diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 51d8caade1..29107e43f8 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions-rust-lang/setup-rust-toolchain@v1
       - name: install mermaid preprocessor
-        run: cargo install mdbook mdbook-mermaid
+        run: cargo install mdbook --version 0.4.52 && cargo install mdbook-mermaid --version 0.16.0
       - name: Build mdbook
         working-directory: ./docs
         run: mdbook build
diff --git a/Cargo.lock b/Cargo.lock
index 858a94fed5..db2851c39b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3122,7 +3122,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4979f22fdb869068da03c9f7528f8297c6fd2606bc3a4affe42e6a823fdb8da4"
 dependencies = [
  "cfg-if 1.0.1",
- "windows-targets 0.52.6",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -4771,9 +4771,9 @@ dependencies = [
 
 [[package]]
 name = "ring"
-version = "0.17.13"
+version = "0.17.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ac5d832aa16abd7d1def883a8545280c20a60f523a370aa3a9617c2b8550ee"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
 dependencies = [
  "cc",
  "cfg-if 1.0.1",
@@ -6338,7 +6338,7 @@ version = "1.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675"
 dependencies = [
- "cfg-if 1.0.1",
+ "cfg-if 0.1.10",
  "static_assertions",
 ]
 
diff --git a/Cross.toml b/Cross.toml
index 87f64e3ce9..9196c2c3b1 100644
--- a/Cross.toml
+++ b/Cross.toml
@@ -1,14 +1,18 @@
 [build]
 default-target = "x86_64-unknown-linux-musl"
 
-[target.aarch64-unknown-linux-musl]
-dockerfile = "cross/Dockerfile.musl"
+[target.aarch64-unknown-linux-musl.dockerfile]
+file = "cross/Dockerfile.musl"
+build-args = { BASE_IMAGE = "ghcr.io/cross-rs/aarch64-unknown-linux-musl:main", CROSS_CMAKE_SYSTEM_PROCESSOR = "aarch64", CROSS_SYSROOT = "/usr/local/aarch64-linux-musl" }
 
-[target.x86_64-unknown-linux-musl]
-dockerfile = "cross/Dockerfile.musl"
+[target.x86_64-unknown-linux-musl.dockerfile]
+file = "cross/Dockerfile.musl"
+build-args = { BASE_IMAGE = "ghcr.io/cross-rs/x86_64-unknown-linux-musl:main", CROSS_CMAKE_SYSTEM_PROCESSOR = "x86_64", CROSS_SYSROOT = "/usr/local/x86_64-linux-musl" }
 
-[target.aarch64-unknown-linux-gnu]
-dockerfile = "cross/Dockerfile.gnu"
+[target.aarch64-unknown-linux-gnu.dockerfile]
+file = "cross/Dockerfile.gnu"
+build-args = { BASE_IMAGE = "ghcr.io/cross-rs/aarch64-unknown-linux-gnu:main" }
 
-[target.x86_64-unknown-linux-gnu]
-dockerfile = "cross/Dockerfile.gnu"
+[target.x86_64-unknown-linux-gnu.dockerfile]
+file = "cross/Dockerfile.gnu"
+build-args = { BASE_IMAGE = "ghcr.io/cross-rs/x86_64-unknown-linux-gnu:main" }
diff --git a/crates/containerd-shim-wasm/src/sandbox/context.rs b/crates/containerd-shim-wasm/src/sandbox/context.rs
index 623ffc2165..ef8ebfeffc 100644
--- a/crates/containerd-shim-wasm/src/sandbox/context.rs
+++ b/crates/containerd-shim-wasm/src/sandbox/context.rs
@@ -31,7 +31,7 @@ pub trait RuntimeContext: Send + Sync {
     ///   "/app/app.wasm#entry" -> { source: File("/app/app.wasm"), func: "entry", name: "Some(app)", arg0: "/app/app.wasm#entry" }
     ///   "my_module.wat" -> { source: File("my_module.wat"), func: "_start", name: "Some(my_module)", arg0: "my_module.wat" }
     ///   "#init" -> { source: File(""), func: "init", name: None, arg0: "#init" }
-    fn entrypoint(&self) -> Entrypoint;
+    fn entrypoint(&self) -> Entrypoint<'_>;
 }
 
 /// The source for a WASI module / components.
@@ -111,7 +111,7 @@ impl RuntimeContext for WasiContext<'_> {
             .unwrap_or_default()
     }
 
-    fn entrypoint(&self) -> Entrypoint {
+    fn entrypoint(&self) -> Entrypoint<'_> {
         let arg0 = self.args().first();
 
         let entry_point = arg0.map(String::as_str).unwrap_or("");
diff --git a/crates/containerd-shim-wasmtime/README.md b/crates/containerd-shim-wasmtime/README.md
index 626e9496f3..2e93766d38 100644
--- a/crates/containerd-shim-wasmtime/README.md
+++ b/crates/containerd-shim-wasmtime/README.md
@@ -27,7 +27,7 @@ upon receiving a terminate or interrupt signal in the container.
 
 This can be very useful on the Wasm-first platforms to allow instance-per-request isolation:
 
-> Eeach Wasm instance serves only one HTTP request, and then goes away. This is fantastic for security and bug
+> Each Wasm instance serves only one HTTP request, and then goes away. This is fantastic for security and bug
 > mitigation: the blast radius of an exploit or guest-runtime bug is only a single request, and can never see the data
 > from other users of the platform or even other requests by the same user. [3]
 
diff --git a/cross/Dockerfile.gnu b/cross/Dockerfile.gnu
index b7d83e816c..945344c2be 100644
--- a/cross/Dockerfile.gnu
+++ b/cross/Dockerfile.gnu
@@ -1,8 +1,8 @@
-ARG CROSS_BASE_IMAGE
+ARG BASE_IMAGE
 ARG CROSS_DEB_ARCH
-FROM $CROSS_BASE_IMAGE
+FROM ${BASE_IMAGE}
 
 ARG CROSS_DEB_ARCH
 RUN dpkg --add-architecture ${CROSS_DEB_ARCH} && \
     apt-get -y update && \
-    apt-get install -y pkg-config protobuf-compiler libseccomp-dev:${CROSS_DEB_ARCH} libzstd-dev:${CROSS_DEB_ARCH} libssl-dev
+    apt-get install -y pkg-config protobuf-compiler libseccomp-dev:${CROSS_DEB_ARCH} libzstd-dev:${CROSS_DEB_ARCH} libssl-dev libclang-dev
diff --git a/cross/Dockerfile.musl b/cross/Dockerfile.musl
index dd6e325442..074e628d68 100644
--- a/cross/Dockerfile.musl
+++ b/cross/Dockerfile.musl
@@ -1,5 +1,8 @@
-ARG CROSS_BASE_IMAGE
-FROM $CROSS_BASE_IMAGE
+ARG BASE_IMAGE
+FROM ${BASE_IMAGE}
+
+ARG CROSS_CMAKE_SYSTEM_PROCESSOR
+ARG CROSS_SYSROOT
 
 COPY --from=jorgeprendes420/apk-anywhere / /
 ENV MARCH=${CROSS_CMAKE_SYSTEM_PROCESSOR}
@@ -25,4 +28,4 @@ rustflags = ["-Clink-arg=-lgcc"]
 EOF
 
 RUN apt-get -y update && \
-    apt-get install -y pkg-config protobuf-compiler
+    apt-get install -y pkg-config protobuf-compiler libclang-dev
diff --git a/docs/src/benchmarks.md b/docs/src/benchmarks.md
index fed6085d95..1c1fa22f26 100644
--- a/docs/src/benchmarks.md
+++ b/docs/src/benchmarks.md
@@ -85,6 +85,6 @@ We use [benchmark-action](https://github.com/benchmark-action/github-action-benc
 
 If you want to contribute to the benchmarks, whether it's adding a new benchmark or improving the existing ones, or just want to share your ideas, please refer to the following issue:
 
-- [Bencharking issue #97](https://github.com/containerd/runwasi/issues/97)
+- [Benchmarking issue #97](https://github.com/containerd/runwasi/issues/97)
 
 Any PRs are welcome!
diff --git a/scripts/setup-cross.sh b/scripts/setup-cross.sh
index 1990f6101a..dacc4dfa38 100755
--- a/scripts/setup-cross.sh
+++ b/scripts/setup-cross.sh
@@ -1,5 +1,17 @@
 #!/bin/bash
-cargo install cross --git https://github.com/cross-rs/cross
+# Use cargo-binstall to install cross from pre-built binaries
+# This avoids the dependency resolution issue where cargo install
+# resolves dependencies to latest versions that require rustc 1.88+
+
+# Install cargo-binstall if not already installed
+if ! command -v cargo-binstall &> /dev/null; then
+    curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
+fi
+
+# Install cross using cargo-binstall (downloads pre-built binary)
+# Use --force to ensure the binary is actually present even if metadata
+# says it's already installed (the Rust cache may have cleaned the binary)
+cargo binstall cross --version 0.2.5 --no-confirm --force
 
 if [ ! -z "$CI" ]; then