diff --git a/.beman-tidy.yaml b/.beman-tidy.yaml
index e1080085..37faa20b 100644
--- a/.beman-tidy.yaml
+++ b/.beman-tidy.yaml
@@ -6,4 +6,5 @@
 
 disabled_rules: []
 ignored_paths:
+    - .cache/
     - infra/
diff --git a/.github/workflows/ci_tests.yml b/.github/workflows/ci_tests.yml
index b8859d05..1627a106 100644
--- a/.github/workflows/ci_tests.yml
+++ b/.github/workflows/ci_tests.yml
@@ -17,10 +17,10 @@ concurrency:
 
 jobs:
   beman-submodule-check:
-    uses: bemanproject/infra-workflows/.github/workflows/reusable-beman-submodule-check.yml@1.7.3
+    uses: bemanproject/infra-workflows/.github/workflows/reusable-beman-submodule-check.yml@1.7.4
 
   preset-test:
-    uses: bemanproject/infra-workflows/.github/workflows/reusable-beman-preset-test.yml@1.7.3
+    uses: bemanproject/infra-workflows/.github/workflows/reusable-beman-preset-test.yml@1.7.4
     with:
       matrix_config: >
         [
@@ -33,7 +33,7 @@ jobs:
         ]
 
   build-and-test:
-    uses: bemanproject/infra-workflows/.github/workflows/reusable-beman-build-and-test.yml@1.7.3
+    uses: bemanproject/infra-workflows/.github/workflows/reusable-beman-build-and-test.yml@1.7.4
     with:
       matrix_config: >
         {
@@ -132,4 +132,4 @@ jobs:
   create-issue-when-fault:
     needs: [preset-test, build-and-test]
     if: failure() && github.event_name == 'schedule'
-    uses: bemanproject/infra-workflows/.github/workflows/reusable-beman-create-issue-when-fault.yml@1.7.3
+    uses: bemanproject/infra-workflows/.github/workflows/reusable-beman-create-issue-when-fault.yml@1.7.4
diff --git a/.github/workflows/pre-commit-check.yml b/.github/workflows/pre-commit-check.yml
index d3cc6af8..85350c4d 100644
--- a/.github/workflows/pre-commit-check.yml
+++ b/.github/workflows/pre-commit-check.yml
@@ -9,6 +9,12 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  checks: write
+  issues: write
+  pull-requests: write
+
 jobs:
   pre-commit:
-    uses: bemanproject/infra-workflows/.github/workflows/reusable-beman-pre-commit.yml@1.3.0
+    uses: bemanproject/infra-workflows/.github/workflows/reusable-beman-pre-commit.yml@1.7.4
diff --git a/.github/workflows/pre-commit-update.yml b/.github/workflows/pre-commit-update.yml
index 53825d40..440984c3 100644
--- a/.github/workflows/pre-commit-update.yml
+++ b/.github/workflows/pre-commit-update.yml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   auto-update-pre-commit:
-    uses: bemanproject/infra-workflows/.github/workflows/reusable-beman-update-pre-commit.yml@1.7.3
+    uses: bemanproject/infra-workflows/.github/workflows/reusable-beman-update-pre-commit.yml@1.7.4
     secrets:
       APP_ID: ${{ secrets.AUTO_PR_BOT_APP_ID }}
       PRIVATE_KEY: ${{ secrets.AUTO_PR_BOT_PRIVATE_KEY }}
diff --git a/CMakePresets.json b/CMakePresets.json
index 084d7180..7cffee09 100644
--- a/CMakePresets.json
+++ b/CMakePresets.json
@@ -34,7 +34,7 @@
       },
       "cacheVariables": {
         "CMAKE_BUILD_TYPE": "Debug",
-        "BEMAN_BUILDSYS_SANITIZER": "MaxSan"
+        "BEMAN_BUILDSYS_SANITIZER": ""
       }
     },
     {
diff --git a/GNUmakefile b/GNUmakefile
index c739feee..771f4d5b 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -7,12 +7,17 @@ MAKEFLAGS+= --warn-undefined-variables  # Warn when an undefined variable is ref
 .SUFFIXES:                              # Disable all suffix rules.
 ##################################################
 
-PRESET ?= release
-IMAGE ?= linux-clang:23
+ifeq ($(origin CXX),default)
+  CXX:= clang++-23
+  CC:= clang-23
+endif
+
+PRESET?=release
+IMAGE?=ghcr.io/bemanproject/infra-containers-clang:latest
 
 _build_path:=build/$(PRESET)
 
-.PHONY: all check distclean dockerbuild
+.PHONY: all check distclean format dockerbuild
 
 # default target rule
 all: .init compile_commands.json ## Make all with cmake workflow preset
@@ -27,8 +32,8 @@ check: .init compile_commands.json ## Run clang-tidy on examples
 
 .PHONY: compile_commands.json
 compile_commands.json: $(_build_path)/compile_commands.json
-	if [ "$(shell readlink compile_commands.json)" != "$(_build_path)/compile_commands.json" ] ; then \
-		ln -fs $< $@
+	if [ "X$(shell readlink compile_commands.json)" != "X$(_build_path)/compile_commands.json" ] ; then \
+		ln -fs $< $@; \
 	fi
 
 CMakeUserPresets.json:: cmake/CMakeUserPresets.json
@@ -41,6 +46,10 @@ distclean: ## Remove all build artifacts
 	.init
 	find . -name '*~' -delete
 
+format: distclean  ## Format all files with pre-commit
+	-pre-commit autoupdate
+	pre-commit run --all
+
 dockerbuild: ## Start docker image interactive
 	docker run -it -v $(CURDIR):/home/builder/workdir $(IMAGE)
 
diff --git a/cmake/cxx-modules-rules.cmake b/cmake/cxx-modules-rules.cmake
index b6c50c29..49eca5d5 100644
--- a/cmake/cxx-modules-rules.cmake
+++ b/cmake/cxx-modules-rules.cmake
@@ -50,7 +50,7 @@ if(NOT DEFINED CMAKE_CXX_STANDARD)
 endif()
 
 # Neither of these two are technically needed, but they make the expectation clear
-set(CMAKE_CXX_EXTENSIONS ON)
+set(CMAKE_CXX_EXTENSIONS OFF)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
 # NOTE: only with Ninja generator install of bmi files works yet!
diff --git a/requirements.txt b/requirements.txt
index d93c02ff..9a283940 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,7 +1,7 @@
 # =============================================================================
 # PYTHON PACKAGES (PIP)
 # =============================================================================
-# USE (python3): pip3 install -U -r requirements.txt
+# USE (python3): uv pip install -r requirements.txt
 # =============================================================================
 
 ### python tools
@@ -18,11 +18,11 @@ check-jsonschema>=0.36.1
 cmake>=4.3
 codespell>=2.4.3
 # conan>=2.26.2
-gersemi>=0.27.2
+gersemi>=0.28.0
 gcovr>=8.6
 ninja>=1.13
 yamllint>=1.38
 
-beman_submodule
-beman-local-ci
+beman-submodule
+#TODO: beman-local-ci>0.3.2
 beman-tidy