diff --git a/.github/workflows/macos-ci-aarch64.yaml b/.github/workflows/macos-ci-aarch64.yaml
index b93935ed9..5ba6a80e6 100644
--- a/.github/workflows/macos-ci-aarch64.yaml
+++ b/.github/workflows/macos-ci-aarch64.yaml
@@ -137,7 +137,7 @@ jobs:
           module use ${ENVDIR}/install/modulefiles/Core
           module load stack-apple-clang/14.0.3
           module load stack-openmpi/4.1.6
-          module load stack-python/3.10.8
+          module load stack-python/3.10.13
           module available
 
           module load jedi-ufs-env/1.0.0
diff --git a/.github/workflows/macos-ci-x86_64.yaml b/.github/workflows/macos-ci-x86_64.yaml
index 2c8762154..d4ff891c7 100644
--- a/.github/workflows/macos-ci-x86_64.yaml
+++ b/.github/workflows/macos-ci-x86_64.yaml
@@ -128,7 +128,7 @@ jobs:
           module use ${ENVDIR}/install/modulefiles/Core
           module load stack-apple-clang/14.0.0
           module load stack-openmpi/4.1.6
-          module load stack-python/3.10.8
+          module load stack-python/3.10.13
           module available
 
           module load jedi-ufs-env/1.0.0
diff --git a/.github/workflows/ubuntu-ci-x86_64.yaml b/.github/workflows/ubuntu-ci-x86_64.yaml
index 912c9da95..c3d49942e 100644
--- a/.github/workflows/ubuntu-ci-x86_64.yaml
+++ b/.github/workflows/ubuntu-ci-x86_64.yaml
@@ -50,6 +50,7 @@ jobs:
 
           # Find external packages
           spack external find --scope system --exclude bison --exclude openssl
+          spack external find --scope system sed
           spack external find --scope system perl
           spack external find --scope system wget
           PATH="/usr/local/opt/curl/bin:$PATH" \
@@ -182,7 +183,7 @@ jobs:
           module use ${ENVDIR}/install/modulefiles/Core
           module load stack-intel/2022.1.0
           module load stack-intel-oneapi-mpi/2021.6.0
-          module load stack-python/3.10.8
+          module load stack-python/3.10.13
           module available
 
           module load jedi-ufs-env/1.0.0
diff --git a/.github/workflows/ubuntu-rnd-x86_64.yaml b/.github/workflows/ubuntu-rnd-x86_64.yaml
index 17468281d..fb4067f80 100644
--- a/.github/workflows/ubuntu-rnd-x86_64.yaml
+++ b/.github/workflows/ubuntu-rnd-x86_64.yaml
@@ -162,7 +162,7 @@ jobs:
           module use /home/ubuntu/spack-stack/CI/unified-env/${TODAY}/modulefiles/Core
           module load stack-intel/2022.1.0
           module load stack-intel-oneapi-mpi/2021.6.0
-          module load stack-python/3.10.8
+          module load stack-python/3.10.13
           module available
 
           module load jedi-ufs-env/1.0.0
diff --git a/configs/common/packages.yaml b/configs/common/packages.yaml
index 998de8044..33c6c7505 100644
--- a/configs/common/packages.yaml
+++ b/configs/common/packages.yaml
@@ -207,21 +207,20 @@
     proj:
       version: ['8.1.0']
       variants: ~tiff
-    # Check site configs for the following systems when making changes here:
-    # Derecho, Narwhal, Gaea-C5
     python:
-      version: ['3.10.8']
+      require: "@3.10.13"
     py-attrs:
       # https://github.com/JCSDA/spack-stack/issues/740
       version: ['21.4.0']
     py-cartopy:
       variants: +plotting
-    py-click:
-      version: ['8.0.3']
+      require: "@0.21.1"
     py-cryptography:
       variants: +rust_bootstrap
-    py-eccodes:
-      version: ['1.4.2']
+    # Introduced in https://github.com/JCSDA/spack-stack/pull/894, pin py-cython
+    # to avoid duplicate packages being built (cylc dependencies soft-want @3:)
+    py-cython:
+      require: "@0.29.36"
     py-h5py:
       version: ['3.7.0']
       variants: ~mpi
@@ -241,33 +240,13 @@
     # To avoid pip._vendor.pep517.wrappers.BackendInvalid errors with newer
     # versions of py-poetry-core when using external/homebrew Python as
     # we do at the moment in spack-stack.
-    py-poetry-core:
-      version: ['1.0.8']
-    py-pybind11:
-      version: ['2.8.1']
-    py-pygithub:
-      version: ['1.55']
-    py-pygrib:
-      version: ['2.1.4']
-    py-pyhdf:
-      version: ['0.10.4']
-    py-pyproj:
-      version: ['3.1.0']
-    py-python-dateutil:
-      version: ['2.8.2']
-    py-pythran:
-      # Versions earlier than 0.11.0 don't compile on macOS with llvm-clang/13.0.0 and Python/3.9,
-      # and 0.11.0 leads to downstream errors in py-scipy with the Intel compilers
-      version: ['0.12.2']
-    py-scipy:
-      version: ['1.9.3']
     # Pin the py-setuptools version to avoid duplicate Python packages
     py-setuptools:
       require: ['@63.4.3']
     py-setuptools-rust:
       variants: +rust_bootstrap
     py-shapely:
-      version: ['1.8.0']
+      require: ['@1.8.0']
     qt:
       version: ['5.15.3']
     scotch:
diff --git a/configs/sites/aws-pcluster/packages.yaml b/configs/sites/aws-pcluster/packages.yaml
index f49a33ded..ee9922c6d 100644
--- a/configs/sites/aws-pcluster/packages.yaml
+++ b/configs/sites/aws-pcluster/packages.yaml
@@ -115,6 +115,10 @@ packages:
     externals:
     - spec: qt@5.12.8
       prefix: /usr
+  sed:
+    externals:
+    - spec: sed@4.7
+      prefix: /usr
   tar:
     externals:
     - spec: tar@1.30
diff --git a/configs/templates/skylab-dev/spack.yaml b/configs/templates/skylab-dev/spack.yaml
index 0a8314cbb..e9df7134b 100644
--- a/configs/templates/skylab-dev/spack.yaml
+++ b/configs/templates/skylab-dev/spack.yaml
@@ -8,7 +8,7 @@ spack:
   definitions:
   - compilers: ['%aocc', '%apple-clang', '%gcc', '%intel']
   - packages:
-      - ewok-env
+      - ewok-env +ecflow +cylc
       - jedi-fv3-env
       - jedi-mpas-env
       - jedi-neptune-env
diff --git a/configs/templates/unified-dev/spack.yaml b/configs/templates/unified-dev/spack.yaml
index bc339f192..c3b622679 100644
--- a/configs/templates/unified-dev/spack.yaml
+++ b/configs/templates/unified-dev/spack.yaml
@@ -11,7 +11,7 @@ spack:
       - global-workflow-env
       - gmao-swell-env
       - gsi-env
-      - ewok-env
+      - ewok-env +ecflow +cylc
       - jedi-fv3-env
       - jedi-mpas-env
       - jedi-neptune-env
diff --git a/spack b/spack
index 91a18e985..922c1c1c2 160000
--- a/spack
+++ b/spack
@@ -1 +1 @@
-Subproject commit 91a18e9853e4153f0cbea3705862feb2832c134b
+Subproject commit 922c1c1c2e412ce9a7ca2f6dd0f8736ab0f6cd91