diff --git a/.github/common.env b/.github/common.env
index 68bf4b697..1b820f189 100644
--- a/.github/common.env
+++ b/.github/common.env
@@ -1,6 +1,6 @@
 # Shared common variables
 
 CI_IMAGE_VERSION=master-2053497538
-CI_TOXENV_MAIN=py39,py310,py311,py312,py313
-CI_TOXENV_PLUGINS=py39-plugins,py310-plugins,py311-plugins,py312-plugins,py313-plugins
+CI_TOXENV_MAIN=py39,py310,py311,py312,py313,py314
+CI_TOXENV_PLUGINS=py39-plugins,py310-plugins,py311-plugins,py312-plugins,py313-plugins,py314-plugins
 CI_TOXENV_ALL="${CI_TOXENV_MAIN},${CI_TOXENV_PLUGINS}"
diff --git a/.github/compose/ci.docker-compose.yml b/.github/compose/ci.docker-compose.yml
index ac8548626..8a904f9cf 100644
--- a/.github/compose/ci.docker-compose.yml
+++ b/.github/compose/ci.docker-compose.yml
@@ -122,3 +122,8 @@ services:
     <<: *tests-template
     image: quay.io/pypa/manylinux_2_28_x86_64
     command: .github/wheel-helpers/test-wheel-manylinux.sh cp313 /opt/python/cp313-cp313/bin/python3
+
+  wheels-manylinux_2_28-cp314:
+    <<: *tests-template
+    image: quay.io/pypa/manylinux_2_28_x86_64
+    command: .github/wheel-helpers/test-wheel-manylinux.sh cp314-cp314 /opt/python/cp314-cp314/bin/python3
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7690bdef4..26df0b5c7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ concurrency:
 
 jobs:
   tests:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     continue-on-error: ${{ matrix.allow-failure || false }}
 
     strategy:
@@ -50,6 +50,9 @@ jobs:
             allow-failure: true
 
     steps:
+      - name: Disable AppArmor restriction for bubblewrap
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+
       - name: Check out repository
         uses: actions/checkout@v2
         # BuildStream requires tags to be able to find its version.
@@ -62,7 +65,7 @@ jobs:
 
   # Matrix of tests which run against remote services which we bring up adjacently
   service-tests:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     strategy:
       matrix:
@@ -75,6 +78,9 @@ jobs:
           - buildgrid
 
     steps:
+      - name: Disable AppArmor restriction for bubblewrap
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+
       - name: Check out repository
         uses: actions/checkout@v2
         # BuildStream requires tags to be able to find its version.
@@ -86,8 +92,11 @@ jobs:
           ${GITHUB_WORKSPACE}/.github/run-ci.sh --service ${{ matrix.test-name }}
 
   build_docs:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
+      - name: Disable AppArmor restriction for bubblewrap
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+
       - name: Check out repository
         uses: actions/checkout@v2
         # BuildStream requires tags to be able to find its version.
@@ -116,7 +125,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-22.04]
+        os: [ubuntu-24.04]
 
     steps:
       - uses: actions/checkout@v3
@@ -127,7 +136,7 @@ jobs:
         run: ${GITHUB_WORKSPACE}/.github/wheel-helpers/fetch-latest-buildbox-release.sh
 
       - name: Build wheels
-        run: pipx run cibuildwheel==v2.22.0
+        run: pipx run cibuildwheel==v3.1.4
 
       - uses: actions/upload-artifact@v4
         with:
@@ -137,7 +146,7 @@ jobs:
   test_wheels:
     name: "Test Python packages: ${{ matrix.test-name }}"
     needs: [build_wheels]
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     strategy:
       matrix:
@@ -149,6 +158,7 @@ jobs:
           - wheels-manylinux_2_28-cp311
           - wheels-manylinux_2_28-cp312
           - wheels-manylinux_2_28-cp313
+          - wheels-manylinux_2_28-cp314
 
     steps:
       - uses: actions/checkout@v3
diff --git a/.github/workflows/merge.yml b/.github/workflows/merge.yml
index 8fc59425a..189198794 100644
--- a/.github/workflows/merge.yml
+++ b/.github/workflows/merge.yml
@@ -8,8 +8,11 @@ on:
 jobs:
   build_docs:
     name: "Build documentation tarball"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
+    - name: Disable AppArmor restriction for bubblewrap
+      run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+
     - name: Checkout code
       uses: actions/checkout@v2
       # BuildStream requires tags to be able to find its version.
@@ -44,7 +47,7 @@ jobs:
 
   publish_docs:
     needs: build_docs
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
 
     - name: Download artifact
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 62c5aabe7..9b81151f6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,8 +8,11 @@ on:
 jobs:
   build_docs:
     name: "Build documentation tarball"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
+      - name: Disable AppArmor restriction for bubblewrap
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+
       - name: Checkout code
         uses: actions/checkout@v2
         # BuildStream requires tags to be able to find its version.
@@ -39,7 +42,7 @@ jobs:
 
   build_sdist:
     name: "Build Python source distribution tarball"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@v3
       with:
@@ -58,7 +61,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-22.04]
+        os: [ubuntu-24.04]
 
     steps:
       - uses: actions/checkout@v3
@@ -69,7 +72,7 @@ jobs:
         run: ${GITHUB_WORKSPACE}/.github/wheel-helpers/fetch-latest-buildbox-release.sh
 
       - name: Build wheels
-        run: pipx run cibuildwheel==v2.22.0
+        run: pipx run cibuildwheel==v3.1.4
 
       - uses: actions/upload-artifact@v4
         with:
@@ -79,7 +82,7 @@ jobs:
   test_wheels:
     name: "Test Python packages: ${{ matrix.test-name }}"
     needs: [build_wheels]
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     strategy:
       matrix:
@@ -91,6 +94,7 @@ jobs:
           - wheels-manylinux_2_28-cp311
           - wheels-manylinux_2_28-cp312
           - wheels-manylinux_2_28-cp313
+          - wheels-manylinux_2_28-cp314
 
     steps:
       - uses: actions/checkout@v3
@@ -109,7 +113,7 @@ jobs:
   upload_github_release:
     name: Upload GitHub release assets
     needs: [build_docs, build_sdist, build_wheels, test_wheels]
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v3
         with:
@@ -129,7 +133,7 @@ jobs:
   upload_pypi_release:
     name: Upload PyPI release assets
     needs: [build_docs, build_sdist, build_wheels, test_wheels]
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/download-artifact@v4
         with:
diff --git a/requirements/requirements.txt b/requirements/requirements.txt
index 4a287f7ed..5d1af0116 100644
--- a/requirements/requirements.txt
+++ b/requirements/requirements.txt
@@ -6,7 +6,7 @@ pluginbase==1.0.1
 protobuf==5.29.5
 psutil==6.1.0
 ruamel.yaml==0.18.6
-ruamel.yaml.clib==0.2.12
+ruamel.yaml.clib==0.2.14
 pyroaring==1.0.0
 ujson==5.10.0
 ## The following requirements were added by pip freeze:
diff --git a/setup.py b/setup.py
index 1e5887fec..3c6aecb95 100755
--- a/setup.py
+++ b/setup.py
@@ -327,6 +327,7 @@ def files_from_module(modname):
         "Programming Language :: Python :: 3.11",
         "Programming Language :: Python :: 3.12",
         "Programming Language :: Python :: 3.13",
+        "Programming Language :: Python :: 3.14",
         "Topic :: Software Development :: Build Tools",
     ],
     description="A framework for modelling build pipelines in YAML",
diff --git a/tox.ini b/tox.ini
index 7042b5328..62362f64e 100644
--- a/tox.ini
+++ b/tox.ini
@@ -16,7 +16,7 @@
 # Tox global configuration
 #
 [tox]
-envlist = py{39,310,311,312,313}
+envlist = py{39,310,311,312,313,314}
 skip_missing_interpreters = true
 isolated_build = true
 
@@ -33,30 +33,30 @@ BST_PLUGINS_VERSION = 79649529cffb695d0d22195ed9a4910c80ca6907 # 2.5.0
 [testenv]
 usedevelop =
     # This is required by Cython in order to get coverage for cython files.
-    py{39,310,311,312,313}-!nocover: True
+    py{39,310,311,312,313,314}-!nocover: True
 
 commands =
     # Running with coverage reporting enabled
-    py{39,310,311,312,313}-!plugins-!nocover: pytest --basetemp {envtmpdir} --cov=buildstream --cov-config .coveragerc {posargs}
+    py{39,310,311,312,313,314}-!plugins-!nocover: pytest --basetemp {envtmpdir} --cov=buildstream --cov-config .coveragerc {posargs}
     # Running with coverage reporting disabled
-    py{39,310,311,312,313}-!plugins-nocover: pytest --basetemp {envtmpdir} {posargs}
+    py{39,310,311,312,313,314}-!plugins-nocover: pytest --basetemp {envtmpdir} {posargs}
     # Running external plugins tests with coverage reporting enabled
-    py{39,310,311,312,313}-plugins-!nocover: pytest --basetemp {envtmpdir} --cov=buildstream --cov-config .coveragerc --plugins {posargs}
+    py{39,310,311,312,313,314}-plugins-!nocover: pytest --basetemp {envtmpdir} --cov=buildstream --cov-config .coveragerc --plugins {posargs}
     # Running external plugins tests with coverage disabled
-    py{39,310,311,312,313}-plugins-nocover: pytest --basetemp {envtmpdir} --plugins {posargs}
+    py{39,310,311,312,313,314}-plugins-nocover: pytest --basetemp {envtmpdir} --plugins {posargs}
 commands_post:
-    py{39,310,311,312,313}-!nocover: mkdir -p .coverage-reports
-    py{39,310,311,312,313}-!nocover: mv {envtmpdir}/.coverage {toxinidir}/.coverage-reports/.coverage.{env:COVERAGE_PREFIX:}{envname}
+    py{39,310,311,312,313,314}-!nocover: mkdir -p .coverage-reports
+    py{39,310,311,312,313,314}-!nocover: mv {envtmpdir}/.coverage {toxinidir}/.coverage-reports/.coverage.{env:COVERAGE_PREFIX:}{envname}
 deps =
-    py{39,310,311,312,313}: -rrequirements/requirements.txt
-    py{39,310,311,312,313}: -rrequirements/dev-requirements.txt
-    py{39,310,311,312,313}: git+https://github.com/apache/buildstream-plugins.git@{env:BST_PLUGINS_VERSION:{[config]BST_PLUGINS_VERSION}}
+    py{39,310,311,312,313,314}: -rrequirements/requirements.txt
+    py{39,310,311,312,313,314}: -rrequirements/dev-requirements.txt
+    py{39,310,311,312,313,314}: git+https://github.com/apache/buildstream-plugins.git@{env:BST_PLUGINS_VERSION:{[config]BST_PLUGINS_VERSION}}
 
     # Install local sample plugins for testing pip plugin origins
-    py{39,310,311,312,313}: {toxinidir}/tests/plugins/sample-plugins
+    py{39,310,311,312,313,314}: {toxinidir}/tests/plugins/sample-plugins
 
     # Install external plugins for plugin tests
-    py{39,310,311,312,313}-plugins: git+https://gitlab.com/buildstream/buildstream-plugins-community.git@{env:BST_PLUGINS_COMMUNITY_VERSION:{[config]BST_PLUGINS_COMMUNITY_VERSION}}#egg=bst_plugins_community[deb]
+    py{39,310,311,312,313,314}-plugins: git+https://gitlab.com/buildstream/buildstream-plugins-community.git@{env:BST_PLUGINS_COMMUNITY_VERSION:{[config]BST_PLUGINS_COMMUNITY_VERSION}}#egg=bst_plugins_community[deb]
 
     # Only require coverage and pytest-cov when using it
     !nocover: -rrequirements/cov-requirements.txt
@@ -84,18 +84,18 @@ passenv =
 # These keys are not inherited by any other sections
 #
 setenv =
-    py{39,310,311,312,313}: COVERAGE_FILE = {envtmpdir}/.coverage
-    py{39,310,311,312,313}: BST_TEST_HOME = {envtmpdir}
-    py{39,310,311,312,313}: BST_TEST_XDG_CACHE_HOME = {envtmpdir}/cache
-    py{39,310,311,312,313}: BST_TEST_XDG_CONFIG_HOME = {envtmpdir}/config
-    py{39,310,311,312,313}: BST_TEST_XDG_DATA_HOME = {envtmpdir}/share
+    py{39,310,311,312,313,314}: COVERAGE_FILE = {envtmpdir}/.coverage
+    py{39,310,311,312,313,314}: BST_TEST_HOME = {envtmpdir}
+    py{39,310,311,312,313,314}: BST_TEST_XDG_CACHE_HOME = {envtmpdir}/cache
+    py{39,310,311,312,313,314}: BST_TEST_XDG_CONFIG_HOME = {envtmpdir}/config
+    py{39,310,311,312,313,314}: BST_TEST_XDG_DATA_HOME = {envtmpdir}/share
 
     # This is required to get coverage for Cython
-    py{39,310,311,312,313}-!nocover: BST_CYTHON_TRACE = 1
+    py{39,310,311,312,313,314}-!nocover: BST_CYTHON_TRACE = 1
     randomized: PYTEST_ADDOPTS="--random-order-bucket=global"
 
 allowlist_externals =
-    py{39,310,311,312,313}:
+    py{39,310,311,312,313,314}:
         mv
         mkdir