diff --git a/configs/common/packages.yaml b/configs/common/packages.yaml
index 4a3ba6c88..7375216c5 100644
--- a/configs/common/packages.yaml
+++ b/configs/common/packages.yaml
@@ -58,6 +58,13 @@ packages:
       require:
       - '@0.0.5'
       - +python
+    # cairo@1.18.0: is uses the meson recipe. The meson build enforces variants
+    # that are all-enabled or all-disabled. The "all-enabled" variants are set to help
+    # the concretizer resolve the correct version without disabling all variants.
+    cairo:
+      require:
+      - '@1.18:'
+      - +zlib+ft+fc+png+pdf
     cdo:
       require:
       - ~openmp
@@ -103,10 +110,11 @@ packages:
       - +netcdf
       - +png
       - +tools
+    # uwtools@2.17: needs ecflow@5.16:; leave the version to the concretizer
     ecflow:
       require:
-      - '@5.11.4'
       - +ui
+      - '@5.18:'
     eckit:
       require:
       - '@2.0.7'
@@ -394,8 +402,11 @@ packages:
     # are removed, which itself is problematic.
     python:
       require:
-      - '@3.11'
-      - ~crypt
+      - '@3.13'
+      # The crypt variant only exists for python<=3.12 since the module was dropped.
+      # An unconditional ~crypt caps python at 3.12
+      - spec: ~crypt
+        when: '@:3.12'
     # Not sure about the exact version requirements, but earlier
     # versions (definitely 4.5.3 and earlier) don't work with newer
     # py-setuptools (version 68 and later) because of a breaking
@@ -414,10 +425,14 @@ packages:
     py-colorama:
       require:
       - '@0.4.6'
-    # Pin to version 42 to avoid maturin dependency that breaks Intel oneAPI builds
-    py-cryptography:
+    # No tutorials extras; prevent py-pandas-datareader dep with broken configparser call
+    py-arch:
+      require:
+      - ~tutorial
+    # Exclude @:2021.3.0 (broken configparser call), which its default +bag/+delayed variants select
+    py-dask:
       require:
-      - '@42'
+      - '@2023.4.1:'
     py-h5py:
       require:
       - ~mpi
@@ -443,11 +458,16 @@ packages:
     # To avoid duplicate packages
     py-numpy:
       require:
-      - '@1'
+      - '@2'
     # Restrict py-pandas to older versions compatible with py-numpy and py-xarray
     py-pandas:
       require:
       - '@:2'
+      # py-versioneer is unavoidably duplicated by pins in py-pyogrio (@0.28) and
+      # py-partd (@0.29). py-pandas is unconstrained and can further cascade splits
+      # into py-xarray/met/metplus/jedi-base-env. This constraints py-pandas to @0.28
+      # (shared with py-pyogrio) so only py-versioneer itself is duplicated.
+      - ^py-versioneer@0.28
     # To avoid duplicate packages
     py-poetry-core:
       require:
@@ -477,19 +497,19 @@ packages:
     py-python-dateutil:
       require:
       - '@2'
-    # To avoid duplicate packages
+    # To avoid duplicate packages, pin to recent version.
     py-requests:
       require:
-      - '@2.32.3'
+      - '@2.32:'
     # To avoid duplicate packages
     py-ruamel-yaml:
       require:
       - '@0.17.16'
     # https://github.com/JCSDA/spack-stack/issues/1942
     # https://github.com/spack/spack-packages/issues/3695
-    py-setuptools:
-      require:
-      - '@73.0.1'
+    # NOTE: py-setuptools was pinned @73.0.1 for the py3.11 stack; removed for the
+    # py3.12/numpy2 migration since modern packages (e.g. py-xarray@2025.7) require
+    # py-setuptools@77.0.3:. Re-evaluate issue #3695 if setuptools duplicates recur.
     # See py-pycparser
     py-sphinxcontrib-bibtex:
       require:
@@ -503,10 +523,10 @@ packages:
       require:
       - '@1.26.20'
       # OR - '@1.26.12' ?
-    # To avoid duplicate packages
+    # Not '@=0.28'; py-pyogrio needs 0.28 and py-partd/py-dask 0.29, build-only so a split is fine
     py-versioneer:
       require:
-      - '@=0.28'
+      - '@0.28:'
     # On a per-site basis, either set qt to buildable: false
     # or add requirement to build with gcc for Intel oneAPI
     qt:
@@ -547,9 +567,10 @@ packages:
     upp:
       require:
       - '@10.0.10'
+    # Upper bound keeps the branch version 'main' out; spack sorts it above 2.x
     uwtools:
       require:
-      - '@2.7.2'
+      - '@2.17:2'
     w3emc:
       require:
       - '@2.13.0'
diff --git a/configs/common/packages_oneapi.yaml b/configs/common/packages_oneapi.yaml
index ad4ea0e5d..ce9150d2e 100644
--- a/configs/common/packages_oneapi.yaml
+++ b/configs/common/packages_oneapi.yaml
@@ -56,6 +56,10 @@ packages:
     nco:
       require:
       - '%c,cxx=gcc'
+    # The py-numpy cannot be built with oneAPI.
+    py-numpy:
+      require:
+      - '%c,cxx=gcc'
     oops:
       require:
       - +mkl
diff --git a/configs/sites/tier2/aws-ubuntu2404/README.md b/configs/sites/tier2/aws-ubuntu2404/README.md
index 981a3d6a5..654ba0993 100644
--- a/configs/sites/tier2/aws-ubuntu2404/README.md
+++ b/configs/sites/tier2/aws-ubuntu2404/README.md
@@ -1,6 +1,6 @@
 ## spack-stack AMI (Ubuntu 24.04)
 
-This document is to go over the the running and usage of this specific AMI for Ubuntu 24.04 LTS. This image has two environments: gnu (gcc-12.3), and intel (intel@2021.10.0). You can use either one of these environments for development purposes.
+This document is to go over the the running and usage of this specific AMI for Ubuntu 24.04 LTS. This image has two environments: gnu (gcc-13.3.0), and intel (intel-oneapi 2026.1.1). You can use either one of these environments for development purposes.
 
 ### Using the Snapshot
 
@@ -120,7 +120,7 @@ exit
 
 ```bash
 cd /opt
-sudo git clone -b release/2.0 --depth 1 --recursive https://github.com/jcsda/spack-stack.git
+sudo git clone -b release/2.1 --depth 1 --recursive https://github.com/jcsda/spack-stack.git
 ```
 
 ## Install Spack-Stack Steps by Compiler
@@ -147,9 +147,12 @@ spack external find --scope system \
 spack compiler find --scope system
 export SPACK_DISABLE_LOCAL_CONFIG=true
 unset SPACK_SYSTEM_CONFIG_PATH
-# ACTION: Edit the site/compilers.yaml with the following.
-#   1) Delete or comment gcc-13 refs and preserve only gcc-12
-#   2) Delete or comment clang refs.
+# ACTION: Edit the generated compiler config (site/compilers.yaml and/or the
+# compiler entries in site/packages.yaml) with the following.
+#   1) Keep a single gcc@13.3.0 spec (the system compiler installed above);
+#      delete any empty or duplicate gcc specs. Redundant/empty specs cause
+#      cryptic build errors later.
+#   2) Delete or comment clang/llvm refs.
 
 # Continue configuration.
 spack config add "packages:all:prefer:['%gcc']"
@@ -173,7 +176,7 @@ spack stack setup-meta-modules
 
 # Add a number of default module locations to the lmod startup script.
 cat << 'EOF' >> /etc/profile.d/z01_lmod.sh
-module use /opt/spack-stack/envs/unified-env-gcc/install/modulefiles/Core
+module use /opt/spack-stack/envs/unified-gcc/install/modulefiles/Core
 EOF
 ```
 
@@ -190,7 +193,7 @@ sudo su -
 wget -O- https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB | gpg --dearmor | tee /usr/share/keyrings/oneapi-archive-keyring.gpg > /dev/null
 echo "deb [signed-by=/usr/share/keyrings/oneapi-archive-keyring.gpg] https://apt.repos.intel.com/oneapi all main" | tee /etc/apt/sources.list.d/oneAPI.list
 apt update
-apt install intel-oneapi-compiler-dpcpp-cpp-2025.3 intel-oneapi-compiler-fortran-2025.3 intel-oneapi-mpi-devel-2021.17 intel-oneapi-tbb-devel-2022.3 intel-oneapi-mkl-devel-2025.3 -y
+apt install intel-oneapi-compiler-dpcpp-cpp-2026.1 intel-oneapi-compiler-fortran-2026.1 intel-oneapi-mpi-devel-2021.18 intel-oneapi-tbb-devel-2023.1 intel-oneapi-mkl-devel-2026.1 -y
 
 exit
 ```
@@ -208,33 +211,40 @@ cat << 'EOF' >> /etc/profile.d/z01_lmod.sh
 module use /opt/intel/oneapi/modulefiles
 EOF
 
-# Create combined module file.
+# Create combined module file. Note that the compiler modulefile has a "tcm"
+# prerequisite; omitting it fails the load with "Cannot load module
+# compiler/2026.1.1. At least one of these module(s) must be loaded: tcm".
 mkdir /opt/intel/oneapi/modulefiles/intel-oneapi-full-env/
-cat << 'EOF' >> /opt/intel/oneapi/modulefiles/intel-oneapi-full-env/2025.3.0
+cat << 'EOF' >> /opt/intel/oneapi/modulefiles/intel-oneapi-full-env/2026.1.1
 #%Module1.0
 ##
-## intel-oneapi-full-env/2025.3.0
+## intel-oneapi-full-env/2026.1.1
 ## Intel oneAPI full module environment
 
 proc ModulesHelp { } {
     puts stderr "intel-oneapi-full-env defines the entire module set used for spack-stack intel builds"
 }
 module-whatis "intel-oneapi-full-env defines the entire module set used for spack-stack intel builds"
-module load umf/1.0.2
-module load tbb/2022.3
-module load compiler-rt/2025.3.0
-module load compiler/2025.3.0
-module load mkl/2025.3
-module load compiler-intel-llvm/2025.3.0
+module load umf/1.1.0
+module load tcm/1.5
+module load tbb/2023.1
+module load compiler-rt/2026.1.1
+module load compiler/2026.1.1
+module load mkl/2026.1
+module load compiler-intel-llvm/2026.1.1
 EOF
 ```
 
 #### Install Intel OneAPI Spack-Stack Environment
 
+The steps below are how this site config was generated. Note that the oneAPI
+modules must **not** be loaded during `spack install` -- see "The module-load
+trap" at the end of this section.
+
 ```bash
 sudo su -
 
-module load intel-oneapi-full-env/2025.3.0
+module load intel-oneapi-full-env/2026.1.1
 export FC=ifx
 export CXX=icpx
 export CC=icx
@@ -247,16 +257,6 @@ cd envs/unified-oneapi
 spack env activate -p .
 
 
-# Before finding packages you need to go into ./common/packages.yaml
-# and comment out gmake requirements to prevent gmake from being
-# over-constrained.
-#   pico ./common/packages.yaml
-# Near the top of the file find and comment out these three lines.
-#  gmake:
-#    require:
-#    - '%gcc'
-
-
 # Find external packages for the site config.
 unset SPACK_DISABLE_LOCAL_CONFIG
 export SPACK_SYSTEM_CONFIG_PATH="$(pwd)/site"
@@ -273,31 +273,30 @@ cat << 'EOF' >> ${SPACK_SYSTEM_CONFIG_PATH}/packages.yaml
   intel-oneapi-runtime:
     buildable: false
     externals:
-    - spec: intel-oneapi-runtime@2025.3.0
+    - spec: intel-oneapi-runtime@2026.1.1
       prefix: /opt/intel/oneapi
       modules:
-      - compiler-rt/2025.3.0
+      - compiler-rt/2026.1.1
   intel-oneapi-mkl:
     buildable: false
     externals:
-    - spec: intel-oneapi-mkl@2025.3
+    # No "modules:" here on purpose - see "The module-load trap" below.
+    - spec: intel-oneapi-mkl@2026.1
       prefix: /opt/intel/oneapi
-      modules:
-      - mkl/2025.3
   intel-oneapi-mpi:
     buildable: false
     externals:
-    - spec: intel-oneapi-mpi@2021.17
+    - spec: intel-oneapi-mpi@2021.18
       prefix: /opt/intel/oneapi
       modules:
-      - mpi/2021.17
+      - mpi/2021.18
   intel-oneapi-tbb:
     buildable: false
     externals:
-    - spec: intel-oneapi-tbb@2022.3
+    - spec: intel-oneapi-tbb@2023.1
       prefix: /opt/intel/oneapi
       modules:
-      - tbb/2022.3
+      - tbb/2023.1
 EOF
 
 spack compiler find --scope system
@@ -315,28 +314,27 @@ pico ${PWD}/site/packages.yaml
 #   intel-oneapi-compilers:
 #     buildable: false
 #     externals:
-#     - spec: intel-oneapi-compilers@2025.3.0
+#     - spec: intel-oneapi-compilers@2026.1.1
 #       prefix: /opt/intel/oneapi
 #       modules:
-#       - umf/1.0.2
-#       - tbb/2022.3
-#       - compiler-rt/2025.3.0
-#       - compiler/2025.3.0
+#       - umf/1.1.0
+#       - tcm/1.5
+#       - tbb/2023.1
+#       - compiler-rt/2026.1.1
+#       - compiler/2026.1.1
 #       extra_attributes:
 #         compilers:
-#           c: /opt/intel/oneapi/compiler/2025.3/bin/icx
-#           fortran: /opt/intel/oneapi/compiler/2025.3/bin/ifx
-#           cxx: /opt/intel/oneapi/compiler/2025.3/bin/icpx
+#           c: /opt/intel/oneapi/compiler/2026.1/bin/icx
+#           fortran: /opt/intel/oneapi/compiler/2026.1/bin/ifx
+#           cxx: /opt/intel/oneapi/compiler/2026.1/bin/icpx
 #   gcc:
 #     buildable: false
 #     externals:
 #     - spec: gcc@13.3.0 languages:='c,c++,fortran'
 #       ....
 
-export SPACK_DISABLE_LOCAL_CONFIG=true
-unset SPACK_SYSTEM_CONFIG_PATH
-
-# Edit the spack.yaml to include these clauses.
+# Edit the spack.yaml to include these clauses. Note this must happen before
+# SPACK_SYSTEM_CONFIG_PATH is unset, or it writes to /packages.yaml.
 cat << 'EOF' >> ${SPACK_SYSTEM_CONFIG_PATH}/packages.yaml
     all:
       prefer:
@@ -351,7 +349,7 @@ cat << 'EOF' >> ${SPACK_SYSTEM_CONFIG_PATH}/packages.yaml
       - '%fortran=gcc %c,cxx=oneapi'
       - '%fortran=gcc %c=oneapi'
       providers:
-        mpi: [intel-oneapi-mpi@2021.17]
+        mpi: [intel-oneapi-mpi@2021.18]
     met:
       variants: +python +grib2 +graphics +lidar2nc +modis
     openmpi:
@@ -372,6 +370,12 @@ cat << 'EOF' >> ${SPACK_SYSTEM_CONFIG_PATH}/packages.yaml
       - +libyaml
 EOF
 
+export SPACK_DISABLE_LOCAL_CONFIG=true
+unset SPACK_SYSTEM_CONFIG_PATH
+
+# Purge the oneAPI modules before installing - see the trap below.
+module purge
+
 spack concretize 2>&1 | tee log.concretize
 ${SPACK_STACK_DIR}/util/show_duplicate_packages.py
 spack install --fail-fast -j 12 2>&1 | tee log.install
@@ -379,10 +383,23 @@ spack module lmod refresh && \
 spack stack setup-meta-modules
 
 cat << 'EOF' >> /etc/profile.d/z01_lmod.sh
-module use /opt/spack-stack/envs/unified-env-oneapi/install/modulefiles/Core
+module use /opt/spack-stack/envs/unified-oneapi/install/modulefiles/Core
 EOF
 ```
 
+#### The module-load trap
+
+Spack loads an external's `modules:` itself and treats a load that does not change
+`LOADEDMODULES` as a failure. So any oneAPI module already loaded in your shell
+makes `spack install` die with a misleading `ModuleLoadError` partway through.
+Purge before installing, and let spack do the loading.
+
+For the same reason no two externals may list the same module. That is why
+`intel-oneapi-mkl` above has no `modules:`: it would load before the compilers
+entry and miss its `tbb`/`compiler-rt` prereqs, but listing those on mkl collides
+with the compilers entry. It needs neither -- the recipe sets `MKLROOT` from
+`prefix`.
+
 </details>
 
 ## Test Installation
@@ -392,9 +409,9 @@ EOF
 
 ```bash
 # Example given for building jedi-bundle
-module use /opt/spack-stack/envs/unified-dev-gcc/install/modulefiles/Core
-module load stack-gcc/11.4.0
-module load stack-openmpi/5.0.5
+module use /opt/spack-stack/envs/unified-gcc/install/modulefiles/Core
+module load stack-gcc/13.3.0
+module load stack-openmpi/5.0.8
 module load base-env
 module load jedi-mpas-env
 module load jedi-fv3-env
@@ -419,9 +436,9 @@ ctest
 
 ```bash
 # Build jedi-bundle with oneapi
-module use /opt/spack-stack/envs/unified-env-oneapi/install/modulefiles/Core
-module load stack-intel-oneapi-compilers/2025.3.0
-module load stack-intel-oneapi-mpi/2021.17
+module use /opt/spack-stack/envs/unified-oneapi/install/modulefiles/Core
+module load stack-intel-oneapi-compilers/2026.1.1
+module load stack-intel-oneapi-mpi/2021.18
 module load base-env
 module load jedi-mpas-env
 module load jedi-fv3-env
diff --git a/configs/sites/tier2/aws-ubuntu2404/modules.yaml b/configs/sites/tier2/aws-ubuntu2404/modules.yaml
index 2aa34ac0e..3b7f4a363 100644
--- a/configs/sites/tier2/aws-ubuntu2404/modules.yaml
+++ b/configs/sites/tier2/aws-ubuntu2404/modules.yaml
@@ -8,7 +8,6 @@ modules:
       - apple-clang
       - gcc
       - intel-oneapi-compilers
-      - llvm
       # MPI modules
       - cray-mpich
       - intel-mpi
diff --git a/configs/sites/tier2/aws-ubuntu2404/packages.yaml b/configs/sites/tier2/aws-ubuntu2404/packages.yaml
index 436375666..e4372adb1 100644
--- a/configs/sites/tier2/aws-ubuntu2404/packages.yaml
+++ b/configs/sites/tier2/aws-ubuntu2404/packages.yaml
@@ -56,6 +56,10 @@ packages:
     externals:
     - spec: gawk@5.2.1
       prefix: /usr
+  gettext:
+    externals:
+    - spec: gettext@0.21
+      prefix: /usr
   git:
     externals:
     - spec: git@2.43.0~tcltk
@@ -68,10 +72,18 @@ packages:
     externals:
     - spec: grep@3.11
       prefix: /usr
+  gmake:
+    externals:
+    - spec: gmake@4.3
+      prefix: /usr
   groff:
     externals:
     - spec: groff@1.23.0
       prefix: /usr
+  libtool:
+    externals:
+    - spec: libtool@2.4.7
+      prefix: /usr
   m4:
     externals:
     - spec: m4@1.4.19
@@ -94,9 +106,11 @@ packages:
     externals:
     - spec: sed@4.9
       prefix: /usr
-  tar:
+  tar::
+    buildable: false
     externals:
     - spec: tar@1.35
+      prefix: /usr
   wget::
     buildable: false
     externals:
diff --git a/configs/sites/tier2/aws-ubuntu2404/packages_oneapi.yaml b/configs/sites/tier2/aws-ubuntu2404/packages_oneapi.yaml
index a8a255671..55149ad0a 100644
--- a/configs/sites/tier2/aws-ubuntu2404/packages_oneapi.yaml
+++ b/configs/sites/tier2/aws-ubuntu2404/packages_oneapi.yaml
@@ -14,23 +14,25 @@ packages:
     - '%fortran=gcc %c,cxx=oneapi'
     - '%fortran=gcc %c=oneapi'
     providers:
-      mpi:: [intel-oneapi-mpi@2021.17]
+      mpi:: [intel-oneapi-mpi@2021.18]
 
   intel-oneapi-compilers:
     buildable: false
     externals:
-    - spec: intel-oneapi-compilers@2025.3.0
+    - spec: intel-oneapi-compilers@2026.1.1
       prefix: /opt/intel/oneapi
       modules:
-       - umf/1.0.2
-       - tbb/2022.3
-       - compiler-rt/2025.3.0
-       - compiler/2025.3.0
+       - umf/1.1.0
+       # 2026.1's compiler modulefile adds a "tcm" prereq that 2025.3 lacks
+       - tcm/1.5
+       - tbb/2023.1
+       - compiler-rt/2026.1.1
+       - compiler/2026.1.1
       extra_attributes:
         compilers:
-          fortran: /opt/intel/oneapi/compiler/2025.3/bin/ifx
-          c: /opt/intel/oneapi/compiler/2025.3/bin/icx
-          cxx: /opt/intel/oneapi/compiler/2025.3/bin/icpx
+          fortran: /opt/intel/oneapi/compiler/2026.1/bin/ifx
+          c: /opt/intel/oneapi/compiler/2026.1/bin/icx
+          cxx: /opt/intel/oneapi/compiler/2026.1/bin/icpx
   openmpi:
     buildable: false
   mpich:
@@ -38,7 +40,7 @@ packages:
   mpi:
     buildable: false
     require:
-    - intel-oneapi-mpi@2021.17
+    - intel-oneapi-mpi@2021.18
   gcc:
     externals:
     - spec: gcc@13.3.0 languages:='c,c++,fortran'
@@ -52,24 +54,33 @@ packages:
   intel-oneapi-mkl:
     buildable: false
     externals:
-    - spec: intel-oneapi-mkl@2025.3
+    # Deliberately NO "modules:" here. The mkl/2026.1 modulefile declares prereqs
+    # on tbb and compiler-rt, and spack loads externals in DAG order -- for e.g.
+    # "ip" it loads intel-oneapi-mkl BEFORE intel-oneapi-compilers, so mkl would
+    # be loaded without its prereqs and fail with
+    #   ModuleLoadError: Module 'mkl/2026.1' could not be loaded.
+    # Adding tbb/compiler-rt here instead collides with the compilers entry
+    # below: spack's load_module() treats an already-loaded module (no change to
+    # LOADEDMODULES) as a failure, so the second load of tbb would error.
+    # None of it is needed -- the intel-oneapi-mkl package sets MKLROOT and
+    # PKG_CONFIG_PATH from component_prefix (= prefix/mkl/<version>) under the
+    # default +envmods, and resolves libs/headers from prefix.
+    - spec: intel-oneapi-mkl@2026.1
       prefix: /opt/intel/oneapi
-      modules:
-      - mkl/2025.3
   intel-oneapi-mpi:
     buildable: false
     externals:
-    - spec: intel-oneapi-mpi@2021.17
+    - spec: intel-oneapi-mpi@2021.18
       modules:
-      - mpi/2021.17
+      - mpi/2021.18
       prefix: /opt/intel/oneapi
   intel-oneapi-tbb:
     buildable: false
     externals:
-    - spec: intel-oneapi-tbb@2022.3
+    - spec: intel-oneapi-tbb@2023.1
       prefix: /opt/intel/oneapi
       modules:
-      - tbb/2022.3
+      - tbb/2023.1
 
   # Package constraints.
   jedi-base-env: