diff --git a/rtl/system/sonata_system.sv b/rtl/system/sonata_system.sv
index 849632d9d..2fedd5151 100644
--- a/rtl/system/sonata_system.sv
+++ b/rtl/system/sonata_system.sv
@@ -734,7 +734,8 @@ module sonata_system
     .HeapBase        ( tl_main_pkg::ADDR_SPACE_SRAM            ),
     .TSMapBase       ( tl_main_pkg::ADDR_SPACE_REV_TAG         ),
     .TSMapSize       ( RevTagDepth                             ),
-    .RV32B           ( ibex_pkg::RV32BFull                     ),
+    .RV32M           ( ibex_pkg::RV32MFast                     ),
+    .RV32B           ( ibex_pkg::RV32BNone                     ),
     .ICache          ( 1'b1                                    )
   ) u_top_tracing (
     .clk_i                  (clk_sys_i),
diff --git a/rtl/system/sram.sv b/rtl/system/sram.sv
index 76ec17cd7..5e83c03f6 100644
--- a/rtl/system/sram.sv
+++ b/rtl/system/sram.sv
@@ -59,7 +59,8 @@ module sram #(
   // TL-UL device adapters
   tlul_adapter_sram #(
     .SramAw           ( SramAw ),
-    .EnableRspIntgGen ( 0      )
+    .EnableRspIntgGen ( 0      ),
+    .Outstanding      ( 2      )
   ) sram_a_device_adapter (
     .clk_i,
     .rst_ni,
@@ -96,7 +97,8 @@ module sram #(
 
   tlul_adapter_sram #(
     .SramAw           ( SramAw ),
-    .EnableRspIntgGen ( 0      )
+    .EnableRspIntgGen ( 0      ),
+    .Outstanding      ( 2      )
   ) sram_b_device_adapter (
     .clk_i,
     .rst_ni,
diff --git a/vendor/lowrisc_ibex.lock.hjson b/vendor/lowrisc_ibex.lock.hjson
index 2572a83f2..4289d933f 100644
--- a/vendor/lowrisc_ibex.lock.hjson
+++ b/vendor/lowrisc_ibex.lock.hjson
@@ -9,6 +9,6 @@
   upstream:
   {
     url: https://github.com/lowrisc/cheriot-ibex.git
-    rev: adc4803d5d13cdf5a629b3f53fb4ce8d1ac38fe5
+    rev: ea2df9db3bcea776f0dc72d6d89c31c73798ecd4
   }
 }
diff --git a/vendor/lowrisc_ibex/rtl/ibexc_top.sv b/vendor/lowrisc_ibex/rtl/ibexc_top.sv
index e725f7fdb..bf3bdeb66 100644
--- a/vendor/lowrisc_ibex/rtl/ibexc_top.sv
+++ b/vendor/lowrisc_ibex/rtl/ibexc_top.sv
@@ -26,6 +26,7 @@ module ibexc_top import ibex_pkg::*; import cheri_pkg::*; #(
   parameter int unsigned MHPMCounterNum   = 0,
   parameter int unsigned MHPMCounterWidth = 40,
   parameter bit          RV32E            = 1'b0,
+  parameter rv32m_e      RV32M            = RV32MFast,
   parameter rv32b_e      RV32B            = RV32BNone,
   parameter bit          WritebackStage   = 1'b1,
   parameter bit          BranchPredictor  = 1'b0,
@@ -258,8 +259,8 @@ module ibexc_top import ibex_pkg::*; import cheri_pkg::*; #(
     .MHPMCounterNum   (MHPMCounterNum  ),
     .MHPMCounterWidth (MHPMCounterWidth),
     .RV32E            (RV32E),
-    .RV32M            (RV32MFast),
-    .RV32B            (RV32BNone),
+    .RV32M            (RV32M),
+    .RV32B            (RV32B),
     .BranchTargetALU  (1'b1),
     .ICache           (ICache),
     .ICacheECC        (1'b0),
diff --git a/vendor/lowrisc_ibex/rtl/ibexc_top_tracing.sv b/vendor/lowrisc_ibex/rtl/ibexc_top_tracing.sv
index f89489bc0..8c2d0083a 100644
--- a/vendor/lowrisc_ibex/rtl/ibexc_top_tracing.sv
+++ b/vendor/lowrisc_ibex/rtl/ibexc_top_tracing.sv
@@ -14,12 +14,13 @@ module ibexc_top_tracing import ibex_pkg::*; import cheri_pkg::*; #(
   parameter int unsigned DmHaltAddr       = 32'h1A110800,
   parameter int unsigned DmExceptionAddr  = 32'h1A110808,
   parameter bit          RV32E            = 1'b0,
+  parameter rv32m_e      RV32M            = RV32MFast,
+  parameter rv32b_e      RV32B            = RV32BNone,
   parameter bit          CheriTBRE        = 1'b1,
   parameter bit          CheriStkZ        = 1'b1,
   parameter bit          DbgTriggerEn     = 1'b1,
   parameter int unsigned DbgHwBreakNum    = 4,
   parameter int unsigned MHPMCounterNum   = 0,
-  parameter rv32b_e      RV32B            = RV32BFull,
   parameter int unsigned HeapBase         = 32'h2001_0000,
   parameter int unsigned TSMapBase        = 32'h2004_0000, // 4kB default
   parameter int unsigned TSMapSize        = 1024,          // in words
@@ -155,6 +156,7 @@ module ibexc_top_tracing import ibex_pkg::*; import cheri_pkg::*; #(
     .DbgTriggerEn     (DbgTriggerEn),
     .DbgHwBreakNum    (DbgHwBreakNum),
     .RV32E            (RV32E),
+    .RV32M            (RV32M),
     .RV32B            (RV32B),
     .WritebackStage   (1'b1),
     .BranchPredictor  (1'b0),