diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml
index 38589d16..b980b8ab 100644
--- a/.github/workflows/build-push.yml
+++ b/.github/workflows/build-push.yml
@@ -63,7 +63,7 @@ env:
   ## variables.
   SIZE_LIMIT_DEBIAN_STABLE_BASE_GIB: 0.9
   SIZE_LIMIT_EIC_CI_GIB: 3.1
-  SIZE_LIMIT_EIC_XL_GIB: 4.6
+  SIZE_LIMIT_EIC_XL_GIB: 4.7
 
 jobs:
   env:
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index d8a61ec1..7e7f8dfb 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -36,7 +36,8 @@ variables:
   ## in .github/workflows/build-push.yml env.
   SIZE_LIMIT_DEBIAN_STABLE_BASE_GIB: "0.9"
   SIZE_LIMIT_EIC_CI_GIB: "3.1"
-  SIZE_LIMIT_EIC_XL_GIB: "4.6"
+  SIZE_LIMIT_EIC_XL_GIB: "4.7"
+  SIZE_LIMIT_EIC_TF_GIB: "6.1"
   SIZE_LIMIT_EIC_CUDA_GIB: "8.1"
   SIZE_LIMIT_EIC_DEV_CUDA_GIB: "10.9"
 
diff --git a/containers/debian/Dockerfile b/containers/debian/Dockerfile
index 257b1956..616fb8b4 100644
--- a/containers/debian/Dockerfile
+++ b/containers/debian/Dockerfile
@@ -120,7 +120,7 @@ fi
 # Install packages
 apt-get -yqq update
 apt-get -yqq install cpp${GCC} gcc${GCC} g++${GCC} gfortran${GCC}
-apt-get -yqq install clang${CLANG} clang-tidy${CLANG} clang-format${CLANG} libclang${CLANG}-dev libc++${CLANG}-dev
+apt-get -yqq install clang${CLANG} clang-tidy${CLANG} clang-format${CLANG} libclang${CLANG}-dev libc++${CLANG}-dev python3-clang${CLANG}
 if [ "${CLANG#-}" -ge 20 ]; then apt-get -yqq install flang${CLANG}; fi
 apt-get -yqq autoremove
 # Remove symlinks loop observed in nvidia/cuda devel images
@@ -290,7 +290,7 @@ spack compiler find --scope spack
 # Note: this uses the python-based yq. Future base image upgrades may cause syntax change.
 yq -iy '.packages.gcc.externals[].extra_attributes += {"environment": {"set": {"GCC_AR": "gcc-ar"}}}' ${SPACK_ROOT}/etc/spack/packages.yaml
 # Ensure LLVM externals satisfy iwyu variant requirements (targets=all)
-yq -iy '.packages.llvm.externals[].spec += " targets=all"' ${SPACK_ROOT}/etc/spack/packages.yaml
+yq -iy '.packages.llvm.externals[].spec += " +python targets=all"' ${SPACK_ROOT}/etc/spack/packages.yaml
 spack config blame compilers
 spack config blame packages
 EOF
@@ -303,7 +303,6 @@ spack bootstrap now
 EOF
 
 ## Find external packages (if not already found as compilers)
-## - allow llvm to be buildable for py-numba > py-llvmlite
 RUN <<EOF
 set -e
 spack external find --scope spack llvm
diff --git a/spack-environment/concretizer.yaml b/spack-environment/concretizer.yaml
index cbea3475..e508426c 100644
--- a/spack-environment/concretizer.yaml
+++ b/spack-environment/concretizer.yaml
@@ -14,3 +14,6 @@ concretizer:
     from:
     - type: local
   unify: true
+  duplicates:
+    max_dupes:
+      llvm: 1
diff --git a/spack-environment/jl/spack.yaml b/spack-environment/jl/spack.yaml
index e66e34dc..d03e09fe 100644
--- a/spack-environment/jl/spack.yaml
+++ b/spack-environment/jl/spack.yaml
@@ -5,6 +5,10 @@ spack:
   - ../packages.yaml
   - ../packages_root_without_opengl.yaml
   - ../view.yaml
+  concretizer:
+    duplicates:
+      max_dupes:
+        llvm: 2  # julia requires llvm with specific symbol suffixes
   specs:
   - acts
   - cmake
diff --git a/spack-environment/tf/epic/spack.yaml b/spack-environment/tf/epic/spack.yaml
index a4d32b88..180cd3ab 100644
--- a/spack-environment/tf/epic/spack.yaml
+++ b/spack-environment/tf/epic/spack.yaml
@@ -5,9 +5,5 @@ spack:
   - ../../config.yaml
   - ../../packages.yaml
   - ../../view.yaml
-  concretizer:
-    duplicates:
-      max_dupes:
-        llvm: 2
   specs:
   - edm4eic
diff --git a/spack-environment/tf/spack.yaml b/spack-environment/tf/spack.yaml
index e81e9005..5813947b 100644
--- a/spack-environment/tf/spack.yaml
+++ b/spack-environment/tf/spack.yaml
@@ -4,10 +4,6 @@ spack:
   - ../config.yaml
   - ../packages.yaml
   - ../view.yaml
-  concretizer:
-    duplicates:
-      max_dupes:
-        llvm: 2  # py-llvmlite needs a different llvm from external
   specs:
   - edm4hep
   - onnx
diff --git a/spack-packages.sh b/spack-packages.sh
index 1ae1478c..49b5b3f5 100644
--- a/spack-packages.sh
+++ b/spack-packages.sh
@@ -25,6 +25,7 @@ caf013be0ee1594fdbba8feb07ffecc88474a2b0
 75395349957ad785cca50002dffb18bbcb48af27
 acac89d6bb7079412e711a50a3f06681132a2723
 438abd1e09f0cea9cb0ccc7e0326adcd0408196b
+d4fb37cedfb7552a753bdc9c0c4792082f4b46e8
 4dc856a13e9066ca3249a593d351af8cda521fa3
 ---
 ## Optional hash table with comma-separated file list
@@ -48,4 +49,5 @@ read -r -d '' SPACKPACKAGES_CHERRYPICKS_FILES <<- \
 ## 75395349957ad785cca50002dffb18bbcb48af27: py-torch: ensure setuptools is not unnecessarily constrained for 2.10:
 ## acac89d6bb7079412e711a50a3f06681132a2723: cuda: append --allow-unsupported-compiler to CUDAFLAGS for dependent_spec
 ## 438abd1e09f0cea9cb0ccc7e0326adcd0408196b: herwig3: add CT14(?n)lo pdfsets as build-time resources
+## d4fb37cedfb7552a753bdc9c0c4792082f4b46e8: py-tensorflow: add libclang variant
 ## 4dc856a13e9066ca3249a593d351af8cda521fa3: root: add v6.40.00, v6.40.02