diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ce437e39..fc8cd033 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -21,6 +21,7 @@ repos:
     hooks:
     -   id: pyupgrade
         args: [--py311-plus]
+        language_version: python3.11
 -   repo: https://github.com/PyCQA/flake8
     rev: 7.0.0
     hooks:
diff --git a/packages.ini b/packages.ini
index 68cf7e49..74119683 100644
--- a/packages.ini
+++ b/packages.ini
@@ -306,7 +306,6 @@ apt_requires =
     wget
 brew_requires = wget
 custom_prebuild = prebuild/librdkafka v2.8.0
-python_versions = <3.14
 [confluent-kafka==2.12.2]
 apt_requires =
     patch
@@ -2108,6 +2107,7 @@ python_versions = <3.14
 [sentry-arroyo==2.37.1]
 [sentry-arroyo==2.38.0]
 [sentry-arroyo==2.38.1]
+[sentry-arroyo==2.38.2]
 
 [sentry-cli==2.14.3]
 [sentry-cli==2.14.4]
diff --git a/prebuild/librdkafka b/prebuild/librdkafka
index fd60a6f6..87c52508 100755
--- a/prebuild/librdkafka
+++ b/prebuild/librdkafka
@@ -4,6 +4,7 @@ from __future__ import annotations
 import argparse
 import os
 import subprocess
+import sys
 import tempfile
 
 
@@ -34,15 +35,19 @@ def main() -> int:
 
         # https://github.com/confluentinc/confluent-kafka-python/blob/cdc5f3b6b5d32c4b9f97ee4f648ad64857fb8223/tools/bootstrap-librdkafka.sh#L42
         print("configuring...")
-        subprocess.check_call(
-            (
-                "./configure",
-                "--enable-static",
-                "--install-deps",
-                f"--prefix={args.prefix}",
-            ),
-            cwd=tmpdir,
-        )
+        configure_args = [
+            "./configure",
+            "--enable-static",
+            "--install-deps",
+        ]
+        # on Linux, use only bundled source deps to avoid picking up system
+        # GSSAPI/Kerberos which auditwheel won't bundle (undefined symbol at
+        # import time). on macOS, system deps are fine: GSSAPI is always
+        # available as a system framework, and bundled deps fail with Xcode 16.
+        if sys.platform == "linux":
+            configure_args.append("--source-deps-only")
+        configure_args.append(f"--prefix={args.prefix}")
+        subprocess.check_call(configure_args, cwd=tmpdir)
 
         print("building...")
         subprocess.check_call(("make", "-j", "-C", "src"), cwd=tmpdir)