diff --git a/.cirrus.yml b/.cirrus.yml
index 2352701c91..ab50a7bc73 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -166,19 +166,19 @@ env:
 # Linux EOL timelines: https://linuxlifecycle.com/
 # Fedora (~13 months): https://fedoraproject.org/wiki/Fedora_Release_Life_Cycle
 
+fedora40_task:
+  container:
+    # Fedora 40 EOL: Around May 2025
+    dockerfile: ci/fedora-40/Dockerfile
+    << : *RESOURCES_TEMPLATE
+  << : *CI_TEMPLATE
+
 fedora39_task:
   container:
     # Fedora 39 EOL: Around Nov 2024
     dockerfile: ci/fedora-39/Dockerfile
     << : *RESOURCES_TEMPLATE
   << : *CI_TEMPLATE
-
-fedora38_task:
-  container:
-    # Fedora 38 EOL: Around May 2024
-    dockerfile: ci/fedora-38/Dockerfile
-    << : *RESOURCES_TEMPLATE
-  << : *CI_TEMPLATE
   << : *SKIP_TASK_ON_PR
 
 centosstream9_task:
diff --git a/CHANGES b/CHANGES
index a11b36cb2a..9724217070 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,27 @@
+7.0.0-dev.387 | 2024-06-18 10:52:25 +0200
+
+  * CMakeLists: Disable -Werror for 3rdparty/sqlite3.c (Arne Welzel, Corelight)
+
+    We package vanilla sqlite from upstream and on Fedora 40 with sqlite 3.46
+    there's the following compiler warning:
+
+        In function 'sqlite3Strlen30',
+            inlined from 'sqlite3ColumnSetColl' at
+            ../../src/3rdparty/sqlite3.c:122105:10:
+            ../../src/3rdparty/sqlite3.c:35003:28: error: 'strlen' reading 1 or more bytes from a region of size 0 [-Werror=stringop-overread]
+        35003 |   return 0x3fffffff & (int)strlen(z);
+              |                            ^~~~~~~~~
+        In function 'sqlite3ColumnSetColl':
+
+    Disabling -Werror on sqlite3.c seems sensible given we have little
+    control over that code.
+
+  * Bump zeek-3rdparty to pull in sqlite move to 3.46 (Christian Kreibich, Corelight)
+
+    This avoids a compiler warning/error on Fedora 40.
+
+  * CI: drop Fedora 38, add 40 (Christian Kreibich, Corelight)
+
 7.0.0-dev.383 | 2024-06-14 13:50:05 +0200
 
   * GH-3783: Spicy: Disallow repeating replacements of the same analyzer. (Robin Sommer, Corelight)
diff --git a/VERSION b/VERSION
index 4e9bd9a24d..dd2df9b2c7 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-7.0.0-dev.383
+7.0.0-dev.387
diff --git a/ci/fedora-38/Dockerfile b/ci/fedora-40/Dockerfile
similarity index 88%
rename from ci/fedora-38/Dockerfile
rename to ci/fedora-40/Dockerfile
index 5ed4573ac6..f292e11ece 100644
--- a/ci/fedora-38/Dockerfile
+++ b/ci/fedora-40/Dockerfile
@@ -1,15 +1,14 @@
-FROM fedora:38
+FROM fedora:40
 
 # A version field to invalidate Cirrus's build cache when needed, as suggested in
 # https://github.com/cirruslabs/cirrus-ci-docs/issues/544#issuecomment-566066822
-ENV DOCKERFILE_VERSION 20230801
+ENV DOCKERFILE_VERSION 20240617
 
 RUN dnf -y install \
     bison \
     ccache \
     cmake \
     diffutils \
-    findutils \
     flex \
     gcc \
     gcc-c++ \
@@ -21,7 +20,6 @@ RUN dnf -y install \
     openssl \
     openssl-devel \
     procps-ng \
-    python3 \
     python3-devel \
     python3-pip\
     sqlite \
diff --git a/src/3rdparty b/src/3rdparty
index 4c5985ca87..96caa6a590 160000
--- a/src/3rdparty
+++ b/src/3rdparty
@@ -1 +1 @@
-Subproject commit 4c5985ca8743d33927943a58e2cc2b74d7b05790
+Subproject commit 96caa6a59023eafae8a94a7b906a4436ebb57d29
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index bb075c4d35..c7ae4f183c 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -45,11 +45,13 @@ if (MSVC)
         # TODO: This is disabled for now because there a bunch of known
         # compiler warnings on Windows that we don't have good fixes for.
         #set(WERROR_FLAG "/WX")
+        #set(WNOERROR_FLAG "/WX:NO")
     endif ()
 else ()
     set(SIGN_COMPARE_FLAG "-Wno-sign-compare")
     if (BUILD_WITH_WERROR)
         set(WERROR_FLAG "-Werror")
+        set(WNOERROR_FLAG "-Wno-error")
     endif ()
 endif ()
 
@@ -445,6 +447,10 @@ set(THIRD_PARTY_SRCS
     $<$<BOOL:USE_SQLITE>:3rdparty/sqlite3.c>
     3rdparty/strsep.c)
 
+if (USE_SQLITE AND WNOERROR_FLAG)
+    set_source_files_properties(3rdparty/sqlite3.c PROPERTIES COMPILE_FLAGS ${WNOERROR_FLAG})
+endif ()
+
 # Highwayhash. Highwayhash is a bit special since it has architecture dependent
 # code...
 set(hhash_dir ${PROJECT_SOURCE_DIR}/auxil/highwayhash/highwayhash)