diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f199f8..dfa1694 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,8 +3,9 @@
 ## v2.1.0
 
 - portable-python's code is now checked by multiple type checkers on every change
-- Bumped OpenSSL to 3.5.9, SQLite to 3.53.4, xz to 5.8.4 and gettext-tiny to 0.3.3; re-checked every other component against upstream (all already current, or deliberately held back — see the `version` property comments).
+- Bumped OpenSSL to 3.5.9, SQLite to 3.53.4, xz to 5.8.4, libffi to 3.8.0 and gettext-tiny to 0.3.3; re-checked every other component against upstream (all already current, or deliberately held back — see the `version` property comments).
 - Bug fixes:
+  - Python 3.15 builds silently lacked `_decimal` (cpython no longer falls back to its bundled libmpdec), `mpdec` is now auto-selected for 3.14+ (3.14 otherwise uses its deprecated bundled libmpdec 2.5.1)
   - With `cpython-use-github: true`, a failed GitHub API call (e.g. rate limiting) crashed with a stack trace
   - A build where `bin/python` could not be found crashed (instead of reporting it) when `cpython-validate-script` or `cpython-additional-packages` was configured
   - Clearer error messages when the latest python version can't be determined, or a python family isn't supported
diff --git a/src/portable_python/cpython.py b/src/portable_python/cpython.py
index f5f8024..3bfad4d 100644
--- a/src/portable_python/cpython.py
+++ b/src/portable_python/cpython.py
@@ -188,7 +188,7 @@ def xenv_LIBZSTD_LIBS(self):
             yield f"{self.deps_lib_dir}/libzstd.a"
 
     def xenv_LIBMPDEC_CFLAGS(self):
-        if self.version >= "3.14" and PPG.target.is_macos:
+        if self.version >= "3.14" and PPG.target.is_macos and self.active_module(Mpdec):
             # Normally ./configure will autodetect using pkg-config, but
             # this doesn't typically work on Mac (the pkg-config binary is
             # in homebrew, which we omit from path) so we have to provide
@@ -196,7 +196,7 @@ def xenv_LIBMPDEC_CFLAGS(self):
             yield f"-I{self.deps}/include"
 
     def xenv_LIBMPDEC_LIBS(self):
-        if self.version >= "3.14" and PPG.target.is_macos:
+        if self.version >= "3.14" and PPG.target.is_macos and self.active_module(Mpdec):
             yield f"{self.deps_lib_dir}/libmpdec.a"
 
     def xenv_LIBREADLINE_LIBS(self):
diff --git a/src/portable_python/external/xcpython.py b/src/portable_python/external/xcpython.py
index 1b54be1..56f9182 100644
--- a/src/portable_python/external/xcpython.py
+++ b/src/portable_python/external/xcpython.py
@@ -135,10 +135,9 @@ def url(self):
 
     @property
     def version(self):
-        # Stay on 3.5: 3.6, 3.7 and 3.8 all landed Jun-Aug 2026 in quick succession (3.7.0 -> 3.7.1 took 2 days)
-        # python-build-standalone still pins 3.4.8, none of the newer lines are proven for static cpython builds yet
+        # python-build-standalone moved from 3.4.8 straight to 3.8.0 in Oct 2026 (their PR #1302), follow their lead
         # Check https://github.com/libffi/libffi/releases
-        return self.cfg_version("3.5.2")
+        return self.cfg_version("3.8.0")
 
     def c_configure_args(self):
         if config_args := self.cfg_configure(self.deps_lib_dir, self.deps_lib64_dir):
@@ -489,7 +488,8 @@ def _do_linux_compile(self):
 
 class Mpdec(ModuleBuilder):
     """
-    Prevent falling back to bundled libmpdec (deprecated and scheduled for removal in Python 3.16)
+    Since 3.15 (gh-115119), cpython no longer falls back to its bundled libmpdec: without one, `_decimal` is silently skipped
+    3.14 still falls back, but to a deprecated (and older) bundled copy, so we build it there too
     """
 
     m_debian = "!libmpdec-dev"
@@ -498,11 +498,11 @@ class Mpdec(ModuleBuilder):
     xenv_CFLAGS = "-fPIC"
 
     def auto_select_reason(self):
-        if self.setup.python_spec.version >= "3.16":
+        if self.setup.python_spec.version >= "3.14":
             if PPG.target.is_macos:
-                return "Required for 3.16 and up"
+                return "Required for 3.14 and up"
             if not self.resolved_telltale:
-                return "Required for 3.16 and up"
+                return "Required for 3.14 and up"
 
     @property
     def url(self):
@@ -518,7 +518,8 @@ def c_configure_args(self):
             yield from config_args
 
         else:
-            pass  # yield "--static"
+            yield "--disable-shared"
+
         yield "--disable-cxx"
 
     def _do_linux_compile(self):
diff --git a/tests/test_report.py b/tests/test_report.py
index f2720b3..90a2bb4 100644
--- a/tests/test_report.py
+++ b/tests/test_report.py
@@ -14,9 +14,9 @@ def test_scan(cli):
         assert "Problematic modules:" in cli.logged
 
     with patch.object(PPG, "find_telltale", return_value=None):  # Simulate a host without any system headers
-        cli.run("-tlinux-x86_64", "build-report", "3.16.0")
+        cli.run("-tlinux-x86_64", "build-report", "3.14.0")
         assert "zstd         1.5.7    static*  broken, can't compile without libzstd-dev" in cli.logged  # Auto-selected ('*')
         assert "mpdec        4.0.1    static*  broken, can't compile without libmpdec-dev" in cli.logged
 
-        cli.run("-tmacos-arm64", "build-report", "3.16.0")
-        assert "mpdec        4.0.1    static*  [auto-selected] Required for 3.16 and up" in cli.logged
+        cli.run("-tmacos-arm64", "build-report", "3.14.0")
+        assert "mpdec        4.0.1    static*  [auto-selected] Required for 3.14 and up" in cli.logged