diff --git a/.github/workflows/publish_pypi.yml b/.github/workflows/publish_pypi.yml
index e454b84..047275d 100644
--- a/.github/workflows/publish_pypi.yml
+++ b/.github/workflows/publish_pypi.yml
@@ -37,7 +37,7 @@ jobs:
         run: |
           if ! command -v llvm-dlltool >/dev/null 2>&1; then
             sudo apt update
-            sudo apt install -y llvm cmake libclang-dev
+            sudo apt install -y llvm cmake build-essential libclang-dev clang
           fi
         shell: bash
 
@@ -56,7 +56,14 @@ jobs:
       - name: Install sccache and maturin
         run: |
           python -m pip install --upgrade pip
-          python -m pip install --upgrade maturin ziglang
+          # ziglang >= 0.17 ships a bundled libc++ that requires -D_LIBCPP_* config
+          # macros only cargo-zigbuild >= 0.24.0 passes to bindgen; otherwise
+          # libczirw-sys fails with "hardening.h ... _LIBCPP_ASSERTION_SEMANTIC_DEFAULT
+          # is not defined". Pin the combo that is known to work.
+          python -m pip install --upgrade maturin "ziglang==0.17.0" "cargo-zigbuild==0.24.0"
+          # in case an older copy was cargo-installed into the CARGO_HOME cache,
+          # prevent it from shadowing the pip-installed one
+          rm -f "${CARGO_HOME:?}/bin/cargo-zigbuild" || true
           if ! command -v sccache >/dev/null 2>&1; then
             cargo install sccache || pip install sccache
           fi
diff --git a/image-registration b/image-registration
index fccc3e6..e5136f0 160000
--- a/image-registration
+++ b/image-registration
@@ -1 +1 @@
-Subproject commit fccc3e6f1da79106d571fbc3befd634af2982029
+Subproject commit e5136f00bbcfce27355637248808c249d749c7cd