diff --git a/Cargo.lock b/Cargo.lock
index 5b5976d7568..57f52dce5ea 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1740,10 +1740,11 @@ dependencies = [
 [[package]]
 name = "common"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/dendrite?rev=04a52a3240a26c58f03e1cf40353d67ff69d76b6#04a52a3240a26c58f03e1cf40353d67ff69d76b6"
+source = "git+https://github.com/oxidecomputer/dendrite?rev=247502812015b409d33240b836d5bf242817453d#247502812015b409d33240b836d5bf242817453d"
 dependencies = [
  "anyhow",
  "chrono",
+ "dpd-types",
  "oxnet",
  "rand 0.9.2",
  "schemars 0.8.22",
@@ -3291,11 +3292,11 @@ dependencies = [
 [[package]]
 name = "dpd-client"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/dendrite?rev=04a52a3240a26c58f03e1cf40353d67ff69d76b6#04a52a3240a26c58f03e1cf40353d67ff69d76b6"
+source = "git+https://github.com/oxidecomputer/dendrite?rev=247502812015b409d33240b836d5bf242817453d#247502812015b409d33240b836d5bf242817453d"
 dependencies = [
  "async-trait",
  "chrono",
- "common 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=04a52a3240a26c58f03e1cf40353d67ff69d76b6)",
+ "common 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=247502812015b409d33240b836d5bf242817453d)",
  "crc8",
  "futures",
  "http",
@@ -3312,6 +3313,30 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "dpd-types"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/dendrite?rev=247502812015b409d33240b836d5bf242817453d#247502812015b409d33240b836d5bf242817453d"
+dependencies = [
+ "dpd-types-versions",
+]
+
+[[package]]
+name = "dpd-types-versions"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/dendrite?rev=247502812015b409d33240b836d5bf242817453d#247502812015b409d33240b836d5bf242817453d"
+dependencies = [
+ "chrono",
+ "dropshot",
+ "omicron-common",
+ "oxnet",
+ "rand 0.9.2",
+ "schemars 0.8.22",
+ "serde",
+ "thiserror 2.0.18",
+ "uuid",
+]
+
 [[package]]
 name = "drift"
 version = "0.2.0"
@@ -8243,7 +8268,7 @@ dependencies = [
  "chrono",
  "crucible-agent-client",
  "dns-service-client",
- "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=04a52a3240a26c58f03e1cf40353d67ff69d76b6)",
+ "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=247502812015b409d33240b836d5bf242817453d)",
  "dropshot",
  "fmd-adm-sys",
  "futures",
@@ -9272,7 +9297,7 @@ dependencies = [
  "display-error-chain",
  "dns-server",
  "dns-service-client",
- "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=04a52a3240a26c58f03e1cf40353d67ff69d76b6)",
+ "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=247502812015b409d33240b836d5bf242817453d)",
  "dropshot",
  "ereport-types",
  "expectorate",
@@ -14564,7 +14589,7 @@ dependencies = [
  "bootstrap-agent-lockstep-types",
  "chrono",
  "daft",
- "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=04a52a3240a26c58f03e1cf40353d67ff69d76b6)",
+ "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=247502812015b409d33240b836d5bf242817453d)",
  "dropshot",
  "either",
  "futures",
@@ -17807,7 +17832,7 @@ name = "wicket-common"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=04a52a3240a26c58f03e1cf40353d67ff69d76b6)",
+ "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=247502812015b409d33240b836d5bf242817453d)",
  "dropshot",
  "gateway-client",
  "gateway-types",
@@ -17875,7 +17900,7 @@ dependencies = [
  "clap",
  "debug-ignore",
  "display-error-chain",
- "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=04a52a3240a26c58f03e1cf40353d67ff69d76b6)",
+ "dpd-client 0.1.0 (git+https://github.com/oxidecomputer/dendrite?rev=247502812015b409d33240b836d5bf242817453d)",
  "dropshot",
  "either",
  "expectorate",
diff --git a/Cargo.toml b/Cargo.toml
index f6327959882..b0ca62d111d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -520,7 +520,7 @@ digest = "0.10.7"
 dns-server = { path = "dns-server" }
 dns-server-api = { path = "dns-server-api" }
 dns-service-client = { path = "clients/dns-service-client" }
-dpd-client = { git = "https://github.com/oxidecomputer/dendrite", rev = "04a52a3240a26c58f03e1cf40353d67ff69d76b6" }
+dpd-client = { git = "https://github.com/oxidecomputer/dendrite", rev = "247502812015b409d33240b836d5bf242817453d" }
 dropshot = { version = "0.17.1", features = [ "usdt-probes" ] }
 dropshot-api-manager = "0.8.0"
 dropshot-api-manager-types = "0.8.0"
diff --git a/package-manifest.toml b/package-manifest.toml
index e7105c67db0..fb2416cdea0 100644
--- a/package-manifest.toml
+++ b/package-manifest.toml
@@ -765,8 +765,8 @@ only_for_targets.image = "standard"
 # the other `source.*` keys.
 source.type = "prebuilt"
 source.repo = "dendrite"
-source.commit = "04a52a3240a26c58f03e1cf40353d67ff69d76b6"
-source.sha256 = "427937bc676d374bdbc76796da37ff1de1c21bcf593fa3317db23e86b4f29c68"
+source.commit = "247502812015b409d33240b836d5bf242817453d"
+source.sha256 = "e878b070c1a3ae26decaa9194d4d785c125f72864c95c14b020770da14fb0b1b"
 output.type = "zone"
 output.intermediate_only = true
 
@@ -792,8 +792,8 @@ only_for_targets.image = "standard"
 # the other `source.*` keys.
 source.type = "prebuilt"
 source.repo = "dendrite"
-source.commit = "04a52a3240a26c58f03e1cf40353d67ff69d76b6"
-source.sha256 = "7b51f10349486f57c431c6fb5f18e7597dba6def1c929227b7bee4f52703cbf6"
+source.commit = "247502812015b409d33240b836d5bf242817453d"
+source.sha256 = "3f383cfbfd4c0af2f4e56eca7bc6376412617f8b78de3d3465718adb0dd668a7"
 output.type = "zone"
 output.intermediate_only = true
 
@@ -812,8 +812,8 @@ only_for_targets.image = "standard"
 # the other `source.*` keys.
 source.type = "prebuilt"
 source.repo = "dendrite"
-source.commit = "04a52a3240a26c58f03e1cf40353d67ff69d76b6"
-source.sha256 = "eb2ee25b5a9c8bb28f17a8d8aaaa0a7bffaf00ee0cadd876baf5c8c85572ca68"
+source.commit = "247502812015b409d33240b836d5bf242817453d"
+source.sha256 = "df1d007e4f90f260a343e7231e6bff2ce61f9d1e73e17765365b8c9f95b2a3d0"
 output.type = "zone"
 output.intermediate_only = true
 
diff --git a/sled-agent/scrimlet-reconcilers/src/dpd_reconciler/port_reconciler.rs b/sled-agent/scrimlet-reconcilers/src/dpd_reconciler/port_reconciler.rs
index d8160ab0925..d1249a64012 100644
--- a/sled-agent/scrimlet-reconcilers/src/dpd_reconciler/port_reconciler.rs
+++ b/sled-agent/scrimlet-reconcilers/src/dpd_reconciler/port_reconciler.rs
@@ -516,6 +516,15 @@ impl From<&'_ DiffablePortSettings> for DpdPortSettings {
             pre2: t.pre2,
         });
 
+        // TODO-multirack Whether we allow DDM traffic is based today only on
+        // whether the link is on a front QSFP port. We set it to false for
+        // them all now, but inter-rack links will need to support it when we
+        // implement multirack DDM routing.
+        //
+        // TODO-robustness: We should really be using the stronger types for
+        // ports in Dendrite, e.g., `PortId::Rear`, instead of strings.
+        let allow_ddm_traffic = port.port_id.starts_with("rear");
+
         // TODO breakouts?
         let mut links = HashMap::with_capacity(1);
         let link_id = DpdLinkId(0);
@@ -530,6 +539,7 @@ impl From<&'_ DiffablePortSettings> for DpdPortSettings {
                     lane: Some(link_id),
                     speed,
                     tx_eq,
+                    allow_ddm_traffic,
                 },
             },
         );
diff --git a/sled-agent/scrimlet-reconcilers/src/dpd_reconciler/port_reconciler/tests.rs b/sled-agent/scrimlet-reconcilers/src/dpd_reconciler/port_reconciler/tests.rs
index cd47d7c1f82..ffdc0ecdb30 100644
--- a/sled-agent/scrimlet-reconcilers/src/dpd_reconciler/port_reconciler/tests.rs
+++ b/sled-agent/scrimlet-reconcilers/src/dpd_reconciler/port_reconciler/tests.rs
@@ -69,6 +69,7 @@ fn dpd_port_settings(
     fec: Option<DpdPortFec>,
     autoneg: bool,
     addrs: Vec<IpAddr>,
+    allow_ddm_traffic: bool,
 ) -> DpdPortSettings {
     let mut links = HashMap::new();
     let link_id = DpdLinkId(0);
@@ -83,6 +84,7 @@ fn dpd_port_settings(
                 lane: Some(link_id),
                 speed,
                 tx_eq: None,
+                allow_ddm_traffic,
             },
         },
     );
@@ -127,6 +129,7 @@ fn plan_all_unchanged() {
             Some(DpdPortFec::Rs),
             true,
             vec![addr],
+            false, // This is an uplink
         ),
     )]);
 
@@ -218,6 +221,7 @@ fn plan_clear_all() {
                 Some(DpdPortFec::Rs),
                 true,
                 vec!["10.0.0.1".parse().unwrap()],
+                false,
             ),
         ),
         (
@@ -227,6 +231,7 @@ fn plan_clear_all() {
                 None,
                 false,
                 vec!["10.0.0.2".parse().unwrap()],
+                false,
             ),
         ),
     ]);
@@ -300,15 +305,28 @@ fn plan_mix() {
                 Some(DpdPortFec::Rs),
                 true,
                 vec![ip0],
+                false,
             ),
         ),
         (
             qsfp1.clone(),
-            dpd_port_settings(DpdPortSpeed::Speed25G, None, false, vec![ip1]),
+            dpd_port_settings(
+                DpdPortSpeed::Speed25G,
+                None,
+                false,
+                vec![ip1],
+                false,
+            ),
         ),
         (
             qsfp2.clone(),
-            dpd_port_settings(DpdPortSpeed::Speed10G, None, false, vec![ip2]),
+            dpd_port_settings(
+                DpdPortSpeed::Speed10G,
+                None,
+                false,
+                vec![ip2],
+                false,
+            ),
         ),
     ]);
 
@@ -410,6 +428,7 @@ fn plan_link_local_addrs_ignored_from_dpd() {
             None,
             true,
             vec![addr, link_local],
+            false,
         ),
     )]);
 
@@ -456,6 +475,7 @@ fn plan_rejects_multi_link_dpd_port() {
         lane: Some(link0),
         speed: DpdPortSpeed::Speed100G,
         tx_eq: None,
+        allow_ddm_traffic: false,
     };
     links.insert(
         link0.to_string(),
diff --git a/tools/dendrite_stub_checksums b/tools/dendrite_stub_checksums
index 73712abc5f8..d4a060c8bed 100644
--- a/tools/dendrite_stub_checksums
+++ b/tools/dendrite_stub_checksums
@@ -1,3 +1,3 @@
-CIDL_SHA256_ILLUMOS="427937bc676d374bdbc76796da37ff1de1c21bcf593fa3317db23e86b4f29c68"
-CIDL_SHA256_LINUX_DPD="d6cfabb2a4a22302880348b9b733d7a8cd5caec2596a41495dfd83482354f107"
-CIDL_SHA256_LINUX_SWADM="4ac47695b1ccef3ac615b9f4d816bc4aa6c3d223f93f38df322982d28017f69e"
+CIDL_SHA256_ILLUMOS="e878b070c1a3ae26decaa9194d4d785c125f72864c95c14b020770da14fb0b1b"
+CIDL_SHA256_LINUX_DPD="8b50e7c021f9a601be3122e1301dd1117d90ba9e0b3218878155557d075b421b"
+CIDL_SHA256_LINUX_SWADM="47ce113499d03d8766b071ebfd64211a3ee19e7526a02ff4dcc8c41a4be4b7ec"
diff --git a/tools/dendrite_version b/tools/dendrite_version
index da6425ab496..e0ecb81e235 100644
--- a/tools/dendrite_version
+++ b/tools/dendrite_version
@@ -1 +1 @@
-COMMIT="04a52a3240a26c58f03e1cf40353d67ff69d76b6"
+COMMIT="247502812015b409d33240b836d5bf242817453d"
diff --git a/wicketd/src/preflight_check/uplink.rs b/wicketd/src/preflight_check/uplink.rs
index f6028870f1c..938b73450ae 100644
--- a/wicketd/src/preflight_check/uplink.rs
+++ b/wicketd/src/preflight_check/uplink.rs
@@ -854,6 +854,12 @@ fn build_port_settings(
         .map(|a| a.address.ip_squashing_addrconf_to_unspecified())
         .collect();
 
+    // We always enable DDM on the backplane, so this only applies to the front
+    // IO ports which are _not_ uplinks. This entire code path is only used for
+    // the preflight uplink checks, so we can confidently say we don't want to
+    // allow DDM.
+    let allow_ddm_traffic = false;
+
     port_settings.links.insert(
         link_id.to_string(),
         LinkSettings {
@@ -865,6 +871,7 @@ fn build_port_settings(
                 speed,
                 lane: Some(LinkId(0)),
                 tx_eq: None,
+                allow_ddm_traffic,
             },
         },
     );