diff --git a/.cargo/config.toml b/.cargo/config.toml
index 5cafed729..9f8803070 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -1,12 +1,9 @@
 [env]
 COMPILE_ENV = { value = "compile-env", relative = true, force = false }
-PATH = { value = "compile-env/bin", relative = true, force = true }
 LIBCLANG_PATH = { value = "compile-env/lib", relative = true, force = true }
-PKG_CONFIG_PATH = { value = "compile-env/sysroot/x86_64-unknown-linux-gnu/release/lib/pkgconfig", relative = true, force = true }
 
 [build]
 target = "x86_64-unknown-linux-gnu"
-rustc = "compile-env/bin/rustc"
 rustflags = ["--cfg", "tokio_unstable"]
 
 [target.x86_64-unknown-linux-gnu]
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 3115b7562..0d96b723b 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -141,6 +141,12 @@ jobs:
           sudo apt-get update
           sudo apt-get install --yes --no-install-recommends just
 
+      - name: "install rust from upstream"
+        if: ${{ matrix.profile.sterile != 'sterile' }}
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: "clippy,rustfmt"
+
       - name: "set up build environment"
         run: |
           REQUIRED_HUGEPAGES=512
@@ -149,14 +155,17 @@ jobs:
           docker run --privileged --rm busybox:latest sh -c "echo $((6 * REQUIRED_HUGEPAGES)) > $OVERCOMMIT_HUGEPAGES_PATH"
           docker run --privileged --rm busybox:latest sh -c "echo $((2 * REQUIRED_HUGEPAGES)) > $HUGEPAGES_PATH"
           docker pull "${{env.UPSTREAM_REGISTRY}}/githedgehog/testn/n-vm:v0.0.9"
-          just --yes \
-            debug_justfile="${{matrix.debug_justfile}}" \
-            profile=${{matrix.profile.name}} \
-            registry="${{env.CACHE_REGISTRY}}" \
-            refresh-compile-env
-          just --yes debug_justfile="${{matrix.debug_justfile}}" fake-nix
+          if [ "${{matrix.profile.sterile}}" = "sterile" ]; then
+            just --yes \
+                debug_justfile="${{matrix.debug_justfile}}" \
+                profile=${{matrix.profile.name}} \
+                registry="${{env.CACHE_REGISTRY}}" \
+                refresh-compile-env
+            just --yes debug_justfile="${{matrix.debug_justfile}}" fake-nix
+          fi
 
       - name: "cargo deny check"
+        if: ${{ matrix.profile.sterile == 'sterile' }}
         run: |
           just \
             debug_justfile="${{matrix.debug_justfile}}" \
@@ -202,6 +211,16 @@ jobs:
             target=x86_64-unknown-linux-gnu \
             print-container-tags
 
+      - name: Install cargo-binstall
+        if: ${{ matrix.profile.sterile != 'sterile' }}
+        uses: cargo-bins/cargo-binstall@main
+
+      - name: Install nextest and kopium
+        if: ${{ matrix.profile.sterile != 'sterile' }}
+        run: |
+            cargo binstall cargo-nextest --secure
+            cargo binstall kopium --secure
+
       - id: "test"
         name: "test"
         run: |
@@ -220,7 +239,7 @@ jobs:
                 --status-level=none \
                 --final-status-level=skip \
                 --message-format=libtest-json-plus > ./results.json
-          else
+          elif [ "${{ matrix.profile.sterile }}" = "sterile" ]; then
             echo "::notice::Running regular tests"
             just \
               debug_justfile="${{matrix.debug_justfile}}" \
@@ -254,6 +273,13 @@ jobs:
                 --features shuttle \
                 shuttle \
                 >> ./results.json
+          else
+              declare -rx NEXTEST_EXPERIMENTAL_LIBTEST_JSON=1
+              cargo nextest run \
+                --status-level=none \
+                --final-status-level=skip \
+                --message-format=libtest-json-plus \
+                > ./results.json
           fi
           # look for any flakes (flakes have a #\\d+ match in their name field)
           jq \
@@ -339,17 +365,26 @@ jobs:
       - id: "clippy"
         name: "run clippy"
         run: |
-          just debug_justfile="${{matrix.debug_justfile}}" profile=${{matrix.profile.name}} \
-            ${{matrix.profile.sterile}} cargo clippy --all-targets --all-features -- -D warnings
+          if [ "${{matrix.profile.sterile}}" != "sterile" ]; then
+            # you can't really get away with --all-features here since that enables dpdk
+            cargo clippy --all-targets -- -D warnings
+          else
+            just debug_justfile="${{matrix.debug_justfile}}" profile=${{matrix.profile.name}} \
+                ${{matrix.profile.sterile}} cargo clippy --all-targets --all-features -- -D warnings
+          fi
 
       - id: "docs"
         name: "run rustdoc"
         run: |
-          RUSTDOCFLAGS="-D warnings" just \
-            debug_justfile="${{matrix.debug_justfile}}" \
-            profile=${{matrix.profile.name}} \
-            target=x86_64-unknown-linux-gnu \
-            ${{matrix.profile.sterile}} cargo doc --no-deps
+          if [ "${{matrix.profile.sterile}}" != "sterile" ]; then
+            cargo doc --no-deps
+          else
+            RUSTDOCFLAGS="-D warnings" just \
+                debug_justfile="${{matrix.debug_justfile}}" \
+                profile=${{matrix.profile.name}} \
+                target=x86_64-unknown-linux-gnu \
+                ${{matrix.profile.sterile}} cargo doc --no-deps
+          fi
 
       - name: "Setup tmate session for debug"
         if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
diff --git a/Cargo.lock b/Cargo.lock
index 82329b8ee..04bbd1429 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1222,7 +1222,6 @@ dependencies = [
  "bolero",
  "bytecheck",
  "capctl",
- "dataplane-dpdk-sysroot-helper",
  "dataplane-id",
  "dataplane-sysfs",
  "dataplane-test-utils",
@@ -1535,7 +1534,6 @@ dependencies = [
 name = "dataplane-sysfs"
 version = "0.1.0"
 dependencies = [
- "dataplane-dpdk-sysroot-helper",
  "dataplane-id",
  "n-vm",
  "nix 0.30.1",
@@ -4067,9 +4065,9 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.12.24"
+version = "0.12.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d0946410b9f7b082a427e4ef5c8ff541a88b357bc6c637c40db3a68ac70a36f"
+checksum = "b6eff9328d40131d43bd911d42d79eb6a47312002a4daefc9e37f17e74a7701a"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -4633,9 +4631,9 @@ dependencies = [
 
 [[package]]
 name = "simd-adler32"
-version = "0.3.7"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
+checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
 
 [[package]]
 name = "simdutf8"
@@ -5239,9 +5237,9 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.7"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf146f99d442e8e68e585f5d798ccd3cad9a7835b917e09728880a862706456"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
 dependencies = [
  "bitflags 2.10.0",
  "bytes",
diff --git a/Cargo.toml b/Cargo.toml
index 38c721e3b..119f8f3cd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,5 +1,32 @@
 [workspace]
 
+default-members = [
+    "args",
+    "cli",
+    "concurrency",
+    "concurrency-macros",
+    "config",
+    "dataplane",
+    "errno",
+    "flow-info",
+    "id",
+    "interface-manager",
+    "k8s-intf",
+    "left-right-tlcache",
+    "mgmt",
+    "nat",
+    "net",
+    "pipeline",
+    "pkt-meta",
+    "rekon",
+    "routing",
+    "stats",
+    "sysfs",
+    "test-utils",
+    "tracectl",
+    "vpcmap",
+]
+
 members = [
     "args",
     "cli",
diff --git a/cli/Cargo.toml b/cli/Cargo.toml
index 6e37ce385..6c6e7a91c 100644
--- a/cli/Cargo.toml
+++ b/cli/Cargo.toml
@@ -9,6 +9,10 @@ license = "Apache-2.0"
 name = "cli"
 path = "bin/main.rs"
 
+[features]
+default = []
+sysroot = ["dep:dpdk-sysroot-helper"]
+
 [dependencies]
 clap = { workspace = true, features = ["derive", "std", "usage"] }
 colored = "3.0.0"
@@ -21,6 +25,6 @@ thiserror = { workspace = true }
 
 [build-dependencies]
 # internal
-dpdk-sysroot-helper = { workspace = true }
+dpdk-sysroot-helper = { workspace = true, optional = true }
 
 # external
diff --git a/cli/build.rs b/cli/build.rs
index 52f5b0197..1fc109eb8 100644
--- a/cli/build.rs
+++ b/cli/build.rs
@@ -2,7 +2,6 @@
 // Copyright Open Network Fabric Authors
 
 fn main() {
-    let sysroot = dpdk_sysroot_helper::get_sysroot();
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
-    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
+    #[cfg(feature = "sysroot")]
+    dpdk_sysroot_helper::use_sysroot();
 }
diff --git a/dataplane/Cargo.toml b/dataplane/Cargo.toml
index e5b4a2f8e..5caaf6a36 100644
--- a/dataplane/Cargo.toml
+++ b/dataplane/Cargo.toml
@@ -5,6 +5,11 @@ edition = "2024"
 publish = false
 license = "Apache-2.0"
 
+[features]
+default = []
+sysroot = ["dep:dpdk-sysroot-helper"]
+dpdk = ["sysroot", "dep:dpdk"]
+
 [dependencies]
 afpacket = { workspace = true, features = ["async-tokio"] }
 args = { workspace = true }
@@ -13,7 +18,7 @@ axum = { workspace = true, features = ["http1", "tokio"] }
 axum-server = { workspace = true }
 concurrency = { workspace = true }
 ctrlc = { workspace = true, features = ["termination"] }
-dpdk = { workspace = true }
+dpdk = { workspace = true, optional = true }
 dyn-iter = { workspace = true }
 futures = { workspace = true }
 hyper = { workspace = true }
@@ -59,7 +64,7 @@ tracing-subscriber = { workspace = true }
 
 [build-dependencies]
 # internal
-dpdk-sysroot-helper = { workspace = true }
+dpdk-sysroot-helper = { workspace = true, optional = true }
 
 # external
 
diff --git a/dataplane/build.rs b/dataplane/build.rs
index 52f5b0197..1fc109eb8 100644
--- a/dataplane/build.rs
+++ b/dataplane/build.rs
@@ -2,7 +2,6 @@
 // Copyright Open Network Fabric Authors
 
 fn main() {
-    let sysroot = dpdk_sysroot_helper::get_sysroot();
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
-    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
+    #[cfg(feature = "sysroot")]
+    dpdk_sysroot_helper::use_sysroot();
 }
diff --git a/dataplane/src/drivers/dpdk.rs b/dataplane/src/drivers/dpdk.rs
index f5f9b2a57..0f1903220 100644
--- a/dataplane/src/drivers/dpdk.rs
+++ b/dataplane/src/drivers/dpdk.rs
@@ -3,6 +3,7 @@
 
 //! DPDK dataplane driver
 
+#![cfg(feature = "dpdk")]
 #![allow(unused)]
 
 use dpdk::dev::{Dev, TxOffloadConfig};
diff --git a/dpdk-sysroot-helper/src/lib.rs b/dpdk-sysroot-helper/src/lib.rs
index 8c5b81f37..54ae40ee2 100644
--- a/dpdk-sysroot-helper/src/lib.rs
+++ b/dpdk-sysroot-helper/src/lib.rs
@@ -29,16 +29,6 @@ pub fn get_target_name() -> String {
         .to_string()
 }
 
-#[must_use]
-pub fn get_project_root() -> String {
-    env::var("CARGO_MANIFEST_DIR").expect("CARGO_MANIFEST_DIR not set")
-}
-
-#[must_use]
-pub fn get_compile_env() -> String {
-    env::var("COMPILE_ENV").expect("COMPILE_ENV not set")
-}
-
 #[must_use]
 pub fn get_sysroot() -> String {
     let compile_env = env::var("COMPILE_ENV").expect("COMPILE_ENV not set");
@@ -53,3 +43,9 @@ pub fn get_sysroot() -> String {
         panic!("sysroot not found at {expected_sysroot}")
     }
 }
+
+pub fn use_sysroot() {
+    let sysroot = get_sysroot();
+    println!("cargo:rustc-link-search=all={sysroot}/lib");
+    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
+}
diff --git a/dpdk/build.rs b/dpdk/build.rs
index 52f5b0197..236576084 100644
--- a/dpdk/build.rs
+++ b/dpdk/build.rs
@@ -2,7 +2,5 @@
 // Copyright Open Network Fabric Authors
 
 fn main() {
-    let sysroot = dpdk_sysroot_helper::get_sysroot();
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
-    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
+    dpdk_sysroot_helper::use_sysroot();
 }
diff --git a/hardware/Cargo.toml b/hardware/Cargo.toml
index 6b5daf745..3cb760e19 100644
--- a/hardware/Cargo.toml
+++ b/hardware/Cargo.toml
@@ -49,6 +49,3 @@ serde = { workspace = true, features = ["std"] }
 serde_yaml_ng = { workspace = true, features = [] }
 tokio = { workspace = true }
 tracing-subscriber = { workspace = true }
-
-[build-dependencies]
-dpdk-sysroot-helper = { workspace = true }
diff --git a/hardware/build.rs b/hardware/build.rs
deleted file mode 100644
index 52f5b0197..000000000
--- a/hardware/build.rs
+++ /dev/null
@@ -1,8 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Copyright Open Network Fabric Authors
-
-fn main() {
-    let sysroot = dpdk_sysroot_helper::get_sysroot();
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
-    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
-}
diff --git a/init/Cargo.toml b/init/Cargo.toml
index 6ac33af3c..97e7d6b97 100644
--- a/init/Cargo.toml
+++ b/init/Cargo.toml
@@ -5,6 +5,10 @@ edition = "2024"
 publish = false
 license = "Apache-2.0"
 
+[features]
+default = []
+sysroot = ["dep:dpdk-sysroot-helper"]
+
 [dependencies]
 # internal
 hardware = { workspace = true, features = ["serde", "scan"] }
@@ -27,6 +31,6 @@ tracing-subscriber = { workspace = true, features = ["fmt"] }
 
 [build-dependencies]
 # internal
-dpdk-sysroot-helper = { workspace = true }
+dpdk-sysroot-helper = { workspace = true, optional = true }
 
 # external
diff --git a/init/build.rs b/init/build.rs
index 52f5b0197..1fc109eb8 100644
--- a/init/build.rs
+++ b/init/build.rs
@@ -2,7 +2,6 @@
 // Copyright Open Network Fabric Authors
 
 fn main() {
-    let sysroot = dpdk_sysroot_helper::get_sysroot();
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
-    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
+    #[cfg(feature = "sysroot")]
+    dpdk_sysroot_helper::use_sysroot();
 }
diff --git a/sysfs/Cargo.toml b/sysfs/Cargo.toml
index 51de2676b..2e0068f96 100644
--- a/sysfs/Cargo.toml
+++ b/sysfs/Cargo.toml
@@ -26,6 +26,5 @@ n-vm = { workspace = true }
 
 [build-dependencies]
 # internal
-dpdk-sysroot-helper = { workspace = true }
 
 # external
diff --git a/sysfs/build.rs b/sysfs/build.rs
deleted file mode 100644
index 52f5b0197..000000000
--- a/sysfs/build.rs
+++ /dev/null
@@ -1,8 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Copyright Open Network Fabric Authors
-
-fn main() {
-    let sysroot = dpdk_sysroot_helper::get_sysroot();
-    println!("cargo:rustc-link-search=all={sysroot}/lib");
-    println!("cargo:rustc-link-arg=--sysroot={sysroot}");
-}