diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml
index 95a51404..83c2cca2 100644
--- a/.github/workflows/build-push.yml
+++ b/.github/workflows/build-push.yml
@@ -541,6 +541,7 @@ jobs:
             "CI_REGISTRY_PASSWORD=${{ secrets.GHCR_REGISTRY_TOKEN }}"
             "GITHUB_REGISTRY_USER=${{ secrets.GHCR_REGISTRY_USER }}"
             "GITHUB_REGISTRY_TOKEN=${{ secrets.GHCR_REGISTRY_TOKEN }}"
+            "GITHUB_SPACK_TOKEN=${{ secrets.SPACK_GITHUB_TOKEN }}"
           secret-files: |
             mirrors=mirrors.yaml
           platforms: ${{ matrix.PLATFORM }}
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index d7d701bd..e8e27344 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -500,6 +500,7 @@ eic:
                    --secret type=env,id=CI_REGISTRY_PASSWORD,env=CI_REGISTRY_PASSWORD
                    --secret type=env,id=GITHUB_REGISTRY_USER,env=GITHUB_REGISTRY_USER
                    --secret type=env,id=GITHUB_REGISTRY_TOKEN,env=GITHUB_REGISTRY_TOKEN
+                   --secret type=env,id=GITHUB_SPACK_TOKEN,env=GITHUB_SPACK_TOKEN
                    --provenance false
                    containers/eic
                    2>&1 | tee build.log
diff --git a/containers/eic/Dockerfile b/containers/eic/Dockerfile
index 9bc99e13..a5ba42df 100644
--- a/containers/eic/Dockerfile
+++ b/containers/eic/Dockerfile
@@ -99,11 +99,18 @@ RUN --mount=type=cache,target=/ccache,id=ccache-${TARGETPLATFORM}              \
     --mount=type=secret,id=CI_REGISTRY_PASSWORD,env=CI_REGISTRY_PASSWORD \
     --mount=type=secret,id=GITHUB_REGISTRY_USER,env=GITHUB_REGISTRY_USER \
     --mount=type=secret,id=GITHUB_REGISTRY_TOKEN,env=GITHUB_REGISTRY_TOKEN \
+    --mount=type=secret,id=GITHUB_SPACK_TOKEN                           \
     <<EOF
 set -e
+if [ -s /run/secrets/GITHUB_SPACK_TOKEN ]; then
+  printf 'machine github.com login x-access-token password %s\n' \
+    "$(cat /run/secrets/GITHUB_SPACK_TOKEN)" > ~/.netrc
+  chmod 600 ~/.netrc
+fi
 export CCACHE_DIR=/ccache
 spack ${SPACK_FLAGS} install ${SPACK_INSTALL_FLAGS}
 spack clean --downloads --stage
+rm -f ~/.netrc
 ccache --show-stats
 ccache --zero-stats
 EOF
@@ -242,12 +249,19 @@ RUN --mount=type=cache,target=/ccache,id=ccache-${TARGETPLATFORM}              \
     --mount=type=secret,id=CI_REGISTRY_PASSWORD,env=CI_REGISTRY_PASSWORD \
     --mount=type=secret,id=GITHUB_REGISTRY_USER,env=GITHUB_REGISTRY_USER \
     --mount=type=secret,id=GITHUB_REGISTRY_TOKEN,env=GITHUB_REGISTRY_TOKEN \
+    --mount=type=secret,id=GITHUB_SPACK_TOKEN                           \
     <<EOF
 set -e
+if [ -s /run/secrets/GITHUB_SPACK_TOKEN ]; then
+  printf 'machine github.com login x-access-token password %s\n' \
+    "$(cat /run/secrets/GITHUB_SPACK_TOKEN)" > ~/.netrc
+  chmod 600 ~/.netrc
+fi
 export CCACHE_DIR=/ccache
 spack ${SPACK_FLAGS} install ${SPACK_INSTALL_FLAGS}
 spack clean --downloads --stage
 spack gc --yes-to-all go go-bootstrap rust rust-bootstrap py-setuptools-rust py-maturin
+rm -f ~/.netrc
 ccache --show-stats
 ccache --zero-stats
 EOF
diff --git a/eic-spack.sh b/eic-spack.sh
index eac402dc..08351f4c 100644
--- a/eic-spack.sh
+++ b/eic-spack.sh
@@ -5,4 +5,4 @@ EICSPACK_ORGREPO="eic/eic-spack"
 
 ## EIC spack commit hash or github version, e.g. v0.19.7
 ## note: nightly builds could use a branch e.g. releases/v0.19
-EICSPACK_VERSION="ce2dc68e4f75299f7a684708788870282ecde53a"
+EICSPACK_VERSION="45f676694035d99722fb3f89423ff94329c4df2b"
diff --git a/spack-environment/packages.yaml b/spack-environment/packages.yaml
index 6d896181..066ea1aa 100644
--- a/spack-environment/packages.yaml
+++ b/spack-environment/packages.yaml
@@ -111,10 +111,10 @@ packages:
     - '@10bbcdbf2be3ad3aa56febcf4c7662d771460a99'
   dawn:
     require:
-    - '@3_91a'
+    - '@main'
   dawncut:
     require:
-    - '@1_54a'
+    - '@main'
   dbus:
     require:
     # Until 1.15.12, https://gitlab.freedesktop.org/dbus/dbus/-/commit/b104667bd7ec55dda057ff4ffdde848336f253f4,