diff --git a/3.13/bookworm/Dockerfile b/3.13/bookworm/Dockerfile
index 4c7bfd25b..0178b0cf6 100644
--- a/3.13/bookworm/Dockerfile
+++ b/3.13/bookworm/Dockerfile
@@ -24,6 +24,14 @@ ENV PYTHON_VERSION 3.13.9
 ENV PYTHON_SHA256 ed5ef34cda36cfa2f3a340f07cac7e7814f91c7f3c411f6d3562323a866c5c66
 
 RUN set -eux; \
+	\
+	savedAptMark="$(apt-mark showmanual)"; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends \
+		clang-18 \
+		llvm-18 \
+		python3 \
+	; \
 	\
 	wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; \
 	echo "$PYTHON_SHA256 *python.tar.xz" | sha256sum -c -; \
@@ -47,6 +55,9 @@ RUN set -eux; \
 		--enable-shared \
 		$(test "${gnuArch%%-*}" != 'riscv64' && echo '--with-lto') \
 		--with-ensurepip \
+# https://github.com/docker-library/python/issues/1009
+# https://docs.python.org/3.14/whatsnew/3.14.html#binary-releases-for-the-experimental-just-in-time-compiler
+		--enable-experimental-jit=yes-off \
 	; \
 	nproc="$(nproc)"; \
 	EXTRA_CFLAGS="$(dpkg-buildflags --get CFLAGS)"; \
@@ -101,6 +112,20 @@ RUN set -eux; \
 	\
 	ldconfig; \
 	\
+	apt-mark auto '.*' > /dev/null; \
+	apt-mark manual $savedAptMark; \
+	find /usr/local -type f -executable -not \( -name '*tkinter*' \) -exec ldd '{}' ';' \
+		| awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); printf "*%s\n", so }' \
+		| sort -u \
+		| xargs -rt dpkg-query --search \
+# https://manpages.debian.org/bookworm/dpkg/dpkg-query.1.en.html#S (we ignore diversions and it'll be really unusual for more than one package to provide any given .so file)
+		| awk 'sub(":$", "", $1) { print $1 }' \
+		| sort -u \
+		| xargs -r apt-mark manual \
+	; \
+	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+	rm -rf /var/lib/apt/lists/*; \
+	\
 	export PYTHONDONTWRITEBYTECODE=1; \
 	python3 --version; \
 	pip3 --version
diff --git a/3.13/slim-bookworm/Dockerfile b/3.13/slim-bookworm/Dockerfile
index d3f2f8e87..cf20ac21a 100644
--- a/3.13/slim-bookworm/Dockerfile
+++ b/3.13/slim-bookworm/Dockerfile
@@ -28,6 +28,7 @@ RUN set -eux; \
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
+		clang-18 \
 		dpkg-dev \
 		gcc \
 		gnupg \
@@ -42,7 +43,9 @@ RUN set -eux; \
 		libreadline-dev \
 		libsqlite3-dev \
 		libssl-dev \
+		llvm-18 \
 		make \
+		python3 \
 		tk-dev \
 		uuid-dev \
 		wget \
@@ -72,6 +75,9 @@ RUN set -eux; \
 		--enable-shared \
 		$(test "${gnuArch%%-*}" != 'riscv64' && echo '--with-lto') \
 		--with-ensurepip \
+# https://github.com/docker-library/python/issues/1009
+# https://docs.python.org/3.14/whatsnew/3.14.html#binary-releases-for-the-experimental-just-in-time-compiler
+		--enable-experimental-jit=yes-off \
 	; \
 	nproc="$(nproc)"; \
 	EXTRA_CFLAGS="$(dpkg-buildflags --get CFLAGS)"; \
diff --git a/3.13/slim-trixie/Dockerfile b/3.13/slim-trixie/Dockerfile
index e3fe308be..d06f9eade 100644
--- a/3.13/slim-trixie/Dockerfile
+++ b/3.13/slim-trixie/Dockerfile
@@ -28,6 +28,7 @@ RUN set -eux; \
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
+		clang-18 \
 		dpkg-dev \
 		gcc \
 		gnupg \
@@ -42,7 +43,9 @@ RUN set -eux; \
 		libreadline-dev \
 		libsqlite3-dev \
 		libssl-dev \
+		llvm-18 \
 		make \
+		python3 \
 		tk-dev \
 		uuid-dev \
 		wget \
@@ -72,6 +75,9 @@ RUN set -eux; \
 		--enable-shared \
 		$(test "${gnuArch%%-*}" != 'riscv64' && echo '--with-lto') \
 		--with-ensurepip \
+# https://github.com/docker-library/python/issues/1009
+# https://docs.python.org/3.14/whatsnew/3.14.html#binary-releases-for-the-experimental-just-in-time-compiler
+		--enable-experimental-jit=yes-off \
 	; \
 	nproc="$(nproc)"; \
 	EXTRA_CFLAGS="$(dpkg-buildflags --get CFLAGS)"; \
diff --git a/3.13/trixie/Dockerfile b/3.13/trixie/Dockerfile
index 8fc726c70..c6d1c7dba 100644
--- a/3.13/trixie/Dockerfile
+++ b/3.13/trixie/Dockerfile
@@ -24,6 +24,14 @@ ENV PYTHON_VERSION 3.13.9
 ENV PYTHON_SHA256 ed5ef34cda36cfa2f3a340f07cac7e7814f91c7f3c411f6d3562323a866c5c66
 
 RUN set -eux; \
+	\
+	savedAptMark="$(apt-mark showmanual)"; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends \
+		clang-18 \
+		llvm-18 \
+		python3 \
+	; \
 	\
 	wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; \
 	echo "$PYTHON_SHA256 *python.tar.xz" | sha256sum -c -; \
@@ -47,6 +55,9 @@ RUN set -eux; \
 		--enable-shared \
 		$(test "${gnuArch%%-*}" != 'riscv64' && echo '--with-lto') \
 		--with-ensurepip \
+# https://github.com/docker-library/python/issues/1009
+# https://docs.python.org/3.14/whatsnew/3.14.html#binary-releases-for-the-experimental-just-in-time-compiler
+		--enable-experimental-jit=yes-off \
 	; \
 	nproc="$(nproc)"; \
 	EXTRA_CFLAGS="$(dpkg-buildflags --get CFLAGS)"; \
@@ -101,6 +112,20 @@ RUN set -eux; \
 	\
 	ldconfig; \
 	\
+	apt-mark auto '.*' > /dev/null; \
+	apt-mark manual $savedAptMark; \
+	find /usr/local -type f -executable -not \( -name '*tkinter*' \) -exec ldd '{}' ';' \
+		| awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); printf "*%s\n", so }' \
+		| sort -u \
+		| xargs -rt dpkg-query --search \
+# https://manpages.debian.org/bookworm/dpkg/dpkg-query.1.en.html#S (we ignore diversions and it'll be really unusual for more than one package to provide any given .so file)
+		| awk 'sub(":$", "", $1) { print $1 }' \
+		| sort -u \
+		| xargs -r apt-mark manual \
+	; \
+	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+	apt-get dist-clean; \
+	\
 	export PYTHONDONTWRITEBYTECODE=1; \
 	python3 --version; \
 	pip3 --version
diff --git a/3.14/bookworm/Dockerfile b/3.14/bookworm/Dockerfile
index f802ef786..28f3ceeb4 100644
--- a/3.14/bookworm/Dockerfile
+++ b/3.14/bookworm/Dockerfile
@@ -27,7 +27,10 @@ RUN set -eux; \
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
+		clang-19 \
 		libzstd-dev \
+		llvm-19 \
+		python3 \
 	; \
 	\
 	wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; \
@@ -46,6 +49,9 @@ RUN set -eux; \
 		--enable-shared \
 		$(test "${gnuArch%%-*}" != 'riscv64' && echo '--with-lto') \
 		--with-ensurepip \
+# https://github.com/docker-library/python/issues/1009
+# https://docs.python.org/3.14/whatsnew/3.14.html#binary-releases-for-the-experimental-just-in-time-compiler
+		--enable-experimental-jit=yes-off \
 	; \
 	nproc="$(nproc)"; \
 	EXTRA_CFLAGS="$(dpkg-buildflags --get CFLAGS)"; \
diff --git a/3.14/slim-bookworm/Dockerfile b/3.14/slim-bookworm/Dockerfile
index efc7d3a65..8b979c51d 100644
--- a/3.14/slim-bookworm/Dockerfile
+++ b/3.14/slim-bookworm/Dockerfile
@@ -27,6 +27,7 @@ RUN set -eux; \
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
+		clang-19 \
 		dpkg-dev \
 		gcc \
 		gnupg \
@@ -42,7 +43,9 @@ RUN set -eux; \
 		libsqlite3-dev \
 		libssl-dev \
 		libzstd-dev \
+		llvm-19 \
 		make \
+		python3 \
 		tk-dev \
 		uuid-dev \
 		wget \
@@ -66,6 +69,9 @@ RUN set -eux; \
 		--enable-shared \
 		$(test "${gnuArch%%-*}" != 'riscv64' && echo '--with-lto') \
 		--with-ensurepip \
+# https://github.com/docker-library/python/issues/1009
+# https://docs.python.org/3.14/whatsnew/3.14.html#binary-releases-for-the-experimental-just-in-time-compiler
+		--enable-experimental-jit=yes-off \
 	; \
 	nproc="$(nproc)"; \
 	EXTRA_CFLAGS="$(dpkg-buildflags --get CFLAGS)"; \
diff --git a/3.14/slim-trixie/Dockerfile b/3.14/slim-trixie/Dockerfile
index 1abf7739d..e8a416431 100644
--- a/3.14/slim-trixie/Dockerfile
+++ b/3.14/slim-trixie/Dockerfile
@@ -27,6 +27,7 @@ RUN set -eux; \
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
+		clang-19 \
 		dpkg-dev \
 		gcc \
 		gnupg \
@@ -42,7 +43,9 @@ RUN set -eux; \
 		libsqlite3-dev \
 		libssl-dev \
 		libzstd-dev \
+		llvm-19 \
 		make \
+		python3 \
 		tk-dev \
 		uuid-dev \
 		wget \
@@ -66,6 +69,9 @@ RUN set -eux; \
 		--enable-shared \
 		$(test "${gnuArch%%-*}" != 'riscv64' && echo '--with-lto') \
 		--with-ensurepip \
+# https://github.com/docker-library/python/issues/1009
+# https://docs.python.org/3.14/whatsnew/3.14.html#binary-releases-for-the-experimental-just-in-time-compiler
+		--enable-experimental-jit=yes-off \
 	; \
 	nproc="$(nproc)"; \
 	EXTRA_CFLAGS="$(dpkg-buildflags --get CFLAGS)"; \
diff --git a/3.14/trixie/Dockerfile b/3.14/trixie/Dockerfile
index 7aa50e8b8..e8dfa61f1 100644
--- a/3.14/trixie/Dockerfile
+++ b/3.14/trixie/Dockerfile
@@ -27,7 +27,10 @@ RUN set -eux; \
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
+		clang-19 \
 		libzstd-dev \
+		llvm-19 \
+		python3 \
 	; \
 	\
 	wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; \
@@ -46,6 +49,9 @@ RUN set -eux; \
 		--enable-shared \
 		$(test "${gnuArch%%-*}" != 'riscv64' && echo '--with-lto') \
 		--with-ensurepip \
+# https://github.com/docker-library/python/issues/1009
+# https://docs.python.org/3.14/whatsnew/3.14.html#binary-releases-for-the-experimental-just-in-time-compiler
+		--enable-experimental-jit=yes-off \
 	; \
 	nproc="$(nproc)"; \
 	EXTRA_CFLAGS="$(dpkg-buildflags --get CFLAGS)"; \
diff --git a/Dockerfile-linux.template b/Dockerfile-linux.template
index d58480c09..6cdfc379f 100644
--- a/Dockerfile-linux.template
+++ b/Dockerfile-linux.template
@@ -8,6 +8,14 @@
 	def rcVersion:
 		env.version | rtrimstr("-rc")
 	;
+	def llvmVersion:
+		if is_alpine then null else
+			{
+				"3.13": "18", # https://github.com/python/cpython/blob/3.13/Tools/jit/README.md
+				"3.14": "19", # https://github.com/python/cpython/blob/3.14/Tools/jit/README.md
+			}[rcVersion]
+		end
+	;
 	def clean_apt:
 		# TODO once bookworm is EOL, remove this and just hard-code "apt-get dist-clean" instead
 		if env.variant | contains("bookworm") then
@@ -155,6 +163,12 @@ RUN set -eux; \
 		if IN(env.version; "3.9", "3.10", "3.11", "3.12", "3.13") then empty else
 			"libzstd-dev"
 		end,
+		if llvmVersion then
+			"clang-\(llvmVersion)",
+			"llvm-\(llvmVersion)",
+			"python3", # "Python 3.11 or newer is required to build the JIT."
+			empty
+		else empty end,
 		empty
 	end
 ] -}}
@@ -215,6 +229,11 @@ RUN set -eux; \
 		$(test "${gnuArch%%-*}" != 'riscv64' && echo '--with-lto') \
 {{ ) end -}}
 		--with-ensurepip \
+{{ if llvmVersion then ( -}}
+# https://github.com/docker-library/python/issues/1009
+# https://docs.python.org/3.14/whatsnew/3.14.html#binary-releases-for-the-experimental-just-in-time-compiler
+		--enable-experimental-jit=yes-off \
+{{ ) else "" end -}}
 	; \
 	nproc="$(nproc)"; \
 {{ if is_alpine then ( -}}