diff --git a/host/Cargo.lock b/host/Cargo.lock
index 2eb902c..2fc74fa 100644
--- a/host/Cargo.lock
+++ b/host/Cargo.lock
@@ -582,7 +582,7 @@ checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 [[package]]
 name = "hyperlight-common"
 version = "0.15.0"
-source = "git+https://github.com/hyperlight-dev/hyperlight?branch=disk_snapshot_copy#621cc03beadae3d9158e72d07d3d156abf2b21fd"
+source = "git+https://github.com/danbugs/hyperlight?rev=5cf37d92#5cf37d92262c918e7d633577a6cf946fb1f069bd"
 dependencies = [
  "anyhow",
  "flatbuffers",
@@ -596,7 +596,7 @@ dependencies = [
 [[package]]
 name = "hyperlight-host"
 version = "0.15.0"
-source = "git+https://github.com/hyperlight-dev/hyperlight?branch=disk_snapshot_copy#621cc03beadae3d9158e72d07d3d156abf2b21fd"
+source = "git+https://github.com/danbugs/hyperlight?rev=5cf37d92#5cf37d92262c918e7d633577a6cf946fb1f069bd"
 dependencies = [
  "anyhow",
  "bitflags 2.11.1",
diff --git a/host/Cargo.toml b/host/Cargo.toml
index 9b8a16b..f6a7cca 100644
--- a/host/Cargo.toml
+++ b/host/Cargo.toml
@@ -27,9 +27,8 @@ name = "pyhl"
 path = "src/bin/pyhl.rs"
 
 [dependencies]
-# hyperlight-dev/hyperlight#1373 — Ludvig's Snapshot::to_file/from_file
-# Uses PAGE_READONLY mapping (no host commit charge per VM).
-hyperlight-host = { git = "https://github.com/hyperlight-dev/hyperlight", branch = "disk_snapshot_copy", features = ["executable_heap", "hw-interrupts"] }
+# danbugs/hyperlight perf/whp-warm-start — snapshot file support + WHP warm-start optimizations.
+hyperlight-host = { git = "https://github.com/danbugs/hyperlight", rev = "5cf37d92", features = ["executable_heap", "hw-interrupts", "whp-no-surrogate"] }
 clap = { version = "4", features = ["derive", "env"] }
 anyhow = "1"
 memmap2 = "0.9"
diff --git a/host/src/lib.rs b/host/src/lib.rs
index 6425def..db14dc3 100644
--- a/host/src/lib.rs
+++ b/host/src/lib.rs
@@ -2008,10 +2008,9 @@ pub struct Sandbox {
     inner: MultiUseSandbox,
     /// Post-init snapshot for fast restore between calls.
     snapshot: Option<Arc<Snapshot>>,
-    /// File mapping to re-register after snapshot restore.
-    /// Snapshot restore unmaps all non-snapshot regions.
+    /// When set, restore uses the preserving variant to keep the
+    /// read-only file mapping alive across restores.
     file_mapping_path: Option<std::path::PathBuf>,
-    file_mapping_base: u64,
     exit_code: Arc<AtomicI32>,
     /// Shared socket table — cleared on [`Sandbox::restore`] so that
     /// host-side fds don't leak across guest restore cycles.
@@ -2247,7 +2246,7 @@ impl Sandbox {
             tools_ref.dispatch(&payload)
         })?;
 
-        Self::finish_evolve(usbox, None, 0, exit_code, sleep_cancel, socket_table)
+        Self::finish_evolve(usbox, None, exit_code, sleep_cancel, socket_table)
     }
 
     /// Low-level: boot with a zero-copy mapped initrd file. Prefer the builder.
@@ -2304,7 +2303,6 @@ impl Sandbox {
         Self::finish_evolve(
             usbox,
             initrd_path.map(|p| p.to_path_buf()),
-            INITRD_MAP_BASE,
             exit_code,
             sleep_cancel,
             socket_table,
@@ -2314,7 +2312,6 @@ impl Sandbox {
     fn finish_evolve(
         usbox: UninitializedSandbox,
         file_mapping_path: Option<std::path::PathBuf>,
-        file_mapping_base: u64,
         exit_code: Arc<AtomicI32>,
         sleep_cancel: SleepCancel,
         socket_table: Option<Arc<Mutex<SocketTable>>>,
@@ -2325,7 +2322,6 @@ impl Sandbox {
             inner,
             snapshot,
             file_mapping_path,
-            file_mapping_base,
             exit_code,
             socket_table,
             sleep_cancel,
@@ -2338,15 +2334,12 @@ impl Sandbox {
     /// guest memory to the state captured after init.
     pub fn restore(&mut self) -> Result<()> {
         if let Some(ref snap) = self.snapshot {
-            self.inner.restore(snap.clone())?;
-        }
-        // Re-register file mapping after restore (snapshot restore
-        // unmaps all non-snapshot regions including file mappings)
-        if let Some(ref path) = self.file_mapping_path {
-            self.inner
-                .map_file_cow(path, self.file_mapping_base, Some("initrd"))?;
+            if self.file_mapping_path.is_some() {
+                self.inner.restore_preserving_file_mappings(snap.clone())?;
+            } else {
+                self.inner.restore(snap.clone())?;
+            }
         }
-        // Close leaked host-side sockets the guest "forgot" about.
         if let Some(ref table) = self.socket_table {
             table.lock().unwrap().clear();
         }
@@ -2543,7 +2536,6 @@ impl Sandbox {
             inner,
             snapshot: Some(arc),
             file_mapping_path: initrd,
-            file_mapping_base: INITRD_MAP_BASE,
             exit_code,
             socket_table,
             sleep_cancel,