diff --git a/config/golden-image-container-integration.yaml b/config/golden-image-container-integration.yaml
index 14d9ac87..975af870 100644
--- a/config/golden-image-container-integration.yaml
+++ b/config/golden-image-container-integration.yaml
@@ -223,6 +223,7 @@ guest:
     - libnspr4
     - libnss3
     - libpango-1.0-0
+    - libsqlite3-dev
     - libssl-dev
     - libx11-6
     - libxcb1
diff --git a/config/golden-image-container.yaml b/config/golden-image-container.yaml
index 20470e9a..fb532d07 100644
--- a/config/golden-image-container.yaml
+++ b/config/golden-image-container.yaml
@@ -178,6 +178,7 @@ guest:
     - git
     - git-lfs
     - jq
+    - libsqlite3-dev
     - libssl-dev
     - maven
     - ninja-build
diff --git a/config/golden-image-integration.yaml b/config/golden-image-integration.yaml
index b5da2b2a..e807f7c4 100644
--- a/config/golden-image-integration.yaml
+++ b/config/golden-image-integration.yaml
@@ -185,6 +185,7 @@ guest:
     - git
     - git-lfs
     - jq
+    - libsqlite3-dev
     - libssl-dev
     - maven
     - ninja-build
diff --git a/config/golden-image.yaml b/config/golden-image.yaml
index 12dde2fe..1f68030e 100644
--- a/config/golden-image.yaml
+++ b/config/golden-image.yaml
@@ -172,6 +172,7 @@ guest:
     - git
     - git-lfs
     - jq
+    - libsqlite3-dev
     - libssl-dev
     - maven
     - ninja-build
diff --git a/internal/imagebuild/assets/smoke-integration.sh b/internal/imagebuild/assets/smoke-integration.sh
index 63ce354b..57effc09 100644
--- a/internal/imagebuild/assets/smoke-integration.sh
+++ b/internal/imagebuild/assets/smoke-integration.sh
@@ -272,6 +272,12 @@ python3 -m pip --version >/dev/null
 pip --version >/dev/null
 pip3 --version >/dev/null
 
+# Release workers have no apt egress. Host tests that load libsqlite3.so or
+# compile against sqlite3.h must find both already in the image.
+test -f /usr/include/sqlite3.h
+test -e /usr/lib/x86_64-linux-gnu/libsqlite3.so
+pkg-config --exists sqlite3
+
 for forbidden in \
   /run/incus/unix.socket \
 	  /var/lib/incus/unix.socket \
diff --git a/internal/imagebuild/assets/smoke.sh b/internal/imagebuild/assets/smoke.sh
index f468e7f7..206163b6 100644
--- a/internal/imagebuild/assets/smoke.sh
+++ b/internal/imagebuild/assets/smoke.sh
@@ -206,6 +206,12 @@ python3 -m pip --version >/dev/null
 pip --version >/dev/null
 pip3 --version >/dev/null
 
+# Release workers have no apt egress. Host tests that load libsqlite3.so or
+# compile against sqlite3.h must find both already in the image.
+test -f /usr/include/sqlite3.h
+test -e /usr/lib/x86_64-linux-gnu/libsqlite3.so
+pkg-config --exists sqlite3
+
 for forbidden in \
   /var/run/docker.sock \
   /run/incus/unix.socket \
diff --git a/internal/imagebuild/orchestrator_test.go b/internal/imagebuild/orchestrator_test.go
index 7af58090..1b0bccf0 100644
--- a/internal/imagebuild/orchestrator_test.go
+++ b/internal/imagebuild/orchestrator_test.go
@@ -165,7 +165,7 @@ func TestRecipeFingerprintIsDeterministic(t *testing.T) {
 	// coupling is the point: the alias is part of the recipe, so a manifest
 	// whose contents changed under an unchanged alias would otherwise ask the
 	// builder to produce different bytes for a name that is already promoted.
-	if first != "sha256:3ca60ebd286bb7be8c1e2449d18e705d65a9ff4d3e4478c60e6416f3807c4498" {
+	if first != "sha256:7a3a1820816163ead5bbbfecfd455147adcae39195b8d6d194927408f7e2c40b" {
 		t.Fatalf("deployed standard recipe fingerprint drifted: %q", first)
 	}
 	smoke, err := SmokeFingerprint(plan)
diff --git a/internal/imagemanifest/manifest_test.go b/internal/imagemanifest/manifest_test.go
index 78e8ba7d..60717139 100644
--- a/internal/imagemanifest/manifest_test.go
+++ b/internal/imagemanifest/manifest_test.go
@@ -42,7 +42,7 @@ func TestRepositoryManifestIsValidAndPinned(t *testing.T) {
 	if !strings.HasPrefix(fingerprint, "sha256:") || len(fingerprint) != len("sha256:")+64 {
 		t.Fatalf("unexpected fingerprint %q", fingerprint)
 	}
-	if fingerprint != "sha256:7a69a79e9ab4e8e99b4dd94d3507d829d1e092927d7a64063ff893d3b7686afb" {
+	if fingerprint != "sha256:98ab78a52fdccdd6df1622e5383f27a67c507cfdad789880c0cf10b1b7f31377" {
 		t.Fatalf("standard manifest fingerprint drifted: %q", fingerprint)
 	}
 }
diff --git a/internal/imagemanifest/provides_test.go b/internal/imagemanifest/provides_test.go
index 2dc9f1dc..b1710fdc 100644
--- a/internal/imagemanifest/provides_test.go
+++ b/internal/imagemanifest/provides_test.go
@@ -79,6 +79,23 @@ func TestEveryPromisedCommandComesFromThisManifest(t *testing.T) {
 	}
 }
 
+func TestEveryImageBakesSqliteCLibrary(t *testing.T) {
+	t.Parallel()
+	for _, path := range goldenManifestPaths(t) {
+		manifest := loadGolden(t, path)
+		found := false
+		for _, name := range manifest.Guest.Packages {
+			if name == "libsqlite3-dev" {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("%s does not install libsqlite3-dev; release workers have no apt egress", filepath.Base(path))
+		}
+	}
+}
+
 func goldenManifestPaths(t *testing.T) []string {
 	t.Helper()
 	paths, err := filepath.Glob(filepath.Join("..", "..", "config", "golden-image*.yaml"))