpkg.json
index a61ef66ca06cf5..e2838c5d2991cf 100644
--- a/ports/qt5-location/vcpkg.json
+++ b/ports/qt5-location/vcpkg.json
@@ -1,6 +1,7 @@
 {
   "name": "qt5-location",
   "version": "5.15.19",
+  "port-version": 1,
   "description": "The Qt Location API helps you create viable mapping solutions using the data available from some of the popular location services.",
   "license": null,
   "dependencies": [
diff --git a/ports/rubberband/fix-size-t.patch b/ports/rubberband/fix-size-t.patch
new file mode 100644
index 00000000000000..eb3c42544de6d8
--- /dev/null
+++ b/ports/rubberband/fix-size-t.patch
@@ -0,0 +1,13 @@
+diff --git a/src/common/mathmisc.h b/src/common/mathmisc.h
+index d8bcc14..eece584 100644
+--- a/src/common/mathmisc.h
++++ b/src/common/mathmisc.h
+@@ -24,6 +24,8 @@
+ #ifndef RUBBERBAND_MATHMISC_H
+ #define RUBBERBAND_MATHMISC_H
+ 
++#include <stddef.h>
++
+ #include "sysutils.h"
+ 
+ #ifndef M_PI
diff --git a/ports/rubberband/portfile.cmake b/ports/rubberband/portfile.cmake
index c9ae1b283e44bf..4371e7f5b9af0a 100644
--- a/ports/rubberband/portfile.cmake
+++ b/ports/rubberband/portfile.cmake
@@ -4,6 +4,8 @@ vcpkg_from_github(
     REF "v${VERSION}"
     SHA512 f581e900a71f78fde3361d2bed2fe165952c2ca087168c5f4e4994586bd832267eea58e0662a74b6a7430bc361fe80b5307b2ee6bf631a3561a8cba86e1cd3f2
     HEAD_REF default
+    PATCHES
+        fix-size-t.patch
 )
 
 
diff --git a/ports/rubberband/vcpkg.json b/ports/rubberband/vcpkg.json
index a543f1a566e999..82cd61573540e0 100644
--- a/ports/rubberband/vcpkg.json
+++ b/ports/rubberband/vcpkg.json
@@ -1,7 +1,7 @@
 {
   "name": "rubberband",
   "version": "4.0.0",
-  "port-version": 1,
+  "port-version": 2,
   "description": "A high quality software library for audio time-stretching and pitch-shifting.",
   "homepage": "https://www.breakfastquay.com/rubberband/",
   "license": "GPL-2.0-or-later",
diff --git a/scripts/azure-pipelines/osx/README.md b/scripts/azure-pipelines/osx/README.md
index 01936821636a92..070e4960bec7b2 100644
--- a/scripts/azure-pipelines/osx/README.md
+++ b/scripts/azure-pipelines/osx/README.md
@@ -1,19 +1,46 @@
-# `vcpkg-eg-mac` VMs
-
 This is the checklist for what the vcpkg team does when updating the macOS machines in the pool.
 
+The hosts do not accept incoming SSH connections. Perform all host-side work in a terminal opened
+through the KVM. Use the KVM software's "paste from clipboard" function to transfer commands and
+short-lived credentials to the host. SSH commands in this document connect from the host to its
+guest VM, not from a developer workstation to the host.
+
+Before publishing the VM update changes, update the Azure Agent URI in
+`scripts/azure-pipelines/osx/guest-prepare.sh` to the current version. You can find this by going to the
+agent pool, selecting "New agent", picking macOS, and copying the link. For example:
+https://download.agent.dev.azure.com/agent/5.277.0/vsts-agent-osx-arm64-5.277.0.tar.gz
+
+Install and enable Homebrew on each host before cloning vcpkg:
+
+```sh
+/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+eval "$(/opt/homebrew/bin/brew shellenv)"
+```
+
+Publish the changes to a fork and branch that the hosts can access. Keep a clone of
+`microsoft/vcpkg` on each host as `origin`, add the operator's fork as a separate remote, and check
+out the working revision to provide the scripts used by these instructions:
+
+```sh
+git clone https://github.com/microsoft/vcpkg ~/vcpkg
+git -C ~/vcpkg remote add <WORKING-REMOTE> https://github.com/<GITHUB-USER>/vcpkg
+git -C ~/vcpkg fetch <WORKING-REMOTE> <WORKING-BRANCH>
+git -C ~/vcpkg checkout --detach FETCH_HEAD
+```
+
+For example, BillyONeal's fork should be added as remote `BillyONeal` with URL
+`https://github.com/BillyONeal/vcpkg`. Do not use `origin` for the working branch unless the changes
+have already been merged into `microsoft/vcpkg`. If the working branch is updated, repeat the
+`fetch` and detached `checkout` commands above on each host.
+
 ## Creating new base images
 
 ### Prerequisites
 
-- [ ] [macosvm](https://github.com/s-u/macosvm) allow-listed
-  by macOS for arm64. Note that the directory 'Parallels' is still used when using `macosvm`
-  just so that scripts know where to find the VM and friends.
-- [ ] An Xcode .xip - you can get this from Apple's developer website,
-  although you'll need to sign in first: <https://developer.apple.com/downloads>  
-  If you are doing this from a local macos box, you can skip to the "update the macos host" step.  
-- [ ] An Xcode Command Line Tools installer
-- [ ] PowerShell 7.x, Azure CLI, and `az login` with your Microsoft corp credentials
+- [ ] The matching macOS IPSW, Xcode 26.6 `.xip`, and Xcode 26.6 Command Line Tools `.dmg`
+    uploaded to the `assets` container in the `vcpkgimageminting` storage account.
+- [ ] PowerShell 7.x, Azure CLI, and `az login` with your Microsoft corp credentials on a workstation
+    that can mint SAS tokens for the storage account.
 
 ### Instructions (ARM64)
 
@@ -21,27 +48,51 @@ This is the checklist for what the vcpkg team does when updating the macOS machi
       and delete one of the agents that are idle.
 - [ ] Go to that machine in the KVM. (Passwords are stored as secrets in the CPP_GITHUB\vcpkg\vcpkgmm-passwords key vault)
 - [ ] Update the macos host
-- [ ] (Once only) install `macosvm` to `~` (this tarball is also backed up in our `vcpkg-image-minting` storage account). For example from a dev workstation:
-    ```
-    ssh vcpkg@HOSTMACHINE
-    curl -L -o macosvm-0.2-2-arm64-darwin21.tar.gz https://github.com/s-u/macosvm/releases/download/0.2-2/macosvm-0.2-2-arm64-darwin21.tar.gz
-    tar xvf macosvm-0.2-2-arm64-darwin21.tar.gz
-    rm macosvm-0.2-2-arm64-darwin21.tar.gz
-    exit
-    ```
-- [ ] Download the matching `.ipsw` for the macOS copy to install. See https://mrmacintosh.com/apple-silicon-m1-full-macos-restore-ipsw-firmware-files-database/ ; links there to find the .ipsw. Example:
-    https://updates.cdn-apple.com/2026WinterFCS/fullrestores/122-28781/DCB2FF13-06CB-44C2-BCA2-DFCAF3521D46/UniversalMac_26.4.1_25E253_Restore.ipsw
-- [ ] Determine the VM name using the form "vcpkg-osx-<date>-arm64", for example "vcpkg-osx-2026-01-12-arm64".
-- [ ] Open a terminal and run the following commands to create the VM with vcpkg-osx-2026-01-12-arm64 and UniversalMac_26.4.1_25E253_Restore.ipsw replaced as appropriate. This must be run in the KVM as it uses a GUI:
-    ```
-    mkdir -p ~/Parallels/vcpkg-osx-2026-01-12-arm64
-    cd ~/Parallels/vcpkg-osx-2026-01-12-arm64
-    ~/macosvm --disk disk.img,size=500g --aux aux.img -c 8 -r 12g --restore ~/UniversalMac_26.4.1_25E253_Restore.ipsw ./vm.json
+- [ ] Prepare the host. This enables Homebrew, installs AzCopy if needed, and installs `macosvm` to `~`:
+    ```sh
+    ~/vcpkg/scripts/azure-pipelines/osx/host-prepare.sh
+    ```
+- [ ] On a workstation, generate download commands with short-lived, blob-scoped credentials for
+    the matching IPSW, Xcode archive, and Command Line Tools installer in the `assets` container:
+    ```powershell
+    function Get-AssetDownloadCommand {
+        Param([Parameter(Mandatory=$true)][ValidateNotNullOrEmpty()][string]$FileName)
+        $accountName = 'vcpkgimageminting'
+        $containerName = 'assets'
+        $uNow = (Get-Date).ToUniversalTime()
+        $start = $uNow.ToString('s') + 'Z'
+        $expiry = $uNow.AddHours(1).ToString('s') + 'Z'
+        $sas = az storage blob generate-sas --as-user --auth-mode login --account-name $accountName --container-name $containerName --name $FileName --permissions r --start $start --expiry $expiry --https-only --output tsv
+        return "azcopy copy `"https://vcpkgimageminting.blob.core.windows.net/assets/$($FileName)?$($sas)`" `"$FileName`""
+    }
+
+    Get-AssetDownloadCommand -FileName UniversalMac_26.6.1_25G76_Restore.ipsw
+    Get-AssetDownloadCommand -FileName Xcode_26.6_Apple_silicon.xip
+    Get-AssetDownloadCommand -FileName Command_Line_Tools_26.6_Apple_silicon.dmg
+    ```
+    This creates a user-delegation SAS for each blob. Each credential is read-only, HTTPS-only, and
+    valid for one hour. A SAS is not single-use and can be reused until it expires, so do not retain
+    the generated commands after the downloads finish.
+    If a matching IPSW has not yet been added to the container, use the
+    [M4 Apple Silicon IPSW firmware database](https://mrmacintosh.com/apple-silicon-m1-full-macos-restore-ipsw-firmware-files-database/)
+    to locate it and upload it first.
+- [ ] In the host's KVM terminal, change to `~`, then use the KVM software's "paste from
+      clipboard" function to paste and run each generated command:
+    ```sh
+    cd ~
+    # Paste and run the three azcopy commands generated on the workstation.
+    ```
+- [ ] Determine the VM directory name using the form "vcpkg-osx-<date>-arm64", for example "vcpkg-osx-2026-08-07-arm64".
+- [ ] Open a terminal and run the following commands to create the VM with vcpkg-osx-2026-08-07-arm64 and UniversalMac_26.6.1_25G76_Restore.ipsw replaced as appropriate. This must be run in the KVM as it uses a GUI:
+    ```
+    mkdir -p ~/vcpkg-osx-2026-08-07-arm64
+    cd ~/vcpkg-osx-2026-08-07-arm64
+    ~/macosvm --disk disk.img,size=500g,sync=none,cache=cached --aux aux.img -c 10 -r 18g --restore ~/UniversalMac_26.6.1_25G76_Restore.ipsw ./vm.json
     ~/macosvm -g ./vm.json
     ```
 - [ ] Follow prompts as you would on real hardware.
     * Set up as new.
-    * Account name: vcpkg
+    * Account name: builduser
     * A very similar password
     * Do not allow computer account password to be reset with your Apple Account.
     * Apple ID: 'Set Up Later' / Skip
@@ -52,38 +103,32 @@ This is the checklist for what the vcpkg team does when updating the macOS machi
 - [ ] Set the desktop wallpaper to a fixed color from Settings -> Wallpaper . (This makes the KVM a lot easier to use :) )
 - [ ] Disable automatic updates in the VM: Settings -> General -> Automatic Updates -> Disable them all
 - [ ] Enable remote login in the VM: Settings -> General -> Sharing -> Remote Login
-- [ ] Set the vcpkg user to be able to use sudo without a password, and install Xcode. For example from a dev workstation:
-    ```
-    scp path/to/Xcode.xip vcpkg@HOSTMACHINE:/Users/vcpkg/Xcode.xip
-    ssh vcpkg@HOSTMACHINE
-    rm ~/.ssh/known_hosts
-    scp Xcode.xip vcpkg@vcpkgs-Virtual-Machine.local:/Users/vcpkg/Xcode.xip
-    ssh vcpkg@vcpkgs-Virtual-Machine.local
-    printf 'vcpkg\tALL=(ALL)\tNOPASSWD:\tALL\n' | sudo tee -a '/etc/sudoers.d/vcpkg'
-    sudo chmod 0440 '/etc/sudoers.d/vcpkg'
-    sudo mdutil -ad
-    xip --expand Xcode.xip
-    sudo mv Xcode.app /Applications/Xcode.app
-    rm Xcode.xip
-    exit
+- [ ] Install Xcode from the host's vcpkg clone. This prompts for the guest password to install an
+    SSH key and enable passwordless sudo, then transfers and expands Xcode:
+    ```sh
+    cd ~/vcpkg/scripts/azure-pipelines/osx
+    ./host-install-xcode.sh
     ```
 - [ ] Open Xcode from Applications in the guest GUI. Uncheck the "code completion model" and accept the EULA.
-- [ ] Update the Azure Agent URI in setup-box.sh to the current version. You can find this by going to the agent pool, selecting "New agent", picking macOS, and copying the link. For example https://download.agent.dev.azure.com/agent/4.266.2/vsts-agent-osx-arm64-4.266.2.tar.gz
-- [ ] Copy setup-box.sh and the xcode installer renamed to 'clt.dmg' to the host. For example from a dev workstation:
-    ```
-    scp ./setup-guest.sh vcpkg@HOSTMACHINE:/Users/vcpkg
-    scp ./setup-box.sh vcpkg@HOSTMACHINE:/Users/vcpkg
-    scp path/to/console/tools.dmg vcpkg@HOSTMACHINE:/Users/vcpkg/clt.dmg
-    ssh vcpkg@HOSTMACHINE
-    chmod +x setup-guest.sh
-    ./setup-guest.sh
-    rm setup-guest.sh
-    rm setup-box.sh
-    rm clt.dmg
-    exit
+- [ ] After completing the Xcode GUI step, run the guest preparation script. It installs the Command
+    Line Tools, build dependencies, and the Azure Pipelines agent:
+    ```sh
+    cd ~/vcpkg/scripts/azure-pipelines/osx
+    ./host-prepare-guest.sh
     ```
 - [ ] Shut down the VM cleanly.
-- [ ] Package the VM into a tarball and upload it to blob storage. From a dev workstation, get the azcopy command to do the upload with:
+- [ ] Delete the temporary installation assets from the host:
+    ```sh
+    rm ~/UniversalMac_26.6.1_25G76_Restore.ipsw \
+        ~/Xcode_26.6_Apple_silicon.xip \
+        ~/Command_Line_Tools_26.6_Apple_silicon.dmg
+    ```
+- [ ] In the host's KVM terminal, package the VM into an archive:
+    ```sh
+    cd ~
+    aa archive -d vcpkg-osx-2026-08-07-arm64 -o vcpkg-osx-2026-08-07-arm64.aar -enable-holes
+    ```
+- [ ] In PowerShell on a workstation, generate the AzCopy upload command:
     ```powershell
     function Get-AzCopyWriteCommand {
         Param([Parameter(Mandatory=$true)][ValidateNotNullOrEmpty()][string]$FileName)
@@ -96,18 +141,10 @@ This is the checklist for what the vcpkg team does when updating the macOS machi
         return "azcopy copy  --check-length=false `"$($FileName)`" `"https://vcpkgimageminting.blob.core.windows.net/pvms/$($FileName)?$($sas)`""
     }
 
-    Get-AzCopyWriteCommand -FileName vcpkg-osx-2026-01-12-arm64.aar
-    ```
-    Then:
-    ```
-    ssh vcpkg@HOSTMACHINE
-    cd ~/Parallels
-    aa archive -d vcpkg-osx-<date>-arm64 -o vcpkg-osx-<date>-arm64.aar -enable-holes
-    brew install azcopy
-    # (The azcopy command line generated above)
-    exit
+    Get-AzCopyWriteCommand -FileName vcpkg-osx-2026-08-07-arm64.aar
     ```
-- [ ] Go to https://dev.azure.com/vcpkg/public/_settings/agentqueues and create a new self hosted Agent pool named `PrOsx-YYYY-MM-DD-arm64` based on the current date. Grant microsoft.vcpkg.ci and microsoft.vcpkg.pr access.
+- [ ] Paste and run the generated AzCopy command in the host's KVM terminal.
+- [ ] Go to https://dev.azure.com/vcpkg/public/_settings/agentqueues and create a new self hosted Agent pool named `PrOsx-2026-08-07-arm64`. Grant microsoft.vcpkg.ci and microsoft.vcpkg.pr access.
 - [ ] Follow the "Deploying images" steps below for each machine in the fleet.
 
 ## Deploying images
@@ -119,15 +156,15 @@ Run these steps on each machine to add to the fleet. Skip steps that were done i
 - [ ] If this machine was used before, delete it from the pool of which it is a member from https://dev.azure.com/vcpkg/public/_settings/agentqueues
 - [ ] Log in to the machine using the KVM.
 - [ ] Check for software updates in macOS system settings
-- [ ] (Once only) install `macosvm` to `~` (this tarball is also backed up in our `vcpkg-image-minting` storage account). From a developer machine:
+- [ ] Ensure the host's vcpkg clone is at the published working revision, then prepare the host. This
+    enables Homebrew, installs AzCopy if needed, and installs `macosvm` to `~`:
     ```sh
-    ssh vcpkg@HOSTMACHINE
-    curl -L -o macosvm-0.2-2-arm64-darwin21.tar.gz https://github.com/s-u/macosvm/releases/download/0.2-2/macosvm-0.2-2-arm64-darwin21.tar.gz
-    tar xvf macosvm-0.2-2-arm64-darwin21.tar.gz
-    rm macosvm-0.2-2-arm64-darwin21.tar.gz
-    exit
+    git -C ~/vcpkg fetch <WORKING-REMOTE> <WORKING-BRANCH>
+    git -C ~/vcpkg checkout --detach FETCH_HEAD
+    ~/vcpkg/scripts/azure-pipelines/osx/host-prepare.sh
     ```
-- [ ] Skip if this is the image building machine. Mint a SAS token URI to the box to use from the Azure portal if you don't already have one, and download the VM. (Recommend running this via SSH from domain joined machine due to containing SAS tokens). From a developer machine, get the azcopy command with:
+- [ ] Skip if this is the image building machine. In PowerShell on a workstation, mint a SAS token
+    and generate the AzCopy command with:
     ```powershell
     function Get-AzCopyReadCommand {
         Param([Parameter(Mandatory=$true)][ValidateNotNullOrEmpty()][string]$FileName)
@@ -140,45 +177,43 @@ Run these steps on each machine to add to the fleet. Skip steps that were done i
         return "azcopy copy `"https://vcpkgimageminting.blob.core.windows.net/pvms/$($FileName)?$($sas)`" `"$($FileName)`""
     }
 
-    Get-AzCopyReadCommand -FileName vcpkg-osx-2026-01-12-arm64.aar
+    Get-AzCopyReadCommand -FileName vcpkg-osx-2026-08-07-arm64.aar
     ```
-    Then run:
+    In the host's KVM terminal, use the KVM software's "paste from clipboard" function to paste and
+    run the generated command, then run:
     ```sh
-    ssh vcpkg@HOSTMACHINE
-    brew install azcopy
-    mkdir -p ~/Parallels
-    cd ~/Parallels
     # (The azcopy command line generated above)
     aa extract -d vcpkg-osx-<DATE>-arm64 -i ./vcpkg-osx-<DATE>-arm64.aar -enable-holes
-    exit
     ```
 - [ ] Open a separate terminal window on the host and start the VM by running:
     ```sh
-    cd ~/Parallels/vcpkg-osx-<DATE>-arm64
+    cd ~/vcpkg-osx-<DATE>-arm64
     ~/macosvm ./vm.json
     ```
-- [ ] Generate an access token to add the agent to the pool:
+- [ ] In PowerShell on a workstation, generate a short-lived access token to add the agent to the
+    pool:
     ```pwsh
     az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken --output tsv
     ```
-- [ ] Copy the guest deploy script to the host, and run it with the access token/OAuth token from the `az account get-access-token` command above as the first parameter. From a developer machine pwsh:
-    ```pwsh
-    scp register-guest.sh vcpkg@HOSTMACHINE:/Users/vcpkg/register-guest.sh
-    ssh vcpkg@HOSTMACHINE
-    rm .ssh/known_hosts
-    chmod +x register-guest.sh
-    ./register-guest.sh TOKEN-GOES-HERE AGENT-NUMBER-GOES-HERE
-    rm register-guest.sh
-    ```
-- [ ] That will cleanly shut down the VM. In the KVM's terminal, relaunch the VM in ephemeral mode with:
+- [ ] In the host's KVM terminal, use the KVM software's "paste from clipboard" function to paste
+    the short-lived access token into the guest deploy command from the vcpkg clone. The script
+    accepts a host name in the form `vcpkg-m4-NNN` case-insensitively, registers the Azure DevOps
+    agent as `VCPKG-M4-NNN`, and stops with an error if the host name or agent pool cannot be
+    determined unambiguously:
+    ```sh
+    ~/vcpkg/scripts/azure-pipelines/osx/host-register-guest.sh TOKEN-GOES-HERE
+    ```
+- [ ] After successful registration, the script will cleanly shut down the VM. If registration fails,
+      the VM remains running for diagnosis. In the KVM's terminal, relaunch the successfully registered
+      VM in ephemeral mode:
     ```sh
     ~/macosvm --ephemeral ./vm.json
     ```
 - [ ] Open a terminal window on the host and run the agent
     ```sh
-    ssh -i ~/Parallels/*/id_guest vcpkg@vcpkgs-Virtual-Machine.local
+    ssh -i ~/vcpkg-osx-*-arm64/id_guest builduser@buildusers-Virtual-Machine.local
     ~/myagent/run.sh
     ```
-- [ ] Check that the machine shows up in the pool, and lock the vcpkg user on the host.
+- [ ] Check that the machine shows up in the pool, and lock the current user account on the host.
 - [ ] Lock the screen on the host.
 - [ ] Update the "vcpkg Macs" spreadsheet line for the machine with the new pool.
diff --git a/scripts/azure-pipelines/osx/azure-pipelines.yml b/scripts/azure-pipelines/osx/azure-pipelines.yml
index 650973740cc4fa..60bf2a69c57589 100644
--- a/scripts/azure-pipelines/osx/azure-pipelines.yml
+++ b/scripts/azure-pipelines/osx/azure-pipelines.yml
@@ -19,7 +19,7 @@ jobs:
 - job: ${{ parameters.jobName }}
   condition: and(succeeded(), contains('^${{ replace(parameters.jobName, '_', '-') }}$', '${{ parameters.tripletPattern }}'))
   pool:
-    name: PrOsx-2026-01-12-arm64
+    name: PrOsx-2026-08-07-arm64
   workspace:
     clean: resources
   timeoutInMinutes: 2880 # 2 days
@@ -64,7 +64,7 @@ jobs:
   - task: UseNode@1
     displayName: 'Ensure Node.js is available'
     inputs:
-      version: '22.x'
+      version: '24.x'
   - bash: |
       cd scripts/azure-pipelines/owners-db && npm ci || true
       # Construct the blob base url using the secret SAS token set earlier
diff --git a/scripts/azure-pipelines/osx/guest-prepare.sh b/scripts/azure-pipelines/osx/guest-prepare.sh
new file mode 100644
index 00000000000000..8ebcad605f076e
--- /dev/null
+++ b/scripts/azure-pipelines/osx/guest-prepare.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+set -e
+
+hdiutil attach clt.dmg -mountpoint /Volumes/setup-installer
+sudo installer -pkg "/Volumes/setup-installer/Command Line Tools.pkg" -target /
+hdiutil detach /Volumes/setup-installer
+rm clt.dmg
+sudo xcode-select -s /Applications/Xcode.app
+curl -fsSL -o "$HOME/Downloads/install-homebrew.sh" https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh
+NONINTERACTIVE=1 /bin/bash "$HOME/Downloads/install-homebrew.sh"
+rm "$HOME/Downloads/install-homebrew.sh"
+(echo; echo 'eval "$(/opt/homebrew/bin/brew shellenv)"') >> "$HOME/.zprofile"
+eval "$(/opt/homebrew/bin/brew shellenv)"
+brew install autoconf-archive autoconf automake azcopy azure-cli bison cmake gettext gfortran gnu-sed gperf libtool meson nasm ninja pkg-config powershell
+mkdir "$HOME/Data"
+curl -fsSL -o "$HOME/Downloads/azure-agent.tar.gz" https://download.agent.dev.azure.com/agent/5.277.0/vsts-agent-osx-arm64-5.277.0.tar.gz
+mkdir "$HOME/myagent"
+tar xf "$HOME/Downloads/azure-agent.tar.gz" -C "$HOME/myagent"
+rm "$HOME/Downloads/azure-agent.tar.gz"
+rm guest-prepare.sh
diff --git a/scripts/azure-pipelines/osx/host-install-xcode.sh b/scripts/azure-pipelines/osx/host-install-xcode.sh
new file mode 100755
index 00000000000000..69dd332846e455
--- /dev/null
+++ b/scripts/azure-pipelines/osx/host-install-xcode.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -e
+
+VM_DIRECTORY=`ls "$HOME" | grep vcpkg-osx-`
+SSH_KEY="$HOME/$VM_DIRECTORY/id_guest"
+SSH_PUBLIC_KEY="$SSH_KEY.pub"
+
+mkdir -p "$HOME/.ssh"
+touch "$HOME/.ssh/known_hosts"
+ssh-keygen -R buildusers-Virtual-Machine.local -f "$HOME/.ssh/known_hosts"
+ssh-keygen -P '' -f "$SSH_KEY"
+echo "Enter the guest builduser password to install the SSH key"
+ssh-copy-id -i "$SSH_PUBLIC_KEY" builduser@buildusers-Virtual-Machine.local
+echo "Enter the guest builduser password to enable passwordless sudo"
+ssh -t -i "$SSH_KEY" builduser@buildusers-Virtual-Machine.local \
+    "printf 'builduser\tALL=(ALL)\tNOPASSWD:\tALL\n' | sudo tee /etc/sudoers.d/builduser >/dev/null && sudo chmod 0440 /etc/sudoers.d/builduser"
+scp -i "$SSH_KEY" "$HOME/Xcode_26.6_Apple_silicon.xip" builduser@buildusers-Virtual-Machine.local:Xcode.xip
+ssh -i "$SSH_KEY" builduser@buildusers-Virtual-Machine.local \
+    "sudo mdutil -ad && xip --expand Xcode.xip && sudo mv Xcode.app /Applications/Xcode.app && rm Xcode.xip"
\ No newline at end of file
diff --git a/scripts/azure-pipelines/osx/host-prepare-guest.sh b/scripts/azure-pipelines/osx/host-prepare-guest.sh
new file mode 100755
index 00000000000000..29bdb161e20ba8
--- /dev/null
+++ b/scripts/azure-pipelines/osx/host-prepare-guest.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -e
+
+export VM_DIRECTORY=`ls "$HOME" | grep vcpkg-osx-`
+export SSH_KEY="$HOME/$VM_DIRECTORY/id_guest"
+ssh -i "$SSH_KEY" builduser@buildusers-Virtual-Machine.local echo hello from \`hostname\`
+scp -i "$SSH_KEY" "$HOME/Command_Line_Tools_26.6_Apple_silicon.dmg" builduser@buildusers-Virtual-Machine.local:clt.dmg
+scp -i "$SSH_KEY" ./guest-prepare.sh builduser@buildusers-Virtual-Machine.local:guest-prepare.sh
+ssh -i "$SSH_KEY" builduser@buildusers-Virtual-Machine.local chmod +x guest-prepare.sh
+ssh -i "$SSH_KEY" builduser@buildusers-Virtual-Machine.local ./guest-prepare.sh
diff --git a/scripts/azure-pipelines/osx/host-prepare.sh b/scripts/azure-pipelines/osx/host-prepare.sh
new file mode 100755
index 00000000000000..51195bb45b60e0
--- /dev/null
+++ b/scripts/azure-pipelines/osx/host-prepare.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -e
+
+if [ ! -x /opt/homebrew/bin/brew ]; then
+    echo "Homebrew must be installed on the host before running this script" >&2
+    exit 1
+fi
+
+eval "$(/opt/homebrew/bin/brew shellenv)"
+grep -Fq '/opt/homebrew/bin/brew shellenv' "$HOME/.zprofile" 2>/dev/null || \
+    printf '%s\n' 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> "$HOME/.zprofile"
+brew install azcopy
+
+if [ ! -x "$HOME/macosvm" ]; then
+    archive="$(mktemp)"
+    curl -fL -o "$archive" https://github.com/s-u/macosvm/releases/download/0.2-3/macosvm-0.2-3-darwin21.tar.gz
+    tar -xvf "$archive" -C "$HOME"
+    rm "$archive"
+fi
\ No newline at end of file
diff --git a/scripts/azure-pipelines/osx/host-register-guest.sh b/scripts/azure-pipelines/osx/host-register-guest.sh
new file mode 100755
index 00000000000000..a30b325d59de58
--- /dev/null
+++ b/scripts/azure-pipelines/osx/host-register-guest.sh
@@ -0,0 +1,41 @@
+#!/bin/sh
+set -e
+
+if [ "$#" -ne 1 ]; then
+    echo "Usage: $0 <token>" >&2
+    exit 1
+fi
+
+HOST_NAME=$(hostname) || {
+    echo "Failed to determine the host name" >&2
+    exit 1
+}
+HOST_NAME=${HOST_NAME%%.*}
+HOST_NAME=$(printf '%s' "$HOST_NAME" | tr '[:lower:]' '[:upper:]')
+case "$HOST_NAME" in
+    VCPKG-M4-[0-9][0-9][0-9]) ;;
+    *)
+        echo "Host name '$HOST_NAME' does not match required format 'VCPKG-M4-NNN'" >&2
+        exit 1
+        ;;
+esac
+
+export AGENT=$HOST_NAME
+echo "THIS IS AGENT: $AGENT"
+export POOL=`echo "$HOME"/vcpkg-osx-*-arm64/ | sed -En 's/.+\/vcpkg-osx-([0-9]{4}-[0-9]{2}-[0-9]{2})-arm64\/$/PrOsx-\1-arm64/p'`
+case "$POOL" in
+    PrOsx-[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]-arm64) ;;
+    *)
+        echo "Failed to determine exactly one agent pool from ~/vcpkg-osx-*-arm64" >&2
+        exit 1
+        ;;
+esac
+# on arm64, DNS works
+export SSH_COOKIE=builduser@buildusers-Virtual-Machine.local
+mkdir -p "$HOME/.ssh"
+touch "$HOME/.ssh/known_hosts"
+ssh-keygen -R buildusers-Virtual-Machine.local -f "$HOME/.ssh/known_hosts"
+echo "POOL: $POOL"
+echo "SSH_COOKIE: $SSH_COOKIE"
+ssh -o "StrictHostKeyChecking=no" -i "$HOME"/vcpkg-osx-*-arm64/id_guest "$SSH_COOKIE" "\$HOME/myagent/config.sh --unattended --url https://dev.azure.com/vcpkg --work \$HOME/Data/work --auth pat --token $1 --pool $POOL --agent $AGENT --replace --acceptTeeEula"
+ssh -o "StrictHostKeyChecking=no" -i "$HOME"/vcpkg-osx-*-arm64/id_guest "$SSH_COOKIE" "sudo shutdown -h now"
diff --git a/scripts/azure-pipelines/osx/register-guest.sh b/scripts/azure-pipelines/osx/register-guest.sh
deleted file mode 100644
index 65fe9f356a7151..00000000000000
--- a/scripts/azure-pipelines/osx/register-guest.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/sh
-if [ -z "$1" ]; then
-    echo "Token missing"
-    exit 1
-fi
-if [ -z "$2" ]; then
-    echo "Agent number missing"
-    exit 1
-fi
-export AGENT=CPPMAC-ARM64-$2
-echo "THIS IS AGENT: $AGENT"
-export POOL=`echo ~/Parallels/*/ | sed -nr 's/\/Users\/vcpkg\/Parallels\/vcpkg-osx-([0-9]{4}-[0-9]{2}-[0-9]{2})-arm64\/$/PrOsx-\1-arm64/p'`
-# on arm64, DNS works
-export SSH_COOKIE=vcpkg@vcpkgs-Virtual-Machine.local
-echo "POOL: $POOL"
-echo "SSH_COOKIE: $SSH_COOKIE"
-ssh $SSH_COOKIE -o "StrictHostKeyChecking=no" -i ~/Parallels/*/id_guest "~/myagent/config.sh --unattended --url https://dev.azure.com/vcpkg --work ~/Data/work --auth pat --token $1 --pool $POOL --agent $AGENT --replace --acceptTeeEula"
-ssh $SSH_COOKIE -o "StrictHostKeyChecking=no" -i ~/Parallels/*/id_guest "sudo shutdown -h now"
diff --git a/scripts/azure-pipelines/osx/setup-box.sh b/scripts/azure-pipelines/osx/setup-box.sh
deleted file mode 100644
index 1328d2d22e19d9..00000000000000
--- a/scripts/azure-pipelines/osx/setup-box.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/sh
-
-hdiutil attach clt.dmg -mountpoint /Volumes/setup-installer
-sudo installer -pkg "/Volumes/setup-installer/Command Line Tools.pkg" -target /
-hdiutil detach /Volumes/setup-installer
-rm clt.dmg
-sudo xcode-select -s /Applications/Xcode.app
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-(echo; echo 'eval "$(/opt/homebrew/bin/brew shellenv)"') >> /Users/vcpkg/.zprofile
-eval "$(/opt/homebrew/bin/brew shellenv)"
-brew install autoconf-archive autoconf automake azcopy azure-cli bison cmake gettext gfortran gnu-sed gperf gtk-doc libtool meson mono nasm ninja pkg-config powershell python-setuptools texinfo yasm
-mkdir ~/Data
-curl -s -o ~/Downloads/azure-agent.tar.gz https://download.agent.dev.azure.com/agent/4.266.2/vsts-agent-osx-arm64-4.266.2.tar.gz
-mkdir ~/myagent
-tar xf ~/Downloads/azure-agent.tar.gz -C ~/myagent
-rm ~/Downloads/azure-agent.tar.gz
-rm setup-box.sh
diff --git a/scripts/azure-pipelines/osx/setup-guest.sh b/scripts/azure-pipelines/osx/setup-guest.sh
deleted file mode 100644
index 092090f508985c..00000000000000
--- a/scripts/azure-pipelines/osx/setup-guest.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/sh
-export VM_DIRECTORY=`ls ~/Parallels | grep vcpkg-osx`
-export SSH_KEY="$HOME/Parallels/$VM_DIRECTORY/id_guest"
-export SSH_PUBLIC_KEY="$SSH_KEY.pub"
-ssh-keygen -P '' -f "$SSH_KEY"
-echo Type 'vcpkg' and press enter
-ssh-copy-id -i "$SSH_PUBLIC_KEY" vcpkg@vcpkgs-Virtual-Machine.local
-echo Keys deployed
-ssh vcpkg@vcpkgs-Virtual-Machine.local -i "$SSH_KEY" echo hello from \`hostname\`
-scp -i "$SSH_KEY" ./clt.dmg vcpkg@vcpkgs-Virtual-Machine.local:/Users/vcpkg/clt.dmg
-scp -i "$SSH_KEY" ./setup-box.sh vcpkg@vcpkgs-Virtual-Machine.local:/Users/vcpkg/setup-box.sh
-ssh vcpkg@vcpkgs-Virtual-Machine.local -i "$SSH_KEY" chmod +x /Users/vcpkg/setup-box.sh
-ssh vcpkg@vcpkgs-Virtual-Machine.local -i "$SSH_KEY" /Users/vcpkg/setup-box.sh
diff --git a/scripts/ci.baseline.txt b/scripts/ci.baseline.txt
index dcc9ca4c197e8d..7ee33c4354f16f 100644
--- a/scripts/ci.baseline.txt
+++ b/scripts/ci.baseline.txt
@@ -833,8 +833,6 @@ libressl:x64-windows-static-md=skip
 libressl:x64-windows-static=skip
 libressl:x64-windows=skip
 libressl:x86-windows=skip
-libtar:arm-neon-android=fail
-libtar:arm64-android=fail
 libtar:arm64-linux=fail
 libtomcrypt:arm64-windows-static-md=fail
 libtomcrypt:arm64-windows=fail
diff --git a/scripts/ci.feature.baseline.txt b/scripts/ci.feature.baseline.txt
index 553b92bbc1dabf..e3a4e4b993183b 100644
--- a/scripts/ci.feature.baseline.txt
+++ b/scripts/ci.feature.baseline.txt
@@ -376,8 +376,6 @@ glpk[dl]:arm64-linux=cascade
 glpk[dl](!windows | uwp)=cascade
 glpk[mysql]:arm64-linux=cascade
 glpk[mysql]:arm64-osx=cascade
-glpk[mysql]:arm64-windows=cascade
-glpk[mysql]:x86-windows=cascade
 glpk[odbc]:arm64-linux=cascade
 glpk[odbc](!windows | uwp)=cascade
 glui:arm64-linux=cascade
@@ -1280,7 +1278,6 @@ rtabmap[opencv-cuda](!x64 | android | osx)=cascade
 rtabmap[openmp]:arm64-osx=feature-fails # No openmp on default osx toolchain
 rtaudio[pulse]:arm64-linux=cascade
 rtlsdr:arm64-linux=cascade
-rubberband:arm64-linux=cascade
 ryml:arm64-windows=cascade
 s2n=skip # builds too slow
 sail[jpegxl]:arm-neon-android=cascade
diff --git a/versions/b-/bde.json b/versions/b-/bde.json
index bd1aea4811dbf6..7a21fded46e4f5 100644
--- a/versions/b-/bde.json
+++ b/versions/b-/bde.json
@@ -1,5 +1,10 @@
 {
   "versions": [
+    {
+      "git-tree": "e3338cf3d83b1d8c93ddeb32ede293ee8c5ef6b2",
+      "version": "4.38.0.0",
+      "port-version": 1
+    },
     {
       "git-tree": "a7259739d6678ff37bdef773adad278e6e987dfd",
       "version": "4.38.0.0",
diff --git a/versions/baseline.json b/versions/baseline.json
index 2bdce4afecafb3..259c57dd613211 100644
--- a/versions/baseline.json
+++ b/versions/baseline.json
@@ -666,7 +666,7 @@
     },
     "bde": {
       "baseline": "4.38.0.0",
-      "port-version": 0
+      "port-version": 1
     },
     "bdwgc": {
       "baseline": "8.2.12",
@@ -2370,7 +2370,7 @@
     },
     "cyrus-sasl": {
       "baseline": "2.1.28",
-      "port-version": 4
+      "port-version": 5
     },
     "czmq": {
       "baseline": "4.2.1",
@@ -3510,7 +3510,7 @@
     },
     "glpk": {
       "baseline": "5.0",
-      "port-version": 3
+      "port-version": 5
     },
     "glslang": {
       "baseline": "16.4.0",
@@ -3850,7 +3850,7 @@
     },
     "highs": {
       "baseline": "1.14.0",
-      "port-version": 0
+      "port-version": 1
     },
     "highway": {
       "baseline": "1.4.0",
@@ -4618,7 +4618,7 @@
     },
     "krb5": {
       "baseline": "1.22.2",
-      "port-version": 1
+      "port-version": 2
     },
     "krpc": {
       "baseline": "0.6.0",
@@ -5782,7 +5782,7 @@
     },
     "libtar": {
       "baseline": "1.2.20",
-      "port-version": 1
+      "port-version": 3
     },
     "libtasn1": {
       "baseline": "4.19.0",
@@ -7086,7 +7086,7 @@
     },
     "nettle": {
       "baseline": "3.10",
-      "port-version": 1
+      "port-version": 2
     },
     "networkdirect-sdk": {
       "baseline": "2.0.1",
@@ -8306,7 +8306,7 @@
     },
     "qt5-location": {
       "baseline": "5.15.19",
-      "port-version": 0
+      "port-version": 1
     },
     "qt5-macextras": {
       "baseline": "5.15.19",
@@ -9026,7 +9026,7 @@
     },
     "rubberband": {
       "baseline": "4.0.0",
-      "port-version": 1
+      "port-version": 2
     },
     "ruckig": {
       "baseline": "0.17.3",
diff --git a/versions/c-/cyrus-sasl.json b/versions/c-/cyrus-sasl.json
index 45f34c08b80b3e..52c49d409322ba 100644
--- a/versions/c-/cyrus-sasl.json
+++ b/versions/c-/cyrus-sasl.json
@@ -1,5 +1,10 @@
 {
   "versions": [
+    {
+      "git-tree": "cfd86e8f7f6c334cc47af6291cc22e234e68d36a",
+      "version": "2.1.28",
+      "port-version": 5
+    },
     {
       "git-tree": "b8f1a9c198fe99f9c37b4ca305f86dfd365e4f37",
       "version": "2.1.28",
diff --git a/versions/g-/glpk.json b/versions/g-/glpk.json
index 4490c03ef49727..25de264fd8dbce 100644
--- a/versions/g-/glpk.json
+++ b/versions/g-/glpk.json
@@ -1,5 +1,15 @@
 {
   "versions": [
+    {
+      "git-tree": "73e45f7e708c847523b7d02be3617436c1cbfd01",
+      "version": "5.0",
+      "port-version": 5
+    },
+    {
+      "git-tree": "183e12f0f3f9e424867fd8cc9c4415a09842516c",
+      "version": "5.0",
+      "port-version": 4
+    },
     {
       "git-tree": "00933f2c7f77149899b7c69c6d09410fca7f5b1d",
       "version": "5.0",
diff --git a/versions/h-/highs.json b/versions/h-/highs.json
index ef69f13639e5f4..4641ebf92ddadf 100644
--- a/versions/h-/highs.json
+++ b/versions/h-/highs.json
@@ -1,5 +1,10 @@
 {
   "versions": [
+    {
+      "git-tree": "428e2942537dcaee38a137ef1a8342ecd2af9fa5",
+      "version": "1.14.0",
+      "port-version": 1
+    },
     {
       "git-tree": "ade8308af2c39213840e613146568b0e3ab5afe9",
       "version": "1.14.0",
diff --git a/versions/k-/krb5.json b/versions/k-/krb5.json
index 56465c061a0601..0e844e6c3d87e8 100644
--- a/versions/k-/krb5.json
+++ b/versions/k-/krb5.json
@@ -1,5 +1,10 @@
 {
   "versions": [
+    {
+      "git-tree": "da86c795f9970afea9aae1304a62a59a7f6c7626",
+      "version": "1.22.2",
+      "port-version": 2
+    },
     {
       "git-tree": "95f4778a75c8e514f20fcabea74e41a2e2664f1f",
       "version": "1.22.2",
diff --git a/versions/l-/libtar.json b/versions/l-/libtar.json
index 2969f204c5dee4..c68d3c4d030cf5 100644
--- a/versions/l-/libtar.json
+++ b/versions/l-/libtar.json
@@ -1,5 +1,15 @@
 {
   "versions": [
+    {
+      "git-tree": "da5874212b5fa954b90a05fd64c1a8e379f318ab",
+      "version": "1.2.20",
+      "port-version": 3
+    },
+    {
+      "git-tree": "30d8ed45daab0bd4edc52df3ebaa174c53f298ab",
+      "version": "1.2.20",
+      "port-version": 2
+    },
     {
       "git-tree": "52ef8acf2b8ff12c21e9a52b9e0f0d14d050f97e",
       "version": "1.2.20",
diff --git a/versions/n-/nettle.json b/versions/n-/nettle.json
index e066ad1a77fb61..16770d32d59a90 100644
--- a/versions/n-/nettle.json
+++ b/versions/n-/nettle.json
@@ -1,5 +1,10 @@
 {
   "versions": [
+    {
+      "git-tree": "aa042bb4b8731ca3842e21b6f78b89b65818aea6",
+      "version": "3.10",
+      "port-version": 2
+    },
     {
       "git-tree": "8e33e188623d99135e4d6db52d98840da86ffc0d",
       "version": "3.10",
diff --git a/versions/q-/qt5-location.json b/versions/q-/qt5-location.json
index 0cb5635954a0cb..34006c6a642ae6 100644
--- a/versions/q-/qt5-location.json
+++ b/versions/q-/qt5-location.json
@@ -1,5 +1,10 @@
 {
   "versions": [
+    {
+      "git-tree": "f82ad6cd2215b194767cca1879dcb48df6ffc8ad",
+      "version": "5.15.19",
+      "port-version": 1
+    },
     {
       "git-tree": "42e67aecbf59c47a6fa3159b8b58ad3ea8b71deb",
       "version": "5.15.19",
diff --git a/versions/r-/rubberband.json b/versions/r-/rubberband.json
index cd2479afd6b80c..9097e178d57424 100644
--- a/versions/r-/rubberband.json
+++ b/versions/r-/rubberband.json
@@ -1,5 +1,10 @@
 {
   "versions": [
+    {
+      "git-tree": "76039ab047258bdd340ce0e9e28ce5d02b165f32",
+      "version": "4.0.0",
+      "port-version": 2
+    },
     {
       "git-tree": "7d948232485cc496cf6c92b9f09a2274a208db03",
       "version": "4.0.0",