diff --git a/crates/openshell-driver-vm/runtime/pins.env b/crates/openshell-driver-vm/runtime/pins.env
index 9977eddcc1..5595394b54 100644
--- a/crates/openshell-driver-vm/runtime/pins.env
+++ b/crates/openshell-driver-vm/runtime/pins.env
@@ -34,6 +34,11 @@ COMMUNITY_SANDBOX_IMAGE="${COMMUNITY_SANDBOX_IMAGE:-ghcr.io/nvidia/openshell-com
 UMOCI_VERSION="${UMOCI_VERSION:-v0.6.0}"
 
 # ── libkrunfw upstream (commit-pinned) ─────────────────────────────────
-# Repo: https://github.com/containers/libkrunfw
-# Pinned: 2026-03-27 (main branch HEAD at time of pinning)
-LIBKRUNFW_REF="${LIBKRUNFW_REF:-463f717bbdd916e1352a025b6fb2456e882b0b39}"
+# Repo: https://github.com/libkrun/libkrunfw
+# Pinned: v5.6.1 (2026-09-16)
+LIBKRUNFW_REF="${LIBKRUNFW_REF:-617938cf2ae9a3a0e5696d23a5d6252cd7a1ef4f}"
+
+# ── libkrun upstream (commit-pinned) ──────────────────────────────────
+# Repo: https://github.com/libkrun/libkrun
+# Pinned: v1.19.4 (2026-09-16)
+LIBKRUN_REF="${LIBKRUN_REF:-728df8125077d0db44265f6e997c72b81b65c015}"
diff --git a/tasks/scripts/vm/build-libkrun-macos.sh b/tasks/scripts/vm/build-libkrun-macos.sh
index 339a736663..f560a19ba8 100755
--- a/tasks/scripts/vm/build-libkrun-macos.sh
+++ b/tasks/scripts/vm/build-libkrun-macos.sh
@@ -31,6 +31,10 @@
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+
+# Source pinned dependency versions.
+source "${ROOT}/crates/openshell-driver-vm/runtime/pins.env" 2>/dev/null || true
+
 BUILD_DIR="${ROOT}/target/libkrun-build"
 OUTPUT_DIR="${BUILD_DIR}"
 BREW_PREFIX="$(brew --prefix 2>/dev/null || echo /opt/homebrew)"
@@ -149,11 +153,12 @@ echo "    Built: libkrunfw.${ABI_VERSION}.dylib ($(du -sh "${OUTPUT_DIR}/libkrun
 
 # ── Clone libkrun ───────────────────────────────────────────────────────
 
-LIBKRUN_REF="${LIBKRUN_REF:-e5922f6}"
+# LIBKRUN_REF is sourced from pins.env; env-var override still works.
+LIBKRUN_REF="${LIBKRUN_REF:-728df8125077d0db44265f6e997c72b81b65c015}"
 
 if [ ! -d libkrun ]; then
     echo "==> Cloning libkrun..."
-    git clone https://github.com/containers/libkrun.git
+    git clone https://github.com/libkrun/libkrun.git
 fi
 
 echo "==> Checking out ${LIBKRUN_REF}..."
diff --git a/tasks/scripts/vm/build-libkrun.sh b/tasks/scripts/vm/build-libkrun.sh
index e204dc0829..bd40f2f1d5 100755
--- a/tasks/scripts/vm/build-libkrun.sh
+++ b/tasks/scripts/vm/build-libkrun.sh
@@ -134,7 +134,7 @@ ensure_python3_with_pyelftools_for_libkrunfw
 
 if [ ! -d libkrunfw ]; then
   echo "    Cloning libkrunfw (pinned: ${LIBKRUNFW_REF:-HEAD})..."
-  git clone https://github.com/containers/libkrunfw.git
+  git clone https://github.com/libkrun/libkrunfw.git
 fi
 
 cd libkrunfw
@@ -405,11 +405,12 @@ echo "==> Building libkrun..."
 ensure_cargo_for_libkrun
 ensure_libclang_for_libkrun
 
-LIBKRUN_REF="${LIBKRUN_REF:-v1.17.4}"
+# LIBKRUN_REF is sourced from pins.env (line 32); env-var override still works.
+LIBKRUN_REF="${LIBKRUN_REF:-728df8125077d0db44265f6e997c72b81b65c015}"
 
 if [ ! -d libkrun ]; then
   echo "    Cloning libkrun..."
-  git clone https://github.com/containers/libkrun.git
+  git clone https://github.com/libkrun/libkrun.git
 fi
 
 cd libkrun
@@ -420,11 +421,6 @@ if [ -n "${LIBKRUN_REF:-}" ]; then
   git checkout "${LIBKRUN_REF}" 2>/dev/null || git checkout "origin/${LIBKRUN_REF}" 2>/dev/null || true
 fi
 
-if [ -f init/Makefile ] || grep -q 'init/init' Makefile 2>/dev/null; then
-  echo "    Building init/init binary..."
-  make init/init
-fi
-
 echo "    Building libkrun with NET=1 BLK=1..."
 cargo build --release --features blk --features net --target-dir="$(pwd)/target"