diff --git a/backend/python/nemo/install.sh b/backend/python/nemo/install.sh
index bb7faeef4..a30fd27c8 100755
--- a/backend/python/nemo/install.sh
+++ b/backend/python/nemo/install.sh
@@ -14,4 +14,28 @@ if [ "x${BUILD_PROFILE}" == "xintel" ]; then
     EXTRA_PIP_INSTALL_FLAGS+=" --upgrade --index-strategy=unsafe-first-match"
 fi
 
+# Darwin needs a newer interpreter than libbackend's 3.10 default. nemo_toolkit
+# pulls in text2num, a Rust extension built with maturin, and its macOS arm64
+# wheels start at cp311 (3.0.2 publishes cp311/cp312/cp313/cp314 and no cp310).
+# On 3.10 pip therefore falls back to the sdist and dies in the PEP 517 hook
+# with "No module named 'maturin'", since EXTRA_PIP_INSTALL_FLAGS carries
+# --no-build-isolation and nothing installs the build backend. Moving to 3.12
+# takes the prebuilt wheel and needs no Rust toolchain on the runner at all.
+#
+# Darwin only, deliberately: the Linux profiles resolve a cp310 manylinux wheel
+# for the same package and have no reason to move.
+if [ "x${BUILD_PROFILE}" == "xmps" ] || [ "x${BUILD_PROFILE}" == "xmetal" ]; then
+    PYTHON_VERSION="3.12"
+    # PYTHON_PATCH must move with it. libbackend builds the portable-Python URL
+    # as cpython-${PYTHON_VERSION}.${PYTHON_PATCH}+${PY_STANDALONE_TAG}-..., and
+    # the default patch is 18 for 3.10.18; leaving it alone asks for a 3.12.18
+    # that was never released and the download 404s.
+    #
+    # 11, not the 12 that sglang/install.sh uses for l4t13: at the 20250818 tag
+    # python-build-standalone published 3.12.12 for linux aarch64 but not for
+    # aarch64-apple-darwin, where 3.12.11 is the newest. Verified against the
+    # release assets rather than copied across.
+    PYTHON_PATCH="11"
+fi
+
 installRequirements
diff --git a/backend/python/sglang/requirements-cublas12-after.txt b/backend/python/sglang/requirements-cublas12-after.txt
index 435075ecb..f731de4e6 100644
--- a/backend/python/sglang/requirements-cublas12-after.txt
+++ b/backend/python/sglang/requirements-cublas12-after.txt
@@ -2,3 +2,16 @@
 # (FunctionCallParser, ReasoningParser) move between releases.
 # 0.5.11 is the floor for Gemma 4 support (PR sgl-project/sglang#21952).
 sglang[all]>=0.5.11
+
+# Keep nvidia-modelopt on a stable release. sglang[all] pulls it in through its
+# `diffusion` extra with no version bound of its own, and install.sh passes a
+# GLOBAL --prerelease=allow (needed because flash-attn-4 only ships 4.0.0b*
+# wheels). Unbounded plus prereleases-allowed resolves to 0.46.0rc0, whose build
+# backend imports wheel_stub without declaring it as a build dependency; with
+# --no-build-isolation also in EXTRA_PIP_INSTALL_FLAGS nothing installs it, and
+# every cublas sglang image fails with "No module named 'wheel_stub'".
+#
+# Bounding this one package rather than dropping the global flag: the flag is
+# load-bearing for flash-attn-4, and this is the narrower change. Raise the
+# bound once 0.46.0 final ships.
+nvidia-modelopt<0.46
diff --git a/backend/python/sglang/requirements-cublas13-after.txt b/backend/python/sglang/requirements-cublas13-after.txt
index 435075ecb..f731de4e6 100644
--- a/backend/python/sglang/requirements-cublas13-after.txt
+++ b/backend/python/sglang/requirements-cublas13-after.txt
@@ -2,3 +2,16 @@
 # (FunctionCallParser, ReasoningParser) move between releases.
 # 0.5.11 is the floor for Gemma 4 support (PR sgl-project/sglang#21952).
 sglang[all]>=0.5.11
+
+# Keep nvidia-modelopt on a stable release. sglang[all] pulls it in through its
+# `diffusion` extra with no version bound of its own, and install.sh passes a
+# GLOBAL --prerelease=allow (needed because flash-attn-4 only ships 4.0.0b*
+# wheels). Unbounded plus prereleases-allowed resolves to 0.46.0rc0, whose build
+# backend imports wheel_stub without declaring it as a build dependency; with
+# --no-build-isolation also in EXTRA_PIP_INSTALL_FLAGS nothing installs it, and
+# every cublas sglang image fails with "No module named 'wheel_stub'".
+#
+# Bounding this one package rather than dropping the global flag: the flag is
+# load-bearing for flash-attn-4, and this is the narrower change. Raise the
+# bound once 0.46.0 final ships.
+nvidia-modelopt<0.46