diff --git a/.github/workflows/ci-workflow.yml b/.github/workflows/ci-workflow.yml
index 69b7338d..e14b9a39 100644
--- a/.github/workflows/ci-workflow.yml
+++ b/.github/workflows/ci-workflow.yml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
 
     container:
-      image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:d5bfe2e793f15a826971ae9de2adcad524df3e8e
+      image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:3.9.0
 
     steps:
       - name: Clone
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
 
     container:
-      image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:d5bfe2e793f15a826971ae9de2adcad524df3e8e
+      image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:3.9.0
 
     steps:
       - name: Clone
@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
 
     container:
-      image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:d5bfe2e793f15a826971ae9de2adcad524df3e8e
+      image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:3.9.0
 
     steps:
       - name: Clone
@@ -72,7 +72,7 @@ jobs:
     needs: job_nanoS_build_debug
 
     container:
-      image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:d5bfe2e793f15a826971ae9de2adcad524df3e8e
+      image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:3.9.0
 
     steps:
       - uses: actions/checkout@v2
diff --git a/MakefileContainer.mk b/MakefileContainer.mk
index 6c947f62..7172c4e8 100644
--- a/MakefileContainer.mk
+++ b/MakefileContainer.mk
@@ -19,7 +19,7 @@ ifneq ($(BOLOS_SDK),)
 $(error Containerized build, BOLOS_SDK should be empty)
 endif
 
-APP_BUILDER_IMAGE = ledger-app-builder:d5bfe2e793f15a826971ae9de2adcad524df3e8e
+APP_BUILDER_IMAGE = ledger-app-builder:3.9.0
 
 default_target: build
 
diff --git a/MakefileSpeculos.mk b/MakefileSpeculos.mk
index 885f4551..71b4914a 100644
--- a/MakefileSpeculos.mk
+++ b/MakefileSpeculos.mk
@@ -15,7 +15,7 @@
 #  limitations under the License.
 #*******************************************************************************
 
-SPECULOS_IMAGE = speculos:sha-6a34680
+SPECULOS_IMAGE = speculos:sha-c59b939
 	
 define run_announce
 	@perl -e 'use Time::HiRes; use POSIX; $$ts = sprintf qq[%f], Time::HiRes::time(); ($$f) = $$ts =~ m~(\....)~; printf qq[%s%s %s make: %s\n], POSIX::strftime("%H:%M:%S", gmtime), $$f, q[-] x 126, $$ARGV[0];' "$(1)"
diff --git a/src/io.c b/src/io.c
index 55a96ace..f4334da7 100644
--- a/src/io.c
+++ b/src/io.c
@@ -139,7 +139,6 @@ unsigned short io_exchange_al(unsigned char channel, unsigned short tx_len) {
     return 0;
 }
 
-STATIC_ASSERT(CX_APILEVEL >= 9, "bad api level");
 static const unsigned PIN_VERIFIED = BOLOS_UX_OK;  // Seems to work for api 9/10
 
 bool device_is_unlocked() {
diff --git a/src/keyDerivation.c b/src/keyDerivation.c
index 54df89bf..aac0dba0 100644
--- a/src/keyDerivation.c
+++ b/src/keyDerivation.c
@@ -35,7 +35,6 @@ __noinline_due_to_stack__ WARN_UNUSED_RESULT uint16_t derivePrivateKey(const bip
 
     // Sanity check
     CRYPTO_ASSERT(pathSpec->length < ARRAY_LEN(pathSpec->path));
-    STATIC_ASSERT(CX_APILEVEL >= 5, "unsupported api level");
     TRACE();
 
     CRYPTO_CX_CHECK(os_derive_bip32_with_seed_no_throw(HDW_NORMAL,
diff --git a/src/main.c b/src/main.c
index 142c7a2f..b9e88fed 100644
--- a/src/main.c
+++ b/src/main.c
@@ -33,12 +33,6 @@
 #include "assert.h"
 #include "io.h"
 
-// The whole app is designed for a specific api level.
-// In case there is an api change, first *verify* changes
-// (especially potential security implications) before bumping
-// the API level!
-STATIC_ASSERT(CX_APILEVEL >= 9, "bad api level");
-
 static const int INS_NONE = -1;
 
 // ui_idle displays the main menu. Note that your app isn't required to use a