diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1338fd3db..0cf5ffcb5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -82,7 +82,7 @@ jobs:
       - name: Install PyInstaller requirements
         run: |
           source .buildenv/bin/activate
-          pip install -r pyinstaller/requirements.txt --require-hashes
+          pip install -r pyinstaller/requirements.txt
 
       - name: Build specterd
         run: |
@@ -139,7 +139,7 @@ jobs:
         run: |
           source .buildenv/Scripts/activate
           cd pyinstaller
-          pip install -r requirements.txt --require-hashes
+          pip install -r requirements.txt
 
       - name: Build specterd
         shell: bash
@@ -206,7 +206,7 @@ jobs:
       - name: Install PyInstaller requirements
         run: |
           source .buildenv/bin/activate
-          pip install -r pyinstaller/requirements.txt --require-hashes
+          pip install -r pyinstaller/requirements.txt
 
       - name: Build specterd
         run: |
diff --git a/.github/workflows/test-specterd-build.yml b/.github/workflows/test-specterd-build.yml
new file mode 100644
index 000000000..bb50fc290
--- /dev/null
+++ b/.github/workflows/test-specterd-build.yml
@@ -0,0 +1,61 @@
+name: Test specterd build
+
+on:
+  pull_request:
+    paths:
+      - 'pyinstaller/**'
+      - 'requirements.in'
+      - 'requirements.txt'
+      - 'src/**'
+      - 'setup.py'
+      - 'setup.cfg'
+      - 'pyproject.toml'
+      - '.github/workflows/test-specterd-build.yml'
+
+env:
+  PYTHON_VERSION: '3.10'
+
+jobs:
+  build-and-smoke-test:
+    name: Build & smoke-test specterd (Linux)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libusb-1.0-0-dev libudev-dev
+
+      - name: Create virtualenv and install
+        run: |
+          pip install virtualenv
+          virtualenv --python=python${{ env.PYTHON_VERSION }} .buildenv
+          source .buildenv/bin/activate
+          pip install -r requirements.txt --require-hashes
+          pip install -e ".[test]"
+          pip install build==0.10.0
+          python3 -m build
+          pip install ./dist/cryptoadvance_specter-*.whl
+
+      - name: Install PyInstaller requirements
+        run: |
+          source .buildenv/bin/activate
+          pip install -r pyinstaller/requirements.txt
+
+      - name: Build specterd
+        run: |
+          source .buildenv/bin/activate
+          echo "0.0.0-test" > pyinstaller/version.txt
+          cd pyinstaller
+          pyinstaller specterd.spec
+          cd ..
+
+      - name: Smoke test
+        run: |
+          ./pyinstaller/dist/specterd --help
+          ./pyinstaller/dist/specterd server --help
diff --git a/pyinstaller/hwibridge.spec b/pyinstaller/hwibridge.spec
index 277f5475d..d4c5639c9 100644
--- a/pyinstaller/hwibridge.spec
+++ b/pyinstaller/hwibridge.spec
@@ -7,8 +7,6 @@ from embit import util as embit_util
 mnemonic_path = os.path.join(mnemonic.__path__[0], "wordlist")
 embit_libsecp_binary = embit_util.ctypes_secp256k1._find_library()
 
-block_cipher = None
-
 binaries = []
 if platform.system() == 'Windows':
     binaries = [("./windll/libusb-1.0.dll", ".")]
@@ -31,23 +29,18 @@ a = Analysis(['hwibridge.py'],
                     (embit_libsecp_binary, 'embit/util/prebuilt'),
              ],
              hiddenimports=[
-                'pkg_resources.py2_warn',
                 'cryptoadvance.specter.config'
              ],
              hookspath=['hooks/'],
              runtime_hooks=[],
              excludes=[],
-             win_no_prefer_redirects=False,
-             win_private_assemblies=False,
-             cipher=block_cipher,
              noarchive=False)
 
 if platform.system() == 'Linux':
     import hwilib
     a.datas += Tree('../udev', prefix='hwilib/udev')
 
-pyz = PYZ(a.pure, a.zipped_data,
-             cipher=block_cipher)
+pyz = PYZ(a.pure, a.zipped_data)
 exe = EXE(pyz,
           a.scripts,
           a.binaries,
diff --git a/pyinstaller/requirements.in b/pyinstaller/requirements.in
index 4009242cc..65c6cba42 100644
--- a/pyinstaller/requirements.in
+++ b/pyinstaller/requirements.in
@@ -1,4 +1,5 @@
-pyinstaller==5.2
+pyinstaller==6.11.1
+setuptools>=78.1.1
 pefile==2022.5.30
 macholib
 pywin32-ctypes
diff --git a/pyinstaller/requirements.txt b/pyinstaller/requirements.txt
index a1772f3a8..1e12d2dd3 100644
--- a/pyinstaller/requirements.txt
+++ b/pyinstaller/requirements.txt
@@ -1,52 +1,15 @@
 #
-# This file is autogenerated by pip-compile with Python 3.10
-# by the following command:
+# Manually updated for PyInstaller 6.x migration.
+# Hashes removed — regenerate with:
+#   pip-compile --generate-hashes requirements.in
 #
-#    pip-compile --generate-hashes requirements.in
-#
-altgraph==0.17 \
-    --hash=sha256:1f05a47122542f97028caf78775a095fbe6a2699b5089de8477eb583167d69aa \
-    --hash=sha256:c623e5f3408ca61d4016f23a681b9adb100802ca3e3da5e718915a9e4052cebe
-    # via
-    #   macholib
-    #   pyinstaller
-future==0.18.2 \
-    --hash=sha256:b1bead90b70cf6ec3f0710ae53a525360fa360d306a86583adc6bf83a4db537d
-    # via pefile
-macholib==1.14 \
-    --hash=sha256:0c436bc847e7b1d9bda0560351bf76d7caf930fb585a828d13608839ef42c432 \
-    --hash=sha256:c500f02867515e6c60a27875b408920d18332ddf96b4035ef03beddd782d4281
-    # via
-    #   -r requirements.in
-    #   pyinstaller
-pefile==2022.5.30 \
-    --hash=sha256:a5488a3dd1fd021ce33f969780b88fe0f7eebb76eb20996d7318f307612a045b
-    # via -r requirements.in
-pyinstaller==5.2 \
-    --hash=sha256:03984eed0baa252ea9854eb0785a1c40ac033c5c28d3abdae7d820da734aed5a \
-    --hash=sha256:1061f7a6de055007949ec9ad1c6a080b93e102b2a288c8ff88f65e5d7716d4aa \
-    --hash=sha256:4def5b6433b4233b2b53ef92ac351788edb11e4d1e08123b9c90e21a7b310a41 \
-    --hash=sha256:5d170f7c4c402c820b4c5cf7fde61dd9741bf0456342b19b207e29041d75aa30 \
-    --hash=sha256:5efc1b3ffb13fe50a51305fe57fb9e6e7bce00d009c16dd3cb76ea4d702a04ab \
-    --hash=sha256:60c53ba54651f22f75dce2bcf49f0a1bcd03c729ced15f2efabad28e0ea0c938 \
-    --hash=sha256:6ecce857491bc4f477fcbde1b430d63b957d99bc511fa7e79136c07f831fc505 \
-    --hash=sha256:9d44f331f96fa0ef556cf5304f8b906ca20f55503ddd7aa2a914e87bc58e2cc9 \
-    --hash=sha256:a21c07dd026bc127684e7a451320bf59cac2c85bea4cb412f7193876ad741d58 \
-    --hash=sha256:dda3a4787fa4498bb9e688f81bed918f061bd583c8ff0e47881a5422a4b2093b \
-    --hash=sha256:f10b19ad4f66ccad16574ff1979cc15e1ea010f8577292500125dd45abcd8303
-    # via -r requirements.in
-pyinstaller-hooks-contrib==2022.8 \
-    --hash=sha256:c4210fc50282c9c6a918e485e0bfae9405592390508e3be9fde19acc2213da56 \
-    --hash=sha256:e46f099934dd4577fb1ddcf37a99fa04027c92f8f5291c8802f326345988d001
-    # via pyinstaller
-pywin32-ctypes==0.2.0 \
-    --hash=sha256:24ffc3b341d457d48e8922352130cf2644024a4ff09762a2261fd34c36ee5942 \
-    --hash=sha256:9dc2d991b3479cc2df15930958b674a48a227d5361d413827a4cfd0b5876fc98
-    # via -r requirements.in
+# Core
+pyinstaller==6.11.1
+pyinstaller-hooks-contrib>=2024.0
+setuptools>=78.1.1
 
-# WARNING: The following packages were not pinned, but pip requires them to be
-# pinned when the requirements file includes hashes. Consider using the --allow-unsafe flag.
-setuptools==68.2.2 \
-    --hash=sha256:b454a35605876da60632df1a60f736524eb73cc47bbc9f3f1ef1b644de74fd2a \
-    --hash=sha256:4ac1475276d2f1c48684874089fefcd83bd7162ddaafb81fac866ba0db282a87
-    # via -r requirements.in (pinned: 69+ removed pkg_resources, breaks PyInstaller)
+# Platform helpers
+altgraph>=0.17
+pefile==2022.5.30
+macholib>=1.14
+pywin32-ctypes>=0.2.0
diff --git a/pyinstaller/specterd.spec b/pyinstaller/specterd.spec
index f23540c66..1bc3f5d84 100644
--- a/pyinstaller/specterd.spec
+++ b/pyinstaller/specterd.spec
@@ -7,8 +7,6 @@ from embit import util as embit_util
 mnemonic_path = os.path.join(mnemonic.__path__[0], "wordlist")
 embit_libsecp_binary = embit_util.ctypes_secp256k1._find_library()
 
-block_cipher = None
-
 binaries = []
 if platform.system() == 'Windows':
     binaries = [("./windll/libusb-1.0.dll", ".")]
@@ -53,24 +51,19 @@ a = Analysis(['specterd.py'],
                     *packaged_software_datas,
              ],
              hiddenimports=[
-                'pkg_resources.py2_warn',
                 'cryptoadvance.specter.config',
                 'tzdata' # used by apscheduler and existing hook doesn't seem to be complete
              ],
              hookspath=['hooks/'],
              runtime_hooks=[],
              excludes=[],
-             win_no_prefer_redirects=False,
-             win_private_assemblies=False,
-             cipher=block_cipher,
              noarchive=False)
 
 if platform.system() == 'Linux':
     import hwilib
     a.datas += Tree('../udev', prefix='hwilib/udev')
 
-pyz = PYZ(a.pure, a.zipped_data,
-             cipher=block_cipher)
+pyz = PYZ(a.pure, a.zipped_data)
 name=os.getenv("specterd_filename","specterd")
 exe = EXE(pyz,
           a.scripts,
diff --git a/requirements.in b/requirements.in
index 5571faa2b..71c717ead 100644
--- a/requirements.in
+++ b/requirements.in
@@ -21,7 +21,7 @@ cbor2==5.4.6
 mnemonic==0.21
 cryptography==42.0.7
 Flask-APScheduler==1.12.4
-gunicorn==20.1.0
+gunicorn==23.0.0
 simple-websocket==0.8.1
 protobuf==4.23.3
 PyJWT==2.4.0
diff --git a/requirements.txt b/requirements.txt
index 0d2e176ad..913302284 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -296,9 +296,9 @@ greenlet==2.0.2 \
     --hash=sha256:f82d4d717d8ef19188687aa32b8363e96062911e63ba22a0cff7802a8e58e5f1 \
     --hash=sha256:fc3a569657468b6f3fb60587e48356fe512c1754ca05a564f11366ac9e306526
     # via -r requirements.in
-gunicorn==20.1.0 \
-    --hash=sha256:9dcc4547dbb1cb284accfb15ab5667a0e5d1881cc443e0677b4882a4067a807e \
-    --hash=sha256:e0a968b5ba15f8a328fdfd7ab1fcb5af4470c28aaf7e55df02a99bc13138e6e8
+gunicorn==23.0.0 \
+    --hash=sha256:ec400d38950de4dfd418cff8328b2c8faed0edb0d517d3394e457c317908ca4d \
+    --hash=sha256:f014447a0101dc57e294f6c18ca6b40227a4c90e9bdb586042628030cba004ec
     # via -r requirements.in
 h11==0.14.0 \
     --hash=sha256:8f19fbbe99e72420ff35c00b27a34cb9937e902a8b810e2c88300c6f0a3b699d \
@@ -569,6 +569,10 @@ protobuf==4.23.3 \
     # via
     #   -r requirements.in
     #   hwi
+packaging==26.0 \
+    --hash=sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529 \
+    --hash=sha256:00243ae351a257117b6a241061796684b084ed1c516a08c48a3f7e147a9d80b4
+    # via gunicorn
 psutil==5.9.0 \
     --hash=sha256:072664401ae6e7c1bfb878c65d7282d4b4391f1bc9a56d5e03b5a490403271b5 \
     --hash=sha256:1070a9b287846a21a5d572d6dddd369517510b68710fca56b0e9e02fd24bed9a \