diff --git a/ansible/roles/baselayout/tasks/main.yml b/ansible/roles/baselayout/tasks/main.yml
index d012be1d6..5d7945ed4 100644
--- a/ansible/roles/baselayout/tasks/main.yml
+++ b/ansible/roles/baselayout/tasks/main.yml
@@ -111,6 +111,16 @@
     name: python3
     path: "/usr/bin/python3.8"
 
+- name: run os-specific steps after package install
+  include_tasks: "{{ post_include }}"
+  loop_control:
+    loop_var: post_include
+  with_first_found:
+    - files:
+        - "{{ role_path }}/tasks/partials/postinstall/{{ os }}.yml"
+        - "{{ role_path }}/tasks/partials/postinstall/{{ os|stripversion }}.yml"
+      skip: true
+
 - name: remove fortune from login shells
   when: os|stripversion == 'freebsd'
   lineinfile:
diff --git a/ansible/roles/baselayout/tasks/partials/postinstall/rhel.yml b/ansible/roles/baselayout/tasks/partials/postinstall/rhel.yml
new file mode 100644
index 000000000..400ed7a0b
--- /dev/null
+++ b/ansible/roles/baselayout/tasks/partials/postinstall/rhel.yml
@@ -0,0 +1,60 @@
+# Red Hat Enterprise Linux
+
+# Version lock packages to prevent them being updated. Unfortunately we cannot
+# lock a package before it is installed.
+# The generic "install packages" task in ansible/roles/baselayout/tasks/main.yml
+# doesn't allow downgrading, which means if a package is already installed at
+# a later version, specifying the version to install will not downgrade to that
+# version. So here we check the version and downgrade if necessary before
+# version locking to ensure we get what we want.
+
+- name: get installed clang version
+  ansible.builtin.command: clang -dumpversion
+  changed_when: false
+  check_mode: false
+  register: clang_dumpversion_result
+
+- name: get installed rust version
+  ansible.builtin.command: rustc -vV
+  changed_when: false
+  check_mode: false
+  register: rustc_vv_result
+
+# We don't need this. Get rid of it to simplify the number of packages to lock.
+- name: remove tracker-miners packages
+  ansible.builtin.dnf:
+    autoremove: true
+    name: tracker-miners
+    state: absent
+
+- name: downgrade packages
+  ansible.builtin.dnf:
+    allow_downgrade: true
+    name:
+      - llvm-toolset-{{rhel_llvm_version}}
+      - rust-toolset-{{rhel_rust_version}}
+    state: present
+  when: 'clang_dumpversion_result.rc != 0 or clang_dumpversion_result.stdout != rhel_llvm_version or
+    rustc_vv_result.rc != 0 or "release: " + rhel_rust_version not in rustc_vv_result.stdout_lines'
+
+# Lock dependent packages as well to prevent those being updated.
+- name: lock package versions
+  community.general.dnf_versionlock:
+    name:
+      - cargo-{{rhel_rust_version}}
+      - clang-{{rhel_llvm_version}}
+      - clang-libs-{{rhel_llvm_version}}
+      - clang-resource-filesystem-{{rhel_llvm_version}}
+      - compiler-rt-{{rhel_llvm_version}}
+      - libomp-{{rhel_llvm_version}}
+      - libomp-devel-{{rhel_llvm_version}}
+      - lld-{{rhel_llvm_version}}
+      - lld-libs-{{rhel_llvm_version}}
+      - llvm-{{rhel_llvm_version}}
+      - llvm-libs-{{rhel_llvm_version}}
+      - llvm-toolset-{{rhel_llvm_version}}
+      - rust-{{rhel_rust_version}}
+      - rust-std-static-{{rhel_rust_version}}
+      - rust-toolset-{{rhel_rust_version}}
+      - rustfmt-{{rhel_rust_version}}
+    state: present
diff --git a/ansible/roles/baselayout/tasks/partials/repo/rhel9.yml b/ansible/roles/baselayout/tasks/partials/repo/rhel9.yml
index 6ef5cf019..f2daeed88 100644
--- a/ansible/roles/baselayout/tasks/partials/repo/rhel9.yml
+++ b/ansible/roles/baselayout/tasks/partials/repo/rhel9.yml
@@ -12,15 +12,3 @@
   ansible.builtin.dnf:
     name: https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
     state: present
-
-- name: install Python 3.12
-  ansible.builtin.dnf:
-    name: ['python3.12','python3.12-pip']
-    state: present
-  notify: package updated
-
-- name: update python3 package alternatives
-  community.general.alternatives:
-    link: /usr/bin/python3
-    name: python3
-    path: /usr/bin/python3.12
diff --git a/ansible/roles/baselayout/vars/main.yml b/ansible/roles/baselayout/vars/main.yml
index bc922aee2..e142ebabb 100644
--- a/ansible/roles/baselayout/vars/main.yml
+++ b/ansible/roles/baselayout/vars/main.yml
@@ -7,6 +7,10 @@
 git_no_binpkg: [ ]
 git_version: 2.10.2
 
+# toolchain versions
+rhel_llvm_version: 19.1.7
+rhel_rust_version: 1.84.1
+
 ssh_config: /etc/ssh/sshd_config
 
 sshd_service_map: {
@@ -87,11 +91,11 @@ packages: {
   ],
 
   rhel8: [
-    'ccache,clang,cmake,gcc-c++,gcc-toolset-10,gcc-toolset-10-libatomic-devel,gcc-toolset-11,gcc-toolset-12,gcc-toolset-12-libatomic-devel,gcc-toolset-13,gcc-toolset-13-libatomic-devel,gcc-toolset-14-libatomic-devel,git,make,python3',
+    'ccache,cmake,gcc-c++,gcc-toolset-10,gcc-toolset-10-libatomic-devel,gcc-toolset-11,gcc-toolset-12,gcc-toolset-12-libatomic-devel,gcc-toolset-13,gcc-toolset-13-libatomic-devel,gcc-toolset-14-libatomic-devel,git,llvm-toolset-{{rhel_llvm_version}},make,python3,python3-dnf-plugin-versionlock,rust-toolset-{{rhel_rust_version}}',
   ],
 
   rhel9: [
-    'ccache,clang,cmake,gcc-c++,gcc-toolset-12,gcc-toolset-12-libatomic-devel,gcc-toolset-13,gcc-toolset-13-libatomic-devel,gcc-toolset-14-libatomic-devel,git,make,python3',
+    'ccache,cmake,gcc-c++,gcc-toolset-12,gcc-toolset-12-libatomic-devel,gcc-toolset-13,gcc-toolset-13-libatomic-devel,gcc-toolset-14-libatomic-devel,git,llvm-toolset-{{rhel_llvm_version}},make,python3,python3-dnf-plugin-versionlock,rust-toolset-{{rhel_rust_version}}',
   ],
 
   smartos: [
diff --git a/ansible/roles/build-test-v8/tasks/partials/rhel8-ppc64.yml b/ansible/roles/build-test-v8/tasks/partials/rhel8-ppc64.yml
index 90065adea..60a1f29e1 100644
--- a/ansible/roles/build-test-v8/tasks/partials/rhel8-ppc64.yml
+++ b/ansible/roles/build-test-v8/tasks/partials/rhel8-ppc64.yml
@@ -11,9 +11,10 @@
     state: enabled
 
 # V8 builds still require Python 2.
+# rhel_llvm_version and rhel_rust_version from ansible/roles/baselayout/vars/main.yml
 - name: install packages required to build V8
   ansible.builtin.dnf:
-    name: ['glib2-devel', 'llvm-toolset', 'ninja-build', 'python2', 'python2-pip']
+    name: ['glib2-devel', 'bindgen-cli', 'llvm-toolset-{{rhel_llvm_version}}', 'ninja-build', 'python2', 'python2-pip', 'rustfmt-{{rhel_rust_version}}']
     state: present
   notify: package updated
 
diff --git a/ansible/roles/build-test-v8/tasks/partials/rhel8-s390x.yml b/ansible/roles/build-test-v8/tasks/partials/rhel8-s390x.yml
index 003c11677..7248bb0b2 100644
--- a/ansible/roles/build-test-v8/tasks/partials/rhel8-s390x.yml
+++ b/ansible/roles/build-test-v8/tasks/partials/rhel8-s390x.yml
@@ -11,9 +11,10 @@
     state: enabled
 
 # Older V8 builds still require Python 2.
+# rhel_llvm_version and rhel_rust_version from ansible/roles/baselayout/vars/main.yml
 - name: install packages required to build V8
   ansible.builtin.dnf:
-    name: ['GConf2-devel', 'llvm-toolset', 'ninja-build', 'python2', 'python2-pip']
+    name: ['GConf2-devel', 'bindgen-cli', 'llvm-toolset-{{rhel_llvm_version}}', 'ninja-build', 'python2', 'python2-pip', 'rustfmt-{{rhel_rust_version}}']
     state: present
   notify: package updated
 
diff --git a/ansible/roles/build-test-v8/tasks/partials/rhel8-x64.yml b/ansible/roles/build-test-v8/tasks/partials/rhel8-x64.yml
index f2a3b5f23..652ec3d45 100644
--- a/ansible/roles/build-test-v8/tasks/partials/rhel8-x64.yml
+++ b/ansible/roles/build-test-v8/tasks/partials/rhel8-x64.yml
@@ -11,9 +11,10 @@
     state: enabled
 
 # V8 builds still require Python 2.
+# rhel_llvm_version and rhel_rust_version from ansible/roles/baselayout/vars/main.yml
 - name: install packages required to build V8
   ansible.builtin.dnf:
-    name: ['llvm-toolset', 'ninja-build', 'python2', 'python2-pip']
+    name: ['bindgen-cli', 'llvm-toolset-{{rhel_llvm_version}}', 'ninja-build', 'python2', 'python2-pip', 'rustfmt-{{rhel_rust_version}}']
     state: present
   notify: package updated
 
diff --git a/ansible/roles/jenkins-worker/tasks/partials/tap2junit/rhel9.yml b/ansible/roles/jenkins-worker/tasks/partials/tap2junit/rhel9.yml
index 626bed02c..be9a7ba06 100644
--- a/ansible/roles/jenkins-worker/tasks/partials/tap2junit/rhel9.yml
+++ b/ansible/roles/jenkins-worker/tasks/partials/tap2junit/rhel9.yml
@@ -6,11 +6,12 @@
 
 - name: install pip
   ansible.builtin.dnf: 
-    name: python3-pip
+    name: ['python3.12','python3.12-pip']
     state: present
 
 - name: install tap2junit
   ansible.builtin.pip:
-    executable: /usr/bin/pip3
     name: tap2junit=={{ tap2junit_version }}
     state: present
+    virtualenv: /home/{{ server_user }}/venv
+    virtualenv_command: python3.12 -m venv