diff --git a/nexus/db-queries/src/db/datastore/bfd.rs b/nexus/db-queries/src/db/datastore/bfd.rs
index 75f1b8cd427..fba19259a68 100644
--- a/nexus/db-queries/src/db/datastore/bfd.rs
+++ b/nexus/db-queries/src/db/datastore/bfd.rs
@@ -78,6 +78,7 @@ impl DataStore {
         diesel::update(dsl::bfd_session)
             .filter(dsl::remote.eq(IpNetwork::from(config.remote)))
             .filter(dsl::switch.eq(config.switch.to_string()))
+            .filter(dsl::time_deleted.is_null())
             .set(dsl::time_deleted.eq(chrono::Utc::now()))
             .execute_async(&*conn)
             .await
diff --git a/package-manifest.toml b/package-manifest.toml
index c8f62567a29..45b42f65897 100644
--- a/package-manifest.toml
+++ b/package-manifest.toml
@@ -446,7 +446,7 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "2efb678fa3e4e59ebb74d695b85012ce1bafa93a"
+source.commit = "5ec0f0603f4fe099ff17792a6f9c1b281d254981"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/maghemite.sha256.txt
 source.sha256 = "7316db9fd7bd271b487a1589755dfacf19ae70f63989b5ff2701f8520757f757"
@@ -462,7 +462,7 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "2efb678fa3e4e59ebb74d695b85012ce1bafa93a"
+source.commit = "5ec0f0603f4fe099ff17792a6f9c1b281d254981"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/mg-ddm.sha256.txt
 source.sha256 = "4bf75cb6ecb96a5276c09889c86707d04b075e1ff3e9463a4856681d82cc7fa0"
@@ -477,10 +477,10 @@ source.repo = "maghemite"
 # `tools/maghemite_openapi_version`. Failing to do so will cause a failure when
 # building `ddm-admin-client` (which will instruct you to update
 # `tools/maghemite_openapi_version`).
-source.commit = "2efb678fa3e4e59ebb74d695b85012ce1bafa93a"
+source.commit = "5ec0f0603f4fe099ff17792a6f9c1b281d254981"
 # The SHA256 digest is automatically posted to:
 # https://buildomat.eng.oxide.computer/public/file/oxidecomputer/maghemite/image/<commit>/mg-ddm.sha256.txt
-source.sha256 = "a36e7035beb705546620457ea674c3c01c14c5cfff41fada4ac4fa694fa93c06"
+source.sha256 = "67056b7e4e9658dcc016859d29898bf1c986ad32676bf965b9e3b723add39683"
 output.type = "zone"
 output.intermediate_only = true
 
diff --git a/tools/maghemite_ddm_openapi_version b/tools/maghemite_ddm_openapi_version
index 4e51aae971c..e006224acb2 100644
--- a/tools/maghemite_ddm_openapi_version
+++ b/tools/maghemite_ddm_openapi_version
@@ -1,2 +1,2 @@
-COMMIT="2efb678fa3e4e59ebb74d695b85012ce1bafa93a"
+COMMIT="5ec0f0603f4fe099ff17792a6f9c1b281d254981"
 SHA2="0b0dbc2f8bbc5d2d9be92d64c4865f8f9335355aae62f7de9f67f81dfb3f1803"
diff --git a/tools/maghemite_mg_openapi_version b/tools/maghemite_mg_openapi_version
index effe2fc7b8f..aa44a835232 100644
--- a/tools/maghemite_mg_openapi_version
+++ b/tools/maghemite_mg_openapi_version
@@ -1,2 +1,2 @@
-COMMIT="2efb678fa3e4e59ebb74d695b85012ce1bafa93a"
+COMMIT="5ec0f0603f4fe099ff17792a6f9c1b281d254981"
 SHA2="0ac038bbaa54d0ae0ac5ccaeff48f03070618372cca26c9d09b716b909bf9355"
diff --git a/tools/maghemite_mgd_checksums b/tools/maghemite_mgd_checksums
index 8dc1d586ba6..47c0d13f4e0 100644
--- a/tools/maghemite_mgd_checksums
+++ b/tools/maghemite_mgd_checksums
@@ -1,2 +1,2 @@
-CIDL_SHA256="a36e7035beb705546620457ea674c3c01c14c5cfff41fada4ac4fa694fa93c06"
-MGD_LINUX_SHA256="6e00ceec2c3c6db29293761912153dd28f3800124d87767ca937423874f8343e"
\ No newline at end of file
+CIDL_SHA256="67056b7e4e9658dcc016859d29898bf1c986ad32676bf965b9e3b723add39683"
+MGD_LINUX_SHA256="248732202f5102bf0947f5f91871379b6c6945fe387d4272cebe6e08f1b58184"
\ No newline at end of file