diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e0b262e65..484ffab24 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -102,7 +102,7 @@ jobs:
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
         with:
-          version: nightly
+          version: v1.4.4
 
       - name: Install forge dependencies
         run: forge install
@@ -128,7 +128,7 @@ jobs:
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
         with:
-          version: nightly
+          version: v1.4.4
 
       - name: Install forge dependencies
         run: forge install
@@ -153,7 +153,7 @@ jobs:
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
         with:
-          version: nightly
+          version: v1.4.4
 
       - name: Install forge dependencies
         run: forge install
@@ -178,13 +178,19 @@ jobs:
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
         with:
-          version: nightly
+          version: v1.4.4
 
       - name: Install forge dependencies
         run: forge install
 
+      - name: Precompile reference using 0.8.24 and via-ir=false
+        run: FOUNDRY_PROFILE=reference forge build
+
+      - name: Precompile optimized using 0.8.24 and via-ir=true
+        run: FOUNDRY_PROFILE=optimized forge build
+
       - name: Run coverage with lcov output
-        run: SEAPORT_COVERAGE=true forge coverage --report lcov
+        run: FOUNDRY_PROFILE=default SEAPORT_COVERAGE=true forge coverage --report lcov
 
       - uses: codecov/codecov-action@v3
         with:
diff --git a/.gitmodules b/.gitmodules
index 022c48821..ee0bf3c83 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -10,11 +10,9 @@
 [submodule "lib/forge-std"]
 	path = lib/forge-std
 	url = https://github.com/foundry-rs/forge-std
-	branch = v1.5.0
 [submodule "lib/solady"]
 	path = lib/solady
 	url = https://github.com/vectorized/solady
-	branch = v0.0.84
 [submodule "lib/solarray"]
 	path = lib/solarray
 	url = https://github.com/emo-eth/solarray
diff --git a/test/foundry/conduit/BaseConduitTest.sol b/test/foundry/conduit/BaseConduitTest.sol
index 7c2d8c52f..0d0401a24 100644
--- a/test/foundry/conduit/BaseConduitTest.sol
+++ b/test/foundry/conduit/BaseConduitTest.sol
@@ -58,7 +58,13 @@ contract BaseConduitTest is
         if (to == address(0)) {
             return false;
         } else if (to.code.length > 0) {
-            (bool success, bytes memory returnData) = to.call(
+            // Cap the gas. A fuzzed address can be any contract already in
+            // state, and some consume everything forwarded to them: the
+            // canonical CREATE2 deployer at 0x4e59b448... reads this calldata
+            // as a salt plus initcode, and once an address has been deployed
+            // the next colliding CREATE2 burns the whole budget, failing the
+            // test with OutOfGas. A real onERC1155Received is far cheaper.
+            (bool success, bytes memory returnData) = to.call{ gas: 100_000 }(
                 abi.encodePacked(
                     ERC1155TokenReceiver.onERC1155Received.selector,
                     address(0),
diff --git a/test/foundry/zone/TestTransferValidationZoneFuzz.t.sol b/test/foundry/zone/TestTransferValidationZoneFuzz.t.sol
index 5dbdfd4ef..29aee2cd7 100644
--- a/test/foundry/zone/TestTransferValidationZoneFuzz.t.sol
+++ b/test/foundry/zone/TestTransferValidationZoneFuzz.t.sol
@@ -1453,10 +1453,20 @@ contract TestTransferValidationZoneOffererTest is BaseOrderTest {
     function _nudgeAddressIfProblematic(
         address _address
     ) internal returns (address) {
+        // Move clear of the precompile range before probing. Precompiles
+        // revert on a bare value transfer, and nudging by one is not enough
+        // to escape: under cancun 0x09 nudges to 0x0a, which reverts too.
+        if (uint160(_address) <= 0x0a) {
+            _address = address(uint160(_address) + 0x0a);
+        }
+
         bool success;
         assembly {
             // Transfer the native token and store if it succeeded or not.
-            success := call(gas(), _address, 1, 0, 0, 0, 0)
+            // The gas is capped because a fuzzed address can be a contract
+            // that consumes everything forwarded to it, such as the CREATE2
+            // deployer on a colliding deployment.
+            success := call(100000, _address, 1, 0, 0, 0, 0)
         }
 
         if (success) {
diff --git a/test/foundry/zone/UnauthorizedOrderSkip.t.sol b/test/foundry/zone/UnauthorizedOrderSkip.t.sol
index 85d2e23f7..3057cf5b7 100644
--- a/test/foundry/zone/UnauthorizedOrderSkip.t.sol
+++ b/test/foundry/zone/UnauthorizedOrderSkip.t.sol
@@ -1650,10 +1650,20 @@ contract UnauthorizedOrderSkipTest is BaseOrderTest {
     function _nudgeAddressIfProblematic(
         address _address
     ) internal returns (address) {
+        // Move clear of the precompile range before probing. Precompiles
+        // revert on a bare value transfer, and nudging by one is not enough
+        // to escape: under cancun 0x09 nudges to 0x0a, which reverts too.
+        if (uint160(_address) <= 0x0a) {
+            _address = address(uint160(_address) + 0x0a);
+        }
+
         bool success;
         assembly {
             // Transfer the native token and store if it succeeded or not.
-            success := call(gas(), _address, 1, 0, 0, 0, 0)
+            // The gas is capped because a fuzzed address can be a contract
+            // that consumes everything forwarded to it, such as the CREATE2
+            // deployer on a colliding deployment.
+            success := call(100000, _address, 1, 0, 0, 0, 0)
         }
 
         if (success) {