diff --git a/Cargo.lock b/Cargo.lock
index f0089412bd5..24b474d0108 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -513,7 +513,7 @@ dependencies = [
  "bitflags 2.11.1",
  "cexpr",
  "clang-sys",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "regex",
@@ -1132,7 +1132,7 @@ version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2264,7 +2264,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2689,7 +2689,7 @@ dependencies = [
 [[package]]
 name = "grovedb"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "axum 0.8.9",
  "bincode",
@@ -2727,7 +2727,7 @@ dependencies = [
 [[package]]
 name = "grovedb-bulk-append-tree"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "bincode",
  "blake3",
@@ -2743,7 +2743,7 @@ dependencies = [
 [[package]]
 name = "grovedb-commitment-tree"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "blake3",
  "grovedb-bulk-append-tree",
@@ -2759,7 +2759,7 @@ dependencies = [
 [[package]]
 name = "grovedb-costs"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "integer-encoding",
  "intmap",
@@ -2769,7 +2769,7 @@ dependencies = [
 [[package]]
 name = "grovedb-dense-fixed-sized-merkle-tree"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "bincode",
  "blake3",
@@ -2782,7 +2782,7 @@ dependencies = [
 [[package]]
 name = "grovedb-element"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "bincode",
  "bincode_derive",
@@ -2797,7 +2797,7 @@ dependencies = [
 [[package]]
 name = "grovedb-epoch-based-storage-flags"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "grovedb-costs",
  "hex",
@@ -2809,7 +2809,7 @@ dependencies = [
 [[package]]
 name = "grovedb-merk"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "bincode",
  "bincode_derive",
@@ -2835,7 +2835,7 @@ dependencies = [
 [[package]]
 name = "grovedb-merkle-mountain-range"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "bincode",
  "blake3",
@@ -2846,7 +2846,7 @@ dependencies = [
 [[package]]
 name = "grovedb-path"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "hex",
 ]
@@ -2854,7 +2854,7 @@ dependencies = [
 [[package]]
 name = "grovedb-query"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "bincode",
  "byteorder",
@@ -2870,7 +2870,7 @@ dependencies = [
 [[package]]
 name = "grovedb-storage"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "blake3",
  "grovedb-costs",
@@ -2889,7 +2889,7 @@ dependencies = [
 [[package]]
 name = "grovedb-version"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "thiserror 2.0.18",
  "versioned-feature-core 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
@@ -2898,7 +2898,7 @@ dependencies = [
 [[package]]
 name = "grovedb-visualize"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "hex",
  "itertools 0.14.0",
@@ -2907,7 +2907,7 @@ dependencies = [
 [[package]]
 name = "grovedbg-types"
 version = "4.0.0"
-source = "git+https://github.com/dashpay/grovedb?rev=5eb7a5380a6e974513343352acfd6b30a8c1f87c#5eb7a5380a6e974513343352acfd6b30a8c1f87c"
+source = "git+https://github.com/dashpay/grovedb?rev=a18f7929460ef9c5d814f61ff84d8805b2a1761b#a18f7929460ef9c5d814f61ff84d8805b2a1761b"
 dependencies = [
  "serde",
  "serde_with 3.20.0",
@@ -3301,7 +3301,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -3552,7 +3552,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5112,7 +5112,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "343d3bd7056eda839b03204e68deff7d1b13aba7af2b2fd16890697274262ee7"
 dependencies = [
  "heck 0.4.1",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "log",
  "multimap",
  "petgraph",
@@ -5133,7 +5133,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -5146,7 +5146,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -5276,7 +5276,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash 2.1.2",
  "rustls",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -5314,9 +5314,9 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6042,7 +6042,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6055,7 +6055,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6114,7 +6114,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6954,7 +6954,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8356,7 +8356,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/Dockerfile b/Dockerfile
index ff14ceaf1d3..b31776de9c8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,12 +18,18 @@
 # - ALPINE_VERSION - use different version of Alpine base image; requires also rust:apline...
 #   image to be available
 # - USERNAME, USER_UID, USER_GID - specification of user used to run the binary
-# - SDK_TEST_DATA - set to `true` to create SDK test data on chain genesis.
+# - SDK_TEST_DATA - set to `true` to create SDK test data on chain genesis
+#   (base fixtures: addresses, group token queries, token direct prices).
 #   For local devnet workflows use `yarn dashmate config set
 #   platform.drive.abci.docker.build.buildArgs.SDK_TEST_DATA true` (the
 #   `yarn setup` script does this automatically for the `local` config) —
 #   do NOT pass it as a shell env. The value flows through dashmate ->
 #   docker-compose `build.args:` -> this ARG.
+# - SHIELDED_TEST_DATA - set to `true` to ALSO seed the shielded pool at
+#   genesis and bake a snapshot file into the runtime image (the
+#   1M-note stress-test path). Implies SDK_TEST_DATA. Off by default —
+#   most devnet setups only need the base SDK fixtures, not the shielded
+#   pool, and seeding shielded notes is expensive at image-build time.
 #
 # # sccache cache backends
 #
@@ -426,12 +432,21 @@ RUN --mount=type=secret,id=AWS \
 # This will prebuild majority of dependencies
 FROM deps AS build-drive-abci
 
-# SDK_TEST_DATA is forwarded by dashmate from each `local_N` config's
-# `platform.drive.abci.docker.build.buildArgs.SDK_TEST_DATA` field (set by
-# `scripts/setup_local_network.sh` after `dashmate setup local`, as part of
-# `yarn setup`). Do NOT set this via shell env — single source of truth is the
-# dashmate config.
+# SDK_TEST_DATA / SHIELDED_TEST_DATA are forwarded by dashmate from each
+# `local_N` config's `platform.drive.abci.docker.build.buildArgs.*` fields
+# (set by `scripts/setup_local_network.sh` after `dashmate setup local`, as
+# part of `yarn setup`). Do NOT set them via shell env — single source of
+# truth is the dashmate config.
+#
+# SHIELDED_TEST_DATA=true ⇒ implies SDK_TEST_DATA=true (the shielded seeder
+# runs inside `create_sdk_test_data`); installs the SDK-test-data cargo
+# profile (sets `--cfg create_sdk_test_data` for the outer SDK-fixture gate)
+# AND passes `--features=shielded_test_data` to cargo. The drive-abci
+# `shielded_test_data` feature compiles in the shielded seeder + bake/apply
+# code and forwards through `drive/shielded_test_data` →
+# `grovedb/unsafe-dump-load` to unlock the underlying grovedb primitives.
 ARG SDK_TEST_DATA
+ARG SHIELDED_TEST_DATA
 ARG ADDITIONAL_FEATURES=""
 
 SHELL ["/bin/bash", "-o", "pipefail","-e", "-x", "-c"]
@@ -456,12 +471,19 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM
     if  [[ "${CARGO_BUILD_PROFILE}" == "release" ]] ; then \
     mv .cargo/config-release.toml .cargo/config.toml; \
     fi && \
+    FEATURES_LIST=""; \
     if [[ -n "${ADDITIONAL_FEATURES_TRIMMED}" ]]; then \
-    export FEATURES_FLAG="--features=${ADDITIONAL_FEATURES_TRIMMED}"; \
+    FEATURES_LIST="${ADDITIONAL_FEATURES_TRIMMED}"; \
     fi && \
-    if [ "${SDK_TEST_DATA}" == "true" ]; then \
+    if [ "${SHIELDED_TEST_DATA}" == "true" ] || [ "${SDK_TEST_DATA}" == "true" ]; then \
     mv .cargo/config-test-sdk-data.toml .cargo/config.toml; \
     fi && \
+    if [ "${SHIELDED_TEST_DATA}" == "true" ]; then \
+    FEATURES_LIST="${FEATURES_LIST:+${FEATURES_LIST},}shielded_test_data"; \
+    fi && \
+    if [[ -n "${FEATURES_LIST}" ]]; then \
+    export FEATURES_FLAG="--features=${FEATURES_LIST}"; \
+    fi && \
     cargo chef cook \
     --recipe-path recipe.json \
     --profile "$CARGO_BUILD_PROFILE" \
@@ -541,12 +563,19 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM
     else \
     export OUT_DIRECTORY=debug; \
     fi && \
+    FEATURES_LIST=""; \
     if [[ -n "${ADDITIONAL_FEATURES_TRIMMED}" ]]; then \
-    export FEATURES_FLAG="--features=${ADDITIONAL_FEATURES_TRIMMED}"; \
+    FEATURES_LIST="${ADDITIONAL_FEATURES_TRIMMED}"; \
     fi && \
-    if [ "${SDK_TEST_DATA}" == "true" ]; then \
+    if [ "${SHIELDED_TEST_DATA}" == "true" ] || [ "${SDK_TEST_DATA}" == "true" ]; then \
     mv .cargo/config-test-sdk-data.toml .cargo/config.toml; \
     fi && \
+    if [ "${SHIELDED_TEST_DATA}" == "true" ]; then \
+    FEATURES_LIST="${FEATURES_LIST:+${FEATURES_LIST},}shielded_test_data"; \
+    fi && \
+    if [[ -n "${FEATURES_LIST}" ]]; then \
+    export FEATURES_FLAG="--features=${FEATURES_LIST}"; \
+    fi && \
     # Workaround: as we cache dapi-grpc, its build.rs is not rerun, so we need to touch it
     echo "// $(date) " >> /platform/packages/dapi-grpc/build.rs && \
     cargo build \
@@ -568,12 +597,16 @@ RUN --mount=type=cache,sharing=shared,id=cargo_registry_index,target=${CARGO_HOM
 # image COPYs that file in and sets `DRIVE_SHIELDED_SNAPSHOT` so the
 # InitChain hook applies it instead of running the runtime seeder.
 #
-# Skipped (file replaced with a sentinel) when SDK_TEST_DATA != "true", so
-# production / non-SDK builds don't carry test data.
+# Skipped (file replaced with a sentinel) when SHIELDED_TEST_DATA != "true",
+# so SDK-only builds (and production) don't carry the shielded fixture.
+# The drive-abci binary itself only contains the `snapshot-bake` subcommand
+# when built with `--cfg create_shielded_test_data` (selected by the
+# SHIELDED_TEST_DATA build arg in the build stage), so invoking it on an
+# SDK-only binary would fail with "unknown subcommand" anyway.
 #
 FROM build-drive-abci AS bake-shielded-snapshot
 
-ARG SDK_TEST_DATA
+ARG SHIELDED_TEST_DATA
 
 # libgcc + libstdc++ for the dynamically-linked drive-abci binary (build
 # stage's alpine image normally has them; explicit `apk add` is a no-op if
@@ -582,11 +615,11 @@ RUN apk add --no-cache libgcc libstdc++
 
 RUN set -ex; \
     mkdir -p /artifacts; \
-    if [ "${SDK_TEST_DATA}" = "true" ]; then \
+    if [ "${SHIELDED_TEST_DATA}" = "true" ]; then \
         /artifacts/drive-abci snapshot-bake --out /artifacts/shielded-pool.snap ; \
         ls -la /artifacts/shielded-pool.snap ; \
     else \
-        echo "SDK_TEST_DATA != true; skipping shielded-pool snapshot bake" ; \
+        echo "SHIELDED_TEST_DATA != true; skipping shielded-pool snapshot bake" ; \
         : > /artifacts/.no-shielded-snapshot ; \
     fi
 
@@ -708,13 +741,13 @@ COPY --from=bake-shielded-snapshot /artifacts/ /opt/dashmate/snapshots/
 COPY packages/rs-drive-abci/.env.mainnet /var/lib/dash/rs-drive-abci/.env
 
 # Only point InitChain's apply-side at the snapshot when the bake stage
-# actually produced one (SDK_TEST_DATA=true). On the SDK_TEST_DATA=false
-# branch the bake stage leaves only a `.no-shielded-snapshot` sentinel, so
-# exporting DRIVE_SHIELDED_SNAPSHOT unconditionally would make
-# create_data_for_shielded_pool try to apply a missing file and fail
-# instead of falling back to the runtime seeder. We gate on the real file's
-# existence (writing the var into the binary's .env, which is loaded via
-# dotenvy and left unset otherwise so the seeder fallback runs).
+# actually produced one (SHIELDED_TEST_DATA=true). Otherwise the bake stage
+# leaves only a `.no-shielded-snapshot` sentinel, so exporting
+# DRIVE_SHIELDED_SNAPSHOT unconditionally would make
+# create_data_for_shielded_pool try to apply a missing file and fail instead
+# of falling back to the runtime seeder. We gate on the real file's existence
+# (writing the var into the binary's .env, which is loaded via dotenvy and
+# left unset otherwise so the seeder fallback runs).
 RUN if [ -f /opt/dashmate/snapshots/shielded-pool.snap ]; then \
         echo "DRIVE_SHIELDED_SNAPSHOT=/opt/dashmate/snapshots/shielded-pool.snap" \
             >> /var/lib/dash/rs-drive-abci/.env ; \
diff --git a/packages/rs-dpp/Cargo.toml b/packages/rs-dpp/Cargo.toml
index 8bcc4360d75..6bfb4536a9e 100644
--- a/packages/rs-dpp/Cargo.toml
+++ b/packages/rs-dpp/Cargo.toml
@@ -71,7 +71,7 @@ strum = { version = "0.26", features = ["derive"] }
 json-schema-compatibility-validator = { path = '../rs-json-schema-compatibility-validator', optional = true }
 once_cell = "1.19.0"
 tracing = { version = "0.1.41" }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", optional = true }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", optional = true }
 
 [dev-dependencies]
 tokio = { version = "1.40", features = ["full"] }
diff --git a/packages/rs-drive-abci/Cargo.toml b/packages/rs-drive-abci/Cargo.toml
index 633d3d2db7e..7059bba18e0 100644
--- a/packages/rs-drive-abci/Cargo.toml
+++ b/packages/rs-drive-abci/Cargo.toml
@@ -82,7 +82,7 @@ derive_more = { version = "1.0", features = ["from", "deref", "deref_mut"] }
 async-trait = "0.1.77"
 console-subscriber = { version = "0.4", optional = true }
 bls-signatures = { git = "https://github.com/dashpay/bls-signatures", rev = "0842b17583888e8f46c252a4ee84cdfd58e0546f", optional = true }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
 nonempty = "0.11"
 # Shielded-pool snapshot needs raw RocksDB SstFileWriter + ingest_external_file_cf
 # bindings, and blake3 for the snapshot-file checksum.
@@ -107,9 +107,9 @@ dpp = { path = "../rs-dpp", default-features = false, features = [
 drive = { path = "../rs-drive", features = ["fixtures-and-mocks"] }
 drive-proof-verifier = { path = "../rs-drive-proof-verifier" }
 strategy-tests = { path = "../strategy-tests" }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", features = ["client"] }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", features = ["client"] }
 assert_matches = "1.5.0"
-drive-abci = { path = ".", features = ["testing-config", "mocks"] }
+drive-abci = { path = ".", features = ["testing-config", "mocks", "shielded_test_data"] }
 bls-signatures = { git = "https://github.com/dashpay/bls-signatures", rev = "0842b17583888e8f46c252a4ee84cdfd58e0546f" }
 mockall = { version = "0.13" }
 dash-platform-macros = { path = "../rs-dash-platform-macros" }
@@ -121,14 +121,22 @@ integer-encoding = { version = "4.0.0" }
 
 # For dump_only_default_and_aux_cfs_under_shielded_subtree_prefix — same
 # subtree-prefix algorithm grovedb uses internally.
-grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
-grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
+grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
+grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
 
 [features]
 default = ["bls-signatures"]
 mocks = ["mockall", "drive/fixtures-and-mocks", "bls-signatures"]
 console = ["console-subscriber", "tokio/tracing"]
 testing-config = []
+# Compiles in the shielded-pool seeder, the `snapshot-bake` subcommand, and
+# the bake/apply API used at devnet InitChain. Pulls `drive/shielded_test_data`
+# (which forwards to `grovedb/unsafe-dump-load`) so the underlying snapshot
+# primitives become available. Dockerfile turns this on when
+# `SHIELDED_TEST_DATA=true`. The snapshot roundtrip test in this crate's own
+# `#[cfg(test)]` module also requires it — the dev-dependency below enables
+# it for `cargo test`.
+shielded_test_data = ["drive/shielded_test_data"]
 grovedbg = ["drive/grovedbg"]
 # `abci-server replay` command
 replay = ["dep:time", "tenderdash-abci/serde"]
diff --git a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/mod.rs b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/mod.rs
index 8fd3d5bc133..f6315d2225f 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/mod.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/mod.rs
@@ -7,6 +7,9 @@ use dpp::version::PlatformVersion;
 use drive::grovedb::TransactionArg;
 
 mod addresses;
+// Shielded-pool seeding (incl. snapshot bake/apply tests) is gated separately
+// from the base SDK fixtures — see the comment in `create_sdk_test_data`.
+#[cfg(any(feature = "shielded_test_data", test))]
 mod shielded;
 mod tokens;
 
@@ -39,6 +42,12 @@ impl<C> Platform<C> {
         self.create_data_for_group_token_queries(block_info, transaction, platform_version)?;
         self.create_data_for_token_direct_prices(block_info, transaction, platform_version)?;
         self.create_data_for_addresses(block_info, transaction, platform_version)?;
+        // Shielded-pool seeding is gated separately so SDK_TEST_DATA-only
+        // builds get the base fixtures (addresses, tokens) without paying the
+        // shielded-seed setup cost or shipping the bake/apply code path. Enable
+        // by building with `--features=shielded_test_data` — the Dockerfile
+        // passes that flag when `SHIELDED_TEST_DATA=true`.
+        #[cfg(feature = "shielded_test_data")]
         self.create_data_for_shielded_pool(block_info, transaction, platform_version)?;
 
         Ok(())
diff --git a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/shielded.rs b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/shielded.rs
index 8f2949e4f8d..bbf9ba84772 100644
--- a/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/shielded.rs
+++ b/packages/rs-drive-abci/src/execution/platform_events/initialization/create_genesis_state/test/shielded.rs
@@ -437,8 +437,7 @@ impl<C> Platform<C> {
 
             // Commit the subtree's data_batch through the transaction —
             // makes all the BulkAppendTree / frontier writes visible to
-            // subsequent reads (including replace_commitment_tree_subtree_root's
-            // own batch).
+            // subsequent reads (including replace_subtree_root's own batch).
             self.drive
                 .grove
                 .raw_storage()
@@ -451,14 +450,17 @@ impl<C> Platform<C> {
                 })?;
 
             // --- Update parent Merk leaf with the new state ---
+            let new_element = drive::grovedb::Element::new_commitment_tree(
+                u64::from(cfg.total_notes),
+                chunk_power,
+                flags,
+            );
             self.drive
                 .grove
-                .replace_commitment_tree_subtree_root(
+                .replace_subtree_root(
                     parent_path,
                     leaf_key,
-                    u64::from(cfg.total_notes),
-                    chunk_power,
-                    flags,
+                    new_element,
                     combined_root,
                     Some(tx),
                     &platform_version.drive.grove_version,
@@ -466,7 +468,7 @@ impl<C> Platform<C> {
                 .value
                 .map_err(|e| {
                     Error::Execution(ExecutionError::CorruptedCodeExecution(Box::leak(
-                        format!("seed: replace_commitment_tree_subtree_root: {e}").into_boxed_str(),
+                        format!("seed: replace_subtree_root: {e}").into_boxed_str(),
                     )))
                 })?;
 
@@ -1038,7 +1040,6 @@ mod platform_tests {
     /// `commit_mmr` to the end) is what makes multi-batch work; this test
     /// pins that contract.
     #[test]
-    #[ignore = "snapshot dump+apply roundtrip; needs the new grovedb branch"]
     fn snapshot_dump_apply_preserves_anchor() {
         let platform_version = PlatformVersion::latest();
 
diff --git a/packages/rs-drive-abci/src/lib.rs b/packages/rs-drive-abci/src/lib.rs
index 756e0176bf5..ac1ac54661b 100644
--- a/packages/rs-drive-abci/src/lib.rs
+++ b/packages/rs-drive-abci/src/lib.rs
@@ -91,11 +91,12 @@ pub mod server;
 /// Shielded-pool genesis snapshot — bake/apply.
 ///
 /// Test-data tooling only: the bake reads a pool seeded by
-/// `create_sdk_test_data` and the apply runs from that same seeder's
+/// `create_data_for_shielded_pool` and the apply runs from that same seeder's
 /// fast-path, so the module has no purpose in a production build. Gated on
-/// `create_sdk_test_data` (its only callers) plus `test` (the genesis
-/// seeder's test module exercises it under `cargo test`).
-#[cfg(any(create_sdk_test_data, test))]
+/// the `shielded_test_data` Cargo feature (which also enables the underlying
+/// grovedb APIs through the dep chain) plus `test`, so the snapshot
+/// roundtrip test exercises it under `cargo test`.
+#[cfg(any(feature = "shielded_test_data", test))]
 pub mod shielded_snapshot;
 /// Verification helpers
 pub mod verify;
diff --git a/packages/rs-drive-abci/src/main.rs b/packages/rs-drive-abci/src/main.rs
index fb84eeefd36..347a21aeca1 100644
--- a/packages/rs-drive-abci/src/main.rs
+++ b/packages/rs-drive-abci/src/main.rs
@@ -78,9 +78,9 @@ enum Commands {
     /// Intended for the Dockerfile bake stage, where the snapshot file is
     /// embedded into the runtime image and consumed at boot via
     /// `DRIVE_SHIELDED_SNAPSHOT=<path>`. Requires the binary to be built
-    /// with `--cfg create_sdk_test_data` so that `create_genesis_state`
-    /// invokes the seeder — the command is compiled out otherwise.
-    #[cfg(create_sdk_test_data)]
+    /// with `--features=shielded_test_data` — the command is compiled out
+    /// otherwise.
+    #[cfg(feature = "shielded_test_data")]
     #[command()]
     SnapshotBake {
         /// Where to write the snapshot file. Parent directory must exist.
@@ -185,8 +185,8 @@ impl Cli {
             Commands::Config => dump_config(&config)?,
             Commands::Status => runtime.block_on(check_status(&config))?,
             Commands::Verify => drive_abci::verify::run(&config, true)?,
-            #[cfg(create_sdk_test_data)]
-            Commands::SnapshotBake { out } => snapshot_bake(&config, &out)?,
+            #[cfg(feature = "shielded_test_data")]
+            Commands::SnapshotBake { out } => snapshot_bake_main::run(&config, &out)?,
             Commands::Version => print_version(),
             #[cfg(feature = "replay")]
             Commands::Replay(args) => {
@@ -205,14 +205,14 @@ fn main() -> Result<(), ExitCode> {
     // skip `load_config` (which would panic on missing GRPC_BIND_ADDRESS etc.)
     // and use a sensible default. Other subcommands (Start / Status / etc.)
     // still need the full config. The command only exists under
-    // `create_sdk_test_data`, so the branch is compiled out otherwise.
-    #[cfg(create_sdk_test_data)]
+    // `feature = "shielded_test_data"`, so the branch is compiled out otherwise.
+    #[cfg(feature = "shielded_test_data")]
     let config = if matches!(cli.command, Commands::SnapshotBake { .. }) {
         drive_abci::config::PlatformConfig::default_local()
     } else {
         load_config(&cli.config)
     };
-    #[cfg(not(create_sdk_test_data))]
+    #[cfg(not(feature = "shielded_test_data"))]
     let config = load_config(&cli.config);
 
     // Start tokio runtime and thread listening for signals.
@@ -346,20 +346,12 @@ fn dump_config(config: &PlatformConfig) -> Result<(), String> {
     Ok(())
 }
 
-/// Stub CoreRPCLike used during `snapshot-bake` — Platform::open_with_client
-/// requires a CoreRPCLike, but create_genesis_state never actually calls any
-/// of its methods (no chain locks, transactions, or quorum lookups happen
-/// during genesis). Every method is `unreachable!()` so a bake that
-/// accidentally tries to talk to Core surfaces as a loud panic.
-///
-/// Only the `snapshot-bake` command uses it, so it is compiled out unless
-/// `create_sdk_test_data` is set (the cfg that command lives behind).
-#[cfg(create_sdk_test_data)]
-struct NoopCoreRPC;
-
-#[cfg(create_sdk_test_data)]
-mod noop_core_rpc_impl {
-    use super::NoopCoreRPC;
+/// Everything that exists only to support the `snapshot-bake` subcommand
+/// (used by the Dockerfile bake stage to pre-build a shielded-pool snapshot
+/// for the runtime image to apply at InitChain). Gated as a whole on the
+/// `shielded_test_data` Cargo feature so production builds carry none of it.
+#[cfg(feature = "shielded_test_data")]
+mod snapshot_bake_main {
     use dpp::dashcore::ephemerealdata::chain_lock::ChainLock;
     use dpp::dashcore::{Block, BlockHash, Header, InstantLock, QuorumHash, Transaction, Txid};
     use dpp::dashcore_rpc::dashcore_rpc_json::{
@@ -369,9 +361,19 @@ mod noop_core_rpc_impl {
     use dpp::dashcore_rpc::json::GetRawTransactionResult;
     use dpp::dashcore_rpc::Error;
     use dpp::prelude::TimestampMillis;
+    use dpp::version::PlatformVersion;
+    use drive_abci::config::PlatformConfig;
+    use drive_abci::platform_types::platform::Platform;
     use drive_abci::rpc::core::CoreRPCLike;
     use serde_json::Value;
 
+    /// Stub CoreRPCLike — Platform::open_with_client requires a CoreRPCLike,
+    /// but create_genesis_state never actually touches Core (no chain locks,
+    /// transactions, or quorum lookups happen during genesis). Every method
+    /// is `unreachable!()` so a bake that accidentally tries to talk to Core
+    /// surfaces as a loud panic.
+    pub(super) struct NoopCoreRPC;
+
     impl CoreRPCLike for NoopCoreRPC {
         fn get_block_hash(&self, _: u32) -> Result<BlockHash, Error> {
             unreachable!()
@@ -450,93 +452,89 @@ mod noop_core_rpc_impl {
             unreachable!()
         }
     }
-}
 
-/// Produce a shielded-pool snapshot at `out_path` from a fresh temporary
-/// GroveDB. Runs the full `create_genesis_state` cycle (which, under
-/// `cfg(create_sdk_test_data)`, invokes the shielded-pool seeder), then
-/// dumps the resulting subtree. Self-contained — `config` is ignored
-/// (we use a tempdir + sensible defaults).
-///
-/// Intended for the Dockerfile bake stage: produce a snapshot once during
-/// image build, embed in the runtime image, load it at every InitChain via
-/// `DRIVE_SHIELDED_SNAPSHOT`.
-#[cfg(create_sdk_test_data)]
-fn snapshot_bake(_config: &PlatformConfig, out_path: &std::path::Path) -> Result<(), String> {
-    use dpp::version::PlatformVersion;
-    use drive_abci::config::PlatformConfig;
-    use drive_abci::platform_types::platform::Platform;
+    /// Produce a shielded-pool snapshot at `out_path` from a fresh temporary
+    /// GroveDB. Runs the full `create_genesis_state` cycle (which, under
+    /// `feature = "shielded_test_data"`, invokes the shielded-pool seeder),
+    /// then dumps the resulting subtree. Self-contained — `_config` is
+    /// ignored (we use a tempdir + sensible defaults).
+    ///
+    /// Intended for the Dockerfile bake stage: produce a snapshot once during
+    /// image build, embed in the runtime image, load it at every InitChain
+    /// via `DRIVE_SHIELDED_SNAPSHOT`.
+    pub(super) fn run(_config: &PlatformConfig, out_path: &std::path::Path) -> Result<(), String> {
+        tracing::info!(
+            out = %out_path.display(),
+            "snapshot-bake: creating tempdir + bootstrapping fresh GroveDB",
+        );
+
+        let tempdir = tempfile::tempdir().map_err(|e| format!("tempdir: {e}"))?;
 
-    tracing::info!(
-        out = %out_path.display(),
-        "snapshot-bake: creating tempdir + bootstrapping fresh GroveDB",
-    );
-
-    let tempdir = tempfile::tempdir().map_err(|e| format!("tempdir: {e}"))?;
-
-    // Use the local (regtest) config — same network the bake target image
-    // will run on. We use NoopCoreRPC so we don't try to connect to a
-    // non-existent Core node during the in-container bake.
-    let mut platform_config = PlatformConfig::default_local();
-    platform_config.db_path = tempdir.path().to_path_buf();
-
-    let platform = Platform::<NoopCoreRPC>::open_with_client(
-        tempdir.path(),
-        Some(platform_config),
-        NoopCoreRPC,
-        None,
-    )
-    .map_err(|e| format!("open platform: {e}"))?;
-
-    let platform_version = PlatformVersion::latest();
-    let tx = platform.drive.grove.start_transaction();
-
-    // Defensively unset DRIVE_SHIELDED_SNAPSHOT before seeding. The seeder
-    // (`create_data_for_shielded_pool`) checks this env var first and, if set,
-    // APPLIES the referenced snapshot instead of running the seeder. A developer
-    // (or the Dockerfile env) with it exported would make `snapshot-bake`
-    // recursively re-dump an inherited snapshot rather than seeding a fresh one.
-    std::env::remove_var("DRIVE_SHIELDED_SNAPSHOT");
-
-    tracing::info!("snapshot-bake: running create_genesis_state (seeds shielded pool under cfg(create_sdk_test_data))");
-    platform
-        .create_genesis_state(
-            1, // genesis_core_height (placeholder for bake)
-            0, // genesis_time (placeholder for bake)
-            Some(&tx),
+        // Use the local (regtest) config — same network the bake target image
+        // will run on. We use NoopCoreRPC so we don't try to connect to a
+        // non-existent Core node during the in-container bake.
+        let mut platform_config = PlatformConfig::default_local();
+        platform_config.db_path = tempdir.path().to_path_buf();
+
+        let platform = Platform::<NoopCoreRPC>::open_with_client(
+            tempdir.path(),
+            Some(platform_config),
+            NoopCoreRPC,
+            None,
+        )
+        .map_err(|e| format!("open platform: {e}"))?;
+
+        let platform_version = PlatformVersion::latest();
+        let tx = platform.drive.grove.start_transaction();
+
+        // Defensively unset DRIVE_SHIELDED_SNAPSHOT before seeding. The seeder
+        // (`create_data_for_shielded_pool`) checks this env var first and, if
+        // set, APPLIES the referenced snapshot instead of running the seeder.
+        // A developer (or the Dockerfile env) with it exported would make
+        // `snapshot-bake` recursively re-dump an inherited snapshot rather
+        // than seeding a fresh one.
+        std::env::remove_var("DRIVE_SHIELDED_SNAPSHOT");
+
+        tracing::info!("snapshot-bake: running create_genesis_state (seeds shielded pool under feature = \"shielded_test_data\")");
+        platform
+            .create_genesis_state(
+                1, // genesis_core_height (placeholder for bake)
+                0, // genesis_time (placeholder for bake)
+                Some(&tx),
+                platform_version,
+            )
+            .map_err(|e| format!("create_genesis_state: {e}"))?;
+        tx.commit().map_err(|e| format!("commit: {e}"))?;
+
+        tracing::info!(
+            out = %out_path.display(),
+            "snapshot-bake: dumping shielded subtree to snapshot file",
+        );
+        let stats = drive_abci::shielded_snapshot::dump_shielded_subtree(
+            &platform.drive.grove,
+            None,
+            out_path,
             platform_version,
         )
-        .map_err(|e| format!("create_genesis_state: {e}"))?;
-    tx.commit().map_err(|e| format!("commit: {e}"))?;
-
-    tracing::info!(
-        out = %out_path.display(),
-        "snapshot-bake: dumping shielded subtree to snapshot file",
-    );
-    let stats = drive_abci::shielded_snapshot::dump_shielded_subtree(
-        &platform.drive.grove,
-        None,
-        out_path,
-        platform_version,
-    )
-    .map_err(|e| format!("snapshot dump failed: {e}"))?;
-
-    tracing::info!(
-        out = %out_path.display(),
-        total_count = stats.total_count,
-        key_count = stats.key_count,
-        sst_bytes = stats.sst_bytes,
-        "snapshot-bake: wrote shielded-pool snapshot",
-    );
-    println!(
-        "wrote {} bytes ({} keys, total_count={}) to {}",
-        stats.sst_bytes,
-        stats.key_count,
-        stats.total_count,
-        out_path.display(),
-    );
+        .map_err(|e| format!("snapshot dump failed: {e}"))?;
+
+        tracing::info!(
+            out = %out_path.display(),
+            total_count = stats.total_count,
+            key_count = stats.key_count,
+            sst_bytes = stats.sst_bytes,
+            "snapshot-bake: wrote shielded-pool snapshot",
+        );
+        println!(
+            "wrote {} bytes ({} keys, total_count={}) to {}",
+            stats.sst_bytes,
+            stats.key_count,
+            stats.total_count,
+            out_path.display(),
+        );
 
-    Ok(())
+        Ok(())
+    }
 }
 
 fn list_enabled_features() -> Vec<&'static str> {
diff --git a/packages/rs-drive-abci/src/shielded_snapshot/mod.rs b/packages/rs-drive-abci/src/shielded_snapshot/mod.rs
index 82fbf1c339a..342b7748283 100644
--- a/packages/rs-drive-abci/src/shielded_snapshot/mod.rs
+++ b/packages/rs-drive-abci/src/shielded_snapshot/mod.rs
@@ -14,7 +14,7 @@
 //!   the underlying RocksDB, cross-validates the reconstructed state against
 //!   the header's `combined_root`, then writes the parent-Merk
 //!   `Element::CommitmentTree` leaf via the new
-//!   `GroveDb::replace_commitment_tree_subtree_root` public API.
+//!   `GroveDb::replace_subtree_root` public API.
 //!
 //! Built on three new public methods we added to grovedb on the
 //! `feat/snapshot-apply-public-api` branch:
@@ -22,7 +22,7 @@
 //! 1. `GroveDb::raw_storage()` — escape hatch to the underlying
 //!    `RocksDbStorage` so we can open a `StorageContext` for raw iteration.
 //! 2. `GroveDb::ingest_subtree_sst(cf, sst_path)` — bulk-ingest an SST file.
-//! 3. `GroveDb::replace_commitment_tree_subtree_root(...)` — patch the
+//! 3. `GroveDb::replace_subtree_root(...)` — patch the
 //!    parent-Merk `Element::CommitmentTree` leaf with a caller-provided
 //!    `combined_root`.
 //!
@@ -559,21 +559,18 @@ pub fn apply_shielded_snapshot(
     let leaf_key = &[SHIELDED_NOTES_KEY];
     let flags = header.flags.map(|b| vec![b]);
 
+    let new_element = Element::new_commitment_tree(header.total_count, header.chunk_power, flags);
     grove
-        .replace_commitment_tree_subtree_root(
+        .replace_subtree_root(
             parent_path,
             leaf_key,
-            header.total_count,
-            header.chunk_power,
-            flags,
+            new_element,
             header.combined_root,
             transaction,
             &platform_version.drive.grove_version,
         )
         .value
-        .map_err(|e| {
-            ShieldedSnapshotError::GroveDb(format!("replace_commitment_tree_subtree_root: {e}"))
-        })?;
+        .map_err(|e| ShieldedSnapshotError::GroveDb(format!("replace_subtree_root: {e}")))?;
 
     Ok(ApplyStats {
         total_count: header.total_count,
diff --git a/packages/rs-drive/Cargo.toml b/packages/rs-drive/Cargo.toml
index c893ae54b9a..48b3d8cfc75 100644
--- a/packages/rs-drive/Cargo.toml
+++ b/packages/rs-drive/Cargo.toml
@@ -52,12 +52,12 @@ enum-map = { version = "2.0.3", optional = true }
 intmap = { version = "3.0.1", features = ["serde"], optional = true }
 chrono = { version = "0.4.35", optional = true }
 itertools = { version = "0.13", optional = true }
-grovedb = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", optional = true, default-features = false }
-grovedb-costs = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", optional = true }
-grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
-grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", optional = true }
-grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
-grovedb-epoch-based-storage-flags = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
+grovedb = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", optional = true, default-features = false }
+grovedb-costs = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", optional = true }
+grovedb-path = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
+grovedb-storage = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", optional = true }
+grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
+grovedb-epoch-based-storage-flags = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
 
 [dev-dependencies]
 criterion = "0.5"
@@ -130,6 +130,12 @@ server = [
 full = ["server", "ciborium", "serde", "bs58", "tempfile", "base64", "chrono"]
 cbor_query = ["ciborium", "dpp/platform-value-cbor", "dpp/cbor"]
 grovedb_operations_logging = []
+# Pass-through to grovedb's `unsafe-dump-load` feature — unlocks the
+# snapshot-bootstrap escape hatches (`raw_storage`, `ingest_subtree_sst`,
+# `replace_subtree_root`). Named after the drive-abci consumer feature
+# (`shielded_test_data`) rather than the grovedb primitive because in this
+# tree the only use case for these APIs is shielded-pool test seeding.
+shielded_test_data = ["grovedb/unsafe-dump-load"]
 verify = [
   "grovedb/verify",
   "grovedb-costs",
diff --git a/packages/rs-platform-version/Cargo.toml b/packages/rs-platform-version/Cargo.toml
index 125441aaaa8..cbcd9702ad8 100644
--- a/packages/rs-platform-version/Cargo.toml
+++ b/packages/rs-platform-version/Cargo.toml
@@ -11,7 +11,7 @@ license = "MIT"
 thiserror = { version = "2.0.12" }
 bincode = { version = "=2.0.1" }
 versioned-feature-core = { git = "https://github.com/dashpay/versioned-feature-core", version = "1.0.0" }
-grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c" }
+grovedb-version = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b" }
 
 [features]
 mock-versions = []
diff --git a/packages/rs-platform-wallet/Cargo.toml b/packages/rs-platform-wallet/Cargo.toml
index b92f03cfa14..e9ea678eb55 100644
--- a/packages/rs-platform-wallet/Cargo.toml
+++ b/packages/rs-platform-wallet/Cargo.toml
@@ -49,7 +49,7 @@ image = { version = "0.25", default-features = false, features = ["png", "jpeg",
 zeroize = "1"
 
 # Shielded pool (optional, behind `shielded` feature)
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", optional = true }
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", optional = true }
 # Direct `rusqlite` access so `FileBackedShieldedStore::open_path` can set
 # WAL + synchronous=NORMAL pragmas before handing the connection to
 # `ClientPersistentCommitmentTree`. Version locked to match the rev grovedb
diff --git a/packages/rs-sdk/Cargo.toml b/packages/rs-sdk/Cargo.toml
index d918fee30ef..97bdbcb1300 100644
--- a/packages/rs-sdk/Cargo.toml
+++ b/packages/rs-sdk/Cargo.toml
@@ -18,7 +18,7 @@ drive = { path = "../rs-drive", default-features = false, features = [
 ] }
 
 drive-proof-verifier = { path = "../rs-drive-proof-verifier", default-features = false }
-grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "5eb7a5380a6e974513343352acfd6b30a8c1f87c", features = [
+grovedb-commitment-tree = { git = "https://github.com/dashpay/grovedb", rev = "a18f7929460ef9c5d814f61ff84d8805b2a1761b", features = [
   "client",
   "sqlite",
 ], optional = true }