diff --git a/.gitmodules b/.gitmodules
index 04514feb5..85942066a 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,8 +1,8 @@
 [submodule "spack"]
   path = spack
   url = https://github.com/jcsda/spack
-  branch = spack-stack-2.1.0
+  branch = spack-stack-2.1.1
 [submodule "repos/builtin"]
   path = repos/builtin
   url = https://github.com/jcsda/spack-packages
-  branch = spack-stack-2.1.0
+  branch = spack-stack-2.1.1
diff --git a/configs/common/packages.yaml b/configs/common/packages.yaml
index 201956b09..c5bae8c79 100644
--- a/configs/common/packages.yaml
+++ b/configs/common/packages.yaml
@@ -52,7 +52,7 @@ packages:
       - visibility=hidden
     bufr:
       require:
-      - '@12.1.0'
+      - '@12.3.0'
       - +python
     bufr-query:
       require:
@@ -201,7 +201,7 @@ packages:
       - '@1.4.2'
     gsi-ncdiag:
       require:
-      - '@1.1.2'
+      - '@1.1.3'
     harfbuzz:
       # cmake-based harfbuzz fails during build
       require:
diff --git a/configs/sites/tier1/hercules/packages.yaml b/configs/sites/tier1/hercules/packages.yaml
index 7c438842b..f2e6478a8 100644
--- a/configs/sites/tier1/hercules/packages.yaml
+++ b/configs/sites/tier1/hercules/packages.yaml
@@ -13,6 +13,13 @@ packages:
       prefix: /apps/spack-managed/gcc-11.3.1/zlib-1.2.13-ltp4c3zzde3zi3gf7x4b7c7nj5ww4i4g
       modules:
       - zlib/1.2.13
+ 
+  # https://github.com/JCSDA/spack-stack/issues/1892
+  openssl:
+    require:
+    - +shared
+    - '@3.0.16'
+
   autoconf:
     externals:
     - spec: autoconf@2.69
diff --git a/configs/sites/tier1/orion/packages.yaml b/configs/sites/tier1/orion/packages.yaml
index 99675d2a4..6b179915b 100644
--- a/configs/sites/tier1/orion/packages.yaml
+++ b/configs/sites/tier1/orion/packages.yaml
@@ -13,6 +13,13 @@ packages:
       prefix: /apps/spack-managed/gcc-11.3.1/zlib-1.2.13-ltp4c3zzde3zi3gf7x4b7c7nj5ww4i4g
       modules:
       - zlib/1.2.13
+
+  # https://github.com/JCSDA/spack-stack/issues/1892
+  openssl:
+    require:
+    - +shared
+    - '@3.0.16'
+
   autoconf:
     externals:
     - spec: autoconf@2.69
diff --git a/repos/builtin b/repos/builtin
index 4a3312cc2..05553f750 160000
--- a/repos/builtin
+++ b/repos/builtin
@@ -1 +1 @@
-Subproject commit 4a3312cc241c0da954ab450cbdd223122a62355f
+Subproject commit 05553f750553659cfd2c30d0e130ea1ed7165d25