diff --git a/lib/Cargo.toml b/lib/Cargo.toml
index cc1528fbe..eaf785e74 100644
--- a/lib/Cargo.toml
+++ b/lib/Cargo.toml
@@ -11,10 +11,10 @@ rust-version = "1.64.0"
 [dependencies]
 anyhow = "1.0"
 camino = { version = "1.0.4", features = ["serde1"] }
-ostree-ext = "0.10.6"
+ostree-ext = "0.11"
 clap = { version= "4.2", features = ["derive"] }
 clap_mangen = { version = "0.2", optional = true }
-cap-std-ext = "1.0.1"
+cap-std-ext = "2"
 hex = "^0.4"
 fn-error-context = "0.2.0"
 gvariant = "0.4.0"
@@ -25,7 +25,7 @@ once_cell = "1.9"
 openssl = "^0.10"
 nix = ">= 0.24, < 0.26"
 regex = "1.7.1"
-rustix = { "version" = "0.36", features = ["thread"] }
+rustix = { "version" = "0.37", features = ["thread", "process"] }
 serde = { features = ["derive"], version = "1.0.125" }
 serde_json = "1.0.64"
 serde_with = ">= 1.9.4, < 2"
diff --git a/lib/src/cli.rs b/lib/src/cli.rs
index bc35104f8..6413911c5 100644
--- a/lib/src/cli.rs
+++ b/lib/src/cli.rs
@@ -4,7 +4,6 @@
 
 use anyhow::{Context, Result};
 use camino::Utf8PathBuf;
-use cap_std_ext::rustix;
 use clap::Parser;
 use fn_error_context::context;
 use ostree::{gio, glib};
@@ -145,7 +144,7 @@ pub(crate) async fn ensure_self_unshared_mount_namespace() -> Result<()> {
         return Ok(());
     }
     if std::env::var_os(recurse_env).is_some() {
-        let am_pid1 = cap_std_ext::rustix::process::getpid().is_init();
+        let am_pid1 = rustix::process::getpid().is_init();
         if am_pid1 {
             tracing::debug!("We are pid 1");
             return Ok(());
@@ -237,7 +236,7 @@ pub(crate) fn require_root() -> Result<()> {
     if !uid.is_root() {
         anyhow::bail!("This command requires root privileges");
     }
-    if !rustix::thread::is_in_capability_bounding_set(rustix::thread::Capability::SystemAdmin)? {
+    if !rustix::thread::capability_is_in_bounding_set(rustix::thread::Capability::SystemAdmin)? {
         anyhow::bail!("This command requires full root privileges (CAP_SYS_ADMIN)");
     }
     Ok(())
@@ -263,10 +262,10 @@ async fn prepare_for_write() -> Result<()> {
 async fn upgrade(opts: UpgradeOpts) -> Result<()> {
     prepare_for_write().await?;
     let sysroot = &get_locked_sysroot().await?;
-    let repo = &sysroot.repo().unwrap();
+    let repo = &sysroot.repo();
     let booted_deployment = &sysroot.require_booted_deployment()?;
     let status = crate::status::DeploymentStatus::from_deployment(booted_deployment, true)?;
-    let osname = booted_deployment.osname().unwrap();
+    let osname = booted_deployment.osname();
     let origin = booted_deployment
         .origin()
         .ok_or_else(|| anyhow::anyhow!("Deployment is missing an origin"))?;
@@ -279,7 +278,7 @@ async fn upgrade(opts: UpgradeOpts) -> Result<()> {
             "Booted deployment contains local rpm-ostree modifications; cannot upgrade via bootc"
         ));
     }
-    let commit = booted_deployment.csum().unwrap();
+    let commit = booted_deployment.csum();
     let state = ostree_container::store::query_image_commit(repo, &commit)?;
     let digest = state.manifest_digest.as_str();
     let fetched = pull(repo, &imgref, opts.quiet).await?;
@@ -308,8 +307,8 @@ async fn switch(opts: SwitchOpts) -> Result<()> {
     let booted_deployment = &sysroot.require_booted_deployment()?;
     let (origin, booted_image) = crate::utils::get_image_origin(booted_deployment)?;
     let booted_refspec = origin.optional_string("origin", "refspec")?;
-    let osname = booted_deployment.osname().unwrap();
-    let repo = &sysroot.repo().unwrap();
+    let osname = booted_deployment.osname();
+    let repo = &sysroot.repo();
 
     let transport = ostree_container::Transport::try_from(opts.transport.as_str())?;
     let imgref = ostree_container::ImageReference {
diff --git a/lib/src/install.rs b/lib/src/install.rs
index f9df6adfb..c173f8f50 100644
--- a/lib/src/install.rs
+++ b/lib/src/install.rs
@@ -20,7 +20,7 @@ use camino::Utf8PathBuf;
 use cap_std::fs::Dir;
 use cap_std_ext::cap_std;
 use cap_std_ext::prelude::CapStdExtDirExt;
-use cap_std_ext::rustix::fs::MetadataExt;
+use rustix::fs::MetadataExt;
 
 use fn_error_context::context;
 use ostree::gio;
@@ -518,7 +518,7 @@ async fn initialize_ostree_root_from_self(
         .next()
         .ok_or_else(|| anyhow::anyhow!("Failed to find deployment"))?;
     // SAFETY: There must be a path
-    let path = sysroot.deployment_dirpath(&deployment).unwrap();
+    let path = sysroot.deployment_dirpath(&deployment);
     let root = rootfs_dir
         .open_dir(path.as_str())
         .context("Opening deployment dir")?;
@@ -531,7 +531,7 @@ async fn initialize_ostree_root_from_self(
     writeln!(f, "{}", root_setup.boot.to_fstab())?;
     f.flush()?;
 
-    let uname = cap_std_ext::rustix::process::uname();
+    let uname = rustix::process::uname();
 
     let aleph = InstallAleph {
         image: src_imageref.imgref.name.clone(),
diff --git a/lib/src/privtests.rs b/lib/src/privtests.rs
index a4fe5656b..04510a385 100644
--- a/lib/src/privtests.rs
+++ b/lib/src/privtests.rs
@@ -2,7 +2,6 @@ use std::process::Command;
 
 use anyhow::Result;
 use camino::{Utf8Path, Utf8PathBuf};
-use cap_std_ext::rustix;
 use fn_error_context::context;
 use rustix::fd::AsFd;
 use xshell::{cmd, Shell};
diff --git a/lib/src/status.rs b/lib/src/status.rs
index 8f82a649e..10d9f7f73 100644
--- a/lib/src/status.rs
+++ b/lib/src/status.rs
@@ -65,7 +65,7 @@ impl DeploymentStatus {
         let staged = deployment.is_staged();
         let pinned = deployment.is_pinned();
         let image = get_image_origin(deployment)?.1;
-        let checksum = deployment.csum().unwrap().to_string();
+        let checksum = deployment.csum().to_string();
         let deploy_serial = (!staged).then(|| deployment.bootserial().try_into().unwrap());
         let supported = deployment
             .origin()
@@ -119,7 +119,7 @@ pub(crate) async fn status(opts: super::cli::StatusOpts) -> Result<()> {
         return Ok(());
     }
     let sysroot = super::cli::get_locked_sysroot().await?;
-    let repo = &sysroot.repo().unwrap();
+    let repo = &sysroot.repo();
     let booted_deployment = sysroot.booted_deployment();
 
     let deployments = get_deployments(&sysroot, booted_deployment.as_ref(), opts.booted)?;