diff --git a/.cirrus.yml b/.cirrus.yml
index 1d01927ddd..9be142d5f4 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -737,7 +737,7 @@ cluster_testing_docker_builder:
 #
 # Also triggers on CIRRUS_CRON == 'zeekctl-nightly' if that is configured
 # through the Cirrus Web UI.
-zeekctl_debian11_task:
+zeekctl_debian12_task:
   cpu: *CPUS
   memory: *MEMORY
   only_if: >
@@ -748,8 +748,8 @@ zeekctl_debian11_task:
         $CIRRUS_BRANCH =~ 'release/.*' )
     )
   container:
-    # Debian 11 EOL: June 2026
-    dockerfile: ci/debian-11/Dockerfile
+    # Debian 12 (bookworm) EOL: TBD
+    dockerfile: ci/debian-12/Dockerfile
     << : *RESOURCES_TEMPLATE
   sync_submodules_script: git submodule update --recursive --init
   always:
@@ -768,24 +768,35 @@ zeekctl_debian11_task:
     upload_zeekctl_testing_artifacts:
       path: "auxil/zeekctl/testing/.tmp/**"
 
-# Test building Zeek with builtin plugins available in
-# testing/builtin-plugins/Files/
-include_plugins_debian11_task:
+include_plugins_debian12_task:
   cpu: *CPUS
   memory: *MEMORY
   container:
-    # Debian 11 EOL: June 2026
-    dockerfile: ci/debian-11/Dockerfile
+    # Debian 12 (bookworm) EOL: TBD
+    dockerfile: ci/debian-12/Dockerfile
     << : *RESOURCES_TEMPLATE
   sync_submodules_script: git submodule update --recursive --init
+  fetch_external_plugins_script:
+    - cd /zeek/testing/builtin-plugins/external && git clone https://github.com/zeek/zeek-perf-support.git
+    - cd /zeek/testing/builtin-plugins/external && git clone https://github.com/zeek/zeek-more-hashes.git
+    - cd /zeek/testing/builtin-plugins/external && git clone https://github.com/zeek/zeek-cluster-backend-nats.git
+    - cd /zeek/testing/builtin-plugins/external && git clone https://github.com/SeisoLLC/zeek-kafka.git
   always:
     ccache_cache:
       folder: /tmp/ccache
       fingerprint_script: echo builtin-plugins-ccache-$ZEEK_CCACHE_EPOCH-$CIRRUS_TASK_NAME-$CIRRUS_OS
       reupload_on_changes: true
-  build_script: ZEEK_CI_CONFIGURE_FLAGS="${ZEEK_CI_CONFIGURE_FLAGS} --include-plugins='/zeek/testing/builtin-plugins/Files/protocol-plugin;/zeek/testing/builtin-plugins/Files/py-lib-plugin;/zeek/testing/builtin-plugins/Files/zeek-version-plugin'" ./ci/build.sh
+  build_script: ZEEK_CI_CONFIGURE_FLAGS="${ZEEK_CI_CONFIGURE_FLAGS} --include-plugins='/zeek/testing/builtin-plugins/Files/protocol-plugin;/zeek/testing/builtin-plugins/Files/py-lib-plugin;/zeek/testing/builtin-plugins/Files/zeek-version-plugin;/zeek/testing/builtin-plugins/external/zeek-perf-support;/zeek/testing/builtin-plugins/external/zeek-more-hashes;/zeek/testing/builtin-plugins/external/zeek-cluster-backend-nats;/zeek/testing/builtin-plugins/external/zeek-kafka'" ./ci/build.sh
   test_script:
     - cd testing/builtin-plugins && ../../auxil/btest/btest -d -b -j ${ZEEK_CI_BTEST_JOBS}
+  test_external_plugins_script: |
+    . /zeek/build/zeek-path-dev.sh
+    set -ex
+    # For now, just check if the external plugins are available.
+    zeek -N Zeek::PerfSupport
+    zeek -N Zeek::MoreHashes
+    zeek -N Zeek::Cluster_Backend_NATS
+    zeek -N Seiso::Kafka
   on_failure:
     upload_include_plugins_testing_artifacts:
       path: "testing/builtin-plugins/.tmp/**"
diff --git a/CHANGES b/CHANGES
index 64d116eb21..c2cd04ab81 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,12 @@
+7.2.0-dev.458 | 2025-03-31 18:59:11 +0200
+
+  * CI: Upgrade zeekctl task to Debian 12 (Arne Welzel, Corelight)
+
+  * GH-3535: CI: Add external plugins to builtin plugins task (Arne Welzel, Corelight)
+
+    This clones a few external plugins to include them in a build. Except
+    for zeek-kafka, the others are maintained by the Zeek project.
+
 7.2.0-dev.454 | 2025-03-31 18:44:59 +0200
 
   * Hook into Broker logs via its new API (Dominik Charousset)
diff --git a/VERSION b/VERSION
index ee3dfa8ea8..26e9f93227 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-7.2.0-dev.454
+7.2.0-dev.458
diff --git a/ci/debian-12/Dockerfile b/ci/debian-12/Dockerfile
index bc66a7d39e..63825702b4 100644
--- a/ci/debian-12/Dockerfile
+++ b/ci/debian-12/Dockerfile
@@ -20,8 +20,10 @@ RUN apt-get update && apt-get -y install \
     git \
     jq \
     libkrb5-dev \
+    libnats-dev \
     libnode-dev \
     libpcap-dev \
+    librdkafka-dev \
     libssl-dev \
     libuv1-dev \
     make \
diff --git a/cmake b/cmake
index eede3aab03..dcaad38c87 160000
--- a/cmake
+++ b/cmake
@@ -1 +1 @@
-Subproject commit eede3aab03b80ade33a757f85dfc29f16a44499b
+Subproject commit dcaad38c87218537a046c092e31ec16a3ee01cfd
diff --git a/testing/builtin-plugins/external/.btest-ignore b/testing/builtin-plugins/external/.btest-ignore
new file mode 100644
index 0000000000..e69de29bb2