diff --git a/configure_easybuild b/configure_easybuild
index c67b879cf3..ed3e651a4c 100644
--- a/configure_easybuild
+++ b/configure_easybuild
@@ -32,6 +32,12 @@ if [[ "$EESSI_CPU_FAMILY" == "aarch64" ]]; then
     DEPS_TO_FILTER="${DEPS_TO_FILTER},Yasm"
 fi
 
+# Version 23.06 of EESSI ships PSM2 in the compat layer, so we can filter this out while retaining support for OFA fabric
+# (longer term this is probably not the right move as PSM2 should be configured with accelerator support, hence the restricted version)
+if [[ "$EESSI_VERSION" == "2023.06" ]]; then
+    DEPS_TO_FILTER="${DEPS_TO_FILTER},PSM2"
+fi
+
 export EASYBUILD_FILTER_DEPS=$DEPS_TO_FILTER
 
 export EASYBUILD_MODULE_EXTENSIONS=1
diff --git a/easystacks/software.eessi.io/2023.06/rebuilds/20240515-eb-4.9.1-GROMACS-correct-gmxapi-version.yml b/easystacks/software.eessi.io/2023.06/rebuilds/20240515-eb-4.9.1-GROMACS-correct-gmxapi-version.yml
new file mode 100644
index 0000000000..eacfad7079
--- /dev/null
+++ b/easystacks/software.eessi.io/2023.06/rebuilds/20240515-eb-4.9.1-GROMACS-correct-gmxapi-version.yml
@@ -0,0 +1,18 @@
+# 2024.05.15
+# Originally shipped version forgot to bump the gmxapi version and source
+# tarball, it was still using an older version from the 2023.3 tarball. Looking
+# at https://gitlab.com/gromacs/gromacs/-/blob/v2024.1/python_packaging/gmxapi/src/gmxapi/version.py?ref_type=tags#L68,
+# the 2024.1 release includes gmxapi 0.5.0.
+#
+# This also introduced a new build dependency on scikit-build-core for GROMACS
+#
+# See https://github.com/easybuilders/easybuild-easyconfigs/pull/20522
+easyconfigs:
+  - scikit-build-core-0.9.3-GCCcore-13.2.0.eb:
+      options:
+        # from-commit: 61d07bff09afe63cfe1ae35dc58a0c8be01eed62
+        from-pr: 20526
+  - GROMACS-2024.1-foss-2023b.eb:
+      options:
+        # from-commit: a0a467a88506c765a93a96b20d7a8fcb01d46b24
+        from-pr: 20522
diff --git a/eessi_container.sh b/eessi_container.sh
index 7d00d1400c..8430a44d2c 100755
--- a/eessi_container.sh
+++ b/eessi_container.sh
@@ -594,11 +594,47 @@ declare -a EESSI_FUSE_MOUNTS=()
 # always mount cvmfs-config repo (to get access to software.eessi.io)
 EESSI_FUSE_MOUNTS+=("--fusemount" "container:cvmfs2 cvmfs-config.cern.ch /cvmfs/cvmfs-config.cern.ch")
 
+# check if we got some data via --resume and, if so, use the overlayfs
+# example scenario:
+# 1st step: some software is build in rw mode
+# 2nd step: the software is tested in ro mode (same access as when we would use a
+#           repository)
 if [[ "${ACCESS}" == "ro" ]]; then
-  export EESSI_READONLY="container:cvmfs2 ${repo_name} /cvmfs/${repo_name}"
+  if [[ -d ${EESSI_TMPDIR}/overlay-upper ]]; then
+    # the overlay-upper directory is only created in a read-write-session, thus
+    # we are resuming from such a session here (otherwise there shouldn't be such
+    # directory yet as it is only created for read-write-sessions a bit further
+    # below); the overlay-upper directory can only exist because it is part of
+    # the ${RESUME} directory or tarball
+    # to be able to see the contents of the read-write session we have to mount
+    # the fuse-overlayfs (in read-only mode) on top of the CernVM-FS repository
+
+    # make sure the overlay-upper directory exists
+    mkdir -p ${EESSI_TMPDIR}/overlay-upper
+
+    # make the target CernVM-FS repository available under /cvmfs_ro
+    export EESSI_READONLY="container:cvmfs2 ${repo_name} /cvmfs_ro/${repo_name}"
+
+    EESSI_FUSE_MOUNTS+=("--fusemount" "${EESSI_READONLY}")
+
+    # now, put the overlay-upper read-only on top of the repo and make it under the usual prefix /cvmfs available
+    EESSI_READONLY_OVERLAY="container:fuse-overlayfs"
+    # ${EESSI_TMPDIR} is bind mounted to /tmp, hence ${EESSI_TMPDIR}/overlay-upper becomes available as /tmp/overlay-upper
+    # the left-most lower dir is put on top, with no upperdir=... the whole overlayfs is made available read-only
+    EESSI_READONLY_OVERLAY+=" -o lowerdir=/tmp/overlay-upper:/cvmfs_ro/${repo_name}"
+    EESSI_READONLY_OVERLAY+=" ${EESSI_CVMFS_REPO}"
+    export EESSI_READONLY_OVERLAY
+
+    EESSI_FUSE_MOUNTS+=("--fusemount" "${EESSI_READONLY_OVERLAY}")
+    export EESSI_FUSE_MOUNTS
+  else
+    # no overlay-upper directory means we are in a plain read-only session and
+    # don't need any fuse-overlayfs
+    export EESSI_READONLY="container:cvmfs2 ${repo_name} /cvmfs/${repo_name}"
 
-  EESSI_FUSE_MOUNTS+=("--fusemount" "${EESSI_READONLY}")
-  export EESSI_FUSE_MOUNTS
+    EESSI_FUSE_MOUNTS+=("--fusemount" "${EESSI_READONLY}")
+    export EESSI_FUSE_MOUNTS
+  fi
 fi
 
 if [[ "${ACCESS}" == "rw" ]]; then