diff --git a/.github/workflows/appimage10.yml b/.github/workflows/appimage10.yml
index e52d01e3..09bf750e 100644
--- a/.github/workflows/appimage10.yml
+++ b/.github/workflows/appimage10.yml
@@ -3,6 +3,22 @@ on:
     tags:
       - "*"
   workflow_dispatch:
+    inputs:
+      tcl_source:
+        description: 'Tcl/Tk source: tarball or github'
+        type: choice
+        options:
+          - tarball
+          - github
+        default: 'github'
+      tcl_ref:
+        description: 'Tcl/Tk ref for github source (e.g. core-8-6-18); blank auto-resolves latest stable tag in series'
+        type: string
+        default: ''
+      tcl_version_override:
+        description: 'Tarball version override (e.g. 8.6.18 or 9.0.4); blank uses locked default'
+        type: string
+        default: ''
 
 name: CI-appimage10
 
@@ -48,10 +64,114 @@ jobs:
             fi
           fi
 
+      - name: Resolve TCL/TK source
+        id: resolve_tcl
+        env:
+          DEFAULT_TCL_SOURCE: github
+          TCL_LOCKED_VERSION: 9.0.4
+          TCL_TAG_GLOB: core-9-0-*
+          TCL_TAG_REGEX: '^core-9-0-[0-9]+$'
+          TCL_REF_INPUT: ${{ github.event.inputs.tcl_ref || '' }}
+          TCL_SOURCE_INPUT: ${{ github.event.inputs.tcl_source || '' }}
+          TCL_VERSION_OVERRIDE: ${{ github.event.inputs.tcl_version_override || '' }}
+        run: |
+          set -euo pipefail
+
+          known_sha() {
+            case "$1/$2" in
+              tcl/8.6.18) echo "8b9b554f3539b37bea20ee6cef14faa63df1259896e466328f596eca9f0c49a5" ;;
+              tk/8.6.18)  echo "8c1d775126c39124c89752737c32c23636b3cd308d0445977aec58cfbc42c46c" ;;
+              tcl/9.0.4)  echo "8c01bac92a9a8ce271b63d3aa28f09cde2c6762d6719ca671cdc8aee25391234" ;;
+              tk/9.0.4)   echo "ab9bd89fcff2e1248b7a9c097035f817fa0725285028c95686fdb92db65bc148" ;;
+              *)          echo "" ;;
+            esac
+          }
+
+          source_method="${TCL_SOURCE_INPUT:-$DEFAULT_TCL_SOURCE}"
+          tcl_version="${TCL_VERSION_OVERRIDE:-$TCL_LOCKED_VERSION}"
+          tcl_ref="core-${tcl_version//./-}"
+
+          if [ "$source_method" = "github" ]; then
+            if [ -n "$TCL_REF_INPUT" ]; then
+              tcl_ref="$TCL_REF_INPUT"
+              echo "Using workflow_dispatch TCL ref: $tcl_ref"
+            else
+              tcl_ref=$(git ls-remote --tags --refs https://github.com/tcltk/tcl.git "refs/tags/${TCL_TAG_GLOB}"                 | awk '{print $2}' | sed 's#refs/tags/##' | sort -V | tail -1)
+              test -n "$tcl_ref"
+              echo "Auto-resolved latest Tcl ref: $tcl_ref"
+            fi
+
+            if ! git ls-remote --tags --refs https://github.com/tcltk/tk.git "refs/tags/$tcl_ref" | grep -q .; then
+              echo "Missing matching Tk tag for Tcl ref: $tcl_ref" >&2
+              exit 1
+            fi
+
+            if echo "$tcl_ref" | grep -Eq "$TCL_TAG_REGEX"; then
+              tcl_version=$(echo "$tcl_ref" | sed -E 's/^core-([0-9]+)-([0-9]+)-([0-9]+)$/\1.\2.\3/')
+            else
+              echo "Warning: ref $tcl_ref does not match expected stable tag pattern; keeping Tcl version=$tcl_version"
+            fi
+          fi
+
+          tcl_ref_tag="core-${tcl_version//./-}"
+          tcl_tarball_url="https://codeload.github.com/tcltk/tcl/tar.gz/refs/tags/$tcl_ref_tag"
+          tk_tarball_url="https://codeload.github.com/tcltk/tk/tar.gz/refs/tags/$tcl_ref_tag"
+
+          tcl_sha=$(known_sha tcl "$tcl_version")
+          tk_sha=$(known_sha tk "$tcl_version")
+
+          if [ -n "$tcl_sha" ] && [ -n "$tk_sha" ]; then
+            sha_status="verified against known SHA"
+          else
+            sha_status="best-effort — no known SHA (actual SHA is printed during Docker build)"
+          fi
+
+          if [ "$source_method" = "github" ]; then
+            tcl_tmpdir=$(mktemp -d)
+            git -c advice.detachedHead=false clone --depth 1 --branch "$tcl_ref" https://github.com/tcltk/tcl.git "$tcl_tmpdir"
+            tcl_commit=$(git -C "$tcl_tmpdir" rev-parse HEAD)
+            tcl_commit_date=$(git -C "$tcl_tmpdir" log -1 --format=%ci)
+            rm -rf "$tcl_tmpdir"
+          else
+            tcl_commit=""
+            tcl_commit_date=""
+          fi
+
+          echo "TCL_SOURCE=$source_method" >> "$GITHUB_ENV"
+          echo "TCL_VERSION=$tcl_version" >> "$GITHUB_ENV"
+          echo "TCL_REF=$tcl_ref" >> "$GITHUB_ENV"
+          echo "TCL_TARBALL_URL=$tcl_tarball_url" >> "$GITHUB_ENV"
+          echo "TK_TARBALL_URL=$tk_tarball_url" >> "$GITHUB_ENV"
+          echo "TCL_TARBALL_SHA256=$tcl_sha" >> "$GITHUB_ENV"
+          echo "TK_TARBALL_SHA256=$tk_sha" >> "$GITHUB_ENV"
+          echo "TCL_SHA_STATUS=$sha_status" >> "$GITHUB_ENV"
+          echo "TCL_COMMIT=$tcl_commit" >> "$GITHUB_ENV"
+          echo "TCL_COMMIT_DATE=$tcl_commit_date" >> "$GITHUB_ENV"
+
+          echo "## Tcl/Tk source" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Field | Value |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| :-- | :-- |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Source method | $source_method |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Tcl/Tk version | $tcl_version |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Tcl ref | $tcl_ref |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| SHA status | $sha_status |" >> "$GITHUB_STEP_SUMMARY"
+          if [ -n "$tcl_commit" ]; then
+            echo "| Tcl commit | $tcl_commit |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Tcl commit date | $tcl_commit_date |" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
       - name: Build project
         run: |
           cd appimage/10
-          make
+          make \
+            TCL_SOURCE="${TCL_SOURCE}" \
+            TCL_VERSION="${TCL_VERSION}" \
+            TCL_REF="${TCL_REF}" \
+            TCL_TARBALL_URL="${TCL_TARBALL_URL}" \
+            TK_TARBALL_URL="${TK_TARBALL_URL}" \
+            TCL_TARBALL_SHA256="${TCL_TARBALL_SHA256}" \
+            TK_TARBALL_SHA256="${TK_TARBALL_SHA256}"
 
           ln -v Magic-x86_64.AppImage "${MAGIC_APPIMAGE_OUTPUT_FILENAME}"
           ls -l *.AppImage
@@ -138,6 +258,18 @@ jobs:
           cat RELEASE-NOTES-CL.txt >> RELEASE-NOTES-GH.txt
 
           # Show in action/artifact output
+          echo "## TCL/TK BUILD INFO" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "- Source: ${TCL_SOURCE}" >> $GITHUB_STEP_SUMMARY
+          echo "- Version: ${TCL_VERSION}" >> $GITHUB_STEP_SUMMARY
+          echo "- Ref: ${TCL_REF}" >> $GITHUB_STEP_SUMMARY
+          echo "- SHA status: ${TCL_SHA_STATUS}" >> $GITHUB_STEP_SUMMARY
+          if [ -n "${TCL_COMMIT}" ]; then
+            echo "- TCL commit: ${TCL_COMMIT}" >> $GITHUB_STEP_SUMMARY
+            echo "- TCL commit date: ${TCL_COMMIT_DATE}" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "" >> $GITHUB_STEP_SUMMARY
+
           echo "## RELEASE NOTES" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           cat RELEASE-NOTES-EL10.txt >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/appimage7.yml b/.github/workflows/appimage7.yml
index a0a672b0..0a01f292 100644
--- a/.github/workflows/appimage7.yml
+++ b/.github/workflows/appimage7.yml
@@ -3,6 +3,22 @@ on:
     tags:
       - "*"
   workflow_dispatch:
+    inputs:
+      tcl_source:
+        description: 'Tcl/Tk source: tarball or github'
+        type: choice
+        options:
+          - tarball
+          - github
+        default: 'tarball'
+      tcl_ref:
+        description: 'Tcl/Tk ref for github source (e.g. core-8-6-18); blank auto-resolves latest stable tag in series'
+        type: string
+        default: ''
+      tcl_version_override:
+        description: 'Tarball version override (e.g. 8.6.18 or 9.0.4); blank uses locked default'
+        type: string
+        default: ''
 
 name: CI-appimage7
 
@@ -48,10 +64,114 @@ jobs:
             fi
           fi
 
+      - name: Resolve TCL/TK source
+        id: resolve_tcl
+        env:
+          DEFAULT_TCL_SOURCE: tarball
+          TCL_LOCKED_VERSION: 8.6.18
+          TCL_TAG_GLOB: core-8-6-*
+          TCL_TAG_REGEX: '^core-8-6-[0-9]+$'
+          TCL_REF_INPUT: ${{ github.event.inputs.tcl_ref || '' }}
+          TCL_SOURCE_INPUT: ${{ github.event.inputs.tcl_source || '' }}
+          TCL_VERSION_OVERRIDE: ${{ github.event.inputs.tcl_version_override || '' }}
+        run: |
+          set -euo pipefail
+
+          known_sha() {
+            case "$1/$2" in
+              tcl/8.6.18) echo "8b9b554f3539b37bea20ee6cef14faa63df1259896e466328f596eca9f0c49a5" ;;
+              tk/8.6.18)  echo "8c1d775126c39124c89752737c32c23636b3cd308d0445977aec58cfbc42c46c" ;;
+              tcl/9.0.4)  echo "8c01bac92a9a8ce271b63d3aa28f09cde2c6762d6719ca671cdc8aee25391234" ;;
+              tk/9.0.4)   echo "ab9bd89fcff2e1248b7a9c097035f817fa0725285028c95686fdb92db65bc148" ;;
+              *)          echo "" ;;
+            esac
+          }
+
+          source_method="${TCL_SOURCE_INPUT:-$DEFAULT_TCL_SOURCE}"
+          tcl_version="${TCL_VERSION_OVERRIDE:-$TCL_LOCKED_VERSION}"
+          tcl_ref="core-${tcl_version//./-}"
+
+          if [ "$source_method" = "github" ]; then
+            if [ -n "$TCL_REF_INPUT" ]; then
+              tcl_ref="$TCL_REF_INPUT"
+              echo "Using workflow_dispatch TCL ref: $tcl_ref"
+            else
+              tcl_ref=$(git ls-remote --tags --refs https://github.com/tcltk/tcl.git "refs/tags/${TCL_TAG_GLOB}"                 | awk '{print $2}' | sed 's#refs/tags/##' | sort -V | tail -1)
+              test -n "$tcl_ref"
+              echo "Auto-resolved latest Tcl ref: $tcl_ref"
+            fi
+
+            if ! git ls-remote --tags --refs https://github.com/tcltk/tk.git "refs/tags/$tcl_ref" | grep -q .; then
+              echo "Missing matching Tk tag for Tcl ref: $tcl_ref" >&2
+              exit 1
+            fi
+
+            if echo "$tcl_ref" | grep -Eq "$TCL_TAG_REGEX"; then
+              tcl_version=$(echo "$tcl_ref" | sed -E 's/^core-([0-9]+)-([0-9]+)-([0-9]+)$/\1.\2.\3/')
+            else
+              echo "Warning: ref $tcl_ref does not match expected stable tag pattern; keeping Tcl version=$tcl_version"
+            fi
+          fi
+
+          tcl_ref_tag="core-${tcl_version//./-}"
+          tcl_tarball_url="https://codeload.github.com/tcltk/tcl/tar.gz/refs/tags/$tcl_ref_tag"
+          tk_tarball_url="https://codeload.github.com/tcltk/tk/tar.gz/refs/tags/$tcl_ref_tag"
+
+          tcl_sha=$(known_sha tcl "$tcl_version")
+          tk_sha=$(known_sha tk "$tcl_version")
+
+          if [ -n "$tcl_sha" ] && [ -n "$tk_sha" ]; then
+            sha_status="verified against known SHA"
+          else
+            sha_status="best-effort — no known SHA (actual SHA is printed during Docker build)"
+          fi
+
+          if [ "$source_method" = "github" ]; then
+            tcl_tmpdir=$(mktemp -d)
+            git -c advice.detachedHead=false clone --depth 1 --branch "$tcl_ref" https://github.com/tcltk/tcl.git "$tcl_tmpdir"
+            tcl_commit=$(git -C "$tcl_tmpdir" rev-parse HEAD)
+            tcl_commit_date=$(git -C "$tcl_tmpdir" log -1 --format=%ci)
+            rm -rf "$tcl_tmpdir"
+          else
+            tcl_commit=""
+            tcl_commit_date=""
+          fi
+
+          echo "TCL_SOURCE=$source_method" >> "$GITHUB_ENV"
+          echo "TCL_VERSION=$tcl_version" >> "$GITHUB_ENV"
+          echo "TCL_REF=$tcl_ref" >> "$GITHUB_ENV"
+          echo "TCL_TARBALL_URL=$tcl_tarball_url" >> "$GITHUB_ENV"
+          echo "TK_TARBALL_URL=$tk_tarball_url" >> "$GITHUB_ENV"
+          echo "TCL_TARBALL_SHA256=$tcl_sha" >> "$GITHUB_ENV"
+          echo "TK_TARBALL_SHA256=$tk_sha" >> "$GITHUB_ENV"
+          echo "TCL_SHA_STATUS=$sha_status" >> "$GITHUB_ENV"
+          echo "TCL_COMMIT=$tcl_commit" >> "$GITHUB_ENV"
+          echo "TCL_COMMIT_DATE=$tcl_commit_date" >> "$GITHUB_ENV"
+
+          echo "## Tcl/Tk source" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Field | Value |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| :-- | :-- |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Source method | $source_method |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Tcl/Tk version | $tcl_version |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Tcl ref | $tcl_ref |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| SHA status | $sha_status |" >> "$GITHUB_STEP_SUMMARY"
+          if [ -n "$tcl_commit" ]; then
+            echo "| Tcl commit | $tcl_commit |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Tcl commit date | $tcl_commit_date |" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
       - name: Build project
         run: |
           cd appimage/7
-          make
+          make \
+            TCL_SOURCE="${TCL_SOURCE}" \
+            TCL_VERSION="${TCL_VERSION}" \
+            TCL_REF="${TCL_REF}" \
+            TCL_TARBALL_URL="${TCL_TARBALL_URL}" \
+            TK_TARBALL_URL="${TK_TARBALL_URL}" \
+            TCL_TARBALL_SHA256="${TCL_TARBALL_SHA256}" \
+            TK_TARBALL_SHA256="${TK_TARBALL_SHA256}"
 
           ln -v Magic-x86_64.AppImage "${MAGIC_APPIMAGE_OUTPUT_FILENAME}"
           ls -l *.AppImage
@@ -138,6 +258,18 @@ jobs:
           cat RELEASE-NOTES-CL.txt >> RELEASE-NOTES-GH.txt
 
           # Show in action/artifact output
+          echo "## TCL/TK BUILD INFO" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "- Source: ${TCL_SOURCE}" >> $GITHUB_STEP_SUMMARY
+          echo "- Version: ${TCL_VERSION}" >> $GITHUB_STEP_SUMMARY
+          echo "- Ref: ${TCL_REF}" >> $GITHUB_STEP_SUMMARY
+          echo "- SHA status: ${TCL_SHA_STATUS}" >> $GITHUB_STEP_SUMMARY
+          if [ -n "${TCL_COMMIT}" ]; then
+            echo "- TCL commit: ${TCL_COMMIT}" >> $GITHUB_STEP_SUMMARY
+            echo "- TCL commit date: ${TCL_COMMIT_DATE}" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "" >> $GITHUB_STEP_SUMMARY
+
           echo "## RELEASE NOTES" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           cat RELEASE-NOTES-EL7.txt >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/appimage8.yml b/.github/workflows/appimage8.yml
index 63a1f2ec..ea440227 100644
--- a/.github/workflows/appimage8.yml
+++ b/.github/workflows/appimage8.yml
@@ -3,6 +3,22 @@ on:
     tags:
       - "*"
   workflow_dispatch:
+    inputs:
+      tcl_source:
+        description: 'Tcl/Tk source: tarball or github'
+        type: choice
+        options:
+          - tarball
+          - github
+        default: 'github'
+      tcl_ref:
+        description: 'Tcl/Tk ref for github source (e.g. core-8-6-18); blank auto-resolves latest stable tag in series'
+        type: string
+        default: ''
+      tcl_version_override:
+        description: 'Tarball version override (e.g. 8.6.18 or 9.0.4); blank uses locked default'
+        type: string
+        default: ''
 
 name: CI-appimage8
 
@@ -48,10 +64,114 @@ jobs:
             fi
           fi
 
+      - name: Resolve TCL/TK source
+        id: resolve_tcl
+        env:
+          DEFAULT_TCL_SOURCE: github
+          TCL_LOCKED_VERSION: 8.6.18
+          TCL_TAG_GLOB: core-8-6-*
+          TCL_TAG_REGEX: '^core-8-6-[0-9]+$'
+          TCL_REF_INPUT: ${{ github.event.inputs.tcl_ref || '' }}
+          TCL_SOURCE_INPUT: ${{ github.event.inputs.tcl_source || '' }}
+          TCL_VERSION_OVERRIDE: ${{ github.event.inputs.tcl_version_override || '' }}
+        run: |
+          set -euo pipefail
+
+          known_sha() {
+            case "$1/$2" in
+              tcl/8.6.18) echo "8b9b554f3539b37bea20ee6cef14faa63df1259896e466328f596eca9f0c49a5" ;;
+              tk/8.6.18)  echo "8c1d775126c39124c89752737c32c23636b3cd308d0445977aec58cfbc42c46c" ;;
+              tcl/9.0.4)  echo "8c01bac92a9a8ce271b63d3aa28f09cde2c6762d6719ca671cdc8aee25391234" ;;
+              tk/9.0.4)   echo "ab9bd89fcff2e1248b7a9c097035f817fa0725285028c95686fdb92db65bc148" ;;
+              *)          echo "" ;;
+            esac
+          }
+
+          source_method="${TCL_SOURCE_INPUT:-$DEFAULT_TCL_SOURCE}"
+          tcl_version="${TCL_VERSION_OVERRIDE:-$TCL_LOCKED_VERSION}"
+          tcl_ref="core-${tcl_version//./-}"
+
+          if [ "$source_method" = "github" ]; then
+            if [ -n "$TCL_REF_INPUT" ]; then
+              tcl_ref="$TCL_REF_INPUT"
+              echo "Using workflow_dispatch TCL ref: $tcl_ref"
+            else
+              tcl_ref=$(git ls-remote --tags --refs https://github.com/tcltk/tcl.git "refs/tags/${TCL_TAG_GLOB}"                 | awk '{print $2}' | sed 's#refs/tags/##' | sort -V | tail -1)
+              test -n "$tcl_ref"
+              echo "Auto-resolved latest Tcl ref: $tcl_ref"
+            fi
+
+            if ! git ls-remote --tags --refs https://github.com/tcltk/tk.git "refs/tags/$tcl_ref" | grep -q .; then
+              echo "Missing matching Tk tag for Tcl ref: $tcl_ref" >&2
+              exit 1
+            fi
+
+            if echo "$tcl_ref" | grep -Eq "$TCL_TAG_REGEX"; then
+              tcl_version=$(echo "$tcl_ref" | sed -E 's/^core-([0-9]+)-([0-9]+)-([0-9]+)$/\1.\2.\3/')
+            else
+              echo "Warning: ref $tcl_ref does not match expected stable tag pattern; keeping Tcl version=$tcl_version"
+            fi
+          fi
+
+          tcl_ref_tag="core-${tcl_version//./-}"
+          tcl_tarball_url="https://codeload.github.com/tcltk/tcl/tar.gz/refs/tags/$tcl_ref_tag"
+          tk_tarball_url="https://codeload.github.com/tcltk/tk/tar.gz/refs/tags/$tcl_ref_tag"
+
+          tcl_sha=$(known_sha tcl "$tcl_version")
+          tk_sha=$(known_sha tk "$tcl_version")
+
+          if [ -n "$tcl_sha" ] && [ -n "$tk_sha" ]; then
+            sha_status="verified against known SHA"
+          else
+            sha_status="best-effort — no known SHA (actual SHA is printed during Docker build)"
+          fi
+
+          if [ "$source_method" = "github" ]; then
+            tcl_tmpdir=$(mktemp -d)
+            git -c advice.detachedHead=false clone --depth 1 --branch "$tcl_ref" https://github.com/tcltk/tcl.git "$tcl_tmpdir"
+            tcl_commit=$(git -C "$tcl_tmpdir" rev-parse HEAD)
+            tcl_commit_date=$(git -C "$tcl_tmpdir" log -1 --format=%ci)
+            rm -rf "$tcl_tmpdir"
+          else
+            tcl_commit=""
+            tcl_commit_date=""
+          fi
+
+          echo "TCL_SOURCE=$source_method" >> "$GITHUB_ENV"
+          echo "TCL_VERSION=$tcl_version" >> "$GITHUB_ENV"
+          echo "TCL_REF=$tcl_ref" >> "$GITHUB_ENV"
+          echo "TCL_TARBALL_URL=$tcl_tarball_url" >> "$GITHUB_ENV"
+          echo "TK_TARBALL_URL=$tk_tarball_url" >> "$GITHUB_ENV"
+          echo "TCL_TARBALL_SHA256=$tcl_sha" >> "$GITHUB_ENV"
+          echo "TK_TARBALL_SHA256=$tk_sha" >> "$GITHUB_ENV"
+          echo "TCL_SHA_STATUS=$sha_status" >> "$GITHUB_ENV"
+          echo "TCL_COMMIT=$tcl_commit" >> "$GITHUB_ENV"
+          echo "TCL_COMMIT_DATE=$tcl_commit_date" >> "$GITHUB_ENV"
+
+          echo "## Tcl/Tk source" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Field | Value |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| :-- | :-- |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Source method | $source_method |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Tcl/Tk version | $tcl_version |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Tcl ref | $tcl_ref |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| SHA status | $sha_status |" >> "$GITHUB_STEP_SUMMARY"
+          if [ -n "$tcl_commit" ]; then
+            echo "| Tcl commit | $tcl_commit |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Tcl commit date | $tcl_commit_date |" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
       - name: Build project
         run: |
           cd appimage/8
-          make
+          make \
+            TCL_SOURCE="${TCL_SOURCE}" \
+            TCL_VERSION="${TCL_VERSION}" \
+            TCL_REF="${TCL_REF}" \
+            TCL_TARBALL_URL="${TCL_TARBALL_URL}" \
+            TK_TARBALL_URL="${TK_TARBALL_URL}" \
+            TCL_TARBALL_SHA256="${TCL_TARBALL_SHA256}" \
+            TK_TARBALL_SHA256="${TK_TARBALL_SHA256}"
 
           ln -v Magic-x86_64.AppImage "${MAGIC_APPIMAGE_OUTPUT_FILENAME}"
           ls -l *.AppImage
@@ -138,6 +258,18 @@ jobs:
           cat RELEASE-NOTES-CL.txt >> RELEASE-NOTES-GH.txt
 
           # Show in action/artifact output
+          echo "## TCL/TK BUILD INFO" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "- Source: ${TCL_SOURCE}" >> $GITHUB_STEP_SUMMARY
+          echo "- Version: ${TCL_VERSION}" >> $GITHUB_STEP_SUMMARY
+          echo "- Ref: ${TCL_REF}" >> $GITHUB_STEP_SUMMARY
+          echo "- SHA status: ${TCL_SHA_STATUS}" >> $GITHUB_STEP_SUMMARY
+          if [ -n "${TCL_COMMIT}" ]; then
+            echo "- TCL commit: ${TCL_COMMIT}" >> $GITHUB_STEP_SUMMARY
+            echo "- TCL commit date: ${TCL_COMMIT_DATE}" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "" >> $GITHUB_STEP_SUMMARY
+
           echo "## RELEASE NOTES" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           cat RELEASE-NOTES-EL8.txt >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/appimage9.yml b/.github/workflows/appimage9.yml
index d70b5a7b..01e13030 100644
--- a/.github/workflows/appimage9.yml
+++ b/.github/workflows/appimage9.yml
@@ -3,6 +3,22 @@ on:
     tags:
       - "*"
   workflow_dispatch:
+    inputs:
+      tcl_source:
+        description: 'Tcl/Tk source: tarball or github'
+        type: choice
+        options:
+          - tarball
+          - github
+        default: 'tarball'
+      tcl_ref:
+        description: 'Tcl/Tk ref for github source (e.g. core-8-6-18); blank auto-resolves latest stable tag in series'
+        type: string
+        default: ''
+      tcl_version_override:
+        description: 'Tarball version override (e.g. 8.6.18 or 9.0.4); blank uses locked default'
+        type: string
+        default: ''
 
 name: CI-appimage9
 
@@ -48,10 +64,114 @@ jobs:
             fi
           fi
 
+      - name: Resolve TCL/TK source
+        id: resolve_tcl
+        env:
+          DEFAULT_TCL_SOURCE: tarball
+          TCL_LOCKED_VERSION: 9.0.4
+          TCL_TAG_GLOB: core-9-0-*
+          TCL_TAG_REGEX: '^core-9-0-[0-9]+$'
+          TCL_REF_INPUT: ${{ github.event.inputs.tcl_ref || '' }}
+          TCL_SOURCE_INPUT: ${{ github.event.inputs.tcl_source || '' }}
+          TCL_VERSION_OVERRIDE: ${{ github.event.inputs.tcl_version_override || '' }}
+        run: |
+          set -euo pipefail
+
+          known_sha() {
+            case "$1/$2" in
+              tcl/8.6.18) echo "8b9b554f3539b37bea20ee6cef14faa63df1259896e466328f596eca9f0c49a5" ;;
+              tk/8.6.18)  echo "8c1d775126c39124c89752737c32c23636b3cd308d0445977aec58cfbc42c46c" ;;
+              tcl/9.0.4)  echo "8c01bac92a9a8ce271b63d3aa28f09cde2c6762d6719ca671cdc8aee25391234" ;;
+              tk/9.0.4)   echo "ab9bd89fcff2e1248b7a9c097035f817fa0725285028c95686fdb92db65bc148" ;;
+              *)          echo "" ;;
+            esac
+          }
+
+          source_method="${TCL_SOURCE_INPUT:-$DEFAULT_TCL_SOURCE}"
+          tcl_version="${TCL_VERSION_OVERRIDE:-$TCL_LOCKED_VERSION}"
+          tcl_ref="core-${tcl_version//./-}"
+
+          if [ "$source_method" = "github" ]; then
+            if [ -n "$TCL_REF_INPUT" ]; then
+              tcl_ref="$TCL_REF_INPUT"
+              echo "Using workflow_dispatch TCL ref: $tcl_ref"
+            else
+              tcl_ref=$(git ls-remote --tags --refs https://github.com/tcltk/tcl.git "refs/tags/${TCL_TAG_GLOB}"                 | awk '{print $2}' | sed 's#refs/tags/##' | sort -V | tail -1)
+              test -n "$tcl_ref"
+              echo "Auto-resolved latest Tcl ref: $tcl_ref"
+            fi
+
+            if ! git ls-remote --tags --refs https://github.com/tcltk/tk.git "refs/tags/$tcl_ref" | grep -q .; then
+              echo "Missing matching Tk tag for Tcl ref: $tcl_ref" >&2
+              exit 1
+            fi
+
+            if echo "$tcl_ref" | grep -Eq "$TCL_TAG_REGEX"; then
+              tcl_version=$(echo "$tcl_ref" | sed -E 's/^core-([0-9]+)-([0-9]+)-([0-9]+)$/\1.\2.\3/')
+            else
+              echo "Warning: ref $tcl_ref does not match expected stable tag pattern; keeping Tcl version=$tcl_version"
+            fi
+          fi
+
+          tcl_ref_tag="core-${tcl_version//./-}"
+          tcl_tarball_url="https://codeload.github.com/tcltk/tcl/tar.gz/refs/tags/$tcl_ref_tag"
+          tk_tarball_url="https://codeload.github.com/tcltk/tk/tar.gz/refs/tags/$tcl_ref_tag"
+
+          tcl_sha=$(known_sha tcl "$tcl_version")
+          tk_sha=$(known_sha tk "$tcl_version")
+
+          if [ -n "$tcl_sha" ] && [ -n "$tk_sha" ]; then
+            sha_status="verified against known SHA"
+          else
+            sha_status="best-effort — no known SHA (actual SHA is printed during Docker build)"
+          fi
+
+          if [ "$source_method" = "github" ]; then
+            tcl_tmpdir=$(mktemp -d)
+            git -c advice.detachedHead=false clone --depth 1 --branch "$tcl_ref" https://github.com/tcltk/tcl.git "$tcl_tmpdir"
+            tcl_commit=$(git -C "$tcl_tmpdir" rev-parse HEAD)
+            tcl_commit_date=$(git -C "$tcl_tmpdir" log -1 --format=%ci)
+            rm -rf "$tcl_tmpdir"
+          else
+            tcl_commit=""
+            tcl_commit_date=""
+          fi
+
+          echo "TCL_SOURCE=$source_method" >> "$GITHUB_ENV"
+          echo "TCL_VERSION=$tcl_version" >> "$GITHUB_ENV"
+          echo "TCL_REF=$tcl_ref" >> "$GITHUB_ENV"
+          echo "TCL_TARBALL_URL=$tcl_tarball_url" >> "$GITHUB_ENV"
+          echo "TK_TARBALL_URL=$tk_tarball_url" >> "$GITHUB_ENV"
+          echo "TCL_TARBALL_SHA256=$tcl_sha" >> "$GITHUB_ENV"
+          echo "TK_TARBALL_SHA256=$tk_sha" >> "$GITHUB_ENV"
+          echo "TCL_SHA_STATUS=$sha_status" >> "$GITHUB_ENV"
+          echo "TCL_COMMIT=$tcl_commit" >> "$GITHUB_ENV"
+          echo "TCL_COMMIT_DATE=$tcl_commit_date" >> "$GITHUB_ENV"
+
+          echo "## Tcl/Tk source" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Field | Value |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| :-- | :-- |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Source method | $source_method |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Tcl/Tk version | $tcl_version |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Tcl ref | $tcl_ref |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| SHA status | $sha_status |" >> "$GITHUB_STEP_SUMMARY"
+          if [ -n "$tcl_commit" ]; then
+            echo "| Tcl commit | $tcl_commit |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Tcl commit date | $tcl_commit_date |" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
       - name: Build project
         run: |
           cd appimage/9
-          make
+          make \
+            TCL_SOURCE="${TCL_SOURCE}" \
+            TCL_VERSION="${TCL_VERSION}" \
+            TCL_REF="${TCL_REF}" \
+            TCL_TARBALL_URL="${TCL_TARBALL_URL}" \
+            TK_TARBALL_URL="${TK_TARBALL_URL}" \
+            TCL_TARBALL_SHA256="${TCL_TARBALL_SHA256}" \
+            TK_TARBALL_SHA256="${TK_TARBALL_SHA256}"
 
           ln -v Magic-x86_64.AppImage "${MAGIC_APPIMAGE_OUTPUT_FILENAME}"
           ls -l *.AppImage
@@ -138,6 +258,18 @@ jobs:
           cat RELEASE-NOTES-CL.txt >> RELEASE-NOTES-GH.txt
 
           # Show in action/artifact output
+          echo "## TCL/TK BUILD INFO" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "- Source: ${TCL_SOURCE}" >> $GITHUB_STEP_SUMMARY
+          echo "- Version: ${TCL_VERSION}" >> $GITHUB_STEP_SUMMARY
+          echo "- Ref: ${TCL_REF}" >> $GITHUB_STEP_SUMMARY
+          echo "- SHA status: ${TCL_SHA_STATUS}" >> $GITHUB_STEP_SUMMARY
+          if [ -n "${TCL_COMMIT}" ]; then
+            echo "- TCL commit: ${TCL_COMMIT}" >> $GITHUB_STEP_SUMMARY
+            echo "- TCL commit date: ${TCL_COMMIT_DATE}" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "" >> $GITHUB_STEP_SUMMARY
+
           echo "## RELEASE NOTES" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           cat RELEASE-NOTES-EL9.txt >> $GITHUB_STEP_SUMMARY
diff --git a/appimage/10/Dockerfile b/appimage/10/Dockerfile
index 6eeddbcd..b69db87e 100644
--- a/appimage/10/Dockerfile
+++ b/appimage/10/Dockerfile
@@ -2,6 +2,14 @@ FROM almalinux:10
 
 USER root
 
+ARG TCL_SOURCE=tarball
+ARG TCL_VERSION=9.0.4
+ARG TCL_REF=core-9-0-4
+ARG TCL_TARBALL_URL=https://codeload.github.com/tcltk/tcl/tar.gz/refs/tags/core-9-0-4
+ARG TK_TARBALL_URL=https://codeload.github.com/tcltk/tk/tar.gz/refs/tags/core-9-0-4
+ARG TCL_TARBALL_SHA256=
+ARG TK_TARBALL_SHA256=
+
 # Build Dependencies (and dump version to logging)
 RUN dnf install -y python3 zlib-devel ncurses-devel readline-devel cairo-devel freeglut-devel \
 	mesa-libGLU-devel mesa-libGL-devel libX11-devel libstdc++-devel gcc gcc-c++ make git tcsh \
@@ -13,18 +21,46 @@ RUN dnf install -y python3 zlib-devel ncurses-devel readline-devel cairo-devel f
 
 # Tcl/Tk
 WORKDIR /tcl
-RUN curl -L https://prdownloads.sourceforge.net/tcl/tcl9.0.1-src.tar.gz | tar --strip-components=1 -xzC . \
-    && cd unix \
-    && ./configure --prefix=/prefix \
-    && make \
-    && make install install-libraries install-msgs install-tzdata
+RUN set -eux; \
+    if [ "$TCL_SOURCE" = "github" ]; then \
+      git clone --filter=blob:none https://github.com/tcltk/tcl.git .; \
+      git checkout --detach "$TCL_REF"; \
+    else \
+      curl -fsSL "$TCL_TARBALL_URL" -o /tmp/tcl-src.tar.gz; \
+      actual_tcl_sha=$(sha256sum /tmp/tcl-src.tar.gz | cut -d' ' -f1); \
+      if [ -n "$TCL_TARBALL_SHA256" ]; then \
+        echo "$TCL_TARBALL_SHA256  /tmp/tcl-src.tar.gz" | sha256sum --check -; \
+      else \
+        echo "WARNING: no known SHA for Tcl tarball ($TCL_TARBALL_URL)"; \
+        echo "WARNING: actual Tcl tarball SHA256 is $actual_tcl_sha"; \
+      fi; \
+      tar --strip-components=1 -xzf /tmp/tcl-src.tar.gz -C .; \
+    fi; \
+    cd unix; \
+    ./configure --prefix=/prefix; \
+    make; \
+    make install install-libraries install-msgs install-tzdata
 
 WORKDIR /tk
-RUN curl -L https://prdownloads.sourceforge.net/tcl/tk9.0.1-src.tar.gz | tar --strip-components=1 -xzC . \
-    && cd unix \
-    && ./configure --prefix=/prefix --with-tcl=/prefix/lib \
-    && make \
-    && make install install-libraries
+RUN set -eux; \
+    if [ "$TCL_SOURCE" = "github" ]; then \
+      git clone --filter=blob:none https://github.com/tcltk/tk.git .; \
+      git checkout --detach "$TCL_REF"; \
+    else \
+      curl -fsSL "$TK_TARBALL_URL" -o /tmp/tk-src.tar.gz; \
+      actual_tk_sha=$(sha256sum /tmp/tk-src.tar.gz | cut -d' ' -f1); \
+      if [ -n "$TK_TARBALL_SHA256" ]; then \
+        echo "$TK_TARBALL_SHA256  /tmp/tk-src.tar.gz" | sha256sum --check -; \
+      else \
+        echo "WARNING: no known SHA for Tk tarball ($TK_TARBALL_URL)"; \
+        echo "WARNING: actual Tk tarball SHA256 is $actual_tk_sha"; \
+      fi; \
+      tar --strip-components=1 -xzf /tmp/tk-src.tar.gz -C .; \
+    fi; \
+    cd unix; \
+    ./configure --prefix=/prefix --with-tcl=/prefix/lib; \
+    make; \
+    make install install-libraries
 
 WORKDIR /prefix/bin
 RUN cp ./wish9.0 ./wish
@@ -47,9 +83,9 @@ RUN ./configure \
 RUN echo "### filesystem:" \
     find /prefix -printf "%y/%M/%m %i/%n %l %u/%U %g/%G %s/%b %T+/%T@\t%p\n"; \
     ls -lR /prefix; \
-    find /prefix -type f -perm /111 -exec bash -c "echo \#\#\# {}; ldd -v {}" \; 2>/dev/null; \
+    find /prefix -type f -perm /111 -exec bash -c "echo \\#\\#\\# {}; ldd -v {}" \; 2>/dev/null; \
     for name in libgcc_s libstdc++ libpng liblzma libxml2 libz libcairo libGL libGLU; do \
-      find /lib64 /usr/lib64 -maxdepth 2 -name "*.so" -name "${name}*" -exec bash -c "echo \#\#\# {}; ldd -v {}" \; 2>/dev/null; \
+      find /lib64 /usr/lib64 -maxdepth 2 -name "*.so" -name "${name}*" -exec bash -c "echo \\#\\#\\# {}; ldd -v {}" \; 2>/dev/null; \
     done; \
     echo "###"
 
diff --git a/appimage/10/Makefile b/appimage/10/Makefile
index 05041d54..246e987b 100644
--- a/appimage/10/Makefile
+++ b/appimage/10/Makefile
@@ -11,6 +11,15 @@ VERSION := $(VERSION_NUM)
 # Allow CI to override
 APPIMAGETOOL_DOWNLOAD_URL ?= https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
 
+TCL_SOURCE ?= github
+TCL_VERSION ?= 9.0.4
+TCL_REF ?= core-$(subst .,-,$(TCL_VERSION))
+TCL_TARBALL_URL ?= https://codeload.github.com/tcltk/tcl/tar.gz/refs/tags/core-$(subst .,-,$(TCL_VERSION))
+TK_TARBALL_URL ?= https://codeload.github.com/tcltk/tk/tar.gz/refs/tags/core-$(subst .,-,$(TCL_VERSION))
+TCL_TARBALL_SHA256 ?=
+TK_TARBALL_SHA256 ?=
+TCL_ABI_VERSION := $(shell echo "$(TCL_VERSION)" | cut -d. -f1-2)
+
 all: $(APPIMAGE)
 
 .PHONY: prefix/bin/magic
@@ -19,13 +28,24 @@ prefix/bin/magic: Dockerfile Makefile
 	@echo "VERSION=$(VERSION)"
 	@echo "ARCH=$(ARCH)"
 	@echo "RESOURCES=$(RESOURCES)"
+	@echo "TCL_SOURCE=$(TCL_SOURCE)"
+	@echo "TCL_VERSION=$(TCL_VERSION)"
+	@echo "TCL_REF=$(TCL_REF)"
 	rm -rf prefix
-	docker build -t magic_build -f ./Dockerfile $(MAGIC_SRC_ROOT)
+	docker build -t magic_build -f ./Dockerfile \
+		--build-arg TCL_SOURCE="$(TCL_SOURCE)" \
+		--build-arg TCL_VERSION="$(TCL_VERSION)" \
+		--build-arg TCL_REF="$(TCL_REF)" \
+		--build-arg TCL_TARBALL_URL="$(TCL_TARBALL_URL)" \
+		--build-arg TK_TARBALL_URL="$(TK_TARBALL_URL)" \
+		--build-arg TCL_TARBALL_SHA256="$(TCL_TARBALL_SHA256)" \
+		--build-arg TK_TARBALL_SHA256="$(TK_TARBALL_SHA256)" \
+		$(MAGIC_SRC_ROOT)
 	id=$$(docker create magic_build) ; \
 	docker cp $$id:/prefix ./prefix ; \
 	docker rm -v $$id
-	mkdir -p prefix/lib/tcl9.0.1
-	cp -r prefix/lib/tcl9.0 prefix/lib/tcl9.0.1/library
+	mkdir -p prefix/lib/tcl$(TCL_VERSION)
+	if [ -d "prefix/lib/tcl$(TCL_ABI_VERSION)" ]; then cp -r "prefix/lib/tcl$(TCL_ABI_VERSION)" "prefix/lib/tcl$(TCL_VERSION)/library"; fi
 
 appimagetool:
 	curl -L "$(APPIMAGETOOL_DOWNLOAD_URL)" > ./appimagetool
diff --git a/appimage/7/Dockerfile b/appimage/7/Dockerfile
index c1dccb93..5b71ee19 100644
--- a/appimage/7/Dockerfile
+++ b/appimage/7/Dockerfile
@@ -13,26 +13,63 @@ RUN ls -l /etc/yum.repos.d/ \
     && yum -y update \
     && rm -f /tmp/CentOS-Base.repo.old
 
+ARG TCL_SOURCE=tarball
+ARG TCL_VERSION=8.6.18
+ARG TCL_REF=core-8-6-18
+ARG TCL_TARBALL_URL=https://codeload.github.com/tcltk/tcl/tar.gz/refs/tags/core-8-6-18
+ARG TK_TARBALL_URL=https://codeload.github.com/tcltk/tk/tar.gz/refs/tags/core-8-6-18
+ARG TCL_TARBALL_SHA256=
+ARG TK_TARBALL_SHA256=
+
 # Build Dependencies (and dump version to logging)
-RUN yum install -y cairo-devel freeglut-devel gcc make tcsh \
+RUN yum install -y cairo-devel freeglut-devel gcc make git tcsh \
     && echo "### rpm -qa:" \
     && rpm -qa | sort \
     && echo ""
+#RUN dnf group install -y "Development Tools"
 
 # Tcl/Tk
 WORKDIR /tcl
-RUN curl -L https://prdownloads.sourceforge.net/tcl/tcl8.6.16-src.tar.gz | tar --strip-components=1 -xzC . \
-    && cd unix \
-    && ./configure --prefix=/prefix \
-    && make \
-    && make install
+RUN set -eux; \
+    if [ "$TCL_SOURCE" = "github" ]; then \
+      git clone --filter=blob:none https://github.com/tcltk/tcl.git .; \
+      git checkout --detach "$TCL_REF"; \
+    else \
+      curl -fsSL "$TCL_TARBALL_URL" -o /tmp/tcl-src.tar.gz; \
+      actual_tcl_sha=$(sha256sum /tmp/tcl-src.tar.gz | cut -d' ' -f1); \
+      if [ -n "$TCL_TARBALL_SHA256" ]; then \
+        echo "$TCL_TARBALL_SHA256  /tmp/tcl-src.tar.gz" | sha256sum --check -; \
+      else \
+        echo "WARNING: no known SHA for Tcl tarball ($TCL_TARBALL_URL)"; \
+        echo "WARNING: actual Tcl tarball SHA256 is $actual_tcl_sha"; \
+      fi; \
+      tar --strip-components=1 -xzf /tmp/tcl-src.tar.gz -C .; \
+    fi; \
+    cd unix; \
+    ./configure --prefix=/prefix; \
+    make; \
+    make install
 
 WORKDIR /tk
-RUN curl -L https://prdownloads.sourceforge.net/tcl/tk8.6.16-src.tar.gz | tar --strip-components=1 -xzC . \
-    && cd unix \
-    && ./configure --prefix=/prefix --with-tcl=/prefix/lib \
-    && make \
-    && make install
+RUN set -eux; \
+    if [ "$TCL_SOURCE" = "github" ]; then \
+      git clone --filter=blob:none https://github.com/tcltk/tk.git .; \
+      git checkout --detach "$TCL_REF"; \
+    else \
+      curl -fsSL "$TK_TARBALL_URL" -o /tmp/tk-src.tar.gz; \
+      actual_tk_sha=$(sha256sum /tmp/tk-src.tar.gz | cut -d' ' -f1); \
+      if [ -n "$TK_TARBALL_SHA256" ]; then \
+        echo "$TK_TARBALL_SHA256  /tmp/tk-src.tar.gz" | sha256sum --check -; \
+      else \
+        echo "WARNING: no known SHA for Tk tarball ($TK_TARBALL_URL)"; \
+        echo "WARNING: actual Tk tarball SHA256 is $actual_tk_sha"; \
+      fi; \
+      tar --strip-components=1 -xzf /tmp/tk-src.tar.gz -C .; \
+    fi; \
+    cd unix; \
+    ./configure --prefix=/prefix --with-tcl=/prefix/lib; \
+    make; \
+    make install
 
 WORKDIR /prefix/bin
 RUN cp ./wish8.6 ./wish
@@ -56,9 +93,9 @@ RUN ./configure \
 RUN echo "### filesystem:" \
     find /prefix -printf "%y/%M/%m %i/%n %l %u/%U %g/%G %s/%b %T+/%T@\t%p\n"; \
     ls -lR /prefix; \
-    find /prefix -type f -perm /111 -exec bash -c "echo \#\#\# {}; ldd -v {}" \; 2>/dev/null; \
+    find /prefix -type f -perm /111 -exec bash -c "echo \\#\\#\\# {}; ldd -v {}" \; 2>/dev/null; \
     for name in libgcc_s libstdc++ libpng liblzma libxml2 libz libcairo libGL libGLU; do \
-      find /lib64 /usr/lib64 -maxdepth 2 -name "*.so" -name "${name}*" -exec bash -c "echo \#\#\# {}; ldd -v {}" \; 2>/dev/null; \
+      find /lib64 /usr/lib64 -maxdepth 2 -name "*.so" -name "${name}*" -exec bash -c "echo \\#\\#\\# {}; ldd -v {}" \; 2>/dev/null; \
     done; \
     echo "###"
 
diff --git a/appimage/7/Makefile b/appimage/7/Makefile
index b575062c..16eb92c4 100644
--- a/appimage/7/Makefile
+++ b/appimage/7/Makefile
@@ -11,6 +11,15 @@ VERSION := $(VERSION_NUM)
 # Allow CI to override
 APPIMAGETOOL_DOWNLOAD_URL ?= https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
 
+TCL_SOURCE ?= tarball
+TCL_VERSION ?= 8.6.18
+TCL_REF ?= core-$(subst .,-,$(TCL_VERSION))
+TCL_TARBALL_URL ?= https://codeload.github.com/tcltk/tcl/tar.gz/refs/tags/core-$(subst .,-,$(TCL_VERSION))
+TK_TARBALL_URL ?= https://codeload.github.com/tcltk/tk/tar.gz/refs/tags/core-$(subst .,-,$(TCL_VERSION))
+TCL_TARBALL_SHA256 ?=
+TK_TARBALL_SHA256 ?=
+TCL_ABI_VERSION := $(shell echo "$(TCL_VERSION)" | cut -d. -f1-2)
+
 all: $(APPIMAGE)
 
 .PHONY: prefix/bin/magic
@@ -19,13 +28,24 @@ prefix/bin/magic: Dockerfile Makefile
 	@echo "VERSION=$(VERSION)"
 	@echo "ARCH=$(ARCH)"
 	@echo "RESOURCES=$(RESOURCES)"
+	@echo "TCL_SOURCE=$(TCL_SOURCE)"
+	@echo "TCL_VERSION=$(TCL_VERSION)"
+	@echo "TCL_REF=$(TCL_REF)"
 	rm -rf prefix
-	docker build -t magic_build -f ./Dockerfile $(MAGIC_SRC_ROOT)
+	docker build -t magic_build -f ./Dockerfile \
+		--build-arg TCL_SOURCE="$(TCL_SOURCE)" \
+		--build-arg TCL_VERSION="$(TCL_VERSION)" \
+		--build-arg TCL_REF="$(TCL_REF)" \
+		--build-arg TCL_TARBALL_URL="$(TCL_TARBALL_URL)" \
+		--build-arg TK_TARBALL_URL="$(TK_TARBALL_URL)" \
+		--build-arg TCL_TARBALL_SHA256="$(TCL_TARBALL_SHA256)" \
+		--build-arg TK_TARBALL_SHA256="$(TK_TARBALL_SHA256)" \
+		$(MAGIC_SRC_ROOT)
 	id=$$(docker create magic_build) ; \
 	docker cp $$id:/prefix ./prefix ; \
 	docker rm -v $$id
-	mkdir -p prefix/lib/tcl8.6.16
-	cp -r prefix/lib/tcl8.6 prefix/lib/tcl8.6.16/library
+	mkdir -p prefix/lib/tcl$(TCL_VERSION)
+	if [ -d "prefix/lib/tcl$(TCL_ABI_VERSION)" ]; then cp -r "prefix/lib/tcl$(TCL_ABI_VERSION)" "prefix/lib/tcl$(TCL_VERSION)/library"; fi
 
 appimagetool:
 	curl -L "$(APPIMAGETOOL_DOWNLOAD_URL)" > ./appimagetool
diff --git a/appimage/8/Dockerfile b/appimage/8/Dockerfile
index 339f2e1d..cf286bfd 100644
--- a/appimage/8/Dockerfile
+++ b/appimage/8/Dockerfile
@@ -2,6 +2,14 @@ FROM almalinux:8
 
 USER root
 
+ARG TCL_SOURCE=tarball
+ARG TCL_VERSION=8.6.18
+ARG TCL_REF=core-8-6-18
+ARG TCL_TARBALL_URL=https://codeload.github.com/tcltk/tcl/tar.gz/refs/tags/core-8-6-18
+ARG TK_TARBALL_URL=https://codeload.github.com/tcltk/tk/tar.gz/refs/tags/core-8-6-18
+ARG TCL_TARBALL_SHA256=
+ARG TK_TARBALL_SHA256=
+
 # Build Dependencies (and dump version to logging)
 RUN dnf install -y python311 zlib-devel ncurses-devel readline-devel cairo-devel freeglut-devel \
 	mesa-libGLU-devel mesa-libGL-devel libX11-devel libstdc++-devel gcc gcc-c++ make git tcsh \
@@ -12,18 +20,46 @@ RUN dnf install -y python311 zlib-devel ncurses-devel readline-devel cairo-devel
 
 # Tcl/Tk
 WORKDIR /tcl
-RUN curl -L https://prdownloads.sourceforge.net/tcl/tcl8.6.16-src.tar.gz | tar --strip-components=1 -xzC . \
-    && cd unix \
-    && ./configure --prefix=/prefix \
-    && make \
-    && make install
+RUN set -eux; \
+    if [ "$TCL_SOURCE" = "github" ]; then \
+      git clone --filter=blob:none https://github.com/tcltk/tcl.git .; \
+      git checkout --detach "$TCL_REF"; \
+    else \
+      curl -fsSL "$TCL_TARBALL_URL" -o /tmp/tcl-src.tar.gz; \
+      actual_tcl_sha=$(sha256sum /tmp/tcl-src.tar.gz | cut -d' ' -f1); \
+      if [ -n "$TCL_TARBALL_SHA256" ]; then \
+        echo "$TCL_TARBALL_SHA256  /tmp/tcl-src.tar.gz" | sha256sum --check -; \
+      else \
+        echo "WARNING: no known SHA for Tcl tarball ($TCL_TARBALL_URL)"; \
+        echo "WARNING: actual Tcl tarball SHA256 is $actual_tcl_sha"; \
+      fi; \
+      tar --strip-components=1 -xzf /tmp/tcl-src.tar.gz -C .; \
+    fi; \
+    cd unix; \
+    ./configure --prefix=/prefix; \
+    make; \
+    make install
 
 WORKDIR /tk
-RUN curl -L https://prdownloads.sourceforge.net/tcl/tk8.6.16-src.tar.gz | tar --strip-components=1 -xzC . \
-    && cd unix \
-    && ./configure --prefix=/prefix --with-tcl=/prefix/lib \
-    && make \
-    && make install
+RUN set -eux; \
+    if [ "$TCL_SOURCE" = "github" ]; then \
+      git clone --filter=blob:none https://github.com/tcltk/tk.git .; \
+      git checkout --detach "$TCL_REF"; \
+    else \
+      curl -fsSL "$TK_TARBALL_URL" -o /tmp/tk-src.tar.gz; \
+      actual_tk_sha=$(sha256sum /tmp/tk-src.tar.gz | cut -d' ' -f1); \
+      if [ -n "$TK_TARBALL_SHA256" ]; then \
+        echo "$TK_TARBALL_SHA256  /tmp/tk-src.tar.gz" | sha256sum --check -; \
+      else \
+        echo "WARNING: no known SHA for Tk tarball ($TK_TARBALL_URL)"; \
+        echo "WARNING: actual Tk tarball SHA256 is $actual_tk_sha"; \
+      fi; \
+      tar --strip-components=1 -xzf /tmp/tk-src.tar.gz -C .; \
+    fi; \
+    cd unix; \
+    ./configure --prefix=/prefix --with-tcl=/prefix/lib; \
+    make; \
+    make install
 
 WORKDIR /prefix/bin
 RUN cp ./wish8.6 ./wish
@@ -46,9 +82,9 @@ RUN ./configure \
 RUN echo "### filesystem:" \
     find /prefix -printf "%y/%M/%m %i/%n %l %u/%U %g/%G %s/%b %T+/%T@\t%p\n"; \
     ls -lR /prefix; \
-    find /prefix -type f -perm /111 -exec bash -c "echo \#\#\# {}; ldd -v {}" \; 2>/dev/null; \
+    find /prefix -type f -perm /111 -exec bash -c "echo \\#\\#\\# {}; ldd -v {}" \; 2>/dev/null; \
     for name in libgcc_s libstdc++ libpng liblzma libxml2 libz libcairo libGL libGLU; do \
-      find /lib64 /usr/lib64 -maxdepth 2 -name "*.so" -name "${name}*" -exec bash -c "echo \#\#\# {}; ldd -v {}" \; 2>/dev/null; \
+      find /lib64 /usr/lib64 -maxdepth 2 -name "*.so" -name "${name}*" -exec bash -c "echo \\#\\#\\# {}; ldd -v {}" \; 2>/dev/null; \
     done; \
     echo "###"
 
diff --git a/appimage/8/Makefile b/appimage/8/Makefile
index b575062c..b9a0c994 100644
--- a/appimage/8/Makefile
+++ b/appimage/8/Makefile
@@ -11,6 +11,15 @@ VERSION := $(VERSION_NUM)
 # Allow CI to override
 APPIMAGETOOL_DOWNLOAD_URL ?= https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
 
+TCL_SOURCE ?= github
+TCL_VERSION ?= 8.6.18
+TCL_REF ?= core-$(subst .,-,$(TCL_VERSION))
+TCL_TARBALL_URL ?= https://codeload.github.com/tcltk/tcl/tar.gz/refs/tags/core-$(subst .,-,$(TCL_VERSION))
+TK_TARBALL_URL ?= https://codeload.github.com/tcltk/tk/tar.gz/refs/tags/core-$(subst .,-,$(TCL_VERSION))
+TCL_TARBALL_SHA256 ?=
+TK_TARBALL_SHA256 ?=
+TCL_ABI_VERSION := $(shell echo "$(TCL_VERSION)" | cut -d. -f1-2)
+
 all: $(APPIMAGE)
 
 .PHONY: prefix/bin/magic
@@ -19,13 +28,24 @@ prefix/bin/magic: Dockerfile Makefile
 	@echo "VERSION=$(VERSION)"
 	@echo "ARCH=$(ARCH)"
 	@echo "RESOURCES=$(RESOURCES)"
+	@echo "TCL_SOURCE=$(TCL_SOURCE)"
+	@echo "TCL_VERSION=$(TCL_VERSION)"
+	@echo "TCL_REF=$(TCL_REF)"
 	rm -rf prefix
-	docker build -t magic_build -f ./Dockerfile $(MAGIC_SRC_ROOT)
+	docker build -t magic_build -f ./Dockerfile \
+		--build-arg TCL_SOURCE="$(TCL_SOURCE)" \
+		--build-arg TCL_VERSION="$(TCL_VERSION)" \
+		--build-arg TCL_REF="$(TCL_REF)" \
+		--build-arg TCL_TARBALL_URL="$(TCL_TARBALL_URL)" \
+		--build-arg TK_TARBALL_URL="$(TK_TARBALL_URL)" \
+		--build-arg TCL_TARBALL_SHA256="$(TCL_TARBALL_SHA256)" \
+		--build-arg TK_TARBALL_SHA256="$(TK_TARBALL_SHA256)" \
+		$(MAGIC_SRC_ROOT)
 	id=$$(docker create magic_build) ; \
 	docker cp $$id:/prefix ./prefix ; \
 	docker rm -v $$id
-	mkdir -p prefix/lib/tcl8.6.16
-	cp -r prefix/lib/tcl8.6 prefix/lib/tcl8.6.16/library
+	mkdir -p prefix/lib/tcl$(TCL_VERSION)
+	if [ -d "prefix/lib/tcl$(TCL_ABI_VERSION)" ]; then cp -r "prefix/lib/tcl$(TCL_ABI_VERSION)" "prefix/lib/tcl$(TCL_VERSION)/library"; fi
 
 appimagetool:
 	curl -L "$(APPIMAGETOOL_DOWNLOAD_URL)" > ./appimagetool
diff --git a/appimage/9/Dockerfile b/appimage/9/Dockerfile
index 95b5571e..527e2bed 100644
--- a/appimage/9/Dockerfile
+++ b/appimage/9/Dockerfile
@@ -2,6 +2,14 @@ FROM almalinux:9
 
 USER root
 
+ARG TCL_SOURCE=tarball
+ARG TCL_VERSION=9.0.4
+ARG TCL_REF=core-9-0-4
+ARG TCL_TARBALL_URL=https://codeload.github.com/tcltk/tcl/tar.gz/refs/tags/core-9-0-4
+ARG TK_TARBALL_URL=https://codeload.github.com/tcltk/tk/tar.gz/refs/tags/core-9-0-4
+ARG TCL_TARBALL_SHA256=
+ARG TK_TARBALL_SHA256=
+
 # Build Dependencies (and dump version to logging)
 RUN dnf install -y python311 zlib-devel ncurses-devel readline-devel cairo-devel freeglut-devel \
 	mesa-libGLU-devel mesa-libGL-devel libX11-devel libstdc++-devel gcc gcc-c++ make git tcsh \
@@ -13,18 +21,46 @@ RUN dnf install -y python311 zlib-devel ncurses-devel readline-devel cairo-devel
 
 # Tcl/Tk
 WORKDIR /tcl
-RUN curl -L https://prdownloads.sourceforge.net/tcl/tcl9.0.1-src.tar.gz | tar --strip-components=1 -xzC . \
-    && cd unix \
-    && ./configure --prefix=/prefix \
-    && make \
-    && make install install-libraries install-msgs install-tzdata
+RUN set -eux; \
+    if [ "$TCL_SOURCE" = "github" ]; then \
+      git clone --filter=blob:none https://github.com/tcltk/tcl.git .; \
+      git checkout --detach "$TCL_REF"; \
+    else \
+      curl -fsSL "$TCL_TARBALL_URL" -o /tmp/tcl-src.tar.gz; \
+      actual_tcl_sha=$(sha256sum /tmp/tcl-src.tar.gz | cut -d' ' -f1); \
+      if [ -n "$TCL_TARBALL_SHA256" ]; then \
+        echo "$TCL_TARBALL_SHA256  /tmp/tcl-src.tar.gz" | sha256sum --check -; \
+      else \
+        echo "WARNING: no known SHA for Tcl tarball ($TCL_TARBALL_URL)"; \
+        echo "WARNING: actual Tcl tarball SHA256 is $actual_tcl_sha"; \
+      fi; \
+      tar --strip-components=1 -xzf /tmp/tcl-src.tar.gz -C .; \
+    fi; \
+    cd unix; \
+    ./configure --prefix=/prefix; \
+    make; \
+    make install install-libraries install-msgs install-tzdata
 
 WORKDIR /tk
-RUN curl -L https://prdownloads.sourceforge.net/tcl/tk9.0.1-src.tar.gz | tar --strip-components=1 -xzC . \
-    && cd unix \
-    && ./configure --prefix=/prefix --with-tcl=/prefix/lib \
-    && make \
-    && make install install-libraries
+RUN set -eux; \
+    if [ "$TCL_SOURCE" = "github" ]; then \
+      git clone --filter=blob:none https://github.com/tcltk/tk.git .; \
+      git checkout --detach "$TCL_REF"; \
+    else \
+      curl -fsSL "$TK_TARBALL_URL" -o /tmp/tk-src.tar.gz; \
+      actual_tk_sha=$(sha256sum /tmp/tk-src.tar.gz | cut -d' ' -f1); \
+      if [ -n "$TK_TARBALL_SHA256" ]; then \
+        echo "$TK_TARBALL_SHA256  /tmp/tk-src.tar.gz" | sha256sum --check -; \
+      else \
+        echo "WARNING: no known SHA for Tk tarball ($TK_TARBALL_URL)"; \
+        echo "WARNING: actual Tk tarball SHA256 is $actual_tk_sha"; \
+      fi; \
+      tar --strip-components=1 -xzf /tmp/tk-src.tar.gz -C .; \
+    fi; \
+    cd unix; \
+    ./configure --prefix=/prefix --with-tcl=/prefix/lib; \
+    make; \
+    make install install-libraries
 
 WORKDIR /prefix/bin
 RUN cp ./wish9.0 ./wish
@@ -47,9 +83,9 @@ RUN ./configure \
 RUN echo "### filesystem:" \
     find /prefix -printf "%y/%M/%m %i/%n %l %u/%U %g/%G %s/%b %T+/%T@\t%p\n"; \
     ls -lR /prefix; \
-    find /prefix -type f -perm /111 -exec bash -c "echo \#\#\# {}; ldd -v {}" \; 2>/dev/null; \
+    find /prefix -type f -perm /111 -exec bash -c "echo \\#\\#\\# {}; ldd -v {}" \; 2>/dev/null; \
     for name in libgcc_s libstdc++ libpng liblzma libxml2 libz libcairo libGL libGLU; do \
-      find /lib64 /usr/lib64 -maxdepth 2 -name "*.so" -name "${name}*" -exec bash -c "echo \#\#\# {}; ldd -v {}" \; 2>/dev/null; \
+      find /lib64 /usr/lib64 -maxdepth 2 -name "*.so" -name "${name}*" -exec bash -c "echo \\#\\#\\# {}; ldd -v {}" \; 2>/dev/null; \
     done; \
     echo "###"
 
diff --git a/appimage/9/Makefile b/appimage/9/Makefile
index 05041d54..22bd9c9b 100644
--- a/appimage/9/Makefile
+++ b/appimage/9/Makefile
@@ -11,6 +11,15 @@ VERSION := $(VERSION_NUM)
 # Allow CI to override
 APPIMAGETOOL_DOWNLOAD_URL ?= https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
 
+TCL_SOURCE ?= tarball
+TCL_VERSION ?= 9.0.4
+TCL_REF ?= core-$(subst .,-,$(TCL_VERSION))
+TCL_TARBALL_URL ?= https://codeload.github.com/tcltk/tcl/tar.gz/refs/tags/core-$(subst .,-,$(TCL_VERSION))
+TK_TARBALL_URL ?= https://codeload.github.com/tcltk/tk/tar.gz/refs/tags/core-$(subst .,-,$(TCL_VERSION))
+TCL_TARBALL_SHA256 ?=
+TK_TARBALL_SHA256 ?=
+TCL_ABI_VERSION := $(shell echo "$(TCL_VERSION)" | cut -d. -f1-2)
+
 all: $(APPIMAGE)
 
 .PHONY: prefix/bin/magic
@@ -19,13 +28,24 @@ prefix/bin/magic: Dockerfile Makefile
 	@echo "VERSION=$(VERSION)"
 	@echo "ARCH=$(ARCH)"
 	@echo "RESOURCES=$(RESOURCES)"
+	@echo "TCL_SOURCE=$(TCL_SOURCE)"
+	@echo "TCL_VERSION=$(TCL_VERSION)"
+	@echo "TCL_REF=$(TCL_REF)"
 	rm -rf prefix
-	docker build -t magic_build -f ./Dockerfile $(MAGIC_SRC_ROOT)
+	docker build -t magic_build -f ./Dockerfile \
+		--build-arg TCL_SOURCE="$(TCL_SOURCE)" \
+		--build-arg TCL_VERSION="$(TCL_VERSION)" \
+		--build-arg TCL_REF="$(TCL_REF)" \
+		--build-arg TCL_TARBALL_URL="$(TCL_TARBALL_URL)" \
+		--build-arg TK_TARBALL_URL="$(TK_TARBALL_URL)" \
+		--build-arg TCL_TARBALL_SHA256="$(TCL_TARBALL_SHA256)" \
+		--build-arg TK_TARBALL_SHA256="$(TK_TARBALL_SHA256)" \
+		$(MAGIC_SRC_ROOT)
 	id=$$(docker create magic_build) ; \
 	docker cp $$id:/prefix ./prefix ; \
 	docker rm -v $$id
-	mkdir -p prefix/lib/tcl9.0.1
-	cp -r prefix/lib/tcl9.0 prefix/lib/tcl9.0.1/library
+	mkdir -p prefix/lib/tcl$(TCL_VERSION)
+	if [ -d "prefix/lib/tcl$(TCL_ABI_VERSION)" ]; then cp -r "prefix/lib/tcl$(TCL_ABI_VERSION)" "prefix/lib/tcl$(TCL_VERSION)/library"; fi
 
 appimagetool:
 	curl -L "$(APPIMAGETOOL_DOWNLOAD_URL)" > ./appimagetool