diff --git a/pyproject.toml b/pyproject.toml
index 41eb3cc9..588f2e88 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -120,11 +120,20 @@ mypy_path = ["tests"]
 build = "cp311-* cp312-* cp313-*"
 skip = ["pp*", "*_i686", "*-win32", "*-musllinux_i686"]
 build-frontend = "build"
+# Build/test on glibc 2.28: numpy/scipy only publish manylinux_2_27/_2_28 wheels,
+# so the default manylinux2014 (glibc 2.17) test image cannot install them and
+# falls back to compiling scipy from source (no OpenBLAS) and fails. musllinux_1_2
+# (the cibuildwheel default) already has matching numpy/scipy wheels.
+manylinux-x86_64-image = "manylinux_2_28"
+musllinux-x86_64-image = "musllinux_1_2"
 # Smoke-test every built wheel: the native extension imports and computes.
 test-command = 'python -c "import nns, nns._nnscore as c; print(c.lpm(2.0, 0.0, [-2.0, -1.0, 0.5, 3.0]))"'
 
 [tool.cibuildwheel.macos]
 archs = ["x86_64", "arm64"]
+# nanobind's C++17 runtime uses aligned new/delete, which requires macOS 10.13+.
+# cibuildwheel otherwise defaults x86_64 to 10.9 and the build fails to compile.
+environment = { MACOSX_DEPLOYMENT_TARGET = "10.14" }
 
 [tool.cibuildwheel.windows]
 archs = ["AMD64"]
diff --git a/sync/nns_source.json b/sync/nns_source.json
index a592d4fb..92867f1c 100644
--- a/sync/nns_source.json
+++ b/sync/nns_source.json
@@ -1,10 +1,10 @@
 {
   "r_repo": "OVVO-Financial/NNS",
-  "r_commit": "unknown",
+  "r_commit": "905b8bbd42b3236bf88aba7f18df7a9a378dbd7b",
   "r_version": "13.0",
   "r_src_tree_hash": "654e411bd4e8caabfd57a1a4190eb1d97411e059",
   "core_repo": "OVVO-Financial/NNS-core",
-  "core_commit": "unknown",
+  "core_commit": "7f93df9dff8762df870c1fbba6e03c0469be6e69",
   "python_repo": "OVVO-Financial/NNS-python",
   "python_commit": null,
   "vendored_core_path": "extern/NNS-core",
diff --git a/tests/tools/test_release_provenance.py b/tests/tools/test_release_provenance.py
index 4cc39e2b..f32a0ae1 100644
--- a/tests/tools/test_release_provenance.py
+++ b/tests/tools/test_release_provenance.py
@@ -43,8 +43,10 @@ def test_allow_unknown_passes_with_placeholder_provenance() -> None:
     assert result.returncode == 0, result.stdout + result.stderr
 
 
-def test_unknown_provenance_fails_real_release() -> None:
-    result = _run([])
+def test_unknown_provenance_fails_real_release(tmp_path: Path) -> None:
+    manifest = tmp_path / "manifest.json"
+    _write_manifest(manifest)  # default r_commit/core_commit are "unknown"
+    result = _run(["--manifest", str(manifest)])
     assert result.returncode != 0
     assert "provenance" in (result.stdout + result.stderr).lower()