diff --git a/.deploy/mta.yaml b/.deploy/mta.yaml
index 9708446d6..d388ec0c5 100644
--- a/.deploy/mta.yaml
+++ b/.deploy/mta.yaml
@@ -82,6 +82,7 @@ modules:
     path: ../gen/db
     parameters:
       buildpack: nodejs_buildpack
+      stack: cflinuxfs5           # cflinuxfs4→5 migration (#3111)
     properties:
       # Two HDI services bound (own container + devtoberfest-planner-db grantor),
       # so the HDI deployer cannot auto-detect the target — name it explicitly.
@@ -97,6 +98,7 @@ modules:
     path: ../gen/db-qa
     parameters:
       buildpack: nodejs_buildpack
+      stack: cflinuxfs5           # cflinuxfs4→5 migration (#3111)
     requires:
       - name: tutorials-hana-qa
       - name: tutorials-cloud-logging   # same as tutorials-db-deployer; mirrors the prod binding for QA forensic parity.
@@ -118,6 +120,7 @@ modules:
       # so the next deploy doesn't revert it back to 1GB.
       disk-quota: 2048M
       buildpack: nodejs_buildpack
+      stack: cflinuxfs5           # cflinuxfs4→5 migration (#3111)
       # DO NOT raise instances without addressing in-process rate limiters in
       # srv/developer-service.js, srv/lib/ip-rate-limit.js, srv/lib/chat-rate-limit.js.
       # See docs/developers/operations/mta-deployment.md "Scaling Constraints" and TODO §22.
@@ -190,6 +193,7 @@ modules:
       memory: 2048M
       disk-quota: 1024M
       buildpack: nodejs_buildpack
+      stack: cflinuxfs5           # cflinuxfs4→5 migration (#3111)
       instances: 1
       health-check-type: http
       health-check-http-endpoint: /health/ready
@@ -320,6 +324,7 @@ modules:
       # not baseline. disk-quota already 2048M (logs stream off-container to
       # stdout/stderr, so disk is not the OOM vector — 33% used at steady state).
       memory: 2048M
+      stack: cflinuxfs5           # cflinuxfs4→5 migration (#3111)
       app-name: tutorials-approuter
       instances: 1                  # Lower bound; Autoscaler manages up to instance_max_count via binding-level config in requires below (#749)
     properties:
diff --git a/mta-mcp.yaml b/mta-mcp.yaml
index 07ad0a6c2..3fa3abaca 100644
--- a/mta-mcp.yaml
+++ b/mta-mcp.yaml
@@ -43,6 +43,7 @@ modules:
       memory: 1024M
       disk-quota: 1024M
       buildpack: nodejs_buildpack
+      stack: cflinuxfs5           # cflinuxfs4→5 migration (#3111)
       instances: 1
     properties:
       NODE_ENV: production
diff --git a/mta.yaml b/mta.yaml
index b6b043c84..343c76e34 100644
--- a/mta.yaml
+++ b/mta.yaml
@@ -138,6 +138,7 @@ modules:
       memory: 2048M
       disk-quota: 1024M
       buildpack: nodejs_buildpack
+      stack: cflinuxfs5           # cflinuxfs4→5 migration (#3111)
       # DO NOT raise instances without addressing in-process rate limiters in
       # srv/developer-service.js, srv/lib/ip-rate-limit.js, srv/lib/chat-rate-limit.js.
       # See docs/developers/operations/mta-deployment.md "Scaling Constraints" and TODO §22.
@@ -194,6 +195,7 @@ modules:
       memory: 2048M
       disk-quota: 1024M
       buildpack: nodejs_buildpack
+      stack: cflinuxfs5           # cflinuxfs4→5 migration (#3111)
       instances: 1
       health-check-type: http
       health-check-http-endpoint: /health/ready
@@ -220,6 +222,7 @@ modules:
     path: gen/db
     parameters:
       buildpack: nodejs_buildpack
+      stack: cflinuxfs5           # cflinuxfs4→5 migration (#3111)
     properties:
       # Two HDI services bound (own container + devtoberfest-planner-db grantor),
       # so the HDI deployer cannot auto-detect the target — name it explicitly.
@@ -235,6 +238,7 @@ modules:
     path: gen/db-qa
     parameters:
       buildpack: nodejs_buildpack
+      stack: cflinuxfs5           # cflinuxfs4→5 migration (#3111)
     requires:
       - name: tutorials-hana-qa
       - name: tutorials-cloud-logging   # same as tutorials-db-deployer; mirrors the prod binding for QA forensic parity.
@@ -250,6 +254,7 @@ modules:
     parameters:
       disk-quota: 2048M
       memory: 512M
+      stack: cflinuxfs5           # cflinuxfs4→5 migration (#3111)
       app-name: tutorials-approuter
       instances: 1                  # Lower bound; Autoscaler manages up to instance_max_count via binding-level config in requires below (#749)
     properties:
diff --git a/srv/lib/curl-transport.js b/srv/lib/curl-transport.js
index e36dfb30e..90ad492a2 100644
--- a/srv/lib/curl-transport.js
+++ b/srv/lib/curl-transport.js
@@ -11,7 +11,7 @@
 //   node  fetch (any UA)    → 403
 // So bumping the User-Agent cannot fix it — headers ride inside a connection
 // whose fingerprint is already flagged. We route the fetch through the curl
-// binary (present in the cflinuxfs4 rootfs) to borrow its TLS fingerprint.
+// binary (present in the cflinuxfs5 rootfs) to borrow its TLS fingerprint.
 //
 // SECURITY: this is a `fetch`-shaped TRANSPORT only. It performs NO SSRF
 // validation of its own — it is designed to be injected into safeFetch()