diff --git a/.cirrus.yml b/.cirrus.yml
index ad22a42c02..49b0fec2cc 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -13,6 +13,7 @@ memory: &MEMORY 16GB
 config: &CONFIG --build-type=release --disable-broker-tests --prefix=$CIRRUS_WORKING_DIR/install --ccache --enable-werror
 no_spicy_config: &NO_SPICY_CONFIG --build-type=release --disable-broker-tests --disable-spicy --prefix=$CIRRUS_WORKING_DIR/install --ccache --enable-werror
 static_config: &STATIC_CONFIG --build-type=release --disable-broker-tests --enable-static-broker --enable-static-binpac --prefix=$CIRRUS_WORKING_DIR/install --ccache --enable-werror
+binary_config: &BINARY_CONFIG --prefix=$CIRRUS_WORKING_DIR/install --libdir=$CIRRUS_WORKING_DIR/install/lib --binary-package --enable-static-broker --enable-static-binpac --disable-broker-tests --build-type=Release --ccache --enable-werror
 asan_sanitizer_config: &ASAN_SANITIZER_CONFIG --build-type=debug --disable-broker-tests --sanitizers=address --enable-fuzzers --enable-coverage --disable-spicy --ccache --enable-werror
 ubsan_sanitizer_config: &UBSAN_SANITIZER_CONFIG --build-type=debug --disable-broker-tests --sanitizers=undefined --enable-fuzzers --disable-spicy --ccache --enable-werror
 tsan_sanitizer_config: &TSAN_SANITIZER_CONFIG --build-type=debug --disable-broker-tests --sanitizers=thread --enable-fuzzers --disable-spicy --ccache --enable-werror
@@ -222,6 +223,20 @@ debian12_static_task:
   env:
     ZEEK_CI_CONFIGURE_FLAGS: *STATIC_CONFIG
 
+debian12_binary_task:
+  container:
+    # Just use a recent/common distro to run binary mode compile test.
+    # As of 2024-03, the used configure flags are equivalent to the flags
+    # that we use to create binary packages.
+    # Just use a recent/common distro to run a static compile test.
+    # Debian 12 (bookworm) EOL: TBD
+    dockerfile: ci/debian-12/Dockerfile
+    << : *RESOURCES_TEMPLATE
+  << : *CI_TEMPLATE
+  << : *SKIP_TASK_ON_PR
+  env:
+    ZEEK_CI_CONFIGURE_FLAGS: *BINARY_CONFIG
+
 debian11_task:
   container:
     # Debian 11 EOL: June 2026
diff --git a/CHANGES b/CHANGES
index b8a5775fae..405b75ca1a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,22 @@
+7.0.0-dev.66 | 2024-03-16 11:14:25 +0100
+
+  * Bump Spicy to latest version reworking AST memory management. (Robin Sommer, Corelight)
+
+    Includes the necessary Zeek-side changes.
+
+    Goes with https://github.com/zeek/spicy/pull/1691.
+
+  * GH-3647: Add a CI test with the same options as we used for binary builds. (Johanna Amann, Corelight)
+
+    We already do have a test that check static builds, but none that tests
+    the exact same build flags we use for binary builds on OBS. This commit
+    fixes this oversight.
+
+  * GH-3647: Fix binary build of `spicyz`. (Robin Sommer, Corelight)
+
+    We need to link against the Spicy toolchain's object libraries but
+    were linking against static libraries instead.
+
 7.0.0-dev.61 | 2024-03-15 13:14:47 -0700
 
   * CI: Remove CentOS 7 and Debian 10 builds (Tim Wojtulewicz, Corelight)
diff --git a/VERSION b/VERSION
index 487eda0c12..a4a375871f 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-7.0.0-dev.61
+7.0.0-dev.66
diff --git a/src/spicy/spicyz/CMakeLists.txt b/src/spicy/spicyz/CMakeLists.txt
index bbf3db9f1d..e68bd224e9 100644
--- a/src/spicy/spicyz/CMakeLists.txt
+++ b/src/spicy/spicyz/CMakeLists.txt
@@ -10,7 +10,18 @@ set_target_properties(spicyz PROPERTIES CXX_EXTENSIONS OFF)
 
 target_include_directories(spicyz PRIVATE ${CMAKE_CURRENT_BINARY_DIR})
 
-target_link_libraries(spicyz PRIVATE hilti spicy)
+if (BINARY_PACKAGING_MODE)
+    # Ensure we link against the HILTI/Spicy toolchain libraries (should be
+    # default, but isn't set here for some reason).
+    set(HAVE_TOOLCHAIN ON)
+
+    hilti_link_object_libraries_in_tree(spicyz PRIVATE)
+    spicy_link_object_libraries_in_tree(spicyz PRIVATE)
+else ()
+    hilti_link_libraries_in_tree(spicyz PRIVATE)
+    spicy_link_libraries_in_tree(spicyz PRIVATE)
+endif ()
+
 prefer_configured_spicy_include_dirs(spicyz)
 
 install(TARGETS spicyz DESTINATION ${CMAKE_INSTALL_BINDIR})