diff --git a/cluster/compose/localnet/compose.yaml b/cluster/compose/localnet/compose.yaml
index 7128cc10e7..71d52bf478 100644
--- a/cluster/compose/localnet/compose.yaml
+++ b/cluster/compose/localnet/compose.yaml
@@ -111,6 +111,8 @@ services:
       - ${LOCALNET_DIR}/conf/canton/app-provider:/app/app-provider/${APP_PROVIDER_PROFILE}
       - ${LOCALNET_DIR}/conf/canton/app-user:/app/app-user/${APP_USER_PROFILE}
       - ${LOCALNET_DIR}/conf/canton/sv:/app/sv/${SV_PROFILE}
+    tmpfs:
+      - /tmp
     ports:
       - "${TEST_PORT-4$PARTICIPANT_LEDGER_API_PORT_SUFFIX:}4${PARTICIPANT_LEDGER_API_PORT_SUFFIX}"
       - "${TEST_PORT-4$PARTICIPANT_ADMIN_API_PORT_SUFFIX:}4${PARTICIPANT_ADMIN_API_PORT_SUFFIX}"
@@ -137,7 +139,6 @@ services:
       - app-user
       - sv
       - multi-sync
-
   splice:
     image: "${IMAGE_REPO}splice-app:${IMAGE_TAG}"
     container_name: splice
@@ -196,6 +197,8 @@ services:
       - ${LOCALNET_DIR}/conf/console/app-user:/app/app-user/${APP_USER_PROFILE}
       - ${LOCALNET_DIR}/conf/console/sv:/app/sv/${SV_PROFILE}
       - ${LOCALNET_DIR}/docker/console/entrypoint.sh:/app/entrypoint.sh
+    tmpfs:
+      - /tmp
     entrypoint: /app/entrypoint.sh
     stdin_open: true
     tty: true
diff --git a/cluster/compose/sv/compose.yaml b/cluster/compose/sv/compose.yaml
index e7a7138a61..2a918c94f3 100644
--- a/cluster/compose/sv/compose.yaml
+++ b/cluster/compose/sv/compose.yaml
@@ -54,6 +54,8 @@ services:
       - CANTON_DOMAIN_POSTGRES_PASSWORD=${SPLICE_SV_DB_PASSWORD}
       - CANTON_SEQUENCER_POSTGRES_DB=sequencer
       - CANTON_DOMAIN_INITIALIZE=false
+    tmpfs:
+      - /tmp
     depends_on:
       postgres-splice-sv:
         condition: service_healthy
@@ -77,6 +79,8 @@ services:
       - CANTON_PARTICIPANT_ADMIN_USER_NAME=administrator
       - AUTH_TARGET_AUDIENCE=${LEDGER_API_AUTH_AUDIENCE}
       - ADDITIONAL_CONFIG_DISABLE_AUTH=canton.participants.participant.ledger-api.auth-services=[]
+    tmpfs:
+      - /tmp
     depends_on:
       postgres-splice-sv:
         condition: service_healthy
diff --git a/cluster/compose/validator/compose.yaml b/cluster/compose/validator/compose.yaml
index 7cfd9692e3..645f703cec 100644
--- a/cluster/compose/validator/compose.yaml
+++ b/cluster/compose/validator/compose.yaml
@@ -56,6 +56,8 @@ services:
     restart: always
     networks:
       - ${DOCKER_NETWORK:-splice_validator}
+    tmpfs:
+      - /tmp
 
   chown-domain-upgrade-dump:
     image: busybox:1.37.0
diff --git a/cluster/helm/splice-global-domain/templates/mediator.yaml b/cluster/helm/splice-global-domain/templates/mediator.yaml
index 56f3125843..bb0ee8dbaf 100644
--- a/cluster/helm/splice-global-domain/templates/mediator.yaml
+++ b/cluster/helm/splice-global-domain/templates/mediator.yaml
@@ -96,11 +96,13 @@ spec:
           failureThreshold: 3
           timeoutSeconds: 10
         {{- end }}
-        {{- if .Values.pvc }}
         volumeMounts:
+        {{- if .Values.pvc }}
           - name: mediator-volume
             mountPath: /persistent-data
         {{- end }}
+          - name: tmp-volume
+            mountPath: /tmp
       restartPolicy: Always
       initContainers:
         - name: pg-init
@@ -142,6 +144,8 @@ spec:
           persistentVolumeClaim:
             claimName: {{ .Release.Name }}-mediator-pvc
       {{- end }}
+        - name: tmp-volume
+          emptyDir: {}
 ---
 {{-  if .Values.pvc }}
 apiVersion: v1
diff --git a/cluster/helm/splice-global-domain/templates/sequencer.yaml b/cluster/helm/splice-global-domain/templates/sequencer.yaml
index fc552d366f..32482ca740 100644
--- a/cluster/helm/splice-global-domain/templates/sequencer.yaml
+++ b/cluster/helm/splice-global-domain/templates/sequencer.yaml
@@ -160,11 +160,13 @@ spec:
             failureThreshold: 3
             timeoutSeconds: 10
         {{- end }}
-          {{- if .Values.pvc }}
           volumeMounts:
+          {{- if .Values.pvc }}
             - name: sequencer-volume
               mountPath: /persistent-data
           {{- end }}
+            - name: tmp-volume
+              mountPath: /tmp
       restartPolicy: Always
       initContainers:
         - name: pg-init
@@ -226,6 +228,8 @@ spec:
           persistentVolumeClaim:
             claimName: {{ .Release.Name }}-sequencer-pvc
       {{- end }}
+        - name: tmp-volume
+          emptyDir: {}
 ---
 apiVersion: v1
 kind: Service
diff --git a/cluster/helm/splice-participant/templates/participant.yaml b/cluster/helm/splice-participant/templates/participant.yaml
index 5546392111..a34888bcf3 100644
--- a/cluster/helm/splice-participant/templates/participant.yaml
+++ b/cluster/helm/splice-participant/templates/participant.yaml
@@ -129,8 +129,8 @@ spec:
         {{- with .Values.resources }}
         resources: {{- toYaml . | nindent 10 }}
         {{- end }}
-        {{- if or (and .Values.extraVolumeMounts (gt (len .Values.extraVolumeMounts) 0)) .Values.pvc }}
         volumeMounts:
+        {{- if or (and .Values.extraVolumeMounts (gt (len .Values.extraVolumeMounts) 0)) .Values.pvc }}
           {{- range .Values.extraVolumeMounts }}
           - name: {{ .name }}
             mountPath: {{ .mountPath }}
@@ -146,6 +146,8 @@ spec:
             mountPath: /persistent-data
         {{- end }}
         {{- end }}
+          - name: tmp-volume
+            mountPath: /tmp
       {{- if or (.Values.persistence.enablePgInitContainer) (.Values.extraInitContainers) }}
       initContainers:
         {{- if .Values.persistence.enablePgInitContainer }}
@@ -187,8 +189,8 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if or (and .Values.extraVolumes (gt (len .Values.extraVolumes) 0)) .Values.pvc }}
       volumes:
+      {{- if or (and .Values.extraVolumes (gt (len .Values.extraVolumes) 0)) .Values.pvc }}
         {{- range .Values.extraVolumes }}
         - name: {{ .name }}
           {{- if .secret }}
@@ -206,6 +208,8 @@ spec:
             claimName: {{ .Release.Name }}-participant-pvc
         {{- end }}
       {{- end }}
+        - name: tmp-volume
+          emptyDir: {}
 ---
 {{-  if .Values.pvc }}
 apiVersion: v1
diff --git a/cluster/helm/splice-participant/tests/participant_test.yaml b/cluster/helm/splice-participant/tests/participant_test.yaml
index a06677e940..725149fa5d 100644
--- a/cluster/helm/splice-participant/tests/participant_test.yaml
+++ b/cluster/helm/splice-participant/tests/participant_test.yaml
@@ -162,6 +162,8 @@ tests:
           persistentVolumeClaim:
             claimName: claim_name
         - name: empty-dir-volume
+        - name: tmp-volume
+          emptyDir: {}
     documentSelector:
       path: kind
       value: Deployment
@@ -232,12 +234,16 @@ tests:
             - name: participant-volume
               persistentVolumeClaim:
                 claimName: participant-1-participant-pvc
+            - name: tmp-volume
+              emptyDir: {}
       # Volume mount is created
       - equal:
           path: spec.template.spec.containers[0].volumeMounts
           value:
             - name: participant-volume
               mountPath: /persistent-data
+            - name: tmp-volume
+              mountPath: /tmp
   - it: "pvc creates PersistentVolumeClaim resource"
     set:
       pvc:
@@ -302,6 +308,8 @@ tests:
             - name: participant-volume
               persistentVolumeClaim:
                 claimName: participant-1-participant-pvc
+            - name: tmp-volume
+              emptyDir: {}
       # All volume mounts are created (extraVolumeMounts + pvc mount)
       - equal:
           path: spec.template.spec.containers[0].volumeMounts
@@ -313,3 +321,5 @@ tests:
               mountPath: /config
             - name: participant-volume
               mountPath: /persistent-data
+            - name: tmp-volume
+              mountPath: /tmp
diff --git a/nix/canton-sources.json b/nix/canton-sources.json
index 0f5565ee1e..e8a32d8d72 100644
--- a/nix/canton-sources.json
+++ b/nix/canton-sources.json
@@ -1,8 +1,8 @@
 {
-  "version": "3.5.1-snapshot.20260423.18760.0.v0d74e51b",
-  "oss_sha256": "sha256:19vc79klbbyks6dvymkd4fjm7y7r50af70mnkbiab7m7ygaz1srx",
-  "canton_base_image_sha256": "sha256:5b3727d6a592e8e97f13a320f41402c2c550687b7085055fbe94d2e1bd6272dc",
-  "canton_participant_image_sha256": "sha256:e98717c20014bf8621495113e2bd889fab8d767322af313c1e848e6b0da29e6c",
-  "canton_mediator_image_sha256": "sha256:be4abbb7128f9f4b675e27e68ff1f9256e00c74f8f7384d99cd6f7bf3c874fba",
-  "canton_sequencer_image_sha256": "sha256:e21b243db32b544d1a3f3344a5083c13aa34951ebb58da30a8d2887237a31d9b"
+  "version": "3.5.1-ad-hoc.20260422.18738.0.v67aa11f7",
+  "oss_sha256": "sha256:1n5qy0pyxn3142g230h71jm9vxh6ijyj5gb6l3ljzvqww615dzs0",
+  "canton_base_image_sha256": "sha256:417622d52ebeecec82f0576d3c84f662a296158bee6de2d2304fd6a6e84324e9",
+  "canton_participant_image_sha256": "sha256:baf8c9838139cb4d53761991e985de32c32125c54d9aa8125de87664ffacb868",
+  "canton_mediator_image_sha256": "sha256:53fbbd01df9d86d0c86cfbeca9d068320ff0ed2c1228cf677e6743b6fffd86c0",
+  "canton_sequencer_image_sha256": "sha256:15ce97a16d54bf7c544488fe8591aca4ee177647c4d247f827f8ab2b47b70e32"
 }
diff --git a/project/ignore-patterns/sbt-output.ignore.txt b/project/ignore-patterns/sbt-output.ignore.txt
index b33546575b..584d6999a9 100644
--- a/project/ignore-patterns/sbt-output.ignore.txt
+++ b/project/ignore-patterns/sbt-output.ignore.txt
@@ -133,6 +133,8 @@ WARN: InvalidDefaultArgInFrom
 # the script does not try to be secure
 .*api_jwt\.py:153: InsecureKeyLengthWarning:.*
 
+cannot change locale.*No such file or directory
+
 # Temporarily ignore the warnings around deprecated stuff in our daml tests
 # TODO(#5114): stop using the deprecated APIs, and remove this
 Severity: DsWarning